@standardagents/code 0.8.0 → 0.9.0

package/dist/index.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import os6, { homedir } from 'os';
-import fs4 from 'fs';
+import os9, { homedir } from 'os';
 import path3 from 'path';
 import readline2 from 'readline/promises';
-import { spawn, execFile } from 'child_process';
 import { stdout, stdin } from 'process';
+import fs4 from 'fs';
 import fsp from 'fs/promises';
 import crypto from 'crypto';
+import { spawn, execFileSync, spawnSync, execFile } from 'child_process';
 import readline from 'readline';
 import { fileURLToPath } from 'url';
 
@@ -251,8 +251,16 @@ var ApiClient = class {
    * Retries with backoff — this is the durable delivery path, so it must land
    * even if the connection is briefly flaky after a permission wait.
    */
-  async postToolResult(threadId, toolCallId, ok, result, error) {
-    const body = JSON.stringify({ tool_call_id: toolCallId, ok, result, error });
+  async postToolResult(threadId, toolCallId, ok, result, error, executor) {
+    const body = JSON.stringify({
+      tool_call_id: toolCallId,
+      ok,
+      result,
+      error,
+      // Ownership fence: calls dispatched to a specific execution owner are
+      // only accepted back from that owner at that generation.
+      ...executor ? { client_id: executor.clientId, generation: executor.generation ?? 0 } : {}
+    });
     for (let attempt = 0; attempt < 6; attempt++) {
       try {
         await this.json(`/api/threads/${threadId}/tool-result`, {
@@ -283,6 +291,39 @@ var ApiClient = class {
       return null;
     }
   }
+  // ── account-wide user KV (per-user, spans every thread) ───────────────────
+  // Backed by the instance's /api/users/me/kv store. This is where the machine
+  // registry lives: which machines (laptops / VPS daemons) belong to this
+  // account, and which projects each machine has.
+  /** Read one value from the signed-in user's account-wide KV (null if absent). */
+  async userKvGet(key) {
+    try {
+      const res = await this.json(
+        `/api/users/me/kv?key=${encodeURIComponent(key)}`
+      );
+      return res?.value ?? null;
+    } catch {
+      return null;
+    }
+  }
+  /** Write one value to the signed-in user's account-wide KV (null deletes). */
+  async userKvSet(key, value) {
+    await this.json(`/api/users/me/kv`, {
+      method: "POST",
+      body: JSON.stringify({ key, value })
+    });
+  }
+  /** List the signed-in user's account-wide KV entries under a key prefix. */
+  async userKvList(prefix) {
+    try {
+      const res = await this.json(
+        `/api/users/me/kv?prefix=${encodeURIComponent(prefix)}&limit=200`
+      );
+      return Array.isArray(res?.entries) ? res.entries : [];
+    } catch {
+      return [];
+    }
+  }
   /** Read a value from the thread's durable KV store (null if absent). */
   async kvGet(threadId, key) {
     try {
@@ -654,18 +695,20 @@ function gradientText(text, phase = 0) {
 // src/bridge.ts
 var PATH_ARG_TOOLS = /* @__PURE__ */ new Set(["read_file", "grep", "glob", "write_file", "edit_file"]);
 var Bridge = class {
-  constructor(api, threadId, host, perm, hooks) {
+  constructor(api, threadId, host, perm, hooks, identity) {
     this.api = api;
     this.threadId = threadId;
     this.host = host;
     this.perm = perm;
     this.hooks = hooks;
+    this.identity = identity;
   }
   api;
   threadId;
   host;
   perm;
   hooks;
+  identity;
   ws = null;
   closed = false;
   heartbeat = null;
@@ -675,6 +718,43 @@ var Bridge = class {
   // Durable forwarded calls we've started handling, so a server re-send (after a
   // reconnect) doesn't prompt or run them twice.
   handledDurable = /* @__PURE__ */ new Set();
+  // Whether this client currently holds execution ownership. Starts true so an
+  // instance that predates the owner concept (no owner field in bridge_ready)
+  // behaves exactly as before; an owner-aware instance sets it on every connect.
+  owner = true;
+  // Ownership generation from the last bridge_ready/owner_changed (echoed in
+  // durable deliveries so the server's fence can match).
+  ownerGeneration = 0;
+  // Resolved once the first owner-aware bridge_ready arrives (or never, on a
+  // legacy instance — callers pair this with a timeout).
+  ownershipKnownResolve = null;
+  ownershipKnownPromise = new Promise((resolve) => {
+    this.ownershipKnownResolve = resolve;
+  });
+  /** Whether this client currently executes forwarded tool calls. */
+  get isOwner() {
+    return this.owner;
+  }
+  /** Adjust the ownership claim used on the NEXT (re)connect — e.g. an
+   * interactive session that became owner reasserts with `takeover` after a
+   * brief drop, instead of silently losing execution to a daemon's
+   * stale-claim probe. */
+  setClaim(claim) {
+    if (this.identity) this.identity.claim = claim;
+  }
+  /**
+   * Resolve once the instance has said whether this client owns execution
+   * (the first owner-aware bridge_ready). Legacy instances never say — the
+   * timeout resolves to the current (assumed-owner) state so callers can gate
+   * owner-only side effects like session_info/mcp_catalog writes.
+   */
+  async whenOwnershipKnown(timeoutMs = 3e3) {
+    await Promise.race([
+      this.ownershipKnownPromise,
+      new Promise((resolve) => setTimeout(resolve, timeoutMs))
+    ]);
+    return this.owner;
+  }
   /**
    * Connect and keep the bridge connected. Resolves on the first successful
    * open; thereafter any drop is reconnected automatically with exponential
@@ -697,7 +777,13 @@ var Bridge = class {
   }
   openSocket() {
     if (this.closed) return;
-    const url = `${this.api.wsEndpoint}/api/threads/${this.threadId}/bridge?token=${encodeURIComponent(this.api.bearer)}`;
+    let url = `${this.api.wsEndpoint}/api/threads/${this.threadId}/bridge?token=${encodeURIComponent(this.api.bearer)}`;
+    if (this.identity) {
+      url += `&client_id=${encodeURIComponent(this.identity.clientId)}&client_kind=${encodeURIComponent(this.identity.clientKind)}&claim=${encodeURIComponent(this.identity.claim)}`;
+      if (this.identity.clientName) {
+        url += `&client_name=${encodeURIComponent(this.identity.clientName)}`;
+      }
+    }
     let ws;
     try {
       ws = new WebSocket(url);
@@ -718,7 +804,17 @@ var Bridge = class {
       this.onMessage(String(ev.data));
     });
     ws.addEventListener("error", () => this.handleDrop(ws));
-    ws.addEventListener("close", () => this.handleDrop(ws));
+    ws.addEventListener("close", (ev) => {
+      if (ev.code === 4001 && this.ws === ws) {
+        this.closed = true;
+        this.owner = false;
+        this.ws = null;
+        this.stopHeartbeat();
+        this.hooks.onSuperseded?.();
+        return;
+      }
+      this.handleDrop(ws);
+    });
   }
   handleDrop(ws) {
     if (this.ws !== ws) return;
@@ -757,6 +853,24 @@ var Bridge = class {
     }
     this.ws?.close();
   }
+  /**
+   * Force a reconnect now. Ownership claims are evaluated at bridge connect,
+   * so a non-owner that wants to re-check (e.g. the daemon probing whether a
+   * disconnected interactive owner has gone stale) cycles its socket.
+   */
+  refresh() {
+    if (this.closed) return;
+    const ws = this.ws;
+    if (ws) {
+      try {
+        ws.close();
+      } catch {
+      }
+      this.handleDrop(ws);
+    } else {
+      this.scheduleReconnect();
+    }
+  }
   send(payload) {
     try {
       this.ws?.send(JSON.stringify(payload));
@@ -770,7 +884,44 @@ var Bridge = class {
     } catch {
       return;
     }
+    if (msg.type === "bridge_ready") {
+      if (typeof msg.owner === "boolean") {
+        this.owner = msg.owner;
+        const owner = parseOwnerInfo(msg.current_owner);
+        this.ownerGeneration = owner?.generation ?? 0;
+        if (typeof msg.claim_refused === "string") {
+          this.hooks.onClaimRefused?.(msg.claim_refused);
+        }
+        this.hooks.onOwnership?.(msg.owner, owner);
+        this.ownershipKnownResolve?.();
+      }
+      return;
+    }
+    if (msg.type === "owner_changed") {
+      const owner = parseOwnerInfo(msg.owner);
+      this.owner = !!owner && !!this.identity && owner.client_id === this.identity.clientId;
+      this.ownerGeneration = owner?.generation ?? 0;
+      this.hooks.onOwnership?.(this.owner, owner);
+      return;
+    }
+    if (msg.type === "superseded") {
+      this.closed = true;
+      this.owner = false;
+      this.stopHeartbeat();
+      if (this.reconnectTimer) {
+        clearTimeout(this.reconnectTimer);
+        this.reconnectTimer = null;
+      }
+      try {
+        this.ws?.close();
+      } catch {
+      }
+      this.ws = null;
+      this.hooks.onSuperseded?.();
+      return;
+    }
     if (msg.type !== "tool_request") return;
+    if (!this.owner) return;
     const req = msg;
     await this.handleToolRequest(req);
   }
@@ -781,7 +932,11 @@ var Bridge = class {
    */
   respond(req, ok, result, error) {
     if (req.durable && req.toolCallId) {
-      void this.api.postToolResult(this.threadId, req.toolCallId, ok, result, error);
+      const executor = this.identity ? {
+        clientId: this.identity.clientId,
+        generation: typeof req.generation === "number" ? req.generation : this.ownerGeneration
+      } : void 0;
+      void this.api.postToolResult(this.threadId, req.toolCallId, ok, result, error, executor);
     } else {
       this.send({ type: "tool_response", id: req.id, ok, result, error });
     }
@@ -801,6 +956,8 @@ var Bridge = class {
       this.respond(req, false, void 0, "Blocked: this command is considered catastrophic and was refused by the client safety guard.");
       return;
     }
+    await this.hooks.refreshPermissions?.().catch(() => {
+    });
     const permKey = permissionKey(req);
     const decision = decide(this.perm, permKey, effectiveRisk, !!req.requestPermission);
     if (decision === "deny") {
@@ -845,6 +1002,17 @@ var Bridge = class {
     }
   }
 };
+function parseOwnerInfo(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const r = value;
+  if (typeof r.client_id !== "string" || r.client_id.length === 0) return null;
+  return {
+    client_id: r.client_id,
+    client_name: typeof r.client_name === "string" ? r.client_name : null,
+    client_kind: typeof r.client_kind === "string" ? r.client_kind : null,
+    generation: typeof r.generation === "number" ? r.generation : void 0
+  };
+}
 function permissionKey(req) {
   if (req.tool !== "mcp") return req.tool;
   const a = req.args;
@@ -929,7 +1097,7 @@ function detailSuffix(tool, result) {
   const lines = result.split("\n").length;
   return ` (${lines} line${lines === 1 ? "" : "s"})`;
 }
-var LOG_DIR = path3.join(os6.homedir(), ".standardagents", "process-logs");
+var LOG_DIR = path3.join(os9.homedir(), ".standardagents", "process-logs");
 var KEY2 = "bg_processes";
 function isAlive(pid) {
   try {
@@ -1006,7 +1174,7 @@ var ProcessRegistry = class {
   }
 };
 function configFile() {
-  return process.env.STANDARDAGENTS_MCP_CONFIG || path3.join(os6.homedir(), ".standardagents", "mcp.json");
+  return process.env.STANDARDAGENTS_MCP_CONFIG || path3.join(os9.homedir(), ".standardagents", "mcp.json");
 }
 function loadMcpConfig() {
   try {
@@ -1063,12 +1231,12 @@ function serverFromCommand(name, commandLine, env) {
   const [command, ...args] = parts;
   return { name: cleanName, command, args, env, enabled: true };
 }
-function tokenize(input2) {
+function tokenize(input3) {
   const out = [];
   let cur = "";
   let quote = null;
-  for (let i = 0; i < input2.length; i++) {
-    const ch = input2[i];
+  for (let i = 0; i < input3.length; i++) {
+    const ch = input3[i];
     if (quote) {
       if (ch === quote) quote = null;
       else cur += ch;
@@ -1308,7 +1476,7 @@ var HostTools = class {
       }
     }
     const hash = crypto.createHash("sha256").update(JSON.stringify(files)).digest("hex").slice(0, 12);
-    const skillDir = path3.join(os6.tmpdir(), "standardcode-skills", `${skill}-${hash}`);
+    const skillDir = path3.join(os9.tmpdir(), "standardcode-skills", `${skill}-${hash}`);
     for (const f of files) {
       const dest = path3.resolve(skillDir, f.path);
       if (path3.relative(skillDir, dest).startsWith("..")) {
@@ -2163,7 +2331,7 @@ function fromFile(filePath) {
   }
 }
 async function readDarwin() {
-  const tmp = path3.join(os6.tmpdir(), `sc-clip-${process.pid}-${Date.now()}.png`);
+  const tmp = path3.join(os9.tmpdir(), `sc-clip-${process.pid}-${Date.now()}.png`);
   const script = [
     `set d to the clipboard as \xABclass PNGf\xBB`,
     `set f to open for access POSIX file "${tmp}" with write permission`,
@@ -2200,7 +2368,7 @@ async function readLinux() {
   return null;
 }
 async function readWindows() {
-  const tmp = path3.join(os6.tmpdir(), `sc-clip-${process.pid}-${Date.now()}.png`);
+  const tmp = path3.join(os9.tmpdir(), `sc-clip-${process.pid}-${Date.now()}.png`);
   const ps = [
     "Add-Type -AssemblyName System.Windows.Forms;",
     "$img = [System.Windows.Forms.Clipboard]::GetImage();",
@@ -2373,14 +2541,14 @@ function buildInputBoxRows(opts) {
     const plainChars = [...plain];
     let di = 0;
     for (const ch of plainChars) {
-      const c2 = colorAt(perimeterIndex("top", xi++, W, bodyH));
+      const c4 = colorAt(perimeterIndex("top", xi++, W, bodyH));
       if (ch === "\u25CF" || ch === "\u25CB") {
         const levelN = Math.max(1, Math.min(5, level));
         const filled = di < levelN;
         di++;
-        top += (filled ? levelColor || c2 : "\x1B[38;5;240m") + (filled ? "\u25CF" : "\u25CB") + reset;
+        top += (filled ? levelColor || c4 : "\x1B[38;5;240m") + (filled ? "\u25CF" : "\u25CB") + reset;
       } else {
-        top += c2 + ch + reset;
+        top += c4 + ch + reset;
       }
     }
   }
@@ -2401,10 +2569,10 @@ function buildInputBoxRows(opts) {
   let bottom = "";
   for (let x = 0; x < W; x++) {
     const idx = perimeterIndex("bottom", W - 1 - x, W, bodyH);
-    const c2 = colorAt(idx);
-    if (x === 0) bottom += c2 + "\u2570" + reset;
-    else if (x === W - 1) bottom += c2 + "\u256F" + reset;
-    else bottom += c2 + "\u2500" + reset;
+    const c4 = colorAt(idx);
+    if (x === 0) bottom += c4 + "\u2570" + reset;
+    else if (x === W - 1) bottom += c4 + "\u256F" + reset;
+    else bottom += c4 + "\u2500" + reset;
   }
   return [pad + top, ...bodyRows, pad + bottom];
 }
@@ -3086,7 +3254,7 @@ var Tui = class _Tui {
     const q = this.inputBuffer.slice(1).trim().toLowerCase();
     if (q === "") return this.commands;
     return this.commands.filter(
-      (c2) => c2.name.startsWith(q) || c2.name.includes(q) || c2.label.toLowerCase().includes(q)
+      (c4) => c4.name.startsWith(q) || c4.name.includes(q) || c4.label.toLowerCase().includes(q)
     );
   }
   runCommand(cmd) {
@@ -4171,7 +4339,7 @@ function tableCells(row) {
   let r = row.trim();
   if (r.startsWith("|")) r = r.slice(1);
   if (r.endsWith("|")) r = r.slice(0, -1);
-  return r.split("|").map((c2) => c2.trim());
+  return r.split("|").map((c4) => c4.trim());
 }
 var SEPARATOR = /^[\s|:-]+$/;
 function isTableSeparator(line) {
@@ -4180,17 +4348,17 @@ function isTableSeparator(line) {
 function renderTable(rows) {
   const cols2 = Math.max(...rows.map((r) => r.length));
   const widths = [];
-  for (let c2 = 0; c2 < cols2; c2++) {
-    widths[c2] = Math.max(...rows.map((r) => visibleWidth(inline(r[c2] ?? ""))));
+  for (let c4 = 0; c4 < cols2; c4++) {
+    widths[c4] = Math.max(...rows.map((r) => visibleWidth(inline(r[c4] ?? ""))));
   }
   const sep = `${GRAY} \u2502 ${R}`;
   const out = [];
   rows.forEach((r, ri) => {
     const cells = [];
-    for (let c2 = 0; c2 < cols2; c2++) {
-      const raw = r[c2] ?? "";
+    for (let c4 = 0; c4 < cols2; c4++) {
+      const raw = r[c4] ?? "";
       const styled = ri === 0 ? `${BOLD2}${inline(raw)}${R}` : inline(raw);
-      cells.push(padEndVisible(styled, widths[c2]));
+      cells.push(padEndVisible(styled, widths[c4]));
     }
     out.push(("  " + cells.join(sep)).replace(/\s+$/, ""));
     if (ri === 0) {
@@ -4510,7 +4678,7 @@ var McpManager = class {
     }
   }
   closeAll() {
-    for (const [, c2] of this.clients) c2.close();
+    for (const [, c4] of this.clients) c4.close();
     this.clients.clear();
   }
   get(name) {
@@ -4521,13 +4689,13 @@ var McpManager = class {
   }
   toolCount() {
     let n = 0;
-    for (const [, c2] of this.clients) n += c2.tools.length;
+    for (const [, c4] of this.clients) n += c4.tools.length;
     return n;
   }
   /** A JSON-serializable catalog of every connected server for the KV/context. */
   catalog() {
     return {
-      servers: Array.from(this.clients.values()).map((c2) => c2.catalogEntry()),
+      servers: Array.from(this.clients.values()).map((c4) => c4.catalogEntry()),
       generatedAt: Date.now()
     };
   }
@@ -4617,9 +4785,9 @@ function flattenContent(content, structured) {
 }
 function flattenResourceContents(contents) {
   const parts = [];
-  for (const c2 of contents || []) {
-    if (typeof c2.text === "string") parts.push(c2.text);
-    else if (typeof c2.blob === "string") parts.push(`[binary resource ${String(c2.uri ?? "")} (${c2.blob.length} b64 chars)]`);
+  for (const c4 of contents || []) {
+    if (typeof c4.text === "string") parts.push(c4.text);
+    else if (typeof c4.blob === "string") parts.push(`[binary resource ${String(c4.uri ?? "")} (${c4.blob.length} b64 chars)]`);
   }
   return parts.join("\n").trim();
 }
@@ -4641,10 +4809,10 @@ function sortKeys(value) {
   }
   return value;
 }
-function sha256(input2) {
-  return crypto.createHash("sha256").update(input2).digest("hex");
+function sha256(input3) {
+  return crypto.createHash("sha256").update(input3).digest("hex");
 }
-var DIR = path3.join(os6.homedir(), ".standardagents");
+var DIR = path3.join(os9.homedir(), ".standardagents");
 var FILE = path3.join(DIR, "credentials");
 function normalizeEndpoint(endpoint) {
   let e = endpoint.trim();
@@ -4702,6 +4870,276 @@ function saveDefaultEndpoint(endpoint) {
   } catch {
   }
 }
+var c = {
+  reset: "\x1B[0m",
+  dim: "\x1B[2m",
+  teal: "\x1B[38;5;37m"
+};
+async function deviceLogin(endpoint) {
+  const start = await fetch(`${endpoint}/api/auth/device/start`, { method: "POST" });
+  if (!start.ok) throw new Error(`This instance does not support browser sign-in (HTTP ${start.status}). Paste an API token instead.`);
+  const info = await start.json();
+  stdout.write(`${c.dim}Opening your browser to sign in. If it doesn't open, visit:${c.reset}
+`);
+  stdout.write(`
+  ${c.teal}${info.verify_url}${c.reset}
+
+`);
+  stdout.write(`${c.dim}Waiting for sign-in to complete\u2026 (Ctrl-C to cancel)${c.reset}
+`);
+  openUrl(info.verify_url);
+  const deadline = Date.now() + (info.expires_in ?? 600) * 1e3;
+  const interval = Math.max(2, info.interval ?? 2) * 1e3;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, interval));
+    const res = await fetch(info.poll_url).catch(() => null);
+    if (!res) continue;
+    if (res.status === 404) throw new Error("The sign-in link expired. Try again.");
+    const body = await res.json().catch(() => ({}));
+    if (body.status === "approved" && body.token) return body.token;
+    if (body.status === "denied") throw new Error("Sign-in was denied in the browser.");
+  }
+  throw new Error("Timed out waiting for browser approval. Try again.");
+}
+function openUrl(url) {
+  const platform = process.platform;
+  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.unref();
+  } catch {
+  }
+}
+var AGENT_ID = "standard_code_agent";
+var AGENT_ID_VARIANTS = [
+  AGENT_ID,
+  "standard_code_low_agent",
+  "standard_code_high_agent"
+];
+var PRODUCTION_ENDPOINT = "https://api.standardcode.ai";
+function readVersion() {
+  try {
+    const pkg = JSON.parse(fs4.readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    return typeof pkg.version === "string" ? pkg.version : "";
+  } catch {
+    return "";
+  }
+}
+function isLocalHost(host) {
+  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host.endsWith(".local") || host.endsWith(".localhost") || /^10\./.test(host) || /^192\.168\./.test(host) || /^172\.(1[6-9]|2\d|3[01])\./.test(host);
+}
+function relaxTlsForLocalEndpoint(endpoint) {
+  let host = "";
+  try {
+    host = new URL(endpoint).hostname;
+  } catch {
+    return false;
+  }
+  if (!endpoint.startsWith("https:") || !isLocalHost(host)) return false;
+  const origEmit = process.emitWarning.bind(process);
+  process.emitWarning = ((warning, ...args) => {
+    const msg = typeof warning === "string" ? warning : warning?.message ?? "";
+    if (msg.includes("NODE_TLS_REJECT_UNAUTHORIZED")) return;
+    return origEmit(warning, ...args);
+  });
+  process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+  return true;
+}
+var DIR2 = path3.join(os9.homedir(), ".standardagents");
+var FILE2 = path3.join(DIR2, "machine.json");
+function loadMachineIdentity() {
+  try {
+    const parsed = JSON.parse(fs4.readFileSync(FILE2, "utf8"));
+    if (typeof parsed.machine_id === "string" && parsed.machine_id.length > 0) {
+      return parsed;
+    }
+  } catch {
+  }
+  const identity = {
+    machine_id: crypto.randomUUID(),
+    created_at: Date.now()
+  };
+  saveMachineIdentity(identity);
+  return identity;
+}
+function saveMachineIdentity(identity) {
+  fs4.mkdirSync(DIR2, { recursive: true });
+  fs4.writeFileSync(FILE2, JSON.stringify(identity, null, 2), { mode: 384 });
+}
+function setMachineName(name) {
+  const identity = loadMachineIdentity();
+  identity.name = name.trim() || void 0;
+  saveMachineIdentity(identity);
+  return identity;
+}
+function machineDisplayName(identity) {
+  return identity.name?.trim() || os9.hostname();
+}
+function daemonClientId(identity) {
+  return `daemon:${identity.machine_id}`;
+}
+function interactiveClientId(identity) {
+  return `cli:${identity.machine_id}:${crypto.randomBytes(4).toString("hex")}`;
+}
+function machineIdFromDaemonClientId(clientId) {
+  if (typeof clientId !== "string") return null;
+  return clientId.startsWith("daemon:") ? clientId.slice("daemon:".length) : null;
+}
+var KEY_PREFIX = "standardcode.machine.";
+var DAEMON_ONLINE_WINDOW_MS = 90 * 1e3;
+function machineKey(machineId) {
+  return `${KEY_PREFIX}${machineId}`;
+}
+function parseMachineRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const r = value;
+  if (typeof r.id !== "string" || r.id.length === 0) return null;
+  return {
+    id: r.id,
+    name: typeof r.name === "string" && r.name ? r.name : String(r.hostname ?? r.id),
+    hostname: typeof r.hostname === "string" ? r.hostname : "",
+    platform: typeof r.platform === "string" ? r.platform : "",
+    arch: typeof r.arch === "string" ? r.arch : "",
+    daemon: r.daemon && typeof r.daemon === "object" && !Array.isArray(r.daemon) ? r.daemon : null,
+    projects: r.projects && typeof r.projects === "object" && !Array.isArray(r.projects) ? r.projects : {},
+    created_at: typeof r.created_at === "number" ? r.created_at : 0,
+    updated_at: typeof r.updated_at === "number" ? r.updated_at : 0
+  };
+}
+async function loadMachines(api) {
+  const entries = await api.userKvList(KEY_PREFIX);
+  return entries.map((e) => parseMachineRecord(e.value)).filter((m) => m !== null);
+}
+async function loadMachine(api, machineId) {
+  return parseMachineRecord(await api.userKvGet(machineKey(machineId)));
+}
+function daemonOnline(record, now = Date.now()) {
+  return !!record.daemon && now - record.daemon.last_seen_at < DAEMON_ONLINE_WINDOW_MS;
+}
+function newRecord(identity) {
+  const now = Date.now();
+  return {
+    id: identity.machine_id,
+    name: machineDisplayName(identity),
+    hostname: os9.hostname(),
+    platform: process.platform,
+    arch: process.arch,
+    daemon: null,
+    projects: {},
+    created_at: now,
+    updated_at: now
+  };
+}
+async function updateOwnMachineRecord(api, identity, mutate) {
+  const existing = await loadMachine(api, identity.machine_id);
+  const record = existing ?? newRecord(identity);
+  record.name = machineDisplayName(identity);
+  record.hostname = os9.hostname();
+  record.platform = process.platform;
+  record.arch = process.arch;
+  mutate?.(record);
+  record.updated_at = Date.now();
+  await api.userKvSet(machineKey(identity.machine_id), record);
+  return record;
+}
+function projectRepository(projectDir) {
+  try {
+    const url = execFileSync("git", ["-C", projectDir, "remote", "get-url", "origin"], {
+      encoding: "utf8",
+      timeout: 3e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    return url || null;
+  } catch {
+    return null;
+  }
+}
+async function registerProject(api, identity, projectDir) {
+  const repository = projectRepository(projectDir);
+  await updateOwnMachineRecord(api, identity, (record) => {
+    record.projects[projectDir] = {
+      name: projectDir.split("/").filter(Boolean).pop() || projectDir,
+      last_used_at: Date.now(),
+      repository
+    };
+  });
+}
+async function unregisterProject(api, identity, projectDir) {
+  await updateOwnMachineRecord(api, identity, (record) => {
+    delete record.projects[projectDir];
+  });
+}
+async function touchDaemon(api, identity, version) {
+  await updateOwnMachineRecord(api, identity, (record) => {
+    const now = Date.now();
+    record.daemon = {
+      version,
+      installed_at: record.daemon?.installed_at ?? now,
+      last_seen_at: now,
+      pid: process.pid
+    };
+  });
+}
+async function clearDaemon(api, identity) {
+  await updateOwnMachineRecord(api, identity, (record) => {
+    record.daemon = null;
+  });
+}
+
+// src/relay.ts
+var APPROVAL_REQUEST_KEY = "approval_request";
+var APPROVAL_RESPONSE_KEY = "approval_response";
+function parseApprovalRequest(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const r = value;
+  if (typeof r.tool_call_id !== "string" || typeof r.tool !== "string") return null;
+  return {
+    tool_call_id: r.tool_call_id,
+    tool: r.tool,
+    summary: typeof r.summary === "string" ? r.summary : r.tool,
+    permission: typeof r.permission === "string" ? r.permission : null,
+    risk: typeof r.risk === "number" ? r.risk : 3,
+    machine: typeof r.machine === "string" ? r.machine : "",
+    requested_at: typeof r.requested_at === "number" ? r.requested_at : 0
+  };
+}
+function parseApprovalResponse(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const r = value;
+  if (typeof r.tool_call_id !== "string" || typeof r.choice !== "string") return null;
+  if (!["allow", "deny", "always", "always_risk"].includes(r.choice)) return null;
+  return {
+    tool_call_id: r.tool_call_id,
+    choice: r.choice,
+    reason: typeof r.reason === "string" ? r.reason : void 0,
+    decided_at: typeof r.decided_at === "number" ? r.decided_at : 0
+  };
+}
+async function writeApprovalResponse(api, threadId, response) {
+  await api.kvSet(threadId, APPROVAL_RESPONSE_KEY, response);
+}
+async function awaitApprovalViaRelay(api, threadId, request, options = {}) {
+  const pollMs = options.pollMs ?? 2e3;
+  const timeoutMs = options.timeoutMs ?? 24 * 60 * 60 * 1e3;
+  await api.kvSet(threadId, APPROVAL_REQUEST_KEY, request);
+  const deadline = Date.now() + timeoutMs;
+  try {
+    while (Date.now() < deadline) {
+      await new Promise((r) => setTimeout(r, pollMs));
+      const response = parseApprovalResponse(await api.kvGet(threadId, APPROVAL_RESPONSE_KEY));
+      if (response && response.tool_call_id === request.tool_call_id) {
+        return response;
+      }
+    }
+    return null;
+  } finally {
+    await api.kvSet(threadId, APPROVAL_REQUEST_KEY, null).catch(() => {
+    });
+    await api.kvSet(threadId, APPROVAL_RESPONSE_KEY, null).catch(() => {
+    });
+  }
+}
 var PKG_NAME = "@standardagents/code";
 var REGISTRY_URL = `https://registry.npmjs.org/${encodeURIComponent(PKG_NAME)}`;
 var CACHE_REL_DIR = ".config/standardagents-cli";
@@ -4879,78 +5317,795 @@ function runUpdate(pm) {
   });
 }
 
-// src/index.ts
-var AGENT_ID = "standard_code_agent";
-var AGENT_ID_VARIANTS = [AGENT_ID, "standard_code_high_agent"];
-var PRODUCTION_ENDPOINT = "https://api.standardcode.ai";
-var c = {
-  reset: "\x1B[0m",
-  dim: "\x1B[2m",
-  bold: "\x1B[1m",
-  white: "\x1B[97m",
-  cyan: "\x1B[36m",
-  green: "\x1B[32m",
-  gray: "\x1B[90m",
-  magenta: "\x1B[35m",
-  yellow: "\x1B[33m",
-  red: "\x1B[31m",
-  teal: "\x1B[38;5;37m"
-  // brand teal (matches the marketing site's teal accent)
-};
-var LOGO_MARK = [
-  "     \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588",
-  "     \u2588\u2588\u2588        \u2588\u2588",
-  "     \u2588\u2588          \u2588",
-  "\u2588\u2588\u2588\u2588 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588",
-  "\u2588\u2588\u2588  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2588\u2588\u2588",
-  "\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2588\u2588\u2588\u2588",
-  "\u2588          \u2588\u2588",
-  "\u2588\u2588        \u2588\u2588\u2588",
-  "\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"
-];
-function printUsage() {
-  stdout.write(
-    [
-      "",
-      `${c.bold}Usage${c.reset}`,
-      "  standardcode [options] [dir]",
-      "",
-      `${c.bold}Options${c.reset}`,
-      "  -e, --endpoint [url]  Use a different Standard Agents instance for this run",
-      "                       (default: https://api.standardcode.ai).",
-      "                       If url is omitted, prompt for it.",
-      "                       Credentials are remembered for that endpoint, but",
-      "                       the saved default endpoint is not changed.",
-      "  -h, --help            Show this help.",
-      ""
-    ].join("\n")
-  );
-}
-function parseArgs2(args) {
-  const parsed = { help: false, promptEndpoint: false };
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (arg === "--help" || arg === "-h") {
-      parsed.help = true;
-      continue;
-    }
-    if (arg === "--endpoint" || arg === "-e") {
-      const value = args[i + 1];
-      if (value && !value.startsWith("-")) {
-        parsed.endpoint = value;
-        i++;
-      } else {
-        parsed.promptEndpoint = true;
+// src/daemon.ts
+var HEARTBEAT_MS = 3e4;
+var RECLAIM_PROBE_MS = 2 * 6e4;
+var UPDATE_CHECK_MS = 6 * 60 * 6e4;
+var SWEEP_MS = 10 * 6e4;
+var MAX_WORKERS = 30;
+var LOG_MAX_BYTES = 1e6;
+var LOG_FILE = path3.join(os9.homedir(), ".standardagents", "daemon.log");
+function daemonLog(line) {
+  try {
+    fs4.mkdirSync(path3.dirname(LOG_FILE), { recursive: true });
+    try {
+      if (fs4.statSync(LOG_FILE).size > LOG_MAX_BYTES) {
+        fs4.renameSync(LOG_FILE, `${LOG_FILE}.old`);
       }
-      continue;
+    } catch {
     }
-    if (arg.startsWith("--endpoint=")) {
-      const value = arg.slice("--endpoint=".length);
-      if (value) {
-        parsed.endpoint = value;
-      } else {
-        parsed.promptEndpoint = true;
-      }
+    fs4.appendFileSync(LOG_FILE, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+`);
+  } catch {
+  }
+}
+function pathFromTags(tags) {
+  const tag = tags.find((t) => t.startsWith("path:"));
+  if (!tag) return null;
+  const raw = tag.slice("path:".length);
+  return raw.replace(/^~(?=\/|$)/, os9.homedir());
+}
+var ThreadWorker = class {
+  constructor(api, identity, threadId, projectDir, createdAt) {
+    this.api = api;
+    this.identity = identity;
+    this.threadId = threadId;
+    this.projectDir = projectDir;
+    this.createdAt = createdAt;
+    const machineName = machineDisplayName(identity);
+    const registry = new ProcessRegistry(api, threadId, machineName);
+    const mcp = new McpManager(projectDir);
+    const publishCatalog = () => void api.kvSet(threadId, "mcp_catalog", mcp.catalog()).catch(() => {
+    });
+    const host = new HostTools(projectDir, registry, threadId, machineName, mcp, publishCatalog, api);
+    this.perm = { level: 1, alwaysAllow: /* @__PURE__ */ new Set(), allowRisk: /* @__PURE__ */ new Set() };
+    this.bridge = new Bridge(
+      api,
+      threadId,
+      host,
+      this.perm,
+      {
+        onActivity: (line) => daemonLog(`[${threadId.slice(0, 8)}] ${line}`),
+        onStatus: (_id, summary) => {
+          this.inFlight += summary ? 1 : -1;
+          if (this.inFlight < 0) this.inFlight = 0;
+        },
+        onConnection: (state, attempt) => {
+          if (state !== "reconnecting" || attempt === 1 || attempt % 10 === 0) {
+            daemonLog(`[${threadId.slice(0, 8)}] bridge ${state}${attempt ? ` (attempt ${attempt})` : ""}`);
+          }
+        },
+        onOwnership: (isOwner, owner) => {
+          this.isOwner = isOwner;
+          daemonLog(
+            `[${threadId.slice(0, 8)}] ownership: ${isOwner ? "OWNER" : "watcher"}` + (owner ? ` (owner: ${owner.client_name || owner.client_id})` : "")
+          );
+        },
+        onSuperseded: () => {
+          daemonLog(`[${threadId.slice(0, 8)}] superseded by another process with this identity \u2014 standing down`);
+          this.onEvicted?.(threadId);
+        },
+        // The daemon's approvals are edited by OTHER clients (the watching
+        // CLI's level menu writes the thread KV) — re-sync before every
+        // permission decision so a level change applies to the next call.
+        refreshPermissions: () => this.reloadApprovals(),
+        requestApproval: async (req, summary, effectiveRisk) => {
+          const permKey = permissionKey(req);
+          const fresh = decide(this.perm, permKey, effectiveRisk, !!req.requestPermission);
+          if (fresh === "allow") return { choice: "allow" };
+          if (!req.toolCallId) {
+            return { choice: "deny", reason: "No one is available to approve this right now." };
+          }
+          daemonLog(`[${threadId.slice(0, 8)}] relaying approval: ${summary} (risk ${effectiveRisk})`);
+          const response = await awaitApprovalViaRelay(api, threadId, {
+            tool_call_id: req.toolCallId,
+            tool: req.tool,
+            summary,
+            permission: req.requestPermission,
+            risk: effectiveRisk,
+            machine: machineName,
+            requested_at: Date.now()
+          });
+          if (!response) {
+            return { choice: "deny", reason: "The approval request timed out with no one to approve it." };
+          }
+          if (response.choice === "always") this.perm.alwaysAllow.add(permKey);
+          if (response.choice === "always_risk") this.perm.allowRisk.add(effectiveRisk);
+          if (response.choice === "always" || response.choice === "always_risk") {
+            saveApprovals(api, threadId, this.perm);
+          }
+          return { choice: response.choice, reason: response.reason };
+        }
+      },
+      {
+        clientId: daemonClientId(identity),
+        clientName: machineName,
+        clientKind: "daemon",
+        claim: "if_unowned"
+      }
+    );
+    void (async () => {
+      for (const s of listMcpServers().filter((s2) => s2.enabled)) {
+        try {
+          await mcp.connect(s);
+        } catch (e) {
+          daemonLog(`[${threadId.slice(0, 8)}] MCP "${s.name}" failed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+      }
+      publishCatalog();
+    })();
+  }
+  api;
+  identity;
+  threadId;
+  projectDir;
+  createdAt;
+  bridge;
+  perm;
+  inFlight = 0;
+  isOwner = false;
+  /** Set by the daemon so a superseded worker can remove itself. */
+  onEvicted;
+  get busy() {
+    return this.inFlight > 0;
+  }
+  async reloadApprovals() {
+    try {
+      const saved = await loadApprovals(this.api, this.threadId);
+      this.perm.alwaysAllow = new Set(saved.allowTools);
+      this.perm.allowRisk = new Set(saved.allowRisk);
+      if (saved.level) this.perm.level = saved.level;
+    } catch {
+    }
+  }
+  async start() {
+    await this.reloadApprovals();
+    void this.api.kvSet(this.threadId, "session_info", {
+      cwd: this.projectDir,
+      machine: machineDisplayName(this.identity)
+    }).catch(() => {
+    });
+    await this.bridge.connect();
+  }
+  stop() {
+    this.bridge.close();
+  }
+};
+async function runDaemon(options = {}) {
+  const endpoint = normalizeEndpoint(options.endpoint || defaultEndpoint() || PRODUCTION_ENDPOINT);
+  relaxTlsForLocalEndpoint(endpoint);
+  const version = readVersion();
+  const identity = loadMachineIdentity();
+  const runnerTag = `runner:${identity.machine_id}`;
+  const cred = getCredential(endpoint);
+  if (!cred) {
+    process.stderr.write(
+      `No saved sign-in for ${endpoint}.
+Run \`standardcode daemon install\` (or plain \`standardcode\`) once to sign in.
+`
+    );
+    process.exit(1);
+  }
+  const api = new ApiClient(endpoint, cred.access_token);
+  const check = await api.verifyDetailed();
+  if (!check.ok) {
+    daemonLog(`startup: credential check failed: ${check.reason}`);
+    process.stderr.write(`Sign-in check failed: ${check.reason}
+`);
+    process.exit(1);
+  }
+  const applied = consumeAppliedUpdate(version);
+  daemonLog(
+    `daemon starting \u2014 v${version}${applied ? " (freshly auto-updated)" : ""}, machine ${identity.machine_id} (${machineDisplayName(identity)}), endpoint ${endpoint}`
+  );
+  process.on("uncaughtException", (err) => {
+    daemonLog(`FATAL uncaughtException: ${err?.stack || err}`);
+    process.exit(1);
+  });
+  process.on("unhandledRejection", (err) => {
+    daemonLog(`unhandledRejection: ${err instanceof Error ? err.stack : String(err)}`);
+  });
+  const workers = /* @__PURE__ */ new Map();
+  const attach = async (threadId, tags, createdAt = 0) => {
+    if (workers.has(threadId)) return;
+    const projectDir = pathFromTags(tags);
+    if (!projectDir) return;
+    if (workers.size >= MAX_WORKERS) {
+      const oldest = [...workers.values()].filter((w) => !w.busy).sort((a, b) => a.createdAt - b.createdAt)[0];
+      if (!oldest) return;
+      oldest.stop();
+      workers.delete(oldest.threadId);
+      daemonLog(`detached ${oldest.threadId.slice(0, 8)} (worker cap)`);
+    }
+    try {
+      fs4.mkdirSync(projectDir, { recursive: true });
+    } catch (e) {
+      daemonLog(`cannot prepare project dir ${projectDir}: ${e instanceof Error ? e.message : String(e)}`);
+      return;
+    }
+    const worker = new ThreadWorker(api, identity, threadId, projectDir, createdAt || Date.now());
+    worker.onEvicted = (id) => detach(id);
+    workers.set(threadId, worker);
+    daemonLog(`attached ${threadId.slice(0, 8)} \u2192 ${projectDir}`);
+    await worker.start();
+    void registerProject(api, identity, projectDir).catch(() => {
+    });
+  };
+  const detach = (threadId) => {
+    const worker = workers.get(threadId);
+    if (!worker) return;
+    worker.stop();
+    workers.delete(threadId);
+    daemonLog(`detached ${threadId.slice(0, 8)}`);
+  };
+  const sweep = async () => {
+    try {
+      const threads = await api.listThreads(AGENT_ID_VARIANTS, [runnerTag]);
+      const recent = threads.sort((a, b) => (b.created_at ?? 0) - (a.created_at ?? 0)).slice(0, MAX_WORKERS);
+      for (const t of recent) {
+        await attach(t.id, t.tags, (t.created_at ?? 0) * 1e3);
+      }
+    } catch (e) {
+      daemonLog(`sweep failed: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  };
+  const events = new SystemEvents(api, {
+    onOpen: () => void sweep(),
+    onThreadCreated: (t) => {
+      if (t.tags?.includes(runnerTag)) void attach(t.id, t.tags ?? [], (t.created_at ?? 0) * 1e3);
+    },
+    onThreadUpdated: (t) => {
+      if (t.terminated) detach(t.id);
+      else if (t.tags?.includes(runnerTag)) void attach(t.id, t.tags ?? [], (t.created_at ?? 0) * 1e3);
+    },
+    onThreadDeleted: (id) => detach(id)
+  });
+  events.connect();
+  await sweep();
+  await touchDaemon(api, identity, version).catch(
+    (e) => daemonLog(`heartbeat failed: ${e instanceof Error ? e.message : String(e)}`)
+  );
+  const heartbeat = setInterval(() => {
+    void touchDaemon(api, identity, version).catch(() => {
+    });
+  }, HEARTBEAT_MS);
+  const reclaim = setInterval(() => {
+    for (const worker of workers.values()) {
+      if (!worker.isOwner) {
+        worker.bridge.setClaim("if_stale");
+        worker.bridge.refresh();
+      } else {
+        worker.bridge.setClaim("if_unowned");
+      }
+    }
+  }, RECLAIM_PROBE_MS);
+  let updateReady = false;
+  const checkUpdates = async () => {
+    try {
+      const info = await checkForUpdate(version);
+      if (!info) return;
+      const pm = detectPackageManager();
+      const decision = decideAutoUpdate(info, { state: readAutoUpdateState(), pm });
+      if (decision === "start" && pm) {
+        daemonLog(`auto-update: installing v${info.latest} in the background`);
+        startBackgroundUpdate(info.latest, pm);
+      }
+      const state = readAutoUpdateState();
+      if (state && state.version === info.latest && state.exitCode === 0) {
+        daemonLog(`auto-update: v${info.latest} installed \u2014 restarting when idle`);
+        updateReady = true;
+      }
+    } catch {
+    }
+  };
+  void checkUpdates();
+  const updateTimer = setInterval(() => void checkUpdates(), UPDATE_CHECK_MS);
+  const sweeper = setInterval(() => {
+    if (updateReady && ![...workers.values()].some((w) => w.busy)) {
+      daemonLog("restarting to apply the installed update");
+      shutdown(0);
+      return;
+    }
+    void sweep();
+  }, SWEEP_MS);
+  const shutdown = (code) => {
+    clearInterval(heartbeat);
+    clearInterval(reclaim);
+    clearInterval(updateTimer);
+    clearInterval(sweeper);
+    for (const worker of workers.values()) worker.stop();
+    events.close();
+    daemonLog(`daemon exiting (code ${code})`);
+    process.exit(code);
+  };
+  process.on("SIGTERM", () => shutdown(0));
+  process.on("SIGINT", () => shutdown(0));
+  daemonLog(`daemon ready \u2014 watching for threads tagged ${runnerTag}`);
+  await new Promise(() => {
+  });
+}
+var SERVICE_LABEL = "ai.standardcode.daemon";
+var SYSTEMD_UNIT = "standardcode-daemon.service";
+function resolveDaemonCommand(extraArgs = []) {
+  const entry = path3.resolve(process.argv[1] ?? "");
+  if (!entry) throw new Error("Cannot determine how this CLI was launched.");
+  const argv = [process.execPath];
+  if (entry.endsWith(".ts")) {
+    let dir = path3.dirname(entry);
+    let tsx = null;
+    for (let i = 0; i < 6 && dir !== path3.dirname(dir); i++) {
+      const candidate = path3.join(dir, "node_modules", "tsx", "dist", "cli.mjs");
+      if (fs4.existsSync(candidate)) {
+        tsx = candidate;
+        break;
+      }
+      dir = path3.dirname(dir);
+    }
+    if (!tsx) {
+      throw new Error(
+        "This is a source checkout and tsx wasn't found \u2014 run `pnpm install` in the repo, or install the CLI globally and re-run daemon install."
+      );
+    }
+    argv.push(tsx);
+  }
+  argv.push(entry, "daemon", "run", ...extraArgs);
+  return { argv };
+}
+function servicePath() {
+  const parts = [
+    path3.dirname(process.execPath),
+    "/opt/homebrew/bin",
+    "/usr/local/bin",
+    "/usr/bin",
+    "/bin",
+    "/usr/sbin",
+    "/sbin"
+  ];
+  const current = (process.env.PATH || "").split(":").filter(Boolean);
+  return [.../* @__PURE__ */ new Set([...current, ...parts])].join(":");
+}
+function run2(cmd, args) {
+  const res = spawnSync(cmd, args, { encoding: "utf8" });
+  const output4 = `${res.stdout ?? ""}${res.stderr ?? ""}`.trim();
+  return { ok: res.status === 0, output: output4 };
+}
+var plistPath = () => path3.join(os9.homedir(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
+var unitPath = () => path3.join(os9.homedir(), ".config", "systemd", "user", SYSTEMD_UNIT);
+var xmlEscape = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+function installService(command, endpoint) {
+  if (process.platform === "darwin") return installLaunchd(command, endpoint);
+  if (process.platform === "linux") return installSystemd(command, endpoint);
+  return {
+    ok: false,
+    detail: `Unsupported platform for the daemon service: ${process.platform}`,
+    manualHint: "Run `standardcode daemon run` under your own supervisor."
+  };
+}
+function installLaunchd(command, endpoint) {
+  const logDir = path3.join(os9.homedir(), ".standardagents");
+  fs4.mkdirSync(logDir, { recursive: true });
+  fs4.mkdirSync(path3.dirname(plistPath()), { recursive: true });
+  const envEntries = [
+    `      <key>PATH</key><string>${xmlEscape(servicePath())}</string>`,
+    ...endpoint ? [`      <key>STANDARD_CODE_DAEMON_ENDPOINT</key><string>${xmlEscape(endpoint)}</string>`] : []
+  ].join("\n");
+  const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>Label</key><string>${SERVICE_LABEL}</string>
+    <key>ProgramArguments</key>
+    <array>
+${command.argv.map((a) => `      <string>${xmlEscape(a)}</string>`).join("\n")}
+    </array>
+    <key>RunAtLoad</key><true/>
+    <key>KeepAlive</key><true/>
+    <key>ThrottleInterval</key><integer>5</integer>
+    <key>StandardOutPath</key><string>${xmlEscape(path3.join(logDir, "daemon.out.log"))}</string>
+    <key>StandardErrorPath</key><string>${xmlEscape(path3.join(logDir, "daemon.err.log"))}</string>
+    <key>EnvironmentVariables</key>
+    <dict>
+${envEntries}
+    </dict>
+  </dict>
+</plist>
+`;
+  fs4.writeFileSync(plistPath(), plist);
+  const uid = typeof process.getuid === "function" ? process.getuid() : 501;
+  run2("launchctl", ["bootout", `gui/${uid}`, plistPath()]);
+  const boot = run2("launchctl", ["bootstrap", `gui/${uid}`, plistPath()]);
+  if (!boot.ok) {
+    const load = run2("launchctl", ["load", "-w", plistPath()]);
+    if (!load.ok) {
+      return {
+        ok: false,
+        detail: `launchctl failed: ${boot.output || load.output}`,
+        manualHint: `Load it manually: launchctl bootstrap gui/${uid} ${plistPath()}`
+      };
+    }
+  }
+  return { ok: true, detail: `LaunchAgent installed (${plistPath()})` };
+}
+function installSystemd(command, endpoint) {
+  fs4.mkdirSync(path3.dirname(unitPath()), { recursive: true });
+  const unit = `[Unit]
+Description=Standard Code daemon (headless coding-agent execution client)
+After=network-online.target
+
+[Service]
+ExecStart=${command.argv.map((a) => a.includes(" ") ? `"${a}"` : a).join(" ")}
+Restart=always
+RestartSec=5
+Environment=PATH=${servicePath()}
+${endpoint ? `Environment=STANDARD_CODE_DAEMON_ENDPOINT=${endpoint}
+` : ""}
+[Install]
+WantedBy=default.target
+`;
+  fs4.writeFileSync(unitPath(), unit);
+  const reload = run2("systemctl", ["--user", "daemon-reload"]);
+  if (!reload.ok) {
+    return {
+      ok: false,
+      detail: `systemd user manager unavailable: ${reload.output}`,
+      manualHint: `Unit written to ${unitPath()}. On a server without a user manager, copy it to /etc/systemd/system/ (sudo), change ExecStart's user if needed, then: sudo systemctl enable --now ${SYSTEMD_UNIT}`
+    };
+  }
+  const enable = run2("systemctl", ["--user", "enable", "--now", SYSTEMD_UNIT]);
+  if (!enable.ok) {
+    return { ok: false, detail: `systemctl enable failed: ${enable.output}` };
+  }
+  const linger = run2("loginctl", ["enable-linger", os9.userInfo().username]);
+  return {
+    ok: true,
+    detail: `systemd user unit installed (${unitPath()})` + (linger.ok ? ", lingering enabled" : ` \u2014 enable lingering manually: sudo loginctl enable-linger ${os9.userInfo().username}`)
+  };
+}
+function uninstallService() {
+  if (process.platform === "darwin") {
+    const uid = typeof process.getuid === "function" ? process.getuid() : 501;
+    run2("launchctl", ["bootout", `gui/${uid}`, plistPath()]);
+    try {
+      fs4.unlinkSync(plistPath());
+    } catch {
+    }
+    return { ok: true, detail: "LaunchAgent removed" };
+  }
+  if (process.platform === "linux") {
+    run2("systemctl", ["--user", "disable", "--now", SYSTEMD_UNIT]);
+    try {
+      fs4.unlinkSync(unitPath());
+    } catch {
+    }
+    run2("systemctl", ["--user", "daemon-reload"]);
+    return { ok: true, detail: "systemd user unit removed" };
+  }
+  return { ok: false, detail: `Unsupported platform: ${process.platform}` };
+}
+function serviceStatus() {
+  if (process.platform === "darwin") {
+    const installed = fs4.existsSync(plistPath());
+    const list = run2("launchctl", ["list", SERVICE_LABEL]);
+    const pidMatch = list.output.match(/"PID"\s*=\s*(\d+)/);
+    return {
+      installed,
+      running: list.ok && !!pidMatch,
+      detail: installed ? list.ok ? pidMatch ? `running (pid ${pidMatch[1]})` : "loaded, not running" : "installed, not loaded" : "not installed"
+    };
+  }
+  if (process.platform === "linux") {
+    const installed = fs4.existsSync(unitPath());
+    const active = run2("systemctl", ["--user", "is-active", SYSTEMD_UNIT]);
+    return {
+      installed,
+      running: active.output.trim() === "active",
+      detail: installed ? active.output.trim() || "unknown" : "not installed"
+    };
+  }
+  return { installed: false, running: false, detail: `unsupported platform ${process.platform}` };
+}
+
+// src/daemon-cli.ts
+var c2 = {
+  reset: "\x1B[0m",
+  dim: "\x1B[2m",
+  bold: "\x1B[1m",
+  green: "\x1B[32m",
+  red: "\x1B[31m",
+  yellow: "\x1B[33m",
+  teal: "\x1B[38;5;37m"
+};
+function usage() {
+  stdout.write(
+    [
+      "",
+      `${c2.bold}standardcode daemon${c2.reset} \u2014 headless execution client for this machine`,
+      "",
+      `${c2.bold}Commands${c2.reset}`,
+      "  install [--endpoint url]   Sign in (if needed), name this machine, and install",
+      "                             the always-on service (launchd / systemd).",
+      "  uninstall                  Stop and remove the service.",
+      "  status                     Service + registry status for this machine.",
+      "  run [--endpoint url]       Run the daemon in the foreground (what the service runs).",
+      "  add-project <path>         Register a project directory for remote sessions.",
+      "  remove-project <path>      Remove a registered project directory.",
+      ""
+    ].join("\n")
+  );
+}
+function parseEndpointFlag(args) {
+  const rest = [];
+  let endpoint;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--endpoint" || arg === "-e") {
+      endpoint = args[++i];
+    } else if (arg.startsWith("--endpoint=")) {
+      endpoint = arg.slice("--endpoint=".length);
+    } else {
+      rest.push(arg);
+    }
+  }
+  return { endpoint, rest };
+}
+function resolveEndpoint(flag) {
+  return normalizeEndpoint(
+    flag || process.env.STANDARD_CODE_DAEMON_ENDPOINT || defaultEndpoint() || PRODUCTION_ENDPOINT
+  );
+}
+async function ensureSignedIn(endpoint) {
+  relaxTlsForLocalEndpoint(endpoint);
+  const host = endpoint.replace(/^https?:\/\//, "");
+  const stored = getCredential(endpoint);
+  if (stored) {
+    const api2 = new ApiClient(endpoint, stored.access_token);
+    const check2 = await api2.verifyDetailed();
+    if (check2.ok) return api2;
+    stdout.write(`${c2.yellow}Saved sign-in for ${host} failed:${c2.reset} ${check2.reason}
+
+`);
+  }
+  stdout.write(`${c2.bold}Sign in to Standard Code${c2.reset} ${c2.dim}(${host})${c2.reset}
+
+`);
+  const token = await deviceLogin(endpoint);
+  const api = new ApiClient(endpoint, token);
+  const check = await api.verifyDetailed();
+  if (!check.ok) throw new Error(`Sign-in didn't verify: ${check.reason}`);
+  saveCredential(
+    { endpoint, access_token: token, token_type: "Bearer", saved_at: Date.now() },
+    { updateDefault: false }
+  );
+  stdout.write(`${c2.green}\u2713${c2.reset} Signed in to ${c2.teal}${host}${c2.reset}
+
+`);
+  return api;
+}
+async function installCommand(endpointFlag) {
+  const endpoint = resolveEndpoint(endpointFlag);
+  const api = await ensureSignedIn(endpoint);
+  const identity = loadMachineIdentity();
+  const rl = readline2.createInterface({ input: stdin, output: stdout });
+  const suggested = machineDisplayName(identity);
+  const answer = (await rl.question(
+    `${c2.bold}Machine name${c2.reset} ${c2.dim}(shown in the session picker)${c2.reset} [${suggested}]: `
+  )).trim();
+  rl.close();
+  if (answer) setMachineName(answer);
+  const named = loadMachineIdentity();
+  await updateOwnMachineRecord(api, named);
+  stdout.write(`${c2.dim}Installing the always-on service\u2026${c2.reset}
+`);
+  const extra = endpointFlag ? ["--endpoint", endpoint] : [];
+  const result = installService(resolveDaemonCommand(extra), endpointFlag ? endpoint : void 0);
+  if (!result.ok) {
+    stdout.write(`${c2.red}\u2717${c2.reset} ${result.detail}
+`);
+    if (result.manualHint) stdout.write(`${c2.dim}${result.manualHint}${c2.reset}
+`);
+    process.exit(1);
+  }
+  stdout.write(`${c2.green}\u2713${c2.reset} ${result.detail}
+`);
+  stdout.write(`${c2.dim}Waiting for the daemon's first heartbeat\u2026${c2.reset}
+`);
+  const deadline = Date.now() + 3e4;
+  let alive = false;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, 2e3));
+    const record = await loadMachine(api, named.machine_id);
+    if (record && daemonOnline(record)) {
+      alive = true;
+      break;
+    }
+  }
+  if (alive) {
+    stdout.write(
+      `${c2.green}\u2713${c2.reset} ${c2.bold}${machineDisplayName(named)}${c2.reset} is online.
+
+Sessions started elsewhere can now run on this machine.
+${c2.dim}Projects register automatically when you run standardcode in a directory here,
+or add one now: standardcode daemon add-project <path>${c2.reset}
+`
+    );
+  } else {
+    stdout.write(
+      `${c2.yellow}\u26A0${c2.reset} The service installed but no heartbeat arrived yet.
+${c2.dim}Check ~/.standardagents/daemon.log and \`standardcode daemon status\`.${c2.reset}
+`
+    );
+  }
+}
+async function statusCommand() {
+  const status = serviceStatus();
+  const identity = loadMachineIdentity();
+  stdout.write(`${c2.bold}Service:${c2.reset}  ${status.detail}
+`);
+  stdout.write(`${c2.bold}Machine:${c2.reset}  ${machineDisplayName(identity)} ${c2.dim}(${identity.machine_id})${c2.reset}
+`);
+  const endpoint = resolveEndpoint();
+  const cred = getCredential(endpoint);
+  if (!cred) {
+    stdout.write(`${c2.bold}Account:${c2.reset}  ${c2.yellow}not signed in to ${endpoint}${c2.reset}
+`);
+    return;
+  }
+  relaxTlsForLocalEndpoint(endpoint);
+  const api = new ApiClient(endpoint, cred.access_token);
+  const record = await loadMachine(api, identity.machine_id).catch(() => null);
+  if (!record) {
+    stdout.write(`${c2.bold}Registry:${c2.reset} not registered yet
+`);
+    return;
+  }
+  const online = daemonOnline(record);
+  const seen = record.daemon ? `${Math.round((Date.now() - record.daemon.last_seen_at) / 1e3)}s ago (v${record.daemon.version})` : "never";
+  stdout.write(`${c2.bold}Registry:${c2.reset} ${online ? `${c2.green}online${c2.reset}` : `${c2.yellow}offline${c2.reset}`} \xB7 last heartbeat ${seen}
+`);
+  const projects = Object.keys(record.projects);
+  stdout.write(`${c2.bold}Projects:${c2.reset} ${projects.length ? "" : c2.dim + "none registered" + c2.reset}
+`);
+  for (const p of projects.sort()) stdout.write(`  ${c2.dim}${p}${c2.reset}
+`);
+}
+async function projectCommand(action, target) {
+  if (!target) {
+    stdout.write(`${c2.red}\u2717${c2.reset} Expected a project path.
+`);
+    process.exit(1);
+  }
+  const dir = path3.resolve(target);
+  if (action === "add" && !fs4.existsSync(dir)) {
+    stdout.write(`${c2.red}\u2717${c2.reset} ${dir} does not exist on this machine.
+`);
+    process.exit(1);
+  }
+  const endpoint = resolveEndpoint();
+  const api = await ensureSignedIn(endpoint);
+  const identity = loadMachineIdentity();
+  if (action === "add") {
+    await registerProject(api, identity, dir);
+    stdout.write(`${c2.green}\u2713${c2.reset} Registered ${dir} for remote sessions on ${machineDisplayName(identity)}.
+`);
+  } else {
+    await unregisterProject(api, identity, dir);
+    stdout.write(`${c2.green}\u2713${c2.reset} Removed ${dir} from this machine's projects.
+`);
+  }
+}
+async function runDaemonCommand(argv) {
+  const [command, ...restArgs] = argv;
+  const { endpoint, rest } = parseEndpointFlag(restArgs);
+  switch (command) {
+    case "run":
+      await runDaemon({ endpoint: endpoint || process.env.STANDARD_CODE_DAEMON_ENDPOINT });
+      return;
+    case "install":
+      await installCommand(endpoint);
+      return;
+    case "uninstall": {
+      const result = uninstallService();
+      stdout.write(`${result.ok ? c2.green + "\u2713" : c2.red + "\u2717"}${c2.reset} ${result.detail}
+`);
+      const ep = resolveEndpoint(endpoint);
+      const cred = getCredential(ep);
+      if (cred) {
+        relaxTlsForLocalEndpoint(ep);
+        await clearDaemon(new ApiClient(ep, cred.access_token), loadMachineIdentity()).catch(() => {
+        });
+      }
+      return;
+    }
+    case "status":
+      await statusCommand();
+      return;
+    case "add-project":
+      await projectCommand("add", rest[0]);
+      return;
+    case "remove-project":
+      await projectCommand("remove", rest[0]);
+      return;
+    case "version":
+      stdout.write(`standardcode daemon v${readVersion()}
+`);
+      return;
+    default:
+      usage();
+      if (command && command !== "help" && command !== "--help" && command !== "-h") {
+        process.exit(1);
+      }
+  }
+}
+
+// src/index.ts
+var c3 = {
+  reset: "\x1B[0m",
+  dim: "\x1B[2m",
+  bold: "\x1B[1m",
+  white: "\x1B[97m",
+  cyan: "\x1B[36m",
+  green: "\x1B[32m",
+  gray: "\x1B[90m",
+  magenta: "\x1B[35m",
+  yellow: "\x1B[33m",
+  red: "\x1B[31m",
+  teal: "\x1B[38;5;37m"
+  // brand teal (matches the marketing site's teal accent)
+};
+var LOGO_MARK = [
+  "     \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588",
+  "     \u2588\u2588\u2588        \u2588\u2588",
+  "     \u2588\u2588          \u2588",
+  "\u2588\u2588\u2588\u2588 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588",
+  "\u2588\u2588\u2588  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2588\u2588\u2588",
+  "\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2588\u2588\u2588\u2588",
+  "\u2588          \u2588\u2588",
+  "\u2588\u2588        \u2588\u2588\u2588",
+  "\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"
+];
+function printUsage() {
+  stdout.write(
+    [
+      "",
+      `${c3.bold}Usage${c3.reset}`,
+      "  standardcode [options] [dir]",
+      "",
+      `${c3.bold}Options${c3.reset}`,
+      "  -e, --endpoint [url]  Use a different Standard Agents instance for this run",
+      "                       (default: https://api.standardcode.ai).",
+      "                       If url is omitted, prompt for it.",
+      "                       Credentials are remembered for that endpoint, but",
+      "                       the saved default endpoint is not changed.",
+      "  -h, --help            Show this help.",
+      ""
+    ].join("\n")
+  );
+}
+function parseArgs2(args) {
+  const parsed = { help: false, promptEndpoint: false };
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--help" || arg === "-h") {
+      parsed.help = true;
+      continue;
+    }
+    if (arg === "--endpoint" || arg === "-e") {
+      const value = args[i + 1];
+      if (value && !value.startsWith("-")) {
+        parsed.endpoint = value;
+        i++;
+      } else {
+        parsed.promptEndpoint = true;
+      }
+      continue;
+    }
+    if (arg.startsWith("--endpoint=")) {
+      const value = arg.slice("--endpoint=".length);
+      if (value) {
+        parsed.endpoint = value;
+      } else {
+        parsed.promptEndpoint = true;
+      }
       continue;
     }
     if (arg === "--") {
@@ -4973,7 +6128,7 @@ function printAssistant(tui, text) {
   let dotted = false;
   for (const line of renderMarkdown(text, cols2)) {
     if (!dotted && line.trim()) {
-      tui.print(`${c.gray}\u2022${c.reset} ${line}`);
+      tui.print(`${c3.gray}\u2022${c3.reset} ${line}`);
       dotted = true;
     } else {
       tui.print(`  ${line}`);
@@ -4988,7 +6143,7 @@ function startLoader(label) {
   const draw = () => {
     const now = Date.now();
     const f = frames[Math.floor(now / 70) % frames.length];
-    stdout.write(`\r\x1B[K${pad}${brandCycleColor(now)}${f}${c.reset} ${c.dim}${label}\u2026${c.reset}`);
+    stdout.write(`\r\x1B[K${pad}${brandCycleColor(now)}${f}${c3.reset} ${c3.dim}${label}\u2026${c3.reset}`);
   };
   draw();
   const timer = setInterval(draw, 70);
@@ -5004,53 +6159,25 @@ function farewell(stoppedProcs = 0) {
   if (stoppedProcs > 0) {
     stdout.write(
       `
-${c.cyan}\u2699${c.reset} Stopped ${stoppedProcs} background process${stoppedProcs === 1 ? "" : "es"}.
+${c3.cyan}\u2699${c3.reset} Stopped ${stoppedProcs} background process${stoppedProcs === 1 ? "" : "es"}.
 `
     );
   }
   stdout.write(`
-${c.teal}\u25C7${c.reset} ${c.dim}Standard Code \u2014 see you soon.${c.reset}
+${c3.teal}\u25C7${c3.reset} ${c3.dim}Standard Code \u2014 see you soon.${c3.reset}
 `);
 }
-function isLocalHost(host) {
-  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host.endsWith(".local") || host.endsWith(".localhost") || /^10\./.test(host) || /^192\.168\./.test(host) || /^172\.(1[6-9]|2\d|3[01])\./.test(host);
-}
-function relaxTlsForLocalEndpoint(endpoint) {
-  let host = "";
-  try {
-    host = new URL(endpoint).hostname;
-  } catch {
-    return false;
-  }
-  if (!endpoint.startsWith("https:") || !isLocalHost(host)) return false;
-  const origEmit = process.emitWarning.bind(process);
-  process.emitWarning = ((warning, ...args) => {
-    const msg = typeof warning === "string" ? warning : warning?.message ?? "";
-    if (msg.includes("NODE_TLS_REJECT_UNAUTHORIZED")) return;
-    return origEmit(warning, ...args);
-  });
-  process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
-  return true;
-}
-function readVersion() {
-  try {
-    const pkg = JSON.parse(fs4.readFileSync(new URL("../package.json", import.meta.url), "utf8"));
-    return typeof pkg.version === "string" ? pkg.version : "";
-  } catch {
-    return "";
-  }
-}
 function printWelcome(endpoint, projectDir) {
-  const home = os6.homedir();
+  const home = os9.homedir();
   const dir = projectDir.startsWith(home) ? "~" + projectDir.slice(home.length) : projectDir;
   const host = endpoint.replace(/^https?:\/\//, "").replace(/\/$/, "");
   const version = readVersion();
   const pad = "  ";
   const meta = [
-    `${c.bold}${gradientText("Standard Code")}${c.reset}${version ? `  ${c.dim}v${version}${c.reset}` : ""}`,
-    `${c.dim}terminal coding agent${c.reset}`,
-    ...endpoint === PRODUCTION_ENDPOINT ? [] : [`${c.teal}${host}${c.reset}`],
-    `${c.dim}${dir}${c.reset}`
+    `${c3.bold}${gradientText("Standard Code")}${c3.reset}${version ? `  ${c3.dim}v${version}${c3.reset}` : ""}`,
+    `${c3.dim}terminal coding agent${c3.reset}`,
+    ...endpoint === PRODUCTION_ENDPOINT ? [] : [`${c3.teal}${host}${c3.reset}`],
+    `${c3.dim}${dir}${c3.reset}`
   ];
   const markWidth = Math.max(...LOGO_MARK.map((l) => [...l].length));
   const metaTop = Math.floor((LOGO_MARK.length - meta.length) / 2);
@@ -5065,11 +6192,11 @@ function printWelcome(endpoint, projectDir) {
 }
 function colorActivity(line) {
   const m = line.match(/^(\s*)([✓✗⛔])\s?([\s\S]*)$/);
-  if (!m) return `${c.dim}${line}${c.reset}`;
+  if (!m) return `${c3.dim}${line}${c3.reset}`;
   const [, indent, glyph, rest] = m;
   if (glyph === "\u2713") {
-    const body = rest.replace(/\s(\([^()]*\))\s*$/, ` ${c.dim}$1${c.reset}`);
-    return `${indent}${c.green}\u2713${c.reset} ${body}`;
+    const body = rest.replace(/\s(\([^()]*\))\s*$/, ` ${c3.dim}$1${c3.reset}`);
+    return `${indent}${c3.green}\u2713${c3.reset} ${body}`;
   }
   if (glyph === "\u2717") {
     const ERR_MAX_LINES = 7;
@@ -5077,22 +6204,26 @@ function colorActivity(line) {
     const shown = lines.slice(0, ERR_MAX_LINES);
     const hidden = lines.length - shown.length;
     const body = shown.map(
-      (l, i) => i === 0 ? `${indent}${c.red}\u2717 ${l}${c.reset}` : `${indent}${c.red}${c.dim}${l}${c.reset}`
+      (l, i) => i === 0 ? `${indent}${c3.red}\u2717 ${l}${c3.reset}` : `${indent}${c3.red}${c3.dim}${l}${c3.reset}`
     ).join("\n");
     if (hidden > 0) {
       return `${body}
-${indent}${c.dim}\u2026 +${hidden} more line${hidden === 1 ? "" : "s"}${c.reset}`;
+${indent}${c3.dim}\u2026 +${hidden} more line${hidden === 1 ? "" : "s"}${c3.reset}`;
     }
     return body;
   }
-  return `${indent}${c.yellow}\u26D4 ${rest}${c.reset}`;
+  return `${indent}${c3.yellow}\u26D4 ${rest}${c3.reset}`;
 }
 async function main() {
+  if (process.argv[2] === "daemon") {
+    await runDaemonCommand(process.argv.slice(3));
+    return;
+  }
   let cliArgs;
   try {
     cliArgs = parseArgs2(process.argv.slice(2));
   } catch (error) {
-    stdout.write(`${c.red}error:${c.reset} ${error instanceof Error ? error.message : String(error)}
+    stdout.write(`${c3.red}error:${c3.reset} ${error instanceof Error ? error.message : String(error)}
 `);
     printUsage();
     process.exit(1);
@@ -5105,7 +6236,7 @@ async function main() {
   const endpointOverride = cliArgs.promptEndpoint || typeof endpointArg === "string" && endpointArg.trim() !== "";
   const dirArg = cliArgs.dir;
   const projectDir = path3.resolve(dirArg || process.cwd());
-  const machine = os6.hostname();
+  const machine = os9.hostname();
   const reader = { rl: null };
   let handoffClosing = false;
   let preflightArmed = false;
@@ -5119,7 +6250,7 @@ async function main() {
     }
     preflightArmed = true;
     stdout.write(`
-${c.dim}Press Control-C again to exit${c.reset}
+${c3.dim}Press Control-C again to exit${c3.reset}
 `);
     preflightTimer = setTimeout(() => {
       preflightArmed = false;
@@ -5141,10 +6272,10 @@ ${c.dim}Press Control-C again to exit${c.reset}
   const askEndpoint = async () => {
     for (; ; ) {
       const answer = (await ask(
-        `${c.cyan}Standard Agents instance URL${c.reset} (e.g. http://localhost:5178): `
+        `${c3.cyan}Standard Agents instance URL${c3.reset} (e.g. http://localhost:5178): `
       )).trim();
       if (answer) return answer;
-      stdout.write(`${c.dim}An endpoint URL is required.${c.reset}
+      stdout.write(`${c3.dim}An endpoint URL is required.${c3.reset}
 `);
     }
   };
@@ -5159,7 +6290,7 @@ ${c.dim}Press Control-C again to exit${c.reset}
   const tlsRelaxed = relaxTlsForLocalEndpoint(endpoint);
   printWelcome(endpoint, projectDir);
   if (tlsRelaxed) {
-    stdout.write(`${c.dim}  TLS verification relaxed for local endpoint.${c.reset}
+    stdout.write(`${c3.dim}  TLS verification relaxed for local endpoint.${c3.reset}
 
 `);
   }
@@ -5171,7 +6302,7 @@ ${c.dim}Press Control-C again to exit${c.reset}
     loading.stop();
     const applied = consumeAppliedUpdate(version);
     if (applied) {
-      stdout.write(`  ${c.green}\u2713${c.reset} ${c.dim}Standard Code updated to v${version}.${c.reset}
+      stdout.write(`  ${c3.green}\u2713${c3.reset} ${c3.dim}Standard Code updated to v${version}.${c3.reset}
 
 `);
     }
@@ -5180,21 +6311,21 @@ ${c.dim}Press Control-C again to exit${c.reset}
       const decision = decideAutoUpdate(updateAvailable, { state: readAutoUpdateState(), pm });
       if (decision === "start" && pm && startBackgroundUpdate(updateAvailable.latest, pm)) {
         stdout.write(
-          `  ${c.teal}\u27F3${c.reset} ${c.dim}Standard Code ${c.reset}${c.bold}v${updateAvailable.latest}${c.reset}${c.dim} is installing in the background \u2014 it applies on your next launch.${c.reset}
+          `  ${c3.teal}\u27F3${c3.reset} ${c3.dim}Standard Code ${c3.reset}${c3.bold}v${updateAvailable.latest}${c3.reset}${c3.dim} is installing in the background \u2014 it applies on your next launch.${c3.reset}
 
 `
         );
       } else if (decision === "in_flight") {
         stdout.write(
-          `  ${c.teal}\u27F3${c.reset} ${c.dim}Standard Code v${updateAvailable.latest} is still installing in the background.${c.reset}
+          `  ${c3.teal}\u27F3${c3.reset} ${c3.dim}Standard Code v${updateAvailable.latest} is still installing in the background.${c3.reset}
 
 `
         );
       } else {
         const display = updateCommand(pm ?? "npm").display;
         stdout.write(
-          `  ${c.teal}\u25C7${c.reset} ${c.dim}Update available:${c.reset} ${c.dim}v${updateAvailable.current}${c.reset} \u2192 ${c.bold}v${updateAvailable.latest}${c.reset}
-  ${c.dim}Run ${c.reset}${c.bold}${display}${c.reset}${c.dim} to update${c.reset}
+          `  ${c3.teal}\u25C7${c3.reset} ${c3.dim}Update available:${c3.reset} ${c3.dim}v${updateAvailable.current}${c3.reset} \u2192 ${c3.bold}v${updateAvailable.latest}${c3.reset}
+  ${c3.dim}Run ${c3.reset}${c3.bold}${display}${c3.reset}${c3.dim} to update${c3.reset}
 
 `
         );
@@ -5212,39 +6343,39 @@ ${c.dim}Press Control-C again to exit${c.reset}
   if (!api || !storedCheck?.ok) {
     const host = endpoint.replace(/^https?:\/\//, "").replace(/\/$/, "");
     if (storedCheck && !storedCheck.ok) {
-      stdout.write(`${c.red}\u2717${c.reset} ${c.dim}Saved sign-in for this endpoint failed:${c.reset} ${storedCheck.reason}
+      stdout.write(`${c3.red}\u2717${c3.reset} ${c3.dim}Saved sign-in for this endpoint failed:${c3.reset} ${storedCheck.reason}
 `);
-      if (storedCheck.hint) stdout.write(`  ${c.dim}${storedCheck.hint}${c.reset}
+      if (storedCheck.hint) stdout.write(`  ${c3.dim}${storedCheck.hint}${c3.reset}
 `);
       stdout.write("\n");
     }
     const explainFailure = (result, prefix) => {
-      stdout.write(`${c.red}\u2717${c.reset} ${prefix}${result.reason}
+      stdout.write(`${c3.red}\u2717${c3.reset} ${prefix}${result.reason}
 `);
-      if (result.hint) stdout.write(`  ${c.dim}${result.hint}${c.reset}
+      if (result.hint) stdout.write(`  ${c3.dim}${result.hint}${c3.reset}
 `);
     };
-    stdout.write(`${c.bold}${gradientText("Sign in to Standard Code")}${c.reset}
+    stdout.write(`${c3.bold}${gradientText("Sign in to Standard Code")}${c3.reset}
 `);
     if (`https://${host}` !== PRODUCTION_ENDPOINT) {
-      stdout.write(`${c.dim}Connecting to${c.reset} ${c.teal}${host}${c.reset}
+      stdout.write(`${c3.dim}Connecting to${c3.reset} ${c3.teal}${host}${c3.reset}
 `);
     }
     stdout.write(
-      `${c.dim}You'll only need to do this once on this machine.${c.reset}
+      `${c3.dim}You'll only need to do this once on this machine.${c3.reset}
 
 `
     );
     stdout.write(
-      `${c.white}Press ${c.bold}Enter${c.reset}${c.white} to open your browser and sign in.${c.reset} ${c.dim}(or paste an API token)${c.reset}
+      `${c3.white}Press ${c3.bold}Enter${c3.reset}${c3.white} to open your browser and sign in.${c3.reset} ${c3.dim}(or paste an API token)${c3.reset}
 
 `
     );
     for (; ; ) {
-      const token = (await ask(`${c.teal}\u276F${c.reset} `)).trim();
+      const token = (await ask(`${c3.teal}\u276F${c3.reset} `)).trim();
       if (!token) {
         const got = await deviceLogin(endpoint).catch((e) => {
-          stdout.write(`${c.red}\u2717${c.reset} ${c.dim}${e instanceof Error ? e.message : String(e)}${c.reset}
+          stdout.write(`${c3.red}\u2717${c3.reset} ${c3.dim}${e instanceof Error ? e.message : String(e)}${c3.reset}
 `);
           return null;
         });
@@ -5258,7 +6389,7 @@ ${c.dim}Press Control-C again to exit${c.reset}
             { endpoint, access_token: got, token_type: "Bearer", saved_at: Date.now() },
             { updateDefault: !endpointOverride }
           );
-          stdout.write(`${c.green}\u2713${c.reset} Connected to ${c.teal}${host}${c.reset}
+          stdout.write(`${c3.green}\u2713${c3.reset} Connected to ${c3.teal}${host}${c3.reset}
 `);
           break;
         }
@@ -5274,7 +6405,7 @@ ${c.dim}Press Control-C again to exit${c.reset}
           { endpoint, access_token: token, token_type: "Bearer", saved_at: Date.now() },
           { updateDefault: !endpointOverride }
         );
-        stdout.write(`${c.green}\u2713${c.reset} Connected to ${c.teal}${host}${c.reset}
+        stdout.write(`${c3.green}\u2713${c3.reset} Connected to ${c3.teal}${host}${c3.reset}
 `);
         break;
       }
@@ -5286,17 +6417,72 @@ ${c.dim}Press Control-C again to exit${c.reset}
   if (!api) process.exit(1);
   handoffClosing = true;
   reader.rl?.close();
-  const tags = [`path:${projectDir}`, `machine:${machine}`];
+  const identity = loadMachineIdentity();
+  void registerProject(api, identity, projectDir).catch(() => {
+  });
+  const tui = new Tui(1);
+  const home = os9.homedir();
+  const tildeDir = projectDir.startsWith(home) ? "~" + projectDir.slice(home.length) : projectDir;
+  const shortDir = tildeDir.length > 38 ? "\u2026" + tildeDir.slice(-37) : tildeDir;
+  const session = { mode: "local", identity };
+  {
+    const loadingMachines = startLoader("Checking your machines");
+    const machines = await loadMachines(api).catch(() => []);
+    loadingMachines.stop();
+    session.suggestDaemonInstall = machines.every((m) => !m.daemon);
+    const remoteTargets = machines.filter((m) => m.id !== identity.machine_id && daemonOnline(m));
+    if (remoteTargets.length > 0) {
+      const where = await tui.select(
+        `${c3.bold}${gradientText("Where should this session run?")}${c3.reset}  ${c3.dim}\u2191\u2193 \xB7 enter \xB7 esc${c3.reset}`,
+        [
+          { label: `This machine \u2014 ${shortDir}`, hint: "tools run locally", value: null },
+          ...remoteTargets.map((m) => ({
+            label: m.name,
+            hint: `${m.hostname} \xB7 daemon online${m.daemon ? ` \xB7 v${m.daemon.version}` : ""}`,
+            value: m
+          }))
+        ]
+      );
+      if (where) {
+        const remotePath = await pickRemoteProject(tui, where);
+        if (remotePath) {
+          session.mode = "remote";
+          session.runner = where;
+          session.remotePath = remotePath;
+        }
+      }
+    }
+  }
+  let tags;
+  let resumeTags;
+  if (session.mode === "remote" && session.runner && session.remotePath) {
+    tags = [
+      `path:${session.remotePath}`,
+      `machine:${session.runner.hostname || session.runner.name}`,
+      `runner:${session.runner.id}`
+    ];
+    resumeTags = [`path:${session.remotePath}`, `runner:${session.runner.id}`];
+  } else {
+    tags = [`path:${projectDir}`, `machine:${machine}`, `runner:${identity.machine_id}`];
+    resumeTags = [`path:${projectDir}`, `machine:${machine}`];
+  }
   const loadingSessions = startLoader("Loading sessions");
   let existing = [];
   try {
-    existing = await api.listThreads(AGENT_ID_VARIANTS, tags);
+    existing = await api.listThreads(AGENT_ID_VARIANTS, resumeTags);
   } catch {
     existing = [];
   }
   const summaries = existing.length > 0 ? await summarizeThreads(api, existing.slice(0, 8)) : [];
   loadingSessions.stop();
-  const tui = new Tui(1);
+  const createSessionThread = async () => {
+    const id = await api.createThread(AGENT_ID, tags);
+    if (session.mode === "remote" && session.runner && session.remotePath) {
+      await api.kvSet(id, "session_info", { cwd: session.remotePath, machine: session.runner.name }).catch(() => {
+      });
+    }
+    return id;
+  };
   let threadId;
   let resumed = false;
   let historySeed;
@@ -5307,31 +6493,61 @@ ${c.dim}Press Control-C again to exit${c.reset}
       value: s.id
     }));
     items.push({ label: "\uFF0B Start a new session", value: null });
-    const home = os6.homedir();
-    const tilde = projectDir.startsWith(home) ? "~" + projectDir.slice(home.length) : projectDir;
-    const shortDir = tilde.length > 38 ? "\u2026" + tilde.slice(-37) : tilde;
+    const whereLabel = session.mode === "remote" && session.runner ? `${session.runner.name}:${shortenPath(session.remotePath ?? "")}` : shortDir;
     const picked = await tui.select(
-      `${c.bold}${gradientText("Resume a session")}${c.reset}  ${c.gray}${shortDir}${c.reset}  ${c.dim}\u2191\u2193 \xB7 enter \xB7 esc${c.reset}`,
+      `${c3.bold}${gradientText("Resume a session")}${c3.reset}  ${c3.gray}${whereLabel}${c3.reset}  ${c3.dim}\u2191\u2193 \xB7 enter \xB7 esc${c3.reset}`,
       items
     );
     if (typeof picked === "string") {
       threadId = picked;
       resumed = true;
     } else {
-      threadId = await api.createThread(AGENT_ID, tags);
+      threadId = await createSessionThread();
       historySeed = existing[0]?.id;
     }
   } else {
-    threadId = await api.createThread(AGENT_ID, tags);
+    threadId = await createSessionThread();
   }
   for (; ; ) {
-    await runInteractive(tui, api, threadId, projectDir, machine, resumed, historySeed);
+    await runInteractive(tui, api, threadId, projectDir, machine, resumed, session, historySeed);
     historySeed = threadId;
-    threadId = await api.createThread(AGENT_ID, tags);
+    threadId = await createSessionThread();
     await api.kvSet(threadId, "lease_supersedes", historySeed);
     resumed = false;
   }
 }
+function shortenPath(p, max = 38) {
+  return p.length > max ? "\u2026" + p.slice(-(max - 1)) : p;
+}
+async function pickRemoteProject(tui, runner) {
+  const ENTER_PATH = "__enter_path__";
+  const projects = Object.entries(runner.projects).sort(
+    (a, b) => (b[1]?.last_used_at ?? 0) - (a[1]?.last_used_at ?? 0)
+  );
+  const items = projects.map(([dir, p]) => ({
+    label: shortenPath(dir, 48),
+    hint: p?.last_used_at ? relativeTime(p.last_used_at / 1e3) : "",
+    value: dir
+  }));
+  items.push({ label: `\uFF0B Another path on ${runner.name}\u2026`, hint: "type a directory", value: ENTER_PATH });
+  const picked = await tui.select(
+    `${c3.bold}${gradientText(`Project on ${runner.name}`)}${c3.reset}  ${c3.dim}\u2191\u2193 \xB7 enter \xB7 esc${c3.reset}`,
+    items
+  );
+  if (!picked) return null;
+  if (picked !== ENTER_PATH) return picked;
+  const typed = await tui.prompt(
+    `Directory on ${runner.name} (absolute, created if missing)`,
+    "~/projects/my-app"
+  );
+  if (!typed) return null;
+  const trimmed = typed.trim();
+  if (!trimmed.startsWith("/") && !trimmed.startsWith("~")) {
+    tui.print(`${c3.yellow}Use an absolute path (starting with / or ~).${c3.reset}`);
+    return null;
+  }
+  return trimmed;
+}
 function isSilentMessage(m) {
   return m?.silent === true || m?.metadata?.silent === true;
 }
@@ -5354,46 +6570,10 @@ async function summarizeThreads(api, threads) {
 }
 function subagentLabel(s, titles) {
   const agentName = (s.agent_name || "").trim();
-  const title = (s.title || "").trim() || titles.get(agentName) || (agentName ? agentName.replace(/[_-]+/g, " ").replace(/\b\w/g, (c2) => c2.toUpperCase()) : "Subagent");
+  const title = (s.title || "").trim() || titles.get(agentName) || (agentName ? agentName.replace(/[_-]+/g, " ").replace(/\b\w/g, (c4) => c4.toUpperCase()) : "Subagent");
   const tagged = (s.threadName || "").trim();
   return tagged ? `${title} \xB7 ${tagged}` : title;
 }
-async function deviceLogin(endpoint) {
-  const start = await fetch(`${endpoint}/api/auth/device/start`, { method: "POST" });
-  if (!start.ok) throw new Error(`This instance does not support browser sign-in (HTTP ${start.status}). Paste an API token instead.`);
-  const info = await start.json();
-  stdout.write(`${c.dim}Opening your browser to sign in. If it doesn't open, visit:${c.reset}
-`);
-  stdout.write(`
-  ${c.teal}${info.verify_url}${c.reset}
-
-`);
-  stdout.write(`${c.dim}Waiting for sign-in to complete\u2026 (Ctrl-C to cancel)${c.reset}
-`);
-  openUrl(info.verify_url);
-  const deadline = Date.now() + (info.expires_in ?? 600) * 1e3;
-  const interval = Math.max(2, info.interval ?? 2) * 1e3;
-  while (Date.now() < deadline) {
-    await new Promise((r) => setTimeout(r, interval));
-    const res = await fetch(info.poll_url).catch(() => null);
-    if (!res) continue;
-    if (res.status === 404) throw new Error("The sign-in link expired. Try again.");
-    const body = await res.json().catch(() => ({}));
-    if (body.status === "approved" && body.token) return body.token;
-    if (body.status === "denied") throw new Error("Sign-in was denied in the browser.");
-  }
-  throw new Error("Timed out waiting for browser approval. Try again.");
-}
-function openUrl(url) {
-  const platform = process.platform;
-  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
-  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
-  try {
-    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
-    child.unref();
-  } catch {
-  }
-}
 function relativeTime(unixSeconds) {
   const diff = Date.now() / 1e3 - unixSeconds;
   if (diff < 60) return "just now";
@@ -5436,8 +6616,8 @@ async function printHistory(api, threadId, tui) {
   const convo = msgs.filter((m) => m.role === "user" || m.role === "assistant" && messageText(m.content).trim()).sort((a, b) => (a.created_at ?? 0) - (b.created_at ?? 0));
   if (!convo.length) return;
   const shown = convo.slice(-24);
-  tui.print(`${c.dim}\u2500\u2500 resuming session \xB7 ${convo.length} message${convo.length === 1 ? "" : "s"} \u2500\u2500${c.reset}`);
-  if (shown.length < convo.length) tui.print(`${c.dim}   \u2026 earlier messages omitted${c.reset}`);
+  tui.print(`${c3.dim}\u2500\u2500 resuming session \xB7 ${convo.length} message${convo.length === 1 ? "" : "s"} \u2500\u2500${c3.reset}`);
+  if (shown.length < convo.length) tui.print(`${c3.dim}   \u2026 earlier messages omitted${c3.reset}`);
   for (const m of shown) {
     const text = messageText(m.content).trim();
     if (!text) continue;
@@ -5445,12 +6625,16 @@ async function printHistory(api, threadId, tui) {
     else printAssistant(tui, text);
   }
 }
-async function runInteractive(tui, api, threadId, projectDir, machine, resumed, historySeedThreadId) {
+async function runInteractive(tui, api, threadId, projectDir, machine, resumed, session, historySeedThreadId) {
+  const remote = session.mode === "remote";
+  const runnerName = session.runner?.name ?? "the remote machine";
   const registry = new ProcessRegistry(api, threadId, machine);
-  const mcp = new McpManager(projectDir);
-  const publishMcpCatalog = () => void api.kvSet(threadId, "mcp_catalog", mcp.catalog()).catch(() => {
-  });
-  const host = new HostTools(projectDir, registry, threadId, machine, mcp, publishMcpCatalog, api);
+  const mcp = remote ? null : new McpManager(projectDir);
+  const publishMcpCatalog = () => {
+    if (mcp) void api.kvSet(threadId, "mcp_catalog", mcp.catalog()).catch(() => {
+    });
+  };
+  const host = new HostTools(projectDir, registry, threadId, machine, mcp ?? void 0, publishMcpCatalog, api);
   const refreshBgCount = () => {
     void registry.runningCount().then((n) => tui.setBackgroundCount(n)).catch(() => {
     });
@@ -5468,8 +6652,6 @@ async function runInteractive(tui, api, threadId, projectDir, machine, resumed,
     saveApprovals(api, threadId, perm);
   });
   saveApprovals(api, threadId, perm);
-  void api.kvSet(threadId, "session_info", { cwd: projectDir, machine }).catch(() => {
-  });
   const attaching = startLoader("Attaching to thread");
   let busy = false;
   let interrupting = false;
@@ -5490,35 +6672,76 @@ async function runInteractive(tui, api, threadId, projectDir, machine, resumed,
     for (const v of activeSteps.values()) label = v;
     tui.setStep(label, liveOut);
   };
-  const bridge = new Bridge(api, threadId, host, perm, {
-    onActivity: (line, detail) => {
-      tui.print(colorActivity(line));
-      if (detail) for (const d of detail) tui.print(d);
-      refreshBgCount();
-    },
-    onStatus: (id, summary) => {
-      if (summary) {
-        if (!activeSteps.has(id)) activeSteps.set(id, summary);
-      } else {
-        activeSteps.delete(id);
-      }
-      refreshStatus();
-    },
-    onConnection: (state, attempt) => {
-      if (state === "reconnecting") {
-        if (attempt >= 4) tui.setConnected(false);
-      } else {
-        tui.setConnected(true);
+  let claim = "if_stale";
+  if (!remote) {
+    const ownerRec = await api.kvGet(threadId, "execution_owner").catch(() => null);
+    const ownerDaemonMachine = machineIdFromDaemonClientId(ownerRec?.client_id);
+    if (ownerDaemonMachine === session.identity.machine_id) claim = "takeover";
+  }
+  const bridge = remote ? null : new Bridge(
+    api,
+    threadId,
+    host,
+    perm,
+    {
+      onActivity: (line, detail) => {
+        tui.print(colorActivity(line));
+        if (detail) for (const d of detail) tui.print(d);
+        refreshBgCount();
+      },
+      onOwnership: (isOwner, owner) => {
+        if (isOwner) {
+          bridge?.setClaim("takeover");
+          void api.kvSet(threadId, "session_info", { cwd: projectDir, machine }).catch(() => {
+          });
+        } else {
+          tui.print(
+            `${c3.yellow}\u26A0 Another client${owner?.client_name ? ` (${owner.client_name})` : ""} is executing tools for this session \u2014 this terminal is watching.${c3.reset}`
+          );
+        }
+      },
+      onClaimRefused: (reason) => {
+        if (reason === "in_flight") {
+          tui.print(
+            `${c3.yellow}\u26A0 The session's current client is mid-operation \u2014 execution can't move here until it finishes. Watching for now.${c3.reset}`
+          );
+        }
+      },
+      onSuperseded: () => {
+        tui.print(
+          `${c3.yellow}\u26A0 Another Standard Code process on this machine took over this session \u2014 this terminal is watching.${c3.reset}`
+        );
+      },
+      onStatus: (id, summary) => {
+        if (summary) {
+          if (!activeSteps.has(id)) activeSteps.set(id, summary);
+        } else {
+          activeSteps.delete(id);
+        }
+        refreshStatus();
+      },
+      onConnection: (state, attempt) => {
+        if (state === "reconnecting") {
+          if (attempt >= 4) tui.setConnected(false);
+        } else {
+          tui.setConnected(true);
+        }
+      },
+      requestApproval: async (req, summary, risk) => {
+        return tui.approval(
+          `${summary}${req.requestPermission ? `
+why: ${req.requestPermission}` : ""}`,
+          risk
+        );
       }
     },
-    requestApproval: async (req, summary, risk) => {
-      return tui.approval(
-        `${summary}${req.requestPermission ? `
-why: ${req.requestPermission}` : ""}`,
-        risk
-      );
+    {
+      clientId: interactiveClientId(session.identity),
+      clientName: `${machineDisplayName(session.identity)} (terminal)`,
+      clientKind: "interactive",
+      claim
     }
-  });
+  );
   const stream = new MessageStream(api, threadId, {
     // Live streaming preview: answer text and (opt-in) internal reasoning feed
     // the TUI's ephemeral preview; the committed message still renders from
@@ -5615,14 +6838,14 @@ why: ${req.requestPermission}` : ""}`,
   const sessionEnded = new Promise((r) => endSession = r);
   const quit = async () => {
     tui.end();
-    const stopped2 = api.stop(threadId).catch(() => {
-    });
+    const stopped2 = bridge?.isOwner ?? false ? api.stop(threadId).catch(() => {
+    }) : Promise.resolve();
     const procsStopped2 = host.stopAllLocalProcesses().catch(() => 0);
-    bridge.close();
+    bridge?.close();
     stream.close();
     events.close();
     subActivity.closeAll();
-    mcp.closeAll();
+    mcp?.closeAll();
     const [, killed2] = await Promise.race([
       Promise.all([stopped2, procsStopped2]),
       new Promise((r) => setTimeout(() => r([void 0, 0]), 1500))
@@ -5634,21 +6857,28 @@ why: ${req.requestPermission}` : ""}`,
   const logout = async () => {
     deleteCredential(api.origin);
     const instanceHost = api.origin.replace(/^https?:\/\//, "");
-    tui.print(`${c.gray}Signed out \u2014 removed the saved token for ${c.teal}${instanceHost}${c.reset}${c.gray}. Run standardcode to sign in again.${c.reset}`);
+    tui.print(`${c3.gray}Signed out \u2014 removed the saved token for ${c3.teal}${instanceHost}${c3.reset}${c3.gray}. Run standardcode to sign in again.${c3.reset}`);
     await quit();
   };
   const bgMgr = {
     list: () => registry.list(),
     stop: async (id) => {
+      if (remote) {
+        tui.print(
+          `${c3.gray}That process runs on ${runnerName} \u2014 ask the agent to stop it (it manages processes there).${c3.reset}`
+        );
+        return;
+      }
       await host.execute("background_process", { action: "stop", id });
       refreshBgCount();
     }
   };
   const mcpCtl = {
     configured: () => listMcpServers(),
-    connectedNames: () => mcp.connectedNames(),
-    catalog: () => mcp.catalog(),
+    connectedNames: () => mcp?.connectedNames() ?? [],
+    catalog: () => mcp?.catalog() ?? { servers: [] },
     connect: async (cfg) => {
+      if (!mcp) return { ok: false, error: "MCP servers run on the session's machine." };
       try {
         const client = await mcp.connect(cfg);
         publishMcpCatalog();
@@ -5659,7 +6889,7 @@ why: ${req.requestPermission}` : ""}`,
       }
     },
     disconnect: (name) => {
-      mcp.disconnect(name);
+      mcp?.disconnect(name);
       publishMcpCatalog();
     },
     add: async (cfg) => {
@@ -5675,7 +6905,7 @@ why: ${req.requestPermission}` : ""}`,
       );
     },
     remove: (name) => {
-      mcp.disconnect(name);
+      mcp?.disconnect(name);
       removeMcpServer(name);
       publishMcpCatalog();
     },
@@ -5694,7 +6924,7 @@ why: ${req.requestPermission}` : ""}`,
       const n = (pendingSent.get(key) ?? 1) - 1;
       if (n > 0) pendingSent.set(key, n);
       else pendingSent.delete(key);
-      tui.print(`${c.dim}failed to send: ${e instanceof Error ? e.message : String(e)}${c.reset}`);
+      tui.print(`${c3.dim}failed to send: ${e instanceof Error ? e.message : String(e)}${c3.reset}`);
       return;
     }
     interrupting = false;
@@ -5711,16 +6941,16 @@ why: ${req.requestPermission}` : ""}`,
     try {
       await api.compact(threadId);
     } catch (err) {
-      tui.print(`${c.red}\u2717${c.reset} couldn't start compaction: ${err.message}`);
+      tui.print(`${c3.red}\u2717${c3.reset} couldn't start compaction: ${err.message}`);
     }
   };
   const runAccountCommand = async () => {
-    tui.print(`${c.gray}Opening your account\u2026${c.reset}`);
+    tui.print(`${c3.gray}Opening your account\u2026${c3.reset}`);
     const link = await api.accountLink(threadId).catch(() => null);
     const target = link?.url ?? "https://standardcode.ai/account";
     openUrl(target);
     tui.print(
-      link?.preauthed ? `${c.gray}\u2192 account dashboard opened in your browser (signed in)${c.reset}` : `${c.gray}\u2192 opened ${target} \u2014 sign in with your account email${c.reset}`
+      link?.preauthed ? `${c3.gray}\u2192 account dashboard opened in your browser (signed in)${c3.reset}` : `${c3.gray}\u2192 opened ${target} \u2014 sign in with your account email${c3.reset}`
     );
   };
   const ordinal = (n) => {
@@ -5731,24 +6961,24 @@ why: ${req.requestPermission}` : ""}`,
   const renderUpgradePanel = (q) => {
     const dots = [];
     for (let i = 0; i < q.max; i++) {
-      if (i < q.current) dots.push(`${c.teal}\u25CF${c.reset}`);
-      else if (i === q.current) dots.push(`${c.bold}${gradientText("\uFF0B")}${c.reset}`);
-      else dots.push(`${c.dim}\xB7${c.reset}`);
+      if (i < q.current) dots.push(`${c3.teal}\u25CF${c3.reset}`);
+      else if (i === q.current) dots.push(`${c3.bold}${gradientText("\uFF0B")}${c3.reset}`);
+      else dots.push(`${c3.dim}\xB7${c3.reset}`);
     }
     const cost = fmtCost(q);
     const lines = [
       "",
-      `${c.bold}${gradientText("\u2726 Add a parallel session")}${c.reset}`,
+      `${c3.bold}${gradientText("\u2726 Add a parallel session")}${c3.reset}`,
       "",
-      `${dots.join(" ")}   ${c.dim}${q.current} of ${q.current} session${q.current === 1 ? "" : "s"} in use${c.reset}`
+      `${dots.join(" ")}   ${c3.dim}${q.current} of ${q.current} session${q.current === 1 ? "" : "s"} in use${c3.reset}`
     ];
     if (q.ends_trial) {
       lines.push(
-        `${c.yellow}Your $5 trial covers 1 session. Adding a ${ordinal(q.sessions)} ends the trial${c.reset}`,
-        `${c.yellow}and starts your $49/mo plan now${cost ? ` \u2014 ${c.bold}${cost} charged today${c.reset}${c.yellow}` : ""}.${c.reset}`
+        `${c3.yellow}Your $5 trial covers 1 session. Adding a ${ordinal(q.sessions)} ends the trial${c3.reset}`,
+        `${c3.yellow}and starts your $49/mo plan now${cost ? ` \u2014 ${c3.bold}${cost} charged today${c3.reset}${c3.yellow}` : ""}.${c3.reset}`
       );
     } else if (cost) {
-      lines.push(`Add a ${ordinal(q.sessions)} session at $49/mo \u2014 ${c.bold}${cost} charged now${c.reset}.`);
+      lines.push(`Add a ${ordinal(q.sessions)} session at $49/mo \u2014 ${c3.bold}${cost} charged now${c3.reset}.`);
     } else {
       lines.push(`Add a ${ordinal(q.sessions)} session at $49/mo \u2014 prorated on your next invoice.`);
     }
@@ -5761,7 +6991,7 @@ why: ${req.requestPermission}` : ""}`,
     try {
       if (opts.auto) {
         tui.print(
-          `${c.yellow}You're out of simultaneous sessions \u2014 another Standard Code session is using your slot.${c.reset}`
+          `${c3.yellow}You're out of simultaneous sessions \u2014 another Standard Code session is using your slot.${c3.reset}`
         );
       }
       const quote = await api.sessionsQuote(threadId);
@@ -5769,16 +6999,16 @@ why: ${req.requestPermission}` : ""}`,
         const link = await api.accountLink(threadId).catch(() => null);
         const target = link?.url ?? "https://standardcode.ai/account";
         tui.print(
-          `${c.gray}Close the other session (its slot frees within ~90s) \u2014 or add another simultaneous session to your plan, then resend your message.${c.reset}`
+          `${c3.gray}Close the other session (its slot frees within ~90s) \u2014 or add another simultaneous session to your plan, then resend your message.${c3.reset}`
         );
         openUrl(target);
-        tui.print(`${c.gray}\u2192 opened ${target} to manage your plan${c.reset}`);
+        tui.print(`${c3.gray}\u2192 opened ${target} to manage your plan${c3.reset}`);
         return;
       }
       if (quote.current >= quote.max) {
         tui.print(
-          `${c.yellow}You're at the maximum of ${quote.max} parallel session${quote.max === 1 ? "" : "s"}.${c.reset}
-${c.gray}Close another session (its slot frees within ~90s), then resend your message.${c.reset}`
+          `${c3.yellow}You're at the maximum of ${quote.max} parallel session${quote.max === 1 ? "" : "s"}.${c3.reset}
+${c3.gray}Close another session (its slot frees within ~90s), then resend your message.${c3.reset}`
         );
         return;
       }
@@ -5790,25 +7020,25 @@ ${c.gray}Close another session (its slot frees within ~90s), then resend your me
         { label: "Not now", value: "no" }
       ]);
       if (choice !== "go") {
-        tui.print(`${c.gray}No change made \u2014 you can upgrade anytime with /upgrade.${c.reset}`);
+        tui.print(`${c3.gray}No change made \u2014 you can upgrade anytime with /upgrade.${c3.reset}`);
         return;
       }
-      tui.print(`${c.gray}Applying\u2026${c.reset}`);
+      tui.print(`${c3.gray}Applying\u2026${c3.reset}`);
       let applied;
       try {
         applied = await api.sessionsUpgrade(threadId, quote.sessions);
       } catch (e) {
-        tui.print(`${c.red}\u2717${c.reset} Upgrade failed: ${e instanceof Error ? e.message : String(e)}`);
+        tui.print(`${c3.red}\u2717${c3.reset} Upgrade failed: ${e instanceof Error ? e.message : String(e)}`);
         return;
       }
       if (!applied?.ok) {
-        tui.print(`${c.red}\u2717${c.reset} Upgrade failed: ${applied?.error ?? "unknown error"}`);
+        tui.print(`${c3.red}\u2717${c3.reset} Upgrade failed: ${applied?.error ?? "unknown error"}`);
         return;
       }
       const n = applied.sessions ?? quote.sessions;
-      tui.print(`${c.green}\u2713${c.reset} ${c.bold}${gradientText(`You now have ${n} parallel session${n === 1 ? "" : "s"}.`)}${c.reset}`);
+      tui.print(`${c3.green}\u2713${c3.reset} ${c3.bold}${gradientText(`You now have ${n} parallel session${n === 1 ? "" : "s"}.`)}${c3.reset}`);
       if (opts.auto && lastSent) {
-        tui.print(`${c.gray}Continuing\u2026${c.reset}`);
+        tui.print(`${c3.gray}Continuing\u2026${c3.reset}`);
         await sendNow(lastSent.text, lastSent.images);
       }
     } finally {
@@ -5852,14 +7082,24 @@ ${c.gray}Close another session (its slot frees within ~90s), then resend your me
       },
       run: () => runApprovalsMenu(tui, perm, () => saveApprovals(api, threadId, perm))
     },
+    // MCP servers are hosted by whichever client executes the tools — hide
+    // the local MCP manager in a remote session (the daemon hosts them there).
+    ...remote ? [] : [
+      {
+        name: "mcp",
+        label: "MCP servers",
+        hint: () => {
+          const n = mcpCtl.connectedNames().length;
+          return n ? `${n} connected` : "none";
+        },
+        run: () => runMcpMenu(tui, mcpCtl)
+      }
+    ],
     {
-      name: "mcp",
-      label: "MCP servers",
-      hint: () => {
-        const n = mcpCtl.connectedNames().length;
-        return n ? `${n} connected` : "none";
-      },
-      run: () => runMcpMenu(tui, mcpCtl)
+      name: "daemon",
+      label: "Machine daemon",
+      hint: () => serviceStatus().installed ? "installed on this machine" : "not installed here",
+      run: () => showDaemonInfo(tui, session)
     },
     {
       name: "skills",
@@ -5893,20 +7133,20 @@ ${c.gray}Close another session (its slot frees within ~90s), then resend your me
       editingQueued = false;
       queued.push({ text, images });
       tui.setQueuedCount(queued.length);
-      tui.print(`${c.gray}\u23F3 queued:${c.reset} ${text}`);
+      tui.print(`${c3.gray}\u23F3 queued:${c3.reset} ${text}`);
       return;
     }
     if (busy) {
       queued.push({ text, images });
       tui.setQueuedCount(queued.length);
-      tui.print(`${c.gray}\u23F3 queued:${c.reset} ${text}  ${c.dim}(esc to steer now)${c.reset}`);
+      tui.print(`${c3.gray}\u23F3 queued:${c3.reset} ${text}  ${c3.dim}(esc to steer now)${c3.reset}`);
     } else {
       void sendNow(text, images);
     }
   };
   tui.onInterrupt = () => {
     if (queued.length > 0) {
-      tui.print(`${c.yellow}\u21AA steering \u2014 stopping current work and sending your message\u2026${c.reset}`);
+      tui.print(`${c3.yellow}\u21AA steering \u2014 stopping current work and sending your message\u2026${c3.reset}`);
       void api.stop(threadId).catch(() => {
       }).then(() => flushQueued());
     } else if (busy) {
@@ -5916,7 +7156,7 @@ ${c.gray}Close another session (its slot frees within ~90s), then resend your me
       liveOut = 0;
       tui.setWorking(false);
       refreshStatus();
-      tui.print(`${c.yellow}[interrupted by user]${c.reset}`);
+      tui.print(`${c3.yellow}[interrupted by user]${c3.reset}`);
       void api.stop(threadId).catch(() => {
       });
     }
@@ -5934,15 +7174,27 @@ ${c.gray}Close another session (its slot frees within ~90s), then resend your me
     return true;
   };
   events.connect();
-  await Promise.all([bridge.connect(), stream.connect()]);
+  await Promise.all([...bridge ? [bridge.connect()] : [], stream.connect()]);
+  const ownsExecution = bridge ? await bridge.whenOwnershipKnown(3e3) : false;
   void api.getGoal(threadId).then((g) => tui.setGoal(g)).catch(() => {
   });
   attaching.stop();
-  tui.banner([
-    `${c.bold}${c.magenta}Standard Code${c.reset} ${c.dim}\u2014 coding agent${c.reset}`,
-    `${c.gray}project:${c.reset} ${projectDir}`,
-    `${c.gray}machine:${c.reset} ${machine}   ${c.gray}thread:${c.reset} ${threadId.slice(0, 8)}`
-  ]);
+  tui.banner(
+    remote ? [
+      `${c3.bold}${c3.magenta}Standard Code${c3.reset} ${c3.dim}\u2014 coding agent${c3.reset}`,
+      `${c3.gray}project:${c3.reset} ${session.remotePath ?? "?"} ${c3.teal}on ${runnerName}${c3.reset}`,
+      `${c3.gray}runs on:${c3.reset} ${runnerName} ${c3.dim}(daemon executes tools; you're watching from ${machine})${c3.reset}   ${c3.gray}thread:${c3.reset} ${threadId.slice(0, 8)}`
+    ] : [
+      `${c3.bold}${c3.magenta}Standard Code${c3.reset} ${c3.dim}\u2014 coding agent${c3.reset}`,
+      `${c3.gray}project:${c3.reset} ${projectDir}`,
+      `${c3.gray}machine:${c3.reset} ${machine}   ${c3.gray}thread:${c3.reset} ${threadId.slice(0, 8)}`
+    ]
+  );
+  if (!remote && session.suggestDaemonInstall && process.platform !== "win32" && !serviceStatus().installed) {
+    tui.print(
+      `${c3.dim}Tip: install the always-on daemon (${c3.reset}standardcode daemon install${c3.dim}) to start sessions on this machine from anywhere.${c3.reset}`
+    );
+  }
   if (resumed) await printHistory(api, threadId, tui);
   try {
     (await api.getMessages(threadId, 200)).forEach((m) => shownIds.add(m.id));
@@ -5951,22 +7203,50 @@ ${c.gray}Close another session (its slot frees within ~90s), then resend your me
   const runningProcs = (await registry.list()).filter((p) => p.status === "running");
   if (runningProcs.length) {
     tui.print(
-      `${c.cyan}\u2699 ${runningProcs.length} background process${runningProcs.length === 1 ? "" : "es"} running:${c.reset}`
+      `${c3.cyan}\u2699 ${runningProcs.length} background process${runningProcs.length === 1 ? "" : "es"} running:${c3.reset}`
     );
-    for (const p of runningProcs) tui.print(`${c.gray}  ${p.id}  ${p.description || p.command}${c.reset}`);
+    for (const p of runningProcs) tui.print(`${c3.gray}  ${p.id}  ${p.description || p.command}${c3.reset}`);
   }
   refreshBgCount();
-  const enabledServers = listMcpServers().filter((s) => s.enabled);
-  for (const s of enabledServers) {
-    const res = await mcpCtl.connect(s);
-    if (res.ok) {
-      tui.print(`${c.cyan}\u26A1 MCP "${s.name}" connected${c.reset} ${c.gray}(${res.tools} tool${res.tools === 1 ? "" : "s"})${c.reset}`);
-    } else {
-      tui.print(`${c.red}\u26A0 MCP "${s.name}" failed:${c.reset} ${c.gray}${res.error}${c.reset}`);
+  if (!remote && ownsExecution) {
+    const enabledServers = listMcpServers().filter((s) => s.enabled);
+    for (const s of enabledServers) {
+      const res = await mcpCtl.connect(s);
+      if (res.ok) {
+        tui.print(`${c3.cyan}\u26A1 MCP "${s.name}" connected${c3.reset} ${c3.gray}(${res.tools} tool${res.tools === 1 ? "" : "s"})${c3.reset}`);
+      } else {
+        tui.print(`${c3.red}\u26A0 MCP "${s.name}" failed:${c3.reset} ${c3.gray}${res.error}${c3.reset}`);
+      }
     }
+    publishMcpCatalog();
   }
-  publishMcpCatalog();
   tui.start();
+  const answeredApprovals = /* @__PURE__ */ new Set();
+  let approvalPromptOpen = false;
+  const relayApprovals = async () => {
+    const watching = remote || (bridge ? !bridge.isOwner : false);
+    if (!watching || approvalPromptOpen) return;
+    const request = parseApprovalRequest(await api.kvGet(threadId, APPROVAL_REQUEST_KEY));
+    if (!request || answeredApprovals.has(request.tool_call_id)) return;
+    approvalPromptOpen = true;
+    try {
+      const { choice, reason } = await tui.approval(
+        `${request.summary}${request.permission ? `
+${c3.bold}why: ${request.permission}${c3.reset}` : ""}
+${c3.dim}runs on ${request.machine || runnerName}${c3.reset}`,
+        request.risk
+      );
+      answeredApprovals.add(request.tool_call_id);
+      await writeApprovalResponse(api, threadId, {
+        tool_call_id: request.tool_call_id,
+        choice,
+        reason,
+        decided_at: Date.now()
+      });
+    } finally {
+      approvalPromptOpen = false;
+    }
+  };
   const poll = async () => {
     let msgs;
     try {
@@ -5985,7 +7265,7 @@ ${c.gray}Close another session (its slot frees within ~90s), then resend your me
         continue;
       }
       if (m.role === "assistant" && text) printAssistant(tui, text);
-      else if (m.role === "system" && text) tui.print(`${c.dim}${text}${c.reset}`);
+      else if (m.role === "system" && text) tui.print(`${c3.dim}${text}${c3.reset}`);
       else if (m.role === "user" && text) {
         const pending = pendingSent.get(text) ?? 0;
         if (pending > 0) {
@@ -6011,6 +7291,8 @@ ${c.gray}Close another session (its slot frees within ~90s), then resend your me
       if (queued.length > 0 && !editingQueued) await flushQueued();
     }
     refreshBgCount();
+    void relayApprovals().catch(() => {
+    });
     try {
       const logs = await api.getLogs(threadId, 100);
       let landed = 0;
@@ -6047,14 +7329,14 @@ ${c.gray}Close another session (its slot frees within ~90s), then resend your me
   await sessionEnded;
   clearInterval(pollTimer);
   clearInterval(heartbeatPoll);
-  const stopped = api.stop(threadId).catch(() => {
-  });
+  const stopped = bridge?.isOwner ?? false ? api.stop(threadId).catch(() => {
+  }) : Promise.resolve();
   const procsStopped = host.stopAllLocalProcesses().catch(() => 0);
-  bridge.close();
+  bridge?.close();
   stream.close();
   events.close();
   subActivity.closeAll();
-  mcp.closeAll();
+  mcp?.closeAll();
   const [, killed] = await Promise.race([
     Promise.all([stopped, procsStopped]),
     new Promise((r) => setTimeout(() => r([void 0, 0]), 1500))
@@ -6067,16 +7349,16 @@ ${c.gray}Close another session (its slot frees within ~90s), then resend your me
   tui.setStep(null, 0);
   tui.setBackgroundCount(0);
   if (killed > 0) {
-    tui.print(`${c.cyan}\u2699${c.reset} Stopped ${killed} background process${killed === 1 ? "" : "es"}.`);
+    tui.print(`${c3.cyan}\u2699${c3.reset} Stopped ${killed} background process${killed === 1 ? "" : "es"}.`);
   }
-  tui.print(`${c.dim}\u2500\u2500 conversation cleared \u2014 starting a fresh session \u2500\u2500${c.reset}`);
+  tui.print(`${c3.dim}\u2500\u2500 conversation cleared \u2014 starting a fresh session \u2500\u2500${c3.reset}`);
 }
 async function runSkillsMenu(tui, skills) {
   let list;
   try {
     list = await skills.list();
   } catch (e) {
-    tui.print(`${c.red}\u2717 couldn't load skills:${c.reset} ${c.gray}${e instanceof Error ? e.message : String(e)}${c.reset}`);
+    tui.print(`${c3.red}\u2717 couldn't load skills:${c3.reset} ${c3.gray}${e instanceof Error ? e.message : String(e)}${c3.reset}`);
     return;
   }
   const INSTALL = "__install__";
@@ -6087,7 +7369,7 @@ async function runSkillsMenu(tui, skills) {
   }));
   items.push({ label: "\uFF0B Install a skill\u2026", hint: "find & install", value: INSTALL });
   const picked = await tui.select(
-    `${c.bold}Agent skills${c.reset}  ${c.dim}(\u2191/\u2193 \xB7 enter \xB7 esc to close)${c.reset}`,
+    `${c3.bold}Agent skills${c3.reset}  ${c3.dim}(\u2191/\u2193 \xB7 enter \xB7 esc to close)${c3.reset}`,
     items
   );
   if (!picked) return;
@@ -6100,8 +7382,8 @@ async function runSkillsMenu(tui, skills) {
     return;
   }
   const skill = list.find((s) => s.name === picked);
-  tui.print(`${c.cyan}${skill.name}${c.reset}${skill.version ? ` ${c.dim}v${skill.version}${c.reset}` : ""} ${c.gray}\u2014 ${skill.description}${c.reset}`);
-  const action = await tui.select(`${c.bold}${picked}${c.reset}`, [
+  tui.print(`${c3.cyan}${skill.name}${c3.reset}${skill.version ? ` ${c3.dim}v${skill.version}${c3.reset}` : ""} ${c3.gray}\u2014 ${skill.description}${c3.reset}`);
+  const action = await tui.select(`${c3.bold}${picked}${c3.reset}`, [
     skill.enabled ? { label: "Disable (hide from the agent)", value: "disable" } : { label: "Enable", value: "enable" },
     { label: "View files", value: "files" },
     { label: "Remove this skill", value: "remove" },
@@ -6110,20 +7392,20 @@ async function runSkillsMenu(tui, skills) {
   try {
     if (action === "enable" || action === "disable") {
       await skills.setEnabled(picked, action === "enable");
-      tui.print(`${c.gray}${action}d ${picked}${c.reset}`);
+      tui.print(`${c3.gray}${action}d ${picked}${c3.reset}`);
     } else if (action === "files") {
-      for (const f of skill.files) tui.print(`  ${c.gray}${f}${c.reset}`);
+      for (const f of skill.files) tui.print(`  ${c3.gray}${f}${c3.reset}`);
     } else if (action === "remove") {
       await skills.remove(picked);
-      tui.print(`${c.gray}removed ${picked}${c.reset}`);
+      tui.print(`${c3.gray}removed ${picked}${c3.reset}`);
     }
   } catch (e) {
-    tui.print(`${c.red}\u2717 ${e instanceof Error ? e.message : String(e)}${c.reset}`);
+    tui.print(`${c3.red}\u2717 ${e instanceof Error ? e.message : String(e)}${c3.reset}`);
   }
 }
 async function runLevelMenu(tui, perm) {
   const picked = await tui.select(
-    `${c.bold}Auto-accept level${c.reset}  ${c.dim}(\u2191/\u2193 \xB7 enter \xB7 shift-tab cycles)${c.reset}`,
+    `${c3.bold}Auto-accept level${c3.reset}  ${c3.dim}(\u2191/\u2193 \xB7 enter \xB7 shift-tab cycles)${c3.reset}`,
     LEVELS.map((l) => ({
       label: levelLabel(l),
       hint: l === tui.level ? "current" : "",
@@ -6135,28 +7417,51 @@ async function runLevelMenu(tui, perm) {
     perm.level = picked;
   }
 }
+function showDaemonInfo(tui, session) {
+  if (session.mode === "remote" && session.runner) {
+    tui.print(
+      `${c3.gray}This session runs on${c3.reset} ${c3.bold}${session.runner.name}${c3.reset} ${c3.gray}(${session.runner.hostname}) \u2014 its daemon executes the tools.${c3.reset}`
+    );
+  } else {
+    tui.print(`${c3.gray}This session runs on this machine.${c3.reset}`);
+  }
+  const status = serviceStatus();
+  tui.print(
+    `${c3.gray}Daemon on this machine:${c3.reset} ${status.installed ? status.detail : "not installed"}`
+  );
+  if (!status.installed) {
+    tui.print(
+      `${c3.gray}Install it to start sessions on this machine from anywhere:${c3.reset} ${c3.bold}standardcode daemon install${c3.reset}`
+    );
+    tui.print(
+      `${c3.dim}The daemon keeps running after you close the terminal \u2014 it self-restarts, self-updates, and executes sessions you start from other machines.${c3.reset}`
+    );
+  } else {
+    tui.print(`${c3.dim}Manage it with standardcode daemon status | uninstall | add-project <path>.${c3.reset}`);
+  }
+}
 function showKeybindings(tui) {
-  tui.print(`${c.gray}shortcuts:${c.reset}`);
-  tui.print(`${c.gray}  shift-tab${c.reset}  cycle auto-accept level (1\u20135)`);
-  tui.print(`${c.gray}  /${c.reset}          open the command palette (type to filter)`);
-  tui.print(`${c.gray}  ctrl-v${c.reset}     paste an image from the clipboard ([#Image 1])`);
-  tui.print(`${c.gray}  \u2191 / \u2193${c.reset}      cycle past messages (on the input's top line)`);
-  tui.print(`${c.gray}  \u2190${c.reset}          from the start of the input: select the [\u2699 n bg] badge (enter opens it)`);
-  tui.print(`${c.gray}  ctrl-c${c.reset}     quit`);
+  tui.print(`${c3.gray}shortcuts:${c3.reset}`);
+  tui.print(`${c3.gray}  shift-tab${c3.reset}  cycle auto-accept level (1\u20135)`);
+  tui.print(`${c3.gray}  /${c3.reset}          open the command palette (type to filter)`);
+  tui.print(`${c3.gray}  ctrl-v${c3.reset}     paste an image from the clipboard ([#Image 1])`);
+  tui.print(`${c3.gray}  \u2191 / \u2193${c3.reset}      cycle past messages (on the input's top line)`);
+  tui.print(`${c3.gray}  \u2190${c3.reset}          from the start of the input: select the [\u2699 n bg] badge (enter opens it)`);
+  tui.print(`${c3.gray}  ctrl-c${c3.reset}     quit`);
 }
 async function runUpdateCommand(tui) {
   const version = readVersion();
   const result = await forceCheckForUpdate(version);
   if (!result) {
-    tui.print(`${c.green}\u2713${c.reset} ${c.gray}@standardagents/code${c.reset} is up to date (v${version})`);
+    tui.print(`${c3.green}\u2713${c3.reset} ${c3.gray}@standardagents/code${c3.reset} is up to date (v${version})`);
     return;
   }
   const { latest } = result;
   tui.print(`
-  ${c.yellow}\u27F3${c.reset} Update available: ${c.gray}v${version}${c.reset} \u2192 ${c.green}v${latest}${c.reset}`);
+  ${c3.yellow}\u27F3${c3.reset} Update available: ${c3.gray}v${version}${c3.reset} \u2192 ${c3.green}v${latest}${c3.reset}`);
   const pm = detectPackageManager();
   if (!pm) {
-    tui.print(`  ${c.gray}This is a source checkout \u2014 pull the repo to update.${c.reset}`);
+    tui.print(`  ${c3.gray}This is a source checkout \u2014 pull the repo to update.${c3.reset}`);
     return;
   }
   const { display } = updateCommand(pm);
@@ -6165,28 +7470,28 @@ async function runUpdateCommand(tui) {
     { label: "No, skip", value: "no" }
   ]);
   if (choice === "yes") {
-    tui.print(`  ${c.gray}Running ${display}\u2026${c.reset}`);
+    tui.print(`  ${c3.gray}Running ${display}\u2026${c3.reset}`);
     const { ok, output: pmOutput } = await runUpdate(pm);
     if (ok) {
-      tui.print(`  ${c.green}\u2713${c.reset} Updated to v${latest}. Restart to use the new version.`);
+      tui.print(`  ${c3.green}\u2713${c3.reset} Updated to v${latest}. Restart to use the new version.`);
     } else {
-      tui.print(`  ${c.red}\u2717${c.reset} Update failed:`);
+      tui.print(`  ${c3.red}\u2717${c3.reset} Update failed:`);
       for (const line of pmOutput.trim().split("\n").slice(-6)) {
-        tui.print(`  ${c.dim}${line}${c.reset}`);
+        tui.print(`  ${c3.dim}${line}${c3.reset}`);
       }
     }
   } else {
-    tui.print(`  ${c.gray}Skipped. Run /update later.${c.reset}`);
+    tui.print(`  ${c3.gray}Skipped. Run /update later.${c3.reset}`);
   }
 }
 async function runProcessMenu(tui, bg) {
   const procs = await bg.list();
   if (!procs.length) {
-    tui.print(`${c.gray}No background processes for this session.${c.reset}`);
+    tui.print(`${c3.gray}No background processes for this session.${c3.reset}`);
     return;
   }
   const items = procs.map((p) => {
-    const status = p.status === "running" ? `${c.green}running${c.reset}` : `${c.gray}${p.status}${typeof p.exitCode === "number" ? ` (exit ${p.exitCode})` : ""}${c.reset}`;
+    const status = p.status === "running" ? `${c3.green}running${c3.reset}` : `${c3.gray}${p.status}${typeof p.exitCode === "number" ? ` (exit ${p.exitCode})` : ""}${c3.reset}`;
     return {
       label: `${p.description || p.command}`,
       hint: `${p.id} \xB7 ${status}`,
@@ -6194,22 +7499,22 @@ async function runProcessMenu(tui, bg) {
     };
   });
   const picked = await tui.select(
-    `${c.bold}Background processes${c.reset}  ${c.dim}(\u2191/\u2193 \xB7 enter to manage \xB7 esc to close)${c.reset}`,
+    `${c3.bold}Background processes${c3.reset}  ${c3.dim}(\u2191/\u2193 \xB7 enter to manage \xB7 esc to close)${c3.reset}`,
     items
   );
   if (!picked) return;
   const proc = procs.find((p) => p.id === picked);
   if (!proc || proc.status !== "running") {
-    tui.print(`${c.gray}${picked} is not running.${c.reset}`);
+    tui.print(`${c3.gray}${picked} is not running.${c3.reset}`);
     return;
   }
-  const action = await tui.select(`${c.bold}${proc.description || proc.command}${c.reset}`, [
+  const action = await tui.select(`${c3.bold}${proc.description || proc.command}${c3.reset}`, [
     { label: "Stop this process", value: "stop" },
     { label: "Leave it running", value: "leave" }
   ]);
   if (action === "stop") {
     await bg.stop(picked);
-    tui.print(`${c.gray}stopped ${picked}${c.reset}`);
+    tui.print(`${c3.gray}stopped ${picked}${c3.reset}`);
   }
 }
 async function runApprovalsMenu(tui, perm, save) {
@@ -6217,7 +7522,7 @@ async function runApprovalsMenu(tui, perm, save) {
   const risks = Array.from(perm.allowRisk).sort((a, b) => a - b);
   if (!tools.length && !risks.length) {
     tui.print(
-      `${c.gray}No pre-approved commands. At a permission prompt, choose "Always allow this tool" or "Allow all level N" to add some.${c.reset}`
+      `${c3.gray}No pre-approved commands. At a permission prompt, choose "Always allow this tool" or "Allow all level N" to add some.${c3.reset}`
     );
     return;
   }
@@ -6227,22 +7532,22 @@ async function runApprovalsMenu(tui, perm, save) {
     { label: "Clear all approvals", hint: "", value: "clear" }
   ];
   const picked = await tui.select(
-    `${c.bold}Approved commands${c.reset}  ${c.dim}(enter to revoke \xB7 esc to close)${c.reset}`,
+    `${c3.bold}Approved commands${c3.reset}  ${c3.dim}(enter to revoke \xB7 esc to close)${c3.reset}`,
     items
   );
   if (!picked) return;
   if (picked === "clear") {
     perm.alwaysAllow.clear();
     perm.allowRisk.clear();
-    tui.print(`${c.gray}cleared all approvals${c.reset}`);
+    tui.print(`${c3.gray}cleared all approvals${c3.reset}`);
   } else if (picked.startsWith("tool:")) {
     const t = picked.slice(5);
     perm.alwaysAllow.delete(t);
-    tui.print(`${c.gray}revoked tool ${t}${c.reset}`);
+    tui.print(`${c3.gray}revoked tool ${t}${c3.reset}`);
   } else if (picked.startsWith("risk:")) {
     const r = Number(picked.slice(5));
     perm.allowRisk.delete(r);
-    tui.print(`${c.gray}revoked level ${r}${c.reset}`);
+    tui.print(`${c3.gray}revoked level ${r}${c3.reset}`);
   }
   save();
 }
@@ -6260,7 +7565,7 @@ async function runMcpMenu(tui, mcp) {
   items.push({ label: "\uFF0B Install a new MCP server\u2026", hint: "find & install", value: INSTALL });
   items.push({ label: "Add manually (name: command)\u2026", hint: "advanced", value: ADD_MANUAL });
   const picked = await tui.select(
-    `${c.bold}MCP servers${c.reset}  ${c.dim}(\u2191/\u2193 \xB7 enter \xB7 esc to close)${c.reset}`,
+    `${c3.bold}MCP servers${c3.reset}  ${c3.dim}(\u2191/\u2193 \xB7 enter \xB7 esc to close)${c3.reset}`,
     items
   );
   if (!picked) return;
@@ -6274,7 +7579,7 @@ async function runMcpMenu(tui, mcp) {
   }
   const server = configured.find((s) => s.name === picked);
   const isConnected = connected.has(picked);
-  const action = await tui.select(`${c.bold}${picked}${c.reset}`, [
+  const action = await tui.select(`${c3.bold}${picked}${c3.reset}`, [
     { label: "View tools", value: "tools" },
     isConnected ? { label: "Disconnect", value: "disconnect" } : { label: "Connect", value: "connect" },
     server.enabled ? { label: "Disable (don't auto-connect)", value: "disable" } : { label: "Enable (auto-connect on start)", value: "enable" },
@@ -6284,29 +7589,29 @@ async function runMcpMenu(tui, mcp) {
   if (action === "tools") {
     const entry = mcp.catalog().servers.find((e) => e.name === picked);
     if (!entry || entry.status !== "connected") {
-      tui.print(`${c.gray}${picked} is not connected \u2014 connect it to list tools.${c.reset}`);
+      tui.print(`${c3.gray}${picked} is not connected \u2014 connect it to list tools.${c3.reset}`);
       return;
     }
-    if (!entry.tools.length) tui.print(`${c.gray}${picked} exposes no tools.${c.reset}`);
-    for (const t of entry.tools) tui.print(`  ${c.cyan}${t.name}${c.reset}${t.description ? ` ${c.gray}\u2014 ${t.description}${c.reset}` : ""}`);
-    if (entry.resources.length) tui.print(`  ${c.gray}${entry.resources.length} resource(s)${c.reset}`);
+    if (!entry.tools.length) tui.print(`${c3.gray}${picked} exposes no tools.${c3.reset}`);
+    for (const t of entry.tools) tui.print(`  ${c3.cyan}${t.name}${c3.reset}${t.description ? ` ${c3.gray}\u2014 ${t.description}${c3.reset}` : ""}`);
+    if (entry.resources.length) tui.print(`  ${c3.gray}${entry.resources.length} resource(s)${c3.reset}`);
   } else if (action === "connect") {
     const res = await mcp.connect(server);
-    tui.print(res.ok ? `${c.cyan}\u26A1 connected (${res.tools} tools)${c.reset}` : `${c.red}\u26A0 ${res.error}${c.reset}`);
+    tui.print(res.ok ? `${c3.cyan}\u26A1 connected (${res.tools} tools)${c3.reset}` : `${c3.red}\u26A0 ${res.error}${c3.reset}`);
   } else if (action === "disconnect") {
     mcp.disconnect(picked);
-    tui.print(`${c.gray}disconnected ${picked}${c.reset}`);
+    tui.print(`${c3.gray}disconnected ${picked}${c3.reset}`);
   } else if (action === "enable") {
     mcp.setEnabled(picked, true);
     const res = await mcp.connect(server);
-    tui.print(res.ok ? `${c.cyan}\u26A1 enabled + connected (${res.tools} tools)${c.reset}` : `${c.red}\u26A0 enabled but failed: ${res.error}${c.reset}`);
+    tui.print(res.ok ? `${c3.cyan}\u26A1 enabled + connected (${res.tools} tools)${c3.reset}` : `${c3.red}\u26A0 enabled but failed: ${res.error}${c3.reset}`);
   } else if (action === "disable") {
     mcp.setEnabled(picked, false);
     mcp.disconnect(picked);
-    tui.print(`${c.gray}disabled + disconnected ${picked}${c.reset}`);
+    tui.print(`${c3.gray}disabled + disconnected ${picked}${c3.reset}`);
   } else if (action === "remove") {
     mcp.remove(picked);
-    tui.print(`${c.gray}removed ${picked}${c.reset}`);
+    tui.print(`${c3.gray}removed ${picked}${c3.reset}`);
   }
 }
 async function addMcpServer(tui, mcp) {
@@ -6317,13 +7622,13 @@ async function addMcpServer(tui, mcp) {
   if (!spec) return;
   const cfg = parseServerSpec(spec);
   if (!cfg) {
-    tui.print(`${c.yellow}couldn't parse that. Use  name: command [args]${c.reset}`);
+    tui.print(`${c3.yellow}couldn't parse that. Use  name: command [args]${c3.reset}`);
     return;
   }
-  tui.print(`${c.gray}connecting MCP "${cfg.name}" (${cfg.command} ${cfg.args.join(" ")})\u2026${c.reset}`);
+  tui.print(`${c3.gray}connecting MCP "${cfg.name}" (${cfg.command} ${cfg.args.join(" ")})\u2026${c3.reset}`);
   const res = await mcp.add(cfg);
-  if (res.ok) tui.print(`${c.cyan}\u26A1 MCP "${cfg.name}" connected${c.reset} ${c.gray}(${res.tools} tool${res.tools === 1 ? "" : "s"})${c.reset}`);
-  else tui.print(`${c.red}\u26A0 MCP "${cfg.name}" failed:${c.reset} ${c.gray}${res.error}${c.reset} ${c.dim}(saved; retry from the MCP menu)${c.reset}`);
+  if (res.ok) tui.print(`${c3.cyan}\u26A1 MCP "${cfg.name}" connected${c3.reset} ${c3.gray}(${res.tools} tool${res.tools === 1 ? "" : "s"})${c3.reset}`);
+  else tui.print(`${c3.red}\u26A0 MCP "${cfg.name}" failed:${c3.reset} ${c3.gray}${res.error}${c3.reset} ${c3.dim}(saved; retry from the MCP menu)${c3.reset}`);
 }
 async function installMcpServerFlow(tui, mcp) {
   const query = await tui.prompt(