claudemesh-cli 1.27.3 → 1.29.0

package/dist/entrypoints/cli.js

@@ -103,7 +103,7 @@ __export(exports_urls, {
   VERSION: () => VERSION,
   URLS: () => URLS
 });
-var URLS, VERSION = "1.27.3", env;
+var URLS, VERSION = "1.29.0", env;
 var init_urls = __esm(() => {
   URLS = {
     BROKER: process.env.CLAUDEMESH_BROKER_URL ?? "wss://ic.claudemesh.com/ws",
@@ -150,6 +150,32 @@ function normaliseInviteUrl(input, host = "claudemesh.com") {
   return trimmed;
 }
 
+// src/services/daemon/policy.ts
+function readEnvDefault() {
+  if (process.env.CLAUDEMESH_NO_DAEMON === "1")
+    return { mode: "no-daemon" };
+  if (process.env.CLAUDEMESH_STRICT_DAEMON === "1")
+    return { mode: "strict" };
+  return { mode: "auto" };
+}
+function setDaemonPolicy(mode) {
+  policy = { mode };
+}
+function getDaemonPolicy() {
+  return policy;
+}
+function policyFromFlags(flags) {
+  if (flags["no-daemon"])
+    return "no-daemon";
+  if (flags.strict)
+    return "strict";
+  return readEnvDefault().mode;
+}
+var policy;
+var init_policy = __esm(() => {
+  policy = readEnvDefault();
+});
+
 // src/constants/paths.ts
 import { homedir as homedir2 } from "node:os";
 import { join as join2 } from "node:path";
@@ -3642,7 +3668,50 @@ var init_local_token = __esm(() => {
   init_paths2();
 });
 
+// src/services/session/token.ts
+var exports_token = {};
+__export(exports_token, {
+  readSessionTokenFromEnv: () => readSessionTokenFromEnv,
+  mintSessionToken: () => mintSessionToken,
+  TOKEN_FILE_ENV: () => TOKEN_FILE_ENV
+});
+import { randomBytes as randomBytes5 } from "node:crypto";
+import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
+function mintSessionToken(dir, fileName = "session-token") {
+  const token = randomBytes5(32).toString("hex");
+  const filePath = `${dir}/${fileName}`;
+  writeFileSync5(filePath, token, { mode: 384 });
+  return { token, filePath };
+}
+function readSessionTokenFromEnv(env2 = process.env) {
+  const direct = env2.CLAUDEMESH_IPC_TOKEN;
+  if (direct && /^[0-9a-f]{64}$/i.test(direct))
+    return direct.toLowerCase();
+  const path = env2[ENV_TOKEN_FILE];
+  if (!path)
+    return null;
+  try {
+    if (!existsSync5(path))
+      return null;
+    const raw = readFileSync5(path, "utf8").trim();
+    if (/^[0-9a-f]{64}$/i.test(raw))
+      return raw.toLowerCase();
+    return null;
+  } catch {
+    return null;
+  }
+}
+var ENV_TOKEN_FILE = "CLAUDEMESH_IPC_TOKEN_FILE", TOKEN_FILE_ENV;
+var init_token = __esm(() => {
+  TOKEN_FILE_ENV = ENV_TOKEN_FILE;
+});
+
 // src/daemon/ipc/client.ts
+var exports_client = {};
+__export(exports_client, {
+  ipc: () => ipc,
+  IpcError: () => IpcError
+});
 import { request as httpRequest } from "node:http";
 async function ipc(opts) {
   const useTcp = !!opts.preferTcp;
@@ -3662,6 +3731,11 @@ async function ipc(opts) {
       throw new IpcError(0, null, "daemon local token not found; is the daemon running?");
     headers.authorization = `Bearer ${tok}`;
   }
+  if (!useTcp) {
+    const sessionTok = readSessionTokenFromEnv();
+    if (sessionTok)
+      headers.authorization = `ClaudeMesh-Session ${sessionTok}`;
+  }
   return new Promise((resolve, reject) => {
     const req = httpRequest(useTcp ? { host: DAEMON_TCP_HOST, port: DAEMON_TCP_DEFAULT_PORT, path: opts.path, method: opts.method ?? "GET", headers } : { socketPath: DAEMON_PATHS.SOCK_FILE, path: opts.path, method: opts.method ?? "GET", headers }, (res) => {
       const chunks = [];
@@ -3686,6 +3760,7 @@ var IpcError;
 var init_client3 = __esm(() => {
   init_paths2();
   init_local_token();
+  init_token();
   IpcError = class IpcError extends Error {
     status;
     payload;
@@ -3703,7 +3778,7 @@ __export(exports_lifecycle, {
   ensureDaemonReady: () => ensureDaemonReady,
   _resetDaemonReadyCache: () => _resetDaemonReadyCache
 });
-import { existsSync as existsSync5, readFileSync as readFileSync5, statSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync6, statSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join4 } from "node:path";
 async function ensureDaemonReady(opts = {}) {
   if (lastResultThisProcess && (lastResultThisProcess.state === "up" || lastResultThisProcess.state === "started")) {
@@ -3744,7 +3819,7 @@ async function runEnsureDaemon(opts) {
   return { state: "spawn-failed", durationMs: Date.now() - t0, reason: spawnRes.reason };
 }
 async function probeDaemon() {
-  if (!existsSync5(DAEMON_PATHS.SOCK_FILE))
+  if (!existsSync6(DAEMON_PATHS.SOCK_FILE))
     return "absent";
   try {
     const res = await ipc({ path: "/v1/version", timeoutMs: PROBE_TIMEOUT_MS });
@@ -3777,7 +3852,7 @@ function recentSpawnFailureFresh() {
 }
 function markSpawnFailure() {
   try {
-    writeFileSync5(SPAWN_FAIL_FILE(), String(Date.now()), { mode: 384 });
+    writeFileSync6(SPAWN_FAIL_FILE(), String(Date.now()), { mode: 384 });
   } catch {}
 }
 function clearSpawnFailure() {
@@ -3814,9 +3889,9 @@ async function spawnDaemon(opts) {
 }
 async function acquireOrShareLock(_opts) {
   const lockPath = SPAWN_LOCK_FILE();
-  if (existsSync5(lockPath)) {
+  if (existsSync6(lockPath)) {
     try {
-      const pidStr = readFileSync5(lockPath, "utf8").trim();
+      const pidStr = readFileSync6(lockPath, "utf8").trim();
       const pid = Number.parseInt(pidStr, 10);
       if (Number.isFinite(pid) && pid > 0) {
         try {
@@ -3827,7 +3902,7 @@ async function acquireOrShareLock(_opts) {
     } catch {}
   }
   try {
-    writeFileSync5(lockPath, String(process.pid), { mode: 384 });
+    writeFileSync6(lockPath, String(process.pid), { mode: 384 });
   } catch {}
   return "acquired";
 }
@@ -3839,7 +3914,7 @@ function releaseLock() {
 async function pollForSocket(budgetMs) {
   const start = Date.now();
   while (Date.now() - start < budgetMs) {
-    if (existsSync5(DAEMON_PATHS.SOCK_FILE)) {
+    if (existsSync6(DAEMON_PATHS.SOCK_FILE)) {
       const probe = await probeDaemon();
       if (probe === "up")
         return { ok: true };
@@ -3873,7 +3948,7 @@ __export(exports_launch, {
 });
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { mkdtempSync, writeFileSync as writeFileSync6, rmSync, readdirSync, statSync as statSync2, existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
+import { mkdtempSync, writeFileSync as writeFileSync7, rmSync, readdirSync, statSync as statSync2, existsSync as existsSync7, readFileSync as readFileSync7 } from "node:fs";
 import { tmpdir, hostname as hostname2, homedir as homedir3 } from "node:os";
 import { join as join5 } from "node:path";
 import { createInterface as createInterface4 } from "node:readline";
@@ -4222,8 +4297,8 @@ async function runLaunch(flags, rawArgs) {
   await ensureDaemonRunning(mesh.slug, args.quiet);
   try {
     const claudeConfigPath = join5(homedir3(), ".claude.json");
-    if (existsSync6(claudeConfigPath)) {
-      const claudeConfig = JSON.parse(readFileSync6(claudeConfigPath, "utf-8"));
+    if (existsSync7(claudeConfigPath)) {
+      const claudeConfig = JSON.parse(readFileSync7(claudeConfigPath, "utf-8"));
       const mcpServers = claudeConfig.mcpServers ?? {};
       let cleaned = 0;
       for (const key of Object.keys(mcpServers)) {
@@ -4241,7 +4316,7 @@ async function runLaunch(flags, rawArgs) {
       }
       if (cleaned > 0) {
         claudeConfig.mcpServers = mcpServers;
-        writeFileSync6(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
+        writeFileSync7(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
 `, "utf-8");
       }
     }
@@ -4267,8 +4342,37 @@ async function runLaunch(flags, rawArgs) {
     ...parsedGroups.length > 0 ? { groups: parsedGroups } : {},
     messageMode
   };
-  writeFileSync6(join5(tmpDir, "config.json"), JSON.stringify(sessionConfig, null, 2) + `
+  writeFileSync7(join5(tmpDir, "config.json"), JSON.stringify(sessionConfig, null, 2) + `
 `, "utf-8");
+  let sessionTokenFilePath = null;
+  let sessionTokenForCleanup = null;
+  try {
+    const { mintSessionToken: mintSessionToken2, TOKEN_FILE_ENV: TOKEN_FILE_ENV2 } = await Promise.resolve().then(() => (init_token(), exports_token));
+    const minted = mintSessionToken2(tmpDir);
+    sessionTokenFilePath = minted.filePath;
+    sessionTokenForCleanup = minted.token;
+    const { ipc: ipc2 } = await Promise.resolve().then(() => (init_client3(), exports_client));
+    const sessionIdForRegister = claudeSessionId ?? randomUUID();
+    await ipc2({
+      method: "POST",
+      path: "/v1/sessions/register",
+      timeoutMs: 3000,
+      body: {
+        token: minted.token,
+        session_id: sessionIdForRegister,
+        mesh: mesh.slug,
+        display_name: displayName,
+        pid: process.pid,
+        cwd: process.cwd(),
+        ...role ? { role } : {},
+        ...parsedGroups.length > 0 ? { groups: parsedGroups.map((g) => `@${g.name}${g.role ? `:${g.role}` : ""}`) } : {}
+      }
+    }).catch(() => null);
+    process._claudemeshTokenEnv = {
+      name: TOKEN_FILE_ENV2,
+      value: minted.filePath
+    };
+  } catch {}
   if (!args.quiet) {
     printBanner(displayName, mesh.slug, role, parsedGroups, messageMode);
   }
@@ -4277,7 +4381,7 @@ async function runLaunch(flags, rawArgs) {
     const claudeConfigPath = join5(homedir3(), ".claude.json");
     let claudeConfig = {};
     try {
-      claudeConfig = JSON.parse(readFileSync6(claudeConfigPath, "utf-8"));
+      claudeConfig = JSON.parse(readFileSync7(claudeConfigPath, "utf-8"));
     } catch {
       claudeConfig = {};
     }
@@ -4304,7 +4408,7 @@ async function runLaunch(flags, rawArgs) {
       meshMcpEntries.push({ key: entryKey, entry });
     }
     claudeConfig.mcpServers = mcpServers;
-    writeFileSync6(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
+    writeFileSync7(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
 `, "utf-8");
     if (!args.quiet && meshMcpEntries.length > 0) {
       console.log(`  ${meshMcpEntries.length} mesh service(s) registered as native MCPs:`);
@@ -4346,7 +4450,7 @@ async function runLaunch(flags, rawArgs) {
       join5(homedir3(), ".claude", "bin", "claude")
     ];
     for (const c of candidates) {
-      if (existsSync6(c)) {
+      if (existsSync7(c)) {
         claudeBin = c;
         break;
       }
@@ -4356,13 +4460,13 @@ async function runLaunch(flags, rawArgs) {
     if (meshMcpEntries.length > 0) {
       try {
         const claudeConfigPath = join5(homedir3(), ".claude.json");
-        const claudeConfig = JSON.parse(readFileSync6(claudeConfigPath, "utf-8"));
+        const claudeConfig = JSON.parse(readFileSync7(claudeConfigPath, "utf-8"));
         const mcpServers = claudeConfig.mcpServers ?? {};
         for (const { key } of meshMcpEntries) {
           delete mcpServers[key];
         }
         claudeConfig.mcpServers = mcpServers;
-        writeFileSync6(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
+        writeFileSync7(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
 `, "utf-8");
       } catch {}
     }
@@ -4392,6 +4496,7 @@ async function runLaunch(flags, rawArgs) {
       CLAUDEMESH_CONFIG_DIR: tmpDir,
       CLAUDEMESH_DISPLAY_NAME: displayName,
       ...claudeSessionId ? { CLAUDEMESH_SESSION_ID: claudeSessionId } : {},
+      ...sessionTokenFilePath ? { CLAUDEMESH_IPC_TOKEN_FILE: sessionTokenFilePath } : {},
       MCP_TIMEOUT: process.env.MCP_TIMEOUT ?? "30000",
       MAX_MCP_OUTPUT_TOKENS: process.env.MAX_MCP_OUTPUT_TOKENS ?? "50000",
       ...role ? { CLAUDEMESH_ROLE: role } : {}
@@ -5059,7 +5164,7 @@ __export(exports_join, {
   runJoin: () => runJoin
 });
 import sodium3 from "libsodium-wrappers";
-import { writeFileSync as writeFileSync7, mkdirSync as mkdirSync4 } from "node:fs";
+import { writeFileSync as writeFileSync8, mkdirSync as mkdirSync4 } from "node:fs";
 import { join as join6, dirname as dirname3 } from "node:path";
 import { homedir as homedir4, hostname as hostname3 } from "node:os";
 function deriveAppBaseUrl() {
@@ -5184,7 +5289,7 @@ async function runJoin(args) {
   const inviteFile = join6(configDir, `invite-${payload.mesh_slug}.txt`);
   try {
     mkdirSync4(dirname3(inviteFile), { recursive: true });
-    writeFileSync7(inviteFile, link, "utf-8");
+    writeFileSync8(inviteFile, link, "utf-8");
   } catch {}
   console.log("");
   console.log(`✓ Joined "${payload.mesh_slug}" as ${displayName}${enroll.alreadyMember ? " (already a member — re-enrolled with same pubkey)" : ""}`);
@@ -6699,6 +6804,12 @@ async function pickMesh(meshes) {
   });
 }
 async function withMesh(opts, fn) {
+  if (getDaemonPolicy().mode === "strict") {
+    console.error(`
+  ✘ daemon not reachable — --strict refuses cold-path fallback.
+` + "    run `claudemesh daemon up` (or `claudemesh doctor`) and retry.\n");
+    process.exit(1);
+  }
   const config = readConfig();
   if (config.meshes.length === 0) {
     console.error("No meshes joined. Run `claudemesh join <url>` first.");
@@ -6749,6 +6860,7 @@ async function withMesh(opts, fn) {
 var init_connect = __esm(() => {
   init_facade8();
   init_facade();
+  init_policy();
 });
 
 // src/commands/info.ts
@@ -7385,107 +7497,6 @@ var init_ban = __esm(() => {
   init_exit_codes();
 });
 
-// src/services/bridge/protocol.ts
-import { homedir as homedir5 } from "node:os";
-import { join as join7 } from "node:path";
-function socketPath(meshSlug) {
-  return join7(homedir5(), ".claudemesh", "sockets", `${meshSlug}.sock`);
-}
-function frame(obj) {
-  return JSON.stringify(obj) + `
-`;
-}
-
-class LineParser {
-  buf = "";
-  feed(chunk) {
-    this.buf += typeof chunk === "string" ? chunk : chunk.toString("utf-8");
-    const lines = [];
-    let nl = this.buf.indexOf(`
-`);
-    while (nl !== -1) {
-      lines.push(this.buf.slice(0, nl));
-      this.buf = this.buf.slice(nl + 1);
-      nl = this.buf.indexOf(`
-`);
-    }
-    return lines;
-  }
-}
-var init_protocol = () => {};
-
-// src/services/bridge/client.ts
-import { createConnection } from "node:net";
-import { existsSync as existsSync7 } from "node:fs";
-import { randomUUID as randomUUID2 } from "node:crypto";
-async function tryBridge(meshSlug, verb, args = {}, timeoutMs = DEFAULT_TIMEOUT_MS) {
-  const path = socketPath(meshSlug);
-  if (!existsSync7(path))
-    return null;
-  return new Promise((resolve) => {
-    const id = randomUUID2();
-    const req = { id, verb, args };
-    const parser = new LineParser;
-    let settled = false;
-    const finish = (value) => {
-      if (settled)
-        return;
-      settled = true;
-      try {
-        socket.destroy();
-      } catch {}
-      clearTimeout(timer);
-      resolve(value);
-    };
-    const socket = createConnection({ path });
-    const timer = setTimeout(() => {
-      finish(null);
-    }, timeoutMs);
-    socket.on("connect", () => {
-      try {
-        socket.write(frame(req));
-      } catch {
-        finish(null);
-      }
-    });
-    socket.on("data", (chunk) => {
-      const lines = parser.feed(chunk);
-      for (const line of lines) {
-        if (!line.trim())
-          continue;
-        let res;
-        try {
-          res = JSON.parse(line);
-        } catch {
-          continue;
-        }
-        if (res.id !== id)
-          continue;
-        if (res.ok)
-          finish({ ok: true, result: res.result });
-        else
-          finish({ ok: false, error: res.error });
-        return;
-      }
-    });
-    socket.on("error", (err) => {
-      const code = err.code;
-      if (code === "ECONNREFUSED" || code === "ENOENT" || code === "EPERM") {
-        finish(null);
-      } else {
-        finish(null);
-      }
-    });
-    socket.on("close", () => {
-      finish(null);
-    });
-  });
-}
-var DEFAULT_TIMEOUT_MS = 5000;
-var init_client4 = __esm(() => {
-  init_protocol();
-});
-
 // src/ui/warnings.ts
 function warnDaemonState(res, opts = {}) {
   if (alreadyWarned)
@@ -7494,6 +7505,8 @@ function warnDaemonState(res, opts = {}) {
     return false;
   if (res.state === "up")
     return false;
+  if (getDaemonPolicy().mode === "strict" && res.state !== "started")
+    return false;
   alreadyWarned = true;
   const tag = (label) => `[claudemesh] ${label}`;
   const hint = (s) => dim(s);
@@ -7519,6 +7532,7 @@ function warnDaemonState(res, opts = {}) {
 }
 var alreadyWarned = false;
 var init_warnings = __esm(() => {
+  init_policy();
   init_styles();
 });
 
@@ -7540,7 +7554,10 @@ function meshQuery(mesh) {
   return mesh ? `?mesh=${encodeURIComponent(mesh)}` : "";
 }
 async function daemonReachable() {
-  const res = await ensureDaemonReady();
+  const policy2 = getDaemonPolicy();
+  if (policy2.mode === "no-daemon")
+    return false;
+  const res = await ensureDaemonReady({ noAutoSpawn: false });
   warnDaemonState(res, {});
   return res.state === "up" || res.state === "started";
 }
@@ -7718,9 +7735,49 @@ async function trySendViaDaemon(args) {
 var init_daemon_route = __esm(() => {
   init_client3();
   init_lifecycle();
+  init_policy();
   init_warnings();
 });
 
+// src/services/session/resolve.ts
+var exports_resolve = {};
+__export(exports_resolve, {
+  getSessionInfo: () => getSessionInfo,
+  _resetSessionCache: () => _resetSessionCache
+});
+async function getSessionInfo() {
+  if (cached !== undefined)
+    return cached;
+  const tok = readSessionTokenFromEnv();
+  if (!tok) {
+    cached = null;
+    return null;
+  }
+  try {
+    const res = await ipc({
+      path: "/v1/sessions/me",
+      timeoutMs: 1500
+    });
+    if (res.status !== 200 || !res.body.session) {
+      cached = null;
+      return null;
+    }
+    cached = res.body.session;
+    return cached;
+  } catch {
+    cached = null;
+    return null;
+  }
+}
+function _resetSessionCache() {
+  cached = undefined;
+}
+var cached = undefined;
+var init_resolve = __esm(() => {
+  init_client3();
+  init_token();
+});
+
 // src/commands/peers.ts
 var exports_peers = {};
 __export(exports_peers, {
@@ -7745,11 +7802,6 @@ async function listPeersForMesh(slug) {
       return dr.map((p) => annotateSelf(p, selfMemberPubkey, null));
     }
   } catch {}
-  const bridged = await tryBridge(slug, "peers");
-  if (bridged && bridged.ok) {
-    const peers = bridged.result;
-    return peers.map((p) => annotateSelf(p, selfMemberPubkey, null));
-  }
   let result = [];
   await withMesh({ meshSlug: slug }, async (client) => {
     const all = await client.listPeers();
@@ -7765,7 +7817,14 @@ function annotateSelf(peer, selfMemberPubkey, selfSessionPubkey) {
 }
 async function runPeers(flags) {
   const config = readConfig();
-  const slugs = flags.mesh ? [flags.mesh] : config.meshes.map((m) => m.slug);
+  let slugs;
+  if (flags.mesh) {
+    slugs = [flags.mesh];
+  } else {
+    const { getSessionInfo: getSessionInfo2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
+    const sess = await getSessionInfo2();
+    slugs = sess ? [sess.mesh] : config.meshes.map((m) => m.slug);
+  }
   if (slugs.length === 0) {
     render.err("No meshes joined.");
     render.hint("claudemesh <invite-url>    # join + launch");
@@ -7819,7 +7878,6 @@ var FIELD_ALIAS;
 var init_peers = __esm(() => {
   init_connect();
   init_facade();
-  init_client4();
   init_render();
   init_styles();
   FIELD_ALIAS = {
@@ -7865,26 +7923,6 @@ async function runSend(flags, to, message) {
       process.exit(1);
     }
   }
-  if (meshSlug) {
-    const bridged = await tryBridge(meshSlug, "send", { to, message, priority });
-    if (bridged !== null) {
-      if (bridged.ok) {
-        const r = bridged.result;
-        if (flags.json) {
-          console.log(JSON.stringify({ ok: true, messageId: r.messageId, target: to }));
-        } else {
-          render.ok(`sent to ${to}`, r.messageId ? dim(r.messageId.slice(0, 8)) : undefined);
-        }
-        return;
-      }
-      if (flags.json) {
-        console.log(JSON.stringify({ ok: false, error: bridged.error }));
-      } else {
-        render.err(`send failed: ${bridged.error}`);
-      }
-      process.exit(1);
-    }
-  }
   await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
     let targetSpec = to;
     if (to.startsWith("#") && !/^#[0-9a-z_-]{20,}$/i.test(to)) {
@@ -7927,7 +7965,6 @@ async function runSend(flags, to, message) {
 var init_send = __esm(() => {
   init_connect();
   init_facade();
-  init_client4();
   init_daemon_route();
   init_render();
   init_styles();
@@ -8255,33 +8292,12 @@ __export(exports_broker_actions, {
   runForget: () => runForget,
   runClock: () => runClock
 });
-function unambiguousMesh(opts) {
-  if (opts.mesh)
-    return opts.mesh;
-  const config = readConfig();
-  return config.meshes.length === 1 ? config.meshes[0].slug : null;
-}
 async function runStatusSet(state, opts) {
   const valid = ["idle", "working", "dnd"];
   if (!valid.includes(state)) {
     render.err(`Invalid status: ${state}`, `must be one of: ${valid.join(", ")}`);
     return EXIT.INVALID_ARGS;
   }
-  const meshSlug = unambiguousMesh(opts);
-  if (meshSlug) {
-    const bridged = await tryBridge(meshSlug, "status_set", { status: state });
-    if (bridged !== null) {
-      if (bridged.ok) {
-        if (opts.json)
-          console.log(JSON.stringify({ status: state }));
-        else
-          render.ok(`status set to ${bold(state)}`);
-        return EXIT.SUCCESS;
-      }
-      render.err(bridged.error);
-      return EXIT.INTERNAL_ERROR;
-    }
-  }
   await withMesh({ meshSlug: opts.mesh ?? null }, async (client) => {
     await client.setStatus(state);
   });
@@ -8296,21 +8312,6 @@ async function runSummary(text, opts) {
     render.err("Usage: claudemesh summary <text>");
     return EXIT.INVALID_ARGS;
   }
-  const meshSlug = unambiguousMesh(opts);
-  if (meshSlug) {
-    const bridged = await tryBridge(meshSlug, "summary", { summary: text });
-    if (bridged !== null) {
-      if (bridged.ok) {
-        if (opts.json)
-          console.log(JSON.stringify({ summary: text }));
-        else
-          render.ok("summary set", dim(text));
-        return EXIT.SUCCESS;
-      }
-      render.err(bridged.error);
-      return EXIT.INTERNAL_ERROR;
-    }
-  }
   await withMesh({ meshSlug: opts.mesh ?? null }, async (client) => {
     await client.setSummary(text);
   });
@@ -8330,21 +8331,6 @@ async function runVisible(value, opts) {
     render.err("Usage: claudemesh visible <true|false>");
     return EXIT.INVALID_ARGS;
   }
-  const meshSlug = unambiguousMesh(opts);
-  if (meshSlug) {
-    const bridged = await tryBridge(meshSlug, "visible", { visible });
-    if (bridged !== null) {
-      if (bridged.ok) {
-        if (opts.json)
-          console.log(JSON.stringify({ visible }));
-        else
-          render.ok(visible ? "you are now visible to peers" : "you are now hidden", visible ? undefined : "direct messages still reach you");
-        return EXIT.SUCCESS;
-      }
-      render.err(bridged.error);
-      return EXIT.INTERNAL_ERROR;
-    }
-  }
   await withMesh({ meshSlug: opts.mesh ?? null }, async (client) => {
     await client.setVisible(visible);
   });
@@ -8574,8 +8560,6 @@ async function runTaskComplete(id, result, opts) {
 }
 var init_broker_actions = __esm(() => {
   init_connect();
-  init_facade();
-  init_client4();
   init_daemon_route();
   init_render();
   init_styles();
@@ -8810,12 +8794,12 @@ var init_whoami = __esm(() => {
 });
 
 // src/daemon/lock.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync7, unlinkSync as unlinkSync3, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync8, unlinkSync as unlinkSync3, writeFileSync as writeFileSync9 } from "node:fs";
 import { dirname as dirname4 } from "node:path";
 function acquireSingletonLock() {
   mkdirSync5(dirname4(DAEMON_PATHS.PID_FILE), { recursive: true, mode: 448 });
   if (existsSync8(DAEMON_PATHS.PID_FILE)) {
-    const raw = readFileSync7(DAEMON_PATHS.PID_FILE, "utf8").trim();
+    const raw = readFileSync8(DAEMON_PATHS.PID_FILE, "utf8").trim();
     const oldPid = Number.parseInt(raw, 10);
     if (Number.isFinite(oldPid) && oldPid > 0 && isProcessAlive(oldPid)) {
       return { result: "already-running", pid: oldPid };
@@ -8823,22 +8807,22 @@ function acquireSingletonLock() {
     try {
       unlinkSync3(DAEMON_PATHS.PID_FILE);
     } catch {}
-    writeFileSync8(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
+    writeFileSync9(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
     return { result: "stale", pid: process.pid };
   }
-  writeFileSync8(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
+  writeFileSync9(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
   return { result: "acquired", pid: process.pid };
 }
 function releaseSingletonLock() {
   try {
-    const raw = readFileSync7(DAEMON_PATHS.PID_FILE, "utf8").trim();
+    const raw = readFileSync8(DAEMON_PATHS.PID_FILE, "utf8").trim();
     if (Number.parseInt(raw, 10) === process.pid)
       unlinkSync3(DAEMON_PATHS.PID_FILE);
   } catch {}
 }
 function readRunningPid() {
   try {
-    const raw = readFileSync7(DAEMON_PATHS.PID_FILE, "utf8").trim();
+    const raw = readFileSync8(DAEMON_PATHS.PID_FILE, "utf8").trim();
     const pid = Number.parseInt(raw, 10);
     if (Number.isFinite(pid) && pid > 0 && isProcessAlive(pid))
       return pid;
@@ -8984,17 +8968,17 @@ function requeueDeadOrPending(db, args) {
 
 // src/daemon/db/sqlite.ts
 async function loadSqlite() {
-  if (cached)
-    return cached;
+  if (cached2)
+    return cached2;
   try {
     const mod = await import("node:sqlite");
-    cached = mod.DatabaseSync;
-    return cached;
+    cached2 = mod.DatabaseSync;
+    return cached2;
   } catch (nodeErr) {
     try {
       const bunMod = await import("bun:sqlite");
-      cached = bunMod.Database;
-      return cached;
+      cached2 = bunMod.Database;
+      return cached2;
     } catch {
       const msg = `claudemesh daemon requires Node.js 22.5+ for the embedded SQLite store (node:sqlite), or Bun (bun:sqlite) for dev. Current: ${process.version}. Original error: ${String(nodeErr)}`;
       throw new Error(msg);
@@ -9025,7 +9009,7 @@ function inImmediateTx(db, fn) {
     throw err;
   }
 }
-var cached = null;
+var cached2 = null;
 
 // src/daemon/fingerprint.ts
 import { createHash } from "node:crypto";
@@ -9074,10 +9058,10 @@ var init_fingerprint = __esm(() => {
 });
 
 // src/daemon/ipc/handlers/send.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 function acceptSend(req, deps) {
   const now = (deps.now ?? Date.now)();
-  const newId = deps.newId ?? randomUUID3;
+  const newId = deps.newId ?? randomUUID2;
   const clientId = req.client_message_id?.trim() || ulidLike(newId);
   const body = Buffer.from(req.message, "utf8");
   const fingerprint = computeRequestFingerprint({
@@ -9268,11 +9252,72 @@ function bindSseStream(res, bus) {
   return cleanup;
 }
 
+// src/daemon/session-registry.ts
+function startReaper() {
+  if (reaperHandle)
+    return;
+  reaperHandle = setInterval(reapDead, REAPER_INTERVAL_MS).unref?.() ?? reaperHandle;
+}
+function registerSession(info) {
+  const priorToken = bySessionId.get(info.sessionId);
+  if (priorToken && priorToken !== info.token)
+    byToken.delete(priorToken);
+  const stored = { ...info, registeredAt: Date.now() };
+  byToken.set(info.token, stored);
+  bySessionId.set(info.sessionId, info.token);
+  return stored;
+}
+function deregisterByToken(token) {
+  const entry = byToken.get(token);
+  if (!entry)
+    return false;
+  byToken.delete(token);
+  if (bySessionId.get(entry.sessionId) === token)
+    bySessionId.delete(entry.sessionId);
+  return true;
+}
+function resolveToken(token) {
+  const entry = byToken.get(token);
+  if (!entry)
+    return null;
+  if (Date.now() - entry.registeredAt > TTL_MS) {
+    deregisterByToken(token);
+    return null;
+  }
+  return entry;
+}
+function listSessions() {
+  return [...byToken.values()];
+}
+function reapDead() {
+  const dead = [];
+  for (const [token, info] of byToken.entries()) {
+    if (Date.now() - info.registeredAt > TTL_MS) {
+      dead.push(token);
+      continue;
+    }
+    try {
+      process.kill(info.pid, 0);
+    } catch {
+      dead.push(token);
+    }
+  }
+  for (const t of dead)
+    deregisterByToken(t);
+}
+var TTL_MS, REAPER_INTERVAL_MS, byToken, bySessionId, reaperHandle = null;
+var init_session_registry = __esm(() => {
+  TTL_MS = 24 * 60 * 60 * 1000;
+  REAPER_INTERVAL_MS = 30 * 1000;
+  byToken = new Map;
+  bySessionId = new Map;
+});
+
 // src/daemon/ipc/server.ts
 import { createServer as createServer2 } from "node:http";
 import { chmodSync as chmodSync3, existsSync as existsSync9, unlinkSync as unlinkSync4 } from "node:fs";
 import { timingSafeEqual } from "node:crypto";
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 function startIpcServer(opts) {
   const log2 = opts.log ?? defaultLogger;
   const handler = makeHandler({
@@ -9372,11 +9417,19 @@ function makeHandler(opts) {
         return;
       }
     }
+    let session = null;
+    {
+      const authz = req.headers.authorization ?? "";
+      const sm = /^ClaudeMesh-Session\s+([0-9a-f]{64})$/i.exec(authz.trim());
+      if (sm && sm[1])
+        session = resolveToken(sm[1].toLowerCase());
+    }
+    const meshFromCtx = (explicit) => explicit && explicit.trim() ? explicit : session?.mesh ?? null;
     if (req.method === "GET" && url.pathname === "/v1/version") {
       respond(res, 200, {
         daemon_version: VERSION,
         ipc_api: "v1",
-        ipc_features: ["version", "health", "send", "inbox", "events", "peers", "profile", "skills", "state", "memory"],
+        ipc_features: ["version", "health", "send", "inbox", "events", "peers", "profile", "skills", "state", "memory", "sessions"],
         schema_version: 1
       });
       return;
@@ -9385,6 +9438,70 @@ function makeHandler(opts) {
       respond(res, 200, { ok: true, pid: process.pid });
       return;
     }
+    if (req.method === "POST" && url.pathname === "/v1/sessions/register") {
+      try {
+        const body = await readJsonBody(req, 64 * 1024);
+        if (!body) {
+          respond(res, 400, { error: "missing body" });
+          return;
+        }
+        const token = typeof body.token === "string" ? body.token : "";
+        if (!/^[0-9a-f]{64}$/i.test(token)) {
+          respond(res, 400, { error: "token must be 64 hex chars" });
+          return;
+        }
+        const sessionId = typeof body.session_id === "string" ? body.session_id : "";
+        const mesh = typeof body.mesh === "string" ? body.mesh : "";
+        const displayName = typeof body.display_name === "string" ? body.display_name : "";
+        const pid = typeof body.pid === "number" ? body.pid : 0;
+        if (!sessionId || !mesh || !displayName || !pid) {
+          respond(res, 400, { error: "session_id, mesh, display_name, pid all required" });
+          return;
+        }
+        const cwd = typeof body.cwd === "string" ? body.cwd : undefined;
+        const role = typeof body.role === "string" ? body.role : undefined;
+        const groups = Array.isArray(body.groups) ? body.groups.filter((g) => typeof g === "string") : undefined;
+        const stored = registerSession({
+          token: token.toLowerCase(),
+          sessionId,
+          mesh,
+          displayName,
+          pid,
+          cwd,
+          role,
+          groups
+        });
+        opts.log("info", "session_registered", { sessionId, mesh, pid });
+        respond(res, 200, { ok: true, registered_at: stored.registeredAt });
+      } catch (e) {
+        respond(res, 400, { error: String(e) });
+      }
+      return;
+    }
+    if (req.method === "DELETE" && url.pathname.startsWith("/v1/sessions/")) {
+      const tail = url.pathname.slice("/v1/sessions/".length);
+      if (!/^[0-9a-f]{64}$/i.test(tail)) {
+        respond(res, 400, { error: "invalid token" });
+        return;
+      }
+      const ok = deregisterByToken(tail.toLowerCase());
+      respond(res, ok ? 200 : 404, { ok, token_prefix: tail.slice(0, 8) });
+      return;
+    }
+    if (req.method === "GET" && url.pathname === "/v1/sessions/me") {
+      if (!session) {
+        respond(res, 401, { error: "no session token" });
+        return;
+      }
+      const { token, ...redacted } = session;
+      respond(res, 200, { session: { ...redacted, token_prefix: token.slice(0, 8) } });
+      return;
+    }
+    if (req.method === "GET" && url.pathname === "/v1/sessions") {
+      const all = listSessions().map(({ token, ...rest }) => ({ ...rest, token_prefix: token.slice(0, 8) }));
+      respond(res, 200, { sessions: all });
+      return;
+    }
     if (req.method === "GET" && url.pathname === "/v1/events") {
       if (!opts.bus) {
         respond(res, 503, { error: "event bus not initialised" });
@@ -9398,7 +9515,7 @@ function makeHandler(opts) {
         respond(res, 503, { error: "broker not initialised" });
         return;
       }
-      const filterMesh = url.searchParams.get("mesh") ?? undefined;
+      const filterMesh = meshFromCtx(url.searchParams.get("mesh")) ?? undefined;
       try {
         const all = [];
         for (const [slug, b] of opts.brokers.entries()) {
@@ -9423,7 +9540,7 @@ function makeHandler(opts) {
         respond(res, 503, { error: "broker not initialised" });
         return;
       }
-      const filterMesh = url.searchParams.get("mesh") ?? undefined;
+      const filterMesh = meshFromCtx(url.searchParams.get("mesh")) ?? undefined;
       const key = url.searchParams.get("key");
       try {
         if (key) {
@@ -9464,7 +9581,7 @@ function makeHandler(opts) {
           respond(res, 400, { error: "missing 'key' (string)" });
           return;
         }
-        const requested = (typeof body.mesh === "string" ? body.mesh : null) || null;
+        const requested = meshFromCtx(typeof body.mesh === "string" ? body.mesh : null);
         let chosen = requested;
         if (!chosen && opts.brokers.size === 1)
           chosen = opts.brokers.keys().next().value;
@@ -9490,7 +9607,7 @@ function makeHandler(opts) {
         return;
       }
       const query = url.searchParams.get("q") ?? "";
-      const filterMesh = url.searchParams.get("mesh") ?? undefined;
+      const filterMesh = meshFromCtx(url.searchParams.get("mesh")) ?? undefined;
       try {
         const all = [];
         for (const [slug, b] of opts.brokers.entries()) {
@@ -9517,7 +9634,7 @@ function makeHandler(opts) {
           respond(res, 400, { error: "missing 'content' (string)" });
           return;
         }
-        const requested = (typeof body.mesh === "string" ? body.mesh : null) || null;
+        const requested = meshFromCtx(typeof body.mesh === "string" ? body.mesh : null);
         let chosen = requested;
         if (!chosen && opts.brokers.size === 1)
           chosen = opts.brokers.keys().next().value;
@@ -9575,7 +9692,7 @@ function makeHandler(opts) {
         return;
       }
       const query = url.searchParams.get("query") ?? undefined;
-      const filterMesh = url.searchParams.get("mesh") ?? undefined;
+      const filterMesh = meshFromCtx(url.searchParams.get("mesh")) ?? undefined;
       try {
         const all = [];
         for (const [slug, b] of opts.brokers.entries()) {
@@ -9605,7 +9722,7 @@ function makeHandler(opts) {
         respond(res, 400, { error: "missing skill name" });
         return;
       }
-      const filterMesh = url.searchParams.get("mesh") ?? undefined;
+      const filterMesh = meshFromCtx(url.searchParams.get("mesh")) ?? undefined;
       try {
         for (const [slug, b] of opts.brokers.entries()) {
           if (filterMesh && filterMesh !== slug)
@@ -9633,7 +9750,7 @@ function makeHandler(opts) {
           respond(res, 400, { error: "expected JSON object" });
           return;
         }
-        const requested = (typeof body.mesh === "string" ? body.mesh : url.searchParams.get("mesh")) || null;
+        const requested = meshFromCtx(typeof body.mesh === "string" ? body.mesh : url.searchParams.get("mesh"));
         const targets = requested ? [opts.brokers.get(requested)].filter(Boolean) : [...opts.brokers.values()];
         if (targets.length === 0) {
           respond(res, 404, { error: "mesh_not_attached", mesh: requested });
@@ -9743,11 +9860,11 @@ function makeHandler(opts) {
           respond(res, 400, { error: "missing 'id'" });
           return;
         }
-        const newId = typeof body.new_client_message_id === "string" && body.new_client_message_id.trim() ? body.new_client_message_id.trim() : randomUUID4();
+        const newId = typeof body.new_client_message_id === "string" && body.new_client_message_id.trim() ? body.new_client_message_id.trim() : randomUUID3();
         const result = requeueDeadOrPending(opts.outboxDb, {
           id: body.id,
           newClientMessageId: newId,
-          newRowId: randomUUID4(),
+          newRowId: randomUUID3(),
           now: Date.now(),
           abortedBy: typeof body.aborted_by === "string" ? body.aborted_by : "operator"
         });
@@ -9917,16 +10034,16 @@ function parseSendRequest(body, idempotencyHeader) {
 }
 async function resolveAndEncrypt(req, broker, meshSecretKey, meshSlug) {
   const { encryptDirect: encryptDirect2 } = await Promise.resolve().then(() => (init_box(), exports_box));
-  const { randomBytes: randomBytes5 } = await import("node:crypto");
+  const { randomBytes: randomBytes6 } = await import("node:crypto");
   const to = req.to.trim();
   if (to.startsWith("#") && /^#[0-9a-z_-]{20,}$/i.test(to)) {
     const ciphertext = Buffer.from(req.message, "utf8").toString("base64");
-    const nonce = randomBytes5(24).toString("base64");
+    const nonce = randomBytes6(24).toString("base64");
     return { target_spec: to, ciphertext, nonce, mesh: meshSlug ?? "" };
   }
   if (to.startsWith("@") || to === "*") {
     const ciphertext = Buffer.from(req.message, "utf8").toString("base64");
-    const nonce = randomBytes5(24).toString("base64");
+    const nonce = randomBytes6(24).toString("base64");
     return { target_spec: to, ciphertext, nonce, mesh: meshSlug ?? "" };
   }
   if (/^[0-9a-f]{64}$/i.test(to)) {
@@ -9967,6 +10084,7 @@ function respond(res, status, body) {
 var init_server = __esm(() => {
   init_paths2();
   init_send2();
+  init_session_registry();
   init_urls();
 });
 
@@ -10598,8 +10716,8 @@ function bufferToHex(b) {
   return s;
 }
 async function randomNonce2() {
-  const { randomBytes: randomBytes5 } = await import("node:crypto");
-  return randomBytes5(24).toString("base64");
+  const { randomBytes: randomBytes6 } = await import("node:crypto");
+  return randomBytes6(24).toString("base64");
 }
 function defaultLog2(level, msg, meta) {
   const line = JSON.stringify({ level, msg, ...meta, ts: new Date().toISOString() });
@@ -10614,7 +10732,7 @@ var POLL_INTERVAL_MS = 500, MAX_ATTEMPTS_PER_ROW = 25, BACKOFF_BASE_MS = 500, BA
 var init_drain = () => {};
 
 // src/daemon/inbound.ts
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 async function handleBrokerPush(msg, ctx) {
   if (msg.subtype === "system" && typeof msg.event === "string") {
     ctx.bus.publish(mapSystemEventKind(msg.event), {
@@ -10637,14 +10755,14 @@ async function handleBrokerPush(msg, ctx) {
   const createdAt = stringOrNull(msg.createdAt);
   const priority = stringOrNull(msg.priority) ?? "next";
   const subtype = stringOrNull(msg.subtype);
-  const clientMessageId = stringOrNull(msg.client_message_id) ?? brokerMessageId ?? randomUUID5();
+  const clientMessageId = stringOrNull(msg.client_message_id) ?? brokerMessageId ?? randomUUID4();
   const body = await decryptOrFallback({
     ciphertext,
     nonce,
     senderPubkey,
     ctx
   });
-  const id = randomUUID5();
+  const id = randomUUID4();
   const inserted = insertIfNew(ctx.db, {
     id,
     client_message_id: clientMessageId,
@@ -10721,12 +10839,12 @@ __export(exports_identity, {
   checkFingerprint: () => checkFingerprint,
   acceptCurrentHost: () => acceptCurrentHost
 });
-import { existsSync as existsSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join7 } from "node:path";
 import { createHash as createHash2 } from "node:crypto";
 import { networkInterfaces } from "node:os";
 function path() {
-  return join8(DAEMON_PATHS.DAEMON_DIR, FILE_NAME);
+  return join7(DAEMON_PATHS.DAEMON_DIR, FILE_NAME);
 }
 function computeCurrentFingerprint() {
   const host_id = readHostId() ?? "";
@@ -10743,12 +10861,12 @@ function computeCurrentFingerprint() {
 function checkFingerprint() {
   const current = computeCurrentFingerprint();
   if (!existsSync10(path())) {
-    writeFileSync9(path(), JSON.stringify(current, null, 2), { mode: 384 });
+    writeFileSync10(path(), JSON.stringify(current, null, 2), { mode: 384 });
     return { result: "first_run", current };
   }
   let stored;
   try {
-    stored = JSON.parse(readFileSync8(path(), "utf8"));
+    stored = JSON.parse(readFileSync9(path(), "utf8"));
   } catch {
     return { result: "unavailable", current };
   }
@@ -10758,14 +10876,14 @@ function checkFingerprint() {
 }
 function acceptCurrentHost() {
   const current = computeCurrentFingerprint();
-  writeFileSync9(path(), JSON.stringify(current, null, 2), { mode: 384 });
+  writeFileSync10(path(), JSON.stringify(current, null, 2), { mode: 384 });
   return current;
 }
 function readHostId() {
   if (process.platform === "linux") {
     for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
       try {
-        const raw = readFileSync8(p, "utf8").trim();
+        const raw = readFileSync9(p, "utf8").trim();
         if (raw)
           return `linux:${raw}`;
       } catch {}
@@ -10810,7 +10928,7 @@ var init_identity = __esm(() => {
 });
 
 // src/daemon/run.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync10 } from "node:fs";
 function detectContainer() {
   if (process.env.KUBERNETES_SERVICE_HOST)
     return true;
@@ -10819,7 +10937,7 @@ function detectContainer() {
   try {
     if (existsSync11("/.dockerenv"))
       return true;
-    const cg = readFileSync9("/proc/1/cgroup", "utf8");
+    const cg = readFileSync10("/proc/1/cgroup", "utf8");
     if (/(docker|kubepods|containerd)/.test(cg))
       return true;
   } catch {}
@@ -10838,10 +10956,10 @@ async function runDaemon(opts = {}) {
 `);
   }
   const fpCheck = checkFingerprint();
-  const policy = opts.clonePolicy ?? "refuse";
+  const policy2 = opts.clonePolicy ?? "refuse";
   if (fpCheck.result === "mismatch") {
     const msg = `host_fingerprint mismatch: this daemon dir was started on a different host.`;
-    if (policy === "refuse") {
+    if (policy2 === "refuse") {
       process.stderr.write(`${msg}
 `);
       process.stderr.write(`  stored host_id: ${fpCheck.stored?.host_id}
@@ -10855,7 +10973,7 @@ async function runDaemon(opts = {}) {
       releaseSingletonLock();
       return 4;
     }
-    if (policy === "warn") {
+    if (policy2 === "warn") {
       process.stderr.write(`WARN: ${msg} (continuing per [clone] policy=warn)
 `);
     }
@@ -10944,6 +11062,7 @@ async function runDaemon(opts = {}) {
   }
   let drain = null;
   drain = startDrainWorker({ db: outboxDb, brokers });
+  startReaper();
   const ipc2 = startIpcServer({
     localToken,
     tcpEnabled,
@@ -11005,6 +11124,7 @@ var init_run = __esm(() => {
   init_lock();
   init_local_token();
   init_server();
+  init_session_registry();
   init_broker();
   init_drain();
   init_inbound();
@@ -11020,10 +11140,10 @@ __export(exports_service_install, {
   installService: () => installService,
   detectPlatform: () => detectPlatform
 });
-import { existsSync as existsSync12, mkdirSync as mkdirSync7, writeFileSync as writeFileSync10, unlinkSync as unlinkSync5, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync7, writeFileSync as writeFileSync11, unlinkSync as unlinkSync5, readFileSync as readFileSync11 } from "node:fs";
 import { execSync as execSync2 } from "node:child_process";
-import { homedir as homedir6 } from "node:os";
-import { join as join9, dirname as dirname5 } from "node:path";
+import { homedir as homedir5 } from "node:os";
+import { join as join8, dirname as dirname5 } from "node:path";
 function detectPlatform() {
   if (process.platform === "darwin")
     return "darwin";
@@ -11074,7 +11194,7 @@ function uninstallService() {
   return { platform: platform5, removed };
 }
 function darwinPlistPath() {
-  return join9(homedir6(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
+  return join8(homedir5(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
 }
 function installDarwin(args) {
   const plist = darwinPlistPath();
@@ -11108,18 +11228,18 @@ function installDarwin(args) {
   <key>StandardErrorPath</key>
   <string>${escapeXml(log2)}</string>
   <key>WorkingDirectory</key>
-  <string>${escapeXml(homedir6())}</string>
+  <string>${escapeXml(homedir5())}</string>
   <key>EnvironmentVariables</key>
   <dict>
     <key>HOME</key>
-    <string>${escapeXml(homedir6())}</string>
+    <string>${escapeXml(homedir5())}</string>
     <key>PATH</key>
     <string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
   </dict>
 </dict>
 </plist>
 `;
-  writeFileSync10(plist, xml, { mode: 420 });
+  writeFileSync11(plist, xml, { mode: 420 });
   return {
     platform: "darwin",
     unitPath: plist,
@@ -11127,7 +11247,7 @@ function installDarwin(args) {
   };
 }
 function linuxUnitPath() {
-  return join9(homedir6(), ".config", "systemd", "user", SYSTEMD_UNIT);
+  return join8(homedir5(), ".config", "systemd", "user", SYSTEMD_UNIT);
 }
 function installLinux(args) {
   const unit = linuxUnitPath();
@@ -11156,7 +11276,7 @@ Environment=PATH=/usr/local/bin:/usr/bin:/bin
 [Install]
 WantedBy=default.target
 `;
-  writeFileSync10(unit, content, { mode: 420 });
+  writeFileSync11(unit, content, { mode: 420 });
   return {
     platform: "linux",
     unitPath: unit,
@@ -11179,7 +11299,7 @@ function readInstalledUnit() {
   if (!existsSync12(path2))
     return { platform: platform5, path: null, content: null };
   try {
-    return { platform: platform5, path: path2, content: readFileSync10(path2, "utf8") };
+    return { platform: platform5, path: path2, content: readFileSync11(path2, "utf8") };
   } catch {
     return { platform: platform5, path: path2, content: null };
   }
@@ -11523,17 +11643,17 @@ import {
   copyFileSync,
   existsSync as existsSync13,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync11,
-  writeFileSync as writeFileSync11
+  readFileSync as readFileSync12,
+  writeFileSync as writeFileSync12
 } from "node:fs";
-import { homedir as homedir7, platform as platform5 } from "node:os";
-import { dirname as dirname6, join as join10, resolve } from "node:path";
+import { homedir as homedir6, platform as platform5 } from "node:os";
+import { dirname as dirname6, join as join9, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync as spawnSync3 } from "node:child_process";
 function readClaudeConfig() {
   if (!existsSync13(CLAUDE_CONFIG))
     return {};
-  const text = readFileSync11(CLAUDE_CONFIG, "utf-8").trim();
+  const text = readFileSync12(CLAUDE_CONFIG, "utf-8").trim();
   if (!text)
     return {};
   try {
@@ -11545,10 +11665,10 @@ function readClaudeConfig() {
 function backupClaudeConfig() {
   if (!existsSync13(CLAUDE_CONFIG))
     return;
-  const backupDir = join10(dirname6(CLAUDE_CONFIG), ".claude", "backups");
+  const backupDir = join9(dirname6(CLAUDE_CONFIG), ".claude", "backups");
   mkdirSync8(backupDir, { recursive: true });
   const ts = Date.now();
-  const dest = join10(backupDir, `.claude.json.pre-claudemesh.${ts}`);
+  const dest = join9(backupDir, `.claude.json.pre-claudemesh.${ts}`);
   copyFileSync(CLAUDE_CONFIG, dest);
 }
 function patchMcpServer(entry) {
@@ -11586,7 +11706,7 @@ function removeMcpServer() {
 }
 function flushClaudeConfig(obj) {
   mkdirSync8(dirname6(CLAUDE_CONFIG), { recursive: true });
-  writeFileSync11(CLAUDE_CONFIG, JSON.stringify(obj, null, 2) + `
+  writeFileSync12(CLAUDE_CONFIG, JSON.stringify(obj, null, 2) + `
 `, "utf-8");
   try {
     chmodSync4(CLAUDE_CONFIG, 384);
@@ -11608,7 +11728,7 @@ function resolveEntry() {
 function resolveBundledSkillsDir() {
   const here = fileURLToPath(import.meta.url);
   const pkgRoot = resolve(dirname6(here), "..", "..");
-  const skillsDir = join10(pkgRoot, "skills");
+  const skillsDir = join9(pkgRoot, "skills");
   if (existsSync13(skillsDir))
     return skillsDir;
   return null;
@@ -11622,13 +11742,13 @@ function installSkills() {
   for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
     if (!entry.isDirectory())
       continue;
-    const srcDir = join10(src, entry.name);
-    const dstDir = join10(CLAUDE_SKILLS_ROOT, entry.name);
+    const srcDir = join9(src, entry.name);
+    const dstDir = join9(CLAUDE_SKILLS_ROOT, entry.name);
     mkdirSync8(dstDir, { recursive: true });
     for (const file of fs.readdirSync(srcDir, { withFileTypes: true })) {
       if (!file.isFile())
         continue;
-      copyFileSync(join10(srcDir, file.name), join10(dstDir, file.name));
+      copyFileSync(join9(srcDir, file.name), join9(dstDir, file.name));
     }
     installed.push(entry.name);
   }
@@ -11643,7 +11763,7 @@ function uninstallSkills() {
   for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
     if (!entry.isDirectory())
       continue;
-    const dstDir = join10(CLAUDE_SKILLS_ROOT, entry.name);
+    const dstDir = join9(CLAUDE_SKILLS_ROOT, entry.name);
     if (existsSync13(dstDir)) {
       try {
         fs.rmSync(dstDir, { recursive: true, force: true });
@@ -11671,7 +11791,7 @@ function entriesEqual(a, b) {
 function readClaudeSettings() {
   if (!existsSync13(CLAUDE_SETTINGS))
     return {};
-  const text = readFileSync11(CLAUDE_SETTINGS, "utf-8").trim();
+  const text = readFileSync12(CLAUDE_SETTINGS, "utf-8").trim();
   if (!text)
     return {};
   try {
@@ -11682,7 +11802,7 @@ function readClaudeSettings() {
 }
 function writeClaudeSettings(obj) {
   mkdirSync8(dirname6(CLAUDE_SETTINGS), { recursive: true });
-  writeFileSync11(CLAUDE_SETTINGS, JSON.stringify(obj, null, 2) + `
+  writeFileSync12(CLAUDE_SETTINGS, JSON.stringify(obj, null, 2) + `
 `, "utf-8");
 }
 function installAllowedTools() {
@@ -11832,7 +11952,7 @@ function runInstall(args = []) {
       const installed = installSkills();
       if (installed.length > 0) {
         render.ok(`Claude skill${installed.length === 1 ? "" : "s"} installed`, installed.join(", "));
-        render.info(dim(`  ${join10(CLAUDE_SKILLS_ROOT, installed[0])}/SKILL.md`));
+        render.info(dim(`  ${join9(CLAUDE_SKILLS_ROOT, installed[0])}/SKILL.md`));
       }
     } catch (e) {
       render.warn(`skill install failed: ${e instanceof Error ? e.message : String(e)}`);
@@ -11969,9 +12089,9 @@ var init_install = __esm(() => {
   init_facade();
   init_render();
   init_styles();
-  CLAUDE_CONFIG = join10(homedir7(), ".claude.json");
-  CLAUDE_SETTINGS = join10(homedir7(), ".claude", "settings.json");
-  CLAUDE_SKILLS_ROOT = join10(homedir7(), ".claude", "skills");
+  CLAUDE_CONFIG = join9(homedir6(), ".claude.json");
+  CLAUDE_SETTINGS = join9(homedir6(), ".claude", "settings.json");
+  CLAUDE_SKILLS_ROOT = join9(homedir6(), ".claude", "skills");
   CLAUDEMESH_TOOLS = [
     "mcp__claudemesh__cancel_scheduled",
     "mcp__claudemesh__check_messages",
@@ -12026,26 +12146,26 @@ var exports_uninstall = {};
 __export(exports_uninstall, {
   uninstall: () => uninstall
 });
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync12, existsSync as existsSync14, rmSync as rmSync2, readdirSync as readdirSync2 } from "node:fs";
-import { join as join11, dirname as dirname7 } from "node:path";
-import { homedir as homedir8 } from "node:os";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync13, existsSync as existsSync14, rmSync as rmSync2, readdirSync as readdirSync2 } from "node:fs";
+import { join as join10, dirname as dirname7 } from "node:path";
+import { homedir as homedir7 } from "node:os";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function bundledSkillsDir() {
   const here = fileURLToPath2(import.meta.url);
-  const pkgRoot = join11(dirname7(here), "..", "..");
-  const skillsDir = join11(pkgRoot, "skills");
+  const pkgRoot = join10(dirname7(here), "..", "..");
+  const skillsDir = join10(pkgRoot, "skills");
   return existsSync14(skillsDir) ? skillsDir : null;
 }
 async function uninstall() {
   let removed = 0;
   if (existsSync14(PATHS.CLAUDE_JSON)) {
     try {
-      const raw = readFileSync12(PATHS.CLAUDE_JSON, "utf-8");
+      const raw = readFileSync13(PATHS.CLAUDE_JSON, "utf-8");
       const config = JSON.parse(raw);
       const servers = config.mcpServers;
       if (servers && "claudemesh" in servers) {
         delete servers.claudemesh;
-        writeFileSync12(PATHS.CLAUDE_JSON, JSON.stringify(config, null, 2) + `
+        writeFileSync13(PATHS.CLAUDE_JSON, JSON.stringify(config, null, 2) + `
 `, "utf-8");
         render.ok("removed MCP server", dim("~/.claude.json"));
         removed++;
@@ -12054,7 +12174,7 @@ async function uninstall() {
   }
   if (existsSync14(PATHS.CLAUDE_SETTINGS)) {
     try {
-      const raw = readFileSync12(PATHS.CLAUDE_SETTINGS, "utf-8");
+      const raw = readFileSync13(PATHS.CLAUDE_SETTINGS, "utf-8");
       const config = JSON.parse(raw);
       const hooks = config.hooks;
       if (hooks) {
@@ -12075,7 +12195,7 @@ async function uninstall() {
           }
         }
         if (removedHooks > 0) {
-          writeFileSync12(PATHS.CLAUDE_SETTINGS, JSON.stringify(config, null, 2) + `
+          writeFileSync13(PATHS.CLAUDE_SETTINGS, JSON.stringify(config, null, 2) + `
 `, "utf-8");
           render.ok(`removed ${removedHooks} claudemesh hook${removedHooks === 1 ? "" : "s"}`, dim("settings.json"));
           removed++;
@@ -12090,7 +12210,7 @@ async function uninstall() {
       for (const entry of readdirSync2(src, { withFileTypes: true })) {
         if (!entry.isDirectory())
           continue;
-        const dst = join11(CLAUDE_SKILLS_ROOT2, entry.name);
+        const dst = join10(CLAUDE_SKILLS_ROOT2, entry.name);
         if (existsSync14(dst)) {
           try {
             rmSync2(dst, { recursive: true, force: true });
@@ -12115,7 +12235,7 @@ var init_uninstall = __esm(() => {
   init_render();
   init_styles();
   init_exit_codes();
-  CLAUDE_SKILLS_ROOT2 = join11(homedir8(), ".claude", "skills");
+  CLAUDE_SKILLS_ROOT2 = join10(homedir7(), ".claude", "skills");
 });
 
 // src/commands/doctor.ts
@@ -12123,9 +12243,9 @@ var exports_doctor = {};
 __export(exports_doctor, {
   runDoctor: () => runDoctor
 });
-import { existsSync as existsSync15, readFileSync as readFileSync13, statSync as statSync3 } from "node:fs";
-import { homedir as homedir9, platform as platform6 } from "node:os";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync14, statSync as statSync3 } from "node:fs";
+import { homedir as homedir8, platform as platform6 } from "node:os";
+import { join as join11 } from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function checkNode() {
   const major = Number(process.versions.node.split(".")[0]);
@@ -12149,7 +12269,7 @@ function checkClaudeOnPath() {
   };
 }
 function checkMcpRegistered() {
-  const claudeConfig = join12(homedir9(), ".claude.json");
+  const claudeConfig = join11(homedir8(), ".claude.json");
   if (!existsSync15(claudeConfig)) {
     return {
       name: "claudemesh MCP registered in ~/.claude.json",
@@ -12158,7 +12278,7 @@ function checkMcpRegistered() {
     };
   }
   try {
-    const cfg = JSON.parse(readFileSync13(claudeConfig, "utf-8"));
+    const cfg = JSON.parse(readFileSync14(claudeConfig, "utf-8"));
     const registered = Boolean(cfg.mcpServers?.["claudemesh"]);
     return {
       name: "claudemesh MCP registered in ~/.claude.json",
@@ -12175,7 +12295,7 @@ function checkMcpRegistered() {
   }
 }
 function checkHooksRegistered() {
-  const settings = join12(homedir9(), ".claude", "settings.json");
+  const settings = join11(homedir8(), ".claude", "settings.json");
   if (!existsSync15(settings)) {
     return {
       name: "Status hooks registered in ~/.claude/settings.json",
@@ -12184,7 +12304,7 @@ function checkHooksRegistered() {
     };
   }
   try {
-    const raw = readFileSync13(settings, "utf-8");
+    const raw = readFileSync14(settings, "utf-8");
     const has = raw.includes("claudemesh hook ");
     return {
       name: "Status hooks registered in ~/.claude/settings.json",
@@ -12560,13 +12680,13 @@ var init_check_claude_binary = __esm(() => {
 });
 
 // src/services/health/check-mcp-registered.ts
-import { existsSync as existsSync17, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync15 } from "node:fs";
 function checkMcpRegistered2() {
   try {
     if (!existsSync17(PATHS.CLAUDE_JSON)) {
       return { name: "mcp-registered", ok: false, message: "~/.claude.json not found" };
     }
-    const raw = readFileSync14(PATHS.CLAUDE_JSON, "utf-8");
+    const raw = readFileSync15(PATHS.CLAUDE_JSON, "utf-8");
     const config = JSON.parse(raw);
     if (config.mcpServers && "claudemesh" in config.mcpServers) {
       return { name: "mcp-registered", ok: true, message: "MCP server registered" };
@@ -12581,13 +12701,13 @@ var init_check_mcp_registered = __esm(() => {
 });
 
 // src/services/health/check-hooks-registered.ts
-import { existsSync as existsSync18, readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync18, readFileSync as readFileSync16 } from "node:fs";
 function checkHooksRegistered2() {
   try {
     if (!existsSync18(PATHS.CLAUDE_SETTINGS)) {
       return { name: "hooks-registered", ok: false, message: "~/.claude/settings.json not found" };
     }
-    const raw = readFileSync15(PATHS.CLAUDE_SETTINGS, "utf-8");
+    const raw = readFileSync16(PATHS.CLAUDE_SETTINGS, "utf-8");
     const config = JSON.parse(raw);
     if (config.hooks) {
       return { name: "hooks-registered", ok: true, message: "Hooks configured" };
@@ -12623,13 +12743,13 @@ var init_check_config_perms = __esm(() => {
 });
 
 // src/services/health/check-keypairs-valid.ts
-import { existsSync as existsSync20, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync20, readFileSync as readFileSync17 } from "node:fs";
 function checkKeypairsValid() {
   if (!existsSync20(PATHS.CONFIG_FILE)) {
     return { name: "keypairs-valid", ok: true, message: "No config (first run)" };
   }
   try {
-    const raw = readFileSync16(PATHS.CONFIG_FILE, "utf-8");
+    const raw = readFileSync17(PATHS.CONFIG_FILE, "utf-8");
     const config = JSON.parse(raw);
     const meshes = config.meshes ?? [];
     if (meshes.length === 0) {
@@ -13109,18 +13229,18 @@ var exports_url_handler = {};
 __export(exports_url_handler, {
   runUrlHandler: () => runUrlHandler
 });
-import { platform as platform7, homedir as homedir10 } from "node:os";
-import { existsSync as existsSync21, mkdirSync as mkdirSync9, writeFileSync as writeFileSync13, rmSync as rmSync3, chmodSync as chmodSync5 } from "node:fs";
-import { join as join13 } from "node:path";
+import { platform as platform7, homedir as homedir9 } from "node:os";
+import { existsSync as existsSync21, mkdirSync as mkdirSync9, writeFileSync as writeFileSync14, rmSync as rmSync3, chmodSync as chmodSync5 } from "node:fs";
+import { join as join12 } from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function resolveClaudemeshBin() {
   return process.argv[1] ?? "claudemesh";
 }
 function installDarwin2() {
   const binPath = resolveClaudemeshBin();
-  const appDir = join13(homedir10(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
-  const contents = join13(appDir, "Contents");
-  const macOS = join13(contents, "MacOS");
+  const appDir = join12(homedir9(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
+  const contents = join12(appDir, "Contents");
+  const macOS = join12(contents, "MacOS");
   mkdirSync9(macOS, { recursive: true });
   const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -13144,7 +13264,7 @@ function installDarwin2() {
   </array>
 </dict>
 </plist>`;
-  writeFileSync13(join13(contents, "Info.plist"), plist);
+  writeFileSync14(join12(contents, "Info.plist"), plist);
   const shim = `#!/bin/sh
 URL="$1"
 CODE=\${URL#claudemesh://}
@@ -13158,8 +13278,8 @@ tell application "Terminal"
 end tell
 EOF
 `;
-  const shimPath = join13(macOS, "open-url");
-  writeFileSync13(shimPath, shim);
+  const shimPath = join12(macOS, "open-url");
+  writeFileSync14(shimPath, shim);
   chmodSync5(shimPath, 493);
   const lsreg = spawnSync5("/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister", ["-f", appDir], { encoding: "utf-8" });
   if (lsreg.status !== 0) {
@@ -13170,7 +13290,7 @@ EOF
 }
 function installLinux2() {
   const binPath = resolveClaudemeshBin();
-  const appsDir = join13(homedir10(), ".local", "share", "applications");
+  const appsDir = join12(homedir9(), ".local", "share", "applications");
   mkdirSync9(appsDir, { recursive: true });
   const desktop = `[Desktop Entry]
 Type=Application
@@ -13182,8 +13302,8 @@ Terminal=true
 MimeType=x-scheme-handler/claudemesh;
 NoDisplay=true
 `;
-  const desktopPath = join13(appsDir, "claudemesh.desktop");
-  writeFileSync13(desktopPath, desktop);
+  const desktopPath = join12(appsDir, "claudemesh.desktop");
+  writeFileSync14(desktopPath, desktop);
   const xdg1 = spawnSync5("xdg-mime", ["default", "claudemesh.desktop", "x-scheme-handler/claudemesh"], { encoding: "utf-8" });
   if (xdg1.status !== 0) {
     render.warn("xdg-mime not available — skipped mime default registration");
@@ -13205,8 +13325,8 @@ function installWindows() {
     `[HKEY_CURRENT_USER\\Software\\Classes\\claudemesh\\shell\\open\\command]`,
     `@="\\"${binPath.replace(/\\/g, "\\\\")}\\" \\"%1\\""`
   ];
-  const regPath = join13(homedir10(), "claudemesh-handler.reg");
-  writeFileSync13(regPath, lines.join(`\r
+  const regPath = join12(homedir9(), "claudemesh-handler.reg");
+  writeFileSync14(regPath, lines.join(`\r
 `));
   const res = spawnSync5("reg.exe", ["import", regPath], { encoding: "utf-8" });
   if (res.status !== 0) {
@@ -13217,14 +13337,14 @@ function installWindows() {
   return EXIT.SUCCESS;
 }
 function uninstallDarwin() {
-  const appDir = join13(homedir10(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
+  const appDir = join12(homedir9(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
   if (existsSync21(appDir))
     rmSync3(appDir, { recursive: true, force: true });
   render.ok("removed claudemesh:// handler on macOS");
   return EXIT.SUCCESS;
 }
 function uninstallLinux() {
-  const desktopPath = join13(homedir10(), ".local", "share", "applications", "claudemesh.desktop");
+  const desktopPath = join12(homedir9(), ".local", "share", "applications", "claudemesh.desktop");
   if (existsSync21(desktopPath))
     rmSync3(desktopPath, { force: true });
   render.ok("removed claudemesh:// handler on Linux");
@@ -13270,9 +13390,9 @@ var exports_status_line = {};
 __export(exports_status_line, {
   runStatusLine: () => runStatusLine
 });
-import { existsSync as existsSync22, readFileSync as readFileSync17 } from "node:fs";
-import { join as join14 } from "node:path";
-import { homedir as homedir11 } from "node:os";
+import { existsSync as existsSync22, readFileSync as readFileSync18 } from "node:fs";
+import { join as join13 } from "node:path";
+import { homedir as homedir10 } from "node:os";
 async function runStatusLine() {
   try {
     const config = readConfig();
@@ -13280,11 +13400,11 @@ async function runStatusLine() {
       process.stdout.write("◇ claudemesh (not joined)");
       return EXIT.SUCCESS;
     }
-    const cachePath = join14(homedir11(), ".claudemesh", "peer-cache.json");
+    const cachePath = join13(homedir10(), ".claudemesh", "peer-cache.json");
     let cache = {};
     if (existsSync22(cachePath)) {
       try {
-        cache = JSON.parse(readFileSync17(cachePath, "utf-8"));
+        cache = JSON.parse(readFileSync18(cachePath, "utf-8"));
       } catch {}
     }
     const pick = config.meshes[0];
@@ -13315,7 +13435,7 @@ __export(exports_backup, {
   runRestore: () => runRestore,
   runBackup: () => runBackup
 });
-import { readFileSync as readFileSync18, writeFileSync as writeFileSync14, existsSync as existsSync23 } from "node:fs";
+import { readFileSync as readFileSync19, writeFileSync as writeFileSync15, existsSync as existsSync23 } from "node:fs";
 import { createInterface as createInterface11 } from "node:readline";
 function readHidden(prompt5) {
   return new Promise((resolve2) => {
@@ -13361,7 +13481,7 @@ async function runBackup(outPath) {
     console.error("  No config found — nothing to back up. Join a mesh first.");
     return EXIT.NOT_FOUND;
   }
-  const plaintext = readFileSync18(configPath);
+  const plaintext = readFileSync19(configPath);
   const pass = await readHidden("  Passphrase (min 12 chars): ");
   if (pass.length < 12) {
     console.error("  ✗ Passphrase too short.");
@@ -13379,7 +13499,7 @@ async function runBackup(outPath) {
   const ciphertext = Buffer.from(s.crypto_aead_xchacha20poly1305_ietf_encrypt(plaintext, null, null, nonce, key));
   const blob = Buffer.concat([MAGIC, salt, nonce, ciphertext]);
   const file = outPath ?? `claudemesh-backup-${new Date().toISOString().replace(/[:.]/g, "-")}.cmb`;
-  writeFileSync14(file, blob, { mode: 384 });
+  writeFileSync15(file, blob, { mode: 384 });
   console.log(`
   ✓ Backup saved: ${file}`);
   console.log(`  Size: ${blob.length} bytes. Guard the passphrase — there is no recovery.
@@ -13395,7 +13515,7 @@ async function runRestore(inPath) {
     console.error(`  ✗ File not found: ${inPath}`);
     return EXIT.NOT_FOUND;
   }
-  const blob = readFileSync18(inPath);
+  const blob = readFileSync19(inPath);
   if (blob.length < 4 + 16 + 24 + 17 || !blob.subarray(0, 4).equals(MAGIC)) {
     console.error("  ✗ Not a claudemesh backup file (bad magic).");
     return EXIT.INVALID_ARGS;
@@ -13416,10 +13536,10 @@ async function runRestore(inPath) {
   const configPath = getConfigPath();
   if (existsSync23(configPath)) {
     const backupOld = `${configPath}.before-restore.${Date.now()}`;
-    writeFileSync14(backupOld, readFileSync18(configPath), { mode: 384 });
+    writeFileSync15(backupOld, readFileSync19(configPath), { mode: 384 });
     console.log(`  ↻ Existing config saved to ${backupOld}`);
   }
-  writeFileSync14(configPath, Buffer.from(plaintext), { mode: 384 });
+  writeFileSync15(configPath, Buffer.from(plaintext), { mode: 384 });
   console.log(`
   ✓ Config restored to ${configPath}`);
   console.log("  Run `claudemesh list` to verify your meshes.\n");
@@ -13440,7 +13560,7 @@ __export(exports_upgrade, {
 });
 import { spawnSync as spawnSync6 } from "node:child_process";
 import { existsSync as existsSync24 } from "node:fs";
-import { dirname as dirname8, join as join15, resolve as resolve2 } from "node:path";
+import { dirname as dirname8, join as join14, resolve as resolve2 } from "node:path";
 async function latestVersion() {
   try {
     const res = await fetch(URLS.NPM_REGISTRY, { signal: AbortSignal.timeout(8000) });
@@ -13453,14 +13573,14 @@ async function latestVersion() {
   }
 }
 function findNpm() {
-  const portable = join15(process.env.HOME ?? "", ".claudemesh", "node", "bin", "npm");
+  const portable = join14(process.env.HOME ?? "", ".claudemesh", "node", "bin", "npm");
   if (existsSync24(portable)) {
-    return { npm: portable, prefix: join15(process.env.HOME ?? "", ".claudemesh") };
+    return { npm: portable, prefix: join14(process.env.HOME ?? "", ".claudemesh") };
   }
   let cur = resolve2(process.argv[1] ?? ".");
   for (let i = 0;i < 6; i++) {
     cur = dirname8(cur);
-    const candidate = join15(cur, "bin", "npm");
+    const candidate = join14(cur, "bin", "npm");
     if (existsSync24(candidate))
       return { npm: candidate };
   }
@@ -13523,9 +13643,9 @@ __export(exports_grants, {
   runBlock: () => runBlock,
   isAllowed: () => isAllowed
 });
-import { existsSync as existsSync25, mkdirSync as mkdirSync10, readFileSync as readFileSync19, writeFileSync as writeFileSync15 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync25, mkdirSync as mkdirSync10, readFileSync as readFileSync20, writeFileSync as writeFileSync16 } from "node:fs";
+import { homedir as homedir11 } from "node:os";
+import { join as join15 } from "node:path";
 async function syncToBroker(meshSlug, grants) {
   const auth = getStoredToken();
   if (!auth)
@@ -13546,16 +13666,16 @@ function readGrants() {
   if (!existsSync25(GRANT_FILE))
     return {};
   try {
-    return JSON.parse(readFileSync19(GRANT_FILE, "utf-8"));
+    return JSON.parse(readFileSync20(GRANT_FILE, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeGrants(g) {
-  const dir = join16(homedir12(), ".claudemesh");
+  const dir = join15(homedir11(), ".claudemesh");
   if (!existsSync25(dir))
     mkdirSync10(dir, { recursive: true });
-  writeFileSync15(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
+  writeFileSync16(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
 }
 function resolveCaps(input) {
   if (input.includes("all"))
@@ -13711,7 +13831,7 @@ var init_grants = __esm(() => {
   BROKER_HTTP7 = URLS.BROKER.replace("wss://", "https://").replace("ws://", "http://").replace("/ws", "");
   ALL_CAPS = ["read", "dm", "broadcast", "state-read", "state-write", "file-read"];
   DEFAULT_CAPS = ["read", "dm", "broadcast", "state-read"];
-  GRANT_FILE = join16(homedir12(), ".claudemesh", "grants.json");
+  GRANT_FILE = join15(homedir11(), ".claudemesh", "grants.json");
 });
 
 // src/commands/profile.ts
@@ -15393,7 +15513,7 @@ __export(exports_file, {
 });
 import { hostname as osHostname } from "node:os";
 import { resolve as resolvePath, basename, dirname as dirname9 } from "node:path";
-import { statSync as statSync7, existsSync as existsSync26, writeFileSync as writeFileSync16, mkdirSync as mkdirSync11 } from "node:fs";
+import { statSync as statSync7, existsSync as existsSync26, writeFileSync as writeFileSync17, mkdirSync as mkdirSync11 } from "node:fs";
 function emitJson2(data) {
   console.log(JSON.stringify(data, null, 2));
 }
@@ -15490,7 +15610,7 @@ async function runFileGet(fileId, opts) {
     const buf = Buffer.from(await res.arrayBuffer());
     const outPath = opts.out ? resolvePath(opts.out) : resolvePath(process.cwd(), meta.name);
     mkdirSync11(dirname9(outPath), { recursive: true });
-    writeFileSync16(outPath, buf);
+    writeFileSync17(outPath, buf);
     if (opts.json) {
       emitJson2({ fileId, name: meta.name, savedTo: outPath, sizeBytes: buf.length });
     } else {
@@ -16100,7 +16220,7 @@ __export(exports_bridge, {
   runBridge: () => runBridge,
   bridgeConfigTemplate: () => bridgeConfigTemplate
 });
-import { readFileSync as readFileSync20, existsSync as existsSync27 } from "node:fs";
+import { readFileSync as readFileSync21, existsSync as existsSync27 } from "node:fs";
 function parseConfig(text) {
   const trimmed = text.trim();
   if (trimmed.startsWith("{"))
@@ -16150,7 +16270,7 @@ async function runBridge(configPath) {
   }
   let cfg;
   try {
-    cfg = parseConfig(readFileSync20(configPath, "utf-8"));
+    cfg = parseConfig(readFileSync21(configPath, "utf-8"));
   } catch (e) {
     render.err(`failed to parse ${configPath}: ${e instanceof Error ? e.message : String(e)}`);
     return EXIT.INVALID_ARGS;
@@ -16554,9 +16674,9 @@ function cacheKey(apiKeySecret, topicName) {
 async function getTopicKey(args) {
   const cacheId = cacheKey(args.apiKeySecret, args.topicName);
   if (!args.fresh) {
-    const cached2 = cache.get(cacheId);
-    if (cached2)
-      return { ok: true, topicKey: cached2.topicKey };
+    const cached3 = cache.get(cacheId);
+    if (cached3)
+      return { ok: true, topicKey: cached3.topicKey };
   }
   let sealed;
   try {
@@ -17458,9 +17578,9 @@ async function startServiceProxy(serviceName) {
     const fetched = await client.getServiceTools(serviceName);
     tools = fetched;
   } catch {
-    const cached2 = client.serviceCatalog.find((s) => s.name === serviceName);
-    if (cached2)
-      tools = cached2.tools;
+    const cached3 = client.serviceCatalog.find((s) => s.name === serviceName);
+    if (cached3)
+      tools = cached3.tools;
   }
   if (tools.length === 0) {
     process.stderr.write(`[mesh:${serviceName}] no tools found — service may not be running
@@ -18205,10 +18325,12 @@ async function gate(ctx, opts) {
 }
 
 // src/entrypoints/cli.ts
+init_policy();
 init_styles();
 installSignalHandlers();
 installErrorHandlers();
 var { command, positionals, flags } = parseArgv(process.argv);
+setDaemonPolicy(policyFromFlags(flags));
 function resolveApprovalMode() {
   const raw = flags["approval-mode"] ?? process.env.CLAUDEMESH_APPROVAL_MODE ?? null;
   if (raw === "plan" || raw === "read-only" || raw === "write" || raw === "yolo")
@@ -18385,6 +18507,8 @@ Flags
   --policy <path>                  override policy file
   -y, --yes                        skip confirmations (= --approval-mode yolo)
   -q, --quiet                      suppress non-essential output
+  --strict                         require daemon for broker-touching verbs (no cold-path fallback)
+  --no-daemon                      skip daemon entirely; open broker WS directly (CI / sandboxed scripts)
 `;
 function colorizeHelp(raw) {
   const lines = raw.split(`
@@ -19426,4 +19550,4 @@ main().catch((err) => {
   process.exit(EXIT.INTERNAL_ERROR);
 });
 
-//# debugId=1F2A51E3A3AE432A64756E2164756E21
+//# debugId=FBD494B01BF81C7164756E2164756E21