remote-pi 0.1.2 → 0.2.0

package/dist/index.js

@@ -1,3 +1,4 @@
+#!/usr/bin/env node
 /**
  * pi-extension — remote-pi slash commands + AgentBridge wiring
  *
@@ -29,27 +30,49 @@
  *   for integration tests.
  */
 import { randomUUID } from "node:crypto";
-import { buildQRUri, displayQR, qrSession, startQRRotation } from "./pairing/qr.js";
-import { addPeer, getOrCreateEd25519Keypair, listPeers, removePeer, } from "./pairing/storage.js";
+import { buildQRUri, qrSession, renderQRAscii, startQRRotation } from "./pairing/qr.js";
+import { addPeer, getOrCreateEd25519Keypair, listOwnerPubkeys, listPeers, removePeer, } from "./pairing/storage.js";
+import { MeshClient } from "./mesh/client.js";
+import { SelfRevoke } from "./mesh/self_revoke.js";
 import { RelayClient, RoomAlreadyOpenError } from "./transport/relay_client.js";
 import { PlainPeerChannel } from "./transport/peer_channel.js";
 import { roomIdForCwd } from "./rooms.js";
 import { SessionPeer } from "./session/peer.js";
 import { registerAgentTools } from "./session/tools.js";
-import { ensureGlobalDirs, listSessions, sessionAuditPath, sessionHasSock, sessionSockPath, skillsDir, } from "./session/global_config.js";
+import { BrokerRemote } from "./session/broker_remote.js";
+import { formatPeerInventory } from "./session/peer_inventory.js";
+import { PiForwardClient } from "./transport/pi_forward_client.js";
+import { discoverSelfLabel, discoverSiblings, fallbackLabel } from "./mesh/siblings.js";
+import { ensureGlobalDirs, LOCAL_SESSION_NAME, sessionAuditPath, sessionSockPath, skillsDir, } from "./session/global_config.js";
+import { acquireCwdLock } from "./session/cwd_lock.js";
+import { addDaemon, listDaemons, removeDaemon } from "./daemon/registry.js";
+import { callSupervisor, supervisorOnline, SupervisorOfflineError } from "./daemon/client.js";
+import { installService, uninstallService, linkCliBinaries, unlinkCliBinaries } from "./daemon/install.js";
 import { defaultAgentName, effectiveAutoStartRelay, loadLocalConfig, localConfigExists, saveLocalConfig, } from "./session/local_config.js";
 import { runSetupWizard } from "./session/setup_wizard.js";
 import { updateFooter } from "./ui/footer.js";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { mkdirSync, copyFileSync, existsSync, unlinkSync } from "node:fs";
-import { kDefaultRelayUrl, resolveRelayUrl, saveConfig, isValidRelayUrl, } from "./config.js";
+import { mkdirSync, copyFileSync, existsSync, unlinkSync, readFileSync } from "node:fs";
+import { hostname } from "node:os";
+import { kDefaultRelayUrl, resolveRelayUrl, saveConfig, isValidRelayUrl, isWebSocketScheme, toWebSocketUrl, } from "./config.js";
 let _state = "idle";
 let _relay = null;
 let _relayUrl = null; // URL used by current _relay connection
-let _peerChannel = null;
-let _appPeerId = null; // active app peer ID (Ed25519 pk base64 std)
-let _peerShort = "";
+/**
+ * Owners currently connected via the relay. Key = app peer pubkey (Ed25519,
+ * base64 standard); value = the dedicated PlainPeerChannel routing messages
+ * to/from that owner.
+ *
+ * Operational notes:
+ *   - Adding/removing entries is exclusively in `_attachPeerChannel` and
+ *     `_detachPeerChannel` (or `_goIdle` for the bulk teardown). Don't mutate
+ *     directly elsewhere — those helpers keep the footer/log/state in sync.
+ *   - `paired` UX state is `_activePeers.size > 0`. The footer and the
+ *     `/remote-pi status` output both derive from this.
+ */
+const _activePeers = new Map();
+let _peerShort = ""; // shortid of the most recently attached peer (UX hint only)
 let _myRoomId = null; // this Pi's room id (derived from cwd)
 let _myRoomMeta = null;
 let _currentModel = undefined; // last-known model name
@@ -57,6 +80,11 @@ let _currentModel = undefined; // last-known model name
 let _sessionPeer = null;
 let _sessionName = null;
 let _sessionPeerCount = 0;
+// Plan/25 Wave B/C — cross-PC routing. Instantiated when this Pi has the
+// local broker (leader) AND the relay WS is up. Detached on either side
+// of those preconditions falling away.
+let _brokerRemote = null;
+let _piForwardClient = null;
 // Cached state of global pairings (`peers.json`). Pairing is per-machine, so a
 // device paired in any Pi process is paired everywhere. Refreshed on boot,
 // after addPeer (handle_pair_request), and after removePeer (revoke).
@@ -90,6 +118,62 @@ function _refreshSessionPeerCount(peer, ctx) {
 function _currentModelName() {
     return _currentModel;
 }
+// ── Cross-PC mesh wiring (plan/25 Wave B/C) ───────────────────────────────────
+/**
+ * Bring up the cross-PC router when both prerequisites are met:
+ *   1. local session peer is the leader (we host the Broker)
+ *   2. relay WS is up (`_relay !== null`)
+ *
+ * Idempotent: safe to call from `_cmdStart`, `_cmdJoin`, post-failover
+ * reconnect, etc. Self-heals: if siblings can't be loaded (no mesh blob
+ * yet, network hiccup) we still attach a `BrokerRemote` with an empty
+ * sibling set — push from a remote sibling will populate the cache later.
+ */
+async function _ensureBrokerRemote() {
+    if (_brokerRemote !== null)
+        return;
+    if (!_sessionPeer || _sessionPeer.currentRole() !== "leader")
+        return;
+    const broker = _sessionPeer.localBroker();
+    if (!broker)
+        return;
+    if (!_relay || !_relayUrl || !_cachedEd25519)
+        return;
+    const pi = new PiForwardClient(_relay);
+    _piForwardClient = pi;
+    const selfPubkeyB64 = Buffer.from(_cachedEd25519.publicKey).toString("base64");
+    // Best-effort sibling + label discovery — failures are non-fatal.
+    let selfPcLabel = fallbackLabel(selfPubkeyB64);
+    let siblings = [];
+    try {
+        const meshClient = new MeshClient(_relayUrl);
+        const owners = await listOwnerPubkeys();
+        if (owners.length > 0) {
+            const [labelRes, sibs] = await Promise.all([
+                discoverSelfLabel({ client: meshClient, ownerEpks: owners, myPubkey: _cachedEd25519.publicKey }),
+                discoverSiblings({ client: meshClient, ownerEpks: owners, myPubkey: _cachedEd25519.publicKey }),
+            ]);
+            selfPcLabel = labelRes.selfPcLabel;
+            siblings = sibs;
+        }
+    }
+    catch (err) {
+        console.error(`[remote-pi] broker_remote bootstrap: sibling discovery failed: ${String(err)}`);
+    }
+    _brokerRemote = new BrokerRemote({
+        broker,
+        pi,
+        selfPcLabel,
+        selfPcPubkey: selfPubkeyB64,
+        siblings,
+    });
+}
+function _teardownBrokerRemote() {
+    _brokerRemote?.detach();
+    _brokerRemote = null;
+    _piForwardClient?.detach();
+    _piForwardClient = null;
+}
 /** Refreshes the Pi TUI footer slots from current module state. Safe no-op when ctx lacks ui. */
 function _refreshFooter(ctx) {
     const target = ctx ?? _lastCtx;
@@ -100,7 +184,10 @@ function _refreshFooter(ctx) {
         session: _sessionName ?? undefined,
         peerCount: _sessionPeerCount,
         relayOn: _state !== "idle",
-        devicePaired: _state === "paired" ? _peerShort : undefined,
+        // `devicePaired` now reflects "any owner currently attached" — picks one
+        // shortid representatively (multi-owner UX detail surfaces in the
+        // `/remote-pi status` line, not the footer slot).
+        devicePaired: _anyPeerActive() ? _peerShort : undefined,
         hasPairings: _hasGlobalPairings,
         agentName: _sessionPeer?.name(),
     };
@@ -112,6 +199,34 @@ function _refreshFooter(ctx) {
 let _sessionStartedAt = null;
 let _messageBuffer = [];
 /** Test-only override of the message buffer. */
+/**
+ * Test-only: emulate what `/remote-pi` does on the returning-user path
+ * (join the local mesh, then start the relay) without touching the FS for
+ * a `localConfigExists()` lookup. Lets tests bring the relay up without
+ * mocking the wizard or the local config storage.
+ *
+ * Typed loosely to accept any ctx shape with `ui.notify` + `cwd` — the
+ * unit tests use minimal mocks that don't satisfy the full
+ * `ExtensionContext` interface.
+ */
+export async function _connectForTest(ctx) {
+    const real = ctx;
+    await _cmdJoin(real);
+    await _cmdStart(real);
+}
+/** Test-only: tear everything down (mirrors `/remote-pi stop`). */
+export async function _stopForTest(ctx) {
+    await _cmdStop(ctx);
+}
+/**
+ * Test-only: relay-only startup, no UDS mesh join. Replaces the old
+ * `remote-pi relay start` handler that some tests captured to bring up
+ * the relay in isolation (e.g. ping/pong tests that don't care about the
+ * agent-network broker).
+ */
+export async function _startRelayForTest(ctx) {
+    await _cmdStart(ctx);
+}
 export function _setMessageBufferForTest(msgs) {
     _messageBuffer = msgs;
 }
@@ -134,6 +249,15 @@ let _pi = null;
 let _stopAutoListener = null;
 // Cached keypair (loaded once, reused across start/pair cycles)
 let _cachedEd25519 = null;
+// Mesh-membership poller (plan/24 Wave 3). Lives across the relay
+// connection lifecycle: started in _cmdStart after the WS is up, stopped
+// in _goIdle when the relay is torn down.
+let _selfRevoke = null;
+// Per-cwd lock acquired by the first `/remote-pi` invocation in this
+// process. Holds the UDS socket open until the process exits (OS auto-
+// releases on crash too). Stays held across `/remote-pi stop` cycles —
+// only released when the Node process itself dies.
+let _cwdLock = null;
 // ── Session sync limit (mirror cache cap) ─────────────────────────────────────
 //
 // Configurable via REMOTE_PI_SYNC_LIMIT env var (positive int, default 30).
@@ -155,8 +279,102 @@ let _reconnectAttempt = 0;
 export function _hasPendingReconnect() {
     return _reconnectTimer !== null;
 }
-/** Exported for tests. */
-export function _getState() { return _state; }
+/**
+ * Public state-snapshot helper. Returns the derived UX state, not the raw
+ * `_state` enum: the W2D refactor collapsed the internal machine to
+ * `idle | started` and made `paired` a derived metric
+ * (`_activePeers.size > 0`). Tests and the footer keep the three-state
+ * mental model via this getter.
+ */
+export function _getState() {
+    if (_state === "idle")
+        return "idle";
+    return _activePeers.size > 0 ? "paired" : "started";
+}
+/** Test-only: number of owners currently attached via PlainPeerChannel. */
+export function _getActivePeerCountForTest() {
+    return _activePeers.size;
+}
+/** Test-only: true if a specific peer (base64 std) has an attached channel. */
+export function _hasActivePeerForTest(appPeerIdStd) {
+    return _activePeers.has(appPeerIdStd);
+}
+// ── Multi-channel helpers ─────────────────────────────────────────────────────
+/**
+ * Sends `msg` to every currently-attached owner channel. The default
+ * dispatch for application-level events that are part of "the agent
+ * session is doing X" (agent_chunk, tool_request, tool_result, agent_done,
+ * user_input mirror, room_meta_update, etc.) — all paired devices see the
+ * same stream.
+ *
+ * Per-request responses (e.g. `session_history` answering a specific
+ * `session_sync` query, or `pair_ok` answering `pair_request`) must NOT
+ * use this — they go to the sender channel directly.
+ */
+function _broadcastToActive(msg) {
+    for (const ch of _activePeers.values()) {
+        try {
+            ch.send(msg);
+        }
+        catch { /* best-effort per channel */ }
+    }
+}
+/** Returns true when at least one owner is attached. Derived `paired` UX. */
+function _anyPeerActive() {
+    return _activePeers.size > 0;
+}
+/**
+ * Adds an owner's channel to `_activePeers`. Also updates the UX hint
+ * `_peerShort` (last-attached shortid) so the footer + status can pick
+ * a representative device when only one is connected.
+ */
+function _attachPeerChannel(appPeerId, channel) {
+    _activePeers.set(appPeerId, channel);
+    _peerShort = appPeerId.slice(0, 8);
+}
+/** Detaches a single owner's channel + removes it from the map. Used by
+ *  `_onPeerDisconnect`, `_cmdRevoke`, and the SelfRevoke callback. */
+function _detachPeerChannel(appPeerId) {
+    const ch = _activePeers.get(appPeerId);
+    if (!ch)
+        return;
+    try {
+        ch.detach();
+    }
+    catch { /* best-effort */ }
+    _activePeers.delete(appPeerId);
+    if (_peerShort === appPeerId.slice(0, 8)) {
+        // Pick a different remaining peer for the UX hint, or clear when none.
+        const next = _activePeers.keys().next().value;
+        _peerShort = next ? next.slice(0, 8) : "";
+    }
+}
+// ── Display-name helpers ──────────────────────────────────────────────────────
+/**
+ * Resolves the name this Pi shows to the mobile app and the relay's
+ * `room_meta.name`. Single source of truth for "what does this Pi call
+ * itself when talking to others".
+ *
+ * Resolution order:
+ *   1. Broker-assigned name (when this Pi is on the local UDS mesh) — may
+ *      carry a `#N` suffix from a name collision. Matches what other
+ *      agents see, so the mobile UI shows the exact same string.
+ *   2. `agent_name` from `<cwd>/.pi/remote-pi/config.json` — set by the
+ *      wizard on first run; this is "the name the user configured".
+ *   3. `defaultAgentName(cwd)` (parent/folder) — fallback when no config
+ *      exists yet and the mesh hasn't been joined.
+ *
+ * Pre-2026-05-23 callers computed `cwd.split('/').slice(-2).join('/')`
+ * inline at three different sites (pair_ok, room_meta, QR URI); this
+ * helper consolidates them and lifts the user's configured name above
+ * the raw cwd path.
+ */
+function _displayName(cwd) {
+    if (_sessionPeer)
+        return _sessionPeer.name();
+    const local = loadLocalConfig(cwd);
+    return local.agent_name || defaultAgentName(cwd);
+}
 // ── Peer lookup helpers ───────────────────────────────────────────────────────
 async function _findKnownPeer(appPeerIdStd) {
     const peers = await listPeers();
@@ -173,13 +391,10 @@ async function _findKnownPeer(appPeerIdStd) {
  * by omitting the reason; app falls back to ping miss naturally.
  */
 function _goIdle(byeReason) {
-    if (_peerChannel && byeReason && _state !== "idle") {
-        try {
-            _peerChannel.send({ type: "bye", reason: byeReason });
-        }
-        catch {
-            // peer already offline — fine
-        }
+    // Broadcast bye to every still-attached owner so each app surfaces
+    // "offline" immediately instead of waiting ~50s for a ping miss.
+    if (byeReason && _state !== "idle" && _anyPeerActive()) {
+        _broadcastToActive({ type: "bye", reason: byeReason });
     }
     // Cancel any pending reconnect attempt. Critical: /remote-pi stop must
     // win the race against a scheduled reconnect.
@@ -190,14 +405,26 @@ function _goIdle(byeReason) {
     _reconnectAttempt = 0;
     _stopAutoListener?.();
     _stopAutoListener = null;
-    _peerChannel?.detach();
-    _peerChannel = null;
-    _appPeerId = null;
+    // Tear down every per-owner channel and clear the map.
+    for (const ch of _activePeers.values()) {
+        try {
+            ch.detach();
+        }
+        catch { /* best-effort */ }
+    }
+    _activePeers.clear();
     _peerShort = "";
     _currentTurnId = null;
     _relay?.close();
     _relay = null;
     _relayUrl = null;
+    // Stop the mesh poller — it's bound to the relay-up lifecycle so a new
+    // _cmdStart will spin up a fresh instance (with potentially a new relay
+    // URL if the user changed it via /remote-pi relay url).
+    _selfRevoke?.stop();
+    _selfRevoke = null;
+    // Cross-PC routing relies on _relay being up; tear it down here too.
+    _teardownBrokerRemote();
     // Preserve _sessionStartedAt + _messageBuffer across stop/start cycles.
     // The Pi agent session outlives the relay connection — `message_end` keeps
     // firing for terminal turns even while idle, and the buffer must survive
@@ -221,11 +448,22 @@ function _onRelayClose() {
         return; // already torn down (e.g. /remote-pi stop)
     _stopAutoListener?.();
     _stopAutoListener = null;
-    _peerChannel?.detach();
-    _peerChannel = null;
-    _appPeerId = null;
+    // Detach every per-owner channel — relay is gone, none can route. The
+    // auto-listener re-attaches owners after `_attemptReconnect` succeeds
+    // (via the same known-peer + pair_request paths used on first connect).
+    for (const ch of _activePeers.values()) {
+        try {
+            ch.detach();
+        }
+        catch { /* best-effort */ }
+    }
+    _activePeers.clear();
+    _peerShort = "";
     _currentTurnId = null;
     _relay = null; // _relayUrl preserved for retry
+    // Cross-PC routing relies on _relay; bring it down. Will be re-instated
+    // by _attemptReconnect on success.
+    _teardownBrokerRemote();
     _state = "started";
     _refreshFooter();
     _scheduleReconnect();
@@ -254,7 +492,9 @@ async function _attemptReconnect() {
         return;
     const edKp = _cachedEd25519;
     const url = _relayUrl;
-    const relay = new RelayClient(url, edKp);
+    // _relayUrl is stored in canonical http(s):// form — convert at the
+    // WS boundary, same as _cmdStart.
+    const relay = new RelayClient(toWebSocketUrl(url), edKp);
     try {
         // Replay the same room identity from _cmdStart. Without this the relay
         // would log this WS as a default-room peer and the app would see a
@@ -279,60 +519,87 @@ async function _attemptReconnect() {
     _reconnectAttempt = 0;
     relay.on("close", _onRelayClose);
     _stopAutoListener = _installAutoListener(relay);
+    // Plan/25 Wave B/C: relay is back; bring cross-PC routing back online.
+    void _ensureBrokerRemote().catch((err) => {
+        console.error(`[remote-pi] _ensureBrokerRemote (post-reconnect) failed: ${String(err)}`);
+    });
     // _state stays "started"; peer reconnect (if previously paired) flows
     // through _installAutoListener → _findKnownPeer → _promoteToPaired
     // automatically when the app sends any inner.
 }
 /**
- * App-level peer disconnect (relay still up).
- * Transitions paired → started and re-installs the auto-listener.
- * Exported so tests can trigger it directly; in production it will be
- * called when the relay sends a peer-disconnect notification (future).
+ * Per-owner disconnect callback. Fires when one specific owner's channel
+ * detaches (e.g. relay told us the peer is gone). Other owners' channels
+ * keep running — relay stays "started".
+ *
+ * Exported so tests can trigger the disconnect path for a specific peer.
+ *
+ * Backward-compat: a no-arg call (legacy tests / pre-W2D callers) falls
+ * back to detaching the most recently attached peer, mirroring the old
+ * singleton semantics.
  */
-export function _onPeerDisconnect() {
-    if (_state !== "paired")
+export function _onPeerDisconnect(appPeerId) {
+    if (_state === "idle")
         return;
-    _peerChannel?.detach();
-    _peerChannel = null;
-    _appPeerId = null;
-    _peerShort = "";
+    const target = appPeerId ?? [..._activePeers.keys()].pop();
+    if (!target)
+        return;
+    if (!_activePeers.has(target))
+        return;
+    _detachPeerChannel(target);
+    if (_anyPeerActive()) {
+        // Other owners still attached — keep _currentTurnId so they continue
+        // seeing the in-flight agent stream.
+        _refreshFooter();
+        return;
+    }
+    // No owner left. Conservatively clear the turn so the next pair_request
+    // starts cleanly.
     _currentTurnId = null;
-    _state = "started";
     _refreshFooter();
-    _lastCtx?.ui.notify("[remote-pi] App disconnected, listening for reconnect", "info");
-    // Re-install auto-listener so reconnect works
-    if (_relay) {
-        _stopAutoListener?.();
-        _stopAutoListener = _installAutoListener(_relay);
-    }
+    _lastCtx?.ui.notify("[remote-pi] All app peers disconnected, listening for reconnect", "info");
+    // Auto-listener stays up — same listener catches the reconnect on any peer.
 }
 /**
- * Promotes started → paired by installing a PlainPeerChannel for `appPeerId`.
- * Routes `firstInner` immediately so the message that triggered reconnection
- * isn't dropped.
+ * Attaches a new owner channel to the multi-owner set. Replaces the
+ * pre-W2D singleton `_promoteToPaired` which set `_state = "paired"` and
+ * a single `_peerChannel`. The relay state remains `started`; pairing
+ * status is derived from `_activePeers.size`.
+ *
+ * Idempotent for the same `appPeerId` (re-attaching tears down the prior
+ * channel and installs a fresh one — covers reconnect from the same
+ * device without leaking listeners).
  */
-function _promoteToPaired(relay, appPeerId, peerName, firstInner) {
+function _attachOwner(relay, appPeerId, peerName, firstInner) {
     const peerShort = appPeerId.slice(0, 8);
-    const channel = new PlainPeerChannel(relay, appPeerId, _myRoomId ?? undefined, (msg) => routeClientMessage(msg, _lastCtx ?? _noopCtx), () => _onPeerDisconnect());
-    _peerChannel = channel;
-    _appPeerId = appPeerId;
-    _peerShort = peerShort;
-    _state = "paired";
+    // Drop any stale channel for this owner before re-attaching.
+    if (_activePeers.has(appPeerId))
+        _detachPeerChannel(appPeerId);
+    const channel = new PlainPeerChannel(relay, appPeerId, _myRoomId ?? undefined, (msg) => _routeClientMessageFrom(channel, msg, _lastCtx ?? _noopCtx), () => _onPeerDisconnect(appPeerId));
+    _attachPeerChannel(appPeerId, channel);
     _refreshFooter();
-    _lastCtx?.ui.notify(`[remote-pi] state: paired (peer=${peerShort}, name=${peerName})`, "info");
+    _lastCtx?.ui.notify(`[remote-pi] Owner attached: peer=${peerShort}, name=${peerName} ` +
+        `(${_activePeers.size} active)`, "info");
     if (firstInner) {
-        // Route the inner that triggered the reconnect — the channel listener
-        // also saw it, but we route through routeClientMessage to be explicit.
+        // The PlainPeerChannel listener fired on the same line that triggered
+        // attachment in some flows; we route explicitly here too to ensure the
+        // inner reaches the handler exactly once.
         void firstInner;
     }
+    return channel;
 }
-// ── Auto-reconnect listener ───────────────────────────────────────────────────
+// ── Auto-listener ─────────────────────────────────────────────────────────────
 //
 // Installed while in 'started' state. Decodes the outer envelope as
-// base64(JSON) and dispatches based on inner type:
-//   • pair_request from any peer → validate token, persist peer, send pair_ok/pair_error
-//   • any inner from a known peer (peers.json) → promote to paired and route
-//   • anything else → ignored
+// base64(JSON) and dispatches per sender peer_id:
+//   • Sender already in `_activePeers` → ignored here (the per-owner
+//     PlainPeerChannel listens on the same relay event and handles its own
+//     traffic via its `remotePeerId` filter)
+//   • `pair_request` from a new peer → validate token, persist peer, send
+//     pair_ok/pair_error, attach a new channel
+//   • Non-pair message from a known peer (peers.json) without an active
+//     channel yet → attach + route the inner (reconnect path)
+//   • Anything else (unknown peer + non-pair) → emit `error: unknown_peer`
 function _installAutoListener(relay) {
     const onMsg = async (line) => {
         let outer;
@@ -344,11 +611,11 @@ function _installAutoListener(relay) {
         }
         if (!outer.peer || !outer.ct)
             return;
-        // Once paired, the PlainPeerChannel handles application messages.
-        if (_state === "paired")
-            return;
         if (_state !== "started")
             return;
+        // Already-attached owners: their PlainPeerChannel handles routing.
+        if (_activePeers.has(outer.peer))
+            return;
         // Decode inner envelope (base64 JSON)
         let inner;
         try {
@@ -368,14 +635,16 @@ function _installAutoListener(relay) {
             await _handlePairRequest(relay, appPeerId, inner);
             return;
         }
-        // Reconnect path: known peer sends a non-pair message → promote to paired
-        // and route through the new PlainPeerChannel. See pairing.md §Reconexão.
+        // Reconnect path: known peer (peers.json) without an active channel
+        // sends a non-pair message → attach + route through the new channel.
+        // See pairing.md §Reconexão.
         const known = await _findKnownPeer(appPeerId);
         if (known) {
-            _promoteToPaired(relay, appPeerId, known.name);
-            // The PlainPeerChannel that was just installed will not have observed
-            // the line we already consumed; route the inner directly.
-            routeClientMessage(inner, _lastCtx ?? _noopCtx);
+            const channel = _attachOwner(relay, appPeerId, known.name);
+            // The PlainPeerChannel listener for this owner won't have seen the
+            // line that triggered the attach (we already consumed it); route
+            // it explicitly via the new channel so the sender gets a reply.
+            _routeClientMessageFrom(channel, inner, _lastCtx ?? _noopCtx);
             return;
         }
         // Unknown peer with non-pair_request inner — signal so the app can react
@@ -393,6 +662,30 @@ function _installAutoListener(relay) {
     relay.on("message", onMsg);
     return () => relay.off("message", onMsg);
 }
+/**
+ * Plan/27 Wave A: lazily resolve the pi-extension package version from
+ * disk so the `pair_ok.harness.version` field reflects what's actually
+ * shipped. The lookup is best-effort — a parse failure (or running this
+ * file out-of-tree) falls back to "0.0.0" which is still semver-valid
+ * and the app tolerates it. Cached at module load.
+ */
+function _readExtensionVersion() {
+    try {
+        const here = fileURLToPath(import.meta.url);
+        // dist/index.js → ../package.json. src/index.ts under tsx → also one level up.
+        const pkgPath = join(here, "..", "..", "package.json");
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+        return typeof pkg.version === "string" ? pkg.version : "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+const _HARNESS = {
+    name: "Pi coding agent",
+    version: _readExtensionVersion(),
+};
+const _HOSTNAME = hostname();
 async function _handlePairRequest(relay, appPeerId, inner) {
     const sendInner = (msg) => {
         const ct = Buffer.from(JSON.stringify(msg)).toString("base64");
@@ -406,9 +699,9 @@ async function _handlePairRequest(relay, appPeerId, inner) {
         const code = status === "expired" ? "token_expired"
             : status === "consumed" ? "token_consumed"
                 : "token_unknown";
-        const msg = code === "token_expired" ? "Token efêmero expirou. Gere um novo QR com /remote-pi pair."
-            : code === "token_consumed" ? "Token já consumido por outro pair_request."
-                : "Token não foi emitido por este Pi.";
+        const msg = code === "token_expired" ? "Ephemeral token expired. Generate a new QR with /remote-pi pair."
+            : code === "token_consumed" ? "Token already consumed by another pair_request."
+                : "Token was not issued by this Pi.";
         sendError(code, msg);
         return;
     }
@@ -427,8 +720,11 @@ async function _handlePairRequest(relay, appPeerId, inner) {
     const cwd = _lastCtx && "cwd" in _lastCtx
         ? _lastCtx.cwd
         : process.cwd();
-    const sessionName = cwd.split("/").slice(-2).join("/") || "remote";
-    _promoteToPaired(relay, appPeerId, inner.device_name);
+    // Prefer the user-configured agent_name (with broker suffix when on the
+    // mesh) over the legacy parent/folder path — matches what the user sees
+    // in the terminal title and in /remote-pi status.
+    const sessionName = _displayName(cwd);
+    _attachOwner(relay, appPeerId, inner.device_name);
     sendInner({
         type: "pair_ok",
         in_reply_to: inner.id,
@@ -439,6 +735,11 @@ async function _handlePairRequest(relay, appPeerId, inner) {
         // to roomIdForCwd(cwd) covers the edge case where pair_request lands
         // before _cmdStart could set _myRoomId (shouldn't happen in practice).
         room_id: _myRoomId ?? roomIdForCwd(cwd),
+        // Plan/27 Wave A — surface the host coding-agent identity + machine
+        // hostname so the app can render a meaningful device row (and tell
+        // two PCs apart even when nicknames collide).
+        harness: _HARNESS,
+        hostname: _HOSTNAME,
     });
 }
 // ── Extension factory (default export) ───────────────────────────────────────
@@ -468,17 +769,18 @@ const extension = (pi) => {
     // misfired on every custom tool from third-party packages. Approval will
     // come back when the Pi ecosystem ships a permissions convention. tool_result
     // is still forwarded so the app shows tool activity transparently.
-    // Mirror input typed in the Pi terminal (or sent via RPC) to the remote app.
-    // 'extension' source is our own sendUserMessage call from routeClientMessage,
-    // which already set _currentTurnId — skip to avoid double turnId.
+    // Mirror input typed in the Pi terminal (or sent via RPC) to every
+    // connected owner. 'extension' source is our own sendUserMessage call
+    // from routeClientMessage, which already set _currentTurnId — skip to
+    // avoid a double turnId.
     pi.on("input", (event) => {
-        if (!_peerChannel)
+        if (!_anyPeerActive())
             return;
         if (event.source === "extension")
             return;
         const turnId = `local_${randomUUID()}`;
         _currentTurnId = turnId;
-        _peerChannel.send({ type: "user_input", id: turnId, text: event.text });
+        _broadcastToActive({ type: "user_input", id: turnId, text: event.text });
     });
     // Track active model so the app can show it in the SessionTile (plano 18).
     // SDK fires model_select on settings load + every user switch. We cache the
@@ -505,21 +807,21 @@ const extension = (pi) => {
         });
     });
     pi.on("message_update", (event) => {
-        if (!_peerChannel || !_currentTurnId)
+        if (!_anyPeerActive() || !_currentTurnId)
             return;
         const ae = event.assistantMessageEvent;
         if (ae.type === "text_delta") {
-            _peerChannel.send({ type: "agent_chunk", in_reply_to: _currentTurnId, delta: ae.delta });
+            _broadcastToActive({ type: "agent_chunk", in_reply_to: _currentTurnId, delta: ae.delta });
         }
     });
-    // Notify the app a tool is about to run (visibility only, NOT approval).
-    // tool_execution_start fires before the tool executes; tool_execution_end
-    // closes the loop with the result (success or error). Together they let
-    // the app render a "Tool running… done" timeline without any gating.
+    // Notify every connected owner that a tool is about to run (visibility
+    // only, NOT approval). tool_execution_start fires before the tool
+    // executes; tool_execution_end closes the loop with the result. Together
+    // they render a "Tool running… done" timeline in each paired app.
     pi.on("tool_execution_start", (event) => {
-        if (!_peerChannel)
+        if (!_anyPeerActive())
             return;
-        _peerChannel.send({
+        _broadcastToActive({
             type: "tool_request",
             tool_call_id: event.toolCallId,
             tool: event.toolName,
@@ -527,12 +829,12 @@ const extension = (pi) => {
         });
     });
     pi.on("tool_execution_end", (event) => {
-        if (!_peerChannel)
+        if (!_anyPeerActive())
             return;
         const msg = event.isError
             ? { type: "tool_result", tool_call_id: event.toolCallId, error: String(event.result) }
             : { type: "tool_result", tool_call_id: event.toolCallId, result: event.result };
-        _peerChannel.send(msg);
+        _broadcastToActive(msg);
     });
     // Cumulative session buffer fed via `message_end`, which fires once per
     // persisted message (user, assistant, toolResult) — same hook the SDK uses
@@ -551,26 +853,55 @@ const extension = (pi) => {
     });
     pi.on("agent_end", () => {
         // Buffer is fed by `message_end`; here we only finalize the outbound
-        // turn signal to the app. No buffer mutation.
-        if (!_peerChannel || !_currentTurnId)
+        // turn signal to every connected owner. No buffer mutation.
+        if (!_anyPeerActive() || !_currentTurnId)
             return;
-        _peerChannel.send({ type: "agent_done", in_reply_to: _currentTurnId });
+        _broadcastToActive({ type: "agent_done", in_reply_to: _currentTurnId });
         _currentTurnId = null;
     });
-    // ── Commands (plano 19 taxonomy) ──────────────────────────────────────────
+    // plan/25 Wave 0: notify the local broker of turn lifecycle so it can
+    // ACK incoming agent-network envelopes as `busy` while this peer's LLM is
+    // mid-turn (and `received` once idle). Fire-and-forget — if the broker
+    // can't be reached, the worst case is a bad ACK answer; recovery is the
+    // next turn boundary. Skip silently when no mesh session is joined.
+    pi.on("turn_start", () => {
+        if (!_sessionPeer)
+            return;
+        void _sessionPeer.send("broker", { type: "turn_state", busy: true })
+            .catch(() => { });
+    });
+    pi.on("turn_end", () => {
+        if (!_sessionPeer)
+            return;
+        void _sessionPeer.send("broker", { type: "turn_state", busy: false })
+            .catch(() => { });
+    });
+    // ── Commands ──────────────────────────────────────────────────────────────
+    //
+    // Final surface: 8 commands. Pre-2026-05-23 we had 20 commands covering
+    // multi-session UDS + granular relay control; in practice every install
+    // converged on one session and the relay was always either fully on or
+    // fully off. The simplified surface keeps the day-to-day path one-key
+    // (`/remote-pi`) and exposes only the actions that have distinct user
+    // intent: setup, status, stop, pair, devices, revoke, set-relay.
     pi.registerCommand("remote-pi", {
-        description: "Connect (join session + start relay), or run setup on first use",
+        description: "Connect (join local mesh + start relay), or run setup on first use",
         getArgumentCompletions: async (prefix) => {
             if (prefix.startsWith("revoke ") || prefix === "revoke") {
                 const shortPrefix = prefix === "revoke" ? "" : prefix.slice("revoke ".length);
                 return _shortidCompletions(shortPrefix, "revoke ");
             }
             return [
-                "join", "leave", "rename", "sessions", "setup",
-                "relay", "pair", "devices", "revoke",
-                "set-relay", "config",
-                // legacy aliases (still autocomplete-visible during the deprecation window)
-                "start", "stop", "list", "add-relay",
+                "setup", "status", "stop",
+                "pair", "devices", "revoke",
+                "set-relay",
+                "peers", // plan/25 Wave D — local + cross-PC inventory
+                "create", "remove", "daemons", // daemon registry (plan/26 W1)
+                // Fleet ops use the `daemon` prefix so `/remote-pi stop` keeps
+                // meaning "stop this local Pi" — the local UX shipped in plan/25.
+                "daemon start", "daemon stop", "daemon restart",
+                "daemon send", "daemon status",
+                "install", "uninstall", // service install (plan/26 W3)
             ]
                 .filter((o) => o.startsWith(prefix))
                 .map((o) => ({ value: o, label: o }));
@@ -579,38 +910,17 @@ const extension = (pi) => {
             _lastCtx = ctx;
             const sub = args.trim();
             if (sub === "") {
-                await _cmdStatus(ctx);
+                await _cmdRoot(ctx);
             }
             else if (sub === "setup") {
                 await _cmdSetup(ctx);
             }
-            else if (sub === "join" || sub.startsWith("join ")) {
-                await _cmdJoin(sub.slice("join".length).trim(), ctx);
-            }
-            else if (sub === "leave") {
-                await _cmdLeave(ctx);
-            }
-            else if (sub.startsWith("rename")) {
-                await _cmdRename(sub.slice("rename".length).trim(), ctx);
-            }
-            else if (sub === "sessions") {
-                _cmdSessions(ctx);
+            else if (sub === "status") {
+                _cmdStatus(ctx);
             }
-            else if (sub === "relay") {
-                await _cmdRelayToggle(ctx);
-            }
-            else if (sub === "relay start") {
-                await _cmdStart(ctx);
-            }
-            else if (sub === "relay stop") {
+            else if (sub === "stop") {
                 await _cmdStop(ctx);
             }
-            else if (sub === "relay status") {
-                _cmdRelayStatus(ctx);
-            }
-            else if (sub.startsWith("relay url")) {
-                _cmdSetRelay(sub.slice("relay url".length).trim(), ctx);
-            }
             else if (sub === "pair") {
                 await _cmdPair(ctx);
             }
@@ -623,44 +933,50 @@ const extension = (pi) => {
             else if (sub.startsWith("set-relay")) {
                 _cmdSetRelay(sub.slice("set-relay".length).trim(), ctx);
             }
-            else if (sub === "config") {
-                _cmdConfig(ctx);
+            else if (sub === "peers") {
+                await _cmdPeers(ctx);
             }
-            // ── Legacy aliases (deprecated, 1-release window) ─────────────────────
-            else if (sub === "start") {
-                ctx.ui.notify("[remote-pi] '/remote-pi start' deprecated — use '/remote-pi relay start' (auto-joining default session)", "warning");
-                await _cmdJoin("", ctx);
-                await _cmdStart(ctx);
+            else if (sub.startsWith("create")) {
+                _cmdCreate(sub.slice("create".length).trim(), ctx);
             }
-            else if (sub === "stop") {
-                ctx.ui.notify("[remote-pi] '/remote-pi stop' deprecated — use '/remote-pi leave' + '/remote-pi relay stop'", "warning");
-                await _cmdLeave(ctx);
-                await _cmdStop(ctx);
+            else if (sub.startsWith("remove")) {
+                _cmdRemove(sub.slice("remove".length).trim(), ctx);
             }
-            else if (sub === "list") {
-                ctx.ui.notify("[remote-pi] '/remote-pi list' deprecated — use '/remote-pi devices'", "warning");
-                await _cmdList(ctx);
+            else if (sub === "daemons") {
+                await _cmdDaemonsList(ctx);
+            }
+            else if (sub === "daemon start") {
+                await _cmdDaemonStart(ctx);
+            }
+            else if (sub === "daemon stop") {
+                await _cmdDaemonStop(ctx);
             }
-            else if (sub.startsWith("add-relay")) {
-                ctx.ui.notify("[remote-pi] '/remote-pi add-relay' deprecated — use '/remote-pi relay url <...>'", "warning");
-                _cmdSetRelay(sub.slice("add-relay".length).trim(), ctx);
+            else if (sub === "daemon restart") {
+                await _cmdDaemonRestart(ctx);
+            }
+            else if (sub === "daemon status") {
+                await _cmdDaemonStatus(ctx);
+            }
+            else if (sub.startsWith("daemon send")) {
+                await _cmdDaemonSend(sub.slice("daemon send".length).trim(), ctx);
+            }
+            else if (sub === "install") {
+                _cmdInstall(ctx, { linkCli: true });
+            }
+            else if (sub === "uninstall") {
+                _cmdUninstall(ctx, { linkCli: true });
             }
             else {
-                await _cmdStatus(ctx);
+                await _cmdRoot(ctx);
             }
         },
     });
-    // Nested registrations (full taxonomy)
+    // Nested registrations (one entry per public action). The flat handler
+    // above already routes `/remote-pi <sub>` — these exist for the SDK's
+    // command palette and slash-autocomplete in some UI modes.
     pi.registerCommand("remote-pi setup", { description: "Run the setup wizard and update local config", handler: async (_, ctx) => { _lastCtx = ctx; await _cmdSetup(ctx); } });
-    pi.registerCommand("remote-pi join", { description: "Join (or create) a local agent session", handler: async (args, ctx) => { _lastCtx = ctx; await _cmdJoin(args.trim(), ctx); } });
-    pi.registerCommand("remote-pi leave", { description: "Leave the current agent session", handler: async (_, ctx) => { _lastCtx = ctx; await _cmdLeave(ctx); } });
-    pi.registerCommand("remote-pi rename", { description: "Rename this agent in the current session", handler: async (args, ctx) => { _lastCtx = ctx; await _cmdRename(args.trim(), ctx); } });
-    pi.registerCommand("remote-pi sessions", { description: "List local agent sessions", handler: async (_, ctx) => { _lastCtx = ctx; _cmdSessions(ctx); } });
-    pi.registerCommand("remote-pi relay", { description: "Toggle the relay connection on/off", handler: async (_, ctx) => { _lastCtx = ctx; await _cmdRelayToggle(ctx); } });
-    pi.registerCommand("remote-pi relay start", { description: "Connect to the relay", handler: async (_, ctx) => { _lastCtx = ctx; await _cmdStart(ctx); } });
-    pi.registerCommand("remote-pi relay stop", { description: "Disconnect from the relay", handler: async (_, ctx) => { _lastCtx = ctx; await _cmdStop(ctx); } });
-    pi.registerCommand("remote-pi relay status", { description: "Show current relay status", handler: async (_, ctx) => { _lastCtx = ctx; _cmdRelayStatus(ctx); } });
-    pi.registerCommand("remote-pi relay url", { description: "Set relay URL (alias of /remote-pi set-relay)", handler: async (args, ctx) => { _lastCtx = ctx; _cmdSetRelay(args.trim(), ctx); } });
+    pi.registerCommand("remote-pi status", { description: "Show local mesh + relay status", handler: async (_, ctx) => { _lastCtx = ctx; _cmdStatus(ctx); } });
+    pi.registerCommand("remote-pi stop", { description: "Stop everything (leave local mesh + disconnect relay)", handler: async (_, ctx) => { _lastCtx = ctx; await _cmdStop(ctx); } });
     pi.registerCommand("remote-pi pair", { description: "Show a QR code to pair a new mobile device", handler: async (_, ctx) => { _lastCtx = ctx; await _cmdPair(ctx); } });
     pi.registerCommand("remote-pi devices", { description: "List paired mobile devices", handler: async (_, ctx) => { _lastCtx = ctx; await _cmdList(ctx); } });
     pi.registerCommand("remote-pi revoke", {
@@ -669,77 +985,164 @@ const extension = (pi) => {
         handler: async (args, ctx) => { _lastCtx = ctx; await _cmdRevoke(args.trim(), ctx); },
     });
     pi.registerCommand("remote-pi set-relay", { description: "Persist a new relay URL to user config", handler: async (args, ctx) => { _lastCtx = ctx; _cmdSetRelay(args.trim(), ctx); } });
-    pi.registerCommand("remote-pi config", { description: "Show the effective relay URL and its source", handler: async (_, ctx) => { _lastCtx = ctx; _cmdConfig(ctx); } });
-    // Legacy aliases (deprecated, 1-release deprecation window).
-    const legacyWarn = (ctx, old, neu) => ctx.ui.notify(`[remote-pi] '${old}' deprecated — use '${neu}'`, "warning");
-    pi.registerCommand("remote-pi start", {
-        description: "[DEPRECATED] alias of /remote-pi relay start (also auto-joins the default session)",
-        handler: async (_, ctx) => { _lastCtx = ctx; legacyWarn(ctx, "/remote-pi start", "/remote-pi relay start"); await _cmdJoin("", ctx); await _cmdStart(ctx); },
-    });
-    pi.registerCommand("remote-pi stop", {
-        description: "[DEPRECATED] alias of /remote-pi leave + /remote-pi relay stop",
-        handler: async (_, ctx) => { _lastCtx = ctx; legacyWarn(ctx, "/remote-pi stop", "/remote-pi leave + /remote-pi relay stop"); await _cmdLeave(ctx); await _cmdStop(ctx); },
+    // Plan/25 Wave D
+    pi.registerCommand("remote-pi peers", {
+        description: "List local + cross-PC mesh peers, grouped by PC label",
+        handler: async (_, ctx) => { _lastCtx = ctx; await _cmdPeers(ctx); },
     });
-    pi.registerCommand("remote-pi list", {
-        description: "[DEPRECATED] alias of /remote-pi devices",
-        handler: async (_, ctx) => { _lastCtx = ctx; legacyWarn(ctx, "/remote-pi list", "/remote-pi devices"); await _cmdList(ctx); },
+    // Daemon registry (plan/26 Wave 1) — create + remove. start/stop/send/
+    // status/install/uninstall come in later waves with the supervisor.
+    pi.registerCommand("remote-pi create", {
+        description: "Register a folder as a daemon (will be supervised once `install` runs)",
+        handler: async (args, ctx) => { _lastCtx = ctx; _cmdCreate(args.trim(), ctx); },
     });
-    pi.registerCommand("remote-pi add-relay", {
-        description: "[DEPRECATED] alias of /remote-pi relay url",
-        handler: async (args, ctx) => { _lastCtx = ctx; legacyWarn(ctx, "/remote-pi add-relay", "/remote-pi relay url"); _cmdSetRelay(args.trim(), ctx); },
+    pi.registerCommand("remote-pi remove", {
+        description: "Unregister a daemon by id (local config is preserved)",
+        handler: async (args, ctx) => { _lastCtx = ctx; _cmdRemove(args.trim(), ctx); },
     });
+    // Fleet ops via the supervisor (plan/26 W2). `/remote-pi stop` stays as
+    // local stop — fleet stop is `/remote-pi daemon stop`.
+    pi.registerCommand("remote-pi daemons", { description: "List registered daemons + state", handler: async (_, ctx) => { _lastCtx = ctx; await _cmdDaemonsList(ctx); } });
+    pi.registerCommand("remote-pi daemon start", { description: "Start every registered daemon", handler: async (_, ctx) => { _lastCtx = ctx; await _cmdDaemonStart(ctx); } });
+    pi.registerCommand("remote-pi daemon stop", { description: "Stop every running daemon", handler: async (_, ctx) => { _lastCtx = ctx; await _cmdDaemonStop(ctx); } });
+    pi.registerCommand("remote-pi daemon restart", { description: "Restart every registered daemon", handler: async (_, ctx) => { _lastCtx = ctx; await _cmdDaemonRestart(ctx); } });
+    pi.registerCommand("remote-pi daemon status", { description: "Show fleet runtime status (pid, uptime, restarts)", handler: async (_, ctx) => { _lastCtx = ctx; await _cmdDaemonStatus(ctx); } });
+    pi.registerCommand("remote-pi daemon send", { description: "Send a prompt to a daemon: `daemon send <id> \"<text>\"`", handler: async (args, ctx) => { _lastCtx = ctx; await _cmdDaemonSend(args.trim(), ctx); } });
+    // Service install / uninstall (plan/26 W3)
+    pi.registerCommand("remote-pi install", { description: "Install pi-supervisord as a system service + link the remote-pi CLI into ~/.local/bin (systemd/launchd)", handler: async (_, ctx) => { _lastCtx = ctx; _cmdInstall(ctx, { linkCli: true }); } });
+    pi.registerCommand("remote-pi uninstall", { description: "Remove the pi-supervisord system service + the ~/.local/bin symlinks (daemons registry preserved)", handler: async (_, ctx) => { _lastCtx = ctx; _cmdUninstall(ctx, { linkCli: true }); } });
 };
 export default extension;
 // ── Command implementations ───────────────────────────────────────────────────
-function _showStatus(ctx) {
+/**
+ * `/remote-pi status` — full state snapshot. Two lines: local mesh + relay.
+ *
+ * Always callable; safe when nothing is up (renders the off variants).
+ * Reuses the same icons as the footer so terminal + status output stay
+ * visually consistent.
+ */
+function _cmdStatus(ctx) {
     const relayUrl = _relayUrl ?? resolveRelayUrl().url;
-    const sessionPart = _sessionName ? `session=${_sessionName} (${_sessionPeerCount}) · ` : "";
-    let msg;
-    if (_state === "idle")
-        msg = `[remote-pi] ${sessionPart}relay=idle (${relayUrl}). Run /remote-pi relay start to connect.`;
-    else if (_state === "started")
-        msg = `[remote-pi] ${sessionPart}relay=started (peer=${_peerShort || "?"}, ${relayUrl}) — run /remote-pi pair to show QR`;
-    else
-        msg = `[remote-pi] ${sessionPart}relay=paired (peer=${_peerShort}, ${relayUrl}) — connected and ready`;
-    ctx.ui.notify(msg, "info");
-}
-async function _cmdStatus(ctx) {
+    // Mesh line
+    let meshLine;
+    if (_sessionPeer) {
+        const name = _sessionPeer.name();
+        meshLine = `🟢 Local mesh: connected as "${name}" (${_sessionPeerCount} peer${_sessionPeerCount === 1 ? "" : "s"})`;
+    }
+    else {
+        meshLine = "⚪ Local mesh: not connected";
+    }
+    // Relay line — paired state is derived from _activePeers.size now.
+    let relayLine;
+    if (_state === "idle") {
+        relayLine = `⚪ Relay: off (${relayUrl}) — run /remote-pi to start`;
+    }
+    else if (_activePeers.size > 0) {
+        const count = _activePeers.size;
+        const shortids = [..._activePeers.keys()].map((k) => k.slice(0, 8)).join(", ");
+        relayLine = `🟢 Relay: ${count} owner${count === 1 ? "" : "s"} online (${shortids}) (${relayUrl})`;
+    }
+    else {
+        relayLine = _hasGlobalPairings
+            ? `🟢 Relay: on, waiting for an app to connect (${relayUrl})`
+            : `🟡 Relay: on, waiting for first pairing (${relayUrl})`;
+    }
+    ctx.ui.notify(`[remote-pi]\n  ${meshLine}\n  ${relayLine}`, "info");
+}
+/**
+ * Plan/25 Wave D: `/remote-pi peers`.
+ *
+ * Queries the local broker for the aggregated peer inventory (`list_peers`
+ * returns locals + cross-PC entries prefixed with `<pc_label>:`). Formats
+ * the result grouped by source so users can see at a glance who's on
+ * their machine vs. on a paired sibling Pi.
+ */
+async function _cmdPeers(ctx) {
+    if (!_sessionPeer) {
+        ctx.ui.notify("[remote-pi] Not on the local mesh. Run /remote-pi to join.", "warning");
+        return;
+    }
+    let peers;
+    try {
+        const reply = await _sessionPeer.request("broker", { type: "list_peers" }, 2000);
+        peers = reply.body?.peers ?? [];
+    }
+    catch (err) {
+        ctx.ui.notify(`[remote-pi] peers list failed: ${String(err)}`, "error");
+        return;
+    }
+    // Exclude self from the printed list — `list_peers` returns every peer
+    // registered with the broker including the caller, which is noise here.
+    const selfName = _sessionPeer.name();
+    ctx.ui.notify(`[remote-pi] peers:\n${formatPeerInventory(peers, selfName)}`, "info");
+}
+/**
+ * Root handler for `/remote-pi`. On first run (no local config) drops into
+ * the wizard; on subsequent runs auto-joins the local mesh + starts the
+ * relay (if opted in during setup), then prints the status.
+ *
+ * `/remote-pi` is intentionally the only command users need day-to-day:
+ * idempotent connect + status display.
+ */
+async function _cmdRoot(ctx) {
     const cwd = "cwd" in ctx ? ctx.cwd : process.cwd();
+    // Per-cwd singleton: at most one Pi process per folder may run /remote-pi.
+    // Bind a UDS socket as the lock (kernel auto-releases on process exit, even
+    // crash); a second invocation in the same cwd sees the live socket and is
+    // refused here, before any wizard / mesh / relay side-effect can run.
+    // Once acquired, the lock is bound to the lifetime of THIS process — repeat
+    // calls to /remote-pi from the same terminal are idempotent (no re-acquire).
+    if (_cwdLock === null) {
+        const result = await acquireCwdLock(cwd);
+        if (!result.ok) {
+            ctx.ui.notify("[remote-pi] Another agent is already running in this folder. " +
+                "Use the existing terminal or run from a different folder.", "warning");
+            return;
+        }
+        _cwdLock = result;
+    }
     // First-time wizard: no local config in this cwd → run interactive setup.
     if (!localConfigExists(cwd)) {
         const ui = ctx.ui;
         if (typeof ui.select !== "function") {
-            _showStatus(ctx);
+            _cmdStatus(ctx);
             return;
         }
         const baseDefault = defaultAgentName(cwd);
-        const newConfig = await runSetupWizard(ui, {
+        const wizardResult = await runSetupWizard(ui, {
             agent_name: baseDefault,
-            session_name: baseDefault,
-            auto_start_relay: true,
+            use_relay: true,
+            enable_daemon: false,
         });
-        if (!newConfig) {
+        if (!wizardResult) {
             ctx.ui.notify("[remote-pi] Setup cancelled.", "info");
             return;
         }
+        // `enable_daemon` is wizard-only state, not part of LocalConfig.
+        const { enable_daemon, ...newConfig } = wizardResult;
         saveLocalConfig(cwd, newConfig);
         ctx.ui.notify(`[remote-pi] Config saved to ${cwd}/.pi/remote-pi/config.json`, "info");
-        await _cmdJoin(newConfig.session_name ?? baseDefault, ctx);
+        await _cmdJoin(ctx);
         if (effectiveAutoStartRelay(newConfig))
             await _cmdStart(ctx);
-        _showStatus(ctx);
+        if (enable_daemon)
+            _cmdInstall(ctx, { linkCli: true });
+        _cmdStatus(ctx);
         return;
     }
     // Returning user with config: auto-start if requested + currently inactive.
     const config = loadLocalConfig(cwd);
     if (effectiveAutoStartRelay(config) && !_sessionPeer) {
-        const sessionName = config.session_name ?? defaultAgentName(cwd);
-        await _cmdJoin(sessionName, ctx);
+        await _cmdJoin(ctx);
         if (_state === "idle")
             await _cmdStart(ctx);
     }
-    _showStatus(ctx);
+    _cmdStatus(ctx);
 }
+/**
+ * `/remote-pi setup` — re-run the wizard. Defaults pre-fill from the
+ * existing config so it doubles as an "edit" flow.
+ */
 async function _cmdSetup(ctx) {
     const cwd = "cwd" in ctx ? ctx.cwd : process.cwd();
     const ui = ctx.ui;
@@ -749,17 +1152,23 @@ async function _cmdSetup(ctx) {
     }
     const current = loadLocalConfig(cwd);
     const baseDefault = defaultAgentName(cwd);
-    const newConfig = await runSetupWizard(ui, {
+    const wizardResult = await runSetupWizard(ui, {
         agent_name: current.agent_name ?? baseDefault,
-        session_name: current.session_name ?? baseDefault,
-        auto_start_relay: effectiveAutoStartRelay(current),
+        use_relay: effectiveAutoStartRelay(current),
+        // No way to introspect launchd/systemd here without shelling out;
+        // default the wizard to "off" — re-running setup is for changing
+        // your mind, not for re-confirming current OS state.
+        enable_daemon: false,
     });
-    if (!newConfig) {
+    if (!wizardResult) {
         ctx.ui.notify("[remote-pi] Setup cancelled.", "info");
         return;
     }
+    const { enable_daemon, ...newConfig } = wizardResult;
     saveLocalConfig(cwd, newConfig);
-    ctx.ui.notify("[remote-pi] Config updated. Run /remote-pi to apply now (join + relay).", "info");
+    ctx.ui.notify("[remote-pi] Config updated. Run /remote-pi to apply now.", "info");
+    if (enable_daemon)
+        _cmdInstall(ctx, { linkCli: true });
 }
 async function _cmdStart(ctx) {
     if (_state !== "idle") {
@@ -774,7 +1183,9 @@ async function _cmdStart(ctx) {
     // share the same Ed25519 identity without colliding on the relay.
     const cwd = "cwd" in ctx ? ctx.cwd : process.cwd();
     const roomId = roomIdForCwd(cwd);
-    const sessionName = cwd.split("/").slice(-2).join("/") || "remote";
+    // Same name we send in pair_ok — keeps room_meta.name and the per-pair
+    // session_name aligned so the app shows consistent labels.
+    const sessionName = _displayName(cwd);
     // Initial model from ctx (ExtensionContext.model is the SDK's current
     // selection — set by user settings or last-used). May be undefined on
     // first boot before any model_select; that's fine, room_meta omits the
@@ -791,7 +1202,10 @@ async function _cmdStart(ctx) {
     // entry that surfaces in the app as a phantom legacy session.
     _myRoomMeta = roomMeta;
     ctx.ui.notify(`[remote-pi] Connecting to relay ${relayUrl} (source: ${source}, room: ${roomId})…`, "info");
-    const relay = new RelayClient(relayUrl, edKp);
+    // Transport opens WebSocket; convert the canonical http(s):// stored
+    // form to ws(s):// at this boundary. The relayUrl variable keeps the
+    // http(s):// form for logging + mesh client construction below.
+    const relay = new RelayClient(toWebSocketUrl(relayUrl), edKp);
     try {
         await relay.connect({ roomId, roomMeta });
     }
@@ -821,34 +1235,152 @@ async function _cmdStart(ctx) {
     relay.on("close", _onRelayClose);
     _stopAutoListener = _installAutoListener(relay);
     _refreshFooter(ctx);
+    // Plan/24 Wave 3: poll mesh_versions to detect remote revocation. The
+    // poller is independent of WS (uses HTTP) and self-heals across relay
+    // reconnects, so a single start here per relay-up cycle is enough.
+    if (_selfRevoke === null) {
+        _selfRevoke = new SelfRevoke({
+            client: new MeshClient(relayUrl),
+            storage: { listOwnerPubkeys, removePeer },
+            myPubkey: edKp.publicKey,
+            onRevoke: (ownerEpk) => {
+                // Multi-channel (W2D): drop only the revoked owner's channel.
+                // Other owners keep their session. Only fall back to full idle
+                // when there are zero attached owners left.
+                _refreshPairingsCache();
+                if (_activePeers.has(ownerEpk)) {
+                    _detachPeerChannel(ownerEpk);
+                    _refreshFooter();
+                }
+                // Surface the revocation inside the Pi chat panel via
+                // `pi.sendMessage` (same channel the QR pair-code uses). Plain
+                // `console.info` from the SelfRevoke poller bypasses the TUI
+                // widget and bleeds into the prompt area, garbling the layout
+                // — same issue we hit with the QR ASCII before plan/24 Wave 3.
+                // sendMessage with a customType keeps the line inline with
+                // the agent's transcript. The poller's own `log.info` keeps
+                // running for daemons/CI where no TUI is attached.
+                const short = ownerEpk.slice(0, 8);
+                _pi?.sendMessage({
+                    customType: "remote-pi:mesh-revoked",
+                    content: `🔒 Revoked by Owner ${short}…\n\n` +
+                        `The mobile app for this Owner removed this PC from the mesh. ` +
+                        `Re-pair via /remote-pi pair if this was unexpected.`,
+                    display: true,
+                });
+            },
+            // Plan/25 Wave D: keep broker_remote's sibling list in sync with
+            // mesh_versions. The poller fires this whenever the union of Pi
+            // members across owners changes — adding/removing a sibling, or
+            // an owner relabeling a nickname. `_brokerRemote` may be null
+            // until `_ensureBrokerRemote` finishes; the callback short-circuits.
+            onMembersChanged: (siblings) => {
+                _brokerRemote?.setSiblings(siblings);
+            },
+        });
+        _selfRevoke.start();
+    }
+    // Plan/25 Wave B/C: bring up cross-PC routing if local broker is ready.
+    // No-op when we're a follower (broker_remote needs the local Broker
+    // instance the leader hosts). Best-effort; failures log but don't break
+    // single-PC operation.
+    void _ensureBrokerRemote().catch((err) => {
+        console.error(`[remote-pi] _ensureBrokerRemote failed: ${String(err)}`);
+    });
     ctx.ui.notify(`[remote-pi] state: started (peer=${myShort}) — Connected to relay ${relayUrl}`, "info");
 }
+/**
+ * `/remote-pi pair` — always generates a fresh QR when the relay is up.
+ *
+ * Pre-W2D this rejected with "Already paired with X" once one owner was
+ * connected, forcing /remote-pi stop to pair a second device — the
+ * catch-22 the multi-channel refactor was designed to break. Now the new
+ * device is **added** to `_activePeers` after scanning, while existing
+ * owners keep their session.
+ */
 async function _cmdPair(ctx) {
+    const cwd = "cwd" in ctx ? ctx.cwd : "";
+    // Auto-bootstrap when services are down. Before this, `/remote-pi pair`
+    // on a fresh terminal forced the user to call `/remote-pi` first — every
+    // session began with the same surprise warning + second command. Now we
+    // do the join + relay-start inline so the common "I just opened a
+    // terminal and want to pair my phone" flow is a single command.
+    //
+    // We don't run the first-time wizard here: pair is a focused operation
+    // and the wizard prompts are wrong UX in that flow. If there's no local
+    // config, the user truly needs to run `/remote-pi` first to configure.
     if (_state === "idle") {
-        ctx.ui.notify("[remote-pi] Run /remote-pi start first.", "warning");
-        return;
+        if (!localConfigExists(cwd)) {
+            ctx.ui.notify("[remote-pi] First-time setup needed. Run /remote-pi to configure, then /remote-pi pair.", "warning");
+            return;
+        }
+        ctx.ui.notify("[remote-pi] Starting mesh + relay before pairing…", "info");
+        if (!_sessionPeer)
+            await _cmdJoin(ctx);
+        if (_state === "idle")
+            await _cmdStart(ctx);
     }
-    if (_state === "paired") {
-        ctx.ui.notify(`[remote-pi] Already paired with ${_peerShort}. Run /remote-pi stop first.`, "warning");
+    // Relay must be up — the QR carries a token the app exchanges through
+    // the relay. Without a live WS there's nothing for the scan to land on.
+    if (_state === "idle" || !_relay) {
+        ctx.ui.notify("[remote-pi] Pair requires the relay to be connected. " +
+            "Run /remote-pi to start it (or fix your relay URL via /remote-pi set-relay).", "warning");
         return;
     }
     const edKp = _cachedEd25519;
-    const cwd = "cwd" in ctx ? ctx.cwd : "";
-    const sessionName = cwd.split("/").slice(-2).join("/") || "remote";
+    // Embed the user-configured name in the QR so the app shows it on the
+    // pairing screen before pair_ok lands (better UX than "remote" or a
+    // raw path snippet).
+    const sessionName = _displayName(cwd);
     const { token, expiresAt } = qrSession.issueToken();
     const roomId = _myRoomId ?? roomIdForCwd(cwd);
     const qrUri = buildQRUri(token, edKp.publicKey, sessionName, roomId);
-    displayQR(qrUri);
-    ctx.ui.notify(`[remote-pi] QR ready — valid until ${new Date(expiresAt).toLocaleTimeString()}. Scan with the app.`, "info");
+    // Render both the QR ASCII and the copy-paste URI inside the Pi TUI's
+    // chat panel via `pi.sendMessage` — the same channel the SDK uses for
+    // agent responses + tool results. `process.stderr.write` (the old QR
+    // path via `displayQR`) broke the TUI layout because it bypassed the
+    // chat widget and bled into the prompt area. qrcode-terminal v0.12
+    // small mode is pure Unicode (█ ▀ ▄ space, no ANSI escapes — see
+    // `lib/main.js:48-53`), so embedding the ASCII inside a sendMessage
+    // content string renders correctly without raw escape bytes.
+    if (_pi) {
+        const qrAscii = renderQRAscii(qrUri);
+        _pi.sendMessage({
+            customType: "remote-pi:pair-code",
+            content: `📱 Scan to pair:\n\n${qrAscii}\n` +
+                `📋 Or copy this pairing code (camera-less devices):\n\n${qrUri}`,
+            display: true,
+        });
+    }
+    ctx.ui.notify(`[remote-pi] QR ready — valid until ${new Date(expiresAt).toLocaleTimeString()}. ` +
+        `Scan with the app, or copy the pairing code printed above.`, "info");
     // Returns immediately; the auto-listener transitions to 'paired' on pair_request.
 }
+/**
+ * `/remote-pi stop` — full teardown. Leaves the local UDS mesh AND closes
+ * the relay. Safe when one or both are already off. To resume, run
+ * `/remote-pi` again.
+ */
 async function _cmdStop(ctx) {
-    if (_state === "idle") {
-        ctx.ui.notify("[remote-pi] Already idle — nothing to stop.", "info");
+    const meshUp = _sessionPeer !== null;
+    const relayUp = _state !== "idle";
+    if (!meshUp && !relayUp) {
+        ctx.ui.notify("[remote-pi] Already stopped — nothing to do.", "info");
         return;
     }
-    _goIdle("peer_stop");
-    ctx.ui.notify("[remote-pi] state: idle — Disconnected.", "info");
+    if (meshUp) {
+        try {
+            await _sessionPeer.leave();
+        }
+        catch { /* best-effort */ }
+        _sessionPeer = null;
+        _sessionName = null;
+        _sessionPeerCount = 0;
+    }
+    if (relayUp)
+        _goIdle("peer_stop");
+    ctx.ui.notify("[remote-pi] Stopped (mesh + relay disconnected).", "info");
+    _refreshFooter(ctx);
 }
 async function _cmdList(ctx) {
     const peers = await listPeers();
@@ -856,10 +1388,13 @@ async function _cmdList(ctx) {
         ctx.ui.notify("[remote-pi] No paired devices.", "info");
         return;
     }
+    // Multi-channel (W2D): each peer is either `online` (channel attached
+    // right now) or `offline` (in peers.json but not connected). Replaces
+    // the singleton " (active)" marker that only ever marked one peer.
     const lines = peers.map((p) => {
         const shortid = p.remote_epk.slice(0, 8);
-        const active = _state === "paired" && _appPeerId === p.remote_epk ? " (active)" : "";
-        return `• ${shortid} — ${p.name}${active}`;
+        const tag = _activePeers.has(p.remote_epk) ? " 🟢 online" : " ⚪ offline";
+        return `• ${shortid} — ${p.name}${tag}`;
     }).join("\n");
     ctx.ui.notify(`[remote-pi] Paired devices:\n${lines}`, "info");
 }
@@ -883,8 +1418,18 @@ async function _cmdRevoke(arg, ctx) {
     const peer = matches[0];
     await removePeer(peer.remote_epk);
     _refreshPairingsCache();
-    if (_state === "paired" && _appPeerId === peer.remote_epk) {
-        _goIdle("session_replaced");
+    // Multi-channel (W2D): close just this owner's channel. Other connected
+    // owners keep their session — the relay stays `started`.
+    if (_activePeers.has(peer.remote_epk)) {
+        // Notify the revoked device explicitly before tearing the channel
+        // down — otherwise it would only know via ping miss.
+        const ch = _activePeers.get(peer.remote_epk);
+        try {
+            ch?.send({ type: "bye", reason: "session_replaced" });
+        }
+        catch { /* best-effort */ }
+        _detachPeerChannel(peer.remote_epk);
+        _refreshFooter();
     }
     ctx.ui.notify(`[remote-pi] Revoked: ${peer.name} (${peer.remote_epk.slice(0, 8)}…)`, "info");
 }
@@ -896,21 +1441,309 @@ async function _shortidCompletions(prefix, valuePrefix = "") {
         .map((x) => ({ value: `${valuePrefix}${x.shortid}`, label: `${x.shortid} (${x.name})` }));
 }
 function _cmdSetRelay(arg, ctx) {
-    const url = arg.trim();
-    if (!url) {
-        ctx.ui.notify("[remote-pi] Usage: /remote-pi set-relay <ws:// or wss:// url>", "warning");
+    const raw = arg.trim();
+    if (!raw) {
+        ctx.ui.notify("[remote-pi] Usage: /remote-pi set-relay <http:// or https:// url>", "warning");
+        return;
+    }
+    if (isWebSocketScheme(raw)) {
+        ctx.ui.notify(`[remote-pi] Use http:// or https://. The extension converts to WebSocket automatically.`, "error");
+        return;
+    }
+    if (!isValidRelayUrl(raw)) {
+        ctx.ui.notify(`[remote-pi] Invalid URL: ${raw}. Must start with http:// or https://`, "error");
+        return;
+    }
+    saveConfig({ relay: raw });
+    ctx.ui.notify(`[remote-pi] Relay set to ${raw}. Run /remote-pi start (or restart) to apply.`, "info");
+}
+// ── Daemon registry commands (plan/26 Wave 1) ─────────────────────────────────
+/**
+ * `/remote-pi create [<cwd>] [--name <name>]`
+ *
+ * Promotes a folder to a daemon entry in `~/.pi/remote/daemons.json`. The
+ * cwd is **always normalized to an absolute realpath** before storage —
+ * `~/Movies`, `./Movies`, `../foo/Movies` all collapse to a single
+ * canonical entry. Relative paths resolve against the Pi process's
+ * current working directory, not the slash-command's `ctx.cwd`.
+ *
+ * Side effects on the cwd's local config (`<cwd>/.pi/remote-pi/config.json`):
+ *   - If the config doesn't exist: created with `auto_start_relay=true`
+ *     (mandatory for daemons) and `agent_name` from `--name` if provided.
+ *   - If the config already exists: left untouched. Re-running `create`
+ *     on an existing daemon is idempotent at this layer; the registry
+ *     itself rejects duplicate cwds.
+ */
+function _cmdCreate(arg, ctx) {
+    // Parse `[cwd] [--name "value with spaces" | --name word]` in any order.
+    // The first non-flag token is the cwd; the rest of the line after
+    // `--name` (quoted or unquoted) is the display name.
+    const nameMatch = arg.match(/--name\s+"([^"]+)"|--name\s+(\S+)/);
+    const name = nameMatch ? (nameMatch[1] ?? nameMatch[2]) : undefined;
+    const cwdRaw = arg.replace(/--name\s+"[^"]+"|--name\s+\S+/, "").trim();
+    if (!cwdRaw) {
+        ctx.ui.notify("[remote-pi] Usage: /remote-pi create <absolute-or-relative-cwd> [--name \"Display name\"]", "warning");
+        return;
+    }
+    let result;
+    try {
+        result = addDaemon(cwdRaw);
+    }
+    catch (err) {
+        ctx.ui.notify(`[remote-pi] create failed: ${String(err)}`, "error");
+        return;
+    }
+    // Provision local config when missing. Use the existing helpers so the
+    // daemon's first boot sees the same shape as a manually-configured Pi.
+    // `saveLocalConfig` is a partial-merge: if the file already exists with
+    // a different agent_name we DON'T overwrite — user's existing config
+    // wins to avoid surprises.
+    if (!localConfigExists(result.cwd)) {
+        saveLocalConfig(result.cwd, {
+            agent_name: name ?? defaultAgentName(result.cwd),
+            auto_start_relay: true,
+        });
+    }
+    const finalName = loadLocalConfig(result.cwd).agent_name ?? defaultAgentName(result.cwd);
+    ctx.ui.notify(`[remote-pi] Daemon registered: id=${result.id} name="${finalName}" cwd=${result.cwd}`, "info");
+}
+/**
+ * `/remote-pi remove <id>`
+ *
+ * Unregisters a daemon by its 8-hex-char id (the same id printed by
+ * `/remote-pi create` and `/remote-pi daemons`). The cwd's local config
+ * stays on disk — re-creating later with the same cwd is a no-op
+ * because the existing config wins.
+ */
+function _cmdRemove(arg, ctx) {
+    const id = arg.trim();
+    if (!id) {
+        ctx.ui.notify("[remote-pi] Usage: /remote-pi remove <id>. Run /remote-pi daemons to see ids.", "warning");
+        return;
+    }
+    let result;
+    try {
+        result = removeDaemon(id);
+    }
+    catch (err) {
+        ctx.ui.notify(`[remote-pi] remove failed: ${String(err)}`, "error");
+        return;
+    }
+    if (!result.removed) {
+        // Surface the registered ids for a quick visual diff.
+        const known = listDaemons().map((d) => d.id).join(", ") || "(none)";
+        ctx.ui.notify(`[remote-pi] No daemon with id "${id}". Known ids: ${known}`, "warning");
+        return;
+    }
+    ctx.ui.notify(`[remote-pi] Daemon removed: id=${id} cwd=${result.cwd}. ` +
+        `Local config at ${result.cwd}/.pi/remote-pi/config.json was kept.`, "info");
+}
+// ── Fleet-ops commands (plan/26 W2) — talk to the supervisor over UDS ─────────
+//
+// Every command here is a thin wrapper around `callSupervisor(...)`. When
+// the supervisor isn't running we fall back to a friendly hint instead of
+// the raw error, so the user can't get stuck on "what's wrong?".
+function _notifyOffline(ctx, err) {
+    ctx.ui.notify(`[remote-pi] ${err.message}`, "warning");
+}
+function _formatDaemonTable(daemons) {
+    if (daemons.length === 0)
+        return "(no daemons registered)";
+    const rows = daemons.map((d) => {
+        const uptime = d.uptime_s !== undefined ? `${d.uptime_s}s` : "—";
+        const pid = d.pid !== undefined ? String(d.pid) : "—";
+        const restarts = d.restart_count ?? 0;
+        return `  ${d.id}  ${d.state.padEnd(8)}  pid=${pid}  up=${uptime}  restarts=${restarts}  ${d.name}  ${d.cwd}`;
+    });
+    return rows.join("\n");
+}
+/**
+ * `/remote-pi daemons` — registry + runtime state in one view. When the
+ * supervisor is offline we still show registry-only output (state =
+ * "stopped" everywhere), so the user can see what's configured even
+ * before `install`.
+ */
+async function _cmdDaemonsList(ctx) {
+    if (!(await supervisorOnline())) {
+        const registry = listDaemons();
+        if (registry.length === 0) {
+            ctx.ui.notify("[remote-pi] No daemons registered. Run /remote-pi create <cwd>.", "info");
+            return;
+        }
+        const rows = registry.map((d) => {
+            const cfg = loadLocalConfig(d.cwd);
+            const name = cfg.agent_name ?? defaultAgentName(d.cwd);
+            return `  ${d.id}  ${name}  ${d.cwd}  (supervisor offline)`;
+        }).join("\n");
+        ctx.ui.notify(`[remote-pi] Daemons (registry only — run install to bring supervisor up):\n${rows}`, "info");
+        return;
+    }
+    try {
+        const data = await callSupervisor({ op: "list" });
+        ctx.ui.notify(`[remote-pi] Daemons:\n${_formatDaemonTable(data.daemons)}`, "info");
+    }
+    catch (err) {
+        if (err instanceof SupervisorOfflineError) {
+            _notifyOffline(ctx, err);
+            return;
+        }
+        ctx.ui.notify(`[remote-pi] daemons failed: ${String(err)}`, "error");
+    }
+}
+async function _cmdDaemonStatus(ctx) {
+    try {
+        const data = await callSupervisor({ op: "status" });
+        ctx.ui.notify(`[remote-pi] Fleet status:\n${_formatDaemonTable(data.daemons)}`, "info");
+    }
+    catch (err) {
+        if (err instanceof SupervisorOfflineError) {
+            _notifyOffline(ctx, err);
+            return;
+        }
+        ctx.ui.notify(`[remote-pi] status failed: ${String(err)}`, "error");
+    }
+}
+async function _cmdDaemonStart(ctx) {
+    try {
+        const data = await callSupervisor({ op: "start_all" });
+        ctx.ui.notify(`[remote-pi] Started ${data.started.length} daemon(s), ` +
+            `${data.already_running.length} already running.`, "info");
+    }
+    catch (err) {
+        if (err instanceof SupervisorOfflineError) {
+            _notifyOffline(ctx, err);
+            return;
+        }
+        ctx.ui.notify(`[remote-pi] start failed: ${String(err)}`, "error");
+    }
+}
+async function _cmdDaemonStop(ctx) {
+    try {
+        const data = await callSupervisor({ op: "stop_all" });
+        ctx.ui.notify(`[remote-pi] Stopped ${data.stopped.length} daemon(s), ` +
+            `${data.already_stopped.length} already stopped.`, "info");
+    }
+    catch (err) {
+        if (err instanceof SupervisorOfflineError) {
+            _notifyOffline(ctx, err);
+            return;
+        }
+        ctx.ui.notify(`[remote-pi] stop failed: ${String(err)}`, "error");
+    }
+}
+async function _cmdDaemonRestart(ctx) {
+    try {
+        const data = await callSupervisor({ op: "restart_all" });
+        ctx.ui.notify(`[remote-pi] Restarted ${data.restarted.length} daemon(s).`, "info");
+    }
+    catch (err) {
+        if (err instanceof SupervisorOfflineError) {
+            _notifyOffline(ctx, err);
+            return;
+        }
+        ctx.ui.notify(`[remote-pi] restart failed: ${String(err)}`, "error");
+    }
+}
+/**
+ * `/remote-pi daemon send <id> "<text>"` — injects a prompt into a
+ * running daemon via its RPC stdin. The agent processes the prompt as
+ * if a user typed it; output flows back via the relay/mesh, not here.
+ *
+ * Fire-and-forget at this layer — the CLI just confirms delivery.
+ */
+async function _cmdDaemonSend(arg, ctx) {
+    // Parse `<id> <text...>` — id is the first token, rest is the prompt.
+    // The text may be quoted; if so, strip the outer quotes. Otherwise
+    // take the entire remainder verbatim.
+    const m = arg.match(/^(\S+)\s+(?:"([^"]*)"|(.*))$/);
+    if (!m) {
+        ctx.ui.notify("[remote-pi] Usage: /remote-pi daemon send <id> \"<prompt text>\"", "warning");
         return;
     }
-    if (!isValidRelayUrl(url)) {
-        ctx.ui.notify(`[remote-pi] Invalid URL: ${url}. Must start with ws:// or wss://`, "error");
+    const id = m[1];
+    const text = (m[2] ?? m[3] ?? "").trim();
+    if (!text) {
+        ctx.ui.notify("[remote-pi] daemon send: prompt text is empty.", "warning");
         return;
     }
-    saveConfig({ relay: url });
-    ctx.ui.notify(`[remote-pi] Relay set to ${url}. Run /remote-pi start (or restart) to apply.`, "info");
+    try {
+        const data = await callSupervisor({ op: "send", id, text });
+        if (data.delivered) {
+            ctx.ui.notify(`[remote-pi] Sent to ${id}: ${text.slice(0, 60)}${text.length > 60 ? "…" : ""}`, "info");
+        }
+        else {
+            ctx.ui.notify(`[remote-pi] daemon ${id} did not accept the prompt (not running?)`, "warning");
+        }
+    }
+    catch (err) {
+        if (err instanceof SupervisorOfflineError) {
+            _notifyOffline(ctx, err);
+            return;
+        }
+        ctx.ui.notify(`[remote-pi] daemon send failed: ${String(err)}`, "error");
+    }
+}
+// ── Install/uninstall the supervisor service (plan/26 W3) ────────────────────
+//
+// Installs `pi-supervisord` as a user-level system service (systemd
+// `--user` unit on Linux, launchd LaunchAgent on macOS). Once installed:
+//   - Supervisor starts at login + survives reboots.
+//   - `remote-pi daemon start/stop/send/...` work without manually
+//     spawning the supervisor.
+// Uninstall is the inverse — leaves the registry (`daemons.json`) intact,
+// so re-installing later picks up where you left off.
+/**
+ * `linkCli` controls whether we symlink `remote-pi` + `pi-supervisord`
+ * into `~/.local/bin/`. The slash-command path passes `true` (user is
+ * inside Pi's TUI — they installed via `pi install npm:remote-pi` and
+ * need us to expose the CLI for them). The standalone-CLI path passes
+ * `false` because the user is already running our binary from PATH (they
+ * did `npm install -g remote-pi`), so re-linking would point their
+ * `remote-pi` at the Pi-extension copy and diverge on upgrades.
+ */
+function _cmdInstall(ctx, opts = {}) {
+    const linkCli = opts.linkCli ?? false;
+    try {
+        const result = installService();
+        const sections = [
+            `[remote-pi] Supervisor service installed (${result.platform}).`,
+            `  Unit: ${result.unitPath}`,
+            `  Steps:\n${result.log.map((l) => "    " + l).join("\n")}`,
+        ];
+        if (linkCli) {
+            const link = linkCliBinaries();
+            sections.push(`  CLI bins linked into ${link.binDir}:`, link.links.map((l) => `    ${l.name} → ${l.target}`).join("\n"), `  Steps:\n${link.log.map((l) => "    " + l).join("\n")}`);
+            if (!link.onPath) {
+                sections.push(`  ⚠ ${link.binDir} is not on $PATH yet. Add this line to ~/.zshrc / ~/.bashrc:`, `      export PATH="$HOME/.local/bin:$PATH"`, `    Then open a new terminal and run \`remote-pi daemons\` to verify.`);
+            }
+        }
+        ctx.ui.notify(sections.join("\n"), "info");
+    }
+    catch (err) {
+        ctx.ui.notify(`[remote-pi] install failed: ${String(err)}`, "error");
+    }
 }
-function _cmdConfig(ctx) {
-    const { url, source } = resolveRelayUrl();
-    ctx.ui.notify(`[remote-pi] Relay: ${url}\n  Source: ${source}`, "info");
+function _cmdUninstall(ctx, opts = {}) {
+    const linkCli = opts.linkCli ?? false;
+    try {
+        const result = uninstallService();
+        const sections = [
+            `[remote-pi] Supervisor service uninstalled (${result.platform}).`,
+            `  Unit: ${result.unitPath} (${result.removed ? "removed" : "not present"})`,
+            `  Steps:\n${result.log.map((l) => "    " + l).join("\n")}`,
+            `  Note: daemons registry (~/.pi/remote/daemons.json) kept — re-install restores everything.`,
+        ];
+        if (linkCli) {
+            const unlink = unlinkCliBinaries();
+            sections.push(`  CLI bins cleanup (${unlink.binDir}):`, unlink.removed
+                .map((r) => `    ${r.name} (${r.existed ? "removed" : "not present"})`)
+                .join("\n"));
+        }
+        ctx.ui.notify(sections.join("\n"), "info");
+    }
+    catch (err) {
+        ctx.ui.notify(`[remote-pi] uninstall failed: ${String(err)}`, "error");
+    }
 }
 // ── Agent-network commands (plano 19) ─────────────────────────────────────────
 function _resolveExtensionDir() {
@@ -957,13 +1790,20 @@ function _deployAgentNetworkSkill() {
     }
     catch { /* best-effort */ }
 }
-async function _cmdJoin(arg, ctx) {
+/**
+ * Joins the fixed local UDS mesh ("local" session — see LOCAL_SESSION_NAME).
+ * Called by `_cmdRoot` on first run and on subsequent runs when the relay
+ * is up and the user hasn't explicitly stopped. The session name is no
+ * longer user-configurable: every Pi on the same machine joins the same
+ * broker.
+ */
+async function _cmdJoin(ctx) {
     const cwd = "cwd" in ctx ? ctx.cwd : process.cwd();
     const local = loadLocalConfig(cwd);
-    const sessionName = (arg || local.session_name || defaultAgentName(cwd)).trim();
+    const sessionName = LOCAL_SESSION_NAME;
     const agentName = local.agent_name || defaultAgentName(cwd);
     if (_sessionPeer) {
-        ctx.ui.notify(`[remote-pi] Already joined "${_sessionName}". Leave first.`, "warning");
+        ctx.ui.notify("[remote-pi] Already on the local mesh.", "warning");
         return;
     }
     ensureGlobalDirs();
@@ -978,6 +1818,19 @@ async function _cmdJoin(arg, ctx) {
         // failover, etc.) — querying list_peers makes the count self-healing.
         if (body && (body.type === "peer_joined" || body.type === "peer_left")) {
             _refreshSessionPeerCount(peer, ctx);
+            // Plan/25 Wave B: push fresh peer list to all siblings so their
+            // remotePeers cache stays current without polling.
+            void peer.request("broker", { type: "list_peers" }, 2000)
+                .then((reply) => {
+                const peers = reply.body?.peers;
+                if (Array.isArray(peers) && _brokerRemote) {
+                    // Strip remote-prefixed entries — onLocalPeersChanged wants
+                    // local-only names (`list_peers` returns aggregated).
+                    const local = peers.filter((p) => !p.includes(":"));
+                    _brokerRemote.onLocalPeersChanged(local);
+                }
+            })
+                .catch(() => { });
             return;
         }
         if (env.from === "broker")
@@ -1000,8 +1853,25 @@ async function _cmdJoin(arg, ctx) {
     // After failover (leader died, we re-elected): the new broker's peers map
     // starts fresh, but our cached `_sessionPeerCount` is stale. Re-seed it so
     // surviving peers don't carry the pre-failover count forever.
+    //
+    // Plan/25 Wave D: when this peer was promoted to leader by the failover,
+    // it now hosts a fresh `Broker` instance with no `RemoteRouter` attached.
+    // The previous broker_remote (on the dead leader) is gone with that
+    // process. Recreate ours here. Followers stay no-op (broker_remote only
+    // runs on the leader). Idempotent — _ensureBrokerRemote short-circuits
+    // when one is already wired.
     peer.onReconnect(() => {
         _refreshSessionPeerCount(peer, ctx);
+        if (peer.currentRole() === "leader") {
+            // Tear down any previous instance first — its broker reference is now
+            // stale (it pointed at the broker we hosted before the prior
+            // disconnect). The new broker comes from `peer.localBroker()` after
+            // reconnect.
+            _teardownBrokerRemote();
+            void _ensureBrokerRemote().catch((err) => {
+                console.error(`[remote-pi] _ensureBrokerRemote (post-failover) failed: ${String(err)}`);
+            });
+        }
     });
     try {
         const assigned = await peer.start();
@@ -1012,84 +1882,65 @@ async function _cmdJoin(arg, ctx) {
         // arrives — the newcomer doesn't get retroactive joined events. Ask the
         // broker for the live peer list to seed the count correctly on join.
         _refreshSessionPeerCount(peer, ctx);
-        saveLocalConfig(cwd, { agent_name: assigned, session_name: sessionName });
-        ctx.ui.notify(`[remote-pi] Joined session "${sessionName}" as "${assigned}" (${peer.currentRole()})`, "info");
+        saveLocalConfig(cwd, { agent_name: assigned });
+        ctx.ui.notify(`[remote-pi] Joined local mesh as "${assigned}" (${peer.currentRole()})`, "info");
         _refreshFooter(ctx);
+        // Plan/25 Wave B/C: try to bring up cross-PC routing now that the
+        // local broker exists. No-op if the relay isn't up yet (will fire
+        // again from `_cmdStart`).
+        void _ensureBrokerRemote().catch((err) => {
+            console.error(`[remote-pi] _ensureBrokerRemote (post-join) failed: ${String(err)}`);
+        });
     }
     catch (err) {
         ctx.ui.notify(`[remote-pi] join failed: ${String(err)}`, "error");
     }
 }
-async function _cmdLeave(ctx) {
-    if (!_sessionPeer) {
-        ctx.ui.notify("[remote-pi] Not in any session.", "info");
-        return;
-    }
-    await _sessionPeer.leave();
-    const name = _sessionName;
-    _sessionPeer = null;
-    _sessionName = null;
-    _sessionPeerCount = 0;
-    ctx.ui.notify(`[remote-pi] Left session "${name}".`, "info");
-    _refreshFooter(ctx);
-}
-async function _cmdRename(arg, ctx) {
-    const newName = arg.trim();
-    if (!newName) {
-        ctx.ui.notify("[remote-pi] Usage: /remote-pi rename <new-name>", "warning");
-        return;
-    }
-    if (!_sessionPeer) {
-        ctx.ui.notify("[remote-pi] Not in any session. Run /remote-pi join first.", "warning");
-        return;
-    }
-    try {
-        const assigned = await _sessionPeer.rename(newName);
-        const cwd = "cwd" in ctx ? ctx.cwd : process.cwd();
-        saveLocalConfig(cwd, { agent_name: assigned });
-        ctx.ui.notify(`[remote-pi] Renamed to "${assigned}".`, "info");
-    }
-    catch (err) {
-        ctx.ui.notify(`[remote-pi] rename failed: ${String(err)}`, "error");
-    }
-}
-function _cmdSessions(ctx) {
-    const sessions = listSessions();
-    if (sessions.length === 0) {
-        ctx.ui.notify("[remote-pi] No sessions found.", "info");
-        return;
-    }
-    const lines = sessions.map((s) => {
-        const live = sessionHasSock(s) ? "🟢" : "⚪";
-        const me = s === _sessionName ? " (current)" : "";
-        return `  ${live} ${s}${me}`;
-    });
-    ctx.ui.notify(`[remote-pi] Sessions:\n${lines.join("\n")}`, "info");
-}
-async function _cmdRelayToggle(ctx) {
-    if (_state === "idle")
-        await _cmdStart(ctx);
-    else
-        await _cmdStop(ctx);
-}
-function _cmdRelayStatus(ctx) {
-    _showStatus(ctx);
-}
 // ── routeClientMessage ────────────────────────────────────────────────────────
-export function routeClientMessage(msg, ctx) {
+/**
+ * Per-channel router. Replaces the W2D-pre `routeClientMessage` which
+ * implicitly used the `_peerChannel` singleton for replies. Each
+ * PlainPeerChannel now carries its own `sender` and passes it here so
+ * sender-specific responses (cancelled, pong, session_history) flow back
+ * through the right wire instead of being broadcast.
+ *
+ * Broadcast messages (user_input mirror, agent_chunk, tool_*) still use
+ * `_broadcastToActive` from the SDK event handlers; this router only
+ * handles incoming app→pi requests.
+ */
+export function _routeClientMessageFrom(sender, msg, ctx) {
     // session_sync has its own internal guards — handle before the strict
-    // peer/pi guard so a missing _pi doesn't drop the reply.
+    // pi-binding guard so a missing _pi doesn't drop the reply.
     if (msg.type === "session_sync") {
-        _handleSessionSync(msg);
+        _handleSessionSync(sender, msg);
         return;
     }
-    if (!_peerChannel || !_pi)
+    if (!_pi)
         return;
     switch (msg.type) {
-        case "user_message":
+        case "user_message": {
+            // Reverse-lookup of the sender's appPeerId from `_activePeers` (the
+            // PlainPeerChannel's `remotePeerId` is private). Purely diagnostic.
+            const senderId = [..._activePeers.entries()].find(([, ch]) => ch === sender)?.[0] ?? "unknown";
+            console.error(`[remote-pi] user_message from ${senderId.slice(0, 8)} ` +
+                `id=${msg.id} text=${JSON.stringify(msg.text).slice(0, 60)} ` +
+                `activePeers=[${[..._activePeers.keys()].map((k) => k.slice(0, 8)).join(", ")}]`);
+            // Source-of-truth rebroadcast (plan/24 W2D fix). Echo the message
+            // back to every attached owner (sender included) BEFORE handing it
+            // off to the agent — so that:
+            //   1. The sender's app waits for this echo to render (no eager
+            //      local store), keeping all owners visually consistent.
+            //   2. Other owners see what was said, not just the agent's reply.
+            //   3. `id` is preserved verbatim, so future dedup logic on the app
+            //      side can key off it.
+            // The user_message is also recorded in _messageBuffer indirectly
+            // via `pi.on("message_end")` after the SDK persists the turn — so
+            // a later `session_sync` returns it in the history events.
+            _broadcastToActive({ type: "user_message", id: msg.id, text: msg.text });
             _currentTurnId = msg.id;
             _pi.sendUserMessage(msg.text);
             break;
+        }
         case "approve_tool":
             // Approval gate was removed (plano 10.2 revisado). Type kept in
             // ClientMessage for forward-compat with a future permissions model;
@@ -1097,10 +1948,12 @@ export function routeClientMessage(msg, ctx) {
             break;
         case "cancel":
             ctx.abort();
-            _peerChannel.send({ type: "cancelled", in_reply_to: msg.id, target_id: msg.target_id });
+            // Reply to the sender that asked to cancel — broadcasting would tell
+            // every owner about a cancellation they didn't request.
+            sender.send({ type: "cancelled", in_reply_to: msg.id, target_id: msg.target_id });
             break;
         case "ping":
-            _peerChannel.send({ type: "pong", in_reply_to: msg.id });
+            sender.send({ type: "pong", in_reply_to: msg.id });
             break;
         case "pair_request":
             // Already paired — ignore subsequent pair_request to maintain idempotency.
@@ -1108,12 +1961,27 @@ export function routeClientMessage(msg, ctx) {
             break;
     }
 }
-// ── session_sync handler + helpers ────────────────────────────────────────────
-function _handleSessionSync(msg) {
-    if (!_peerChannel)
+/**
+ * Backward-compatible shim for legacy callers + tests that didn't track
+ * a specific sender channel. Routes to the most recently attached owner,
+ * mirroring the pre-W2D singleton behavior.
+ */
+export function routeClientMessage(msg, ctx) {
+    const fallback = [..._activePeers.values()].pop();
+    if (!fallback)
         return;
+    _routeClientMessageFrom(fallback, msg, ctx);
+}
+// ── session_sync handler + helpers ────────────────────────────────────────────
+/**
+ * `session_sync` is a per-sender query: the owner asking gets the reply,
+ * not the whole broadcast. Otherwise a session_sync from owner A would
+ * also dump history to owner B's wire — duplicate traffic + the wrong
+ * `in_reply_to`.
+ */
+function _handleSessionSync(sender, msg) {
     if (_sessionStartedAt === null) {
-        _peerChannel.send({
+        sender.send({
             type: "session_history",
             in_reply_to: msg.id,
             session_started_at: 0,
@@ -1131,7 +1999,7 @@ function _handleSessionSync(msg) {
     const allEvents = _mapAgentMessagesToEvents(_messageBuffer);
     const slice = effectiveLimit > 0 ? allEvents.slice(-effectiveLimit) : [];
     const truncated = allEvents.length > effectiveLimit;
-    _peerChannel.send({
+    sender.send({
         type: "session_history",
         in_reply_to: msg.id,
         session_started_at: _sessionStartedAt,
@@ -1224,7 +2092,7 @@ export function _mapAgentMessagesToEvents(messages) {
 // ── Standalone CLI ────────────────────────────────────────────────────────────
 if (import.meta.url === `file://${process.argv[1]}`) {
     const [, , subcmd, ...cliArgs] = process.argv;
-    if (subcmd === "list") {
+    if (subcmd === "devices" || subcmd === "list") {
         const peers = await listPeers();
         if (peers.length === 0) {
             console.log("[remote-pi] No peers");
@@ -1255,21 +2123,81 @@ if (import.meta.url === `file://${process.argv[1]}`) {
         }
     }
     else if (subcmd === "set-relay") {
-        const url = (cliArgs[0] ?? "").trim();
-        if (!url) {
+        const raw = (cliArgs[0] ?? "").trim();
+        if (!raw) {
             console.log(`Usage: set-relay <url> (default: ${kDefaultRelayUrl})`);
         }
-        else if (!isValidRelayUrl(url)) {
-            console.log(`Invalid URL: ${url}. Must start with ws:// or wss://`);
+        else if (isWebSocketScheme(raw)) {
+            console.log(`Use http:// or https://. The extension converts to WebSocket automatically.`);
+        }
+        else if (!isValidRelayUrl(raw)) {
+            console.log(`Invalid URL: ${raw}. Must start with http:// or https://`);
         }
         else {
-            saveConfig({ relay: url });
-            console.log(`Relay set to ${url}`);
+            saveConfig({ relay: raw });
+            console.log(`Relay set to ${raw}`);
         }
     }
-    else if (subcmd === "config") {
-        const { url, source } = resolveRelayUrl();
-        console.log(`Relay: ${url}\n  Source: ${source}`);
+    else if (subcmd === "create") {
+        // Standalone: `remote-pi create <cwd> [--name "X"]`. The shell already
+        // split the args and stripped the outer quotes, so an arg like
+        // `Tmp Agent` arrives as a single element with embedded space. Re-add
+        // quotes around any arg containing whitespace so the regex-based
+        // parser (shared with the slash-command path) sees the same shape
+        // as it would from a Pi interactive prompt.
+        const joined = cliArgs.map((a) => (/\s/.test(a) ? `"${a}"` : a)).join(" ");
+        _cmdCreate(joined, {
+            ui: { notify: (msg) => console.log(msg) },
+        });
+    }
+    else if (subcmd === "remove") {
+        const id = (cliArgs[0] ?? "").trim();
+        _cmdRemove(id, {
+            ui: { notify: (msg) => console.log(msg) },
+        });
+    }
+    else if (subcmd === "daemons") {
+        // Mirror the slash handler: ask the supervisor when reachable,
+        // fall back to registry-only when not.
+        const stubCtx = { ui: { notify: (msg) => console.log(msg) } };
+        await _cmdDaemonsList(stubCtx);
+    }
+    else if (subcmd === "daemon") {
+        // `remote-pi daemon <op> [args]`. Reuse the fleet-ops handlers — they
+        // already accept a minimal ctx with `notify`.
+        const op = cliArgs[0] ?? "";
+        const rest = cliArgs.slice(1).map((a) => (/\s/.test(a) ? `"${a}"` : a)).join(" ");
+        const stubCtx = { ui: { notify: (msg) => console.log(msg) } };
+        if (op === "start") {
+            await _cmdDaemonStart(stubCtx);
+        }
+        else if (op === "stop") {
+            await _cmdDaemonStop(stubCtx);
+        }
+        else if (op === "restart") {
+            await _cmdDaemonRestart(stubCtx);
+        }
+        else if (op === "status") {
+            await _cmdDaemonStatus(stubCtx);
+        }
+        else if (op === "send") {
+            await _cmdDaemonSend(rest, stubCtx);
+        }
+        else {
+            console.log("Usage: remote-pi daemon <start|stop|restart|status|send <id> \"<text>\">");
+        }
+    }
+    else if (subcmd === "install") {
+        // CLI mode = user installed via `npm install -g remote-pi`, so the
+        // `remote-pi` / `pi-supervisord` bins are already on $PATH via npm's
+        // global prefix. Explicit `linkCli: false` so we never stomp those
+        // with symlinks pointing at a parallel Pi-extension install.
+        const stubCtx = { ui: { notify: (msg) => console.log(msg) } };
+        _cmdInstall(stubCtx, { linkCli: false });
+    }
+    else if (subcmd === "uninstall") {
+        const stubCtx = { ui: { notify: (msg) => console.log(msg) } };
+        _cmdUninstall(stubCtx, { linkCli: false });
     }
     else {
         const edKp = await getOrCreateEd25519Keypair();