@openscout/scout 0.2.92 → 0.2.94

package/dist/node/main.mjs

@@ -14397,9 +14397,9 @@ var require_cjs11 = __commonJS((exports) => {
 
 // ../runtime/dist/broker-process-manager.js
 import { spawn as spawn2, spawnSync } from "node:child_process";
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync4, renameSync as renameSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync5, renameSync as renameSync3, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir5, networkInterfaces } from "node:os";
-import { dirname as dirname3, join as join5, resolve as resolve2 } from "node:path";
+import { dirname as dirname4, join as join6, resolve as resolve2 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // ../runtime/dist/broker-api.js
@@ -16224,9 +16224,202 @@ function readTailscaleSelfWebHostsSync(env = process.env) {
 }
 
 // ../runtime/dist/local-config.js
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, renameSync as renameSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import { homedir as homedir3, hostname as osHostname } from "node:os";
+import { dirname as dirname2, join as join4 } from "node:path";
+
+// ../runtime/dist/node-identity.js
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, sign, verify } from "node:crypto";
+import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname, join as join3 } from "node:path";
+var NODE_IDENTITY_FILE = "node-identity.json";
+var NODE_FINGERPRINT_PREFIX = "osc1";
+var NODE_CARD_TTL_MS = 24 * 60 * 60 * 1000;
+var stableNodeQualifierCache = new Map;
+function stripBonjourCollisionSuffix(value) {
+  if (!value || typeof value !== "string")
+    return "";
+  let trimmed = value.trim();
+  const isDotLocal = /\.local\.?$/i.test(trimmed);
+  if (isDotLocal) {
+    trimmed = trimmed.replace(/\.local\.?$/i, "");
+  }
+  const isHyphenLocalOpenscout = /-local-openscout$/i.test(trimmed);
+  const isHyphenLocal = !isHyphenLocalOpenscout && /-local$/i.test(trimmed);
+  if (isHyphenLocalOpenscout) {
+    trimmed = trimmed.replace(/-local-openscout$/i, "");
+  } else if (isHyphenLocal) {
+    trimmed = trimmed.replace(/-local$/i, "");
+  }
+  if (!isDotLocal && !isHyphenLocalOpenscout && !isHyphenLocal) {
+    return trimmed;
+  }
+  trimmed = trimmed.replace(/(?<=[a-zA-Z].*?)(?:-\d+)+$/, "");
+  if (isDotLocal)
+    return `${trimmed}.local`;
+  if (isHyphenLocalOpenscout)
+    return `${trimmed}-local-openscout`;
+  if (isHyphenLocal)
+    return `${trimmed}-local`;
+  return trimmed;
+}
+function nodeIdentityPath(supportDirectory) {
+  const dir = supportDirectory ?? resolveOpenScoutSupportPaths().supportDirectory;
+  return join3(dir, NODE_IDENTITY_FILE);
+}
+function loadOrCreateNodeIdentity(supportDirectory) {
+  const path = nodeIdentityPath(supportDirectory);
+  if (existsSync4(path)) {
+    return readAndValidateNodeIdentity(path);
+  }
+  return createNodeIdentity(supportDirectory);
+}
+function readStableNodeQualifier(supportDirectory) {
+  const path = nodeIdentityPath(supportDirectory);
+  const cached = stableNodeQualifierCache.get(path);
+  if (cached) {
+    return cached;
+  }
+  if (!existsSync4(path)) {
+    return null;
+  }
+  const nodeQualifier = normalizeNodeQualifier(readAndValidateNodeIdentity(path).nodeQualifier);
+  if (nodeQualifier) {
+    stableNodeQualifierCache.set(path, nodeQualifier);
+  }
+  return nodeQualifier || null;
+}
+function readAndValidateNodeIdentity(path) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync3(path, "utf8"));
+  } catch {
+    throw new Error(`Corrupt node identity at ${path}; remove it to generate a fresh one.`);
+  }
+  if (parsed.version !== 1 || !parsed.publicKey || !parsed.privateKey) {
+    throw new Error(`Corrupt node identity at ${path}; remove it to generate a fresh one.`);
+  }
+  if (parsed.nodeQualifier !== undefined && normalizePersistedNodeQualifier(parsed.nodeQualifier) !== parsed.nodeQualifier) {
+    throw new Error(`Corrupt node identity at ${path}; remove it to generate a fresh one.`);
+  }
+  try {
+    const derived = createPublicKey(importPrivateKey(parsed.privateKey)).export({ type: "spki", format: "der" }).toString("base64");
+    if (derived !== parsed.publicKey) {
+      throw new Error("mismatch");
+    }
+  } catch {
+    throw new Error(`Node identity at ${path} has mismatched or invalid keys; remove it to generate a fresh one.`);
+  }
+  return parsed;
+}
+function normalizePersistedNodeQualifier(value) {
+  return typeof value === "string" ? value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "") : "";
+}
+function normalizeNodeQualifier(value) {
+  return stripBonjourCollisionSuffix(normalizePersistedNodeQualifier(value));
+}
+function createNodeIdentity(supportDirectory) {
+  if (!supportDirectory) {
+    assertTestIsolatedUserData("write the node identity", "OPENSCOUT_SUPPORT_DIRECTORY");
+  }
+  const path = nodeIdentityPath(supportDirectory);
+  const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+  const identity = {
+    version: 1,
+    publicKey: publicKey.export({ type: "spki", format: "der" }).toString("base64"),
+    privateKey: privateKey.export({ type: "pkcs8", format: "der" }).toString("base64"),
+    createdAt: Date.now()
+  };
+  mkdirSync2(dirname(path), { recursive: true });
+  try {
+    writeFileSync2(path, `${JSON.stringify(identity, null, 2)}
+`, { encoding: "utf8", mode: 384, flag: "wx" });
+  } catch (error) {
+    if (error.code === "EEXIST") {
+      return readAndValidateNodeIdentity(path);
+    }
+    throw error;
+  }
+  try {
+    chmodSync(path, 384);
+  } catch {}
+  return identity;
+}
+function nodeKeyId(publicKeyBase64) {
+  return createHash("sha256").update(Buffer.from(publicKeyBase64, "base64")).digest("hex");
+}
+function nodeFingerprint(publicKeyBase64) {
+  const digest = createHash("sha256").update(Buffer.from(publicKeyBase64, "base64")).digest();
+  const encoded = base32Encode(digest.subarray(0, 10)).toLowerCase();
+  return `${NODE_FINGERPRINT_PREFIX}:${encoded.slice(0, 4)}-${encoded.slice(4, 8)}`;
+}
+function signNodePayload(identity, payload) {
+  const key = importPrivateKey(identity.privateKey);
+  return sign(null, typeof payload === "string" ? Buffer.from(payload, "utf8") : payload, key).toString("base64");
+}
+function verifyNodeSignature(publicKeyBase64, payload, signatureBase64) {
+  try {
+    const key = importPublicKey(publicKeyBase64);
+    return verify(null, typeof payload === "string" ? Buffer.from(payload, "utf8") : payload, key, Buffer.from(signatureBase64, "base64"));
+  } catch {
+    return false;
+  }
+}
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalJson).join(",")}]`;
+  }
+  const record = value;
+  const keys = Object.keys(record).sort();
+  return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
+}
+function verifySignedNodeCard(card, now = Date.now()) {
+  if (nodeKeyId(card.publicKey) !== card.keyId) {
+    return false;
+  }
+  if (nodeFingerprint(card.publicKey) !== card.fingerprint) {
+    return false;
+  }
+  if (!Number.isFinite(card.expiresAt) || card.expiresAt <= now) {
+    return false;
+  }
+  if (card.tls !== undefined) {
+    if (typeof card.tls !== "object" || card.tls === null || typeof card.tls.spkiFingerprint !== "string" || !/^[0-9a-f]{64}$/.test(card.tls.spkiFingerprint)) {
+      return false;
+    }
+  }
+  const { signature, ...unsigned } = card;
+  return verifyNodeSignature(card.publicKey, canonicalJson(unsigned), signature);
+}
+var BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+function base32Encode(input) {
+  let bits = 0;
+  let value = 0;
+  let output = "";
+  for (const byte of input) {
+    value = value << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      output += BASE32_ALPHABET[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) {
+    output += BASE32_ALPHABET[value << 5 - bits & 31];
+  }
+  return output;
+}
+function importPrivateKey(privateKeyBase64) {
+  return createPrivateKey({ key: Buffer.from(privateKeyBase64, "base64"), format: "der", type: "pkcs8" });
+}
+function importPublicKey(publicKeyBase64) {
+  return createPublicKey({ key: Buffer.from(publicKeyBase64, "base64"), format: "der", type: "spki" });
+}
+
+// ../runtime/dist/local-config.js
 var LOCAL_CONFIG_VERSION = 1;
 var DEFAULT_SCOUT_WEB_PORTAL_HOST = "scout.local";
 var DEFAULT_SCOUT_WEB_DEV_HOST = `dev.${DEFAULT_SCOUT_WEB_PORTAL_HOST}`;
@@ -16251,17 +16444,17 @@ var DEFAULT_LOCAL_CONFIG = {
   }
 };
 function localConfigHome() {
-  return process.env.OPENSCOUT_HOME ?? join3(homedir3(), ".openscout");
+  return process.env.OPENSCOUT_HOME ?? join4(homedir3(), ".openscout");
 }
 function localConfigPath() {
-  return join3(localConfigHome(), "config.json");
+  return join4(localConfigHome(), "config.json");
 }
 function loadLocalConfig() {
   const configPath = localConfigPath();
-  if (!existsSync4(configPath))
+  if (!existsSync5(configPath))
     return { version: LOCAL_CONFIG_VERSION };
   try {
-    return validateLocalConfig(JSON.parse(readFileSync3(configPath, "utf8")));
+    return validateLocalConfig(JSON.parse(readFileSync4(configPath, "utf8")));
   } catch {
     return { version: LOCAL_CONFIG_VERSION };
   }
@@ -16339,34 +16532,34 @@ function resolveBrokerPort() {
 function writeLocalConfig(config) {
   assertTestIsolatedUserData("write the OpenScout local config", "OPENSCOUT_HOME");
   const configPath = localConfigPath();
-  mkdirSync2(dirname(configPath), { recursive: true });
+  mkdirSync3(dirname2(configPath), { recursive: true });
   const body = JSON.stringify({ ...config, version: LOCAL_CONFIG_VERSION }, null, 2) + `
 `;
   const tmp = `${configPath}.tmp`;
-  writeFileSync2(tmp, body, "utf8");
-  renameSync(tmp, configPath);
+  writeFileSync3(tmp, body, "utf8");
+  renameSync2(tmp, configPath);
 }
 function localConfigExists() {
-  return existsSync4(localConfigPath());
+  return existsSync5(localConfigPath());
 }
 
 // ../runtime/dist/tool-resolution.js
-import { accessSync, constants, existsSync as existsSync5 } from "node:fs";
+import { accessSync, constants, existsSync as existsSync6 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { basename, dirname as dirname2, join as join4, resolve } from "node:path";
+import { basename, dirname as dirname3, join as join5, resolve } from "node:path";
 var DEFAULT_COMMON_EXECUTABLE_DIRECTORIES = [
-  join4(homedir4(), ".bun", "bin"),
+  join5(homedir4(), ".bun", "bin"),
   "/opt/homebrew/bin",
   "/usr/local/bin"
 ];
 function commonClaudeExecutableDirectories(env) {
   const home = env.HOME ?? homedir4();
   return [
-    join4(home, ".local", "bin"),
-    join4(home, ".claude", "local"),
+    join5(home, ".local", "bin"),
+    join5(home, ".claude", "local"),
     "/opt/homebrew/bin",
     "/usr/local/bin",
-    join4(home, ".bun", "bin")
+    join5(home, ".bun", "bin")
   ];
 }
 function expandHomePath(value, env = process.env) {
@@ -16375,7 +16568,7 @@ function expandHomePath(value, env = process.env) {
     return home;
   }
   if (value.startsWith("~/")) {
-    return join4(home, value.slice(2));
+    return join5(home, value.slice(2));
   }
   return value;
 }
@@ -16432,7 +16625,7 @@ function resolveExecutableFromSearch(options) {
   ], env);
   for (const directory of searchDirectories) {
     for (const name of options.names) {
-      const candidate = join4(directory, name);
+      const candidate = join5(directory, name);
       if (isExecutablePath(candidate)) {
         return {
           path: candidate,
@@ -16446,7 +16639,7 @@ function resolveExecutableFromSearch(options) {
 function resolveExecutableFromDirectories(directories, names, env, source) {
   for (const directory of dedupeDirectories(directories, env)) {
     for (const name of names) {
-      const candidate = join4(directory, name);
+      const candidate = join5(directory, name);
       if (isExecutablePath(candidate)) {
         return { path: candidate, source };
       }
@@ -16484,7 +16677,7 @@ function findExecutableOnSearchPath(name, env) {
     ...DEFAULT_COMMON_EXECUTABLE_DIRECTORIES
   ], env);
   for (const directory of searchDirectories) {
-    const candidate = join4(directory, name);
+    const candidate = join5(directory, name);
     if (isExecutablePath(candidate)) {
       return { path: candidate, source: "path" };
     }
@@ -16502,14 +16695,14 @@ var DEFAULT_ADVERTISE_SCOPE = "local";
 var MESH_BIND_CONFIG_FILE = "mesh-bind.json";
 function meshBindConfigPath(supportDirectory) {
   const dir = supportDirectory ?? resolveOpenScoutSupportPaths().supportDirectory;
-  return join5(dir, MESH_BIND_CONFIG_FILE);
+  return join6(dir, MESH_BIND_CONFIG_FILE);
 }
 function readPersistedAdvertiseScope(supportDirectory) {
   const path = meshBindConfigPath(supportDirectory);
-  if (!existsSync6(path))
+  if (!existsSync7(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    const parsed = JSON.parse(readFileSync5(path, "utf8"));
     if (parsed.version !== 1)
       return null;
     if (parsed.advertiseScope === "mesh" || parsed.advertiseScope === "local") {
@@ -16628,7 +16821,7 @@ function isWildcardHost(host) {
   return trimmed === "0.0.0.0" || trimmed === "::" || trimmed === "[::]";
 }
 function buildDefaultBrokerSocketPath(runtimeDirectory) {
-  return join5(runtimeDirectory, "broker.sock");
+  return join6(runtimeDirectory, "broker.sock");
 }
 var DEFAULT_BROKER_URL = buildDefaultBrokerUrl();
 function resolveScoutBrokerControlUrl(_config = resolveBrokerServiceConfig()) {
@@ -16647,17 +16840,17 @@ function runtimePackageDir() {
   const fromGlobal = findGlobalRuntimeDir();
   if (fromGlobal)
     return fromGlobal;
-  const moduleDir = dirname3(fileURLToPath(import.meta.url));
+  const moduleDir = dirname4(fileURLToPath(import.meta.url));
   return resolve2(moduleDir, "..");
 }
 function isInstalledRuntimePackageDir(candidate) {
-  return existsSync6(join5(candidate, "package.json")) && existsSync6(join5(candidate, "bin", "openscout-runtime.mjs"));
+  return existsSync7(join6(candidate, "package.json")) && existsSync7(join6(candidate, "bin", "openscout-runtime.mjs"));
 }
 function findGlobalRuntimeDir() {
   const candidates = [
-    join5(homedir5(), ".bun", "node_modules", "@openscout", "runtime"),
-    join5(homedir5(), ".bun", "install", "global", "node_modules", "@openscout", "runtime"),
-    join5(homedir5(), ".bun", "install", "global", "node_modules", "@openscout", "scout", "node_modules", "@openscout", "runtime")
+    join6(homedir5(), ".bun", "node_modules", "@openscout", "runtime"),
+    join6(homedir5(), ".bun", "install", "global", "node_modules", "@openscout", "runtime"),
+    join6(homedir5(), ".bun", "install", "global", "node_modules", "@openscout", "scout", "node_modules", "@openscout", "runtime")
   ];
   for (const c of candidates) {
     if (isInstalledRuntimePackageDir(c))
@@ -16670,7 +16863,7 @@ function findGlobalRuntimeDir() {
       const scoutPkg = resolve2(scoutBin, "..", "..");
       if (isInstalledRuntimePackageDir(scoutPkg))
         return scoutPkg;
-      const nested = join5(scoutPkg, "node_modules", "@openscout", "runtime");
+      const nested = join6(scoutPkg, "node_modules", "@openscout", "runtime");
       if (isInstalledRuntimePackageDir(nested))
         return nested;
       const sibling = resolve2(scoutPkg, "..", "runtime");
@@ -16681,7 +16874,7 @@ function findGlobalRuntimeDir() {
   return null;
 }
 function findBundledRuntimeDir() {
-  const moduleDir = dirname3(fileURLToPath(import.meta.url));
+  const moduleDir = dirname4(fileURLToPath(import.meta.url));
   return resolveBundledRuntimeDirFromModuleDir(moduleDir);
 }
 function resolveBundledRuntimeDirFromModuleDir(moduleDir) {
@@ -16698,11 +16891,11 @@ function resolveBundledRuntimeDirFromModuleDir(moduleDir) {
 function findWorkspaceRuntimeDir(startDir) {
   let current = resolve2(startDir);
   while (true) {
-    const candidate = join5(current, "packages", "runtime");
-    if (existsSync6(join5(candidate, "package.json")) && existsSync6(join5(candidate, "src"))) {
+    const candidate = join6(current, "packages", "runtime");
+    if (existsSync7(join6(candidate, "package.json")) && existsSync7(join6(candidate, "src"))) {
       return candidate;
     }
-    const parent = dirname3(current);
+    const parent = dirname4(current);
     if (parent === current)
       return null;
     current = parent;
@@ -16749,17 +16942,17 @@ function resolveBrokerServiceConfig() {
   const serviceAdapter = resolveBrokerServiceAdapter();
   const uid = typeof process.getuid === "function" ? process.getuid() : Number.parseInt(process.env.UID ?? "0", 10);
   const supportPaths = resolveOpenScoutSupportPaths();
-  const defaultSupportDir = join5(homedir5(), "Library", "Application Support", "OpenScout");
+  const defaultSupportDir = join6(homedir5(), "Library", "Application Support", "OpenScout");
   const supportDirectory = isTmpPath(supportPaths.supportDirectory) ? defaultSupportDir : supportPaths.supportDirectory;
-  const runtimeDirectory = join5(supportDirectory, "runtime");
-  const logsDirectory = join5(supportDirectory, "logs", "broker");
-  const controlHome = isTmpPath(supportPaths.controlHome) ? join5(homedir5(), ".openscout", "control-plane") : supportPaths.controlHome;
+  const runtimeDirectory = join6(supportDirectory, "runtime");
+  const logsDirectory = join6(supportDirectory, "logs", "broker");
+  const controlHome = isTmpPath(supportPaths.controlHome) ? join6(homedir5(), ".openscout", "control-plane") : supportPaths.controlHome;
   const advertiseScope = resolveAdvertiseScope(process.env, () => readPersistedAdvertiseScope(supportDirectory));
   const brokerHost = resolveBrokerHost(advertiseScope);
   const brokerPort = Number.parseInt(process.env.OPENSCOUT_BROKER_PORT ?? String(resolveBrokerPort()), 10);
   const brokerUrl = resolveBrokerUrl(brokerHost, brokerPort, advertiseScope);
   const brokerSocketPath = process.env.OPENSCOUT_BROKER_SOCKET_PATH ?? buildDefaultBrokerSocketPath(runtimeDirectory);
-  const launchAgentPath = join5(homedir5(), "Library", "LaunchAgents", `${label}.plist`);
+  const launchAgentPath = join6(homedir5(), "Library", "LaunchAgents", `${label}.plist`);
   return {
     label,
     mode,
@@ -16770,8 +16963,8 @@ function resolveBrokerServiceConfig() {
     supportDirectory,
     runtimeDirectory,
     logsDirectory,
-    stdoutLogPath: join5(logsDirectory, "stdout.log"),
-    stderrLogPath: join5(logsDirectory, "stderr.log"),
+    stdoutLogPath: join6(logsDirectory, "stdout.log"),
+    stderrLogPath: join6(logsDirectory, "stderr.log"),
     controlHome,
     runtimePackageDir: runtimePackageDir(),
     bunExecutable: serviceAdapter === "macos-scoutd" ? resolveBunExecutable2() : resolveOptionalBunExecutable(),
@@ -16805,10 +16998,10 @@ function resolveEnvExecutable(value) {
 function findWorkspaceRootFromRuntimeDir(runtimePackageDir2) {
   let current = resolve2(runtimePackageDir2);
   while (true) {
-    if (existsSync6(join5(current, "Cargo.toml")) && existsSync6(join5(current, "crates", "scoutd", "Cargo.toml"))) {
+    if (existsSync7(join6(current, "Cargo.toml")) && existsSync7(join6(current, "crates", "scoutd", "Cargo.toml"))) {
       return current;
     }
-    const parent = dirname3(current);
+    const parent = dirname4(current);
     if (parent === current)
       return null;
     current = parent;
@@ -16825,13 +17018,13 @@ function resolveScoutdCommand(config = resolveBrokerServiceConfig()) {
   }
   const workspaceRoot = findWorkspaceRootFromRuntimeDir(config.runtimePackageDir);
   const packageCandidates = [
-    join5(config.runtimePackageDir, "bin", "scoutd"),
-    join5(config.runtimePackageDir, "native", "scoutd"),
-    join5(config.runtimePackageDir, "scoutd"),
-    workspaceRoot ? join5(workspaceRoot, "packages", "cli", "bin", "scoutd") : null,
-    workspaceRoot ? join5(workspaceRoot, "packages", "runtime", "bin", "scoutd") : null,
-    join5(config.runtimeDirectory, "scoutd"),
-    join5(dirname3(config.runtimePackageDir), "scout", "bin", "scoutd")
+    join6(config.runtimePackageDir, "bin", "scoutd"),
+    join6(config.runtimePackageDir, "native", "scoutd"),
+    join6(config.runtimePackageDir, "scoutd"),
+    workspaceRoot ? join6(workspaceRoot, "packages", "cli", "bin", "scoutd") : null,
+    workspaceRoot ? join6(workspaceRoot, "packages", "runtime", "bin", "scoutd") : null,
+    join6(config.runtimeDirectory, "scoutd"),
+    join6(dirname4(config.runtimePackageDir), "scout", "bin", "scoutd")
   ];
   for (const candidate of packageCandidates) {
     const resolved = executableCandidate(candidate);
@@ -16845,8 +17038,8 @@ function resolveScoutdCommand(config = resolveBrokerServiceConfig()) {
   }
   if (workspaceRoot && workspaceScoutdAllowed()) {
     for (const candidate of [
-      join5(workspaceRoot, "target", "release", "scoutd"),
-      join5(workspaceRoot, "target", "debug", "scoutd")
+      join6(workspaceRoot, "target", "release", "scoutd"),
+      join6(workspaceRoot, "target", "debug", "scoutd")
     ]) {
       const resolved = executableCandidate(candidate);
       if (resolved) {
@@ -16931,7 +17124,7 @@ function normalizeNativeServiceStatus(input, config) {
   const healthMeshId = readString2(healthRecord.meshId);
   const healthSocketFallbackError = readString2(healthRecord.socketFallbackError);
   const healthCounts = isRecord3(healthRecord.counts) ? healthRecord.counts : undefined;
-  const installed = readBoolean(input.installed) ?? existsSync6(config.launchAgentPath);
+  const installed = readBoolean(input.installed) ?? existsSync7(config.launchAgentPath);
   const loaded = readBoolean(input.loaded) ?? false;
   const stdoutLogPath = readString2(input.stdoutLogPath) ?? config.stdoutLogPath;
   const stderrLogPath = readString2(input.stderrLogPath) ?? config.stderrLogPath;
@@ -17052,8 +17245,8 @@ var SCHEMA_GUARDED_SERVICE_COMMANDS = new Set([
   "restart"
 ]);
 function assertBrokerServiceSchemaCompatible(config) {
-  const databasePath = join5(config.controlHome, "control-plane.sqlite");
-  if (!existsSync6(databasePath))
+  const databasePath = join6(config.controlHome, "control-plane.sqlite");
+  if (!existsSync7(databasePath))
     return;
   const database = openControlPlaneSqliteDatabase(databasePath, { readonly: true });
   try {
@@ -17086,7 +17279,7 @@ async function runScoutdServiceCommand(command, config, timeoutMs = SCOUTD_DEFAU
 function readCoreAgentsSync() {
   try {
     const settingsPath = resolveOpenScoutSupportPaths().settingsPath;
-    const raw = readFileSync4(settingsPath, "utf8");
+    const raw = readFileSync5(settingsPath, "utf8");
     const settings = JSON.parse(raw);
     const raw_agents = settings?.agents?.coreAgents;
     if (Array.isArray(raw_agents)) {
@@ -17099,10 +17292,10 @@ function bootoutCommand(config) {
   return `/bin/launchctl bootout ${config.serviceTarget}`;
 }
 function readLogLines(path) {
-  if (!existsSync6(path)) {
+  if (!existsSync7(path)) {
     return [];
   }
-  return readFileSync4(path, "utf8").split(`
+  return readFileSync5(path, "utf8").split(`
 `).map((line) => line.trim()).filter(Boolean);
 }
 function isPackageScriptBanner(line) {
@@ -17326,15 +17519,15 @@ if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1] && !pr
 
 // ../runtime/dist/harness-catalog.js
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync7, statSync } from "node:fs";
+import { existsSync as existsSync8, statSync } from "node:fs";
 import { mkdir, readFile as readFile2, writeFile } from "node:fs/promises";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname4, join as join7 } from "node:path";
+import { dirname as dirname5, join as join8 } from "node:path";
 
 // ../agent-sessions/dist/codex-executable.js
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { accessSync as accessSync2, constants as constants2 } from "node:fs";
-import { delimiter, join as join6 } from "node:path";
+import { delimiter, join as join7 } from "node:path";
 function isExecutable(filePath) {
   if (!filePath)
     return false;
@@ -17378,11 +17571,11 @@ function codexAppBundleCandidates(env) {
   const appNames = ["Codex.app", "ChatGPT.app"];
   const candidates = appNames.flatMap((appName) => [
     {
-      path: join6("/Applications", appName, "Contents", "Resources", "codex"),
+      path: join7("/Applications", appName, "Contents", "Resources", "codex"),
       source: "codex_app_bundle"
     },
     {
-      path: join6(env.HOME ?? "", "Applications", appName, "Contents", "Resources", "codex"),
+      path: join7(env.HOME ?? "", "Applications", appName, "Contents", "Resources", "codex"),
       source: "codex_app_bundle"
     }
   ]);
@@ -17390,7 +17583,7 @@ function codexAppBundleCandidates(env) {
 }
 function pathCandidates(env) {
   return (env.PATH ?? "").split(delimiter).filter(Boolean).map((directory) => ({
-    path: join6(directory, "codex"),
+    path: join7(directory, "codex"),
     source: "path"
   }));
 }
@@ -17401,7 +17594,7 @@ function commonCandidates(env) {
     "/opt/homebrew/bin",
     "/usr/local/bin"
   ].filter(Boolean).map((directory) => ({
-    path: join6(directory, "codex"),
+    path: join7(directory, "codex"),
     source: "common"
   }));
 }
@@ -18037,7 +18230,7 @@ function expandHomePath2(value) {
   if (value === "~")
     return home;
   if (value.startsWith("~/"))
-    return join7(home, value.slice(2));
+    return join8(home, value.slice(2));
   return value;
 }
 function defaultWhichBinary(binary, platform) {
@@ -18071,7 +18264,7 @@ function defaultRunCommand(command, platform) {
 }
 function defaultRequirementExists(requirement) {
   const expanded = expandHomePath2(requirement.path);
-  if (!existsSync7(expanded))
+  if (!existsSync8(expanded))
     return false;
   if (requirement.fileType === "any" || !requirement.fileType)
     return true;
@@ -18300,7 +18493,7 @@ async function readHarnessCatalogOverrides(overridePath = resolveOpenScoutSuppor
   }
 }
 async function writeHarnessCatalogOverrides(overrides, overridePath = resolveOpenScoutSupportPaths().harnessCatalogPath) {
-  await mkdir(dirname4(overridePath), { recursive: true });
+  await mkdir(dirname5(overridePath), { recursive: true });
   const payload = {
     version: HARNESS_CATALOG_VERSION,
     entries: overrides,
@@ -18310,7 +18503,7 @@ async function writeHarnessCatalogOverrides(overrides, overridePath = resolveOpe
 `, "utf8");
 }
 async function ensureHarnessCatalogOverrideFile(overridePath = resolveOpenScoutSupportPaths().harnessCatalogPath) {
-  if (existsSync7(overridePath))
+  if (existsSync8(overridePath))
     return;
   await writeHarnessCatalogOverrides({}, overridePath);
 }
@@ -20634,22 +20827,22 @@ function validateScoutRendezvousCodename(codename) {
 
 // ../runtime/dist/claude-statusline.js
 import { appendFile, mkdir as mkdir2, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname5, join as join8 } from "node:path";
+import { basename as basename2, dirname as dirname6, join as join9 } from "node:path";
 function resolveClaudeStatuslineDirectory() {
-  return join8(resolveOpenScoutSupportPaths().runtimeDirectory, "statusline");
+  return join9(resolveOpenScoutSupportPaths().runtimeDirectory, "statusline");
 }
 function resolveClaudeStatuslineDelegatePath() {
-  return join8(resolveClaudeStatuslineDirectory(), "claude-delegate.json");
+  return join9(resolveClaudeStatuslineDirectory(), "claude-delegate.json");
 }
 function resolveClaudeStatuslineWrapperPath() {
-  return join8(resolveClaudeStatuslineDirectory(), "claude-statusline.sh");
+  return join9(resolveClaudeStatuslineDirectory(), "claude-statusline.sh");
 }
 async function writeClaudeStatuslineDelegate(delegate, path = resolveClaudeStatuslineDelegatePath()) {
   const next = {
     version: 1,
     ...delegate
   };
-  await mkdir2(dirname5(path), { recursive: true });
+  await mkdir2(dirname6(path), { recursive: true });
   await writeFile2(path, JSON.stringify(next, null, 2) + `
 `, "utf8");
   return next;
@@ -20664,9 +20857,9 @@ function isOpenScoutClaudeStatuslineCommand(command, wrapperPath = resolveClaude
 }
 
 // ../runtime/dist/managed-installs.js
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname6 } from "node:path";
+import { dirname as dirname7 } from "node:path";
 function emptyManagedInstallsFile(now = Date.now()) {
   return {
     version: 1,
@@ -20683,7 +20876,7 @@ function stableInstallId(input) {
     input.provider ?? "",
     input.targetPath ?? ""
   ].join("\x00");
-  return `install.${createHash("sha256").update(key).digest("hex").slice(0, 18)}`;
+  return `install.${createHash2("sha256").update(key).digest("hex").slice(0, 18)}`;
 }
 function normalizeManagedInstallsFile(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -20706,7 +20899,7 @@ async function readManagedInstallsFile(path = resolveOpenScoutSupportPaths().man
 }
 async function writeManagedInstallsFile(file, path = resolveOpenScoutSupportPaths().managedInstallsPath) {
   assertTestIsolatedUserData("write the managed-installs registry", "OPENSCOUT_SUPPORT_DIRECTORY");
-  await mkdir3(dirname6(path), { recursive: true });
+  await mkdir3(dirname7(path), { recursive: true });
   await writeFile3(path, JSON.stringify(file, null, 2) + `
 `, "utf8");
 }
@@ -20732,167 +20925,6 @@ async function upsertManagedInstall(input, now = Date.now()) {
   return next;
 }
 
-// ../runtime/dist/node-identity.js
-import { createHash as createHash2, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, sign, verify } from "node:crypto";
-import { chmodSync, existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync5, renameSync as renameSync3, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname7, join as join9 } from "node:path";
-var NODE_IDENTITY_FILE = "node-identity.json";
-var NODE_FINGERPRINT_PREFIX = "osc1";
-var NODE_CARD_TTL_MS = 24 * 60 * 60 * 1000;
-var stableNodeQualifierCache = new Map;
-function nodeIdentityPath(supportDirectory) {
-  const dir = supportDirectory ?? resolveOpenScoutSupportPaths().supportDirectory;
-  return join9(dir, NODE_IDENTITY_FILE);
-}
-function loadOrCreateNodeIdentity(supportDirectory) {
-  const path = nodeIdentityPath(supportDirectory);
-  if (existsSync8(path)) {
-    return readAndValidateNodeIdentity(path);
-  }
-  return createNodeIdentity(supportDirectory);
-}
-function readStableNodeQualifier(supportDirectory) {
-  const path = nodeIdentityPath(supportDirectory);
-  const cached = stableNodeQualifierCache.get(path);
-  if (cached) {
-    return cached;
-  }
-  if (!existsSync8(path)) {
-    return null;
-  }
-  const nodeQualifier = normalizeNodeQualifier(readAndValidateNodeIdentity(path).nodeQualifier);
-  if (nodeQualifier) {
-    stableNodeQualifierCache.set(path, nodeQualifier);
-  }
-  return nodeQualifier || null;
-}
-function readAndValidateNodeIdentity(path) {
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync5(path, "utf8"));
-  } catch {
-    throw new Error(`Corrupt node identity at ${path}; remove it to generate a fresh one.`);
-  }
-  if (parsed.version !== 1 || !parsed.publicKey || !parsed.privateKey) {
-    throw new Error(`Corrupt node identity at ${path}; remove it to generate a fresh one.`);
-  }
-  if (parsed.nodeQualifier !== undefined && normalizeNodeQualifier(parsed.nodeQualifier) !== parsed.nodeQualifier) {
-    throw new Error(`Corrupt node identity at ${path}; remove it to generate a fresh one.`);
-  }
-  try {
-    const derived = createPublicKey(importPrivateKey(parsed.privateKey)).export({ type: "spki", format: "der" }).toString("base64");
-    if (derived !== parsed.publicKey) {
-      throw new Error("mismatch");
-    }
-  } catch {
-    throw new Error(`Node identity at ${path} has mismatched or invalid keys; remove it to generate a fresh one.`);
-  }
-  return parsed;
-}
-function normalizeNodeQualifier(value) {
-  return typeof value === "string" ? value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "") : "";
-}
-function createNodeIdentity(supportDirectory) {
-  if (!supportDirectory) {
-    assertTestIsolatedUserData("write the node identity", "OPENSCOUT_SUPPORT_DIRECTORY");
-  }
-  const path = nodeIdentityPath(supportDirectory);
-  const { publicKey, privateKey } = generateKeyPairSync("ed25519");
-  const identity = {
-    version: 1,
-    publicKey: publicKey.export({ type: "spki", format: "der" }).toString("base64"),
-    privateKey: privateKey.export({ type: "pkcs8", format: "der" }).toString("base64"),
-    createdAt: Date.now()
-  };
-  mkdirSync4(dirname7(path), { recursive: true });
-  try {
-    writeFileSync4(path, `${JSON.stringify(identity, null, 2)}
-`, { encoding: "utf8", mode: 384, flag: "wx" });
-  } catch (error) {
-    if (error.code === "EEXIST") {
-      return readAndValidateNodeIdentity(path);
-    }
-    throw error;
-  }
-  try {
-    chmodSync(path, 384);
-  } catch {}
-  return identity;
-}
-function nodeKeyId(publicKeyBase64) {
-  return createHash2("sha256").update(Buffer.from(publicKeyBase64, "base64")).digest("hex");
-}
-function nodeFingerprint(publicKeyBase64) {
-  const digest = createHash2("sha256").update(Buffer.from(publicKeyBase64, "base64")).digest();
-  const encoded = base32Encode(digest.subarray(0, 10)).toLowerCase();
-  return `${NODE_FINGERPRINT_PREFIX}:${encoded.slice(0, 4)}-${encoded.slice(4, 8)}`;
-}
-function signNodePayload(identity, payload) {
-  const key = importPrivateKey(identity.privateKey);
-  return sign(null, typeof payload === "string" ? Buffer.from(payload, "utf8") : payload, key).toString("base64");
-}
-function verifyNodeSignature(publicKeyBase64, payload, signatureBase64) {
-  try {
-    const key = importPublicKey(publicKeyBase64);
-    return verify(null, typeof payload === "string" ? Buffer.from(payload, "utf8") : payload, key, Buffer.from(signatureBase64, "base64"));
-  } catch {
-    return false;
-  }
-}
-function canonicalJson(value) {
-  if (value === null || typeof value !== "object") {
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map(canonicalJson).join(",")}]`;
-  }
-  const record2 = value;
-  const keys = Object.keys(record2).sort();
-  return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record2[key])}`).join(",")}}`;
-}
-function verifySignedNodeCard(card, now = Date.now()) {
-  if (nodeKeyId(card.publicKey) !== card.keyId) {
-    return false;
-  }
-  if (nodeFingerprint(card.publicKey) !== card.fingerprint) {
-    return false;
-  }
-  if (!Number.isFinite(card.expiresAt) || card.expiresAt <= now) {
-    return false;
-  }
-  if (card.tls !== undefined) {
-    if (typeof card.tls !== "object" || card.tls === null || typeof card.tls.spkiFingerprint !== "string" || !/^[0-9a-f]{64}$/.test(card.tls.spkiFingerprint)) {
-      return false;
-    }
-  }
-  const { signature, ...unsigned } = card;
-  return verifyNodeSignature(card.publicKey, canonicalJson(unsigned), signature);
-}
-var BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
-function base32Encode(input) {
-  let bits = 0;
-  let value = 0;
-  let output = "";
-  for (const byte of input) {
-    value = value << 8 | byte;
-    bits += 8;
-    while (bits >= 5) {
-      output += BASE32_ALPHABET[value >>> bits - 5 & 31];
-      bits -= 5;
-    }
-  }
-  if (bits > 0) {
-    output += BASE32_ALPHABET[value << 5 - bits & 31];
-  }
-  return output;
-}
-function importPrivateKey(privateKeyBase64) {
-  return createPrivateKey({ key: Buffer.from(privateKeyBase64, "base64"), format: "der", type: "pkcs8" });
-}
-function importPublicKey(publicKeyBase64) {
-  return createPublicKey({ key: Buffer.from(publicKeyBase64, "base64"), format: "der", type: "spki" });
-}
-
 // ../runtime/dist/user-project-hints.js
 import { readdir, readFile as readFile5, stat } from "node:fs/promises";
 import { homedir as homedir7 } from "node:os";
@@ -21843,6 +21875,9 @@ function defaultSettings() {
       quickHits: [],
       preparedAt: null
     },
+    voice: {
+      realtimeEnabled: false
+    },
     ui: {
       scenes: [],
       activeSceneIdBySurface: {}
@@ -22230,6 +22265,7 @@ async function normalizeSettingsRecord(value, options = {}) {
   const telegram = typeof bridges.telegram === "object" && bridges.telegram ? bridges.telegram : {};
   const network = typeof candidate.network === "object" && candidate.network ? candidate.network : {};
   const phone = typeof candidate.phone === "object" && candidate.phone ? candidate.phone : {};
+  const voice = typeof candidate.voice === "object" && candidate.voice ? candidate.voice : {};
   const ui = typeof candidate.ui === "object" && candidate.ui ? candidate.ui : {};
   const oldOperatorName = typeof candidate.operatorName === "string" ? candidate.operatorName : undefined;
   const seededWorkspaceRoots = await seedWorkspaceRoots({
@@ -22302,6 +22338,9 @@ async function normalizeSettingsRecord(value, options = {}) {
       quickHits: normalizeStringList(phone.quickHits),
       preparedAt: normalizeOptionalTimestamp(phone.preparedAt)
     },
+    voice: {
+      realtimeEnabled: typeof voice.realtimeEnabled === "boolean" ? voice.realtimeEnabled : base.voice.realtimeEnabled
+    },
     ui: normalizeUi(ui)
   };
 }
@@ -22422,6 +22461,10 @@ async function writeOpenScoutSettings(settings, options = {}) {
       ...current.phone,
       ...settings.phone ?? {}
     },
+    voice: {
+      ...current.voice,
+      ...settings.voice ?? {}
+    },
     ui: {
       ...current.ui,
       ...settings.ui ?? {}
@@ -23390,21 +23433,47 @@ async function initializeOpenScoutSetup(options = {}) {
 }
 
 // ../runtime/dist/user-config.js
-import { existsSync as existsSync10, readFileSync as readFileSync7, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync7, statSync as statSync2, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
 import { dirname as dirname10, join as join12 } from "node:path";
 function userConfigPath() {
   return join12(process.env.OPENSCOUT_HOME ?? join12(homedir9(), ".openscout"), "user.json");
 }
-function loadUserConfig() {
-  const configPath = userConfigPath();
-  if (!existsSync10(configPath))
-    return {};
+var userConfigCache = null;
+var USER_CONFIG_STAT_INTERVAL_MS = 100;
+function userConfigFileKey(configPath) {
   try {
-    return JSON.parse(readFileSync7(configPath, "utf8"));
+    const stats = statSync2(configPath);
+    return `${stats.ino}:${stats.mtimeMs}:${stats.size}`;
   } catch {
-    return {};
+    return "missing";
+  }
+}
+function readUserConfigFromDisk(configPath, now) {
+  const fileKey = userConfigFileKey(configPath);
+  let value = {};
+  if (existsSync10(configPath)) {
+    try {
+      value = JSON.parse(readFileSync7(configPath, "utf8"));
+    } catch {
+      value = {};
+    }
+  }
+  userConfigCache = { path: configPath, value, fileKey, statCheckedAt: now };
+  return { ...value };
+}
+function loadUserConfig(now = Date.now()) {
+  const configPath = userConfigPath();
+  if (userConfigCache && userConfigCache.path === configPath) {
+    if (now - userConfigCache.statCheckedAt < USER_CONFIG_STAT_INTERVAL_MS) {
+      return { ...userConfigCache.value };
+    }
+    if (userConfigFileKey(configPath) === userConfigCache.fileKey) {
+      userConfigCache.statCheckedAt = now;
+      return { ...userConfigCache.value };
+    }
   }
+  return readUserConfigFromDisk(configPath, now);
 }
 function saveUserConfig(config) {
   assertTestIsolatedUserData("write the OpenScout user config", "OPENSCOUT_HOME");
@@ -23412,6 +23481,7 @@ function saveUserConfig(config) {
   mkdirSync5(dirname10(configPath), { recursive: true });
   writeFileSync5(configPath, JSON.stringify(config, null, 2) + `
 `, "utf8");
+  userConfigCache = null;
 }
 function readSettingsOperatorName() {
   const settingsPath = resolveOpenScoutSupportPaths().settingsPath;
@@ -33766,7 +33836,7 @@ async function requestJsonWithBun2(connect, socketPath, payload, timeoutMs) {
 }
 
 // ../runtime/dist/system-probes/git-build-info.js
-import { existsSync as existsSync13, realpathSync, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync13, realpathSync, statSync as statSync3 } from "node:fs";
 import { dirname as dirname12, resolve as resolve6 } from "node:path";
 var staticMetadataByRepo = new Map;
 function realpathOrResolved(path) {
@@ -33779,7 +33849,7 @@ function realpathOrResolved(path) {
 function directoryOrParent(path) {
   const resolved = resolve6(path);
   try {
-    const stat3 = statSync2(resolved);
+    const stat3 = statSync3(resolved);
     return stat3.isDirectory() ? resolved : dirname12(resolved);
   } catch {
     return resolved;
@@ -35910,7 +35980,7 @@ var sessions2 = new Map;
 var CODEX_ROLLOUT_STALE_ACTIVE_TURN_MS = 10 * 60 * 1000;
 
 // ../runtime/dist/pi-rpc.js
-import { existsSync as existsSync16, readFileSync as readFileSync9, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync9, statSync as statSync4 } from "node:fs";
 import { mkdir as mkdir6, writeFile as writeFile6 } from "node:fs/promises";
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { homedir as homedir14 } from "node:os";
@@ -36017,12 +36087,12 @@ function readPiRpcCredentialFile(name, options = {}) {
     return;
   }
   try {
-    const directoryStat = statSync3(directory);
+    const directoryStat = statSync4(directory);
     if (!directoryStat.isDirectory() || (directoryStat.mode & 63) !== 0) {
       return;
     }
     const path = join17(directory, name);
-    const stat4 = statSync3(path);
+    const stat4 = statSync4(path);
     if (!stat4.isFile() || (stat4.mode & 63) !== 0 || stat4.size > 16 * 1024) {
       return;
     }