dsh-home-hosted 0.2.2 → 0.3.2

package/lib/index.js

@@ -40,13 +40,14 @@ var DEFAULT_SETTINGS = {
   agentTools: { enabled: true, allow: [...AGENT_TOOL_NAMES] },
   panel: { port: null },
   authNotice: true,
+  reclaimToken: true,
   uiStyle: "detailed",
   cli: { prefer: "pinned" }
 };
 
 // src/service.ts
 import { Service } from "@deepseek-ai/cordis";
-import fs12 from "node:fs";
+import fs13 from "node:fs";
 import path13 from "node:path";
 import process10 from "node:process";
 import { fileURLToPath } from "node:url";
@@ -2032,8 +2033,9 @@ function removeEntry(raw, id) {
 }
 
 // src/home-hosted/dsh-entry.ts
-import path8 from "node:path";
-import process5 from "node:process";
+import fs11 from "node:fs";
+import path10 from "node:path";
+import process7 from "node:process";
 
 // src/home-hosted/launch.ts
 import fs8 from "node:fs";
@@ -2101,144 +2103,12 @@ function buildHomeHostedBootSpec(facts, launch, options) {
   };
 }
 
-// src/home-hosted/dsh-entry.ts
-function detectProfile(argv, env = {}) {
-  for (let index = 0; index < argv.length; index += 1) {
-    const arg = argv[index];
-    if (arg === "--profile" && typeof argv[index + 1] === "string" && !argv[index + 1].startsWith("-"))
-      return argv[index + 1];
-    if (arg?.startsWith("--profile="))
-      return arg.slice("--profile=".length);
-  }
-  const dir = env.DSH_PROFILE_DIR;
-  if (typeof dir === "string" && dir.length > 0) {
-    const base = path8.basename(dir);
-    if (base.length > 0 && base !== "." && base !== path8.sep)
-      return base;
-  }
-  const app = argv.slice(2).find((candidate) => candidate !== void 0 && !candidate.startsWith("-"));
-  if (app !== void 0 && app.length > 0)
-    return app;
-  const fromEnv = env.DSH_PROFILE;
-  return typeof fromEnv === "string" && fromEnv.length > 0 ? fromEnv : "web";
-}
-async function resolveDshLaunch() {
-  const fromArgv = process5.argv[1];
-  if (typeof fromArgv === "string" && /\.[cm]?js$/.test(fromArgv) && path8.isAbsolute(fromArgv))
-    return { program: process5.execPath, args: [fromArgv], cliEntry: fromArgv, shimPath: null, source: "entry" };
-  const found = await which("dsh");
-  return found === null ? null : resolveShimmedCli(found, process5.execPath);
-}
-function buildDshEntry(facts) {
-  const launch = facts.launch;
-  const entryArgs = launch?.args ?? [];
-  const profile = facts.profile === null || facts.profile === void 0 ? "web" : facts.profile;
-  const appArgs = [];
-  if (facts.port !== null) {
-    appArgs.push(
-      "--port",
-      "{port}",
-      "--host",
-      "{host}",
-      "--no-open",
-      "--trusted-host",
-      `localhost:{port}`
-    );
-    if (facts.host === "0.0.0.0")
-      appArgs.push("--trusted-host", "{lanIp}:{port}");
-  }
-  const launcherArgs = profile === "web" ? ["web"] : ["--profile", profile];
-  const args = [...entryArgs, ...launcherArgs, ...appArgs];
-  return {
-    id: facts.id,
-    label: "DSH web",
-    enabled: true,
-    autostart: true,
-    command: launch?.program ?? "dsh",
-    args,
-    bind: facts.host === "0.0.0.0" ? "lan" : "local",
-    port: facts.port,
-    cwd: process5.cwd(),
-    env: {},
-    dataEnvs: { DSH_HOME: facts.dshHome },
-    onPortConflict: "kill",
-    stop: { killPortHolders: true },
-    health: {
-      enabled: true,
-      mode: "http",
-      // 401 is normal here: the panel answers the login route when auth is on.
-      http: { path: "/", method: "GET", expectStatusBelow: 500, expectBody: "" }
-    }
-  };
-}
-
-// src/home-hosted/entries.ts
-function defaultOnPortConflict(platform = process.platform) {
-  return platform === "win32" ? "kill" : "follow";
-}
-function defaultIntent(id, platform = process.platform) {
-  return {
-    id,
-    autostart: true,
-    onPortConflict: defaultOnPortConflict(platform),
-    stopKillPortHolders: true,
-    persistent: true
-  };
-}
-function ownedPatch(intent, live, options = {}) {
-  const stop = live?.stop ?? {};
-  return {
-    autostart: intent.autostart,
-    onPortConflict: intent.onPortConflict,
-    ...options.persistent === false ? {} : { persistent: intent.persistent },
-    stop: { ...stop, killPortHolders: intent.stopKillPortHolders }
-  };
-}
-function ownedDrift(live, intent, options = {}) {
-  if (live === null)
-    return ["missing entry"];
-  const drift = [];
-  if (live.autostart !== intent.autostart)
-    drift.push("autostart");
-  if (live.onPortConflict !== intent.onPortConflict)
-    drift.push("onPortConflict");
-  if (options.persistent !== false && (live.persistent ?? false) !== intent.persistent)
-    drift.push("persistent");
-  const killPortHolders = live.stop?.killPortHolders;
-  if (killPortHolders !== intent.stopKillPortHolders)
-    drift.push("stop.killPortHolders");
-  return drift;
-}
-function snapshotOwned(live) {
-  const killPortHolders = live.stop?.killPortHolders;
-  return {
-    id: live.id,
-    autostart: typeof live.autostart === "boolean" ? live.autostart : false,
-    onPortConflict: isOnPortConflict(live.onPortConflict) ? live.onPortConflict : "block",
-    persistent: live.persistent === true,
-    stop: { killPortHolders: typeof killPortHolders === "boolean" ? killPortHolders : false }
-  };
-}
-function restorePatch(live, snapshot) {
-  const stop = live.stop ?? {};
-  const previous = snapshot?.stop ?? {};
-  return {
-    autostart: snapshot?.autostart ?? false,
-    onPortConflict: snapshot?.onPortConflict ?? "block",
-    persistent: snapshot?.persistent === true,
-    stop: {
-      ...stop,
-      killPortHolders: typeof previous.killPortHolders === "boolean" ? previous.killPortHolders : false
-    }
-  };
-}
-
 // src/home-hosted/resolve.ts
 import { createRequire } from "node:module";
 import fs9 from "node:fs";
-import path9 from "node:path";
-import process6 from "node:process";
-var EXPECTED_RANGE = "^0.6.4";
+import path8 from "node:path";
+import process5 from "node:process";
+var EXPECTED_RANGE = "^0.6.6";
 var MIN_SUPPORTED_VERSION = "0.4.1";
 var MIN_KILL_VERSION = "0.6.0";
 var MIN_PERSISTENT_VERSION = "0.6.3";
@@ -2253,7 +2123,7 @@ function binEntryFromManifest(manifestPath) {
   try {
     const manifest = JSON.parse(fs9.readFileSync(manifestPath, "utf8"));
     const declared = typeof manifest.bin === "string" ? manifest.bin : manifest.bin?.["home-hosted"] ?? Object.values(manifest.bin ?? {})[0];
-    return typeof declared === "string" && declared.length > 0 ? path9.resolve(path9.dirname(manifestPath), declared) : null;
+    return typeof declared === "string" && declared.length > 0 ? path8.resolve(path8.dirname(manifestPath), declared) : null;
   } catch {
     return null;
   }
@@ -2309,7 +2179,7 @@ async function resolveCli(options = {}) {
   const override = options.override?.trim();
   let unusableOverride = null;
   if (override !== void 0 && override.length > 0) {
-    const launch = resolveShimmedCli(path9.resolve(override));
+    const launch = resolveShimmedCli(path8.resolve(override));
     if (launch === null) {
       unusableOverride = override;
     } else {
@@ -2343,13 +2213,13 @@ async function resolveCli(options = {}) {
     }
     dependency = {
       candidate: { source: "dependency", path: dependencyEntry, version: version2 },
-      launch: { program: process6.execPath, args: [dependencyEntry], cliEntry: dependencyEntry, shimPath: null, source: "entry" }
+      launch: { program: process5.execPath, args: [dependencyEntry], cliEntry: dependencyEntry, shimPath: null, source: "entry" }
     };
   }
   let global = null;
   const found = await locate("home-hosted") ?? await locate("hh");
   if (found !== null) {
-    const launch = resolveShimmedCli(path9.resolve(found));
+    const launch = resolveShimmedCli(path8.resolve(found));
     if (launch !== null) {
       global = {
         candidate: { source: "path", path: launch.cliEntry ?? launch.shimPath ?? launch.program, version: await readVersion(launch) },
@@ -2413,16 +2283,16 @@ async function resolveCli(options = {}) {
 
 // src/home-hosted/launcher.ts
 import fs10 from "node:fs";
-import path10 from "node:path";
-import process7 from "node:process";
+import path9 from "node:path";
+import process6 from "node:process";
 function launcherDir(stateDir) {
-  return path10.join(stateDir, "bin");
+  return path9.join(stateDir, "bin");
 }
 function launcherPath(stateDir) {
-  return path10.join(launcherDir(stateDir), "home-hosted.mjs");
+  return path9.join(launcherDir(stateDir), "home-hosted.mjs");
 }
 function launcherRecordPath(stateDir) {
-  return path10.join(launcherDir(stateDir), "resolved.json");
+  return path9.join(launcherDir(stateDir), "resolved.json");
 }
 function buildLauncherSource(options) {
   const marker = options.marker ?? "managed by dsh-home-hosted";
@@ -2547,13 +2417,444 @@ async function preflightLauncher(stateDir, timeoutMs = 1e4) {
   const file = launcherPath(stateDir);
   if (!fs10.existsSync(file))
     return null;
-  const result = process7.platform === "win32" ? await run(process7.execPath, [file, "--version"], { timeoutMs }) : await run(file, ["--version"], { timeoutMs });
+  const result = process6.platform === "win32" ? await run(process6.execPath, [file, "--version"], { timeoutMs }) : await run(file, ["--version"], { timeoutMs });
   return parseVersion(result.stdout) ?? parseVersion(result.stderr);
 }
+function dshLauncherRecordPath(stateDir) {
+  return path9.join(launcherDir(stateDir), "dsh-resolved.json");
+}
+function dshLauncherPath(stateDir, entryExtension) {
+  const extension = (entryExtension ?? "").toLowerCase() === ".cjs" ? ".cjs" : ".mjs";
+  return path9.join(launcherDir(stateDir), `dsh${extension}`);
+}
+function readDshLauncherRecord(stateDir) {
+  return readJson(dshLauncherRecordPath(stateDir));
+}
+function buildDshLauncherSource(options) {
+  const esm = (options.entryExtension ?? "").toLowerCase() !== ".cjs";
+  const prelude = esm ? `import fs from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import { spawnSync } from 'node:child_process'` : `const fs = require('node:fs')
+const path = require('node:path')
+const process = require('node:process')
+const { spawnSync } = require('node:child_process')`;
+  const roots = [options.resolvedEntry === null ? null : dshSearchRoot(options.resolvedEntry), ...options.searchRoots ?? []].filter((root) => typeof root === "string" && root.length > 0);
+  return `#!/usr/bin/env node
+// managed by dsh-home-hosted \u2014 rewritten on every plugin start; do not edit.
+${prelude}
+
+const DSH_HOME = ${JSON.stringify(options.dshHome)}
+const RECORD = ${JSON.stringify(dshLauncherRecordPath(options.stateDir))}
+const SEARCH_ROOTS = ${JSON.stringify([...new Set(roots)])}
+
+function readRecord() {
+  try { return JSON.parse(fs.readFileSync(RECORD, 'utf8')) } catch { return null }
+}
+
+function isEntry(file) {
+  let stat = null
+  try { stat = fs.statSync(file) } catch { return false }
+  return stat.isFile() && /\\.(?:mjs|cjs|js)$/.test(file)
+}
+
+function collect(out, entry) {
+  if (typeof entry === 'string' && isEntry(entry) && !out.includes(entry)) out.push(entry)
+}
+
+function collectStore(root, out) {
+  const store = path.join(root, 'node_modules', '.pnpm')
+  let names = []
+  try { names = fs.readdirSync(store) } catch { return }
+  for (const name of names) {
+    if (!name.startsWith('dsh@') && !name.startsWith('@deepseek-ai+dsh@')) continue
+    collect(out, path.join(store, name, 'node_modules', '@deepseek-ai', 'dsh', 'lib', 'bin.js'))
+    collect(out, path.join(store, name, 'node_modules', 'dsh', 'bin', 'dsh.js'))
+  }
+}
+
+function collectRoot(root, out) {
+  collect(out, path.join(root, 'node_modules', '@deepseek-ai', 'dsh', 'lib', 'bin.js'))
+  collect(out, path.join(root, 'node_modules', 'dsh', 'bin', 'dsh.js'))
+  collectStore(root, out)
+}
+
+function candidates() {
+  const out = []
+  const record = readRecord()
+  if (record && typeof record.entry === 'string') collect(out, record.entry)
+  for (const root of [...(Array.isArray(record?.roots) ? record.roots : []), ...SEARCH_ROOTS]) collectRoot(root, out)
+  collectRoot(DSH_HOME, out)
+  let profiles = []
+  try { profiles = fs.readdirSync(path.join(DSH_HOME, 'profiles')) } catch {}
+  for (const name of profiles) collectRoot(path.join(DSH_HOME, 'profiles', name), out)
+  // Last resort: a dsh on the entry's own PATH.
+  for (const dir of (process.env.PATH ?? '').split(path.delimiter)) {
+    collect(out, path.join(dir, 'dsh'))
+    collect(out, path.join(dir, 'dsh.cmd'))
+  }
+  return out
+}
+
+function versionOf(entry) {
+  let dir = path.dirname(entry)
+  for (let hop = 0; hop < 4; hop += 1) {
+    try {
+      const manifest = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'))
+      if (typeof manifest.version === 'string') return manifest.version
+    } catch {}
+    dir = path.dirname(dir)
+  }
+  return null
+}
+
+function compare(a, b) {
+  const split = value => {
+    const [core, pre = null] = String(value).split('-', 2)
+    return { parts: core.split('.').map(part => Number.parseInt(part, 10) || 0), pre }
+  }
+  const left = split(a); const right = split(b)
+  for (let i = 0; i < 3; i += 1) {
+    const diff = (left.parts[i] ?? 0) - (right.parts[i] ?? 0)
+    if (diff !== 0) return diff < 0 ? -1 : 1
+  }
+  if (left.pre === right.pre) return 0
+  if (left.pre === null) return 1
+  if (right.pre === null) return -1
+  return left.pre < right.pre ? -1 : 1
+}
+
+// A recorded path that still exists is usually the copy to boot, but never the
+// older one: a rebuild or upgrade that landed elsewhere must win on version.
+function choose() {
+  const recorded = readRecord()?.entry ?? null
+  const found = candidates().map(entry => ({ entry, recorded: entry === recorded, version: versionOf(entry) }))
+  const known = found.filter(item => item.version !== null)
+  if (known.length > 0) {
+    known.sort((a, b) => (compare(b.version, a.version) || (Number(b.recorded) - Number(a.recorded))))
+    return known[0].entry
+  }
+  return (found.find(item => item.recorded) ?? found[0])?.entry ?? null
+}
+
+const entry = choose()
+if (entry === null) {
+  console.error('[dsh-home-hosted] no dsh entry found for ' + DSH_HOME + ' (recorded path, $DSH_HOME node_modules, profiles/*, PATH). Reinstall dsh, or restart: dsh web')
+  process.exit(1)
+}
+
+const args = process.argv.slice(2)
+const result = /\\.(mjs|cjs|js)$/.test(entry)
+  ? spawnSync(process.execPath, [entry, ...args], { stdio: 'inherit' })
+  : spawnSync(entry, args, { stdio: 'inherit', shell: process.platform === 'win32' && /\\.(cmd|bat)$/i.test(entry) })
+process.exit(typeof result.status === 'number' ? result.status : 1)
+`;
+}
+function writeDshLauncher(options) {
+  const file = dshLauncherPath(options.stateDir, options.entryExtension);
+  const source = buildDshLauncherSource(options);
+  const previous = fs10.existsSync(file) ? fs10.readFileSync(file, "utf8") : null;
+  const changed = previous !== source;
+  if (changed) {
+    writeFileAtomic(file, source, 493);
+    fs10.chmodSync(file, 493);
+  }
+  const raw = [dshSearchRoot(options.resolvedEntry), ...options.searchRoots ?? [], ...readDshLauncherRecord(options.stateDir)?.roots ?? []];
+  const known = raw.filter((root) => typeof root === "string" && root.length > 0 && dshRootUsable(root));
+  const roots = [...new Set(known)];
+  writeJsonAtomic(dshLauncherRecordPath(options.stateDir), {
+    entry: options.resolvedEntry,
+    roots,
+    writtenAt: Date.now()
+  }, 384);
+  return { path: file, changed };
+}
+function dshCandidatesUnder(root) {
+  const out = [];
+  for (const entry of [
+    path9.join(root, "node_modules", "@deepseek-ai", "dsh", "lib", "bin.js"),
+    path9.join(root, "node_modules", "dsh", "bin", "dsh.js")
+  ]) {
+    if (fs10.existsSync(entry))
+      out.push(entry);
+  }
+  const store = path9.join(root, "node_modules", ".pnpm");
+  if (fs10.existsSync(store)) {
+    for (const name2 of fs10.readdirSync(store)) {
+      if (!name2.startsWith("dsh@") && !name2.startsWith("@deepseek-ai+dsh@"))
+        continue;
+      for (const entry of [
+        path9.join(store, name2, "node_modules", "@deepseek-ai", "dsh", "lib", "bin.js"),
+        path9.join(store, name2, "node_modules", "dsh", "bin", "dsh.js")
+      ]) {
+        if (fs10.existsSync(entry))
+          out.push(entry);
+      }
+    }
+  }
+  return out;
+}
+function dshSearchRoot(entry) {
+  if (typeof entry !== "string" || entry.length === 0)
+    return null;
+  const parts = entry.split(path9.sep);
+  const store = parts.indexOf(".pnpm");
+  const modules = store > 0 ? store - 1 : parts.lastIndexOf("node_modules");
+  return modules > 0 ? parts.slice(0, modules).join(path9.sep) : null;
+}
+function dshRootUsable(root) {
+  return dshCandidatesUnder(root).length > 0 || fs10.existsSync(path9.join(root, "node_modules", ".pnpm"));
+}
+
+// src/home-hosted/dsh-entry.ts
+function detectProfile(argv, env = {}) {
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === "--profile" && typeof argv[index + 1] === "string" && !argv[index + 1].startsWith("-"))
+      return argv[index + 1];
+    if (arg?.startsWith("--profile="))
+      return arg.slice("--profile=".length);
+  }
+  const dir = env.DSH_PROFILE_DIR;
+  if (typeof dir === "string" && dir.length > 0) {
+    const base = path10.basename(dir);
+    if (base.length > 0 && base !== "." && base !== path10.sep)
+      return base;
+  }
+  const app = argv.slice(2).find((candidate) => candidate !== void 0 && !candidate.startsWith("-"));
+  if (app !== void 0 && app.length > 0)
+    return app;
+  const fromEnv = env.DSH_PROFILE;
+  return typeof fromEnv === "string" && fromEnv.length > 0 ? fromEnv : "web";
+}
+function versionOf(entry) {
+  let dir = path10.dirname(entry);
+  for (let hop = 0; hop < 4; hop += 1) {
+    const manifest = readJson(path10.join(dir, "package.json"));
+    if (typeof manifest?.version === "string")
+      return manifest.version;
+    dir = path10.dirname(dir);
+  }
+  return null;
+}
+function isEntry(file) {
+  return /\.[cm]?js$/.test(file) && fs11.existsSync(file) && !fs11.statSync(file).isDirectory();
+}
+function realPath(file) {
+  try {
+    return fs11.realpathSync(file);
+  } catch {
+    return file;
+  }
+}
+function cloneEntryFrom(argv1) {
+  if (!isEntry(argv1))
+    return null;
+  const root = path10.dirname(path10.dirname(argv1));
+  for (const candidate of [
+    path10.join(root, "lib", "bin.js"),
+    path10.join(root, "lib", "bin.mjs"),
+    path10.join(root, "lib", "bin.cjs"),
+    path10.join(root, "dist", "bin.js"),
+    path10.join(root, "bin", "dsh.js"),
+    path10.join(root, "bin", "dsh.mjs")
+  ]) {
+    if (isEntry(candidate))
+      return candidate;
+  }
+  return argv1;
+}
+function launchedEntry(argv1) {
+  const real = realPath(argv1);
+  const direct = cloneEntryFrom(real);
+  if (direct !== null)
+    return direct;
+  const shimmed = resolveShimmedCli(real, process7.execPath);
+  return shimmed?.cliEntry == null ? null : cloneEntryFrom(shimmed.cliEntry);
+}
+function findDshEntry(dshHome2) {
+  const found = [];
+  found.push(...dshCandidatesUnder(dshHome2));
+  for (const name2 of readdirNames(path10.join(dshHome2, "profiles")))
+    found.push(...dshCandidatesUnder(path10.join(dshHome2, "profiles", name2)));
+  const withVersion = found.map((entry) => ({ entry, version: versionOf(entry) }));
+  withVersion.sort((a, b) => compareVersions(b.version ?? "0.0.0", a.version ?? "0.0.0"));
+  return withVersion[0]?.entry ?? null;
+}
+function readdirNames(dir) {
+  try {
+    return fs11.readdirSync(dir);
+  } catch {
+    return [];
+  }
+}
+async function resolveDshLaunch(options = {}) {
+  const argv1 = options.argv1 === void 0 ? process7.argv[1] : options.argv1;
+  const dshHome2 = options.dshHome ?? dshHome();
+  const stateDir = options.stateDir ?? pluginStateDir();
+  const local = typeof argv1 === "string" && argv1.length > 0 ? launchedEntry(argv1) : null;
+  if (local !== null && realPath(local) !== realPath(dshLauncherPath(stateDir, path10.extname(local)))) {
+    const launcher = writeDshLauncher({
+      stateDir,
+      dshHome: dshHome2,
+      resolvedEntry: local,
+      entryExtension: path10.extname(local),
+      // Where this install sits, so a rebuilt/moved copy is found next boot.
+      searchRoots: [dshSearchRoot(local)].filter((root) => root !== null)
+    });
+    return { program: process7.execPath, args: [local], cliEntry: local, shimPath: null, source: "entry", launcherPath: launcher.path };
+  }
+  const installed = findDshEntry(dshHome2);
+  if (installed !== null) {
+    const launcher = writeDshLauncher({ stateDir, dshHome: dshHome2, resolvedEntry: installed, entryExtension: path10.extname(installed) });
+    return { program: process7.execPath, args: [installed], cliEntry: installed, shimPath: null, source: "entry", launcherPath: launcher.path };
+  }
+  const found = await (options.findOnPath ?? which)("dsh");
+  if (found === null)
+    return null;
+  const launch = resolveShimmedCli(found, process7.execPath);
+  return launch === null ? null : { ...launch, launcherPath: null };
+}
+function buildCommand(launch, launcherPath2) {
+  if (launcherPath2 !== null && launcherPath2.length > 0)
+    return { command: process7.execPath, entryArgs: [launcherPath2] };
+  return { command: launch.program, entryArgs: launch.args };
+}
+function entryScript(config) {
+  const program = config.command;
+  if (typeof program !== "string" || program.length === 0)
+    return null;
+  if (!path10.isAbsolute(program))
+    return program;
+  const rest = config.args ?? [];
+  return rest.find((arg) => path10.isAbsolute(arg)) ?? program;
+}
+function needsLauncherRepair(config) {
+  const program = config.command;
+  if (typeof program !== "string" || program.length === 0)
+    return false;
+  if (path10.isAbsolute(program))
+    return true;
+  return (config.args ?? []).some((arg, index) => index === 0 && path10.isAbsolute(arg));
+}
+function launcherRepair(config, launch) {
+  if (launch?.launcherPath == null || launch.launcherPath.length === 0)
+    return null;
+  const launcher = launch.launcherPath;
+  const stored = entryScript(config);
+  if (stored === null || stored === launcher)
+    return null;
+  if (stored !== launch.cliEntry)
+    return null;
+  const rest = (config.args ?? []).filter((arg, index) => !(index === 0 && path10.isAbsolute(arg)));
+  return { command: process7.execPath, args: [launcher, ...rest] };
+}
+function buildDshEntry(facts) {
+  const launch = facts.launch;
+  const profile = facts.profile === null || facts.profile === void 0 ? "web" : facts.profile;
+  const appArgs = [];
+  if (facts.port !== null) {
+    appArgs.push(
+      "--port",
+      "{port}",
+      "--host",
+      "{host}",
+      "--no-open",
+      "--trusted-host",
+      `localhost:{port}`
+    );
+    if (facts.host === "0.0.0.0")
+      appArgs.push("--trusted-host", "{lanIp}:{port}");
+  }
+  const launcherArgs = profile === "web" ? ["web"] : ["--profile", profile];
+  const generated = launch === null ? { command: "dsh", entryArgs: [] } : buildCommand(launch, facts.launcherPath ?? null);
+  return {
+    id: facts.id,
+    label: "DSH web",
+    enabled: true,
+    autostart: true,
+    command: generated.command,
+    args: [...generated.entryArgs, ...launcherArgs, ...appArgs],
+    bind: facts.host === "0.0.0.0" ? "lan" : "local",
+    port: facts.port,
+    cwd: process7.cwd(),
+    env: {},
+    dataEnvs: { DSH_HOME: facts.dshHome },
+    onPortConflict: "kill",
+    stop: { killPortHolders: true },
+    health: {
+      enabled: true,
+      mode: "http",
+      // 401 is normal here: the panel answers the login route when auth is on.
+      http: { path: "/", method: "GET", expectStatusBelow: 500, expectBody: "" }
+    }
+  };
+}
+
+// src/home-hosted/entries.ts
+function defaultOnPortConflict(platform = process.platform) {
+  return platform === "win32" ? "kill" : "follow";
+}
+function defaultIntent(id, platform = process.platform) {
+  return {
+    id,
+    autostart: true,
+    onPortConflict: defaultOnPortConflict(platform),
+    stopKillPortHolders: true,
+    persistent: true
+  };
+}
+function ownedPatch(intent, live, options = {}) {
+  const stop = live?.stop ?? {};
+  return {
+    autostart: intent.autostart,
+    onPortConflict: intent.onPortConflict,
+    ...options.persistent === false ? {} : { persistent: intent.persistent },
+    stop: { ...stop, killPortHolders: intent.stopKillPortHolders }
+  };
+}
+function ownedDrift(live, intent, options = {}) {
+  if (live === null)
+    return ["missing entry"];
+  const drift = [];
+  if (live.autostart !== intent.autostart)
+    drift.push("autostart");
+  if (live.onPortConflict !== intent.onPortConflict)
+    drift.push("onPortConflict");
+  if (options.persistent !== false && (live.persistent ?? false) !== intent.persistent)
+    drift.push("persistent");
+  const killPortHolders = live.stop?.killPortHolders;
+  if (killPortHolders !== intent.stopKillPortHolders)
+    drift.push("stop.killPortHolders");
+  return drift;
+}
+function snapshotOwned(live) {
+  const killPortHolders = live.stop?.killPortHolders;
+  return {
+    id: live.id,
+    autostart: typeof live.autostart === "boolean" ? live.autostart : false,
+    onPortConflict: isOnPortConflict(live.onPortConflict) ? live.onPortConflict : "block",
+    persistent: live.persistent === true,
+    stop: { killPortHolders: typeof killPortHolders === "boolean" ? killPortHolders : false }
+  };
+}
+function restorePatch(live, snapshot) {
+  const stop = live.stop ?? {};
+  const previous = snapshot?.stop ?? {};
+  return {
+    autostart: snapshot?.autostart ?? false,
+    onPortConflict: snapshot?.onPortConflict ?? "block",
+    persistent: snapshot?.persistent === true,
+    stop: {
+      ...stop,
+      killPortHolders: typeof previous.killPortHolders === "boolean" ? previous.killPortHolders : false
+    }
+  };
+}
 
 // src/home-hosted/panel-control.ts
 import { spawn as spawn2 } from "node:child_process";
-import fs11 from "node:fs";
+import fs12 from "node:fs";
 import path11 from "node:path";
 import process8 from "node:process";
 function cliArgs(deps, command) {
@@ -2642,7 +2943,7 @@ log('started with exit ' + String(result.status))
 function writeTakeoverHelper(deps, oldPid) {
   const file = takeoverHelperPath(deps.stateDir);
   writeFileAtomic(file, buildTakeoverSource(deps, oldPid), 493);
-  fs11.chmodSync(file, 493);
+  fs12.chmodSync(file, 493);
   return file;
 }
 function spawnDetached(program, args) {
@@ -2760,14 +3061,19 @@ var PanelClient = class {
     return await this.request("POST", `/api/servers/${encodeURIComponent(id)}/free-port`);
   }
 };
-async function verifyToken(baseUrl, token, timeoutMs = 5e3) {
+async function probeToken(baseUrl, token, timeoutMs = 5e3) {
   try {
     await new PanelClient({ baseUrl, token, timeoutMs }).listServers();
-    return true;
-  } catch {
-    return false;
+    return "ok";
+  } catch (error) {
+    if (error instanceof PanelError && (error.code === "AUTH_REQUIRED" || error.status === 401 || error.status === 403))
+      return "refused";
+    return "unreachable";
   }
 }
+async function verifyToken(baseUrl, token, timeoutMs = 5e3) {
+  return await probeToken(baseUrl, token, timeoutMs) === "ok";
+}
 
 // src/home-hosted/runtime.ts
 import http from "node:http";
@@ -2863,18 +3169,35 @@ function apiTokenEnrolled(home) {
   const secrets = readJson(secretsFile(home));
   return secrets !== null && secrets.apiToken !== null && secrets.apiToken !== void 0;
 }
-var inFlight = /* @__PURE__ */ new Map();
+var queue = /* @__PURE__ */ new Map();
+function serialised(stateDir, work) {
+  const key = path12.resolve(stateDir);
+  const previous = queue.get(key) ?? Promise.resolve();
+  const next = previous.then(work, work);
+  const settled = next.then(() => void 0, () => void 0);
+  queue.set(key, settled);
+  void settled.then(() => {
+    if (queue.get(key) === settled) queue.delete(key);
+  });
+  return next;
+}
 async function ensureToken(options) {
-  const key = path12.resolve(options.stateDir);
-  const pending = inFlight.get(key);
-  if (pending !== void 0)
-    return await pending;
-  const attempt = enrollToken(options);
-  inFlight.set(key, attempt);
+  return await serialised(options.stateDir, async () => await enrollToken(options));
+}
+async function reclaimToken(options) {
+  return await serialised(options.stateDir, async () => await enrollFreshToken(options));
+}
+async function runCli2(exec, args, env) {
   try {
-    return await attempt;
-  } finally {
-    inFlight.delete(key);
+    const result = await exec(args, env);
+    if (result.code !== 0) {
+      return {
+        failure: result.error?.trim() || result.stderr.trim() || result.stdout.trim() || `exit ${String(result.code)}`
+      };
+    }
+    return { result };
+  } catch (error) {
+    return { failure: error instanceof Error ? error.message : String(error) };
   }
 }
 async function enrollToken(options) {
@@ -2889,20 +3212,34 @@ async function enrollToken(options) {
     };
   }
   const token = generateToken();
-  const result = await options.exec(["--home", options.home, "set-token"], { HHOSTED_TOKEN: token });
-  if (result.code !== 0) {
+  const enrolled = await runCli2(options.exec, ["--home", options.home, "set-token"], { HHOSTED_TOKEN: token });
+  if (enrolled.result === void 0) {
     return {
       token: null,
       enrolled: false,
-      detail: `could not enrol an API token: ${result.stderr.trim() || result.stdout.trim() || `exit ${String(result.code)}`}`
+      detail: `could not enrol an API token: ${enrolled.failure ?? "the CLI did not answer"}`
     };
   }
   storeToken(options.stateDir, token);
   return { token, enrolled: true, detail: "enrolled a new panel API token" };
 }
+async function enrollFreshToken(options) {
+  const token = generateToken();
+  const enrolled = await runCli2(options.exec, ["--home", options.home, "set-token"], { HHOSTED_TOKEN: token });
+  if (enrolled.result === void 0) {
+    return {
+      token: null,
+      detail: `could not enrol a fresh API token: ${enrolled.failure ?? "the CLI did not answer"}; the previously stored token was kept`
+    };
+  }
+  storeToken(options.stateDir, token);
+  return { token, detail: "enrolled a fresh panel API token" };
+}
 
 // src/service.ts
 var ENTRY_ID_PATTERN = /^[a-z0-9][a-z0-9_-]*$/;
+var TOKEN_PROBE_TIMEOUT_MS = 3e3;
+var ENTRY_RECOVERY_INTERVAL_MS = 3e4;
 function pluginRoot() {
   try {
     return path13.dirname(path13.dirname(fileURLToPath(import.meta.url)));
@@ -2924,8 +3261,18 @@ var HomeHostedService = class extends Service {
     this.snapshotsFile = path13.join(options.stateDir, "snapshots.json");
   }
   clientCache = null;
+  /** The last token this service proved against a panel, so a poll does not re-probe it. */
+  tokenProof = null;
   tokenDetail = "";
+  /** When a missing managed entry was last put back, so a poll cannot become a write loop. */
+  entryRecoveryAt = 0;
   snapshotsFile;
+  async resolveDsh(dshHome2) {
+    return await (this.options.resolveDsh ?? ((options) => resolveDshLaunch(options)))({
+      dshHome: dshHome2,
+      stateDir: this.options.stateDir
+    });
+  }
   // -------------------------------------------------------------------------
   // Facts
   // -------------------------------------------------------------------------
@@ -3019,14 +3366,40 @@ var HomeHostedService = class extends Service {
       throw new HomeHostedError(read.error, "CONFIG_UNREADABLE");
     writeConfig(this.options.home, patchControl(read.raw ?? {}, { port }), this.writtenBy());
   }
+  /** Whether this exact token was already proved against this exact panel. */
+  tokenProven(url, token) {
+    return this.tokenProof !== null && this.tokenProof.until > Date.now() && this.tokenProof.url === url && this.tokenProof.token === token;
+  }
+  proveToken(url, token) {
+    this.tokenProof = { url, token, until: Date.now() + 3e4 };
+  }
   async panelStatus() {
     const runtime = this.runtime();
     const stored = readStoredToken(this.options.stateDir);
     const enrolledOnDisk = apiTokenEnrolled(this.options.home);
     const reachable = runtime !== null && (pidAlive(runtime.pid) || await probePanel(runtime.url));
     const answered = runtime !== null && await probePanel(runtime.url);
-    const token = stored !== null ? "enrolled" : enrolledOnDisk ? "present" : "absent";
-    const writeVia = answered && stored !== null ? "api" : "file";
+    let token = "unknown";
+    let tokenVerified = false;
+    if (answered) {
+      if (stored === null) {
+        token = enrolledOnDisk ? "present" : "absent";
+      } else if (this.tokenProven(runtime.url, stored)) {
+        token = "enrolled";
+        tokenVerified = true;
+      } else {
+        const probe = await probeToken(runtime.url, stored, TOKEN_PROBE_TIMEOUT_MS);
+        if (probe === "ok") {
+          token = "enrolled";
+          tokenVerified = true;
+          this.proveToken(runtime.url, stored);
+        } else if (probe === "refused") {
+          token = "stale";
+          tokenVerified = true;
+        }
+      }
+    }
+    const writeVia = token === "enrolled" ? "api" : "file";
     return {
       home: this.options.home,
       reachable: answered,
@@ -3036,9 +3409,55 @@ var HomeHostedService = class extends Service {
       pid: runtime?.pid ?? null,
       writeVia,
       token,
-      detail: answered ? stored !== null ? this.tokenDetail || "the panel is answering and this plugin holds a token" : enrolledOnDisk ? "the panel is answering, but home-hosted already holds an API token this plugin does not have" : "the panel is answering; a token will be enrolled on the first write" : runtime === null ? "no run.json: the panel is not running, so entries are written straight to servers.config.json" : reachable ? "the panel process is alive but is not answering" : "the panel is not running"
+      tokenVerified,
+      detail: answered ? token === "enrolled" ? this.tokenDetail || "the panel is answering and this plugin holds a token" : token === "stale" ? "the panel refused this plugin's API token, so writes go straight to servers.config.json; regenerate the token" : token === "present" ? "the panel is answering, but home-hosted already holds an API token this plugin does not have" : token === "absent" ? "the panel is answering but no API token is enrolled for it yet; writes go to servers.config.json until one is" : "the panel answered, but the plugin's token could not be checked" : runtime === null ? "no run.json: the panel is not running, so entries are written straight to servers.config.json" : token === "present" || token === "stale" ? "the panel process is up but does not answer with this plugin's API token, so this page cannot reach it" : "the panel process is alive but is not answering"
     };
   }
+  /**
+   * Replace the panel's API token with a fresh one and prove it.
+   *
+   * home-hosted keeps only a hash, so a token this plugin does not hold cannot
+   * be recovered: a new token replaces the old hash in one CLI write, and it is
+   * proved against the answering panel before being reported.
+   *
+   * The panel is not required to be *answering*: a missing or refused token is a
+   * common reason it cannot be reached at all, and refusing the repair for that
+   * reason would leave no way out from the page. Only a panel that was never
+   * started is refused — there is nothing to enrol a token against yet.
+   */
+  async reclaimPanelToken() {
+    const runtime = this.runtime();
+    if (runtime === null) {
+      throw new HomeHostedError(
+        "the panel has not been started, so there is nothing to enrol a token against; start it first",
+        "PANEL_UNAVAILABLE"
+      );
+    }
+    const answering = await probePanel(runtime.url);
+    const result = await reclaimToken({
+      home: this.options.home,
+      stateDir: this.options.stateDir,
+      exec: (args, env) => this.cliExec(args, env)
+    });
+    this.clientCache = null;
+    this.tokenProof = null;
+    this.tokenDetail = result.detail;
+    if (result.token === null)
+      throw new HomeHostedError(result.detail, "TOKEN_RECLAIM_FAILED");
+    if (!answering) {
+      this.tokenDetail = `${result.detail}; the panel is not answering, so it could not be proved yet`;
+      return await this.status();
+    }
+    const probe = await probeToken(runtime.url, result.token, TOKEN_PROBE_TIMEOUT_MS);
+    if (probe !== "ok") {
+      throw new HomeHostedError(
+        probe === "refused" ? "a fresh token was enrolled, but the panel refused it; check the panel log before trying again" : "a fresh token was enrolled, but the panel stopped answering before it could be verified",
+        "TOKEN_RECLAIM_UNVERIFIED"
+      );
+    }
+    this.proveToken(runtime.url, result.token);
+    return await this.status();
+  }
   async tryClient() {
     if (this.clientCache !== null && this.clientCache.until > Date.now())
       return this.clientCache.client;
@@ -3057,6 +3476,7 @@ var HomeHostedService = class extends Service {
       return null;
     const client = new PanelClient({ baseUrl: runtime.url, token: ensured.token });
     this.clientCache = { client, until: Date.now() + 3e4 };
+    this.proveToken(runtime.url, ensured.token);
     return client;
   }
   async requireClient() {
@@ -3095,20 +3515,35 @@ var HomeHostedService = class extends Service {
       map.set(entry.id, { view: { id: entry.id, status: "unknown", pid: null, url: null, config: entry }, config: entry });
     return map;
   }
-  async createEntry(intent, patch, live) {
+  async createEntry(intent, patch) {
     if (intent.id !== this.options.defaultEntryId)
       return null;
-    const dsh = await resolveDshLaunch();
+    const harnessHome = process10.env.DSH_HOME ?? dshHome();
+    const dsh = await this.resolveDsh(harnessHome);
     const { port, host } = this.webServer();
     const generated = buildDshEntry({
       id: intent.id,
       port,
       host,
       profile: detectProfile(process10.argv, process10.env),
-      dshHome: process10.env.DSH_HOME ?? dshHome(),
-      launch: dsh
+      dshHome: harnessHome,
+      launch: dsh,
+      launcherPath: dsh?.launcherPath ?? null
     });
-    return { ...live ?? generated, ...generated, ...patch };
+    return { ...generated, ...patch };
+  }
+  /**
+   * An entry written before the launcher existed still runs a clone's build
+   * output directly. Point it at the stable launcher, or the fix would only
+   * ever apply to freshly created entries — the plugin never rewrites an
+   * existing entry's command.
+   */
+  async dshCommandRepair(live) {
+    if (live === null || !needsLauncherRepair(live))
+      return null;
+    const harnessHome = process10.env.DSH_HOME ?? dshHome();
+    const dsh = await this.resolveDsh(harnessHome);
+    return launcherRepair(live, dsh);
   }
   async writeOwned(intent) {
     const live = (await this.liveEntries()).get(intent.id) ?? null;
@@ -3118,13 +3553,14 @@ var HomeHostedService = class extends Service {
       this.saveSnapshots(snapshots);
     }
     const patch = ownedPatch(intent, live?.config ?? null, { persistent: await this.supportsPersistent() });
+    const repair = intent.id === this.options.defaultEntryId ? await this.dshCommandRepair(live?.config ?? null) : null;
     const client = await this.tryClient();
     if (client !== null) {
       if (live !== null) {
-        await client.updateServer(intent.id, patch);
+        await client.updateServer(intent.id, { ...patch, ...repair ?? {} });
         return;
       }
-      const entry2 = await this.createEntry(intent, patch, null);
+      const entry2 = await this.createEntry(intent, patch);
       if (entry2 === null) {
         throw new HomeHostedError(
           `no server "${intent.id}" exists; create it first, then this plugin can adopt its autostart and conflict policy`,
@@ -3139,10 +3575,10 @@ var HomeHostedService = class extends Service {
       throw new HomeHostedError(read.error, "CONFIG_UNREADABLE");
     let raw = read.raw ?? {};
     if (findEntry(raw, intent.id) !== null) {
-      writeConfig(this.options.home, patchEntry(raw, intent.id, patch), this.writtenBy());
+      writeConfig(this.options.home, patchEntry(raw, intent.id, { ...patch, ...repair ?? {} }), this.writtenBy());
       return;
     }
-    const entry = await this.createEntry(intent, patch, null);
+    const entry = await this.createEntry(intent, patch);
     if (entry === null)
       throw new HomeHostedError(`no server "${intent.id}" exists in ${this.options.home}/servers.config.json`, "ENTRY_MISSING");
     if (await this.panelRunning()) {
@@ -3211,8 +3647,9 @@ var HomeHostedService = class extends Service {
       entries.push(intent);
       this.options.settings.update({
         // The page's toggle reads this flag, so managing the harness has to record
-        // itself; restoring or removing that entry clears it again.
-        ...intent.id === this.options.defaultEntryId ? { manageDsh: true } : {},
+        // itself; restoring or removing that entry clears it again. A paused intent
+        // (`autostart: false`) is not management, or the toggle could never go off.
+        ...intent.id === this.options.defaultEntryId ? { manageDsh: intent.autostart } : {},
         entries
       });
     }
@@ -3301,7 +3738,7 @@ var HomeHostedService = class extends Service {
       case "switch": {
         if (file === void 0 || file.trim().length === 0)
           throw new HomeHostedError("switching the UI needs the zip to install", "UI_FILE_REQUIRED");
-        if (!fs12.existsSync(file))
+        if (!fs13.existsSync(file))
           throw new HomeHostedError(`no file at ${file}`, "UI_FILE_MISSING");
         const result = await runUi(["ui-switch", "--file", file, "--yes"]);
         return { ok: result.code === 0, detail: result.code === 0 ? "the UI was replaced" : "the switch did not run", ui: active(), output: result.output };
@@ -3519,13 +3956,43 @@ var HomeHostedService = class extends Service {
    * an explicit click or an approved tool call, not as a side effect of startup.
    */
   async reconcile() {
+    await this.ensureManagedEntry();
+    await this.repairBootEntry();
+  }
+  /**
+   * Put back a managed entry that no longer exists, while its intent still wants
+   * autostart. A paused intent is a deliberate stop and is left alone.
+   *
+   * Called from startup `reconcile()` as well as the status read, because a person
+   * who deletes the entry from the panel is looking at the page right then — not
+   * at the next plugin start. A failed attempt is not repeated for a while, so a
+   * config that cannot be written does not turn every poll into a write.
+   */
+  async ensureManagedEntry() {
+    const { settings } = this.options;
+    const id = this.options.defaultEntryId;
+    if (!settings.get().manageDsh || !settings.intentFor(id).autostart)
+      return;
+    const now = Date.now();
+    if (now - this.entryRecoveryAt < ENTRY_RECOVERY_INTERVAL_MS)
+      return;
+    this.entryRecoveryAt = now;
+    if ((await this.entriesStatus()).every((entry) => entry.intent.id !== id || entry.exists))
+      return;
+    try {
+      await this.writeOwned({ ...settings.intentFor(id), autostart: true });
+    } catch {
+    }
+  }
+  /** Re-assert the boot entry when the OS still has it but it stopped working. */
+  async repairBootEntry() {
     if (!this.options.settings.get().autostart.enabled)
       return;
     const status = await this.bootStatus();
     if (status.state !== "enabled-failing" && status.state !== "installed-disabled")
       return;
     const fileBacked = status.mechanism === "systemd-user" || status.mechanism === "systemd-system" || status.mechanism === "xdg-autostart" || status.mechanism === "launchd-agent" || status.mechanism === "launchd-daemon";
-    if (fileBacked && (status.unitPath === null || !fs12.existsSync(status.unitPath)))
+    if (fileBacked && (status.unitPath === null || !fs13.existsSync(status.unitPath)))
       return;
     try {
       await this.installBoot();
@@ -3564,7 +4031,9 @@ var HomeHostedService = class extends Service {
       defaultEntryId: this.options.defaultEntryId,
       panel,
       boot: await this.bootStatus(),
-      entries: await this.entriesStatus(),
+      // A deleted managed entry is put back here as well as at startup: whoever
+      // deleted it is looking at the page that reports it missing.
+      entries: await this.ensureManagedEntry().then(async () => await this.entriesStatus()),
       servers,
       settings: this.options.settings.get(),
       cli,
@@ -3638,6 +4107,8 @@ var HomeHostedService = class extends Service {
         return await this.startPanelNow();
       case "panel.takeover":
         return await this.takeoverPanel(input.force === true);
+      case "panel.reclaimToken":
+        return await this.reclaimPanelToken();
       case "cli.installGlobal":
         return await this.installGlobalCli();
       default:
@@ -3831,6 +4302,8 @@ function normalize(raw, fallbackEntryId) {
       port: typeof raw?.panel?.port === "number" && Number.isInteger(raw.panel.port) && raw.panel.port >= 1 && raw.panel.port <= 65535 ? raw.panel.port : null
     },
     authNotice: raw?.authNotice === void 0 ? DEFAULT_SETTINGS.authNotice : raw.authNotice === true,
+    // Absent means on: a stale token is a fault to repair, not a setting to opt into.
+    reclaimToken: raw?.reclaimToken === void 0 ? DEFAULT_SETTINGS.reclaimToken : raw.reclaimToken === true,
     uiStyle: raw?.uiStyle === "compact" ? "compact" : "detailed",
     agentTools: {
       // Absent means the default (on), and so does the pair the previous
@@ -3868,6 +4341,7 @@ var SettingsStore = class {
       entries: patch.entries ?? this.current.entries,
       panel: { ...this.current.panel, ...patch.panel ?? {} },
       authNotice: patch.authNotice ?? this.current.authNotice,
+      reclaimToken: patch.reclaimToken ?? this.current.reclaimToken,
       uiStyle: patch.uiStyle ?? this.current.uiStyle,
       agentTools: { ...this.current.agentTools, ...patch.agentTools ?? {} },
       cli: { ...this.current.cli, ...patch.cli ?? {} }
@@ -4001,7 +4475,49 @@ function toolNameFor(name2) {
 var READ_ONLY_ACTIONS = {
   ui_manage: (input) => stringArg(input, "action") === "status"
 };
-function registerOne(ctx, service, name2) {
+var TOKEN_REFUSAL_CODES = /* @__PURE__ */ new Set([
+  "AUTH_REQUIRED",
+  "AUTH_UNARMED",
+  "UNAUTHORIZED",
+  "FORBIDDEN",
+  "INVALID_TOKEN",
+  "TOKEN_STALE",
+  "TOKEN_REFUSED"
+]);
+function errorCode(error) {
+  const code = error?.code;
+  return typeof code === "string" ? code : null;
+}
+function errorStatus(error) {
+  const status = error?.status;
+  return typeof status === "number" ? status : null;
+}
+function refusedByPanel(error) {
+  const status = errorStatus(error);
+  if (status === 401 || status === 403)
+    return true;
+  const code = errorCode(error);
+  return code !== null && TOKEN_REFUSAL_CODES.has(code);
+}
+async function tokenRefused(service, error) {
+  if (refusedByPanel(error))
+    return true;
+  if (errorCode(error) !== "PANEL_UNAVAILABLE")
+    return false;
+  try {
+    const status = await service.call("status", {});
+    return status?.panel.token === "stale";
+  } catch {
+    return false;
+  }
+}
+function messageOf(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function failureText(error) {
+  return `failed: ${messageOf(error)}`;
+}
+function registerOne(ctx, service, settings, name2) {
   const spec = TOOL_SPECS[name2];
   const toolName = toolNameFor(name2);
   const mutatingTool = MUTATING_AGENT_TOOLS.includes(name2);
@@ -4030,11 +4546,27 @@ function registerOne(ctx, service, name2) {
         if (outcome !== "allowed-once")
           return `refused: approval answered "${outcome}" (session sandbox: ${mode ?? "unknown"}). ${remedy}`;
       }
+      let request;
       try {
-        const { endpoint, payload } = spec.run(input);
-        return JSON.stringify(await service.call(endpoint, payload), null, 2);
+        request = spec.run(input);
       } catch (error) {
-        return `failed: ${error instanceof Error ? error.message : String(error)}`;
+        return failureText(error);
+      }
+      try {
+        return JSON.stringify(await service.call(request.endpoint, request.payload), null, 2);
+      } catch (error) {
+        if (!settings.get().reclaimToken || !await tokenRefused(service, error))
+          return failureText(error);
+        try {
+          await service.call("panel.reclaimToken", {});
+        } catch (reclaimError) {
+          return `${failureText(error)} (token reclaim failed: ${messageOf(reclaimError)})`;
+        }
+        try {
+          return JSON.stringify(await service.call(request.endpoint, request.payload), null, 2);
+        } catch (retryError) {
+          return failureText(retryError);
+        }
       }
     }
   }));
@@ -4050,7 +4582,7 @@ function registerAgentTools(ctx, service, settings) {
         return;
       for (const name2 of current.agentTools.allow) {
         try {
-          disposers.push(registerOne(scoped, service, name2));
+          disposers.push(registerOne(scoped, service, settings, name2));
         } catch {
         }
       }