bazilion 0.12.1 → 0.13.0

package/dist/cli.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { defineCommand as defineCommand26, runCommand, showUsage } from "citty";
+import { defineCommand as defineCommand28, runCommand, showUsage } from "citty";
 
 // package.json
 var package_default = {
   name: "bazilion",
-  version: "0.12.1",
+  version: "0.13.0",
   description: "Multi-agent runtime CLI \u2014 spawn LLM agents, manage profiles/teams/skills, and run the local daemon.",
   license: "MIT",
   repository: {
@@ -49,15 +49,16 @@ var package_default = {
     access: "public"
   },
   dependencies: {
-    "@earendil-works/pi-agent-core": "0.80.6",
-    "@earendil-works/pi-ai": "0.80.6",
-    "@earendil-works/pi-coding-agent": "0.80.6",
+    "@earendil-works/pi-agent-core": "0.84.3",
+    "@earendil-works/pi-ai": "0.84.3",
+    "@earendil-works/pi-coding-agent": "0.84.3",
     "@hono/node-server": "^2.0.6",
     "@mozilla/readability": "^0.6.0",
     "@playwright/browser-chromium": "^1.61.0",
     "@tanstack/react-router": "1.170.16",
     "@tobilu/qmd": "^2.5.3",
     "adm-zip": "^0.5.17",
+    "age-encryption": "0.3.0",
     citty: "^0.2.2",
     dompurify: "^3.4.11",
     grammy: "^1.44.0",
@@ -96,15 +97,17 @@ async function resolveToken(src) {
 }
 function createClient(cfg) {
   async function authHeaders() {
-    const token = await resolveToken(cfg.token);
+    const token = cfg.token === null ? null : await resolveToken(cfg.token);
+    const extra = typeof cfg.headers === "function" ? await cfg.headers() : cfg.headers ?? {};
     return {
-      authorization: `Bearer ${token}`,
+      ...token ? { authorization: `Bearer ${token}` } : {},
       // Astro 6 enabled `security.checkOrigin` by default for server mode:
       // any state-changing request without an `Origin` matching the server
       // host is rejected with 403. Browsers set this automatically; `fetch`
       // in Node / React Native does not. Stamping the server's own URL is
       // always valid for a legitimate client.
-      origin: cfg.serverUrl
+      origin: cfg.serverUrl,
+      ...extra
     };
   }
   async function request(method, path, body) {
@@ -229,15 +232,15 @@ function columnize(rows, gap = "  ") {
   if (rows.length === 0) return [];
   const colCount = rows[0]?.length ?? 0;
   const widths = new Array(colCount).fill(0);
-  for (const row of rows) {
+  for (const row2 of rows) {
     for (let i = 0; i < colCount; i++) {
-      const cell = row[i] ?? "";
+      const cell = row2[i] ?? "";
       const prev = widths[i] ?? 0;
       if (cell.length > prev) widths[i] = cell.length;
     }
   }
   return rows.map(
-    (row) => row.map((cell, i) => {
+    (row2) => row2.map((cell, i) => {
       if (i === colCount - 1) return cell;
       return (cell ?? "").padEnd(widths[i] ?? 0);
     }).join(gap)
@@ -1339,7 +1342,7 @@ var attentionCommand = defineCommand3({
 });
 
 // src/commands/auth.ts
-import { loginOpenAICodex } from "@earendil-works/pi-ai/oauth";
+import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
 import { defineCommand as defineCommand4 } from "citty";
 function formatExpiry(ms) {
   if (!ms) return "(unknown)";
@@ -1355,20 +1358,28 @@ var openaiLoginCmd = defineCommand4({
     const client = createClient2();
     console.log("opening your browser for OpenAI sign-in...");
     console.log("(if it doesn't open automatically, paste the URL shown below)");
-    const creds = await loginOpenAICodex({
-      onAuth: ({ url }) => {
-        console.log("");
-        console.log(`  \u2192 ${url}`);
-        console.log("");
+    const oauth = openaiCodexProvider().auth.oauth;
+    if (!oauth) throw new Error("Pi openai-codex provider does not expose OAuth");
+    const loginController = new AbortController();
+    const creds = await oauth.login({
+      signal: loginController.signal,
+      notify: (event) => {
+        if (event.type === "auth_url") {
+          console.log("");
+          console.log(`  \u2192 ${event.url}`);
+          console.log("");
+        } else if (event.type === "progress" || event.type === "info") {
+          console.log(`  ${event.message}`);
+        } else if (event.type === "device_code") {
+          console.log(`  open ${event.verificationUri} and enter ${event.userCode}`);
+        }
       },
-      onPrompt: async (prompt) => {
+      prompt: async (prompt) => {
+        if (prompt.type === "select") return prompt.options[0]?.id ?? "";
         process.stdout.write(`${prompt.message}: `);
         return new Promise((resolve4) => {
           process.stdin.once("data", (d) => resolve4(String(d).trim()));
         });
-      },
-      onProgress: (msg) => {
-        console.log(`  ${msg}`);
       }
     });
     const status = await client.put("/api/auth/openai", {
@@ -1438,11 +1449,20 @@ var authCommand = defineCommand4({
 });
 
 // src/commands/backup.ts
-import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto";
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash as createHash3,
+  pbkdf2Sync,
+  randomBytes,
+  randomUUID as randomUUID2
+} from "crypto";
 import {
   chmodSync as chmodSync2,
   closeSync as closeSync2,
   copyFileSync,
+  cpSync,
+  createReadStream,
   createWriteStream,
   existsSync as existsSync2,
   fsyncSync as fsyncSync2,
@@ -1452,21 +1472,24 @@ import {
   openSync as openSync2,
   readdirSync,
   readFileSync as readFileSync4,
+  readSync,
   renameSync as renameSync2,
-  rmSync as rmSync2
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync2
 } from "fs";
 import { tmpdir } from "os";
 import { basename as basename3, dirname as dirname2, isAbsolute, parse, posix, relative, resolve as resolve2 } from "path";
-import { DatabaseSync } from "node:sqlite";
+import { DatabaseSync, backup as sqliteBackup } from "node:sqlite";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
+import { Decrypter, Encrypter } from "age-encryption";
 import { defineCommand as defineCommand5 } from "citty";
 import { extract, list as list3 } from "tar";
 
 // src/backup-schema.ts
 import { createHash } from "crypto";
 var CANONICAL_MIGRATION = "0001_init";
-var CANONICAL_SCHEMA_HASH = "7c0867f97bd6a7d9c8a89f43f6ae7e5259c3976d40cd81a2061c43c30b7590a1";
+var CANONICAL_SCHEMA_HASH = "4bde209eb0bf9851bf1f01fc96263f165a1799c81e720ddea463169a0d6c0d51";
 var CANONICAL_OBJECTS = [
   ["index", "agent_triggers_agent"],
   ["index", "agent_triggers_enabled"],
@@ -1491,6 +1514,8 @@ var CANONICAL_OBJECTS = [
   ["index", "trigger_dispatches_claimable"],
   ["index", "trigger_dispatches_trigger_time"],
   ["index", "web_tokens_active"],
+  ["index", "web_sessions_active"],
+  ["index", "web_sessions_device"],
   ["table", "agent_skills"],
   ["table", "agent_loop_break_events"],
   ["table", "agent_lesson_proposals"],
@@ -1525,9 +1550,11 @@ var CANONICAL_OBJECTS = [
   ["table", "team_templates"],
   ["table", "teams"],
   ["table", "telegram_allowed_users"],
+  ["table", "telegram_pairing_challenge"],
   ["table", "template_instantiations"],
   ["table", "trigger_dispatches"],
   ["table", "web_tokens"],
+  ["table", "web_sessions"],
   ["trigger", "create_team_policy"],
   ["trigger", "prevent_detached_team_policy_delete"],
   ["trigger", "validate_source_binding_insert"],
@@ -1543,7 +1570,7 @@ function assertCanonicalBackupSchema(db) {
   const migrations = db.prepare("SELECT version FROM schema_migrations ORDER BY version").all();
   if (migrations.length !== 1 || migrations[0]?.version !== CANONICAL_MIGRATION) {
     throw new Error(
-      `schema_migrations must contain exactly ${CANONICAL_MIGRATION}; found ` + (migrations.map((row) => row.version).join(", ") || "none")
+      `schema_migrations must contain exactly ${CANONICAL_MIGRATION}; found ` + (migrations.map((row2) => row2.version).join(", ") || "none")
     );
   }
   const rows = db.prepare(
@@ -1551,20 +1578,20 @@ function assertCanonicalBackupSchema(db) {
        FROM sqlite_schema
        WHERE sql IS NOT NULL AND name NOT LIKE 'sqlite_%'`
   ).all();
-  const byKey = new Map(rows.map((row) => [`${row.type}\0${row.name}`, row]));
+  const byKey = new Map(rows.map((row2) => [`${row2.type}\0${row2.name}`, row2]));
   const canonicalKeys = new Set(CANONICAL_OBJECTS.map(([type, name]) => `${type}\0${name}`));
-  for (const row of rows) {
-    if (!canonicalKeys.has(`${row.type}\0${row.name}`)) {
-      throw new Error(`unexpected schema ${row.type} is not canonical: ${row.name}`);
+  for (const row2 of rows) {
+    if (!canonicalKeys.has(`${row2.type}\0${row2.name}`)) {
+      throw new Error(`unexpected schema ${row2.type} is not canonical: ${row2.name}`);
     }
   }
   const canonicalRows = [];
   for (const [type, name] of CANONICAL_OBJECTS) {
-    const row = byKey.get(`${type}\0${name}`);
-    if (!row) throw new Error(`required canonical schema ${type} is missing: ${name}`);
-    canonicalRows.push(row);
+    const row2 = byKey.get(`${type}\0${name}`);
+    if (!row2) throw new Error(`required canonical schema ${type} is missing: ${name}`);
+    canonicalRows.push(row2);
   }
-  const payload = canonicalRows.map((row) => [row.type, row.name, row.tbl_name, normalizeSql(row.sql)].join("\0")).join("\n");
+  const payload = canonicalRows.map((row2) => [row2.type, row2.name, row2.tbl_name, normalizeSql(row2.sql)].join("\0")).join("\n");
   const actualHash = createHash("sha256").update(payload).digest("hex");
   if (actualHash !== CANONICAL_SCHEMA_HASH) {
     throw new Error(
@@ -1880,18 +1907,34 @@ async function acquireHomeRestoreLock(home) {
 
 // src/commands/backup.ts
 var createCmd = defineCommand5({
-  meta: { name: "create", description: "Download a tar.gz backup of ~/.bazilion from the server" },
+  meta: { name: "create", description: "Create a client-side encrypted backup of ~/.bazilion" },
   args: {
     output: {
       type: "positional",
       required: false,
-      description: "Output file path (default: ./bazilion-backup-YYYY-MM-DD.tar.gz)"
+      description: "Output path (default: .tar.gz.age with --recipient, otherwise .tar.gz)"
+    },
+    recipient: {
+      type: "string",
+      description: "age recipient (age1\u2026 or age1pq1\u2026); encrypts before writing output"
+    },
+    plaintext: {
+      type: "boolean",
+      description: "Explicitly permit a sensitive unencrypted .tar.gz backup"
     }
   },
   async run({ args }) {
+    if (args.recipient && args.plaintext) {
+      throw new Error("--recipient and --plaintext are mutually exclusive");
+    }
+    if (!args.recipient && !args.plaintext) {
+      throw new Error("choose --recipient <age1\u2026> for encryption or explicitly pass --plaintext");
+    }
     const cfg = loadClientConfig();
     const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-    const outAbs = resolve2(args.output ?? `bazilion-backup-${date}.tar.gz`);
+    const defaultSuffix = args.recipient ? ".tar.gz.age" : ".tar.gz";
+    const outAbs = resolve2(args.output ?? `bazilion-backup-${date}${defaultSuffix}`);
+    if (existsSync2(outAbs)) throw new Error(`refusing to overwrite existing backup: ${outAbs}`);
     const configuredHome = resolve2(resolveCliPaths().home);
     const outputFromHome = relative(configuredHome, outAbs);
     if (!outputFromHome || !outputFromHome.startsWith("..") && !isAbsolute(outputFromHome)) {
@@ -1899,7 +1942,10 @@ var createCmd = defineCommand5({
         `backup output must be outside BAZILION_HOME (${configuredHome}) to avoid nesting backups`
       );
     }
-    console.log(`downloading backup \u2192 ${outAbs}`);
+    if (!args.recipient) {
+      console.warn("warning: creating a plaintext backup containing all Bazilion credentials");
+    }
+    console.log(`${args.recipient ? "encrypting" : "downloading"} backup \u2192 ${outAbs}`);
     const res = await fetch(`${cfg.serverUrl}/api/backup`, {
       headers: { authorization: `Bearer ${cfg.token}`, origin: cfg.serverUrl }
     });
@@ -1915,11 +1961,25 @@ var createCmd = defineCommand5({
     const downloadDir = mkdtempSync(resolve2(tmpdir(), "bazilion-download-"));
     const partial = resolve2(downloadDir, "backup.tar.gz");
     try {
-      await pipeline(
-        Readable.fromWeb(res.body),
-        createWriteStream(partial, { flags: "wx", mode: 384 })
-      );
-      await validateArchive(partial);
+      if (args.recipient) {
+        const [encryptSource, validateSource] = res.body.tee();
+        const encrypter = new Encrypter();
+        encrypter.addRecipient(args.recipient);
+        const encrypted = await encrypter.encrypt(encryptSource);
+        await Promise.all([
+          pipeline(
+            Readable.fromWeb(encrypted),
+            createWriteStream(partial, { flags: "wx", mode: 384 })
+          ),
+          validateArchiveReadable(Readable.fromWeb(validateSource))
+        ]);
+      } else {
+        await pipeline(
+          Readable.fromWeb(res.body),
+          createWriteStream(partial, { flags: "wx", mode: 384 })
+        );
+      }
+      if (!args.recipient) await validateArchive(partial);
       try {
         renameSync2(partial, outAbs);
       } catch (error) {
@@ -2049,6 +2109,27 @@ async function validateArchive(file) {
       entries.push({ path, type: entry2.type, linkpath: entry2.linkpath });
     }
   });
+  return validateArchiveEntries(entries);
+}
+async function validateArchiveReadable(stream) {
+  const entries = [];
+  const parser = list3({
+    strict: true,
+    onentry(entry2) {
+      if (entry2.meta) return;
+      const path = normalizeArchivePath(entry2.path);
+      if (!path) return;
+      if (!EXTRACTABLE_ENTRY_TYPES.has(entry2.type)) {
+        throw new Error(`backup contains unsupported ${entry2.type} entry: ${path}`);
+      }
+      if (entry2.type === "SymbolicLink") validateArchiveSymbolicLink(path, entry2.linkpath);
+      entries.push({ path, type: entry2.type, linkpath: entry2.linkpath });
+    }
+  });
+  await pipeline(stream, parser);
+  return validateArchiveEntries(entries);
+}
+function validateArchiveEntries(entries) {
   const byPath = /* @__PURE__ */ new Map();
   for (const entry2 of entries) {
     if (byPath.has(entry2.path)) throw new Error(`backup contains a duplicate path: ${entry2.path}`);
@@ -2107,7 +2188,7 @@ function validateDatabase(path, authToken) {
     db = new DatabaseSync(path, { readOnly: true });
     const integrity = db.prepare("PRAGMA integrity_check").all();
     if (integrity.length !== 1 || integrity[0]?.integrity_check !== "ok") {
-      const detail = integrity.map((row) => row.integrity_check).join("; ") || "no result";
+      const detail = integrity.map((row2) => row2.integrity_check).join("; ") || "no result";
       throw new Error(`integrity_check failed: ${detail}`);
     }
     const foreignKeyErrors = db.prepare("PRAGMA foreign_key_check").all();
@@ -2118,7 +2199,7 @@ function validateDatabase(path, authToken) {
     const tokenHash = createHash3("sha256").update(authToken).digest("hex");
     const activeBootstrap = db.prepare(
       `SELECT 1 FROM web_tokens
-         WHERE token_hash = ? AND label = 'bootstrap' AND revoked_at IS NULL
+         WHERE token_hash = ? AND kind = 'bootstrap' AND revoked_at IS NULL
          LIMIT 1`
     ).get(tokenHash);
     if (!activeBootstrap) {
@@ -2181,8 +2262,8 @@ function rebaseRestoredHomeDirectories(database, payload, targetHome) {
       const collection = table;
       const stagedRoot = resolve2(payload, collection);
       const targetRoot = resolve2(targetHome, collection);
-      for (const row of rows) {
-        const id = validateEntityId(row.id, idPattern, `${table} row`);
+      for (const row2 of rows) {
+        const id = validateEntityId(row2.id, idPattern, `${table} row`);
         const rowLabel = `${table} row ${JSON.stringify(id)}`;
         const stagedDir = containedChildDirectory(stagedRoot, id, rowLabel);
         requireExtractedDirectory(stagedDir, rowLabel);
@@ -2194,8 +2275,8 @@ function rebaseRestoredHomeDirectories(database, payload, targetHome) {
       }
     }
     const stagedTeamsRoot = resolve2(payload, "teams");
-    for (const row of teams) {
-      const id = validateEntityId(row.id, SLUG_ID, "teams row");
+    for (const row2 of teams) {
+      const id = validateEntityId(row2.id, SLUG_ID, "teams row");
       const rowLabel = `teams row ${JSON.stringify(id)}`;
       requireExtractedTeamSlot(containedChildDirectory(stagedTeamsRoot, id, rowLabel), rowLabel);
     }
@@ -2216,8 +2297,8 @@ function rebaseRestoredHomeDirectories(database, payload, targetHome) {
       const readProfile = db.prepare("SELECT dir FROM profiles WHERE id = ?");
       const readAgent = db.prepare("SELECT dir FROM agents WHERE id = ?");
       for (const rewrite of rewrites) {
-        const row = rewrite.table === "profiles" ? readProfile.get(rewrite.id) : readAgent.get(rewrite.id);
-        if (row?.dir !== rewrite.dir) {
+        const row2 = rewrite.table === "profiles" ? readProfile.get(rewrite.id) : readAgent.get(rewrite.id);
+        if (row2?.dir !== rewrite.dir) {
           throw new Error(
             `could not verify rebased ${rewrite.table} row ${JSON.stringify(rewrite.id)}`
           );
@@ -2255,6 +2336,14 @@ function removeRebuildableQmdIndexes(payload) {
     }
   }
 }
+function revokeRestoredBrowserSessions(database) {
+  const db = new DatabaseSync(database);
+  try {
+    db.prepare("UPDATE web_sessions SET revoked_at = ? WHERE revoked_at IS NULL").run(Date.now());
+  } finally {
+    db.close();
+  }
+}
 function installValidatedPayload(payload, targetHome, staging, lifecycle, operations = { rename: renameSync2 }) {
   const previous = resolve2(staging, "previous-home");
   const hadPrevious = existsSync2(targetHome);
@@ -2368,6 +2457,37 @@ function fsyncDirectory(path) {
     if (fd !== null) closeSync2(fd);
   }
 }
+function fsyncFile(path) {
+  const fd = openSync2(path, "r");
+  try {
+    fsyncSync2(fd);
+  } finally {
+    closeSync2(fd);
+  }
+}
+var AGE_HEADER = Buffer.from("age-encryption.org/v1\n", "ascii");
+function isAgeEncrypted(path) {
+  const fd = openSync2(path, "r");
+  try {
+    const header = Buffer.alloc(AGE_HEADER.length);
+    return readSync(fd, header, 0, header.length, 0) === header.length && header.equals(AGE_HEADER);
+  } finally {
+    closeSync2(fd);
+  }
+}
+function readAgeIdentity(rawPath) {
+  const path = resolve2(rawPath);
+  const entry2 = lstatSync2(path);
+  if (!entry2.isFile()) throw new Error(`age identity is not a regular file: ${path}`);
+  if (process.platform !== "win32" && (entry2.mode & 63) !== 0) {
+    throw new Error(`age identity must be owner-only (chmod 600): ${path}`);
+  }
+  const identities = readFileSync4(path, "utf8").split(/\r?\n/).map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
+  if (identities.length !== 1 || !identities[0]?.startsWith("AGE-SECRET-KEY-")) {
+    throw new Error("age identity file must contain exactly one supported AGE-SECRET-KEY entry");
+  }
+  return identities[0];
+}
 var restoreCmd = defineCommand5({
   meta: {
     name: "restore",
@@ -2383,6 +2503,10 @@ var restoreCmd = defineCommand5({
     force: {
       type: "boolean",
       description: "Overwrite existing non-empty home (destroys existing data)"
+    },
+    identity: {
+      type: "string",
+      description: "Path to an age identity file required for encrypted backups"
     }
   },
   async run({ args }) {
@@ -2423,7 +2547,36 @@ var restoreCmd = defineCommand5({
       const payload = resolve2(staging, "payload");
       let preserveStaging = false;
       try {
-        copyFileSync(file, stagedArchive);
+        if (isAgeEncrypted(file)) {
+          if (!args.identity) {
+            throw new Error("encrypted backup requires --identity <owner-only age identity file>");
+          }
+          const identity = readAgeIdentity(args.identity);
+          const decrypter = new Decrypter();
+          decrypter.addIdentity(identity);
+          let decrypted;
+          try {
+            decrypted = await decrypter.decrypt(
+              Readable.toWeb(createReadStream(file))
+            );
+          } catch {
+            throw new Error("backup decryption failed: wrong identity or invalid encrypted header");
+          }
+          try {
+            await pipeline(
+              Readable.fromWeb(decrypted),
+              createWriteStream(stagedArchive, { flags: "wx", mode: 384 })
+            );
+          } catch {
+            throw new Error("backup decryption failed: ciphertext is truncated or modified");
+          }
+        } else {
+          if (args.identity) {
+            throw new Error("encrypted-only restore requested, but the backup is plaintext");
+          }
+          copyFileSync(file, stagedArchive);
+          chmodSync2(stagedArchive, 384);
+        }
         await validateArchive(stagedArchive);
         mkdirSync2(payload);
         await extract({
@@ -2445,6 +2598,7 @@ var restoreCmd = defineCommand5({
         const authToken = validateAuthFile(authFile);
         validateDatabase(database, authToken);
         rebaseRestoredHomeDirectories(database, payload, targetHome);
+        revokeRestoredBrowserSessions(database);
         validateDatabase(database, authToken);
         removeRebuildableQmdIndexes(payload);
         console.log(`installing validated backup ${file} \u2192 ${targetHome}`);
@@ -2475,11 +2629,200 @@ var restoreCmd = defineCommand5({
     console.log("start the server with: bazilion serve  (migrations apply automatically)");
   }
 });
+function decryptSecretEnvelope(raw, password) {
+  const envelope = JSON.parse(raw);
+  const key = pbkdf2Sync(password, Buffer.from(envelope.salt, "hex"), 1e5, 32, "sha256");
+  const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(envelope.iv, "hex"));
+  decipher.setAuthTag(Buffer.from(envelope.tag, "hex"));
+  return Buffer.concat([
+    decipher.update(Buffer.from(envelope.data, "hex")),
+    decipher.final()
+  ]).toString("utf8");
+}
+function encryptSecretEnvelope(value, password) {
+  const salt = randomBytes(16);
+  const key = pbkdf2Sync(password, salt, 1e5, 32, "sha256");
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const data = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+  return JSON.stringify({
+    salt: salt.toString("hex"),
+    iv: iv.toString("hex"),
+    tag: cipher.getAuthTag().toString("hex"),
+    data: data.toString("hex")
+  });
+}
+function credentialInventory(home) {
+  const authFile = resolve2(home, "auth.json");
+  const database = resolve2(home, "bazilion.db");
+  const token = validateAuthFile(authFile);
+  validateDatabase(database, token);
+  const db = new DatabaseSync(database, { readOnly: true });
+  try {
+    const activeTokens = db.prepare(
+      "SELECT COUNT(*) AS count FROM web_tokens WHERE revoked_at IS NULL AND kind = 'device' AND expires_at > ?"
+    ).get(Date.now());
+    const secretKeys = db.prepare("SELECT key FROM secrets ORDER BY key").all().map((row2) => row2.key);
+    return { bootstrap: true, activeTokens: activeTokens.count, secretKeys };
+  } finally {
+    db.close();
+  }
+}
+var inventoryCmd = defineCommand5({
+  meta: { name: "inventory", description: "List credential classes captured by a backup/home" },
+  args: { home: { type: "string", description: "Override BAZILION_HOME" } },
+  run({ args }) {
+    const home = resolve2(resolveCliPaths(args.home).home);
+    const inventory = credentialInventory(home);
+    console.log("credential classes present (values are never shown):");
+    console.log(`  bootstrap token: ${inventory.bootstrap ? "present" : "missing"}`);
+    console.log(`  active device/web/mobile tokens: ${inventory.activeTokens}`);
+    for (const key of inventory.secretKeys) console.log(`  stored secret: ${key}`);
+  }
+});
+var recoveryGuideCmd = defineCommand5({
+  meta: { name: "recovery-guide", description: "Print the credential-exposure recovery checklist" },
+  run() {
+    console.log("Bazilion credential exposure recovery:");
+    console.log("1. Stop the Bazilion daemon and preserve the suspected archive for investigation.");
+    console.log(
+      "2. Run `bazilion backup inventory`, then `bazilion backup rotate-bootstrap --yes`."
+    );
+    console.log("3. Regenerate the Telegram bot token with BotFather and save the replacement.");
+    console.log(
+      "4. Disconnect/revoke the affected OpenAI session or grant, then authenticate again."
+    );
+    console.log("5. Rotate every provider or MCP credential named by the inventory.");
+    console.log("6. Create and verify a fresh recipient-encrypted backup after external rotation.");
+    console.log(
+      "Local bootstrap rotation does not revoke copied Telegram/OpenAI/provider credentials."
+    );
+  }
+});
+var rotateBootstrapCmd = defineCommand5({
+  meta: {
+    name: "rotate-bootstrap",
+    description: "Offline crash-safe bootstrap rotation; revokes every other local token"
+  },
+  args: {
+    home: { type: "string", description: "Override BAZILION_HOME" },
+    yes: { type: "boolean", required: true, description: "Confirm token revocation and home swap" }
+  },
+  async run({ args }) {
+    if (!args.yes) throw new Error("--yes is required");
+    const paths = resolveCliPaths(args.home);
+    const targetHome = resolve2(paths.home);
+    if (targetHome === parse(targetHome).root) {
+      throw new Error(`refusing to rotate filesystem root: ${targetHome}`);
+    }
+    const lock = await acquireHomeRestoreLock(targetHome);
+    const parent = dirname2(targetHome);
+    const staging = mkdtempSync(resolve2(parent, ".bazilion-rotate-"));
+    const payload = resolve2(staging, "payload");
+    let preserveStaging = false;
+    try {
+      for (const serverUrl of configuredLoopbackUrls()) {
+        if (await probeServerRunning(serverUrl)) {
+          throw new Error(`bazilion server appears to be running at ${serverUrl} \u2014 stop it first.`);
+        }
+      }
+      const oldAuth = JSON.parse(readFileSync4(paths.authFile, "utf8"));
+      if (typeof oldAuth.token !== "string" || !oldAuth.token) {
+        throw new Error("auth.json is missing the bootstrap token");
+      }
+      validateDatabase(resolve2(targetHome, "bazilion.db"), oldAuth.token);
+      cpSync(targetHome, payload, {
+        recursive: true,
+        dereference: false,
+        verbatimSymlinks: true,
+        preserveTimestamps: true
+      });
+      const stagedDb = resolve2(payload, "bazilion.db");
+      rmSync2(stagedDb, { force: true });
+      const sourceDb = new DatabaseSync(resolve2(targetHome, "bazilion.db"), { readOnly: true });
+      try {
+        await sqliteBackup(sourceDb, stagedDb);
+      } finally {
+        sourceDb.close();
+      }
+      for (const suffix of ["-wal", "-shm", "-journal"])
+        rmSync2(`${stagedDb}${suffix}`, { force: true });
+      const newToken = randomBytes(24).toString("hex");
+      const db = new DatabaseSync(stagedDb);
+      try {
+        db.exec("PRAGMA foreign_keys = ON; BEGIN IMMEDIATE");
+        try {
+          const rows = db.prepare("SELECT key, envelope FROM secrets ORDER BY key").all();
+          const updateSecret = db.prepare(
+            "UPDATE secrets SET envelope = ?, updated_at = ? WHERE key = ?"
+          );
+          for (const row2 of rows) {
+            let value;
+            try {
+              value = decryptSecretEnvelope(row2.envelope, oldAuth.token);
+            } catch {
+              throw new Error(`stored secret is unreadable and rotation was aborted: ${row2.key}`);
+            }
+            updateSecret.run(encryptSecretEnvelope(value, newToken), Date.now(), row2.key);
+          }
+          const oldHash = createHash3("sha256").update(oldAuth.token).digest("hex");
+          const newHash = createHash3("sha256").update(newToken).digest("hex");
+          const bootstrap = db.prepare(
+            "UPDATE web_tokens SET token_hash = ?, last_used_at = NULL, revoked_at = NULL WHERE token_hash = ? AND kind = 'bootstrap' AND revoked_at IS NULL"
+          ).run(newHash, oldHash);
+          if (bootstrap.changes !== 1) throw new Error("active bootstrap token row was not unique");
+          const revokedAt = Date.now();
+          db.prepare(
+            "UPDATE web_tokens SET revoked_at = ? WHERE kind != 'bootstrap' AND revoked_at IS NULL"
+          ).run(revokedAt);
+          db.prepare("UPDATE web_sessions SET revoked_at = ? WHERE revoked_at IS NULL").run(
+            revokedAt
+          );
+          db.exec("COMMIT");
+        } catch (error) {
+          db.exec("ROLLBACK");
+          throw error;
+        }
+      } finally {
+        db.close();
+      }
+      const stagedAuth = resolve2(payload, "auth.json");
+      const authPartial = resolve2(payload, `.auth.json.${randomUUID2()}.installing`);
+      writeFileSync2(authPartial, `${JSON.stringify({ ...oldAuth, token: newToken }, null, 2)}
+`, {
+        mode: 384,
+        flag: "wx"
+      });
+      renameSync2(authPartial, stagedAuth);
+      chmodSync2(stagedAuth, 384);
+      validateDatabase(stagedDb, newToken);
+      const verification = credentialInventory(payload);
+      if (!verification.bootstrap) throw new Error("rotated credential inventory is invalid");
+      fsyncFile(stagedDb);
+      fsyncFile(stagedAuth);
+      fsyncDirectory(payload);
+      try {
+        installValidatedPayload(payload, targetHome, staging, lock);
+      } catch (error) {
+        if (error instanceof RestoreRecoveryRequiredError) preserveStaging = true;
+        throw error;
+      }
+      console.log("bootstrap token rotated; all non-bootstrap Bazilion tokens were revoked");
+      console.log("external Telegram, OpenAI, provider, and MCP credentials were not revoked");
+    } finally {
+      if (!preserveStaging) rmSync2(staging, { recursive: true, force: true });
+      lock.release();
+    }
+  }
+});
 var backupCommand = defineCommand5({
-  meta: { name: "backup", description: "Create or restore a ~/.bazilion tar.gz backup" },
+  meta: { name: "backup", description: "Encrypted backup, restore, and credential recovery" },
   subCommands: {
     create: createCmd,
-    restore: restoreCmd
+    restore: restoreCmd,
+    inventory: inventoryCmd,
+    "recovery-guide": recoveryGuideCmd,
+    "rotate-bootstrap": rotateBootstrapCmd
   }
   // `bazilion backup` with no positional falls through to citty's subcommand
   // prompt ("No command specified"). The previous default (auto-download to
@@ -2921,7 +3264,7 @@ var doctorCommand = defineCommand9({
   meta: { name: "doctor", description: "Diagnose your bazilion install" },
   async run() {
     const client = createClient2();
-    const r = await client.get("/api/health");
+    const r = await client.get("/api/health/details");
     function check(label, condition, hint) {
       const mark = condition ? "\u2713" : "\u2717";
       const tail = !condition && hint ? ` \u2014 ${hint}` : "";
@@ -2966,22 +3309,24 @@ var doctorCommand = defineCommand9({
       }
     }
     console.log(
-      `  \u2713 lmstudio: ${r.providers.lmstudio.baseURL}${r.providers.lmstudio.hasKey ? " (api key set)" : ""}`
+      `  \u2713 lmstudio: ${r.providers.lmstudio.customEndpointConfigured ? "custom endpoint configured" : "default local endpoint"}${r.providers.lmstudio.keyConfigured ? " (API key configured)" : ""}`
+    );
+    console.log(
+      `  \u2713 ollama:   ${r.providers.ollama.customEndpointConfigured ? "custom endpoint configured" : "default local endpoint"}`
     );
-    console.log(`  \u2713 ollama:   ${r.providers.ollama.baseURL}`);
     console.log();
     console.log("web search (at least one needed for web_search tool)");
-    if (r.webSearch.bravePreview) {
-      console.log(`  \u2713 Brave Search (BRAVE_API_KEY set, ${r.webSearch.bravePreview})`);
+    if (r.webSearch.braveConfigured) {
+      console.log("  \u2713 Brave Search configured");
     } else {
       console.log("  - Brave Search (set BRAVE_API_KEY \u2014 free at https://brave.com/search/api/)");
     }
-    if (r.webSearch.searxngUrl) {
-      console.log(`  \u2713 SearXNG: ${r.webSearch.searxngUrl}`);
+    if (r.webSearch.searxngConfigured) {
+      console.log("  \u2713 SearXNG configured");
     } else {
       console.log("  - SearXNG (set SEARXNG_URL if you self-host one)");
     }
-    if (!r.webSearch.bravePreview && !r.webSearch.searxngUrl) {
+    if (!r.webSearch.braveConfigured && !r.webSearch.searxngConfigured) {
       console.log("  \u26A0 no search backend \u2014 web_search will error until one is configured");
     }
     console.log();
@@ -2998,35 +3343,7 @@ var doctorCommand = defineCommand9({
       `  ${r.scheduler.enabled ? "\u2713" : "-"} scheduler${r.scheduler.enabled ? ` (tick ${r.scheduler.tickMs}ms)` : " (BAZILION_SCHEDULER=off)"}`
     );
     console.log();
-    console.log("agent shell security");
-    if (!r.shellSecurity.ok) {
-      check("valid shell-security configuration", false, r.shellSecurity.error);
-    } else {
-      if (r.shellSecurity.approvalMode === "dangerous") {
-        console.log("  - dangerous-command approval enabled");
-        console.log(
-          "    web and TTY CLI turns can allow once; background and non-TTY turns auto-deny"
-        );
-      } else {
-        console.log("  - dangerous-command approval off");
-        console.log("    set BAZILION_BASH_APPROVAL=dangerous to opt in");
-      }
-      if (r.shellSecurity.sandboxMode === "docker") {
-        console.log(`  - Docker sandbox configured (${r.shellSecurity.sandboxImage})`);
-        console.log(
-          "    workspace-only writable mount \xB7 bounded inputs/skills/memory read-only \xB7 network disabled"
-        );
-        console.log("    host coding tools hidden");
-        console.log(
-          "    policy syntax is valid; Docker and image availability are checked on execution"
-        );
-        console.log("    commands fail closed if either is unavailable");
-      } else {
-        console.log("  - sandbox off (agent shell and coding tools run on the host)");
-        console.log("    approval is a host-execution tripwire, not a filesystem sandbox");
-        console.log("    set BAZILION_BASH_SANDBOX=docker to opt in");
-      }
-    }
+    for (const line of executionSecurityDoctorLines(r)) console.log(line);
     console.log();
     console.log("operational counts");
     console.log(`  ${r.triggers.active} active trigger(s), ${r.triggers.disabled} disabled`);
@@ -3035,7 +3352,7 @@ var doctorCommand = defineCommand9({
     const hasProfiles = (r.database?.ok ? r.database.profiles : 0) > 0;
     const hasAgents = (r.database?.ok ? r.database.totalAgents : 0) > 0;
     console.log();
-    if (!r.ok) {
+    if (doctorHasIssues(r)) {
       console.log("issues found \u2717");
       process.exit(1);
     }
@@ -3057,9 +3374,150 @@ var doctorCommand = defineCommand9({
     }
   }
 });
+function executionSecurityDoctorLines(report) {
+  const configured = report.executionSecurity.configuredOperatorHttp;
+  const protectedTurns = report.executionSecurity.protectedUnattendedTurns;
+  const lines = ["configured operator HTTP (legacy \xB7 unprotected)"];
+  if (!report.shellSecurity.ok) {
+    lines.push(checkLine("valid shell-security configuration", false, report.shellSecurity.error));
+  } else {
+    if (report.shellSecurity.approvalMode === "dangerous") {
+      lines.push(
+        "  - dangerous-command approval enabled",
+        "    web and TTY CLI turns can allow once; non-interactive operator requests auto-deny"
+      );
+    } else {
+      lines.push(
+        "  - dangerous-command approval off",
+        "    set BAZILION_BASH_APPROVAL=dangerous to opt in"
+      );
+    }
+    if (report.shellSecurity.sandboxMode === "docker") {
+      lines.push(
+        `  - coding surface: Docker only (${report.shellSecurity.sandboxImage})`,
+        "    workspace-only writable mount \xB7 bounded inputs/skills/memory read-only \xB7 network disabled",
+        "    host coding tools hidden",
+        "    policy syntax is valid; Docker and image availability are checked on execution",
+        "    commands fail closed if either is unavailable"
+      );
+    } else {
+      lines.push(
+        "  - coding surface: host tools",
+        "    approval is a host-execution tripwire, not a filesystem sandbox",
+        "    set BAZILION_BASH_SANDBOX=docker to opt in"
+      );
+    }
+  }
+  lines.push(`  - browser: ${configured.browser}`, `  - MCP: ${configured.mcp}`, "");
+  lines.push(
+    "protected unattended turns baseline (Telegram, schedules, inbox, approvals)",
+    checkLine("protected base runtime ready", protectedTurns.baseRuntimeReady),
+    "  - coding surface: Docker only",
+    checkLine(
+      `Docker ready (${protectedTurns.docker.image})`,
+      protectedTurns.docker.ready,
+      protectedTurns.docker.reason ?? void 0
+    ),
+    checkLine("OpenAI Codex enabled", protectedTurns.openaiCodex.enabled),
+    checkLine("ChatGPT connected", protectedTurns.openaiCodex.connected),
+    `  - OpenAI access: ${openAIAccessStatus(protectedTurns.openaiCodex)}`,
+    checkLine("OpenAI Codex baseline eligible", protectedTurns.openaiCodex.baselineEligible),
+    `  \u2713 browser: ${protectedTurns.browser}`,
+    `  \u2713 MCP: ${protectedTurns.mcp}`,
+    "  - every turn separately validates its selected normal/review model, bound OAuth refresh, and mounts/paths"
+  );
+  if (protectedTurns.remediation) {
+    lines.push(`  remediation: ${protectedTurns.remediation}`);
+  }
+  return lines;
+}
+function doctorHasIssues(report) {
+  return !report.ok || !report.protectedWorkBaselineReady;
+}
+function openAIAccessStatus(status) {
+  if (status.accessCurrent) return "current";
+  if (status.refreshOnNextTurn) return "refresh on next turn";
+  return "unavailable";
+}
+function checkLine(label, condition, hint) {
+  const mark = condition ? "\u2713" : "\u2717";
+  const tail = !condition && hint ? ` \u2014 ${hint}` : "";
+  return `  ${mark} ${label}${tail}`;
+}
 
-// src/commands/inbox.ts
+// src/commands/gateway.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
 import { defineCommand as defineCommand10 } from "citty";
+var execFileAsync = promisify(execFile);
+function exactHttpsOrigin(raw) {
+  if (!raw) throw new Error("BAZILION_PUBLIC_ORIGIN is required");
+  const url = new URL(raw);
+  if (url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.origin !== raw.replace(/\/$/, "")) {
+    throw new Error("BAZILION_PUBLIC_ORIGIN must be an exact HTTPS origin");
+  }
+  return url;
+}
+function listenerIsLoopback(output, port) {
+  const suffix = `:${port}`;
+  const listeners = output.split("\n").filter((line) => line.trim()).filter((line) => line.split(/\s+/).some((field) => field.endsWith(suffix)));
+  return listeners.length > 0 && listeners.every((line) => /(?:127\.0\.0\.1|\[?::1\]?):\d+/.test(line));
+}
+function hasFunnel(value) {
+  if (Array.isArray(value)) return value.some(hasFunnel);
+  if (!value || typeof value !== "object") return false;
+  return Object.entries(value).some(
+    ([key, nested]) => /funnel/i.test(key) && nested !== false && nested !== null || hasFunnel(nested)
+  );
+}
+var preflightCmd = defineCommand10({
+  meta: { name: "preflight", description: "Read-only private Tailscale gateway safety check" },
+  async run() {
+    const publicOrigin = exactHttpsOrigin(process.env.BAZILION_PUBLIC_ORIGIN);
+    const daemonPort = Number(process.env.PORT ?? 4321);
+    const webPort = Number(process.env.WEB_PORT ?? 4322);
+    const { stdout: listeners } = await execFileAsync("ss", ["-ltnH"], { timeout: 5e3 });
+    if (!listenerIsLoopback(listeners, daemonPort)) {
+      throw new Error(`daemon port ${daemonPort} is not listening exclusively on loopback`);
+    }
+    if (!listenerIsLoopback(listeners, webPort)) {
+      throw new Error(`web port ${webPort} is not listening exclusively on loopback`);
+    }
+    let serveStatus;
+    try {
+      const { stdout: stdout2 } = await execFileAsync("tailscale", ["serve", "status", "--json"], {
+        timeout: 1e4,
+        maxBuffer: 1024 * 1024
+      });
+      serveStatus = JSON.parse(stdout2);
+    } catch {
+      throw new Error("could not obtain unambiguous `tailscale serve status --json` evidence");
+    }
+    if (hasFunnel(serveStatus))
+      throw new Error("Tailscale Funnel is enabled; private Serve is required");
+    const serialized = JSON.stringify(serveStatus);
+    if (!serialized.includes(`127.0.0.1:${webPort}`) && !serialized.includes(`localhost:${webPort}`)) {
+      throw new Error(`Tailscale Serve does not clearly target the loopback web port ${webPort}`);
+    }
+    const health = await createClient2().get("/api/health/details");
+    if (!health.protectedWorkBaselineReady) {
+      throw new Error("BAZ-027 protected-turn baseline is not ready");
+    }
+    console.log("private gateway preflight passed");
+    console.log(`public origin: ${publicOrigin.origin}`);
+    console.log(`daemon: loopback:${daemonPort}`);
+    console.log(`web: loopback:${webPort}`);
+    console.log("Tailscale: private Serve target present; Funnel absent");
+    console.log("hosted Agent turns: protected baseline ready");
+  }
+});
+var gatewayCommand = defineCommand10({
+  meta: { name: "gateway", description: "Inspect the private web gateway posture" },
+  subCommands: { preflight: preflightCmd }
+});
+
+// src/commands/inbox.ts
+import { defineCommand as defineCommand11 } from "citty";
 function decodeText(payload) {
   try {
     const obj = JSON.parse(payload);
@@ -3075,7 +3533,7 @@ function messageRow(m) {
   const preview = text2.length > 60 ? `${text2.slice(0, 60)}\u2026` : text2;
   return [m.id, state, when, `from:${m.fromAgentId.slice(0, 8)}`, `"${preview}"`];
 }
-var listCmd3 = defineCommand10({
+var listCmd3 = defineCommand11({
   meta: { name: "list", description: "List messages in an agent inbox" },
   args: {
     agent: { type: "positional", required: true, description: "Recipient agent id" },
@@ -3094,7 +3552,7 @@ var listCmd3 = defineCommand10({
     for (const line of columnize(messages.map(messageRow))) console.log(line);
   }
 });
-var showCmd2 = defineCommand10({
+var showCmd2 = defineCommand11({
   meta: { name: "show", description: "Show a single message in full" },
   args: {
     id: { type: "positional", required: true, description: "Message id" }
@@ -3114,7 +3572,7 @@ var showCmd2 = defineCommand10({
     console.log(decodeText(m.payload));
   }
 });
-var readCmd = defineCommand10({
+var readCmd = defineCommand11({
   meta: { name: "read", description: "Mark a message as read" },
   args: {
     id: { type: "positional", required: true, description: "Message id" }
@@ -3125,7 +3583,7 @@ var readCmd = defineCommand10({
     console.log(`marked read: ${args.id}`);
   }
 });
-var loopBreaksCmd = defineCommand10({
+var loopBreaksCmd = defineCommand11({
   meta: { name: "loop-breaks", description: "List stopped agent-message chains" },
   args: {
     agent: { type: "positional", required: true, description: "Agent id" },
@@ -3153,7 +3611,7 @@ var loopBreaksCmd = defineCommand10({
       console.log(line);
   }
 });
-var inboxCommand = defineCommand10({
+var inboxCommand = defineCommand11({
   meta: { name: "inbox", description: "Inspect agent inboxes" },
   subCommands: {
     list: listCmd3,
@@ -3164,8 +3622,8 @@ var inboxCommand = defineCommand10({
 });
 
 // src/commands/login.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
-import { defineCommand as defineCommand11 } from "citty";
+import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { defineCommand as defineCommand12 } from "citty";
 function normalizeServer(raw) {
   let url;
   try {
@@ -3179,13 +3637,17 @@ function normalizeServer(raw) {
   return `${url.origin}${url.pathname.replace(/\/$/, "")}`;
 }
 async function verifyToken(server, token) {
-  const res = await fetch(`${server}/api/health`, {
+  const res = await fetch(`${server}/api/auth/whoami`, {
     headers: { authorization: `Bearer ${token}`, origin: server }
   });
   if (res.status === 401) throw new Error("server rejected token (401)");
-  if (!res.ok) throw new Error(`server returned ${res.status} from /api/health`);
+  if (!res.ok) throw new Error(`server returned ${res.status} from /api/auth/whoami`);
+  const owner = await res.json();
+  if (owner.publicOrigin && owner.publicOrigin !== new URL(server).origin) {
+    throw new Error("server canonical private origin does not match --server");
+  }
 }
-var loginCommand = defineCommand11({
+var loginCommand = defineCommand12({
   meta: {
     name: "login",
     description: "Save a remote bazilion server + token pair to auth.json"
@@ -3193,7 +3655,7 @@ var loginCommand = defineCommand11({
   args: {
     server: { type: "string", description: "Remote server URL (http[s]://...)" },
     token: { type: "string", description: "Token issued by `bazilion token create`" },
-    skipVerify: { type: "boolean", description: "Don't probe /api/health before saving" },
+    skipVerify: { type: "boolean", description: "Don't verify /api/auth/whoami before saving" },
     clear: { type: "boolean", description: "Remove the stored remote instead of setting one" }
   },
   async run({ args }) {
@@ -3210,7 +3672,7 @@ var loginCommand = defineCommand11({
         return;
       }
       delete auth.remote;
-      writeFileSync2(paths.authFile, `${JSON.stringify(auth, null, 2)}
+      writeFileSync3(paths.authFile, `${JSON.stringify(auth, null, 2)}
 `, { mode: 384 });
       console.log("cleared stored remote; CLI will fall back to the local daemon");
       return;
@@ -3225,7 +3687,7 @@ var loginCommand = defineCommand11({
       await verifyToken(server, args.token);
     }
     auth.remote = { server, token: args.token };
-    writeFileSync2(paths.authFile, `${JSON.stringify(auth, null, 2)}
+    writeFileSync3(paths.authFile, `${JSON.stringify(auth, null, 2)}
 `, { mode: 384 });
     console.log(`saved remote: ${server}`);
     console.log("CLI will now target this server unless BAZILION_SERVER is set in the env.");
@@ -3233,7 +3695,7 @@ var loginCommand = defineCommand11({
 });
 
 // src/commands/mcp.ts
-import { defineCommand as defineCommand12 } from "citty";
+import { defineCommand as defineCommand13 } from "citty";
 function serverRow(s) {
   const where = s.transport === "stdio" ? `${s.command} ${s.args.join(" ")}`.trim() : s.url ?? "";
   return [
@@ -3245,7 +3707,7 @@ function serverRow(s) {
     where
   ];
 }
-var addCmd = defineCommand12({
+var addCmd = defineCommand13({
   meta: { name: "add", description: "Register an MCP server" },
   args: {
     name: { type: "positional", required: true, description: "Unique name ([a-zA-Z0-9_])" },
@@ -3272,7 +3734,7 @@ var addCmd = defineCommand12({
     console.log(`${server.id}	${server.name}	${server.transport}`);
   }
 });
-var listCmd4 = defineCommand12({
+var listCmd4 = defineCommand13({
   meta: { name: "list", description: "List MCP servers" },
   async run() {
     const client = createClient2();
@@ -3284,7 +3746,7 @@ var listCmd4 = defineCommand12({
     for (const line of columnize(servers.map(serverRow))) console.log(line);
   }
 });
-var showCmd3 = defineCommand12({
+var showCmd3 = defineCommand13({
   meta: { name: "show", description: "Show one MCP server" },
   args: { id: { type: "positional", required: true } },
   async run({ args }) {
@@ -3293,7 +3755,7 @@ var showCmd3 = defineCommand12({
     console.log(JSON.stringify(server, null, 2));
   }
 });
-var rmCmd2 = defineCommand12({
+var rmCmd2 = defineCommand13({
   meta: { name: "rm", description: "Delete an MCP server" },
   args: { id: { type: "positional", required: true } },
   async run({ args }) {
@@ -3302,7 +3764,7 @@ var rmCmd2 = defineCommand12({
     console.log(`removed MCP server ${args.id}`);
   }
 });
-var enableCmd = defineCommand12({
+var enableCmd = defineCommand13({
   meta: { name: "enable", description: "Enable an MCP server" },
   args: { id: { type: "positional", required: true } },
   async run({ args }) {
@@ -3311,7 +3773,7 @@ var enableCmd = defineCommand12({
     console.log(`enabled MCP server ${args.id}`);
   }
 });
-var disableCmd = defineCommand12({
+var disableCmd = defineCommand13({
   meta: { name: "disable", description: "Disable an MCP server" },
   args: { id: { type: "positional", required: true } },
   async run({ args }) {
@@ -3320,7 +3782,7 @@ var disableCmd = defineCommand12({
     console.log(`disabled MCP server ${args.id}`);
   }
 });
-var testCmd = defineCommand12({
+var testCmd = defineCommand13({
   meta: { name: "test", description: "Connect to a server and list its tools" },
   args: { id: { type: "positional", required: true } },
   async run({ args }) {
@@ -3338,7 +3800,7 @@ var testCmd = defineCommand12({
     for (const t of tools) console.log(`  ${t.name}	${t.description}`);
   }
 });
-var mcpCommand = defineCommand12({
+var mcpCommand = defineCommand13({
   meta: { name: "mcp", description: "Manage MCP servers" },
   subCommands: {
     add: addCmd,
@@ -3352,11 +3814,11 @@ var mcpCommand = defineCommand12({
 });
 
 // src/commands/memory.ts
-import { defineCommand as defineCommand13 } from "citty";
+import { defineCommand as defineCommand14 } from "citty";
 function encodeKey(key) {
   return key.split("/").map(encodeURIComponent).join("/");
 }
-var writeCmd = defineCommand13({
+var writeCmd = defineCommand14({
   meta: { name: "write", description: "Write an entry into a team's shared memory" },
   args: {
     team: { type: "positional", required: true, description: "Team slug" },
@@ -3372,7 +3834,7 @@ var writeCmd = defineCommand13({
     console.log(`wrote ${entry2.key} (${entry2.content.length} bytes)`);
   }
 });
-var readCmd2 = defineCommand13({
+var readCmd2 = defineCommand14({
   meta: { name: "read", description: "Read an entry from a team's shared memory" },
   args: {
     team: { type: "positional", required: true, description: "Team slug" },
@@ -3386,7 +3848,7 @@ var readCmd2 = defineCommand13({
     console.log(entry2.content);
   }
 });
-var searchCmd = defineCommand13({
+var searchCmd = defineCommand14({
   meta: { name: "search", description: "Search a team's shared memory" },
   args: {
     team: { type: "positional", required: true, description: "Team slug" },
@@ -3407,7 +3869,7 @@ var searchCmd = defineCommand13({
     }
   }
 });
-var listCmd5 = defineCommand13({
+var listCmd5 = defineCommand14({
   meta: { name: "list", description: "List all entries in a team's shared memory" },
   args: {
     team: { type: "positional", required: true, description: "Team slug" }
@@ -3424,7 +3886,7 @@ var listCmd5 = defineCommand13({
     }
   }
 });
-var rmCmd3 = defineCommand13({
+var rmCmd3 = defineCommand14({
   meta: { name: "rm", description: "Remove an entry from a team's shared memory" },
   args: {
     team: { type: "positional", required: true, description: "Team slug" },
@@ -3436,7 +3898,7 @@ var rmCmd3 = defineCommand13({
     console.log(`removed ${args.key}`);
   }
 });
-var memoryCommand = defineCommand13({
+var memoryCommand = defineCommand14({
   meta: {
     name: "memory",
     description: "Manage a team's shared memory (BM25-indexed markdown notes)"
@@ -3452,8 +3914,8 @@ var memoryCommand = defineCommand13({
 
 // src/commands/profile.ts
 import { spawn as spawn2 } from "child_process";
-import { randomBytes } from "crypto";
-import { readFileSync as readFileSync6, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
+import { randomBytes as randomBytes2 } from "crypto";
+import { readFileSync as readFileSync6, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 import { join as join4 } from "path";
 
@@ -3468,7 +3930,7 @@ var PROFILE_FILES = [
 ];
 
 // src/commands/profile.ts
-import { defineCommand as defineCommand14 } from "citty";
+import { defineCommand as defineCommand15 } from "citty";
 function splitCsv(v) {
   if (!v) return void 0;
   const out = v.split(",").map((s) => s.trim()).filter(Boolean);
@@ -3479,7 +3941,7 @@ function parseSkillsMode(v) {
   if (v === "all" || v === "selected") return v;
   throw new Error(`--skills-mode must be 'all' or 'selected', got '${v}'`);
 }
-var createCmd2 = defineCommand14({
+var createCmd2 = defineCommand15({
   meta: { name: "create", description: "Create a new profile" },
   args: {
     id: { type: "positional", required: true, description: "Profile slug" },
@@ -3542,7 +4004,7 @@ var createCmd2 = defineCommand14({
     console.log(`created profile ${profile.id} at ${profile.dir}`);
   }
 });
-var listCmd6 = defineCommand14({
+var listCmd6 = defineCommand15({
   meta: { name: "list", description: "List profiles" },
   async run() {
     const client = createClient2();
@@ -3555,7 +4017,7 @@ var listCmd6 = defineCommand14({
     for (const line of columnize(rows)) console.log(line);
   }
 });
-var showCmd4 = defineCommand14({
+var showCmd4 = defineCommand15({
   meta: { name: "show", description: "Show profile details" },
   args: {
     id: { type: "positional", required: true }
@@ -3580,7 +4042,7 @@ var showCmd4 = defineCommand14({
     }
   }
 });
-var editCmd2 = defineCommand14({
+var editCmd2 = defineCommand15({
   meta: { name: "edit", description: "Open a profile file in $EDITOR" },
   args: {
     id: { type: "positional", required: true },
@@ -3599,8 +4061,8 @@ var editCmd2 = defineCommand14({
     const { content } = await client.get(
       `/api/profiles/${args.id}/files/${file}`
     );
-    const tmpPath = join4(tmpdir2(), `bazilion-${args.id}-${file}-${randomBytes(4).toString("hex")}`);
-    writeFileSync3(tmpPath, content);
+    const tmpPath = join4(tmpdir2(), `bazilion-${args.id}-${file}-${randomBytes2(4).toString("hex")}`);
+    writeFileSync4(tmpPath, content);
     try {
       const editor = process.env.EDITOR ?? process.env.VISUAL ?? "vi";
       const code = await new Promise((resolve4, reject) => {
@@ -3625,7 +4087,7 @@ var editCmd2 = defineCommand14({
     }
   }
 });
-var updateCmd = defineCommand14({
+var updateCmd = defineCommand15({
   meta: {
     name: "update",
     description: "Update profile settings (name, model, skills-mode, skills)"
@@ -3659,7 +4121,7 @@ var updateCmd = defineCommand14({
     console.log(`updated profile ${profile.id}`);
   }
 });
-var deleteCmd2 = defineCommand14({
+var deleteCmd2 = defineCommand15({
   meta: { name: "delete", description: "Permanently delete a profile and its files" },
   args: {
     id: { type: "positional", required: true }
@@ -3670,7 +4132,7 @@ var deleteCmd2 = defineCommand14({
     console.log(`deleted profile ${args.id}`);
   }
 });
-var profileCommand = defineCommand14({
+var profileCommand = defineCommand15({
   meta: { name: "profile", description: "Manage profiles" },
   subCommands: {
     create: createCmd2,
@@ -3683,8 +4145,8 @@ var profileCommand = defineCommand14({
 });
 
 // src/commands/provider.ts
-import { defineCommand as defineCommand15 } from "citty";
-var listCmd7 = defineCommand15({
+import { defineCommand as defineCommand16 } from "citty";
+var listCmd7 = defineCommand16({
   meta: {
     name: "list",
     description: "List all providers with enabled/disabled state and curated model counts"
@@ -3710,7 +4172,7 @@ var listCmd7 = defineCommand15({
     for (const line of columnize(rows)) console.log(line);
   }
 });
-var modelsCmd = defineCommand15({
+var modelsCmd = defineCommand16({
   meta: {
     name: "models",
     description: "Show curated + catalog + live models for one provider"
@@ -3742,7 +4204,7 @@ var modelsCmd = defineCommand15({
     }
   }
 });
-var modelsSetCmd = defineCommand15({
+var modelsSetCmd = defineCommand16({
   meta: {
     name: "models-set",
     description: "Replace the curated model list for a provider (comma-separated)"
@@ -3767,7 +4229,7 @@ var modelsSetCmd = defineCommand15({
     for (const m of saved.models) console.log(`  ${m}`);
   }
 });
-var enableCmd2 = defineCommand15({
+var enableCmd2 = defineCommand16({
   meta: { name: "enable", description: "Toggle a provider on so agents can use it" },
   args: {
     name: { type: "positional", required: true, description: "Provider id (e.g. anthropic)" }
@@ -3781,7 +4243,7 @@ var enableCmd2 = defineCommand15({
     console.log(`${res.name}: enabled`);
   }
 });
-var disableCmd2 = defineCommand15({
+var disableCmd2 = defineCommand16({
   meta: {
     name: "disable",
     description: "Toggle a provider off \u2014 agents will refuse its model strings"
@@ -3798,7 +4260,7 @@ var disableCmd2 = defineCommand15({
     console.log(`${res.name}: disabled`);
   }
 });
-var testCmd2 = defineCommand15({
+var testCmd2 = defineCommand16({
   meta: { name: "test", description: "Send a single chat to a model and print the reply" },
   args: {
     model: {
@@ -3819,7 +4281,7 @@ var testCmd2 = defineCommand15({
     }
   }
 });
-var providerCommand = defineCommand15({
+var providerCommand = defineCommand16({
   meta: { name: "provider", description: "Manage and test LLM providers" },
   subCommands: {
     list: listCmd7,
@@ -3832,8 +4294,8 @@ var providerCommand = defineCommand15({
 });
 
 // src/commands/send.ts
-import { defineCommand as defineCommand16 } from "citty";
-var sendCommand = defineCommand16({
+import { defineCommand as defineCommand17 } from "citty";
+var sendCommand = defineCommand17({
   meta: {
     name: "send",
     description: "Send a message from one agent to another"
@@ -3867,11 +4329,11 @@ var sendCommand = defineCommand16({
 import { spawn as spawn3 } from "child_process";
 import { existsSync as existsSync5 } from "fs";
 import { join as join5 } from "path";
-import { defineCommand as defineCommand17 } from "citty";
+import { defineCommand as defineCommand18 } from "citty";
 var bundledDaemonEntry2 = join5(import.meta.dirname, "daemon.js");
 var sourceDaemonEntry2 = join5(import.meta.dirname, "..", "..", "..", "daemon", "src", "index.ts");
 var daemonEntry2 = existsSync5(bundledDaemonEntry2) ? bundledDaemonEntry2 : sourceDaemonEntry2;
-var serveCommand = defineCommand17({
+var serveCommand = defineCommand18({
   meta: {
     name: "serve",
     description: "Start the bazilion daemon (HTTP API)"
@@ -3937,17 +4399,54 @@ var serveCommand = defineCommand17({
   }
 });
 
+// src/commands/session.ts
+import { defineCommand as defineCommand19 } from "citty";
+function row(session) {
+  const state = session.revokedAt ? "revoked" : session.absoluteExpiresAt <= Date.now() || session.idleExpiresAt <= Date.now() ? "expired" : "active";
+  return [
+    session.id,
+    state,
+    session.current ? "current" : "",
+    session.deviceLabel,
+    `idle: ${new Date(session.idleExpiresAt).toISOString()}`,
+    `absolute: ${new Date(session.absoluteExpiresAt).toISOString()}`
+  ];
+}
+var listCmd8 = defineCommand19({
+  meta: { name: "list", description: "List browser sessions" },
+  async run() {
+    const { sessions } = await createClient2().get("/api/sessions");
+    if (sessions.length === 0) {
+      console.log("(no active browser sessions)");
+      return;
+    }
+    for (const line of columnize(sessions.map(row))) console.log(line);
+  }
+});
+var revokeCmd = defineCommand19({
+  meta: { name: "revoke", description: "Revoke one browser session" },
+  args: { id: { type: "positional", required: true } },
+  async run({ args }) {
+    await createClient2().del(`/api/sessions/${encodeURIComponent(args.id)}`);
+    console.log(`revoked browser session ${args.id}`);
+  }
+});
+var sessionCommand = defineCommand19({
+  meta: { name: "session", description: "Manage browser sessions" },
+  subCommands: { list: listCmd8, revoke: revokeCmd }
+});
+
 // src/commands/skill.ts
 import { existsSync as existsSync6, readFileSync as readFileSync7, statSync } from "fs";
 import { basename as basename4, resolve as resolve3 } from "path";
-import { defineCommand as defineCommand18 } from "citty";
+import { defineCommand as defineCommand20 } from "citty";
 function printFindings(findings, prefix = "  ") {
   for (const f of findings) {
     const line = f.line ? ` line ${f.line}` : "";
     console.log(`${prefix}${f.severity}: ${f.code}${line} - ${f.message}`);
   }
 }
-var listCmd8 = defineCommand18({
+var listCmd9 = defineCommand20({
   meta: { name: "list", description: "List installed skills (or those attached to an agent)" },
   args: {
     agent: { type: "string", description: "Filter to skills attached to this agent" }
@@ -3988,7 +4487,7 @@ var listCmd8 = defineCommand18({
     }
   }
 });
-var importCmd = defineCommand18({
+var importCmd = defineCommand20({
   meta: {
     name: "import",
     description: "Import skills from openclaw, a directory, or a local .zip archive"
@@ -4057,7 +4556,7 @@ var importCmd = defineCommand18({
     }
   }
 });
-var rmCmd4 = defineCommand18({
+var rmCmd4 = defineCommand20({
   meta: { name: "rm", description: "Remove an installed skill" },
   args: {
     name: { type: "positional", required: true }
@@ -4068,10 +4567,10 @@ var rmCmd4 = defineCommand18({
     console.log(`removed skill ${args.name}`);
   }
 });
-var skillCommand = defineCommand18({
+var skillCommand = defineCommand20({
   meta: { name: "skill", description: "Manage the skill library" },
   subCommands: {
-    list: listCmd8,
+    list: listCmd9,
     import: importCmd,
     rm: rmCmd4
   }
@@ -4080,11 +4579,11 @@ var skillCommand = defineCommand18({
 // src/commands/team.ts
 import { readFileSync as readFileSync9 } from "fs";
 import { stdin as stdin2 } from "process";
-import { defineCommand as defineCommand20 } from "citty";
+import { defineCommand as defineCommand22 } from "citty";
 
 // src/commands/team-policy.ts
 import { readFileSync as readFileSync8 } from "fs";
-import { defineCommand as defineCommand19 } from "citty";
+import { defineCommand as defineCommand21 } from "citty";
 
 // src/team-interchange.ts
 var TEAM_POLICY_INTERCHANGE_VERSION = 1;
@@ -4332,7 +4831,7 @@ function printPolicy(detail) {
       console.log(line);
   }
 }
-var show2 = defineCommand19({
+var show2 = defineCommand21({
   meta: { name: "show", description: "Show the one effective live policy for a Team" },
   args: {
     team: { type: "positional", required: true },
@@ -4346,7 +4845,7 @@ var show2 = defineCommand19({
     else printPolicy(detail);
   }
 });
-var exportCommand = defineCommand19({
+var exportCommand = defineCommand21({
   meta: { name: "export", description: "Export a revisioned Team policy document" },
   args: { team: { type: "positional", required: true } },
   async run({ args }) {
@@ -4370,7 +4869,7 @@ function printEdgeDiff(current, edges) {
   for (const value of diff2.added) console.log(`  + ${value}`);
   for (const value of diff2.removed) console.log(`  - ${value}`);
 }
-var importCommand = defineCommand19({
+var importCommand = defineCommand21({
   meta: {
     name: "import",
     description: "Validate, diff, and explicitly replace a Team policy"
@@ -4425,7 +4924,7 @@ var importCommand = defineCommand19({
     console.log(`updated Team ${args.team} policy to revision ${updated.teamPolicy.revision}`);
   }
 });
-var diff = defineCommand19({
+var diff = defineCommand21({
   meta: { name: "diff", description: "Compare live policy with its retained baseline source" },
   args: {
     team: { type: "positional", required: true },
@@ -4449,7 +4948,7 @@ var diff = defineCommand19({
     );
   }
 });
-var evaluate = defineCommand19({
+var evaluate = defineCommand21({
   meta: {
     name: "evaluate",
     description: "Evaluate a communication path without sending or recording a block"
@@ -4480,7 +4979,7 @@ var evaluate = defineCommand19({
     );
   }
 });
-var blocks = defineCommand19({
+var blocks = defineCommand21({
   meta: { name: "blocks", description: "List paginated durable communication denials" },
   args: {
     team: { type: "positional", required: true },
@@ -4529,7 +5028,7 @@ var blocks = defineCommand19({
     if (page.nextCursor) console.log(`next cursor: ${page.nextCursor}`);
   }
 });
-var teamPolicyCommand = defineCommand19({
+var teamPolicyCommand = defineCommand21({
   meta: { name: "policy", description: "Inspect and manage the Team-owned live policy" },
   subCommands: {
     show: show2,
@@ -4542,7 +5041,7 @@ var teamPolicyCommand = defineCommand19({
 });
 
 // src/commands/team.ts
-var addCmd2 = defineCommand20({
+var addCmd2 = defineCommand22({
   meta: {
     name: "add",
     description: "Register a team at ~/.bazilion/teams/<slug>/ (use --link to point at an existing tree)"
@@ -4566,7 +5065,7 @@ var addCmd2 = defineCommand20({
     console.log(`registered team ${g.id} at ${g.path}`);
   }
 });
-var listCmd9 = defineCommand20({
+var listCmd10 = defineCommand22({
   meta: { name: "list", description: "List teams" },
   async run() {
     const client = createClient2();
@@ -4579,7 +5078,7 @@ var listCmd9 = defineCommand20({
     for (const line of columnize(rows)) console.log(line);
   }
 });
-var rmCmd5 = defineCommand20({
+var rmCmd5 = defineCommand22({
   meta: { name: "rm", description: "Remove a team registration" },
   args: {
     id: { type: "positional", required: true }
@@ -4600,7 +5099,7 @@ async function readStdin() {
   for await (const chunk of stdin2) chunks.push(chunk);
   return Buffer.concat(chunks).toString("utf8");
 }
-var userMdShowCmd = defineCommand20({
+var userMdShowCmd = defineCommand22({
   meta: { name: "show", description: "Print the team's USER.md" },
   args: { id: { type: "positional", required: true } },
   async run({ args }) {
@@ -4610,7 +5109,7 @@ var userMdShowCmd = defineCommand20({
     if (g.userMd && !g.userMd.endsWith("\n")) process.stdout.write("\n");
   }
 });
-var userMdSetCmd = defineCommand20({
+var userMdSetCmd = defineCommand22({
   meta: {
     name: "set",
     description: "Replace the team's USER.md (from --file, --from-stdin, or inline text)"
@@ -4636,7 +5135,7 @@ var userMdSetCmd = defineCommand20({
     console.log(`updated USER.md for team ${args.id} (${content.length} bytes)`);
   }
 });
-var userMdClearCmd = defineCommand20({
+var userMdClearCmd = defineCommand22({
   meta: { name: "clear", description: "Clear the team's USER.md to empty" },
   args: { id: { type: "positional", required: true } },
   async run({ args }) {
@@ -4646,7 +5145,7 @@ var userMdClearCmd = defineCommand20({
     console.log(`cleared USER.md for team ${args.id}`);
   }
 });
-var userMdCmd = defineCommand20({
+var userMdCmd = defineCommand22({
   meta: { name: "user-md", description: "View or edit a team's USER.md" },
   subCommands: {
     show: userMdShowCmd,
@@ -4654,7 +5153,7 @@ var userMdCmd = defineCommand20({
     clear: userMdClearCmd
   }
 });
-var topicFormatShowCmd = defineCommand20({
+var topicFormatShowCmd = defineCommand22({
   meta: { name: "show", description: "Print the team's Telegram topic-name template" },
   args: { id: { type: "positional", required: true } },
   async run({ args }) {
@@ -4663,7 +5162,7 @@ var topicFormatShowCmd = defineCommand20({
     console.log(g.telegramTopicNameFormat ?? "(default naming)");
   }
 });
-var topicFormatSetCmd = defineCommand20({
+var topicFormatSetCmd = defineCommand22({
   meta: {
     name: "set",
     description: "Set the topic-name template. Tokens: {agent.name} {team.name} {team.slug} (must include {agent.name})"
@@ -4683,7 +5182,7 @@ var topicFormatSetCmd = defineCommand20({
     console.log(`set topic-name template for team ${args.id}: ${g.telegramTopicNameFormat}`);
   }
 });
-var topicFormatClearCmd = defineCommand20({
+var topicFormatClearCmd = defineCommand22({
   meta: { name: "clear", description: "Clear the template (revert to built-in naming)" },
   args: { id: { type: "positional", required: true } },
   async run({ args }) {
@@ -4693,7 +5192,7 @@ var topicFormatClearCmd = defineCommand20({
     console.log(`cleared topic-name template for team ${args.id}`);
   }
 });
-var topicFormatCmd = defineCommand20({
+var topicFormatCmd = defineCommand22({
   meta: {
     name: "topic-format",
     description: "View or edit a team's Telegram forum-topic name template"
@@ -4704,11 +5203,11 @@ var topicFormatCmd = defineCommand20({
     clear: topicFormatClearCmd
   }
 });
-var teamCommand = defineCommand20({
+var teamCommand = defineCommand22({
   meta: { name: "team", description: "Manage teams (collaboration contexts)" },
   subCommands: {
     add: addCmd2,
-    list: listCmd9,
+    list: listCmd10,
     rm: rmCmd5,
     "user-md": userMdCmd,
     "topic-format": topicFormatCmd,
@@ -4718,7 +5217,7 @@ var teamCommand = defineCommand20({
 
 // src/commands/team-template.ts
 import { readFileSync as readFileSync10 } from "fs";
-import { defineCommand as defineCommand21 } from "citty";
+import { defineCommand as defineCommand23 } from "citty";
 function jsonFile(path) {
   try {
     return JSON.parse(readFileSync10(path, "utf8"));
@@ -4746,7 +5245,7 @@ function printTeam(detail) {
       console.log(line);
   }
 }
-var list4 = defineCommand21({
+var list4 = defineCommand23({
   meta: { name: "list", description: "List canonical Team templates" },
   args: { json: { type: "boolean", description: "Emit stable JSON" } },
   async run({ args }) {
@@ -4755,12 +5254,12 @@ var list4 = defineCommand21({
     if (!rows.length) return console.log("(no Team templates)");
     for (const line of columnize([
       ["id", "revision", "slots", "name"],
-      ...rows.map((row) => [row.id, String(row.currentRevision), String(row.slotCount), row.name])
+      ...rows.map((row2) => [row2.id, String(row2.currentRevision), String(row2.slotCount), row2.name])
     ]))
       console.log(line);
   }
 });
-var show3 = defineCommand21({
+var show3 = defineCommand23({
   meta: { name: "show", description: "Show a canonical Team template" },
   args: {
     id: { type: "positional", required: true },
@@ -4774,7 +5273,7 @@ var show3 = defineCommand21({
     else printTeam(detail);
   }
 });
-var exportCommand2 = defineCommand21({
+var exportCommand2 = defineCommand23({
   meta: {
     name: "export",
     description: "Export a portable versioned Team-template document to stdout"
@@ -4814,7 +5313,7 @@ function printImportDiff(current, document) {
   for (const value of diff2.added) console.log(`  + ${value}`);
   for (const value of diff2.removed) console.log(`  - ${value}`);
 }
-var importCommand2 = defineCommand21({
+var importCommand2 = defineCommand23({
   meta: {
     name: "import",
     description: "Validate, diff, and explicitly apply a portable Team-template document"
@@ -4895,7 +5394,7 @@ var importCommand2 = defineCommand21({
     );
   }
 });
-var teamTemplateCommand = defineCommand21({
+var teamTemplateCommand = defineCommand23({
   meta: {
     name: "team-template",
     description: "Inspect and exchange canonical Team templates"
@@ -4904,8 +5403,8 @@ var teamTemplateCommand = defineCommand21({
 });
 
 // src/commands/telegram.ts
-import { defineCommand as defineCommand22 } from "citty";
-var setCmd2 = defineCommand22({
+import { defineCommand as defineCommand24 } from "citty";
+var setCmd2 = defineCommand24({
   meta: {
     name: "set",
     description: "Save bot token + supergroup chat ID (paired write)"
@@ -4923,7 +5422,7 @@ var setCmd2 = defineCommand22({
     console.log(`saved \xB7 token ${state.botTokenPreview} \xB7 chat ${state.chatId}`);
   }
 });
-var clearCmd = defineCommand22({
+var clearCmd = defineCommand24({
   meta: {
     name: "clear",
     description: "Remove stored bot token + chat ID"
@@ -4934,7 +5433,7 @@ var clearCmd = defineCommand22({
     console.log("cleared");
   }
 });
-var showCmd5 = defineCommand22({
+var showCmd5 = defineCommand24({
   meta: {
     name: "show",
     description: "Show what credentials are stored (token is masked)"
@@ -4955,7 +5454,7 @@ var showCmd5 = defineCommand22({
     }
   }
 });
-var reconnectCmd = defineCommand22({
+var reconnectCmd = defineCommand24({
   meta: {
     name: "reconnect",
     description: "Apply a pending supergroup chat-id migration + re-activate the bot"
@@ -4966,7 +5465,7 @@ var reconnectCmd = defineCommand22({
     console.log(`reconnected \xB7 chat ${state.chatId}`);
   }
 });
-var configCmd = defineCommand22({
+var configCmd = defineCommand24({
   meta: {
     name: "config",
     description: "Manage Telegram credentials (bot token + chat ID)"
@@ -4977,7 +5476,7 @@ var configCmd = defineCommand22({
     show: showCmd5
   }
 });
-var healthCmd = defineCommand22({
+var healthCmd = defineCommand24({
   meta: {
     name: "health",
     description: "Run the four-step preflight against the Telegram Bot API"
@@ -5007,11 +5506,16 @@ var healthCmd = defineCommand22({
     console.log(line(p.isForum, "forum topics enabled", String(p.isForum)));
     console.log(line(p.hasManageTopics, "can_manage_topics", String(p.hasManageTopics)));
     console.log(line(p.privacyModeOff, "Privacy Mode is OFF", String(p.privacyModeOff)));
-    const allOk = p.botUsername.length > 0 && p.chatTitle.length > 0 && p.isForum && p.hasManageTopics && p.privacyModeOff;
+    console.log(line(p.chatIsPrivate, "supergroup is private", String(p.chatIsPrivate)));
+    console.log(line(p.memberCount === 2, "one owner + bot", String(p.memberCount ?? "unknown")));
+    if (p.ownerPresent !== null) {
+      console.log(line(p.ownerPresent, "paired owner is present", String(p.ownerPresent)));
+    }
+    const allOk = p.botUsername.length > 0 && p.chatTitle.length > 0 && p.isForum && p.hasManageTopics && p.privacyModeOff && p.chatIsPrivate && p.memberCount === 2 && p.ownerPresent !== false;
     if (!allOk) process.exitCode = 1;
   }
 });
-var botStatusCmd = defineCommand22({
+var botStatusCmd = defineCommand24({
   meta: {
     name: "status",
     description: "Show polling state of the live bot"
@@ -5036,7 +5540,7 @@ var botStatusCmd = defineCommand22({
     if (!p.running) process.exitCode = 1;
   }
 });
-var botRestartCmd = defineCommand22({
+var botRestartCmd = defineCommand24({
   meta: {
     name: "restart",
     description: "Force-restart the bot (tears down + brings up from current creds)"
@@ -5047,7 +5551,7 @@ var botRestartCmd = defineCommand22({
     console.log("restart requested");
   }
 });
-var botCmd = defineCommand22({
+var botCmd = defineCommand24({
   meta: {
     name: "bot",
     description: "Inspect / control the live polling bot"
@@ -5057,7 +5561,7 @@ var botCmd = defineCommand22({
     restart: botRestartCmd
   }
 });
-var bindCmd = defineCommand22({
+var bindCmd = defineCommand24({
   meta: {
     name: "bind",
     description: "Create a Telegram topic for an agent (manual fallback for /talk)"
@@ -5075,7 +5579,7 @@ var bindCmd = defineCommand22({
     console.log(`  ${result.deepLink}`);
   }
 });
-var unbindCmd = defineCommand22({
+var unbindCmd = defineCommand24({
   meta: {
     name: "unbind",
     description: "Clear an agent's Telegram topic binding (topic stays in Telegram as orphan)"
@@ -5089,7 +5593,7 @@ var unbindCmd = defineCommand22({
     console.log(`unbound agent ${args.agent}`);
   }
 });
-var listBindingsCmd = defineCommand22({
+var listBindingsCmd = defineCommand24({
   meta: {
     name: "list",
     description: "List agents and their Telegram topic bindings"
@@ -5117,24 +5621,23 @@ var listBindingsCmd = defineCommand22({
     }
   }
 });
-var allowCmd = defineCommand22({
+var allowCmd = defineCommand24({
   meta: { name: "allow", description: "Add a Telegram user id to the allowlist" },
   args: {
     userId: { type: "positional", required: true, description: "Numeric Telegram user id" },
-    label: { type: "string", description: "Optional human label" },
-    owner: { type: "boolean", description: "Grant owner role (can manage the allowlist)" }
+    label: { type: "string", description: "Optional human label" }
   },
   async run({ args }) {
     const client = createClient2();
     const u = await client.post("/api/config/telegram/acl", {
       userId: Number(args.userId),
       label: args.label ?? null,
-      role: args.owner ? "owner" : "member"
+      role: "member"
     });
     console.log(`allowed ${u.userId} (${u.role})`);
   }
 });
-var denyCmd = defineCommand22({
+var denyCmd = defineCommand24({
   meta: { name: "deny", description: "Remove a Telegram user id from the allowlist" },
   args: { userId: { type: "positional", required: true } },
   async run({ args }) {
@@ -5143,13 +5646,13 @@ var denyCmd = defineCommand22({
     console.log(`removed ${args.userId}`);
   }
 });
-var allowedCmd = defineCommand22({
+var allowedCmd = defineCommand24({
   meta: { name: "allowed", description: "List allowlisted Telegram users" },
   async run() {
     const client = createClient2();
     const users = await client.get("/api/config/telegram/acl");
     if (users.length === 0) {
-      console.log("(allowlist empty \u2014 open; first user to message becomes owner)");
+      console.log("(allowlist empty \u2014 unpaired and closed)");
       return;
     }
     for (const u of users) {
@@ -5158,7 +5661,56 @@ var allowedCmd = defineCommand22({
     }
   }
 });
-var telegramCommand = defineCommand22({
+var pairingCreateCmd = defineCommand24({
+  meta: { name: "create", description: "Generate a one-time Telegram owner pairing code" },
+  async run() {
+    const result = await createClient2().post(
+      "/api/config/telegram/pairing/challenge"
+    );
+    console.log(`pairing code: ${result.code}`);
+    console.log(`expires: ${new Date(result.expiresAt).toISOString()}`);
+    console.log("send `/pair <code>` in the configured \u2699 bazilion service topic");
+  }
+});
+var pairingStatusCmd = defineCommand24({
+  meta: { name: "status", description: "Show Telegram owner pairing status" },
+  async run() {
+    const result = await createClient2().get("/api/config/telegram/pairing");
+    console.log(`paired: ${result.paired}`);
+    console.log(`owner: ${result.ownerUserId ?? "(none)"}`);
+    console.log(`challenge active: ${result.challengeActive}`);
+    if (result.challengeExpiresAt)
+      console.log(`expires: ${new Date(result.challengeExpiresAt).toISOString()}`);
+  }
+});
+var pairingCancelCmd = defineCommand24({
+  meta: { name: "cancel", description: "Cancel the active Telegram pairing code" },
+  async run() {
+    await createClient2().del("/api/config/telegram/pairing/challenge");
+    console.log("pairing challenge cancelled");
+  }
+});
+var pairingResetCmd = defineCommand24({
+  meta: { name: "reset", description: "Revoke the Telegram owner and require re-pairing" },
+  args: {
+    yes: { type: "boolean", description: "Confirm destructive owner reset", required: true }
+  },
+  async run({ args }) {
+    if (!args.yes) throw new Error("--yes is required");
+    await createClient2().post("/api/config/telegram/pairing/reset", { confirm: true });
+    console.log("Telegram owner reset; ingress is closed until re-paired");
+  }
+});
+var pairingCmd = defineCommand24({
+  meta: { name: "pairing", description: "Manage single-owner Telegram pairing" },
+  subCommands: {
+    create: pairingCreateCmd,
+    status: pairingStatusCmd,
+    cancel: pairingCancelCmd,
+    reset: pairingResetCmd
+  }
+});
+var telegramCommand = defineCommand24({
   meta: {
     name: "telegram",
     description: "Telegram integration: credentials, health, bot lifecycle, bindings, access"
@@ -5173,47 +5725,42 @@ var telegramCommand = defineCommand22({
     list: listBindingsCmd,
     allow: allowCmd,
     deny: denyCmd,
-    allowed: allowedCmd
+    allowed: allowedCmd,
+    pairing: pairingCmd
   }
 });
 
 // src/commands/token.ts
-import { networkInterfaces } from "os";
-import { defineCommand as defineCommand23 } from "citty";
+import { defineCommand as defineCommand25 } from "citty";
 import qrcode from "qrcode-terminal";
 function tokenRow(t) {
   const last = t.lastUsedAt ? new Date(t.lastUsedAt).toISOString() : "(never)";
-  const state = t.revokedAt ? "revoked" : "active";
-  return [t.id, state, t.label, `last: ${last}`];
-}
-function detectLanOrigin(port) {
-  const candidates = [];
-  for (const ifs of Object.values(networkInterfaces())) {
-    for (const i of ifs ?? []) {
-      if (i.family === "IPv4" && !i.internal) candidates.push(i.address);
-    }
-  }
-  const [first, ...rest] = candidates;
-  if (!first) return null;
-  const origin = `http://${first}:${port}`;
-  return rest.length > 0 ? { origin, warning: `multiple LAN IPs found (${candidates.join(", ")}) \u2014 using ${first}` } : { origin };
+  const expired = t.expiresAt !== null && t.expiresAt <= Date.now();
+  const state = t.revokedAt ? "revoked" : expired ? "expired" : "active";
+  const expires = t.expiresAt ? new Date(t.expiresAt).toISOString() : "(never)";
+  return [t.id, t.kind, state, t.label, `expires: ${expires}`, `last: ${last}`];
 }
 function resolveQrServer(override) {
-  if (override) return override.replace(/\/$/, "");
+  const raw = override ?? loadClientConfig().serverUrl;
+  const url = new URL(raw);
+  const loopback = ["127.0.0.1", "localhost", "[::1]", "::1"].includes(url.hostname);
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    throw new Error("pairing server must use HTTPS (HTTP is allowed only for loopback development)");
+  }
+  if (url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    throw new Error(
+      "pairing server must be an exact origin without credentials, path, query, or fragment"
+    );
+  }
   const cfg = loadClientConfig();
-  const current = new URL(cfg.serverUrl);
-  const isLoopback = current.hostname === "127.0.0.1" || current.hostname === "localhost" || current.hostname === "::1";
-  if (!isLoopback) return cfg.serverUrl.replace(/\/$/, "");
-  const detected = detectLanOrigin(current.port || "4321");
-  if (!detected) {
+  if (loopback && !override && new URL(cfg.serverUrl).hostname === url.hostname) {
     throw new Error(
-      "server URL is loopback-only and no LAN interface was found. Pass --server http://<host>:<port> so the mobile client knows where to connect."
+      "server URL is loopback-only. Pass --server https://<private-tailnet-host> for mobile pairing."
     );
   }
-  if (detected.warning) console.warn(`\u26A0 ${detected.warning}`);
-  return detected.origin;
+  return url.origin;
 }
-var createCmd3 = defineCommand23({
+var createCmd3 = defineCommand25({
   meta: { name: "create", description: "Mint a new web token (shown once)" },
   args: {
     label: { type: "positional", required: true, description: "Human-readable label" },
@@ -5224,14 +5771,26 @@ var createCmd3 = defineCommand23({
     server: {
       type: "string",
       description: "Server URL to embed in the pairing QR (default: detect LAN IP; ignored without --qr)"
+    },
+    expiresDays: {
+      type: "string",
+      description: "Device lifetime in days (default 90, maximum 365)"
     }
   },
   async run({ args }) {
     const client = createClient2();
-    const body = { label: args.label };
+    const expiresInDays = args.expiresDays === void 0 ? void 0 : Number(args.expiresDays);
+    if (expiresInDays !== void 0 && !Number.isInteger(expiresInDays)) {
+      throw new Error("--expires-days must be an integer");
+    }
+    const body = { label: args.label, expiresInDays };
     const res = await client.post("/api/tokens", body);
     console.log(`id:    ${res.meta.id}`);
     console.log(`label: ${res.meta.label}`);
+    console.log(`kind:  ${res.meta.kind}`);
+    console.log(
+      `expires: ${res.meta.expiresAt ? new Date(res.meta.expiresAt).toISOString() : "(never)"}`
+    );
     console.log(`token: ${res.token}`);
     console.log("");
     console.log("store the token now \u2014 it is not recoverable later.");
@@ -5244,7 +5803,7 @@ var createCmd3 = defineCommand23({
     qrcode.generate(pairUrl, { small: true }, (qr) => console.log(qr));
   }
 });
-var listCmd10 = defineCommand23({
+var listCmd11 = defineCommand25({
   meta: { name: "list", description: "List web tokens" },
   args: {
     all: { type: "boolean", description: "Include revoked tokens" }
@@ -5260,7 +5819,7 @@ var listCmd10 = defineCommand23({
     for (const line of columnize(tokens.map(tokenRow))) console.log(line);
   }
 });
-var showLocalCmd = defineCommand23({
+var showLocalCmd = defineCommand25({
   meta: {
     name: "show-local",
     description: "Print the bootstrap web token stored in ~/.bazilion/auth.json"
@@ -5270,7 +5829,7 @@ var showLocalCmd = defineCommand23({
     console.log(readAuthFile(paths.authFile).token);
   }
 });
-var revokeCmd = defineCommand23({
+var revokeCmd2 = defineCommand25({
   meta: { name: "revoke", description: "Revoke a web token" },
   args: {
     id: { type: "positional", required: true }
@@ -5281,19 +5840,19 @@ var revokeCmd = defineCommand23({
     console.log(`revoked token ${args.id}`);
   }
 });
-var tokenCommand = defineCommand23({
+var tokenCommand = defineCommand25({
   meta: { name: "token", description: "Manage web tokens for API/CLI clients" },
   subCommands: {
     create: createCmd3,
-    list: listCmd10,
-    revoke: revokeCmd,
+    list: listCmd11,
+    revoke: revokeCmd2,
     "show-local": showLocalCmd
   }
 });
 
 // src/commands/trigger.ts
-import { defineCommand as defineCommand24 } from "citty";
-var addCmd3 = defineCommand24({
+import { defineCommand as defineCommand26 } from "citty";
+var addCmd3 = defineCommand26({
   meta: { name: "add", description: "Add an interval / cron trigger to an agent" },
   args: {
     agent: { type: "positional", required: true },
@@ -5341,7 +5900,7 @@ function triggerRow(t) {
   const msgPreview = t.message.length > 60 ? `${t.message.slice(0, 60)}\u2026` : t.message;
   return [t.id, state, spec, `last: ${last}`, `"${msgPreview}"`];
 }
-var listCmd11 = defineCommand24({
+var listCmd12 = defineCommand26({
   meta: { name: "list", description: "List triggers for an agent" },
   args: {
     agent: { type: "positional", required: true }
@@ -5358,7 +5917,7 @@ var listCmd11 = defineCommand24({
     for (const line of columnize(triggers.map(triggerRow))) console.log(line);
   }
 });
-var rmCmd6 = defineCommand24({
+var rmCmd6 = defineCommand26({
   meta: { name: "rm", description: "Delete a trigger" },
   args: {
     id: { type: "positional", required: true }
@@ -5369,7 +5928,7 @@ var rmCmd6 = defineCommand24({
     console.log(`removed trigger ${args.id}`);
   }
 });
-var enableCmd3 = defineCommand24({
+var enableCmd3 = defineCommand26({
   meta: { name: "enable", description: "Enable a trigger" },
   args: {
     id: { type: "positional", required: true }
@@ -5381,7 +5940,7 @@ var enableCmd3 = defineCommand24({
     console.log(`enabled trigger ${args.id}`);
   }
 });
-var disableCmd3 = defineCommand24({
+var disableCmd3 = defineCommand26({
   meta: { name: "disable", description: "Disable a trigger" },
   args: {
     id: { type: "positional", required: true }
@@ -5393,7 +5952,7 @@ var disableCmd3 = defineCommand24({
     console.log(`disabled trigger ${args.id}`);
   }
 });
-var historyCmd = defineCommand24({
+var historyCmd = defineCommand26({
   meta: { name: "history", description: "Show recent dispatches for a trigger" },
   args: {
     id: { type: "positional", required: true },
@@ -5421,11 +5980,11 @@ var historyCmd = defineCommand24({
     for (const line of columnize(rows)) console.log(line);
   }
 });
-var triggerCommand = defineCommand24({
+var triggerCommand = defineCommand26({
   meta: { name: "trigger", description: "Manage scheduled agent triggers" },
   subCommands: {
     add: addCmd3,
-    list: listCmd11,
+    list: listCmd12,
     rm: rmCmd6,
     enable: enableCmd3,
     disable: disableCmd3,
@@ -5436,7 +5995,7 @@ var triggerCommand = defineCommand24({
 // src/commands/uninstall.ts
 import { existsSync as existsSync7, readdirSync as readdirSync2, rmSync as rmSync4 } from "fs";
 import { join as join6 } from "path";
-import { defineCommand as defineCommand25 } from "citty";
+import { defineCommand as defineCommand27 } from "citty";
 function makeLineReader() {
   let buffer = "";
   let ended = false;
@@ -5484,7 +6043,7 @@ function removePath(p) {
   rmSync4(p, { recursive: true, force: true });
   return true;
 }
-var uninstallCommand = defineCommand25({
+var uninstallCommand = defineCommand27({
   meta: {
     name: "uninstall",
     description: "Wipe bazilion state from ~/.bazilion (or BAZILION_HOME)"
@@ -5555,7 +6114,7 @@ var uninstallCommand = defineCommand25({
 
 // src/index.ts
 var VERSION = package_default.version;
-var main = defineCommand26({
+var main = defineCommand28({
   meta: {
     name: "bazilion",
     version: VERSION,
@@ -5574,11 +6133,13 @@ var main = defineCommand26({
     mcp: mcpCommand,
     provider: providerCommand,
     send: sendCommand,
+    session: sessionCommand,
     inbox: inboxCommand,
     config: configCommand,
     serve: serveCommand,
     dashboard: dashboardCommand,
     doctor: doctorCommand,
+    gateway: gatewayCommand,
     backup: backupCommand,
     trigger: triggerCommand,
     token: tokenCommand,
@@ -5678,7 +6239,7 @@ function printTopLevelHelp() {
     },
     {
       title: "ops",
-      items: [["backup", "Download a tar.gz backup of ~/.bazilion"]]
+      items: [["backup", "Encrypted backup, restore, and credential recovery"]]
     },
     {
       title: "remote",