claudemesh-cli 1.34.18 → 1.35.1

package/dist/entrypoints/cli.js

@@ -104,7 +104,7 @@ __export(exports_urls, {
   VERSION: () => VERSION,
   URLS: () => URLS
 });
-var URLS, VERSION = "1.34.18", env;
+var URLS, VERSION = "1.35.1", env;
 var init_urls = __esm(() => {
   URLS = {
     BROKER: process.env.CLAUDEMESH_BROKER_URL ?? "wss://ic.claudemesh.com/ws",
@@ -4337,6 +4337,76 @@ var init_session_hello_sig = __esm(() => {
   DEFAULT_ATTESTATION_TTL_MS = 12 * 60 * 60 * 1000;
 });
 
+// src/services/session/keypair-store.ts
+var exports_keypair_store = {};
+__export(exports_keypair_store, {
+  sessionsDir: () => sessionsDir,
+  loadOrCreateSessionKeypair: () => loadOrCreateSessionKeypair
+});
+import { randomBytes as randomBytes6 } from "node:crypto";
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync7, renameSync as renameSync2, rmSync, writeFileSync as writeFileSync7 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { join as join5 } from "node:path";
+function sessionsDir() {
+  return process.env.CLAUDEMESH_SESSIONS_DIR || join5(homedir5(), ".claudemesh", "sessions");
+}
+function keyFilePath(meshSlug, sessionId) {
+  return join5(sessionsDir(), meshSlug, `${sessionId}.json`);
+}
+function readValidKeypair(file) {
+  try {
+    if (!existsSync8(file))
+      return null;
+    const parsed = JSON.parse(readFileSync7(file, "utf8"));
+    if (parsed && typeof parsed.publicKey === "string" && /^[0-9a-f]{64}$/.test(parsed.publicKey) && typeof parsed.secretKey === "string" && /^[0-9a-f]{128}$/.test(parsed.secretKey)) {
+      return { publicKey: parsed.publicKey, secretKey: parsed.secretKey };
+    }
+  } catch {}
+  return null;
+}
+async function loadOrCreateSessionKeypair(meshSlug, sessionId) {
+  if (!SLUG_RE.test(meshSlug) || !UUID_RE.test(sessionId)) {
+    return generateKeypair3();
+  }
+  const file = keyFilePath(meshSlug, sessionId);
+  const existing = readValidKeypair(file);
+  if (existing)
+    return existing;
+  const kp = await generateKeypair3();
+  try {
+    mkdirSync4(join5(sessionsDir(), meshSlug), { recursive: true, mode: 448 });
+    const stored = {
+      version: 1,
+      meshSlug,
+      sessionId,
+      publicKey: kp.publicKey,
+      secretKey: kp.secretKey,
+      createdAt: new Date().toISOString()
+    };
+    const tmp = `${file}.${randomBytes6(6).toString("hex")}.tmp`;
+    writeFileSync7(tmp, JSON.stringify(stored), { mode: 384 });
+    try {
+      if (existsSync8(file)) {
+        const won = readValidKeypair(file);
+        if (won) {
+          try {
+            rmSync(tmp, { force: true });
+          } catch {}
+          return won;
+        }
+      }
+      renameSync2(tmp, file);
+    } catch {}
+  } catch {}
+  return kp;
+}
+var UUID_RE, SLUG_RE;
+var init_keypair_store = __esm(() => {
+  init_facade7();
+  UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  SLUG_RE = /^[a-z0-9._-]+$/i;
+});
+
 // src/commands/launch.ts
 var exports_launch = {};
 __export(exports_launch, {
@@ -4344,10 +4414,33 @@ __export(exports_launch, {
 });
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { mkdtempSync, writeFileSync as writeFileSync7, rmSync, readdirSync, statSync as statSync2, existsSync as existsSync8, readFileSync as readFileSync7 } from "node:fs";
-import { tmpdir, hostname as hostname2, homedir as homedir5 } from "node:os";
-import { join as join5 } from "node:path";
+import { mkdtempSync, writeFileSync as writeFileSync8, rmSync as rmSync2, readdirSync, statSync as statSync2, existsSync as existsSync9, readFileSync as readFileSync8 } from "node:fs";
+import { tmpdir, hostname as hostname2, homedir as homedir6 } from "node:os";
+import { join as join6 } from "node:path";
 import { createInterface as createInterface4 } from "node:readline";
+function resolveLatestSessionUuid(cwd) {
+  try {
+    const slug = cwd.replace(/\//g, "-");
+    const dir = join6(homedir6(), ".claude", "projects", slug);
+    if (!existsSync9(dir))
+      return;
+    const uuidRe = /^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$/i;
+    let newest = null;
+    for (const entry of readdirSync(dir)) {
+      const m = uuidRe.exec(entry);
+      if (!m)
+        continue;
+      try {
+        const mtime = statSync2(join6(dir, entry)).mtimeMs;
+        if (!newest || mtime > newest.mtime)
+          newest = { id: m[1], mtime };
+      } catch {}
+    }
+    return newest?.id;
+  } catch {
+    return;
+  }
+}
 async function ensureDaemonRunning(meshSlug, quiet) {
   const { ensureDaemonReady: ensureDaemonReady2 } = await Promise.resolve().then(() => (init_lifecycle(), exports_lifecycle));
   if (!quiet)
@@ -4743,17 +4836,17 @@ async function runLaunch(flags, rawArgs) {
     for (const entry of readdirSync(tmpBase)) {
       if (!entry.startsWith("claudemesh-"))
         continue;
-      const full = join5(tmpBase, entry);
+      const full = join6(tmpBase, entry);
       const age = Date.now() - statSync2(full).mtimeMs;
       if (age > 3600000)
-        rmSync(full, { recursive: true, force: true });
+        rmSync2(full, { recursive: true, force: true });
     }
   } catch {}
   await ensureDaemonRunning(mesh.slug, args.quiet);
   try {
-    const claudeConfigPath = join5(homedir5(), ".claude.json");
-    if (existsSync8(claudeConfigPath)) {
-      const claudeConfig = JSON.parse(readFileSync7(claudeConfigPath, "utf-8"));
+    const claudeConfigPath = join6(homedir6(), ".claude.json");
+    if (existsSync9(claudeConfigPath)) {
+      const claudeConfig = JSON.parse(readFileSync8(claudeConfigPath, "utf-8"));
       const mcpServers = claudeConfig.mcpServers ?? {};
       let cleaned = 0;
       for (const key of Object.keys(mcpServers)) {
@@ -4771,7 +4864,7 @@ async function runLaunch(flags, rawArgs) {
       }
       if (cleaned > 0) {
         claudeConfig.mcpServers = mcpServers;
-        writeFileSync7(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
+        writeFileSync8(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
 `, "utf-8");
       }
     }
@@ -4788,7 +4881,7 @@ async function runLaunch(flags, rawArgs) {
       console.log("  (Could not fetch service catalog — mesh services won't be natively available)");
     }
   }
-  const tmpDir = mkdtempSync(join5(tmpdir(), "claudemesh-"));
+  const tmpDir = mkdtempSync(join6(tmpdir(), "claudemesh-"));
   const sessionConfig = {
     version: 1,
     meshes: [mesh],
@@ -4797,10 +4890,18 @@ async function runLaunch(flags, rawArgs) {
     ...parsedGroups.length > 0 ? { groups: parsedGroups } : {},
     messageMode
   };
-  writeFileSync7(join5(tmpDir, "config.json"), JSON.stringify(sessionConfig, null, 2) + `
-`, "utf-8");
+  writeFileSync8(join6(tmpDir, "config.json"), JSON.stringify(sessionConfig, null, 2) + `
+`, { encoding: "utf-8", mode: 384 });
   const isResume = args.resume !== null || args.continueSession;
-  const claudeSessionId = isResume ? undefined : randomUUID();
+  let claudeSessionId;
+  if (args.resume) {
+    claudeSessionId = args.resume;
+  } else if (args.continueSession) {
+    claudeSessionId = resolveLatestSessionUuid(process.cwd());
+  } else {
+    claudeSessionId = randomUUID();
+  }
+  const passSessionIdFlag = !isResume;
   let sessionTokenFilePath = null;
   let sessionTokenForCleanup = null;
   try {
@@ -4812,7 +4913,7 @@ async function runLaunch(flags, rawArgs) {
     try {
       const { generateKeypair: generateKeypair4 } = await Promise.resolve().then(() => (init_facade7(), exports_facade4));
       const { signParentAttestation: signParentAttestation2 } = await Promise.resolve().then(() => (init_session_hello_sig(), exports_session_hello_sig));
-      const sessionKp = await generateKeypair4();
+      const sessionKp = claudeSessionId ? await (await Promise.resolve().then(() => (init_keypair_store(), exports_keypair_store))).loadOrCreateSessionKeypair(mesh.slug, claudeSessionId) : await generateKeypair4();
       const att = await signParentAttestation2({
         parentMemberPubkey: mesh.pubkey,
         parentSecretKey: mesh.secretKey,
@@ -4858,10 +4959,10 @@ async function runLaunch(flags, rawArgs) {
   }
   const meshMcpEntries = [];
   if (serviceCatalog.length > 0) {
-    const claudeConfigPath = join5(homedir5(), ".claude.json");
+    const claudeConfigPath = join6(homedir6(), ".claude.json");
     let claudeConfig = {};
     try {
-      claudeConfig = JSON.parse(readFileSync7(claudeConfigPath, "utf-8"));
+      claudeConfig = JSON.parse(readFileSync8(claudeConfigPath, "utf-8"));
     } catch {
       claudeConfig = {};
     }
@@ -4888,7 +4989,7 @@ async function runLaunch(flags, rawArgs) {
       meshMcpEntries.push({ key: entryKey, entry });
     }
     claudeConfig.mcpServers = mcpServers;
-    writeFileSync7(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
+    writeFileSync8(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
 `, "utf-8");
     if (!args.quiet && meshMcpEntries.length > 0) {
       console.log(`  ${meshMcpEntries.length} mesh service(s) registered as native MCPs:`);
@@ -4912,7 +5013,7 @@ async function runLaunch(flags, rawArgs) {
   const claudeArgs = [
     "--dangerously-load-development-channels",
     "server:claudemesh",
-    ...claudeSessionId ? ["--session-id", claudeSessionId] : [],
+    ...passSessionIdFlag && claudeSessionId ? ["--session-id", claudeSessionId] : [],
     ...args.resume ? ["--resume", args.resume] : [],
     ...args.continueSession ? ["--continue"] : [],
     ...args.skipPermConfirm ? ["--dangerously-skip-permissions"] : [],
@@ -4923,12 +5024,12 @@ async function runLaunch(flags, rawArgs) {
   let claudeBin = "claude";
   if (!isWindows2) {
     const candidates = [
-      join5(homedir5(), ".local", "bin", "claude"),
+      join6(homedir6(), ".local", "bin", "claude"),
       "/usr/local/bin/claude",
-      join5(homedir5(), ".claude", "bin", "claude")
+      join6(homedir6(), ".claude", "bin", "claude")
     ];
     for (const c of candidates) {
-      if (existsSync8(c)) {
+      if (existsSync9(c)) {
         claudeBin = c;
         break;
       }
@@ -4937,19 +5038,19 @@ async function runLaunch(flags, rawArgs) {
   const cleanup = () => {
     if (meshMcpEntries.length > 0) {
       try {
-        const claudeConfigPath = join5(homedir5(), ".claude.json");
-        const claudeConfig = JSON.parse(readFileSync7(claudeConfigPath, "utf-8"));
+        const claudeConfigPath = join6(homedir6(), ".claude.json");
+        const claudeConfig = JSON.parse(readFileSync8(claudeConfigPath, "utf-8"));
         const mcpServers = claudeConfig.mcpServers ?? {};
         for (const { key } of meshMcpEntries) {
           delete mcpServers[key];
         }
         claudeConfig.mcpServers = mcpServers;
-        writeFileSync7(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
+        writeFileSync8(claudeConfigPath, JSON.stringify(claudeConfig, null, 2) + `
 `, "utf-8");
       } catch {}
     }
     try {
-      rmSync(tmpDir, { recursive: true, force: true });
+      rmSync2(tmpDir, { recursive: true, force: true });
     } catch {}
   };
   process.on("exit", cleanup);
@@ -5642,9 +5743,9 @@ __export(exports_join, {
   runJoin: () => runJoin
 });
 import sodium3 from "libsodium-wrappers";
-import { writeFileSync as writeFileSync8, mkdirSync as mkdirSync4 } from "node:fs";
-import { join as join6, dirname as dirname3 } from "node:path";
-import { homedir as homedir6, hostname as hostname3 } from "node:os";
+import { writeFileSync as writeFileSync9, mkdirSync as mkdirSync5 } from "node:fs";
+import { join as join7, dirname as dirname3 } from "node:path";
+import { homedir as homedir7, hostname as hostname3 } from "node:os";
 function deriveAppBaseUrl() {
   const override = process.env.CLAUDEMESH_APP_URL;
   if (override)
@@ -5763,11 +5864,11 @@ async function runJoin(args) {
     joinedAt: new Date().toISOString()
   });
   writeConfig(config);
-  const configDir = env.CLAUDEMESH_CONFIG_DIR ?? join6(homedir6(), ".claudemesh");
-  const inviteFile = join6(configDir, `invite-${payload.mesh_slug}.txt`);
+  const configDir = env.CLAUDEMESH_CONFIG_DIR ?? join7(homedir7(), ".claudemesh");
+  const inviteFile = join7(configDir, `invite-${payload.mesh_slug}.txt`);
   try {
-    mkdirSync4(dirname3(inviteFile), { recursive: true });
-    writeFileSync8(inviteFile, link, "utf-8");
+    mkdirSync5(dirname3(inviteFile), { recursive: true });
+    writeFileSync9(inviteFile, link, "utf-8");
   } catch {}
   console.log("");
   console.log(`✓ Joined "${payload.mesh_slug}" as ${displayName}${enroll.alreadyMember ? " (already a member — re-enrolled with same pubkey)" : ""}`);
@@ -6013,7 +6114,7 @@ async function rename(oldSlug, newSlug) {
     console.error(`  ${icons.cross} Usage: ${bold("claudemesh rename")} <old-slug> <new-slug>`);
     return EXIT.INVALID_ARGS;
   }
-  if (!SLUG_RE.test(newSlug)) {
+  if (!SLUG_RE2.test(newSlug)) {
     console.error(`  ${icons.cross} Invalid slug: must be 2-32 chars, lowercase alnum + hyphens, start with alnum`);
     return EXIT.INVALID_ARGS;
   }
@@ -6064,7 +6165,7 @@ async function rename(oldSlug, newSlug) {
     return EXIT.INTERNAL_ERROR;
   }
 }
-var SLUG_RE;
+var SLUG_RE2;
 var init_rename2 = __esm(() => {
   init_facade10();
   init_facade6();
@@ -6072,7 +6173,7 @@ var init_rename2 = __esm(() => {
   init_facade();
   init_styles();
   init_exit_codes();
-  SLUG_RE = /^[a-z0-9][a-z0-9-]{1,31}$/;
+  SLUG_RE2 = /^[a-z0-9][a-z0-9-]{1,31}$/;
 });
 
 // src/services/clipboard/read.ts
@@ -9272,12 +9373,12 @@ var init_whoami = __esm(() => {
 });
 
 // src/daemon/lock.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync8, unlinkSync as unlinkSync3, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync9, unlinkSync as unlinkSync3, writeFileSync as writeFileSync10 } from "node:fs";
 import { dirname as dirname4 } from "node:path";
 function acquireSingletonLock() {
-  mkdirSync5(dirname4(DAEMON_PATHS.PID_FILE), { recursive: true, mode: 448 });
-  if (existsSync9(DAEMON_PATHS.PID_FILE)) {
-    const raw = readFileSync8(DAEMON_PATHS.PID_FILE, "utf8").trim();
+  mkdirSync6(dirname4(DAEMON_PATHS.PID_FILE), { recursive: true, mode: 448 });
+  if (existsSync10(DAEMON_PATHS.PID_FILE)) {
+    const raw = readFileSync9(DAEMON_PATHS.PID_FILE, "utf8").trim();
     const oldPid = Number.parseInt(raw, 10);
     if (Number.isFinite(oldPid) && oldPid > 0 && isProcessAlive(oldPid)) {
       return { result: "already-running", pid: oldPid };
@@ -9285,22 +9386,22 @@ function acquireSingletonLock() {
     try {
       unlinkSync3(DAEMON_PATHS.PID_FILE);
     } catch {}
-    writeFileSync9(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
+    writeFileSync10(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
     return { result: "stale", pid: process.pid };
   }
-  writeFileSync9(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
+  writeFileSync10(DAEMON_PATHS.PID_FILE, String(process.pid), { mode: 384 });
   return { result: "acquired", pid: process.pid };
 }
 function releaseSingletonLock() {
   try {
-    const raw = readFileSync8(DAEMON_PATHS.PID_FILE, "utf8").trim();
+    const raw = readFileSync9(DAEMON_PATHS.PID_FILE, "utf8").trim();
     if (Number.parseInt(raw, 10) === process.pid)
       unlinkSync3(DAEMON_PATHS.PID_FILE);
   } catch {}
 }
 function readRunningPid() {
   try {
-    const raw = readFileSync8(DAEMON_PATHS.PID_FILE, "utf8").trim();
+    const raw = readFileSync9(DAEMON_PATHS.PID_FILE, "utf8").trim();
     const pid = Number.parseInt(raw, 10);
     if (Number.isFinite(pid) && pid > 0 && isProcessAlive(pid))
       return pid;
@@ -9990,7 +10091,7 @@ var init_session_registry = __esm(() => {
 
 // src/daemon/ipc/server.ts
 import { createServer as createServer2 } from "node:http";
-import { chmodSync as chmodSync3, existsSync as existsSync10, unlinkSync as unlinkSync4 } from "node:fs";
+import { chmodSync as chmodSync3, existsSync as existsSync11, unlinkSync as unlinkSync4 } from "node:fs";
 import { timingSafeEqual } from "node:crypto";
 import { randomUUID as randomUUID3 } from "node:crypto";
 function startIpcServer(opts) {
@@ -10006,7 +10107,7 @@ function startIpcServer(opts) {
     meshConfigs: opts.meshConfigs,
     onPendingInserted: opts.onPendingInserted
   });
-  if (existsSync10(DAEMON_PATHS.SOCK_FILE)) {
+  if (existsSync11(DAEMON_PATHS.SOCK_FILE)) {
     try {
       unlinkSync4(DAEMON_PATHS.SOCK_FILE);
     } catch {}
@@ -10833,16 +10934,16 @@ function parseSendRequest(body, idempotencyHeader) {
 }
 async function resolveAndEncrypt(req, broker, meshSecretKey, meshSlug) {
   const { encryptDirect: encryptDirect2 } = await Promise.resolve().then(() => (init_box(), exports_box));
-  const { randomBytes: randomBytes6 } = await import("node:crypto");
+  const { randomBytes: randomBytes7 } = await import("node:crypto");
   const to = req.to.trim();
   if (to.startsWith("#") && /^#[0-9a-z_-]{20,}$/i.test(to)) {
     const ciphertext = Buffer.from(req.message, "utf8").toString("base64");
-    const nonce = randomBytes6(24).toString("base64");
+    const nonce = randomBytes7(24).toString("base64");
     return { target_spec: to, ciphertext, nonce, mesh: meshSlug ?? "" };
   }
   if (to.startsWith("@") || to === "*") {
     const ciphertext = Buffer.from(req.message, "utf8").toString("base64");
-    const nonce = randomBytes6(24).toString("base64");
+    const nonce = randomBytes7(24).toString("base64");
     return { target_spec: to, ciphertext, nonce, mesh: meshSlug ?? "" };
   }
   if (/^[0-9a-f]{64}$/i.test(to)) {
@@ -11863,8 +11964,8 @@ function bufferToHex(b) {
   return s;
 }
 async function randomNonce2() {
-  const { randomBytes: randomBytes6 } = await import("node:crypto");
-  return randomBytes6(24).toString("base64");
+  const { randomBytes: randomBytes7 } = await import("node:crypto");
+  return randomBytes7(24).toString("base64");
 }
 function defaultLog4(level, msg, meta) {
   const line = JSON.stringify({ level, msg, ...meta, ts: new Date().toISOString() });
@@ -12039,13 +12140,13 @@ __export(exports_identity, {
   __resetHostIdCacheForTests: () => __resetHostIdCacheForTests,
   __computeV1FingerprintForTests: () => __computeV1FingerprintForTests
 });
-import { existsSync as existsSync11, readFileSync as readFileSync9, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync10, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join8 } from "node:path";
 import { createHash as createHash2 } from "node:crypto";
 import { execFileSync } from "node:child_process";
 import { networkInterfaces } from "node:os";
 function path() {
-  return join7(DAEMON_PATHS.DAEMON_DIR, FILE_NAME);
+  return join8(DAEMON_PATHS.DAEMON_DIR, FILE_NAME);
 }
 function computeCurrentFingerprint() {
   const host_id = readHostIdV2() ?? "";
@@ -12060,13 +12161,13 @@ function computeCurrentFingerprint() {
 }
 function checkFingerprint() {
   const current = computeCurrentFingerprint();
-  if (!existsSync11(path())) {
-    writeFileSync10(path(), JSON.stringify(current, null, 2), { mode: 384 });
+  if (!existsSync12(path())) {
+    writeFileSync11(path(), JSON.stringify(current, null, 2), { mode: 384 });
     return { result: "first_run", current };
   }
   let stored;
   try {
-    stored = JSON.parse(readFileSync9(path(), "utf8"));
+    stored = JSON.parse(readFileSync10(path(), "utf8"));
   } catch {
     return { result: "unavailable", current };
   }
@@ -12074,7 +12175,7 @@ function checkFingerprint() {
     if (stored.fingerprint === current.fingerprint)
       return { result: "match", current, stored };
     if (stored.host_id && stored.host_id === current.host_id) {
-      writeFileSync10(path(), JSON.stringify(current, null, 2), { mode: 384 });
+      writeFileSync11(path(), JSON.stringify(current, null, 2), { mode: 384 });
       return { result: "match", current, stored };
     }
     return { result: "mismatch", current, stored };
@@ -12082,7 +12183,7 @@ function checkFingerprint() {
   if (stored.schema_version === 1) {
     const v1 = computeCurrentFingerprintV1();
     if (stored.fingerprint === v1.fingerprint) {
-      writeFileSync10(path(), JSON.stringify(current, null, 2), { mode: 384 });
+      writeFileSync11(path(), JSON.stringify(current, null, 2), { mode: 384 });
       return { result: "match", current, stored };
     }
     return { result: "mismatch", current, stored };
@@ -12091,7 +12192,7 @@ function checkFingerprint() {
 }
 function acceptCurrentHost() {
   const current = computeCurrentFingerprint();
-  writeFileSync10(path(), JSON.stringify(current, null, 2), { mode: 384 });
+  writeFileSync11(path(), JSON.stringify(current, null, 2), { mode: 384 });
   return current;
 }
 function fingerprintV2(host_id, stable_mac) {
@@ -12141,7 +12242,7 @@ function readHostIdV1() {
   if (process.platform === "linux") {
     for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
       try {
-        const raw = readFileSync9(p, "utf8").trim();
+        const raw = readFileSync10(p, "utf8").trim();
         if (raw)
           return `linux:${raw}`;
       } catch {}
@@ -12187,7 +12288,7 @@ function readHostIdV2Uncached() {
   if (process.platform === "linux") {
     for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
       try {
-        const raw = readFileSync9(p, "utf8").trim();
+        const raw = readFileSync10(p, "utf8").trim();
         if (raw)
           return `linux:${raw}`;
       } catch {}
@@ -12230,23 +12331,23 @@ var init_identity = __esm(() => {
 });
 
 // src/daemon/run.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync6, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync7, readFileSync as readFileSync11 } from "node:fs";
 function detectContainer() {
   if (process.env.KUBERNETES_SERVICE_HOST)
     return true;
   if (process.env.CONTAINER === "1")
     return true;
   try {
-    if (existsSync12("/.dockerenv"))
+    if (existsSync13("/.dockerenv"))
       return true;
-    const cg = readFileSync10("/proc/1/cgroup", "utf8");
+    const cg = readFileSync11("/proc/1/cgroup", "utf8");
     if (/(docker|kubepods|containerd)/.test(cg))
       return true;
   } catch {}
   return false;
 }
 async function runDaemon(opts = {}) {
-  mkdirSync6(DAEMON_PATHS.DAEMON_DIR, { recursive: true, mode: 448 });
+  mkdirSync7(DAEMON_PATHS.DAEMON_DIR, { recursive: true, mode: 448 });
   const lock = acquireSingletonLock();
   if (lock.result === "already-running") {
     process.stderr.write(`daemon already running (pid ${lock.pid})
@@ -12389,6 +12490,17 @@ async function runDaemon(opts = {}) {
         }
         prior.close().catch(() => {});
       }
+      const priorByPubkey = sessionBrokersByPubkey.get(info.presence.sessionPubkey);
+      if (priorByPubkey && priorByPubkey !== prior) {
+        for (const [tok, c] of sessionBrokers) {
+          if (c === priorByPubkey) {
+            sessionBrokers.delete(tok);
+            break;
+          }
+        }
+        sessionBrokersByPubkey.delete(info.presence.sessionPubkey);
+        priorByPubkey.close().catch(() => {});
+      }
       const sessionSecretKeyHex = info.presence.sessionSecretKey;
       const sessionPubkeyHex = info.presence.sessionPubkey;
       const client = new SessionBrokerClient({
@@ -12525,10 +12637,10 @@ __export(exports_service_install, {
   installService: () => installService,
   detectPlatform: () => detectPlatform
 });
-import { existsSync as existsSync13, mkdirSync as mkdirSync7, writeFileSync as writeFileSync11, unlinkSync as unlinkSync5, readFileSync as readFileSync11 } from "node:fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync8, writeFileSync as writeFileSync12, unlinkSync as unlinkSync5, readFileSync as readFileSync12 } from "node:fs";
 import { execSync as execSync2 } from "node:child_process";
-import { homedir as homedir7 } from "node:os";
-import { join as join8, dirname as dirname5 } from "node:path";
+import { homedir as homedir8 } from "node:os";
+import { join as join9, dirname as dirname5 } from "node:path";
 function detectPlatform() {
   if (process.platform === "darwin")
     return "darwin";
@@ -12546,10 +12658,10 @@ function installService(args) {
   if (isCi() && !args.allowCi) {
     throw new Error("Refusing to install persistent service in CI; pass --allow-ci-persistent to override.");
   }
-  if (!existsSync13(args.binaryPath)) {
+  if (!existsSync14(args.binaryPath)) {
     throw new Error(`binary not found at ${args.binaryPath}`);
   }
-  mkdirSync7(DAEMON_PATHS.DAEMON_DIR, { recursive: true, mode: 448 });
+  mkdirSync8(DAEMON_PATHS.DAEMON_DIR, { recursive: true, mode: 448 });
   if (platform5 === "darwin")
     return installDarwin(args);
   return installLinux(args);
@@ -12562,7 +12674,7 @@ function uninstallService() {
     try {
       execSync2(`launchctl bootout gui/$(id -u)/${SERVICE_LABEL2}`, { stdio: "ignore" });
     } catch {}
-    if (existsSync13(p)) {
+    if (existsSync14(p)) {
       unlinkSync5(p);
       removed.push(p);
     }
@@ -12571,7 +12683,7 @@ function uninstallService() {
     try {
       execSync2(`systemctl --user disable --now ${SYSTEMD_UNIT2}`, { stdio: "ignore" });
     } catch {}
-    if (existsSync13(p)) {
+    if (existsSync14(p)) {
       unlinkSync5(p);
       removed.push(p);
     }
@@ -12579,11 +12691,11 @@ function uninstallService() {
   return { platform: platform5, removed };
 }
 function darwinPlistPath() {
-  return join8(homedir7(), "Library", "LaunchAgents", `${SERVICE_LABEL2}.plist`);
+  return join9(homedir8(), "Library", "LaunchAgents", `${SERVICE_LABEL2}.plist`);
 }
 function installDarwin(args) {
   const plist = darwinPlistPath();
-  mkdirSync7(dirname5(plist), { recursive: true });
+  mkdirSync8(dirname5(plist), { recursive: true });
   const log2 = DAEMON_PATHS.LOG_FILE;
   const nodeBin = process.execPath;
   const meshArgs = [
@@ -12615,25 +12727,25 @@ function installDarwin(args) {
   <key>StandardErrorPath</key>
   <string>${escapeXml(log2)}</string>
   <key>WorkingDirectory</key>
-  <string>${escapeXml(homedir7())}</string>
+  <string>${escapeXml(homedir8())}</string>
   <key>EnvironmentVariables</key>
   <dict>
     <key>HOME</key>
-    <string>${escapeXml(homedir7())}</string>
+    <string>${escapeXml(homedir8())}</string>
     <key>PATH</key>
     <string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
   </dict>
 </dict>
 </plist>
 `;
-  writeFileSync11(plist, xml, { mode: 420 });
+  writeFileSync12(plist, xml, { mode: 420 });
   try {
     execSync2(`launchctl bootout gui/$(id -u)/${SERVICE_LABEL2}`, { stdio: "ignore" });
   } catch {}
   try {
     const pidPath = DAEMON_PATHS.PID_FILE;
-    if (existsSync13(pidPath)) {
-      const pid = parseInt(readFileSync11(pidPath, "utf8").trim(), 10);
+    if (existsSync14(pidPath)) {
+      const pid = parseInt(readFileSync12(pidPath, "utf8").trim(), 10);
       if (Number.isFinite(pid) && pid > 0) {
         try {
           process.kill(pid, "SIGTERM");
@@ -12648,11 +12760,11 @@ function installDarwin(args) {
   };
 }
 function linuxUnitPath() {
-  return join8(homedir7(), ".config", "systemd", "user", SYSTEMD_UNIT2);
+  return join9(homedir8(), ".config", "systemd", "user", SYSTEMD_UNIT2);
 }
 function installLinux(args) {
   const unit = linuxUnitPath();
-  mkdirSync7(dirname5(unit), { recursive: true });
+  mkdirSync8(dirname5(unit), { recursive: true });
   const nodeBin = process.execPath;
   const execArgs = [
     "daemon",
@@ -12678,14 +12790,14 @@ Environment=PATH=/usr/local/bin:/usr/bin:/bin
 [Install]
 WantedBy=default.target
 `;
-  writeFileSync11(unit, content, { mode: 420 });
+  writeFileSync12(unit, content, { mode: 420 });
   try {
     execSync2(`systemctl --user stop ${SYSTEMD_UNIT2}`, { stdio: "ignore" });
   } catch {}
   try {
     const pidPath = DAEMON_PATHS.PID_FILE;
-    if (existsSync13(pidPath)) {
-      const pid = parseInt(readFileSync11(pidPath, "utf8").trim(), 10);
+    if (existsSync14(pidPath)) {
+      const pid = parseInt(readFileSync12(pidPath, "utf8").trim(), 10);
       if (Number.isFinite(pid) && pid > 0) {
         try {
           process.kill(pid, "SIGTERM");
@@ -12712,10 +12824,10 @@ function readInstalledUnit() {
   if (!platform5)
     return { platform: null, path: null, content: null };
   const path2 = platform5 === "darwin" ? darwinPlistPath() : linuxUnitPath();
-  if (!existsSync13(path2))
+  if (!existsSync14(path2))
     return { platform: platform5, path: null, content: null };
   try {
-    return { platform: platform5, path: path2, content: readFileSync11(path2, "utf8") };
+    return { platform: platform5, path: path2, content: readFileSync12(path2, "utf8") };
   } catch {
     return { platform: platform5, path: path2, content: null };
   }
@@ -12731,8 +12843,8 @@ __export(exports_daemon, {
   runDaemonCommand: () => runDaemonCommand
 });
 import { spawn } from "node:child_process";
-import { existsSync as existsSync14, openSync as openSync3, mkdirSync as mkdirSync8 } from "node:fs";
-import { join as join9 } from "node:path";
+import { existsSync as existsSync15, openSync as openSync3, mkdirSync as mkdirSync9 } from "node:fs";
+import { join as join10 } from "node:path";
 async function runDaemonCommand(sub, opts, rest = []) {
   switch (sub) {
     case undefined:
@@ -13054,8 +13166,8 @@ async function runStop(opts) {
   return 1;
 }
 async function spawnDetachedDaemon(opts) {
-  mkdirSync8(DAEMON_PATHS.DAEMON_DIR, { recursive: true, mode: 448 });
-  const logPath = join9(DAEMON_PATHS.DAEMON_DIR, "daemon.log");
+  mkdirSync9(DAEMON_PATHS.DAEMON_DIR, { recursive: true, mode: 448 });
+  const logPath = join10(DAEMON_PATHS.DAEMON_DIR, "daemon.log");
   const binary = process.argv[1] ?? "claudemesh";
   const args = ["daemon", "up", "--foreground"];
   if (opts.noTcp)
@@ -13073,7 +13185,7 @@ async function spawnDetachedDaemon(opts) {
   const sockPath = DAEMON_PATHS.SOCK_FILE;
   const startedAt = Date.now();
   while (Date.now() - startedAt < 3000) {
-    if (existsSync14(sockPath)) {
+    if (existsSync15(sockPath)) {
       if (opts.json) {
         process.stdout.write(JSON.stringify({ ok: true, detached: true, pid: child.pid, log: logPath }) + `
 `);
@@ -13118,19 +13230,19 @@ __export(exports_install, {
 import {
   chmodSync as chmodSync4,
   copyFileSync,
-  existsSync as existsSync15,
-  mkdirSync as mkdirSync9,
-  readFileSync as readFileSync12,
-  writeFileSync as writeFileSync12
+  existsSync as existsSync16,
+  mkdirSync as mkdirSync10,
+  readFileSync as readFileSync13,
+  writeFileSync as writeFileSync13
 } from "node:fs";
-import { homedir as homedir8, platform as platform5 } from "node:os";
-import { dirname as dirname6, join as join10, resolve } from "node:path";
+import { homedir as homedir9, platform as platform5 } from "node:os";
+import { dirname as dirname6, join as join11, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync as spawnSync3 } from "node:child_process";
 function readClaudeConfig() {
-  if (!existsSync15(CLAUDE_CONFIG))
+  if (!existsSync16(CLAUDE_CONFIG))
     return {};
-  const text = readFileSync12(CLAUDE_CONFIG, "utf-8").trim();
+  const text = readFileSync13(CLAUDE_CONFIG, "utf-8").trim();
   if (!text)
     return {};
   try {
@@ -13140,12 +13252,12 @@ function readClaudeConfig() {
   }
 }
 function backupClaudeConfig() {
-  if (!existsSync15(CLAUDE_CONFIG))
+  if (!existsSync16(CLAUDE_CONFIG))
     return;
-  const backupDir = join10(dirname6(CLAUDE_CONFIG), ".claude", "backups");
-  mkdirSync9(backupDir, { recursive: true });
+  const backupDir = join11(dirname6(CLAUDE_CONFIG), ".claude", "backups");
+  mkdirSync10(backupDir, { recursive: true });
   const ts = Date.now();
-  const dest = join10(backupDir, `.claude.json.pre-claudemesh.${ts}`);
+  const dest = join11(backupDir, `.claude.json.pre-claudemesh.${ts}`);
   copyFileSync(CLAUDE_CONFIG, dest);
 }
 function patchMcpServer(entry) {
@@ -13169,7 +13281,7 @@ function patchMcpServer(entry) {
   return action;
 }
 function removeMcpServer() {
-  if (!existsSync15(CLAUDE_CONFIG))
+  if (!existsSync16(CLAUDE_CONFIG))
     return false;
   backupClaudeConfig();
   const cfg = readClaudeConfig();
@@ -13182,8 +13294,8 @@ function removeMcpServer() {
   return true;
 }
 function flushClaudeConfig(obj) {
-  mkdirSync9(dirname6(CLAUDE_CONFIG), { recursive: true });
-  writeFileSync12(CLAUDE_CONFIG, JSON.stringify(obj, null, 2) + `
+  mkdirSync10(dirname6(CLAUDE_CONFIG), { recursive: true });
+  writeFileSync13(CLAUDE_CONFIG, JSON.stringify(obj, null, 2) + `
 `, "utf-8");
   try {
     chmodSync4(CLAUDE_CONFIG, 384);
@@ -13205,8 +13317,8 @@ function resolveEntry() {
 function resolveBundledSkillsDir() {
   const here = fileURLToPath(import.meta.url);
   const pkgRoot = resolve(dirname6(here), "..", "..");
-  const skillsDir = join10(pkgRoot, "skills");
-  if (existsSync15(skillsDir))
+  const skillsDir = join11(pkgRoot, "skills");
+  if (existsSync16(skillsDir))
     return skillsDir;
   return null;
 }
@@ -13219,13 +13331,13 @@ function installSkills() {
   for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
     if (!entry.isDirectory())
       continue;
-    const srcDir = join10(src, entry.name);
-    const dstDir = join10(CLAUDE_SKILLS_ROOT, entry.name);
-    mkdirSync9(dstDir, { recursive: true });
+    const srcDir = join11(src, entry.name);
+    const dstDir = join11(CLAUDE_SKILLS_ROOT, entry.name);
+    mkdirSync10(dstDir, { recursive: true });
     for (const file of fs.readdirSync(srcDir, { withFileTypes: true })) {
       if (!file.isFile())
         continue;
-      copyFileSync(join10(srcDir, file.name), join10(dstDir, file.name));
+      copyFileSync(join11(srcDir, file.name), join11(dstDir, file.name));
     }
     installed.push(entry.name);
   }
@@ -13240,8 +13352,8 @@ function uninstallSkills() {
   for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
     if (!entry.isDirectory())
       continue;
-    const dstDir = join10(CLAUDE_SKILLS_ROOT, entry.name);
-    if (existsSync15(dstDir)) {
+    const dstDir = join11(CLAUDE_SKILLS_ROOT, entry.name);
+    if (existsSync16(dstDir)) {
       try {
         fs.rmSync(dstDir, { recursive: true, force: true });
         removed.push(entry.name);
@@ -13266,9 +13378,9 @@ function entriesEqual(a, b) {
   return a.command === b.command && JSON.stringify(a.args ?? []) === JSON.stringify(b.args ?? []);
 }
 function readClaudeSettings() {
-  if (!existsSync15(CLAUDE_SETTINGS))
+  if (!existsSync16(CLAUDE_SETTINGS))
     return {};
-  const text = readFileSync12(CLAUDE_SETTINGS, "utf-8").trim();
+  const text = readFileSync13(CLAUDE_SETTINGS, "utf-8").trim();
   if (!text)
     return {};
   try {
@@ -13278,8 +13390,8 @@ function readClaudeSettings() {
   }
 }
 function writeClaudeSettings(obj) {
-  mkdirSync9(dirname6(CLAUDE_SETTINGS), { recursive: true });
-  writeFileSync12(CLAUDE_SETTINGS, JSON.stringify(obj, null, 2) + `
+  mkdirSync10(dirname6(CLAUDE_SETTINGS), { recursive: true });
+  writeFileSync13(CLAUDE_SETTINGS, JSON.stringify(obj, null, 2) + `
 `, "utf-8");
 }
 function installAllowedTools() {
@@ -13293,7 +13405,7 @@ function installAllowedTools() {
   return { added: toAdd, unchanged: CLAUDEMESH_TOOLS.length - toAdd.length };
 }
 function uninstallAllowedTools() {
-  if (!existsSync15(CLAUDE_SETTINGS))
+  if (!existsSync16(CLAUDE_SETTINGS))
     return 0;
   const settings = readClaudeSettings();
   const existing = settings.allowedTools ?? [];
@@ -13328,7 +13440,7 @@ function installHooks() {
   return { added, unchanged };
 }
 function uninstallHooks() {
-  if (!existsSync15(CLAUDE_SETTINGS))
+  if (!existsSync16(CLAUDE_SETTINGS))
     return 0;
   const settings = readClaudeSettings();
   const hooks2 = settings.hooks;
@@ -13378,7 +13490,7 @@ async function runInstall(args = []) {
     render.err("`bun` is not on PATH.", "Install Bun first: https://bun.com");
     process.exit(1);
   }
-  if (!existsSync15(entry)) {
+  if (!existsSync16(entry)) {
     render.err(`MCP entry not found at ${entry}`);
     process.exit(1);
   }
@@ -13429,7 +13541,7 @@ async function runInstall(args = []) {
       const installed = installSkills();
       if (installed.length > 0) {
         render.ok(`Claude skill${installed.length === 1 ? "" : "s"} installed`, installed.join(", "));
-        render.info(dim(`  ${join10(CLAUDE_SKILLS_ROOT, installed[0])}/SKILL.md`));
+        render.info(dim(`  ${join11(CLAUDE_SKILLS_ROOT, installed[0])}/SKILL.md`));
       }
     } catch (e) {
       render.warn(`skill install failed: ${e instanceof Error ? e.message : String(e)}`);
@@ -13592,9 +13704,9 @@ var init_install = __esm(() => {
   init_facade();
   init_render();
   init_styles();
-  CLAUDE_CONFIG = join10(homedir8(), ".claude.json");
-  CLAUDE_SETTINGS = join10(homedir8(), ".claude", "settings.json");
-  CLAUDE_SKILLS_ROOT = join10(homedir8(), ".claude", "skills");
+  CLAUDE_CONFIG = join11(homedir9(), ".claude.json");
+  CLAUDE_SETTINGS = join11(homedir9(), ".claude", "settings.json");
+  CLAUDE_SKILLS_ROOT = join11(homedir9(), ".claude", "skills");
   CLAUDEMESH_TOOLS = [
     "mcp__claudemesh__cancel_scheduled",
     "mcp__claudemesh__check_messages",
@@ -13649,35 +13761,35 @@ var exports_uninstall = {};
 __export(exports_uninstall, {
   uninstall: () => uninstall
 });
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync13, existsSync as existsSync16, rmSync as rmSync2, readdirSync as readdirSync2 } from "node:fs";
-import { join as join11, dirname as dirname7 } from "node:path";
-import { homedir as homedir9 } from "node:os";
+import { readFileSync as readFileSync14, writeFileSync as writeFileSync14, existsSync as existsSync17, rmSync as rmSync3, readdirSync as readdirSync2 } from "node:fs";
+import { join as join12, dirname as dirname7 } from "node:path";
+import { homedir as homedir10 } from "node:os";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function bundledSkillsDir() {
   const here = fileURLToPath2(import.meta.url);
-  const pkgRoot = join11(dirname7(here), "..", "..");
-  const skillsDir = join11(pkgRoot, "skills");
-  return existsSync16(skillsDir) ? skillsDir : null;
+  const pkgRoot = join12(dirname7(here), "..", "..");
+  const skillsDir = join12(pkgRoot, "skills");
+  return existsSync17(skillsDir) ? skillsDir : null;
 }
 async function uninstall() {
   let removed = 0;
-  if (existsSync16(PATHS.CLAUDE_JSON)) {
+  if (existsSync17(PATHS.CLAUDE_JSON)) {
     try {
-      const raw = readFileSync13(PATHS.CLAUDE_JSON, "utf-8");
+      const raw = readFileSync14(PATHS.CLAUDE_JSON, "utf-8");
       const config = JSON.parse(raw);
       const servers = config.mcpServers;
       if (servers && "claudemesh" in servers) {
         delete servers.claudemesh;
-        writeFileSync13(PATHS.CLAUDE_JSON, JSON.stringify(config, null, 2) + `
+        writeFileSync14(PATHS.CLAUDE_JSON, JSON.stringify(config, null, 2) + `
 `, "utf-8");
         render.ok("removed MCP server", dim("~/.claude.json"));
         removed++;
       }
     } catch {}
   }
-  if (existsSync16(PATHS.CLAUDE_SETTINGS)) {
+  if (existsSync17(PATHS.CLAUDE_SETTINGS)) {
     try {
-      const raw = readFileSync13(PATHS.CLAUDE_SETTINGS, "utf-8");
+      const raw = readFileSync14(PATHS.CLAUDE_SETTINGS, "utf-8");
       const config = JSON.parse(raw);
       const hooks2 = config.hooks;
       if (hooks2) {
@@ -13698,7 +13810,7 @@ async function uninstall() {
           }
         }
         if (removedHooks > 0) {
-          writeFileSync13(PATHS.CLAUDE_SETTINGS, JSON.stringify(config, null, 2) + `
+          writeFileSync14(PATHS.CLAUDE_SETTINGS, JSON.stringify(config, null, 2) + `
 `, "utf-8");
           render.ok(`removed ${removedHooks} claudemesh hook${removedHooks === 1 ? "" : "s"}`, dim("settings.json"));
           removed++;
@@ -13713,10 +13825,10 @@ async function uninstall() {
       for (const entry of readdirSync2(src, { withFileTypes: true })) {
         if (!entry.isDirectory())
           continue;
-        const dst = join11(CLAUDE_SKILLS_ROOT2, entry.name);
-        if (existsSync16(dst)) {
+        const dst = join12(CLAUDE_SKILLS_ROOT2, entry.name);
+        if (existsSync17(dst)) {
           try {
-            rmSync2(dst, { recursive: true, force: true });
+            rmSync3(dst, { recursive: true, force: true });
             removedSkills.push(entry.name);
           } catch {}
         }
@@ -13738,7 +13850,7 @@ var init_uninstall = __esm(() => {
   init_render();
   init_styles();
   init_exit_codes();
-  CLAUDE_SKILLS_ROOT2 = join11(homedir9(), ".claude", "skills");
+  CLAUDE_SKILLS_ROOT2 = join12(homedir10(), ".claude", "skills");
 });
 
 // src/commands/doctor.ts
@@ -13746,9 +13858,9 @@ var exports_doctor = {};
 __export(exports_doctor, {
   runDoctor: () => runDoctor
 });
-import { existsSync as existsSync17, readFileSync as readFileSync14, statSync as statSync3 } from "node:fs";
-import { homedir as homedir10, platform as platform6 } from "node:os";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync18, readFileSync as readFileSync15, statSync as statSync3 } from "node:fs";
+import { homedir as homedir11, platform as platform6 } from "node:os";
+import { join as join13 } from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function checkNode() {
   const major = Number(process.versions.node.split(".")[0]);
@@ -13772,8 +13884,8 @@ function checkClaudeOnPath() {
   };
 }
 function checkMcpRegistered() {
-  const claudeConfig = join12(homedir10(), ".claude.json");
-  if (!existsSync17(claudeConfig)) {
+  const claudeConfig = join13(homedir11(), ".claude.json");
+  if (!existsSync18(claudeConfig)) {
     return {
       name: "claudemesh MCP registered in ~/.claude.json",
       pass: false,
@@ -13781,7 +13893,7 @@ function checkMcpRegistered() {
     };
   }
   try {
-    const cfg = JSON.parse(readFileSync14(claudeConfig, "utf-8"));
+    const cfg = JSON.parse(readFileSync15(claudeConfig, "utf-8"));
     const registered = Boolean(cfg.mcpServers?.["claudemesh"]);
     return {
       name: "claudemesh MCP registered in ~/.claude.json",
@@ -13798,8 +13910,8 @@ function checkMcpRegistered() {
   }
 }
 function checkHooksRegistered() {
-  const settings = join12(homedir10(), ".claude", "settings.json");
-  if (!existsSync17(settings)) {
+  const settings = join13(homedir11(), ".claude", "settings.json");
+  if (!existsSync18(settings)) {
     return {
       name: "Status hooks registered in ~/.claude/settings.json",
       pass: false,
@@ -13807,7 +13919,7 @@ function checkHooksRegistered() {
     };
   }
   try {
-    const raw = readFileSync14(settings, "utf-8");
+    const raw = readFileSync15(settings, "utf-8");
     const has = raw.includes("claudemesh hook ");
     return {
       name: "Status hooks registered in ~/.claude/settings.json",
@@ -13824,7 +13936,7 @@ function checkHooksRegistered() {
 }
 function checkConfigFile() {
   const path2 = getConfigPath();
-  if (!existsSync17(path2)) {
+  if (!existsSync18(path2)) {
     return {
       name: "~/.claudemesh/config.json exists and parses",
       pass: true,
@@ -14007,7 +14119,7 @@ var exports_status = {};
 __export(exports_status, {
   runStatus: () => runStatus2
 });
-import { statSync as statSync4, existsSync as existsSync18 } from "node:fs";
+import { statSync as statSync4, existsSync as existsSync19 } from "node:fs";
 import WebSocket3 from "ws";
 async function probeBroker(url, timeoutMs = 4000) {
   return new Promise((resolve2) => {
@@ -14037,7 +14149,7 @@ async function runStatus2() {
   render.section(`status (v${VERSION})`);
   const configPath = getConfigPath();
   let configPermsNote = "missing";
-  if (existsSync18(configPath)) {
+  if (existsSync19(configPath)) {
     const mode = (statSync4(configPath).mode & 511).toString(8).padStart(4, "0");
     configPermsNote = mode === "0600" ? `${mode}` : `${mode} — expected 0600`;
   }
@@ -14183,13 +14295,13 @@ var init_check_claude_binary = __esm(() => {
 });
 
 // src/services/health/check-mcp-registered.ts
-import { existsSync as existsSync19, readFileSync as readFileSync15 } from "node:fs";
+import { existsSync as existsSync20, readFileSync as readFileSync16 } from "node:fs";
 function checkMcpRegistered2() {
   try {
-    if (!existsSync19(PATHS.CLAUDE_JSON)) {
+    if (!existsSync20(PATHS.CLAUDE_JSON)) {
       return { name: "mcp-registered", ok: false, message: "~/.claude.json not found" };
     }
-    const raw = readFileSync15(PATHS.CLAUDE_JSON, "utf-8");
+    const raw = readFileSync16(PATHS.CLAUDE_JSON, "utf-8");
     const config = JSON.parse(raw);
     if (config.mcpServers && "claudemesh" in config.mcpServers) {
       return { name: "mcp-registered", ok: true, message: "MCP server registered" };
@@ -14204,13 +14316,13 @@ var init_check_mcp_registered = __esm(() => {
 });
 
 // src/services/health/check-hooks-registered.ts
-import { existsSync as existsSync20, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync21, readFileSync as readFileSync17 } from "node:fs";
 function checkHooksRegistered2() {
   try {
-    if (!existsSync20(PATHS.CLAUDE_SETTINGS)) {
+    if (!existsSync21(PATHS.CLAUDE_SETTINGS)) {
       return { name: "hooks-registered", ok: false, message: "~/.claude/settings.json not found" };
     }
-    const raw = readFileSync16(PATHS.CLAUDE_SETTINGS, "utf-8");
+    const raw = readFileSync17(PATHS.CLAUDE_SETTINGS, "utf-8");
     const config = JSON.parse(raw);
     if (config.hooks) {
       return { name: "hooks-registered", ok: true, message: "Hooks configured" };
@@ -14225,10 +14337,10 @@ var init_check_hooks_registered = __esm(() => {
 });
 
 // src/services/health/check-config-perms.ts
-import { existsSync as existsSync21, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync22, statSync as statSync5 } from "node:fs";
 function checkConfigPerms() {
   const configFile = PATHS.CONFIG_FILE;
-  if (!existsSync21(configFile)) {
+  if (!existsSync22(configFile)) {
     return { name: "config-perms", ok: true, message: "No config file yet (first run)" };
   }
   try {
@@ -14246,13 +14358,13 @@ var init_check_config_perms = __esm(() => {
 });
 
 // src/services/health/check-keypairs-valid.ts
-import { existsSync as existsSync22, readFileSync as readFileSync17 } from "node:fs";
+import { existsSync as existsSync23, readFileSync as readFileSync18 } from "node:fs";
 function checkKeypairsValid() {
-  if (!existsSync22(PATHS.CONFIG_FILE)) {
+  if (!existsSync23(PATHS.CONFIG_FILE)) {
     return { name: "keypairs-valid", ok: true, message: "No config (first run)" };
   }
   try {
-    const raw = readFileSync17(PATHS.CONFIG_FILE, "utf-8");
+    const raw = readFileSync18(PATHS.CONFIG_FILE, "utf-8");
     const config = JSON.parse(raw);
     const meshes = config.meshes ?? [];
     if (meshes.length === 0) {
@@ -14732,19 +14844,19 @@ var exports_url_handler = {};
 __export(exports_url_handler, {
   runUrlHandler: () => runUrlHandler
 });
-import { platform as platform7, homedir as homedir11 } from "node:os";
-import { existsSync as existsSync23, mkdirSync as mkdirSync10, writeFileSync as writeFileSync14, rmSync as rmSync3, chmodSync as chmodSync5 } from "node:fs";
-import { join as join13 } from "node:path";
+import { platform as platform7, homedir as homedir12 } from "node:os";
+import { existsSync as existsSync24, mkdirSync as mkdirSync11, writeFileSync as writeFileSync15, rmSync as rmSync4, chmodSync as chmodSync5 } from "node:fs";
+import { join as join14 } from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function resolveClaudemeshBin() {
   return process.argv[1] ?? "claudemesh";
 }
 function installDarwin2() {
   const binPath = resolveClaudemeshBin();
-  const appDir = join13(homedir11(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
-  const contents = join13(appDir, "Contents");
-  const macOS = join13(contents, "MacOS");
-  mkdirSync10(macOS, { recursive: true });
+  const appDir = join14(homedir12(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
+  const contents = join14(appDir, "Contents");
+  const macOS = join14(contents, "MacOS");
+  mkdirSync11(macOS, { recursive: true });
   const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -14767,7 +14879,7 @@ function installDarwin2() {
   </array>
 </dict>
 </plist>`;
-  writeFileSync14(join13(contents, "Info.plist"), plist);
+  writeFileSync15(join14(contents, "Info.plist"), plist);
   const shim = `#!/bin/sh
 URL="$1"
 CODE=\${URL#claudemesh://}
@@ -14781,8 +14893,8 @@ tell application "Terminal"
 end tell
 EOF
 `;
-  const shimPath = join13(macOS, "open-url");
-  writeFileSync14(shimPath, shim);
+  const shimPath = join14(macOS, "open-url");
+  writeFileSync15(shimPath, shim);
   chmodSync5(shimPath, 493);
   const lsreg = spawnSync5("/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister", ["-f", appDir], { encoding: "utf-8" });
   if (lsreg.status !== 0) {
@@ -14793,8 +14905,8 @@ EOF
 }
 function installLinux2() {
   const binPath = resolveClaudemeshBin();
-  const appsDir = join13(homedir11(), ".local", "share", "applications");
-  mkdirSync10(appsDir, { recursive: true });
+  const appsDir = join14(homedir12(), ".local", "share", "applications");
+  mkdirSync11(appsDir, { recursive: true });
   const desktop = `[Desktop Entry]
 Type=Application
 Name=Claudemesh
@@ -14805,8 +14917,8 @@ Terminal=true
 MimeType=x-scheme-handler/claudemesh;
 NoDisplay=true
 `;
-  const desktopPath = join13(appsDir, "claudemesh.desktop");
-  writeFileSync14(desktopPath, desktop);
+  const desktopPath = join14(appsDir, "claudemesh.desktop");
+  writeFileSync15(desktopPath, desktop);
   const xdg1 = spawnSync5("xdg-mime", ["default", "claudemesh.desktop", "x-scheme-handler/claudemesh"], { encoding: "utf-8" });
   if (xdg1.status !== 0) {
     render.warn("xdg-mime not available — skipped mime default registration");
@@ -14828,8 +14940,8 @@ function installWindows() {
     `[HKEY_CURRENT_USER\\Software\\Classes\\claudemesh\\shell\\open\\command]`,
     `@="\\"${binPath.replace(/\\/g, "\\\\")}\\" \\"%1\\""`
   ];
-  const regPath = join13(homedir11(), "claudemesh-handler.reg");
-  writeFileSync14(regPath, lines.join(`\r
+  const regPath = join14(homedir12(), "claudemesh-handler.reg");
+  writeFileSync15(regPath, lines.join(`\r
 `));
   const res = spawnSync5("reg.exe", ["import", regPath], { encoding: "utf-8" });
   if (res.status !== 0) {
@@ -14840,16 +14952,16 @@ function installWindows() {
   return EXIT.SUCCESS;
 }
 function uninstallDarwin() {
-  const appDir = join13(homedir11(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
-  if (existsSync23(appDir))
-    rmSync3(appDir, { recursive: true, force: true });
+  const appDir = join14(homedir12(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
+  if (existsSync24(appDir))
+    rmSync4(appDir, { recursive: true, force: true });
   render.ok("removed claudemesh:// handler on macOS");
   return EXIT.SUCCESS;
 }
 function uninstallLinux() {
-  const desktopPath = join13(homedir11(), ".local", "share", "applications", "claudemesh.desktop");
-  if (existsSync23(desktopPath))
-    rmSync3(desktopPath, { force: true });
+  const desktopPath = join14(homedir12(), ".local", "share", "applications", "claudemesh.desktop");
+  if (existsSync24(desktopPath))
+    rmSync4(desktopPath, { force: true });
   render.ok("removed claudemesh:// handler on Linux");
   return EXIT.SUCCESS;
 }
@@ -14893,9 +15005,9 @@ var exports_status_line = {};
 __export(exports_status_line, {
   runStatusLine: () => runStatusLine
 });
-import { existsSync as existsSync24, readFileSync as readFileSync18 } from "node:fs";
-import { join as join14 } from "node:path";
-import { homedir as homedir12 } from "node:os";
+import { existsSync as existsSync25, readFileSync as readFileSync19 } from "node:fs";
+import { join as join15 } from "node:path";
+import { homedir as homedir13 } from "node:os";
 async function runStatusLine() {
   try {
     const config = readConfig();
@@ -14903,11 +15015,11 @@ async function runStatusLine() {
       process.stdout.write("◇ claudemesh (not joined)");
       return EXIT.SUCCESS;
     }
-    const cachePath = join14(homedir12(), ".claudemesh", "peer-cache.json");
+    const cachePath = join15(homedir13(), ".claudemesh", "peer-cache.json");
     let cache = {};
-    if (existsSync24(cachePath)) {
+    if (existsSync25(cachePath)) {
       try {
-        cache = JSON.parse(readFileSync18(cachePath, "utf-8"));
+        cache = JSON.parse(readFileSync19(cachePath, "utf-8"));
       } catch {}
     }
     const pick = config.meshes[0];
@@ -14938,7 +15050,7 @@ __export(exports_backup, {
   runRestore: () => runRestore,
   runBackup: () => runBackup
 });
-import { readFileSync as readFileSync19, writeFileSync as writeFileSync15, existsSync as existsSync25 } from "node:fs";
+import { readFileSync as readFileSync20, writeFileSync as writeFileSync16, existsSync as existsSync26 } from "node:fs";
 import { createInterface as createInterface11 } from "node:readline";
 function readHidden(prompt5) {
   return new Promise((resolve2) => {
@@ -14980,11 +15092,11 @@ async function deriveKey(pass, salt, s) {
 }
 async function runBackup(outPath) {
   const configPath = getConfigPath();
-  if (!existsSync25(configPath)) {
+  if (!existsSync26(configPath)) {
     console.error("  No config found — nothing to back up. Join a mesh first.");
     return EXIT.NOT_FOUND;
   }
-  const plaintext = readFileSync19(configPath);
+  const plaintext = readFileSync20(configPath);
   const pass = await readHidden("  Passphrase (min 12 chars): ");
   if (pass.length < 12) {
     console.error("  ✗ Passphrase too short.");
@@ -15002,7 +15114,7 @@ async function runBackup(outPath) {
   const ciphertext = Buffer.from(s.crypto_aead_xchacha20poly1305_ietf_encrypt(plaintext, null, null, nonce, key));
   const blob = Buffer.concat([MAGIC, salt, nonce, ciphertext]);
   const file = outPath ?? `claudemesh-backup-${new Date().toISOString().replace(/[:.]/g, "-")}.cmb`;
-  writeFileSync15(file, blob, { mode: 384 });
+  writeFileSync16(file, blob, { mode: 384 });
   console.log(`
   ✓ Backup saved: ${file}`);
   console.log(`  Size: ${blob.length} bytes. Guard the passphrase — there is no recovery.
@@ -15014,11 +15126,11 @@ async function runRestore(inPath) {
     console.error("  Usage: claudemesh restore <backup-file>");
     return EXIT.INVALID_ARGS;
   }
-  if (!existsSync25(inPath)) {
+  if (!existsSync26(inPath)) {
     console.error(`  ✗ File not found: ${inPath}`);
     return EXIT.NOT_FOUND;
   }
-  const blob = readFileSync19(inPath);
+  const blob = readFileSync20(inPath);
   if (blob.length < 4 + 16 + 24 + 17 || !blob.subarray(0, 4).equals(MAGIC)) {
     console.error("  ✗ Not a claudemesh backup file (bad magic).");
     return EXIT.INVALID_ARGS;
@@ -15037,12 +15149,12 @@ async function runRestore(inPath) {
     return EXIT.INTERNAL_ERROR;
   }
   const configPath = getConfigPath();
-  if (existsSync25(configPath)) {
+  if (existsSync26(configPath)) {
     const backupOld = `${configPath}.before-restore.${Date.now()}`;
-    writeFileSync15(backupOld, readFileSync19(configPath), { mode: 384 });
+    writeFileSync16(backupOld, readFileSync20(configPath), { mode: 384 });
     console.log(`  ↻ Existing config saved to ${backupOld}`);
   }
-  writeFileSync15(configPath, Buffer.from(plaintext), { mode: 384 });
+  writeFileSync16(configPath, Buffer.from(plaintext), { mode: 384 });
   console.log(`
   ✓ Config restored to ${configPath}`);
   console.log("  Run `claudemesh list` to verify your meshes.\n");
@@ -15062,8 +15174,8 @@ __export(exports_upgrade, {
   runUpgrade: () => runUpgrade
 });
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync26 } from "node:fs";
-import { dirname as dirname8, join as join15, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync27 } from "node:fs";
+import { dirname as dirname8, join as join16, resolve as resolve2 } from "node:path";
 async function latestVersion() {
   try {
     const res = await fetch(URLS.NPM_REGISTRY, { signal: AbortSignal.timeout(8000) });
@@ -15076,15 +15188,15 @@ async function latestVersion() {
   }
 }
 function findNpm() {
-  const portable = join15(process.env.HOME ?? "", ".claudemesh", "node", "bin", "npm");
-  if (existsSync26(portable)) {
-    return { npm: portable, prefix: join15(process.env.HOME ?? "", ".claudemesh") };
+  const portable = join16(process.env.HOME ?? "", ".claudemesh", "node", "bin", "npm");
+  if (existsSync27(portable)) {
+    return { npm: portable, prefix: join16(process.env.HOME ?? "", ".claudemesh") };
   }
   let cur = resolve2(process.argv[1] ?? ".");
   for (let i = 0;i < 6; i++) {
     cur = dirname8(cur);
-    const candidate = join15(cur, "bin", "npm");
-    if (existsSync26(candidate))
+    const candidate = join16(cur, "bin", "npm");
+    if (existsSync27(candidate))
       return { npm: candidate };
   }
   return { npm: "npm" };
@@ -15146,9 +15258,9 @@ __export(exports_grants, {
   runBlock: () => runBlock,
   isAllowed: () => isAllowed
 });
-import { existsSync as existsSync27, mkdirSync as mkdirSync11, readFileSync as readFileSync20, writeFileSync as writeFileSync16 } from "node:fs";
-import { homedir as homedir13 } from "node:os";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync12, readFileSync as readFileSync21, writeFileSync as writeFileSync17 } from "node:fs";
+import { homedir as homedir14 } from "node:os";
+import { join as join17 } from "node:path";
 async function syncToBroker(meshSlug, grants) {
   const auth = getStoredToken();
   if (!auth)
@@ -15166,19 +15278,19 @@ async function syncToBroker(meshSlug, grants) {
   }
 }
 function readGrants() {
-  if (!existsSync27(GRANT_FILE))
+  if (!existsSync28(GRANT_FILE))
     return {};
   try {
-    return JSON.parse(readFileSync20(GRANT_FILE, "utf-8"));
+    return JSON.parse(readFileSync21(GRANT_FILE, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeGrants(g) {
-  const dir = join16(homedir13(), ".claudemesh");
-  if (!existsSync27(dir))
-    mkdirSync11(dir, { recursive: true });
-  writeFileSync16(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
+  const dir = join17(homedir14(), ".claudemesh");
+  if (!existsSync28(dir))
+    mkdirSync12(dir, { recursive: true });
+  writeFileSync17(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
 }
 function resolveCaps(input) {
   if (input.includes("all"))
@@ -15334,7 +15446,7 @@ var init_grants = __esm(() => {
   BROKER_HTTP7 = URLS.BROKER.replace("wss://", "https://").replace("ws://", "http://").replace("/ws", "");
   ALL_CAPS = ["read", "dm", "broadcast", "state-read", "state-write", "file-read"];
   DEFAULT_CAPS = ["read", "dm", "broadcast", "state-read"];
-  GRANT_FILE = join16(homedir13(), ".claudemesh", "grants.json");
+  GRANT_FILE = join17(homedir14(), ".claudemesh", "grants.json");
 });
 
 // src/commands/profile.ts
@@ -17055,7 +17167,7 @@ __export(exports_file, {
 });
 import { hostname as osHostname2 } from "node:os";
 import { resolve as resolvePath, basename, dirname as dirname9 } from "node:path";
-import { statSync as statSync7, existsSync as existsSync28, writeFileSync as writeFileSync17, mkdirSync as mkdirSync12 } from "node:fs";
+import { statSync as statSync7, existsSync as existsSync29, writeFileSync as writeFileSync18, mkdirSync as mkdirSync13 } from "node:fs";
 function emitJson2(data) {
   console.log(JSON.stringify(data, null, 2));
 }
@@ -17072,7 +17184,7 @@ async function runFileShare(filePath, opts) {
     return EXIT.INVALID_ARGS;
   }
   const absPath = resolvePath(filePath);
-  if (!existsSync28(absPath)) {
+  if (!existsSync29(absPath)) {
     render.err(`File not found: ${absPath}`);
     return EXIT.INVALID_ARGS;
   }
@@ -17151,8 +17263,8 @@ async function runFileGet(fileId, opts) {
     }
     const buf = Buffer.from(await res.arrayBuffer());
     const outPath = opts.out ? resolvePath(opts.out) : resolvePath(process.cwd(), meta.name);
-    mkdirSync12(dirname9(outPath), { recursive: true });
-    writeFileSync17(outPath, buf);
+    mkdirSync13(dirname9(outPath), { recursive: true });
+    writeFileSync18(outPath, buf);
     if (opts.json) {
       emitJson2({ fileId, name: meta.name, savedTo: outPath, sizeBytes: buf.length });
     } else {
@@ -17762,7 +17874,7 @@ __export(exports_bridge, {
   runBridge: () => runBridge,
   bridgeConfigTemplate: () => bridgeConfigTemplate
 });
-import { readFileSync as readFileSync21, existsSync as existsSync29 } from "node:fs";
+import { readFileSync as readFileSync22, existsSync as existsSync30 } from "node:fs";
 function parseConfig(text) {
   const trimmed = text.trim();
   if (trimmed.startsWith("{"))
@@ -17806,13 +17918,13 @@ async function runBridge(configPath) {
     render.err("Usage: claudemesh bridge run <config.yaml>");
     return EXIT.INVALID_ARGS;
   }
-  if (!existsSync29(configPath)) {
+  if (!existsSync30(configPath)) {
     render.err(`config file not found: ${configPath}`);
     return EXIT.NOT_FOUND;
   }
   let cfg;
   try {
-    cfg = parseConfig(readFileSync21(configPath, "utf-8"));
+    cfg = parseConfig(readFileSync22(configPath, "utf-8"));
   } catch (e) {
     render.err(`failed to parse ${configPath}: ${e instanceof Error ? e.message : String(e)}`);
     return EXIT.INVALID_ARGS;
@@ -18786,12 +18898,12 @@ import {
   ListResourcesRequestSchema,
   ReadResourceRequestSchema
 } from "@modelcontextprotocol/sdk/types.js";
-import { existsSync as existsSync30, appendFileSync as appendFileSync2 } from "node:fs";
+import { existsSync as existsSync31, appendFileSync as appendFileSync2 } from "node:fs";
 import { request as httpRequest2 } from "node:http";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 async function daemonReady() {
   for (let i = 0;i < DAEMON_BOOT_RETRIES; i++) {
-    if (existsSync30(DAEMON_PATHS.SOCK_FILE))
+    if (existsSync31(DAEMON_PATHS.SOCK_FILE))
       return true;
     await new Promise((r) => setTimeout(r, DAEMON_BOOT_RETRY_MS));
   }
@@ -19065,7 +19177,7 @@ ${mf.allowed_tools.map((t) => `  - ${t}`).join(`
     return { contents: [{ uri, mimeType: "text/markdown", text: fm.join(`
 `) + skill.instructions }] };
   });
-  const mcpLogPath = join17(DAEMON_PATHS.DAEMON_DIR, `mcp-${process.pid}.log`);
+  const mcpLogPath = join18(DAEMON_PATHS.DAEMON_DIR, `mcp-${process.pid}.log`);
   const mcpLog = (msg, meta) => {
     const line = JSON.stringify({ ts: new Date().toISOString(), pid: process.pid, msg, ...meta }) + `
 `;
@@ -21392,4 +21504,4 @@ main().catch((err) => {
   process.exit(EXIT.INTERNAL_ERROR);
 });
 
-//# debugId=C8B9D377DC161E3E64756E2164756E21
+//# debugId=A7ECB4BF81F2B4CE64756E2164756E21