srift-transfer 4.0.0 → 4.1.0

package/dist/index.js

@@ -1289,12 +1289,13 @@ function withQuery(url, q) {
   return `${url}${url.includes("?") ? "&" : "?"}${q}`;
 }
 function explainStatus(status, body) {
-  const msg = body.replace(/^SRIFT:\s*/, "").trim();
+  let msg = body.replace(/^SRIFT:\s*/, "").trim();
+  if (/^\s*<(!doctype|html)/i.test(msg)) msg = status >= 500 ? "The SRIFT server or a proxy in front of it is temporarily unavailable \u2014 retry shortly" : "";
+  if (status === 424 || status === 502 && /sender error: (the shared file|cannot read the shared file)/i.test(msg)) return new GetError(msg || "The sender can no longer serve this file.", "ESENDERFILE", status);
   if (status === 404) return new GetError(msg || "Link not found \u2014 it expired, was revoked, or the sender went offline.", "ENOTFOUND_LINK", 404);
   if (status === 410) return new GetError(msg || "Link expired or reached its download limit.", "EGONE", 410);
   if (status === 503) return new GetError(msg || "Sender is offline \u2014 their daemon must be running for relay links.", "EOFFLINE", 503);
   if (status === 409) return new GetError(msg || "The sender is still uploading \u2014 retry shortly.", "ENOTREADY", 409);
-  if (status === 502 && /sender error: (the shared file|cannot read the shared file)/i.test(msg)) return new GetError(msg, "ESENDERFILE", 502);
   return new GetError(`${msg || "Download failed"} (HTTP ${status})`, "EHTTP", status);
 }
 async function readSmallBody(res, max = 4096) {
@@ -1481,7 +1482,7 @@ async function getLink(input, opts = {}) {
   }
   const serverName = filenameFromDisposition(head["content-disposition"]) || "download.bin";
   const mode = head["x-srift-mode"] ? String(head["x-srift-mode"]) : null;
-  const total = parseInt(String(head["content-length"] || ""), 10) || 0;
+  const total = parseInt(String(head["x-srift-size"] || head["content-length"] || ""), 10) || 0;
   let received = 0;
   let lastPrint = 0;
   const progress = (n) => {
@@ -1744,10 +1745,10 @@ var init_skills_data = __esm({
   "../../lib/mcp/skills-data.mjs"() {
     "use strict";
     SOURCES = [
-      { name: "encrypted-chat", content: "---\nname: encrypted-chat\ndescription: Send and read end-to-end encrypted chat messages and manage in-session file transfers within an active SRIFT session\n---\n\n# encrypted-chat\n\nSend and read end-to-end encrypted chat messages within an active SRIFT session, plus manage in-session file transfers, via the local MCP daemon.\n\n## Requirements\n\nAn active SRIFT session (see the `session-management` skill to open or join one first). No special credentials required.\n\n## Instructions\n\nAvailable MCP tools (see `/.well-known/mcp/server-card.json` for full schemas):\n\n- `srift_send_chat` \u2014 send an E2EE chat message to peers in the current session.\n- `srift_chat_history` \u2014 read decrypted chat history for the current session.\n- `srift_send_file` \u2014 offer a file to peers already inside the session (in-session transfer, distinct from `quick-share`'s standalone link flow).\n- `srift_accept_transfer` \u2014 accept and download an inbound file offer.\n- `srift_list_transfers` \u2014 list all active and recent transfers with progress.\n- `srift_read_state` \u2014 read the raw `.srift-state.json` snapshot for debugging/observability.\n\nAll messages and file payloads are encrypted client-side with AES-256-GCM before leaving the device; the daemon never has access to plaintext.\n" },
+      { name: "encrypted-chat", content: "---\nname: encrypted-chat\ndescription: Send and read end-to-end encrypted chat messages and manage in-session file transfers within an active SRIFT session\n---\n\n# encrypted-chat\n\nSend and read end-to-end encrypted chat messages within an active SRIFT session, plus manage in-session file transfers, via the local MCP daemon.\n\n## Requirements\n\nAn active SRIFT session (see the `session-management` skill to open or join one first). No special credentials required.\n\n## Instructions\n\nAvailable MCP tools (see `/.well-known/mcp/server-card.json` for full schemas):\n\n- `srift_send_chat` \u2014 send an E2EE chat message to peers in the current session.\n- `srift_chat_history` \u2014 read decrypted chat history for the current session.\n- `srift_send_file` \u2014 offer a file to peers already inside the session (in-session transfer, distinct from `quick-share`'s standalone link flow).\n- `srift_accept_transfer` \u2014 accept and download an inbound file offer.\n- `srift_list_transfers` \u2014 list all active and recent transfers with progress.\n- `srift_read_state` \u2014 read the raw `.srift-state.json` snapshot for debugging/observability.\n\nYour local daemon (or the browser) encrypts messages and file chunks with AES-256-GCM before they leave the device, using keys derived from the session (plus the optional `roomSecret`); the relay server only forwards ciphertext and never receives the key. Without a `roomSecret` the key is derivable from the session ID (which the server sees); set one on both sides to make it participant-only.\n" },
       { name: "get-company-info", content: "---\nname: get-company-info\ndescription: Retrieve overview and core metadata for SRIFT and SRIPTO Corporation\n---\n\n# get-company-info\n\nRetrieve high-level overview and specifications about SRIFT and SRIPTO Corporation.\n\n## Requirements\n\nNo special credentials required.\n\n## Instructions\n\nRead the home page or `llms.txt` to find details about Srift (secure P2P transport), LetMeTeach, SRIX, and A\u039EI.\n" },
       { name: "quick-share", content: "---\nname: quick-share\ndescription: Zero-install file delivery: seed a file and get a public download URL, no session setup required on the recipient's end\n---\n\n# quick-share\n\nZero-install file delivery via SRIFT's local MCP server. Returns a public `https://srift.app/d/<token>` relay link that any recipient can open in a browser \u2014 no SRIFT install, no signup, no session-join UI required on their end. The bytes stream from the sender's machine through the srift.app relay on demand (pass-through, `Cache-Control: no-store`); nothing is stored on any server, so the link works while the sender's daemon (or process) runs.\n\n## Requirements\n\nNo credentials. The SRIFT local daemon binds to `127.0.0.1:3822` with zero authentication. Only outbound HTTPS/WSS on port 443 is needed.\n\n## Instructions\n\n1. Call the MCP tool `srift_quick_share` with `{ filePath: \"/absolute/path/to/file\" }` (single file) or `{ filePaths: [...] }` (up to 500 files/folders). Optional params: `bundle` (default: true = one .tar.gz link; false = one link per path, created in parallel), `bundleName`, `exclude` (string[] for glob patterns to skip), `sessionName`, `maxDownloads`, `ttlMs`, `encrypt`, `password`.\n2. The tool returns a `downloadUrl` (e.g. `https://srift.app/d/<token>`) when bundled, or `{ links: [], errors: [] }` when separate. With `encrypt: true` (or a `password`) each link is end-to-end encrypted with AES-256-GCM: the key rides in the `#k=` URL fragment, is never sent to a server, and the browser decrypts locally. Without it, links are protected by TLS in transit only \u2014 use `encrypt` for anything sensitive.\n3. Hand the URL(s) to the recipient. In order of preference, they can run:\n   - `srift get <url> [<url> ...]` (or `npx -y srift-transfer get <url>`; proxy-aware, resumable, decrypts `#k=` links, supports multiple URLs with `--concurrency N`, works where curl is broken)\n   - `wget --content-disposition <url>`\n   - PowerShell `iwr <url> -OutFile <name>`\n   - `curl -OJ <url>`\n   - or just open it in any browser.\n4. Keep the sending side running until the recipient has downloaded. From a shell, `srift quick-share <file> [<file> ...] --wait` blocks until then (`--wait-timeout 30m` exits with code 3 on timeout); `--keep-alive` serves until the TTL expires.\n\n## Sandboxed and datacenter agents\n\nIf the background daemon cannot start (the sandbox forbids local servers, blocks detached spawns or loopback, or the port is taken), `srift mcp` and `srift quick-share` host the daemon inside their own process: no local port, outbound HTTPS/WSS on 443 only. The MCP server switches automatically, so this tool keeps working. From a shell, run quick-share in the background (it exits after the download) or with `--wait`; `--foreground` forces in-process serving. Blocked UDP never breaks links. Run `srift doctor` (or the `srift_net_diagnose` tool) to diagnose connectivity; `HTTPS_PROXY`/`NO_PROXY` and `NODE_EXTRA_CA_CERTS` are honoured.\n\nSee `/openapi.json` and `/.well-known/mcp/server-card.json` for the full tool contract.\n" },
-      { name: "session-management", content: '---\nname: session-management\ndescription: Create, join, monitor, and control SRIFT end-to-end encrypted P2P sessions via the local MCP daemon\n---\n\n# session-management\n\nCreate, join, monitor, and control SRIFT end-to-end encrypted P2P sessions ("rooms") via the local MCP daemon. Covers the full session lifecycle used for in-session file transfer and encrypted chat.\n\n## Requirements\n\nNo special credentials required. The SRIFT local daemon binds to `127.0.0.1:3822` and requires zero authentication.\n\n## Instructions\n\nAvailable MCP tools (see `/.well-known/mcp/server-card.json` for full schemas):\n\n- `srift_start_session` \u2014 open a new E2EE room as host.\n- `srift_join_session` \u2014 join an existing room by its 7-character session ID.\n- `srift_session_status` \u2014 read current session, role, connected peers, and pending join requests.\n- `srift_approve_join` / `srift_reject_join` \u2014 host-only: approve or reject a guest\'s join request.\n- `srift_kick_user` \u2014 host-only: disconnect and ban a peer.\n- `srift_close_session` \u2014 tear down the session and flush all encryption keys.\n\nAll session state is ephemeral and in-memory; nothing is persisted server-side. Keys are derived locally via PBKDF2-SHA256 and never leave the client device.\n' }
+      { name: "session-management", content: '---\nname: session-management\ndescription: Create, join, monitor, and control SRIFT end-to-end encrypted P2P sessions via the local MCP daemon\n---\n\n# session-management\n\nCreate, join, monitor, and control SRIFT end-to-end encrypted P2P sessions ("rooms") via the local MCP daemon. Covers the full session lifecycle used for in-session file transfer and encrypted chat.\n\n## Requirements\n\nNo special credentials required. The SRIFT local daemon binds to `127.0.0.1:3822` and requires zero authentication.\n\n## Instructions\n\nAvailable MCP tools (see `/.well-known/mcp/server-card.json` for full schemas):\n\n- `srift_start_session` \u2014 open a new E2EE room as host.\n- `srift_join_session` \u2014 join an existing room by its 7-character session ID.\n- `srift_session_status` \u2014 read current session, role, connected peers, and pending join requests.\n- `srift_approve_join` / `srift_reject_join` \u2014 host-only: approve or reject a guest\'s join request.\n- `srift_kick_user` \u2014 host-only: remove a peer. Get their `userId` from `srift_session_status` \u2192 `participants`.\n- `srift_close_session` \u2014 tear down the session and flush all encryption keys.\n\nSessions are ephemeral: session metadata and chat ciphertext are kept server-side only until the session is deleted (host close or 7 days of inactivity), and files are never stored. Keys are derived locally via PBKDF2-SHA256 from the session ID (plus the optional `roomSecret`) and are never sent to the server; without a `roomSecret` the key is derivable from the session ID, which the server sees, so pass one to `srift_start_session` / `srift_join_session` to make it participant-only.\n' }
     ];
     MCP_SKILLS = SOURCES.map(({ name, content }) => {
       const uri = `skill://${name}/SKILL.md`;
@@ -2006,7 +2007,7 @@ var init_core = __esm({
           type: "object",
           properties: {
             sessionName: { type: "string", description: 'Human-readable session name (optional, e.g. "Project Collab")' },
-            roomSecret: { type: "string", description: "Optional shared secret for extra-strong E2EE key derivation. Never sent to server." }
+            roomSecret: { type: "string", description: "Optional shared secret mixed into key derivation. Never sent to server. Without it the key is derivable from the session ID (which the server sees); set it to make the key participant-only." }
           }
         },
         outputSchema: {
@@ -2057,15 +2058,37 @@ var init_core = __esm({
       {
         name: "srift_session_status",
         title: "Get Session Status",
-        description: "Get current session details: id, role (host/guest), connection state, pending join requests, peer count.",
+        description: "Get current session details: session { id, role (host/guest), connection state, your userId }, pending join requests (approve with srift_approve_join), and members with their userIds (remove one with srift_kick_user).",
         inputSchema: { type: "object", properties: {} },
         outputSchema: {
           type: "object",
           properties: {
-            sessionId: { type: "string", description: "Active session ID, if any" },
-            role: { type: "string", description: 'Active role: "host", "guest", or null' },
-            isConnected: { type: "boolean", description: "True if connected to signaling server" },
-            peerCount: { type: "number", description: "Number of connected peers in the room" },
+            session: {
+              type: "object",
+              description: "The active session (id is null when there is none)",
+              properties: {
+                id: { type: ["string", "null"], description: "Active session ID" },
+                name: { type: ["string", "null"], description: "Session name" },
+                role: { type: ["string", "null"], description: '"host", "guest", or null' },
+                isConnected: { type: "boolean", description: "True if connected to the signaling server" },
+                userId: { type: ["string", "null"], description: "Your user id in the session" },
+                status: { type: "string", description: 'Guest only: "pending_approval" or "approved" (hosted endpoint)' }
+              }
+            },
+            peerCount: { type: "number", description: "Number of connected sockets in the room (hosted endpoint)" },
+            participants: {
+              type: "array",
+              description: "Session members (local daemon): pass userId to srift_kick_user to remove one",
+              items: {
+                type: "object",
+                properties: {
+                  userId: { type: "string" },
+                  username: { type: "string" },
+                  isHost: { type: "boolean" },
+                  online: { type: "boolean" }
+                }
+              }
+            },
             pendingJoins: {
               type: "array",
               description: "List of pending guest join requests waiting for host approval",
@@ -2159,7 +2182,7 @@ var init_core = __esm({
       {
         name: "srift_kick_user",
         title: "Kick Peer",
-        description: "Host-only. Disconnect and ban a peer from the active room.",
+        description: "Host-only. Disconnect and remove a peer from the active room. Get the peer's userId from srift_session_status (participants).",
         inputSchema: {
           type: "object",
           properties: {
@@ -2427,6 +2450,8 @@ var init_core = __esm({
           type: "object",
           properties: {
             ok: { type: "boolean", description: "True if the diagnostic ran successfully (independent of what it found)" },
+            base: { type: "string", description: "The SRIFT server that was probed" },
+            checkedAt: { type: "string", description: "When the probe ran (ISO 8601); cached results show an older time" },
             verdict: { type: "string", description: '"ok", "degraded", or "blocked"' },
             rungs: {
               type: "array",
@@ -2572,8 +2597,13 @@ session-management, and get-company-info, \`skills/get\` to fetch one by URI, an
 ## Security model
 - AES-256-GCM, 12-byte random IV per message.
 - PBKDF2-SHA256, 100,000 iterations.
-- All keys derive locally from sessionId (+ optional roomSecret). Server never sees them.
-- File chunks transit P2P (WebTorrent for >10MB, WebSocket-relay fallback otherwise).
+- All keys derive locally from sessionId (+ optional roomSecret). The key is never sent to the
+  server, but the server sees the sessionId: without a roomSecret the key is derivable from it.
+  Pass roomSecret to srift_start_session / srift_join_session to make the key participant-only.
+- Quick-share links are end-to-end encrypted only with encrypt: true (key in the #k= fragment);
+  otherwise TLS in transit only, zero retention.
+- The CLI daemon moves file chunks over the AES-256-GCM WebSocket relay (browsers use WebRTC for
+  files >5 MB, with the relay as fallback).
 
 ## Local daemon vs hosted MCP
 If you are talking to the hosted endpoint (https://srift.app/mcp) instead of a local
@@ -2590,6 +2620,8 @@ for full file-transfer + chat capability.
 
 // ../../cli/mcp.ts
 import http3 from "http";
+import fs6 from "fs";
+import path5 from "path";
 function callDaemon(endpoint, method, body) {
   const emb = embeddedCall(method, endpoint, body);
   if (emb) return emb.then((r) => {
@@ -2640,43 +2672,60 @@ async function callTool(name, args) {
         sessionName: args.sessionName,
         roomSecret: args.roomSecret
       });
-      return `Session created.
+      const joinUrl = res.joinUrl || `https://srift.app/join-session?id=${res.sessionId}`;
+      return {
+        text: `Session created.
 Session ID: ${res.sessionId}
-Share URL: https://srift.app/join-session?id=${res.sessionId}
-You are the HOST. Approve incoming joins with srift_approve_join.`;
+Share URL: ${joinUrl}
+You are the HOST. Approve incoming joins with srift_approve_join.`,
+        structured: { sessionId: res.sessionId, url: joinUrl, role: "host" }
+      };
     }
     case "srift_join_session": {
       const res = await callDaemon("/session/join", "POST", args);
-      return `Join requested for session ${args.sessionId}. Status: ${res.success ? "awaiting host approval" : "failed"}.`;
+      return {
+        text: `Join requested for session ${args.sessionId}. Status: ${res.success ? "awaiting host approval" : "failed"}.`,
+        structured: { sessionId: args.sessionId, status: res.success ? "awaiting_approval" : "failed" }
+      };
     }
     case "srift_session_status": {
       const res = await callDaemon("/status", "GET");
-      return JSON.stringify({ session: res.session, pendingJoins: res.pendingJoins }, null, 2);
+      return JSON.stringify({ session: res.session, pendingJoins: res.pendingJoins, participants: res.participants || [] }, null, 2);
     }
     case "srift_close_session":
       await callDaemon("/session/close", "POST");
-      return "Session closed. Keys flushed.";
+      return { text: "Session closed. Keys flushed.", structured: { success: true } };
     case "srift_approve_join":
       await callDaemon("/session/approve", "POST", args);
-      return `Approved ${args.tempUserId}.`;
+      return { text: `Approved ${args.tempUserId}.`, structured: { success: true, tempUserId: args.tempUserId } };
     case "srift_reject_join":
       await callDaemon("/session/reject", "POST", args);
-      return `Rejected ${args.tempUserId}.`;
+      return { text: `Rejected ${args.tempUserId}.`, structured: { success: true, tempUserId: args.tempUserId } };
     case "srift_kick_user":
       await callDaemon("/session/kick", "POST", args);
-      return `Kicked ${args.userId}.`;
+      return { text: `Kicked ${args.userId}.`, structured: { success: true, userId: args.userId } };
     case "srift_send_file": {
       const res = await callDaemon("/send", "POST", args);
-      return `File offered.
+      return {
+        text: `File offered.
 File ID: ${res.fileId}
-The peer must call srift_accept_transfer with this fileId.`;
+The peer must call srift_accept_transfer with this fileId.`,
+        structured: { fileId: res.fileId, fileName: path5.basename(String(args.filePath || "")), fileSize: (() => {
+          try {
+            return fs6.statSync(args.filePath).size;
+          } catch {
+            return void 0;
+          }
+        })() }
+      };
     }
     case "srift_accept_transfer":
       await callDaemon("/receive", "POST", args);
-      return `Transfer ${args.fileId} accepted. Downloading\u2026`;
+      return { text: `Transfer ${args.fileId} accepted. Downloading\u2026`, structured: { success: true, fileId: args.fileId } };
     case "srift_list_transfers": {
       const res = await callDaemon("/status", "GET");
-      return JSON.stringify(res.activeTransfers || [], null, 2);
+      const transfers = res.activeTransfers || [];
+      return { text: JSON.stringify(transfers, null, 2), structured: { transfers } };
     }
     case "srift_quick_share": {
       const multi = Array.isArray(args?.filePaths) && args.filePaths.length > 0;
@@ -2770,10 +2819,11 @@ The peer must call srift_accept_transfer with this fileId.`;
     }
     case "srift_send_chat":
       await callDaemon("/chat/send", "POST", args);
-      return `Sent (E2EE): "${args.message}"`;
+      return { text: `Sent (E2EE): "${args.message}"`, structured: { success: true, timestamp: (/* @__PURE__ */ new Date()).toISOString() } };
     case "srift_chat_history": {
       const res = await callDaemon("/chat/history", "GET");
-      return JSON.stringify(res, null, 2);
+      const messages = Array.isArray(res) ? res : res?.messages || [];
+      return { text: JSON.stringify(res, null, 2), structured: { messages } };
     }
     case "srift_read_state": {
       const res = await callDaemon("/state", "GET");
@@ -2846,7 +2896,7 @@ var init_mcp = __esm({
     SERVER_INFO = {
       name: "srift-mcp-server",
       title: "SRIFT Secure P2P File Transfer",
-      version: "4.0.0"
+      version: "4.1.0"
     };
     localDaemonBackend = { callTool, readResource };
     handleMcpMessage = createMcpHandler({
@@ -2858,8 +2908,8 @@ var init_mcp = __esm({
 });
 
 // ../../cli/pack.ts
-import fs6 from "fs";
-import path5 from "path";
+import fs7 from "fs";
+import path6 from "path";
 import zlib from "zlib";
 import { pipeline } from "stream/promises";
 import { Readable } from "stream";
@@ -2883,16 +2933,16 @@ function normFileMode(m) {
 }
 function listFiles(root, excludes = DEFAULT_EXCLUDES) {
   const pats = excludes.map(globToRegExp);
-  const excluded = (rel) => pats.some((p) => p.test(rel) || p.test(path5.posix.basename(rel)));
+  const excluded = (rel) => pats.some((p) => p.test(rel) || p.test(path6.posix.basename(rel)));
   const out = [];
   const walk = (dirAbs, dirRel) => {
-    const ents = fs6.readdirSync(dirAbs, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+    const ents = fs7.readdirSync(dirAbs, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
     for (const e of ents) {
       const rel = dirRel ? `${dirRel}/${e.name}` : e.name;
       if (excluded(rel)) continue;
-      const abs = path5.join(dirAbs, e.name);
+      const abs = path6.join(dirAbs, e.name);
       if (e.isSymbolicLink()) continue;
-      const st = fs6.lstatSync(abs);
+      const st = fs7.lstatSync(abs);
       if (e.isDirectory()) {
         out.push({ abs, rel, size: 0, mode: 493, mtime: Math.floor(st.mtimeMs / 1e3), dir: true });
         walk(abs, rel);
@@ -2954,7 +3004,7 @@ async function* tarStream(entries, prefix) {
     yield* entryHeaders(e, prefix);
     if (e.dir) continue;
     let written = 0;
-    const stream = fs6.createReadStream(e.abs);
+    const stream = fs7.createReadStream(e.abs);
     stream.on("error", () => {
     });
     try {
@@ -2975,17 +3025,17 @@ async function* tarStream(entries, prefix) {
   yield Buffer.alloc(BLOCK * 2);
 }
 async function packDirectory(dir, outFile, excludes = DEFAULT_EXCLUDES) {
-  const root = path5.resolve(dir);
+  const root = path6.resolve(dir);
   const entries = listFiles(root, excludes);
   const files = entries.filter((e) => !e.dir);
   if (!files.length) throw new Error(`Nothing to share in ${root} (empty, or everything was excluded)`);
-  const prefix = path5.basename(root) || "folder";
-  await pipeline(Readable.from(tarStream(entries, prefix)), zlib.createGzip({ level: 6 }), fs6.createWriteStream(outFile, { mode: 384 }));
+  const prefix = path6.basename(root) || "folder";
+  await pipeline(Readable.from(tarStream(entries, prefix)), zlib.createGzip({ level: 6 }), fs7.createWriteStream(outFile, { mode: 384 }));
   return { files: files.length, bytes: files.reduce((a, e) => a + e.size, 0) };
 }
 function readable(p) {
   try {
-    fs6.accessSync(p, fs6.constants.R_OK);
+    fs7.accessSync(p, fs7.constants.R_OK);
     return null;
   } catch (e) {
     return e?.code || "unreadable";
@@ -2999,7 +3049,7 @@ function listPaths(paths, excludes = DEFAULT_EXCLUDES, skipped = []) {
       used.add(name.toLowerCase());
       return name;
     }
-    const ext = path5.extname(name);
+    const ext = path6.extname(name);
     const stem2 = name.slice(0, name.length - ext.length);
     for (let i = 2; ; i++) {
       const c = `${stem2} (${i})${ext}`;
@@ -3010,10 +3060,10 @@ function listPaths(paths, excludes = DEFAULT_EXCLUDES, skipped = []) {
     }
   };
   for (const p of paths) {
-    const abs = path5.resolve(p);
+    const abs = path6.resolve(p);
     let st;
     try {
-      st = fs6.statSync(abs);
+      st = fs7.statSync(abs);
     } catch (e) {
       skipped.push({ path: abs, reason: e?.code === "ENOENT" ? "not found" : e?.code || "stat failed" });
       continue;
@@ -3026,7 +3076,7 @@ function listPaths(paths, excludes = DEFAULT_EXCLUDES, skipped = []) {
         skipped.push({ path: abs, reason: e?.code || "unreadable folder" });
         continue;
       }
-      const name = unique(path5.basename(abs) || "item");
+      const name = unique(path6.basename(abs) || "item");
       out.push({ abs, rel: name, size: 0, mode: 493, mtime: Math.floor(st.mtimeMs / 1e3), dir: true });
       for (const e of inner) {
         const why = e.dir ? null : readable(e.abs);
@@ -3042,7 +3092,7 @@ function listPaths(paths, excludes = DEFAULT_EXCLUDES, skipped = []) {
         skipped.push({ path: abs, reason: why });
         continue;
       }
-      out.push({ abs, rel: unique(path5.basename(abs) || "item"), size: st.size, mode: normFileMode(st.mode), mtime: Math.floor(st.mtimeMs / 1e3), dir: false });
+      out.push({ abs, rel: unique(path6.basename(abs) || "item"), size: st.size, mode: normFileMode(st.mode), mtime: Math.floor(st.mtimeMs / 1e3), dir: false });
     } else {
       skipped.push({ path: abs, reason: "not a regular file or folder" });
     }
@@ -3059,7 +3109,7 @@ async function packPaths(paths, outFile, prefix, excludes = DEFAULT_EXCLUDES) {
       throw new Error(`Nothing to share${skipped.length ? ` \u2014 skipped: ${skipped.map((x) => `${x.path} (${x.reason})`).join(", ")}` : " (empty folders, or everything was excluded)"}`);
     }
     try {
-      await pipeline(Readable.from(tarStream(entries, prefix)), zlib.createGzip({ level: 6 }), fs6.createWriteStream(outFile, { mode: 384 }));
+      await pipeline(Readable.from(tarStream(entries, prefix)), zlib.createGzip({ level: 6 }), fs7.createWriteStream(outFile, { mode: 384 }));
       return { files: files.length, bytes: files.reduce((a, e) => a + e.size, 0), skipped };
     } catch (err) {
       const bad = err?.packEntry;
@@ -3100,10 +3150,10 @@ import express from "express";
 import cors from "cors";
 import { WebSocket as WebSocket2 } from "ws";
 import { webcrypto } from "crypto";
-import fs7 from "fs";
+import fs8 from "fs";
 import http4 from "http";
 import { Duplex } from "stream";
-import path6 from "path";
+import path7 from "path";
 import os4 from "os";
 import { v4 as uuidv4 } from "uuid";
 import dotenv from "dotenv";
@@ -3234,6 +3284,46 @@ async function decrypt(encB64) {
   const decrypted = await crypto5.subtle.decrypt({ name: "AES-GCM", iv: iv2 }, encryptionKey, ciphertext);
   return new TextDecoder().decode(decrypted);
 }
+function relayKey() {
+  if (!session.id) return Promise.reject(new Error("No active session"));
+  if (relayKeyCache?.sessionId !== session.id) relayKeyCache = { sessionId: session.id, key: deriveKey(session.id) };
+  return relayKeyCache.key;
+}
+function relayAad(fileId, chunkIndex, totalChunks) {
+  return new TextEncoder().encode(`${RELAY_ENC}|${fileId}|${chunkIndex}|${totalChunks}`);
+}
+async function sealRelayChunk(plain, fileId, chunkIndex, totalChunks) {
+  const iv2 = crypto5.getRandomValues(new Uint8Array(IV_LEN));
+  const ct = new Uint8Array(await crypto5.subtle.encrypt(
+    { name: "AES-GCM", iv: iv2, additionalData: relayAad(fileId, chunkIndex, totalChunks) },
+    await relayKey(),
+    plain
+  ));
+  const out = new Uint8Array(IV_LEN + ct.length);
+  out.set(iv2);
+  out.set(ct, IV_LEN);
+  return Array.from(out);
+}
+async function openRelayChunk(p) {
+  if (p.enc === void 0 || p.enc === null) {
+    if (typeof p.chunk === "string") return Buffer.from(p.chunk, "base64");
+    if (Array.isArray(p.chunk)) return Buffer.from(p.chunk);
+    throw new Error("relay chunk is neither base64 nor a byte array");
+  }
+  if (p.enc !== RELAY_ENC) throw new Error(`unsupported relay encryption scheme: ${String(p.enc)}`);
+  if (!Array.isArray(p.chunk)) throw new Error("sealed relay chunk is not a byte array");
+  const data = Uint8Array.from(p.chunk);
+  if (data.length < IV_LEN + 16) throw new Error("sealed relay chunk too short");
+  try {
+    return Buffer.from(await crypto5.subtle.decrypt(
+      { name: "AES-GCM", iv: data.slice(0, IV_LEN), additionalData: relayAad(p.fileId, p.chunkIndex, p.totalChunks) },
+      await relayKey(),
+      data.slice(IV_LEN)
+    ));
+  } catch {
+    throw new Error(`relay chunk ${p.chunkIndex} of ${p.fileId} failed authentication (wrong session key or tampered data)`);
+  }
+}
 function getTrackers(sessionId) {
   const list = [];
   try {
@@ -3272,13 +3362,13 @@ function writeStateFile() {
     })),
     lastUpdated: (/* @__PURE__ */ new Date()).toISOString()
   };
-  fs7.writeFileSync(STATE_PATH, JSON.stringify(stateData, null, 2), "utf-8");
+  fs8.writeFileSync(STATE_PATH, JSON.stringify(stateData, null, 2), "utf-8");
 }
 function pruneStaleStateOnStartup() {
-  if (!fs7.existsSync(STATE_PATH)) return;
+  if (!fs8.existsSync(STATE_PATH)) return;
   let prunedCount = 0;
   try {
-    const raw = fs7.readFileSync(STATE_PATH, "utf-8");
+    const raw = fs8.readFileSync(STATE_PATH, "utf-8");
     const parsed = JSON.parse(raw);
     const now = Date.now();
     const lastUpdatedMs = parsed?.lastUpdated ? Date.parse(parsed.lastUpdated) : NaN;
@@ -3297,7 +3387,7 @@ function pruneStaleStateOnStartup() {
     if (sessionStale || freshTransfers.length !== transfers.length) {
       parsed.activeTransfers = freshTransfers;
       parsed.lastUpdated = (/* @__PURE__ */ new Date()).toISOString();
-      fs7.writeFileSync(STATE_PATH, JSON.stringify(parsed, null, 2), "utf-8");
+      fs8.writeFileSync(STATE_PATH, JSON.stringify(parsed, null, 2), "utf-8");
     }
     if (prunedCount > 0) {
       console.log(
@@ -3307,7 +3397,7 @@ function pruneStaleStateOnStartup() {
   } catch (err) {
     console.warn("[DAEMON] Stale state file was unreadable, removing it:", err?.message || err);
     try {
-      fs7.unlinkSync(STATE_PATH);
+      fs8.unlinkSync(STATE_PATH);
     } catch {
     }
   }
@@ -3328,8 +3418,11 @@ function connectWebSocket(wsTargetUrl) {
   }
   csrfToken = null;
   console.log(`[DAEMON] Connecting to Signaler WS: ${wsTargetUrl}`);
-  wsConn = new WebSocket2(wsTargetUrl, { agent: agentFor(wsTargetUrl) });
-  wsConn.on("open", () => {
+  const sock = new WebSocket2(wsTargetUrl, { agent: agentFor(wsTargetUrl) });
+  wsConn = sock;
+  const current = () => wsConn === sock;
+  sock.on("open", () => {
+    if (!current()) return;
     console.log("[DAEMON] WebSocket connection open");
     session.isConnected = true;
     writeStateFile();
@@ -3367,7 +3460,8 @@ function connectWebSocket(wsTargetUrl) {
       }
     }, 3e4);
   });
-  wsConn.on("message", async (dataStr) => {
+  sock.on("message", async (dataStr) => {
+    if (!current()) return;
     try {
       const msg = JSON.parse(dataStr);
       const { type, payload } = msg;
@@ -3400,6 +3494,30 @@ function connectWebSocket(wsTargetUrl) {
         case "heartbeat_ack":
           lastHeartbeatAckAt = Date.now();
           break;
+        case "user_list": {
+          const users = Array.isArray(payload?.users) ? payload.users : [];
+          participants = users.map((u) => ({ userId: String(u.id), username: String(u.username || ""), isHost: !!u.is_host, online: !!u.isOnline }));
+          broadcastSSE("participants", { participants });
+          if (payload?.messageId) {
+            try {
+              sock.send(JSON.stringify({ type: "user_list_ack", payload: { messageId: payload.messageId } }));
+            } catch {
+            }
+          }
+          break;
+        }
+        case "kicked_from_session":
+          console.log(`[DAEMON] Kicked from session: ${payload?.reason || ""}`);
+          sessionTerminated = true;
+          terminationReason = payload?.reason || "You were removed from the session by the host";
+          session.isConnected = false;
+          session.userId = null;
+          csrfToken = null;
+          pendingJoins = [];
+          participants = [];
+          writeStateFile();
+          broadcastSSE("session_terminated", { reason: terminationReason });
+          break;
         case "session_deleted":
           console.log(`[DAEMON] Session deleted by host: ${payload.reason || ""}`);
           sessionTerminated = true;
@@ -3407,6 +3525,7 @@ function connectWebSocket(wsTargetUrl) {
           session = { id: null, name: null, role: null, isConnected: false, userId: null };
           activeTransfers = [];
           pendingJoins = [];
+          participants = [];
           encryptionKey = null;
           writeStateFile();
           broadcastSSE("session_terminated", { reason: terminationReason });
@@ -3423,6 +3542,7 @@ function connectWebSocket(wsTargetUrl) {
             session.isConnected = false;
             session.userId = null;
             pendingJoins = [];
+            participants = [];
             writeStateFile();
             broadcastSSE("session_terminated", { reason: terminationReason });
           }
@@ -3477,14 +3597,41 @@ function connectWebSocket(wsTargetUrl) {
           break;
         case "file_accept":
           console.log(`[DAEMON] File offer accepted by peer! ID: ${payload.fileId}`);
+          {
+            const acceptedTx = activeTransfers.find((t) => t.fileId === payload.fileId);
+            if (acceptedTx) acceptedTx.peerRelayEnc = payload.relayEnc === RELAY_ENC ? RELAY_ENC : void 0;
+          }
           startUpload(payload.fileId, payload.userId);
           break;
         case "webtorrent_info_hash":
           handleWebTorrentInfoHash(payload);
           break;
         case "file_chunk":
-          handleIncomingChunk(payload);
+          handleIncomingChunk(payload).catch((e) => {
+            console.error(`[DAEMON] Relay chunk rejected: ${e?.message || e}`);
+            const bad = activeTransfers.find((t) => t.fileId === payload?.fileId);
+            if (bad) {
+              bad.status = "error";
+              writeStateFile();
+            }
+            try {
+              sock.send(JSON.stringify({ type: "file_cancel_by_receiver", payload: { fileId: payload?.fileId } }));
+            } catch {
+            }
+          });
           break;
+        case "file_cancelled_by_receiver":
+        case "file_cancelled_by_sender":
+        case "file_cancelled_all": {
+          const gone = activeTransfers.find((t) => t.fileId === payload?.fileId);
+          activeUploads.delete(payload?.fileId);
+          if (gone && gone.status !== "completed") {
+            gone.status = "cancelled";
+            writeStateFile();
+            broadcastSSE("transfer_progress", { fileId: gone.fileId, fileName: gone.name, size: gone.size, bytesTransferred: gone.bytesTransferred, progress: gone.progress, status: "cancelled" });
+          }
+          break;
+        }
         case "file_chunk_ack":
           handleChunkAck(payload);
           break;
@@ -3496,6 +3643,7 @@ function connectWebSocket(wsTargetUrl) {
           if (entry) {
             entry.token = payload.token;
             entry.downloadUrl = payload.downloadUrl;
+            if (typeof payload.claim === "string") entry.claim = payload.claim;
             pubsharesByToken.set(payload.token, entry);
             const resolver = pubshareRegResolvers.get(payload.fileId);
             if (resolver) {
@@ -3529,7 +3677,8 @@ function connectWebSocket(wsTargetUrl) {
       console.error("[DAEMON] Error processing WS message:", err);
     }
   });
-  wsConn.on("close", () => {
+  sock.on("close", () => {
+    if (!current()) return;
     console.log("[DAEMON] WebSocket connection closed");
     session.isConnected = false;
     csrfToken = null;
@@ -3549,7 +3698,8 @@ function connectWebSocket(wsTargetUrl) {
       }
     }, 3e3);
   });
-  wsConn.on("error", (err) => {
+  sock.on("error", (err) => {
+    if (!current()) return;
     console.error("[DAEMON] WebSocket error:", err);
   });
 }
@@ -3687,7 +3837,7 @@ async function startWebSocketUpload(fileId, targetUserId) {
   const tx = activeTransfers.find((t) => t.fileId === fileId);
   if (!tx || !tx.filePath) return;
   const chunkSize = 64 * 1024;
-  const stat = fs7.statSync(tx.filePath);
+  const stat = fs8.statSync(tx.filePath);
   const totalChunks = Math.max(1, Math.ceil(stat.size / chunkSize));
   tx.status = "uploading";
   tx.startTime = Date.now();
@@ -3705,6 +3855,17 @@ async function startWebSocketUpload(fileId, targetUserId) {
   sendNextChunk(fileId);
 }
 function sendNextChunk(fileId) {
+  sendNextChunkAsync(fileId).catch((e) => {
+    console.error(`[DAEMON] Relay upload failed for ${fileId}: ${e?.message || e}`);
+    activeUploads.delete(fileId);
+    const failed = activeTransfers.find((t) => t.fileId === fileId);
+    if (failed) {
+      failed.status = "error";
+      writeStateFile();
+    }
+  });
+}
+async function sendNextChunkAsync(fileId) {
   const upload = activeUploads.get(fileId);
   if (!upload) return;
   const tx = activeTransfers.find((t) => t.fileId === fileId);
@@ -3724,18 +3885,18 @@ function sendNextChunk(fileId) {
     return;
   }
   const start = upload.currentChunk * upload.chunkSize;
-  const stat = fs7.statSync(upload.filePath);
+  const stat = fs8.statSync(upload.filePath);
   const end = Math.min(start + upload.chunkSize, stat.size);
   const buffer = Buffer.alloc(end - start);
-  const fd = fs7.openSync(upload.filePath, "r");
-  fs7.readSync(fd, buffer, 0, end - start, start);
-  fs7.closeSync(fd);
-  const chunkBase64 = buffer.toString("base64");
+  const fd = fs8.openSync(upload.filePath, "r");
+  fs8.readSync(fd, buffer, 0, end - start, start);
+  fs8.closeSync(fd);
+  const frame = tx.peerRelayEnc === RELAY_ENC ? { chunk: await sealRelayChunk(buffer, fileId, upload.currentChunk, upload.totalChunks), enc: RELAY_ENC } : { chunk: buffer.toString("base64") };
   wsConn?.send(JSON.stringify({
     type: "file_chunk",
     payload: {
       fileId,
-      chunk: chunkBase64,
+      ...frame,
       chunkIndex: upload.currentChunk,
       totalChunks: upload.totalChunks,
       targetUserId: upload.targetUserId
@@ -3769,18 +3930,21 @@ function handleChunkAck(payload) {
     sendNextChunk(fileId);
   }
 }
-function handleIncomingChunk(payload) {
-  const { fileId, chunk, chunkIndex, totalChunks, from } = payload;
+async function handleIncomingChunk(payload) {
+  const { fileId, chunkIndex, totalChunks, from } = payload;
   const tx = activeTransfers.find((t) => t.fileId === fileId);
   if (!tx) return;
+  const mode = payload.enc === void 0 || payload.enc === null ? "plain" : "sealed";
+  if (tx.relayMode && tx.relayMode !== mode) throw new Error(`transfer ${fileId} mixed sealed and plaintext chunks`);
+  tx.relayMode = mode;
+  const chunkBuffer = await openRelayChunk(payload);
   tx.status = "downloading";
   tx.totalChunks = totalChunks;
   tx.peerId = from;
-  const chunkBuffer = Buffer.from(chunk, "base64");
   tx.bytesTransferred += chunkBuffer.length;
   tx.chunksCount++;
-  const chunkPath = path6.join(TEMP_DIR, `${fileId}_chunk_${chunkIndex}`);
-  fs7.writeFileSync(chunkPath, chunkBuffer);
+  const chunkPath = path7.join(TEMP_DIR, `${fileId}_chunk_${chunkIndex}`);
+  fs8.writeFileSync(chunkPath, chunkBuffer);
   tx.progress = tx.bytesTransferred / tx.size * 100;
   const elapsed = (Date.now() - tx.startTime) / 1e3;
   if (elapsed > 0) {
@@ -3808,10 +3972,10 @@ function handleFileComplete(payload) {
   const tx = activeTransfers.find((t) => t.fileId === fileId);
   if (!tx) return;
   const destDir = tx.saveDir || process.cwd();
-  const destPath = path6.join(destDir, tx.name);
+  const destPath = path7.join(destDir, tx.name);
   try {
-    if (!fs7.existsSync(destDir)) {
-      fs7.mkdirSync(destDir, { recursive: true });
+    if (!fs8.existsSync(destDir)) {
+      fs8.mkdirSync(destDir, { recursive: true });
     }
   } catch (err) {
     console.error(`[DAEMON] Failed to create destination directory ${destDir}:`, err);
@@ -3819,7 +3983,7 @@ function handleFileComplete(payload) {
     writeStateFile();
     return;
   }
-  const writeStream = fs7.createWriteStream(destPath);
+  const writeStream = fs8.createWriteStream(destPath);
   writeStream.on("error", (err) => {
     console.error(`[DAEMON] Write stream error for ${destPath}:`, err);
     tx.status = "error";
@@ -3854,12 +4018,12 @@ function handleFileComplete(payload) {
     });
   });
   for (let i = 0; i < tx.totalChunks; i++) {
-    const chunkPath = path6.join(TEMP_DIR, `${fileId}_chunk_${i}`);
-    if (fs7.existsSync(chunkPath)) {
+    const chunkPath = path7.join(TEMP_DIR, `${fileId}_chunk_${i}`);
+    if (fs8.existsSync(chunkPath)) {
       try {
-        const chunkBuf = fs7.readFileSync(chunkPath);
+        const chunkBuf = fs8.readFileSync(chunkPath);
         writeStream.write(chunkBuf);
-        fs7.unlinkSync(chunkPath);
+        fs8.unlinkSync(chunkPath);
       } catch (err) {
         console.error(`[DAEMON] Error reading/writing chunk ${i}:`, err);
         writeStream.emit("error", err);
@@ -3869,6 +4033,20 @@ function handleFileComplete(payload) {
   }
   writeStream.end();
 }
+async function waitSignalReady(maxMs = 8e3) {
+  if (!session.id) return { status: 409, body: { success: false, error: "No active session. Call /session/start first." } };
+  if (sessionTerminated) return { status: 410, body: { success: false, error: terminationReason || "The session ended." } };
+  if (session.role === "guest" && !session.userId) {
+    return { status: 409, body: { success: false, error: "Waiting for the host to approve your join request.", retryAfterMs: 2e3 } };
+  }
+  const ready = () => !!encryptionKey && !!csrfToken && wsConn?.readyState === WebSocket2.OPEN;
+  for (let waited = 0; waited < maxMs && !ready() && session.id; waited += 100) {
+    await new Promise((r) => setTimeout(r, 100));
+  }
+  if (ready()) return null;
+  if (!encryptionKey) return { status: 409, body: { success: false, error: "Encryption key not ready. Session still initialising." } };
+  return { status: 503, body: { success: false, error: "Signaling connection not ready (WebSocket is connecting). Retry in 1\u20132 seconds.", retryAfterMs: 1500 } };
+}
 async function registerPubshare(fileId, absPath, filename, size, mime, opts = {}, timeoutMs = 5e3) {
   if (!wsConn || wsConn.readyState !== WebSocket2.OPEN) {
     throw new Error("Signaling WebSocket not connected");
@@ -3891,7 +4069,8 @@ async function registerPubshare(fileId, absPath, filename, size, mime, opts = {}
     linkKey: opts.linkKey,
     tempFile: opts.tempFile,
     displayName: opts.displayName || filename,
-    prefixLen: opts.prefixLen
+    prefixLen: opts.prefixLen,
+    claim: opts.preferClaim
   };
   pubshares.set(fileId, entry);
   const ackP = new Promise((resolve, reject) => {
@@ -3916,6 +4095,7 @@ async function registerPubshare(fileId, absPath, filename, size, mime, opts = {}
       maxDownloads,
       expiresAt,
       preferToken: opts.preferToken || void 0,
+      preferClaim: opts.preferToken && opts.preferClaim ? opts.preferClaim : void 0,
       encrypted: opts.encrypted ? true : void 0,
       prefixLen: opts.encrypted && opts.prefixLen ? opts.prefixLen : void 0
     }
@@ -3932,7 +4112,7 @@ async function reregisterPubsharesAfterReconnect() {
       pubsharesByToken.delete(entry.token);
       if (entry.tempFile) {
         try {
-          fs7.unlinkSync(entry.tempFile);
+          fs8.unlinkSync(entry.tempFile);
         } catch {
         }
       }
@@ -3943,7 +4123,7 @@ async function reregisterPubsharesAfterReconnect() {
       pubsharesByToken.delete(entry.token);
       if (entry.tempFile) {
         try {
-          fs7.unlinkSync(entry.tempFile);
+          fs8.unlinkSync(entry.tempFile);
         } catch {
         }
       }
@@ -3962,6 +4142,7 @@ async function reregisterPubsharesAfterReconnect() {
           maxDownloads: remainingMax,
           ttlMs: remainingTtl,
           preferToken: entry.token,
+          preferClaim: entry.claim,
           encrypted: entry.encrypted,
           linkKey: entry.linkKey,
           tempFile: entry.tempFile,
@@ -3987,16 +4168,16 @@ async function handlePubsharePull(payload) {
   }
   let fd;
   try {
-    fd = fs7.openSync(entry.filePath, "r");
+    fd = fs8.openSync(entry.filePath, "r");
   } catch (e) {
     throw new Error(e?.code === "ENOENT" ? "the shared file no longer exists on the sender" : `cannot read the shared file (${e?.code || e?.message})`);
   }
   try {
-    const size = fs7.fstatSync(fd).size;
+    const size = fs8.fstatSync(fd).size;
     if (size !== entry.size) throw new Error("the shared file changed after the link was created");
   } catch (e) {
     try {
-      fs7.closeSync(fd);
+      fs8.closeSync(fd);
     } catch {
     }
     throw e;
@@ -4016,7 +4197,7 @@ async function handlePubsharePull(payload) {
       }
       const len = Math.min(CHUNK, end - pos + 1);
       const buf = Buffer.alloc(len);
-      const got = fs7.readSync(fd, buf, 0, len, pos);
+      const got = fs8.readSync(fd, buf, 0, len, pos);
       if (got !== len) throw new Error("the shared file changed while it was being sent");
       const dataB64 = buf.toString("base64");
       wsConn.send(JSON.stringify({
@@ -4040,7 +4221,7 @@ async function handlePubsharePull(payload) {
     }
   } finally {
     try {
-      fs7.closeSync(fd);
+      fs8.closeSync(fd);
     } catch {
     }
     activePulls.delete(requestId);
@@ -4093,7 +4274,7 @@ async function ensureHostSessionOnce(sessionName) {
 }
 async function shareViaRelay(absPath, stat, reqBody, encrypt2) {
   await ensureHostSession(reqBody.sessionName);
-  const filename = reqBody.name || path6.basename(absPath);
+  const filename = reqBody.name || path7.basename(absPath);
   const fileId = `cli_file_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
   let servePath = absPath;
   let serveSize = stat.size;
@@ -4103,13 +4284,13 @@ async function shareViaRelay(absPath, stat, reqBody, encrypt2) {
   if (encrypt2) {
     const key = newLinkKey();
     linkKey = b64url(key);
-    tempFile = path6.join(TEMP_DIR, `${fileId}.sre1`);
+    tempFile = path7.join(TEMP_DIR, `${fileId}.sre1`);
     const meta = { name: filename, size: stat.size, mime: "application/octet-stream" };
-    const fd = fs7.openSync(tempFile, "w", 384);
+    const fd = fs8.openSync(tempFile, "w", 384);
     try {
-      for await (const part of encryptFile(absPath, key, meta, { password: reqBody.password })) fs7.writeSync(fd, part);
+      for await (const part of encryptFile(absPath, key, meta, { password: reqBody.password })) fs8.writeSync(fd, part);
     } finally {
-      fs7.closeSync(fd);
+      fs8.closeSync(fd);
     }
     servePath = tempFile;
     serveSize = encryptedSize(stat.size, meta);
@@ -4141,7 +4322,7 @@ async function shareViaRelay(absPath, stat, reqBody, encrypt2) {
   if (reqBody._ownedPath) {
     if (encrypt2) {
       try {
-        fs7.unlinkSync(reqBody._ownedPath);
+        fs8.unlinkSync(reqBody._ownedPath);
       } catch {
       }
     } else tempFile = reqBody._ownedPath;
@@ -4180,7 +4361,7 @@ async function shareViaRelay(absPath, stat, reqBody, encrypt2) {
   } catch (e) {
     if (tempFile) {
       try {
-        fs7.unlinkSync(tempFile);
+        fs8.unlinkSync(tempFile);
       } catch {
       }
     }
@@ -4212,26 +4393,26 @@ function safeArchiveBase(name, fallback) {
 async function createShare(reqBody) {
   if (!reqBody?.filePath) throw Object.assign(new Error("filePath (or filePaths) required"), { status: 400 });
   assertRelayMode(reqBody);
-  const absPath = path6.resolve(reqBody.filePath);
+  const absPath = path7.resolve(reqBody.filePath);
   let stat;
   try {
-    stat = fs7.statSync(absPath);
+    stat = fs8.statSync(absPath);
   } catch {
     throw Object.assign(new Error(`File not found: ${absPath}`), { status: 404 });
   }
   if (stat.isDirectory()) {
-    const base = safeArchiveBase(path6.basename(absPath), "folder");
-    const out = path6.join(TEMP_DIR, `${uuidv4()}-${base}.tar.gz`);
+    const base = safeArchiveBase(path7.basename(absPath), "folder");
+    const out = path7.join(TEMP_DIR, `${uuidv4()}-${base}.tar.gz`);
     try {
       await packDirectory(absPath, out, excludesFor(reqBody));
     } catch (e) {
       try {
-        fs7.unlinkSync(out);
+        fs8.unlinkSync(out);
       } catch {
       }
       throw Object.assign(new Error(e?.message || String(e)), { status: 400 });
     }
-    return shareViaRelay(out, fs7.statSync(out), { ...reqBody, name: reqBody.name || `${base}.tar.gz`, _ownedPath: out }, shareEncrypt(reqBody));
+    return shareViaRelay(out, fs8.statSync(out), { ...reqBody, name: reqBody.name || `${base}.tar.gz`, _ownedPath: out }, shareEncrypt(reqBody));
   }
   if (!stat.isFile()) throw Object.assign(new Error(`Not a regular file or folder: ${absPath}`), { status: 400 });
   return shareViaRelay(absPath, stat, reqBody, shareEncrypt(reqBody));
@@ -4239,26 +4420,26 @@ async function createShare(reqBody) {
 async function createMultiShare(reqBody) {
   assertRelayMode(reqBody);
   const raw = Array.isArray(reqBody.filePaths) ? reqBody.filePaths : [];
-  const paths = Array.from(new Set(raw.filter((p) => typeof p === "string" && p.trim()).map((p) => path6.resolve(p))));
+  const paths = Array.from(new Set(raw.filter((p) => typeof p === "string" && p.trim()).map((p) => path7.resolve(p))));
   if (!paths.length) throw Object.assign(new Error("filePaths must be a non-empty array of paths"), { status: 400 });
   if (paths.length > MAX_MULTI_PATHS) throw Object.assign(new Error(`Too many paths (${paths.length}); max ${MAX_MULTI_PATHS}. Share a folder instead.`), { status: 400 });
-  const missing = paths.filter((p) => !fs7.existsSync(p));
+  const missing = paths.filter((p) => !fs8.existsSync(p));
   const bundle = reqBody.bundle !== false;
   if (bundle) {
     const stamp = (/* @__PURE__ */ new Date()).toISOString().slice(0, 16).replace(/[-:T]/g, "");
     const base = safeArchiveBase(reqBody.bundleName, `srift-${paths.length}-items-${stamp}`);
-    const out = path6.join(TEMP_DIR, `${uuidv4()}-${base}.tar.gz`);
+    const out = path7.join(TEMP_DIR, `${uuidv4()}-${base}.tar.gz`);
     let packed;
     try {
       packed = await packPaths(paths, out, base, excludesFor(reqBody));
     } catch (e) {
       try {
-        fs7.unlinkSync(out);
+        fs8.unlinkSync(out);
       } catch {
       }
       throw Object.assign(new Error(e?.message || String(e)), { status: 400 });
     }
-    const r = await shareViaRelay(out, fs7.statSync(out), { ...reqBody, name: `${base}.tar.gz`, _ownedPath: out }, shareEncrypt(reqBody));
+    const r = await shareViaRelay(out, fs8.statSync(out), { ...reqBody, name: `${base}.tar.gz`, _ownedPath: out }, shareEncrypt(reqBody));
     if (packed.skipped.length) console.warn(`[DAEMON] bundle skipped ${packed.skipped.length} item(s): ${packed.skipped.map((x) => x.path).join(", ")}`);
     return { ...r, bundle: true, files: packed.files, bytes: packed.bytes, paths: paths.length, skipped: packed.skipped };
   }
@@ -4327,7 +4508,7 @@ function embeddedDispatch(method, pathname, body) {
     }
   });
 }
-var _WebTorrentCtor, _webTorrentLoadError, SRIFT_HOME, EMBEDDED, STATE_PATH, logPath, logStream, logMessage, fmtLogArg, crypto5, PORT, DEFAULT_SIGNALER_URL, activeSignalerUrl, lastDiag, session, activeTransfers, chatHistory, pendingJoins, sseClients, wsConn, wsUrl, csrfToken, heartbeatInterval, lastHeartbeatAckAt, encryptionKey, sessionTerminated, terminationReason, activeTorrents, wtClient, pubshares, pubsharesByToken, activePulls, pubshareRegResolvers, TEMP_DIR, KDF_ITERATIONS, IV_LEN, STATE_STALE_MS, activeUploads, app, LOCAL_HOSTS, DAEMON_START_TIME, PACKAGE_VERSION, hostSessionInflight, MAX_MULTI_PATHS, MULTI_CONCURRENCY, embeddedReady, httpServer;
+var _WebTorrentCtor, _webTorrentLoadError, SRIFT_HOME, EMBEDDED, STATE_PATH, logPath, logStream, logMessage, fmtLogArg, crypto5, PORT, DEFAULT_SIGNALER_URL, activeSignalerUrl, lastDiag, session, activeTransfers, chatHistory, pendingJoins, participants, sseClients, wsConn, wsUrl, csrfToken, heartbeatInterval, lastHeartbeatAckAt, encryptionKey, sessionTerminated, terminationReason, activeTorrents, wtClient, pubshares, pubsharesByToken, activePulls, pubshareRegResolvers, TEMP_DIR, KDF_ITERATIONS, IV_LEN, RELAY_ENC, relayKeyCache, STATE_STALE_MS, activeUploads, app, LOCAL_HOSTS, DAEMON_START_TIME, PACKAGE_VERSION, hostSessionInflight, MAX_MULTI_PATHS, MULTI_CONCURRENCY, embeddedReady, httpServer;
 var init_daemon = __esm({
   "../../cli/daemon.ts"() {
     "use strict";
@@ -4339,25 +4520,25 @@ var init_daemon = __esm({
     init_pack();
     _WebTorrentCtor = null;
     _webTorrentLoadError = null;
-    SRIFT_HOME = path6.join(os4.homedir(), ".srift");
+    SRIFT_HOME = path7.join(os4.homedir(), ".srift");
     try {
-      fs7.mkdirSync(SRIFT_HOME, { recursive: true, mode: 448 });
+      fs8.mkdirSync(SRIFT_HOME, { recursive: true, mode: 448 });
       try {
-        fs7.chmodSync(SRIFT_HOME, 448);
+        fs8.chmodSync(SRIFT_HOME, 448);
       } catch {
       }
     } catch (e) {
     }
     EMBEDDED = process.env.SRIFT_DAEMON_EMBEDDED === "1";
-    STATE_PATH = path6.join(SRIFT_HOME, EMBEDDED ? "state-embedded.json" : "state.json");
-    logPath = path6.join(SRIFT_HOME, "daemon.log");
+    STATE_PATH = path7.join(SRIFT_HOME, EMBEDDED ? "state-embedded.json" : "state.json");
+    logPath = path7.join(SRIFT_HOME, "daemon.log");
     try {
-      if (fs7.statSync(logPath).size > 5 * 1024 * 1024) fs7.renameSync(logPath, `${logPath}.1`);
+      if (fs8.statSync(logPath).size > 5 * 1024 * 1024) fs8.renameSync(logPath, `${logPath}.1`);
     } catch {
     }
-    logStream = fs7.createWriteStream(logPath, { flags: "a", mode: 384 });
+    logStream = fs8.createWriteStream(logPath, { flags: "a", mode: 384 });
     try {
-      fs7.chmodSync(logPath, 384);
+      fs8.chmodSync(logPath, 384);
     } catch {
     }
     logMessage = (level, message) => {
@@ -4404,6 +4585,7 @@ var init_daemon = __esm({
     activeTransfers = [];
     chatHistory = [];
     pendingJoins = [];
+    participants = [];
     sseClients = [];
     wsConn = null;
     wsUrl = null;
@@ -4419,15 +4601,15 @@ var init_daemon = __esm({
     pubsharesByToken = /* @__PURE__ */ new Map();
     activePulls = /* @__PURE__ */ new Map();
     pubshareRegResolvers = /* @__PURE__ */ new Map();
-    TEMP_DIR = path6.join(SRIFT_HOME, "tmp");
-    if (!fs7.existsSync(TEMP_DIR)) {
-      fs7.mkdirSync(TEMP_DIR, { recursive: true, mode: 448 });
+    TEMP_DIR = path7.join(SRIFT_HOME, "tmp");
+    if (!fs8.existsSync(TEMP_DIR)) {
+      fs8.mkdirSync(TEMP_DIR, { recursive: true, mode: 448 });
     }
     try {
-      for (const f of fs7.readdirSync(TEMP_DIR)) {
+      for (const f of fs8.readdirSync(TEMP_DIR)) {
         if (f.endsWith(".sre1")) {
           try {
-            fs7.unlinkSync(path6.join(TEMP_DIR, f));
+            fs8.unlinkSync(path7.join(TEMP_DIR, f));
           } catch {
           }
         }
@@ -4436,6 +4618,8 @@ var init_daemon = __esm({
     }
     KDF_ITERATIONS = 1e5;
     IV_LEN = 12;
+    RELAY_ENC = "sgcm1";
+    relayKeyCache = null;
     STATE_STALE_MS = 24 * 60 * 60 * 1e3;
     pruneStaleStateOnStartup();
     activeUploads = /* @__PURE__ */ new Map();
@@ -4454,7 +4638,7 @@ var init_daemon = __esm({
     app.use(cors({ origin: "*", maxAge: 600 }));
     app.use(express.json());
     DAEMON_START_TIME = Date.now();
-    PACKAGE_VERSION = "4.0.0";
+    PACKAGE_VERSION = "4.1.0";
     app.get("/health", (req, res) => {
       res.json({
         ok: true,
@@ -4478,6 +4662,7 @@ var init_daemon = __esm({
         },
         activeTransfers,
         pendingJoins,
+        participants,
         lastUpdated: (/* @__PURE__ */ new Date()).toISOString()
       });
     });
@@ -4505,7 +4690,7 @@ var init_daemon = __esm({
         wsUrl = data.wsUrl || `${activeSignalerUrl.replace(/^http/, "ws")}/ws`;
         if (wsUrl) connectWebSocket(wsUrl);
         writeStateFile();
-        res.json({ success: true, sessionId: data.sessionId });
+        res.json({ success: true, sessionId: data.sessionId, joinUrl: `${activeSignalerUrl.replace(/\/+$/, "")}/join-session?id=${data.sessionId}` });
       } catch (err) {
         console.error("[DAEMON] Failed to start session:", err);
         res.status(500).json({ success: false, error: err.message });
@@ -4550,7 +4735,7 @@ var init_daemon = __esm({
         res.status(500).json({ success: false, error: err.message });
       }
     });
-    app.post("/session/approve", (req, res) => {
+    app.post("/session/approve", async (req, res) => {
       const { tempUserId } = req.body;
       if (!tempUserId) {
         return res.status(400).json({ success: false, error: "tempUserId required" });
@@ -4568,7 +4753,13 @@ var init_daemon = __esm({
         payload: { sessionId: session.id, tempUserId }
       }));
       pendingJoins = pendingJoins.filter((j) => j.tempUserId !== tempUserId);
-      res.json({ success: true });
+      const before = new Set(participants.filter((p) => p.online).map((p) => p.userId));
+      const joined = () => participants.find((p) => p.online && !p.isHost && p.username === pending.username && !before.has(p.userId));
+      for (let waited = 0; waited < 8e3 && !joined() && session.id; waited += 100) {
+        await new Promise((r) => setTimeout(r, 100));
+      }
+      const member = joined();
+      res.json({ success: true, joined: !!member, userId: member?.userId ?? null, username: pending.username });
     });
     app.post("/session/reject", (req, res) => {
       const { tempUserId, reason } = req.body;
@@ -4645,13 +4836,14 @@ var init_daemon = __esm({
       activeTransfers = [];
       chatHistory = [];
       pendingJoins = [];
+      participants = [];
       csrfToken = null;
       encryptionKey = null;
       try {
-        if (fs7.existsSync(TEMP_DIR)) {
-          for (const f of fs7.readdirSync(TEMP_DIR)) {
+        if (fs8.existsSync(TEMP_DIR)) {
+          for (const f of fs8.readdirSync(TEMP_DIR)) {
             try {
-              fs7.unlinkSync(path6.join(TEMP_DIR, f));
+              fs8.unlinkSync(path7.join(TEMP_DIR, f));
             } catch {
             }
           }
@@ -4667,14 +4859,16 @@ var init_daemon = __esm({
         if (!filePath) {
           return res.status(400).json({ success: false, error: "filePath is required" });
         }
-        const absPath = path6.resolve(filePath);
-        if (!fs7.existsSync(absPath)) {
+        const absPath = path7.resolve(filePath);
+        if (!fs8.existsSync(absPath)) {
           return res.status(404).json({ success: false, error: `File not found: ${absPath}` });
         }
-        const stat = fs7.statSync(absPath);
-        const filename = path6.basename(absPath);
+        const stat = fs8.statSync(absPath);
+        const filename = path7.basename(absPath);
         const fileId = `cli_file_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
         const targetProtocol = webTorrentAllowed() && (protocol === "webtorrent" || stat.size > 10 * 1024 * 1024 && protocol !== "websocket") ? "webtorrent" : "websocket";
+        const notReady = await waitSignalReady();
+        if (notReady) return res.status(notReady.status).json(notReady.body);
         const newTx = {
           fileId,
           name: filename,
@@ -4720,13 +4914,14 @@ var init_daemon = __esm({
       if (!tx) {
         return res.status(404).json({ success: false, error: "No offer found for this fileId" });
       }
-      tx.saveDir = saveDir ? path6.resolve(saveDir) : process.cwd();
+      tx.saveDir = saveDir ? path7.resolve(saveDir) : process.cwd();
       tx.status = "downloading";
       tx.startTime = Date.now();
       console.log(`[DAEMON] Accepting file offer ${fileId}, saving to ${tx.saveDir}`);
       wsConn?.send(JSON.stringify({
         type: "file_accept",
-        payload: { fileId }
+        // relayEnc: this daemon decrypts sealed relay chunks (see openRelayChunk)
+        payload: { fileId, relayEnc: RELAY_ENC }
       }));
       res.json({ success: true });
     });
@@ -4739,16 +4934,8 @@ var init_daemon = __esm({
         if (!session.id) {
           return res.status(409).json({ success: false, error: "No active session. Call /session/start first." });
         }
-        if (!encryptionKey) {
-          return res.status(409).json({ success: false, error: "Encryption key not ready. Session still initialising." });
-        }
-        if (!wsConn || wsConn.readyState !== 1) {
-          return res.status(503).json({
-            success: false,
-            error: "Signaling connection not ready (WebSocket is connecting). Retry in 1\u20132 seconds.",
-            retryAfterMs: 1500
-          });
-        }
+        const notReady = await waitSignalReady();
+        if (notReady) return res.status(notReady.status).json(notReady.body);
         const encContent = await encrypt(message);
         wsConn.send(JSON.stringify({
           type: "chat",
@@ -4771,8 +4958,8 @@ var init_daemon = __esm({
     });
     app.get("/state", (req, res) => {
       try {
-        if (fs7.existsSync(STATE_PATH)) {
-          const raw = fs7.readFileSync(STATE_PATH, "utf-8");
+        if (fs8.existsSync(STATE_PATH)) {
+          const raw = fs8.readFileSync(STATE_PATH, "utf-8");
           res.type("application/json").send(raw);
         } else {
           res.json({ session: { id: null, isConnected: false }, activeTransfers: [], lastUpdated: null });
@@ -4852,7 +5039,7 @@ var init_daemon = __esm({
       pubshares.delete(entry.fileId);
       if (entry.tempFile) {
         try {
-          fs7.unlinkSync(entry.tempFile);
+          fs8.unlinkSync(entry.tempFile);
         } catch {
         }
       }
@@ -4964,7 +5151,7 @@ data: /mcp/messages
         servers: [{ url: `http://127.0.0.1:${PORT}` }],
         paths: {
           "/health": { get: { summary: "Liveness probe", description: "Returns {ok,version,uptime_ms,mcp,webrtc,webtorrent}", responses: { "200": { description: "OK" } } } },
-          "/status": { get: { summary: "Get session + transfers + pending joins", responses: { "200": { description: "OK" } } } },
+          "/status": { get: { summary: "Get session, transfers, pending joins and participants (members with userId, for /session/kick)", responses: { "200": { description: "OK" } } } },
           "/state": { get: { summary: "Workspace state snapshot (.srift-state.json)", responses: { "200": { description: "OK" } } } },
           "/transfers": { get: { summary: "Live transfer list with speed and ETA. Optional ?fileId= to filter.", responses: { "200": { description: "OK" } } } },
           "/transfers/{fileId}": { get: { summary: "Per-transfer drill-down", parameters: [{ name: "fileId", in: "path", required: true, schema: { type: "string" } }], responses: { "200": { description: "OK" }, "404": { description: "Transfer not found" } } } },
@@ -4972,9 +5159,11 @@ data: /mcp/messages
           "/metrics": { get: { summary: "Prometheus-format counters (no auth)", responses: { "200": { description: "text/plain Prometheus format" } } } },
           "/logs": { get: { summary: "NDJSON daemon log tail. ?lines=N (default 100)", responses: { "200": { description: "application/x-ndjson" } } } },
           "/reset": { post: { summary: "Wipe all state and flush encryption keys", responses: { "200": { description: "{ok:true}" } } } },
-          "/session/start": { post: { summary: "Create new session (becomes host)", requestBody: { content: { "application/json": { schema: { type: "object", properties: { sessionName: { type: "string" }, roomSecret: { type: "string" } } } } } }, responses: { "200": { description: "{success:true,sessionId}" } } } },
+          "/v1/diag": { get: { summary: "Network diagnosis (same as `srift doctor --json`); ?fresh=1 re-probes", responses: { "200": { description: "Diagnosis report" } } } },
+          "/daemon/stop": { post: { summary: "Stop this daemon", responses: { "200": { description: "OK" } } } },
+          "/session/start": { post: { summary: "Create new session (becomes host); returns sessionId and joinUrl", requestBody: { content: { "application/json": { schema: { type: "object", properties: { sessionName: { type: "string" }, roomSecret: { type: "string" } } } } } }, responses: { "200": { description: "{success:true,sessionId}" } } } },
           "/session/join": { post: { summary: "Join existing session", requestBody: { content: { "application/json": { schema: { type: "object", required: ["sessionId"], properties: { sessionId: { type: "string" }, username: { type: "string" }, roomSecret: { type: "string" } } } } } }, responses: { "200": { description: "OK" }, "400": { description: "Missing sessionId" }, "404": { description: "Session not found" } } } },
-          "/session/approve": { post: { summary: "Host approves a pending join request", requestBody: { content: { "application/json": { schema: { type: "object", required: ["tempUserId"], properties: { tempUserId: { type: "string" } } } } } }, responses: { "200": { description: "OK" }, "400": { description: "tempUserId required" }, "403": { description: "Not host" }, "404": { description: "No such pending request" } } } },
+          "/session/approve": { post: { summary: "Host approves a pending join request; returns {success, joined, userId} once the guest is in the room (max 8 s)", requestBody: { content: { "application/json": { schema: { type: "object", required: ["tempUserId"], properties: { tempUserId: { type: "string" } } } } } }, responses: { "200": { description: "OK" }, "400": { description: "tempUserId required" }, "403": { description: "Not host" }, "404": { description: "No such pending request" } } } },
           "/session/reject": { post: { summary: "Host rejects a pending join request", requestBody: { content: { "application/json": { schema: { type: "object", required: ["tempUserId"], properties: { tempUserId: { type: "string" }, reason: { type: "string" } } } } } }, responses: { "200": { description: "OK" }, "400": { description: "tempUserId required" }, "403": { description: "Not host" } } } },
           "/session/kick": { post: { summary: "Host kicks a peer", requestBody: { content: { "application/json": { schema: { type: "object", required: ["userId"], properties: { userId: { type: "string" } } } } } }, responses: { "200": { description: "OK" }, "400": { description: "userId required" }, "403": { description: "Not host" } } } },
           "/session/close": { post: { summary: "Tear down the session and flush keys", responses: { "200": { description: "OK" } } } },
@@ -5055,8 +5244,8 @@ data: /mcp/messages
     app.get("/logs", (req, res) => {
       const lines = parseInt(req.query.lines || "100", 10);
       try {
-        if (!fs7.existsSync(logPath)) return res.json([]);
-        const content = fs7.readFileSync(logPath, "utf-8");
+        if (!fs8.existsSync(logPath)) return res.json([]);
+        const content = fs8.readFileSync(logPath, "utf-8");
         const all = content.split("\n").filter(Boolean);
         const tail = all.slice(-Math.min(lines, all.length));
         res.set("Content-Type", "application/x-ndjson");
@@ -5091,15 +5280,16 @@ data: /mcp/messages
       activeTransfers = [];
       chatHistory = [];
       pendingJoins = [];
+      participants = [];
       csrfToken = null;
       encryptionKey = null;
       wsUrl = null;
       let cleanedChunks = 0;
       try {
-        if (fs7.existsSync(TEMP_DIR)) {
-          for (const f of fs7.readdirSync(TEMP_DIR)) {
+        if (fs8.existsSync(TEMP_DIR)) {
+          for (const f of fs8.readdirSync(TEMP_DIR)) {
             try {
-              fs7.unlinkSync(path6.join(TEMP_DIR, f));
+              fs8.unlinkSync(path7.join(TEMP_DIR, f));
               cleanedChunks++;
             } catch {
             }
@@ -5161,16 +5351,17 @@ data: /mcp/messages
         activeTransfers = [];
         chatHistory = [];
         pendingJoins = [];
+        participants = [];
         encryptionKey = null;
         wsUrl = null;
         writeStateFile();
       } catch {
       }
       try {
-        if (fs7.existsSync(TEMP_DIR)) {
-          for (const f of fs7.readdirSync(TEMP_DIR)) {
+        if (fs8.existsSync(TEMP_DIR)) {
+          for (const f of fs8.readdirSync(TEMP_DIR)) {
             try {
-              fs7.unlinkSync(path6.join(TEMP_DIR, f));
+              fs8.unlinkSync(path7.join(TEMP_DIR, f));
             } catch {
             }
           }
@@ -5185,7 +5376,7 @@ data: /mcp/messages
       process.on("exit", () => {
         for (const e of pubshares.values()) if (e.tempFile) {
           try {
-            fs7.unlinkSync(e.tempFile);
+            fs8.unlinkSync(e.tempFile);
           } catch {
           }
         }
@@ -6837,12 +7028,12 @@ var init_card = __esm({
 });
 
 // ../../cli/agentnet/describe.ts
-import fs9 from "node:fs";
+import fs10 from "node:fs";
 import os6 from "node:os";
-import path8 from "node:path";
+import path9 from "node:path";
 function read(file2) {
   try {
-    return fs9.readFileSync(file2, "utf8");
+    return fs10.readFileSync(file2, "utf8");
   } catch {
     return null;
   }
@@ -6855,7 +7046,7 @@ function firstSentence(s) {
 function detectProject(start = process.cwd()) {
   let dir = start;
   for (let i = 0; i < 4; i++) {
-    const pkg = read(path8.join(dir, "package.json"));
+    const pkg = read(path9.join(dir, "package.json"));
     if (pkg) {
       try {
         const j = JSON.parse(pkg);
@@ -6864,7 +7055,7 @@ function detectProject(start = process.cwd()) {
       } catch {
       }
     }
-    const py = read(path8.join(dir, "pyproject.toml"));
+    const py = read(path9.join(dir, "pyproject.toml"));
     if (py) {
       return {
         name: py.match(/^\s*name\s*=\s*"([^"]+)"/m)?.[1],
@@ -6872,7 +7063,7 @@ function detectProject(start = process.cwd()) {
         stack: "Python"
       };
     }
-    const cargo = read(path8.join(dir, "Cargo.toml"));
+    const cargo = read(path9.join(dir, "Cargo.toml"));
     if (cargo) {
       return {
         name: cargo.match(/^\s*name\s*=\s*"([^"]+)"/m)?.[1],
@@ -6880,9 +7071,9 @@ function detectProject(start = process.cwd()) {
         stack: "Rust"
       };
     }
-    const gomod = read(path8.join(dir, "go.mod"));
+    const gomod = read(path9.join(dir, "go.mod"));
     if (gomod) return { name: gomod.match(/^module\s+(\S+)/m)?.[1]?.split("/").pop(), stack: "Go" };
-    const parent = path8.dirname(dir);
+    const parent = path9.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -6890,7 +7081,7 @@ function detectProject(start = process.cwd()) {
 }
 function runtimeLabel() {
   if (process.env.KUBERNETES_SERVICE_HOST) return "Kubernetes";
-  if (fs9.existsSync("/.dockerenv")) return "container";
+  if (fs10.existsSync("/.dockerenv")) return "container";
   if (process.env.GITHUB_ACTIONS) return "GitHub Actions";
   if (process.env.CODESPACES) return "Codespace";
   if (process.env.AWS_LAMBDA_FUNCTION_NAME) return "AWS Lambda";
@@ -6926,20 +7117,20 @@ var init_describe = __esm({
 
 // ../../cli/agentnet/local.ts
 import { AsyncLocalStorage } from "node:async_hooks";
-import fs10 from "node:fs";
+import fs11 from "node:fs";
 import os7 from "node:os";
-import path9 from "node:path";
+import path10 from "node:path";
 function inHome(home, fn) {
   return homeCtx.run(home, fn);
 }
 function anDir() {
-  return homeCtx.getStore() || process.env.SRIFT_AN_HOME || path9.join(os7.homedir(), ".srift", "agentnet");
+  return homeCtx.getStore() || process.env.SRIFT_AN_HOME || path10.join(os7.homedir(), ".srift", "agentnet");
 }
 function file(name) {
-  return path9.join(anDir(), name);
+  return path10.join(anDir(), name);
 }
 function ensureDir(dir = anDir()) {
-  fs10.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs11.mkdirSync(dir, { recursive: true, mode: 448 });
 }
 function ramFor() {
   const k = anDir();
@@ -6959,7 +7150,7 @@ function readJson(name, fallback) {
       const v = ramFor().json.get(name);
       return v === void 0 ? fallback : JSON.parse(v);
     }
-    return JSON.parse(fs10.readFileSync(file(name), "utf8"));
+    return JSON.parse(fs11.readFileSync(file(name), "utf8"));
   } catch {
     return fallback;
   }
@@ -6972,20 +7163,20 @@ function writeJson(name, data) {
   ensureDir();
   const target = file(name);
   const tmp = `${target}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-  fs10.writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 384 });
+  fs11.writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 384 });
   try {
-    fs10.renameSync(tmp, target);
+    fs11.renameSync(tmp, target);
   } catch (e) {
     for (let i = 0; i < 20; i++) {
       sleepSync(25);
       try {
-        fs10.renameSync(tmp, target);
+        fs11.renameSync(tmp, target);
         return;
       } catch {
       }
     }
     try {
-      fs10.unlinkSync(tmp);
+      fs11.unlinkSync(tmp);
     } catch {
     }
     throw e;
@@ -7002,15 +7193,15 @@ function withLock(name, fn) {
   let fd = null;
   while (fd === null) {
     try {
-      fd = fs10.openSync(lock, "wx");
-      fs10.writeSync(fd, String(process.pid));
+      fd = fs11.openSync(lock, "wx");
+      fs11.writeSync(fd, String(process.pid));
     } catch (e) {
       if (e?.code !== "EEXIST" && e?.code !== "EPERM" && e?.code !== "EACCES" && e?.code !== "EBUSY") throw e;
       try {
-        const holder = Number(fs10.readFileSync(lock, "utf8"));
-        const age = Date.now() - fs10.statSync(lock).mtimeMs;
+        const holder = Number(fs11.readFileSync(lock, "utf8"));
+        const age = Date.now() - fs11.statSync(lock).mtimeMs;
         if (holder && holder !== process.pid && !pidAlive(holder) && age > 200 || age > 6e4) {
-          fs10.unlinkSync(lock);
+          fs11.unlinkSync(lock);
           continue;
         }
       } catch {
@@ -7023,11 +7214,11 @@ function withLock(name, fn) {
     return fn();
   } finally {
     try {
-      fs10.closeSync(fd);
+      fs11.closeSync(fd);
     } catch {
     }
     try {
-      fs10.unlinkSync(lock);
+      fs11.unlinkSync(lock);
     } catch {
     }
   }
@@ -7040,13 +7231,13 @@ function mutateJson(name, fallback, fn) {
   });
 }
 function hasIdentity() {
-  return fs10.existsSync(file("identity.json"));
+  return fs11.existsSync(file("identity.json"));
 }
 function loadIdentity() {
   const p = file("identity.json");
   let text2;
   try {
-    text2 = fs10.readFileSync(p, "utf8");
+    text2 = fs11.readFileSync(p, "utf8");
   } catch (e) {
     if (e?.code === "ENOENT") return null;
     throw new Error(`Cannot read ${p} (${e?.code || e?.message}). Refusing to continue so your address is never replaced.`);
@@ -7101,7 +7292,7 @@ function ensureIdentity() {
   ensureDir();
   let fd;
   try {
-    fd = fs10.openSync(file("identity.json.creating"), "wx");
+    fd = fs11.openSync(file("identity.json.creating"), "wx");
   } catch {
     for (let i = 0; i < 100; i++) {
       sleepSync(20);
@@ -7109,7 +7300,7 @@ function ensureIdentity() {
       if (again) return { identity: again, created: false };
     }
     try {
-      fs10.unlinkSync(file("identity.json.creating"));
+      fs11.unlinkSync(file("identity.json.creating"));
     } catch {
     }
     return ensureIdentity();
@@ -7121,9 +7312,9 @@ function ensureIdentity() {
     saveIdentity(identity);
     return { identity, created: true };
   } finally {
-    fs10.closeSync(fd);
+    fs11.closeSync(fd);
     try {
-      fs10.unlinkSync(file("identity.json.creating"));
+      fs11.unlinkSync(file("identity.json.creating"));
     } catch {
     }
   }
@@ -7133,7 +7324,7 @@ function saveProfile(address, profile) {
   withLock("identity.json", () => {
     let raw;
     try {
-      raw = JSON.parse(fs10.readFileSync(file("identity.json"), "utf8").replace(/^\uFEFF/, ""));
+      raw = JSON.parse(fs11.readFileSync(file("identity.json"), "utf8").replace(/^\uFEFF/, ""));
     } catch {
       return;
     }
@@ -7274,7 +7465,7 @@ function inboxPath() {
 function readInbox() {
   if (isEphemeral()) return ramFor().inbox.slice();
   try {
-    return fs10.readFileSync(inboxPath(), "utf8").split("\n").filter(Boolean).map((l) => {
+    return fs11.readFileSync(inboxPath(), "utf8").split("\n").filter(Boolean).map((l) => {
       try {
         return JSON.parse(l);
       } catch {
@@ -7299,7 +7490,7 @@ function appendInbox(rec) {
     if (r.inbox.length > 2e4) r.inbox.splice(0, r.inbox.length - 2e4);
   } else {
     ensureDir();
-    withLock("inbox.jsonl", () => fs10.appendFileSync(inboxPath(), JSON.stringify(rec) + "\n", { mode: 384 }));
+    withLock("inbox.jsonl", () => fs11.appendFileSync(inboxPath(), JSON.stringify(rec) + "\n", { mode: 384 }));
   }
   ids.add(rec.id);
   if (ids.size > 2e4) recentIds.set(key, new Set([...ids].slice(-1e4)));
@@ -7322,14 +7513,14 @@ function outboxAdd(item) {
     return;
   }
   ensureDir(outboxDir());
-  fs10.writeFileSync(path9.join(outboxDir(), `${item.id}.json`), JSON.stringify(item), { mode: 384 });
+  fs11.writeFileSync(path10.join(outboxDir(), `${item.id}.json`), JSON.stringify(item), { mode: 384 });
 }
 function outboxList() {
   if (isEphemeral()) return [...ramFor().outbox.values()].map((v) => JSON.parse(v));
   try {
-    return fs10.readdirSync(outboxDir()).filter((f) => f.endsWith(".json")).map((f) => {
+    return fs11.readdirSync(outboxDir()).filter((f) => f.endsWith(".json")).map((f) => {
       try {
-        return JSON.parse(fs10.readFileSync(path9.join(outboxDir(), f), "utf8"));
+        return JSON.parse(fs11.readFileSync(path10.join(outboxDir(), f), "utf8"));
       } catch {
         return null;
       }
@@ -7343,7 +7534,7 @@ function outboxUpdate(item) {
     if (ramFor().outbox.has(item.id)) ramFor().outbox.set(item.id, JSON.stringify(item));
     return;
   }
-  if (OUTBOX_ID.test(item.id) && fs10.existsSync(path9.join(outboxDir(), `${item.id}.json`))) outboxAdd(item);
+  if (OUTBOX_ID.test(item.id) && fs11.existsSync(path10.join(outboxDir(), `${item.id}.json`))) outboxAdd(item);
 }
 function outboxRemove(id) {
   if (isEphemeral()) {
@@ -7352,7 +7543,7 @@ function outboxRemove(id) {
   }
   if (!OUTBOX_ID.test(id)) return;
   try {
-    fs10.unlinkSync(path9.join(outboxDir(), `${id}.json`));
+    fs11.unlinkSync(path10.join(outboxDir(), `${id}.json`));
   } catch {
   }
 }
@@ -7365,14 +7556,14 @@ function readLock() {
   const p = file("node.lock");
   let l = null;
   try {
-    l = JSON.parse(fs10.readFileSync(p, "utf8"));
+    l = JSON.parse(fs11.readFileSync(p, "utf8"));
   } catch {
     return null;
   }
   if (!l || !Number.isInteger(l.pid)) return null;
   if (l.pid === process.pid && l.nonce && l.nonce === myLockNonce) return l;
   try {
-    if (Date.now() - fs10.statSync(p).mtimeMs > LOCK_STALE_MS) return null;
+    if (Date.now() - fs11.statSync(p).mtimeMs > LOCK_STALE_MS) return null;
   } catch {
     return null;
   }
@@ -7383,16 +7574,16 @@ function acquireLock() {
   const p = file("node.lock");
   for (let attempt2 = 0; attempt2 < 2; attempt2++) {
     try {
-      const fd = fs10.openSync(p, "wx", 384);
+      const fd = fs11.openSync(p, "wx", 384);
       myLockNonce = randomToken(12);
-      fs10.writeSync(fd, JSON.stringify({ pid: process.pid, startedAt: nowSec(), nonce: myLockNonce }));
-      fs10.closeSync(fd);
+      fs11.writeSync(fd, JSON.stringify({ pid: process.pid, startedAt: nowSec(), nonce: myLockNonce }));
+      fs11.closeSync(fd);
       return true;
     } catch (e) {
       if (e?.code !== "EEXIST") throw e;
       if (readLock()) return false;
       try {
-        fs10.unlinkSync(p);
+        fs11.unlinkSync(p);
       } catch {
       }
     }
@@ -7403,20 +7594,20 @@ function heartbeatLock() {
   if (!myLockNonce) return;
   const now = /* @__PURE__ */ new Date();
   try {
-    fs10.utimesSync(file("node.lock"), now, now);
+    fs11.utimesSync(file("node.lock"), now, now);
   } catch {
   }
 }
 function requestStop() {
   ensureDir();
-  fs10.writeFileSync(file("node.stop"), String(Date.now()), { mode: 384 });
+  fs11.writeFileSync(file("node.stop"), String(Date.now()), { mode: 384 });
 }
 function stopRequested() {
-  return fs10.existsSync(file("node.stop"));
+  return fs11.existsSync(file("node.stop"));
 }
 function clearStopRequest() {
   try {
-    fs10.unlinkSync(file("node.stop"));
+    fs11.unlinkSync(file("node.stop"));
   } catch {
   }
 }
@@ -7425,7 +7616,7 @@ function clearLock() {
   if (l && l.pid === process.pid && (!l.nonce || l.nonce === myLockNonce)) {
     myLockNonce = null;
     try {
-      fs10.unlinkSync(file("node.lock"));
+      fs11.unlinkSync(file("node.lock"));
     } catch {
     }
   }
@@ -7471,12 +7662,12 @@ function appendSent(rec) {
     return;
   }
   ensureDir();
-  withLock("sent.jsonl", () => fs10.appendFileSync(file("sent.jsonl"), JSON.stringify(rec) + "\n", { mode: 384 }));
+  withLock("sent.jsonl", () => fs11.appendFileSync(file("sent.jsonl"), JSON.stringify(rec) + "\n", { mode: 384 }));
 }
 function readSent() {
   if (isEphemeral()) return ramFor().sent.slice();
   try {
-    return fs10.readFileSync(file("sent.jsonl"), "utf8").split("\n").filter(Boolean).map((l) => {
+    return fs11.readFileSync(file("sent.jsonl"), "utf8").split("\n").filter(Boolean).map((l) => {
       try {
         return JSON.parse(l);
       } catch {
@@ -7498,11 +7689,11 @@ function pidAlive(pid) {
 function cleanStaleEphemeral() {
   let n = 0;
   try {
-    for (const d of fs10.readdirSync(os7.tmpdir())) {
+    for (const d of fs11.readdirSync(os7.tmpdir())) {
       const m = d.match(/^srift-an-(\d+)-/);
       if (m && Number(m[1]) !== process.pid && !pidAlive(Number(m[1]))) {
         try {
-          fs10.rmSync(path9.join(os7.tmpdir(), d), { recursive: true, force: true });
+          fs11.rmSync(path10.join(os7.tmpdir(), d), { recursive: true, force: true });
           n++;
         } catch {
         }
@@ -7518,23 +7709,23 @@ function filesRoot() {
     let root = ephemeralRoots.get(key);
     if (!root) {
       cleanStaleEphemeral();
-      root = fs10.mkdtempSync(path9.join(os7.tmpdir(), `srift-an-${process.pid}-`));
+      root = fs11.mkdtempSync(path10.join(os7.tmpdir(), `srift-an-${process.pid}-`));
       ephemeralRoots.set(key, root);
       const r = root;
       process.once("exit", () => {
         try {
-          fs10.rmSync(r, { recursive: true, force: true });
+          fs11.rmSync(r, { recursive: true, force: true });
         } catch {
         }
       });
     }
     return root;
   }
-  return path9.join(anDir(), "files");
+  return path10.join(anDir(), "files");
 }
 function filesDir(...parts) {
-  const d = path9.join(filesRoot(), ...parts);
-  fs10.mkdirSync(d, { recursive: true, mode: 448 });
+  const d = path10.join(filesRoot(), ...parts);
+  fs11.mkdirSync(d, { recursive: true, mode: 448 });
   return d;
 }
 function rewriteJsonl(name, keep) {
@@ -7543,7 +7734,7 @@ function rewriteJsonl(name, keep) {
   withLock(name, () => {
     let lines;
     try {
-      lines = fs10.readFileSync(p, "utf8").split("\n").filter(Boolean);
+      lines = fs11.readFileSync(p, "utf8").split("\n").filter(Boolean);
     } catch {
       return;
     }
@@ -7557,8 +7748,8 @@ function rewriteJsonl(name, keep) {
     });
     if (!removed) return;
     const tmp = `${p}.${process.pid}.tmp`;
-    fs10.writeFileSync(tmp, kept.map((l) => l + "\n").join(""), { mode: 384 });
-    fs10.renameSync(tmp, p);
+    fs11.writeFileSync(tmp, kept.map((l) => l + "\n").join(""), { mode: 384 });
+    fs11.renameSync(tmp, p);
   });
   if (removed) recentIds.delete("disk:" + anDir());
   return removed;
@@ -7602,11 +7793,11 @@ function prune(cfg = loadConfig(), now = nowSec()) {
     return k;
   });
   try {
-    const inc = path9.join(filesRoot(), ".incoming");
-    for (const f of fs10.readdirSync(inc)) {
-      const fp = path9.join(inc, f);
-      if (Date.now() - fs10.statSync(fp).mtimeMs > 36e5) {
-        fs10.rmSync(fp, { force: true });
+    const inc = path10.join(filesRoot(), ".incoming");
+    for (const f of fs11.readdirSync(inc)) {
+      const fp = path10.join(inc, f);
+      if (Date.now() - fs11.statSync(fp).mtimeMs > 36e5) {
+        fs11.rmSync(fp, { force: true });
         r.partials++;
       }
     }
@@ -7617,19 +7808,19 @@ function prune(cfg = loadConfig(), now = nowSec()) {
     const walk = (d) => {
       let entries = [];
       try {
-        entries = fs10.readdirSync(d, { withFileTypes: true });
+        entries = fs11.readdirSync(d, { withFileTypes: true });
       } catch {
         return;
       }
       for (const e of entries) {
-        const fp = path9.join(d, e.name);
+        const fp = path10.join(d, e.name);
         if (e.isDirectory()) {
           if (e.name !== ".incoming") walk(fp);
           continue;
         }
         try {
-          if (fs10.statSync(fp).mtimeMs < limit) {
-            fs10.rmSync(fp, { force: true });
+          if (fs11.statSync(fp).mtimeMs < limit) {
+            fs11.rmSync(fp, { force: true });
             r.files++;
           }
         } catch {
@@ -7644,12 +7835,12 @@ function prune(cfg = loadConfig(), now = nowSec()) {
 function rotateLog(maxBytes = 5 * 1024 * 1024) {
   const p = file("node.log");
   try {
-    if (fs10.statSync(p).size <= maxBytes) return false;
+    if (fs11.statSync(p).size <= maxBytes) return false;
     try {
-      fs10.rmSync(p + ".1", { force: true });
+      fs11.rmSync(p + ".1", { force: true });
     } catch {
     }
-    fs10.renameSync(p, p + ".1");
+    fs11.renameSync(p, p + ".1");
     return true;
   } catch {
     return false;
@@ -7663,14 +7854,14 @@ function wipe(all = false) {
   if (all) names.push("identity.json", "contacts.json", "groups.json", "config.json", "node.lock");
   for (const n of names) {
     const p = file(n);
-    if (fs10.existsSync(p)) {
-      fs10.rmSync(p, { recursive: true, force: true });
+    if (fs11.existsSync(p)) {
+      fs11.rmSync(p, { recursive: true, force: true });
       removed.push(n);
     }
   }
   if (all) {
     try {
-      for (const f of fs10.readdirSync(anDir())) if (f.endsWith(".lock") || f.endsWith(".tmp")) fs10.rmSync(path9.join(anDir(), f), { force: true });
+      for (const f of fs11.readdirSync(anDir())) if (f.endsWith(".lock") || f.endsWith(".tmp")) fs11.rmSync(path10.join(anDir(), f), { force: true });
     } catch {
     }
   }
@@ -7821,8 +8012,8 @@ var init_group = __esm({
 
 // ../../cli/agentnet/files.ts
 import crypto7 from "node:crypto";
-import fs11 from "node:fs";
-import path10 from "node:path";
+import fs12 from "node:fs";
+import path11 from "node:path";
 function safeFileName(name) {
   const raw = String(name || "file").split(/[\\/]/).pop() || "file";
   let base = raw.replace(/[\u0000-\u001f\u007f<>:"|?*]/g, "_").replace(/^\.+/, "_").replace(/[. ]+$/, "").trim();
@@ -7830,33 +8021,33 @@ function safeFileName(name) {
   return (base || "file").slice(0, 180);
 }
 function uniquePath2(dir, name) {
-  let p = path10.join(dir, name);
-  if (!fs11.existsSync(p)) return p;
-  const ext = path10.extname(name);
+  let p = path11.join(dir, name);
+  if (!fs12.existsSync(p)) return p;
+  const ext = path11.extname(name);
   const stem2 = name.slice(0, name.length - ext.length);
   for (let i = 1; ; i++) {
-    p = path10.join(dir, `${stem2} (${i})${ext}`);
-    if (!fs11.existsSync(p)) return p;
+    p = path11.join(dir, `${stem2} (${i})${ext}`);
+    if (!fs12.existsSync(p)) return p;
   }
 }
 function sha256File(p) {
   const h = crypto7.createHash("sha256");
-  const fd = fs11.openSync(p, "r");
+  const fd = fs12.openSync(p, "r");
   try {
     const buf = Buffer.alloc(1 << 20);
     let n;
-    while ((n = fs11.readSync(fd, buf, 0, buf.length, null)) > 0) h.update(buf.subarray(0, n));
+    while ((n = fs12.readSync(fd, buf, 0, buf.length, null)) > 0) h.update(buf.subarray(0, n));
   } finally {
-    fs11.closeSync(fd);
+    fs12.closeSync(fd);
   }
   return h.digest("hex");
 }
 function makeOffer(filePath, groupId) {
-  const st = fs11.statSync(filePath);
+  const st = fs12.statSync(filePath);
   if (!st.isFile()) throw new Error(`Not a file: ${filePath}`);
   return {
     fileId: newId(),
-    name: safeFileName(path10.basename(filePath)),
+    name: safeFileName(path11.basename(filePath)),
     size: st.size,
     sha256: sha256File(filePath),
     chunkSize: CHUNK_SIZE,
@@ -7867,7 +8058,7 @@ function makeOffer(filePath, groupId) {
 function readChunk(fd, offer, index) {
   const len = Math.min(offer.chunkSize, offer.size - index * offer.chunkSize);
   const buf = Buffer.alloc(Math.max(0, len));
-  if (len > 0) fs11.readSync(fd, buf, 0, len, index * offer.chunkSize);
+  if (len > 0) fs12.readSync(fd, buf, 0, len, index * offer.chunkSize);
   return buf.toString("base64");
 }
 var CHUNK_SIZE, FILE_WINDOW, IDLE_MS, MAX_PER_SENDER, MAX_TOTAL, MAX_TOTAL_BYTES, WIN_RESERVED2, FileReceiver;
@@ -7910,8 +8101,8 @@ var init_files = __esm({
       }
       begin(offer, from, fromName) {
         const dir = filesDir(".incoming");
-        const part = path10.join(dir, `${offer.fileId}.part`);
-        const fd = fs11.openSync(part, "w", 384);
+        const part = path11.join(dir, `${offer.fileId}.part`);
+        const fd = fs12.openSync(part, "w", 384);
         this.incoming.set(offer.fileId, { ...offer, name: safeFileName(offer.name), from, fromName, part, fd, received: /* @__PURE__ */ new Set(), bytes: 0, lastAt: Date.now() });
       }
       /** Write one chunk. `complete` = every chunk is on disk (call finalize() after acking). */
@@ -7926,7 +8117,7 @@ var init_files = __esm({
         const data = Buffer.from(body.data, "base64");
         const expected = Math.min(t.chunkSize, t.size - index * t.chunkSize);
         if (data.length !== Math.max(0, expected)) return { error: "chunk size mismatch" };
-        if (data.length) fs11.writeSync(t.fd, data, 0, data.length, index * t.chunkSize);
+        if (data.length) fs12.writeSync(t.fd, data, 0, data.length, index * t.chunkSize);
         t.received.add(index);
         t.bytes += data.length;
         t.lastAt = Date.now();
@@ -7937,7 +8128,7 @@ var init_files = __esm({
         const t = this.incoming.get(fileId);
         if (!t) return { error: "unknown transfer" };
         try {
-          fs11.closeSync(t.fd);
+          fs12.closeSync(t.fd);
         } catch {
         }
         this.incoming.delete(t.fileId);
@@ -7947,26 +8138,26 @@ var init_files = __esm({
           const actual = sha256File(t.part);
           if (actual !== t.sha256) {
             try {
-              fs11.unlinkSync(t.part);
+              fs12.unlinkSync(t.part);
             } catch {
             }
             return { error: "hash mismatch" };
           }
           const dir = t.groupId ? filesDir("groups", t.groupId) : filesDir(compactAddress(t.from));
           const dest = uniquePath2(dir, t.name);
-          const root = path10.resolve(filesRoot()) + path10.sep;
-          if (!path10.resolve(dest).startsWith(root)) {
+          const root = path11.resolve(filesRoot()) + path11.sep;
+          if (!path11.resolve(dest).startsWith(root)) {
             try {
-              fs11.unlinkSync(t.part);
+              fs12.unlinkSync(t.part);
             } catch {
             }
             return { error: "invalid destination" };
           }
-          fs11.renameSync(t.part, dest);
-          return { done: { fileId: t.fileId, from: t.from, fromName: t.fromName, name: path10.basename(dest), size: t.size, sha256: actual, path: dest, groupId: t.groupId } };
+          fs12.renameSync(t.part, dest);
+          return { done: { fileId: t.fileId, from: t.from, fromName: t.fromName, name: path11.basename(dest), size: t.size, sha256: actual, path: dest, groupId: t.groupId } };
         } catch (e) {
           try {
-            fs11.unlinkSync(t.part);
+            fs12.unlinkSync(t.part);
           } catch {
           }
           return { error: `could not save file: ${e?.code || e?.message}` };
@@ -7976,11 +8167,11 @@ var init_files = __esm({
         const t = this.incoming.get(fileId);
         if (!t) return;
         try {
-          fs11.closeSync(t.fd);
+          fs12.closeSync(t.fd);
         } catch {
         }
         try {
-          fs11.unlinkSync(t.part);
+          fs12.unlinkSync(t.part);
         } catch {
         }
         this.incoming.delete(fileId);
@@ -8264,10 +8455,9 @@ var init_relay_client = __esm({
               reject(new Error("closed before auth"));
               return;
             }
-            if (this.ws === ws) {
-              this.ws = null;
-              this.transport = null;
-            }
+            if (this.ws !== ws) return;
+            this.ws = null;
+            this.transport = null;
             for (const [, cb] of this.waiting) cb({ type: "error", error: "connection closed" });
             this.waiting.clear();
             this.emit("disconnected");
@@ -8602,6 +8792,8 @@ async function resolveAll(query) {
   }
   const tag = q.startsWith("@") || /~[a-z2-7]{4,20}$/i.test(q) ? parseHandleTag(q) : null;
   if (tag) {
+    const known = Object.values(loadContacts()).filter((c) => c.policy !== "blocked" && cardMatchesTag({ ...c.card || {}, name: c.card?.name || c.name, address: c.address }, tag));
+    if (known.length === 1) return [{ address: known[0].address, card: checked(known[0].card, known[0].address), source: "contacts" }];
     const res = await liveSearch({ handle: tag.suffix ? `${tag.handle}~${tag.suffix}` : tag.handle, limit: 20 });
     return res.filter((r) => r.card && cardMatchesTag(r.card, tag)).map((r) => ({ ...r, source: "handle" }));
   }
@@ -8712,7 +8904,7 @@ var init_netpolicy = __esm({
 
 // ../../cli/agentnet/node.ts
 import { EventEmitter as EventEmitter2 } from "node:events";
-import fs12 from "node:fs";
+import fs13 from "node:fs";
 async function pool(items, n, fn) {
   const out = new Array(items.length);
   let i = 0;
@@ -9174,7 +9366,7 @@ var init_node = __esm({
         if (!a) return { ...base, result: "no_answer", reason: "recipient did not answer the offer (is its node running?)" };
         if (!a.body?.accepted) return { ...base, result: "rejected", reason: a.body?.reason };
         const ack = this.waitFor((r) => r.type === "file_ack" && r.from === to2 && r.body?.fileId === offer.fileId, 12e4);
-        const fd = fs12.openSync(filePath, "r");
+        const fd = fs13.openSync(filePath, "r");
         let failed = null;
         let sent = 0;
         try {
@@ -9194,7 +9386,7 @@ var init_node = __esm({
             failed = `chunk ${i} not delivered`;
           });
         } finally {
-          fs12.closeSync(fd);
+          fs13.closeSync(fd);
         }
         if (failed) {
           ack.cancel();
@@ -9363,9 +9555,11 @@ var init_node = __esm({
         const targets = [...new Set(outboxList().map((i) => i.to))].filter((t) => !this.watchedTargets.has(t));
         if (!targets.length) return;
         for (const t of targets) this.watchedTargets.add(t);
-        await this.watch(targets).catch(() => {
+        const states = await this.watch(targets).catch(() => {
           for (const t of targets) this.watchedTargets.delete(t);
+          return {};
         });
+        for (const [addr, st] of Object.entries(states)) if (st === "online" && this.opts.recv) void this.flushOutboxFor(addr);
       }
       expired(i) {
         return nowSec() - i.createdAt > this.cfg.outboxMaxAgeDays * 86400;
@@ -10874,8 +11068,8 @@ __export(mcp_exports, {
   createAgentNetMcpHandler: () => createAgentNetMcpHandler,
   startAgentNetMcp: () => startAgentNetMcp
 });
-import fs13 from "node:fs";
-import path11 from "node:path";
+import fs14 from "node:fs";
+import path12 from "node:path";
 function text(o, isError = false) {
   return { content: [{ type: "text", text: typeof o === "string" ? o : JSON.stringify(o, null, 2) }], structuredContent: typeof o === "object" ? o : void 0, isError };
 }
@@ -10897,16 +11091,16 @@ async function resolveTarget(t) {
   const direct = normalizeAddress(t);
   if (direct && t.replace(/^srift:/i, "").replace(/-/g, "").length === 20) return direct;
   const r = await resolveAll(t);
-  if (r.length > 1) throw new Error(`"${t}" is ambiguous (${r.length} online agents): ${r.map((x) => "@" + (x.tag || x.address)).join(", ")}. Use the full @name~xxxxxx tag.`);
+  if (r.length > 1) throw new Error(`"${t}" is ambiguous (${r.length} online agents): ${r.map((x) => "@" + (x.tag || x.address)).join(", ")}. Use the full @name~xxxxxxxx tag.`);
   if (!r.length) throw new Error(`Could not resolve "${t}" (it must be online, or use an invite/address). Try srift_an_search.`);
   return r[0].address;
 }
 function allowedFile(p) {
-  const abs = path11.resolve(p);
-  const roots = (process.env.SRIFT_AN_FILE_ROOTS || process.cwd()).split(path11.delimiter).filter(Boolean).map((r) => path11.resolve(r));
-  const inside = roots.some((r) => abs === r || abs.startsWith(r.endsWith(path11.sep) ? r : r + path11.sep));
+  const abs = path12.resolve(p);
+  const roots = (process.env.SRIFT_AN_FILE_ROOTS || process.cwd()).split(path12.delimiter).filter(Boolean).map((r) => path12.resolve(r));
+  const inside = roots.some((r) => abs === r || abs.startsWith(r.endsWith(path12.sep) ? r : r + path12.sep));
   if (!inside) throw new Error(`Refusing to send ${abs}: only files under ${roots.join(", ")} can be sent through MCP (set SRIFT_AN_FILE_ROOTS to allow more).`);
-  const rel = path11.relative(roots.find((r) => abs.startsWith(r)) || roots[0], abs);
+  const rel = path12.relative(roots.find((r) => abs.startsWith(r)) || roots[0], abs);
   if (rel.split(/[\\/]/).some((seg) => seg.startsWith("."))) throw new Error(`Refusing to send hidden files or folders (${rel}) through MCP.`);
   return abs;
 }
@@ -11243,13 +11437,13 @@ async function startAgentNetMcp(opts = {}) {
   hooks.onDiscovery = h.onDiscovery;
   let lastSize = 0;
   try {
-    lastSize = fs13.statSync(inboxPath()).size;
+    lastSize = fs14.statSync(inboxPath()).size;
   } catch {
   }
   setInterval(() => {
     if (ownsLock) return;
     try {
-      const s = fs13.statSync(inboxPath()).size;
+      const s = fs14.statSync(inboxPath()).size;
       if (s !== lastSize) {
         lastSize = s;
         hooks.onInbox();
@@ -11311,7 +11505,7 @@ var init_mcp2 = __esm({
     LEGACY_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
     INBOX_URI = "srift://agentnet/inbox";
     DISCOVERIES_URI = "srift://agentnet/discoveries";
-    to = { type: "string", description: "Target: srift: address, @name~xxxxxx tag, @name, @owner/agent, contact name, name@domain, domain, or invite link" };
+    to = { type: "string", description: "Target: srift: address, @name~xxxxxxxx tag, @name, @owner/agent, contact name, name@domain, domain, or invite link" };
     obj = (properties, required = []) => ({ type: "object", properties, required, additionalProperties: false });
     AGENTNET_TOOLS = [
       { name: "srift_an_whoami", description: "This agent's permanent address (its 'phone number'), unique @tag, one-line description, discoverability and relays.", inputSchema: obj({}) },
@@ -11334,7 +11528,7 @@ var init_mcp2 = __esm({
       },
       {
         name: "srift_an_find",
-        description: "Resolve a specific agent: srift: address, @name~xxxxxx, @name, @owner/agent, owner:@owner (all their agents), name@domain, domain, or invite link. Falls back to live search.",
+        description: "Resolve a specific agent: srift: address, @name~xxxxxxxx, @name, @owner/agent, owner:@owner (all their agents), name@domain, domain, or invite link. Falls back to live search.",
         inputSchema: obj({ query: { type: "string" }, limit: { type: "number" } }, ["query"])
       },
       {
@@ -11436,8 +11630,8 @@ __export(cli_exports, {
   inboxPath: () => inboxPath,
   run: () => run
 });
-import fs14 from "node:fs";
-import path12 from "node:path";
+import fs15 from "node:fs";
+import path13 from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 import readline from "node:readline";
 function flag(args, name) {
@@ -11577,12 +11771,12 @@ ${r.map((x) => `  @${x.tag || (x.card ? handleTag(x.card) : x.address)}  ${x.one
       if (action === "export") {
         const file2 = pos[2] || fail("Usage: srift an id export <file>");
         const { identity: identity2 } = ensureIdentity();
-        fs14.writeFileSync(file2, JSON.stringify(identity2, null, 2), { mode: 384 });
+        fs15.writeFileSync(file2, JSON.stringify(identity2, null, 2), { mode: 384 });
         return out(`Exported identity (PRIVATE KEYS) to ${file2}. Keep it secret.`, { exported: file2, address: identity2.address });
       }
       if (action === "import") {
         const file2 = pos[2] || fail("Usage: srift an id import <file>");
-        const idt = JSON.parse(fs14.readFileSync(file2, "utf8"));
+        const idt = JSON.parse(fs15.readFileSync(file2, "utf8"));
         if (addressFromEdPub(idt.edPub) !== idt.address || !idt.edPriv || !idt.xPriv) fail("Not a valid AgentNet identity file.");
         if (hasIdentity() && !has(args, "--force")) fail("An identity already exists. Re-run with --force to replace it.");
         saveIdentity(idt);
@@ -11698,12 +11892,12 @@ Home:         ${anDir()}`,
     case "up": {
       if (has(args, "--detach")) {
         const childArgs = [...process.execArgv, process.argv[1], ...process.argv.slice(2).filter((a) => a !== "--detach")];
-        fs14.mkdirSync(anDir(), { recursive: true });
+        fs15.mkdirSync(anDir(), { recursive: true });
         rotateLog();
-        const logFd = fs14.openSync(path12.join(anDir(), "node.log"), "a");
+        const logFd = fs15.openSync(path13.join(anDir(), "node.log"), "a");
         const child = spawn3(process.execPath, childArgs, { detached: true, stdio: ["ignore", logFd, logFd], windowsHide: true });
         child.unref();
-        return out(`AgentNet node started in background (pid ${child.pid}). Log: ${path12.join(anDir(), "node.log")}`, { pid: child.pid });
+        return out(`AgentNet node started in background (pid ${child.pid}). Log: ${path13.join(anDir(), "node.log")}`, { pid: child.pid });
       }
       const { identity } = ensureIdentity();
       if (sub === "host" || has(args, "--discoverable")) {
@@ -11903,13 +12097,13 @@ Home:         ${anDir()}`,
         }
         try {
           if (t.startsWith("/file ")) {
-            const fp = path12.resolve(t.slice(6).trim().replace(/^"|"$/g, ""));
+            const fp = path13.resolve(t.slice(6).trim().replace(/^"|"$/g, ""));
             if (g) {
               const r = await n.groupSendFile(g.state.id, fp);
-              console.log(`  \u{1F4CE} ${path12.basename(fp)}: ${r.results.filter((x) => x.result === "delivered").length}/${r.results.length} members received it`);
+              console.log(`  \u{1F4CE} ${path13.basename(fp)}: ${r.results.filter((x) => x.result === "delivered").length}/${r.results.length} members received it`);
             } else {
               const r = await n.sendFile(peer, fp);
-              console.log(`  \u{1F4CE} ${path12.basename(fp)}: ${r.result}${r.reason ? ` \u2014 ${r.reason}` : ""}`);
+              console.log(`  \u{1F4CE} ${path13.basename(fp)}: ${r.result}${r.reason ? ` \u2014 ${r.reason}` : ""}`);
             }
           } else if (g) {
             const r = await n.groupSend(g.state.id, t);
@@ -11940,8 +12134,8 @@ Home:         ${anDir()}`,
     case "file": {
       const a = await target(pos[1]);
       const fp = pos[2] || fail("Usage: srift an file <to> <path>");
-      const r = await withNode(true, (n) => n.sendFile(a, path12.resolve(fp), { onProgress: (p) => {
-        if (!json) process.stderr.write(`\r[agentnet] sending ${path12.basename(fp)} ${Math.round(p * 100)}%`);
+      const r = await withNode(true, (n) => n.sendFile(a, path13.resolve(fp), { onProgress: (p) => {
+        if (!json) process.stderr.write(`\r[agentnet] sending ${path13.basename(fp)} ${Math.round(p * 100)}%`);
       } }));
       if (!json) process.stderr.write("\n");
       out(r.result === "delivered" ? `Delivered ${r.name} (${r.size} bytes) to ${a} in ${((r.ms || 0) / 1e3).toFixed(1)}s \u2014 SHA-256 verified by the receiver.` : `Not delivered: ${r.result}${r.reason ? ` \u2014 ${r.reason}` : ""}`, r);
@@ -12023,9 +12217,9 @@ Chat: srift an chat ${r.group.id}`, r);
       if (action === "file") {
         const id = gid(pos[2]);
         const fp = pos[3] || fail("Usage: srift an group file <group> <path>");
-        const r = await withNode(true, (n) => n.groupSendFile(id, path12.resolve(fp)));
+        const r = await withNode(true, (n) => n.groupSendFile(id, path13.resolve(fp)));
         const ok = r.results.filter((x) => x.result === "delivered").length;
-        return out(`${path12.basename(fp)} delivered to ${ok}/${r.results.length} members (SHA-256 verified).
+        return out(`${path13.basename(fp)} delivered to ${ok}/${r.results.length} members (SHA-256 verified).
 ${r.results.map((x) => `  ${x.to}: ${x.result}${x.reason ? ` \u2014 ${x.reason}` : ""}`).join("\n")}`, r);
       }
       if (action === "call") {
@@ -12071,8 +12265,8 @@ ${r.results.map((x) => `  ${x.to}: ${x.result}${x.reason ? ` \u2014 ${x.reason}`
       if (file2 && !has(args, "--link")) {
         const res = await withNode(true, async (n) => {
           const m = textArg ? await n.send(a, "msg", body) : null;
-          const f = await n.sendFile(a, path12.resolve(file2), { onProgress: (p) => {
-            if (!json) process.stderr.write(`\r[agentnet] sending ${path12.basename(file2)} ${Math.round(p * 100)}%`);
+          const f = await n.sendFile(a, path13.resolve(file2), { onProgress: (p) => {
+            if (!json) process.stderr.write(`\r[agentnet] sending ${path13.basename(file2)} ${Math.round(p * 100)}%`);
           } });
           return { message: m, file: f };
         });
@@ -12084,9 +12278,9 @@ ${r.results.map((x) => `  ${x.to}: ${x.result}${x.reason ? ` \u2014 ${x.reason}`
       if (file2) {
         if (!helpers.callDaemon) fail("File attachments need the SRIFT daemon.");
         await helpers.ensureDaemon?.();
-        const share = await helpers.callDaemon("/quick-share", "POST", { filePath: path12.resolve(file2), encrypt: true });
+        const share = await helpers.callDaemon("/quick-share", "POST", { filePath: path13.resolve(file2), encrypt: true });
         if (!share?.downloadUrl) fail(`quick-share failed: ${share?.error || "unknown error"}`);
-        body.attachments = [{ name: path12.basename(file2), url: share.downloadUrl, size: share.size }];
+        body.attachments = [{ name: path13.basename(file2), url: share.downloadUrl, size: share.size }];
       }
       const queue = has(args, "--queue");
       const r = await withNode(false, (n) => n.send(a, "msg", body, { queue }));
@@ -12412,7 +12606,7 @@ Hooks fire from the running node ('srift an up' / 'host' / 'mcp').`, { hooks: ma
         sessions,
         quickShare: helpers.callDaemon ? async (filePath) => {
           await helpers.ensureDaemon?.();
-          const r = await helpers.callDaemon("/quick-share", "POST", { filePath: path12.resolve(filePath), encrypt: true });
+          const r = await helpers.callDaemon("/quick-share", "POST", { filePath: path13.resolve(filePath), encrypt: true });
           if (!r?.downloadUrl) throw new Error(r?.error || "quick-share failed");
           return { url: r.downloadUrl };
         } : void 0
@@ -12441,7 +12635,7 @@ No database anywhere: relays keep only what is live (RAM) and route only to ONLI
 
 Identity (your "phone number")
   srift an id [--name N] [--description D] [--skills a,b]   show/create your address + handle tag
-  srift an id handle @name              set a handle; your tag is name~xxxxxx (key-derived, unforgeable)
+  srift an id handle @name              set a handle; your tag is name~xxxxxxxx (key-derived, unforgeable)
   srift an id owner <srift-own:token> | --clear      accept an owner's signed claim
   srift an id link-domain acme.com [--name support]  print /.well-known/srift for your domain
   srift an id export <file> | import <file> | rotate
@@ -12453,7 +12647,7 @@ Be found (live)
   srift an up [--discoverable] [--poll] [--detach]   go online;  srift an down
 Find & reach others
   srift an search "what you need" [--watch] [--limit 10]   live search; --watch notifies as matches come online
-  srift an find <srift:addr|@name|@name~xxxxxx|@owner/agent|owner:@owner|name@domain|domain|invite|"need">
+  srift an find <srift:addr|@name|@name~xxxxxxxx|@owner/agent|owner:@owner|name@domain|domain|invite|"need">
   srift an knock <to> "hey, it's me \u2014 \u2026" [--wait 60]    ask to connect; they accept/reject with a note
   srift an connect "what you need" [--max 5] [--wait 30] [--note "\u2026"] [--message "\u2026" | --no-message]
                                         search \u2192 knock best matches \u2192 first accept \u2192 conversation starts
@@ -12522,8 +12716,8 @@ Add --json to any command for machine-readable output.`;
 import { spawn as spawn4, execSync } from "child_process";
 import http7 from "http";
 import https3 from "https";
-import fs15 from "fs";
-import path13 from "path";
+import fs16 from "fs";
+import path14 from "path";
 import os8 from "os";
 import crypto8 from "crypto";
 import net4 from "net";
@@ -12535,8 +12729,8 @@ init_history();
 init_embedded();
 import http5 from "http";
 import https2 from "https";
-import fs8 from "fs";
-import path7 from "path";
+import fs9 from "fs";
+import path8 from "path";
 import os5 from "os";
 import { fileURLToPath } from "url";
 var DAEMON_PORT2 = parseInt(process.env.SRIFT_DAEMON_PORT || "3822", 10);
@@ -12602,7 +12796,7 @@ async function handleSessionStart(name, roomSecret, isJson) {
     } else {
       console.log(`[SRIFT] Session created successfully!`);
       console.log(`Session ID:   ${res.sessionId}`);
-      console.log(`Access Link:  https://srift.app/join-session?id=${res.sessionId}`);
+      console.log(`Access Link:  ${res.joinUrl || `https://srift.app/join-session?id=${res.sessionId}`}`);
       if (roomSecret) {
         console.log(`Room Secret:  ${roomSecret} (derived locally, never sent to server)`);
       }
@@ -12649,6 +12843,14 @@ Pending Join Requests (${res.pendingJoins.length}):`);
           console.log(`  - ${j.username} (${j.tempUserId}) [Run 'srift approve ${j.tempUserId}' to let them in]`);
         });
       }
+      if (res.participants && res.participants.length > 0) {
+        console.log(`
+Members (${res.participants.length}):`);
+        res.participants.forEach((p) => {
+          const kick = s.role === "host" && !p.isHost ? ` [remove: 'srift kick ${p.userId}']` : "";
+          console.log(`  - ${p.username}${p.isHost ? " (host)" : ""} ${p.online ? "online" : "offline"} (${p.userId})${kick}`);
+        });
+      }
     }
   } catch (err) {
     console.error(`Error: ${err.message}`);
@@ -13023,8 +13225,25 @@ async function handlePubshareAdd(filePath, isJson, opts = {}) {
     process.exit(1);
   }
 }
-function handleMonitorTransfer(fileId, jsonStream) {
+var TERMINAL_STATUSES = ["completed", "error", "cancelled"];
+async function handleMonitorTransfer(fileId, jsonStream) {
   const url = `${DAEMON_URL2}/api/v1/monitor/events`;
+  try {
+    const tx = ((await callDaemon2("/status", "GET")).activeTransfers || []).find((t) => t.fileId === fileId);
+    if (!tx) {
+      console.error(`[SRIFT] No transfer with id ${fileId}. See: srift list`);
+      process.exit(1);
+    }
+    if (jsonStream) console.log(JSON.stringify({ fileId, fileName: tx.name, size: tx.size, progress: tx.progress, status: tx.status }));
+    else renderProgressBar(tx.progress || 0, tx.speedKBps || 0, tx.etaSeconds || 0, tx.status);
+    if (TERMINAL_STATUSES.includes(tx.status)) {
+      if (!jsonStream) console.log("\nTransfer reached terminal state:", tx.status);
+      process.exit(0);
+    }
+  } catch (err) {
+    console.error(`[SRIFT] Monitor error: ${err.message}`);
+    process.exit(1);
+  }
   const req = http5.request(url, (res) => {
     res.on("data", (chunk) => {
       const lines = chunk.toString().split("\n");
@@ -13038,6 +13257,7 @@ function handleMonitorTransfer(fileId, jsonStream) {
             if (currentEvent === "transfer_progress" && dataJson.fileId === fileId) {
               if (jsonStream) {
                 console.log(JSON.stringify(dataJson));
+                if (TERMINAL_STATUSES.includes(dataJson.status)) process.exit(0);
               } else {
                 renderProgressBar(
                   dataJson.progress,
@@ -13045,7 +13265,7 @@ function handleMonitorTransfer(fileId, jsonStream) {
                   dataJson.timeRemainingSeconds,
                   dataJson.status
                 );
-                if (dataJson.status === "completed" || dataJson.status === "error" || dataJson.status === "cancelled") {
+                if (TERMINAL_STATUSES.includes(dataJson.status)) {
                   console.log("\nTransfer reached terminal state:", dataJson.status);
                   process.exit(0);
                 }
@@ -13137,16 +13357,16 @@ async function handleAutoInstallMcp(isJson) {
   try {
     let configPath = "";
     if (process.platform === "win32") {
-      configPath = path7.join(process.env.APPDATA || path7.join(os5.homedir(), "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+      configPath = path8.join(process.env.APPDATA || path8.join(os5.homedir(), "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
     } else if (process.platform === "darwin") {
-      configPath = path7.join(os5.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+      configPath = path8.join(os5.homedir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
     } else {
-      configPath = path7.join(os5.homedir(), ".config", "Claude", "claude_desktop_config.json");
+      configPath = path8.join(os5.homedir(), ".config", "Claude", "claude_desktop_config.json");
     }
     let config = { mcpServers: {} };
-    if (fs8.existsSync(configPath)) {
+    if (fs9.existsSync(configPath)) {
       try {
-        config = JSON.parse(fs8.readFileSync(configPath, "utf8"));
+        config = JSON.parse(fs9.readFileSync(configPath, "utf8"));
       } catch (err) {
         throw new Error(`Failed to parse Claude Desktop config at ${configPath}: ${err.message}`);
       }
@@ -13155,7 +13375,7 @@ async function handleAutoInstallMcp(isJson) {
       config.mcpServers = {};
     }
     const execPath = process.execPath || "";
-    const execBase = path7.basename(execPath).toLowerCase();
+    const execBase = path8.basename(execPath).toLowerCase();
     const isCompiledBinary = execBase === "srift" || execBase === "srift.exe" || typeof process.isBun === "boolean" && process.isBun || process.versions && process.versions.bun !== void 0;
     let command = "";
     let mcpArgs = [];
@@ -13165,16 +13385,16 @@ async function handleAutoInstallMcp(isJson) {
     } else {
       command = "node";
       const __filename2 = fileURLToPath(import.meta.url);
-      const __dirname2 = path7.dirname(__filename2);
-      const scriptPath = path7.resolve(__dirname2, "index.ts").replace(/\\/g, "/");
+      const __dirname2 = path8.dirname(__filename2);
+      const scriptPath = path8.resolve(__dirname2, "index.ts").replace(/\\/g, "/");
       mcpArgs = ["--experimental-strip-types", scriptPath, "mcp"];
     }
     config.mcpServers.srift = {
       command,
       args: mcpArgs
     };
-    fs8.mkdirSync(path7.dirname(configPath), { recursive: true });
-    fs8.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf8");
+    fs9.mkdirSync(path8.dirname(configPath), { recursive: true });
+    fs9.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf8");
     if (isJson) {
       console.log(JSON.stringify({ success: true, configPath }));
     } else {
@@ -13192,13 +13412,13 @@ IMPORTANT: Please restart Claude Desktop for the changes to take effect.`);
 }
 async function handleBootstrap(targetDirArg, opts = {}) {
   try {
-    const targetDir = targetDirArg ? path7.resolve(targetDirArg) : process.cwd();
+    const targetDir = targetDirArg ? path8.resolve(targetDirArg) : process.cwd();
     const createCursorrules = opts.cursorrules || !opts.cursorrules && !opts.agents;
     const createAgents = opts.agents || !opts.cursorrules && !opts.agents;
     console.log(`[SRIFT] Bootstrapping AI Agent instructions in: ${targetDir}`);
-    fs8.mkdirSync(targetDir, { recursive: true });
+    fs9.mkdirSync(targetDir, { recursive: true });
     if (createCursorrules) {
-      const cursorrulesPath = path7.join(targetDir, ".cursorrules");
+      const cursorrulesPath = path8.join(targetDir, ".cursorrules");
       console.log(`  Writing .cursorrules...`);
       let content = DEFAULT_CURSORRULES;
       try {
@@ -13206,11 +13426,11 @@ async function handleBootstrap(targetDirArg, opts = {}) {
       } catch (err) {
         console.log(`  (Note: failed to fetch latest .cursorrules online: ${err.message}. Using offline template.)`);
       }
-      fs8.writeFileSync(cursorrulesPath, content, "utf8");
+      fs9.writeFileSync(cursorrulesPath, content, "utf8");
       console.log(`  \u2705 .cursorrules written to ${cursorrulesPath}`);
     }
     if (createAgents) {
-      const agentsPath = path7.join(targetDir, "AGENTS.md");
+      const agentsPath = path8.join(targetDir, "AGENTS.md");
       console.log(`  Writing AGENTS.md...`);
       let content = DEFAULT_AGENTS_MD;
       try {
@@ -13218,7 +13438,7 @@ async function handleBootstrap(targetDirArg, opts = {}) {
       } catch (err) {
         console.log(`  (Note: failed to fetch latest AGENTS.md online: ${err.message}. Using offline template.)`);
       }
-      fs8.writeFileSync(agentsPath, content, "utf8");
+      fs9.writeFileSync(agentsPath, content, "utf8");
       console.log(`  \u2705 AGENTS.md written to ${agentsPath}`);
     }
     console.log(`
@@ -13290,10 +13510,10 @@ init_get();
 init_pack();
 init_history();
 var __filename = fileURLToPath2(import.meta.url);
-var __dirname = path13.dirname(__filename);
+var __dirname = path14.dirname(__filename);
 var DAEMON_PORT3 = parseInt(process.env.SRIFT_DAEMON_PORT || "3822", 10);
 var DAEMON_URL3 = `http://127.0.0.1:${DAEMON_PORT3}`;
-var CLI_VERSION = "4.0.0";
+var CLI_VERSION = "4.1.0";
 function parseDuration(s) {
   if (!s) return 0;
   const m = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/i.exec(s.trim());
@@ -13358,36 +13578,36 @@ function flagValues(args, name) {
   });
   return out;
 }
-var OUTBOX_DIR = path13.join(os8.homedir(), ".srift", "outbox");
+var OUTBOX_DIR = path14.join(os8.homedir(), ".srift", "outbox");
 function outboxPath(name) {
-  fs15.mkdirSync(OUTBOX_DIR, { recursive: true, mode: 448 });
+  fs16.mkdirSync(OUTBOX_DIR, { recursive: true, mode: 448 });
   try {
     const cutoff = Date.now() - 30 * 864e5;
-    for (const f of fs15.readdirSync(OUTBOX_DIR)) {
-      const p = path13.join(OUTBOX_DIR, f);
+    for (const f of fs16.readdirSync(OUTBOX_DIR)) {
+      const p = path14.join(OUTBOX_DIR, f);
       try {
-        if (fs15.statSync(p).mtimeMs < cutoff) fs15.rmSync(p, { recursive: true, force: true });
+        if (fs16.statSync(p).mtimeMs < cutoff) fs16.rmSync(p, { recursive: true, force: true });
       } catch {
       }
     }
   } catch {
   }
-  const dir = path13.join(OUTBOX_DIR, `${Date.now()}-${crypto8.randomBytes(4).toString("hex")}`);
-  fs15.mkdirSync(dir, { recursive: true, mode: 448 });
-  return path13.join(dir, name);
+  const dir = path14.join(OUTBOX_DIR, `${Date.now()}-${crypto8.randomBytes(4).toString("hex")}`);
+  fs16.mkdirSync(dir, { recursive: true, mode: 448 });
+  return path14.join(dir, name);
 }
 async function stdinToFile(dest) {
   if (process.stdin.isTTY) throw new Error("Nothing on stdin. Pipe data in, e.g.:  tar cz dir | srift quick-share - --filename dir.tgz");
-  await pipeline2(process.stdin, fs15.createWriteStream(dest, { mode: 384 }));
-  return fs15.statSync(dest).size;
+  await pipeline2(process.stdin, fs16.createWriteStream(dest, { mode: 384 }));
+  return fs16.statSync(dest).size;
 }
 var SRIFT_BASE_DL_URL = "https://srift.app/dl";
-var CONFIG_DIR = path13.join(os8.homedir(), ".srift");
-var CONFIG_FILE = path13.join(CONFIG_DIR, "config.json");
+var CONFIG_DIR = path14.join(os8.homedir(), ".srift");
+var CONFIG_FILE = path14.join(CONFIG_DIR, "config.json");
 function readConfig() {
   try {
-    if (fs15.existsSync(CONFIG_FILE)) {
-      return JSON.parse(fs15.readFileSync(CONFIG_FILE, "utf8"));
+    if (fs16.existsSync(CONFIG_FILE)) {
+      return JSON.parse(fs16.readFileSync(CONFIG_FILE, "utf8"));
     }
   } catch {
   }
@@ -13395,8 +13615,8 @@ function readConfig() {
 }
 function writeConfig(config) {
   try {
-    fs15.mkdirSync(CONFIG_DIR, { recursive: true });
-    fs15.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2) + "\n");
+    fs16.mkdirSync(CONFIG_DIR, { recursive: true });
+    fs16.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2) + "\n");
   } catch {
   }
 }
@@ -13507,9 +13727,9 @@ async function handleVersion(isJson) {
 }
 async function handleSelfUpdate(isJson) {
   const isBinary = !__filename.endsWith(".ts") && !__filename.endsWith(".js");
-  const installDir = path13.join(os8.homedir(), ".srift", "bin");
+  const installDir = path14.join(os8.homedir(), ".srift", "bin");
   const binName = process.platform === "win32" ? "srift.exe" : "srift";
-  const binPath = path13.join(installDir, binName);
+  const binPath = path14.join(installDir, binName);
   console.log(`[srift] Checking for updates...`);
   let data;
   try {
@@ -13567,15 +13787,15 @@ async function handleSelfUpdate(isJson) {
   const tmpPath = binPath + ".new";
   const stampPath = binPath + ".new.stamp";
   try {
-    if (fs15.existsSync(stampPath)) {
-      const prevUrl = fs15.readFileSync(stampPath, "utf8").trim();
-      if (prevUrl !== binaryUrl && fs15.existsSync(tmpPath)) {
-        fs15.unlinkSync(tmpPath);
+    if (fs16.existsSync(stampPath)) {
+      const prevUrl = fs16.readFileSync(stampPath, "utf8").trim();
+      if (prevUrl !== binaryUrl && fs16.existsSync(tmpPath)) {
+        fs16.unlinkSync(tmpPath);
       }
-    } else if (fs15.existsSync(tmpPath)) {
-      fs15.unlinkSync(tmpPath);
+    } else if (fs16.existsSync(tmpPath)) {
+      fs16.unlinkSync(tmpPath);
     }
-    fs15.writeFileSync(stampPath, binaryUrl);
+    fs16.writeFileSync(stampPath, binaryUrl);
   } catch {
   }
   console.log(`[srift] Downloading ${binaryUrl} ...`);
@@ -13587,7 +13807,7 @@ async function handleSelfUpdate(isJson) {
     process.exit(1);
   } finally {
     try {
-      if (fs15.existsSync(stampPath)) fs15.unlinkSync(stampPath);
+      if (fs16.existsSync(stampPath)) fs16.unlinkSync(stampPath);
     } catch {
     }
   }
@@ -13597,10 +13817,10 @@ async function handleSelfUpdate(isJson) {
     const line = lines.find((l) => l.trim().endsWith(binName));
     if (line) {
       const expected = line.trim().split(/\s+/)[0].toLowerCase();
-      const actual = crypto8.createHash("sha256").update(fs15.readFileSync(tmpPath)).digest("hex");
+      const actual = crypto8.createHash("sha256").update(fs16.readFileSync(tmpPath)).digest("hex");
       if (actual !== expected) {
         try {
-          fs15.unlinkSync(tmpPath);
+          fs16.unlinkSync(tmpPath);
         } catch {
         }
         console.error(`[srift] Checksum mismatch! Aborting update.`);
@@ -13617,23 +13837,23 @@ async function handleSelfUpdate(isJson) {
     console.log(`[srift] Could not download checksum (${err?.message || err}). Continuing without verification.`);
   }
   try {
-    fs15.chmodSync(tmpPath, 493);
+    fs16.chmodSync(tmpPath, 493);
   } catch {
   }
   const bakPath = binPath + ".bak";
   try {
-    if (fs15.existsSync(binPath)) {
-      if (fs15.existsSync(bakPath)) fs15.unlinkSync(bakPath);
-      fs15.renameSync(binPath, bakPath);
+    if (fs16.existsSync(binPath)) {
+      if (fs16.existsSync(bakPath)) fs16.unlinkSync(bakPath);
+      fs16.renameSync(binPath, bakPath);
     }
-    fs15.renameSync(tmpPath, binPath);
-    if (fs15.existsSync(bakPath)) {
+    fs16.renameSync(tmpPath, binPath);
+    if (fs16.existsSync(bakPath)) {
       try {
-        fs15.unlinkSync(bakPath);
+        fs16.unlinkSync(bakPath);
       } catch {
       }
     }
-    const others = findAllSriftBinaries().filter((p) => path13.resolve(p) !== path13.resolve(binPath));
+    const others = findAllSriftBinaries().filter((p) => path14.resolve(p) !== path14.resolve(binPath));
     if (others.length) {
       console.log(`[srift] Cleaning ${others.length} stale srift binar${others.length === 1 ? "y" : "ies"} elsewhere on the system...`);
       for (const o of others) {
@@ -13645,7 +13865,7 @@ async function handleSelfUpdate(isJson) {
       purgeSriftFromPath();
       if (process.platform === "win32") {
         try {
-          const installDir2 = path13.dirname(binPath);
+          const installDir2 = path14.dirname(binPath);
           const psCmd = [
             "$p=[System.Environment]::GetEnvironmentVariable('Path','User')",
             "if(-not $p){$p=''}",
@@ -13664,9 +13884,9 @@ async function handleSelfUpdate(isJson) {
       try {
         const winBin = binPath.replace(/\//g, "\\");
         const winTmp = tmpPath.replace(/\//g, "\\");
-        const batPath = path13.join(os8.tmpdir(), `srift-update-${process.pid}-${Date.now()}.bat`);
+        const batPath = path14.join(os8.tmpdir(), `srift-update-${process.pid}-${Date.now()}.bat`);
         const batBody = '@echo off\r\ntimeout /t 2 /nobreak >nul 2>&1\r\n:swap\r\ndel /f /q "' + winBin + '" >nul 2>&1\r\nif exist "' + winBin + '" (\r\n  timeout /t 1 /nobreak >nul 2>&1\r\n  goto :swap\r\n)\r\nmove /y "' + winTmp + '" "' + winBin + '" >nul 2>&1\r\ndel /f /q "%~f0" >nul 2>&1\r\n';
-        fs15.writeFileSync(batPath, batBody, "utf8");
+        fs16.writeFileSync(batPath, batBody, "utf8");
         spawn4("cmd.exe", ["/C", batPath], {
           detached: true,
           stdio: "ignore",
@@ -13712,7 +13932,7 @@ function _downloadAttempt(url, dest, resumeFrom, showProgress, socketIdleMs) {
       let received = resumeFrom;
       let lastPrint = 0;
       let lastDataAt = Date.now();
-      const file2 = fs15.createWriteStream(dest, { flags: resumeFrom > 0 ? "a" : "w" });
+      const file2 = fs16.createWriteStream(dest, { flags: resumeFrom > 0 ? "a" : "w" });
       const stallTimer = setInterval(() => {
         if (Date.now() - lastDataAt > socketIdleMs) {
           clearInterval(stallTimer);
@@ -13754,8 +13974,8 @@ function _downloadAttempt(url, dest, resumeFrom, showProgress, socketIdleMs) {
 }
 function _findCurl() {
   if (process.platform === "win32") {
-    const win = path13.join(process.env.WINDIR || "C:\\Windows", "System32", "curl.exe");
-    if (fs15.existsSync(win)) return win;
+    const win = path14.join(process.env.WINDIR || "C:\\Windows", "System32", "curl.exe");
+    if (fs16.existsSync(win)) return win;
   }
   try {
     const out = execSync(process.platform === "win32" ? "where curl.exe" : "which curl", {
@@ -13764,14 +13984,14 @@ function _findCurl() {
     }).trim().split("\n").map((s) => s.trim()).filter(Boolean);
     for (const p of out) {
       if (/powershell/i.test(p)) continue;
-      if (fs15.existsSync(p)) return p;
+      if (fs16.existsSync(p)) return p;
     }
   } catch {
   }
   return null;
 }
 async function _runCurl(curlPath, url, dest, showProgress) {
-  fs15.mkdirSync(path13.dirname(dest), { recursive: true });
+  fs16.mkdirSync(path14.dirname(dest), { recursive: true });
   const ua = `srift-cli/${CLI_VERSION} (${process.platform}; ${process.arch})`;
   const args = [
     "-fL",
@@ -13808,7 +14028,7 @@ async function _runCurl(curlPath, url, dest, showProgress) {
   });
 }
 async function downloadFile(url, dest) {
-  fs15.mkdirSync(path13.dirname(dest), { recursive: true });
+  fs16.mkdirSync(path14.dirname(dest), { recursive: true });
   const curlPath = _findCurl();
   if (curlPath) {
     console.log(`[srift] Downloading via curl (${curlPath}) \u2014 handles 5xx + connection drops natively.`);
@@ -13819,7 +14039,7 @@ async function downloadFile(url, dest) {
       /*showProgress*/
       true
     );
-    if (ok && fs15.existsSync(dest) && fs15.statSync(dest).size > 1e6) {
+    if (ok && fs16.existsSync(dest) && fs16.statSync(dest).size > 1e6) {
       console.log("");
       return;
     }
@@ -13830,7 +14050,7 @@ async function downloadFile(url, dest) {
   const socketIdleMs = 3e4;
   let lastErr = null;
   for (let attempt2 = 1; attempt2 <= maxAttempts; attempt2++) {
-    const resumeFrom = fs15.existsSync(dest) ? fs15.statSync(dest).size : 0;
+    const resumeFrom = fs16.existsSync(dest) ? fs16.statSync(dest).size : 0;
     try {
       await _downloadAttempt(
         url,
@@ -13843,7 +14063,7 @@ async function downloadFile(url, dest) {
       return;
     } catch (err) {
       lastErr = err;
-      const partial = fs15.existsSync(dest) ? fs15.statSync(dest).size : 0;
+      const partial = fs16.existsSync(dest) ? fs16.statSync(dest).size : 0;
       const partialMb = (partial / 1024 / 1024).toFixed(1);
       if (attempt2 >= maxAttempts) break;
       const wait = Math.min(2e3 * attempt2, 8e3);
@@ -14053,7 +14273,7 @@ async function ensureDaemon() {
   void isMcp;
   logFn("[SRIFT] Starting background transfer daemon...");
   const isBunBinary = !!(process.versions && process.versions.bun) || typeof process.isBun === "boolean" && process.isBun;
-  const execBase = path13.basename(process.execPath || "").toLowerCase();
+  const execBase = path14.basename(process.execPath || "").toLowerCase();
   const isCompiledBinary = isBunBinary || execBase === "srift" || execBase === "srift.exe";
   let execCmd;
   let spawnArgs;
@@ -14063,7 +14283,7 @@ async function ensureDaemon() {
   } else {
     const isJs = __filename.endsWith(".js");
     const daemonFile = isJs ? "daemon.js" : "daemon.ts";
-    const daemonPath = path13.join(__dirname, daemonFile);
+    const daemonPath = path14.join(__dirname, daemonFile);
     execCmd = process.execPath;
     spawnArgs = isJs ? [daemonPath] : ["--experimental-strip-types", daemonPath];
   }
@@ -14319,21 +14539,21 @@ function findAllSriftBinaries() {
   const add = (p) => {
     if (!p) return;
     try {
-      const abs = path13.resolve(p);
-      if (fs15.existsSync(abs) && fs15.statSync(abs).isFile()) found.add(abs);
+      const abs = path14.resolve(p);
+      if (fs16.existsSync(abs) && fs16.statSync(abs).isFile()) found.add(abs);
     } catch {
     }
   };
-  const execBase = path13.basename(process.execPath || "").toLowerCase();
+  const execBase = path14.basename(process.execPath || "").toLowerCase();
   if (execBase === "srift" || execBase === "srift.exe") add(process.execPath);
-  add(path13.join(os8.homedir(), ".srift", "bin", binName));
+  add(path14.join(os8.homedir(), ".srift", "bin", binName));
   try {
     const cmd = process.platform === "win32" ? "where srift" : "which -a srift";
     const out = execSync(cmd, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
     for (const line of out.split("\n").map((s) => s.trim()).filter(Boolean)) add(line);
   } catch {
   }
-  const pathDirs = (process.env.PATH || "").split(path13.delimiter).filter(Boolean);
+  const pathDirs = (process.env.PATH || "").split(path14.delimiter).filter(Boolean);
   if (process.platform === "win32") {
     try {
       const userPath = execSync(
@@ -14346,7 +14566,7 @@ function findAllSriftBinaries() {
     } catch {
     }
   }
-  for (const dir of pathDirs) add(path13.join(dir, binName));
+  for (const dir of pathDirs) add(path14.join(dir, binName));
   return Array.from(found);
 }
 function purgeSriftFromPath() {
@@ -14369,19 +14589,19 @@ function purgeSriftFromPath() {
     return;
   }
   const rcFiles = [
-    path13.join(os8.homedir(), ".bashrc"),
-    path13.join(os8.homedir(), ".zshrc"),
-    path13.join(os8.homedir(), ".profile"),
-    path13.join(os8.homedir(), ".bash_profile"),
-    path13.join(os8.homedir(), ".config", "fish", "config.fish")
+    path14.join(os8.homedir(), ".bashrc"),
+    path14.join(os8.homedir(), ".zshrc"),
+    path14.join(os8.homedir(), ".profile"),
+    path14.join(os8.homedir(), ".bash_profile"),
+    path14.join(os8.homedir(), ".config", "fish", "config.fish")
   ];
   for (const rc of rcFiles) {
-    if (!fs15.existsSync(rc)) continue;
+    if (!fs16.existsSync(rc)) continue;
     try {
-      const original = fs15.readFileSync(rc, "utf8");
+      const original = fs16.readFileSync(rc, "utf8");
       const filtered = original.split("\n").filter((l) => !/\.srift[\/\\]bin/.test(l) && l.trim() !== "# SRIFT" && !l.includes("fish_add_path ~/.srift")).join("\n");
       if (filtered !== original) {
-        fs15.writeFileSync(rc, filtered);
+        fs16.writeFileSync(rc, filtered);
         console.log(`[srift] Cleaned srift PATH entry from: ${rc}`);
       }
     } catch {
@@ -14391,9 +14611,9 @@ function purgeSriftFromPath() {
 function scheduleWindowsDelete(binaryPath) {
   try {
     const winBin = binaryPath.replace(/\//g, "\\");
-    const batPath = path13.join(os8.tmpdir(), `srift-uninstall-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.bat`);
+    const batPath = path14.join(os8.tmpdir(), `srift-uninstall-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.bat`);
     const batBody = '@echo off\r\ntimeout /t 2 /nobreak >nul 2>&1\r\nif not exist "' + winBin + '" goto :selfDelete\r\n:retry\r\ndel /f /q "' + winBin + '" >nul 2>&1\r\nif exist "' + winBin + '" (\r\n  timeout /t 1 /nobreak >nul 2>&1\r\n  goto :retry\r\n)\r\n:selfDelete\r\ndel /f /q "%~f0" >nul 2>&1\r\n';
-    fs15.writeFileSync(batPath, batBody, "utf8");
+    fs16.writeFileSync(batPath, batBody, "utf8");
     spawn4("cmd.exe", ["/C", batPath], {
       detached: true,
       stdio: "ignore",
@@ -14407,13 +14627,13 @@ function scheduleWindowsDelete(binaryPath) {
 }
 function removeBinary(binaryPath) {
   try {
-    fs15.unlinkSync(binaryPath);
+    fs16.unlinkSync(binaryPath);
     return { ok: true, deferred: false };
   } catch (e) {
     if (process.platform === "win32" && (e?.code === "EPERM" || e?.code === "EBUSY" || e?.code === "EACCES" || e?.code === "ENOTEMPTY")) {
       try {
         const renamed = `${binaryPath}.old-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-        fs15.renameSync(binaryPath, renamed);
+        fs16.renameSync(binaryPath, renamed);
         scheduleWindowsDelete(renamed);
         return { ok: true, deferred: true };
       } catch {
@@ -14461,13 +14681,13 @@ async function handleUninstall(purge) {
     console.error(`[srift] Could not remove ${failed.length}:`);
     failed.forEach((f) => console.error(`           ${f}`));
   }
-  const standardInstallDir = path13.join(os8.homedir(), ".srift", "bin");
-  if (fs15.existsSync(standardInstallDir)) {
+  const standardInstallDir = path14.join(os8.homedir(), ".srift", "bin");
+  if (fs16.existsSync(standardInstallDir)) {
     try {
-      for (const f of fs15.readdirSync(standardInstallDir)) {
-        const fp = path13.join(standardInstallDir, f);
+      for (const f of fs16.readdirSync(standardInstallDir)) {
+        const fp = path14.join(standardInstallDir, f);
         try {
-          fs15.unlinkSync(fp);
+          fs16.unlinkSync(fp);
         } catch {
         }
       }
@@ -14475,18 +14695,18 @@ async function handleUninstall(purge) {
     }
   }
   if (purge) {
-    const sriftDir = path13.join(os8.homedir(), ".srift");
-    if (fs15.existsSync(sriftDir)) {
+    const sriftDir = path14.join(os8.homedir(), ".srift");
+    if (fs16.existsSync(sriftDir)) {
       try {
-        fs15.rmSync(sriftDir, { recursive: true, force: true });
+        fs16.rmSync(sriftDir, { recursive: true, force: true });
         console.log(`[srift] Purged directory: ${sriftDir}`);
       } catch (e) {
         if (process.platform === "win32") {
-          const batPath = path13.join(os8.tmpdir(), `srift-purge-${process.pid}-${Date.now()}.bat`);
+          const batPath = path14.join(os8.tmpdir(), `srift-purge-${process.pid}-${Date.now()}.bat`);
           const winDir = sriftDir.replace(/\//g, "\\");
           const batBody = '@echo off\r\ntimeout /t 3 /nobreak >nul 2>&1\r\n:retry\r\nrmdir /s /q "' + winDir + '" >nul 2>&1\r\nif exist "' + winDir + '" (\r\n  timeout /t 1 /nobreak >nul 2>&1\r\n  goto :retry\r\n)\r\ndel /f /q "%~f0" >nul 2>&1\r\n';
           try {
-            fs15.writeFileSync(batPath, batBody, "utf8");
+            fs16.writeFileSync(batPath, batBody, "utf8");
             spawn4("cmd.exe", ["/C", batPath], { detached: true, stdio: "ignore", windowsHide: true, shell: false }).unref();
             console.log(`[srift] Scheduled purge of ${sriftDir} (~3s after exit).`);
           } catch (ee) {
@@ -14502,10 +14722,10 @@ async function handleUninstall(purge) {
   if (process.platform === "win32") {
     try {
       const tmp = os8.tmpdir();
-      for (const f of fs15.readdirSync(tmp)) {
+      for (const f of fs16.readdirSync(tmp)) {
         if (/^srift-(uninstall|update|purge)-.*\.bat$/.test(f)) {
           try {
-            fs15.unlinkSync(path13.join(tmp, f));
+            fs16.unlinkSync(path14.join(tmp, f));
           } catch {
           }
         }
@@ -14554,7 +14774,10 @@ var ALL_COMMANDS = [
   "status",
   "reset",
   "logs",
-  "uninstall"
+  "uninstall",
+  "agentnet",
+  "an",
+  "bootstrap"
 ];
 function suggestCommand(input) {
   const prefixMatch = ALL_COMMANDS.find((c) => c.startsWith(input) || input.startsWith(c.slice(0, 3)));
@@ -14684,7 +14907,7 @@ async function main() {
       }
       const jsonStream = args.includes("--json-stream");
       await ensureDaemon();
-      handleMonitorTransfer(fileId, jsonStream);
+      await handleMonitorTransfer(fileId, jsonStream);
       break;
     }
     case "approve": {
@@ -14792,15 +15015,15 @@ async function main() {
           const n = await stdinToFile(filePath);
           if (!isJson) console.error(`[srift] Read ${n} bytes from stdin.`);
         } else {
-          const abs = path13.resolve(target);
-          if (!fs15.existsSync(abs)) throw new Error(`File not found: ${abs}`);
-          if (fs15.statSync(abs).isDirectory()) {
-            const base = path13.basename(abs) || "folder";
+          const abs = path14.resolve(target);
+          if (!fs16.existsSync(abs)) throw new Error(`File not found: ${abs}`);
+          if (fs16.statSync(abs).isDirectory()) {
+            const base = path14.basename(abs) || "folder";
             displayName = displayName || `${base}.tar.gz`;
             filePath = outboxPath(displayName.replace(/[\\/]/g, "_"));
             const excludes = [...DEFAULT_EXCLUDES, ...flagValues(args, "--exclude")];
             const r = await packDirectory(abs, filePath, excludes);
-            if (!isJson) console.error(`[srift] Packed ${r.files} file(s), ${r.bytes} bytes \u2192 ${path13.basename(filePath)} (excluded: ${excludes.join(", ")})`);
+            if (!isJson) console.error(`[srift] Packed ${r.files} file(s), ${r.bytes} bytes \u2192 ${path14.basename(filePath)} (excluded: ${excludes.join(", ")})`);
           } else {
             filePath = abs;
           }
@@ -14832,17 +15055,17 @@ async function main() {
           console.error("stdin (-) cannot be combined with other paths.");
           process.exit(1);
         }
-        const missing = targets.filter((t) => !fs15.existsSync(path13.resolve(t)));
+        const missing = targets.filter((t) => !fs16.existsSync(path14.resolve(t)));
         if (missing.length === targets.length) {
-          const msg = `File not found: ${missing.map((m) => path13.resolve(m)).join(", ")}`;
+          const msg = `File not found: ${missing.map((m) => path14.resolve(m)).join(", ")}`;
           if (isJson) console.log(JSON.stringify({ success: false, error: msg }));
           else console.error(`Error: ${msg}`);
           process.exit(1);
         }
-        if (missing.length && !isJson) console.error(`[srift] Warning: not found, will be skipped: ${missing.map((m) => path13.resolve(m)).join(", ")}`);
+        if (missing.length && !isJson) console.error(`[srift] Warning: not found, will be skipped: ${missing.map((m) => path14.resolve(m)).join(", ")}`);
         try {
           const where = await ensureDaemonOrEmbedded({ force: args.includes("--foreground") });
-          const res = await handleQuickShareMany(targets.map((t) => path13.resolve(t)), isJson, {
+          const res = await handleQuickShareMany(targets.map((t) => path14.resolve(t)), isJson, {
             maxDownloads,
             ttlMs,
             encrypt: encrypt2,
@@ -14888,7 +15111,7 @@ async function main() {
           console.error("Several links cannot all go to stdout; use -o <dir>.");
           process.exit(64);
         }
-        fs15.mkdirSync(outDir, { recursive: true });
+        fs16.mkdirSync(outDir, { recursive: true });
         const conc = Math.min(16, Math.max(1, parseInt(flagValue(args, "--concurrency") || "4", 10) || 4));
         const results = await mapLimit(links, conc, async (l) => {
           try {
@@ -14942,8 +15165,10 @@ async function main() {
         break;
       }
       const items = readHistory().reverse();
+      const limitArg = parseInt(flagValue(args, "--limit") || "", 10);
+      const limit = Number.isFinite(limitArg) && limitArg > 0 ? limitArg : null;
       if (isJson) {
-        console.log(JSON.stringify({ items }));
+        console.log(JSON.stringify({ items: limit ? items.slice(0, limit) : items }));
         break;
       }
       if (!items.length) {
@@ -14951,8 +15176,7 @@ async function main() {
         break;
       }
       const now = Date.now();
-      const limit = parseInt(flagValue(args, "--limit") || "20", 10);
-      for (const it of items.slice(0, Number.isFinite(limit) && limit > 0 ? limit : 20)) {
+      for (const it of items.slice(0, limit || 20)) {
         const state = it.expiresAt && it.expiresAt <= now ? "expired" : it.expiresAt ? `expires ${new Date(it.expiresAt).toLocaleString()}` : "no expiry";
         console.log(`${it.at.slice(0, 19).replace("T", " ")}  ${it.mode.padEnd(5)} ${it.encrypted ? "e2ee " : "plain"}  ${it.fileName}  (${state})`);
         console.log(`    ${it.downloadUrl}`);
@@ -15181,7 +15405,7 @@ Env vars:
 function printInstallMcpInstructions() {
   const claudeWin = `${process.env.APPDATA || "%APPDATA%"}\\Claude\\claude_desktop_config.json`;
   const execPath = process.execPath || "";
-  const execBase = path13.basename(execPath).toLowerCase();
+  const execBase = path14.basename(execPath).toLowerCase();
   const isCompiledBinary = execBase === "srift" || execBase === "srift.exe" || typeof process.isBun === "boolean" && process.isBun || process.versions && process.versions.bun !== void 0;
   let cmd;
   let argList;
@@ -15198,7 +15422,7 @@ function printInstallMcpInstructions() {
     argList = `["mcp"]`;
     cursorCmd = `srift mcp`;
   } else {
-    const scriptPath = path13.resolve(__dirname, "index.ts").replace(/\\/g, "/");
+    const scriptPath = path14.resolve(__dirname, "index.ts").replace(/\\/g, "/");
     cmd = `node`;
     argList = `["--experimental-strip-types","${scriptPath}","mcp"]`;
     cursorCmd = `node --experimental-strip-types ${scriptPath} mcp`;
@@ -15232,10 +15456,10 @@ Same command/args as above.
 
 # Cloud / browser agents (ChatGPT, Claude.ai, n8n, Zapier, etc.)
 # These run off your machine and CANNOT reach 127.0.0.1 \u2014 use the hosted endpoint:
-Hosted MCP:         POST https://srift.app/mcp        (no install, 8 orchestration tools)
+Hosted MCP:         POST https://srift.app/mcp        (no install, 9 session/control tools)
 { "mcpServers": { "srift": { "type": "streamable-http", "url": "https://srift.app/mcp" } } }
 
-# Local daemon surfaces (this machine only \u2014 full 14 tools):
+# Local daemon surfaces (this machine only \u2014 all 15 tools):
 HTTP MCP endpoint:  POST http://127.0.0.1:${DAEMON_PORT3}/mcp
 OpenAPI spec:       GET  http://127.0.0.1:${DAEMON_PORT3}/openapi.json
 AI Plugin:          GET  http://127.0.0.1:${DAEMON_PORT3}/.well-known/ai-plugin.json