infinicode 2.8.58 → 2.8.60

package/dist/kernel/federation/dashboard-html.js

@@ -5530,6 +5530,10 @@ button.act:disabled{opacity:0.5;cursor:default;}
       if(greetings && document.activeElement!==greetings) greetings.value=(device.greeting_phrases||[]).join(String.fromCharCode(10));
       var note=$('pk-device-note');
       if(note){
+        if(!device.id && n && n.connected){
+          note.textContent='mesh connected; scheduler identity is bootstrapping or failed';
+          return;
+        }
         var source=inv.source||'robot heartbeat', counts=(inv.video||[]).length+'/'+(inv.audio_input||[]).length+'/'+(inv.audio_output||[]).length;
         note.textContent=hasRealInventory(inv) ? ('inventory from '+source+' · camera/mic/speaker '+counts) : (device.id ? 'no real hardware inventory reported yet · restart vision-agent + preview-agent on this robot' : 'waiting for robot heartbeat inventory');
       }

package/dist/kernel/federation/transport-http.d.ts

@@ -63,6 +63,10 @@ export declare class MeshServer {
      *  (browsers, which can't set headers on navigation or EventSource). */
     private presentedToken;
     private authOk;
+    /** A robot uses this header only when it talks to the hub's scheduler proxy.
+     * Its device token remains the Authorization header and is forwarded to the
+     * scheduler. Requiring both keeps arbitrary Tailnet callers out. */
+    private schedulerProxyAuthOk;
     private handle;
     private openStream;
     private readBody;

package/dist/kernel/federation/transport-http.js

@@ -106,8 +106,24 @@ export class MeshServer {
         this.readBody(req)
             .then(async (body) => {
             const headers = { 'content-type': req.headers['content-type'] ?? 'application/json' };
+            const meshProxyToken = req.headers['x-robopark-mesh-token'];
+            if (typeof meshProxyToken === 'string') {
+                // The scheduler uses this only for device bootstrap. The mesh server
+                // has already validated it before this proxy method is reached.
+                headers['x-robopark-mesh-token'] = meshProxyToken;
+            }
             if (this.opts.schedulerToken)
                 headers['authorization'] = `Bearer ${this.opts.schedulerToken}`;
+            else {
+                const inbound = req.headers.authorization;
+                const presented = this.presentedToken(req);
+                const isMeshToken = this.opts.token && presented && safeEqual(presented, this.opts.token);
+                // Robot device tokens must reach the scheduler unchanged. Mesh tokens
+                // authenticate the proxy itself and are not scheduler credentials.
+                if (!isMeshToken && typeof inbound === 'string' && inbound.startsWith('Bearer ')) {
+                    headers.authorization = inbound;
+                }
+            }
             const upstream = await fetch(target, {
                 method: req.method,
                 headers,
@@ -250,6 +266,15 @@ export class MeshServer {
         const presented = this.presentedToken(req);
         return presented !== undefined && safeEqual(presented, this.opts.token);
     }
+    /** A robot uses this header only when it talks to the hub's scheduler proxy.
+     * Its device token remains the Authorization header and is forwarded to the
+     * scheduler. Requiring both keeps arbitrary Tailnet callers out. */
+    schedulerProxyAuthOk(req, path) {
+        if (!path.startsWith('/robopark/api/') || !this.opts.token)
+            return false;
+        const presented = req.headers['x-robopark-mesh-token'];
+        return typeof presented === 'string' && safeEqual(presented, this.opts.token);
+    }
     handle(req, res) {
         const url = req.url ?? '/';
         const path = url.split('?', 1)[0];
@@ -257,7 +282,7 @@ export class MeshServer {
             res.writeHead(204).end();
             return;
         }
-        if (!this.authOk(req)) {
+        if (!this.authOk(req) && !this.schedulerProxyAuthOk(req, path)) {
             res.writeHead(401).end('unauthorized');
             return;
         }

package/dist/robopark/auto-start.js

@@ -73,7 +73,7 @@ Wants=network-online.target
 [Service]
 Type=simple
 ExecStart=${service.command} ${service.args.map(shellQuote).join(' ')}
-WorkingDirectory=${service.workingDir ?? '/opt/robopark'}
+WorkingDirectory=${service.workingDir ?? homedir()}
 Restart=always
 RestartSec=5
 ${envLines}
@@ -83,7 +83,15 @@ WantedBy=multi-user.target
 `;
     try {
         writeFileSync(unitPath, unit, 'utf8');
-        return { ok: true, message: `wrote systemd unit ${unitPath}. Run: systemctl enable --now ${unitName}` };
+        const reload = spawnSync('systemctl', ['daemon-reload'], { encoding: 'utf8' });
+        if (reload.status !== 0) {
+            return { ok: false, message: `wrote ${unitPath}, but systemctl daemon-reload failed: ${reload.stderr || reload.stdout}` };
+        }
+        const enabled = spawnSync('systemctl', ['enable', '--now', unitName], { encoding: 'utf8' });
+        if (enabled.status !== 0) {
+            return { ok: false, message: `wrote ${unitPath}, but systemctl enable --now failed: ${enabled.stderr || enabled.stdout}` };
+        }
+        return { ok: true, message: `enabled and started systemd unit ${unitName}` };
     }
     catch (e) {
         return { ok: false, message: `could not write ${unitPath}: ${e instanceof Error ? e.message : String(e)}` };

package/dist/robopark/robot-runtime.js

@@ -101,11 +101,27 @@ export async function roboparkRobotRuntime(opts) {
         '--scheduler-url', opts.schedulerUrl, '--robot-id', opts.name,
         '--video-device', opts.videoDevice ?? 'auto', '--audio-device', opts.audioDevice ?? 'default',
         '--save-config'];
-    if (opts.vision !== false)
-        previewArgs.push('--robovision-url', 'http://127.0.0.1:5000');
     if (opts.enrollmentToken)
         previewArgs.push('--enrollment-token', opts.enrollmentToken);
-    const preview = { label: 'preview', command: process.execPath, args: previewArgs };
+    const preview = {
+        label: 'preview',
+        command: process.execPath,
+        args: previewArgs,
+        // Tailscale scheduler access goes through the authenticated hub proxy.
+        // Keep this in the child environment, never in the persisted robot config.
+        env: {
+            ROBOPARK_MESH_TOKEN: opts.token,
+            // Keep internal service wiring out of the Commander argument boundary.
+            // This also lets preview start while RoboVision is still warming up.
+            ROBOVISION_URL: opts.vision !== false ? 'http://127.0.0.1:5000' : '',
+            ROBOVISION_MEDIA_URL: opts.vision !== false
+                ? 'http://127.0.0.1:5000/api/media/inventory'
+                : '',
+            ROBOVISION_CAMERA: opts.vision !== false ? '1' : '0',
+            // Inventory changes should reach the Control Center promptly.
+            HEARTBEAT_INTERVAL: '5',
+        },
+    };
     const start = (entry) => {
         const child = spawn(entry.command, entry.args, {
             env: { ...process.env, ...entry.env, ROBOPARK_ROBOT_RUNTIME: '1' },
@@ -160,20 +176,18 @@ export async function roboparkRobotRuntime(opts) {
         start(children[0]);
         if (opts.vision !== false) {
             start(children[1]);
-            if (!await waitForVision()) {
-                console.error(chalk.red('  RoboVision did not recover after the mesh update; retrying in 5s'));
-                // Stop the partially restarted stack before retrying. Otherwise a
-                // second mesh child would collide with the existing listener.
-                await Promise.all([...children, preview].map(stopChild));
-                recycling = false;
-                setTimeout(() => { if (!stopping)
-                    void recycleAfterMeshUpdate(); }, RESTART_DELAY_MS);
-                return;
-            }
         }
         start(preview);
         recycling = false;
         console.log(chalk.green('  robot runtime updated and healthy'));
+        if (opts.vision !== false) {
+            void waitForVision().then(ready => {
+                if (!stopping)
+                    console.log(ready
+                        ? chalk.green('  RoboVision camera/audio inventory ready')
+                        : chalk.yellow('  RoboVision is degraded; preview heartbeat remains online and will retry'));
+            });
+        }
     };
     console.log(chalk.bold('\n  robopark robot up'));
     console.log(chalk.dim('  ' + '─'.repeat(52)));
@@ -186,21 +200,20 @@ export async function roboparkRobotRuntime(opts) {
         console.log(chalk.dim('  clearing stale device identity for fresh enrollment…'));
         resetStaleEnrollment();
     }
-    // The mesh can reconnect independently; camera/audio must be healthy before
-    // preview sends its first inventory heartbeat or opens the motion webhook.
+    // Identity and inventory reporting start immediately. RoboVision may still
+    // be installing or recovering without making the robot disappear.
     start(children[0]);
+    start(preview);
     if (opts.vision !== false) {
         start(children[1]);
-        console.log(chalk.dim('  waiting for RoboVision camera/audio inventory…'));
-        if (!await waitForVision()) {
-            stopping = true;
-            for (const entry of children)
-                entry.child?.kill('SIGTERM');
-            throw new Error('RoboVision did not become healthy at http://127.0.0.1:5000 within 120s');
-        }
-        console.log(chalk.green('  ✓ RoboVision ready; starting preview agent'));
+        console.log(chalk.dim('  RoboVision health check running in background…'));
+        void waitForVision().then(ready => {
+            if (!stopping)
+                console.log(ready
+                    ? chalk.green('  RoboVision camera/audio inventory ready')
+                    : chalk.yellow('  RoboVision is degraded; preview heartbeat remains online and will retry'));
+        });
     }
-    start(preview);
     const shutdown = () => {
         stopping = true;
         for (const entry of [...children, preview])

package/dist/robopark/setup.js

@@ -163,7 +163,9 @@ async function setupRobot(config, opts, ctx, internal) {
     // preview-agent) silently kept talking to whatever hub auto-discovery
     // found (e.g. a real hub reachable over Tailscale), not the one requested.
     const hubHost = new URL(hubUrl).hostname;
-    const schedulerUrl = `http://${hubHost}:${opts.schedulerPort ? parseInt(opts.schedulerPort, 10) : DEFAULT_SCHEDULER_PORT}`;
+    const schedulerUrl = network === 'tailscale'
+        ? `${hubUrl.replace(/\/+$/, '')}/robopark`
+        : `http://${hubHost}:${opts.schedulerPort ? parseInt(opts.schedulerPort, 10) : DEFAULT_SCHEDULER_PORT}`;
     // Vision (camera/motion detection -> presence-triggered session) is the
     // production trigger — on by default. --no-vision opts out (e.g. no camera
     // on this box, or RoboVisionAI_PI isn't installed).
@@ -187,13 +189,21 @@ async function setupRobot(config, opts, ctx, internal) {
     console.log('  ' + chalk.cyan(`robopark ${runtimeArgs.join(' ')}`));
     console.log(chalk.dim(`  network: ${network} (scheduler: ${schedulerUrl})`));
     console.log();
-    if (opts.start) {
+    // On Linux, registerAutoStart enables and starts the systemd service. Do not
+    // also launch a detached copy that can leave mesh healthy while preview is
+    // duplicated, blocked, or running under a different HOME.
+    if (opts.start && !(opts.autoStart && process.platform === 'linux')) {
         const robotArgv = [process.execPath, process.argv[1], ...runtimeArgs];
         console.log(chalk.dim('  starting unified robot runtime…'));
         runDetached(robotArgv[0], robotArgv.slice(1));
     }
     if (opts.autoStart) {
-        const robotArgv = [process.execPath, process.argv[1], ...runtimeArgs, '--foreground'];
+        // Enrollment is a one-time bootstrap action. Persisting it in the
+        // supervisor would erase the device identity and attempt a new enrollment
+        // on every reboot, creating duplicate robots (or failing after the token
+        // is consumed).
+        const bootRuntimeArgs = runtimeArgs.filter((arg, index) => arg !== '--enrollment-token' && runtimeArgs[index - 1] !== '--enrollment-token');
+        const robotArgv = [process.execPath, process.argv[1], ...bootRuntimeArgs, '--foreground'];
         for (const role of ['robot', 'robot-preview-agent', 'robot-vision-agent']) {
             unregisterAutoStart(role, internal.name);
         }

package/dist/robopark-cli.js

@@ -135,6 +135,7 @@ program
     .option('--enrollment-token <token>', 'one-time enrollment token')
     .option('--video-device <dev>', 'camera: auto, /dev/video0, 0, picamera', 'auto')
     .option('--audio-device <dev>', 'microphone: default, none, or name/index', 'default')
+    .option('--robovision-url <url>', 'RoboVision base URL used for camera streaming and hardware inventory')
     .option('--width <px>', 'video width', '640')
     .option('--height <px>', 'video height', '480')
     .option('--fps <n>', 'video fps', '15')
@@ -183,7 +184,9 @@ robotProgram
     await roboparkRobotRuntime({
         name: opts.name,
         hubUrl: opts.hubUrl,
-        schedulerUrl: opts.schedulerUrl ?? `http://${hub.hostname}:8080`,
+        schedulerUrl: opts.schedulerUrl ?? (opts.tailscale
+            ? `${opts.hubUrl.replace(/\/+$/, '')}/robopark`
+            : `http://${hub.hostname}:8080`),
         token: opts.token,
         port: opts.port,
         network: opts.tailscale ? 'tailscale' : 'lan',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infinicode",
-  "version": "2.8.58",
+  "version": "2.8.60",
   "description": "OpenKernel — provider-agnostic AI execution kernel. Native coding agent + mission-driven execution runtime.",
   "type": "module",
   "main": "./dist/kernel/index.js",

package/packages/robopark/scheduler/main.py

@@ -43,6 +43,21 @@ ROBOPARK_AGENT_TOKEN_FILE = os.getenv(
     "ROBOPARK_AGENT_TOKEN_FILE",
     os.path.join(os.getenv("SCHEDULER_DATA_DIR", "/app/data"), ".robopark-agent-token"),
 )
+
+
+def _load_mesh_token() -> str:
+    """Load the hub credential shared with unified robot runtimes."""
+    configured = os.getenv("ROBOPARK_MESH_TOKEN", "").strip()
+    if configured:
+        return configured
+    try:
+        with open(os.path.expanduser("~/.robopark/mesh.token"), "r", encoding="utf8") as handle:
+            return handle.read().strip()
+    except OSError:
+        return ""
+
+
+ROBOPARK_MESH_TOKEN = _load_mesh_token()
 
 # ElevenLabs credentials used by the /api/voices/elevenlabs endpoint. We accept
 # both the long-form ELEVENLABS_API_KEY and a shorter ELEVENLABS_KEY alias so
@@ -180,7 +195,7 @@ class DeviceCreate(BaseModel):
     notes: Optional[str] = None
     enrollment_token: Optional[str] = None  # if omitted, one is auto-generated
 
-class DeviceEnrollRequest(BaseModel):
+class DeviceEnrollRequest(BaseModel):
     enrollment_token: str
     name: Optional[str] = None
     tailscale_ip: Optional[str] = None
@@ -188,8 +203,13 @@ class DeviceEnrollRequest(BaseModel):
     motor_server_url: Optional[str] = None
     livekit_url: Optional[str] = None
     character_id: Optional[str] = None
-    video_device: Optional[str] = None
-    audio_device: Optional[str] = None
+    video_device: Optional[str] = None
+    audio_device: Optional[str] = None
+
+class DeviceBootstrapRequest(BaseModel):
+    name: str
+    lan_ip: Optional[str] = None
+    tailscale_ip: Optional[str] = None
 
 class DeviceEnrollResponse(BaseModel):
     device_id: str
@@ -2343,7 +2363,7 @@ async def rotate_device_token(device_id: str):
     await _log_history("device", "device", device_id, "token_rotated", "operator")
     return {"device_id": device_id, "device_token": new_token}
 
-async def _authorize_device(device_id: str, authorization: Optional[str]) -> bool:
+async def _authorize_device(device_id: str, authorization: Optional[str]) -> bool:
     """Verify Bearer token matches stored hash for this device."""
     if not authorization or not authorization.lower().startswith("bearer "):
         return False
@@ -2351,9 +2371,18 @@ async def _authorize_device(device_id: str, authorization: Optional[str]) -> boo
     async with aiosqlite.connect(DB_PATH) as db:
         async with db.execute("SELECT token_hash FROM devices WHERE id = ?", (device_id,)) as c:
             row = await c.fetchone()
-    if not row or not row[0]:
-        return False
-    return hmac.compare_digest(row[0], _hash(token))
+    if not row or not row[0]:
+        return False
+    return hmac.compare_digest(row[0], _hash(token))
+
+
+def _authorize_mesh_bootstrap(presented: Optional[str]) -> bool:
+    """Authenticate bootstrap before a device-scoped token exists."""
+    return bool(
+        ROBOPARK_MESH_TOKEN
+        and presented
+        and hmac.compare_digest(ROBOPARK_MESH_TOKEN, presented.strip())
+    )
 
 async def _log_history(category: str, entity_type: Optional[str] = None, entity_id: Optional[str] = None,
                        action: Optional[str] = None, actor: Optional[str] = None, details: Optional[str] = None):
@@ -2430,8 +2459,61 @@ async def _authorize_fleet(authorization: Optional[str]) -> bool:
             rows = await c.fetchall()
     return any(r[0] and hmac.compare_digest(r[0], token_hash) for r in rows)
 
-@app.post("/api/devices/enroll", response_model=DeviceEnrollResponse)
-async def enroll_device(payload: DeviceEnrollRequest):
+@app.post("/api/devices/bootstrap", response_model=DeviceEnrollResponse)
+async def bootstrap_device(
+    payload: DeviceBootstrapRequest,
+    x_robopark_mesh_token: Optional[str] = Header(default=None),
+):
+    """Create or recover one scheduler identity for a mesh-authenticated robot."""
+    if not _authorize_mesh_bootstrap(x_robopark_mesh_token):
+        raise HTTPException(401, "Invalid or missing RoboPark mesh token")
+    name = payload.name.strip()
+    if not name:
+        raise HTTPException(400, "name is required")
+
+    new_token = secrets.token_urlsafe(32)
+    new_hash = _hash(new_token)
+    now = datetime.utcnow().isoformat()
+    async with aiosqlite.connect(DB_PATH) as db:
+        db.row_factory = aiosqlite.Row
+        async with db.execute(
+            """SELECT id FROM devices WHERE lower(name) = lower(?)
+               ORDER BY CASE lower(status) WHEN 'online' THEN 0 WHEN 'running' THEN 1 ELSE 2 END,
+                        last_heartbeat DESC, enrolled_at DESC LIMIT 1""",
+            (name,),
+        ) as cursor:
+            existing = await cursor.fetchone()
+        if existing:
+            device_id = existing["id"]
+            await db.execute(
+                """UPDATE devices SET token_hash = ?, status = 'enrolled',
+                   lan_ip = COALESCE(?, lan_ip), tailscale_ip = COALESCE(?, tailscale_ip),
+                   enrolled_at = COALESCE(enrolled_at, ?) WHERE id = ?""",
+                (new_hash, payload.lan_ip, payload.tailscale_ip, now, device_id),
+            )
+        else:
+            device_id = f"dev_{secrets.token_hex(4)}"
+            await db.execute(
+                """INSERT INTO devices
+                   (id, name, lan_ip, tailscale_ip, token_hash, status, enrolled_at, created_at)
+                   VALUES (?, ?, ?, ?, ?, 'enrolled', ?, ?)""",
+                (device_id, name, payload.lan_ip, payload.tailscale_ip, new_hash, now, now),
+            )
+        await db.execute(
+            "INSERT OR IGNORE INTO robots (id, name, status) VALUES (?, ?, 'idle')",
+            (device_id, name),
+        )
+        await db.execute("UPDATE robots SET name = ? WHERE id = ?", (name, device_id))
+        await db.commit()
+
+    await broadcast("device_bootstrapped", {"device_id": device_id, "name": name})
+    await _log_history("device", "device", device_id, "bootstrapped", "mesh", f"name={name}")
+    scheduler_url = os.getenv("SCHEDULER_PUBLIC_URL", f"http://localhost:{os.getenv('SCHEDULER_PORT', '8080')}")
+    return DeviceEnrollResponse(device_id=device_id, device_token=new_token, scheduler_url=scheduler_url)
+
+
+@app.post("/api/devices/enroll", response_model=DeviceEnrollResponse)
+async def enroll_device(payload: DeviceEnrollRequest):
     """First-boot enrollment for a Pi. Requires production_mode = true and a valid enrollment token.
     Returns a long-lived device_token the Pi will use for heartbeats."""
     if not await get_production_mode():

package/packages/robopark/scheduler/preview_agent.py

@@ -68,7 +68,7 @@ logger = logging.getLogger("robopark.preview_agent")
 
 _DEVICE_INVENTORY_CACHE: Optional[dict] = None
 _DEVICE_INVENTORY_CACHE_AT = 0.0
-DEVICE_INVENTORY_CACHE_SECONDS = 30.0
+DEVICE_INVENTORY_CACHE_SECONDS = 5.0
 ROBOVISION_MEDIA_URL = os.getenv("ROBOVISION_MEDIA_URL", "http://127.0.0.1:5000/api/media/inventory")
 
 
@@ -256,13 +256,48 @@ def _load_token() -> Optional[str]:
     return None
 
 
-def _save_token(token: str) -> None:
-    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
-    TOKEN_FILE.write_text(token, encoding="utf8")
-    os.chmod(TOKEN_FILE, 0o600)
-
-
-async def _enroll(scheduler_url: str, enrollment_token: str, robot_id: str) -> str:
+def _save_token(token: str) -> None:
+    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    TOKEN_FILE.write_text(token, encoding="utf8")
+    os.chmod(TOKEN_FILE, 0o600)
+
+
+def _mesh_proxy_headers() -> dict:
+    """Add hub authentication only when the runtime supplied it.
+
+    Direct LAN scheduler calls work unchanged. Tailscale calls use the hub's
+    /robopark proxy, which needs this separate mesh credential while the normal
+    Authorization header remains the scheduler device token.
+    """
+    token = os.getenv("ROBOPARK_MESH_TOKEN", "").strip()
+    return {"X-RoboPark-Mesh-Token": token} if token else {}
+
+
+async def _bootstrap_mesh_device(scheduler_url: str, robot_id: str) -> tuple[str, str]:
+    """Create or recover this robot's scheduler identity using mesh auth."""
+    async with httpx.AsyncClient(headers=_mesh_proxy_headers()) as client:
+        response = await client.post(
+            f"{scheduler_url.rstrip('/')}/api/devices/bootstrap",
+            json={"name": robot_id, "lan_ip": _get_lan_ip()},
+            timeout=30.0,
+        )
+        response.raise_for_status()
+        data = response.json()
+    device_id = str(data.get("device_id") or "").strip()
+    device_token = str(data.get("device_token") or "").strip()
+    if not device_id or not device_token:
+        raise RuntimeError("mesh bootstrap did not return device credentials")
+    _save_token(device_token)
+    cfg = _load_config()
+    cfg["device_id"] = device_id
+    cfg["device_token"] = device_token
+    cfg["scheduler_url"] = scheduler_url
+    _save_config(cfg)
+    logger.info("mesh bootstrap resolved scheduler device %s", device_id)
+    return device_id, device_token
+
+
+async def _enroll(scheduler_url: str, enrollment_token: str, robot_id: str) -> str:
     """Enroll this Pi with the scheduler and return the device token."""
     import socket
     payload = {
@@ -270,7 +305,7 @@ async def _enroll(scheduler_url: str, enrollment_token: str, robot_id: str) -> s
         "name": robot_id,
         "lan_ip": _get_lan_ip(),
     }
-    async with httpx.AsyncClient() as client:
+    async with httpx.AsyncClient(headers=_mesh_proxy_headers()) as client:
         r = await client.post(
             f"{scheduler_url.rstrip('/')}/api/devices/enroll",
             json=payload,
@@ -302,16 +337,26 @@ def _get_lan_ip() -> Optional[str]:
         return None
 
 
-async def _send_heartbeat(scheduler_url: str, device_id: str, token: str) -> Optional[bool]:
+async def _send_heartbeat(
+    scheduler_url: str, device_id: str, token: str
+) -> tuple[Optional[bool], bool]:
     try:
         inventory = _get_device_inventory()
+        headers = {"Authorization": f"Bearer {token}", **_mesh_proxy_headers()}
         async with httpx.AsyncClient() as client:
             response = await client.post(
                 f"{scheduler_url.rstrip('/')}/api/devices/{device_id}/heartbeat",
                 json={"status": "online", "ip": _get_lan_ip(), "device_inventory": inventory},
-                headers={"Authorization": f"Bearer {token}"},
+                headers=headers,
                 timeout=10.0,
             )
+            if response.status_code in (401, 404):
+                logger.warning(
+                    "heartbeat credentials rejected for %s (%s)",
+                    device_id,
+                    response.status_code,
+                )
+                return None, False
             response.raise_for_status()
             logger.info(
                 "heartbeat accepted: inventory source=%s camera=%d mic=%d speaker=%d",
@@ -320,10 +365,10 @@ async def _send_heartbeat(scheduler_url: str, device_id: str, token: str) -> Opt
                 len(inventory.get("audio_input", [])),
                 len(inventory.get("audio_output", [])),
             )
-            return bool(response.json().get("production_mode", False))
+            return bool(response.json().get("production_mode", False)), True
     except Exception as e:
         logger.warning(f"heartbeat failed: {e}")
-    return None
+    return None, True
 
 
 @dataclass
@@ -384,19 +429,43 @@ class PreviewAgent:
         self._last_device_config_poll = 0.0
         self._motion_reference = None
         self._last_motion_sample = 0.0
-        self._motion_capture: Optional[VideoCapture] = None
-        self._motion_capture_lock = asyncio.Lock()
-
-    async def run(self) -> None:
-        enrollment_token = os.getenv("ENROLLMENT_TOKEN") or self.enrollment_token
-        if not self.device_token and enrollment_token:
+        self._motion_capture: Optional[VideoCapture] = None
+        self._motion_capture_lock = asyncio.Lock()
+        self._mesh_bootstrap_ready = False
+        self._next_mesh_bootstrap = 0.0
+
+    async def _ensure_mesh_identity(self) -> bool:
+        if not _mesh_proxy_headers():
+            return bool(self.device_id and self.device_token)
+        now = time.monotonic()
+        if self._mesh_bootstrap_ready:
+            return True
+        if now < self._next_mesh_bootstrap:
+            return False
+        self._next_mesh_bootstrap = now + 5.0
+        try:
+            self.device_id, self.device_token = await _bootstrap_mesh_device(
+                self.scheduler_url, self.robot_id
+            )
+            self._mesh_bootstrap_ready = True
+            return True
+        except Exception as exc:
+            logger.warning("mesh device bootstrap failed: %s", exc)
+            return False
+
+    async def run(self) -> None:
+        enrollment_token = os.getenv("ENROLLMENT_TOKEN") or self.enrollment_token
+        if _mesh_proxy_headers():
+            await self._ensure_mesh_identity()
+
+        if not self.device_token and enrollment_token:
             self.device_token = await _enroll(self.scheduler_url, enrollment_token, self.robot_id)
 
         if not self.device_token:
             logger.error("no DEVICE_TOKEN and no ENROLLMENT_TOKEN; cannot poll scheduler")
             sys.exit(1)
 
-        self._session = httpx.AsyncClient()
+        self._session = httpx.AsyncClient(headers=_mesh_proxy_headers())
 
         # Must come after self._session exists — _resolve_device_id() guards
         # on it and silently no-ops otherwise. On a fresh enroll (no cached
@@ -703,13 +772,18 @@ class PreviewAgent:
         await asyncio.to_thread(_play_audio_effect, self.audio_output_device, "disconnect")
         self._current_state = PreviewState()
 
-    async def _heartbeat_loop(self) -> None:
-        while not self._shutdown.is_set():
-            if self.device_id and self.device_token:
-                production_mode = await _send_heartbeat(
-                    self.scheduler_url, self.device_id, self.device_token
-                )
-                if production_mode is not None:
+    async def _heartbeat_loop(self) -> None:
+        while not self._shutdown.is_set():
+            if _mesh_proxy_headers() and not self._mesh_bootstrap_ready:
+                await self._ensure_mesh_identity()
+            if self.device_id and self.device_token:
+                production_mode, credentials_ok = await _send_heartbeat(
+                    self.scheduler_url, self.device_id, self.device_token
+                )
+                if not credentials_ok:
+                    self._mesh_bootstrap_ready = False
+                    self._next_mesh_bootstrap = 0.0
+                if production_mode is not None:
                     self.production_mode = production_mode
                     if not production_mode and self._vision_session_id:
                         await self._end_vision_session()
@@ -1630,7 +1704,9 @@ def main() -> None:
         "video_device": args.video_device,
         "audio_device": args.audio_device,
         "robovision_url": args.robovision_url or os.getenv("ROBOVISION_URL", "http://127.0.0.1:5000"),
-        "use_robovision_camera": bool(args.robovision_url),
+        "use_robovision_camera": bool(args.robovision_url) or os.getenv(
+            "ROBOVISION_CAMERA", ""
+        ).lower() in ("1", "true", "yes", "on"),
         "video_width": args.width,
         "video_height": args.height,
         "video_fps": args.fps,