tesseract-agent 0.11.3 → 0.11.7

package/dist-bundle/cli.js

@@ -3378,7 +3378,7 @@ var require_stream = __commonJS({
       };
       duplex._final = function(callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open7() {
+          ws.once("open", function open8() {
             duplex._final(callback);
           });
           return;
@@ -3399,7 +3399,7 @@ var require_stream = __commonJS({
       };
       duplex._write = function(chunk, encoding, callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open7() {
+          ws.once("open", function open8() {
             duplex._write(chunk, encoding, callback);
           });
           return;
@@ -24207,9 +24207,9 @@ function extractJsonObject(raw) {
 function extractJsonArray(raw) {
   return extractBalanced(raw, "[", "]");
 }
-function extractBalanced(raw, open7, close) {
+function extractBalanced(raw, open8, close) {
   const s = raw.replace(/^```(?:json)?\s*/i, "").replace(/\s*```\s*$/i, "");
-  const start3 = s.indexOf(open7);
+  const start3 = s.indexOf(open8);
   if (start3 < 0)
     return null;
   let depth = 0, inStr = false, esc3 = false;
@@ -24226,7 +24226,7 @@ function extractBalanced(raw, open7, close) {
     }
     if (c === '"')
       inStr = true;
-    else if (c === open7)
+    else if (c === open8)
       depth++;
     else if (c === close) {
       depth--;
@@ -27550,6 +27550,32 @@ var init_mesh_node_name = __esm({
   }
 });
 
+// ../../packages/shared/dist/host-id.js
+function parseHostId(hostId) {
+  if (!hostId)
+    return null;
+  const i = hostId.indexOf(":");
+  if (i < 0 || hostId.slice(0, i) !== "electron")
+    return null;
+  const rest = hostId.slice(i + 1);
+  const j = rest.indexOf(":");
+  if (j < 0)
+    return null;
+  const owner = rest.slice(0, j);
+  const deviceId3 = rest.slice(j + 1);
+  if (!owner || !deviceId3)
+    return null;
+  return { kind: "electron", owner, deviceId: deviceId3 };
+}
+function hostDeviceId(hostId) {
+  return parseHostId(hostId)?.deviceId ?? null;
+}
+var init_host_id = __esm({
+  "../../packages/shared/dist/host-id.js"() {
+    "use strict";
+  }
+});
+
 // ../../packages/shared/dist/index.js
 var init_dist2 = __esm({
   "../../packages/shared/dist/index.js"() {
@@ -27610,6 +27636,7 @@ var init_dist2 = __esm({
     init_user_dialog();
     init_session_ops();
     init_mesh_node_name();
+    init_host_id();
   }
 });
 
@@ -29167,17 +29194,17 @@ function markerPair(path6) {
   return { open: `// ${MARKER}:start`, close: `// ${MARKER}:end` };
 }
 function upsertMarkedBlock(path6, source, block2, anchor) {
-  const { open: open7, close } = markerPair(path6);
-  const start3 = source.indexOf(open7);
+  const { open: open8, close } = markerPair(path6);
+  const start3 = source.indexOf(open8);
   const end2 = source.indexOf(close);
   if (start3 !== -1 && end2 !== -1 && end2 > start3) {
-    const existing = source.slice(start3 + open7.length, end2);
+    const existing = source.slice(start3 + open8.length, end2);
     const next = `
 ${block2}
 `;
     if (existing === next)
       return { ok: true, source, changed: false };
-    return { ok: true, source: source.slice(0, start3 + open7.length) + next + source.slice(end2), changed: true };
+    return { ok: true, source: source.slice(0, start3 + open8.length) + next + source.slice(end2), changed: true };
   }
   if (start3 !== -1 || end2 !== -1) {
     return { ok: false, why: `found only one of the ${MARKER} markers \u2014 remove the stray one by hand and re-run` };
@@ -29189,7 +29216,7 @@ ${block2}
     return { ok: false, why: "could not find where to insert \u2014 the file does not look like the shape we expected" };
   const at = m.index + m[0].length;
   return { ok: true, source: `${source.slice(0, at)}
-${open7}
+${open8}
 ${block2}
 ${close}${source.slice(at)}`, changed: true };
 }
@@ -31045,6 +31072,19 @@ var init_work_ledger = __esm({
        * gone: what the barrier needs is the answer to "what happened to the thing I was waiting
        * for", asked after it stopped existing.
        */
+      /**
+       * Proof of life: the producer said something about this item (a progress frame, an
+       * inventory that still lists it, a registry that still says running). Its deadline moves
+       * out again, so a long-running job that keeps reporting is never mistaken for a hung one
+       * and never swept while it is really working. Detached items have no deadline to move.
+       */
+      touch(id, now2) {
+        const item = this.items.get(id);
+        if (!item || item.disposition !== "awaited")
+          return false;
+        this.items.set(id, { ...item, deadline: now2 + DEFAULT_DEADLINE_MS[item.kind] });
+        return true;
+      }
       settle(id, outcome = "completed") {
         const had = this.items.delete(id);
         if (had) {
@@ -31123,6 +31163,10 @@ var init_work_ledger = __esm({
         for (const t of inv.tasks ?? []) {
           seen.add(t.id);
           const subagent = t.type === "subagent";
+          if (this.items.has(t.id)) {
+            this.touch(t.id, now2);
+            continue;
+          }
           this.register({
             id: t.id,
             kind: subagent ? "subagent" : "engine-task",
@@ -31165,7 +31209,7 @@ var init_work_ledger = __esm({
           else
             waiting.push(item);
         }
-        return { quiescent: waiting.length === 0, waiting, overdue, detached };
+        return { quiescent: waiting.length === 0 && overdue.length === 0, waiting, overdue, detached };
       }
       /**
        * One line per item, for the grader and the closing report.
@@ -37093,14 +37137,72 @@ var init_cost_ledger = __esm({
   }
 });
 
+// ../../packages/agent-core/dist/session-activity.js
+import { open as open3 } from "node:fs/promises";
+function lastTimestampIn(chunk) {
+  let last = null;
+  const re = /"timestamp":"([^"]{10,40})"/g;
+  let m;
+  while ((m = re.exec(chunk)) !== null) {
+    const t = Date.parse(m[1]);
+    if (Number.isFinite(t))
+      last = t;
+  }
+  return last;
+}
+async function lastConversationTime(file2) {
+  let fh;
+  try {
+    fh = await open3(file2, "r");
+  } catch {
+    return null;
+  }
+  try {
+    const size = (await fh.stat()).size;
+    if (size === 0)
+      return null;
+    let end2 = size;
+    let scanned = 0;
+    while (end2 > 0 && scanned < ACTIVITY_MAX_SCAN_BYTES) {
+      const start3 = Math.max(0, end2 - ACTIVITY_WINDOW_BYTES);
+      const len = end2 - start3;
+      const buf = Buffer.alloc(len);
+      const { bytesRead } = await fh.read(buf, 0, len, start3);
+      const found = lastTimestampIn(buf.subarray(0, bytesRead).toString("utf8"));
+      if (found !== null)
+        return found;
+      scanned += len;
+      end2 = start3 + OVERLAP > start3 ? Math.max(0, start3 + OVERLAP) : start3;
+      if (start3 === 0)
+        break;
+    }
+    return null;
+  } catch {
+    return null;
+  } finally {
+    await fh.close().catch(() => {
+    });
+  }
+}
+var ACTIVITY_WINDOW_BYTES, ACTIVITY_MAX_SCAN_BYTES, OVERLAP;
+var init_session_activity = __esm({
+  "../../packages/agent-core/dist/session-activity.js"() {
+    "use strict";
+    ACTIVITY_WINDOW_BYTES = 64 * 1024;
+    ACTIVITY_MAX_SCAN_BYTES = 2 * 1024 * 1024;
+    OVERLAP = 64;
+  }
+});
+
 // ../../packages/agent-core/dist/session-store.js
 import { readFile as readFile5, stat as stat2 } from "node:fs/promises";
 import { listSessions, getSessionMessages, getSubagentMessages as sdkGetSubagentMessages, forkSession } from "@anthropic-ai/claude-agent-sdk";
-function toSessionInfo(s) {
+async function toSessionInfo(s) {
   const fromFirst = stripPromptPrefix(s.firstPrompt ?? "").slice(0, 80);
   const fromSummary = stripPromptPrefix(s.summary ?? "").slice(0, 80);
   const title = s.customTitle || fromFirst || fromSummary || `Session ${s.sessionId.slice(0, 8)}`;
-  return { id: s.sessionId, title, lastModified: s.lastModified, cwd: s.cwd };
+  const spoken = s.cwd ? await lastConversationTime(sessionFile(s.cwd, s.sessionId)) : null;
+  return { id: s.sessionId, title, lastModified: spoken ?? s.lastModified, cwd: s.cwd };
 }
 function transcriptMatches(raw, q) {
   for (const line of raw.split("\n")) {
@@ -37220,12 +37322,14 @@ ${input.command}
   }
   return blocks;
 }
-var SEARCH_SCAN_LIMIT, SEARCH_RESULT_LIMIT, SEARCH_MAX_FILE_BYTES, FORK_RETRY_ATTEMPTS, FORK_RETRY_DELAY_MS, delay, SessionStore;
+var newestFirst, SEARCH_SCAN_LIMIT, SEARCH_RESULT_LIMIT, SEARCH_MAX_FILE_BYTES, FORK_RETRY_ATTEMPTS, FORK_RETRY_DELAY_MS, delay, SessionStore;
 var init_session_store = __esm({
   "../../packages/agent-core/dist/session-store.js"() {
     "use strict";
     init_session_transfer();
     init_history_slim();
+    init_session_activity();
+    newestFirst = (a, b) => b.lastModified - a.lastModified;
     SEARCH_SCAN_LIMIT = 200;
     SEARCH_RESULT_LIMIT = 50;
     SEARCH_MAX_FILE_BYTES = 8 * 1024 * 1024;
@@ -37239,7 +37343,7 @@ var init_session_store = __esm({
       async getSessions(projectDir) {
         try {
           const sessions3 = projectDir ? await listSessions({ dir: projectDir, limit: 50 }) : await listSessions({ limit: 50 });
-          return sessions3.map(toSessionInfo);
+          return (await Promise.all(sessions3.map(toSessionInfo))).sort(newestFirst);
         } catch (err2) {
           return [];
         }
@@ -37260,7 +37364,7 @@ var init_session_store = __esm({
         }
         const out = [];
         for (const s of sessions3) {
-          const info = toSessionInfo(s);
+          const info = await toSessionInfo(s);
           if (info.title.toLowerCase().includes(q)) {
             out.push(info);
           } else if (s.cwd) {
@@ -37278,7 +37382,7 @@ var init_session_store = __esm({
           if (out.length >= SEARCH_RESULT_LIMIT)
             break;
         }
-        return out;
+        return out.sort(newestFirst);
       }
       async getSessionMessages(sessionId, projectDir) {
         try {
@@ -37308,6 +37412,7 @@ var init_session_store = __esm({
       rawToMessages(raw) {
         const messages = [];
         for (const entry of raw) {
+          const ts = typeof entry.timestamp === "string" ? Date.parse(entry.timestamp) : NaN;
           const blocks = extractBlocks(entry.message);
           if (blocks.length === 0 && entry.type === "user")
             continue;
@@ -37323,7 +37428,8 @@ var init_session_store = __esm({
             blocks: entry.type === "assistant" ? blocks : void 0,
             // Thread the per-message SDK uuid so the renderer can pass it as
             // session:fork.upToMessageId ("fork from here").
-            uuid: typeof entry.uuid === "string" ? entry.uuid : void 0
+            uuid: typeof entry.uuid === "string" ? entry.uuid : void 0,
+            ...Number.isFinite(ts) ? { timestamp: ts } : {}
           });
         }
         return messages;
@@ -37923,6 +38029,9 @@ function setBrowserExtensionProbe(fn) {
 function isTurnBearingFrame(type) {
   return type === "assistant" || type === "stream_event" || type === "user";
 }
+function turnStillOpening(openedAt, now2) {
+  return openedAt !== void 0 && now2 - openedAt < TURN_OPENING_GRACE_MS;
+}
 function findUserInstalledClaude(binName) {
   const home = homedir3();
   const abs = [
@@ -38814,7 +38923,7 @@ ${next}` : next;
 function autoDecisionSubject(prompt2) {
   return prompt2.kind === "permission" ? prompt2.tool : void 0;
 }
-var browserExtensionConnected, SLIM_KEEP_RECENT_TURNS, cachedClaudeExe, unsupportedCliOptions, rejectedCliArgs, CAPS_VERSION, capsLoaded, EFFORT_LADDER, cachedEfforts, modelEffortLevels, sharedSessionStore, monoNowMs, sessionCwdCache, cachedNodeExe, HUMAN_READABLE_FIELDS, SYSTEM_EVENT_CATEGORY, TOOL_RESULT_CAP, MAX_RESULT_IMAGES, MAX_IMAGE_BASE64, PERMISSION_MODES, EDIT_PREVIEW_CAP, AsyncMessagePump, IDLE_REAP_MS, EFFORT_SWAP_DEBOUNCE_MS, MODERATE_IDLE_MS, STEER_COALESCE_MS, AUTO_BACKGROUND_SECONDS, TASK_REGISTER_SECONDS, JOB_NOTICE_COALESCE_MS, JOB_NOTICE_WORK_ID, QUIESCENCE_MAX_MS, QUIESCENCE_POLL_MS, BATCH_WAIT_MS, INLINE_TOOL_NAMES, STOP_HARD_KILL_AFTER_MS, STREAM_STALL_MS, STREAM_FIRST_FRAME_MS, RV_TASK_MAX, OPTION_RATING_JSON_SCHEMA, AgentManager;
+var browserExtensionConnected, TURN_OPENING_GRACE_MS, SLIM_KEEP_RECENT_TURNS, cachedClaudeExe, unsupportedCliOptions, rejectedCliArgs, CAPS_VERSION, capsLoaded, EFFORT_LADDER, cachedEfforts, modelEffortLevels, sharedSessionStore, monoNowMs, sessionCwdCache, cachedNodeExe, HUMAN_READABLE_FIELDS, SYSTEM_EVENT_CATEGORY, TOOL_RESULT_CAP, MAX_RESULT_IMAGES, MAX_IMAGE_BASE64, PERMISSION_MODES, EDIT_PREVIEW_CAP, AsyncMessagePump, IDLE_REAP_MS, EFFORT_SWAP_DEBOUNCE_MS, MODERATE_IDLE_MS, STEER_COALESCE_MS, AUTO_BACKGROUND_SECONDS, TASK_REGISTER_SECONDS, JOB_NOTICE_COALESCE_MS, JOB_NOTICE_WORK_ID, QUIESCENCE_MAX_MS, QUIESCENCE_POLL_MS, BATCH_WAIT_MS, INLINE_TOOL_NAMES, STOP_HARD_KILL_AFTER_MS, STREAM_STALL_MS, STREAM_FIRST_FRAME_MS, RV_TASK_MAX, OPTION_RATING_JSON_SCHEMA, AgentManager;
 var init_agent_manager = __esm({
   "../../packages/agent-core/dist/agent-manager.js"() {
     "use strict";
@@ -38874,6 +38983,7 @@ var init_agent_manager = __esm({
     init_stream_stall();
     init_usage_limit();
     browserExtensionConnected = () => false;
+    TURN_OPENING_GRACE_MS = 5 * 6e4;
     SLIM_KEEP_RECENT_TURNS = 3;
     unsupportedCliOptions = /* @__PURE__ */ new Set();
     rejectedCliArgs = /* @__PURE__ */ new Map();
@@ -38944,7 +39054,7 @@ var init_agent_manager = __esm({
     TASK_REGISTER_SECONDS = 3;
     JOB_NOTICE_COALESCE_MS = 400;
     JOB_NOTICE_WORK_ID = "pending-job-notices";
-    QUIESCENCE_MAX_MS = 20 * 6e4;
+    QUIESCENCE_MAX_MS = 12 * 60 * 6e4;
     QUIESCENCE_POLL_MS = 500;
     BATCH_WAIT_MS = 6e4;
     INLINE_TOOL_NAMES = /* @__PURE__ */ new Set([
@@ -40001,19 +40111,23 @@ ${full.slice(-8e3)}`;
               this.clearWorkNarration(live, narrated);
               return;
             }
-            const v = live.ledger.verdict(Date.now());
+            const now2 = Date.now();
+            live.ledger.sweep(now2);
+            this.refreshLedgerFromRegistry(live, now2);
+            const v = live.ledger.verdict(now2);
             if (v.quiescent)
               break;
-            if (Date.now() - started2 >= QUIESCENCE_MAX_MS) {
+            if (now2 - started2 >= QUIESCENCE_MAX_MS) {
               cappedOut = true;
               break;
             }
             if (!narrated && live.sessionId) {
               narrated = true;
+              const running2 = v.waiting.length + v.overdue.length;
               this.send({
                 type: "agent:narration",
                 sessionId: live.sessionId,
-                text: `Waiting for ${v.waiting.length} background ${v.waiting.length === 1 ? "task" : "tasks"} to finish\u2026`,
+                text: `Waiting for ${running2} background ${running2 === 1 ? "task" : "tasks"} to finish\u2026`,
                 engineLabel: "Claude Code"
               }, live.origin);
             }
@@ -40044,6 +40158,7 @@ ${full.slice(-8e3)}`;
         log(`[turn] ${live.sessionId || "(pending)"} started a turn on its own \u2014 marking busy`);
         live.streaming = true;
         live.turnSeq++;
+        live.turnOpeningAt = void 0;
         live.lastActivity = Date.now();
         if (live.idleTimer) {
           clearTimeout(live.idleTimer);
@@ -42584,6 +42699,8 @@ ${unattendedReportDirective(params)}` : ""), live.sessionId) },
             const parentToolUseId = message.parent_tool_use_id ?? void 0;
             if (!live.streaming && !live.reaped && isTurnBearingFrame(message.type))
               this.adoptSelfStartedTurn(live);
+            if (!live.streaming && !live.reaped && (live.turnsDone ?? 0) > 0 && message.type === "system" && message.subtype === "init")
+              live.turnOpeningAt = Date.now();
             switch (message.type) {
               case "stream_event": {
                 const event = message.event;
@@ -42726,6 +42843,8 @@ ${unattendedReportDirective(params)}` : ""), live.sessionId) },
               }
               case "result": {
                 this.emitLifecycle("Stop", { sessionId: sid, subtype: message.subtype ?? null });
+                live.turnsDone = (live.turnsDone ?? 0) + 1;
+                live.turnOpeningAt = void 0;
                 flushPendingThinking();
                 const r = message;
                 const resultSid = r.session_id || "";
@@ -42935,6 +43054,7 @@ ${unattendedReportDirective(params)}` : ""), live.sessionId) },
                     const taskId = sstr(m.task_id);
                     if (!taskId)
                       break;
+                    live.ledger.touch(taskId, Date.now());
                     const u = m.usage;
                     emit2({
                       type: "agent:task",
@@ -42973,6 +43093,8 @@ ${unattendedReportDirective(params)}` : ""), live.sessionId) },
                     if (status2 === "completed" || status2 === "failed" || status2 === "killed") {
                       this.clearAutoBackground(live, taskId);
                       live.taskIds.delete(taskId);
+                    } else {
+                      live.ledger.touch(taskId, Date.now());
                     }
                     break;
                   }
@@ -42984,6 +43106,8 @@ ${unattendedReportDirective(params)}` : ""), live.sessionId) },
                   case "background_tasks_changed": {
                     const listed = new Set((Array.isArray(m.tasks) ? m.tasks : []).map((t) => sstr(t?.task_id)).filter(Boolean));
                     live.taskIds = listed;
+                    for (const id of listed)
+                      live.ledger.touch(id, Date.now());
                     break;
                   }
                   case "task_notification": {
@@ -43526,7 +43650,7 @@ ${err2.stack}` : ""}` : String(err2);
           // Blocked on its own background work. A turn that dispatched a build emits nothing while
           // it waits, and that silence is the intended behaviour — not a dead stream. Reads the
           // ledger, so it goes false on its own once every awaited item has passed its deadline.
-          awaitingWork: live.ledger.verdict(Date.now()).waiting.length > 0,
+          awaitingWork: !live.ledger.verdict(Date.now()).quiescent,
           idleMs: monoNowMs() - (live.lastFrameAt ?? 0),
           windowMs: live.stallWindowMs ?? STREAM_STALL_MS
         });
@@ -43717,7 +43841,8 @@ ${err2.stack}` : ""}` : String(err2);
         for (const id of [...claimed])
           if (!live.ledger.has(id))
             claimed.delete(id);
-        const watched = live.ledger.verdict(started2).waiting.filter((i) => !claimed.has(i.id)).map((i) => ({ id: i.id, description: i.description, kind: i.kind }));
+        const v0 = live.ledger.verdict(started2);
+        const watched = [...v0.waiting, ...v0.overdue].filter((i) => !claimed.has(i.id)).map((i) => ({ id: i.id, description: i.description, kind: i.kind }));
         for (const w of watched)
           claimed.add(w.id);
         if (watched.length === 0)
@@ -44291,10 +44416,12 @@ ${lines.join("\n")}
       hasWorkInFlight(live) {
         if (live.gradePending)
           return true;
+        if (turnStillOpening(live.turnOpeningAt, Date.now()))
+          return true;
         if ((live.awaitDepth ?? 0) > 0)
           return true;
         try {
-          if (live.ledger.verdict(Date.now()).waiting.length > 0)
+          if (!live.ledger.verdict(Date.now()).quiescent)
             return true;
         } catch {
         }
@@ -44305,6 +44432,24 @@ ${lines.join("\n")}
         }
         return false;
       }
+      /** The job registry is the authority on daemon-owned jobs: anything it still reports as
+       *  running is alive, whatever the ledger's deadline says — touch it (or put it back if a
+       *  sweep already took it). */
+      refreshLedgerFromRegistry(live, now2) {
+        let jobs;
+        try {
+          jobs = live.jobs?.list() ?? [];
+        } catch {
+          return;
+        }
+        for (const j of jobs) {
+          if (j.status !== "running")
+            continue;
+          if (!live.ledger.touch(j.id, now2)) {
+            live.ledger.register({ id: j.id, kind: "tool-job", description: `${j.kind ?? "job"}: ${j.description ?? j.id}` }, now2);
+          }
+        }
+      }
       reapIdleSession(sessionId, force = false) {
         const live = this.liveSessions.get(sessionId);
         if (!live || live.streaming || live.reaped)
@@ -81321,8 +81466,8 @@ var mesh_ca_exports = {};
 __export(mesh_ca_exports, {
   netCaCommand: () => netCaCommand
 });
-import { chmodSync as chmodSync8, existsSync as existsSync49, mkdirSync as mkdirSync45, readFileSync as readFileSync54, writeFileSync as writeFileSync46 } from "node:fs";
-import { join as join87, resolve as resolve13 } from "node:path";
+import { chmodSync as chmodSync8, existsSync as existsSync50, mkdirSync as mkdirSync46, readFileSync as readFileSync55, writeFileSync as writeFileSync47 } from "node:fs";
+import { join as join88, resolve as resolve13 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 function die(msg) {
   console.error(msg);
@@ -81353,28 +81498,28 @@ async function readPassphrase(prompt2) {
   }
 }
 function writeSecretFile(p, bytes2) {
-  writeFileSync46(p, bytes2, { mode: 384 });
+  writeFileSync47(p, bytes2, { mode: 384 });
   try {
     chmodSync8(p, 384);
   } catch {
   }
 }
 function ensureDir(p) {
-  mkdirSync45(p, { recursive: true, mode: 448 });
+  mkdirSync46(p, { recursive: true, mode: 448 });
   try {
     chmodSync8(p, 448);
   } catch {
   }
 }
 async function openCa(dir2) {
-  const gPath = join87(dir2, "genesis.bin");
-  const sPath = join87(dir2, "ca.sealed");
-  if (!existsSync49(gPath) || !existsSync49(sPath)) {
+  const gPath = join88(dir2, "genesis.bin");
+  const sPath = join88(dir2, "ca.sealed");
+  if (!existsSync50(gPath) || !existsSync50(sPath)) {
     die(`No mesh CA in ${dir2}. Run: tesseract-agent net init --org NAME --ca-dir ${dir2}`);
   }
-  const genesisBytes = new Uint8Array(readFileSync54(gPath));
+  const genesisBytes = new Uint8Array(readFileSync55(gPath));
   const genesis = decodeGenesis(genesisBytes);
-  const sealed = decodeRecoveryBundle(new Uint8Array(readFileSync54(sPath)));
+  const sealed = decodeRecoveryBundle(new Uint8Array(readFileSync55(sPath)));
   const pass = await readPassphrase("CA passphrase: ");
   let seed;
   try {
@@ -81390,7 +81535,7 @@ async function netCaCommand(rest, flags) {
   if (sub === "init") {
     const org = typeof flags.org === "string" ? flags.org.trim() : "";
     if (!org) die("Usage: tesseract-agent net init --org NAME [--ca-dir DIR]");
-    if (existsSync49(join87(caDir, "ca.sealed"))) {
+    if (existsSync50(join88(caDir, "ca.sealed"))) {
       die(`A mesh CA already exists in ${caDir}. Refusing to overwrite it.`);
     }
     const pass = await readPassphrase("New CA passphrase: ");
@@ -81412,9 +81557,9 @@ async function netCaCommand(rest, flags) {
     const genesisBytes = encodeGenesis(genesis);
     const fp = await genesisFingerprint(genesis);
     ensureDir(caDir);
-    writeFileSync46(join87(caDir, "genesis.bin"), genesisBytes);
-    writeSecretFile(join87(caDir, "ca.sealed"), encodeRecoveryBundle(await sealCaKey(seed, pass, `${org} mesh CA`)));
-    writeSecretFile(join87(caDir, "disablement.secret"), hex3(disable.secret));
+    writeFileSync47(join88(caDir, "genesis.bin"), genesisBytes);
+    writeSecretFile(join88(caDir, "ca.sealed"), encodeRecoveryBundle(await sealCaKey(seed, pass, `${org} mesh CA`)));
+    writeSecretFile(join88(caDir, "disablement.secret"), hex3(disable.secret));
     console.log(`
 Mesh created for "${org}".`);
     console.log(`  fingerprint: ${hex3(fp)}`);
@@ -81429,7 +81574,7 @@ Mesh created for "${org}".`);
     console.log(`  ${hex3(disable.secret)}`);
     console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
     console.log(`
-A copy of the disablement secret is in ${join87(caDir, "disablement.secret")}.`);
+A copy of the disablement secret is in ${join88(caDir, "disablement.secret")}.`);
     console.log("Move it somewhere the CA directory is not \u2014 holding both in one place");
     console.log("defeats the point of having two.");
     const caFlag = caDir === resolve13("./mesh-ca") ? "" : ` --ca-dir ${caDir}`;
@@ -81482,14 +81627,14 @@ Next, issue an identity for a machine (pick a free address in ${formatPrefix(gen
       [{ keyIndex: 0, privateKey: ca.privateKey }]
     );
     ensureDir(outDir);
-    writeFileSync46(join87(outDir, "genesis.bin"), genesisBytes);
-    writeFileSync46(join87(outDir, "node.cert"), encodeCert(cert));
-    writeSecretFile(join87(outDir, "node.key"), await exportStaticPrivate(nodeKey));
+    writeFileSync47(join88(outDir, "genesis.bin"), genesisBytes);
+    writeFileSync47(join88(outDir, "node.cert"), encodeCert(cert));
+    writeSecretFile(join88(outDir, "node.key"), await exportStaticPrivate(nodeKey));
     console.log(`Minted "${name}" at ${ip4}.`);
     console.log(`  ${outDir}`);
     console.log("\nCopy that directory to the node and run there:");
-    console.log(`  tesseract-agent net enroll --genesis ${join87(outDir, "genesis.bin")} \\`);
-    console.log(`      --cert ${join87(outDir, "node.cert")} --key ${join87(outDir, "node.key")}`);
+    console.log(`  tesseract-agent net enroll --genesis ${join88(outDir, "genesis.bin")} \\`);
+    console.log(`      --cert ${join88(outDir, "node.cert")} --key ${join88(outDir, "node.key")}`);
     console.log("\nnode.key is the node's identity \u2014 send it over a channel you trust, and");
     console.log("delete this copy once the node has it.");
     return;
@@ -81525,8 +81670,8 @@ Next, issue an identity for a machine (pick a free address in ${formatPrefix(gen
       ip4Exceptions: []
     };
     const signed = await signBundle(bundle, [{ keyIndex: 0, privateKey: ca.privateKey }]);
-    const out = resolve13(typeof flags.out === "string" ? flags.out : join87(caDir, "bundle.bin"));
-    writeFileSync46(out, encodeSignedBundle(signed));
+    const out = resolve13(typeof flags.out === "string" ? flags.out : join88(caDir, "bundle.bin"));
+    writeFileSync47(out, encodeSignedBundle(signed));
     console.log(`Signed policy bundle (epoch ${epoch2}) \u2192 ${out}`);
     console.log("Every node must receive it; the relay distributes it, or copy it to");
     console.log(`each node's mesh directory as bundle.bin.`);
@@ -81548,17 +81693,43 @@ var init_mesh_ca = __esm({
 
 // src/cli.ts
 init_base_paths();
-import { existsSync as existsSync50, mkdtempSync as mkdtempSync4, readFileSync as readFileSync56, rmSync as rmSync13 } from "node:fs";
+import { existsSync as existsSync51, mkdtempSync as mkdtempSync4, readFileSync as readFileSync57, rmSync as rmSync13 } from "node:fs";
 import { createHash as createHash9 } from "node:crypto";
 import { execFileSync as execFileSync6, spawn as spawn14 } from "node:child_process";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 import { tmpdir as tmpdir8 } from "node:os";
-import { dirname as dirname40, join as join88, resolve as resolve15 } from "node:path";
+import { dirname as dirname41, join as join89, resolve as resolve15 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 
 // ../../packages/host-core/dist/control-link.js
 import { hostname as hostname4 } from "node:os";
 
+// ../../packages/host-core/dist/hook-fanout.js
+function composeHooks(sets, onError) {
+  return new Proxy({}, {
+    get(_target, key2) {
+      if (typeof key2 !== "string")
+        return void 0;
+      const fns = sets.map((s) => s[key2]).filter((f) => typeof f === "function");
+      if (fns.length === 0)
+        return void 0;
+      const owners = sets.filter((s) => typeof s[key2] === "function");
+      return (...args) => {
+        for (let i = 0; i < fns.length; i++) {
+          try {
+            fns[i].apply(owners[i], args);
+          } catch (err2) {
+            onError?.(key2, err2);
+          }
+        }
+      };
+    },
+    has(_target, key2) {
+      return typeof key2 === "string" && sets.some((s) => typeof s[key2] === "function");
+    }
+  });
+}
+
 // ../../packages/host-core/dist/engines/rewind-result.js
 var strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.length > 0) : [];
 function toRewindOutcome(res, noHistory) {
@@ -84817,21 +84988,21 @@ function createMcpHealth(deps = {}) {
   let servers = {};
   const disabled2 = /* @__PURE__ */ new Set();
   const cache5 = /* @__PURE__ */ new Map();
-  const inflight = /* @__PURE__ */ new Map();
+  const inflight2 = /* @__PURE__ */ new Map();
   async function probeCached(name, spec) {
     const hit = cache5.get(name);
     if (hit && now2() - hit.at < TTL_MS3)
       return hit.row;
-    const running2 = inflight.get(name);
+    const running2 = inflight2.get(name);
     if (running2)
       return running2;
     const p = probe(name, spec).catch((e) => ({ name, status: "failed", error: e?.message ?? "probe failed" })).then((row) => {
       const full = { ...row, name };
       cache5.set(name, { at: now2(), row: full });
-      inflight.delete(name);
+      inflight2.delete(name);
       return full;
     });
-    inflight.set(name, p);
+    inflight2.set(name, p);
     return p;
   }
   return {
@@ -84851,7 +85022,7 @@ function createMcpHealth(deps = {}) {
     },
     async reconnect(name) {
       cache5.delete(name);
-      inflight.delete(name);
+      inflight2.delete(name);
       if (servers[name] && !disabled2.has(name))
         await probeCached(name, servers[name]);
     },
@@ -84994,10 +85165,10 @@ function extractJson(text12) {
     }
   }
   for (let start3 = 0; start3 < text12.length; start3++) {
-    const open7 = text12[start3];
-    if (open7 !== "{" && open7 !== "[")
+    const open8 = text12[start3];
+    if (open8 !== "{" && open8 !== "[")
       continue;
-    const close = open7 === "{" ? "}" : "]";
+    const close = open8 === "{" ? "}" : "]";
     let depth = 0;
     let inStr = false;
     let esc3 = false;
@@ -85016,7 +85187,7 @@ function extractJson(text12) {
         inStr = true;
         continue;
       }
-      if (ch === open7)
+      if (ch === open8)
         depth++;
       else if (ch === close) {
         depth--;
@@ -90282,7 +90453,6 @@ var LAUNCH_MARKERS = [
   "CCB_FORCE_DAEMON_GUI",
   "CCB_HOST_DAEMON",
   "CCB_RDESK_ROLE",
-  "CCB_RDESK_SERVER",
   "CCB_RDESK_CLIENT",
   "CCB_RDESK_ONLY",
   "CCB_MESH_APP",
@@ -90297,7 +90467,7 @@ function mainAppChildEnv(env) {
   return out;
 }
 function ownBinaryIsMainApp(env) {
-  return !env.CCB_RDESK_ROLE && env.CCB_RDESK_SERVER !== "1" && env.CCB_RDESK_CLIENT !== "1" && env.CCB_MESH_APP !== "1";
+  return !env.CCB_RDESK_ROLE && env.CCB_RDESK_CLIENT !== "1" && env.CCB_MESH_APP !== "1";
 }
 
 // ../../packages/host-core/dist/gui/dock-policy.js
@@ -91224,11 +91394,11 @@ var GUIDE_TOOLS = describedBy("tool.voice-guide", GUIDE_TOOL_SHAPES);
 var defaultGreeting = () => prompt("voice.greeting");
 function buildGuidePrompt(opts = {}) {
   const project = opts.projectName ? prompt("voice.guide.project-clause", { projectName: opts.projectName }) : "";
-  const open7 = (opts.sessions ?? []).map((s) => s.label?.trim()).filter((l) => !!l);
-  const openLine = open7.length > 0 ? prompt("voice.guide.open-sessions", {
-    count: open7.length,
-    plural: open7.length === 1 ? "" : "s",
-    labels: open7.map((l) => `"${l}"`).join(", "),
+  const open8 = (opts.sessions ?? []).map((s) => s.label?.trim()).filter((l) => !!l);
+  const openLine = open8.length > 0 ? prompt("voice.guide.open-sessions", {
+    count: open8.length,
+    plural: open8.length === 1 ? "" : "s",
+    labels: open8.map((l) => `"${l}"`).join(", "),
     toolStatus: TOOL_STATUS
   }) : "";
   return [
@@ -95868,8 +96038,8 @@ async function falTopazEnhance(path6, spec, opts) {
   const dir2 = opts.outDir ?? workDir();
   mkdirSync22(dir2, { recursive: true });
   const outPath = join43(dir2, "enhanced.mp4");
-  const { writeFileSync: writeFileSync47 } = await import("node:fs");
-  writeFileSync47(outPath, Buffer.from(await dl.arrayBuffer()));
+  const { writeFileSync: writeFileSync48 } = await import("node:fs");
+  writeFileSync48(outPath, Buffer.from(await dl.arrayBuffer()));
   const out = await probeMedia(outPath).catch(() => null);
   opts.onProgress?.(100, "Enhance complete");
   return { path: outPath, mime: MIME, width: out?.width ?? null, height: out?.height ?? null, durationSec: out?.durationSec ?? p.durationSec, summary: `fal Topaz ${spec.model ?? "Proteus"} \xD7${spec.upscaleFactor ?? 2}` };
@@ -99984,7 +100154,7 @@ init_credentials();
 init_credentials();
 import { hostname as hostname3, platform } from "node:os";
 import { randomUUID as randomUUID23 } from "node:crypto";
-import { chmodSync as chmodSync3, existsSync as existsSync23, mkdirSync as mkdirSync26, readFileSync as readFileSync36, writeFileSync as writeFileSync24 } from "node:fs";
+import { chmodSync as chmodSync3, existsSync as existsSync23, mkdirSync as mkdirSync26, readFileSync as readFileSync36, statSync as statSync14, unlinkSync as unlinkSync3, writeFileSync as writeFileSync24 } from "node:fs";
 import { join as join53 } from "node:path";
 var FILE = () => join53(daemonDir2(), "machine-identity.json");
 function readMachineIdentity() {
@@ -100024,25 +100194,88 @@ function tokenUsable(m) {
   const ms = Date.parse(m.expiresAt);
   return Number.isFinite(ms) && ms - Date.now() > 24 * 60 * 60 * 1e3;
 }
+var inflight = null;
 async function ensureMachineIdentity(opts) {
+  if (inflight)
+    return inflight;
+  inflight = ensureMachineIdentityOnce(opts).finally(() => {
+    inflight = null;
+  });
+  return inflight;
+}
+var LOCK = () => join53(daemonDir2(), "machine-identity.lock");
+var LOCK_STALE_MS = 3e4;
+function tryRegistrationLock() {
+  const f = LOCK();
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      mkdirSync26(daemonDir2(), { recursive: true, mode: 448 });
+      writeFileSync24(f, String(process.pid), { flag: "wx" });
+      return true;
+    } catch {
+      try {
+        if (Date.now() - statSync14(f).mtimeMs < LOCK_STALE_MS)
+          return false;
+        unlinkSync3(f);
+      } catch {
+        return false;
+      }
+    }
+  }
+  return false;
+}
+function releaseRegistrationLock() {
+  try {
+    unlinkSync3(LOCK());
+  } catch {
+  }
+}
+async function waitForIdentity(ms) {
+  const until = Date.now() + ms;
+  while (Date.now() < until) {
+    await new Promise((r) => setTimeout(r, 250));
+    const m = readMachineIdentity();
+    if (m)
+      return m;
+  }
+  return null;
+}
+async function ensureMachineIdentityOnce(opts) {
   const { apiOrigin: apiOrigin2, backendOrigin: backendOrigin2, isAllowedOrigin: isAllowedOrigin3, log: log9 } = opts;
   if (!isAllowedOrigin3(apiOrigin2)) {
     log9?.(`machine identity: refusing a non-default server: ${apiOrigin2}`);
     return null;
   }
   let m = readMachineIdentity();
+  if (m && opts.deviceId)
+    m = adoptPersistentDeviceId(opts.deviceId, log9).identity ?? m;
   try {
     if (!m) {
-      const reg = await postJson(`${apiOrigin2}/api/core/tesseract/identity/device`, { label: hostname3().slice(0, 120), platform: platform() });
-      m = {
-        deviceToken: reg.token,
-        publicId: reg.publicId,
-        deviceId: randomUUID23().slice(0, 8),
-        apiOrigin: apiOrigin2,
-        backendOrigin: backendOrigin2
-      };
-      write(m);
-      log9?.(`machine identity: registered \u2014 this machine can be reached as ${reg.publicId}`);
+      if (!tryRegistrationLock()) {
+        m = await waitForIdentity(1e4);
+        if (!m) {
+          log9?.("machine identity: another process is registering this machine \u2014 will use its identity on the next tick");
+          return null;
+        }
+      } else {
+        try {
+          m = readMachineIdentity();
+          if (!m) {
+            const reg = await postJson(`${apiOrigin2}/api/core/tesseract/identity/device`, { label: hostname3().slice(0, 120), platform: platform() });
+            m = {
+              deviceToken: reg.token,
+              publicId: reg.publicId,
+              deviceId: opts.deviceId ?? randomUUID23().slice(0, 8),
+              apiOrigin: apiOrigin2,
+              backendOrigin: backendOrigin2
+            };
+            write(m);
+            log9?.(`machine identity: registered \u2014 this machine can be reached as ${reg.publicId}`);
+          }
+        } finally {
+          releaseRegistrationLock();
+        }
+      }
     }
     if (!tokenUsable(m)) {
       const t = await postJson(`${apiOrigin2}/auth/device/relay-token`, { deviceToken: m.deviceToken, deviceId: m.deviceId });
@@ -100056,6 +100289,18 @@ async function ensureMachineIdentity(opts) {
     return m && tokenUsable(m) ? m : null;
   }
 }
+function adoptPersistentDeviceId(deviceId3, log9) {
+  const m = readMachineIdentity();
+  if (!m || !deviceId3 || m.deviceId === deviceId3)
+    return { identity: m, migratedFrom: null };
+  const old = m.deviceId;
+  const next = { ...m, deviceId: deviceId3 };
+  delete next.accessToken;
+  delete next.expiresAt;
+  write(next);
+  log9?.(`machine identity: device id ${old} \u2192 ${deviceId3} (the id this computer has whether signed in or not)`);
+  return { identity: next, migratedFrom: old };
+}
 
 // ../../packages/host-core/dist/rdesk/server-auth.js
 var DEFAULT_API = (process.env.CCB_TESSERACT_API ?? "https://app.tesseract.dev").replace(/\/$/, "");
@@ -100099,7 +100344,7 @@ import { dirname as dirname27, join as join58, resolve as resolve11 } from "node
 // ../../packages/host-core/dist/active-link/blocks.js
 import { createHash as createHash5 } from "node:crypto";
 import { createReadStream as createReadStream2 } from "node:fs";
-import { open as open3, mkdir as mkdir12, rename as rename2, chmod as chmod2, utimes, unlink } from "node:fs/promises";
+import { open as open4, mkdir as mkdir12, rename as rename2, chmod as chmod2, utimes, unlink } from "node:fs/promises";
 import { dirname as dirname24 } from "node:path";
 var CHUNK3 = 1024 * 1024;
 var MAX_INFLIGHT2 = 8 * CHUNK3;
@@ -100229,7 +100474,7 @@ var StagingWriter = class {
   async ensureOpen() {
     if (!this.fh) {
       await mkdir12(dirname24(this.stagingPath), { recursive: true });
-      this.fh = await open3(this.stagingPath, "w");
+      this.fh = await open4(this.stagingPath, "w");
     }
     return this.fh;
   }
@@ -100292,7 +100537,7 @@ var BlockAssembler = class {
   }
   async open() {
     await mkdir12(dirname24(this.stagingPath), { recursive: true });
-    this.fh = await open3(this.stagingPath, "w");
+    this.fh = await open4(this.stagingPath, "w");
   }
   /** Write a received block at its byte offset (index * CHUNK). */
   async writeBlock(index, buf) {
@@ -100307,7 +100552,7 @@ var BlockAssembler = class {
       await this.open();
     let lf = null;
     try {
-      lf = await open3(localAbs, "r");
+      lf = await open4(localAbs, "r");
       const buf = Buffer.alloc(len);
       const { bytesRead } = await lf.read(buf, 0, len, localOffset);
       if (bytesRead !== len)
@@ -100569,7 +100814,7 @@ async function gitSyncedFiles(root) {
 
 // ../../packages/host-core/dist/active-link/session.js
 import { createHash as createHash6 } from "node:crypto";
-import { lstat as lstat4, readlink as readlink3, open as open4 } from "node:fs/promises";
+import { lstat as lstat4, readlink as readlink3, open as open5 } from "node:fs/promises";
 var OutboundSender = class {
   deps;
   queue = [];
@@ -100663,7 +100908,7 @@ var OutboundSender = class {
     const running2 = createHash6("sha256");
     let fh;
     try {
-      fh = await open4(abs, "r");
+      fh = await open5(abs, "r");
     } catch {
       return;
     }
@@ -100734,7 +100979,7 @@ var OutboundSender = class {
     const mode = st.mode;
     let fh;
     try {
-      fh = await open4(abs, "r");
+      fh = await open5(abs, "r");
     } catch {
       return;
     }
@@ -100995,7 +101240,7 @@ function readdirp(root, options = {}) {
 
 // ../../node_modules/chokidar/esm/handler.js
 import { watchFile, unwatchFile, watch as fs_watch } from "fs";
-import { open as open5, stat as stat7, lstat as lstat6, realpath as fsrealpath } from "fs/promises";
+import { open as open6, stat as stat7, lstat as lstat6, realpath as fsrealpath } from "fs/promises";
 import * as sysPath from "path";
 import { type as osType } from "os";
 var STR_DATA = "data";
@@ -101379,7 +101624,7 @@ var setFsWatchListener = (path6, fullPath, options, handlers) => {
         cont.watcherUnusable = true;
       if (isWindows2 && error51.code === "EPERM") {
         try {
-          const fd = await open5(path6, "r");
+          const fd = await open6(path6, "r");
           await fd.close();
           broadcastErr(error51);
         } catch (err2) {
@@ -101497,9 +101742,9 @@ var NodeFsHandler = class {
     if (this.fsw.closed) {
       return;
     }
-    const dirname41 = sysPath.dirname(file2);
+    const dirname42 = sysPath.dirname(file2);
     const basename14 = sysPath.basename(file2);
-    const parent = this.fsw._getWatchedDir(dirname41);
+    const parent = this.fsw._getWatchedDir(dirname42);
     let prevStats = stats;
     if (parent.has(basename14))
       return;
@@ -101526,7 +101771,7 @@ var NodeFsHandler = class {
             prevStats = newStats2;
           }
         } catch (error51) {
-          this.fsw._remove(dirname41, basename14);
+          this.fsw._remove(dirname42, basename14);
         }
       } else if (parent.has(basename14)) {
         const at = newStats.atimeMs;
@@ -103725,6 +103970,7 @@ function turnRekeyed(from, to) {
 var HOST_ROOT = resolveHostRoot();
 var HOST_CONTAIN = resolveContainmentRoot() ?? void 0;
 var hooks = null;
+var hookSets = [];
 var socket = null;
 var heartbeat = null;
 var reconnectTimer = null;
@@ -103883,7 +104129,7 @@ async function ensureP2pReady() {
   }
 }
 function ownHostId() {
-  const mine = serverHosts.find((h) => h.hostId.endsWith(`:${deviceId}`));
+  const mine = serverHosts.find((h) => h.deviceId === deviceId);
   return mine?.hostId ?? "local";
 }
 var lastOwnHostLog = null;
@@ -103897,9 +104143,10 @@ function logOwnHostVerdict() {
 }
 function presentedHosts() {
   const out = serverHosts.slice();
-  if (!out.some((h) => h.hostId.endsWith(`:${deviceId}`))) {
+  if (!out.some((h) => h.deviceId === deviceId)) {
     out.unshift({
       hostId: "local",
+      deviceId,
       name: hostname4(),
       kind: "electron",
       platform: process.platform,
@@ -103914,7 +104161,7 @@ function presentedHosts() {
 }
 function connectedFsHosts() {
   const mine = ownHostId();
-  return serverHosts.filter((h) => h.online && h.hostId !== mine && !h.hostId.endsWith(`:${deviceId}`)).filter((h) => h.kind === "electron" || h.kind === "cloud").filter((h) => !h.caps || h.caps.includes("fs")).map((h) => ({ hostId: h.hostId, label: h.name || (h.kind === "cloud" ? "Cloud agent" : "Remote machine") }));
+  return serverHosts.filter((h) => h.online && h.hostId !== mine && h.deviceId !== deviceId).filter((h) => h.kind === "electron" || h.kind === "cloud").filter((h) => !h.caps || h.caps.includes("fs")).map((h) => ({ hostId: h.hostId, label: h.name || (h.kind === "cloud" ? "Cloud agent" : "Remote machine") }));
 }
 function listHosts() {
   return presentedHosts();
@@ -104095,7 +104342,12 @@ function resumeActiveLinks() {
     for (const { linkId } of listActiveLinks())
       if (!configured.has(linkId))
         void disconnectActiveLink(linkId);
-    for (const cfg2 of configs) {
+    for (const stored of configs) {
+      const peerDevice = hostDeviceId(stored.peerHostId);
+      const live = peerDevice ? serverHosts.find((h) => h.deviceId === peerDevice) : void 0;
+      const cfg2 = live && live.hostId !== stored.peerHostId ? { ...stored, peerHostId: live.hostId } : stored;
+      if (cfg2 !== stored)
+        saveLinkConfig(cfg2);
       connectActiveLink({
         linkId: cfg2.linkId,
         localRoot: cfg2.localRoot,
@@ -104695,10 +104947,19 @@ function handleHostChannel(payload) {
     return;
   }
   if (payload.type === "host:register:denied") {
+    const d = payload;
+    if (d.reason === "revoked") {
+      stopHeartbeat();
+      teardownHostRole();
+      const message2 = typeof payload.message === "string" ? payload.message : "This computer was removed from the account.";
+      console.log(`[control-link] host:register DENIED reason=revoked \u2014 ${message2}`);
+      hooks?.notify({ type: "notify", level: "warning", message: message2 });
+      hooks?.onDeviceRevoked?.();
+      return;
+    }
     entitlementDenied = true;
     stopHeartbeat();
     const message = typeof payload.message === "string" ? payload.message : "Running agents on your own machines requires a paid plan.";
-    const d = payload;
     console.log(`[control-link] host:register DENIED reason=${String(d.reason ?? "?")} feature=${String(d.feature ?? "?")} limit=${String(d.limit ?? "?")} \u2014 ${message}`);
     hooks?.notify({ type: "notify", level: "warning", message });
     scheduleEntitlementRetry();
@@ -105186,7 +105447,9 @@ function startControlLink(config2, h) {
   deviceId = config2.deviceId;
   backendOrigin = config2.tokenSource.backendOrigin;
   hostVersion = config2.version;
-  hooks = h;
+  if (!hookSets.includes(h))
+    hookSets.push(h);
+  hooks = composeHooks(hookSets, (hook, err2) => console.warn(`[control-link] ${hook} listener failed:`, err2 instanceof Error ? err2.message : err2));
   stopped = false;
   if (config2.e2e && !hostSessions) {
     const e2e = config2.e2e;
@@ -105232,6 +105495,8 @@ function refreshControlLink() {
   if (accountChanged) {
     serverHosts = [];
     serverSelected = false;
+    entitlementDenied = false;
+    cancelEntitlementRetry();
     teardownHostRole();
     hooks.pushHosts(presentedHosts());
     hooks.ownHostResolved(ownHostId());
@@ -106730,7 +106995,7 @@ function rdeskSharingEnabled() {
 // ../../packages/host-core/dist/rdesk/password.js
 init_credentials();
 import { scryptSync, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual4, randomInt } from "node:crypto";
-import { readFileSync as readFileSync41, writeFileSync as writeFileSync29, existsSync as existsSync28, unlinkSync as unlinkSync3 } from "node:fs";
+import { readFileSync as readFileSync41, writeFileSync as writeFileSync29, existsSync as existsSync28, unlinkSync as unlinkSync4 } from "node:fs";
 import { join as join63 } from "node:path";
 function pwFile() {
   return join63(daemonDir2(), "rdesk-password.json");
@@ -106776,11 +107041,11 @@ function readRdeskPasswordPlain() {
 function setRdeskPassword(password) {
   if (!password) {
     try {
-      unlinkSync3(pwFile());
+      unlinkSync4(pwFile());
     } catch {
     }
     try {
-      unlinkSync3(pwPlainFile());
+      unlinkSync4(pwPlainFile());
     } catch {
     }
     return;
@@ -107471,7 +107736,7 @@ async function seal(key2, plaintext, aad) {
   const ct = await aesSeal(key2, nonce2, plaintext, aad);
   return `${ENVELOPE}:${b64u(nonce2)}:${b64u(ct)}`;
 }
-async function open6(key2, envelope2, aad) {
+async function open7(key2, envelope2, aad) {
   const parts = envelope2.split(":");
   if (parts.length !== 3 || parts[0] !== ENVELOPE)
     throw new Error("malformed vault envelope");
@@ -107484,7 +107749,7 @@ async function wrapVaultKey(masterKey, vaultKey) {
   return seal(await wrappingKey(masterKey), vaultKey, WRAP_AAD);
 }
 async function unwrapVaultKey(masterKey, wrapped) {
-  return open6(await wrappingKey(masterKey), wrapped, WRAP_AAD);
+  return open7(await wrappingKey(masterKey), wrapped, WRAP_AAD);
 }
 async function createVault(masterPassword, kdf2 = defaultKdfParams()) {
   const masterKey = deriveMasterKey(masterPassword, kdf2);
@@ -107517,7 +107782,7 @@ async function recoverWithKey(recoveryKey, meta4) {
     throw new Error("no recovery key is set for this vault");
   const kek = await importAesKey(parseRecoveryKey(recoveryKey));
   try {
-    return await open6(kek, meta4.recoveryWrappedVaultKey, RECOVERY_AAD);
+    return await open7(kek, meta4.recoveryWrappedVaultKey, RECOVERY_AAD);
   } catch {
     throw new Error("Incorrect recovery key");
   }
@@ -107538,7 +107803,7 @@ async function encryptItem(vaultKey, item) {
 }
 async function decryptItem(vaultKey, enc) {
   const key2 = await importAesKey(vaultKey);
-  return JSON.parse(fromUtf8(await open6(key2, enc.ciphertext, itemAad(enc.id))));
+  return JSON.parse(fromUtf8(await open7(key2, enc.ciphertext, itemAad(enc.id))));
 }
 function tombstone(id, updatedAt) {
   return { id, ciphertext: "", updatedAt, deleted: true };
@@ -108401,7 +108666,7 @@ function makeDaemonVaultApi(getOrigin, getToken2) {
 
 // ../../packages/host-core/dist/vault/persistence.js
 init_base_paths();
-import { existsSync as existsSync29, mkdirSync as mkdirSync31, readFileSync as readFileSync42, writeFileSync as writeFileSync30, unlinkSync as unlinkSync4 } from "node:fs";
+import { existsSync as existsSync29, mkdirSync as mkdirSync31, readFileSync as readFileSync42, writeFileSync as writeFileSync30, unlinkSync as unlinkSync5 } from "node:fs";
 import { dirname as dirname29 } from "node:path";
 function vaultStoreFile() {
   return homePath(".tesseract", "vault", "vault.json");
@@ -108447,7 +108712,7 @@ function makeVaultPersistence(file2 = vaultStoreFile, deviceKeyFile = vaultDevic
     clearDeviceKey() {
       try {
         if (existsSync29(deviceKeyFile()))
-          unlinkSync4(deviceKeyFile());
+          unlinkSync5(deviceKeyFile());
       } catch {
       }
     }
@@ -109624,16 +109889,16 @@ async function startLocalServer(opts) {
 
 // ../../packages/host-core/dist/daemon-runtime.js
 init_base_paths();
-import { readFileSync as readFileSync49, writeFileSync as writeFileSync40, existsSync as existsSync39, mkdirSync as mkdirSync41, unlinkSync as unlinkSync6, chmodSync as chmodSync7, statSync as statSync14 } from "node:fs";
+import { readFileSync as readFileSync50, writeFileSync as writeFileSync41, existsSync as existsSync40, mkdirSync as mkdirSync42, unlinkSync as unlinkSync7, chmodSync as chmodSync7, statSync as statSync15 } from "node:fs";
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { join as join77 } from "node:path";
+import { join as join78 } from "node:path";
 import { randomBytes as randomBytes10 } from "node:crypto";
 import { hostname as hostname5 } from "node:os";
 
 // ../../packages/shared/dist/daemon-registry.js
 init_base_paths();
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync31, mkdirSync as mkdirSync34, readdirSync as readdirSync11, readFileSync as readFileSync45, readlinkSync, unlinkSync as unlinkSync5, writeFileSync as writeFileSync33 } from "node:fs";
+import { existsSync as existsSync31, mkdirSync as mkdirSync34, readdirSync as readdirSync11, readFileSync as readFileSync45, readlinkSync, unlinkSync as unlinkSync6, writeFileSync as writeFileSync33 } from "node:fs";
 import { join as join65 } from "node:path";
 var SUPERVISOR_PID = Number(process.env.CCB_DAEMON_SUPERVISOR_PID ?? 0) || 0;
 delete process.env.CCB_DAEMON_SUPERVISOR_PID;
@@ -109714,7 +109979,7 @@ function registerSelfAsDaemon(version2) {
 }
 function forgetDaemon(pid) {
   try {
-    unlinkSync5(recordPath(pid));
+    unlinkSync6(recordPath(pid));
   } catch {
   }
   invalidateSupervisorCache();
@@ -109922,6 +110187,7 @@ var BundleOfferLedger = class {
 init_dist6();
 
 // ../../packages/host-core/dist/mesh/netd-client.js
+import { existsSync as existsSync33, readdirSync as readdirSync12 } from "node:fs";
 import { connect as connect2 } from "node:net";
 import { platform as platform3 } from "node:process";
 var NETD_WIRE_VERSION = 2;
@@ -109934,6 +110200,17 @@ function netdEndpoint() {
     return "/var/run/tesseract-netd.sock";
   return "/run/tesseract-netd.sock";
 }
+function netdListening() {
+  const ep = endpointOverride() ?? netdEndpoint();
+  if (process.platform !== "win32")
+    return existsSync33(ep);
+  try {
+    const name = ep.replace(/^\\\\\.\\pipe\\/, "");
+    return readdirSync12("\\\\.\\pipe\\").includes(name);
+  } catch {
+    return false;
+  }
+}
 function endpointOverride() {
   return process.env.CCB_NETD_SOCKET ?? null;
 }
@@ -110295,9 +110572,6 @@ var NetdEngine = class {
   }
 };
 
-// ../../packages/host-core/dist/mesh/node.js
-import { existsSync as existsSync34 } from "node:fs";
-
 // ../../packages/host-core/dist/mesh/bundle-refresh.js
 init_dist6();
 var CONTEXT = "tsr-bundle-fetch-v1";
@@ -110334,7 +110608,7 @@ ${ts}`);
 
 // ../../packages/host-core/dist/mesh/config.js
 init_credentials();
-import { chmodSync as chmodSync5, existsSync as existsSync33, mkdirSync as mkdirSync36, readdirSync as readdirSync12, readFileSync as readFileSync47, renameSync as renameSync11, rmSync as rmSync7, writeFileSync as writeFileSync35 } from "node:fs";
+import { chmodSync as chmodSync5, existsSync as existsSync34, mkdirSync as mkdirSync36, readdirSync as readdirSync13, readFileSync as readFileSync47, renameSync as renameSync11, rmSync as rmSync7, writeFileSync as writeFileSync35 } from "node:fs";
 import { dirname as dirname31, join as join68 } from "node:path";
 function meshDir() {
   return join68(daemonDir2(), "mesh");
@@ -110378,14 +110652,14 @@ var FILES = {
 function readIfPresent(name, dir2 = meshDir()) {
   const p = join68(dir2, name);
   try {
-    return existsSync33(p) ? new Uint8Array(readFileSync47(p)) : void 0;
+    return existsSync34(p) ? new Uint8Array(readFileSync47(p)) : void 0;
   } catch {
     return void 0;
   }
 }
 function migrateSingleMesh() {
   const legacyGenesis = join68(meshDir(), FILES.genesis);
-  if (!existsSync33(legacyGenesis))
+  if (!existsSync34(legacyGenesis))
     return null;
   const id = meshIdFromCert(readIfPresent(FILES.cert)) ?? LEGACY_MESH_ID;
   const dest = oneMeshDir(id);
@@ -110394,11 +110668,11 @@ function migrateSingleMesh() {
     chmodSync5(dest, 448);
     for (const f of Object.values(FILES)) {
       const from = join68(meshDir(), f);
-      if (existsSync33(from))
+      if (existsSync34(from))
         renameSync11(from, join68(dest, f));
     }
     const key2 = join68(dest, FILES.key);
-    if (existsSync33(key2))
+    if (existsSync34(key2))
       chmodSync5(key2, 384);
   } catch {
     return null;
@@ -110409,7 +110683,7 @@ function listMeshIds() {
   migrateSingleMesh();
   let names;
   try {
-    names = readdirSync12(meshesDir(), { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    names = readdirSync13(meshesDir(), { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return [];
   }
@@ -110704,7 +110978,7 @@ function loadMeshCore() {
 }
 var meshCore = loadMeshCore();
 function meshEngineStatus() {
-  if (process.env.CCB_MESH_IN_DAEMON !== "1" && existsSync34(netdEndpoint())) {
+  if (process.env.CCB_MESH_IN_DAEMON !== "1" && netdListening()) {
     return { available: true, reason: null };
   }
   return { available: meshCore.available === true, reason: meshCore.loadError ?? null };
@@ -110934,7 +111208,14 @@ var MeshNode = class {
         reason: "this machine was removed from the network \u2014 ask an admin for a new invitation"
       };
     }
-    const inNetd = process.env.CCB_MESH_IN_DAEMON !== "1" && existsSync34(netdEndpoint());
+    const forcedInDaemon = process.env.CCB_MESH_IN_DAEMON === "1";
+    const inNetd = !forcedInDaemon && netdListening();
+    if (!inNetd && !forcedInDaemon) {
+      return {
+        ok: false,
+        reason: "the network helper is not running, so nothing can open the tunnel \u2014 install it with `tesseract-agent net helper install`"
+      };
+    }
     if (!inNetd && !meshCore.available) {
       return { ok: false, reason: `mesh engine unavailable: ${meshCore.loadError ?? "no prebuilt"}` };
     }
@@ -111670,14 +111951,32 @@ function startNodes(log9) {
       return [];
     }
     const started2 = meshNode().start();
-    log9(started2.ok ? "mesh: node up" : `mesh: not started \u2014 ${started2.reason}`);
-    return started2.ok && only !== void 0 ? [only] : [];
+    if (started2.ok) {
+      log9("mesh: node up");
+      return only !== void 0 ? [only] : [];
+    }
+    const refusal = { running: false, enrolled: true, lastError: started2.reason };
+    if (only !== void 0)
+      writeStatus(refusal, only);
+    writeStatus(refusal);
+    log9(`mesh: not started \u2014 ${started2.reason}`);
+    return [];
   }
   const running2 = [];
+  let failedPrimary = null;
   for (const r of meshManager().startAll()) {
-    log9(r.ok ? `mesh ${r.meshId}: up` : `mesh ${r.meshId}: not started \u2014 ${r.reason}`);
-    if (r.ok)
+    if (r.ok) {
+      log9(`mesh ${r.meshId}: up`);
       running2.push(r.meshId);
+      continue;
+    }
+    writeStatus({ running: false, enrolled: true, lastError: r.reason }, r.meshId);
+    if (failedPrimary === null)
+      failedPrimary = r.reason ?? "the node did not start";
+    log9(`mesh ${r.meshId}: not started \u2014 ${r.reason}`);
+  }
+  if (running2.length === 0 && failedPrimary !== null) {
+    writeStatus({ running: false, enrolled: true, lastError: failedPrimary });
   }
   return running2;
 }
@@ -111748,7 +112047,7 @@ function initDropReceiveUi(deps = {}) {
           log5("reveal failed:", err2 instanceof Error ? err2.message : String(err2));
         }
       };
-      const open7 = () => {
+      const open8 = () => {
         const el2 = electronModule();
         if (!el2)
           return;
@@ -111759,7 +112058,7 @@ function initDropReceiveUi(deps = {}) {
         title: "Files received",
         body: `${describe3(e)} \xB7 ${formatBytes(e.bytesDone)}`,
         actions: [{ id: "reveal", label: "Show in Finder" }, { id: "open", label: "Open" }],
-        onAction: (id) => id === "open" ? open7() : reveal(),
+        onAction: (id) => id === "open" ? open8() : reveal(),
         // Clicking the banner body is the only reliable action on macOS (buttons need
         // an expanded banner and are suppressed under Focus), so make it do the useful
         // thing rather than nothing.
@@ -112183,8 +112482,8 @@ async function fetchBlobDrop(opts) {
   if (opts.sealedKey) {
     if (!opts.sealingPrivate)
       throw new Error("This device has no sealing key, so it cannot open the transfer.");
-    const open7 = opts.openSeal ?? openFromPrivateKey;
-    contentKey = await open7(await opts.sealingPrivate(), opts.sealedKey, new TextEncoder().encode(opts.dropId));
+    const open8 = opts.openSeal ?? openFromPrivateKey;
+    contentKey = await open8(await opts.sealingPrivate(), opts.sealedKey, new TextEncoder().encode(opts.dropId));
   }
   const totalBytes = opts.items.reduce((n, i) => n + (i.kind === "file" ? i.size : 0), 0);
   let bytesDone = 0;
@@ -113760,10 +114059,42 @@ function closeRdeskCallWindow() {
 // ../../packages/host-core/dist/daemon-runtime.js
 init_credentials();
 
+// ../../packages/shared/dist/identity.js
+init_base_paths();
+import { existsSync as existsSync39, mkdirSync as mkdirSync41, readFileSync as readFileSync49, writeFileSync as writeFileSync40 } from "node:fs";
+import { dirname as dirname35, join as join77 } from "node:path";
+import { randomUUID as randomUUID29 } from "node:crypto";
+function deviceIdFile() {
+  return join77(tesseractHome(), "device-id.json");
+}
+function readPersistedDeviceId() {
+  try {
+    const raw = JSON.parse(readFileSync49(deviceIdFile(), "utf-8"));
+    return typeof raw.deviceId === "string" && raw.deviceId ? raw.deviceId : null;
+  } catch {
+    return null;
+  }
+}
+function persistentDeviceId() {
+  const cur = readPersistedDeviceId();
+  if (cur)
+    return cur;
+  const id = randomUUID29().slice(0, 8);
+  try {
+    const f = deviceIdFile();
+    const dir2 = dirname35(f);
+    if (!existsSync39(dir2))
+      mkdirSync41(dir2, { recursive: true });
+    writeFileSync40(f, JSON.stringify({ deviceId: id }));
+  } catch {
+  }
+  return id;
+}
+
 // ../../packages/host-core/dist/error-report.js
 init_dist2();
 init_credentials();
-import { randomUUID as randomUUID29 } from "node:crypto";
+import { randomUUID as randomUUID30 } from "node:crypto";
 import { release as osRelease, arch as osArch } from "node:os";
 var MAX_QUEUE = 100;
 var FLUSH_INTERVAL_MS = 3e4;
@@ -113815,7 +114146,7 @@ function captureDaemonError(error51, opts = {}) {
       return;
     const creds3 = readCredentials();
     const report = {
-      reportId: randomUUID29(),
+      reportId: randomUUID30(),
       occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
       schemaVersion: 1,
       surface,
@@ -113912,8 +114243,8 @@ async function runDaemon(opts = {}) {
   log9("paths", JSON.stringify(sealBasePaths()));
   const OUR_STARTED_AT = procStartedAt(process.pid);
   let ownsMachine = false;
-  const pidfile = () => join77(daemonDir2(), "daemon.lock");
-  const statusFile = () => join77(daemonDir2(), "status.json");
+  const pidfile = () => join78(daemonDir2(), "daemon.lock");
+  const statusFile = () => join78(daemonDir2(), "status.json");
   const isAlive2 = (pid) => {
     if (!Number.isFinite(pid) || pid <= 0)
       return false;
@@ -113926,7 +114257,7 @@ async function runDaemon(opts = {}) {
   };
   const lockHeldByAnother = () => {
     try {
-      const pid = Number(readFileSync49(pidfile(), "utf-8").trim());
+      const pid = Number(readFileSync50(pidfile(), "utf-8").trim());
       return Number.isFinite(pid) && pid > 0 && pid !== process.pid && isAlive2(pid);
     } catch {
       return false;
@@ -113934,7 +114265,7 @@ async function runDaemon(opts = {}) {
   };
   const lockHeldByYieldingSubset = () => {
     try {
-      const pid = Number(readFileSync49(pidfile(), "utf-8").trim());
+      const pid = Number(readFileSync50(pidfile(), "utf-8").trim());
       if (!Number.isFinite(pid) || pid <= 0 || pid === process.pid || !isAlive2(pid))
         return false;
       return liveDaemons().some((d) => d.pid === pid && d.rdeskOnly === true);
@@ -113945,22 +114276,22 @@ async function runDaemon(opts = {}) {
   function acquireLock2() {
     const f = pidfile();
     try {
-      if (!existsSync39(daemonDir2()))
-        mkdirSync41(daemonDir2(), { recursive: true, mode: 448 });
+      if (!existsSync40(daemonDir2()))
+        mkdirSync42(daemonDir2(), { recursive: true, mode: 448 });
     } catch {
     }
     for (let attempt = 0; attempt < 2; attempt++) {
       try {
-        writeFileSync40(f, String(process.pid), { flag: "wx" });
+        writeFileSync41(f, String(process.pid), { flag: "wx" });
         return true;
       } catch {
         try {
-          const prev = Number(readFileSync49(f, "utf-8").trim());
+          const prev = Number(readFileSync50(f, "utf-8").trim());
           if (!prev)
             return false;
           if (prev !== process.pid && isAlive2(prev))
             return false;
-          unlinkSync6(f);
+          unlinkSync7(f);
         } catch {
           return false;
         }
@@ -113971,8 +114302,8 @@ async function runDaemon(opts = {}) {
   function releaseLock() {
     try {
       const f = pidfile();
-      if (existsSync39(f) && Number(readFileSync49(f, "utf-8").trim()) === process.pid)
-        unlinkSync6(f);
+      if (existsSync40(f) && Number(readFileSync50(f, "utf-8").trim()) === process.pid)
+        unlinkSync7(f);
     } catch {
     }
   }
@@ -113981,7 +114312,7 @@ async function runDaemon(opts = {}) {
     if (!ownsMachine)
       return;
     try {
-      writeFileSync40(statusFile(), JSON.stringify({ pid: process.pid, startedAt: OUR_STARTED_AT, role: process.env.CCB_RDESK_ROLE ?? "host", version: VERSION3, execPath: process.env.CCB_DAEMON_EXECPATH ?? process.execPath, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), gui: daemonGuiTrayActive(), ...localInfo ?? {}, ...s }));
+      writeFileSync41(statusFile(), JSON.stringify({ pid: process.pid, startedAt: OUR_STARTED_AT, role: process.env.CCB_RDESK_ROLE ?? "host", version: VERSION3, execPath: process.env.CCB_DAEMON_EXECPATH ?? process.execPath, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), gui: daemonGuiTrayActive(), ...localInfo ?? {}, ...s }));
       chmodSync7(statusFile(), 384);
     } catch {
     }
@@ -114028,6 +114359,19 @@ async function runDaemon(opts = {}) {
   const activityTracker = createActivityTracker({ log: log9 });
   let activityTimer = null;
   let creds3 = readCredentials();
+  try {
+    const ownId = persistentDeviceId();
+    const { migratedFrom } = adoptPersistentDeviceId(ownId, (m) => log9(m));
+    if (migratedFrom) {
+      try {
+        opts.onDeviceIdMigrated?.(migratedFrom, ownId);
+      } catch (e) {
+        log9("device id migration hook failed", e.message);
+      }
+    }
+  } catch (e) {
+    log9("device id reconcile skipped", e.message);
+  }
   let machine = null;
   const acquireIdentity = async () => {
     const signedIn = readCredentials();
@@ -114039,6 +114383,7 @@ async function runDaemon(opts = {}) {
       apiOrigin: apiOriginForMachine(),
       backendOrigin: backendOriginForMachine(),
       isAllowedOrigin: isAllowedApiOrigin,
+      deviceId: persistentDeviceId(),
       log: (msg) => log9(msg)
     });
     machine = m;
@@ -114490,6 +114835,7 @@ async function runDaemon(opts = {}) {
         apiOrigin: c.apiOrigin,
         backendOrigin: c.backendOrigin,
         isAllowedOrigin: isAllowedApiOrigin,
+        deviceId: persistentDeviceId(),
         log: (m) => log9(m)
       });
       if (!next?.accessToken) {
@@ -114516,7 +114862,7 @@ async function runDaemon(opts = {}) {
         if (r.status === 401) {
           log9("device token no longer valid \u2014 dropping to local-only on restart");
           try {
-            unlinkSync6(join77(daemonDir2(), "credentials.json"));
+            unlinkSync7(join78(daemonDir2(), "credentials.json"));
           } catch {
           }
           shutdown(0, "token-revoked-401");
@@ -114535,7 +114881,7 @@ async function runDaemon(opts = {}) {
       scheduleRefreshRetry("the api was unreachable");
     }
   }
-  setDaemonIdentityReload(async () => {
+  const reloadIdentity = async () => {
     const fresh = readCredentials();
     const next = nextDaemonIdentity(fresh, { accessToken, userId: c.userId });
     if (next.kind === "unchanged")
@@ -114552,6 +114898,7 @@ async function runDaemon(opts = {}) {
       apiOrigin: c.apiOrigin,
       backendOrigin: c.backendOrigin,
       isAllowedOrigin: isAllowedApiOrigin,
+      deviceId: persistentDeviceId(),
       log: (msg) => log9(msg)
     });
     if (!m?.accessToken) {
@@ -114563,7 +114910,8 @@ async function runDaemon(opts = {}) {
     accessToken = m.accessToken;
     log9("signed out \u2014 this machine speaks for itself again");
     refreshControlLink();
-  });
+  };
+  setDaemonIdentityReload(reloadIdentity);
   registerTesseractEngine({ getIceServers: () => fetchIceServers() });
   registerVncEngine();
   registerRdpEngine();
@@ -114814,7 +115162,7 @@ async function runDaemon(opts = {}) {
     let freeTicks = 0;
     const lockHolder = () => {
       try {
-        return Number(readFileSync49(pidfile(), "utf-8").trim()) || 0;
+        return Number(readFileSync50(pidfile(), "utf-8").trim()) || 0;
       } catch {
         return 0;
       }
@@ -114891,7 +115239,7 @@ async function runDaemon(opts = {}) {
     // open. getRdeskClientWebContents() is null for the SERVER / full-app daemon (no client
     // window) → those sends are no-ops, so this is inert outside the rdesk-client role.
     pushHosts: (hosts) => {
-      writeStatus2({ deviceId: c.deviceId, connected: true });
+      writeStatus2({ deviceId: c.deviceId, ownHostId: ownHost(), connected: true });
       getRdeskClientWebContents()?.send("hostlink:hosts", hosts);
     },
     ownHostResolved: (own2) => {
@@ -114975,6 +115323,18 @@ async function runDaemon(opts = {}) {
     deliverRdeskSignal: (payload, hostId, sessionId) => {
       getRdeskClientWebContents()?.send("rdesk:signal", { payload, hostId, sessionId });
     },
+    // The account removed this machine (Remove in My Computers on another device, CLI logout).
+    // Drop the account credentials and speak for the machine itself again — the same switch a
+    // sign-out makes. The host app's own hook additionally turns sharing off, so it does not
+    // simply provision a new token and come straight back.
+    onDeviceRevoked: () => {
+      log9("this machine was removed from the account \u2014 dropping its credentials; it speaks for itself again");
+      try {
+        unlinkSync7(join78(daemonDir2(), "credentials.json"));
+      } catch {
+      }
+      void reloadIdentity();
+    },
     // Universal clipboard sync: a copy (or fetch/chunk control frame) from another of the account's
     // devices → hand it to the daemon's clipboard-sync (created in onOwned).
     onClipboard: (entry, fromClientId) => daemonClipboardSync?.onRemote(entry, fromClientId),
@@ -115023,7 +115383,7 @@ async function runDaemon(opts = {}) {
     if (appPid > 0 && appPid !== process.pid) {
       const quitMarker = () => {
         try {
-          return Number(readFileSync49(join77(daemonDir2(), "app-quit.marker"), "utf-8").trim()) || 0;
+          return Number(readFileSync50(join78(daemonDir2(), "app-quit.marker"), "utf-8").trim()) || 0;
         } catch {
           return 0;
         }
@@ -115048,7 +115408,7 @@ async function runDaemon(opts = {}) {
           log9(`desktop app (pid ${appPid}) is gone with NO clean-quit marker \u2014 reporting`);
           const tail3 = (name) => {
             try {
-              const buf = readFileSync49(join77(daemonDir2(), name), "utf-8");
+              const buf = readFileSync50(join78(daemonDir2(), name), "utf-8");
               return buf.length > 4096 ? buf.slice(-4096) : buf;
             } catch {
               return void 0;
@@ -115079,14 +115439,14 @@ async function runDaemon(opts = {}) {
   }
   try {
     const DAEMON_LOG_CAP = 2 * 1024 * 1024;
-    const daemonLogFile = join77(daemonDir2(), "daemon.log");
+    const daemonLogFile = join78(daemonDir2(), "daemon.log");
     const capTimer = setInterval(() => {
       try {
-        if (existsSync39(daemonLogFile) && statSync14(daemonLogFile).size > DAEMON_LOG_CAP) {
-          const buf = readFileSync49(daemonLogFile, "utf-8");
+        if (existsSync40(daemonLogFile) && statSync15(daemonLogFile).size > DAEMON_LOG_CAP) {
+          const buf = readFileSync50(daemonLogFile, "utf-8");
           const kept = `\u2026[daemon.log capped at ${(/* @__PURE__ */ new Date()).toISOString()}]\u2026
 ` + buf.slice(-DAEMON_LOG_CAP / 2);
-          writeFileSync40(daemonLogFile, kept);
+          writeFileSync41(daemonLogFile, kept);
         }
       } catch {
       }
@@ -115396,15 +115756,15 @@ init_credentials();
 
 // ../../packages/host-core/dist/net-service/ensure-installed.js
 import { execFile as execFile14 } from "node:child_process";
-import { existsSync as existsSync43 } from "node:fs";
-import { dirname as dirname36, join as join81 } from "node:path";
+import { existsSync as existsSync44 } from "node:fs";
+import { dirname as dirname37, join as join82 } from "node:path";
 import { promisify as promisify10 } from "node:util";
 
 // ../../packages/host-core/dist/net-service/launchd-system.js
 import { spawn as spawn9 } from "node:child_process";
-import { existsSync as existsSync40, mkdtempSync as mkdtempSync2, writeFileSync as writeFileSync41, rmSync as rmSync10, readFileSync as readFileSync50 } from "node:fs";
+import { existsSync as existsSync41, mkdtempSync as mkdtempSync2, writeFileSync as writeFileSync42, rmSync as rmSync10, readFileSync as readFileSync51 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
-import { join as join78 } from "node:path";
+import { join as join79 } from "node:path";
 
 // ../../packages/host-core/dist/net-service/owner-uid.js
 function installOwnerUid(env = process.env, self2 = typeof process.getuid === "function" ? process.getuid() : 0) {
@@ -115496,9 +115856,9 @@ ${args}
     <key>ProcessType</key>
     <string>Interactive</string>
     <key>StandardErrorPath</key>
-    <string>${xml(join78(spec.stateDir, "netd.log"))}</string>
+    <string>${xml(join79(spec.stateDir, "netd.log"))}</string>
     <key>StandardOutPath</key>
-    <string>${xml(join78(spec.stateDir, "netd.log"))}</string>
+    <string>${xml(join79(spec.stateDir, "netd.log"))}</string>
   </dict>
 </plist>
 `;
@@ -115511,10 +115871,10 @@ function runForCode(cmd, args) {
   });
 }
 async function elevate(script) {
-  const dir2 = mkdtempSync2(join78(tmpdir6(), "tesseract-netd-"));
-  const path6 = join78(dir2, "install.sh");
+  const dir2 = mkdtempSync2(join79(tmpdir6(), "tesseract-netd-"));
+  const path6 = join79(dir2, "install.sh");
   try {
-    writeFileSync41(path6, script, { mode: 384 });
+    writeFileSync42(path6, script, { mode: 384 });
     if (await alreadyElevated()) {
       return { code: await runForCode("/bin/sh", [path6]), declined: false };
     }
@@ -115573,9 +115933,9 @@ ${plist}TESSERACT_PLIST_EOF`,
       };
     },
     async state() {
-      if (!existsSync40(PLIST))
+      if (!existsSync41(PLIST))
         return { installed: false, running: false };
-      const owner = parseOwnerUid(readFileSync50(PLIST, "utf8"));
+      const owner = parseOwnerUid(readFileSync51(PLIST, "utf8"));
       const running2 = await netdAvailable();
       return {
         installed: true,
@@ -115593,7 +115953,7 @@ ${plist}TESSERACT_PLIST_EOF`,
 
 // ../../packages/host-core/dist/net-service/systemd-system.js
 import { spawn as spawn11 } from "node:child_process";
-import { existsSync as existsSync41, readFileSync as readFileSync51 } from "node:fs";
+import { existsSync as existsSync42, readFileSync as readFileSync52 } from "node:fs";
 
 // ../../packages/host-core/dist/service/exec.js
 import { execFile as execFile11, spawn as spawn10 } from "node:child_process";
@@ -115629,6 +115989,8 @@ async function elevated(script) {
 }
 var UNIT = "tesseract-netd.service";
 var UNIT_PATH = `/etc/systemd/system/${UNIT}`;
+var SYSTEM_EXEC_DIR = "/usr/local/libexec/tesseract-netd";
+var SYSTEM_EXEC = `${SYSTEM_EXEC_DIR}/tesseract-netd`;
 function unitVal(v) {
   return v.replace(/%/g, "%%");
 }
@@ -115700,8 +116062,12 @@ WantedBy=multi-user.target
 function buildInstallScript(spec) {
   return [
     `install -d -m 0700 ${sh2(spec.stateDir)}`,
+    // Copy the helper to the root-owned system path and run it from there — see SYSTEM_EXEC.
+    // BEFORE the unit is written and started, so the ExecStart it names already exists.
+    `install -d -m 0755 ${sh2(SYSTEM_EXEC_DIR)}`,
+    `install -m 0755 ${sh2(spec.exec)} ${sh2(SYSTEM_EXEC)}`,
     `cat > ${sh2(UNIT_PATH)} <<'TESSERACT_UNIT_EOF'
-${buildUnit(spec)}TESSERACT_UNIT_EOF`,
+${buildUnit({ ...spec, exec: SYSTEM_EXEC })}TESSERACT_UNIT_EOF`,
     "systemctl daemon-reload",
     `systemctl enable ${UNIT}`,
     // RESTART, not `enable --now`. `--now` only STARTS, so on a REINSTALL it leaves the
@@ -115730,15 +116096,19 @@ function makeSystemdSystem() {
       const script = [
         `systemctl disable --now ${UNIT} || true`,
         `rm -f ${sh2(UNIT_PATH)}`,
+        // The copied binary too — see SYSTEM_EXEC. Leaving a root-owned setuid-adjacent
+        // binary behind after an uninstall is exactly the kind of thing a security review
+        // flags, and it is ours to clean up.
+        `rm -rf ${sh2(SYSTEM_EXEC_DIR)}`,
         "systemctl daemon-reload"
       ].join("\n");
       const code = await elevated(script);
       return code === 0 ? { ok: true } : { ok: false, detail: `removing the helper failed (exit ${code})` };
     },
     async state() {
-      if (!existsSync41(UNIT_PATH))
+      if (!existsSync42(UNIT_PATH))
         return { installed: false, running: false };
-      const owner = parseOwnerUid(readFileSync51(UNIT_PATH, "utf8"));
+      const owner = parseOwnerUid(readFileSync52(UNIT_PATH, "utf8"));
       const active = await tryRun("systemctl", ["is-active", UNIT]);
       const running2 = active.stdout.trim() === "active";
       const own2 = owner === void 0 ? {} : { ownerUid: owner };
@@ -115763,9 +116133,9 @@ function sh2(s) {
 
 // ../../packages/host-core/dist/net-service/windows-service.js
 import { execFile as execFile12, spawn as spawn12 } from "node:child_process";
-import { mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync42, rmSync as rmSync11 } from "node:fs";
+import { mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync43, rmSync as rmSync11 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
-import { join as join79 } from "node:path";
+import { join as join80 } from "node:path";
 import { promisify as promisify8 } from "node:util";
 var run6 = promisify8(execFile12);
 var SERVICE = "TesseractNetd";
@@ -115793,9 +116163,9 @@ function buildBinaryPath(spec) {
   return parts.map((p) => `"${p}"`).join(" ");
 }
 async function elevatePowerShell(script) {
-  const dir2 = mkdtempSync3(join79(tmpdir7(), "tesseract-netd-"));
-  const inner = join79(dir2, "install.ps1");
-  writeFileSync42(inner, script, { encoding: "utf8" });
+  const dir2 = mkdtempSync3(join80(tmpdir7(), "tesseract-netd-"));
+  const inner = join80(dir2, "install.ps1");
+  writeFileSync43(inner, script, { encoding: "utf8" });
   if (await alreadyElevated()) {
     return new Promise((resolve16) => {
       const p = spawn12("powershell.exe", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", inner], { stdio: "inherit" });
@@ -115810,8 +116180,8 @@ async function elevatePowerShell(script) {
       p.on("close", (code) => finish(code ?? 1));
     });
   }
-  const outer = join79(dir2, "elevate.ps1");
-  writeFileSync42(outer, [
+  const outer = join80(dir2, "elevate.ps1");
+  writeFileSync43(outer, [
     '$ErrorActionPreference = "Stop"',
     "try {",
     `  $p = Start-Process -FilePath "powershell.exe" -ArgumentList @("-NoProfile","-ExecutionPolicy","Bypass","-File",${ps(inner)}) -Verb RunAs -Wait -PassThru`,
@@ -115999,15 +116369,15 @@ function makeNetService() {
 }
 
 // ../../packages/host-core/dist/net-service/netd-binary.js
-import { existsSync as existsSync42 } from "node:fs";
-import { dirname as dirname35, join as join80 } from "node:path";
+import { existsSync as existsSync43 } from "node:fs";
+import { dirname as dirname36, join as join81 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 function netdBinaryName() {
   return process.platform === "win32" ? "tesseract-netd.exe" : "tesseract-netd";
 }
 function override2() {
   const p = process.env.CCB_NETD_BIN;
-  return p && existsSync42(p) ? p : null;
+  return p && existsSync43(p) ? p : null;
 }
 function netdBinaryPath() {
   const fromEnv = override2();
@@ -116017,24 +116387,24 @@ function netdBinaryPath() {
   const candidates = [];
   const resources = process.resourcesPath;
   if (resources)
-    candidates.push(join80(resources, "netd", name));
+    candidates.push(join81(resources, "netd", name));
   try {
-    const here = dirname35(fileURLToPath7(import.meta.url));
-    candidates.push(join80(here, "..", "..", "netd", name));
-    candidates.push(join80(here, "..", "..", "..", "netd", name));
+    const here = dirname36(fileURLToPath7(import.meta.url));
+    candidates.push(join81(here, "..", "..", "netd", name));
+    candidates.push(join81(here, "..", "..", "..", "netd", name));
     const triple = `${process.platform}-${process.arch}`;
-    for (const root of [here, join80(here, ".."), join80(here, "..", "..")]) {
-      candidates.push(join80(root, "mesh-core", "prebuilds", triple, "netd", name));
+    for (const root of [here, join81(here, ".."), join81(here, "..", "..")]) {
+      candidates.push(join81(root, "mesh-core", "prebuilds", triple, "netd", name));
     }
   } catch {
   }
   if (process.env.CCB_REPO_ROOT) {
-    candidates.push(join80(process.env.CCB_REPO_ROOT, "crates", "target", "release", name));
+    candidates.push(join81(process.env.CCB_REPO_ROOT, "crates", "target", "release", name));
   }
-  candidates.push(join80(process.cwd(), "crates", "target", "release", name));
+  candidates.push(join81(process.cwd(), "crates", "target", "release", name));
   for (const c of candidates) {
     try {
-      if (existsSync42(c))
+      if (existsSync43(c))
         return c;
     } catch {
     }
@@ -116076,7 +116446,7 @@ async function ensureNetHelperInstalled() {
   if (st.installed && !mismatched)
     return { ok: true, already: true };
   const exec2 = netdBinaryPath();
-  if (exec2 && process.platform === "win32" && !existsSync43(join81(dirname36(exec2), "wintun.dll"))) {
+  if (exec2 && process.platform === "win32" && !existsSync44(join82(dirname37(exec2), "wintun.dll"))) {
     return {
       ok: false,
       reason: "no-binary",
@@ -116128,8 +116498,8 @@ import { platform as platform6 } from "node:os";
 
 // ../../packages/host-core/dist/service/launchd.js
 init_credentials();
-import { writeFileSync as writeFileSync43, existsSync as existsSync44, mkdirSync as mkdirSync42, unlinkSync as unlinkSync7 } from "node:fs";
-import { dirname as dirname37, join as join82 } from "node:path";
+import { writeFileSync as writeFileSync44, existsSync as existsSync45, mkdirSync as mkdirSync43, unlinkSync as unlinkSync8 } from "node:fs";
+import { dirname as dirname38, join as join83 } from "node:path";
 import { homedir as homedir13, userInfo as userInfo2 } from "node:os";
 function xml2(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
@@ -116137,10 +116507,10 @@ function xml2(s) {
 function makeLaunchd(instanceId) {
   const suffix = instanceSuffix(instanceId);
   const label = SERVICE_LABEL_BASE + (suffix ? `.${suffix}` : "");
-  const plistPath = () => join82(homedir13(), "Library", "LaunchAgents", `${label}.plist`);
+  const plistPath = () => join83(homedir13(), "Library", "LaunchAgents", `${label}.plist`);
   const domainTarget = () => `gui/${userInfo2().uid}`;
   const serviceTarget = () => `${domainTarget()}/${label}`;
-  const logFile = () => join82(daemonDir2(), "daemon.log");
+  const logFile = () => join83(daemonDir2(), "daemon.log");
   const workDirOf = (spec) => spec.workingDirectory ?? daemonDir2();
   function buildPlist2(spec) {
     const args = [spec.exec, ...spec.args].map((a) => `      <string>${xml2(a)}</string>`).join("\n");
@@ -116215,10 +116585,10 @@ ${env}
   };
   return {
     async install(spec) {
-      mkdirSync42(workDirOf(spec), { recursive: true });
-      mkdirSync42(dirname37(plistPath()), { recursive: true });
-      mkdirSync42(dirname37(spec.logPath), { recursive: true });
-      writeFileSync43(plistPath(), buildPlist2(spec));
+      mkdirSync43(workDirOf(spec), { recursive: true });
+      mkdirSync43(dirname38(plistPath()), { recursive: true });
+      mkdirSync43(dirname38(spec.logPath), { recursive: true });
+      writeFileSync44(plistPath(), buildPlist2(spec));
       await run5("launchctl", ["bootout", serviceTarget()]).catch(() => {
       });
       await untilGone();
@@ -116234,9 +116604,9 @@ ${env}
     async uninstall() {
       await run5("launchctl", ["bootout", serviceTarget()]).catch(() => {
       });
-      if (existsSync44(plistPath())) {
+      if (existsSync45(plistPath())) {
         try {
-          unlinkSync7(plistPath());
+          unlinkSync8(plistPath());
         } catch {
         }
       }
@@ -116245,7 +116615,7 @@ ${env}
       await this.install(spec);
     },
     async isInstalled() {
-      return existsSync44(plistPath());
+      return existsSync45(plistPath());
     },
     async start() {
       await run5("launchctl", ["bootstrap", domainTarget(), plistPath()]).catch(() => {
@@ -116262,7 +116632,7 @@ ${env}
     },
     async logs(follow) {
       const f = logFile();
-      if (!existsSync44(f)) {
+      if (!existsSync45(f)) {
         console.log(`No log yet at ${f} \u2014 has the service started?`);
         return;
       }
@@ -116273,8 +116643,8 @@ ${env}
 
 // ../../packages/host-core/dist/service/systemd.js
 init_credentials();
-import { writeFileSync as writeFileSync44, existsSync as existsSync45, mkdirSync as mkdirSync43, unlinkSync as unlinkSync8 } from "node:fs";
-import { dirname as dirname38, join as join83 } from "node:path";
+import { writeFileSync as writeFileSync45, existsSync as existsSync46, mkdirSync as mkdirSync44, unlinkSync as unlinkSync9 } from "node:fs";
+import { dirname as dirname39, join as join84 } from "node:path";
 import { homedir as homedir14, userInfo as userInfo3 } from "node:os";
 function unitVal2(v) {
   return v.replace(/%/g, "%%");
@@ -116286,8 +116656,8 @@ function makeSystemd(instanceId) {
   const suffix = instanceSuffix(instanceId);
   const unit = `tesseract-host${suffix ? `-${suffix}` : ""}.service`;
   const unitPath = () => {
-    const base = process.env.XDG_CONFIG_HOME || join83(homedir14(), ".config");
-    return join83(base, "systemd", "user", unit);
+    const base = process.env.XDG_CONFIG_HOME || join84(homedir14(), ".config");
+    return join84(base, "systemd", "user", unit);
   };
   const workDirOf = (spec) => spec.workingDirectory ?? daemonDir2();
   function buildUnit2(spec) {
@@ -116314,10 +116684,10 @@ WantedBy=default.target
   }
   return {
     async install(spec) {
-      mkdirSync43(workDirOf(spec), { recursive: true });
-      mkdirSync43(dirname38(unitPath()), { recursive: true });
-      mkdirSync43(dirname38(spec.logPath), { recursive: true });
-      writeFileSync44(unitPath(), buildUnit2(spec));
+      mkdirSync44(workDirOf(spec), { recursive: true });
+      mkdirSync44(dirname39(unitPath()), { recursive: true });
+      mkdirSync44(dirname39(spec.logPath), { recursive: true });
+      writeFileSync45(unitPath(), buildUnit2(spec));
       await run5("loginctl", ["enable-linger", userInfo3().username]).catch(() => {
       });
       await run5("systemctl", ["--user", "daemon-reload"]).catch(() => {
@@ -116329,9 +116699,9 @@ WantedBy=default.target
     async uninstall() {
       await run5("systemctl", ["--user", "disable", "--now", unit]).catch(() => {
       });
-      if (existsSync45(unitPath())) {
+      if (existsSync46(unitPath())) {
         try {
-          unlinkSync8(unitPath());
+          unlinkSync9(unitPath());
         } catch {
         }
       }
@@ -116342,7 +116712,7 @@ WantedBy=default.target
       await this.install(spec);
     },
     async isInstalled() {
-      return existsSync45(unitPath());
+      return existsSync46(unitPath());
     },
     async start() {
       await run5("systemctl", ["--user", "start", unit]);
@@ -116354,8 +116724,8 @@ WantedBy=default.target
       await runInherit("systemctl", ["--user", "status", unit, "--no-pager"]);
     },
     async logs(follow) {
-      const f = join83(daemonDir2(), "daemon.log");
-      if (existsSync45(f)) {
+      const f = join84(daemonDir2(), "daemon.log");
+      if (existsSync46(f)) {
         await runInherit("tail", follow ? ["-f", f] : ["-n", "200", f]);
         return;
       }
@@ -116367,12 +116737,12 @@ WantedBy=default.target
 
 // ../../packages/host-core/dist/service/windows.js
 init_credentials();
-import { writeFileSync as writeFileSync45, existsSync as existsSync46, mkdirSync as mkdirSync44, unlinkSync as unlinkSync9, readFileSync as readFileSync52 } from "node:fs";
-import { dirname as dirname39, join as join84 } from "node:path";
+import { writeFileSync as writeFileSync46, existsSync as existsSync47, mkdirSync as mkdirSync45, unlinkSync as unlinkSync10, readFileSync as readFileSync53 } from "node:fs";
+import { dirname as dirname40, join as join85 } from "node:path";
 function publishedDaemonPid(dir2) {
   for (const f of ["status.json", "daemon.lock"]) {
     try {
-      const raw = readFileSync52(join84(dir2, f), "utf-8");
+      const raw = readFileSync53(join85(dir2, f), "utf-8");
       const pid = f === "status.json" ? Number(JSON.parse(raw).pid) : Number(raw.trim());
       if (Number.isInteger(pid) && pid > 0)
         return pid;
@@ -116384,8 +116754,8 @@ function publishedDaemonPid(dir2) {
 function makeWindowsTask(instanceId) {
   const suffix = instanceSuffix(instanceId);
   const task = `Fineguide\\TesseractHost${suffix ? `-${suffix}` : ""}`;
-  const wrapperPath = () => join84(daemonDir2(), `run-host${suffix ? `-${suffix}` : ""}.cmd`);
-  const logFile = () => join84(daemonDir2(), "daemon.log");
+  const wrapperPath = () => join85(daemonDir2(), `run-host${suffix ? `-${suffix}` : ""}.cmd`);
+  const logFile = () => join85(daemonDir2(), "daemon.log");
   const oneLine2 = (s) => s.replace(/[\r\n]+/g, " ");
   const envVal = (v) => oneLine2(v).replace(/%/g, "%%").replace(/"/g, "");
   const cmdArg = (a) => `"${oneLine2(a).replace(/"/g, "")}"`;
@@ -116401,10 +116771,10 @@ start "" /b ${cmd} >> "${oneLine2(spec.logPath).replace(/"/g, "")}" 2>&1\r
   }
   return {
     async install(spec) {
-      mkdirSync44(spec.workingDirectory ?? daemonDir2(), { recursive: true });
-      mkdirSync44(dirname39(spec.logPath), { recursive: true });
-      mkdirSync44(dirname39(wrapperPath()), { recursive: true });
-      writeFileSync45(wrapperPath(), buildWrapper(spec));
+      mkdirSync45(spec.workingDirectory ?? daemonDir2(), { recursive: true });
+      mkdirSync45(dirname40(spec.logPath), { recursive: true });
+      mkdirSync45(dirname40(wrapperPath()), { recursive: true });
+      writeFileSync46(wrapperPath(), buildWrapper(spec));
       await run5("schtasks", ["/Create", "/TN", task, "/SC", "ONLOGON", "/RL", "LIMITED", "/F", "/TR", `"${wrapperPath()}"`]);
       await run5("schtasks", ["/Run", "/TN", task]).catch(() => {
       });
@@ -116412,9 +116782,9 @@ start "" /b ${cmd} >> "${oneLine2(spec.logPath).replace(/"/g, "")}" 2>&1\r
     async uninstall() {
       await run5("schtasks", ["/Delete", "/TN", task, "/F"]).catch(() => {
       });
-      if (existsSync46(wrapperPath())) {
+      if (existsSync47(wrapperPath())) {
         try {
-          unlinkSync9(wrapperPath());
+          unlinkSync10(wrapperPath());
         } catch {
         }
       }
@@ -116486,7 +116856,7 @@ start "" /b ${cmd} >> "${oneLine2(spec.logPath).replace(/"/g, "")}" 2>&1\r
     },
     async logs(follow) {
       const f = logFile();
-      if (!existsSync46(f)) {
+      if (!existsSync47(f)) {
         console.log(`No log yet at ${f} \u2014 has the task run?`);
         return;
       }
@@ -116517,9 +116887,8 @@ init_safe_kill();
 
 // src/auth.ts
 var import_qrcode_terminal = __toESM(require_main(), 1);
-import { randomUUID as randomUUID30 } from "node:crypto";
-import { existsSync as existsSync47, rmSync as rmSync12 } from "node:fs";
-import { join as join85 } from "node:path";
+import { existsSync as existsSync48, rmSync as rmSync12 } from "node:fs";
+import { join as join86 } from "node:path";
 
 // src/config.ts
 import { hostname as hostname6 } from "node:os";
@@ -116659,7 +117028,7 @@ async function login(opts) {
       process.exit(1);
     }
   }
-  const deviceId3 = readCredentials()?.deviceId ?? process.env.CCB_DEVICE_ID ?? randomUUID30().slice(0, 8);
+  const deviceId3 = readCredentials()?.deviceId ?? process.env.CCB_DEVICE_ID ?? persistentDeviceId();
   const label = opts.name ?? defaultLabel();
   if (opts.token) {
     const dt = await fetchJson(`${api}/auth/device-token`, {
@@ -116720,8 +117089,8 @@ async function logout() {
   }
   for (const f of ["credentials.json", "status.json", "daemon.lock"]) {
     try {
-      const p = join85(daemonDir2(), f);
-      if (existsSync47(p)) rmSync12(p);
+      const p = join86(daemonDir2(), f);
+      if (existsSync48(p)) rmSync12(p);
     } catch {
     }
   }
@@ -116879,9 +117248,9 @@ function startSelfUpdater(current) {
 }
 
 // src/service.ts
-import { join as join86 } from "node:path";
+import { join as join87 } from "node:path";
 import { platform as platform7 } from "node:os";
-import { existsSync as existsSync48, readFileSync as readFileSync53 } from "node:fs";
+import { existsSync as existsSync49, readFileSync as readFileSync54 } from "node:fs";
 function controller(instanceId) {
   const c = getServiceController(instanceId);
   if (!c) {
@@ -116894,7 +117263,7 @@ function buildSpec(cliEntry) {
     exec: process.execPath,
     args: [cliEntry, "run"],
     env: { CCB_DAEMON_DIR: daemonDir2() },
-    logPath: join86(daemonDir2(), "daemon.log")
+    logPath: join87(daemonDir2(), "daemon.log")
   };
 }
 var isAlive = (pid) => {
@@ -116906,10 +117275,10 @@ var isAlive = (pid) => {
   }
 };
 function runningDaemonInfo() {
-  const lock = join86(daemonDir2(), "daemon.lock");
+  const lock = join87(daemonDir2(), "daemon.lock");
   try {
-    if (!existsSync48(lock)) return null;
-    const pid = Number(readFileSync53(lock, "utf-8").trim());
+    if (!existsSync49(lock)) return null;
+    const pid = Number(readFileSync54(lock, "utf-8").trim());
     if (!pid || !isAlive(pid)) return null;
     return { pid, device: readCredentials()?.deviceId };
   } catch {
@@ -116943,7 +117312,7 @@ async function logs(instanceId, follow) {
 }
 
 // src/net.ts
-import { readFileSync as readFileSync55 } from "node:fs";
+import { readFileSync as readFileSync56 } from "node:fs";
 import { randomBytes as randomBytes11 } from "node:crypto";
 import { hostname as hostname7 } from "node:os";
 import { resolve as resolve14 } from "node:path";
@@ -117008,7 +117377,7 @@ function readOrDie(label, p) {
     process.exit(1);
   }
   try {
-    return new Uint8Array(readFileSync55(resolve14(p)));
+    return new Uint8Array(readFileSync56(resolve14(p)));
   } catch (e) {
     console.error(`net enroll: could not read --${label} ${p}: ${e instanceof Error ? e.message : e}`);
     process.exit(1);
@@ -117075,6 +117444,10 @@ async function netCommand(rest, flags) {
       return;
     }
     console.log("mesh engine:  ok");
+    if (s.running === false) {
+      console.log(`node:         NOT RUNNING \u2014 ${s.lastError ?? "no reason was recorded"}`);
+      return;
+    }
     console.log(`node:         running on UDP port ${s.port ?? "?"}`);
     console.log(`node:         LAN discovery ${s.lan ? "on" : "off (no multicast on this network)"}`);
     const established = s.established ?? [];
@@ -117561,8 +117934,8 @@ async function netCommand(rest, flags) {
 // src/cli.ts
 function pkgVersion() {
   try {
-    const p = join88(dirname40(fileURLToPath8(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync56(p, "utf8")).version ?? "0.0.0";
+    const p = join89(dirname41(fileURLToPath8(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync57(p, "utf8")).version ?? "0.0.0";
   } catch {
     return "0.0.0";
   }
@@ -117790,7 +118163,7 @@ async function linkCommand(rest, flags) {
   process.exit(1);
 }
 async function captureClaudeSubscription(flags) {
-  const home = mkdtempSync4(join88(tmpdir8(), "tesseract-claude-login-"));
+  const home = mkdtempSync4(join89(tmpdir8(), "tesseract-claude-login-"));
   const binary = typeof flags["claude-path"] === "string" ? flags["claude-path"] : process.env.CCB_ENGINE_PATH_CLAUDE_CODE || "claude";
   const args = ["auth", "login", "--claudeai"];
   if (typeof flags.email === "string") args.push("--email", flags.email);
@@ -117807,8 +118180,8 @@ async function captureClaudeSubscription(flags) {
       child.once("close", (exitCode, signal) => resolveCode(signal ? 1 : exitCode ?? 1));
     });
     if (code !== 0) throw new Error(`Claude sign-in did not complete (exit ${code}).`);
-    const file2 = join88(home, ".credentials.json");
-    if (existsSync50(file2)) return readFileSync56(file2, "utf8");
+    const file2 = join89(home, ".credentials.json");
+    if (existsSync51(file2)) return readFileSync57(file2, "utf8");
     if (process.platform === "darwin") {
       const value = execFileSync6("security", [
         "find-generic-password",
@@ -117890,7 +118263,7 @@ async function runnerCommand(rest, flags) {
       process.exit(1);
     }
     const oauthFilePath = typeof flags["oauth-file"] === "string" ? resolve15(flags["oauth-file"]) : void 0;
-    const oauthAuthFile = oauthFilePath ? readFileSync56(oauthFilePath, "utf8") : void 0;
+    const oauthAuthFile = oauthFilePath ? readFileSync57(oauthFilePath, "utf8") : void 0;
     if (oauthAuthFile) {
       try {
         JSON.parse(oauthAuthFile);