tesseract-agent 0.12.2-beta.4 → 0.12.2

package/dist-bundle/cli.js

@@ -2640,7 +2640,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls2 = __require("tls");
-    var { randomBytes: randomBytes53, createHash: createHash88 } = __require("crypto");
+    var { randomBytes: randomBytes53, createHash: createHash89 } = __require("crypto");
     var { Duplex: Duplex2, Readable: Readable19 } = __require("stream");
     var { URL: URL4 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -3308,7 +3308,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket2, "Invalid Upgrade header");
           return;
         }
-        const digest2 = createHash88("sha1").update(key7 + GUID).digest("base64");
+        const digest2 = createHash89("sha1").update(key7 + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest2) {
           abortHandshake(websocket, socket2, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -3677,7 +3677,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter4 = __require("events");
     var http = __require("http");
     var { Duplex: Duplex2 } = __require("stream");
-    var { createHash: createHash88 } = __require("crypto");
+    var { createHash: createHash89 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -3984,7 +3984,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket2, 503);
-        const digest2 = createHash88("sha1").update(key7 + GUID).digest("base64");
+        const digest2 = createHash89("sha1").update(key7 + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -16411,7 +16411,7 @@ var init_capabilities2 = __esm({
         label: "Make something in this conversation",
         help: "What the model is told the `studio.start` App-Control capability does (studio domain, write).",
         vars: [],
-        content: `Start one of Tesseract's makers in this conversation: a picture, a logo, a website, a mobile app, a video, a presentation, a personal assistant, deep research, a data analysis, a game (played in the browser right here, or a real Unity, Unreal or Godot project), a skin for the Tesseract app itself, a new project folder (named as the person says and set up the way they describe), a piece of writing (an email, a letter, a blog post, a CV \u2014 drafted with them in a document they edit), a postcard (a picture and their words, both sides, to print or send), social media posts (a caption for each platform and a matching picture, ready to schedule), one of their photos enhanced (restored, brightened, sharpened, made bigger, the background removed), a spreadsheet (a budget, a tracker, an invoice list, or their own data, with formulas, totals and a chart), a PDF (one they have filled in and signed by them, something turned into a PDF, or a form people can fill), a diagram (a flowchart, an org chart, a timeline, a mind map), a drawing (an illustration, an icon, poster art in the vector editor), a font (an original typeface from what it is for and how it looks, or in the spirit of a font they name \u2014 its letters drawn, then opened in the font editor), a piece of audio (a podcast episode, a voice-over, a narration, a recording of theirs cleaned up, a short music edit \u2014 finished in the audio editor, or a script voiced with music under it), a motion graphic (an animated title, a lower third, a logo reveal, a short animated explainer \u2014 built in the motion editor and exported to video), a wireframe (grayscale screens of a web page or an app linked into a clickable flow, edited by hand \u2014 or a blank canvas to build on with pictures to work from), an invoice (lines, tax, due date and payment details, numbered after their last one \u2014 a Word document with its PDF), an email newsletter (planned, looked up where needed and laid out as email-safe HTML for their mailing tool), a form or survey (questions of every kind with simple logic \u2014 a fillable PDF and a web page that collects the answers), a Remote Desktop connection (to one of their own computers, to someone else's, or letting someone reach this one \u2014 anything that opens their computer stays the person's press), or a private network for their devices (home or office; its join token and shut-down secret are shown to the person, never to you). It opens on the canvas beside the chat, asks its own questions in the chat and makes the thing itself \u2014 better than making it with your own tools. Use it whenever the person wants one of these made, in a plain chat as much as in one already making something else (that one stops; what it said stays in the chat). Pass what they said as "about" so they are not asked it again; then end your turn without writing anything \u2014 the maker carries on in the chat.`
+        content: `Start one of Tesseract's makers in this conversation: a picture, a logo, a website, a mobile app, a video, a presentation, a personal assistant, deep research, a data analysis, a game (played in the browser right here, or a real Unity, Unreal or Godot project), a skin for the Tesseract app itself, a new project folder (named as the person says and set up the way they describe), a piece of writing (an email, a letter, a blog post, a CV \u2014 drafted with them in a document they edit), a postcard (a picture and their words, both sides, to print or send), social media posts (a caption for each platform and a matching picture, ready to schedule), one of their photos enhanced (restored, brightened, sharpened, made bigger, the background removed), a spreadsheet (a budget, a tracker, an invoice list, or their own data, with formulas, totals and a chart), a PDF (one they have filled in and signed by them, something turned into a PDF, or a form people can fill), a diagram (a flowchart, an org chart, a timeline, a mind map), a drawing (an illustration, an icon, poster art in the vector editor), a comic (a manga or a webtoon, from an idea or a whole script, its pages in the comic editor), a font (an original typeface from what it is for and how it looks, or in the spirit of a font they name \u2014 its letters drawn, then opened in the font editor), a piece of audio (a podcast episode, a voice-over, a narration, a recording of theirs cleaned up, a short music edit \u2014 finished in the audio editor, or a script voiced with music under it), a motion graphic (an animated title, a lower third, a logo reveal, a short animated explainer \u2014 built in the motion editor and exported to video), a wireframe (grayscale screens of a web page or an app linked into a clickable flow, edited by hand \u2014 or a blank canvas to build on with pictures to work from), an invoice (lines, tax, due date and payment details, numbered after their last one \u2014 a Word document with its PDF), an email newsletter (planned, looked up where needed and laid out as email-safe HTML for their mailing tool), a form or survey (questions of every kind with simple logic \u2014 a fillable PDF and a web page that collects the answers), a Remote Desktop connection (to one of their own computers, to someone else's, or letting someone reach this one \u2014 anything that opens their computer stays the person's press), or a private network for their devices (home or office; its join token and shut-down secret are shown to the person, never to you). It opens on the canvas beside the chat, asks its own questions in the chat and makes the thing itself \u2014 better than making it with your own tools. Use it whenever the person wants one of these made, in a plain chat as much as in one already making something else (that one stops; what it said stays in the chat). Pass what they said as "about" so they are not asked it again; then end your turn without writing anything \u2014 the maker carries on in the chat.`
       },
       {
         id: "capability.studio.reply",
@@ -107313,7 +107313,7 @@ ${JSON.stringify(r, null, 2)}`
         domain: "studio",
         title: "Make something in this conversation",
         input: external_exports.object({
-          kind: external_exports.enum(["picture", "logo", "website", "app", "video", "presentation", "assistant", "research", "data", "game", "skin", "project", "writing", "postcard", "social", "photo", "remote", "network", "spreadsheet", "pdf", "diagram", "drawing", "font", "audio", "motion", "wireframe", "invoice", "newsletter", "form"]).describe("What to make: picture, logo (a brand: symbol, name in type, colours), website, app (a mobile app), video, presentation, assistant (a personal assistant), research (a deep research report), data (an analysis of data), game (a browser game played right here, or a Unity, Unreal or Godot project), skin (a look for the Tesseract app itself), project (a new project folder with the name given, set up the way the person describes), writing (an email, a letter, a blog post, a CV \u2014 drafted with them in a document they edit), postcard (a picture and their words, both sides, to print or send), social (social media posts: a picture and a caption for each platform, ready to schedule), photo (their own photo enhanced: restored, brightened, sharpened, colourised, made bigger, the background removed \u2014 picture is for a new picture), remote (Remote Desktop: connect to one of the person's own computers, to someone else's by ID and password, a one-time code or asking them by email, or let someone reach this computer \u2014 the person presses anything that opens it), network (a private network for their devices, home or office: made, then devices added; its token and secret stay on the person's screen), spreadsheet (a budget, tracker, schedule, invoice list or inventory \u2014 or their own data \u2014 made into a workbook with formulas, totals and a chart), pdf (fill in and sign a PDF they have, turn a document, pictures or a web page into a PDF, or make a form people can fill), diagram (a flowchart, org chart, timeline, mind map or sequence diagram, drawn from Mermaid they can edit), drawing (an illustration, an icon or poster art drawn in the vector editor), font (an original typeface: its letters drawn by AI from what it is for and its look or a font to start from, then opened in the font editor), audio (a podcast episode, voice-over, narration, a recording cleaned up or a short music edit \u2014 from their recording, finished in the audio editor, or a script voiced with music on a timeline), motion (an animated title, a lower third, a logo reveal or a short animated explainer, built in the motion editor and exportable to video), wireframe (low-fidelity grayscale screens of a web page or an app linked into a clickable flow, edited by hand in the card \u2014 or a blank canvas to build on with pictures to work from; can be handed to the website, app or project maker as its brief), invoice (an invoice to a customer \u2014 lines, tax, due date, payment details \u2014 made as a Word document with its PDF), newsletter (an email newsletter planned, researched where needed and laid out as email-safe HTML), form (a form or survey with questions of every kind, made as a fillable PDF and a web page that collects answers)."),
+          kind: external_exports.enum(["picture", "logo", "website", "app", "video", "presentation", "assistant", "research", "data", "game", "skin", "project", "writing", "postcard", "social", "photo", "remote", "network", "spreadsheet", "pdf", "diagram", "drawing", "font", "audio", "motion", "wireframe", "invoice", "newsletter", "form", "comic"]).describe("What to make: picture, logo (a brand: symbol, name in type, colours), website, app (a mobile app), video, presentation, assistant (a personal assistant), research (a deep research report), data (an analysis of data), game (a browser game played right here, or a Unity, Unreal or Godot project), skin (a look for the Tesseract app itself), project (a new project folder with the name given, set up the way the person describes), writing (an email, a letter, a blog post, a CV \u2014 drafted with them in a document they edit), postcard (a picture and their words, both sides, to print or send), social (social media posts: a picture and a caption for each platform, ready to schedule), photo (their own photo enhanced: restored, brightened, sharpened, colourised, made bigger, the background removed \u2014 picture is for a new picture), remote (Remote Desktop: connect to one of the person's own computers, to someone else's by ID and password, a one-time code or asking them by email, or let someone reach this computer \u2014 the person presses anything that opens it), network (a private network for their devices, home or office: made, then devices added; its token and secret stay on the person's screen), spreadsheet (a budget, tracker, schedule, invoice list or inventory \u2014 or their own data \u2014 made into a workbook with formulas, totals and a chart), pdf (fill in and sign a PDF they have, turn a document, pictures or a web page into a PDF, or make a form people can fill), diagram (a flowchart, org chart, timeline, mind map or sequence diagram, drawn from Mermaid they can edit), drawing (an illustration, an icon or poster art drawn in the vector editor), font (an original typeface: its letters drawn by AI from what it is for and its look or a font to start from, then opened in the font editor), audio (a podcast episode, voice-over, narration, a recording cleaned up or a short music edit \u2014 from their recording, finished in the audio editor, or a script voiced with music on a timeline), motion (an animated title, a lower third, a logo reveal or a short animated explainer, built in the motion editor and exportable to video), wireframe (low-fidelity grayscale screens of a web page or an app linked into a clickable flow, edited by hand in the card \u2014 or a blank canvas to build on with pictures to work from; can be handed to the website, app or project maker as its brief), invoice (an invoice to a customer \u2014 lines, tax, due date, payment details \u2014 made as a Word document with its PDF), newsletter (an email newsletter planned, researched where needed and laid out as email-safe HTML), form (a form or survey with questions of every kind, made as a fillable PDF and a web page that collects answers), comic (a comic, a manga or a webtoon)."),
           about: external_exports.string().optional().describe("What the person said they want, in their own words and language \u2014 given to the maker as the answer to its first question. Leave it out to let the maker ask.")
         }),
         mutation: "write",
@@ -323993,14 +323993,14 @@ function tapTelemetry(msg2, origin2, accountOf3, engineOf2 = () => "") {
     } else if (m.type === "chat:error") {
       if (failures.size > 200)
         failures.clear();
-      failures.set(m.sessionId ?? "", {
+      failures.set(failureKey(m), {
         kind: m.restricted ? "refused" : m.transient ? "connection" : m.continuable ? "limit" : "failed",
         reason: classifyError(m.error ?? ""),
         ...m.clientRequestId ? { turn: m.clientRequestId } : {}
       });
     } else if (m.type === "agent:status" && m.status === "error") {
-      const failure2 = failures.get(m.sessionId ?? "");
-      failures.delete(m.sessionId ?? "");
+      const failure2 = failures.get(failureKey(m));
+      failures.delete(failureKey(m));
       let engine = "";
       try {
         engine = engineOf2(m.sessionId);
@@ -324071,7 +324071,7 @@ function wireTelemetryIpc(ipc) {
     trackTelemetry(name, props && typeof props === "object" ? props : void 0, typeof sessionId === "string" && sessionId ? { sessionId } : void 0);
   });
 }
-var FLUSH_INTERVAL_MS, CONSENT_RECHECK_MS, BATCH_MAX, MAX_QUEUE, MAX_BACKOFF_MS, SEND_TIMEOUT_MS, sink3, extensionOrigins, failures, processCollector;
+var FLUSH_INTERVAL_MS, CONSENT_RECHECK_MS, BATCH_MAX, MAX_QUEUE, MAX_BACKOFF_MS, SEND_TIMEOUT_MS, sink3, extensionOrigins, failures, failureKey, processCollector;
 var init_telemetry2 = __esm({
   "../../packages/host-core/dist/telemetry.js"() {
     "use strict";
@@ -324090,6 +324090,7 @@ var init_telemetry2 = __esm({
     sink3 = null;
     extensionOrigins = /* @__PURE__ */ new Set();
     failures = /* @__PURE__ */ new Map();
+    failureKey = (m) => m.sessionId || (m.clientRequestId ? `req:${m.clientRequestId}` : "");
     processCollector = null;
   }
 });
@@ -359995,7 +359996,8 @@ var init_os_favorites = __esm({
 
 // ../../packages/host-core/dist/conditional-file.js
 import { chmod as chmod6, mkdir as mkdir14, open as open12, readFile as readFile11, rename as rename10, rm as rm11, rmdir as rmdir4, stat as stat19, unlink as unlink7, writeFile as writeFile10 } from "node:fs/promises";
-import { randomUUID as randomUUID70 } from "node:crypto";
+import { createReadStream as createReadStream4 } from "node:fs";
+import { createHash as createHash43, randomUUID as randomUUID70 } from "node:crypto";
 import { hostname as hostname6 } from "node:os";
 import { dirname as dirname83, join as join198 } from "node:path";
 function pidAlive2(pid) {
@@ -360103,6 +360105,77 @@ async function conditionalWriteText(path15, content, expected, limit5 = LIMIT) {
     }
   }
 }
+async function digestOf(path15) {
+  let meta5;
+  try {
+    meta5 = await stat19(path15);
+  } catch (error51) {
+    if (isMissing(error51))
+      return null;
+    throw error51;
+  }
+  if (!meta5.isFile())
+    throw new Error("Conditional target is not a regular file.");
+  const hash3 = createHash43("sha256");
+  for await (const chunk of createReadStream4(path15))
+    hash3.update(chunk);
+  return { digest: hash3.digest("hex"), identity: `${meta5.dev}:${meta5.ino}:${meta5.size}:${meta5.mtimeMs}:${meta5.ctimeMs}`, mode: meta5.mode & 4095 };
+}
+async function conditionalReplaceFile(path15, part, expected) {
+  if (expected !== null && (typeof expected !== "string" || !/^[0-9a-f]{64}$/.test(expected)))
+    return { ok: false, error: "Invalid conditional-write baseline." };
+  if (dirname83(part) !== dirname83(path15))
+    return { ok: false, error: "The new file must be beside the one it replaces." };
+  const lock = `${path15}.tess-write-lock`, token4 = randomUUID70();
+  let locked = false, moved = false;
+  try {
+    for (let attempt = 0; !locked; attempt++) {
+      try {
+        await mkdir14(lock);
+        locked = true;
+      } catch (error51) {
+        if (error51.code !== "EEXIST")
+          throw error51;
+        if (await clearStaleLock(lock))
+          continue;
+        if (attempt >= 20)
+          return { ok: false, conflict: true, error: "Another window is saving this file. Try again in a moment." };
+        await sleep9(50);
+      }
+    }
+    await writeFile10(join198(lock, "owner.json"), JSON.stringify({ pid: process.pid, host: hostname6(), at: Date.now(), token: token4 }));
+    const before2 = await digestOf(path15);
+    if ((before2?.digest ?? null) !== expected)
+      return { ok: false, conflict: true, error: "File changed since it was read." };
+    const meta5 = await stat19(part);
+    if (!meta5.isFile())
+      return { ok: false, error: "The new file is not a file." };
+    if (before2)
+      await chmod6(part, before2.mode);
+    const now2 = await stat19(path15).catch((error51) => {
+      if (isMissing(error51))
+        return null;
+      throw error51;
+    });
+    if ((now2 ? `${now2.dev}:${now2.ino}:${now2.size}:${now2.mtimeMs}:${now2.ctimeMs}` : null) !== (before2?.identity ?? null))
+      return { ok: false, conflict: true, error: "File changed while the replacement was prepared." };
+    await rename10(part, path15);
+    moved = true;
+    return { ok: true, identity: `${meta5.size}:${meta5.mtimeMs}` };
+  } catch (error51) {
+    return { ok: false, error: String(error51.message ?? error51) };
+  } finally {
+    if (!moved)
+      await unlink7(part).catch(() => void 0);
+    if (locked) {
+      const owner = await readFile11(join198(lock, "owner.json"), "utf8").catch(() => "");
+      if (owner.includes(token4))
+        await rm11(lock, { recursive: true, force: true }).catch(() => void 0);
+      else if (!owner)
+        await rmdir4(lock).catch(() => void 0);
+    }
+  }
+}
 var LIMIT, STALE_MS3, isMissing, sleep9;
 var init_conditional_file = __esm({
   "../../packages/host-core/dist/conditional-file.js"() {
@@ -364884,7 +364957,7 @@ var init_types16 = __esm({
 // ../../packages/host-core/dist/vfs/http-client.js
 import { Agent as HttpAgent, request as httpRequest4 } from "node:http";
 import { Agent as HttpsAgent, request as httpsRequest2 } from "node:https";
-import { createHash as createHash43, randomBytes as randomBytes30 } from "node:crypto";
+import { createHash as createHash44, randomBytes as randomBytes30 } from "node:crypto";
 async function readText3(res, cap2 = 32 * 1024 * 1024) {
   const chunks3 = [];
   let n2 = 0;
@@ -364999,8 +365072,8 @@ var init_http_client = __esm({
         this.agent.destroy();
       }
     };
-    md52 = (s) => createHash43("md5").update(s).digest("hex");
-    sha2563 = (s) => createHash43("sha256").update(s).digest("hex");
+    md52 = (s) => createHash44("md5").update(s).digest("hex");
+    sha2563 = (s) => createHash44("sha256").update(s).digest("hex");
     Authenticator = class {
       login;
       digest = null;
@@ -371568,7 +371641,7 @@ var require_keyParser = __commonJS({
     var {
       createDecipheriv: createDecipheriv2,
       createECDH,
-      createHash: createHash88,
+      createHash: createHash89,
       createHmac: createHmac9,
       createSign: createSign2,
       createVerify,
@@ -372256,11 +372329,11 @@ ${formatted}-----END ${type2} KEY-----`;
                 );
               }
               const ivSlice = bufferSlice(cipherIV, 0, 8);
-              let cipherKey = createHash88("md5").update(passphrase).update(ivSlice).digest();
+              let cipherKey = createHash89("md5").update(passphrase).update(ivSlice).digest();
               while (cipherKey.length < encInfo.keyLen) {
                 cipherKey = combineBuffers(
                   cipherKey,
-                  createHash88("md5").update(cipherKey).update(passphrase).update(ivSlice).digest()
+                  createHash89("md5").update(cipherKey).update(passphrase).update(ivSlice).digest()
                 );
               }
               if (cipherKey.length > encInfo.keyLen)
@@ -372425,8 +372498,8 @@ ${formatted}-----END ${type2} KEY-----`;
         if (encrypted) {
           const encInfo = CIPHER_INFO[cipherName];
           let cipherKey = combineBuffers(
-            createHash88("sha1").update(PPK_PP1).update(passphrase).digest(),
-            createHash88("sha1").update(PPK_PP2).update(passphrase).digest()
+            createHash89("sha1").update(PPK_PP1).update(passphrase).digest(),
+            createHash89("sha1").update(PPK_PP2).update(passphrase).digest()
           );
           if (cipherKey.length > encInfo.keyLen)
             cipherKey = bufferSlice(cipherKey, 0, encInfo.keyLen);
@@ -372466,7 +372539,7 @@ ${formatted}-----END ${type2} KEY-----`;
           passphrase = EMPTY_PASSPHRASE;
         const calcMAC = createHmac9(
           "sha1",
-          createHash88("sha1").update("putty-private-key-file-mac-key").update(passphrase).digest()
+          createHash89("sha1").update("putty-private-key-file-mac-key").update(passphrase).digest()
         ).update(macData).digest("hex");
         if (calcMAC !== mac3) {
           if (encrypted) {
@@ -374788,7 +374861,7 @@ var require_kex = __commonJS({
       createDiffieHellman,
       createDiffieHellmanGroup,
       createECDH,
-      createHash: createHash88,
+      createHash: createHash89,
       createPublicKey: createPublicKey5,
       diffieHellman: diffieHellman2,
       generateKeyPairSync: generateKeyPairSync2,
@@ -375214,7 +375287,7 @@ var require_kex = __commonJS({
               DISCONNECT_REASON.KEY_EXCHANGE_FAILED
             );
           }
-          const hash3 = createHash88(this.hashName);
+          const hash3 = createHash89(this.hashName);
           hashString2(hash3, isServer ? this._remoteIdentRaw : this._identRaw);
           hashString2(hash3, isServer ? this._identRaw : this._remoteIdentRaw);
           hashString2(hash3, isServer ? this._remoteKexinit : this._kexinit);
@@ -376222,9 +376295,9 @@ var require_kex = __commonJS({
     function generateKEXVal(len2, hashName, secret, exchangeHash, sessionID, char) {
       let ret;
       if (len2) {
-        let digest2 = createHash88(hashName).update(secret).update(exchangeHash).update(char).update(sessionID).digest();
+        let digest2 = createHash89(hashName).update(secret).update(exchangeHash).update(char).update(sessionID).digest();
         while (digest2.length < len2) {
-          const chunk = createHash88(hashName).update(secret).update(exchangeHash).update(digest2).digest();
+          const chunk = createHash89(hashName).update(secret).update(exchangeHash).update(digest2).digest();
           const extended = Buffer.allocUnsafe(digest2.length + chunk.length);
           extended.set(digest2, 0);
           extended.set(chunk, digest2.length);
@@ -381659,7 +381732,7 @@ var require_client = __commonJS({
   "../../node_modules/ssh2/lib/client.js"(exports2, module) {
     "use strict";
     var {
-      createHash: createHash88,
+      createHash: createHash89,
       getHashes,
       randomFillSync
     } = __require("crypto");
@@ -381881,7 +381954,7 @@ var require_client = __commonJS({
           }
           hostVerifier = (key7, verify5) => {
             if (hashAlgo)
-              key7 = createHash88(hashAlgo).update(key7).digest("hex");
+              key7 = createHash89(hashAlgo).update(key7).digest("hex");
             const ret = hashCb(key7, verify5);
             if (ret !== void 0)
               verify5(ret);
@@ -385182,7 +385255,7 @@ var require_lib7 = __commonJS({
 });
 
 // ../../packages/host-core/dist/vfs/secrets.js
-import { createHash as createHash44 } from "node:crypto";
+import { createHash as createHash45 } from "node:crypto";
 import { existsSync as existsSync97, readFileSync as readFileSync49, renameSync as renameSync25, rmSync as rmSync17 } from "node:fs";
 import { join as join201 } from "node:path";
 function setVfsVault(v) {
@@ -385301,7 +385374,7 @@ async function describeKey(privateKey, passphrase) {
     const pub2 = k.getPublicSSH();
     return {
       publicKey: `${k.type} ${pub2.toString("base64")}`,
-      fingerprint: `SHA256:${createHash44("sha256").update(pub2).digest("base64").replace(/=+$/, "")}`,
+      fingerprint: `SHA256:${createHash45("sha256").update(pub2).digest("base64").replace(/=+$/, "")}`,
       keyType: k.type.startsWith("ecdsa") ? "ecdsa" : k.type.replace(/^ssh-/, "")
     };
   } catch {
@@ -385539,7 +385612,7 @@ var init_secrets2 = __esm({
 });
 
 // ../../packages/host-core/dist/vfs/s3.js
-import { createHash as createHash45, createHmac as createHmac3 } from "node:crypto";
+import { createHash as createHash46, createHmac as createHmac3 } from "node:crypto";
 import { mkdirSync as mkdirSync40, readFileSync as readFileSync50, rmSync as rmSync18, writeFileSync as writeFileSync35 } from "node:fs";
 import { join as join202, posix as posix4 } from "node:path";
 import { Readable as Readable3 } from "node:stream";
@@ -385638,10 +385711,10 @@ var init_s3 = __esm({
     init_http_client();
     init_secrets2();
     init_types16();
-    EMPTY_SHA = createHash45("sha256").update("").digest("hex");
+    EMPTY_SHA = createHash46("sha256").update("").digest("hex");
     PART_SIZE = 16 * 1024 * 1024;
     PENDING_MAX_AGE_MS = 7 * 24 * 3600 * 1e3;
-    recordFile2 = (endpoint5, bucket2, key7) => join202(vfsDataDir(), "uploads", createHash45("sha256").update(`s3
+    recordFile2 = (endpoint5, bucket2, key7) => join202(vfsDataDir(), "uploads", createHash46("sha256").update(`s3
 ${endpoint5}
 ${bucket2}
 ${key7}`).digest("hex").slice(0, 32) + ".json");
@@ -385658,7 +385731,7 @@ ${key7}`).digest("hex").slice(0, 32) + ".json");
       isArray: (name) => ["Bucket", "Contents", "CommonPrefixes", "Part"].includes(name)
     });
     hmac2 = (key7, data3) => createHmac3("sha256", key7).update(data3).digest();
-    sha256hex = (data3) => createHash45("sha256").update(data3).digest("hex");
+    sha256hex = (data3) => createHash46("sha256").update(data3).digest("hex");
     S3Session = class {
       u;
       keys;
@@ -386079,7 +386152,7 @@ ${key7}`).digest("hex").slice(0, 32) + ".json");
 });
 
 // ../../packages/host-core/dist/vfs/azure.js
-import { createHash as createHash46, createHmac as createHmac4, randomBytes as randomBytes31 } from "node:crypto";
+import { createHash as createHash47, createHmac as createHmac4, randomBytes as randomBytes31 } from "node:crypto";
 import { posix as posix5 } from "node:path";
 import { Readable as Readable4 } from "node:stream";
 function sharedKeyAuthorization(i) {
@@ -386301,7 +386374,7 @@ var init_azure3 = __esm({
        * and the upload continues after them. Ids within a blob must all be the same length.
        */
       blockId(path15, size2, mtimeMs, ix, random2) {
-        const token4 = random2 ?? createHash46("sha256").update(`${path15}
+        const token4 = random2 ?? createHash47("sha256").update(`${path15}
 ${size2}
 ${mtimeMs ?? ""}`).digest("hex").slice(0, 16);
         return Buffer.from(`${token4}-${String(ix).padStart(6, "0")}`).toString("base64");
@@ -386446,7 +386519,7 @@ ${mtimeMs ?? ""}`).digest("hex").slice(0, 16);
 });
 
 // ../../packages/host-core/dist/vfs/oauth.js
-import { createHash as createHash47, randomBytes as randomBytes32 } from "node:crypto";
+import { createHash as createHash48, randomBytes as randomBytes32 } from "node:crypto";
 import { createServer as createServer11 } from "node:http";
 async function getJson5(url2, token4, init = {}) {
   const res = await fetch(url2, { method: init.method ?? "GET", headers: { authorization: `Bearer ${token4}`, ...init.headers ?? {} }, body: init.body });
@@ -386505,7 +386578,7 @@ async function signInToCloud(protocol, opts) {
   if (!p.clientId)
     throw new VfsError("unsupported", `${p.label} sign-in isn't set up in this version yet.`);
   const verifier = b64url3(randomBytes32(48));
-  const challenge = b64url3(createHash47("sha256").update(verifier).digest());
+  const challenge = b64url3(createHash48("sha256").update(verifier).digest());
   const state6 = b64url3(randomBytes32(18));
   const { server: server3, port } = await listen2(p);
   const path15 = p.redirectPath ?? "/callback";
@@ -386765,7 +386838,7 @@ __export(webdav_exports, {
   skipBytes: () => skipBytes,
   webdavDriver: () => webdavDriver
 });
-import { createHash as createHash48 } from "node:crypto";
+import { createHash as createHash49 } from "node:crypto";
 import { posix as posix6 } from "node:path";
 import { Readable as Readable5, Transform } from "node:stream";
 function originOf(u) {
@@ -387114,7 +387187,7 @@ var init_webdav = __esm({
         return `${this.origin}/remote.php/dav/uploads/${encodeURIComponent(this.u.user ?? "")}/${id2}/${name ? encodeURIComponent(name) : ""}`;
       }
       uploadId(path15, size2, mtimeMs) {
-        return "tess-" + createHash48("sha256").update(`${path15}
+        return "tess-" + createHash49("sha256").update(`${path15}
 ${size2}
 ${mtimeMs ?? ""}`).digest("hex").slice(0, 24);
       }
@@ -387314,7 +387387,7 @@ ${mtimeMs ?? ""}`).digest("hex").slice(0, 24);
 });
 
 // ../../packages/host-core/dist/vfs/dropbox.js
-import { createHash as createHash49 } from "node:crypto";
+import { createHash as createHash50 } from "node:crypto";
 import { mkdirSync as mkdirSync41, readFileSync as readFileSync51, rmSync as rmSync19, writeFileSync as writeFileSync36 } from "node:fs";
 import { join as join203, posix as posix7 } from "node:path";
 import { Readable as Readable6 } from "node:stream";
@@ -387432,7 +387505,7 @@ var init_dropbox = __esm({
       }
       // ── uploads ──────────────────────────────────────────────────────────────────────
       recordFile(path15) {
-        return join203(vfsDataDir(), "uploads", createHash49("sha256").update(`dropbox
+        return join203(vfsDataDir(), "uploads", createHash50("sha256").update(`dropbox
 ${this.connKey}
 ${path15.toLowerCase()}`).digest("hex").slice(0, 32) + ".json");
       }
@@ -390379,7 +390452,7 @@ var init_ftp = __esm({
 });
 
 // ../../packages/host-core/dist/vfs/googledrive.js
-import { createHash as createHash50 } from "node:crypto";
+import { createHash as createHash51 } from "node:crypto";
 import { mkdirSync as mkdirSync42, readFileSync as readFileSync52, rmSync as rmSync20, writeFileSync as writeFileSync37 } from "node:fs";
 import { join as join204, posix as posix10 } from "node:path";
 function nodeOf(f3) {
@@ -390640,7 +390713,7 @@ var init_googledrive = __esm({
       }
       // ── uploads ──────────────────────────────────────────────────────────────────────
       recordFile(path15) {
-        return join204(vfsDataDir(), "uploads", createHash50("sha256").update(`googledrive
+        return join204(vfsDataDir(), "uploads", createHash51("sha256").update(`googledrive
 ${this.connKey}
 ${path15}`).digest("hex").slice(0, 32) + ".json");
       }
@@ -390803,7 +390876,7 @@ ${path15}`).digest("hex").slice(0, 32) + ".json");
 });
 
 // ../../packages/host-core/dist/vfs/irods.js
-import { createHash as createHash51, randomBytes as randomBytes33 } from "node:crypto";
+import { createHash as createHash52, randomBytes as randomBytes33 } from "node:crypto";
 import { connect as netConnect3, isIP as isIP2 } from "node:net";
 import { posix as posix11 } from "node:path";
 import { Readable as Readable8 } from "node:stream";
@@ -390850,7 +390923,7 @@ function header3(type2, msgLen, errorLen, bsLen, intInfo) {
 function challengeDigest(challenge, password) {
   const pw = Buffer.alloc(MAX_PASSWORD);
   Buffer.from(password.replace(/^[\t\n\v\f\r ]+|[\t\n\v\f\r ]+$/g, ""), "utf-8").copy(pw, 0, 0, MAX_PASSWORD);
-  const d = createHash51("md5").update(challenge).update(pw).digest();
+  const d = createHash52("md5").update(challenge).update(pw).digest();
   for (let i = 0; i < d.length; i++)
     if (d[i] === 0)
       d[i] = 1;
@@ -391482,7 +391555,7 @@ var init_irods = __esm({
 });
 
 // ../../packages/host-core/dist/vfs/onedrive.js
-import { createHash as createHash52 } from "node:crypto";
+import { createHash as createHash53 } from "node:crypto";
 import { mkdirSync as mkdirSync43, readFileSync as readFileSync53, rmSync as rmSync21, writeFileSync as writeFileSync38 } from "node:fs";
 import { join as join205, posix as posix12 } from "node:path";
 import { Readable as Readable9 } from "node:stream";
@@ -391609,7 +391682,7 @@ var init_onedrive = __esm({
       }
       // ── uploads ──────────────────────────────────────────────────────────────────────
       recordFile(path15) {
-        return join205(vfsDataDir(), "uploads", createHash52("sha256").update(`onedrive
+        return join205(vfsDataDir(), "uploads", createHash53("sha256").update(`onedrive
 ${this.connKey}
 ${path15}`).digest("hex").slice(0, 32) + ".json");
       }
@@ -391909,7 +391982,7 @@ var init_registry6 = __esm({
 });
 
 // ../../packages/host-core/dist/ssh/ssh-connect.js
-import { createHash as createHash53 } from "node:crypto";
+import { createHash as createHash54 } from "node:crypto";
 import { existsSync as existsSync98, mkdirSync as mkdirSync44, readFileSync as readFileSync54, renameSync as renameSync26, writeFileSync as writeFileSync39 } from "node:fs";
 import { homedir as homedir48 } from "node:os";
 import { join as join206 } from "node:path";
@@ -391988,7 +392061,7 @@ function forgetHostKey(host3, port) {
   }
 }
 function hostKeyFingerprint(key7) {
-  return "SHA256:" + createHash53("sha256").update(key7).digest("base64").replace(/=+$/, "");
+  return "SHA256:" + createHash54("sha256").update(key7).digest("base64").replace(/=+$/, "");
 }
 function loadKey(file8) {
   try {
@@ -392310,7 +392383,7 @@ var init_sftp = __esm({
 });
 
 // ../../packages/host-core/dist/vfs/local.js
-import { createReadStream as createReadStream4, createWriteStream as createWriteStream4 } from "node:fs";
+import { createReadStream as createReadStream5, createWriteStream as createWriteStream4 } from "node:fs";
 import { chmod as chmod7, copyFile as copyFile4, lstat as lstat8, mkdir as mkdir15, readdir as readdir14, readlink as readlink2, rename as rename11, rmdir as rmdir5, stat as stat20, symlink as symlink3, unlink as unlink8, utimes as utimes3 } from "node:fs/promises";
 import { dirname as dirname85, join as join207 } from "node:path";
 import { pipeline as pipeline3 } from "node:stream/promises";
@@ -392381,7 +392454,7 @@ var init_local2 = __esm({
         } catch (e) {
           throw mapErr(e, path15);
         }
-        return createReadStream4(path15, { start: opts?.start ?? 0 });
+        return createReadStream5(path15, { start: opts?.start ?? 0 });
       },
       async write(path15, source3, opts) {
         const start7 = opts?.start ?? 0;
@@ -392450,7 +392523,7 @@ var init_local2 = __esm({
 
 // ../../packages/host-core/dist/vfs/smb.js
 import { spawn as spawn20 } from "node:child_process";
-import { createHash as createHash54 } from "node:crypto";
+import { createHash as createHash55 } from "node:crypto";
 import { existsSync as existsSync99, mkdirSync as mkdirSync45, readdirSync as readdirSync19, realpathSync as realpathSync8 } from "node:fs";
 import { join as join208, posix as posix14, win32 as win325 } from "node:path";
 function run9(cmd3, args, input, timeoutMs = 3e4) {
@@ -392549,7 +392622,7 @@ var init_smb = __esm({
     encSmb = (s) => encodeURIComponent(s);
     macMounter = {
       async mount(u, share, secret) {
-        const root = join208(vfsDataDir(), "mnt", createHash54("sha256").update(`${u.host}
+        const root = join208(vfsDataDir(), "mnt", createHash55("sha256").update(`${u.host}
 ${u.port ?? ""}
 ${u.domain ?? ""}
 ${u.user ?? ""}
@@ -393451,7 +393524,7 @@ var init_swift = __esm({
 });
 
 // ../../packages/host-core/dist/vfs/transfer.js
-import { createHash as createHash55 } from "node:crypto";
+import { createHash as createHash56 } from "node:crypto";
 import { mkdirSync as mkdirSync46, readFileSync as readFileSync55, rmSync as rmSync22, writeFileSync as writeFileSync40 } from "node:fs";
 import { join as joinLocal } from "node:path";
 import { posix as posix17 } from "node:path";
@@ -393695,7 +393768,7 @@ var init_transfer = __esm({
       }
     };
     journalDir = () => joinLocal(vfsDataDir(), "transfers");
-    journalFile = (op2, src, destDir) => joinLocal(journalDir(), createHash55("sha256").update(`${op2}
+    journalFile = (op2, src, destDir) => joinLocal(journalDir(), createHash56("sha256").update(`${op2}
 ${src}
 ${destDir}`).digest("hex").slice(0, 32) + ".json");
   }
@@ -394796,6 +394869,15 @@ async function runRemoteFsOp(root, op2, args, quotaKey) {
         return OUTSIDE("rename");
       const newPath = join210(dirname86(oldPath), newName);
       const caseOnlyRename = newPath.toLowerCase() === oldPath.toLowerCase() && newPath !== oldPath;
+      const options = a[2];
+      if (options && Object.hasOwn(options, "expectedSha256")) {
+        if (options.expectedSha256 !== null && typeof options.expectedSha256 !== "string")
+          return { ok: false, error: "Invalid conditional-write baseline." };
+        const real4 = await safeContentPath(newPath), part = await safeContentPath(oldPath);
+        if (!real4 || !part)
+          return OUTSIDE("rename");
+        return inFolder2(dirname86(oldPath), async () => ({ ...await conditionalReplaceFile(real4, part, options.expectedSha256), newPath }));
+      }
       return inFolder2(dirname86(oldPath), async () => {
         if (!caseOnlyRename && await exists3(newPath)) {
           let targetIsDir = false;
@@ -395434,7 +395516,7 @@ var init_fs_datachannel_host = __esm({
 });
 
 // ../../packages/host-core/dist/active-link/paths.js
-import { createHash as createHash56 } from "node:crypto";
+import { createHash as createHash57 } from "node:crypto";
 import { realpathSync as realpathSync9 } from "node:fs";
 import { join as join211, relative as relative27, sep as sep39 } from "node:path";
 function activeLinkEnabled() {
@@ -395461,7 +395543,7 @@ function suggestLinkId(localRoot) {
     canon2 = realpathSync9.native(localRoot);
   } catch {
   }
-  return createHash56("sha256").update(canon2).digest("hex").slice(0, 16);
+  return createHash57("sha256").update(canon2).digest("hex").slice(0, 16);
 }
 function activeLinkRoot() {
   return process.env.CCB_ACTIVE_LINK_DIR ?? tessPath("active-link");
@@ -416536,20 +416618,20 @@ var init_host_name = __esm({
 });
 
 // ../../packages/host-core/dist/active-link/blocks.js
-import { createHash as createHash57 } from "node:crypto";
-import { createReadStream as createReadStream5 } from "node:fs";
+import { createHash as createHash58 } from "node:crypto";
+import { createReadStream as createReadStream6 } from "node:fs";
 import { open as open14, mkdir as mkdir18, rename as rename13, chmod as chmod9, utimes as utimes5, unlink as unlink9 } from "node:fs/promises";
 import { dirname as dirname89 } from "node:path";
 function hashBytes(buf) {
-  return createHash57("sha256").update(buf).digest("hex");
+  return createHash58("sha256").update(buf).digest("hex");
 }
 function hashString(s) {
-  return createHash57("sha256").update(s, "utf-8").digest("hex");
+  return createHash58("sha256").update(s, "utf-8").digest("hex");
 }
 function hashFile2(abs) {
   return new Promise((resolve64, reject) => {
-    const h = createHash57("sha256");
-    const rs = createReadStream5(abs);
+    const h = createHash58("sha256");
+    const rs = createReadStream6(abs);
     rs.on("data", (d) => h.update(d));
     rs.on("end", () => resolve64(h.digest("hex")));
     rs.on("error", reject);
@@ -416557,12 +416639,12 @@ function hashFile2(abs) {
 }
 function hashFileBlocks(abs) {
   return new Promise((resolve64, reject) => {
-    const whole = createHash57("sha256");
+    const whole = createHash58("sha256");
     const blocks2 = [];
-    let cur = createHash57("sha256");
+    let cur = createHash58("sha256");
     let curLen = 0;
     let size2 = 0;
-    const rs = createReadStream5(abs, { highWaterMark: 256 * 1024 });
+    const rs = createReadStream6(abs, { highWaterMark: 256 * 1024 });
     rs.on("data", (chunk) => {
       const d = chunk;
       whole.update(d);
@@ -416575,7 +416657,7 @@ function hashFileBlocks(abs) {
         off += take;
         if (curLen === CHUNK5) {
           blocks2.push(cur.digest("hex"));
-          cur = createHash57("sha256");
+          cur = createHash58("sha256");
           curLen = 0;
         }
       }
@@ -416662,9 +416744,9 @@ var init_blocks = __esm({
       stagingPath;
       fh = null;
       bytes = 0;
-      whole = createHash57("sha256");
+      whole = createHash58("sha256");
       blocks = [];
-      cur = createHash57("sha256");
+      cur = createHash58("sha256");
       curLen = 0;
       constructor(stagingPath) {
         this.stagingPath = stagingPath;
@@ -416689,7 +416771,7 @@ var init_blocks = __esm({
           off += take;
           if (this.curLen === CHUNK5) {
             this.blocks.push(this.cur.digest("hex"));
-            this.cur = createHash57("sha256");
+            this.cur = createHash58("sha256");
             this.curLen = 0;
           }
         }
@@ -417037,7 +417119,7 @@ var init_gitignore = __esm({
 });
 
 // ../../packages/host-core/dist/active-link/session.js
-import { createHash as createHash58 } from "node:crypto";
+import { createHash as createHash59 } from "node:crypto";
 import { lstat as lstat11, readlink as readlink5, open as open15 } from "node:fs/promises";
 var OutboundSender;
 var init_session3 = __esm({
@@ -417136,7 +417218,7 @@ var init_session3 = __esm({
         const size2 = st.size;
         const mtimeMs = Math.floor(st.mtimeMs);
         const mode = st.mode;
-        const running4 = createHash58("sha256");
+        const running4 = createHash59("sha256");
         let fh;
         try {
           fh = await open15(abs, "r");
@@ -421561,7 +421643,7 @@ __export(routines_exports, {
   syncSeededRoutines: () => syncSeededRoutines,
   taskSession: () => taskSession
 });
-import { createHash as createHash59 } from "node:crypto";
+import { createHash as createHash60 } from "node:crypto";
 import { join as join223 } from "node:path";
 function namesCharter(prompt2, folder) {
   return !!folder && charterPaths(folder).some((p) => prompt2.includes(p));
@@ -421578,7 +421660,7 @@ function routineSeed(folder, held5 = [], file8 = daemonTasksFile()) {
   }));
 }
 function seedRoutineHash(r) {
-  return createHash59("sha256").update(JSON.stringify([r.cron.trim(), r.prompt, r.paused === true])).digest("hex").slice(0, 16);
+  return createHash60("sha256").update(JSON.stringify([r.cron.trim(), r.prompt, r.paused === true])).digest("hex").slice(0, 16);
 }
 function syncSeededRoutines(folder, routines, applied, file8 = daemonTasksFile(), now2 = Date.now()) {
   const store2 = new CronStore({ file: file8 });
@@ -426307,15 +426389,15 @@ var init_model = __esm({
 });
 
 // ../../packages/embed-core/dist/fetch.js
-import { createHash as createHash60 } from "node:crypto";
+import { createHash as createHash61 } from "node:crypto";
 import { createWriteStream as createWriteStream6, existsSync as existsSync109, mkdirSync as mkdirSync51, readFileSync as readFileSync63, renameSync as renameSync30, rmSync as rmSync24, statSync as statSync80, writeFileSync as writeFileSync45 } from "node:fs";
 import { dirname as dirname97 } from "node:path";
 import { Readable as Readable14 } from "node:stream";
 import { pipeline as pipeline4 } from "node:stream/promises";
 async function sha256File(path15) {
-  const h = createHash60("sha256");
-  const { createReadStream: createReadStream12 } = await import("node:fs");
-  await pipeline4(createReadStream12(path15), async function* (src) {
+  const h = createHash61("sha256");
+  const { createReadStream: createReadStream13 } = await import("node:fs");
+  await pipeline4(createReadStream13(path15), async function* (src) {
     for await (const chunk of src)
       h.update(chunk);
   });
@@ -426352,7 +426434,7 @@ async function downloadVerified(url2, path15, f3, opts = {}, onBytes) {
   const res = await (opts.fetchImpl ?? fetch)(url2, { signal: opts.signal, redirect: "follow" });
   if (!res.ok || !res.body)
     throw new Error(`HTTP ${res.status} for ${f3.asset}`);
-  const hash3 = createHash60("sha256");
+  const hash3 = createHash61("sha256");
   let size2 = 0;
   try {
     await pipeline4(Readable14.fromWeb(res.body), async function* (src) {
@@ -429863,11 +429945,11 @@ ${ENCODE_SOURCE}
 });
 
 // ../../packages/embed-core/dist/vector-store.js
-import { createHash as createHash61 } from "node:crypto";
+import { createHash as createHash62 } from "node:crypto";
 import { appendFileSync as appendFileSync6, mkdirSync as mkdirSync52, readFileSync as readFileSync65, statSync as statSync81 } from "node:fs";
 import { dirname as dirname98, join as join229 } from "node:path";
 function textKey(text51) {
-  return createHash61("sha256").update(text51).digest("hex").slice(0, KEY_BYTES * 2);
+  return createHash62("sha256").update(text51).digest("hex").slice(0, KEY_BYTES * 2);
 }
 function encodeRecord(key7, vec, dims) {
   const b = Buffer.alloc(KEY_BYTES + dims * 4);
@@ -431894,7 +431976,7 @@ var init_window = __esm({
 });
 
 // ../../packages/host-core/dist/violet-sessions/service.js
-import { createHash as createHash62, randomUUID as randomUUID77 } from "node:crypto";
+import { createHash as createHash63, randomUUID as randomUUID77 } from "node:crypto";
 import { basename as basename52, isAbsolute as isAbsolute44, join as join233, normalize as normalize10 } from "node:path";
 function surfaceFiles(m) {
   const p = m.payload;
@@ -432374,7 +432456,7 @@ function createVioletSessions(d) {
     const paths = [...new Set([...t2.kept, ...turn.made, ...t2.made].map((p) => normalize10(p)))].filter((p) => inFolder3(u.folder, p));
     const shown5 = [];
     const sameOf = /* @__PURE__ */ new Map();
-    const sameKey = (f3) => f3.bytes ? createHash62("sha256").update(f3.bytes).digest("hex") : `${madeKind(f3.path)}:${f3.size}`;
+    const sameKey = (f3) => f3.bytes ? createHash63("sha256").update(f3.bytes).digest("hex") : `${madeKind(f3.path)}:${f3.size}`;
     if (paths.length) {
       const read4 = await readAs(u, paths, { maxBytes: SAME_READ_MAX });
       for (const f3 of read4) {
@@ -433348,7 +433430,7 @@ var init_turn = __esm({
 });
 
 // ../../packages/host-core/dist/memory/episodes.js
-import { createReadStream as createReadStream6, existsSync as existsSync111 } from "node:fs";
+import { createReadStream as createReadStream7, existsSync as existsSync111 } from "node:fs";
 import { createInterface as createInterface3 } from "node:readline";
 function syntheticFolder(cwd, projectKey) {
   const s = `${cwd ?? ""} ${projectKey ?? ""}`;
@@ -433381,7 +433463,7 @@ async function* lineChunks(f3) {
     if (!existsSync111(path15))
       continue;
     let buf = [];
-    const rl = createInterface3({ input: createReadStream6(path15, { encoding: "utf8" }), crlfDelay: Infinity });
+    const rl = createInterface3({ input: createReadStream7(path15, { encoding: "utf8" }), crlfDelay: Infinity });
     for await (const line5 of rl) {
       buf.push(line5);
       if (buf.length >= CHUNK_LINES) {
@@ -433630,9 +433712,9 @@ var init_pg_store = __esm({
 });
 
 // ../../packages/host-core/dist/memory/qdrant-client.js
-import { createHash as createHash63 } from "node:crypto";
+import { createHash as createHash64 } from "node:crypto";
 function pointId(item, n2) {
-  const h = createHash63("sha1").update(`${item}#${n2}`).digest("hex");
+  const h = createHash64("sha1").update(`${item}#${n2}`).digest("hex");
   return `${h.slice(0, 8)}-${h.slice(8, 12)}-5${h.slice(13, 16)}-${(parseInt(h[16], 16) & 3 | 8).toString(16)}${h.slice(17, 20)}-${h.slice(20, 32)}`;
 }
 var COLLECTION2, TENANT_FIELD, TENANT_PID, DIMS, INDEX_LAYOUT, RESCORE, SMALL, DENSE_SHARE, CUE_SHARE, QdrantError, QdrantClient;
@@ -433934,11 +434016,11 @@ var init_qdrant_client = __esm({
 });
 
 // ../../packages/host-core/dist/memory/store.js
-import { createHash as createHash64 } from "node:crypto";
-import { appendFileSync as appendFileSync7, closeSync as closeSync23, createReadStream as createReadStream7, existsSync as existsSync112, mkdirSync as mkdirSync54, openSync as openSync10, readFileSync as readFileSync67, readSync as readSync15, renameSync as renameSync32, statSync as statSync82, truncateSync as truncateSync3, writeFileSync as writeFileSync47 } from "node:fs";
+import { createHash as createHash65 } from "node:crypto";
+import { appendFileSync as appendFileSync7, closeSync as closeSync23, createReadStream as createReadStream8, existsSync as existsSync112, mkdirSync as mkdirSync54, openSync as openSync10, readFileSync as readFileSync67, readSync as readSync15, renameSync as renameSync32, statSync as statSync82, truncateSync as truncateSync3, writeFileSync as writeFileSync47 } from "node:fs";
 import { dirname as dirname99 } from "node:path";
 function fingerprint2(...parts2) {
-  const h = createHash64("sha1");
+  const h = createHash65("sha1");
   for (const p of parts2)
     h.update(typeof p === "string" || p == null ? p ?? "" : p.join("
")).update("\0");
   return h.digest("hex").slice(0, 16);
@@ -433987,7 +434069,7 @@ var init_store5 = __esm({
             return false;
           }
         };
-        for await (const chunk of createReadStream7(this.path)) {
+        for await (const chunk of createReadStream8(this.path)) {
           let from = 0;
           for (let nl = chunk.indexOf(10); nl >= 0; nl = chunk.indexOf(10, from)) {
             const line5 = Buffer.concat([...pending6, chunk.subarray(from, nl)]);
@@ -462321,7 +462403,7 @@ var init_calibration = __esm({
 });
 
 // ../../packages/host-core/dist/crew/claude-peer.js
-import { createHash as createHash65, randomUUID as randomUUID87 } from "node:crypto";
+import { createHash as createHash66, randomUUID as randomUUID87 } from "node:crypto";
 import { connect as connect3, createServer as createServer14 } from "node:net";
 import { homedir as homedir53 } from "node:os";
 import { basename as basename67, dirname as dirname107, join as join254 } from "node:path";
@@ -462471,7 +462553,7 @@ var init_claude_peer = __esm({
       /** The session's own token, from its key file — none when there is no such file (not needed on macOS/Linux). */
       tokenOf(t2) {
         const home2 = this.deps.home ?? homedir53();
-        const hash3 = createHash65("sha256").update(t2.socketPath).digest("hex");
+        const hash3 = createHash66("sha256").update(t2.socketPath).digest("hex");
         try {
           const raw2 = JSON.parse(readFileSync3(join254(home2, ".claude", "sessions", `${t2.pid}.${hash3}.key`), "utf8"));
           return typeof raw2.peerToken === "string" && /^[0-9a-f]{16,128}$/.test(raw2.peerToken) ? raw2.peerToken : void 0;
@@ -462499,7 +462581,7 @@ var init_claude_peer = __esm({
 });
 
 // ../../packages/host-core/dist/crew/external-claude.js
-import { createHash as createHash66 } from "node:crypto";
+import { createHash as createHash67 } from "node:crypto";
 import { homedir as homedir54 } from "node:os";
 import { join as join255, relative as relative34, isAbsolute as isAbsolute45 } from "node:path";
 function alive2(pid) {
@@ -462746,7 +462828,7 @@ async function refreshClaudeHistory(home2 = homedir54()) {
   await i.reading;
 }
 function claudeEditorsOf(absPath4, sinceMs = 0, home2 = homedir54()) {
-  const h = createHash66("sha256").update(absPath4).digest("hex").slice(0, 16);
+  const h = createHash67("sha256").update(absPath4).digest("hex").slice(0, 16);
   const index = indexes.get(home2) ?? buildIndexSync(home2);
   return (index.byHash.get(h) ?? []).filter((e) => e.at > sinceMs).sort((a, b) => b.at - a.at);
 }
@@ -463027,7 +463109,7 @@ var init_messaging = __esm({
 
 // ../../packages/host-core/dist/crew/project.js
 import { execFile as execFile27 } from "node:child_process";
-import { createHash as createHash67 } from "node:crypto";
+import { createHash as createHash68 } from "node:crypto";
 import { basename as basename68, dirname as dirname108, join as join256, resolve as resolve50 } from "node:path";
 function git6(cwd, args, input, timeoutMs = 2e4) {
   const env = { ...process.env, GIT_OPTIONAL_LOCKS: "0", LC_ALL: "C" };
@@ -463096,7 +463178,7 @@ function gitDirOf(root) {
 }
 function crewDir(root) {
   const name = basename68(root).replace(/[^\w.-]/g, "_") || "project";
-  const hash3 = createHash67("sha1").update(resolve50(root)).digest("hex").slice(0, 10);
+  const hash3 = createHash68("sha1").update(resolve50(root)).digest("hex").slice(0, 10);
   return join256(tesseractHome(), "projects", `${name}-${hash3}`, "crew");
 }
 async function catFiles(root, specs) {
@@ -480150,7 +480232,7 @@ var init_tracker = __esm({
 });
 
 // ../../packages/host-core/dist/crew/watch.js
-import { createHash as createHash68 } from "node:crypto";
+import { createHash as createHash69 } from "node:crypto";
 function commandOf2(input) {
   if (!input || typeof input !== "object")
     return void 0;
@@ -480215,7 +480297,7 @@ var init_watch2 = __esm({
         if (ev.input === void 0 || call5.signed || !tool5)
           return {};
         call5.signed = true;
-        const sig = createHash68("sha1").update(`${tool5}\0${stable(ev.input)}`).digest("hex");
+        const sig = createHash69("sha1").update(`${tool5}\0${stable(ev.input)}`).digest("hex");
         s.repeats = s.lastSig === sig ? s.repeats + 1 : 1;
         s.lastSig = sig;
         if (SHELL_TOOLS2.has(tool5) || ev.kind === "execute") {
@@ -481107,7 +481189,7 @@ var init_ports = __esm({
 });
 
 // ../../packages/host-core/dist/crew/cite.js
-import { createHash as createHash69 } from "node:crypto";
+import { createHash as createHash70 } from "node:crypto";
 function parseSpec(spec3) {
   const s = spec3.trim();
   const hash3 = s.lastIndexOf("#");
@@ -481161,7 +481243,7 @@ var init_cite = __esm({
     "use strict";
     init_interfaces();
     MAX_CITED = 4e3;
-    sha = (s) => createHash69("sha256").update(s).digest("hex");
+    sha = (s) => createHash70("sha256").update(s).digest("hex");
   }
 });
 
@@ -481704,7 +481786,7 @@ var init_tree = __esm({
 });
 
 // ../../packages/host-core/dist/crew/organization.js
-import { createHash as createHash70, randomUUID as randomUUID91 } from "node:crypto";
+import { createHash as createHash71, randomUUID as randomUUID91 } from "node:crypto";
 import { dirname as dirname117, isAbsolute as isAbsolute48, relative as relative37, resolve as resolve53 } from "node:path";
 var active5, scopeValid, withinScope, normalize16, finiteMoney, CrewOrganizations;
 var init_organization3 = __esm({
@@ -482187,7 +482269,7 @@ var init_organization3 = __esm({
         const rel = relative37(root, file8);
         if (isAbsolute48(artifact) || rel === ".." || rel.startsWith("../") || isAbsolute48(rel))
           throw new Error("Artifact is outside this project");
-        const actual = `sha256:${createHash70("sha256").update(readFileSync3(file8)).digest("hex")}`;
+        const actual = `sha256:${createHash71("sha256").update(readFileSync3(file8)).digest("hex")}`;
         if (actual !== version4)
           throw new Error("Artifact changed since this version; publish the new version and repeat verification");
       }
@@ -491784,7 +491866,7 @@ var init_focus_probe = __esm({
 });
 
 // ../../packages/host-core/dist/rdesk/file-pull.js
-import { createReadStream as createReadStream8, promises as fsp3 } from "node:fs";
+import { createReadStream as createReadStream9, promises as fsp3 } from "node:fs";
 import { basename as basename72 } from "node:path";
 function oneChooser(open18) {
   let current12 = null;
@@ -491808,7 +491890,7 @@ var init_file_pull = __esm({
         return { size: s.size, isFile: s.isFile() };
       },
       // A size of 0 says nothing: an empty file ends by itself, and a special file (some mounts) reports 0 and has contents.
-      read: (path15, size2) => createReadStream8(path15, { highWaterMark: FILE_PULL_CHUNK, ...size2 > 0 ? { end: size2 - 1 } : {} })
+      read: (path15, size2) => createReadStream9(path15, { highWaterMark: FILE_PULL_CHUNK, ...size2 > 0 ? { end: size2 - 1 } : {} })
     };
     LinkGone = class extends Error {
       constructor() {
@@ -492367,7 +492449,7 @@ var init_tesseract_engine = __esm({
 
 // ../../packages/host-core/dist/engines/machine-sign-in.js
 import { execFile as execFile31 } from "node:child_process";
-import { createHash as createHash71 } from "node:crypto";
+import { createHash as createHash72 } from "node:crypto";
 import { homedir as homedir58 } from "node:os";
 import { join as join267 } from "node:path";
 function securityHas(service, account2) {
@@ -492510,7 +492592,7 @@ var init_machine_sign_in = __esm({
     geminiDir = (ctx2) => join267(dirOf(ctx2, "GEMINI_CLI_HOME", ctx2.home), ".gemini");
     opencodeDir = (ctx2) => join267(dirOf(ctx2, "XDG_DATA_HOME", join267(ctx2.home, ".local", "share")), "opencode");
     cursorDir = (ctx2) => dirOf(ctx2, "CURSOR_CONFIG_DIR", join267(ctx2.home, ".cursor"));
-    sha2564 = (text51) => createHash71("sha256").update(text51).digest("hex");
+    sha2564 = (text51) => createHash72("sha256").update(text51).digest("hex");
     SETUPS = {
       // A subscription: `.credentials.json` in its config dir (Linux, Windows) or the login keychain (macOS). A key: the
       // environment, or the one a Console login leaves in `.claude.json` where it could not use the keychain. Not its
@@ -493092,8 +493174,8 @@ var init_assist_shell = __esm({
 
 // ../../packages/host-core/dist/remote-install/wsl.js
 import { spawn as spawn25 } from "node:child_process";
-import { createHash as createHash72 } from "node:crypto";
-import { createReadStream as createReadStream9, createWriteStream as createWriteStream7, existsSync as existsSync123, mkdirSync as mkdirSync60, renameSync as renameSync34, rmSync as rmSync26, statSync as statSync91 } from "node:fs";
+import { createHash as createHash73 } from "node:crypto";
+import { createReadStream as createReadStream10, createWriteStream as createWriteStream7, existsSync as existsSync123, mkdirSync as mkdirSync60, renameSync as renameSync34, rmSync as rmSync26, statSync as statSync91 } from "node:fs";
 import { basename as basename73, join as join268 } from "node:path";
 import { Readable as Readable15, Transform as Transform3 } from "node:stream";
 import { pipeline as pipeline5 } from "node:stream/promises";
@@ -493270,13 +493352,13 @@ function pickImage(manifest, arch2 = process.arch, want2 = DEFAULT_IMAGE) {
   return null;
 }
 async function hashFile3(hash3, path15) {
-  for await (const chunk of createReadStream9(path15))
+  for await (const chunk of createReadStream10(path15))
     hash3.update(chunk);
   return hash3;
 }
 async function downloadImage(image3, dir2, opts = {}) {
   const file8 = join268(dir2, basename73(new URL(image3.url).pathname) || "distribution.wsl");
-  if (existsSync123(file8) && (await hashFile3(createHash72("sha256"), file8)).digest("hex") === image3.sha256)
+  if (existsSync123(file8) && (await hashFile3(createHash73("sha256"), file8)).digest("hex") === image3.sha256)
     return file8;
   mkdirSync60(dir2, { recursive: true });
   const part = `${file8}.part`;
@@ -493288,7 +493370,7 @@ async function downloadImage(image3, dir2, opts = {}) {
   if (!res.ok || !res.body)
     throw new Error(`The download did not start (HTTP ${res.status}).`);
   const resumed = have > 0 && res.status === 206;
-  const hash3 = resumed ? await hashFile3(createHash72("sha256"), part) : createHash72("sha256");
+  const hash3 = resumed ? await hashFile3(createHash73("sha256"), part) : createHash73("sha256");
   let received = resumed ? have : 0;
   const length = Number(res.headers.get("content-length"));
   const total = Number.isFinite(length) && length > 0 ? received + length : null;
@@ -501252,7 +501334,7 @@ var init_reissue = __esm({
 });
 
 // ../../packages/host-core/dist/mesh/wireguard-psk.js
-import { createCipheriv, createDecipheriv, createHash as createHash73, createPrivateKey as createPrivateKey2, createPublicKey, diffieHellman, randomBytes as randomBytes45 } from "node:crypto";
+import { createCipheriv, createDecipheriv, createHash as createHash74, createPrivateKey as createPrivateKey2, createPublicKey, diffieHellman, randomBytes as randomBytes45 } from "node:crypto";
 function check32(name, b) {
   if (b.length !== 32)
     throw new Error(`${name} must be 32 bytes`);
@@ -501331,7 +501413,7 @@ var init_wireguard_psk = __esm({
     priv = (raw2) => createPrivateKey2({ key: Buffer.concat([PKCS8, raw2]), format: "der", type: "pkcs8" });
     pub = (raw2) => createPublicKey({ key: Buffer.concat([SPKI, raw2]), format: "der", type: "spki" });
     rawPublic = (raw2) => Buffer.from(createPublicKey(priv(raw2)).export({ format: "der", type: "spki" })).subarray(SPKI.length);
-    key5 = (s, ephemeralPub, gateway) => createHash73("blake2s256").update(LABEL3).update(s).update(ephemeralPub).update(gateway).digest();
+    key5 = (s, ephemeralPub, gateway) => createHash74("blake2s256").update(LABEL3).update(s).update(ephemeralPub).update(gateway).digest();
   }
 });
 
@@ -502441,7 +502523,7 @@ var init_manager4 = __esm({
 });
 
 // ../../packages/host-core/dist/mesh/route-sync.js
-import { createHash as createHash74 } from "node:crypto";
+import { createHash as createHash75 } from "node:crypto";
 async function syncRoutes(running4, memo2, now2 = Date.now) {
   const out = { up: [], added: [], down: [], failed: [], helperAbsent: false };
   if (!await netdAvailable()) {
@@ -502522,7 +502604,7 @@ async function syncRoutes(running4, memo2, now2 = Date.now) {
   return out;
 }
 function upFingerprint(args) {
-  const h = createHash74("sha256");
+  const h = createHash75("sha256");
   const part = (b) => {
     const bytes3 = typeof b === "string" ? Buffer.from(b) : Buffer.from(b ?? new Uint8Array());
     h.update(`${bytes3.length}:`);
@@ -503530,7 +503612,7 @@ var init_restart_policy = __esm({
 });
 
 // ../../packages/host-core/dist/net-service/self-update.js
-import { createHash as createHash75 } from "node:crypto";
+import { createHash as createHash76 } from "node:crypto";
 import { readFileSync as readFileSync76, statSync as statSync93 } from "node:fs";
 function shippedSeq(sigText) {
   let o;
@@ -503631,7 +503713,7 @@ function cachedDigest(path15) {
     const seen2 = digests.get(path15);
     if (seen2 && seen2.size === st.size && seen2.mtimeMs === st.mtimeMs)
       return seen2.sum;
-    const sum = createHash75("sha256").update(readFileSync76(path15)).digest("hex");
+    const sum = createHash76("sha256").update(readFileSync76(path15)).digest("hex");
     digests.set(path15, { size: st.size, mtimeMs: st.mtimeMs, sum });
     return sum;
   } catch {
@@ -503721,7 +503803,7 @@ var init_self_update = __esm({
 });
 
 // ../../packages/host-core/dist/net-service/instance-update.js
-import { createHash as createHash76 } from "node:crypto";
+import { createHash as createHash77 } from "node:crypto";
 import { mkdtempSync as mkdtempSync7, rmSync as rmSync29, writeFileSync as writeFileSync55 } from "node:fs";
 import { tmpdir as tmpdir22 } from "node:os";
 import { join as join275 } from "node:path";
@@ -503852,7 +503934,7 @@ async function fetchReleaseHelper(fetchImpl = fetch, target2 = { platform: proce
           continue;
         throw e;
       }
-      const got = createHash76("sha256").update(bytes3).digest("hex");
+      const got = createHash77("sha256").update(bytes3).digest("hex");
       if (!sum || got !== sum)
         return { ok: false, detail: `${asset} from ${tag2} does not match its published checksum` };
       const dir2 = mkdtempSync7(join275(tmpdir22(), "tesseract-netd-update-"));
@@ -503865,7 +503947,7 @@ async function fetchReleaseHelper(fetchImpl = fetch, target2 = { platform: proce
           const wBytes = new Uint8Array(await (await get(`${base2}/${workerAsset}`)).arrayBuffer());
           const wSum = (await (await get(`${base2}/${workerAsset}.sha256`)).text()).trim().split(/\s+/)[0]?.toLowerCase();
           const wSig = await (await get(`${base2}/${workerAsset}.sig`)).text();
-          if (wSum && createHash76("sha256").update(wBytes).digest("hex") === wSum) {
+          if (wSum && createHash77("sha256").update(wBytes).digest("hex") === wSum) {
             const wName = target2.platform === "win32" ? "tesseract-tailnet.exe" : "tesseract-tailnet";
             writeFileSync55(join275(dir2, wName), wBytes, { mode: 384 });
             writeFileSync55(join275(dir2, `${wName}.sig`), wSig, { mode: 384 });
@@ -507714,7 +507796,7 @@ var init_run_media = __esm({
 
 // ../../packages/host-core/dist/chat-agent.js
 import { randomUUID as randomUUID94 } from "node:crypto";
-import { createReadStream as createReadStream10, mkdirSync as mkdirSync67 } from "node:fs";
+import { createReadStream as createReadStream11, mkdirSync as mkdirSync67 } from "node:fs";
 import { tmpdir as tmpdir23 } from "node:os";
 import { join as join285 } from "node:path";
 import { Readable as Readable17 } from "node:stream";
@@ -507739,7 +507821,7 @@ function createChatAgentRunner(deps6) {
     const res = await fetch(`${deps6.apiUrl}${path15}`, {
       method: "POST",
       headers: { authorization: `Bearer ${token4}`, "content-type": CHAT_RUN_MEDIA_CONTENT_TYPE },
-      body: "file" in body ? Readable17.toWeb(createReadStream10(body.file)) : new Uint8Array(body.bytes),
+      body: "file" in body ? Readable17.toWeb(createReadStream11(body.file)) : new Uint8Array(body.bytes),
       duplex: "half",
       signal: AbortSignal.timeout(18e4 + Math.ceil(size2 / UPLOAD_FLOOR_BYTES_PER_SEC) * 1e3)
     });
@@ -511777,10 +511859,10 @@ var init_rdesk_call_window = __esm({
 });
 
 // ../../packages/host-core/dist/assistant/sign-in.js
-import { createHash as createHash77 } from "node:crypto";
+import { createHash as createHash78 } from "node:crypto";
 import { join as join296 } from "node:path";
 function signInPrint(c) {
-  return createHash77("sha256").update(`tesseract-assistant-sign-in
+  return createHash78("sha256").update(`tesseract-assistant-sign-in
 ${c.dtid}
 ${c.refreshSecret}`).digest("hex");
 }
@@ -513555,7 +513637,7 @@ ${known2.body}`).join("\n\n");
 });
 
 // ../../packages/host-core/dist/memory/qdrant-binary.js
-import { createHash as createHash78 } from "node:crypto";
+import { createHash as createHash79 } from "node:crypto";
 import { chmodSync as chmodSync17, createWriteStream as createWriteStream9, existsSync as existsSync141, mkdirSync as mkdirSync78, readFileSync as readFileSync89, renameSync as renameSync39, rmSync as rmSync34, statSync as statSync94, writeFileSync as writeFileSync67 } from "node:fs";
 import { join as join300 } from "node:path";
 import { Readable as Readable18 } from "node:stream";
@@ -513602,7 +513684,7 @@ async function ensureQdrant(opts = {}) {
   const res = await (opts.fetchImpl ?? fetch)(assetUrl(a), { signal: opts.signal, redirect: "follow" });
   if (!res.ok || !res.body)
     throw new Error(`HTTP ${res.status} for ${a.asset}`);
-  const hash3 = createHash78("sha256");
+  const hash3 = createHash79("sha256");
   let size2 = 0;
   try {
     await pipeline7(Readable18.fromWeb(res.body), async function* (src) {
@@ -514022,7 +514104,7 @@ var init_rebuild = __esm({
 });
 
 // ../../packages/host-core/dist/memory/profiles.js
-import { createHash as createHash79 } from "node:crypto";
+import { createHash as createHash80 } from "node:crypto";
 function profileSubjects(items2, sizes) {
   const on = /* @__PURE__ */ new Map();
   for (const it of items2) {
@@ -514176,7 +514258,7 @@ with its date. Write:
     };
     day6 = (ts) => new Date(ts).toLocaleDateString("en-GB", { day: "numeric", month: "long", year: "numeric", timeZone: "UTC" });
     when3 = (it) => it.eventAt || day6(it.ts);
-    hash2 = (s) => createHash79("sha256").update(s).digest("hex");
+    hash2 = (s) => createHash80("sha256").update(s).digest("hex");
     promptOf = (s) => `SUBJECT: ${s.concept}
 
 MEMORIES:
@@ -517159,11 +517241,11 @@ import { existsSync as existsSync149, readFileSync as readFileSync98, statSync a
 import { homedir as homedir66 } from "node:os";
 import { dirname as dirname137, isAbsolute as isAbsolute50, join as join308, relative as relative40 } from "node:path";
 import { promisify as promisify23 } from "node:util";
-import { createHash as createHash80 } from "node:crypto";
+import { createHash as createHash81 } from "node:crypto";
 import { readFileSync as readFileForHash } from "node:fs";
 function sha256File2(file8) {
   try {
-    return createHash80("sha256").update(readFileForHash(file8)).digest("hex");
+    return createHash81("sha256").update(readFileForHash(file8)).digest("hex");
   } catch {
     return void 0;
   }
@@ -520098,7 +520180,7 @@ var init_clipboard_privacy = __esm({
 });
 
 // ../../packages/host-core/dist/clipboard/clipboard-platform.js
-import { createHash as createHash81 } from "node:crypto";
+import { createHash as createHash82 } from "node:crypto";
 import { spawn as spawn32 } from "node:child_process";
 import { accessSync, constants as fsConstants2, existsSync as existsSync153 } from "node:fs";
 import { delimiter as delimiter3, join as join313 } from "node:path";
@@ -520149,7 +520231,7 @@ function imageFingerprint(img2) {
   const { width, height } = size2;
   if (!width || !height)
     return "";
-  const h = createHash81("sha1");
+  const h = createHash82("sha1");
   if (typeof img2.toBitmap !== "function") {
     try {
       h.update(img2.toPNG());
@@ -520184,7 +520266,7 @@ function imageFingerprint(img2) {
   return `${width}x${height}:${bmp.length}:${h.digest("base64")}`;
 }
 function sha13(s) {
-  return createHash81("sha1").update(s).digest("base64");
+  return createHash82("sha1").update(s).digest("base64");
 }
 function readBufferSafe(clip9, format4) {
   try {
@@ -520886,7 +520968,7 @@ Gtk.main()
 });
 
 // ../../packages/host-core/dist/clipboard/paste-history-store.js
-import { createHash as createHash82, randomUUID as randomUUID98 } from "node:crypto";
+import { createHash as createHash83, randomUUID as randomUUID98 } from "node:crypto";
 import { appendFileSync as appendFileSync10, existsSync as existsSync154, mkdirSync as mkdirSync84, readFileSync as readFileSync102, renameSync as renameSync43, statSync as statSync99, unlinkSync as unlinkSync14, writeFileSync as writeFileSync76 } from "node:fs";
 import { join as join314 } from "node:path";
 function pasteHistoryPath() {
@@ -521138,7 +521220,7 @@ function createPasteHistoryStore(opts = {}) {
     return gone.map((i) => i.id);
   }
   function writeImage(png, thumbJpeg) {
-    const base2 = createHash82("sha256").update(png).digest("hex");
+    const base2 = createHash83("sha256").update(png).digest("hex");
     const dir2 = pasteImagesDir();
     mkdirSync84(dir2, { recursive: true, mode: 448 });
     const imageFile = `${base2}.png`;
@@ -522941,9 +523023,9 @@ var init_standalone_atrium_app = __esm({
 });
 
 // ../../packages/host-core/dist/clipboard/clipboard-sync.js
-import { createHash as createHash83, randomUUID as randomUUID99 } from "node:crypto";
+import { createHash as createHash84, randomUUID as randomUUID99 } from "node:crypto";
 function sha2(input) {
-  return createHash83("sha1").update(input).digest("base64");
+  return createHash84("sha1").update(input).digest("base64");
 }
 function entrySignature(e) {
   return e.kind === "image" ? `img:${e.imagePngBase64 ? sha2(e.imagePngBase64) : ""}` : `txt:${sha2(e.text ?? "")}`;
@@ -524075,7 +524157,7 @@ var init_service4 = __esm({
 });
 
 // ../../packages/host-core/dist/drops/send.js
-import { createReadStream as createReadStream11 } from "node:fs";
+import { createReadStream as createReadStream12 } from "node:fs";
 import { lstat as lstat17, readdir as readdir20 } from "node:fs/promises";
 import { basename as basename79, join as join323, relative as relative41, sep as sep47 } from "node:path";
 async function collectItems(paths, opts) {
@@ -524175,7 +524257,7 @@ async function sendDrop(deps6, req) {
     const local = byRel.get(it.rel);
     if (!local?.abs)
       continue;
-    const raw2 = createReadStream11(local.abs);
+    const raw2 = createReadStream12(local.abs);
     const body2 = contentKey ? encryptStream(raw2, contentKey) : raw2;
     await deps6.upload(`/${created.dropId}/items/${it.itemId}/blob`, body2, contentKey ? void 0 : local.size);
     bytesDone += local.size;
@@ -525823,7 +525905,7 @@ var init_relay_address = __esm({
 });
 
 // ../../packages/host-core/dist/assistant/seed-files.js
-import { createHash as createHash84 } from "node:crypto";
+import { createHash as createHash85 } from "node:crypto";
 import { dirname as dirname145, join as join328, normalize as normalize18, relative as relative42, sep as sep48 } from "node:path";
 import { gunzipSync as gunzipSync3, gzipSync as gzipSync3 } from "node:zlib";
 async function collectSeedFiles(folder) {
@@ -525896,7 +525978,7 @@ function unpackSeedFiles(env) {
     for (const [p, t2] of Object.entries(parsed.files ?? {}))
       if (typeof t2 === "string")
         files[p] = t2;
-    return { files, hash: createHash84("sha256").update(data3).digest("hex") };
+    return { files, hash: createHash85("sha256").update(data3).digest("hex") };
   } catch {
     return null;
   }
@@ -525956,7 +526038,7 @@ var init_seed_files = __esm({
 });
 
 // ../../packages/host-core/dist/assistant/boot.js
-import { createHash as createHash85 } from "node:crypto";
+import { createHash as createHash86 } from "node:crypto";
 import { homedir as homedir70 } from "node:os";
 import { dirname as dirname146, join as join329, resolve as resolve58, sep as sep49 } from "node:path";
 function parse15(raw2, what, problems) {
@@ -526687,7 +526769,7 @@ var init_boot = __esm({
     init_helper_seat();
     init_hosting();
     init_violet2();
-    sha3 = (s) => createHash85("sha256").update(s).digest("hex");
+    sha3 = (s) => createHash86("sha256").update(s).digest("hex");
     SEED_PARTS_FILE = ".seed-parts.json";
     ENGINE_HOMES = [".claude", ".codex", ".gemini", ".local/share/opencode", ".config/opencode"];
     under5 = (p, dir2) => p === dir2 || p.startsWith(dir2.endsWith(sep49) ? dir2 : dir2 + sep49);
@@ -549004,7 +549086,7 @@ init_dist30();
 init_dist30();
 init_dist30();
 import { existsSync as existsSync172, mkdtempSync as mkdtempSync11, readFileSync as readFileSync122, rmSync as rmSync46 } from "node:fs";
-import { createHash as createHash87 } from "node:crypto";
+import { createHash as createHash88 } from "node:crypto";
 import { execFileSync as execFileSync13, spawn as spawn35, spawnSync as spawnSync11 } from "node:child_process";
 import { fileURLToPath as fileURLToPath13 } from "node:url";
 import { tmpdir as tmpdir27 } from "node:os";
@@ -551892,7 +551974,7 @@ async function assistantSignIn(provider14, label4) {
 init_dist2();
 init_base_paths();
 import { spawnSync as spawnSync10 } from "node:child_process";
-import { createHash as createHash86 } from "node:crypto";
+import { createHash as createHash87 } from "node:crypto";
 import { chmodSync as chmodSync20, existsSync as existsSync168, mkdirSync as mkdirSync96, readdirSync as readdirSync32, renameSync as renameSync46, rmSync as rmSync44, statSync as statSync102, symlinkSync as symlinkSync3, writeFileSync as writeFileSync91, lstatSync as lstatSync30, unlinkSync as unlinkSync21 } from "node:fs";
 import { writeFile as writeFile15 } from "node:fs/promises";
 import { createRequire as createRequire8 } from "node:module";
@@ -552043,7 +552125,7 @@ async function fetchChecked(url2, to) {
   const want2 = (await (await fetch(`${url2}.sha256`, { signal: AbortSignal.timeout(6e4), headers: { "user-agent": "tesseract-agent" } })).text()).trim().split(/\s+/)[0]?.toLowerCase();
   if (!want2 || !/^[0-9a-f]{64}$/.test(want2)) throw new Error(`${url2}.sha256: no checksum published`);
   await download2(url2, to);
-  const got = createHash86("sha256").update(await import("node:fs/promises").then((f3) => f3.readFile(to))).digest("hex");
+  const got = createHash87("sha256").update(await import("node:fs/promises").then((f3) => f3.readFile(to))).digest("hex");
   if (got !== want2) throw new Error(`${url2}: checksum mismatch (got ${got.slice(0, 12)}\u2026, expected ${want2.slice(0, 12)}\u2026)`);
 }
 function extract(archive, into) {
@@ -552522,7 +552604,7 @@ async function linkCommand(rest, flags) {
     }
     let linkId;
     if (typeof flags.id === "string") linkId = flags.id;
-    else if (typeof flags.name === "string") linkId = createHash87("sha256").update(flags.name).digest("hex").slice(0, 16);
+    else if (typeof flags.name === "string") linkId = createHash88("sha256").update(flags.name).digest("hex").slice(0, 16);
     else {
       console.error("Provide --name <shared-label> (identical on both machines) or --id <sharedId>.");
       process.exit(1);