@staff0rd/assist 0.756.0 → 0.757.1

package/dist/index.js

@@ -6,7 +6,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "@staff0rd/assist",
-  version: "0.756.0",
+  version: "0.757.1",
   type: "module",
   main: "dist/index.js",
   bin: {
@@ -563,7 +563,7 @@ function stripLegacyConfigKeys(config) {
 }
 
 // src/shared/types.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 
 // src/shared/adviceFragmentNames.ts
 var adviceFragmentTitles = {
@@ -638,267 +638,273 @@ function isSecretSchemaNode(node) {
   return meta?.[SECRET_META_KEY] === true;
 }
 
+// src/shared/sessionLinkSchema.ts
+import { z as z3 } from "zod";
+var SSH_LINK_RETIRED = "ssh links are no longer supported; relink with `assist sessions nodes link <name> --tailscale <host> --port <port>`";
+var sessionLinkSchema = z3.preprocess(
+  (link3, ctx) => {
+    if (link3 && typeof link3 === "object" && "ssh" in link3)
+      ctx.issues.push({
+        code: "custom",
+        message: SSH_LINK_RETIRED,
+        input: link3
+      });
+    return link3;
+  },
+  z3.strictObject({ name: z3.string(), url: z3.string() })
+);
+
 // src/shared/types.ts
-var transcriptConfigSchema = z3.strictObject({
-  vttDir: z3.string(),
-  transcriptsDir: z3.string(),
-  summaryDir: z3.string()
+var transcriptConfigSchema = z4.strictObject({
+  vttDir: z4.string(),
+  transcriptsDir: z4.string(),
+  summaryDir: z4.string()
 });
-var miroExtractSchema = z3.strictObject({
-  board: z3.string().optional(),
-  frame: z3.string().optional(),
-  topLeft: z3.string(),
-  bottomRight: z3.string(),
-  items: z3.string(),
-  ignore: z3.string().optional(),
-  out: z3.string().optional()
+var miroExtractSchema = z4.strictObject({
+  board: z4.string().optional(),
+  frame: z4.string().optional(),
+  topLeft: z4.string(),
+  bottomRight: z4.string(),
+  items: z4.string(),
+  ignore: z4.string().optional(),
+  out: z4.string().optional()
 });
 var DEFAULT_BACKUP_DIR = "~/.assist/backups";
 var DEFAULT_CLONE_DIR = "~/git";
 var assistConfigShape = {
-  advice: z3.strictObject({
-    sections: z3.partialRecord(z3.enum(adviceFragmentNames), z3.boolean()).default({}),
-    extra: z3.string().optional(),
-    verify: z3.string().optional()
+  advice: z4.strictObject({
+    sections: z4.partialRecord(z4.enum(adviceFragmentNames), z4.boolean()).default({}),
+    extra: z4.string().optional(),
+    verify: z4.string().optional()
   }).optional(),
-  backlog: z3.strictObject({
-    previewComments: z3.boolean().default(false)
+  backlog: z4.strictObject({
+    previewComments: z4.boolean().default(false)
   }).optional(),
-  backup: z3.strictObject({
-    dir: z3.string().default(DEFAULT_BACKUP_DIR)
+  backup: z4.strictObject({
+    dir: z4.string().default(DEFAULT_BACKUP_DIR)
   }).default({ dir: DEFAULT_BACKUP_DIR }),
-  clone: z3.strictObject({
-    baseDir: z3.string().default(DEFAULT_CLONE_DIR)
+  clone: z4.strictObject({
+    baseDir: z4.string().default(DEFAULT_CLONE_DIR)
   }).default({ baseDir: DEFAULT_CLONE_DIR }),
-  commit: z3.strictObject({
-    conventional: z3.boolean().default(false),
-    pull: z3.boolean().default(false),
-    push: z3.boolean().default(false),
-    expectedBranch: z3.string().optional()
+  commit: z4.strictObject({
+    conventional: z4.boolean().default(false),
+    pull: z4.boolean().default(false),
+    push: z4.boolean().default(false),
+    expectedBranch: z4.string().optional()
   }).default({ conventional: false, pull: false, push: false }),
-  branch: z3.strictObject({
-    prefix: z3.string().optional(),
-    defaultBranch: z3.string().optional()
+  branch: z4.strictObject({
+    prefix: z4.string().optional(),
+    defaultBranch: z4.string().optional()
   }).optional(),
-  devlog: z3.strictObject({
-    name: z3.string().optional(),
-    ignore: z3.array(z3.string()).optional(),
-    skip: z3.record(z3.string(), z3.array(z3.string())).optional()
+  devlog: z4.strictObject({
+    name: z4.string().optional(),
+    ignore: z4.array(z4.string()).optional(),
+    skip: z4.record(z4.string(), z4.array(z4.string())).optional()
   }).optional(),
-  notify: z3.strictObject({
-    enabled: z3.boolean().default(true)
+  notify: z4.strictObject({
+    enabled: z4.boolean().default(true)
   }).default({ enabled: true }),
-  complexity: z3.strictObject({
-    ignore: z3.array(z3.string()).default(["**/*test.ts*"])
+  complexity: z4.strictObject({
+    ignore: z4.array(z4.string()).default(["**/*test.ts*"])
   }).default({ ignore: ["**/*test.ts*"] }),
-  hardcodedColors: z3.strictObject({
-    ignore: z3.array(z3.string()).default([])
+  hardcodedColors: z4.strictObject({
+    ignore: z4.array(z4.string()).default([])
   }).optional(),
-  blockCodeComments: z3.strictObject({
-    ignore: z3.array(z3.string()).default([])
+  blockCodeComments: z4.strictObject({
+    ignore: z4.array(z4.string()).default([])
   }).optional(),
-  restructure: z3.strictObject({
-    ignore: z3.array(z3.string()).default([]),
-    pin: z3.array(z3.string()).default([]),
-    maxDepth: z3.number().int().positive().default(10)
+  restructure: z4.strictObject({
+    ignore: z4.array(z4.string()).default([]),
+    pin: z4.array(z4.string()).default([]),
+    maxDepth: z4.number().int().positive().default(10)
   }).optional(),
-  jira: z3.strictObject({
-    acField: z3.string().default("customfield_11937")
+  jira: z4.strictObject({
+    acField: z4.string().default("customfield_11937")
   }).optional(),
-  roam: z3.strictObject({
-    clientId: secretConfigValue(z3.string()),
-    clientSecret: secretConfigValue(z3.string()),
-    accessToken: secretConfigValue(z3.string()).optional(),
-    refreshToken: secretConfigValue(z3.string()).optional(),
-    tokenExpiresAt: z3.number().optional()
+  roam: z4.strictObject({
+    clientId: secretConfigValue(z4.string()),
+    clientSecret: secretConfigValue(z4.string()),
+    accessToken: secretConfigValue(z4.string()).optional(),
+    refreshToken: secretConfigValue(z4.string()).optional(),
+    tokenExpiresAt: z4.number().optional()
   }).optional(),
-  slack: z3.strictObject({
-    channel: z3.string().optional()
+  slack: z4.strictObject({
+    channel: z4.string().optional()
   }).optional(),
-  prs: z3.strictObject({
-    slack: z3.string().optional(),
-    required: z3.boolean().default(true),
-    promptJira: z3.boolean().default(false),
-    promptGithub: z3.boolean().default(false),
-    draft: z3.boolean().default(false),
-    readingWordsPerMinute: z3.number().int().positive().optional()
+  prs: z4.strictObject({
+    slack: z4.string().optional(),
+    required: z4.boolean().default(true),
+    promptJira: z4.boolean().default(false),
+    promptGithub: z4.boolean().default(false),
+    draft: z4.boolean().default(false),
+    readingWordsPerMinute: z4.number().int().positive().optional()
   }).optional(),
-  review: z3.strictObject({
-    codexModel: z3.string().optional(),
-    highLevel: z3.strictObject({
-      criticalPaths: z3.array(z3.string()).default([]),
-      uiPaths: z3.array(z3.string()).default([]),
-      descriptionWordCap: z3.number().int().positive().default(300)
+  review: z4.strictObject({
+    codexModel: z4.string().optional(),
+    highLevel: z4.strictObject({
+      criticalPaths: z4.array(z4.string()).default([]),
+      uiPaths: z4.array(z4.string()).default([]),
+      descriptionWordCap: z4.number().int().positive().default(300)
     }).optional()
   }).optional(),
-  readTime: z3.strictObject({
-    wordsPerMinute: z3.number().int().positive().default(200)
+  readTime: z4.strictObject({
+    wordsPerMinute: z4.number().int().positive().default(200)
   }).optional(),
-  releases: z3.strictObject({
-    streams: z3.array(
-      z3.strictObject({
-        name: z3.string(),
-        repo: z3.string(),
-        workflow: z3.string(),
-        nodes: z3.array(
-          z3.strictObject({
-            id: z3.string(),
-            environment: z3.string().optional(),
-            kind: z3.enum(["build", "gate"]).optional(),
-            label: z3.string().optional()
+  releases: z4.strictObject({
+    streams: z4.array(
+      z4.strictObject({
+        name: z4.string(),
+        repo: z4.string(),
+        workflow: z4.string(),
+        nodes: z4.array(
+          z4.strictObject({
+            id: z4.string(),
+            environment: z4.string().optional(),
+            kind: z4.enum(["build", "gate"]).optional(),
+            label: z4.string().optional()
           })
         ),
-        edges: z3.array(z3.tuple([z3.string(), z3.string()])).default([])
+        edges: z4.array(z4.tuple([z4.string(), z4.string()])).default([])
       })
     ).default([])
   }).optional(),
-  worktree: z3.strictObject({
-    enabled: z3.boolean().default(false),
-    watcher: z3.boolean().default(false),
-    trunk: z3.boolean().default(false),
-    includeDrafts: z3.boolean().default(false),
-    root: z3.string().optional(),
-    install: z3.union([z3.boolean(), z3.string(), z3.array(z3.string())]).default(true),
-    commitBeforeManualChecks: z3.boolean().default(false),
-    commitBeforePhaseEnd: z3.boolean().optional(),
-    copy: z3.array(z3.string()).default([
+  worktree: z4.strictObject({
+    enabled: z4.boolean().default(false),
+    watcher: z4.boolean().default(false),
+    trunk: z4.boolean().default(false),
+    includeDrafts: z4.boolean().default(false),
+    root: z4.string().optional(),
+    install: z4.union([z4.boolean(), z4.string(), z4.array(z4.string())]).default(true),
+    commitBeforeManualChecks: z4.boolean().default(false),
+    commitBeforePhaseEnd: z4.boolean().optional(),
+    copy: z4.array(z4.string()).default([
       ".env",
       "settings.local.json",
       ".claude/settings.local.json"
     ])
   }).optional(),
-  run: z3.array(z3.union([runConfigSchema, runLinkSchema])).optional(),
-  subtasks: z3.array(
-    z3.strictObject({
-      title: z3.string(),
-      description: z3.string().optional()
+  run: z4.array(z4.union([runConfigSchema, runLinkSchema])).optional(),
+  subtasks: z4.array(
+    z4.strictObject({
+      title: z4.string(),
+      description: z4.string().optional()
     })
   ).optional(),
   transcript: transcriptConfigSchema.optional(),
-  cliReadVerbs: z3.record(z3.string(), z3.array(z3.string())).optional(),
-  cliHook: z3.strictObject({
-    blockNpmRun: z3.boolean().default(true)
+  cliReadVerbs: z4.record(z4.string(), z4.array(z4.string())).optional(),
+  cliHook: z4.strictObject({
+    blockNpmRun: z4.boolean().default(true)
   }).optional(),
-  dotnet: z3.strictObject({
-    inspect: z3.strictObject({
-      suppress: z3.array(z3.string()).default([])
+  dotnet: z4.strictObject({
+    inspect: z4.strictObject({
+      suppress: z4.array(z4.string()).default([])
     }).default({ suppress: [] })
   }).optional(),
-  litellm: z3.strictObject({
-    baseUrl: z3.string().optional(),
-    apiKey: secretConfigValue(z3.string()).optional()
+  litellm: z4.strictObject({
+    baseUrl: z4.string().optional(),
+    apiKey: secretConfigValue(z4.string()).optional()
   }).optional(),
-  ravendb: z3.strictObject({
-    connections: z3.array(
-      z3.strictObject({
-        name: z3.string(),
-        url: z3.string(),
-        database: z3.string(),
-        apiKeyRef: z3.string()
+  ravendb: z4.strictObject({
+    connections: z4.array(
+      z4.strictObject({
+        name: z4.string(),
+        url: z4.string(),
+        database: z4.string(),
+        apiKeyRef: z4.string()
       })
     ).default([]),
-    defaultConnection: z3.string().optional()
+    defaultConnection: z4.string().optional()
   }).optional(),
-  seq: z3.strictObject({
-    connections: z3.array(
-      z3.strictObject({
-        name: z3.string(),
-        url: z3.string(),
-        apiToken: secretConfigValue(z3.string())
+  seq: z4.strictObject({
+    connections: z4.array(
+      z4.strictObject({
+        name: z4.string(),
+        url: z4.string(),
+        apiToken: secretConfigValue(z4.string())
       })
     ).default([]),
-    defaultConnection: z3.string().optional()
+    defaultConnection: z4.string().optional()
   }).optional(),
-  sql: z3.strictObject({
-    connections: z3.array(
-      z3.strictObject({
-        name: z3.string(),
-        server: z3.string(),
-        port: z3.number(),
-        user: z3.string(),
-        password: secretConfigValue(z3.string()),
-        database: z3.string()
+  sql: z4.strictObject({
+    connections: z4.array(
+      z4.strictObject({
+        name: z4.string(),
+        server: z4.string(),
+        port: z4.number(),
+        user: z4.string(),
+        password: secretConfigValue(z4.string()),
+        database: z4.string()
       })
     ).default([]),
-    defaultConnection: z3.string().optional()
+    defaultConnection: z4.string().optional()
   }).optional(),
-  screenshot: z3.strictObject({
-    outputDir: z3.string().default("./screenshots")
+  screenshot: z4.strictObject({
+    outputDir: z4.string().default("./screenshots")
   }).default({ outputDir: "./screenshots" }),
-  sessions: z3.strictObject({
-    nodeName: z3.string().optional(),
-    links: z3.array(
-      z3.union([
-        z3.strictObject({ name: z3.string(), url: z3.string() }),
-        z3.strictObject({
-          name: z3.string(),
-          ssh: z3.string(),
-          port: z3.number().int(),
-          localPort: z3.number().int().optional()
-        })
-      ])
-    ).optional(),
-    linkVersionCheck: z3.enum(["block", "warn", "off"]).default("block"),
-    tailscaleServe: z3.boolean().default(true),
-    includeCommittedChanges: z3.boolean().default(true),
-    topBar: z3.boolean().default(true),
-    floatWaiting: z3.boolean().default(true),
-    floatWaitingAfterMs: z3.number().default(5e3),
-    maxLive: z3.number().default(24),
-    newSessionMode: z3.enum(["draft", "bug", "prompt", "design"]).default("draft")
+  sessions: z4.strictObject({
+    nodeName: z4.string().optional(),
+    links: z4.array(sessionLinkSchema).optional(),
+    linkVersionCheck: z4.enum(["block", "warn", "off"]).default("block"),
+    tailscaleServe: z4.boolean().default(true),
+    includeCommittedChanges: z4.boolean().default(true),
+    topBar: z4.boolean().default(true),
+    floatWaiting: z4.boolean().default(true),
+    floatWaitingAfterMs: z4.number().default(5e3),
+    maxLive: z4.number().default(24),
+    newSessionMode: z4.enum(["draft", "bug", "prompt", "design"]).default("draft")
   }).optional(),
-  database: z3.strictObject({
-    url: secretConfigValue(z3.string()).optional()
+  database: z4.strictObject({
+    url: secretConfigValue(z4.string()).optional()
   }).default({}),
-  mermaid: z3.strictObject({
-    krokiUrl: z3.string().default("https://kroki.io")
+  mermaid: z4.strictObject({
+    krokiUrl: z4.string().default("https://kroki.io")
   }).default({ krokiUrl: "https://kroki.io" }),
-  miro: z3.strictObject({
-    extracts: z3.record(z3.string(), miroExtractSchema).optional()
+  miro: z4.strictObject({
+    extracts: z4.record(z4.string(), miroExtractSchema).optional()
   }).optional(),
-  news: z3.strictObject({
-    showInNav: z3.boolean().default(false)
+  news: z4.strictObject({
+    showInNav: z4.boolean().default(false)
   }).optional(),
-  next: z3.strictObject({
-    peers: z3.array(z3.string()).optional(),
-    repos: z3.array(z3.string()).optional(),
-    projects: z3.array(
-      z3.string().regex(
+  next: z4.strictObject({
+    peers: z4.array(z4.string()).optional(),
+    repos: z4.array(z4.string()).optional(),
+    projects: z4.array(
+      z4.string().regex(
         /^[^/\s]+\/\d+$/,
         "Use <owner>/<project number>, e.g. my-org/3"
       )
     ).optional(),
-    pickStatuses: z3.array(z3.string()).optional(),
-    excludeLabels: z3.array(z3.string()).optional(),
-    excludeTypes: z3.array(z3.string()).optional()
+    pickStatuses: z4.array(z4.string()).optional(),
+    excludeLabels: z4.array(z4.string()).optional(),
+    excludeTypes: z4.array(z4.string()).optional()
   }).optional(),
-  deny: z3.array(
-    z3.strictObject({
-      pattern: z3.string(),
-      message: z3.string()
+  deny: z4.array(
+    z4.strictObject({
+      pattern: z4.string(),
+      message: z4.string()
     })
   ).optional(),
-  forbiddenStrings: z3.array(
-    z3.strictObject({
-      file: z3.string(),
-      paths: z3.array(z3.string()),
-      disallowed: z3.string()
+  forbiddenStrings: z4.array(
+    z4.strictObject({
+      file: z4.string(),
+      paths: z4.array(z4.string()),
+      disallowed: z4.string()
     })
   ).optional(),
-  sync: z3.strictObject({
-    autoConfirm: z3.boolean().default(false)
+  sync: z4.strictObject({
+    autoConfirm: z4.boolean().default(false)
   }).default({ autoConfirm: false }),
-  harness: z3.strictObject({
-    engine: z3.enum(["claude", "codex", "pi"]).default("claude"),
-    exposeCodexActions: z3.boolean().optional(),
-    exposePiActions: z3.boolean().optional(),
-    codexModel: z3.string().optional()
+  harness: z4.strictObject({
+    engine: z4.enum(["claude", "codex", "pi"]).default("claude"),
+    exposeCodexActions: z4.boolean().optional(),
+    exposePiActions: z4.boolean().optional(),
+    codexModel: z4.string().optional()
   }).default({ engine: "claude" })
 };
-var repoConfigSchema = z3.strictObject(assistConfigShape).partial();
-var assistConfigSchema = z3.strictObject({
+var repoConfigSchema = z4.strictObject(assistConfigShape).partial();
+var assistConfigSchema = z4.strictObject({
   ...assistConfigShape,
-  repos: z3.record(z3.string(), repoConfigSchema).optional()
+  repos: z4.record(z4.string(), repoConfigSchema).optional()
 });
 
 // src/shared/loadConfigFrom.ts
@@ -5071,52 +5077,52 @@ async function loadAllItems(orm, origin) {
 import { readFileSync as readFileSync13 } from "fs";
 
 // src/commands/backlog/types.ts
-import { z as z4 } from "zod";
-var backlogStatusSchema = z4.enum(["todo", "in-progress", "done", "wontdo"]);
-var backlogTypeSchema = z4.enum(["story", "bug"]);
-var planTaskSchema = z4.object({
-  task: z4.string()
+import { z as z5 } from "zod";
+var backlogStatusSchema = z5.enum(["todo", "in-progress", "done", "wontdo"]);
+var backlogTypeSchema = z5.enum(["story", "bug"]);
+var planTaskSchema = z5.object({
+  task: z5.string()
 }).strip();
-var planPhaseSchema = z4.strictObject({
-  name: z4.string(),
-  tasks: z4.array(planTaskSchema),
-  manualChecks: z4.array(z4.string()).optional()
+var planPhaseSchema = z5.strictObject({
+  name: z5.string(),
+  tasks: z5.array(planTaskSchema),
+  manualChecks: z5.array(z5.string()).optional()
 });
-var phaseUsageSchema = z4.strictObject({
-  phaseIdx: z4.number(),
-  tokensUp: z4.number(),
-  tokensDown: z4.number(),
-  activeMs: z4.number(),
-  peakContextPct: z4.number()
+var phaseUsageSchema = z5.strictObject({
+  phaseIdx: z5.number(),
+  tokensUp: z5.number(),
+  tokensDown: z5.number(),
+  activeMs: z5.number(),
+  peakContextPct: z5.number()
 });
-var phaseSessionSchema = z4.strictObject({
-  phaseIdx: z4.number(),
-  claudeSessionId: z4.string(),
-  hostname: z4.string(),
-  osUser: z4.string(),
-  createdAt: z4.string().optional()
+var phaseSessionSchema = z5.strictObject({
+  phaseIdx: z5.number(),
+  claudeSessionId: z5.string(),
+  hostname: z5.string(),
+  osUser: z5.string(),
+  createdAt: z5.string().optional()
 });
-var phaseUsageTotalSchema = z4.strictObject({
-  tokensUp: z4.number(),
-  tokensDown: z4.number(),
-  activeMs: z4.number(),
-  peakContextPct: z4.number()
+var phaseUsageTotalSchema = z5.strictObject({
+  tokensUp: z5.number(),
+  tokensDown: z5.number(),
+  activeMs: z5.number(),
+  peakContextPct: z5.number()
 });
-var subtaskStatusSchema = z4.enum(["todo", "in-progress", "done"]);
-var subtaskSchema = z4.strictObject({
-  title: z4.string(),
-  description: z4.string().optional(),
+var subtaskStatusSchema = z5.enum(["todo", "in-progress", "done"]);
+var subtaskSchema = z5.strictObject({
+  title: z5.string(),
+  description: z5.string().optional(),
   status: subtaskStatusSchema.default("todo")
 });
-var backlogCommentTypeSchema = z4.enum(["comment", "summary"]);
-var backlogCommentSchema = z4.strictObject({
-  id: z4.number().optional(),
-  text: z4.string(),
-  phase: z4.number().optional(),
-  timestamp: z4.string(),
+var backlogCommentTypeSchema = z5.enum(["comment", "summary"]);
+var backlogCommentSchema = z5.strictObject({
+  id: z5.number().optional(),
+  text: z5.string(),
+  phase: z5.number().optional(),
+  timestamp: z5.string(),
   type: backlogCommentTypeSchema
 });
-var gitRefKindSchema = z4.enum([
+var gitRefKindSchema = z5.enum([
   "branch",
   "commit",
   "commit-parent",
@@ -5124,41 +5130,41 @@ var gitRefKindSchema = z4.enum([
   "slack",
   "session"
 ]);
-var gitRefSchema = z4.strictObject({
+var gitRefSchema = z5.strictObject({
   kind: gitRefKindSchema,
-  ref: z4.string(),
-  title: z4.string().optional(),
-  url: z4.string().optional(),
-  state: z4.string().optional(),
-  createdAt: z4.string().optional()
+  ref: z5.string(),
+  title: z5.string().optional(),
+  url: z5.string().optional(),
+  state: z5.string().optional(),
+  createdAt: z5.string().optional()
 });
-var backlogLinkTypeSchema = z4.enum(["relates-to", "depends-on"]);
-var backlogLinkSchema = z4.strictObject({
+var backlogLinkTypeSchema = z5.enum(["relates-to", "depends-on"]);
+var backlogLinkSchema = z5.strictObject({
   type: backlogLinkTypeSchema,
-  targetId: z4.number()
+  targetId: z5.number()
 });
-var backlogItemSchema = z4.strictObject({
-  id: z4.number(),
+var backlogItemSchema = z5.strictObject({
+  id: z5.number(),
   type: backlogTypeSchema.default("story"),
-  name: z4.string(),
-  description: z4.string().optional(),
-  acceptanceCriteria: z4.array(z4.string()),
-  plan: z4.array(planPhaseSchema).optional(),
-  currentPhase: z4.number().optional(),
-  starred: z4.boolean().default(false),
+  name: z5.string(),
+  description: z5.string().optional(),
+  acceptanceCriteria: z5.array(z5.string()),
+  plan: z5.array(planPhaseSchema).optional(),
+  currentPhase: z5.number().optional(),
+  starred: z5.boolean().default(false),
   status: backlogStatusSchema,
-  comments: z4.array(backlogCommentSchema).optional(),
-  subtasks: z4.array(subtaskSchema).optional(),
-  links: z4.array(backlogLinkSchema).optional(),
-  phaseUsage: z4.array(phaseUsageSchema).optional(),
-  phaseSessions: z4.array(phaseSessionSchema).optional(),
+  comments: z5.array(backlogCommentSchema).optional(),
+  subtasks: z5.array(subtaskSchema).optional(),
+  links: z5.array(backlogLinkSchema).optional(),
+  phaseUsage: z5.array(phaseUsageSchema).optional(),
+  phaseSessions: z5.array(phaseSessionSchema).optional(),
   usageTotal: phaseUsageTotalSchema.optional(),
-  gitRefs: z4.array(gitRefSchema).optional(),
-  origin: z4.string().optional(),
-  jiraKey: z4.string().optional(),
-  githubIssue: z4.string().optional()
+  gitRefs: z5.array(gitRefSchema).optional(),
+  origin: z5.string().optional(),
+  jiraKey: z5.string().optional(),
+  githubIssue: z5.string().optional()
 });
-var backlogFileSchema = z4.array(backlogItemSchema);
+var backlogFileSchema = z5.array(backlogItemSchema);
 
 // src/commands/backlog/parseBacklogJsonl.ts
 function parseBacklogJsonl(path106) {
@@ -6525,7 +6531,7 @@ ${issues}`);
 }
 
 // src/commands/backlog/propose/proposedItemSchema.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 
 // src/commands/backlog/buildCommentLines.ts
 function buildCommentLines(comments3) {
@@ -6677,20 +6683,20 @@ function buildPhasePrompt(item, phaseNumber, phase) {
 }
 
 // src/commands/backlog/propose/proposedItemSchema.ts
-var proposedPhaseSchema = z5.strictObject({
-  name: z5.string().trim().min(1, "phase name is required").refine(
+var proposedPhaseSchema = z6.strictObject({
+  name: z6.string().trim().min(1, "phase name is required").refine(
     (name) => name.toLowerCase() !== REVIEW_PHASE_NAME.toLowerCase(),
     `"${REVIEW_PHASE_NAME}" is owned by the runner and appended to every plan automatically \u2014 remove this phase`
   ),
-  tasks: z5.array(z5.string().trim().min(1)).min(1, "a phase needs at least one task"),
-  manualChecks: z5.array(z5.string().trim().min(1)).default([])
+  tasks: z6.array(z6.string().trim().min(1)).min(1, "a phase needs at least one task"),
+  manualChecks: z6.array(z6.string().trim().min(1)).default([])
 });
-var proposedItemSchema = z5.strictObject({
-  name: z5.string().trim().min(1, "name is required"),
-  type: z5.enum(["story", "bug"]),
-  description: z5.string().optional(),
-  acceptanceCriteria: z5.array(z5.string().trim().min(1)).default([]),
-  phases: z5.array(proposedPhaseSchema).default([])
+var proposedItemSchema = z6.strictObject({
+  name: z6.string().trim().min(1, "name is required"),
+  type: z6.enum(["story", "bug"]),
+  description: z6.string().optional(),
+  acceptanceCriteria: z6.array(z6.string().trim().min(1)).default([]),
+  phases: z6.array(proposedPhaseSchema).default([])
 });
 
 // src/commands/backlog/propose/readProposedItem.ts
@@ -8215,18 +8221,18 @@ async function persistPhaseSessionId(itemId2, phaseIdx, claudeSessionId) {
 import { mkdirSync as mkdirSync9, readFileSync as readFileSync19, rmSync as rmSync2, writeFileSync as writeFileSync20 } from "fs";
 import { homedir as homedir11 } from "os";
 import { dirname as dirname18, join as join30 } from "path";
-import { z as z6 } from "zod";
-var activitySchema = z6.object({
-  kind: z6.enum(["command", "backlog"]),
-  harness: z6.enum(["claude", "codex", "pi"]).optional(),
-  name: z6.string().optional(),
-  itemId: z6.number().optional(),
-  itemName: z6.string().optional(),
-  phase: z6.number().optional(),
-  phaseName: z6.string().optional(),
-  totalPhases: z6.number().optional(),
-  claudeSessionId: z6.string().optional(),
-  startedAt: z6.number()
+import { z as z7 } from "zod";
+var activitySchema = z7.object({
+  kind: z7.enum(["command", "backlog"]),
+  harness: z7.enum(["claude", "codex", "pi"]).optional(),
+  name: z7.string().optional(),
+  itemId: z7.number().optional(),
+  itemName: z7.string().optional(),
+  phase: z7.number().optional(),
+  phaseName: z7.string().optional(),
+  totalPhases: z7.number().optional(),
+  claudeSessionId: z7.string().optional(),
+  startedAt: z7.number()
 });
 function activityPath(sessionId) {
   return join30(homedir11(), ".assist", "activity", `activity-${sessionId}.json`);
@@ -10243,9 +10249,9 @@ async function update(id, options2) {
 import chalk102 from "chalk";
 
 // src/commands/backlog/updatePlan/planUpdateSchema.ts
-import { z as z7 } from "zod";
-var planUpdateSchema = z7.strictObject({
-  phases: z7.array(proposedPhaseSchema).min(1, "a plan needs at least one phase")
+import { z as z8 } from "zod";
+var planUpdateSchema = z8.strictObject({
+  phases: z8.array(proposedPhaseSchema).min(1, "a plan needs at least one phase")
 });
 
 // src/commands/backlog/updatePlan/readPlanUpdate.ts
@@ -12997,8 +13003,8 @@ var seqConfigHelp = [
 var nodesConfigHelp = [
   {
     key: "sessions.links",
-    setter: "assist sessions nodes link <name> http://127.0.0.1:<port> (or --tailscale <host> --port <port>, or --ssh <alias> --port <port>)",
-    note: "linked nodes whose sessions merge into this node's web UI, each direct (url, including a Tailscale <host>.<tailnet>.ts.net https url) or over an ssh tunnel (ssh alias, peer port, localPort); each name must match the peer's sessions.nodeName"
+    setter: "assist sessions nodes link <name> --tailscale <host> --port <port> (or a peer <url>)",
+    note: "linked nodes whose sessions merge into this node's web UI, each dialled at its url (a Tailscale https://<host>.<tailnet>.ts.net:<port> url, or any direct url); each name must match the peer's sessions.nodeName"
   },
   {
     key: "sessions.linkVersionCheck",
@@ -15007,21 +15013,8 @@ async function prList(req, res) {
 }
 
 // src/commands/sessions/shared/loadLinkSpecs.ts
-var TUNNEL_PORT_BASE = 43e3;
-function defaultTunnelPort(port) {
-  return TUNNEL_PORT_BASE + port % 1e3;
-}
-function toLinkSpec(link3) {
-  if ("url" in link3) return { name: link3.name, url: link3.url };
-  const localPort = link3.localPort ?? defaultTunnelPort(link3.port);
-  return {
-    name: link3.name,
-    url: `http://127.0.0.1:${localPort}`,
-    ssh: { alias: link3.ssh, port: link3.port, localPort }
-  };
-}
 function loadLinkSpecs() {
-  return (loadConfig().sessions?.links ?? []).map(toLinkSpec);
+  return loadConfig().sessions?.links ?? [];
 }
 function findLinkSpec(name) {
   return loadLinkSpecs().find((spec) => spec.name === name);
@@ -15040,6 +15033,20 @@ import {
 } from "http";
 import { request as httpsRequest } from "https";
 
+// src/commands/sessions/web/peerTimeoutMs.ts
+var peerTimeoutMs = 2e4;
+
+// src/commands/sessions/web/boundUpstream.ts
+function boundUpstream(upstream, res) {
+  upstream.setTimeout(
+    peerTimeoutMs,
+    () => upstream.destroy(new Error(`no response after ${peerTimeoutMs}ms`))
+  );
+  res.on("close", () => {
+    if (!res.writableFinished) upstream.destroy();
+  });
+}
+
 // src/commands/sessions/web/isQuietPoll.ts
 var POLLED_PATHS = /* @__PURE__ */ new Set(["/api/git-status"]);
 function isQuietPoll(pathname, status2) {
@@ -15078,6 +15085,7 @@ function forwardToPeer(req, res, node, url) {
       },
       (peer) => relayPeerResponse(peer, res, url.pathname, log2, resolve26)
     );
+    boundUpstream(upstream, res);
     upstream.on("error", (error) => {
       log2(`failed: ${error.message}`);
       if (res.headersSent) res.destroy();
@@ -25275,36 +25283,36 @@ function stringOrUndefined(value) {
 }
 
 // src/commands/sessions/daemon/persistedSessionSchema.ts
-import { z as z8 } from "zod";
-var persistedSessionSchema = z8.object({
-  id: z8.string().optional(),
-  name: z8.string(),
-  title: z8.string().optional(),
-  generatedTitle: z8.string().optional(),
-  subtitle: z8.string().optional(),
-  commandType: z8.enum(["claude", "run", "assist"]),
-  harness: z8.enum(["claude", "codex", "pi"]).optional(),
-  status: z8.enum(["running", "waiting", "done", "error", "stopped"]).optional(),
-  cwd: z8.string(),
-  startedAt: z8.number(),
-  runningMs: z8.number().optional(),
-  claudeSessionId: z8.string().optional(),
-  harnessSessionId: z8.string().optional(),
-  initialPrompt: z8.string().optional(),
-  runName: z8.string().optional(),
-  runArgs: z8.array(z8.string()).optional(),
-  assistArgs: z8.array(z8.string()).optional(),
+import { z as z9 } from "zod";
+var persistedSessionSchema = z9.object({
+  id: z9.string().optional(),
+  name: z9.string(),
+  title: z9.string().optional(),
+  generatedTitle: z9.string().optional(),
+  subtitle: z9.string().optional(),
+  commandType: z9.enum(["claude", "run", "assist"]),
+  harness: z9.enum(["claude", "codex", "pi"]).optional(),
+  status: z9.enum(["running", "waiting", "done", "error", "stopped"]).optional(),
+  cwd: z9.string(),
+  startedAt: z9.number(),
+  runningMs: z9.number().optional(),
+  claudeSessionId: z9.string().optional(),
+  harnessSessionId: z9.string().optional(),
+  initialPrompt: z9.string().optional(),
+  runName: z9.string().optional(),
+  runArgs: z9.array(z9.string()).optional(),
+  assistArgs: z9.array(z9.string()).optional(),
   activity: activitySchema.optional(),
-  starred: z8.boolean().optional(),
-  watcher: z8.boolean().optional(),
-  design: z8.boolean().optional(),
-  auto: z8.boolean().optional(),
-  autoRun: z8.boolean().optional(),
-  autoAdvance: z8.boolean().optional(),
-  reviewStarted: z8.boolean().optional(),
-  launchedFrom: z8.string().optional(),
-  interrupted: z8.object({ reason: z8.string(), at: z8.number() }).optional(),
-  undurable: z8.object({ reason: z8.string(), removesTree: z8.boolean().optional() }).optional()
+  starred: z9.boolean().optional(),
+  watcher: z9.boolean().optional(),
+  design: z9.boolean().optional(),
+  auto: z9.boolean().optional(),
+  autoRun: z9.boolean().optional(),
+  autoAdvance: z9.boolean().optional(),
+  reviewStarted: z9.boolean().optional(),
+  launchedFrom: z9.string().optional(),
+  interrupted: z9.object({ reason: z9.string(), at: z9.number() }).optional(),
+  undurable: z9.object({ reason: z9.string(), removesTree: z9.boolean().optional() }).optional()
 });
 
 // src/commands/sessions/daemon/toPersistedSession.ts
@@ -38177,16 +38185,16 @@ function selectPassages(sources, selection) {
 }
 
 // src/commands/transcript/selectionSchema.ts
-import { z as z9 } from "zod";
-var selectionSchema = z9.strictObject({
-  keep: z9.array(
-    z9.strictObject({
-      file: z9.string().trim().min(1, "file is required"),
-      from: z9.string().trim().min(1, "from is required"),
-      to: z9.string().trim().min(1, "to is required")
+import { z as z10 } from "zod";
+var selectionSchema = z10.strictObject({
+  keep: z10.array(
+    z10.strictObject({
+      file: z10.string().trim().min(1, "file is required"),
+      from: z10.string().trim().min(1, "from is required"),
+      to: z10.string().trim().min(1, "to is required")
     })
   ).min(1, "a selection needs at least one keep range"),
-  removed: z9.array(z9.string().trim().min(1)).default([])
+  removed: z10.array(z10.string().trim().min(1)).default([])
 });
 
 // src/commands/transcript/widenAudienceInText.ts
@@ -40228,14 +40236,6 @@ function registerRun(program2) {
 
 // src/commands/sessions/nodes/formatLink.ts
 import chalk253 from "chalk";
-
-// src/commands/sessions/daemon/links/describeTarget.ts
-function describeTarget({ url, ssh }) {
-  if (!ssh) return `direct ${url}`;
-  return `ssh ${ssh.alias}:${ssh.port} via 127.0.0.1:${ssh.localPort}`;
-}
-
-// src/commands/sessions/nodes/formatLink.ts
 var STATE_COLOURS = {
   connected: chalk253.green,
   connecting: chalk253.yellow,
@@ -40247,7 +40247,7 @@ function formatLink(link3) {
   const peer = link3.peerVersion ? ` peer ${link3.peerVersion}` : "";
   const error = link3.error ? `
     ${chalk253.dim(`last error${link3.errorAt ? ` ${link3.errorAt}` : ""}: ${link3.error}`)}` : "";
-  return `  ${link3.name} ${colour(link3.state)} ${describeTarget(link3)}${peer}${error}`;
+  return `  ${link3.name} ${colour(link3.state)} ${link3.url}${peer}${error}`;
 }
 
 // src/commands/sessions/daemon/listDaemonPids.ts
@@ -40479,9 +40479,9 @@ function createAutoExit(exit, graceMs = DEFAULT_GRACE_MS) {
 }
 
 // src/commands/sessions/daemon/loadActiveSelection.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var ACTIVE_FILE = "active.json";
-var activeSelectionSchema = z10.record(z10.string(), z10.string());
+var activeSelectionSchema = z11.record(z11.string(), z11.string());
 function loadActiveSelection() {
   const parsed = activeSelectionSchema.safeParse(
     loadJson(ACTIVE_FILE)
@@ -44144,10 +44144,10 @@ function restoreAllSessions(spawner, sessions, notify2) {
 
 // src/commands/sessions/daemon/retrySession.ts
 function retrySession(session, clients, onStatusChange) {
-  const spawn12 = respawnThunk(session);
-  if (!spawn12) return false;
+  const spawn10 = respawnThunk(session);
+  if (!spawn10) return false;
   const respawn = () => {
-    respawnSession(session, spawn12, "running", clients, onStatusChange);
+    respawnSession(session, spawn10, "running", clients, onStatusChange);
     daemonLog(`session ${session.id} retried: ${session.name}`);
   };
   const pty2 = session.pty;
@@ -44721,134 +44721,6 @@ async function selfUpdatePeer(url) {
   throw new Error(body.error ?? `self-update responded ${response.status}`);
 }
 
-// src/commands/sessions/daemon/links/SshTunnel.ts
-import { createInterface as createInterface10 } from "readline";
-import { setTimeout as delay2 } from "timers/promises";
-
-// src/commands/sessions/daemon/links/killOrphanOnDaemonExit.ts
-var liveChildren = /* @__PURE__ */ new Set();
-var exitHookInstalled = false;
-function killOrphanOnDaemonExit(child) {
-  liveChildren.add(child);
-  child.once("exit", () => liveChildren.delete(child));
-  if (exitHookInstalled) return;
-  exitHookInstalled = true;
-  process.once("exit", () => {
-    for (const live of liveChildren) live.kill();
-  });
-}
-
-// src/commands/sessions/daemon/links/sshTunnelArgs.ts
-function sshTunnelArgs({ alias, port, localPort }) {
-  return [
-    "-N",
-    "-o",
-    "BatchMode=yes",
-    "-o",
-    "ExitOnForwardFailure=yes",
-    "-o",
-    "ServerAliveInterval=15",
-    "-o",
-    "ServerAliveCountMax=3",
-    "-L",
-    `${localPort}:127.0.0.1:${port}`,
-    alias
-  ];
-}
-
-// src/commands/sessions/daemon/links/SshTunnelIo.ts
-import { spawn as spawn10 } from "child_process";
-
-// src/commands/sessions/shared/portAccepts.ts
-import { connect as connect3 } from "net";
-function portAccepts(port, timeoutMs = 1e3) {
-  return new Promise((resolve26) => {
-    const socket = connect3({ host: "127.0.0.1", port });
-    const settle = (ok) => {
-      socket.destroy();
-      resolve26(ok);
-    };
-    socket.setTimeout(timeoutMs, () => settle(false));
-    socket.once("connect", () => settle(true));
-    socket.once("error", () => settle(false));
-  });
-}
-
-// src/commands/sessions/daemon/links/SshTunnelIo.ts
-var defaultSshTunnelIo = {
-  spawn: (args) => spawn10("ssh", args, {
-    stdio: ["ignore", "ignore", "pipe"],
-    windowsHide: true
-  }),
-  accepts: (port) => portAccepts(port),
-  bindTimeoutMs: 15e3,
-  pollMs: 200
-};
-
-// src/commands/sessions/daemon/links/SshTunnel.ts
-var SshTunnel = class {
-  constructor(name, target, io = defaultSshTunnelIo) {
-    this.name = name;
-    this.target = target;
-    this.io = io;
-  }
-  child;
-  exitReason = "";
-  lastStderr = "";
-  async ready() {
-    if (!this.child) this.start();
-    await this.waitBound(this.child);
-  }
-  dispose() {
-    const child = this.child;
-    this.child = void 0;
-    if (!child) return;
-    daemonLog(`link ${this.name} tunnel: stopping ssh`);
-    child.kill();
-  }
-  start() {
-    const args = sshTunnelArgs(this.target);
-    daemonLog(`link ${this.name} tunnel: spawning ssh ${args.join(" ")}`);
-    const child = this.io.spawn(args);
-    this.child = child;
-    this.lastStderr = "";
-    killOrphanOnDaemonExit(child);
-    if (child.stderr)
-      createInterface10({ input: child.stderr }).on("line", (line) => {
-        this.lastStderr = line;
-        daemonLog(`link ${this.name} ssh: ${line}`);
-      });
-    child.once("error", (error) => this.onExit(child, error.message));
-    child.once(
-      "exit",
-      (code, signal) => this.onExit(child, signal ? `signal ${signal}` : `code ${code}`)
-    );
-  }
-  onExit(child, reason4) {
-    if (this.child !== child) return;
-    this.child = void 0;
-    this.exitReason = this.lastStderr ? `${reason4}: ${this.lastStderr}` : reason4;
-    daemonLog(`link ${this.name} tunnel: ssh exited (${this.exitReason})`);
-  }
-  async waitBound(child) {
-    const { alias, localPort } = this.target;
-    const deadline = Date.now() + this.io.bindTimeoutMs;
-    while (Date.now() < deadline) {
-      if (this.child !== child)
-        throw new Error(`ssh tunnel to ${alias} exited (${this.exitReason})`);
-      if (await this.io.accepts(localPort)) return;
-      await delay2(this.io.pollMs);
-    }
-    this.dispose();
-    throw new Error(
-      `ssh tunnel to ${alias} did not bind 127.0.0.1:${localPort} within ${this.io.bindTimeoutMs / 1e3}s`
-    );
-  }
-};
-
-// src/commands/sessions/daemon/links/sshTunnelFor.ts
-var sshTunnelFor = (spec) => spec.ssh ? new SshTunnel(spec.name, spec.ssh) : void 0;
-
 // src/commands/sessions/daemon/links/linkDeps.ts
 function linkDeps(options2, callbacks) {
   return {
@@ -44866,7 +44738,6 @@ function linkDeps(options2, callbacks) {
       callbacks.onHistoryChanged
     ),
     transport: options2.transport ?? connectLinkWebSocket,
-    tunnel: options2.tunnel ?? sshTunnelFor,
     heal: options2.heal ?? selfUpdatePeer,
     reconnectMs: options2.reconnectMs ?? 3e3,
     blockedRetryMs: options2.blockedRetryMs ?? 6e4,
@@ -44973,7 +44844,6 @@ function createLinkContext(spec, deps2) {
     deps: deps2,
     relay: createRelayState(spec.name, deps2),
     breaker: new LaunchCircuitBreaker(`link ${spec.name} ws`),
-    tunnel: deps2.tunnel(spec),
     socket: null,
     greeted: false,
     state: "disconnected",
@@ -44992,7 +44862,6 @@ function describeLink(ctx) {
   return {
     name: ctx.spec.name,
     url: ctx.spec.url,
-    ssh: ctx.spec.ssh,
     state: ctx.state,
     error: ctx.blockedMessage ?? ctx.lastError?.message,
     errorAt: ctx.lastError?.at,
@@ -45092,16 +44961,16 @@ function linkHealRefusal(node, peerVersion, healAttempted) {
 }
 
 // src/commands/sessions/daemon/links/scheduleReconnect.ts
-function armReconnect(ctx, delay3) {
+function armReconnect(ctx, delay2) {
   clearTimeout(ctx.reconnectTimer);
-  ctx.reconnectTimer = setTimeout(ctx.connect, delay3);
+  ctx.reconnectTimer = setTimeout(ctx.connect, delay2);
   ctx.reconnectTimer.unref?.();
 }
 function scheduleReconnect2(ctx) {
   if (ctx.disposed) return;
   if (ctx.blockedMessage) return armReconnect(ctx, ctx.deps.blockedRetryMs);
-  const delay3 = ctx.breaker.tripped() ? ctx.breaker.remainingMs() : ctx.deps.reconnectMs;
-  armReconnect(ctx, delay3);
+  const delay2 = ctx.breaker.tripped() ? ctx.breaker.remainingMs() : ctx.deps.reconnectMs;
+  armReconnect(ctx, delay2);
 }
 function reconnectNow(ctx) {
   ctx.breaker.clear();
@@ -45365,8 +45234,6 @@ async function openLink(ctx) {
   if (ctx.breaker.tripped()) return scheduleReconnect2(ctx);
   if (!ctx.blockedMessage) setLinkState(ctx, "connecting");
   try {
-    await ctx.tunnel?.ready();
-    if (ctx.disposed) return;
     daemonLog(`link ${ctx.spec.name} ws: connecting to ${ctx.spec.url}`);
     const socket = await ctx.deps.transport(ctx.spec.url, {
       onLine: guardLinkCallback(
@@ -45446,18 +45313,14 @@ var NodeLink = class {
     this.ctx.disposed = true;
     clearTimeout(this.ctx.reconnectTimer);
     disconnectLink(this.ctx);
-    this.ctx.tunnel?.dispose();
   }
 };
 
 // src/commands/sessions/daemon/links/reconcileLinks.ts
-function sameTarget(wanted, current) {
-  return wanted?.url === current.url && JSON.stringify(wanted.ssh) === JSON.stringify(current.ssh);
-}
 function reconcileLinks(links2, specs, create) {
   const wanted = new Map(specs.map((spec) => [spec.name, spec]));
   for (const [name, link3] of links2) {
-    if (sameTarget(wanted.get(name), link3.spec)) {
+    if (wanted.get(name)?.url === link3.spec.url) {
       link3.unlatch();
       continue;
     }
@@ -45467,7 +45330,7 @@ function reconcileLinks(links2, specs, create) {
   }
   for (const spec of specs) {
     if (links2.has(spec.name)) continue;
-    daemonLog(`link ${spec.name}: added (${describeTarget(spec)})`);
+    daemonLog(`link ${spec.name}: added (${spec.url})`);
     const link3 = create(spec);
     links2.set(spec.name, link3);
     link3.start();
@@ -45997,7 +45860,7 @@ function exitAfterFlush(code) {
 }
 
 // src/commands/sessions/daemon/handleConnection.ts
-import { createInterface as createInterface11 } from "readline";
+import { createInterface as createInterface10 } from "readline";
 
 // src/commands/sessions/daemon/handleHelloRequest.ts
 var handleHelloRequest = (client, m, d) => {
@@ -46012,10 +45875,10 @@ var handleHelloRequest = (client, m, d) => {
 };
 
 // src/commands/sessions/daemon/creator.ts
-function creator(isNew, spawn12) {
+function creator(isNew, spawn10) {
   return (client, m, d) => {
     if (m.links.route(client, d)) return;
-    const result = spawn12(m, d);
+    const result = spawn10(m, d);
     if (typeof result !== "string") {
       sendTo(client, { type: "error", message: result.error });
       return;
@@ -46583,7 +46446,7 @@ function handleConnection(socket, manager) {
   };
   manager.addClient(client);
   manager.clients.greet(client);
-  const lines2 = createInterface11({ input: socket });
+  const lines2 = createInterface10({ input: socket });
   lines2.on("error", () => {
   });
   lines2.on("line", (line) => {
@@ -46782,37 +46645,6 @@ function failed2(hop, error, remediation) {
   return { hop, ok: false, error, remediation };
 }
 
-// src/commands/sessions/nodes/agentHop.ts
-var ONEPASSWORD_AGENT = '"~/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock"';
-async function agentHop(ssh, probes) {
-  const agent = await probes.sshAgent(ssh.alias);
-  switch (agent.status) {
-    case "ok":
-      return passed(
-        "agent",
-        `${agent.keys} key(s)${agent.socket ? ` via ${agent.socket}` : ""}`
-      );
-    case "missing":
-      return failed2(
-        "agent",
-        `no IdentityAgent for ${ssh.alias} and SSH_AUTH_SOCK is unset`,
-        `IdentityAgent missing \u2014 add \`IdentityAgent ${ONEPASSWORD_AGENT}\` under \`Host ${ssh.alias}\` in ~/.ssh/config`
-      );
-    case "no-keys":
-      return failed2(
-        "agent",
-        `the agent${agent.socket ? ` at ${agent.socket}` : ""} holds no keys`,
-        "add or import an SSH key in 1Password, then allow it in the SSH agent"
-      );
-    case "unreachable":
-      return failed2(
-        "agent",
-        agent.error,
-        "1Password SSH agent not reachable \u2014 open and unlock 1Password and turn on Settings \u2192 Developer \u2192 Use the SSH agent"
-      );
-  }
-}
-
 // src/commands/sessions/nodes/fetchPeerJson.ts
 var PEER_TIMEOUT_MS = 3e3;
 function peerErrorCode(error) {
@@ -46899,45 +46731,6 @@ function linkStateHop(spec, probes) {
   );
 }
 
-// src/commands/sessions/nodes/sshHop.ts
-var REMEDIATIONS = [
-  [
-    /connection refused/i,
-    (alias) => `Remote Login is off on ${alias} \u2014 on a Mac turn on System Settings \u2192 General \u2192 Sharing \u2192 Remote Login; on Windows run \`Start-Service sshd\` (OpenSSH Server)`
-  ],
-  [
-    /could not resolve hostname/i,
-    (alias) => `no \`Host ${alias}\` in ~/.ssh/config and ${alias} does not resolve \u2014 add a Host entry with its HostName`
-  ],
-  [
-    /host key verification failed/i,
-    (alias) => `run \`ssh ${alias}\` once to accept its host key`
-  ],
-  [
-    /agent refused operation|sign_and_send_pubkey/i,
-    () => "1Password refused to sign \u2014 unlock it and approve the key request"
-  ],
-  [
-    /permission denied/i,
-    (alias) => `${alias} rejected every key offered \u2014 add this node's 1Password public key to ~/.ssh/authorized_keys on ${alias} (C:\\ProgramData\\ssh\\administrators_authorized_keys for a Windows administrator)`
-  ],
-  [
-    /timed out/i,
-    (alias) => `${alias} did not answer on its ssh port \u2014 is it awake and on this network?`
-  ]
-];
-async function sshHop(ssh, probes) {
-  const { code, stderr } = await probes.ssh(ssh.alias);
-  if (code === 0) return passed("ssh", `ssh ${ssh.alias} authenticated`);
-  const error = stderr || `ssh exited ${code}`;
-  const match = REMEDIATIONS.find(([pattern2]) => pattern2.test(error));
-  return failed2(
-    "ssh",
-    error,
-    match?.[1](ssh.alias) ?? `run \`ssh -v ${ssh.alias}\` to see where it fails`
-  );
-}
-
 // src/commands/sessions/nodes/findTailscalePeer.ts
 function findTailscalePeer(status2, hostname2) {
   const nodes = [
@@ -46988,18 +46781,6 @@ async function tailscaleHop(spec, probes) {
   );
 }
 
-// src/commands/sessions/nodes/tunnelHop.ts
-async function tunnelHop(spec, ssh, probes) {
-  const bound = `127.0.0.1:${ssh.localPort}`;
-  if (await probes.tunnel(ssh.localPort))
-    return passed("tunnel", `${bound} \u2192 ${ssh.alias}:${ssh.port}`);
-  return failed2(
-    "tunnel",
-    `nothing bound on ${bound}`,
-    `this node's daemon keeps \`ssh -N -L ${ssh.localPort}:127.0.0.1:${ssh.port} ${ssh.alias}\` up \u2014 run \`assist daemon restart\` and check daemon.log for \`link ${spec.name} tunnel:\` and \`link ${spec.name} ssh:\` lines`
-  );
-}
-
 // src/commands/sessions/nodes/tailscaleServeRemediation.ts
 function tailscaleServeRemediation(spec, error) {
   const status2 = error.status;
@@ -47016,8 +46797,6 @@ function isTailscaleLink(spec) {
 
 // src/commands/sessions/nodes/webHop.ts
 function webRemediation(spec, error) {
-  if (spec.ssh && error.status === void 0)
-    return `nothing listening on ${spec.ssh.port} on ${spec.ssh.alias} \u2014 is project-switch running ${spec.name}'s web server?`;
   const serve = isTailscaleLink(spec) ? tailscaleServeRemediation(spec, error) : void 0;
   if (serve) return serve;
   const { hostname: hostname2, port } = new URL(spec.url);
@@ -47047,7 +46826,7 @@ async function webHop(spec, probes) {
       hop: failed2(
         "web",
         `peer reports nodeName ${health2.nodeName}, link expects ${spec.name}`,
-        `relink with \`assist sessions nodes unlink ${spec.name}\` then \`assist sessions nodes link ${health2.nodeName} ${spec.ssh ? `--ssh ${spec.ssh.alias} --port ${spec.ssh.port}` : spec.url}\`, or set sessions.nodeName on the peer`
+        `relink with \`assist sessions nodes unlink ${spec.name}\` then \`assist sessions nodes link ${health2.nodeName} ${spec.url}\`, or set sessions.nodeName on the peer`
       )
     };
   return {
@@ -47073,17 +46852,6 @@ function peerDaemonHop(spec, health2) {
 async function diagnoseLink(spec, probes) {
   const hops = [];
   const done2 = () => ({ ...spec, ok: hops.every((h) => h.ok), hops });
-  if (spec.ssh) {
-    const { ssh } = spec;
-    for (const probe of [
-      () => agentHop(ssh, probes),
-      () => sshHop(ssh, probes),
-      () => tunnelHop(spec, ssh, probes)
-    ]) {
-      hops.push(await probe());
-      if (!hops.at(-1)?.ok) return done2();
-    }
-  }
   if (isTailscaleLink(spec)) {
     hops.push(await tailscaleHop(spec, probes));
     if (!hops.at(-1)?.ok) return done2();
@@ -47146,77 +46914,6 @@ async function probePeerHello(url) {
   return result;
 }
 
-// src/commands/sessions/nodes/probeSsh.ts
-import { spawn as spawn11 } from "child_process";
-var PROBE_TIMEOUT_MS = 15e3;
-function probeSsh(alias) {
-  return new Promise((resolve26) => {
-    const child = spawn11(
-      "ssh",
-      ["-o", "BatchMode=yes", "-o", "ConnectTimeout=5", alias, "exit"],
-      { stdio: ["ignore", "ignore", "pipe"], windowsHide: true }
-    );
-    let stderr = "";
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk;
-    });
-    const timer = setTimeout(() => child.kill(), PROBE_TIMEOUT_MS);
-    child.once("error", (error) => {
-      clearTimeout(timer);
-      resolve26({ code: null, stderr: error.message });
-    });
-    child.once("close", (code) => {
-      clearTimeout(timer);
-      resolve26({ code, stderr: stderr.trim() });
-    });
-  });
-}
-
-// src/commands/sessions/nodes/probeSshAgent.ts
-import { spawnSync as spawnSync9 } from "child_process";
-import { homedir as homedir25 } from "os";
-var PROBE_TIMEOUT_MS2 = 5e3;
-function parseIdentityAgent(sshConfig, env = process.env) {
-  const line = sshConfig.split(/\r?\n/).find((l) => l.toLowerCase().startsWith("identityagent "));
-  const value = line?.slice("identityagent ".length).trim().replace(/^"(.*)"$/, "$1");
-  if (!value || value.toLowerCase() === "none") return void 0;
-  if (value === "SSH_AUTH_SOCK" || value === "$SSH_AUTH_SOCK")
-    return env.SSH_AUTH_SOCK;
-  return value.replace(/^~(?=$|[/\\])/, homedir25());
-}
-function configuredAgent(alias) {
-  const result = spawnSync9("ssh", ["-G", alias], {
-    encoding: "utf8",
-    timeout: PROBE_TIMEOUT_MS2,
-    windowsHide: true
-  });
-  return parseIdentityAgent(result.stdout ?? "") ?? process.env.SSH_AUTH_SOCK;
-}
-async function probeSshAgent(alias) {
-  const socket = configuredAgent(alias);
-  if (!socket && process.platform !== "win32") return { status: "missing" };
-  const result = spawnSync9("ssh-add", ["-l"], {
-    encoding: "utf8",
-    timeout: PROBE_TIMEOUT_MS2,
-    windowsHide: true,
-    env: socket ? { ...process.env, SSH_AUTH_SOCK: socket } : process.env
-  });
-  if (result.error)
-    return { status: "unreachable", socket, error: result.error.message };
-  if (result.status === 0)
-    return {
-      status: "ok",
-      socket,
-      keys: result.stdout.trim().split(/\r?\n/).length
-    };
-  if (result.status === 1) return { status: "no-keys", socket };
-  return {
-    status: "unreachable",
-    socket,
-    error: result.stderr.trim() || `ssh-add exited ${result.status}`
-  };
-}
-
 // src/commands/sessions/nodes/printReport.ts
 import chalk254 from "chalk";
 function printReport(report2) {
@@ -47245,9 +46942,6 @@ function doctorProbes(live) {
   return {
     health: (url) => fetchPeerJson(url, "/api/health"),
     hello: probePeerHello,
-    sshAgent: probeSshAgent,
-    ssh: probeSsh,
-    tunnel: (localPort) => portAccepts(localPort),
     tailscale: tailscaleStatus,
     linkState: (name) => {
       if (!live) return "no-daemon";
@@ -47329,7 +47023,7 @@ async function nodeLogs(name, options2) {
 }
 
 // src/commands/sessions/nodes/linkNode.ts
-import chalk257 from "chalk";
+import chalk258 from "chalk";
 
 // src/commands/sessions/nodes/notifyDaemonLinks.ts
 import chalk256 from "chalk";
@@ -47355,11 +47049,10 @@ async function notifyDaemonLinks() {
   }
 }
 
+// src/commands/sessions/nodes/readLinks.ts
+import chalk257 from "chalk";
+
 // src/commands/sessions/nodes/writeLinks.ts
-function readLinks() {
-  const sessions = loadGlobalConfigRaw().sessions;
-  return sessions?.links ?? [];
-}
 async function writeLinks(links2) {
   const config = loadGlobalConfigRaw();
   const sessions = { ...config.sessions };
@@ -47371,6 +47064,20 @@ async function writeLinks(links2) {
   saveGlobalConfig(updated2);
 }
 
+// src/commands/sessions/nodes/readLinks.ts
+async function readLinks() {
+  const sessions = loadGlobalConfigRaw().sessions;
+  const stored = sessions?.links ?? [];
+  const links2 = stored.filter((link3) => !!link3.url);
+  if (links2.length === stored.length) return links2;
+  await writeLinks(links2);
+  const dropped = stored.filter((link3) => !link3.url).map((link3) => link3.name);
+  console.log(
+    chalk257.yellow(`Removed ${dropped.join(", ")}: ${SSH_LINK_RETIRED}`)
+  );
+  return links2;
+}
+
 // src/commands/sessions/nodes/tailscaleLinkUrl.ts
 async function localTailnetSuffix() {
   return tailnetSuffix(await tailscaleStatus());
@@ -47399,82 +47106,54 @@ function parseLinkUrl(url) {
 }
 
 // src/commands/sessions/nodes/buildLink.ts
-async function buildLink(name, url, options2, others, resolveTailnetSuffix) {
-  if ([url, options2.ssh, options2.tailscale].filter(Boolean).length > 1)
-    throw new Error(
-      "pass only one of <url>, --tailscale <host> or --ssh <alias>"
-    );
+async function buildLink(name, url, options2, resolveTailnetSuffix) {
+  if (url && options2.tailscale)
+    throw new Error("pass only one of <url> or --tailscale <host>");
   if (url) return { name, url: parseLinkUrl(url) };
-  if (options2.tailscale) {
-    const port2 = parsePort("--port", options2.port);
-    return {
-      name,
-      url: await tailscaleLinkUrl(
-        options2.tailscale,
-        port2,
-        resolveTailnetSuffix
-      )
-    };
-  }
-  if (!options2.ssh)
+  if (!options2.tailscale)
     throw new Error(
-      "pass the peer's <url>, --tailscale <host> --port <port> or --ssh <alias> --port <port>"
+      "pass the peer's <url> or --tailscale <host> --port <port>"
     );
   const port = parsePort("--port", options2.port);
-  const localPort = options2.localPort ? parsePort("--local-port", options2.localPort) : freeTunnelPort(port, others);
-  return { name, ssh: options2.ssh, port, localPort };
-}
-function freeTunnelPort(port, others) {
-  const taken = new Set(others.map((link3) => toLinkSpec(link3).ssh?.localPort));
-  let candidate = defaultTunnelPort(port);
-  while (taken.has(candidate)) candidate++;
-  return candidate;
+  return {
+    name,
+    url: await tailscaleLinkUrl(options2.tailscale, port, resolveTailnetSuffix)
+  };
 }
 
 // src/commands/sessions/nodes/linkNode.ts
 async function linkNode(name, url, options2) {
   if (name.includes(":")) throw new Error("node names cannot contain ':'");
+  const others = (await readLinks()).filter((link4) => link4.name !== name);
   if (name === resolveNodeName())
     throw new Error(`${name} is this node; link to a different node`);
-  const others = readLinks().filter((link4) => link4.name !== name);
-  const link3 = await buildLink(name, url, options2, others);
+  const link3 = await buildLink(name, url, options2);
   await writeLinks([...others, link3]);
-  console.log(
-    chalk257.green(`Linked ${name} (${describeTarget(toLinkSpec(link3))})`)
-  );
+  console.log(chalk258.green(`Linked ${name} (${link3.url})`));
   await notifyDaemonLinks();
 }
 
 // src/commands/sessions/nodes/registerLinkCommand.ts
 function registerLinkCommand(nodes) {
   nodes.command("link <name> [url]").description(
-    "Link a peer node by its web server URL, by its Tailscale name with --tailscale and --port, or over ssh with --ssh and --port (name must match the peer's sessions.nodeName)"
+    "Link a peer node by its web server URL or by its Tailscale name with --tailscale and --port (name must match the peer's sessions.nodeName)"
   ).option(
     "--tailscale <host>",
     "Dial the peer at https://<host>.<tailnet>.ts.net:<port> (the peer runs tailscale serve for its web server port)"
-  ).option(
-    "--ssh <alias>",
-    "Tunnel to the peer through this ~/.ssh/config alias"
-  ).option(
-    "--port <port>",
-    "The peer's web server port (with --tailscale or --ssh)"
-  ).option(
-    "--local-port <port>",
-    "Local end of the ssh tunnel (default: 43000 + port % 1000, bumped past other links)"
-  ).action(linkNode);
+  ).option("--port <port>", "The peer's web server port (with --tailscale)").action(linkNode);
 }
 
 // src/commands/sessions/nodes/unlinkNode.ts
-import chalk258 from "chalk";
+import chalk259 from "chalk";
 async function unlinkNode(name) {
-  const links2 = readLinks();
+  const links2 = await readLinks();
   const remaining = links2.filter((link3) => link3.name !== name);
   if (remaining.length === links2.length) {
-    console.log(chalk258.yellow(`No link named ${name}`));
+    console.log(chalk259.yellow(`No link named ${name}`));
     return;
   }
   await writeLinks(remaining);
-  console.log(chalk258.green(`Unlinked ${name}`));
+  console.log(chalk259.green(`Unlinked ${name}`));
   await notifyDaemonLinks();
 }
 
@@ -47495,14 +47174,14 @@ function registerNodes(sessions) {
 }
 
 // src/commands/sessions/daemon/requestSessionOutput.ts
-import { createInterface as createInterface12 } from "readline";
+import { createInterface as createInterface11 } from "readline";
 var OUTPUT_TIMEOUT_MS = 5e3;
 async function requestSessionOutput(target) {
   const socket = await connectToDaemon().catch(() => {
     throw new Error("No sessions daemon is running");
   });
   try {
-    const lines2 = createInterface12({ input: socket });
+    const lines2 = createInterface11({ input: socket });
     lines2.on("error", () => {
     });
     const reply2 = readDaemonMessage(
@@ -47605,7 +47284,7 @@ async function renameSession(title) {
 
 // src/commands/sessions/summarise.ts
 import * as fs58 from "fs";
-import chalk259 from "chalk";
+import chalk260 from "chalk";
 
 // src/commands/sessions/summarise/shared.ts
 import * as fs57 from "fs";
@@ -47664,22 +47343,22 @@ ${firstMessage}`);
 async function summarise2(options2) {
   const files = await discoverSessionFiles();
   if (files.length === 0) {
-    console.log(chalk259.yellow("No sessions found."));
+    console.log(chalk260.yellow("No sessions found."));
     return;
   }
   const toProcess = selectCandidates(files, options2);
   if (toProcess.length === 0) {
-    console.log(chalk259.green("All sessions already summarised."));
+    console.log(chalk260.green("All sessions already summarised."));
     return;
   }
   console.log(
-    chalk259.cyan(
+    chalk260.cyan(
       `Summarising ${toProcess.length} session(s) (${files.length} total)\u2026`
     )
   );
   const { succeeded, failed: failed3 } = processSessions(toProcess);
   console.log(
-    chalk259.green(`Done: ${succeeded} summarised`) + (failed3 > 0 ? chalk259.yellow(`, ${failed3} skipped`) : "")
+    chalk260.green(`Done: ${succeeded} summarised`) + (failed3 > 0 ? chalk260.yellow(`, ${failed3} skipped`) : "")
   );
 }
 function selectCandidates(files, options2) {
@@ -47699,16 +47378,16 @@ function processSessions(files) {
   let failed3 = 0;
   for (let i = 0; i < files.length; i++) {
     const file = files[i];
-    process.stdout.write(chalk259.dim(`  [${i + 1}/${files.length}] `));
+    process.stdout.write(chalk260.dim(`  [${i + 1}/${files.length}] `));
     const summary = summariseSession(file);
     if (summary) {
       writeSummary(file, summary);
       succeeded++;
-      process.stdout.write(`${chalk259.green("\u2713")} ${summary}
+      process.stdout.write(`${chalk260.green("\u2713")} ${summary}
 `);
     } else {
       failed3++;
-      process.stdout.write(` ${chalk259.yellow("skip")}
+      process.stdout.write(` ${chalk260.yellow("skip")}
 `);
     }
   }
@@ -47738,10 +47417,10 @@ function registerSessions(program2) {
 }
 
 // src/reportCliError.ts
-import chalk260 from "chalk";
+import chalk261 from "chalk";
 function reportCliError(error) {
   if (error instanceof InvalidItemIdError || error instanceof AmbiguousRepoConfigError || error instanceof UnknownRepoConfigError || error instanceof MissingRunCwdError || error instanceof MiroExtractError) {
-    console.error(chalk260.red(error.message));
+    console.error(chalk261.red(error.message));
   } else {
     console.error(error);
   }