tesseract-agent 0.11.2 → 0.11.5

package/dist-bundle/cli.js

@@ -3378,7 +3378,7 @@ var require_stream = __commonJS({
       };
       duplex._final = function(callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open7() {
+          ws.once("open", function open8() {
             duplex._final(callback);
           });
           return;
@@ -3399,7 +3399,7 @@ var require_stream = __commonJS({
       };
       duplex._write = function(chunk, encoding, callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open7() {
+          ws.once("open", function open8() {
             duplex._write(chunk, encoding, callback);
           });
           return;
@@ -4269,7 +4269,7 @@ function isPidAlive(pid) {
 function createSchedulerLock(lockDir, ownerId, now2 = () => Date.now()) {
   const lockFile = join5(lockDir, "scheduled_tasks.lock");
   let held = false;
-  const read = () => {
+  const read2 = () => {
     try {
       const rec = JSON.parse(readFileSync4(lockFile, "utf-8"));
       if (rec && typeof rec.ownerId === "string" && typeof rec.pid === "number" && typeof rec.refreshedAt === "number")
@@ -4294,13 +4294,13 @@ function createSchedulerLock(lockDir, ownerId, now2 = () => Date.now()) {
       held = false;
       return false;
     }
-    const after = read();
+    const after = read2();
     held = !!after && after.nonce === nonce2;
     return held;
   };
   return {
     isOwner() {
-      const existing = read();
+      const existing = read2();
       if (!existing) {
         try {
           const fd = openSync(lockFile, "wx");
@@ -4312,7 +4312,7 @@ function createSchedulerLock(lockDir, ownerId, now2 = () => Date.now()) {
           held = true;
           return true;
         } catch {
-          const r = read();
+          const r = read2();
           if (r && r.ownerId === ownerId)
             return writeLease();
           return false;
@@ -4329,7 +4329,7 @@ function createSchedulerLock(lockDir, ownerId, now2 = () => Date.now()) {
     release() {
       if (!held)
         return;
-      const r = read();
+      const r = read2();
       if (r && r.ownerId === ownerId) {
         try {
           unlinkSync(lockFile);
@@ -24207,9 +24207,9 @@ function extractJsonObject(raw) {
 function extractJsonArray(raw) {
   return extractBalanced(raw, "[", "]");
 }
-function extractBalanced(raw, open7, close) {
+function extractBalanced(raw, open8, close) {
   const s = raw.replace(/^```(?:json)?\s*/i, "").replace(/\s*```\s*$/i, "");
-  const start3 = s.indexOf(open7);
+  const start3 = s.indexOf(open8);
   if (start3 < 0)
     return null;
   let depth = 0, inStr = false, esc3 = false;
@@ -24226,7 +24226,7 @@ function extractBalanced(raw, open7, close) {
     }
     if (c === '"')
       inStr = true;
-    else if (c === open7)
+    else if (c === open8)
       depth++;
     else if (c === close) {
       depth--;
@@ -29167,17 +29167,17 @@ function markerPair(path6) {
   return { open: `// ${MARKER}:start`, close: `// ${MARKER}:end` };
 }
 function upsertMarkedBlock(path6, source, block2, anchor) {
-  const { open: open7, close } = markerPair(path6);
-  const start3 = source.indexOf(open7);
+  const { open: open8, close } = markerPair(path6);
+  const start3 = source.indexOf(open8);
   const end2 = source.indexOf(close);
   if (start3 !== -1 && end2 !== -1 && end2 > start3) {
-    const existing = source.slice(start3 + open7.length, end2);
+    const existing = source.slice(start3 + open8.length, end2);
     const next = `
 ${block2}
 `;
     if (existing === next)
       return { ok: true, source, changed: false };
-    return { ok: true, source: source.slice(0, start3 + open7.length) + next + source.slice(end2), changed: true };
+    return { ok: true, source: source.slice(0, start3 + open8.length) + next + source.slice(end2), changed: true };
   }
   if (start3 !== -1 || end2 !== -1) {
     return { ok: false, why: `found only one of the ${MARKER} markers \u2014 remove the stray one by hand and re-run` };
@@ -29189,7 +29189,7 @@ ${block2}
     return { ok: false, why: "could not find where to insert \u2014 the file does not look like the shape we expected" };
   const at = m.index + m[0].length;
   return { ok: true, source: `${source.slice(0, at)}
-${open7}
+${open8}
 ${block2}
 ${close}${source.slice(at)}`, changed: true };
 }
@@ -30878,8 +30878,8 @@ ${err2 instanceof Error ? err2.message : String(err2)}
           const fd = openSync2(job.logPath, "r");
           try {
             const buf = Buffer.allocUnsafe(want);
-            const read = readSync(fd, buf, 0, want, size - want);
-            return buf.subarray(0, read).toString("utf8");
+            const read2 = readSync(fd, buf, 0, want, size - want);
+            return buf.subarray(0, read2).toString("utf8");
           } finally {
             closeSync2(fd);
           }
@@ -31045,6 +31045,19 @@ var init_work_ledger = __esm({
        * gone: what the barrier needs is the answer to "what happened to the thing I was waiting
        * for", asked after it stopped existing.
        */
+      /**
+       * Proof of life: the producer said something about this item (a progress frame, an
+       * inventory that still lists it, a registry that still says running). Its deadline moves
+       * out again, so a long-running job that keeps reporting is never mistaken for a hung one
+       * and never swept while it is really working. Detached items have no deadline to move.
+       */
+      touch(id, now2) {
+        const item = this.items.get(id);
+        if (!item || item.disposition !== "awaited")
+          return false;
+        this.items.set(id, { ...item, deadline: now2 + DEFAULT_DEADLINE_MS[item.kind] });
+        return true;
+      }
       settle(id, outcome = "completed") {
         const had = this.items.delete(id);
         if (had) {
@@ -31123,6 +31136,10 @@ var init_work_ledger = __esm({
         for (const t of inv.tasks ?? []) {
           seen.add(t.id);
           const subagent = t.type === "subagent";
+          if (this.items.has(t.id)) {
+            this.touch(t.id, now2);
+            continue;
+          }
           this.register({
             id: t.id,
             kind: subagent ? "subagent" : "engine-task",
@@ -31165,7 +31182,7 @@ var init_work_ledger = __esm({
           else
             waiting.push(item);
         }
-        return { quiescent: waiting.length === 0, waiting, overdue, detached };
+        return { quiescent: waiting.length === 0 && overdue.length === 0, waiting, overdue, detached };
       }
       /**
        * One line per item, for the grader and the closing report.
@@ -31254,10 +31271,10 @@ function wrapAsyncTool(def, opts) {
         return text9(raced.err instanceof Error ? raced.err.message : String(raced.err), true);
       }
       opts.learnedSlow?.add(t.name);
-      const job = opts.registry.start(t.name, describeArgs(t.name, args), async (write2) => {
+      const job = opts.registry.start(t.name, describeArgs(t.name, args), async (write3) => {
         try {
           const out = await work;
-          write2(out);
+          write3(out);
         } catch (err2) {
           throw err2 instanceof Error ? err2 : new Error(String(err2));
         }
@@ -37093,14 +37110,72 @@ var init_cost_ledger = __esm({
   }
 });
 
+// ../../packages/agent-core/dist/session-activity.js
+import { open as open3 } from "node:fs/promises";
+function lastTimestampIn(chunk) {
+  let last = null;
+  const re = /"timestamp":"([^"]{10,40})"/g;
+  let m;
+  while ((m = re.exec(chunk)) !== null) {
+    const t = Date.parse(m[1]);
+    if (Number.isFinite(t))
+      last = t;
+  }
+  return last;
+}
+async function lastConversationTime(file2) {
+  let fh;
+  try {
+    fh = await open3(file2, "r");
+  } catch {
+    return null;
+  }
+  try {
+    const size = (await fh.stat()).size;
+    if (size === 0)
+      return null;
+    let end2 = size;
+    let scanned = 0;
+    while (end2 > 0 && scanned < ACTIVITY_MAX_SCAN_BYTES) {
+      const start3 = Math.max(0, end2 - ACTIVITY_WINDOW_BYTES);
+      const len = end2 - start3;
+      const buf = Buffer.alloc(len);
+      const { bytesRead } = await fh.read(buf, 0, len, start3);
+      const found = lastTimestampIn(buf.subarray(0, bytesRead).toString("utf8"));
+      if (found !== null)
+        return found;
+      scanned += len;
+      end2 = start3 + OVERLAP > start3 ? Math.max(0, start3 + OVERLAP) : start3;
+      if (start3 === 0)
+        break;
+    }
+    return null;
+  } catch {
+    return null;
+  } finally {
+    await fh.close().catch(() => {
+    });
+  }
+}
+var ACTIVITY_WINDOW_BYTES, ACTIVITY_MAX_SCAN_BYTES, OVERLAP;
+var init_session_activity = __esm({
+  "../../packages/agent-core/dist/session-activity.js"() {
+    "use strict";
+    ACTIVITY_WINDOW_BYTES = 64 * 1024;
+    ACTIVITY_MAX_SCAN_BYTES = 2 * 1024 * 1024;
+    OVERLAP = 64;
+  }
+});
+
 // ../../packages/agent-core/dist/session-store.js
 import { readFile as readFile5, stat as stat2 } from "node:fs/promises";
 import { listSessions, getSessionMessages, getSubagentMessages as sdkGetSubagentMessages, forkSession } from "@anthropic-ai/claude-agent-sdk";
-function toSessionInfo(s) {
+async function toSessionInfo(s) {
   const fromFirst = stripPromptPrefix(s.firstPrompt ?? "").slice(0, 80);
   const fromSummary = stripPromptPrefix(s.summary ?? "").slice(0, 80);
   const title = s.customTitle || fromFirst || fromSummary || `Session ${s.sessionId.slice(0, 8)}`;
-  return { id: s.sessionId, title, lastModified: s.lastModified, cwd: s.cwd };
+  const spoken = s.cwd ? await lastConversationTime(sessionFile(s.cwd, s.sessionId)) : null;
+  return { id: s.sessionId, title, lastModified: spoken ?? s.lastModified, cwd: s.cwd };
 }
 function transcriptMatches(raw, q) {
   for (const line of raw.split("\n")) {
@@ -37220,12 +37295,14 @@ ${input.command}
   }
   return blocks;
 }
-var SEARCH_SCAN_LIMIT, SEARCH_RESULT_LIMIT, SEARCH_MAX_FILE_BYTES, FORK_RETRY_ATTEMPTS, FORK_RETRY_DELAY_MS, delay, SessionStore;
+var newestFirst, SEARCH_SCAN_LIMIT, SEARCH_RESULT_LIMIT, SEARCH_MAX_FILE_BYTES, FORK_RETRY_ATTEMPTS, FORK_RETRY_DELAY_MS, delay, SessionStore;
 var init_session_store = __esm({
   "../../packages/agent-core/dist/session-store.js"() {
     "use strict";
     init_session_transfer();
     init_history_slim();
+    init_session_activity();
+    newestFirst = (a, b) => b.lastModified - a.lastModified;
     SEARCH_SCAN_LIMIT = 200;
     SEARCH_RESULT_LIMIT = 50;
     SEARCH_MAX_FILE_BYTES = 8 * 1024 * 1024;
@@ -37239,7 +37316,7 @@ var init_session_store = __esm({
       async getSessions(projectDir) {
         try {
           const sessions3 = projectDir ? await listSessions({ dir: projectDir, limit: 50 }) : await listSessions({ limit: 50 });
-          return sessions3.map(toSessionInfo);
+          return (await Promise.all(sessions3.map(toSessionInfo))).sort(newestFirst);
         } catch (err2) {
           return [];
         }
@@ -37260,7 +37337,7 @@ var init_session_store = __esm({
         }
         const out = [];
         for (const s of sessions3) {
-          const info = toSessionInfo(s);
+          const info = await toSessionInfo(s);
           if (info.title.toLowerCase().includes(q)) {
             out.push(info);
           } else if (s.cwd) {
@@ -37278,7 +37355,7 @@ var init_session_store = __esm({
           if (out.length >= SEARCH_RESULT_LIMIT)
             break;
         }
-        return out;
+        return out.sort(newestFirst);
       }
       async getSessionMessages(sessionId, projectDir) {
         try {
@@ -37308,6 +37385,7 @@ var init_session_store = __esm({
       rawToMessages(raw) {
         const messages = [];
         for (const entry of raw) {
+          const ts = typeof entry.timestamp === "string" ? Date.parse(entry.timestamp) : NaN;
           const blocks = extractBlocks(entry.message);
           if (blocks.length === 0 && entry.type === "user")
             continue;
@@ -37323,7 +37401,8 @@ var init_session_store = __esm({
             blocks: entry.type === "assistant" ? blocks : void 0,
             // Thread the per-message SDK uuid so the renderer can pass it as
             // session:fork.upToMessageId ("fork from here").
-            uuid: typeof entry.uuid === "string" ? entry.uuid : void 0
+            uuid: typeof entry.uuid === "string" ? entry.uuid : void 0,
+            ...Number.isFinite(ts) ? { timestamp: ts } : {}
           });
         }
         return messages;
@@ -37920,6 +37999,12 @@ import { spawn as spawn2, execSync, execFileSync } from "node:child_process";
 function setBrowserExtensionProbe(fn) {
   browserExtensionConnected = fn;
 }
+function isTurnBearingFrame(type) {
+  return type === "assistant" || type === "stream_event" || type === "user";
+}
+function turnStillOpening(openedAt, now2) {
+  return openedAt !== void 0 && now2 - openedAt < TURN_OPENING_GRACE_MS;
+}
 function findUserInstalledClaude(binName) {
   const home = homedir3();
   const abs = [
@@ -38811,7 +38896,7 @@ ${next}` : next;
 function autoDecisionSubject(prompt2) {
   return prompt2.kind === "permission" ? prompt2.tool : void 0;
 }
-var browserExtensionConnected, SLIM_KEEP_RECENT_TURNS, cachedClaudeExe, unsupportedCliOptions, rejectedCliArgs, CAPS_VERSION, capsLoaded, EFFORT_LADDER, cachedEfforts, modelEffortLevels, sharedSessionStore, monoNowMs, sessionCwdCache, cachedNodeExe, HUMAN_READABLE_FIELDS, SYSTEM_EVENT_CATEGORY, TOOL_RESULT_CAP, MAX_RESULT_IMAGES, MAX_IMAGE_BASE64, PERMISSION_MODES, EDIT_PREVIEW_CAP, AsyncMessagePump, IDLE_REAP_MS, EFFORT_SWAP_DEBOUNCE_MS, MODERATE_IDLE_MS, STEER_COALESCE_MS, AUTO_BACKGROUND_SECONDS, TASK_REGISTER_SECONDS, JOB_NOTICE_COALESCE_MS, JOB_NOTICE_WORK_ID, QUIESCENCE_MAX_MS, QUIESCENCE_POLL_MS, BATCH_WAIT_MS, INLINE_TOOL_NAMES, STOP_HARD_KILL_AFTER_MS, STREAM_STALL_MS, STREAM_FIRST_FRAME_MS, RV_TASK_MAX, OPTION_RATING_JSON_SCHEMA, AgentManager;
+var browserExtensionConnected, TURN_OPENING_GRACE_MS, SLIM_KEEP_RECENT_TURNS, cachedClaudeExe, unsupportedCliOptions, rejectedCliArgs, CAPS_VERSION, capsLoaded, EFFORT_LADDER, cachedEfforts, modelEffortLevels, sharedSessionStore, monoNowMs, sessionCwdCache, cachedNodeExe, HUMAN_READABLE_FIELDS, SYSTEM_EVENT_CATEGORY, TOOL_RESULT_CAP, MAX_RESULT_IMAGES, MAX_IMAGE_BASE64, PERMISSION_MODES, EDIT_PREVIEW_CAP, AsyncMessagePump, IDLE_REAP_MS, EFFORT_SWAP_DEBOUNCE_MS, MODERATE_IDLE_MS, STEER_COALESCE_MS, AUTO_BACKGROUND_SECONDS, TASK_REGISTER_SECONDS, JOB_NOTICE_COALESCE_MS, JOB_NOTICE_WORK_ID, QUIESCENCE_MAX_MS, QUIESCENCE_POLL_MS, BATCH_WAIT_MS, INLINE_TOOL_NAMES, STOP_HARD_KILL_AFTER_MS, STREAM_STALL_MS, STREAM_FIRST_FRAME_MS, RV_TASK_MAX, OPTION_RATING_JSON_SCHEMA, AgentManager;
 var init_agent_manager = __esm({
   "../../packages/agent-core/dist/agent-manager.js"() {
     "use strict";
@@ -38871,6 +38956,7 @@ var init_agent_manager = __esm({
     init_stream_stall();
     init_usage_limit();
     browserExtensionConnected = () => false;
+    TURN_OPENING_GRACE_MS = 5 * 6e4;
     SLIM_KEEP_RECENT_TURNS = 3;
     unsupportedCliOptions = /* @__PURE__ */ new Set();
     rejectedCliArgs = /* @__PURE__ */ new Map();
@@ -38941,7 +39027,7 @@ var init_agent_manager = __esm({
     TASK_REGISTER_SECONDS = 3;
     JOB_NOTICE_COALESCE_MS = 400;
     JOB_NOTICE_WORK_ID = "pending-job-notices";
-    QUIESCENCE_MAX_MS = 20 * 6e4;
+    QUIESCENCE_MAX_MS = 12 * 60 * 6e4;
     QUIESCENCE_POLL_MS = 500;
     BATCH_WAIT_MS = 6e4;
     INLINE_TOOL_NAMES = /* @__PURE__ */ new Set([
@@ -39980,50 +40066,77 @@ ${full.slice(-8e3)}`;
         let cappedOut = false;
         let narrated = false;
         const turn = live.turnSeq;
-        for (; ; ) {
-          if (live.rv !== rv) {
-            log(`[work] quiescence wait for ${live.sessionId} dropped \u2014 another run owns the session`);
-            this.clearWorkNarration(live, narrated);
-            return;
-          }
-          if (live.reaped) {
-            log(`[work] quiescence wait for ${live.sessionId} dropped \u2014 the session was torn down`);
-            this.clearWorkNarration(live, narrated);
-            return;
-          }
-          if (live.turnSeq !== turn) {
-            log(`[work] quiescence wait for ${live.sessionId} superseded by a new turn`);
-            this.clearWorkNarration(live, narrated);
-            return;
-          }
-          const v = live.ledger.verdict(Date.now());
-          if (v.quiescent)
-            break;
-          if (Date.now() - started2 >= QUIESCENCE_MAX_MS) {
-            cappedOut = true;
-            break;
-          }
-          if (!narrated && live.sessionId) {
-            narrated = true;
-            this.send({
-              type: "agent:narration",
-              sessionId: live.sessionId,
-              text: `Waiting for ${v.waiting.length} background ${v.waiting.length === 1 ? "task" : "tasks"} to finish\u2026`,
-              engineLabel: "Claude Code"
-            }, live.origin);
+        live.gradePending = true;
+        try {
+          for (; ; ) {
+            if (live.rv !== rv) {
+              log(`[work] quiescence wait for ${live.sessionId} dropped \u2014 another run owns the session`);
+              this.clearWorkNarration(live, narrated);
+              return;
+            }
+            if (live.gone) {
+              log(`[work] quiescence wait for ${live.sessionId} dropped \u2014 the session was torn down`);
+              this.clearWorkNarration(live, narrated);
+              return;
+            }
+            if (live.turnSeq !== turn) {
+              log(`[work] quiescence wait for ${live.sessionId} superseded by a new turn`);
+              this.clearWorkNarration(live, narrated);
+              return;
+            }
+            const now2 = Date.now();
+            live.ledger.sweep(now2);
+            this.refreshLedgerFromRegistry(live, now2);
+            const v = live.ledger.verdict(now2);
+            if (v.quiescent)
+              break;
+            if (now2 - started2 >= QUIESCENCE_MAX_MS) {
+              cappedOut = true;
+              break;
+            }
+            if (!narrated && live.sessionId) {
+              narrated = true;
+              const running2 = v.waiting.length + v.overdue.length;
+              this.send({
+                type: "agent:narration",
+                sessionId: live.sessionId,
+                text: `Waiting for ${running2} background ${running2 === 1 ? "task" : "tasks"} to finish\u2026`,
+                engineLabel: "Claude Code"
+              }, live.origin);
+            }
+            await new Promise((res) => setTimeout(res, QUIESCENCE_POLL_MS));
           }
-          await new Promise((res) => setTimeout(res, QUIESCENCE_POLL_MS));
+          this.clearWorkNarration(live, narrated);
+          live.ledger.sweep(Date.now());
+          const outstanding = live.ledger.summarize(Date.now());
+          if (cappedOut)
+            log(`[work] quiescence cap reached for ${live.sessionId}; grading anyway with: ${outstanding.join("; ") || "(nothing outstanding)"}`);
+          else if (Date.now() - started2 > 1e3)
+            log(`[work] ${live.sessionId} settled after ${Math.round((Date.now() - started2) / 1e3)}s \u2014 grading now`);
+          if (!cappedOut && outstanding.length)
+            log(`[work] grading with work still in flight: ${outstanding.join("; ")}`);
+          await this.runVerification(live, finalText, didWork);
+        } finally {
+          live.gradePending = false;
+        }
+      }
+      /**
+       * Mark a turn the engine started on its own as busy — exactly what a send does.
+       *
+       * Bumping `turnSeq` is deliberate: a quiescence wait for the PREVIOUS turn must see itself
+       * superseded, the same way it would by a turn we started, rather than grade the old final
+       * text while the new turn runs.
+       */
+      adoptSelfStartedTurn(live) {
+        log(`[turn] ${live.sessionId || "(pending)"} started a turn on its own \u2014 marking busy`);
+        live.streaming = true;
+        live.turnSeq++;
+        live.turnOpeningAt = void 0;
+        live.lastActivity = Date.now();
+        if (live.idleTimer) {
+          clearTimeout(live.idleTimer);
+          live.idleTimer = void 0;
         }
-        this.clearWorkNarration(live, narrated);
-        live.ledger.sweep(Date.now());
-        const outstanding = live.ledger.summarize(Date.now());
-        if (cappedOut)
-          log(`[work] quiescence cap reached for ${live.sessionId}; grading anyway with: ${outstanding.join("; ") || "(nothing outstanding)"}`);
-        else if (Date.now() - started2 > 1e3)
-          log(`[work] ${live.sessionId} settled after ${Math.round((Date.now() - started2) / 1e3)}s \u2014 grading now`);
-        if (!cappedOut && outstanding.length)
-          log(`[work] grading with work still in flight: ${outstanding.join("; ")}`);
-        await this.runVerification(live, finalText, didWork);
       }
       /** Take down the "waiting on background work" strip, if we put one up. */
       clearWorkNarration(live, narrated) {
@@ -42557,6 +42670,10 @@ ${unattendedReportDirective(params)}` : ""), live.sessionId) },
             }
             const sid = live.sessionId;
             const parentToolUseId = message.parent_tool_use_id ?? void 0;
+            if (!live.streaming && !live.reaped && isTurnBearingFrame(message.type))
+              this.adoptSelfStartedTurn(live);
+            if (!live.streaming && !live.reaped && (live.turnsDone ?? 0) > 0 && message.type === "system" && message.subtype === "init")
+              live.turnOpeningAt = Date.now();
             switch (message.type) {
               case "stream_event": {
                 const event = message.event;
@@ -42699,6 +42816,8 @@ ${unattendedReportDirective(params)}` : ""), live.sessionId) },
               }
               case "result": {
                 this.emitLifecycle("Stop", { sessionId: sid, subtype: message.subtype ?? null });
+                live.turnsDone = (live.turnsDone ?? 0) + 1;
+                live.turnOpeningAt = void 0;
                 flushPendingThinking();
                 const r = message;
                 const resultSid = r.session_id || "";
@@ -42908,6 +43027,7 @@ ${unattendedReportDirective(params)}` : ""), live.sessionId) },
                     const taskId = sstr(m.task_id);
                     if (!taskId)
                       break;
+                    live.ledger.touch(taskId, Date.now());
                     const u = m.usage;
                     emit2({
                       type: "agent:task",
@@ -42946,6 +43066,8 @@ ${unattendedReportDirective(params)}` : ""), live.sessionId) },
                     if (status2 === "completed" || status2 === "failed" || status2 === "killed") {
                       this.clearAutoBackground(live, taskId);
                       live.taskIds.delete(taskId);
+                    } else {
+                      live.ledger.touch(taskId, Date.now());
                     }
                     break;
                   }
@@ -42957,6 +43079,8 @@ ${unattendedReportDirective(params)}` : ""), live.sessionId) },
                   case "background_tasks_changed": {
                     const listed = new Set((Array.isArray(m.tasks) ? m.tasks : []).map((t) => sstr(t?.task_id)).filter(Boolean));
                     live.taskIds = listed;
+                    for (const id of listed)
+                      live.ledger.touch(id, Date.now());
                     break;
                   }
                   case "task_notification": {
@@ -43314,6 +43438,7 @@ ${err2.stack}` : ""}` : String(err2);
             emit2({ type: "agent:status", sessionId: sid, status: "error" });
           }
         } finally {
+          live.gone = true;
           if (live.idleTimer) {
             clearTimeout(live.idleTimer);
             live.idleTimer = void 0;
@@ -43498,7 +43623,7 @@ ${err2.stack}` : ""}` : String(err2);
           // Blocked on its own background work. A turn that dispatched a build emits nothing while
           // it waits, and that silence is the intended behaviour — not a dead stream. Reads the
           // ledger, so it goes false on its own once every awaited item has passed its deadline.
-          awaitingWork: live.ledger.verdict(Date.now()).waiting.length > 0,
+          awaitingWork: !live.ledger.verdict(Date.now()).quiescent,
           idleMs: monoNowMs() - (live.lastFrameAt ?? 0),
           windowMs: live.stallWindowMs ?? STREAM_STALL_MS
         });
@@ -43522,6 +43647,7 @@ ${err2.stack}` : ""}` : String(err2);
           live.abort.abort();
         } catch {
         }
+        live.gone = true;
       }
       /** M7 — stop ONE background task (vs interruptSession which aborts the whole
        *  turn). Driver-only, same origin guard. No-op if the session/task is gone. */
@@ -43688,7 +43814,8 @@ ${err2.stack}` : ""}` : String(err2);
         for (const id of [...claimed])
           if (!live.ledger.has(id))
             claimed.delete(id);
-        const watched = live.ledger.verdict(started2).waiting.filter((i) => !claimed.has(i.id)).map((i) => ({ id: i.id, description: i.description, kind: i.kind }));
+        const v0 = live.ledger.verdict(started2);
+        const watched = [...v0.waiting, ...v0.overdue].filter((i) => !claimed.has(i.id)).map((i) => ({ id: i.id, description: i.description, kind: i.kind }));
         for (const w of watched)
           claimed.add(w.id);
         if (watched.length === 0)
@@ -43756,8 +43883,8 @@ ${lines.join("\n")}
           const fd = openSync5(path6, "r");
           try {
             const buf = Buffer.allocUnsafe(want);
-            const read = readSync4(fd, buf, 0, want, Math.max(0, size - want));
-            return buf.subarray(0, read).toString("utf8").slice(-maxChars);
+            const read2 = readSync4(fd, buf, 0, want, Math.max(0, size - want));
+            return buf.subarray(0, read2).toString("utf8").slice(-maxChars);
           } finally {
             closeSync5(fd);
           }
@@ -44247,12 +44374,65 @@ ${lines.join("\n")}
       /** Close an idle session's Query (→ child process + IPC freed via runConsumer's
        *  finally), keeping the on-disk session resumable. Deletes from the live map
        *  FIRST so a racing sendMessage misses it and cleanly re-creates with resume. */
+      /**
+       * Is this session, whatever `streaming` says, still in the middle of something?
+       *
+       * `streaming` only tracks turns WE started. A CLI running its own background monitor
+       * starts turns by itself when events land, and between two of those — or during a long
+       * tool call inside one — the session reads as idle here while the engine is hard at work.
+       * The memory monitor's moderate-pressure reclaim reaped exactly such a session, 60 seconds
+       * "idle" with a batch barrier that had just reported "1 still running": the CLI carried on
+       * for another 69 minutes, un-mapped and ungradeable. Work the ledger is awaiting, a job
+       * that is running, a wait inside `await_jobs`, or a turn-end grade still waiting for
+       * quiescence — any of these means the session is busy.
+       */
+      hasWorkInFlight(live) {
+        if (live.gradePending)
+          return true;
+        if (turnStillOpening(live.turnOpeningAt, Date.now()))
+          return true;
+        if ((live.awaitDepth ?? 0) > 0)
+          return true;
+        try {
+          if (!live.ledger.verdict(Date.now()).quiescent)
+            return true;
+        } catch {
+        }
+        try {
+          if (live.jobs?.list().some((j) => j.status === "running"))
+            return true;
+        } catch {
+        }
+        return false;
+      }
+      /** The job registry is the authority on daemon-owned jobs: anything it still reports as
+       *  running is alive, whatever the ledger's deadline says — touch it (or put it back if a
+       *  sweep already took it). */
+      refreshLedgerFromRegistry(live, now2) {
+        let jobs;
+        try {
+          jobs = live.jobs?.list() ?? [];
+        } catch {
+          return;
+        }
+        for (const j of jobs) {
+          if (j.status !== "running")
+            continue;
+          if (!live.ledger.touch(j.id, now2)) {
+            live.ledger.register({ id: j.id, kind: "tool-job", description: `${j.kind ?? "job"}: ${j.description ?? j.id}` }, now2);
+          }
+        }
+      }
       reapIdleSession(sessionId, force = false) {
         const live = this.liveSessions.get(sessionId);
         if (!live || live.streaming || live.reaped)
           return false;
         if (this.isHeld(live) && !force)
           return false;
+        if (!force && this.hasWorkInFlight(live)) {
+          log(`[reap] ${sessionId} looks idle but has work in flight \u2014 left alone`);
+          return false;
+        }
         log("Reaping idle session:", sessionId);
         live.reaped = true;
         this.emitLifecycle("SessionEnd", { sessionId, reason: force ? "forced" : "idle-reap" });
@@ -44301,6 +44481,10 @@ ${lines.join("\n")}
         let n = 0;
         for (const live of [...this.liveSessions.values()]) {
           if (!live.streaming && !live.reaped) {
+            if (this.hasWorkInFlight(live)) {
+              log(`[reap] critical reclaim spared ${live.sessionId}: work in flight`);
+              continue;
+            }
             if (this.reapIdleSession(live.sessionId, true))
               n++;
           }
@@ -44325,6 +44509,7 @@ ${lines.join("\n")}
           if (live.reaped)
             continue;
           live.reaped = true;
+          live.gone = true;
           if (live.idleTimer) {
             clearTimeout(live.idleTimer);
             live.idleTimer = void 0;
@@ -46172,9 +46357,9 @@ function wrapHostedAsyncTool(t, opts) {
         return text11(raced.err instanceof Error ? raced.err.message : String(raced.err), true);
       opts.learnedSlow?.add(t.name);
       const sessionId = ctx2?.sessionId;
-      const job = opts.registry.start(t.name, describeArgs2(t.name, args), async (write2) => {
+      const job = opts.registry.start(t.name, describeArgs2(t.name, args), async (write3) => {
         try {
-          write2(await work);
+          write3(await work);
         } catch (err2) {
           throw err2 instanceof Error ? err2 : new Error(String(err2));
         }
@@ -79502,7 +79687,7 @@ function alphabet(letters) {
   };
 }
 // @__NO_SIDE_EFFECTS__
-function join67(separator = "") {
+function join68(separator = "") {
   astr("join", separator);
   return {
     encode: (from) => {
@@ -79707,7 +79892,7 @@ var init_esm = __esm({
       convertRadix2,
       radix,
       radix2,
-      join: join67,
+      join: join68,
       padding
     };
   }
@@ -81254,8 +81439,8 @@ var mesh_ca_exports = {};
 __export(mesh_ca_exports, {
   netCaCommand: () => netCaCommand
 });
-import { chmodSync as chmodSync8, existsSync as existsSync49, mkdirSync as mkdirSync45, readFileSync as readFileSync54, writeFileSync as writeFileSync46 } from "node:fs";
-import { join as join87, resolve as resolve13 } from "node:path";
+import { chmodSync as chmodSync8, existsSync as existsSync50, mkdirSync as mkdirSync46, readFileSync as readFileSync55, writeFileSync as writeFileSync47 } from "node:fs";
+import { join as join88, resolve as resolve13 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 function die(msg) {
   console.error(msg);
@@ -81269,9 +81454,9 @@ async function readPassphrase(prompt2) {
   }
   const rl = createInterface2({ input: process.stdin, output: process.stdout, terminal: true });
   const out = process.stdout;
-  const write2 = out.write.bind(out);
+  const write3 = out.write.bind(out);
   let muted = false;
-  out.write = (chunk) => muted ? true : write2(chunk);
+  out.write = (chunk) => muted ? true : write3(chunk);
   process.stdout.write(prompt2);
   muted = true;
   try {
@@ -81281,33 +81466,33 @@ async function readPassphrase(prompt2) {
     }));
   } finally {
     muted = false;
-    out.write = write2;
+    out.write = write3;
     process.stdout.write("\n");
   }
 }
 function writeSecretFile(p, bytes2) {
-  writeFileSync46(p, bytes2, { mode: 384 });
+  writeFileSync47(p, bytes2, { mode: 384 });
   try {
     chmodSync8(p, 384);
   } catch {
   }
 }
 function ensureDir(p) {
-  mkdirSync45(p, { recursive: true, mode: 448 });
+  mkdirSync46(p, { recursive: true, mode: 448 });
   try {
     chmodSync8(p, 448);
   } catch {
   }
 }
 async function openCa(dir2) {
-  const gPath = join87(dir2, "genesis.bin");
-  const sPath = join87(dir2, "ca.sealed");
-  if (!existsSync49(gPath) || !existsSync49(sPath)) {
+  const gPath = join88(dir2, "genesis.bin");
+  const sPath = join88(dir2, "ca.sealed");
+  if (!existsSync50(gPath) || !existsSync50(sPath)) {
     die(`No mesh CA in ${dir2}. Run: tesseract-agent net init --org NAME --ca-dir ${dir2}`);
   }
-  const genesisBytes = new Uint8Array(readFileSync54(gPath));
+  const genesisBytes = new Uint8Array(readFileSync55(gPath));
   const genesis = decodeGenesis(genesisBytes);
-  const sealed = decodeRecoveryBundle(new Uint8Array(readFileSync54(sPath)));
+  const sealed = decodeRecoveryBundle(new Uint8Array(readFileSync55(sPath)));
   const pass = await readPassphrase("CA passphrase: ");
   let seed;
   try {
@@ -81323,7 +81508,7 @@ async function netCaCommand(rest, flags) {
   if (sub === "init") {
     const org = typeof flags.org === "string" ? flags.org.trim() : "";
     if (!org) die("Usage: tesseract-agent net init --org NAME [--ca-dir DIR]");
-    if (existsSync49(join87(caDir, "ca.sealed"))) {
+    if (existsSync50(join88(caDir, "ca.sealed"))) {
       die(`A mesh CA already exists in ${caDir}. Refusing to overwrite it.`);
     }
     const pass = await readPassphrase("New CA passphrase: ");
@@ -81345,9 +81530,9 @@ async function netCaCommand(rest, flags) {
     const genesisBytes = encodeGenesis(genesis);
     const fp = await genesisFingerprint(genesis);
     ensureDir(caDir);
-    writeFileSync46(join87(caDir, "genesis.bin"), genesisBytes);
-    writeSecretFile(join87(caDir, "ca.sealed"), encodeRecoveryBundle(await sealCaKey(seed, pass, `${org} mesh CA`)));
-    writeSecretFile(join87(caDir, "disablement.secret"), hex3(disable.secret));
+    writeFileSync47(join88(caDir, "genesis.bin"), genesisBytes);
+    writeSecretFile(join88(caDir, "ca.sealed"), encodeRecoveryBundle(await sealCaKey(seed, pass, `${org} mesh CA`)));
+    writeSecretFile(join88(caDir, "disablement.secret"), hex3(disable.secret));
     console.log(`
 Mesh created for "${org}".`);
     console.log(`  fingerprint: ${hex3(fp)}`);
@@ -81362,7 +81547,7 @@ Mesh created for "${org}".`);
     console.log(`  ${hex3(disable.secret)}`);
     console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
     console.log(`
-A copy of the disablement secret is in ${join87(caDir, "disablement.secret")}.`);
+A copy of the disablement secret is in ${join88(caDir, "disablement.secret")}.`);
     console.log("Move it somewhere the CA directory is not \u2014 holding both in one place");
     console.log("defeats the point of having two.");
     const caFlag = caDir === resolve13("./mesh-ca") ? "" : ` --ca-dir ${caDir}`;
@@ -81415,14 +81600,14 @@ Next, issue an identity for a machine (pick a free address in ${formatPrefix(gen
       [{ keyIndex: 0, privateKey: ca.privateKey }]
     );
     ensureDir(outDir);
-    writeFileSync46(join87(outDir, "genesis.bin"), genesisBytes);
-    writeFileSync46(join87(outDir, "node.cert"), encodeCert(cert));
-    writeSecretFile(join87(outDir, "node.key"), await exportStaticPrivate(nodeKey));
+    writeFileSync47(join88(outDir, "genesis.bin"), genesisBytes);
+    writeFileSync47(join88(outDir, "node.cert"), encodeCert(cert));
+    writeSecretFile(join88(outDir, "node.key"), await exportStaticPrivate(nodeKey));
     console.log(`Minted "${name}" at ${ip4}.`);
     console.log(`  ${outDir}`);
     console.log("\nCopy that directory to the node and run there:");
-    console.log(`  tesseract-agent net enroll --genesis ${join87(outDir, "genesis.bin")} \\`);
-    console.log(`      --cert ${join87(outDir, "node.cert")} --key ${join87(outDir, "node.key")}`);
+    console.log(`  tesseract-agent net enroll --genesis ${join88(outDir, "genesis.bin")} \\`);
+    console.log(`      --cert ${join88(outDir, "node.cert")} --key ${join88(outDir, "node.key")}`);
     console.log("\nnode.key is the node's identity \u2014 send it over a channel you trust, and");
     console.log("delete this copy once the node has it.");
     return;
@@ -81458,8 +81643,8 @@ Next, issue an identity for a machine (pick a free address in ${formatPrefix(gen
       ip4Exceptions: []
     };
     const signed = await signBundle(bundle, [{ keyIndex: 0, privateKey: ca.privateKey }]);
-    const out = resolve13(typeof flags.out === "string" ? flags.out : join87(caDir, "bundle.bin"));
-    writeFileSync46(out, encodeSignedBundle(signed));
+    const out = resolve13(typeof flags.out === "string" ? flags.out : join88(caDir, "bundle.bin"));
+    writeFileSync47(out, encodeSignedBundle(signed));
     console.log(`Signed policy bundle (epoch ${epoch2}) \u2192 ${out}`);
     console.log("Every node must receive it; the relay distributes it, or copy it to");
     console.log(`each node's mesh directory as bundle.bin.`);
@@ -81481,17 +81666,43 @@ var init_mesh_ca = __esm({
 
 // src/cli.ts
 init_base_paths();
-import { existsSync as existsSync50, mkdtempSync as mkdtempSync4, readFileSync as readFileSync56, rmSync as rmSync13 } from "node:fs";
+import { existsSync as existsSync51, mkdtempSync as mkdtempSync4, readFileSync as readFileSync57, rmSync as rmSync13 } from "node:fs";
 import { createHash as createHash9 } from "node:crypto";
 import { execFileSync as execFileSync6, spawn as spawn14 } from "node:child_process";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 import { tmpdir as tmpdir8 } from "node:os";
-import { dirname as dirname40, join as join88, resolve as resolve15 } from "node:path";
+import { dirname as dirname41, join as join89, resolve as resolve15 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 
 // ../../packages/host-core/dist/control-link.js
 import { hostname as hostname4 } from "node:os";
 
+// ../../packages/host-core/dist/hook-fanout.js
+function composeHooks(sets, onError) {
+  return new Proxy({}, {
+    get(_target, key2) {
+      if (typeof key2 !== "string")
+        return void 0;
+      const fns = sets.map((s) => s[key2]).filter((f) => typeof f === "function");
+      if (fns.length === 0)
+        return void 0;
+      const owners = sets.filter((s) => typeof s[key2] === "function");
+      return (...args) => {
+        for (let i = 0; i < fns.length; i++) {
+          try {
+            fns[i].apply(owners[i], args);
+          } catch (err2) {
+            onError?.(key2, err2);
+          }
+        }
+      };
+    },
+    has(_target, key2) {
+      return typeof key2 === "string" && sets.some((s) => typeof s[key2] === "function");
+    }
+  });
+}
+
 // ../../packages/host-core/dist/engines/rewind-result.js
 var strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.length > 0) : [];
 function toRewindOutcome(res, noHistory) {
@@ -81514,9 +81725,9 @@ function toRewindOutcome(res, noHistory) {
 }
 
 // ../../packages/host-core/dist/control-link.js
-import { join as join60, basename as basename11 } from "node:path";
-import { randomUUID as randomUUID24 } from "node:crypto";
-import { mkdirSync as mkdirSync29 } from "node:fs";
+import { join as join61, basename as basename11 } from "node:path";
+import { randomUUID as randomUUID25 } from "node:crypto";
+import { mkdirSync as mkdirSync30 } from "node:fs";
 
 // ../../node_modules/ws/wrapper.mjs
 var import_stream = __toESM(require_stream(), 1);
@@ -84750,21 +84961,21 @@ function createMcpHealth(deps = {}) {
   let servers = {};
   const disabled2 = /* @__PURE__ */ new Set();
   const cache5 = /* @__PURE__ */ new Map();
-  const inflight = /* @__PURE__ */ new Map();
+  const inflight2 = /* @__PURE__ */ new Map();
   async function probeCached(name, spec) {
     const hit = cache5.get(name);
     if (hit && now2() - hit.at < TTL_MS3)
       return hit.row;
-    const running2 = inflight.get(name);
+    const running2 = inflight2.get(name);
     if (running2)
       return running2;
     const p = probe(name, spec).catch((e) => ({ name, status: "failed", error: e?.message ?? "probe failed" })).then((row) => {
       const full = { ...row, name };
       cache5.set(name, { at: now2(), row: full });
-      inflight.delete(name);
+      inflight2.delete(name);
       return full;
     });
-    inflight.set(name, p);
+    inflight2.set(name, p);
     return p;
   }
   return {
@@ -84784,7 +84995,7 @@ function createMcpHealth(deps = {}) {
     },
     async reconnect(name) {
       cache5.delete(name);
-      inflight.delete(name);
+      inflight2.delete(name);
       if (servers[name] && !disabled2.has(name))
         await probeCached(name, servers[name]);
     },
@@ -84927,10 +85138,10 @@ function extractJson(text12) {
     }
   }
   for (let start3 = 0; start3 < text12.length; start3++) {
-    const open7 = text12[start3];
-    if (open7 !== "{" && open7 !== "[")
+    const open8 = text12[start3];
+    if (open8 !== "{" && open8 !== "[")
       continue;
-    const close = open7 === "{" ? "}" : "]";
+    const close = open8 === "{" ? "}" : "]";
     let depth = 0;
     let inStr = false;
     let esc3 = false;
@@ -84949,7 +85160,7 @@ function extractJson(text12) {
         inStr = true;
         continue;
       }
-      if (ch === open7)
+      if (ch === open8)
         depth++;
       else if (ch === close) {
         depth--;
@@ -89008,8 +89219,8 @@ ${text12}`;
       const t = await conn(threadCwd.get(sessionId) ?? spawnedCwd ?? projectDir ?? void 0);
       if (!t)
         return { ok: false, reason: `${label} is not reachable for this.` };
-      const read = await t.request("thread/read", { threadId: sessionId, includeTurns: true }).catch(() => null);
-      const turns2 = (read?.thread ?? {}).turns ?? [];
+      const read2 = await t.request("thread/read", { threadId: sessionId, includeTurns: true }).catch(() => null);
+      const turns2 = (read2?.thread ?? {}).turns ?? [];
       const at = turns2.findIndex((tn) => (tn.items ?? []).some((it) => it.id === uuid3));
       if (at < 0)
         return { ok: false, reason: `${label} no longer has that message.` };
@@ -90215,7 +90426,6 @@ var LAUNCH_MARKERS = [
   "CCB_FORCE_DAEMON_GUI",
   "CCB_HOST_DAEMON",
   "CCB_RDESK_ROLE",
-  "CCB_RDESK_SERVER",
   "CCB_RDESK_CLIENT",
   "CCB_RDESK_ONLY",
   "CCB_MESH_APP",
@@ -90230,7 +90440,7 @@ function mainAppChildEnv(env) {
   return out;
 }
 function ownBinaryIsMainApp(env) {
-  return !env.CCB_RDESK_ROLE && env.CCB_RDESK_SERVER !== "1" && env.CCB_RDESK_CLIENT !== "1" && env.CCB_MESH_APP !== "1";
+  return !env.CCB_RDESK_ROLE && env.CCB_RDESK_CLIENT !== "1" && env.CCB_MESH_APP !== "1";
 }
 
 // ../../packages/host-core/dist/gui/dock-policy.js
@@ -91157,11 +91367,11 @@ var GUIDE_TOOLS = describedBy("tool.voice-guide", GUIDE_TOOL_SHAPES);
 var defaultGreeting = () => prompt("voice.greeting");
 function buildGuidePrompt(opts = {}) {
   const project = opts.projectName ? prompt("voice.guide.project-clause", { projectName: opts.projectName }) : "";
-  const open7 = (opts.sessions ?? []).map((s) => s.label?.trim()).filter((l) => !!l);
-  const openLine = open7.length > 0 ? prompt("voice.guide.open-sessions", {
-    count: open7.length,
-    plural: open7.length === 1 ? "" : "s",
-    labels: open7.map((l) => `"${l}"`).join(", "),
+  const open8 = (opts.sessions ?? []).map((s) => s.label?.trim()).filter((l) => !!l);
+  const openLine = open8.length > 0 ? prompt("voice.guide.open-sessions", {
+    count: open8.length,
+    plural: open8.length === 1 ? "" : "s",
+    labels: open8.map((l) => `"${l}"`).join(", "),
     toolStatus: TOOL_STATUS
   }) : "";
   return [
@@ -95801,8 +96011,8 @@ async function falTopazEnhance(path6, spec, opts) {
   const dir2 = opts.outDir ?? workDir();
   mkdirSync22(dir2, { recursive: true });
   const outPath = join43(dir2, "enhanced.mp4");
-  const { writeFileSync: writeFileSync47 } = await import("node:fs");
-  writeFileSync47(outPath, Buffer.from(await dl.arrayBuffer()));
+  const { writeFileSync: writeFileSync48 } = await import("node:fs");
+  writeFileSync48(outPath, Buffer.from(await dl.arrayBuffer()));
   const out = await probeMedia(outPath).catch(() => null);
   opts.onProgress?.(100, "Enhance complete");
   return { path: outPath, mime: MIME, width: out?.width ?? null, height: out?.height ?? null, durationSec: out?.durationSec ?? p.durationSec, summary: `fal Topaz ${spec.model ?? "Proteus"} \xD7${spec.upscaleFactor ?? 2}` };
@@ -99105,9 +99315,9 @@ async function startOutboundTransfer(msg, controllerClientId, ownHostId2, hostRo
             break;
           const len = Math.min(CHUNK2, f.size - offset);
           const buf = Buffer.alloc(len);
-          const read = readSync7(fd, buf, 0, len, offset);
-          send4({ type: "fs:transferChunk", transferId, toHost, fileIx, rel: f.rel, mode: f.mode, kind: "file", offset, base64: buf.subarray(0, read).toString("base64"), eof: offset + len >= f.size }, { hostId: toHost });
-          state3.sentBytes += read;
+          const read2 = readSync7(fd, buf, 0, len, offset);
+          send4({ type: "fs:transferChunk", transferId, toHost, fileIx, rel: f.rel, mode: f.mode, kind: "file", offset, base64: buf.subarray(0, read2).toString("base64"), eof: offset + len >= f.size }, { hostId: toHost });
+          state3.sentBytes += read2;
         }
       }
     } catch (e) {
@@ -99916,22 +100126,70 @@ init_credentials();
 // ../../packages/host-core/dist/rdesk/machine-identity.js
 init_credentials();
 import { hostname as hostname3, platform } from "node:os";
+import { randomUUID as randomUUID24 } from "node:crypto";
+import { chmodSync as chmodSync3, existsSync as existsSync24, mkdirSync as mkdirSync27, readFileSync as readFileSync37, statSync as statSync14, unlinkSync as unlinkSync3, writeFileSync as writeFileSync25 } from "node:fs";
+import { join as join54 } from "node:path";
+
+// ../../packages/host-core/dist/device-id.js
+init_base_paths();
+import { existsSync as existsSync23, mkdirSync as mkdirSync26, readFileSync as readFileSync36, writeFileSync as writeFileSync24 } from "node:fs";
+import { dirname as dirname24, join as join53 } from "node:path";
 import { randomUUID as randomUUID23 } from "node:crypto";
-import { chmodSync as chmodSync3, existsSync as existsSync23, mkdirSync as mkdirSync26, readFileSync as readFileSync36, writeFileSync as writeFileSync24 } from "node:fs";
-import { join as join53 } from "node:path";
-var FILE = () => join53(daemonDir2(), "machine-identity.json");
+function deviceIdFile() {
+  return join53(tesseractHome(), "device-id.json");
+}
+function read() {
+  try {
+    const raw = JSON.parse(readFileSync36(deviceIdFile(), "utf-8"));
+    const deviceId3 = typeof raw.deviceId === "string" && raw.deviceId ? raw.deviceId : null;
+    const aliases = Array.isArray(raw.aliases) ? raw.aliases.filter((a) => typeof a === "string" && !!a) : [];
+    return { deviceId: deviceId3, aliases };
+  } catch {
+    return { deviceId: null, aliases: [] };
+  }
+}
+function write(deviceId3, aliases) {
+  try {
+    const f = deviceIdFile();
+    const dir2 = dirname24(f);
+    if (!existsSync23(dir2))
+      mkdirSync26(dir2, { recursive: true });
+    writeFileSync24(f, JSON.stringify(aliases.length ? { deviceId: deviceId3, aliases } : { deviceId: deviceId3 }));
+  } catch {
+  }
+}
+function persistentDeviceId() {
+  const cur = read();
+  if (cur.deviceId)
+    return cur.deviceId;
+  const id = randomUUID23().slice(0, 8);
+  write(id, cur.aliases);
+  return id;
+}
+function addDeviceIdAlias(old) {
+  if (!old)
+    return;
+  const cur = read();
+  const deviceId3 = cur.deviceId ?? persistentDeviceId();
+  if (old === deviceId3 || cur.aliases.includes(old))
+    return;
+  write(deviceId3, [...cur.aliases, old]);
+}
+
+// ../../packages/host-core/dist/rdesk/machine-identity.js
+var FILE = () => join54(daemonDir2(), "machine-identity.json");
 function readMachineIdentity() {
   try {
-    const m = JSON.parse(readFileSync36(FILE(), "utf-8"));
+    const m = JSON.parse(readFileSync37(FILE(), "utf-8"));
     return m?.deviceToken && m?.publicId ? m : null;
   } catch {
     return null;
   }
 }
-function write(m) {
+function write2(m) {
   try {
-    mkdirSync26(daemonDir2(), { recursive: true, mode: 448 });
-    writeFileSync24(FILE(), JSON.stringify(m, null, 2), { mode: 384 });
+    mkdirSync27(daemonDir2(), { recursive: true, mode: 448 });
+    writeFileSync25(FILE(), JSON.stringify(m, null, 2), { mode: 384 });
     chmodSync3(FILE(), 384);
   } catch {
   }
@@ -99957,30 +100215,100 @@ function tokenUsable(m) {
   const ms = Date.parse(m.expiresAt);
   return Number.isFinite(ms) && ms - Date.now() > 24 * 60 * 60 * 1e3;
 }
+var inflight = null;
 async function ensureMachineIdentity(opts) {
+  if (inflight)
+    return inflight;
+  inflight = ensureMachineIdentityOnce(opts).finally(() => {
+    inflight = null;
+  });
+  return inflight;
+}
+var LOCK = () => join54(daemonDir2(), "machine-identity.lock");
+var LOCK_STALE_MS = 3e4;
+function tryRegistrationLock() {
+  const f = LOCK();
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      mkdirSync27(daemonDir2(), { recursive: true, mode: 448 });
+      writeFileSync25(f, String(process.pid), { flag: "wx" });
+      return true;
+    } catch {
+      try {
+        if (Date.now() - statSync14(f).mtimeMs < LOCK_STALE_MS)
+          return false;
+        unlinkSync3(f);
+      } catch {
+        return false;
+      }
+    }
+  }
+  return false;
+}
+function releaseRegistrationLock() {
+  try {
+    unlinkSync3(LOCK());
+  } catch {
+  }
+}
+async function waitForIdentity(ms) {
+  const until = Date.now() + ms;
+  while (Date.now() < until) {
+    await new Promise((r) => setTimeout(r, 250));
+    const m = readMachineIdentity();
+    if (m)
+      return m;
+  }
+  return null;
+}
+async function ensureMachineIdentityOnce(opts) {
   const { apiOrigin: apiOrigin2, backendOrigin: backendOrigin2, isAllowedOrigin: isAllowedOrigin3, log: log9 } = opts;
   if (!isAllowedOrigin3(apiOrigin2)) {
     log9?.(`machine identity: refusing a non-default server: ${apiOrigin2}`);
     return null;
   }
   let m = readMachineIdentity();
+  if (m && opts.deviceId && m.deviceId !== opts.deviceId) {
+    const old = m.deviceId;
+    m = { ...m, deviceId: opts.deviceId };
+    delete m.accessToken;
+    delete m.expiresAt;
+    write2(m);
+    addDeviceIdAlias(old);
+    log9?.(`machine identity: device id ${old} \u2192 ${opts.deviceId} (the id this computer uses whether signed in or not; ${old} kept as an alias)`);
+  }
   try {
     if (!m) {
-      const reg = await postJson(`${apiOrigin2}/api/core/tesseract/identity/device`, { label: hostname3().slice(0, 120), platform: platform() });
-      m = {
-        deviceToken: reg.token,
-        publicId: reg.publicId,
-        deviceId: randomUUID23().slice(0, 8),
-        apiOrigin: apiOrigin2,
-        backendOrigin: backendOrigin2
-      };
-      write(m);
-      log9?.(`machine identity: registered \u2014 this machine can be reached as ${reg.publicId}`);
+      if (!tryRegistrationLock()) {
+        m = await waitForIdentity(1e4);
+        if (!m) {
+          log9?.("machine identity: another process is registering this machine \u2014 will use its identity on the next tick");
+          return null;
+        }
+      } else {
+        try {
+          m = readMachineIdentity();
+          if (!m) {
+            const reg = await postJson(`${apiOrigin2}/api/core/tesseract/identity/device`, { label: hostname3().slice(0, 120), platform: platform() });
+            m = {
+              deviceToken: reg.token,
+              publicId: reg.publicId,
+              deviceId: opts.deviceId ?? randomUUID24().slice(0, 8),
+              apiOrigin: apiOrigin2,
+              backendOrigin: backendOrigin2
+            };
+            write2(m);
+            log9?.(`machine identity: registered \u2014 this machine can be reached as ${reg.publicId}`);
+          }
+        } finally {
+          releaseRegistrationLock();
+        }
+      }
     }
     if (!tokenUsable(m)) {
       const t = await postJson(`${apiOrigin2}/auth/device/relay-token`, { deviceToken: m.deviceToken, deviceId: m.deviceId });
       m = { ...m, accessToken: t.accessToken, expiresAt: t.expiresAt, publicId: t.publicId, apiOrigin: apiOrigin2, backendOrigin: backendOrigin2 };
-      write(m);
+      write2(m);
       log9?.("machine identity: relay token minted");
     }
     return m;
@@ -100026,14 +100354,14 @@ function getMachinePublicId() {
 
 // ../../packages/host-core/dist/active-link/engine.js
 import { lstat as lstat7, readlink as readlink4, rm as rm4, mkdir as mkdir13, symlink as symlink2, rename as rename3, utimes as utimes2, writeFile as writeFile12 } from "node:fs/promises";
-import { existsSync as existsSync25 } from "node:fs";
-import { dirname as dirname27, join as join58, resolve as resolve11 } from "node:path";
+import { existsSync as existsSync26 } from "node:fs";
+import { dirname as dirname28, join as join59, resolve as resolve11 } from "node:path";
 
 // ../../packages/host-core/dist/active-link/blocks.js
 import { createHash as createHash5 } from "node:crypto";
 import { createReadStream as createReadStream2 } from "node:fs";
-import { open as open3, mkdir as mkdir12, rename as rename2, chmod as chmod2, utimes, unlink } from "node:fs/promises";
-import { dirname as dirname24 } from "node:path";
+import { open as open4, mkdir as mkdir12, rename as rename2, chmod as chmod2, utimes, unlink } from "node:fs/promises";
+import { dirname as dirname25 } from "node:path";
 var CHUNK3 = 1024 * 1024;
 var MAX_INFLIGHT2 = 8 * CHUNK3;
 var IDLE_MS2 = 6e4;
@@ -100161,8 +100489,8 @@ var StagingWriter = class {
   }
   async ensureOpen() {
     if (!this.fh) {
-      await mkdir12(dirname24(this.stagingPath), { recursive: true });
-      this.fh = await open3(this.stagingPath, "w");
+      await mkdir12(dirname25(this.stagingPath), { recursive: true });
+      this.fh = await open4(this.stagingPath, "w");
     }
     return this.fh;
   }
@@ -100191,7 +100519,7 @@ var StagingWriter = class {
     });
     await fh.close();
     this.fh = null;
-    await mkdir12(dirname24(dest), { recursive: true });
+    await mkdir12(dirname25(dest), { recursive: true });
     await chmod2(this.stagingPath, mode & 511).catch(() => {
     });
     const secs = mtimeMs / 1e3;
@@ -100224,8 +100552,8 @@ var BlockAssembler = class {
     this.stagingPath = stagingPath;
   }
   async open() {
-    await mkdir12(dirname24(this.stagingPath), { recursive: true });
-    this.fh = await open3(this.stagingPath, "w");
+    await mkdir12(dirname25(this.stagingPath), { recursive: true });
+    this.fh = await open4(this.stagingPath, "w");
   }
   /** Write a received block at its byte offset (index * CHUNK). */
   async writeBlock(index, buf) {
@@ -100240,7 +100568,7 @@ var BlockAssembler = class {
       await this.open();
     let lf = null;
     try {
-      lf = await open3(localAbs, "r");
+      lf = await open4(localAbs, "r");
       const buf = Buffer.alloc(len);
       const { bytesRead } = await lf.read(buf, 0, len, localOffset);
       if (bytesRead !== len)
@@ -100268,7 +100596,7 @@ var BlockAssembler = class {
       });
       return false;
     }
-    await mkdir12(dirname24(dest), { recursive: true });
+    await mkdir12(dirname25(dest), { recursive: true });
     await chmod2(this.stagingPath, mode & 511).catch(() => {
     });
     const secs = mtimeMs / 1e3;
@@ -100291,8 +100619,8 @@ var BlockAssembler = class {
 };
 
 // ../../packages/host-core/dist/active-link/manifest.js
-import { readFileSync as readFileSync37, writeFileSync as writeFileSync25, mkdirSync as mkdirSync27, existsSync as existsSync24, renameSync as renameSync8 } from "node:fs";
-import { join as join54 } from "node:path";
+import { readFileSync as readFileSync38, writeFileSync as writeFileSync26, mkdirSync as mkdirSync28, existsSync as existsSync25, renameSync as renameSync8 } from "node:fs";
+import { join as join55 } from "node:path";
 
 // ../../packages/host-core/dist/active-link/reconcile.js
 var ABSENT = { kind: "absent", t: -Infinity, hash: "" };
@@ -100328,11 +100656,11 @@ var LinkManifest = class {
     this.dir = dir2;
   }
   file() {
-    return join54(this.dir, "manifest.json");
+    return join55(this.dir, "manifest.json");
   }
   load() {
     try {
-      const raw = JSON.parse(readFileSync37(this.file(), "utf-8"));
+      const raw = JSON.parse(readFileSync38(this.file(), "utf-8"));
       this.records = new Map(Object.entries(raw.records ?? {}));
       this.tombstones = new Map(Object.entries(raw.tombstones ?? {}));
     } catch {
@@ -100413,14 +100741,14 @@ var LinkManifest = class {
     if (!this.dirty)
       return;
     try {
-      if (!existsSync24(this.dir))
-        mkdirSync27(this.dir, { recursive: true });
+      if (!existsSync25(this.dir))
+        mkdirSync28(this.dir, { recursive: true });
       const json3 = {
         records: Object.fromEntries(this.records),
         tombstones: Object.fromEntries(this.tombstones)
       };
       const tmp = `${this.file()}.tmp`;
-      writeFileSync25(tmp, JSON.stringify(json3));
+      writeFileSync26(tmp, JSON.stringify(json3));
       renameSync8(tmp, this.file());
       this.dirty = false;
     } catch {
@@ -100430,7 +100758,7 @@ var LinkManifest = class {
 
 // ../../packages/host-core/dist/active-link/scanner.js
 import { readdir as readdir7, lstat as lstat3, readlink as readlink2 } from "node:fs/promises";
-import { join as join55, sep as sep10 } from "node:path";
+import { join as join56, sep as sep10 } from "node:path";
 async function walkRels(root, extraIgnore) {
   const out = [];
   async function rec(dir2) {
@@ -100445,7 +100773,7 @@ async function walkRels(root, extraIgnore) {
         continue;
       if (e.isDirectory() && HEAVY_DIRS.has(e.name))
         continue;
-      const abs = join55(dir2, e.name);
+      const abs = join56(dir2, e.name);
       if (extraIgnore?.(abs))
         continue;
       if (e.isDirectory())
@@ -100484,7 +100812,7 @@ async function scanTree(root, prior, allow, extraIgnore) {
   return { records };
 }
 function absOf(root, rel) {
-  return join55(root, rel.split("/").join(sep10));
+  return join56(root, rel.split("/").join(sep10));
 }
 
 // ../../packages/host-core/dist/active-link/gitignore.js
@@ -100502,7 +100830,7 @@ async function gitSyncedFiles(root) {
 
 // ../../packages/host-core/dist/active-link/session.js
 import { createHash as createHash6 } from "node:crypto";
-import { lstat as lstat4, readlink as readlink3, open as open4 } from "node:fs/promises";
+import { lstat as lstat4, readlink as readlink3, open as open5 } from "node:fs/promises";
 var OutboundSender = class {
   deps;
   queue = [];
@@ -100596,7 +100924,7 @@ var OutboundSender = class {
     const running2 = createHash6("sha256");
     let fh;
     try {
-      fh = await open4(abs, "r");
+      fh = await open5(abs, "r");
     } catch {
       return;
     }
@@ -100667,7 +100995,7 @@ var OutboundSender = class {
     const mode = st.mode;
     let fh;
     try {
-      fh = await open4(abs, "r");
+      fh = await open5(abs, "r");
     } catch {
       return;
     }
@@ -100928,7 +101256,7 @@ function readdirp(root, options = {}) {
 
 // ../../node_modules/chokidar/esm/handler.js
 import { watchFile, unwatchFile, watch as fs_watch } from "fs";
-import { open as open5, stat as stat7, lstat as lstat6, realpath as fsrealpath } from "fs/promises";
+import { open as open6, stat as stat7, lstat as lstat6, realpath as fsrealpath } from "fs/promises";
 import * as sysPath from "path";
 import { type as osType } from "os";
 var STR_DATA = "data";
@@ -101312,7 +101640,7 @@ var setFsWatchListener = (path6, fullPath, options, handlers) => {
         cont.watcherUnusable = true;
       if (isWindows2 && error51.code === "EPERM") {
         try {
-          const fd = await open5(path6, "r");
+          const fd = await open6(path6, "r");
           await fd.close();
           broadcastErr(error51);
         } catch (err2) {
@@ -101430,9 +101758,9 @@ var NodeFsHandler = class {
     if (this.fsw.closed) {
       return;
     }
-    const dirname41 = sysPath.dirname(file2);
+    const dirname42 = sysPath.dirname(file2);
     const basename14 = sysPath.basename(file2);
-    const parent = this.fsw._getWatchedDir(dirname41);
+    const parent = this.fsw._getWatchedDir(dirname42);
     let prevStats = stats;
     if (parent.has(basename14))
       return;
@@ -101459,7 +101787,7 @@ var NodeFsHandler = class {
             prevStats = newStats2;
           }
         } catch (error51) {
-          this.fsw._remove(dirname41, basename14);
+          this.fsw._remove(dirname42, basename14);
         }
       } else if (parent.has(basename14)) {
         const at = newStats.atimeMs;
@@ -102509,7 +102837,7 @@ var ActiveLinkEngine = class {
   }
   async start() {
     this.emit({ type: "status", linkId: this.opts.linkId, state: "scanning" });
-    await rm4(join58(this.stateDir, ".staging"), { recursive: true, force: true }).catch(() => {
+    await rm4(join59(this.stateDir, ".staging"), { recursive: true, force: true }).catch(() => {
     });
     this.manifest.load();
     await this.reconcileScan();
@@ -102904,13 +103232,13 @@ var ActiveLinkEngine = class {
    *  file so the path still exists — recorded as a FILE matching disk so the local
    *  watcher doesn't churn. The target is containment-checked, never dereferenced. */
   async applySymlink(rel, dest, target, mtimeMs, mode) {
-    const resolved = resolve11(dirname27(dest), target);
+    const resolved = resolve11(dirname28(dest), target);
     if (!isInsideRoot(resolved, this.opts.localRoot))
       return;
     const hash2 = hashString(target);
     const secs = mtimeMs / 1e3;
     try {
-      await mkdir13(dirname27(dest), { recursive: true });
+      await mkdir13(dirname28(dest), { recursive: true });
       await rm4(dest, { force: true, recursive: true });
       try {
         await symlink2(target, dest);
@@ -102962,7 +103290,7 @@ var ActiveLinkEngine = class {
       return;
     if (fromRec && fromRec.kind === "file") {
       try {
-        await mkdir13(dirname27(toAbs2), { recursive: true });
+        await mkdir13(dirname28(toAbs2), { recursive: true });
         await rename3(fromAbs, toAbs2);
         const secs = mtimeMs / 1e3;
         await utimes2(toAbs2, secs, secs).catch(() => {
@@ -102987,7 +103315,7 @@ var ActiveLinkEngine = class {
     await this.maybeRefreshAllow(rels);
     const state3 = /* @__PURE__ */ new Map();
     for (const rel of rels) {
-      if (existsSync25(absOf(this.opts.localRoot, rel)) && !this.isSynced(rel)) {
+      if (existsSync26(absOf(this.opts.localRoot, rel)) && !this.isSynced(rel)) {
         this.manifest.dropRecord(rel);
         continue;
       }
@@ -103091,7 +103419,7 @@ var ActiveLinkEngine = class {
     for (const rel of this.manifest.recordRels()) {
       if (records.has(rel))
         continue;
-      if (existsSync25(absOf(this.opts.localRoot, rel)))
+      if (existsSync26(absOf(this.opts.localRoot, rel)))
         this.manifest.dropRecord(rel);
       else
         this.manifest.setTombstone(rel, now2);
@@ -103137,7 +103465,7 @@ var ActiveLinkEngine = class {
     this.inboundWatchdog.clear();
   }
   stagingPath(rel, tag) {
-    return join58(this.stateDir, ".staging", `${hashString(rel)}.${tag}`);
+    return join59(this.stateDir, ".staging", `${hashString(rel)}.${tag}`);
   }
   pruneSuppress() {
     const now2 = this.now();
@@ -103162,14 +103490,14 @@ var ActiveLinkEngine = class {
 };
 
 // ../../packages/host-core/dist/active-link/config.js
-import { readFileSync as readFileSync38, writeFileSync as writeFileSync26, mkdirSync as mkdirSync28, existsSync as existsSync26, renameSync as renameSync9, watch as watch3 } from "node:fs";
-import { join as join59 } from "node:path";
+import { readFileSync as readFileSync39, writeFileSync as writeFileSync27, mkdirSync as mkdirSync29, existsSync as existsSync27, renameSync as renameSync9, watch as watch3 } from "node:fs";
+import { join as join60 } from "node:path";
 function configPath2() {
-  return join59(activeLinkRoot(), "links.json");
+  return join60(activeLinkRoot(), "links.json");
 }
 function loadLinkConfigs() {
   try {
-    const raw = JSON.parse(readFileSync38(configPath2(), "utf-8"));
+    const raw = JSON.parse(readFileSync39(configPath2(), "utf-8"));
     if (!Array.isArray(raw.links))
       return [];
     return raw.links.filter((c) => c && c.linkId && c.localRoot && c.peerHostId);
@@ -103180,10 +103508,10 @@ function loadLinkConfigs() {
 function writeAll(links) {
   try {
     const dir2 = activeLinkRoot();
-    if (!existsSync26(dir2))
-      mkdirSync28(dir2, { recursive: true });
+    if (!existsSync27(dir2))
+      mkdirSync29(dir2, { recursive: true });
     const tmp = `${configPath2()}.tmp`;
-    writeFileSync26(tmp, JSON.stringify({ links }, null, 2));
+    writeFileSync27(tmp, JSON.stringify({ links }, null, 2));
     renameSync9(tmp, configPath2());
   } catch {
   }
@@ -103202,11 +103530,11 @@ function saveLinkConfig(cfg2) {
   writeAll(links);
 }
 function pendingPath() {
-  return join59(activeLinkRoot(), "pending-deprovisions.json");
+  return join60(activeLinkRoot(), "pending-deprovisions.json");
 }
 function loadPendingDeprovisions() {
   try {
-    const raw = JSON.parse(readFileSync38(pendingPath(), "utf-8"));
+    const raw = JSON.parse(readFileSync39(pendingPath(), "utf-8"));
     return Array.isArray(raw.pending) ? raw.pending.filter((p) => p && p.linkId && p.peerHostId) : [];
   } catch {
     return [];
@@ -103215,10 +103543,10 @@ function loadPendingDeprovisions() {
 function writePending(pending2) {
   try {
     const dir2 = activeLinkRoot();
-    if (!existsSync26(dir2))
-      mkdirSync28(dir2, { recursive: true });
+    if (!existsSync27(dir2))
+      mkdirSync29(dir2, { recursive: true });
     const tmp = `${pendingPath()}.tmp`;
-    writeFileSync26(tmp, JSON.stringify({ pending: pending2 }, null, 2));
+    writeFileSync27(tmp, JSON.stringify({ pending: pending2 }, null, 2));
     renameSync9(tmp, pendingPath());
   } catch {
   }
@@ -103231,8 +103559,8 @@ function removeLinkConfig(linkId) {
 }
 function watchLinkConfigs(onChange) {
   const dir2 = activeLinkRoot();
-  if (!existsSync26(dir2))
-    mkdirSync28(dir2, { recursive: true });
+  if (!existsSync27(dir2))
+    mkdirSync29(dir2, { recursive: true });
   let timer2 = null;
   let watcher = null;
   try {
@@ -103377,7 +103705,7 @@ function routeInboundLinkFrame(frame) {
 init_dist5();
 
 // ../../packages/host-core/dist/pty-manager.js
-import { existsSync as existsSync27 } from "node:fs";
+import { existsSync as existsSync28 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
 init_safe_kill();
 var ptyPromise = null;
@@ -103532,7 +103860,7 @@ function listUnix() {
   const seen = /* @__PURE__ */ new Set();
   const loginShell = process.env.SHELL || "";
   const add2 = (id, path6) => {
-    if (!path6 || seen.has(path6) || !existsSync27(path6))
+    if (!path6 || seen.has(path6) || !existsSync28(path6))
       return;
     seen.add(path6);
     out.push(mk(id, path6, path6 === loginShell));
@@ -103564,7 +103892,7 @@ function listWindows() {
   const gitBash = `${pf}\\Git\\bin\\bash.exe`;
   const pwsh7 = `${pf}\\PowerShell\\7\\pwsh.exe`;
   const add2 = (id, path6, label, isDefault = false) => {
-    if (path6 && existsSync27(path6))
+    if (path6 && existsSync28(path6))
       out.push(mk(id, path6, isDefault, label));
   };
   add2("powershell", winPwsh, "Windows PowerShell", true);
@@ -103623,7 +103951,7 @@ function resolveCwd(cwd, hostRoot) {
   const fallback = hostRoot || homedir9();
   if (!cwd)
     return fallback;
-  if (!existsSync27(cwd))
+  if (!existsSync28(cwd))
     return fallback;
   if (hostRoot && !isInsideRoot(cwd, hostRoot))
     return hostRoot;
@@ -103658,6 +103986,7 @@ function turnRekeyed(from, to) {
 var HOST_ROOT = resolveHostRoot();
 var HOST_CONTAIN = resolveContainmentRoot() ?? void 0;
 var hooks = null;
+var hookSets = [];
 var socket = null;
 var heartbeat = null;
 var reconnectTimer = null;
@@ -103855,6 +104184,16 @@ function listHosts() {
 function ownHost() {
   return ownHostId();
 }
+function setControlLinkDeviceId(id) {
+  if (!id || id === deviceId)
+    return;
+  deviceId = id;
+  if (cfg)
+    cfg = { ...cfg, deviceId: id };
+  lastOwnHostLog = null;
+  hooks?.ownHostResolved(ownHostId());
+  hooks?.pushHosts(presentedHosts());
+}
 function assertServerSelection() {
   if (!socket || socket.readyState !== 1)
     return;
@@ -104081,9 +104420,9 @@ function provisionActiveLinkMirror(payload) {
   const remoteSubfolder = typeof payload.remoteSubfolder === "string" ? payload.remoteSubfolder : void 0;
   let localRoot;
   if (remoteParent && remoteSubfolder) {
-    localRoot = join60(remoteParent, safeFolderName(remoteSubfolder));
+    localRoot = join61(remoteParent, safeFolderName(remoteSubfolder));
   } else {
-    localRoot = join60(HOST_ROOT, "Tesseract Mirrors", safeFolderName(projectName));
+    localRoot = join61(HOST_ROOT, "Tesseract Mirrors", safeFolderName(projectName));
   }
   if (loadLinkConfigs().some((c) => c.localRoot === localRoot && c.linkId !== linkId)) {
     localRoot = `${localRoot}-${linkId.slice(0, 6)}`;
@@ -104091,7 +104430,7 @@ function provisionActiveLinkMirror(payload) {
   if (!isInsideRoot(localRoot, HOST_ROOT))
     return;
   try {
-    mkdirSync29(localRoot, { recursive: true });
+    mkdirSync30(localRoot, { recursive: true });
   } catch {
   }
   saveLinkConfig({
@@ -104399,7 +104738,7 @@ async function handleInboundAgent(msg, driverClientId) {
           send3("agent", {
             type: "agent:notice",
             sessionId: msg.sessionId,
-            noticeId: randomUUID24(),
+            noticeId: randomUUID25(),
             category: "model",
             level: "warning",
             title: "That model is not available on this device",
@@ -105119,7 +105458,9 @@ function startControlLink(config2, h) {
   deviceId = config2.deviceId;
   backendOrigin = config2.tokenSource.backendOrigin;
   hostVersion = config2.version;
-  hooks = h;
+  if (!hookSets.includes(h))
+    hookSets.push(h);
+  hooks = composeHooks(hookSets, (hook, err2) => console.warn(`[control-link] ${hook} listener failed:`, err2 instanceof Error ? err2.message : err2));
   stopped = false;
   if (config2.e2e && !hostSessions) {
     const e2e = config2.e2e;
@@ -105196,9 +105537,9 @@ init_gateway_plan2();
 init_base_paths();
 init_credentials();
 init_dist5();
-import { mkdirSync as mkdirSync30, readFileSync as readFileSync39, writeFileSync as writeFileSync27 } from "node:fs";
-import { randomUUID as randomUUID25 } from "node:crypto";
-import { dirname as dirname28 } from "node:path";
+import { mkdirSync as mkdirSync31, readFileSync as readFileSync40, writeFileSync as writeFileSync28 } from "node:fs";
+import { randomUUID as randomUUID26 } from "node:crypto";
+import { dirname as dirname29 } from "node:path";
 var REFRESH_MS = 24 * 60 * 60 * 1e3;
 var TIMEOUT_MS2 = 1e4;
 var CACHE = () => tessPath("bundled-model.json");
@@ -105208,22 +105549,22 @@ function deviceId2() {
   if (fromCredentials)
     return fromCredentials;
   try {
-    const raw = JSON.parse(readFileSync39(DEVICE_ID(), "utf8"));
+    const raw = JSON.parse(readFileSync40(DEVICE_ID(), "utf8"));
     if (typeof raw?.deviceId === "string" && raw.deviceId)
       return raw.deviceId;
   } catch {
   }
-  const fresh = randomUUID25().slice(0, 8);
+  const fresh = randomUUID26().slice(0, 8);
   try {
-    mkdirSync30(dirname28(DEVICE_ID()), { recursive: true });
-    writeFileSync27(DEVICE_ID(), JSON.stringify({ deviceId: fresh }), { mode: 384 });
+    mkdirSync31(dirname29(DEVICE_ID()), { recursive: true });
+    writeFileSync28(DEVICE_ID(), JSON.stringify({ deviceId: fresh }), { mode: 384 });
   } catch {
   }
   return fresh;
 }
 function readCache() {
   try {
-    const raw = JSON.parse(readFileSync39(CACHE(), "utf8"));
+    const raw = JSON.parse(readFileSync40(CACHE(), "utf8"));
     if (typeof raw?.apiKey === "string" && typeof raw.baseUrl === "string" && raw.models?.low && raw.models.high) {
       return { ...raw, fetchedAt: raw.fetchedAt ?? 0 };
     }
@@ -105233,8 +105574,8 @@ function readCache() {
 }
 function writeCache(key2) {
   try {
-    mkdirSync30(dirname28(CACHE()), { recursive: true });
-    writeFileSync27(CACHE(), JSON.stringify({ ...key2, fetchedAt: Date.now() }, null, 2), { mode: 384 });
+    mkdirSync31(dirname29(CACHE()), { recursive: true });
+    writeFileSync28(CACHE(), JSON.stringify({ ...key2, fetchedAt: Date.now() }, null, 2), { mode: 384 });
   } catch (e) {
     log(`gateway key: could not cache (${e.message})`);
   }
@@ -105815,7 +106156,7 @@ Open System Settings \u2192 Privacy & Security \u2192 Screen Recording and switc
 }
 
 // ../../packages/host-core/dist/rdesk/publisher-window.js
-import { join as join61 } from "node:path";
+import { join as join62 } from "node:path";
 var windows = /* @__PURE__ */ new Map();
 var ipcInstalled = false;
 function ensureIpc() {
@@ -105970,7 +106311,7 @@ var PublisherWindow = class {
       win3.setContentProtection(true);
     } catch {
     }
-    await win3.loadFile(join61(daemonUiDir(), "publisher.html"));
+    await win3.loadFile(join62(daemonUiDir(), "publisher.html"));
     this.send("rdesk:pub:start", {
       sessionId: this.sessionId,
       sourceId,
@@ -106015,7 +106356,7 @@ var PublisherWindow = class {
       win3.setContentProtection(true);
     } catch {
     }
-    await win3.loadFile(join61(daemonUiDir(), "publisher.html"));
+    await win3.loadFile(join62(daemonUiDir(), "publisher.html"));
     this.send("rdesk:pub:start", {
       sessionId: this.sessionId,
       mode: "canvas",
@@ -106615,10 +106956,10 @@ function setInProcConnector(fn) {
 
 // ../../packages/host-core/dist/rdesk/server-prefs.js
 init_credentials();
-import { readFileSync as readFileSync40, writeFileSync as writeFileSync28 } from "node:fs";
-import { join as join62 } from "node:path";
+import { readFileSync as readFileSync41, writeFileSync as writeFileSync29 } from "node:fs";
+import { join as join63 } from "node:path";
 function rdeskServerPrefsPath() {
-  return join62(daemonDir2(), "rdesk-server.json");
+  return join63(daemonDir2(), "rdesk-server.json");
 }
 var DEFAULTS2 = {
   enabled: true,
@@ -106630,7 +106971,7 @@ var DEFAULTS2 = {
 };
 function readRdeskServerPrefs() {
   try {
-    const p = JSON.parse(readFileSync40(rdeskServerPrefsPath(), "utf8"));
+    const p = JSON.parse(readFileSync41(rdeskServerPrefsPath(), "utf8"));
     return {
       // `!== false` (not `?? true`): only an explicit opt-out disables sharing, so a
       // partially-written or older prefs file never silently turns the machine off.
@@ -106648,7 +106989,7 @@ function readRdeskServerPrefs() {
 function writeRdeskServerPrefs(patch) {
   try {
     const next = { ...readRdeskServerPrefs(), ...patch };
-    writeFileSync28(rdeskServerPrefsPath(), JSON.stringify(next), { mode: 384 });
+    writeFileSync29(rdeskServerPrefsPath(), JSON.stringify(next), { mode: 384 });
   } catch {
   }
 }
@@ -106663,13 +107004,13 @@ function rdeskSharingEnabled() {
 // ../../packages/host-core/dist/rdesk/password.js
 init_credentials();
 import { scryptSync, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual4, randomInt } from "node:crypto";
-import { readFileSync as readFileSync41, writeFileSync as writeFileSync29, existsSync as existsSync28, unlinkSync as unlinkSync3 } from "node:fs";
-import { join as join63 } from "node:path";
+import { readFileSync as readFileSync42, writeFileSync as writeFileSync30, existsSync as existsSync29, unlinkSync as unlinkSync4 } from "node:fs";
+import { join as join64 } from "node:path";
 function pwFile() {
-  return join63(daemonDir2(), "rdesk-password.json");
+  return join64(daemonDir2(), "rdesk-password.json");
 }
 function pwPlainFile() {
-  return join63(daemonDir2(), "rdesk-password.enc");
+  return join64(daemonDir2(), "rdesk-password.enc");
 }
 var PW_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789";
 var PW_LENGTH = 16;
@@ -106684,14 +107025,14 @@ function writePlain(password) {
     const safe2 = electronModule()?.safeStorage;
     if (!safe2?.isEncryptionAvailable())
       return;
-    writeFileSync29(pwPlainFile(), safe2.encryptString(password), { mode: 384 });
+    writeFileSync30(pwPlainFile(), safe2.encryptString(password), { mode: 384 });
   } catch {
   }
 }
 function canRevealRdeskPassword() {
   try {
     const safe2 = electronModule()?.safeStorage;
-    return !!safe2?.isEncryptionAvailable() && existsSync28(pwPlainFile());
+    return !!safe2?.isEncryptionAvailable() && existsSync29(pwPlainFile());
   } catch {
     return false;
   }
@@ -106701,7 +107042,7 @@ function readRdeskPasswordPlain() {
     const safe2 = electronModule()?.safeStorage;
     if (!safe2?.isEncryptionAvailable())
       return null;
-    return safe2.decryptString(readFileSync41(pwPlainFile()));
+    return safe2.decryptString(readFileSync42(pwPlainFile()));
   } catch {
     return null;
   }
@@ -106709,18 +107050,18 @@ function readRdeskPasswordPlain() {
 function setRdeskPassword(password) {
   if (!password) {
     try {
-      unlinkSync3(pwFile());
+      unlinkSync4(pwFile());
     } catch {
     }
     try {
-      unlinkSync3(pwPlainFile());
+      unlinkSync4(pwPlainFile());
     } catch {
     }
     return;
   }
   const salt = randomBytes5(16);
   const hash2 = scryptSync(password, salt, 32);
-  writeFileSync29(pwFile(), JSON.stringify({ salt: salt.toString("hex"), hash: hash2.toString("hex") }), { mode: 384 });
+  writeFileSync30(pwFile(), JSON.stringify({ salt: salt.toString("hex"), hash: hash2.toString("hex") }), { mode: 384 });
   writePlain(password);
 }
 function regenerateRdeskPassword() {
@@ -106734,7 +107075,7 @@ function ensureRdeskPassword() {
   return regenerateRdeskPassword();
 }
 function hasRdeskPassword() {
-  return !!process.env.CCB_RDESK_PASSWORD || existsSync28(pwFile());
+  return !!process.env.CCB_RDESK_PASSWORD || existsSync29(pwFile());
 }
 function verifyRdeskPassword(password) {
   if (!password)
@@ -106743,7 +107084,7 @@ function verifyRdeskPassword(password) {
   if (override3)
     return password.length === override3.length && timingSafeEqual4(Buffer.from(password), Buffer.from(override3));
   try {
-    const { salt, hash: hash2 } = JSON.parse(readFileSync41(pwFile(), "utf8"));
+    const { salt, hash: hash2 } = JSON.parse(readFileSync42(pwFile(), "utf8"));
     const got = scryptSync(password, Buffer.from(salt, "hex"), 32);
     const want = Buffer.from(hash2, "hex");
     return got.length === want.length && timingSafeEqual4(got, want);
@@ -107221,7 +107562,7 @@ function stopSystemEvents() {
 }
 
 // ../../packages/host-core/dist/local-server.js
-import { randomUUID as randomUUID27 } from "node:crypto";
+import { randomUUID as randomUUID28 } from "node:crypto";
 init_daemon_settings();
 
 // ../../packages/host-core/dist/vault/manager.js
@@ -107309,8 +107650,8 @@ function createPasskeyRegistration(rpId) {
 
 // ../../packages/host-core/dist/vault/manager.js
 init_base_paths();
-import { mkdirSync as mkdirSync33, readFileSync as readFileSync44, writeFileSync as writeFileSync32 } from "node:fs";
-import { dirname as dirname30 } from "node:path";
+import { mkdirSync as mkdirSync34, readFileSync as readFileSync45, writeFileSync as writeFileSync33 } from "node:fs";
+import { dirname as dirname31 } from "node:path";
 
 // ../../packages/vault-core/dist/crypto.js
 init_argon2();
@@ -107404,7 +107745,7 @@ async function seal(key2, plaintext, aad) {
   const ct = await aesSeal(key2, nonce2, plaintext, aad);
   return `${ENVELOPE}:${b64u(nonce2)}:${b64u(ct)}`;
 }
-async function open6(key2, envelope2, aad) {
+async function open7(key2, envelope2, aad) {
   const parts = envelope2.split(":");
   if (parts.length !== 3 || parts[0] !== ENVELOPE)
     throw new Error("malformed vault envelope");
@@ -107417,7 +107758,7 @@ async function wrapVaultKey(masterKey, vaultKey) {
   return seal(await wrappingKey(masterKey), vaultKey, WRAP_AAD);
 }
 async function unwrapVaultKey(masterKey, wrapped) {
-  return open6(await wrappingKey(masterKey), wrapped, WRAP_AAD);
+  return open7(await wrappingKey(masterKey), wrapped, WRAP_AAD);
 }
 async function createVault(masterPassword, kdf2 = defaultKdfParams()) {
   const masterKey = deriveMasterKey(masterPassword, kdf2);
@@ -107450,7 +107791,7 @@ async function recoverWithKey(recoveryKey, meta4) {
     throw new Error("no recovery key is set for this vault");
   const kek = await importAesKey(parseRecoveryKey(recoveryKey));
   try {
-    return await open6(kek, meta4.recoveryWrappedVaultKey, RECOVERY_AAD);
+    return await open7(kek, meta4.recoveryWrappedVaultKey, RECOVERY_AAD);
   } catch {
     throw new Error("Incorrect recovery key");
   }
@@ -107471,7 +107812,7 @@ async function encryptItem(vaultKey, item) {
 }
 async function decryptItem(vaultKey, enc) {
   const key2 = await importAesKey(vaultKey);
-  return JSON.parse(fromUtf8(await open6(key2, enc.ciphertext, itemAad(enc.id))));
+  return JSON.parse(fromUtf8(await open7(key2, enc.ciphertext, itemAad(enc.id))));
 }
 function tombstone(id, updatedAt) {
   return { id, ciphertext: "", updatedAt, deleted: true };
@@ -107817,7 +108158,7 @@ var XJSON_AAD = utf8("tesseract-vault-encrypted-json-v1");
 init_credentials();
 
 // ../../packages/host-core/dist/vault/store.js
-import { randomUUID as randomUUID26 } from "node:crypto";
+import { randomUUID as randomUUID27 } from "node:crypto";
 var b64 = (u) => Buffer.from(u).toString("base64");
 var u82 = (s) => new Uint8Array(Buffer.from(s, "base64"));
 var isServerRecoverableMeta = (m) => !m.wrappedVaultKey;
@@ -108119,7 +108460,7 @@ var VaultStore = class {
     const existing = input.id ? items.get(input.id) : void 0;
     const { id: _drop, name, folderId, favorite, reprompt, notes, tags, ...content } = input;
     const item = {
-      id: input.id ?? randomUUID26(),
+      id: input.id ?? randomUUID27(),
       name,
       folderId,
       favorite,
@@ -108148,7 +108489,7 @@ var VaultStore = class {
     const now2 = this.now();
     for (const d of drafts) {
       const { name, notes, favorite, tags, ...content } = d;
-      const item = { id: randomUUID26(), name, notes, favorite, tags, createdAt: now2, updatedAt: now2, ...content };
+      const item = { id: randomUUID27(), name, notes, favorite, tags, createdAt: now2, updatedAt: now2, ...content };
       items.set(item.id, item);
       this.enc.set(item.id, await encryptItem(key2, item));
       this.dirty.add(item.id);
@@ -108334,8 +108675,8 @@ function makeDaemonVaultApi(getOrigin, getToken2) {
 
 // ../../packages/host-core/dist/vault/persistence.js
 init_base_paths();
-import { existsSync as existsSync29, mkdirSync as mkdirSync31, readFileSync as readFileSync42, writeFileSync as writeFileSync30, unlinkSync as unlinkSync4 } from "node:fs";
-import { dirname as dirname29 } from "node:path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync32, readFileSync as readFileSync43, writeFileSync as writeFileSync31, unlinkSync as unlinkSync5 } from "node:fs";
+import { dirname as dirname30 } from "node:path";
 function vaultStoreFile() {
   return homePath(".tesseract", "vault", "vault.json");
 }
@@ -108346,9 +108687,9 @@ function makeVaultPersistence(file2 = vaultStoreFile, deviceKeyFile = vaultDevic
   return {
     load() {
       try {
-        if (!existsSync29(file2()))
+        if (!existsSync30(file2()))
           return null;
-        const parsed = JSON.parse(readFileSync42(file2(), "utf8"));
+        const parsed = JSON.parse(readFileSync43(file2(), "utf8"));
         if (!parsed || typeof parsed !== "object")
           return null;
         return { meta: parsed.meta ?? null, items: Array.isArray(parsed.items) ? parsed.items : [] };
@@ -108358,29 +108699,29 @@ function makeVaultPersistence(file2 = vaultStoreFile, deviceKeyFile = vaultDevic
     },
     save(state3) {
       try {
-        mkdirSync31(dirname29(file2()), { recursive: true, mode: 448 });
-        writeFileSync30(file2(), JSON.stringify(state3), { mode: 384 });
+        mkdirSync32(dirname30(file2()), { recursive: true, mode: 448 });
+        writeFileSync31(file2(), JSON.stringify(state3), { mode: 384 });
       } catch {
       }
     },
     loadDeviceKey() {
       try {
-        return existsSync29(deviceKeyFile()) ? readFileSync42(deviceKeyFile(), "utf8").trim() || null : null;
+        return existsSync30(deviceKeyFile()) ? readFileSync43(deviceKeyFile(), "utf8").trim() || null : null;
       } catch {
         return null;
       }
     },
     saveDeviceKey(base64Key) {
       try {
-        mkdirSync31(dirname29(deviceKeyFile()), { recursive: true, mode: 448 });
-        writeFileSync30(deviceKeyFile(), base64Key, { mode: 384 });
+        mkdirSync32(dirname30(deviceKeyFile()), { recursive: true, mode: 448 });
+        writeFileSync31(deviceKeyFile(), base64Key, { mode: 384 });
       } catch {
       }
     },
     clearDeviceKey() {
       try {
-        if (existsSync29(deviceKeyFile()))
-          unlinkSync4(deviceKeyFile());
+        if (existsSync30(deviceKeyFile()))
+          unlinkSync5(deviceKeyFile());
       } catch {
       }
     }
@@ -108389,8 +108730,8 @@ function makeVaultPersistence(file2 = vaultStoreFile, deviceKeyFile = vaultDevic
 
 // ../../packages/host-core/dist/vault/biometric.js
 init_base_paths();
-import { existsSync as existsSync30, mkdirSync as mkdirSync32, readFileSync as readFileSync43, rmSync as rmSync6, writeFileSync as writeFileSync31 } from "node:fs";
-import { join as join64 } from "node:path";
+import { existsSync as existsSync31, mkdirSync as mkdirSync33, readFileSync as readFileSync44, rmSync as rmSync6, writeFileSync as writeFileSync32 } from "node:fs";
+import { join as join65 } from "node:path";
 async function electronBio() {
   if (!electronModule())
     return null;
@@ -108407,11 +108748,11 @@ async function electronBio() {
 }
 function bioDir() {
   const d = homePath(".tesseract", "vault-bio");
-  mkdirSync32(d, { recursive: true, mode: 448 });
+  mkdirSync33(d, { recursive: true, mode: 448 });
   return d;
 }
 function bioFile(id) {
-  return join64(bioDir(), `${String(id).replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 64)}.enc`);
+  return join65(bioDir(), `${String(id).replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 64)}.enc`);
 }
 async function biometricAvailable() {
   if (process.platform !== "darwin")
@@ -108426,24 +108767,24 @@ async function biometricAvailable() {
   }
 }
 function biometricEnrolled(id) {
-  return existsSync30(bioFile(id));
+  return existsSync31(bioFile(id));
 }
 async function biometricEnroll(id, base64Key) {
   const bio = await electronBio();
   if (!bio)
     throw new Error("Touch ID is not available on this device.");
   await bio.systemPreferences.promptTouchID("enable Touch ID for your vault");
-  writeFileSync31(bioFile(id), bio.safeStorage.encryptString(base64Key), { mode: 384 });
+  writeFileSync32(bioFile(id), bio.safeStorage.encryptString(base64Key), { mode: 384 });
 }
 async function biometricUnlock(id) {
   const f = bioFile(id);
-  if (!existsSync30(f))
+  if (!existsSync31(f))
     throw new Error("Touch ID is not set up for this vault.");
   const bio = await electronBio();
   if (!bio)
     throw new Error("Touch ID is not available on this device.");
   await bio.systemPreferences.promptTouchID("unlock your vault");
-  return bio.safeStorage.decryptString(readFileSync43(f));
+  return bio.safeStorage.decryptString(readFileSync44(f));
 }
 function biometricDisable(id) {
   try {
@@ -108473,7 +108814,7 @@ var VaultManager = class {
   // ── auto-lock ────────────────────────────────────────────────────────────────────
   loadAutoLock() {
     try {
-      const raw = JSON.parse(readFileSync44(settingsFile(), "utf8"));
+      const raw = JSON.parse(readFileSync45(settingsFile(), "utf8"));
       return Number.isFinite(raw.autoLockMinutes) ? Math.max(0, raw.autoLockMinutes) : 0;
     } catch {
       return 0;
@@ -108481,8 +108822,8 @@ var VaultManager = class {
   }
   saveAutoLock() {
     try {
-      mkdirSync33(dirname30(settingsFile()), { recursive: true, mode: 448 });
-      writeFileSync32(settingsFile(), JSON.stringify({ autoLockMinutes: this.autoLockMinutes }), { mode: 384 });
+      mkdirSync34(dirname31(settingsFile()), { recursive: true, mode: 448 });
+      writeFileSync33(settingsFile(), JSON.stringify({ autoLockMinutes: this.autoLockMinutes }), { mode: 384 });
     } catch {
     }
   }
@@ -109179,7 +109520,7 @@ async function startLocalServer(opts) {
             send4("agent", {
               type: "agent:notice",
               sessionId: msg.sessionId,
-              noticeId: randomUUID27(),
+              noticeId: randomUUID28(),
               category: "model",
               level: "warning",
               title: "That model is not available on this device",
@@ -109557,22 +109898,22 @@ async function startLocalServer(opts) {
 
 // ../../packages/host-core/dist/daemon-runtime.js
 init_base_paths();
-import { readFileSync as readFileSync49, writeFileSync as writeFileSync40, existsSync as existsSync39, mkdirSync as mkdirSync41, unlinkSync as unlinkSync6, chmodSync as chmodSync7, statSync as statSync14 } from "node:fs";
+import { readFileSync as readFileSync50, writeFileSync as writeFileSync41, existsSync as existsSync40, mkdirSync as mkdirSync42, unlinkSync as unlinkSync7, chmodSync as chmodSync7, statSync as statSync15 } from "node:fs";
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { join as join77 } from "node:path";
+import { join as join78 } from "node:path";
 import { randomBytes as randomBytes10 } from "node:crypto";
 import { hostname as hostname5 } from "node:os";
 
 // ../../packages/shared/dist/daemon-registry.js
 init_base_paths();
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync31, mkdirSync as mkdirSync34, readdirSync as readdirSync11, readFileSync as readFileSync45, readlinkSync, unlinkSync as unlinkSync5, writeFileSync as writeFileSync33 } from "node:fs";
-import { join as join65 } from "node:path";
+import { existsSync as existsSync32, mkdirSync as mkdirSync35, readdirSync as readdirSync11, readFileSync as readFileSync46, readlinkSync, unlinkSync as unlinkSync6, writeFileSync as writeFileSync34 } from "node:fs";
+import { join as join66 } from "node:path";
 var SUPERVISOR_PID = Number(process.env.CCB_DAEMON_SUPERVISOR_PID ?? 0) || 0;
 delete process.env.CCB_DAEMON_SUPERVISOR_PID;
 var PS_ENV = { ...process.env, LC_ALL: "C", LANG: "C" };
-var registryDir = () => join65(daemonDir(), "daemons");
-var recordPath = (pid) => join65(registryDir(), `${pid}.json`);
+var registryDir = () => join66(daemonDir(), "daemons");
+var recordPath = (pid) => join66(registryDir(), `${pid}.json`);
 function isPidAlive2(pid) {
   try {
     process.kill(pid, 0);
@@ -109624,7 +109965,7 @@ function pidStillMatches(pid, rec) {
 }
 function registerSelfAsDaemon(version2) {
   try {
-    mkdirSync34(registryDir(), { recursive: true, mode: 448 });
+    mkdirSync35(registryDir(), { recursive: true, mode: 448 });
     const rec = {
       pid: process.pid,
       startedAt: procStartedAt(process.pid),
@@ -109636,7 +109977,7 @@ function registerSelfAsDaemon(version2) {
       ...process.env.CCB_RDESK_ONLY === "1" || process.env.CCB_MESH_ONLY === "1" ? { rdeskOnly: true } : {},
       ...SUPERVISOR_PID ? { supervisorPid: SUPERVISOR_PID, supervisorStartedAt: procStartedAt(SUPERVISOR_PID) } : {}
     };
-    writeFileSync33(recordPath(process.pid), JSON.stringify(rec), { mode: 384 });
+    writeFileSync34(recordPath(process.pid), JSON.stringify(rec), { mode: 384 });
     invalidateSupervisorCache();
     try {
       registeredDaemons(process.pid);
@@ -109647,7 +109988,7 @@ function registerSelfAsDaemon(version2) {
 }
 function forgetDaemon(pid) {
   try {
-    unlinkSync5(recordPath(pid));
+    unlinkSync6(recordPath(pid));
   } catch {
   }
   invalidateSupervisorCache();
@@ -109657,7 +109998,7 @@ function unregisterSelfAsDaemon() {
 }
 function readRecord(pid) {
   try {
-    return JSON.parse(readFileSync45(recordPath(pid), "utf-8"));
+    return JSON.parse(readFileSync46(recordPath(pid), "utf-8"));
   } catch {
     return null;
   }
@@ -109671,7 +110012,7 @@ function allRegisteredPids() {
 }
 function registeredDaemons(selfPid) {
   const out = [];
-  if (!existsSync31(registryDir()))
+  if (!existsSync32(registryDir()))
     return out;
   for (const pid of allRegisteredPids()) {
     if (pid === selfPid)
@@ -109700,18 +110041,18 @@ function liveDaemons() {
 }
 
 // ../../packages/host-core/dist/device-identity.js
-import { join as join66 } from "node:path";
-import { readFileSync as readFileSync46, writeFileSync as writeFileSync34, existsSync as existsSync32, mkdirSync as mkdirSync35, renameSync as renameSync10, chmodSync as chmodSync4 } from "node:fs";
+import { join as join67 } from "node:path";
+import { readFileSync as readFileSync47, writeFileSync as writeFileSync35, existsSync as existsSync33, mkdirSync as mkdirSync36, renameSync as renameSync10, chmodSync as chmodSync4 } from "node:fs";
 init_credentials();
 var cached3 = null;
 function identityPath() {
-  return join66(daemonDir2(), "identity.json");
+  return join67(daemonDir2(), "identity.json");
 }
 async function loadOrCreateDeviceIdentity() {
   if (cached3)
     return cached3;
   try {
-    const stored = JSON.parse(readFileSync46(identityPath(), "utf-8"));
+    const stored = JSON.parse(readFileSync47(identityPath(), "utf-8"));
     if (stored?.privateJwk) {
       cached3 = await importIdentity(stored.privateJwk);
       return cached3;
@@ -109721,10 +110062,10 @@ async function loadOrCreateDeviceIdentity() {
   const kp = await generateIdentityKeyPair(true);
   const { privateJwk, publicRaw } = await exportIdentity(kp);
   const dir2 = daemonDir2();
-  if (!existsSync32(dir2))
-    mkdirSync35(dir2, { recursive: true, mode: 448 });
+  if (!existsSync33(dir2))
+    mkdirSync36(dir2, { recursive: true, mode: 448 });
   const tmp = `${identityPath()}.tmp`;
-  writeFileSync34(tmp, JSON.stringify({ privateJwk, publicRaw, alg: "P256-ECDSA" }, null, 2), { mode: 384 });
+  writeFileSync35(tmp, JSON.stringify({ privateJwk, publicRaw, alg: "P256-ECDSA" }, null, 2), { mode: 384 });
   renameSync10(tmp, identityPath());
   try {
     chmodSync4(identityPath(), 384);
@@ -109735,7 +110076,7 @@ async function loadOrCreateDeviceIdentity() {
 }
 var sealingCached = null;
 function sealingPath() {
-  return join66(daemonDir2(), "sealing.json");
+  return join67(daemonDir2(), "sealing.json");
 }
 var EC_DH = { name: "ECDH", namedCurve: "P-256" };
 async function loadOrCreateSealingKey() {
@@ -109743,7 +110084,7 @@ async function loadOrCreateSealingKey() {
     return sealingCached;
   const { subtle: subtle5 } = globalThis.crypto;
   try {
-    const stored = JSON.parse(readFileSync46(sealingPath(), "utf-8"));
+    const stored = JSON.parse(readFileSync47(sealingPath(), "utf-8"));
     if (stored?.privateJwk && stored.publicRaw) {
       const privateKey = await subtle5.importKey("jwk", stored.privateJwk, EC_DH, true, ["deriveBits"]);
       sealingCached = { privateKey, publicRaw: unb64u(stored.publicRaw) };
@@ -109755,10 +110096,10 @@ async function loadOrCreateSealingKey() {
   const publicRaw = new Uint8Array(await subtle5.exportKey("raw", kp.publicKey));
   const privateJwk = await subtle5.exportKey("jwk", kp.privateKey);
   const dir2 = daemonDir2();
-  if (!existsSync32(dir2))
-    mkdirSync35(dir2, { recursive: true, mode: 448 });
+  if (!existsSync33(dir2))
+    mkdirSync36(dir2, { recursive: true, mode: 448 });
   const tmp = `${sealingPath()}.tmp`;
-  writeFileSync34(tmp, JSON.stringify({ privateJwk, publicRaw: b64u(publicRaw), alg: "P256-ECDH" }, null, 2), { mode: 384 });
+  writeFileSync35(tmp, JSON.stringify({ privateJwk, publicRaw: b64u(publicRaw), alg: "P256-ECDH" }, null, 2), { mode: 384 });
   renameSync10(tmp, sealingPath());
   try {
     chmodSync4(sealingPath(), 384);
@@ -109855,6 +110196,7 @@ var BundleOfferLedger = class {
 init_dist6();
 
 // ../../packages/host-core/dist/mesh/netd-client.js
+import { existsSync as existsSync34, readdirSync as readdirSync12 } from "node:fs";
 import { connect as connect2 } from "node:net";
 import { platform as platform3 } from "node:process";
 var NETD_WIRE_VERSION = 2;
@@ -109867,6 +110209,17 @@ function netdEndpoint() {
     return "/var/run/tesseract-netd.sock";
   return "/run/tesseract-netd.sock";
 }
+function netdListening() {
+  const ep = endpointOverride() ?? netdEndpoint();
+  if (process.platform !== "win32")
+    return existsSync34(ep);
+  try {
+    const name = ep.replace(/^\\\\\.\\pipe\\/, "");
+    return readdirSync12("\\\\.\\pipe\\").includes(name);
+  } catch {
+    return false;
+  }
+}
 function endpointOverride() {
   return process.env.CCB_NETD_SOCKET ?? null;
 }
@@ -110149,7 +110502,7 @@ var NetdEngine = class {
     p.relayed = p.relayed || relayed;
     this.#pendingEndpoints.set(k, p);
   }
-  startHandshake(staticPub, _nowMs) {
+  #flushHint(staticPub) {
     const k = staticPub.toString("hex");
     const p = this.#pendingEndpoints.get(k) ?? { endpoints: [], relayed: false };
     this.#pendingEndpoints.delete(k);
@@ -110158,6 +110511,12 @@ var NetdEngine = class {
         this.#lastError = `hint: ${r.detail}`;
     });
   }
+  startHandshake(staticPub, _nowMs) {
+    this.#flushHint(staticPub);
+  }
+  ensureHandshake(staticPub, _nowMs) {
+    this.#flushHint(staticPub);
+  }
   /** No UDP here — netd owns the socket. Never called in practice; kept for the interface. */
   injectUdp(_pkt, _from, _nowMs) {
   }
@@ -110222,9 +110581,6 @@ var NetdEngine = class {
   }
 };
 
-// ../../packages/host-core/dist/mesh/node.js
-import { existsSync as existsSync34 } from "node:fs";
-
 // ../../packages/host-core/dist/mesh/bundle-refresh.js
 init_dist6();
 var CONTEXT = "tsr-bundle-fetch-v1";
@@ -110261,13 +110617,13 @@ ${ts}`);
 
 // ../../packages/host-core/dist/mesh/config.js
 init_credentials();
-import { chmodSync as chmodSync5, existsSync as existsSync33, mkdirSync as mkdirSync36, readdirSync as readdirSync12, readFileSync as readFileSync47, renameSync as renameSync11, rmSync as rmSync7, writeFileSync as writeFileSync35 } from "node:fs";
-import { dirname as dirname31, join as join68 } from "node:path";
+import { chmodSync as chmodSync5, existsSync as existsSync35, mkdirSync as mkdirSync37, readdirSync as readdirSync13, readFileSync as readFileSync48, renameSync as renameSync11, rmSync as rmSync7, writeFileSync as writeFileSync36 } from "node:fs";
+import { dirname as dirname32, join as join69 } from "node:path";
 function meshDir() {
-  return join68(daemonDir2(), "mesh");
+  return join69(daemonDir2(), "mesh");
 }
 function meshesDir() {
-  return join68(meshDir(), "meshes");
+  return join69(meshDir(), "meshes");
 }
 var MESH_DIR_NAME_BYTES = 8;
 function meshDirName(genesisFp) {
@@ -110285,7 +110641,7 @@ function oneMeshDir(meshId) {
   if (!isMeshId(meshId)) {
     throw new Error(`not a mesh id: ${JSON.stringify(meshId.slice(0, 64))}`);
   }
-  return join68(meshesDir(), meshId);
+  return join69(meshesDir(), meshId);
 }
 var LEGACY_MESH_ID = "legacy";
 var CERT_GENESIS_FP_OFFSET = 19;
@@ -110303,29 +110659,29 @@ var FILES = {
   local: "local.json"
 };
 function readIfPresent(name, dir2 = meshDir()) {
-  const p = join68(dir2, name);
+  const p = join69(dir2, name);
   try {
-    return existsSync33(p) ? new Uint8Array(readFileSync47(p)) : void 0;
+    return existsSync35(p) ? new Uint8Array(readFileSync48(p)) : void 0;
   } catch {
     return void 0;
   }
 }
 function migrateSingleMesh() {
-  const legacyGenesis = join68(meshDir(), FILES.genesis);
-  if (!existsSync33(legacyGenesis))
+  const legacyGenesis = join69(meshDir(), FILES.genesis);
+  if (!existsSync35(legacyGenesis))
     return null;
   const id = meshIdFromCert(readIfPresent(FILES.cert)) ?? LEGACY_MESH_ID;
   const dest = oneMeshDir(id);
   try {
-    mkdirSync36(dest, { recursive: true, mode: 448 });
+    mkdirSync37(dest, { recursive: true, mode: 448 });
     chmodSync5(dest, 448);
     for (const f of Object.values(FILES)) {
-      const from = join68(meshDir(), f);
-      if (existsSync33(from))
-        renameSync11(from, join68(dest, f));
+      const from = join69(meshDir(), f);
+      if (existsSync35(from))
+        renameSync11(from, join69(dest, f));
     }
-    const key2 = join68(dest, FILES.key);
-    if (existsSync33(key2))
+    const key2 = join69(dest, FILES.key);
+    if (existsSync35(key2))
       chmodSync5(key2, 384);
   } catch {
     return null;
@@ -110336,7 +110692,7 @@ function listMeshIds() {
   migrateSingleMesh();
   let names;
   try {
-    names = readdirSync12(meshesDir(), { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    names = readdirSync13(meshesDir(), { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return [];
   }
@@ -110348,15 +110704,15 @@ function listMeshIds() {
 }
 function readLocal(meshId) {
   try {
-    return JSON.parse(readFileSync47(join68(oneMeshDir(meshId), FILES.local), "utf8"));
+    return JSON.parse(readFileSync48(join69(oneMeshDir(meshId), FILES.local), "utf8"));
   } catch {
     return null;
   }
 }
 function writeLocal(meshId, state3) {
   try {
-    mkdirSync36(oneMeshDir(meshId), { recursive: true, mode: 448 });
-    writeFileSync35(join68(oneMeshDir(meshId), FILES.local), JSON.stringify(state3, null, 2), { mode: 384 });
+    mkdirSync37(oneMeshDir(meshId), { recursive: true, mode: 448 });
+    writeFileSync36(join69(oneMeshDir(meshId), FILES.local), JSON.stringify(state3, null, 2), { mode: 384 });
   } catch {
   }
 }
@@ -110389,8 +110745,8 @@ function loadMeshIdentity() {
   return first === void 0 ? null : loadMesh(first);
 }
 function writeSecret(name, bytes2, dir2 = meshDir()) {
-  const p = join68(dir2, name);
-  writeFileSync35(p, bytes2, { mode: 384 });
+  const p = join69(dir2, name);
+  writeFileSync36(p, bytes2, { mode: 384 });
   try {
     chmodSync5(p, 384);
   } catch {
@@ -110402,20 +110758,20 @@ function saveMeshIdentity(id) {
     saveMesh(meshId, id);
     return;
   }
-  mkdirSync36(meshDir(), { recursive: true, mode: 448 });
+  mkdirSync37(meshDir(), { recursive: true, mode: 448 });
   try {
     chmodSync5(meshDir(), 448);
   } catch {
   }
-  writeFileSync35(join68(meshDir(), FILES.genesis), id.genesis);
-  writeFileSync35(join68(meshDir(), FILES.cert), id.cert);
+  writeFileSync36(join69(meshDir(), FILES.genesis), id.genesis);
+  writeFileSync36(join69(meshDir(), FILES.cert), id.cert);
   writeSecret(FILES.key, id.staticPrivate);
   if (id.bundle)
-    writeFileSync35(join68(meshDir(), FILES.bundle), id.bundle);
+    writeFileSync36(join69(meshDir(), FILES.bundle), id.bundle);
 }
 function saveMesh(meshId, id) {
   const dir2 = oneMeshDir(meshId);
-  mkdirSync36(dir2, { recursive: true, mode: 448 });
+  mkdirSync37(dir2, { recursive: true, mode: 448 });
   try {
     chmodSync5(meshDir(), 448);
   } catch {
@@ -110428,13 +110784,13 @@ function saveMesh(meshId, id) {
     chmodSync5(dir2, 448);
   } catch {
   }
-  writeFileSync35(join68(dir2, FILES.genesis), id.genesis);
-  writeFileSync35(join68(dir2, FILES.cert), id.cert);
+  writeFileSync36(join69(dir2, FILES.genesis), id.genesis);
+  writeFileSync36(join69(dir2, FILES.cert), id.cert);
   writeSecret(FILES.key, id.staticPrivate, dir2);
   if (id.sigPrivate)
     writeSecret(FILES.sigKey, id.sigPrivate, dir2);
   if (id.bundle)
-    writeFileSync35(join68(dir2, FILES.bundle), id.bundle);
+    writeFileSync36(join69(dir2, FILES.bundle), id.bundle);
   if (readLocal(meshId) === null)
     writeLocal(meshId, { joinedAt: Date.now() });
 }
@@ -110444,13 +110800,13 @@ function removeMesh(meshId) {
 var STATUS_REFRESH_MS = 5e3;
 var STATUS_STALE_MS = 2e4;
 function statusPath(meshId) {
-  return meshId === void 0 ? join68(meshDir(), "status.json") : join68(oneMeshDir(meshId), "status.json");
+  return meshId === void 0 ? join69(meshDir(), "status.json") : join69(oneMeshDir(meshId), "status.json");
 }
 function writeStatus(status2, meshId) {
   try {
     const p = statusPath(meshId);
-    mkdirSync36(dirname31(p), { recursive: true, mode: 448 });
-    writeFileSync35(p, JSON.stringify({ ...status2, at: Date.now() }, null, 2));
+    mkdirSync37(dirname32(p), { recursive: true, mode: 448 });
+    writeFileSync36(p, JSON.stringify({ ...status2, at: Date.now() }, null, 2));
   } catch {
   }
 }
@@ -110462,7 +110818,7 @@ function clearStatus(meshId) {
 }
 function readStatus(meshId) {
   try {
-    const raw = JSON.parse(readFileSync47(statusPath(meshId), "utf8"));
+    const raw = JSON.parse(readFileSync48(statusPath(meshId), "utf8"));
     if (typeof raw.at !== "number")
       return null;
     return { ...raw, at: raw.at, stale: Date.now() - raw.at > STATUS_STALE_MS };
@@ -110474,8 +110830,8 @@ function cacheBundle(bundle, meshId) {
   try {
     const id = meshId ?? listMeshIds()[0];
     const dir2 = id === void 0 ? meshDir() : oneMeshDir(id);
-    mkdirSync36(dir2, { recursive: true, mode: 448 });
-    writeFileSync35(join68(dir2, FILES.bundle), bundle);
+    mkdirSync37(dir2, { recursive: true, mode: 448 });
+    writeFileSync36(join69(dir2, FILES.bundle), bundle);
   } catch {
   }
 }
@@ -110631,7 +110987,7 @@ function loadMeshCore() {
 }
 var meshCore = loadMeshCore();
 function meshEngineStatus() {
-  if (process.env.CCB_MESH_IN_DAEMON !== "1" && existsSync34(netdEndpoint())) {
+  if (process.env.CCB_MESH_IN_DAEMON !== "1" && netdListening()) {
     return { available: true, reason: null };
   }
   return { available: meshCore.available === true, reason: meshCore.loadError ?? null };
@@ -110861,7 +111217,14 @@ var MeshNode = class {
         reason: "this machine was removed from the network \u2014 ask an admin for a new invitation"
       };
     }
-    const inNetd = process.env.CCB_MESH_IN_DAEMON !== "1" && existsSync34(netdEndpoint());
+    const forcedInDaemon = process.env.CCB_MESH_IN_DAEMON === "1";
+    const inNetd = !forcedInDaemon && netdListening();
+    if (!inNetd && !forcedInDaemon) {
+      return {
+        ok: false,
+        reason: "the network helper is not running, so nothing can open the tunnel \u2014 install it with `tesseract-agent net helper install`"
+      };
+    }
     if (!inNetd && !meshCore.available) {
       return { ok: false, reason: `mesh engine unavailable: ${meshCore.loadError ?? "no prebuilt"}` };
     }
@@ -111066,7 +111429,7 @@ var MeshNode = class {
         this.#peers.set(hex6, staticPub);
       }
       engine.addPath(staticPub, `${address}:${port}`, false);
-      engine.startHandshake(staticPub, Date.now());
+      engine.ensureHandshake(staticPub, Date.now());
       this.#drain();
     } catch (e) {
       this.#lastError = e instanceof Error ? e.message : String(e);
@@ -111151,7 +111514,7 @@ var MeshNode = class {
             } catch {
             }
           }
-          engine.startHandshake(pk, Date.now());
+          engine.ensureHandshake(pk, Date.now());
           break;
         }
         case "mesh:gone": {
@@ -111295,7 +111658,7 @@ var MeshNode = class {
       for (const e of p.endpoints)
         engine.addPath(pk, `${p.observedIp}:${e.port}`, false);
     }
-    engine.startHandshake(pk, Date.now());
+    engine.ensureHandshake(pk, Date.now());
     const meshId = this.#engine?.meshId();
     try {
       if (meshId)
@@ -111610,7 +111973,7 @@ function startNodes(log9) {
 }
 
 // ../../packages/host-core/dist/drops/receive-ui.js
-import { basename as basename12, dirname as dirname32 } from "node:path";
+import { basename as basename12, dirname as dirname33 } from "node:path";
 var log5 = (...a) => console.log("[drops]", ...a);
 function formatBytes(n) {
   if (!Number.isFinite(n) || n <= 0)
@@ -111675,7 +112038,7 @@ function initDropReceiveUi(deps = {}) {
           log5("reveal failed:", err2 instanceof Error ? err2.message : String(err2));
         }
       };
-      const open7 = () => {
+      const open8 = () => {
         const el2 = electronModule();
         if (!el2)
           return;
@@ -111686,7 +112049,7 @@ function initDropReceiveUi(deps = {}) {
         title: "Files received",
         body: `${describe3(e)} \xB7 ${formatBytes(e.bytesDone)}`,
         actions: [{ id: "reveal", label: "Show in Finder" }, { id: "open", label: "Open" }],
-        onAction: (id) => id === "open" ? open7() : reveal(),
+        onAction: (id) => id === "open" ? open8() : reveal(),
         // Clicking the banner body is the only reliable action on macOS (buttons need
         // an expanded banner and are suppressed under Focus), so make it do the useful
         // thing rather than nothing.
@@ -111704,7 +112067,7 @@ import { basename as basename13 } from "node:path";
 // ../../packages/host-core/dist/drops/paths.js
 init_base_paths();
 import { mkdir as mkdir14 } from "node:fs/promises";
-import { join as join69 } from "node:path";
+import { join as join70 } from "node:path";
 
 // ../../packages/host-core/dist/drops/names.js
 var WINDOWS_RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i;
@@ -111793,7 +112156,7 @@ function basenameOf(p) {
 function resolveDropsRoot() {
   const root = resolveHostRoot();
   const preferred = dropsDir();
-  return isInsideRoot(preferred, root) ? preferred : join69(root, "Drops");
+  return isInsideRoot(preferred, root) ? preferred : join70(root, "Drops");
 }
 async function ensureDropsRoot() {
   const dir2 = resolveDropsRoot();
@@ -111809,7 +112172,7 @@ async function ensureDropDir(opts) {
     parts.push(sanitizeDropName(opts.sender, "Unknown sender"));
   if (!opts.singleItem && opts.label)
     parts.push(sanitizeDropName(opts.label, "Files"));
-  const dir2 = join69(...parts);
+  const dir2 = join70(...parts);
   await mkdir14(dir2, { recursive: true });
   return dir2;
 }
@@ -111952,7 +112315,7 @@ function createDropHandler(deps) {
 // ../../packages/host-core/dist/drops/blob-fetch.js
 import { createWriteStream as createWriteStream2 } from "node:fs";
 import { mkdir as mkdir15, rm as rm5, chmod as chmod3 } from "node:fs/promises";
-import { dirname as dirname33, join as join70 } from "node:path";
+import { dirname as dirname34, join as join71 } from "node:path";
 import { Readable as Readable2 } from "node:stream";
 import { pipeline } from "node:stream/promises";
 
@@ -112110,8 +112473,8 @@ async function fetchBlobDrop(opts) {
   if (opts.sealedKey) {
     if (!opts.sealingPrivate)
       throw new Error("This device has no sealing key, so it cannot open the transfer.");
-    const open7 = opts.openSeal ?? openFromPrivateKey;
-    contentKey = await open7(await opts.sealingPrivate(), opts.sealedKey, new TextEncoder().encode(opts.dropId));
+    const open8 = opts.openSeal ?? openFromPrivateKey;
+    contentKey = await open8(await opts.sealingPrivate(), opts.sealedKey, new TextEncoder().encode(opts.dropId));
   }
   const totalBytes = opts.items.reduce((n, i) => n + (i.kind === "file" ? i.size : 0), 0);
   let bytesDone = 0;
@@ -112124,7 +112487,7 @@ async function fetchBlobDrop(opts) {
         log7(`drop ${opts.dropId}: refusing directory "${item.rel}"`);
         continue;
       }
-      const abs = join70(opts.destDir, rel);
+      const abs = join71(opts.destDir, rel);
       if (!isInsideRoot(abs, opts.destDir)) {
         log7(`drop ${opts.dropId}: refusing directory outside the destination`);
         continue;
@@ -112145,12 +112508,12 @@ async function fetchBlobDrop(opts) {
         log7(`drop ${opts.dropId}: refusing "${item.rel}"`);
         continue;
       }
-      let abs = join70(opts.destDir, rel);
+      let abs = join71(opts.destDir, rel);
       if (!isInsideRoot(abs, opts.destDir)) {
         log7(`drop ${opts.dropId}: refusing a path outside the destination`);
         continue;
       }
-      await mkdir15(dirname33(abs), { recursive: true });
+      await mkdir15(dirname34(abs), { recursive: true });
       abs = await uniqueDropPath(abs);
       const res = await fetchFn(new URL(item.url, opts.apiOrigin).toString(), { signal: opts.signal });
       if (!res.ok || !res.body)
@@ -112182,7 +112545,7 @@ async function fetchBlobDrop(opts) {
 }
 
 // ../../packages/host-core/dist/chat-agent.js
-import { randomUUID as randomUUID28 } from "node:crypto";
+import { randomUUID as randomUUID29 } from "node:crypto";
 init_prompts();
 var TURN_TIMEOUT_MS = 4 * 6e4;
 var PARTIAL_INTERVAL_MS = 700;
@@ -112211,7 +112574,7 @@ function createChatAgentRunner(deps) {
   }
   async function runTurn(prompt2, onPartial) {
     const backend2 = await getSharedBackend();
-    const clientRequestId = `chat-agent-${randomUUID28()}`;
+    const clientRequestId = `chat-agent-${randomUUID29()}`;
     return new Promise((resolve16, reject) => {
       let text12 = "";
       let settled = false;
@@ -112420,13 +112783,13 @@ var RdeskServerChannel = class {
 };
 
 // ../../packages/host-core/dist/rdesk/channel-client.js
-import { readFileSync as readFileSync48 } from "node:fs";
-import { join as join71 } from "node:path";
+import { readFileSync as readFileSync49 } from "node:fs";
+import { join as join72 } from "node:path";
 var RECONNECT_MS = 2e3;
 var CLAIM_RETRY_MS = 5e3;
 function readEndpoint(dir2, selfPid) {
   try {
-    const s = JSON.parse(readFileSync48(join71(dir2, "status.json"), "utf8"));
+    const s = JSON.parse(readFileSync49(join72(dir2, "status.json"), "utf8"));
     if (selfPid && s.pid === selfPid)
       return null;
     return s.localPort && s.localToken ? `ws://127.0.0.1:${s.localPort}/?token=${s.localToken}` : null;
@@ -112871,10 +113234,10 @@ function registerRdpEngine() {
 // ../../packages/host-core/dist/rdesk/audit.js
 init_credentials();
 import { appendFile, stat as stat9, rename as rename4 } from "node:fs/promises";
-import { join as join72 } from "node:path";
+import { join as join73 } from "node:path";
 var MAX_BYTES2 = 2 * 1024 * 1024;
 function rdeskAuditPath() {
-  return join72(daemonDir2(), "rdesk-audit.jsonl");
+  return join73(daemonDir2(), "rdesk-audit.jsonl");
 }
 var queue = [];
 var draining = false;
@@ -112916,13 +113279,13 @@ function appendRdeskAudit(e) {
 
 // ../../packages/host-core/dist/fileprovider-bridge.js
 init_managed_spawn();
-import { writeFileSync as writeFileSync36, mkdirSync as mkdirSync37, rmSync as rmSync8, existsSync as existsSync35 } from "node:fs";
+import { writeFileSync as writeFileSync37, mkdirSync as mkdirSync38, rmSync as rmSync8, existsSync as existsSync36 } from "node:fs";
 import { homedir as homedir10 } from "node:os";
-import { join as join73 } from "node:path";
+import { join as join74 } from "node:path";
 init_safe_kill();
 var APPEX_BUNDLE_ID = "dev.tesseract.FileProvider";
 function appexBridgeInfoPath() {
-  return join73(homedir10(), "Library", "Containers", APPEX_BUNDLE_ID, "Data", "Library", "Application Support", "tesseract-bridge.json");
+  return join74(homedir10(), "Library", "Containers", APPEX_BUNDLE_ID, "Data", "Library", "Application Support", "tesseract-bridge.json");
 }
 function clearBridgeInfo() {
   if (process.platform !== "darwin")
@@ -113087,9 +113450,9 @@ function stopFileProviderBridge() {
 
 // ../../packages/host-core/dist/vault/autofill-bridge.js
 import { randomBytes as randomBytes9 } from "node:crypto";
-import { existsSync as existsSync36, mkdirSync as mkdirSync38, writeFileSync as writeFileSync37, rmSync as rmSync9 } from "node:fs";
+import { existsSync as existsSync37, mkdirSync as mkdirSync39, writeFileSync as writeFileSync38, rmSync as rmSync9 } from "node:fs";
 import { homedir as homedir11 } from "node:os";
-import { join as join74 } from "node:path";
+import { join as join75 } from "node:path";
 
 // ../../packages/host-core/dist/vault/peer-verify.js
 import { execFile as execFile9 } from "node:child_process";
@@ -113151,10 +113514,10 @@ async function isTrustedAutofillPeer(remotePort) {
 var APPEX_BUNDLE_ID2 = "dev.tesseract.AutoFill";
 var BRIDGE_PORTS2 = [17872, 17873, 17874, 17875];
 function appexContainerData() {
-  return join74(homedir11(), "Library", "Containers", APPEX_BUNDLE_ID2, "Data");
+  return join75(homedir11(), "Library", "Containers", APPEX_BUNDLE_ID2, "Data");
 }
 function bridgeInfoPath() {
-  return join74(appexContainerData(), "Library", "Application Support", "tesseract-autofill-bridge.json");
+  return join75(appexContainerData(), "Library", "Application Support", "tesseract-autofill-bridge.json");
 }
 var infoLoggedOnce = false;
 function writeBridgeInfo(port, token3, log9) {
@@ -113162,16 +113525,16 @@ function writeBridgeInfo(port, token3, log9) {
     return;
   const containerData = appexContainerData();
   try {
-    if (!existsSync36(containerData)) {
+    if (!existsSync37(containerData)) {
       if (!infoLoggedOnce) {
         infoLoggedOnce = true;
         log9("autofill bridge-info SKIP: no appex container yet at", containerData);
       }
       return;
     }
-    const dir2 = join74(containerData, "Library", "Application Support");
-    mkdirSync38(dir2, { recursive: true });
-    writeFileSync37(bridgeInfoPath(), JSON.stringify({ port, token: token3, pid: process.pid, ts: Date.now() }), { mode: 384 });
+    const dir2 = join75(containerData, "Library", "Application Support");
+    mkdirSync39(dir2, { recursive: true });
+    writeFileSync38(bridgeInfoPath(), JSON.stringify({ port, token: token3, pid: process.pid, ts: Date.now() }), { mode: 384 });
     if (!infoLoggedOnce) {
       infoLoggedOnce = true;
       log9("autofill bridge-info WROTE", port, "\u2192", dir2);
@@ -113411,9 +113774,9 @@ function createNodePowerController() {
 
 // ../../packages/host-core/dist/native-host.js
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { chmodSync as chmodSync6, existsSync as existsSync37, mkdirSync as mkdirSync39, writeFileSync as writeFileSync38 } from "node:fs";
+import { chmodSync as chmodSync6, existsSync as existsSync38, mkdirSync as mkdirSync40, writeFileSync as writeFileSync39 } from "node:fs";
 import { homedir as homedir12, platform as platform5 } from "node:os";
-import { dirname as dirname34, join as join75, resolve as resolve12 } from "node:path";
+import { dirname as dirname35, join as join76, resolve as resolve12 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 var HOST_NAME = "com.tesseract.companion";
 var EXTENSION_IDS = ["icpnghhpcmaonjckkpilpajblfehpplo", "giolfpookdhjfafcchaflhmigghaeffn"];
@@ -113422,41 +113785,41 @@ function browserProfileDirs() {
   const home = homedir12();
   const p = platform5();
   if (p === "darwin") {
-    const base = join75(home, "Library/Application Support");
-    return ["Google/Chrome", "Google/Chrome Beta", "Google/Chrome Dev", "Google/Chrome Canary", "Chromium", "Microsoft Edge", "BraveSoftware/Brave-Browser", "Vivaldi", "Arc"].map((b) => join75(base, b));
+    const base = join76(home, "Library/Application Support");
+    return ["Google/Chrome", "Google/Chrome Beta", "Google/Chrome Dev", "Google/Chrome Canary", "Chromium", "Microsoft Edge", "BraveSoftware/Brave-Browser", "Vivaldi", "Arc"].map((b) => join76(base, b));
   }
   if (p === "win32")
     return [];
-  const cfg2 = join75(home, ".config");
-  return ["google-chrome", "google-chrome-beta", "chromium", "microsoft-edge", "BraveSoftware/Brave-Browser", "vivaldi"].map((b) => join75(cfg2, b));
+  const cfg2 = join76(home, ".config");
+  return ["google-chrome", "google-chrome-beta", "chromium", "microsoft-edge", "BraveSoftware/Brave-Browser", "vivaldi"].map((b) => join76(cfg2, b));
 }
 function resolveBridge(log9) {
   const candidates = [
     process.env.CCB_COMPANION_HOST_JS,
-    process.resourcesPath ? join75(process.resourcesPath, "companion-host", BRIDGE_BASENAME) : void 0
+    process.resourcesPath ? join76(process.resourcesPath, "companion-host", BRIDGE_BASENAME) : void 0
   ];
   try {
-    const here = dirname34(fileURLToPath6(import.meta.url));
+    const here = dirname35(fileURLToPath6(import.meta.url));
     candidates.push(resolve12(here, "../../../apps/companion-host/dist", BRIDGE_BASENAME));
     candidates.push(resolve12(here, "../../apps/companion-host/dist", BRIDGE_BASENAME));
   } catch {
   }
   for (const c of candidates)
-    if (c && existsSync37(c))
+    if (c && existsSync38(c))
       return c;
   log9("companion native-host: bridge not found; skipping registration (looked in", candidates.filter(Boolean).join(" , "), ")");
   return null;
 }
 function writeLauncher(daemonDir3, bridge, runtime) {
   const isWin = platform5() === "win32";
-  const launcher = join75(daemonDir3, isWin ? "companion-host.cmd" : "companion-host.sh");
+  const launcher = join76(daemonDir3, isWin ? "companion-host.cmd" : "companion-host.sh");
   if (isWin) {
-    writeFileSync38(launcher, `@echo off\r
+    writeFileSync39(launcher, `@echo off\r
 set ELECTRON_RUN_AS_NODE=1\r
 "${runtime}" "${bridge}" %*\r
 `);
   } else {
-    writeFileSync38(launcher, `#!/bin/sh
+    writeFileSync39(launcher, `#!/bin/sh
 # Tesseract Companion native-messaging launcher (auto-written by the daemon).
 ELECTRON_RUN_AS_NODE=1 exec "${runtime}" "${bridge}" "$@"
 `);
@@ -113471,7 +113834,7 @@ function registerNativeHost(opts) {
     if (!bridge)
       return;
     const runtime = opts.runtime ?? process.execPath;
-    mkdirSync39(opts.daemonDir, { recursive: true });
+    mkdirSync40(opts.daemonDir, { recursive: true });
     const launcher = writeLauncher(opts.daemonDir, bridge, runtime);
     const manifestJson = JSON.stringify({
       name: HOST_NAME,
@@ -113484,12 +113847,12 @@ function registerNativeHost(opts) {
       return registerWindows(opts.daemonDir, manifestJson, log9);
     let wrote = 0;
     for (const profile of browserProfileDirs()) {
-      if (!existsSync37(profile))
+      if (!existsSync38(profile))
         continue;
       try {
-        const dir2 = join75(profile, "NativeMessagingHosts");
-        mkdirSync39(dir2, { recursive: true });
-        writeFileSync38(join75(dir2, `${HOST_NAME}.json`), manifestJson);
+        const dir2 = join76(profile, "NativeMessagingHosts");
+        mkdirSync40(dir2, { recursive: true });
+        writeFileSync39(join76(dir2, `${HOST_NAME}.json`), manifestJson);
         wrote++;
       } catch {
       }
@@ -113501,8 +113864,8 @@ function registerNativeHost(opts) {
 }
 function registerWindows(daemonDir3, manifestJson, log9) {
   try {
-    const manifestPath = join75(daemonDir3, `${HOST_NAME}.json`);
-    writeFileSync38(manifestPath, manifestJson);
+    const manifestPath = join76(daemonDir3, `${HOST_NAME}.json`);
+    writeFileSync39(manifestPath, manifestJson);
     for (const root of ["Software\\Google\\Chrome", "Software\\Microsoft\\Edge", "Software\\BraveSoftware\\Brave-Browser"]) {
       try {
         execFileSync4("reg", ["add", `HKCU\\${root}\\NativeMessagingHosts\\${HOST_NAME}`, "/ve", "/t", "REG_SZ", "/d", manifestPath, "/f"], { stdio: "ignore" });
@@ -113520,10 +113883,10 @@ init_daemon_settings();
 
 // ../../packages/host-core/dist/activity/activity-tracker.js
 init_credentials();
-import { promises as fsp, writeFileSync as writeFileSync39, mkdirSync as mkdirSync40, existsSync as existsSync38 } from "node:fs";
-import { join as join76 } from "node:path";
+import { promises as fsp, writeFileSync as writeFileSync40, mkdirSync as mkdirSync41, existsSync as existsSync39 } from "node:fs";
+import { join as join77 } from "node:path";
 function activityProfilePath() {
-  return join76(daemonDir2(), "activity-profile.json");
+  return join77(daemonDir2(), "activity-profile.json");
 }
 var MAX_APPS = 300;
 var MAX_AGE_DAYS = 120;
@@ -113598,7 +113961,7 @@ function createActivityTracker(opts = {}) {
         return;
       const key2 = front.bundleId || front.name;
       await ensureLoaded();
-      if (profile && Object.keys(profile.apps).length && !existsSync38(activityProfilePath())) {
+      if (profile && Object.keys(profile.apps).length && !existsSync39(activityProfilePath())) {
         log9("activity profile cleared externally \u2014 resetting in-memory");
         profile = { version: 1, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), apps: {} };
       }
@@ -113634,8 +113997,8 @@ function createActivityTracker(opts = {}) {
         if (profile) {
           pruneProfile(profile);
           profile.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-          mkdirSync40(daemonDir2(), { recursive: true, mode: 448 });
-          writeFileSync39(activityProfilePath(), JSON.stringify(profile), { mode: 384 });
+          mkdirSync41(daemonDir2(), { recursive: true, mode: 448 });
+          writeFileSync40(activityProfilePath(), JSON.stringify(profile), { mode: 384 });
           dirty = 0;
         }
       } catch (e) {
@@ -113690,7 +114053,7 @@ init_credentials();
 // ../../packages/host-core/dist/error-report.js
 init_dist2();
 init_credentials();
-import { randomUUID as randomUUID29 } from "node:crypto";
+import { randomUUID as randomUUID30 } from "node:crypto";
 import { release as osRelease, arch as osArch } from "node:os";
 var MAX_QUEUE = 100;
 var FLUSH_INTERVAL_MS = 3e4;
@@ -113742,7 +114105,7 @@ function captureDaemonError(error51, opts = {}) {
       return;
     const creds3 = readCredentials();
     const report = {
-      reportId: randomUUID29(),
+      reportId: randomUUID30(),
       occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
       schemaVersion: 1,
       surface,
@@ -113839,8 +114202,8 @@ async function runDaemon(opts = {}) {
   log9("paths", JSON.stringify(sealBasePaths()));
   const OUR_STARTED_AT = procStartedAt(process.pid);
   let ownsMachine = false;
-  const pidfile = () => join77(daemonDir2(), "daemon.lock");
-  const statusFile = () => join77(daemonDir2(), "status.json");
+  const pidfile = () => join78(daemonDir2(), "daemon.lock");
+  const statusFile = () => join78(daemonDir2(), "status.json");
   const isAlive2 = (pid) => {
     if (!Number.isFinite(pid) || pid <= 0)
       return false;
@@ -113853,7 +114216,7 @@ async function runDaemon(opts = {}) {
   };
   const lockHeldByAnother = () => {
     try {
-      const pid = Number(readFileSync49(pidfile(), "utf-8").trim());
+      const pid = Number(readFileSync50(pidfile(), "utf-8").trim());
       return Number.isFinite(pid) && pid > 0 && pid !== process.pid && isAlive2(pid);
     } catch {
       return false;
@@ -113861,7 +114224,7 @@ async function runDaemon(opts = {}) {
   };
   const lockHeldByYieldingSubset = () => {
     try {
-      const pid = Number(readFileSync49(pidfile(), "utf-8").trim());
+      const pid = Number(readFileSync50(pidfile(), "utf-8").trim());
       if (!Number.isFinite(pid) || pid <= 0 || pid === process.pid || !isAlive2(pid))
         return false;
       return liveDaemons().some((d) => d.pid === pid && d.rdeskOnly === true);
@@ -113872,22 +114235,22 @@ async function runDaemon(opts = {}) {
   function acquireLock2() {
     const f = pidfile();
     try {
-      if (!existsSync39(daemonDir2()))
-        mkdirSync41(daemonDir2(), { recursive: true, mode: 448 });
+      if (!existsSync40(daemonDir2()))
+        mkdirSync42(daemonDir2(), { recursive: true, mode: 448 });
     } catch {
     }
     for (let attempt = 0; attempt < 2; attempt++) {
       try {
-        writeFileSync40(f, String(process.pid), { flag: "wx" });
+        writeFileSync41(f, String(process.pid), { flag: "wx" });
         return true;
       } catch {
         try {
-          const prev = Number(readFileSync49(f, "utf-8").trim());
+          const prev = Number(readFileSync50(f, "utf-8").trim());
           if (!prev)
             return false;
           if (prev !== process.pid && isAlive2(prev))
             return false;
-          unlinkSync6(f);
+          unlinkSync7(f);
         } catch {
           return false;
         }
@@ -113898,8 +114261,8 @@ async function runDaemon(opts = {}) {
   function releaseLock() {
     try {
       const f = pidfile();
-      if (existsSync39(f) && Number(readFileSync49(f, "utf-8").trim()) === process.pid)
-        unlinkSync6(f);
+      if (existsSync40(f) && Number(readFileSync50(f, "utf-8").trim()) === process.pid)
+        unlinkSync7(f);
     } catch {
     }
   }
@@ -113908,7 +114271,7 @@ async function runDaemon(opts = {}) {
     if (!ownsMachine)
       return;
     try {
-      writeFileSync40(statusFile(), JSON.stringify({ pid: process.pid, startedAt: OUR_STARTED_AT, role: process.env.CCB_RDESK_ROLE ?? "host", version: VERSION3, execPath: process.env.CCB_DAEMON_EXECPATH ?? process.execPath, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), gui: daemonGuiTrayActive(), ...localInfo ?? {}, ...s }));
+      writeFileSync41(statusFile(), JSON.stringify({ pid: process.pid, startedAt: OUR_STARTED_AT, role: process.env.CCB_RDESK_ROLE ?? "host", version: VERSION3, execPath: process.env.CCB_DAEMON_EXECPATH ?? process.execPath, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), gui: daemonGuiTrayActive(), ...localInfo ?? {}, ...s }));
       chmodSync7(statusFile(), 384);
     } catch {
     }
@@ -113966,6 +114329,7 @@ async function runDaemon(opts = {}) {
       apiOrigin: apiOriginForMachine(),
       backendOrigin: backendOriginForMachine(),
       isAllowedOrigin: isAllowedApiOrigin,
+      deviceId: persistentDeviceId(),
       log: (msg) => log9(msg)
     });
     machine = m;
@@ -114417,6 +114781,7 @@ async function runDaemon(opts = {}) {
         apiOrigin: c.apiOrigin,
         backendOrigin: c.backendOrigin,
         isAllowedOrigin: isAllowedApiOrigin,
+        deviceId: persistentDeviceId(),
         log: (m) => log9(m)
       });
       if (!next?.accessToken) {
@@ -114443,7 +114808,7 @@ async function runDaemon(opts = {}) {
         if (r.status === 401) {
           log9("device token no longer valid \u2014 dropping to local-only on restart");
           try {
-            unlinkSync6(join77(daemonDir2(), "credentials.json"));
+            unlinkSync7(join78(daemonDir2(), "credentials.json"));
           } catch {
           }
           shutdown(0, "token-revoked-401");
@@ -114472,6 +114837,7 @@ async function runDaemon(opts = {}) {
       c = fresh;
       accessToken = fresh.accessToken;
       log9(`signed in as ${fresh.userId} \u2014 re-homing the control link to the account`);
+      setControlLinkDeviceId(fresh.deviceId);
       refreshControlLink();
       return;
     }
@@ -114479,6 +114845,7 @@ async function runDaemon(opts = {}) {
       apiOrigin: c.apiOrigin,
       backendOrigin: c.backendOrigin,
       isAllowedOrigin: isAllowedApiOrigin,
+      deviceId: persistentDeviceId(),
       log: (msg) => log9(msg)
     });
     if (!m?.accessToken) {
@@ -114489,6 +114856,7 @@ async function runDaemon(opts = {}) {
     c = { ...c, accessToken: m.accessToken, refreshSecret: "", dtid: "", userId: "", deviceId: m.deviceId, publicId: m.publicId, expiresAt: m.expiresAt ?? c.expiresAt };
     accessToken = m.accessToken;
     log9("signed out \u2014 this machine speaks for itself again");
+    setControlLinkDeviceId(m.deviceId);
     refreshControlLink();
   });
   registerTesseractEngine({ getIceServers: () => fetchIceServers() });
@@ -114741,7 +115109,7 @@ async function runDaemon(opts = {}) {
     let freeTicks = 0;
     const lockHolder = () => {
       try {
-        return Number(readFileSync49(pidfile(), "utf-8").trim()) || 0;
+        return Number(readFileSync50(pidfile(), "utf-8").trim()) || 0;
       } catch {
         return 0;
       }
@@ -114818,7 +115186,7 @@ async function runDaemon(opts = {}) {
     // open. getRdeskClientWebContents() is null for the SERVER / full-app daemon (no client
     // window) → those sends are no-ops, so this is inert outside the rdesk-client role.
     pushHosts: (hosts) => {
-      writeStatus2({ deviceId: c.deviceId, connected: true });
+      writeStatus2({ deviceId: c.deviceId, ownHostId: ownHost(), connected: true });
       getRdeskClientWebContents()?.send("hostlink:hosts", hosts);
     },
     ownHostResolved: (own2) => {
@@ -114950,7 +115318,7 @@ async function runDaemon(opts = {}) {
     if (appPid > 0 && appPid !== process.pid) {
       const quitMarker = () => {
         try {
-          return Number(readFileSync49(join77(daemonDir2(), "app-quit.marker"), "utf-8").trim()) || 0;
+          return Number(readFileSync50(join78(daemonDir2(), "app-quit.marker"), "utf-8").trim()) || 0;
         } catch {
           return 0;
         }
@@ -114975,7 +115343,7 @@ async function runDaemon(opts = {}) {
           log9(`desktop app (pid ${appPid}) is gone with NO clean-quit marker \u2014 reporting`);
           const tail3 = (name) => {
             try {
-              const buf = readFileSync49(join77(daemonDir2(), name), "utf-8");
+              const buf = readFileSync50(join78(daemonDir2(), name), "utf-8");
               return buf.length > 4096 ? buf.slice(-4096) : buf;
             } catch {
               return void 0;
@@ -115006,14 +115374,14 @@ async function runDaemon(opts = {}) {
   }
   try {
     const DAEMON_LOG_CAP = 2 * 1024 * 1024;
-    const daemonLogFile = join77(daemonDir2(), "daemon.log");
+    const daemonLogFile = join78(daemonDir2(), "daemon.log");
     const capTimer = setInterval(() => {
       try {
-        if (existsSync39(daemonLogFile) && statSync14(daemonLogFile).size > DAEMON_LOG_CAP) {
-          const buf = readFileSync49(daemonLogFile, "utf-8");
+        if (existsSync40(daemonLogFile) && statSync15(daemonLogFile).size > DAEMON_LOG_CAP) {
+          const buf = readFileSync50(daemonLogFile, "utf-8");
           const kept = `\u2026[daemon.log capped at ${(/* @__PURE__ */ new Date()).toISOString()}]\u2026
 ` + buf.slice(-DAEMON_LOG_CAP / 2);
-          writeFileSync40(daemonLogFile, kept);
+          writeFileSync41(daemonLogFile, kept);
         }
       } catch {
       }
@@ -115323,15 +115691,15 @@ init_credentials();
 
 // ../../packages/host-core/dist/net-service/ensure-installed.js
 import { execFile as execFile14 } from "node:child_process";
-import { existsSync as existsSync43 } from "node:fs";
-import { dirname as dirname36, join as join81 } from "node:path";
+import { existsSync as existsSync44 } from "node:fs";
+import { dirname as dirname37, join as join82 } from "node:path";
 import { promisify as promisify10 } from "node:util";
 
 // ../../packages/host-core/dist/net-service/launchd-system.js
 import { spawn as spawn9 } from "node:child_process";
-import { existsSync as existsSync40, mkdtempSync as mkdtempSync2, writeFileSync as writeFileSync41, rmSync as rmSync10, readFileSync as readFileSync50 } from "node:fs";
+import { existsSync as existsSync41, mkdtempSync as mkdtempSync2, writeFileSync as writeFileSync42, rmSync as rmSync10, readFileSync as readFileSync51 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
-import { join as join78 } from "node:path";
+import { join as join79 } from "node:path";
 
 // ../../packages/host-core/dist/net-service/owner-uid.js
 function installOwnerUid(env = process.env, self2 = typeof process.getuid === "function" ? process.getuid() : 0) {
@@ -115423,9 +115791,9 @@ ${args}
     <key>ProcessType</key>
     <string>Interactive</string>
     <key>StandardErrorPath</key>
-    <string>${xml(join78(spec.stateDir, "netd.log"))}</string>
+    <string>${xml(join79(spec.stateDir, "netd.log"))}</string>
     <key>StandardOutPath</key>
-    <string>${xml(join78(spec.stateDir, "netd.log"))}</string>
+    <string>${xml(join79(spec.stateDir, "netd.log"))}</string>
   </dict>
 </plist>
 `;
@@ -115438,10 +115806,10 @@ function runForCode(cmd, args) {
   });
 }
 async function elevate(script) {
-  const dir2 = mkdtempSync2(join78(tmpdir6(), "tesseract-netd-"));
-  const path6 = join78(dir2, "install.sh");
+  const dir2 = mkdtempSync2(join79(tmpdir6(), "tesseract-netd-"));
+  const path6 = join79(dir2, "install.sh");
   try {
-    writeFileSync41(path6, script, { mode: 384 });
+    writeFileSync42(path6, script, { mode: 384 });
     if (await alreadyElevated()) {
       return { code: await runForCode("/bin/sh", [path6]), declined: false };
     }
@@ -115500,9 +115868,9 @@ ${plist}TESSERACT_PLIST_EOF`,
       };
     },
     async state() {
-      if (!existsSync40(PLIST))
+      if (!existsSync41(PLIST))
         return { installed: false, running: false };
-      const owner = parseOwnerUid(readFileSync50(PLIST, "utf8"));
+      const owner = parseOwnerUid(readFileSync51(PLIST, "utf8"));
       const running2 = await netdAvailable();
       return {
         installed: true,
@@ -115520,7 +115888,7 @@ ${plist}TESSERACT_PLIST_EOF`,
 
 // ../../packages/host-core/dist/net-service/systemd-system.js
 import { spawn as spawn11 } from "node:child_process";
-import { existsSync as existsSync41, readFileSync as readFileSync51 } from "node:fs";
+import { existsSync as existsSync42, readFileSync as readFileSync52 } from "node:fs";
 
 // ../../packages/host-core/dist/service/exec.js
 import { execFile as execFile11, spawn as spawn10 } from "node:child_process";
@@ -115556,6 +115924,8 @@ async function elevated(script) {
 }
 var UNIT = "tesseract-netd.service";
 var UNIT_PATH = `/etc/systemd/system/${UNIT}`;
+var SYSTEM_EXEC_DIR = "/usr/local/libexec/tesseract-netd";
+var SYSTEM_EXEC = `${SYSTEM_EXEC_DIR}/tesseract-netd`;
 function unitVal(v) {
   return v.replace(/%/g, "%%");
 }
@@ -115627,8 +115997,12 @@ WantedBy=multi-user.target
 function buildInstallScript(spec) {
   return [
     `install -d -m 0700 ${sh2(spec.stateDir)}`,
+    // Copy the helper to the root-owned system path and run it from there — see SYSTEM_EXEC.
+    // BEFORE the unit is written and started, so the ExecStart it names already exists.
+    `install -d -m 0755 ${sh2(SYSTEM_EXEC_DIR)}`,
+    `install -m 0755 ${sh2(spec.exec)} ${sh2(SYSTEM_EXEC)}`,
     `cat > ${sh2(UNIT_PATH)} <<'TESSERACT_UNIT_EOF'
-${buildUnit(spec)}TESSERACT_UNIT_EOF`,
+${buildUnit({ ...spec, exec: SYSTEM_EXEC })}TESSERACT_UNIT_EOF`,
     "systemctl daemon-reload",
     `systemctl enable ${UNIT}`,
     // RESTART, not `enable --now`. `--now` only STARTS, so on a REINSTALL it leaves the
@@ -115657,15 +116031,19 @@ function makeSystemdSystem() {
       const script = [
         `systemctl disable --now ${UNIT} || true`,
         `rm -f ${sh2(UNIT_PATH)}`,
+        // The copied binary too — see SYSTEM_EXEC. Leaving a root-owned setuid-adjacent
+        // binary behind after an uninstall is exactly the kind of thing a security review
+        // flags, and it is ours to clean up.
+        `rm -rf ${sh2(SYSTEM_EXEC_DIR)}`,
         "systemctl daemon-reload"
       ].join("\n");
       const code = await elevated(script);
       return code === 0 ? { ok: true } : { ok: false, detail: `removing the helper failed (exit ${code})` };
     },
     async state() {
-      if (!existsSync41(UNIT_PATH))
+      if (!existsSync42(UNIT_PATH))
         return { installed: false, running: false };
-      const owner = parseOwnerUid(readFileSync51(UNIT_PATH, "utf8"));
+      const owner = parseOwnerUid(readFileSync52(UNIT_PATH, "utf8"));
       const active = await tryRun("systemctl", ["is-active", UNIT]);
       const running2 = active.stdout.trim() === "active";
       const own2 = owner === void 0 ? {} : { ownerUid: owner };
@@ -115690,9 +116068,9 @@ function sh2(s) {
 
 // ../../packages/host-core/dist/net-service/windows-service.js
 import { execFile as execFile12, spawn as spawn12 } from "node:child_process";
-import { mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync42, rmSync as rmSync11 } from "node:fs";
+import { mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync43, rmSync as rmSync11 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
-import { join as join79 } from "node:path";
+import { join as join80 } from "node:path";
 import { promisify as promisify8 } from "node:util";
 var run6 = promisify8(execFile12);
 var SERVICE = "TesseractNetd";
@@ -115720,9 +116098,9 @@ function buildBinaryPath(spec) {
   return parts.map((p) => `"${p}"`).join(" ");
 }
 async function elevatePowerShell(script) {
-  const dir2 = mkdtempSync3(join79(tmpdir7(), "tesseract-netd-"));
-  const inner = join79(dir2, "install.ps1");
-  writeFileSync42(inner, script, { encoding: "utf8" });
+  const dir2 = mkdtempSync3(join80(tmpdir7(), "tesseract-netd-"));
+  const inner = join80(dir2, "install.ps1");
+  writeFileSync43(inner, script, { encoding: "utf8" });
   if (await alreadyElevated()) {
     return new Promise((resolve16) => {
       const p = spawn12("powershell.exe", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", inner], { stdio: "inherit" });
@@ -115737,8 +116115,8 @@ async function elevatePowerShell(script) {
       p.on("close", (code) => finish(code ?? 1));
     });
   }
-  const outer = join79(dir2, "elevate.ps1");
-  writeFileSync42(outer, [
+  const outer = join80(dir2, "elevate.ps1");
+  writeFileSync43(outer, [
     '$ErrorActionPreference = "Stop"',
     "try {",
     `  $p = Start-Process -FilePath "powershell.exe" -ArgumentList @("-NoProfile","-ExecutionPolicy","Bypass","-File",${ps(inner)}) -Verb RunAs -Wait -PassThru`,
@@ -115926,15 +116304,15 @@ function makeNetService() {
 }
 
 // ../../packages/host-core/dist/net-service/netd-binary.js
-import { existsSync as existsSync42 } from "node:fs";
-import { dirname as dirname35, join as join80 } from "node:path";
+import { existsSync as existsSync43 } from "node:fs";
+import { dirname as dirname36, join as join81 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 function netdBinaryName() {
   return process.platform === "win32" ? "tesseract-netd.exe" : "tesseract-netd";
 }
 function override2() {
   const p = process.env.CCB_NETD_BIN;
-  return p && existsSync42(p) ? p : null;
+  return p && existsSync43(p) ? p : null;
 }
 function netdBinaryPath() {
   const fromEnv = override2();
@@ -115944,24 +116322,24 @@ function netdBinaryPath() {
   const candidates = [];
   const resources = process.resourcesPath;
   if (resources)
-    candidates.push(join80(resources, "netd", name));
+    candidates.push(join81(resources, "netd", name));
   try {
-    const here = dirname35(fileURLToPath7(import.meta.url));
-    candidates.push(join80(here, "..", "..", "netd", name));
-    candidates.push(join80(here, "..", "..", "..", "netd", name));
+    const here = dirname36(fileURLToPath7(import.meta.url));
+    candidates.push(join81(here, "..", "..", "netd", name));
+    candidates.push(join81(here, "..", "..", "..", "netd", name));
     const triple = `${process.platform}-${process.arch}`;
-    for (const root of [here, join80(here, ".."), join80(here, "..", "..")]) {
-      candidates.push(join80(root, "mesh-core", "prebuilds", triple, "netd", name));
+    for (const root of [here, join81(here, ".."), join81(here, "..", "..")]) {
+      candidates.push(join81(root, "mesh-core", "prebuilds", triple, "netd", name));
     }
   } catch {
   }
   if (process.env.CCB_REPO_ROOT) {
-    candidates.push(join80(process.env.CCB_REPO_ROOT, "crates", "target", "release", name));
+    candidates.push(join81(process.env.CCB_REPO_ROOT, "crates", "target", "release", name));
   }
-  candidates.push(join80(process.cwd(), "crates", "target", "release", name));
+  candidates.push(join81(process.cwd(), "crates", "target", "release", name));
   for (const c of candidates) {
     try {
-      if (existsSync42(c))
+      if (existsSync43(c))
         return c;
     } catch {
     }
@@ -116003,7 +116381,7 @@ async function ensureNetHelperInstalled() {
   if (st.installed && !mismatched)
     return { ok: true, already: true };
   const exec2 = netdBinaryPath();
-  if (exec2 && process.platform === "win32" && !existsSync43(join81(dirname36(exec2), "wintun.dll"))) {
+  if (exec2 && process.platform === "win32" && !existsSync44(join82(dirname37(exec2), "wintun.dll"))) {
     return {
       ok: false,
       reason: "no-binary",
@@ -116055,8 +116433,8 @@ import { platform as platform6 } from "node:os";
 
 // ../../packages/host-core/dist/service/launchd.js
 init_credentials();
-import { writeFileSync as writeFileSync43, existsSync as existsSync44, mkdirSync as mkdirSync42, unlinkSync as unlinkSync7 } from "node:fs";
-import { dirname as dirname37, join as join82 } from "node:path";
+import { writeFileSync as writeFileSync44, existsSync as existsSync45, mkdirSync as mkdirSync43, unlinkSync as unlinkSync8 } from "node:fs";
+import { dirname as dirname38, join as join83 } from "node:path";
 import { homedir as homedir13, userInfo as userInfo2 } from "node:os";
 function xml2(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
@@ -116064,10 +116442,10 @@ function xml2(s) {
 function makeLaunchd(instanceId) {
   const suffix = instanceSuffix(instanceId);
   const label = SERVICE_LABEL_BASE + (suffix ? `.${suffix}` : "");
-  const plistPath = () => join82(homedir13(), "Library", "LaunchAgents", `${label}.plist`);
+  const plistPath = () => join83(homedir13(), "Library", "LaunchAgents", `${label}.plist`);
   const domainTarget = () => `gui/${userInfo2().uid}`;
   const serviceTarget = () => `${domainTarget()}/${label}`;
-  const logFile = () => join82(daemonDir2(), "daemon.log");
+  const logFile = () => join83(daemonDir2(), "daemon.log");
   const workDirOf = (spec) => spec.workingDirectory ?? daemonDir2();
   function buildPlist2(spec) {
     const args = [spec.exec, ...spec.args].map((a) => `      <string>${xml2(a)}</string>`).join("\n");
@@ -116142,10 +116520,10 @@ ${env}
   };
   return {
     async install(spec) {
-      mkdirSync42(workDirOf(spec), { recursive: true });
-      mkdirSync42(dirname37(plistPath()), { recursive: true });
-      mkdirSync42(dirname37(spec.logPath), { recursive: true });
-      writeFileSync43(plistPath(), buildPlist2(spec));
+      mkdirSync43(workDirOf(spec), { recursive: true });
+      mkdirSync43(dirname38(plistPath()), { recursive: true });
+      mkdirSync43(dirname38(spec.logPath), { recursive: true });
+      writeFileSync44(plistPath(), buildPlist2(spec));
       await run5("launchctl", ["bootout", serviceTarget()]).catch(() => {
       });
       await untilGone();
@@ -116161,9 +116539,9 @@ ${env}
     async uninstall() {
       await run5("launchctl", ["bootout", serviceTarget()]).catch(() => {
       });
-      if (existsSync44(plistPath())) {
+      if (existsSync45(plistPath())) {
         try {
-          unlinkSync7(plistPath());
+          unlinkSync8(plistPath());
         } catch {
         }
       }
@@ -116172,7 +116550,7 @@ ${env}
       await this.install(spec);
     },
     async isInstalled() {
-      return existsSync44(plistPath());
+      return existsSync45(plistPath());
     },
     async start() {
       await run5("launchctl", ["bootstrap", domainTarget(), plistPath()]).catch(() => {
@@ -116189,7 +116567,7 @@ ${env}
     },
     async logs(follow) {
       const f = logFile();
-      if (!existsSync44(f)) {
+      if (!existsSync45(f)) {
         console.log(`No log yet at ${f} \u2014 has the service started?`);
         return;
       }
@@ -116200,8 +116578,8 @@ ${env}
 
 // ../../packages/host-core/dist/service/systemd.js
 init_credentials();
-import { writeFileSync as writeFileSync44, existsSync as existsSync45, mkdirSync as mkdirSync43, unlinkSync as unlinkSync8 } from "node:fs";
-import { dirname as dirname38, join as join83 } from "node:path";
+import { writeFileSync as writeFileSync45, existsSync as existsSync46, mkdirSync as mkdirSync44, unlinkSync as unlinkSync9 } from "node:fs";
+import { dirname as dirname39, join as join84 } from "node:path";
 import { homedir as homedir14, userInfo as userInfo3 } from "node:os";
 function unitVal2(v) {
   return v.replace(/%/g, "%%");
@@ -116213,8 +116591,8 @@ function makeSystemd(instanceId) {
   const suffix = instanceSuffix(instanceId);
   const unit = `tesseract-host${suffix ? `-${suffix}` : ""}.service`;
   const unitPath = () => {
-    const base = process.env.XDG_CONFIG_HOME || join83(homedir14(), ".config");
-    return join83(base, "systemd", "user", unit);
+    const base = process.env.XDG_CONFIG_HOME || join84(homedir14(), ".config");
+    return join84(base, "systemd", "user", unit);
   };
   const workDirOf = (spec) => spec.workingDirectory ?? daemonDir2();
   function buildUnit2(spec) {
@@ -116241,10 +116619,10 @@ WantedBy=default.target
   }
   return {
     async install(spec) {
-      mkdirSync43(workDirOf(spec), { recursive: true });
-      mkdirSync43(dirname38(unitPath()), { recursive: true });
-      mkdirSync43(dirname38(spec.logPath), { recursive: true });
-      writeFileSync44(unitPath(), buildUnit2(spec));
+      mkdirSync44(workDirOf(spec), { recursive: true });
+      mkdirSync44(dirname39(unitPath()), { recursive: true });
+      mkdirSync44(dirname39(spec.logPath), { recursive: true });
+      writeFileSync45(unitPath(), buildUnit2(spec));
       await run5("loginctl", ["enable-linger", userInfo3().username]).catch(() => {
       });
       await run5("systemctl", ["--user", "daemon-reload"]).catch(() => {
@@ -116256,9 +116634,9 @@ WantedBy=default.target
     async uninstall() {
       await run5("systemctl", ["--user", "disable", "--now", unit]).catch(() => {
       });
-      if (existsSync45(unitPath())) {
+      if (existsSync46(unitPath())) {
         try {
-          unlinkSync8(unitPath());
+          unlinkSync9(unitPath());
         } catch {
         }
       }
@@ -116269,7 +116647,7 @@ WantedBy=default.target
       await this.install(spec);
     },
     async isInstalled() {
-      return existsSync45(unitPath());
+      return existsSync46(unitPath());
     },
     async start() {
       await run5("systemctl", ["--user", "start", unit]);
@@ -116281,8 +116659,8 @@ WantedBy=default.target
       await runInherit("systemctl", ["--user", "status", unit, "--no-pager"]);
     },
     async logs(follow) {
-      const f = join83(daemonDir2(), "daemon.log");
-      if (existsSync45(f)) {
+      const f = join84(daemonDir2(), "daemon.log");
+      if (existsSync46(f)) {
         await runInherit("tail", follow ? ["-f", f] : ["-n", "200", f]);
         return;
       }
@@ -116294,12 +116672,12 @@ WantedBy=default.target
 
 // ../../packages/host-core/dist/service/windows.js
 init_credentials();
-import { writeFileSync as writeFileSync45, existsSync as existsSync46, mkdirSync as mkdirSync44, unlinkSync as unlinkSync9, readFileSync as readFileSync52 } from "node:fs";
-import { dirname as dirname39, join as join84 } from "node:path";
+import { writeFileSync as writeFileSync46, existsSync as existsSync47, mkdirSync as mkdirSync45, unlinkSync as unlinkSync10, readFileSync as readFileSync53 } from "node:fs";
+import { dirname as dirname40, join as join85 } from "node:path";
 function publishedDaemonPid(dir2) {
   for (const f of ["status.json", "daemon.lock"]) {
     try {
-      const raw = readFileSync52(join84(dir2, f), "utf-8");
+      const raw = readFileSync53(join85(dir2, f), "utf-8");
       const pid = f === "status.json" ? Number(JSON.parse(raw).pid) : Number(raw.trim());
       if (Number.isInteger(pid) && pid > 0)
         return pid;
@@ -116311,8 +116689,8 @@ function publishedDaemonPid(dir2) {
 function makeWindowsTask(instanceId) {
   const suffix = instanceSuffix(instanceId);
   const task = `Fineguide\\TesseractHost${suffix ? `-${suffix}` : ""}`;
-  const wrapperPath = () => join84(daemonDir2(), `run-host${suffix ? `-${suffix}` : ""}.cmd`);
-  const logFile = () => join84(daemonDir2(), "daemon.log");
+  const wrapperPath = () => join85(daemonDir2(), `run-host${suffix ? `-${suffix}` : ""}.cmd`);
+  const logFile = () => join85(daemonDir2(), "daemon.log");
   const oneLine2 = (s) => s.replace(/[\r\n]+/g, " ");
   const envVal = (v) => oneLine2(v).replace(/%/g, "%%").replace(/"/g, "");
   const cmdArg = (a) => `"${oneLine2(a).replace(/"/g, "")}"`;
@@ -116328,10 +116706,10 @@ start "" /b ${cmd} >> "${oneLine2(spec.logPath).replace(/"/g, "")}" 2>&1\r
   }
   return {
     async install(spec) {
-      mkdirSync44(spec.workingDirectory ?? daemonDir2(), { recursive: true });
-      mkdirSync44(dirname39(spec.logPath), { recursive: true });
-      mkdirSync44(dirname39(wrapperPath()), { recursive: true });
-      writeFileSync45(wrapperPath(), buildWrapper(spec));
+      mkdirSync45(spec.workingDirectory ?? daemonDir2(), { recursive: true });
+      mkdirSync45(dirname40(spec.logPath), { recursive: true });
+      mkdirSync45(dirname40(wrapperPath()), { recursive: true });
+      writeFileSync46(wrapperPath(), buildWrapper(spec));
       await run5("schtasks", ["/Create", "/TN", task, "/SC", "ONLOGON", "/RL", "LIMITED", "/F", "/TR", `"${wrapperPath()}"`]);
       await run5("schtasks", ["/Run", "/TN", task]).catch(() => {
       });
@@ -116339,9 +116717,9 @@ start "" /b ${cmd} >> "${oneLine2(spec.logPath).replace(/"/g, "")}" 2>&1\r
     async uninstall() {
       await run5("schtasks", ["/Delete", "/TN", task, "/F"]).catch(() => {
       });
-      if (existsSync46(wrapperPath())) {
+      if (existsSync47(wrapperPath())) {
         try {
-          unlinkSync9(wrapperPath());
+          unlinkSync10(wrapperPath());
         } catch {
         }
       }
@@ -116413,7 +116791,7 @@ start "" /b ${cmd} >> "${oneLine2(spec.logPath).replace(/"/g, "")}" 2>&1\r
     },
     async logs(follow) {
       const f = logFile();
-      if (!existsSync46(f)) {
+      if (!existsSync47(f)) {
         console.log(`No log yet at ${f} \u2014 has the task run?`);
         return;
       }
@@ -116444,9 +116822,9 @@ init_safe_kill();
 
 // src/auth.ts
 var import_qrcode_terminal = __toESM(require_main(), 1);
-import { randomUUID as randomUUID30 } from "node:crypto";
-import { existsSync as existsSync47, rmSync as rmSync12 } from "node:fs";
-import { join as join85 } from "node:path";
+import { randomUUID as randomUUID31 } from "node:crypto";
+import { existsSync as existsSync48, rmSync as rmSync12 } from "node:fs";
+import { join as join86 } from "node:path";
 
 // src/config.ts
 import { hostname as hostname6 } from "node:os";
@@ -116586,7 +116964,7 @@ async function login(opts) {
       process.exit(1);
     }
   }
-  const deviceId3 = readCredentials()?.deviceId ?? process.env.CCB_DEVICE_ID ?? randomUUID30().slice(0, 8);
+  const deviceId3 = readCredentials()?.deviceId ?? process.env.CCB_DEVICE_ID ?? randomUUID31().slice(0, 8);
   const label = opts.name ?? defaultLabel();
   if (opts.token) {
     const dt = await fetchJson(`${api}/auth/device-token`, {
@@ -116647,8 +117025,8 @@ async function logout() {
   }
   for (const f of ["credentials.json", "status.json", "daemon.lock"]) {
     try {
-      const p = join85(daemonDir2(), f);
-      if (existsSync47(p)) rmSync12(p);
+      const p = join86(daemonDir2(), f);
+      if (existsSync48(p)) rmSync12(p);
     } catch {
     }
   }
@@ -116806,9 +117184,9 @@ function startSelfUpdater(current) {
 }
 
 // src/service.ts
-import { join as join86 } from "node:path";
+import { join as join87 } from "node:path";
 import { platform as platform7 } from "node:os";
-import { existsSync as existsSync48, readFileSync as readFileSync53 } from "node:fs";
+import { existsSync as existsSync49, readFileSync as readFileSync54 } from "node:fs";
 function controller(instanceId) {
   const c = getServiceController(instanceId);
   if (!c) {
@@ -116821,7 +117199,7 @@ function buildSpec(cliEntry) {
     exec: process.execPath,
     args: [cliEntry, "run"],
     env: { CCB_DAEMON_DIR: daemonDir2() },
-    logPath: join86(daemonDir2(), "daemon.log")
+    logPath: join87(daemonDir2(), "daemon.log")
   };
 }
 var isAlive = (pid) => {
@@ -116833,10 +117211,10 @@ var isAlive = (pid) => {
   }
 };
 function runningDaemonInfo() {
-  const lock = join86(daemonDir2(), "daemon.lock");
+  const lock = join87(daemonDir2(), "daemon.lock");
   try {
-    if (!existsSync48(lock)) return null;
-    const pid = Number(readFileSync53(lock, "utf-8").trim());
+    if (!existsSync49(lock)) return null;
+    const pid = Number(readFileSync54(lock, "utf-8").trim());
     if (!pid || !isAlive(pid)) return null;
     return { pid, device: readCredentials()?.deviceId };
   } catch {
@@ -116870,7 +117248,7 @@ async function logs(instanceId, follow) {
 }
 
 // src/net.ts
-import { readFileSync as readFileSync55 } from "node:fs";
+import { readFileSync as readFileSync56 } from "node:fs";
 import { randomBytes as randomBytes11 } from "node:crypto";
 import { hostname as hostname7 } from "node:os";
 import { resolve as resolve14 } from "node:path";
@@ -116935,7 +117313,7 @@ function readOrDie(label, p) {
     process.exit(1);
   }
   try {
-    return new Uint8Array(readFileSync55(resolve14(p)));
+    return new Uint8Array(readFileSync56(resolve14(p)));
   } catch (e) {
     console.error(`net enroll: could not read --${label} ${p}: ${e instanceof Error ? e.message : e}`);
     process.exit(1);
@@ -117488,8 +117866,8 @@ async function netCommand(rest, flags) {
 // src/cli.ts
 function pkgVersion() {
   try {
-    const p = join88(dirname40(fileURLToPath8(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync56(p, "utf8")).version ?? "0.0.0";
+    const p = join89(dirname41(fileURLToPath8(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync57(p, "utf8")).version ?? "0.0.0";
   } catch {
     return "0.0.0";
   }
@@ -117717,7 +118095,7 @@ async function linkCommand(rest, flags) {
   process.exit(1);
 }
 async function captureClaudeSubscription(flags) {
-  const home = mkdtempSync4(join88(tmpdir8(), "tesseract-claude-login-"));
+  const home = mkdtempSync4(join89(tmpdir8(), "tesseract-claude-login-"));
   const binary = typeof flags["claude-path"] === "string" ? flags["claude-path"] : process.env.CCB_ENGINE_PATH_CLAUDE_CODE || "claude";
   const args = ["auth", "login", "--claudeai"];
   if (typeof flags.email === "string") args.push("--email", flags.email);
@@ -117734,8 +118112,8 @@ async function captureClaudeSubscription(flags) {
       child.once("close", (exitCode, signal) => resolveCode(signal ? 1 : exitCode ?? 1));
     });
     if (code !== 0) throw new Error(`Claude sign-in did not complete (exit ${code}).`);
-    const file2 = join88(home, ".credentials.json");
-    if (existsSync50(file2)) return readFileSync56(file2, "utf8");
+    const file2 = join89(home, ".credentials.json");
+    if (existsSync51(file2)) return readFileSync57(file2, "utf8");
     if (process.platform === "darwin") {
       const value = execFileSync6("security", [
         "find-generic-password",
@@ -117817,7 +118195,7 @@ async function runnerCommand(rest, flags) {
       process.exit(1);
     }
     const oauthFilePath = typeof flags["oauth-file"] === "string" ? resolve15(flags["oauth-file"]) : void 0;
-    const oauthAuthFile = oauthFilePath ? readFileSync56(oauthFilePath, "utf8") : void 0;
+    const oauthAuthFile = oauthFilePath ? readFileSync57(oauthFilePath, "utf8") : void 0;
     if (oauthAuthFile) {
       try {
         JSON.parse(oauthAuthFile);