claudemesh-cli 1.27.3 → 1.28.0

package/dist/entrypoints/cli.js

@@ -103,7 +103,7 @@ __export(exports_urls, {
   VERSION: () => VERSION,
   URLS: () => URLS
 });
-var URLS, VERSION = "1.27.3", env;
+var URLS, VERSION = "1.28.0", env;
 var init_urls = __esm(() => {
   URLS = {
     BROKER: process.env.CLAUDEMESH_BROKER_URL ?? "wss://ic.claudemesh.com/ws",
@@ -150,6 +150,32 @@ function normaliseInviteUrl(input, host = "claudemesh.com") {
   return trimmed;
 }
 
+// src/services/daemon/policy.ts
+function readEnvDefault() {
+  if (process.env.CLAUDEMESH_NO_DAEMON === "1")
+    return { mode: "no-daemon" };
+  if (process.env.CLAUDEMESH_STRICT_DAEMON === "1")
+    return { mode: "strict" };
+  return { mode: "auto" };
+}
+function setDaemonPolicy(mode) {
+  policy = { mode };
+}
+function getDaemonPolicy() {
+  return policy;
+}
+function policyFromFlags(flags) {
+  if (flags["no-daemon"])
+    return "no-daemon";
+  if (flags.strict)
+    return "strict";
+  return readEnvDefault().mode;
+}
+var policy;
+var init_policy = __esm(() => {
+  policy = readEnvDefault();
+});
+
 // src/constants/paths.ts
 import { homedir as homedir2 } from "node:os";
 import { join as join2 } from "node:path";
@@ -6699,6 +6725,12 @@ async function pickMesh(meshes) {
   });
 }
 async function withMesh(opts, fn) {
+  if (getDaemonPolicy().mode === "strict") {
+    console.error(`
+  ✘ daemon not reachable — --strict refuses cold-path fallback.
+` + "    run `claudemesh daemon up` (or `claudemesh doctor`) and retry.\n");
+    process.exit(1);
+  }
   const config = readConfig();
   if (config.meshes.length === 0) {
     console.error("No meshes joined. Run `claudemesh join <url>` first.");
@@ -6749,6 +6781,7 @@ async function withMesh(opts, fn) {
 var init_connect = __esm(() => {
   init_facade8();
   init_facade();
+  init_policy();
 });
 
 // src/commands/info.ts
@@ -7385,107 +7418,6 @@ var init_ban = __esm(() => {
   init_exit_codes();
 });
 
-// src/services/bridge/protocol.ts
-import { homedir as homedir5 } from "node:os";
-import { join as join7 } from "node:path";
-function socketPath(meshSlug) {
-  return join7(homedir5(), ".claudemesh", "sockets", `${meshSlug}.sock`);
-}
-function frame(obj) {
-  return JSON.stringify(obj) + `
-`;
-}
-
-class LineParser {
-  buf = "";
-  feed(chunk) {
-    this.buf += typeof chunk === "string" ? chunk : chunk.toString("utf-8");
-    const lines = [];
-    let nl = this.buf.indexOf(`
-`);
-    while (nl !== -1) {
-      lines.push(this.buf.slice(0, nl));
-      this.buf = this.buf.slice(nl + 1);
-      nl = this.buf.indexOf(`
-`);
-    }
-    return lines;
-  }
-}
-var init_protocol = () => {};
-
-// src/services/bridge/client.ts
-import { createConnection } from "node:net";
-import { existsSync as existsSync7 } from "node:fs";
-import { randomUUID as randomUUID2 } from "node:crypto";
-async function tryBridge(meshSlug, verb, args = {}, timeoutMs = DEFAULT_TIMEOUT_MS) {
-  const path = socketPath(meshSlug);
-  if (!existsSync7(path))
-    return null;
-  return new Promise((resolve) => {
-    const id = randomUUID2();
-    const req = { id, verb, args };
-    const parser = new LineParser;
-    let settled = false;
-    const finish = (value) => {
-      if (settled)
-        return;
-      settled = true;
-      try {
-        socket.destroy();
-      } catch {}
-      clearTimeout(timer);
-      resolve(value);
-    };
-    const socket = createConnection({ path });
-    const timer = setTimeout(() => {
-      finish(null);
-    }, timeoutMs);
-    socket.on("connect", () => {
-      try {
-        socket.write(frame(req));
-      } catch {
-        finish(null);
-      }
-    });
-    socket.on("data", (chunk) => {
-      const lines = parser.feed(chunk);
-      for (const line of lines) {
-        if (!line.trim())
-          continue;
-        let res;
-        try {
-          res = JSON.parse(line);
-        } catch {
-          continue;
-        }
-        if (res.id !== id)
-          continue;
-        if (res.ok)
-          finish({ ok: true, result: res.result });
-        else
-          finish({ ok: false, error: res.error });
-        return;
-      }
-    });
-    socket.on("error", (err) => {
-      const code = err.code;
-      if (code === "ECONNREFUSED" || code === "ENOENT" || code === "EPERM") {
-        finish(null);
-      } else {
-        finish(null);
-      }
-    });
-    socket.on("close", () => {
-      finish(null);
-    });
-  });
-}
-var DEFAULT_TIMEOUT_MS = 5000;
-var init_client4 = __esm(() => {
-  init_protocol();
-});
-
 // src/ui/warnings.ts
 function warnDaemonState(res, opts = {}) {
   if (alreadyWarned)
@@ -7494,6 +7426,8 @@ function warnDaemonState(res, opts = {}) {
     return false;
   if (res.state === "up")
     return false;
+  if (getDaemonPolicy().mode === "strict" && res.state !== "started")
+    return false;
   alreadyWarned = true;
   const tag = (label) => `[claudemesh] ${label}`;
   const hint = (s) => dim(s);
@@ -7519,6 +7453,7 @@ function warnDaemonState(res, opts = {}) {
 }
 var alreadyWarned = false;
 var init_warnings = __esm(() => {
+  init_policy();
   init_styles();
 });
 
@@ -7540,7 +7475,10 @@ function meshQuery(mesh) {
   return mesh ? `?mesh=${encodeURIComponent(mesh)}` : "";
 }
 async function daemonReachable() {
-  const res = await ensureDaemonReady();
+  const policy2 = getDaemonPolicy();
+  if (policy2.mode === "no-daemon")
+    return false;
+  const res = await ensureDaemonReady({ noAutoSpawn: false });
   warnDaemonState(res, {});
   return res.state === "up" || res.state === "started";
 }
@@ -7718,6 +7656,7 @@ async function trySendViaDaemon(args) {
 var init_daemon_route = __esm(() => {
   init_client3();
   init_lifecycle();
+  init_policy();
   init_warnings();
 });
 
@@ -7745,11 +7684,6 @@ async function listPeersForMesh(slug) {
       return dr.map((p) => annotateSelf(p, selfMemberPubkey, null));
     }
   } catch {}
-  const bridged = await tryBridge(slug, "peers");
-  if (bridged && bridged.ok) {
-    const peers = bridged.result;
-    return peers.map((p) => annotateSelf(p, selfMemberPubkey, null));
-  }
   let result = [];
   await withMesh({ meshSlug: slug }, async (client) => {
     const all = await client.listPeers();
@@ -7819,7 +7753,6 @@ var FIELD_ALIAS;
 var init_peers = __esm(() => {
   init_connect();
   init_facade();
-  init_client4();
   init_render();
   init_styles();
   FIELD_ALIAS = {
@@ -7865,26 +7798,6 @@ async function runSend(flags, to, message) {
       process.exit(1);
     }
   }
-  if (meshSlug) {
-    const bridged = await tryBridge(meshSlug, "send", { to, message, priority });
-    if (bridged !== null) {
-      if (bridged.ok) {
-        const r = bridged.result;
-        if (flags.json) {
-          console.log(JSON.stringify({ ok: true, messageId: r.messageId, target: to }));
-        } else {
-          render.ok(`sent to ${to}`, r.messageId ? dim(r.messageId.slice(0, 8)) : undefined);
-        }
-        return;
-      }
-      if (flags.json) {
-        console.log(JSON.stringify({ ok: false, error: bridged.error }));
-      } else {
-        render.err(`send failed: ${bridged.error}`);
-      }
-      process.exit(1);
-    }
-  }
   await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
     let targetSpec = to;
     if (to.startsWith("#") && !/^#[0-9a-z_-]{20,}$/i.test(to)) {
@@ -7927,7 +7840,6 @@ async function runSend(flags, to, message) {
 var init_send = __esm(() => {
   init_connect();
   init_facade();
-  init_client4();
   init_daemon_route();
   init_render();
   init_styles();
@@ -8255,33 +8167,12 @@ __export(exports_broker_actions, {
   runForget: () => runForget,
   runClock: () => runClock
 });
-function unambiguousMesh(opts) {
-  if (opts.mesh)
-    return opts.mesh;
-  const config = readConfig();
-  return config.meshes.length === 1 ? config.meshes[0].slug : null;
-}
 async function runStatusSet(state, opts) {
   const valid = ["idle", "working", "dnd"];
   if (!valid.includes(state)) {
     render.err(`Invalid status: ${state}`, `must be one of: ${valid.join(", ")}`);
     return EXIT.INVALID_ARGS;
   }
-  const meshSlug = unambiguousMesh(opts);
-  if (meshSlug) {
-    const bridged = await tryBridge(meshSlug, "status_set", { status: state });
-    if (bridged !== null) {
-      if (bridged.ok) {
-        if (opts.json)
-          console.log(JSON.stringify({ status: state }));
-        else
-          render.ok(`status set to ${bold(state)}`);
-        return EXIT.SUCCESS;
-      }
-      render.err(bridged.error);
-      return EXIT.INTERNAL_ERROR;
-    }
-  }
   await withMesh({ meshSlug: opts.mesh ?? null }, async (client) => {
     await client.setStatus(state);
   });
@@ -8296,21 +8187,6 @@ async function runSummary(text, opts) {
     render.err("Usage: claudemesh summary <text>");
     return EXIT.INVALID_ARGS;
   }
-  const meshSlug = unambiguousMesh(opts);
-  if (meshSlug) {
-    const bridged = await tryBridge(meshSlug, "summary", { summary: text });
-    if (bridged !== null) {
-      if (bridged.ok) {
-        if (opts.json)
-          console.log(JSON.stringify({ summary: text }));
-        else
-          render.ok("summary set", dim(text));
-        return EXIT.SUCCESS;
-      }
-      render.err(bridged.error);
-      return EXIT.INTERNAL_ERROR;
-    }
-  }
   await withMesh({ meshSlug: opts.mesh ?? null }, async (client) => {
     await client.setSummary(text);
   });
@@ -8330,21 +8206,6 @@ async function runVisible(value, opts) {
     render.err("Usage: claudemesh visible <true|false>");
     return EXIT.INVALID_ARGS;
   }
-  const meshSlug = unambiguousMesh(opts);
-  if (meshSlug) {
-    const bridged = await tryBridge(meshSlug, "visible", { visible });
-    if (bridged !== null) {
-      if (bridged.ok) {
-        if (opts.json)
-          console.log(JSON.stringify({ visible }));
-        else
-          render.ok(visible ? "you are now visible to peers" : "you are now hidden", visible ? undefined : "direct messages still reach you");
-        return EXIT.SUCCESS;
-      }
-      render.err(bridged.error);
-      return EXIT.INTERNAL_ERROR;
-    }
-  }
   await withMesh({ meshSlug: opts.mesh ?? null }, async (client) => {
     await client.setVisible(visible);
   });
@@ -8574,8 +8435,6 @@ async function runTaskComplete(id, result, opts) {
 }
 var init_broker_actions = __esm(() => {
   init_connect();
-  init_facade();
-  init_client4();
   init_daemon_route();
   init_render();
   init_styles();
@@ -8810,11 +8669,11 @@ var init_whoami = __esm(() => {
 });
 
 // src/daemon/lock.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync7, unlinkSync as unlinkSync3, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync7, unlinkSync as unlinkSync3, writeFileSync as writeFileSync8 } from "node:fs";
 import { dirname as dirname4 } from "node:path";
 function acquireSingletonLock() {
   mkdirSync5(dirname4(DAEMON_PATHS.PID_FILE), { recursive: true, mode: 448 });
-  if (existsSync8(DAEMON_PATHS.PID_FILE)) {
+  if (existsSync7(DAEMON_PATHS.PID_FILE)) {
     const raw = readFileSync7(DAEMON_PATHS.PID_FILE, "utf8").trim();
     const oldPid = Number.parseInt(raw, 10);
     if (Number.isFinite(oldPid) && oldPid > 0 && isProcessAlive(oldPid)) {
@@ -9074,10 +8933,10 @@ var init_fingerprint = __esm(() => {
 });
 
 // src/daemon/ipc/handlers/send.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 function acceptSend(req, deps) {
   const now = (deps.now ?? Date.now)();
-  const newId = deps.newId ?? randomUUID3;
+  const newId = deps.newId ?? randomUUID2;
   const clientId = req.client_message_id?.trim() || ulidLike(newId);
   const body = Buffer.from(req.message, "utf8");
   const fingerprint = computeRequestFingerprint({
@@ -9270,9 +9129,9 @@ function bindSseStream(res, bus) {
 
 // src/daemon/ipc/server.ts
 import { createServer as createServer2 } from "node:http";
-import { chmodSync as chmodSync3, existsSync as existsSync9, unlinkSync as unlinkSync4 } from "node:fs";
+import { chmodSync as chmodSync3, existsSync as existsSync8, unlinkSync as unlinkSync4 } from "node:fs";
 import { timingSafeEqual } from "node:crypto";
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 function startIpcServer(opts) {
   const log2 = opts.log ?? defaultLogger;
   const handler = makeHandler({
@@ -9286,7 +9145,7 @@ function startIpcServer(opts) {
     meshConfigs: opts.meshConfigs,
     onPendingInserted: opts.onPendingInserted
   });
-  if (existsSync9(DAEMON_PATHS.SOCK_FILE)) {
+  if (existsSync8(DAEMON_PATHS.SOCK_FILE)) {
     try {
       unlinkSync4(DAEMON_PATHS.SOCK_FILE);
     } catch {}
@@ -9743,11 +9602,11 @@ function makeHandler(opts) {
           respond(res, 400, { error: "missing 'id'" });
           return;
         }
-        const newId = typeof body.new_client_message_id === "string" && body.new_client_message_id.trim() ? body.new_client_message_id.trim() : randomUUID4();
+        const newId = typeof body.new_client_message_id === "string" && body.new_client_message_id.trim() ? body.new_client_message_id.trim() : randomUUID3();
         const result = requeueDeadOrPending(opts.outboxDb, {
           id: body.id,
           newClientMessageId: newId,
-          newRowId: randomUUID4(),
+          newRowId: randomUUID3(),
           now: Date.now(),
           abortedBy: typeof body.aborted_by === "string" ? body.aborted_by : "operator"
         });
@@ -10614,7 +10473,7 @@ var POLL_INTERVAL_MS = 500, MAX_ATTEMPTS_PER_ROW = 25, BACKOFF_BASE_MS = 500, BA
 var init_drain = () => {};
 
 // src/daemon/inbound.ts
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 async function handleBrokerPush(msg, ctx) {
   if (msg.subtype === "system" && typeof msg.event === "string") {
     ctx.bus.publish(mapSystemEventKind(msg.event), {
@@ -10637,14 +10496,14 @@ async function handleBrokerPush(msg, ctx) {
   const createdAt = stringOrNull(msg.createdAt);
   const priority = stringOrNull(msg.priority) ?? "next";
   const subtype = stringOrNull(msg.subtype);
-  const clientMessageId = stringOrNull(msg.client_message_id) ?? brokerMessageId ?? randomUUID5();
+  const clientMessageId = stringOrNull(msg.client_message_id) ?? brokerMessageId ?? randomUUID4();
   const body = await decryptOrFallback({
     ciphertext,
     nonce,
     senderPubkey,
     ctx
   });
-  const id = randomUUID5();
+  const id = randomUUID4();
   const inserted = insertIfNew(ctx.db, {
     id,
     client_message_id: clientMessageId,
@@ -10721,12 +10580,12 @@ __export(exports_identity, {
   checkFingerprint: () => checkFingerprint,
   acceptCurrentHost: () => acceptCurrentHost
 });
-import { existsSync as existsSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join7 } from "node:path";
 import { createHash as createHash2 } from "node:crypto";
 import { networkInterfaces } from "node:os";
 function path() {
-  return join8(DAEMON_PATHS.DAEMON_DIR, FILE_NAME);
+  return join7(DAEMON_PATHS.DAEMON_DIR, FILE_NAME);
 }
 function computeCurrentFingerprint() {
   const host_id = readHostId() ?? "";
@@ -10742,7 +10601,7 @@ function computeCurrentFingerprint() {
 }
 function checkFingerprint() {
   const current = computeCurrentFingerprint();
-  if (!existsSync10(path())) {
+  if (!existsSync9(path())) {
     writeFileSync9(path(), JSON.stringify(current, null, 2), { mode: 384 });
     return { result: "first_run", current };
   }
@@ -10810,14 +10669,14 @@ var init_identity = __esm(() => {
 });
 
 // src/daemon/run.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync9 } from "node:fs";
 function detectContainer() {
   if (process.env.KUBERNETES_SERVICE_HOST)
     return true;
   if (process.env.CONTAINER === "1")
     return true;
   try {
-    if (existsSync11("/.dockerenv"))
+    if (existsSync10("/.dockerenv"))
       return true;
     const cg = readFileSync9("/proc/1/cgroup", "utf8");
     if (/(docker|kubepods|containerd)/.test(cg))
@@ -10838,10 +10697,10 @@ async function runDaemon(opts = {}) {
 `);
   }
   const fpCheck = checkFingerprint();
-  const policy = opts.clonePolicy ?? "refuse";
+  const policy2 = opts.clonePolicy ?? "refuse";
   if (fpCheck.result === "mismatch") {
     const msg = `host_fingerprint mismatch: this daemon dir was started on a different host.`;
-    if (policy === "refuse") {
+    if (policy2 === "refuse") {
       process.stderr.write(`${msg}
 `);
       process.stderr.write(`  stored host_id: ${fpCheck.stored?.host_id}
@@ -10855,7 +10714,7 @@ async function runDaemon(opts = {}) {
       releaseSingletonLock();
       return 4;
     }
-    if (policy === "warn") {
+    if (policy2 === "warn") {
       process.stderr.write(`WARN: ${msg} (continuing per [clone] policy=warn)
 `);
     }
@@ -11020,10 +10879,10 @@ __export(exports_service_install, {
   installService: () => installService,
   detectPlatform: () => detectPlatform
 });
-import { existsSync as existsSync12, mkdirSync as mkdirSync7, writeFileSync as writeFileSync10, unlinkSync as unlinkSync5, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync7, writeFileSync as writeFileSync10, unlinkSync as unlinkSync5, readFileSync as readFileSync10 } from "node:fs";
 import { execSync as execSync2 } from "node:child_process";
-import { homedir as homedir6 } from "node:os";
-import { join as join9, dirname as dirname5 } from "node:path";
+import { homedir as homedir5 } from "node:os";
+import { join as join8, dirname as dirname5 } from "node:path";
 function detectPlatform() {
   if (process.platform === "darwin")
     return "darwin";
@@ -11041,7 +10900,7 @@ function installService(args) {
   if (isCi() && !args.allowCi) {
     throw new Error("Refusing to install persistent service in CI; pass --allow-ci-persistent to override.");
   }
-  if (!existsSync12(args.binaryPath)) {
+  if (!existsSync11(args.binaryPath)) {
     throw new Error(`binary not found at ${args.binaryPath}`);
   }
   mkdirSync7(DAEMON_PATHS.DAEMON_DIR, { recursive: true, mode: 448 });
@@ -11057,7 +10916,7 @@ function uninstallService() {
     try {
       execSync2(`launchctl bootout gui/$(id -u)/${SERVICE_LABEL}`, { stdio: "ignore" });
     } catch {}
-    if (existsSync12(p)) {
+    if (existsSync11(p)) {
       unlinkSync5(p);
       removed.push(p);
     }
@@ -11066,7 +10925,7 @@ function uninstallService() {
     try {
       execSync2(`systemctl --user disable --now ${SYSTEMD_UNIT}`, { stdio: "ignore" });
     } catch {}
-    if (existsSync12(p)) {
+    if (existsSync11(p)) {
       unlinkSync5(p);
       removed.push(p);
     }
@@ -11074,7 +10933,7 @@ function uninstallService() {
   return { platform: platform5, removed };
 }
 function darwinPlistPath() {
-  return join9(homedir6(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
+  return join8(homedir5(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
 }
 function installDarwin(args) {
   const plist = darwinPlistPath();
@@ -11108,11 +10967,11 @@ function installDarwin(args) {
   <key>StandardErrorPath</key>
   <string>${escapeXml(log2)}</string>
   <key>WorkingDirectory</key>
-  <string>${escapeXml(homedir6())}</string>
+  <string>${escapeXml(homedir5())}</string>
   <key>EnvironmentVariables</key>
   <dict>
     <key>HOME</key>
-    <string>${escapeXml(homedir6())}</string>
+    <string>${escapeXml(homedir5())}</string>
     <key>PATH</key>
     <string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
   </dict>
@@ -11127,7 +10986,7 @@ function installDarwin(args) {
   };
 }
 function linuxUnitPath() {
-  return join9(homedir6(), ".config", "systemd", "user", SYSTEMD_UNIT);
+  return join8(homedir5(), ".config", "systemd", "user", SYSTEMD_UNIT);
 }
 function installLinux(args) {
   const unit = linuxUnitPath();
@@ -11176,7 +11035,7 @@ function readInstalledUnit() {
   if (!platform5)
     return { platform: null, path: null, content: null };
   const path2 = platform5 === "darwin" ? darwinPlistPath() : linuxUnitPath();
-  if (!existsSync12(path2))
+  if (!existsSync11(path2))
     return { platform: platform5, path: null, content: null };
   try {
     return { platform: platform5, path: path2, content: readFileSync10(path2, "utf8") };
@@ -11521,17 +11380,17 @@ __export(exports_install, {
 import {
   chmodSync as chmodSync4,
   copyFileSync,
-  existsSync as existsSync13,
+  existsSync as existsSync12,
   mkdirSync as mkdirSync8,
   readFileSync as readFileSync11,
   writeFileSync as writeFileSync11
 } from "node:fs";
-import { homedir as homedir7, platform as platform5 } from "node:os";
-import { dirname as dirname6, join as join10, resolve } from "node:path";
+import { homedir as homedir6, platform as platform5 } from "node:os";
+import { dirname as dirname6, join as join9, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync as spawnSync3 } from "node:child_process";
 function readClaudeConfig() {
-  if (!existsSync13(CLAUDE_CONFIG))
+  if (!existsSync12(CLAUDE_CONFIG))
     return {};
   const text = readFileSync11(CLAUDE_CONFIG, "utf-8").trim();
   if (!text)
@@ -11543,12 +11402,12 @@ function readClaudeConfig() {
   }
 }
 function backupClaudeConfig() {
-  if (!existsSync13(CLAUDE_CONFIG))
+  if (!existsSync12(CLAUDE_CONFIG))
     return;
-  const backupDir = join10(dirname6(CLAUDE_CONFIG), ".claude", "backups");
+  const backupDir = join9(dirname6(CLAUDE_CONFIG), ".claude", "backups");
   mkdirSync8(backupDir, { recursive: true });
   const ts = Date.now();
-  const dest = join10(backupDir, `.claude.json.pre-claudemesh.${ts}`);
+  const dest = join9(backupDir, `.claude.json.pre-claudemesh.${ts}`);
   copyFileSync(CLAUDE_CONFIG, dest);
 }
 function patchMcpServer(entry) {
@@ -11572,7 +11431,7 @@ function patchMcpServer(entry) {
   return action;
 }
 function removeMcpServer() {
-  if (!existsSync13(CLAUDE_CONFIG))
+  if (!existsSync12(CLAUDE_CONFIG))
     return false;
   backupClaudeConfig();
   const cfg = readClaudeConfig();
@@ -11608,8 +11467,8 @@ function resolveEntry() {
 function resolveBundledSkillsDir() {
   const here = fileURLToPath(import.meta.url);
   const pkgRoot = resolve(dirname6(here), "..", "..");
-  const skillsDir = join10(pkgRoot, "skills");
-  if (existsSync13(skillsDir))
+  const skillsDir = join9(pkgRoot, "skills");
+  if (existsSync12(skillsDir))
     return skillsDir;
   return null;
 }
@@ -11622,13 +11481,13 @@ function installSkills() {
   for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
     if (!entry.isDirectory())
       continue;
-    const srcDir = join10(src, entry.name);
-    const dstDir = join10(CLAUDE_SKILLS_ROOT, entry.name);
+    const srcDir = join9(src, entry.name);
+    const dstDir = join9(CLAUDE_SKILLS_ROOT, entry.name);
     mkdirSync8(dstDir, { recursive: true });
     for (const file of fs.readdirSync(srcDir, { withFileTypes: true })) {
       if (!file.isFile())
         continue;
-      copyFileSync(join10(srcDir, file.name), join10(dstDir, file.name));
+      copyFileSync(join9(srcDir, file.name), join9(dstDir, file.name));
     }
     installed.push(entry.name);
   }
@@ -11643,8 +11502,8 @@ function uninstallSkills() {
   for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
     if (!entry.isDirectory())
       continue;
-    const dstDir = join10(CLAUDE_SKILLS_ROOT, entry.name);
-    if (existsSync13(dstDir)) {
+    const dstDir = join9(CLAUDE_SKILLS_ROOT, entry.name);
+    if (existsSync12(dstDir)) {
       try {
         fs.rmSync(dstDir, { recursive: true, force: true });
         removed.push(entry.name);
@@ -11669,7 +11528,7 @@ function entriesEqual(a, b) {
   return a.command === b.command && JSON.stringify(a.args ?? []) === JSON.stringify(b.args ?? []);
 }
 function readClaudeSettings() {
-  if (!existsSync13(CLAUDE_SETTINGS))
+  if (!existsSync12(CLAUDE_SETTINGS))
     return {};
   const text = readFileSync11(CLAUDE_SETTINGS, "utf-8").trim();
   if (!text)
@@ -11696,7 +11555,7 @@ function installAllowedTools() {
   return { added: toAdd, unchanged: CLAUDEMESH_TOOLS.length - toAdd.length };
 }
 function uninstallAllowedTools() {
-  if (!existsSync13(CLAUDE_SETTINGS))
+  if (!existsSync12(CLAUDE_SETTINGS))
     return 0;
   const settings = readClaudeSettings();
   const existing = settings.allowedTools ?? [];
@@ -11731,7 +11590,7 @@ function installHooks() {
   return { added, unchanged };
 }
 function uninstallHooks() {
-  if (!existsSync13(CLAUDE_SETTINGS))
+  if (!existsSync12(CLAUDE_SETTINGS))
     return 0;
   const settings = readClaudeSettings();
   const hooks = settings.hooks;
@@ -11781,7 +11640,7 @@ function runInstall(args = []) {
     render.err("`bun` is not on PATH.", "Install Bun first: https://bun.com");
     process.exit(1);
   }
-  if (!existsSync13(entry)) {
+  if (!existsSync12(entry)) {
     render.err(`MCP entry not found at ${entry}`);
     process.exit(1);
   }
@@ -11832,7 +11691,7 @@ function runInstall(args = []) {
       const installed = installSkills();
       if (installed.length > 0) {
         render.ok(`Claude skill${installed.length === 1 ? "" : "s"} installed`, installed.join(", "));
-        render.info(dim(`  ${join10(CLAUDE_SKILLS_ROOT, installed[0])}/SKILL.md`));
+        render.info(dim(`  ${join9(CLAUDE_SKILLS_ROOT, installed[0])}/SKILL.md`));
       }
     } catch (e) {
       render.warn(`skill install failed: ${e instanceof Error ? e.message : String(e)}`);
@@ -11969,9 +11828,9 @@ var init_install = __esm(() => {
   init_facade();
   init_render();
   init_styles();
-  CLAUDE_CONFIG = join10(homedir7(), ".claude.json");
-  CLAUDE_SETTINGS = join10(homedir7(), ".claude", "settings.json");
-  CLAUDE_SKILLS_ROOT = join10(homedir7(), ".claude", "skills");
+  CLAUDE_CONFIG = join9(homedir6(), ".claude.json");
+  CLAUDE_SETTINGS = join9(homedir6(), ".claude", "settings.json");
+  CLAUDE_SKILLS_ROOT = join9(homedir6(), ".claude", "skills");
   CLAUDEMESH_TOOLS = [
     "mcp__claudemesh__cancel_scheduled",
     "mcp__claudemesh__check_messages",
@@ -12026,19 +11885,19 @@ var exports_uninstall = {};
 __export(exports_uninstall, {
   uninstall: () => uninstall
 });
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync12, existsSync as existsSync14, rmSync as rmSync2, readdirSync as readdirSync2 } from "node:fs";
-import { join as join11, dirname as dirname7 } from "node:path";
-import { homedir as homedir8 } from "node:os";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync12, existsSync as existsSync13, rmSync as rmSync2, readdirSync as readdirSync2 } from "node:fs";
+import { join as join10, dirname as dirname7 } from "node:path";
+import { homedir as homedir7 } from "node:os";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function bundledSkillsDir() {
   const here = fileURLToPath2(import.meta.url);
-  const pkgRoot = join11(dirname7(here), "..", "..");
-  const skillsDir = join11(pkgRoot, "skills");
-  return existsSync14(skillsDir) ? skillsDir : null;
+  const pkgRoot = join10(dirname7(here), "..", "..");
+  const skillsDir = join10(pkgRoot, "skills");
+  return existsSync13(skillsDir) ? skillsDir : null;
 }
 async function uninstall() {
   let removed = 0;
-  if (existsSync14(PATHS.CLAUDE_JSON)) {
+  if (existsSync13(PATHS.CLAUDE_JSON)) {
     try {
       const raw = readFileSync12(PATHS.CLAUDE_JSON, "utf-8");
       const config = JSON.parse(raw);
@@ -12052,7 +11911,7 @@ async function uninstall() {
       }
     } catch {}
   }
-  if (existsSync14(PATHS.CLAUDE_SETTINGS)) {
+  if (existsSync13(PATHS.CLAUDE_SETTINGS)) {
     try {
       const raw = readFileSync12(PATHS.CLAUDE_SETTINGS, "utf-8");
       const config = JSON.parse(raw);
@@ -12090,8 +11949,8 @@ async function uninstall() {
       for (const entry of readdirSync2(src, { withFileTypes: true })) {
         if (!entry.isDirectory())
           continue;
-        const dst = join11(CLAUDE_SKILLS_ROOT2, entry.name);
-        if (existsSync14(dst)) {
+        const dst = join10(CLAUDE_SKILLS_ROOT2, entry.name);
+        if (existsSync13(dst)) {
           try {
             rmSync2(dst, { recursive: true, force: true });
             removedSkills.push(entry.name);
@@ -12115,7 +11974,7 @@ var init_uninstall = __esm(() => {
   init_render();
   init_styles();
   init_exit_codes();
-  CLAUDE_SKILLS_ROOT2 = join11(homedir8(), ".claude", "skills");
+  CLAUDE_SKILLS_ROOT2 = join10(homedir7(), ".claude", "skills");
 });
 
 // src/commands/doctor.ts
@@ -12123,9 +11982,9 @@ var exports_doctor = {};
 __export(exports_doctor, {
   runDoctor: () => runDoctor
 });
-import { existsSync as existsSync15, readFileSync as readFileSync13, statSync as statSync3 } from "node:fs";
-import { homedir as homedir9, platform as platform6 } from "node:os";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync13, statSync as statSync3 } from "node:fs";
+import { homedir as homedir8, platform as platform6 } from "node:os";
+import { join as join11 } from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function checkNode() {
   const major = Number(process.versions.node.split(".")[0]);
@@ -12149,8 +12008,8 @@ function checkClaudeOnPath() {
   };
 }
 function checkMcpRegistered() {
-  const claudeConfig = join12(homedir9(), ".claude.json");
-  if (!existsSync15(claudeConfig)) {
+  const claudeConfig = join11(homedir8(), ".claude.json");
+  if (!existsSync14(claudeConfig)) {
     return {
       name: "claudemesh MCP registered in ~/.claude.json",
       pass: false,
@@ -12175,8 +12034,8 @@ function checkMcpRegistered() {
   }
 }
 function checkHooksRegistered() {
-  const settings = join12(homedir9(), ".claude", "settings.json");
-  if (!existsSync15(settings)) {
+  const settings = join11(homedir8(), ".claude", "settings.json");
+  if (!existsSync14(settings)) {
     return {
       name: "Status hooks registered in ~/.claude/settings.json",
       pass: false,
@@ -12201,7 +12060,7 @@ function checkHooksRegistered() {
 }
 function checkConfigFile() {
   const path2 = getConfigPath();
-  if (!existsSync15(path2)) {
+  if (!existsSync14(path2)) {
     return {
       name: "~/.claudemesh/config.json exists and parses",
       pass: true,
@@ -12384,7 +12243,7 @@ var exports_status = {};
 __export(exports_status, {
   runStatus: () => runStatus2
 });
-import { statSync as statSync4, existsSync as existsSync16 } from "node:fs";
+import { statSync as statSync4, existsSync as existsSync15 } from "node:fs";
 import WebSocket3 from "ws";
 async function probeBroker(url, timeoutMs = 4000) {
   return new Promise((resolve2) => {
@@ -12414,7 +12273,7 @@ async function runStatus2() {
   render.section(`status (v${VERSION})`);
   const configPath = getConfigPath();
   let configPermsNote = "missing";
-  if (existsSync16(configPath)) {
+  if (existsSync15(configPath)) {
     const mode = (statSync4(configPath).mode & 511).toString(8).padStart(4, "0");
     configPermsNote = mode === "0600" ? `${mode}` : `${mode} — expected 0600`;
   }
@@ -12560,10 +12419,10 @@ var init_check_claude_binary = __esm(() => {
 });
 
 // src/services/health/check-mcp-registered.ts
-import { existsSync as existsSync17, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync14 } from "node:fs";
 function checkMcpRegistered2() {
   try {
-    if (!existsSync17(PATHS.CLAUDE_JSON)) {
+    if (!existsSync16(PATHS.CLAUDE_JSON)) {
       return { name: "mcp-registered", ok: false, message: "~/.claude.json not found" };
     }
     const raw = readFileSync14(PATHS.CLAUDE_JSON, "utf-8");
@@ -12581,10 +12440,10 @@ var init_check_mcp_registered = __esm(() => {
 });
 
 // src/services/health/check-hooks-registered.ts
-import { existsSync as existsSync18, readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync15 } from "node:fs";
 function checkHooksRegistered2() {
   try {
-    if (!existsSync18(PATHS.CLAUDE_SETTINGS)) {
+    if (!existsSync17(PATHS.CLAUDE_SETTINGS)) {
       return { name: "hooks-registered", ok: false, message: "~/.claude/settings.json not found" };
     }
     const raw = readFileSync15(PATHS.CLAUDE_SETTINGS, "utf-8");
@@ -12602,10 +12461,10 @@ var init_check_hooks_registered = __esm(() => {
 });
 
 // src/services/health/check-config-perms.ts
-import { existsSync as existsSync19, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync18, statSync as statSync5 } from "node:fs";
 function checkConfigPerms() {
   const configFile = PATHS.CONFIG_FILE;
-  if (!existsSync19(configFile)) {
+  if (!existsSync18(configFile)) {
     return { name: "config-perms", ok: true, message: "No config file yet (first run)" };
   }
   try {
@@ -12623,9 +12482,9 @@ var init_check_config_perms = __esm(() => {
 });
 
 // src/services/health/check-keypairs-valid.ts
-import { existsSync as existsSync20, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync16 } from "node:fs";
 function checkKeypairsValid() {
-  if (!existsSync20(PATHS.CONFIG_FILE)) {
+  if (!existsSync19(PATHS.CONFIG_FILE)) {
     return { name: "keypairs-valid", ok: true, message: "No config (first run)" };
   }
   try {
@@ -13109,18 +12968,18 @@ var exports_url_handler = {};
 __export(exports_url_handler, {
   runUrlHandler: () => runUrlHandler
 });
-import { platform as platform7, homedir as homedir10 } from "node:os";
-import { existsSync as existsSync21, mkdirSync as mkdirSync9, writeFileSync as writeFileSync13, rmSync as rmSync3, chmodSync as chmodSync5 } from "node:fs";
-import { join as join13 } from "node:path";
+import { platform as platform7, homedir as homedir9 } from "node:os";
+import { existsSync as existsSync20, mkdirSync as mkdirSync9, writeFileSync as writeFileSync13, rmSync as rmSync3, chmodSync as chmodSync5 } from "node:fs";
+import { join as join12 } from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function resolveClaudemeshBin() {
   return process.argv[1] ?? "claudemesh";
 }
 function installDarwin2() {
   const binPath = resolveClaudemeshBin();
-  const appDir = join13(homedir10(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
-  const contents = join13(appDir, "Contents");
-  const macOS = join13(contents, "MacOS");
+  const appDir = join12(homedir9(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
+  const contents = join12(appDir, "Contents");
+  const macOS = join12(contents, "MacOS");
   mkdirSync9(macOS, { recursive: true });
   const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -13144,7 +13003,7 @@ function installDarwin2() {
   </array>
 </dict>
 </plist>`;
-  writeFileSync13(join13(contents, "Info.plist"), plist);
+  writeFileSync13(join12(contents, "Info.plist"), plist);
   const shim = `#!/bin/sh
 URL="$1"
 CODE=\${URL#claudemesh://}
@@ -13158,7 +13017,7 @@ tell application "Terminal"
 end tell
 EOF
 `;
-  const shimPath = join13(macOS, "open-url");
+  const shimPath = join12(macOS, "open-url");
   writeFileSync13(shimPath, shim);
   chmodSync5(shimPath, 493);
   const lsreg = spawnSync5("/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister", ["-f", appDir], { encoding: "utf-8" });
@@ -13170,7 +13029,7 @@ EOF
 }
 function installLinux2() {
   const binPath = resolveClaudemeshBin();
-  const appsDir = join13(homedir10(), ".local", "share", "applications");
+  const appsDir = join12(homedir9(), ".local", "share", "applications");
   mkdirSync9(appsDir, { recursive: true });
   const desktop = `[Desktop Entry]
 Type=Application
@@ -13182,7 +13041,7 @@ Terminal=true
 MimeType=x-scheme-handler/claudemesh;
 NoDisplay=true
 `;
-  const desktopPath = join13(appsDir, "claudemesh.desktop");
+  const desktopPath = join12(appsDir, "claudemesh.desktop");
   writeFileSync13(desktopPath, desktop);
   const xdg1 = spawnSync5("xdg-mime", ["default", "claudemesh.desktop", "x-scheme-handler/claudemesh"], { encoding: "utf-8" });
   if (xdg1.status !== 0) {
@@ -13205,7 +13064,7 @@ function installWindows() {
     `[HKEY_CURRENT_USER\\Software\\Classes\\claudemesh\\shell\\open\\command]`,
     `@="\\"${binPath.replace(/\\/g, "\\\\")}\\" \\"%1\\""`
   ];
-  const regPath = join13(homedir10(), "claudemesh-handler.reg");
+  const regPath = join12(homedir9(), "claudemesh-handler.reg");
   writeFileSync13(regPath, lines.join(`\r
 `));
   const res = spawnSync5("reg.exe", ["import", regPath], { encoding: "utf-8" });
@@ -13217,15 +13076,15 @@ function installWindows() {
   return EXIT.SUCCESS;
 }
 function uninstallDarwin() {
-  const appDir = join13(homedir10(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
-  if (existsSync21(appDir))
+  const appDir = join12(homedir9(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
+  if (existsSync20(appDir))
     rmSync3(appDir, { recursive: true, force: true });
   render.ok("removed claudemesh:// handler on macOS");
   return EXIT.SUCCESS;
 }
 function uninstallLinux() {
-  const desktopPath = join13(homedir10(), ".local", "share", "applications", "claudemesh.desktop");
-  if (existsSync21(desktopPath))
+  const desktopPath = join12(homedir9(), ".local", "share", "applications", "claudemesh.desktop");
+  if (existsSync20(desktopPath))
     rmSync3(desktopPath, { force: true });
   render.ok("removed claudemesh:// handler on Linux");
   return EXIT.SUCCESS;
@@ -13270,9 +13129,9 @@ var exports_status_line = {};
 __export(exports_status_line, {
   runStatusLine: () => runStatusLine
 });
-import { existsSync as existsSync22, readFileSync as readFileSync17 } from "node:fs";
-import { join as join14 } from "node:path";
-import { homedir as homedir11 } from "node:os";
+import { existsSync as existsSync21, readFileSync as readFileSync17 } from "node:fs";
+import { join as join13 } from "node:path";
+import { homedir as homedir10 } from "node:os";
 async function runStatusLine() {
   try {
     const config = readConfig();
@@ -13280,9 +13139,9 @@ async function runStatusLine() {
       process.stdout.write("◇ claudemesh (not joined)");
       return EXIT.SUCCESS;
     }
-    const cachePath = join14(homedir11(), ".claudemesh", "peer-cache.json");
+    const cachePath = join13(homedir10(), ".claudemesh", "peer-cache.json");
     let cache = {};
-    if (existsSync22(cachePath)) {
+    if (existsSync21(cachePath)) {
       try {
         cache = JSON.parse(readFileSync17(cachePath, "utf-8"));
       } catch {}
@@ -13315,7 +13174,7 @@ __export(exports_backup, {
   runRestore: () => runRestore,
   runBackup: () => runBackup
 });
-import { readFileSync as readFileSync18, writeFileSync as writeFileSync14, existsSync as existsSync23 } from "node:fs";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync14, existsSync as existsSync22 } from "node:fs";
 import { createInterface as createInterface11 } from "node:readline";
 function readHidden(prompt5) {
   return new Promise((resolve2) => {
@@ -13357,7 +13216,7 @@ async function deriveKey(pass, salt, s) {
 }
 async function runBackup(outPath) {
   const configPath = getConfigPath();
-  if (!existsSync23(configPath)) {
+  if (!existsSync22(configPath)) {
     console.error("  No config found — nothing to back up. Join a mesh first.");
     return EXIT.NOT_FOUND;
   }
@@ -13391,7 +13250,7 @@ async function runRestore(inPath) {
     console.error("  Usage: claudemesh restore <backup-file>");
     return EXIT.INVALID_ARGS;
   }
-  if (!existsSync23(inPath)) {
+  if (!existsSync22(inPath)) {
     console.error(`  ✗ File not found: ${inPath}`);
     return EXIT.NOT_FOUND;
   }
@@ -13414,7 +13273,7 @@ async function runRestore(inPath) {
     return EXIT.INTERNAL_ERROR;
   }
   const configPath = getConfigPath();
-  if (existsSync23(configPath)) {
+  if (existsSync22(configPath)) {
     const backupOld = `${configPath}.before-restore.${Date.now()}`;
     writeFileSync14(backupOld, readFileSync18(configPath), { mode: 384 });
     console.log(`  ↻ Existing config saved to ${backupOld}`);
@@ -13439,8 +13298,8 @@ __export(exports_upgrade, {
   runUpgrade: () => runUpgrade
 });
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync24 } from "node:fs";
-import { dirname as dirname8, join as join15, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync23 } from "node:fs";
+import { dirname as dirname8, join as join14, resolve as resolve2 } from "node:path";
 async function latestVersion() {
   try {
     const res = await fetch(URLS.NPM_REGISTRY, { signal: AbortSignal.timeout(8000) });
@@ -13453,15 +13312,15 @@ async function latestVersion() {
   }
 }
 function findNpm() {
-  const portable = join15(process.env.HOME ?? "", ".claudemesh", "node", "bin", "npm");
-  if (existsSync24(portable)) {
-    return { npm: portable, prefix: join15(process.env.HOME ?? "", ".claudemesh") };
+  const portable = join14(process.env.HOME ?? "", ".claudemesh", "node", "bin", "npm");
+  if (existsSync23(portable)) {
+    return { npm: portable, prefix: join14(process.env.HOME ?? "", ".claudemesh") };
   }
   let cur = resolve2(process.argv[1] ?? ".");
   for (let i = 0;i < 6; i++) {
     cur = dirname8(cur);
-    const candidate = join15(cur, "bin", "npm");
-    if (existsSync24(candidate))
+    const candidate = join14(cur, "bin", "npm");
+    if (existsSync23(candidate))
       return { npm: candidate };
   }
   return { npm: "npm" };
@@ -13523,9 +13382,9 @@ __export(exports_grants, {
   runBlock: () => runBlock,
   isAllowed: () => isAllowed
 });
-import { existsSync as existsSync25, mkdirSync as mkdirSync10, readFileSync as readFileSync19, writeFileSync as writeFileSync15 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync10, readFileSync as readFileSync19, writeFileSync as writeFileSync15 } from "node:fs";
+import { homedir as homedir11 } from "node:os";
+import { join as join15 } from "node:path";
 async function syncToBroker(meshSlug, grants) {
   const auth = getStoredToken();
   if (!auth)
@@ -13543,7 +13402,7 @@ async function syncToBroker(meshSlug, grants) {
   }
 }
 function readGrants() {
-  if (!existsSync25(GRANT_FILE))
+  if (!existsSync24(GRANT_FILE))
     return {};
   try {
     return JSON.parse(readFileSync19(GRANT_FILE, "utf-8"));
@@ -13552,8 +13411,8 @@ function readGrants() {
   }
 }
 function writeGrants(g) {
-  const dir = join16(homedir12(), ".claudemesh");
-  if (!existsSync25(dir))
+  const dir = join15(homedir11(), ".claudemesh");
+  if (!existsSync24(dir))
     mkdirSync10(dir, { recursive: true });
   writeFileSync15(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
 }
@@ -13711,7 +13570,7 @@ var init_grants = __esm(() => {
   BROKER_HTTP7 = URLS.BROKER.replace("wss://", "https://").replace("ws://", "http://").replace("/ws", "");
   ALL_CAPS = ["read", "dm", "broadcast", "state-read", "state-write", "file-read"];
   DEFAULT_CAPS = ["read", "dm", "broadcast", "state-read"];
-  GRANT_FILE = join16(homedir12(), ".claudemesh", "grants.json");
+  GRANT_FILE = join15(homedir11(), ".claudemesh", "grants.json");
 });
 
 // src/commands/profile.ts
@@ -15393,7 +15252,7 @@ __export(exports_file, {
 });
 import { hostname as osHostname } from "node:os";
 import { resolve as resolvePath, basename, dirname as dirname9 } from "node:path";
-import { statSync as statSync7, existsSync as existsSync26, writeFileSync as writeFileSync16, mkdirSync as mkdirSync11 } from "node:fs";
+import { statSync as statSync7, existsSync as existsSync25, writeFileSync as writeFileSync16, mkdirSync as mkdirSync11 } from "node:fs";
 function emitJson2(data) {
   console.log(JSON.stringify(data, null, 2));
 }
@@ -15410,7 +15269,7 @@ async function runFileShare(filePath, opts) {
     return EXIT.INVALID_ARGS;
   }
   const absPath = resolvePath(filePath);
-  if (!existsSync26(absPath)) {
+  if (!existsSync25(absPath)) {
     render.err(`File not found: ${absPath}`);
     return EXIT.INVALID_ARGS;
   }
@@ -16100,7 +15959,7 @@ __export(exports_bridge, {
   runBridge: () => runBridge,
   bridgeConfigTemplate: () => bridgeConfigTemplate
 });
-import { readFileSync as readFileSync20, existsSync as existsSync27 } from "node:fs";
+import { readFileSync as readFileSync20, existsSync as existsSync26 } from "node:fs";
 function parseConfig(text) {
   const trimmed = text.trim();
   if (trimmed.startsWith("{"))
@@ -16144,7 +16003,7 @@ async function runBridge(configPath) {
     render.err("Usage: claudemesh bridge run <config.yaml>");
     return EXIT.INVALID_ARGS;
   }
-  if (!existsSync27(configPath)) {
+  if (!existsSync26(configPath)) {
     render.err(`config file not found: ${configPath}`);
     return EXIT.NOT_FOUND;
   }
@@ -17124,11 +16983,11 @@ import {
   ListResourcesRequestSchema,
   ReadResourceRequestSchema
 } from "@modelcontextprotocol/sdk/types.js";
-import { existsSync as existsSync28 } from "node:fs";
+import { existsSync as existsSync27 } from "node:fs";
 import { request as httpRequest2 } from "node:http";
 async function daemonReady() {
   for (let i = 0;i < DAEMON_BOOT_RETRIES; i++) {
-    if (existsSync28(DAEMON_PATHS.SOCK_FILE))
+    if (existsSync27(DAEMON_PATHS.SOCK_FILE))
       return true;
     await new Promise((r) => setTimeout(r, DAEMON_BOOT_RETRY_MS));
   }
@@ -18205,10 +18064,12 @@ async function gate(ctx, opts) {
 }
 
 // src/entrypoints/cli.ts
+init_policy();
 init_styles();
 installSignalHandlers();
 installErrorHandlers();
 var { command, positionals, flags } = parseArgv(process.argv);
+setDaemonPolicy(policyFromFlags(flags));
 function resolveApprovalMode() {
   const raw = flags["approval-mode"] ?? process.env.CLAUDEMESH_APPROVAL_MODE ?? null;
   if (raw === "plan" || raw === "read-only" || raw === "write" || raw === "yolo")
@@ -18385,6 +18246,8 @@ Flags
   --policy <path>                  override policy file
   -y, --yes                        skip confirmations (= --approval-mode yolo)
   -q, --quiet                      suppress non-essential output
+  --strict                         require daemon for broker-touching verbs (no cold-path fallback)
+  --no-daemon                      skip daemon entirely; open broker WS directly (CI / sandboxed scripts)
 `;
 function colorizeHelp(raw) {
   const lines = raw.split(`
@@ -19426,4 +19289,4 @@ main().catch((err) => {
   process.exit(EXIT.INTERNAL_ERROR);
 });
 
-//# debugId=1F2A51E3A3AE432A64756E2164756E21
+//# debugId=04E4A5313AE4F0EA64756E2164756E21