claudemesh-cli 1.35.1 → 1.37.0

package/dist/entrypoints/cli.js

@@ -104,7 +104,7 @@ __export(exports_urls, {
   VERSION: () => VERSION,
   URLS: () => URLS
 });
-var URLS, VERSION = "1.35.1", env;
+var URLS, VERSION = "1.37.0", env;
 var init_urls = __esm(() => {
   URLS = {
     BROKER: process.env.CLAUDEMESH_BROKER_URL ?? "wss://ic.claudemesh.com/ws",
@@ -3668,6 +3668,9 @@ var init_paths2 = __esm(() => {
     },
     get LOG_FILE() {
       return join3(this.DAEMON_DIR, "daemon.log");
+    },
+    get SESSIONS_FILE() {
+      return join3(this.DAEMON_DIR, "sessions.json");
     }
   };
 });
@@ -8195,12 +8198,12 @@ async function runPeers(flags) {
   for (const slug of slugs) {
     try {
       const peers = await listPeersForMesh(slug);
+      const visible = flags.all ? peers : peers.filter((p) => p.peerRole !== "control-plane");
       if (wantsJson) {
-        const projected = fieldList ? peers.map((p) => projectFields(p, fieldList)) : peers;
+        const projected = fieldList ? visible.map((p) => projectFields(p, fieldList)) : visible;
         allJson.push({ mesh: slug, peers: projected });
         continue;
       }
-      const visible = flags.all ? peers : peers.filter((p) => p.peerRole !== "control-plane");
       const sorted = visible.slice().sort((a, b) => {
         const score = (p) => p.isThisSession ? 0 : p.isSelf ? 1 : 2;
         return score(a) - score(b);
@@ -8274,37 +8277,64 @@ async function runSend(flags, to, message) {
   }
   const priority = flags.priority === "now" ? "now" : flags.priority === "low" ? "low" : "next";
   const config = readConfig();
-  const meshSlug = flags.mesh ?? (config.meshes.length === 1 ? config.meshes[0].slug : null);
-  if (!to.startsWith("@") && !to.startsWith("#") && to !== "*" && /^[0-9a-f]{4,63}$/i.test(to)) {
-    try {
-      const { tryListPeersViaDaemon: tryListPeersViaDaemon2 } = await Promise.resolve().then(() => (init_daemon_route(), exports_daemon_route));
-      const peers = await tryListPeersViaDaemon2() ?? [];
-      const lower = to.toLowerCase();
-      const matches2 = peers.filter((p) => {
-        const pk = p.pubkey ?? "";
-        const mpk = p.memberPubkey ?? "";
-        return pk.toLowerCase().startsWith(lower) || mpk.toLowerCase().startsWith(lower);
-      });
-      if (matches2.length === 0) {
-        render.err(`No peer matches hex prefix "${to}".`);
-        const names = peers.map((p) => p.displayName).filter(Boolean).join(", ");
-        if (names)
-          render.hint(`online: ${names}`);
-        process.exit(1);
-      }
-      if (matches2.length > 1) {
-        const candidates = matches2.map((p) => {
-          const pk = p.pubkey ?? "";
-          const dn = p.displayName ?? "?";
-          return `${dn} ${pk.slice(0, 16)}…`;
-        }).join(", ");
-        render.err(`Ambiguous hex prefix "${to}" — matches ${matches2.length} peers.`);
+  let meshSlug = flags.mesh ?? (config.meshes.length === 1 ? config.meshes[0].slug : null);
+  const isDirect = !to.startsWith("@") && !to.startsWith("#") && to !== "*";
+  const isFullPubkey = /^[0-9a-f]{64}$/i.test(to);
+  const isPrefix = /^[0-9a-f]{4,63}$/i.test(to);
+  const isName = isDirect && !isFullPubkey && !isPrefix;
+  if (isDirect && (isPrefix || isName || isFullPubkey && !meshSlug)) {
+    const { tryListPeersViaDaemon: tryListPeersViaDaemon2 } = await Promise.resolve().then(() => (init_daemon_route(), exports_daemon_route));
+    const searchSlugs = meshSlug ? [meshSlug] : config.meshes.map((m) => m.slug);
+    const lower = to.toLowerCase();
+    let daemonReachable2 = false;
+    const matches2 = [];
+    for (const slug of searchSlugs) {
+      const peers = await tryListPeersViaDaemon2(slug);
+      if (peers === null)
+        continue;
+      daemonReachable2 = true;
+      for (const p of peers) {
+        if (p.peerRole === "control-plane")
+          continue;
+        const pk = (p.pubkey ?? "").toLowerCase();
+        const mpk = (p.memberPubkey ?? "").toLowerCase();
+        const dn = p.displayName ?? "?";
+        const hit = isName ? dn.toLowerCase() === lower : pk.startsWith(lower) || mpk.startsWith(lower);
+        if (hit)
+          matches2.push({ slug, pubkey: p.pubkey ?? "", displayName: dn });
+      }
+    }
+    if (daemonReachable2) {
+      const byPubkey = new Map;
+      for (const m of matches2)
+        if (!byPubkey.has(m.pubkey))
+          byPubkey.set(m.pubkey, m);
+      const uniq = [...byPubkey.values()];
+      const meshesHit = [...new Set(uniq.map((m) => m.slug))];
+      if (uniq.length === 0) {
+        if (!isFullPubkey) {
+          render.err(`No peer matches "${to}"${flags.mesh ? ` on mesh "${flags.mesh}"` : " on any joined mesh"}.`);
+          render.hint("Check `claudemesh peer list` (add --mesh <slug> to scope).");
+          process.exit(1);
+        }
+      } else if (uniq.length > 1) {
+        if (meshesHit.length > 1 && !meshSlug) {
+          const where = uniq.map((m) => `${m.displayName} ${m.pubkey.slice(0, 12)}… @${m.slug}`).join(", ");
+          render.err(`"${to}" matches peers on ${meshesHit.length} meshes — pick one with --mesh <slug>.`);
+          render.hint(`candidates: ${where}`);
+          process.exit(1);
+        }
+        const candidates = uniq.map((m) => `${m.displayName} ${m.pubkey.slice(0, 16)}…`).join(", ");
+        render.err(`Ambiguous ${isName ? "name" : "prefix"} "${to}" — matches ${uniq.length} peers.`);
         render.hint(`candidates: ${candidates}`);
         render.hint("Use a longer prefix or paste the full 64-char pubkey.");
         process.exit(1);
+      } else {
+        meshSlug = uniq[0].slug;
+        if (!isFullPubkey)
+          to = uniq[0].pubkey;
       }
-      to = matches2[0].pubkey ?? to;
-    } catch {}
+    }
   }
   if (meshSlug) {
     const joined = config.meshes.find((m) => m.slug === meshSlug);
@@ -8327,7 +8357,7 @@ async function runSend(flags, to, message) {
             return false;
           if (ownSessionPk && r.pubkey.toLowerCase() === ownSessionPk)
             return false;
-          if (r.channel === "claudemesh-daemon")
+          if (r.peerRole === "control-plane" || r.channel === "claudemesh-daemon")
             return false;
           return r.memberPubkey?.toLowerCase() === to.toLowerCase();
         });
@@ -8374,14 +8404,40 @@ async function runSend(flags, to, message) {
       }
     }
   }
+  if (flags.self) {
+    render.warn("--self had no effect: it only applies when the target is your own member pubkey (fan-out to your sibling sessions). Sending to this specific pubkey directly.");
+  }
+  let recipientOnline = null;
+  let recipientName;
+  if (isDirect && meshSlug) {
+    const { tryListPeersViaDaemon: tryListPeersViaDaemon2 } = await Promise.resolve().then(() => (init_daemon_route(), exports_daemon_route));
+    const peers = await tryListPeersViaDaemon2(meshSlug);
+    if (peers !== null) {
+      const lower = to.toLowerCase();
+      const match = peers.find((p) => {
+        const r = p;
+        if (r.peerRole === "control-plane")
+          return false;
+        return r.pubkey?.toLowerCase() === lower || r.memberPubkey?.toLowerCase() === lower;
+      });
+      recipientOnline = !!match;
+      recipientName = match ? match.displayName : undefined;
+    }
+  }
+  const offlineHint = "Session pubkeys are ephemeral — a key from an ended session never reconnects, so the message can't be delivered. Re-fetch a live target with `claudemesh peer list --json`.";
   {
     const dr = await trySendViaDaemon({ to, message, priority, expectedMesh: meshSlug ?? undefined });
     if (dr !== null) {
       if (dr.ok) {
-        if (flags.json)
-          console.log(JSON.stringify({ ok: true, messageId: dr.messageId, target: to, via: "daemon", duplicate: !!dr.duplicate }));
-        else
-          render.ok(`sent to ${to} (daemon)`, dr.messageId ? dim(dr.messageId.slice(0, 8)) : undefined);
+        if (flags.json) {
+          console.log(JSON.stringify({ ok: true, messageId: dr.messageId, target: to, via: "daemon", duplicate: !!dr.duplicate, status: dr.status, recipientOnline }));
+        } else if (recipientOnline === false) {
+          render.warn(`queued for ${recipientName ?? to.slice(0, 16) + "…"} — no connected peer matches this key on "${meshSlug}".`);
+          render.hint(offlineHint);
+        } else {
+          const who = recipientName ? `${recipientName} (${to.slice(0, 16)}…)` : to;
+          render.ok(`sent to ${who}${recipientOnline === true ? " (online)" : " (daemon)"}`, dr.messageId ? dim(dr.messageId.slice(0, 8)) : undefined);
+        }
         return;
       }
       if (flags.json)
@@ -8391,7 +8447,7 @@ async function runSend(flags, to, message) {
       process.exit(1);
     }
   }
-  await withMesh({ meshSlug: flags.mesh ?? null }, async (client) => {
+  await withMesh({ meshSlug: meshSlug ?? flags.mesh ?? null }, async (client) => {
     let targetSpec = to;
     if (to.startsWith("#") && !/^#[0-9a-z_-]{20,}$/i.test(to)) {
       const name = to.slice(1);
@@ -8416,9 +8472,13 @@ async function runSend(flags, to, message) {
     const result = await client.send(targetSpec, message, priority);
     if (result.ok) {
       if (flags.json) {
-        console.log(JSON.stringify({ ok: true, messageId: result.messageId, target: to }));
+        console.log(JSON.stringify({ ok: true, messageId: result.messageId, target: to, recipientOnline }));
+      } else if (recipientOnline === false) {
+        render.warn(`queued for ${recipientName ?? to} — no connected peer matches this key on "${meshSlug ?? flags.mesh ?? "default"}".`);
+        render.hint(offlineHint);
       } else {
-        render.ok(`sent to ${to}`, result.messageId ? dim(result.messageId.slice(0, 8)) : undefined);
+        const who = recipientName ? `${recipientName} (${to.slice(0, 16)}…)` : to;
+        render.ok(`sent to ${who}${recipientOnline === true ? " (online)" : ""}`, result.messageId ? dim(result.messageId.slice(0, 8)) : undefined);
       }
     } else {
       if (flags.json) {
@@ -9924,6 +9984,12 @@ function bindSseStream(res, bus, filter = {}) {
 }
 
 // src/daemon/process-info.ts
+var exports_process_info = {};
+__export(exports_process_info, {
+  isPidAlive: () => isPidAlive,
+  getProcessStartTimes: () => getProcessStartTimes,
+  getProcessStartTime: () => getProcessStartTime
+});
 import { execFile as execFile2 } from "node:child_process";
 import { promisify } from "node:util";
 async function getProcessStartTime(pid) {
@@ -9979,6 +10045,37 @@ var init_process_info = __esm(() => {
 });
 
 // src/daemon/session-registry.ts
+import { existsSync as existsSync11, mkdirSync as mkdirSync7, readFileSync as readFileSync10, renameSync as renameSync3, writeFileSync as writeFileSync11 } from "node:fs";
+import { dirname as dirname5 } from "node:path";
+import { randomBytes as randomBytes7 } from "node:crypto";
+function toPersisted(info) {
+  const { presence: _presence, ...rest } = info;
+  return rest;
+}
+function setRegistryPersistence(path) {
+  persistPath = path;
+}
+function persist() {
+  if (!persistPath)
+    return;
+  try {
+    mkdirSync7(dirname5(persistPath), { recursive: true, mode: 448 });
+    const rows = [...byToken.values()].map(toPersisted);
+    const tmp = `${persistPath}.${randomBytes7(6).toString("hex")}.tmp`;
+    writeFileSync11(tmp, JSON.stringify({ version: 1, sessions: rows }), { mode: 384 });
+    renameSync3(tmp, persistPath);
+  } catch {}
+}
+function readPersistedSessions(path) {
+  try {
+    if (!existsSync11(path))
+      return [];
+    const parsed = JSON.parse(readFileSync10(path, "utf8"));
+    return Array.isArray(parsed.sessions) ? parsed.sessions : [];
+  } catch {
+    return [];
+  }
+}
 function startReaper() {
   if (reaperHandle)
     return;
@@ -10004,6 +10101,7 @@ function registerSession(info) {
   const stored = { ...info, registeredAt: Date.now() };
   byToken.set(info.token, stored);
   bySessionId.set(info.sessionId, info.token);
+  persist();
   try {
     hooks.onRegister?.(stored);
   } catch {}
@@ -10020,6 +10118,7 @@ async function captureStartTimeAsync(token, pid) {
   if (!entry || entry.pid !== pid)
     return;
   entry.startTime = lstart;
+  persist();
 }
 function deregisterByToken(token) {
   const entry = byToken.get(token);
@@ -10028,6 +10127,7 @@ function deregisterByToken(token) {
   byToken.delete(token);
   if (bySessionId.get(entry.sessionId) === token)
     bySessionId.delete(entry.sessionId);
+  persist();
   try {
     hooks.onDeregister?.(entry);
   } catch {}
@@ -10079,7 +10179,7 @@ async function reapDead() {
   for (const t of dead)
     deregisterByToken(t);
 }
-var TTL_MS, REAPER_INTERVAL_MS, byToken, bySessionId, hooks, reaperHandle = null;
+var TTL_MS, REAPER_INTERVAL_MS, byToken, bySessionId, hooks, reaperHandle = null, persistPath = null;
 var init_session_registry = __esm(() => {
   init_process_info();
   TTL_MS = 24 * 60 * 60 * 1000;
@@ -10091,7 +10191,7 @@ var init_session_registry = __esm(() => {
 
 // src/daemon/ipc/server.ts
 import { createServer as createServer2 } from "node:http";
-import { chmodSync as chmodSync3, existsSync as existsSync11, unlinkSync as unlinkSync4 } from "node:fs";
+import { chmodSync as chmodSync3, existsSync as existsSync12, unlinkSync as unlinkSync4 } from "node:fs";
 import { timingSafeEqual } from "node:crypto";
 import { randomUUID as randomUUID3 } from "node:crypto";
 function startIpcServer(opts) {
@@ -10107,7 +10207,7 @@ function startIpcServer(opts) {
     meshConfigs: opts.meshConfigs,
     onPendingInserted: opts.onPendingInserted
   });
-  if (existsSync11(DAEMON_PATHS.SOCK_FILE)) {
+  if (existsSync12(DAEMON_PATHS.SOCK_FILE)) {
     try {
       unlinkSync4(DAEMON_PATHS.SOCK_FILE);
     } catch {}
@@ -10934,16 +11034,16 @@ function parseSendRequest(body, idempotencyHeader) {
 }
 async function resolveAndEncrypt(req, broker, meshSecretKey, meshSlug) {
   const { encryptDirect: encryptDirect2 } = await Promise.resolve().then(() => (init_box(), exports_box));
-  const { randomBytes: randomBytes7 } = await import("node:crypto");
+  const { randomBytes: randomBytes8 } = await import("node:crypto");
   const to = req.to.trim();
   if (to.startsWith("#") && /^#[0-9a-z_-]{20,}$/i.test(to)) {
     const ciphertext = Buffer.from(req.message, "utf8").toString("base64");
-    const nonce = randomBytes7(24).toString("base64");
+    const nonce = randomBytes8(24).toString("base64");
     return { target_spec: to, ciphertext, nonce, mesh: meshSlug ?? "" };
   }
   if (to.startsWith("@") || to === "*") {
     const ciphertext = Buffer.from(req.message, "utf8").toString("base64");
-    const nonce = randomBytes7(24).toString("base64");
+    const nonce = randomBytes8(24).toString("base64");
     return { target_spec: to, ciphertext, nonce, mesh: meshSlug ?? "" };
   }
   if (/^[0-9a-f]{64}$/i.test(to)) {
@@ -11635,13 +11735,23 @@ class SessionBrokerClient {
           sessionPubkey: this.opts.sessionPubkey,
           sessionSecretKey: this.opts.sessionSecretKey
         });
+        let parentAttestation = this.opts.parentAttestation;
+        try {
+          parentAttestation = await signParentAttestation({
+            parentMemberPubkey: this.opts.mesh.pubkey,
+            parentSecretKey: this.opts.mesh.secretKey,
+            sessionPubkey: this.opts.sessionPubkey
+          });
+        } catch (e) {
+          this.log("warn", "parent attestation re-mint failed; reusing stored token (may be expired)", { err: String(e) });
+        }
         return {
           type: "session_hello",
           meshId: this.opts.mesh.meshId,
           parentMemberId: this.opts.mesh.memberId,
           parentMemberPubkey: this.opts.mesh.pubkey,
           sessionPubkey: this.opts.sessionPubkey,
-          parentAttestation: this.opts.parentAttestation,
+          parentAttestation,
           displayName: this.opts.displayName,
           sessionId: this.opts.sessionId,
           pid: this.opts.pid,
@@ -11964,8 +12074,8 @@ function bufferToHex(b) {
   return s;
 }
 async function randomNonce2() {
-  const { randomBytes: randomBytes7 } = await import("node:crypto");
-  return randomBytes7(24).toString("base64");
+  const { randomBytes: randomBytes8 } = await import("node:crypto");
+  return randomBytes8(24).toString("base64");
 }
 function defaultLog4(level, msg, meta) {
   const line = JSON.stringify({ level, msg, ...meta, ts: new Date().toISOString() });
@@ -12140,7 +12250,7 @@ __export(exports_identity, {
   __resetHostIdCacheForTests: () => __resetHostIdCacheForTests,
   __computeV1FingerprintForTests: () => __computeV1FingerprintForTests
 });
-import { existsSync as existsSync12, readFileSync as readFileSync10, writeFileSync as writeFileSync11 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync11, writeFileSync as writeFileSync12 } from "node:fs";
 import { join as join8 } from "node:path";
 import { createHash as createHash2 } from "node:crypto";
 import { execFileSync } from "node:child_process";
@@ -12161,13 +12271,13 @@ function computeCurrentFingerprint() {
 }
 function checkFingerprint() {
   const current = computeCurrentFingerprint();
-  if (!existsSync12(path())) {
-    writeFileSync11(path(), JSON.stringify(current, null, 2), { mode: 384 });
+  if (!existsSync13(path())) {
+    writeFileSync12(path(), JSON.stringify(current, null, 2), { mode: 384 });
     return { result: "first_run", current };
   }
   let stored;
   try {
-    stored = JSON.parse(readFileSync10(path(), "utf8"));
+    stored = JSON.parse(readFileSync11(path(), "utf8"));
   } catch {
     return { result: "unavailable", current };
   }
@@ -12175,7 +12285,7 @@ function checkFingerprint() {
     if (stored.fingerprint === current.fingerprint)
       return { result: "match", current, stored };
     if (stored.host_id && stored.host_id === current.host_id) {
-      writeFileSync11(path(), JSON.stringify(current, null, 2), { mode: 384 });
+      writeFileSync12(path(), JSON.stringify(current, null, 2), { mode: 384 });
       return { result: "match", current, stored };
     }
     return { result: "mismatch", current, stored };
@@ -12183,7 +12293,7 @@ function checkFingerprint() {
   if (stored.schema_version === 1) {
     const v1 = computeCurrentFingerprintV1();
     if (stored.fingerprint === v1.fingerprint) {
-      writeFileSync11(path(), JSON.stringify(current, null, 2), { mode: 384 });
+      writeFileSync12(path(), JSON.stringify(current, null, 2), { mode: 384 });
       return { result: "match", current, stored };
     }
     return { result: "mismatch", current, stored };
@@ -12192,7 +12302,7 @@ function checkFingerprint() {
 }
 function acceptCurrentHost() {
   const current = computeCurrentFingerprint();
-  writeFileSync11(path(), JSON.stringify(current, null, 2), { mode: 384 });
+  writeFileSync12(path(), JSON.stringify(current, null, 2), { mode: 384 });
   return current;
 }
 function fingerprintV2(host_id, stable_mac) {
@@ -12242,7 +12352,7 @@ function readHostIdV1() {
   if (process.platform === "linux") {
     for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
       try {
-        const raw = readFileSync10(p, "utf8").trim();
+        const raw = readFileSync11(p, "utf8").trim();
         if (raw)
           return `linux:${raw}`;
       } catch {}
@@ -12288,7 +12398,7 @@ function readHostIdV2Uncached() {
   if (process.platform === "linux") {
     for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
       try {
-        const raw = readFileSync10(p, "utf8").trim();
+        const raw = readFileSync11(p, "utf8").trim();
         if (raw)
           return `linux:${raw}`;
       } catch {}
@@ -12331,23 +12441,23 @@ var init_identity = __esm(() => {
 });
 
 // src/daemon/run.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync7, readFileSync as readFileSync11 } from "node:fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync8, readFileSync as readFileSync12 } from "node:fs";
 function detectContainer() {
   if (process.env.KUBERNETES_SERVICE_HOST)
     return true;
   if (process.env.CONTAINER === "1")
     return true;
   try {
-    if (existsSync13("/.dockerenv"))
+    if (existsSync14("/.dockerenv"))
       return true;
-    const cg = readFileSync11("/proc/1/cgroup", "utf8");
+    const cg = readFileSync12("/proc/1/cgroup", "utf8");
     if (/(docker|kubepods|containerd)/.test(cg))
       return true;
   } catch {}
   return false;
 }
 async function runDaemon(opts = {}) {
-  mkdirSync7(DAEMON_PATHS.DAEMON_DIR, { recursive: true, mode: 448 });
+  mkdirSync8(DAEMON_PATHS.DAEMON_DIR, { recursive: true, mode: 448 });
   const lock = acquireSingletonLock();
   if (lock.result === "already-running") {
     process.stderr.write(`daemon already running (pid ${lock.pid})
@@ -12549,6 +12659,85 @@ async function runDaemon(opts = {}) {
     }
   });
   startReaper();
+  try {
+    const persisted = readPersistedSessions(DAEMON_PATHS.SESSIONS_FILE);
+    if (persisted.length > 0) {
+      const { loadOrCreateSessionKeypair: loadOrCreateSessionKeypair2 } = await Promise.resolve().then(() => (init_keypair_store(), exports_keypair_store));
+      const { signParentAttestation: signParentAttestation2 } = await Promise.resolve().then(() => (init_session_hello_sig(), exports_session_hello_sig));
+      const { isPidAlive: isPidAlive2, getProcessStartTimes: getProcessStartTimes2 } = await Promise.resolve().then(() => (init_process_info(), exports_process_info));
+      const liveStartTimes = await getProcessStartTimes2(persisted.map((p) => p.pid)).catch(() => new Map);
+      let revived = 0;
+      for (const s of persisted) {
+        if (!isPidAlive2(s.pid))
+          continue;
+        if (s.startTime !== undefined) {
+          const live = liveStartTimes.get(s.pid);
+          if (live !== undefined && live !== s.startTime)
+            continue;
+        }
+        const meshConfig = meshConfigs.get(s.mesh);
+        if (!meshConfig)
+          continue;
+        try {
+          const kp = await loadOrCreateSessionKeypair2(meshConfig.slug, s.sessionId);
+          const att = await signParentAttestation2({
+            parentMemberPubkey: meshConfig.pubkey,
+            parentSecretKey: meshConfig.secretKey,
+            sessionPubkey: kp.publicKey
+          });
+          registerSession({
+            token: s.token,
+            sessionId: s.sessionId,
+            mesh: s.mesh,
+            displayName: s.displayName,
+            pid: s.pid,
+            ...s.cwd ? { cwd: s.cwd } : {},
+            ...s.role ? { role: s.role } : {},
+            ...s.groups ? { groups: s.groups } : {},
+            ...s.startTime ? { startTime: s.startTime } : {},
+            presence: {
+              sessionPubkey: kp.publicKey,
+              sessionSecretKey: kp.secretKey,
+              parentAttestation: {
+                sessionPubkey: att.sessionPubkey,
+                parentMemberPubkey: att.parentMemberPubkey,
+                expiresAt: att.expiresAt,
+                signature: att.signature
+              }
+            }
+          });
+          revived++;
+        } catch (err) {
+          process.stderr.write(JSON.stringify({
+            level: "warn",
+            msg: "session_rehydrate_failed",
+            token: s.token.slice(0, 8),
+            mesh: s.mesh,
+            err: String(err),
+            ts: new Date().toISOString()
+          }) + `
+`);
+        }
+      }
+      process.stderr.write(JSON.stringify({
+        level: "info",
+        msg: "sessions_rehydrated",
+        revived,
+        persisted: persisted.length,
+        ts: new Date().toISOString()
+      }) + `
+`);
+    }
+  } catch (err) {
+    process.stderr.write(JSON.stringify({
+      level: "warn",
+      msg: "session_rehydrate_scan_failed",
+      err: String(err),
+      ts: new Date().toISOString()
+    }) + `
+`);
+  }
+  setRegistryPersistence(DAEMON_PATHS.SESSIONS_FILE);
   const ipc2 = startIpcServer({
     localToken,
     tcpEnabled,
@@ -12637,10 +12826,10 @@ __export(exports_service_install, {
   installService: () => installService,
   detectPlatform: () => detectPlatform
 });
-import { existsSync as existsSync14, mkdirSync as mkdirSync8, writeFileSync as writeFileSync12, unlinkSync as unlinkSync5, readFileSync as readFileSync12 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync9, writeFileSync as writeFileSync13, unlinkSync as unlinkSync5, readFileSync as readFileSync13 } from "node:fs";
 import { execSync as execSync2 } from "node:child_process";
 import { homedir as homedir8 } from "node:os";
-import { join as join9, dirname as dirname5 } from "node:path";
+import { join as join9, dirname as dirname6 } from "node:path";
 function detectPlatform() {
   if (process.platform === "darwin")
     return "darwin";
@@ -12658,10 +12847,10 @@ function installService(args) {
   if (isCi() && !args.allowCi) {
     throw new Error("Refusing to install persistent service in CI; pass --allow-ci-persistent to override.");
   }
-  if (!existsSync14(args.binaryPath)) {
+  if (!existsSync15(args.binaryPath)) {
     throw new Error(`binary not found at ${args.binaryPath}`);
   }
-  mkdirSync8(DAEMON_PATHS.DAEMON_DIR, { recursive: true, mode: 448 });
+  mkdirSync9(DAEMON_PATHS.DAEMON_DIR, { recursive: true, mode: 448 });
   if (platform5 === "darwin")
     return installDarwin(args);
   return installLinux(args);
@@ -12674,7 +12863,7 @@ function uninstallService() {
     try {
       execSync2(`launchctl bootout gui/$(id -u)/${SERVICE_LABEL2}`, { stdio: "ignore" });
     } catch {}
-    if (existsSync14(p)) {
+    if (existsSync15(p)) {
       unlinkSync5(p);
       removed.push(p);
     }
@@ -12683,7 +12872,7 @@ function uninstallService() {
     try {
       execSync2(`systemctl --user disable --now ${SYSTEMD_UNIT2}`, { stdio: "ignore" });
     } catch {}
-    if (existsSync14(p)) {
+    if (existsSync15(p)) {
       unlinkSync5(p);
       removed.push(p);
     }
@@ -12695,7 +12884,7 @@ function darwinPlistPath() {
 }
 function installDarwin(args) {
   const plist = darwinPlistPath();
-  mkdirSync8(dirname5(plist), { recursive: true });
+  mkdirSync9(dirname6(plist), { recursive: true });
   const log2 = DAEMON_PATHS.LOG_FILE;
   const nodeBin = process.execPath;
   const meshArgs = [
@@ -12738,14 +12927,14 @@ function installDarwin(args) {
 </dict>
 </plist>
 `;
-  writeFileSync12(plist, xml, { mode: 420 });
+  writeFileSync13(plist, xml, { mode: 420 });
   try {
     execSync2(`launchctl bootout gui/$(id -u)/${SERVICE_LABEL2}`, { stdio: "ignore" });
   } catch {}
   try {
     const pidPath = DAEMON_PATHS.PID_FILE;
-    if (existsSync14(pidPath)) {
-      const pid = parseInt(readFileSync12(pidPath, "utf8").trim(), 10);
+    if (existsSync15(pidPath)) {
+      const pid = parseInt(readFileSync13(pidPath, "utf8").trim(), 10);
       if (Number.isFinite(pid) && pid > 0) {
         try {
           process.kill(pid, "SIGTERM");
@@ -12764,7 +12953,7 @@ function linuxUnitPath() {
 }
 function installLinux(args) {
   const unit = linuxUnitPath();
-  mkdirSync8(dirname5(unit), { recursive: true });
+  mkdirSync9(dirname6(unit), { recursive: true });
   const nodeBin = process.execPath;
   const execArgs = [
     "daemon",
@@ -12790,14 +12979,14 @@ Environment=PATH=/usr/local/bin:/usr/bin:/bin
 [Install]
 WantedBy=default.target
 `;
-  writeFileSync12(unit, content, { mode: 420 });
+  writeFileSync13(unit, content, { mode: 420 });
   try {
     execSync2(`systemctl --user stop ${SYSTEMD_UNIT2}`, { stdio: "ignore" });
   } catch {}
   try {
     const pidPath = DAEMON_PATHS.PID_FILE;
-    if (existsSync14(pidPath)) {
-      const pid = parseInt(readFileSync12(pidPath, "utf8").trim(), 10);
+    if (existsSync15(pidPath)) {
+      const pid = parseInt(readFileSync13(pidPath, "utf8").trim(), 10);
       if (Number.isFinite(pid) && pid > 0) {
         try {
           process.kill(pid, "SIGTERM");
@@ -12824,10 +13013,10 @@ function readInstalledUnit() {
   if (!platform5)
     return { platform: null, path: null, content: null };
   const path2 = platform5 === "darwin" ? darwinPlistPath() : linuxUnitPath();
-  if (!existsSync14(path2))
+  if (!existsSync15(path2))
     return { platform: platform5, path: null, content: null };
   try {
-    return { platform: platform5, path: path2, content: readFileSync12(path2, "utf8") };
+    return { platform: platform5, path: path2, content: readFileSync13(path2, "utf8") };
   } catch {
     return { platform: platform5, path: path2, content: null };
   }
@@ -12843,7 +13032,7 @@ __export(exports_daemon, {
   runDaemonCommand: () => runDaemonCommand
 });
 import { spawn } from "node:child_process";
-import { existsSync as existsSync15, openSync as openSync3, mkdirSync as mkdirSync9 } from "node:fs";
+import { existsSync as existsSync16, openSync as openSync3, mkdirSync as mkdirSync10 } from "node:fs";
 import { join as join10 } from "node:path";
 async function runDaemonCommand(sub, opts, rest = []) {
   switch (sub) {
@@ -13166,7 +13355,7 @@ async function runStop(opts) {
   return 1;
 }
 async function spawnDetachedDaemon(opts) {
-  mkdirSync9(DAEMON_PATHS.DAEMON_DIR, { recursive: true, mode: 448 });
+  mkdirSync10(DAEMON_PATHS.DAEMON_DIR, { recursive: true, mode: 448 });
   const logPath = join10(DAEMON_PATHS.DAEMON_DIR, "daemon.log");
   const binary = process.argv[1] ?? "claudemesh";
   const args = ["daemon", "up", "--foreground"];
@@ -13185,7 +13374,7 @@ async function spawnDetachedDaemon(opts) {
   const sockPath = DAEMON_PATHS.SOCK_FILE;
   const startedAt = Date.now();
   while (Date.now() - startedAt < 3000) {
-    if (existsSync15(sockPath)) {
+    if (existsSync16(sockPath)) {
       if (opts.json) {
         process.stdout.write(JSON.stringify({ ok: true, detached: true, pid: child.pid, log: logPath }) + `
 `);
@@ -13230,19 +13419,19 @@ __export(exports_install, {
 import {
   chmodSync as chmodSync4,
   copyFileSync,
-  existsSync as existsSync16,
-  mkdirSync as mkdirSync10,
-  readFileSync as readFileSync13,
-  writeFileSync as writeFileSync13
+  existsSync as existsSync17,
+  mkdirSync as mkdirSync11,
+  readFileSync as readFileSync14,
+  writeFileSync as writeFileSync14
 } from "node:fs";
 import { homedir as homedir9, platform as platform5 } from "node:os";
-import { dirname as dirname6, join as join11, resolve } from "node:path";
+import { dirname as dirname7, join as join11, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync as spawnSync3 } from "node:child_process";
 function readClaudeConfig() {
-  if (!existsSync16(CLAUDE_CONFIG))
+  if (!existsSync17(CLAUDE_CONFIG))
     return {};
-  const text = readFileSync13(CLAUDE_CONFIG, "utf-8").trim();
+  const text = readFileSync14(CLAUDE_CONFIG, "utf-8").trim();
   if (!text)
     return {};
   try {
@@ -13252,10 +13441,10 @@ function readClaudeConfig() {
   }
 }
 function backupClaudeConfig() {
-  if (!existsSync16(CLAUDE_CONFIG))
+  if (!existsSync17(CLAUDE_CONFIG))
     return;
-  const backupDir = join11(dirname6(CLAUDE_CONFIG), ".claude", "backups");
-  mkdirSync10(backupDir, { recursive: true });
+  const backupDir = join11(dirname7(CLAUDE_CONFIG), ".claude", "backups");
+  mkdirSync11(backupDir, { recursive: true });
   const ts = Date.now();
   const dest = join11(backupDir, `.claude.json.pre-claudemesh.${ts}`);
   copyFileSync(CLAUDE_CONFIG, dest);
@@ -13281,7 +13470,7 @@ function patchMcpServer(entry) {
   return action;
 }
 function removeMcpServer() {
-  if (!existsSync16(CLAUDE_CONFIG))
+  if (!existsSync17(CLAUDE_CONFIG))
     return false;
   backupClaudeConfig();
   const cfg = readClaudeConfig();
@@ -13294,8 +13483,8 @@ function removeMcpServer() {
   return true;
 }
 function flushClaudeConfig(obj) {
-  mkdirSync10(dirname6(CLAUDE_CONFIG), { recursive: true });
-  writeFileSync13(CLAUDE_CONFIG, JSON.stringify(obj, null, 2) + `
+  mkdirSync11(dirname7(CLAUDE_CONFIG), { recursive: true });
+  writeFileSync14(CLAUDE_CONFIG, JSON.stringify(obj, null, 2) + `
 `, "utf-8");
   try {
     chmodSync4(CLAUDE_CONFIG, 384);
@@ -13312,13 +13501,13 @@ function resolveEntry() {
   const here = fileURLToPath(import.meta.url);
   if (isBundledFile(here))
     return here;
-  return resolve(dirname6(here), "..", "index.ts");
+  return resolve(dirname7(here), "..", "index.ts");
 }
 function resolveBundledSkillsDir() {
   const here = fileURLToPath(import.meta.url);
-  const pkgRoot = resolve(dirname6(here), "..", "..");
+  const pkgRoot = resolve(dirname7(here), "..", "..");
   const skillsDir = join11(pkgRoot, "skills");
-  if (existsSync16(skillsDir))
+  if (existsSync17(skillsDir))
     return skillsDir;
   return null;
 }
@@ -13333,7 +13522,7 @@ function installSkills() {
       continue;
     const srcDir = join11(src, entry.name);
     const dstDir = join11(CLAUDE_SKILLS_ROOT, entry.name);
-    mkdirSync10(dstDir, { recursive: true });
+    mkdirSync11(dstDir, { recursive: true });
     for (const file of fs.readdirSync(srcDir, { withFileTypes: true })) {
       if (!file.isFile())
         continue;
@@ -13353,7 +13542,7 @@ function uninstallSkills() {
     if (!entry.isDirectory())
       continue;
     const dstDir = join11(CLAUDE_SKILLS_ROOT, entry.name);
-    if (existsSync16(dstDir)) {
+    if (existsSync17(dstDir)) {
       try {
         fs.rmSync(dstDir, { recursive: true, force: true });
         removed.push(entry.name);
@@ -13378,9 +13567,9 @@ function entriesEqual(a, b) {
   return a.command === b.command && JSON.stringify(a.args ?? []) === JSON.stringify(b.args ?? []);
 }
 function readClaudeSettings() {
-  if (!existsSync16(CLAUDE_SETTINGS))
+  if (!existsSync17(CLAUDE_SETTINGS))
     return {};
-  const text = readFileSync13(CLAUDE_SETTINGS, "utf-8").trim();
+  const text = readFileSync14(CLAUDE_SETTINGS, "utf-8").trim();
   if (!text)
     return {};
   try {
@@ -13390,8 +13579,8 @@ function readClaudeSettings() {
   }
 }
 function writeClaudeSettings(obj) {
-  mkdirSync10(dirname6(CLAUDE_SETTINGS), { recursive: true });
-  writeFileSync13(CLAUDE_SETTINGS, JSON.stringify(obj, null, 2) + `
+  mkdirSync11(dirname7(CLAUDE_SETTINGS), { recursive: true });
+  writeFileSync14(CLAUDE_SETTINGS, JSON.stringify(obj, null, 2) + `
 `, "utf-8");
 }
 function installAllowedTools() {
@@ -13405,7 +13594,7 @@ function installAllowedTools() {
   return { added: toAdd, unchanged: CLAUDEMESH_TOOLS.length - toAdd.length };
 }
 function uninstallAllowedTools() {
-  if (!existsSync16(CLAUDE_SETTINGS))
+  if (!existsSync17(CLAUDE_SETTINGS))
     return 0;
   const settings = readClaudeSettings();
   const existing = settings.allowedTools ?? [];
@@ -13440,7 +13629,7 @@ function installHooks() {
   return { added, unchanged };
 }
 function uninstallHooks() {
-  if (!existsSync16(CLAUDE_SETTINGS))
+  if (!existsSync17(CLAUDE_SETTINGS))
     return 0;
   const settings = readClaudeSettings();
   const hooks2 = settings.hooks;
@@ -13490,7 +13679,7 @@ async function runInstall(args = []) {
     render.err("`bun` is not on PATH.", "Install Bun first: https://bun.com");
     process.exit(1);
   }
-  if (!existsSync16(entry)) {
+  if (!existsSync17(entry)) {
     render.err(`MCP entry not found at ${entry}`);
     process.exit(1);
   }
@@ -13761,35 +13950,35 @@ var exports_uninstall = {};
 __export(exports_uninstall, {
   uninstall: () => uninstall
 });
-import { readFileSync as readFileSync14, writeFileSync as writeFileSync14, existsSync as existsSync17, rmSync as rmSync3, readdirSync as readdirSync2 } from "node:fs";
-import { join as join12, dirname as dirname7 } from "node:path";
+import { readFileSync as readFileSync15, writeFileSync as writeFileSync15, existsSync as existsSync18, rmSync as rmSync3, readdirSync as readdirSync2 } from "node:fs";
+import { join as join12, dirname as dirname8 } from "node:path";
 import { homedir as homedir10 } from "node:os";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function bundledSkillsDir() {
   const here = fileURLToPath2(import.meta.url);
-  const pkgRoot = join12(dirname7(here), "..", "..");
+  const pkgRoot = join12(dirname8(here), "..", "..");
   const skillsDir = join12(pkgRoot, "skills");
-  return existsSync17(skillsDir) ? skillsDir : null;
+  return existsSync18(skillsDir) ? skillsDir : null;
 }
 async function uninstall() {
   let removed = 0;
-  if (existsSync17(PATHS.CLAUDE_JSON)) {
+  if (existsSync18(PATHS.CLAUDE_JSON)) {
     try {
-      const raw = readFileSync14(PATHS.CLAUDE_JSON, "utf-8");
+      const raw = readFileSync15(PATHS.CLAUDE_JSON, "utf-8");
       const config = JSON.parse(raw);
       const servers = config.mcpServers;
       if (servers && "claudemesh" in servers) {
         delete servers.claudemesh;
-        writeFileSync14(PATHS.CLAUDE_JSON, JSON.stringify(config, null, 2) + `
+        writeFileSync15(PATHS.CLAUDE_JSON, JSON.stringify(config, null, 2) + `
 `, "utf-8");
         render.ok("removed MCP server", dim("~/.claude.json"));
         removed++;
       }
     } catch {}
   }
-  if (existsSync17(PATHS.CLAUDE_SETTINGS)) {
+  if (existsSync18(PATHS.CLAUDE_SETTINGS)) {
     try {
-      const raw = readFileSync14(PATHS.CLAUDE_SETTINGS, "utf-8");
+      const raw = readFileSync15(PATHS.CLAUDE_SETTINGS, "utf-8");
       const config = JSON.parse(raw);
       const hooks2 = config.hooks;
       if (hooks2) {
@@ -13810,7 +13999,7 @@ async function uninstall() {
           }
         }
         if (removedHooks > 0) {
-          writeFileSync14(PATHS.CLAUDE_SETTINGS, JSON.stringify(config, null, 2) + `
+          writeFileSync15(PATHS.CLAUDE_SETTINGS, JSON.stringify(config, null, 2) + `
 `, "utf-8");
           render.ok(`removed ${removedHooks} claudemesh hook${removedHooks === 1 ? "" : "s"}`, dim("settings.json"));
           removed++;
@@ -13826,7 +14015,7 @@ async function uninstall() {
         if (!entry.isDirectory())
           continue;
         const dst = join12(CLAUDE_SKILLS_ROOT2, entry.name);
-        if (existsSync17(dst)) {
+        if (existsSync18(dst)) {
           try {
             rmSync3(dst, { recursive: true, force: true });
             removedSkills.push(entry.name);
@@ -13858,7 +14047,7 @@ var exports_doctor = {};
 __export(exports_doctor, {
   runDoctor: () => runDoctor
 });
-import { existsSync as existsSync18, readFileSync as readFileSync15, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync16, statSync as statSync3 } from "node:fs";
 import { homedir as homedir11, platform as platform6 } from "node:os";
 import { join as join13 } from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
@@ -13885,7 +14074,7 @@ function checkClaudeOnPath() {
 }
 function checkMcpRegistered() {
   const claudeConfig = join13(homedir11(), ".claude.json");
-  if (!existsSync18(claudeConfig)) {
+  if (!existsSync19(claudeConfig)) {
     return {
       name: "claudemesh MCP registered in ~/.claude.json",
       pass: false,
@@ -13893,7 +14082,7 @@ function checkMcpRegistered() {
     };
   }
   try {
-    const cfg = JSON.parse(readFileSync15(claudeConfig, "utf-8"));
+    const cfg = JSON.parse(readFileSync16(claudeConfig, "utf-8"));
     const registered = Boolean(cfg.mcpServers?.["claudemesh"]);
     return {
       name: "claudemesh MCP registered in ~/.claude.json",
@@ -13911,7 +14100,7 @@ function checkMcpRegistered() {
 }
 function checkHooksRegistered() {
   const settings = join13(homedir11(), ".claude", "settings.json");
-  if (!existsSync18(settings)) {
+  if (!existsSync19(settings)) {
     return {
       name: "Status hooks registered in ~/.claude/settings.json",
       pass: false,
@@ -13919,7 +14108,7 @@ function checkHooksRegistered() {
     };
   }
   try {
-    const raw = readFileSync15(settings, "utf-8");
+    const raw = readFileSync16(settings, "utf-8");
     const has = raw.includes("claudemesh hook ");
     return {
       name: "Status hooks registered in ~/.claude/settings.json",
@@ -13936,7 +14125,7 @@ function checkHooksRegistered() {
 }
 function checkConfigFile() {
   const path2 = getConfigPath();
-  if (!existsSync18(path2)) {
+  if (!existsSync19(path2)) {
     return {
       name: "~/.claudemesh/config.json exists and parses",
       pass: true,
@@ -14119,7 +14308,7 @@ var exports_status = {};
 __export(exports_status, {
   runStatus: () => runStatus2
 });
-import { statSync as statSync4, existsSync as existsSync19 } from "node:fs";
+import { statSync as statSync4, existsSync as existsSync20 } from "node:fs";
 import WebSocket3 from "ws";
 async function probeBroker(url, timeoutMs = 4000) {
   return new Promise((resolve2) => {
@@ -14149,7 +14338,7 @@ async function runStatus2() {
   render.section(`status (v${VERSION})`);
   const configPath = getConfigPath();
   let configPermsNote = "missing";
-  if (existsSync19(configPath)) {
+  if (existsSync20(configPath)) {
     const mode = (statSync4(configPath).mode & 511).toString(8).padStart(4, "0");
     configPermsNote = mode === "0600" ? `${mode}` : `${mode} — expected 0600`;
   }
@@ -14295,13 +14484,13 @@ var init_check_claude_binary = __esm(() => {
 });
 
 // src/services/health/check-mcp-registered.ts
-import { existsSync as existsSync20, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync21, readFileSync as readFileSync17 } from "node:fs";
 function checkMcpRegistered2() {
   try {
-    if (!existsSync20(PATHS.CLAUDE_JSON)) {
+    if (!existsSync21(PATHS.CLAUDE_JSON)) {
       return { name: "mcp-registered", ok: false, message: "~/.claude.json not found" };
     }
-    const raw = readFileSync16(PATHS.CLAUDE_JSON, "utf-8");
+    const raw = readFileSync17(PATHS.CLAUDE_JSON, "utf-8");
     const config = JSON.parse(raw);
     if (config.mcpServers && "claudemesh" in config.mcpServers) {
       return { name: "mcp-registered", ok: true, message: "MCP server registered" };
@@ -14316,13 +14505,13 @@ var init_check_mcp_registered = __esm(() => {
 });
 
 // src/services/health/check-hooks-registered.ts
-import { existsSync as existsSync21, readFileSync as readFileSync17 } from "node:fs";
+import { existsSync as existsSync22, readFileSync as readFileSync18 } from "node:fs";
 function checkHooksRegistered2() {
   try {
-    if (!existsSync21(PATHS.CLAUDE_SETTINGS)) {
+    if (!existsSync22(PATHS.CLAUDE_SETTINGS)) {
       return { name: "hooks-registered", ok: false, message: "~/.claude/settings.json not found" };
     }
-    const raw = readFileSync17(PATHS.CLAUDE_SETTINGS, "utf-8");
+    const raw = readFileSync18(PATHS.CLAUDE_SETTINGS, "utf-8");
     const config = JSON.parse(raw);
     if (config.hooks) {
       return { name: "hooks-registered", ok: true, message: "Hooks configured" };
@@ -14337,10 +14526,10 @@ var init_check_hooks_registered = __esm(() => {
 });
 
 // src/services/health/check-config-perms.ts
-import { existsSync as existsSync22, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync23, statSync as statSync5 } from "node:fs";
 function checkConfigPerms() {
   const configFile = PATHS.CONFIG_FILE;
-  if (!existsSync22(configFile)) {
+  if (!existsSync23(configFile)) {
     return { name: "config-perms", ok: true, message: "No config file yet (first run)" };
   }
   try {
@@ -14358,13 +14547,13 @@ var init_check_config_perms = __esm(() => {
 });
 
 // src/services/health/check-keypairs-valid.ts
-import { existsSync as existsSync23, readFileSync as readFileSync18 } from "node:fs";
+import { existsSync as existsSync24, readFileSync as readFileSync19 } from "node:fs";
 function checkKeypairsValid() {
-  if (!existsSync23(PATHS.CONFIG_FILE)) {
+  if (!existsSync24(PATHS.CONFIG_FILE)) {
     return { name: "keypairs-valid", ok: true, message: "No config (first run)" };
   }
   try {
-    const raw = readFileSync18(PATHS.CONFIG_FILE, "utf-8");
+    const raw = readFileSync19(PATHS.CONFIG_FILE, "utf-8");
     const config = JSON.parse(raw);
     const meshes = config.meshes ?? [];
     if (meshes.length === 0) {
@@ -14845,7 +15034,7 @@ __export(exports_url_handler, {
   runUrlHandler: () => runUrlHandler
 });
 import { platform as platform7, homedir as homedir12 } from "node:os";
-import { existsSync as existsSync24, mkdirSync as mkdirSync11, writeFileSync as writeFileSync15, rmSync as rmSync4, chmodSync as chmodSync5 } from "node:fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync12, writeFileSync as writeFileSync16, rmSync as rmSync4, chmodSync as chmodSync5 } from "node:fs";
 import { join as join14 } from "node:path";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function resolveClaudemeshBin() {
@@ -14856,7 +15045,7 @@ function installDarwin2() {
   const appDir = join14(homedir12(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
   const contents = join14(appDir, "Contents");
   const macOS = join14(contents, "MacOS");
-  mkdirSync11(macOS, { recursive: true });
+  mkdirSync12(macOS, { recursive: true });
   const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -14879,7 +15068,7 @@ function installDarwin2() {
   </array>
 </dict>
 </plist>`;
-  writeFileSync15(join14(contents, "Info.plist"), plist);
+  writeFileSync16(join14(contents, "Info.plist"), plist);
   const shim = `#!/bin/sh
 URL="$1"
 CODE=\${URL#claudemesh://}
@@ -14894,7 +15083,7 @@ end tell
 EOF
 `;
   const shimPath = join14(macOS, "open-url");
-  writeFileSync15(shimPath, shim);
+  writeFileSync16(shimPath, shim);
   chmodSync5(shimPath, 493);
   const lsreg = spawnSync5("/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister", ["-f", appDir], { encoding: "utf-8" });
   if (lsreg.status !== 0) {
@@ -14906,7 +15095,7 @@ EOF
 function installLinux2() {
   const binPath = resolveClaudemeshBin();
   const appsDir = join14(homedir12(), ".local", "share", "applications");
-  mkdirSync11(appsDir, { recursive: true });
+  mkdirSync12(appsDir, { recursive: true });
   const desktop = `[Desktop Entry]
 Type=Application
 Name=Claudemesh
@@ -14918,7 +15107,7 @@ MimeType=x-scheme-handler/claudemesh;
 NoDisplay=true
 `;
   const desktopPath = join14(appsDir, "claudemesh.desktop");
-  writeFileSync15(desktopPath, desktop);
+  writeFileSync16(desktopPath, desktop);
   const xdg1 = spawnSync5("xdg-mime", ["default", "claudemesh.desktop", "x-scheme-handler/claudemesh"], { encoding: "utf-8" });
   if (xdg1.status !== 0) {
     render.warn("xdg-mime not available — skipped mime default registration");
@@ -14941,7 +15130,7 @@ function installWindows() {
     `@="\\"${binPath.replace(/\\/g, "\\\\")}\\" \\"%1\\""`
   ];
   const regPath = join14(homedir12(), "claudemesh-handler.reg");
-  writeFileSync15(regPath, lines.join(`\r
+  writeFileSync16(regPath, lines.join(`\r
 `));
   const res = spawnSync5("reg.exe", ["import", regPath], { encoding: "utf-8" });
   if (res.status !== 0) {
@@ -14953,14 +15142,14 @@ function installWindows() {
 }
 function uninstallDarwin() {
   const appDir = join14(homedir12(), "Library", "Application Support", "claudemesh", "ClaudemeshHandler.app");
-  if (existsSync24(appDir))
+  if (existsSync25(appDir))
     rmSync4(appDir, { recursive: true, force: true });
   render.ok("removed claudemesh:// handler on macOS");
   return EXIT.SUCCESS;
 }
 function uninstallLinux() {
   const desktopPath = join14(homedir12(), ".local", "share", "applications", "claudemesh.desktop");
-  if (existsSync24(desktopPath))
+  if (existsSync25(desktopPath))
     rmSync4(desktopPath, { force: true });
   render.ok("removed claudemesh:// handler on Linux");
   return EXIT.SUCCESS;
@@ -15005,7 +15194,7 @@ var exports_status_line = {};
 __export(exports_status_line, {
   runStatusLine: () => runStatusLine
 });
-import { existsSync as existsSync25, readFileSync as readFileSync19 } from "node:fs";
+import { existsSync as existsSync26, readFileSync as readFileSync20 } from "node:fs";
 import { join as join15 } from "node:path";
 import { homedir as homedir13 } from "node:os";
 async function runStatusLine() {
@@ -15017,9 +15206,9 @@ async function runStatusLine() {
     }
     const cachePath = join15(homedir13(), ".claudemesh", "peer-cache.json");
     let cache = {};
-    if (existsSync25(cachePath)) {
+    if (existsSync26(cachePath)) {
       try {
-        cache = JSON.parse(readFileSync19(cachePath, "utf-8"));
+        cache = JSON.parse(readFileSync20(cachePath, "utf-8"));
       } catch {}
     }
     const pick = config.meshes[0];
@@ -15050,7 +15239,7 @@ __export(exports_backup, {
   runRestore: () => runRestore,
   runBackup: () => runBackup
 });
-import { readFileSync as readFileSync20, writeFileSync as writeFileSync16, existsSync as existsSync26 } from "node:fs";
+import { readFileSync as readFileSync21, writeFileSync as writeFileSync17, existsSync as existsSync27 } from "node:fs";
 import { createInterface as createInterface11 } from "node:readline";
 function readHidden(prompt5) {
   return new Promise((resolve2) => {
@@ -15092,11 +15281,11 @@ async function deriveKey(pass, salt, s) {
 }
 async function runBackup(outPath) {
   const configPath = getConfigPath();
-  if (!existsSync26(configPath)) {
+  if (!existsSync27(configPath)) {
     console.error("  No config found — nothing to back up. Join a mesh first.");
     return EXIT.NOT_FOUND;
   }
-  const plaintext = readFileSync20(configPath);
+  const plaintext = readFileSync21(configPath);
   const pass = await readHidden("  Passphrase (min 12 chars): ");
   if (pass.length < 12) {
     console.error("  ✗ Passphrase too short.");
@@ -15114,7 +15303,7 @@ async function runBackup(outPath) {
   const ciphertext = Buffer.from(s.crypto_aead_xchacha20poly1305_ietf_encrypt(plaintext, null, null, nonce, key));
   const blob = Buffer.concat([MAGIC, salt, nonce, ciphertext]);
   const file = outPath ?? `claudemesh-backup-${new Date().toISOString().replace(/[:.]/g, "-")}.cmb`;
-  writeFileSync16(file, blob, { mode: 384 });
+  writeFileSync17(file, blob, { mode: 384 });
   console.log(`
   ✓ Backup saved: ${file}`);
   console.log(`  Size: ${blob.length} bytes. Guard the passphrase — there is no recovery.
@@ -15126,11 +15315,11 @@ async function runRestore(inPath) {
     console.error("  Usage: claudemesh restore <backup-file>");
     return EXIT.INVALID_ARGS;
   }
-  if (!existsSync26(inPath)) {
+  if (!existsSync27(inPath)) {
     console.error(`  ✗ File not found: ${inPath}`);
     return EXIT.NOT_FOUND;
   }
-  const blob = readFileSync20(inPath);
+  const blob = readFileSync21(inPath);
   if (blob.length < 4 + 16 + 24 + 17 || !blob.subarray(0, 4).equals(MAGIC)) {
     console.error("  ✗ Not a claudemesh backup file (bad magic).");
     return EXIT.INVALID_ARGS;
@@ -15149,12 +15338,12 @@ async function runRestore(inPath) {
     return EXIT.INTERNAL_ERROR;
   }
   const configPath = getConfigPath();
-  if (existsSync26(configPath)) {
+  if (existsSync27(configPath)) {
     const backupOld = `${configPath}.before-restore.${Date.now()}`;
-    writeFileSync16(backupOld, readFileSync20(configPath), { mode: 384 });
+    writeFileSync17(backupOld, readFileSync21(configPath), { mode: 384 });
     console.log(`  ↻ Existing config saved to ${backupOld}`);
   }
-  writeFileSync16(configPath, Buffer.from(plaintext), { mode: 384 });
+  writeFileSync17(configPath, Buffer.from(plaintext), { mode: 384 });
   console.log(`
   ✓ Config restored to ${configPath}`);
   console.log("  Run `claudemesh list` to verify your meshes.\n");
@@ -15174,8 +15363,8 @@ __export(exports_upgrade, {
   runUpgrade: () => runUpgrade
 });
 import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync27 } from "node:fs";
-import { dirname as dirname8, join as join16, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync28 } from "node:fs";
+import { dirname as dirname9, join as join16, resolve as resolve2 } from "node:path";
 async function latestVersion() {
   try {
     const res = await fetch(URLS.NPM_REGISTRY, { signal: AbortSignal.timeout(8000) });
@@ -15189,14 +15378,14 @@ async function latestVersion() {
 }
 function findNpm() {
   const portable = join16(process.env.HOME ?? "", ".claudemesh", "node", "bin", "npm");
-  if (existsSync27(portable)) {
+  if (existsSync28(portable)) {
     return { npm: portable, prefix: join16(process.env.HOME ?? "", ".claudemesh") };
   }
   let cur = resolve2(process.argv[1] ?? ".");
   for (let i = 0;i < 6; i++) {
-    cur = dirname8(cur);
+    cur = dirname9(cur);
     const candidate = join16(cur, "bin", "npm");
-    if (existsSync27(candidate))
+    if (existsSync28(candidate))
       return { npm: candidate };
   }
   return { npm: "npm" };
@@ -15258,7 +15447,7 @@ __export(exports_grants, {
   runBlock: () => runBlock,
   isAllowed: () => isAllowed
 });
-import { existsSync as existsSync28, mkdirSync as mkdirSync12, readFileSync as readFileSync21, writeFileSync as writeFileSync17 } from "node:fs";
+import { existsSync as existsSync29, mkdirSync as mkdirSync13, readFileSync as readFileSync22, writeFileSync as writeFileSync18 } from "node:fs";
 import { homedir as homedir14 } from "node:os";
 import { join as join17 } from "node:path";
 async function syncToBroker(meshSlug, grants) {
@@ -15278,19 +15467,19 @@ async function syncToBroker(meshSlug, grants) {
   }
 }
 function readGrants() {
-  if (!existsSync28(GRANT_FILE))
+  if (!existsSync29(GRANT_FILE))
     return {};
   try {
-    return JSON.parse(readFileSync21(GRANT_FILE, "utf-8"));
+    return JSON.parse(readFileSync22(GRANT_FILE, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeGrants(g) {
   const dir = join17(homedir14(), ".claudemesh");
-  if (!existsSync28(dir))
-    mkdirSync12(dir, { recursive: true });
-  writeFileSync17(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
+  if (!existsSync29(dir))
+    mkdirSync13(dir, { recursive: true });
+  writeFileSync18(GRANT_FILE, JSON.stringify(g, null, 2), { mode: 384 });
 }
 function resolveCaps(input) {
   if (input.includes("all"))
@@ -17166,8 +17355,8 @@ __export(exports_file, {
   runFileGet: () => runFileGet
 });
 import { hostname as osHostname2 } from "node:os";
-import { resolve as resolvePath, basename, dirname as dirname9 } from "node:path";
-import { statSync as statSync7, existsSync as existsSync29, writeFileSync as writeFileSync18, mkdirSync as mkdirSync13 } from "node:fs";
+import { resolve as resolvePath, basename, dirname as dirname10 } from "node:path";
+import { statSync as statSync7, existsSync as existsSync30, writeFileSync as writeFileSync19, mkdirSync as mkdirSync14 } from "node:fs";
 function emitJson2(data) {
   console.log(JSON.stringify(data, null, 2));
 }
@@ -17184,7 +17373,7 @@ async function runFileShare(filePath, opts) {
     return EXIT.INVALID_ARGS;
   }
   const absPath = resolvePath(filePath);
-  if (!existsSync29(absPath)) {
+  if (!existsSync30(absPath)) {
     render.err(`File not found: ${absPath}`);
     return EXIT.INVALID_ARGS;
   }
@@ -17263,8 +17452,8 @@ async function runFileGet(fileId, opts) {
     }
     const buf = Buffer.from(await res.arrayBuffer());
     const outPath = opts.out ? resolvePath(opts.out) : resolvePath(process.cwd(), meta.name);
-    mkdirSync13(dirname9(outPath), { recursive: true });
-    writeFileSync18(outPath, buf);
+    mkdirSync14(dirname10(outPath), { recursive: true });
+    writeFileSync19(outPath, buf);
     if (opts.json) {
       emitJson2({ fileId, name: meta.name, savedTo: outPath, sizeBytes: buf.length });
     } else {
@@ -17874,7 +18063,7 @@ __export(exports_bridge, {
   runBridge: () => runBridge,
   bridgeConfigTemplate: () => bridgeConfigTemplate
 });
-import { readFileSync as readFileSync22, existsSync as existsSync30 } from "node:fs";
+import { readFileSync as readFileSync23, existsSync as existsSync31 } from "node:fs";
 function parseConfig(text) {
   const trimmed = text.trim();
   if (trimmed.startsWith("{"))
@@ -17918,13 +18107,13 @@ async function runBridge(configPath) {
     render.err("Usage: claudemesh bridge run <config.yaml>");
     return EXIT.INVALID_ARGS;
   }
-  if (!existsSync30(configPath)) {
+  if (!existsSync31(configPath)) {
     render.err(`config file not found: ${configPath}`);
     return EXIT.NOT_FOUND;
   }
   let cfg;
   try {
-    cfg = parseConfig(readFileSync22(configPath, "utf-8"));
+    cfg = parseConfig(readFileSync23(configPath, "utf-8"));
   } catch (e) {
     render.err(`failed to parse ${configPath}: ${e instanceof Error ? e.message : String(e)}`);
     return EXIT.INVALID_ARGS;
@@ -18898,12 +19087,12 @@ import {
   ListResourcesRequestSchema,
   ReadResourceRequestSchema
 } from "@modelcontextprotocol/sdk/types.js";
-import { existsSync as existsSync31, appendFileSync as appendFileSync2 } from "node:fs";
+import { existsSync as existsSync32, appendFileSync as appendFileSync2 } from "node:fs";
 import { request as httpRequest2 } from "node:http";
 import { join as join18 } from "node:path";
 async function daemonReady() {
   for (let i = 0;i < DAEMON_BOOT_RETRIES; i++) {
-    if (existsSync31(DAEMON_PATHS.SOCK_FILE))
+    if (existsSync32(DAEMON_PATHS.SOCK_FILE))
       return true;
     await new Promise((r) => setTimeout(r, DAEMON_BOOT_RETRY_MS));
   }
@@ -21504,4 +21693,4 @@ main().catch((err) => {
   process.exit(EXIT.INTERNAL_ERROR);
 });
 
-//# debugId=A7ECB4BF81F2B4CE64756E2164756E21
+//# debugId=2228CF546341C88264756E2164756E21