remosidian 0.1.12 → 0.1.13

package/dist/remosidian.mjs

@@ -15244,21 +15244,22 @@ var __webpack_exports__ = {};
 
 // EXPORTS
 __nccwpck_require__.d(__webpack_exports__, {
-  gu: () => (/* binding */ buildPairCode),
-  ti: () => (/* binding */ buildPairDeepLink),
-  lz: () => (/* binding */ buildPairUri),
-  jO: () => (/* binding */ buildServeArgs),
-  YP: () => (/* binding */ createCompactPairingPayload),
+  gu: () => (/* reexport */ buildPairCode),
+  ti: () => (/* reexport */ buildPairDeepLink),
+  lz: () => (/* reexport */ buildPairUri),
+  jO: () => (/* reexport */ buildServeArgs),
+  YP: () => (/* reexport */ createCompactPairingPayload),
   wX: () => (/* binding */ expandVaultSpec),
-  NT: () => (/* binding */ hasLegacyAccessArgs),
-  BK: () => (/* binding */ helpText),
+  NT: () => (/* reexport */ hasLegacyAccessArgs),
+  BK: () => (/* reexport */ helpText),
   iW: () => (/* binding */ main),
-  RG: () => (/* binding */ normalizeCliFlags),
-  QN: () => (/* binding */ normalizePortValue),
-  bo: () => (/* binding */ parseAccessValue),
-  Zy: () => (/* binding */ parseArgs),
+  RG: () => (/* reexport */ normalizeCliFlags),
+  QN: () => (/* reexport */ normalizePortValue),
+  bo: () => (/* reexport */ parseAccessValue),
+  Zy: () => (/* reexport */ parseArgs),
   Mf: () => (/* binding */ resolveEntrypointHref),
-  t0: () => (/* binding */ resolveInvocation)
+  t0: () => (/* reexport */ resolveInvocation),
+  kr: () => (/* reexport */ resolvePersonalAgentOverride)
 });
 
 ;// CONCATENATED MODULE: external "node:child_process"
@@ -15275,6 +15276,203 @@ const promises_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.ur
 const external_node_url_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:url");
 // EXTERNAL MODULE: ../../node_modules/qrcode/lib/index.js
 var lib = __nccwpck_require__(7514);
+;// CONCATENATED MODULE: ./bin/cli-pairing.mjs
+
+
+
+
+function cli_pairing_renderQrTerminal(payload) {
+  return new Promise((resolveTerm, rejectTerm) => {
+    lib.toString(payload, { type: 'terminal', small: true, errorCorrectionLevel: 'M' }, (err, str) => {
+      if (err) {
+        rejectTerm(err);
+        return;
+      }
+      resolveTerm(str);
+    });
+  });
+}
+
+async function cli_pairing_writeQrPng(payload, filePath) {
+  (0,external_node_fs_namespaceObject.mkdirSync)((0,external_node_path_namespaceObject.dirname)(filePath), { recursive: true });
+  await lib.toFile(filePath, payload, { type: 'png', errorCorrectionLevel: 'M', margin: 1, scale: 8 });
+}
+
+function printHumanHealth(health) {
+  const lines = [];
+  lines.push(`Daemon       ${health.daemonId} (${health.displayName})`);
+  lines.push(`Version      ${health.version}`);
+  if (health.runtime) {
+    lines.push(`Runtime      ${health.runtime === 'cli' ? 'CLI' : 'Obsidian plugin'}`);
+  }
+  lines.push(`Listening    http://${health.canonicalHost}:${health.port}`);
+  if (health.relayUrl) {
+    lines.push(`Relay        ${health.relayUrl}`);
+  }
+  if (Array.isArray(health.fallbackHosts) && health.fallbackHosts.length > 0) {
+    lines.push(`Fallbacks    ${health.fallbackHosts.join(', ')}`);
+  }
+  if (Array.isArray(health.connections) && health.connections.length > 0) {
+    lines.push('Connections:');
+    for (const conn of health.connections) {
+      const proto = conn.secure ? 'wss' : 'ws';
+      lines.push(
+        conn.source === 'remoteDirect'
+          ? '  - Remote Direct (stable)'
+          : `  - ${proto}://${conn.host}:${conn.port} (${conn.source}, ${conn.stability})`,
+      );
+    }
+  }
+  if (Array.isArray(health.vaults) && health.vaults.length > 0) {
+    lines.push('Vaults:');
+    for (const vault of health.vaults) {
+      lines.push(`  - ${vault.id}: ${vault.root ?? '(unknown root)'}`);
+    }
+  } else {
+    lines.push('Vaults:      (none configured — pass --vault or run `remosidian init`)');
+  }
+  lines.push(`Paired       ${health.pairedDevices ?? 0} device(s)`);
+  lines.push(`Personal Agent  ${health.features?.personalAgent === true ? 'shown' : 'hidden'}`);
+  if (health.ai?.configured) {
+    lines.push(`AI           ${health.ai.agent ?? 'agent'} (local CLI)`);
+  } else {
+    lines.push('AI           (no claude / codex CLI on PATH — install one to enable Ask)');
+  }
+  return lines.join('\n');
+}
+
+function buildPairUri(payload) {
+  // Emit the full schema so @lifeos/client-core's default parser picks it
+  // up. We chose JSON-over-base64url because it survives clipboard paste,
+  // deep links, and QR data URIs without escaping headaches.
+  const full = {
+    type: payload.type,
+    daemonId: payload.daemonId,
+    displayName: payload.displayName,
+    canonicalHost: payload.canonicalHost,
+    port: payload.port,
+    ...(payload.fallbackHosts && payload.fallbackHosts.length > 0 ? { fallbackHosts: payload.fallbackHosts } : {}),
+    ...(payload.connections && payload.connections.length > 0 ? { connections: payload.connections } : {}),
+    pairNonce: payload.pairNonce,
+    expiresAt: payload.expiresAt,
+    ...(payload.runtime ? { runtime: payload.runtime } : {}),
+    ...(payload.vaults && payload.vaults.length > 0 ? { vaults: payload.vaults } : {}),
+  };
+  const encoded = Buffer.from(JSON.stringify(full), 'utf8').toString('base64url');
+  return `remosidian://pair?v=1&data=${encoded}`;
+}
+
+function normalizePairingConnections(payload) {
+  const explicitConnections = Array.isArray(payload.connections)
+    ? payload.connections
+        .filter(
+          (target) =>
+            target &&
+            typeof target.host === 'string' &&
+            Number.isFinite(target.port) &&
+            typeof target.source === 'string' &&
+            typeof target.stability === 'string',
+        )
+        .map((target) => ({
+          kind: target.kind === 'relay' ? 'relay' : 'direct',
+          host: target.host.trim(),
+          port: Math.floor(Number(target.port)),
+          ...(target.secure === true ? { secure: true } : {}),
+          ...(target.remoteDirect ? { remoteDirect: target.remoteDirect } : {}),
+          source: target.source,
+          stability: target.stability,
+        }))
+        .filter((target) => target.host && target.port > 0)
+    : [];
+  if (explicitConnections.length > 0) {
+    return explicitConnections;
+  }
+  const fallbackHosts = Array.isArray(payload.fallbackHosts)
+    ? payload.fallbackHosts.filter((host) => typeof host === 'string' && host.trim()).map((host) => host.trim())
+    : [];
+  const port = Number.isFinite(payload.port) && payload.port > 0 ? Math.floor(payload.port) : 41234;
+  return [
+    {
+      kind: 'direct',
+      host: payload.canonicalHost,
+      port,
+      source: 'configured_host',
+      stability: 'stable',
+    },
+    ...fallbackHosts.map((host) => ({
+      kind: 'direct',
+      host,
+      port,
+      source: 'fallback',
+      stability: 'stable',
+    })),
+  ];
+}
+
+function createCompactPairingPayload(payload) {
+  const compact = {
+    t: 'rp',
+    d: payload.daemonId,
+    n: payload.displayName,
+    h: payload.canonicalHost,
+    p: payload.port,
+    c: payload.pairNonce,
+    e: payload.expiresAt,
+  };
+  if (Array.isArray(payload.fallbackHosts) && payload.fallbackHosts.length > 0) {
+    compact.f = payload.fallbackHosts;
+  }
+  const connections = normalizePairingConnections(payload);
+  if (connections.length > 0) {
+    compact.o = connections.map((target) => [
+      target.kind,
+      target.host,
+      target.port,
+      target.source,
+      target.stability,
+      target.secure === true,
+      ...(target.remoteDirect ? [target.remoteDirect.serverAddress, target.remoteDirect.remotePort] : []),
+    ]);
+  }
+  if (payload.runtime) {
+    compact.r = payload.runtime;
+  }
+  if (Array.isArray(payload.vaults) && payload.vaults.length > 0) {
+    compact.v = payload.vaults;
+  }
+  return compact;
+}
+
+function buildPairCode(payload) {
+  return JSON.stringify(createCompactPairingPayload(payload));
+}
+
+function buildPairDeepLink(pairingCode) {
+  return `remosidian://pair?data=${encodeURIComponent(pairingCode)}`;
+}
+
+function formatConnectionSummary(target) {
+  if (target.source === 'remoteDirect') return 'Remote Direct (stable)';
+  const scheme = target.secure === true || target.port === 443 ? 'https' : 'http';
+  return `${scheme}://${target.host}:${target.port} (${target.source}, ${target.stability})`;
+}
+
+async function printPairingQr(pairingPayload, paths) {
+  const runtime = paths;
+  const pairingCode = buildPairCode(pairingPayload);
+  const deepLink = buildPairDeepLink(pairingCode);
+  const qr = await cli_pairing_renderQrTerminal(pairingCode);
+  (0,external_node_fs_namespaceObject.writeFileSync)(runtime.pairingCodePath, `${pairingCode}\n`, 'utf8');
+  await cli_pairing_writeQrPng(pairingCode, runtime.pairingQrPath).catch(() => undefined);
+  process.stdout.write(`\nScan this QR code with the Remosidian app:\n\n${qr}\n`);
+  process.stdout.write(`If the terminal QR is hard to scan, open this PNG instead:\n${runtime.pairingQrPath}\n`);
+  process.stdout.write(`If this device cannot scan, paste this pairing code in Remosidian:\n${pairingCode}\n`);
+  process.stdout.write(`Pairing code saved to:\n${runtime.pairingCodePath}\n`);
+  process.stdout.write(`Or open this deep link on a device with Remosidian installed:\n${deepLink}\n`);
+}
+
+
+
 ;// CONCATENATED MODULE: ../../packages/remosidian-server/dist/paths.js
 
 
@@ -15338,6 +15536,18 @@ function isTruthyEnv(value) {
     const normalized = value.trim().toLowerCase();
     return normalized === '' || normalized === '1' || normalized === 'true' || normalized === 'yes';
 }
+function readBoolean(value, fallback = false) {
+    if (typeof value === 'boolean')
+        return value;
+    if (typeof value !== 'string')
+        return fallback;
+    const normalized = value.trim().toLowerCase();
+    if (['1', 'true', 'yes', 'on'].includes(normalized))
+        return true;
+    if (['0', 'false', 'no', 'off'].includes(normalized))
+        return false;
+    return fallback;
+}
 function getNonBlankPath(value) {
     return typeof value === 'string' && value.trim().length > 0 ? value : undefined;
 }
@@ -15426,6 +15636,8 @@ function normalizeRemosidianConfig(value) {
             : typeof server.relayUrl === 'string'
                 ? server.relayUrl.trim()
                 : '';
+    const rawFeatures = server.features && typeof server.features === 'object' ? server.features : {};
+    const personalAgent = readBoolean(process.env.REMOSIDIAN_PERSONAL_AGENT, readBoolean(rawFeatures.personalAgent));
     const vaults = Array.isArray(raw.vaults)
         ? raw.vaults.map(normalizeVault).filter((vault) => Boolean(vault))
         : [];
@@ -15436,6 +15648,7 @@ function normalizeRemosidianConfig(value) {
             port: readPort(envPort ?? server.port, readPort(server.port, DEFAULT_REMOSIDIAN_PORT)),
             advertisedHosts,
             ...(relayUrl ? { relayUrl } : {}),
+            features: { personalAgent },
         },
         ...(ai ? { ai } : {}),
     };
@@ -15452,225 +15665,32 @@ function loadRemosidianConfig(configPath = createRemosidianPaths().configPath) {
 //# sourceMappingURL=config.js.map
 ;// CONCATENATED MODULE: external "node:http"
 const external_node_http_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:http");
-;// CONCATENATED MODULE: ../../packages/daemon-core/dist/auth.js
-function firstHeaderValue(value) {
-    if (Array.isArray(value))
-        return value[0];
-    return value;
-}
-function extractClientFingerprint(req) {
-    const forwardedFor = firstHeaderValue(req.headers["x-forwarded-for"]);
-    const cfConnectingIp = firstHeaderValue(req.headers["cf-connecting-ip"]);
-    const realIp = firstHeaderValue(req.headers["x-real-ip"]);
-    const ip = forwardedFor?.split(",")[0]?.trim() ||
-        cfConnectingIp ||
-        realIp ||
-        req.socket.remoteAddress ||
-        undefined;
-    const userAgent = firstHeaderValue(req.headers["user-agent"]);
-    return {
-        ...(ip ? { ip } : {}),
-        ...(userAgent ? { userAgent } : {}),
-    };
+;// CONCATENATED MODULE: ../../packages/daemon-core/dist/advertised-hosts.js
+
+
+function isIpv4(address) {
+    const parts = address.split('.');
+    if (parts.length !== 4)
+        return false;
+    return parts.every((part) => /^\d+$/.test(part) && Number(part) >= 0 && Number(part) <= 255);
 }
-function isLoopbackAddress(address) {
-    if (!address)
+function isSharedIpv4(address) {
+    if (!isIpv4(address))
         return false;
-    return (address === "127.0.0.1" ||
-        address === "::1" ||
-        address === "::ffff:127.0.0.1");
+    const [first, second] = address.split('.').map(Number);
+    return first === 100 && second >= 64 && second <= 127;
 }
-const PROXY_HEADER_NAMES = [
-    "x-forwarded-for",
-    "x-forwarded-host",
-    "x-forwarded-proto",
-    "x-real-ip",
-    "forwarded",
-    "via",
-    "cf-connecting-ip",
-    "cf-ray",
-];
-function isProxiedRequest(headers) {
-    for (const name of PROXY_HEADER_NAMES) {
-        if (headers[name] !== undefined)
-            return true;
-    }
-    return false;
+function isLinkLocalIpv4(address) {
+    if (!isIpv4(address))
+        return false;
+    const [first, second] = address.split('.').map(Number);
+    return first === 169 && second === 254;
 }
-function isTrustedLocalRequest(req) {
-    return (isLoopbackAddress(req.socket.remoteAddress) &&
-        !isProxiedRequest(req.headers));
-}
-function readBearerToken(header) {
-    if (!header)
-        return null;
-    const match = header.match(/^Bearer\s+(.+)$/i);
-    return match?.[1]?.trim() || null;
-}
-function resolveRequestToken(authHeader, queryToken) {
-    return readBearerToken(authHeader) ?? queryToken;
-}
-function isLegacyToken(token, legacyToken) {
-    return Boolean(token && legacyToken && token === legacyToken);
-}
-function isAuthorizedToken(token, legacyToken, validatePairToken, touch = true) {
-    if (!token)
-        return false;
-    if (isLegacyToken(token, legacyToken))
-        return true;
-    return Boolean(validatePairToken(token, touch));
-}
-//# sourceMappingURL=auth.js.map
-;// CONCATENATED MODULE: external "node:crypto"
-const external_node_crypto_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:crypto");
-;// CONCATENATED MODULE: ../../packages/daemon-core/dist/identity.js
-
-
-
-
-
-function base64Url(bytes) {
-    return (0,external_node_crypto_namespaceObject.randomBytes)(bytes).toString('base64url');
-}
-function buildDaemonId() {
-    return `d_${base64Url(12)}`;
-}
-function defaultDisplayName(options) {
-    return options?.systemHostname ?? (0,external_node_os_namespaceObject.hostname)();
-}
-function runHostnameCommand(command, args) {
-    return (0,external_node_child_process_namespaceObject.execFileSync)(command, args, {
-        encoding: 'utf8',
-        stdio: ['ignore', 'pipe', 'ignore'],
-        timeout: 1_000,
-    });
-}
-function normalizeMdnsHostname(value) {
-    const raw = value.trim().replace(/\.$/, '').toLowerCase();
-    if (!raw)
-        return null;
-    const firstLabel = raw.endsWith('.local') ? raw.slice(0, -6) : raw.split('.')[0];
-    const label = firstLabel
-        .normalize('NFKD')
-        .replace(/[^a-z0-9-]+/g, '-')
-        .replace(/^-+|-+$/g, '')
-        .slice(0, 63);
-    return label ? `${label}.local` : null;
-}
-/**
- * Discover the platform's real local host label before projecting it into the
- * mDNS `.local` namespace. macOS has a dedicated Bonjour LocalHostName that
- * can differ from `os.hostname()` on managed machines. Linux prefers its
- * configured static hostname; Windows' `os.hostname()` reflects COMPUTERNAME.
- * Whether another device can resolve the resulting name is verified by the
- * client after an IP pairing succeeds.
- */
-function discoverPlatformLocalHostname(options = {}) {
-    const platform = options.platform ?? process.platform;
-    const systemHostname = options.systemHostname ?? (0,external_node_os_namespaceObject.hostname)();
-    const runCommand = options.runCommand ?? runHostnameCommand;
-    const command = platform === 'darwin'
-        ? ['scutil', ['--get', 'LocalHostName']]
-        : platform === 'linux'
-            ? ['hostnamectl', ['--static']]
-            : null;
-    if (command) {
-        try {
-            const discovered = normalizeMdnsHostname(runCommand(command[0], [...command[1]]));
-            if (discovered)
-                return discovered;
-        }
-        catch {
-            // Minimal Linux containers and older macOS installations may not have
-            // the platform helper. `os.hostname()` remains the portable fallback.
-        }
-    }
-    return normalizeMdnsHostname(systemHostname) ?? 'localhost';
-}
-function defaultCanonicalHost(options) {
-    return discoverPlatformLocalHostname(options);
-}
-function createIdentity(port, hostnameOptions) {
-    return {
-        daemonId: buildDaemonId(),
-        daemonSecret: base64Url(32),
-        displayName: defaultDisplayName(hostnameOptions),
-        canonicalHost: defaultCanonicalHost(hostnameOptions),
-        port,
-        createdAt: new Date().toISOString(),
-    };
-}
-function writeIdentity(identity, identityPath) {
-    (0,external_node_fs_namespaceObject.mkdirSync)((0,external_node_path_namespaceObject.dirname)(identityPath), { recursive: true });
-    (0,external_node_fs_namespaceObject.writeFileSync)(identityPath, `${JSON.stringify(identity, null, 2)}\n`, 'utf8');
-}
-function loadOrCreateDaemonIdentity(port, identityPath, hostnameOptions) {
-    const discoveredCanonicalHost = defaultCanonicalHost(hostnameOptions);
-    try {
-        const raw = (0,external_node_fs_namespaceObject.readFileSync)(identityPath, 'utf8');
-        const parsed = JSON.parse(raw);
-        if (typeof parsed.daemonId === 'string' &&
-            typeof parsed.daemonSecret === 'string' &&
-            typeof parsed.displayName === 'string' &&
-            typeof parsed.canonicalHost === 'string' &&
-            typeof parsed.createdAt === 'string') {
-            const identity = {
-                daemonId: parsed.daemonId,
-                daemonSecret: parsed.daemonSecret,
-                displayName: parsed.displayName,
-                canonicalHost: parsed.canonicalHost,
-                port: typeof parsed.port === 'number' && Number.isFinite(parsed.port) ? parsed.port : port,
-                createdAt: parsed.createdAt,
-            };
-            const legacyGeneratedHost = normalizeMdnsHostname(parsed.displayName);
-            if (legacyGeneratedHost &&
-                identity.canonicalHost.toLowerCase() === legacyGeneratedHost &&
-                identity.canonicalHost !== discoveredCanonicalHost) {
-                identity.canonicalHost = discoveredCanonicalHost;
-            }
-            if (identity.port !== port) {
-                identity.port = port;
-            }
-            if (identity.port !== parsed.port || identity.canonicalHost !== parsed.canonicalHost) {
-                writeIdentity(identity, identityPath);
-            }
-            return identity;
-        }
-    }
-    catch {
-        // Fall through to create a new identity.
-    }
-    const identity = createIdentity(port, hostnameOptions);
-    writeIdentity(identity, identityPath);
-    return identity;
-}
-//# sourceMappingURL=identity.js.map
-;// CONCATENATED MODULE: ../../packages/daemon-core/dist/advertised-hosts.js
-
-
-function isIpv4(address) {
-    const parts = address.split('.');
-    if (parts.length !== 4)
-        return false;
-    return parts.every((part) => /^\d+$/.test(part) && Number(part) >= 0 && Number(part) <= 255);
-}
-function isSharedIpv4(address) {
-    if (!isIpv4(address))
-        return false;
-    const [first, second] = address.split('.').map(Number);
-    return first === 100 && second >= 64 && second <= 127;
-}
-function isLinkLocalIpv4(address) {
-    if (!isIpv4(address))
-        return false;
-    const [first, second] = address.split('.').map(Number);
-    return first === 169 && second === 254;
-}
-function isBenchmarkIpv4(address) {
-    if (!isIpv4(address))
-        return false;
-    const [first, second] = address.split('.').map(Number);
-    return first === 198 && (second === 18 || second === 19);
+function isBenchmarkIpv4(address) {
+    if (!isIpv4(address))
+        return false;
+    const [first, second] = address.split('.').map(Number);
+    return first === 198 && (second === 18 || second === 19);
 }
 function isPrivateIpv4(address) {
     if (!isIpv4(address))
@@ -15959,139 +15979,199 @@ function computeAdvertisedHosts(options) {
     };
 }
 //# sourceMappingURL=advertised-hosts.js.map
-;// CONCATENATED MODULE: ../../packages/daemon-core/dist/pairing-store.js
-
-
-
-function pairing_store_base64Url(bytes) {
-    return (0,external_node_crypto_namespaceObject.randomBytes)(bytes).toString("base64url");
+;// CONCATENATED MODULE: ../../packages/daemon-core/dist/auth.js
+function firstHeaderValue(value) {
+    if (Array.isArray(value))
+        return value[0];
+    return value;
 }
-function hashToken(token) {
-    return (0,external_node_crypto_namespaceObject.createHash)("sha256").update(token).digest("hex");
+function extractClientFingerprint(req) {
+    const forwardedFor = firstHeaderValue(req.headers["x-forwarded-for"]);
+    const cfConnectingIp = firstHeaderValue(req.headers["cf-connecting-ip"]);
+    const realIp = firstHeaderValue(req.headers["x-real-ip"]);
+    const ip = forwardedFor?.split(",")[0]?.trim() ||
+        cfConnectingIp ||
+        realIp ||
+        req.socket.remoteAddress ||
+        undefined;
+    const userAgent = firstHeaderValue(req.headers["user-agent"]);
+    return {
+        ...(ip ? { ip } : {}),
+        ...(userAgent ? { userAgent } : {}),
+    };
 }
-function sameHash(left, right) {
-    const leftBuffer = Buffer.from(left);
-    const rightBuffer = Buffer.from(right);
-    if (leftBuffer.length !== rightBuffer.length)
+function isLoopbackAddress(address) {
+    if (!address)
         return false;
-    return (0,external_node_crypto_namespaceObject.timingSafeEqual)(leftBuffer, rightBuffer);
+    return (address === "127.0.0.1" ||
+        address === "::1" ||
+        address === "::ffff:127.0.0.1");
 }
-function readRecords(pairingsPath) {
-    try {
-        const raw = (0,external_node_fs_namespaceObject.readFileSync)(pairingsPath, "utf8");
-        const parsed = JSON.parse(raw);
-        if (!Array.isArray(parsed))
-            return [];
-        return parsed.filter((entry) => entry &&
-            typeof entry.deviceId === "string" &&
-            typeof entry.deviceName === "string" &&
-            typeof entry.tokenHash === "string" &&
-            typeof entry.createdAt === "string" &&
-            typeof entry.lastSeenAt === "string" &&
-            (typeof entry.revokedAt === "string" || entry.revokedAt === null));
-    }
-    catch {
-        return [];
+const PROXY_HEADER_NAMES = [
+    "x-forwarded-for",
+    "x-forwarded-host",
+    "x-forwarded-proto",
+    "x-real-ip",
+    "forwarded",
+    "via",
+    "cf-connecting-ip",
+    "cf-ray",
+];
+function isProxiedRequest(headers) {
+    for (const name of PROXY_HEADER_NAMES) {
+        if (headers[name] !== undefined)
+            return true;
     }
+    return false;
 }
-function writeRecords(pairingsPath, records) {
-    (0,external_node_fs_namespaceObject.mkdirSync)((0,external_node_path_namespaceObject.dirname)(pairingsPath), { recursive: true });
-    (0,external_node_fs_namespaceObject.writeFileSync)(pairingsPath, `${JSON.stringify(records, null, 2)}\n`, "utf8");
+function isTrustedLocalRequest(req) {
+    return (isLoopbackAddress(req.socket.remoteAddress) &&
+        !isProxiedRequest(req.headers));
 }
-class PairingStore {
-    pairingsPath;
-    records;
-    windows = new Map();
-    constructor(pairingsPath) {
-        this.pairingsPath = pairingsPath;
-        this.records = readRecords(pairingsPath);
-    }
-    list() {
-        return this.records.slice();
-    }
-    pairedCount() {
-        return this.records.filter((record) => !record.revokedAt).length;
-    }
-    openWindow(windowMs = 5 * 60_000, reusable = false) {
-        const pairingId = `pair_${pairing_store_base64Url(8)}`;
-        const pairNonce = pairing_store_base64Url(24);
-        const expiresAt = new Date(Date.now() + windowMs).toISOString();
-        const window = { pairingId, pairNonce, expiresAt, reusable };
-        this.windows.set(pairNonce, window);
-        return window;
-    }
-    consumeWindow(pairNonce) {
-        const window = this.windows.get(pairNonce);
-        if (!window)
-            return null;
-        if (!window.reusable) {
-            this.windows.delete(pairNonce);
-        }
-        if (new Date(window.expiresAt).getTime() < Date.now()) {
-            return null;
-        }
-        return window;
-    }
-    issuePairToken(deviceId, deviceName) {
-        const now = new Date().toISOString();
-        const pairToken = pairing_store_base64Url(32);
-        const nextRecord = {
-            deviceId,
-            deviceName,
-            tokenHash: hashToken(pairToken),
-            createdAt: now,
-            lastSeenAt: now,
-            revokedAt: null,
-        };
-        const existingIndex = this.records.findIndex((record) => record.deviceId === deviceId);
-        if (existingIndex >= 0) {
-            this.records[existingIndex] = nextRecord;
-        }
-        else {
-            this.records.unshift(nextRecord);
+function readBearerToken(header) {
+    if (!header)
+        return null;
+    const match = header.match(/^Bearer\s+(.+)$/i);
+    return match?.[1]?.trim() || null;
+}
+function resolveRequestToken(authHeader, queryToken) {
+    return readBearerToken(authHeader) ?? queryToken;
+}
+function isLegacyToken(token, legacyToken) {
+    return Boolean(token && legacyToken && token === legacyToken);
+}
+function isAuthorizedToken(token, legacyToken, validatePairToken, touch = true) {
+    if (!token)
+        return false;
+    if (isLegacyToken(token, legacyToken))
+        return true;
+    return Boolean(validatePairToken(token, touch));
+}
+//# sourceMappingURL=auth.js.map
+;// CONCATENATED MODULE: external "node:crypto"
+const external_node_crypto_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:crypto");
+;// CONCATENATED MODULE: ../../packages/daemon-core/dist/identity.js
+
+
+
+
+
+function base64Url(bytes) {
+    return (0,external_node_crypto_namespaceObject.randomBytes)(bytes).toString('base64url');
+}
+function buildDaemonId() {
+    return `d_${base64Url(12)}`;
+}
+function defaultDisplayName(options) {
+    return options?.systemHostname ?? (0,external_node_os_namespaceObject.hostname)();
+}
+function runHostnameCommand(command, args) {
+    return (0,external_node_child_process_namespaceObject.execFileSync)(command, args, {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+        timeout: 1_000,
+    });
+}
+function normalizeMdnsHostname(value) {
+    const raw = value.trim().replace(/\.$/, '').toLowerCase();
+    if (!raw)
+        return null;
+    const firstLabel = raw.endsWith('.local') ? raw.slice(0, -6) : raw.split('.')[0];
+    const label = firstLabel
+        .normalize('NFKD')
+        .replace(/[^a-z0-9-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 63);
+    return label ? `${label}.local` : null;
+}
+/**
+ * Discover the platform's real local host label before projecting it into the
+ * mDNS `.local` namespace. macOS has a dedicated Bonjour LocalHostName that
+ * can differ from `os.hostname()` on managed machines. Linux prefers its
+ * configured static hostname; Windows' `os.hostname()` reflects COMPUTERNAME.
+ * Whether another device can resolve the resulting name is verified by the
+ * client after an IP pairing succeeds.
+ */
+function discoverPlatformLocalHostname(options = {}) {
+    const platform = options.platform ?? process.platform;
+    const systemHostname = options.systemHostname ?? (0,external_node_os_namespaceObject.hostname)();
+    const runCommand = options.runCommand ?? runHostnameCommand;
+    const command = platform === 'darwin'
+        ? ['scutil', ['--get', 'LocalHostName']]
+        : platform === 'linux'
+            ? ['hostnamectl', ['--static']]
+            : null;
+    if (command) {
+        try {
+            const discovered = normalizeMdnsHostname(runCommand(command[0], [...command[1]]));
+            if (discovered)
+                return discovered;
         }
-        writeRecords(this.pairingsPath, this.records);
-        return pairToken;
-    }
-    validatePairToken(deviceId, token, touch = true) {
-        const record = this.records.find((entry) => entry.deviceId === deviceId && !entry.revokedAt);
-        if (!record)
-            return false;
-        const tokenDigest = hashToken(token);
-        if (!sameHash(record.tokenHash, tokenDigest))
-            return false;
-        if (touch) {
-            record.lastSeenAt = new Date().toISOString();
-            writeRecords(this.pairingsPath, this.records);
+        catch {
+            // Minimal Linux containers and older macOS installations may not have
+            // the platform helper. `os.hostname()` remains the portable fallback.
         }
-        return true;
     }
-    validateAnyPairToken(token, touch = true) {
-        const tokenDigest = hashToken(token);
-        const record = this.records.find((entry) => !entry.revokedAt && sameHash(entry.tokenHash, tokenDigest));
-        if (!record)
-            return null;
-        if (touch) {
-            record.lastSeenAt = new Date().toISOString();
-            writeRecords(this.pairingsPath, this.records);
+    return normalizeMdnsHostname(systemHostname) ?? 'localhost';
+}
+function defaultCanonicalHost(options) {
+    return discoverPlatformLocalHostname(options);
+}
+function createIdentity(port, hostnameOptions) {
+    return {
+        daemonId: buildDaemonId(),
+        daemonSecret: base64Url(32),
+        displayName: defaultDisplayName(hostnameOptions),
+        canonicalHost: defaultCanonicalHost(hostnameOptions),
+        port,
+        createdAt: new Date().toISOString(),
+    };
+}
+function writeIdentity(identity, identityPath) {
+    (0,external_node_fs_namespaceObject.mkdirSync)((0,external_node_path_namespaceObject.dirname)(identityPath), { recursive: true });
+    (0,external_node_fs_namespaceObject.writeFileSync)(identityPath, `${JSON.stringify(identity, null, 2)}\n`, 'utf8');
+}
+function loadOrCreateDaemonIdentity(port, identityPath, hostnameOptions) {
+    const discoveredCanonicalHost = defaultCanonicalHost(hostnameOptions);
+    try {
+        const raw = (0,external_node_fs_namespaceObject.readFileSync)(identityPath, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.daemonId === 'string' &&
+            typeof parsed.daemonSecret === 'string' &&
+            typeof parsed.displayName === 'string' &&
+            typeof parsed.canonicalHost === 'string' &&
+            typeof parsed.createdAt === 'string') {
+            const identity = {
+                daemonId: parsed.daemonId,
+                daemonSecret: parsed.daemonSecret,
+                displayName: parsed.displayName,
+                canonicalHost: parsed.canonicalHost,
+                port: typeof parsed.port === 'number' && Number.isFinite(parsed.port) ? parsed.port : port,
+                createdAt: parsed.createdAt,
+            };
+            const legacyGeneratedHost = normalizeMdnsHostname(parsed.displayName);
+            if (legacyGeneratedHost &&
+                identity.canonicalHost.toLowerCase() === legacyGeneratedHost &&
+                identity.canonicalHost !== discoveredCanonicalHost) {
+                identity.canonicalHost = discoveredCanonicalHost;
+            }
+            if (identity.port !== port) {
+                identity.port = port;
+            }
+            if (identity.port !== parsed.port || identity.canonicalHost !== parsed.canonicalHost) {
+                writeIdentity(identity, identityPath);
+            }
+            return identity;
         }
-        return record;
-    }
-    revoke(deviceId) {
-        const record = this.records.find((entry) => entry.deviceId === deviceId && !entry.revokedAt);
-        if (!record)
-            return false;
-        record.revokedAt = new Date().toISOString();
-        writeRecords(this.pairingsPath, this.records);
-        return true;
     }
-    reset() {
-        this.records = [];
-        this.windows.clear();
-        writeRecords(this.pairingsPath, this.records);
+    catch {
+        // Fall through to create a new identity.
     }
+    const identity = createIdentity(port, hostnameOptions);
+    writeIdentity(identity, identityPath);
+    return identity;
 }
-//# sourceMappingURL=pairing-store.js.map
+//# sourceMappingURL=identity.js.map
 ;// CONCATENATED MODULE: ../../packages/daemon-core/dist/pairing-http.js
 // Reusable HTTP pairing handlers for daemon products (Vibelet, Remosidian, ...).
 //
@@ -16225,6 +16305,7 @@ function createPairingHttpHandler(deps) {
             return;
         }
         deps.pairings.reset();
+        deps.onReset?.();
         sendJson(res, 200, { ok: true });
     };
     const tryHandle = async (req, res, pathname) => {
@@ -16247,47 +16328,352 @@ function createPairingHttpHandler(deps) {
     return { openPairing, handleOpen, handleCreate, handleReset, tryHandle };
 }
 //# sourceMappingURL=pairing-http.js.map
-;// CONCATENATED MODULE: ../../packages/daemon-core/dist/index.js
-
-
+;// CONCATENATED MODULE: ../../packages/daemon-core/dist/pairing-store.js
 
 
 
-//# sourceMappingURL=index.js.map
-;// CONCATENATED MODULE: ../../packages/remosidian-protocol/dist/assistant.js
-function isAssistantStatus(value) {
-    if (!value || typeof value !== 'object')
-        return false;
-    const v = value;
-    return (typeof v.enabled === 'boolean' &&
-        typeof v.connected === 'boolean' &&
-        typeof v.paused === 'boolean' &&
-        Number.isFinite(v.checkedAt));
+function pairing_store_base64Url(bytes) {
+    return (0,external_node_crypto_namespaceObject.randomBytes)(bytes).toString("base64url");
 }
-function isAssistantReply(value) {
-    if (!value || typeof value !== 'object')
-        return false;
-    const v = value;
-    return (typeof v.text === 'string' &&
-        v.text.length <= 30000 &&
-        Number.isFinite(v.checkedAt) &&
-        (v.receiptId === undefined || typeof v.receiptId === 'string') &&
-        (v.proposal === undefined ||
-            (typeof v.proposal === 'object' &&
-                v.proposal !== null &&
-                typeof v.proposal.id === 'string' &&
-                typeof v.proposal.description === 'string')));
+function hashToken(token) {
+    return (0,external_node_crypto_namespaceObject.createHash)("sha256").update(token).digest("hex");
 }
-//# sourceMappingURL=assistant.js.map
-;// CONCATENATED MODULE: ../../packages/remosidian-protocol/dist/assistant-signals.js
-function isAssistantSignals(value) {
-    if (!value || typeof value !== 'object')
+function sameHash(left, right) {
+    const leftBuffer = Buffer.from(left);
+    const rightBuffer = Buffer.from(right);
+    if (leftBuffer.length !== rightBuffer.length)
         return false;
-    const v = value;
-    return (typeof v.inboxEnabled === 'boolean' &&
-        typeof v.inboxDirectory === 'string' &&
-        Array.isArray(v.inbox) &&
-        v.inbox.length <= 50 &&
+    return (0,external_node_crypto_namespaceObject.timingSafeEqual)(leftBuffer, rightBuffer);
+}
+function readRecords(pairingsPath) {
+    try {
+        const raw = (0,external_node_fs_namespaceObject.readFileSync)(pairingsPath, "utf8");
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed))
+            return [];
+        return parsed.filter((entry) => entry &&
+            typeof entry.deviceId === "string" &&
+            typeof entry.deviceName === "string" &&
+            typeof entry.tokenHash === "string" &&
+            typeof entry.createdAt === "string" &&
+            typeof entry.lastSeenAt === "string" &&
+            (typeof entry.revokedAt === "string" || entry.revokedAt === null));
+    }
+    catch {
+        return [];
+    }
+}
+function writeRecords(pairingsPath, records) {
+    (0,external_node_fs_namespaceObject.mkdirSync)((0,external_node_path_namespaceObject.dirname)(pairingsPath), { recursive: true });
+    (0,external_node_fs_namespaceObject.writeFileSync)(pairingsPath, `${JSON.stringify(records, null, 2)}\n`, "utf8");
+}
+class PairingStore {
+    pairingsPath;
+    records;
+    windows = new Map();
+    constructor(pairingsPath) {
+        this.pairingsPath = pairingsPath;
+        this.records = readRecords(pairingsPath);
+    }
+    list() {
+        return this.records.slice();
+    }
+    pairedCount() {
+        return this.records.filter((record) => !record.revokedAt).length;
+    }
+    openWindow(windowMs = 5 * 60_000, reusable = false) {
+        const pairingId = `pair_${pairing_store_base64Url(8)}`;
+        const pairNonce = pairing_store_base64Url(24);
+        const expiresAt = new Date(Date.now() + windowMs).toISOString();
+        const window = { pairingId, pairNonce, expiresAt, reusable };
+        this.windows.set(pairNonce, window);
+        return window;
+    }
+    consumeWindow(pairNonce) {
+        const window = this.windows.get(pairNonce);
+        if (!window)
+            return null;
+        if (!window.reusable) {
+            this.windows.delete(pairNonce);
+        }
+        if (new Date(window.expiresAt).getTime() < Date.now()) {
+            return null;
+        }
+        return window;
+    }
+    issuePairToken(deviceId, deviceName) {
+        const now = new Date().toISOString();
+        const pairToken = pairing_store_base64Url(32);
+        const nextRecord = {
+            deviceId,
+            deviceName,
+            tokenHash: hashToken(pairToken),
+            createdAt: now,
+            lastSeenAt: now,
+            revokedAt: null,
+        };
+        const existingIndex = this.records.findIndex((record) => record.deviceId === deviceId);
+        if (existingIndex >= 0) {
+            this.records[existingIndex] = nextRecord;
+        }
+        else {
+            this.records.unshift(nextRecord);
+        }
+        writeRecords(this.pairingsPath, this.records);
+        return pairToken;
+    }
+    validatePairToken(deviceId, token, touch = true) {
+        const record = this.records.find((entry) => entry.deviceId === deviceId && !entry.revokedAt);
+        if (!record)
+            return false;
+        const tokenDigest = hashToken(token);
+        if (!sameHash(record.tokenHash, tokenDigest))
+            return false;
+        if (touch) {
+            record.lastSeenAt = new Date().toISOString();
+            writeRecords(this.pairingsPath, this.records);
+        }
+        return true;
+    }
+    validateAnyPairToken(token, touch = true) {
+        const tokenDigest = hashToken(token);
+        const record = this.records.find((entry) => !entry.revokedAt && sameHash(entry.tokenHash, tokenDigest));
+        if (!record)
+            return null;
+        if (touch) {
+            record.lastSeenAt = new Date().toISOString();
+            writeRecords(this.pairingsPath, this.records);
+        }
+        return record;
+    }
+    revoke(deviceId) {
+        const record = this.records.find((entry) => entry.deviceId === deviceId && !entry.revokedAt);
+        if (!record)
+            return false;
+        record.revokedAt = new Date().toISOString();
+        writeRecords(this.pairingsPath, this.records);
+        return true;
+    }
+    reset() {
+        this.records = [];
+        this.windows.clear();
+        writeRecords(this.pairingsPath, this.records);
+    }
+}
+//# sourceMappingURL=pairing-store.js.map
+;// CONCATENATED MODULE: external "node:fs/promises"
+const external_node_fs_promises_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:fs/promises");
+;// CONCATENATED MODULE: external "node:readline"
+const external_node_readline_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:readline");
+;// CONCATENATED MODULE: ../../packages/daemon-core/dist/remote-direct-server.js
+
+
+
+
+
+const READY_TIMEOUT_MS = 45_000;
+const PREFERRED_APP_LOOPBACK_PORT = 39_876;
+const MAX_EVENT_LINE_LENGTH = 8_192;
+function binaryFilename() {
+    const suffix = process.platform === 'win32' ? '.exe' : '';
+    return `vibelet-remote-direct-${process.platform}-${process.arch}${suffix}`;
+}
+function resolveRemoteDirectBinaryCandidates() {
+    const configured = (process.env.REMOSIDIAN_REMOTE_DIRECT_BIN || process.env.VIBELET_REMOTE_DIRECT_BIN)?.trim();
+    const entryDirectory = (0,external_node_path_namespaceObject.dirname)((0,external_node_path_namespaceObject.resolve)(process.argv[1] || process.cwd()));
+    return [
+        ...(configured ? [(0,external_node_path_namespaceObject.resolve)(configured)] : []),
+        (0,external_node_path_namespaceObject.join)(entryDirectory, 'remoteDirect', binaryFilename()),
+        (0,external_node_path_namespaceObject.resolve)(entryDirectory, '../dist/remoteDirect', binaryFilename()),
+    ];
+}
+async function resolveRemoteDirectBinary() {
+    for (const candidate of resolveRemoteDirectBinaryCandidates()) {
+        try {
+            await (0,external_node_fs_promises_namespaceObject.access)(candidate, process.platform === 'win32' ? external_node_fs_namespaceObject.constants.F_OK : external_node_fs_namespaceObject.constants.X_OK);
+            return candidate;
+        }
+        catch {
+            // Try the next deterministic packaged/development location.
+        }
+    }
+    throw new Error(`RemoteDirect sidecar is unavailable for ${process.platform}/${process.arch}`);
+}
+function redactCapability(value) {
+    return value.replace(/tc[A-Za-z0-9_-]{16,}/g, '[redacted-remoteDirect-address]').slice(0, 500);
+}
+function parseReadyEvent(line, expectedPort) {
+    if (!line || line.length > MAX_EVENT_LINE_LENGTH)
+        return null;
+    try {
+        const parsed = JSON.parse(line);
+        if (parsed.event !== 'server_ready' ||
+            typeof parsed.address !== 'string' ||
+            !parsed.address.startsWith('tc') ||
+            parsed.address.length > 4096 ||
+            parsed.port !== expectedPort) {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+class RemoteDirectServerProcess {
+    options;
+    child = null;
+    stopping = false;
+    constructor(options) {
+        this.options = options;
+    }
+    get isRunning() {
+        return Boolean(this.child && this.child.exitCode === null && this.child.signalCode === null);
+    }
+    async start() {
+        if (this.child)
+            throw new Error('RemoteDirect sidecar is already started');
+        const binary = await resolveRemoteDirectBinary();
+        this.stopping = false;
+        const child = (0,external_node_child_process_namespaceObject.spawn)(binary, [
+            'server',
+            '--target',
+            `127.0.0.1:${this.options.daemonPort}`,
+            '--remote-port',
+            String(this.options.daemonPort),
+            '--state',
+            this.options.statePath,
+        ], { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
+        this.child = child;
+        let stderr = '';
+        child.stderr.setEncoding('utf8');
+        child.stderr.on('data', (chunk) => {
+            stderr = `${stderr}${chunk}`.slice(-2_000);
+        });
+        child.once('exit', (code, signal) => {
+            if (this.child === child)
+                this.child = null;
+            if (!this.stopping)
+                this.options.onUnexpectedExit?.({ code, signal });
+        });
+        const ready = await new Promise((resolveReady, rejectReady) => {
+            const lines = (0,external_node_readline_namespaceObject.createInterface)({ input: child.stdout });
+            const timer = setTimeout(() => {
+                lines.close();
+                rejectReady(new Error('RemoteDirect sidecar startup timed out'));
+            }, READY_TIMEOUT_MS);
+            timer.unref?.();
+            const finish = (error, event) => {
+                clearTimeout(timer);
+                lines.close();
+                child.off('error', onError);
+                child.off('exit', onExitBeforeReady);
+                if (error)
+                    rejectReady(error);
+                else if (event)
+                    resolveReady(event);
+            };
+            const onError = (error) => finish(new Error(`RemoteDirect sidecar failed to launch: ${redactCapability(error.message)}`));
+            const onExitBeforeReady = (code, signal) => finish(new Error(`RemoteDirect sidecar exited before ready (${code ?? signal ?? 'unknown'}): ${redactCapability(stderr.trim())}`));
+            child.once('error', onError);
+            child.once('exit', onExitBeforeReady);
+            lines.on('line', (line) => {
+                const event = parseReadyEvent(line, this.options.daemonPort);
+                if (event)
+                    finish(undefined, event);
+            });
+        }).catch((error) => {
+            this.stop();
+            throw error;
+        });
+        return {
+            kind: 'direct',
+            host: '127.0.0.1',
+            port: PREFERRED_APP_LOOPBACK_PORT,
+            source: 'remoteDirect',
+            stability: 'stable',
+            remoteDirect: {
+                serverAddress: ready.address,
+                remotePort: ready.port,
+            },
+        };
+    }
+    stop() {
+        this.stopping = true;
+        const child = this.child;
+        this.child = null;
+        if (!child || child.exitCode !== null || child.signalCode !== null)
+            return;
+        child.kill('SIGTERM');
+        const forceTimer = setTimeout(() => {
+            if (child.exitCode === null && child.signalCode === null)
+                child.kill('SIGKILL');
+        }, 2_000);
+        forceTimer.unref?.();
+    }
+}
+//# sourceMappingURL=remote-direct-server.js.map
+;// CONCATENATED MODULE: ../../packages/daemon-core/dist/index.js
+
+
+
+
+
+
+//# sourceMappingURL=index.js.map
+;// CONCATENATED MODULE: ../../packages/remosidian-protocol/dist/assistant.js
+function isAssistantStatus(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const v = value;
+    return (typeof v.enabled === 'boolean' &&
+        typeof v.connected === 'boolean' &&
+        typeof v.paused === 'boolean' &&
+        Number.isFinite(v.checkedAt) &&
+        ['ready', 'disabled', 'paused', 'agent_offline'].includes(v.state) &&
+        (v.summary === undefined || isAssistantSummary(v.summary)));
+}
+function isAssistantSummary(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const v = value;
+    return (['total', 'active', 'paused', 'blocked', 'review', 'completed'].every((key) => Number.isSafeInteger(v[key]) && Number(v[key]) >= 0) &&
+        (v.runningGoalId === null || typeof v.runningGoalId === 'string') &&
+        Array.isArray(v.focus) &&
+        v.focus.length <= 8 &&
+        v.focus.every((goal) => goal &&
+            typeof goal.id === 'string' &&
+            typeof goal.title === 'string' &&
+            ['active', 'paused', 'blocked', 'review', 'completed'].includes(goal.status) &&
+            Number.isSafeInteger(goal.priority) &&
+            typeof goal.summary === 'string' &&
+            typeof goal.blocker === 'string' &&
+            Number.isFinite(goal.updatedAt)));
+}
+function isAssistantReply(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const v = value;
+    return (typeof v.text === 'string' &&
+        v.text.length <= 30000 &&
+        Number.isFinite(v.checkedAt) &&
+        (v.receiptId === undefined || typeof v.receiptId === 'string') &&
+        (v.proposal === undefined ||
+            (typeof v.proposal === 'object' &&
+                v.proposal !== null &&
+                typeof v.proposal.id === 'string' &&
+                typeof v.proposal.description === 'string')));
+}
+//# sourceMappingURL=assistant.js.map
+;// CONCATENATED MODULE: ../../packages/remosidian-protocol/dist/assistant-signals.js
+function isAssistantSignals(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const v = value;
+    return (typeof v.inboxEnabled === 'boolean' &&
+        typeof v.inboxDirectory === 'string' &&
+        Array.isArray(v.inbox) &&
+        v.inbox.length <= 50 &&
         v.inbox.every((x) => x &&
             typeof x.id === 'string' &&
             typeof x.goalId === 'string' &&
@@ -16300,7 +16686,7 @@ function isAssistantSignals(value) {
         v.notifications.every((x) => x &&
             typeof x.id === 'string' &&
             typeof x.goalId === 'string' &&
-            ['decision', 'review', 'failure'].includes(x.kind) &&
+            ['started', 'progress', 'decision', 'review', 'blocked', 'failure', 'completed', 'summary'].includes(x.kind) &&
             typeof x.title === 'string' &&
             typeof x.body === 'string' &&
             Number.isFinite(x.createdAt) &&
@@ -16747,8 +17133,6 @@ function parseRemosidianPush(input) {
 //# sourceMappingURL=index.js.map
 ;// CONCATENATED MODULE: external "node:events"
 const external_node_events_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:events");
-;// CONCATENATED MODULE: external "node:fs/promises"
-const external_node_fs_promises_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:fs/promises");
 ;// CONCATENATED MODULE: external "node:stream"
 const external_node_stream_namespaceObject = __WEBPACK_EXTERNAL_createRequire(import.meta.url)("node:stream");
 ;// CONCATENATED MODULE: ../../packages/remosidian-server/node_modules/readdirp/index.js
@@ -18523,7 +18907,7 @@ function createAssistantProVerifier(env = process.env, fetcher = fetch) {
     const key = env.REVENUECAT_API_KEY;
     let validUntil = 0;
     return async (customerId) => {
-        if (developmentPro && customerId === 'remosidian-local-dev')
+        if (developmentPro)
             return true;
         if (!customer || customer !== customerId || !project || !entitlement || !key)
             return false;
@@ -18675,7 +19059,9 @@ class AssistantPush {
                         !feed.notifications.every((n) => typeof n.id === 'string' &&
                             Number.isSafeInteger(n.sequence) &&
                             n.sequence > device.cursor &&
-                            ['decision', 'review', 'failure'].includes(n.kind) &&
+                            ['started', 'progress', 'decision', 'review', 'blocked', 'failure', 'completed', 'summary'].includes(n.kind) &&
+                            typeof n.title === 'string' &&
+                            typeof n.body === 'string' &&
                             typeof n.read === 'boolean'))
                         throw Error('Invalid notice feed');
                     for (const notice of feed.notifications) {
@@ -18683,6 +19069,7 @@ class AssistantPush {
                             device.queue.push({
                                 noticeId: notice.id,
                                 sequence: notice.sequence,
+                                title: notice.title.slice(0, 120),
                                 state: 'queued',
                                 attempts: 0,
                                 nextAt: this.now(),
@@ -18730,8 +19117,8 @@ class AssistantPush {
         try {
             const result = await this.request('send', {
                 to: device.token,
-                title: 'Remosidian 个人助理',
-                body: '有新的任务进展需要你查看。',
+                title: ticket.title || 'Remosidian Personal Agent',
+                body: '打开置顶会话查看详情。',
                 sound: 'default',
                 channelId: 'personal-assistant',
                 data: {
@@ -30506,12 +30893,12 @@ class RemosidianAssistant {
                 (0,external_node_path_namespaceObject.join)((0,external_node_os_namespaceObject.homedir)(), 'Library', 'Application Support', 'LifeOS Agent');
         this.port = options.agentPort ?? Number(process.env.LIFEOS_AGENT_PORT || 4317);
         if (!Number.isInteger(this.port) || this.port < 1024 || this.port > 65535)
-            throw new Error('助理端口无效。');
+            throw new Error('Personal Agent 端口无效。');
         this.ready = (0,external_node_fs_promises_namespaceObject.readFile)((0,external_node_path_namespaceObject.join)(options.dataDir, 'assistant-settings.json'), 'utf8')
             .then((raw) => {
             const ids = JSON.parse(raw);
             if (!Array.isArray(ids) || !ids.every((id) => typeof id === 'string'))
-                throw new Error('助理设置无效。');
+                throw new Error('Personal Agent 设置无效。');
             this.enabled = new Set(ids);
         })
             .catch((error) => {
@@ -30538,7 +30925,7 @@ class RemosidianAssistant {
     async handle(req, signal) {
         await this.ready;
         if (this.loadError)
-            throw new Error('个人助理设置无法读取，请在电脑端检查。');
+            throw new Error('Personal Agent 设置无法读取，请在电脑端检查。');
         const vault = this.options.config.vaults.find((v) => v.id === req.vaultId);
         if (!vault)
             throw new VaultRequestError('找不到这个知识库。', 'not_found');
@@ -30555,16 +30942,16 @@ class RemosidianAssistant {
         }
         // A lapse must not trap users into leaving automatic work running.
         if (!pro && !disabling)
-            throw new VaultRequestError('个人助理需要有效的 Remosidian Pro 权限；请检查电脑端的订阅验证配置。', 'forbidden');
+            throw new VaultRequestError('Personal Agent 需要有效的 Remosidian Pro 权限；请检查电脑端的订阅验证配置。', 'forbidden');
         if (req.op === 'assistant.status')
             return this.status(req.vaultId, vault.root, signal);
         if (this.busy)
-            throw new Error('助理正在处理上一条请求，请稍后重试。');
+            throw new Error('Personal Agent 正在处理上一条请求，请稍后重试。');
         this.busy = true;
         try {
             if (req.op === 'assistant.push.register') {
                 if (req.enabled && !this.enabled.has(req.vaultId))
-                    throw Error('请先开启个人助理。');
+                    throw Error('请先开启 Personal Agent。');
                 const dashboard = req.enabled
                     ? (await this.call(vault.root, '/api/dashboard', signal))
                     : null;
@@ -30580,7 +30967,7 @@ class RemosidianAssistant {
                 if (req.enabled) {
                     await this.call(vault.root, '/api/dashboard', signal);
                     if (req.pause)
-                        throw new Error('开启助理时不能同时暂停后台。');
+                        throw new Error('开启 Personal Agent 时不能同时暂停后台。');
                 }
                 // Persist disabling first. If pause fails, control remains disabled and the error is explicit.
                 const next = new Set(this.enabled);
@@ -30595,7 +30982,7 @@ class RemosidianAssistant {
                 return this.status(req.vaultId, vault.root, signal);
             }
             if (!this.enabled.has(req.vaultId))
-                throw new VaultRequestError('请先在设置中开启个人助理。', 'forbidden');
+                throw new VaultRequestError('请先在设置中开启 Personal Agent。', 'forbidden');
             if (req.op === 'assistant.signals' ||
                 req.op === 'assistant.inbox.configure' ||
                 req.op === 'assistant.notice.read') {
@@ -30626,7 +31013,7 @@ class RemosidianAssistant {
                 : { vaultRoot: vault.root, proposalId: req.proposalId };
             const reply = await this.call(vault.root, path, signal, input);
             if (!isAssistantReply(reply))
-                throw new Error('电脑返回的助理结果格式无效。');
+                throw new Error('电脑返回的 Personal Agent 结果格式无效。');
             return reply;
         }
         finally {
@@ -30636,15 +31023,50 @@ class RemosidianAssistant {
     async status(vaultId, root, signal) {
         try {
             const result = (await this.call(root, '/api/dashboard', signal));
+            const goals = Array.isArray(result.goals) ? result.goals : [];
+            const counts = (status) => goals.filter((goal) => goal.status === status).length;
+            const enabled = this.enabled.has(vaultId);
+            const paused = result.settings.paused;
             return {
-                enabled: this.enabled.has(vaultId),
+                enabled,
                 connected: true,
-                paused: result.settings.paused,
+                paused,
                 checkedAt: Date.now(),
+                state: !enabled ? 'disabled' : paused ? 'paused' : 'ready',
+                summary: {
+                    total: goals.length,
+                    active: counts('active'),
+                    paused: counts('paused'),
+                    blocked: counts('blocked'),
+                    review: counts('review'),
+                    completed: counts('completed'),
+                    runningGoalId: result.runningGoalId,
+                    focus: goals
+                        .filter((goal) => goal.status !== 'completed')
+                        .sort((a, b) => Number(b.id === result.runningGoalId) - Number(a.id === result.runningGoalId) ||
+                        a.priority - b.priority ||
+                        b.updatedAt - a.updatedAt)
+                        .slice(0, 4)
+                        .map((goal) => ({
+                        id: goal.id,
+                        title: goal.title.slice(0, 160),
+                        status: goal.status,
+                        priority: goal.priority,
+                        summary: goal.summary.slice(0, 500),
+                        blocker: goal.blocker.slice(0, 500),
+                        updatedAt: goal.updatedAt,
+                    })),
+                },
             };
         }
         catch {
-            return { enabled: this.enabled.has(vaultId), connected: false, paused: false, checkedAt: Date.now() };
+            return {
+                enabled: this.enabled.has(vaultId),
+                connected: false,
+                paused: false,
+                checkedAt: Date.now(),
+                state: 'agent_offline',
+            };
         }
     }
     async save(next) {
@@ -30657,7 +31079,7 @@ class RemosidianAssistant {
     async call(root, path, signal, body, method = 'POST') {
         const token = (await (0,external_node_fs_promises_namespaceObject.readFile)((0,external_node_path_namespaceObject.join)(this.agentDataDir, 'remosidian-bridge.token'), 'utf8')).trim();
         if (!/^[a-f0-9]{64}$/u.test(token))
-            throw new Error('本机助理凭据无效。');
+            throw new Error('本机 Personal Agent 凭据无效。');
         const response = await fetch(`http://127.0.0.1:${this.port}${path}`, {
             method: body === undefined ? 'GET' : method,
             headers: {
@@ -30671,7 +31093,7 @@ class RemosidianAssistant {
         });
         const result = (await response.json());
         if (!response.ok)
-            throw new Error(result.error || '无法连接电脑上的个人助理。');
+            throw new Error(result.error || '无法连接电脑上的 Personal Agent。');
         if (path === '/api/dashboard' &&
             (!result.settings?.vault || (await (0,external_node_fs_promises_namespaceObject.realpath)(result.settings.vault)) !== (await (0,external_node_fs_promises_namespaceObject.realpath)(root))))
             throw new Error('知识库连接不一致。');
@@ -33416,7 +33838,7 @@ function runFileBackedPluginTurn(input, prompt, options, onDelta) {
 }
 //# sourceMappingURL=chat-plugin-runtime.js.map
 ;// CONCATENATED MODULE: ../../packages/remosidian-server/dist/version.js
-const VERSION = '0.1.12';
+const VERSION = '0.1.13';
 //# sourceMappingURL=version.js.map
 ;// CONCATENATED MODULE: ../../packages/remosidian-server/dist/chat-runtime.js
 
@@ -34263,6 +34685,30 @@ class RemosidianProtocolMetrics {
     }
 }
 //# sourceMappingURL=protocol-metrics.js.map
+;// CONCATENATED MODULE: ../../packages/remosidian-server/dist/remote-direct-transport.js
+
+
+
+async function startRemoteDirectTransport(instance, options, port) {
+    const transport = options.remoteDirect
+        ? new RemoteDirectServerProcess({
+            daemonPort: port,
+            statePath: (0,external_node_path_namespaceObject.join)(createRemosidianPaths(options.dataDir).dataDir, 'remote-direct-server.json'),
+            onUnexpectedExit: () => instance.setRemoteDirectConnection(null),
+        })
+        : null;
+    try {
+        if (transport)
+            instance.setRemoteDirectConnection(await transport.start());
+    }
+    catch (error) {
+        await new Promise((resolve) => instance.webSocketServer.close(() => instance.httpServer.close(() => resolve())));
+        await instance.dispose();
+        throw error;
+    }
+    return transport;
+}
+//# sourceMappingURL=remote-direct-transport.js.map
 ;// CONCATENATED MODULE: ../../packages/remosidian-server/dist/request-handler.js
 
 
@@ -34310,7 +34756,7 @@ async function handleRemosidianRequest(req, vaultService, chatService, conversat
         case 'assistant.notice.read':
         case 'assistant.push.register':
             if (!context.assistant)
-                return invalidResponse(req.id, '此服务器尚未支持个人助理，请更新电脑端。');
+                return invalidResponse(req.id, '此服务器尚未支持 Personal Agent，请更新电脑端。');
             return okResponse(req.id, await context.assistant.handle(req, context.signal));
         case 'vault.list':
             return okResponse(req.id, await vaultService.list(req.vaultId, req.dir));
@@ -34754,6 +35200,7 @@ const _parseCodexRateLimitsForTesting = (/* unused pure expression or super */ n
 
 
 
+
 function server_sendJson(res, statusCode, data) {
     const body = `${JSON.stringify(data)}\n`;
     res.writeHead(statusCode, {
@@ -34923,13 +35370,19 @@ function createRemosidianServer(options = {}) {
         subscriptionWatchers.delete(key);
         void existing.watcher.close();
     };
+    let remoteDirectConnection = null;
     const startedAt = Date.now();
-    const getAdvertisedConnectionTarget = () => computeAdvertisedConnectionTarget({
-        canonicalHost: advertisedHosts.canonicalHost,
-        fallbackHosts: advertisedHosts.fallbackHosts,
-        port: config.server.port,
-        relayUrl,
-    });
+    const getAdvertisedConnectionTarget = () => {
+        const target = computeAdvertisedConnectionTarget({
+            canonicalHost: advertisedHosts.canonicalHost,
+            fallbackHosts: advertisedHosts.fallbackHosts,
+            port: config.server.port,
+            relayUrl,
+        });
+        return remoteDirectConnection
+            ? { ...target, connections: [remoteDirectConnection, ...target.connections] }
+            : target;
+    };
     const buildHealth = () => {
         const target = getAdvertisedConnectionTarget();
         return {
@@ -34940,6 +35393,7 @@ function createRemosidianServer(options = {}) {
             canonicalHost: target.canonicalHost,
             fallbackHosts: target.fallbackHosts,
             port: target.port,
+            remoteDirect: { enabled: options.remoteDirect === true, running: Boolean(remoteDirectConnection) },
             runtime: hostRuntime,
             ...(relayUrl ? { relayUrl } : {}),
             connections: target.connections,
@@ -34952,6 +35406,9 @@ function createRemosidianServer(options = {}) {
             wsClients: webSocketServer.clients.size,
             protocol: protocolMetrics.snapshot(),
             uptimeSeconds: Math.round((Date.now() - startedAt) / 1000),
+            features: {
+                personalAgent: config.server.features?.personalAgent === true,
+            },
             ai: chatService.configured
                 ? {
                     configured: true,
@@ -35144,6 +35601,9 @@ function createRemosidianServer(options = {}) {
         identity,
         pairings,
         advertisedHosts,
+        setRemoteDirectConnection: (target) => {
+            remoteDirectConnection = target;
+        },
         dispose: async () => {
             await assistant.close();
             await Promise.all([...subscriptionWatchers.values()].map((entry) => entry.watcher.close()));
@@ -35170,10 +35630,14 @@ async function startRemosidianServer(options = {}) {
     });
     const address = instance.httpServer.address();
     const port = address?.port ?? listenPort;
+    instance.config.server.port = port;
+    const transport = await startRemoteDirectTransport(instance, options, port);
     return {
         ...instance,
         port,
         close: async () => {
+            transport?.stop();
+            instance.setRemoteDirectConnection(null);
             await new Promise((resolve, reject) => {
                 // WebSocketServer.close waits for clients; mobile clients can otherwise
                 // keep plugin stop/restart pending indefinitely.
@@ -36306,10 +36770,11 @@ function applyConnectionConfig(config, { relayUrl, advertisedHost, fallbackHosts
           ...(localOnly ? { localOnly: true } : {}),
         }
       : currentAdvertisedHosts;
+  const { relayUrl: _savedRelay, ...server } = config.server ?? {};
   return {
     ...config,
     server: {
-      ...config.server,
+      ...server,
       advertisedHosts,
       ...(relayUrl && !localOnly ? { relayUrl } : {}),
     },
@@ -36337,6 +36802,7 @@ async function resolveRelayForStart(
   const advertisedHost = isWildcardBindHost(flags.host) ? '' : normalizeOptionalString(flags.host);
   const fallbackHosts = readCsvList(flags['fallback-hosts']);
   const shouldManageTunnel =
+    flags.cloudflare === true &&
     !localOnly &&
     explicitRelay === null &&
     !advertisedHost &&
@@ -36374,7 +36840,7 @@ async function resolveRelayForStart(
         clearRelayConfig(relayConfigPath);
         process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
         process.stderr.write(
-          `Continuing with LAN/local pairing. Use \`npx ${ALIAS_NPM_PACKAGE} start --force\` after fixing Cloudflare Tunnel, or pass --relay=<url> for a custom tunnel.\n`,
+          `Continuing with Remote Direct and LAN pairing. Use \`npx ${ALIAS_NPM_PACKAGE} start --cloudflare --force\` after fixing Cloudflare Tunnel, or pass --relay=<url> for a custom tunnel.\n`,
         );
       }
     }
@@ -36389,7 +36855,8 @@ async function resolveRelayForStart(
   }
 
   const ignoreSavedRelay =
-    explicitRelay === null && (Boolean(advertisedHost) || fallbackHosts.length > 0 || managedTunnelFailed);
+    explicitRelay === null &&
+    (flags.cloudflare !== true || Boolean(advertisedHost) || fallbackHosts.length > 0 || managedTunnelFailed);
   const relayUrl =
     explicitRelay !== null
       ? explicitRelay
@@ -36399,75 +36866,17 @@ async function resolveRelayForStart(
 
 
 
-;// CONCATENATED MODULE: ./bin/remosidian.mjs
-
-
-
-
-
-
-
-
-
-
-
-
+function shouldRestartDaemon(health, flags, environment = process.env) {
+  if (flags.force === true) return true;
+  const remoteDirect = flags.local !== true;
+  if (health.remoteDirect?.enabled !== remoteDirect || (remoteDirect && health.remoteDirect?.running !== true))
+    return true;
+  const wantsRelay = flags.cloudflare === true || Boolean(flags.relay) || Boolean(environment.REMOSIDIAN_RELAY_URL);
+  return Boolean(health.relayUrl) !== wantsRelay;
+}
 
-
-const remosidian_PROG = 'remosidian';
-const PRIMARY_NPM_PACKAGE = '@remosidian/cli';
-const remosidian_ALIAS_NPM_PACKAGE = 'remosidian';
-
-function helpText() {
-  return [
-    `${remosidian_PROG} v${VERSION} — remote vault server for Obsidian / LifeOS`,
-    '',
-    'Package names:',
-    `  ${PRIMARY_NPM_PACKAGE}`,
-    `  ${remosidian_ALIAS_NPM_PACKAGE}`,
-    '',
-    'Usage:',
-    `  npx ${remosidian_ALIAS_NPM_PACKAGE}             Start the current directory as a vault`,
-    `  npx ${remosidian_ALIAS_NPM_PACKAGE} <command> [options]`,
-    `  ${remosidian_PROG} <command> [options]`,
-    '',
-    'Commands:',
-    '  start                Start or reuse the Remosidian background daemon',
-    '  pair                 Open a one-time pairing window and print a QR code',
-    '  status               Print the running daemon health snapshot',
-    '  stop                 Stop the background daemon',
-    '  reset-pairings       Revoke every paired device (local only)',
-    '  init                 Create ~/.remosidian/config.json interactively',
-    '  help                 Show this help',
-    '',
-    'Global options:',
-    '  --data-dir <path>    Override $REMOSIDIAN_HOME (default: ~/.remosidian)',
-    '  --config <path>      Override $REMOSIDIAN_CONFIG (default: <data-dir>/config.json)',
-    '  --version            Print version and exit',
-    '',
-    'start options:',
-    '  --vault <id>:<path>  Use an ad-hoc vault instead of the config file',
-    '                       (repeatable; id defaults to folder name)',
-    '  --port <number>      Listen on this TCP port (default 41234)',
-    '  --access=local      LAN/local only; skip Cloudflare Tunnel and saved relay config',
-    '  --access=remote     Use the default managed Cloudflare Tunnel path',
-    '  --access=https://<url>',
-    '                       Use a custom relay URL for remote access',
-    '  --access=<host>[,<fallback>]',
-    '                       Use direct LAN/Tailscale hosts',
-    '  --access=           Clear the saved relay URL for this run',
-    '  --force              Restart the managed Cloudflare Tunnel before startup',
-    '  --bind <address>     Bind to this interface (default 0.0.0.0)',
-    '  --agent <name>       AI agent for /Ask: claude or codex (auto-detects)',
-    '  --agent-path <path>  Override the agent binary path',
-    '  --foreground         Run the server in the foreground',
-    '  --json               Emit a single JSON line instead of human output',
-    '  --no-qr              Skip the pairing QR on startup',
-    '',
-    'Legacy access aliases still work:',
-    '  --local, --remote, --tunnel, --relay <url>, --host <address>, --fallback-hosts <x>',
-  ].join('\n');
-}
+;// CONCATENATED MODULE: ./bin/cli-args.mjs
+const cli_args_PROG = 'remosidian';
 
 function parseArgs(argv) {
   const args = { positionals: [], flags: {}, vaults: [] };
@@ -36498,8 +36907,8 @@ function parseArgs(argv) {
   return args;
 }
 
-function failUsage(message, details = '') {
-  process.stderr.write(`[${remosidian_PROG}] ${message}\n`);
+function cli_args_failUsage(message, details = '') {
+  process.stderr.write(`[${cli_args_PROG}] ${message}\n`);
   if (details) {
     process.stderr.write(`${details}\n`);
   }
@@ -36566,7 +36975,7 @@ function normalizeAccessHost(host) {
     .toLowerCase();
 }
 
-function parseAccessValue(rawValue, fail = failUsage) {
+function parseAccessValue(rawValue, fail = cli_args_failUsage) {
   if (rawValue === true) {
     fail('--access requires an argument (e.g. --access=local)');
   }
@@ -36648,7 +37057,7 @@ function normalizePortValue(rawValue) {
   return parsed;
 }
 
-function parsePortFlag(flags, fail = failUsage) {
+function parsePortFlag(flags, fail = cli_args_failUsage) {
   if (!hasOwnFlag(flags, 'port')) return null;
   if (flags.port === true) {
     fail('--port requires an argument (e.g. --port 41234)');
@@ -36661,7 +37070,7 @@ function parsePortFlag(flags, fail = failUsage) {
   return parsed;
 }
 
-function validateLegacyAccessValues(flags, fail = failUsage) {
+function validateLegacyAccessValues(flags, fail = cli_args_failUsage) {
   for (const name of ['relay', 'host', 'fallback-hosts']) {
     if (flags[name] === true) {
       const hint =
@@ -36671,10 +37080,22 @@ function validateLegacyAccessValues(flags, fail = failUsage) {
   }
 }
 
-function normalizeCliFlags(flags, env = process.env, fail = failUsage) {
+function resolvePersonalAgentOverride(flags, fail = cli_args_failUsage) {
+  const enable = hasOwnFlag(flags, 'personal-agent') || hasOwnFlag(flags, 'pa');
+  const disable = hasOwnFlag(flags, 'no-personal-agent') || hasOwnFlag(flags, 'no-pa');
+  if (enable && disable) {
+    fail('Do not combine Personal Agent enable and disable flags.');
+  }
+  if (enable) return true;
+  if (disable) return false;
+  return undefined;
+}
+
+function normalizeCliFlags(flags, env = process.env, fail = cli_args_failUsage) {
   const normalized = { ...flags };
   applyNpmConfigArgFallback(normalized, 'port', env);
   applyNpmConfigFlagFallback(normalized, 'force', env);
+  applyNpmConfigFlagFallback(normalized, 'cloudflare', env);
 
   const hasAccessFlag = hasOwnFlag(normalized, 'access');
   const envAccessValue = hasAccessFlag ? null : readNpmConfigArg('access', env);
@@ -36707,6 +37128,7 @@ function normalizeCliFlags(flags, env = process.env, fail = failUsage) {
   delete normalized.tunnel;
   validateLegacyAccessValues(normalized, fail);
   parsePortFlag(normalized, fail);
+  resolvePersonalAgentOverride(normalized, fail);
   return normalized;
 }
 
@@ -36728,326 +37150,91 @@ function resolveInvocation(argv) {
   return { command, rest, useCurrentDirectoryVault: false };
 }
 
-function resolveEntrypointHref(path) {
-  if (!path) return '';
-  try {
-    return (0,external_node_url_namespaceObject.pathToFileURL)((0,external_node_fs_namespaceObject.realpathSync)((0,external_node_path_namespaceObject.resolve)(path))).href;
-  } catch {
-    return (0,external_node_url_namespaceObject.pathToFileURL)((0,external_node_path_namespaceObject.resolve)(path)).href;
-  }
-}
-
-function expandVaultSpec(spec) {
-  if (spec.trim().length === 0) return null;
-  const colon = spec.indexOf(':');
-  let id = '';
-  let root = spec;
-  if (colon > 0 && !/^[a-zA-Z]:[\\/]/.test(spec)) {
-    id = spec.slice(0, colon).trim();
-    root = spec.slice(colon + 1);
-  }
-  if (root.trim().length === 0) return null;
-  const resolved = resolveUserPath(root);
-  if (!id) {
-    id = resolved.split(/[\\/]/).filter(Boolean).pop() ?? 'vault';
-  }
-  return {
-    id,
-    name: id,
-    root: resolved,
-    ignored: ['.obsidian/**', '.git/**', '.DS_Store', '*.swp', '*.tmp'],
-  };
-}
-
-function loadConfigOrNull(paths) {
-  if (!(0,external_node_fs_namespaceObject.existsSync)(paths.configPath)) {
-    return null;
-  }
-  try {
-    return JSON.parse((0,external_node_fs_namespaceObject.readFileSync)(paths.configPath, 'utf8'));
-  } catch (error) {
-    console.error(`[${remosidian_PROG}] failed to read ${paths.configPath}: ${error?.message ?? error}`);
-    process.exit(2);
-  }
-}
-
-function resolvePaths(flags) {
-  const dataDir = typeof flags['data-dir'] === 'string' ? flags['data-dir'] : undefined;
-  const configPath = typeof flags['config'] === 'string' ? flags['config'] : undefined;
-  if (configPath) {
-    const paths = createRemosidianPaths(dataDir ?? process.env.REMOSIDIAN_HOME ?? '~/.remosidian');
-    return { ...paths, configPath: resolveUserPath(configPath) };
-  }
-  return createRemosidianPaths(dataDir ?? process.env.REMOSIDIAN_HOME ?? '~/.remosidian');
-}
-
-function createRuntimePaths(paths) {
-  const runtimeDir = (0,external_node_path_namespaceObject.join)(paths.dataDir, 'runtime', 'current');
-  const logDir = (0,external_node_path_namespaceObject.join)(paths.dataDir, 'logs');
-  return {
-    runtimeDir,
-    runtimeEntryPath: (0,external_node_path_namespaceObject.join)(runtimeDir, 'dist', 'remosidian.mjs'),
-    pidPath: (0,external_node_path_namespaceObject.join)(paths.dataDir, 'daemon.pid'),
-    logDir,
-    stdoutLogPath: (0,external_node_path_namespaceObject.join)(logDir, 'daemon.stdout.log'),
-    stderrLogPath: (0,external_node_path_namespaceObject.join)(logDir, 'daemon.stderr.log'),
-    pairingQrPath: (0,external_node_path_namespaceObject.join)(paths.dataDir, 'pairing-qr.png'),
-    pairingCodePath: (0,external_node_path_namespaceObject.join)(paths.dataDir, 'pairing-code.txt'),
-  };
-}
-
-function readPidFile(pidPath) {
-  try {
-    const pid = Number((0,external_node_fs_namespaceObject.readFileSync)(pidPath, 'utf8').trim());
-    return Number.isFinite(pid) && pid > 0 ? pid : null;
-  } catch {
-    return null;
-  }
-}
-
-function writePidFile(pidPath, pid) {
-  (0,external_node_fs_namespaceObject.mkdirSync)((0,external_node_path_namespaceObject.dirname)(pidPath), { recursive: true });
-  (0,external_node_fs_namespaceObject.writeFileSync)(pidPath, `${pid}\n`, 'utf8');
-}
-
-function removePidFile(pidPath) {
-  (0,external_node_fs_namespaceObject.rmSync)(pidPath, { force: true });
-}
-
-function remosidian_isProcessAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function currentEntrypointPath() {
-  const entryPath = (0,external_node_url_namespaceObject.fileURLToPath)(import.meta.url);
-  try {
-    return (0,external_node_fs_namespaceObject.realpathSync)(entryPath);
-  } catch {
-    return entryPath;
-  }
-}
-
-function installRuntime(paths) {
-  const runtime = createRuntimePaths(paths);
-  (0,external_node_fs_namespaceObject.mkdirSync)((0,external_node_path_namespaceObject.dirname)(runtime.runtimeEntryPath), { recursive: true });
-  (0,external_node_fs_namespaceObject.copyFileSync)(currentEntrypointPath(), runtime.runtimeEntryPath);
-  (0,external_node_fs_namespaceObject.chmodSync)(runtime.runtimeEntryPath, 0o755);
-  return runtime;
-}
-
-function resolveRequestedPort(flags, paths) {
-  return parsePortFlag(flags) ?? loadConfigOrNull(paths)?.server?.port ?? 41234;
-}
-
-function renderQrTerminal(payload) {
-  return new Promise((resolveTerm, rejectTerm) => {
-    lib.toString(payload, { type: 'terminal', small: true, errorCorrectionLevel: 'M' }, (err, str) => {
-      if (err) {
-        rejectTerm(err);
-        return;
-      }
-      resolveTerm(str);
-    });
-  });
-}
-
-async function writeQrPng(payload, filePath) {
-  (0,external_node_fs_namespaceObject.mkdirSync)((0,external_node_path_namespaceObject.dirname)(filePath), { recursive: true });
-  await lib.toFile(filePath, payload, { type: 'png', errorCorrectionLevel: 'M', margin: 1, scale: 8 });
-}
-
-function printHumanHealth(health) {
-  const lines = [];
-  lines.push(`Daemon       ${health.daemonId} (${health.displayName})`);
-  lines.push(`Version      ${health.version}`);
-  if (health.runtime) {
-    lines.push(`Runtime      ${health.runtime === 'cli' ? 'CLI' : 'Obsidian plugin'}`);
-  }
-  lines.push(`Listening    http://${health.canonicalHost}:${health.port}`);
-  if (health.relayUrl) {
-    lines.push(`Relay        ${health.relayUrl}`);
-  }
-  if (Array.isArray(health.fallbackHosts) && health.fallbackHosts.length > 0) {
-    lines.push(`Fallbacks    ${health.fallbackHosts.join(', ')}`);
-  }
-  if (Array.isArray(health.connections) && health.connections.length > 0) {
-    lines.push('Connections:');
-    for (const conn of health.connections) {
-      const proto = conn.secure ? 'wss' : 'ws';
-      lines.push(`  - ${proto}://${conn.host}:${conn.port} (${conn.source}, ${conn.stability})`);
-    }
-  }
-  if (Array.isArray(health.vaults) && health.vaults.length > 0) {
-    lines.push('Vaults:');
-    for (const vault of health.vaults) {
-      lines.push(`  - ${vault.id}: ${vault.root ?? '(unknown root)'}`);
-    }
-  } else {
-    lines.push('Vaults:      (none configured — pass --vault or run `remosidian init`)');
-  }
-  lines.push(`Paired       ${health.pairedDevices ?? 0} device(s)`);
-  if (health.ai?.configured) {
-    lines.push(`AI           ${health.ai.agent ?? 'agent'} (local CLI)`);
-  } else {
-    lines.push('AI           (no claude / codex CLI on PATH — install one to enable Ask)');
-  }
-  return lines.join('\n');
-}
-
-function buildPairUri(payload) {
-  // Emit the full schema so @lifeos/client-core's default parser picks it
-  // up. We chose JSON-over-base64url because it survives clipboard paste,
-  // deep links, and QR data URIs without escaping headaches.
-  const full = {
-    type: payload.type,
-    daemonId: payload.daemonId,
-    displayName: payload.displayName,
-    canonicalHost: payload.canonicalHost,
-    port: payload.port,
-    ...(payload.fallbackHosts && payload.fallbackHosts.length > 0 ? { fallbackHosts: payload.fallbackHosts } : {}),
-    ...(payload.connections && payload.connections.length > 0 ? { connections: payload.connections } : {}),
-    pairNonce: payload.pairNonce,
-    expiresAt: payload.expiresAt,
-    ...(payload.runtime ? { runtime: payload.runtime } : {}),
-    ...(payload.vaults && payload.vaults.length > 0 ? { vaults: payload.vaults } : {}),
-  };
-  const encoded = Buffer.from(JSON.stringify(full), 'utf8').toString('base64url');
-  return `remosidian://pair?v=1&data=${encoded}`;
-}
-
-function normalizePairingConnections(payload) {
-  const explicitConnections = Array.isArray(payload.connections)
-    ? payload.connections
-        .filter(
-          (target) =>
-            target &&
-            typeof target.host === 'string' &&
-            Number.isFinite(target.port) &&
-            typeof target.source === 'string' &&
-            typeof target.stability === 'string',
-        )
-        .map((target) => ({
-          kind: target.kind === 'relay' ? 'relay' : 'direct',
-          host: target.host.trim(),
-          port: Math.floor(Number(target.port)),
-          ...(target.secure === true ? { secure: true } : {}),
-          source: target.source,
-          stability: target.stability,
-        }))
-        .filter((target) => target.host && target.port > 0)
-    : [];
-  if (explicitConnections.length > 0) {
-    return explicitConnections;
-  }
-  const fallbackHosts = Array.isArray(payload.fallbackHosts)
-    ? payload.fallbackHosts.filter((host) => typeof host === 'string' && host.trim()).map((host) => host.trim())
-    : [];
-  const port = Number.isFinite(payload.port) && payload.port > 0 ? Math.floor(payload.port) : 41234;
-  return [
-    {
-      kind: 'direct',
-      host: payload.canonicalHost,
-      port,
-      source: 'configured_host',
-      stability: 'stable',
-    },
-    ...fallbackHosts.map((host) => ({
-      kind: 'direct',
-      host,
-      port,
-      source: 'fallback',
-      stability: 'stable',
-    })),
-  ];
-}
-
-function createCompactPairingPayload(payload) {
-  const compact = {
-    t: 'rp',
-    d: payload.daemonId,
-    n: payload.displayName,
-    h: payload.canonicalHost,
-    p: payload.port,
-    c: payload.pairNonce,
-    e: payload.expiresAt,
-  };
-  if (Array.isArray(payload.fallbackHosts) && payload.fallbackHosts.length > 0) {
-    compact.f = payload.fallbackHosts;
-  }
-  const connections = normalizePairingConnections(payload);
-  if (connections.length > 0) {
-    compact.o = connections.map((target) => [
-      target.kind,
-      target.host,
-      target.port,
-      target.source,
-      target.stability,
-      target.secure === true,
-    ]);
-  }
-  if (payload.runtime) {
-    compact.r = payload.runtime;
-  }
-  if (Array.isArray(payload.vaults) && payload.vaults.length > 0) {
-    compact.v = payload.vaults;
-  }
-  return compact;
-}
-
-function buildPairCode(payload) {
-  return JSON.stringify(createCompactPairingPayload(payload));
-}
-
-function buildPairDeepLink(pairingCode) {
-  return `remosidian://pair?data=${encodeURIComponent(pairingCode)}`;
-}
-
-function formatConnectionSummary(target) {
-  const scheme = target.secure === true || target.port === 443 ? 'https' : 'http';
-  return `${scheme}://${target.host}:${target.port} (${target.source}, ${target.stability})`;
-}
-
-async function printPairingQr(pairingPayload, paths) {
-  const runtime = createRuntimePaths(paths);
-  const pairingCode = buildPairCode(pairingPayload);
-  const deepLink = buildPairDeepLink(pairingCode);
-  const qr = await renderQrTerminal(pairingCode);
-  (0,external_node_fs_namespaceObject.writeFileSync)(runtime.pairingCodePath, `${pairingCode}\n`, 'utf8');
-  await writeQrPng(pairingCode, runtime.pairingQrPath).catch(() => undefined);
-  process.stdout.write(`\nScan this QR code with the Remosidian app:\n\n${qr}\n`);
-  process.stdout.write(`If the terminal QR is hard to scan, open this PNG instead:\n${runtime.pairingQrPath}\n`);
-  process.stdout.write(`If this device cannot scan, paste this pairing code in Remosidian:\n${pairingCode}\n`);
-  process.stdout.write(`Pairing code saved to:\n${runtime.pairingCodePath}\n`);
-  process.stdout.write(`Or open this deep link on a device with Remosidian installed:\n${deepLink}\n`);
-}
-
-async function printPairingSummary(port, paths, health = null, flags = {}) {
-  const healthPayload = health ?? (await waitForHealth(port));
-  if (flags.json) {
-    process.stdout.write(`${JSON.stringify({ ok: true, ...healthPayload })}\n`);
-    return;
-  }
-  process.stdout.write(`Remosidian daemon is ready.\n\n`);
-  process.stdout.write(`${printHumanHealth(healthPayload)}\n`);
-  if (flags['no-qr']) {
-    return;
+function buildServeArgs(flags) {
+  const args = ['serve'];
+  for (const vault of flags.__vaults ?? []) {
+    args.push('--vault', vault);
   }
-  const pairingPayload = await postJson(port, '/pair/open');
-  const connections = normalizePairingConnections(pairingPayload);
-  if (connections.length > 0) {
-    process.stdout.write('\nPairing paths:\n');
-    for (const target of connections) {
-      process.stdout.write(`  - ${formatConnectionSummary(target)}\n`);
+  const skipFlags = new Set(['__vaults', 'foreground', 'json']);
+  for (const [key, value] of Object.entries(flags)) {
+    if (skipFlags.has(key)) continue;
+    if (key === 'no-qr') continue;
+    if (value === true) {
+      args.push(`--${key}`);
+    } else if (typeof value === 'string') {
+      args.push(`--${key}`, value);
     }
   }
-  await printPairingQr(pairingPayload, paths);
+  args.push('--no-qr');
+  return args;
+}
+
+
+
+;// CONCATENATED MODULE: ./bin/cli-help.mjs
+
+const cli_help_PROG = 'remosidian';
+const PRIMARY_NPM_PACKAGE = '@remosidian/cli';
+const cli_help_ALIAS_NPM_PACKAGE = 'remosidian';
+function helpText() {
+  return [
+    `${cli_help_PROG} v${VERSION} — remote vault server for Obsidian / LifeOS`,
+    '',
+    'Package names:',
+    `  ${PRIMARY_NPM_PACKAGE}`,
+    `  ${cli_help_ALIAS_NPM_PACKAGE}`,
+    '',
+    'Usage:',
+    `  npx ${cli_help_ALIAS_NPM_PACKAGE}             Start the current directory as a vault`,
+    `  npx ${cli_help_ALIAS_NPM_PACKAGE} <command> [options]`,
+    `  ${cli_help_PROG} <command> [options]`,
+    '',
+    'Commands:',
+    '  start                Start or reuse the Remosidian background daemon',
+    '  pair                 Open a one-time pairing window and print a QR code',
+    '  status               Print the running daemon health snapshot',
+    '  stop                 Stop the background daemon',
+    '  reset-pairings       Revoke every paired device (local only)',
+    '  init                 Create ~/.remosidian/config.json interactively',
+    '  help                 Show this help',
+    '',
+    'Global options:',
+    '  --data-dir <path>    Override $REMOSIDIAN_HOME (default: ~/.remosidian)',
+    '  --config <path>      Override $REMOSIDIAN_CONFIG (default: <data-dir>/config.json)',
+    '  --version            Print version and exit',
+    '',
+    'start options:',
+    '  --vault <id>:<path>  Use an ad-hoc vault instead of the config file',
+    '                       (repeatable; id defaults to folder name)',
+    '  --port <number>      Listen on this TCP port (default 41234)',
+    '  --access=local      LAN/local only; skip Cloudflare Tunnel and saved relay config',
+    '  --access=remote     Use the default Remote Direct path',
+    '  --access=https://<url>',
+    '                       Use a custom relay URL for remote access',
+    '  --access=<host>[,<fallback>]',
+    '                       Use direct LAN/Tailscale hosts',
+    '  --access=           Clear the saved relay URL for this run',
+    '  --force              Restart the managed Cloudflare Tunnel before startup',
+    '  --bind <address>     Bind to this interface (default 0.0.0.0)',
+    '  --agent <name>       AI agent for /Ask: claude or codex (auto-detects)',
+    '  --agent-path <path>  Override the agent binary path',
+    '  --personal-agent     Expose the Personal Agent in paired mobile apps',
+    '  --pa                 Short alias for --personal-agent',
+    '  --no-personal-agent  Hide the Personal Agent in paired mobile apps',
+    '  --no-pa              Short alias for --no-personal-agent',
+    '  --cloudflare         Also enable managed Cloudflare access',
+    '  --foreground         Run the server in the foreground',
+    '  --json               Emit a single JSON line instead of human output',
+    '  --no-qr              Skip the pairing QR on startup',
+    '',
+    'Legacy access aliases still work:',
+    '  --local, --remote, --tunnel, --relay <url>, --host <address>, --fallback-hosts <x>',
+  ].join('\n');
 }
 
+
+
+;// CONCATENATED MODULE: ./bin/cli-daemon-api.mjs
 async function probeHealth(port, timeoutMs = 0) {
   const deadline = Date.now() + timeoutMs;
   do {
@@ -37086,23 +37273,179 @@ async function postJson(port, pathname, body = undefined) {
   return payload;
 }
 
-function buildServeArgs(flags) {
-  const args = ['serve'];
-  for (const vault of flags.__vaults ?? []) {
-    args.push('--vault', vault);
+async function waitForDaemonExit(port, timeoutMs = 5_000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const health = await probeHealth(port, 0);
+    if (!health) {
+      return true;
+    }
+    await new Promise((resolveWait) => setTimeout(resolveWait, 200));
   }
-  const skipFlags = new Set(['__vaults', 'foreground', 'json']);
-  for (const [key, value] of Object.entries(flags)) {
-    if (skipFlags.has(key)) continue;
-    if (key === 'no-qr') continue;
-    if (value === true) {
-      args.push(`--${key}`);
-    } else if (typeof value === 'string') {
-      args.push(`--${key}`, value);
+  return false;
+}
+
+;// CONCATENATED MODULE: ./bin/remosidian.mjs
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+const remosidian_PROG = 'remosidian';
+const remosidian_ALIAS_NPM_PACKAGE = 'remosidian';
+
+function resolveEntrypointHref(path) {
+  if (!path) return '';
+  try {
+    return (0,external_node_url_namespaceObject.pathToFileURL)((0,external_node_fs_namespaceObject.realpathSync)((0,external_node_path_namespaceObject.resolve)(path))).href;
+  } catch {
+    return (0,external_node_url_namespaceObject.pathToFileURL)((0,external_node_path_namespaceObject.resolve)(path)).href;
+  }
+}
+
+function expandVaultSpec(spec) {
+  if (spec.trim().length === 0) return null;
+  const colon = spec.indexOf(':');
+  let id = '';
+  let root = spec;
+  if (colon > 0 && !/^[a-zA-Z]:[\\/]/.test(spec)) {
+    id = spec.slice(0, colon).trim();
+    root = spec.slice(colon + 1);
+  }
+  if (root.trim().length === 0) return null;
+  const resolved = resolveUserPath(root);
+  if (!id) {
+    id = resolved.split(/[\\/]/).filter(Boolean).pop() ?? 'vault';
+  }
+  return {
+    id,
+    name: id,
+    root: resolved,
+    ignored: ['.obsidian/**', '.git/**', '.DS_Store', '*.swp', '*.tmp'],
+  };
+}
+
+function loadConfigOrNull(paths) {
+  if (!(0,external_node_fs_namespaceObject.existsSync)(paths.configPath)) {
+    return null;
+  }
+  try {
+    return JSON.parse((0,external_node_fs_namespaceObject.readFileSync)(paths.configPath, 'utf8'));
+  } catch (error) {
+    console.error(`[${remosidian_PROG}] failed to read ${paths.configPath}: ${error?.message ?? error}`);
+    process.exit(2);
+  }
+}
+
+function resolvePaths(flags) {
+  const dataDir = typeof flags['data-dir'] === 'string' ? flags['data-dir'] : undefined;
+  const configPath = typeof flags['config'] === 'string' ? flags['config'] : undefined;
+  if (configPath) {
+    const paths = createRemosidianPaths(dataDir ?? process.env.REMOSIDIAN_HOME ?? '~/.remosidian');
+    return { ...paths, configPath: resolveUserPath(configPath) };
+  }
+  return createRemosidianPaths(dataDir ?? process.env.REMOSIDIAN_HOME ?? '~/.remosidian');
+}
+
+function createRuntimePaths(paths) {
+  const runtimeDir = (0,external_node_path_namespaceObject.join)(paths.dataDir, 'runtime', 'current');
+  const logDir = (0,external_node_path_namespaceObject.join)(paths.dataDir, 'logs');
+  return {
+    runtimeDir,
+    runtimeEntryPath: (0,external_node_path_namespaceObject.join)(runtimeDir, 'dist', 'remosidian.mjs'),
+    pidPath: (0,external_node_path_namespaceObject.join)(paths.dataDir, 'daemon.pid'),
+    logDir,
+    stdoutLogPath: (0,external_node_path_namespaceObject.join)(logDir, 'daemon.stdout.log'),
+    stderrLogPath: (0,external_node_path_namespaceObject.join)(logDir, 'daemon.stderr.log'),
+    pairingQrPath: (0,external_node_path_namespaceObject.join)(paths.dataDir, 'pairing-qr.png'),
+    pairingCodePath: (0,external_node_path_namespaceObject.join)(paths.dataDir, 'pairing-code.txt'),
+  };
+}
+
+function readPidFile(pidPath) {
+  try {
+    const pid = Number((0,external_node_fs_namespaceObject.readFileSync)(pidPath, 'utf8').trim());
+    return Number.isFinite(pid) && pid > 0 ? pid : null;
+  } catch {
+    return null;
+  }
+}
+
+function writePidFile(pidPath, pid) {
+  (0,external_node_fs_namespaceObject.mkdirSync)((0,external_node_path_namespaceObject.dirname)(pidPath), { recursive: true });
+  (0,external_node_fs_namespaceObject.writeFileSync)(pidPath, `${pid}\n`, 'utf8');
+}
+
+function removePidFile(pidPath) {
+  (0,external_node_fs_namespaceObject.rmSync)(pidPath, { force: true });
+}
+
+function remosidian_isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function currentEntrypointPath() {
+  const entryPath = (0,external_node_url_namespaceObject.fileURLToPath)(import.meta.url);
+  try {
+    return (0,external_node_fs_namespaceObject.realpathSync)(entryPath);
+  } catch {
+    return entryPath;
+  }
+}
+
+function installRuntime(paths) {
+  const runtime = createRuntimePaths(paths);
+  (0,external_node_fs_namespaceObject.mkdirSync)((0,external_node_path_namespaceObject.dirname)(runtime.runtimeEntryPath), { recursive: true });
+  (0,external_node_fs_namespaceObject.copyFileSync)(currentEntrypointPath(), runtime.runtimeEntryPath);
+  const sidecarDir = (0,external_node_path_namespaceObject.join)((0,external_node_path_namespaceObject.dirname)(currentEntrypointPath()), 'remoteDirect');
+  if ((0,external_node_fs_namespaceObject.existsSync)(sidecarDir))
+    (0,external_node_fs_namespaceObject.cpSync)(sidecarDir, (0,external_node_path_namespaceObject.join)((0,external_node_path_namespaceObject.dirname)(runtime.runtimeEntryPath), 'remoteDirect'), { recursive: true });
+  (0,external_node_fs_namespaceObject.chmodSync)(runtime.runtimeEntryPath, 0o755);
+  return runtime;
+}
+
+function resolveRequestedPort(flags, paths) {
+  return parsePortFlag(flags) ?? loadConfigOrNull(paths)?.server?.port ?? 41234;
+}
+
+async function printPairingSummary(port, paths, health = null, flags = {}) {
+  const healthPayload = health ?? (await waitForHealth(port));
+  if (flags.json) {
+    process.stdout.write(`${JSON.stringify({ ok: true, ...healthPayload })}\n`);
+    return;
+  }
+  process.stdout.write(`Remosidian daemon is ready.\n\n`);
+  process.stdout.write(`${printHumanHealth(healthPayload)}\n`);
+  if (flags['no-qr']) {
+    return;
+  }
+  const pairingPayload = await postJson(port, '/pair/open');
+  const connections = normalizePairingConnections(pairingPayload);
+  if (connections.length > 0) {
+    process.stdout.write('\nPairing paths:\n');
+    for (const target of connections) {
+      process.stdout.write(`  - ${formatConnectionSummary(target)}\n`);
     }
   }
-  args.push('--no-qr');
-  return args;
+  await printPairingQr(pairingPayload, createRuntimePaths(paths));
 }
 
 function startDetachedDaemon(paths, flags) {
@@ -37138,6 +37481,7 @@ async function cmdServe(flags, paths) {
       server: {
         port: portFlag ?? config?.server?.port ?? 41234,
         advertisedHosts: config?.server?.advertisedHosts ?? 'auto',
+        ...(config?.server?.features ? { features: config.server.features } : {}),
       },
       ...(config?.ai ? { ai: config.ai } : {}),
     };
@@ -37154,6 +37498,17 @@ async function cmdServe(flags, paths) {
     process.exit(2);
   }
 
+  const personalAgentOverride = resolvePersonalAgentOverride(flags);
+  if (personalAgentOverride !== undefined) {
+    finalConfig.server = {
+      ...finalConfig.server,
+      features: {
+        ...(finalConfig.server?.features ?? {}),
+        personalAgent: personalAgentOverride,
+      },
+    };
+  }
+
   const agentFlag = typeof flags.agent === 'string' ? flags.agent.trim() : '';
   const agentPathFlag =
     typeof flags['agent-path'] === 'string' && flags['agent-path'].trim().length > 0 ? flags['agent-path'] : '';
@@ -37178,6 +37533,7 @@ async function cmdServe(flags, paths) {
           : '0.0.0.0';
   const server = await startRemosidianServer({
     config: finalConfig,
+    remoteDirect: connectionConfig.localOnly !== true,
     dataDir: paths.dataDir,
     host: bindHost,
     port,
@@ -37211,7 +37567,7 @@ async function cmdServe(flags, paths) {
       const openResp = await fetch(`http://127.0.0.1:${server.port}/pair/open`, { method: 'POST' });
       if (openResp.ok) {
         const payload = await openResp.json();
-        await printPairingQr(payload, paths);
+        await printPairingQr(payload, createRuntimePaths(paths));
       }
     } catch (error) {
       process.stderr.write(`[${remosidian_PROG}] pair payload not available: ${error?.message ?? error}\n`);
@@ -37240,7 +37596,29 @@ async function cmdStart(flags, paths) {
     return;
   }
   const port = resolveRequestedPort(flags, paths);
-  const existing = await probeHealth(port, 1_000);
+  let existing = await probeHealth(port, 1_000);
+  const personalAgentOverride = resolvePersonalAgentOverride(flags);
+  if (existing && personalAgentOverride !== undefined && existing.features?.personalAgent !== personalAgentOverride) {
+    const runtime = createRuntimePaths(paths);
+    const pid = readPidFile(runtime.pidPath);
+    if (!pid || !remosidian_isProcessAlive(pid)) {
+      failUsage(
+        `The daemon on port ${port} was not started by this CLI, so its Personal Agent setting cannot be changed automatically.`,
+        'Stop that foreground/service process, then run this command again.',
+      );
+    }
+    process.kill(pid, 'SIGTERM');
+    const stopped = await waitForDaemonExit(port);
+    if (!stopped) {
+      throw new Error(`Timed out restarting Remosidian daemon on 127.0.0.1:${port}`);
+    }
+    removePidFile(runtime.pidPath);
+    existing = null;
+  }
+  if (existing && shouldRestartDaemon(existing, flags)) {
+    await cmdStop(flags, paths);
+    existing = null;
+  }
   if (existing) {
     if (!flags.json) {
       process.stdout.write('Remosidian daemon is already running. Reusing it.\n\n');
@@ -37306,18 +37684,6 @@ async function cmdStatus(flags, paths) {
   }
 }
 
-async function waitForDaemonExit(port, timeoutMs = 5_000) {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    const health = await probeHealth(port, 0);
-    if (!health) {
-      return true;
-    }
-    await new Promise((resolveWait) => setTimeout(resolveWait, 200));
-  }
-  return false;
-}
-
 async function cmdStop(flags, paths) {
   const port = resolveRequestedPort(flags, paths);
   const runtime = createRuntimePaths(paths);
@@ -37331,7 +37697,7 @@ async function cmdStop(flags, paths) {
     await waitForDaemonExit(port);
     removePidFile(runtime.pidPath);
     stopTunnel({ tunnelStatePath: (0,external_node_path_namespaceObject.join)(paths.dataDir, 'tunnel.json') });
-    process.stdout.write('Remosidian daemon stopped.\n');
+    if (!flags.json) process.stdout.write('Remosidian daemon stopped.\n');
     return;
   }
   removePidFile(runtime.pidPath);
@@ -37343,7 +37709,7 @@ async function cmdStop(flags, paths) {
     process.exit(1);
   }
   stopTunnel({ tunnelStatePath: (0,external_node_path_namespaceObject.join)(paths.dataDir, 'tunnel.json') });
-  process.stdout.write('Remosidian daemon is not running.\n');
+  if (!flags.json) process.stdout.write('Remosidian daemon is not running.\n');
 }
 
 async function cmdResetPairings(flags, paths) {
@@ -37474,4 +37840,5 @@ var __webpack_exports__parseAccessValue = __webpack_exports__.bo;
 var __webpack_exports__parseArgs = __webpack_exports__.Zy;
 var __webpack_exports__resolveEntrypointHref = __webpack_exports__.Mf;
 var __webpack_exports__resolveInvocation = __webpack_exports__.t0;
-export { __webpack_exports__buildPairCode as buildPairCode, __webpack_exports__buildPairDeepLink as buildPairDeepLink, __webpack_exports__buildPairUri as buildPairUri, __webpack_exports__buildServeArgs as buildServeArgs, __webpack_exports__createCompactPairingPayload as createCompactPairingPayload, __webpack_exports__expandVaultSpec as expandVaultSpec, __webpack_exports__hasLegacyAccessArgs as hasLegacyAccessArgs, __webpack_exports__helpText as helpText, __webpack_exports__main as main, __webpack_exports__normalizeCliFlags as normalizeCliFlags, __webpack_exports__normalizePortValue as normalizePortValue, __webpack_exports__parseAccessValue as parseAccessValue, __webpack_exports__parseArgs as parseArgs, __webpack_exports__resolveEntrypointHref as resolveEntrypointHref, __webpack_exports__resolveInvocation as resolveInvocation };
+var __webpack_exports__resolvePersonalAgentOverride = __webpack_exports__.kr;
+export { __webpack_exports__buildPairCode as buildPairCode, __webpack_exports__buildPairDeepLink as buildPairDeepLink, __webpack_exports__buildPairUri as buildPairUri, __webpack_exports__buildServeArgs as buildServeArgs, __webpack_exports__createCompactPairingPayload as createCompactPairingPayload, __webpack_exports__expandVaultSpec as expandVaultSpec, __webpack_exports__hasLegacyAccessArgs as hasLegacyAccessArgs, __webpack_exports__helpText as helpText, __webpack_exports__main as main, __webpack_exports__normalizeCliFlags as normalizeCliFlags, __webpack_exports__normalizePortValue as normalizePortValue, __webpack_exports__parseAccessValue as parseAccessValue, __webpack_exports__parseArgs as parseArgs, __webpack_exports__resolveEntrypointHref as resolveEntrypointHref, __webpack_exports__resolveInvocation as resolveInvocation, __webpack_exports__resolvePersonalAgentOverride as resolvePersonalAgentOverride };