tesseract-agent 0.11.5 → 0.11.7

package/dist-bundle/cli.js

@@ -4269,7 +4269,7 @@ function isPidAlive(pid) {
 function createSchedulerLock(lockDir, ownerId, now2 = () => Date.now()) {
   const lockFile = join5(lockDir, "scheduled_tasks.lock");
   let held = false;
-  const read2 = () => {
+  const read = () => {
     try {
       const rec = JSON.parse(readFileSync4(lockFile, "utf-8"));
       if (rec && typeof rec.ownerId === "string" && typeof rec.pid === "number" && typeof rec.refreshedAt === "number")
@@ -4294,13 +4294,13 @@ function createSchedulerLock(lockDir, ownerId, now2 = () => Date.now()) {
       held = false;
       return false;
     }
-    const after = read2();
+    const after = read();
     held = !!after && after.nonce === nonce2;
     return held;
   };
   return {
     isOwner() {
-      const existing = read2();
+      const existing = read();
       if (!existing) {
         try {
           const fd = openSync(lockFile, "wx");
@@ -4312,7 +4312,7 @@ function createSchedulerLock(lockDir, ownerId, now2 = () => Date.now()) {
           held = true;
           return true;
         } catch {
-          const r = read2();
+          const r = read();
           if (r && r.ownerId === ownerId)
             return writeLease();
           return false;
@@ -4329,7 +4329,7 @@ function createSchedulerLock(lockDir, ownerId, now2 = () => Date.now()) {
     release() {
       if (!held)
         return;
-      const r = read2();
+      const r = read();
       if (r && r.ownerId === ownerId) {
         try {
           unlinkSync(lockFile);
@@ -27550,6 +27550,32 @@ var init_mesh_node_name = __esm({
   }
 });
 
+// ../../packages/shared/dist/host-id.js
+function parseHostId(hostId) {
+  if (!hostId)
+    return null;
+  const i = hostId.indexOf(":");
+  if (i < 0 || hostId.slice(0, i) !== "electron")
+    return null;
+  const rest = hostId.slice(i + 1);
+  const j = rest.indexOf(":");
+  if (j < 0)
+    return null;
+  const owner = rest.slice(0, j);
+  const deviceId3 = rest.slice(j + 1);
+  if (!owner || !deviceId3)
+    return null;
+  return { kind: "electron", owner, deviceId: deviceId3 };
+}
+function hostDeviceId(hostId) {
+  return parseHostId(hostId)?.deviceId ?? null;
+}
+var init_host_id = __esm({
+  "../../packages/shared/dist/host-id.js"() {
+    "use strict";
+  }
+});
+
 // ../../packages/shared/dist/index.js
 var init_dist2 = __esm({
   "../../packages/shared/dist/index.js"() {
@@ -27610,6 +27636,7 @@ var init_dist2 = __esm({
     init_user_dialog();
     init_session_ops();
     init_mesh_node_name();
+    init_host_id();
   }
 });
 
@@ -30878,8 +30905,8 @@ ${err2 instanceof Error ? err2.message : String(err2)}
           const fd = openSync2(job.logPath, "r");
           try {
             const buf = Buffer.allocUnsafe(want);
-            const read2 = readSync(fd, buf, 0, want, size - want);
-            return buf.subarray(0, read2).toString("utf8");
+            const read = readSync(fd, buf, 0, want, size - want);
+            return buf.subarray(0, read).toString("utf8");
           } finally {
             closeSync2(fd);
           }
@@ -31271,10 +31298,10 @@ function wrapAsyncTool(def, opts) {
         return text9(raced.err instanceof Error ? raced.err.message : String(raced.err), true);
       }
       opts.learnedSlow?.add(t.name);
-      const job = opts.registry.start(t.name, describeArgs(t.name, args), async (write3) => {
+      const job = opts.registry.start(t.name, describeArgs(t.name, args), async (write2) => {
         try {
           const out = await work;
-          write3(out);
+          write2(out);
         } catch (err2) {
           throw err2 instanceof Error ? err2 : new Error(String(err2));
         }
@@ -43883,8 +43910,8 @@ ${lines.join("\n")}
           const fd = openSync5(path6, "r");
           try {
             const buf = Buffer.allocUnsafe(want);
-            const read2 = readSync4(fd, buf, 0, want, Math.max(0, size - want));
-            return buf.subarray(0, read2).toString("utf8").slice(-maxChars);
+            const read = readSync4(fd, buf, 0, want, Math.max(0, size - want));
+            return buf.subarray(0, read).toString("utf8").slice(-maxChars);
           } finally {
             closeSync5(fd);
           }
@@ -46357,9 +46384,9 @@ function wrapHostedAsyncTool(t, opts) {
         return text11(raced.err instanceof Error ? raced.err.message : String(raced.err), true);
       opts.learnedSlow?.add(t.name);
       const sessionId = ctx2?.sessionId;
-      const job = opts.registry.start(t.name, describeArgs2(t.name, args), async (write3) => {
+      const job = opts.registry.start(t.name, describeArgs2(t.name, args), async (write2) => {
         try {
-          write3(await work);
+          write2(await work);
         } catch (err2) {
           throw err2 instanceof Error ? err2 : new Error(String(err2));
         }
@@ -79687,7 +79714,7 @@ function alphabet(letters) {
   };
 }
 // @__NO_SIDE_EFFECTS__
-function join68(separator = "") {
+function join67(separator = "") {
   astr("join", separator);
   return {
     encode: (from) => {
@@ -79892,7 +79919,7 @@ var init_esm = __esm({
       convertRadix2,
       radix,
       radix2,
-      join: join68,
+      join: join67,
       padding
     };
   }
@@ -81454,9 +81481,9 @@ async function readPassphrase(prompt2) {
   }
   const rl = createInterface2({ input: process.stdin, output: process.stdout, terminal: true });
   const out = process.stdout;
-  const write3 = out.write.bind(out);
+  const write2 = out.write.bind(out);
   let muted = false;
-  out.write = (chunk) => muted ? true : write3(chunk);
+  out.write = (chunk) => muted ? true : write2(chunk);
   process.stdout.write(prompt2);
   muted = true;
   try {
@@ -81466,7 +81493,7 @@ async function readPassphrase(prompt2) {
     }));
   } finally {
     muted = false;
-    out.write = write3;
+    out.write = write2;
     process.stdout.write("\n");
   }
 }
@@ -81725,9 +81752,9 @@ function toRewindOutcome(res, noHistory) {
 }
 
 // ../../packages/host-core/dist/control-link.js
-import { join as join61, basename as basename11 } from "node:path";
-import { randomUUID as randomUUID25 } from "node:crypto";
-import { mkdirSync as mkdirSync30 } from "node:fs";
+import { join as join60, basename as basename11 } from "node:path";
+import { randomUUID as randomUUID24 } from "node:crypto";
+import { mkdirSync as mkdirSync29 } from "node:fs";
 
 // ../../node_modules/ws/wrapper.mjs
 var import_stream = __toESM(require_stream(), 1);
@@ -89219,8 +89246,8 @@ ${text12}`;
       const t = await conn(threadCwd.get(sessionId) ?? spawnedCwd ?? projectDir ?? void 0);
       if (!t)
         return { ok: false, reason: `${label} is not reachable for this.` };
-      const read2 = await t.request("thread/read", { threadId: sessionId, includeTurns: true }).catch(() => null);
-      const turns2 = (read2?.thread ?? {}).turns ?? [];
+      const read = await t.request("thread/read", { threadId: sessionId, includeTurns: true }).catch(() => null);
+      const turns2 = (read?.thread ?? {}).turns ?? [];
       const at = turns2.findIndex((tn) => (tn.items ?? []).some((it) => it.id === uuid3));
       if (at < 0)
         return { ok: false, reason: `${label} no longer has that message.` };
@@ -99315,9 +99342,9 @@ async function startOutboundTransfer(msg, controllerClientId, ownHostId2, hostRo
             break;
           const len = Math.min(CHUNK2, f.size - offset);
           const buf = Buffer.alloc(len);
-          const read2 = readSync7(fd, buf, 0, len, offset);
-          send4({ type: "fs:transferChunk", transferId, toHost, fileIx, rel: f.rel, mode: f.mode, kind: "file", offset, base64: buf.subarray(0, read2).toString("base64"), eof: offset + len >= f.size }, { hostId: toHost });
-          state3.sentBytes += read2;
+          const read = readSync7(fd, buf, 0, len, offset);
+          send4({ type: "fs:transferChunk", transferId, toHost, fileIx, rel: f.rel, mode: f.mode, kind: "file", offset, base64: buf.subarray(0, read).toString("base64"), eof: offset + len >= f.size }, { hostId: toHost });
+          state3.sentBytes += read;
         }
       }
     } catch (e) {
@@ -100126,70 +100153,22 @@ init_credentials();
 // ../../packages/host-core/dist/rdesk/machine-identity.js
 init_credentials();
 import { hostname as hostname3, platform } from "node:os";
-import { randomUUID as randomUUID24 } from "node:crypto";
-import { chmodSync as chmodSync3, existsSync as existsSync24, mkdirSync as mkdirSync27, readFileSync as readFileSync37, statSync as statSync14, unlinkSync as unlinkSync3, writeFileSync as writeFileSync25 } from "node:fs";
-import { join as join54 } from "node:path";
-
-// ../../packages/host-core/dist/device-id.js
-init_base_paths();
-import { existsSync as existsSync23, mkdirSync as mkdirSync26, readFileSync as readFileSync36, writeFileSync as writeFileSync24 } from "node:fs";
-import { dirname as dirname24, join as join53 } from "node:path";
 import { randomUUID as randomUUID23 } from "node:crypto";
-function deviceIdFile() {
-  return join53(tesseractHome(), "device-id.json");
-}
-function read() {
-  try {
-    const raw = JSON.parse(readFileSync36(deviceIdFile(), "utf-8"));
-    const deviceId3 = typeof raw.deviceId === "string" && raw.deviceId ? raw.deviceId : null;
-    const aliases = Array.isArray(raw.aliases) ? raw.aliases.filter((a) => typeof a === "string" && !!a) : [];
-    return { deviceId: deviceId3, aliases };
-  } catch {
-    return { deviceId: null, aliases: [] };
-  }
-}
-function write(deviceId3, aliases) {
-  try {
-    const f = deviceIdFile();
-    const dir2 = dirname24(f);
-    if (!existsSync23(dir2))
-      mkdirSync26(dir2, { recursive: true });
-    writeFileSync24(f, JSON.stringify(aliases.length ? { deviceId: deviceId3, aliases } : { deviceId: deviceId3 }));
-  } catch {
-  }
-}
-function persistentDeviceId() {
-  const cur = read();
-  if (cur.deviceId)
-    return cur.deviceId;
-  const id = randomUUID23().slice(0, 8);
-  write(id, cur.aliases);
-  return id;
-}
-function addDeviceIdAlias(old) {
-  if (!old)
-    return;
-  const cur = read();
-  const deviceId3 = cur.deviceId ?? persistentDeviceId();
-  if (old === deviceId3 || cur.aliases.includes(old))
-    return;
-  write(deviceId3, [...cur.aliases, old]);
-}
-
-// ../../packages/host-core/dist/rdesk/machine-identity.js
-var FILE = () => join54(daemonDir2(), "machine-identity.json");
+import { chmodSync as chmodSync3, existsSync as existsSync23, mkdirSync as mkdirSync26, readFileSync as readFileSync36, statSync as statSync14, unlinkSync as unlinkSync3, writeFileSync as writeFileSync24 } from "node:fs";
+import { join as join53 } from "node:path";
+var FILE = () => join53(daemonDir2(), "machine-identity.json");
 function readMachineIdentity() {
   try {
-    const m = JSON.parse(readFileSync37(FILE(), "utf-8"));
+    const m = JSON.parse(readFileSync36(FILE(), "utf-8"));
     return m?.deviceToken && m?.publicId ? m : null;
   } catch {
     return null;
   }
 }
-function write2(m) {
+function write(m) {
   try {
-    mkdirSync27(daemonDir2(), { recursive: true, mode: 448 });
-    writeFileSync25(FILE(), JSON.stringify(m, null, 2), { mode: 384 });
+    mkdirSync26(daemonDir2(), { recursive: true, mode: 448 });
+    writeFileSync24(FILE(), JSON.stringify(m, null, 2), { mode: 384 });
     chmodSync3(FILE(), 384);
   } catch {
   }
@@ -100224,14 +100203,14 @@ async function ensureMachineIdentity(opts) {
   });
   return inflight;
 }
-var LOCK = () => join54(daemonDir2(), "machine-identity.lock");
+var LOCK = () => join53(daemonDir2(), "machine-identity.lock");
 var LOCK_STALE_MS = 3e4;
 function tryRegistrationLock() {
   const f = LOCK();
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
-      mkdirSync27(daemonDir2(), { recursive: true, mode: 448 });
-      writeFileSync25(f, String(process.pid), { flag: "wx" });
+      mkdirSync26(daemonDir2(), { recursive: true, mode: 448 });
+      writeFileSync24(f, String(process.pid), { flag: "wx" });
       return true;
     } catch {
       try {
@@ -100268,15 +100247,8 @@ async function ensureMachineIdentityOnce(opts) {
     return null;
   }
   let m = readMachineIdentity();
-  if (m && opts.deviceId && m.deviceId !== opts.deviceId) {
-    const old = m.deviceId;
-    m = { ...m, deviceId: opts.deviceId };
-    delete m.accessToken;
-    delete m.expiresAt;
-    write2(m);
-    addDeviceIdAlias(old);
-    log9?.(`machine identity: device id ${old} \u2192 ${opts.deviceId} (the id this computer uses whether signed in or not; ${old} kept as an alias)`);
-  }
+  if (m && opts.deviceId)
+    m = adoptPersistentDeviceId(opts.deviceId, log9).identity ?? m;
   try {
     if (!m) {
       if (!tryRegistrationLock()) {
@@ -100293,11 +100265,11 @@ async function ensureMachineIdentityOnce(opts) {
             m = {
               deviceToken: reg.token,
               publicId: reg.publicId,
-              deviceId: opts.deviceId ?? randomUUID24().slice(0, 8),
+              deviceId: opts.deviceId ?? randomUUID23().slice(0, 8),
               apiOrigin: apiOrigin2,
               backendOrigin: backendOrigin2
             };
-            write2(m);
+            write(m);
             log9?.(`machine identity: registered \u2014 this machine can be reached as ${reg.publicId}`);
           }
         } finally {
@@ -100308,7 +100280,7 @@ async function ensureMachineIdentityOnce(opts) {
     if (!tokenUsable(m)) {
       const t = await postJson(`${apiOrigin2}/auth/device/relay-token`, { deviceToken: m.deviceToken, deviceId: m.deviceId });
       m = { ...m, accessToken: t.accessToken, expiresAt: t.expiresAt, publicId: t.publicId, apiOrigin: apiOrigin2, backendOrigin: backendOrigin2 };
-      write2(m);
+      write(m);
       log9?.("machine identity: relay token minted");
     }
     return m;
@@ -100317,6 +100289,18 @@ async function ensureMachineIdentityOnce(opts) {
     return m && tokenUsable(m) ? m : null;
   }
 }
+function adoptPersistentDeviceId(deviceId3, log9) {
+  const m = readMachineIdentity();
+  if (!m || !deviceId3 || m.deviceId === deviceId3)
+    return { identity: m, migratedFrom: null };
+  const old = m.deviceId;
+  const next = { ...m, deviceId: deviceId3 };
+  delete next.accessToken;
+  delete next.expiresAt;
+  write(next);
+  log9?.(`machine identity: device id ${old} \u2192 ${deviceId3} (the id this computer has whether signed in or not)`);
+  return { identity: next, migratedFrom: old };
+}
 
 // ../../packages/host-core/dist/rdesk/server-auth.js
 var DEFAULT_API = (process.env.CCB_TESSERACT_API ?? "https://app.tesseract.dev").replace(/\/$/, "");
@@ -100354,14 +100338,14 @@ function getMachinePublicId() {
 
 // ../../packages/host-core/dist/active-link/engine.js
 import { lstat as lstat7, readlink as readlink4, rm as rm4, mkdir as mkdir13, symlink as symlink2, rename as rename3, utimes as utimes2, writeFile as writeFile12 } from "node:fs/promises";
-import { existsSync as existsSync26 } from "node:fs";
-import { dirname as dirname28, join as join59, resolve as resolve11 } from "node:path";
+import { existsSync as existsSync25 } from "node:fs";
+import { dirname as dirname27, join as join58, resolve as resolve11 } from "node:path";
 
 // ../../packages/host-core/dist/active-link/blocks.js
 import { createHash as createHash5 } from "node:crypto";
 import { createReadStream as createReadStream2 } from "node:fs";
 import { open as open4, mkdir as mkdir12, rename as rename2, chmod as chmod2, utimes, unlink } from "node:fs/promises";
-import { dirname as dirname25 } from "node:path";
+import { dirname as dirname24 } from "node:path";
 var CHUNK3 = 1024 * 1024;
 var MAX_INFLIGHT2 = 8 * CHUNK3;
 var IDLE_MS2 = 6e4;
@@ -100489,7 +100473,7 @@ var StagingWriter = class {
   }
   async ensureOpen() {
     if (!this.fh) {
-      await mkdir12(dirname25(this.stagingPath), { recursive: true });
+      await mkdir12(dirname24(this.stagingPath), { recursive: true });
       this.fh = await open4(this.stagingPath, "w");
     }
     return this.fh;
@@ -100519,7 +100503,7 @@ var StagingWriter = class {
     });
     await fh.close();
     this.fh = null;
-    await mkdir12(dirname25(dest), { recursive: true });
+    await mkdir12(dirname24(dest), { recursive: true });
     await chmod2(this.stagingPath, mode & 511).catch(() => {
     });
     const secs = mtimeMs / 1e3;
@@ -100552,7 +100536,7 @@ var BlockAssembler = class {
     this.stagingPath = stagingPath;
   }
   async open() {
-    await mkdir12(dirname25(this.stagingPath), { recursive: true });
+    await mkdir12(dirname24(this.stagingPath), { recursive: true });
     this.fh = await open4(this.stagingPath, "w");
   }
   /** Write a received block at its byte offset (index * CHUNK). */
@@ -100596,7 +100580,7 @@ var BlockAssembler = class {
       });
       return false;
     }
-    await mkdir12(dirname25(dest), { recursive: true });
+    await mkdir12(dirname24(dest), { recursive: true });
     await chmod2(this.stagingPath, mode & 511).catch(() => {
     });
     const secs = mtimeMs / 1e3;
@@ -100619,8 +100603,8 @@ var BlockAssembler = class {
 };
 
 // ../../packages/host-core/dist/active-link/manifest.js
-import { readFileSync as readFileSync38, writeFileSync as writeFileSync26, mkdirSync as mkdirSync28, existsSync as existsSync25, renameSync as renameSync8 } from "node:fs";
-import { join as join55 } from "node:path";
+import { readFileSync as readFileSync37, writeFileSync as writeFileSync25, mkdirSync as mkdirSync27, existsSync as existsSync24, renameSync as renameSync8 } from "node:fs";
+import { join as join54 } from "node:path";
 
 // ../../packages/host-core/dist/active-link/reconcile.js
 var ABSENT = { kind: "absent", t: -Infinity, hash: "" };
@@ -100656,11 +100640,11 @@ var LinkManifest = class {
     this.dir = dir2;
   }
   file() {
-    return join55(this.dir, "manifest.json");
+    return join54(this.dir, "manifest.json");
   }
   load() {
     try {
-      const raw = JSON.parse(readFileSync38(this.file(), "utf-8"));
+      const raw = JSON.parse(readFileSync37(this.file(), "utf-8"));
       this.records = new Map(Object.entries(raw.records ?? {}));
       this.tombstones = new Map(Object.entries(raw.tombstones ?? {}));
     } catch {
@@ -100741,14 +100725,14 @@ var LinkManifest = class {
     if (!this.dirty)
       return;
     try {
-      if (!existsSync25(this.dir))
-        mkdirSync28(this.dir, { recursive: true });
+      if (!existsSync24(this.dir))
+        mkdirSync27(this.dir, { recursive: true });
       const json3 = {
         records: Object.fromEntries(this.records),
         tombstones: Object.fromEntries(this.tombstones)
       };
       const tmp = `${this.file()}.tmp`;
-      writeFileSync26(tmp, JSON.stringify(json3));
+      writeFileSync25(tmp, JSON.stringify(json3));
       renameSync8(tmp, this.file());
       this.dirty = false;
     } catch {
@@ -100758,7 +100742,7 @@ var LinkManifest = class {
 
 // ../../packages/host-core/dist/active-link/scanner.js
 import { readdir as readdir7, lstat as lstat3, readlink as readlink2 } from "node:fs/promises";
-import { join as join56, sep as sep10 } from "node:path";
+import { join as join55, sep as sep10 } from "node:path";
 async function walkRels(root, extraIgnore) {
   const out = [];
   async function rec(dir2) {
@@ -100773,7 +100757,7 @@ async function walkRels(root, extraIgnore) {
         continue;
       if (e.isDirectory() && HEAVY_DIRS.has(e.name))
         continue;
-      const abs = join56(dir2, e.name);
+      const abs = join55(dir2, e.name);
       if (extraIgnore?.(abs))
         continue;
       if (e.isDirectory())
@@ -100812,7 +100796,7 @@ async function scanTree(root, prior, allow, extraIgnore) {
   return { records };
 }
 function absOf(root, rel) {
-  return join56(root, rel.split("/").join(sep10));
+  return join55(root, rel.split("/").join(sep10));
 }
 
 // ../../packages/host-core/dist/active-link/gitignore.js
@@ -102837,7 +102821,7 @@ var ActiveLinkEngine = class {
   }
   async start() {
     this.emit({ type: "status", linkId: this.opts.linkId, state: "scanning" });
-    await rm4(join59(this.stateDir, ".staging"), { recursive: true, force: true }).catch(() => {
+    await rm4(join58(this.stateDir, ".staging"), { recursive: true, force: true }).catch(() => {
     });
     this.manifest.load();
     await this.reconcileScan();
@@ -103232,13 +103216,13 @@ var ActiveLinkEngine = class {
    *  file so the path still exists — recorded as a FILE matching disk so the local
    *  watcher doesn't churn. The target is containment-checked, never dereferenced. */
   async applySymlink(rel, dest, target, mtimeMs, mode) {
-    const resolved = resolve11(dirname28(dest), target);
+    const resolved = resolve11(dirname27(dest), target);
     if (!isInsideRoot(resolved, this.opts.localRoot))
       return;
     const hash2 = hashString(target);
     const secs = mtimeMs / 1e3;
     try {
-      await mkdir13(dirname28(dest), { recursive: true });
+      await mkdir13(dirname27(dest), { recursive: true });
       await rm4(dest, { force: true, recursive: true });
       try {
         await symlink2(target, dest);
@@ -103290,7 +103274,7 @@ var ActiveLinkEngine = class {
       return;
     if (fromRec && fromRec.kind === "file") {
       try {
-        await mkdir13(dirname28(toAbs2), { recursive: true });
+        await mkdir13(dirname27(toAbs2), { recursive: true });
         await rename3(fromAbs, toAbs2);
         const secs = mtimeMs / 1e3;
         await utimes2(toAbs2, secs, secs).catch(() => {
@@ -103315,7 +103299,7 @@ var ActiveLinkEngine = class {
     await this.maybeRefreshAllow(rels);
     const state3 = /* @__PURE__ */ new Map();
     for (const rel of rels) {
-      if (existsSync26(absOf(this.opts.localRoot, rel)) && !this.isSynced(rel)) {
+      if (existsSync25(absOf(this.opts.localRoot, rel)) && !this.isSynced(rel)) {
         this.manifest.dropRecord(rel);
         continue;
       }
@@ -103419,7 +103403,7 @@ var ActiveLinkEngine = class {
     for (const rel of this.manifest.recordRels()) {
       if (records.has(rel))
         continue;
-      if (existsSync26(absOf(this.opts.localRoot, rel)))
+      if (existsSync25(absOf(this.opts.localRoot, rel)))
         this.manifest.dropRecord(rel);
       else
         this.manifest.setTombstone(rel, now2);
@@ -103465,7 +103449,7 @@ var ActiveLinkEngine = class {
     this.inboundWatchdog.clear();
   }
   stagingPath(rel, tag) {
-    return join59(this.stateDir, ".staging", `${hashString(rel)}.${tag}`);
+    return join58(this.stateDir, ".staging", `${hashString(rel)}.${tag}`);
   }
   pruneSuppress() {
     const now2 = this.now();
@@ -103490,14 +103474,14 @@ var ActiveLinkEngine = class {
 };
 
 // ../../packages/host-core/dist/active-link/config.js
-import { readFileSync as readFileSync39, writeFileSync as writeFileSync27, mkdirSync as mkdirSync29, existsSync as existsSync27, renameSync as renameSync9, watch as watch3 } from "node:fs";
-import { join as join60 } from "node:path";
+import { readFileSync as readFileSync38, writeFileSync as writeFileSync26, mkdirSync as mkdirSync28, existsSync as existsSync26, renameSync as renameSync9, watch as watch3 } from "node:fs";
+import { join as join59 } from "node:path";
 function configPath2() {
-  return join60(activeLinkRoot(), "links.json");
+  return join59(activeLinkRoot(), "links.json");
 }
 function loadLinkConfigs() {
   try {
-    const raw = JSON.parse(readFileSync39(configPath2(), "utf-8"));
+    const raw = JSON.parse(readFileSync38(configPath2(), "utf-8"));
     if (!Array.isArray(raw.links))
       return [];
     return raw.links.filter((c) => c && c.linkId && c.localRoot && c.peerHostId);
@@ -103508,10 +103492,10 @@ function loadLinkConfigs() {
 function writeAll(links) {
   try {
     const dir2 = activeLinkRoot();
-    if (!existsSync27(dir2))
-      mkdirSync29(dir2, { recursive: true });
+    if (!existsSync26(dir2))
+      mkdirSync28(dir2, { recursive: true });
     const tmp = `${configPath2()}.tmp`;
-    writeFileSync27(tmp, JSON.stringify({ links }, null, 2));
+    writeFileSync26(tmp, JSON.stringify({ links }, null, 2));
     renameSync9(tmp, configPath2());
   } catch {
   }
@@ -103530,11 +103514,11 @@ function saveLinkConfig(cfg2) {
   writeAll(links);
 }
 function pendingPath() {
-  return join60(activeLinkRoot(), "pending-deprovisions.json");
+  return join59(activeLinkRoot(), "pending-deprovisions.json");
 }
 function loadPendingDeprovisions() {
   try {
-    const raw = JSON.parse(readFileSync39(pendingPath(), "utf-8"));
+    const raw = JSON.parse(readFileSync38(pendingPath(), "utf-8"));
     return Array.isArray(raw.pending) ? raw.pending.filter((p) => p && p.linkId && p.peerHostId) : [];
   } catch {
     return [];
@@ -103543,10 +103527,10 @@ function loadPendingDeprovisions() {
 function writePending(pending2) {
   try {
     const dir2 = activeLinkRoot();
-    if (!existsSync27(dir2))
-      mkdirSync29(dir2, { recursive: true });
+    if (!existsSync26(dir2))
+      mkdirSync28(dir2, { recursive: true });
     const tmp = `${pendingPath()}.tmp`;
-    writeFileSync27(tmp, JSON.stringify({ pending: pending2 }, null, 2));
+    writeFileSync26(tmp, JSON.stringify({ pending: pending2 }, null, 2));
     renameSync9(tmp, pendingPath());
   } catch {
   }
@@ -103559,8 +103543,8 @@ function removeLinkConfig(linkId) {
 }
 function watchLinkConfigs(onChange) {
   const dir2 = activeLinkRoot();
-  if (!existsSync27(dir2))
-    mkdirSync29(dir2, { recursive: true });
+  if (!existsSync26(dir2))
+    mkdirSync28(dir2, { recursive: true });
   let timer2 = null;
   let watcher = null;
   try {
@@ -103705,7 +103689,7 @@ function routeInboundLinkFrame(frame) {
 init_dist5();
 
 // ../../packages/host-core/dist/pty-manager.js
-import { existsSync as existsSync28 } from "node:fs";
+import { existsSync as existsSync27 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
 init_safe_kill();
 var ptyPromise = null;
@@ -103860,7 +103844,7 @@ function listUnix() {
   const seen = /* @__PURE__ */ new Set();
   const loginShell = process.env.SHELL || "";
   const add2 = (id, path6) => {
-    if (!path6 || seen.has(path6) || !existsSync28(path6))
+    if (!path6 || seen.has(path6) || !existsSync27(path6))
       return;
     seen.add(path6);
     out.push(mk(id, path6, path6 === loginShell));
@@ -103892,7 +103876,7 @@ function listWindows() {
   const gitBash = `${pf}\\Git\\bin\\bash.exe`;
   const pwsh7 = `${pf}\\PowerShell\\7\\pwsh.exe`;
   const add2 = (id, path6, label, isDefault = false) => {
-    if (path6 && existsSync28(path6))
+    if (path6 && existsSync27(path6))
       out.push(mk(id, path6, isDefault, label));
   };
   add2("powershell", winPwsh, "Windows PowerShell", true);
@@ -103951,7 +103935,7 @@ function resolveCwd(cwd, hostRoot) {
   const fallback = hostRoot || homedir9();
   if (!cwd)
     return fallback;
-  if (!existsSync28(cwd))
+  if (!existsSync27(cwd))
     return fallback;
   if (hostRoot && !isInsideRoot(cwd, hostRoot))
     return hostRoot;
@@ -104145,7 +104129,7 @@ async function ensureP2pReady() {
   }
 }
 function ownHostId() {
-  const mine = serverHosts.find((h) => h.hostId.endsWith(`:${deviceId}`));
+  const mine = serverHosts.find((h) => h.deviceId === deviceId);
   return mine?.hostId ?? "local";
 }
 var lastOwnHostLog = null;
@@ -104159,9 +104143,10 @@ function logOwnHostVerdict() {
 }
 function presentedHosts() {
   const out = serverHosts.slice();
-  if (!out.some((h) => h.hostId.endsWith(`:${deviceId}`))) {
+  if (!out.some((h) => h.deviceId === deviceId)) {
     out.unshift({
       hostId: "local",
+      deviceId,
       name: hostname4(),
       kind: "electron",
       platform: process.platform,
@@ -104176,7 +104161,7 @@ function presentedHosts() {
 }
 function connectedFsHosts() {
   const mine = ownHostId();
-  return serverHosts.filter((h) => h.online && h.hostId !== mine && !h.hostId.endsWith(`:${deviceId}`)).filter((h) => h.kind === "electron" || h.kind === "cloud").filter((h) => !h.caps || h.caps.includes("fs")).map((h) => ({ hostId: h.hostId, label: h.name || (h.kind === "cloud" ? "Cloud agent" : "Remote machine") }));
+  return serverHosts.filter((h) => h.online && h.hostId !== mine && h.deviceId !== deviceId).filter((h) => h.kind === "electron" || h.kind === "cloud").filter((h) => !h.caps || h.caps.includes("fs")).map((h) => ({ hostId: h.hostId, label: h.name || (h.kind === "cloud" ? "Cloud agent" : "Remote machine") }));
 }
 function listHosts() {
   return presentedHosts();
@@ -104184,16 +104169,6 @@ function listHosts() {
 function ownHost() {
   return ownHostId();
 }
-function setControlLinkDeviceId(id) {
-  if (!id || id === deviceId)
-    return;
-  deviceId = id;
-  if (cfg)
-    cfg = { ...cfg, deviceId: id };
-  lastOwnHostLog = null;
-  hooks?.ownHostResolved(ownHostId());
-  hooks?.pushHosts(presentedHosts());
-}
 function assertServerSelection() {
   if (!socket || socket.readyState !== 1)
     return;
@@ -104367,7 +104342,12 @@ function resumeActiveLinks() {
     for (const { linkId } of listActiveLinks())
       if (!configured.has(linkId))
         void disconnectActiveLink(linkId);
-    for (const cfg2 of configs) {
+    for (const stored of configs) {
+      const peerDevice = hostDeviceId(stored.peerHostId);
+      const live = peerDevice ? serverHosts.find((h) => h.deviceId === peerDevice) : void 0;
+      const cfg2 = live && live.hostId !== stored.peerHostId ? { ...stored, peerHostId: live.hostId } : stored;
+      if (cfg2 !== stored)
+        saveLinkConfig(cfg2);
       connectActiveLink({
         linkId: cfg2.linkId,
         localRoot: cfg2.localRoot,
@@ -104420,9 +104400,9 @@ function provisionActiveLinkMirror(payload) {
   const remoteSubfolder = typeof payload.remoteSubfolder === "string" ? payload.remoteSubfolder : void 0;
   let localRoot;
   if (remoteParent && remoteSubfolder) {
-    localRoot = join61(remoteParent, safeFolderName(remoteSubfolder));
+    localRoot = join60(remoteParent, safeFolderName(remoteSubfolder));
   } else {
-    localRoot = join61(HOST_ROOT, "Tesseract Mirrors", safeFolderName(projectName));
+    localRoot = join60(HOST_ROOT, "Tesseract Mirrors", safeFolderName(projectName));
   }
   if (loadLinkConfigs().some((c) => c.localRoot === localRoot && c.linkId !== linkId)) {
     localRoot = `${localRoot}-${linkId.slice(0, 6)}`;
@@ -104430,7 +104410,7 @@ function provisionActiveLinkMirror(payload) {
   if (!isInsideRoot(localRoot, HOST_ROOT))
     return;
   try {
-    mkdirSync30(localRoot, { recursive: true });
+    mkdirSync29(localRoot, { recursive: true });
   } catch {
   }
   saveLinkConfig({
@@ -104738,7 +104718,7 @@ async function handleInboundAgent(msg, driverClientId) {
           send3("agent", {
             type: "agent:notice",
             sessionId: msg.sessionId,
-            noticeId: randomUUID25(),
+            noticeId: randomUUID24(),
             category: "model",
             level: "warning",
             title: "That model is not available on this device",
@@ -104967,10 +104947,19 @@ function handleHostChannel(payload) {
     return;
   }
   if (payload.type === "host:register:denied") {
+    const d = payload;
+    if (d.reason === "revoked") {
+      stopHeartbeat();
+      teardownHostRole();
+      const message2 = typeof payload.message === "string" ? payload.message : "This computer was removed from the account.";
+      console.log(`[control-link] host:register DENIED reason=revoked \u2014 ${message2}`);
+      hooks?.notify({ type: "notify", level: "warning", message: message2 });
+      hooks?.onDeviceRevoked?.();
+      return;
+    }
     entitlementDenied = true;
     stopHeartbeat();
     const message = typeof payload.message === "string" ? payload.message : "Running agents on your own machines requires a paid plan.";
-    const d = payload;
     console.log(`[control-link] host:register DENIED reason=${String(d.reason ?? "?")} feature=${String(d.feature ?? "?")} limit=${String(d.limit ?? "?")} \u2014 ${message}`);
     hooks?.notify({ type: "notify", level: "warning", message });
     scheduleEntitlementRetry();
@@ -105506,6 +105495,8 @@ function refreshControlLink() {
   if (accountChanged) {
     serverHosts = [];
     serverSelected = false;
+    entitlementDenied = false;
+    cancelEntitlementRetry();
     teardownHostRole();
     hooks.pushHosts(presentedHosts());
     hooks.ownHostResolved(ownHostId());
@@ -105537,9 +105528,9 @@ init_gateway_plan2();
 init_base_paths();
 init_credentials();
 init_dist5();
-import { mkdirSync as mkdirSync31, readFileSync as readFileSync40, writeFileSync as writeFileSync28 } from "node:fs";
-import { randomUUID as randomUUID26 } from "node:crypto";
-import { dirname as dirname29 } from "node:path";
+import { mkdirSync as mkdirSync30, readFileSync as readFileSync39, writeFileSync as writeFileSync27 } from "node:fs";
+import { randomUUID as randomUUID25 } from "node:crypto";
+import { dirname as dirname28 } from "node:path";
 var REFRESH_MS = 24 * 60 * 60 * 1e3;
 var TIMEOUT_MS2 = 1e4;
 var CACHE = () => tessPath("bundled-model.json");
@@ -105549,22 +105540,22 @@ function deviceId2() {
   if (fromCredentials)
     return fromCredentials;
   try {
-    const raw = JSON.parse(readFileSync40(DEVICE_ID(), "utf8"));
+    const raw = JSON.parse(readFileSync39(DEVICE_ID(), "utf8"));
     if (typeof raw?.deviceId === "string" && raw.deviceId)
       return raw.deviceId;
   } catch {
   }
-  const fresh = randomUUID26().slice(0, 8);
+  const fresh = randomUUID25().slice(0, 8);
   try {
-    mkdirSync31(dirname29(DEVICE_ID()), { recursive: true });
-    writeFileSync28(DEVICE_ID(), JSON.stringify({ deviceId: fresh }), { mode: 384 });
+    mkdirSync30(dirname28(DEVICE_ID()), { recursive: true });
+    writeFileSync27(DEVICE_ID(), JSON.stringify({ deviceId: fresh }), { mode: 384 });
   } catch {
   }
   return fresh;
 }
 function readCache() {
   try {
-    const raw = JSON.parse(readFileSync40(CACHE(), "utf8"));
+    const raw = JSON.parse(readFileSync39(CACHE(), "utf8"));
     if (typeof raw?.apiKey === "string" && typeof raw.baseUrl === "string" && raw.models?.low && raw.models.high) {
       return { ...raw, fetchedAt: raw.fetchedAt ?? 0 };
     }
@@ -105574,8 +105565,8 @@ function readCache() {
 }
 function writeCache(key2) {
   try {
-    mkdirSync31(dirname29(CACHE()), { recursive: true });
-    writeFileSync28(CACHE(), JSON.stringify({ ...key2, fetchedAt: Date.now() }, null, 2), { mode: 384 });
+    mkdirSync30(dirname28(CACHE()), { recursive: true });
+    writeFileSync27(CACHE(), JSON.stringify({ ...key2, fetchedAt: Date.now() }, null, 2), { mode: 384 });
   } catch (e) {
     log(`gateway key: could not cache (${e.message})`);
   }
@@ -106156,7 +106147,7 @@ Open System Settings \u2192 Privacy & Security \u2192 Screen Recording and switc
 }
 
 // ../../packages/host-core/dist/rdesk/publisher-window.js
-import { join as join62 } from "node:path";
+import { join as join61 } from "node:path";
 var windows = /* @__PURE__ */ new Map();
 var ipcInstalled = false;
 function ensureIpc() {
@@ -106311,7 +106302,7 @@ var PublisherWindow = class {
       win3.setContentProtection(true);
     } catch {
     }
-    await win3.loadFile(join62(daemonUiDir(), "publisher.html"));
+    await win3.loadFile(join61(daemonUiDir(), "publisher.html"));
     this.send("rdesk:pub:start", {
       sessionId: this.sessionId,
       sourceId,
@@ -106356,7 +106347,7 @@ var PublisherWindow = class {
       win3.setContentProtection(true);
     } catch {
     }
-    await win3.loadFile(join62(daemonUiDir(), "publisher.html"));
+    await win3.loadFile(join61(daemonUiDir(), "publisher.html"));
     this.send("rdesk:pub:start", {
       sessionId: this.sessionId,
       mode: "canvas",
@@ -106956,10 +106947,10 @@ function setInProcConnector(fn) {
 
 // ../../packages/host-core/dist/rdesk/server-prefs.js
 init_credentials();
-import { readFileSync as readFileSync41, writeFileSync as writeFileSync29 } from "node:fs";
-import { join as join63 } from "node:path";
+import { readFileSync as readFileSync40, writeFileSync as writeFileSync28 } from "node:fs";
+import { join as join62 } from "node:path";
 function rdeskServerPrefsPath() {
-  return join63(daemonDir2(), "rdesk-server.json");
+  return join62(daemonDir2(), "rdesk-server.json");
 }
 var DEFAULTS2 = {
   enabled: true,
@@ -106971,7 +106962,7 @@ var DEFAULTS2 = {
 };
 function readRdeskServerPrefs() {
   try {
-    const p = JSON.parse(readFileSync41(rdeskServerPrefsPath(), "utf8"));
+    const p = JSON.parse(readFileSync40(rdeskServerPrefsPath(), "utf8"));
     return {
       // `!== false` (not `?? true`): only an explicit opt-out disables sharing, so a
       // partially-written or older prefs file never silently turns the machine off.
@@ -106989,7 +106980,7 @@ function readRdeskServerPrefs() {
 function writeRdeskServerPrefs(patch) {
   try {
     const next = { ...readRdeskServerPrefs(), ...patch };
-    writeFileSync29(rdeskServerPrefsPath(), JSON.stringify(next), { mode: 384 });
+    writeFileSync28(rdeskServerPrefsPath(), JSON.stringify(next), { mode: 384 });
   } catch {
   }
 }
@@ -107004,13 +106995,13 @@ function rdeskSharingEnabled() {
 // ../../packages/host-core/dist/rdesk/password.js
 init_credentials();
 import { scryptSync, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual4, randomInt } from "node:crypto";
-import { readFileSync as readFileSync42, writeFileSync as writeFileSync30, existsSync as existsSync29, unlinkSync as unlinkSync4 } from "node:fs";
-import { join as join64 } from "node:path";
+import { readFileSync as readFileSync41, writeFileSync as writeFileSync29, existsSync as existsSync28, unlinkSync as unlinkSync4 } from "node:fs";
+import { join as join63 } from "node:path";
 function pwFile() {
-  return join64(daemonDir2(), "rdesk-password.json");
+  return join63(daemonDir2(), "rdesk-password.json");
 }
 function pwPlainFile() {
-  return join64(daemonDir2(), "rdesk-password.enc");
+  return join63(daemonDir2(), "rdesk-password.enc");
 }
 var PW_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789";
 var PW_LENGTH = 16;
@@ -107025,14 +107016,14 @@ function writePlain(password) {
     const safe2 = electronModule()?.safeStorage;
     if (!safe2?.isEncryptionAvailable())
       return;
-    writeFileSync30(pwPlainFile(), safe2.encryptString(password), { mode: 384 });
+    writeFileSync29(pwPlainFile(), safe2.encryptString(password), { mode: 384 });
   } catch {
   }
 }
 function canRevealRdeskPassword() {
   try {
     const safe2 = electronModule()?.safeStorage;
-    return !!safe2?.isEncryptionAvailable() && existsSync29(pwPlainFile());
+    return !!safe2?.isEncryptionAvailable() && existsSync28(pwPlainFile());
   } catch {
     return false;
   }
@@ -107042,7 +107033,7 @@ function readRdeskPasswordPlain() {
     const safe2 = electronModule()?.safeStorage;
     if (!safe2?.isEncryptionAvailable())
       return null;
-    return safe2.decryptString(readFileSync42(pwPlainFile()));
+    return safe2.decryptString(readFileSync41(pwPlainFile()));
   } catch {
     return null;
   }
@@ -107061,7 +107052,7 @@ function setRdeskPassword(password) {
   }
   const salt = randomBytes5(16);
   const hash2 = scryptSync(password, salt, 32);
-  writeFileSync30(pwFile(), JSON.stringify({ salt: salt.toString("hex"), hash: hash2.toString("hex") }), { mode: 384 });
+  writeFileSync29(pwFile(), JSON.stringify({ salt: salt.toString("hex"), hash: hash2.toString("hex") }), { mode: 384 });
   writePlain(password);
 }
 function regenerateRdeskPassword() {
@@ -107075,7 +107066,7 @@ function ensureRdeskPassword() {
   return regenerateRdeskPassword();
 }
 function hasRdeskPassword() {
-  return !!process.env.CCB_RDESK_PASSWORD || existsSync29(pwFile());
+  return !!process.env.CCB_RDESK_PASSWORD || existsSync28(pwFile());
 }
 function verifyRdeskPassword(password) {
   if (!password)
@@ -107084,7 +107075,7 @@ function verifyRdeskPassword(password) {
   if (override3)
     return password.length === override3.length && timingSafeEqual4(Buffer.from(password), Buffer.from(override3));
   try {
-    const { salt, hash: hash2 } = JSON.parse(readFileSync42(pwFile(), "utf8"));
+    const { salt, hash: hash2 } = JSON.parse(readFileSync41(pwFile(), "utf8"));
     const got = scryptSync(password, Buffer.from(salt, "hex"), 32);
     const want = Buffer.from(hash2, "hex");
     return got.length === want.length && timingSafeEqual4(got, want);
@@ -107562,7 +107553,7 @@ function stopSystemEvents() {
 }
 
 // ../../packages/host-core/dist/local-server.js
-import { randomUUID as randomUUID28 } from "node:crypto";
+import { randomUUID as randomUUID27 } from "node:crypto";
 init_daemon_settings();
 
 // ../../packages/host-core/dist/vault/manager.js
@@ -107650,8 +107641,8 @@ function createPasskeyRegistration(rpId) {
 
 // ../../packages/host-core/dist/vault/manager.js
 init_base_paths();
-import { mkdirSync as mkdirSync34, readFileSync as readFileSync45, writeFileSync as writeFileSync33 } from "node:fs";
-import { dirname as dirname31 } from "node:path";
+import { mkdirSync as mkdirSync33, readFileSync as readFileSync44, writeFileSync as writeFileSync32 } from "node:fs";
+import { dirname as dirname30 } from "node:path";
 
 // ../../packages/vault-core/dist/crypto.js
 init_argon2();
@@ -108158,7 +108149,7 @@ var XJSON_AAD = utf8("tesseract-vault-encrypted-json-v1");
 init_credentials();
 
 // ../../packages/host-core/dist/vault/store.js
-import { randomUUID as randomUUID27 } from "node:crypto";
+import { randomUUID as randomUUID26 } from "node:crypto";
 var b64 = (u) => Buffer.from(u).toString("base64");
 var u82 = (s) => new Uint8Array(Buffer.from(s, "base64"));
 var isServerRecoverableMeta = (m) => !m.wrappedVaultKey;
@@ -108460,7 +108451,7 @@ var VaultStore = class {
     const existing = input.id ? items.get(input.id) : void 0;
     const { id: _drop, name, folderId, favorite, reprompt, notes, tags, ...content } = input;
     const item = {
-      id: input.id ?? randomUUID27(),
+      id: input.id ?? randomUUID26(),
       name,
       folderId,
       favorite,
@@ -108489,7 +108480,7 @@ var VaultStore = class {
     const now2 = this.now();
     for (const d of drafts) {
       const { name, notes, favorite, tags, ...content } = d;
-      const item = { id: randomUUID27(), name, notes, favorite, tags, createdAt: now2, updatedAt: now2, ...content };
+      const item = { id: randomUUID26(), name, notes, favorite, tags, createdAt: now2, updatedAt: now2, ...content };
       items.set(item.id, item);
       this.enc.set(item.id, await encryptItem(key2, item));
       this.dirty.add(item.id);
@@ -108675,8 +108666,8 @@ function makeDaemonVaultApi(getOrigin, getToken2) {
 
 // ../../packages/host-core/dist/vault/persistence.js
 init_base_paths();
-import { existsSync as existsSync30, mkdirSync as mkdirSync32, readFileSync as readFileSync43, writeFileSync as writeFileSync31, unlinkSync as unlinkSync5 } from "node:fs";
-import { dirname as dirname30 } from "node:path";
+import { existsSync as existsSync29, mkdirSync as mkdirSync31, readFileSync as readFileSync42, writeFileSync as writeFileSync30, unlinkSync as unlinkSync5 } from "node:fs";
+import { dirname as dirname29 } from "node:path";
 function vaultStoreFile() {
   return homePath(".tesseract", "vault", "vault.json");
 }
@@ -108687,9 +108678,9 @@ function makeVaultPersistence(file2 = vaultStoreFile, deviceKeyFile = vaultDevic
   return {
     load() {
       try {
-        if (!existsSync30(file2()))
+        if (!existsSync29(file2()))
           return null;
-        const parsed = JSON.parse(readFileSync43(file2(), "utf8"));
+        const parsed = JSON.parse(readFileSync42(file2(), "utf8"));
         if (!parsed || typeof parsed !== "object")
           return null;
         return { meta: parsed.meta ?? null, items: Array.isArray(parsed.items) ? parsed.items : [] };
@@ -108699,28 +108690,28 @@ function makeVaultPersistence(file2 = vaultStoreFile, deviceKeyFile = vaultDevic
     },
     save(state3) {
       try {
-        mkdirSync32(dirname30(file2()), { recursive: true, mode: 448 });
-        writeFileSync31(file2(), JSON.stringify(state3), { mode: 384 });
+        mkdirSync31(dirname29(file2()), { recursive: true, mode: 448 });
+        writeFileSync30(file2(), JSON.stringify(state3), { mode: 384 });
       } catch {
       }
     },
     loadDeviceKey() {
       try {
-        return existsSync30(deviceKeyFile()) ? readFileSync43(deviceKeyFile(), "utf8").trim() || null : null;
+        return existsSync29(deviceKeyFile()) ? readFileSync42(deviceKeyFile(), "utf8").trim() || null : null;
       } catch {
         return null;
       }
     },
     saveDeviceKey(base64Key) {
       try {
-        mkdirSync32(dirname30(deviceKeyFile()), { recursive: true, mode: 448 });
-        writeFileSync31(deviceKeyFile(), base64Key, { mode: 384 });
+        mkdirSync31(dirname29(deviceKeyFile()), { recursive: true, mode: 448 });
+        writeFileSync30(deviceKeyFile(), base64Key, { mode: 384 });
       } catch {
       }
     },
     clearDeviceKey() {
       try {
-        if (existsSync30(deviceKeyFile()))
+        if (existsSync29(deviceKeyFile()))
           unlinkSync5(deviceKeyFile());
       } catch {
       }
@@ -108730,8 +108721,8 @@ function makeVaultPersistence(file2 = vaultStoreFile, deviceKeyFile = vaultDevic
 
 // ../../packages/host-core/dist/vault/biometric.js
 init_base_paths();
-import { existsSync as existsSync31, mkdirSync as mkdirSync33, readFileSync as readFileSync44, rmSync as rmSync6, writeFileSync as writeFileSync32 } from "node:fs";
-import { join as join65 } from "node:path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync32, readFileSync as readFileSync43, rmSync as rmSync6, writeFileSync as writeFileSync31 } from "node:fs";
+import { join as join64 } from "node:path";
 async function electronBio() {
   if (!electronModule())
     return null;
@@ -108748,11 +108739,11 @@ async function electronBio() {
 }
 function bioDir() {
   const d = homePath(".tesseract", "vault-bio");
-  mkdirSync33(d, { recursive: true, mode: 448 });
+  mkdirSync32(d, { recursive: true, mode: 448 });
   return d;
 }
 function bioFile(id) {
-  return join65(bioDir(), `${String(id).replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 64)}.enc`);
+  return join64(bioDir(), `${String(id).replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 64)}.enc`);
 }
 async function biometricAvailable() {
   if (process.platform !== "darwin")
@@ -108767,24 +108758,24 @@ async function biometricAvailable() {
   }
 }
 function biometricEnrolled(id) {
-  return existsSync31(bioFile(id));
+  return existsSync30(bioFile(id));
 }
 async function biometricEnroll(id, base64Key) {
   const bio = await electronBio();
   if (!bio)
     throw new Error("Touch ID is not available on this device.");
   await bio.systemPreferences.promptTouchID("enable Touch ID for your vault");
-  writeFileSync32(bioFile(id), bio.safeStorage.encryptString(base64Key), { mode: 384 });
+  writeFileSync31(bioFile(id), bio.safeStorage.encryptString(base64Key), { mode: 384 });
 }
 async function biometricUnlock(id) {
   const f = bioFile(id);
-  if (!existsSync31(f))
+  if (!existsSync30(f))
     throw new Error("Touch ID is not set up for this vault.");
   const bio = await electronBio();
   if (!bio)
     throw new Error("Touch ID is not available on this device.");
   await bio.systemPreferences.promptTouchID("unlock your vault");
-  return bio.safeStorage.decryptString(readFileSync44(f));
+  return bio.safeStorage.decryptString(readFileSync43(f));
 }
 function biometricDisable(id) {
   try {
@@ -108814,7 +108805,7 @@ var VaultManager = class {
   // ── auto-lock ────────────────────────────────────────────────────────────────────
   loadAutoLock() {
     try {
-      const raw = JSON.parse(readFileSync45(settingsFile(), "utf8"));
+      const raw = JSON.parse(readFileSync44(settingsFile(), "utf8"));
       return Number.isFinite(raw.autoLockMinutes) ? Math.max(0, raw.autoLockMinutes) : 0;
     } catch {
       return 0;
@@ -108822,8 +108813,8 @@ var VaultManager = class {
   }
   saveAutoLock() {
     try {
-      mkdirSync34(dirname31(settingsFile()), { recursive: true, mode: 448 });
-      writeFileSync33(settingsFile(), JSON.stringify({ autoLockMinutes: this.autoLockMinutes }), { mode: 384 });
+      mkdirSync33(dirname30(settingsFile()), { recursive: true, mode: 448 });
+      writeFileSync32(settingsFile(), JSON.stringify({ autoLockMinutes: this.autoLockMinutes }), { mode: 384 });
     } catch {
     }
   }
@@ -109520,7 +109511,7 @@ async function startLocalServer(opts) {
             send4("agent", {
               type: "agent:notice",
               sessionId: msg.sessionId,
-              noticeId: randomUUID28(),
+              noticeId: randomUUID27(),
               category: "model",
               level: "warning",
               title: "That model is not available on this device",
@@ -109907,13 +109898,13 @@ import { hostname as hostname5 } from "node:os";
 // ../../packages/shared/dist/daemon-registry.js
 init_base_paths();
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync32, mkdirSync as mkdirSync35, readdirSync as readdirSync11, readFileSync as readFileSync46, readlinkSync, unlinkSync as unlinkSync6, writeFileSync as writeFileSync34 } from "node:fs";
-import { join as join66 } from "node:path";
+import { existsSync as existsSync31, mkdirSync as mkdirSync34, readdirSync as readdirSync11, readFileSync as readFileSync45, readlinkSync, unlinkSync as unlinkSync6, writeFileSync as writeFileSync33 } from "node:fs";
+import { join as join65 } from "node:path";
 var SUPERVISOR_PID = Number(process.env.CCB_DAEMON_SUPERVISOR_PID ?? 0) || 0;
 delete process.env.CCB_DAEMON_SUPERVISOR_PID;
 var PS_ENV = { ...process.env, LC_ALL: "C", LANG: "C" };
-var registryDir = () => join66(daemonDir(), "daemons");
-var recordPath = (pid) => join66(registryDir(), `${pid}.json`);
+var registryDir = () => join65(daemonDir(), "daemons");
+var recordPath = (pid) => join65(registryDir(), `${pid}.json`);
 function isPidAlive2(pid) {
   try {
     process.kill(pid, 0);
@@ -109965,7 +109956,7 @@ function pidStillMatches(pid, rec) {
 }
 function registerSelfAsDaemon(version2) {
   try {
-    mkdirSync35(registryDir(), { recursive: true, mode: 448 });
+    mkdirSync34(registryDir(), { recursive: true, mode: 448 });
     const rec = {
       pid: process.pid,
       startedAt: procStartedAt(process.pid),
@@ -109977,7 +109968,7 @@ function registerSelfAsDaemon(version2) {
       ...process.env.CCB_RDESK_ONLY === "1" || process.env.CCB_MESH_ONLY === "1" ? { rdeskOnly: true } : {},
       ...SUPERVISOR_PID ? { supervisorPid: SUPERVISOR_PID, supervisorStartedAt: procStartedAt(SUPERVISOR_PID) } : {}
     };
-    writeFileSync34(recordPath(process.pid), JSON.stringify(rec), { mode: 384 });
+    writeFileSync33(recordPath(process.pid), JSON.stringify(rec), { mode: 384 });
     invalidateSupervisorCache();
     try {
       registeredDaemons(process.pid);
@@ -109998,7 +109989,7 @@ function unregisterSelfAsDaemon() {
 }
 function readRecord(pid) {
   try {
-    return JSON.parse(readFileSync46(recordPath(pid), "utf-8"));
+    return JSON.parse(readFileSync45(recordPath(pid), "utf-8"));
   } catch {
     return null;
   }
@@ -110012,7 +110003,7 @@ function allRegisteredPids() {
 }
 function registeredDaemons(selfPid) {
   const out = [];
-  if (!existsSync32(registryDir()))
+  if (!existsSync31(registryDir()))
     return out;
   for (const pid of allRegisteredPids()) {
     if (pid === selfPid)
@@ -110041,18 +110032,18 @@ function liveDaemons() {
 }
 
 // ../../packages/host-core/dist/device-identity.js
-import { join as join67 } from "node:path";
-import { readFileSync as readFileSync47, writeFileSync as writeFileSync35, existsSync as existsSync33, mkdirSync as mkdirSync36, renameSync as renameSync10, chmodSync as chmodSync4 } from "node:fs";
+import { join as join66 } from "node:path";
+import { readFileSync as readFileSync46, writeFileSync as writeFileSync34, existsSync as existsSync32, mkdirSync as mkdirSync35, renameSync as renameSync10, chmodSync as chmodSync4 } from "node:fs";
 init_credentials();
 var cached3 = null;
 function identityPath() {
-  return join67(daemonDir2(), "identity.json");
+  return join66(daemonDir2(), "identity.json");
 }
 async function loadOrCreateDeviceIdentity() {
   if (cached3)
     return cached3;
   try {
-    const stored = JSON.parse(readFileSync47(identityPath(), "utf-8"));
+    const stored = JSON.parse(readFileSync46(identityPath(), "utf-8"));
     if (stored?.privateJwk) {
       cached3 = await importIdentity(stored.privateJwk);
       return cached3;
@@ -110062,10 +110053,10 @@ async function loadOrCreateDeviceIdentity() {
   const kp = await generateIdentityKeyPair(true);
   const { privateJwk, publicRaw } = await exportIdentity(kp);
   const dir2 = daemonDir2();
-  if (!existsSync33(dir2))
-    mkdirSync36(dir2, { recursive: true, mode: 448 });
+  if (!existsSync32(dir2))
+    mkdirSync35(dir2, { recursive: true, mode: 448 });
   const tmp = `${identityPath()}.tmp`;
-  writeFileSync35(tmp, JSON.stringify({ privateJwk, publicRaw, alg: "P256-ECDSA" }, null, 2), { mode: 384 });
+  writeFileSync34(tmp, JSON.stringify({ privateJwk, publicRaw, alg: "P256-ECDSA" }, null, 2), { mode: 384 });
   renameSync10(tmp, identityPath());
   try {
     chmodSync4(identityPath(), 384);
@@ -110076,7 +110067,7 @@ async function loadOrCreateDeviceIdentity() {
 }
 var sealingCached = null;
 function sealingPath() {
-  return join67(daemonDir2(), "sealing.json");
+  return join66(daemonDir2(), "sealing.json");
 }
 var EC_DH = { name: "ECDH", namedCurve: "P-256" };
 async function loadOrCreateSealingKey() {
@@ -110084,7 +110075,7 @@ async function loadOrCreateSealingKey() {
     return sealingCached;
   const { subtle: subtle5 } = globalThis.crypto;
   try {
-    const stored = JSON.parse(readFileSync47(sealingPath(), "utf-8"));
+    const stored = JSON.parse(readFileSync46(sealingPath(), "utf-8"));
     if (stored?.privateJwk && stored.publicRaw) {
       const privateKey = await subtle5.importKey("jwk", stored.privateJwk, EC_DH, true, ["deriveBits"]);
       sealingCached = { privateKey, publicRaw: unb64u(stored.publicRaw) };
@@ -110096,10 +110087,10 @@ async function loadOrCreateSealingKey() {
   const publicRaw = new Uint8Array(await subtle5.exportKey("raw", kp.publicKey));
   const privateJwk = await subtle5.exportKey("jwk", kp.privateKey);
   const dir2 = daemonDir2();
-  if (!existsSync33(dir2))
-    mkdirSync36(dir2, { recursive: true, mode: 448 });
+  if (!existsSync32(dir2))
+    mkdirSync35(dir2, { recursive: true, mode: 448 });
   const tmp = `${sealingPath()}.tmp`;
-  writeFileSync35(tmp, JSON.stringify({ privateJwk, publicRaw: b64u(publicRaw), alg: "P256-ECDH" }, null, 2), { mode: 384 });
+  writeFileSync34(tmp, JSON.stringify({ privateJwk, publicRaw: b64u(publicRaw), alg: "P256-ECDH" }, null, 2), { mode: 384 });
   renameSync10(tmp, sealingPath());
   try {
     chmodSync4(sealingPath(), 384);
@@ -110196,7 +110187,7 @@ var BundleOfferLedger = class {
 init_dist6();
 
 // ../../packages/host-core/dist/mesh/netd-client.js
-import { existsSync as existsSync34, readdirSync as readdirSync12 } from "node:fs";
+import { existsSync as existsSync33, readdirSync as readdirSync12 } from "node:fs";
 import { connect as connect2 } from "node:net";
 import { platform as platform3 } from "node:process";
 var NETD_WIRE_VERSION = 2;
@@ -110212,7 +110203,7 @@ function netdEndpoint() {
 function netdListening() {
   const ep = endpointOverride() ?? netdEndpoint();
   if (process.platform !== "win32")
-    return existsSync34(ep);
+    return existsSync33(ep);
   try {
     const name = ep.replace(/^\\\\\.\\pipe\\/, "");
     return readdirSync12("\\\\.\\pipe\\").includes(name);
@@ -110617,13 +110608,13 @@ ${ts}`);
 
 // ../../packages/host-core/dist/mesh/config.js
 init_credentials();
-import { chmodSync as chmodSync5, existsSync as existsSync35, mkdirSync as mkdirSync37, readdirSync as readdirSync13, readFileSync as readFileSync48, renameSync as renameSync11, rmSync as rmSync7, writeFileSync as writeFileSync36 } from "node:fs";
-import { dirname as dirname32, join as join69 } from "node:path";
+import { chmodSync as chmodSync5, existsSync as existsSync34, mkdirSync as mkdirSync36, readdirSync as readdirSync13, readFileSync as readFileSync47, renameSync as renameSync11, rmSync as rmSync7, writeFileSync as writeFileSync35 } from "node:fs";
+import { dirname as dirname31, join as join68 } from "node:path";
 function meshDir() {
-  return join69(daemonDir2(), "mesh");
+  return join68(daemonDir2(), "mesh");
 }
 function meshesDir() {
-  return join69(meshDir(), "meshes");
+  return join68(meshDir(), "meshes");
 }
 var MESH_DIR_NAME_BYTES = 8;
 function meshDirName(genesisFp) {
@@ -110641,7 +110632,7 @@ function oneMeshDir(meshId) {
   if (!isMeshId(meshId)) {
     throw new Error(`not a mesh id: ${JSON.stringify(meshId.slice(0, 64))}`);
   }
-  return join69(meshesDir(), meshId);
+  return join68(meshesDir(), meshId);
 }
 var LEGACY_MESH_ID = "legacy";
 var CERT_GENESIS_FP_OFFSET = 19;
@@ -110659,29 +110650,29 @@ var FILES = {
   local: "local.json"
 };
 function readIfPresent(name, dir2 = meshDir()) {
-  const p = join69(dir2, name);
+  const p = join68(dir2, name);
   try {
-    return existsSync35(p) ? new Uint8Array(readFileSync48(p)) : void 0;
+    return existsSync34(p) ? new Uint8Array(readFileSync47(p)) : void 0;
   } catch {
     return void 0;
   }
 }
 function migrateSingleMesh() {
-  const legacyGenesis = join69(meshDir(), FILES.genesis);
-  if (!existsSync35(legacyGenesis))
+  const legacyGenesis = join68(meshDir(), FILES.genesis);
+  if (!existsSync34(legacyGenesis))
     return null;
   const id = meshIdFromCert(readIfPresent(FILES.cert)) ?? LEGACY_MESH_ID;
   const dest = oneMeshDir(id);
   try {
-    mkdirSync37(dest, { recursive: true, mode: 448 });
+    mkdirSync36(dest, { recursive: true, mode: 448 });
     chmodSync5(dest, 448);
     for (const f of Object.values(FILES)) {
-      const from = join69(meshDir(), f);
-      if (existsSync35(from))
-        renameSync11(from, join69(dest, f));
+      const from = join68(meshDir(), f);
+      if (existsSync34(from))
+        renameSync11(from, join68(dest, f));
     }
-    const key2 = join69(dest, FILES.key);
-    if (existsSync35(key2))
+    const key2 = join68(dest, FILES.key);
+    if (existsSync34(key2))
       chmodSync5(key2, 384);
   } catch {
     return null;
@@ -110704,15 +110695,15 @@ function listMeshIds() {
 }
 function readLocal(meshId) {
   try {
-    return JSON.parse(readFileSync48(join69(oneMeshDir(meshId), FILES.local), "utf8"));
+    return JSON.parse(readFileSync47(join68(oneMeshDir(meshId), FILES.local), "utf8"));
   } catch {
     return null;
   }
 }
 function writeLocal(meshId, state3) {
   try {
-    mkdirSync37(oneMeshDir(meshId), { recursive: true, mode: 448 });
-    writeFileSync36(join69(oneMeshDir(meshId), FILES.local), JSON.stringify(state3, null, 2), { mode: 384 });
+    mkdirSync36(oneMeshDir(meshId), { recursive: true, mode: 448 });
+    writeFileSync35(join68(oneMeshDir(meshId), FILES.local), JSON.stringify(state3, null, 2), { mode: 384 });
   } catch {
   }
 }
@@ -110745,8 +110736,8 @@ function loadMeshIdentity() {
   return first === void 0 ? null : loadMesh(first);
 }
 function writeSecret(name, bytes2, dir2 = meshDir()) {
-  const p = join69(dir2, name);
-  writeFileSync36(p, bytes2, { mode: 384 });
+  const p = join68(dir2, name);
+  writeFileSync35(p, bytes2, { mode: 384 });
   try {
     chmodSync5(p, 384);
   } catch {
@@ -110758,20 +110749,20 @@ function saveMeshIdentity(id) {
     saveMesh(meshId, id);
     return;
   }
-  mkdirSync37(meshDir(), { recursive: true, mode: 448 });
+  mkdirSync36(meshDir(), { recursive: true, mode: 448 });
   try {
     chmodSync5(meshDir(), 448);
   } catch {
   }
-  writeFileSync36(join69(meshDir(), FILES.genesis), id.genesis);
-  writeFileSync36(join69(meshDir(), FILES.cert), id.cert);
+  writeFileSync35(join68(meshDir(), FILES.genesis), id.genesis);
+  writeFileSync35(join68(meshDir(), FILES.cert), id.cert);
   writeSecret(FILES.key, id.staticPrivate);
   if (id.bundle)
-    writeFileSync36(join69(meshDir(), FILES.bundle), id.bundle);
+    writeFileSync35(join68(meshDir(), FILES.bundle), id.bundle);
 }
 function saveMesh(meshId, id) {
   const dir2 = oneMeshDir(meshId);
-  mkdirSync37(dir2, { recursive: true, mode: 448 });
+  mkdirSync36(dir2, { recursive: true, mode: 448 });
   try {
     chmodSync5(meshDir(), 448);
   } catch {
@@ -110784,13 +110775,13 @@ function saveMesh(meshId, id) {
     chmodSync5(dir2, 448);
   } catch {
   }
-  writeFileSync36(join69(dir2, FILES.genesis), id.genesis);
-  writeFileSync36(join69(dir2, FILES.cert), id.cert);
+  writeFileSync35(join68(dir2, FILES.genesis), id.genesis);
+  writeFileSync35(join68(dir2, FILES.cert), id.cert);
   writeSecret(FILES.key, id.staticPrivate, dir2);
   if (id.sigPrivate)
     writeSecret(FILES.sigKey, id.sigPrivate, dir2);
   if (id.bundle)
-    writeFileSync36(join69(dir2, FILES.bundle), id.bundle);
+    writeFileSync35(join68(dir2, FILES.bundle), id.bundle);
   if (readLocal(meshId) === null)
     writeLocal(meshId, { joinedAt: Date.now() });
 }
@@ -110800,13 +110791,13 @@ function removeMesh(meshId) {
 var STATUS_REFRESH_MS = 5e3;
 var STATUS_STALE_MS = 2e4;
 function statusPath(meshId) {
-  return meshId === void 0 ? join69(meshDir(), "status.json") : join69(oneMeshDir(meshId), "status.json");
+  return meshId === void 0 ? join68(meshDir(), "status.json") : join68(oneMeshDir(meshId), "status.json");
 }
 function writeStatus(status2, meshId) {
   try {
     const p = statusPath(meshId);
-    mkdirSync37(dirname32(p), { recursive: true, mode: 448 });
-    writeFileSync36(p, JSON.stringify({ ...status2, at: Date.now() }, null, 2));
+    mkdirSync36(dirname31(p), { recursive: true, mode: 448 });
+    writeFileSync35(p, JSON.stringify({ ...status2, at: Date.now() }, null, 2));
   } catch {
   }
 }
@@ -110818,7 +110809,7 @@ function clearStatus(meshId) {
 }
 function readStatus(meshId) {
   try {
-    const raw = JSON.parse(readFileSync48(statusPath(meshId), "utf8"));
+    const raw = JSON.parse(readFileSync47(statusPath(meshId), "utf8"));
     if (typeof raw.at !== "number")
       return null;
     return { ...raw, at: raw.at, stale: Date.now() - raw.at > STATUS_STALE_MS };
@@ -110830,8 +110821,8 @@ function cacheBundle(bundle, meshId) {
   try {
     const id = meshId ?? listMeshIds()[0];
     const dir2 = id === void 0 ? meshDir() : oneMeshDir(id);
-    mkdirSync37(dir2, { recursive: true, mode: 448 });
-    writeFileSync36(join69(dir2, FILES.bundle), bundle);
+    mkdirSync36(dir2, { recursive: true, mode: 448 });
+    writeFileSync35(join68(dir2, FILES.bundle), bundle);
   } catch {
   }
 }
@@ -111960,20 +111951,38 @@ function startNodes(log9) {
       return [];
     }
     const started2 = meshNode().start();
-    log9(started2.ok ? "mesh: node up" : `mesh: not started \u2014 ${started2.reason}`);
-    return started2.ok && only !== void 0 ? [only] : [];
+    if (started2.ok) {
+      log9("mesh: node up");
+      return only !== void 0 ? [only] : [];
+    }
+    const refusal = { running: false, enrolled: true, lastError: started2.reason };
+    if (only !== void 0)
+      writeStatus(refusal, only);
+    writeStatus(refusal);
+    log9(`mesh: not started \u2014 ${started2.reason}`);
+    return [];
   }
   const running2 = [];
+  let failedPrimary = null;
   for (const r of meshManager().startAll()) {
-    log9(r.ok ? `mesh ${r.meshId}: up` : `mesh ${r.meshId}: not started \u2014 ${r.reason}`);
-    if (r.ok)
+    if (r.ok) {
+      log9(`mesh ${r.meshId}: up`);
       running2.push(r.meshId);
+      continue;
+    }
+    writeStatus({ running: false, enrolled: true, lastError: r.reason }, r.meshId);
+    if (failedPrimary === null)
+      failedPrimary = r.reason ?? "the node did not start";
+    log9(`mesh ${r.meshId}: not started \u2014 ${r.reason}`);
+  }
+  if (running2.length === 0 && failedPrimary !== null) {
+    writeStatus({ running: false, enrolled: true, lastError: failedPrimary });
   }
   return running2;
 }
 
 // ../../packages/host-core/dist/drops/receive-ui.js
-import { basename as basename12, dirname as dirname33 } from "node:path";
+import { basename as basename12, dirname as dirname32 } from "node:path";
 var log5 = (...a) => console.log("[drops]", ...a);
 function formatBytes(n) {
   if (!Number.isFinite(n) || n <= 0)
@@ -112067,7 +112076,7 @@ import { basename as basename13 } from "node:path";
 // ../../packages/host-core/dist/drops/paths.js
 init_base_paths();
 import { mkdir as mkdir14 } from "node:fs/promises";
-import { join as join70 } from "node:path";
+import { join as join69 } from "node:path";
 
 // ../../packages/host-core/dist/drops/names.js
 var WINDOWS_RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i;
@@ -112156,7 +112165,7 @@ function basenameOf(p) {
 function resolveDropsRoot() {
   const root = resolveHostRoot();
   const preferred = dropsDir();
-  return isInsideRoot(preferred, root) ? preferred : join70(root, "Drops");
+  return isInsideRoot(preferred, root) ? preferred : join69(root, "Drops");
 }
 async function ensureDropsRoot() {
   const dir2 = resolveDropsRoot();
@@ -112172,7 +112181,7 @@ async function ensureDropDir(opts) {
     parts.push(sanitizeDropName(opts.sender, "Unknown sender"));
   if (!opts.singleItem && opts.label)
     parts.push(sanitizeDropName(opts.label, "Files"));
-  const dir2 = join70(...parts);
+  const dir2 = join69(...parts);
   await mkdir14(dir2, { recursive: true });
   return dir2;
 }
@@ -112315,7 +112324,7 @@ function createDropHandler(deps) {
 // ../../packages/host-core/dist/drops/blob-fetch.js
 import { createWriteStream as createWriteStream2 } from "node:fs";
 import { mkdir as mkdir15, rm as rm5, chmod as chmod3 } from "node:fs/promises";
-import { dirname as dirname34, join as join71 } from "node:path";
+import { dirname as dirname33, join as join70 } from "node:path";
 import { Readable as Readable2 } from "node:stream";
 import { pipeline } from "node:stream/promises";
 
@@ -112487,7 +112496,7 @@ async function fetchBlobDrop(opts) {
         log7(`drop ${opts.dropId}: refusing directory "${item.rel}"`);
         continue;
       }
-      const abs = join71(opts.destDir, rel);
+      const abs = join70(opts.destDir, rel);
       if (!isInsideRoot(abs, opts.destDir)) {
         log7(`drop ${opts.dropId}: refusing directory outside the destination`);
         continue;
@@ -112508,12 +112517,12 @@ async function fetchBlobDrop(opts) {
         log7(`drop ${opts.dropId}: refusing "${item.rel}"`);
         continue;
       }
-      let abs = join71(opts.destDir, rel);
+      let abs = join70(opts.destDir, rel);
       if (!isInsideRoot(abs, opts.destDir)) {
         log7(`drop ${opts.dropId}: refusing a path outside the destination`);
         continue;
       }
-      await mkdir15(dirname34(abs), { recursive: true });
+      await mkdir15(dirname33(abs), { recursive: true });
       abs = await uniqueDropPath(abs);
       const res = await fetchFn(new URL(item.url, opts.apiOrigin).toString(), { signal: opts.signal });
       if (!res.ok || !res.body)
@@ -112545,7 +112554,7 @@ async function fetchBlobDrop(opts) {
 }
 
 // ../../packages/host-core/dist/chat-agent.js
-import { randomUUID as randomUUID29 } from "node:crypto";
+import { randomUUID as randomUUID28 } from "node:crypto";
 init_prompts();
 var TURN_TIMEOUT_MS = 4 * 6e4;
 var PARTIAL_INTERVAL_MS = 700;
@@ -112574,7 +112583,7 @@ function createChatAgentRunner(deps) {
   }
   async function runTurn(prompt2, onPartial) {
     const backend2 = await getSharedBackend();
-    const clientRequestId = `chat-agent-${randomUUID29()}`;
+    const clientRequestId = `chat-agent-${randomUUID28()}`;
     return new Promise((resolve16, reject) => {
       let text12 = "";
       let settled = false;
@@ -112783,13 +112792,13 @@ var RdeskServerChannel = class {
 };
 
 // ../../packages/host-core/dist/rdesk/channel-client.js
-import { readFileSync as readFileSync49 } from "node:fs";
-import { join as join72 } from "node:path";
+import { readFileSync as readFileSync48 } from "node:fs";
+import { join as join71 } from "node:path";
 var RECONNECT_MS = 2e3;
 var CLAIM_RETRY_MS = 5e3;
 function readEndpoint(dir2, selfPid) {
   try {
-    const s = JSON.parse(readFileSync49(join72(dir2, "status.json"), "utf8"));
+    const s = JSON.parse(readFileSync48(join71(dir2, "status.json"), "utf8"));
     if (selfPid && s.pid === selfPid)
       return null;
     return s.localPort && s.localToken ? `ws://127.0.0.1:${s.localPort}/?token=${s.localToken}` : null;
@@ -113234,10 +113243,10 @@ function registerRdpEngine() {
 // ../../packages/host-core/dist/rdesk/audit.js
 init_credentials();
 import { appendFile, stat as stat9, rename as rename4 } from "node:fs/promises";
-import { join as join73 } from "node:path";
+import { join as join72 } from "node:path";
 var MAX_BYTES2 = 2 * 1024 * 1024;
 function rdeskAuditPath() {
-  return join73(daemonDir2(), "rdesk-audit.jsonl");
+  return join72(daemonDir2(), "rdesk-audit.jsonl");
 }
 var queue = [];
 var draining = false;
@@ -113279,13 +113288,13 @@ function appendRdeskAudit(e) {
 
 // ../../packages/host-core/dist/fileprovider-bridge.js
 init_managed_spawn();
-import { writeFileSync as writeFileSync37, mkdirSync as mkdirSync38, rmSync as rmSync8, existsSync as existsSync36 } from "node:fs";
+import { writeFileSync as writeFileSync36, mkdirSync as mkdirSync37, rmSync as rmSync8, existsSync as existsSync35 } from "node:fs";
 import { homedir as homedir10 } from "node:os";
-import { join as join74 } from "node:path";
+import { join as join73 } from "node:path";
 init_safe_kill();
 var APPEX_BUNDLE_ID = "dev.tesseract.FileProvider";
 function appexBridgeInfoPath() {
-  return join74(homedir10(), "Library", "Containers", APPEX_BUNDLE_ID, "Data", "Library", "Application Support", "tesseract-bridge.json");
+  return join73(homedir10(), "Library", "Containers", APPEX_BUNDLE_ID, "Data", "Library", "Application Support", "tesseract-bridge.json");
 }
 function clearBridgeInfo() {
   if (process.platform !== "darwin")
@@ -113450,9 +113459,9 @@ function stopFileProviderBridge() {
 
 // ../../packages/host-core/dist/vault/autofill-bridge.js
 import { randomBytes as randomBytes9 } from "node:crypto";
-import { existsSync as existsSync37, mkdirSync as mkdirSync39, writeFileSync as writeFileSync38, rmSync as rmSync9 } from "node:fs";
+import { existsSync as existsSync36, mkdirSync as mkdirSync38, writeFileSync as writeFileSync37, rmSync as rmSync9 } from "node:fs";
 import { homedir as homedir11 } from "node:os";
-import { join as join75 } from "node:path";
+import { join as join74 } from "node:path";
 
 // ../../packages/host-core/dist/vault/peer-verify.js
 import { execFile as execFile9 } from "node:child_process";
@@ -113514,10 +113523,10 @@ async function isTrustedAutofillPeer(remotePort) {
 var APPEX_BUNDLE_ID2 = "dev.tesseract.AutoFill";
 var BRIDGE_PORTS2 = [17872, 17873, 17874, 17875];
 function appexContainerData() {
-  return join75(homedir11(), "Library", "Containers", APPEX_BUNDLE_ID2, "Data");
+  return join74(homedir11(), "Library", "Containers", APPEX_BUNDLE_ID2, "Data");
 }
 function bridgeInfoPath() {
-  return join75(appexContainerData(), "Library", "Application Support", "tesseract-autofill-bridge.json");
+  return join74(appexContainerData(), "Library", "Application Support", "tesseract-autofill-bridge.json");
 }
 var infoLoggedOnce = false;
 function writeBridgeInfo(port, token3, log9) {
@@ -113525,16 +113534,16 @@ function writeBridgeInfo(port, token3, log9) {
     return;
   const containerData = appexContainerData();
   try {
-    if (!existsSync37(containerData)) {
+    if (!existsSync36(containerData)) {
       if (!infoLoggedOnce) {
         infoLoggedOnce = true;
         log9("autofill bridge-info SKIP: no appex container yet at", containerData);
       }
       return;
     }
-    const dir2 = join75(containerData, "Library", "Application Support");
-    mkdirSync39(dir2, { recursive: true });
-    writeFileSync38(bridgeInfoPath(), JSON.stringify({ port, token: token3, pid: process.pid, ts: Date.now() }), { mode: 384 });
+    const dir2 = join74(containerData, "Library", "Application Support");
+    mkdirSync38(dir2, { recursive: true });
+    writeFileSync37(bridgeInfoPath(), JSON.stringify({ port, token: token3, pid: process.pid, ts: Date.now() }), { mode: 384 });
     if (!infoLoggedOnce) {
       infoLoggedOnce = true;
       log9("autofill bridge-info WROTE", port, "\u2192", dir2);
@@ -113774,9 +113783,9 @@ function createNodePowerController() {
 
 // ../../packages/host-core/dist/native-host.js
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { chmodSync as chmodSync6, existsSync as existsSync38, mkdirSync as mkdirSync40, writeFileSync as writeFileSync39 } from "node:fs";
+import { chmodSync as chmodSync6, existsSync as existsSync37, mkdirSync as mkdirSync39, writeFileSync as writeFileSync38 } from "node:fs";
 import { homedir as homedir12, platform as platform5 } from "node:os";
-import { dirname as dirname35, join as join76, resolve as resolve12 } from "node:path";
+import { dirname as dirname34, join as join75, resolve as resolve12 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 var HOST_NAME = "com.tesseract.companion";
 var EXTENSION_IDS = ["icpnghhpcmaonjckkpilpajblfehpplo", "giolfpookdhjfafcchaflhmigghaeffn"];
@@ -113785,41 +113794,41 @@ function browserProfileDirs() {
   const home = homedir12();
   const p = platform5();
   if (p === "darwin") {
-    const base = join76(home, "Library/Application Support");
-    return ["Google/Chrome", "Google/Chrome Beta", "Google/Chrome Dev", "Google/Chrome Canary", "Chromium", "Microsoft Edge", "BraveSoftware/Brave-Browser", "Vivaldi", "Arc"].map((b) => join76(base, b));
+    const base = join75(home, "Library/Application Support");
+    return ["Google/Chrome", "Google/Chrome Beta", "Google/Chrome Dev", "Google/Chrome Canary", "Chromium", "Microsoft Edge", "BraveSoftware/Brave-Browser", "Vivaldi", "Arc"].map((b) => join75(base, b));
   }
   if (p === "win32")
     return [];
-  const cfg2 = join76(home, ".config");
-  return ["google-chrome", "google-chrome-beta", "chromium", "microsoft-edge", "BraveSoftware/Brave-Browser", "vivaldi"].map((b) => join76(cfg2, b));
+  const cfg2 = join75(home, ".config");
+  return ["google-chrome", "google-chrome-beta", "chromium", "microsoft-edge", "BraveSoftware/Brave-Browser", "vivaldi"].map((b) => join75(cfg2, b));
 }
 function resolveBridge(log9) {
   const candidates = [
     process.env.CCB_COMPANION_HOST_JS,
-    process.resourcesPath ? join76(process.resourcesPath, "companion-host", BRIDGE_BASENAME) : void 0
+    process.resourcesPath ? join75(process.resourcesPath, "companion-host", BRIDGE_BASENAME) : void 0
   ];
   try {
-    const here = dirname35(fileURLToPath6(import.meta.url));
+    const here = dirname34(fileURLToPath6(import.meta.url));
     candidates.push(resolve12(here, "../../../apps/companion-host/dist", BRIDGE_BASENAME));
     candidates.push(resolve12(here, "../../apps/companion-host/dist", BRIDGE_BASENAME));
   } catch {
   }
   for (const c of candidates)
-    if (c && existsSync38(c))
+    if (c && existsSync37(c))
       return c;
   log9("companion native-host: bridge not found; skipping registration (looked in", candidates.filter(Boolean).join(" , "), ")");
   return null;
 }
 function writeLauncher(daemonDir3, bridge, runtime) {
   const isWin = platform5() === "win32";
-  const launcher = join76(daemonDir3, isWin ? "companion-host.cmd" : "companion-host.sh");
+  const launcher = join75(daemonDir3, isWin ? "companion-host.cmd" : "companion-host.sh");
   if (isWin) {
-    writeFileSync39(launcher, `@echo off\r
+    writeFileSync38(launcher, `@echo off\r
 set ELECTRON_RUN_AS_NODE=1\r
 "${runtime}" "${bridge}" %*\r
 `);
   } else {
-    writeFileSync39(launcher, `#!/bin/sh
+    writeFileSync38(launcher, `#!/bin/sh
 # Tesseract Companion native-messaging launcher (auto-written by the daemon).
 ELECTRON_RUN_AS_NODE=1 exec "${runtime}" "${bridge}" "$@"
 `);
@@ -113834,7 +113843,7 @@ function registerNativeHost(opts) {
     if (!bridge)
       return;
     const runtime = opts.runtime ?? process.execPath;
-    mkdirSync40(opts.daemonDir, { recursive: true });
+    mkdirSync39(opts.daemonDir, { recursive: true });
     const launcher = writeLauncher(opts.daemonDir, bridge, runtime);
     const manifestJson = JSON.stringify({
       name: HOST_NAME,
@@ -113847,12 +113856,12 @@ function registerNativeHost(opts) {
       return registerWindows(opts.daemonDir, manifestJson, log9);
     let wrote = 0;
     for (const profile of browserProfileDirs()) {
-      if (!existsSync38(profile))
+      if (!existsSync37(profile))
         continue;
       try {
-        const dir2 = join76(profile, "NativeMessagingHosts");
-        mkdirSync40(dir2, { recursive: true });
-        writeFileSync39(join76(dir2, `${HOST_NAME}.json`), manifestJson);
+        const dir2 = join75(profile, "NativeMessagingHosts");
+        mkdirSync39(dir2, { recursive: true });
+        writeFileSync38(join75(dir2, `${HOST_NAME}.json`), manifestJson);
         wrote++;
       } catch {
       }
@@ -113864,8 +113873,8 @@ function registerNativeHost(opts) {
 }
 function registerWindows(daemonDir3, manifestJson, log9) {
   try {
-    const manifestPath = join76(daemonDir3, `${HOST_NAME}.json`);
-    writeFileSync39(manifestPath, manifestJson);
+    const manifestPath = join75(daemonDir3, `${HOST_NAME}.json`);
+    writeFileSync38(manifestPath, manifestJson);
     for (const root of ["Software\\Google\\Chrome", "Software\\Microsoft\\Edge", "Software\\BraveSoftware\\Brave-Browser"]) {
       try {
         execFileSync4("reg", ["add", `HKCU\\${root}\\NativeMessagingHosts\\${HOST_NAME}`, "/ve", "/t", "REG_SZ", "/d", manifestPath, "/f"], { stdio: "ignore" });
@@ -113883,10 +113892,10 @@ init_daemon_settings();
 
 // ../../packages/host-core/dist/activity/activity-tracker.js
 init_credentials();
-import { promises as fsp, writeFileSync as writeFileSync40, mkdirSync as mkdirSync41, existsSync as existsSync39 } from "node:fs";
-import { join as join77 } from "node:path";
+import { promises as fsp, writeFileSync as writeFileSync39, mkdirSync as mkdirSync40, existsSync as existsSync38 } from "node:fs";
+import { join as join76 } from "node:path";
 function activityProfilePath() {
-  return join77(daemonDir2(), "activity-profile.json");
+  return join76(daemonDir2(), "activity-profile.json");
 }
 var MAX_APPS = 300;
 var MAX_AGE_DAYS = 120;
@@ -113961,7 +113970,7 @@ function createActivityTracker(opts = {}) {
         return;
       const key2 = front.bundleId || front.name;
       await ensureLoaded();
-      if (profile && Object.keys(profile.apps).length && !existsSync39(activityProfilePath())) {
+      if (profile && Object.keys(profile.apps).length && !existsSync38(activityProfilePath())) {
         log9("activity profile cleared externally \u2014 resetting in-memory");
         profile = { version: 1, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), apps: {} };
       }
@@ -113997,8 +114006,8 @@ function createActivityTracker(opts = {}) {
         if (profile) {
           pruneProfile(profile);
           profile.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-          mkdirSync41(daemonDir2(), { recursive: true, mode: 448 });
-          writeFileSync40(activityProfilePath(), JSON.stringify(profile), { mode: 384 });
+          mkdirSync40(daemonDir2(), { recursive: true, mode: 448 });
+          writeFileSync39(activityProfilePath(), JSON.stringify(profile), { mode: 384 });
           dirty = 0;
         }
       } catch (e) {
@@ -114050,6 +114059,38 @@ function closeRdeskCallWindow() {
 // ../../packages/host-core/dist/daemon-runtime.js
 init_credentials();
 
+// ../../packages/shared/dist/identity.js
+init_base_paths();
+import { existsSync as existsSync39, mkdirSync as mkdirSync41, readFileSync as readFileSync49, writeFileSync as writeFileSync40 } from "node:fs";
+import { dirname as dirname35, join as join77 } from "node:path";
+import { randomUUID as randomUUID29 } from "node:crypto";
+function deviceIdFile() {
+  return join77(tesseractHome(), "device-id.json");
+}
+function readPersistedDeviceId() {
+  try {
+    const raw = JSON.parse(readFileSync49(deviceIdFile(), "utf-8"));
+    return typeof raw.deviceId === "string" && raw.deviceId ? raw.deviceId : null;
+  } catch {
+    return null;
+  }
+}
+function persistentDeviceId() {
+  const cur = readPersistedDeviceId();
+  if (cur)
+    return cur;
+  const id = randomUUID29().slice(0, 8);
+  try {
+    const f = deviceIdFile();
+    const dir2 = dirname35(f);
+    if (!existsSync39(dir2))
+      mkdirSync41(dir2, { recursive: true });
+    writeFileSync40(f, JSON.stringify({ deviceId: id }));
+  } catch {
+  }
+  return id;
+}
+
 // ../../packages/host-core/dist/error-report.js
 init_dist2();
 init_credentials();
@@ -114318,6 +114359,19 @@ async function runDaemon(opts = {}) {
   const activityTracker = createActivityTracker({ log: log9 });
   let activityTimer = null;
   let creds3 = readCredentials();
+  try {
+    const ownId = persistentDeviceId();
+    const { migratedFrom } = adoptPersistentDeviceId(ownId, (m) => log9(m));
+    if (migratedFrom) {
+      try {
+        opts.onDeviceIdMigrated?.(migratedFrom, ownId);
+      } catch (e) {
+        log9("device id migration hook failed", e.message);
+      }
+    }
+  } catch (e) {
+    log9("device id reconcile skipped", e.message);
+  }
   let machine = null;
   const acquireIdentity = async () => {
     const signedIn = readCredentials();
@@ -114827,7 +114881,7 @@ async function runDaemon(opts = {}) {
       scheduleRefreshRetry("the api was unreachable");
     }
   }
-  setDaemonIdentityReload(async () => {
+  const reloadIdentity = async () => {
     const fresh = readCredentials();
     const next = nextDaemonIdentity(fresh, { accessToken, userId: c.userId });
     if (next.kind === "unchanged")
@@ -114837,7 +114891,6 @@ async function runDaemon(opts = {}) {
       c = fresh;
       accessToken = fresh.accessToken;
       log9(`signed in as ${fresh.userId} \u2014 re-homing the control link to the account`);
-      setControlLinkDeviceId(fresh.deviceId);
       refreshControlLink();
       return;
     }
@@ -114856,9 +114909,9 @@ async function runDaemon(opts = {}) {
     c = { ...c, accessToken: m.accessToken, refreshSecret: "", dtid: "", userId: "", deviceId: m.deviceId, publicId: m.publicId, expiresAt: m.expiresAt ?? c.expiresAt };
     accessToken = m.accessToken;
     log9("signed out \u2014 this machine speaks for itself again");
-    setControlLinkDeviceId(m.deviceId);
     refreshControlLink();
-  });
+  };
+  setDaemonIdentityReload(reloadIdentity);
   registerTesseractEngine({ getIceServers: () => fetchIceServers() });
   registerVncEngine();
   registerRdpEngine();
@@ -115270,6 +115323,18 @@ async function runDaemon(opts = {}) {
     deliverRdeskSignal: (payload, hostId, sessionId) => {
       getRdeskClientWebContents()?.send("rdesk:signal", { payload, hostId, sessionId });
     },
+    // The account removed this machine (Remove in My Computers on another device, CLI logout).
+    // Drop the account credentials and speak for the machine itself again — the same switch a
+    // sign-out makes. The host app's own hook additionally turns sharing off, so it does not
+    // simply provision a new token and come straight back.
+    onDeviceRevoked: () => {
+      log9("this machine was removed from the account \u2014 dropping its credentials; it speaks for itself again");
+      try {
+        unlinkSync7(join78(daemonDir2(), "credentials.json"));
+      } catch {
+      }
+      void reloadIdentity();
+    },
     // Universal clipboard sync: a copy (or fetch/chunk control frame) from another of the account's
     // devices → hand it to the daemon's clipboard-sync (created in onOwned).
     onClipboard: (entry, fromClientId) => daemonClipboardSync?.onRemote(entry, fromClientId),
@@ -116822,7 +116887,6 @@ init_safe_kill();
 
 // src/auth.ts
 var import_qrcode_terminal = __toESM(require_main(), 1);
-import { randomUUID as randomUUID31 } from "node:crypto";
 import { existsSync as existsSync48, rmSync as rmSync12 } from "node:fs";
 import { join as join86 } from "node:path";
 
@@ -116964,7 +117028,7 @@ async function login(opts) {
       process.exit(1);
     }
   }
-  const deviceId3 = readCredentials()?.deviceId ?? process.env.CCB_DEVICE_ID ?? randomUUID31().slice(0, 8);
+  const deviceId3 = readCredentials()?.deviceId ?? process.env.CCB_DEVICE_ID ?? persistentDeviceId();
   const label = opts.name ?? defaultLabel();
   if (opts.token) {
     const dt = await fetchJson(`${api}/auth/device-token`, {
@@ -117380,6 +117444,10 @@ async function netCommand(rest, flags) {
       return;
     }
     console.log("mesh engine:  ok");
+    if (s.running === false) {
+      console.log(`node:         NOT RUNNING \u2014 ${s.lastError ?? "no reason was recorded"}`);
+      return;
+    }
     console.log(`node:         running on UDP port ${s.port ?? "?"}`);
     console.log(`node:         LAN discovery ${s.lan ? "on" : "off (no multicast on this network)"}`);
     const established = s.established ?? [];