tesseract-agent 0.10.8 → 0.10.9

package/dist-bundle/cli.js

@@ -4010,6 +4010,20 @@ var init_app_elements = __esm({
         title: "Search",
         description: "Opens search and the command palette \u2014 the fastest way to find anything."
       },
+      {
+        id: "guide.dock",
+        area: "guide",
+        title: "The guide",
+        // No `reveal`: the dock only exists while the guide is summoned, and a tour step that
+        // silently opened it would be pointing at something it had just conjured.
+        description: "Sits in the bottom corner when summoned. Type or say what you want and she does it."
+      },
+      {
+        id: "titlebar.guide",
+        area: "titlebar",
+        title: "Ask the guide",
+        description: "Opens the guide \u2014 say or type what you want and she does it, or shows you where."
+      },
       {
         id: "titlebar.settings",
         area: "titlebar",
@@ -4253,8 +4267,8 @@ function parseModelJsonArray(raw) {
 function schemaRejected(status2) {
   return status2 === 400 || status2 === 422;
 }
-function anthropicBaseUrl() {
-  return process.env.ANTHROPIC_BASE_URL?.trim() || "https://api.anthropic.com";
+function anthropicBaseUrl(env) {
+  return env?.ANTHROPIC_BASE_URL?.trim() || process.env.ANTHROPIC_BASE_URL?.trim() || "https://api.anthropic.com";
 }
 var OAUTH_BETA_HEADER;
 var init_model_json = __esm({
@@ -4278,6 +4292,56 @@ var init_domain_id = __esm({
   }
 });
 
+// ../../packages/shared/dist/run-directive.js
+function withRunDirective(userText, directive) {
+  if (!directive.trim())
+    return userText;
+  const head = userText ? `${userText}
+
+` : "";
+  return `${head}${RUN_DIRECTIVE_MARK}
+${directive}`;
+}
+var RUN_DIRECTIVE_MARK;
+var init_run_directive = __esm({
+  "../../packages/shared/dist/run-directive.js"() {
+    "use strict";
+    RUN_DIRECTIVE_MARK = "<!-- tesseract:run-directive -->";
+  }
+});
+
+// ../../packages/shared/dist/proactive-compaction.js
+function proactiveCompactionVerdict(a) {
+  if (a.inFlight)
+    return "skip";
+  if (typeof a.pct !== "number" || !Number.isFinite(a.pct) || a.pct <= 0 || a.pct >= 100)
+    return "skip";
+  if (typeof a.usagePct !== "number" || !Number.isFinite(a.usagePct))
+    return "skip";
+  if (a.usagePct > IMPOSSIBLE_FILL_PCT)
+    return "skip";
+  if (a.usagePct < a.pct)
+    return "reset";
+  if (typeof a.lastCompactPct === "number" && a.usagePct < a.lastCompactPct + PROACTIVE_REGROWTH_POINTS)
+    return "skip";
+  return "compact";
+}
+var PROACTIVE_REGROWTH_POINTS, IMPOSSIBLE_FILL_PCT;
+var init_proactive_compaction = __esm({
+  "../../packages/shared/dist/proactive-compaction.js"() {
+    "use strict";
+    PROACTIVE_REGROWTH_POINTS = 5;
+    IMPOSSIBLE_FILL_PCT = 100;
+  }
+});
+
+// ../../packages/shared/dist/digit-recall.js
+var init_digit_recall = __esm({
+  "../../packages/shared/dist/digit-recall.js"() {
+    "use strict";
+  }
+});
+
 // ../../packages/shared/dist/telemetry.js
 var TELEMETRY_EVENTS, EVENT_CATEGORY;
 var init_telemetry = __esm({
@@ -4705,14 +4769,67 @@ var init_hosting = __esm({
   }
 });
 
+// ../../packages/shared/dist/model-long-context.js
+function supportsOneMillionContext(model) {
+  const id = (model ?? "").trim();
+  if (!id)
+    return false;
+  if (/haiku/i.test(id))
+    return false;
+  return ONE_MILLION_FAMILIES.some((re) => re.test(id));
+}
+function hasOneMillionSuffix(model) {
+  return /\[1m\]$/i.test((model ?? "").trim());
+}
+function withOneMillionContext(model) {
+  const id = model?.trim();
+  if (!id)
+    return model;
+  if (hasOneMillionSuffix(id))
+    return id;
+  if (!supportsOneMillionContext(id))
+    return id;
+  return `${id}${SUFFIX}`;
+}
+function withoutOneMillionContext(model) {
+  const id = model?.trim();
+  if (!id)
+    return model;
+  return id.replace(/\[1m\]$/i, "");
+}
+var ONE_MILLION_FAMILIES, SUFFIX;
+var init_model_long_context = __esm({
+  "../../packages/shared/dist/model-long-context.js"() {
+    "use strict";
+    ONE_MILLION_FAMILIES = [
+      /(^|[/.])claude-sonnet-(4-6|4-7|4-8|5)\b/i,
+      /(^|[/.])claude-opus-(4-6|4-7|4-8|5)\b/i,
+      /(^|[/.])claude-fable-5\b/i,
+      // The CLI's own short aliases.
+      /^(sonnet|opus|fable)$/i
+    ];
+    SUFFIX = "[1m]";
+  }
+});
+
 // ../../packages/shared/dist/settings.js
 function canCallDirectly(modelId) {
   return !!modelId && MODEL_OPTIONS.some((m) => m.id === modelId);
 }
-var MODEL_OPTIONS, DEFAULT_VERIFIER_MODEL;
+function isCliModelAlias(model) {
+  return CLI_MODEL_ALIASES.test((model ?? "").trim());
+}
+function verifierModelLadder(model) {
+  const bare = withoutOneMillionContext(model) ?? model;
+  const first = canCallDirectly(bare) ? bare : DEFAULT_VERIFIER_MODEL;
+  const rest = MODEL_OPTIONS.map((m) => m.id).filter((id) => id !== first && !/haiku/i.test(id));
+  return [first, ...rest];
+}
+var MODEL_OPTIONS, DEFAULT_VERIFIER_MODEL, CLI_MODEL_ALIASES;
 var init_settings = __esm({
   "../../packages/shared/dist/settings.js"() {
     "use strict";
+    init_model_long_context();
     MODEL_OPTIONS = [
       { id: "claude-opus-5", label: "Claude Opus 5" },
       { id: "claude-sonnet-5", label: "Claude Sonnet 5" },
@@ -4722,6 +4839,7 @@ var init_settings = __esm({
       { id: "claude-haiku-4-5", label: "Claude Haiku 4.5" }
     ];
     DEFAULT_VERIFIER_MODEL = MODEL_OPTIONS[0].id;
+    CLI_MODEL_ALIASES = /^(?:default|sonnet|opus|haiku|fable)(?:\[1m\])?$/i;
   }
 });
 
@@ -6400,9 +6518,9 @@ function kebab(s) {
   return s.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[^a-zA-Z0-9]+/g, "-").replace(/^-+|-+$/g, "").toLowerCase();
 }
 function tokenCssVarName(path6, token3) {
-  const override2 = token3 ? tessExt(token3)?.cssVar : void 0;
-  if (override2) {
-    const name = override2.startsWith("--") ? override2 : `--${override2}`;
+  const override3 = token3 ? tessExt(token3)?.cssVar : void 0;
+  if (override3) {
+    const name = override3.startsWith("--") ? override3 : `--${override3}`;
     if (/^--[A-Za-z0-9-]+$/.test(name))
       return name;
   }
@@ -7256,6 +7374,9 @@ var init_dist = __esm({
     init_ws_protocol();
     init_frame();
     init_domain_id();
+    init_run_directive();
+    init_proactive_compaction();
+    init_digit_recall();
     init_telemetry();
     init_error_report();
     init_eula();
@@ -7947,8 +8068,9 @@ function materializeClaudeAuthHome(contents) {
   return home;
 }
 function withClaudeModels(env, main2, fast) {
-  if (main2)
-    env.ANTHROPIC_MODEL = main2;
+  if (main2) {
+    env.ANTHROPIC_MODEL = process.env.TESSERACT_DISABLE_1M_CONTEXT === "1" ? main2 : withOneMillionContext(main2) ?? main2;
+  }
   if (fast)
     env.ANTHROPIC_SMALL_FAST_MODEL = fast;
   return env;
@@ -7975,14 +8097,14 @@ function resolveRunnerEnv(spec) {
     return {};
   const key2 = spec?.secret?.trim();
   if (provider.claudeEnterprise) {
-    const run5 = claudeEnterpriseRun(provider.claudeEnterprise, { secret: key2, baseUrl: spec?.baseUrl, main: main2, fast });
-    if (run5.error)
-      return { CCB_RUNNER_CONFIG_ERROR: run5.error };
-    if (!run5.file)
-      return run5.env;
+    const run8 = claudeEnterpriseRun(provider.claudeEnterprise, { secret: key2, baseUrl: spec?.baseUrl, main: main2, fast });
+    if (run8.error)
+      return { CCB_RUNNER_CONFIG_ERROR: run8.error };
+    if (!run8.file)
+      return run8.env;
     try {
-      const path6 = materializeEnterpriseCredential(run5.file.suggestedName, run5.file.contents);
-      return { ...run5.env, [run5.file.envVar]: path6 };
+      const path6 = materializeEnterpriseCredential(run8.file.suggestedName, run8.file.contents);
+      return { ...run8.env, [run8.file.envVar]: path6 };
     } catch (e) {
       return { CCB_RUNNER_CONFIG_ERROR: `Could not write the ${provider.label} credential on this machine: ${e.message}` };
     }
@@ -8049,6 +8171,7 @@ var init_resolve = __esm({
   "../../packages/host-core/dist/runners/resolve.js"() {
     "use strict";
     init_base_paths();
+    init_model_long_context();
     init_file_lock();
     init_dist();
     init_proxy_router();
@@ -8589,21 +8712,27 @@ function readDaemonAgentSettings() {
     return snap;
   }
 }
+function gatewayCanCall(model, snapshot4) {
+  const tiers2 = snapshot4.gatewayTiers;
+  if (!tiers2?.length)
+    return true;
+  return tiers2.includes(model) || snapshot4.gatewayDirectNaming === true;
+}
 function gatewayTierRejection(model) {
   if (!model)
     return null;
-  const tiers2 = readDaemonAgentSettings().gatewayTiers;
-  if (!tiers2?.length || tiers2.includes(model))
+  const snap = readDaemonAgentSettings();
+  if (gatewayCanCall(model, snap))
     return null;
-  return { model, tiers: [...tiers2] };
+  return { model, tiers: [...snap.gatewayTiers ?? []] };
 }
 function gatewayTierClamp(model) {
   if (!model)
     return model;
-  const tiers2 = readDaemonAgentSettings().gatewayTiers;
-  if (!tiers2?.length || tiers2.includes(model))
+  const snap = readDaemonAgentSettings();
+  if (gatewayCanCall(model, snap))
     return model;
-  console.warn(`[gateway] Model "${model}" isn't served by this device's gateway key (${tiers2.join(", ")}) \u2014 dropping it so the gateway picks one it can reach.`);
+  console.warn(`[gateway] Model "${model}" isn't served by this device's gateway key (${(snap.gatewayTiers ?? []).join(", ")}) \u2014 dropping it so the gateway picks one it can reach.`);
   return void 0;
 }
 function chatSendToParams(msg, defaults) {
@@ -8630,6 +8759,10 @@ function chatSendToParams(msg, defaults) {
     // one OFF for one conversation could not actually turn it off.
     ...msg.unattended !== void 0 ? { unattended: msg.unattended } : {},
     ...msg.reinforcedVerification !== void 0 ? { reinforcedVerification: msg.reinforcedVerification } : {},
+    // Forwarded even at 0/100 (both mean "no proactive compaction"), for the same reason as
+    // the two flags above: falling through to the machine-wide number would make a
+    // conversation that opted out of compaction impossible to express.
+    ...msg.autoCompactPct !== void 0 ? { autoCompactPct: msg.autoCompactPct } : {},
     ...msg.autoContinuation ? { autoContinuation: true } : {},
     ...msg.model ? { model: msg.model } : {},
     ...msg.jsonSchema ? { jsonSchema: msg.jsonSchema } : {},
@@ -8699,11 +8832,15 @@ function mergeDaemonAgentSettings(params) {
     // local override (single-config CLI). Enabled skills' env is folded in. Empty ⇒
     // ambient Claude.
     engineEnv: params.engineEnv ?? {
-      ...poolActiveEngineEnv() ?? (s.runnerSpec ? resolveRunnerEnv(s.runnerSpec) : resolveOverrideEngineEnv()),
+      ...daemonEngineEnv(),
       ...s.skillEnv ?? {}
     }
   };
 }
+function daemonEngineEnv() {
+  const s = readDaemonAgentSettings();
+  return poolActiveEngineEnv() ?? (s.runnerSpec ? resolveRunnerEnv(s.runnerSpec) : resolveOverrideEngineEnv());
+}
 var init_daemon_settings = __esm({
   "../../packages/host-core/dist/daemon-settings.js"() {
     "use strict";
@@ -12058,10 +12195,10 @@ var init_schemas = __esm({
       $ZodType.init(inst, def);
       const desc = Object.getOwnPropertyDescriptor(def, "shape");
       if (!desc?.get) {
-        const sh = def.shape;
+        const sh3 = def.shape;
         Object.defineProperty(def, "shape", {
           get: () => {
-            const newSh = { ...sh };
+            const newSh = { ...sh3 };
             Object.defineProperty(def, "shape", {
               value: newSh
             });
@@ -28566,8 +28703,8 @@ function prompt(id, vars) {
     }
     return "";
   }
-  const override2 = snapshot2.entries[id];
-  return interpolatePrompt(typeof override2 === "string" ? override2 : spec.content, vars);
+  const override3 = snapshot2.entries[id];
+  return interpolatePrompt(typeof override3 === "string" ? override3 : spec.content, vars);
 }
 function describedBy(idPrefix, specs, key2 = (s) => s.name) {
   return specs.map((spec) => Object.defineProperty({ ...spec }, "description", {
@@ -28708,7 +28845,7 @@ function buildPack(s) {
   const dual = (lv) => ({ $value: lv[0], $extensions: { "com.tesseract": { modes: { dark: lv[1] } } } });
   const val = (v) => Array.isArray(v) ? dual(v) : { $value: v };
   const r = s.radius ?? { sm: "6px", md: "10px", lg: "16px" };
-  const sh = s.shadow ?? {
+  const sh3 = s.shadow ?? {
     sm: "0 1px 2px rgb(0 0 0 / 0.06)",
     md: "0 4px 12px rgb(0 0 0 / 0.08)",
     lg: "0 12px 32px rgb(0 0 0 / 0.12)"
@@ -28753,7 +28890,7 @@ function buildPack(s) {
       xl: { $value: "40px" }
     },
     radius: { $type: "dimension", sm: { $value: r.sm }, md: { $value: r.md }, lg: { $value: r.lg }, full: { $value: "9999px" } },
-    shadow: { $type: "shadow", sm: { $value: sh.sm }, md: { $value: sh.md }, lg: { $value: sh.lg } }
+    shadow: { $type: "shadow", sm: { $value: sh3.sm }, md: { $value: sh3.md }, lg: { $value: sh3.lg } }
   };
   return { $packSchema: DESIGN_PACK_SCHEMA, id: s.id, name: s.name, description: s.description, style: s.style, tokens: tokens3 };
 }
@@ -31716,7 +31853,7 @@ var init_job_registry = __esm({
        * the calling tool can return `{ id, logPath }` to the model in the same tick, so the
        * turn continues instead of blocking. `run` is deliberately NOT awaited here.
        */
-      start(kind, description, run5) {
+      start(kind, description, run8) {
         const id = makeId(++this.seq);
         const logPath = join16(this.dir, `${id}.output`);
         const abort = new AbortController();
@@ -31736,7 +31873,7 @@ var init_job_registry = __esm({
         this.evict();
         void (async () => {
           try {
-            const tail3 = await run5((chunk) => this.write(id, chunk), abort.signal);
+            const tail3 = await run8((chunk) => this.write(id, chunk), abort.signal);
             if (typeof tail3 === "string" && tail3)
               this.write(id, tail3);
             this.settle(id, abort.signal.aborted ? "stopped" : "completed", abort.signal.aborted ? 130 : 0);
@@ -33485,9 +33622,9 @@ function paginationSignature(engine) {
   return [...engine.pagination.params].sort().join("+");
 }
 function pageStrategy(engine) {
-  const override2 = OVERRIDES[engine.id];
-  if (override2)
-    return override2;
+  const override3 = OVERRIDES[engine.id];
+  if (override3)
+    return override3;
   const sig = paginationSignature(engine);
   if (!sig)
     return { kind: "none", reason: "This engine declares no pagination parameters." };
@@ -36635,27 +36772,18 @@ function autoCompactEnvFor(pct2, supplied) {
 function shouldCompactProactively(a) {
   if (a.mode === "off")
     return "skip";
-  if (a.inFlight)
-    return "skip";
-  if (typeof a.pct !== "number" || !Number.isFinite(a.pct) || a.pct <= 0 || a.pct >= 100)
-    return "skip";
-  if (typeof a.usagePct !== "number" || !Number.isFinite(a.usagePct))
-    return "skip";
-  if (a.usagePct < a.pct)
-    return "reset";
-  if (typeof a.lastCompactPct === "number" && a.usagePct < a.lastCompactPct + PROACTIVE_REGROWTH_POINTS)
-    return "skip";
-  return "compact";
+  return proactiveCompactionVerdict(a);
 }
-var OVERFLOW_MAX_TRIES, OVERFLOW_COMPACT_MESSAGE, OVERFLOW_RESUME_MESSAGE, PROACTIVE_REGROWTH_POINTS;
+var OVERFLOW_MAX_TRIES, OVERFLOW_COMPACT_MESSAGE, OVERFLOW_RESUME_MESSAGE;
 var init_context_recovery = __esm({
   "../../packages/agent-core/dist/context-recovery.js"() {
     "use strict";
+    init_dist();
     init_unattended_log();
+    init_dist();
     OVERFLOW_MAX_TRIES = 3;
     OVERFLOW_COMPACT_MESSAGE = "/compact";
     OVERFLOW_RESUME_MESSAGE = "Continue.";
-    PROACTIVE_REGROWTH_POINTS = 5;
   }
 });
 
@@ -37483,13 +37611,16 @@ async function fetchSessionUsage(env) {
 }
 async function anthropicHeaders(env) {
   const apiKey = env?.ANTHROPIC_API_KEY?.trim() || process.env.ANTHROPIC_API_KEY?.trim() || "";
-  const oauth = apiKey ? "" : await resolveOauthToken(env) || "";
-  if (!apiKey && !oauth)
+  const authToken = apiKey ? "" : env?.ANTHROPIC_AUTH_TOKEN?.trim() || "";
+  const oauth = apiKey || authToken ? "" : await resolveOauthToken(env) || "";
+  if (!apiKey && !authToken && !oauth)
     return null;
   const headers = { "content-type": "application/json", "anthropic-version": "2023-06-01" };
   if (apiKey)
     headers["x-api-key"] = apiKey;
-  else {
+  else if (authToken) {
+    headers.authorization = `Bearer ${authToken}`;
+  } else {
     headers.authorization = `Bearer ${oauth}`;
     headers["anthropic-beta"] = OAUTH_BETA_HEADER;
   }
@@ -37499,27 +37630,31 @@ async function hasAnthropicCred(env) {
   return await anthropicHeaders(env) !== null;
 }
 async function anthropicMessage(args) {
+  return (await anthropicCall(args)).text;
+}
+async function anthropicCall(args) {
   const { env, model, system, content, maxTokens, timeoutMs, label } = args;
   const attempts = Math.max(1, args.attempts ?? 1);
   const budgetMs = args.budgetMs ?? attempts * timeoutMs + 4e3;
   const deadline = Date.now() + budgetMs;
-  const base = { model, max_tokens: maxTokens, system, messages: [{ role: "user", content }] };
-  let body = JSON.stringify(args.schema ? { ...base, output_config: { format: { type: "json_schema", schema: args.schema } } } : base);
-  let schemaDropped = false;
+  const base = { ...model ? { model } : {}, max_tokens: maxTokens, system, messages: [{ role: "user", content }] };
+  const useSchema = !!args.schema && !schemaUnsupported.has(schemaKey(anthropicBaseUrl(env), model));
+  let body = JSON.stringify(useSchema ? { ...base, output_config: { format: { type: "json_schema", schema: args.schema } } } : base);
+  let schemaDropped = !useSchema;
   const headers = await anthropicHeaders(env);
   if (!headers)
-    return null;
+    return { text: null, rateLimited: false };
   for (let attempt = 0; attempt < attempts; attempt++) {
     const remaining = deadline - Date.now();
     if (remaining < 1e3) {
       log(`${label}: out of budget after ${attempt} attempt(s) \u2014 giving up rather than starting a leg that cannot finish.`);
-      return null;
+      return { text: null, rateLimited: false };
     }
     const ac = new AbortController();
     const legMs = Math.min(timeoutMs, remaining);
     const legTimer = setTimeout(() => ac.abort(new Error("The operation was aborted due to timeout")), legMs);
     try {
-      const res = await fetch(`${anthropicBaseUrl()}/v1/messages`, {
+      const res = await fetch(`${anthropicBaseUrl(env)}/v1/messages`, {
         method: "POST",
         headers,
         body,
@@ -37527,23 +37662,34 @@ async function anthropicMessage(args) {
       });
       if (res.ok) {
         const j = await res.json();
-        return (j.content ?? []).filter((b) => b.type === "text").map((b) => b.text ?? "").join("").trim() || null;
+        const text12 = (j.content ?? []).filter((b) => b.type === "text").map((b) => b.text ?? "").join("").trim() || null;
+        return { text: text12, rateLimited: false };
       }
       if (schemaRejected(res.status) && args.schema && !schemaDropped) {
         schemaDropped = true;
+        schemaUnsupported.add(schemaKey(anthropicBaseUrl(env), model));
         body = JSON.stringify(base);
         log(`${label}: the endpoint rejected output_config (${model}) \u2014 retrying without the schema and parsing the reply as text.`);
         attempt--;
         continue;
       }
-      if ((res.status === 429 || res.status === 529) && attempt < attempts - 1) {
-        const wait = Math.max(0, Math.min(800 * (attempt + 1) * (attempt + 1), deadline - Date.now()));
+      const rateLimited = res.status === 429 || res.status === 529;
+      const modelRejected = (res.status === 400 || res.status === 403 || res.status === 404) && !!model;
+      if (rateLimited && attempt < attempts - 1) {
+        let stated = 0;
+        try {
+          stated = Number(res.headers?.get?.("retry-after")) * 1e3;
+        } catch {
+          stated = 0;
+        }
+        const backoff3 = Number.isFinite(stated) && stated > 0 ? stated : 800 * (attempt + 1) * (attempt + 1);
+        const wait = Math.max(0, Math.min(backoff3, deadline - Date.now()));
         log(`${label}: HTTP ${res.status} (${model}) \u2014 retry ${attempt + 1} in ${wait}ms`);
         await new Promise((r) => setTimeout(r, wait));
         continue;
       }
       log(`${label}: HTTP ${res.status} (${model})`);
-      return null;
+      return { text: null, rateLimited, modelRejected };
     } catch (err2) {
       if (args.retryOnThrow && attempt < attempts - 1) {
         const wait = Math.max(0, Math.min(800 * (attempt + 1) * (attempt + 1), deadline - Date.now()));
@@ -37552,19 +37698,27 @@ async function anthropicMessage(args) {
         continue;
       }
       log(`${label}: call failed:`, err2 instanceof Error ? err2.message : String(err2));
-      return null;
+      return { text: null, rateLimited: false };
     } finally {
       clearTimeout(legTimer);
     }
   }
-  return null;
+  return { text: null, rateLimited: false };
+}
+function isDirectAnthropic(env) {
+  try {
+    return /(^|\.)api\.anthropic\.com$/i.test(new URL(anthropicBaseUrl(env)).hostname);
+  } catch {
+    return false;
+  }
 }
 async function buildClaudeNarrationLlm(env) {
   if (!await hasAnthropicCred(env))
     return null;
+  const model = isDirectAnthropic(env) ? "claude-haiku-4-5" : env?.ANTHROPIC_SMALL_FAST_MODEL?.trim() || env?.ANTHROPIC_MODEL?.trim() || "";
   const complete = ({ system, prompt: prompt2, maxTokens, schema }) => anthropicMessage({
     env,
-    model: "claude-haiku-4-5",
+    model,
     system,
     content: prompt2,
     maxTokens,
@@ -37574,43 +37728,60 @@ async function buildClaudeNarrationLlm(env) {
   });
   return { complete, engineLabel: "Claude Code" };
 }
-async function buildClaudeSmartLlm(env) {
-  if (!await hasAnthropicCred(env))
+function graderLadder(model, env) {
+  if (isDirectAnthropic(env))
+    return verifierModelLadder(model);
+  const configured = env?.ANTHROPIC_MODEL?.trim();
+  const named = model?.trim();
+  const wanted2 = named && !isCliModelAlias(named) ? named : configured;
+  return [...new Set([wanted2, configured].filter((m) => !!m))];
+}
+async function buildClaudeSmartLlm(builderEnv) {
+  return async ({ model, system, prompt: prompt2, maxTokens, schema, env: callEnv }) => {
+    const env = callEnv && Object.keys(callEnv).length ? callEnv : builderEnv;
+    const deadline = Date.now() + RV_GRADE_ATTEMPTS * RV_GRADE_TIMEOUT_MS + RV_GRADE_BACKOFF_MS;
+    const ladder = graderLadder(model, env);
+    let rejectedOnce = false;
+    for (let i = 0; i < Math.max(1, ladder.length); i++) {
+      const remaining = deadline - Date.now();
+      if (remaining < 2e3)
+        break;
+      const out = await anthropicCall({
+        env,
+        schema,
+        model: ladder[i] ?? "",
+        // No `thinking` on purpose: the accepted shape differs per model generation
+        // (adaptive-only, budget_tokens, disabled-at-effort), and a 400 here costs the whole
+        // verification pass. The models we call think by default where it matters.
+        system,
+        content: prompt2,
+        maxTokens,
+        timeoutMs: Math.min(SMART_TIMEOUT_MS, remaining),
+        label: "verifier",
+        // TWO attempts, not three (RV_GRADE_ATTEMPTS) — see the deadline above. Only the
+        // FIRST model gets them: a fallback leg exists because the first was rate-limited,
+        // and spending the remaining budget re-asking one model would leave none for the
+        // model that can actually answer.
+        attempts: i === 0 ? RV_GRADE_ATTEMPTS : 1,
+        retryOnThrow: i === 0,
+        budgetMs: remaining
+      });
+      if (out.text) {
+        if (i > 0)
+          log(`verifier: graded with ${ladder[i]} \u2014 ${ladder[0]} was unavailable`);
+        return out.text;
+      }
+      if (out.rateLimited)
+        continue;
+      if (out.modelRejected && !rejectedOnce) {
+        rejectedOnce = true;
+        continue;
+      }
+      return null;
+    }
+    log("verifier: every model was rate-limited or out of budget \u2014 this run cannot be graded now");
     return null;
-  return ({ model, system, prompt: prompt2, maxTokens, schema }) => anthropicMessage({
-    env,
-    schema,
-    // Only a model this endpoint actually serves. `/^claude-/` was a PROVIDER-NAME test
-    // standing in for "can this be called": it passed a gateway tier alias or a dated id
-    // straight through (400 → the schema-drop retry → 400 again → every verified run on that
-    // model reporting "the verifier did not return a usable verdict"), and it FAILED
-    // `us.anthropic.claude-*`, silently downgrading a Claude session's grader. The catalog
-    // answers the question the regex was imitating.
-    model: canCallDirectly(model) ? model : DEFAULT_VERIFIER_MODEL,
-    // No `thinking` / `output_config` on purpose: the accepted shape differs per model
-    // generation (adaptive-only, budget_tokens, disabled-at-effort), and a 400 here costs
-    // the whole verification pass. The models we call think by default where it matters.
-    system,
-    content: prompt2,
-    maxTokens,
-    timeoutMs: SMART_TIMEOUT_MS,
-    label: "verifier",
-    // TWO attempts, not three (RV_GRADE_ATTEMPTS). The desktop gives a grade
-    // RV_VERDICT_GRACE_MS before it stops waiting and ends the run itself; a third attempt
-    // plus backoff pushes the sum past it, so the verdict would land after the client had
-    // already moved on — and then dispatch a "continue and finish it" turn into whatever
-    // the user started next.
-    attempts: RV_GRADE_ATTEMPTS,
-    retryOnThrow: true,
-    // The ATTEMPT PLAN, not the client's grace — the two are different numbers on purpose.
-    // The desktop stops waiting at RV_VERDICT_GRACE_MS (180s), ends the run itself, and a
-    // late verdict then dispatches a "continue and finish it" turn on top of whatever the
-    // user started next. The shared constants already encode the gap: 2 x 75s + 4s = 154s of
-    // trying, leaving 26s for the verdict to actually get back and be applied. Budgeting to
-    // the grace itself would spend that margin and land the answer exactly as the client
-    // gives up, which is a race rather than a deadline.
-    budgetMs: RV_GRADE_ATTEMPTS * RV_GRADE_TIMEOUT_MS + RV_GRADE_BACKOFF_MS
-  });
+  };
 }
 async function buildClaudeVisionLlm(env) {
   if (!await hasAnthropicCred(env))
@@ -37630,7 +37801,7 @@ async function buildClaudeVisionLlm(env) {
     ]
   });
 }
-var execFileP, USAGE_URL, FETCH_TIMEOUT_MS, cache4, TTL_MS, SMART_TIMEOUT_MS, VISION_TIMEOUT_MS;
+var execFileP, USAGE_URL, FETCH_TIMEOUT_MS, cache4, TTL_MS, schemaUnsupported, schemaKey, SMART_TIMEOUT_MS, VISION_TIMEOUT_MS;
 var init_session_usage = __esm({
   "../../packages/agent-core/dist/session-usage.js"() {
     "use strict";
@@ -37642,6 +37813,8 @@ var init_session_usage = __esm({
     FETCH_TIMEOUT_MS = 5e3;
     cache4 = null;
     TTL_MS = 2e4;
+    schemaUnsupported = /* @__PURE__ */ new Set();
+    schemaKey = (base, model) => `${base}|${model}`;
     SMART_TIMEOUT_MS = RV_GRADE_TIMEOUT_MS;
     VISION_TIMEOUT_MS = 2e4;
   }
@@ -38088,6 +38261,26 @@ function sessionStoreFor(mode) {
 function unattendedReportDirective(send4) {
   return unattendedModeFor({ optedIn: send4.unattended, origin: send4.origin }) !== "off" ? prompt("agent.system.unattended-report") : "";
 }
+function sdkModelId(model) {
+  const id = model?.trim();
+  if (!id)
+    return void 0;
+  if (process.env.TESSERACT_DISABLE_1M_CONTEXT === "1")
+    return id;
+  if (/[/]/.test(id) || /^[a-z]{2,}\./i.test(id))
+    return id;
+  return withOneMillionContext(id) ?? id;
+}
+function anthropicEnvOf(env) {
+  const keys = ["ANTHROPIC_BASE_URL", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_API_KEY", "ANTHROPIC_MODEL", "ANTHROPIC_SMALL_FAST_MODEL", "CLAUDE_CODE_OAUTH_TOKEN", "CLAUDE_CONFIG_DIR"];
+  const out = {};
+  for (const k of keys) {
+    const v = env[k];
+    if (typeof v === "string" && v.trim())
+      out[k] = v;
+  }
+  return out;
+}
 function unknownModelEnv(model) {
   const id = (model ?? "").trim();
   if (!id || /^claude-/i.test(id))
@@ -38351,8 +38544,8 @@ function taskNotificationNotices(content) {
   }
   if (!text12.includes("<task-notification>"))
     return [];
-  const tag = (xml2, name) => {
-    const m = new RegExp(`<${name}>([\\s\\S]*?)</${name}>`).exec(xml2);
+  const tag = (xml3, name) => {
+    const m = new RegExp(`<${name}>([\\s\\S]*?)</${name}>`).exec(xml3);
     return m ? m[1].trim() : "";
   };
   const specs = [];
@@ -38641,6 +38834,12 @@ function withPinnedSource(sources, pinned) {
     return sources;
   return [...sources, pinned];
 }
+function isCompactionPrompt(prompt2) {
+  const p = (prompt2 ?? "").trim();
+  if (!p.startsWith("/compact"))
+    return false;
+  return p.length === "/compact".length || /^[\s\n]/.test(p.slice("/compact".length));
+}
 function buildMobileClause(dir2) {
   try {
     let fw = "";
@@ -38738,6 +38937,8 @@ var init_agent_manager = __esm({
     init_reinforced_verification();
     init_unattended_log();
     init_context_recovery();
+    init_model_long_context();
+    init_dist();
     init_dist();
     init_dist();
     init_base_paths();
@@ -39258,7 +39459,7 @@ var init_agent_manager = __esm({
        * doing it would spend two turns on one reclaim.
        */
       async maybeCompactProactively(live) {
-        const pct2 = (() => {
+        const pct2 = live.autoCompactPct ?? (() => {
           try {
             return this.autoCompactPct?.();
           } catch {
@@ -39371,6 +39572,13 @@ var init_agent_manager = __esm({
         this.narrator.setConfig(cfg2);
         this.cheapLlm = cfg2?.complete ?? null;
       }
+      /** The endpoint + credential this HOST runs agents against, for the manager's own
+       *  on-demand model calls (see summarizeSession). Injected by the host, which is the only
+       *  side that can resolve it — see host-core `daemonEngineEnv`. */
+      hostEnv = null;
+      setHostEnv(env) {
+        this.hostEnv = env && Object.keys(env).length ? env : null;
+      }
       /** Summarize a session transcript into concise Markdown with the injected cheap
        *  (Haiku) model. Runs in the daemon — the desktop forwards the request rather
        *  than calling a model itself. Keeps the HEAD + TAIL of a long transcript. */
@@ -39380,7 +39588,7 @@ var init_agent_manager = __esm({
         let llm = this.cheapLlm;
         if (!llm) {
           try {
-            llm = (await buildClaudeNarrationLlm())?.complete ?? null;
+            llm = (await buildClaudeNarrationLlm(this.hostEnv ?? void 0))?.complete ?? null;
           } catch {
           }
         }
@@ -39577,7 +39785,15 @@ ${full.slice(-8e3)}`;
           }
           const todos = live.todos?.map((t) => ({ content: t.content, status: String(t.status) }));
           const call3 = gate === "review" ? reviewGrade(rv, finalText, todos) : gate === "phase" ? phaseGrade(rv, rv.lastVerdict?.phaseName ?? "", finalText, todos) : completenessGrade(rv, finalText, todos);
-          const raw = await llm({ model: live.model, system: call3.system, prompt: call3.prompt, maxTokens: 16e3, schema: call3.schema });
+          const raw = await llm({
+            model: live.model,
+            system: call3.system,
+            prompt: call3.prompt,
+            maxTokens: 16e3,
+            schema: call3.schema,
+            // Grade THIS session on the endpoint it is running on — see live.endpointEnv.
+            env: live.endpointEnv
+          });
           if (live.rv !== rv || live.reaped) {
             if (live.reaped || live.rv === void 0) {
               emitVerification({ action: "done", gate, cycle: rv.cycles, maxCycles: RV_MAX_CYCLES, unavailable: "This run ended before it could be verified." });
@@ -39655,6 +39871,8 @@ ${full.slice(-8e3)}`;
        *  and the 20-cycle cap silently stops capping anything. */
       applyTurnPolicy(live, p) {
         live.unattended = unattendedModeFor({ optedIn: p.unattended, origin: p.origin });
+        if (p.autoCompactPct !== void 0)
+          live.autoCompactPct = p.autoCompactPct;
         live.autoDecisions = 0;
         if (p.model !== void 0)
           live.model = p.model || void 0;
@@ -40361,7 +40579,7 @@ ${lines}`;
           if (opts.permissionMode)
             await live.query.setPermissionMode(opts.permissionMode);
           if (opts.model !== void 0) {
-            await live.query.setModel(opts.model || void 0);
+            await live.query.setModel(sdkModelId(opts.model));
             live.model = opts.model || void 0;
           }
           if (opts.maxThinkingTokens !== void 0)
@@ -40481,7 +40699,7 @@ ${lines}`;
           live.windowId = params.windowId;
         live.pendingTitle = params.message.trim().slice(0, 80);
         if (params.model)
-          void live.query.setModel(params.model || void 0).catch(() => {
+          void live.query.setModel(sdkModelId(params.model)).catch(() => {
           });
         if (params.permissionMode)
           void live.query.setPermissionMode(params.permissionMode).catch(() => {
@@ -40656,6 +40874,7 @@ ${prompt("agent.system.project-dir", { dir: projectDir })}` : "";
             windowId: params.windowId,
             sources: params.sources,
             unattended: params.unattended,
+            autoCompactPct: params.autoCompactPct,
             reinforcedVerification: params.reinforcedVerification,
             task: params.message,
             rvInjected: params.rvInjected,
@@ -40721,12 +40940,17 @@ ${prompt("agent.system.project-dir", { dir: projectDir })}` : "";
         const lateDirective = live.unattendedReportSent ? "" : unattendedReportDirective(params);
         if (lateDirective)
           live.unattendedReportSent = true;
+        const hostTurn = (params.autoContinuation || params.rvInjected) && !userText.trimStart().startsWith("/");
         const sdkMsg = {
           type: "user",
           parent_tool_use_id: null,
-          message: { role: "user", content: lateDirective ? `${userText}
-
-${lateDirective}` : userText }
+          // MARKED, so a client can show the user's own words and not the instruction we
+          // appended to them — the engine writes this combined text into its transcript, so it
+          // comes back on every resume (see shared/run-directive).
+          message: {
+            role: "user",
+            content: lateDirective ? withRunDirective(userText, lateDirective) : hostTurn ? withRunDirective("", userText) : userText
+          }
         };
         live.pump.push(sdkMsg);
       }
@@ -40841,14 +41065,19 @@ ${lateDirective}` : userText }
             // it. It only *permits* bypass — the active behavior is still governed by
             // permissionMode, so it's safe to set unconditionally.
             allowDangerouslySkipPermissions: true,
-            ...params.model ? { model: params.model } : {},
+            // Suffixed for the long window where the family has one — see sdkModelId. Without
+            // this the CLI reports a 200k window for a 1M model and compaction acts on a fill
+            // that is up to five times too high.
+            ...params.model ? { model: sdkModelId(params.model) } : {},
             // Clamp to what THIS CLI accepts — an unsupported level is a hard exit-1, not
             // a warning. See clampEffort.
             ...ultracodeEffort ? { effort: ultracodeEffort } : {},
             // Model-level fallback. Ours rotates CREDENTIALS on failure; this rotates the
             // MODEL before the turn fails at all, so an overloaded primary degrades instead
             // of surfacing an error the user has to act on.
-            ...params.fallbackModel ? { fallbackModel: params.fallbackModel } : {},
+            // Same for the fallback: it REPLACES the main model on an overload, so a bare id here
+            // would quietly move a long conversation onto a 200k window mid-run.
+            ...params.fallbackModel ? { fallbackModel: sdkModelId(params.fallbackModel) } : {},
             ...params.enableFileCheckpointing ? { enableFileCheckpointing: true } : {},
             ...params.agentProgressSummaries ? { agentProgressSummaries: true } : {},
             ...params.includeHookEvents ? { includeHookEvents: true } : {},
@@ -41448,6 +41677,7 @@ ${lateDirective}` : userText }
                 ...params.engineEnv ?? {},
                 CCB_IPC_PORT: String(live.ipcPort)
               };
+              live.endpointEnv = anthropicEnvOf(spawnEnv);
               const child = spawn3(options.command, options.args, {
                 cwd: options.cwd,
                 env: spawnEnv,
@@ -42489,6 +42719,11 @@ ${err2.stack}` : ""}` : String(err2);
        *  the stream was actually alive. */
       touchStream(live, firstFrame = false) {
         live.lastFrameAt = monoNowMs();
+        if (isCompactionPrompt(live.lastPrompt)) {
+          live.stallWindowMs = void 0;
+          this.clearStall(live);
+          return;
+        }
         const window2 = firstFrame ? STREAM_FIRST_FRAME_MS : STREAM_STALL_MS;
         live.stallWindowMs = window2;
         if (!live.streaming) {
@@ -42533,7 +42768,7 @@ ${err2.stack}` : ""}` : String(err2);
           this.armStall(live, decision.ms);
           return;
         }
-        log(`Stream stall: no frames for ${STREAM_STALL_MS}ms on session ${live.sessionId || "(pending)"} \u2014 killing the dead turn so it can be retried`);
+        log(`Stream stall: no frames for ${live.stallWindowMs ?? STREAM_STALL_MS}ms on session ${live.sessionId || "(pending)"} \u2014 killing the dead turn so it can be retried`);
         live.stalled = true;
         this.hardKillSession(live);
       }
@@ -43989,10 +44224,10 @@ async function startHostedToolset(deps) {
   if (asyncTools) {
     try {
       hostedJobs = await Promise.resolve().then(() => (init_hosted_jobs(), hosted_jobs_exports));
-      const { tmpdir: tmpdir7 } = await import("node:os");
+      const { tmpdir: tmpdir9 } = await import("node:os");
       const { join: joinPath3 } = await import("node:path");
       const made = hostedJobs.createHostedJobRegistry({
-        dir: joinPath3(tmpdir7(), "tesseract-hosted-jobs", randomUUID9()),
+        dir: joinPath3(tmpdir9(), "tesseract-hosted-jobs", randomUUID9()),
         notifyModel: deps.notifyModel
       });
       jobs = made.registry;
@@ -44059,7 +44294,7 @@ async function startHostedToolset(deps) {
   await build();
   return { endpoint: endpoint2, sendBrowserResponse, tasks, refresh: build };
 }
-function buildHostTaskTools(registry3, run5) {
+function buildHostTaskTools(registry3, run8) {
   const text12 = (t, isError = false) => ({ content: [{ type: "text", text: t }], ...isError ? { isError: true } : {} });
   return [
     {
@@ -44081,7 +44316,7 @@ function buildHostTaskTools(registry3, run5) {
         const task = registry3.start("subagent", description);
         task.messages.push({ role: "user", content: prompt2 });
         try {
-          const out = await run5(prompt2, { signal: task.abort.signal });
+          const out = await run8(prompt2, { signal: task.abort.signal });
           if (task.status === "stopped")
             return text12(`Subagent "${description}" was stopped.`, true);
           task.status = "done";
@@ -78701,8 +78936,8 @@ var mesh_ca_exports = {};
 __export(mesh_ca_exports, {
   netCaCommand: () => netCaCommand
 });
-import { chmodSync as chmodSync8, existsSync as existsSync44, mkdirSync as mkdirSync44, readFileSync as readFileSync50, writeFileSync as writeFileSync43 } from "node:fs";
-import { join as join82, resolve as resolve13 } from "node:path";
+import { chmodSync as chmodSync8, existsSync as existsSync48, mkdirSync as mkdirSync44, readFileSync as readFileSync50, writeFileSync as writeFileSync45 } from "node:fs";
+import { join as join86, resolve as resolve13 } from "node:path";
 import { createInterface } from "node:readline";
 function die(msg) {
   console.error(msg);
@@ -78733,7 +78968,7 @@ async function readPassphrase(prompt2) {
   }
 }
 function writeSecretFile(p, bytes2) {
-  writeFileSync43(p, bytes2, { mode: 384 });
+  writeFileSync45(p, bytes2, { mode: 384 });
   try {
     chmodSync8(p, 384);
   } catch {
@@ -78747,9 +78982,9 @@ function ensureDir(p) {
   }
 }
 async function openCa(dir2) {
-  const gPath = join82(dir2, "genesis.bin");
-  const sPath = join82(dir2, "ca.sealed");
-  if (!existsSync44(gPath) || !existsSync44(sPath)) {
+  const gPath = join86(dir2, "genesis.bin");
+  const sPath = join86(dir2, "ca.sealed");
+  if (!existsSync48(gPath) || !existsSync48(sPath)) {
     die(`No mesh CA in ${dir2}. Run: tesseract-agent net init --org NAME --ca-dir ${dir2}`);
   }
   const genesisBytes = new Uint8Array(readFileSync50(gPath));
@@ -78770,7 +79005,7 @@ async function netCaCommand(rest, flags) {
   if (sub === "init") {
     const org = typeof flags.org === "string" ? flags.org.trim() : "";
     if (!org) die("Usage: tesseract-agent net init --org NAME [--ca-dir DIR]");
-    if (existsSync44(join82(caDir, "ca.sealed"))) {
+    if (existsSync48(join86(caDir, "ca.sealed"))) {
       die(`A mesh CA already exists in ${caDir}. Refusing to overwrite it.`);
     }
     const pass = await readPassphrase("New CA passphrase: ");
@@ -78792,9 +79027,9 @@ async function netCaCommand(rest, flags) {
     const genesisBytes = encodeGenesis(genesis);
     const fp = await genesisFingerprint(genesis);
     ensureDir(caDir);
-    writeFileSync43(join82(caDir, "genesis.bin"), genesisBytes);
-    writeSecretFile(join82(caDir, "ca.sealed"), encodeRecoveryBundle(await sealCaKey(seed, pass, `${org} mesh CA`)));
-    writeSecretFile(join82(caDir, "disablement.secret"), hex3(disable.secret));
+    writeFileSync45(join86(caDir, "genesis.bin"), genesisBytes);
+    writeSecretFile(join86(caDir, "ca.sealed"), encodeRecoveryBundle(await sealCaKey(seed, pass, `${org} mesh CA`)));
+    writeSecretFile(join86(caDir, "disablement.secret"), hex3(disable.secret));
     console.log(`
 Mesh created for "${org}".`);
     console.log(`  fingerprint: ${hex3(fp)}`);
@@ -78809,7 +79044,7 @@ Mesh created for "${org}".`);
     console.log(`  ${hex3(disable.secret)}`);
     console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
     console.log(`
-A copy of the disablement secret is in ${join82(caDir, "disablement.secret")}.`);
+A copy of the disablement secret is in ${join86(caDir, "disablement.secret")}.`);
     console.log("Move it somewhere the CA directory is not \u2014 holding both in one place");
     console.log("defeats the point of having two.");
     const caFlag = caDir === resolve13("./mesh-ca") ? "" : ` --ca-dir ${caDir}`;
@@ -78862,14 +79097,14 @@ Next, issue an identity for a machine (pick a free address in ${formatPrefix(gen
       [{ keyIndex: 0, privateKey: ca.privateKey }]
     );
     ensureDir(outDir);
-    writeFileSync43(join82(outDir, "genesis.bin"), genesisBytes);
-    writeFileSync43(join82(outDir, "node.cert"), encodeCert(cert));
-    writeSecretFile(join82(outDir, "node.key"), await exportStaticPrivate(nodeKey));
+    writeFileSync45(join86(outDir, "genesis.bin"), genesisBytes);
+    writeFileSync45(join86(outDir, "node.cert"), encodeCert(cert));
+    writeSecretFile(join86(outDir, "node.key"), await exportStaticPrivate(nodeKey));
     console.log(`Minted "${name}" at ${ip4}.`);
     console.log(`  ${outDir}`);
     console.log("\nCopy that directory to the node and run there:");
-    console.log(`  tesseract-agent net enroll --genesis ${join82(outDir, "genesis.bin")} \\`);
-    console.log(`      --cert ${join82(outDir, "node.cert")} --key ${join82(outDir, "node.key")}`);
+    console.log(`  tesseract-agent net enroll --genesis ${join86(outDir, "genesis.bin")} \\`);
+    console.log(`      --cert ${join86(outDir, "node.cert")} --key ${join86(outDir, "node.key")}`);
     console.log("\nnode.key is the node's identity \u2014 send it over a channel you trust, and");
     console.log("delete this copy once the node has it.");
     return;
@@ -78905,8 +79140,8 @@ Next, issue an identity for a machine (pick a free address in ${formatPrefix(gen
       ip4Exceptions: []
     };
     const signed = await signBundle(bundle, [{ keyIndex: 0, privateKey: ca.privateKey }]);
-    const out = resolve13(typeof flags.out === "string" ? flags.out : join82(caDir, "bundle.bin"));
-    writeFileSync43(out, encodeSignedBundle(signed));
+    const out = resolve13(typeof flags.out === "string" ? flags.out : join86(caDir, "bundle.bin"));
+    writeFileSync45(out, encodeSignedBundle(signed));
     console.log(`Signed policy bundle (epoch ${epoch2}) \u2192 ${out}`);
     console.log("Every node must receive it; the relay distributes it, or copy it to");
     console.log(`each node's mesh directory as bundle.bin.`);
@@ -78928,12 +79163,12 @@ var init_mesh_ca = __esm({
 
 // src/cli.ts
 init_base_paths();
-import { existsSync as existsSync45, mkdtempSync as mkdtempSync2, readFileSync as readFileSync52, rmSync as rmSync11 } from "node:fs";
+import { existsSync as existsSync49, mkdtempSync as mkdtempSync4, readFileSync as readFileSync52, rmSync as rmSync13 } from "node:fs";
 import { createHash as createHash9 } from "node:crypto";
-import { execFileSync as execFileSync6, spawn as spawn11 } from "node:child_process";
-import { fileURLToPath as fileURLToPath7 } from "node:url";
-import { tmpdir as tmpdir6 } from "node:os";
-import { dirname as dirname36, join as join83, resolve as resolve15 } from "node:path";
+import { execFileSync as execFileSync6, spawn as spawn14 } from "node:child_process";
+import { fileURLToPath as fileURLToPath8 } from "node:url";
+import { tmpdir as tmpdir8 } from "node:os";
+import { dirname as dirname38, join as join87, resolve as resolve15 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline/promises";
 
 // ../../packages/host-core/dist/control-link.js
@@ -80492,6 +80727,7 @@ async function createClaudeCodeBackend(send4, onBrowserRequest, loadPluginRuntim
     respondToPermission: (requestId, decision, callerOrigin) => manager2.respondToPermission(requestId, decision, callerOrigin),
     setNarrationLlm: (cfg2) => manager2.setNarrationLlm(cfg2),
     setVerifierLlm: (fn) => manager2.setVerifierLlm(fn),
+    setHostEnv: (env) => manager2.setHostEnv(env),
     setImageGen: (runner3) => manager2.setImageGen(runner3),
     setSerpApi: (deps) => manager2.setSerpApi(deps),
     setVideoGen: (runner3) => manager2.setVideoGen(runner3),
@@ -81796,9 +82032,9 @@ function resolveBundledMcpBin(basename14, envOverride) {
   if (cached3 !== void 0)
     return cached3;
   const candidates = [];
-  const override2 = envOverride ? process.env[envOverride] : void 0;
-  if (override2)
-    candidates.push(override2);
+  const override3 = envOverride ? process.env[envOverride] : void 0;
+  if (override3)
+    candidates.push(override3);
   const rp = process.resourcesPath;
   if (rp)
     candidates.push(join26(rp, "host-daemon", basename14));
@@ -83076,7 +83312,7 @@ function createAcpBackend(engine, send4, resolve16, onBrowserRequest, loadPlugin
           return;
         return sendMessage({ ...prev, message, sessionId: sid, autoContinuation: true });
       },
-      log: (m) => console.warn(`[${LABEL2}] ${m}`)
+      log: (m) => console.warn(`[${LABEL3}] ${m}`)
     });
     return noticeDispatcher;
   };
@@ -83298,7 +83534,7 @@ function createAcpBackend(engine, send4, resolve16, onBrowserRequest, loadPlugin
             ...cappedOut ? { cappedOut: true } : {}
           }, turn.origin);
         },
-        log: (m, e) => console.warn(`[${LABEL2}] ${m}`, e ?? "")
+        log: (m, e) => console.warn(`[${LABEL3}] ${m}`, e ?? "")
       });
     });
   }
@@ -83536,7 +83772,7 @@ function createAcpBackend(engine, send4, resolve16, onBrowserRequest, loadPlugin
                 ...cappedOut ? { cappedOut: true } : {}
               }, turn.origin);
             },
-            log: (m, e) => console.warn(`[${LABEL2}] ${m}`, e ?? "")
+            log: (m, e) => console.warn(`[${LABEL3}] ${m}`, e ?? "")
           });
         });
       });
@@ -83589,13 +83825,13 @@ function createAcpBackend(engine, send4, resolve16, onBrowserRequest, loadPlugin
         agentMcp = agentCaps?.mcpCapabilities;
         const authed = await withTimeout2(authenticateIfOffered(t, init?.authMethods), AUTH_TIMEOUT_MS, `${engine.label} did not finish authenticating.`).catch(() => false);
         if (init?.authMethods?.length && !authed) {
-          console.warn(`[${LABEL2}] no authentication method was accepted; session/load and resume may fail.`);
+          console.warn(`[${LABEL3}] no authentication method was accepted; session/load and resume may fail.`);
         }
         if (apiPort) {
           const api = createEngineHttpApi(apiPort, engine.httpApi?.host ?? "127.0.0.1");
           httpApi = await api.ready() ? api : null;
           if (!httpApi)
-            console.warn(`[${LABEL2}] its HTTP API did not come up on ${apiPort}; using the ACP path only.`);
+            console.warn(`[${LABEL3}] its HTTP API did not come up on ${apiPort}; using the ACP path only.`);
         }
       } catch (e) {
         try {
@@ -83942,7 +84178,9 @@ ${text12}`);
       const usage2 = contextUsageFor(live);
       const verdict = shouldCompactProactively({
         mode: unattendedModeFor({ optedIn: params.unattended, origin: params.origin }),
-        pct: readDaemonAgentSettings().autoCompactPct,
+        // The conversation's own threshold when its client sent one (per-conversation there),
+        // else the machine-wide setting.
+        pct: params.autoCompactPct ?? readDaemonAgentSettings().autoCompactPct,
         usagePct: typeof usage2?.percentage === "number" ? usage2.percentage : null,
         lastCompactPct: proactiveCompactedAt.get(live) ?? null,
         inFlight: false
@@ -83954,7 +84192,7 @@ ${text12}`);
       if (verdict !== "compact")
         return;
       proactiveCompactedAt.set(live, usage2?.percentage ?? 0);
-      console.warn(`[${LABEL2}] auto-compact: ${Math.round(usage2?.percentage ?? 0)}% of the window used \u2014 compacting`);
+      console.warn(`[${LABEL3}] auto-compact: ${Math.round(usage2?.percentage ?? 0)}% of the window used \u2014 compacting`);
       await sendMessage({ ...params, message: OVERFLOW_COMPACT_MESSAGE, sessionId: live, autoContinuation: true });
       const now2 = sessionRekey.get(live) ?? live;
       if (now2 !== live) {
@@ -83962,7 +84200,7 @@ ${text12}`);
         proactiveCompactedAt.delete(live);
       }
     } catch (err2) {
-      console.warn(`[${LABEL2}] auto-compact failed:`, err2 instanceof Error ? err2.message : String(err2));
+      console.warn(`[${LABEL3}] auto-compact failed:`, err2 instanceof Error ? err2.message : String(err2));
     }
   }
   async function sendMessage(params) {
@@ -84281,7 +84519,7 @@ ${detail}` : detail, !overflow);
     }
   }
   const declared = declaredCaps;
-  const LABEL2 = engine.label;
+  const LABEL3 = engine.label;
   let hostedBoot = null;
   async function ensureHostedToolset() {
     if (!declared.toolInjection || hostedEndpoint)
@@ -84313,7 +84551,7 @@ ${detail}` : detail, !overflow);
           // own permission gate, and it cannot disturb the parent's turn state.
           runSubagent: async (prompt2, { signal }) => {
             if (!transport || !spawnedCwd)
-              throw new Error(`${LABEL2} is not running.`);
+              throw new Error(`${LABEL3} is not running.`);
             const res = await transport.request("session/new", { cwd: spawnedCwd, mcpServers: [] });
             const sub = res?.sessionId;
             if (!sub)
@@ -84340,7 +84578,7 @@ ${detail}` : detail, !overflow);
         hostTasks = ht.tasks;
         refreshHostedTools = ht.refresh;
       } catch (e) {
-        console.warn(`[${LABEL2}] host toolset unavailable:`, e);
+        console.warn(`[${LABEL3}] host toolset unavailable:`, e);
       }
     })();
     await hostedBoot;
@@ -85155,7 +85393,7 @@ function createCodexAppServerBackend(send4, resolve16, onBrowserRequest, loadPlu
   const HOSTED_TOKEN_ENV = "TESSERACT_MCP_TOKEN";
   const label = engineById(ENGINE_ID2)?.label ?? "Codex";
   const declared = engineById(ENGINE_ID2)?.capabilities ?? {};
-  const LABEL2 = label;
+  const LABEL3 = label;
   const lastSendParams = /* @__PURE__ */ new Map();
   let noticeDispatcher = null;
   const jobNotices = () => {
@@ -85243,7 +85481,7 @@ function createCodexAppServerBackend(send4, resolve16, onBrowserRequest, loadPlu
         hostTasks = ht.tasks;
         refreshHostedTools = ht.refresh;
       } catch (e) {
-        console.warn(`[${LABEL2}] host toolset unavailable:`, e);
+        console.warn(`[${LABEL3}] host toolset unavailable:`, e);
       }
     })();
     await hostedBoot;
@@ -85769,7 +86007,9 @@ function createCodexAppServerBackend(send4, resolve16, onBrowserRequest, loadPlu
       const usage2 = contextUsageFor(threadId);
       const verdict = shouldCompactProactively({
         mode: unattendedModeFor({ optedIn: params.unattended, origin: params.origin }),
-        pct: readDaemonAgentSettings().autoCompactPct,
+        // The conversation's own threshold when its client sent one (per-conversation there),
+        // else the machine-wide setting.
+        pct: params.autoCompactPct ?? readDaemonAgentSettings().autoCompactPct,
         usagePct: typeof usage2?.percentage === "number" ? usage2.percentage : null,
         lastCompactPct: proactiveCompactedAt.get(threadId) ?? null,
         inFlight: false
@@ -85781,10 +86021,10 @@ function createCodexAppServerBackend(send4, resolve16, onBrowserRequest, loadPlu
       if (verdict !== "compact")
         return;
       proactiveCompactedAt.set(threadId, usage2?.percentage ?? 0);
-      console.warn(`[${LABEL2}] auto-compact: ${Math.round(usage2?.percentage ?? 0)}% of the window used \u2014 compacting`);
+      console.warn(`[${LABEL3}] auto-compact: ${Math.round(usage2?.percentage ?? 0)}% of the window used \u2014 compacting`);
       await sendMessage({ ...params, message: OVERFLOW_COMPACT_MESSAGE, sessionId: threadId, autoContinuation: true });
     } catch (err2) {
-      console.warn(`[${LABEL2}] auto-compact failed:`, err2 instanceof Error ? err2.message : String(err2));
+      console.warn(`[${LABEL3}] auto-compact failed:`, err2 instanceof Error ? err2.message : String(err2));
     }
   }
   async function sendMessage(params) {
@@ -87243,8 +87483,8 @@ var pluginTtsProviders = [];
 var loadedGeneration = [];
 var loadQueue = Promise.resolve();
 function loadPluginRuntime(opts) {
-  const run5 = () => loadPluginRuntimeSerial(opts);
-  const next = loadQueue.then(run5, run5);
+  const run8 = () => loadPluginRuntimeSerial(opts);
+  const next = loadQueue.then(run8, run8);
   loadQueue = next.catch(() => void 0);
   return next;
 }
@@ -89957,7 +90197,7 @@ var VoiceControl = class {
     };
     let llm = null;
     try {
-      const cfg2 = await buildClaudeNarrationLlm();
+      const cfg2 = await buildClaudeNarrationLlm(daemonEngineEnv());
       llm = cfg2?.complete ?? null;
     } catch {
     }
@@ -90164,17 +90404,17 @@ async function launchCompanionBrowser() {
   if (!first) {
     throw new Error('No browser on this machine has the Tesseract Companion extension installed, so there is nothing to drive. Install the Companion in Chrome (or another Chromium browser), or use target:"internal" to use the browser inside Tesseract.');
   }
-  const { execFile: execFile11 } = await import("node:child_process");
-  const run5 = (cmd, args) => new Promise((resolve16, reject) => {
-    execFile11(cmd, args, { timeout: 15e3 }, (err2) => err2 ? reject(err2) : resolve16());
+  const { execFile: execFile15 } = await import("node:child_process");
+  const run8 = (cmd, args) => new Promise((resolve16, reject) => {
+    execFile15(cmd, args, { timeout: 15e3 }, (err2) => err2 ? reject(err2) : resolve16());
   });
   try {
     if (process.platform === "darwin")
-      await run5("open", ["-a", first.launch]);
+      await run8("open", ["-a", first.launch]);
     else if (process.platform === "win32")
-      await run5("cmd", ["/c", "start", "", first.launch]);
+      await run8("cmd", ["/c", "start", "", first.launch]);
     else
-      await run5(first.launch, []);
+      await run8(first.launch, []);
   } catch (err2) {
     throw new Error(`Could not start ${first.name}: ${err2 instanceof Error ? err2.message : String(err2)}`);
   }
@@ -91434,10 +91674,10 @@ function buildEnhanceChain(spec) {
     steps.push(`upscale\xD7${f}`);
     resizes = true;
   }
-  const sh = spec.sharpen ?? "light";
-  if (sh !== "none") {
-    parts.push(`cas=strength=${SHARPEN[sh]}`);
-    steps.push(`sharpen:${sh}`);
+  const sh3 = spec.sharpen ?? "light";
+  if (sh3 !== "none") {
+    parts.push(`cas=strength=${SHARPEN[sh3]}`);
+    steps.push(`sharpen:${sh3}`);
   }
   if (spec.deband) {
     parts.push("deband");
@@ -92368,11 +92608,11 @@ function pickProvider(c) {
   return null;
 }
 function modelFor(id, pc, quality) {
-  const override2 = pc.model?.trim();
+  const override3 = pc.model?.trim();
   if (id === "tesseract")
-    return override2 || FREE_MODEL;
-  if (override2)
-    return override2;
+    return override3 || FREE_MODEL;
+  if (override3)
+    return override3;
   return quality === "standard" ? STANDARD_MODEL : FAST_MODEL;
 }
 function estimateFor(id, model, durationSec) {
@@ -93212,8 +93452,8 @@ async function falTopazEnhance(path6, spec, opts) {
   const dir2 = opts.outDir ?? workDir();
   mkdirSync21(dir2, { recursive: true });
   const outPath = join42(dir2, "enhanced.mp4");
-  const { writeFileSync: writeFileSync44 } = await import("node:fs");
-  writeFileSync44(outPath, Buffer.from(await dl.arrayBuffer()));
+  const { writeFileSync: writeFileSync46 } = await import("node:fs");
+  writeFileSync46(outPath, Buffer.from(await dl.arrayBuffer()));
   const out = await probeMedia(outPath).catch(() => null);
   opts.onProgress?.(100, "Enhance complete");
   return { path: outPath, mime: MIME, width: out?.width ?? null, height: out?.height ?? null, durationSec: out?.durationSec ?? p.durationSec, summary: `fal Topaz ${spec.model ?? "Proteus"} \xD7${spec.upscaleFactor ?? 2}` };
@@ -95048,17 +95288,25 @@ function buildSharedBackend(engineId) {
       return b;
     backend = b;
     refreshDaemonScheduling(b);
-    void buildClaudeNarrationLlm().then((cfg2) => {
+    const runnerEnv = (() => {
+      try {
+        return daemonEngineEnv();
+      } catch {
+        return void 0;
+      }
+    })();
+    b.setHostEnv?.(runnerEnv ?? null);
+    void buildClaudeNarrationLlm(runnerEnv).then((cfg2) => {
       if (cfg2) {
         b.setNarrationLlm?.(cfg2);
-        log("narration: enabled (Claude Haiku)");
+        log(`narration: enabled (${runnerEnv?.ANTHROPIC_BASE_URL ?? "api.anthropic.com"})`);
       } else
         log("narration: disabled \u2014 no Claude creds resolved");
     }).catch((e) => log("narration: setup failed:", e instanceof Error ? e.message : String(e)));
-    void buildClaudeSmartLlm().then((fn) => {
+    void buildClaudeSmartLlm(runnerEnv).then((fn) => {
       if (fn) {
         b.setVerifierLlm?.(fn);
-        log("reinforced-verification: grader enabled");
+        log(`reinforced-verification: grader enabled (${runnerEnv?.ANTHROPIC_BASE_URL ?? "api.anthropic.com"})`);
       } else
         log("reinforced-verification: disabled \u2014 no Claude creds resolved");
     }).catch((e) => log("reinforced-verification: setup failed:", e instanceof Error ? e.message : String(e)));
@@ -98827,9 +99075,9 @@ var NodeFsHandler = class {
     if (this.fsw.closed) {
       return;
     }
-    const dirname37 = sysPath.dirname(file2);
+    const dirname39 = sysPath.dirname(file2);
     const basename14 = sysPath.basename(file2);
-    const parent = this.fsw._getWatchedDir(dirname37);
+    const parent = this.fsw._getWatchedDir(dirname39);
     let prevStats = stats;
     if (parent.has(basename14))
       return;
@@ -98856,7 +99104,7 @@ var NodeFsHandler = class {
             prevStats = newStats2;
           }
         } catch (error51) {
-          this.fsw._remove(dirname37, basename14);
+          this.fsw._remove(dirname39, basename14);
         }
       } else if (parent.has(basename14)) {
         const at = newStats.atimeMs;
@@ -103299,8 +103547,8 @@ async function wakeDisplay(log9) {
   if (process.platform !== "darwin")
     return;
   try {
-    const { spawn: spawn12 } = await import("node:child_process");
-    spawn12("caffeinate", ["-u", "-t", "5"], { detached: true, stdio: "ignore" }).unref();
+    const { spawn: spawn15 } = await import("node:child_process");
+    spawn15("caffeinate", ["-u", "-t", "5"], { detached: true, stdio: "ignore" }).unref();
     log9?.("display was asleep \u2014 declared user activity to wake it");
     await new Promise((r) => setTimeout(r, 1200));
   } catch {
@@ -104136,9 +104384,9 @@ function hasRdeskPassword() {
 function verifyRdeskPassword(password) {
   if (!password)
     return false;
-  const override2 = process.env.CCB_RDESK_PASSWORD;
-  if (override2)
-    return password.length === override2.length && timingSafeEqual4(Buffer.from(password), Buffer.from(override2));
+  const override3 = process.env.CCB_RDESK_PASSWORD;
+  if (override3)
+    return password.length === override3.length && timingSafeEqual4(Buffer.from(password), Buffer.from(override3));
   try {
     const { salt, hash: hash2 } = JSON.parse(readFileSync40(pwFile(), "utf8"));
     const got = scryptSync(password, Buffer.from(salt, "hex"), 32);
@@ -107563,6 +107811,16 @@ var LanDiscovery = class {
 var _a3;
 var requireCjs = createRequire4(import.meta.url);
 function loadMeshCore() {
+  for (const spec of [
+    "@fineguide-tesseract/mesh-core",
+    "./mesh-core/index.js",
+    "../mesh-core/index.js"
+  ]) {
+    try {
+      return requireCjs(spec);
+    } catch {
+    }
+  }
   try {
     return requireCjs("@fineguide-tesseract/mesh-core");
   } catch (e) {
@@ -109475,12 +109733,12 @@ function watchForIdentity(deps) {
     const wait = Math.min(max, Math.round(delay3 * (1 + (random() * 2 - 1) * JITTER)));
     timer2 = setTimeout(() => {
       timer2 = null;
-      void run5("backoff");
+      void run8("backoff");
     }, wait);
     timer2.unref?.();
     delay3 = Math.min(max, Math.round(delay3 * FACTOR));
   };
-  async function run5(reason) {
+  async function run8(reason) {
     if (stopped2 || settled || inFlight2)
       return;
     inFlight2 = true;
@@ -109512,10 +109770,10 @@ function watchForIdentity(deps) {
       return;
     delay3 = first;
     clear();
-    void run5(reason);
+    void run8(reason);
   };
   unsubscribe = (deps.subscribe ?? subscribeToWakeSignals)(nudge);
-  void run5("boot");
+  void run8("boot");
   return {
     ready,
     nudge,
@@ -112114,9 +112372,8 @@ function meshIdOf(cert) {
 // ../../packages/host-core/dist/mesh/full-tunnel.js
 function fullTunnelState(i) {
   const no2 = (reason) => ({ allowed: false, reason, warnings: [] });
-  if (i.platform !== "linux") {
-    const name = i.platform === "darwin" ? "macOS" : i.platform === "win32" ? "Windows" : i.platform;
-    return no2(`Routing all traffic needs the network helper, which does not exist on ${name} yet.`);
+  if (i.platform !== "linux" && i.platform !== "darwin" && i.platform !== "win32") {
+    return no2(`Routing all traffic needs the network helper, which does not exist on ${i.platform} yet.`);
   }
   if (!i.engineAvailable) {
     return no2("This build shipped without the network engine, so no traffic can be routed. That is a packaging fault \u2014 please report it.");
@@ -112169,21 +112426,685 @@ function bundleGrantsExitNode(bundle) {
 // ../../packages/host-core/dist/mesh/machine-owner.js
 init_credentials();
 
-// ../../packages/host-core/dist/service/exec.js
-import { execFile as execFile10, spawn as spawn9 } from "node:child_process";
+// ../../packages/host-core/dist/net-service/ensure-installed.js
+import { execFile as execFile14 } from "node:child_process";
+import { existsSync as existsSync42 } from "node:fs";
+import { dirname as dirname34, join as join80 } from "node:path";
+import { promisify as promisify10 } from "node:util";
+
+// ../../packages/host-core/dist/net-service/launchd-system.js
+import { spawn as spawn9 } from "node:child_process";
+import { existsSync as existsSync39, mkdtempSync as mkdtempSync2, writeFileSync as writeFileSync40, rmSync as rmSync10 } from "node:fs";
+import { tmpdir as tmpdir6 } from "node:os";
+import { join as join77 } from "node:path";
+
+// ../../packages/host-core/dist/net-service/elevation.js
+import { execFile as execFile10 } from "node:child_process";
 import { promisify as promisify6 } from "node:util";
 var run4 = promisify6(execFile10);
-function runInherit(cmd, args) {
+async function alreadyElevated() {
+  if (process.platform === "win32") {
+    try {
+      const { stdout } = await run4("powershell.exe", [
+        "-NoProfile",
+        "-Command",
+        "(New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
+      ]);
+      return String(stdout).trim().toLowerCase() === "true";
+    } catch {
+      return false;
+    }
+  }
+  return typeof process.getuid === "function" && process.getuid() === 0;
+}
+
+// ../../packages/host-core/dist/net-service/launchd-system.js
+var LABEL2 = "dev.tesseract.netd";
+var PLIST = `/Library/LaunchDaemons/${LABEL2}.plist`;
+function xml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function sh(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+function buildPlist(spec) {
+  const argv = [
+    spec.exec,
+    "--state-dir",
+    spec.stateDir,
+    "--socket",
+    spec.socket,
+    "--owner-uid",
+    String(spec.ownerUid)
+  ];
+  const args = argv.map((a) => `      <string>${xml(a)}</string>`).join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>Label</key>
+    <string>${LABEL2}</string>
+    <key>ProgramArguments</key>
+    <array>
+${args}
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <!-- on-failure only, exactly like systemd's Restart=on-failure: a helper that exits 0
+         has been asked to stop, and restarting it would fight the operator. -->
+    <key>KeepAlive</key>
+    <dict>
+      <key>SuccessfulExit</key>
+      <false/>
+    </dict>
+    <!-- launchd has no equivalent of systemd's StartLimitBurst, so a PERMANENT failure \u2014
+         netd refusing to start on an unreadable journal \u2014 respawns forever rather than
+         landing in a failed state. 30s keeps that out of the log and off the CPU; the
+         remedy is still 'net doctor', which reads the real table. -->
+    <key>ThrottleInterval</key>
+    <integer>30</integer>
+    <key>ProcessType</key>
+    <string>Interactive</string>
+    <key>StandardErrorPath</key>
+    <string>${xml(join77(spec.stateDir, "netd.log"))}</string>
+    <key>StandardOutPath</key>
+    <string>${xml(join77(spec.stateDir, "netd.log"))}</string>
+  </dict>
+</plist>
+`;
+}
+function runForCode(cmd, args) {
   return new Promise((resolve16) => {
     const p = spawn9(cmd, args, { stdio: "inherit" });
+    p.on("error", () => resolve16(127));
+    p.on("close", (code) => resolve16(code ?? 1));
+  });
+}
+async function elevate(script) {
+  const dir2 = mkdtempSync2(join77(tmpdir6(), "tesseract-netd-"));
+  const path6 = join77(dir2, "install.sh");
+  try {
+    writeFileSync40(path6, script, { mode: 384 });
+    if (await alreadyElevated()) {
+      return { code: await runForCode("/bin/sh", [path6]), declined: false };
+    }
+    const code = await runForCode("osascript", [
+      "-e",
+      `do shell script "/bin/sh " & quoted form of "${path6}" with administrator privileges`
+    ]);
+    return { code, declined: code === 1 };
+  } finally {
+    try {
+      rmSync10(dir2, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+function makeLaunchDaemon() {
+  return {
+    supported: process.platform === "darwin",
+    async install(spec) {
+      const plist = buildPlist(spec);
+      const script = [
+        "set -e",
+        `/usr/bin/install -d -m 0700 -o root -g wheel ${sh(spec.stateDir)}`,
+        `cat > ${sh(PLIST)} <<'TESSERACT_PLIST_EOF'
+${plist}TESSERACT_PLIST_EOF`,
+        // launchd REFUSES to load a plist that is group- or world-writable, and says so in
+        // a way that reads as a permissions problem with the binary rather than the file.
+        `chown root:wheel ${sh(PLIST)}`,
+        `chmod 644 ${sh(PLIST)}`,
+        // bootout first so a reinstall replaces a loaded job rather than failing with
+        // "service already loaded". `|| true` because not-loaded is the ordinary case.
+        `/bin/launchctl bootout system/${LABEL2} 2>/dev/null || true`,
+        `/bin/launchctl bootstrap system ${sh(PLIST)}`,
+        `/bin/launchctl enable system/${LABEL2}`
+      ].join("\n");
+      const { code, declined } = await elevate(`${script}
+`);
+      if (code !== 0) {
+        return {
+          ok: false,
+          detail: declined ? "the elevation prompt was declined" : `installing the helper failed (exit ${code})`
+        };
+      }
+      return { ok: true };
+    },
+    async uninstall() {
+      const script = [
+        `/bin/launchctl bootout system/${LABEL2} 2>/dev/null || true`,
+        `rm -f ${sh(PLIST)}`
+      ].join("\n");
+      const { code, declined } = await elevate(`${script}
+`);
+      return code === 0 ? { ok: true } : {
+        ok: false,
+        detail: declined ? "the elevation prompt was declined" : `removing the helper failed (exit ${code})`
+      };
+    },
+    async state() {
+      if (!existsSync39(PLIST))
+        return { installed: false, running: false };
+      const running2 = await netdAvailable();
+      return {
+        installed: true,
+        running: running2,
+        ...running2 ? {} : {
+          detail: `the helper is installed but not answering \u2014 check ${LABEL2} in Console, or reinstall it`
+        }
+      };
+    },
+    async openApprovalSettings() {
+    }
+  };
+}
+
+// ../../packages/host-core/dist/net-service/systemd-system.js
+import { spawn as spawn11 } from "node:child_process";
+import { existsSync as existsSync40 } from "node:fs";
+
+// ../../packages/host-core/dist/service/exec.js
+import { execFile as execFile11, spawn as spawn10 } from "node:child_process";
+import { promisify as promisify7 } from "node:util";
+var run5 = promisify7(execFile11);
+function runInherit(cmd, args) {
+  return new Promise((resolve16) => {
+    const p = spawn10(cmd, args, { stdio: "inherit" });
     p.on("error", () => resolve16());
     p.on("close", () => resolve16());
   });
 }
 
 // ../../packages/host-core/dist/net-service/systemd-system.js
+function runForCode2(cmd, args) {
+  return new Promise((resolve16) => {
+    const p = spawn11(cmd, args, { stdio: "inherit" });
+    p.on("error", () => resolve16(127));
+    p.on("close", (code) => resolve16(code ?? 1));
+  });
+}
+async function tryRun(cmd, args) {
+  try {
+    const { stdout } = await run5(cmd, args);
+    return { stdout: String(stdout), code: 0 };
+  } catch (e) {
+    const err2 = e;
+    return { stdout: String(err2.stdout ?? ""), code: typeof err2.code === "number" ? err2.code : 1 };
+  }
+}
+async function elevated(script) {
+  return await alreadyElevated() ? runForCode2("sh", ["-c", script]) : runForCode2("pkexec", ["sh", "-c", script]);
+}
 var UNIT = "tesseract-netd.service";
 var UNIT_PATH = `/etc/systemd/system/${UNIT}`;
+function unitVal(v) {
+  return v.replace(/%/g, "%%");
+}
+function buildUnit(spec) {
+  const exec2 = [
+    spec.exec,
+    "--state-dir",
+    spec.stateDir,
+    "--socket",
+    spec.socket,
+    "--owner-uid",
+    String(spec.ownerUid)
+  ].map(unitVal).join(" ");
+  return `[Unit]
+Description=Tesseract network helper (mesh routes and tunnel device)
+Documentation=https://tesseract.dev/docs/mesh
+After=network-online.target
+Wants=network-online.target
+# A START LIMIT, because some failures are PERMANENT and restarting cannot fix them. An
+# unreadable journal is the one that proved it: netd refuses to start while routes may be
+# installed that it cannot identify, and without this the unit loops forever \u2014 measured at
+# 7 attempts in 30s on a real box, filling the log and never reaching a state an operator
+# can see as "stopped, needs attention". After 5 failures in 60s systemd gives up and marks
+# it failed, which is what state() reports.
+#
+# These belong in [Unit]: they are documented in systemd.unit(5), not systemd.service(5),
+# and systemd silently IGNORES them in the [Service] section \u2014 which is where I first put
+# them.
+StartLimitIntervalSec=60
+StartLimitBurst=5
+
+[Service]
+# notify, so 'systemctl start' does not return before the socket exists \u2014 otherwise the
+# app connects to a service systemd calls started and gets ENOENT.
+Type=notify
+NotifyAccess=main
+ExecStart=${exec2}
+# Exactly what programming routes and opening a tun device need. NOT setcap: that grants
+# the capability to the FILE, so anything executing it inherits the grant, and it is
+# silently ignored on AppImage's nosuid FUSE mount \u2014 the only auto-updating Linux target.
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
+NoNewPrivileges=yes
+# This process is reachable over a socket by anything on the machine. Everything below
+# bounds what a bug in it could reach.
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+RestrictNamespaces=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+# The journal directory is the ONLY thing it may write.
+ReadWritePaths=${unitVal(spec.stateDir)}
+DeviceAllow=/dev/net/tun rw
+# on-failure, never always: a helper that exits 0 has been asked to stop, and restarting
+# it would fight the operator.
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function makeSystemdSystem() {
+  return {
+    supported: process.platform === "linux",
+    async install(spec) {
+      const unit = buildUnit(spec);
+      const script = [
+        `install -d -m 0700 ${sh2(spec.stateDir)}`,
+        `cat > ${sh2(UNIT_PATH)} <<'TESSERACT_UNIT_EOF'
+${unit}TESSERACT_UNIT_EOF`,
+        "systemctl daemon-reload",
+        `systemctl enable --now ${UNIT}`
+      ].join("\n");
+      const code = await elevated(script);
+      if (code !== 0) {
+        const declined = code === 126 || code === 127;
+        return {
+          ok: false,
+          detail: declined ? "the elevation prompt was declined" : `installing the helper failed (exit ${code})`
+        };
+      }
+      return { ok: true };
+    },
+    async uninstall() {
+      const script = [
+        `systemctl disable --now ${UNIT} || true`,
+        `rm -f ${sh2(UNIT_PATH)}`,
+        "systemctl daemon-reload"
+      ].join("\n");
+      const code = await elevated(script);
+      return code === 0 ? { ok: true } : { ok: false, detail: `removing the helper failed (exit ${code})` };
+    },
+    async state() {
+      if (!existsSync40(UNIT_PATH))
+        return { installed: false, running: false };
+      const active = await tryRun("systemctl", ["is-active", UNIT]);
+      const running2 = active.stdout.trim() === "active";
+      if (running2)
+        return { installed: true, running: true };
+      const show = await tryRun("systemctl", ["show", UNIT, "--property=Result", "--value"]);
+      const result = show.stdout.trim();
+      return {
+        installed: true,
+        running: false,
+        ...result && result !== "success" ? { detail: `the helper failed: ${result}` } : {}
+      };
+    },
+    async openApprovalSettings() {
+    }
+  };
+}
+function sh2(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+
+// ../../packages/host-core/dist/net-service/windows-service.js
+import { execFile as execFile12, spawn as spawn12 } from "node:child_process";
+import { mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync41, rmSync as rmSync11 } from "node:fs";
+import { tmpdir as tmpdir7 } from "node:os";
+import { join as join78 } from "node:path";
+import { promisify as promisify8 } from "node:util";
+var run6 = promisify8(execFile12);
+var SERVICE = "TesseractNetd";
+var DISPLAY = "Tesseract network helper";
+var ERROR_CANCELLED = 1223;
+function ps(s) {
+  return `'${s.replace(/'/g, "''")}'`;
+}
+function buildBinaryPath(spec) {
+  const parts = [
+    spec.exec,
+    // NOT optional, and its absence is silent. The SCM launches the process and waits for it
+    // to call `StartServiceCtrlDispatcher`; without this flag netd runs its console path
+    // instead, never reports a status, and the SCM gives up — leaving a service that is
+    // registered, visible in services.msc, refuses to start, and reports exit code 0. That
+    // exact state was reproduced on the Windows build machine before the flag existed.
+    "--service",
+    "--state-dir",
+    spec.stateDir,
+    "--socket",
+    spec.socket
+  ];
+  if (spec.ownerSid)
+    parts.push("--owner-sid", spec.ownerSid);
+  return parts.map((p) => `"${p}"`).join(" ");
+}
+async function elevatePowerShell(script) {
+  const dir2 = mkdtempSync3(join78(tmpdir7(), "tesseract-netd-"));
+  const inner = join78(dir2, "install.ps1");
+  writeFileSync41(inner, script, { encoding: "utf8" });
+  if (await alreadyElevated()) {
+    return new Promise((resolve16) => {
+      const p = spawn12("powershell.exe", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", inner], { stdio: "inherit" });
+      const finish = (code) => {
+        try {
+          rmSync11(dir2, { recursive: true, force: true });
+        } catch {
+        }
+        resolve16({ code, declined: false });
+      };
+      p.on("error", () => finish(127));
+      p.on("close", (code) => finish(code ?? 1));
+    });
+  }
+  const outer = join78(dir2, "elevate.ps1");
+  writeFileSync41(outer, [
+    '$ErrorActionPreference = "Stop"',
+    "try {",
+    `  $p = Start-Process -FilePath "powershell.exe" -ArgumentList @("-NoProfile","-ExecutionPolicy","Bypass","-File",${ps(inner)}) -Verb RunAs -Wait -PassThru`,
+    "  exit $p.ExitCode",
+    "} catch {",
+    `  exit ${ERROR_CANCELLED}`,
+    "}"
+  ].join("\n"), { encoding: "utf8" });
+  return new Promise((resolve16) => {
+    const p = spawn12("powershell.exe", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", outer], { stdio: "inherit" });
+    const finish = (code) => {
+      try {
+        rmSync11(dir2, { recursive: true, force: true });
+      } catch {
+      }
+      resolve16({ code, declined: code === ERROR_CANCELLED });
+    };
+    p.on("error", () => finish(127));
+    p.on("close", (code) => finish(code ?? 1));
+  });
+}
+function buildInstallScript(spec) {
+  const bin = buildBinaryPath(spec);
+  return [
+    '$ErrorActionPreference = "Stop"',
+    `New-Item -ItemType Directory -Force -Path ${ps(spec.stateDir)} | Out-Null`,
+    // A reinstall must replace, not fail. Stop first: New-Service refuses a name that
+    // exists, and sc.exe delete on a running service only marks it for deletion.
+    `$existing = Get-Service -Name ${ps(SERVICE)} -ErrorAction SilentlyContinue`,
+    "if ($existing) {",
+    `  Stop-Service -Name ${ps(SERVICE)} -Force -ErrorAction SilentlyContinue`,
+    `  & sc.exe delete ${SERVICE} | Out-Null`,
+    "  Start-Sleep -Milliseconds 500",
+    "}",
+    `New-Service -Name ${ps(SERVICE)} -BinaryPathName ${ps(bin)} -DisplayName ${ps(DISPLAY)} -Description ${ps("Programs the routes for Tesseract private networks and owns the tunnel device.")} -StartupType Automatic | Out-Null`,
+    // Restart on failure, three times, then stop trying. The Windows equivalent of
+    // systemd's Restart=on-failure with a start limit — netd refuses to start while an
+    // unreadable journal may mean routes are installed, and that is a PERMANENT failure
+    // no amount of restarting fixes.
+    `& sc.exe failure ${SERVICE} reset= 86400 actions= restart/5000/restart/5000/restart/5000 | Out-Null`,
+    `Start-Service -Name ${ps(SERVICE)}`,
+    "exit 0"
+  ].join("\n");
+}
+function buildUninstallScript() {
+  return [
+    `Stop-Service -Name ${ps(SERVICE)} -Force -ErrorAction SilentlyContinue`,
+    `& sc.exe delete ${SERVICE} | Out-Null`,
+    "exit 0"
+  ].join("\n");
+}
+function makeWindowsService() {
+  return {
+    supported: process.platform === "win32",
+    async install(spec) {
+      const { code, declined } = await elevatePowerShell(`${buildInstallScript(spec)}
+`);
+      if (code !== 0) {
+        return {
+          ok: false,
+          detail: declined ? "the elevation prompt was declined" : `installing the helper failed (exit ${code})`
+        };
+      }
+      return { ok: true };
+    },
+    async uninstall() {
+      const { code, declined } = await elevatePowerShell(`${buildUninstallScript()}
+`);
+      return code === 0 ? { ok: true } : {
+        ok: false,
+        detail: declined ? "the elevation prompt was declined" : `removing the helper failed (exit ${code})`
+      };
+    },
+    async state() {
+      try {
+        const { stdout } = await run6("sc.exe", ["query", SERVICE]);
+        const out = String(stdout);
+        const running2 = /STATE\s*:\s*4\b/.test(out);
+        if (running2)
+          return { installed: true, running: true };
+        return {
+          installed: true,
+          running: false,
+          detail: "the helper is installed but not running \u2014 reinstall it, or start the Tesseract network helper service"
+        };
+      } catch {
+        return { installed: false, running: false };
+      }
+    },
+    async openApprovalSettings() {
+    }
+  };
+}
+
+// ../../packages/host-core/dist/net-service/windows-nat.js
+import { execFile as execFile13 } from "node:child_process";
+import { promisify as promisify9 } from "node:util";
+var run7 = promisify9(execFile13);
+var NAT_FEATURE = "Containers-HNS";
+async function natCapability() {
+  if (process.platform !== "win32") {
+    return { available: true, reason: "", needsRestart: false };
+  }
+  try {
+    const { stdout } = await run7("powershell.exe", [
+      "-NoProfile",
+      "-NonInteractive",
+      "-Command",
+      "if (Get-CimClass -Namespace root/StandardCimv2 -ClassName MSFT_NetNat -ErrorAction SilentlyContinue) { 'yes' } else { 'no' }"
+    ]);
+    if (String(stdout).trim() === "yes") {
+      return { available: true, reason: "", needsRestart: false };
+    }
+  } catch {
+  }
+  return {
+    available: false,
+    reason: "Windows needs one more component before this machine can be the way out for others. It is an optional Windows feature, and turning it on needs a restart. Nothing else about the private network needs it \u2014 this machine can already join, and route all of its own traffic through someone else.",
+    needsRestart: true
+  };
+}
+function buildEnableNatScript() {
+  return [
+    '$ErrorActionPreference = "Stop"',
+    // -NoRestart, ALWAYS. We report that a restart is needed; we never perform one. An
+    // application that reboots a machine is one nobody leaves running.
+    `$r = Enable-WindowsOptionalFeature -Online -FeatureName ${NAT_FEATURE} -All -NoRestart`,
+    // 3010 is ERROR_SUCCESS_REBOOT_REQUIRED and is a SUCCESS. Treating it as a failure
+    // would tell the user their install failed on the machine where it worked.
+    "if ($r.RestartNeeded) { exit 3010 }",
+    "exit 0"
+  ].join("\n");
+}
+async function enableNatProvider() {
+  if (process.platform !== "win32") {
+    return { ok: false, reason: "unsupported", detail: "this is a Windows-only component" };
+  }
+  const { code, declined } = await elevatePowerShell(`${buildEnableNatScript()}
+`);
+  if (code === 0)
+    return { ok: true, restartRequired: false };
+  if (code === 3010)
+    return { ok: true, restartRequired: true };
+  return {
+    ok: false,
+    reason: declined ? "declined" : "failed",
+    detail: declined ? "the elevation prompt was declined" : `enabling the Windows NAT component failed (exit ${code})`
+  };
+}
+
+// ../../packages/host-core/dist/net-service/index.js
+function inert(reason) {
+  return {
+    supported: false,
+    async install() {
+      return { ok: false, detail: reason };
+    },
+    async uninstall() {
+      return { ok: false, detail: reason };
+    },
+    async state() {
+      return { installed: false, running: false, detail: reason };
+    },
+    async openApprovalSettings() {
+    }
+  };
+}
+function makeNetService() {
+  switch (process.platform) {
+    case "linux":
+      return makeSystemdSystem();
+    // A root LaunchDaemon, not a System Extension. The extension is still the right end
+    // state — it brings split DNS, On-Demand and an OS kill switch — but it is an Xcode
+    // project, a second signing identity and a user approval, and none of that is needed to
+    // open a utun and program routes. See `launchd-system.ts`.
+    case "darwin":
+      return makeLaunchDaemon();
+    // A LocalSystem service, separate from the daemon's per-user Scheduled Task, which stays
+    // unprivileged. See `windows-service.ts`.
+    case "win32":
+      return makeWindowsService();
+    default:
+      return inert(`no network helper for ${process.platform}`);
+  }
+}
+
+// ../../packages/host-core/dist/net-service/netd-binary.js
+import { existsSync as existsSync41 } from "node:fs";
+import { dirname as dirname33, join as join79 } from "node:path";
+import { fileURLToPath as fileURLToPath7 } from "node:url";
+function netdBinaryName() {
+  return process.platform === "win32" ? "tesseract-netd.exe" : "tesseract-netd";
+}
+function override2() {
+  const p = process.env.CCB_NETD_BIN;
+  return p && existsSync41(p) ? p : null;
+}
+function netdBinaryPath() {
+  const fromEnv = override2();
+  if (fromEnv)
+    return fromEnv;
+  const name = netdBinaryName();
+  const candidates = [];
+  const resources = process.resourcesPath;
+  if (resources)
+    candidates.push(join79(resources, "netd", name));
+  try {
+    const here = dirname33(fileURLToPath7(import.meta.url));
+    candidates.push(join79(here, "..", "..", "netd", name));
+    candidates.push(join79(here, "..", "..", "..", "netd", name));
+    const triple = `${process.platform}-${process.arch}`;
+    for (const root of [here, join79(here, ".."), join79(here, "..", "..")]) {
+      candidates.push(join79(root, "mesh-core", "prebuilds", triple, "netd", name));
+    }
+  } catch {
+  }
+  if (process.env.CCB_REPO_ROOT) {
+    candidates.push(join79(process.env.CCB_REPO_ROOT, "crates", "target", "release", name));
+  }
+  candidates.push(join79(process.cwd(), "crates", "target", "release", name));
+  for (const c of candidates) {
+    try {
+      if (existsSync41(c))
+        return c;
+    } catch {
+    }
+  }
+  return null;
+}
+
+// ../../packages/host-core/dist/net-service/ensure-installed.js
+function stateDir() {
+  switch (process.platform) {
+    case "win32":
+      return "C:\\ProgramData\\Tesseract\\netd";
+    case "darwin":
+      return "/Library/Application Support/Tesseract/netd";
+    default:
+      return "/var/lib/tesseract-netd";
+  }
+}
+async function ownerSid() {
+  if (process.platform !== "win32")
+    return void 0;
+  try {
+    const { stdout } = await promisify10(execFile14)("whoami", ["/user", "/fo", "csv", "/nh"]);
+    const m = /"(S-1-[0-9-]+)"/.exec(String(stdout));
+    return m?.[1];
+  } catch {
+    return void 0;
+  }
+}
+async function ensureNetHelperInstalled() {
+  const svc = makeNetService();
+  if (!svc.supported) {
+    const st2 = await svc.state();
+    return { ok: false, reason: "unsupported", detail: st2.detail ?? "no helper on this platform" };
+  }
+  const st = await svc.state();
+  if (st.installed)
+    return { ok: true, already: true };
+  const exec2 = netdBinaryPath();
+  if (exec2 && process.platform === "win32" && !existsSync42(join80(dirname34(exec2), "wintun.dll"))) {
+    return {
+      ok: false,
+      reason: "no-binary",
+      detail: "this build shipped the network helper without wintun.dll, so it cannot open a tunnel"
+    };
+  }
+  if (!exec2) {
+    return {
+      ok: false,
+      reason: "no-binary",
+      detail: "this build did not ship the network helper"
+    };
+  }
+  const r = await svc.install({
+    exec: exec2,
+    stateDir: stateDir(),
+    socket: netdEndpoint(),
+    ...await ownerSid().then((sid) => sid ? { ownerSid: sid } : {}),
+    // The uid whose requests may mutate. Read HERE, at install time, by the process the
+    // user is actually running — the helper starts as a system service with no session, so
+    // reading it there would be wrong in every interesting case.
+    ownerUid: typeof process.getuid === "function" ? process.getuid() : 0
+  });
+  if (r.ok)
+    return { ok: true, already: false };
+  const declined = /declin|cancel/i.test(r.detail ?? "");
+  return {
+    ok: false,
+    reason: declined ? "declined" : "failed",
+    detail: r.detail ?? "installing the helper failed"
+  };
+}
 
 // ../../packages/host-core/dist/clipboard/clipboard-sync.js
 var MAX_IMAGE_BYTES3 = 10 * 1024 * 1024;
@@ -112202,24 +113123,24 @@ import { platform as platform6 } from "node:os";
 
 // ../../packages/host-core/dist/service/launchd.js
 init_credentials();
-import { writeFileSync as writeFileSync40, existsSync as existsSync39, mkdirSync as mkdirSync41, unlinkSync as unlinkSync7 } from "node:fs";
-import { dirname as dirname33, join as join77 } from "node:path";
+import { writeFileSync as writeFileSync42, existsSync as existsSync43, mkdirSync as mkdirSync41, unlinkSync as unlinkSync7 } from "node:fs";
+import { dirname as dirname35, join as join81 } from "node:path";
 import { homedir as homedir13, userInfo as userInfo2 } from "node:os";
-function xml(s) {
+function xml2(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 function makeLaunchd(instanceId) {
   const suffix = instanceSuffix(instanceId);
   const label = SERVICE_LABEL_BASE + (suffix ? `.${suffix}` : "");
-  const plistPath = () => join77(homedir13(), "Library", "LaunchAgents", `${label}.plist`);
+  const plistPath = () => join81(homedir13(), "Library", "LaunchAgents", `${label}.plist`);
   const domainTarget = () => `gui/${userInfo2().uid}`;
   const serviceTarget = () => `${domainTarget()}/${label}`;
-  const logFile = () => join77(daemonDir2(), "daemon.log");
+  const logFile = () => join81(daemonDir2(), "daemon.log");
   const workDirOf = (spec) => spec.workingDirectory ?? daemonDir2();
-  function buildPlist(spec) {
-    const args = [spec.exec, ...spec.args].map((a) => `      <string>${xml(a)}</string>`).join("\n");
-    const env = Object.entries(spec.env).map(([k, v]) => `      <key>${xml(k)}</key>
-      <string>${xml(v)}</string>`).join("\n");
+  function buildPlist2(spec) {
+    const args = [spec.exec, ...spec.args].map((a) => `      <string>${xml2(a)}</string>`).join("\n");
+    const env = Object.entries(spec.env).map(([k, v]) => `      <key>${xml2(k)}</key>
+      <string>${xml2(v)}</string>`).join("\n");
     return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -112235,7 +113156,7 @@ ${args}
 ${env}
     </dict>
     <key>WorkingDirectory</key>
-    <string>${xml(workDirOf(spec))}</string>
+    <string>${xml2(workDirOf(spec))}</string>
     <key>RunAtLoad</key>
     <true/>
     <key>KeepAlive</key>
@@ -112250,9 +113171,9 @@ ${env}
     <key>LimitLoadToSessionType</key>
     <string>Aqua</string>
     <key>StandardOutPath</key>
-    <string>${xml(spec.logPath)}</string>
+    <string>${xml2(spec.logPath)}</string>
     <key>StandardErrorPath</key>
-    <string>${xml(spec.logPath)}</string>
+    <string>${xml2(spec.logPath)}</string>
   </dict>
 </plist>
 `;
@@ -112260,21 +113181,21 @@ ${env}
   return {
     async install(spec) {
       mkdirSync41(workDirOf(spec), { recursive: true });
-      mkdirSync41(dirname33(plistPath()), { recursive: true });
-      mkdirSync41(dirname33(spec.logPath), { recursive: true });
-      writeFileSync40(plistPath(), buildPlist(spec));
-      await run4("launchctl", ["bootout", serviceTarget()]).catch(() => {
+      mkdirSync41(dirname35(plistPath()), { recursive: true });
+      mkdirSync41(dirname35(spec.logPath), { recursive: true });
+      writeFileSync42(plistPath(), buildPlist2(spec));
+      await run5("launchctl", ["bootout", serviceTarget()]).catch(() => {
       });
-      await run4("launchctl", ["bootstrap", domainTarget(), plistPath()]);
-      await run4("launchctl", ["enable", serviceTarget()]).catch(() => {
+      await run5("launchctl", ["bootstrap", domainTarget(), plistPath()]);
+      await run5("launchctl", ["enable", serviceTarget()]).catch(() => {
       });
-      await run4("launchctl", ["kickstart", "-k", serviceTarget()]).catch(() => {
+      await run5("launchctl", ["kickstart", "-k", serviceTarget()]).catch(() => {
       });
     },
     async uninstall() {
-      await run4("launchctl", ["bootout", serviceTarget()]).catch(() => {
+      await run5("launchctl", ["bootout", serviceTarget()]).catch(() => {
       });
-      if (existsSync39(plistPath())) {
+      if (existsSync43(plistPath())) {
         try {
           unlinkSync7(plistPath());
         } catch {
@@ -112285,16 +113206,16 @@ ${env}
       await this.install(spec);
     },
     async isInstalled() {
-      return existsSync39(plistPath());
+      return existsSync43(plistPath());
     },
     async start() {
-      await run4("launchctl", ["bootstrap", domainTarget(), plistPath()]).catch(() => {
+      await run5("launchctl", ["bootstrap", domainTarget(), plistPath()]).catch(() => {
       });
-      await run4("launchctl", ["kickstart", serviceTarget()]).catch(() => {
+      await run5("launchctl", ["kickstart", serviceTarget()]).catch(() => {
       });
     },
     async stop() {
-      await run4("launchctl", ["bootout", serviceTarget()]).catch(() => {
+      await run5("launchctl", ["bootout", serviceTarget()]).catch(() => {
       });
     },
     async status() {
@@ -112302,7 +113223,7 @@ ${env}
     },
     async logs(follow) {
       const f = logFile();
-      if (!existsSync39(f)) {
+      if (!existsSync43(f)) {
         console.log(`No log yet at ${f} \u2014 has the service started?`);
         return;
       }
@@ -112313,10 +113234,10 @@ ${env}
 
 // ../../packages/host-core/dist/service/systemd.js
 init_credentials();
-import { writeFileSync as writeFileSync41, existsSync as existsSync40, mkdirSync as mkdirSync42, unlinkSync as unlinkSync8 } from "node:fs";
-import { dirname as dirname34, join as join78 } from "node:path";
+import { writeFileSync as writeFileSync43, existsSync as existsSync44, mkdirSync as mkdirSync42, unlinkSync as unlinkSync8 } from "node:fs";
+import { dirname as dirname36, join as join82 } from "node:path";
 import { homedir as homedir14, userInfo as userInfo3 } from "node:os";
-function unitVal(v) {
+function unitVal2(v) {
   return v.replace(/%/g, "%%");
 }
 function shq(s) {
@@ -112326,8 +113247,8 @@ function makeSystemd(instanceId) {
   const suffix = instanceSuffix(instanceId);
   const unit = `tesseract-host${suffix ? `-${suffix}` : ""}.service`;
   const unitPath = () => {
-    const base = process.env.XDG_CONFIG_HOME || join78(homedir14(), ".config");
-    return join78(base, "systemd", "user", unit);
+    const base = process.env.XDG_CONFIG_HOME || join82(homedir14(), ".config");
+    return join82(base, "systemd", "user", unit);
   };
   const workDirOf = (spec) => spec.workingDirectory ?? daemonDir2();
   function buildUnit2(spec) {
@@ -112341,7 +113262,7 @@ Wants=network-online.target
 [Service]
 Type=simple
 ${env}
-WorkingDirectory=${unitVal(workDirOf(spec))}
+WorkingDirectory=${unitVal2(workDirOf(spec))}
 ExecStart=${execStart}
 Restart=on-failure
 RestartSec=30
@@ -112355,40 +113276,40 @@ WantedBy=default.target
   return {
     async install(spec) {
       mkdirSync42(workDirOf(spec), { recursive: true });
-      mkdirSync42(dirname34(unitPath()), { recursive: true });
-      mkdirSync42(dirname34(spec.logPath), { recursive: true });
-      writeFileSync41(unitPath(), buildUnit2(spec));
-      await run4("loginctl", ["enable-linger", userInfo3().username]).catch(() => {
+      mkdirSync42(dirname36(unitPath()), { recursive: true });
+      mkdirSync42(dirname36(spec.logPath), { recursive: true });
+      writeFileSync43(unitPath(), buildUnit2(spec));
+      await run5("loginctl", ["enable-linger", userInfo3().username]).catch(() => {
       });
-      await run4("systemctl", ["--user", "daemon-reload"]).catch(() => {
+      await run5("systemctl", ["--user", "daemon-reload"]).catch(() => {
       });
-      await run4("systemctl", ["--user", "enable", unit]).catch(() => {
+      await run5("systemctl", ["--user", "enable", unit]).catch(() => {
       });
-      await run4("systemctl", ["--user", "restart", unit]);
+      await run5("systemctl", ["--user", "restart", unit]);
     },
     async uninstall() {
-      await run4("systemctl", ["--user", "disable", "--now", unit]).catch(() => {
+      await run5("systemctl", ["--user", "disable", "--now", unit]).catch(() => {
       });
-      if (existsSync40(unitPath())) {
+      if (existsSync44(unitPath())) {
         try {
           unlinkSync8(unitPath());
         } catch {
         }
       }
-      await run4("systemctl", ["--user", "daemon-reload"]).catch(() => {
+      await run5("systemctl", ["--user", "daemon-reload"]).catch(() => {
       });
     },
     async restart(spec) {
       await this.install(spec);
     },
     async isInstalled() {
-      return existsSync40(unitPath());
+      return existsSync44(unitPath());
     },
     async start() {
-      await run4("systemctl", ["--user", "start", unit]);
+      await run5("systemctl", ["--user", "start", unit]);
     },
     async stop() {
-      await run4("systemctl", ["--user", "stop", unit]);
+      await run5("systemctl", ["--user", "stop", unit]);
     },
     async status() {
       await runInherit("systemctl", ["--user", "status", unit, "--no-pager"]);
@@ -112401,13 +113322,13 @@ WantedBy=default.target
 
 // ../../packages/host-core/dist/service/windows.js
 init_credentials();
-import { writeFileSync as writeFileSync42, existsSync as existsSync41, mkdirSync as mkdirSync43, unlinkSync as unlinkSync9 } from "node:fs";
-import { dirname as dirname35, join as join79 } from "node:path";
+import { writeFileSync as writeFileSync44, existsSync as existsSync45, mkdirSync as mkdirSync43, unlinkSync as unlinkSync9 } from "node:fs";
+import { dirname as dirname37, join as join83 } from "node:path";
 function makeWindowsTask(instanceId) {
   const suffix = instanceSuffix(instanceId);
   const task = `Fineguide\\TesseractHost${suffix ? `-${suffix}` : ""}`;
-  const wrapperPath = () => join79(daemonDir2(), `run-host${suffix ? `-${suffix}` : ""}.cmd`);
-  const logFile = () => join79(daemonDir2(), "daemon.log");
+  const wrapperPath = () => join83(daemonDir2(), `run-host${suffix ? `-${suffix}` : ""}.cmd`);
+  const logFile = () => join83(daemonDir2(), "daemon.log");
   const oneLine2 = (s) => s.replace(/[\r\n]+/g, " ");
   const envVal = (v) => oneLine2(v).replace(/%/g, "%%").replace(/"/g, "");
   const cmdArg = (a) => `"${oneLine2(a).replace(/"/g, "")}"`;
@@ -112424,17 +113345,17 @@ start "" /b ${cmd} >> "${oneLine2(spec.logPath).replace(/"/g, "")}" 2>&1\r
   return {
     async install(spec) {
       mkdirSync43(spec.workingDirectory ?? daemonDir2(), { recursive: true });
-      mkdirSync43(dirname35(spec.logPath), { recursive: true });
-      mkdirSync43(dirname35(wrapperPath()), { recursive: true });
-      writeFileSync42(wrapperPath(), buildWrapper(spec));
-      await run4("schtasks", ["/Create", "/TN", task, "/SC", "ONLOGON", "/RL", "LIMITED", "/F", "/TR", `"${wrapperPath()}"`]);
-      await run4("schtasks", ["/Run", "/TN", task]).catch(() => {
+      mkdirSync43(dirname37(spec.logPath), { recursive: true });
+      mkdirSync43(dirname37(wrapperPath()), { recursive: true });
+      writeFileSync44(wrapperPath(), buildWrapper(spec));
+      await run5("schtasks", ["/Create", "/TN", task, "/SC", "ONLOGON", "/RL", "LIMITED", "/F", "/TR", `"${wrapperPath()}"`]);
+      await run5("schtasks", ["/Run", "/TN", task]).catch(() => {
       });
     },
     async uninstall() {
-      await run4("schtasks", ["/Delete", "/TN", task, "/F"]).catch(() => {
+      await run5("schtasks", ["/Delete", "/TN", task, "/F"]).catch(() => {
       });
-      if (existsSync41(wrapperPath())) {
+      if (existsSync45(wrapperPath())) {
         try {
           unlinkSync9(wrapperPath());
         } catch {
@@ -112446,17 +113367,17 @@ start "" /b ${cmd} >> "${oneLine2(spec.logPath).replace(/"/g, "")}" 2>&1\r
     },
     async isInstalled() {
       try {
-        await run4("schtasks", ["/Query", "/TN", task]);
+        await run5("schtasks", ["/Query", "/TN", task]);
         return true;
       } catch {
         return false;
       }
     },
     async start() {
-      await run4("schtasks", ["/Run", "/TN", task]);
+      await run5("schtasks", ["/Run", "/TN", task]);
     },
     async stop() {
-      await run4("schtasks", ["/End", "/TN", task]).catch(() => {
+      await run5("schtasks", ["/End", "/TN", task]).catch(() => {
       });
     },
     async status() {
@@ -112464,7 +113385,7 @@ start "" /b ${cmd} >> "${oneLine2(spec.logPath).replace(/"/g, "")}" 2>&1\r
     },
     async logs(follow) {
       const f = logFile();
-      if (!existsSync41(f)) {
+      if (!existsSync45(f)) {
         console.log(`No log yet at ${f} \u2014 has the task run?`);
         return;
       }
@@ -112496,8 +113417,8 @@ init_safe_kill();
 // src/auth.ts
 var import_qrcode_terminal = __toESM(require_main(), 1);
 import { randomUUID as randomUUID29 } from "node:crypto";
-import { existsSync as existsSync42, rmSync as rmSync10 } from "node:fs";
-import { join as join80 } from "node:path";
+import { existsSync as existsSync46, rmSync as rmSync12 } from "node:fs";
+import { join as join84 } from "node:path";
 
 // src/config.ts
 import { hostname as hostname6 } from "node:os";
@@ -112698,8 +113619,8 @@ async function logout() {
   }
   for (const f of ["credentials.json", "status.json", "daemon.lock"]) {
     try {
-      const p = join80(daemonDir2(), f);
-      if (existsSync42(p)) rmSync10(p);
+      const p = join84(daemonDir2(), f);
+      if (existsSync46(p)) rmSync12(p);
     } catch {
     }
   }
@@ -112719,7 +113640,7 @@ function whoami() {
 }
 
 // src/self-update.ts
-import { spawn as spawn10 } from "node:child_process";
+import { spawn as spawn13 } from "node:child_process";
 import { createPublicKey, verify as cryptoVerify } from "node:crypto";
 var RESTART_EXIT_CODE = 75;
 var REGISTRY_BASE = "https://registry.npmjs.org/tesseract-agent";
@@ -112794,7 +113715,7 @@ function installVersion(target) {
     log8(`installing tesseract-agent@${target} \u2026`);
     let child;
     try {
-      child = spawn10(npm, ["install", "-g", `tesseract-agent@${target}`], { stdio: ["ignore", "inherit", "inherit"] });
+      child = spawn13(npm, ["install", "-g", `tesseract-agent@${target}`], { stdio: ["ignore", "inherit", "inherit"] });
     } catch (e) {
       log8("npm spawn threw:", e instanceof Error ? e.message : String(e));
       resolve16(false);
@@ -112857,9 +113778,9 @@ function startSelfUpdater(current) {
 }
 
 // src/service.ts
-import { join as join81 } from "node:path";
+import { join as join85 } from "node:path";
 import { platform as platform7 } from "node:os";
-import { existsSync as existsSync43, readFileSync as readFileSync49 } from "node:fs";
+import { existsSync as existsSync47, readFileSync as readFileSync49 } from "node:fs";
 function controller(instanceId) {
   const c = getServiceController(instanceId);
   if (!c) {
@@ -112872,7 +113793,7 @@ function buildSpec(cliEntry) {
     exec: process.execPath,
     args: [cliEntry, "run"],
     env: { CCB_DAEMON_DIR: daemonDir2() },
-    logPath: join81(daemonDir2(), "daemon.log")
+    logPath: join85(daemonDir2(), "daemon.log")
   };
 }
 var isAlive = (pid) => {
@@ -112884,9 +113805,9 @@ var isAlive = (pid) => {
   }
 };
 function runningDaemonInfo() {
-  const lock = join81(daemonDir2(), "daemon.lock");
+  const lock = join85(daemonDir2(), "daemon.lock");
   try {
-    if (!existsSync43(lock)) return null;
+    if (!existsSync47(lock)) return null;
     const pid = Number(readFileSync49(lock, "utf-8").trim());
     if (!pid || !isAlive(pid)) return null;
     return { pid, device: readCredentials()?.deviceId };
@@ -112939,6 +113860,16 @@ function usage() {
                                              Join a network. The token is all you need;
                                              the name defaults to this machine's hostname.
   tesseract-agent net leave MESH [--yes]     Forget a mesh entirely, key included
+  tesseract-agent net helper [status|install|uninstall|enable-nat]
+                                             The privileged network helper, which is what
+                                             actually programs the routes. Without it a
+                                             machine joins, holds a certificate, shows a
+                                             roster \u2014 and carries no packets. Run the
+                                             install under sudo (Windows: an elevated
+                                             shell); there is nothing to prompt on a server.
+                                             enable-nat is WINDOWS ONLY and only needed to
+                                             be the way out FOR OTHERS \u2014 it turns on a
+                                             Windows optional feature and needs a restart.
 
 Running a network (needs a signed-in account):
   tesseract-agent net new [NAME]             Create a network and print its join token.
@@ -113120,9 +114051,80 @@ async function netCommand(rest, flags) {
       updateLocal(meshId, { enabled: sub === "up" });
       console.log(`${meshId}  ${sub === "up" ? "enabled" : "disabled"}`);
     }
-    console.log("Run `tesseract-agent restart` for this to take effect now.");
+    if (sub === "down") {
+      const stillOn = listMeshIds().filter((id) => readLocal(id)?.enabled !== false);
+      const r = await syncRoutes(stillOn);
+      if (r.helperAbsent) {
+        console.log("The network helper is not installed, so nothing was routed anyway.");
+      } else {
+        if (r.down.length) console.log(`routes removed: ${r.down.join(", ")}`);
+        for (const f of r.failed) console.error(`routes ${f.meshId}: ${f.reason}`);
+      }
+    } else if (!await netdAvailable()) {
+      console.log("The network helper is not installed, so nothing will be routed yet.");
+      console.log("Install it with: sudo tesseract-agent net helper install");
+    }
+    console.log("Run `tesseract-agent restart` to start or stop the node itself.");
     return;
   }
+  if (sub === "helper") {
+    const action = rest[1] ?? "status";
+    const svc = makeNetService();
+    if (action === "status") {
+      const st = await svc.state();
+      const bin = netdBinaryPath();
+      console.log(`platform      ${process.platform}${svc.supported ? "" : "  (no helper for this platform)"}`);
+      console.log(`binary        ${bin ?? "NOT SHIPPED IN THIS BUILD"}`);
+      console.log(`installed     ${st.installed ? "yes" : "no"}`);
+      console.log(`running       ${st.running ? "yes" : "no"}`);
+      console.log(`answering     ${await netdAvailable() ? "yes" : "no"}`);
+      if (st.detail) console.log(`note          ${st.detail}`);
+      const nat = await natCapability();
+      console.log(`way out for others  ${nat.available ? "yes" : "NOT YET"}`);
+      if (!nat.available) {
+        console.log(`  ${nat.reason}`);
+        console.log("  Turn it on with: tesseract-agent net helper enable-nat");
+      }
+      return;
+    }
+    if (action === "enable-nat") {
+      const nat = await natCapability();
+      if (nat.available) {
+        console.log("This machine can already be the way out for others. Nothing to do.");
+        return;
+      }
+      const r = await enableNatProvider();
+      if (r.ok) {
+        console.log("The Windows NAT component is enabled.");
+        if (r.restartRequired) {
+          console.log("RESTART REQUIRED to finish. Nothing was restarted for you.");
+        }
+        return;
+      }
+      console.error(`net helper enable-nat: ${r.detail}`);
+      process.exit(r.reason === "unsupported" ? 2 : 1);
+    }
+    if (action === "install") {
+      const r = await ensureNetHelperInstalled();
+      if (r.ok) {
+        console.log(r.already ? "The network helper is already installed." : "The network helper is installed.");
+        return;
+      }
+      console.error(`net helper install: ${r.detail}`);
+      process.exit(r.reason === "unsupported" || r.reason === "no-binary" ? 2 : 1);
+    }
+    if (action === "uninstall") {
+      const r = await svc.uninstall();
+      if (r.ok) {
+        console.log("The network helper is removed.");
+        return;
+      }
+      console.error(`net helper uninstall: ${r.detail ?? "failed"}`);
+      process.exit(1);
+    }
+    console.error(`net helper: unknown action ${action} (status | install | uninstall | enable-nat)`);
+    process.exit(1);
+  }
   if (sub === "join") {
     const token3 = rest[1] ?? str2(flags.token);
     const code = str2(flags.code);
@@ -113442,7 +114444,7 @@ async function netCommand(rest, flags) {
 // src/cli.ts
 function pkgVersion() {
   try {
-    const p = join83(dirname36(fileURLToPath7(import.meta.url)), "..", "package.json");
+    const p = join87(dirname38(fileURLToPath8(import.meta.url)), "..", "package.json");
     return JSON.parse(readFileSync52(p, "utf8")).version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -113499,7 +114501,7 @@ async function superviseDaemon(cliEntry) {
   let stopping3 = false;
   let child = null;
   const spawnWorker = () => {
-    const c = spawn11(process.execPath, [cliEntry, "__worker"], { stdio: "inherit", env: process.env });
+    const c = spawn14(process.execPath, [cliEntry, "__worker"], { stdio: "inherit", env: process.env });
     child = c;
     let settled = false;
     const settle = (fn) => {
@@ -113671,7 +114673,7 @@ async function linkCommand(rest, flags) {
   process.exit(1);
 }
 async function captureClaudeSubscription(flags) {
-  const home = mkdtempSync2(join83(tmpdir6(), "tesseract-claude-login-"));
+  const home = mkdtempSync4(join87(tmpdir8(), "tesseract-claude-login-"));
   const binary = typeof flags["claude-path"] === "string" ? flags["claude-path"] : process.env.CCB_ENGINE_PATH_CLAUDE_CODE || "claude";
   const args = ["auth", "login", "--claudeai"];
   if (typeof flags.email === "string") args.push("--email", flags.email);
@@ -113680,7 +114682,7 @@ async function captureClaudeSubscription(flags) {
   console.log("Open the authorization URL in any browser; paste the returned code here if Claude asks for it.");
   try {
     const code = await new Promise((resolveCode, reject) => {
-      const child = spawn11(binary, args, {
+      const child = spawn14(binary, args, {
         env: { ...process.env, CLAUDE_CONFIG_DIR: home },
         stdio: "inherit"
       });
@@ -113688,8 +114690,8 @@ async function captureClaudeSubscription(flags) {
       child.once("close", (exitCode, signal) => resolveCode(signal ? 1 : exitCode ?? 1));
     });
     if (code !== 0) throw new Error(`Claude sign-in did not complete (exit ${code}).`);
-    const file2 = join83(home, ".credentials.json");
-    if (existsSync45(file2)) return readFileSync52(file2, "utf8");
+    const file2 = join87(home, ".credentials.json");
+    if (existsSync49(file2)) return readFileSync52(file2, "utf8");
     if (process.platform === "darwin") {
       const value = execFileSync6("security", [
         "find-generic-password",
@@ -113701,7 +114703,7 @@ async function captureClaudeSubscription(flags) {
     }
     throw new Error("Claude reported success but no credentials were captured.");
   } finally {
-    rmSync11(home, { recursive: true, force: true });
+    rmSync13(home, { recursive: true, force: true });
   }
 }
 async function runnerCommand(rest, flags) {
@@ -113816,7 +114818,7 @@ async function main() {
     process.env.CCB_DAEMON_DIR = tessPath(`daemon-${instance}`);
   }
   const force = flags.yes === true || flags.force === true;
-  const cliEntry = fileURLToPath7(import.meta.url);
+  const cliEntry = fileURLToPath8(import.meta.url);
   switch (cmd) {
     case "login":
       await login({