claudemesh-cli 1.28.0 → 1.30.0

package/dist/entrypoints/cli.js

@@ -92,7 +92,8 @@ var init_exit_codes = __esm(() => {
     ALREADY_EXISTS: 6,
     PERMISSION_DENIED: 7,
     INTERNAL_ERROR: 8,
-    CLAUDE_MISSING: 9
+    CLAUDE_MISSING: 9,
+    IO_ERROR: 10
   };
 });
 
@@ -103,7 +104,7 @@ __export(exports_urls, {
   VERSION: () => VERSION,
   URLS: () => URLS
 });
-var URLS, VERSION = "1.28.0", env;
+var URLS, VERSION = "1.30.0", env;
 var init_urls = __esm(() => {
   URLS = {
     BROKER: process.env.CLAUDEMESH_BROKER_URL ?? "wss://ic.claudemesh.com/ws",
@@ -3668,7 +3669,50 @@ var init_local_token = __esm(() => {
   init_paths2();
 });
 
+// src/services/session/token.ts
+var exports_token = {};
+__export(exports_token, {
+  readSessionTokenFromEnv: () => readSessionTokenFromEnv,
+  mintSessionToken: () => mintSessionToken,
+  TOKEN_FILE_ENV: () => TOKEN_FILE_ENV
+});
+import { randomBytes as randomBytes5 } from "node:crypto";
+import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "node:fs";
+function mintSessionToken(dir, fileName = "session-token") {
+  const token = randomBytes5(32).toString("hex");
+  const filePath = `${dir}/${fileName}`;
+  writeFileSync5(filePath, token, { mode: 384 });
+  return { token, filePath };
+}
+function readSessionTokenFromEnv(env2 = process.env) {
+  const direct = env2.CLAUDEMESH_IPC_TOKEN;
+  if (direct && /^[0-9a-f]{64}$/i.test(direct))
+    return direct.toLowerCase();
+  const path = env2[ENV_TOKEN_FILE];
+  if (!path)
+    return null;
+  try {
+    if (!existsSync5(path))
+      return null;
+    const raw = readFileSync5(path, "utf8").trim();
+    if (/^[0-9a-f]{64}$/i.test(raw))
+      return raw.toLowerCase();
+    return null;
+  } catch {
+    return null;
+  }
+}
+var ENV_TOKEN_FILE = "CLAUDEMESH_IPC_TOKEN_FILE", TOKEN_FILE_ENV;
+var init_token = __esm(() => {
+  TOKEN_FILE_ENV = ENV_TOKEN_FILE;
+});
+
 // src/daemon/ipc/client.ts
+var exports_client = {};
+__export(exports_client, {
+  ipc: () => ipc,
+  IpcError: () => IpcError
+});
 import { request as httpRequest } from "node:http";
 async function ipc(opts) {
   const useTcp = !!opts.preferTcp;
@@ -3688,6 +3732,11 @@ async function ipc(opts) {
       throw new IpcError(0, null, "daemon local token not found; is the daemon running?");
     headers.authorization = `Bearer ${tok}`;
   }
+  if (!useTcp) {
+    const sessionTok = readSessionTokenFromEnv();
+    if (sessionTok)
+      headers.authorization = `ClaudeMesh-Session ${sessionTok}`;
+  }
   return new Promise((resolve, reject) => {
     const req = httpRequest(useTcp ? { host: DAEMON_TCP_HOST, port: DAEMON_TCP_DEFAULT_PORT, path: opts.path, method: opts.method ?? "GET", headers } : { socketPath: DAEMON_PATHS.SOCK_FILE, path: opts.path, method: opts.method ?? "GET", headers }, (res) => {
       const chunks = [];
@@ -3712,6 +3761,7 @@ var IpcError;
 var init_client3 = __esm(() => {
   init_paths2();
   init_local_token();
+  init_token();
   IpcError = class IpcError extends Error {
     status;
     payload;
@@ -3729,7 +3779,7 @@ __export(exports_lifecycle, {
   ensureDaemonReady: () => ensureDaemonReady,
   _resetDaemonReadyCache: () => _resetDaemonReadyCache
 });
-import { existsSync as existsSync5, readFileSync as readFileSync5, statSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync6, statSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join4 } from "node:path";
 async function ensureDaemonReady(opts = {}) {
   if (lastResultThisProcess && (lastResultThisProcess.state === "up" || lastResultThisProcess.state === "started")) {
@@ -3770,7 +3820,7 @@ async function runEnsureDaemon(opts) {
   return { state: "spawn-failed", durationMs: Date.now() - t0, reason: spawnRes.reason };
 }
 async function probeDaemon() {
-  if (!existsSync5(DAEMON_PATHS.SOCK_FILE))
+  if (!existsSync6(DAEMON_PATHS.SOCK_FILE))
     return "absent";
   try {
     const res = await ipc({ path: "/v1/version", timeoutMs: PROBE_TIMEOUT_MS });
@@ -3803,7 +3853,7 @@ function recentSpawnFailureFresh() {
 }
 function markSpawnFailure() {
   try {
-    writeFileSync5(SPAWN_FAIL_FILE(), String(Date.now()), { mode: 384 });
+    writeFileSync6(SPAWN_FAIL_FILE(), String(Date.now()), { mode: 384 });
   } catch {}
 }
 function clearSpawnFailure() {
@@ -3840,9 +3890,9 @@ async function spawnDaemon(opts) {
 }
 async function acquireOrShareLock(_opts) {
   const lockPath = SPAWN_LOCK_FILE();
-  if (existsSync5(lockPath)) {
+  if (existsSync6(lockPath)) {
     try {
-      const pidStr = readFileSync5(lockPath, "utf8").trim();
+      const pidStr = readFileSync6(lockPath, "utf8").trim();
       const pid = Number.parseInt(pidStr, 10);
       if (Number.isFinite(pid) && pid > 0) {
         try {
@@ -3853,7 +3903,7 @@ async function acquireOrShareLock(_opts) {
     } catch {}
   }
   try {
-    writeFileSync5(lockPath, String(process.pid), { mode: 384 });
+    writeFileSync6(lockPath, String(process.pid), { mode: 384 });
   } catch {}
   return "acquired";
 }
@@ -3865,7 +3915,7 @@ function releaseLock() {
 async function pollForSocket(budgetMs) {
   const start = Date.now();
   while (Date.now() - start < budgetMs) {
-    if (existsSync5(DAEMON_PATHS.SOCK_FILE)) {
+    if (existsSync6(DAEMON_PATHS.SOCK_FILE)) {
       const probe = await probeDaemon();
       if (probe === "up")
         return { ok: true };
@@ -3892,6 +3942,38 @@ var init_lifecycle = __esm(() => {
   init_paths2();
 });
 
+// src/services/broker/session-hello-sig.ts
+var exports_session_hello_sig = {};
+__export(exports_session_hello_sig, {
+  signSessionHello: () => signSessionHello,
+  signParentAttestation: () => signParentAttestation,
+  DEFAULT_ATTESTATION_TTL_MS: () => DEFAULT_ATTESTATION_TTL_MS
+});
+async function signParentAttestation(args) {
+  const s = await ensureSodium();
+  const expiresAt = (args.now ?? Date.now()) + (args.ttlMs ?? DEFAULT_ATTESTATION_TTL_MS);
+  const canonical = `claudemesh-session-attest|${args.parentMemberPubkey}|${args.sessionPubkey}|${expiresAt}`;
+  const sig = s.crypto_sign_detached(s.from_string(canonical), s.from_hex(args.parentSecretKey));
+  return {
+    sessionPubkey: args.sessionPubkey,
+    parentMemberPubkey: args.parentMemberPubkey,
+    expiresAt,
+    signature: s.to_hex(sig)
+  };
+}
+async function signSessionHello(args) {
+  const s = await ensureSodium();
+  const timestamp2 = args.now ?? Date.now();
+  const canonical = `claudemesh-session-hello|${args.meshId}|${args.parentMemberPubkey}|${args.sessionPubkey}|${timestamp2}`;
+  const sig = s.crypto_sign_detached(s.from_string(canonical), s.from_hex(args.sessionSecretKey));
+  return { timestamp: timestamp2, signature: s.to_hex(sig) };
+}
+var DEFAULT_ATTESTATION_TTL_MS;
+var init_session_hello_sig = __esm(() => {
+  init_keypair();
+  DEFAULT_ATTESTATION_TTL_MS = 12 * 60 * 60 * 1000;
+});
+
 // src/commands/launch.ts
 var exports_launch = {};
 __export(exports_launch, {
@@ -3899,7 +3981,7 @@ __export(exports_launch, {
 });
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { mkdtempSync, writeFileSync as writeFileSync6, rmSync, readdirSync, statSync as statSync2, existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
+import { mkdtempSync, writeFileSync as writeFileSync7, rmSync, readdirSync, statSync as statSync2, existsSync as existsSync7, readFileSync as readFileSync7 } from "node:fs";
 import { tmpdir, hostname as hostname2, homedir as homedir3 } from "node:os";
 import { join as join5 } from "node:path";
 import { createInterface as createInterface4 } from "node:readline";
@@ -4248,8 +4330,8 @@ async function runLaunch(flags, rawArgs) {
   await ensureDaemonRunning(mesh.slug, args.quiet);
   try {
     const claudeConfigPath = join5(homedir3(), ".claude.json");
-    if (existsSync6(claudeConfigPath)) {
-      const claudeConfig = JSON.parse(readFileSync6(claudeConfigPath, "utf-8"));
+    if (existsSync7(claudeConfigPath)) {
+      const claudeConfig = JSON.parse(readFileSync7(claudeConfigPath, "utf-8"));
       const mcpServers = claudeConfig.mcpServers ?? {};
       let cleaned = 0;
       for (const key of Object.keys(mcpServers)) {
@@ -4267,7 +4349,7 @@ async function runLaunch(flags, rawArgs) {
       }
       if (cleaned > 0) {
         claudeConfig.mcpServers = mcpServers;
-        writeFileSync6(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
+        writeFileSync7(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
 `, "utf-8");
       }
     }
@@ -4293,8 +4375,61 @@ async function runLaunch(flags, rawArgs) {
     ...parsedGroups.length > 0 ? { groups: parsedGroups } : {},
     messageMode
   };
-  writeFileSync6(join5(tmpDir, "config.json"), JSON.stringify(sessionConfig, null, 2) + `
+  writeFileSync7(join5(tmpDir, "config.json"), JSON.stringify(sessionConfig, null, 2) + `
 `, "utf-8");
+  const isResume = args.resume !== null || args.continueSession;
+  const claudeSessionId = isResume ? undefined : randomUUID();
+  let sessionTokenFilePath = null;
+  let sessionTokenForCleanup = null;
+  try {
+    const { mintSessionToken: mintSessionToken2, TOKEN_FILE_ENV: TOKEN_FILE_ENV2 } = await Promise.resolve().then(() => (init_token(), exports_token));
+    const minted = mintSessionToken2(tmpDir);
+    sessionTokenFilePath = minted.filePath;
+    sessionTokenForCleanup = minted.token;
+    let presencePayload;
+    try {
+      const { generateKeypair: generateKeypair4 } = await Promise.resolve().then(() => (init_facade7(), exports_facade4));
+      const { signParentAttestation: signParentAttestation2 } = await Promise.resolve().then(() => (init_session_hello_sig(), exports_session_hello_sig));
+      const sessionKp = await generateKeypair4();
+      const att = await signParentAttestation2({
+        parentMemberPubkey: mesh.pubkey,
+        parentSecretKey: mesh.secretKey,
+        sessionPubkey: sessionKp.publicKey
+      });
+      presencePayload = {
+        session_pubkey: sessionKp.publicKey,
+        session_secret_key: sessionKp.secretKey,
+        parent_attestation: {
+          session_pubkey: att.sessionPubkey,
+          parent_member_pubkey: att.parentMemberPubkey,
+          expires_at: att.expiresAt,
+          signature: att.signature
+        }
+      };
+    } catch {}
+    const { ipc: ipc2 } = await Promise.resolve().then(() => (init_client3(), exports_client));
+    const sessionIdForRegister = claudeSessionId ?? randomUUID();
+    await ipc2({
+      method: "POST",
+      path: "/v1/sessions/register",
+      timeoutMs: 3000,
+      body: {
+        token: minted.token,
+        session_id: sessionIdForRegister,
+        mesh: mesh.slug,
+        display_name: displayName,
+        pid: process.pid,
+        cwd: process.cwd(),
+        ...role ? { role } : {},
+        ...parsedGroups.length > 0 ? { groups: parsedGroups.map((g) => `@${g.name}${g.role ? `:${g.role}` : ""}`) } : {},
+        ...presencePayload ? { presence: presencePayload } : {}
+      }
+    }).catch(() => null);
+    process._claudemeshTokenEnv = {
+      name: TOKEN_FILE_ENV2,
+      value: minted.filePath
+    };
+  } catch {}
   if (!args.quiet) {
     printBanner(displayName, mesh.slug, role, parsedGroups, messageMode);
   }
@@ -4303,7 +4438,7 @@ async function runLaunch(flags, rawArgs) {
     const claudeConfigPath = join5(homedir3(), ".claude.json");
     let claudeConfig = {};
     try {
-      claudeConfig = JSON.parse(readFileSync6(claudeConfigPath, "utf-8"));
+      claudeConfig = JSON.parse(readFileSync7(claudeConfigPath, "utf-8"));
     } catch {
       claudeConfig = {};
     }
@@ -4330,7 +4465,7 @@ async function runLaunch(flags, rawArgs) {
       meshMcpEntries.push({ key: entryKey, entry });
     }
     claudeConfig.mcpServers = mcpServers;
-    writeFileSync6(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
+    writeFileSync7(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
 `, "utf-8");
     if (!args.quiet && meshMcpEntries.length > 0) {
       console.log(`  ${meshMcpEntries.length} mesh service(s) registered as native MCPs:`);
@@ -4351,8 +4486,6 @@ async function runLaunch(flags, rawArgs) {
     }
     filtered.push(args.claudeArgs[i]);
   }
-  const isResume = args.resume !== null || args.continueSession;
-  const claudeSessionId = isResume ? undefined : randomUUID();
   const claudeArgs = [
     "--dangerously-load-development-channels",
     "server:claudemesh",
@@ -4372,7 +4505,7 @@ async function runLaunch(flags, rawArgs) {
       join5(homedir3(), ".claude", "bin", "claude")
     ];
     for (const c of candidates) {
-      if (existsSync6(c)) {
+      if (existsSync7(c)) {
         claudeBin = c;
         break;
       }
@@ -4382,13 +4515,13 @@ async function runLaunch(flags, rawArgs) {
     if (meshMcpEntries.length > 0) {
       try {
         const claudeConfigPath = join5(homedir3(), ".claude.json");
-        const claudeConfig = JSON.parse(readFileSync6(claudeConfigPath, "utf-8"));
+        const claudeConfig = JSON.parse(readFileSync7(claudeConfigPath, "utf-8"));
         const mcpServers = claudeConfig.mcpServers ?? {};
         for (const { key } of meshMcpEntries) {
           delete mcpServers[key];
         }
         claudeConfig.mcpServers = mcpServers;
-        writeFileSync6(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
+        writeFileSync7(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
 `, "utf-8");
       } catch {}
     }
@@ -4418,6 +4551,7 @@ async function runLaunch(flags, rawArgs) {
       CLAUDEMESH_CONFIG_DIR: tmpDir,
       CLAUDEMESH_DISPLAY_NAME: displayName,
       ...claudeSessionId ? { CLAUDEMESH_SESSION_ID: claudeSessionId } : {},
+      ...sessionTokenFilePath ? { CLAUDEMESH_IPC_TOKEN_FILE: sessionTokenFilePath } : {},
       MCP_TIMEOUT: process.env.MCP_TIMEOUT ?? "30000",
       MAX_MCP_OUTPUT_TOKENS: process.env.MAX_MCP_OUTPUT_TOKENS ?? "50000",
       ...role ? { CLAUDEMESH_ROLE: role } : {}
@@ -5085,7 +5219,7 @@ __export(exports_join, {
   runJoin: () => runJoin
 });
 import sodium3 from "libsodium-wrappers";
-import { writeFileSync as writeFileSync7, mkdirSync as mkdirSync4 } from "node:fs";
+import { writeFileSync as writeFileSync8, mkdirSync as mkdirSync4 } from "node:fs";
 import { join as join6, dirname as dirname3 } from "node:path";
 import { homedir as homedir4, hostname as hostname3 } from "node:os";
 function deriveAppBaseUrl() {
@@ -5210,7 +5344,7 @@ async function runJoin(args) {
   const inviteFile = join6(configDir, `invite-${payload.mesh_slug}.txt`);
   try {
     mkdirSync4(dirname3(inviteFile), { recursive: true });
-    writeFileSync7(inviteFile, link, "utf-8");
+    writeFileSync8(inviteFile, link, "utf-8");
   } catch {}
   console.log("");
   console.log(`✓ Joined "${payload.mesh_slug}" as ${displayName}${enroll.alreadyMember ? " (already a member — re-enrolled with same pubkey)" : ""}`);
@@ -7660,6 +7794,45 @@ var init_daemon_route = __esm(() => {
   init_warnings();
 });
 
+// src/services/session/resolve.ts
+var exports_resolve = {};
+__export(exports_resolve, {
+  getSessionInfo: () => getSessionInfo,
+  _resetSessionCache: () => _resetSessionCache
+});
+async function getSessionInfo() {
+  if (cached !== undefined)
+    return cached;
+  const tok = readSessionTokenFromEnv();
+  if (!tok) {
+    cached = null;
+    return null;
+  }
+  try {
+    const res = await ipc({
+      path: "/v1/sessions/me",
+      timeoutMs: 1500
+    });
+    if (res.status !== 200 || !res.body.session) {
+      cached = null;
+      return null;
+    }
+    cached = res.body.session;
+    return cached;
+  } catch {
+    cached = null;
+    return null;
+  }
+}
+function _resetSessionCache() {
+  cached = undefined;
+}
+var cached = undefined;
+var init_resolve = __esm(() => {
+  init_client3();
+  init_token();
+});
+
 // src/commands/peers.ts
 var exports_peers = {};
 __export(exports_peers, {
@@ -7699,7 +7872,14 @@ function annotateSelf(peer, selfMemberPubkey, selfSessionPubkey) {
 }
 async function runPeers(flags) {
   const config = readConfig();
-  const slugs = flags.mesh ? [flags.mesh] : config.meshes.map((m) => m.slug);
+  let slugs;
+  if (flags.mesh) {
+    slugs = [flags.mesh];
+  } else {
+    const { getSessionInfo: getSessionInfo2 } = await Promise.resolve().then(() => (init_resolve(), exports_resolve));
+    const sess = await getSessionInfo2();
+    slugs = sess ? [sess.mesh] : config.meshes.map((m) => m.slug);
+  }
   if (slugs.length === 0) {
     render.err("No meshes joined.");
     render.hint("claudemesh <invite-url>    # join + launch");
@@ -8315,7 +8495,7 @@ async function runMsgStatus(id, opts) {
       console.log(JSON.stringify(result, null, 2));
       return EXIT.SUCCESS;
     }
-    render.section(`message ${id.slice(0, 12)}…`);
+    render.section(`message ${lookupId.slice(0, 12)}…`);
     render.kv([
       ["target", result.targetSpec],
       ["delivered", result.delivered ? "yes" : "no"],
@@ -8669,12 +8849,12 @@ var init_whoami = __esm(() => {
 });
 
 // src/daemon/lock.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync7, unlinkSync as unlinkSync3, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync8, unlinkSync as unlinkSync3, writeFileSync as writeFileSync9 } from "node:fs";
 import { dirname as dirname4 } from "node:path";
 function acquireSingletonLock() {
   mkdirSync5(dirname4(DAEMON_PATHS.PID_FILE), { recursive: true, mode: 448 });
-  if (existsSync7(DAEMON_PATHS.PID_FILE)) {
-    const raw = readFileSync7(DAEMON_PATHS.PID_FILE, "utf8").trim();
+  if (existsSync8(DAEMON_PATHS.PID_FILE)) {
+    const raw = readFileSync8(DAEMON_PATHS.PID_FILE, "utf8").trim();
     const oldPid = Number.parseInt(raw, 10);
     if (Number.isFinite(oldPid) && oldPid > 0 && isProcessAlive(oldPid)) {
       return { result: "already-running", pid: oldPid };
@@ -8682,22 +8862,22 @@ function acquireSingletonLock() {
     try {
       unlinkSync3(DAEMON_PATHS.PID_FILE);
     } catch {}
-    writeFileSync8(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
+    writeFileSync9(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
     return { result: "stale", pid: process.pid };
   }
-  writeFileSync8(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
+  writeFileSync9(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
   return { result: "acquired", pid: process.pid };
 }
 function releaseSingletonLock() {
   try {
-    const raw = readFileSync7(DAEMON_PATHS.PID_FILE, "utf8").trim();
+    const raw = readFileSync8(DAEMON_PATHS.PID_FILE, "utf8").trim();
     if (Number.parseInt(raw, 10) === process.pid)
       unlinkSync3(DAEMON_PATHS.PID_FILE);
   } catch {}
 }
 function readRunningPid() {
   try {
-    const raw = readFileSync7(DAEMON_PATHS.PID_FILE, "utf8").trim();
+    const raw = readFileSync8(DAEMON_PATHS.PID_FILE, "utf8").trim();
     const pid = Number.parseInt(raw, 10);
     if (Number.isFinite(pid) && pid > 0 && isProcessAlive(pid))
       return pid;
@@ -8843,17 +9023,17 @@ function requeueDeadOrPending(db, args) {
 
 // src/daemon/db/sqlite.ts
 async function loadSqlite() {
-  if (cached)
-    return cached;
+  if (cached2)
+    return cached2;
   try {
     const mod = await import("node:sqlite");
-    cached = mod.DatabaseSync;
-    return cached;
+    cached2 = mod.DatabaseSync;
+    return cached2;
   } catch (nodeErr) {
     try {
       const bunMod = await import("bun:sqlite");
-      cached = bunMod.Database;
-      return cached;
+      cached2 = bunMod.Database;
+      return cached2;
     } catch {
       const msg = `claudemesh daemon requires Node.js 22.5+ for the embedded SQLite store (node:sqlite), or Bun (bun:sqlite) for dev. Current: ${process.version}. Original error: ${String(nodeErr)}`;
       throw new Error(msg);
@@ -8884,7 +9064,7 @@ function inImmediateTx(db, fn) {
     throw err;
   }
 }
-var cached = null;
+var cached2 = null;
 
 // src/daemon/fingerprint.ts
 import { createHash } from "node:crypto";
@@ -9127,9 +9307,88 @@ function bindSseStream(res, bus) {
   return cleanup;
 }
 
+// src/daemon/session-registry.ts
+function startReaper() {
+  if (reaperHandle)
+    return;
+  reaperHandle = setInterval(reapDead, REAPER_INTERVAL_MS).unref?.() ?? reaperHandle;
+}
+function setRegistryHooks(next) {
+  hooks.onRegister = next.onRegister;
+  hooks.onDeregister = next.onDeregister;
+}
+function registerSession(info) {
+  const priorToken = bySessionId.get(info.sessionId);
+  if (priorToken && priorToken !== info.token) {
+    const prior = byToken.get(priorToken);
+    if (prior) {
+      byToken.delete(priorToken);
+      try {
+        hooks.onDeregister?.(prior);
+      } catch {}
+    }
+  }
+  const stored = { ...info, registeredAt: Date.now() };
+  byToken.set(info.token, stored);
+  bySessionId.set(info.sessionId, info.token);
+  try {
+    hooks.onRegister?.(stored);
+  } catch {}
+  return stored;
+}
+function deregisterByToken(token) {
+  const entry = byToken.get(token);
+  if (!entry)
+    return false;
+  byToken.delete(token);
+  if (bySessionId.get(entry.sessionId) === token)
+    bySessionId.delete(entry.sessionId);
+  try {
+    hooks.onDeregister?.(entry);
+  } catch {}
+  return true;
+}
+function resolveToken(token) {
+  const entry = byToken.get(token);
+  if (!entry)
+    return null;
+  if (Date.now() - entry.registeredAt > TTL_MS) {
+    deregisterByToken(token);
+    return null;
+  }
+  return entry;
+}
+function listSessions() {
+  return [...byToken.values()];
+}
+function reapDead() {
+  const dead = [];
+  for (const [token, info] of byToken.entries()) {
+    if (Date.now() - info.registeredAt > TTL_MS) {
+      dead.push(token);
+      continue;
+    }
+    try {
+      process.kill(info.pid, 0);
+    } catch {
+      dead.push(token);
+    }
+  }
+  for (const t of dead)
+    deregisterByToken(t);
+}
+var TTL_MS, REAPER_INTERVAL_MS, byToken, bySessionId, hooks, reaperHandle = null;
+var init_session_registry = __esm(() => {
+  TTL_MS = 24 * 60 * 60 * 1000;
+  REAPER_INTERVAL_MS = 30 * 1000;
+  byToken = new Map;
+  bySessionId = new Map;
+  hooks = {};
+});
+
 // src/daemon/ipc/server.ts
 import { createServer as createServer2 } from "node:http";
-import { chmodSync as chmodSync3, existsSync as existsSync8, unlinkSync as unlinkSync4 } from "node:fs";
+import { chmodSync as chmodSync3, existsSync as existsSync9, unlinkSync as unlinkSync4 } from "node:fs";
 import { timingSafeEqual } from "node:crypto";
 import { randomUUID as randomUUID3 } from "node:crypto";
 function startIpcServer(opts) {
@@ -9145,7 +9404,7 @@ function startIpcServer(opts) {
     meshConfigs: opts.meshConfigs,
     onPendingInserted: opts.onPendingInserted
   });
-  if (existsSync8(DAEMON_PATHS.SOCK_FILE)) {
+  if (existsSync9(DAEMON_PATHS.SOCK_FILE)) {
     try {
       unlinkSync4(DAEMON_PATHS.SOCK_FILE);
     } catch {}
@@ -9231,11 +9490,19 @@ function makeHandler(opts) {
         return;
       }
     }
+    let session = null;
+    {
+      const authz = req.headers.authorization ?? "";
+      const sm = /^ClaudeMesh-Session\s+([0-9a-f]{64})$/i.exec(authz.trim());
+      if (sm && sm[1])
+        session = resolveToken(sm[1].toLowerCase());
+    }
+    const meshFromCtx = (explicit) => explicit && explicit.trim() ? explicit : session?.mesh ?? null;
     if (req.method === "GET" && url.pathname === "/v1/version") {
       respond(res, 200, {
         daemon_version: VERSION,
         ipc_api: "v1",
-        ipc_features: ["version", "health", "send", "inbox", "events", "peers", "profile", "skills", "state", "memory"],
+        ipc_features: ["version", "health", "send", "inbox", "events", "peers", "profile", "skills", "state", "memory", "sessions"],
         schema_version: 1
       });
       return;
@@ -9244,6 +9511,102 @@ function makeHandler(opts) {
       respond(res, 200, { ok: true, pid: process.pid });
       return;
     }
+    if (req.method === "POST" && url.pathname === "/v1/sessions/register") {
+      try {
+        const body = await readJsonBody(req, 64 * 1024);
+        if (!body) {
+          respond(res, 400, { error: "missing body" });
+          return;
+        }
+        const token = typeof body.token === "string" ? body.token : "";
+        if (!/^[0-9a-f]{64}$/i.test(token)) {
+          respond(res, 400, { error: "token must be 64 hex chars" });
+          return;
+        }
+        const sessionId = typeof body.session_id === "string" ? body.session_id : "";
+        const mesh = typeof body.mesh === "string" ? body.mesh : "";
+        const displayName = typeof body.display_name === "string" ? body.display_name : "";
+        const pid = typeof body.pid === "number" ? body.pid : 0;
+        if (!sessionId || !mesh || !displayName || !pid) {
+          respond(res, 400, { error: "session_id, mesh, display_name, pid all required" });
+          return;
+        }
+        const cwd = typeof body.cwd === "string" ? body.cwd : undefined;
+        const role = typeof body.role === "string" ? body.role : undefined;
+        const groups = Array.isArray(body.groups) ? body.groups.filter((g) => typeof g === "string") : undefined;
+        let presence;
+        const rawPresence = body.presence;
+        if (rawPresence && typeof rawPresence === "object") {
+          const p = rawPresence;
+          const sessionPubkey = typeof p.session_pubkey === "string" ? p.session_pubkey.toLowerCase() : "";
+          const sessionSecretKey = typeof p.session_secret_key === "string" ? p.session_secret_key.toLowerCase() : "";
+          const att = p.parent_attestation;
+          if (/^[0-9a-f]{64}$/.test(sessionPubkey) && /^[0-9a-f]{128}$/.test(sessionSecretKey) && att && typeof att === "object" && typeof att.session_pubkey === "string" && typeof att.parent_member_pubkey === "string" && typeof att.expires_at === "number" && typeof att.signature === "string") {
+            presence = {
+              sessionPubkey,
+              sessionSecretKey,
+              parentAttestation: {
+                sessionPubkey: att.session_pubkey.toLowerCase(),
+                parentMemberPubkey: att.parent_member_pubkey.toLowerCase(),
+                expiresAt: att.expires_at,
+                signature: att.signature.toLowerCase()
+              }
+            };
+          } else {
+            opts.log("warn", "session_register_presence_malformed", { mesh });
+          }
+        }
+        const stored = registerSession({
+          token: token.toLowerCase(),
+          sessionId,
+          mesh,
+          displayName,
+          pid,
+          cwd,
+          role,
+          groups,
+          ...presence ? { presence } : {}
+        });
+        opts.log("info", "session_registered", {
+          sessionId,
+          mesh,
+          pid,
+          presence: presence ? "yes" : "no"
+        });
+        respond(res, 200, {
+          ok: true,
+          registered_at: stored.registeredAt,
+          presence_accepted: !!presence
+        });
+      } catch (e) {
+        respond(res, 400, { error: String(e) });
+      }
+      return;
+    }
+    if (req.method === "DELETE" && url.pathname.startsWith("/v1/sessions/")) {
+      const tail = url.pathname.slice("/v1/sessions/".length);
+      if (!/^[0-9a-f]{64}$/i.test(tail)) {
+        respond(res, 400, { error: "invalid token" });
+        return;
+      }
+      const ok = deregisterByToken(tail.toLowerCase());
+      respond(res, ok ? 200 : 404, { ok, token_prefix: tail.slice(0, 8) });
+      return;
+    }
+    if (req.method === "GET" && url.pathname === "/v1/sessions/me") {
+      if (!session) {
+        respond(res, 401, { error: "no session token" });
+        return;
+      }
+      const { token, ...redacted } = session;
+      respond(res, 200, { session: { ...redacted, token_prefix: token.slice(0, 8) } });
+      return;
+    }
+    if (req.method === "GET" && url.pathname === "/v1/sessions") {
+      const all = listSessions().map(({ token, ...rest }) => ({ ...rest, token_prefix: token.slice(0, 8) }));
+      respond(res, 200, { sessions: all });
+      return;
+    }
     if (req.method === "GET" && url.pathname === "/v1/events") {
       if (!opts.bus) {
         respond(res, 503, { error: "event bus not initialised" });
@@ -9257,7 +9620,7 @@ function makeHandler(opts) {
         respond(res, 503, { error: "broker not initialised" });
         return;
       }
-      const filterMesh = url.searchParams.get("mesh") ?? undefined;
+      const filterMesh = meshFromCtx(url.searchParams.get("mesh")) ?? undefined;
       try {
         const all = [];
         for (const [slug, b] of opts.brokers.entries()) {
@@ -9282,7 +9645,7 @@ function makeHandler(opts) {
         respond(res, 503, { error: "broker not initialised" });
         return;
       }
-      const filterMesh = url.searchParams.get("mesh") ?? undefined;
+      const filterMesh = meshFromCtx(url.searchParams.get("mesh")) ?? undefined;
       const key = url.searchParams.get("key");
       try {
         if (key) {
@@ -9323,7 +9686,7 @@ function makeHandler(opts) {
           respond(res, 400, { error: "missing 'key' (string)" });
           return;
         }
-        const requested = (typeof body.mesh === "string" ? body.mesh : null) || null;
+        const requested = meshFromCtx(typeof body.mesh === "string" ? body.mesh : null);
         let chosen = requested;
         if (!chosen && opts.brokers.size === 1)
           chosen = opts.brokers.keys().next().value;
@@ -9349,7 +9712,7 @@ function makeHandler(opts) {
         return;
       }
       const query = url.searchParams.get("q") ?? "";
-      const filterMesh = url.searchParams.get("mesh") ?? undefined;
+      const filterMesh = meshFromCtx(url.searchParams.get("mesh")) ?? undefined;
       try {
         const all = [];
         for (const [slug, b] of opts.brokers.entries()) {
@@ -9376,7 +9739,7 @@ function makeHandler(opts) {
           respond(res, 400, { error: "missing 'content' (string)" });
           return;
         }
-        const requested = (typeof body.mesh === "string" ? body.mesh : null) || null;
+        const requested = meshFromCtx(typeof body.mesh === "string" ? body.mesh : null);
         let chosen = requested;
         if (!chosen && opts.brokers.size === 1)
           chosen = opts.brokers.keys().next().value;
@@ -9434,7 +9797,7 @@ function makeHandler(opts) {
         return;
       }
       const query = url.searchParams.get("query") ?? undefined;
-      const filterMesh = url.searchParams.get("mesh") ?? undefined;
+      const filterMesh = meshFromCtx(url.searchParams.get("mesh")) ?? undefined;
       try {
         const all = [];
         for (const [slug, b] of opts.brokers.entries()) {
@@ -9464,7 +9827,7 @@ function makeHandler(opts) {
         respond(res, 400, { error: "missing skill name" });
         return;
       }
-      const filterMesh = url.searchParams.get("mesh") ?? undefined;
+      const filterMesh = meshFromCtx(url.searchParams.get("mesh")) ?? undefined;
       try {
         for (const [slug, b] of opts.brokers.entries()) {
           if (filterMesh && filterMesh !== slug)
@@ -9492,7 +9855,7 @@ function makeHandler(opts) {
           respond(res, 400, { error: "expected JSON object" });
           return;
         }
-        const requested = (typeof body.mesh === "string" ? body.mesh : url.searchParams.get("mesh")) || null;
+        const requested = meshFromCtx(typeof body.mesh === "string" ? body.mesh : url.searchParams.get("mesh"));
         const targets = requested ? [opts.brokers.get(requested)].filter(Boolean) : [...opts.brokers.values()];
         if (targets.length === 0) {
           respond(res, 404, { error: "mesh_not_attached", mesh: requested });
@@ -9776,16 +10139,16 @@ function parseSendRequest(body, idempotencyHeader) {
 }
 async function resolveAndEncrypt(req, broker, meshSecretKey, meshSlug) {
   const { encryptDirect: encryptDirect2 } = await Promise.resolve().then(() => (init_box(), exports_box));
-  const { randomBytes: randomBytes5 } = await import("node:crypto");
+  const { randomBytes: randomBytes6 } = await import("node:crypto");
   const to = req.to.trim();
   if (to.startsWith("#") && /^#[0-9a-z_-]{20,}$/i.test(to)) {
     const ciphertext = Buffer.from(req.message, "utf8").toString("base64");
-    const nonce = randomBytes5(24).toString("base64");
+    const nonce = randomBytes6(24).toString("base64");
     return { target_spec: to, ciphertext, nonce, mesh: meshSlug ?? "" };
   }
   if (to.startsWith("@") || to === "*") {
     const ciphertext = Buffer.from(req.message, "utf8").toString("base64");
-    const nonce = randomBytes5(24).toString("base64");
+    const nonce = randomBytes6(24).toString("base64");
     return { target_spec: to, ciphertext, nonce, mesh: meshSlug ?? "" };
   }
   if (/^[0-9a-f]{64}$/i.test(to)) {
@@ -9826,6 +10189,7 @@ function respond(res, status, body) {
 var init_server = __esm(() => {
   init_paths2();
   init_send2();
+  init_session_registry();
   init_urls();
 });
 
@@ -10314,9 +10678,168 @@ var init_broker = __esm(() => {
   BACKOFF_CAPS_MS = [1000, 2000, 4000, 8000, 16000, 30000];
 });
 
+// src/daemon/session-broker.ts
+import { hostname as osHostname } from "node:os";
+import WebSocket3 from "ws";
+
+class SessionBrokerClient {
+  opts;
+  ws = null;
+  _status = "closed";
+  closed = false;
+  reconnectAttempt = 0;
+  reconnectTimer = null;
+  helloTimer = null;
+  constructor(opts) {
+    this.opts = opts;
+  }
+  get status() {
+    return this._status;
+  }
+  get meshSlug() {
+    return this.opts.mesh.slug;
+  }
+  get sessionPubkey() {
+    return this.opts.sessionPubkey;
+  }
+  log = (level, msg, meta) => {
+    (this.opts.log ?? defaultLog2)(level, msg, {
+      mesh: this.opts.mesh.slug,
+      session_pubkey: this.opts.sessionPubkey.slice(0, 12),
+      ...meta
+    });
+  };
+  setStatus(s) {
+    if (this._status === s)
+      return;
+    this._status = s;
+    this.opts.onStatusChange?.(s);
+  }
+  async connect() {
+    if (this.closed)
+      throw new Error("client_closed");
+    if (this._status === "connecting" || this._status === "open")
+      return;
+    this.setStatus("connecting");
+    const ws = new WebSocket3(this.opts.mesh.brokerUrl);
+    this.ws = ws;
+    return new Promise((resolve, reject) => {
+      ws.on("open", async () => {
+        try {
+          const { timestamp: timestamp2, signature } = await signSessionHello({
+            meshId: this.opts.mesh.meshId,
+            parentMemberPubkey: this.opts.mesh.pubkey,
+            sessionPubkey: this.opts.sessionPubkey,
+            sessionSecretKey: this.opts.sessionSecretKey
+          });
+          ws.send(JSON.stringify({
+            type: "session_hello",
+            meshId: this.opts.mesh.meshId,
+            parentMemberId: this.opts.mesh.memberId,
+            parentMemberPubkey: this.opts.mesh.pubkey,
+            sessionPubkey: this.opts.sessionPubkey,
+            parentAttestation: this.opts.parentAttestation,
+            displayName: this.opts.displayName,
+            sessionId: this.opts.sessionId,
+            pid: this.opts.pid,
+            cwd: this.opts.cwd ?? process.cwd(),
+            hostname: osHostname(),
+            peerType: "ai",
+            channel: "claudemesh-session",
+            ...this.opts.groups && this.opts.groups.length > 0 ? { groups: this.opts.groups } : {},
+            ...this.opts.role ? { role: this.opts.role } : {},
+            timestamp: timestamp2,
+            signature
+          }));
+          this.helloTimer = setTimeout(() => {
+            this.log("warn", "session_hello_ack_timeout");
+            try {
+              ws.close();
+            } catch {}
+            reject(new Error("session_hello_ack_timeout"));
+          }, HELLO_ACK_TIMEOUT_MS3);
+        } catch (e) {
+          reject(e instanceof Error ? e : new Error(String(e)));
+        }
+      });
+      ws.on("message", (raw) => {
+        let msg;
+        try {
+          msg = JSON.parse(raw.toString());
+        } catch {
+          return;
+        }
+        if (msg.type === "hello_ack") {
+          if (this.helloTimer)
+            clearTimeout(this.helloTimer);
+          this.helloTimer = null;
+          this.setStatus("open");
+          this.reconnectAttempt = 0;
+          resolve();
+          return;
+        }
+        if (msg.type === "error") {
+          this.log("warn", "broker_error", { code: msg.code, message: msg.message });
+          if (msg.code === "unknown_message_type") {
+            this.closed = true;
+          }
+          return;
+        }
+      });
+      ws.on("close", (code, reason) => {
+        if (this.helloTimer) {
+          clearTimeout(this.helloTimer);
+          this.helloTimer = null;
+        }
+        if (this.closed) {
+          this.setStatus("closed");
+          return;
+        }
+        this.setStatus("reconnecting");
+        const wait = BACKOFF_CAPS_MS2[Math.min(this.reconnectAttempt, BACKOFF_CAPS_MS2.length - 1)] ?? 30000;
+        this.reconnectAttempt++;
+        this.log("info", "session_broker_reconnect_scheduled", { wait_ms: wait, code, reason: reason.toString("utf8") });
+        this.reconnectTimer = setTimeout(() => this.connect().catch((err) => this.log("warn", "session_broker_reconnect_failed", { err: String(err) })), wait);
+        if (this._status === "connecting")
+          reject(new Error(`closed_before_hello_${code}`));
+      });
+      ws.on("error", (err) => this.log("warn", "session_broker_ws_error", { err: err.message }));
+    });
+  }
+  async close() {
+    this.closed = true;
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+    if (this.helloTimer) {
+      clearTimeout(this.helloTimer);
+      this.helloTimer = null;
+    }
+    try {
+      this.ws?.close();
+    } catch {}
+    this.setStatus("closed");
+  }
+}
+function defaultLog2(level, msg, meta) {
+  const line = JSON.stringify({ level, msg, ...meta, ts: new Date().toISOString() });
+  if (level === "info")
+    process.stdout.write(line + `
+`);
+  else
+    process.stderr.write(line + `
+`);
+}
+var HELLO_ACK_TIMEOUT_MS3 = 5000, BACKOFF_CAPS_MS2;
+var init_session_broker = __esm(() => {
+  init_session_hello_sig();
+  BACKOFF_CAPS_MS2 = [1000, 2000, 4000, 8000, 16000, 30000];
+});
+
 // src/daemon/drain.ts
 function startDrainWorker(opts) {
-  const log2 = opts.log ?? defaultLog2;
+  const log2 = opts.log ?? defaultLog3;
   let stopped = false;
   let wakeResolve = null;
   let wakePromise = new Promise((r) => {
@@ -10457,10 +10980,10 @@ function bufferToHex(b) {
   return s;
 }
 async function randomNonce2() {
-  const { randomBytes: randomBytes5 } = await import("node:crypto");
-  return randomBytes5(24).toString("base64");
+  const { randomBytes: randomBytes6 } = await import("node:crypto");
+  return randomBytes6(24).toString("base64");
 }
-function defaultLog2(level, msg, meta) {
+function defaultLog3(level, msg, meta) {
   const line = JSON.stringify({ level, msg, ...meta, ts: new Date().toISOString() });
   if (level === "info")
     process.stdout.write(line + `
@@ -10580,7 +11103,7 @@ __export(exports_identity, {
   checkFingerprint: () => checkFingerprint,
   acceptCurrentHost: () => acceptCurrentHost
 });
-import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync10 } from "node:fs";
 import { join as join7 } from "node:path";
 import { createHash as createHash2 } from "node:crypto";
 import { networkInterfaces } from "node:os";
@@ -10601,13 +11124,13 @@ function computeCurrentFingerprint() {
 }
 function checkFingerprint() {
   const current = computeCurrentFingerprint();
-  if (!existsSync9(path())) {
-    writeFileSync9(path(), JSON.stringify(current, null, 2), { mode: 384 });
+  if (!existsSync10(path())) {
+    writeFileSync10(path(), JSON.stringify(current, null, 2), { mode: 384 });
     return { result: "first_run", current };
   }
   let stored;
   try {
-    stored = JSON.parse(readFileSync8(path(), "utf8"));
+    stored = JSON.parse(readFileSync9(path(), "utf8"));
   } catch {
     return { result: "unavailable", current };
   }
@@ -10617,14 +11140,14 @@ function checkFingerprint() {
 }
 function acceptCurrentHost() {
   const current = computeCurrentFingerprint();
-  writeFileSync9(path(), JSON.stringify(current, null, 2), { mode: 384 });
+  writeFileSync10(path(), JSON.stringify(current, null, 2), { mode: 384 });
   return current;
 }
 function readHostId() {
   if (process.platform === "linux") {
     for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
       try {
-        const raw = readFileSync8(p, "utf8").trim();
+        const raw = readFileSync9(p, "utf8").trim();
         if (raw)
           return `linux:${raw}`;
       } catch {}
@@ -10669,16 +11192,16 @@ var init_identity = __esm(() => {
 });
 
 // src/daemon/run.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync9 } from "node:fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync10 } from "node:fs";
 function detectContainer() {
   if (process.env.KUBERNETES_SERVICE_HOST)
     return true;
   if (process.env.CONTAINER === "1")
     return true;
   try {
-    if (existsSync10("/.dockerenv"))
+    if (existsSync11("/.dockerenv"))
       return true;
-    const cg = readFileSync9("/proc/1/cgroup", "utf8");
+    const cg = readFileSync10("/proc/1/cgroup", "utf8");
     if (/(docker|kubepods|containerd)/.test(cg))
       return true;
   } catch {}
@@ -10803,6 +11326,57 @@ async function runDaemon(opts = {}) {
   }
   let drain = null;
   drain = startDrainWorker({ db: outboxDb, brokers });
+  const sessionBrokers = new Map;
+  setRegistryHooks({
+    onRegister: (info) => {
+      if (!info.presence)
+        return;
+      const meshConfig = meshConfigs.get(info.mesh);
+      if (!meshConfig) {
+        process.stderr.write(JSON.stringify({
+          level: "warn",
+          msg: "session_broker_no_mesh_config",
+          mesh: info.mesh,
+          ts: new Date().toISOString()
+        }) + `
+`);
+        return;
+      }
+      const prior = sessionBrokers.get(info.token);
+      if (prior) {
+        sessionBrokers.delete(info.token);
+        prior.close().catch(() => {});
+      }
+      const client = new SessionBrokerClient({
+        mesh: meshConfig,
+        sessionPubkey: info.presence.sessionPubkey,
+        sessionSecretKey: info.presence.sessionSecretKey,
+        parentAttestation: info.presence.parentAttestation,
+        sessionId: info.sessionId,
+        displayName: info.displayName,
+        ...info.role ? { role: info.role } : {},
+        ...info.cwd ? { cwd: info.cwd } : {},
+        pid: info.pid
+      });
+      sessionBrokers.set(info.token, client);
+      client.connect().catch((err) => process.stderr.write(JSON.stringify({
+        level: "warn",
+        msg: "session_broker_connect_failed",
+        mesh: info.mesh,
+        err: String(err),
+        ts: new Date().toISOString()
+      }) + `
+`));
+    },
+    onDeregister: (info) => {
+      const client = sessionBrokers.get(info.token);
+      if (!client)
+        return;
+      sessionBrokers.delete(info.token);
+      client.close().catch(() => {});
+    }
+  });
+  startReaper();
   const ipc2 = startIpcServer({
     localToken,
     tcpEnabled,
@@ -10845,6 +11419,12 @@ async function runDaemon(opts = {}) {
         await b.close();
       } catch {}
     }
+    for (const b of sessionBrokers.values()) {
+      try {
+        await b.close();
+      } catch {}
+    }
+    sessionBrokers.clear();
     await ipc2.close();
     try {
       outboxDb.close();
@@ -10864,7 +11444,9 @@ var init_run = __esm(() => {
   init_lock();
   init_local_token();
   init_server();
+  init_session_registry();
   init_broker();
+  init_session_broker();
   init_drain();
   init_inbound();
   init_identity();
@@ -10879,7 +11461,7 @@ __export(exports_service_install, {
   installService: () => installService,
   detectPlatform: () => detectPlatform
 });
-import { existsSync as existsSync11, mkdirSync as mkdirSync7, writeFileSync as writeFileSync10, unlinkSync as unlinkSync5, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync7, writeFileSync as writeFileSync11, unlinkSync as unlinkSync5, readFileSync as readFileSync11 } from "node:fs";
 import { execSync as execSync2 } from "node:child_process";
 import { homedir as homedir5 } from "node:os";
 import { join as join8, dirname as dirname5 } from "node:path";
@@ -10900,7 +11482,7 @@ function installService(args) {
   if (isCi() && !args.allowCi) {
     throw new Error("Refusing to install persistent service in CI; pass --allow-ci-persistent to override.");
   }
-  if (!existsSync11(args.binaryPath)) {
+  if (!existsSync12(args.binaryPath)) {
     throw new Error(`binary not found at ${args.binaryPath}`);
   }
   mkdirSync7(DAEMON_PATHS.DAEMON_DIR, { recursive: true, mode: 448 });
@@ -10916,7 +11498,7 @@ function uninstallService() {
     try {
       execSync2(`launchctl bootout gui/$(id -u)/${SERVICE_LABEL}`, { stdio: "ignore" });
     } catch {}
-    if (existsSync11(p)) {
+    if (existsSync12(p)) {
       unlinkSync5(p);
       removed.push(p);
     }
@@ -10925,7 +11507,7 @@ function uninstallService() {
     try {
       execSync2(`systemctl --user disable --now ${SYSTEMD_UNIT}`, { stdio: "ignore" });
     } catch {}
-    if (existsSync11(p)) {
+    if (existsSync12(p)) {
       unlinkSync5(p);
       removed.push(p);
     }
@@ -10978,7 +11560,7 @@ function installDarwin(args) {
 </dict>
 </plist>
 `;
-  writeFileSync10(plist, xml, { mode: 420 });
+  writeFileSync11(plist, xml, { mode: 420 });
   return {
     platform: "darwin",
     unitPath: plist,
@@ -11015,7 +11597,7 @@ Environment=PATH=/usr/local/bin:/usr/bin:/bin
 [Install]
 WantedBy=default.target
 `;
-  writeFileSync10(unit, content, { mode: 420 });
+  writeFileSync11(unit, content, { mode: 420 });
   return {
     platform: "linux",
     unitPath: unit,
@@ -11035,10 +11617,10 @@ function readInstalledUnit() {
   if (!platform5)
     return { platform: null, path: null, content: null };
   const path2 = platform5 === "darwin" ? darwinPlistPath() : linuxUnitPath();
-  if (!existsSync11(path2))
+  if (!existsSync12(path2))
     return { platform: platform5, path: null, content: null };
   try {
-    return { platform: platform5, path: path2, content: readFileSync10(path2, "utf8") };
+    return { platform: platform5, path: path2, content: readFileSync11(path2, "utf8") };
   } catch {
     return { platform: platform5, path: path2, content: null };
   }
@@ -11380,19 +11962,19 @@ __export(exports_install, {
 import {
   chmodSync as chmodSync4,
   copyFileSync,
-  existsSync as existsSync12,
+  existsSync as existsSync13,
   mkdirSync as mkdirSync8,
-  readFileSync as readFileSync11,
-  writeFileSync as writeFileSync11
+  readFileSync as readFileSync12,
+  writeFileSync as writeFileSync12
 } from "node:fs";
 import { homedir as homedir6, platform as platform5 } from "node:os";
 import { dirname as dirname6, join as join9, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync as spawnSync3 } from "node:child_process";
 function readClaudeConfig() {
-  if (!existsSync12(CLAUDE_CONFIG))
+  if (!existsSync13(CLAUDE_CONFIG))
     return {};
-  const text = readFileSync11(CLAUDE_CONFIG, "utf-8").trim();
+  const text = readFileSync12(CLAUDE_CONFIG, "utf-8").trim();
   if (!text)
     return {};
   try {
@@ -11402,7 +11984,7 @@ function readClaudeConfig() {
   }
 }
 function backupClaudeConfig() {
-  if (!existsSync12(CLAUDE_CONFIG))
+  if (!existsSync13(CLAUDE_CONFIG))
     return;
   const backupDir = join9(dirname6(CLAUDE_CONFIG), ".claude", "backups");
   mkdirSync8(backupDir, { recursive: true });
@@ -11431,7 +12013,7 @@ function patchMcpServer(entry) {
   return action;
 }
 function removeMcpServer() {
-  if (!existsSync12(CLAUDE_CONFIG))
+  if (!existsSync13(CLAUDE_CONFIG))
     return false;
   backupClaudeConfig();
   const cfg = readClaudeConfig();
@@ -11445,7 +12027,7 @@ function removeMcpServer() {
 }
 function flushClaudeConfig(obj) {
   mkdirSync8(dirname6(CLAUDE_CONFIG), { recursive: true });
-  writeFileSync11(CLAUDE_CONFIG, JSON.stringify(obj, null, 2) + `
+  writeFileSync12(CLAUDE_CONFIG, JSON.stringify(obj, null, 2) + `
 `, "utf-8");
   try {
     chmodSync4(CLAUDE_CONFIG, 384);
@@ -11468,7 +12050,7 @@ function resolveBundledSkillsDir() {
   const here = fileURLToPath(import.meta.url);
   const pkgRoot = resolve(dirname6(here), "..", "..");
   const skillsDir = join9(pkgRoot, "skills");
-  if (existsSync12(skillsDir))
+  if (existsSync13(skillsDir))
     return skillsDir;
   return null;
 }
@@ -11503,7 +12085,7 @@ function uninstallSkills() {
     if (!entry.isDirectory())
       continue;
     const dstDir = join9(CLAUDE_SKILLS_ROOT, entry.name);
-    if (existsSync12(dstDir)) {
+    if (existsSync13(dstDir)) {
       try {
         fs.rmSync(dstDir, { recursive: true, force: true });
         removed.push(entry.name);
@@ -11528,9 +12110,9 @@ function entriesEqual(a, b) {
   return a.command === b.command && JSON.stringify(a.args ?? []) === JSON.stringify(b.args ?? []);
 }
 function readClaudeSettings() {
-  if (!existsSync12(CLAUDE_SETTINGS))
+  if (!existsSync13(CLAUDE_SETTINGS))
     return {};
-  const text = readFileSync11(CLAUDE_SETTINGS, "utf-8").trim();
+  const text = readFileSync12(CLAUDE_SETTINGS, "utf-8").trim();
   if (!text)
     return {};
   try {
@@ -11541,7 +12123,7 @@ function readClaudeSettings() {
 }
 function writeClaudeSettings(obj) {
   mkdirSync8(dirname6(CLAUDE_SETTINGS), { recursive: true });
-  writeFileSync11(CLAUDE_SETTINGS, JSON.stringify(obj, null, 2) + `
+  writeFileSync12(CLAUDE_SETTINGS, JSON.stringify(obj, null, 2) + `
 `, "utf-8");
 }
 function installAllowedTools() {
@@ -11555,7 +12137,7 @@ function installAllowedTools() {
   return { added: toAdd, unchanged: CLAUDEMESH_TOOLS.length - toAdd.length };
 }
 function uninstallAllowedTools() {
-  if (!existsSync12(CLAUDE_SETTINGS))
+  if (!existsSync13(CLAUDE_SETTINGS))
     return 0;
   const settings = readClaudeSettings();
   const existing = settings.allowedTools ?? [];
@@ -11570,11 +12152,11 @@ function uninstallAllowedTools() {
 }
 function installHooks() {
   const settings = readClaudeSettings();
-  const hooks = (settings.hooks ??= {}) ?? {};
+  const hooks2 = (settings.hooks ??= {}) ?? {};
   let added = 0;
   let unchanged = 0;
   const ensure = (event, command) => {
-    const list = hooks[event] ??= [];
+    const list = hooks2[event] ??= [];
     const alreadyPresent = list.some((entry) => (entry.hooks ?? []).some((h) => h.command === command));
     if (alreadyPresent) {
       unchanged += 1;
@@ -11585,32 +12167,32 @@ function installHooks() {
   };
   ensure("Stop", HOOK_COMMAND_STOP);
   ensure("UserPromptSubmit", HOOK_COMMAND_USER_PROMPT);
-  settings.hooks = hooks;
+  settings.hooks = hooks2;
   writeClaudeSettings(settings);
   return { added, unchanged };
 }
 function uninstallHooks() {
-  if (!existsSync12(CLAUDE_SETTINGS))
+  if (!existsSync13(CLAUDE_SETTINGS))
     return 0;
   const settings = readClaudeSettings();
-  const hooks = settings.hooks;
-  if (!hooks)
+  const hooks2 = settings.hooks;
+  if (!hooks2)
     return 0;
   let removed = 0;
-  for (const event of Object.keys(hooks)) {
+  for (const event of Object.keys(hooks2)) {
     const kept = [];
-    for (const entry of hooks[event] ?? []) {
+    for (const entry of hooks2[event] ?? []) {
       const filtered = (entry.hooks ?? []).filter((h) => !(h.command ?? "").includes(HOOK_MARKER));
       removed += (entry.hooks ?? []).length - filtered.length;
       if (filtered.length > 0)
         kept.push({ ...entry, hooks: filtered });
     }
     if (kept.length === 0)
-      delete hooks[event];
+      delete hooks2[event];
     else
-      hooks[event] = kept;
+      hooks2[event] = kept;
   }
-  settings.hooks = hooks;
+  settings.hooks = hooks2;
   writeClaudeSettings(settings);
   return removed;
 }
@@ -11640,7 +12222,7 @@ function runInstall(args = []) {
     render.err("`bun` is not on PATH.", "Install Bun first: https://bun.com");
     process.exit(1);
   }
-  if (!existsSync12(entry)) {
+  if (!existsSync13(entry)) {
     render.err(`MCP entry not found at ${entry}`);
     process.exit(1);
   }
@@ -11885,7 +12467,7 @@ var exports_uninstall = {};
 __export(exports_uninstall, {
   uninstall: () => uninstall
 });
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync12, existsSync as existsSync13, rmSync as rmSync2, readdirSync as readdirSync2 } from "node:fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync13, existsSync as existsSync14, rmSync as rmSync2, readdirSync as readdirSync2 } from "node:fs";
 import { join as join10, dirname as dirname7 } from "node:path";
 import { homedir as homedir7 } from "node:os";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
@@ -11893,32 +12475,32 @@ function bundledSkillsDir() {
   const here = fileURLToPath2(import.meta.url);
   const pkgRoot = join10(dirname7(here), "..", "..");
   const skillsDir = join10(pkgRoot, "skills");
-  return existsSync13(skillsDir) ? skillsDir : null;
+  return existsSync14(skillsDir) ? skillsDir : null;
 }
 async function uninstall() {
   let removed = 0;
-  if (existsSync13(PATHS.CLAUDE_JSON)) {
+  if (existsSync14(PATHS.CLAUDE_JSON)) {
     try {
-      const raw = readFileSync12(PATHS.CLAUDE_JSON, "utf-8");
+      const raw = readFileSync13(PATHS.CLAUDE_JSON, "utf-8");
       const config = JSON.parse(raw);
       const servers = config.mcpServers;
       if (servers && "claudemesh" in servers) {
         delete servers.claudemesh;
-        writeFileSync12(PATHS.CLAUDE_JSON, JSON.stringify(config, null, 2) + `
+        writeFileSync13(PATHS.CLAUDE_JSON, JSON.stringify(config, null, 2) + `
 `, "utf-8");
         render.ok("removed MCP server", dim("~/.claude.json"));
         removed++;
       }
     } catch {}
   }
-  if (existsSync13(PATHS.CLAUDE_SETTINGS)) {
+  if (existsSync14(PATHS.CLAUDE_SETTINGS)) {
     try {
-      const raw = readFileSync12(PATHS.CLAUDE_SETTINGS, "utf-8");
+      const raw = readFileSync13(PATHS.CLAUDE_SETTINGS, "utf-8");
       const config = JSON.parse(raw);
-      const hooks = config.hooks;
-      if (hooks) {
+      const hooks2 = config.hooks;
+      if (hooks2) {
         let removedHooks = 0;
-        for (const [event, entries] of Object.entries(hooks)) {
+        for (const [event, entries] of Object.entries(hooks2)) {
           if (!Array.isArray(entries))
             continue;
           const filtered = entries.filter((h) => {
@@ -11928,13 +12510,13 @@ async function uninstall() {
           if (filtered.length < entries.length) {
             removedHooks += entries.length - filtered.length;
             if (filtered.length === 0)
-              delete hooks[event];
+              delete hooks2[event];
             else
-              hooks[event] = filtered;
+              hooks2[event] = filtered;
           }
         }
         if (removedHooks > 0) {
-          writeFileSync12(PATHS.CLAUDE_SETTINGS, JSON.stringify(config, null, 2) + `
+          writeFileSync13(PATHS.CLAUDE_SETTINGS, JSON.stringify(config, null, 2) + `
 `, "utf-8");
           render.ok(`removed ${removedHooks} claudemesh hook${removedHooks === 1 ? "" : "s"}`, dim("settings.json"));
           removed++;
@@ -11950,7 +12532,7 @@ async function uninstall() {
         if (!entry.isDirectory())
           continue;
         const dst = join10(CLAUDE_SKILLS_ROOT2, entry.name);
-        if (existsSync13(dst)) {
+        if (existsSync14(dst)) {
           try {
             rmSync2(dst, { recursive: true, force: true });
             removedSkills.push(entry.name);
@@ -11982,7 +12564,7 @@ var exports_doctor = {};
 __export(exports_doctor, {
   runDoctor: () => runDoctor
 });
-import { existsSync as existsSync14, readFileSync as readFileSync13, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync15, readFileSync as readFileSync14, statSync as statSync3 } from "node:fs";
 import { homedir as homedir8, platform as platform6 } from "node:os";
 import { join as join11 } from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
@@ -12009,7 +12591,7 @@ function checkClaudeOnPath() {
 }
 function checkMcpRegistered() {
   const claudeConfig = join11(homedir8(), ".claude.json");
-  if (!existsSync14(claudeConfig)) {
+  if (!existsSync15(claudeConfig)) {
     return {
       name: "claudemesh MCP registered in ~/.claude.json",
       pass: false,
@@ -12017,7 +12599,7 @@ function checkMcpRegistered() {
     };
   }
   try {
-    const cfg = JSON.parse(readFileSync13(claudeConfig, "utf-8"));
+    const cfg = JSON.parse(readFileSync14(claudeConfig, "utf-8"));
     const registered = Boolean(cfg.mcpServers?.["claudemesh"]);
     return {
       name: "claudemesh MCP registered in ~/.claude.json",
@@ -12035,7 +12617,7 @@ function checkMcpRegistered() {
 }
 function checkHooksRegistered() {
   const settings = join11(homedir8(), ".claude", "settings.json");
-  if (!existsSync14(settings)) {
+  if (!existsSync15(settings)) {
     return {
       name: "Status hooks registered in ~/.claude/settings.json",
       pass: false,
@@ -12043,7 +12625,7 @@ function checkHooksRegistered() {
     };
   }
   try {
-    const raw = readFileSync13(settings, "utf-8");
+    const raw = readFileSync14(settings, "utf-8");
     const has = raw.includes("claudemesh hook ");
     return {
       name: "Status hooks registered in ~/.claude/settings.json",
@@ -12060,7 +12642,7 @@ function checkHooksRegistered() {
 }
 function checkConfigFile() {
   const path2 = getConfigPath();
-  if (!existsSync14(path2)) {
+  if (!existsSync15(path2)) {
     return {
       name: "~/.claudemesh/config.json exists and parses",
       pass: true,
@@ -12132,8 +12714,8 @@ async function checkBrokerWs() {
   const wsUrl = URLS.BROKER;
   const start = Date.now();
   try {
-    const WebSocket3 = (await import("ws")).default;
-    const ws = new WebSocket3(wsUrl);
+    const WebSocket4 = (await import("ws")).default;
+    const ws = new WebSocket4(wsUrl);
     const result = await new Promise((resolve2) => {
       const timer = setTimeout(() => {
         try {
@@ -12243,12 +12825,12 @@ var exports_status = {};
 __export(exports_status, {
   runStatus: () => runStatus2
 });
-import { statSync as statSync4, existsSync as existsSync15 } from "node:fs";
-import WebSocket3 from "ws";
+import { statSync as statSync4, existsSync as existsSync16 } from "node:fs";
+import WebSocket4 from "ws";
 async function probeBroker(url, timeoutMs = 4000) {
   return new Promise((resolve2) => {
     const started = Date.now();
-    const ws = new WebSocket3(url);
+    const ws = new WebSocket4(url);
     const timer = setTimeout(() => {
       try {
         ws.terminate();
@@ -12273,7 +12855,7 @@ async function runStatus2() {
   render.section(`status (v${VERSION})`);
   const configPath = getConfigPath();
   let configPermsNote = "missing";
-  if (existsSync15(configPath)) {
+  if (existsSync16(configPath)) {
     const mode = (statSync4(configPath).mode & 511).toString(8).padStart(4, "0");
     configPermsNote = mode === "0600" ? `${mode}` : `${mode} — expected 0600`;
   }
@@ -12419,13 +13001,13 @@ var init_check_claude_binary = __esm(() => {
 });
 
 // src/services/health/check-mcp-registered.ts
-import { existsSync as existsSync16, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync17, readFileSync as readFileSync15 } from "node:fs";
 function checkMcpRegistered2() {
   try {
-    if (!existsSync16(PATHS.CLAUDE_JSON)) {
+    if (!existsSync17(PATHS.CLAUDE_JSON)) {
       return { name: "mcp-registered", ok: false, message: "~/.claude.json not found" };
     }
-    const raw = readFileSync14(PATHS.CLAUDE_JSON, "utf-8");
+    const raw = readFileSync15(PATHS.CLAUDE_JSON, "utf-8");
     const config = JSON.parse(raw);
     if (config.mcpServers && "claudemesh" in config.mcpServers) {
       return { name: "mcp-registered", ok: true, message: "MCP server registered" };
@@ -12440,13 +13022,13 @@ var init_check_mcp_registered = __esm(() => {
 });
 
 // src/services/health/check-hooks-registered.ts
-import { existsSync as existsSync17, readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync18, readFileSync as readFileSync16 } from "node:fs";
 function checkHooksRegistered2() {
   try {
-    if (!existsSync17(PATHS.CLAUDE_SETTINGS)) {
+    if (!existsSync18(PATHS.CLAUDE_SETTINGS)) {
       return { name: "hooks-registered", ok: false, message: "~/.claude/settings.json not found" };
     }
-    const raw = readFileSync15(PATHS.CLAUDE_SETTINGS, "utf-8");
+    const raw = readFileSync16(PATHS.CLAUDE_SETTINGS, "utf-8");
     const config = JSON.parse(raw);
     if (config.hooks) {
       return { name: "hooks-registered", ok: true, message: "Hooks configured" };
@@ -12461,10 +13043,10 @@ var init_check_hooks_registered = __esm(() => {
 });
 
 // src/services/health/check-config-perms.ts
-import { existsSync as existsSync18, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync19, statSync as statSync5 } from "node:fs";
 function checkConfigPerms() {
   const configFile = PATHS.CONFIG_FILE;
-  if (!existsSync18(configFile)) {
+  if (!existsSync19(configFile)) {
     return { name: "config-perms", ok: true, message: "No config file yet (first run)" };
   }
   try {
@@ -12482,13 +13064,13 @@ var init_check_config_perms = __esm(() => {
 });
 
 // src/services/health/check-keypairs-valid.ts
-import { existsSync as existsSync19, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync20, readFileSync as readFileSync17 } from "node:fs";
 function checkKeypairsValid() {
-  if (!existsSync19(PATHS.CONFIG_FILE)) {
+  if (!existsSync20(PATHS.CONFIG_FILE)) {
     return { name: "keypairs-valid", ok: true, message: "No config (first run)" };
   }
   try {
-    const raw = readFileSync16(PATHS.CONFIG_FILE, "utf-8");
+    const raw = readFileSync17(PATHS.CONFIG_FILE, "utf-8");
     const config = JSON.parse(raw);
     const meshes = config.meshes ?? [];
     if (meshes.length === 0) {
@@ -12969,7 +13551,7 @@ __export(exports_url_handler, {
   runUrlHandler: () => runUrlHandler
 });
 import { platform as platform7, homedir as homedir9 } from "node:os";
-import { existsSync as existsSync20, mkdirSync as mkdirSync9, writeFileSync as writeFileSync13, rmSync as rmSync3, chmodSync as chmodSync5 } from "node:fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync9, writeFileSync as writeFileSync14, rmSync as rmSync3, chmodSync as chmodSync5 } from "node:fs";
 import { join as join12 } from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function resolveClaudemeshBin() {
@@ -13003,7 +13585,7 @@ function installDarwin2() {
   </array>
 </dict>
 </plist>`;
-  writeFileSync13(join12(contents, "Info.plist"), plist);
+  writeFileSync14(join12(contents, "Info.plist"), plist);
   const shim = `#!/bin/sh
 URL="$1"
 CODE=\${URL#claudemesh://}
@@ -13018,7 +13600,7 @@ end tell
 EOF
 `;
   const shimPath = join12(macOS, "open-url");
-  writeFileSync13(shimPath, shim);
+  writeFileSync14(shimPath, shim);
   chmodSync5(shimPath, 493);
   const lsreg = spawnSync5("/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister", ["-f", appDir], { encoding: "utf-8" });
   if (lsreg.status !== 0) {
@@ -13042,7 +13624,7 @@ MimeType=x-scheme-handler/claudemesh;
 NoDisplay=true
 `;
   const desktopPath = join12(appsDir, "claudemesh.desktop");
-  writeFileSync13(desktopPath, desktop);
+  writeFileSync14(desktopPath, desktop);
   const xdg1 = spawnSync5("xdg-mime", ["default", "claudemesh.desktop", "x-scheme-handler/claudemesh"], { encoding: "utf-8" });
   if (xdg1.status !== 0) {
     render.warn("xdg-mime not available — skipped mime default registration");
@@ -13065,7 +13647,7 @@ function installWindows() {
     `@="\\"${binPath.replace(/\\/g, "\\\\")}\\" \\"%1\\""`
   ];
   const regPath = join12(homedir9(), "claudemesh-handler.reg");
-  writeFileSync13(regPath, lines.join(`\r
+  writeFileSync14(regPath, lines.join(`\r
 `));
   const res = spawnSync5("reg.exe", ["import", regPath], { encoding: "utf-8" });
   if (res.status !== 0) {
@@ -13077,14 +13659,14 @@ function installWindows() {
 }
 function uninstallDarwin() {
   const appDir = join12(homedir9(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
-  if (existsSync20(appDir))
+  if (existsSync21(appDir))
     rmSync3(appDir, { recursive: true, force: true });
   render.ok("removed claudemesh:// handler on macOS");
   return EXIT.SUCCESS;
 }
 function uninstallLinux() {
   const desktopPath = join12(homedir9(), ".local", "share", "applications", "claudemesh.desktop");
-  if (existsSync20(desktopPath))
+  if (existsSync21(desktopPath))
     rmSync3(desktopPath, { force: true });
   render.ok("removed claudemesh:// handler on Linux");
   return EXIT.SUCCESS;
@@ -13129,7 +13711,7 @@ var exports_status_line = {};
 __export(exports_status_line, {
   runStatusLine: () => runStatusLine
 });
-import { existsSync as existsSync21, readFileSync as readFileSync17 } from "node:fs";
+import { existsSync as existsSync22, readFileSync as readFileSync18 } from "node:fs";
 import { join as join13 } from "node:path";
 import { homedir as homedir10 } from "node:os";
 async function runStatusLine() {
@@ -13141,9 +13723,9 @@ async function runStatusLine() {
     }
     const cachePath = join13(homedir10(), ".claudemesh", "peer-cache.json");
     let cache = {};
-    if (existsSync21(cachePath)) {
+    if (existsSync22(cachePath)) {
       try {
-        cache = JSON.parse(readFileSync17(cachePath, "utf-8"));
+        cache = JSON.parse(readFileSync18(cachePath, "utf-8"));
       } catch {}
     }
     const pick = config.meshes[0];
@@ -13174,7 +13756,7 @@ __export(exports_backup, {
   runRestore: () => runRestore,
   runBackup: () => runBackup
 });
-import { readFileSync as readFileSync18, writeFileSync as writeFileSync14, existsSync as existsSync22 } from "node:fs";
+import { readFileSync as readFileSync19, writeFileSync as writeFileSync15, existsSync as existsSync23 } from "node:fs";
 import { createInterface as createInterface11 } from "node:readline";
 function readHidden(prompt5) {
   return new Promise((resolve2) => {
@@ -13216,11 +13798,11 @@ async function deriveKey(pass, salt, s) {
 }
 async function runBackup(outPath) {
   const configPath = getConfigPath();
-  if (!existsSync22(configPath)) {
+  if (!existsSync23(configPath)) {
     console.error("  No config found — nothing to back up. Join a mesh first.");
     return EXIT.NOT_FOUND;
   }
-  const plaintext = readFileSync18(configPath);
+  const plaintext = readFileSync19(configPath);
   const pass = await readHidden("  Passphrase (min 12 chars): ");
   if (pass.length < 12) {
     console.error("  ✗ Passphrase too short.");
@@ -13238,7 +13820,7 @@ async function runBackup(outPath) {
   const ciphertext = Buffer.from(s.crypto_aead_xchacha20poly1305_ietf_encrypt(plaintext, null, null, nonce, key));
   const blob = Buffer.concat([MAGIC, salt, nonce, ciphertext]);
   const file = outPath ?? `claudemesh-backup-${new Date().toISOString().replace(/[:.]/g, "-")}.cmb`;
-  writeFileSync14(file, blob, { mode: 384 });
+  writeFileSync15(file, blob, { mode: 384 });
   console.log(`
   ✓ Backup saved: ${file}`);
   console.log(`  Size: ${blob.length} bytes. Guard the passphrase — there is no recovery.
@@ -13250,11 +13832,11 @@ async function runRestore(inPath) {
     console.error("  Usage: claudemesh restore <backup-file>");
     return EXIT.INVALID_ARGS;
   }
-  if (!existsSync22(inPath)) {
+  if (!existsSync23(inPath)) {
     console.error(`  ✗ File not found: ${inPath}`);
     return EXIT.NOT_FOUND;
   }
-  const blob = readFileSync18(inPath);
+  const blob = readFileSync19(inPath);
   if (blob.length < 4 + 16 + 24 + 17 || !blob.subarray(0, 4).equals(MAGIC)) {
     console.error("  ✗ Not a claudemesh backup file (bad magic).");
     return EXIT.INVALID_ARGS;
@@ -13273,12 +13855,12 @@ async function runRestore(inPath) {
     return EXIT.INTERNAL_ERROR;
   }
   const configPath = getConfigPath();
-  if (existsSync22(configPath)) {
+  if (existsSync23(configPath)) {
     const backupOld = `${configPath}.before-restore.${Date.now()}`;
-    writeFileSync14(backupOld, readFileSync18(configPath), { mode: 384 });
+    writeFileSync15(backupOld, readFileSync19(configPath), { mode: 384 });
     console.log(`  ↻ Existing config saved to ${backupOld}`);
   }
-  writeFileSync14(configPath, Buffer.from(plaintext), { mode: 384 });
+  writeFileSync15(configPath, Buffer.from(plaintext), { mode: 384 });
   console.log(`
   ✓ Config restored to ${configPath}`);
   console.log("  Run `claudemesh list` to verify your meshes.\n");
@@ -13298,7 +13880,7 @@ __export(exports_upgrade, {
   runUpgrade: () => runUpgrade
 });
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync23 } from "node:fs";
+import { existsSync as existsSync24 } from "node:fs";
 import { dirname as dirname8, join as join14, resolve as resolve2 } from "node:path";
 async function latestVersion() {
   try {
@@ -13313,14 +13895,14 @@ async function latestVersion() {
 }
 function findNpm() {
   const portable = join14(process.env.HOME ?? "", ".claudemesh", "node", "bin", "npm");
-  if (existsSync23(portable)) {
+  if (existsSync24(portable)) {
     return { npm: portable, prefix: join14(process.env.HOME ?? "", ".claudemesh") };
   }
   let cur = resolve2(process.argv[1] ?? ".");
   for (let i = 0;i < 6; i++) {
     cur = dirname8(cur);
     const candidate = join14(cur, "bin", "npm");
-    if (existsSync23(candidate))
+    if (existsSync24(candidate))
       return { npm: candidate };
   }
   return { npm: "npm" };
@@ -13382,7 +13964,7 @@ __export(exports_grants, {
   runBlock: () => runBlock,
   isAllowed: () => isAllowed
 });
-import { existsSync as existsSync24, mkdirSync as mkdirSync10, readFileSync as readFileSync19, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync10, readFileSync as readFileSync20, writeFileSync as writeFileSync16 } from "node:fs";
 import { homedir as homedir11 } from "node:os";
 import { join as join15 } from "node:path";
 async function syncToBroker(meshSlug, grants) {
@@ -13402,19 +13984,19 @@ async function syncToBroker(meshSlug, grants) {
   }
 }
 function readGrants() {
-  if (!existsSync24(GRANT_FILE))
+  if (!existsSync25(GRANT_FILE))
     return {};
   try {
-    return JSON.parse(readFileSync19(GRANT_FILE, "utf-8"));
+    return JSON.parse(readFileSync20(GRANT_FILE, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeGrants(g) {
   const dir = join15(homedir11(), ".claudemesh");
-  if (!existsSync24(dir))
+  if (!existsSync25(dir))
     mkdirSync10(dir, { recursive: true });
-  writeFileSync15(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
+  writeFileSync16(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
 }
 function resolveCaps(input) {
   if (input.includes("all"))
@@ -14269,17 +14851,17 @@ async function runUnwatch(id, opts) {
 }
 async function runWebhookList(opts) {
   return await withMesh({ meshSlug: opts.mesh ?? null }, async (client) => {
-    const hooks = await client.listWebhooks();
+    const hooks2 = await client.listWebhooks();
     if (opts.json) {
-      emitJson(hooks);
+      emitJson(hooks2);
       return EXIT.SUCCESS;
     }
-    if (hooks.length === 0) {
+    if (hooks2.length === 0) {
       render.info(dim("(no webhooks)"));
       return EXIT.SUCCESS;
     }
-    render.section(`webhooks (${hooks.length})`);
-    for (const h of hooks) {
+    render.section(`webhooks (${hooks2.length})`);
+    for (const h of hooks2) {
       const dot = h.active ? "●" : dim("○");
       process.stdout.write(`  ${dot} ${bold(h.name)} ${dim("· " + h.url)}
 `);
@@ -15250,9 +15832,9 @@ __export(exports_file, {
   runFileShare: () => runFileShare,
   runFileGet: () => runFileGet
 });
-import { hostname as osHostname } from "node:os";
+import { hostname as osHostname2 } from "node:os";
 import { resolve as resolvePath, basename, dirname as dirname9 } from "node:path";
-import { statSync as statSync7, existsSync as existsSync25, writeFileSync as writeFileSync16, mkdirSync as mkdirSync11 } from "node:fs";
+import { statSync as statSync7, existsSync as existsSync26, writeFileSync as writeFileSync17, mkdirSync as mkdirSync11 } from "node:fs";
 function emitJson2(data) {
   console.log(JSON.stringify(data, null, 2));
 }
@@ -15269,7 +15851,7 @@ async function runFileShare(filePath, opts) {
     return EXIT.INVALID_ARGS;
   }
   const absPath = resolvePath(filePath);
-  if (!existsSync25(absPath)) {
+  if (!existsSync26(absPath)) {
     render.err(`File not found: ${absPath}`);
     return EXIT.INVALID_ARGS;
   }
@@ -15282,7 +15864,7 @@ async function runFileShare(filePath, opts) {
   return await withMesh({ meshSlug: opts.mesh ?? null }, async (client, mesh) => {
     if (opts.to && !opts.upload) {
       const peers = await client.listPeers();
-      const myHost = osHostname();
+      const myHost = osHostname2();
       const target = peers.find((p) => {
         if (!p.hostname || p.hostname !== myHost)
           return false;
@@ -15349,7 +15931,7 @@ async function runFileGet(fileId, opts) {
     const buf = Buffer.from(await res.arrayBuffer());
     const outPath = opts.out ? resolvePath(opts.out) : resolvePath(process.cwd(), meta.name);
     mkdirSync11(dirname9(outPath), { recursive: true });
-    writeFileSync16(outPath, buf);
+    writeFileSync17(outPath, buf);
     if (opts.json) {
       emitJson2({ fileId, name: meta.name, savedTo: outPath, sizeBytes: buf.length });
     } else {
@@ -15444,7 +16026,7 @@ var require_client = __commonJS((exports) => {
   var ws_1 = __importDefault(__require("ws"));
   var crypto_js_1 = require_crypto();
   var MAX_QUEUED2 = 100;
-  var HELLO_ACK_TIMEOUT_MS3 = 5000;
+  var HELLO_ACK_TIMEOUT_MS4 = 5000;
   var BACKOFF_CAPS2 = [1000, 2000, 4000, 8000, 16000, 30000];
 
   class MeshClient extends node_events_1.EventEmitter {
@@ -15509,7 +16091,7 @@ var require_client = __commonJS((exports) => {
             this.debug("hello_ack timeout");
             ws.close();
             reject(new Error("hello_ack timeout"));
-          }, HELLO_ACK_TIMEOUT_MS3);
+          }, HELLO_ACK_TIMEOUT_MS4);
         };
         const onMessage = (raw) => {
           let msg;
@@ -15959,7 +16541,7 @@ __export(exports_bridge, {
   runBridge: () => runBridge,
   bridgeConfigTemplate: () => bridgeConfigTemplate
 });
-import { readFileSync as readFileSync20, existsSync as existsSync26 } from "node:fs";
+import { readFileSync as readFileSync21, existsSync as existsSync27 } from "node:fs";
 function parseConfig(text) {
   const trimmed = text.trim();
   if (trimmed.startsWith("{"))
@@ -16003,13 +16585,13 @@ async function runBridge(configPath) {
     render.err("Usage: claudemesh bridge run <config.yaml>");
     return EXIT.INVALID_ARGS;
   }
-  if (!existsSync26(configPath)) {
+  if (!existsSync27(configPath)) {
     render.err(`config file not found: ${configPath}`);
     return EXIT.NOT_FOUND;
   }
   let cfg;
   try {
-    cfg = parseConfig(readFileSync20(configPath, "utf-8"));
+    cfg = parseConfig(readFileSync21(configPath, "utf-8"));
   } catch (e) {
     render.err(`failed to parse ${configPath}: ${e instanceof Error ? e.message : String(e)}`);
     return EXIT.INVALID_ARGS;
@@ -16413,9 +16995,9 @@ function cacheKey(apiKeySecret, topicName) {
 async function getTopicKey(args) {
   const cacheId = cacheKey(args.apiKeySecret, args.topicName);
   if (!args.fresh) {
-    const cached2 = cache.get(cacheId);
-    if (cached2)
-      return { ok: true, topicKey: cached2.topicKey };
+    const cached3 = cache.get(cacheId);
+    if (cached3)
+      return { ok: true, topicKey: cached3.topicKey };
   }
   let sealed;
   try {
@@ -16983,11 +17565,11 @@ import {
   ListResourcesRequestSchema,
   ReadResourceRequestSchema
 } from "@modelcontextprotocol/sdk/types.js";
-import { existsSync as existsSync27 } from "node:fs";
+import { existsSync as existsSync28 } from "node:fs";
 import { request as httpRequest2 } from "node:http";
 async function daemonReady() {
   for (let i = 0;i < DAEMON_BOOT_RETRIES; i++) {
-    if (existsSync27(DAEMON_PATHS.SOCK_FILE))
+    if (existsSync28(DAEMON_PATHS.SOCK_FILE))
       return true;
     await new Promise((r) => setTimeout(r, DAEMON_BOOT_RETRY_MS));
   }
@@ -17317,9 +17899,9 @@ async function startServiceProxy(serviceName) {
     const fetched = await client.getServiceTools(serviceName);
     tools = fetched;
   } catch {
-    const cached2 = client.serviceCatalog.find((s) => s.name === serviceName);
-    if (cached2)
-      tools = cached2.tools;
+    const cached3 = client.serviceCatalog.find((s) => s.name === serviceName);
+    if (cached3)
+      tools = cached3.tools;
   }
   if (tools.length === 0) {
     process.stderr.write(`[mesh:${serviceName}] no tools found — service may not be running
@@ -19289,4 +19871,4 @@ main().catch((err) => {
   process.exit(EXIT.INTERNAL_ERROR);
 });
 
-//# debugId=04E4A5313AE4F0EA64756E2164756E21
+//# debugId=A7687DD2912DA01C64756E2164756E21