ever-works-node 0.2.5 → 0.2.6

package/cli.js

@@ -3509,10 +3509,10 @@ var {
 // src/cli/program.ts
 var import_node_path7 = require("node:path");
 
-// ../../node_modules/.pnpm/@ever-co+connect-contracts@1.0.0-rc.2/node_modules/@ever-co/connect-contracts/dist/index.js
+// ../../node_modules/.pnpm/@ever-co+connect-contracts@1.0.0-rc.7/node_modules/@ever-co/connect-contracts/dist/index.js
 var CONSTANTS = {
   "$comment": "Wire constants of the Ever Platform modules. tools/split-integrations.mjs refreshes the fields read from the contract (contracts_version, code patterns, install_sources, products, stats_headers, feed_event_types, integration_keys, root_keys); every other value is a default a product may override by its own configuration.",
-  "contracts_version": "1.0.0-rc.2",
+  "contracts_version": "1.0.0-rc.7",
   "connect_code_pattern": "^EVC(-[0-9A-HJKMNP-TV-Za-hj-kmnp-tv-z]{4}){3}$",
   "link_code_pattern": "^EVL(-[0-9A-HJKMNP-TV-Za-hj-kmnp-tv-z]{4}){3}$",
   "install_sources": "^(cloud|self-hosted|ever\\.sh|works_app|desktop|partner:[a-z0-9-]{2,32})$",
@@ -3660,6 +3660,15 @@ var CONSTANTS = {
       "x": "Ync-MW21JL72GOiS-RVrlvS3gyFH5Krh5f6I66jw1Qc",
       "use": "sig",
       "alg": "EdDSA"
+    },
+    {
+      "kid": "ever-202610-025b",
+      "iss": "https://api.ever.co",
+      "kty": "OKP",
+      "crv": "Ed25519",
+      "x": "AwXJEZdyiK3QEhUnNB-0fIsN9PPLgbF6O3tyZT3moDc",
+      "use": "sig",
+      "alg": "EdDSA"
     }
   ],
   "root_keys_file_env": "EVER_PLATFORM_ROOT_KEYS_FILE",
@@ -3727,6 +3736,7 @@ var PROBLEM_CODES = [
   "already_connected",
   "already_linked",
   "already_claimed",
+  "claim_locked",
   "invalid_client",
   "public_jwk_invalid",
   "identifier_claimed",
@@ -3752,6 +3762,11 @@ var PROBLEM_CODES = [
   "database_absent",
   "database_unreachable",
   "topic_private",
+  "realtime_disabled",
+  "topic_forbidden",
+  "topic_invalid",
+  "realtime_busy",
+  "too_many_streams",
   "keys_unavailable",
   "internal_error"
 ];
@@ -4967,6 +4982,36 @@ var SKILL_READINESS_STATES = [
 ];
 var SKILL_CARD_STATES = [...SKILL_READINESS_STATES, "disabled", "needs_review"];
 var SKILL_READINESS_FILTERS = [...SKILL_CARD_STATES, "attention"];
+var FLEET_CONTROL_POLICY_DEFAULTS = Object.freeze({
+  view: "org-members",
+  sessions: "owner",
+  desktop: "owner",
+  logs: "owner",
+  services: "owner",
+  docker: "owner",
+  processes: "owner",
+  ports: "owner",
+  files: "owner",
+  commands: "owner",
+  schedules: "owner",
+  checkouts: "owner",
+  machines: "owner"
+});
+var FLEET_ACTION_FAMILY_HINT_LABELS = Object.freeze({
+  view: "view",
+  sessions: "sessions",
+  desktop: "desktop",
+  logs: "logs",
+  services: "services",
+  docker: "Docker",
+  processes: "processes",
+  ports: "ports",
+  files: "files",
+  commands: "commands",
+  schedules: "schedules",
+  checkouts: "checkouts",
+  machines: "lifecycle"
+});
 var FLEET_AGENT_CREDENTIAL_FAMILIES = [
   {
     cli: "claude-code",
@@ -5554,6 +5599,581 @@ function truncateToUtf8Bytes(value, maxBytes) {
   return { value: decoded.replace(/\uFFFD+$/, "").trimEnd(), truncated: true };
 }
 __name(truncateToUtf8Bytes, "truncateToUtf8Bytes");
+var FLEET_LINK_VERSION = 1;
+var FLEET_LINK_WS_PATH = "/ws/fleet/link";
+var FLEET_LINK_MAX_FRAME_BYTES = 16 * 1024 * 1024;
+var FLEET_LINK_FRAME_HEADER_BYTES = 9;
+var FLEET_LINK_MAX_PAYLOAD_BYTES = FLEET_LINK_MAX_FRAME_BYTES - FLEET_LINK_FRAME_HEADER_BYTES;
+var FLEET_LINK_MAX_JSON_BYTES = 1024 * 1024;
+var FLEET_LINK_MAX_CHANNEL_NUMBER = 4294967295;
+var FLEET_LINK_MAX_CHANNELS = 64;
+var FLEET_LINK_PING_INTERVAL_MS = 15e3;
+var FLEET_LINK_SILENCE_MS = 45e3;
+var FLEET_LINK_BACKOFF_BASE_MS = 1e3;
+var FLEET_LINK_BACKOFF_MAX_MS = 3e4;
+var FLEET_LINK_REFUSED_RETRY_MS = 5 * 6e4;
+var FLEET_LINK_HELLO_BLOCK_MS = 6e4;
+var FLEET_LINK_AUTH_TIMEOUT_MS = 5e3;
+var FLEET_LINK_INLINE_REPLY_MS = 2e3;
+var FLEET_LINK_RESUME_WINDOW_MS = 12e4;
+var FLEET_OPERATION_RETENTION_MS = 60 * 6e4;
+var FLEET_LINK_DEFAULT_LIMITS = {
+  maxFrameBytes: FLEET_LINK_MAX_FRAME_BYTES,
+  maxChannels: FLEET_LINK_MAX_CHANNELS,
+  pingIntervalMs: FLEET_LINK_PING_INTERVAL_MS,
+  silenceMs: FLEET_LINK_SILENCE_MS,
+  inlineReplyMs: FLEET_LINK_INLINE_REPLY_MS
+};
+var FLEET_LINK_CLOSE_CODES = {
+  /** Normal close (a node shutting down, a channel-less link released). */
+  normal: 1e3,
+  /** The API process is shutting down. */
+  shutdown: 1001,
+  /** Undifferentiated credential refusal. */
+  auth: 4001,
+  /** 45 s without a frame. */
+  silence: 4002,
+  /** This deployment does not accept node links (`FLEET_NODE_LINK_ENABLED` off). */
+  disabled: 4003,
+  /** Too many hellos (CONTRACTS U9). */
+  rateLimited: 4008,
+  /** The other side broke the protocol (bad first frame, a node-opened channel, …). */
+  protocol: 4009,
+  /** A newer link from the same node replaced this one. */
+  replaced: 4010,
+  /** The node presented no consent that allows a link (work, attend, manage all off). */
+  noConsent: 4012
+};
+var FLEET_LINK_FRAME_KINDS = {
+  /** Raw bytes: terminal output/input, log lines, file chunks. */
+  DATA: 1,
+  /** `[cols u16][rows u16]`. */
+  RESIZE: 2,
+  /** `[code i32]`. */
+  EXIT: 3,
+  /** UTF-8 JSON control message. */
+  JSON: 10,
+  /** UTF-8 reason code. */
+  CLOSE: 11,
+  /** A full picture (the existing computer-frame encoding). */
+  FRAME: 20,
+  /** A pointer / key / text event (the existing computer input encoding). */
+  INPUT: 21,
+  /** Changed tiles `[w][h][count]{x,y,w,h,len,jpeg}`. */
+  TILES: 23,
+  /** `[bytes u32]` credit. */
+  ACK: 30,
+  /** End of a stream. */
+  END: 31,
+  /** UTF-8 text ≤ 256 KiB, pasted into a desktop. */
+  CLIP: 40
+};
+var FRAME_KIND_VALUES = new Set(Object.values(FLEET_LINK_FRAME_KINDS));
+function isFleetLinkFrameKind(value) {
+  return typeof value === "number" && FRAME_KIND_VALUES.has(value);
+}
+__name(isFleetLinkFrameKind, "isFleetLinkFrameKind");
+var FLEET_LINK_MAX_CLIP_BYTES = 256 * 1024;
+var FLEET_LINK_CREDIT_WINDOW_BYTES = 8 * 1024 * 1024;
+var FLEET_LINK_CREDIT_FAMILIES = ["files", "logs"];
+var FLEET_CONSENT_FLAGS = {
+  work: "--work",
+  attend: "--attend",
+  manage: "--manage",
+  usageScan: "--usage-scan"
+};
+var FLEET_NO_CONSENTS = Object.freeze({
+  work: false,
+  attend: false,
+  manage: false,
+  usageScan: false
+});
+function normalizeFleetConsents(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  const record = value;
+  return {
+    work: record.work === true,
+    attend: record.attend === true,
+    manage: record.manage === true,
+    usageScan: record.usageScan === true
+  };
+}
+__name(normalizeFleetConsents, "normalizeFleetConsents");
+function isFleetLinkEligible(consents) {
+  return Boolean(consents && (consents.work || consents.attend || consents.manage));
+}
+__name(isFleetLinkEligible, "isFleetLinkEligible");
+var FLEET_LINK_FAMILIES = [
+  "session",
+  "desktop",
+  "logs",
+  "machine",
+  "files",
+  "command",
+  "schedule",
+  "tunnel",
+  "clip"
+];
+function isFleetLinkFamily(value) {
+  return typeof value === "string" && FLEET_LINK_FAMILIES.includes(value);
+}
+__name(isFleetLinkFamily, "isFleetLinkFamily");
+var FLEET_LINK_FAMILY_CONSENT = {
+  session: "work-or-manage",
+  desktop: "attend",
+  logs: "manage",
+  machine: "manage",
+  files: "manage",
+  command: "manage",
+  schedule: "manage",
+  tunnel: "manage",
+  clip: "attend"
+};
+var FLEET_LINK_VERB_CONSENT_OVERRIDES = {
+  /** A read allowed on any open link. */
+  "health.now": "link"
+};
+function fleetLinkVerbConsent(verb) {
+  return Object.prototype.hasOwnProperty.call(FLEET_LINK_VERB_CONSENT_OVERRIDES, verb) ? FLEET_LINK_VERB_CONSENT_OVERRIDES[verb] : FLEET_LINK_FAMILY_CONSENT.machine;
+}
+__name(fleetLinkVerbConsent, "fleetLinkVerbConsent");
+function fleetLinkChannelOpenConsent(family) {
+  if (family === "machine" && Object.keys(FLEET_LINK_VERB_CONSENT_OVERRIDES).length > 0) return "link";
+  return FLEET_LINK_FAMILY_CONSENT[family];
+}
+__name(fleetLinkChannelOpenConsent, "fleetLinkChannelOpenConsent");
+function fleetConsentSatisfies(consents, requirement) {
+  if (!consents) return false;
+  switch (requirement) {
+    case "link":
+      return isFleetLinkEligible(consents);
+    case "work":
+      return consents.work;
+    case "attend":
+      return consents.attend;
+    case "manage":
+      return consents.manage;
+    case "work-or-manage":
+      return consents.work || consents.manage;
+    default:
+      return false;
+  }
+}
+__name(fleetConsentSatisfies, "fleetConsentSatisfies");
+function fleetConsentFlagsFor(requirement) {
+  switch (requirement) {
+    case "work":
+      return [FLEET_CONSENT_FLAGS.work];
+    case "attend":
+      return [FLEET_CONSENT_FLAGS.attend];
+    case "manage":
+      return [FLEET_CONSENT_FLAGS.manage];
+    case "work-or-manage":
+      return [FLEET_CONSENT_FLAGS.work, FLEET_CONSENT_FLAGS.manage];
+    case "link":
+    default:
+      return [FLEET_CONSENT_FLAGS.work, FLEET_CONSENT_FLAGS.attend, FLEET_CONSENT_FLAGS.manage];
+  }
+}
+__name(fleetConsentFlagsFor, "fleetConsentFlagsFor");
+function fleetConsentMissingHint(requirement, nodeName) {
+  const flags = fleetConsentFlagsFor(requirement);
+  const joined = flags.length === 1 ? flags[0] : `${flags.slice(0, -1).join(", ")} or ${flags[flags.length - 1]}`;
+  return `start the node with ${joined} on ${nodeName}`;
+}
+__name(fleetConsentMissingHint, "fleetConsentMissingHint");
+var VERB_PATTERN = /^[a-z][a-zA-Z0-9]{0,31}(?:\.[a-z][a-zA-Z0-9]{0,31}){0,3}$/;
+function isFleetLinkVerb(value) {
+  return typeof value === "string" && VERB_PATTERN.test(value);
+}
+__name(isFleetLinkVerb, "isFleetLinkVerb");
+var FLEET_LINK_ERROR_CODES = [
+  "not_found",
+  "invalid",
+  "unreachable",
+  "consent_missing",
+  "permission_denied",
+  "confirmation_required",
+  "root_required",
+  "kill_switch",
+  "limit_exceeded",
+  "unsupported_on_node",
+  "busy",
+  "operation_failed",
+  "internal",
+  /** A channel the reconnect could not resume (CONTRACTS §3.1). */
+  "resume_failed"
+];
+function isFleetLinkErrorCode(value) {
+  return typeof value === "string" && FLEET_LINK_ERROR_CODES.includes(value);
+}
+__name(isFleetLinkErrorCode, "isFleetLinkErrorCode");
+var FLEET_LINK_MAX_HINT_LENGTH = 500;
+var FLEET_LINK_CONTROL_TYPES = [
+  "link.hello",
+  "link.ready",
+  "link.ping",
+  "link.pong",
+  "link.pause",
+  "link.resume",
+  "link.drain",
+  "channel.open",
+  "channel.ready",
+  "channel.refused",
+  "channel.close",
+  "operation.progress",
+  "operation.done",
+  "operation.cancel"
+];
+var ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+function isFleetLinkId(value) {
+  return typeof value === "string" && ID_PATTERN.test(value);
+}
+__name(isFleetLinkId, "isFleetLinkId");
+var FLEET_LINK_MAX_JSON_DEPTH = 32;
+var MAX_TOKEN_LENGTH = 4096;
+var MAX_TAGS = 64;
+var MAX_TAG_LENGTH = 128;
+var MAX_VERSION_LENGTH = 64;
+var MAX_RESUME_KEY_LENGTH = 128;
+var MAX_SERVER_TIME_LENGTH = 64;
+var MAX_PROGRESS_MESSAGE_LENGTH = 500;
+var MAX_DRAIN_GRACE_SEC = 3600;
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var EXTENSION_TYPE_PATTERN = /^[a-z][a-zA-Z0-9]{0,31}(?:\.[a-z][a-zA-Z0-9-]{0,31}){1,3}$/;
+var RESUME_KEY_PATTERN = /^[\x21-\x7e]+$/;
+var FORBIDDEN_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var CONTROL_TYPES = new Set(FLEET_LINK_CONTROL_TYPES);
+var KIND_JSON = FLEET_LINK_FRAME_KINDS.JSON;
+var utf8Encoder = new TextEncoder();
+function utf8Decode(bytes) {
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    return null;
+  }
+}
+__name(utf8Decode, "utf8Decode");
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+__name(isRecord4, "isRecord4");
+function isChannelNumber(value, allowControl = false) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= (allowControl ? 0 : 1) && value <= FLEET_LINK_MAX_CHANNEL_NUMBER;
+}
+__name(isChannelNumber, "isChannelNumber");
+function isBoundedInt3(value, min, max) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= min && value <= max;
+}
+__name(isBoundedInt3, "isBoundedInt3");
+function boundedString(value, max) {
+  return typeof value === "string" && value.length <= max ? value : null;
+}
+__name(boundedString, "boundedString");
+function toBytes(raw) {
+  if (raw instanceof Uint8Array) return raw;
+  if (raw instanceof ArrayBuffer) return new Uint8Array(raw);
+  if (ArrayBuffer.isView(raw)) return new Uint8Array(raw.buffer, raw.byteOffset, raw.byteLength);
+  return null;
+}
+__name(toBytes, "toBytes");
+function encodeFleetLinkFrame(channel, kind, payload) {
+  if (!isChannelNumber(channel, true) || !isFleetLinkFrameKind(kind) || !(payload instanceof Uint8Array)) {
+    return null;
+  }
+  const total = FLEET_LINK_FRAME_HEADER_BYTES + payload.byteLength;
+  if (total > FLEET_LINK_MAX_FRAME_BYTES) return null;
+  const out = new Uint8Array(total);
+  const view = new DataView(out.buffer);
+  view.setUint32(0, channel, false);
+  view.setUint8(4, kind);
+  view.setUint32(5, payload.byteLength, false);
+  out.set(payload, FLEET_LINK_FRAME_HEADER_BYTES);
+  return out;
+}
+__name(encodeFleetLinkFrame, "encodeFleetLinkFrame");
+function decodeFleetLinkFrame(raw) {
+  const bytes = toBytes(raw);
+  if (!bytes) return null;
+  if (bytes.byteLength > FLEET_LINK_MAX_FRAME_BYTES) return null;
+  if (bytes.byteLength < FLEET_LINK_FRAME_HEADER_BYTES) return null;
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const channel = view.getUint32(0, false);
+  const kind = view.getUint8(4);
+  const length = view.getUint32(5, false);
+  if (!isFleetLinkFrameKind(kind)) return null;
+  if (length !== bytes.byteLength - FLEET_LINK_FRAME_HEADER_BYTES) return null;
+  return {
+    channel,
+    kind,
+    payload: bytes.subarray(FLEET_LINK_FRAME_HEADER_BYTES)
+  };
+}
+__name(decodeFleetLinkFrame, "decodeFleetLinkFrame");
+function peekFleetLinkFrameChannel(raw) {
+  const bytes = toBytes(raw);
+  if (!bytes || bytes.byteLength < 4) return null;
+  return new DataView(bytes.buffer, bytes.byteOffset, 4).getUint32(0, false);
+}
+__name(peekFleetLinkFrameChannel, "peekFleetLinkFrameChannel");
+function depthWithin(value, maxDepth) {
+  const stack = [{ value, depth: 1 }];
+  while (stack.length > 0) {
+    const next = stack.pop();
+    if (next.depth > maxDepth) return false;
+    if (typeof next.value === "object" && next.value !== null) {
+      for (const child of Object.values(next.value)) {
+        if (typeof child === "object" && child !== null) stack.push({ value: child, depth: next.depth + 1 });
+      }
+    }
+  }
+  return true;
+}
+__name(depthWithin, "depthWithin");
+function decodeFleetLinkJson(payload, maxBytes = FLEET_LINK_MAX_JSON_BYTES) {
+  if (!(payload instanceof Uint8Array) || payload.byteLength === 0 || payload.byteLength > maxBytes) return null;
+  const text = utf8Decode(payload);
+  if (text === null) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(text, (key, value) => FORBIDDEN_KEYS.has(key) ? void 0 : value);
+  } catch {
+    return null;
+  }
+  if (!isRecord4(parsed) || !depthWithin(parsed, FLEET_LINK_MAX_JSON_DEPTH)) return null;
+  return parsed;
+}
+__name(decodeFleetLinkJson, "decodeFleetLinkJson");
+function encodeFleetLinkJson(channel, value, maxBytes = channel === 0 ? FLEET_LINK_MAX_JSON_BYTES : FLEET_LINK_MAX_FRAME_BYTES - FLEET_LINK_FRAME_HEADER_BYTES) {
+  let text;
+  try {
+    text = JSON.stringify(value);
+  } catch {
+    return null;
+  }
+  if (typeof text !== "string") return null;
+  const payload = utf8Encoder.encode(text);
+  if (payload.byteLength > maxBytes) return null;
+  return encodeFleetLinkFrame(channel, KIND_JSON, payload);
+}
+__name(encodeFleetLinkJson, "encodeFleetLinkJson");
+function normalizeFleetLinkError(value) {
+  if (!isRecord4(value) || !isFleetLinkErrorCode(value.code)) return null;
+  const hint = typeof value.hint === "string" ? value.hint.slice(0, FLEET_LINK_MAX_HINT_LENGTH) : "";
+  const error = { code: value.code, hint };
+  if (isRecord4(value.details)) error.details = value.details;
+  return error;
+}
+__name(normalizeFleetLinkError, "normalizeFleetLinkError");
+function makeFleetLinkError(code, hint, details) {
+  const error = { code, hint: hint.slice(0, FLEET_LINK_MAX_HINT_LENGTH) };
+  if (details) error.details = details;
+  return error;
+}
+__name(makeFleetLinkError, "makeFleetLinkError");
+function closeReason(value) {
+  if (value === "normal") return "normal";
+  return isFleetLinkErrorCode(value) ? value : null;
+}
+__name(closeReason, "closeReason");
+function decodeCapabilities(value) {
+  if (!Array.isArray(value) || value.length > MAX_TAGS) return null;
+  const out = [];
+  for (const tag of value) {
+    if (typeof tag !== "string" || tag.length === 0 || tag.length > MAX_TAG_LENGTH) return null;
+    out.push(tag);
+  }
+  return out;
+}
+__name(decodeCapabilities, "decodeCapabilities");
+function decodeResumeChannels(value) {
+  if (!Array.isArray(value) || value.length > FLEET_LINK_MAX_CHANNELS) return null;
+  const out = [];
+  for (const entry of value) {
+    if (!isRecord4(entry) || !isChannelNumber(entry.channel) || !isFleetLinkFamily(entry.family)) return null;
+    const channel = { channel: entry.channel, family: entry.family };
+    if (entry.resumeKey !== void 0) {
+      const key = boundedString(entry.resumeKey, MAX_RESUME_KEY_LENGTH);
+      if (key === null || !RESUME_KEY_PATTERN.test(key)) return null;
+      channel.resumeKey = key;
+    }
+    out.push(channel);
+  }
+  return out;
+}
+__name(decodeResumeChannels, "decodeResumeChannels");
+function decodeChannelList(value) {
+  if (!Array.isArray(value) || value.length > FLEET_LINK_MAX_CHANNELS) return null;
+  return value.every((entry) => isChannelNumber(entry)) ? [...value] : null;
+}
+__name(decodeChannelList, "decodeChannelList");
+function decodeLimits(value) {
+  if (!isRecord4(value)) return null;
+  const { maxFrameBytes, maxChannels, pingIntervalMs, silenceMs, inlineReplyMs } = value;
+  if (!isBoundedInt3(maxFrameBytes, FLEET_LINK_FRAME_HEADER_BYTES, FLEET_LINK_MAX_FRAME_BYTES) || !isBoundedInt3(maxChannels, 1, FLEET_LINK_MAX_CHANNELS) || !isBoundedInt3(pingIntervalMs, 1, 36e5) || !isBoundedInt3(silenceMs, 1, 36e5) || !isBoundedInt3(inlineReplyMs, 1, 36e5)) {
+    return null;
+  }
+  return { maxFrameBytes, maxChannels, pingIntervalMs, silenceMs, inlineReplyMs };
+}
+__name(decodeLimits, "decodeLimits");
+function decodeHello(record) {
+  const nodeId = boundedString(record.nodeId, 36);
+  const token = boundedString(record.token, MAX_TOKEN_LENGTH);
+  const capabilities = decodeCapabilities(record.capabilities);
+  const consents = normalizeFleetConsents(record.consents);
+  if (nodeId === null || !UUID_PATTERN.test(nodeId) || !isBoundedInt3(record.linkVersion, 1, 1e3) || capabilities === null || consents === null || token === null || token.length === 0) {
+    return null;
+  }
+  const hello = {
+    type: "link.hello",
+    nodeId: nodeId.toLowerCase(),
+    linkVersion: record.linkVersion,
+    capabilities,
+    consents,
+    token
+  };
+  if (record.nodeVersion !== void 0) {
+    const version = boundedString(record.nodeVersion, MAX_VERSION_LENGTH);
+    if (version === null) return null;
+    hello.nodeVersion = version;
+  }
+  if (record.resume !== void 0) {
+    if (!isRecord4(record.resume) || !isBoundedInt3(record.resume.linkGeneration, 0, Number.MAX_SAFE_INTEGER)) {
+      return null;
+    }
+    const channels = decodeResumeChannels(record.resume.channels ?? []);
+    if (channels === null) return null;
+    hello.resume = { linkGeneration: record.resume.linkGeneration, channels };
+  }
+  return hello;
+}
+__name(decodeHello, "decodeHello");
+function decodeKnownControl(record) {
+  switch (record.type) {
+    case "link.hello":
+      return decodeHello(record);
+    case "link.ready": {
+      const limits = decodeLimits(record.limits);
+      const serverTime = boundedString(record.serverTime, MAX_SERVER_TIME_LENGTH);
+      const resumed = decodeChannelList(record.resumed ?? []);
+      const closed = decodeChannelList(record.closed ?? []);
+      if (!isBoundedInt3(record.linkGeneration, 1, Number.MAX_SAFE_INTEGER) || limits === null || serverTime === null || resumed === null || closed === null) {
+        return null;
+      }
+      return { type: "link.ready", linkGeneration: record.linkGeneration, limits, serverTime, resumed, closed };
+    }
+    case "link.ping":
+    case "link.pong":
+      return typeof record.t === "number" && Number.isFinite(record.t) ? { type: record.type === "link.ping" ? "link.ping" : "link.pong", t: record.t } : null;
+    case "link.pause":
+      return record.reason === "kill_switch" ? { type: "link.pause", reason: "kill_switch" } : null;
+    case "link.resume":
+      return { type: "link.resume" };
+    case "link.drain":
+      return isBoundedInt3(record.graceSec, 0, MAX_DRAIN_GRACE_SEC) ? { type: "link.drain", graceSec: record.graceSec } : null;
+    case "channel.open": {
+      if (!isChannelNumber(record.channel) || !isFleetLinkFamily(record.family) || !isFleetLinkId(record.requestId) || record.params !== void 0 && !isRecord4(record.params)) {
+        return null;
+      }
+      return {
+        type: "channel.open",
+        channel: record.channel,
+        family: record.family,
+        params: record.params ?? {},
+        requestId: record.requestId
+      };
+    }
+    case "channel.ready": {
+      if (!isChannelNumber(record.channel) || !isFleetLinkId(record.requestId)) return null;
+      const ready = {
+        type: "channel.ready",
+        channel: record.channel,
+        requestId: record.requestId
+      };
+      if (record.resumeKey !== void 0) {
+        const key = boundedString(record.resumeKey, MAX_RESUME_KEY_LENGTH);
+        if (key === null || !RESUME_KEY_PATTERN.test(key)) return null;
+        ready.resumeKey = key;
+      }
+      return ready;
+    }
+    case "channel.refused": {
+      const error = normalizeFleetLinkError(
+        record.error !== void 0 ? record.error : { code: record.code, hint: record.hint, details: record.details }
+      );
+      if (!isChannelNumber(record.channel) || !isFleetLinkId(record.requestId) || error === null) return null;
+      return { type: "channel.refused", channel: record.channel, requestId: record.requestId, error };
+    }
+    case "channel.close": {
+      const reason = closeReason(record.reason);
+      if (!isChannelNumber(record.channel) || reason === null) return null;
+      const close = { type: "channel.close", channel: record.channel, reason };
+      if (typeof record.hint === "string") close.hint = record.hint.slice(0, FLEET_LINK_MAX_HINT_LENGTH);
+      return close;
+    }
+    case "operation.progress": {
+      if (!isFleetLinkId(record.operationId) || !isRecord4(record.progress)) return null;
+      const progress = {};
+      if (record.progress.percent !== void 0) {
+        const percent2 = record.progress.percent;
+        if (typeof percent2 !== "number" || !Number.isFinite(percent2) || percent2 < 0 || percent2 > 100)
+          return null;
+        progress.percent = percent2;
+      }
+      if (record.progress.message !== void 0) {
+        if (typeof record.progress.message !== "string") return null;
+        progress.message = record.progress.message.slice(0, MAX_PROGRESS_MESSAGE_LENGTH);
+      }
+      return { type: "operation.progress", operationId: record.operationId, progress };
+    }
+    case "operation.done": {
+      if (!isFleetLinkId(record.operationId)) return null;
+      const done = { type: "operation.done", operationId: record.operationId };
+      if (record.error !== void 0) {
+        const error = normalizeFleetLinkError(record.error);
+        if (error === null) return null;
+        done.error = error;
+      } else if (record.result !== void 0) {
+        done.result = record.result;
+      }
+      return done;
+    }
+    case "operation.cancel":
+      return isFleetLinkId(record.operationId) ? { type: "operation.cancel", operationId: record.operationId } : null;
+    default:
+      return null;
+  }
+}
+__name(decodeKnownControl, "decodeKnownControl");
+function decodeFleetLinkControl(payload) {
+  const record = decodeFleetLinkJson(payload);
+  if (!record || typeof record.type !== "string") return null;
+  if (CONTROL_TYPES.has(record.type)) return decodeKnownControl(record);
+  if (!EXTENSION_TYPE_PATTERN.test(record.type)) return null;
+  return record;
+}
+__name(decodeFleetLinkControl, "decodeFleetLinkControl");
+function isFleetLinkControlMessage(message) {
+  return CONTROL_TYPES.has(message.type);
+}
+__name(isFleetLinkControlMessage, "isFleetLinkControlMessage");
+function encodeFleetLinkControl(message) {
+  return encodeFleetLinkJson(0, message, FLEET_LINK_MAX_JSON_BYTES);
+}
+__name(encodeFleetLinkControl, "encodeFleetLinkControl");
+function asFleetLinkRequest(record) {
+  if (!isFleetLinkId(record.requestId) || typeof record.type !== "string" || record.type.length > 128) return null;
+  if (record.params !== void 0 && !isRecord4(record.params)) return null;
+  const request = { requestId: record.requestId, type: record.type };
+  if (record.params !== void 0) request.params = record.params;
+  return request;
+}
+__name(asFleetLinkRequest, "asFleetLinkRequest");
+function decodeFleetLinkAck(payload) {
+  if (!(payload instanceof Uint8Array) || payload.byteLength !== 4) return null;
+  return new DataView(payload.buffer, payload.byteOffset, 4).getUint32(0, false);
+}
+__name(decodeFleetLinkAck, "decodeFleetLinkAck");
 var FLEET_JOB_FAILURE_KIND_MODEL_USAGE_LIMIT = "model_usage_limit";
 var FLEET_MODEL_USAGE_LIMIT_FALLBACK_MS = 60 * 60 * 1e3;
 var FLEET_MODEL_USAGE_LIMIT_MIN_MS = 60 * 1e3;
@@ -5905,10 +6525,109 @@ var FLEET_CREDENTIAL_MAX_LENGTH = 256;
 var FLEET_DEFAULT_ENROLLMENT_TOKEN_TTL_MS = 15 * 6e4;
 var FLEET_DEFAULT_NODE_OFFLINE_AFTER_MS = 5 * 6e4;
 var FLEET_DEFAULT_NODE_OFFLINE_NOTICE_AFTER_MS = 30 * 6e4;
-var FLEET_DEFAULT_MAX_CAPABILITY_TAGS = 16;
+var FLEET_DEFAULT_MAX_CAPABILITY_TAGS = 32;
+var FLEET_LEGACY_MAX_CAPABILITY_TAGS = 16;
 var FLEET_DEFAULT_MAX_CAPABILITY_TAG_LENGTH = 32;
 var FLEET_DEFAULT_CREDENTIAL_ROTATION_OVERLAP_MS = 15 * 6e4;
 var FLEET_MAX_CREDENTIAL_ROTATION_OVERLAP_MS = 24 * 60 * 6e4;
+var FLEET_HEALTH_PROBE_TIMEOUT_MS = 2e3;
+var FLEET_HEALTH_RAW_RETENTION_MS = 7 * 24 * 60 * 6e4;
+var FLEET_HEALTH_HOURLY_RETENTION_MS = 90 * 24 * 60 * 6e4;
+var FLEET_HEALTH_DISK_CRITICAL_MARGIN_BYTES = 1024 ** 3;
+var FLEET_HEALTH_MAX_GPU_MODEL_LENGTH = 64;
+var FLEET_HEALTH_MAX_GPUS = 16;
+var FLEET_HEALTH_MAX_MIB = 2 ** 40;
+var FLEET_HEALTH_MAX_LOAD_AVG = 1e5;
+var FLEET_HEALTH_MAX_CORES = 4096;
+var FLEET_HEALTH_MAX_UPTIME_SEC = 100 * 365 * 24 * 60 * 60;
+var FLEET_HEALTH_MAX_FAILED_SERVICES = 1e4;
+var FLEET_NODE_GPU_VENDORS = ["nvidia", "amd", "intel", "apple", "other"];
+function finiteIn(value, min, max) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return null;
+  if (value < min || value > max) return null;
+  return value;
+}
+__name(finiteIn, "finiteIn");
+function round(value, decimals) {
+  const factor = 10 ** decimals;
+  return Math.round(value * factor) / factor;
+}
+__name(round, "round");
+function percent(value) {
+  const v = finiteIn(value, 0, 100);
+  return v === null ? null : round(v, 1);
+}
+__name(percent, "percent");
+function wholeIn(value, min, max) {
+  const v = finiteIn(value, min, max);
+  return v === null ? null : Math.floor(v);
+}
+__name(wholeIn, "wholeIn");
+function boundedText(value, max) {
+  if (typeof value !== "string") return null;
+  const cleaned = value.replace(/[\u0000-\u001F\u007F]+/g, " ").replace(/\s+/g, " ").trim();
+  return cleaned ? cleaned.slice(0, max) : null;
+}
+__name(boundedText, "boundedText");
+function sanitizeOneGpu(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const source = raw;
+  const vendor = FLEET_NODE_GPU_VENDORS.includes(source.vendor) ? source.vendor : "other";
+  const gpu = {
+    vendor,
+    name: boundedText(source.name, FLEET_HEALTH_MAX_GPU_MODEL_LENGTH)
+  };
+  const util = percent(source.utilPercent);
+  if (util !== null) gpu.utilPercent = util;
+  const used = wholeIn(source.memUsedMiB, 0, FLEET_HEALTH_MAX_MIB);
+  const total = wholeIn(source.memTotalMiB, 0, FLEET_HEALTH_MAX_MIB);
+  if (used !== null && total !== null && used > total) return gpu;
+  if (used !== null) gpu.memUsedMiB = used;
+  if (total !== null) gpu.memTotalMiB = total;
+  return gpu;
+}
+__name(sanitizeOneGpu, "sanitizeOneGpu");
+function sanitizeGpu(raw) {
+  if (raw === null) return null;
+  if (!Array.isArray(raw)) return void 0;
+  const gpus = raw.slice(0, FLEET_HEALTH_MAX_GPUS).map(sanitizeOneGpu).filter((gpu) => gpu !== null);
+  if (gpus.length === 0) return raw.length === 0 ? null : void 0;
+  return gpus;
+}
+__name(sanitizeGpu, "sanitizeGpu");
+function sanitizeFleetNodeHealthSnapshot(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const source = raw;
+  const out = {};
+  const cpu = percent(source.cpuPercent);
+  if (cpu !== null) out.cpuPercent = cpu;
+  const mem = percent(source.memPercent);
+  if (mem !== null) out.memPercent = mem;
+  const memTotal = wholeIn(source.memTotalMiB, 0, FLEET_HEALTH_MAX_MIB);
+  const memUsed = wholeIn(source.memUsedMiB, 0, FLEET_HEALTH_MAX_MIB);
+  if (memTotal !== null) out.memTotalMiB = memTotal;
+  if (memUsed !== null && (memTotal === null || memUsed <= memTotal)) out.memUsedMiB = memUsed;
+  const disk = percent(source.diskPercent);
+  if (disk !== null) out.diskPercent = disk;
+  const diskFree = wholeIn(source.diskFreeMiB, 0, FLEET_HEALTH_MAX_MIB);
+  const diskTotal = wholeIn(source.diskTotalMiB, 0, FLEET_HEALTH_MAX_MIB);
+  if (diskTotal !== null) out.diskTotalMiB = diskTotal;
+  if (diskFree !== null && (diskTotal === null || diskFree <= diskTotal)) out.diskFreeMiB = diskFree;
+  const load = finiteIn(source.loadAvg1, 0, FLEET_HEALTH_MAX_LOAD_AVG);
+  if (load !== null) out.loadAvg1 = round(load, 2);
+  const cores = wholeIn(source.cpuCores, 1, FLEET_HEALTH_MAX_CORES);
+  if (cores !== null) out.cpuCores = cores;
+  const uptime2 = wholeIn(source.uptimeSec, 0, FLEET_HEALTH_MAX_UPTIME_SEC);
+  if (uptime2 !== null) out.uptimeSec = uptime2;
+  const gpu = sanitizeGpu(source.gpu);
+  if (gpu !== void 0) out.gpu = gpu;
+  if (typeof source.pendingReboot === "boolean") out.pendingReboot = source.pendingReboot;
+  const failed = wholeIn(source.failedServices, 0, FLEET_HEALTH_MAX_FAILED_SERVICES);
+  if (failed !== null) out.failedServices = failed;
+  return Object.keys(out).length > 0 ? out : null;
+}
+__name(sanitizeFleetNodeHealthSnapshot, "sanitizeFleetNodeHealthSnapshot");
+var FLEET_HEALTH_BYTES_PER_MIB = 1024 * 1024;
 var FLEET_PUSH_CAPABILITY = "git-push";
 var FLEET_PUSH_MIN_GIT_VERSION = "2.31.0";
 var FLEET_PUSH_CREDENTIAL_USERNAME = "x-access-token";
@@ -6574,6 +7293,56 @@ var EVER_GAUZY_PRESET_SCOPES = INTEGRATION_SCOPES.filter(
   (scope) => !INTEGRATION_OPT_IN_SCOPES.includes(scope)
 );
 
+// src/core/link/modules/control.ts
+var FLEET_MANAGED_CAPABILITY = "managed";
+function createLinkControlState() {
+  let paused = false;
+  let drain = null;
+  const listeners = /* @__PURE__ */ new Set();
+  const notify = /* @__PURE__ */ __name(() => {
+    const snapshot = { paused, drain };
+    for (const listener of [...listeners]) {
+      try {
+        listener(snapshot);
+      } catch {
+      }
+    }
+  }, "notify");
+  return {
+    get paused() {
+      return paused;
+    },
+    get drain() {
+      return drain;
+    },
+    onChange(listener) {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    pause() {
+      if (paused) return;
+      paused = true;
+      notify();
+    },
+    resume() {
+      if (!paused) return;
+      paused = false;
+      notify();
+    },
+    startDrain(message, receivedAt) {
+      drain = { graceSec: message.graceSec, receivedAt };
+      notify();
+    }
+  };
+}
+__name(createLinkControlState, "createLinkControlState");
+var controlModule = {
+  id: "control",
+  tags: /* @__PURE__ */ __name((environment) => environment.consents.manage ? [FLEET_MANAGED_CAPABILITY] : [], "tags")
+};
+
 // src/core/gpu-probe.ts
 var VENDOR_PATTERNS = [
   { vendor: "nvidia", pattern: /\b(nvidia|geforce|quadro|tesla|rtx|gtx)\b/i },
@@ -6652,6 +7421,11 @@ function extractChipsetLines(stdout) {
 }
 __name(extractChipsetLines, "extractChipsetLines");
 async function detectGpu(runner, platform) {
+  return (await detectGpuWithEvidence(runner, platform)).gpu;
+}
+__name(detectGpu, "detectGpu");
+async function detectGpuWithEvidence(runner, platform) {
+  let answered = false;
   for (const probe of gpuProbesFor(platform)) {
     let stdout;
     try {
@@ -6663,6 +7437,7 @@ async function detectGpu(runner, platform) {
     } catch {
       continue;
     }
+    if (probe.command !== "nvidia-smi") answered = true;
     let text = stdout;
     if (probe.command === "lspci") {
       text = extractDisplayLines(stdout);
@@ -6673,11 +7448,82 @@ async function detectGpu(runner, platform) {
     if (!model) {
       continue;
     }
-    return { vendor: classifyGpuVendor(text), model };
+    return { gpu: { vendor: classifyGpuVendor(text), model }, answered: true };
   }
-  return null;
+  return { gpu: null, answered };
 }
-__name(detectGpu, "detectGpu");
+__name(detectGpuWithEvidence, "detectGpuWithEvidence");
+var NVIDIA_SMI_HEALTH_ARGS = [
+  "--query-gpu=name,utilization.gpu,memory.used,memory.total",
+  "--format=csv,noheader,nounits"
+];
+function numericField(text) {
+  if (typeof text !== "string") return void 0;
+  const trimmed = text.trim();
+  if (!/^\d+(\.\d+)?$/.test(trimmed)) return void 0;
+  const value = Number(trimmed);
+  return Number.isFinite(value) ? value : void 0;
+}
+__name(numericField, "numericField");
+function parseNvidiaSmiHealth(stdout) {
+  const readings = [];
+  for (const raw of (stdout ?? "").split(/\r?\n/)) {
+    const reading = parseNvidiaSmiLine(raw.trim());
+    if (reading) readings.push(reading);
+  }
+  return readings;
+}
+__name(parseNvidiaSmiHealth, "parseNvidiaSmiHealth");
+function parseNvidiaSmiLine(line) {
+  if (!line) return null;
+  const cells = line.split(",");
+  if (cells.length < 4) return null;
+  const memTotal = numericField(cells[cells.length - 1]);
+  const memUsed = numericField(cells[cells.length - 2]);
+  const util = numericField(cells[cells.length - 3]);
+  const name = cells.slice(0, cells.length - 3).join(",").trim().slice(0, 120);
+  if (!name) return null;
+  const reading = { name };
+  if (util !== void 0) reading.utilPercent = util;
+  if (memUsed !== void 0) reading.memUsedMiB = Math.round(memUsed);
+  if (memTotal !== void 0) reading.memTotalMiB = Math.round(memTotal);
+  return reading;
+}
+__name(parseNvidiaSmiLine, "parseNvidiaSmiLine");
+var ROCM_SMI_HEALTH_ARGS = ["--showuse", "--showmeminfo", "vram", "--json"];
+function parseRocmSmiHealth(stdout) {
+  let parsed;
+  try {
+    parsed = JSON.parse((stdout ?? "").trim());
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  const card = Object.entries(parsed).find(([key]) => /^card\d+$/i.test(key))?.[1];
+  if (!card || typeof card !== "object") return null;
+  const fields = Object.entries(card);
+  const read = /* @__PURE__ */ __name((pattern) => {
+    const entry = fields.find(([key]) => pattern.test(key));
+    return entry ? numericField(String(entry[1])) : void 0;
+  }, "read");
+  const util = read(/gpu use \(%\)/i);
+  const totalBytes = read(/vram total memory \(b\)/i);
+  const usedBytes = read(/vram total used memory \(b\)/i);
+  const reading = {};
+  if (util !== void 0) reading.utilPercent = util;
+  if (usedBytes !== void 0) reading.memUsedMiB = Math.round(usedBytes / (1024 * 1024));
+  if (totalBytes !== void 0) reading.memTotalMiB = Math.round(totalBytes / (1024 * 1024));
+  return Object.keys(reading).length > 0 ? reading : null;
+}
+__name(parseRocmSmiHealth, "parseRocmSmiHealth");
+var IOREG_GPU_ARGS = ["-r", "-d", "1", "-w", "0", "-c", "IOAccelerator"];
+function parseIoregGpuUtil(stdout) {
+  const match = /"Device Utilization %"\s*=\s*(\d+)/.exec(stdout ?? "");
+  if (!match) return null;
+  const value = Number(match[1]);
+  return Number.isFinite(value) ? value : null;
+}
+__name(parseIoregGpuUtil, "parseIoregGpuUtil");
 
 // src/core/screen/capture-backend.ts
 var HEADLESS_BROWSER_CAPTURE_AVAILABILITY = Object.freeze({
@@ -6708,7 +7554,7 @@ __name(safeAvailable, "safeAvailable");
 var MAX_CAPABILITY_TAGS = FLEET_DEFAULT_MAX_CAPABILITY_TAGS;
 var MAX_CAPABILITY_TAG_LENGTH = FLEET_DEFAULT_MAX_CAPABILITY_TAG_LENGTH;
 var MAX_PLATFORM_LENGTH = FLEET_MAX_PLATFORM_LENGTH;
-var MAX_VERSION_LENGTH = FLEET_MAX_VERSION_LENGTH;
+var MAX_VERSION_LENGTH2 = FLEET_MAX_VERSION_LENGTH;
 var MIN_CREDENTIAL_LENGTH = FLEET_CREDENTIAL_MIN_LENGTH;
 var MAX_CREDENTIAL_LENGTH = FLEET_CREDENTIAL_MAX_LENGTH;
 var DEFAULT_HEARTBEAT_INTERVAL_MS = 6e4;
@@ -6837,6 +7683,20 @@ function clampWorkspaceGcPolicy(input) {
   };
 }
 __name(clampWorkspaceGcPolicy, "clampWorkspaceGcPolicy");
+var DEFAULT_NODE_EXECUTION_POLICY = Object.freeze({
+  allowSkipPermissions: false,
+  allowShellCommands: false,
+  restrictedMode: true
+});
+function resolveNodeExecutionPolicy(input) {
+  if (!input || typeof input !== "object") return { ...DEFAULT_NODE_EXECUTION_POLICY };
+  return {
+    allowSkipPermissions: input.allowSkipPermissions === true,
+    allowShellCommands: input.allowShellCommands === true,
+    restrictedMode: input.restrictedMode !== false
+  };
+}
+__name(resolveNodeExecutionPolicy, "resolveNodeExecutionPolicy");
 function redactConfig(config) {
   const redacted = {
     apiUrl: config.apiUrl,
@@ -6848,7 +7708,8 @@ function redactConfig(config) {
     enrolledAt: config.enrolledAt,
     hasSecret: typeof config.secret === "string" && config.secret.length > 0,
     secretStorage: config.secretStorage ?? "file",
-    paused: config.paused === true
+    paused: config.paused === true,
+    executionPolicy: resolveNodeExecutionPolicy(config.executionPolicy)
   };
   if (config.capabilitySelection !== void 0) {
     redacted.capabilitySelection = [...config.capabilitySelection];
@@ -7008,7 +7869,10 @@ async function detectCapabilities(runner, environment) {
     // SAME rule the lane used, and the two cannot disagree. `input` is
     // NOT advertised: nothing on this node injects input yet.
     environment.attended === true ? FLEET_ATTENDED_CAPABILITY : null,
-    environment.attended === true && isScreenCaptureAvailable(environment, environment.captureBackends) ? FLEET_SCREEN_CAPABILITY : null
+    environment.attended === true && isScreenCaptureAvailable(environment, environment.captureBackends) ? FLEET_SCREEN_CAPABILITY : null,
+    // Fleet node link (FL-02): the module tags, LAST, so a node that already
+    // advertised everything above keeps advertising exactly that.
+    ...environment.linkModuleTags ?? []
   ]);
 }
 __name(detectCapabilities, "detectCapabilities");
@@ -7023,7 +7887,10 @@ var NON_SELECTABLE_TAGS = /* @__PURE__ */ new Set([
   // A capability selection written before these tags existed must not
   // silently withhold a live view its owner just switched on.
   FLEET_ATTENDED_CAPABILITY,
-  FLEET_SCREEN_CAPABILITY
+  FLEET_SCREEN_CAPABILITY,
+  // Fleet node link (FL-02): `managed` exists only under `--manage`, which IS
+  // the opt-in — a selection written before the tag existed must not withhold it.
+  FLEET_MANAGED_CAPABILITY
 ]);
 function isAlwaysAdvertisedCapability(tag) {
   return isIdentityCapability(tag) || NON_SELECTABLE_TAGS.has(tag);
@@ -7038,10 +7905,11 @@ function applyCapabilitySelection(detected, selection) {
 }
 __name(applyCapabilitySelection, "applyCapabilitySelection");
 async function describeSelf(runner, environment, version, selection, telemetry = {}) {
+  const healthReading = resolveTelemetry(telemetry.health);
   const detected = await detectCapabilities(runner, environment);
   const description = {
     platform: describePlatform(environment),
-    version: version.slice(0, MAX_VERSION_LENGTH),
+    version: version.slice(0, MAX_VERSION_LENGTH2),
     capabilities: applyCapabilitySelection(detected, selection)
   };
   const cliVersion = await resolveTelemetry(telemetry.cliVersion);
@@ -7093,6 +7961,19 @@ async function describeSelf(runner, environment, version, selection, telemetry =
     description.maxCpuPercent = typeof limits.maxCpuPercent === "number" ? limits.maxCpuPercent : null;
     description.maxMemoryMb = typeof limits.maxMemoryMb === "number" ? limits.maxMemoryMb : null;
   }
+  const health2 = sanitizeFleetNodeHealthSnapshot(await healthReading);
+  if (health2) {
+    description.health = health2;
+  }
+  const consents = await resolveTelemetry(telemetry.consents);
+  if (consents) {
+    description.consents = {
+      work: consents.work === true,
+      attend: consents.attend === true,
+      manage: consents.manage === true,
+      usageScan: consents.usageScan === true
+    };
+  }
   return description;
 }
 __name(describeSelf, "describeSelf");
@@ -7188,6 +8069,9 @@ function parseConfig(raw) {
   if (typeof candidate.workspaceRoot === "string" && ABSOLUTE_PATH.test(candidate.workspaceRoot.trim())) {
     config.workspaceRoot = candidate.workspaceRoot.trim();
   }
+  if (candidate.executionPolicy && typeof candidate.executionPolicy === "object") {
+    config.executionPolicy = resolveNodeExecutionPolicy(candidate.executionPolicy);
+  }
   if (candidate.unsafe && typeof candidate.unsafe === "object" && typeof candidate.unsafe.since === "string" && Number.isFinite(Date.parse(candidate.unsafe.since)) && typeof candidate.unsafe.reason === "string" && candidate.unsafe.reason.trim()) {
     config.unsafe = {
       since: new Date(candidate.unsafe.since).toISOString(),
@@ -7624,6 +8508,17 @@ function selfDescription(source) {
   if (source.maxMemoryMb !== void 0) {
     out.maxMemoryMb = source.maxMemoryMb;
   }
+  if (source.health !== void 0) {
+    out.health = source.health;
+  }
+  if (source.consents !== void 0) {
+    out.consents = {
+      work: source.consents.work === true,
+      attend: source.consents.attend === true,
+      manage: source.consents.manage === true,
+      usageScan: source.consents.usageScan === true
+    };
+  }
   return out;
 }
 __name(selfDescription, "selfDescription");
@@ -7692,7 +8587,18 @@ var systemScheduler = {
   clearTimeout: /* @__PURE__ */ __name((handle) => clearTimeout(handle), "clearTimeout")
 };
 var OPTIONAL_DESCRIPTION_FIELD_TIERS = [
-  // NEWEST first. Node lifecycle + remote node limits (self-build slices
+  // NEWEST first. Computer health (FL-03): the health snapshot. Its own
+  // tier, so a platform that predates it costs exactly this one field —
+  // the consents, pinned CLI versions and enforced limits below keep
+  // flowing (FR-3, U9). Newer than the consents: FL-02 reached `develop`
+  // first, so a platform that knows the consents but not the snapshot
+  // exists, and the reverse never will.
+  ["health"],
+  // Fleet node link (FL-02): the consents. A platform that predates them
+  // answers 400; the node strips this tier, keeps beating with everything
+  // else, and does not open the link (spec U11).
+  ["consents"],
+  // Then Node lifecycle + remote node limits (self-build slices
   // AR, AS). Tiered (review): `cliVersions` goes out on EVERY beat of a
   // node with a pinned CLI, so an upgraded node talking to a platform that
   // predates it would otherwise drop the worker state and housekeeping
@@ -7757,6 +8663,12 @@ var HeartbeatLoop = class {
    * will never accept them.
    */
   strippedTiers = 0;
+  /**
+   * Fleet node link (FL-02): the platform refused more than the legacy
+   * {@link FLEET_LEGACY_MAX_CAPABILITY_TAGS} tags; beats carry the first
+   * sixteen from then on. Process-scoped for the same reason as the tiers.
+   */
+  legacyTagCap = false;
   state = {
     state: "idle",
     lastHeartbeatAt: null,
@@ -7779,6 +8691,17 @@ var HeartbeatLoop = class {
   getState() {
     return { ...this.state };
   }
+  /**
+   * Whether the platform has NOT proven it predates `field` — i.e. the beat
+   * still carries it. The node link opens only while `consents` is still
+   * accepted: a platform that rejected the field cannot authorise a channel
+   * by consent, so this node does not ask it to (spec U11).
+   */
+  acceptsField(field) {
+    return !OPTIONAL_DESCRIPTION_FIELD_TIERS.slice(0, this.strippedTiers).some(
+      (tier) => tier.includes(field)
+    );
+  }
   onChange(listener) {
     this.listeners.add(listener);
     return () => {
@@ -7856,22 +8779,36 @@ var HeartbeatLoop = class {
    */
   async beat(description) {
     const credential = { nodeId: this.options.nodeId, secret: this.options.secret };
-    let sent = stripTiers(description, this.strippedTiers);
+    const shape = /* @__PURE__ */ __name((tiers) => capTags(stripTiers(description, tiers), this.legacyTagCap), "shape");
+    let sent = shape(this.strippedTiers);
     try {
       return await this.options.client.heartbeat({ ...credential, ...sent });
     } catch (error) {
       if (!isFieldRejection(error)) throw error;
       let lastError = error;
+      if (!this.legacyTagCap && (description.capabilities?.length ?? 0) > FLEET_LEGACY_MAX_CAPABILITY_TAGS) {
+        sent = capTags(stripTiers(description, this.strippedTiers), true);
+        try {
+          const result = await this.options.client.heartbeat({ ...credential, ...sent });
+          this.legacyTagCap = true;
+          this.options.logger?.warn(
+            `Platform refused more than ${FLEET_LEGACY_MAX_CAPABILITY_TAGS} capability tags; reporting the first ${FLEET_LEGACY_MAX_CAPABILITY_TAGS} until this node restarts.`
+          );
+          return result;
+        } catch (retryError) {
+          if (!isFieldRejection(retryError)) throw retryError;
+          lastError = retryError;
+          this.legacyTagCap = true;
+        }
+      }
       for (let tiers = this.strippedTiers + 1; tiers <= OPTIONAL_DESCRIPTION_FIELD_TIERS.length; tiers += 1) {
-        const candidate = stripTiers(description, tiers);
+        const candidate = shape(tiers);
         if (Object.keys(candidate).length === Object.keys(sent).length) continue;
         sent = candidate;
         try {
           const result = await this.options.client.heartbeat({ ...credential, ...candidate });
           this.strippedTiers = tiers;
-          this.options.logger?.warn(
-            tiers >= OPTIONAL_DESCRIPTION_FIELD_TIERS.length ? "Platform rejected the optional self-description fields (worker state, housekeeping); it predates them. Reporting liveness only until this node restarts." : "Platform rejected the newest optional self-description fields (pinned CLI versions, enforced limits); it predates them. Still reporting worker state and housekeeping; the newer fields stay off until this node restarts."
-          );
+          this.options.logger?.warn(describeStrippedTiers(tiers));
           return result;
         } catch (retryError) {
           if (!isFieldRejection(retryError)) throw retryError;
@@ -7942,6 +8879,25 @@ var HeartbeatLoop = class {
     }
   }
 };
+function capTags(description, cap) {
+  if (!cap || !Array.isArray(description.capabilities)) return description;
+  if (description.capabilities.length <= FLEET_LEGACY_MAX_CAPABILITY_TAGS) return description;
+  return { ...description, capabilities: description.capabilities.slice(0, FLEET_LEGACY_MAX_CAPABILITY_TAGS) };
+}
+__name(capTags, "capTags");
+function describeStrippedTiers(tiers) {
+  if (tiers >= OPTIONAL_DESCRIPTION_FIELD_TIERS.length) {
+    return "Platform rejected the optional self-description fields (worker state, housekeeping); it predates them. Reporting liveness only until this node restarts.";
+  }
+  if (tiers >= 3) {
+    return "Platform rejected the newest optional self-description fields (pinned CLI versions, enforced limits); it predates them. Still reporting worker state and housekeeping; the newer fields stay off until this node restarts.";
+  }
+  if (tiers >= 2) {
+    return "Platform rejected the consents field; it predates the node link. Still reporting pinned CLI versions, enforced limits, worker state and housekeeping; the node link stays closed and the health snapshot off until this node restarts.";
+  }
+  return "Platform rejected the health snapshot; it predates it. Still reporting everything else; health stays off until this node restarts.";
+}
+__name(describeStrippedTiers, "describeStrippedTiers");
 function stripTiers(description, tiers) {
   const out = {};
   const dropped = new Set(OPTIONAL_DESCRIPTION_FIELD_TIERS.slice(0, tiers).flat());
@@ -8114,6 +9070,8 @@ __name(cacheProbe, "cacheProbe");
 // src/core/executors/model-cli.ts
 var MODEL_CLI_EMPTY_MCP_CONFIG = `${JSON.stringify({ mcpServers: {} }, null, 2)}
 `;
+var MODEL_CLI_FLEET_SETTINGS = `${JSON.stringify({ disableAllHooks: true }, null, 2)}
+`;
 var CODEX_SETTING_VALUE = /^[A-Za-z0-9._-]{1,64}$/;
 var TOML_STRING_ASSIGNMENT = /^([A-Za-z0-9_-]+)[ \t]*=[ \t]*(?:"([^"\\]*)"|'([^']*)')(?:[ \t]+#.*|#.*)?$/;
 var TOML_MULTILINE_VALUE_START = /^[^=#]*=[ \t]*("""|''')/;
@@ -8329,6 +9287,10 @@ function buildModelCliCommand(input) {
     if (execution.effort && !omitted.has("--effort")) args.push("--effort", execution.effort);
     if (budget && !omitted.has("--max-budget-usd")) args.push("--max-budget-usd", budget);
     if (execution.skipPermissions === true) args.push("--dangerously-skip-permissions");
+    if (input.settingsPath !== void 0) {
+      args.push("--setting-sources", "user", "--settings", quoteShellPath(input.settingsPath, platform));
+    }
+    if (input.restricted === true && execution.skipPermissions !== true) args.push("--restricted");
     if (mcp) {
       args.push(
         "--mcp-config",
@@ -8393,6 +9355,16 @@ function assertMountGrantsInCommand(input) {
 __name(assertMountGrantsInCommand, "assertMountGrantsInCommand");
 var STRICT_MCP_CONFIG_IN_COMMAND = / --mcp-config "[^"]+" --strict-mcp-config /;
 var CODEX_IGNORE_USER_CONFIG_IN_COMMAND = / exec --ignore-user-config /;
+var SETTINGS_ISOLATION_IN_COMMAND = / --setting-sources user --settings "[^"]+" /;
+function assertSettingsIsolationInCommand(input) {
+  if (input.execution.provider !== "claude-code") return;
+  if (!SETTINGS_ISOLATION_IN_COMMAND.test(input.command)) {
+    throw new ModelCliCommandError(
+      "The claude-code command line does not carry --setting-sources user --settings <file>, so the run would load the repository's own .claude/settings.json (its hooks, env and apiKeyHelper) and run hooks"
+    );
+  }
+}
+__name(assertSettingsIsolationInCommand, "assertSettingsIsolationInCommand");
 function assertMcpIsolationInCommand(input) {
   if (input.execution.provider === "codex") {
     if (!CODEX_IGNORE_USER_CONFIG_IN_COMMAND.test(input.command)) {
@@ -8728,9 +9700,27 @@ var MODEL_CLI_REQUIRED_FLAGS = {
   // since the MCP isolation fix (#2584): the empty strict config, or the
   // bridge's. A CLI without them cannot run fleet work at all, so `doctor`
   // must say INCOMPATIBLE, not "runs that need them will fail".
-  "claude-code": ["-p", "--output-format", "--permission-mode", "--mcp-config", "--strict-mcp-config"],
+  //
+  // `--setting-sources` + `--settings` ride EVERY fleet Claude Code run since
+  // control 17 (2026-10-18): the worktree's own `.claude/settings*.json` is
+  // never loaded and every hook is off. A CLI without them cannot keep a
+  // repository's hooks from running as the machine owner, so it is
+  // INCOMPATIBLE rather than "runs go without".
+  "claude-code": [
+    "-p",
+    "--output-format",
+    "--permission-mode",
+    "--mcp-config",
+    "--strict-mcp-config",
+    "--setting-sources",
+    "--settings"
+  ],
   codex: ["--json", "--sandbox", "-C", "--ignore-user-config"]
 };
+var MODEL_CLI_HARDENING_FLAGS = {
+  "claude-code": ["--restricted"],
+  codex: []
+};
 var MODEL_CLI_CONDITIONAL_FLAGS = {
   "claude-code": [
     "--model",
@@ -8864,6 +9854,7 @@ function judgeModelCliHelp(provider, executable, version, help) {
     missingRequiredFlags: [],
     missingConditionalFlags: [],
     unsupportedOptionalFlags: [],
+    missingHardeningFlags: [],
     note: null
   };
   if (help === null) {
@@ -8882,7 +9873,8 @@ function judgeModelCliHelp(provider, executable, version, help) {
     supportedFlags: advertised,
     missingRequiredFlags: missing(required),
     missingConditionalFlags: missing(MODEL_CLI_CONDITIONAL_FLAGS[provider]),
-    unsupportedOptionalFlags: missing(MODEL_CLI_OPTIONAL_FLAGS[provider])
+    unsupportedOptionalFlags: missing(MODEL_CLI_OPTIONAL_FLAGS[provider]),
+    missingHardeningFlags: missing(MODEL_CLI_HARDENING_FLAGS[provider])
   };
 }
 __name(judgeModelCliHelp, "judgeModelCliHelp");
@@ -8978,11 +9970,16 @@ __name(formatBytes, "formatBytes");
 var import_node_fs = require("node:fs");
 var import_node_path = require("node:path");
 async function measureWorkspaceFreeBytes(probe, rootPath) {
+  const candidate = await nearestExistingPath(rootPath);
+  return candidate === null ? null : detectDiskFreeBytes(probe, candidate);
+}
+__name(measureWorkspaceFreeBytes, "measureWorkspaceFreeBytes");
+async function nearestExistingPath(rootPath) {
   let candidate = rootPath;
   for (; ; ) {
     try {
       await import_node_fs.promises.lstat(candidate);
-      break;
+      return candidate;
     } catch (error) {
       if (error.code !== "ENOENT") {
         return null;
@@ -8994,9 +9991,8 @@ async function measureWorkspaceFreeBytes(probe, rootPath) {
       candidate = parent;
     }
   }
-  return detectDiskFreeBytes(probe, candidate);
 }
-__name(measureWorkspaceFreeBytes, "measureWorkspaceFreeBytes");
+__name(nearestExistingPath, "nearestExistingPath");
 
 // src/core/worker-loop.ts
 var DEFAULT_IDLE_POLL_MS = 5e3;
@@ -10593,17 +11589,22 @@ __name(keychainDisabledByEnv, "keychainDisabledByEnv");
 // src/node-io.ts
 function createCommandRunner() {
   return {
-    run: /* @__PURE__ */ __name((command, args) => new Promise((resolve9) => {
+    run: /* @__PURE__ */ __name((command, args, options) => new Promise((resolve9) => {
+      const timeout = typeof options?.timeoutMs === "number" && Number.isFinite(options.timeoutMs) && options.timeoutMs > 0 ? options.timeoutMs : 1e4;
       (0, import_node_child_process.execFile)(
         command,
         args,
-        { shell: process.platform === "win32", windowsHide: true, timeout: 1e4 },
+        { shell: process.platform === "win32", windowsHide: true, timeout },
         (error, stdout, stderr) => {
           const code = error ? error.code ?? 1 : 0;
           resolve9({
             code: typeof code === "number" ? code : 1,
             stdout: String(stdout),
             stderr: String(stderr),
+            // A string code is a spawn failure (`ENOENT`: not installed),
+            // not an exit status; `code` above still reads 1 for callers
+            // that only ask "did it succeed".
+            ...typeof code === "string" ? { spawnError: code } : {},
             // `execFile` sets `killed` when it terminated the child at
             // `timeout`; what the child printed until then is partial.
             timedOut: Boolean(error && error.killed)
@@ -10782,7 +11783,8 @@ function readCpuTicks() {
 }
 __name(readCpuTicks, "readCpuTicks");
 function createResourceProbe(options = {}) {
-  const windowMs = Math.max(options.sampleWindowMs ?? 0, 0);
+  const everyWindowMs = Math.max(options.sampleWindowMs ?? 0, 0);
+  const firstWindowMs = Math.max(options.firstSampleWindowMs ?? 0, 0);
   let previous = null;
   const measure = /* @__PURE__ */ __name((current, baseline) => {
     if (!baseline) return 0;
@@ -10795,6 +11797,7 @@ function createResourceProbe(options = {}) {
   return {
     sample: /* @__PURE__ */ __name(async () => {
       let baseline = previous;
+      const windowMs = everyWindowMs > 0 ? everyWindowMs : previous === null ? firstWindowMs : 0;
       if (windowMs > 0) {
         baseline = readCpuTicks();
         await new Promise((resolve9) => setTimeout(resolve9, windowMs));
@@ -10823,10 +11826,51 @@ function createDiskProbe() {
       } catch {
         return null;
       }
-    }, "freeBytes")
+    }, "freeBytes"),
+    // Computer health (FL-03): the same `statfs`, read whole. Null on the
+    // same failures, and on any figure that is not a sane byte count.
+    volume: /* @__PURE__ */ __name(async (targetPath) => {
+      try {
+        const stats = await fsp.statfs(targetPath);
+        const block = Number(stats.bsize);
+        const reading = {
+          totalBytes: Number(stats.blocks) * block,
+          freeBytes: Number(stats.bfree) * block,
+          availableBytes: Number(stats.bavail) * block
+        };
+        const sane = Object.values(reading).every((value) => Number.isFinite(value) && value >= 0);
+        return sane && reading.totalBytes > 0 ? reading : null;
+      } catch {
+        return null;
+      }
+    }, "volume")
   };
 }
 __name(createDiskProbe, "createDiskProbe");
+function createHealthProbeIo(runner) {
+  return {
+    platform: process.platform,
+    runner,
+    // Its own sampler — see `createResourceProbe` on why it is never shared
+    // with the admission gate — whose first reading is a real 250 ms one.
+    resourceProbe: createResourceProbe({ firstSampleWindowMs: 250 }),
+    host: {
+      loadAvg1: /* @__PURE__ */ __name(() => os.loadavg()[0] ?? null, "loadAvg1"),
+      uptimeSec: /* @__PURE__ */ __name(() => os.uptime(), "uptimeSec"),
+      cores: /* @__PURE__ */ __name(() => typeof os.availableParallelism === "function" ? os.availableParallelism() : os.cpus().length, "cores")
+    },
+    disk: createDiskProbe(),
+    pathExists: /* @__PURE__ */ __name(async (target) => {
+      try {
+        await fsp.access(target);
+        return true;
+      } catch {
+        return false;
+      }
+    }, "pathExists")
+  };
+}
+__name(createHealthProbeIo, "createHealthProbeIo");
 var systemFetch = /* @__PURE__ */ __name((url, init) => fetch(url, {
   method: init.method,
   headers: init.headers,
@@ -11296,6 +12340,27 @@ var FleetJobClient = class {
       expiresInSec: typeof payload.expiresInSec === "number" ? payload.expiresInSec : 60
     };
   }
+  /**
+   * Fleet node link (FL-02) — a single-use, five-minute token for this
+   * machine's one outbound link socket, minted through the node credential.
+   * Never logged. A platform that does not accept links answers 404, which
+   * reaches the caller as an `invalid-request` error with `status: 404`.
+   */
+  async mintLinkToken() {
+    const payload = await this.post("api/fleet/link-token", "link-token", {
+      nodeId: this.nodeId,
+      secret: this.secret
+    });
+    if (typeof payload?.token !== "string" || !payload.token || typeof payload.wsPath !== "string") {
+      throw new FleetClientError("malformed", "Link token response did not contain a token");
+    }
+    this.logger?.protect(payload.token);
+    return {
+      token: payload.token,
+      wsPath: payload.wsPath,
+      expiresInSec: typeof payload.expiresInSec === "number" ? payload.expiresInSec : 300
+    };
+  }
   /** Report what the watched Agent's profile holds here (counts only — never a path, never a cookie). */
   async reportComputerProfile(sessionId, report) {
     const payload = await this.post(
@@ -11393,19 +12458,287 @@ function errorForJobStatus(status, operation) {
 }
 __name(errorForJobStatus, "errorForJobStatus");
 
-// src/core/housekeeping-report.ts
-function summarizeWorkspaceReap(result) {
-  const dryRun = result.dryRun === true;
-  const worktrees = dryRun ? result.kept.length + result.removed.length : result.kept.length;
-  const keptBytes = result.kept.reduce((sum, verdict) => sum + safeBytes(verdict.record.sizeBytes), 0);
-  const keptPoolBytes = result.keptPools.reduce((sum, verdict) => sum + safeBytes(verdict.pool.sizeBytes), 0);
-  const plannedBytes = dryRun ? result.removed.reduce((sum, entry) => sum + safeBytes(entry.freedBytes), 0) + result.removedPools.reduce((sum, entry) => sum + safeBytes(entry.freedBytes), 0) : 0;
-  return {
-    workspaceCount: worktrees,
-    workspaceBytes: keptBytes + keptPoolBytes + plannedBytes,
-    freedBytes: dryRun ? 0 : safeBytes(result.freedBytes),
-    dryRun
-  };
+// src/core/health-probe.ts
+var BYTES_PER_MIB = 1024 * 1024;
+var DEFAULT_SLOW_FACT_TTL_MS = 5 * 6e4;
+var DEFAULT_SLOW_FACT_DEADLINE_MS = 15e3;
+var GPU_IDENTITY_TTL_MS = 10 * 6e4;
+var LINUX_REBOOT_REQUIRED_PATH = "/var/run/reboot-required";
+var LINUX_DEBIAN_RELEASE_PATH = "/etc/debian_version";
+var NEEDS_RESTARTING_REBOOT_PATTERN = /reboot is required/i;
+var WINDOWS_HEALTH_SCRIPT = [
+  "$ErrorActionPreference = 'Stop'",
+  "try {",
+  "  $pending = (Test-Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing\\RebootPending') -or (Test-Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\RebootRequired')",
+  '  "reboot=$pending"',
+  "} catch {}",
+  "try {",
+  `  $failed = @(Get-CimInstance -ClassName Win32_Service -Filter "StartMode='Auto' AND State='Stopped' AND ExitCode<>0 AND ExitCode<>1077")`,
+  '  "failed=$($failed.Count)"',
+  "} catch {}",
+  "try {",
+  "  $adapters = @(Get-CimInstance -ClassName Win32_VideoController)",
+  '  "adapters=$($adapters.Count)"',
+  '  foreach ($adapter in $adapters) { "gpu=$($adapter.Name)" }',
+  "} catch {}"
+].join("\n");
+function encodePowerShell(script) {
+  return Buffer.from(script, "utf16le").toString("base64");
+}
+__name(encodePowerShell, "encodePowerShell");
+function parseWindowsHealth(stdout) {
+  const facts = {};
+  let adapterCount = null;
+  const names = [];
+  for (const raw of (stdout ?? "").split(/\r?\n/)) {
+    const line = raw.trim();
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const key = line.slice(0, eq);
+    const value = line.slice(eq + 1).trim();
+    if (key === "reboot" && /^(true|false)$/i.test(value)) facts.pendingReboot = /^true$/i.test(value);
+    if (key === "failed" && /^\d+$/.test(value)) facts.failedServices = Number(value);
+    if (key === "adapters" && /^\d+$/.test(value)) adapterCount = Number(value);
+    if (key === "gpu" && value) names.push(value);
+  }
+  if (adapterCount !== null) facts.adapters = adapterCount > 0 ? names : [];
+  return facts;
+}
+__name(parseWindowsHealth, "parseWindowsHealth");
+function countSystemdFailedUnits(stdout) {
+  return (stdout ?? "").split(/\r?\n/).filter((line) => line.trim().length > 0).length;
+}
+__name(countSystemdFailedUnits, "countSystemdFailedUnits");
+function refreshInBackground(probe, ttlMs, now = Date.now) {
+  let value = null;
+  let answered = false;
+  let expiresAt = Number.NEGATIVE_INFINITY;
+  let inFlight = null;
+  const refresh = /* @__PURE__ */ __name(() => {
+    if (!inFlight) {
+      inFlight = Promise.resolve().then(probe).catch(() => null).then((fresh) => {
+        value = fresh;
+        answered = true;
+        expiresAt = now() + ttlMs;
+        return fresh;
+      }).finally(() => {
+        inFlight = null;
+      });
+    }
+    return inFlight;
+  }, "refresh");
+  return async () => {
+    if (now() < expiresAt) return value;
+    const pending = refresh();
+    return answered ? value : pending;
+  };
+}
+__name(refreshInBackground, "refreshInBackground");
+function withDeadline(work, ms) {
+  return new Promise((resolve9) => {
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      resolve9(void 0);
+    }, ms);
+    timer.unref?.();
+    const finish = /* @__PURE__ */ __name((value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve9(value);
+    }, "finish");
+    try {
+      Promise.resolve(work()).then(finish, () => finish(void 0));
+    } catch {
+      finish(void 0);
+    }
+  });
+}
+__name(withDeadline, "withDeadline");
+function finiteOrNull(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+__name(finiteOrNull, "finiteOrNull");
+function createHealthProbe(io, options) {
+  const budget = options.timeoutMs ?? FLEET_HEALTH_PROBE_TIMEOUT_MS;
+  const slowTtl = options.slowFactTtlMs ?? DEFAULT_SLOW_FACT_TTL_MS;
+  const slowDeadline = options.slowFactDeadlineMs ?? DEFAULT_SLOW_FACT_DEADLINE_MS;
+  const now = options.now ?? Date.now;
+  const run = /* @__PURE__ */ __name(async (command, args, timeoutMs) => {
+    try {
+      return await io.runner.run(command, [...args], { timeoutMs });
+    } catch {
+      return null;
+    }
+  }, "run");
+  const cpuAndMemory = /* @__PURE__ */ __name(async () => {
+    const sample = await io.resourceProbe.sample();
+    const out = {};
+    const cpu = finiteOrNull(sample.cpuPercent);
+    if (cpu !== null) out.cpuPercent = cpu;
+    const total = finiteOrNull(sample.totalMemoryMb);
+    const used = finiteOrNull(sample.usedMemoryMb);
+    if (total !== null && total > 0) {
+      out.memTotalMiB = Math.floor(total);
+      if (used !== null && used >= 0) {
+        out.memUsedMiB = Math.round(used);
+        out.memPercent = used / total * 100;
+      }
+    }
+    return out;
+  }, "cpuAndMemory");
+  const disk = /* @__PURE__ */ __name(async () => {
+    const probe = io.disk;
+    if (!probe?.volume) return {};
+    const target = await nearestExistingPath(options.workspacePath);
+    if (!target) return {};
+    const reading = await probe.volume(target);
+    if (!reading) return {};
+    const used = Math.max(reading.totalBytes - reading.freeBytes, 0);
+    const denominator = used + reading.availableBytes;
+    const out = {
+      diskFreeMiB: Math.floor(reading.availableBytes / BYTES_PER_MIB),
+      diskTotalMiB: Math.floor(reading.totalBytes / BYTES_PER_MIB)
+    };
+    if (denominator > 0) out.diskPercent = used / denominator * 100;
+    return out;
+  }, "disk");
+  const hostFacts = /* @__PURE__ */ __name(() => {
+    const out = {};
+    const cores = finiteOrNull(io.host.cores());
+    if (cores !== null) out.cpuCores = cores;
+    const uptime2 = finiteOrNull(io.host.uptimeSec());
+    if (uptime2 !== null) out.uptimeSec = uptime2;
+    if (io.platform !== "win32") {
+      const load = finiteOrNull(io.host.loadAvg1());
+      if (load !== null) out.loadAvg1 = load;
+    }
+    return out;
+  }, "hostFacts");
+  const windowsFacts = refreshInBackground(
+    async () => {
+      const result = await run(
+        "powershell",
+        ["-NoProfile", "-NonInteractive", "-EncodedCommand", encodePowerShell(WINDOWS_HEALTH_SCRIPT)],
+        slowDeadline
+      );
+      return result && result.code === 0 && !result.timedOut ? parseWindowsHealth(result.stdout) : null;
+    },
+    slowTtl,
+    now
+  );
+  const linuxPendingReboot = refreshInBackground(
+    async () => {
+      if (await io.pathExists(LINUX_REBOOT_REQUIRED_PATH)) return true;
+      if (await io.pathExists(LINUX_DEBIAN_RELEASE_PATH)) return false;
+      const result = await run("needs-restarting", ["-r"], slowDeadline);
+      if (!result || result.timedOut || result.spawnError) return null;
+      if (result.code === 0) return false;
+      if (result.code === 1 && NEEDS_RESTARTING_REBOOT_PATTERN.test(result.stdout)) return true;
+      return null;
+    },
+    slowTtl,
+    now
+  );
+  const linuxFailedServices = refreshInBackground(
+    async () => {
+      const result = await run(
+        "systemctl",
+        ["list-units", "--state=failed", "--no-legend", "--plain", "--no-pager"],
+        slowDeadline
+      );
+      return result && result.code === 0 && !result.timedOut ? countSystemdFailedUnits(result.stdout) : null;
+    },
+    slowTtl,
+    now
+  );
+  const gpuIdentity = refreshInBackground(
+    () => detectGpuWithEvidence(io.runner, io.platform),
+    GPU_IDENTITY_TTL_MS,
+    now
+  );
+  const pendingRebootAndServices = /* @__PURE__ */ __name(async () => {
+    const out = {};
+    if (io.platform === "win32") {
+      const facts = await windowsFacts();
+      if (facts?.pendingReboot !== void 0) out.pendingReboot = facts.pendingReboot;
+      if (facts?.failedServices !== void 0) out.failedServices = facts.failedServices;
+      return out;
+    }
+    if (io.platform === "linux") {
+      const [reboot, failed] = await Promise.all([
+        withDeadline(linuxPendingReboot, budget),
+        withDeadline(linuxFailedServices, budget)
+      ]);
+      if (typeof reboot === "boolean") out.pendingReboot = reboot;
+      if (typeof failed === "number") out.failedServices = failed;
+    }
+    return out;
+  }, "pendingRebootAndServices");
+  const gpu = /* @__PURE__ */ __name(async () => {
+    const nvidia = await run("nvidia-smi", NVIDIA_SMI_HEALTH_ARGS, budget);
+    if (nvidia && nvidia.code === 0 && !nvidia.timedOut) {
+      const parsed = parseNvidiaSmiHealth(nvidia.stdout);
+      if (parsed.length > 0) return { gpu: parsed.map((gpu2) => ({ vendor: "nvidia", ...gpu2 })) };
+    }
+    if (io.platform === "win32") {
+      const facts = await windowsFacts();
+      if (!facts || facts.adapters === void 0) return {};
+      if (facts.adapters.length === 0) return { gpu: null };
+      return { gpu: facts.adapters.map((name) => ({ vendor: classifyGpuVendor(name), name })) };
+    }
+    const identity = await gpuIdentity();
+    if (!identity) return {};
+    if (!identity.gpu) return identity.answered ? { gpu: null } : {};
+    const found = { vendor: identity.gpu.vendor, name: identity.gpu.model };
+    if (identity.gpu.vendor === "amd" && io.platform === "linux") {
+      const rocm = await run("rocm-smi", ROCM_SMI_HEALTH_ARGS, budget);
+      const usage = rocm && rocm.code === 0 && !rocm.timedOut ? parseRocmSmiHealth(rocm.stdout) : null;
+      if (usage) Object.assign(found, usage);
+    }
+    if (identity.gpu.vendor === "apple" && io.platform === "darwin") {
+      const ioreg = await run("ioreg", IOREG_GPU_ARGS, budget);
+      const util = ioreg && ioreg.code === 0 && !ioreg.timedOut ? parseIoregGpuUtil(ioreg.stdout) : null;
+      if (util !== null) found.utilPercent = util;
+    }
+    return { gpu: [found] };
+  }, "gpu");
+  return async () => {
+    try {
+      const parts = await Promise.all([
+        withDeadline(cpuAndMemory, budget),
+        withDeadline(disk, budget),
+        withDeadline(hostFacts, budget),
+        withDeadline(pendingRebootAndServices, budget),
+        withDeadline(gpu, budget)
+      ]);
+      const merged = {};
+      for (const part of parts) {
+        if (part) Object.assign(merged, part);
+      }
+      return sanitizeFleetNodeHealthSnapshot(merged);
+    } catch {
+      return null;
+    }
+  };
+}
+__name(createHealthProbe, "createHealthProbe");
+
+// src/core/housekeeping-report.ts
+function summarizeWorkspaceReap(result) {
+  const dryRun = result.dryRun === true;
+  const worktrees = dryRun ? result.kept.length + result.removed.length : result.kept.length;
+  const keptBytes = result.kept.reduce((sum, verdict) => sum + safeBytes(verdict.record.sizeBytes), 0);
+  const keptPoolBytes = result.keptPools.reduce((sum, verdict) => sum + safeBytes(verdict.pool.sizeBytes), 0);
+  const plannedBytes = dryRun ? result.removed.reduce((sum, entry) => sum + safeBytes(entry.freedBytes), 0) + result.removedPools.reduce((sum, entry) => sum + safeBytes(entry.freedBytes), 0) : 0;
+  return {
+    workspaceCount: worktrees,
+    workspaceBytes: keptBytes + keptPoolBytes + plannedBytes,
+    freedBytes: dryRun ? 0 : safeBytes(result.freedBytes),
+    dryRun
+  };
 }
 __name(summarizeWorkspaceReap, "summarizeWorkspaceReap");
 function safeBytes(value) {
@@ -11552,6 +12885,50 @@ var import_fs2 = require("fs");
 var import_fs3 = require("fs");
 var import_os = require("os");
 var import_path2 = require("path");
+
+// src/core/execution-policy.ts
+var NodeExecutionPolicyError = class extends Error {
+  static {
+    __name(this, "NodeExecutionPolicyError");
+  }
+  constructor(message) {
+    super(message);
+    this.name = "NodeExecutionPolicyError";
+  }
+};
+var NODE_POLICY_COMMAND_HINT = "The machine owner can allow it on this PC with `ever-works-node policy <flag> on` (then restart the node; for the desktop app, run the command with EVER_WORKS_NODE_CONFIG set to the app\u2019s node-config.json); the platform cannot change this setting";
+function describePhase(name, count) {
+  return count > 0 ? `${count} ${name}${count === 1 ? "" : "s"}` : null;
+}
+__name(describePhase, "describePhase");
+function enforceAgentTaskExecutionPolicy(input, policy) {
+  if (!policy) return;
+  if (input.execution?.skipPermissions === true && !policy.allowSkipPermissions) {
+    throw new NodeExecutionPolicyError(
+      `Refused by this node's local execution policy: the job asks to run ${String(input.execution.provider)} with its permission checks switched off (skip-permissions), which gives an untrusted prompt an unrestricted shell as the machine owner. ${NODE_POLICY_COMMAND_HINT} (flag: --allow-skip-permissions).`
+    );
+  }
+  if (policy.allowShellCommands) return;
+  const phases = [
+    describePhase("setup command", input.setupCount),
+    describePhase(input.execution ? "command step" : "command-template step", input.stepCount),
+    describePhase("acceptance check", input.checkCount)
+  ].filter((phase) => phase !== null);
+  if (phases.length === 0) return;
+  throw new NodeExecutionPolicyError(
+    `Refused by this node's local execution policy: the job carries ${phases.join(", ")}. Those are shell commands the node itself would run with the machine owner\u2019s privileges, executing repository code` + (input.execution ? " \u2014 after the model step, code the model may have just written" : "") + `. ${NODE_POLICY_COMMAND_HINT} (flag: --allow-shell-commands), or run this Work with checks off.`
+  );
+}
+__name(enforceAgentTaskExecutionPolicy, "enforceAgentTaskExecutionPolicy");
+function enforceAcceptanceChecksExecutionPolicy(checkCount, policy) {
+  if (!policy || policy.allowShellCommands || checkCount === 0) return;
+  throw new NodeExecutionPolicyError(
+    `Refused by this node's local execution policy: the job carries ${describePhase("acceptance check", checkCount)}, shell commands the node would run with the machine owner\u2019s privileges. ${NODE_POLICY_COMMAND_HINT} (flag: --allow-shell-commands).`
+  );
+}
+__name(enforceAcceptanceChecksExecutionPolicy, "enforceAcceptanceChecksExecutionPolicy");
+
+// src/core/executors/acceptance-checks.ts
 var DEFAULT_CHECK_TIMEOUT_SEC = 600;
 var MAX_CHECK_TIMEOUT_SEC = 1800;
 var CHECK_LOG_TAIL_BYTES = 4096;
@@ -11598,6 +12975,7 @@ async function runAcceptanceChecksJob(job, io = {}, signal) {
     throwIfCommandAborted(signal);
     return { gateStatus: "none", results: [] };
   }
+  enforceAcceptanceChecksExecutionPolicy(checks.length, io.executionPolicy);
   const results = [];
   for (const check of checks) {
     throwIfCommandAborted(signal);
@@ -13329,6 +14707,10 @@ async function runAgentTaskJob(job, io = {}, signal) {
   const checks = withRunEnvGrants(resolveAcceptanceChecks(payload), runEnvGrants);
   const grantedSteps = withRunEnvGrants(steps, runEnvGrants);
   const setup = withRunEnvGrants(normalizeAgentTaskSetup(payload.setup), runEnvGrants);
+  enforceAgentTaskExecutionPolicy(
+    { execution, setupCount: setup.length, stepCount: grantedSteps.length, checkCount: checks.length },
+    io.executionPolicy
+  );
   let workspaceResolution;
   try {
     workspaceResolution = await resolveAgentTaskWorkspace(taskId, payload, io, signal);
@@ -13730,6 +15112,7 @@ async function runModelStep(jobId, execution, workspacePath, mounts, bridgeSpec,
     resultPath: (0, import_path4.join)(scratchDir, "model-output.json")
   };
   const mcpConfigPath = (0, import_path4.join)(scratchDir, "mcp.json");
+  const settingsPath = (0, import_path4.join)(scratchDir, "claude-settings.json");
   const containment = await establishModelContainment(execution.provider, scratchDir, scratchFs, io);
   const bridge = await startBridge(jobId, bridgeSpec, mcpConfigPath, scratchFs, io);
   const recordEvidence = io.modelTranscript !== "off";
@@ -13745,7 +15128,12 @@ async function runModelStep(jobId, execution, workspacePath, mounts, bridgeSpec,
       await scratchFs.writeFile(mcpConfigPath, MODEL_CLI_EMPTY_MCP_CONFIG);
       emptyMcpConfigPath = mcpConfigPath;
     }
-    const droppedFlags = await optionalFlagsToDrop(jobId, execution, executable, io);
+    let claudeSettingsPath;
+    if (execution.provider === "claude-code") {
+      await scratchFs.writeFile(settingsPath, MODEL_CLI_FLEET_SETTINGS);
+      claudeSettingsPath = settingsPath;
+    }
+    const { dropped: droppedFlags, restricted } = await probeModelCliFlags(jobId, execution, executable, io);
     const codexUserSettings = execution.provider === "codex" ? await readOwnerCodexSettings(
       jobId,
       io,
@@ -13763,6 +15151,8 @@ async function runModelStep(jobId, execution, workspacePath, mounts, bridgeSpec,
           ...mounts && mounts.length > 0 ? { mounts } : {},
           ...bridge.cli ? { mcp: bridge.cli } : {},
           ...emptyMcpConfigPath ? { emptyMcpConfigPath } : {},
+          ...claudeSettingsPath ? { settingsPath: claudeSettingsPath } : {},
+          ...restricted ? { restricted: true } : {},
           ...codexUserSettings ? { codexUserSettings } : {},
           ...resumeSessionId ? { resumeSessionId } : {},
           ...io.platform ? { platform: io.platform } : {},
@@ -13770,6 +15160,7 @@ async function runModelStep(jobId, execution, workspacePath, mounts, bridgeSpec,
           ...droppedFlags.length > 0 ? { omitFlags: droppedFlags } : {}
         });
         assertMcpIsolationInCommand({ command, execution });
+        assertSettingsIsolationInCommand({ command, execution });
         assertMountGrantsInCommand({
           command,
           execution,
@@ -13848,14 +15239,21 @@ async function refuseUnderClaudeManagedMcpConfig(provider, io) {
   );
 }
 __name(refuseUnderClaudeManagedMcpConfig, "refuseUnderClaudeManagedMcpConfig");
-async function optionalFlagsToDrop(jobId, execution, executable, io) {
-  if (!io.modelCliCompat) return [];
+async function probeModelCliFlags(jobId, execution, executable, io) {
+  if (!io.modelCliCompat) return { dropped: [], restricted: false };
   let compat = null;
   try {
     compat = await io.modelCliCompat(execution.provider, executable);
   } catch {
-    return [];
+    return { dropped: [], restricted: false };
   }
+  return {
+    dropped: optionalFlagsToDrop(jobId, execution, compat, io),
+    restricted: supportsRestrictedMode(jobId, execution, compat, io)
+  };
+}
+__name(probeModelCliFlags, "probeModelCliFlags");
+function optionalFlagsToDrop(jobId, execution, compat, io) {
   const dropped = unsupportedOptionalModelCliFlags(execution, compat?.supportedFlags ?? null);
   if (dropped.length > 0) {
     io.logger?.warn(
@@ -13865,6 +15263,18 @@ async function optionalFlagsToDrop(jobId, execution, executable, io) {
   return dropped;
 }
 __name(optionalFlagsToDrop, "optionalFlagsToDrop");
+function supportsRestrictedMode(jobId, execution, compat, io) {
+  if (execution.provider !== "claude-code" || execution.skipPermissions === true) return false;
+  if (io.executionPolicy?.restrictedMode === false) return false;
+  const supported = compat?.supportedFlags?.has("--restricted") === true;
+  if (!supported && compat?.supportedFlags) {
+    io.logger?.info(
+      `[fleet-node] job ${jobId}: the pinned claude-code CLI (${compat.version ?? "version unknown"}) does not advertise --restricted \u2014 running with the baseline settings isolation only. Upgrade Claude Code on this machine for the stricter mode.`
+    );
+  }
+  return supported;
+}
+__name(supportsRestrictedMode, "supportsRestrictedMode");
 async function establishModelContainment(provider, scratchDir, scratchFs, io) {
   const downgrades = [
     {
@@ -15346,17 +16756,9 @@ function describe(error) {
 }
 __name(describe, "describe");
 
-// src/core/screen/node-leg.ts
-var NODE_LEG_RECONNECT_BASE_MS = 2e3;
-var NODE_LEG_RECONNECT_MAX_MS = 3e4;
-var NODE_LEG_ACCEPTED_AFTER_MS = 3e4;
+// src/core/link/link-socket.ts
 var LOOPBACK_HOSTNAMES2 = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
-function toComputerWsUrl(apiUrl, wsPath) {
-  const origin = new URL(apiUrl).origin;
-  return `${origin.replace(/^http/, "ws")}${wsPath.startsWith("/") ? wsPath : `/${wsPath}`}`;
-}
-__name(toComputerWsUrl, "toComputerWsUrl");
-function isSecureLegOrigin(apiUrl) {
+function isSecureLinkOrigin(apiUrl) {
   let parsed;
   try {
     parsed = new URL(apiUrl);
@@ -15366,6 +16768,83 @@ function isSecureLegOrigin(apiUrl) {
   if (parsed.protocol === "https:") return true;
   return parsed.protocol === "http:" && LOOPBACK_HOSTNAMES2.has(parsed.hostname);
 }
+__name(isSecureLinkOrigin, "isSecureLinkOrigin");
+function toLinkWsUrl(apiUrl, wsPath) {
+  const origin = new URL(apiUrl).origin;
+  return `${origin.replace(/^http/, "ws")}${wsPath.startsWith("/") ? wsPath : `/${wsPath}`}`;
+}
+__name(toLinkWsUrl, "toLinkWsUrl");
+var LinkBackoff = class {
+  static {
+    __name(this, "LinkBackoff");
+  }
+  attempt = 0;
+  baseMs;
+  maxMs;
+  jitter;
+  random;
+  constructor(options = {}) {
+    this.baseMs = options.baseMs ?? FLEET_LINK_BACKOFF_BASE_MS;
+    this.maxMs = Math.max(this.baseMs, options.maxMs ?? FLEET_LINK_BACKOFF_MAX_MS);
+    this.jitter = Math.min(Math.max(options.jitter ?? 0.2, 0), 0.9);
+    this.random = options.random ?? Math.random;
+  }
+  /** Attempts made since the last reset. */
+  get attempts() {
+    return this.attempt;
+  }
+  /** The nominal (un-jittered) wait for attempt `n`. */
+  nominal(attempt) {
+    return Math.min(this.baseMs * 2 ** Math.min(Math.max(attempt, 0), 20), this.maxMs);
+  }
+  next() {
+    const nominal = this.nominal(this.attempt);
+    this.attempt += 1;
+    const spread = nominal * this.jitter * (this.random() * 2 - 1);
+    return Math.round(Math.min(Math.max(nominal + spread, this.baseMs), this.maxMs));
+  }
+  reset() {
+    this.attempt = 0;
+  }
+};
+var LINK_SOCKET_OPEN = 1;
+function defaultLinkSocketFactory() {
+  const Ctor = globalThis.WebSocket;
+  if (typeof Ctor !== "function") return null;
+  return (url) => {
+    const socket = new Ctor(url);
+    try {
+      socket.binaryType = "arraybuffer";
+    } catch {
+    }
+    return socket;
+  };
+}
+__name(defaultLinkSocketFactory, "defaultLinkSocketFactory");
+function linkMessageBytes(data) {
+  if (data instanceof Uint8Array) return data;
+  if (data instanceof ArrayBuffer) return new Uint8Array(data);
+  if (ArrayBuffer.isView(data)) return new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+  return null;
+}
+__name(linkMessageBytes, "linkMessageBytes");
+function linkCloseCode(event) {
+  const code = event?.code;
+  return typeof code === "number" ? code : null;
+}
+__name(linkCloseCode, "linkCloseCode");
+
+// src/core/screen/node-leg.ts
+var NODE_LEG_RECONNECT_BASE_MS = 2e3;
+var NODE_LEG_RECONNECT_MAX_MS = 3e4;
+var NODE_LEG_ACCEPTED_AFTER_MS = 3e4;
+function toComputerWsUrl(apiUrl, wsPath) {
+  return toLinkWsUrl(apiUrl, wsPath);
+}
+__name(toComputerWsUrl, "toComputerWsUrl");
+function isSecureLegOrigin(apiUrl) {
+  return isSecureLinkOrigin(apiUrl);
+}
 __name(isSecureLegOrigin, "isSecureLegOrigin");
 function openNodeLeg(options) {
   if (!isSecureLegOrigin(options.apiUrl)) {
@@ -15534,13 +17013,13 @@ var ComputerSessionPayloadError = class extends Error {
     this.name = "ComputerSessionPayloadError";
   }
 };
-var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function normalizeComputerSessionPayload(raw, nodeId) {
   if (!raw || typeof raw !== "object") throw new ComputerSessionPayloadError("Live view payload is missing");
   const payload = raw;
   const sessionId = typeof payload.sessionId === "string" ? payload.sessionId : "";
   const agentId = typeof payload.agentId === "string" ? payload.agentId : "";
-  if (!UUID_PATTERN.test(sessionId) || !UUID_PATTERN.test(agentId)) {
+  if (!UUID_PATTERN2.test(sessionId) || !UUID_PATTERN2.test(agentId)) {
     throw new ComputerSessionPayloadError("Live view payload has no valid session or Agent");
   }
   if (payload.nodeId !== nodeId) {
@@ -15797,6 +17276,7 @@ var PROBLEM_CODES2 = [
   "already_connected",
   "already_linked",
   "already_claimed",
+  "claim_locked",
   "invalid_client",
   "public_jwk_invalid",
   "identifier_claimed",
@@ -15822,6 +17302,11 @@ var PROBLEM_CODES2 = [
   "database_absent",
   "database_unreachable",
   "topic_private",
+  "realtime_disabled",
+  "topic_forbidden",
+  "topic_invalid",
+  "realtime_busy",
+  "too_many_streams",
   "keys_unavailable",
   "internal_error"
 ];
@@ -16406,6 +17891,49 @@ var FLEET_AGENT_CREDENTIAL_FAMILIES2 = [
 FLEET_AGENT_CREDENTIAL_FAMILIES2.flatMap(
   (family) => family.envNames
 );
+var FLEET_LINK_FRAME_KINDS2 = {
+  /** Raw bytes: terminal output/input, log lines, file chunks. */
+  DATA: 1,
+  /** `[cols u16][rows u16]`. */
+  RESIZE: 2,
+  /** `[code i32]`. */
+  EXIT: 3,
+  /** UTF-8 JSON control message. */
+  JSON: 10,
+  /** UTF-8 reason code. */
+  CLOSE: 11,
+  /** A full picture (the existing computer-frame encoding). */
+  FRAME: 20,
+  /** A pointer / key / text event (the existing computer input encoding). */
+  INPUT: 21,
+  /** Changed tiles `[w][h][count]{x,y,w,h,len,jpeg}`. */
+  TILES: 23,
+  /** `[bytes u32]` credit. */
+  ACK: 30,
+  /** End of a stream. */
+  END: 31,
+  /** UTF-8 text ≤ 256 KiB, pasted into a desktop. */
+  CLIP: 40
+};
+new Set(Object.values(FLEET_LINK_FRAME_KINDS2));
+var FLEET_LINK_CONTROL_TYPES2 = [
+  "link.hello",
+  "link.ready",
+  "link.ping",
+  "link.pong",
+  "link.pause",
+  "link.resume",
+  "link.drain",
+  "channel.open",
+  "channel.ready",
+  "channel.refused",
+  "channel.close",
+  "operation.progress",
+  "operation.done",
+  "operation.cancel"
+];
+new Set(FLEET_LINK_CONTROL_TYPES2);
+new TextEncoder();
 var EMAIL_INBOX_CAP_FIELDS2 = [
   "inboxDailySends",
   "inboxBurstSends",
@@ -20148,6 +21676,7 @@ var PROBLEM_CODES3 = [
   "already_connected",
   "already_linked",
   "already_claimed",
+  "claim_locked",
   "invalid_client",
   "public_jwk_invalid",
   "identifier_claimed",
@@ -20173,6 +21702,11 @@ var PROBLEM_CODES3 = [
   "database_absent",
   "database_unreachable",
   "topic_private",
+  "realtime_disabled",
+  "topic_forbidden",
+  "topic_invalid",
+  "realtime_busy",
+  "too_many_streams",
   "keys_unavailable",
   "internal_error"
 ];
@@ -20757,6 +22291,49 @@ var FLEET_AGENT_CREDENTIAL_FAMILIES3 = [
 FLEET_AGENT_CREDENTIAL_FAMILIES3.flatMap(
   (family) => family.envNames
 );
+var FLEET_LINK_FRAME_KINDS3 = {
+  /** Raw bytes: terminal output/input, log lines, file chunks. */
+  DATA: 1,
+  /** `[cols u16][rows u16]`. */
+  RESIZE: 2,
+  /** `[code i32]`. */
+  EXIT: 3,
+  /** UTF-8 JSON control message. */
+  JSON: 10,
+  /** UTF-8 reason code. */
+  CLOSE: 11,
+  /** A full picture (the existing computer-frame encoding). */
+  FRAME: 20,
+  /** A pointer / key / text event (the existing computer input encoding). */
+  INPUT: 21,
+  /** Changed tiles `[w][h][count]{x,y,w,h,len,jpeg}`. */
+  TILES: 23,
+  /** `[bytes u32]` credit. */
+  ACK: 30,
+  /** End of a stream. */
+  END: 31,
+  /** UTF-8 text ≤ 256 KiB, pasted into a desktop. */
+  CLIP: 40
+};
+new Set(Object.values(FLEET_LINK_FRAME_KINDS3));
+var FLEET_LINK_CONTROL_TYPES3 = [
+  "link.hello",
+  "link.ready",
+  "link.ping",
+  "link.pong",
+  "link.pause",
+  "link.resume",
+  "link.drain",
+  "channel.open",
+  "channel.ready",
+  "channel.refused",
+  "channel.close",
+  "operation.progress",
+  "operation.done",
+  "operation.cancel"
+];
+new Set(FLEET_LINK_CONTROL_TYPES3);
+new TextEncoder();
 var EMAIL_INBOX_CAP_FIELDS3 = [
   "inboxDailySends",
   "inboxBurstSends",
@@ -22051,119 +23628,1230 @@ async function defaultReadTextFile(path2) {
 }
 __name(defaultReadTextFile, "defaultReadTextFile");
 
-// src/core/runtime.ts
-function buildSelfDescriptionTelemetry(io, cliCompat) {
-  const pinned = /* @__PURE__ */ __name(() => io.environment.modelCli ?? {}, "pinned");
-  const telemetry = {
-    cliVersion: cliCompat ? async () => primaryPinnedCliVersion(await cliCompat.probeAll(pinned())) ?? detectAgentCliVersion(io.runner) : () => detectAgentCliVersion(io.runner),
-    modelIdentity: cacheProbe(() => detectModelIdentity(io.runner, io.environment.modelCli ?? {}))
-  };
-  if (cliCompat) {
-    telemetry.cliVersions = async () => describeCliVersions(await cliCompat.probeAll(pinned()));
-  }
-  if (io.diskProbe) {
-    const probe = io.diskProbe;
-    const path2 = io.workspacePath ?? process.cwd();
-    telemetry.diskFreeBytes = () => measureWorkspaceFreeBytes(probe, path2);
-  }
-  return telemetry;
-}
-__name(buildSelfDescriptionTelemetry, "buildSelfDescriptionTelemetry");
-function clampHeartbeatInterval(intervalMs) {
-  if (typeof intervalMs !== "number" || !Number.isFinite(intervalMs)) {
-    return DEFAULT_HEARTBEAT_INTERVAL_MS;
-  }
-  return Math.min(Math.max(Math.round(intervalMs), MIN_HEARTBEAT_INTERVAL_MS), MAX_HEARTBEAT_INTERVAL_MS);
-}
-__name(clampHeartbeatInterval, "clampHeartbeatInterval");
-async function enrollNode(options) {
-  const { logger } = options;
-  logger.protect(options.token);
-  const client = new FleetClient({
-    apiUrl: options.apiUrl,
-    fetchFn: options.fetchFn,
-    logger,
-    userAgent: options.userAgent ?? `ever-works-node/${options.version}`
-  });
-  const description = await describeSelf(
-    options.runner,
-    options.environment,
-    options.version,
-    options.capabilitySelection ?? null,
-    // Deliberately WITHOUT the pinned-CLI compat probe (review, slice AR):
-    // that probe adds `cliVersions`, an optional field an older platform's
-    // `forbidNonWhitelisted` pipe answers with a 400 — and enrollment, unlike
-    // the heartbeat, has no strip-and-retry fallback, so a new node could
-    // never enroll against it. The first heartbeat reports the pinned
-    // versions, behind the heartbeat's own fallback.
-    buildSelfDescriptionTelemetry(options)
-  );
-  logger.info(`Enrolling with ${client.baseUrl} as ${description.platform} [${description.capabilities.join(", ")}]`);
-  const result = await client.enroll({ token: options.token, ...description });
-  logger.protect(result.secret);
-  const limits = clampResourceLimits(options.limits);
-  const config = {
-    apiUrl: client.baseUrl,
-    nodeId: result.nodeId,
-    secret: result.secret,
-    kind: options.kind,
-    capabilities: description.capabilities,
-    limits,
-    heartbeatIntervalMs: clampHeartbeatInterval(options.heartbeatIntervalMs),
-    enrolledAt: new Date(options.now ? options.now() : Date.now()).toISOString()
-  };
-  if (options.capabilitySelection) {
-    config.capabilitySelection = [...options.capabilitySelection];
+// src/core/link/link-client.ts
+var import_node_crypto3 = require("node:crypto");
+
+// src/core/link/channel-mux.ts
+var ChannelMux = class {
+  constructor(options) {
+    this.options = options;
   }
-  const label = options.name?.trim() || result.node.name;
-  if (label) {
-    config.name = label;
+  options;
+  static {
+    __name(this, "ChannelMux");
+  }
+  channels = /* @__PURE__ */ new Map();
+  /** Numbers closed on the current generation. */
+  retired = /* @__PURE__ */ new Set();
+  sender = null;
+  /** Channels currently open (suspended ones included). */
+  get size() {
+    return this.channels.size;
+  }
+  /** Point the table at a socket (null while the link is down). */
+  bind(sender) {
+    this.sender = sender;
+  }
+  has(channel) {
+    return this.channels.has(channel);
+  }
+  /** Send a raw frame through the bound socket. */
+  sendFrame(frame) {
+    if (!frame || !this.sender) return false;
+    try {
+      return this.sender(frame);
+    } catch {
+      return false;
+    }
   }
-  logger.info(
-    `Enrolled as node ${result.nodeId} ("${config.name ?? "unnamed"}") \u2014 max ${limits.maxConcurrentJobs} concurrent job(s)`
-  );
-  return config;
-}
-__name(enrollNode, "enrollNode");
-function createNodeRuntime(config, io, options = {}) {
-  io.logger.protect(config.secret);
-  const userAgent = io.userAgent ?? `ever-works-node/${io.version}`;
-  const apiBase = resolveApiBase(config, options.env ?? process.env);
-  io.logger.info(`Control plane: ${describeApiBase(apiBase)}`);
-  if (apiBase.mismatch) {
-    io.logger.warn(
-      `The pinned control plane (${apiBase.url}) is not the origin this node enrolled against (${apiBase.configuredUrl}). Every call will be refused with 401 until the pin is corrected or the node is re-enrolled.`
-    );
+  sendControl(message) {
+    return this.sendFrame(encodeFleetLinkControl(message));
   }
-  const client = new FleetClient({
-    apiUrl: apiBase.url,
-    fetchFn: io.fetchFn,
-    logger: io.logger,
-    userAgent
-  });
-  const selection = config.capabilitySelection ?? null;
-  const workspaceRoot = options.agentTaskWorkspaceRoot ?? defaultFleetTaskWorkspaceRoot();
-  const cliCompat = new ModelCliCompatibilityProbe({
-    runner: io.runner,
-    platform: io.environment.platform,
-    ...io.statFile ? { statFile: io.statFile } : {},
-    ...io.now ? { now: io.now } : {}
-  });
-  const pinnedModelCli = options.modelCli ?? io.environment.modelCli ?? {};
-  const telemetry = buildSelfDescriptionTelemetry(
-    {
-      ...io,
-      workspacePath: io.workspacePath ?? workspaceRoot,
+  /** `channel.open` from the platform: answer `channel.ready` or `channel.refused`. */
+  async open(message) {
+    const { channel, family, params, requestId } = message;
+    const refuse = /* @__PURE__ */ __name((error) => {
+      this.sendControl({ type: "channel.refused", channel, requestId, error });
+    }, "refuse");
+    if (this.channels.has(channel) || this.retired.has(channel)) {
+      refuse(makeFleetLinkError("invalid", `channel ${channel} is already in use on this link`));
+      return;
+    }
+    if (this.channels.size >= FLEET_LINK_MAX_CHANNELS) {
+      refuse(
+        makeFleetLinkError(
+          "limit_exceeded",
+          `${FLEET_LINK_MAX_CHANNELS} channels are open on ${this.options.nodeName}; close one`
+        )
+      );
+      return;
+    }
+    if (this.options.control.paused) {
+      refuse(makeFleetLinkError("kill_switch", "clear it under Settings \u2192 Fleet"));
+      return;
+    }
+    const provider = this.options.modules.family(family);
+    if (!provider) {
+      refuse(
+        makeFleetLinkError(
+          "unsupported_on_node",
+          `${this.options.nodeName} (node ${this.options.nodeVersion}) cannot do this yet: ${family}`,
+          { family, nodeVersion: this.options.nodeVersion }
+        )
+      );
+      return;
+    }
+    let requirement;
+    try {
+      requirement = this.options.modules.familyConsent(family, params);
+    } catch (thrown) {
+      this.options.logger?.warn(
+        `Link channel ${channel} (${family}) consent check failed: ${thrown instanceof Error ? thrown.message : String(thrown)}`
+      );
+      refuse(makeFleetLinkError("internal", `${this.options.nodeName} could not check this channel's consent`));
+      return;
+    }
+    if (!fleetConsentSatisfies(this.options.consents, requirement)) {
+      refuse(
+        makeFleetLinkError("consent_missing", fleetConsentMissingHint(requirement, this.options.nodeName), {
+          family,
+          consent: requirement
+        })
+      );
+      return;
+    }
+    const placeholder = { channel, family, handler: {}, credit: null, suspended: false };
+    this.channels.set(channel, placeholder);
+    let result;
+    try {
+      result = await provider.open(this.contextFor(channel, family, params));
+    } catch (thrown) {
+      result = {
+        ok: false,
+        error: makeFleetLinkError(
+          "operation_failed",
+          (thrown instanceof Error ? thrown.message : String(thrown)).split(/\r?\n/, 1)[0].slice(0, 300)
+        )
+      };
+    }
+    if (this.channels.get(channel) !== placeholder) {
+      if (result.ok) result.handler.onClose?.("normal");
+      return;
+    }
+    if (!result.ok) {
+      this.channels.delete(channel);
+      this.retired.add(channel);
+      refuse(result.error);
+      return;
+    }
+    placeholder.handler = result.handler;
+    placeholder.credit = FLEET_LINK_CREDIT_FAMILIES.includes(family) ? FLEET_LINK_CREDIT_WINDOW_BYTES : null;
+    const ready = {
+      type: "channel.ready",
+      channel,
+      requestId
+    };
+    if (result.handler.resumeKey) ready.resumeKey = result.handler.resumeKey;
+    this.sendControl(ready);
+  }
+  /** A frame for a channel above 0. Frames for an unknown channel are dropped. */
+  deliver(frame) {
+    const entry = this.channels.get(frame.channel);
+    if (!entry || entry.suspended) return;
+    if (frame.kind === FLEET_LINK_FRAME_KINDS.ACK && entry.credit !== null) {
+      const granted = decodeFleetLinkAck(frame.payload);
+      if (granted !== null && granted > 0) {
+        entry.credit = Math.min(entry.credit + granted, FLEET_LINK_CREDIT_WINDOW_BYTES);
+        try {
+          entry.handler.onDrain?.();
+        } catch {
+        }
+      }
+      return;
+    }
+    try {
+      if (frame.kind === FLEET_LINK_FRAME_KINDS.JSON) {
+        const message = decodeFleetLinkJson(frame.payload, FLEET_LINK_MAX_PAYLOAD_BYTES);
+        if (message) entry.handler.onJson?.(message);
+        return;
+      }
+      entry.handler.onBinary?.(frame.kind, frame.payload);
+    } catch (thrown) {
+      this.options.logger?.warn(
+        `Link channel ${frame.channel} (${entry.family}) handler failed: ${thrown instanceof Error ? thrown.message : String(thrown)}`
+      );
+    }
+  }
+  /** `channel.close` from the platform. */
+  closeRemote(channel, reason) {
+    this.finish(channel, reason, false);
+  }
+  /** Close one channel from the node's side, telling the platform. */
+  closeLocal(channel, reason, hint) {
+    if (!this.channels.has(channel)) return;
+    this.finish(channel, reason, true, hint);
+  }
+  /**
+   * The link dropped. Channels that cannot resume are closed now with
+   * `resume_failed`; the rest are suspended and listed for the reconnect.
+   */
+  suspend() {
+    this.sender = null;
+    const resume = [];
+    for (const entry of [...this.channels.values()]) {
+      if (entry.handler.resumeKey) {
+        entry.suspended = true;
+        resume.push({ channel: entry.channel, family: entry.family, resumeKey: entry.handler.resumeKey });
+      } else {
+        this.finish(entry.channel, "resume_failed", false);
+      }
+    }
+    return resume;
+  }
+  /**
+   * A new generation is ready. Channels it `resumed` carry on; every other
+   * suspended channel closes with the reason the platform gave, or
+   * `resume_failed`. Numbers retired on the previous generation are free
+   * again — retirement is per generation.
+   */
+  resumeGeneration(resumed, closed, closedReason = "resume_failed") {
+    this.retired = /* @__PURE__ */ new Set();
+    const keep = new Set(resumed);
+    for (const entry of [...this.channels.values()]) {
+      if (!entry.suspended) continue;
+      if (keep.has(entry.channel)) {
+        entry.suspended = false;
+        try {
+          entry.handler.onResume?.();
+        } catch {
+        }
+      } else {
+        this.finish(entry.channel, closed.includes(entry.channel) ? closedReason : "resume_failed", false);
+      }
+    }
+  }
+  /** Close every channel (shutdown, or a link that will not come back). */
+  closeAll(reason) {
+    for (const channel of [...this.channels.keys()]) this.finish(channel, reason, false);
+  }
+  finish(channel, reason, tellPlatform, hint) {
+    const entry = this.channels.get(channel);
+    if (!entry) return;
+    this.channels.delete(channel);
+    this.retired.add(channel);
+    if (tellPlatform) {
+      const close = {
+        type: "channel.close",
+        channel,
+        reason
+      };
+      if (hint) close.hint = hint;
+      this.sendControl(close);
+    }
+    try {
+      entry.handler.onClose?.(reason);
+    } catch {
+    }
+  }
+  contextFor(channel, family, params) {
+    const live = /* @__PURE__ */ __name(() => {
+      const entry = this.channels.get(channel);
+      return entry && !entry.suspended ? entry : null;
+    }, "live");
+    return {
+      channel,
+      family,
+      params,
+      consents: this.options.consents,
+      control: this.options.control,
+      nodeVersion: this.options.nodeVersion,
+      nodeName: this.options.nodeName,
+      logger: this.options.logger,
+      operations: this.options.operations,
+      sendJson: /* @__PURE__ */ __name((message) => live() ? this.sendFrame(encodeFleetLinkJson(channel, message)) : false, "sendJson"),
+      sendBinary: /* @__PURE__ */ __name((kind, payload) => {
+        const entry = live();
+        if (!entry) return false;
+        if (kind === FLEET_LINK_FRAME_KINDS.DATA && entry.credit !== null) {
+          if (payload.byteLength > entry.credit) return false;
+          const sent = this.sendFrame(encodeFleetLinkFrame(channel, kind, payload));
+          if (sent) entry.credit -= payload.byteLength;
+          return sent;
+        }
+        return this.sendFrame(encodeFleetLinkFrame(channel, kind, payload));
+      }, "sendBinary"),
+      sendControl: /* @__PURE__ */ __name((message) => this.sendControl(message), "sendControl"),
+      close: /* @__PURE__ */ __name((reason, hint) => this.closeLocal(channel, reason, hint), "close")
+    };
+  }
+};
+
+// src/core/link/modules/registry.ts
+var MachineVerbError = class extends Error {
+  constructor(error) {
+    super(error.hint);
+    this.error = error;
+    this.name = "MachineVerbError";
+  }
+  error;
+  static {
+    __name(this, "MachineVerbError");
+  }
+};
+var MODULE_ID_PATTERN = /^[a-z][a-z0-9-]{0,47}$/;
+function composeNodeModules(modules) {
+  const ids = /* @__PURE__ */ new Set();
+  const families = /* @__PURE__ */ new Map();
+  const verbs = /* @__PURE__ */ new Map();
+  const controls = /* @__PURE__ */ new Map();
+  for (const module2 of modules) {
+    if (!MODULE_ID_PATTERN.test(module2.id)) throw new Error(`Node module id "${module2.id}" is not kebab-case`);
+    if (ids.has(module2.id)) throw new Error(`Node module "${module2.id}" is registered twice`);
+    ids.add(module2.id);
+    for (const provider of module2.families ?? []) {
+      if (families.has(provider.family)) {
+        throw new Error(
+          `Channel family "${provider.family}" is claimed by two node modules (second: ${module2.id})`
+        );
+      }
+      families.set(provider.family, provider);
+    }
+    for (const [name, verb] of Object.entries(module2.machineVerbs ?? {})) {
+      if (!isFleetLinkVerb(name))
+        throw new Error(`Machine verb "${name}" (module ${module2.id}) is not a valid verb name`);
+      if (verbs.has(name))
+        throw new Error(`Machine verb "${name}" is registered by two node modules (second: ${module2.id})`);
+      verbs.set(name, verb);
+    }
+    for (const [type, handler] of Object.entries(module2.controlHandlers ?? {})) {
+      if (controls.has(type))
+        throw new Error(`Control type "${type}" is handled by two node modules (second: ${module2.id})`);
+      controls.set(type, handler);
+    }
+  }
+  const frozen = Object.freeze([...modules]);
+  return {
+    modules: frozen,
+    tags(environment) {
+      const out = [];
+      for (const module2 of frozen) {
+        for (const tag of module2.tags?.(environment) ?? []) {
+          if (typeof tag === "string" && tag.length > 0 && !out.includes(tag)) out.push(tag);
+        }
+      }
+      return out;
+    },
+    family: /* @__PURE__ */ __name((name) => families.get(name), "family"),
+    familyConsent(name, params) {
+      const provider = families.get(name);
+      const declared = provider?.consent;
+      if (typeof declared === "function") return declared(params);
+      return declared ?? fleetLinkChannelOpenConsent(name);
+    },
+    machineVerb: /* @__PURE__ */ __name((name) => verbs.get(name), "machineVerb"),
+    machineVerbs: /* @__PURE__ */ __name(() => [...verbs.keys()].sort(), "machineVerbs"),
+    controlHandler: /* @__PURE__ */ __name((type) => controls.get(type), "controlHandler")
+  };
+}
+__name(composeNodeModules, "composeNodeModules");
+
+// src/core/link/modules/machine.ts
+var MACHINE_CHANNEL_MAX_IN_FLIGHT = 32;
+function errorFrom(thrown, signal) {
+  if (thrown instanceof MachineVerbError) return thrown.error;
+  if (signal.aborted) return makeFleetLinkError("operation_failed", "cancelled");
+  const message = thrown instanceof Error ? thrown.message : String(thrown);
+  const firstLine = message.split(/\r?\n/, 1)[0]?.trim() || "the request failed on the node";
+  return makeFleetLinkError("operation_failed", firstLine.slice(0, 300));
+}
+__name(errorFrom, "errorFrom");
+function openMachineChannel(context, options) {
+  const setTimer = options.setTimer ?? ((callback, ms) => setTimeout(callback, ms));
+  const clearTimer = options.clearTimer ?? ((handle2) => clearTimeout(handle2));
+  const inFlight = /* @__PURE__ */ new Map();
+  const reply = /* @__PURE__ */ __name((message) => {
+    if (!context.sendJson(message) && typeof message.requestId === "string") {
+      context.sendJson({
+        requestId: message.requestId,
+        error: makeFleetLinkError("internal", "the reply could not be sent")
+      });
+    }
+  }, "reply");
+  const refuse = /* @__PURE__ */ __name((requestId, error) => {
+    context.sendJson({ requestId, error });
+  }, "refuse");
+  const handle = /* @__PURE__ */ __name((raw) => {
+    const request = asFleetLinkRequest(raw);
+    if (!request) {
+      if (isFleetLinkId(raw.requestId)) {
+        refuse(
+          raw.requestId,
+          makeFleetLinkError("invalid", "a request needs a requestId, a type and object params")
+        );
+      }
+      return;
+    }
+    const { requestId, type: name } = request;
+    if (inFlight.has(requestId)) {
+      refuse(requestId, makeFleetLinkError("invalid", "this requestId is already in flight"));
+      return;
+    }
+    const verb = options.verb(name);
+    if (!verb) {
+      refuse(
+        requestId,
+        makeFleetLinkError(
+          "unsupported_on_node",
+          `${context.nodeName} (node ${context.nodeVersion}) cannot do this yet: ${name}`,
+          { verb: name, nodeVersion: context.nodeVersion }
+        )
+      );
+      return;
+    }
+    const consent = fleetLinkVerbConsent(name);
+    if (!fleetConsentSatisfies(context.consents, consent)) {
+      refuse(
+        requestId,
+        makeFleetLinkError("consent_missing", fleetConsentMissingHint(consent, context.nodeName), {
+          verb: name,
+          consent
+        })
+      );
+      return;
+    }
+    if (verb.stateChanging && context.control.paused) {
+      refuse(requestId, makeFleetLinkError("kill_switch", "clear it under Settings \u2192 Fleet"));
+      return;
+    }
+    if (inFlight.size >= MACHINE_CHANNEL_MAX_IN_FLIGHT) {
+      refuse(
+        requestId,
+        makeFleetLinkError(
+          "busy",
+          `${MACHINE_CHANNEL_MAX_IN_FLIGHT} requests are already running on this channel`
+        )
+      );
+      return;
+    }
+    const abort = new AbortController();
+    inFlight.set(requestId, abort);
+    let operationId = null;
+    let lastProgress = null;
+    let settled = false;
+    const becomeOperation = /* @__PURE__ */ __name(() => {
+      if (settled || operationId !== null) return;
+      inFlight.delete(requestId);
+      operationId = context.operations.start(() => abort.abort());
+      reply({ requestId, operationId });
+      if (lastProgress) context.operations.progress(operationId, lastProgress);
+    }, "becomeOperation");
+    const inlineMs = Math.max(0, options.inlineReplyMs?.() ?? FLEET_LINK_INLINE_REPLY_MS);
+    const timer = setTimer(becomeOperation, inlineMs);
+    const finish = /* @__PURE__ */ __name((outcome) => {
+      if (settled) return;
+      settled = true;
+      clearTimer(timer);
+      if (operationId === null) {
+        inFlight.delete(requestId);
+        if (abort.signal.aborted) return;
+        if (outcome.error) refuse(requestId, outcome.error);
+        else reply({ requestId, result: outcome.result ?? null });
+        return;
+      }
+      context.operations.done(operationId, outcome);
+    }, "finish");
+    let running;
+    try {
+      running = Promise.resolve(
+        verb.run({
+          verb: name,
+          params: request.params ?? {},
+          consents: context.consents,
+          control: context.control,
+          nodeVersion: context.nodeVersion,
+          nodeName: context.nodeName,
+          signal: abort.signal,
+          logger: context.logger,
+          progress: /* @__PURE__ */ __name((progress) => {
+            lastProgress = progress;
+            if (operationId !== null) context.operations.progress(operationId, progress);
+          }, "progress")
+        })
+      );
+    } catch (thrown) {
+      running = Promise.reject(thrown);
+    }
+    running.then(
+      (result) => finish({ result }),
+      (thrown) => finish({ error: errorFrom(thrown, abort.signal) })
+    );
+  }, "handle");
+  return {
+    resumeKey: "machine",
+    onJson: handle,
+    onClose: /* @__PURE__ */ __name(() => {
+      for (const abort of inFlight.values()) abort.abort();
+      inFlight.clear();
+    }, "onClose")
+  };
+}
+__name(openMachineChannel, "openMachineChannel");
+function createMachineModule(options) {
+  return {
+    id: "machine",
+    families: [
+      {
+        // Opening needs only the link (`fleetLinkChannelOpenConsent`, CONTRACTS
+        // R-31); every request is checked against its verb's consent above.
+        family: "machine",
+        open: /* @__PURE__ */ __name((context) => ({ ok: true, handler: openMachineChannel(context, options) }), "open")
+      }
+    ]
+  };
+}
+__name(createMachineModule, "createMachineModule");
+
+// src/core/link/modules/index.ts
+var NODE_LINK_MODULES = [];
+function composeNodeLinkModules(options = {}) {
+  const { extra = [], ...machineOptions } = options;
+  let composed = null;
+  const machine = createMachineModule({
+    ...machineOptions,
+    verb: /* @__PURE__ */ __name((name) => composed?.machineVerb(name), "verb")
+  });
+  composed = composeNodeModules([controlModule, machine, ...NODE_LINK_MODULES, ...extra]);
+  return composed;
+}
+__name(composeNodeLinkModules, "composeNodeLinkModules");
+
+// src/core/link/link-client.ts
+var MAX_PENDING_OPERATION_RESULTS = 64;
+var READY_TIMEOUT_MS = FLEET_LINK_AUTH_TIMEOUT_MS * 2;
+var MAX_HELLO_TAGS = 64;
+function createNodeLink(options) {
+  return new NodeLinkClient(options);
+}
+__name(createNodeLink, "createNodeLink");
+var NodeLinkClient = class {
+  constructor(options) {
+    this.options = options;
+    this.scheduler = options.scheduler ?? systemScheduler;
+    this.now = options.now ?? (() => Date.now());
+    this.backoff = new LinkBackoff({ random: options.random });
+    this.modules = options.modules ?? composeNodeLinkModules({
+      inlineReplyMs: /* @__PURE__ */ __name(() => this.limits.inlineReplyMs, "inlineReplyMs"),
+      setTimer: /* @__PURE__ */ __name((callback, ms) => this.scheduler.setTimeout(callback, ms), "setTimer"),
+      clearTimer: /* @__PURE__ */ __name((handle) => this.scheduler.clearTimeout(handle), "clearTimer")
+    });
+    const operations = {
+      start: /* @__PURE__ */ __name((cancel) => {
+        const id = `op-${(0, import_node_crypto3.randomUUID)()}`;
+        this.operations.set(id, { cancel });
+        return id;
+      }, "start"),
+      progress: /* @__PURE__ */ __name((operationId, progress) => {
+        if (!this.operations.has(operationId)) return;
+        if (this.state.phase === "connected") {
+          this.mux.sendControl({ type: "operation.progress", operationId, progress });
+        }
+      }, "progress"),
+      done: /* @__PURE__ */ __name((operationId, outcome) => {
+        if (!this.operations.delete(operationId)) return;
+        let done = { type: "operation.done", operationId };
+        if (outcome.error) done.error = outcome.error;
+        else done.result = outcome.result ?? null;
+        if (encodeFleetLinkControl(done) === null) {
+          done = {
+            type: "operation.done",
+            operationId,
+            error: makeFleetLinkError(
+              "operation_failed",
+              `the result was too large to send back (over ${Math.round(FLEET_LINK_MAX_JSON_BYTES / (1024 * 1024))} MiB)`
+            )
+          };
+        }
+        if (this.state.phase !== "connected" || !this.mux.sendControl(done)) this.keepResult(done);
+      }, "done")
+    };
+    this.mux = new ChannelMux({
+      modules: this.modules,
+      consents: options.consents,
+      control: this.control,
+      operations,
+      nodeVersion: options.nodeVersion,
+      nodeName: options.nodeName?.trim() || "this computer",
+      logger: options.logger
+    });
+    this.control.onChange(({ paused }) => this.patch({ paused }));
+  }
+  options;
+  static {
+    __name(this, "NodeLinkClient");
+  }
+  control = createLinkControlState();
+  modules;
+  scheduler;
+  now;
+  backoff;
+  mux;
+  listeners = /* @__PURE__ */ new Set();
+  operations = /* @__PURE__ */ new Map();
+  pendingResults = [];
+  limits = FLEET_LINK_DEFAULT_LIMITS;
+  started = false;
+  closed = false;
+  socket = null;
+  reconnectTimer = null;
+  tickTimer = null;
+  readyTimer = null;
+  resumeExpiry = null;
+  lastFrameAt = 0;
+  /** The generation to present on the next hello (the last one this node held). */
+  previousGeneration = null;
+  resumeChannels = [];
+  refusalLogged = false;
+  /** The single-use token of the attempt in flight, protected in the logger until the attempt ends. */
+  attemptToken = null;
+  dropLogged = false;
+  state = {
+    phase: "idle",
+    detail: null,
+    linkGeneration: null,
+    connectedSince: null,
+    lastDisconnectAt: null,
+    bytesIn: 0,
+    bytesOut: 0,
+    openChannels: 0,
+    paused: false,
+    nextAttemptInMs: null
+  };
+  getState() {
+    return { ...this.state, openChannels: this.mux.size };
+  }
+  onChange(listener) {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+  start() {
+    if (this.started || this.closed) return;
+    this.started = true;
+    if (!isFleetLinkEligible(this.options.consents)) {
+      this.patch({
+        phase: "not-open",
+        detail: "not open: this computer only reports health (start it with --work, --attend or --manage)"
+      });
+      this.options.logger?.info(
+        "Node link not opened: no --work, --attend or --manage consent \u2014 this computer only reports health."
+      );
+      return;
+    }
+    if (!isSecureLinkOrigin(this.options.apiUrl)) {
+      this.patch({ phase: "insecure", detail: "not open: the platform is reached over plain http" });
+      this.options.logger?.warn(
+        "Node link not opened: the platform is reached over plain http, and a link token is only sent over https (or to localhost)."
+      );
+      return;
+    }
+    if (!this.options.factory) {
+      this.patch({ phase: "unavailable", detail: "not open: this runtime has no WebSocket client" });
+      this.options.logger?.warn("Node link not opened: this runtime has no WebSocket client.");
+      return;
+    }
+    void this.connect();
+  }
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    this.clearTimer("reconnectTimer");
+    this.clearTimer("tickTimer");
+    this.clearTimer("readyTimer");
+    this.clearTimer("resumeExpiry");
+    this.mux.closeAll("normal");
+    const socket = this.socket;
+    this.socket = null;
+    this.mux.bind(null);
+    if (socket) {
+      this.detach(socket);
+      try {
+        socket.close(FLEET_LINK_CLOSE_CODES.normal, "node shutting down");
+      } catch {
+      }
+    }
+    this.forgetToken();
+    for (const operation of this.operations.values()) operation.cancel();
+    this.operations.clear();
+    this.patch({ phase: "closed", detail: null, nextAttemptInMs: null, linkGeneration: null });
+  }
+  // ─── Connecting ────────────────────────────────────────────────────────
+  async connect() {
+    if (this.closed) return;
+    this.patch({
+      phase: this.previousGeneration === null ? "connecting" : "reconnecting",
+      nextAttemptInMs: null
+    });
+    let minted;
+    try {
+      minted = await this.options.mintToken();
+    } catch (error) {
+      if (this.closed) return;
+      if (error instanceof FleetClientError && error.status === 404) {
+        this.refused();
+        return;
+      }
+      this.options.logger?.warn(`Node link: could not get a link token: ${describe4(error)}`);
+      this.scheduleReconnect(this.backoff.next());
+      return;
+    }
+    if (this.closed) return;
+    this.forgetToken();
+    this.attemptToken = minted.token;
+    this.options.logger?.protect(minted.token);
+    let capabilities;
+    try {
+      capabilities = [...await this.options.capabilities()].slice(0, MAX_HELLO_TAGS);
+    } catch {
+      capabilities = [];
+    }
+    if (this.closed) return;
+    let socket;
+    try {
+      socket = this.options.factory(toLinkWsUrl(this.options.apiUrl, minted.wsPath || FLEET_LINK_WS_PATH));
+    } catch (error) {
+      this.forgetToken();
+      this.options.logger?.warn(`Node link: could not open a socket: ${describe4(error)}`);
+      this.scheduleReconnect(this.backoff.next());
+      return;
+    }
+    this.socket = socket;
+    this.patch({ bytesIn: 0, bytesOut: 0 });
+    socket.onopen = () => {
+      if (this.socket !== socket) return;
+      const hello = {
+        type: "link.hello",
+        nodeId: this.options.nodeId,
+        linkVersion: FLEET_LINK_VERSION,
+        capabilities,
+        consents: { ...this.options.consents },
+        token: minted.token,
+        nodeVersion: this.options.nodeVersion
+      };
+      if (this.previousGeneration !== null) {
+        hello.resume = { linkGeneration: this.previousGeneration, channels: this.resumeChannels };
+      }
+      this.mux.bind((frame) => this.sendOn(socket, frame));
+      this.mux.sendControl(hello);
+      this.lastFrameAt = this.now();
+      this.clearTimer("readyTimer");
+      this.readyTimer = this.scheduler.setTimeout(() => {
+        this.readyTimer = null;
+        if (this.socket === socket && this.state.phase !== "connected") {
+          this.dropSocket(socket, FLEET_LINK_CLOSE_CODES.protocol, "no link.ready");
+        }
+      }, READY_TIMEOUT_MS);
+    };
+    socket.onmessage = (event) => {
+      if (this.socket === socket) this.onBytes(event.data);
+    };
+    socket.onerror = () => void 0;
+    socket.onclose = (event) => {
+      if (this.socket === socket) this.dropSocket(socket, linkCloseCode(event), null);
+    };
+  }
+  refused() {
+    this.patch({
+      phase: "refused",
+      detail: "refused by the platform: this deployment does not accept node links yet"
+    });
+    if (!this.refusalLogged) {
+      this.refusalLogged = true;
+      this.options.logger?.info("The platform does not accept node links yet \u2014 trying again in 5 minutes.");
+    }
+    this.scheduleReconnect(FLEET_LINK_REFUSED_RETRY_MS);
+  }
+  scheduleReconnect(delayMs) {
+    if (this.closed) return;
+    this.clearTimer("reconnectTimer");
+    this.patch({ nextAttemptInMs: delayMs });
+    this.reconnectTimer = this.scheduler.setTimeout(() => {
+      this.reconnectTimer = null;
+      void this.connect();
+    }, delayMs);
+  }
+  // ─── Receiving ─────────────────────────────────────────────────────────
+  onBytes(data) {
+    const bytes = linkMessageBytes(data);
+    if (!bytes) return;
+    this.lastFrameAt = this.now();
+    this.state.bytesIn += bytes.byteLength;
+    if (bytes.byteLength > FLEET_LINK_MAX_FRAME_BYTES) {
+      const channel = peekFleetLinkFrameChannel(bytes);
+      if (channel !== null && channel > 0) this.mux.closeLocal(channel, "invalid", "frame over 16 MiB");
+      return;
+    }
+    const frame = decodeFleetLinkFrame(bytes);
+    if (!frame) return;
+    if (frame.channel !== 0) {
+      if (this.state.phase === "connected") this.mux.deliver(frame);
+      return;
+    }
+    const message = decodeFleetLinkControl(frame.payload);
+    if (!message) return;
+    if (isFleetLinkControlMessage(message)) this.onControl(message);
+    else if (this.state.phase === "connected") this.onExtension(message);
+  }
+  onControl(message) {
+    if (this.state.phase !== "connected") {
+      if (message.type === "link.ready") this.onReady(message);
+      return;
+    }
+    switch (message.type) {
+      case "link.ping":
+        this.mux.sendControl({ type: "link.pong", t: message.t });
+        return;
+      case "link.pause":
+        if (!this.control.paused) {
+          this.options.logger?.warn("The fleet kill switch is on: live actions on this computer are paused.");
+        }
+        this.control.pause();
+        return;
+      case "link.resume":
+        if (this.control.paused)
+          this.options.logger?.info("The fleet kill switch was cleared: live actions resume.");
+        this.control.resume();
+        return;
+      case "link.drain":
+        this.options.logger?.warn(`Drain all: owner sessions on this computer end in ${message.graceSec} s.`);
+        this.control.startDrain(message, this.now());
+        return;
+      case "channel.open":
+        this.mux.open(message).catch((error) => {
+          this.options.logger?.warn(
+            `Node link: opening channel ${message.channel} failed: ${describe4(error)}`
+          );
+        });
+        return;
+      case "channel.close":
+        this.mux.closeRemote(message.channel, message.reason);
+        return;
+      case "operation.cancel":
+        this.operations.get(message.operationId)?.cancel();
+        return;
+      default:
+        return;
+    }
+  }
+  onReady(message) {
+    const socket = this.socket;
+    if (!socket) return;
+    this.clearTimer("readyTimer");
+    this.clearTimer("resumeExpiry");
+    this.forgetToken();
+    this.limits = message.limits;
+    this.previousGeneration = message.linkGeneration;
+    if (this.control.paused) {
+      this.control.resume();
+      this.options.logger?.info(
+        "Node link reconnected: the earlier pause is lifted unless the platform repeats it."
+      );
+    }
+    this.resumeChannels = [];
+    this.backoff.reset();
+    this.refusalLogged = false;
+    this.dropLogged = false;
+    this.patch({
+      phase: "connected",
+      detail: null,
+      linkGeneration: message.linkGeneration,
+      connectedSince: this.now(),
+      nextAttemptInMs: null
+    });
+    this.mux.resumeGeneration(message.resumed, message.closed);
+    this.options.logger?.info(
+      `Node link connected (generation ${message.linkGeneration}${message.resumed.length > 0 ? `, ${message.resumed.length} channel(s) resumed` : ""}).`
+    );
+    this.flushResults();
+    this.scheduleTick();
+  }
+  onExtension(message) {
+    const handler = this.modules.controlHandler(message.type);
+    if (!handler) return;
+    try {
+      handler(message, { consents: this.options.consents, control: this.control, logger: this.options.logger });
+    } catch (error) {
+      this.options.logger?.warn(`Node link: ${message.type} handler failed: ${describe4(error)}`);
+    }
+  }
+  // ─── Keeping it alive ──────────────────────────────────────────────────
+  scheduleTick() {
+    this.clearTimer("tickTimer");
+    this.tickTimer = this.scheduler.setTimeout(() => {
+      this.tickTimer = null;
+      this.tick();
+    }, this.limits.pingIntervalMs);
+  }
+  tick() {
+    const socket = this.socket;
+    if (!socket || this.state.phase !== "connected") return;
+    if (this.now() - this.lastFrameAt >= this.limits.silenceMs) {
+      this.options.logger?.warn(
+        `Node link: nothing heard for ${Math.round(this.limits.silenceMs / 1e3)} s \u2014 reconnecting.`
+      );
+      this.dropSocket(socket, FLEET_LINK_CLOSE_CODES.silence, "silence");
+      return;
+    }
+    this.mux.sendControl({ type: "link.ping", t: this.now() });
+    this.scheduleTick();
+  }
+  /**
+   * The socket is gone (closed by the platform, by silence, or by us). Run
+   * the drop once: suspend resumable channels, then decide whether and when
+   * to come back.
+   */
+  dropSocket(socket, code, reason) {
+    if (this.socket !== socket) return;
+    this.socket = null;
+    this.detach(socket);
+    this.forgetToken();
+    if (reason !== null) {
+      try {
+        socket.close(code ?? FLEET_LINK_CLOSE_CODES.normal, reason);
+      } catch {
+      }
+    }
+    this.clearTimer("tickTimer");
+    this.clearTimer("readyTimer");
+    const wasConnected = this.state.phase === "connected";
+    this.resumeChannels = this.mux.suspend();
+    this.patch({ linkGeneration: null, connectedSince: null, lastDisconnectAt: this.now() });
+    if (this.closed) return;
+    if (this.resumeChannels.length > 0) this.armResumeExpiry();
+    if (code === FLEET_LINK_CLOSE_CODES.disabled) {
+      this.refused();
+      return;
+    }
+    if (code === FLEET_LINK_CLOSE_CODES.noConsent) {
+      this.mux.closeAll("consent_missing");
+      this.patch({ phase: "not-open", detail: "refused by the platform: no consent that opens a link" });
+      this.options.logger?.warn("The platform refused the node link: no --work, --attend or --manage consent.");
+      return;
+    }
+    if (code === FLEET_LINK_CLOSE_CODES.replaced) {
+      this.options.logger?.warn("Node link replaced by a newer link for this node \u2014 is it running twice?");
+    }
+    const wait = code === FLEET_LINK_CLOSE_CODES.rateLimited ? Math.max(this.backoff.next(), FLEET_LINK_HELLO_BLOCK_MS) : this.backoff.next();
+    if (wasConnected && !this.dropLogged) {
+      this.dropLogged = true;
+      this.options.logger?.warn(
+        `Node link lost${code !== null ? ` (code ${code})` : ""} \u2014 reconnecting in ${Math.round(wait / 1e3)} s.`
+      );
+    }
+    this.patch({ phase: "reconnecting", detail: "reconnecting" });
+    this.scheduleReconnect(wait);
+  }
+  /** Channels held for a reconnect close `resume_failed` if none comes within the window. */
+  armResumeExpiry() {
+    this.clearTimer("resumeExpiry");
+    this.resumeExpiry = this.scheduler.setTimeout(() => {
+      this.resumeExpiry = null;
+      if (this.state.phase === "connected") return;
+      this.mux.closeAll("resume_failed");
+      this.resumeChannels = [];
+    }, FLEET_LINK_RESUME_WINDOW_MS);
+  }
+  // ─── Sending ───────────────────────────────────────────────────────────
+  sendOn(socket, frame) {
+    if (this.socket !== socket || socket.readyState !== LINK_SOCKET_OPEN) return false;
+    try {
+      socket.send(frame);
+    } catch {
+      return false;
+    }
+    this.state.bytesOut += frame.byteLength;
+    return true;
+  }
+  keepResult(done) {
+    this.pendingResults.push(done);
+    if (this.pendingResults.length > MAX_PENDING_OPERATION_RESULTS) this.pendingResults.shift();
+  }
+  flushResults() {
+    const pending = this.pendingResults;
+    this.pendingResults = [];
+    for (const done of pending) {
+      if (!this.mux.sendControl(done)) this.keepResult(done);
+    }
+  }
+  // ─── Plumbing ──────────────────────────────────────────────────────────
+  /** A link token is single-use: once its attempt ended it is dead, and need not stay in the redactor. */
+  forgetToken() {
+    if (this.attemptToken === null) return;
+    this.options.logger?.unprotect(this.attemptToken);
+    this.attemptToken = null;
+  }
+  detach(socket) {
+    socket.onopen = null;
+    socket.onmessage = null;
+    socket.onclose = null;
+    socket.onerror = null;
+    this.mux.bind(null);
+  }
+  clearTimer(name) {
+    const handle = this[name];
+    if (handle !== null) {
+      this.scheduler.clearTimeout(handle);
+      this[name] = null;
+    }
+  }
+  patch(next) {
+    this.state = { ...this.state, ...next };
+    const snapshot = this.getState();
+    for (const listener of [...this.listeners]) {
+      try {
+        listener(snapshot);
+      } catch {
+      }
+    }
+  }
+};
+function describe4(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+__name(describe4, "describe");
+
+// src/core/link/link-record.ts
+var PHASES = /* @__PURE__ */ new Set([
+  "idle",
+  "not-open",
+  "insecure",
+  "unavailable",
+  "connecting",
+  "connected",
+  "reconnecting",
+  "refused",
+  "closed"
+]);
+function nodeLinkRecordPath(configPath) {
+  return `${configPath}.link.json`;
+}
+__name(nodeLinkRecordPath, "nodeLinkRecordPath");
+function toNodeLinkRecord(consents, state, now) {
+  return {
+    version: 1,
+    recordedAt: new Date(now).toISOString(),
+    consents: { ...consents },
+    phase: state.phase,
+    detail: state.detail,
+    linkGeneration: state.linkGeneration,
+    connectedSince: state.connectedSince === null ? null : new Date(state.connectedSince).toISOString()
+  };
+}
+__name(toNodeLinkRecord, "toNodeLinkRecord");
+function parseNodeLinkRecord(raw) {
+  if (!raw) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const record = parsed;
+  const consents = normalizeFleetConsents(record.consents);
+  if (record.version !== 1 || typeof record.recordedAt !== "string" || !Number.isFinite(Date.parse(record.recordedAt)) || consents === null || typeof record.phase !== "string" || !PHASES.has(record.phase)) {
+    return null;
+  }
+  return {
+    version: 1,
+    recordedAt: record.recordedAt,
+    consents,
+    phase: record.phase,
+    detail: typeof record.detail === "string" ? record.detail.slice(0, 300) : null,
+    linkGeneration: typeof record.linkGeneration === "number" && Number.isSafeInteger(record.linkGeneration) ? record.linkGeneration : null,
+    connectedSince: typeof record.connectedSince === "string" && Number.isFinite(Date.parse(record.connectedSince)) ? record.connectedSince : null
+  };
+}
+__name(parseNodeLinkRecord, "parseNodeLinkRecord");
+async function readNodeLinkRecord(fs10, configPath) {
+  try {
+    return parseNodeLinkRecord(await fs10.readFile(nodeLinkRecordPath(configPath)));
+  } catch {
+    return null;
+  }
+}
+__name(readNodeLinkRecord, "readNodeLinkRecord");
+async function writeNodeLinkRecord(fs10, configPath, record) {
+  const path2 = nodeLinkRecordPath(configPath);
+  await fs10.mkdir(fs10.dirname(path2));
+  await fs10.writeFile(path2, `${JSON.stringify(record, null, 2)}
+`);
+}
+__name(writeNodeLinkRecord, "writeNodeLinkRecord");
+function describeConsents(consents) {
+  const on = ["work", "attend", "manage", "usageScan"].filter((key) => consents[key]).map((key) => key === "usageScan" ? "usage-scan" : key);
+  return on.length > 0 ? on.join(" \xB7 ") : "none (enrolled only \u2014 reports health)";
+}
+__name(describeConsents, "describeConsents");
+function describeLinkRecord(record, now) {
+  if (!record) return "unknown (the service has not reported its link yet)";
+  const age = Math.max(0, Math.round((now - Date.parse(record.recordedAt)) / 1e3));
+  const heard = `as of ${record.recordedAt}${age > 120 ? ` (${age}s ago)` : ""}`;
+  switch (record.phase) {
+    case "connected":
+      return `connected since ${record.connectedSince ?? record.recordedAt} (generation ${record.linkGeneration ?? "?"}) \u2014 ${heard}`;
+    case "reconnecting":
+    case "connecting":
+      return `${record.phase}\u2026 \u2014 ${heard}`;
+    default:
+      return `${record.detail ?? record.phase} \u2014 ${heard}`;
+  }
+}
+__name(describeLinkRecord, "describeLinkRecord");
+
+// src/core/runtime.ts
+function buildSelfDescriptionTelemetry(io, cliCompat) {
+  const pinned = /* @__PURE__ */ __name(() => io.environment.modelCli ?? {}, "pinned");
+  const telemetry = {
+    cliVersion: cliCompat ? async () => primaryPinnedCliVersion(await cliCompat.probeAll(pinned())) ?? detectAgentCliVersion(io.runner) : () => detectAgentCliVersion(io.runner),
+    modelIdentity: cacheProbe(() => detectModelIdentity(io.runner, io.environment.modelCli ?? {}))
+  };
+  if (cliCompat) {
+    telemetry.cliVersions = async () => describeCliVersions(await cliCompat.probeAll(pinned()));
+  }
+  if (io.diskProbe) {
+    const probe = io.diskProbe;
+    const path2 = io.workspacePath ?? process.cwd();
+    telemetry.diskFreeBytes = () => measureWorkspaceFreeBytes(probe, path2);
+  }
+  return telemetry;
+}
+__name(buildSelfDescriptionTelemetry, "buildSelfDescriptionTelemetry");
+function clampHeartbeatInterval(intervalMs) {
+  if (typeof intervalMs !== "number" || !Number.isFinite(intervalMs)) {
+    return DEFAULT_HEARTBEAT_INTERVAL_MS;
+  }
+  return Math.min(Math.max(Math.round(intervalMs), MIN_HEARTBEAT_INTERVAL_MS), MAX_HEARTBEAT_INTERVAL_MS);
+}
+__name(clampHeartbeatInterval, "clampHeartbeatInterval");
+async function enrollNode(options) {
+  const { logger } = options;
+  logger.protect(options.token);
+  const client = new FleetClient({
+    apiUrl: options.apiUrl,
+    fetchFn: options.fetchFn,
+    logger,
+    userAgent: options.userAgent ?? `ever-works-node/${options.version}`
+  });
+  const description = await describeSelf(
+    options.runner,
+    options.environment,
+    options.version,
+    options.capabilitySelection ?? null,
+    // Deliberately WITHOUT the pinned-CLI compat probe (review, slice AR):
+    // that probe adds `cliVersions`, an optional field an older platform's
+    // `forbidNonWhitelisted` pipe answers with a 400 — and enrollment, unlike
+    // the heartbeat, has no strip-and-retry fallback, so a new node could
+    // never enroll against it. The first heartbeat reports the pinned
+    // versions, behind the heartbeat's own fallback.
+    buildSelfDescriptionTelemetry(options)
+  );
+  logger.info(`Enrolling with ${client.baseUrl} as ${description.platform} [${description.capabilities.join(", ")}]`);
+  const result = await client.enroll({ token: options.token, ...description });
+  logger.protect(result.secret);
+  const limits = clampResourceLimits(options.limits);
+  const config = {
+    apiUrl: client.baseUrl,
+    nodeId: result.nodeId,
+    secret: result.secret,
+    kind: options.kind,
+    capabilities: description.capabilities,
+    limits,
+    heartbeatIntervalMs: clampHeartbeatInterval(options.heartbeatIntervalMs),
+    enrolledAt: new Date(options.now ? options.now() : Date.now()).toISOString()
+  };
+  if (options.capabilitySelection) {
+    config.capabilitySelection = [...options.capabilitySelection];
+  }
+  const label = options.name?.trim() || result.node.name;
+  if (label) {
+    config.name = label;
+  }
+  logger.info(
+    `Enrolled as node ${result.nodeId} ("${config.name ?? "unnamed"}") \u2014 max ${limits.maxConcurrentJobs} concurrent job(s)`
+  );
+  return config;
+}
+__name(enrollNode, "enrollNode");
+function createNodeRuntime(config, io, options = {}) {
+  io.logger.protect(config.secret);
+  const userAgent = io.userAgent ?? `ever-works-node/${io.version}`;
+  const apiBase = resolveApiBase(config, options.env ?? process.env);
+  io.logger.info(`Control plane: ${describeApiBase(apiBase)}`);
+  if (apiBase.mismatch) {
+    io.logger.warn(
+      `The pinned control plane (${apiBase.url}) is not the origin this node enrolled against (${apiBase.configuredUrl}). Every call will be refused with 401 until the pin is corrected or the node is re-enrolled.`
+    );
+  }
+  const client = new FleetClient({
+    apiUrl: apiBase.url,
+    fetchFn: io.fetchFn,
+    logger: io.logger,
+    userAgent
+  });
+  const selection = config.capabilitySelection ?? null;
+  const workspaceRoot = options.agentTaskWorkspaceRoot ?? defaultFleetTaskWorkspaceRoot();
+  const executionPolicy = resolveNodeExecutionPolicy(config.executionPolicy);
+  const cliCompat = new ModelCliCompatibilityProbe({
+    runner: io.runner,
+    platform: io.environment.platform,
+    ...io.statFile ? { statFile: io.statFile } : {},
+    ...io.now ? { now: io.now } : {}
+  });
+  const pinnedModelCli = options.modelCli ?? io.environment.modelCli ?? {};
+  const telemetry = buildSelfDescriptionTelemetry(
+    {
+      ...io,
+      workspacePath: io.workspacePath ?? workspaceRoot,
       environment: { ...io.environment, modelCli: pinnedModelCli }
     },
     cliCompat
   );
+  let loopRef = null;
+  if (io.health) {
+    const probeHealth = createHealthProbe(io.health, {
+      workspacePath: io.workspacePath ?? workspaceRoot,
+      ...io.now ? { now: io.now } : {}
+    });
+    telemetry.health = () => loopRef && !loopRef.acceptsField("health") ? null : probeHealth();
+  }
   const attendedCapture = options.attendEnabled ? selectAttendedCapture(io.environment, options) : null;
-  const environment = attendedCapture ? {
+  const consents = {
+    work: options.workerEnabled === true,
+    attend: attendedCapture !== null,
+    manage: options.manageEnabled === true,
+    usageScan: false
+  };
+  const linkModules = composeNodeLinkModules({
+    ...options.linkModules ? { extra: options.linkModules } : {},
+    ...io.scheduler ? {
+      setTimer: /* @__PURE__ */ __name((callback, ms) => io.scheduler.setTimeout(callback, ms), "setTimer"),
+      clearTimer: /* @__PURE__ */ __name((handle) => io.scheduler.clearTimeout(handle), "clearTimer")
+    } : {}
+  });
+  const linkModuleTags = linkModules.tags({ consents, platform: io.environment.platform, nodeVersion: io.version });
+  const environment = {
     ...io.environment,
-    attended: true,
-    captureBackends: attendedCapture.captureBackend ? [attendedCapture.captureBackend] : []
-  } : io.environment;
+    ...attendedCapture ? {
+      attended: true,
+      captureBackends: attendedCapture.captureBackend ? [attendedCapture.captureBackend] : []
+    } : {},
+    ...consents.manage ? { managed: true } : {},
+    ...linkModuleTags.length > 0 ? { linkModuleTags } : {}
+  };
+  telemetry.consents = () => consents;
+  let lastDescribedCapabilities = [];
+  let startLink = null;
   let attendedWake = null;
   const holdableLanes = [];
   let limitTarget = null;
@@ -22183,7 +24871,11 @@ function createNodeRuntime(config, io, options = {}) {
     // Re-probed on EVERY beat, like the capability tags: installing an
     // agent CLI or filling a disk is exactly the kind of change an
     // operator needs to see without restarting the node.
-    describe: /* @__PURE__ */ __name(() => describeSelf(io.runner, environment, io.version, selection, telemetry), "describe"),
+    describe: /* @__PURE__ */ __name(async () => {
+      const description = await describeSelf(io.runner, environment, io.version, selection, telemetry);
+      lastDescribedCapabilities = description.capabilities;
+      return description;
+    }, "describe"),
     intervalMs: clampHeartbeatInterval(config.heartbeatIntervalMs),
     logger: io.logger,
     ...io.scheduler ? { scheduler: io.scheduler } : {},
@@ -22192,9 +24884,12 @@ function createNodeRuntime(config, io, options = {}) {
       attendedWake?.(response.pendingComputerSessions);
       lifecycle.applyHeartbeat(response);
       throttleTarget?.(response.node?.modelThrottles);
+      startLink?.();
     }, "onAccepted")
   };
-  const runtime = { client, loop: new HeartbeatLoop(loopOptions), lifecycle, cliCompat };
+  const loop = new HeartbeatLoop(loopOptions);
+  loopRef = loop;
+  const runtime = { client, loop, lifecycle, cliCompat, consents };
   let sharedJobClient = null;
   const jobClientFor = /* @__PURE__ */ __name(() => sharedJobClient ??= new FleetJobClient({
     apiUrl: apiBase.url,
@@ -22204,6 +24899,46 @@ function createNodeRuntime(config, io, options = {}) {
     logger: io.logger,
     userAgent
   }), "jobClientFor");
+  if (options.nodeLink) {
+    const link = createNodeLink({
+      apiUrl: apiBase.url,
+      nodeId: config.nodeId,
+      ...config.name ? { nodeName: config.name } : {},
+      nodeVersion: io.version,
+      consents,
+      capabilities: /* @__PURE__ */ __name(() => lastDescribedCapabilities, "capabilities"),
+      mintToken: /* @__PURE__ */ __name(() => jobClientFor().mintLinkToken(), "mintToken"),
+      factory: options.linkSocketFactory === void 0 ? defaultLinkSocketFactory() : options.linkSocketFactory,
+      modules: linkModules,
+      logger: io.logger,
+      ...io.scheduler ? { scheduler: io.scheduler } : {},
+      ...io.now ? { now: io.now } : {}
+    });
+    runtime.link = link;
+    let predatesLogged = false;
+    startLink = /* @__PURE__ */ __name(() => {
+      if (runtime.loop.acceptsField("consents")) {
+        link.start();
+      } else if (!predatesLogged) {
+        predatesLogged = true;
+        io.logger.warn("Node link not opened: the platform predates consents in the heartbeat.");
+      }
+    }, "startLink");
+    if (options.persistLinkState) {
+      const persist = options.persistLinkState;
+      let lastKey = "";
+      link.onChange((state) => {
+        const key = `${state.phase}|${state.linkGeneration ?? ""}|${state.detail ?? ""}`;
+        if (key === lastKey) return;
+        lastKey = key;
+        void Promise.resolve().then(() => persist(toNodeLinkRecord(consents, state, io.now ? io.now() : Date.now()))).catch(
+          (error) => io.logger.warn(
+            `Could not record the node link state: ${error instanceof Error ? error.message : String(error)}`
+          )
+        );
+      });
+    }
+  }
   if (options.workerEnabled) {
     const jobClient = jobClientFor();
     const limits = clampResourceLimits(
@@ -22231,9 +24966,18 @@ function createNodeRuntime(config, io, options = {}) {
       ...io.monotonicNow ? { monotonicNow: io.monotonicNow } : {},
       // Agent computers: on an attended machine, live views belong to the
       // attended lane alone — never parked in (or holding a slot of) the
-      // work lane. Sent only under `--attend`, so a work-only node's lease
-      // body is exactly what it always was.
-      ...options.attendEnabled ? { excludeKinds: ["computer-session"] } : {},
+      // work lane (only under `--attend`).
+      //
+      // Control 18: a machine whose owner has not allowed node-run shell
+      // commands does not lease `acceptance-checks` jobs at all (every one
+      // is a shell command in a directory the platform names), so they
+      // stay with a node that will run them instead of failing here.
+      ...(() => {
+        const excluded = [];
+        if (options.attendEnabled) excluded.push("computer-session");
+        if (!executionPolicy.allowShellCommands) excluded.push("acceptance-checks");
+        return excluded.length > 0 ? { excludeKinds: excluded } : {};
+      })(),
       // Fleet usage limits: the CLIs an agent-task can run with here, so a
       // node whose only CLI is out of quota stops leasing agent-task work
       // until the reset (other kinds keep leasing).
@@ -22264,7 +25008,13 @@ function createNodeRuntime(config, io, options = {}) {
       ...io.diskProbe ? { diskProbe: io.diskProbe } : {},
       minFreeDiskBytes: effectiveMinFreeDiskBytes(limits)
     });
-    worker.register("acceptance-checks", (job, signal) => runAcceptanceChecksJob(job, {}, signal));
+    worker.register(
+      "acceptance-checks",
+      (job, signal) => (
+        // Control 18: refused here too, should one arrive despite the lease filter.
+        runAcceptanceChecksJob(job, { executionPolicy }, signal)
+      )
+    );
     const modelCli = options.modelCli ?? io.environment.modelCli ?? {};
     worker.register("agent-task", async (job, signal, lease) => {
       const pushCredentials = lease ? new PushCredentialSession({
@@ -22371,6 +25121,11 @@ function createNodeRuntime(config, io, options = {}) {
             // read from the wire: a job cannot talk a node into
             // believing it is another one.
             nodeId: config.nodeId,
+            // Control 18 — the machine owner's local execution policy,
+            // from the LOCAL config only (OFF/OFF unless the owner ran
+            // `ever-works-node policy`). Always passed: an executor that
+            // gets no policy enforces none.
+            executionPolicy,
             // Self-build slice Z (EW-796) — the platform side of the
             // MCP bridge, wired through the SAME authenticated job
             // client the lease protocol uses. No new endpoint, no new
@@ -22535,7 +25290,7 @@ function installShutdownHandlers(signals, shutdown) {
 __name(installShutdownHandlers, "installShutdownHandlers");
 
 // src/core/worker-safety-store.ts
-var import_node_crypto3 = require("node:crypto");
+var import_node_crypto4 = require("node:crypto");
 var MARKER_VERSION = 1;
 var WorkerSafetyPrerequisiteError = class extends Error {
   static {
@@ -22553,7 +25308,7 @@ __name(workerSafetyMarkerPath, "workerSafetyMarkerPath");
 function createConfigWorkerSafetyGate(fs10, configPath, options = {}) {
   const markerPath = workerSafetyMarkerPath(configPath);
   const now = options.now ?? (() => Date.now());
-  const createSessionId = options.createSessionId ?? import_node_crypto3.randomUUID;
+  const createSessionId = options.createSessionId ?? import_node_crypto4.randomUUID;
   const readRaw = /* @__PURE__ */ __name(async () => {
     try {
       return await fs10.readFile(markerPath);
@@ -22664,7 +25419,7 @@ function detail(error) {
 __name(detail, "detail");
 
 // src/core/workspaces/workspace-inventory.ts
-var import_node_crypto4 = require("node:crypto");
+var import_node_crypto5 = require("node:crypto");
 var import_node_fs5 = require("node:fs");
 var import_node_path5 = require("node:path");
 var FLEET_WORKSPACE_STAMP_FILE = "ew-workspace.json";
@@ -23091,7 +25846,7 @@ async function readStamp(gitDir) {
 }
 __name(readStamp, "readStamp");
 function intentPath(poolPath, bindingKey) {
-  const key = (0, import_node_crypto4.createHash)("sha256").update("workspace-intent-v1\0").update(bindingKey).digest("hex");
+  const key = (0, import_node_crypto5.createHash)("sha256").update("workspace-intent-v1\0").update(bindingKey).digest("hex");
   return (0, import_node_path5.join)(poolPath, FLEET_WORKSPACE_INTENTS_DIR, `${key}.json`);
 }
 __name(intentPath, "intentPath");
@@ -23842,6 +26597,7 @@ async function runStart(deps, options) {
   };
   const workerEnabled = options.work === true;
   const attendEnabled = options.attend === true;
+  const manageEnabled = options.manage === true;
   const startPaused = config.paused === true;
   const concurrency = parseConcurrency(options.concurrency);
   const limitOverrides = parseLimitFlags(options);
@@ -23879,22 +26635,37 @@ async function runStart(deps, options) {
     // Written directly (not via a conditional spread) so excess-property
     // checking keeps this name tied to the runtime option it feeds.
     agentTaskWorkspaceRoot: workspaceRoot,
-    persistUnsafe: /* @__PURE__ */ __name(async (unsafe) => saveConfig(
-      deps.fs,
-      deps.configPath,
-      { ...config, unsafe },
-      {
-        platform: deps.platform,
+    // Re-read before writing: the file may have changed since this service
+    // started (`ever-works-node policy` run meanwhile), and a quarantine must
+    // record `unsafe` without reverting anything else in it.
+    persistUnsafe: /* @__PURE__ */ __name(async (unsafe) => {
+      const current = await loadConfig(deps.fs, deps.configPath, {
         secrets: deps.secrets ?? null,
         logger: deps.io.logger
-      }
-    ), "persistUnsafe"),
+      }).catch(() => null) ?? config;
+      await saveConfig(
+        deps.fs,
+        deps.configPath,
+        { ...current, unsafe },
+        {
+          platform: deps.platform,
+          secrets: deps.secrets ?? null,
+          logger: deps.io.logger
+        }
+      );
+    }, "persistUnsafe"),
     workerSafetyGate: createConfigWorkerSafetyGate(deps.fs, deps.configPath, { platform: deps.platform }),
     // Node lifecycle (slice AR): what the platform last said about this
     // daemon's version, recorded beside the config for `status`/`doctor`.
     persistLifecycle: /* @__PURE__ */ __name((record) => writeNodeLifecycleRecord(deps.fs, deps.configPath, record), "persistLifecycle"),
     ...deps.resourceProbe ? { resourceProbe: deps.resourceProbe } : {},
-    attendEnabled
+    attendEnabled,
+    // Fleet node link (FL-02): the fourth consent, and the link itself. The
+    // link opens on the first accepted heartbeat when any of --work,
+    // --attend, --manage is on; its state is recorded for `status`.
+    manageEnabled,
+    nodeLink: true,
+    persistLinkState: /* @__PURE__ */ __name((record) => writeNodeLinkRecord(deps.fs, deps.configPath, record), "persistLinkState")
   });
   if (workerEnabled) {
     void logModelCliCompatibility(deps, runtime.cliCompat, modelCli.paths);
@@ -23998,9 +26769,13 @@ async function runStart(deps, options) {
   if (!worker) {
     deps.out("Worker host disabled \u2014 reporting liveness only (pass --work to execute platform work)");
   }
+  deps.out(
+    isFleetLinkEligible(runtime.consents) ? `Consents \u2014 ${describeConsents(runtime.consents)}; the node link opens after the first accepted heartbeat` : "Consents \u2014 none: the node link stays closed and this computer only reports health (pass --work, --attend or --manage)"
+  );
   await (deps.waitForShutdown?.() ?? (deps.signals ? signalled : Promise.resolve()));
   reaper?.stop();
   shuttingDown = true;
+  runtime.link?.close();
   loop.stop();
   await loop.settled();
   await lanesStarted;
@@ -24048,6 +26823,61 @@ function parseConcurrency(raw) {
   return parsed;
 }
 __name(parseConcurrency, "parseConcurrency");
+function describeExecutionPolicy(policy) {
+  return `skip-permissions ${policy.allowSkipPermissions ? "ALLOWED" : "refused"}, node-run shell commands ${policy.allowShellCommands ? "ALLOWED" : "refused"}, Claude Code restricted mode ${policy.restrictedMode ? "on" : "OFF"}`;
+}
+__name(describeExecutionPolicy, "describeExecutionPolicy");
+function parsePolicySwitch(flag, value) {
+  if (value === void 0) return void 0;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "on" || normalized === "true" || normalized === "yes") return true;
+  if (normalized === "off" || normalized === "false" || normalized === "no") return false;
+  throw new CliError(`${flag} takes 'on' or 'off', not '${value}'`);
+}
+__name(parsePolicySwitch, "parsePolicySwitch");
+async function runPolicy(deps, options) {
+  const config = await requireConfig(deps);
+  const current = resolveNodeExecutionPolicy(config.executionPolicy);
+  const skip = parsePolicySwitch("--allow-skip-permissions", options.allowSkipPermissions);
+  const shell = parsePolicySwitch("--allow-shell-commands", options.allowShellCommands);
+  const restricted = parsePolicySwitch("--restricted-mode", options.restrictedMode);
+  if (skip === void 0 && shell === void 0 && restricted === void 0) {
+    deps.out(`policy       ${describeExecutionPolicy(current)}`);
+    deps.out(
+      "Change it with `ever-works-node policy --allow-skip-permissions on|off --allow-shell-commands on|off --restricted-mode on|off`."
+    );
+    return;
+  }
+  const next = {
+    allowSkipPermissions: skip ?? current.allowSkipPermissions,
+    allowShellCommands: shell ?? current.allowShellCommands,
+    restrictedMode: restricted ?? current.restrictedMode
+  };
+  await saveConfig(
+    deps.fs,
+    deps.configPath,
+    { ...config, executionPolicy: next },
+    { platform: deps.platform, secrets: deps.secrets ?? null, logger: deps.io.logger }
+  );
+  deps.out(`policy       ${describeExecutionPolicy(next)}`);
+  if (next.allowSkipPermissions) {
+    deps.out(
+      "WARNING: jobs may now run the model CLI with its permission checks OFF. A prompt injection in a Task, a repository or a review comment then has an unrestricted shell as this account, with no filesystem or network boundary."
+    );
+  }
+  if (next.allowShellCommands) {
+    deps.out(
+      "WARNING: jobs may now make this node run shell commands (setup, acceptance checks). They execute repository code as this account \u2014 after a model step, code the model may have written."
+    );
+  }
+  if (!next.restrictedMode) {
+    deps.out(
+      "Note: Claude Code restricted mode is OFF \u2014 runs keep the baseline isolation (no repository settings, no hooks) but get the command-running built-ins back and read your ~/.claude/settings.json."
+    );
+  }
+  deps.out("Restart the node service for a running worker to apply the change.");
+}
+__name(runPolicy, "runPolicy");
 async function runPause(deps, paused, options = {}) {
   const config = await requireConfig(deps);
   const verb = paused ? "Paused" : "Resumed";
@@ -24195,12 +27025,18 @@ async function runStatus(deps) {
   deps.out(`work         ${view.paused ? "PAUSED (draining \u2014 no new work)" : "accepting new work"}`);
   const lifecycleRecord = await readNodeLifecycleRecord(deps.fs, deps.configPath);
   deps.out(`daemon       ${describeDaemonLifecycle(deps, lifecycleRecord)}`);
+  const linkRecord = await readNodeLinkRecord(deps.fs, deps.configPath);
+  deps.out(
+    `consents     ${linkRecord ? describeConsents(linkRecord.consents) : "unknown (the service has not reported them yet)"}`
+  );
+  deps.out(`link         ${describeLinkRecord(linkRecord, (deps.now ?? (() => Date.now()))())}`);
   deps.out(
     `offering     ${view.capabilitySelection ? view.capabilitySelection.join(", ") || "(identity only)" : "(everything detected)"}`
   );
   deps.out(`limits       ${describeLimits(view.limits)}`);
   deps.out(`ceiling      ${describePlatformCeiling(lifecycleRecord, view.limits)}`);
   deps.out(`workspace gc ${describeWorkspaceGc(view.workspaceGc ?? DEFAULT_WORKSPACE_GC_POLICY)}`);
+  deps.out(`policy       ${describeExecutionPolicy(view.executionPolicy)}`);
   deps.out(`credential   ${view.hasSecret ? "stored" : "MISSING"}`);
   deps.out(`config       ${deps.configPath}`);
 }
@@ -24407,6 +27243,11 @@ function describeModelCli(compat) {
   if (compat.missingConditionalFlags.length > 0) {
     notes.push(`runs that need ${compat.missingConditionalFlags.join(", ")} will fail here`);
   }
+  if ((compat.missingHardeningFlags ?? []).length > 0) {
+    notes.push(
+      `runs go without the stricter ${compat.missingHardeningFlags.join(", ")} mode (upgrade the CLI to get it)`
+    );
+  }
   return `${head} \u2014 compatible${notes.length > 0 ? `; ${notes.join("; ")}` : ""}`;
 }
 __name(describeModelCli, "describeModelCli");
@@ -24474,6 +27315,7 @@ function lifecycleJson(deps, report) {
       missingRequiredFlags: compat.missingRequiredFlags,
       missingConditionalFlags: compat.missingConditionalFlags,
       unsupportedOptionalFlags: compat.unsupportedOptionalFlags,
+      missingHardeningFlags: compat.missingHardeningFlags ?? [],
       note: compat.note
     }))
   };
@@ -24502,6 +27344,11 @@ async function runDoctor(deps, options) {
   }
   printHousekeepingHeader(deps, report, now);
   printLifecycle(deps, lifecycle);
+  const linkRecord = await readNodeLinkRecord(deps.fs, deps.configPath);
+  deps.out(
+    `consents     ${linkRecord ? describeConsents(linkRecord.consents) : "unknown (the service has not reported them yet)"}`
+  );
+  deps.out(`link         ${describeLinkRecord(linkRecord, now)}`);
   printPlan(deps, report.plan, now);
 }
 __name(runDoctor, "runDoctor");
@@ -24588,6 +27435,9 @@ function buildProgram(deps) {
   program2.command("start").description("Run the heartbeat loop (and, with --work, the job worker host) until SIGINT/SIGTERM").option("-i, --heartbeat-interval <seconds>", "Override the stored heartbeat cadence, in seconds").option("-w, --work", "Lease and execute platform work on this machine (off by default)").option(
     "--attend",
     "Allow live viewing of this machine from the dashboard (off by default; independent of --work)"
+  ).option(
+    "--manage",
+    "Allow managing this machine from the dashboard \u2014 owner sessions, logs, services, Docker, processes, ports, files, commands, schedules (off by default; independent of --work and --attend)"
   ).option(
     "-c, --concurrency <count>",
     "Max jobs to execute at once when --work is set (overrides the stored limit)"
@@ -24612,6 +27462,20 @@ function buildProgram(deps) {
   program2.command("resume").description("Take work again after a pause").option("--local-only", "Only clear the local flag; do not tell the platform").action(async (options) => {
     await runPause(deps, false, options);
   });
+  program2.command("policy").description(
+    "Show or change what platform jobs may make this machine do (local only; the platform cannot change it)"
+  ).option(
+    "--allow-skip-permissions <on|off>",
+    "Let jobs run the model CLI with its permission checks off (--dangerously-skip-permissions). Default off."
+  ).option(
+    "--allow-shell-commands <on|off>",
+    "Let jobs make this node run shell commands: setup, command steps, acceptance checks. Default off."
+  ).option(
+    "--restricted-mode <on|off>",
+    "Run Claude Code with --restricted when it supports it (no shell tools, no settings files). Default on."
+  ).action(async (options) => {
+    await runPolicy(deps, options);
+  });
   program2.command("clear-quarantine").description("Clear a persisted unsafe worker state after verifying every prior process tree is stopped").option(
     "--confirm-process-tree-stopped",
     "Assert that the prior Git/command process tree has been independently verified stopped"
@@ -24705,15 +27569,16 @@ function createLogger(options = {}) {
 __name(createLogger, "createLogger");
 
 // src/version.ts
-var NODE_APP_VERSION = "0.2.5";
+var NODE_APP_VERSION = "0.2.6";
 
 // src/cli.ts
 function buildDeps() {
   const logger = createLogger();
+  const runner = createCommandRunner();
   return {
     io: {
       fetchFn: systemFetch,
-      runner: createCommandRunner(),
+      runner,
       environment: currentEnvironment(),
       logger,
       version: NODE_APP_VERSION,
@@ -24724,7 +27589,9 @@ function buildDeps() {
       diskProbe: createDiskProbe(),
       // Node lifecycle (slice AR): the cache key of the model-CLI
       // compatibility probe, so an upgraded CLI is re-probed at once.
-      statFile: statModelCliFile
+      statFile: statModelCliFile,
+      // Computer health (FL-03): the snapshot every heartbeat carries.
+      health: createHealthProbeIo(runner)
     },
     fs: createConfigFileSystem(),
     configPath: defaultConfigPath(),