claudemesh-cli 1.28.0 → 1.29.0

package/dist/entrypoints/cli.js

@@ -103,7 +103,7 @@ __export(exports_urls, {
   VERSION: () => VERSION,
   URLS: () => URLS
 });
-var URLS, VERSION = "1.28.0", env;
+var URLS, VERSION = "1.29.0", env;
 var init_urls = __esm(() => {
   URLS = {
     BROKER: process.env.CLAUDEMESH_BROKER_URL ?? "wss://ic.claudemesh.com/ws",
@@ -3668,7 +3668,50 @@ var init_local_token = __esm(() => {
   init_paths2();
 });
 
+// src/services/session/token.ts
+var exports_token = {};
+__export(exports_token, {
+  readSessionTokenFromEnv: () => readSessionTokenFromEnv,
+  mintSessionToken: () => mintSessionToken,
+  TOKEN_FILE_ENV: () => TOKEN_FILE_ENV
+});
+import { randomBytes as randomBytes5 } from "node:crypto";
+import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
+function mintSessionToken(dir, fileName = "session-token") {
+  const token = randomBytes5(32).toString("hex");
+  const filePath = `${dir}/${fileName}`;
+  writeFileSync5(filePath, token, { mode: 384 });
+  return { token, filePath };
+}
+function readSessionTokenFromEnv(env2 = process.env) {
+  const direct = env2.CLAUDEMESH_IPC_TOKEN;
+  if (direct && /^[0-9a-f]{64}$/i.test(direct))
+    return direct.toLowerCase();
+  const path = env2[ENV_TOKEN_FILE];
+  if (!path)
+    return null;
+  try {
+    if (!existsSync5(path))
+      return null;
+    const raw = readFileSync5(path, "utf8").trim();
+    if (/^[0-9a-f]{64}$/i.test(raw))
+      return raw.toLowerCase();
+    return null;
+  } catch {
+    return null;
+  }
+}
+var ENV_TOKEN_FILE = "CLAUDEMESH_IPC_TOKEN_FILE", TOKEN_FILE_ENV;
+var init_token = __esm(() => {
+  TOKEN_FILE_ENV = ENV_TOKEN_FILE;
+});
+
 // src/daemon/ipc/client.ts
+var exports_client = {};
+__export(exports_client, {
+  ipc: () => ipc,
+  IpcError: () => IpcError
+});
 import { request as httpRequest } from "node:http";
 async function ipc(opts) {
   const useTcp = !!opts.preferTcp;
@@ -3688,6 +3731,11 @@ async function ipc(opts) {
       throw new IpcError(0, null, "daemon local token not found; is the daemon running?");
     headers.authorization = `Bearer ${tok}`;
   }
+  if (!useTcp) {
+    const sessionTok = readSessionTokenFromEnv();
+    if (sessionTok)
+      headers.authorization = `ClaudeMesh-Session ${sessionTok}`;
+  }
   return new Promise((resolve, reject) => {
     const req = httpRequest(useTcp ? { host: DAEMON_TCP_HOST, port: DAEMON_TCP_DEFAULT_PORT, path: opts.path, method: opts.method ?? "GET", headers } : { socketPath: DAEMON_PATHS.SOCK_FILE, path: opts.path, method: opts.method ?? "GET", headers }, (res) => {
       const chunks = [];
@@ -3712,6 +3760,7 @@ var IpcError;
 var init_client3 = __esm(() => {
   init_paths2();
   init_local_token();
+  init_token();
   IpcError = class IpcError extends Error {
     status;
     payload;
@@ -3729,7 +3778,7 @@ __export(exports_lifecycle, {
   ensureDaemonReady: () => ensureDaemonReady,
   _resetDaemonReadyCache: () => _resetDaemonReadyCache
 });
-import { existsSync as existsSync5, readFileSync as readFileSync5, statSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync6, statSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join4 } from "node:path";
 async function ensureDaemonReady(opts = {}) {
   if (lastResultThisProcess && (lastResultThisProcess.state === "up" || lastResultThisProcess.state === "started")) {
@@ -3770,7 +3819,7 @@ async function runEnsureDaemon(opts) {
   return { state: "spawn-failed", durationMs: Date.now() - t0, reason: spawnRes.reason };
 }
 async function probeDaemon() {
-  if (!existsSync5(DAEMON_PATHS.SOCK_FILE))
+  if (!existsSync6(DAEMON_PATHS.SOCK_FILE))
     return "absent";
   try {
     const res = await ipc({ path: "/v1/version", timeoutMs: PROBE_TIMEOUT_MS });
@@ -3803,7 +3852,7 @@ function recentSpawnFailureFresh() {
 }
 function markSpawnFailure() {
   try {
-    writeFileSync5(SPAWN_FAIL_FILE(), String(Date.now()), { mode: 384 });
+    writeFileSync6(SPAWN_FAIL_FILE(), String(Date.now()), { mode: 384 });
   } catch {}
 }
 function clearSpawnFailure() {
@@ -3840,9 +3889,9 @@ async function spawnDaemon(opts) {
 }
 async function acquireOrShareLock(_opts) {
   const lockPath = SPAWN_LOCK_FILE();
-  if (existsSync5(lockPath)) {
+  if (existsSync6(lockPath)) {
     try {
-      const pidStr = readFileSync5(lockPath, "utf8").trim();
+      const pidStr = readFileSync6(lockPath, "utf8").trim();
       const pid = Number.parseInt(pidStr, 10);
       if (Number.isFinite(pid) && pid > 0) {
         try {
@@ -3853,7 +3902,7 @@ async function acquireOrShareLock(_opts) {
     } catch {}
   }
   try {
-    writeFileSync5(lockPath, String(process.pid), { mode: 384 });
+    writeFileSync6(lockPath, String(process.pid), { mode: 384 });
   } catch {}
   return "acquired";
 }
@@ -3865,7 +3914,7 @@ function releaseLock() {
 async function pollForSocket(budgetMs) {
   const start = Date.now();
   while (Date.now() - start < budgetMs) {
-    if (existsSync5(DAEMON_PATHS.SOCK_FILE)) {
+    if (existsSync6(DAEMON_PATHS.SOCK_FILE)) {
       const probe = await probeDaemon();
       if (probe === "up")
         return { ok: true };
@@ -3899,7 +3948,7 @@ __export(exports_launch, {
 });
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { mkdtempSync, writeFileSync as writeFileSync6, rmSync, readdirSync, statSync as statSync2, existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
+import { mkdtempSync, writeFileSync as writeFileSync7, rmSync, readdirSync, statSync as statSync2, existsSync as existsSync7, readFileSync as readFileSync7 } from "node:fs";
 import { tmpdir, hostname as hostname2, homedir as homedir3 } from "node:os";
 import { join as join5 } from "node:path";
 import { createInterface as createInterface4 } from "node:readline";
@@ -4248,8 +4297,8 @@ async function runLaunch(flags, rawArgs) {
   await ensureDaemonRunning(mesh.slug, args.quiet);
   try {
     const claudeConfigPath = join5(homedir3(), ".claude.json");
-    if (existsSync6(claudeConfigPath)) {
-      const claudeConfig = JSON.parse(readFileSync6(claudeConfigPath, "utf-8"));
+    if (existsSync7(claudeConfigPath)) {
+      const claudeConfig = JSON.parse(readFileSync7(claudeConfigPath, "utf-8"));
       const mcpServers = claudeConfig.mcpServers ?? {};
       let cleaned = 0;
       for (const key of Object.keys(mcpServers)) {
@@ -4267,7 +4316,7 @@ async function runLaunch(flags, rawArgs) {
       }
       if (cleaned > 0) {
         claudeConfig.mcpServers = mcpServers;
-        writeFileSync6(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
+        writeFileSync7(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
 `, "utf-8");
       }
     }
@@ -4293,8 +4342,37 @@ async function runLaunch(flags, rawArgs) {
     ...parsedGroups.length > 0 ? { groups: parsedGroups } : {},
     messageMode
   };
-  writeFileSync6(join5(tmpDir, "config.json"), JSON.stringify(sessionConfig, null, 2) + `
+  writeFileSync7(join5(tmpDir, "config.json"), JSON.stringify(sessionConfig, null, 2) + `
 `, "utf-8");
+  let sessionTokenFilePath = null;
+  let sessionTokenForCleanup = null;
+  try {
+    const { mintSessionToken: mintSessionToken2, TOKEN_FILE_ENV: TOKEN_FILE_ENV2 } = await Promise.resolve().then(() => (init_token(), exports_token));
+    const minted = mintSessionToken2(tmpDir);
+    sessionTokenFilePath = minted.filePath;
+    sessionTokenForCleanup = minted.token;
+    const { ipc: ipc2 } = await Promise.resolve().then(() => (init_client3(), exports_client));
+    const sessionIdForRegister = claudeSessionId ?? randomUUID();
+    await ipc2({
+      method: "POST",
+      path: "/v1/sessions/register",
+      timeoutMs: 3000,
+      body: {
+        token: minted.token,
+        session_id: sessionIdForRegister,
+        mesh: mesh.slug,
+        display_name: displayName,
+        pid: process.pid,
+        cwd: process.cwd(),
+        ...role ? { role } : {},
+        ...parsedGroups.length > 0 ? { groups: parsedGroups.map((g) => `@${g.name}${g.role ? `:${g.role}` : ""}`) } : {}
+      }
+    }).catch(() => null);
+    process._claudemeshTokenEnv = {
+      name: TOKEN_FILE_ENV2,
+      value: minted.filePath
+    };
+  } catch {}
   if (!args.quiet) {
     printBanner(displayName, mesh.slug, role, parsedGroups, messageMode);
   }
@@ -4303,7 +4381,7 @@ async function runLaunch(flags, rawArgs) {
     const claudeConfigPath = join5(homedir3(), ".claude.json");
     let claudeConfig = {};
     try {
-      claudeConfig = JSON.parse(readFileSync6(claudeConfigPath, "utf-8"));
+      claudeConfig = JSON.parse(readFileSync7(claudeConfigPath, "utf-8"));
     } catch {
       claudeConfig = {};
     }
@@ -4330,7 +4408,7 @@ async function runLaunch(flags, rawArgs) {
       meshMcpEntries.push({ key: entryKey, entry });
     }
     claudeConfig.mcpServers = mcpServers;
-    writeFileSync6(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
+    writeFileSync7(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
 `, "utf-8");
     if (!args.quiet && meshMcpEntries.length > 0) {
       console.log(`  ${meshMcpEntries.length} mesh service(s) registered as native MCPs:`);
@@ -4372,7 +4450,7 @@ async function runLaunch(flags, rawArgs) {
       join5(homedir3(), ".claude", "bin", "claude")
     ];
     for (const c of candidates) {
-      if (existsSync6(c)) {
+      if (existsSync7(c)) {
         claudeBin = c;
         break;
       }
@@ -4382,13 +4460,13 @@ async function runLaunch(flags, rawArgs) {
     if (meshMcpEntries.length > 0) {
       try {
         const claudeConfigPath = join5(homedir3(), ".claude.json");
-        const claudeConfig = JSON.parse(readFileSync6(claudeConfigPath, "utf-8"));
+        const claudeConfig = JSON.parse(readFileSync7(claudeConfigPath, "utf-8"));
         const mcpServers = claudeConfig.mcpServers ?? {};
         for (const { key } of meshMcpEntries) {
           delete mcpServers[key];
         }
         claudeConfig.mcpServers = mcpServers;
-        writeFileSync6(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
+        writeFileSync7(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
 `, "utf-8");
       } catch {}
     }
@@ -4418,6 +4496,7 @@ async function runLaunch(flags, rawArgs) {
       CLAUDEMESH_CONFIG_DIR: tmpDir,
       CLAUDEMESH_DISPLAY_NAME: displayName,
       ...claudeSessionId ? { CLAUDEMESH_SESSION_ID: claudeSessionId } : {},
+      ...sessionTokenFilePath ? { CLAUDEMESH_IPC_TOKEN_FILE: sessionTokenFilePath } : {},
       MCP_TIMEOUT: process.env.MCP_TIMEOUT ?? "30000",
       MAX_MCP_OUTPUT_TOKENS: process.env.MAX_MCP_OUTPUT_TOKENS ?? "50000",
       ...role ? { CLAUDEMESH_ROLE: role } : {}
@@ -5085,7 +5164,7 @@ __export(exports_join, {
   runJoin: () => runJoin
 });
 import sodium3 from "libsodium-wrappers";
-import { writeFileSync as writeFileSync7, mkdirSync as mkdirSync4 } from "node:fs";
+import { writeFileSync as writeFileSync8, mkdirSync as mkdirSync4 } from "node:fs";
 import { join as join6, dirname as dirname3 } from "node:path";
 import { homedir as homedir4, hostname as hostname3 } from "node:os";
 function deriveAppBaseUrl() {
@@ -5210,7 +5289,7 @@ async function runJoin(args) {
   const inviteFile = join6(configDir, `invite-${payload.mesh_slug}.txt`);
   try {
     mkdirSync4(dirname3(inviteFile), { recursive: true });
-    writeFileSync7(inviteFile, link, "utf-8");
+    writeFileSync8(inviteFile, link, "utf-8");
   } catch {}
   console.log("");
   console.log(`✓ Joined "${payload.mesh_slug}" as ${displayName}${enroll.alreadyMember ? " (already a member — re-enrolled with same pubkey)" : ""}`);
@@ -7660,6 +7739,45 @@ var init_daemon_route = __esm(() => {
   init_warnings();
 });
 
+// src/services/session/resolve.ts
+var exports_resolve = {};
+__export(exports_resolve, {
+  getSessionInfo: () => getSessionInfo,
+  _resetSessionCache: () => _resetSessionCache
+});
+async function getSessionInfo() {
+  if (cached !== undefined)
+    return cached;
+  const tok = readSessionTokenFromEnv();
+  if (!tok) {
+    cached = null;
+    return null;
+  }
+  try {
+    const res = await ipc({
+      path: "/v1/sessions/me",
+      timeoutMs: 1500
+    });
+    if (res.status !== 200 || !res.body.session) {
+      cached = null;
+      return null;
+    }
+    cached = res.body.session;
+    return cached;
+  } catch {
+    cached = null;
+    return null;
+  }
+}
+function _resetSessionCache() {
+  cached = undefined;
+}
+var cached = undefined;
+var init_resolve = __esm(() => {
+  init_client3();
+  init_token();
+});
+
 // src/commands/peers.ts
 var exports_peers = {};
 __export(exports_peers, {
@@ -7699,7 +7817,14 @@ function annotateSelf(peer, selfMemberPubkey, selfSessionPubkey) {
 }
 async function runPeers(flags) {
   const config = readConfig();
-  const slugs = flags.mesh ? [flags.mesh] : config.meshes.map((m) => m.slug);
+  let slugs;
+  if (flags.mesh) {
+    slugs = [flags.mesh];
+  } else {
+    const { getSessionInfo: getSessionInfo2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
+    const sess = await getSessionInfo2();
+    slugs = sess ? [sess.mesh] : config.meshes.map((m) => m.slug);
+  }
   if (slugs.length === 0) {
     render.err("No meshes joined.");
     render.hint("claudemesh <invite-url>    # join + launch");
@@ -8669,12 +8794,12 @@ var init_whoami = __esm(() => {
 });
 
 // src/daemon/lock.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync7, unlinkSync as unlinkSync3, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync8, unlinkSync as unlinkSync3, writeFileSync as writeFileSync9 } from "node:fs";
 import { dirname as dirname4 } from "node:path";
 function acquireSingletonLock() {
   mkdirSync5(dirname4(DAEMON_PATHS.PID_FILE), { recursive: true, mode: 448 });
-  if (existsSync7(DAEMON_PATHS.PID_FILE)) {
-    const raw = readFileSync7(DAEMON_PATHS.PID_FILE, "utf8").trim();
+  if (existsSync8(DAEMON_PATHS.PID_FILE)) {
+    const raw = readFileSync8(DAEMON_PATHS.PID_FILE, "utf8").trim();
     const oldPid = Number.parseInt(raw, 10);
     if (Number.isFinite(oldPid) && oldPid > 0 && isProcessAlive(oldPid)) {
       return { result: "already-running", pid: oldPid };
@@ -8682,22 +8807,22 @@ function acquireSingletonLock() {
     try {
       unlinkSync3(DAEMON_PATHS.PID_FILE);
     } catch {}
-    writeFileSync8(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
+    writeFileSync9(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
     return { result: "stale", pid: process.pid };
   }
-  writeFileSync8(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
+  writeFileSync9(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
   return { result: "acquired", pid: process.pid };
 }
 function releaseSingletonLock() {
   try {
-    const raw = readFileSync7(DAEMON_PATHS.PID_FILE, "utf8").trim();
+    const raw = readFileSync8(DAEMON_PATHS.PID_FILE, "utf8").trim();
     if (Number.parseInt(raw, 10) === process.pid)
       unlinkSync3(DAEMON_PATHS.PID_FILE);
   } catch {}
 }
 function readRunningPid() {
   try {
-    const raw = readFileSync7(DAEMON_PATHS.PID_FILE, "utf8").trim();
+    const raw = readFileSync8(DAEMON_PATHS.PID_FILE, "utf8").trim();
     const pid = Number.parseInt(raw, 10);
     if (Number.isFinite(pid) && pid > 0 && isProcessAlive(pid))
       return pid;
@@ -8843,17 +8968,17 @@ function requeueDeadOrPending(db, args) {
 
 // src/daemon/db/sqlite.ts
 async function loadSqlite() {
-  if (cached)
-    return cached;
+  if (cached2)
+    return cached2;
   try {
     const mod = await import("node:sqlite");
-    cached = mod.DatabaseSync;
-    return cached;
+    cached2 = mod.DatabaseSync;
+    return cached2;
   } catch (nodeErr) {
     try {
       const bunMod = await import("bun:sqlite");
-      cached = bunMod.Database;
-      return cached;
+      cached2 = bunMod.Database;
+      return cached2;
     } catch {
       const msg = `claudemesh daemon requires Node.js 22.5+ for the embedded SQLite store (node:sqlite), or Bun (bun:sqlite) for dev. Current: ${process.version}. Original error: ${String(nodeErr)}`;
       throw new Error(msg);
@@ -8884,7 +9009,7 @@ function inImmediateTx(db, fn) {
     throw err;
   }
 }
-var cached = null;
+var cached2 = null;
 
 // src/daemon/fingerprint.ts
 import { createHash } from "node:crypto";
@@ -9127,9 +9252,70 @@ function bindSseStream(res, bus) {
   return cleanup;
 }
 
+// src/daemon/session-registry.ts
+function startReaper() {
+  if (reaperHandle)
+    return;
+  reaperHandle = setInterval(reapDead, REAPER_INTERVAL_MS).unref?.() ?? reaperHandle;
+}
+function registerSession(info) {
+  const priorToken = bySessionId.get(info.sessionId);
+  if (priorToken && priorToken !== info.token)
+    byToken.delete(priorToken);
+  const stored = { ...info, registeredAt: Date.now() };
+  byToken.set(info.token, stored);
+  bySessionId.set(info.sessionId, info.token);
+  return stored;
+}
+function deregisterByToken(token) {
+  const entry = byToken.get(token);
+  if (!entry)
+    return false;
+  byToken.delete(token);
+  if (bySessionId.get(entry.sessionId) === token)
+    bySessionId.delete(entry.sessionId);
+  return true;
+}
+function resolveToken(token) {
+  const entry = byToken.get(token);
+  if (!entry)
+    return null;
+  if (Date.now() - entry.registeredAt > TTL_MS) {
+    deregisterByToken(token);
+    return null;
+  }
+  return entry;
+}
+function listSessions() {
+  return [...byToken.values()];
+}
+function reapDead() {
+  const dead = [];
+  for (const [token, info] of byToken.entries()) {
+    if (Date.now() - info.registeredAt > TTL_MS) {
+      dead.push(token);
+      continue;
+    }
+    try {
+      process.kill(info.pid, 0);
+    } catch {
+      dead.push(token);
+    }
+  }
+  for (const t of dead)
+    deregisterByToken(t);
+}
+var TTL_MS, REAPER_INTERVAL_MS, byToken, bySessionId, reaperHandle = null;
+var init_session_registry = __esm(() => {
+  TTL_MS = 24 * 60 * 60 * 1000;
+  REAPER_INTERVAL_MS = 30 * 1000;
+  byToken = new Map;
+  bySessionId = new Map;
+});
+
 // src/daemon/ipc/server.ts
 import { createServer as createServer2 } from "node:http";
-import { chmodSync as chmodSync3, existsSync as existsSync8, unlinkSync as unlinkSync4 } from "node:fs";
+import { chmodSync as chmodSync3, existsSync as existsSync9, unlinkSync as unlinkSync4 } from "node:fs";
 import { timingSafeEqual } from "node:crypto";
 import { randomUUID as randomUUID3 } from "node:crypto";
 function startIpcServer(opts) {
@@ -9145,7 +9331,7 @@ function startIpcServer(opts) {
     meshConfigs: opts.meshConfigs,
     onPendingInserted: opts.onPendingInserted
   });
-  if (existsSync8(DAEMON_PATHS.SOCK_FILE)) {
+  if (existsSync9(DAEMON_PATHS.SOCK_FILE)) {
     try {
       unlinkSync4(DAEMON_PATHS.SOCK_FILE);
     } catch {}
@@ -9231,11 +9417,19 @@ function makeHandler(opts) {
         return;
       }
     }
+    let session = null;
+    {
+      const authz = req.headers.authorization ?? "";
+      const sm = /^ClaudeMesh-Session\s+([0-9a-f]{64})$/i.exec(authz.trim());
+      if (sm && sm[1])
+        session = resolveToken(sm[1].toLowerCase());
+    }
+    const meshFromCtx = (explicit) => explicit && explicit.trim() ? explicit : session?.mesh ?? null;
     if (req.method === "GET" && url.pathname === "/v1/version") {
       respond(res, 200, {
         daemon_version: VERSION,
         ipc_api: "v1",
-        ipc_features: ["version", "health", "send", "inbox", "events", "peers", "profile", "skills", "state", "memory"],
+        ipc_features: ["version", "health", "send", "inbox", "events", "peers", "profile", "skills", "state", "memory", "sessions"],
         schema_version: 1
       });
       return;
@@ -9244,6 +9438,70 @@ function makeHandler(opts) {
       respond(res, 200, { ok: true, pid: process.pid });
       return;
     }
+    if (req.method === "POST" && url.pathname === "/v1/sessions/register") {
+      try {
+        const body = await readJsonBody(req, 64 * 1024);
+        if (!body) {
+          respond(res, 400, { error: "missing body" });
+          return;
+        }
+        const token = typeof body.token === "string" ? body.token : "";
+        if (!/^[0-9a-f]{64}$/i.test(token)) {
+          respond(res, 400, { error: "token must be 64 hex chars" });
+          return;
+        }
+        const sessionId = typeof body.session_id === "string" ? body.session_id : "";
+        const mesh = typeof body.mesh === "string" ? body.mesh : "";
+        const displayName = typeof body.display_name === "string" ? body.display_name : "";
+        const pid = typeof body.pid === "number" ? body.pid : 0;
+        if (!sessionId || !mesh || !displayName || !pid) {
+          respond(res, 400, { error: "session_id, mesh, display_name, pid all required" });
+          return;
+        }
+        const cwd = typeof body.cwd === "string" ? body.cwd : undefined;
+        const role = typeof body.role === "string" ? body.role : undefined;
+        const groups = Array.isArray(body.groups) ? body.groups.filter((g) => typeof g === "string") : undefined;
+        const stored = registerSession({
+          token: token.toLowerCase(),
+          sessionId,
+          mesh,
+          displayName,
+          pid,
+          cwd,
+          role,
+          groups
+        });
+        opts.log("info", "session_registered", { sessionId, mesh, pid });
+        respond(res, 200, { ok: true, registered_at: stored.registeredAt });
+      } catch (e) {
+        respond(res, 400, { error: String(e) });
+      }
+      return;
+    }
+    if (req.method === "DELETE" && url.pathname.startsWith("/v1/sessions/")) {
+      const tail = url.pathname.slice("/v1/sessions/".length);
+      if (!/^[0-9a-f]{64}$/i.test(tail)) {
+        respond(res, 400, { error: "invalid token" });
+        return;
+      }
+      const ok = deregisterByToken(tail.toLowerCase());
+      respond(res, ok ? 200 : 404, { ok, token_prefix: tail.slice(0, 8) });
+      return;
+    }
+    if (req.method === "GET" && url.pathname === "/v1/sessions/me") {
+      if (!session) {
+        respond(res, 401, { error: "no session token" });
+        return;
+      }
+      const { token, ...redacted } = session;
+      respond(res, 200, { session: { ...redacted, token_prefix: token.slice(0, 8) } });
+      return;
+    }
+    if (req.method === "GET" && url.pathname === "/v1/sessions") {
+      const all = listSessions().map(({ token, ...rest }) => ({ ...rest, token_prefix: token.slice(0, 8) }));
+      respond(res, 200, { sessions: all });
+      return;
+    }
     if (req.method === "GET" && url.pathname === "/v1/events") {
       if (!opts.bus) {
         respond(res, 503, { error: "event bus not initialised" });
@@ -9257,7 +9515,7 @@ function makeHandler(opts) {
         respond(res, 503, { error: "broker not initialised" });
         return;
       }
-      const filterMesh = url.searchParams.get("mesh") ?? undefined;
+      const filterMesh = meshFromCtx(url.searchParams.get("mesh")) ?? undefined;
       try {
         const all = [];
         for (const [slug, b] of opts.brokers.entries()) {
@@ -9282,7 +9540,7 @@ function makeHandler(opts) {
         respond(res, 503, { error: "broker not initialised" });
         return;
       }
-      const filterMesh = url.searchParams.get("mesh") ?? undefined;
+      const filterMesh = meshFromCtx(url.searchParams.get("mesh")) ?? undefined;
       const key = url.searchParams.get("key");
       try {
         if (key) {
@@ -9323,7 +9581,7 @@ function makeHandler(opts) {
           respond(res, 400, { error: "missing 'key' (string)" });
           return;
         }
-        const requested = (typeof body.mesh === "string" ? body.mesh : null) || null;
+        const requested = meshFromCtx(typeof body.mesh === "string" ? body.mesh : null);
         let chosen = requested;
         if (!chosen && opts.brokers.size === 1)
           chosen = opts.brokers.keys().next().value;
@@ -9349,7 +9607,7 @@ function makeHandler(opts) {
         return;
       }
       const query = url.searchParams.get("q") ?? "";
-      const filterMesh = url.searchParams.get("mesh") ?? undefined;
+      const filterMesh = meshFromCtx(url.searchParams.get("mesh")) ?? undefined;
       try {
         const all = [];
         for (const [slug, b] of opts.brokers.entries()) {
@@ -9376,7 +9634,7 @@ function makeHandler(opts) {
           respond(res, 400, { error: "missing 'content' (string)" });
           return;
         }
-        const requested = (typeof body.mesh === "string" ? body.mesh : null) || null;
+        const requested = meshFromCtx(typeof body.mesh === "string" ? body.mesh : null);
         let chosen = requested;
         if (!chosen && opts.brokers.size === 1)
           chosen = opts.brokers.keys().next().value;
@@ -9434,7 +9692,7 @@ function makeHandler(opts) {
         return;
       }
       const query = url.searchParams.get("query") ?? undefined;
-      const filterMesh = url.searchParams.get("mesh") ?? undefined;
+      const filterMesh = meshFromCtx(url.searchParams.get("mesh")) ?? undefined;
       try {
         const all = [];
         for (const [slug, b] of opts.brokers.entries()) {
@@ -9464,7 +9722,7 @@ function makeHandler(opts) {
         respond(res, 400, { error: "missing skill name" });
         return;
       }
-      const filterMesh = url.searchParams.get("mesh") ?? undefined;
+      const filterMesh = meshFromCtx(url.searchParams.get("mesh")) ?? undefined;
       try {
         for (const [slug, b] of opts.brokers.entries()) {
           if (filterMesh && filterMesh !== slug)
@@ -9492,7 +9750,7 @@ function makeHandler(opts) {
           respond(res, 400, { error: "expected JSON object" });
           return;
         }
-        const requested = (typeof body.mesh === "string" ? body.mesh : url.searchParams.get("mesh")) || null;
+        const requested = meshFromCtx(typeof body.mesh === "string" ? body.mesh : url.searchParams.get("mesh"));
         const targets = requested ? [opts.brokers.get(requested)].filter(Boolean) : [...opts.brokers.values()];
         if (targets.length === 0) {
           respond(res, 404, { error: "mesh_not_attached", mesh: requested });
@@ -9776,16 +10034,16 @@ function parseSendRequest(body, idempotencyHeader) {
 }
 async function resolveAndEncrypt(req, broker, meshSecretKey, meshSlug) {
   const { encryptDirect: encryptDirect2 } = await Promise.resolve().then(() => (init_box(), exports_box));
-  const { randomBytes: randomBytes5 } = await import("node:crypto");
+  const { randomBytes: randomBytes6 } = await import("node:crypto");
   const to = req.to.trim();
   if (to.startsWith("#") && /^#[0-9a-z_-]{20,}$/i.test(to)) {
     const ciphertext = Buffer.from(req.message, "utf8").toString("base64");
-    const nonce = randomBytes5(24).toString("base64");
+    const nonce = randomBytes6(24).toString("base64");
     return { target_spec: to, ciphertext, nonce, mesh: meshSlug ?? "" };
   }
   if (to.startsWith("@") || to === "*") {
     const ciphertext = Buffer.from(req.message, "utf8").toString("base64");
-    const nonce = randomBytes5(24).toString("base64");
+    const nonce = randomBytes6(24).toString("base64");
     return { target_spec: to, ciphertext, nonce, mesh: meshSlug ?? "" };
   }
   if (/^[0-9a-f]{64}$/i.test(to)) {
@@ -9826,6 +10084,7 @@ function respond(res, status, body) {
 var init_server = __esm(() => {
   init_paths2();
   init_send2();
+  init_session_registry();
   init_urls();
 });
 
@@ -10457,8 +10716,8 @@ function bufferToHex(b) {
   return s;
 }
 async function randomNonce2() {
-  const { randomBytes: randomBytes5 } = await import("node:crypto");
-  return randomBytes5(24).toString("base64");
+  const { randomBytes: randomBytes6 } = await import("node:crypto");
+  return randomBytes6(24).toString("base64");
 }
 function defaultLog2(level, msg, meta) {
   const line = JSON.stringify({ level, msg, ...meta, ts: new Date().toISOString() });
@@ -10580,7 +10839,7 @@ __export(exports_identity, {
   checkFingerprint: () => checkFingerprint,
   acceptCurrentHost: () => acceptCurrentHost
 });
-import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync10 } from "node:fs";
 import { join as join7 } from "node:path";
 import { createHash as createHash2 } from "node:crypto";
 import { networkInterfaces } from "node:os";
@@ -10601,13 +10860,13 @@ function computeCurrentFingerprint() {
 }
 function checkFingerprint() {
   const current = computeCurrentFingerprint();
-  if (!existsSync9(path())) {
-    writeFileSync9(path(), JSON.stringify(current, null, 2), { mode: 384 });
+  if (!existsSync10(path())) {
+    writeFileSync10(path(), JSON.stringify(current, null, 2), { mode: 384 });
     return { result: "first_run", current };
   }
   let stored;
   try {
-    stored = JSON.parse(readFileSync8(path(), "utf8"));
+    stored = JSON.parse(readFileSync9(path(), "utf8"));
   } catch {
     return { result: "unavailable", current };
   }
@@ -10617,14 +10876,14 @@ function checkFingerprint() {
 }
 function acceptCurrentHost() {
   const current = computeCurrentFingerprint();
-  writeFileSync9(path(), JSON.stringify(current, null, 2), { mode: 384 });
+  writeFileSync10(path(), JSON.stringify(current, null, 2), { mode: 384 });
   return current;
 }
 function readHostId() {
   if (process.platform === "linux") {
     for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
       try {
-        const raw = readFileSync8(p, "utf8").trim();
+        const raw = readFileSync9(p, "utf8").trim();
         if (raw)
           return `linux:${raw}`;
       } catch {}
@@ -10669,16 +10928,16 @@ var init_identity = __esm(() => {
 });
 
 // src/daemon/run.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync10 } from "node:fs";
 function detectContainer() {
   if (process.env.KUBERNETES_SERVICE_HOST)
     return true;
   if (process.env.CONTAINER === "1")
     return true;
   try {
-    if (existsSync10("/.dockerenv"))
+    if (existsSync11("/.dockerenv"))
       return true;
-    const cg = readFileSync9("/proc/1/cgroup", "utf8");
+    const cg = readFileSync10("/proc/1/cgroup", "utf8");
     if (/(docker|kubepods|containerd)/.test(cg))
       return true;
   } catch {}
@@ -10803,6 +11062,7 @@ async function runDaemon(opts = {}) {
   }
   let drain = null;
   drain = startDrainWorker({ db: outboxDb, brokers });
+  startReaper();
   const ipc2 = startIpcServer({
     localToken,
     tcpEnabled,
@@ -10864,6 +11124,7 @@ var init_run = __esm(() => {
   init_lock();
   init_local_token();
   init_server();
+  init_session_registry();
   init_broker();
   init_drain();
   init_inbound();
@@ -10879,7 +11140,7 @@ __export(exports_service_install, {
   installService: () => installService,
   detectPlatform: () => detectPlatform
 });
-import { existsSync as existsSync11, mkdirSync as mkdirSync7, writeFileSync as writeFileSync10, unlinkSync as unlinkSync5, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync7, writeFileSync as writeFileSync11, unlinkSync as unlinkSync5, readFileSync as readFileSync11 } from "node:fs";
 import { execSync as execSync2 } from "node:child_process";
 import { homedir as homedir5 } from "node:os";
 import { join as join8, dirname as dirname5 } from "node:path";
@@ -10900,7 +11161,7 @@ function installService(args) {
   if (isCi() && !args.allowCi) {
     throw new Error("Refusing to install persistent service in CI; pass --allow-ci-persistent to override.");
   }
-  if (!existsSync11(args.binaryPath)) {
+  if (!existsSync12(args.binaryPath)) {
     throw new Error(`binary not found at ${args.binaryPath}`);
   }
   mkdirSync7(DAEMON_PATHS.DAEMON_DIR, { recursive: true, mode: 448 });
@@ -10916,7 +11177,7 @@ function uninstallService() {
     try {
       execSync2(`launchctl bootout gui/$(id -u)/${SERVICE_LABEL}`, { stdio: "ignore" });
     } catch {}
-    if (existsSync11(p)) {
+    if (existsSync12(p)) {
       unlinkSync5(p);
       removed.push(p);
     }
@@ -10925,7 +11186,7 @@ function uninstallService() {
     try {
       execSync2(`systemctl --user disable --now ${SYSTEMD_UNIT}`, { stdio: "ignore" });
     } catch {}
-    if (existsSync11(p)) {
+    if (existsSync12(p)) {
       unlinkSync5(p);
       removed.push(p);
     }
@@ -10978,7 +11239,7 @@ function installDarwin(args) {
 </dict>
 </plist>
 `;
-  writeFileSync10(plist, xml, { mode: 420 });
+  writeFileSync11(plist, xml, { mode: 420 });
   return {
     platform: "darwin",
     unitPath: plist,
@@ -11015,7 +11276,7 @@ Environment=PATH=/usr/local/bin:/usr/bin:/bin
 [Install]
 WantedBy=default.target
 `;
-  writeFileSync10(unit, content, { mode: 420 });
+  writeFileSync11(unit, content, { mode: 420 });
   return {
     platform: "linux",
     unitPath: unit,
@@ -11035,10 +11296,10 @@ function readInstalledUnit() {
   if (!platform5)
     return { platform: null, path: null, content: null };
   const path2 = platform5 === "darwin" ? darwinPlistPath() : linuxUnitPath();
-  if (!existsSync11(path2))
+  if (!existsSync12(path2))
     return { platform: platform5, path: null, content: null };
   try {
-    return { platform: platform5, path: path2, content: readFileSync10(path2, "utf8") };
+    return { platform: platform5, path: path2, content: readFileSync11(path2, "utf8") };
   } catch {
     return { platform: platform5, path: path2, content: null };
   }
@@ -11380,19 +11641,19 @@ __export(exports_install, {
 import {
   chmodSync as chmodSync4,
   copyFileSync,
-  existsSync as existsSync12,
+  existsSync as existsSync13,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync11,
-  writeFileSync as writeFileSync11
+  readFileSync as readFileSync12,
+  writeFileSync as writeFileSync12
 } from "node:fs";
 import { homedir as homedir6, platform as platform5 } from "node:os";
 import { dirname as dirname6, join as join9, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync as spawnSync3 } from "node:child_process";
 function readClaudeConfig() {
-  if (!existsSync12(CLAUDE_CONFIG))
+  if (!existsSync13(CLAUDE_CONFIG))
     return {};
-  const text = readFileSync11(CLAUDE_CONFIG, "utf-8").trim();
+  const text = readFileSync12(CLAUDE_CONFIG, "utf-8").trim();
   if (!text)
     return {};
   try {
@@ -11402,7 +11663,7 @@ function readClaudeConfig() {
   }
 }
 function backupClaudeConfig() {
-  if (!existsSync12(CLAUDE_CONFIG))
+  if (!existsSync13(CLAUDE_CONFIG))
     return;
   const backupDir = join9(dirname6(CLAUDE_CONFIG), ".claude", "backups");
   mkdirSync8(backupDir, { recursive: true });
@@ -11431,7 +11692,7 @@ function patchMcpServer(entry) {
   return action;
 }
 function removeMcpServer() {
-  if (!existsSync12(CLAUDE_CONFIG))
+  if (!existsSync13(CLAUDE_CONFIG))
     return false;
   backupClaudeConfig();
   const cfg = readClaudeConfig();
@@ -11445,7 +11706,7 @@ function removeMcpServer() {
 }
 function flushClaudeConfig(obj) {
   mkdirSync8(dirname6(CLAUDE_CONFIG), { recursive: true });
-  writeFileSync11(CLAUDE_CONFIG, JSON.stringify(obj, null, 2) + `
+  writeFileSync12(CLAUDE_CONFIG, JSON.stringify(obj, null, 2) + `
 `, "utf-8");
   try {
     chmodSync4(CLAUDE_CONFIG, 384);
@@ -11468,7 +11729,7 @@ function resolveBundledSkillsDir() {
   const here = fileURLToPath(import.meta.url);
   const pkgRoot = resolve(dirname6(here), "..", "..");
   const skillsDir = join9(pkgRoot, "skills");
-  if (existsSync12(skillsDir))
+  if (existsSync13(skillsDir))
     return skillsDir;
   return null;
 }
@@ -11503,7 +11764,7 @@ function uninstallSkills() {
     if (!entry.isDirectory())
       continue;
     const dstDir = join9(CLAUDE_SKILLS_ROOT, entry.name);
-    if (existsSync12(dstDir)) {
+    if (existsSync13(dstDir)) {
       try {
         fs.rmSync(dstDir, { recursive: true, force: true });
         removed.push(entry.name);
@@ -11528,9 +11789,9 @@ function entriesEqual(a, b) {
   return a.command === b.command && JSON.stringify(a.args ?? []) === JSON.stringify(b.args ?? []);
 }
 function readClaudeSettings() {
-  if (!existsSync12(CLAUDE_SETTINGS))
+  if (!existsSync13(CLAUDE_SETTINGS))
     return {};
-  const text = readFileSync11(CLAUDE_SETTINGS, "utf-8").trim();
+  const text = readFileSync12(CLAUDE_SETTINGS, "utf-8").trim();
   if (!text)
     return {};
   try {
@@ -11541,7 +11802,7 @@ function readClaudeSettings() {
 }
 function writeClaudeSettings(obj) {
   mkdirSync8(dirname6(CLAUDE_SETTINGS), { recursive: true });
-  writeFileSync11(CLAUDE_SETTINGS, JSON.stringify(obj, null, 2) + `
+  writeFileSync12(CLAUDE_SETTINGS, JSON.stringify(obj, null, 2) + `
 `, "utf-8");
 }
 function installAllowedTools() {
@@ -11555,7 +11816,7 @@ function installAllowedTools() {
   return { added: toAdd, unchanged: CLAUDEMESH_TOOLS.length - toAdd.length };
 }
 function uninstallAllowedTools() {
-  if (!existsSync12(CLAUDE_SETTINGS))
+  if (!existsSync13(CLAUDE_SETTINGS))
     return 0;
   const settings = readClaudeSettings();
   const existing = settings.allowedTools ?? [];
@@ -11590,7 +11851,7 @@ function installHooks() {
   return { added, unchanged };
 }
 function uninstallHooks() {
-  if (!existsSync12(CLAUDE_SETTINGS))
+  if (!existsSync13(CLAUDE_SETTINGS))
     return 0;
   const settings = readClaudeSettings();
   const hooks = settings.hooks;
@@ -11640,7 +11901,7 @@ function runInstall(args = []) {
     render.err("`bun` is not on PATH.", "Install Bun first: https://bun.com");
     process.exit(1);
   }
-  if (!existsSync12(entry)) {
+  if (!existsSync13(entry)) {
     render.err(`MCP entry not found at ${entry}`);
     process.exit(1);
   }
@@ -11885,7 +12146,7 @@ var exports_uninstall = {};
 __export(exports_uninstall, {
   uninstall: () => uninstall
 });
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync12, existsSync as existsSync13, rmSync as rmSync2, readdirSync as readdirSync2 } from "node:fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync13, existsSync as existsSync14, rmSync as rmSync2, readdirSync as readdirSync2 } from "node:fs";
 import { join as join10, dirname as dirname7 } from "node:path";
 import { homedir as homedir7 } from "node:os";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
@@ -11893,27 +12154,27 @@ function bundledSkillsDir() {
   const here = fileURLToPath2(import.meta.url);
   const pkgRoot = join10(dirname7(here), "..", "..");
   const skillsDir = join10(pkgRoot, "skills");
-  return existsSync13(skillsDir) ? skillsDir : null;
+  return existsSync14(skillsDir) ? skillsDir : null;
 }
 async function uninstall() {
   let removed = 0;
-  if (existsSync13(PATHS.CLAUDE_JSON)) {
+  if (existsSync14(PATHS.CLAUDE_JSON)) {
     try {
-      const raw = readFileSync12(PATHS.CLAUDE_JSON, "utf-8");
+      const raw = readFileSync13(PATHS.CLAUDE_JSON, "utf-8");
       const config = JSON.parse(raw);
       const servers = config.mcpServers;
       if (servers && "claudemesh" in servers) {
         delete servers.claudemesh;
-        writeFileSync12(PATHS.CLAUDE_JSON, JSON.stringify(config, null, 2) + `
+        writeFileSync13(PATHS.CLAUDE_JSON, JSON.stringify(config, null, 2) + `
 `, "utf-8");
         render.ok("removed MCP server", dim("~/.claude.json"));
         removed++;
       }
     } catch {}
   }
-  if (existsSync13(PATHS.CLAUDE_SETTINGS)) {
+  if (existsSync14(PATHS.CLAUDE_SETTINGS)) {
     try {
-      const raw = readFileSync12(PATHS.CLAUDE_SETTINGS, "utf-8");
+      const raw = readFileSync13(PATHS.CLAUDE_SETTINGS, "utf-8");
       const config = JSON.parse(raw);
       const hooks = config.hooks;
       if (hooks) {
@@ -11934,7 +12195,7 @@ async function uninstall() {
           }
         }
         if (removedHooks > 0) {
-          writeFileSync12(PATHS.CLAUDE_SETTINGS, JSON.stringify(config, null, 2) + `
+          writeFileSync13(PATHS.CLAUDE_SETTINGS, JSON.stringify(config, null, 2) + `
 `, "utf-8");
           render.ok(`removed ${removedHooks} claudemesh hook${removedHooks === 1 ? "" : "s"}`, dim("settings.json"));
           removed++;
@@ -11950,7 +12211,7 @@ async function uninstall() {
         if (!entry.isDirectory())
           continue;
         const dst = join10(CLAUDE_SKILLS_ROOT2, entry.name);
-        if (existsSync13(dst)) {
+        if (existsSync14(dst)) {
           try {
             rmSync2(dst, { recursive: true, force: true });
             removedSkills.push(entry.name);
@@ -11982,7 +12243,7 @@ var exports_doctor = {};
 __export(exports_doctor, {
   runDoctor: () => runDoctor
 });
-import { existsSync as existsSync14, readFileSync as readFileSync13, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync15, readFileSync as readFileSync14, statSync as statSync3 } from "node:fs";
 import { homedir as homedir8, platform as platform6 } from "node:os";
 import { join as join11 } from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
@@ -12009,7 +12270,7 @@ function checkClaudeOnPath() {
 }
 function checkMcpRegistered() {
   const claudeConfig = join11(homedir8(), ".claude.json");
-  if (!existsSync14(claudeConfig)) {
+  if (!existsSync15(claudeConfig)) {
     return {
       name: "claudemesh MCP registered in ~/.claude.json",
       pass: false,
@@ -12017,7 +12278,7 @@ function checkMcpRegistered() {
     };
   }
   try {
-    const cfg = JSON.parse(readFileSync13(claudeConfig, "utf-8"));
+    const cfg = JSON.parse(readFileSync14(claudeConfig, "utf-8"));
     const registered = Boolean(cfg.mcpServers?.["claudemesh"]);
     return {
       name: "claudemesh MCP registered in ~/.claude.json",
@@ -12035,7 +12296,7 @@ function checkMcpRegistered() {
 }
 function checkHooksRegistered() {
   const settings = join11(homedir8(), ".claude", "settings.json");
-  if (!existsSync14(settings)) {
+  if (!existsSync15(settings)) {
     return {
       name: "Status hooks registered in ~/.claude/settings.json",
       pass: false,
@@ -12043,7 +12304,7 @@ function checkHooksRegistered() {
     };
   }
   try {
-    const raw = readFileSync13(settings, "utf-8");
+    const raw = readFileSync14(settings, "utf-8");
     const has = raw.includes("claudemesh hook ");
     return {
       name: "Status hooks registered in ~/.claude/settings.json",
@@ -12060,7 +12321,7 @@ function checkHooksRegistered() {
 }
 function checkConfigFile() {
   const path2 = getConfigPath();
-  if (!existsSync14(path2)) {
+  if (!existsSync15(path2)) {
     return {
       name: "~/.claudemesh/config.json exists and parses",
       pass: true,
@@ -12243,7 +12504,7 @@ var exports_status = {};
 __export(exports_status, {
   runStatus: () => runStatus2
 });
-import { statSync as statSync4, existsSync as existsSync15 } from "node:fs";
+import { statSync as statSync4, existsSync as existsSync16 } from "node:fs";
 import WebSocket3 from "ws";
 async function probeBroker(url, timeoutMs = 4000) {
   return new Promise((resolve2) => {
@@ -12273,7 +12534,7 @@ async function runStatus2() {
   render.section(`status (v${VERSION})`);
   const configPath = getConfigPath();
   let configPermsNote = "missing";
-  if (existsSync15(configPath)) {
+  if (existsSync16(configPath)) {
     const mode = (statSync4(configPath).mode & 511).toString(8).padStart(4, "0");
     configPermsNote = mode === "0600" ? `${mode}` : `${mode} — expected 0600`;
   }
@@ -12419,13 +12680,13 @@ var init_check_claude_binary = __esm(() => {
 });
 
 // src/services/health/check-mcp-registered.ts
-import { existsSync as existsSync16, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync15 } from "node:fs";
 function checkMcpRegistered2() {
   try {
-    if (!existsSync16(PATHS.CLAUDE_JSON)) {
+    if (!existsSync17(PATHS.CLAUDE_JSON)) {
       return { name: "mcp-registered", ok: false, message: "~/.claude.json not found" };
     }
-    const raw = readFileSync14(PATHS.CLAUDE_JSON, "utf-8");
+    const raw = readFileSync15(PATHS.CLAUDE_JSON, "utf-8");
     const config = JSON.parse(raw);
     if (config.mcpServers && "claudemesh" in config.mcpServers) {
       return { name: "mcp-registered", ok: true, message: "MCP server registered" };
@@ -12440,13 +12701,13 @@ var init_check_mcp_registered = __esm(() => {
 });
 
 // src/services/health/check-hooks-registered.ts
-import { existsSync as existsSync17, readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync18, readFileSync as readFileSync16 } from "node:fs";
 function checkHooksRegistered2() {
   try {
-    if (!existsSync17(PATHS.CLAUDE_SETTINGS)) {
+    if (!existsSync18(PATHS.CLAUDE_SETTINGS)) {
       return { name: "hooks-registered", ok: false, message: "~/.claude/settings.json not found" };
     }
-    const raw = readFileSync15(PATHS.CLAUDE_SETTINGS, "utf-8");
+    const raw = readFileSync16(PATHS.CLAUDE_SETTINGS, "utf-8");
     const config = JSON.parse(raw);
     if (config.hooks) {
       return { name: "hooks-registered", ok: true, message: "Hooks configured" };
@@ -12461,10 +12722,10 @@ var init_check_hooks_registered = __esm(() => {
 });
 
 // src/services/health/check-config-perms.ts
-import { existsSync as existsSync18, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync19, statSync as statSync5 } from "node:fs";
 function checkConfigPerms() {
   const configFile = PATHS.CONFIG_FILE;
-  if (!existsSync18(configFile)) {
+  if (!existsSync19(configFile)) {
     return { name: "config-perms", ok: true, message: "No config file yet (first run)" };
   }
   try {
@@ -12482,13 +12743,13 @@ var init_check_config_perms = __esm(() => {
 });
 
 // src/services/health/check-keypairs-valid.ts
-import { existsSync as existsSync19, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync20, readFileSync as readFileSync17 } from "node:fs";
 function checkKeypairsValid() {
-  if (!existsSync19(PATHS.CONFIG_FILE)) {
+  if (!existsSync20(PATHS.CONFIG_FILE)) {
     return { name: "keypairs-valid", ok: true, message: "No config (first run)" };
   }
   try {
-    const raw = readFileSync16(PATHS.CONFIG_FILE, "utf-8");
+    const raw = readFileSync17(PATHS.CONFIG_FILE, "utf-8");
     const config = JSON.parse(raw);
     const meshes = config.meshes ?? [];
     if (meshes.length === 0) {
@@ -12969,7 +13230,7 @@ __export(exports_url_handler, {
   runUrlHandler: () => runUrlHandler
 });
 import { platform as platform7, homedir as homedir9 } from "node:os";
-import { existsSync as existsSync20, mkdirSync as mkdirSync9, writeFileSync as writeFileSync13, rmSync as rmSync3, chmodSync as chmodSync5 } from "node:fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync9, writeFileSync as writeFileSync14, rmSync as rmSync3, chmodSync as chmodSync5 } from "node:fs";
 import { join as join12 } from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function resolveClaudemeshBin() {
@@ -13003,7 +13264,7 @@ function installDarwin2() {
   </array>
 </dict>
 </plist>`;
-  writeFileSync13(join12(contents, "Info.plist"), plist);
+  writeFileSync14(join12(contents, "Info.plist"), plist);
   const shim = `#!/bin/sh
 URL="$1"
 CODE=\${URL#claudemesh://}
@@ -13018,7 +13279,7 @@ end tell
 EOF
 `;
   const shimPath = join12(macOS, "open-url");
-  writeFileSync13(shimPath, shim);
+  writeFileSync14(shimPath, shim);
   chmodSync5(shimPath, 493);
   const lsreg = spawnSync5("/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister", ["-f", appDir], { encoding: "utf-8" });
   if (lsreg.status !== 0) {
@@ -13042,7 +13303,7 @@ MimeType=x-scheme-handler/claudemesh;
 NoDisplay=true
 `;
   const desktopPath = join12(appsDir, "claudemesh.desktop");
-  writeFileSync13(desktopPath, desktop);
+  writeFileSync14(desktopPath, desktop);
   const xdg1 = spawnSync5("xdg-mime", ["default", "claudemesh.desktop", "x-scheme-handler/claudemesh"], { encoding: "utf-8" });
   if (xdg1.status !== 0) {
     render.warn("xdg-mime not available — skipped mime default registration");
@@ -13065,7 +13326,7 @@ function installWindows() {
     `@="\\"${binPath.replace(/\\/g, "\\\\")}\\" \\"%1\\""`
   ];
   const regPath = join12(homedir9(), "claudemesh-handler.reg");
-  writeFileSync13(regPath, lines.join(`\r
+  writeFileSync14(regPath, lines.join(`\r
 `));
   const res = spawnSync5("reg.exe", ["import", regPath], { encoding: "utf-8" });
   if (res.status !== 0) {
@@ -13077,14 +13338,14 @@ function installWindows() {
 }
 function uninstallDarwin() {
   const appDir = join12(homedir9(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
-  if (existsSync20(appDir))
+  if (existsSync21(appDir))
     rmSync3(appDir, { recursive: true, force: true });
   render.ok("removed claudemesh:// handler on macOS");
   return EXIT.SUCCESS;
 }
 function uninstallLinux() {
   const desktopPath = join12(homedir9(), ".local", "share", "applications", "claudemesh.desktop");
-  if (existsSync20(desktopPath))
+  if (existsSync21(desktopPath))
     rmSync3(desktopPath, { force: true });
   render.ok("removed claudemesh:// handler on Linux");
   return EXIT.SUCCESS;
@@ -13129,7 +13390,7 @@ var exports_status_line = {};
 __export(exports_status_line, {
   runStatusLine: () => runStatusLine
 });
-import { existsSync as existsSync21, readFileSync as readFileSync17 } from "node:fs";
+import { existsSync as existsSync22, readFileSync as readFileSync18 } from "node:fs";
 import { join as join13 } from "node:path";
 import { homedir as homedir10 } from "node:os";
 async function runStatusLine() {
@@ -13141,9 +13402,9 @@ async function runStatusLine() {
     }
     const cachePath = join13(homedir10(), ".claudemesh", "peer-cache.json");
     let cache = {};
-    if (existsSync21(cachePath)) {
+    if (existsSync22(cachePath)) {
       try {
-        cache = JSON.parse(readFileSync17(cachePath, "utf-8"));
+        cache = JSON.parse(readFileSync18(cachePath, "utf-8"));
       } catch {}
     }
     const pick = config.meshes[0];
@@ -13174,7 +13435,7 @@ __export(exports_backup, {
   runRestore: () => runRestore,
   runBackup: () => runBackup
 });
-import { readFileSync as readFileSync18, writeFileSync as writeFileSync14, existsSync as existsSync22 } from "node:fs";
+import { readFileSync as readFileSync19, writeFileSync as writeFileSync15, existsSync as existsSync23 } from "node:fs";
 import { createInterface as createInterface11 } from "node:readline";
 function readHidden(prompt5) {
   return new Promise((resolve2) => {
@@ -13216,11 +13477,11 @@ async function deriveKey(pass, salt, s) {
 }
 async function runBackup(outPath) {
   const configPath = getConfigPath();
-  if (!existsSync22(configPath)) {
+  if (!existsSync23(configPath)) {
     console.error("  No config found — nothing to back up. Join a mesh first.");
     return EXIT.NOT_FOUND;
   }
-  const plaintext = readFileSync18(configPath);
+  const plaintext = readFileSync19(configPath);
   const pass = await readHidden("  Passphrase (min 12 chars): ");
   if (pass.length < 12) {
     console.error("  ✗ Passphrase too short.");
@@ -13238,7 +13499,7 @@ async function runBackup(outPath) {
   const ciphertext = Buffer.from(s.crypto_aead_xchacha20poly1305_ietf_encrypt(plaintext, null, null, nonce, key));
   const blob = Buffer.concat([MAGIC, salt, nonce, ciphertext]);
   const file = outPath ?? `claudemesh-backup-${new Date().toISOString().replace(/[:.]/g, "-")}.cmb`;
-  writeFileSync14(file, blob, { mode: 384 });
+  writeFileSync15(file, blob, { mode: 384 });
   console.log(`
   ✓ Backup saved: ${file}`);
   console.log(`  Size: ${blob.length} bytes. Guard the passphrase — there is no recovery.
@@ -13250,11 +13511,11 @@ async function runRestore(inPath) {
     console.error("  Usage: claudemesh restore <backup-file>");
     return EXIT.INVALID_ARGS;
   }
-  if (!existsSync22(inPath)) {
+  if (!existsSync23(inPath)) {
     console.error(`  ✗ File not found: ${inPath}`);
     return EXIT.NOT_FOUND;
   }
-  const blob = readFileSync18(inPath);
+  const blob = readFileSync19(inPath);
   if (blob.length < 4 + 16 + 24 + 17 || !blob.subarray(0, 4).equals(MAGIC)) {
     console.error("  ✗ Not a claudemesh backup file (bad magic).");
     return EXIT.INVALID_ARGS;
@@ -13273,12 +13534,12 @@ async function runRestore(inPath) {
     return EXIT.INTERNAL_ERROR;
   }
   const configPath = getConfigPath();
-  if (existsSync22(configPath)) {
+  if (existsSync23(configPath)) {
     const backupOld = `${configPath}.before-restore.${Date.now()}`;
-    writeFileSync14(backupOld, readFileSync18(configPath), { mode: 384 });
+    writeFileSync15(backupOld, readFileSync19(configPath), { mode: 384 });
     console.log(`  ↻ Existing config saved to ${backupOld}`);
   }
-  writeFileSync14(configPath, Buffer.from(plaintext), { mode: 384 });
+  writeFileSync15(configPath, Buffer.from(plaintext), { mode: 384 });
   console.log(`
   ✓ Config restored to ${configPath}`);
   console.log("  Run `claudemesh list` to verify your meshes.\n");
@@ -13298,7 +13559,7 @@ __export(exports_upgrade, {
   runUpgrade: () => runUpgrade
 });
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync23 } from "node:fs";
+import { existsSync as existsSync24 } from "node:fs";
 import { dirname as dirname8, join as join14, resolve as resolve2 } from "node:path";
 async function latestVersion() {
   try {
@@ -13313,14 +13574,14 @@ async function latestVersion() {
 }
 function findNpm() {
   const portable = join14(process.env.HOME ?? "", ".claudemesh", "node", "bin", "npm");
-  if (existsSync23(portable)) {
+  if (existsSync24(portable)) {
     return { npm: portable, prefix: join14(process.env.HOME ?? "", ".claudemesh") };
   }
   let cur = resolve2(process.argv[1] ?? ".");
   for (let i = 0;i < 6; i++) {
     cur = dirname8(cur);
     const candidate = join14(cur, "bin", "npm");
-    if (existsSync23(candidate))
+    if (existsSync24(candidate))
       return { npm: candidate };
   }
   return { npm: "npm" };
@@ -13382,7 +13643,7 @@ __export(exports_grants, {
   runBlock: () => runBlock,
   isAllowed: () => isAllowed
 });
-import { existsSync as existsSync24, mkdirSync as mkdirSync10, readFileSync as readFileSync19, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync10, readFileSync as readFileSync20, writeFileSync as writeFileSync16 } from "node:fs";
 import { homedir as homedir11 } from "node:os";
 import { join as join15 } from "node:path";
 async function syncToBroker(meshSlug, grants) {
@@ -13402,19 +13663,19 @@ async function syncToBroker(meshSlug, grants) {
   }
 }
 function readGrants() {
-  if (!existsSync24(GRANT_FILE))
+  if (!existsSync25(GRANT_FILE))
     return {};
   try {
-    return JSON.parse(readFileSync19(GRANT_FILE, "utf-8"));
+    return JSON.parse(readFileSync20(GRANT_FILE, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeGrants(g) {
   const dir = join15(homedir11(), ".claudemesh");
-  if (!existsSync24(dir))
+  if (!existsSync25(dir))
     mkdirSync10(dir, { recursive: true });
-  writeFileSync15(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
+  writeFileSync16(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
 }
 function resolveCaps(input) {
   if (input.includes("all"))
@@ -15252,7 +15513,7 @@ __export(exports_file, {
 });
 import { hostname as osHostname } from "node:os";
 import { resolve as resolvePath, basename, dirname as dirname9 } from "node:path";
-import { statSync as statSync7, existsSync as existsSync25, writeFileSync as writeFileSync16, mkdirSync as mkdirSync11 } from "node:fs";
+import { statSync as statSync7, existsSync as existsSync26, writeFileSync as writeFileSync17, mkdirSync as mkdirSync11 } from "node:fs";
 function emitJson2(data) {
   console.log(JSON.stringify(data, null, 2));
 }
@@ -15269,7 +15530,7 @@ async function runFileShare(filePath, opts) {
     return EXIT.INVALID_ARGS;
   }
   const absPath = resolvePath(filePath);
-  if (!existsSync25(absPath)) {
+  if (!existsSync26(absPath)) {
     render.err(`File not found: ${absPath}`);
     return EXIT.INVALID_ARGS;
   }
@@ -15349,7 +15610,7 @@ async function runFileGet(fileId, opts) {
     const buf = Buffer.from(await res.arrayBuffer());
     const outPath = opts.out ? resolvePath(opts.out) : resolvePath(process.cwd(), meta.name);
     mkdirSync11(dirname9(outPath), { recursive: true });
-    writeFileSync16(outPath, buf);
+    writeFileSync17(outPath, buf);
     if (opts.json) {
       emitJson2({ fileId, name: meta.name, savedTo: outPath, sizeBytes: buf.length });
     } else {
@@ -15959,7 +16220,7 @@ __export(exports_bridge, {
   runBridge: () => runBridge,
   bridgeConfigTemplate: () => bridgeConfigTemplate
 });
-import { readFileSync as readFileSync20, existsSync as existsSync26 } from "node:fs";
+import { readFileSync as readFileSync21, existsSync as existsSync27 } from "node:fs";
 function parseConfig(text) {
   const trimmed = text.trim();
   if (trimmed.startsWith("{"))
@@ -16003,13 +16264,13 @@ async function runBridge(configPath) {
     render.err("Usage: claudemesh bridge run <config.yaml>");
     return EXIT.INVALID_ARGS;
   }
-  if (!existsSync26(configPath)) {
+  if (!existsSync27(configPath)) {
     render.err(`config file not found: ${configPath}`);
     return EXIT.NOT_FOUND;
   }
   let cfg;
   try {
-    cfg = parseConfig(readFileSync20(configPath, "utf-8"));
+    cfg = parseConfig(readFileSync21(configPath, "utf-8"));
   } catch (e) {
     render.err(`failed to parse ${configPath}: ${e instanceof Error ? e.message : String(e)}`);
     return EXIT.INVALID_ARGS;
@@ -16413,9 +16674,9 @@ function cacheKey(apiKeySecret, topicName) {
 async function getTopicKey(args) {
   const cacheId = cacheKey(args.apiKeySecret, args.topicName);
   if (!args.fresh) {
-    const cached2 = cache.get(cacheId);
-    if (cached2)
-      return { ok: true, topicKey: cached2.topicKey };
+    const cached3 = cache.get(cacheId);
+    if (cached3)
+      return { ok: true, topicKey: cached3.topicKey };
   }
   let sealed;
   try {
@@ -16983,11 +17244,11 @@ import {
   ListResourcesRequestSchema,
   ReadResourceRequestSchema
 } from "@modelcontextprotocol/sdk/types.js";
-import { existsSync as existsSync27 } from "node:fs";
+import { existsSync as existsSync28 } from "node:fs";
 import { request as httpRequest2 } from "node:http";
 async function daemonReady() {
   for (let i = 0;i < DAEMON_BOOT_RETRIES; i++) {
-    if (existsSync27(DAEMON_PATHS.SOCK_FILE))
+    if (existsSync28(DAEMON_PATHS.SOCK_FILE))
       return true;
     await new Promise((r) => setTimeout(r, DAEMON_BOOT_RETRY_MS));
   }
@@ -17317,9 +17578,9 @@ async function startServiceProxy(serviceName) {
     const fetched = await client.getServiceTools(serviceName);
     tools = fetched;
   } catch {
-    const cached2 = client.serviceCatalog.find((s) => s.name === serviceName);
-    if (cached2)
-      tools = cached2.tools;
+    const cached3 = client.serviceCatalog.find((s) => s.name === serviceName);
+    if (cached3)
+      tools = cached3.tools;
   }
   if (tools.length === 0) {
     process.stderr.write(`[mesh:${serviceName}] no tools found — service may not be running
@@ -19289,4 +19550,4 @@ main().catch((err) => {
   process.exit(EXIT.INTERNAL_ERROR);
 });
 
-//# debugId=04E4A5313AE4F0EA64756E2164756E21
+//# debugId=FBD494B01BF81C7164756E2164756E21