tesseract-agent 0.11.19 → 0.11.20

package/dist-bundle/cli.js

@@ -39665,7 +39665,6 @@ import { tmpdir as tmpdir3, homedir as homedir3, userInfo } from "node:os";
 import { join as join19, dirname as dirname9 } from "node:path";
 import { existsSync as existsSync6, readFileSync as readFileSync13, readdirSync as readdirSync4, openSync as openSync5, readSync as readSync4, closeSync as closeSync5, statSync as statSync7, writeFileSync as writeFileSync8, mkdirSync as mkdirSync11, copyFileSync, renameSync as renameSync5, realpathSync as realpathSync2 } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { createRequire } from "node:module";
 import { createServer } from "node:net";
 import { spawn as spawn2, execSync, execFileSync } from "node:child_process";
 function setBrowserExtensionProbe(fn) {
@@ -39723,17 +39722,6 @@ function resolveClaudeCodeExecutable() {
   const user = findUserInstalledClaude(binName);
   if (user)
     return cachedClaudeExe = user;
-  const require2 = createRequire(import.meta.url);
-  const keys = process.platform === "linux" ? [`linux-${process.arch}`, `linux-${process.arch}-musl`] : [`${process.platform}-${process.arch}`];
-  for (const key2 of keys) {
-    try {
-      const pkgJson = require2.resolve(`@anthropic-ai/claude-agent-sdk-${key2}/package.json`);
-      const bin = join19(dirname9(pkgJson), binName);
-      if (existsSync6(bin))
-        return cachedClaudeExe = bin;
-    } catch {
-    }
-  }
   const resourcesPath = process.resourcesPath;
   if (resourcesPath) {
     const platKey = process.platform === "darwin" ? "mac" : process.platform === "win32" ? "win" : "linux";
@@ -47717,7 +47705,7 @@ var init_managed_spawn = __esm({
 
 // ../../packages/host-core/dist/runners/proxy-router.js
 import { execFile as execFile4, execSync as execSync2 } from "node:child_process";
-import { createRequire as createRequire2 } from "node:module";
+import { createRequire } from "node:module";
 import { randomUUID as randomUUID6, createHash as createHash2 } from "node:crypto";
 import { existsSync as existsSync9, mkdirSync as mkdirSync13, writeFileSync as writeFileSync11 } from "node:fs";
 import { join as join24, dirname as dirname11, sep as sep3 } from "node:path";
@@ -47912,7 +47900,7 @@ var init_proxy_router = __esm({
     init_base_paths();
     init_managed_spawn();
     init_dist2();
-    requireFromHere = createRequire2(import.meta.url);
+    requireFromHere = createRequire(import.meta.url);
     ROUTER_PORT = 8787;
     BIND_HOST = "127.0.0.1";
     ROUTER_TOKEN = randomUUID6();
@@ -84283,8 +84271,8 @@ var mesh_ca_exports = {};
 __export(mesh_ca_exports, {
   netCaCommand: () => netCaCommand
 });
-import { chmodSync as chmodSync9, existsSync as existsSync59, mkdirSync as mkdirSync51, readFileSync as readFileSync67, writeFileSync as writeFileSync50 } from "node:fs";
-import { join as join101, resolve as resolve13 } from "node:path";
+import { chmodSync as chmodSync9, existsSync as existsSync60, mkdirSync as mkdirSync52, readFileSync as readFileSync68, writeFileSync as writeFileSync51 } from "node:fs";
+import { join as join102, resolve as resolve13 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 function die(msg) {
   console.error(msg);
@@ -84315,28 +84303,28 @@ async function readPassphrase(prompt2) {
   }
 }
 function writeSecretFile(p, bytes3) {
-  writeFileSync50(p, bytes3, { mode: 384 });
+  writeFileSync51(p, bytes3, { mode: 384 });
   try {
     chmodSync9(p, 384);
   } catch {
   }
 }
 function ensureDir(p) {
-  mkdirSync51(p, { recursive: true, mode: 448 });
+  mkdirSync52(p, { recursive: true, mode: 448 });
   try {
     chmodSync9(p, 448);
   } catch {
   }
 }
 async function openCa(dir2) {
-  const gPath = join101(dir2, "genesis.bin");
-  const sPath = join101(dir2, "ca.sealed");
-  if (!existsSync59(gPath) || !existsSync59(sPath)) {
+  const gPath = join102(dir2, "genesis.bin");
+  const sPath = join102(dir2, "ca.sealed");
+  if (!existsSync60(gPath) || !existsSync60(sPath)) {
     die(`No mesh CA in ${dir2}. Run: tesseract-agent mesh init --org NAME --ca-dir ${dir2}`);
   }
-  const genesisBytes = new Uint8Array(readFileSync67(gPath));
+  const genesisBytes = new Uint8Array(readFileSync68(gPath));
   const genesis = decodeGenesis(genesisBytes);
-  const sealed = decodeRecoveryBundle(new Uint8Array(readFileSync67(sPath)));
+  const sealed = decodeRecoveryBundle(new Uint8Array(readFileSync68(sPath)));
   const pass = await readPassphrase("CA passphrase: ");
   let seed;
   try {
@@ -84352,7 +84340,7 @@ async function netCaCommand(rest, flags) {
   if (sub === "init") {
     const org = typeof flags.org === "string" ? flags.org.trim() : "";
     if (!org) die("Usage: tesseract-agent mesh init --org NAME [--ca-dir DIR]");
-    if (existsSync59(join101(caDir, "ca.sealed"))) {
+    if (existsSync60(join102(caDir, "ca.sealed"))) {
       die(`A mesh CA already exists in ${caDir}. Refusing to overwrite it.`);
     }
     const pass = await readPassphrase("New CA passphrase: ");
@@ -84374,9 +84362,9 @@ async function netCaCommand(rest, flags) {
     const genesisBytes = encodeGenesis(genesis);
     const fp = await genesisFingerprint(genesis);
     ensureDir(caDir);
-    writeFileSync50(join101(caDir, "genesis.bin"), genesisBytes);
-    writeSecretFile(join101(caDir, "ca.sealed"), encodeRecoveryBundle(await sealCaKey(seed, pass, `${org} mesh CA`)));
-    writeSecretFile(join101(caDir, "disablement.secret"), hex3(disable.secret));
+    writeFileSync51(join102(caDir, "genesis.bin"), genesisBytes);
+    writeSecretFile(join102(caDir, "ca.sealed"), encodeRecoveryBundle(await sealCaKey(seed, pass, `${org} mesh CA`)));
+    writeSecretFile(join102(caDir, "disablement.secret"), hex3(disable.secret));
     console.log(`
 Mesh created for "${org}".`);
     console.log(`  fingerprint: ${hex3(fp)}`);
@@ -84391,7 +84379,7 @@ Mesh created for "${org}".`);
     console.log(`  ${hex3(disable.secret)}`);
     console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
     console.log(`
-A copy of the disablement secret is in ${join101(caDir, "disablement.secret")}.`);
+A copy of the disablement secret is in ${join102(caDir, "disablement.secret")}.`);
     console.log("Move it somewhere the CA directory is not \u2014 holding both in one place");
     console.log("defeats the point of having two.");
     const caFlag = caDir === resolve13("./mesh-ca") ? "" : ` --ca-dir ${caDir}`;
@@ -84444,14 +84432,14 @@ Next, issue an identity for a machine (pick a free address in ${formatPrefix(gen
       [{ keyIndex: 0, privateKey: ca.privateKey }]
     );
     ensureDir(outDir);
-    writeFileSync50(join101(outDir, "genesis.bin"), genesisBytes);
-    writeFileSync50(join101(outDir, "node.cert"), encodeCert(cert));
-    writeSecretFile(join101(outDir, "node.key"), await exportStaticPrivate(nodeKey));
+    writeFileSync51(join102(outDir, "genesis.bin"), genesisBytes);
+    writeFileSync51(join102(outDir, "node.cert"), encodeCert(cert));
+    writeSecretFile(join102(outDir, "node.key"), await exportStaticPrivate(nodeKey));
     console.log(`Minted "${name}" at ${ip4}.`);
     console.log(`  ${outDir}`);
     console.log("\nCopy that directory to the node and run there:");
-    console.log(`  tesseract-agent mesh enroll --genesis ${join101(outDir, "genesis.bin")} \\`);
-    console.log(`      --cert ${join101(outDir, "node.cert")} --key ${join101(outDir, "node.key")}`);
+    console.log(`  tesseract-agent mesh enroll --genesis ${join102(outDir, "genesis.bin")} \\`);
+    console.log(`      --cert ${join102(outDir, "node.cert")} --key ${join102(outDir, "node.key")}`);
     console.log("\nnode.key is the node's identity \u2014 send it over a channel you trust, and");
     console.log("delete this copy once the node has it.");
     return;
@@ -84487,8 +84475,8 @@ Next, issue an identity for a machine (pick a free address in ${formatPrefix(gen
       ip4Exceptions: []
     };
     const signed = await signBundle(bundle, [{ keyIndex: 0, privateKey: ca.privateKey }]);
-    const out = resolve13(typeof flags.out === "string" ? flags.out : join101(caDir, "bundle.bin"));
-    writeFileSync50(out, encodeSignedBundle(signed));
+    const out = resolve13(typeof flags.out === "string" ? flags.out : join102(caDir, "bundle.bin"));
+    writeFileSync51(out, encodeSignedBundle(signed));
     console.log(`Signed policy bundle (epoch ${epoch2}) \u2192 ${out}`);
     console.log("Every node must receive it; the relay distributes it, or copy it to");
     console.log(`each node's mesh directory as bundle.bin.`);
@@ -84510,12 +84498,12 @@ var init_mesh_ca = __esm({
 
 // src/cli.ts
 init_base_paths();
-import { existsSync as existsSync60, mkdtempSync as mkdtempSync4, readFileSync as readFileSync69, rmSync as rmSync14 } from "node:fs";
+import { existsSync as existsSync61, mkdtempSync as mkdtempSync4, readFileSync as readFileSync70, rmSync as rmSync14 } from "node:fs";
 import { createHash as createHash12 } from "node:crypto";
-import { execFileSync as execFileSync8, spawn as spawn14 } from "node:child_process";
+import { execFileSync as execFileSync9, spawn as spawn14 } from "node:child_process";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 import { tmpdir as tmpdir8 } from "node:os";
-import { dirname as dirname45, join as join102, resolve as resolve15 } from "node:path";
+import { dirname as dirname46, join as join103, resolve as resolve15 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 
 // ../../packages/host-core/dist/control-link.js
@@ -100456,8 +100444,8 @@ import { randomUUID as randomUUID23 } from "node:crypto";
 import { existsSync as existsSync21 } from "node:fs";
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { sep as sep6, join as join46, dirname as dirname19 } from "node:path";
-import { createRequire as createRequire3 } from "node:module";
-var require_ = createRequire3(import.meta.url);
+import { createRequire as createRequire2 } from "node:module";
+var require_ = createRequire2(import.meta.url);
 var unpacked = (p) => p.replace(`app.asar${sep6}`, `app.asar.unpacked${sep6}`);
 function exportedPath(name) {
   try {
@@ -101164,8 +101152,8 @@ async function falTopazEnhance(path6, spec, opts) {
   const dir2 = opts.outDir ?? workDir();
   mkdirSync24(dir2, { recursive: true });
   const outPath = join48(dir2, "enhanced.mp4");
-  const { writeFileSync: writeFileSync51 } = await import("node:fs");
-  writeFileSync51(outPath, Buffer.from(await dl.arrayBuffer()));
+  const { writeFileSync: writeFileSync52 } = await import("node:fs");
+  writeFileSync52(outPath, Buffer.from(await dl.arrayBuffer()));
   const out = await probeMedia(outPath).catch(() => null);
   opts.onProgress?.(100, "Enhance complete");
   return { path: outPath, mime: MIME, width: out?.width ?? null, height: out?.height ?? null, durationSec: out?.durationSec ?? p.durationSec, summary: `fal Topaz ${spec.model ?? "Proteus"} \xD7${spec.upscaleFactor ?? 2}` };
@@ -107237,9 +107225,9 @@ var NodeFsHandler = class {
     if (this.fsw.closed) {
       return;
     }
-    const dirname46 = sysPath.dirname(file2);
+    const dirname47 = sysPath.dirname(file2);
     const basename17 = sysPath.basename(file2);
-    const parent = this.fsw._getWatchedDir(dirname46);
+    const parent = this.fsw._getWatchedDir(dirname47);
     let prevStats = stats;
     if (parent.has(basename17))
       return;
@@ -107266,7 +107254,7 @@ var NodeFsHandler = class {
             prevStats = newStats2;
           }
         } catch (error51) {
-          this.fsw._remove(dirname46, basename17);
+          this.fsw._remove(dirname47, basename17);
         }
       } else if (parent.has(basename17)) {
         const at = newStats.atimeMs;
@@ -116137,9 +116125,9 @@ async function startLocalServer(opts) {
 
 // ../../packages/host-core/dist/daemon-runtime.js
 init_base_paths();
-import { readFileSync as readFileSync59, writeFileSync as writeFileSync44, existsSync as existsSync49, mkdirSync as mkdirSync47, unlinkSync as unlinkSync8, chmodSync as chmodSync8, statSync as statSync21 } from "node:fs";
-import { execFileSync as execFileSync6 } from "node:child_process";
-import { join as join91 } from "node:path";
+import { readFileSync as readFileSync60, writeFileSync as writeFileSync45, existsSync as existsSync50, mkdirSync as mkdirSync48, unlinkSync as unlinkSync8, chmodSync as chmodSync8, statSync as statSync21 } from "node:fs";
+import { execFileSync as execFileSync7 } from "node:child_process";
+import { join as join92 } from "node:path";
 import { randomBytes as randomBytes11 } from "node:crypto";
 import { hostname as hostname6 } from "node:os";
 
@@ -116548,7 +116536,7 @@ async function getPeerIdentityPub(opts) {
 
 // ../../packages/host-core/dist/mesh/node.js
 import { createSocket } from "node:dgram";
-import { createRequire as createRequire4 } from "node:module";
+import { createRequire as createRequire3 } from "node:module";
 init_credentials();
 
 // ../../packages/host-core/dist/mesh/bundle-gossip.js
@@ -117448,7 +117436,7 @@ function isAdvertisableEndpoint(ip, overlays) {
 // ../../packages/host-core/dist/mesh/node.js
 init_dist6();
 var _a3;
-var requireCjs = createRequire4(import.meta.url);
+var requireCjs = createRequire3(import.meta.url);
 function joinedOverlayRanges() {
   const out = [];
   try {
@@ -121869,33 +121857,150 @@ init_credentials();
 
 // ../../packages/shared/dist/identity.js
 init_base_paths();
+import { existsSync as existsSync49, mkdirSync as mkdirSync47, readFileSync as readFileSync59, writeFileSync as writeFileSync44 } from "node:fs";
+import { dirname as dirname40, join as join91 } from "node:path";
+import { randomUUID as randomUUID31 } from "node:crypto";
+
+// ../../packages/shared/dist/device-id-mirror.js
+init_base_paths();
+import { execFileSync as execFileSync6 } from "node:child_process";
 import { existsSync as existsSync48, mkdirSync as mkdirSync46, readFileSync as readFileSync58, writeFileSync as writeFileSync43 } from "node:fs";
+import { homedir as homedir16 } from "node:os";
 import { dirname as dirname39, join as join90 } from "node:path";
-import { randomUUID as randomUUID31 } from "node:crypto";
+var SERVICE = "dev.tesseract.device-id";
+var ACCOUNT = "device-id";
+var TOOL_TIMEOUT_MS = 4e3;
+function machineGlobalAllowed() {
+  try {
+    return !isAlternateHome();
+  } catch {
+    return false;
+  }
+}
+function appSupportDir(env = process.env, platform8 = process.platform) {
+  const home = homedir16();
+  if (platform8 === "darwin")
+    return join90(home, "Library", "Application Support", "Tesseract");
+  if (platform8 === "win32")
+    return join90(env.APPDATA ?? join90(home, "AppData", "Roaming"), "Tesseract");
+  return join90(env.XDG_CONFIG_HOME ?? join90(home, ".config"), "Tesseract");
+}
+function mirrorFile() {
+  return join90(appSupportDir(), "device-id.json");
+}
+function readJsonId(file2) {
+  try {
+    const raw = JSON.parse(readFileSync58(file2, "utf-8"));
+    return typeof raw.deviceId === "string" && raw.deviceId ? raw.deviceId : null;
+  } catch {
+    return null;
+  }
+}
+function writeJsonId(file2, deviceId3) {
+  try {
+    const dir2 = dirname39(file2);
+    if (!existsSync48(dir2))
+      mkdirSync46(dir2, { recursive: true });
+    writeFileSync43(file2, JSON.stringify({ deviceId: deviceId3 }), { mode: 384 });
+  } catch {
+  }
+}
+function haveTool(bin) {
+  try {
+    execFileSync6(process.platform === "win32" ? "where" : "which", [bin], { timeout: TOOL_TIMEOUT_MS, stdio: "pipe" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readFromCredentialStore() {
+  try {
+    if (process.platform === "darwin") {
+      const out = execFileSync6("security", ["find-generic-password", "-s", SERVICE, "-a", ACCOUNT, "-w"], {
+        encoding: "utf-8",
+        timeout: TOOL_TIMEOUT_MS,
+        stdio: ["ignore", "pipe", "ignore"]
+      }).trim();
+      return out || null;
+    }
+    if (process.platform === "linux" && haveTool("secret-tool")) {
+      const out = execFileSync6("secret-tool", ["lookup", "service", SERVICE, "account", ACCOUNT], {
+        encoding: "utf-8",
+        timeout: TOOL_TIMEOUT_MS,
+        stdio: ["ignore", "pipe", "ignore"]
+      }).trim();
+      return out || null;
+    }
+  } catch {
+  }
+  return null;
+}
+function writeToCredentialStore(deviceId3) {
+  try {
+    if (process.platform === "darwin") {
+      execFileSync6("security", ["add-generic-password", "-s", SERVICE, "-a", ACCOUNT, "-w", deviceId3, "-U"], {
+        timeout: TOOL_TIMEOUT_MS,
+        stdio: "ignore"
+      });
+      return;
+    }
+    if (process.platform === "linux" && haveTool("secret-tool")) {
+      execFileSync6("secret-tool", ["store", "--label=Tesseract device id", "service", SERVICE, "account", ACCOUNT], {
+        input: deviceId3,
+        timeout: TOOL_TIMEOUT_MS,
+        stdio: ["pipe", "ignore", "ignore"]
+      });
+    }
+  } catch {
+  }
+}
+function recoverDeviceId() {
+  if (!machineGlobalAllowed())
+    return null;
+  return readJsonId(mirrorFile()) ?? readFromCredentialStore();
+}
+function ensureMirrors(deviceId3) {
+  if (!machineGlobalAllowed())
+    return;
+  const file2 = mirrorFile();
+  if (readJsonId(file2) === deviceId3)
+    return;
+  writeJsonId(file2, deviceId3);
+  writeToCredentialStore(deviceId3);
+}
+
+// ../../packages/shared/dist/identity.js
 function deviceIdFile() {
-  return join90(tesseractHome(), "device-id.json");
+  return join91(tesseractHome(), "device-id.json");
 }
 function readPersistedDeviceId() {
   try {
-    const raw = JSON.parse(readFileSync58(deviceIdFile(), "utf-8"));
+    const raw = JSON.parse(readFileSync59(deviceIdFile(), "utf-8"));
     return typeof raw.deviceId === "string" && raw.deviceId ? raw.deviceId : null;
   } catch {
     return null;
   }
 }
+function mintDeviceId() {
+  return randomUUID31().replace(/-/g, "");
+}
 function persistentDeviceId() {
   const cur = readPersistedDeviceId();
-  if (cur)
+  if (cur) {
+    ensureMirrors(cur);
     return cur;
-  const id = randomUUID31().slice(0, 8);
+  }
+  const recovered = recoverDeviceId();
+  const id = recovered ?? mintDeviceId();
   try {
     const f = deviceIdFile();
-    const dir2 = dirname39(f);
-    if (!existsSync48(dir2))
-      mkdirSync46(dir2, { recursive: true });
-    writeFileSync43(f, JSON.stringify({ deviceId: id }));
+    const dir2 = dirname40(f);
+    if (!existsSync49(dir2))
+      mkdirSync47(dir2, { recursive: true });
+    writeFileSync44(f, JSON.stringify({ deviceId: id }));
   } catch {
   }
+  ensureMirrors(id);
   return id;
 }
 
@@ -122052,8 +122157,8 @@ async function runDaemon(opts = {}) {
   log10("paths", JSON.stringify(sealBasePaths()));
   const OUR_STARTED_AT = procStartedAt(process.pid);
   let ownsMachine = false;
-  const pidfile2 = () => join91(daemonDir2(), "daemon.lock");
-  const statusFile2 = () => join91(daemonDir2(), "status.json");
+  const pidfile2 = () => join92(daemonDir2(), "daemon.lock");
+  const statusFile2 = () => join92(daemonDir2(), "status.json");
   const isAlive2 = (pid) => {
     if (!Number.isFinite(pid) || pid <= 0)
       return false;
@@ -122066,7 +122171,7 @@ async function runDaemon(opts = {}) {
   };
   const lockHeldByAnother = () => {
     try {
-      const pid = Number(readFileSync59(pidfile2(), "utf-8").trim());
+      const pid = Number(readFileSync60(pidfile2(), "utf-8").trim());
       return Number.isFinite(pid) && pid > 0 && pid !== process.pid && isAlive2(pid);
     } catch {
       return false;
@@ -122074,7 +122179,7 @@ async function runDaemon(opts = {}) {
   };
   const lockHeldByYieldingSubset = () => {
     try {
-      const pid = Number(readFileSync59(pidfile2(), "utf-8").trim());
+      const pid = Number(readFileSync60(pidfile2(), "utf-8").trim());
       if (!Number.isFinite(pid) || pid <= 0 || pid === process.pid || !isAlive2(pid))
         return false;
       return liveDaemons().some((d) => d.pid === pid && d.rdeskOnly === true);
@@ -122085,17 +122190,17 @@ async function runDaemon(opts = {}) {
   function acquireLock2() {
     const f = pidfile2();
     try {
-      if (!existsSync49(daemonDir2()))
-        mkdirSync47(daemonDir2(), { recursive: true, mode: 448 });
+      if (!existsSync50(daemonDir2()))
+        mkdirSync48(daemonDir2(), { recursive: true, mode: 448 });
     } catch {
     }
     for (let attempt = 0; attempt < 2; attempt++) {
       try {
-        writeFileSync44(f, String(process.pid), { flag: "wx" });
+        writeFileSync45(f, String(process.pid), { flag: "wx" });
         return true;
       } catch {
         try {
-          const prev = Number(readFileSync59(f, "utf-8").trim());
+          const prev = Number(readFileSync60(f, "utf-8").trim());
           if (!prev)
             return false;
           if (prev !== process.pid && isAlive2(prev))
@@ -122111,7 +122216,7 @@ async function runDaemon(opts = {}) {
   function releaseLock() {
     try {
       const f = pidfile2();
-      if (existsSync49(f) && Number(readFileSync59(f, "utf-8").trim()) === process.pid)
+      if (existsSync50(f) && Number(readFileSync60(f, "utf-8").trim()) === process.pid)
         unlinkSync8(f);
     } catch {
     }
@@ -122121,7 +122226,7 @@ async function runDaemon(opts = {}) {
     if (!ownsMachine)
       return;
     try {
-      writeFileSync44(statusFile2(), JSON.stringify({ pid: process.pid, startedAt: OUR_STARTED_AT, role: process.env.CCB_RDESK_ROLE ?? "host", kind: KIND, version: VERSION2, execPath: process.env.CCB_DAEMON_EXECPATH ?? process.execPath, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), gui: daemonGuiTrayActive(), ...localInfo ?? {}, ...s }));
+      writeFileSync45(statusFile2(), JSON.stringify({ pid: process.pid, startedAt: OUR_STARTED_AT, role: process.env.CCB_RDESK_ROLE ?? "host", kind: KIND, version: VERSION2, execPath: process.env.CCB_DAEMON_EXECPATH ?? process.execPath, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), gui: daemonGuiTrayActive(), ...localInfo ?? {}, ...s }));
       chmodSync8(statusFile2(), 384);
     } catch {
     }
@@ -122241,7 +122346,7 @@ async function runDaemon(opts = {}) {
   }
   const snapshotProcs = (tag) => {
     try {
-      const raw = execFileSync6("ps", ["-axww", "-o", "pid=,ppid=,pcpu=,etime=,command="], { encoding: "utf8", timeout: 3e3 });
+      const raw = execFileSync7("ps", ["-axww", "-o", "pid=,ppid=,pcpu=,etime=,command="], { encoding: "utf8", timeout: 3e3 });
       const rows = raw.split("\n").filter((l) => /[Tt]esseract|host-daemon/.test(l) && !/\bgrep\b|ps -axww/.test(l));
       log10(`PROC-SNAPSHOT [${tag}] me=${process.pid} ppid=${process.ppid} \u2014 ${rows.length} tesseract proc(s):`);
       for (const r of rows.slice(0, 40))
@@ -122684,7 +122789,7 @@ async function runDaemon(opts = {}) {
         if (r.status === 401) {
           log10("device token no longer valid \u2014 dropping to local-only on restart");
           try {
-            unlinkSync8(join91(daemonDir2(), "credentials.json"));
+            unlinkSync8(join92(daemonDir2(), "credentials.json"));
           } catch {
           }
           shutdown(0, "token-revoked-401");
@@ -123004,7 +123109,7 @@ async function runDaemon(opts = {}) {
     let freeTicks = 0;
     const lockHolder = () => {
       try {
-        return Number(readFileSync59(pidfile2(), "utf-8").trim()) || 0;
+        return Number(readFileSync60(pidfile2(), "utf-8").trim()) || 0;
       } catch {
         return 0;
       }
@@ -123174,7 +123279,7 @@ async function runDaemon(opts = {}) {
     onDeviceRevoked: () => {
       log10("this machine was removed from the account \u2014 dropping its credentials; it speaks for itself again");
       try {
-        unlinkSync8(join91(daemonDir2(), "credentials.json"));
+        unlinkSync8(join92(daemonDir2(), "credentials.json"));
       } catch {
       }
       void reloadIdentity();
@@ -123227,7 +123332,7 @@ async function runDaemon(opts = {}) {
     if (appPid > 0 && appPid !== process.pid) {
       const quitMarker = () => {
         try {
-          return Number(readFileSync59(join91(daemonDir2(), "app-quit.marker"), "utf-8").trim()) || 0;
+          return Number(readFileSync60(join92(daemonDir2(), "app-quit.marker"), "utf-8").trim()) || 0;
         } catch {
           return 0;
         }
@@ -123252,7 +123357,7 @@ async function runDaemon(opts = {}) {
           log10(`desktop app (pid ${appPid}) is gone with NO clean-quit marker \u2014 reporting`);
           const tail3 = (name) => {
             try {
-              const buf = readFileSync59(join91(daemonDir2(), name), "utf-8");
+              const buf = readFileSync60(join92(daemonDir2(), name), "utf-8");
               return buf.length > 4096 ? buf.slice(-4096) : buf;
             } catch {
               return void 0;
@@ -123283,14 +123388,14 @@ async function runDaemon(opts = {}) {
   }
   try {
     const DAEMON_LOG_CAP = 2 * 1024 * 1024;
-    const daemonLogFile = join91(daemonDir2(), "daemon.log");
+    const daemonLogFile = join92(daemonDir2(), "daemon.log");
     const capTimer = setInterval(() => {
       try {
-        if (existsSync49(daemonLogFile) && statSync21(daemonLogFile).size > DAEMON_LOG_CAP) {
-          const buf = readFileSync59(daemonLogFile, "utf-8");
+        if (existsSync50(daemonLogFile) && statSync21(daemonLogFile).size > DAEMON_LOG_CAP) {
+          const buf = readFileSync60(daemonLogFile, "utf-8");
           const kept = `\u2026[daemon.log capped at ${(/* @__PURE__ */ new Date()).toISOString()}]\u2026
 ` + buf.slice(-DAEMON_LOG_CAP / 2);
-          writeFileSync44(daemonLogFile, kept);
+          writeFileSync45(daemonLogFile, kept);
         }
       } catch {
       }
@@ -123396,15 +123501,15 @@ init_credentials();
 
 // ../../packages/host-core/dist/net-service/ensure-installed.js
 import { execFile as execFile16 } from "node:child_process";
-import { existsSync as existsSync53, readFileSync as readFileSync62, statSync as statSync22 } from "node:fs";
-import { dirname as dirname41, join as join95 } from "node:path";
+import { existsSync as existsSync54, readFileSync as readFileSync63, statSync as statSync22 } from "node:fs";
+import { dirname as dirname42, join as join96 } from "node:path";
 import { promisify as promisify12 } from "node:util";
 
 // ../../packages/host-core/dist/net-service/launchd-system.js
 import { spawn as spawn9 } from "node:child_process";
-import { existsSync as existsSync51, mkdtempSync as mkdtempSync2, writeFileSync as writeFileSync45, rmSync as rmSync11, readFileSync as readFileSync60 } from "node:fs";
+import { existsSync as existsSync52, mkdtempSync as mkdtempSync2, writeFileSync as writeFileSync46, rmSync as rmSync11, readFileSync as readFileSync61 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
-import { join as join93 } from "node:path";
+import { join as join94 } from "node:path";
 
 // ../../packages/host-core/dist/net-service/owner-uid.js
 function installOwnerUid(env = process.env, self2 = typeof process.getuid === "function" ? process.getuid() : 0) {
@@ -123449,14 +123554,14 @@ async function alreadyElevated() {
 }
 
 // ../../packages/host-core/dist/net-service/app-bundle.js
-import { execFileSync as execFileSync7 } from "node:child_process";
-import { existsSync as existsSync50 } from "node:fs";
-import { dirname as dirname40, basename as basename16, join as join92 } from "node:path";
+import { execFileSync as execFileSync8 } from "node:child_process";
+import { existsSync as existsSync51 } from "node:fs";
+import { dirname as dirname41, basename as basename16, join as join93 } from "node:path";
 function appBundleFor(exec2) {
   let found;
-  let dir2 = dirname40(exec2);
-  for (let prev = ""; dir2 !== prev; prev = dir2, dir2 = dirname40(dir2)) {
-    if (basename16(dir2).endsWith(".app") && existsSync50(join92(dir2, "Contents", "Info.plist"))) {
+  let dir2 = dirname41(exec2);
+  for (let prev = ""; dir2 !== prev; prev = dir2, dir2 = dirname41(dir2)) {
+    if (basename16(dir2).endsWith(".app") && existsSync51(join93(dir2, "Contents", "Info.plist"))) {
       found = dir2;
     }
   }
@@ -123472,7 +123577,7 @@ function bundleIdForExec(exec2) {
   if (!bundle)
     return void 0;
   try {
-    const id = execFileSync7("/usr/bin/plutil", ["-extract", "CFBundleIdentifier", "raw", "-o", "-", join92(bundle, "Contents", "Info.plist")], { encoding: "utf8", timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const id = execFileSync8("/usr/bin/plutil", ["-extract", "CFBundleIdentifier", "raw", "-o", "-", join93(bundle, "Contents", "Info.plist")], { encoding: "utf8", timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] }).trim();
     return looksLikeBundleId(id) ? id : void 0;
   } catch {
     return void 0;
@@ -123571,10 +123676,10 @@ function runForCode(cmd, args) {
   });
 }
 async function elevate(script) {
-  const dir2 = mkdtempSync2(join93(tmpdir6(), "tesseract-netd-"));
-  const path6 = join93(dir2, "install.sh");
+  const dir2 = mkdtempSync2(join94(tmpdir6(), "tesseract-netd-"));
+  const path6 = join94(dir2, "install.sh");
   try {
-    writeFileSync45(path6, script, { mode: 384 });
+    writeFileSync46(path6, script, { mode: 384 });
     if (await alreadyElevated()) {
       return { code: await runForCode("/bin/sh", [path6]), declined: false };
     }
@@ -123644,9 +123749,9 @@ ${plist}TESSERACT_PLIST_EOF`,
       };
     },
     async state() {
-      if (!existsSync51(PLIST))
+      if (!existsSync52(PLIST))
         return { installed: false, running: false };
-      const text13 = readFileSync60(PLIST, "utf8");
+      const text13 = readFileSync61(PLIST, "utf8");
       const owner = parseOwnerUid(text13);
       const assoc = parseAssociatedBundleId(text13);
       const running2 = await netdAvailable();
@@ -123667,7 +123772,7 @@ ${plist}TESSERACT_PLIST_EOF`,
 
 // ../../packages/host-core/dist/net-service/systemd-system.js
 import { spawn as spawn11 } from "node:child_process";
-import { existsSync as existsSync52, readFileSync as readFileSync61 } from "node:fs";
+import { existsSync as existsSync53, readFileSync as readFileSync62 } from "node:fs";
 
 // ../../packages/host-core/dist/service/exec.js
 import { execFile as execFile13, spawn as spawn10 } from "node:child_process";
@@ -123844,9 +123949,9 @@ function makeSystemdSystem() {
       return code === 0 ? { ok: true } : { ok: false, detail: `removing the helper failed (exit ${code})` };
     },
     async state() {
-      if (!existsSync52(UNIT_PATH))
+      if (!existsSync53(UNIT_PATH))
         return { installed: false, running: false };
-      const owner = parseOwnerUid(readFileSync61(UNIT_PATH, "utf8"));
+      const owner = parseOwnerUid(readFileSync62(UNIT_PATH, "utf8"));
       const active2 = await tryRun("systemctl", ["is-active", UNIT]);
       const running2 = active2.stdout.trim() === "active";
       const own2 = owner === void 0 ? {} : { ownerUid: owner };
@@ -123871,12 +123976,12 @@ function sh2(s) {
 
 // ../../packages/host-core/dist/net-service/windows-service.js
 import { execFile as execFile14, spawn as spawn12 } from "node:child_process";
-import { mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync46, rmSync as rmSync12 } from "node:fs";
+import { mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync47, rmSync as rmSync12 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
-import { join as join94, win32 } from "node:path";
+import { join as join95, win32 } from "node:path";
 import { promisify as promisify10 } from "node:util";
 var run7 = promisify10(execFile14);
-var SERVICE = "TesseractNetd";
+var SERVICE2 = "TesseractNetd";
 var DISPLAY = "Tesseract network helper";
 function windowsHelperDir() {
   const root = process.env.ProgramW6432 || process.env.ProgramFiles || "C:\\Program Files";
@@ -123908,9 +124013,9 @@ function buildBinaryPath(spec) {
   return parts.map((p) => `"${p}"`).join(" ");
 }
 async function elevatePowerShell(script) {
-  const dir2 = mkdtempSync3(join94(tmpdir7(), "tesseract-netd-"));
-  const inner = join94(dir2, "install.ps1");
-  writeFileSync46(inner, script, { encoding: "utf8" });
+  const dir2 = mkdtempSync3(join95(tmpdir7(), "tesseract-netd-"));
+  const inner = join95(dir2, "install.ps1");
+  writeFileSync47(inner, script, { encoding: "utf8" });
   if (await alreadyElevated()) {
     return new Promise((resolve16) => {
       const p = spawn12("powershell.exe", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", inner], { stdio: "inherit" });
@@ -123925,8 +124030,8 @@ async function elevatePowerShell(script) {
       p.on("close", (code) => finish2(code ?? 1));
     });
   }
-  const outer = join94(dir2, "elevate.ps1");
-  writeFileSync46(outer, [
+  const outer = join95(dir2, "elevate.ps1");
+  writeFileSync47(outer, [
     '$ErrorActionPreference = "Stop"',
     "try {",
     `  $p = Start-Process -FilePath "powershell.exe" -ArgumentList @("-NoProfile","-ExecutionPolicy","Bypass","-File",${ps(inner)}) -Verb RunAs -Wait -PassThru`,
@@ -123960,10 +124065,10 @@ function buildInstallScript2(spec) {
     // Stopping first is ALSO what makes the copy below possible: Windows locks a running
     // executable, so overwriting `tesseract-netd.exe` while the old service holds it fails
     // with "being used by another process" — on exactly the upgrade this exists to perform.
-    `$existing = Get-Service -Name ${ps(SERVICE)} -ErrorAction SilentlyContinue`,
+    `$existing = Get-Service -Name ${ps(SERVICE2)} -ErrorAction SilentlyContinue`,
     "if ($existing) {",
-    `  Stop-Service -Name ${ps(SERVICE)} -Force -ErrorAction SilentlyContinue`,
-    `  & sc.exe delete ${SERVICE} | Out-Null`,
+    `  Stop-Service -Name ${ps(SERVICE2)} -Force -ErrorAction SilentlyContinue`,
+    `  & sc.exe delete ${SERVICE2} | Out-Null`,
     "  Start-Sleep -Milliseconds 500",
     "}",
     // The whole shipped directory, not just the exe: tun-rs `LoadLibrary`s `wintun.dll` from
@@ -123975,7 +124080,7 @@ function buildInstallScript2(spec) {
     `if (-not (Test-Path -LiteralPath ${ps(windowsHelperExec())})) { exit 2 }`,
     // Checked ELEVATED, on the admin-owned copy: the source directory is user-writable.
     ...spec.execSha256 ? [`if ((Get-FileHash -Algorithm SHA256 -LiteralPath ${ps(windowsHelperExec())}).Hash.ToLower() -ne ${ps(spec.execSha256)}) { Remove-Item -LiteralPath ${ps(windowsHelperExec())} -Force; exit 3 }`] : [],
-    `New-Service -Name ${ps(SERVICE)} -BinaryPathName ${ps(bin)} -DisplayName ${ps(DISPLAY)} -Description ${ps("Programs the routes for Tesseract private networks and owns the tunnel device.")} -StartupType Automatic | Out-Null`,
+    `New-Service -Name ${ps(SERVICE2)} -BinaryPathName ${ps(bin)} -DisplayName ${ps(DISPLAY)} -Description ${ps("Programs the routes for Tesseract private networks and owns the tunnel device.")} -StartupType Automatic | Out-Null`,
     // RESTART FOR AS LONG AS THE MACHINE IS ON, which is the same contract systemd
     // (`Restart=on-failure`, no `StartLimitBurst`) and launchd (`KeepAlive`/`SuccessfulExit`)
     // give on the other two platforms. A private network that stops coming back after three
@@ -123993,15 +124098,15 @@ function buildInstallScript2(spec) {
     // `reset= 86400` still applies: a day without a failure clears the count. The delays rise
     // 5s → 10s → 60s, and Windows repeats the LAST action for every subsequent failure, so a
     // genuinely unfixable crash costs one attempt a minute rather than a spin.
-    `& sc.exe failure ${SERVICE} reset= 86400 actions= restart/5000/restart/10000/restart/60000 | Out-Null`,
-    `Start-Service -Name ${ps(SERVICE)}`,
+    `& sc.exe failure ${SERVICE2} reset= 86400 actions= restart/5000/restart/10000/restart/60000 | Out-Null`,
+    `Start-Service -Name ${ps(SERVICE2)}`,
     "exit 0"
   ].join("\n");
 }
 function buildUninstallScript() {
   return [
-    `Stop-Service -Name ${ps(SERVICE)} -Force -ErrorAction SilentlyContinue`,
-    `& sc.exe delete ${SERVICE} | Out-Null`,
+    `Stop-Service -Name ${ps(SERVICE2)} -Force -ErrorAction SilentlyContinue`,
+    `& sc.exe delete ${SERVICE2} | Out-Null`,
     // The copy goes too. Leaving an admin-owned helper behind after an uninstall is litter at
     // best; the pause lets the stopped process release its file lock first.
     "Start-Sleep -Milliseconds 500",
@@ -124033,7 +124138,7 @@ function makeWindowsService() {
     },
     async state() {
       try {
-        const { stdout } = await run7("sc.exe", ["query", SERVICE]);
+        const { stdout } = await run7("sc.exe", ["query", SERVICE2]);
         const out = String(stdout);
         const running2 = /STATE\s*:\s*4\b/.test(out);
         if (running2)
@@ -124185,16 +124290,16 @@ function installedHelperPath(platform8) {
 function helperDiffers(shipped, installed) {
   if (!shipped || !installed)
     return false;
-  if (!existsSync53(shipped))
+  if (!existsSync54(shipped))
     return false;
-  if (!existsSync53(installed))
+  if (!existsSync54(installed))
     return true;
   try {
     const a = statSync22(shipped);
     const b = statSync22(installed);
     if (a.size !== b.size)
       return true;
-    return !readFileSync62(shipped).equals(readFileSync62(installed));
+    return !readFileSync63(shipped).equals(readFileSync63(installed));
   } catch {
     return false;
   }
@@ -124223,7 +124328,7 @@ async function ensureNetHelperInstalled() {
       return { ok: false, reason: "failed", detail: u.detail };
   }
   const exec2 = netdBinaryPath();
-  if (exec2 && process.platform === "win32" && !existsSync53(join95(dirname41(exec2), "wintun.dll"))) {
+  if (exec2 && process.platform === "win32" && !existsSync54(join96(dirname42(exec2), "wintun.dll"))) {
     return {
       ok: false,
       reason: "no-binary",
@@ -124280,9 +124385,9 @@ import { platform as platform6 } from "node:os";
 
 // ../../packages/host-core/dist/service/launchd.js
 init_credentials();
-import { writeFileSync as writeFileSync47, existsSync as existsSync54, mkdirSync as mkdirSync48, unlinkSync as unlinkSync9, readFileSync as readFileSync63 } from "node:fs";
-import { dirname as dirname42, join as join96 } from "node:path";
-import { homedir as homedir16, userInfo as userInfo2 } from "node:os";
+import { writeFileSync as writeFileSync48, existsSync as existsSync55, mkdirSync as mkdirSync49, unlinkSync as unlinkSync9, readFileSync as readFileSync64 } from "node:fs";
+import { dirname as dirname43, join as join97 } from "node:path";
+import { homedir as homedir17, userInfo as userInfo2 } from "node:os";
 
 // ../../packages/host-core/dist/service/legacy-label.js
 function definitionIsCli(text13) {
@@ -124298,18 +124403,18 @@ function xml2(s) {
 function makeLaunchd(instanceId) {
   const suffix = instanceSuffix(instanceId);
   const label = SERVICE_LABEL_BASE + (suffix ? `.${suffix}` : "");
-  const plistPath = () => join96(homedir16(), "Library", "LaunchAgents", `${label}.plist`);
+  const plistPath = () => join97(homedir17(), "Library", "LaunchAgents", `${label}.plist`);
   const domainTarget = () => `gui/${userInfo2().uid}`;
   const serviceTarget = () => `${domainTarget()}/${label}`;
-  const logFile = () => join96(daemonDir2(), "daemon.log");
+  const logFile = () => join97(daemonDir2(), "daemon.log");
   const legacyLabel = LEGACY_SERVICE_LABEL_BASE + (suffix ? `.${suffix}` : "");
-  const legacyPlistPath = () => join96(homedir16(), "Library", "LaunchAgents", `${legacyLabel}.plist`);
+  const legacyPlistPath = () => join97(homedir17(), "Library", "LaunchAgents", `${legacyLabel}.plist`);
   async function removeLegacySharedJob() {
     try {
       const p = legacyPlistPath();
-      if (!existsSync54(p))
+      if (!existsSync55(p))
         return;
-      if (!definitionIsCli(readFileSync63(p, "utf-8")))
+      if (!definitionIsCli(readFileSync64(p, "utf-8")))
         return;
       await run6("launchctl", ["bootout", `${domainTarget()}/${legacyLabel}`]).catch(() => {
       });
@@ -124392,10 +124497,10 @@ ${env}
   return {
     async install(spec) {
       await removeLegacySharedJob();
-      mkdirSync48(workDirOf(spec), { recursive: true });
-      mkdirSync48(dirname42(plistPath()), { recursive: true });
-      mkdirSync48(dirname42(spec.logPath), { recursive: true });
-      writeFileSync47(plistPath(), buildPlist2(spec));
+      mkdirSync49(workDirOf(spec), { recursive: true });
+      mkdirSync49(dirname43(plistPath()), { recursive: true });
+      mkdirSync49(dirname43(spec.logPath), { recursive: true });
+      writeFileSync48(plistPath(), buildPlist2(spec));
       await run6("launchctl", ["bootout", serviceTarget()]).catch(() => {
       });
       await untilGone();
@@ -124411,7 +124516,7 @@ ${env}
     async uninstall() {
       await run6("launchctl", ["bootout", serviceTarget()]).catch(() => {
       });
-      if (existsSync54(plistPath())) {
+      if (existsSync55(plistPath())) {
         try {
           unlinkSync9(plistPath());
         } catch {
@@ -124422,7 +124527,7 @@ ${env}
       await this.install(spec);
     },
     async isInstalled() {
-      return existsSync54(plistPath());
+      return existsSync55(plistPath());
     },
     async start() {
       await run6("launchctl", ["bootstrap", domainTarget(), plistPath()]).catch(() => {
@@ -124439,7 +124544,7 @@ ${env}
     },
     async logs(follow) {
       const f = logFile();
-      if (!existsSync54(f)) {
+      if (!existsSync55(f)) {
         console.log(`No log yet at ${f} \u2014 has the service started?`);
         return;
       }
@@ -124450,9 +124555,9 @@ ${env}
 
 // ../../packages/host-core/dist/service/systemd.js
 init_credentials();
-import { writeFileSync as writeFileSync48, existsSync as existsSync55, mkdirSync as mkdirSync49, unlinkSync as unlinkSync10, readFileSync as readFileSync64 } from "node:fs";
-import { dirname as dirname43, join as join97 } from "node:path";
-import { homedir as homedir17, userInfo as userInfo3 } from "node:os";
+import { writeFileSync as writeFileSync49, existsSync as existsSync56, mkdirSync as mkdirSync50, unlinkSync as unlinkSync10, readFileSync as readFileSync65 } from "node:fs";
+import { dirname as dirname44, join as join98 } from "node:path";
+import { homedir as homedir18, userInfo as userInfo3 } from "node:os";
 function unitVal2(v) {
   return v.replace(/%/g, "%%");
 }
@@ -124464,16 +124569,16 @@ function makeSystemd(instanceId) {
   const unit = `tesseract-agent${suffix ? `-${suffix}` : ""}.service`;
   const legacyUnit = `tesseract-host${suffix ? `-${suffix}` : ""}.service`;
   const unitPath = () => {
-    const base = process.env.XDG_CONFIG_HOME || join97(homedir17(), ".config");
-    return join97(base, "systemd", "user", unit);
+    const base = process.env.XDG_CONFIG_HOME || join98(homedir18(), ".config");
+    return join98(base, "systemd", "user", unit);
   };
   async function removeLegacySharedUnit() {
     try {
-      const base = process.env.XDG_CONFIG_HOME || join97(homedir17(), ".config");
-      const p = join97(base, "systemd", "user", legacyUnit);
-      if (!existsSync55(p))
+      const base = process.env.XDG_CONFIG_HOME || join98(homedir18(), ".config");
+      const p = join98(base, "systemd", "user", legacyUnit);
+      if (!existsSync56(p))
         return;
-      if (!definitionIsCli(readFileSync64(p, "utf-8")))
+      if (!definitionIsCli(readFileSync65(p, "utf-8")))
         return;
       await run6("systemctl", ["--user", "disable", "--now", legacyUnit]).catch(() => {
       });
@@ -124509,10 +124614,10 @@ WantedBy=default.target
   return {
     async install(spec) {
       await removeLegacySharedUnit();
-      mkdirSync49(workDirOf(spec), { recursive: true });
-      mkdirSync49(dirname43(unitPath()), { recursive: true });
-      mkdirSync49(dirname43(spec.logPath), { recursive: true });
-      writeFileSync48(unitPath(), buildUnit2(spec));
+      mkdirSync50(workDirOf(spec), { recursive: true });
+      mkdirSync50(dirname44(unitPath()), { recursive: true });
+      mkdirSync50(dirname44(spec.logPath), { recursive: true });
+      writeFileSync49(unitPath(), buildUnit2(spec));
       await run6("loginctl", ["enable-linger", userInfo3().username]).catch(() => {
       });
       await run6("systemctl", ["--user", "daemon-reload"]).catch(() => {
@@ -124524,7 +124629,7 @@ WantedBy=default.target
     async uninstall() {
       await run6("systemctl", ["--user", "disable", "--now", unit]).catch(() => {
       });
-      if (existsSync55(unitPath())) {
+      if (existsSync56(unitPath())) {
         try {
           unlinkSync10(unitPath());
         } catch {
@@ -124537,7 +124642,7 @@ WantedBy=default.target
       await this.install(spec);
     },
     async isInstalled() {
-      return existsSync55(unitPath());
+      return existsSync56(unitPath());
     },
     async start() {
       await run6("systemctl", ["--user", "start", unit]);
@@ -124549,8 +124654,8 @@ WantedBy=default.target
       await runInherit("systemctl", ["--user", "status", unit, "--no-pager"]);
     },
     async logs(follow) {
-      const f = join97(daemonDir2(), "daemon.log");
-      if (existsSync55(f)) {
+      const f = join98(daemonDir2(), "daemon.log");
+      if (existsSync56(f)) {
         await runInherit("tail", follow ? ["-f", f] : ["-n", "200", f]);
         return;
       }
@@ -124562,12 +124667,12 @@ WantedBy=default.target
 
 // ../../packages/host-core/dist/service/windows.js
 init_credentials();
-import { writeFileSync as writeFileSync49, existsSync as existsSync56, mkdirSync as mkdirSync50, unlinkSync as unlinkSync11, readFileSync as readFileSync65 } from "node:fs";
-import { dirname as dirname44, join as join98 } from "node:path";
+import { writeFileSync as writeFileSync50, existsSync as existsSync57, mkdirSync as mkdirSync51, unlinkSync as unlinkSync11, readFileSync as readFileSync66 } from "node:fs";
+import { dirname as dirname45, join as join99 } from "node:path";
 function publishedDaemonPid(dir2) {
   for (const f of ["status.json", "daemon.lock"]) {
     try {
-      const raw = readFileSync65(join98(dir2, f), "utf-8");
+      const raw = readFileSync66(join99(dir2, f), "utf-8");
       const pid = f === "status.json" ? Number(JSON.parse(raw).pid) : Number(raw.trim());
       if (Number.isInteger(pid) && pid > 0)
         return pid;
@@ -124580,15 +124685,15 @@ function makeWindowsTask(instanceId) {
   const suffix = instanceSuffix(instanceId);
   const task = `Fineguide\\TesseractAgent${suffix ? `-${suffix}` : ""}`;
   const legacyTask = `Fineguide\\TesseractHost${suffix ? `-${suffix}` : ""}`;
-  const wrapperPath = () => join98(daemonDir2(), `run-agent${suffix ? `-${suffix}` : ""}.cmd`);
-  const legacyWrapperPath = () => join98(daemonDir2(), `run-host${suffix ? `-${suffix}` : ""}.cmd`);
-  const logFile = () => join98(daemonDir2(), "daemon.log");
+  const wrapperPath = () => join99(daemonDir2(), `run-agent${suffix ? `-${suffix}` : ""}.cmd`);
+  const legacyWrapperPath = () => join99(daemonDir2(), `run-host${suffix ? `-${suffix}` : ""}.cmd`);
+  const logFile = () => join99(daemonDir2(), "daemon.log");
   async function removeLegacySharedTask() {
     try {
       const w = legacyWrapperPath();
-      if (!existsSync56(w))
+      if (!existsSync57(w))
         return;
-      if (!definitionIsCli(readFileSync65(w, "utf-8")))
+      if (!definitionIsCli(readFileSync66(w, "utf-8")))
         return;
       await run6("schtasks", ["/End", "/TN", legacyTask]).catch(() => {
       });
@@ -124614,10 +124719,10 @@ start "" /b ${cmd} >> "${oneLine3(spec.logPath).replace(/"/g, "")}" 2>&1\r
   return {
     async install(spec) {
       await removeLegacySharedTask();
-      mkdirSync50(spec.workingDirectory ?? daemonDir2(), { recursive: true });
-      mkdirSync50(dirname44(spec.logPath), { recursive: true });
-      mkdirSync50(dirname44(wrapperPath()), { recursive: true });
-      writeFileSync49(wrapperPath(), buildWrapper(spec));
+      mkdirSync51(spec.workingDirectory ?? daemonDir2(), { recursive: true });
+      mkdirSync51(dirname45(spec.logPath), { recursive: true });
+      mkdirSync51(dirname45(wrapperPath()), { recursive: true });
+      writeFileSync50(wrapperPath(), buildWrapper(spec));
       await run6("schtasks", ["/Create", "/TN", task, "/SC", "ONLOGON", "/RL", "LIMITED", "/F", "/TR", `"${wrapperPath()}"`]);
       await run6("schtasks", ["/Run", "/TN", task]).catch(() => {
       });
@@ -124625,7 +124730,7 @@ start "" /b ${cmd} >> "${oneLine3(spec.logPath).replace(/"/g, "")}" 2>&1\r
     async uninstall() {
       await run6("schtasks", ["/Delete", "/TN", task, "/F"]).catch(() => {
       });
-      if (existsSync56(wrapperPath())) {
+      if (existsSync57(wrapperPath())) {
         try {
           unlinkSync11(wrapperPath());
         } catch {
@@ -124699,7 +124804,7 @@ start "" /b ${cmd} >> "${oneLine3(spec.logPath).replace(/"/g, "")}" 2>&1\r
     },
     async logs(follow) {
       const f = logFile();
-      if (!existsSync56(f)) {
+      if (!existsSync57(f)) {
         console.log(`No log yet at ${f} \u2014 has the task run?`);
         return;
       }
@@ -124835,8 +124940,8 @@ init_safe_kill();
 
 // src/auth.ts
 var import_qrcode_terminal = __toESM(require_main(), 1);
-import { existsSync as existsSync57, rmSync as rmSync13 } from "node:fs";
-import { join as join99 } from "node:path";
+import { existsSync as existsSync58, rmSync as rmSync13 } from "node:fs";
+import { join as join100 } from "node:path";
 
 // src/config.ts
 import { hostname as hostname7 } from "node:os";
@@ -125037,8 +125142,8 @@ async function logout() {
   }
   for (const f of ["credentials.json", "status.json", "daemon.lock"]) {
     try {
-      const p = join99(daemonDir2(), f);
-      if (existsSync57(p)) rmSync13(p);
+      const p = join100(daemonDir2(), f);
+      if (existsSync58(p)) rmSync13(p);
     } catch {
     }
   }
@@ -125196,9 +125301,9 @@ function startSelfUpdater(current) {
 }
 
 // src/service.ts
-import { join as join100 } from "node:path";
+import { join as join101 } from "node:path";
 import { platform as platform7 } from "node:os";
-import { existsSync as existsSync58, readFileSync as readFileSync66 } from "node:fs";
+import { existsSync as existsSync59, readFileSync as readFileSync67 } from "node:fs";
 function controller(instanceId) {
   const c = getServiceController(instanceId);
   if (!c) {
@@ -125211,7 +125316,7 @@ function buildSpec(cliEntry) {
     exec: process.execPath,
     args: [cliEntry, "run"],
     env: { CCB_DAEMON_DIR: daemonDir2() },
-    logPath: join100(daemonDir2(), "daemon.log")
+    logPath: join101(daemonDir2(), "daemon.log")
   };
 }
 var isAlive = (pid) => {
@@ -125223,10 +125328,10 @@ var isAlive = (pid) => {
   }
 };
 function runningDaemonInfo() {
-  const lock = join100(daemonDir2(), "daemon.lock");
+  const lock = join101(daemonDir2(), "daemon.lock");
   try {
-    if (!existsSync58(lock)) return null;
-    const pid = Number(readFileSync66(lock, "utf-8").trim());
+    if (!existsSync59(lock)) return null;
+    const pid = Number(readFileSync67(lock, "utf-8").trim());
     if (!pid || !isAlive(pid)) return null;
     return { pid, device: readCredentials()?.deviceId };
   } catch {
@@ -125260,7 +125365,7 @@ async function logs(instanceId, follow) {
 }
 
 // src/net.ts
-import { readFileSync as readFileSync68 } from "node:fs";
+import { readFileSync as readFileSync69 } from "node:fs";
 import { randomBytes as randomBytes12 } from "node:crypto";
 import { hostname as hostname8 } from "node:os";
 import { resolve as resolve14 } from "node:path";
@@ -125343,7 +125448,7 @@ function readOrDie(label, p) {
     process.exit(1);
   }
   try {
-    return new Uint8Array(readFileSync68(resolve14(p)));
+    return new Uint8Array(readFileSync69(resolve14(p)));
   } catch (e) {
     console.error(`net enroll: could not read --${label} ${p}: ${e instanceof Error ? e.message : e}`);
     process.exit(1);
@@ -126111,8 +126216,8 @@ async function meshCommand(rest, flags) {
 // src/cli.ts
 function pkgVersion() {
   try {
-    const p = join102(dirname45(fileURLToPath8(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync69(p, "utf8")).version ?? "0.0.0";
+    const p = join103(dirname46(fileURLToPath8(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync70(p, "utf8")).version ?? "0.0.0";
   } catch {
     return "0.0.0";
   }
@@ -126340,7 +126445,7 @@ async function linkCommand(rest, flags) {
   process.exit(1);
 }
 async function captureClaudeSubscription(flags) {
-  const home = mkdtempSync4(join102(tmpdir8(), "tesseract-claude-login-"));
+  const home = mkdtempSync4(join103(tmpdir8(), "tesseract-claude-login-"));
   const binary = typeof flags["claude-path"] === "string" ? flags["claude-path"] : process.env.CCB_ENGINE_PATH_CLAUDE_CODE || "claude";
   const args = ["auth", "login", "--claudeai"];
   if (typeof flags.email === "string") args.push("--email", flags.email);
@@ -126357,10 +126462,10 @@ async function captureClaudeSubscription(flags) {
       child.once("close", (exitCode, signal2) => resolveCode(signal2 ? 1 : exitCode ?? 1));
     });
     if (code !== 0) throw new Error(`Claude sign-in did not complete (exit ${code}).`);
-    const file2 = join102(home, ".credentials.json");
-    if (existsSync60(file2)) return readFileSync69(file2, "utf8");
+    const file2 = join103(home, ".credentials.json");
+    if (existsSync61(file2)) return readFileSync70(file2, "utf8");
     if (process.platform === "darwin") {
-      const value = execFileSync8("security", [
+      const value = execFileSync9("security", [
         "find-generic-password",
         "-s",
         "Claude Code-credentials",
@@ -126440,7 +126545,7 @@ async function runnerCommand(rest, flags) {
       process.exit(1);
     }
     const oauthFilePath = typeof flags["oauth-file"] === "string" ? resolve15(flags["oauth-file"]) : void 0;
-    const oauthAuthFile = oauthFilePath ? readFileSync69(oauthFilePath, "utf8") : void 0;
+    const oauthAuthFile = oauthFilePath ? readFileSync70(oauthFilePath, "utf8") : void 0;
     if (oauthAuthFile) {
       try {
         JSON.parse(oauthAuthFile);

package/dist-bundle/mesh-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fineguide-tesseract/mesh-core",
-  "version": "0.11.19",
+  "version": "0.11.20",
   "main": "index.js",
   "types": "index.d.ts"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tesseract-agent",
-  "version": "0.11.19",
+  "version": "0.11.20",
   "license": "UNLICENSED",
   "publishConfig": {
     "access": "public",