tesseract-agent 0.11.22 → 0.11.23

package/dist-bundle/cli.js

@@ -20016,7 +20016,7 @@ var init_screen = __esm({
         vars: [],
         sensitive: true,
         content: `
-YOU CAN SEE AND CONTROL THIS MAC. You control the developer's ACTUAL macOS screen directly through the \`tesseract-computer\` tools, and you ALSO have your full Claude Code toolset (bash, files, editors, web, etc.). Use whichever fits: drive the screen for on-screen tasks, use your coding/file/shell tools for the rest, and combine them freely.
+YOU CAN SEE AND CONTROL THIS COMPUTER. You control the developer's ACTUAL screen directly through the \`tesseract-computer\` tools, and you ALSO have your full Claude Code toolset (bash, files, editors, web, etc.). Use whichever fits: drive the screen for on-screen tasks, use your coding/file/shell tools for the rest, and combine them freely.
 
 THE LOOP IS SEE \u2192 ACT \u2192 VERIFY:
 - Call \`see_screen\` to LOOK \u2014 it returns the current screen as an image. YOU read the image and decide where to act. Call it before acting on anything new, and AGAIN after acting to confirm what happened.
@@ -20028,7 +20028,7 @@ VERIFY & SELF-CORRECT AS YOU GO: after EVERY action, \`see_screen\` and check it
 
 READING TEXT ALOUD: when the developer asks you to READ something on the screen (an article, a message, an error, code, a field's value) \u2014 do NOT transcribe it from the picture, you will misread it. Call \`read_text\` with a short \`what\`, and when you can see the block, the region rectangle (x1,y1,x2,y2) around it \u2014 it pulls the EXACT text via accessibility. Then read that back. When it's spoken, keep it to the relevant part; if it's long, give the gist or ask how much of it to read.
 
-MORE HELPERS (prefer these over guessing or blind waits): \`read_ui\` lists the on-screen elements with their exact click coordinates \u2014 use it to act precisely on a busy/unfamiliar window. \`wait_for\` waits until something appears or disappears (page loaded, spinner gone) instead of a blind pause. \`get_clipboard\` / \`get_selection\` read the clipboard or whatever the developer has highlighted (use \`get_selection\` when they say "this"). \`open_url\` / \`open_path\` open a link or a file/folder directly (more reliable than navigating by hand). \`list_windows\` shows what's open and \`focus_window\` brings a specific one to the front. \`notify\` posts a macOS notification.
+MORE HELPERS (prefer these over guessing or blind waits): \`read_ui\` lists the on-screen elements with their exact click coordinates \u2014 use it to act precisely on a busy/unfamiliar window. \`wait_for\` waits until something appears or disappears (page loaded, spinner gone) instead of a blind pause. \`get_clipboard\` / \`get_selection\` read the clipboard or whatever the developer has highlighted (use \`get_selection\` when they say "this"). \`open_url\` / \`open_path\` open a link or a file/folder directly (more reliable than navigating by hand). \`list_windows\` shows what's open and \`focus_window\` brings a specific one to the front. \`notify\` posts a system notification.
 
 BE TRUTHFUL: never say something worked, opened, or is showing unless you JUST confirmed it with a fresh \`see_screen\`. A tool returning "done" only means the keystroke/click was sent \u2014 NOT that it had the effect you wanted.
 
@@ -20046,7 +20046,7 @@ WHEN YOUR REPLIES ARE READ ALOUD (voice): keep them SHORT and conversational \u2
         vars: [],
         content: `
 
-YOU ARE THE VOICE LAYER. You talk with the developer, understand what they want, and hand the actual DOING to a powerful agent (Claude Code) that fully controls this Mac \u2014 it takes high-res screenshots, uses the mouse/keyboard, the accessibility tree, processes, files, and every other tool. You do NOT operate the screen yourself.
+YOU ARE THE VOICE LAYER. You talk with the developer, understand what they want, and hand the actual DOING to a powerful agent (Claude Code) that fully controls this computer \u2014 it takes high-res screenshots, uses the mouse/keyboard, the accessibility tree, processes, files, and every other tool. You do NOT operate the screen yourself.
 
 You also see a LOW-RESOLUTION ~1 fps view of the screen, so you can follow along, describe what's happening, and confirm results in your own words \u2014 but it's just for awareness; never try to act on it.
 
@@ -27125,6 +27125,11 @@ function engineSearchDirs(opts) {
     const programFiles = env.ProgramFiles ?? "C:\\Program Files";
     const choco = env.ChocolateyInstall ?? "C:\\ProgramData\\chocolatey";
     return dedupe([
+      // The native installer's launcher dir (Claude Code's `install.ps1` writes %USERPROFILE%\.local\bin
+      // there, mirroring POSIX ~/.local/bin). Omitting it read a working native install as "not
+      // installed" in the picker/Settings while chat worked — and left it off the probe PATH preamble,
+      // since windowsPathPreamble derives its dirs from here.
+      j(home, ".local", "bin"),
       j(appData, "npm"),
       j(localAppData, "pnpm"),
       j(localAppData, "Volta", "bin"),
@@ -28603,7 +28608,24 @@ function parseNSFilenames(raw) {
 function parseUriList(raw) {
   return raw.split(/[\r\n]+/).map((l) => l.trim()).filter((l) => l.startsWith("file://")).map(decodeFileUrl);
 }
-function readFilePathsWith(read) {
+function parseCfHdrop(bytes3) {
+  if (bytes3.length < 20)
+    return [];
+  const dv = new DataView(bytes3.buffer, bytes3.byteOffset, bytes3.byteLength);
+  const pFiles = dv.getUint32(0, true);
+  if (pFiles >= bytes3.length)
+    return [];
+  const fWide = dv.getUint32(16, true) !== 0;
+  const body = new TextDecoder(fWide ? "utf-16le" : "latin1").decode(bytes3.subarray(pFiles));
+  const out = [];
+  for (const seg of body.split("\0")) {
+    if (!seg)
+      break;
+    out.push(seg);
+  }
+  return out;
+}
+function readFilePathsWith(read, readBuffer) {
   const tryRead = (format) => {
     try {
       return read(format) || "";
@@ -28626,6 +28648,17 @@ function readFilePathsWith(read) {
     if (p.length)
       return p;
   }
+  if (readBuffer) {
+    try {
+      const buf = readBuffer("CF_HDROP");
+      if (buf && buf.length) {
+        const p = parseCfHdrop(buf);
+        if (p.length)
+          return p;
+      }
+    } catch {
+    }
+  }
   return [];
 }
 var init_clipboard_files = __esm({
@@ -38653,11 +38686,11 @@ function inflightParamsOf(p) {
     clientRequestId: pick3("clientRequestId")
   };
 }
-function recordInflightTurn(sessionId, params, attempts = 0) {
+function recordInflightTurn(sessionId, params, attempts2 = 0) {
   try {
     const dir2 = inflightDir();
     mkdirSync8(dir2, { recursive: true });
-    const entry = { sessionId, startedAt: (/* @__PURE__ */ new Date()).toISOString(), attempts, params: inflightParamsOf({ ...params, sessionId }) };
+    const entry = { sessionId, startedAt: (/* @__PURE__ */ new Date()).toISOString(), attempts: attempts2, params: inflightParamsOf({ ...params, sessionId }) };
     const tmp = `${fileFor(sessionId)}.tmp`;
     writeFileSync6(tmp, JSON.stringify(entry), { mode: 384 });
     renameSync4(tmp, fileFor(sessionId));
@@ -39798,8 +39831,8 @@ async function anthropicMessage(args) {
 }
 async function anthropicCall(args) {
   const { env, model, system, content, maxTokens, timeoutMs, label } = args;
-  const attempts = Math.max(1, args.attempts ?? 1);
-  const budgetMs = args.budgetMs ?? attempts * timeoutMs + 4e3;
+  const attempts2 = Math.max(1, args.attempts ?? 1);
+  const budgetMs = args.budgetMs ?? attempts2 * timeoutMs + 4e3;
   const deadline = Date.now() + budgetMs;
   const base = { ...model ? { model } : {}, max_tokens: maxTokens, system, messages: [{ role: "user", content }] };
   const useSchema = !!args.schema && !schemaUnsupported.has(schemaKey(anthropicBaseUrl(env), model));
@@ -39808,7 +39841,7 @@ async function anthropicCall(args) {
   const headers = await anthropicHeaders(env);
   if (!headers)
     return { text: null, rateLimited: false };
-  for (let attempt = 0; attempt < attempts; attempt++) {
+  for (let attempt = 0; attempt < attempts2; attempt++) {
     const remaining = deadline - Date.now();
     if (remaining < 1e3) {
       log(`${label}: out of budget after ${attempt} attempt(s) \u2014 giving up rather than starting a leg that cannot finish.`);
@@ -39845,7 +39878,7 @@ async function anthropicCall(args) {
       }
       const rateLimited = res.status === 429 || res.status === 529;
       const modelRejected = (res.status === 400 || res.status === 403 || res.status === 404) && !!model;
-      if (rateLimited && attempt < attempts - 1) {
+      if (rateLimited && attempt < attempts2 - 1) {
         let stated = 0;
         try {
           stated = Number(res.headers?.get?.("retry-after")) * 1e3;
@@ -39861,7 +39894,7 @@ async function anthropicCall(args) {
       log(`${label}: HTTP ${res.status} (${model}) ${errBody.slice(0, 200)}`);
       return { text: null, rateLimited, modelRejected };
     } catch (err2) {
-      if (args.retryOnThrow && attempt < attempts - 1) {
+      if (args.retryOnThrow && attempt < attempts2 - 1) {
         const wait = Math.max(0, Math.min(800 * (attempt + 1) * (attempt + 1), deadline - Date.now()));
         log(`${label}: call failed (${err2 instanceof Error ? err2.message : String(err2)}) \u2014 retry ${attempt + 1} in ${wait}ms`);
         await new Promise((r) => setTimeout(r, wait));
@@ -39995,7 +40028,7 @@ function killProcessTree(child, signal2 = "SIGKILL") {
   const pid = child.pid;
   if (process.platform === "win32") {
     try {
-      spawn("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
+      spawn("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
     } catch {
     }
     return;
@@ -40480,7 +40513,7 @@ function findUserInstalledClaude(binName) {
     if (existsSync6(p))
       return p;
   try {
-    const out = execFileSync(process.platform === "win32" ? "where" : "which", [binName], { encoding: "utf8" }).split("\n")[0]?.trim();
+    const out = execFileSync(process.platform === "win32" ? "where" : "which", [binName], { encoding: "utf8", windowsHide: true }).split("\n")[0]?.trim();
     if (out && existsSync6(out))
       return out;
   } catch {
@@ -40497,17 +40530,21 @@ function resolvedClaudeCodePath() {
 function resolveClaudeCodeExecutable() {
   if (cachedClaudeExe)
     return cachedClaudeExe;
-  const binName = process.platform === "win32" ? "claude.exe" : "claude";
-  const user = findUserInstalledClaude(binName);
-  if (user)
-    return cachedClaudeExe = user;
+  const binNames = process.platform === "win32" ? ["claude.exe", "claude.cmd"] : ["claude"];
+  for (const name of binNames) {
+    const user = findUserInstalledClaude(name);
+    if (user)
+      return cachedClaudeExe = user;
+  }
   const resourcesPath = process.resourcesPath;
   if (resourcesPath) {
     const platKey = process.platform === "darwin" ? "mac" : process.platform === "win32" ? "win" : "linux";
     for (const dir2 of [`${platKey}-${process.arch}`, platKey]) {
-      const bundled = join19(resourcesPath, "claude-cli", dir2, binName);
-      if (existsSync6(bundled))
-        return cachedClaudeExe = bundled;
+      for (const name of binNames) {
+        const bundled = join19(resourcesPath, "claude-cli", dir2, name);
+        if (existsSync6(bundled))
+          return cachedClaudeExe = bundled;
+      }
     }
   }
   throw new Error("Claude Code isn\u2019t installed. Tesseract runs the agent framework you have installed rather than bundling one \u2014 install it with `curl -fsSL https://claude.ai/install.sh | bash` (Windows: `irm https://claude.ai/install.ps1 | iex`), or pick a different engine in Settings.");
@@ -40638,7 +40675,14 @@ function cliEffortLevels() {
     return cachedEfforts;
   cachedEfforts = null;
   try {
-    const help = execFileSync(resolveClaudeCodeExecutable(), ["--help"], { encoding: "utf8", timeout: 5e3, maxBuffer: 8 * 1024 * 1024 });
+    const claudeExe = resolveClaudeCodeExecutable();
+    const help = execFileSync(claudeExe, ["--help"], {
+      encoding: "utf8",
+      timeout: 5e3,
+      maxBuffer: 8 * 1024 * 1024,
+      windowsHide: true,
+      ...process.platform === "win32" && /\.(cmd|bat)$/i.test(claudeExe) ? { shell: true } : {}
+    });
     const line = help.split("\n").find((l) => l.includes("--effort"));
     const listed = line ? /\(([^)]*)\)/.exec(line) : null;
     const levels = listed?.[1].split(",").map((x) => x.trim()).filter(Boolean) ?? [];
@@ -40849,7 +40893,7 @@ function resolveNodeExecutable() {
       return cachedNodeExe = p;
   }
   try {
-    const found = execSync(process.platform === "win32" ? "where node" : "command -v node", { encoding: "utf8", timeout: 3e3 }).split(/\r?\n/)[0].trim();
+    const found = execSync(process.platform === "win32" ? "where node" : "command -v node", { encoding: "utf8", timeout: 3e3, windowsHide: true }).split(/\r?\n/)[0].trim();
     if (found && existsSync6(found))
       return cachedNodeExe = found;
   } catch {
@@ -45829,11 +45873,14 @@ ${prompt("agent.system.long-running")}`;
               };
               delete spawnEnv.CLAUDE_CODE_DISABLE_BACKGROUND_TASKS;
               live.endpointEnv = anthropicEnvOf(spawnEnv);
+              const winBatch = process.platform === "win32" && /\.(cmd|bat)$/i.test(options.command);
               const child = spawn2(options.command, options.args, {
                 cwd: options.cwd,
                 env: spawnEnv,
                 signal: options.signal,
                 stdio: ["pipe", "pipe", "pipe"],
+                windowsHide: true,
+                ...winBatch ? { shell: true } : {},
                 // Own process group (POSIX) so Stop can SIGKILL the WHOLE tree — the CLI's
                 // Bash tool spawns grandchildren (builds, dev servers, sleeps) that a
                 // single-PID kill would orphan. Pipes keep it attached; we never unref, so
@@ -49027,7 +49074,7 @@ function nodeExe() {
       }
       if (!cachedNodeExe2) {
         try {
-          const found = execSync2(process.platform === "win32" ? "where node" : "command -v node", { encoding: "utf8" }).split(/\r?\n/)[0].trim();
+          const found = execSync2(process.platform === "win32" ? "where node" : "command -v node", { encoding: "utf8", windowsHide: true }).split(/\r?\n/)[0].trim();
           if (found && existsSync9(found))
             cachedNodeExe2 = found;
         } catch {
@@ -49110,7 +49157,7 @@ function writeConfig(cfg2) {
 function ccr(args, timeout = 8e3) {
   const { exe, asNode } = nodeExe();
   return new Promise((resolve16) => {
-    execFile4(exe, [ccrCliPath(), ...args], { env: ccrEnv(asNode), timeout }, (err2, stdout, stderr) => {
+    execFile4(exe, [ccrCliPath(), ...args], { env: ccrEnv(asNode), timeout, windowsHide: true }, (err2, stdout, stderr) => {
       resolve16({ ok: !err2, out: `${stdout || ""}${stderr || ""}` });
     });
   });
@@ -49822,7 +49869,7 @@ function rememberedPath(engineId) {
 function which(bin, path6) {
   const tool2 = process.platform === "win32" ? "where" : "which";
   try {
-    const out = execFileSync2(tool2, [bin], { env: { ...process.env, PATH: path6 }, timeout: 4e3, encoding: "utf-8" });
+    const out = execFileSync2(tool2, [bin], { env: { ...process.env, PATH: path6 }, timeout: 4e3, encoding: "utf-8", windowsHide: true });
     return out.split(/\r?\n/).map((l) => l.trim()).find(Boolean) || void 0;
   } catch {
     return void 0;
@@ -85795,7 +85842,7 @@ var init_mesh_ca = __esm({
 init_base_paths();
 import { existsSync as existsSync61, mkdtempSync as mkdtempSync4, readFileSync as readFileSync70, rmSync as rmSync14 } from "node:fs";
 import { createHash as createHash12 } from "node:crypto";
-import { execFileSync as execFileSync9, spawn as spawn14 } from "node:child_process";
+import { execFileSync as execFileSync9, spawn as spawn16 } from "node:child_process";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 import { tmpdir as tmpdir8 } from "node:os";
 import { dirname as dirname47, join as join104, resolve as resolve15 } from "node:path";
@@ -96176,7 +96223,7 @@ function checkTrust(rootDir, trusted, relaxHardlink = false) {
   } catch {
     return "unreadable";
   }
-  if ((st.mode & 2) !== 0)
+  if (!isWindows && (st.mode & 2) !== 0)
     return "world-writable";
   if (!isWindows && typeof process.getuid === "function") {
     const uid = process.getuid();
@@ -97613,6 +97660,13 @@ function capture(command, args, opts = {}) {
     }
   });
 }
+async function loadLibnutWindowing() {
+  if (process.platform === "linux" && !process.env.DISPLAY)
+    return null;
+  const n = await loadLibnut();
+  const w = n;
+  return w && typeof w.getActiveWindow === "function" && typeof w.getWindowTitle === "function" && typeof w.focusWindow === "function" && typeof w.keyTap === "function" && typeof w.keyToggle === "function" ? w : null;
+}
 var libnutPromise;
 function loadLibnut() {
   if (libnutPromise)
@@ -97784,6 +97838,10 @@ function createDaemonOsControlRunner() {
       const p = n.getMousePos();
       return { x: p.x, y: p.y };
     },
+    // KNOWN LIMITATION (Windows): libnut-win32's typeString drives the ASCII keyboard-event path and
+    // CANNOT emit non-ASCII / Unicode characters (accents, CJK, emoji) — those come out wrong or empty.
+    // Plain ASCII typing is fine. A dedicated Unicode helper (SendInput with KEYEVENTF_UNICODE) is a
+    // separate rdesk task; until then typeString stays the text path. macOS/Linux type Unicode fine.
     async typeText(t) {
       const n = await nutOrThrow();
       n.typeString(t);
@@ -97797,8 +97855,20 @@ function createDaemonOsControlRunner() {
       n.keyTap(key2, modifiers);
       log3(`key ${combo}`);
     },
-    // App launch (the one non-input capability the voice path needs — shells `open`)
+    // App launch (the one non-input capability the voice path needs) — platform-correct launcher.
     async appLaunch(app) {
+      if (process.platform === "win32") {
+        const r2 = await capture("cmd", ["/c", "start", "", app], { timeoutMs: 1e4 });
+        if (r2.code !== 0)
+          throw new Error(r2.stderr.trim() || `Could not launch ${app}`);
+        return;
+      }
+      if (process.platform === "linux") {
+        const r2 = await capture("xdg-open", [app], { timeoutMs: 1e4 });
+        if (r2.code !== 0)
+          throw new Error(r2.stderr.trim() || `Could not launch ${app}`);
+        return;
+      }
       const r = await capture("open", [app.includes(".") ? "-b" : "-a", app], { timeoutMs: 1e4 });
       if (r.code !== 0)
         throw new Error(r.stderr.trim() || `Could not launch ${app}`);
@@ -102017,7 +102087,7 @@ function run2(bin, args, opts) {
     let timedOut = false;
     let child;
     try {
-      child = spawn7(bin, args, { cwd: opts?.cwd ?? mediaSpawnCwd(), stdio: ["ignore", "pipe", "pipe"] });
+      child = spawn7(bin, args, { cwd: opts?.cwd ?? mediaSpawnCwd(), stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
     } catch (e) {
       reject(e instanceof Error ? e : new Error(String(e)));
       return;
@@ -102427,7 +102497,7 @@ async function realesrganGpuWorks() {
       return false;
     }
     await new Promise((resolve16, reject) => {
-      const c = spawn8(re.bin, ["-i", inP, "-o", outP, "-n", model, "-s", "2", "-m", re.models, "-g", "0"], { cwd: upscaleSpawnCwd(), stdio: "ignore" });
+      const c = spawn8(re.bin, ["-i", inP, "-o", outP, "-n", model, "-s", "2", "-m", re.models, "-g", "0"], { cwd: upscaleSpawnCwd(), stdio: "ignore", windowsHide: true });
       const t = setTimeout(() => {
         killChild(c, "SIGKILL", "realesrgan GPU probe (timeout)");
         reject(new Error("probe timeout"));
@@ -104875,6 +104945,7 @@ function readRecord(buf, base, rel) {
 }
 async function windowsFavorites() {
   const script = [
+    `[Console]::OutputEncoding=[System.Text.Encoding]::UTF8`,
     `$ErrorActionPreference='SilentlyContinue'`,
     `$sh = New-Object -ComObject Shell.Application`,
     `$ns = $sh.Namespace('shell:::{679f85cb-0220-4080-b29b-5540cc05aab6}')`,
@@ -104882,10 +104953,10 @@ async function windowsFavorites() {
   ].join("; ");
   const encoded = Buffer.from(script, "utf16le").toString("base64");
   const stdout = await new Promise((resolve16) => {
-    const child = execFile5("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", encoded], { timeout: 4e3, windowsHide: true, maxBuffer: 1 << 20 }, (err2, out) => resolve16(err2 ? "" : out));
+    const child = execFile5("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", encoded], { timeout: 4e3, windowsHide: true, maxBuffer: 1 << 20, encoding: "utf8" }, (err2, out) => resolve16(err2 ? "" : out));
     child.on("error", () => resolve16(""));
   });
-  const items = stdout.split(/\r?\n/).map((line) => {
+  const items = stdout.replace(/^/, "").split(/\r?\n/).map((line) => {
     const tab = line.indexOf("	");
     if (tab < 0)
       return null;
@@ -105397,10 +105468,19 @@ async function runRemoteFsOp(root, op2, args, quotaKey) {
             id = statId(join56(real, e.name));
           } catch {
           }
+          let isDir = e.isDirectory();
+          if (e.isSymbolicLink()) {
+            const resolved = safeContentPath(join56(real, e.name));
+            try {
+              isDir = resolved != null && statSync16(resolved).isDirectory();
+            } catch {
+              isDir = false;
+            }
+          }
           return {
             name: e.name,
             path: join56(dir2, e.name),
-            isDir: e.isDirectory(),
+            isDir,
             ignored: ignored.has(e.name),
             size: id?.size,
             mtimeMs: id?.mtimeMs,
@@ -105476,13 +105556,35 @@ async function runRemoteFsOp(root, op2, args, quotaKey) {
         return OUTSIDE("write");
       const off = Math.max(0, Math.floor(Number(a[1]) || 0));
       const buf = Buffer.from(String(a[2] ?? ""), "base64");
+      if (off === 0) {
+        const tmp = join56(dirname22(real), `.${basename8(real)}.tesseract-upload-${process.pid}-${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`);
+        let fd2 = null;
+        try {
+          await mkdir10(dirname22(real), { recursive: true });
+          fd2 = openSync7(tmp, "w");
+          if (buf.length > 0)
+            writeSync2(fd2, buf, 0, buf.length, 0);
+          closeSync7(fd2);
+          fd2 = null;
+          await renameAsync(tmp, real);
+          return { ok: true, bytesWritten: buf.length };
+        } catch (err2) {
+          return { ok: false, error: String(err2.message) };
+        } finally {
+          if (fd2 != null)
+            try {
+              closeSync7(fd2);
+            } catch {
+            }
+          try {
+            rmSync6(tmp, { force: true });
+          } catch {
+          }
+        }
+      }
       let fd = null;
       try {
-        if (off === 0) {
-          await mkdir10(dirname22(real), { recursive: true });
-          fd = openSync7(real, "w");
-        } else
-          fd = openSync7(real, "r+");
+        fd = openSync7(real, "r+");
         if (buf.length > 0)
           writeSync2(fd, buf, 0, buf.length, off);
         return { ok: true, bytesWritten: buf.length };
@@ -105607,8 +105709,16 @@ async function runRemoteFsOp(root, op2, args, quotaKey) {
       if (!insideOk(oldPath))
         return OUTSIDE("rename");
       const newPath = join56(dirname22(oldPath), newName);
-      if (existsSync24(newPath))
-        return { ok: false, error: `A file named "${newName}" already exists.` };
+      const caseOnlyRename = newPath.toLowerCase() === oldPath.toLowerCase() && newPath !== oldPath;
+      if (!caseOnlyRename && existsSync24(newPath)) {
+        let targetIsDir = false;
+        try {
+          targetIsDir = statSync16(newPath).isDirectory();
+        } catch {
+        }
+        if (targetIsDir)
+          return { ok: false, error: `A folder named "${newName}" already exists.` };
+      }
       try {
         await renameAsync(oldPath, newPath);
         return { ok: true, newPath };
@@ -105700,22 +105810,38 @@ async function runRemoteFsOp(root, op2, args, quotaKey) {
     case "movePaths": {
       const srcPaths = Array.isArray(a[0]) ? a[0] : [];
       const destDir = String(a[1] ?? "");
+      const destNamesArg = a[2];
+      const destNames = Array.isArray(destNamesArg) ? destNamesArg.map((n) => typeof n === "string" && validName(n) ? n : void 0) : typeof destNamesArg === "string" && validName(destNamesArg) ? [destNamesArg] : [];
       if (!insideOk(destDir))
         return OUTSIDE(op2 === "copyPaths" ? "copy" : "move");
       try {
         const newPaths = [];
-        for (const src of srcPaths) {
+        for (let i = 0; i < srcPaths.length; i++) {
+          const src = srcPaths[i];
           if (typeof src !== "string" || !src)
             continue;
           if (!insideOk(src))
             return OUTSIDE(op2 === "copyPaths" ? "copy from" : "move from");
-          if (op2 === "movePaths" && dirname22(src) === destDir) {
+          const wantName = destNames[i];
+          if (op2 === "movePaths" && !wantName && dirname22(src) === destDir) {
             newPaths.push(src);
             continue;
           }
-          const target = resolveUniqueName(destDir, basename8(src));
+          let target;
+          if (wantName) {
+            target = join56(destDir, wantName);
+            let targetIsDir = false;
+            try {
+              targetIsDir = statSync16(target).isDirectory();
+            } catch {
+            }
+            if (targetIsDir)
+              return { ok: false, error: `A folder named "${wantName}" already exists.` };
+          } else {
+            target = resolveUniqueName(destDir, basename8(src));
+          }
           if (op2 === "copyPaths")
-            await cp(src, target, { recursive: true, errorOnExist: false, force: false });
+            await cp(src, target, { recursive: true, errorOnExist: false, force: !!wantName });
           else
             await moveItem(src, target);
           newPaths.push(target);
@@ -106914,17 +107040,17 @@ var PeerLinkManager = class {
       }
       return this.awaitInbound(token4, msg.peerHostId);
     }
-    const attempts = [
+    const attempts2 = [
       dialLadder({ peerHostId: msg.peerHostId, candidates: msg.peerCandidates, peerFingerprint256: msg.peerTlsFingerprint256, token: token4 })
     ];
     if (quicOn)
       for (const u of udp)
-        attempts.push(this.quicDial(msg, token4, u));
-    dbg(`[peer-link] handleGo dial: racing ${attempts.length} rung(s) (TCP${quicOn ? " + QUIC" : ""}) to ${msg.peerHostId}`);
+        attempts2.push(this.quicDial(msg, token4, u));
+    dbg(`[peer-link] handleGo dial: racing ${attempts2.length} rung(s) (TCP${quicOn ? " + QUIC" : ""}) to ${msg.peerHostId}`);
     return new Promise((resolve16, reject) => {
       let done = false, failed = 0;
       const errs = [];
-      for (const p of attempts) {
+      for (const p of attempts2) {
         p.then((l) => {
           if (done) {
             try {
@@ -106940,7 +107066,7 @@ var PeerLinkManager = class {
         }, (e) => {
           errs.push(e);
           console.warn(`[peer-link] dial rung failed: ${e.message}`);
-          if (++failed === attempts.length && !done)
+          if (++failed === attempts2.length && !done)
             reject(new Error(`peer-link: no rung connected (${errs.map((x) => x.message).join("; ")})`));
         });
       }
@@ -110633,6 +110759,7 @@ function routeInboundLinkFrame(frame) {
 init_dist5();
 
 // ../../packages/host-core/dist/pty-manager.js
+import { spawn as spawn9 } from "node:child_process";
 import { existsSync as existsSync31 } from "node:fs";
 import { homedir as homedir11 } from "node:os";
 init_safe_kill();
@@ -110668,6 +110795,24 @@ function flush(ptyId, s, sink3) {
   s.bytes = 0;
   sink3.output(ptyId, Buffer.from(joined, "utf8").toString("base64"));
 }
+function killPtyProc(proc, signal2, label) {
+  if (process.platform !== "win32") {
+    killChild(proc, signal2, label);
+    return;
+  }
+  const pid = proc.pid;
+  if (typeof pid !== "number" || pid <= 0)
+    return;
+  try {
+    proc.kill();
+  } catch {
+  }
+  try {
+    spawn9("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true }).on("error", () => {
+    });
+  } catch {
+  }
+}
 async function openPty(opts, sink3) {
   const pty = await loadPty();
   if (!pty)
@@ -110736,7 +110881,7 @@ function killPty(ptyId, signal2, clientId) {
     clearTimeout(s.timer);
     s.timer = null;
   }
-  killChild(s.proc, signal2, "pty session");
+  killPtyProc(s.proc, signal2, "pty session");
 }
 function releaseClientPtys(clientId) {
   for (const [k, s] of [...sessions2]) {
@@ -110746,7 +110891,7 @@ function releaseClientPtys(clientId) {
       clearTimeout(s.timer);
       s.timer = null;
     }
-    killChild(s.proc, "SIGTERM", "pty session");
+    killPtyProc(s.proc, "SIGTERM", "pty session");
     sessions2.delete(k);
   }
 }
@@ -110758,7 +110903,7 @@ function releaseRemotePtys() {
       clearTimeout(s.timer);
       s.timer = null;
     }
-    killChild(s.proc, "SIGTERM", "pty session");
+    killPtyProc(s.proc, "SIGTERM", "pty session");
     sessions2.delete(k);
   }
 }
@@ -113855,12 +114000,40 @@ function displayBoundsById(monitorId) {
   const d = el2.screen.getAllDisplays().find((x) => String(x.id) === monitorId) ?? el2.screen.getPrimaryDisplay();
   return d ? { x: d.bounds.x, y: d.bounds.y, width: d.bounds.width, height: d.bounds.height } : null;
 }
+function virtualDesktopFraction(globalDip) {
+  const el2 = electronModule();
+  const scr = el2?.screen;
+  if (!scr)
+    return { fx: 0, fy: 0 };
+  const toPhys = (p) => typeof scr.dipToScreenPoint === "function" ? scr.dipToScreenPoint(p) : p;
+  const displays = scr.getAllDisplays();
+  if (!displays.length)
+    return { fx: 0, fy: 0 };
+  let minX = Infinity, minY = Infinity, maxX = -Infinity, maxY = -Infinity;
+  for (const d of displays) {
+    const tl = toPhys({ x: d.bounds.x, y: d.bounds.y });
+    const pw = Math.round(d.bounds.width * (d.scaleFactor || 1));
+    const ph = Math.round(d.bounds.height * (d.scaleFactor || 1));
+    if (tl.x < minX)
+      minX = tl.x;
+    if (tl.y < minY)
+      minY = tl.y;
+    if (tl.x + pw > maxX)
+      maxX = tl.x + pw;
+    if (tl.y + ph > maxY)
+      maxY = tl.y + ph;
+  }
+  const vw = Math.max(1, maxX - minX), vh = Math.max(1, maxY - minY);
+  const phys = toPhys(globalDip);
+  const clamp5 = (n) => n < 0 ? 0 : n > 1 ? 1 : n;
+  return { fx: clamp5((phys.x - minX) / vw), fy: clamp5((phys.y - minY) / vh) };
+}
 async function wakeDisplay(log10) {
   if (process.platform !== "darwin")
     return;
   try {
-    const { spawn: spawn15 } = await import("node:child_process");
-    spawn15("caffeinate", ["-u", "-t", "5"], { detached: true, stdio: "ignore" }).unref();
+    const { spawn: spawn17 } = await import("node:child_process");
+    spawn17("caffeinate", ["-u", "-t", "5"], { detached: true, stdio: "ignore" }).unref();
     log10?.("display was asleep \u2014 declared user activity to wake it");
     await new Promise((r) => setTimeout(r, 1200));
   } catch {
@@ -114083,8 +114256,397 @@ var PublisherWindow = class {
   }
 };
 
+// ../../packages/host-core/dist/rdesk/win-input.js
+import { spawn as spawn10 } from "node:child_process";
+function vkForCode(code, key2) {
+  if (code) {
+    if (code.length === 4 && code.startsWith("Key")) {
+      const c = code.charCodeAt(3);
+      if (c >= 65 && c <= 90)
+        return c;
+    }
+    if (code.length === 6 && code.startsWith("Digit")) {
+      const c = code.charCodeAt(5);
+      if (c >= 48 && c <= 57)
+        return c;
+    }
+    if (code.startsWith("Numpad")) {
+      const n = NUMPAD[code];
+      if (n !== void 0)
+        return n;
+    }
+    if (code.length >= 2 && code[0] === "F") {
+      const n = Number(code.slice(1));
+      if (Number.isInteger(n) && n >= 1 && n <= 24)
+        return 112 + (n - 1);
+    }
+    const mapped = CODE_VK[code];
+    if (mapped !== void 0)
+      return mapped;
+  }
+  const named = KEY_VK[key2];
+  if (named !== void 0)
+    return named;
+  if (key2.length === 1) {
+    const c = key2.toUpperCase().charCodeAt(0);
+    if (c >= 65 && c <= 90 || c >= 48 && c <= 57)
+      return c;
+  }
+  return 0;
+}
+var NUMPAD = {
+  Numpad0: 96,
+  Numpad1: 97,
+  Numpad2: 98,
+  Numpad3: 99,
+  Numpad4: 100,
+  Numpad5: 101,
+  Numpad6: 102,
+  Numpad7: 103,
+  Numpad8: 104,
+  Numpad9: 105,
+  NumpadMultiply: 106,
+  NumpadAdd: 107,
+  NumpadSubtract: 109,
+  NumpadDecimal: 110,
+  NumpadDivide: 111,
+  NumpadEnter: 13
+};
+var CODE_VK = {
+  // Modifiers (L/R specific so a chord releases the exact key it pressed).
+  ShiftLeft: 160,
+  ShiftRight: 161,
+  ControlLeft: 162,
+  ControlRight: 163,
+  AltLeft: 164,
+  AltRight: 165,
+  MetaLeft: 91,
+  MetaRight: 92,
+  // Editing / whitespace.
+  Enter: 13,
+  Escape: 27,
+  Tab: 9,
+  Backspace: 8,
+  Space: 32,
+  CapsLock: 20,
+  // Navigation (extended keys — the helper flags them EXTENDEDKEY).
+  ArrowUp: 38,
+  ArrowDown: 40,
+  ArrowLeft: 37,
+  ArrowRight: 39,
+  Home: 36,
+  End: 35,
+  PageUp: 33,
+  PageDown: 34,
+  Insert: 45,
+  Delete: 46,
+  // US-position punctuation (host layout re-interprets; text still rides typeUnicode).
+  Backquote: 192,
+  Minus: 189,
+  Equal: 187,
+  BracketLeft: 219,
+  BracketRight: 221,
+  Backslash: 220,
+  Semicolon: 186,
+  Quote: 222,
+  Comma: 188,
+  Period: 190,
+  Slash: 191,
+  PrintScreen: 44,
+  ScrollLock: 145,
+  Pause: 19,
+  ContextMenu: 93
+};
+var KEY_VK = {
+  Shift: 16,
+  Control: 17,
+  Alt: 18,
+  Meta: 91,
+  Enter: 13,
+  Escape: 27,
+  Tab: 9,
+  Backspace: 8,
+  Delete: 46,
+  " ": 32,
+  ArrowUp: 38,
+  ArrowDown: 40,
+  ArrowLeft: 37,
+  ArrowRight: 39,
+  Home: 36,
+  End: 35,
+  PageUp: 33,
+  PageDown: 34,
+  Insert: 45
+};
+var BTN_CODE = { L: "L", R: "R", M: "M", X1: "1", X2: "2" };
+var CSHARP = `
+using System;
+using System.Runtime.InteropServices;
+using System.Globalization;
+namespace Tess {
+  public static class Input {
+    [StructLayout(LayoutKind.Sequential)] struct MOUSEINPUT { public int dx; public int dy; public uint mouseData; public uint dwFlags; public uint time; public IntPtr dwExtraInfo; }
+    [StructLayout(LayoutKind.Sequential)] struct KEYBDINPUT { public ushort wVk; public ushort wScan; public uint dwFlags; public uint time; public IntPtr dwExtraInfo; }
+    [StructLayout(LayoutKind.Explicit)] struct INPUTUNION { [FieldOffset(0)] public MOUSEINPUT mi; [FieldOffset(0)] public KEYBDINPUT ki; }
+    [StructLayout(LayoutKind.Sequential)] struct INPUT { public uint type; public INPUTUNION u; }
+    [DllImport("user32.dll", SetLastError=true)] static extern uint SendInput(uint nInputs, INPUT[] pInputs, int cbSize);
+    [DllImport("user32.dll")] static extern int GetSystemMetrics(int nIndex);
+    [DllImport("user32.dll")] static extern IntPtr SetProcessDpiAwarenessContext(IntPtr value);
+
+    const uint INPUT_MOUSE=0, INPUT_KEYBOARD=1;
+    const uint MOVE=0x0001, ABSOLUTE=0x8000, VIRTUALDESK=0x4000;
+    const uint LEFTDOWN=0x0002, LEFTUP=0x0004, RIGHTDOWN=0x0008, RIGHTUP=0x0010, MIDDLEDOWN=0x0020, MIDDLEUP=0x0040, XDOWN=0x0080, XUP=0x0100, WHEEL=0x0800, HWHEEL=0x1000;
+    const uint KEYUP=0x0002, UNICODE=0x0004, EXTENDED=0x0001;
+    const uint XBUTTON1=0x0001, XBUTTON2=0x0002;
+    const int SM_XVIRTUALSCREEN=76, SM_YVIRTUALSCREEN=77, SM_CXVIRTUALSCREEN=78, SM_CYVIRTUALSCREEN=79;
+    static readonly CultureInfo CI = CultureInfo.InvariantCulture;
+
+    static void Send(INPUT[] a){ SendInput((uint)a.Length, a, Marshal.SizeOf(typeof(INPUT))); }
+    static INPUT Mouse(uint flags, int dx, int dy, uint data){ INPUT i=new INPUT(); i.type=INPUT_MOUSE; i.u.mi.dx=dx; i.u.mi.dy=dy; i.u.mi.mouseData=data; i.u.mi.dwFlags=flags; return i; }
+    static INPUT Kbd(ushort vk, ushort scan, uint flags){ INPUT i=new INPUT(); i.type=INPUT_KEYBOARD; i.u.ki.wVk=vk; i.u.ki.wScan=scan; i.u.ki.dwFlags=flags; return i; }
+
+    static int Clamp(int v){ return v<0?0:(v>65535?65535:v); }
+    static void MoveFraction(double fx, double fy){
+      int nx=Clamp((int)Math.Round(fx*65535.0)); int ny=Clamp((int)Math.Round(fy*65535.0));
+      Send(new INPUT[]{ Mouse(MOVE|ABSOLUTE|VIRTUALDESK, nx, ny, 0) });
+    }
+    static void MovePhysical(int px, int py){
+      int vx=GetSystemMetrics(SM_XVIRTUALSCREEN), vy=GetSystemMetrics(SM_YVIRTUALSCREEN);
+      int vw=GetSystemMetrics(SM_CXVIRTUALSCREEN), vh=GetSystemMetrics(SM_CYVIRTUALSCREEN);
+      if(vw<1) vw=1; if(vh<1) vh=1;
+      MoveFraction((px-vx)/(double)vw, (py-vy)/(double)vh);
+    }
+    static void Button(string b, bool down){
+      switch(b){
+        case "L": Send(new INPUT[]{ Mouse(down?LEFTDOWN:LEFTUP,0,0,0) }); break;
+        case "R": Send(new INPUT[]{ Mouse(down?RIGHTDOWN:RIGHTUP,0,0,0) }); break;
+        case "M": Send(new INPUT[]{ Mouse(down?MIDDLEDOWN:MIDDLEUP,0,0,0) }); break;
+        case "1": Send(new INPUT[]{ Mouse(down?XDOWN:XUP,0,0,XBUTTON1) }); break;
+        case "2": Send(new INPUT[]{ Mouse(down?XDOWN:XUP,0,0,XBUTTON2) }); break;
+      }
+    }
+    static void Wheel(int dx, int dy){
+      if(dy!=0) Send(new INPUT[]{ Mouse(WHEEL,0,0,(uint)dy) });
+      if(dx!=0) Send(new INPUT[]{ Mouse(HWHEEL,0,0,(uint)dx) });
+    }
+    static bool IsExtended(ushort vk){
+      switch(vk){
+        case 0x21: case 0x22: case 0x23: case 0x24: case 0x25: case 0x26: case 0x27: case 0x28:
+        case 0x2d: case 0x2e: case 0x5b: case 0x5c: case 0x5d: case 0xa3: case 0xa5: case 0x2c: return true;
+        default: return false;
+      }
+    }
+    static void Key(ushort vk, bool down){
+      uint flags = down?0u:KEYUP;
+      if(IsExtended(vk)) flags |= EXTENDED;
+      Send(new INPUT[]{ Kbd(vk,0,flags) });
+    }
+    static void Unicode(string[] p, int start){
+      for(int i=start;i<p.Length;i++){
+        ushort u;
+        if(!ushort.TryParse(p[i], NumberStyles.HexNumber, CI, out u)) continue;
+        Send(new INPUT[]{ Kbd(0,u,UNICODE), Kbd(0,u,UNICODE|KEYUP) });
+      }
+    }
+    static void Dispatch(string line){
+      if(line.Length==0) return;
+      string[] p = line.Split(' ');
+      switch(p[0]){
+        case "MF": MoveFraction(double.Parse(p[1],CI), double.Parse(p[2],CI)); break;
+        case "M": MovePhysical(int.Parse(p[1],CI), int.Parse(p[2],CI)); break;
+        case "B": Button(p[1], p[2]=="1"); break;
+        case "W": Wheel(int.Parse(p[1],CI), int.Parse(p[2],CI)); break;
+        case "K": Key(ushort.Parse(p[1],CI), p[2]=="1"); break;
+        case "U": Unicode(p, 1); break;
+        case "PING": Console.Out.WriteLine("PONG"); Console.Out.Flush(); break;
+      }
+    }
+    public static void Pump(){
+      try { SetProcessDpiAwarenessContext(new IntPtr(-4)); } catch {} // PER_MONITOR_AWARE_V2; best-effort
+      Console.Out.WriteLine("READY"); Console.Out.Flush();
+      string line;
+      while((line = Console.In.ReadLine()) != null){
+        try { Dispatch(line); } catch { /* one bad command must never kill the pump */ }
+      }
+    }
+  }
+}
+`;
+var PS_SCRIPT = `$ErrorActionPreference='Stop'; Add-Type -TypeDefinition @'
+${CSHARP}
+'@ ; [Tess.Input]::Pump()`;
+var WinInputImpl = class {
+  child = null;
+  starting = null;
+  queue = [];
+  readyResolvers = [];
+  stdoutBuf = "";
+  stopped = false;
+  log;
+  constructor(log10) {
+    this.log = log10 ?? (() => {
+    });
+  }
+  /** Start the helper if it isn't running. Idempotent and lazy — a crashed helper is relaunched
+   *  the next time a command is sent (the queued command flushes once it's up). */
+  ensure() {
+    if (this.stopped || this.child)
+      return;
+    const b642 = Buffer.from(PS_SCRIPT, "utf16le").toString("base64");
+    let child;
+    try {
+      child = spawn10("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", b642], {
+        windowsHide: true,
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+    } catch (e) {
+      this.log(`win-input: could not spawn powershell: ${e instanceof Error ? e.message : String(e)}`);
+      return;
+    }
+    this.child = child;
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (d) => {
+      this.stdoutBuf += d;
+      if (this.stdoutBuf.includes("READY")) {
+        this.stdoutBuf = "";
+        const r = this.readyResolvers;
+        this.readyResolvers = [];
+        for (const res of r) {
+          try {
+            res();
+          } catch {
+          }
+        }
+      }
+    });
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (d) => {
+      const s = d.trim();
+      if (s)
+        this.log(`win-input stderr: ${s.slice(0, 300)}`);
+    });
+    child.on("error", (e) => {
+      this.log(`win-input: helper error: ${e instanceof Error ? e.message : String(e)}`);
+      this.child = null;
+    });
+    child.on("exit", (code, signal2) => {
+      if (!this.stopped)
+        this.log(`win-input: helper exited (code=${code ?? "?"} signal=${signal2 ?? "-"}) \u2014 will relaunch on next input`);
+      this.child = null;
+    });
+    if (this.queue.length) {
+      const q = this.queue;
+      this.queue = [];
+      for (const line of q)
+        this.rawWrite(line);
+    }
+  }
+  rawWrite(line) {
+    const c = this.child;
+    if (!c || !c.stdin.writable) {
+      this.queue.push(line);
+      if (this.queue.length > 512)
+        this.queue.shift();
+      return;
+    }
+    try {
+      c.stdin.write(line + "\n");
+    } catch (e) {
+      this.log(`win-input: write failed: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
+  send(line) {
+    this.ensure();
+    this.rawWrite(line);
+  }
+  async warm() {
+    if (this.stopped)
+      return;
+    this.ensure();
+    if (!this.child)
+      return;
+    await new Promise((resolve16) => {
+      const t = setTimeout(() => {
+        this.readyResolvers = this.readyResolvers.filter((r) => r !== resolve16);
+        resolve16();
+      }, 6e3);
+      t.unref?.();
+      this.readyResolvers.push(() => {
+        clearTimeout(t);
+        resolve16();
+      });
+    });
+  }
+  async moveAbsolute(fx, fy) {
+    this.send(`MF ${clampFrac(fx)} ${clampFrac(fy)}`);
+  }
+  async moveAbsolutePhysical(px, py) {
+    this.send(`M ${Math.round(px)} ${Math.round(py)}`);
+  }
+  async button(btn, down) {
+    this.send(`B ${BTN_CODE[btn]} ${down ? 1 : 0}`);
+  }
+  async wheel(dx, dy) {
+    this.send(`W ${Math.round(dx)} ${Math.round(dy)}`);
+  }
+  async keyByVk(vk, down) {
+    if (vk > 0)
+      this.send(`K ${vk | 0} ${down ? 1 : 0}`);
+  }
+  async typeUnicode(text13) {
+    if (!text13)
+      return;
+    const units = [];
+    for (let i = 0; i < text13.length; i++)
+      units.push(text13.charCodeAt(i).toString(16));
+    for (let i = 0; i < units.length; i += 64)
+      this.send(`U ${units.slice(i, i + 64).join(" ")}`);
+  }
+  async stop() {
+    this.stopped = true;
+    const c = this.child;
+    this.child = null;
+    this.queue = [];
+    if (!c)
+      return;
+    try {
+      c.stdin.end();
+    } catch {
+    }
+    await new Promise((resolve16) => {
+      let done = false;
+      const finish2 = () => {
+        if (done)
+          return;
+        done = true;
+        resolve16();
+      };
+      c.on("exit", finish2);
+      const t = setTimeout(() => {
+        try {
+          c.kill();
+        } catch {
+        }
+        finish2();
+      }, 800);
+      t.unref?.();
+    });
+  }
+};
+function clampFrac(v) {
+  if (!Number.isFinite(v))
+    return 0;
+  return v < 0 ? 0 : v > 1 ? 1 : Math.round(v * 1e6) / 1e6;
+}
+function createWinInput(opts = {}) {
+  if (process.platform !== "win32")
+    return null;
+  return new WinInputImpl(opts.log);
+}
+
 // ../../packages/host-core/dist/rdesk/input-injector.js
 var BUTTON = { 0: "left", 1: "middle", 2: "right" };
+var WIN_BUTTON = { 0: "L", 1: "M", 2: "R", 3: "X1", 4: "X2" };
 function normalizeKey(key2) {
   const named = {
     " ": "space",
@@ -114120,26 +114682,91 @@ function isComboKey(key2, modifiers = 0) {
   const hasHardMod = (modifiers & (1 | 2 | 4)) !== 0;
   return key2.length !== 1 || hasHardMod;
 }
+var COMBO_TOKEN_VK = {
+  ctrl: 17,
+  control: 17,
+  alt: 18,
+  option: 18,
+  opt: 18,
+  shift: 16,
+  cmd: 91,
+  command: 91,
+  meta: 91,
+  win: 91,
+  super: 91,
+  enter: 13,
+  return: 13,
+  tab: 9,
+  escape: 27,
+  esc: 27,
+  space: 32,
+  backspace: 8,
+  delete: 46,
+  del: 46,
+  insert: 45,
+  up: 38,
+  down: 40,
+  left: 37,
+  right: 39,
+  home: 36,
+  end: 35,
+  pageup: 33,
+  pgup: 33,
+  pagedown: 34,
+  pgdn: 34
+};
+function comboTokenVk(token4) {
+  const t = token4.trim().toLowerCase();
+  if (COMBO_TOKEN_VK[t] !== void 0)
+    return COMBO_TOKEN_VK[t];
+  if (/^f([1-9]|1[0-9]|2[0-4])$/.test(t))
+    return 112 + (Number(t.slice(1)) - 1);
+  if (t.length === 1) {
+    const c = t.toUpperCase().charCodeAt(0);
+    if (c >= 65 && c <= 90 || c >= 48 && c <= 57)
+      return c;
+  }
+  return 0;
+}
 var RdeskInputInjector = class {
   runner;
   origin;
   access;
-  constructor(runner2, origin, access) {
+  win;
+  /** VKs currently held down on the Windows path — released on view/disconnect/blur so a
+   *  modifier or key never "sticks" on the remote machine after control ends. */
+  heldVks = /* @__PURE__ */ new Set();
+  constructor(runner2, origin, access, win3 = null) {
     this.runner = runner2;
     this.origin = origin;
     this.access = access;
+    this.win = win3;
   }
   setAccess(level) {
+    if (this.access === "control" && level !== "control")
+      this.releaseAll();
     this.access = level;
   }
   setOrigin(origin) {
     this.origin = origin;
   }
+  /** Release every held key on the Windows path. Called on access change, disconnect and blur. */
+  releaseAll() {
+    if (!this.win) {
+      this.heldVks.clear();
+      return;
+    }
+    for (const vk of this.heldVks)
+      void this.win.api.keyByVk(vk, false);
+    this.heldVks.clear();
+  }
   /** Apply one viewer input event, or drop it when the session is view-only. */
   async apply(ev) {
     if (this.access !== "control")
       return;
     const at = (x, y) => ({ x: this.origin.x + x, y: this.origin.y + y });
+    if (this.win)
+      return this.applyWin(ev, at);
     if (ev.kind === "mouse") {
       if (ev.action === "move")
         return void this.runner.mouseMove(at(ev.x, ev.y));
@@ -114160,686 +114787,134 @@ var RdeskInputInjector = class {
         return void this.runner.pressKeys(keyCombo(ev.key, ev.modifiers));
     }
   }
-};
-
-// ../../packages/host-core/dist/rdesk/wayland-input.js
-function isWaylandSession() {
-  return process.platform === "linux" && (process.env.XDG_SESSION_TYPE === "wayland" || !!process.env.WAYLAND_DISPLAY);
-}
-var BTN = { left: 272, right: 273, middle: 274 };
-async function createWaylandInputProvider(onUnavailable) {
-  const fail4 = (reason) => {
-    onUnavailable?.(reason);
-    return null;
-  };
-  if (!isWaylandSession())
-    return fail4("not a Wayland session");
-  let dbus = null;
-  try {
-    dbus = await import("dbus-next");
-  } catch (e) {
-    return fail4(`dbus-next could not be loaded: ${e instanceof Error ? e.message : String(e)}`);
-  }
-  try {
-    const bus = dbus.sessionBus();
-    const obj = await bus.getProxyObject("org.freedesktop.portal.Desktop", "/org/freedesktop/portal/desktop");
-    const portal = obj.getInterface("org.freedesktop.portal.RemoteDesktop");
-    const sessionHandle = await establishSession(portal);
-    if (!sessionHandle)
-      return fail4(`the RemoteDesktop portal did not grant a session${lastSessionError ? ` (${lastSessionError})` : " (Start was refused, or nobody answered its consent prompt on that machine)"}`);
-    const opts = {};
-    return {
-      pointerMotionAbsolute: (x, y, w, h) => void portal.NotifyPointerMotionAbsolute(sessionHandle, opts, 0, x / Math.max(1, w), y / Math.max(1, h)).catch(() => {
-      }),
-      pointerButton: (b, down) => void portal.NotifyPointerButton(sessionHandle, opts, b, down ? 1 : 0).catch(() => {
-      }),
-      pointerAxis: (dx, dy) => void portal.NotifyPointerAxis(sessionHandle, opts, dx, dy).catch(() => {
-      }),
-      keyboardKeycode: (k, down) => void portal.NotifyKeyboardKeycode(sessionHandle, opts, k, down ? 1 : 0).catch(() => {
-      }),
-      keyboardKeysym: (ks, down) => void portal.NotifyKeyboardKeysym(sessionHandle, opts, ks, down ? 1 : 0).catch(() => {
-      }),
-      close: () => {
+  /** The Windows input path (win32 only). Absolute virtual-desktop mouse, Unicode text, real
+   *  key down/up by virtual-key code. */
+  applyWin(ev, at) {
+    const api = this.win.api;
+    if (ev.kind === "mouse") {
+      const f = this.win.toFraction(at(ev.x, ev.y));
+      void api.moveAbsolute(f.fx, f.fy);
+      const btn = WIN_BUTTON[ev.button ?? 0] ?? "L";
+      if (ev.action === "down")
+        void api.button(btn, true);
+      else if (ev.action === "up")
+        void api.button(btn, false);
+      else if (ev.action === "click") {
+        void api.button(btn, true);
+        void api.button(btn, false);
       }
-    };
-  } catch (e) {
-    return fail4(`the RemoteDesktop portal is not reachable: ${e instanceof Error ? e.message : String(e)}`);
-  }
-}
-var lastSessionError = "";
-async function establishSession(portal) {
-  try {
-    const token4 = "tesseract" + Math.floor(Date.now() % 1e6);
-    await portal.CreateSession({ session_handle_token: token4, handle_token: token4 });
-    const session = `/org/freedesktop/portal/desktop/session/${token4}`;
-    await portal.SelectDevices(session, { types: 3, handle_token: token4 + "s" });
-    await portal.Start(session, "", { handle_token: token4 + "g" });
-    return session;
-  } catch (e) {
-    lastSessionError = e instanceof Error ? e.message : String(e);
-    return null;
-  }
-}
-var KEYSYM = {
-  // Modifiers
-  shift: 65505,
-  ctrl: 65507,
-  alt: 65513,
-  cmd: 65515,
-  // Shift_L, Control_L, Alt_L, Super_L
-  // Named keys
-  enter: 65293,
-  tab: 65289,
-  escape: 65307,
-  backspace: 65288,
-  delete: 65535,
-  space: 32,
-  up: 65362,
-  down: 65364,
-  left: 65361,
-  right: 65363,
-  home: 65360,
-  end: 65367,
-  pageup: 65365,
-  pagedown: 65366,
-  insert: 65379,
-  f1: 65470,
-  f2: 65471,
-  f3: 65472,
-  f4: 65473,
-  f5: 65474,
-  f6: 65475,
-  f7: 65476,
-  f8: 65477,
-  f9: 65478,
-  f10: 65479,
-  f11: 65480,
-  f12: 65481
-};
-function charKeysym(ch) {
-  const cp2 = ch.codePointAt(0) ?? 0;
-  if (cp2 === 0)
-    return 0;
-  return cp2 <= 255 ? cp2 : 16777216 + cp2;
-}
-function tokenKeysym(token4) {
-  const t = token4.trim().toLowerCase();
-  if (KEYSYM[t] !== void 0)
-    return KEYSYM[t];
-  return t.length === 1 ? charKeysym(t) : 0;
-}
-function waylandInputRunner(p, screen) {
-  const w = () => screen.w, h = () => screen.h;
-  return {
-    async mouseMove(pt) {
-      p.pointerMotionAbsolute(pt.x, pt.y, w(), h());
-    },
-    async mouseClick(o) {
-      if (o.at)
-        p.pointerMotionAbsolute(o.at.x, o.at.y, w(), h());
-      const b = BTN[o.button ?? "left"];
-      const click = () => {
-        p.pointerButton(b, true);
-        p.pointerButton(b, false);
-      };
-      click();
-      if (o.double)
-        click();
-    },
-    async scroll(o) {
-      p.pointerAxis(o.dx ?? 0, o.dy ?? 0);
-    },
-    async typeText(text13) {
-      for (const ch of text13) {
-        const ks = charKeysym(ch);
-        if (!ks)
-          continue;
-        p.keyboardKeysym(ks, true);
-        p.keyboardKeysym(ks, false);
+      return;
+    }
+    if (ev.kind === "wheel") {
+      void api.moveAbsolute(...fracOf(this.win.toFraction(at(ev.x, ev.y))));
+      void api.wheel(-Math.round(ev.deltaX), -Math.round(ev.deltaY));
+      return;
+    }
+    if (ev.kind === "key") {
+      if (ev.action === "char") {
+        if (ev.text)
+          void api.typeUnicode(ev.text);
+        return;
       }
-    },
-    async pressKeys(combo) {
-      const parts = combo.split("+").map((x) => x.trim()).filter(Boolean);
-      if (!parts.length)
+      if (ev.key.includes("+")) {
+        if (ev.action === "down")
+          this.pressWinCombo(ev.key);
         return;
-      const key2 = tokenKeysym(parts[parts.length - 1]);
-      const mods = parts.slice(0, -1).map(tokenKeysym).filter((k) => k > 0);
-      if (!key2)
+      }
+      const vk = vkForCode(ev.code, ev.key);
+      if (!vk)
         return;
-      for (const m of mods)
-        p.keyboardKeysym(m, true);
-      p.keyboardKeysym(key2, true);
-      p.keyboardKeysym(key2, false);
-      for (const m of [...mods].reverse())
-        p.keyboardKeysym(m, false);
-    }
-  };
-}
-
-// ../../packages/host-core/dist/rdesk/host-clipboard.js
-init_dist2();
-import { statSync as statSync19 } from "node:fs";
-import { basename as basename13 } from "node:path";
-function readHostClipboardFilePaths() {
-  const el2 = electronModule();
-  const clip2 = el2?.clipboard;
-  if (!clip2)
-    return [];
-  try {
-    return readFilePathsWith((f) => clip2.read(f));
-  } catch {
-    return [];
-  }
-}
-function describeClipFiles(paths) {
-  const out = [];
-  for (const p of paths) {
-    try {
-      const st = statSync19(p);
-      out.push({ path: p, name: basename13(p), isDir: st.isDirectory(), size: st.isDirectory() ? 0 : st.size });
-    } catch {
+      const mods = ev.modifiers ?? 0;
+      if (ev.action === "down") {
+        if (ev.key.length === 1 && (mods & (2 | 4)) === 0)
+          return;
+        void api.keyByVk(vk, true);
+        this.heldVks.add(vk);
+      } else if (ev.action === "up") {
+        void api.keyByVk(vk, false);
+        this.heldVks.delete(vk);
+      }
     }
   }
-  return out;
-}
-function watchHostClipboardFiles(onChange, intervalMs = 1500) {
-  let last = "";
-  let stopped2 = false;
-  const tick = () => {
-    if (stopped2)
-      return;
-    const paths = readHostClipboardFilePaths();
-    const key2 = paths.join("\0");
-    if (key2 === last)
+  /** Inject a named chord ("ctrl+alt+delete") as a real down/up sequence on the Windows path. */
+  pressWinCombo(combo) {
+    const api = this.win.api;
+    const toks = combo.split("+").map((t) => t.trim()).filter(Boolean);
+    const vks = toks.map(comboTokenVk).filter((v) => v > 0);
+    if (!vks.length)
       return;
-    last = key2;
-    onChange(paths.length ? describeClipFiles(paths) : []);
-  };
-  const timer2 = setInterval(tick, intervalMs);
-  timer2.unref?.();
-  return () => {
-    stopped2 = true;
-    clearInterval(timer2);
-  };
+    for (const vk of vks)
+      void api.keyByVk(vk, true);
+    for (const vk of [...vks].reverse())
+      void api.keyByVk(vk, false);
+  }
+};
+function fracOf(f) {
+  return [f.fx, f.fy];
 }
 
-// ../../packages/host-core/dist/rdesk/tesseract-engine.js
-var TesseractEngine = class {
-  id = "tesseract";
-  ctx;
-  deps;
-  pub = null;
-  injector = null;
-  /** Stops the host-clipboard file watcher for this session (see host-clipboard.ts). */
-  stopClipWatch = null;
-  monitorId = "";
-  sourceId = "";
-  // active capture source (screen or window)
-  quality = "auto";
-  systemAudio = false;
-  access;
-  constructor(ctx2, deps) {
-    this.ctx = ctx2;
-    this.deps = deps;
-    this.access = ctx2.accessLevel;
+// ../../packages/host-core/dist/system-events.js
+import { execFile as execFile8 } from "node:child_process";
+import { networkInterfaces, platform as platform2 } from "node:os";
+
+// ../../packages/host-core/dist/participants.js
+var DAEMON_PARTICIPANT = "daemon";
+var ParticipantRegistry = class {
+  byId = /* @__PURE__ */ new Map();
+  /** Declare a participant. Idempotent — re-joining an existing id updates its label and keeps its
+   *  state, which is what a reconnect is. */
+  join(id, label, now2) {
+    const existing = this.byId.get(id);
+    if (existing) {
+      existing.label = label;
+      return null;
+    }
+    this.byId.set(id, { id, label, active: false, focused: false, joinedAt: now2 });
+    return { kind: "joined", id };
+  }
+  /** It went away — closed, crashed, or its socket dropped. Anything it claimed goes with it: a
+   *  process that died is not frontmost, and leaving that behind would make the machine look
+   *  permanently attended. */
+  leave(id) {
+    return this.byId.delete(id) ? { kind: "left", id } : null;
+  }
+  /** Frontmost, as reported by the participant itself. */
+  setActive(id, active2) {
+    const p = this.byId.get(id);
+    if (!p || p.active === active2)
+      return null;
+    p.active = active2;
+    return { kind: active2 ? "activated" : "deactivated", id };
+  }
+  setFocused(id, focused) {
+    const p = this.byId.get(id);
+    if (!p || p.focused === focused)
+      return null;
+    p.focused = focused;
+    return { kind: focused ? "window-focus" : "window-blur", id };
   }
   /**
-   * What this session can ACTUALLY do, derived at runtime.
+   * Is anybody at this machine?
    *
-   * This used to be a hardcoded constant returned identically on every platform, so a
-   * viewer was told `input: true` by a Wayland host that cannot inject a keystroke, and
-   * offered a system-audio toggle on macOS where the capture is known to be silent. A
-   * capability flag that doesn't track reality is worse than no flag: the viewer renders
-   * a control that quietly does nothing.
+   * The union, deliberately. With a single boolean, two participants taking and losing focus in
+   * sequence leave the answer set by whichever spoke last — so the desktop app blurring would
+   * report an empty machine while somebody sits in front of the Remote Desktop window.
    */
-  capabilities() {
-    return {
-      // False until an input runner was actually obtained (see start()): on Wayland
-      // without the portal, control is impossible and the session is view-only.
-      input: !!this.injector,
-      clipboard: true,
-      // No drag/drop or upload surface exists inside an rdesk session today. It was
-      // advertised as if it did; nothing in either viewer ever read it.
-      fileTransfer: false,
-      multiMonitor: true,
-      windowCapture: true,
-      // share a single window/app (privacy)
-      // Voice now rides this session's own peer connection (setAv).
-      bidiAudioVideo: true,
-      // Windows/Linux capture desktop audio natively; macOS needs a loopback we don't
-      // ship, so claiming it there just produces a toggle that yields silence.
-      systemAudio: process.platform !== "darwin"
-    };
-  }
-  listMonitors() {
-    return listPublisherMonitors();
-  }
-  listSources() {
-    return listPublisherSources();
+  anyonePresent() {
+    for (const p of this.byId.values())
+      if (p.active || p.focused)
+        return true;
+    return false;
   }
-  startOpts(iceServers) {
-    return { iceServers, quality: this.quality, systemAudio: this.systemAudio };
+  /** Who is accounted for. Lets a caller tell "nobody is here" from "nobody has reported". */
+  participants() {
+    return [...this.byId.values()].map((p) => ({ ...p }));
   }
-  async setSource(sourceId) {
-    this.sourceId = sourceId;
-    const origin = sourceId.startsWith("screen:") ? this.originForActiveScreen() : { x: 0, y: 0 };
-    this.injector?.setOrigin(origin);
-    const iceServers = await this.deps.getIceServers().catch(() => []);
-    await this.pub?.setSource(sourceId, this.startOpts(iceServers));
+  has(id) {
+    return this.byId.has(id);
   }
-  originForActiveScreen() {
-    const b = displayBoundsById(this.monitorId);
-    return b ? { x: b.x, y: b.y } : { x: 0, y: 0 };
-  }
-  async start(opts) {
-    const monitors = await listPublisherMonitors();
-    this.monitorId = opts.monitorId ?? monitors.find((m) => m.primary)?.id ?? monitors[0]?.id ?? "";
-    this.quality = opts.quality ?? "auto";
-    this.sourceId = await sourceIdForMonitor(this.monitorId).catch(() => "");
-    const origin = displayBoundsById(this.monitorId) ?? { x: 0, y: 0, width: 0, height: 0 };
-    let runner2;
-    if (this.deps.makeRunner) {
-      runner2 = this.deps.makeRunner();
-    } else if (isWaylandSession()) {
-      let waylandReason = "";
-      const wp = await createWaylandInputProvider((r) => {
-        waylandReason = r;
-      });
-      if (wp) {
-        const m = monitors.find((x) => x.id === this.monitorId) ?? monitors[0];
-        runner2 = waylandInputRunner(wp, { w: m?.width ?? origin.width, h: m?.height ?? origin.height });
-        this.ctx.log("rdesk: Wayland input via XDG RemoteDesktop portal.");
-      } else {
-        this.ctx.log(`rdesk: Wayland \u2014 keyboard and mouse unavailable, streaming view-only. Reason: ${waylandReason || "unknown"}`);
-        runner2 = createDaemonOsControlRunner();
-      }
-    } else {
-      runner2 = createDaemonOsControlRunner();
-    }
-    this.injector = new RdeskInputInjector(runner2, { x: origin.x, y: origin.y }, this.ctx.accessLevel);
-    const iceServers = await this.deps.getIceServers().catch(() => []);
-    const pub = new PublisherWindow(this.ctx.sessionId, {
-      onOffer: (sdp) => this.ctx.sendSignal({ type: "signal:offer", sdp }),
-      onIce: (candidate) => this.ctx.sendSignal({ type: "signal:ice", candidate }),
-      onInput: (ev) => void this.injector?.apply(ev),
-      // Clipboard sync (Phase 6): write the viewer's clipboard onto the host so ⌘V pastes
-      // into the remote machine. Gated by control access (view-only never writes).
-      onClipboard: (text13) => {
-        if (this.access === "control") {
-          const el2 = electronModule();
-          try {
-            el2?.clipboard?.writeText(text13);
-          } catch {
-          }
-        }
-      },
-      onReady: () => this.ctx.log("publisher connected"),
-      onError: (err2) => {
-        this.ctx.log(`publisher error: ${err2}`);
-        this.ctx.sendControl({ type: "rdesk:closed", reason: "network" });
-      },
-      // Media is direct-first; log which path actually won so a regression to relay
-      // (which costs real bandwidth) is visible instead of silent. Types only, no IPs.
-      onCapture: (ok, message) => {
-        this.ctx.log(`capture ${ok ? "ok" : `LOST \u2014 ${message}`}`);
-        this.ctx.onCapture?.(ok, message);
-      },
-      onPath: (path6, d) => {
-        this.ctx.log(`media path=${path6} (local=${d.localType ?? "?"} remote=${d.remoteType ?? "?"})`);
-        this.ctx.onPath?.(path6, d);
-      }
-    });
-    this.pub = pub;
-    this.stopClipWatch = watchHostClipboardFiles((files) => {
-      if (this.access !== "control")
-        return;
-      this.pub?.sendData({ t: "clipboard-files", files });
-    });
-    await pub.start({
-      iceServers,
-      monitorId: this.monitorId,
-      quality: this.quality,
-      systemAudio: this.systemAudio
-    });
-  }
-  onSignal(msg) {
-    if (!this.pub)
-      return;
-    if (msg.type === "signal:answer")
-      this.pub.answer(msg.sdp);
-    else if (msg.type === "signal:ice")
-      this.pub.addIce(msg.candidate);
-  }
-  applyInput(ev) {
-    void this.injector?.apply(ev);
-  }
-  setAccessLevel(level) {
-    this.access = level;
-    this.injector?.setAccess(level);
-  }
-  async setMonitor(monitorId) {
-    this.monitorId = monitorId;
-    this.sourceId = await sourceIdForMonitor(monitorId).catch(() => this.sourceId);
-    const origin = displayBoundsById(monitorId);
-    if (origin && this.injector)
-      this.injector.setOrigin({ x: origin.x, y: origin.y });
-    const iceServers = await this.deps.getIceServers().catch(() => []);
-    await this.pub?.setMonitor(monitorId, this.startOpts(iceServers));
-  }
-  setAv(on) {
-    this.pub?.setAv(on);
-  }
-  setQuality(preset) {
-    this.quality = preset;
-    this.pub?.setQuality(preset);
-  }
-  setMute(m) {
-    if (typeof m.systemAudio === "boolean" && m.systemAudio !== this.systemAudio && this.sourceId) {
-      this.systemAudio = m.systemAudio;
-      void this.deps.getIceServers().catch(() => []).then((ice) => this.pub?.setSource(this.sourceId, this.startOpts(ice)));
-    }
-  }
-  async stop() {
-    this.stopClipWatch?.();
-    this.stopClipWatch = null;
-    await this.pub?.stop();
-    this.pub = null;
-    this.injector = null;
-  }
-};
-function registerTesseractEngine(deps) {
-  registerRdeskEngine("tesseract", (ctx2) => new TesseractEngine(ctx2, deps));
-}
-
-// ../../packages/host-core/dist/local-server.js
-import { timingSafeEqual as timingSafeEqual5 } from "node:crypto";
-
-// ../../packages/host-core/dist/in-process-link.js
-var OPEN = 1;
-var CLOSED = 3;
-var InProcSocket = class {
-  OPEN = OPEN;
-  CLOSED = CLOSED;
-  readyState = OPEN;
-  peer = null;
-  listeners = /* @__PURE__ */ new Map();
-  on(event, cb) {
-    let s = this.listeners.get(event);
-    if (!s) {
-      s = /* @__PURE__ */ new Set();
-      this.listeners.set(event, s);
-    }
-    s.add(cb);
-    return this;
-  }
-  once(event, cb) {
-    const wrap = (...a) => {
-      this.off(event, wrap);
-      cb(...a);
-    };
-    return this.on(event, wrap);
-  }
-  off(event, cb) {
-    this.listeners.get(event)?.delete(cb);
-    return this;
-  }
-  removeListener(event, cb) {
-    return this.off(event, cb);
-  }
-  fire(event, ...args) {
-    const s = this.listeners.get(event);
-    if (!s)
-      return;
-    for (const cb of [...s]) {
-      try {
-        cb(...args);
-      } catch {
-      }
-    }
-  }
-  /** Deliver `data` to the PEER's 'message' listeners on the next macrotask. */
-  send(data) {
-    const peer = this.peer;
-    if (!peer || peer.readyState !== OPEN)
-      return;
-    setImmediate(() => {
-      if (peer.readyState === OPEN)
-        peer.fire("message", data);
-    });
-  }
-  close(_code, _reason) {
-    if (this.readyState === CLOSED)
-      return;
-    this.readyState = CLOSED;
-    const peer = this.peer;
-    setImmediate(() => this.fire("close"));
-    if (peer && peer.readyState !== CLOSED) {
-      peer.readyState = CLOSED;
-      setImmediate(() => peer.fire("close"));
-    }
-  }
-  /** @internal wire this end to its peer. */
-  _link(peer) {
-    this.peer = peer;
-  }
-  /** @internal fire 'open' on the next macrotask (client end only; the server never awaits it). */
-  _fireOpen() {
-    setImmediate(() => this.fire("open"));
-  }
-};
-function makeInProcPair() {
-  const serverEnd = new InProcSocket();
-  const clientEnd = new InProcSocket();
-  serverEnd._link(clientEnd);
-  clientEnd._link(serverEnd);
-  return { serverEnd, clientEnd };
-}
-var connector = null;
-function setInProcConnector(fn) {
-  connector = fn;
-}
-
-// ../../packages/host-core/dist/rdesk/server-prefs.js
-init_credentials();
-import { readFileSync as readFileSync44, writeFileSync as writeFileSync29 } from "node:fs";
-import { join as join72 } from "node:path";
-function rdeskServerPrefsPath() {
-  return join72(daemonDir2(), "rdesk-server.json");
-}
-var DEFAULTS2 = {
-  enabled: true,
-  defaultAccess: "control",
-  quality: "auto",
-  autostart: true,
-  hideTray: false,
-  noticeShownAt: 0
-};
-function readRdeskServerPrefs() {
-  try {
-    const p = JSON.parse(readFileSync44(rdeskServerPrefsPath(), "utf8"));
-    return {
-      // `!== false` (not `?? true`): only an explicit opt-out disables sharing, so a
-      // partially-written or older prefs file never silently turns the machine off.
-      enabled: p.enabled !== false,
-      defaultAccess: p.defaultAccess === "view" ? "view" : "control",
-      quality: p.quality ?? DEFAULTS2.quality,
-      autostart: p.autostart ?? DEFAULTS2.autostart,
-      hideTray: p.hideTray ?? DEFAULTS2.hideTray,
-      noticeShownAt: typeof p.noticeShownAt === "number" ? p.noticeShownAt : 0
-    };
-  } catch {
-    return { ...DEFAULTS2 };
-  }
-}
-function writeRdeskServerPrefs(patch) {
-  try {
-    const next = { ...readRdeskServerPrefs(), ...patch };
-    writeFileSync29(rdeskServerPrefsPath(), JSON.stringify(next), { mode: 384 });
-  } catch {
-  }
-}
-function rdeskSharingEnabled() {
-  if (process.env.CCB_RDESK_ENABLED === "0")
-    return false;
-  if (process.env.CCB_RDESK_ENABLED === "1")
-    return true;
-  return readRdeskServerPrefs().enabled;
-}
-
-// ../../packages/host-core/dist/rdesk/password.js
-init_credentials();
-import { scryptSync, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual4, randomInt } from "node:crypto";
-import { readFileSync as readFileSync45, writeFileSync as writeFileSync30, existsSync as existsSync32, unlinkSync as unlinkSync4 } from "node:fs";
-import { join as join73 } from "node:path";
-function pwFile() {
-  return join73(daemonDir2(), "rdesk-password.json");
-}
-function pwPlainFile() {
-  return join73(daemonDir2(), "rdesk-password.enc");
-}
-var PW_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789";
-var PW_LENGTH = 16;
-function generatePassword() {
-  let out = "";
-  for (let i = 0; i < PW_LENGTH; i++)
-    out += PW_ALPHABET[randomInt(PW_ALPHABET.length)];
-  return (out.match(/.{1,4}/g) ?? [out]).join("-");
-}
-function writePlain(password) {
-  try {
-    const safe2 = electronModule()?.safeStorage;
-    if (!safe2?.isEncryptionAvailable())
-      return;
-    writeFileSync30(pwPlainFile(), safe2.encryptString(password), { mode: 384 });
-  } catch {
-  }
-}
-function canRevealRdeskPassword() {
-  try {
-    const safe2 = electronModule()?.safeStorage;
-    return !!safe2?.isEncryptionAvailable() && existsSync32(pwPlainFile());
-  } catch {
-    return false;
-  }
-}
-function readRdeskPasswordPlain() {
-  try {
-    const safe2 = electronModule()?.safeStorage;
-    if (!safe2?.isEncryptionAvailable())
-      return null;
-    return safe2.decryptString(readFileSync45(pwPlainFile()));
-  } catch {
-    return null;
-  }
-}
-function setRdeskPassword(password) {
-  if (!password) {
-    try {
-      unlinkSync4(pwFile());
-    } catch {
-    }
-    try {
-      unlinkSync4(pwPlainFile());
-    } catch {
-    }
-    return;
-  }
-  const salt = randomBytes5(16);
-  const hash2 = scryptSync(password, salt, 32);
-  writeFileSync30(pwFile(), JSON.stringify({ salt: salt.toString("hex"), hash: hash2.toString("hex") }), { mode: 384 });
-  writePlain(password);
-}
-function regenerateRdeskPassword() {
-  const pw = generatePassword();
-  setRdeskPassword(pw);
-  return pw;
-}
-function ensureRdeskPassword() {
-  if (hasRdeskPassword())
-    return null;
-  return regenerateRdeskPassword();
-}
-function hasRdeskPassword() {
-  return !!process.env.CCB_RDESK_PASSWORD || existsSync32(pwFile());
-}
-function verifyRdeskPassword(password) {
-  if (!password)
-    return false;
-  const override3 = process.env.CCB_RDESK_PASSWORD;
-  if (override3)
-    return password.length === override3.length && timingSafeEqual4(Buffer.from(password), Buffer.from(override3));
-  try {
-    const { salt, hash: hash2 } = JSON.parse(readFileSync45(pwFile(), "utf8"));
-    const got = scryptSync(password, Buffer.from(salt, "hex"), 32);
-    const want = Buffer.from(hash2, "hex");
-    return got.length === want.length && timingSafeEqual4(got, want);
-  } catch {
-    return false;
-  }
-}
-
-// ../../packages/host-core/dist/system-events.js
-import { execFile as execFile8 } from "node:child_process";
-import { networkInterfaces, platform as platform2 } from "node:os";
-
-// ../../packages/host-core/dist/participants.js
-var DAEMON_PARTICIPANT = "daemon";
-var ParticipantRegistry = class {
-  byId = /* @__PURE__ */ new Map();
-  /** Declare a participant. Idempotent — re-joining an existing id updates its label and keeps its
-   *  state, which is what a reconnect is. */
-  join(id, label, now2) {
-    const existing = this.byId.get(id);
-    if (existing) {
-      existing.label = label;
-      return null;
-    }
-    this.byId.set(id, { id, label, active: false, focused: false, joinedAt: now2 });
-    return { kind: "joined", id };
-  }
-  /** It went away — closed, crashed, or its socket dropped. Anything it claimed goes with it: a
-   *  process that died is not frontmost, and leaving that behind would make the machine look
-   *  permanently attended. */
-  leave(id) {
-    return this.byId.delete(id) ? { kind: "left", id } : null;
-  }
-  /** Frontmost, as reported by the participant itself. */
-  setActive(id, active2) {
-    const p = this.byId.get(id);
-    if (!p || p.active === active2)
-      return null;
-    p.active = active2;
-    return { kind: active2 ? "activated" : "deactivated", id };
-  }
-  setFocused(id, focused) {
-    const p = this.byId.get(id);
-    if (!p || p.focused === focused)
-      return null;
-    p.focused = focused;
-    return { kind: focused ? "window-focus" : "window-blur", id };
-  }
-  /**
-   * Is anybody at this machine?
-   *
-   * The union, deliberately. With a single boolean, two participants taking and losing focus in
-   * sequence leave the answer set by whichever spoke last — so the desktop app blurring would
-   * report an empty machine while somebody sits in front of the Remote Desktop window.
-   */
-  anyonePresent() {
-    for (const p of this.byId.values())
-      if (p.active || p.focused)
-        return true;
-    return false;
-  }
-  /** Who is accounted for. Lets a caller tell "nobody is here" from "nobody has reported". */
-  participants() {
-    return [...this.byId.values()].map((p) => ({ ...p }));
-  }
-  has(id) {
-    return this.byId.has(id);
-  }
-  clear() {
-    this.byId.clear();
+  clear() {
+    this.byId.clear();
   }
 };
 
@@ -114981,269 +115056,930 @@ async function probeOnce(url2) {
         }
       };
       try {
-        const req = en.request({ method: "HEAD", url: url2 });
-        const t = setTimeout(() => {
-          try {
-            req.abort();
-          } catch {
-          }
-          done(false);
-        }, PROBE_TIMEOUT_MS2);
-        t.unref?.();
-        req.on("response", () => {
-          clearTimeout(t);
-          done(true);
-        });
-        req.on("error", () => {
-          clearTimeout(t);
-          done(false);
-        });
-        req.end();
+        const req = en.request({ method: "HEAD", url: url2 });
+        const t = setTimeout(() => {
+          try {
+            req.abort();
+          } catch {
+          }
+          done(false);
+        }, PROBE_TIMEOUT_MS2);
+        t.unref?.();
+        req.on("response", () => {
+          clearTimeout(t);
+          done(true);
+        });
+        req.on("error", () => {
+          clearTimeout(t);
+          done(false);
+        });
+        req.end();
+      } catch {
+        done(false);
+      }
+    });
+  }
+  try {
+    await fetch(url2, { method: "HEAD", signal: AbortSignal.timeout(PROBE_TIMEOUT_MS2) });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function probeNetwork() {
+  const started2 = Date.now();
+  const results = await Promise.all(PROBE_URLS.map((u) => probeOnce(u)));
+  const reachable = results.some(Boolean);
+  emitSystemEvent({ type: "net:probe", reachable, ms: Date.now() - started2 });
+  if (reachable !== state2.online)
+    emitSystemEvent({ type: reachable ? "net:online" : "net:offline", evidence: "probed" });
+  return reachable;
+}
+function startNetworkProbing(requester = "daemon") {
+  wanted.add(requester);
+  if (probing)
+    return;
+  probing = true;
+  probeAttempt = 0;
+  scheduleProbe(0);
+}
+function stopNetworkProbing(requester) {
+  if (requester !== void 0) {
+    wanted.delete(requester);
+    if (wanted.size > 0)
+      return;
+  } else {
+    wanted.clear();
+  }
+  probing = false;
+  if (probeTimer) {
+    clearTimeout(probeTimer);
+    probeTimer = null;
+  }
+  probeAttempt = 0;
+}
+var probeTimer = null;
+var probeAttempt = 0;
+var probing = false;
+var wanted = /* @__PURE__ */ new Set();
+function scheduleProbe(delayMs) {
+  if (probeTimer)
+    clearTimeout(probeTimer);
+  probeTimer = setTimeout(() => {
+    void runProbeCycle();
+  }, delayMs);
+  probeTimer.unref?.();
+}
+async function runProbeCycle() {
+  probeTimer = null;
+  if (!probing)
+    return;
+  const ok = await probeNetwork();
+  if (!probing)
+    return;
+  if (ok) {
+    probing = false;
+    probeAttempt = 0;
+    wanted.clear();
+    return;
+  }
+  scheduleProbe(probeDelayMs(probeAttempt++));
+}
+function addressFingerprint() {
+  const out = [];
+  for (const [name, addrs] of Object.entries(networkInterfaces())) {
+    for (const a of addrs ?? [])
+      if (!a.internal)
+        out.push(`${name}:${a.address}`);
+  }
+  return out.sort();
+}
+function readLidClosed() {
+  if (platform2() !== "darwin")
+    return Promise.resolve(null);
+  return new Promise((resolve16) => {
+    execFile8("ioreg", ["-r", "-k", "AppleClamshellState", "-d", "4"], { timeout: 4e3 }, (err2, stdout) => {
+      resolve16(err2 ? null : parseClamshell(stdout ?? ""));
+    });
+  });
+}
+function parseClamshell(stdout) {
+  const m = /"AppleClamshellState"\s*=\s*(Yes|No)/.exec(stdout);
+  return m ? m[1] === "Yes" : null;
+}
+var TICK_MS = 1e4;
+var CLOCK_JUMP_MS = TICK_MS * 3;
+var LID_EVERY_TICKS = 3;
+var stops = [];
+var started = false;
+function startSystemEvents(opts = {}) {
+  if (started)
+    return;
+  started = true;
+  const log10 = opts.log ?? (() => {
+  });
+  const el2 = electronModule();
+  emitSystemEvent({ type: "process:started", pid: process.pid, version: opts.version ?? "dev", headless: !el2 });
+  const pm = el2?.powerMonitor;
+  if (pm?.on) {
+    const wire = (name, make) => {
+      const h = () => {
+        emitSystemEvent(make());
+      };
+      try {
+        pm.on(name, h);
+        stops.push(() => {
+          try {
+            pm.removeListener(name, h);
+          } catch {
+          }
+        });
+      } catch {
+      }
+    };
+    wire("suspend", () => ({ type: "power:suspend" }));
+    wire("resume", () => ({ type: "power:resume" }));
+    wire("on-ac", () => ({ type: "power:on-ac" }));
+    wire("on-battery", () => ({ type: "power:on-battery" }));
+    wire("lock-screen", () => ({ type: "power:lock-screen" }));
+    wire("unlock-screen", () => ({ type: "power:unlock-screen" }));
+    wire("user-did-become-active", () => ({ type: "power:user-active" }));
+    wire("user-did-resign-active", () => ({ type: "power:user-idle", idleSeconds: pm.getSystemIdleTime?.() ?? 0 }));
+    wire("shutdown", () => ({ type: "power:os-shutdown" }));
+    wire("thermal-state-change", () => ({ type: "power:thermal", state: pm.getCurrentThermalState?.() ?? "unknown" }));
+    if (typeof pm.onBatteryPower === "boolean")
+      emitSystemEvent({ type: pm.onBatteryPower ? "power:on-battery" : "power:on-ac" });
+  }
+  if (el2?.screen?.on) {
+    const count = () => {
+      try {
+        return el2.screen.getAllDisplays().length;
+      } catch {
+        return 0;
+      }
+    };
+    const wireScreen = (name, type) => {
+      const h = () => {
+        emitSystemEvent({ type, count: count() });
+      };
+      try {
+        el2.screen.on(name, h);
+        stops.push(() => {
+          try {
+            el2.screen.removeListener?.(name, h);
+          } catch {
+          }
+        });
+      } catch {
+      }
+    };
+    wireScreen("display-added", "display:added");
+    wireScreen("display-removed", "display:removed");
+    wireScreen("display-metrics-changed", "display:changed");
+    state2.displays = count();
+  }
+  if (el2?.app?.on) {
+    const wireApp = (name, fire) => {
+      try {
+        el2.app.on(name, fire);
+        stops.push(() => {
+          try {
+            el2.app.removeListener?.(name, fire);
+          } catch {
+          }
+        });
+      } catch {
+      }
+    };
+    joinParticipant(DAEMON_PARTICIPANT, "Tesseract daemon");
+    wireApp("activate", () => reportParticipantActive(DAEMON_PARTICIPANT, true));
+    wireApp("did-become-active", () => reportParticipantActive(DAEMON_PARTICIPANT, true));
+    wireApp("did-resign-active", () => reportParticipantActive(DAEMON_PARTICIPANT, false));
+    wireApp("browser-window-focus", () => reportParticipantFocus(DAEMON_PARTICIPANT, true));
+    wireApp("browser-window-blur", () => reportParticipantFocus(DAEMON_PARTICIPANT, false));
+  }
+  if (el2?.nativeTheme?.on) {
+    const h = () => {
+      emitSystemEvent({ type: "theme:changed", dark: !!el2.nativeTheme?.shouldUseDarkColors });
+    };
+    try {
+      el2.nativeTheme.on("updated", h);
+      stops.push(() => {
+        try {
+          el2.nativeTheme?.removeListener?.("updated", h);
+        } catch {
+        }
+      });
+    } catch {
+    }
+  }
+  let lastTick = Date.now();
+  let addresses = addressFingerprint();
+  let ticks = 0;
+  const tick = setInterval(() => {
+    const now2 = Date.now();
+    const drift = now2 - lastTick;
+    lastTick = now2;
+    if (drift > CLOCK_JUMP_MS)
+      emitSystemEvent({ type: "power:clock-jump", missedMs: drift - TICK_MS });
+    const next = addressFingerprint();
+    if (next.join("|") !== addresses.join("|")) {
+      addresses = next;
+      emitSystemEvent({ type: "net:interfaces-changed", addresses: next });
+      void probeNetwork().catch(() => {
+      });
+    }
+    if (++ticks % LID_EVERY_TICKS === 0) {
+      void readLidClosed().then((closed) => {
+        if (closed === null || closed === state2.lidClosed)
+          return;
+        emitSystemEvent({ type: closed ? "lid:closed" : "lid:opened" });
+      }).catch(() => {
+      });
+    }
+  }, TICK_MS);
+  tick.unref?.();
+  stops.push(() => clearInterval(tick));
+  try {
+    const osOnline = el2?.net?.isOnline?.();
+    if (typeof osOnline === "boolean")
+      reportOsOnline(osOnline);
+  } catch {
+  }
+  log10(`system events: watching (${el2 ? "electron" : "headless"})`);
+}
+function stopSystemEvents() {
+  for (const s of stops) {
+    try {
+      s();
+    } catch {
+    }
+  }
+  stops = [];
+  stopNetworkProbing();
+  leaveParticipant(DAEMON_PARTICIPANT);
+  started = false;
+}
+
+// ../../packages/host-core/dist/rdesk/wayland-input.js
+function isWaylandSession() {
+  return process.platform === "linux" && (process.env.XDG_SESSION_TYPE === "wayland" || !!process.env.WAYLAND_DISPLAY);
+}
+var BTN = { left: 272, right: 273, middle: 274 };
+async function createWaylandInputProvider(onUnavailable) {
+  const fail4 = (reason) => {
+    onUnavailable?.(reason);
+    return null;
+  };
+  if (!isWaylandSession())
+    return fail4("not a Wayland session");
+  let dbus = null;
+  try {
+    dbus = await import("dbus-next");
+  } catch (e) {
+    return fail4(`dbus-next could not be loaded: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  try {
+    const bus = dbus.sessionBus();
+    const obj = await bus.getProxyObject("org.freedesktop.portal.Desktop", "/org/freedesktop/portal/desktop");
+    const portal = obj.getInterface("org.freedesktop.portal.RemoteDesktop");
+    const sessionHandle = await establishSession(portal);
+    if (!sessionHandle)
+      return fail4(`the RemoteDesktop portal did not grant a session${lastSessionError ? ` (${lastSessionError})` : " (Start was refused, or nobody answered its consent prompt on that machine)"}`);
+    const opts = {};
+    return {
+      pointerMotionAbsolute: (x, y, w, h) => void portal.NotifyPointerMotionAbsolute(sessionHandle, opts, 0, x / Math.max(1, w), y / Math.max(1, h)).catch(() => {
+      }),
+      pointerButton: (b, down) => void portal.NotifyPointerButton(sessionHandle, opts, b, down ? 1 : 0).catch(() => {
+      }),
+      pointerAxis: (dx, dy) => void portal.NotifyPointerAxis(sessionHandle, opts, dx, dy).catch(() => {
+      }),
+      keyboardKeycode: (k, down) => void portal.NotifyKeyboardKeycode(sessionHandle, opts, k, down ? 1 : 0).catch(() => {
+      }),
+      keyboardKeysym: (ks, down) => void portal.NotifyKeyboardKeysym(sessionHandle, opts, ks, down ? 1 : 0).catch(() => {
+      }),
+      close: () => {
+      }
+    };
+  } catch (e) {
+    return fail4(`the RemoteDesktop portal is not reachable: ${e instanceof Error ? e.message : String(e)}`);
+  }
+}
+var lastSessionError = "";
+async function establishSession(portal) {
+  try {
+    const token4 = "tesseract" + Math.floor(Date.now() % 1e6);
+    await portal.CreateSession({ session_handle_token: token4, handle_token: token4 });
+    const session = `/org/freedesktop/portal/desktop/session/${token4}`;
+    await portal.SelectDevices(session, { types: 3, handle_token: token4 + "s" });
+    await portal.Start(session, "", { handle_token: token4 + "g" });
+    return session;
+  } catch (e) {
+    lastSessionError = e instanceof Error ? e.message : String(e);
+    return null;
+  }
+}
+var KEYSYM = {
+  // Modifiers
+  shift: 65505,
+  ctrl: 65507,
+  alt: 65513,
+  cmd: 65515,
+  // Shift_L, Control_L, Alt_L, Super_L
+  // Named keys
+  enter: 65293,
+  tab: 65289,
+  escape: 65307,
+  backspace: 65288,
+  delete: 65535,
+  space: 32,
+  up: 65362,
+  down: 65364,
+  left: 65361,
+  right: 65363,
+  home: 65360,
+  end: 65367,
+  pageup: 65365,
+  pagedown: 65366,
+  insert: 65379,
+  f1: 65470,
+  f2: 65471,
+  f3: 65472,
+  f4: 65473,
+  f5: 65474,
+  f6: 65475,
+  f7: 65476,
+  f8: 65477,
+  f9: 65478,
+  f10: 65479,
+  f11: 65480,
+  f12: 65481
+};
+function charKeysym(ch) {
+  const cp2 = ch.codePointAt(0) ?? 0;
+  if (cp2 === 0)
+    return 0;
+  return cp2 <= 255 ? cp2 : 16777216 + cp2;
+}
+function tokenKeysym(token4) {
+  const t = token4.trim().toLowerCase();
+  if (KEYSYM[t] !== void 0)
+    return KEYSYM[t];
+  return t.length === 1 ? charKeysym(t) : 0;
+}
+function waylandInputRunner(p, screen) {
+  const w = () => screen.w, h = () => screen.h;
+  return {
+    async mouseMove(pt) {
+      p.pointerMotionAbsolute(pt.x, pt.y, w(), h());
+    },
+    async mouseClick(o) {
+      if (o.at)
+        p.pointerMotionAbsolute(o.at.x, o.at.y, w(), h());
+      const b = BTN[o.button ?? "left"];
+      const click = () => {
+        p.pointerButton(b, true);
+        p.pointerButton(b, false);
+      };
+      click();
+      if (o.double)
+        click();
+    },
+    async scroll(o) {
+      p.pointerAxis(o.dx ?? 0, o.dy ?? 0);
+    },
+    async typeText(text13) {
+      for (const ch of text13) {
+        const ks = charKeysym(ch);
+        if (!ks)
+          continue;
+        p.keyboardKeysym(ks, true);
+        p.keyboardKeysym(ks, false);
+      }
+    },
+    async pressKeys(combo) {
+      const parts = combo.split("+").map((x) => x.trim()).filter(Boolean);
+      if (!parts.length)
+        return;
+      const key2 = tokenKeysym(parts[parts.length - 1]);
+      const mods = parts.slice(0, -1).map(tokenKeysym).filter((k) => k > 0);
+      if (!key2)
+        return;
+      for (const m of mods)
+        p.keyboardKeysym(m, true);
+      p.keyboardKeysym(key2, true);
+      p.keyboardKeysym(key2, false);
+      for (const m of [...mods].reverse())
+        p.keyboardKeysym(m, false);
+    }
+  };
+}
+
+// ../../packages/host-core/dist/rdesk/host-clipboard.js
+init_dist2();
+import { statSync as statSync19 } from "node:fs";
+import { basename as basename13 } from "node:path";
+function readHostClipboardFilePaths() {
+  const el2 = electronModule();
+  const clip2 = el2?.clipboard;
+  if (!clip2)
+    return [];
+  try {
+    return readFilePathsWith((f) => clip2.read(f));
+  } catch {
+    return [];
+  }
+}
+function describeClipFiles(paths) {
+  const out = [];
+  for (const p of paths) {
+    try {
+      const st = statSync19(p);
+      out.push({ path: p, name: basename13(p), isDir: st.isDirectory(), size: st.isDirectory() ? 0 : st.size });
+    } catch {
+    }
+  }
+  return out;
+}
+function watchHostClipboardFiles(onChange, intervalMs = 1500) {
+  let last = "";
+  let stopped2 = false;
+  const tick = () => {
+    if (stopped2)
+      return;
+    const paths = readHostClipboardFilePaths();
+    const key2 = paths.join("\0");
+    if (key2 === last)
+      return;
+    last = key2;
+    onChange(paths.length ? describeClipFiles(paths) : []);
+  };
+  const timer2 = setInterval(tick, intervalMs);
+  timer2.unref?.();
+  return () => {
+    stopped2 = true;
+    clearInterval(timer2);
+  };
+}
+
+// ../../packages/host-core/dist/rdesk/tesseract-engine.js
+var TesseractEngine = class {
+  id = "tesseract";
+  ctx;
+  deps;
+  pub = null;
+  injector = null;
+  /** Windows SendInput backend (win32 only) — the injector routes through it instead of libnut. */
+  win = null;
+  /** Unsubscribe from the machine lock/unlock watch (see start()). */
+  stopLockWatch = null;
+  /** Stops the host-clipboard file watcher for this session (see host-clipboard.ts). */
+  stopClipWatch = null;
+  monitorId = "";
+  sourceId = "";
+  // active capture source (screen or window)
+  quality = "auto";
+  systemAudio = false;
+  access;
+  constructor(ctx2, deps) {
+    this.ctx = ctx2;
+    this.deps = deps;
+    this.access = ctx2.accessLevel;
+  }
+  /**
+   * What this session can ACTUALLY do, derived at runtime.
+   *
+   * This used to be a hardcoded constant returned identically on every platform, so a
+   * viewer was told `input: true` by a Wayland host that cannot inject a keystroke, and
+   * offered a system-audio toggle on macOS where the capture is known to be silent. A
+   * capability flag that doesn't track reality is worse than no flag: the viewer renders
+   * a control that quietly does nothing.
+   */
+  capabilities() {
+    return {
+      // False until an input runner was actually obtained (see start()): on Wayland
+      // without the portal, control is impossible and the session is view-only.
+      input: !!this.injector,
+      clipboard: true,
+      // No drag/drop or upload surface exists inside an rdesk session today. It was
+      // advertised as if it did; nothing in either viewer ever read it.
+      fileTransfer: false,
+      multiMonitor: true,
+      windowCapture: true,
+      // share a single window/app (privacy)
+      // Voice now rides this session's own peer connection (setAv).
+      bidiAudioVideo: true,
+      // Windows/Linux capture desktop audio natively; macOS needs a loopback we don't
+      // ship, so claiming it there just produces a toggle that yields silence.
+      systemAudio: process.platform !== "darwin"
+    };
+  }
+  listMonitors() {
+    return listPublisherMonitors();
+  }
+  listSources() {
+    return listPublisherSources();
+  }
+  startOpts(iceServers) {
+    return { iceServers, quality: this.quality, systemAudio: this.systemAudio };
+  }
+  async setSource(sourceId) {
+    this.sourceId = sourceId;
+    const origin = sourceId.startsWith("screen:") ? this.originForActiveScreen() : { x: 0, y: 0 };
+    this.injector?.setOrigin(origin);
+    const iceServers = await this.deps.getIceServers().catch(() => []);
+    await this.pub?.setSource(sourceId, this.startOpts(iceServers));
+  }
+  originForActiveScreen() {
+    const b = displayBoundsById(this.monitorId);
+    return b ? { x: b.x, y: b.y } : { x: 0, y: 0 };
+  }
+  /**
+   * Tell the viewer the machine is LOCKED, using the daemon's existing lock/unlock watch.
+   *
+   * When Windows locks (or shows a UAC / Ctrl-Alt-Del secure desktop) capture goes black and any
+   * injected input is silently dropped — a user process cannot reach the secure desktop. The viewer
+   * would otherwise see a black rectangle and a "the display may be asleep" guess. Reporting an
+   * accurate capture-lost with the real cause replaces that guess; on unlock we clear it. Held keys
+   * are also released, so a modifier down when the lock hit doesn't stick. Enabled on every platform
+   * (the events are cross-platform); the wording names the Windows secure desktop where it applies.
+   */
+  startLockWatch() {
+    const lockedMsg = process.platform === "win32" ? "This computer is locked (Windows secure desktop). Its screen can\u2019t be shared and input is paused until someone signs in." : "This computer is locked. Its screen can\u2019t be shared until someone signs in.";
+    try {
+      if (systemState().screenLocked === true)
+        this.ctx.onCapture?.(false, lockedMsg);
+    } catch {
+    }
+    this.stopLockWatch = onSystemEvent((e) => {
+      if (e.event.type === "power:lock-screen") {
+        this.injector?.releaseAll();
+        this.ctx.onCapture?.(false, lockedMsg);
+      } else if (e.event.type === "power:unlock-screen") {
+        this.ctx.onCapture?.(true, "");
+      }
+    });
+  }
+  async start(opts) {
+    const monitors = await listPublisherMonitors();
+    this.monitorId = opts.monitorId ?? monitors.find((m) => m.primary)?.id ?? monitors[0]?.id ?? "";
+    this.quality = opts.quality ?? "auto";
+    this.sourceId = await sourceIdForMonitor(this.monitorId).catch(() => "");
+    const origin = displayBoundsById(this.monitorId) ?? { x: 0, y: 0, width: 0, height: 0 };
+    let runner2;
+    if (this.deps.makeRunner) {
+      runner2 = this.deps.makeRunner();
+    } else if (isWaylandSession()) {
+      let waylandReason = "";
+      const wp = await createWaylandInputProvider((r) => {
+        waylandReason = r;
+      });
+      if (wp) {
+        const m = monitors.find((x) => x.id === this.monitorId) ?? monitors[0];
+        runner2 = waylandInputRunner(wp, { w: m?.width ?? origin.width, h: m?.height ?? origin.height });
+        this.ctx.log("rdesk: Wayland input via XDG RemoteDesktop portal.");
+      } else {
+        this.ctx.log(`rdesk: Wayland \u2014 keyboard and mouse unavailable, streaming view-only. Reason: ${waylandReason || "unknown"}`);
+        runner2 = createDaemonOsControlRunner();
+      }
+    } else {
+      runner2 = createDaemonOsControlRunner();
+    }
+    let winBinding = null;
+    if (!this.deps.makeRunner && process.platform === "win32") {
+      const win3 = createWinInput({ log: (m) => this.ctx.log(m) });
+      if (win3) {
+        this.win = win3;
+        void win3.warm();
+        winBinding = { api: win3, toFraction: (p) => virtualDesktopFraction(p) };
+      }
+    }
+    this.injector = new RdeskInputInjector(runner2, { x: origin.x, y: origin.y }, this.ctx.accessLevel, winBinding);
+    this.startLockWatch();
+    const iceServers = await this.deps.getIceServers().catch(() => []);
+    const pub = new PublisherWindow(this.ctx.sessionId, {
+      onOffer: (sdp) => this.ctx.sendSignal({ type: "signal:offer", sdp }),
+      onIce: (candidate) => this.ctx.sendSignal({ type: "signal:ice", candidate }),
+      onInput: (ev) => void this.injector?.apply(ev),
+      // Clipboard sync (Phase 6): write the viewer's clipboard onto the host so ⌘V pastes
+      // into the remote machine. Gated by control access (view-only never writes).
+      onClipboard: (text13) => {
+        if (this.access === "control") {
+          const el2 = electronModule();
+          try {
+            el2?.clipboard?.writeText(text13);
+          } catch {
+          }
+        }
+      },
+      onReady: () => this.ctx.log("publisher connected"),
+      onError: (err2) => {
+        this.ctx.log(`publisher error: ${err2}`);
+        this.ctx.sendControl({ type: "rdesk:closed", reason: "network" });
+      },
+      // Media is direct-first; log which path actually won so a regression to relay
+      // (which costs real bandwidth) is visible instead of silent. Types only, no IPs.
+      onCapture: (ok, message) => {
+        this.ctx.log(`capture ${ok ? "ok" : `LOST \u2014 ${message}`}`);
+        this.ctx.onCapture?.(ok, message);
+      },
+      onPath: (path6, d) => {
+        this.ctx.log(`media path=${path6} (local=${d.localType ?? "?"} remote=${d.remoteType ?? "?"})`);
+        this.ctx.onPath?.(path6, d);
+      }
+    });
+    this.pub = pub;
+    this.stopClipWatch = watchHostClipboardFiles((files) => {
+      if (this.access !== "control")
+        return;
+      this.pub?.sendData({ t: "clipboard-files", files });
+    });
+    await pub.start({
+      iceServers,
+      monitorId: this.monitorId,
+      quality: this.quality,
+      systemAudio: this.systemAudio
+    });
+  }
+  onSignal(msg) {
+    if (!this.pub)
+      return;
+    if (msg.type === "signal:answer")
+      this.pub.answer(msg.sdp);
+    else if (msg.type === "signal:ice")
+      this.pub.addIce(msg.candidate);
+  }
+  applyInput(ev) {
+    void this.injector?.apply(ev);
+  }
+  setAccessLevel(level) {
+    this.access = level;
+    this.injector?.setAccess(level);
+  }
+  async setMonitor(monitorId) {
+    this.monitorId = monitorId;
+    this.sourceId = await sourceIdForMonitor(monitorId).catch(() => this.sourceId);
+    const origin = displayBoundsById(monitorId);
+    if (origin && this.injector)
+      this.injector.setOrigin({ x: origin.x, y: origin.y });
+    const iceServers = await this.deps.getIceServers().catch(() => []);
+    await this.pub?.setMonitor(monitorId, this.startOpts(iceServers));
+  }
+  setAv(on) {
+    this.pub?.setAv(on);
+  }
+  setQuality(preset) {
+    this.quality = preset;
+    this.pub?.setQuality(preset);
+  }
+  setMute(m) {
+    if (typeof m.systemAudio === "boolean" && m.systemAudio !== this.systemAudio && this.sourceId) {
+      this.systemAudio = m.systemAudio;
+      void this.deps.getIceServers().catch(() => []).then((ice) => this.pub?.setSource(this.sourceId, this.startOpts(ice)));
+    }
+  }
+  async stop() {
+    this.stopClipWatch?.();
+    this.stopClipWatch = null;
+    this.stopLockWatch?.();
+    this.stopLockWatch = null;
+    this.injector?.releaseAll();
+    await this.pub?.stop();
+    this.pub = null;
+    this.injector = null;
+    await this.win?.stop();
+    this.win = null;
+  }
+};
+function registerTesseractEngine(deps) {
+  registerRdeskEngine("tesseract", (ctx2) => new TesseractEngine(ctx2, deps));
+}
+
+// ../../packages/host-core/dist/local-server.js
+import { timingSafeEqual as timingSafeEqual5 } from "node:crypto";
+
+// ../../packages/host-core/dist/in-process-link.js
+var OPEN = 1;
+var CLOSED = 3;
+var InProcSocket = class {
+  OPEN = OPEN;
+  CLOSED = CLOSED;
+  readyState = OPEN;
+  peer = null;
+  listeners = /* @__PURE__ */ new Map();
+  on(event, cb) {
+    let s = this.listeners.get(event);
+    if (!s) {
+      s = /* @__PURE__ */ new Set();
+      this.listeners.set(event, s);
+    }
+    s.add(cb);
+    return this;
+  }
+  once(event, cb) {
+    const wrap = (...a) => {
+      this.off(event, wrap);
+      cb(...a);
+    };
+    return this.on(event, wrap);
+  }
+  off(event, cb) {
+    this.listeners.get(event)?.delete(cb);
+    return this;
+  }
+  removeListener(event, cb) {
+    return this.off(event, cb);
+  }
+  fire(event, ...args) {
+    const s = this.listeners.get(event);
+    if (!s)
+      return;
+    for (const cb of [...s]) {
+      try {
+        cb(...args);
       } catch {
-        done(false);
       }
-    });
+    }
   }
-  try {
-    await fetch(url2, { method: "HEAD", signal: AbortSignal.timeout(PROBE_TIMEOUT_MS2) });
-    return true;
-  } catch {
-    return false;
+  /** Deliver `data` to the PEER's 'message' listeners on the next macrotask. */
+  send(data) {
+    const peer = this.peer;
+    if (!peer || peer.readyState !== OPEN)
+      return;
+    setImmediate(() => {
+      if (peer.readyState === OPEN)
+        peer.fire("message", data);
+    });
   }
-}
-async function probeNetwork() {
-  const started2 = Date.now();
-  const results = await Promise.all(PROBE_URLS.map((u) => probeOnce(u)));
-  const reachable = results.some(Boolean);
-  emitSystemEvent({ type: "net:probe", reachable, ms: Date.now() - started2 });
-  if (reachable !== state2.online)
-    emitSystemEvent({ type: reachable ? "net:online" : "net:offline", evidence: "probed" });
-  return reachable;
-}
-function startNetworkProbing(requester = "daemon") {
-  wanted.add(requester);
-  if (probing)
-    return;
-  probing = true;
-  probeAttempt = 0;
-  scheduleProbe(0);
-}
-function stopNetworkProbing(requester) {
-  if (requester !== void 0) {
-    wanted.delete(requester);
-    if (wanted.size > 0)
+  close(_code, _reason) {
+    if (this.readyState === CLOSED)
       return;
-  } else {
-    wanted.clear();
+    this.readyState = CLOSED;
+    const peer = this.peer;
+    setImmediate(() => this.fire("close"));
+    if (peer && peer.readyState !== CLOSED) {
+      peer.readyState = CLOSED;
+      setImmediate(() => peer.fire("close"));
+    }
   }
-  probing = false;
-  if (probeTimer) {
-    clearTimeout(probeTimer);
-    probeTimer = null;
+  /** @internal wire this end to its peer. */
+  _link(peer) {
+    this.peer = peer;
   }
-  probeAttempt = 0;
+  /** @internal fire 'open' on the next macrotask (client end only; the server never awaits it). */
+  _fireOpen() {
+    setImmediate(() => this.fire("open"));
+  }
+};
+function makeInProcPair() {
+  const serverEnd = new InProcSocket();
+  const clientEnd = new InProcSocket();
+  serverEnd._link(clientEnd);
+  clientEnd._link(serverEnd);
+  return { serverEnd, clientEnd };
 }
-var probeTimer = null;
-var probeAttempt = 0;
-var probing = false;
-var wanted = /* @__PURE__ */ new Set();
-function scheduleProbe(delayMs) {
-  if (probeTimer)
-    clearTimeout(probeTimer);
-  probeTimer = setTimeout(() => {
-    void runProbeCycle();
-  }, delayMs);
-  probeTimer.unref?.();
+var connector = null;
+function setInProcConnector(fn) {
+  connector = fn;
 }
-async function runProbeCycle() {
-  probeTimer = null;
-  if (!probing)
-    return;
-  const ok = await probeNetwork();
-  if (!probing)
-    return;
-  if (ok) {
-    probing = false;
-    probeAttempt = 0;
-    wanted.clear();
-    return;
+
+// ../../packages/host-core/dist/rdesk/server-prefs.js
+init_credentials();
+import { readFileSync as readFileSync44, writeFileSync as writeFileSync29 } from "node:fs";
+import { join as join72 } from "node:path";
+function rdeskServerPrefsPath() {
+  return join72(daemonDir2(), "rdesk-server.json");
+}
+var DEFAULTS2 = {
+  enabled: true,
+  defaultAccess: "control",
+  quality: "auto",
+  autostart: true,
+  hideTray: false,
+  noticeShownAt: 0
+};
+function readRdeskServerPrefs() {
+  try {
+    const p = JSON.parse(readFileSync44(rdeskServerPrefsPath(), "utf8"));
+    return {
+      // `!== false` (not `?? true`): only an explicit opt-out disables sharing, so a
+      // partially-written or older prefs file never silently turns the machine off.
+      enabled: p.enabled !== false,
+      defaultAccess: p.defaultAccess === "view" ? "view" : "control",
+      quality: p.quality ?? DEFAULTS2.quality,
+      autostart: p.autostart ?? DEFAULTS2.autostart,
+      hideTray: p.hideTray ?? DEFAULTS2.hideTray,
+      noticeShownAt: typeof p.noticeShownAt === "number" ? p.noticeShownAt : 0
+    };
+  } catch {
+    return { ...DEFAULTS2 };
   }
-  scheduleProbe(probeDelayMs(probeAttempt++));
 }
-function addressFingerprint() {
-  const out = [];
-  for (const [name, addrs] of Object.entries(networkInterfaces())) {
-    for (const a of addrs ?? [])
-      if (!a.internal)
-        out.push(`${name}:${a.address}`);
+function writeRdeskServerPrefs(patch) {
+  try {
+    const next = { ...readRdeskServerPrefs(), ...patch };
+    writeFileSync29(rdeskServerPrefsPath(), JSON.stringify(next), { mode: 384 });
+  } catch {
   }
-  return out.sort();
 }
-function readLidClosed() {
-  if (platform2() !== "darwin")
-    return Promise.resolve(null);
-  return new Promise((resolve16) => {
-    execFile8("ioreg", ["-r", "-k", "AppleClamshellState", "-d", "4"], { timeout: 4e3 }, (err2, stdout) => {
-      resolve16(err2 ? null : parseClamshell(stdout ?? ""));
-    });
-  });
+function rdeskSharingEnabled() {
+  if (process.env.CCB_RDESK_ENABLED === "0")
+    return false;
+  if (process.env.CCB_RDESK_ENABLED === "1")
+    return true;
+  return readRdeskServerPrefs().enabled;
 }
-function parseClamshell(stdout) {
-  const m = /"AppleClamshellState"\s*=\s*(Yes|No)/.exec(stdout);
-  return m ? m[1] === "Yes" : null;
+
+// ../../packages/host-core/dist/rdesk/password.js
+init_credentials();
+import { scryptSync, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual4, randomInt } from "node:crypto";
+import { readFileSync as readFileSync45, writeFileSync as writeFileSync30, existsSync as existsSync32, unlinkSync as unlinkSync4 } from "node:fs";
+import { join as join73 } from "node:path";
+function pwFile() {
+  return join73(daemonDir2(), "rdesk-password.json");
 }
-var TICK_MS = 1e4;
-var CLOCK_JUMP_MS = TICK_MS * 3;
-var LID_EVERY_TICKS = 3;
-var stops = [];
-var started = false;
-function startSystemEvents(opts = {}) {
-  if (started)
-    return;
-  started = true;
-  const log10 = opts.log ?? (() => {
-  });
-  const el2 = electronModule();
-  emitSystemEvent({ type: "process:started", pid: process.pid, version: opts.version ?? "dev", headless: !el2 });
-  const pm = el2?.powerMonitor;
-  if (pm?.on) {
-    const wire = (name, make) => {
-      const h = () => {
-        emitSystemEvent(make());
-      };
-      try {
-        pm.on(name, h);
-        stops.push(() => {
-          try {
-            pm.removeListener(name, h);
-          } catch {
-          }
-        });
-      } catch {
-      }
-    };
-    wire("suspend", () => ({ type: "power:suspend" }));
-    wire("resume", () => ({ type: "power:resume" }));
-    wire("on-ac", () => ({ type: "power:on-ac" }));
-    wire("on-battery", () => ({ type: "power:on-battery" }));
-    wire("lock-screen", () => ({ type: "power:lock-screen" }));
-    wire("unlock-screen", () => ({ type: "power:unlock-screen" }));
-    wire("user-did-become-active", () => ({ type: "power:user-active" }));
-    wire("user-did-resign-active", () => ({ type: "power:user-idle", idleSeconds: pm.getSystemIdleTime?.() ?? 0 }));
-    wire("shutdown", () => ({ type: "power:os-shutdown" }));
-    wire("thermal-state-change", () => ({ type: "power:thermal", state: pm.getCurrentThermalState?.() ?? "unknown" }));
-    if (typeof pm.onBatteryPower === "boolean")
-      emitSystemEvent({ type: pm.onBatteryPower ? "power:on-battery" : "power:on-ac" });
-  }
-  if (el2?.screen?.on) {
-    const count = () => {
-      try {
-        return el2.screen.getAllDisplays().length;
-      } catch {
-        return 0;
-      }
-    };
-    const wireScreen = (name, type) => {
-      const h = () => {
-        emitSystemEvent({ type, count: count() });
-      };
-      try {
-        el2.screen.on(name, h);
-        stops.push(() => {
-          try {
-            el2.screen.removeListener?.(name, h);
-          } catch {
-          }
-        });
-      } catch {
-      }
-    };
-    wireScreen("display-added", "display:added");
-    wireScreen("display-removed", "display:removed");
-    wireScreen("display-metrics-changed", "display:changed");
-    state2.displays = count();
-  }
-  if (el2?.app?.on) {
-    const wireApp = (name, fire) => {
-      try {
-        el2.app.on(name, fire);
-        stops.push(() => {
-          try {
-            el2.app.removeListener?.(name, fire);
-          } catch {
-          }
-        });
-      } catch {
-      }
-    };
-    joinParticipant(DAEMON_PARTICIPANT, "Tesseract daemon");
-    wireApp("activate", () => reportParticipantActive(DAEMON_PARTICIPANT, true));
-    wireApp("did-become-active", () => reportParticipantActive(DAEMON_PARTICIPANT, true));
-    wireApp("did-resign-active", () => reportParticipantActive(DAEMON_PARTICIPANT, false));
-    wireApp("browser-window-focus", () => reportParticipantFocus(DAEMON_PARTICIPANT, true));
-    wireApp("browser-window-blur", () => reportParticipantFocus(DAEMON_PARTICIPANT, false));
+function pwPlainFile() {
+  return join73(daemonDir2(), "rdesk-password.enc");
+}
+var PW_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789";
+var PW_LENGTH = 16;
+function generatePassword() {
+  let out = "";
+  for (let i = 0; i < PW_LENGTH; i++)
+    out += PW_ALPHABET[randomInt(PW_ALPHABET.length)];
+  return (out.match(/.{1,4}/g) ?? [out]).join("-");
+}
+function writePlain(password) {
+  try {
+    const safe2 = electronModule()?.safeStorage;
+    if (!safe2?.isEncryptionAvailable())
+      return;
+    writeFileSync30(pwPlainFile(), safe2.encryptString(password), { mode: 384 });
+  } catch {
   }
-  if (el2?.nativeTheme?.on) {
-    const h = () => {
-      emitSystemEvent({ type: "theme:changed", dark: !!el2.nativeTheme?.shouldUseDarkColors });
-    };
-    try {
-      el2.nativeTheme.on("updated", h);
-      stops.push(() => {
-        try {
-          el2.nativeTheme?.removeListener?.("updated", h);
-        } catch {
-        }
-      });
-    } catch {
-    }
+}
+function canRevealRdeskPassword() {
+  try {
+    const safe2 = electronModule()?.safeStorage;
+    return !!safe2?.isEncryptionAvailable() && existsSync32(pwPlainFile());
+  } catch {
+    return false;
   }
-  let lastTick = Date.now();
-  let addresses = addressFingerprint();
-  let ticks = 0;
-  const tick = setInterval(() => {
-    const now2 = Date.now();
-    const drift = now2 - lastTick;
-    lastTick = now2;
-    if (drift > CLOCK_JUMP_MS)
-      emitSystemEvent({ type: "power:clock-jump", missedMs: drift - TICK_MS });
-    const next = addressFingerprint();
-    if (next.join("|") !== addresses.join("|")) {
-      addresses = next;
-      emitSystemEvent({ type: "net:interfaces-changed", addresses: next });
-      void probeNetwork().catch(() => {
-      });
-    }
-    if (++ticks % LID_EVERY_TICKS === 0) {
-      void readLidClosed().then((closed) => {
-        if (closed === null || closed === state2.lidClosed)
-          return;
-        emitSystemEvent({ type: closed ? "lid:closed" : "lid:opened" });
-      }).catch(() => {
-      });
-    }
-  }, TICK_MS);
-  tick.unref?.();
-  stops.push(() => clearInterval(tick));
+}
+function readRdeskPasswordPlain() {
   try {
-    const osOnline = el2?.net?.isOnline?.();
-    if (typeof osOnline === "boolean")
-      reportOsOnline(osOnline);
+    const safe2 = electronModule()?.safeStorage;
+    if (!safe2?.isEncryptionAvailable())
+      return null;
+    return safe2.decryptString(readFileSync45(pwPlainFile()));
   } catch {
+    return null;
   }
-  log10(`system events: watching (${el2 ? "electron" : "headless"})`);
 }
-function stopSystemEvents() {
-  for (const s of stops) {
+function setRdeskPassword(password) {
+  if (!password) {
     try {
-      s();
+      unlinkSync4(pwFile());
+    } catch {
+    }
+    try {
+      unlinkSync4(pwPlainFile());
     } catch {
     }
+    return;
+  }
+  const salt = randomBytes5(16);
+  const hash2 = scryptSync(password, salt, 32);
+  writeFileSync30(pwFile(), JSON.stringify({ salt: salt.toString("hex"), hash: hash2.toString("hex") }), { mode: 384 });
+  writePlain(password);
+}
+function regenerateRdeskPassword() {
+  const pw = generatePassword();
+  setRdeskPassword(pw);
+  return pw;
+}
+function ensureRdeskPassword() {
+  if (hasRdeskPassword())
+    return null;
+  return regenerateRdeskPassword();
+}
+function hasRdeskPassword() {
+  return !!process.env.CCB_RDESK_PASSWORD || existsSync32(pwFile());
+}
+function verifyRdeskPassword(password) {
+  if (!password)
+    return false;
+  const override3 = process.env.CCB_RDESK_PASSWORD;
+  if (override3)
+    return password.length === override3.length && timingSafeEqual4(Buffer.from(password), Buffer.from(override3));
+  try {
+    const { salt, hash: hash2 } = JSON.parse(readFileSync45(pwFile(), "utf8"));
+    const got = scryptSync(password, Buffer.from(salt, "hex"), 32);
+    const want = Buffer.from(hash2, "hex");
+    return got.length === want.length && timingSafeEqual4(got, want);
+  } catch {
+    return false;
   }
-  stops = [];
-  stopNetworkProbing();
-  leaveParticipant(DAEMON_PARTICIPANT);
-  started = false;
 }
 
 // ../../packages/host-core/dist/local-server.js
@@ -117859,7 +118595,9 @@ function uninstallCliAgent(log10 = console.log) {
     log10("[cli-agent] uninstalling the tesseract-agent npm package");
     execFileSync4(process.platform === "win32" ? "npm.cmd" : "npm", ["uninstall", "-g", "tesseract-agent"], {
       stdio: ["ignore", "pipe", "pipe"],
-      timeout: 12e4
+      timeout: 12e4,
+      shell: process.platform === "win32",
+      windowsHide: true
     });
     log10("[cli-agent] uninstalled");
     return true;
@@ -120295,6 +121033,7 @@ var realHost = () => hostname5();
 
 // ../../packages/host-core/dist/cli-link/install.js
 import { chmodSync as chmodSync6, existsSync as existsSync40, mkdirSync as mkdirSync39, readFileSync as readFileSync53, writeFileSync as writeFileSync37 } from "node:fs";
+import { spawnSync as spawnSync3 } from "node:child_process";
 import { dirname as dirname33 } from "node:path";
 
 // ../../packages/host-core/dist/cli-link/plan.js
@@ -120363,6 +121102,42 @@ function planCliLink(args) {
 
 // ../../packages/host-core/dist/cli-link/install.js
 init_patched_resources();
+function readUserPath() {
+  const r = spawnSync3("reg", ["query", "HKCU\\Environment", "/v", "Path"], { encoding: "utf8", windowsHide: true });
+  if (r.status !== 0 || !r.stdout)
+    return "";
+  const m = r.stdout.match(/^\s*Path\s+REG_(?:EXPAND_)?SZ\s+(.*)$/im);
+  return m ? m[1].trim() : "";
+}
+function pathHasEntry(pathValue, dir2) {
+  const norm = (s) => s.trim().replace(/\\+$/, "").toLowerCase();
+  const want = norm(dir2);
+  return pathValue.split(";").some((e) => e.trim() !== "" && norm(e) === want);
+}
+function broadcastEnvChange() {
+  const ps2 = [
+    `$s = '[DllImport("user32.dll", SetLastError=true, CharSet=CharSet.Auto)] public static extern IntPtr SendMessageTimeout(IntPtr hWnd, uint Msg, UIntPtr wParam, string lParam, uint fuFlags, uint uTimeout, out UIntPtr lpdwResult);';`,
+    "$t = Add-Type -MemberDefinition $s -Name Win32Env -Namespace Tess -PassThru;",
+    "$r = [UIntPtr]::Zero;",
+    // HWND_BROADCAST=0xffff, WM_SETTINGCHANGE=0x1A, SMTO_ABORTIFHUNG=0x2, 5s timeout.
+    "[void]$t::SendMessageTimeout([IntPtr]0xffff, 0x1A, [UIntPtr]::Zero, 'Environment', 0x2, 5000, [ref]$r);"
+  ].join(" ");
+  try {
+    spawnSync3("powershell", ["-NoProfile", "-NonInteractive", "-Command", ps2], { windowsHide: true, timeout: 15e3 });
+  } catch {
+  }
+}
+function ensureWindowsPathEntry(dir2) {
+  const current = readUserPath();
+  if (pathHasEntry(current, dir2))
+    return { ok: true, added: false };
+  const next = current ? `${current.replace(/;+$/, "")};${dir2}` : dir2;
+  const w = spawnSync3("reg", ["add", "HKCU\\Environment", "/v", "Path", "/t", "REG_EXPAND_SZ", "/d", next, "/f"], { encoding: "utf8", windowsHide: true });
+  if (w.status !== 0)
+    return { ok: false, added: false, reason: (w.stderr || w.stdout || "reg add failed").trim() };
+  broadcastEnvChange();
+  return { ok: true, added: true };
+}
 function installCliShims(args) {
   const plan = planCliLink(args);
   if (!plan)
@@ -120401,6 +121176,12 @@ function installCliShims(args) {
       }
     }
   }
+  if (plan.needsPathEntry && process.platform === "win32" && installed.length > 0) {
+    const pathRes = ensureWindowsPathEntry(plan.dir);
+    if (!pathRes.ok) {
+      return { ok: false, dir: plan.dir, installed, skipped, reason: `shims written but PATH update failed: ${pathRes.reason ?? "unknown"}` };
+    }
+  }
   return { ok: installed.length > 0, dir: plan.dir, installed, skipped };
 }
 function ensureCliOnPath(log10) {
@@ -121577,7 +122358,7 @@ function startRdeskChannelClient(deps) {
     if (sock?.readyState === wrapper_default.OPEN)
       sock.send(JSON.stringify({ channel: "rdeskhost", payload }));
   };
-  const scheduleRetry = () => {
+  const scheduleRetry2 = () => {
     if (stopped2 || retry)
       return;
     retry = setTimeout(() => {
@@ -121591,7 +122372,7 @@ function startRdeskChannelClient(deps) {
       return;
     const url2 = readEndpoint(deps.daemonDir(), deps.selfPid);
     if (!url2) {
-      scheduleRetry();
+      scheduleRetry2();
       return;
     }
     const ws = new wrapper_default(url2);
@@ -121646,7 +122427,7 @@ function startRdeskChannelClient(deps) {
         return;
       sock = null;
       setHolding(false, "disconnected");
-      scheduleRetry();
+      scheduleRetry2();
     };
     ws.on("close", drop);
     ws.on("error", () => {
@@ -122281,11 +123062,28 @@ async function homeFor(hostId) {
   }
   return null;
 }
-async function resolveTarget(urlPath) {
-  const segs = urlPath.split("/").filter(Boolean).map((s) => decodeURIComponent(s));
-  if (segs.length === 0 || segs[0] !== token2)
+function safeDecode3(s) {
+  try {
+    return decodeURIComponent(s);
+  } catch {
     return null;
-  if (segs.some((seg) => seg === ".." || seg === "." || seg.includes("\0")))
+  }
+}
+function decodeSegs(urlPath) {
+  const segs = [];
+  for (const raw of urlPath.split("/").filter(Boolean)) {
+    const d = safeDecode3(raw);
+    if (d === null)
+      return null;
+    if (d === ".." || d === "." || /[\\/:\0]/.test(d))
+      return null;
+    segs.push(d);
+  }
+  return segs;
+}
+async function resolveTarget(urlPath) {
+  const segs = decodeSegs(urlPath);
+  if (!segs || segs.length === 0 || segs[0] !== token2)
     return null;
   const rest = segs.slice(1);
   if (rest.length === 0)
@@ -122300,7 +123098,11 @@ async function resolveTarget(urlPath) {
   if (!home)
     return null;
   const rel = rest.slice(1);
-  return { kind: "path", hostId, label, remote: `${home.replace(/\/+$/, "")}/${rel.join("/")}`, rel };
+  const base = home.replace(/\/+$/, "");
+  const remote = `${base}/${rel.join("/")}`;
+  if (remote !== base && !remote.startsWith(`${base}/`))
+    return null;
+  return { kind: "path", hostId, label, remote, rel };
 }
 async function remotePathOf(t) {
   if (t.kind === "machine")
@@ -122322,10 +123124,8 @@ var href = (segs) => "/" + segs.map((s) => encodeURIComponent(s)).join("/");
 function propfindXml(entries) {
   const body = entries.map((e) => {
     const mtime = new Date(e.mtimeMs ?? Date.now()).toUTCString();
-    const iso = new Date(e.mtimeMs ?? Date.now()).toISOString();
-    const name = e.segs[e.segs.length - 1] ?? "Tesseract";
     const props = e.isDir ? `<D:resourcetype><D:collection/></D:resourcetype>` : `<D:resourcetype/><D:getcontentlength>${e.size ?? 0}</D:getcontentlength>`;
-    return `<D:response><D:href>${xmlEscape(href(e.segs))}${e.isDir ? "/" : ""}</D:href><D:propstat><D:prop><D:displayname>${xmlEscape(name)}</D:displayname><D:getlastmodified>${mtime}</D:getlastmodified><D:creationdate>${iso}</D:creationdate>` + props + `</D:prop><D:status>HTTP/1.1 200 OK</D:status></D:propstat></D:response>`;
+    return `<D:response><D:href>${xmlEscape(href(e.segs))}${e.isDir ? "/" : ""}</D:href><D:propstat><D:prop><D:getlastmodified>${mtime}</D:getlastmodified>` + props + `</D:prop><D:status>HTTP/1.1 200 OK</D:status></D:propstat></D:response>`;
   }).join("");
   return `<?xml version="1.0" encoding="utf-8"?><D:multistatus xmlns:D="DAV:">${body}</D:multistatus>`;
 }
@@ -122517,7 +123317,7 @@ async function route2(req, res) {
     send4(res, 404, "not found", DAV_HEADERS);
     return;
   }
-  const urlSegs = urlPath.split("/").filter(Boolean).map((s) => decodeURIComponent(s));
+  const urlSegs = decodeSegs(urlPath) ?? [];
   switch (method) {
     case "PROPFIND":
       await handlePropfind(req, res, t, urlSegs);
@@ -122595,7 +123395,7 @@ function bind(i) {
   s.on("listening", () => {
     server = s;
     boundPort = port;
-    log8(`file-share (WebDAV) listening on http://127.0.0.1:${port}/${token2}/`);
+    log8(`file-share (WebDAV) listening on http://127.0.0.1:${port}/ (token redacted)`);
   });
   s.on("error", (e) => {
     if (e.code === "EADDRINUSE") {
@@ -122648,6 +123448,15 @@ var run3 = promisify6(execFile10);
 var OPTS = { timeout: 2e4, windowsHide: true };
 var mounted = false;
 var mountedAt = null;
+var RETRY_MS = 6e4;
+var MAX_ATTEMPTS = 5;
+var retryTimer = null;
+var attempts = 0;
+function redact(s) {
+  const tok = fileShareToken();
+  const out = tok ? s.split(tok).join("<token>") : s;
+  return out.replace(/([/\\])[0-9a-f]{32}(?=[/\\"'\s]|$)/gi, "$1<token>");
+}
 function davUri() {
   const port = fileSharePort();
   const token4 = fileShareToken();
@@ -122675,44 +123484,135 @@ async function mountLinux(log10) {
     const msg = String(e.message || "");
     if (/already mounted/i.test(msg)) {
     } else if (/not found|ENOENT/i.test(msg)) {
-      log10(`file-share: gio not available \u2014 install gvfs-backends to mount ${uri} in Files`);
+      log10(`file-share: gio not available \u2014 install gvfs-backends to mount ${redact(uri)} in Files`);
       return false;
     } else if (/No such interface|not supported|dav/i.test(msg)) {
-      log10(`file-share: GVfs has no dav backend \u2014 install gvfs-backends (${msg.split("\n")[0]})`);
+      log10(`file-share: GVfs has no dav backend \u2014 install gvfs-backends (${redact(msg.split("\n")[0])})`);
       return false;
     } else {
-      log10(`file-share: gio mount failed: ${msg.split("\n")[0]}`);
+      log10(`file-share: gio mount failed: ${redact(msg.split("\n")[0])}`);
       return false;
     }
   }
   addGtkBookmark(uri, "Tesseract");
   mountedAt = uri;
-  log10(`file-share: mounted in Files (GVfs) \u2192 ${uri}`);
+  log10(`file-share: mounted in Files (GVfs) \u2192 ${redact(uri)}`);
   return true;
 }
+function runWin(cmd, args) {
+  return new Promise((resolve16) => {
+    execFile10(cmd, args, { ...OPTS, encoding: "buffer", maxBuffer: 8 * 1024 * 1024 }, (err2, stdout, stderr) => {
+      const e = err2;
+      const combined = Buffer.concat([stderr ?? Buffer.alloc(0), stdout ?? Buffer.alloc(0)]).toString("latin1").trim();
+      const code = e && typeof e.code === "number" ? e.code : null;
+      const out = combined || (e && typeof e.code === "string" ? e.code : "");
+      resolve16({ ok: !e, code, out });
+    });
+  });
+}
+function ourUnc(port) {
+  return `\\\\127.0.0.1@${port}\\${fileShareToken()}`.toLowerCase();
+}
+async function mappedDisks() {
+  const r = await runWin("powershell.exe", [
+    "-NoProfile",
+    "-NonInteractive",
+    "-Command",
+    'Get-CimInstance Win32_MappedLogicalDisk | ForEach-Object { "$($_.DeviceID)`t$($_.ProviderName)" }'
+  ]);
+  if (!r.ok)
+    return [];
+  const out = [];
+  for (const line of r.out.split(/\r?\n/)) {
+    const tab = line.indexOf("	");
+    if (tab < 0)
+      continue;
+    const device = line.slice(0, tab).trim();
+    const provider = line.slice(tab + 1).trim();
+    if (/^[A-Za-z]:$/.test(device))
+      out.push({ device, provider });
+  }
+  return out;
+}
+async function usedDriveLetters() {
+  const used = /* @__PURE__ */ new Set();
+  const r = await runWin("powershell.exe", [
+    "-NoProfile",
+    "-NonInteractive",
+    "-Command",
+    '(Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Name) -join ","'
+  ]);
+  if (r.ok)
+    for (const n of r.out.split(",")) {
+      const L = n.trim().toUpperCase();
+      if (/^[A-Z]$/.test(L))
+        used.add(L);
+    }
+  return used;
+}
+function pickFreeLetter(used) {
+  for (let c = "Z".charCodeAt(0); c >= "D".charCodeAt(0); c--) {
+    const L = String.fromCharCode(c);
+    if (!used.has(L))
+      return L;
+  }
+  return null;
+}
 async function mountWindows(log10) {
   const url2 = fileShareUrl();
-  if (!url2)
+  const port = fileSharePort();
+  if (!url2 || !port)
     return false;
-  try {
-    await run3("sc", ["config", "WebClient", "start=", "auto"], OPTS);
-  } catch {
-  }
-  try {
-    await run3("net", ["start", "WebClient"], OPTS);
-  } catch {
+  const disks = await mappedDisks();
+  const want = ourUnc(port);
+  const tokenLc = fileShareToken().toLowerCase();
+  let reuse = null;
+  for (const d of disks) {
+    const prov = d.provider.toLowerCase();
+    const isOurs2 = prov.startsWith("\\\\127.0.0.1@") && prov.includes(`\\${tokenLc}`);
+    if (!isOurs2)
+      continue;
+    if (prov === want || prov === `${want}\\`) {
+      reuse = d.device;
+      continue;
+    }
+    const del = await runWin("net", ["use", d.device, "/delete", "/y"]);
+    log10(del.ok ? `file-share: removed a stale mapping on ${d.device}` : `file-share: could not remove stale mapping on ${d.device} (${redact(del.out) || `exit ${del.code}`})`);
   }
-  try {
-    const { stdout } = await run3("net", ["use", "*", url2, "/persistent:no"], OPTS);
-    const drive = /([A-Za-z]:)/.exec(stdout)?.[1] ?? null;
-    mountedAt = drive ?? url2;
-    log10(`file-share: mapped in Explorer \u2192 ${mountedAt}`);
+  if (reuse) {
+    mountedAt = reuse;
+    log10(`file-share: reusing existing mapping on ${reuse}`);
     return true;
-  } catch (e) {
-    const msg = String(e.message || "").split("\n").find((l) => l.trim()) ?? "";
-    log10(`file-share: net use failed (${msg.trim()}) \u2014 is the WebClient service running?`);
+  }
+  const used = await usedDriveLetters();
+  for (const d of disks)
+    used.add(d.device[0].toUpperCase());
+  const letter = pickFreeLetter(used);
+  if (!letter) {
+    log10("file-share: no free drive letter to map the share");
     return false;
   }
+  const res = await runWin("net", ["use", `${letter}:`, url2, "/persistent:no"]);
+  if (res.ok) {
+    mountedAt = `${letter}:`;
+    log10(`file-share: mapped in Explorer \u2192 ${letter}:`);
+    return true;
+  }
+  const detail = redact(res.out).split(/\r?\n/).map((l) => l.trim()).filter(Boolean).join(" ");
+  const sysErr = /System error (\d+)/i.exec(res.out)?.[1] ?? null;
+  const hint = sysErr === "1058" ? " \u2014 the WebClient service is disabled; enable it (services.msc \u2192 WebClient, Manual/Automatic) so `net use` can trigger-start it" : sysErr === "53" || sysErr === "67" || sysErr === "1231" || sysErr === "3" ? " \u2014 WebClient could not be reached; it may be stopped or absent (net use normally trigger-starts it)" : "";
+  log10(`file-share: net use failed (exit ${res.code}${sysErr ? `, System error ${sysErr}` : ""}: ${detail || "no output"})${hint}`);
+  return false;
+}
+function scheduleRetry(log10) {
+  if (mounted || retryTimer || attempts >= MAX_ATTEMPTS)
+    return;
+  attempts++;
+  retryTimer = setTimeout(() => {
+    retryTimer = null;
+    void mountFileShare(log10);
+  }, RETRY_MS);
+  retryTimer.unref?.();
 }
 async function mountFileShare(log10 = () => {
 }) {
@@ -122724,18 +123624,34 @@ async function mountFileShare(log10 = () => {
     return false;
   const ok = process.platform === "linux" ? await mountLinux(log10) : process.platform === "win32" ? await mountWindows(log10) : false;
   mounted = ok;
+  if (ok) {
+    attempts = 0;
+    if (retryTimer) {
+      clearTimeout(retryTimer);
+      retryTimer = null;
+    }
+  } else
+    scheduleRetry(log10);
   return ok;
 }
 async function unmountFileShare(log10 = () => {
 }) {
-  if (!mounted || !mountedAt)
+  if (retryTimer) {
+    clearTimeout(retryTimer);
+    retryTimer = null;
+  }
+  attempts = 0;
+  if (!mounted || !mountedAt) {
+    mounted = false;
     return;
+  }
+  const at = mountedAt;
   try {
     if (process.platform === "linux")
-      await run3("gio", ["mount", "-u", mountedAt], OPTS);
+      await run3("gio", ["mount", "-u", at], OPTS);
     else if (process.platform === "win32")
-      await run3("net", ["use", mountedAt, "/delete", "/y"], OPTS);
-    log10(`file-share: unmounted ${mountedAt}`);
+      await run3("net", ["use", at, "/delete", "/y"], OPTS);
+    log10(`file-share: unmounted ${redact(at)}`);
   } catch {
   }
   mounted = false;
@@ -123115,9 +124031,10 @@ function writeLauncher(daemonDir3, bridge, runtime) {
   const launcher = join89(daemonDir3, isWin ? "companion-host.cmd" : "companion-host.sh");
   if (isWin) {
     writeFileSync41(launcher, `@echo off\r
+chcp 65001>nul\r
 set ELECTRON_RUN_AS_NODE=1\r
 "${runtime}" "${bridge}" %*\r
-`);
+`, { encoding: "utf8" });
   } else {
     writeFileSync41(launcher, `#!/bin/sh
 # Tesseract Companion native-messaging launcher (auto-written by the daemon).
@@ -123170,7 +124087,7 @@ function registerWindows(daemonDir3, manifestJson, log10) {
     writeFileSync41(manifestPath, manifestJson);
     for (const root of ["Software\\Google\\Chrome", "Software\\Microsoft\\Edge", "Software\\BraveSoftware\\Brave-Browser"]) {
       try {
-        execFileSync5("reg", ["add", `HKCU\\${root}\\NativeMessagingHosts\\${HOST_NAME}`, "/ve", "/t", "REG_SZ", "/d", manifestPath, "/f"], { stdio: "ignore" });
+        execFileSync5("reg", ["add", `HKCU\\${root}\\NativeMessagingHosts\\${HOST_NAME}`, "/ve", "/t", "REG_SZ", "/d", manifestPath, "/f"], { stdio: "ignore", windowsHide: true });
       } catch {
       }
     }
@@ -123228,6 +124145,37 @@ function loadMacAx2() {
   })();
   return macAxPromise2;
 }
+var windowingPromise;
+function loadWindowing() {
+  if (!windowingPromise)
+    windowingPromise = loadLibnutWindowing();
+  return windowingPromise;
+}
+function appNameFromWindowTitle(title) {
+  const parts = title.split(/\s+[-—|]\s+/).map((s) => s.trim()).filter(Boolean);
+  return parts.length ? parts[parts.length - 1] : title.trim();
+}
+async function detectFrontmost() {
+  if (process.platform === "darwin") {
+    const ax = await loadMacAx2();
+    return ax?.frontmostApp() ?? null;
+  }
+  const win3 = await loadWindowing();
+  if (!win3)
+    return null;
+  try {
+    const handle3 = win3.getActiveWindow();
+    if (!handle3 || handle3 <= 0)
+      return null;
+    const title = (win3.getWindowTitle(handle3) ?? "").trim();
+    if (!title)
+      return null;
+    const name = appNameFromWindowTitle(title);
+    return name ? { name, bundleId: "", pid: handle3 } : null;
+  } catch {
+    return null;
+  }
+}
 function createActivityTracker(opts = {}) {
   const intervalMs = opts.intervalMs ?? 5e3;
   const flushEvery = opts.flushEvery ?? 12;
@@ -123257,8 +124205,7 @@ function createActivityTracker(opts = {}) {
   }
   async function sample() {
     try {
-      const ax = await loadMacAx2();
-      const front = ax?.frontmostApp() ?? null;
+      const front = await detectFrontmost();
       if (!front || !front.name)
         return;
       const key2 = front.bundleId || front.name;
@@ -123430,7 +124377,7 @@ function writeJsonId(file2, deviceId3) {
 }
 function haveTool(bin) {
   try {
-    execFileSync6(process.platform === "win32" ? "where" : "which", [bin], { timeout: TOOL_TIMEOUT_MS, stdio: "pipe" });
+    execFileSync6(process.platform === "win32" ? "where" : "which", [bin], { timeout: TOOL_TIMEOUT_MS, stdio: "pipe", windowsHide: true });
     return true;
   } catch {
     return false;
@@ -123672,6 +124619,14 @@ function backoff2() {
 // ../../packages/host-core/dist/daemon-runtime.js
 var daemonClipboardSync = null;
 var REFRESH_INTERVAL_MS2 = 12 * 60 * 60 * 1e3;
+function releaseDaemonLock() {
+  try {
+    const f = join93(daemonDir2(), "daemon.lock");
+    if (existsSync50(f) && Number(readFileSync60(f, "utf-8").trim()) === process.pid)
+      unlinkSync8(f);
+  } catch {
+  }
+}
 async function runDaemon(opts = {}) {
   const VERSION2 = opts.version ?? process.env.CCB_DAEMON_VERSION ?? "dev";
   const TAG = opts.tag ?? "host-daemon";
@@ -123692,10 +124647,31 @@ async function runDaemon(opts = {}) {
       return false;
     }
   };
+  const readOwnerStatus = () => {
+    try {
+      const s = JSON.parse(readFileSync60(statusFile2(), "utf-8"));
+      const pid = Number(s.pid);
+      if (!Number.isInteger(pid) || pid <= 0 || s.stopped === true)
+        return null;
+      return { pid, startedAt: typeof s.startedAt === "string" ? s.startedAt : void 0 };
+    } catch {
+      return null;
+    }
+  };
+  const lockOwnerIsLive = (pid) => {
+    if (!isAlive2(pid))
+      return false;
+    if (pid === process.pid)
+      return true;
+    const owner = readOwnerStatus();
+    if (owner && owner.pid === pid && owner.startedAt)
+      return pidStillMatches(pid, { startedAt: owner.startedAt });
+    return true;
+  };
   const lockHeldByAnother = () => {
     try {
       const pid = Number(readFileSync60(pidfile2(), "utf-8").trim());
-      return Number.isFinite(pid) && pid > 0 && pid !== process.pid && isAlive2(pid);
+      return Number.isFinite(pid) && pid > 0 && pid !== process.pid && lockOwnerIsLive(pid);
     } catch {
       return false;
     }
@@ -123703,7 +124679,7 @@ async function runDaemon(opts = {}) {
   const lockHeldByYieldingSubset = () => {
     try {
       const pid = Number(readFileSync60(pidfile2(), "utf-8").trim());
-      if (!Number.isFinite(pid) || pid <= 0 || pid === process.pid || !isAlive2(pid))
+      if (!Number.isFinite(pid) || pid <= 0 || pid === process.pid || !lockOwnerIsLive(pid))
         return false;
       return liveDaemons().some((d) => d.pid === pid && d.rdeskOnly === true);
     } catch {
@@ -123726,7 +124702,7 @@ async function runDaemon(opts = {}) {
           const prev = Number(readFileSync60(f, "utf-8").trim());
           if (!prev)
             return false;
-          if (prev !== process.pid && isAlive2(prev))
+          if (prev !== process.pid && lockOwnerIsLive(prev))
             return false;
           unlinkSync8(f);
         } catch {
@@ -123736,14 +124712,7 @@ async function runDaemon(opts = {}) {
     }
     return false;
   }
-  function releaseLock() {
-    try {
-      const f = pidfile2();
-      if (existsSync50(f) && Number(readFileSync60(f, "utf-8").trim()) === process.pid)
-        unlinkSync8(f);
-    } catch {
-    }
-  }
+  const releaseLock = () => releaseDaemonLock();
   const WE_ARE_RDESK_ONLY = process.env.CCB_RDESK_ONLY === "1" || process.env.CCB_MESH_ONLY === "1";
   function writeStatus2(s) {
     if (!ownsMachine)
@@ -124024,6 +124993,10 @@ async function runDaemon(opts = {}) {
         }
         if (mergedProcess) {
           if (deliberateMergedQuit()) {
+            try {
+              releaseLock();
+            } catch {
+            }
             try {
               log10("APP before-quit \u2014 allowed (merged: deliberate quit)");
             } catch {
@@ -124647,7 +125620,7 @@ async function runDaemon(opts = {}) {
       }
       const holder = lockHolder();
       const fullDaemonAlive = liveDaemons().some((d) => d.pid !== process.pid && d.rdeskOnly !== true);
-      if (holder > 0 && isAlive2(holder) || fullDaemonAlive) {
+      if (holder > 0 && lockOwnerIsLive(holder) || fullDaemonAlive) {
         freeTicks = 0;
         return;
       }
@@ -125081,7 +126054,7 @@ import { dirname as dirname43, join as join97 } from "node:path";
 import { promisify as promisify12 } from "node:util";
 
 // ../../packages/host-core/dist/net-service/launchd-system.js
-import { spawn as spawn9 } from "node:child_process";
+import { spawn as spawn11 } from "node:child_process";
 import { existsSync as existsSync52, mkdtempSync as mkdtempSync2, writeFileSync as writeFileSync46, rmSync as rmSync11, readFileSync as readFileSync61 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
 import { join as join95 } from "node:path";
@@ -125249,7 +126222,7 @@ ${args}
 }
 function runForCode(cmd, args) {
   return new Promise((resolve16) => {
-    const p = spawn9(cmd, args, { stdio: "inherit" });
+    const p = spawn11(cmd, args, { stdio: "inherit" });
     p.on("error", () => resolve16(127));
     p.on("close", (code) => resolve16(code ?? 1));
   });
@@ -125352,16 +126325,16 @@ ${plist}TESSERACT_PLIST_EOF`,
 }
 
 // ../../packages/host-core/dist/net-service/systemd-system.js
-import { spawn as spawn11 } from "node:child_process";
+import { spawn as spawn13 } from "node:child_process";
 import { existsSync as existsSync53, readFileSync as readFileSync62 } from "node:fs";
 
 // ../../packages/host-core/dist/service/exec.js
-import { execFile as execFile13, spawn as spawn10 } from "node:child_process";
+import { execFile as execFile13, spawn as spawn12 } from "node:child_process";
 import { promisify as promisify9 } from "node:util";
 var run6 = promisify9(execFile13);
 function runInherit(cmd, args) {
   return new Promise((resolve16) => {
-    const p = spawn10(cmd, args, { stdio: "inherit" });
+    const p = spawn12(cmd, args, { stdio: "inherit" });
     p.on("error", () => resolve16());
     p.on("close", () => resolve16());
   });
@@ -125370,7 +126343,7 @@ function runInherit(cmd, args) {
 // ../../packages/host-core/dist/net-service/systemd-system.js
 function runForCode2(cmd, args) {
   return new Promise((resolve16) => {
-    const p = spawn11(cmd, args, { stdio: "inherit" });
+    const p = spawn13(cmd, args, { stdio: "inherit" });
     p.on("error", () => resolve16(127));
     p.on("close", (code) => resolve16(code ?? 1));
   });
@@ -125556,7 +126529,7 @@ function sh2(s) {
 }
 
 // ../../packages/host-core/dist/net-service/windows-service.js
-import { execFile as execFile14, spawn as spawn12 } from "node:child_process";
+import { execFile as execFile14, spawn as spawn14 } from "node:child_process";
 import { mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync47, rmSync as rmSync12 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
 import { join as join96, win32 } from "node:path";
@@ -125599,7 +126572,7 @@ async function elevatePowerShell(script) {
   writeFileSync47(inner, script, { encoding: "utf8" });
   if (await alreadyElevated()) {
     return new Promise((resolve16) => {
-      const p = spawn12("powershell.exe", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", inner], { stdio: "inherit" });
+      const p = spawn14("powershell.exe", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", inner], { stdio: "inherit" });
       const finish2 = (code) => {
         try {
           rmSync12(dir2, { recursive: true, force: true });
@@ -125622,7 +126595,7 @@ async function elevatePowerShell(script) {
     "}"
   ].join("\n"), { encoding: "utf8" });
   return new Promise((resolve16) => {
-    const p = spawn12("powershell.exe", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", outer], { stdio: "inherit" });
+    const p = spawn14("powershell.exe", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", outer], { stdio: "inherit" });
     const finish2 = (code) => {
       try {
         rmSync12(dir2, { recursive: true, force: true });
@@ -126746,7 +127719,7 @@ function whoami() {
 }
 
 // src/self-update.ts
-import { spawn as spawn13 } from "node:child_process";
+import { spawn as spawn15 } from "node:child_process";
 import { createPublicKey, verify as cryptoVerify } from "node:crypto";
 var RESTART_EXIT_CODE = 75;
 var REGISTRY_BASE = "https://registry.npmjs.org/tesseract-agent";
@@ -126821,7 +127794,7 @@ function installVersion(target) {
     log9(`installing tesseract-agent@${target} \u2026`);
     let child;
     try {
-      child = spawn13(npm, ["install", "-g", `tesseract-agent@${target}`], { stdio: ["ignore", "inherit", "inherit"] });
+      child = spawn15(npm, ["install", "-g", `tesseract-agent@${target}`], { stdio: ["ignore", "inherit", "inherit"], shell: process.platform === "win32", windowsHide: true });
     } catch (e) {
       log9("npm spawn threw:", e instanceof Error ? e.message : String(e));
       resolve16(false);
@@ -127909,7 +128882,7 @@ async function superviseDaemon(cliEntry) {
   let stopping3 = false;
   let child = null;
   const spawnWorker = () => {
-    const c = spawn14(process.execPath, [cliEntry, "__worker"], { stdio: "inherit", env: process.env });
+    const c = spawn16(process.execPath, [cliEntry, "__worker"], { stdio: "inherit", env: process.env });
     child = c;
     let settled = false;
     const settle2 = (fn) => {
@@ -128090,9 +129063,11 @@ async function captureClaudeSubscription(flags) {
   console.log("Open the authorization URL in any browser; paste the returned code here if Claude asks for it.");
   try {
     const code = await new Promise((resolveCode, reject) => {
-      const child = spawn14(binary, args, {
+      const child = spawn16(binary, args, {
         env: { ...process.env, CLAUDE_CONFIG_DIR: home },
-        stdio: "inherit"
+        stdio: "inherit",
+        // An npm-installed engine CLI is a .cmd shim on Windows — spawn via a shell or Node >=18.20.2 throws EINVAL.
+        shell: process.platform === "win32" && /\.(cmd|bat)$/i.test(binary)
       });
       child.once("error", reject);
       child.once("close", (exitCode, signal2) => resolveCode(signal2 ? 1 : exitCode ?? 1));