claudemesh-cli 1.27.2 → 1.28.0

package/dist/entrypoints/cli.js

@@ -103,7 +103,7 @@ __export(exports_urls, {
   VERSION: () => VERSION,
   URLS: () => URLS
 });
-var URLS, VERSION = "1.27.2", env;
+var URLS, VERSION = "1.28.0", env;
 var init_urls = __esm(() => {
   URLS = {
     BROKER: process.env.CLAUDEMESH_BROKER_URL ?? "wss://ic.claudemesh.com/ws",
@@ -150,6 +150,32 @@ function normaliseInviteUrl(input, host = "claudemesh.com") {
   return trimmed;
 }
 
+// src/services/daemon/policy.ts
+function readEnvDefault() {
+  if (process.env.CLAUDEMESH_NO_DAEMON === "1")
+    return { mode: "no-daemon" };
+  if (process.env.CLAUDEMESH_STRICT_DAEMON === "1")
+    return { mode: "strict" };
+  return { mode: "auto" };
+}
+function setDaemonPolicy(mode) {
+  policy = { mode };
+}
+function getDaemonPolicy() {
+  return policy;
+}
+function policyFromFlags(flags) {
+  if (flags["no-daemon"])
+    return "no-daemon";
+  if (flags.strict)
+    return "strict";
+  return readEnvDefault().mode;
+}
+var policy;
+var init_policy = __esm(() => {
+  policy = readEnvDefault();
+});
+
 // src/constants/paths.ts
 import { homedir as homedir2 } from "node:os";
 import { join as join2 } from "node:path";
@@ -3588,12 +3614,6 @@ var init_spinner = __esm(() => {
 });
 
 // src/daemon/paths.ts
-var exports_paths = {};
-__export(exports_paths, {
-  DAEMON_TCP_HOST: () => DAEMON_TCP_HOST,
-  DAEMON_TCP_DEFAULT_PORT: () => DAEMON_TCP_DEFAULT_PORT,
-  DAEMON_PATHS: () => DAEMON_PATHS
-});
 import { join as join3 } from "node:path";
 var DAEMON_PATHS, DAEMON_TCP_HOST = "127.0.0.1", DAEMON_TCP_DEFAULT_PORT = 47823;
 var init_paths2 = __esm(() => {
@@ -3623,6 +3643,255 @@ var init_paths2 = __esm(() => {
   };
 });
 
+// src/daemon/local-token.ts
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+import { randomBytes as randomBytes4 } from "node:crypto";
+function readLocalToken() {
+  try {
+    return readFileSync4(DAEMON_PATHS.TOKEN_FILE, "utf8").trim();
+  } catch {
+    return null;
+  }
+}
+function ensureLocalToken() {
+  const existing = readLocalToken();
+  if (existing)
+    return existing;
+  mkdirSync3(dirname2(DAEMON_PATHS.TOKEN_FILE), { recursive: true, mode: 448 });
+  const tok = randomBytes4(32).toString("base64url");
+  writeFileSync4(DAEMON_PATHS.TOKEN_FILE, tok + `
+`, { mode: 384 });
+  return tok;
+}
+var init_local_token = __esm(() => {
+  init_paths2();
+});
+
+// src/daemon/ipc/client.ts
+import { request as httpRequest } from "node:http";
+async function ipc(opts) {
+  const useTcp = !!opts.preferTcp;
+  const headers = {
+    accept: "application/json",
+    host: "localhost"
+  };
+  let bodyBuf;
+  if (opts.body !== undefined) {
+    bodyBuf = Buffer.from(JSON.stringify(opts.body), "utf8");
+    headers["content-type"] = "application/json";
+    headers["content-length"] = String(bodyBuf.length);
+  }
+  if (useTcp) {
+    const tok = readLocalToken();
+    if (!tok)
+      throw new IpcError(0, null, "daemon local token not found; is the daemon running?");
+    headers.authorization = `Bearer ${tok}`;
+  }
+  return new Promise((resolve, reject) => {
+    const req = httpRequest(useTcp ? { host: DAEMON_TCP_HOST, port: DAEMON_TCP_DEFAULT_PORT, path: opts.path, method: opts.method ?? "GET", headers } : { socketPath: DAEMON_PATHS.SOCK_FILE, path: opts.path, method: opts.method ?? "GET", headers }, (res) => {
+      const chunks = [];
+      res.on("data", (c) => chunks.push(c));
+      res.on("end", () => {
+        const raw = Buffer.concat(chunks).toString("utf8");
+        let parsed = raw;
+        try {
+          parsed = raw.length > 0 ? JSON.parse(raw) : null;
+        } catch {}
+        resolve({ status: res.statusCode ?? 0, body: parsed });
+      });
+    });
+    req.setTimeout(opts.timeoutMs ?? 5000, () => req.destroy(new Error("ipc_timeout")));
+    req.on("error", (err) => reject(err));
+    if (bodyBuf)
+      req.write(bodyBuf);
+    req.end();
+  });
+}
+var IpcError;
+var init_client3 = __esm(() => {
+  init_paths2();
+  init_local_token();
+  IpcError = class IpcError extends Error {
+    status;
+    payload;
+    constructor(status, payload, msg) {
+      super(msg);
+      this.status = status;
+      this.payload = payload;
+    }
+  };
+});
+
+// src/services/daemon/lifecycle.ts
+var exports_lifecycle = {};
+__export(exports_lifecycle, {
+  ensureDaemonReady: () => ensureDaemonReady,
+  _resetDaemonReadyCache: () => _resetDaemonReadyCache
+});
+import { existsSync as existsSync5, readFileSync as readFileSync5, statSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join4 } from "node:path";
+async function ensureDaemonReady(opts = {}) {
+  if (lastResultThisProcess && (lastResultThisProcess.state === "up" || lastResultThisProcess.state === "started")) {
+    return lastResultThisProcess;
+  }
+  if (process.env.CLAUDEMESH_INTERNAL_NO_AUTOSPAWN === "1") {
+    opts = { ...opts, noAutoSpawn: true };
+  }
+  const result = await runEnsureDaemon(opts);
+  lastResultThisProcess = result;
+  return result;
+}
+function _resetDaemonReadyCache() {
+  lastResultThisProcess = null;
+}
+async function runEnsureDaemon(opts) {
+  const t0 = Date.now();
+  const probe = await probeDaemon();
+  if (probe === "up")
+    return { state: "up", durationMs: Date.now() - t0 };
+  if (probe === "stale")
+    cleanupStaleFiles();
+  if (opts.noAutoSpawn) {
+    return { state: "down", durationMs: Date.now() - t0, reason: "auto-spawn disabled" };
+  }
+  if (recentSpawnFailureFresh()) {
+    return {
+      state: "spawn-suppressed",
+      durationMs: Date.now() - t0,
+      reason: `daemon failed to start within last ${Math.round(SPAWN_FAIL_TTL_MS / 1000)}s`
+    };
+  }
+  const spawnRes = await spawnDaemon(opts);
+  if (spawnRes.ok) {
+    return { state: "started", durationMs: Date.now() - t0 };
+  }
+  markSpawnFailure();
+  return { state: "spawn-failed", durationMs: Date.now() - t0, reason: spawnRes.reason };
+}
+async function probeDaemon() {
+  if (!existsSync5(DAEMON_PATHS.SOCK_FILE))
+    return "absent";
+  try {
+    const res = await ipc({ path: "/v1/version", timeoutMs: PROBE_TIMEOUT_MS });
+    if (res.status === 200)
+      return "up";
+    return "stale";
+  } catch (err) {
+    if (err instanceof IpcError)
+      return "stale";
+    const msg = String(err);
+    if (/ENOENT|ECONNREFUSED|ipc_timeout|EPIPE|ECONNRESET/.test(msg))
+      return "stale";
+    return "stale";
+  }
+}
+function cleanupStaleFiles() {
+  for (const p of [DAEMON_PATHS.SOCK_FILE, DAEMON_PATHS.PID_FILE]) {
+    try {
+      unlinkSync2(p);
+    } catch {}
+  }
+}
+function recentSpawnFailureFresh() {
+  try {
+    const st = statSync(SPAWN_FAIL_FILE());
+    return Date.now() - st.mtimeMs < SPAWN_FAIL_TTL_MS;
+  } catch {
+    return false;
+  }
+}
+function markSpawnFailure() {
+  try {
+    writeFileSync5(SPAWN_FAIL_FILE(), String(Date.now()), { mode: 384 });
+  } catch {}
+}
+function clearSpawnFailure() {
+  try {
+    unlinkSync2(SPAWN_FAIL_FILE());
+  } catch {}
+}
+async function spawnDaemon(opts) {
+  const lockResult = await acquireOrShareLock(opts);
+  if (lockResult === "wait-existing") {
+    return await pollForSocket(opts.budgetMs ?? 3000);
+  }
+  try {
+    const { spawn } = await import("node:child_process");
+    const binary = await resolveCliBinary();
+    const args = ["daemon", "up"];
+    if (opts.mesh)
+      args.push("--mesh", opts.mesh);
+    const child = spawn(binary, args, {
+      detached: true,
+      stdio: "ignore",
+      env: { ...process.env, CLAUDEMESH_INTERNAL_NO_AUTOSPAWN: "1" }
+    });
+    child.unref();
+    const polled = await pollForSocket(opts.budgetMs ?? 3000);
+    if (polled.ok)
+      clearSpawnFailure();
+    return polled;
+  } catch (err) {
+    return { ok: false, reason: err instanceof Error ? err.message : String(err) };
+  } finally {
+    releaseLock();
+  }
+}
+async function acquireOrShareLock(_opts) {
+  const lockPath = SPAWN_LOCK_FILE();
+  if (existsSync5(lockPath)) {
+    try {
+      const pidStr = readFileSync5(lockPath, "utf8").trim();
+      const pid = Number.parseInt(pidStr, 10);
+      if (Number.isFinite(pid) && pid > 0) {
+        try {
+          process.kill(pid, 0);
+          return "wait-existing";
+        } catch {}
+      }
+    } catch {}
+  }
+  try {
+    writeFileSync5(lockPath, String(process.pid), { mode: 384 });
+  } catch {}
+  return "acquired";
+}
+function releaseLock() {
+  try {
+    unlinkSync2(SPAWN_LOCK_FILE());
+  } catch {}
+}
+async function pollForSocket(budgetMs) {
+  const start = Date.now();
+  while (Date.now() - start < budgetMs) {
+    if (existsSync5(DAEMON_PATHS.SOCK_FILE)) {
+      const probe = await probeDaemon();
+      if (probe === "up")
+        return { ok: true };
+    }
+    await new Promise((r) => setTimeout(r, 150));
+  }
+  return { ok: false, reason: `socket did not appear within ${budgetMs}ms` };
+}
+async function resolveCliBinary() {
+  const argv1 = process.argv[1] ?? "claudemesh";
+  if (/\.ts$/.test(argv1) || /node_modules|src\/entrypoints/.test(argv1)) {
+    try {
+      const { execSync } = await import("node:child_process");
+      return execSync("which claudemesh", { encoding: "utf8" }).trim() || "claudemesh";
+    } catch {
+      return "claudemesh";
+    }
+  }
+  return argv1;
+}
+var SPAWN_LOCK_FILE = () => join4(DAEMON_PATHS.DAEMON_DIR, ".spawn.lock"), SPAWN_FAIL_FILE = () => join4(DAEMON_PATHS.DAEMON_DIR, ".spawn-failure"), SPAWN_FAIL_TTL_MS = 30000, PROBE_TIMEOUT_MS = 800, lastResultThisProcess = null;
+var init_lifecycle = __esm(() => {
+  init_client3();
+  init_paths2();
+});
+
 // src/commands/launch.ts
 var exports_launch = {};
 __export(exports_launch, {
@@ -3630,42 +3899,26 @@ __export(exports_launch, {
 });
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { mkdtempSync, writeFileSync as writeFileSync4, rmSync, readdirSync, statSync, existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
+import { mkdtempSync, writeFileSync as writeFileSync6, rmSync, readdirSync, statSync as statSync2, existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
 import { tmpdir, hostname as hostname2, homedir as homedir3 } from "node:os";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 import { createInterface as createInterface4 } from "node:readline";
 async function ensureDaemonRunning(meshSlug, quiet) {
-  const { DAEMON_PATHS: DAEMON_PATHS2 } = await Promise.resolve().then(() => (init_paths2(), exports_paths));
-  if (existsSync5(DAEMON_PATHS2.SOCK_FILE))
-    return;
+  const { ensureDaemonReady: ensureDaemonReady2 } = await Promise.resolve().then(() => (init_lifecycle(), exports_lifecycle));
   if (!quiet)
-    render.info("starting claudemesh daemon…");
-  const { spawn } = await import("node:child_process");
-  const argv0 = process.argv[1] ?? "claudemesh";
-  let binary = argv0;
-  if (/\.ts$/.test(binary) || /node_modules|src\/entrypoints/.test(binary)) {
-    try {
-      const { execSync } = await import("node:child_process");
-      binary = execSync("which claudemesh", { encoding: "utf8" }).trim();
-    } catch {
-      binary = "claudemesh";
-    }
+    render.info("ensuring claudemesh daemon is running…");
+  const res = await ensureDaemonReady2({ budgetMs: 1e4, mesh: meshSlug });
+  if (res.state === "up") {
+    if (!quiet)
+      render.ok("daemon already running");
+    return;
   }
-  const child = spawn(binary, ["daemon", "up", "--mesh", meshSlug], {
-    detached: true,
-    stdio: "ignore"
-  });
-  child.unref();
-  const start = Date.now();
-  while (Date.now() - start < 1e4) {
-    if (existsSync5(DAEMON_PATHS2.SOCK_FILE)) {
-      if (!quiet)
-        render.ok("daemon ready");
-      return;
-    }
-    await new Promise((r) => setTimeout(r, 200));
+  if (res.state === "started") {
+    if (!quiet)
+      render.ok(`daemon ready (${res.durationMs}ms)`);
+    return;
   }
-  render.warn("daemon failed to start within 10s", "Run `claudemesh daemon up --mesh " + meshSlug + "` manually, then re-launch.");
+  render.warn(`daemon ${res.state}${res.reason ? `: ${res.reason}` : ""}`, "Run `claudemesh daemon up --mesh " + meshSlug + "` manually, then re-launch.");
 }
 function parseGroupsString(raw) {
   return raw.split(",").map((s) => s.trim()).filter(Boolean).map((token) => {
@@ -3986,17 +4239,17 @@ async function runLaunch(flags, rawArgs) {
     for (const entry of readdirSync(tmpBase)) {
       if (!entry.startsWith("claudemesh-"))
         continue;
-      const full = join4(tmpBase, entry);
-      const age = Date.now() - statSync(full).mtimeMs;
+      const full = join5(tmpBase, entry);
+      const age = Date.now() - statSync2(full).mtimeMs;
       if (age > 3600000)
         rmSync(full, { recursive: true, force: true });
     }
   } catch {}
   await ensureDaemonRunning(mesh.slug, args.quiet);
   try {
-    const claudeConfigPath = join4(homedir3(), ".claude.json");
-    if (existsSync5(claudeConfigPath)) {
-      const claudeConfig = JSON.parse(readFileSync4(claudeConfigPath, "utf-8"));
+    const claudeConfigPath = join5(homedir3(), ".claude.json");
+    if (existsSync6(claudeConfigPath)) {
+      const claudeConfig = JSON.parse(readFileSync6(claudeConfigPath, "utf-8"));
       const mcpServers = claudeConfig.mcpServers ?? {};
       let cleaned = 0;
       for (const key of Object.keys(mcpServers)) {
@@ -4014,7 +4267,7 @@ async function runLaunch(flags, rawArgs) {
       }
       if (cleaned > 0) {
         claudeConfig.mcpServers = mcpServers;
-        writeFileSync4(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
+        writeFileSync6(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
 `, "utf-8");
       }
     }
@@ -4031,7 +4284,7 @@ async function runLaunch(flags, rawArgs) {
       console.log("  (Could not fetch service catalog — mesh services won't be natively available)");
     }
   }
-  const tmpDir = mkdtempSync(join4(tmpdir(), "claudemesh-"));
+  const tmpDir = mkdtempSync(join5(tmpdir(), "claudemesh-"));
   const sessionConfig = {
     version: 1,
     meshes: [mesh],
@@ -4040,17 +4293,17 @@ async function runLaunch(flags, rawArgs) {
     ...parsedGroups.length > 0 ? { groups: parsedGroups } : {},
     messageMode
   };
-  writeFileSync4(join4(tmpDir, "config.json"), JSON.stringify(sessionConfig, null, 2) + `
+  writeFileSync6(join5(tmpDir, "config.json"), JSON.stringify(sessionConfig, null, 2) + `
 `, "utf-8");
   if (!args.quiet) {
     printBanner(displayName, mesh.slug, role, parsedGroups, messageMode);
   }
   const meshMcpEntries = [];
   if (serviceCatalog.length > 0) {
-    const claudeConfigPath = join4(homedir3(), ".claude.json");
+    const claudeConfigPath = join5(homedir3(), ".claude.json");
     let claudeConfig = {};
     try {
-      claudeConfig = JSON.parse(readFileSync4(claudeConfigPath, "utf-8"));
+      claudeConfig = JSON.parse(readFileSync6(claudeConfigPath, "utf-8"));
     } catch {
       claudeConfig = {};
     }
@@ -4077,7 +4330,7 @@ async function runLaunch(flags, rawArgs) {
       meshMcpEntries.push({ key: entryKey, entry });
     }
     claudeConfig.mcpServers = mcpServers;
-    writeFileSync4(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
+    writeFileSync6(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
 `, "utf-8");
     if (!args.quiet && meshMcpEntries.length > 0) {
       console.log(`  ${meshMcpEntries.length} mesh service(s) registered as native MCPs:`);
@@ -4114,12 +4367,12 @@ async function runLaunch(flags, rawArgs) {
   let claudeBin = "claude";
   if (!isWindows2) {
     const candidates = [
-      join4(homedir3(), ".local", "bin", "claude"),
+      join5(homedir3(), ".local", "bin", "claude"),
       "/usr/local/bin/claude",
-      join4(homedir3(), ".claude", "bin", "claude")
+      join5(homedir3(), ".claude", "bin", "claude")
     ];
     for (const c of candidates) {
-      if (existsSync5(c)) {
+      if (existsSync6(c)) {
         claudeBin = c;
         break;
       }
@@ -4128,14 +4381,14 @@ async function runLaunch(flags, rawArgs) {
   const cleanup = () => {
     if (meshMcpEntries.length > 0) {
       try {
-        const claudeConfigPath = join4(homedir3(), ".claude.json");
-        const claudeConfig = JSON.parse(readFileSync4(claudeConfigPath, "utf-8"));
+        const claudeConfigPath = join5(homedir3(), ".claude.json");
+        const claudeConfig = JSON.parse(readFileSync6(claudeConfigPath, "utf-8"));
         const mcpServers = claudeConfig.mcpServers ?? {};
         for (const { key } of meshMcpEntries) {
           delete mcpServers[key];
         }
         claudeConfig.mcpServers = mcpServers;
-        writeFileSync4(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
+        writeFileSync6(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
 `, "utf-8");
       } catch {}
     }
@@ -4832,8 +5085,8 @@ __export(exports_join, {
   runJoin: () => runJoin
 });
 import sodium3 from "libsodium-wrappers";
-import { writeFileSync as writeFileSync5, mkdirSync as mkdirSync3 } from "node:fs";
-import { join as join5, dirname as dirname2 } from "node:path";
+import { writeFileSync as writeFileSync7, mkdirSync as mkdirSync4 } from "node:fs";
+import { join as join6, dirname as dirname3 } from "node:path";
 import { homedir as homedir4, hostname as hostname3 } from "node:os";
 function deriveAppBaseUrl() {
   const override = process.env.CLAUDEMESH_APP_URL;
@@ -4953,11 +5206,11 @@ async function runJoin(args) {
     joinedAt: new Date().toISOString()
   });
   writeConfig(config);
-  const configDir = env.CLAUDEMESH_CONFIG_DIR ?? join5(homedir4(), ".claudemesh");
-  const inviteFile = join5(configDir, `invite-${payload.mesh_slug}.txt`);
+  const configDir = env.CLAUDEMESH_CONFIG_DIR ?? join6(homedir4(), ".claudemesh");
+  const inviteFile = join6(configDir, `invite-${payload.mesh_slug}.txt`);
   try {
-    mkdirSync3(dirname2(inviteFile), { recursive: true });
-    writeFileSync5(inviteFile, link, "utf-8");
+    mkdirSync4(dirname3(inviteFile), { recursive: true });
+    writeFileSync7(inviteFile, link, "utf-8");
   } catch {}
   console.log("");
   console.log(`✓ Joined "${payload.mesh_slug}" as ${displayName}${enroll.alreadyMember ? " (already a member — re-enrolled with same pubkey)" : ""}`);
@@ -6472,6 +6725,12 @@ async function pickMesh(meshes) {
   });
 }
 async function withMesh(opts, fn) {
+  if (getDaemonPolicy().mode === "strict") {
+    console.error(`
+  ✘ daemon not reachable — --strict refuses cold-path fallback.
+` + "    run `claudemesh daemon up` (or `claudemesh doctor`) and retry.\n");
+    process.exit(1);
+  }
   const config = readConfig();
   if (config.meshes.length === 0) {
     console.error("No meshes joined. Run `claudemesh join <url>` first.");
@@ -6522,6 +6781,7 @@ async function withMesh(opts, fn) {
 var init_connect = __esm(() => {
   init_facade8();
   init_facade();
+  init_policy();
 });
 
 // src/commands/info.ts
@@ -7158,185 +7418,43 @@ var init_ban = __esm(() => {
   init_exit_codes();
 });
 
-// src/services/bridge/protocol.ts
-import { homedir as homedir5 } from "node:os";
-import { join as join6 } from "node:path";
-function socketPath(meshSlug) {
-  return join6(homedir5(), ".claudemesh", "sockets", `${meshSlug}.sock`);
-}
-function frame(obj) {
-  return JSON.stringify(obj) + `
-`;
-}
-
-class LineParser {
-  buf = "";
-  feed(chunk) {
-    this.buf += typeof chunk === "string" ? chunk : chunk.toString("utf-8");
-    const lines = [];
-    let nl = this.buf.indexOf(`
+// src/ui/warnings.ts
+function warnDaemonState(res, opts = {}) {
+  if (alreadyWarned)
+    return false;
+  if (opts.quiet || opts.json)
+    return false;
+  if (res.state === "up")
+    return false;
+  if (getDaemonPolicy().mode === "strict" && res.state !== "started")
+    return false;
+  alreadyWarned = true;
+  const tag = (label) => `[claudemesh] ${label}`;
+  const hint = (s) => dim(s);
+  switch (res.state) {
+    case "started":
+      process.stderr.write(`${tag("info")} daemon restarted automatically ${hint(`(took ${res.durationMs}ms)`)}
 `);
-    while (nl !== -1) {
-      lines.push(this.buf.slice(0, nl));
-      this.buf = this.buf.slice(nl + 1);
-      nl = this.buf.indexOf(`
+      return true;
+    case "down":
+      process.stderr.write(`${tag("info")} daemon not running — using cold path ${hint("(slower; run `claudemesh daemon up` for warm path)")}
 `);
-    }
-    return lines;
-  }
-}
-var init_protocol = () => {};
-
-// src/services/bridge/client.ts
-import { createConnection } from "node:net";
-import { existsSync as existsSync6 } from "node:fs";
-import { randomUUID as randomUUID2 } from "node:crypto";
-async function tryBridge(meshSlug, verb, args = {}, timeoutMs = DEFAULT_TIMEOUT_MS) {
-  const path = socketPath(meshSlug);
-  if (!existsSync6(path))
-    return null;
-  return new Promise((resolve) => {
-    const id = randomUUID2();
-    const req = { id, verb, args };
-    const parser = new LineParser;
-    let settled = false;
-    const finish = (value) => {
-      if (settled)
-        return;
-      settled = true;
-      try {
-        socket.destroy();
-      } catch {}
-      clearTimeout(timer);
-      resolve(value);
-    };
-    const socket = createConnection({ path });
-    const timer = setTimeout(() => {
-      finish(null);
-    }, timeoutMs);
-    socket.on("connect", () => {
-      try {
-        socket.write(frame(req));
-      } catch {
-        finish(null);
-      }
-    });
-    socket.on("data", (chunk) => {
-      const lines = parser.feed(chunk);
-      for (const line of lines) {
-        if (!line.trim())
-          continue;
-        let res;
-        try {
-          res = JSON.parse(line);
-        } catch {
-          continue;
-        }
-        if (res.id !== id)
-          continue;
-        if (res.ok)
-          finish({ ok: true, result: res.result });
-        else
-          finish({ ok: false, error: res.error });
-        return;
-      }
-    });
-    socket.on("error", (err) => {
-      const code = err.code;
-      if (code === "ECONNREFUSED" || code === "ENOENT" || code === "EPERM") {
-        finish(null);
-      } else {
-        finish(null);
-      }
-    });
-    socket.on("close", () => {
-      finish(null);
-    });
-  });
-}
-var DEFAULT_TIMEOUT_MS = 5000;
-var init_client3 = __esm(() => {
-  init_protocol();
-});
-
-// src/daemon/local-token.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname3 } from "node:path";
-import { randomBytes as randomBytes4 } from "node:crypto";
-function readLocalToken() {
-  try {
-    return readFileSync5(DAEMON_PATHS.TOKEN_FILE, "utf8").trim();
-  } catch {
-    return null;
-  }
-}
-function ensureLocalToken() {
-  const existing = readLocalToken();
-  if (existing)
-    return existing;
-  mkdirSync4(dirname3(DAEMON_PATHS.TOKEN_FILE), { recursive: true, mode: 448 });
-  const tok = randomBytes4(32).toString("base64url");
-  writeFileSync6(DAEMON_PATHS.TOKEN_FILE, tok + `
-`, { mode: 384 });
-  return tok;
-}
-var init_local_token = __esm(() => {
-  init_paths2();
-});
-
-// src/daemon/ipc/client.ts
-import { request as httpRequest } from "node:http";
-async function ipc(opts) {
-  const useTcp = !!opts.preferTcp;
-  const headers = {
-    accept: "application/json",
-    host: "localhost"
-  };
-  let bodyBuf;
-  if (opts.body !== undefined) {
-    bodyBuf = Buffer.from(JSON.stringify(opts.body), "utf8");
-    headers["content-type"] = "application/json";
-    headers["content-length"] = String(bodyBuf.length);
-  }
-  if (useTcp) {
-    const tok = readLocalToken();
-    if (!tok)
-      throw new IpcError(0, null, "daemon local token not found; is the daemon running?");
-    headers.authorization = `Bearer ${tok}`;
+      return true;
+    case "spawn-suppressed":
+      process.stderr.write(`${tag("warn")} ${res.reason ?? "daemon failed to start recently"} — using cold path ${hint("(run `claudemesh doctor`)")}
+`);
+      return true;
+    case "spawn-failed":
+      process.stderr.write(`${tag("warn")} daemon spawn failed${res.reason ? `: ${res.reason}` : ""} — using cold path ${hint("(check ~/.claudemesh/daemon/daemon.log)")}
+`);
+      return true;
   }
-  return new Promise((resolve, reject) => {
-    const req = httpRequest(useTcp ? { host: DAEMON_TCP_HOST, port: DAEMON_TCP_DEFAULT_PORT, path: opts.path, method: opts.method ?? "GET", headers } : { socketPath: DAEMON_PATHS.SOCK_FILE, path: opts.path, method: opts.method ?? "GET", headers }, (res) => {
-      const chunks = [];
-      res.on("data", (c) => chunks.push(c));
-      res.on("end", () => {
-        const raw = Buffer.concat(chunks).toString("utf8");
-        let parsed = raw;
-        try {
-          parsed = raw.length > 0 ? JSON.parse(raw) : null;
-        } catch {}
-        resolve({ status: res.statusCode ?? 0, body: parsed });
-      });
-    });
-    req.setTimeout(opts.timeoutMs ?? 5000, () => req.destroy(new Error("ipc_timeout")));
-    req.on("error", (err) => reject(err));
-    if (bodyBuf)
-      req.write(bodyBuf);
-    req.end();
-  });
+  return false;
 }
-var IpcError;
-var init_client4 = __esm(() => {
-  init_paths2();
-  init_local_token();
-  IpcError = class IpcError extends Error {
-    status;
-    payload;
-    constructor(status, payload, msg) {
-      super(msg);
-      this.status = status;
-      this.payload = payload;
-    }
-  };
+var alreadyWarned = false;
+var init_warnings = __esm(() => {
+  init_policy();
+  init_styles();
 });
 
 // src/services/bridge/daemon-route.ts
@@ -7353,12 +7471,19 @@ __export(exports_daemon_route, {
   tryGetSkillViaDaemon: () => tryGetSkillViaDaemon,
   tryForgetViaDaemon: () => tryForgetViaDaemon
 });
-import { existsSync as existsSync7 } from "node:fs";
 function meshQuery(mesh) {
   return mesh ? `?mesh=${encodeURIComponent(mesh)}` : "";
 }
+async function daemonReachable() {
+  const policy2 = getDaemonPolicy();
+  if (policy2.mode === "no-daemon")
+    return false;
+  const res = await ensureDaemonReady({ noAutoSpawn: false });
+  warnDaemonState(res, {});
+  return res.state === "up" || res.state === "started";
+}
 async function tryListPeersViaDaemon(mesh) {
-  if (!existsSync7(DAEMON_PATHS.SOCK_FILE))
+  if (!await daemonReachable())
     return null;
   try {
     const res = await ipc({ path: `/v1/peers${meshQuery(mesh)}`, timeoutMs: 3000 });
@@ -7373,7 +7498,7 @@ async function tryListPeersViaDaemon(mesh) {
   }
 }
 async function tryListSkillsViaDaemon(mesh) {
-  if (!existsSync7(DAEMON_PATHS.SOCK_FILE))
+  if (!await daemonReachable())
     return null;
   try {
     const res = await ipc({ path: `/v1/skills${meshQuery(mesh)}`, timeoutMs: 3000 });
@@ -7388,7 +7513,7 @@ async function tryListSkillsViaDaemon(mesh) {
   }
 }
 async function tryGetSkillViaDaemon(name, mesh) {
-  if (!existsSync7(DAEMON_PATHS.SOCK_FILE))
+  if (!await daemonReachable())
     return null;
   try {
     const res = await ipc({
@@ -7405,7 +7530,7 @@ async function tryGetSkillViaDaemon(name, mesh) {
   }
 }
 async function tryGetStateViaDaemon(key, mesh) {
-  if (!existsSync7(DAEMON_PATHS.SOCK_FILE))
+  if (!await daemonReachable())
     return null;
   try {
     const path = `/v1/state?key=${encodeURIComponent(key)}${mesh ? `&mesh=${encodeURIComponent(mesh)}` : ""}`;
@@ -7423,7 +7548,7 @@ async function tryGetStateViaDaemon(key, mesh) {
   }
 }
 async function tryListStateViaDaemon(mesh) {
-  if (!existsSync7(DAEMON_PATHS.SOCK_FILE))
+  if (!await daemonReachable())
     return null;
   try {
     const res = await ipc({ path: `/v1/state${meshQuery(mesh)}`, timeoutMs: 3000 });
@@ -7438,7 +7563,7 @@ async function tryListStateViaDaemon(mesh) {
   }
 }
 async function trySetStateViaDaemon(key, value, mesh) {
-  if (!existsSync7(DAEMON_PATHS.SOCK_FILE))
+  if (!await daemonReachable())
     return false;
   try {
     const res = await ipc({
@@ -7453,7 +7578,7 @@ async function trySetStateViaDaemon(key, value, mesh) {
   }
 }
 async function tryRememberViaDaemon(content, tags, mesh) {
-  if (!existsSync7(DAEMON_PATHS.SOCK_FILE))
+  if (!await daemonReachable())
     return null;
   try {
     const res = await ipc({
@@ -7470,7 +7595,7 @@ async function tryRememberViaDaemon(content, tags, mesh) {
   }
 }
 async function tryRecallViaDaemon(query, mesh) {
-  if (!existsSync7(DAEMON_PATHS.SOCK_FILE))
+  if (!await daemonReachable())
     return null;
   try {
     const path = `/v1/memory?q=${encodeURIComponent(query)}${mesh ? `&mesh=${encodeURIComponent(mesh)}` : ""}`;
@@ -7486,7 +7611,7 @@ async function tryRecallViaDaemon(query, mesh) {
   }
 }
 async function tryForgetViaDaemon(id, mesh) {
-  if (!existsSync7(DAEMON_PATHS.SOCK_FILE))
+  if (!await daemonReachable())
     return false;
   try {
     const path = `/v1/memory/${encodeURIComponent(id)}${meshQuery(mesh)}`;
@@ -7497,7 +7622,7 @@ async function tryForgetViaDaemon(id, mesh) {
   }
 }
 async function trySendViaDaemon(args) {
-  if (!existsSync7(DAEMON_PATHS.SOCK_FILE))
+  if (!await daemonReachable())
     return null;
   try {
     const res = await ipc({
@@ -7529,8 +7654,10 @@ async function trySendViaDaemon(args) {
   }
 }
 var init_daemon_route = __esm(() => {
-  init_client4();
-  init_paths2();
+  init_client3();
+  init_lifecycle();
+  init_policy();
+  init_warnings();
 });
 
 // src/commands/peers.ts
@@ -7557,11 +7684,6 @@ async function listPeersForMesh(slug) {
       return dr.map((p) => annotateSelf(p, selfMemberPubkey, null));
     }
   } catch {}
-  const bridged = await tryBridge(slug, "peers");
-  if (bridged && bridged.ok) {
-    const peers = bridged.result;
-    return peers.map((p) => annotateSelf(p, selfMemberPubkey, null));
-  }
   let result = [];
   await withMesh({ meshSlug: slug }, async (client) => {
     const all = await client.listPeers();
@@ -7631,7 +7753,6 @@ var FIELD_ALIAS;
 var init_peers = __esm(() => {
   init_connect();
   init_facade();
-  init_client3();
   init_render();
   init_styles();
   FIELD_ALIAS = {
@@ -7677,26 +7798,6 @@ async function runSend(flags, to, message) {
       process.exit(1);
     }
   }
-  if (meshSlug) {
-    const bridged = await tryBridge(meshSlug, "send", { to, message, priority });
-    if (bridged !== null) {
-      if (bridged.ok) {
-        const r = bridged.result;
-        if (flags.json) {
-          console.log(JSON.stringify({ ok: true, messageId: r.messageId, target: to }));
-        } else {
-          render.ok(`sent to ${to}`, r.messageId ? dim(r.messageId.slice(0, 8)) : undefined);
-        }
-        return;
-      }
-      if (flags.json) {
-        console.log(JSON.stringify({ ok: false, error: bridged.error }));
-      } else {
-        render.err(`send failed: ${bridged.error}`);
-      }
-      process.exit(1);
-    }
-  }
   await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
     let targetSpec = to;
     if (to.startsWith("#") && !/^#[0-9a-z_-]{20,}$/i.test(to)) {
@@ -7739,7 +7840,6 @@ async function runSend(flags, to, message) {
 var init_send = __esm(() => {
   init_connect();
   init_facade();
-  init_client3();
   init_daemon_route();
   init_render();
   init_styles();
@@ -8067,33 +8167,12 @@ __export(exports_broker_actions, {
   runForget: () => runForget,
   runClock: () => runClock
 });
-function unambiguousMesh(opts) {
-  if (opts.mesh)
-    return opts.mesh;
-  const config = readConfig();
-  return config.meshes.length === 1 ? config.meshes[0].slug : null;
-}
 async function runStatusSet(state, opts) {
   const valid = ["idle", "working", "dnd"];
   if (!valid.includes(state)) {
     render.err(`Invalid status: ${state}`, `must be one of: ${valid.join(", ")}`);
     return EXIT.INVALID_ARGS;
   }
-  const meshSlug = unambiguousMesh(opts);
-  if (meshSlug) {
-    const bridged = await tryBridge(meshSlug, "status_set", { status: state });
-    if (bridged !== null) {
-      if (bridged.ok) {
-        if (opts.json)
-          console.log(JSON.stringify({ status: state }));
-        else
-          render.ok(`status set to ${bold(state)}`);
-        return EXIT.SUCCESS;
-      }
-      render.err(bridged.error);
-      return EXIT.INTERNAL_ERROR;
-    }
-  }
   await withMesh({ meshSlug: opts.mesh ?? null }, async (client) => {
     await client.setStatus(state);
   });
@@ -8108,21 +8187,6 @@ async function runSummary(text, opts) {
     render.err("Usage: claudemesh summary <text>");
     return EXIT.INVALID_ARGS;
   }
-  const meshSlug = unambiguousMesh(opts);
-  if (meshSlug) {
-    const bridged = await tryBridge(meshSlug, "summary", { summary: text });
-    if (bridged !== null) {
-      if (bridged.ok) {
-        if (opts.json)
-          console.log(JSON.stringify({ summary: text }));
-        else
-          render.ok("summary set", dim(text));
-        return EXIT.SUCCESS;
-      }
-      render.err(bridged.error);
-      return EXIT.INTERNAL_ERROR;
-    }
-  }
   await withMesh({ meshSlug: opts.mesh ?? null }, async (client) => {
     await client.setSummary(text);
   });
@@ -8142,21 +8206,6 @@ async function runVisible(value, opts) {
     render.err("Usage: claudemesh visible <true|false>");
     return EXIT.INVALID_ARGS;
   }
-  const meshSlug = unambiguousMesh(opts);
-  if (meshSlug) {
-    const bridged = await tryBridge(meshSlug, "visible", { visible });
-    if (bridged !== null) {
-      if (bridged.ok) {
-        if (opts.json)
-          console.log(JSON.stringify({ visible }));
-        else
-          render.ok(visible ? "you are now visible to peers" : "you are now hidden", visible ? undefined : "direct messages still reach you");
-        return EXIT.SUCCESS;
-      }
-      render.err(bridged.error);
-      return EXIT.INTERNAL_ERROR;
-    }
-  }
   await withMesh({ meshSlug: opts.mesh ?? null }, async (client) => {
     await client.setVisible(visible);
   });
@@ -8386,8 +8435,6 @@ async function runTaskComplete(id, result, opts) {
 }
 var init_broker_actions = __esm(() => {
   init_connect();
-  init_facade();
-  init_client3();
   init_daemon_route();
   init_render();
   init_styles();
@@ -8622,35 +8669,35 @@ var init_whoami = __esm(() => {
 });
 
 // src/daemon/lock.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync6, unlinkSync as unlinkSync2, writeFileSync as writeFileSync7 } from "node:fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync7, unlinkSync as unlinkSync3, writeFileSync as writeFileSync8 } from "node:fs";
 import { dirname as dirname4 } from "node:path";
 function acquireSingletonLock() {
   mkdirSync5(dirname4(DAEMON_PATHS.PID_FILE), { recursive: true, mode: 448 });
-  if (existsSync8(DAEMON_PATHS.PID_FILE)) {
-    const raw = readFileSync6(DAEMON_PATHS.PID_FILE, "utf8").trim();
+  if (existsSync7(DAEMON_PATHS.PID_FILE)) {
+    const raw = readFileSync7(DAEMON_PATHS.PID_FILE, "utf8").trim();
     const oldPid = Number.parseInt(raw, 10);
     if (Number.isFinite(oldPid) && oldPid > 0 && isProcessAlive(oldPid)) {
       return { result: "already-running", pid: oldPid };
     }
     try {
-      unlinkSync2(DAEMON_PATHS.PID_FILE);
+      unlinkSync3(DAEMON_PATHS.PID_FILE);
     } catch {}
-    writeFileSync7(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
+    writeFileSync8(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
     return { result: "stale", pid: process.pid };
   }
-  writeFileSync7(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
+  writeFileSync8(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
   return { result: "acquired", pid: process.pid };
 }
 function releaseSingletonLock() {
   try {
-    const raw = readFileSync6(DAEMON_PATHS.PID_FILE, "utf8").trim();
+    const raw = readFileSync7(DAEMON_PATHS.PID_FILE, "utf8").trim();
     if (Number.parseInt(raw, 10) === process.pid)
-      unlinkSync2(DAEMON_PATHS.PID_FILE);
+      unlinkSync3(DAEMON_PATHS.PID_FILE);
   } catch {}
 }
 function readRunningPid() {
   try {
-    const raw = readFileSync6(DAEMON_PATHS.PID_FILE, "utf8").trim();
+    const raw = readFileSync7(DAEMON_PATHS.PID_FILE, "utf8").trim();
     const pid = Number.parseInt(raw, 10);
     if (Number.isFinite(pid) && pid > 0 && isProcessAlive(pid))
       return pid;
@@ -8886,10 +8933,10 @@ var init_fingerprint = __esm(() => {
 });
 
 // src/daemon/ipc/handlers/send.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 function acceptSend(req, deps) {
   const now = (deps.now ?? Date.now)();
-  const newId = deps.newId ?? randomUUID3;
+  const newId = deps.newId ?? randomUUID2;
   const clientId = req.client_message_id?.trim() || ulidLike(newId);
   const body = Buffer.from(req.message, "utf8");
   const fingerprint = computeRequestFingerprint({
@@ -9082,9 +9129,9 @@ function bindSseStream(res, bus) {
 
 // src/daemon/ipc/server.ts
 import { createServer as createServer2 } from "node:http";
-import { chmodSync as chmodSync3, existsSync as existsSync9, unlinkSync as unlinkSync3 } from "node:fs";
+import { chmodSync as chmodSync3, existsSync as existsSync8, unlinkSync as unlinkSync4 } from "node:fs";
 import { timingSafeEqual } from "node:crypto";
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 function startIpcServer(opts) {
   const log2 = opts.log ?? defaultLogger;
   const handler = makeHandler({
@@ -9098,9 +9145,9 @@ function startIpcServer(opts) {
     meshConfigs: opts.meshConfigs,
     onPendingInserted: opts.onPendingInserted
   });
-  if (existsSync9(DAEMON_PATHS.SOCK_FILE)) {
+  if (existsSync8(DAEMON_PATHS.SOCK_FILE)) {
     try {
-      unlinkSync3(DAEMON_PATHS.SOCK_FILE);
+      unlinkSync4(DAEMON_PATHS.SOCK_FILE);
     } catch {}
   }
   const uds = createServer2(handler);
@@ -9136,7 +9183,7 @@ function startIpcServer(opts) {
         tcp ? new Promise((res) => tcp.close(() => res())) : Promise.resolve()
       ]);
       try {
-        unlinkSync3(DAEMON_PATHS.SOCK_FILE);
+        unlinkSync4(DAEMON_PATHS.SOCK_FILE);
       } catch {}
     }
   };
@@ -9555,11 +9602,11 @@ function makeHandler(opts) {
           respond(res, 400, { error: "missing 'id'" });
           return;
         }
-        const newId = typeof body.new_client_message_id === "string" && body.new_client_message_id.trim() ? body.new_client_message_id.trim() : randomUUID4();
+        const newId = typeof body.new_client_message_id === "string" && body.new_client_message_id.trim() ? body.new_client_message_id.trim() : randomUUID3();
         const result = requeueDeadOrPending(opts.outboxDb, {
           id: body.id,
           newClientMessageId: newId,
-          newRowId: randomUUID4(),
+          newRowId: randomUUID3(),
           now: Date.now(),
           abortedBy: typeof body.aborted_by === "string" ? body.aborted_by : "operator"
         });
@@ -10426,7 +10473,7 @@ var POLL_INTERVAL_MS = 500, MAX_ATTEMPTS_PER_ROW = 25, BACKOFF_BASE_MS = 500, BA
 var init_drain = () => {};
 
 // src/daemon/inbound.ts
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 async function handleBrokerPush(msg, ctx) {
   if (msg.subtype === "system" && typeof msg.event === "string") {
     ctx.bus.publish(mapSystemEventKind(msg.event), {
@@ -10449,14 +10496,14 @@ async function handleBrokerPush(msg, ctx) {
   const createdAt = stringOrNull(msg.createdAt);
   const priority = stringOrNull(msg.priority) ?? "next";
   const subtype = stringOrNull(msg.subtype);
-  const clientMessageId = stringOrNull(msg.client_message_id) ?? brokerMessageId ?? randomUUID5();
+  const clientMessageId = stringOrNull(msg.client_message_id) ?? brokerMessageId ?? randomUUID4();
   const body = await decryptOrFallback({
     ciphertext,
     nonce,
     senderPubkey,
     ctx
   });
-  const id = randomUUID5();
+  const id = randomUUID4();
   const inserted = insertIfNew(ctx.db, {
     id,
     client_message_id: clientMessageId,
@@ -10533,7 +10580,7 @@ __export(exports_identity, {
   checkFingerprint: () => checkFingerprint,
   acceptCurrentHost: () => acceptCurrentHost
 });
-import { existsSync as existsSync10, readFileSync as readFileSync7, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync9 } from "node:fs";
 import { join as join7 } from "node:path";
 import { createHash as createHash2 } from "node:crypto";
 import { networkInterfaces } from "node:os";
@@ -10554,13 +10601,13 @@ function computeCurrentFingerprint() {
 }
 function checkFingerprint() {
   const current = computeCurrentFingerprint();
-  if (!existsSync10(path())) {
-    writeFileSync8(path(), JSON.stringify(current, null, 2), { mode: 384 });
+  if (!existsSync9(path())) {
+    writeFileSync9(path(), JSON.stringify(current, null, 2), { mode: 384 });
     return { result: "first_run", current };
   }
   let stored;
   try {
-    stored = JSON.parse(readFileSync7(path(), "utf8"));
+    stored = JSON.parse(readFileSync8(path(), "utf8"));
   } catch {
     return { result: "unavailable", current };
   }
@@ -10570,14 +10617,14 @@ function checkFingerprint() {
 }
 function acceptCurrentHost() {
   const current = computeCurrentFingerprint();
-  writeFileSync8(path(), JSON.stringify(current, null, 2), { mode: 384 });
+  writeFileSync9(path(), JSON.stringify(current, null, 2), { mode: 384 });
   return current;
 }
 function readHostId() {
   if (process.platform === "linux") {
     for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
       try {
-        const raw = readFileSync7(p, "utf8").trim();
+        const raw = readFileSync8(p, "utf8").trim();
         if (raw)
           return `linux:${raw}`;
       } catch {}
@@ -10622,16 +10669,16 @@ var init_identity = __esm(() => {
 });
 
 // src/daemon/run.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync9 } from "node:fs";
 function detectContainer() {
   if (process.env.KUBERNETES_SERVICE_HOST)
     return true;
   if (process.env.CONTAINER === "1")
     return true;
   try {
-    if (existsSync11("/.dockerenv"))
+    if (existsSync10("/.dockerenv"))
       return true;
-    const cg = readFileSync8("/proc/1/cgroup", "utf8");
+    const cg = readFileSync9("/proc/1/cgroup", "utf8");
     if (/(docker|kubepods|containerd)/.test(cg))
       return true;
   } catch {}
@@ -10650,10 +10697,10 @@ async function runDaemon(opts = {}) {
 `);
   }
   const fpCheck = checkFingerprint();
-  const policy = opts.clonePolicy ?? "refuse";
+  const policy2 = opts.clonePolicy ?? "refuse";
   if (fpCheck.result === "mismatch") {
     const msg = `host_fingerprint mismatch: this daemon dir was started on a different host.`;
-    if (policy === "refuse") {
+    if (policy2 === "refuse") {
       process.stderr.write(`${msg}
 `);
       process.stderr.write(`  stored host_id: ${fpCheck.stored?.host_id}
@@ -10667,7 +10714,7 @@ async function runDaemon(opts = {}) {
       releaseSingletonLock();
       return 4;
     }
-    if (policy === "warn") {
+    if (policy2 === "warn") {
       process.stderr.write(`WARN: ${msg} (continuing per [clone] policy=warn)
 `);
     }
@@ -10832,9 +10879,9 @@ __export(exports_service_install, {
   installService: () => installService,
   detectPlatform: () => detectPlatform
 });
-import { existsSync as existsSync12, mkdirSync as mkdirSync7, writeFileSync as writeFileSync9, unlinkSync as unlinkSync4, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync7, writeFileSync as writeFileSync10, unlinkSync as unlinkSync5, readFileSync as readFileSync10 } from "node:fs";
 import { execSync as execSync2 } from "node:child_process";
-import { homedir as homedir6 } from "node:os";
+import { homedir as homedir5 } from "node:os";
 import { join as join8, dirname as dirname5 } from "node:path";
 function detectPlatform() {
   if (process.platform === "darwin")
@@ -10853,7 +10900,7 @@ function installService(args) {
   if (isCi() && !args.allowCi) {
     throw new Error("Refusing to install persistent service in CI; pass --allow-ci-persistent to override.");
   }
-  if (!existsSync12(args.binaryPath)) {
+  if (!existsSync11(args.binaryPath)) {
     throw new Error(`binary not found at ${args.binaryPath}`);
   }
   mkdirSync7(DAEMON_PATHS.DAEMON_DIR, { recursive: true, mode: 448 });
@@ -10869,8 +10916,8 @@ function uninstallService() {
     try {
       execSync2(`launchctl bootout gui/$(id -u)/${SERVICE_LABEL}`, { stdio: "ignore" });
     } catch {}
-    if (existsSync12(p)) {
-      unlinkSync4(p);
+    if (existsSync11(p)) {
+      unlinkSync5(p);
       removed.push(p);
     }
   } else if (platform5 === "linux") {
@@ -10878,15 +10925,15 @@ function uninstallService() {
     try {
       execSync2(`systemctl --user disable --now ${SYSTEMD_UNIT}`, { stdio: "ignore" });
     } catch {}
-    if (existsSync12(p)) {
-      unlinkSync4(p);
+    if (existsSync11(p)) {
+      unlinkSync5(p);
       removed.push(p);
     }
   }
   return { platform: platform5, removed };
 }
 function darwinPlistPath() {
-  return join8(homedir6(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
+  return join8(homedir5(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
 }
 function installDarwin(args) {
   const plist = darwinPlistPath();
@@ -10920,18 +10967,18 @@ function installDarwin(args) {
   <key>StandardErrorPath</key>
   <string>${escapeXml(log2)}</string>
   <key>WorkingDirectory</key>
-  <string>${escapeXml(homedir6())}</string>
+  <string>${escapeXml(homedir5())}</string>
   <key>EnvironmentVariables</key>
   <dict>
     <key>HOME</key>
-    <string>${escapeXml(homedir6())}</string>
+    <string>${escapeXml(homedir5())}</string>
     <key>PATH</key>
     <string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
   </dict>
 </dict>
 </plist>
 `;
-  writeFileSync9(plist, xml, { mode: 420 });
+  writeFileSync10(plist, xml, { mode: 420 });
   return {
     platform: "darwin",
     unitPath: plist,
@@ -10939,7 +10986,7 @@ function installDarwin(args) {
   };
 }
 function linuxUnitPath() {
-  return join8(homedir6(), ".config", "systemd", "user", SYSTEMD_UNIT);
+  return join8(homedir5(), ".config", "systemd", "user", SYSTEMD_UNIT);
 }
 function installLinux(args) {
   const unit = linuxUnitPath();
@@ -10968,7 +11015,7 @@ Environment=PATH=/usr/local/bin:/usr/bin:/bin
 [Install]
 WantedBy=default.target
 `;
-  writeFileSync9(unit, content, { mode: 420 });
+  writeFileSync10(unit, content, { mode: 420 });
   return {
     platform: "linux",
     unitPath: unit,
@@ -10988,10 +11035,10 @@ function readInstalledUnit() {
   if (!platform5)
     return { platform: null, path: null, content: null };
   const path2 = platform5 === "darwin" ? darwinPlistPath() : linuxUnitPath();
-  if (!existsSync12(path2))
+  if (!existsSync11(path2))
     return { platform: platform5, path: null, content: null };
   try {
-    return { platform: platform5, path: path2, content: readFileSync9(path2, "utf8") };
+    return { platform: platform5, path: path2, content: readFileSync10(path2, "utf8") };
   } catch {
     return { platform: platform5, path: path2, content: null };
   }
@@ -11319,7 +11366,7 @@ async function runStop(opts) {
 }
 var init_daemon = __esm(() => {
   init_run();
-  init_client4();
+  init_client3();
   init_lock();
   init_paths2();
 });
@@ -11333,19 +11380,19 @@ __export(exports_install, {
 import {
   chmodSync as chmodSync4,
   copyFileSync,
-  existsSync as existsSync13,
+  existsSync as existsSync12,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync10,
-  writeFileSync as writeFileSync10
+  readFileSync as readFileSync11,
+  writeFileSync as writeFileSync11
 } from "node:fs";
-import { homedir as homedir7, platform as platform5 } from "node:os";
+import { homedir as homedir6, platform as platform5 } from "node:os";
 import { dirname as dirname6, join as join9, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync as spawnSync3 } from "node:child_process";
 function readClaudeConfig() {
-  if (!existsSync13(CLAUDE_CONFIG))
+  if (!existsSync12(CLAUDE_CONFIG))
     return {};
-  const text = readFileSync10(CLAUDE_CONFIG, "utf-8").trim();
+  const text = readFileSync11(CLAUDE_CONFIG, "utf-8").trim();
   if (!text)
     return {};
   try {
@@ -11355,7 +11402,7 @@ function readClaudeConfig() {
   }
 }
 function backupClaudeConfig() {
-  if (!existsSync13(CLAUDE_CONFIG))
+  if (!existsSync12(CLAUDE_CONFIG))
     return;
   const backupDir = join9(dirname6(CLAUDE_CONFIG), ".claude", "backups");
   mkdirSync8(backupDir, { recursive: true });
@@ -11384,7 +11431,7 @@ function patchMcpServer(entry) {
   return action;
 }
 function removeMcpServer() {
-  if (!existsSync13(CLAUDE_CONFIG))
+  if (!existsSync12(CLAUDE_CONFIG))
     return false;
   backupClaudeConfig();
   const cfg = readClaudeConfig();
@@ -11398,7 +11445,7 @@ function removeMcpServer() {
 }
 function flushClaudeConfig(obj) {
   mkdirSync8(dirname6(CLAUDE_CONFIG), { recursive: true });
-  writeFileSync10(CLAUDE_CONFIG, JSON.stringify(obj, null, 2) + `
+  writeFileSync11(CLAUDE_CONFIG, JSON.stringify(obj, null, 2) + `
 `, "utf-8");
   try {
     chmodSync4(CLAUDE_CONFIG, 384);
@@ -11421,7 +11468,7 @@ function resolveBundledSkillsDir() {
   const here = fileURLToPath(import.meta.url);
   const pkgRoot = resolve(dirname6(here), "..", "..");
   const skillsDir = join9(pkgRoot, "skills");
-  if (existsSync13(skillsDir))
+  if (existsSync12(skillsDir))
     return skillsDir;
   return null;
 }
@@ -11456,7 +11503,7 @@ function uninstallSkills() {
     if (!entry.isDirectory())
       continue;
     const dstDir = join9(CLAUDE_SKILLS_ROOT, entry.name);
-    if (existsSync13(dstDir)) {
+    if (existsSync12(dstDir)) {
       try {
         fs.rmSync(dstDir, { recursive: true, force: true });
         removed.push(entry.name);
@@ -11481,9 +11528,9 @@ function entriesEqual(a, b) {
   return a.command === b.command && JSON.stringify(a.args ?? []) === JSON.stringify(b.args ?? []);
 }
 function readClaudeSettings() {
-  if (!existsSync13(CLAUDE_SETTINGS))
+  if (!existsSync12(CLAUDE_SETTINGS))
     return {};
-  const text = readFileSync10(CLAUDE_SETTINGS, "utf-8").trim();
+  const text = readFileSync11(CLAUDE_SETTINGS, "utf-8").trim();
   if (!text)
     return {};
   try {
@@ -11494,7 +11541,7 @@ function readClaudeSettings() {
 }
 function writeClaudeSettings(obj) {
   mkdirSync8(dirname6(CLAUDE_SETTINGS), { recursive: true });
-  writeFileSync10(CLAUDE_SETTINGS, JSON.stringify(obj, null, 2) + `
+  writeFileSync11(CLAUDE_SETTINGS, JSON.stringify(obj, null, 2) + `
 `, "utf-8");
 }
 function installAllowedTools() {
@@ -11508,7 +11555,7 @@ function installAllowedTools() {
   return { added: toAdd, unchanged: CLAUDEMESH_TOOLS.length - toAdd.length };
 }
 function uninstallAllowedTools() {
-  if (!existsSync13(CLAUDE_SETTINGS))
+  if (!existsSync12(CLAUDE_SETTINGS))
     return 0;
   const settings = readClaudeSettings();
   const existing = settings.allowedTools ?? [];
@@ -11543,7 +11590,7 @@ function installHooks() {
   return { added, unchanged };
 }
 function uninstallHooks() {
-  if (!existsSync13(CLAUDE_SETTINGS))
+  if (!existsSync12(CLAUDE_SETTINGS))
     return 0;
   const settings = readClaudeSettings();
   const hooks = settings.hooks;
@@ -11593,7 +11640,7 @@ function runInstall(args = []) {
     render.err("`bun` is not on PATH.", "Install Bun first: https://bun.com");
     process.exit(1);
   }
-  if (!existsSync13(entry)) {
+  if (!existsSync12(entry)) {
     render.err(`MCP entry not found at ${entry}`);
     process.exit(1);
   }
@@ -11781,9 +11828,9 @@ var init_install = __esm(() => {
   init_facade();
   init_render();
   init_styles();
-  CLAUDE_CONFIG = join9(homedir7(), ".claude.json");
-  CLAUDE_SETTINGS = join9(homedir7(), ".claude", "settings.json");
-  CLAUDE_SKILLS_ROOT = join9(homedir7(), ".claude", "skills");
+  CLAUDE_CONFIG = join9(homedir6(), ".claude.json");
+  CLAUDE_SETTINGS = join9(homedir6(), ".claude", "settings.json");
+  CLAUDE_SKILLS_ROOT = join9(homedir6(), ".claude", "skills");
   CLAUDEMESH_TOOLS = [
     "mcp__claudemesh__cancel_scheduled",
     "mcp__claudemesh__check_messages",
@@ -11838,35 +11885,35 @@ var exports_uninstall = {};
 __export(exports_uninstall, {
   uninstall: () => uninstall
 });
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync11, existsSync as existsSync14, rmSync as rmSync2, readdirSync as readdirSync2 } from "node:fs";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync12, existsSync as existsSync13, rmSync as rmSync2, readdirSync as readdirSync2 } from "node:fs";
 import { join as join10, dirname as dirname7 } from "node:path";
-import { homedir as homedir8 } from "node:os";
+import { homedir as homedir7 } from "node:os";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function bundledSkillsDir() {
   const here = fileURLToPath2(import.meta.url);
   const pkgRoot = join10(dirname7(here), "..", "..");
   const skillsDir = join10(pkgRoot, "skills");
-  return existsSync14(skillsDir) ? skillsDir : null;
+  return existsSync13(skillsDir) ? skillsDir : null;
 }
 async function uninstall() {
   let removed = 0;
-  if (existsSync14(PATHS.CLAUDE_JSON)) {
+  if (existsSync13(PATHS.CLAUDE_JSON)) {
     try {
-      const raw = readFileSync11(PATHS.CLAUDE_JSON, "utf-8");
+      const raw = readFileSync12(PATHS.CLAUDE_JSON, "utf-8");
       const config = JSON.parse(raw);
       const servers = config.mcpServers;
       if (servers && "claudemesh" in servers) {
         delete servers.claudemesh;
-        writeFileSync11(PATHS.CLAUDE_JSON, JSON.stringify(config, null, 2) + `
+        writeFileSync12(PATHS.CLAUDE_JSON, JSON.stringify(config, null, 2) + `
 `, "utf-8");
         render.ok("removed MCP server", dim("~/.claude.json"));
         removed++;
       }
     } catch {}
   }
-  if (existsSync14(PATHS.CLAUDE_SETTINGS)) {
+  if (existsSync13(PATHS.CLAUDE_SETTINGS)) {
     try {
-      const raw = readFileSync11(PATHS.CLAUDE_SETTINGS, "utf-8");
+      const raw = readFileSync12(PATHS.CLAUDE_SETTINGS, "utf-8");
       const config = JSON.parse(raw);
       const hooks = config.hooks;
       if (hooks) {
@@ -11887,7 +11934,7 @@ async function uninstall() {
           }
         }
         if (removedHooks > 0) {
-          writeFileSync11(PATHS.CLAUDE_SETTINGS, JSON.stringify(config, null, 2) + `
+          writeFileSync12(PATHS.CLAUDE_SETTINGS, JSON.stringify(config, null, 2) + `
 `, "utf-8");
           render.ok(`removed ${removedHooks} claudemesh hook${removedHooks === 1 ? "" : "s"}`, dim("settings.json"));
           removed++;
@@ -11903,7 +11950,7 @@ async function uninstall() {
         if (!entry.isDirectory())
           continue;
         const dst = join10(CLAUDE_SKILLS_ROOT2, entry.name);
-        if (existsSync14(dst)) {
+        if (existsSync13(dst)) {
           try {
             rmSync2(dst, { recursive: true, force: true });
             removedSkills.push(entry.name);
@@ -11927,7 +11974,7 @@ var init_uninstall = __esm(() => {
   init_render();
   init_styles();
   init_exit_codes();
-  CLAUDE_SKILLS_ROOT2 = join10(homedir8(), ".claude", "skills");
+  CLAUDE_SKILLS_ROOT2 = join10(homedir7(), ".claude", "skills");
 });
 
 // src/commands/doctor.ts
@@ -11935,8 +11982,8 @@ var exports_doctor = {};
 __export(exports_doctor, {
   runDoctor: () => runDoctor
 });
-import { existsSync as existsSync15, readFileSync as readFileSync12, statSync as statSync2 } from "node:fs";
-import { homedir as homedir9, platform as platform6 } from "node:os";
+import { existsSync as existsSync14, readFileSync as readFileSync13, statSync as statSync3 } from "node:fs";
+import { homedir as homedir8, platform as platform6 } from "node:os";
 import { join as join11 } from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function checkNode() {
@@ -11961,8 +12008,8 @@ function checkClaudeOnPath() {
   };
 }
 function checkMcpRegistered() {
-  const claudeConfig = join11(homedir9(), ".claude.json");
-  if (!existsSync15(claudeConfig)) {
+  const claudeConfig = join11(homedir8(), ".claude.json");
+  if (!existsSync14(claudeConfig)) {
     return {
       name: "claudemesh MCP registered in ~/.claude.json",
       pass: false,
@@ -11970,7 +12017,7 @@ function checkMcpRegistered() {
     };
   }
   try {
-    const cfg = JSON.parse(readFileSync12(claudeConfig, "utf-8"));
+    const cfg = JSON.parse(readFileSync13(claudeConfig, "utf-8"));
     const registered = Boolean(cfg.mcpServers?.["claudemesh"]);
     return {
       name: "claudemesh MCP registered in ~/.claude.json",
@@ -11987,8 +12034,8 @@ function checkMcpRegistered() {
   }
 }
 function checkHooksRegistered() {
-  const settings = join11(homedir9(), ".claude", "settings.json");
-  if (!existsSync15(settings)) {
+  const settings = join11(homedir8(), ".claude", "settings.json");
+  if (!existsSync14(settings)) {
     return {
       name: "Status hooks registered in ~/.claude/settings.json",
       pass: false,
@@ -11996,7 +12043,7 @@ function checkHooksRegistered() {
     };
   }
   try {
-    const raw = readFileSync12(settings, "utf-8");
+    const raw = readFileSync13(settings, "utf-8");
     const has = raw.includes("claudemesh hook ");
     return {
       name: "Status hooks registered in ~/.claude/settings.json",
@@ -12013,7 +12060,7 @@ function checkHooksRegistered() {
 }
 function checkConfigFile() {
   const path2 = getConfigPath();
-  if (!existsSync15(path2)) {
+  if (!existsSync14(path2)) {
     return {
       name: "~/.claudemesh/config.json exists and parses",
       pass: true,
@@ -12022,7 +12069,7 @@ function checkConfigFile() {
   }
   try {
     readConfig();
-    const st = statSync2(path2);
+    const st = statSync3(path2);
     const mode = (st.mode & 511).toString(8);
     const secure = platform6() === "win32" || mode === "600";
     return {
@@ -12196,7 +12243,7 @@ var exports_status = {};
 __export(exports_status, {
   runStatus: () => runStatus2
 });
-import { statSync as statSync3, existsSync as existsSync16 } from "node:fs";
+import { statSync as statSync4, existsSync as existsSync15 } from "node:fs";
 import WebSocket3 from "ws";
 async function probeBroker(url, timeoutMs = 4000) {
   return new Promise((resolve2) => {
@@ -12226,8 +12273,8 @@ async function runStatus2() {
   render.section(`status (v${VERSION})`);
   const configPath = getConfigPath();
   let configPermsNote = "missing";
-  if (existsSync16(configPath)) {
-    const mode = (statSync3(configPath).mode & 511).toString(8).padStart(4, "0");
+  if (existsSync15(configPath)) {
+    const mode = (statSync4(configPath).mode & 511).toString(8).padStart(4, "0");
     configPermsNote = mode === "0600" ? `${mode}` : `${mode} — expected 0600`;
   }
   render.kv([["config", configPath], ["perms", configPermsNote]]);
@@ -12372,13 +12419,13 @@ var init_check_claude_binary = __esm(() => {
 });
 
 // src/services/health/check-mcp-registered.ts
-import { existsSync as existsSync17, readFileSync as readFileSync13 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync14 } from "node:fs";
 function checkMcpRegistered2() {
   try {
-    if (!existsSync17(PATHS.CLAUDE_JSON)) {
+    if (!existsSync16(PATHS.CLAUDE_JSON)) {
       return { name: "mcp-registered", ok: false, message: "~/.claude.json not found" };
     }
-    const raw = readFileSync13(PATHS.CLAUDE_JSON, "utf-8");
+    const raw = readFileSync14(PATHS.CLAUDE_JSON, "utf-8");
     const config = JSON.parse(raw);
     if (config.mcpServers && "claudemesh" in config.mcpServers) {
       return { name: "mcp-registered", ok: true, message: "MCP server registered" };
@@ -12393,13 +12440,13 @@ var init_check_mcp_registered = __esm(() => {
 });
 
 // src/services/health/check-hooks-registered.ts
-import { existsSync as existsSync18, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync15 } from "node:fs";
 function checkHooksRegistered2() {
   try {
-    if (!existsSync18(PATHS.CLAUDE_SETTINGS)) {
+    if (!existsSync17(PATHS.CLAUDE_SETTINGS)) {
       return { name: "hooks-registered", ok: false, message: "~/.claude/settings.json not found" };
     }
-    const raw = readFileSync14(PATHS.CLAUDE_SETTINGS, "utf-8");
+    const raw = readFileSync15(PATHS.CLAUDE_SETTINGS, "utf-8");
     const config = JSON.parse(raw);
     if (config.hooks) {
       return { name: "hooks-registered", ok: true, message: "Hooks configured" };
@@ -12414,14 +12461,14 @@ var init_check_hooks_registered = __esm(() => {
 });
 
 // src/services/health/check-config-perms.ts
-import { existsSync as existsSync19, statSync as statSync4 } from "node:fs";
+import { existsSync as existsSync18, statSync as statSync5 } from "node:fs";
 function checkConfigPerms() {
   const configFile = PATHS.CONFIG_FILE;
-  if (!existsSync19(configFile)) {
+  if (!existsSync18(configFile)) {
     return { name: "config-perms", ok: true, message: "No config file yet (first run)" };
   }
   try {
-    const mode = statSync4(configFile).mode & 511;
+    const mode = statSync5(configFile).mode & 511;
     if (mode <= 384) {
       return { name: "config-perms", ok: true, message: `config.json mode ${mode.toString(8)}` };
     }
@@ -12435,13 +12482,13 @@ var init_check_config_perms = __esm(() => {
 });
 
 // src/services/health/check-keypairs-valid.ts
-import { existsSync as existsSync20, readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync16 } from "node:fs";
 function checkKeypairsValid() {
-  if (!existsSync20(PATHS.CONFIG_FILE)) {
+  if (!existsSync19(PATHS.CONFIG_FILE)) {
     return { name: "keypairs-valid", ok: true, message: "No config (first run)" };
   }
   try {
-    const raw = readFileSync15(PATHS.CONFIG_FILE, "utf-8");
+    const raw = readFileSync16(PATHS.CONFIG_FILE, "utf-8");
     const config = JSON.parse(raw);
     const meshes = config.meshes ?? [];
     if (meshes.length === 0) {
@@ -12921,8 +12968,8 @@ var exports_url_handler = {};
 __export(exports_url_handler, {
   runUrlHandler: () => runUrlHandler
 });
-import { platform as platform7, homedir as homedir10 } from "node:os";
-import { existsSync as existsSync21, mkdirSync as mkdirSync9, writeFileSync as writeFileSync12, rmSync as rmSync3, chmodSync as chmodSync5 } from "node:fs";
+import { platform as platform7, homedir as homedir9 } from "node:os";
+import { existsSync as existsSync20, mkdirSync as mkdirSync9, writeFileSync as writeFileSync13, rmSync as rmSync3, chmodSync as chmodSync5 } from "node:fs";
 import { join as join12 } from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function resolveClaudemeshBin() {
@@ -12930,7 +12977,7 @@ function resolveClaudemeshBin() {
 }
 function installDarwin2() {
   const binPath = resolveClaudemeshBin();
-  const appDir = join12(homedir10(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
+  const appDir = join12(homedir9(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
   const contents = join12(appDir, "Contents");
   const macOS = join12(contents, "MacOS");
   mkdirSync9(macOS, { recursive: true });
@@ -12956,7 +13003,7 @@ function installDarwin2() {
   </array>
 </dict>
 </plist>`;
-  writeFileSync12(join12(contents, "Info.plist"), plist);
+  writeFileSync13(join12(contents, "Info.plist"), plist);
   const shim = `#!/bin/sh
 URL="$1"
 CODE=\${URL#claudemesh://}
@@ -12971,7 +13018,7 @@ end tell
 EOF
 `;
   const shimPath = join12(macOS, "open-url");
-  writeFileSync12(shimPath, shim);
+  writeFileSync13(shimPath, shim);
   chmodSync5(shimPath, 493);
   const lsreg = spawnSync5("/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister", ["-f", appDir], { encoding: "utf-8" });
   if (lsreg.status !== 0) {
@@ -12982,7 +13029,7 @@ EOF
 }
 function installLinux2() {
   const binPath = resolveClaudemeshBin();
-  const appsDir = join12(homedir10(), ".local", "share", "applications");
+  const appsDir = join12(homedir9(), ".local", "share", "applications");
   mkdirSync9(appsDir, { recursive: true });
   const desktop = `[Desktop Entry]
 Type=Application
@@ -12995,7 +13042,7 @@ MimeType=x-scheme-handler/claudemesh;
 NoDisplay=true
 `;
   const desktopPath = join12(appsDir, "claudemesh.desktop");
-  writeFileSync12(desktopPath, desktop);
+  writeFileSync13(desktopPath, desktop);
   const xdg1 = spawnSync5("xdg-mime", ["default", "claudemesh.desktop", "x-scheme-handler/claudemesh"], { encoding: "utf-8" });
   if (xdg1.status !== 0) {
     render.warn("xdg-mime not available — skipped mime default registration");
@@ -13017,8 +13064,8 @@ function installWindows() {
     `[HKEY_CURRENT_USER\\Software\\Classes\\claudemesh\\shell\\open\\command]`,
     `@="\\"${binPath.replace(/\\/g, "\\\\")}\\" \\"%1\\""`
   ];
-  const regPath = join12(homedir10(), "claudemesh-handler.reg");
-  writeFileSync12(regPath, lines.join(`\r
+  const regPath = join12(homedir9(), "claudemesh-handler.reg");
+  writeFileSync13(regPath, lines.join(`\r
 `));
   const res = spawnSync5("reg.exe", ["import", regPath], { encoding: "utf-8" });
   if (res.status !== 0) {
@@ -13029,15 +13076,15 @@ function installWindows() {
   return EXIT.SUCCESS;
 }
 function uninstallDarwin() {
-  const appDir = join12(homedir10(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
-  if (existsSync21(appDir))
+  const appDir = join12(homedir9(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
+  if (existsSync20(appDir))
     rmSync3(appDir, { recursive: true, force: true });
   render.ok("removed claudemesh:// handler on macOS");
   return EXIT.SUCCESS;
 }
 function uninstallLinux() {
-  const desktopPath = join12(homedir10(), ".local", "share", "applications", "claudemesh.desktop");
-  if (existsSync21(desktopPath))
+  const desktopPath = join12(homedir9(), ".local", "share", "applications", "claudemesh.desktop");
+  if (existsSync20(desktopPath))
     rmSync3(desktopPath, { force: true });
   render.ok("removed claudemesh:// handler on Linux");
   return EXIT.SUCCESS;
@@ -13082,9 +13129,9 @@ var exports_status_line = {};
 __export(exports_status_line, {
   runStatusLine: () => runStatusLine
 });
-import { existsSync as existsSync22, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync21, readFileSync as readFileSync17 } from "node:fs";
 import { join as join13 } from "node:path";
-import { homedir as homedir11 } from "node:os";
+import { homedir as homedir10 } from "node:os";
 async function runStatusLine() {
   try {
     const config = readConfig();
@@ -13092,11 +13139,11 @@ async function runStatusLine() {
       process.stdout.write("◇ claudemesh (not joined)");
       return EXIT.SUCCESS;
     }
-    const cachePath = join13(homedir11(), ".claudemesh", "peer-cache.json");
+    const cachePath = join13(homedir10(), ".claudemesh", "peer-cache.json");
     let cache = {};
-    if (existsSync22(cachePath)) {
+    if (existsSync21(cachePath)) {
       try {
-        cache = JSON.parse(readFileSync16(cachePath, "utf-8"));
+        cache = JSON.parse(readFileSync17(cachePath, "utf-8"));
       } catch {}
     }
     const pick = config.meshes[0];
@@ -13127,7 +13174,7 @@ __export(exports_backup, {
   runRestore: () => runRestore,
   runBackup: () => runBackup
 });
-import { readFileSync as readFileSync17, writeFileSync as writeFileSync13, existsSync as existsSync23 } from "node:fs";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync14, existsSync as existsSync22 } from "node:fs";
 import { createInterface as createInterface11 } from "node:readline";
 function readHidden(prompt5) {
   return new Promise((resolve2) => {
@@ -13169,11 +13216,11 @@ async function deriveKey(pass, salt, s) {
 }
 async function runBackup(outPath) {
   const configPath = getConfigPath();
-  if (!existsSync23(configPath)) {
+  if (!existsSync22(configPath)) {
     console.error("  No config found — nothing to back up. Join a mesh first.");
     return EXIT.NOT_FOUND;
   }
-  const plaintext = readFileSync17(configPath);
+  const plaintext = readFileSync18(configPath);
   const pass = await readHidden("  Passphrase (min 12 chars): ");
   if (pass.length < 12) {
     console.error("  ✗ Passphrase too short.");
@@ -13191,7 +13238,7 @@ async function runBackup(outPath) {
   const ciphertext = Buffer.from(s.crypto_aead_xchacha20poly1305_ietf_encrypt(plaintext, null, null, nonce, key));
   const blob = Buffer.concat([MAGIC, salt, nonce, ciphertext]);
   const file = outPath ?? `claudemesh-backup-${new Date().toISOString().replace(/[:.]/g, "-")}.cmb`;
-  writeFileSync13(file, blob, { mode: 384 });
+  writeFileSync14(file, blob, { mode: 384 });
   console.log(`
   ✓ Backup saved: ${file}`);
   console.log(`  Size: ${blob.length} bytes. Guard the passphrase — there is no recovery.
@@ -13203,11 +13250,11 @@ async function runRestore(inPath) {
     console.error("  Usage: claudemesh restore <backup-file>");
     return EXIT.INVALID_ARGS;
   }
-  if (!existsSync23(inPath)) {
+  if (!existsSync22(inPath)) {
     console.error(`  ✗ File not found: ${inPath}`);
     return EXIT.NOT_FOUND;
   }
-  const blob = readFileSync17(inPath);
+  const blob = readFileSync18(inPath);
   if (blob.length < 4 + 16 + 24 + 17 || !blob.subarray(0, 4).equals(MAGIC)) {
     console.error("  ✗ Not a claudemesh backup file (bad magic).");
     return EXIT.INVALID_ARGS;
@@ -13226,12 +13273,12 @@ async function runRestore(inPath) {
     return EXIT.INTERNAL_ERROR;
   }
   const configPath = getConfigPath();
-  if (existsSync23(configPath)) {
+  if (existsSync22(configPath)) {
     const backupOld = `${configPath}.before-restore.${Date.now()}`;
-    writeFileSync13(backupOld, readFileSync17(configPath), { mode: 384 });
+    writeFileSync14(backupOld, readFileSync18(configPath), { mode: 384 });
     console.log(`  ↻ Existing config saved to ${backupOld}`);
   }
-  writeFileSync13(configPath, Buffer.from(plaintext), { mode: 384 });
+  writeFileSync14(configPath, Buffer.from(plaintext), { mode: 384 });
   console.log(`
   ✓ Config restored to ${configPath}`);
   console.log("  Run `claudemesh list` to verify your meshes.\n");
@@ -13251,7 +13298,7 @@ __export(exports_upgrade, {
   runUpgrade: () => runUpgrade
 });
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync24 } from "node:fs";
+import { existsSync as existsSync23 } from "node:fs";
 import { dirname as dirname8, join as join14, resolve as resolve2 } from "node:path";
 async function latestVersion() {
   try {
@@ -13266,14 +13313,14 @@ async function latestVersion() {
 }
 function findNpm() {
   const portable = join14(process.env.HOME ?? "", ".claudemesh", "node", "bin", "npm");
-  if (existsSync24(portable)) {
+  if (existsSync23(portable)) {
     return { npm: portable, prefix: join14(process.env.HOME ?? "", ".claudemesh") };
   }
   let cur = resolve2(process.argv[1] ?? ".");
   for (let i = 0;i < 6; i++) {
     cur = dirname8(cur);
     const candidate = join14(cur, "bin", "npm");
-    if (existsSync24(candidate))
+    if (existsSync23(candidate))
       return { npm: candidate };
   }
   return { npm: "npm" };
@@ -13335,8 +13382,8 @@ __export(exports_grants, {
   runBlock: () => runBlock,
   isAllowed: () => isAllowed
 });
-import { existsSync as existsSync25, mkdirSync as mkdirSync10, readFileSync as readFileSync18, writeFileSync as writeFileSync14 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
+import { existsSync as existsSync24, mkdirSync as mkdirSync10, readFileSync as readFileSync19, writeFileSync as writeFileSync15 } from "node:fs";
+import { homedir as homedir11 } from "node:os";
 import { join as join15 } from "node:path";
 async function syncToBroker(meshSlug, grants) {
   const auth = getStoredToken();
@@ -13355,19 +13402,19 @@ async function syncToBroker(meshSlug, grants) {
   }
 }
 function readGrants() {
-  if (!existsSync25(GRANT_FILE))
+  if (!existsSync24(GRANT_FILE))
     return {};
   try {
-    return JSON.parse(readFileSync18(GRANT_FILE, "utf-8"));
+    return JSON.parse(readFileSync19(GRANT_FILE, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeGrants(g) {
-  const dir = join15(homedir12(), ".claudemesh");
-  if (!existsSync25(dir))
+  const dir = join15(homedir11(), ".claudemesh");
+  if (!existsSync24(dir))
     mkdirSync10(dir, { recursive: true });
-  writeFileSync14(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
+  writeFileSync15(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
 }
 function resolveCaps(input) {
   if (input.includes("all"))
@@ -13523,7 +13570,7 @@ var init_grants = __esm(() => {
   BROKER_HTTP7 = URLS.BROKER.replace("wss://", "https://").replace("ws://", "http://").replace("/ws", "");
   ALL_CAPS = ["read", "dm", "broadcast", "state-read", "state-write", "file-read"];
   DEFAULT_CAPS = ["read", "dm", "broadcast", "state-read"];
-  GRANT_FILE = join15(homedir12(), ".claudemesh", "grants.json");
+  GRANT_FILE = join15(homedir11(), ".claudemesh", "grants.json");
 });
 
 // src/commands/profile.ts
@@ -15205,7 +15252,7 @@ __export(exports_file, {
 });
 import { hostname as osHostname } from "node:os";
 import { resolve as resolvePath, basename, dirname as dirname9 } from "node:path";
-import { statSync as statSync6, existsSync as existsSync26, writeFileSync as writeFileSync15, mkdirSync as mkdirSync11 } from "node:fs";
+import { statSync as statSync7, existsSync as existsSync25, writeFileSync as writeFileSync16, mkdirSync as mkdirSync11 } from "node:fs";
 function emitJson2(data) {
   console.log(JSON.stringify(data, null, 2));
 }
@@ -15222,11 +15269,11 @@ async function runFileShare(filePath, opts) {
     return EXIT.INVALID_ARGS;
   }
   const absPath = resolvePath(filePath);
-  if (!existsSync26(absPath)) {
+  if (!existsSync25(absPath)) {
     render.err(`File not found: ${absPath}`);
     return EXIT.INVALID_ARGS;
   }
-  const stat = statSync6(absPath);
+  const stat = statSync7(absPath);
   if (!stat.isFile()) {
     render.err(`Not a regular file: ${absPath}`);
     return EXIT.INVALID_ARGS;
@@ -15302,7 +15349,7 @@ async function runFileGet(fileId, opts) {
     const buf = Buffer.from(await res.arrayBuffer());
     const outPath = opts.out ? resolvePath(opts.out) : resolvePath(process.cwd(), meta.name);
     mkdirSync11(dirname9(outPath), { recursive: true });
-    writeFileSync15(outPath, buf);
+    writeFileSync16(outPath, buf);
     if (opts.json) {
       emitJson2({ fileId, name: meta.name, savedTo: outPath, sizeBytes: buf.length });
     } else {
@@ -15912,7 +15959,7 @@ __export(exports_bridge, {
   runBridge: () => runBridge,
   bridgeConfigTemplate: () => bridgeConfigTemplate
 });
-import { readFileSync as readFileSync19, existsSync as existsSync27 } from "node:fs";
+import { readFileSync as readFileSync20, existsSync as existsSync26 } from "node:fs";
 function parseConfig(text) {
   const trimmed = text.trim();
   if (trimmed.startsWith("{"))
@@ -15956,13 +16003,13 @@ async function runBridge(configPath) {
     render.err("Usage: claudemesh bridge run <config.yaml>");
     return EXIT.INVALID_ARGS;
   }
-  if (!existsSync27(configPath)) {
+  if (!existsSync26(configPath)) {
     render.err(`config file not found: ${configPath}`);
     return EXIT.NOT_FOUND;
   }
   let cfg;
   try {
-    cfg = parseConfig(readFileSync19(configPath, "utf-8"));
+    cfg = parseConfig(readFileSync20(configPath, "utf-8"));
   } catch (e) {
     render.err(`failed to parse ${configPath}: ${e instanceof Error ? e.message : String(e)}`);
     return EXIT.INVALID_ARGS;
@@ -16936,11 +16983,11 @@ import {
   ListResourcesRequestSchema,
   ReadResourceRequestSchema
 } from "@modelcontextprotocol/sdk/types.js";
-import { existsSync as existsSync28 } from "node:fs";
+import { existsSync as existsSync27 } from "node:fs";
 import { request as httpRequest2 } from "node:http";
 async function daemonReady() {
   for (let i = 0;i < DAEMON_BOOT_RETRIES; i++) {
-    if (existsSync28(DAEMON_PATHS.SOCK_FILE))
+    if (existsSync27(DAEMON_PATHS.SOCK_FILE))
       return true;
     await new Promise((r) => setTimeout(r, DAEMON_BOOT_RETRY_MS));
   }
@@ -18017,10 +18064,12 @@ async function gate(ctx, opts) {
 }
 
 // src/entrypoints/cli.ts
+init_policy();
 init_styles();
 installSignalHandlers();
 installErrorHandlers();
 var { command, positionals, flags } = parseArgv(process.argv);
+setDaemonPolicy(policyFromFlags(flags));
 function resolveApprovalMode() {
   const raw = flags["approval-mode"] ?? process.env.CLAUDEMESH_APPROVAL_MODE ?? null;
   if (raw === "plan" || raw === "read-only" || raw === "write" || raw === "yolo")
@@ -18197,6 +18246,8 @@ Flags
   --policy <path>                  override policy file
   -y, --yes                        skip confirmations (= --approval-mode yolo)
   -q, --quiet                      suppress non-essential output
+  --strict                         require daemon for broker-touching verbs (no cold-path fallback)
+  --no-daemon                      skip daemon entirely; open broker WS directly (CI / sandboxed scripts)
 `;
 function colorizeHelp(raw) {
   const lines = raw.split(`
@@ -19238,4 +19289,4 @@ main().catch((err) => {
   process.exit(EXIT.INTERNAL_ERROR);
 });
 
-//# debugId=856EC7628E8E9AE364756E2164756E21
+//# debugId=04E4A5313AE4F0EA64756E2164756E21