tesseract-agent 0.11.9 → 0.11.10

package/dist-bundle/cli.js

@@ -23829,12 +23829,12 @@ function buildCronTools(deps) {
     }),
     tool("Sleep", prompt("tool.cron.Sleep"), { seconds: external_exports.number().describe("Seconds to sleep (clamped to 0\u2013120)") }, async (args, extra) => {
       const s = Math.max(0, Math.min(120, Math.floor(args.seconds)));
-      const signal = extra?.signal;
+      const signal2 = extra?.signal;
       const interrupted = await new Promise((res) => {
-        if (signal?.aborted)
+        if (signal2?.aborted)
           return res(true);
         const id = setTimeout(() => res(false), s * 1e3);
-        signal?.addEventListener("abort", () => {
+        signal2?.addEventListener("abort", () => {
           clearTimeout(id);
           res(true);
         }, { once: true });
@@ -26047,8 +26047,8 @@ var init_cloud_agent = __esm({
 
 // ../../packages/shared/dist/engine-endpoint.js
 function joinPath(...parts) {
-  const sep11 = process.platform === "win32" ? "\\" : "/";
-  return parts.filter(Boolean).map((p, i) => i === 0 ? p.replace(/[\\/]+$/, "") : p.replace(/^[\\/]+|[\\/]+$/g, "")).join(sep11);
+  const sep12 = process.platform === "win32" ? "\\" : "/";
+  return parts.filter(Boolean).map((p, i) => i === 0 ? p.replace(/[\\/]+$/, "") : p.replace(/^[\\/]+|[\\/]+$/g, "")).join(sep12);
 }
 function toml(value) {
   return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
@@ -26246,6 +26246,12 @@ var init_enterprise_env = __esm({
 });
 
 // ../../packages/shared/dist/runtimes.js
+function runtimeUserPrefix(platform8) {
+  return platform8 === "win32" ? "$env:USERPROFILE\\.tesseract\\runtimes" : "$HOME/.tesseract/runtimes";
+}
+function runtimeUserBinDir(platform8) {
+  return platform8 === "win32" ? runtimeUserPrefix(platform8) : `${runtimeUserPrefix(platform8)}/bin`;
+}
 var RUNTIME_CATALOG, RUNTIME_IDS;
 var init_runtimes = __esm({
   "../../packages/shared/dist/runtimes.js"() {
@@ -26266,57 +26272,10 @@ var init_runtimes = __esm({
   }
 });
 
-// ../../packages/shared/dist/gateway-plan.js
-function providerBase(key2, which2) {
-  const fromServer = key2.endpoints?.[which2]?.trim();
-  if (fromServer)
-    return fromServer;
-  return which2 === "anthropic" ? gatewayAnthropicBaseUrl(key2.baseUrl) : which2 === "openai" ? gatewayOpenAiBaseUrl(key2.baseUrl) : gatewayGeminiBaseUrl(key2.baseUrl);
-}
-function tiers(engineId, key2, models) {
-  const claudeDefaults = engineId === "claude-code";
-  const served = new Set(Object.values(key2.models).filter((v) => typeof v === "string" && !!v));
-  const asked = (v) => {
-    const t = v?.trim();
-    if (!t)
-      return void 0;
-    if (t.includes("/"))
-      return t;
-    return served.has(t) ? t : void 0;
-  };
-  const main2 = asked(models.main) || (claudeDefaults ? key2.models.claude : void 0) || key2.models.high;
-  const fast = asked(models.fast) || (claudeDefaults ? key2.models.claudeFast : void 0) || key2.models.low;
-  return { main: main2, fast };
-}
-function planGatewayRun(engineId, key2, models, homeBase) {
-  const wire = gatewayWireFor(engineId);
-  if (!wire)
-    return void 0;
-  const { main: main2, fast } = tiers(engineId, key2, models);
-  const effort = ENGINE_CATALOG[engineId]?.modelControls.reasoningEfforts?.includes(models.reasoningEffort ?? "") ? models.reasoningEffort : void 0;
-  return planEndpointRun(wire.kind, {
-    baseUrl: wire.kind === "anthropic-env" ? providerBase(key2, "anthropic") : wire.kind === "gemini-env" ? providerBase(key2, "gemini") : providerBase(key2, "openai"),
-    apiKey: key2.apiKey,
-    main: main2,
-    fast,
-    ...effort ? { reasoningEffort: effort } : {},
-    label: "Tesseract Gateway",
-    // The gateway's OWN homes, unchanged: an upgrading install must not re-materialize
-    // under a new name and leave the old one behind.
-    homeKey: HOME_DIR_NAME[engineId]
-  }, homeBase);
-}
-var HOME_DIR_NAME;
-var init_gateway_plan = __esm({
-  "../../packages/shared/dist/gateway-plan.js"() {
+// ../../packages/shared/dist/component-compat.js
+var init_component_compat = __esm({
+  "../../packages/shared/dist/component-compat.js"() {
     "use strict";
-    init_runner_compat();
-    init_engine_endpoint();
-    init_engines();
-    HOME_DIR_NAME = {
-      opencode: "opencode-bundled",
-      "openai-codex": "gateway-openai-codex"
-    };
   }
 });
 
@@ -26350,8 +26309,8 @@ function pathSep(platform8) {
   return platform8 === "win32" ? "\\" : "/";
 }
 function joinPath2(platform8, ...parts) {
-  const sep11 = pathSep(platform8);
-  return parts.filter((p) => p !== "").map((p, i) => i === 0 ? p.replace(/[\\/]+$/, "") : p.replace(/^[\\/]+|[\\/]+$/g, "")).join(sep11);
+  const sep12 = pathSep(platform8);
+  return parts.filter((p) => p !== "").map((p, i) => i === 0 ? p.replace(/[\\/]+$/, "") : p.replace(/^[\\/]+|[\\/]+$/g, "")).join(sep12);
 }
 function dedupe(dirs) {
   const seen = /* @__PURE__ */ new Set();
@@ -26406,13 +26365,93 @@ function engineSearchDirs(opts) {
     "/snap/bin"
   ]);
 }
-var EMPTY_ENGINE_PATH_STORE, VIA_VALUES;
+var EMPTY_ENGINE_PATH_STORE, VIA_VALUES, ENGINE_EXTRA_DIRS;
 var init_engine_paths = __esm({
   "../../packages/shared/dist/engine-paths.js"() {
     "use strict";
     init_engines();
     EMPTY_ENGINE_PATH_STORE = { version: 1, entries: {} };
     VIA_VALUES = ["user", "env", "path", "well-known", "install"];
+    ENGINE_EXTRA_DIRS = {
+      // Mirrors agent-core's findUserInstalledClaude — Claude's installer puts it here.
+      "claude-code": ["~/.claude/local"],
+      "openai-codex": ["~/.codex/bin"],
+      opencode: ["~/.opencode/bin"],
+      "gemini-cli": ["~/.gemini/bin"]
+    };
+  }
+});
+
+// ../../packages/shared/dist/runtime-probe.js
+var PROBE_PATH_PREFIX;
+var init_runtime_probe = __esm({
+  "../../packages/shared/dist/runtime-probe.js"() {
+    "use strict";
+    init_engine_paths();
+    init_runtimes();
+    PROBE_PATH_PREFIX = [
+      // FIRST, deliberately: this is where we install, and a machine with an old system-wide copy
+      // must resolve OURS. That is the whole reason a user-path install can fix a root-owned one
+      // we are not allowed to touch.
+      runtimeUserBinDir("linux"),
+      ...engineSearchDirs({ home: "$HOME", platform: "linux" }),
+      ...engineSearchDirs({ home: "$HOME", platform: "darwin" }),
+      ...Object.values(ENGINE_EXTRA_DIRS).flat().map((d) => d.replace(/^~/, "$HOME"))
+    ].filter((d, i, a) => a.indexOf(d) === i).join(":");
+  }
+});
+
+// ../../packages/shared/dist/gateway-plan.js
+function providerBase(key2, which2) {
+  const fromServer = key2.endpoints?.[which2]?.trim();
+  if (fromServer)
+    return fromServer;
+  return which2 === "anthropic" ? gatewayAnthropicBaseUrl(key2.baseUrl) : which2 === "openai" ? gatewayOpenAiBaseUrl(key2.baseUrl) : gatewayGeminiBaseUrl(key2.baseUrl);
+}
+function tiers(engineId, key2, models) {
+  const claudeDefaults = engineId === "claude-code";
+  const served = new Set(Object.values(key2.models).filter((v) => typeof v === "string" && !!v));
+  const asked = (v) => {
+    const t = v?.trim();
+    if (!t)
+      return void 0;
+    if (t.includes("/"))
+      return t;
+    return served.has(t) ? t : void 0;
+  };
+  const main2 = asked(models.main) || (claudeDefaults ? key2.models.claude : void 0) || key2.models.high;
+  const fast = asked(models.fast) || (claudeDefaults ? key2.models.claudeFast : void 0) || key2.models.low;
+  return { main: main2, fast };
+}
+function planGatewayRun(engineId, key2, models, homeBase) {
+  const wire = gatewayWireFor(engineId);
+  if (!wire)
+    return void 0;
+  const { main: main2, fast } = tiers(engineId, key2, models);
+  const effort = ENGINE_CATALOG[engineId]?.modelControls.reasoningEfforts?.includes(models.reasoningEffort ?? "") ? models.reasoningEffort : void 0;
+  return planEndpointRun(wire.kind, {
+    baseUrl: wire.kind === "anthropic-env" ? providerBase(key2, "anthropic") : wire.kind === "gemini-env" ? providerBase(key2, "gemini") : providerBase(key2, "openai"),
+    apiKey: key2.apiKey,
+    main: main2,
+    fast,
+    ...effort ? { reasoningEffort: effort } : {},
+    label: "Tesseract Gateway",
+    // The gateway's OWN homes, unchanged: an upgrading install must not re-materialize
+    // under a new name and leave the old one behind.
+    homeKey: HOME_DIR_NAME[engineId]
+  }, homeBase);
+}
+var HOME_DIR_NAME;
+var init_gateway_plan = __esm({
+  "../../packages/shared/dist/gateway-plan.js"() {
+    "use strict";
+    init_runner_compat();
+    init_engine_endpoint();
+    init_engines();
+    HOME_DIR_NAME = {
+      opencode: "opencode-bundled",
+      "openai-codex": "gateway-openai-codex"
+    };
   }
 });
 
@@ -27709,6 +27748,8 @@ var init_dist2 = __esm({
     init_enterprise_env();
     init_providers();
     init_runtimes();
+    init_component_compat();
+    init_runtime_probe();
     init_runner_configs();
     init_runner_compat();
     init_gateway_plan();
@@ -33583,10 +33624,10 @@ var init_client = __esm({
         const creds3 = await this.creds().catch(() => void 0);
         const remaining = Math.max(1, deadline - Date.now());
         const timeout = AbortSignal.timeout(remaining);
-        const signal = opts.signal ? AbortSignal.any([opts.signal, timeout]) : timeout;
+        const signal2 = opts.signal ? AbortSignal.any([opts.signal, timeout]) : timeout;
         return this.fetchImpl(url2, {
           headers: { accept: "application/json", ...creds3?.baseUrl ? creds3.headers ?? {} : {} },
-          signal
+          signal: signal2
         });
       }
       /**
@@ -35442,7 +35483,7 @@ function scheduleUnattendedAnswer(prompt2, deps) {
       ...extra
     });
   };
-  const timer2 = setTimeout(() => {
+  const timer2 = setTimeout(async () => {
     const mode = deps.mode();
     if (mode === "off") {
       record2("off", "skipped", { reason: "unattended switched off before the answer landed" });
@@ -35457,7 +35498,7 @@ function scheduleUnattendedAnswer(prompt2, deps) {
       return;
     }
     const cappedOut = spent > UNATTENDED_MAX_DECISIONS;
-    const answer = unattendedAnswer(mode, prompt2, { capped: cappedOut });
+    let answer = unattendedAnswer(mode, prompt2, { capped: cappedOut });
     if (!answer) {
       try {
         deps.refund();
@@ -35466,6 +35507,23 @@ function scheduleUnattendedAnswer(prompt2, deps) {
       record2(mode, "skipped", { reason: "no policy answer for this prompt kind", spent });
       return;
     }
+    if (deps.prepare && !cappedOut) {
+      try {
+        const better = await deps.prepare();
+        if (better)
+          answer = { ...answer, ...better };
+      } catch (err2) {
+        deps.log?.("unattended: preparing a better answer failed \u2014 the policy answer stands", err2);
+      }
+      if (deps.mode() === "off") {
+        try {
+          deps.refund();
+        } catch {
+        }
+        record2("off", "skipped", { reason: "unattended switched off before the answer landed", spent });
+        return;
+      }
+    }
     let applied = false;
     try {
       applied = deps.apply(answer);
@@ -37402,6 +37460,42 @@ var init_session_mirror = __esm({
   }
 });
 
+// ../../packages/agent-core/dist/prompt-withdrawal.js
+var PROMPT_WITHDRAWN_NOTE, PROMPT_WITHDRAWN_DECISION;
+var init_prompt_withdrawal = __esm({
+  "../../packages/agent-core/dist/prompt-withdrawal.js"() {
+    "use strict";
+    PROMPT_WITHDRAWN_NOTE = "The user replied in the chat instead of answering this prompt, so it was withdrawn. Their message follows \u2014 take it into account and continue from it.";
+    PROMPT_WITHDRAWN_DECISION = "Withdrawn \u2014 you replied in the chat instead, so your message went to the agent.";
+  }
+});
+
+// ../../packages/agent-core/dist/question-recommendation.js
+function pickRecommendedAnswers(questions, recommendations) {
+  if (!questions.length)
+    return null;
+  const answers = {};
+  const said = [];
+  for (const [qi, q] of questions.entries()) {
+    const labels = new Set((q.options ?? []).map((o) => o.label));
+    const usable = recommendations.filter((r) => r.questionIndex === qi && labels.has(r.optionLabel) && RANK[r.level] < 9).sort((a, b) => RANK[a.level] - RANK[b.level]);
+    if (!usable.length)
+      return null;
+    const chosen = q.multiSelect ? usable.filter((r, i) => i === 0 || RANK[r.level] <= RANK.recommended) : [usable[0]];
+    const picked = [...new Set(chosen.map((r) => r.optionLabel))];
+    answers[q.question] = picked.join(",");
+    said.push(`"${picked.join('" + "')}" for "${q.question.length > 60 ? `${q.question.slice(0, 57)}\u2026` : q.question}"`);
+  }
+  return { answers, decision: `Chose the recommended answer${questions.length > 1 ? "s" : ""}: ${said.join("; ")}` };
+}
+var RANK;
+var init_question_recommendation = __esm({
+  "../../packages/agent-core/dist/question-recommendation.js"() {
+    "use strict";
+    RANK = { highly_recommended: 0, recommended: 1, neutral: 2, caution: 9, discouraged: 9 };
+  }
+});
+
 // ../../packages/agent-core/dist/trace-store.js
 import { promises as fs } from "node:fs";
 import path from "node:path";
@@ -38195,7 +38289,7 @@ var init_session_usage = __esm({
 
 // ../../packages/agent-core/dist/kill-tree.js
 import { spawn } from "node:child_process";
-function killProcessTree(child, signal = "SIGKILL") {
+function killProcessTree(child, signal2 = "SIGKILL") {
   if (!child || typeof child.pid !== "number" || child.pid <= 0 || child.exitCode !== null)
     return;
   const pid = child.pid;
@@ -38207,10 +38301,10 @@ function killProcessTree(child, signal = "SIGKILL") {
     return;
   }
   try {
-    process.kill(-pid, signal);
+    process.kill(-pid, signal2);
   } catch {
     try {
-      child.kill(signal);
+      child.kill(signal2);
     } catch {
     }
   }
@@ -38353,13 +38447,13 @@ function assistantUsageLimitFallback(content) {
   const text12 = blocks.map((block2) => typeof block2.text === "string" ? block2.text : "").join("\n").trim();
   if (!text12 || text12.length > 600)
     return void 0;
-  const signal = classifyUsageMessage(text12);
-  if (signal !== "limit" && signal !== "org-policy")
+  const signal2 = classifyUsageMessage(text12);
+  if (signal2 !== "limit" && signal2 !== "org-policy")
     return void 0;
   const isoReset = text12.match(/\b\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z\b/i)?.[0];
   const resetMatch = text12.match(/(?:reset|resets|available again)(?:s| at| on| in)?\s+([^\n]+)/i);
   const parsed = Date.parse(isoReset ?? resetMatch?.[1].trim() ?? "");
-  return { retryAt: Number.isFinite(parsed) ? parsed : void 0, signal };
+  return { retryAt: Number.isFinite(parsed) ? parsed : void 0, signal: signal2 };
 }
 function usageLimitErrorMessage(rejection) {
   if (rejection.signal === "org-policy") {
@@ -39313,7 +39407,7 @@ ${next}` : next;
 function autoDecisionSubject(prompt2) {
   return prompt2.kind === "permission" ? prompt2.tool : void 0;
 }
-var browserExtensionConnected, TURN_OPENING_GRACE_MS, STRIP_SETTLE_MS, INFLIGHT_RESUME_DELAY_MS, REDISPATCH_DIRECTIVE, cachedClaudeExe, unsupportedCliOptions, rejectedCliArgs, CAPS_VERSION, capsLoaded, EFFORT_LADDER, cachedEfforts, modelEffortLevels, sharedSessionStore, monoNowMs, sessionCwdCache, cachedNodeExe, HUMAN_READABLE_FIELDS, SYSTEM_EVENT_CATEGORY, TOOL_RESULT_CAP, MAX_RESULT_IMAGES, MAX_IMAGE_BASE64, PERMISSION_MODES, EDIT_PREVIEW_CAP, AsyncMessagePump, IDLE_REAP_MS, EFFORT_SWAP_DEBOUNCE_MS, MODERATE_IDLE_MS, STEER_COALESCE_MS, AUTO_BACKGROUND_SECONDS, TASK_REGISTER_SECONDS, JOB_NOTICE_COALESCE_MS, JOB_NOTICE_WORK_ID, QUIESCENCE_MAX_MS, MODEL_FALLBACK_MAX_HOPS, MODEL_FALLBACK_RESUME_MESSAGE, QUIESCENCE_POLL_MS, BATCH_WAIT_MS, INLINE_TOOL_NAMES, STOP_HARD_KILL_AFTER_MS, STREAM_STALL_MS, STREAM_FIRST_FRAME_MS, OVERFLOW_SILENCE_MS, RV_TASK_MAX, OPTION_RATING_JSON_SCHEMA, AgentManager;
+var browserExtensionConnected, TURN_OPENING_GRACE_MS, RECOMMEND_ANSWER_TIMEOUT_MS, STRIP_SETTLE_MS, INFLIGHT_RESUME_DELAY_MS, REDISPATCH_DIRECTIVE, cachedClaudeExe, unsupportedCliOptions, rejectedCliArgs, CAPS_VERSION, capsLoaded, EFFORT_LADDER, cachedEfforts, modelEffortLevels, sharedSessionStore, monoNowMs, sessionCwdCache, cachedNodeExe, HUMAN_READABLE_FIELDS, SYSTEM_EVENT_CATEGORY, TOOL_RESULT_CAP, MAX_RESULT_IMAGES, MAX_IMAGE_BASE64, PERMISSION_MODES, EDIT_PREVIEW_CAP, AsyncMessagePump, IDLE_REAP_MS, EFFORT_SWAP_DEBOUNCE_MS, MODERATE_IDLE_MS, STEER_COALESCE_MS, AUTO_BACKGROUND_SECONDS, TASK_REGISTER_SECONDS, JOB_NOTICE_COALESCE_MS, JOB_NOTICE_WORK_ID, QUIESCENCE_MAX_MS, MODEL_FALLBACK_MAX_HOPS, MODEL_FALLBACK_RESUME_MESSAGE, QUIESCENCE_POLL_MS, BATCH_WAIT_MS, INLINE_TOOL_NAMES, STOP_HARD_KILL_AFTER_MS, STREAM_STALL_MS, STREAM_FIRST_FRAME_MS, OVERFLOW_SILENCE_MS, RV_TASK_MAX, OPTION_RATING_JSON_SCHEMA, AgentManager;
 var init_agent_manager = __esm({
   "../../packages/agent-core/dist/agent-manager.js"() {
     "use strict";
@@ -39368,6 +39462,8 @@ var init_agent_manager = __esm({
     init_session_edit();
     init_session_transfer();
     init_session_mirror();
+    init_prompt_withdrawal();
+    init_question_recommendation();
     init_trace_store();
     init_cost_ledger();
     init_session_store();
@@ -39379,6 +39475,7 @@ var init_agent_manager = __esm({
     init_usage_limit();
     browserExtensionConnected = () => false;
     TURN_OPENING_GRACE_MS = 5 * 6e4;
+    RECOMMEND_ANSWER_TIMEOUT_MS = 25e3;
     STRIP_SETTLE_MS = 750;
     INFLIGHT_RESUME_DELAY_MS = 8e3;
     REDISPATCH_DIRECTIVE = "This message is being re-sent because the app restarted while you were working on it. If the same request already appears above, do not start over \u2014 continue from where you left off, keeping what was already done.";
@@ -40657,6 +40754,64 @@ ${full.slice(-8e3)}`;
        *  No-op if the request is unknown (already resolved / aborted). On "allow &
        *  don't ask again" (persist) we hand the SDK its own suggested permission
        *  updates so the same call won't prompt again this session. */
+      /**
+       * Withdraw every prompt parked on THIS session — the user answered in the chat instead.
+       *
+       * Each is answered the way "no" is answered for its kind (deny / decline / cancel), with
+       * PROMPT_WITHDRAWN_NOTE where a note can travel, and announced to the client as an
+       * agent:auto_decision so the card it drew resolves. WITHOUT interrupt: a denial returns
+       * control to the model mid-turn, and the user's message (steered in right after) is the
+       * next thing it reads — so it continues from the message rather than starting over.
+       * Matched by session object, not id: a prompt can be parked before the id is resolved.
+       */
+      withdrawParkedPrompts(live) {
+        let n = 0;
+        const announce = (requestId, promptKind, behavior, subject) => {
+          const evt = {
+            type: "agent:auto_decision",
+            sessionId: live.sessionId,
+            requestId,
+            promptKind,
+            ...subject ? { subject } : {},
+            decision: PROMPT_WITHDRAWN_DECISION,
+            behavior
+          };
+          if (live.clientRequestId)
+            this.send({ ...evt, clientRequestId: live.clientRequestId }, live.origin);
+          else
+            this.send(evt, live.origin);
+        };
+        for (const [id, e] of [...this.pendingPermissions]) {
+          if (e.live !== live)
+            continue;
+          const kind = e.tool === "ExitPlanMode" ? "plan" : e.tool === "AskUserQuestion" ? "question" : "permission";
+          this.respondToPermission(id, { behavior: "deny", message: PROMPT_WITHDRAWN_NOTE });
+          announce(id, kind, "deny", kind === "permission" ? e.tool : void 0);
+          n++;
+        }
+        for (const [id, e] of [...this.pendingElicitations]) {
+          if (e.live !== live)
+            continue;
+          this.respondToElicitation(id, { action: "decline" });
+          announce(id, "elicitation", "decline");
+          n++;
+        }
+        for (const [id, e] of [...this.pendingUserDialogs]) {
+          if (e.live !== live)
+            continue;
+          this.respondToUserDialog(id, { behavior: "cancelled" });
+          announce(id, "dialog", "cancel");
+          n++;
+        }
+        for (const [id, e] of [...this.pendingUiRequests]) {
+          if (!live.sessionId || e.sessionId !== live.sessionId)
+            continue;
+          this.respondToUiRequest(id, { cancelled: true });
+          announce(id, "skill_ui", "cancel");
+          n++;
+        }
+        return n;
+      }
       respondToPermission(requestId, decision, callerOrigin) {
         const entry = this.pendingPermissions.get(requestId);
         if (!entry)
@@ -40968,7 +41123,7 @@ ${full.slice(-8e3)}`;
        *  The per-turn budget is spent here rather than in the policy so that BLOWING it is
        *  still an answer: a capped prompt is declined with an explanation, never abandoned.
        *  Abandoning it is a hang — the precise failure this whole path exists to prevent. */
-      autoAnswerPrompt(live, requestId, prompt2, apply2) {
+      autoAnswerPrompt(live, requestId, prompt2, apply2, prepare) {
         scheduleUnattendedAnswer(prompt2, {
           context: { sessionId: live.sessionId, engine: "claude-code" },
           mode: () => live.unattended ?? "off",
@@ -40981,6 +41136,7 @@ ${full.slice(-8e3)}`;
           // the parked promise themselves, so `apply` reports that there is nothing left to
           // answer and we stay silent rather than logging a phantom decision.
           apply: apply2,
+          ...prepare ? { prepare } : {},
           report: (answer, cappedOut) => {
             const subject = autoDecisionSubject(prompt2);
             const evt = {
@@ -41011,7 +41167,7 @@ ${full.slice(-8e3)}`;
        *  than canUseTool because hooks fire in EVERY permission mode — bypassPermissions
        *  (the app default) shadows canUseTool but never hooks. Mirrors canUseTool's
        *  abort/cleanup handling so an interrupted turn never leaks a parked card. */
-      raiseQuestion(live, input, toolUseId, signal, agentId) {
+      raiseQuestion(live, input, toolUseId, signal2, agentId) {
         return new Promise((resolve16) => {
           const requestId = randomUUID4();
           let holding = false;
@@ -41029,17 +41185,18 @@ ${full.slice(-8e3)}`;
           };
           const cleanup2 = () => {
             unpark();
-            signal.removeEventListener("abort", onAbort);
+            signal2.removeEventListener("abort", onAbort);
           };
-          if (signal.aborted) {
+          if (signal2.aborted) {
             resolve16({ behavior: "deny", message: "Interrupted.", interrupt: true });
             return;
           }
-          signal.addEventListener("abort", onAbort, { once: true });
+          signal2.addEventListener("abort", onAbort, { once: true });
           holding = true;
           live.parked = (live.parked ?? 0) + 1;
-          this.pendingPermissions.set(requestId, { resolve: resolve16, cleanup: cleanup2, origin: live.origin });
+          this.pendingPermissions.set(requestId, { resolve: resolve16, cleanup: cleanup2, origin: live.origin, live, tool: "AskUserQuestion" });
           const willEvaluate = !!this.cheapLlm && Array.isArray(input.questions) && input.questions.length > 0;
+          const recommendAsAnswer = willEvaluate && live.unattended === "auto";
           const evt = {
             type: "agent:permission_request",
             sessionId: live.sessionId,
@@ -41054,14 +41211,26 @@ ${full.slice(-8e3)}`;
             this.send({ ...evt, clientRequestId: live.clientRequestId }, live.origin);
           else
             this.send(evt, live.origin);
-          if (willEvaluate)
+          if (willEvaluate && !recommendAsAnswer)
             void this.evaluateOptions(live, requestId, input);
           this.autoAnswerPrompt(live, requestId, { kind: "question", tool: "AskUserQuestion" }, (a) => {
             if (!this.pendingPermissions.has(requestId))
               return false;
-            this.respondToPermission(requestId, { behavior: "deny", message: a.message });
+            this.respondToPermission(requestId, a.behavior === "allow" ? { behavior: "allow", ...a.updatedInput ? { updatedInput: a.updatedInput } : {} } : { behavior: "deny", message: a.message });
             return true;
-          });
+          }, recommendAsAnswer ? async () => {
+            const questions = input.questions;
+            const recs = await Promise.race([
+              this.evaluateOptions(live, requestId, input),
+              new Promise((r) => setTimeout(() => r([]), RECOMMEND_ANSWER_TIMEOUT_MS))
+            ]);
+            const pick3 = pickRecommendedAnswers(questions, recs);
+            if (!pick3) {
+              log(`unattended: no usable recommendation for the question \u2014 handing it back to the agent`);
+              return null;
+            }
+            return { behavior: "allow", updatedInput: { answers: pick3.answers }, message: void 0, decision: pick3.decision };
+          } : void 0);
         });
       }
       /** Compile a compact context summary for the option-recommendation LLM: the project,
@@ -41087,10 +41256,10 @@ ${text12.slice(0, 1600)}`);
       async evaluateOptions(live, requestId, input) {
         const llm = this.cheapLlm;
         if (!llm)
-          return;
+          return [];
         const questions = Array.isArray(input.questions) ? input.questions : [];
         if (!questions.length)
-          return;
+          return [];
         try {
           const qText = questions.map((q, qi) => {
             const opts = Array.isArray(q.options) ? q.options : [];
@@ -41106,19 +41275,21 @@ ${lines}`;
           });
           const out = await llm({ system, prompt: userPrompt, maxTokens: 1400, schema: OPTION_RATING_JSON_SCHEMA });
           if (!out)
-            return;
+            return [];
           const parsed = parseModelJson(out) ?? {};
           const LEVELS = /* @__PURE__ */ new Set(["highly_recommended", "recommended", "neutral", "caution", "discouraged"]);
           const clean2 = (Array.isArray(parsed.recommendations) ? parsed.recommendations : []).map((r) => r).filter((r) => r && typeof r.optionLabel === "string" && typeof r.questionIndex === "number" && typeof r.level === "string" && LEVELS.has(r.level)).map((r) => ({ questionIndex: r.questionIndex, optionLabel: r.optionLabel, level: r.level, reason: typeof r.reason === "string" ? r.reason.slice(0, 140) : "" }));
           if (!clean2.length || !this.pendingPermissions.has(requestId))
-            return;
+            return clean2;
           const evt = { type: "agent:option_recommendations", sessionId: live.sessionId, requestId, recommendations: clean2 };
           if (live.clientRequestId)
             this.send({ ...evt, clientRequestId: live.clientRequestId }, live.origin);
           else
             this.send(evt, live.origin);
+          return clean2;
         } catch (err2) {
           log("option recommendation eval failed:", err2 instanceof Error ? err2.message : String(err2));
+          return [];
         }
       }
       /** request_user_dialog: park a promise, raise the dialog card
@@ -41126,7 +41297,7 @@ ${lines}`;
        *  reply (→ respondToUserDialog). Mirrors onElicitation: the CLI parks the flow until
        *  we answer; an unanswered/aborted dialog resolves 'cancelled' so the CLI applies the
        *  dialog's default behavior (e.g. the classic refusal message) rather than hanging. */
-      raiseUserDialog(live, request2, signal) {
+      raiseUserDialog(live, request2, signal2) {
         return new Promise((resolve16) => {
           const requestId = randomUUID4();
           log("user_dialog raised:", request2.dialogKind, "requestId=" + requestId, "payloadKeys=" + Object.keys(request2.payload ?? {}).join(","));
@@ -41136,14 +41307,14 @@ ${lines}`;
               resolve16({ behavior: "cancelled" });
             }
           };
-          const cleanup2 = () => signal.removeEventListener("abort", onAbort);
-          if (signal.aborted) {
+          const cleanup2 = () => signal2.removeEventListener("abort", onAbort);
+          if (signal2.aborted) {
             log("user_dialog pre-aborted (cancelled):", request2.dialogKind);
             resolve16({ behavior: "cancelled" });
             return;
           }
-          signal.addEventListener("abort", onAbort, { once: true });
-          this.pendingUserDialogs.set(requestId, { resolve: resolve16, cleanup: cleanup2, origin: live.origin });
+          signal2.addEventListener("abort", onAbort, { once: true });
+          this.pendingUserDialogs.set(requestId, { resolve: resolve16, cleanup: cleanup2, origin: live.origin, live });
           const evt = {
             type: "agent:user_dialog_request",
             sessionId: live.sessionId,
@@ -42054,6 +42225,11 @@ ${prompt("agent.system.long-running")}`;
           }
         }
         if (live && live.streaming) {
+          if (!params.autoContinuation && !params.rvInjected) {
+            const withdrawn = this.withdrawParkedPrompts(live);
+            if (withdrawn)
+              log(`[prompt] ${live.sessionId || "(pending)"}: ${withdrawn} parked prompt(s) withdrawn \u2014 the user replied in the chat`);
+          }
           const sameOrigin = (params.origin ?? void 0) === (live.origin ?? void 0);
           if (sameOrigin) {
             live.lastActivity = Date.now();
@@ -42805,7 +42981,7 @@ ${prompt("agent.system.long-running")}`;
               opts.signal.addEventListener("abort", onAbort, { once: true });
               holding = true;
               live.parked = (live.parked ?? 0) + 1;
-              this.pendingPermissions.set(requestId, { resolve: resolve16, suggestions: opts.suggestions, cleanup: cleanup2, origin: live.origin });
+              this.pendingPermissions.set(requestId, { resolve: resolve16, suggestions: opts.suggestions, cleanup: cleanup2, origin: live.origin, live, tool: toolName });
               const evt = {
                 type: "agent:permission_request",
                 sessionId: live.sessionId,
@@ -42850,7 +43026,7 @@ ${prompt("agent.system.long-running")}`;
                 return;
               }
               opts.signal.addEventListener("abort", onAbort, { once: true });
-              this.pendingElicitations.set(requestId, { resolve: resolve16, cleanup: cleanup2, origin: live.origin });
+              this.pendingElicitations.set(requestId, { resolve: resolve16, cleanup: cleanup2, origin: live.origin, live });
               const evt = {
                 type: "agent:elicitation_request",
                 sessionId: live.sessionId,
@@ -43139,6 +43315,7 @@ ${prompt("agent.system.long-running")}`;
                 if (errSeen >= 8e3)
                   log("[engine stderr] \u2026 further output suppressed for this turn");
               });
+              child.once("exit", (code, signal2) => log(`[engine exit] ${live.sessionId || "(pending)"} pid=${child.pid} code=${code} signal=${signal2}`));
               live.child = child;
               return child;
             },
@@ -44108,9 +44285,10 @@ ${unattendedReportDirective(params)}` : ""), live.sessionId) },
             reportUsageLimit(live.usageLimitRejection, sid);
             log("Claude subscription usage limit rejected the turn:", sid);
           } else if (live.interrupted || live.abort.signal.aborted) {
+            const byUser = live.interrupted;
             live.interrupted = false;
             this.clearStopWatchdog(live);
-            log("Session interrupted by user (caught from iterator):", sid);
+            log(`Session interrupted (caught from iterator): ${sid} \u2014 ${byUser ? "user stop" : "abort signal"}; engine said: ${err2 instanceof Error ? err2.message : String(err2)}`);
             emit2({ type: "chat:error", sessionId: sid, error: "Interrupted." });
             emit2({ type: "agent:status", sessionId: sid, status: "idle" });
           } else if (live.resultErrorReported) {
@@ -44555,7 +44733,7 @@ ${err2.stack}` : ""}` : String(err2);
        * `capMs` is a seam for the tests: the real cap is a minute, and a test that had to sleep
        * through it would either be a minute long or would assert a timeout instead of the report.
        */
-      async waitForBatchWork(live, signal, capMs = BATCH_WAIT_MS) {
+      async waitForBatchWork(live, signal2, capMs = BATCH_WAIT_MS) {
         const started2 = Date.now();
         this.refreshLedgerLiveness(live, started2);
         live.ledger.sweep(started2);
@@ -44572,7 +44750,7 @@ ${err2.stack}` : ""}` : String(err2);
         const turn = live.turnSeq;
         log(`[work] batch barrier: waiting for ${watched.length} item(s) on ${live.sessionId}`);
         while (Date.now() - started2 < capMs) {
-          if (signal?.aborted || live.turnSeq !== turn) {
+          if (signal2?.aborted || live.turnSeq !== turn) {
             log("[work] batch barrier abandoned \u2014 the turn it belonged to is gone");
             return void 0;
           }
@@ -45534,6 +45712,8 @@ __export(dist_exports2, {
   PRESENT_TOOL_NAMES: () => PRESENT_TOOL_NAMES,
   PRESENT_TOOL_SPECS: () => PRESENT_TOOL_SPECS,
   PROACTIVE_REGROWTH_POINTS: () => PROACTIVE_REGROWTH_POINTS,
+  PROMPT_WITHDRAWN_DECISION: () => PROMPT_WITHDRAWN_DECISION,
+  PROMPT_WITHDRAWN_NOTE: () => PROMPT_WITHDRAWN_NOTE,
   SLIM_KEEP_RECENT_TURNS: () => SLIM_KEEP_RECENT_TURNS,
   SessionStore: () => SessionStore,
   TOKENS_CSS_FILE: () => TOKENS_CSS_FILE,
@@ -45591,6 +45771,7 @@ __export(dist_exports2, {
   normalizeTokens: () => normalizeTokens,
   offloadDirFor: () => offloadDirFor,
   parseColorToRgb: () => parseColorToRgb,
+  pickRecommendedAnswers: () => pickRecommendedAnswers,
   readSessionArtifacts: () => readSessionArtifacts,
   readSessionRowsForDisplay: () => readSessionRowsForDisplay,
   readUnattendedDecisions: () => readUnattendedDecisions,
@@ -45648,6 +45829,8 @@ var init_dist5 = __esm({
     init_context_recovery();
     init_session_transfer();
     init_log();
+    init_prompt_withdrawal();
+    init_question_recommendation();
     init_session_mirror();
     init_history_slim();
     init_history_filter();
@@ -45819,7 +46002,7 @@ var init_reaper_binary = __esm({
 function hasLivePid(child) {
   return !!child && typeof child.pid === "number" && Number.isFinite(child.pid) && child.pid > 0;
 }
-function killChild(child, signal = "SIGTERM", label = "child", log10 = (m) => console.warn(m)) {
+function killChild(child, signal2 = "SIGTERM", label = "child", log10 = (m) => console.warn(m)) {
   if (!hasLivePid(child)) {
     try {
       log10(`[safe-kill] refused to signal ${label}: no live pid (pid=${String(child?.pid)}) \u2014 kill() on a handle without a pid becomes kill(0), which signals our OWN process group`);
@@ -45828,7 +46011,7 @@ function killChild(child, signal = "SIGTERM", label = "child", log10 = (m) => co
     return false;
   }
   try {
-    child.kill(signal);
+    child.kill(signal2);
     return true;
   } catch {
     return false;
@@ -46693,17 +46876,17 @@ import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync as existsSync11, readFileSync as readFileSync18 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
 function augmentedPath() {
-  const sep11 = process.platform === "win32" ? ";" : ":";
+  const sep12 = process.platform === "win32" ? ";" : ":";
   const extra = engineSearchDirs({ home: homedir4(), platform: process.platform, env: process.env });
   const seen = /* @__PURE__ */ new Set();
   const parts = [];
-  for (const p of [...(process.env.PATH ?? "").split(sep11), ...extra]) {
+  for (const p of [...(process.env.PATH ?? "").split(sep12), ...extra]) {
     if (p && !seen.has(p)) {
       seen.add(p);
       parts.push(p);
     }
   }
-  return parts.join(sep11);
+  return parts.join(sep12);
 }
 function rememberedPath(engineId) {
   try {
@@ -76440,10 +76623,10 @@ var init_codec = __esm({
         if (items.length > max)
           fail("too-long", `vec ${items.length} > ${max}`);
         for (let i = 1; i < items.length; i++) {
-          const cmp = compareUtf8(items[i - 1], items[i]);
-          if (cmp === 0)
+          const cmp2 = compareUtf8(items[i - 1], items[i]);
+          if (cmp2 === 0)
             fail("duplicate", items[i]);
-          if (cmp > 0)
+          if (cmp2 > 0)
             fail("not-sorted", `${items[i - 1]} > ${items[i]}`);
         }
         this.u16(items.length);
@@ -76542,10 +76725,10 @@ var init_codec = __esm({
         for (let i = 0; i < n; i++) {
           const s = this.str();
           if (i > 0) {
-            const cmp = compareUtf8(out[i - 1], s);
-            if (cmp === 0)
+            const cmp2 = compareUtf8(out[i - 1], s);
+            if (cmp2 === 0)
               fail("duplicate", s);
-            if (cmp > 0)
+            if (cmp2 > 0)
               fail("not-sorted", `${out[i - 1]} > ${s}`);
           }
           out.push(s);
@@ -76646,10 +76829,10 @@ function writePrefixes(w, items) {
   if (items.length > LIMITS.VEC)
     throw new MeshCodecError("too-long", `routes ${items.length}`);
   for (let i = 1; i < items.length; i++) {
-    const cmp = comparePrefix(items[i - 1], items[i]);
-    if (cmp === 0)
+    const cmp2 = comparePrefix(items[i - 1], items[i]);
+    if (cmp2 === 0)
       throw new MeshCodecError("duplicate", "route");
-    if (cmp > 0)
+    if (cmp2 > 0)
       throw new MeshCodecError("not-sorted", "route");
   }
   w.u16(items.length);
@@ -76664,10 +76847,10 @@ function readPrefixes(r) {
   for (let i = 0; i < n; i++) {
     const p = readPrefix(r);
     if (i > 0) {
-      const cmp = comparePrefix(out[i - 1], p);
-      if (cmp === 0)
+      const cmp2 = comparePrefix(out[i - 1], p);
+      if (cmp2 === 0)
         throw new MeshCodecError("duplicate", "route");
-      if (cmp > 0)
+      if (cmp2 > 0)
         throw new MeshCodecError("not-sorted", "route");
     }
     out.push(p);
@@ -80538,7 +80721,7 @@ function alphabet(letters) {
   };
 }
 // @__NO_SIDE_EFFECTS__
-function join69(separator = "") {
+function join70(separator = "") {
   astr("join", separator);
   return {
     encode: (from) => {
@@ -80743,7 +80926,7 @@ var init_esm = __esm({
       convertRadix2,
       radix,
       radix2,
-      join: join69,
+      join: join70,
       padding
     };
   }
@@ -82289,8 +82472,8 @@ var mesh_ca_exports = {};
 __export(mesh_ca_exports, {
   netCaCommand: () => netCaCommand
 });
-import { chmodSync as chmodSync8, existsSync as existsSync54, mkdirSync as mkdirSync49, readFileSync as readFileSync58, writeFileSync as writeFileSync49 } from "node:fs";
-import { join as join93, resolve as resolve13 } from "node:path";
+import { chmodSync as chmodSync8, existsSync as existsSync55, mkdirSync as mkdirSync49, readFileSync as readFileSync61, writeFileSync as writeFileSync49 } from "node:fs";
+import { join as join94, resolve as resolve13 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 function die(msg) {
   console.error(msg);
@@ -82335,14 +82518,14 @@ function ensureDir(p) {
   }
 }
 async function openCa(dir2) {
-  const gPath = join93(dir2, "genesis.bin");
-  const sPath = join93(dir2, "ca.sealed");
-  if (!existsSync54(gPath) || !existsSync54(sPath)) {
+  const gPath = join94(dir2, "genesis.bin");
+  const sPath = join94(dir2, "ca.sealed");
+  if (!existsSync55(gPath) || !existsSync55(sPath)) {
     die(`No mesh CA in ${dir2}. Run: tesseract-agent net init --org NAME --ca-dir ${dir2}`);
   }
-  const genesisBytes = new Uint8Array(readFileSync58(gPath));
+  const genesisBytes = new Uint8Array(readFileSync61(gPath));
   const genesis = decodeGenesis(genesisBytes);
-  const sealed = decodeRecoveryBundle(new Uint8Array(readFileSync58(sPath)));
+  const sealed = decodeRecoveryBundle(new Uint8Array(readFileSync61(sPath)));
   const pass = await readPassphrase("CA passphrase: ");
   let seed;
   try {
@@ -82358,7 +82541,7 @@ async function netCaCommand(rest, flags) {
   if (sub === "init") {
     const org = typeof flags.org === "string" ? flags.org.trim() : "";
     if (!org) die("Usage: tesseract-agent net init --org NAME [--ca-dir DIR]");
-    if (existsSync54(join93(caDir, "ca.sealed"))) {
+    if (existsSync55(join94(caDir, "ca.sealed"))) {
       die(`A mesh CA already exists in ${caDir}. Refusing to overwrite it.`);
     }
     const pass = await readPassphrase("New CA passphrase: ");
@@ -82380,9 +82563,9 @@ async function netCaCommand(rest, flags) {
     const genesisBytes = encodeGenesis(genesis);
     const fp = await genesisFingerprint(genesis);
     ensureDir(caDir);
-    writeFileSync49(join93(caDir, "genesis.bin"), genesisBytes);
-    writeSecretFile(join93(caDir, "ca.sealed"), encodeRecoveryBundle(await sealCaKey(seed, pass, `${org} mesh CA`)));
-    writeSecretFile(join93(caDir, "disablement.secret"), hex3(disable.secret));
+    writeFileSync49(join94(caDir, "genesis.bin"), genesisBytes);
+    writeSecretFile(join94(caDir, "ca.sealed"), encodeRecoveryBundle(await sealCaKey(seed, pass, `${org} mesh CA`)));
+    writeSecretFile(join94(caDir, "disablement.secret"), hex3(disable.secret));
     console.log(`
 Mesh created for "${org}".`);
     console.log(`  fingerprint: ${hex3(fp)}`);
@@ -82397,7 +82580,7 @@ Mesh created for "${org}".`);
     console.log(`  ${hex3(disable.secret)}`);
     console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
     console.log(`
-A copy of the disablement secret is in ${join93(caDir, "disablement.secret")}.`);
+A copy of the disablement secret is in ${join94(caDir, "disablement.secret")}.`);
     console.log("Move it somewhere the CA directory is not \u2014 holding both in one place");
     console.log("defeats the point of having two.");
     const caFlag = caDir === resolve13("./mesh-ca") ? "" : ` --ca-dir ${caDir}`;
@@ -82450,14 +82633,14 @@ Next, issue an identity for a machine (pick a free address in ${formatPrefix(gen
       [{ keyIndex: 0, privateKey: ca.privateKey }]
     );
     ensureDir(outDir);
-    writeFileSync49(join93(outDir, "genesis.bin"), genesisBytes);
-    writeFileSync49(join93(outDir, "node.cert"), encodeCert(cert));
-    writeSecretFile(join93(outDir, "node.key"), await exportStaticPrivate(nodeKey));
+    writeFileSync49(join94(outDir, "genesis.bin"), genesisBytes);
+    writeFileSync49(join94(outDir, "node.cert"), encodeCert(cert));
+    writeSecretFile(join94(outDir, "node.key"), await exportStaticPrivate(nodeKey));
     console.log(`Minted "${name}" at ${ip4}.`);
     console.log(`  ${outDir}`);
     console.log("\nCopy that directory to the node and run there:");
-    console.log(`  tesseract-agent net enroll --genesis ${join93(outDir, "genesis.bin")} \\`);
-    console.log(`      --cert ${join93(outDir, "node.cert")} --key ${join93(outDir, "node.key")}`);
+    console.log(`  tesseract-agent net enroll --genesis ${join94(outDir, "genesis.bin")} \\`);
+    console.log(`      --cert ${join94(outDir, "node.cert")} --key ${join94(outDir, "node.key")}`);
     console.log("\nnode.key is the node's identity \u2014 send it over a channel you trust, and");
     console.log("delete this copy once the node has it.");
     return;
@@ -82493,7 +82676,7 @@ Next, issue an identity for a machine (pick a free address in ${formatPrefix(gen
       ip4Exceptions: []
     };
     const signed = await signBundle(bundle, [{ keyIndex: 0, privateKey: ca.privateKey }]);
-    const out = resolve13(typeof flags.out === "string" ? flags.out : join93(caDir, "bundle.bin"));
+    const out = resolve13(typeof flags.out === "string" ? flags.out : join94(caDir, "bundle.bin"));
     writeFileSync49(out, encodeSignedBundle(signed));
     console.log(`Signed policy bundle (epoch ${epoch2}) \u2192 ${out}`);
     console.log("Every node must receive it; the relay distributes it, or copy it to");
@@ -82516,12 +82699,12 @@ var init_mesh_ca = __esm({
 
 // src/cli.ts
 init_base_paths();
-import { existsSync as existsSync55, mkdtempSync as mkdtempSync4, readFileSync as readFileSync60, rmSync as rmSync14 } from "node:fs";
+import { existsSync as existsSync56, mkdtempSync as mkdtempSync4, readFileSync as readFileSync63, rmSync as rmSync14 } from "node:fs";
 import { createHash as createHash9 } from "node:crypto";
-import { execFileSync as execFileSync7, spawn as spawn14 } from "node:child_process";
+import { execFileSync as execFileSync8, spawn as spawn14 } from "node:child_process";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 import { tmpdir as tmpdir8 } from "node:os";
-import { dirname as dirname44, join as join94, resolve as resolve15 } from "node:path";
+import { dirname as dirname44, join as join95, resolve as resolve15 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 
 // ../../packages/host-core/dist/control-link.js
@@ -85360,8 +85543,8 @@ function installWorkspaceHandlers(t, opts) {
             w(term.exit);
         }
       });
-      child.on("exit", (code, signal) => {
-        term.exit = { exitCode: code, signal: signal ?? null };
+      child.on("exit", (code, signal2) => {
+        term.exit = { exitCode: code, signal: signal2 ?? null };
         for (const w of term.waiters.splice(0))
           w(term.exit);
       });
@@ -85692,6 +85875,9 @@ var SEED = {
   // itself and the 5.4 mini/nano are 400k.
   "gpt-6-astra": 105e4,
   "gpt-5.6": 105e4,
+  "gpt-5.6-sol": 105e4,
+  "gpt-5.6-terra": 105e4,
+  "gpt-5.6-luna": 105e4,
   "gpt-5.5": 105e4,
   "gpt-5.4": 105e4,
   "gpt-5": 4e5,
@@ -86633,6 +86819,18 @@ function toolOutputText(content) {
   const c = content;
   return c?.text ?? "";
 }
+async function pickDefaultModel(current, offered, floor, windowOf) {
+  if (current && await windowOf(current) >= floor.minWindow)
+    return null;
+  const set2 = new Set(offered);
+  for (const id of floor.preferred)
+    if (set2.has(id) && id !== current)
+      return id;
+  for (const id of offered)
+    if (id !== current && await windowOf(id) >= floor.minWindow)
+      return id;
+  return null;
+}
 function modelMemoPath(engineId) {
   return join30(daemonDir2(), "engine-config", engineId, "last-model.txt");
 }
@@ -86690,6 +86888,23 @@ ${snapshot4}
 </context_from_compaction>`;
 }
 var OPENCODE_ACP = {
+  // 200k is the one window the operator called unusable; big-pickle is OpenCode's default.
+  // Preference: the strongest 1M-class model per provider the user is likely to have, the
+  // engine's own zen mirrors of them, then its free 1M tier. All published at ≥1M (2026-09).
+  defaultModelFloor: {
+    minWindow: 1e6,
+    preferred: [
+      "anthropic/claude-sonnet-5",
+      "openai/gpt-5.6",
+      "google/gemini-3.5-flash",
+      "opencode/claude-sonnet-5",
+      "opencode/gpt-5.6",
+      "opencode/gemini-3.5-flash",
+      "opencode/nemotron-3-ultra-free",
+      "opencode/muse-spark-1.3-contributor-free",
+      "opencode/mimo-v2-pro-free"
+    ]
+  },
   // Its shipped ruleset is `"*": "allow"`, so its ACP layer — which forwards permissions
   // correctly, and auto-REJECTS when the client advertises no responder — never had anything
   // to forward. `OPENCODE_PERMISSION` is applied last in its config assembly, so this is the
@@ -87964,6 +88179,30 @@ ${text12}`);
     send: send5,
     log: (m) => console.warn(`[${engine.label}] ${m}`)
   });
+  function withdrawParkedPrompts(sid, clientRequestId, origin) {
+    let n = 0;
+    const announce = (requestId, promptKind, behavior) => send5({ type: "agent:auto_decision", sessionId: sid, clientRequestId, requestId, promptKind, decision: PROMPT_WITHDRAWN_DECISION, behavior }, origin);
+    for (const [rid, pend] of [...pendingPermissions]) {
+      if (pend.sid !== sid)
+        continue;
+      pendingPermissions.delete(rid);
+      const id = pend.options.find((o) => o.kind === "reject_once")?.optionId ?? pend.options.find((o) => o.kind?.startsWith("reject"))?.optionId;
+      pend.resolve(id ? { outcome: { outcome: "selected", optionId: id } } : { outcome: { outcome: "cancelled" } });
+      announce(rid, "permission", "deny");
+      n++;
+    }
+    if (turns.size <= 1) {
+      for (const [rid, pend] of [...pendingDialogs]) {
+        pendingDialogs.delete(rid);
+        pend.resolve({ action: "decline" });
+        announce(rid, "elicitation", "decline");
+        n++;
+      }
+    }
+    if (n)
+      console.warn(`[${engine.label}] ${sid}: ${n} parked prompt(s) withdrawn \u2014 the user replied in the chat`);
+    return n;
+  }
   async function maybeCompactProactively(sid, params) {
     try {
       if (params.autoContinuation)
@@ -88100,6 +88339,17 @@ ${text12}`);
         knownSessions.add(sid);
         sessionIndex.record({ id: sid, cwd: params.projectDir, title: firstLine(params.message) });
         sessionConfig.set(sid, readSessionConfig(res));
+        if (!params.model && engine.defaultModelFloor) {
+          const cfg2 = sessionConfig.get(sid);
+          const pick3 = await pickDefaultModel(cfg2?.currentModel, (cfg2?.models ?? []).map((m) => m.id), engine.defaultModelFloor, (id) => resolveContextWindow(id).catch(() => 0));
+          if (pick3 && cfg2) {
+            const ok = await t.request("session/set_model", { sessionId: sid, modelId: pick3 }).then(() => true).catch(() => false);
+            if (ok) {
+              console.warn(`[${engine.label}] default model ${cfg2.currentModel ?? "(none)"} is under ${engine.defaultModelFloor.minWindow.toLocaleString()} tokens \u2014 new session switched to ${pick3}`);
+              cfg2.currentModel = pick3;
+            }
+          }
+        }
         rememberModel(engine.id, sessionConfig.get(sid)?.currentModel);
         sessionCwd.set(sid, params.projectDir);
         if (hostedHold.token) {
@@ -88126,6 +88376,8 @@ ${text12}`);
     if (declared.fileRewind && params.projectDir) {
       await snapshots.take(sid, snapKey, params.projectDir);
     }
+    if (!params.autoContinuation)
+      withdrawParkedPrompts(sid, params.clientRequestId, origin);
     const messageId = randomUUID14();
     const turnId = randomUUID14();
     const startedAt2 = Date.now();
@@ -88312,7 +88564,7 @@ ${detail}` : detail, !overflow);
           ],
           // A subagent is a SEPARATE ACP session on the same live process: no history, its
           // own permission gate, and it cannot disturb the parent's turn state.
-          runSubagent: async (prompt2, { signal }) => {
+          runSubagent: async (prompt2, { signal: signal2 }) => {
             if (!transport || !spawnedCwd)
               throw new Error(`${LABEL3} is not running.`);
             const res = await transport.request("session/new", { cwd: spawnedCwd, mcpServers: [] });
@@ -88320,7 +88572,7 @@ ${detail}` : detail, !overflow);
             if (!sub)
               throw new Error("could not start a subagent session");
             knownSessions.add(sub);
-            signal.addEventListener("abort", () => {
+            signal2.addEventListener("abort", () => {
               try {
                 transport?.notify("session/cancel", { sessionId: sub });
               } catch {
@@ -88989,6 +89241,7 @@ import { mkdirSync as mkdirSync18, readFileSync as readFileSync24, writeFileSync
 import { join as join31 } from "node:path";
 init_daemon_settings();
 init_dist5();
+import { homedir as homedir8 } from "node:os";
 init_prompts();
 init_hosted_jobs();
 var TESSERACT_INTERNAL_SECRET3 = /^(CCB_JWT_SECRET|JWT_SECRET|TESSERACT_TOKEN|CCB_RELAY_SECRET|TURN_SECRET|LIVEKIT_API_SECRET)$/;
@@ -89169,6 +89422,28 @@ function itemToolName(item) {
       return null;
   }
 }
+function configuredCodexModel(home = process.env.CODEX_HOME ?? join31(homedir8(), ".codex")) {
+  try {
+    const m = /^\s*model\s*=\s*"([^"]+)"/m.exec(readFileSync24(join31(home, "config.toml"), "utf8"));
+    return m?.[1] || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function codexWindowFlags(published, remembered, pct2) {
+  const flags = [];
+  if (published > 0)
+    flags.push("-c", `model_context_window=${published}`);
+  if (!pct2 || pct2 <= 0 || pct2 >= 100)
+    return flags;
+  const base = remembered && (!published || remembered >= published * 0.7) ? remembered : published;
+  if (!base)
+    return flags;
+  const limit = Math.round(base * (pct2 / 100));
+  if (limit > 0)
+    flags.push("-c", `model_auto_compact_token_limit=${limit}`);
+  return flags;
+}
 function createCodexAppServerBackend(send5, resolve16, onBrowserRequest, loadPluginRuntime2) {
   const ENGINE_ID2 = "openai-codex";
   const HOSTED_TOKEN_ENV = "TESSERACT_MCP_TOKEN";
@@ -89222,7 +89497,7 @@ function createCodexAppServerBackend(send5, resolve16, onBrowserRequest, loadPlu
           extraTools: () => scheduling.tools(),
           // A subagent is a separate THREAD on the same app-server: its own history, its own
           // approval policy, and it cannot disturb the parent turn.
-          runSubagent: async (prompt2, { signal }) => {
+          runSubagent: async (prompt2, { signal: signal2 }) => {
             if (!transport || !spawnedCwd)
               throw new Error(`${label} is not running.`);
             const started2 = await transport.request("thread/start", {
@@ -89235,7 +89510,7 @@ function createCodexAppServerBackend(send5, resolve16, onBrowserRequest, loadPlu
               throw new Error("could not start a subagent thread");
             const out = [];
             subagentSinks.set(sub, out);
-            signal.addEventListener("abort", () => {
+            signal2.addEventListener("abort", () => {
               void transport?.request("turn/interrupt", { threadId: sub }).catch(() => {
               });
             });
@@ -89247,7 +89522,7 @@ function createCodexAppServerBackend(send5, resolve16, onBrowserRequest, loadPlu
                   resolveWait();
                 };
                 subagentDone.set(sub, done);
-                signal.addEventListener("abort", done);
+                signal2.addEventListener("abort", done);
               });
             } finally {
               subagentSinks.delete(sub);
@@ -89611,17 +89886,12 @@ function createCodexAppServerBackend(send5, resolve16, onBrowserRequest, loadPlu
       return void 0;
     }
   }
-  function compactionFlags() {
-    const pct2 = readDaemonAgentSettings().autoCompactPct;
-    if (!pct2 || pct2 <= 0 || pct2 >= 100)
-      return [];
-    const window2 = rememberedWindow();
-    if (!window2)
-      return [];
-    const limit = Math.round(window2 * (pct2 / 100));
-    return limit > 0 ? ["-c", `model_auto_compact_token_limit=${limit}`] : [];
+  async function spawnFlags(model) {
+    const id = model ?? configuredCodexModel();
+    const published = id ? await resolveContextWindow(id).catch(() => 0) : 0;
+    return codexWindowFlags(published, rememberedWindow(), readDaemonAgentSettings().autoCompactPct);
   }
-  async function ensureProcess(command, env, cwd) {
+  async function ensureProcess(command, env, cwd, model) {
     if (transport && child && !child.killed && spawnedCwd === cwd)
       return transport;
     if (transport && child && !child.killed && spawnedCwd !== cwd) {
@@ -89636,7 +89906,7 @@ function createCodexAppServerBackend(send5, resolve16, onBrowserRequest, loadPlu
     if (initPromise)
       return initPromise;
     initPromise = (async () => {
-      const c = spawnManaged(command, ["app-server", ...compactionFlags()], {
+      const c = spawnManaged(command, ["app-server", ...await spawnFlags(model)], {
         name: "codex",
         killSignal: "SIGKILL",
         cwd,
@@ -89862,6 +90132,34 @@ function createCodexAppServerBackend(send5, resolve16, onBrowserRequest, loadPlu
     send: send5,
     log: (m) => console.warn(`[${label}] ${m}`)
   });
+  function withdrawParkedPrompts(threadId, clientRequestId, origin) {
+    let n = 0;
+    const announce = (requestId, promptKind, behavior) => send5({ type: "agent:auto_decision", sessionId: threadId, clientRequestId, requestId, promptKind, decision: PROMPT_WITHDRAWN_DECISION, behavior }, origin);
+    for (const [rid, pend] of [...pendingApprovals]) {
+      if (pend.threadId !== threadId)
+        continue;
+      pendingApprovals.delete(rid);
+      pend.resolve(pend.deny);
+      announce(rid, "permission", "deny");
+      n++;
+    }
+    if (turns.size <= 1) {
+      for (const [rid, pend] of [...pendingDialogs]) {
+        pendingDialogs.delete(rid);
+        if (pend.kind === "userDialog") {
+          pend.resolve({ answers: {} });
+          announce(rid, "dialog", "cancel");
+        } else {
+          pend.resolve({ action: "decline" });
+          announce(rid, "elicitation", "decline");
+        }
+        n++;
+      }
+    }
+    if (n)
+      console.warn(`[${label}] ${threadId}: ${n} parked prompt(s) withdrawn \u2014 the user replied in the chat`);
+    return n;
+  }
   async function maybeCompactProactively(threadId, params) {
     try {
       if (params.autoContinuation)
@@ -89908,17 +90206,17 @@ function createCodexAppServerBackend(send5, resolve16, onBrowserRequest, loadPlu
       return;
     }
     await ensureHostedToolset();
+    const live = params.sessionId ? liveRunModes.get(params.sessionId) : void 0;
+    const permissionMode = live?.permissionMode ?? params.permissionMode;
+    const model = live?.model ?? params.model;
     let t;
     try {
-      t = await ensureProcess(cfg2.command, cfg2.env, params.projectDir);
+      t = await ensureProcess(cfg2.command, cfg2.env, params.projectDir, model);
     } catch (e) {
       fail4(params.sessionId ?? "", params.clientRequestId, `${label} failed to start: ${String(e?.message ?? e)}`, origin, true);
       return;
     }
     await installTools(t, { ...injectedServers, ...params.mcpServers ?? {} });
-    const live = params.sessionId ? liveRunModes.get(params.sessionId) : void 0;
-    const permissionMode = live?.permissionMode ?? params.permissionMode;
-    const model = live?.model ?? params.model;
     let threadId = params.sessionId ? followRekey(params.sessionId) : params.sessionId;
     if (threadId && threadId !== params.sessionId)
       send5({ type: "session:created", sessionId: threadId, clientRequestId: params.clientRequestId }, origin);
@@ -89992,6 +90290,8 @@ function createCodexAppServerBackend(send5, resolve16, onBrowserRequest, loadPlu
       await snapshots.take(threadId, snapKey, params.projectDir);
     }
     userTurnSeq.set(threadId, userSeq + 1);
+    if (!params.autoContinuation)
+      withdrawParkedPrompts(threadId, params.clientRequestId, origin);
     const messageId = randomUUID15();
     const turnId = randomUUID15();
     const startedAt2 = Date.now();
@@ -91726,7 +92026,8 @@ import { join as join35, dirname as dirname16 } from "node:path";
 
 // ../../packages/host-core/dist/service/types.js
 init_base_paths();
-var SERVICE_LABEL_BASE = "dev.tesseract.app.host";
+var SERVICE_LABEL_BASE = "dev.tesseract.agent";
+var LEGACY_SERVICE_LABEL_BASE = "dev.tesseract.app.host";
 function instanceSuffix(instanceId) {
   if (instanceId)
     return instanceId;
@@ -92334,17 +92635,17 @@ function createDaemonOsControlRunner() {
       const n = await nutOrThrow();
       const btn = NUT_BTN[opts?.button ?? "left"];
       const stepPx = opts?.stepPx ?? 5, stepMs = opts?.stepMs ?? 12;
-      const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+      const sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
       const move = (x, y) => {
         const rx = Math.round(x), ry = Math.round(y);
         n.moveMouse(rx, ry);
         opts?.onStep?.({ x: rx, y: ry });
       };
       move(points[0].x, points[0].y);
-      await sleep(120);
+      await sleep2(120);
       n.mouseToggle("down", btn);
       if (opts?.grabMs)
-        await sleep(opts.grabMs);
+        await sleep2(opts.grabMs);
       try {
         for (let i = 1; i < points.length; i++) {
           const a = points[i - 1], b = points[i];
@@ -92354,11 +92655,11 @@ function createDaemonOsControlRunner() {
             if (opts?.signal?.aborted)
               return;
             move(a.x + (b.x - a.x) * s / segs, a.y + (b.y - a.y) * s / segs);
-            await sleep(stepMs);
+            await sleep2(stepMs);
           }
         }
         if (opts?.dropMs && !opts?.signal?.aborted)
-          await sleep(opts.dropMs);
+          await sleep2(opts.dropMs);
       } finally {
         n.mouseToggle("up", btn);
       }
@@ -92419,7 +92720,7 @@ function wireIpcOnce() {
     }
   });
 }
-function showFormWindow(kind, payload, signal) {
+function showFormWindow(kind, payload, signal2) {
   const el2 = electronModule();
   if (!el2)
     notReady("Asking for input");
@@ -92453,7 +92754,7 @@ function showFormWindow(kind, payload, signal) {
       if (done)
         return;
       done = true;
-      signal?.removeEventListener("abort", onAbort);
+      signal2?.removeEventListener("abort", onAbort);
       pendingInput.delete(reqId);
       try {
         if (!win3.isDestroyed())
@@ -92464,10 +92765,10 @@ function showFormWindow(kind, payload, signal) {
     };
     pendingInput.set(reqId, finish);
     win3.on("closed", () => finish({ submitted: false, values: {} }));
-    if (signal?.aborted)
+    if (signal2?.aborted)
       onAbort();
     else
-      signal?.addEventListener("abort", onAbort);
+      signal2?.addEventListener("abort", onAbort);
   });
 }
 async function confirmAction(spec, opts) {
@@ -93586,9 +93887,9 @@ function isNotice(toolName) {
   return toolName === "_notice_";
 }
 function parseNotice(summary) {
-  const sep11 = summary.indexOf("\n\n");
-  const headerRaw = (sep11 >= 0 ? summary.slice(0, sep11) : summary).trim();
-  const body = sep11 >= 0 ? summary.slice(sep11 + 2).trim() : "";
+  const sep12 = summary.indexOf("\n\n");
+  const headerRaw = (sep12 >= 0 ? summary.slice(0, sep12) : summary).trim();
+  const body = sep12 >= 0 ? summary.slice(sep12 + 2).trim() : "";
   const subtype = headerRaw.replace(/^_+|_+$/g, "");
   return { subtype, body };
 }
@@ -94191,7 +94492,7 @@ import { randomUUID as randomUUID24 } from "node:crypto";
 
 // ../../packages/host-core/dist/companion-browsers.js
 import { existsSync as existsSync17, readdirSync as readdirSync8, readFileSync as readFileSync26, statSync as statSync12 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
+import { homedir as homedir9 } from "node:os";
 import { join as join39 } from "node:path";
 var COMPANION_EXTENSION_IDS = [
   "icpnghhpcmaonjckkpilpajblfehpplo",
@@ -94224,7 +94525,7 @@ var WIN = [
   ["Chromium/User Data", "Chromium", "chrome"]
 ];
 function roots() {
-  const home = homedir8();
+  const home = homedir9();
   if (process.platform === "darwin") {
     const base = join39(home, "Library/Application Support");
     return MAC.map(([d, n, a]) => [join39(base, d), n, a]);
@@ -94893,7 +95194,7 @@ var SUPPORTED_DURATIONS = [4, 6, 8];
 var DEFAULT_DURATION = 8;
 var REQUEST_TIMEOUT_MS = 9e4;
 var DOWNLOAD_TIMEOUT_MS = 18e4;
-var withTimeout3 = (signal, ms) => signal ?? AbortSignal.timeout(ms);
+var withTimeout3 = (signal2, ms) => signal2 ?? AbortSignal.timeout(ms);
 function clampDuration(requested) {
   if (!requested || !Number.isFinite(requested))
     return DEFAULT_DURATION;
@@ -95007,7 +95308,7 @@ var GeminiVeoProvider = class {
 var DEFAULT_MODEL4 = "tsr-video";
 var REQUEST_TIMEOUT_MS2 = 9e4;
 var DOWNLOAD_TIMEOUT_MS2 = 18e4;
-var withTimeout4 = (signal, ms) => signal ?? AbortSignal.timeout(ms);
+var withTimeout4 = (signal2, ms) => signal2 ?? AbortSignal.timeout(ms);
 var TesseractVeoProvider = class {
   id = "tesseract";
   model;
@@ -96147,7 +96448,7 @@ var HEYGEN_DIRECT_BASE_URL = "https://api.heygen.com";
 var DEFAULT_DIM = { width: 1280, height: 720 };
 var HG_REQUEST_TIMEOUT_MS = 6e4;
 var HG_DOWNLOAD_TIMEOUT_MS = 18e4;
-async function hgFetch(path6, cfg2, init, signal) {
+async function hgFetch(path6, cfg2, init, signal2) {
   const base = (cfg2.baseUrl || HEYGEN_DIRECT_BASE_URL).replace(/\/+$/, "");
   let res;
   try {
@@ -96155,7 +96456,7 @@ async function hgFetch(path6, cfg2, init, signal) {
       method: init.method,
       headers: { "X-Api-Key": cfg2.apiKey, ...init.body != null ? { "Content-Type": "application/json" } : {} },
       ...init.body != null ? { body: JSON.stringify(init.body) } : {},
-      signal: signal ?? AbortSignal.timeout(HG_REQUEST_TIMEOUT_MS)
+      signal: signal2 ?? AbortSignal.timeout(HG_REQUEST_TIMEOUT_MS)
     });
   } catch (e) {
     throw new Error(`HeyGen: network error \u2014 ${e instanceof Error ? e.message : String(e)}`);
@@ -96169,11 +96470,11 @@ async function hgFetch(path6, cfg2, init, signal) {
   }
   return json3;
 }
-async function listAvatarsHeyGen(cfg2, signal) {
-  const j = await hgFetch("/v2/avatars", cfg2, { method: "GET" }, signal);
+async function listAvatarsHeyGen(cfg2, signal2) {
+  const j = await hgFetch("/v2/avatars", cfg2, { method: "GET" }, signal2);
   return (j.data?.avatars ?? []).map((a) => ({ avatarId: a.avatar_id, name: a.avatar_name ?? a.avatar_id }));
 }
-async function submitAvatarVideoHeyGen(spec, cfg2, signal) {
+async function submitAvatarVideoHeyGen(spec, cfg2, signal2) {
   if (!spec.avatarId && !spec.talkingPhotoId)
     throw new Error("HeyGen: provide an avatarId or talkingPhotoId.");
   const character = spec.talkingPhotoId ? { type: "talking_photo", talking_photo_id: spec.talkingPhotoId } : { type: "avatar", avatar_id: spec.avatarId, avatar_style: "normal" };
@@ -96187,21 +96488,21 @@ async function submitAvatarVideoHeyGen(spec, cfg2, signal) {
     ],
     dimension: { width: spec.width ?? DEFAULT_DIM.width, height: spec.height ?? DEFAULT_DIM.height }
   };
-  const j = await hgFetch("/v2/video/generate", cfg2, { method: "POST", body }, signal);
+  const j = await hgFetch("/v2/video/generate", cfg2, { method: "POST", body }, signal2);
   const id = j.data?.video_id;
   if (!id)
     throw new Error("HeyGen returned no video_id.");
   return id;
 }
-async function pollAvatarVideoHeyGen(videoId, cfg2, signal) {
-  const j = await hgFetch(`/v1/video_status.get?video_id=${encodeURIComponent(videoId)}`, cfg2, { method: "GET" }, signal);
+async function pollAvatarVideoHeyGen(videoId, cfg2, signal2) {
+  const j = await hgFetch(`/v1/video_status.get?video_id=${encodeURIComponent(videoId)}`, cfg2, { method: "GET" }, signal2);
   const d = j.data ?? {};
   const error51 = typeof d.error === "string" ? d.error : d.error?.message;
   return { status: d.status ?? "processing", videoUrl: d.video_url, error: error51 };
 }
-async function downloadHeyGenVideo(url2, signal) {
+async function downloadHeyGenVideo(url2, signal2) {
   try {
-    const res = await fetch(url2, { signal: signal ?? AbortSignal.timeout(HG_DOWNLOAD_TIMEOUT_MS) });
+    const res = await fetch(url2, { signal: signal2 ?? AbortSignal.timeout(HG_DOWNLOAD_TIMEOUT_MS) });
     if (!res.ok)
       throw new Error(`HeyGen video download failed (${res.status})`);
     return { bytes: new Uint8Array(await res.arrayBuffer()), mime: "video/mp4" };
@@ -98966,14 +99267,14 @@ function parseExternalTabId(browserId) {
   if (!browserId.startsWith("ext:"))
     return null;
   const rest = browserId.slice(4);
-  const sep11 = rest.lastIndexOf(":");
-  const digits = sep11 < 0 ? rest : rest.slice(sep11 + 1);
+  const sep12 = rest.lastIndexOf(":");
+  const digits = sep12 < 0 ? rest : rest.slice(sep12 + 1);
   if (!/^\d+$/.test(digits))
     return null;
   const tabId = Number(digits);
-  if (sep11 < 0)
+  if (sep12 < 0)
     return { key: null, tabId };
-  const key2 = rest.slice(0, sep11);
+  const key2 = rest.slice(0, sep12);
   return key2 ? { key: key2, tabId } : null;
 }
 function preferredCompanion() {
@@ -99362,7 +99663,7 @@ init_base_paths();
 import { readFile as readFile12 } from "node:fs/promises";
 import { statSync as statSync13 } from "node:fs";
 import { execFile as execFile5 } from "node:child_process";
-import { homedir as homedir9 } from "node:os";
+import { homedir as homedir10 } from "node:os";
 import { basename as basename7, join as join49 } from "node:path";
 var recentsProvider = () => [];
 var ownDeviceIdProvider = () => "";
@@ -99432,7 +99733,7 @@ function prettyName(p) {
   return basename7(p) || p;
 }
 async function macFavorites() {
-  const dir2 = join49(homedir9(), "Library", "Application Support", "com.apple.sharedfilelist");
+  const dir2 = join49(homedir10(), "Library", "Application Support", "com.apple.sharedfilelist");
   let denied = false;
   for (const ext of ["sfl3", "sfl2"]) {
     try {
@@ -99449,7 +99750,7 @@ async function macFavorites() {
   return { favorites: macFallback(), needsFda: denied };
 }
 function macFallback() {
-  const home = homedir9();
+  const home = homedir10();
   const known = [
     { label: "Applications", path: "/Applications" },
     { label: "iCloud Drive", path: join49(home, "Library", "Mobile Documents", "com~apple~CloudDocs") },
@@ -99594,11 +99895,11 @@ async function windowsFavorites() {
   return finalize2(items);
 }
 async function linuxFavorites() {
-  const config2 = process.env.XDG_CONFIG_HOME || join49(homedir9(), ".config");
+  const config2 = process.env.XDG_CONFIG_HOME || join49(homedir10(), ".config");
   const candidates = [
     join49(config2, "gtk-3.0", "bookmarks"),
     join49(config2, "gtk-4.0", "bookmarks"),
-    join49(homedir9(), ".gtk-bookmarks")
+    join49(homedir10(), ".gtk-bookmarks")
     // legacy GTK2
   ];
   for (const file2 of candidates) {
@@ -102208,7 +102509,7 @@ function sameState(a, b) {
     return true;
   return false;
 }
-function decide(local, remote, ownWinsTie) {
+function decide2(local, remote, ownWinsTie) {
   if (sameState(local, remote))
     return "noop";
   if (remote.t > local.t)
@@ -104601,7 +104902,7 @@ var ActiveLinkEngine = class {
       const local = this.manifest.effective(rel);
       const entry = peerMap.get(rel);
       const remote = entry ? LinkManifest.sideOf(entry) : ABSENT;
-      if (decide(local, remote, this.ownWinsTie) !== "pull")
+      if (decide2(local, remote, this.ownWinsTie) !== "pull")
         continue;
       if (remote.kind === "deleted")
         void this.applyDelete(rel, remote.t);
@@ -104613,13 +104914,13 @@ var ActiveLinkEngine = class {
   onFile(rel, kind, mtimeMs, hash2) {
     const local = this.manifest.effective(rel);
     const remote = { kind, t: mtimeMs, hash: hash2 };
-    if (decide(local, remote, this.ownWinsTie) === "pull")
+    if (decide2(local, remote, this.ownWinsTie) === "pull")
       this.pull(rel, kind);
   }
   async onDelete(rel, deletedAtMs) {
     const local = this.manifest.effective(rel);
     const remote = { kind: "deleted", t: deletedAtMs, hash: "" };
-    if (decide(local, remote, this.ownWinsTie) === "pull")
+    if (decide2(local, remote, this.ownWinsTie) === "pull")
       await this.applyDelete(rel, deletedAtMs);
   }
   /** Request content for a path we've decided the peer wins: symlinks (and the
@@ -104979,7 +105280,7 @@ var ActiveLinkEngine = class {
   /** Would an incoming file@(mtimeMs,hash) still win against our CURRENT local state?
    *  Used to drop a pull that a concurrent local write has overtaken. */
   incomingStillWins(rel, mtimeMs, hash2) {
-    return decide(this.manifest.effective(rel), { kind: "file", t: mtimeMs, hash: hash2 }, this.ownWinsTie) === "pull";
+    return decide2(this.manifest.effective(rel), { kind: "file", t: mtimeMs, hash: hash2 }, this.ownWinsTie) === "pull";
   }
   async reconcileScan() {
     this.allow = await gitSyncedFiles(this.opts.localRoot);
@@ -105280,7 +105581,7 @@ init_dist5();
 
 // ../../packages/host-core/dist/pty-manager.js
 import { existsSync as existsSync28 } from "node:fs";
-import { homedir as homedir10 } from "node:os";
+import { homedir as homedir11 } from "node:os";
 init_safe_kill();
 var ptyPromise = null;
 function loadPty() {
@@ -105348,10 +105649,10 @@ async function openPty(opts, sink3) {
     else if (!s.timer)
       s.timer = setTimeout(() => flush(opts.ptyId, s, sink3), FLUSH_MS);
   });
-  proc.onExit(({ exitCode, signal }) => {
+  proc.onExit(({ exitCode, signal: signal2 }) => {
     flush(opts.ptyId, s, sink3);
     sessions2.delete(k);
-    sink3.exit(opts.ptyId, exitCode ?? null, signal ?? null);
+    sink3.exit(opts.ptyId, exitCode ?? null, signal2 ?? null);
   });
   return { pid: proc.pid };
 }
@@ -105373,7 +105674,7 @@ function resizePty(ptyId, cols, rows, clientId) {
     }
   }
 }
-function killPty(ptyId, signal, clientId) {
+function killPty(ptyId, signal2, clientId) {
   const k = key(clientId, ptyId);
   const s = sessions2.get(k);
   if (!s)
@@ -105382,7 +105683,7 @@ function killPty(ptyId, signal, clientId) {
     clearTimeout(s.timer);
     s.timer = null;
   }
-  killChild(s.proc, signal, "pty session");
+  killChild(s.proc, signal2, "pty session");
 }
 function releaseClientPtys(clientId) {
   for (const [k, s] of [...sessions2]) {
@@ -105522,7 +105823,7 @@ function buildChildEnv(opts) {
   return base;
 }
 function resolveCwd(cwd, hostRoot) {
-  const fallback = hostRoot || homedir10();
+  const fallback = hostRoot || homedir11();
   if (!cwd)
     return fallback;
   if (!existsSync28(cwd))
@@ -106431,7 +106732,7 @@ async function serveInboundTerm(p, driverClientId) {
     case "term:open": {
       const sink3 = {
         output: (ptyId, base643) => send3("term", { type: "term:output", ptyId, base64: base643 }, route3),
-        exit: (ptyId, exitCode, signal) => send3("term", { type: "term:exit", ptyId, exitCode, signal }, route3)
+        exit: (ptyId, exitCode, signal2) => send3("term", { type: "term:exit", ptyId, exitCode, signal: signal2 }, route3)
       };
       try {
         const { pid } = await openPty({ ptyId: p.ptyId, clientId: driverClientId, shell: p.shell, args: p.args, cwd: p.cwd, cols: p.cols, rows: p.rows, env: p.env, hostRoot: HOST_CONTAIN }, sink3);
@@ -107404,11 +107705,15 @@ var RdeskSessionManager = class {
       onCapture: (ok, message) => this.reportCapture(sessionId, viewer.clientId, ok, message)
     };
     let engine;
+    let session;
     try {
       engine = await this.deps.createEngine(engineKind, ctx2);
+      session = { sessionId, viewer, grant, accessLevel, engine, startedAt: this.now() };
+      this.sessions.set(sessionId, session);
       const dq = this.deps.defaultQuality;
       await engine.start({ monitorId: void 0, quality: (typeof dq === "function" ? dq() : dq) ?? "auto" });
     } catch (e) {
+      this.sessions.delete(sessionId);
       const err2 = e instanceof Error ? e.message : String(e);
       this.log(`engine start failed sessionId=${sessionId}: ${err2}`);
       this.deps.onCaptureBlocked?.({ sessionId, viewerName: viewer.name, error: err2 });
@@ -107418,8 +107723,6 @@ var RdeskSessionManager = class {
     const sources = await engine.listSources?.().catch(() => []) ?? [];
     const activeMonitor = monitors.find((m) => m.primary)?.id ?? monitors[0]?.id ?? "";
     const activeSource = sources.find((s) => s.kind === "screen" && s.primary)?.id ?? sources[0]?.id ?? "";
-    const session = { sessionId, viewer, grant, accessLevel, engine, startedAt: this.now() };
-    this.sessions.set(sessionId, session);
     this.log(`accepted sessionId=${sessionId} grant=${grant} engine=${engine.id} access=${accessLevel}`);
     this.audit({ event: "accept", sessionId, viewerUserId: viewer.userId, viewerName: viewer.name, grant, detail: `engine=${engine.id}` });
     this.deps.sendControl(sessionId, viewer.clientId, {
@@ -110848,7 +111151,7 @@ async function startLocalServer(opts) {
     let participantId = null;
     const termSink = {
       output: (ptyId, base643) => send5("term", { type: "term:output", ptyId, base64: base643 }),
-      exit: (ptyId, exitCode, signal) => send5("term", { type: "term:exit", ptyId, exitCode, signal })
+      exit: (ptyId, exitCode, signal2) => send5("term", { type: "term:exit", ptyId, exitCode, signal: signal2 })
     };
     const heldSessions = /* @__PURE__ */ new Set();
     let focusedTab;
@@ -111557,9 +111860,9 @@ async function startLocalServer(opts) {
 
 // ../../packages/host-core/dist/daemon-runtime.js
 init_base_paths();
-import { readFileSync as readFileSync53, writeFileSync as writeFileSync43, existsSync as existsSync43, mkdirSync as mkdirSync45, unlinkSync as unlinkSync7, chmodSync as chmodSync7, statSync as statSync17 } from "node:fs";
-import { execFileSync as execFileSync5 } from "node:child_process";
-import { join as join82 } from "node:path";
+import { readFileSync as readFileSync54, writeFileSync as writeFileSync43, existsSync as existsSync44, mkdirSync as mkdirSync45, unlinkSync as unlinkSync8, chmodSync as chmodSync7, statSync as statSync17 } from "node:fs";
+import { execFileSync as execFileSync6 } from "node:child_process";
+import { join as join83 } from "node:path";
 import { randomBytes as randomBytes11 } from "node:crypto";
 import { hostname as hostname6 } from "node:os";
 
@@ -111685,6 +111988,37 @@ function registeredDaemons(selfPid) {
   }
   return out;
 }
+function readProcessTable() {
+  const rows = [];
+  try {
+    if (process.platform === "win32") {
+      const raw2 = execFileSync3("powershell.exe", [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        'Get-CimInstance Win32_Process | ForEach-Object { "$($_.ProcessId)`t$($_.ParentProcessId)`t$($_.CommandLine)" }'
+      ], { encoding: "utf8", timeout: 8e3, windowsHide: true });
+      for (const line of raw2.split(/\r?\n/)) {
+        const p = line.split("	");
+        if (p.length < 3)
+          continue;
+        const pid = Number(p[0]);
+        const ppid = Number(p[1]);
+        if (pid > 0)
+          rows.push({ pid, ppid, cmd: p.slice(2).join("	") });
+      }
+      return rows;
+    }
+    const raw = execFileSync3("ps", ["-axww", "-o", "pid=,ppid=,command="], { encoding: "utf8", timeout: 8e3, env: PS_ENV });
+    for (const line of raw.split("\n")) {
+      const m = line.match(/^\s*(\d+)\s+(\d+)\s+(.*)$/);
+      if (m)
+        rows.push({ pid: Number(m[1]), ppid: Number(m[2]), cmd: m[3] });
+    }
+  } catch {
+  }
+  return rows;
+}
 var supervisorCache = null;
 function invalidateSupervisorCache() {
   supervisorCache = null;
@@ -111699,19 +112033,138 @@ function liveDaemons() {
   return out;
 }
 
+// ../../packages/host-core/dist/cli-agent.js
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { existsSync as existsSync33, readFileSync as readFileSync47, unlinkSync as unlinkSync7 } from "node:fs";
+import { join as join68, sep as sep11 } from "node:path";
+init_credentials();
+var statusFile = () => join68(daemonDir2(), "status.json");
+var pidfile = () => join68(daemonDir2(), "daemon.lock");
+var CLI_PKG = `${sep11}node_modules${sep11}tesseract-agent${sep11}`;
+function isCliExecPath(execPath) {
+  if (!execPath)
+    return false;
+  return execPath.includes(CLI_PKG) || execPath.endsWith(`${sep11}tesseract-agent`);
+}
+function readMachineHolder() {
+  let raw;
+  try {
+    raw = readFileSync47(statusFile(), "utf-8");
+  } catch {
+    return null;
+  }
+  let s;
+  try {
+    s = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const pid = Number(s.pid);
+  if (!Number.isInteger(pid) || pid <= 0 || !isPidAlive2(pid))
+    return null;
+  const execPath = typeof s.execPath === "string" ? s.execPath : "";
+  const stamped = s.kind === "cli" || s.kind === "app" ? s.kind : void 0;
+  return {
+    pid,
+    kind: stamped ?? (isCliExecPath(execPath) ? "cli" : "app"),
+    execPath,
+    version: typeof s.version === "string" ? s.version : "unknown"
+  };
+}
+function descendantsOf(pid, table = readProcessTable()) {
+  const byParent = /* @__PURE__ */ new Map();
+  for (const r of table) {
+    if (r.ppid === r.pid)
+      continue;
+    byParent.set(r.ppid, [...byParent.get(r.ppid) ?? [], r.pid]);
+  }
+  const out = [];
+  const seen = /* @__PURE__ */ new Set([pid]);
+  const walk2 = (p) => {
+    for (const child of byParent.get(p) ?? []) {
+      if (seen.has(child))
+        continue;
+      seen.add(child);
+      walk2(child);
+      out.push(child);
+    }
+  };
+  walk2(pid);
+  return out;
+}
+function signal(pid, sig) {
+  if (!Number.isInteger(pid) || pid <= 0)
+    return;
+  try {
+    process.kill(pid, sig);
+  } catch {
+  }
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function stopCliAgent(holder, log10 = console.log) {
+  const tree = [...descendantsOf(holder.pid), holder.pid];
+  log10(`[cli-agent] stopping the headless agent: pid ${holder.pid} (+${tree.length - 1} child process(es)), v${holder.version}`);
+  for (const pid of tree)
+    signal(pid, "SIGTERM");
+  for (let i = 0; i < 20 && tree.some(isPidAlive2); i++)
+    await sleep(250);
+  const stubborn = tree.filter(isPidAlive2);
+  if (stubborn.length) {
+    log10(`[cli-agent] ${stubborn.length} process(es) ignored SIGTERM \u2014 escalating to SIGKILL`);
+    for (const pid of stubborn)
+      signal(pid, "SIGKILL");
+    await sleep(500);
+  }
+  const alive = tree.filter(isPidAlive2);
+  if (alive.length) {
+    log10(`[cli-agent] could NOT stop pid(s) ${alive.join(", ")}`);
+    return false;
+  }
+  try {
+    if (existsSync33(pidfile()) && Number(readFileSync47(pidfile(), "utf-8").trim()) === holder.pid)
+      unlinkSync7(pidfile());
+  } catch {
+  }
+  log10("[cli-agent] stopped");
+  return true;
+}
+function uninstallCliAgent(log10 = console.log) {
+  try {
+    log10("[cli-agent] uninstalling the tesseract-agent npm package");
+    execFileSync4(process.platform === "win32" ? "npm.cmd" : "npm", ["uninstall", "-g", "tesseract-agent"], {
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 12e4
+    });
+    log10("[cli-agent] uninstalled");
+    return true;
+  } catch (e) {
+    log10("[cli-agent] uninstall failed (the agent is stopped regardless):", e?.message ?? e);
+    return false;
+  }
+}
+async function evictCliAgent(log10 = console.log) {
+  const holder = readMachineHolder();
+  if (!holder || holder.kind !== "cli")
+    return "none";
+  log10(`[cli-agent] the headless CLI agent owns this machine (${holder.execPath}); the desktop app takes over`);
+  if (!await stopCliAgent(holder, log10))
+    return "failed";
+  return uninstallCliAgent(log10) ? "stopped-and-uninstalled" : "stopped";
+}
+
 // ../../packages/host-core/dist/device-identity.js
-import { join as join68 } from "node:path";
-import { readFileSync as readFileSync47, writeFileSync as writeFileSync35, existsSync as existsSync33, mkdirSync as mkdirSync36, renameSync as renameSync11, chmodSync as chmodSync4 } from "node:fs";
+import { join as join69 } from "node:path";
+import { readFileSync as readFileSync48, writeFileSync as writeFileSync35, existsSync as existsSync34, mkdirSync as mkdirSync36, renameSync as renameSync11, chmodSync as chmodSync4 } from "node:fs";
 init_credentials();
 var cached3 = null;
 function identityPath() {
-  return join68(daemonDir2(), "identity.json");
+  return join69(daemonDir2(), "identity.json");
 }
 async function loadOrCreateDeviceIdentity() {
   if (cached3)
     return cached3;
   try {
-    const stored = JSON.parse(readFileSync47(identityPath(), "utf-8"));
+    const stored = JSON.parse(readFileSync48(identityPath(), "utf-8"));
     if (stored?.privateJwk) {
       cached3 = await importIdentity(stored.privateJwk);
       return cached3;
@@ -111721,7 +112174,7 @@ async function loadOrCreateDeviceIdentity() {
   const kp = await generateIdentityKeyPair(true);
   const { privateJwk, publicRaw } = await exportIdentity(kp);
   const dir2 = daemonDir2();
-  if (!existsSync33(dir2))
+  if (!existsSync34(dir2))
     mkdirSync36(dir2, { recursive: true, mode: 448 });
   const tmp = `${identityPath()}.tmp`;
   writeFileSync35(tmp, JSON.stringify({ privateJwk, publicRaw, alg: "P256-ECDSA" }, null, 2), { mode: 384 });
@@ -111735,7 +112188,7 @@ async function loadOrCreateDeviceIdentity() {
 }
 var sealingCached = null;
 function sealingPath() {
-  return join68(daemonDir2(), "sealing.json");
+  return join69(daemonDir2(), "sealing.json");
 }
 var EC_DH = { name: "ECDH", namedCurve: "P-256" };
 async function loadOrCreateSealingKey() {
@@ -111743,7 +112196,7 @@ async function loadOrCreateSealingKey() {
     return sealingCached;
   const { subtle: subtle5 } = globalThis.crypto;
   try {
-    const stored = JSON.parse(readFileSync47(sealingPath(), "utf-8"));
+    const stored = JSON.parse(readFileSync48(sealingPath(), "utf-8"));
     if (stored?.privateJwk && stored.publicRaw) {
       const privateKey = await subtle5.importKey("jwk", stored.privateJwk, EC_DH, true, ["deriveBits"]);
       sealingCached = { privateKey, publicRaw: unb64u(stored.publicRaw) };
@@ -111755,7 +112208,7 @@ async function loadOrCreateSealingKey() {
   const publicRaw = new Uint8Array(await subtle5.exportKey("raw", kp.publicKey));
   const privateJwk = await subtle5.exportKey("jwk", kp.privateKey);
   const dir2 = daemonDir2();
-  if (!existsSync33(dir2))
+  if (!existsSync34(dir2))
     mkdirSync36(dir2, { recursive: true, mode: 448 });
   const tmp = `${sealingPath()}.tmp`;
   writeFileSync35(tmp, JSON.stringify({ privateJwk, publicRaw: b64u(publicRaw), alg: "P256-ECDH" }, null, 2), { mode: 384 });
@@ -111855,7 +112308,7 @@ var BundleOfferLedger = class {
 init_dist6();
 
 // ../../packages/host-core/dist/mesh/netd-client.js
-import { existsSync as existsSync34, readdirSync as readdirSync13 } from "node:fs";
+import { existsSync as existsSync35, readdirSync as readdirSync13 } from "node:fs";
 import { connect as connect2 } from "node:net";
 import { platform as platform3 } from "node:process";
 var NETD_WIRE_VERSION = 2;
@@ -111871,7 +112324,7 @@ function netdEndpoint() {
 function netdListening() {
   const ep = endpointOverride() ?? netdEndpoint();
   if (process.platform !== "win32")
-    return existsSync34(ep);
+    return existsSync35(ep);
   try {
     const name = ep.replace(/^\\\\\.\\pipe\\/, "");
     return readdirSync13("\\\\.\\pipe\\").includes(name);
@@ -112323,13 +112776,13 @@ ${ts}`);
 
 // ../../packages/host-core/dist/mesh/config.js
 init_credentials();
-import { chmodSync as chmodSync5, existsSync as existsSync35, mkdirSync as mkdirSync37, readdirSync as readdirSync14, readFileSync as readFileSync48, renameSync as renameSync12, rmSync as rmSync8, writeFileSync as writeFileSync36 } from "node:fs";
-import { dirname as dirname31, join as join70 } from "node:path";
+import { chmodSync as chmodSync5, existsSync as existsSync36, mkdirSync as mkdirSync37, readdirSync as readdirSync14, readFileSync as readFileSync49, renameSync as renameSync12, rmSync as rmSync8, writeFileSync as writeFileSync36 } from "node:fs";
+import { dirname as dirname31, join as join71 } from "node:path";
 function meshDir() {
-  return join70(daemonDir2(), "mesh");
+  return join71(daemonDir2(), "mesh");
 }
 function meshesDir() {
-  return join70(meshDir(), "meshes");
+  return join71(meshDir(), "meshes");
 }
 var MESH_DIR_NAME_BYTES = 8;
 function meshDirName(genesisFp) {
@@ -112347,7 +112800,7 @@ function oneMeshDir(meshId) {
   if (!isMeshId(meshId)) {
     throw new Error(`not a mesh id: ${JSON.stringify(meshId.slice(0, 64))}`);
   }
-  return join70(meshesDir(), meshId);
+  return join71(meshesDir(), meshId);
 }
 var LEGACY_MESH_ID = "legacy";
 var CERT_GENESIS_FP_OFFSET = 19;
@@ -112365,16 +112818,16 @@ var FILES = {
   local: "local.json"
 };
 function readIfPresent(name, dir2 = meshDir()) {
-  const p = join70(dir2, name);
+  const p = join71(dir2, name);
   try {
-    return existsSync35(p) ? new Uint8Array(readFileSync48(p)) : void 0;
+    return existsSync36(p) ? new Uint8Array(readFileSync49(p)) : void 0;
   } catch {
     return void 0;
   }
 }
 function migrateSingleMesh() {
-  const legacyGenesis = join70(meshDir(), FILES.genesis);
-  if (!existsSync35(legacyGenesis))
+  const legacyGenesis = join71(meshDir(), FILES.genesis);
+  if (!existsSync36(legacyGenesis))
     return null;
   const id = meshIdFromCert(readIfPresent(FILES.cert)) ?? LEGACY_MESH_ID;
   const dest = oneMeshDir(id);
@@ -112382,12 +112835,12 @@ function migrateSingleMesh() {
     mkdirSync37(dest, { recursive: true, mode: 448 });
     chmodSync5(dest, 448);
     for (const f of Object.values(FILES)) {
-      const from = join70(meshDir(), f);
-      if (existsSync35(from))
-        renameSync12(from, join70(dest, f));
+      const from = join71(meshDir(), f);
+      if (existsSync36(from))
+        renameSync12(from, join71(dest, f));
     }
-    const key2 = join70(dest, FILES.key);
-    if (existsSync35(key2))
+    const key2 = join71(dest, FILES.key);
+    if (existsSync36(key2))
       chmodSync5(key2, 384);
   } catch {
     return null;
@@ -112410,7 +112863,7 @@ function listMeshIds() {
 }
 function readLocal(meshId) {
   try {
-    return JSON.parse(readFileSync48(join70(oneMeshDir(meshId), FILES.local), "utf8"));
+    return JSON.parse(readFileSync49(join71(oneMeshDir(meshId), FILES.local), "utf8"));
   } catch {
     return null;
   }
@@ -112418,7 +112871,7 @@ function readLocal(meshId) {
 function writeLocal(meshId, state3) {
   try {
     mkdirSync37(oneMeshDir(meshId), { recursive: true, mode: 448 });
-    writeFileSync36(join70(oneMeshDir(meshId), FILES.local), JSON.stringify(state3, null, 2), { mode: 384 });
+    writeFileSync36(join71(oneMeshDir(meshId), FILES.local), JSON.stringify(state3, null, 2), { mode: 384 });
   } catch {
   }
 }
@@ -112451,7 +112904,7 @@ function loadMeshIdentity() {
   return first === void 0 ? null : loadMesh(first);
 }
 function writeSecret(name, bytes3, dir2 = meshDir()) {
-  const p = join70(dir2, name);
+  const p = join71(dir2, name);
   writeFileSync36(p, bytes3, { mode: 384 });
   try {
     chmodSync5(p, 384);
@@ -112469,11 +112922,11 @@ function saveMeshIdentity(id) {
     chmodSync5(meshDir(), 448);
   } catch {
   }
-  writeFileSync36(join70(meshDir(), FILES.genesis), id.genesis);
-  writeFileSync36(join70(meshDir(), FILES.cert), id.cert);
+  writeFileSync36(join71(meshDir(), FILES.genesis), id.genesis);
+  writeFileSync36(join71(meshDir(), FILES.cert), id.cert);
   writeSecret(FILES.key, id.staticPrivate);
   if (id.bundle)
-    writeFileSync36(join70(meshDir(), FILES.bundle), id.bundle);
+    writeFileSync36(join71(meshDir(), FILES.bundle), id.bundle);
 }
 function saveMesh(meshId, id) {
   const dir2 = oneMeshDir(meshId);
@@ -112490,13 +112943,13 @@ function saveMesh(meshId, id) {
     chmodSync5(dir2, 448);
   } catch {
   }
-  writeFileSync36(join70(dir2, FILES.genesis), id.genesis);
-  writeFileSync36(join70(dir2, FILES.cert), id.cert);
+  writeFileSync36(join71(dir2, FILES.genesis), id.genesis);
+  writeFileSync36(join71(dir2, FILES.cert), id.cert);
   writeSecret(FILES.key, id.staticPrivate, dir2);
   if (id.sigPrivate)
     writeSecret(FILES.sigKey, id.sigPrivate, dir2);
   if (id.bundle)
-    writeFileSync36(join70(dir2, FILES.bundle), id.bundle);
+    writeFileSync36(join71(dir2, FILES.bundle), id.bundle);
   if (readLocal(meshId) === null)
     writeLocal(meshId, { joinedAt: Date.now() });
 }
@@ -112506,7 +112959,7 @@ function removeMesh(meshId) {
 var STATUS_REFRESH_MS = 5e3;
 var STATUS_STALE_MS = 2e4;
 function statusPath(meshId) {
-  return meshId === void 0 ? join70(meshDir(), "status.json") : join70(oneMeshDir(meshId), "status.json");
+  return meshId === void 0 ? join71(meshDir(), "status.json") : join71(oneMeshDir(meshId), "status.json");
 }
 function writeStatus(status2, meshId) {
   try {
@@ -112524,7 +112977,7 @@ function clearStatus(meshId) {
 }
 function readStatus(meshId) {
   try {
-    const raw = JSON.parse(readFileSync48(statusPath(meshId), "utf8"));
+    const raw = JSON.parse(readFileSync49(statusPath(meshId), "utf8"));
     if (typeof raw.at !== "number")
       return null;
     return { ...raw, at: raw.at, stale: Date.now() - raw.at > STATUS_STALE_MS };
@@ -112537,7 +112990,7 @@ function cacheBundle(bundle, meshId) {
     const id = meshId ?? listMeshIds()[0];
     const dir2 = id === void 0 ? meshDir() : oneMeshDir(id);
     mkdirSync37(dir2, { recursive: true, mode: 448 });
-    writeFileSync36(join70(dir2, FILES.bundle), bundle);
+    writeFileSync36(join71(dir2, FILES.bundle), bundle);
   } catch {
   }
 }
@@ -113534,11 +113987,11 @@ var MeshNode = class {
       return;
     const reflexive = [];
     for (const a of learned) {
-      const sep11 = a.lastIndexOf(":");
-      if (sep11 <= 0)
+      const sep12 = a.lastIndexOf(":");
+      if (sep12 <= 0)
         continue;
-      const ip = a.slice(0, sep11).replace(/^\[|\]$/g, "");
-      const port = Number(a.slice(sep11 + 1));
+      const ip = a.slice(0, sep12).replace(/^\[|\]$/g, "");
+      const port = Number(a.slice(sep12 + 1));
       if (!Number.isInteger(port) || port <= 0 || port > 65535)
         continue;
       reflexive.push({ type: "srflx", ip, port, priority: 0 });
@@ -114312,7 +114765,7 @@ import { basename as basename15 } from "node:path";
 // ../../packages/host-core/dist/drops/paths.js
 init_base_paths();
 import { mkdir as mkdir14 } from "node:fs/promises";
-import { join as join71 } from "node:path";
+import { join as join72 } from "node:path";
 
 // ../../packages/host-core/dist/drops/names.js
 var WINDOWS_RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i;
@@ -114401,7 +114854,7 @@ function basenameOf(p) {
 function resolveDropsRoot() {
   const root = resolveHostRoot();
   const preferred = dropsDir();
-  return isInsideRoot(preferred, root) ? preferred : join71(root, "Drops");
+  return isInsideRoot(preferred, root) ? preferred : join72(root, "Drops");
 }
 async function ensureDropsRoot() {
   const dir2 = resolveDropsRoot();
@@ -114417,7 +114870,7 @@ async function ensureDropDir(opts) {
     parts.push(sanitizeDropName(opts.sender, "Unknown sender"));
   if (!opts.singleItem && opts.label)
     parts.push(sanitizeDropName(opts.label, "Files"));
-  const dir2 = join71(...parts);
+  const dir2 = join72(...parts);
   await mkdir14(dir2, { recursive: true });
   return dir2;
 }
@@ -114560,7 +115013,7 @@ function createDropHandler(deps) {
 // ../../packages/host-core/dist/drops/blob-fetch.js
 import { createWriteStream as createWriteStream2 } from "node:fs";
 import { mkdir as mkdir15, rm as rm5, chmod as chmod3 } from "node:fs/promises";
-import { dirname as dirname33, join as join72 } from "node:path";
+import { dirname as dirname33, join as join73 } from "node:path";
 import { Readable as Readable2 } from "node:stream";
 import { pipeline } from "node:stream/promises";
 
@@ -114732,7 +115185,7 @@ async function fetchBlobDrop(opts) {
         log7(`drop ${opts.dropId}: refusing directory "${item.rel}"`);
         continue;
       }
-      const abs = join72(opts.destDir, rel);
+      const abs = join73(opts.destDir, rel);
       if (!isInsideRoot(abs, opts.destDir)) {
         log7(`drop ${opts.dropId}: refusing directory outside the destination`);
         continue;
@@ -114753,7 +115206,7 @@ async function fetchBlobDrop(opts) {
         log7(`drop ${opts.dropId}: refusing "${item.rel}"`);
         continue;
       }
-      let abs = join72(opts.destDir, rel);
+      let abs = join73(opts.destDir, rel);
       if (!isInsideRoot(abs, opts.destDir)) {
         log7(`drop ${opts.dropId}: refusing a path outside the destination`);
         continue;
@@ -115028,13 +115481,13 @@ var RdeskServerChannel = class {
 };
 
 // ../../packages/host-core/dist/rdesk/channel-client.js
-import { readFileSync as readFileSync49 } from "node:fs";
-import { join as join73 } from "node:path";
+import { readFileSync as readFileSync50 } from "node:fs";
+import { join as join74 } from "node:path";
 var RECONNECT_MS = 2e3;
 var CLAIM_RETRY_MS = 5e3;
 function readEndpoint(dir2, selfPid) {
   try {
-    const s = JSON.parse(readFileSync49(join73(dir2, "status.json"), "utf8"));
+    const s = JSON.parse(readFileSync50(join74(dir2, "status.json"), "utf8"));
     if (selfPid && s.pid === selfPid)
       return null;
     return s.localPort && s.localToken ? `ws://127.0.0.1:${s.localPort}/?token=${s.localToken}` : null;
@@ -115479,10 +115932,10 @@ function registerRdpEngine() {
 // ../../packages/host-core/dist/rdesk/audit.js
 init_credentials();
 import { appendFile, stat as stat9, rename as rename4 } from "node:fs/promises";
-import { join as join74 } from "node:path";
+import { join as join75 } from "node:path";
 var MAX_BYTES2 = 2 * 1024 * 1024;
 function rdeskAuditPath() {
-  return join74(daemonDir2(), "rdesk-audit.jsonl");
+  return join75(daemonDir2(), "rdesk-audit.jsonl");
 }
 var queue = [];
 var draining = false;
@@ -115524,13 +115977,13 @@ function appendRdeskAudit(e) {
 
 // ../../packages/host-core/dist/fileprovider-bridge.js
 init_managed_spawn();
-import { writeFileSync as writeFileSync37, mkdirSync as mkdirSync38, rmSync as rmSync9, existsSync as existsSync36 } from "node:fs";
-import { homedir as homedir11 } from "node:os";
-import { join as join75 } from "node:path";
+import { writeFileSync as writeFileSync37, mkdirSync as mkdirSync38, rmSync as rmSync9, existsSync as existsSync37 } from "node:fs";
+import { homedir as homedir12 } from "node:os";
+import { join as join76 } from "node:path";
 init_safe_kill();
 var APPEX_BUNDLE_ID = "dev.tesseract.FileProvider";
 function appexBridgeInfoPath() {
-  return join75(homedir11(), "Library", "Containers", APPEX_BUNDLE_ID, "Data", "Library", "Application Support", "tesseract-bridge.json");
+  return join76(homedir12(), "Library", "Containers", APPEX_BUNDLE_ID, "Data", "Library", "Application Support", "tesseract-bridge.json");
 }
 function clearBridgeInfo() {
   if (process.platform !== "darwin")
@@ -115696,8 +116149,8 @@ function stopFileProviderBridge() {
 // ../../packages/host-core/dist/file-share-server.js
 import { createServer as createServer5 } from "node:http";
 import { randomBytes as randomBytes9 } from "node:crypto";
-import { existsSync as existsSync37, readFileSync as readFileSync50, writeFileSync as writeFileSync38, mkdirSync as mkdirSync39 } from "node:fs";
-import { join as join76, dirname as dirname34 } from "node:path";
+import { existsSync as existsSync38, readFileSync as readFileSync51, writeFileSync as writeFileSync38, mkdirSync as mkdirSync39 } from "node:fs";
+import { join as join77, dirname as dirname34 } from "node:path";
 init_credentials();
 var SHARE_PORTS = [47831, 47832, 47833, 47834, 47835, 47836, 47837, 47838];
 var CHUNK4 = 1024 * 1024;
@@ -115707,10 +116160,10 @@ var token2 = "";
 var log8 = () => {
 };
 function loadOrCreateToken() {
-  const file2 = join76(daemonDir2(), "file-share-token");
+  const file2 = join77(daemonDir2(), "file-share-token");
   try {
-    if (existsSync37(file2)) {
-      const t2 = readFileSync50(file2, "utf-8").trim();
+    if (existsSync38(file2)) {
+      const t2 = readFileSync51(file2, "utf-8").trim();
       if (/^[a-f0-9]{32}$/.test(t2))
         return t2;
     }
@@ -116106,9 +116559,9 @@ function fileShareToken() {
 // ../../packages/host-core/dist/file-share-mount.js
 import { execFile as execFile10 } from "node:child_process";
 import { promisify as promisify5 } from "node:util";
-import { homedir as homedir12 } from "node:os";
-import { existsSync as existsSync38, readFileSync as readFileSync51, appendFileSync as appendFileSync5, mkdirSync as mkdirSync40 } from "node:fs";
-import { join as join77, dirname as dirname35 } from "node:path";
+import { homedir as homedir13 } from "node:os";
+import { existsSync as existsSync39, readFileSync as readFileSync52, appendFileSync as appendFileSync5, mkdirSync as mkdirSync40 } from "node:fs";
+import { join as join78, dirname as dirname35 } from "node:path";
 var run3 = promisify5(execFile10);
 var OPTS = { timeout: 2e4, windowsHide: true };
 var mounted = false;
@@ -116120,9 +116573,9 @@ function davUri() {
 }
 function addGtkBookmark(uri, label) {
   try {
-    const file2 = join77(homedir12(), ".config", "gtk-3.0", "bookmarks");
+    const file2 = join78(homedir13(), ".config", "gtk-3.0", "bookmarks");
     const line = `${uri} ${label}`;
-    const cur = existsSync38(file2) ? readFileSync51(file2, "utf-8") : "";
+    const cur = existsSync39(file2) ? readFileSync52(file2, "utf-8") : "";
     if (cur.split("\n").some((l) => l.trim() === line))
       return;
     mkdirSync40(dirname35(file2), { recursive: true });
@@ -116207,9 +116660,9 @@ async function unmountFileShare(log10 = () => {
 
 // ../../packages/host-core/dist/vault/autofill-bridge.js
 import { randomBytes as randomBytes10 } from "node:crypto";
-import { existsSync as existsSync39, mkdirSync as mkdirSync41, writeFileSync as writeFileSync39, rmSync as rmSync10 } from "node:fs";
-import { homedir as homedir13 } from "node:os";
-import { join as join78 } from "node:path";
+import { existsSync as existsSync40, mkdirSync as mkdirSync41, writeFileSync as writeFileSync39, rmSync as rmSync10 } from "node:fs";
+import { homedir as homedir14 } from "node:os";
+import { join as join79 } from "node:path";
 
 // ../../packages/host-core/dist/vault/peer-verify.js
 import { execFile as execFile11 } from "node:child_process";
@@ -116271,10 +116724,10 @@ async function isTrustedAutofillPeer(remotePort) {
 var APPEX_BUNDLE_ID2 = "dev.tesseract.AutoFill";
 var BRIDGE_PORTS2 = [17872, 17873, 17874, 17875];
 function appexContainerData() {
-  return join78(homedir13(), "Library", "Containers", APPEX_BUNDLE_ID2, "Data");
+  return join79(homedir14(), "Library", "Containers", APPEX_BUNDLE_ID2, "Data");
 }
 function bridgeInfoPath() {
-  return join78(appexContainerData(), "Library", "Application Support", "tesseract-autofill-bridge.json");
+  return join79(appexContainerData(), "Library", "Application Support", "tesseract-autofill-bridge.json");
 }
 var infoLoggedOnce = false;
 function writeBridgeInfo(port, token4, log10) {
@@ -116282,14 +116735,14 @@ function writeBridgeInfo(port, token4, log10) {
     return;
   const containerData = appexContainerData();
   try {
-    if (!existsSync39(containerData)) {
+    if (!existsSync40(containerData)) {
       if (!infoLoggedOnce) {
         infoLoggedOnce = true;
         log10("autofill bridge-info SKIP: no appex container yet at", containerData);
       }
       return;
     }
-    const dir2 = join78(containerData, "Library", "Application Support");
+    const dir2 = join79(containerData, "Library", "Application Support");
     mkdirSync41(dir2, { recursive: true });
     writeFileSync39(bridgeInfoPath(), JSON.stringify({ port, token: token4, pid: process.pid, ts: Date.now() }), { mode: 384 });
     if (!infoLoggedOnce) {
@@ -116530,30 +116983,30 @@ function createNodePowerController() {
 }
 
 // ../../packages/host-core/dist/native-host.js
-import { execFileSync as execFileSync4 } from "node:child_process";
-import { chmodSync as chmodSync6, existsSync as existsSync40, mkdirSync as mkdirSync42, writeFileSync as writeFileSync40 } from "node:fs";
-import { homedir as homedir14, platform as platform5 } from "node:os";
-import { dirname as dirname36, join as join79, resolve as resolve12 } from "node:path";
+import { execFileSync as execFileSync5 } from "node:child_process";
+import { chmodSync as chmodSync6, existsSync as existsSync41, mkdirSync as mkdirSync42, writeFileSync as writeFileSync40 } from "node:fs";
+import { homedir as homedir15, platform as platform5 } from "node:os";
+import { dirname as dirname36, join as join80, resolve as resolve12 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 var HOST_NAME = "com.tesseract.companion";
 var EXTENSION_IDS = ["icpnghhpcmaonjckkpilpajblfehpplo", "giolfpookdhjfafcchaflhmigghaeffn"];
 var BRIDGE_BASENAME = "host.cjs";
 function browserProfileDirs() {
-  const home = homedir14();
+  const home = homedir15();
   const p = platform5();
   if (p === "darwin") {
-    const base = join79(home, "Library/Application Support");
-    return ["Google/Chrome", "Google/Chrome Beta", "Google/Chrome Dev", "Google/Chrome Canary", "Chromium", "Microsoft Edge", "BraveSoftware/Brave-Browser", "Vivaldi", "Arc"].map((b) => join79(base, b));
+    const base = join80(home, "Library/Application Support");
+    return ["Google/Chrome", "Google/Chrome Beta", "Google/Chrome Dev", "Google/Chrome Canary", "Chromium", "Microsoft Edge", "BraveSoftware/Brave-Browser", "Vivaldi", "Arc"].map((b) => join80(base, b));
   }
   if (p === "win32")
     return [];
-  const cfg2 = join79(home, ".config");
-  return ["google-chrome", "google-chrome-beta", "chromium", "microsoft-edge", "BraveSoftware/Brave-Browser", "vivaldi"].map((b) => join79(cfg2, b));
+  const cfg2 = join80(home, ".config");
+  return ["google-chrome", "google-chrome-beta", "chromium", "microsoft-edge", "BraveSoftware/Brave-Browser", "vivaldi"].map((b) => join80(cfg2, b));
 }
 function resolveBridge(log10) {
   const candidates = [
     process.env.CCB_COMPANION_HOST_JS,
-    process.resourcesPath ? join79(process.resourcesPath, "companion-host", BRIDGE_BASENAME) : void 0
+    process.resourcesPath ? join80(process.resourcesPath, "companion-host", BRIDGE_BASENAME) : void 0
   ];
   try {
     const here = dirname36(fileURLToPath6(import.meta.url));
@@ -116562,14 +117015,14 @@ function resolveBridge(log10) {
   } catch {
   }
   for (const c of candidates)
-    if (c && existsSync40(c))
+    if (c && existsSync41(c))
       return c;
   log10("companion native-host: bridge not found; skipping registration (looked in", candidates.filter(Boolean).join(" , "), ")");
   return null;
 }
 function writeLauncher(daemonDir3, bridge, runtime) {
   const isWin = platform5() === "win32";
-  const launcher = join79(daemonDir3, isWin ? "companion-host.cmd" : "companion-host.sh");
+  const launcher = join80(daemonDir3, isWin ? "companion-host.cmd" : "companion-host.sh");
   if (isWin) {
     writeFileSync40(launcher, `@echo off\r
 set ELECTRON_RUN_AS_NODE=1\r
@@ -116604,12 +117057,12 @@ function registerNativeHost(opts) {
       return registerWindows(opts.daemonDir, manifestJson, log10);
     let wrote = 0;
     for (const profile of browserProfileDirs()) {
-      if (!existsSync40(profile))
+      if (!existsSync41(profile))
         continue;
       try {
-        const dir2 = join79(profile, "NativeMessagingHosts");
+        const dir2 = join80(profile, "NativeMessagingHosts");
         mkdirSync42(dir2, { recursive: true });
-        writeFileSync40(join79(dir2, `${HOST_NAME}.json`), manifestJson);
+        writeFileSync40(join80(dir2, `${HOST_NAME}.json`), manifestJson);
         wrote++;
       } catch {
       }
@@ -116621,11 +117074,11 @@ function registerNativeHost(opts) {
 }
 function registerWindows(daemonDir3, manifestJson, log10) {
   try {
-    const manifestPath = join79(daemonDir3, `${HOST_NAME}.json`);
+    const manifestPath = join80(daemonDir3, `${HOST_NAME}.json`);
     writeFileSync40(manifestPath, manifestJson);
     for (const root of ["Software\\Google\\Chrome", "Software\\Microsoft\\Edge", "Software\\BraveSoftware\\Brave-Browser"]) {
       try {
-        execFileSync4("reg", ["add", `HKCU\\${root}\\NativeMessagingHosts\\${HOST_NAME}`, "/ve", "/t", "REG_SZ", "/d", manifestPath, "/f"], { stdio: "ignore" });
+        execFileSync5("reg", ["add", `HKCU\\${root}\\NativeMessagingHosts\\${HOST_NAME}`, "/ve", "/t", "REG_SZ", "/d", manifestPath, "/f"], { stdio: "ignore" });
       } catch {
       }
     }
@@ -116640,10 +117093,10 @@ init_daemon_settings();
 
 // ../../packages/host-core/dist/activity/activity-tracker.js
 init_credentials();
-import { promises as fsp, writeFileSync as writeFileSync41, mkdirSync as mkdirSync43, existsSync as existsSync41 } from "node:fs";
-import { join as join80 } from "node:path";
+import { promises as fsp, writeFileSync as writeFileSync41, mkdirSync as mkdirSync43, existsSync as existsSync42 } from "node:fs";
+import { join as join81 } from "node:path";
 function activityProfilePath() {
-  return join80(daemonDir2(), "activity-profile.json");
+  return join81(daemonDir2(), "activity-profile.json");
 }
 var MAX_APPS = 300;
 var MAX_AGE_DAYS = 120;
@@ -116718,7 +117171,7 @@ function createActivityTracker(opts = {}) {
         return;
       const key2 = front.bundleId || front.name;
       await ensureLoaded();
-      if (profile && Object.keys(profile.apps).length && !existsSync41(activityProfilePath())) {
+      if (profile && Object.keys(profile.apps).length && !existsSync42(activityProfilePath())) {
         log10("activity profile cleared externally \u2014 resetting in-memory");
         profile = { version: 1, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), apps: {} };
       }
@@ -116835,15 +117288,15 @@ init_credentials();
 
 // ../../packages/shared/dist/identity.js
 init_base_paths();
-import { existsSync as existsSync42, mkdirSync as mkdirSync44, readFileSync as readFileSync52, writeFileSync as writeFileSync42 } from "node:fs";
-import { dirname as dirname37, join as join81 } from "node:path";
+import { existsSync as existsSync43, mkdirSync as mkdirSync44, readFileSync as readFileSync53, writeFileSync as writeFileSync42 } from "node:fs";
+import { dirname as dirname37, join as join82 } from "node:path";
 import { randomUUID as randomUUID31 } from "node:crypto";
 function deviceIdFile() {
-  return join81(tesseractHome(), "device-id.json");
+  return join82(tesseractHome(), "device-id.json");
 }
 function readPersistedDeviceId() {
   try {
-    const raw = JSON.parse(readFileSync52(deviceIdFile(), "utf-8"));
+    const raw = JSON.parse(readFileSync53(deviceIdFile(), "utf-8"));
     return typeof raw.deviceId === "string" && raw.deviceId ? raw.deviceId : null;
   } catch {
     return null;
@@ -116857,7 +117310,7 @@ function persistentDeviceId() {
   try {
     const f = deviceIdFile();
     const dir2 = dirname37(f);
-    if (!existsSync42(dir2))
+    if (!existsSync43(dir2))
       mkdirSync44(dir2, { recursive: true });
     writeFileSync42(f, JSON.stringify({ deviceId: id }));
   } catch {
@@ -117013,12 +117466,13 @@ var REFRESH_INTERVAL_MS2 = 12 * 60 * 60 * 1e3;
 async function runDaemon(opts = {}) {
   const VERSION3 = opts.version ?? process.env.CCB_DAEMON_VERSION ?? "dev";
   const TAG = opts.tag ?? "host-daemon";
+  const KIND = opts.kind ?? "app";
   const log10 = (...args) => console.log(`[${TAG} ${(/* @__PURE__ */ new Date()).toISOString()}]`, ...args);
   log10("paths", JSON.stringify(sealBasePaths()));
   const OUR_STARTED_AT = procStartedAt(process.pid);
   let ownsMachine = false;
-  const pidfile = () => join82(daemonDir2(), "daemon.lock");
-  const statusFile = () => join82(daemonDir2(), "status.json");
+  const pidfile2 = () => join83(daemonDir2(), "daemon.lock");
+  const statusFile2 = () => join83(daemonDir2(), "status.json");
   const isAlive2 = (pid) => {
     if (!Number.isFinite(pid) || pid <= 0)
       return false;
@@ -117031,7 +117485,7 @@ async function runDaemon(opts = {}) {
   };
   const lockHeldByAnother = () => {
     try {
-      const pid = Number(readFileSync53(pidfile(), "utf-8").trim());
+      const pid = Number(readFileSync54(pidfile2(), "utf-8").trim());
       return Number.isFinite(pid) && pid > 0 && pid !== process.pid && isAlive2(pid);
     } catch {
       return false;
@@ -117039,7 +117493,7 @@ async function runDaemon(opts = {}) {
   };
   const lockHeldByYieldingSubset = () => {
     try {
-      const pid = Number(readFileSync53(pidfile(), "utf-8").trim());
+      const pid = Number(readFileSync54(pidfile2(), "utf-8").trim());
       if (!Number.isFinite(pid) || pid <= 0 || pid === process.pid || !isAlive2(pid))
         return false;
       return liveDaemons().some((d) => d.pid === pid && d.rdeskOnly === true);
@@ -117048,9 +117502,9 @@ async function runDaemon(opts = {}) {
     }
   };
   function acquireLock2() {
-    const f = pidfile();
+    const f = pidfile2();
     try {
-      if (!existsSync43(daemonDir2()))
+      if (!existsSync44(daemonDir2()))
         mkdirSync45(daemonDir2(), { recursive: true, mode: 448 });
     } catch {
     }
@@ -117060,12 +117514,12 @@ async function runDaemon(opts = {}) {
         return true;
       } catch {
         try {
-          const prev = Number(readFileSync53(f, "utf-8").trim());
+          const prev = Number(readFileSync54(f, "utf-8").trim());
           if (!prev)
             return false;
           if (prev !== process.pid && isAlive2(prev))
             return false;
-          unlinkSync7(f);
+          unlinkSync8(f);
         } catch {
           return false;
         }
@@ -117075,9 +117529,9 @@ async function runDaemon(opts = {}) {
   }
   function releaseLock() {
     try {
-      const f = pidfile();
-      if (existsSync43(f) && Number(readFileSync53(f, "utf-8").trim()) === process.pid)
-        unlinkSync7(f);
+      const f = pidfile2();
+      if (existsSync44(f) && Number(readFileSync54(f, "utf-8").trim()) === process.pid)
+        unlinkSync8(f);
     } catch {
     }
   }
@@ -117086,14 +117540,21 @@ async function runDaemon(opts = {}) {
     if (!ownsMachine)
       return;
     try {
-      writeFileSync43(statusFile(), JSON.stringify({ pid: process.pid, startedAt: OUR_STARTED_AT, role: process.env.CCB_RDESK_ROLE ?? "host", version: VERSION3, execPath: process.env.CCB_DAEMON_EXECPATH ?? process.execPath, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), gui: daemonGuiTrayActive(), ...localInfo ?? {}, ...s }));
-      chmodSync7(statusFile(), 384);
+      writeFileSync43(statusFile2(), JSON.stringify({ pid: process.pid, startedAt: OUR_STARTED_AT, role: process.env.CCB_RDESK_ROLE ?? "host", kind: KIND, version: VERSION3, execPath: process.env.CCB_DAEMON_EXECPATH ?? process.execPath, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), gui: daemonGuiTrayActive(), ...localInfo ?? {}, ...s }));
+      chmodSync7(statusFile2(), 384);
     } catch {
     }
   }
   const standaloneViewer = process.env.CCB_RDESK_ROLE === "client";
   if (!standaloneViewer) {
     registerSelfAsDaemon(VERSION3);
+    if (KIND === "app") {
+      try {
+        await evictCliAgent(log10);
+      } catch (e) {
+        log10("[cli-agent] eviction failed:", e?.message ?? e);
+      }
+    }
     if (acquireLock2()) {
       ownsMachine = true;
     } else if (!WE_ARE_RDESK_ONLY && lockHeldByYieldingSubset()) {
@@ -117111,6 +117572,12 @@ async function runDaemon(opts = {}) {
         unregisterSelfAsDaemon();
         ownsMachine = false;
       }
+    } else if (KIND === "cli") {
+      log10("the Tesseract desktop app already owns this machine \u2014 standing down.");
+      log10("the desktop app and the tesseract-agent CLI cannot both run here; uninstall one (`npm uninstall -g tesseract-agent`) to stop seeing this.");
+      unregisterSelfAsDaemon();
+      releaseLock();
+      process.exit(0);
     } else {
       log10("another live instance already owns this machine (holds the pid lock) \u2014 not taking over");
       unregisterSelfAsDaemon();
@@ -117193,7 +117660,7 @@ async function runDaemon(opts = {}) {
   }
   const snapshotProcs = (tag) => {
     try {
-      const raw = execFileSync5("ps", ["-axww", "-o", "pid=,ppid=,pcpu=,etime=,command="], { encoding: "utf8", timeout: 3e3 });
+      const raw = execFileSync6("ps", ["-axww", "-o", "pid=,ppid=,pcpu=,etime=,command="], { encoding: "utf8", timeout: 3e3 });
       const rows = raw.split("\n").filter((l) => /[Tt]esseract|host-daemon/.test(l) && !/\bgrep\b|ps -axww/.test(l));
       log10(`PROC-SNAPSHOT [${tag}] me=${process.pid} ppid=${process.ppid} \u2014 ${rows.length} tesseract proc(s):`);
       for (const r of rows.slice(0, 40))
@@ -117636,7 +118103,7 @@ async function runDaemon(opts = {}) {
         if (r.status === 401) {
           log10("device token no longer valid \u2014 dropping to local-only on restart");
           try {
-            unlinkSync7(join82(daemonDir2(), "credentials.json"));
+            unlinkSync8(join83(daemonDir2(), "credentials.json"));
           } catch {
           }
           shutdown(0, "token-revoked-401");
@@ -117708,7 +118175,7 @@ async function runDaemon(opts = {}) {
     deviceId: () => c.deviceId,
     ownHostId: () => ownHost() || null,
     canPrompt: () => !!electronModule(),
-    confirm: async (spec, signal) => (await confirmAction(spec, { signal })).confirmed,
+    confirm: async (spec, signal2) => (await confirmAction(spec, { signal: signal2 })).confirmed,
     // Store-and-forward: we won the claim, so pull the bytes and (for cross-user
     // drops) open the one seal in the fan-out that was made for THIS device.
     fetchBlobDrop: async ({ dropId, destDir, claim, sender }) => {
@@ -117953,7 +118420,7 @@ async function runDaemon(opts = {}) {
     let freeTicks = 0;
     const lockHolder = () => {
       try {
-        return Number(readFileSync53(pidfile(), "utf-8").trim()) || 0;
+        return Number(readFileSync54(pidfile2(), "utf-8").trim()) || 0;
       } catch {
         return 0;
       }
@@ -118123,7 +118590,7 @@ async function runDaemon(opts = {}) {
     onDeviceRevoked: () => {
       log10("this machine was removed from the account \u2014 dropping its credentials; it speaks for itself again");
       try {
-        unlinkSync7(join82(daemonDir2(), "credentials.json"));
+        unlinkSync8(join83(daemonDir2(), "credentials.json"));
       } catch {
       }
       void reloadIdentity();
@@ -118176,7 +118643,7 @@ async function runDaemon(opts = {}) {
     if (appPid > 0 && appPid !== process.pid) {
       const quitMarker = () => {
         try {
-          return Number(readFileSync53(join82(daemonDir2(), "app-quit.marker"), "utf-8").trim()) || 0;
+          return Number(readFileSync54(join83(daemonDir2(), "app-quit.marker"), "utf-8").trim()) || 0;
         } catch {
           return 0;
         }
@@ -118201,7 +118668,7 @@ async function runDaemon(opts = {}) {
           log10(`desktop app (pid ${appPid}) is gone with NO clean-quit marker \u2014 reporting`);
           const tail3 = (name) => {
             try {
-              const buf = readFileSync53(join82(daemonDir2(), name), "utf-8");
+              const buf = readFileSync54(join83(daemonDir2(), name), "utf-8");
               return buf.length > 4096 ? buf.slice(-4096) : buf;
             } catch {
               return void 0;
@@ -118232,11 +118699,11 @@ async function runDaemon(opts = {}) {
   }
   try {
     const DAEMON_LOG_CAP = 2 * 1024 * 1024;
-    const daemonLogFile = join82(daemonDir2(), "daemon.log");
+    const daemonLogFile = join83(daemonDir2(), "daemon.log");
     const capTimer = setInterval(() => {
       try {
-        if (existsSync43(daemonLogFile) && statSync17(daemonLogFile).size > DAEMON_LOG_CAP) {
-          const buf = readFileSync53(daemonLogFile, "utf-8");
+        if (existsSync44(daemonLogFile) && statSync17(daemonLogFile).size > DAEMON_LOG_CAP) {
+          const buf = readFileSync54(daemonLogFile, "utf-8");
           const kept = `\u2026[daemon.log capped at ${(/* @__PURE__ */ new Date()).toISOString()}]\u2026
 ` + buf.slice(-DAEMON_LOG_CAP / 2);
           writeFileSync43(daemonLogFile, kept);
@@ -118345,15 +118812,15 @@ init_credentials();
 
 // ../../packages/host-core/dist/net-service/ensure-installed.js
 import { execFile as execFile16 } from "node:child_process";
-import { existsSync as existsSync48 } from "node:fs";
-import { dirname as dirname40, join as join87 } from "node:path";
+import { existsSync as existsSync49 } from "node:fs";
+import { dirname as dirname40, join as join88 } from "node:path";
 import { promisify as promisify11 } from "node:util";
 
 // ../../packages/host-core/dist/net-service/launchd-system.js
 import { spawn as spawn9 } from "node:child_process";
-import { existsSync as existsSync45, mkdtempSync as mkdtempSync2, writeFileSync as writeFileSync44, rmSync as rmSync11, readFileSync as readFileSync54 } from "node:fs";
+import { existsSync as existsSync46, mkdtempSync as mkdtempSync2, writeFileSync as writeFileSync44, rmSync as rmSync11, readFileSync as readFileSync55 } from "node:fs";
 import { tmpdir as tmpdir6 } from "node:os";
-import { join as join84 } from "node:path";
+import { join as join85 } from "node:path";
 
 // ../../packages/host-core/dist/net-service/owner-uid.js
 function installOwnerUid(env = process.env, self2 = typeof process.getuid === "function" ? process.getuid() : 0) {
@@ -118398,14 +118865,14 @@ async function alreadyElevated() {
 }
 
 // ../../packages/host-core/dist/net-service/app-bundle.js
-import { execFileSync as execFileSync6 } from "node:child_process";
-import { existsSync as existsSync44 } from "node:fs";
-import { dirname as dirname38, basename as basename16, join as join83 } from "node:path";
+import { execFileSync as execFileSync7 } from "node:child_process";
+import { existsSync as existsSync45 } from "node:fs";
+import { dirname as dirname38, basename as basename16, join as join84 } from "node:path";
 function appBundleFor(exec2) {
   let found;
   let dir2 = dirname38(exec2);
   for (let prev = ""; dir2 !== prev; prev = dir2, dir2 = dirname38(dir2)) {
-    if (basename16(dir2).endsWith(".app") && existsSync44(join83(dir2, "Contents", "Info.plist"))) {
+    if (basename16(dir2).endsWith(".app") && existsSync45(join84(dir2, "Contents", "Info.plist"))) {
       found = dir2;
     }
   }
@@ -118421,7 +118888,7 @@ function bundleIdForExec(exec2) {
   if (!bundle)
     return void 0;
   try {
-    const id = execFileSync6("/usr/bin/plutil", ["-extract", "CFBundleIdentifier", "raw", "-o", "-", join83(bundle, "Contents", "Info.plist")], { encoding: "utf8", timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const id = execFileSync7("/usr/bin/plutil", ["-extract", "CFBundleIdentifier", "raw", "-o", "-", join84(bundle, "Contents", "Info.plist")], { encoding: "utf8", timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] }).trim();
     return looksLikeBundleId(id) ? id : void 0;
   } catch {
     return void 0;
@@ -118486,9 +118953,9 @@ ${args}
     <key>ProcessType</key>
     <string>Interactive</string>
     <key>StandardErrorPath</key>
-    <string>${xml(join84(spec.stateDir, "netd.log"))}</string>
+    <string>${xml(join85(spec.stateDir, "netd.log"))}</string>
     <key>StandardOutPath</key>
-    <string>${xml(join84(spec.stateDir, "netd.log"))}</string>
+    <string>${xml(join85(spec.stateDir, "netd.log"))}</string>
   </dict>
 </plist>
 `;
@@ -118501,8 +118968,8 @@ function runForCode(cmd, args) {
   });
 }
 async function elevate(script) {
-  const dir2 = mkdtempSync2(join84(tmpdir6(), "tesseract-netd-"));
-  const path6 = join84(dir2, "install.sh");
+  const dir2 = mkdtempSync2(join85(tmpdir6(), "tesseract-netd-"));
+  const path6 = join85(dir2, "install.sh");
   try {
     writeFileSync44(path6, script, { mode: 384 });
     if (await alreadyElevated()) {
@@ -118564,9 +119031,9 @@ ${plist}TESSERACT_PLIST_EOF`,
       };
     },
     async state() {
-      if (!existsSync45(PLIST))
+      if (!existsSync46(PLIST))
         return { installed: false, running: false };
-      const text12 = readFileSync54(PLIST, "utf8");
+      const text12 = readFileSync55(PLIST, "utf8");
       const owner = parseOwnerUid(text12);
       const assoc = parseAssociatedBundleId(text12);
       const running2 = await netdAvailable();
@@ -118587,7 +119054,7 @@ ${plist}TESSERACT_PLIST_EOF`,
 
 // ../../packages/host-core/dist/net-service/systemd-system.js
 import { spawn as spawn11 } from "node:child_process";
-import { existsSync as existsSync46, readFileSync as readFileSync55 } from "node:fs";
+import { existsSync as existsSync47, readFileSync as readFileSync56 } from "node:fs";
 
 // ../../packages/host-core/dist/service/exec.js
 import { execFile as execFile13, spawn as spawn10 } from "node:child_process";
@@ -118755,9 +119222,9 @@ function makeSystemdSystem() {
       return code === 0 ? { ok: true } : { ok: false, detail: `removing the helper failed (exit ${code})` };
     },
     async state() {
-      if (!existsSync46(UNIT_PATH))
+      if (!existsSync47(UNIT_PATH))
         return { installed: false, running: false };
-      const owner = parseOwnerUid(readFileSync55(UNIT_PATH, "utf8"));
+      const owner = parseOwnerUid(readFileSync56(UNIT_PATH, "utf8"));
       const active = await tryRun("systemctl", ["is-active", UNIT]);
       const running2 = active.stdout.trim() === "active";
       const own2 = owner === void 0 ? {} : { ownerUid: owner };
@@ -118784,7 +119251,7 @@ function sh2(s) {
 import { execFile as execFile14, spawn as spawn12 } from "node:child_process";
 import { mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync45, rmSync as rmSync12 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
-import { join as join85 } from "node:path";
+import { join as join86 } from "node:path";
 import { promisify as promisify9 } from "node:util";
 var run7 = promisify9(execFile14);
 var SERVICE = "TesseractNetd";
@@ -118812,8 +119279,8 @@ function buildBinaryPath(spec) {
   return parts.map((p) => `"${p}"`).join(" ");
 }
 async function elevatePowerShell(script) {
-  const dir2 = mkdtempSync3(join85(tmpdir7(), "tesseract-netd-"));
-  const inner = join85(dir2, "install.ps1");
+  const dir2 = mkdtempSync3(join86(tmpdir7(), "tesseract-netd-"));
+  const inner = join86(dir2, "install.ps1");
   writeFileSync45(inner, script, { encoding: "utf8" });
   if (await alreadyElevated()) {
     return new Promise((resolve16) => {
@@ -118829,7 +119296,7 @@ async function elevatePowerShell(script) {
       p.on("close", (code) => finish(code ?? 1));
     });
   }
-  const outer = join85(dir2, "elevate.ps1");
+  const outer = join86(dir2, "elevate.ps1");
   writeFileSync45(outer, [
     '$ErrorActionPreference = "Stop"',
     "try {",
@@ -119018,15 +119485,15 @@ function makeNetService() {
 }
 
 // ../../packages/host-core/dist/net-service/netd-binary.js
-import { existsSync as existsSync47 } from "node:fs";
-import { dirname as dirname39, join as join86 } from "node:path";
+import { existsSync as existsSync48 } from "node:fs";
+import { dirname as dirname39, join as join87 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 function netdBinaryName() {
   return process.platform === "win32" ? "tesseract-netd.exe" : "tesseract-netd";
 }
 function override2() {
   const p = process.env.CCB_NETD_BIN;
-  return p && existsSync47(p) ? p : null;
+  return p && existsSync48(p) ? p : null;
 }
 function netdBinaryPath() {
   const fromEnv = override2();
@@ -119036,24 +119503,24 @@ function netdBinaryPath() {
   const candidates = [];
   const resources = process.resourcesPath;
   if (resources)
-    candidates.push(join86(resources, "netd", name));
+    candidates.push(join87(resources, "netd", name));
   try {
     const here = dirname39(fileURLToPath7(import.meta.url));
-    candidates.push(join86(here, "..", "..", "netd", name));
-    candidates.push(join86(here, "..", "..", "..", "netd", name));
+    candidates.push(join87(here, "..", "..", "netd", name));
+    candidates.push(join87(here, "..", "..", "..", "netd", name));
     const triple = `${process.platform}-${process.arch}`;
-    for (const root of [here, join86(here, ".."), join86(here, "..", "..")]) {
-      candidates.push(join86(root, "mesh-core", "prebuilds", triple, "netd", name));
+    for (const root of [here, join87(here, ".."), join87(here, "..", "..")]) {
+      candidates.push(join87(root, "mesh-core", "prebuilds", triple, "netd", name));
     }
   } catch {
   }
   if (process.env.CCB_REPO_ROOT) {
-    candidates.push(join86(process.env.CCB_REPO_ROOT, "crates", "target", "release", name));
+    candidates.push(join87(process.env.CCB_REPO_ROOT, "crates", "target", "release", name));
   }
-  candidates.push(join86(process.cwd(), "crates", "target", "release", name));
+  candidates.push(join87(process.cwd(), "crates", "target", "release", name));
   for (const c of candidates) {
     try {
-      if (existsSync47(c))
+      if (existsSync48(c))
         return c;
     } catch {
     }
@@ -119097,7 +119564,7 @@ async function ensureNetHelperInstalled() {
   if (st.installed && !mismatched && !misattributed)
     return { ok: true, already: true };
   const exec2 = netdBinaryPath();
-  if (exec2 && process.platform === "win32" && !existsSync48(join87(dirname40(exec2), "wintun.dll"))) {
+  if (exec2 && process.platform === "win32" && !existsSync49(join88(dirname40(exec2), "wintun.dll"))) {
     return {
       ok: false,
       reason: "no-binary",
@@ -119151,19 +119618,43 @@ import { platform as platform6 } from "node:os";
 
 // ../../packages/host-core/dist/service/launchd.js
 init_credentials();
-import { writeFileSync as writeFileSync46, existsSync as existsSync49, mkdirSync as mkdirSync46, unlinkSync as unlinkSync8 } from "node:fs";
-import { dirname as dirname41, join as join88 } from "node:path";
-import { homedir as homedir15, userInfo as userInfo2 } from "node:os";
+import { writeFileSync as writeFileSync46, existsSync as existsSync50, mkdirSync as mkdirSync46, unlinkSync as unlinkSync9, readFileSync as readFileSync57 } from "node:fs";
+import { dirname as dirname41, join as join89 } from "node:path";
+import { homedir as homedir16, userInfo as userInfo2 } from "node:os";
+
+// ../../packages/host-core/dist/service/legacy-label.js
+function definitionIsCli(text12) {
+  if (!text12)
+    return false;
+  return /node_modules[/\\]tesseract-agent[/\\]/.test(text12) || /[/\\]bin[/\\]tesseract-agent(\.cmd|\.exe)?["'\s]*$/m.test(text12) || /[/\\]bin[/\\]tesseract-agent(\.cmd|\.exe)?[<"'\s]/.test(text12);
+}
+
+// ../../packages/host-core/dist/service/launchd.js
 function xml2(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 function makeLaunchd(instanceId) {
   const suffix = instanceSuffix(instanceId);
   const label = SERVICE_LABEL_BASE + (suffix ? `.${suffix}` : "");
-  const plistPath = () => join88(homedir15(), "Library", "LaunchAgents", `${label}.plist`);
+  const plistPath = () => join89(homedir16(), "Library", "LaunchAgents", `${label}.plist`);
   const domainTarget = () => `gui/${userInfo2().uid}`;
   const serviceTarget = () => `${domainTarget()}/${label}`;
-  const logFile = () => join88(daemonDir2(), "daemon.log");
+  const logFile = () => join89(daemonDir2(), "daemon.log");
+  const legacyLabel = LEGACY_SERVICE_LABEL_BASE + (suffix ? `.${suffix}` : "");
+  const legacyPlistPath = () => join89(homedir16(), "Library", "LaunchAgents", `${legacyLabel}.plist`);
+  async function removeLegacySharedJob() {
+    try {
+      const p = legacyPlistPath();
+      if (!existsSync50(p))
+        return;
+      if (!definitionIsCli(readFileSync57(p, "utf-8")))
+        return;
+      await run6("launchctl", ["bootout", `${domainTarget()}/${legacyLabel}`]).catch(() => {
+      });
+      unlinkSync9(p);
+    } catch {
+    }
+  }
   const workDirOf = (spec) => spec.workingDirectory ?? daemonDir2();
   function buildPlist2(spec) {
     const args = [spec.exec, ...spec.args].map((a) => `      <string>${xml2(a)}</string>`).join("\n");
@@ -119238,6 +119729,7 @@ ${env}
   };
   return {
     async install(spec) {
+      await removeLegacySharedJob();
       mkdirSync46(workDirOf(spec), { recursive: true });
       mkdirSync46(dirname41(plistPath()), { recursive: true });
       mkdirSync46(dirname41(spec.logPath), { recursive: true });
@@ -119257,9 +119749,9 @@ ${env}
     async uninstall() {
       await run6("launchctl", ["bootout", serviceTarget()]).catch(() => {
       });
-      if (existsSync49(plistPath())) {
+      if (existsSync50(plistPath())) {
         try {
-          unlinkSync8(plistPath());
+          unlinkSync9(plistPath());
         } catch {
         }
       }
@@ -119268,7 +119760,7 @@ ${env}
       await this.install(spec);
     },
     async isInstalled() {
-      return existsSync49(plistPath());
+      return existsSync50(plistPath());
     },
     async start() {
       await run6("launchctl", ["bootstrap", domainTarget(), plistPath()]).catch(() => {
@@ -119285,7 +119777,7 @@ ${env}
     },
     async logs(follow) {
       const f = logFile();
-      if (!existsSync49(f)) {
+      if (!existsSync50(f)) {
         console.log(`No log yet at ${f} \u2014 has the service started?`);
         return;
       }
@@ -119296,9 +119788,9 @@ ${env}
 
 // ../../packages/host-core/dist/service/systemd.js
 init_credentials();
-import { writeFileSync as writeFileSync47, existsSync as existsSync50, mkdirSync as mkdirSync47, unlinkSync as unlinkSync9 } from "node:fs";
-import { dirname as dirname42, join as join89 } from "node:path";
-import { homedir as homedir16, userInfo as userInfo3 } from "node:os";
+import { writeFileSync as writeFileSync47, existsSync as existsSync51, mkdirSync as mkdirSync47, unlinkSync as unlinkSync10, readFileSync as readFileSync58 } from "node:fs";
+import { dirname as dirname42, join as join90 } from "node:path";
+import { homedir as homedir17, userInfo as userInfo3 } from "node:os";
 function unitVal2(v) {
   return v.replace(/%/g, "%%");
 }
@@ -119307,11 +119799,28 @@ function shq(s) {
 }
 function makeSystemd(instanceId) {
   const suffix = instanceSuffix(instanceId);
-  const unit = `tesseract-host${suffix ? `-${suffix}` : ""}.service`;
+  const unit = `tesseract-agent${suffix ? `-${suffix}` : ""}.service`;
+  const legacyUnit = `tesseract-host${suffix ? `-${suffix}` : ""}.service`;
   const unitPath = () => {
-    const base = process.env.XDG_CONFIG_HOME || join89(homedir16(), ".config");
-    return join89(base, "systemd", "user", unit);
+    const base = process.env.XDG_CONFIG_HOME || join90(homedir17(), ".config");
+    return join90(base, "systemd", "user", unit);
   };
+  async function removeLegacySharedUnit() {
+    try {
+      const base = process.env.XDG_CONFIG_HOME || join90(homedir17(), ".config");
+      const p = join90(base, "systemd", "user", legacyUnit);
+      if (!existsSync51(p))
+        return;
+      if (!definitionIsCli(readFileSync58(p, "utf-8")))
+        return;
+      await run6("systemctl", ["--user", "disable", "--now", legacyUnit]).catch(() => {
+      });
+      unlinkSync10(p);
+      await run6("systemctl", ["--user", "daemon-reload"]).catch(() => {
+      });
+    } catch {
+    }
+  }
   const workDirOf = (spec) => spec.workingDirectory ?? daemonDir2();
   function buildUnit2(spec) {
     const execStart = [spec.exec, ...spec.args].map(shq).join(" ");
@@ -119337,6 +119846,7 @@ WantedBy=default.target
   }
   return {
     async install(spec) {
+      await removeLegacySharedUnit();
       mkdirSync47(workDirOf(spec), { recursive: true });
       mkdirSync47(dirname42(unitPath()), { recursive: true });
       mkdirSync47(dirname42(spec.logPath), { recursive: true });
@@ -119352,9 +119862,9 @@ WantedBy=default.target
     async uninstall() {
       await run6("systemctl", ["--user", "disable", "--now", unit]).catch(() => {
       });
-      if (existsSync50(unitPath())) {
+      if (existsSync51(unitPath())) {
         try {
-          unlinkSync9(unitPath());
+          unlinkSync10(unitPath());
         } catch {
         }
       }
@@ -119365,7 +119875,7 @@ WantedBy=default.target
       await this.install(spec);
     },
     async isInstalled() {
-      return existsSync50(unitPath());
+      return existsSync51(unitPath());
     },
     async start() {
       await run6("systemctl", ["--user", "start", unit]);
@@ -119377,8 +119887,8 @@ WantedBy=default.target
       await runInherit("systemctl", ["--user", "status", unit, "--no-pager"]);
     },
     async logs(follow) {
-      const f = join89(daemonDir2(), "daemon.log");
-      if (existsSync50(f)) {
+      const f = join90(daemonDir2(), "daemon.log");
+      if (existsSync51(f)) {
         await runInherit("tail", follow ? ["-f", f] : ["-n", "200", f]);
         return;
       }
@@ -119390,12 +119900,12 @@ WantedBy=default.target
 
 // ../../packages/host-core/dist/service/windows.js
 init_credentials();
-import { writeFileSync as writeFileSync48, existsSync as existsSync51, mkdirSync as mkdirSync48, unlinkSync as unlinkSync10, readFileSync as readFileSync56 } from "node:fs";
-import { dirname as dirname43, join as join90 } from "node:path";
+import { writeFileSync as writeFileSync48, existsSync as existsSync52, mkdirSync as mkdirSync48, unlinkSync as unlinkSync11, readFileSync as readFileSync59 } from "node:fs";
+import { dirname as dirname43, join as join91 } from "node:path";
 function publishedDaemonPid(dir2) {
   for (const f of ["status.json", "daemon.lock"]) {
     try {
-      const raw = readFileSync56(join90(dir2, f), "utf-8");
+      const raw = readFileSync59(join91(dir2, f), "utf-8");
       const pid = f === "status.json" ? Number(JSON.parse(raw).pid) : Number(raw.trim());
       if (Number.isInteger(pid) && pid > 0)
         return pid;
@@ -119406,9 +119916,26 @@ function publishedDaemonPid(dir2) {
 }
 function makeWindowsTask(instanceId) {
   const suffix = instanceSuffix(instanceId);
-  const task = `Fineguide\\TesseractHost${suffix ? `-${suffix}` : ""}`;
-  const wrapperPath = () => join90(daemonDir2(), `run-host${suffix ? `-${suffix}` : ""}.cmd`);
-  const logFile = () => join90(daemonDir2(), "daemon.log");
+  const task = `Fineguide\\TesseractAgent${suffix ? `-${suffix}` : ""}`;
+  const legacyTask = `Fineguide\\TesseractHost${suffix ? `-${suffix}` : ""}`;
+  const wrapperPath = () => join91(daemonDir2(), `run-agent${suffix ? `-${suffix}` : ""}.cmd`);
+  const legacyWrapperPath = () => join91(daemonDir2(), `run-host${suffix ? `-${suffix}` : ""}.cmd`);
+  const logFile = () => join91(daemonDir2(), "daemon.log");
+  async function removeLegacySharedTask() {
+    try {
+      const w = legacyWrapperPath();
+      if (!existsSync52(w))
+        return;
+      if (!definitionIsCli(readFileSync59(w, "utf-8")))
+        return;
+      await run6("schtasks", ["/End", "/TN", legacyTask]).catch(() => {
+      });
+      await run6("schtasks", ["/Delete", "/TN", legacyTask, "/F"]).catch(() => {
+      });
+      unlinkSync11(w);
+    } catch {
+    }
+  }
   const oneLine2 = (s) => s.replace(/[\r\n]+/g, " ");
   const envVal = (v) => oneLine2(v).replace(/%/g, "%%").replace(/"/g, "");
   const cmdArg = (a) => `"${oneLine2(a).replace(/"/g, "")}"`;
@@ -119424,6 +119951,7 @@ start "" /b ${cmd} >> "${oneLine2(spec.logPath).replace(/"/g, "")}" 2>&1\r
   }
   return {
     async install(spec) {
+      await removeLegacySharedTask();
       mkdirSync48(spec.workingDirectory ?? daemonDir2(), { recursive: true });
       mkdirSync48(dirname43(spec.logPath), { recursive: true });
       mkdirSync48(dirname43(wrapperPath()), { recursive: true });
@@ -119435,9 +119963,9 @@ start "" /b ${cmd} >> "${oneLine2(spec.logPath).replace(/"/g, "")}" 2>&1\r
     async uninstall() {
       await run6("schtasks", ["/Delete", "/TN", task, "/F"]).catch(() => {
       });
-      if (existsSync51(wrapperPath())) {
+      if (existsSync52(wrapperPath())) {
         try {
-          unlinkSync10(wrapperPath());
+          unlinkSync11(wrapperPath());
         } catch {
         }
       }
@@ -119509,7 +120037,7 @@ start "" /b ${cmd} >> "${oneLine2(spec.logPath).replace(/"/g, "")}" 2>&1\r
     },
     async logs(follow) {
       const f = logFile();
-      if (!existsSync51(f)) {
+      if (!existsSync52(f)) {
         console.log(`No log yet at ${f} \u2014 has the task run?`);
         return;
       }
@@ -119540,8 +120068,8 @@ init_safe_kill();
 
 // src/auth.ts
 var import_qrcode_terminal = __toESM(require_main(), 1);
-import { existsSync as existsSync52, rmSync as rmSync13 } from "node:fs";
-import { join as join91 } from "node:path";
+import { existsSync as existsSync53, rmSync as rmSync13 } from "node:fs";
+import { join as join92 } from "node:path";
 
 // src/config.ts
 import { hostname as hostname7 } from "node:os";
@@ -119742,8 +120270,8 @@ async function logout() {
   }
   for (const f of ["credentials.json", "status.json", "daemon.lock"]) {
     try {
-      const p = join91(daemonDir2(), f);
-      if (existsSync52(p)) rmSync13(p);
+      const p = join92(daemonDir2(), f);
+      if (existsSync53(p)) rmSync13(p);
     } catch {
     }
   }
@@ -119901,9 +120429,9 @@ function startSelfUpdater(current) {
 }
 
 // src/service.ts
-import { join as join92 } from "node:path";
+import { join as join93 } from "node:path";
 import { platform as platform7 } from "node:os";
-import { existsSync as existsSync53, readFileSync as readFileSync57 } from "node:fs";
+import { existsSync as existsSync54, readFileSync as readFileSync60 } from "node:fs";
 function controller(instanceId) {
   const c = getServiceController(instanceId);
   if (!c) {
@@ -119916,7 +120444,7 @@ function buildSpec(cliEntry) {
     exec: process.execPath,
     args: [cliEntry, "run"],
     env: { CCB_DAEMON_DIR: daemonDir2() },
-    logPath: join92(daemonDir2(), "daemon.log")
+    logPath: join93(daemonDir2(), "daemon.log")
   };
 }
 var isAlive = (pid) => {
@@ -119928,10 +120456,10 @@ var isAlive = (pid) => {
   }
 };
 function runningDaemonInfo() {
-  const lock = join92(daemonDir2(), "daemon.lock");
+  const lock = join93(daemonDir2(), "daemon.lock");
   try {
-    if (!existsSync53(lock)) return null;
-    const pid = Number(readFileSync57(lock, "utf-8").trim());
+    if (!existsSync54(lock)) return null;
+    const pid = Number(readFileSync60(lock, "utf-8").trim());
     if (!pid || !isAlive(pid)) return null;
     return { pid, device: readCredentials()?.deviceId };
   } catch {
@@ -119965,7 +120493,7 @@ async function logs(instanceId, follow) {
 }
 
 // src/net.ts
-import { readFileSync as readFileSync59 } from "node:fs";
+import { readFileSync as readFileSync62 } from "node:fs";
 import { randomBytes as randomBytes12 } from "node:crypto";
 import { hostname as hostname8 } from "node:os";
 import { resolve as resolve14 } from "node:path";
@@ -120036,7 +120564,7 @@ function readOrDie(label, p) {
     process.exit(1);
   }
   try {
-    return new Uint8Array(readFileSync59(resolve14(p)));
+    return new Uint8Array(readFileSync62(resolve14(p)));
   } catch (e) {
     console.error(`net enroll: could not read --${label} ${p}: ${e instanceof Error ? e.message : e}`);
     process.exit(1);
@@ -120715,8 +121243,8 @@ async function netCommand(rest, flags) {
 // src/cli.ts
 function pkgVersion() {
   try {
-    const p = join94(dirname44(fileURLToPath8(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync60(p, "utf8")).version ?? "0.0.0";
+    const p = join95(dirname44(fileURLToPath8(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync63(p, "utf8")).version ?? "0.0.0";
   } catch {
     return "0.0.0";
   }
@@ -120786,13 +121314,13 @@ async function superviseDaemon(cliEntry) {
       if (stopping3) process.exit(1);
       setTimeout(spawnWorker, 2e3).unref?.();
     }));
-    c.on("exit", (code, signal) => settle2(() => {
+    c.on("exit", (code, signal2) => settle2(() => {
       if (stopping3) process.exit(typeof code === "number" ? code : 0);
       if (code === RESTART_EXIT_CODE) {
         spawnWorker();
         return;
       }
-      process.exit(typeof code === "number" ? code : signal ? 1 : 0);
+      process.exit(typeof code === "number" ? code : signal2 ? 1 : 0);
     }));
   };
   const forward = (sig) => {
@@ -120944,7 +121472,7 @@ async function linkCommand(rest, flags) {
   process.exit(1);
 }
 async function captureClaudeSubscription(flags) {
-  const home = mkdtempSync4(join94(tmpdir8(), "tesseract-claude-login-"));
+  const home = mkdtempSync4(join95(tmpdir8(), "tesseract-claude-login-"));
   const binary = typeof flags["claude-path"] === "string" ? flags["claude-path"] : process.env.CCB_ENGINE_PATH_CLAUDE_CODE || "claude";
   const args = ["auth", "login", "--claudeai"];
   if (typeof flags.email === "string") args.push("--email", flags.email);
@@ -120958,13 +121486,13 @@ async function captureClaudeSubscription(flags) {
         stdio: "inherit"
       });
       child.once("error", reject);
-      child.once("close", (exitCode, signal) => resolveCode(signal ? 1 : exitCode ?? 1));
+      child.once("close", (exitCode, signal2) => resolveCode(signal2 ? 1 : exitCode ?? 1));
     });
     if (code !== 0) throw new Error(`Claude sign-in did not complete (exit ${code}).`);
-    const file2 = join94(home, ".credentials.json");
-    if (existsSync55(file2)) return readFileSync60(file2, "utf8");
+    const file2 = join95(home, ".credentials.json");
+    if (existsSync56(file2)) return readFileSync63(file2, "utf8");
     if (process.platform === "darwin") {
-      const value = execFileSync7("security", [
+      const value = execFileSync8("security", [
         "find-generic-password",
         "-s",
         "Claude Code-credentials",
@@ -121044,7 +121572,7 @@ async function runnerCommand(rest, flags) {
       process.exit(1);
     }
     const oauthFilePath = typeof flags["oauth-file"] === "string" ? resolve15(flags["oauth-file"]) : void 0;
-    const oauthAuthFile = oauthFilePath ? readFileSync60(oauthFilePath, "utf8") : void 0;
+    const oauthAuthFile = oauthFilePath ? readFileSync63(oauthFilePath, "utf8") : void 0;
     if (oauthAuthFile) {
       try {
         JSON.parse(oauthAuthFile);
@@ -121112,7 +121640,7 @@ async function main() {
       break;
     case "__worker":
       startSelfUpdater(CLI_VERSION);
-      await runDaemon({ tag: "tesseract", version: CLI_VERSION });
+      await runDaemon({ tag: "tesseract", version: CLI_VERSION, kind: "cli" });
       break;
     case "install": {
       const info = runningDaemonInfo();