claudemesh-cli 1.32.1 → 1.34.0

package/dist/entrypoints/cli.js

@@ -104,7 +104,7 @@ __export(exports_urls, {
   VERSION: () => VERSION,
   URLS: () => URLS
 });
-var URLS, VERSION = "1.32.1", env;
+var URLS, VERSION = "1.34.0", env;
 var init_urls = __esm(() => {
   URLS = {
     BROKER: process.env.CLAUDEMESH_BROKER_URL ?? "wss://ic.claudemesh.com/ws",
@@ -4019,6 +4019,7 @@ __export(exports_daemon_route, {
   tryListStateViaDaemon: () => tryListStateViaDaemon,
   tryListSkillsViaDaemon: () => tryListSkillsViaDaemon,
   tryListPeersViaDaemon: () => tryListPeersViaDaemon,
+  tryListInboxViaDaemon: () => tryListInboxViaDaemon,
   tryGetStateViaDaemon: () => tryGetStateViaDaemon,
   tryGetSkillViaDaemon: () => tryGetSkillViaDaemon,
   tryForgetViaDaemon: () => tryForgetViaDaemon
@@ -4049,6 +4050,22 @@ async function tryListPeersViaDaemon(mesh) {
     return null;
   }
 }
+async function tryListInboxViaDaemon(mesh, limit = 100) {
+  if (!await daemonReachable())
+    return null;
+  try {
+    const path = `/v1/inbox${meshQuery(mesh)}${meshQuery(mesh) ? "&" : "?"}limit=${limit}`;
+    const res = await ipc({ path, timeoutMs: 3000 });
+    if (res.status !== 200)
+      return null;
+    return Array.isArray(res.body.items) ? res.body.items : [];
+  } catch (err) {
+    const msg = String(err);
+    if (/ENOENT|ECONNREFUSED|ipc_timeout/.test(msg))
+      return null;
+    return null;
+  }
+}
 async function tryListSkillsViaDaemon(mesh) {
   if (!await daemonReachable())
     return null;
@@ -7948,8 +7965,15 @@ async function listPeersForMesh(slug) {
 function annotateSelf(peer, selfMemberPubkey, selfSessionPubkey) {
   const isSelf = !!(selfMemberPubkey && peer.memberPubkey && peer.memberPubkey === selfMemberPubkey);
   const isThisSession = !!(isSelf && selfSessionPubkey && peer.pubkey === selfSessionPubkey);
-  const role = peer.profile?.role?.trim() || undefined;
-  return { ...peer, ...role ? { role } : {}, isSelf, isThisSession };
+  const peerRole = peer.peerRole ?? "session";
+  const profileRole = peer.profile?.role?.trim() || undefined;
+  return {
+    ...peer,
+    ...profileRole ? { role: profileRole } : {},
+    peerRole,
+    isSelf,
+    isThisSession
+  };
 }
 async function runPeers(flags) {
   const config = readConfig();
@@ -7977,13 +8001,13 @@ async function runPeers(flags) {
         allJson.push({ mesh: slug, peers: projected });
         continue;
       }
-      const visible = flags.all ? peers : peers.filter((p) => p.channel !== "claudemesh-daemon");
+      const visible = flags.all ? peers : peers.filter((p) => p.peerRole !== "control-plane");
       const sorted = visible.slice().sort((a, b) => {
         const score = (p) => p.isThisSession ? 0 : p.isSelf ? 1 : 2;
         return score(a) - score(b);
       });
-      const hiddenDaemons = peers.length - visible.length;
-      const header = hiddenDaemons > 0 ? `peers on ${slug} (${sorted.length}, ${hiddenDaemons} daemon hidden — use --all)` : `peers on ${slug} (${sorted.length})`;
+      const hiddenControlPlane = peers.length - visible.length;
+      const header = hiddenControlPlane > 0 ? `peers on ${slug} (${sorted.length}, ${hiddenControlPlane} control-plane hidden — use --all)` : `peers on ${slug} (${sorted.length})`;
       render.section(header);
       if (sorted.length === 0) {
         render.info(dim("  (no peers connected)"));
@@ -8220,38 +8244,47 @@ var exports_inbox = {};
 __export(exports_inbox, {
   runInbox: () => runInbox
 });
-function formatMessage(msg) {
-  const text = msg.plaintext ?? `[encrypted: ${msg.ciphertext.slice(0, 32)}…]`;
-  const from = msg.senderPubkey.slice(0, 8);
-  const time = new Date(msg.createdAt).toLocaleTimeString();
-  const kindTag = msg.kind === "direct" ? "→ direct" : msg.kind;
-  return `  ${bold(from)} ${dim(`[${kindTag}] ${time}`)}
+function formatMessage(msg, includeMesh) {
+  const text = msg.body ?? "[encrypted]";
+  const from = msg.sender_name && msg.sender_name !== msg.sender_pubkey.slice(0, 8) ? `${msg.sender_name} (${msg.sender_pubkey.slice(0, 8)})` : msg.sender_pubkey.slice(0, 8);
+  const time = new Date(msg.received_at).toLocaleTimeString();
+  const topicTag = msg.topic ? ` (#${msg.topic})` : "";
+  const meshTag = includeMesh ? ` [${msg.mesh}]` : "";
+  return `  ${bold(from)} ${dim(`${meshTag}${topicTag} ${time}`)}
   ${text}`;
 }
 async function runInbox(flags) {
-  const waitMs = (flags.wait ?? 1) * 1000;
-  await withMesh({ meshSlug: flags.mesh ?? null }, async (client, mesh) => {
-    await new Promise((resolve) => setTimeout(resolve, waitMs));
-    const messages = client.drainPushBuffer();
+  const meshSlug = flags.mesh;
+  const items = await tryListInboxViaDaemon(meshSlug, flags.limit ?? 100);
+  if (items === null) {
     if (flags.json) {
-      process.stdout.write(JSON.stringify(messages, null, 2) + `
+      process.stdout.write(`[]
 `);
       return;
     }
-    if (messages.length === 0) {
-      render.info(dim(`No messages on mesh "${mesh.slug}".`));
-      return;
-    }
-    render.section(`inbox — ${mesh.slug} (${messages.length} message${messages.length === 1 ? "" : "s"})`);
-    for (const msg of messages) {
-      process.stdout.write(formatMessage(msg) + `
+    render.info(dim("Daemon not reachable. Run `claudemesh daemon up` and retry."));
+    return;
+  }
+  if (flags.json) {
+    process.stdout.write(JSON.stringify(items, null, 2) + `
+`);
+    return;
+  }
+  if (items.length === 0) {
+    const scope = meshSlug ? `mesh "${meshSlug}"` : "any mesh";
+    render.info(dim(`No messages on ${scope}.`));
+    return;
+  }
+  const heading = meshSlug ? `inbox — ${meshSlug} (${items.length} message${items.length === 1 ? "" : "s"})` : `inbox (${items.length} message${items.length === 1 ? "" : "s"})`;
+  render.section(heading);
+  for (const msg of items) {
+    process.stdout.write(formatMessage(msg, !meshSlug) + `
 
 `);
-    }
-  });
+  }
 }
 var init_inbox = __esm(() => {
-  init_connect();
+  init_daemon_route();
   init_render();
   init_styles();
 });
@@ -9142,6 +9175,9 @@ function migrateOutbox(db) {
     db.exec(`ALTER TABLE outbox ADD COLUMN ciphertext TEXT`);
   if (!hasPriority)
     db.exec(`ALTER TABLE outbox ADD COLUMN priority TEXT`);
+  const hasSenderSessionPk = columnExists(db, "outbox", "sender_session_pubkey");
+  if (!hasSenderSessionPk)
+    db.exec(`ALTER TABLE outbox ADD COLUMN sender_session_pubkey TEXT`);
 }
 function columnExists(db, table, column) {
   const rows = db.prepare(`PRAGMA table_info(${table})`).all();
@@ -9152,7 +9188,8 @@ function findByClientId(db, clientMessageId) {
     SELECT id, client_message_id, request_fingerprint, payload, enqueued_at,
            attempts, next_attempt_at, status, last_error, delivered_at,
            broker_message_id, aborted_at, aborted_by, superseded_by,
-           mesh, target_spec, nonce, ciphertext, priority
+           mesh, target_spec, nonce, ciphertext, priority,
+           sender_session_pubkey
       FROM outbox WHERE client_message_id = ?
   `).get(clientMessageId);
   return row ?? null;
@@ -9162,9 +9199,10 @@ function insertPending(db, input) {
     INSERT INTO outbox (
       id, client_message_id, request_fingerprint, payload,
       enqueued_at, attempts, next_attempt_at, status,
-      mesh, target_spec, nonce, ciphertext, priority
-    ) VALUES (?, ?, ?, ?, ?, 0, ?, 'pending', ?, ?, ?, ?, ?)
-  `).run(input.id, input.client_message_id, input.request_fingerprint, input.payload, input.now, input.now, input.mesh ?? null, input.target_spec ?? null, input.nonce ?? null, input.ciphertext ?? null, input.priority ?? null);
+      mesh, target_spec, nonce, ciphertext, priority,
+      sender_session_pubkey
+    ) VALUES (?, ?, ?, ?, ?, 0, ?, 'pending', ?, ?, ?, ?, ?, ?)
+  `).run(input.id, input.client_message_id, input.request_fingerprint, input.payload, input.now, input.now, input.mesh ?? null, input.target_spec ?? null, input.nonce ?? null, input.ciphertext ?? null, input.priority ?? null, input.sender_session_pubkey ?? null);
 }
 function fingerprintsEqual(a, b) {
   if (a.length !== b.length)
@@ -9185,7 +9223,8 @@ function listOutbox(db, p = {}) {
     SELECT id, client_message_id, request_fingerprint, payload, enqueued_at,
            attempts, next_attempt_at, status, last_error, delivered_at,
            broker_message_id, aborted_at, aborted_by, superseded_by,
-           mesh, target_spec, nonce, ciphertext, priority
+           mesh, target_spec, nonce, ciphertext, priority,
+           sender_session_pubkey
       FROM outbox
      ${where.length ? "WHERE " + where.join(" AND ") : ""}
      ORDER BY enqueued_at DESC
@@ -9199,7 +9238,8 @@ function findById(db, id) {
     SELECT id, client_message_id, request_fingerprint, payload, enqueued_at,
            attempts, next_attempt_at, status, last_error, delivered_at,
            broker_message_id, aborted_at, aborted_by, superseded_by,
-           mesh, target_spec, nonce, ciphertext, priority
+           mesh, target_spec, nonce, ciphertext, priority,
+           sender_session_pubkey
       FROM outbox WHERE id = ?
   `).get(id) ?? null;
 }
@@ -9347,7 +9387,8 @@ function acceptSend(req, deps) {
         target_spec: req.target_spec,
         nonce: req.nonce,
         ciphertext: req.ciphertext,
-        priority: req.priority
+        priority: req.priority,
+        sender_session_pubkey: req.sender_session_pubkey
       });
       return { kind: "accepted_pending", status: 202, client_message_id: clientId };
     }
@@ -9446,6 +9487,10 @@ function listInbox(db, p) {
     where.push("sender_pubkey = ?");
     args.push(p.fromPubkey);
   }
+  if (p.mesh !== undefined) {
+    where.push("mesh = ?");
+    args.push(p.mesh);
+  }
   const sql = `
     SELECT id, client_message_id, broker_message_id, mesh, topic,
            sender_pubkey, sender_name, body, meta, received_at, reply_to_id
@@ -10197,10 +10242,12 @@ function makeHandler(opts) {
       const fromPubkey = url.searchParams.get("from") ?? undefined;
       const limitRaw = url.searchParams.get("limit");
       const limit = limitRaw ? Number.parseInt(limitRaw, 10) : undefined;
+      const meshFilter = meshFromCtx(url.searchParams.get("mesh")) ?? undefined;
       const rows = listInbox(opts.inboxDb, {
         since: Number.isFinite(since) ? since : undefined,
         topic,
         fromPubkey,
+        ...meshFilter ? { mesh: meshFilter } : {},
         limit: Number.isFinite(limit ?? NaN) ? limit : undefined
       });
       respond(res, 200, {
@@ -10317,12 +10364,17 @@ function makeHandler(opts) {
             respond(res, 404, { error: "mesh_not_attached", mesh: chosenSlug });
             return;
           }
+          const senderSessionPubkey = session?.presence?.sessionPubkey;
+          const senderSecretKey = session?.presence?.sessionSecretKey ?? meshCfg.secretKey;
           try {
-            const routed = await resolveAndEncrypt(parsed.req, broker, meshCfg.secretKey, chosenSlug);
+            const routed = await resolveAndEncrypt(parsed.req, broker, senderSecretKey, chosenSlug);
             parsed.req.target_spec = routed.target_spec;
             parsed.req.ciphertext = routed.ciphertext;
             parsed.req.nonce = routed.nonce;
             parsed.req.mesh = routed.mesh;
+            if (senderSessionPubkey) {
+              parsed.req.sender_session_pubkey = senderSessionPubkey;
+            }
           } catch (e) {
             respond(res, 502, { error: "route_failed", detail: String(e) });
             return;
@@ -10450,9 +10502,7 @@ async function resolveAndEncrypt(req, broker, meshSecretKey, meshSlug) {
     return { target_spec: to, ciphertext, nonce, mesh: meshSlug ?? "" };
   }
   if (/^[0-9a-f]{64}$/i.test(to)) {
-    const sessionKeys2 = broker.getSessionKeys();
-    const senderSecret2 = sessionKeys2?.sessionSecretKey ?? meshSecretKey;
-    const env3 = await encryptDirect2(req.message, to, senderSecret2);
+    const env3 = await encryptDirect2(req.message, to, meshSecretKey);
     return { target_spec: to, ciphertext: env3.ciphertext, nonce: env3.nonce, mesh: meshSlug ?? "" };
   }
   const peers = await broker.listPeers().catch(() => []);
@@ -10463,18 +10513,14 @@ async function resolveAndEncrypt(req, broker, meshSecretKey, meshSlug) {
     if (matches2.length > 1)
       throw new Error(`prefix "${to}" is ambiguous (${matches2.length} matches)`);
     const recipient2 = matches2[0].pubkey;
-    const sessionKeys2 = broker.getSessionKeys();
-    const senderSecret2 = sessionKeys2?.sessionSecretKey ?? meshSecretKey;
-    const env3 = await encryptDirect2(req.message, recipient2, senderSecret2);
+    const env3 = await encryptDirect2(req.message, recipient2, meshSecretKey);
     return { target_spec: recipient2, ciphertext: env3.ciphertext, nonce: env3.nonce, mesh: meshSlug ?? "" };
   }
   const match = peers.find((p) => p.displayName.toLowerCase() === to.toLowerCase());
   if (!match)
     throw new Error(`peer "${to}" not found`);
   const recipient = match.pubkey;
-  const sessionKeys = broker.getSessionKeys();
-  const senderSecret = sessionKeys?.sessionSecretKey ?? meshSecretKey;
-  const env2 = await encryptDirect2(req.message, recipient, senderSecret);
+  const env2 = await encryptDirect2(req.message, recipient, meshSecretKey);
   return { target_spec: recipient, ciphertext: env2.ciphertext, nonce: env2.nonce, mesh: meshSlug ?? "" };
 }
 function respond(res, status, body) {
@@ -10491,18 +10537,149 @@ var init_server = __esm(() => {
   init_urls();
 });
 
-// src/daemon/broker.ts
+// src/daemon/ws-lifecycle.ts
 import WebSocket2 from "ws";
+function connectWsWithBackoff(opts) {
+  const helloAckTimeoutMs = opts.helloAckTimeoutMs ?? DEFAULT_HELLO_ACK_TIMEOUT_MS;
+  const backoffCapsMs = opts.backoffCapsMs ?? DEFAULT_BACKOFF_CAPS_MS;
+  const log2 = opts.log ?? defaultLog;
+  let ws = null;
+  let status = "closed";
+  let closed = false;
+  let reconnectAttempt = 0;
+  let reconnectTimer = null;
+  let helloTimer = null;
+  const setStatus = (s) => {
+    if (status === s)
+      return;
+    status = s;
+    opts.onStatusChange?.(s);
+  };
+  const openOnce = () => {
+    if (closed)
+      return Promise.reject(new Error("client_closed"));
+    setStatus("connecting");
+    log2("info", "ws_open_attempt", { url: opts.url });
+    const sock = new WebSocket2(opts.url);
+    ws = sock;
+    return new Promise((resolve, reject) => {
+      sock.on("open", () => {
+        log2("info", "ws_open_ok", { url: opts.url });
+        (async () => {
+          try {
+            const hello = await opts.buildHello();
+            sock.send(JSON.stringify(hello));
+            log2("info", "ws_hello_sent", { url: opts.url });
+            helloTimer = setTimeout(() => {
+              log2("warn", "hello_ack_timeout", { url: opts.url });
+              try {
+                sock.close();
+              } catch {}
+              reject(new Error("hello_ack_timeout"));
+            }, helloAckTimeoutMs);
+          } catch (e) {
+            log2("warn", "ws_build_hello_threw", { err: String(e) });
+            reject(e instanceof Error ? e : new Error(String(e)));
+          }
+        })();
+      });
+      sock.on("message", (raw) => {
+        let msg;
+        try {
+          msg = JSON.parse(raw.toString());
+        } catch {
+          return;
+        }
+        if (opts.isHelloAck(msg)) {
+          if (helloTimer) {
+            clearTimeout(helloTimer);
+            helloTimer = null;
+          }
+          setStatus("open");
+          reconnectAttempt = 0;
+          log2("info", "ws_hello_acked", { url: opts.url });
+          resolve();
+          return;
+        }
+        opts.onMessage(msg);
+      });
+      sock.on("close", (code, reason) => {
+        if (helloTimer) {
+          clearTimeout(helloTimer);
+          helloTimer = null;
+        }
+        const reasonStr = reason.toString("utf8");
+        log2("warn", "ws_closed", { url: opts.url, code, reason: reasonStr, status });
+        opts.onBeforeReconnect?.(code, reasonStr);
+        if (closed) {
+          setStatus("closed");
+          return;
+        }
+        setStatus("reconnecting");
+        const wait = backoffCapsMs[Math.min(reconnectAttempt, backoffCapsMs.length - 1)] ?? 30000;
+        reconnectAttempt++;
+        log2("info", "ws_reconnect_scheduled", { url: opts.url, wait_ms: wait, code, reason: reasonStr });
+        reconnectTimer = setTimeout(() => openOnce().catch((err) => log2("warn", "ws_reconnect_failed", { url: opts.url, err: String(err) })), wait);
+        if (status === "connecting" || status === "reconnecting") {
+          reject(new Error(`closed_before_hello_${code}`));
+        }
+      });
+      sock.on("error", (err) => log2("warn", "ws_error", { url: opts.url, err: err.message }));
+    });
+  };
+  return openOnce().then(() => {
+    const handle = {
+      get status() {
+        return status;
+      },
+      get ws() {
+        return ws;
+      },
+      send(payload) {
+        if (!ws || ws.readyState !== ws.OPEN) {
+          throw new Error("ws_not_open");
+        }
+        ws.send(JSON.stringify(payload));
+      },
+      async close() {
+        closed = true;
+        if (reconnectTimer) {
+          clearTimeout(reconnectTimer);
+          reconnectTimer = null;
+        }
+        if (helloTimer) {
+          clearTimeout(helloTimer);
+          helloTimer = null;
+        }
+        try {
+          ws?.close();
+        } catch {}
+        setStatus("closed");
+      }
+    };
+    return handle;
+  });
+}
+var DEFAULT_HELLO_ACK_TIMEOUT_MS = 5000, DEFAULT_BACKOFF_CAPS_MS, defaultLog = (level, msg, meta) => {
+  const line = JSON.stringify({ level, msg, ...meta, ts: new Date().toISOString() });
+  if (level === "info")
+    process.stdout.write(line + `
+`);
+  else
+    process.stderr.write(line + `
+`);
+};
+var init_ws_lifecycle = __esm(() => {
+  DEFAULT_BACKOFF_CAPS_MS = [1000, 2000, 4000, 8000, 16000, 30000];
+});
 
+// src/daemon/broker.ts
 class DaemonBrokerClient {
   mesh;
   opts;
-  ws = null;
+  lifecycle = null;
   _status = "closed";
   closed = false;
-  reconnectAttempt = 0;
-  reconnectTimer = null;
-  helloTimer = null;
   pendingAcks = new Map;
   peerListResolvers = new Map;
   skillListResolvers = new Map;
@@ -10511,8 +10688,6 @@ class DaemonBrokerClient {
   stateListResolvers = new Map;
   memoryStoreResolvers = new Map;
   memoryRecallResolvers = new Map;
-  sessionPubkey = null;
-  sessionSecretKey = null;
   opens = [];
   reqCounter = 0;
   constructor(mesh, opts = {}) {
@@ -10529,72 +10704,39 @@ class DaemonBrokerClient {
     return this.mesh.meshId;
   }
   log = (level, msg, meta) => {
-    (this.opts.log ?? defaultLog)(level, msg, { mesh: this.mesh.slug, ...meta });
+    (this.opts.log ?? defaultLog2)(level, msg, { mesh: this.mesh.slug, ...meta });
   };
-  setConnStatus(s) {
-    if (this._status === s)
-      return;
-    this._status = s;
-    this.opts.onStatusChange?.(s);
-  }
   async connect() {
     if (this.closed)
       throw new Error("client_closed");
     if (this._status === "connecting" || this._status === "open")
       return;
-    this.setConnStatus("connecting");
-    const ws = new WebSocket2(this.mesh.brokerUrl);
-    this.ws = ws;
-    return new Promise((resolve, reject) => {
-      ws.on("open", async () => {
-        try {
-          if (!this.sessionPubkey) {
-            const { generateKeypair: generateKeypair4 } = await Promise.resolve().then(() => (init_facade7(), exports_facade4));
-            const kp = await generateKeypair4();
-            this.sessionPubkey = kp.publicKey;
-            this.sessionSecretKey = kp.secretKey;
-          }
-          const { timestamp: timestamp2, signature } = await signHello(this.mesh.meshId, this.mesh.memberId, this.mesh.pubkey, this.mesh.secretKey);
-          ws.send(JSON.stringify({
-            type: "hello",
-            meshId: this.mesh.meshId,
-            memberId: this.mesh.memberId,
-            pubkey: this.mesh.pubkey,
-            sessionPubkey: this.sessionPubkey,
-            displayName: this.opts.displayName,
-            sessionId: `daemon-${process.pid}`,
-            pid: process.pid,
-            cwd: process.cwd(),
-            hostname: __require("node:os").hostname(),
-            peerType: "ai",
-            channel: "claudemesh-daemon",
-            timestamp: timestamp2,
-            signature
-          }));
-          this.helloTimer = setTimeout(() => {
-            this.log("warn", "broker_hello_ack_timeout");
-            try {
-              ws.close();
-            } catch {}
-            reject(new Error("hello_ack_timeout"));
-          }, HELLO_ACK_TIMEOUT_MS2);
-        } catch (e) {
-          reject(e instanceof Error ? e : new Error(String(e)));
-        }
-      });
-      ws.on("message", (raw) => {
-        let msg;
-        try {
-          msg = JSON.parse(raw.toString());
-        } catch {
-          return;
-        }
-        if (msg.type === "hello_ack") {
-          if (this.helloTimer)
-            clearTimeout(this.helloTimer);
-          this.helloTimer = null;
-          this.setConnStatus("open");
-          this.reconnectAttempt = 0;
+    this.lifecycle = await connectWsWithBackoff({
+      url: this.mesh.brokerUrl,
+      buildHello: async () => {
+        const { timestamp: timestamp2, signature } = await signHello(this.mesh.meshId, this.mesh.memberId, this.mesh.pubkey, this.mesh.secretKey);
+        return {
+          type: "hello",
+          meshId: this.mesh.meshId,
+          memberId: this.mesh.memberId,
+          pubkey: this.mesh.pubkey,
+          displayName: this.opts.displayName,
+          sessionId: `daemon-${process.pid}`,
+          pid: process.pid,
+          cwd: process.cwd(),
+          hostname: __require("node:os").hostname(),
+          peerType: "ai",
+          channel: "claudemesh-daemon",
+          timestamp: timestamp2,
+          signature
+        };
+      },
+      isHelloAck: (msg) => msg.type === "hello_ack",
+      onMessage: (msg) => this.handleMessage(msg),
+      onStatusChange: (s) => {
+        this._status = s;
+        this.opts.onStatusChange?.(s);
+        if (s === "open") {
           const queued = this.opens.slice();
           this.opens.length = 0;
           for (const fn of queued) {
@@ -10604,123 +10746,121 @@ class DaemonBrokerClient {
               this.log("warn", "open_handler_failed", { err: String(e) });
             }
           }
-          resolve();
-          return;
-        }
-        if (msg.type === "ack") {
-          const id = String(msg.id ?? "");
-          const ack = this.pendingAcks.get(id);
-          if (ack) {
-            this.pendingAcks.delete(id);
-            clearTimeout(ack.timer);
-            if (typeof msg.error === "string" && msg.error.length > 0) {
-              ack.resolve({ ok: false, error: msg.error, permanent: classifyPermanent(msg.error) });
-            } else {
-              ack.resolve({ ok: true, messageId: String(msg.messageId ?? id) });
-            }
-          }
-          return;
-        }
-        if (msg.type === "peers_list") {
-          const reqId = String(msg._reqId ?? "");
-          const pending = this.peerListResolvers.get(reqId);
-          if (pending) {
-            this.peerListResolvers.delete(reqId);
-            clearTimeout(pending.timer);
-            pending.resolve(Array.isArray(msg.peers) ? msg.peers : []);
-          }
-          return;
-        }
-        if (msg.type === "skill_list") {
-          const reqId = String(msg._reqId ?? "");
-          const pending = this.skillListResolvers.get(reqId);
-          if (pending) {
-            this.skillListResolvers.delete(reqId);
-            clearTimeout(pending.timer);
-            pending.resolve(Array.isArray(msg.skills) ? msg.skills : []);
-          }
-          return;
-        }
-        if (msg.type === "skill_data") {
-          const reqId = String(msg._reqId ?? "");
-          const pending = this.skillDataResolvers.get(reqId);
-          if (pending) {
-            this.skillDataResolvers.delete(reqId);
-            clearTimeout(pending.timer);
-            pending.resolve(msg.skill ?? null);
-          }
-          return;
-        }
-        if (msg.type === "state_value" || msg.type === "state_data") {
-          const reqId = String(msg._reqId ?? "");
-          const pending = this.stateGetResolvers.get(reqId);
-          if (pending) {
-            this.stateGetResolvers.delete(reqId);
-            clearTimeout(pending.timer);
-            pending.resolve(msg.state ?? msg.row ?? null);
-          }
-          return;
         }
-        if (msg.type === "state_list") {
-          const reqId = String(msg._reqId ?? "");
-          const pending = this.stateListResolvers.get(reqId);
-          if (pending) {
-            this.stateListResolvers.delete(reqId);
-            clearTimeout(pending.timer);
-            pending.resolve(Array.isArray(msg.entries) ? msg.entries : []);
-          }
-          return;
-        }
-        if (msg.type === "memory_stored") {
-          const reqId = String(msg._reqId ?? "");
-          const pending = this.memoryStoreResolvers.get(reqId);
-          if (pending) {
-            this.memoryStoreResolvers.delete(reqId);
-            clearTimeout(pending.timer);
-            pending.resolve(typeof msg.memoryId === "string" ? msg.memoryId : null);
-          }
-          return;
-        }
-        if (msg.type === "memory_recall_result") {
-          const reqId = String(msg._reqId ?? "");
-          const pending = this.memoryRecallResolvers.get(reqId);
-          if (pending) {
-            this.memoryRecallResolvers.delete(reqId);
-            clearTimeout(pending.timer);
-            pending.resolve(Array.isArray(msg.matches) ? msg.matches : []);
-          }
-          return;
-        }
-        if (msg.type === "push" || msg.type === "inbound") {
-          this.opts.onPush?.(msg);
-          return;
-        }
-      });
-      ws.on("close", (code, reason) => {
-        if (this.helloTimer) {
-          clearTimeout(this.helloTimer);
-          this.helloTimer = null;
-        }
-        this.failPendingAcks(`broker_disconnected_${code}`);
-        if (this.closed) {
-          this.setConnStatus("closed");
-          return;
+      },
+      onBeforeReconnect: (code) => this.failPendingAcks(`broker_disconnected_${code}`),
+      log: (level, msg, meta) => this.log(level, `broker_${msg}`, meta)
+    });
+  }
+  handleMessage(msg) {
+    if (msg.type === "ack") {
+      const id = String(msg.id ?? "");
+      const ack = this.pendingAcks.get(id);
+      if (ack) {
+        this.pendingAcks.delete(id);
+        clearTimeout(ack.timer);
+        if (typeof msg.error === "string" && msg.error.length > 0) {
+          ack.resolve({ ok: false, error: msg.error, permanent: classifyPermanent(msg.error) });
+        } else {
+          ack.resolve({ ok: true, messageId: String(msg.messageId ?? id) });
         }
-        this.setConnStatus("reconnecting");
-        const wait = BACKOFF_CAPS_MS[Math.min(this.reconnectAttempt, BACKOFF_CAPS_MS.length - 1)] ?? 30000;
-        this.reconnectAttempt++;
-        this.log("info", "broker_reconnect_scheduled", { wait_ms: wait, code, reason: reason.toString("utf8") });
-        this.reconnectTimer = setTimeout(() => this.connect().catch((err) => this.log("warn", "broker_reconnect_failed", { err: String(err) })), wait);
-        if (this._status === "connecting")
-          reject(new Error(`closed_before_hello_${code}`));
+      }
+      return;
+    }
+    if (msg.type === "peers_list") {
+      const reqId = String(msg._reqId ?? "");
+      const pending = this.peerListResolvers.get(reqId);
+      if (pending) {
+        this.peerListResolvers.delete(reqId);
+        clearTimeout(pending.timer);
+        pending.resolve(Array.isArray(msg.peers) ? msg.peers : []);
+      }
+      return;
+    }
+    if (msg.type === "skill_list") {
+      const reqId = String(msg._reqId ?? "");
+      const pending = this.skillListResolvers.get(reqId);
+      if (pending) {
+        this.skillListResolvers.delete(reqId);
+        clearTimeout(pending.timer);
+        pending.resolve(Array.isArray(msg.skills) ? msg.skills : []);
+      }
+      return;
+    }
+    if (msg.type === "skill_data") {
+      const reqId = String(msg._reqId ?? "");
+      const pending = this.skillDataResolvers.get(reqId);
+      if (pending) {
+        this.skillDataResolvers.delete(reqId);
+        clearTimeout(pending.timer);
+        pending.resolve(msg.skill ?? null);
+      }
+      return;
+    }
+    if (msg.type === "state_value" || msg.type === "state_data") {
+      const reqId = String(msg._reqId ?? "");
+      const pending = this.stateGetResolvers.get(reqId);
+      if (pending) {
+        this.stateGetResolvers.delete(reqId);
+        clearTimeout(pending.timer);
+        pending.resolve(msg.state ?? msg.row ?? null);
+      }
+      return;
+    }
+    if (msg.type === "state_list") {
+      const reqId = String(msg._reqId ?? "");
+      const pending = this.stateListResolvers.get(reqId);
+      if (pending) {
+        this.stateListResolvers.delete(reqId);
+        clearTimeout(pending.timer);
+        pending.resolve(Array.isArray(msg.entries) ? msg.entries : []);
+      }
+      return;
+    }
+    if (msg.type === "memory_stored") {
+      const reqId = String(msg._reqId ?? "");
+      const pending = this.memoryStoreResolvers.get(reqId);
+      if (pending) {
+        this.memoryStoreResolvers.delete(reqId);
+        clearTimeout(pending.timer);
+        pending.resolve(typeof msg.memoryId === "string" ? msg.memoryId : null);
+      }
+      return;
+    }
+    if (msg.type === "memory_recall_result") {
+      const reqId = String(msg._reqId ?? "");
+      const pending = this.memoryRecallResolvers.get(reqId);
+      if (pending) {
+        this.memoryRecallResolvers.delete(reqId);
+        clearTimeout(pending.timer);
+        pending.resolve(Array.isArray(msg.matches) ? msg.matches : []);
+      }
+      return;
+    }
+    if (msg.type === "push" || msg.type === "inbound") {
+      this.opts.onPush?.(msg);
+      return;
+    }
+  }
+  isOpen() {
+    const sock = this.lifecycle?.ws;
+    return !!sock && sock.readyState === sock.OPEN;
+  }
+  sendClientAck(clientMessageId, brokerMessageId) {
+    if (!this.isOpen())
+      return;
+    try {
+      this.lifecycle.send({
+        type: "client_ack",
+        clientMessageId,
+        ...brokerMessageId ? { brokerMessageId } : {}
       });
-      ws.on("error", (err) => this.log("warn", "broker_ws_error", { err: err.message }));
-    });
+    } catch {}
   }
   send(req) {
     return new Promise((resolve) => {
       const dispatch = () => {
-        if (!this.ws || this.ws.readyState !== this.ws.OPEN) {
+        if (!this.isOpen()) {
           resolve({ ok: false, error: "broker_not_open", permanent: false });
           return;
         }
@@ -10732,7 +10872,7 @@ class DaemonBrokerClient {
         }, SEND_ACK_TIMEOUT_MS);
         this.pendingAcks.set(id, { resolve, timer });
         try {
-          this.ws.send(JSON.stringify({
+          this.lifecycle.send({
             type: "send",
             id,
             client_message_id: id,
@@ -10741,7 +10881,7 @@ class DaemonBrokerClient {
             priority: req.priority,
             nonce: req.nonce,
             ciphertext: req.ciphertext
-          }));
+          });
         } catch (e) {
           this.pendingAcks.delete(id);
           clearTimeout(timer);
@@ -10755,7 +10895,7 @@ class DaemonBrokerClient {
     });
   }
   async listPeers(timeoutMs = 5000) {
-    if (this._status !== "open" || !this.ws)
+    if (this._status !== "open" || !this.lifecycle)
       return [];
     return new Promise((resolve) => {
       const reqId = `pl-${++this.reqCounter}`;
@@ -10765,7 +10905,7 @@ class DaemonBrokerClient {
       }, timeoutMs);
       this.peerListResolvers.set(reqId, { resolve, timer });
       try {
-        this.ws.send(JSON.stringify({ type: "list_peers", _reqId: reqId }));
+        this.lifecycle.send({ type: "list_peers", _reqId: reqId });
       } catch {
         this.peerListResolvers.delete(reqId);
         clearTimeout(timer);
@@ -10774,7 +10914,7 @@ class DaemonBrokerClient {
     });
   }
   async listSkills(query, timeoutMs = 5000) {
-    if (this._status !== "open" || !this.ws)
+    if (this._status !== "open" || !this.lifecycle)
       return [];
     return new Promise((resolve) => {
       const reqId = `sl-${++this.reqCounter}`;
@@ -10784,7 +10924,7 @@ class DaemonBrokerClient {
       }, timeoutMs);
       this.skillListResolvers.set(reqId, { resolve, timer });
       try {
-        this.ws.send(JSON.stringify({ type: "list_skills", query, _reqId: reqId }));
+        this.lifecycle.send({ type: "list_skills", query, _reqId: reqId });
       } catch {
         this.skillListResolvers.delete(reqId);
         clearTimeout(timer);
@@ -10793,7 +10933,7 @@ class DaemonBrokerClient {
     });
   }
   async getSkill(name, timeoutMs = 5000) {
-    if (this._status !== "open" || !this.ws)
+    if (this._status !== "open" || !this.lifecycle)
       return null;
     return new Promise((resolve) => {
       const reqId = `sg-${++this.reqCounter}`;
@@ -10803,7 +10943,7 @@ class DaemonBrokerClient {
       }, timeoutMs);
       this.skillDataResolvers.set(reqId, { resolve, timer });
       try {
-        this.ws.send(JSON.stringify({ type: "get_skill", name, _reqId: reqId }));
+        this.lifecycle.send({ type: "get_skill", name, _reqId: reqId });
       } catch {
         this.skillDataResolvers.delete(reqId);
         clearTimeout(timer);
@@ -10812,7 +10952,7 @@ class DaemonBrokerClient {
     });
   }
   async getState(key, timeoutMs = 5000) {
-    if (this._status !== "open" || !this.ws)
+    if (this._status !== "open" || !this.lifecycle)
       return null;
     return new Promise((resolve) => {
       const reqId = `sg-${++this.reqCounter}`;
@@ -10822,7 +10962,7 @@ class DaemonBrokerClient {
       }, timeoutMs);
       this.stateGetResolvers.set(reqId, { resolve, timer });
       try {
-        this.ws.send(JSON.stringify({ type: "get_state", key, _reqId: reqId }));
+        this.lifecycle.send({ type: "get_state", key, _reqId: reqId });
       } catch {
         this.stateGetResolvers.delete(reqId);
         clearTimeout(timer);
@@ -10831,7 +10971,7 @@ class DaemonBrokerClient {
     });
   }
   async listState(timeoutMs = 5000) {
-    if (this._status !== "open" || !this.ws)
+    if (this._status !== "open" || !this.lifecycle)
       return [];
     return new Promise((resolve) => {
       const reqId = `sl-${++this.reqCounter}`;
@@ -10841,7 +10981,7 @@ class DaemonBrokerClient {
       }, timeoutMs);
       this.stateListResolvers.set(reqId, { resolve, timer });
       try {
-        this.ws.send(JSON.stringify({ type: "list_state", _reqId: reqId }));
+        this.lifecycle.send({ type: "list_state", _reqId: reqId });
       } catch {
         this.stateListResolvers.delete(reqId);
         clearTimeout(timer);
@@ -10850,14 +10990,14 @@ class DaemonBrokerClient {
     });
   }
   setState(key, value) {
-    if (this._status !== "open" || !this.ws)
+    if (this._status !== "open" || !this.lifecycle)
       return;
     try {
-      this.ws.send(JSON.stringify({ type: "set_state", key, value }));
+      this.lifecycle.send({ type: "set_state", key, value });
     } catch {}
   }
   async remember(content, tags, timeoutMs = 5000) {
-    if (this._status !== "open" || !this.ws)
+    if (this._status !== "open" || !this.lifecycle)
       return null;
     return new Promise((resolve) => {
       const reqId = `mr-${++this.reqCounter}`;
@@ -10867,7 +11007,7 @@ class DaemonBrokerClient {
       }, timeoutMs);
       this.memoryStoreResolvers.set(reqId, { resolve, timer });
       try {
-        this.ws.send(JSON.stringify({ type: "remember", content, tags, _reqId: reqId }));
+        this.lifecycle.send({ type: "remember", content, tags, _reqId: reqId });
       } catch {
         this.memoryStoreResolvers.delete(reqId);
         clearTimeout(timer);
@@ -10876,7 +11016,7 @@ class DaemonBrokerClient {
     });
   }
   async recall(query, timeoutMs = 5000) {
-    if (this._status !== "open" || !this.ws)
+    if (this._status !== "open" || !this.lifecycle)
       return [];
     return new Promise((resolve) => {
       const reqId = `mc-${++this.reqCounter}`;
@@ -10886,7 +11026,7 @@ class DaemonBrokerClient {
       }, timeoutMs);
       this.memoryRecallResolvers.set(reqId, { resolve, timer });
       try {
-        this.ws.send(JSON.stringify({ type: "recall", query, _reqId: reqId }));
+        this.lifecycle.send({ type: "recall", query, _reqId: reqId });
       } catch {
         this.memoryRecallResolvers.delete(reqId);
         clearTimeout(timer);
@@ -10895,60 +11035,50 @@ class DaemonBrokerClient {
     });
   }
   forget(memoryId) {
-    if (this._status !== "open" || !this.ws)
+    if (this._status !== "open" || !this.lifecycle)
       return;
     try {
-      this.ws.send(JSON.stringify({ type: "forget", memoryId }));
+      this.lifecycle.send({ type: "forget", memoryId });
     } catch {}
   }
   setProfile(profile) {
-    if (this._status !== "open" || !this.ws)
+    if (this._status !== "open" || !this.lifecycle)
       return;
     try {
-      this.ws.send(JSON.stringify({ type: "set_profile", ...profile }));
+      this.lifecycle.send({ type: "set_profile", ...profile });
     } catch {}
   }
   setSummary(summary) {
-    if (this._status !== "open" || !this.ws)
+    if (this._status !== "open" || !this.lifecycle)
       return;
     try {
-      this.ws.send(JSON.stringify({ type: "set_summary", summary }));
+      this.lifecycle.send({ type: "set_summary", summary });
     } catch {}
   }
   setStatus(status) {
-    if (this._status !== "open" || !this.ws)
+    if (this._status !== "open" || !this.lifecycle)
       return;
     try {
-      this.ws.send(JSON.stringify({ type: "set_status", status }));
+      this.lifecycle.send({ type: "set_status", status });
     } catch {}
   }
   setVisible(visible) {
-    if (this._status !== "open" || !this.ws)
+    if (this._status !== "open" || !this.lifecycle)
       return;
     try {
-      this.ws.send(JSON.stringify({ type: "set_visible", visible }));
+      this.lifecycle.send({ type: "set_visible", visible });
     } catch {}
   }
   async close() {
     this.closed = true;
-    if (this.reconnectTimer) {
-      clearTimeout(this.reconnectTimer);
-      this.reconnectTimer = null;
-    }
-    if (this.helloTimer) {
-      clearTimeout(this.helloTimer);
-      this.helloTimer = null;
-    }
     this.failPendingAcks("daemon_shutdown");
-    try {
-      this.ws?.close();
-    } catch {}
-    this.setConnStatus("closed");
-  }
-  getSessionKeys() {
-    if (!this.sessionPubkey || !this.sessionSecretKey)
-      return null;
-    return { sessionPubkey: this.sessionPubkey, sessionSecretKey: this.sessionSecretKey };
+    if (this.lifecycle) {
+      try {
+        await this.lifecycle.close();
+      } catch {}
+      this.lifecycle = null;
+    }
+    this._status = "closed";
   }
   failPendingAcks(reason) {
     for (const [id, ack] of this.pendingAcks) {
@@ -10958,7 +11088,7 @@ class DaemonBrokerClient {
     }
   }
 }
-function defaultLog(level, msg, meta) {
+function defaultLog2(level, msg, meta) {
   const line = JSON.stringify({ level, msg, ...meta, ts: new Date().toISOString() });
   if (level === "info")
     process.stdout.write(line + `
@@ -10970,24 +11100,26 @@ function defaultLog(level, msg, meta) {
 function classifyPermanent(err) {
   return /payload_too_large|forbidden|not_found|invalid|schema|auth|signature/i.test(err);
 }
-var HELLO_ACK_TIMEOUT_MS2 = 5000, SEND_ACK_TIMEOUT_MS = 15000, BACKOFF_CAPS_MS;
+var SEND_ACK_TIMEOUT_MS = 15000;
 var init_broker = __esm(() => {
   init_hello_sig();
-  BACKOFF_CAPS_MS = [1000, 2000, 4000, 8000, 16000, 30000];
+  init_ws_lifecycle();
 });
 
 // src/daemon/session-broker.ts
 import { hostname as osHostname } from "node:os";
-import WebSocket3 from "ws";
+function classifyPermanent2(error2) {
+  return /unknown|invalid|forbidden|not_authorized|target_not_found/i.test(error2);
+}
 
 class SessionBrokerClient {
   opts;
-  ws = null;
+  lifecycle = null;
   _status = "closed";
   closed = false;
-  reconnectAttempt = 0;
-  reconnectTimer = null;
-  helloTimer = null;
+  brokerUnsupported = false;
+  pendingAcks = new Map;
+  opens = [];
   constructor(opts) {
     this.opts = opts;
   }
@@ -11001,85 +11133,68 @@ class SessionBrokerClient {
     return this.opts.sessionPubkey;
   }
   log = (level, msg, meta) => {
-    (this.opts.log ?? defaultLog2)(level, msg, {
+    (this.opts.log ?? defaultLog3)(level, msg, {
       mesh: this.opts.mesh.slug,
       session_pubkey: this.opts.sessionPubkey.slice(0, 12),
       ...meta
     });
   };
-  setStatus(s) {
-    if (this._status === s)
-      return;
-    this._status = s;
-    this.opts.onStatusChange?.(s);
-  }
   async connect() {
     if (this.closed)
       throw new Error("client_closed");
     if (this._status === "connecting" || this._status === "open")
       return;
-    this.setStatus("connecting");
-    const ws = new WebSocket3(this.opts.mesh.brokerUrl);
-    this.ws = ws;
-    return new Promise((resolve, reject) => {
-      ws.on("open", async () => {
-        try {
-          const { timestamp: timestamp2, signature } = await signSessionHello({
-            meshId: this.opts.mesh.meshId,
-            parentMemberPubkey: this.opts.mesh.pubkey,
-            sessionPubkey: this.opts.sessionPubkey,
-            sessionSecretKey: this.opts.sessionSecretKey
-          });
-          ws.send(JSON.stringify({
-            type: "session_hello",
-            meshId: this.opts.mesh.meshId,
-            parentMemberId: this.opts.mesh.memberId,
-            parentMemberPubkey: this.opts.mesh.pubkey,
-            sessionPubkey: this.opts.sessionPubkey,
-            parentAttestation: this.opts.parentAttestation,
-            displayName: this.opts.displayName,
-            sessionId: this.opts.sessionId,
-            pid: this.opts.pid,
-            cwd: this.opts.cwd ?? process.cwd(),
-            hostname: osHostname(),
-            peerType: "ai",
-            channel: "claudemesh-session",
-            ...this.opts.groups && this.opts.groups.length > 0 ? { groups: this.opts.groups } : {},
-            ...this.opts.role ? { role: this.opts.role } : {},
-            timestamp: timestamp2,
-            signature
-          }));
-          this.helloTimer = setTimeout(() => {
-            this.log("warn", "session_hello_ack_timeout");
-            try {
-              ws.close();
-            } catch {}
-            reject(new Error("session_hello_ack_timeout"));
-          }, HELLO_ACK_TIMEOUT_MS3);
-        } catch (e) {
-          reject(e instanceof Error ? e : new Error(String(e)));
-        }
-      });
-      ws.on("message", (raw) => {
-        let msg;
-        try {
-          msg = JSON.parse(raw.toString());
-        } catch {
-          return;
-        }
-        if (msg.type === "hello_ack") {
-          if (this.helloTimer)
-            clearTimeout(this.helloTimer);
-          this.helloTimer = null;
-          this.setStatus("open");
-          this.reconnectAttempt = 0;
-          resolve();
-          return;
-        }
+    this.lifecycle = await connectWsWithBackoff({
+      url: this.opts.mesh.brokerUrl,
+      buildHello: async () => {
+        const { timestamp: timestamp2, signature } = await signSessionHello({
+          meshId: this.opts.mesh.meshId,
+          parentMemberPubkey: this.opts.mesh.pubkey,
+          sessionPubkey: this.opts.sessionPubkey,
+          sessionSecretKey: this.opts.sessionSecretKey
+        });
+        return {
+          type: "session_hello",
+          meshId: this.opts.mesh.meshId,
+          parentMemberId: this.opts.mesh.memberId,
+          parentMemberPubkey: this.opts.mesh.pubkey,
+          sessionPubkey: this.opts.sessionPubkey,
+          parentAttestation: this.opts.parentAttestation,
+          displayName: this.opts.displayName,
+          sessionId: this.opts.sessionId,
+          pid: this.opts.pid,
+          cwd: this.opts.cwd ?? process.cwd(),
+          hostname: osHostname(),
+          peerType: "ai",
+          channel: "claudemesh-session",
+          ...this.opts.groups && this.opts.groups.length > 0 ? { groups: this.opts.groups } : {},
+          ...this.opts.role ? { role: this.opts.role } : {},
+          timestamp: timestamp2,
+          signature
+        };
+      },
+      isHelloAck: (msg) => msg.type === "hello_ack",
+      onMessage: (msg) => {
         if (msg.type === "error") {
           this.log("warn", "broker_error", { code: msg.code, message: msg.message });
           if (msg.code === "unknown_message_type") {
+            this.brokerUnsupported = true;
             this.closed = true;
+            this.lifecycle?.close();
+          }
+          return;
+        }
+        if (msg.type === "ack") {
+          const id = String(msg.id ?? "");
+          const ack = this.pendingAcks.get(id);
+          if (ack) {
+            this.pendingAcks.delete(id);
+            clearTimeout(ack.timer);
+            if (typeof msg.error === "string" && msg.error.length > 0) {
+              ack.resolve({ ok: false, error: msg.error, permanent: classifyPermanent2(msg.error) });
+            } else {
+              ack.resolve({ ok: true, messageId: String(msg.messageId ?? id) });
+            }
           }
           return;
         }
@@ -11087,44 +11202,104 @@ class SessionBrokerClient {
           this.opts.onPush?.(msg);
           return;
         }
-      });
-      ws.on("close", (code, reason) => {
-        if (this.helloTimer) {
-          clearTimeout(this.helloTimer);
-          this.helloTimer = null;
+      },
+      onStatusChange: (s) => {
+        this._status = s;
+        this.opts.onStatusChange?.(s);
+        if (s === "open") {
+          const queued = this.opens.slice();
+          this.opens.length = 0;
+          for (const fn of queued) {
+            try {
+              fn();
+            } catch (e) {
+              this.log("warn", "session_open_handler_failed", { err: String(e) });
+            }
+          }
+        } else if (s === "closed" || s === "reconnecting") {
+          this.failPendingAcks(`session_ws_${s}`);
         }
-        if (this.closed) {
-          this.setStatus("closed");
+      },
+      log: (level, msg, meta) => this.log(level, `session_broker_${msg}`, meta)
+    });
+  }
+  sendClientAck(clientMessageId, brokerMessageId) {
+    if (this._status !== "open" || !this.lifecycle)
+      return;
+    try {
+      this.lifecycle.send({
+        type: "client_ack",
+        clientMessageId,
+        ...brokerMessageId ? { brokerMessageId } : {}
+      });
+    } catch {}
+  }
+  isOpen() {
+    const sock = this.lifecycle?.ws;
+    return !!sock && sock.readyState === sock.OPEN;
+  }
+  send(req) {
+    return new Promise((resolve) => {
+      const dispatch = () => {
+        if (!this.isOpen() || !this.lifecycle) {
+          resolve({ ok: false, error: "session_ws_not_open", permanent: false });
           return;
         }
-        this.setStatus("reconnecting");
-        const wait = BACKOFF_CAPS_MS2[Math.min(this.reconnectAttempt, BACKOFF_CAPS_MS2.length - 1)] ?? 30000;
-        this.reconnectAttempt++;
-        this.log("info", "session_broker_reconnect_scheduled", { wait_ms: wait, code, reason: reason.toString("utf8") });
-        this.reconnectTimer = setTimeout(() => this.connect().catch((err) => this.log("warn", "session_broker_reconnect_failed", { err: String(err) })), wait);
-        if (this._status === "connecting")
-          reject(new Error(`closed_before_hello_${code}`));
-      });
-      ws.on("error", (err) => this.log("warn", "session_broker_ws_error", { err: err.message }));
+        const id = req.client_message_id;
+        const timer = setTimeout(() => {
+          if (this.pendingAcks.delete(id)) {
+            resolve({ ok: false, error: "ack_timeout", permanent: false });
+          }
+        }, SEND_ACK_TIMEOUT_MS2);
+        this.pendingAcks.set(id, { resolve, timer });
+        try {
+          this.lifecycle.send({
+            type: "send",
+            id,
+            client_message_id: id,
+            request_fingerprint: req.request_fingerprint_hex,
+            targetSpec: req.targetSpec,
+            priority: req.priority,
+            nonce: req.nonce,
+            ciphertext: req.ciphertext
+          });
+        } catch (e) {
+          this.pendingAcks.delete(id);
+          clearTimeout(timer);
+          resolve({ ok: false, error: `ws_write_failed: ${String(e)}`, permanent: false });
+        }
+      };
+      if (this._status === "open")
+        dispatch();
+      else
+        this.opens.push(dispatch);
     });
   }
+  failPendingAcks(reason) {
+    if (this.pendingAcks.size === 0)
+      return;
+    const entries = [...this.pendingAcks.entries()];
+    this.pendingAcks.clear();
+    for (const [, ack] of entries) {
+      clearTimeout(ack.timer);
+      ack.resolve({ ok: false, error: reason, permanent: false });
+    }
+  }
   async close() {
     this.closed = true;
-    if (this.reconnectTimer) {
-      clearTimeout(this.reconnectTimer);
-      this.reconnectTimer = null;
-    }
-    if (this.helloTimer) {
-      clearTimeout(this.helloTimer);
-      this.helloTimer = null;
+    if (this.lifecycle) {
+      try {
+        await this.lifecycle.close();
+      } catch {}
+      this.lifecycle = null;
     }
-    try {
-      this.ws?.close();
-    } catch {}
-    this.setStatus("closed");
+    this._status = "closed";
+  }
+  get isBrokerUnsupported() {
+    return this.brokerUnsupported;
   }
 }
-function defaultLog2(level, msg, meta) {
+function defaultLog3(level, msg, meta) {
   const line = JSON.stringify({ level, msg, ...meta, ts: new Date().toISOString() });
   if (level === "info")
     process.stdout.write(line + `
@@ -11133,15 +11308,15 @@ function defaultLog2(level, msg, meta) {
     process.stderr.write(line + `
 `);
 }
-var HELLO_ACK_TIMEOUT_MS3 = 5000, BACKOFF_CAPS_MS2;
+var SEND_ACK_TIMEOUT_MS2 = 15000;
 var init_session_broker = __esm(() => {
   init_session_hello_sig();
-  BACKOFF_CAPS_MS2 = [1000, 2000, 4000, 8000, 16000, 30000];
+  init_ws_lifecycle();
 });
 
 // src/daemon/drain.ts
 function startDrainWorker(opts) {
-  const log2 = opts.log ?? defaultLog3;
+  const log2 = opts.log ?? defaultLog4;
   let stopped = false;
   let wakeResolve = null;
   let wakePromise = new Promise((r) => {
@@ -11183,7 +11358,8 @@ async function drainOnce(opts, log2) {
   const now = Date.now();
   const rows = opts.db.prepare(`
     SELECT id, client_message_id, request_fingerprint, payload, attempts,
-           target_spec, nonce, ciphertext, priority, mesh
+           target_spec, nonce, ciphertext, priority, mesh,
+           sender_session_pubkey
       FROM outbox
      WHERE status = 'pending' AND next_attempt_at <= ?
      ORDER BY enqueued_at
@@ -11195,17 +11371,21 @@ async function drainOnce(opts, log2) {
     if (markInflight(opts.db, row.id, now) === 0)
       continue;
     const fpHex = bufferToHex(row.request_fingerprint);
-    let broker;
+    let daemonBroker;
     if (row.mesh) {
-      broker = opts.brokers.get(row.mesh);
+      daemonBroker = opts.brokers.get(row.mesh);
     } else if (opts.brokers.size === 1) {
-      broker = opts.brokers.values().next().value;
+      daemonBroker = opts.brokers.values().next().value;
     }
-    if (!broker) {
+    if (!daemonBroker) {
       log2("warn", "drain_no_broker_for_mesh", { id: row.id, mesh: row.mesh ?? "(null)" });
       markDead(opts.db, row.id, `no_broker_for_mesh:${row.mesh ?? "null"}`);
       continue;
     }
+    let sessionBroker;
+    if (row.sender_session_pubkey && opts.getSessionBrokerByPubkey) {
+      sessionBroker = opts.getSessionBrokerByPubkey(row.sender_session_pubkey);
+    }
     let targetSpec;
     let nonce;
     let ciphertext;
@@ -11221,16 +11401,29 @@ async function drainOnce(opts, log2) {
       ciphertext = Buffer.from(row.payload).toString("base64");
       priority = "next";
     }
+    const sendArgs = {
+      targetSpec,
+      priority,
+      nonce,
+      ciphertext,
+      client_message_id: row.client_message_id,
+      request_fingerprint_hex: fpHex
+    };
     let res;
     try {
-      res = await broker.send({
-        targetSpec,
-        priority,
-        nonce,
-        ciphertext,
-        client_message_id: row.client_message_id,
-        request_fingerprint_hex: fpHex
-      });
+      if (row.sender_session_pubkey) {
+        if (!sessionBroker || !sessionBroker.isOpen()) {
+          log2("info", "drain_session_ws_not_ready", {
+            id: row.id,
+            session_pubkey: row.sender_session_pubkey.slice(0, 12)
+          });
+          backoffPending(opts.db, row.id, row.attempts + 1, "session_ws_not_open", "session_ws_not_open");
+          continue;
+        }
+        res = await sessionBroker.send(sendArgs);
+      } else {
+        res = await daemonBroker.send(sendArgs);
+      }
     } catch (e) {
       log2("warn", "drain_send_threw", { id: row.id, err: String(e) });
       backoffPending(opts.db, row.id, row.attempts + 1, "exception", String(e));
@@ -11285,7 +11478,7 @@ async function randomNonce2() {
   const { randomBytes: randomBytes6 } = await import("node:crypto");
   return randomBytes6(24).toString("base64");
 }
-function defaultLog3(level, msg, meta) {
+function defaultLog4(level, msg, meta) {
   const line = JSON.stringify({ level, msg, ...meta, ts: new Date().toISOString() });
   if (level === "info")
     process.stdout.write(line + `
@@ -11342,6 +11535,7 @@ async function handleBrokerPush(msg, ctx) {
     received_at: Date.now(),
     reply_to_id: replyToId
   });
+  ctx.ackClientMessage?.(clientMessageId, brokerMessageId);
   if (!inserted)
     return;
   ctx.bus.publish("message", {
@@ -11612,13 +11806,12 @@ async function runDaemon(opts = {}) {
         bus.publish("broker_status", { mesh: mesh.slug, status: s });
       },
       onPush: (m) => {
-        const sessionKeys = broker.getSessionKeys();
         handleBrokerPush(m, {
           db: inboxDb,
           bus,
           meshSlug: mesh.slug,
           recipientSecretKeyHex: mesh.secretKey,
-          sessionSecretKeyHex: sessionKeys?.sessionSecretKey
+          ackClientMessage: (cmid, bmid) => broker.sendClientAck(cmid, bmid)
         });
       }
     });
@@ -11626,9 +11819,14 @@ async function runDaemon(opts = {}) {
 `));
     brokers.set(mesh.slug, broker);
   }
-  let drain = null;
-  drain = startDrainWorker({ db: outboxDb, brokers });
   const sessionBrokers = new Map;
+  const sessionBrokersByPubkey = new Map;
+  let drain = null;
+  drain = startDrainWorker({
+    db: outboxDb,
+    brokers,
+    getSessionBrokerByPubkey: (pubkey) => sessionBrokersByPubkey.get(pubkey)
+  });
   setRegistryHooks({
     onRegister: (info) => {
       if (!info.presence)
@@ -11647,6 +11845,9 @@ async function runDaemon(opts = {}) {
       const prior = sessionBrokers.get(info.token);
       if (prior) {
         sessionBrokers.delete(info.token);
+        if (sessionBrokersByPubkey.get(prior.sessionPubkey) === prior) {
+          sessionBrokersByPubkey.delete(prior.sessionPubkey);
+        }
         prior.close().catch(() => {});
       }
       const sessionSecretKeyHex = info.presence.sessionSecretKey;
@@ -11666,11 +11867,13 @@ async function runDaemon(opts = {}) {
             bus,
             meshSlug: meshConfig.slug,
             recipientSecretKeyHex: meshConfig.secretKey,
-            sessionSecretKeyHex
+            sessionSecretKeyHex,
+            ackClientMessage: (cmid, bmid) => client.sendClientAck(cmid, bmid)
           });
         }
       });
       sessionBrokers.set(info.token, client);
+      sessionBrokersByPubkey.set(info.presence.sessionPubkey, client);
       client.connect().catch((err) => process.stderr.write(JSON.stringify({
         level: "warn",
         msg: "session_broker_connect_failed",
@@ -11685,6 +11888,9 @@ async function runDaemon(opts = {}) {
       if (!client)
         return;
       sessionBrokers.delete(info.token);
+      if (sessionBrokersByPubkey.get(client.sessionPubkey) === client) {
+        sessionBrokersByPubkey.delete(client.sessionPubkey);
+      }
       client.close().catch(() => {});
     }
   });
@@ -13076,8 +13282,8 @@ async function checkBrokerWs() {
   const wsUrl = URLS.BROKER;
   const start = Date.now();
   try {
-    const WebSocket4 = (await import("ws")).default;
-    const ws = new WebSocket4(wsUrl);
+    const WebSocket3 = (await import("ws")).default;
+    const ws = new WebSocket3(wsUrl);
     const result = await new Promise((resolve2) => {
       const timer = setTimeout(() => {
         try {
@@ -13188,11 +13394,11 @@ __export(exports_status, {
   runStatus: () => runStatus2
 });
 import { statSync as statSync4, existsSync as existsSync16 } from "node:fs";
-import WebSocket4 from "ws";
+import WebSocket3 from "ws";
 async function probeBroker(url, timeoutMs = 4000) {
   return new Promise((resolve2) => {
     const started = Date.now();
-    const ws = new WebSocket4(url);
+    const ws = new WebSocket3(url);
     const timer = setTimeout(() => {
       try {
         ws.terminate();
@@ -16402,7 +16608,7 @@ var require_client = __commonJS((exports) => {
   var ws_1 = __importDefault(__require("ws"));
   var crypto_js_1 = require_crypto();
   var MAX_QUEUED2 = 100;
-  var HELLO_ACK_TIMEOUT_MS4 = 5000;
+  var HELLO_ACK_TIMEOUT_MS2 = 5000;
   var BACKOFF_CAPS2 = [1000, 2000, 4000, 8000, 16000, 30000];
 
   class MeshClient extends node_events_1.EventEmitter {
@@ -16467,7 +16673,7 @@ var require_client = __commonJS((exports) => {
             this.debug("hello_ack timeout");
             ws.close();
             reject(new Error("hello_ack timeout"));
-          }, HELLO_ACK_TIMEOUT_MS4);
+          }, HELLO_ACK_TIMEOUT_MS2);
         };
         const onMessage = (raw) => {
           let msg;
@@ -19479,7 +19685,7 @@ async function main() {
     }
     case "inbox": {
       const { runInbox: runInbox2 } = await Promise.resolve().then(() => (init_inbox(), exports_inbox));
-      await runInbox2({ json: !!flags.json });
+      await runInbox2({ mesh: flags.mesh, json: !!flags.json, limit: typeof flags.limit === "number" ? flags.limit : typeof flags.limit === "string" ? Number.parseInt(flags.limit, 10) : undefined });
       break;
     }
     case "state": {
@@ -19734,7 +19940,7 @@ async function main() {
         await runSend2({ mesh: flags.mesh, priority: flags.priority, json: !!flags.json, self: !!flags.self }, positionals[1] ?? "", positionals.slice(2).join(" "));
       } else if (sub === "inbox") {
         const { runInbox: runInbox2 } = await Promise.resolve().then(() => (init_inbox(), exports_inbox));
-        await runInbox2({ json: !!flags.json });
+        await runInbox2({ mesh: flags.mesh, json: !!flags.json, limit: typeof flags.limit === "number" ? flags.limit : typeof flags.limit === "string" ? Number.parseInt(flags.limit, 10) : undefined });
       } else if (sub === "status") {
         const { runMsgStatus: runMsgStatus2 } = await Promise.resolve().then(() => (init_broker_actions(), exports_broker_actions));
         process.exit(await runMsgStatus2(positionals[1], { mesh: flags.mesh, json: !!flags.json }));
@@ -20287,4 +20493,4 @@ main().catch((err) => {
   process.exit(EXIT.INTERNAL_ERROR);
 });
 
-//# debugId=FAFB4F8D5ECBBBB864756E2164756E21
+//# debugId=55E9142D00D4EE3764756E2164756E21