tesseract-agent 0.4.16 → 0.4.18

package/dist-bundle/cli.js

@@ -70,7 +70,7 @@ var require_buffer_util = __commonJS({
     "use strict";
     var { EMPTY_BUFFER } = require_constants();
     var FastBuffer = Buffer[Symbol.species];
-    function concat(list, totalLength) {
+    function concat2(list, totalLength) {
       if (list.length === 0) return EMPTY_BUFFER;
       if (list.length === 1) return list[0];
       const target = Buffer.allocUnsafe(totalLength);
@@ -116,7 +116,7 @@ var require_buffer_util = __commonJS({
       return buf;
     }
     module.exports = {
-      concat,
+      concat: concat2,
       mask: _mask,
       toArrayBuffer,
       toBuffer,
@@ -785,7 +785,7 @@ var require_receiver = __commonJS({
       kStatusCode,
       kWebSocket
     } = require_constants();
-    var { concat, toArrayBuffer, unmask } = require_buffer_util();
+    var { concat: concat2, toArrayBuffer, unmask } = require_buffer_util();
     var { isValidStatusCode, isValidUTF8 } = require_validation();
     var FastBuffer = Buffer[Symbol.species];
     var GET_INFO = 0;
@@ -1271,9 +1271,9 @@ var require_receiver = __commonJS({
         if (this._opcode === 2) {
           let data;
           if (this._binaryType === "nodebuffer") {
-            data = concat(fragments, messageLength);
+            data = concat2(fragments, messageLength);
           } else if (this._binaryType === "arraybuffer") {
-            data = toArrayBuffer(concat(fragments, messageLength));
+            data = toArrayBuffer(concat2(fragments, messageLength));
           } else if (this._binaryType === "blob") {
             data = new Blob(fragments);
           } else {
@@ -1291,7 +1291,7 @@ var require_receiver = __commonJS({
             });
           }
         } else {
-          const buf = concat(fragments, messageLength);
+          const buf = concat2(fragments, messageLength);
           if (!this._skipUTF8Validation && !isValidUTF8(buf)) {
             const error51 = this.createError(
               Error,
@@ -2289,7 +2289,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls2 = __require("tls");
-    var { randomBytes: randomBytes4, createHash: createHash6 } = __require("crypto");
+    var { randomBytes: randomBytes5, createHash: createHash6 } = __require("crypto");
     var { Duplex, Readable: Readable2 } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -2827,7 +2827,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key2 = randomBytes4(16).toString("base64");
+      const key2 = randomBytes5(16).toString("base64");
       const request = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -4129,8 +4129,8 @@ function createSchedulerLock(lockDir, ownerId, now = () => Date.now()) {
     }
   };
   const writeLease = () => {
-    const nonce = `${process.pid}-${now()}-${++nonceSeq}`;
-    const rec = { ownerId, pid: process.pid, refreshedAt: now(), nonce };
+    const nonce2 = `${process.pid}-${now()}-${++nonceSeq}`;
+    const rec = { ownerId, pid: process.pid, refreshedAt: now(), nonce: nonce2 };
     const tmp = `${lockFile}.${process.pid}.tmp`;
     try {
       writeFileSync2(tmp, JSON.stringify(rec));
@@ -4144,7 +4144,7 @@ function createSchedulerLock(lockDir, ownerId, now = () => Date.now()) {
       return false;
     }
     const after = read();
-    held = !!after && after.nonce === nonce;
+    held = !!after && after.nonce === nonce2;
     return held;
   };
   return {
@@ -19350,6 +19350,76 @@ var init_cron_tools = __esm({
   }
 });
 
+// ../../packages/shared/dist/permissions.js
+var PERMISSIONS, PERMISSION_BY_ID;
+var init_permissions = __esm({
+  "../../packages/shared/dist/permissions.js"() {
+    "use strict";
+    PERMISSIONS = [
+      {
+        id: "microphone",
+        label: "Microphone",
+        why: "Talk to the agent in voice mode and be heard on group calls.",
+        icon: "Mic",
+        category: "media",
+        applicablePlatforms: ["darwin", "win32"],
+        requestKind: "in-app"
+      },
+      {
+        id: "camera",
+        label: "Camera",
+        why: "Share your video on group calls.",
+        icon: "Camera",
+        category: "media",
+        applicablePlatforms: ["darwin", "win32"],
+        requestKind: "in-app"
+      },
+      {
+        id: "screen-recording",
+        label: "Screen Recording",
+        why: "Capture a screenshot region or share your screen on calls.",
+        icon: "MonitorPlay",
+        category: "media",
+        applicablePlatforms: ["darwin"],
+        requestKind: "settings-only",
+        requiresRelaunchAfterGrant: true,
+        settingsHint: "Enable Tesseract under Screen Recording, then relaunch."
+      },
+      {
+        id: "full-disk-access",
+        label: "Full Disk Access",
+        why: "Show the folders you pinned in Finder\u2019s sidebar.",
+        icon: "FolderLock",
+        category: "system",
+        applicablePlatforms: ["darwin"],
+        requestKind: "settings-only",
+        requiresRelaunchAfterGrant: true,
+        settingsHint: "Enable Tesseract under Full Disk Access, then relaunch."
+      },
+      {
+        id: "notifications",
+        label: "Notifications",
+        why: "Tell you when a background task or agent turn finishes while you\u2019re away.",
+        icon: "Bell",
+        category: "notifications",
+        applicablePlatforms: ["darwin", "win32", "linux"],
+        requestKind: "in-app"
+      },
+      {
+        id: "local-network",
+        label: "Local Network",
+        why: "Connect to your other machines on the same network.",
+        icon: "Wifi",
+        category: "network",
+        applicablePlatforms: ["darwin"],
+        requestKind: "info-only",
+        settingsHint: "Managed by macOS \u2014 allow Tesseract under Local Network in System Settings."
+      }
+    ];
+    PERMISSION_BY_ID = Object.fromEntries(PERMISSIONS.map((p) => [p.id, p]));
+  }
+});
+
 // ../../packages/shared/dist/ws-protocol.js
 var MIRRORED_AGENT_EVENTS;
 var init_ws_protocol = __esm({
@@ -20477,6 +20547,128 @@ var init_design_tokens = __esm({
   }
 });
 
+// ../../packages/shared/dist/file-langs.js
+function langForFilename(name) {
+  const lower = name.toLowerCase();
+  if (SPECIAL_NAMES[lower])
+    return SPECIAL_NAMES[lower];
+  const dot = lower.lastIndexOf(".");
+  if (dot > 0) {
+    const ext = lower.slice(dot + 1);
+    if (EXT_TO_LANG[ext])
+      return EXT_TO_LANG[ext];
+  }
+  return null;
+}
+var EXT_TO_LANG, SPECIAL_NAMES, STATS_HEAVY_DIRS, STATS_SKIP_FILES;
+var init_file_langs = __esm({
+  "../../packages/shared/dist/file-langs.js"() {
+    "use strict";
+    EXT_TO_LANG = {
+      ts: "TypeScript",
+      tsx: "TypeScript",
+      mts: "TypeScript",
+      cts: "TypeScript",
+      js: "JavaScript",
+      jsx: "JavaScript",
+      mjs: "JavaScript",
+      cjs: "JavaScript",
+      py: "Python",
+      pyi: "Python",
+      rb: "Ruby",
+      go: "Go",
+      rs: "Rust",
+      java: "Java",
+      kt: "Kotlin",
+      kts: "Kotlin",
+      c: "C",
+      h: "C",
+      cpp: "C++",
+      cc: "C++",
+      cxx: "C++",
+      hpp: "C++",
+      hh: "C++",
+      cs: "C#",
+      swift: "Swift",
+      m: "Objective-C",
+      mm: "Objective-C++",
+      php: "PHP",
+      dart: "Dart",
+      scala: "Scala",
+      sh: "Shell",
+      bash: "Shell",
+      zsh: "Shell",
+      fish: "Shell",
+      sql: "SQL",
+      html: "HTML",
+      htm: "HTML",
+      css: "CSS",
+      scss: "SCSS",
+      sass: "Sass",
+      less: "Less",
+      vue: "Vue",
+      svelte: "Svelte",
+      json: "JSON",
+      json5: "JSON",
+      jsonc: "JSON",
+      yaml: "YAML",
+      yml: "YAML",
+      toml: "TOML",
+      ini: "INI",
+      xml: "XML",
+      md: "Markdown",
+      markdown: "Markdown",
+      mdx: "MDX",
+      rst: "reStructuredText",
+      tex: "TeX",
+      r: "R",
+      lua: "Lua",
+      pl: "Perl",
+      pm: "Perl",
+      ex: "Elixir",
+      exs: "Elixir",
+      erl: "Erlang",
+      clj: "Clojure",
+      cljs: "Clojure",
+      hs: "Haskell",
+      proto: "Protobuf",
+      gradle: "Gradle",
+      groovy: "Groovy",
+      ps1: "PowerShell",
+      bat: "Batch",
+      cmd: "Batch",
+      vim: "Vim Script",
+      graphql: "GraphQL",
+      gql: "GraphQL"
+    };
+    SPECIAL_NAMES = {
+      dockerfile: "Dockerfile",
+      makefile: "Makefile",
+      cmakelists: "CMake",
+      rakefile: "Ruby",
+      gemfile: "Ruby"
+    };
+    STATS_HEAVY_DIRS = /* @__PURE__ */ new Set([
+      ".git",
+      "node_modules",
+      "dist",
+      "build",
+      ".next",
+      ".turbo",
+      "out",
+      "target",
+      ".cache",
+      "coverage",
+      ".venv",
+      "venv",
+      "__pycache__",
+      ".gradle",
+      "vendor"
+    ]);
+    STATS_SKIP_FILES = /* @__PURE__ */ new Set([".DS_Store", "Thumbs.db"]);
+  }
+});
+
 // ../../packages/shared/dist/snapshot.js
 var SNAPSHOT_MAX_TEXT_BYTES, SNAPSHOT_MAX_BINARY_BYTES, SNAPSHOT_MAX_TOTAL_BYTES;
 var init_snapshot = __esm({
@@ -20492,6 +20684,7 @@ var init_snapshot = __esm({
 var init_dist2 = __esm({
   "../../packages/shared/dist/index.js"() {
     "use strict";
+    init_permissions();
     init_ws_protocol();
     init_frame();
     init_plans();
@@ -20505,6 +20698,7 @@ var init_dist2 = __esm({
     init_rotation();
     init_settings();
     init_design_tokens();
+    init_file_langs();
     init_snapshot();
   }
 });
@@ -21269,7 +21463,7 @@ var init_canvas_tools = __esm({
 });
 
 // ../../packages/agent-core/dist/session-transfer.js
-import { homedir } from "node:os";
+import { homedir as homedir2 } from "node:os";
 import { join as join6, dirname as dirname3, sep, resolve as resolve3 } from "node:path";
 import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2, readdir } from "node:fs/promises";
 import { existsSync } from "node:fs";
@@ -21289,7 +21483,7 @@ function sanitizeProjectDir(cwd) {
   return s.length <= MAX_PROJECT_DIR_LEN ? s : `${s.slice(0, MAX_PROJECT_DIR_LEN)}-${cwdHash(cwd)}`;
 }
 function projectsRoot() {
-  return join6(homedir(), ".claude", "projects");
+  return join6(homedir2(), ".claude", "projects");
 }
 function sessionDir(cwd) {
   return join6(projectsRoot(), sanitizeProjectDir(cwd));
@@ -21802,7 +21996,7 @@ ${input.command}
   }
   return blocks;
 }
-var SEARCH_SCAN_LIMIT, SEARCH_RESULT_LIMIT, SEARCH_MAX_FILE_BYTES, SessionStore;
+var SEARCH_SCAN_LIMIT, SEARCH_RESULT_LIMIT, SEARCH_MAX_FILE_BYTES, FORK_RETRY_ATTEMPTS, FORK_RETRY_DELAY_MS, delay, SessionStore;
 var init_session_store = __esm({
   "../../packages/agent-core/dist/session-store.js"() {
     "use strict";
@@ -21810,6 +22004,9 @@ var init_session_store = __esm({
     SEARCH_SCAN_LIMIT = 200;
     SEARCH_RESULT_LIMIT = 50;
     SEARCH_MAX_FILE_BYTES = 8 * 1024 * 1024;
+    FORK_RETRY_ATTEMPTS = 2;
+    FORK_RETRY_DELAY_MS = 300;
+    delay = (ms) => new Promise((resolve10) => setTimeout(resolve10, ms));
     SessionStore = class {
       /** List resumable sessions. When `projectDir` is given, only sessions whose
        *  cwd matches that project are returned, so each window's Resume list is
@@ -21890,16 +22087,20 @@ var init_session_store = __esm({
        *  Returns the new session id, or null on failure. NOTE: forked sessions start
        *  WITHOUT file-history/undo snapshots (SDK behavior). */
       async forkSession(sessionId, opts) {
-        try {
-          const upToMessageId = opts?.upToMessageId ?? await this.lastResumableMessageId(sessionId, opts?.projectDir);
-          const result = await forkSession(sessionId, {
-            ...opts?.projectDir ? { dir: opts.projectDir } : {},
-            ...upToMessageId ? { upToMessageId } : {},
-            ...opts?.title ? { title: opts.title } : {}
-          });
-          return result.sessionId;
-        } catch {
-          return null;
+        for (let attempt = 0; ; attempt++) {
+          try {
+            const upToMessageId = opts?.upToMessageId ?? await this.lastResumableMessageId(sessionId, opts?.projectDir);
+            const result = await forkSession(sessionId, {
+              ...opts?.projectDir ? { dir: opts.projectDir } : {},
+              ...upToMessageId ? { upToMessageId } : {},
+              ...opts?.title ? { title: opts.title } : {}
+            });
+            return result.sessionId;
+          } catch {
+            if (attempt >= FORK_RETRY_ATTEMPTS)
+              return null;
+            await delay(FORK_RETRY_DELAY_MS);
+          }
         }
       }
       /** The uuid of the last transcript message after which NO tool_use is left without
@@ -21965,7 +22166,7 @@ var init_log = __esm({
 import { readFile as readFile5 } from "node:fs/promises";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { homedir as homedir2 } from "node:os";
+import { homedir as homedir3 } from "node:os";
 import { join as join8 } from "node:path";
 function tokenFromCredsBlob(raw) {
   try {
@@ -21995,7 +22196,7 @@ async function resolveOauthToken(env) {
   const ambientTok = process.env.CLAUDE_CODE_OAUTH_TOKEN?.trim();
   if (ambientTok)
     return ambientTok;
-  const fromAmbientDir = await tokenFromConfigDir(process.env.CLAUDE_CONFIG_DIR ?? join8(homedir2(), ".claude"));
+  const fromAmbientDir = await tokenFromConfigDir(process.env.CLAUDE_CONFIG_DIR ?? join8(homedir3(), ".claude"));
   if (fromAmbientDir)
     return fromAmbientDir;
   if (process.platform === "darwin") {
@@ -22111,17 +22312,45 @@ var init_session_usage = __esm({
   }
 });
 
+// ../../packages/agent-core/dist/kill-tree.js
+import { spawn } from "node:child_process";
+function killProcessTree(child, signal = "SIGKILL") {
+  if (!child || child.pid == null || child.exitCode !== null)
+    return;
+  const pid = child.pid;
+  if (process.platform === "win32") {
+    try {
+      spawn("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
+    } catch {
+    }
+    return;
+  }
+  try {
+    process.kill(-pid, signal);
+  } catch {
+    try {
+      child.kill(signal);
+    } catch {
+    }
+  }
+}
+var init_kill_tree = __esm({
+  "../../packages/agent-core/dist/kill-tree.js"() {
+    "use strict";
+  }
+});
+
 // ../../packages/agent-core/dist/agent-manager.js
 import { query, createSdkMcpServer } from "@anthropic-ai/claude-agent-sdk";
 import { writeFile as writeFile4, mkdir as mkdir4, readFile as readFile6 } from "node:fs/promises";
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { tmpdir, homedir as homedir3 } from "node:os";
+import { tmpdir, homedir as homedir4 } from "node:os";
 import { join as join9, dirname as dirname5 } from "node:path";
 import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { createRequire } from "node:module";
 import { createServer } from "node:net";
-import { spawn, execSync } from "node:child_process";
+import { spawn as spawn2, execSync } from "node:child_process";
 function findClaudeCliJs() {
   const require2 = createRequire(import.meta.url);
   const sdkMain = require2.resolve("@anthropic-ai/claude-agent-sdk");
@@ -22294,9 +22523,9 @@ function sourcesEqual(a, b) {
   if (a.length !== b.length)
     return false;
   const as = [...a].sort();
-  const bs = [...b].sort();
+  const bs2 = [...b].sort();
   for (let i = 0; i < as.length; i++)
-    if (as[i] !== bs[i])
+    if (as[i] !== bs2[i])
       return false;
   return true;
 }
@@ -22328,7 +22557,7 @@ MOBILE (${fw}):
     return "";
   }
 }
-var cachedNodeExe, HUMAN_READABLE_FIELDS, TOOL_RESULT_CAP, MAX_RESULT_IMAGES, MAX_IMAGE_BASE64, PERMISSION_MODES, EDIT_PREVIEW_CAP, AsyncMessagePump, IDLE_REAP_MS, MODERATE_IDLE_MS, STEER_COALESCE_MS, AgentManager;
+var cachedNodeExe, HUMAN_READABLE_FIELDS, TOOL_RESULT_CAP, MAX_RESULT_IMAGES, MAX_IMAGE_BASE64, PERMISSION_MODES, EDIT_PREVIEW_CAP, AsyncMessagePump, IDLE_REAP_MS, MODERATE_IDLE_MS, STEER_COALESCE_MS, STOP_HARD_KILL_AFTER_MS, AgentManager;
 var init_agent_manager = __esm({
   "../../packages/agent-core/dist/agent-manager.js"() {
     "use strict";
@@ -22344,6 +22573,7 @@ var init_agent_manager = __esm({
     init_trace_store();
     init_session_store();
     init_session_usage();
+    init_kill_tree();
     init_log();
     HUMAN_READABLE_FIELDS = ["message", "text", "content", "summary", "description", "output", "stdout", "error", "reason", "name"];
     TOOL_RESULT_CAP = 16e3;
@@ -22393,6 +22623,7 @@ var init_agent_manager = __esm({
     IDLE_REAP_MS = 5 * 60 * 1e3;
     MODERATE_IDLE_MS = 60 * 1e3;
     STEER_COALESCE_MS = 500;
+    STOP_HARD_KILL_AFTER_MS = 1200;
     AgentManager = class {
       send;
       onBrowserRequest;
@@ -23145,7 +23376,7 @@ CRITICAL RULES:
                     // fall back to ~/.tesseract/canvas when the session isn't on disk yet.
                     canvasDir: async () => {
                       const dir = await sessionSidecarDir(live.sessionId, projectDir);
-                      return dir ? join9(dir, "canvas") : join9(process.env.CCB_TESSERACT_DIR ?? join9(homedir3(), ".tesseract"), "canvas");
+                      return dir ? join9(dir, "canvas") : join9(process.env.CCB_TESSERACT_DIR ?? join9(homedir4(), ".tesseract"), "canvas");
                     },
                     emitCanvasReady: (p) => {
                       const ts = Date.now();
@@ -23298,12 +23529,18 @@ CRITICAL RULES:
                 const exe = nodeExe2 ?? process.execPath;
                 const runAsNode = exe === process.execPath && !!process.versions.electron;
                 const spawnEnv = { ...options.env, ...params.env ?? {}, ...params.engineEnv ?? {}, CCB_IPC_PORT: String(live.ipcPort), ...runAsNode ? { ELECTRON_RUN_AS_NODE: "1" } : {} };
-                const child = spawn(exe, [cliJs, ...options.args], {
+                const child = spawn2(exe, [cliJs, ...options.args], {
                   cwd: options.cwd,
                   env: spawnEnv,
                   signal: options.signal,
-                  stdio: ["pipe", "pipe", "pipe"]
+                  stdio: ["pipe", "pipe", "pipe"],
+                  // Own process group (POSIX) so Stop can SIGKILL the WHOLE tree — the
+                  // CLI re-execs node and its Bash tool spawns grandchildren (builds,
+                  // dev servers, sleeps) that a single-PID kill would orphan. Pipes keep
+                  // it attached; we never unref, so the parent still tracks it.
+                  detached: process.platform !== "win32"
                 });
+                live.child = child;
                 return child;
               },
               // Claude Code preset + our browser instructions appended. The preset
@@ -23556,6 +23793,7 @@ CRITICAL RULES:
                   refreshSessionUsage(turnSid);
                 } else if (live.interrupted) {
                   live.interrupted = false;
+                  this.clearStopWatchdog(live);
                   log("Session interrupted by user:", turnSid);
                   emit({ type: "chat:error", sessionId: turnSid, error: "Interrupted." });
                   emit({ type: "agent:status", sessionId: turnSid, status: "idle" });
@@ -23779,6 +24017,7 @@ ${text3}` : header;
           const sid = live.sessionId;
           if (live.interrupted || live.abort.signal.aborted) {
             live.interrupted = false;
+            this.clearStopWatchdog(live);
             log("Session interrupted by user (caught from iterator):", sid);
             emit({ type: "chat:error", sessionId: sid, error: "Interrupted." });
             emit({ type: "agent:status", sessionId: sid, status: "idle" });
@@ -23798,6 +24037,7 @@ ${err.stack}` : ""}` : String(err);
             clearTimeout(live.steerFlushTimer);
             live.steerFlushTimer = void 0;
           }
+          this.clearStopWatchdog(live);
           if (live.sessionId)
             this.liveSessions.delete(live.sessionId);
           this.pendingLiveSessions.delete(live);
@@ -23805,6 +24045,8 @@ ${err.stack}` : ""}` : String(err);
             live.query.close();
           } catch {
           }
+          if (live.abort.signal.aborted)
+            killProcessTree(live.child, "SIGKILL");
           for (const s of live.ipcSockets) {
             try {
               s.destroy();
@@ -23832,28 +24074,54 @@ ${err.stack}` : ""}` : String(err);
           live.pendingSteer = void 0;
           live.interrupted = true;
           live.query.interrupt().catch((err) => {
-            log("interrupt() failed, falling back to abort:", err instanceof Error ? err.message : String(err));
-            try {
-              live.abort.abort();
-            } catch {
-            }
+            log("interrupt() failed, force-killing process tree:", err instanceof Error ? err.message : String(err));
+            this.hardKillSession(live);
           });
+          this.armStopWatchdog(live);
           return true;
         }
         for (const pending of this.pendingLiveSessions) {
           log("Interrupting pending session (no canonical id yet)");
           pending.interrupted = true;
-          pending.query.interrupt().catch(() => {
-            try {
-              pending.abort.abort();
-            } catch {
-            }
-          });
+          pending.query.interrupt().catch(() => this.hardKillSession(pending));
+          this.armStopWatchdog(pending);
           return true;
         }
         log("No active session to interrupt for:", sessionId);
         return false;
       }
+      /** Arm the Stop watchdog: if the graceful interrupt hasn't ended the turn
+       *  within STOP_HARD_KILL_AFTER_MS, force-kill the whole process tree. The
+       *  `interrupted` flag is reset to false when the interrupt is acknowledged
+       *  (result frame / caught iterator), so a timely graceful stop self-cancels. */
+      armStopWatchdog(live) {
+        if (live.killTimer)
+          clearTimeout(live.killTimer);
+        live.killTimer = setTimeout(() => {
+          live.killTimer = void 0;
+          if (live.interrupted && !live.reaped) {
+            log("Stop watchdog: graceful interrupt stalled \u2014 force-killing process tree for", live.sessionId);
+            this.hardKillSession(live);
+          }
+        }, STOP_HARD_KILL_AFTER_MS);
+      }
+      /** Cancel a pending Stop watchdog (graceful interrupt landed / session torn down). */
+      clearStopWatchdog(live) {
+        if (live.killTimer) {
+          clearTimeout(live.killTimer);
+          live.killTimer = void 0;
+        }
+      }
+      /** Force-stop a session NOW: abort the SDK (so the consumer treats it as an
+       *  interrupt) and SIGKILL the CLI's entire process group, reaping any Bash /
+       *  tool / MCP grandchildren that a graceful stop left running. */
+      hardKillSession(live) {
+        try {
+          live.abort.abort();
+        } catch {
+        }
+        killProcessTree(live.child, "SIGKILL");
+      }
       /** M7 — stop ONE background task (vs interruptSession which aborts the whole
        *  turn). Driver-only, same origin guard. No-op if the session/task is gone. */
       async stopTask(sessionId, taskId, callerOrigin) {
@@ -24042,6 +24310,7 @@ ${err.stack}` : ""}` : String(err);
             clearTimeout(live.steerFlushTimer);
             live.steerFlushTimer = void 0;
           }
+          this.clearStopWatchdog(live);
           if (live.sessionId)
             this.liveSessions.delete(live.sessionId);
           this.pendingLiveSessions.delete(live);
@@ -24049,6 +24318,7 @@ ${err.stack}` : ""}` : String(err);
             live.abort.abort();
           } catch {
           }
+          killProcessTree(live.child, "SIGKILL");
           live.pump.end();
         }
       }
@@ -24109,6 +24379,7 @@ __export(dist_exports, {
   getTokenSegments: () => getTokenSegments,
   importSession: () => importSession,
   isToken: () => isToken,
+  killProcessTree: () => killProcessTree,
   log: () => log,
   normalizeTokens: () => normalizeTokens,
   parseColorToRgb: () => parseColorToRgb,
@@ -24137,6 +24408,7 @@ var init_dist4 = __esm({
     init_session_usage();
     init_session_transfer();
     init_log();
+    init_kill_tree();
     init_session_artifacts();
     init_imagegen_tools();
     init_design_tokens2();
@@ -26501,7 +26773,7 @@ var require_build2 = __commonJS({
         throw new Error("BigInt is not defined. Your environment doesn't implement BigInt.");
       }
     }
-    function concat(buffers) {
+    function concat2(buffers) {
       let outputLength = 0;
       let prevLength = 0;
       for (let i = 0; i < buffers.length; i++) {
@@ -26547,7 +26819,7 @@ var require_build2 = __commonJS({
         this.items.push(buf);
       }
       final() {
-        return concat(this.items);
+        return concat2(this.items);
       }
     };
     var powers2 = [new Uint8Array([1])];
@@ -28267,7 +28539,7 @@ ${values.join("\n")}` : `${blockName} :`;
           }
           retBuffers.push(valueBuf);
         }
-        return concat(retBuffers);
+        return concat2(retBuffers);
       }
       fromString(string4) {
         this.value = [];
@@ -28496,7 +28768,7 @@ ${values.join("\n")}` : `${blockName} :`;
           }
           retBuffers.push(valueBuf);
         }
-        return concat(retBuffers);
+        return concat2(retBuffers);
       }
       fromString(string4) {
         this.value = [];
@@ -29710,7 +29982,7 @@ var require_concat = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.concatToUint8Array = concatToUint8Array;
-    exports.concat = concat;
+    exports.concat = concat2;
     var buffer_source_js_1 = require_buffer_source();
     function concatToUint8Array(buffers) {
       const views = [];
@@ -29728,7 +30000,7 @@ var require_concat = __commonJS({
       }
       return result;
     }
-    function concat(first, second, ...rest) {
+    function concat2(first, second, ...rest) {
       let buffers;
       let type;
       if (typeof second === "function") {
@@ -36978,13 +37250,13 @@ var require_lazy_helpers = __commonJS({
       }
     };
     exports.DelayedConstructor = DelayedConstructor;
-    function delay2(wrappedConstructor) {
+    function delay3(wrappedConstructor) {
       if (typeof wrappedConstructor === "undefined") {
         throw new Error("Attempt to `delay` undefined. Constructor must be wrapped in a callback");
       }
       return new DelayedConstructor(wrappedConstructor);
     }
-    exports.delay = delay2;
+    exports.delay = delay3;
   }
 });
 
@@ -38896,11 +39168,11 @@ var require_x509_cjs = __commonJS({
     var brainpoolP384t1 = "brainpoolP384t1";
     var brainpoolP512r1 = "brainpoolP512r1";
     var brainpoolP512t1 = "brainpoolP512t1";
-    var ECDSA = "ECDSA";
+    var ECDSA2 = "ECDSA";
     exports.EcAlgorithm = EcAlgorithm_1 = class EcAlgorithm {
       toAsnAlgorithm(alg) {
         switch (alg.name.toLowerCase()) {
-          case ECDSA.toLowerCase():
+          case ECDSA2.toLowerCase():
             if ("hash" in alg) {
               const hash2 = typeof alg.hash === "string" ? alg.hash : alg.hash.name;
               switch (hash2.toLowerCase()) {
@@ -38985,22 +39257,22 @@ var require_x509_cjs = __commonJS({
         switch (alg.algorithm) {
           case asn1Ecc__namespace.id_ecdsaWithSHA1:
             return {
-              name: ECDSA,
+              name: ECDSA2,
               hash: { name: "SHA-1" }
             };
           case asn1Ecc__namespace.id_ecdsaWithSHA256:
             return {
-              name: ECDSA,
+              name: ECDSA2,
               hash: { name: "SHA-256" }
             };
           case asn1Ecc__namespace.id_ecdsaWithSHA384:
             return {
-              name: ECDSA,
+              name: ECDSA2,
               hash: { name: "SHA-384" }
             };
           case asn1Ecc__namespace.id_ecdsaWithSHA512:
             return {
-              name: ECDSA,
+              name: ECDSA2,
               hash: { name: "SHA-512" }
             };
           case asn1Ecc__namespace.id_ecPublicKey: {
@@ -39011,92 +39283,92 @@ var require_x509_cjs = __commonJS({
             switch (parameters.namedCurve) {
               case asn1Ecc__namespace.id_secp256r1:
                 return {
-                  name: ECDSA,
+                  name: ECDSA2,
                   namedCurve: "P-256"
                 };
               case EcAlgorithm_1.SECP256K1:
                 return {
-                  name: ECDSA,
+                  name: ECDSA2,
                   namedCurve: "K-256"
                 };
               case asn1Ecc__namespace.id_secp384r1:
                 return {
-                  name: ECDSA,
+                  name: ECDSA2,
                   namedCurve: "P-384"
                 };
               case asn1Ecc__namespace.id_secp521r1:
                 return {
-                  name: ECDSA,
+                  name: ECDSA2,
                   namedCurve: "P-521"
                 };
               case idBrainpoolP160r1:
                 return {
-                  name: ECDSA,
+                  name: ECDSA2,
                   namedCurve: brainpoolP160r1
                 };
               case idBrainpoolP160t1:
                 return {
-                  name: ECDSA,
+                  name: ECDSA2,
                   namedCurve: brainpoolP160t1
                 };
               case idBrainpoolP192r1:
                 return {
-                  name: ECDSA,
+                  name: ECDSA2,
                   namedCurve: brainpoolP192r1
                 };
               case idBrainpoolP192t1:
                 return {
-                  name: ECDSA,
+                  name: ECDSA2,
                   namedCurve: brainpoolP192t1
                 };
               case idBrainpoolP224r1:
                 return {
-                  name: ECDSA,
+                  name: ECDSA2,
                   namedCurve: brainpoolP224r1
                 };
               case idBrainpoolP224t1:
                 return {
-                  name: ECDSA,
+                  name: ECDSA2,
                   namedCurve: brainpoolP224t1
                 };
               case idBrainpoolP256r1:
                 return {
-                  name: ECDSA,
+                  name: ECDSA2,
                   namedCurve: brainpoolP256r1
                 };
               case idBrainpoolP256t1:
                 return {
-                  name: ECDSA,
+                  name: ECDSA2,
                   namedCurve: brainpoolP256t1
                 };
               case idBrainpoolP320r1:
                 return {
-                  name: ECDSA,
+                  name: ECDSA2,
                   namedCurve: brainpoolP320r1
                 };
               case idBrainpoolP320t1:
                 return {
-                  name: ECDSA,
+                  name: ECDSA2,
                   namedCurve: brainpoolP320t1
                 };
               case idBrainpoolP384r1:
                 return {
-                  name: ECDSA,
+                  name: ECDSA2,
                   namedCurve: brainpoolP384r1
                 };
               case idBrainpoolP384t1:
                 return {
-                  name: ECDSA,
+                  name: ECDSA2,
                   namedCurve: brainpoolP384t1
                 };
               case idBrainpoolP512r1:
                 return {
-                  name: ECDSA,
+                  name: ECDSA2,
                   namedCurve: brainpoolP512r1
                 };
               case idBrainpoolP512t1:
                 return {
-                  name: ECDSA,
+                  name: ECDSA2,
                   namedCurve: brainpoolP512t1
                 };
             }
@@ -42479,6 +42751,95 @@ var require_selfsigned = __commonJS({
   }
 });
 
+// ../../packages/host-core/dist/peer-link/tls-direct.js
+import tls from "node:tls";
+import { X509Certificate, timingSafeEqual } from "node:crypto";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync9, existsSync as existsSync10, mkdirSync as mkdirSync8 } from "node:fs";
+import { dirname as dirname10 } from "node:path";
+function fingerprintOf(certPem) {
+  return new X509Certificate(certPem).fingerprint256;
+}
+function fingerprintsEqual(a, b) {
+  if (!a || !b)
+    return false;
+  const ba = Buffer.from(a);
+  const bb = Buffer.from(b);
+  return ba.length === bb.length && timingSafeEqual(ba, bb);
+}
+async function loadOrCreateIdentity(certPath, keyPath) {
+  if (existsSync10(certPath) && existsSync10(keyPath)) {
+    const cert = readFileSync9(certPath, "utf8");
+    const key2 = readFileSync9(keyPath, "utf8");
+    return { cert, key: key2, fingerprint256: fingerprintOf(cert) };
+  }
+  const tenYears = new Date(Date.now() + 10 * 365 * 24 * 60 * 60 * 1e3);
+  const pems = await (0, import_selfsigned.generate)([{ name: "commonName", value: "tesseract-peer" }], { keySize: 2048, notAfterDate: tenYears, algorithm: "sha256" });
+  try {
+    mkdirSync8(dirname10(certPath), { recursive: true });
+  } catch {
+  }
+  try {
+    writeFileSync9(certPath, pems.cert, { mode: 384 });
+    writeFileSync9(keyPath, pems.private, { mode: 384 });
+  } catch {
+  }
+  return { cert: pems.cert, key: pems.private, fingerprint256: fingerprintOf(pems.cert) };
+}
+function pinnedConnect(opts) {
+  return new Promise((resolve10, reject) => {
+    let settled = false;
+    const done = (err, sock) => {
+      if (settled)
+        return;
+      settled = true;
+      if (err) {
+        try {
+          sock?.destroy();
+        } catch {
+        }
+        reject(err);
+      } else
+        resolve10(sock);
+    };
+    const socket2 = tls.connect({
+      host: opts.host,
+      port: opts.port,
+      // No CA / hostname identity — we authenticate SOLELY by the brokered
+      // fingerprint, so accept the self-signed cert at the TLS layer and verify
+      // the pin ourselves below (fail-closed).
+      rejectUnauthorized: false,
+      checkServerIdentity: () => void 0,
+      timeout: opts.timeoutMs ?? 8e3
+    }, () => {
+      const peer = socket2.getPeerCertificate();
+      const fp = peer && peer.fingerprint256;
+      if (!fingerprintsEqual(fp, opts.peerFingerprint256)) {
+        done(new Error("peer-link: TLS fingerprint mismatch (fail-closed)"));
+        return;
+      }
+      socket2.setNoDelay(true);
+      done(void 0, socket2);
+    });
+    socket2.once("timeout", () => done(new Error("peer-link: TLS connect timeout")));
+    socket2.once("error", (e) => done(e instanceof Error ? e : new Error(String(e))));
+  });
+}
+function createListener(identity, port, onSocket) {
+  const server = tls.createServer({ cert: identity.cert, key: identity.key, requestCert: false, rejectUnauthorized: false }, (sock) => {
+    sock.setNoDelay(true);
+    onSocket(sock);
+  });
+  server.listen(port, "0.0.0.0");
+  return server;
+}
+var import_selfsigned;
+var init_tls_direct = __esm({
+  "../../packages/host-core/dist/peer-link/tls-direct.js"() {
+    "use strict";
+    import_selfsigned = __toESM(require_selfsigned(), 1);
+  }
+});
+
 // ../../packages/host-core/dist/peer-link/framing.js
 function encodeFrame2(payload) {
   const out = new Uint8Array(4 + payload.length);
@@ -42628,9 +42989,9 @@ var init_transport = __esm({
 });
 
 // ../../packages/host-core/dist/peer-link/stun.js
-import { randomBytes } from "node:crypto";
+import { randomBytes as randomBytes2 } from "node:crypto";
 function encodeBindingRequest() {
-  const txId = randomBytes(12);
+  const txId = randomBytes2(12);
   const packet = Buffer.alloc(20);
   packet.writeUInt16BE(BINDING_REQUEST, 0);
   packet.writeUInt16BE(0, 2);
@@ -42766,11 +43127,11 @@ function quicByteSocket(stream) {
 }
 function pinningVerify(expectedFingerprint256) {
   return async (certs) => {
-    const { X509Certificate: X509Certificate2 } = await import("node:crypto");
     if (!certs.length)
       throw new Error("quic: peer presented no certificate");
+    const { X509Certificate: X509Certificate2 } = await import("node:crypto");
     const fp = new X509Certificate2(Buffer.from(certs[0])).fingerprint256;
-    if (fp !== expectedFingerprint256)
+    if (!fingerprintsEqual(fp, expectedFingerprint256))
       throw new Error("quic: TLS fingerprint mismatch (fail-closed)");
     return void 0;
   };
@@ -42852,6 +43213,7 @@ var init_quic_transport = __esm({
     "use strict";
     init_transport();
     init_stun();
+    init_tls_direct();
     ALPN = ["tesseract-peer"];
     quicModP = null;
     loadQuic = () => quicModP ??= import("@matrixai/quic");
@@ -43934,17 +44296,17 @@ var require_main = __commonJS({
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync14 } from "node:fs";
+import { readFileSync as readFileSync15 } from "node:fs";
 import { createHash as createHash5 } from "node:crypto";
-import { spawn as spawn7 } from "node:child_process";
+import { spawn as spawn8 } from "node:child_process";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { homedir as homedir17 } from "node:os";
-import { dirname as dirname18, join as join36, resolve as resolve9 } from "node:path";
+import { homedir as homedir16 } from "node:os";
+import { dirname as dirname18, join as join38, resolve as resolve9 } from "node:path";
 import { createInterface } from "node:readline/promises";
 
 // ../../packages/host-core/dist/control-link.js
-import { hostname as hostname3, homedir as homedir13 } from "node:os";
-import { join as join29, basename as basename7 } from "node:path";
+import { hostname as hostname3 } from "node:os";
+import { join as join30, basename as basename7 } from "node:path";
 import { mkdirSync as mkdirSync11 } from "node:fs";
 
 // ../../node_modules/ws/wrapper.mjs
@@ -43960,6 +44322,7 @@ var wrapper_default = import_websocket.default;
 
 // ../../packages/host-core/dist/path-guard.js
 import { realpathSync } from "node:fs";
+import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 function canonicalForGuard(p) {
   const abs = resolve(p);
@@ -43990,6 +44353,380 @@ function isInsideRoot(p, root) {
   const rel = relative(realRoot, canonicalForGuard(p));
   return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
 }
+function safeResolve(p, root) {
+  if (!root)
+    return null;
+  try {
+    const real = realpathSync.native(p);
+    return isInsideRoot(real, root) ? real : null;
+  } catch {
+    return isInsideRoot(p, root) ? p : null;
+  }
+}
+function resolveContainmentRoot() {
+  const env = process.env.CCB_HOST_ROOT;
+  return env && env.trim() ? env : null;
+}
+function resolveHostRoot() {
+  return resolveContainmentRoot() ?? homedir();
+}
+
+// ../../packages/e2e/dist/suite.js
+var subtle = globalThis.crypto.subtle;
+var bs = (b) => b;
+var SUITE = "TSE1";
+var EC = { name: "ECDH", namedCurve: "P-256" };
+var ECDSA = { name: "ECDSA", namedCurve: "P-256" };
+function randomBytes(n) {
+  return globalThis.crypto.getRandomValues(new Uint8Array(n));
+}
+function b64u(bytes) {
+  let s = "";
+  for (const b of bytes)
+    s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function unb64u(s) {
+  const pad = s.length % 4 === 0 ? "" : "=".repeat(4 - s.length % 4);
+  const b = atob(s.replace(/-/g, "+").replace(/_/g, "/") + pad);
+  const out = new Uint8Array(b.length);
+  for (let i = 0; i < b.length; i++)
+    out[i] = b.charCodeAt(i);
+  return out;
+}
+function utf8(s) {
+  return new TextEncoder().encode(s);
+}
+function concat(...parts) {
+  const len = parts.reduce((n, p) => n + p.length, 0);
+  const out = new Uint8Array(len);
+  let o = 0;
+  for (const p of parts) {
+    out.set(p, o);
+    o += p.length;
+  }
+  return out;
+}
+async function generateIdentityKeyPair(extractable = false) {
+  const kp = await subtle.generateKey(ECDSA, extractable, ["sign", "verify"]);
+  const publicRaw = new Uint8Array(await subtle.exportKey("raw", kp.publicKey));
+  return { privateKey: kp.privateKey, publicKey: kp.publicKey, publicRaw };
+}
+async function importIdentityPublic(raw) {
+  return subtle.importKey("raw", bs(raw), ECDSA, true, ["verify"]);
+}
+async function exportIdentity(kp) {
+  const privateJwk = await subtle.exportKey("jwk", kp.privateKey);
+  return { privateJwk, publicRaw: b64u(kp.publicRaw) };
+}
+async function importIdentity(privateJwk) {
+  const privateKey = await subtle.importKey("jwk", privateJwk, ECDSA, true, ["sign"]);
+  const pubJwk = { kty: privateJwk.kty, crv: privateJwk.crv, x: privateJwk.x, y: privateJwk.y, ext: true };
+  const publicKey = await subtle.importKey("jwk", pubJwk, ECDSA, true, ["verify"]);
+  const publicRaw = new Uint8Array(await subtle.exportKey("raw", publicKey));
+  return { privateKey, publicKey, publicRaw };
+}
+async function sign(privateKey, message) {
+  return new Uint8Array(await subtle.sign({ name: "ECDSA", hash: "SHA-256" }, privateKey, bs(message)));
+}
+async function verify(publicRaw, message, sig) {
+  try {
+    const key2 = await importIdentityPublic(publicRaw);
+    return await subtle.verify({ name: "ECDSA", hash: "SHA-256" }, key2, bs(sig), bs(message));
+  } catch {
+    return false;
+  }
+}
+async function generateEphemeral() {
+  const kp = await subtle.generateKey(EC, false, ["deriveBits"]);
+  const publicRaw = new Uint8Array(await subtle.exportKey("raw", kp.publicKey));
+  return { privateKey: kp.privateKey, publicRaw };
+}
+async function ecdh(privateKey, peerPublicRaw) {
+  const peer = await subtle.importKey("raw", bs(peerPublicRaw), EC, false, []);
+  return new Uint8Array(await subtle.deriveBits({ name: "ECDH", public: peer }, privateKey, 256));
+}
+async function hkdf(ikm, salt, info, bytes) {
+  const key2 = await subtle.importKey("raw", bs(ikm), "HKDF", false, ["deriveBits"]);
+  return new Uint8Array(await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: bs(salt), info: bs(info) }, key2, bytes * 8));
+}
+async function importAesKey(raw) {
+  return subtle.importKey("raw", bs(raw), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+}
+async function aesSeal(key2, nonce2, plaintext, aad) {
+  return new Uint8Array(await subtle.encrypt({ name: "AES-GCM", iv: bs(nonce2), additionalData: bs(aad) }, key2, bs(plaintext)));
+}
+async function aesOpen(key2, nonce2, ciphertext, aad) {
+  return new Uint8Array(await subtle.decrypt({ name: "AES-GCM", iv: bs(nonce2), additionalData: bs(aad) }, key2, bs(ciphertext)));
+}
+async function sha256(bytes) {
+  return new Uint8Array(await subtle.digest("SHA-256", bs(bytes)));
+}
+
+// ../../packages/e2e/dist/record.js
+function canonicalAad(r, dir, seq) {
+  return utf8(JSON.stringify([1, SUITE, r.ch, r.host, r.client, r.sess, r.bid ?? "", dir, seq]));
+}
+function nonce(prefix, seq) {
+  const n = new Uint8Array(12);
+  n.set(prefix.subarray(0, 4), 0);
+  const dv = new DataView(n.buffer);
+  dv.setUint32(4, Math.floor(seq / 4294967296));
+  dv.setUint32(8, seq >>> 0);
+  return n;
+}
+var WINDOW = 1024;
+var ReplayWindow = class {
+  highest = -1;
+  seen = /* @__PURE__ */ new Set();
+  permits(seq) {
+    if (seq < 0)
+      return false;
+    if (seq <= this.highest - WINDOW)
+      return false;
+    return !this.seen.has(seq);
+  }
+  accept(seq) {
+    this.seen.add(seq);
+    if (seq > this.highest)
+      this.highest = seq;
+    for (const v of this.seen)
+      if (v <= this.highest - WINDOW)
+        this.seen.delete(v);
+  }
+};
+var Sealer = class {
+  key;
+  prefix;
+  dir;
+  seq = 0;
+  constructor(key2, prefix, dir) {
+    this.key = key2;
+    this.prefix = prefix;
+    this.dir = dir;
+  }
+  async seal(routing, plaintext) {
+    const s = this.seq++;
+    const ct = await aesSeal(this.key, nonce(this.prefix, s), plaintext, canonicalAad(routing, this.dir, s));
+    return { e2e: 1, s, ct: b64u(ct) };
+  }
+  async sealJson(routing, payload) {
+    return this.seal(routing, utf8(JSON.stringify(payload)));
+  }
+};
+var Opener = class {
+  key;
+  prefix;
+  dir;
+  window = new ReplayWindow();
+  constructor(key2, prefix, dir) {
+    this.key = key2;
+    this.prefix = prefix;
+    this.dir = dir;
+  }
+  async open(rec, routing) {
+    if (!this.window.permits(rec.s))
+      throw new Error("e2e: replayed or out-of-window sequence");
+    const pt = await aesOpen(this.key, nonce(this.prefix, rec.s), unb64u(rec.ct), canonicalAad(routing, this.dir, rec.s));
+    this.window.accept(rec.s);
+    return pt;
+  }
+  async openJson(rec, routing) {
+    return JSON.parse(new TextDecoder().decode(await this.open(rec, routing)));
+  }
+};
+
+// ../../packages/e2e/dist/handshake.js
+var HELLO_CAPS_DEFAULT = ["fs", "term", "agent"];
+async function helloTranscript(h) {
+  return sha256(concat(utf8(`${h.suite}|${h.sess}|${h.from}|${h.to}|`), unb64u(h.eD), unb64u(h.nD), utf8(`|${h.caps.join(",")}`)));
+}
+function signedBytes(th, eD, eH, nD, nH, signer, tag) {
+  return concat(th, unb64u(eD), unb64u(eH), unb64u(nD), unb64u(nH), utf8(`|${signer}|${tag}`));
+}
+async function deriveSession(rk, role, peerDeviceId, caps) {
+  const kD2H = await importAesKey(await hkdf(rk, new Uint8Array(0), utf8("d2h key"), 32));
+  const kH2D = await importAesKey(await hkdf(rk, new Uint8Array(0), utf8("h2d key"), 32));
+  const pD2H = await hkdf(rk, new Uint8Array(0), utf8("d2h nonce"), 4);
+  const pH2D = await hkdf(rk, new Uint8Array(0), utf8("h2d nonce"), 4);
+  return role === "initiator" ? { sealer: new Sealer(kD2H, pD2H, "d2h"), opener: new Opener(kH2D, pH2D, "h2d"), peerDeviceId, caps } : { sealer: new Sealer(kH2D, pH2D, "h2d"), opener: new Opener(kD2H, pD2H, "d2h"), peerDeviceId, caps };
+}
+async function confirmKey(rk) {
+  return importAesKey(await hkdf(rk, new Uint8Array(0), utf8("confirm"), 32));
+}
+var ZERO_NONCE = new Uint8Array(12);
+async function startHandshake(opts) {
+  const eph = await generateEphemeral();
+  const hello = {
+    t: "e2e:hello",
+    v: 1,
+    suite: SUITE,
+    sess: opts.sess,
+    from: opts.selfDeviceId,
+    to: opts.peerDeviceId,
+    eD: b64u(eph.publicRaw),
+    nD: b64u(randomBytes(16)),
+    caps: opts.caps ?? HELLO_CAPS_DEFAULT
+  };
+  return { hello, state: { hello, eph, identityPriv: opts.identityPriv, selfDeviceId: opts.selfDeviceId } };
+}
+async function finishInitiator(state, resp, peerIdentityPub) {
+  const th = await helloTranscript(state.hello);
+  const okH = await verify(peerIdentityPub, signedBytes(th, state.hello.eD, resp.eH, state.hello.nD, resp.nH, resp.from, "resp"), unb64u(resp.sigH));
+  if (!okH)
+    throw new Error("e2e: host identity signature did not verify");
+  const z2 = await ecdh(state.eph.privateKey, unb64u(resp.eH));
+  const rk = await hkdf(z2, concat(unb64u(state.hello.nD), unb64u(resp.nH)), th, 32);
+  const sigD = await sign(state.identityPriv, signedBytes(th, state.hello.eD, resp.eH, state.hello.nD, resp.nH, state.selfDeviceId, "confirm"));
+  const fin = await aesSeal(await confirmKey(rk), ZERO_NONCE, new Uint8Array(0), th);
+  const confirm2 = { t: "e2e:confirm", v: 1, sess: state.hello.sess, from: state.selfDeviceId, to: resp.from, sigD: b64u(sigD), fin: b64u(fin) };
+  const session = await deriveSession(rk, "initiator", resp.from, state.hello.caps);
+  return { confirm: confirm2, session };
+}
+async function respondHandshake(opts) {
+  const { hello } = opts;
+  if (hello.to !== opts.selfDeviceId)
+    throw new Error("e2e: hello addressed to a different device");
+  const th = await helloTranscript(hello);
+  const eph = await generateEphemeral();
+  const nH = b64u(randomBytes(16));
+  const sigH = await sign(opts.identityPriv, signedBytes(th, hello.eD, b64u(eph.publicRaw), hello.nD, nH, opts.selfDeviceId, "resp"));
+  const resp = { t: "e2e:resp", v: 1, sess: hello.sess, from: opts.selfDeviceId, to: hello.from, eH: b64u(eph.publicRaw), nH, sigH: b64u(sigH) };
+  const z2 = await ecdh(eph.privateKey, unb64u(hello.eD));
+  const rk = await hkdf(z2, concat(unb64u(hello.nD), unb64u(nH)), th, 32);
+  return { resp, pending: { hello, th, rk, resp, selfDeviceId: opts.selfDeviceId } };
+}
+async function finishResponder(pending, confirm2, peerIdentityPub) {
+  const okD = await verify(peerIdentityPub, signedBytes(pending.th, pending.hello.eD, pending.resp.eH, pending.hello.nD, pending.resp.nH, confirm2.from, "confirm"), unb64u(confirm2.sigD));
+  if (!okD)
+    throw new Error("e2e: driver identity signature did not verify");
+  try {
+    await aesOpen(await confirmKey(pending.rk), ZERO_NONCE, unb64u(confirm2.fin), pending.th);
+  } catch {
+    throw new Error("e2e: key confirmation failed");
+  }
+  return deriveSession(pending.rk, "responder", confirm2.from, pending.hello.caps);
+}
+
+// ../../packages/e2e/dist/session.js
+var E2ESessions = class {
+  cfg;
+  map = /* @__PURE__ */ new Map();
+  constructor(cfg2) {
+    this.cfg = cfg2;
+  }
+  has(sessionId) {
+    return !!this.map.get(sessionId)?.session;
+  }
+  getSession(sessionId) {
+    return this.map.get(sessionId)?.session;
+  }
+  /** Tear a session down (decrypt failure / driver gone). Rejects a pending handshake. */
+  drop(sessionId) {
+    const e = this.map.get(sessionId);
+    if (e?.reject && !e.session)
+      e.reject(new Error("e2e: session dropped"));
+    this.map.delete(sessionId);
+  }
+  /** Initiator: ensure an established session for `sessionId` to `peerDeviceId`. Idempotent —
+   *  concurrent callers share the in-flight handshake. */
+  async ensure(sessionId, peerDeviceId) {
+    const existing = this.map.get(sessionId);
+    if (existing?.session)
+      return existing.session;
+    if (existing?.ready)
+      return existing.ready;
+    const entry = {};
+    entry.ready = new Promise((res, rej) => {
+      entry.resolve = res;
+      entry.reject = rej;
+    });
+    this.map.set(sessionId, entry);
+    try {
+      const { hello, state } = await startHandshake({
+        sess: sessionId,
+        selfDeviceId: this.cfg.selfDeviceId,
+        peerDeviceId,
+        identityPriv: this.cfg.identityPriv,
+        caps: this.cfg.caps
+      });
+      entry.initState = state;
+      this.cfg.sendHandshake(hello);
+    } catch (e) {
+      entry.reject?.(e);
+      this.map.delete(sessionId);
+    }
+    return entry.ready;
+  }
+  /** Feed an inbound handshake frame. Throws never (handshake failure rejects the
+   *  pending ensure() / drops the responder entry — callers fall back to plaintext or
+   *  surface the error). */
+  async onHandshake(msg) {
+    try {
+      if (msg.t === "e2e:hello")
+        return await this.onHello(msg);
+      if (msg.t === "e2e:resp")
+        return await this.onResp(msg);
+      if (msg.t === "e2e:confirm")
+        return await this.onConfirm(msg);
+    } catch {
+    }
+  }
+  async onHello(hello) {
+    const { resp, pending } = await respondHandshake({ hello, selfDeviceId: this.cfg.selfDeviceId, identityPriv: this.cfg.identityPriv });
+    this.map.set(hello.sess, { pending });
+    this.cfg.sendHandshake(resp);
+  }
+  async onResp(resp) {
+    const entry = this.map.get(resp.sess);
+    if (!entry?.initState)
+      return;
+    const peerPub = await this.cfg.getPeerIdentityPub(resp.from);
+    if (!peerPub) {
+      entry.reject?.(new Error("e2e: no identity key for peer " + resp.from));
+      this.map.delete(resp.sess);
+      return;
+    }
+    try {
+      const { confirm: confirm2, session } = await finishInitiator(entry.initState, resp, peerPub);
+      entry.session = session;
+      entry.initState = void 0;
+      this.cfg.sendHandshake(confirm2);
+      entry.resolve?.(session);
+    } catch (e) {
+      entry.reject?.(e);
+      this.map.delete(resp.sess);
+    }
+  }
+  async onConfirm(confirm2) {
+    const entry = this.map.get(confirm2.sess);
+    if (!entry?.pending)
+      return;
+    const peerPub = await this.cfg.getPeerIdentityPub(confirm2.from);
+    if (!peerPub) {
+      this.map.delete(confirm2.sess);
+      return;
+    }
+    try {
+      entry.session = await finishResponder(entry.pending, confirm2, peerPub);
+      entry.pending = void 0;
+    } catch {
+      this.map.delete(confirm2.sess);
+    }
+  }
+  /** Seal a payload for an established session, or null if none is established yet. */
+  async seal(sessionId, routing, payload) {
+    const s = this.map.get(sessionId)?.session;
+    return s ? s.sealer.sealJson(routing, payload) : null;
+  }
+  /** Open a sealed record. Throws if no session or on auth failure (caller drops + rehandshakes). */
+  async open(sessionId, routing, rec) {
+    const s = this.map.get(sessionId)?.session;
+    if (!s)
+      throw new Error("e2e: no session for " + sessionId);
+    return s.opener.openJson(rec, routing);
+  }
+};
 
 // ../../packages/host-core/dist/daemon-agent.js
 import { join as join18 } from "node:path";
@@ -44056,8 +44793,16 @@ async function createClaudeCodeBackend(send2, onBrowserRequest, loadPluginRuntim
 }
 
 // ../../packages/host-core/dist/engines/cli-backend-base.js
-import { spawn as spawn2 } from "node:child_process";
+init_dist4();
+import { spawn as spawn3 } from "node:child_process";
 import { randomUUID as randomUUID3 } from "node:crypto";
+var TESSERACT_INTERNAL_SECRET = /^(CCB_JWT_SECRET|JWT_SECRET|TESSERACT_TOKEN|CCB_RELAY_SECRET|TURN_SECRET|LIVEKIT_API_SECRET)$/;
+function scrubInternalSecrets(env) {
+  for (const k of Object.keys(env))
+    if (TESSERACT_INTERNAL_SECRET.test(k))
+      delete env[k];
+  return env;
+}
 var MAX_LIVE = 8;
 var CliAgentBackend = class {
   adapter;
@@ -44098,12 +44843,17 @@ var CliAgentBackend = class {
       emitMsg({ type: "session:created", sessionId, clientRequestId: params.clientRequestId });
     emitMsg({ type: "agent:status", sessionId, clientRequestId: params.clientRequestId, status: "running" });
     const args = this.adapter.buildArgs(params, ctx);
-    const child = spawn2(spawnCfg.command, args, {
+    const child = spawn3(spawnCfg.command, args, {
       cwd: params.projectDir,
       // engineEnv carries the resolved runner env + enabled-skill secrets (the desktop
       // resolves them into the 0600 snapshot); merge so CLI engines get them too.
-      env: { ...process.env, ...spawnCfg.env, ...params.engineEnv ?? {} },
-      stdio: ["ignore", "pipe", "pipe"]
+      // scrubInternalSecrets drops Tesseract's own control-plane secrets (provider
+      // keys are kept — the engine needs them).
+      env: scrubInternalSecrets({ ...process.env, ...spawnCfg.env, ...params.engineEnv ?? {} }),
+      stdio: ["ignore", "pipe", "pipe"],
+      // Own process group (POSIX) so Stop can SIGKILL the whole tree, not just the
+      // CLI's PID — these engines spawn their own tool subprocesses too.
+      detached: process.platform !== "win32"
     });
     const turn = { child, sessionId, clientRequestId: params.clientRequestId, messageId: ctx.messageId, acc: "", buf: "", errored: false, interrupted: false };
     this.live.set(sessionId, turn);
@@ -44151,6 +44901,10 @@ var CliAgentBackend = class {
       emitMsg({ type: "agent:status", sessionId, clientRequestId: turn.clientRequestId, status: "error" });
     });
     child.on("close", (code) => {
+      if (turn.killTimer) {
+        clearTimeout(turn.killTimer);
+        turn.killTimer = void 0;
+      }
       if (this.adapter.streaming) {
         if (turn.buf.trim())
           handleLine(turn.buf);
@@ -44180,10 +44934,14 @@ var CliAgentBackend = class {
     if (!turn)
       return false;
     turn.interrupted = true;
-    try {
-      turn.child.kill("SIGTERM");
-    } catch {
-    }
+    killProcessTree(turn.child, "SIGTERM");
+    if (turn.killTimer)
+      clearTimeout(turn.killTimer);
+    turn.killTimer = setTimeout(() => {
+      turn.killTimer = void 0;
+      if (this.live.has(sessionId))
+        killProcessTree(turn.child, "SIGKILL");
+    }, 1200);
     return true;
   }
   // CLI engines don't expose a resumable on-disk session list to us in v1, so the
@@ -44200,10 +44958,11 @@ var CliAgentBackend = class {
     if (level !== "critical")
       return;
     for (const [id, turn] of this.live) {
-      try {
-        turn.child.kill("SIGTERM");
-      } catch {
+      if (turn.killTimer) {
+        clearTimeout(turn.killTimer);
+        turn.killTimer = void 0;
       }
+      killProcessTree(turn.child, "SIGKILL");
       this.live.delete(id);
     }
   }
@@ -44432,7 +45191,7 @@ init_dist4();
 // ../../packages/host-core/dist/plugin-tools.js
 import { existsSync as existsSync7, readdirSync } from "node:fs";
 import { join as join16 } from "node:path";
-import { homedir as homedir8 } from "node:os";
+import { homedir as homedir9 } from "node:os";
 
 // ../../packages/plugin-host/dist/discovery.js
 import fs2 from "node:fs";
@@ -44767,9 +45526,9 @@ import { join as join15 } from "node:path";
 // ../../packages/host-core/dist/credentials.js
 import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, existsSync as existsSync3, renameSync as renameSync3, chmodSync } from "node:fs";
 import { join as join10 } from "node:path";
-import { homedir as homedir4 } from "node:os";
+import { homedir as homedir5 } from "node:os";
 function daemonDir() {
-  return process.env.CCB_DAEMON_DIR ?? join10(homedir4(), ".tesseract", "daemon");
+  return process.env.CCB_DAEMON_DIR ?? join10(homedir5(), ".tesseract", "daemon");
 }
 function credentialsPath() {
   return join10(daemonDir(), "credentials.json");
@@ -44801,24 +45560,24 @@ function writeCredentials(c) {
 // ../../packages/host-core/dist/runners/resolve.js
 init_dist2();
 import { readFileSync as readFileSync5, existsSync as existsSync5, statSync, mkdirSync as mkdirSync5, writeFileSync as writeFileSync6 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
+import { homedir as homedir7 } from "node:os";
 import { join as join12 } from "node:path";
 import { createHash as createHash2 } from "node:crypto";
 
 // ../../packages/host-core/dist/runners/proxy-router.js
 init_dist2();
-import { spawn as spawn3, execFile as execFile2, execSync as execSync2 } from "node:child_process";
+import { spawn as spawn4, execFile as execFile2, execSync as execSync2 } from "node:child_process";
 import { createRequire as createRequire2 } from "node:module";
 import { randomUUID as randomUUID4, createHash } from "node:crypto";
 import { existsSync as existsSync4, mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
+import { homedir as homedir6 } from "node:os";
 import { join as join11, dirname as dirname6, sep as sep3 } from "node:path";
 import { request as httpRequest } from "node:http";
 var requireFromHere = createRequire2(import.meta.url);
 var ROUTER_PORT = 8787;
 var BIND_HOST = "127.0.0.1";
 var ROUTER_TOKEN = randomUUID4();
-var routerHomeDir = join11(homedir5(), ".tesseract", "router-home");
+var routerHomeDir = join11(homedir6(), ".tesseract", "router-home");
 var lastConfigHash = "";
 var running = false;
 var starting = null;
@@ -44963,7 +45722,7 @@ async function restart() {
   await ccr(["stop"]).catch(() => void 0);
   try {
     const { exe, asNode } = nodeExe();
-    const child = spawn3(exe, [ccrCliPath(), "start"], { env: ccrEnv(asNode), detached: true, stdio: "ignore" });
+    const child = spawn4(exe, [ccrCliPath(), "start"], { env: ccrEnv(asNode), detached: true, stdio: "ignore" });
     child.unref();
   } catch {
     running = false;
@@ -44989,7 +45748,7 @@ function routerEndpointSync(desired) {
 }
 
 // ../../packages/host-core/dist/runners/resolve.js
-var runnerHomeBase = join12(homedir6(), ".tesseract", "runner-home");
+var runnerHomeBase = join12(homedir7(), ".tesseract", "runner-home");
 function materializeClaudeAuthHome(contents) {
   const id = createHash2("sha256").update(contents).digest("hex").slice(0, 16);
   const home = join12(runnerHomeBase, id);
@@ -45045,7 +45804,7 @@ function resolveRunnerEnv(spec) {
   return { ANTHROPIC_BASE_URL: endpoint.baseUrl, ANTHROPIC_AUTH_TOKEN: endpoint.authToken, ANTHROPIC_API_KEY: "" };
 }
 function overridePath() {
-  return join12(process.env.CCB_TESSERACT_DIR ?? join12(homedir6(), ".tesseract"), "runners.json");
+  return join12(process.env.CCB_TESSERACT_DIR ?? join12(homedir7(), ".tesseract"), "runners.json");
 }
 var cache2 = null;
 var cachedMtime = -1;
@@ -45274,7 +46033,7 @@ function setActiveConfig(id) {
 // ../../packages/host-core/dist/daemon-engine-spawn.js
 init_dist2();
 import { execFileSync } from "node:child_process";
-import { homedir as homedir7 } from "node:os";
+import { homedir as homedir8 } from "node:os";
 import { join as join14 } from "node:path";
 function envKey(id) {
   return id.toUpperCase().replace(/[^A-Z0-9]/g, "_");
@@ -45286,10 +46045,10 @@ function augmentedPath() {
     "/opt/homebrew/bin",
     "/usr/bin",
     "/bin",
-    join14(homedir7(), ".local", "bin"),
-    join14(homedir7(), "bin"),
-    join14(homedir7(), ".bun", "bin"),
-    join14(homedir7(), ".npm-global", "bin")
+    join14(homedir8(), ".local", "bin"),
+    join14(homedir8(), "bin"),
+    join14(homedir8(), ".bun", "bin"),
+    join14(homedir8(), ".npm-global", "bin")
   ];
   const seen = /* @__PURE__ */ new Set();
   const parts = [];
@@ -45432,7 +46191,7 @@ function buildDaemonPluginLoader(pluginsDir) {
   };
 }
 function daemonSkillsPluginConfig() {
-  const root = readDaemonAgentSettings().skillsRoot ?? join16(process.env.CCB_TESSERACT_DIR ?? join16(homedir8(), ".tesseract"), "extensions-skills");
+  const root = readDaemonAgentSettings().skillsRoot ?? join16(process.env.CCB_TESSERACT_DIR ?? join16(homedir9(), ".tesseract"), "extensions-skills");
   if (!existsSync7(join16(root, ".claude-plugin", "plugin.json")))
     return null;
   const enabled = join16(root, "skills");
@@ -45728,7 +46487,7 @@ async function closeEnginePage(browserId) {
 // ../../packages/host-core/dist/image-gen-runner.js
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync8, readFileSync as readFileSync8 } from "node:fs";
-import { homedir as homedir9 } from "node:os";
+import { homedir as homedir10 } from "node:os";
 import { join as join17 } from "node:path";
 
 // ../../packages/image-edit-core/dist/types.js
@@ -45945,7 +46704,7 @@ function createImageEditProvider(id, cfg2) {
 
 // ../../packages/host-core/dist/image-gen-runner.js
 function generatedImagesDir() {
-  const home = process.env.CCB_TESSERACT_DIR ?? join17(homedir9(), ".tesseract");
+  const home = process.env.CCB_TESSERACT_DIR ?? join17(homedir10(), ".tesseract");
   return join17(home, "generated-images");
 }
 function creds() {
@@ -46129,12 +46888,143 @@ function refreshDaemonScheduling(b) {
 }
 
 // ../../packages/host-core/dist/fs-remote.js
-import { readdir as readdir2, readFile as readFile7, writeFile as writeFile5, mkdir as mkdir5, cp, rm, rename as renameAsync, stat as stat2 } from "node:fs/promises";
-import { openSync as openSync2, readSync, closeSync as closeSync2, statSync as statSync3, existsSync as existsSync8, watch } from "node:fs";
-import { basename as basename2, dirname as dirname7, join as join19, relative as relative4, resolve as resolve5, sep as sep4, isAbsolute as isAbsolute4 } from "node:path";
+import { readdir as readdir3, readFile as readFile8, writeFile as writeFile5, mkdir as mkdir5, cp, rm, rename as renameAsync, stat as stat2 } from "node:fs/promises";
+import { openSync as openSync2, readSync, closeSync as closeSync2, statSync as statSync3, existsSync as existsSync8, watch, realpathSync as realpathSync2, constants as fsConstants } from "node:fs";
+import { basename as basename2, dirname as dirname7, join as join20, relative as relative4, resolve as resolve5, sep as sep4, isAbsolute as isAbsolute4 } from "node:path";
 import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
+
+// ../../packages/host-core/dist/fs-stats.js
+init_dist2();
+import { readdir as readdir2, lstat, readFile as readFile7 } from "node:fs/promises";
+import { join as join19 } from "node:path";
+var TEXT_CAP = 5 * 1024 * 1024;
+async function dirStats(root, opts) {
+  const start2 = Date.now();
+  const MAX_ENTRIES = 2e5, TIME_MS = 1e4;
+  let fileCount = 0, dirCount = 0, totalBytes = 0, visited = 0, truncated = false;
+  const stack = [root];
+  while (stack.length) {
+    if (visited >= MAX_ENTRIES || Date.now() - start2 > TIME_MS) {
+      truncated = true;
+      break;
+    }
+    const dir = stack.pop();
+    let ents;
+    try {
+      ents = await readdir2(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const e of ents) {
+      if (visited >= MAX_ENTRIES || Date.now() - start2 > TIME_MS) {
+        truncated = true;
+        break;
+      }
+      if (STATS_SKIP_FILES.has(e.name))
+        continue;
+      visited++;
+      if (e.isDirectory()) {
+        if (opts?.excludeHeavy && STATS_HEAVY_DIRS.has(e.name))
+          continue;
+        dirCount++;
+        stack.push(join19(dir, e.name));
+      } else if (e.isFile()) {
+        fileCount++;
+        try {
+          totalBytes += (await lstat(join19(dir, e.name))).size;
+        } catch {
+        }
+      }
+    }
+  }
+  return { fileCount, dirCount, totalBytes, truncated };
+}
+async function codeStats(root) {
+  const start2 = Date.now();
+  const MAX_FILES = 25e3, MAX_BYTES = 256 * 1024 * 1024, TIME_MS = 12e3;
+  const byLang = /* @__PURE__ */ new Map();
+  let totalFiles = 0, totalLines = 0, bytes = 0, truncated = false;
+  const stack = [root];
+  while (stack.length) {
+    if (totalFiles >= MAX_FILES || bytes >= MAX_BYTES || Date.now() - start2 > TIME_MS) {
+      truncated = true;
+      break;
+    }
+    const dir = stack.pop();
+    let ents;
+    try {
+      ents = await readdir2(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const e of ents) {
+      if (totalFiles >= MAX_FILES || bytes >= MAX_BYTES || Date.now() - start2 > TIME_MS) {
+        truncated = true;
+        break;
+      }
+      if (STATS_SKIP_FILES.has(e.name))
+        continue;
+      if (e.isDirectory()) {
+        if (!STATS_HEAVY_DIRS.has(e.name))
+          stack.push(join19(dir, e.name));
+        continue;
+      }
+      if (!e.isFile())
+        continue;
+      const lang = langForFilename(e.name);
+      if (!lang)
+        continue;
+      const full = join19(dir, e.name);
+      let size = 0;
+      try {
+        size = (await lstat(full)).size;
+      } catch {
+        continue;
+      }
+      const row = byLang.get(lang) ?? { files: 0, lines: 0 };
+      row.files++;
+      totalFiles++;
+      if (size <= TEXT_CAP) {
+        try {
+          const txt = await readFile7(full, "utf8");
+          bytes += size;
+          let lines = 0;
+          for (let i = 0; i < txt.length; i++)
+            if (txt.charCodeAt(i) === 10)
+              lines++;
+          if (txt.length && txt.charCodeAt(txt.length - 1) !== 10)
+            lines++;
+          row.lines += lines;
+          totalLines += lines;
+        } catch {
+        }
+      }
+      byLang.set(lang, row);
+    }
+  }
+  const byLangSorted = [...byLang.entries()].map(([lang, v]) => ({ lang, files: v.files, lines: v.lines })).sort((a, b) => b.lines - a.lines || b.files - a.files);
+  return { byLang: byLangSorted, totalFiles, totalLines, truncated };
+}
+
+// ../../packages/host-core/dist/fs-remote.js
 var execFileAsync = promisify2(execFile3);
+function insideOk(p) {
+  const c = resolveContainmentRoot();
+  return c ? isInsideRoot(p, c) : true;
+}
+function safeContentPath(p) {
+  const c = resolveContainmentRoot();
+  if (c)
+    return safeResolve(p, c);
+  try {
+    return realpathSync2.native(p);
+  } catch {
+    return p;
+  }
+}
+var O_NOFOLLOW = fsConstants.O_NOFOLLOW ?? 0;
+var CREATE_EXCL_NOFOLLOW = fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | O_NOFOLLOW;
 var LISTALL_SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
   ".hg",
@@ -46169,7 +47059,7 @@ async function listAllFilesUnder(dir) {
         return;
       let entries;
       try {
-        entries = await readdir2(d, { withFileTypes: true });
+        entries = await readdir3(d, { withFileTypes: true });
       } catch {
         return;
       }
@@ -46178,7 +47068,7 @@ async function listAllFilesUnder(dir) {
           return;
         if (ent.name === ".DS_Store")
           continue;
-        const full = join19(d, ent.name);
+        const full = join20(d, ent.name);
         if (ent.isDirectory()) {
           if (!LISTALL_SKIP_DIRS.has(ent.name))
             await walk(full);
@@ -46294,76 +47184,107 @@ function resolveParent(raw, root) {
   if (raw === "" || raw === "~")
     return root;
   if (raw.startsWith("~/"))
-    return join19(root, raw.slice(2));
-  return isAbsolute4(raw) ? raw : join19(root, raw);
+    return join20(root, raw.slice(2));
+  return isAbsolute4(raw) ? raw : join20(root, raw);
 }
 function resolveUniqueName(dir, name) {
-  const direct = join19(dir, name);
+  const direct = join20(dir, name);
   if (!existsSync8(direct))
     return direct;
   const dot = name.lastIndexOf(".");
   const base = dot > 0 ? name.slice(0, dot) : name;
   const ext = dot > 0 ? name.slice(dot) : "";
   for (let i = 2; i < 1e4; i++) {
-    const candidate = join19(dir, `${base} ${i}${ext}`);
+    const candidate = join20(dir, `${base} ${i}${ext}`);
     if (!existsSync8(candidate))
       return candidate;
   }
   return direct;
 }
+var RL_WINDOW_MS = 1e4;
+var RL_MAX_OPS = 400;
+var RL_MAX_WRITE_BYTES = 256 * 1024 * 1024;
+var rlBuckets = /* @__PURE__ */ new Map();
+var WRITE_OPS = /* @__PURE__ */ new Set(["writeFile", "writeBinary", "createFile", "createProject"]);
+var HEAVY_OPS = /* @__PURE__ */ new Set(["dirStats", "codeStats"]);
+var HEAVY_OP_COST = 25;
+function withinRate(key2, op, bytes) {
+  const now = Date.now();
+  let b = rlBuckets.get(key2);
+  if (!b || now >= b.resetAt) {
+    b = { resetAt: now + RL_WINDOW_MS, ops: 0, writeBytes: 0 };
+    rlBuckets.set(key2, b);
+  }
+  b.ops += HEAVY_OPS.has(op) ? HEAVY_OP_COST : 1;
+  if (WRITE_OPS.has(op))
+    b.writeBytes += bytes;
+  return b.ops <= RL_MAX_OPS && b.writeBytes <= RL_MAX_WRITE_BYTES;
+}
+function releaseFsClient(key2) {
+  rlBuckets.delete(key2);
+}
 var OUTSIDE = (verb) => ({ ok: false, error: `Refusing to ${verb} outside the shared root.` });
 var validName = (n) => !!n && !n.includes("/") && !n.includes("\\") && n !== "." && n !== "..";
 async function readRemoteBytes(root, path5) {
-  if (!isInsideRoot(path5, root))
+  const real = safeContentPath(path5);
+  if (!real)
     return { error: "Path is outside the shared root." };
   try {
-    const s = statSync3(path5);
+    const s = statSync3(real);
     if (!s.isFile())
       return { error: "Not a file" };
     if (s.size > REMOTE_READ_CAP)
       return { error: `File is too large to read whole over the network (${(s.size / 1024 / 1024).toFixed(1)} MB) \u2014 open it locally.` };
-    return { bytes: await readFile7(path5), size: s.size };
+    return { bytes: await readFile8(real), size: s.size };
   } catch (err) {
     return { error: String(err.message) };
   }
 }
-async function runRemoteFsOp(root, op, args) {
+async function runRemoteFsOp(root, op, args, quotaKey) {
   const a = args ?? [];
+  if (quotaKey) {
+    const bytes = op === "writeFile" ? Buffer.byteLength(String(a[1] ?? "")) : op === "writeBinary" ? Math.floor(String(a[1] ?? "").length * 0.75) : 0;
+    if (!withinRate(quotaKey, op, bytes))
+      throw new Error("Too many filesystem requests \u2014 please slow down.");
+  }
   switch (op) {
     case "readDir": {
       const dir = String(a[0] ?? root);
-      if (!isInsideRoot(dir, root))
+      const real = safeContentPath(dir);
+      if (!real)
         return [];
       try {
-        const entries = (await readdir2(dir, { withFileTypes: true })).filter((e) => e.name !== ".DS_Store");
-        const ignored = await gitIgnoredNames(dir, entries.map((e) => e.name));
-        return entries.map((e) => ({ name: e.name, path: join19(dir, e.name), isDir: e.isDirectory(), ignored: ignored.has(e.name) })).sort((x, y) => x.isDir === y.isDir ? x.name.localeCompare(y.name) : x.isDir ? -1 : 1);
+        const entries = (await readdir3(real, { withFileTypes: true })).filter((e) => e.name !== ".DS_Store");
+        const ignored = await gitIgnoredNames(real, entries.map((e) => e.name));
+        return entries.map((e) => ({ name: e.name, path: join20(dir, e.name), isDir: e.isDirectory(), ignored: ignored.has(e.name) })).sort((x, y) => x.isDir === y.isDir ? x.name.localeCompare(y.name) : x.isDir ? -1 : 1);
       } catch {
         return [];
       }
     }
     case "listAllFiles": {
       const dir = String(a[0] ?? root);
-      if (!isInsideRoot(dir, root))
+      const real = safeContentPath(dir);
+      if (!real)
         return [];
       try {
-        return await listAllFilesUnder(dir);
+        return await listAllFilesUnder(real);
       } catch {
         return [];
       }
     }
     case "readFile": {
       const p = String(a[0] ?? "");
-      if (!isInsideRoot(p, root))
+      const real = safeContentPath(p);
+      if (!real)
         return { error: "Path is outside the shared root." };
       const ext = p.split(".").pop()?.toLowerCase() ?? "";
       if (BINARY_EXT.has(ext))
         return { error: "Binary file \u2014 not shown in the editor." };
       try {
-        const s = statSync3(p);
+        const s = statSync3(real);
         if (s.size > TEXT_SIZE_LIMIT)
           return { error: "File too large for text view." };
-        return { content: await readFile7(p, "utf-8") };
+        return { content: await readFile8(real, "utf-8") };
       } catch (err) {
         return { error: String(err.message) };
       }
@@ -46371,11 +47292,12 @@ async function runRemoteFsOp(root, op, args) {
     case "writeFile": {
       const p = String(a[0] ?? "");
       const content = String(a[1] ?? "");
-      if (!isInsideRoot(p, root))
+      const real = safeContentPath(p);
+      if (!real)
         return OUTSIDE("write");
       try {
-        await mkdir5(dirname7(p), { recursive: true });
-        await writeFile5(p, content, "utf-8");
+        await mkdir5(dirname7(real), { recursive: true });
+        await writeFile5(real, content, "utf-8");
         return { ok: true };
       } catch (err) {
         return { ok: false, error: String(err.message) };
@@ -46384,11 +47306,12 @@ async function runRemoteFsOp(root, op, args) {
     case "writeBinary": {
       const p = String(a[0] ?? "");
       const base643 = String(a[1] ?? "");
-      if (!isInsideRoot(p, root))
+      const real = safeContentPath(p);
+      if (!real)
         return OUTSIDE("write");
       try {
-        await mkdir5(dirname7(p), { recursive: true });
-        await writeFile5(p, Buffer.from(base643, "base64"));
+        await mkdir5(dirname7(real), { recursive: true });
+        await writeFile5(real, Buffer.from(base643, "base64"));
         return { ok: true };
       } catch (err) {
         return { ok: false, error: String(err.message) };
@@ -46396,10 +47319,11 @@ async function runRemoteFsOp(root, op, args) {
     }
     case "statFile": {
       const p = String(a[0] ?? "");
-      if (!isInsideRoot(p, root))
+      const real = safeContentPath(p);
+      if (!real)
         return { error: "Path is outside the shared root." };
       try {
-        const s = statSync3(p);
+        const s = statSync3(real);
         if (!s.isFile())
           return { error: "Not a file" };
         const ext = p.split(".").pop()?.toLowerCase() ?? "";
@@ -46410,7 +47334,8 @@ async function runRemoteFsOp(root, op, args) {
     }
     case "readChunk": {
       const p = String(a[0] ?? "");
-      if (!isInsideRoot(p, root))
+      const real = safeContentPath(p);
+      if (!real)
         return { error: "Path is outside the shared root." };
       const off = Math.max(0, Math.floor(Number(a[1]) || 0));
       const len = Math.min(1024 * 1024, Math.max(0, Math.floor(Number(a[2]) || 0)));
@@ -46418,7 +47343,7 @@ async function runRemoteFsOp(root, op, args) {
         return { base64: "", bytesRead: 0 };
       let fd = null;
       try {
-        fd = openSync2(p, "r");
+        fd = openSync2(real, "r");
         const buf = Buffer.alloc(len);
         const bytesRead = readSync(fd, buf, 0, len, off);
         return { base64: buf.subarray(0, bytesRead).toString("base64"), bytesRead };
@@ -46434,13 +47359,14 @@ async function runRemoteFsOp(root, op, args) {
     }
     case "readBinary": {
       const p = String(a[0] ?? "");
-      if (!isInsideRoot(p, root))
+      const real = safeContentPath(p);
+      if (!real)
         return { error: "Path is outside the shared root." };
       try {
-        const s = statSync3(p);
+        const s = statSync3(real);
         if (s.size > REMOTE_READ_CAP)
           return { error: `File is too large to read whole over the network (${(s.size / 1024 / 1024).toFixed(1)} MB) \u2014 open it locally.` };
-        return { base64: (await readFile7(p)).toString("base64"), size: s.size };
+        return { base64: (await readFile8(real)).toString("base64"), size: s.size };
       } catch (err) {
         return { error: String(err.message) };
       }
@@ -46450,8 +47376,8 @@ async function runRemoteFsOp(root, op, args) {
       const name = String(a[1] ?? "").trim();
       if (!validName(name))
         return { ok: false, error: "Invalid project name." };
-      const target = join19(parent, name);
-      if (!isInsideRoot(target, root))
+      const target = join20(parent, name);
+      if (!insideOk(target))
         return { ok: false, error: "Refusing to create a project outside the shared root." };
       if (existsSync8(target))
         return { ok: false, error: `A folder named "${name}" already exists.` };
@@ -46468,14 +47394,14 @@ async function runRemoteFsOp(root, op, args) {
       const name = String(a[1] ?? "").trim();
       if (!validName(name))
         return { ok: false, error: "Invalid name." };
-      if (!isInsideRoot(parent, root))
+      const target = join20(parent, name);
+      if (!insideOk(target))
         return OUTSIDE("create");
-      const target = join19(parent, name);
       if (existsSync8(target))
         return { ok: false, error: `"${name}" already exists.` };
       try {
         if (op === "createFile")
-          await writeFile5(target, "", "utf-8");
+          await writeFile5(target, "", { encoding: "utf-8", flag: CREATE_EXCL_NOFOLLOW });
         else
           await mkdir5(target);
         return { ok: true, path: target };
@@ -46488,9 +47414,9 @@ async function runRemoteFsOp(root, op, args) {
       const newName = String(a[1] ?? "").trim();
       if (!validName(newName))
         return { ok: false, error: "Invalid name." };
-      if (!isInsideRoot(oldPath, root))
+      if (!insideOk(oldPath))
         return OUTSIDE("rename");
-      const newPath = join19(dirname7(oldPath), newName);
+      const newPath = join20(dirname7(oldPath), newName);
       if (existsSync8(newPath))
         return { ok: false, error: `A file named "${newName}" already exists.` };
       try {
@@ -46504,7 +47430,7 @@ async function runRemoteFsOp(root, op, args) {
       const p = String(a[0] ?? "");
       if (!p)
         return { ok: false, error: "Bad request" };
-      if (!isInsideRoot(p, root))
+      if (!insideOk(p))
         return OUTSIDE("delete");
       if (resolve5(p) === resolve5(root))
         return { ok: false, error: "Refusing to delete the shared root." };
@@ -46519,14 +47445,14 @@ async function runRemoteFsOp(root, op, args) {
     case "movePaths": {
       const srcPaths = Array.isArray(a[0]) ? a[0] : [];
       const destDir = String(a[1] ?? "");
-      if (!isInsideRoot(destDir, root))
+      if (!insideOk(destDir))
         return OUTSIDE(op === "copyPaths" ? "copy" : "move");
       try {
         const newPaths = [];
         for (const src of srcPaths) {
           if (typeof src !== "string" || !src)
             continue;
-          if (!isInsideRoot(src, root))
+          if (!insideOk(src))
             return OUTSIDE(op === "copyPaths" ? "copy from" : "move from");
           if (op === "movePaths" && dirname7(src) === destDir) {
             newPaths.push(src);
@@ -46545,18 +47471,31 @@ async function runRemoteFsOp(root, op, args) {
       }
     }
     case "openFolder": {
-      const p = a[0] != null ? resolveParent(String(a[0]), root) : root;
-      if (!isInsideRoot(p, root))
+      const requested = a[0] != null ? resolveParent(String(a[0]), root) : root;
+      const real = safeContentPath(requested);
+      if (!real)
         return { error: "outside_root" };
       try {
-        const s = await stat2(p);
+        const s = await stat2(real);
         if (!s.isDirectory())
           return { error: "not_dir" };
-        return { root: resolve5(p), name: basename2(p) };
+        return { root: resolve5(real), name: basename2(real) };
       } catch {
         return { error: "not_found" };
       }
     }
+    case "dirStats": {
+      const real = safeContentPath(String(a[0] ?? root));
+      if (!real)
+        return { fileCount: 0, dirCount: 0, totalBytes: 0, truncated: false, error: "outside_root" };
+      return dirStats(real, a[1]);
+    }
+    case "codeStats": {
+      const real = safeContentPath(String(a[0] ?? root));
+      if (!real)
+        return { byLang: [], totalFiles: 0, totalLines: 0, truncated: false, error: "outside_root" };
+      return codeStats(real);
+    }
     case "currentRoot":
       return { root, name: basename2(root) };
     case "homeDir":
@@ -46582,7 +47521,7 @@ function watchRemoteRoot(root, key2, onChange) {
       const rel = String(filename);
       if (rel.split(sep4).some((seg) => IGNORED.has(seg)))
         return;
-      pending.add(join19(resolved, rel));
+      pending.add(join20(resolved, rel));
       if (timer)
         clearTimeout(timer);
       timer = setTimeout(() => {
@@ -46766,21 +47705,21 @@ function toNdcIceServers(configs) {
       if (!m)
         continue;
       const scheme = m[1].toLowerCase();
-      const hostname5 = m[2];
+      const hostname6 = m[2];
       const port = m[3] ? parseInt(m[3], 10) : scheme.endsWith("s") ? 5349 : 3478;
       if (scheme.startsWith("stun")) {
-        out.push({ hostname: hostname5, port });
+        out.push({ hostname: hostname6, port });
         continue;
       }
       const transport = (m[4] ?? "udp").toLowerCase();
       const relayType = scheme === "turns" ? "TurnTls" : transport === "tcp" ? "TurnTcp" : "TurnUdp";
-      out.push({ hostname: hostname5, port, username: c.username, password: c.credential, relayType });
+      out.push({ hostname: hostname6, port, username: c.username, password: c.credential, relayType });
     }
   }
   return out;
 }
 var peers = /* @__PURE__ */ new Map();
-var delay = (ms) => new Promise((r) => setTimeout(r, ms));
+var delay2 = (ms) => new Promise((r) => setTimeout(r, ms));
 var CHUNK = 64 * 1024;
 var MAX_MSG = 256 * 1024;
 var HIGH_WATER = 8 * 1024 * 1024;
@@ -46802,7 +47741,7 @@ async function serveGet(dc, id, path5, root) {
   } catch {
     return;
   }
-  const waitDrain = drainers.get(dc) ?? (() => delay(15));
+  const waitDrain = drainers.get(dc) ?? (() => delay2(15));
   for (let off = 0, seq = 0; off < bytes.length; off += CHUNK, seq++) {
     while (dc.isOpen() && dc.bufferedAmount() > HIGH_WATER)
       await waitDrain();
@@ -46946,13 +47885,13 @@ function dynamicMetrics() {
 }
 
 // ../../packages/host-core/dist/fs-transfer.js
-import { readdir as readdir3, lstat, mkdir as mkdir6, chmod, rm as rm2, readlink, symlink, stat as stat3 } from "node:fs/promises";
+import { readdir as readdir4, lstat as lstat2, mkdir as mkdir6, chmod, rm as rm2, readlink, symlink, stat as stat3 } from "node:fs/promises";
 import { openSync as openSync3, readSync as readSync2, closeSync as closeSync3, existsSync as existsSync9, createWriteStream } from "node:fs";
-import { dirname as dirname9, join as join21, relative as relative6, sep as sep6 } from "node:path";
+import { dirname as dirname9, join as join22, relative as relative6, sep as sep6 } from "node:path";
 
 // ../../packages/host-core/dist/active-link/paths.js
-import { homedir as homedir10 } from "node:os";
-import { join as join20, relative as relative5, sep as sep5 } from "node:path";
+import { homedir as homedir11 } from "node:os";
+import { join as join21, relative as relative5, sep as sep5 } from "node:path";
 function activeLinkEnabled() {
   return process.env.CCB_ACTIVE_LINK !== "0";
 }
@@ -46978,7 +47917,7 @@ function toPosixRel(root, abs) {
   return relative5(root, abs).split(sep5).join("/");
 }
 function fromPosixRel(root, rel) {
-  return join20(root, rel.split("/").join(sep5));
+  return join21(root, rel.split("/").join(sep5));
 }
 function isExcludedAbs(abs, root) {
   const rel = toPosixRel(root, abs);
@@ -46987,10 +47926,10 @@ function isExcludedAbs(abs, root) {
   return rel.split("/").some(isExcludedName);
 }
 function activeLinkRoot() {
-  return process.env.CCB_ACTIVE_LINK_DIR ?? join20(homedir10(), ".tesseract", "active-link");
+  return process.env.CCB_ACTIVE_LINK_DIR ?? join21(homedir11(), ".tesseract", "active-link");
 }
 function linkStateDir(linkId) {
-  return join20(activeLinkRoot(), linkId);
+  return join21(activeLinkRoot(), linkId);
 }
 
 // ../../packages/host-core/dist/fs-transfer.js
@@ -47003,9 +47942,9 @@ function clearTimer(t) {
   return null;
 }
 function uniqueDir(parent, name) {
-  let candidate = join21(parent, name);
+  let candidate = join22(parent, name);
   for (let i = 2; existsSync9(candidate) && i < 1e4; i++)
-    candidate = join21(parent, `${name} ${i}`);
+    candidate = join22(parent, `${name} ${i}`);
   return candidate;
 }
 var producers = /* @__PURE__ */ new Map();
@@ -47042,15 +47981,15 @@ async function buildManifest(root, followSymlinks, excludeHeavy) {
   const files = [];
   let totalBytes = 0;
   async function walk(dir) {
-    const entries = await readdir3(dir, { withFileTypes: true });
+    const entries = await readdir4(dir, { withFileTypes: true });
     for (const e of entries) {
       if (ALWAYS_SKIP.has(e.name))
         continue;
       if (e.isDirectory() && excludeHeavy && HEAVY_DIRS.has(e.name))
         continue;
-      const abs = join21(dir, e.name);
+      const abs = join22(dir, e.name);
       const rel = relative6(root, abs).split(sep6).join("/");
-      const st = await lstat(abs).catch(() => null);
+      const st = await lstat2(abs).catch(() => null);
       if (!st)
         continue;
       if (st.isSymbolicLink() && !followSymlinks) {
@@ -47115,11 +48054,11 @@ async function startOutboundTransfer(msg, controllerClientId, ownHostId2, hostRo
   for (let fileIx = 0; fileIx < manifest.files.length && !state.cancelled; fileIx++) {
     const f = manifest.files[fileIx];
     if (f.kind === "symlink") {
-      const target = await readlink(join21(srcPath, f.rel.split("/").join(sep6))).catch(() => "");
+      const target = await readlink(join22(srcPath, f.rel.split("/").join(sep6))).catch(() => "");
       send2({ type: "fs:transferChunk", transferId, toHost, fileIx, rel: f.rel, mode: f.mode, kind: "symlink", offset: 0, base64: Buffer.from(target, "utf-8").toString("base64"), eof: true }, { hostId: toHost });
       continue;
     }
-    const abs = join21(srcPath, f.rel.split("/").join(sep6));
+    const abs = join22(srcPath, f.rel.split("/").join(sep6));
     let fd = null;
     try {
       fd = openSync3(abs, "r");
@@ -47231,7 +48170,7 @@ async function beginInboundTransfer(msg, hostRoot, send2) {
     failNoState("Invalid destination name.");
     return;
   }
-  let destRoot = join21(parent, msg.destName);
+  let destRoot = join22(parent, msg.destName);
   let createdRoot = false;
   if (existsSync9(destRoot)) {
     if (msg.onCollision === "abort") {
@@ -47273,7 +48212,7 @@ async function beginInboundTransfer(msg, hostRoot, send2) {
   try {
     await mkdir6(destRoot, { recursive: true });
     for (const d of msg.dirs) {
-      const abs = join21(destRoot, d.rel.split("/").join(sep6));
+      const abs = join22(destRoot, d.rel.split("/").join(sep6));
       if (isInsideRoot(abs, destRoot))
         await mkdir6(abs, { recursive: true }).catch(() => {
         });
@@ -47287,7 +48226,7 @@ async function writeInboundChunk(msg, send2) {
   if (!s || s.cancelled)
     return;
   armConsumerWatchdog(msg.transferId, send2);
-  const abs = join21(s.destRoot, msg.rel.split("/").join(sep6));
+  const abs = join22(s.destRoot, msg.rel.split("/").join(sep6));
   if (msg.rel.includes("..") || !isInsideRoot(abs, s.destRoot)) {
     failConsumer(msg.transferId, `Refusing a path outside the destination: ${msg.rel}`, send2);
     return;
@@ -47295,7 +48234,7 @@ async function writeInboundChunk(msg, send2) {
   try {
     if (msg.kind === "symlink") {
       const target = Buffer.from(msg.base64, "base64").toString("utf-8");
-      const resolved = join21(dirname9(abs), target);
+      const resolved = join22(dirname9(abs), target);
       if (isInsideRoot(resolved, s.destRoot)) {
         await mkdir6(dirname9(abs), { recursive: true }).catch(() => {
         });
@@ -47370,90 +48309,13 @@ function cancelTransfersForClient(clientId, send2) {
 }
 
 // ../../packages/host-core/dist/peer-link/index.js
-import { homedir as homedir11 } from "node:os";
-import { join as join22 } from "node:path";
-
-// ../../packages/host-core/dist/peer-link/manager.js
-import { randomBytes as randomBytes2 } from "node:crypto";
-
-// ../../packages/host-core/dist/peer-link/tls-direct.js
-var import_selfsigned = __toESM(require_selfsigned(), 1);
-import tls from "node:tls";
-import { X509Certificate } from "node:crypto";
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync9, existsSync as existsSync10, mkdirSync as mkdirSync8 } from "node:fs";
-import { dirname as dirname10 } from "node:path";
-function fingerprintOf(certPem) {
-  return new X509Certificate(certPem).fingerprint256;
-}
-async function loadOrCreateIdentity(certPath, keyPath) {
-  if (existsSync10(certPath) && existsSync10(keyPath)) {
-    const cert = readFileSync9(certPath, "utf8");
-    const key2 = readFileSync9(keyPath, "utf8");
-    return { cert, key: key2, fingerprint256: fingerprintOf(cert) };
-  }
-  const tenYears = new Date(Date.now() + 10 * 365 * 24 * 60 * 60 * 1e3);
-  const pems = await (0, import_selfsigned.generate)([{ name: "commonName", value: "tesseract-peer" }], { keySize: 2048, notAfterDate: tenYears, algorithm: "sha256" });
-  try {
-    mkdirSync8(dirname10(certPath), { recursive: true });
-  } catch {
-  }
-  try {
-    writeFileSync9(certPath, pems.cert, { mode: 384 });
-    writeFileSync9(keyPath, pems.private, { mode: 384 });
-  } catch {
-  }
-  return { cert: pems.cert, key: pems.private, fingerprint256: fingerprintOf(pems.cert) };
-}
-function pinnedConnect(opts) {
-  return new Promise((resolve10, reject) => {
-    let settled = false;
-    const done = (err, sock) => {
-      if (settled)
-        return;
-      settled = true;
-      if (err) {
-        try {
-          sock?.destroy();
-        } catch {
-        }
-        reject(err);
-      } else
-        resolve10(sock);
-    };
-    const socket2 = tls.connect({
-      host: opts.host,
-      port: opts.port,
-      // No CA / hostname identity — we authenticate SOLELY by the brokered
-      // fingerprint, so accept the self-signed cert at the TLS layer and verify
-      // the pin ourselves below (fail-closed).
-      rejectUnauthorized: false,
-      checkServerIdentity: () => void 0,
-      timeout: opts.timeoutMs ?? 8e3
-    }, () => {
-      const peer = socket2.getPeerCertificate();
-      const fp = peer && peer.fingerprint256;
-      if (!fp || fp !== opts.peerFingerprint256) {
-        done(new Error("peer-link: TLS fingerprint mismatch (fail-closed)"));
-        return;
-      }
-      socket2.setNoDelay(true);
-      done(void 0, socket2);
-    });
-    socket2.once("timeout", () => done(new Error("peer-link: TLS connect timeout")));
-    socket2.once("error", (e) => done(e instanceof Error ? e : new Error(String(e))));
-  });
-}
-function createListener(identity, port, onSocket) {
-  const server = tls.createServer({ cert: identity.cert, key: identity.key, requestCert: false, rejectUnauthorized: false }, (sock) => {
-    sock.setNoDelay(true);
-    onSocket(sock);
-  });
-  server.listen(port, "0.0.0.0");
-  return server;
-}
+import { homedir as homedir12 } from "node:os";
+import { join as join23 } from "node:path";
 
 // ../../packages/host-core/dist/peer-link/manager.js
+init_tls_direct();
 init_transport();
+import { randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 
 // ../../packages/host-core/dist/peer-link/candidates.js
 import os2 from "node:os";
@@ -47484,6 +48346,7 @@ function orderCandidates(cands) {
 }
 
 // ../../packages/host-core/dist/peer-link/ladder.js
+init_tls_direct();
 init_transport();
 function pathFor(c) {
   return c.type === "host" ? "lan" : "public";
@@ -47589,7 +48452,7 @@ var PeerLinkManager = class {
       const q = await Promise.resolve().then(() => (init_quic_transport(), quic_transport_exports));
       const socket2 = await q.makeQuicSocket(this.udpPort);
       this.quicSocket = socket2;
-      await q.startQuicServerOnSocket({ socket: socket2, identity, onStream: (bs) => this.acceptInbound(bs, "punch") });
+      await q.startQuicServerOnSocket({ socket: socket2, identity, onStream: (bs2) => this.acceptInbound(bs2, "punch") });
       const refresh = async () => {
         try {
           const s = await q.discoverSrflx(socket2, stunHost, stunPort);
@@ -47651,10 +48514,13 @@ var PeerLinkManager = class {
     let matchedHex;
     const { link, ready } = socketPeerLink(sock, "", path5, {
       expectToken: (f) => {
-        const h = toHex(f);
-        if (this.pendingInbound.has(h)) {
-          matchedHex = h;
-          return true;
+        const hb = Buffer.from(toHex(f));
+        for (const key2 of this.pendingInbound.keys()) {
+          const kb = Buffer.from(key2);
+          if (kb.length === hb.length && timingSafeEqual2(kb, hb)) {
+            matchedHex = key2;
+            return true;
+          }
         }
         return false;
       }
@@ -47798,7 +48664,7 @@ var PeerLinkManager = class {
     this.attach(ctx);
     await this.ensureListener();
     const myFingerprint = (await this.identity()).fingerprint256;
-    const rid = randomBytes2(8).toString("hex");
+    const rid = randomBytes3(8).toString("hex");
     const myCandidates = gatherTcpCandidates(this.listenPort, this.observedIp);
     return new Promise((resolve10, reject) => {
       let settled = false;
@@ -47882,8 +48748,8 @@ var PeerLinkManager = class {
 // ../../packages/host-core/dist/peer-link/index.js
 var P2P_ENABLED = process.env.CCB_P2P !== "0";
 function identityPaths() {
-  const dir = process.env.CCB_P2P_DIR ?? join22(homedir11(), ".tesseract");
-  return { certPath: join22(dir, "peer-cert.pem"), keyPath: join22(dir, "peer-key.pem") };
+  const dir = process.env.CCB_P2P_DIR ?? join23(homedir12(), ".tesseract");
+  return { certPath: join23(dir, "peer-cert.pem"), keyPath: join23(dir, "peer-key.pem") };
 }
 var manager = null;
 function peerLinkManager() {
@@ -47898,9 +48764,9 @@ async function openPeerLink(peerHostId, ctx) {
 }
 
 // ../../packages/host-core/dist/active-link/engine.js
-import { lstat as lstat6, readlink as readlink4, rm as rm3, mkdir as mkdir8, symlink as symlink2, rename as rename2, utimes as utimes2, writeFile as writeFile6 } from "node:fs/promises";
+import { lstat as lstat7, readlink as readlink4, rm as rm3, mkdir as mkdir8, symlink as symlink2, rename as rename2, utimes as utimes2, writeFile as writeFile6 } from "node:fs/promises";
 import { existsSync as existsSync12 } from "node:fs";
-import { dirname as dirname14, join as join27, resolve as resolve8 } from "node:path";
+import { dirname as dirname14, join as join28, resolve as resolve8 } from "node:path";
 
 // ../../packages/host-core/dist/active-link/blocks.js
 import { createHash as createHash3 } from "node:crypto";
@@ -48165,7 +49031,7 @@ var BlockAssembler = class {
 
 // ../../packages/host-core/dist/active-link/manifest.js
 import { readFileSync as readFileSync10, writeFileSync as writeFileSync10, mkdirSync as mkdirSync9, existsSync as existsSync11, renameSync as renameSync5 } from "node:fs";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 
 // ../../packages/host-core/dist/active-link/reconcile.js
 var ABSENT = { kind: "absent", t: -Infinity, hash: "" };
@@ -48201,7 +49067,7 @@ var LinkManifest = class {
     this.dir = dir;
   }
   file() {
-    return join23(this.dir, "manifest.json");
+    return join24(this.dir, "manifest.json");
   }
   load() {
     try {
@@ -48302,14 +49168,14 @@ var LinkManifest = class {
 };
 
 // ../../packages/host-core/dist/active-link/scanner.js
-import { readdir as readdir4, lstat as lstat2, readlink as readlink2 } from "node:fs/promises";
-import { join as join24, sep as sep7 } from "node:path";
+import { readdir as readdir5, lstat as lstat3, readlink as readlink2 } from "node:fs/promises";
+import { join as join25, sep as sep7 } from "node:path";
 async function walkRels(root, extraIgnore) {
   const out = [];
   async function rec(dir) {
     let entries;
     try {
-      entries = await readdir4(dir, { withFileTypes: true });
+      entries = await readdir5(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -48318,7 +49184,7 @@ async function walkRels(root, extraIgnore) {
         continue;
       if (e.isDirectory() && HEAVY_DIRS.has(e.name))
         continue;
-      const abs = join24(dir, e.name);
+      const abs = join25(dir, e.name);
       if (extraIgnore?.(abs))
         continue;
       if (e.isDirectory())
@@ -48335,7 +49201,7 @@ async function scanTree(root, prior, allow, extraIgnore) {
   const rels = allow ? [...allow] : await walkRels(root, extraIgnore);
   for (const rel of rels) {
     const abs = fromPosixRel(root, rel);
-    const st = await lstat2(abs).catch(() => null);
+    const st = await lstat3(abs).catch(() => null);
     if (!st)
       continue;
     if (st.isSymbolicLink()) {
@@ -48343,9 +49209,9 @@ async function scanTree(root, prior, allow, extraIgnore) {
       records.set(rel, { kind: "symlink", mtimeMs: Math.floor(st.mtimeMs), size: 0, mode: st.mode, hash: hashString(target), blocks: [] });
     } else if (st.isFile()) {
       const mtimeMs = Math.floor(st.mtimeMs);
-      const cached2 = prior?.getRecord(rel);
-      if (cached2 && cached2.kind === "file" && cached2.size === st.size && cached2.mtimeMs === mtimeMs) {
-        records.set(rel, { ...cached2, mode: st.mode });
+      const cached3 = prior?.getRecord(rel);
+      if (cached3 && cached3.kind === "file" && cached3.size === st.size && cached3.mtimeMs === mtimeMs) {
+        records.set(rel, { ...cached3, mode: st.mode });
       } else {
         const h = await hashFileBlocks(abs).catch(() => null);
         if (!h)
@@ -48357,7 +49223,7 @@ async function scanTree(root, prior, allow, extraIgnore) {
   return { records };
 }
 function absOf(root, rel) {
-  return join24(root, rel.split("/").join(sep7));
+  return join25(root, rel.split("/").join(sep7));
 }
 
 // ../../packages/host-core/dist/active-link/gitignore.js
@@ -48375,7 +49241,7 @@ async function gitSyncedFiles(root) {
 
 // ../../packages/host-core/dist/active-link/session.js
 import { createHash as createHash4 } from "node:crypto";
-import { lstat as lstat3, readlink as readlink3, open as open2 } from "node:fs/promises";
+import { lstat as lstat4, readlink as readlink3, open as open2 } from "node:fs/promises";
 var OutboundSender = class {
   deps;
   queue = [];
@@ -48433,8 +49299,12 @@ var OutboundSender = class {
     }
   }
   async sendWholeFile(rel) {
+    if (rel.includes("..") || !isInsideRoot(absOf(this.deps.localRoot, rel), this.deps.localRoot)) {
+      this.deps.onError?.(`Refused a path outside the link root: ${rel}`);
+      return;
+    }
     const abs = absOf(this.deps.localRoot, rel);
-    const st = await lstat3(abs).catch(() => null);
+    const st = await lstat4(abs).catch(() => null);
     if (!st)
       return;
     const { linkId, ownHostId: ownHostId2, send: send2 } = this.deps;
@@ -48522,8 +49392,12 @@ var OutboundSender = class {
       this.deps.onSent?.(rel);
   }
   async sendBlocks(rel, indexes) {
+    if (rel.includes("..") || !isInsideRoot(absOf(this.deps.localRoot, rel), this.deps.localRoot)) {
+      this.deps.onError?.(`Refused a path outside the link root: ${rel}`);
+      return;
+    }
     const abs = absOf(this.deps.localRoot, rel);
-    const st = await lstat3(abs).catch(() => null);
+    const st = await lstat4(abs).catch(() => null);
     if (!st || !st.isFile())
       return;
     const { linkId, ownHostId: ownHostId2, send: send2 } = this.deps;
@@ -48568,12 +49442,12 @@ var OutboundSender = class {
 
 // ../../node_modules/chokidar/esm/index.js
 import { stat as statcb } from "fs";
-import { stat as stat6, readdir as readdir6 } from "fs/promises";
+import { stat as stat6, readdir as readdir7 } from "fs/promises";
 import { EventEmitter as EventEmitter2 } from "events";
 import * as sysPath2 from "path";
 
 // ../../node_modules/readdirp/esm/index.js
-import { stat as stat4, lstat as lstat4, readdir as readdir5, realpath } from "node:fs/promises";
+import { stat as stat4, lstat as lstat5, readdir as readdir6, realpath } from "node:fs/promises";
 import { Readable } from "node:stream";
 import { resolve as presolve, relative as prelative, join as pjoin, sep as psep } from "node:path";
 var EntryTypes = {
@@ -48640,7 +49514,7 @@ var ReaddirpStream = class extends Readable {
     const { root, type } = opts;
     this._fileFilter = normalizeFilter(opts.fileFilter);
     this._directoryFilter = normalizeFilter(opts.directoryFilter);
-    const statMethod = opts.lstat ? lstat4 : stat4;
+    const statMethod = opts.lstat ? lstat5 : stat4;
     if (wantBigintFsStats) {
       this._stat = (path5) => statMethod(path5, { bigint: true });
     } else {
@@ -48711,7 +49585,7 @@ var ReaddirpStream = class extends Readable {
   async _exploreDir(path5, depth) {
     let files;
     try {
-      files = await readdir5(path5, this._rdOptions);
+      files = await readdir6(path5, this._rdOptions);
     } catch (error51) {
       this._onError(error51);
     }
@@ -48750,7 +49624,7 @@ var ReaddirpStream = class extends Readable {
       const full = entry.fullPath;
       try {
         const entryRealPath = await realpath(full);
-        const entryRealPathStats = await lstat4(entryRealPath);
+        const entryRealPathStats = await lstat5(entryRealPath);
         if (entryRealPathStats.isFile()) {
           return "file";
         }
@@ -48793,7 +49667,7 @@ function readdirp(root, options = {}) {
 
 // ../../node_modules/chokidar/esm/handler.js
 import { watchFile, unwatchFile, watch as fs_watch } from "fs";
-import { open as open3, stat as stat5, lstat as lstat5, realpath as fsrealpath } from "fs/promises";
+import { open as open3, stat as stat5, lstat as lstat6, realpath as fsrealpath } from "fs/promises";
 import * as sysPath from "path";
 import { type as osType } from "os";
 var STR_DATA = "data";
@@ -48820,7 +49694,7 @@ var EVENTS = {
 };
 var EV = EVENTS;
 var THROTTLE_MODE_WATCH = "watch";
-var statMethods = { lstat: lstat5, stat: stat5 };
+var statMethods = { lstat: lstat6, stat: stat5 };
 var KEY_LISTENERS = "listeners";
 var KEY_ERR = "errHandlers";
 var KEY_RAW = "rawEmitters";
@@ -49680,7 +50554,7 @@ var DirEntry = class {
       return;
     const dir = this.path;
     try {
-      await readdir6(dir);
+      await readdir7(dir);
     } catch (err) {
       if (this._removeWatcher) {
         this._removeWatcher(sysPath2.dirname(dir), sysPath2.basename(dir));
@@ -50374,7 +51248,7 @@ var ActiveLinkEngine = class {
   }
   async start() {
     this.emit({ type: "status", linkId: this.opts.linkId, state: "scanning" });
-    await rm3(join27(this.stateDir, ".staging"), { recursive: true, force: true }).catch(() => {
+    await rm3(join28(this.stateDir, ".staging"), { recursive: true, force: true }).catch(() => {
     });
     this.manifest.load();
     await this.reconcileScan();
@@ -50596,16 +51470,18 @@ var ActiveLinkEngine = class {
   // ── Block-delta: sender side (reply to a block-map request) ───────────────────
   async onBlockMapReq(rel) {
     const abs = absOf(this.opts.localRoot, rel);
-    const st = await lstat6(abs).catch(() => null);
+    if (rel.includes("..") || !isInsideRoot(abs, this.opts.localRoot))
+      return;
+    const st = await lstat7(abs).catch(() => null);
     if (!st || !st.isFile())
       return;
     const mtimeMs = Math.floor(st.mtimeMs);
-    const cached2 = this.manifest.getRecord(rel);
+    const cached3 = this.manifest.getRecord(rel);
     let wholeHash;
     let blocks;
-    if (cached2 && cached2.kind === "file" && cached2.size === st.size && cached2.mtimeMs === mtimeMs) {
-      wholeHash = cached2.hash;
-      blocks = cached2.blocks;
+    if (cached3 && cached3.kind === "file" && cached3.size === st.size && cached3.mtimeMs === mtimeMs) {
+      wholeHash = cached3.hash;
+      blocks = cached3.blocks;
     } else {
       const h = await hashFileBlocks(abs).catch(() => null);
       if (!h)
@@ -50819,6 +51695,8 @@ var ActiveLinkEngine = class {
     const fromRec = this.manifest.getRecord(fromRel);
     const fromAbs = absOf(this.opts.localRoot, fromRel);
     const toAbs2 = absOf(this.opts.localRoot, toRel2);
+    if (fromRel.includes("..") || !isInsideRoot(fromAbs, this.opts.localRoot))
+      return;
     if (toRel2.includes("..") || !isInsideRoot(toAbs2, this.opts.localRoot))
       return;
     if (fromRec && fromRec.kind === "file") {
@@ -50916,7 +51794,7 @@ var ActiveLinkEngine = class {
   /** Current on-disk record for a rel, or null if missing/a directory. */
   async computeRecord(rel) {
     const abs = absOf(this.opts.localRoot, rel);
-    const st = await lstat6(abs).catch(() => null);
+    const st = await lstat7(abs).catch(() => null);
     if (!st || st.isDirectory())
       return null;
     if (st.isSymbolicLink()) {
@@ -50926,9 +51804,9 @@ var ActiveLinkEngine = class {
     if (!st.isFile())
       return null;
     const mtimeMs = Math.floor(st.mtimeMs);
-    const cached2 = this.manifest.getRecord(rel);
-    if (cached2 && cached2.kind === "file" && cached2.size === st.size && cached2.mtimeMs === mtimeMs) {
-      return { ...cached2, mode: st.mode };
+    const cached3 = this.manifest.getRecord(rel);
+    if (cached3 && cached3.kind === "file" && cached3.size === st.size && cached3.mtimeMs === mtimeMs) {
+      return { ...cached3, mode: st.mode };
     }
     const h = await hashFileBlocks(abs).catch(() => null);
     if (!h)
@@ -50998,7 +51876,7 @@ var ActiveLinkEngine = class {
     this.inboundWatchdog.clear();
   }
   stagingPath(rel, tag) {
-    return join27(this.stateDir, ".staging", `${hashString(rel)}.${tag}`);
+    return join28(this.stateDir, ".staging", `${hashString(rel)}.${tag}`);
   }
   pruneSuppress() {
     const now = this.now();
@@ -51024,9 +51902,9 @@ var ActiveLinkEngine = class {
 
 // ../../packages/host-core/dist/active-link/config.js
 import { readFileSync as readFileSync11, writeFileSync as writeFileSync11, mkdirSync as mkdirSync10, existsSync as existsSync13, renameSync as renameSync6, watch as watch4 } from "node:fs";
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 function configPath2() {
-  return join28(activeLinkRoot(), "links.json");
+  return join29(activeLinkRoot(), "links.json");
 }
 function loadLinkConfigs() {
   try {
@@ -51063,7 +51941,7 @@ function saveLinkConfig(cfg2) {
   writeAll(links);
 }
 function pendingPath() {
-  return join28(activeLinkRoot(), "pending-deprovisions.json");
+  return join29(activeLinkRoot(), "pending-deprovisions.json");
 }
 function loadPendingDeprovisions() {
   try {
@@ -51239,7 +52117,7 @@ init_dist4();
 
 // ../../packages/host-core/dist/pty-manager.js
 import { existsSync as existsSync14 } from "node:fs";
-import { homedir as homedir12 } from "node:os";
+import { homedir as homedir13 } from "node:os";
 var ptyPromise = null;
 function loadPty() {
   if (!ptyPromise) {
@@ -51276,15 +52154,13 @@ async function openPty(opts, sink) {
   const pty = await loadPty();
   if (!pty)
     throw new Error("Terminal support is unavailable on this machine.");
+  if (!opts.local && opts.shell && !new Set(listInterpreters().map((i) => i.path)).has(opts.shell)) {
+    throw new Error("Requested shell is not an allowed interpreter on this machine.");
+  }
   const shell = opts.shell || defaultShell();
   const args = opts.args ?? defaultArgs(shell);
   const cwd = resolveCwd(opts.cwd, opts.hostRoot);
-  const env = {
-    ...process.env,
-    ...opts.env,
-    TERM: "xterm-256color",
-    COLORTERM: "truecolor"
-  };
+  const env = buildChildEnv(opts);
   let proc;
   try {
     proc = pty.spawn(shell, args, {
@@ -51464,8 +52340,34 @@ function defaultArgs(shell) {
     return [];
   return ["bash", "zsh", "fish"].includes(idForPath(shell)) ? ["-l"] : [];
 }
+var DANGEROUS_ENV_KEY = /^(LD_|DYLD_)|PRELOAD|^NODE_OPTIONS$|^PATH$|^BASH_ENV$|^ENV$|^ZDOTDIR$|^IFS$|^PROMPT_COMMAND$|^PERL5LIB$|^PYTHONPATH$|^PYTHONSTARTUP$|^GIT_SSH|^GIT_EXTERNAL_DIFF$/i;
+var REMOTE_ENV_ALLOW = ["HOME", "USER", "LOGNAME", "LANG", "LC_ALL", "LC_CTYPE", "TZ", "PATH", "SHELL", "TMPDIR", "SystemRoot", "ComSpec", "PATHEXT", "USERPROFILE", "APPDATA", "LOCALAPPDATA"];
+function stripDangerousEnv(env) {
+  const out = {};
+  if (env) {
+    for (const [k, v] of Object.entries(env))
+      if (!DANGEROUS_ENV_KEY.test(k))
+        out[k] = v;
+  }
+  return out;
+}
+function buildChildEnv(opts) {
+  const base = {};
+  if (opts.local) {
+    Object.assign(base, process.env);
+    Object.assign(base, opts.env ?? {});
+  } else {
+    for (const k of REMOTE_ENV_ALLOW)
+      if (process.env[k] != null)
+        base[k] = process.env[k];
+    Object.assign(base, stripDangerousEnv(opts.env));
+  }
+  base.TERM = "xterm-256color";
+  base.COLORTERM = "truecolor";
+  return base;
+}
 function resolveCwd(cwd, hostRoot) {
-  const fallback = hostRoot || homedir12();
+  const fallback = hostRoot || homedir13();
   if (!cwd)
     return fallback;
   if (!existsSync14(cwd))
@@ -51666,7 +52568,17 @@ async function createElevenLabsAgent(args) {
         first_message: "",
         language
       },
-      asr: { quality: "high", provider: "elevenlabs", user_input_audio_format: "pcm_16000" },
+      // ElevenLabs retired "Original ASR" (provider:'elevenlabs') — after 2026-07-08
+      // create/patch with it returns an error. scribe_realtime (Scribe v2.2 Realtime)
+      // is the successor and supports pcm_16000 (verified against a live agent).
+      // keyterm prompting boosts recognition of brand/feature terms the guide
+      // discusses (Scribe realtime caps at 50 terms × 20 chars).
+      asr: {
+        quality: "high",
+        provider: "scribe_realtime",
+        user_input_audio_format: "pcm_16000",
+        keywords: ["Tesseract", "Claude", "Anthropic", "MCP", "worktree", "subagent", "plugin"]
+      },
       tts: {
         model_id: "eleven_flash_v2",
         voice_id: voiceId,
@@ -51675,7 +52587,12 @@ async function createElevenLabsAgent(args) {
         speed: 1,
         similarity_boost: 0.8
       },
-      turn: { turn_timeout: 7, turn_eagerness: "normal" },
+      // turn_v3 = latest turn-taking model (better accuracy + lower turn latency).
+      // Eagerness stays 'normal' (NOT 'patient' like the phone info-collection
+      // bots): the guide is a real-time desktop assistant and must stay responsive.
+      turn: { turn_timeout: 7, turn_eagerness: "normal", turn_model: "turn_v3" },
+      // Ignore background voices (room noise / other people) to cut false barge-ins.
+      vad: { background_voice_detection: true },
       conversation: {
         text_only: false,
         // 2h — long working sessions. NOT per-conversation overridable (EL pins
@@ -52879,7 +53796,8 @@ function turnEnded(key2) {
 function turnRekeyed(from, to) {
   cfg?.power.turnRekeyed(from, to);
 }
-var HOST_ROOT = process.env.CCB_HOST_ROOT ?? homedir13();
+var HOST_ROOT = resolveHostRoot();
+var HOST_CONTAIN = resolveContainmentRoot() ?? void 0;
 var hooks = null;
 var socket = null;
 var heartbeat = null;
@@ -52920,13 +53838,43 @@ function wsUrl(token) {
   return `${backendOrigin.replace(/^http/, "ws")}/ws?token=${encodeURIComponent(token)}`;
 }
 var outbox = [];
-function send(channel, payload, extra) {
+function rawSend(channel, payload, extra) {
   const data = JSON.stringify({ channel, payload, ...extra });
   if (socket && socket.readyState === 1)
     socket.send(data);
   else if (socket && socket.readyState === 0 && outbox.length < 256)
     outbox.push(data);
 }
+var hostSessions = null;
+var sessToClient = /* @__PURE__ */ new Map();
+var clientToSess = /* @__PURE__ */ new Map();
+var sessHost = /* @__PURE__ */ new Map();
+var sealChains = /* @__PURE__ */ new Map();
+var SEALABLE_CHANNELS = /* @__PURE__ */ new Set(["agent", "fs", "term", "browser", "editor"]);
+function e2eRouting(channel, sess, browserId) {
+  return { ch: channel, host: sessHost.get(sess) ?? "", client: "", sess, bid: typeof browserId === "string" ? browserId : "" };
+}
+function e2eRequired() {
+  return !!hostSessions && process.env.CCB_E2E_REQUIRED === "1";
+}
+function send(channel, payload, extra) {
+  const clientId = extra && typeof extra.clientId === "string" ? extra.clientId : void 0;
+  const sess = clientId ? clientToSess.get(clientId) : void 0;
+  const isHandshake = !!payload && typeof payload.t === "string" && payload.t.startsWith("e2e:");
+  if (hostSessions && clientId && sess && hostSessions.has(sess) && SEALABLE_CHANNELS.has(channel) && !isHandshake) {
+    const routing = e2eRouting(channel, sess, extra?.browserId);
+    const prev = sealChains.get(clientId) ?? Promise.resolve();
+    const next = prev.then(async () => {
+      const rec = await hostSessions.seal(sess, routing, payload);
+      rawSend(channel, rec ?? payload, extra);
+    }).catch(() => {
+      rawSend(channel, payload, extra);
+    });
+    sealChains.set(clientId, next);
+    return;
+  }
+  rawSend(channel, payload, extra);
+}
 var p2pSubscribers = /* @__PURE__ */ new Set();
 var p2pCtx = null;
 var p2pReady = false;
@@ -53160,9 +54108,9 @@ function provisionActiveLinkMirror(payload) {
   const remoteSubfolder = typeof payload.remoteSubfolder === "string" ? payload.remoteSubfolder : void 0;
   let localRoot;
   if (remoteParent && remoteSubfolder) {
-    localRoot = join29(remoteParent, safeFolderName(remoteSubfolder));
+    localRoot = join30(remoteParent, safeFolderName(remoteSubfolder));
   } else {
-    localRoot = join29(HOST_ROOT, "Tesseract Mirrors", safeFolderName(projectName));
+    localRoot = join30(HOST_ROOT, "Tesseract Mirrors", safeFolderName(projectName));
   }
   if (loadLinkConfigs().some((c) => c.localRoot === localRoot && c.linkId !== linkId)) {
     localRoot = `${localRoot}-${linkId.slice(0, 6)}`;
@@ -53387,6 +54335,8 @@ async function handleInboundAgent(msg, driverClientId) {
       const newId = await b.forkSession?.(msg.sessionId, { projectDir: msg.projectDir, upToMessageId: msg.upToMessageId, title: msg.title }).catch(() => null);
       if (newId)
         send("agent", { type: "session:forked", clientRequestId: msg.clientRequestId, sessionId: newId, sourceSessionId: msg.sessionId, title: msg.title }, route2);
+      else
+        send("agent", { type: "session:forkFailed", clientRequestId: msg.clientRequestId, sourceSessionId: msg.sessionId }, route2);
       break;
     }
     case "agent:context_usage":
@@ -53463,7 +54413,7 @@ async function serveInboundFs(requestId, op, args, driverClientId) {
     return;
   const route2 = driverClientId ? { clientId: driverClientId } : {};
   try {
-    const result = await runRemoteFsOp(HOST_ROOT, op, args ?? []);
+    const result = await runRemoteFsOp(HOST_ROOT, op, args ?? [], driverClientId);
     send("fs", { type: "fs:res", requestId, result }, route2);
     if (op === "openFolder" && driverClientId && result && typeof result.root === "string") {
       const root = result.root;
@@ -53482,7 +54432,7 @@ async function serveInboundTerm(p, driverClientId) {
         exit: (ptyId, exitCode, signal) => send("term", { type: "term:exit", ptyId, exitCode, signal }, route2)
       };
       try {
-        const { pid } = await openPty({ ptyId: p.ptyId, clientId: driverClientId, shell: p.shell, args: p.args, cwd: p.cwd, cols: p.cols, rows: p.rows, env: p.env, hostRoot: HOST_ROOT }, sink);
+        const { pid } = await openPty({ ptyId: p.ptyId, clientId: driverClientId, shell: p.shell, args: p.args, cwd: p.cwd, cols: p.cols, rows: p.rows, env: p.env, hostRoot: HOST_CONTAIN }, sink);
         send("term", { type: "term:opened", ptyId: p.ptyId, requestId: p.requestId, pid }, route2);
       } catch (err) {
         send("term", { type: "term:openError", ptyId: p.ptyId, requestId: p.requestId, error: err instanceof Error ? err.message : String(err) }, route2);
@@ -53505,6 +54455,15 @@ async function serveInboundTerm(p, driverClientId) {
 }
 function releaseDriver(clientId) {
   unwatchRemoteClient(clientId);
+  releaseFsClient(clientId);
+  const sess = clientToSess.get(clientId);
+  if (sess) {
+    hostSessions?.drop(sess);
+    sessToClient.delete(sess);
+    sessHost.delete(sess);
+  }
+  clientToSess.delete(clientId);
+  sealChains.delete(clientId);
   voiceControls.get(clientId)?.stop("disconnected");
   voiceControls.delete(clientId);
   unwatchSessionClient(clientId);
@@ -53617,7 +54576,7 @@ function registerAsHost() {
   void ensureP2pReady();
   const kind = process.env.CCB_HOST_KIND === "cloud" ? "cloud" : void 0;
   const name = kind === "cloud" ? "Cloud agent" : hostname3();
-  send("host", { type: "host:register", name, platform: process.platform, deviceId, caps: ["agent", "fs", "term"], ...kind ? { kind } : {}, ...staticMetrics(hostVersion), ...p2pAdvert ?? {} });
+  send("host", { type: "host:register", name, platform: process.platform, deviceId, caps: hostSessions ? ["agent", "fs", "term", "e2e"] : ["agent", "fs", "term"], ...kind ? { kind } : {}, ...staticMetrics(hostVersion), ...p2pAdvert ?? {} });
   if (!heartbeat)
     heartbeat = setInterval(() => send("host", { type: "host:heartbeat", ...dynamicMetrics() }), 2e4);
 }
@@ -53654,10 +54613,8 @@ function connect() {
       }
     }
   };
-  socket.onmessage = (ev) => {
-    const data = ev.data;
-    if (typeof data !== "string")
-      return;
+  let inboundChain = Promise.resolve();
+  const handleInbound = async (data) => {
     let env;
     try {
       env = JSON.parse(data);
@@ -53681,18 +54638,50 @@ function connect() {
     }
     const inbound = typeof env.hostId === "string" && env.hostId.endsWith(`:${deviceId}`);
     const clientId = typeof env.clientId === "string" ? env.clientId : void 0;
+    const driving = inbound && sharingEnabled() && !entitlementDenied;
+    if (hostSessions && inbound && clientId && channel && SEALABLE_CHANNELS.has(channel)) {
+      const pp = env.payload;
+      if (pp && typeof pp.t === "string" && pp.t.startsWith("e2e:")) {
+        const hs = env.payload;
+        if (hs.t === "e2e:hello") {
+          sessToClient.set(hs.sess, clientId);
+          clientToSess.set(clientId, hs.sess);
+          if (typeof env.hostId === "string")
+            sessHost.set(hs.sess, env.hostId);
+        }
+        await hostSessions.onHandshake(hs);
+        return;
+      }
+      if (pp && pp.e2e === 1) {
+        if (!driving)
+          return;
+        const sess = clientToSess.get(clientId);
+        if (!sess || !hostSessions.has(sess))
+          return;
+        try {
+          const plain = await hostSessions.open(sess, e2eRouting(channel, sess, env.browserId), env.payload);
+          await handleInbound(JSON.stringify({ ...env, payload: plain, e2eOpened: true }));
+        } catch {
+        }
+        return;
+      }
+    }
     if (channel === "activelink") {
       handleActiveLinkChannel(env.payload, inbound);
       return;
     }
     if (channel === "voice") {
-      if (inbound)
-        void handleInboundVoice(env.payload, clientId);
+      if (inbound) {
+        if (driving)
+          void handleInboundVoice(env.payload, clientId);
+        return;
+      }
       return;
     }
     if (channel === "agent") {
       if (inbound) {
-        void handleInboundAgent(env.payload, clientId);
+        if (driving)
+          void handleInboundAgent(env.payload, clientId);
         return;
       }
       const p = env.payload;
@@ -53709,7 +54698,13 @@ function connect() {
     if (channel === "fs") {
       const p = env.payload;
       if (inbound && p.type === "fs:req") {
-        void serveInboundFs(p.requestId, p.op, p.args, clientId);
+        if (driving) {
+          if (e2eRequired() && !env.e2eOpened) {
+            send("fs", { type: "fs:res", requestId: p.requestId, error: "This machine requires an encrypted connection \u2014 please update your app." }, clientId ? { clientId } : {});
+            return;
+          }
+          void serveInboundFs(p.requestId, p.op, p.args, clientId);
+        }
         return;
       }
       if (p.type === "fs:res") {
@@ -53725,27 +54720,27 @@ function connect() {
         return;
       }
       if (p.type === "fs:transferStart") {
-        if (inbound)
+        if (driving)
           void beginOutboundTransfer(p, clientId ?? "");
         return;
       }
       if (p.type === "fs:transferManifest") {
-        if (inbound)
+        if (driving)
           void beginInboundTransfer(p, HOST_ROOT, transferSend);
         return;
       }
       if (p.type === "fs:transferChunk") {
-        if (inbound)
+        if (driving)
           void writeInboundChunk(p, transferSend);
         return;
       }
       if (p.type === "fs:transferAck") {
-        if (inbound)
+        if (driving)
           onTransferAck(p);
         return;
       }
       if (p.type === "fs:transferCancel") {
-        if (inbound)
+        if (driving)
           cancelTransfer(p.transferId, transferSend);
         return;
       }
@@ -53758,7 +54753,14 @@ function connect() {
     if (channel === "term") {
       const p = env.payload;
       if (inbound) {
-        void serveInboundTerm(p, clientId);
+        if (driving) {
+          if (e2eRequired() && !env.e2eOpened) {
+            if (p.type === "term:open")
+              send("term", { type: "term:openError", ptyId: p.ptyId, requestId: p.requestId, error: "This machine requires an encrypted connection \u2014 please update your app." }, clientId ? { clientId } : {});
+            return;
+          }
+          void serveInboundTerm(p, clientId);
+        }
         return;
       }
       hooks?.pushTerm(p);
@@ -53773,7 +54775,7 @@ function connect() {
           r(p.iceServers);
         return;
       }
-      if (inbound && clientId && typeof p?.type === "string" && p.type.startsWith("signal:dc-")) {
+      if (driving && clientId && typeof p?.type === "string" && p.type.startsWith("signal:dc-")) {
         void handleDcSignal(clientId, p, HOST_ROOT, ownHostId(), (payload) => send("signal", payload, { clientId, browserId: "fsdc" }));
       }
       return;
@@ -53790,7 +54792,7 @@ function connect() {
     }
     if (channel === "browser") {
       console.log(`[browser/host] '${String(env.payload?.type)}' inbound=${inbound} client=${clientId ? String(clientId).slice(0, 8) : "none"} bid=${env.browserId ?? "default"}`);
-      if (!inbound)
+      if (!driving)
         return;
       const p = env.payload;
       if (!p || typeof p.type !== "string" || !clientId)
@@ -53828,7 +54830,7 @@ function connect() {
     if (channel === "editor") {
       const ep = env.payload;
       console.log(`[editor/host] '${String(ep?.channel)}' inbound=${inbound} client=${clientId ? String(clientId).slice(0, 8) : "none"} bid=${env.browserId ?? "default"}`);
-      if (!inbound)
+      if (!driving)
         return;
       if (!ep || typeof ep.channel !== "string" || !clientId)
         return;
@@ -53847,6 +54849,16 @@ function connect() {
       return;
     }
   };
+  socket.onmessage = (ev) => {
+    const data = ev.data;
+    if (typeof data !== "string")
+      return;
+    if (hostSessions)
+      inboundChain = inboundChain.then(() => handleInbound(data)).catch(() => {
+      });
+    else
+      void handleInbound(data);
+  };
   socket.onclose = () => {
     cleanup();
     if (!stopped)
@@ -53862,6 +54874,19 @@ function startControlLink(config2, h) {
   hostVersion = config2.version;
   hooks = h;
   stopped = false;
+  if (config2.e2e && !hostSessions) {
+    const e2e = config2.e2e;
+    hostSessions = new E2ESessions({
+      selfDeviceId: e2e.selfDeviceId,
+      identityPriv: e2e.identityPriv,
+      getPeerIdentityPub: e2e.getPeerIdentityPub,
+      sendHandshake: (msg) => {
+        const cid = sessToClient.get(msg.sess);
+        if (cid)
+          rawSend("agent", msg, { clientId: cid });
+      }
+    });
+  }
   hooks.pushHosts(presentedHosts());
   hooks.ownHostResolved(ownHostId());
   ensureLinkConfigWatch();
@@ -53915,8 +54940,26 @@ function stopControlLink() {
 }
 
 // ../../packages/host-core/dist/local-server.js
+import { timingSafeEqual as timingSafeEqual3 } from "node:crypto";
 init_dist2();
 var connSeq = 0;
+function tokenMatches(got, want) {
+  if (!got)
+    return false;
+  const a = Buffer.from(got);
+  const b = Buffer.from(want);
+  return a.length === b.length && timingSafeEqual3(a, b);
+}
+function originAllowed(origin) {
+  if (!origin)
+    return true;
+  try {
+    const h = new URL(origin).hostname;
+    return h === "127.0.0.1" || h === "localhost" || h === "::1" || h === "[::1]";
+  } catch {
+    return false;
+  }
+}
 async function startLocalServer(opts) {
   const log3 = opts.log ?? (() => {
   });
@@ -53930,7 +54973,8 @@ async function startLocalServer(opts) {
   log3(`local listener on 127.0.0.1:${port}`);
   wss.on("connection", (ws, req) => {
     const url2 = new URL(req.url ?? "/", "http://127.0.0.1");
-    if (url2.searchParams.get("token") !== opts.token) {
+    const origin = req.headers.origin ?? void 0;
+    if (!originAllowed(origin) || !tokenMatches(url2.searchParams.get("token"), opts.token)) {
       try {
         ws.close(1008, "unauthorized");
       } catch {
@@ -53949,11 +54993,11 @@ async function startLocalServer(opts) {
     };
     const heldSessions = /* @__PURE__ */ new Set();
     let voiceControl = null;
-    const unregisterSink = registerAgentSink((msg, origin) => {
-      const isCron = origin === "cron" && (MIRRORED_AGENT_EVENTS.has(msg.type) || msg.type === "session:created");
-      if (origin !== loopbackOrigin && !isCron)
+    const unregisterSink = registerAgentSink((msg, origin2) => {
+      const isCron = origin2 === "cron" && (MIRRORED_AGENT_EVENTS.has(msg.type) || msg.type === "session:created");
+      if (origin2 !== loopbackOrigin && !isCron)
         return;
-      if (origin === loopbackOrigin)
+      if (origin2 === loopbackOrigin)
         voiceControl?.feedAgentEvent(msg);
       if (msg.type === "chat:echoed")
         return;
@@ -54060,6 +55104,8 @@ async function startLocalServer(opts) {
           const newId = await b.forkSession?.(msg.sessionId, { projectDir: msg.projectDir, upToMessageId: msg.upToMessageId, title: msg.title }).catch(() => null);
           if (newId)
             send2("agent", { type: "session:forked", clientRequestId: msg.clientRequestId, sessionId: newId, sourceSessionId: msg.sessionId, title: msg.title });
+          else
+            send2("agent", { type: "session:forkFailed", clientRequestId: msg.clientRequestId, sourceSessionId: msg.sessionId });
           break;
         }
         case "agent:context_usage":
@@ -54162,7 +55208,9 @@ async function startLocalServer(opts) {
             const { pid } = await openPty(
               // `local`: a loopback terminal is the user's OWN machine — never
               // reaped by the host-role teardown that runs in this same process.
-              { ptyId: p.ptyId, clientId: termClientId, shell: p.shell, args: p.args, cwd: p.cwd, cols: p.cols, rows: p.rows, env: p.env, hostRoot: opts.hostRoot, local: true },
+              // hostRoot = the containment boundary (undefined when uncontained), so a
+              // loopback terminal on a personal machine isn't clamped to a start dir.
+              { ptyId: p.ptyId, clientId: termClientId, shell: p.shell, args: p.args, cwd: p.cwd, cols: p.cols, rows: p.rows, env: p.env, hostRoot: resolveContainmentRoot() ?? void 0, local: true },
               termSink
             );
             send2("term", { type: "term:opened", ptyId: p.ptyId, requestId: p.requestId, pid });
@@ -54194,13 +55242,94 @@ async function startLocalServer(opts) {
 }
 
 // ../../packages/host-core/dist/daemon-runtime.js
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync12, existsSync as existsSync15, mkdirSync as mkdirSync12, unlinkSync as unlinkSync2, chmodSync as chmodSync3 } from "node:fs";
-import { join as join30 } from "node:path";
-import { homedir as homedir14 } from "node:os";
-import { randomBytes as randomBytes3 } from "node:crypto";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync13, existsSync as existsSync16, mkdirSync as mkdirSync13, unlinkSync as unlinkSync2, chmodSync as chmodSync4 } from "node:fs";
+import { join as join32 } from "node:path";
+import { randomBytes as randomBytes4 } from "node:crypto";
+import { hostname as hostname4 } from "node:os";
+
+// ../../packages/host-core/dist/device-identity.js
+import { join as join31 } from "node:path";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync12, existsSync as existsSync15, mkdirSync as mkdirSync12, renameSync as renameSync7, chmodSync as chmodSync3 } from "node:fs";
+var cached2 = null;
+function identityPath() {
+  return join31(daemonDir(), "identity.json");
+}
+async function loadOrCreateDeviceIdentity() {
+  if (cached2)
+    return cached2;
+  try {
+    const stored = JSON.parse(readFileSync12(identityPath(), "utf-8"));
+    if (stored?.privateJwk) {
+      cached2 = await importIdentity(stored.privateJwk);
+      return cached2;
+    }
+  } catch {
+  }
+  const kp = await generateIdentityKeyPair(true);
+  const { privateJwk, publicRaw } = await exportIdentity(kp);
+  const dir = daemonDir();
+  if (!existsSync15(dir))
+    mkdirSync12(dir, { recursive: true, mode: 448 });
+  const tmp = `${identityPath()}.tmp`;
+  writeFileSync12(tmp, JSON.stringify({ privateJwk, publicRaw, alg: "P256-ECDSA" }, null, 2), { mode: 384 });
+  renameSync7(tmp, identityPath());
+  try {
+    chmodSync3(identityPath(), 384);
+  } catch {
+  }
+  cached2 = kp;
+  return kp;
+}
+var DEVICES_BASE = (apiOrigin) => `${apiOrigin.replace(/\/$/, "")}/api/core/tesseract/devices`;
+async function registerDeviceKey(opts) {
+  try {
+    const r = await fetch(`${DEVICES_BASE(opts.apiOrigin)}/key`, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${opts.accessToken}` },
+      body: JSON.stringify({
+        deviceId: opts.deviceId,
+        identityPub: b64u(opts.publicRaw),
+        alg: "P256-ECDSA",
+        tlsFingerprint256: opts.tlsFingerprint256,
+        label: opts.label
+      })
+    });
+    return r.ok;
+  } catch {
+    return false;
+  }
+}
+var PEER_TTL_MS = 6e4;
+var peerCache = null;
+async function refreshPeerKeys(apiOrigin, accessToken) {
+  try {
+    const r = await fetch(`${DEVICES_BASE(apiOrigin)}/keys`, { headers: { authorization: `Bearer ${accessToken}` } });
+    if (!r.ok)
+      return;
+    const list = await r.json();
+    const byDevice = /* @__PURE__ */ new Map();
+    for (const k of list)
+      byDevice.set(k.deviceId, k);
+    peerCache = { at: Date.now(), byDevice };
+  } catch {
+  }
+}
+async function getPeerIdentityPub(opts) {
+  const stale = !peerCache || Date.now() - peerCache.at > PEER_TTL_MS;
+  if (stale || !peerCache?.byDevice.has(opts.deviceId))
+    await refreshPeerKeys(opts.apiOrigin, opts.accessToken);
+  const row = peerCache?.byDevice.get(opts.deviceId);
+  if (!row || row.revokedAt)
+    return null;
+  try {
+    return unb64u(row.identityPub);
+  } catch {
+    return null;
+  }
+}
 
 // ../../packages/host-core/dist/power-node.js
-import { spawn as spawn4 } from "node:child_process";
+import { spawn as spawn5 } from "node:child_process";
 import { platform } from "node:os";
 function createNodePowerController() {
   const active = /* @__PURE__ */ new Set();
@@ -54208,9 +55337,9 @@ function createNodePowerController() {
   function spawnInhibitor() {
     try {
       if (platform() === "darwin")
-        return spawn4("caffeinate", ["-i"], { stdio: "ignore" });
+        return spawn5("caffeinate", ["-i"], { stdio: "ignore" });
       if (platform() === "linux") {
-        return spawn4("systemd-inhibit", ["--what=sleep", "--why=tesseract agent running", "--mode=block", "sleep", "infinity"], { stdio: "ignore" });
+        return spawn5("systemd-inhibit", ["--what=sleep", "--why=tesseract agent running", "--mode=block", "sleep", "infinity"], { stdio: "ignore" });
       }
     } catch {
     }
@@ -54262,8 +55391,8 @@ async function runDaemon(opts = {}) {
   const VERSION = opts.version ?? process.env.CCB_DAEMON_VERSION ?? "dev";
   const TAG = opts.tag ?? "host-daemon";
   const log3 = (...args) => console.log(`[${TAG} ${(/* @__PURE__ */ new Date()).toISOString()}]`, ...args);
-  const pidfile = () => join30(daemonDir(), "daemon.lock");
-  const statusFile = () => join30(daemonDir(), "status.json");
+  const pidfile = () => join32(daemonDir(), "daemon.lock");
+  const statusFile = () => join32(daemonDir(), "status.json");
   const isAlive2 = (pid) => {
     try {
       process.kill(pid, 0);
@@ -54275,17 +55404,17 @@ async function runDaemon(opts = {}) {
   function acquireLock() {
     const f = pidfile();
     try {
-      if (existsSync15(f)) {
-        const prev = Number(readFileSync12(f, "utf-8").trim());
+      if (existsSync16(f)) {
+        const prev = Number(readFileSync13(f, "utf-8").trim());
         if (prev && prev !== process.pid && isAlive2(prev))
           return false;
       }
     } catch {
     }
     try {
-      if (!existsSync15(daemonDir()))
-        mkdirSync12(daemonDir(), { recursive: true, mode: 448 });
-      writeFileSync12(f, String(process.pid));
+      if (!existsSync16(daemonDir()))
+        mkdirSync13(daemonDir(), { recursive: true, mode: 448 });
+      writeFileSync13(f, String(process.pid));
     } catch {
     }
     return true;
@@ -54293,15 +55422,15 @@ async function runDaemon(opts = {}) {
   function releaseLock() {
     try {
       const f = pidfile();
-      if (existsSync15(f) && Number(readFileSync12(f, "utf-8").trim()) === process.pid)
+      if (existsSync16(f) && Number(readFileSync13(f, "utf-8").trim()) === process.pid)
         unlinkSync2(f);
     } catch {
     }
   }
   function writeStatus(s) {
     try {
-      writeFileSync12(statusFile(), JSON.stringify({ pid: process.pid, version: VERSION, execPath: process.execPath, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), ...localInfo ?? {}, ...s }));
-      chmodSync3(statusFile(), 384);
+      writeFileSync13(statusFile(), JSON.stringify({ pid: process.pid, version: VERSION, execPath: process.execPath, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), ...localInfo ?? {}, ...s }));
+      chmodSync4(statusFile(), 384);
     } catch {
     }
   }
@@ -54334,9 +55463,9 @@ async function runDaemon(opts = {}) {
   process.on("SIGTERM", () => shutdown(0));
   process.on("SIGINT", () => shutdown(0));
   process.env.CCB_HOST_DAEMON = "1";
-  const localToken = randomBytes3(24).toString("hex");
+  const localToken = randomBytes4(24).toString("hex");
   try {
-    localServer = await startLocalServer({ hostRoot: process.env.CCB_HOST_ROOT ?? homedir14(), token: localToken, log: log3 });
+    localServer = await startLocalServer({ hostRoot: resolveHostRoot(), token: localToken, log: log3 });
     localInfo = { localPort: localServer.port, localToken };
   } catch (e) {
     log3("local listener failed to start", e.message);
@@ -54351,6 +55480,15 @@ async function runDaemon(opts = {}) {
   const c = creds2;
   let accessToken = c.accessToken;
   const tokenSource = { getToken: () => accessToken, getUserId: () => c.userId, backendOrigin: c.backendOrigin };
+  void (async () => {
+    try {
+      const id = await loadOrCreateDeviceIdentity();
+      const ok = await registerDeviceKey({ apiOrigin: c.apiOrigin, accessToken, deviceId: c.deviceId, publicRaw: id.publicRaw, label: hostname4() });
+      log3(ok ? "e2e identity registered" : "e2e identity registration not accepted (will retry on restart)");
+    } catch (e) {
+      log3("e2e identity registration failed (non-fatal)", e.message);
+    }
+  })();
   async function refresh() {
     try {
       const r = await fetch(`${c.apiOrigin}/auth/device-token/refresh`, {
@@ -54363,7 +55501,7 @@ async function runDaemon(opts = {}) {
         if (r.status === 401) {
           log3("device token no longer valid \u2014 dropping to local-only on restart");
           try {
-            unlinkSync2(join30(daemonDir(), "credentials.json"));
+            unlinkSync2(join32(daemonDir(), "credentials.json"));
           } catch {
           }
           shutdown(0);
@@ -54396,7 +55534,20 @@ async function runDaemon(opts = {}) {
     pushTerm: () => {
     }
   };
-  startControlLink({ deviceId: c.deviceId, power: createNodePowerController(), tokenSource, version: VERSION }, hooks2);
+  let e2e;
+  if (process.env.CCB_E2E === "1") {
+    try {
+      const id = await loadOrCreateDeviceIdentity();
+      e2e = {
+        selfDeviceId: c.deviceId,
+        identityPriv: id.privateKey,
+        getPeerIdentityPub: (d) => getPeerIdentityPub({ apiOrigin: c.apiOrigin, accessToken, deviceId: d })
+      };
+    } catch (err) {
+      log3("e2e responder init failed (staying plaintext)", err.message);
+    }
+  }
+  startControlLink({ deviceId: c.deviceId, power: createNodePowerController(), tokenSource, version: VERSION, e2e }, hooks2);
   log3(`started \u2014 device ${c.deviceId}, user ${c.userId}, relay ${c.backendOrigin}, local :${localInfo?.localPort ?? "off"}, version ${VERSION}`);
   await refresh();
   timer = setInterval(() => {
@@ -54408,17 +55559,17 @@ async function runDaemon(opts = {}) {
 import { platform as platform2 } from "node:os";
 
 // ../../packages/host-core/dist/service/launchd.js
-import { writeFileSync as writeFileSync13, existsSync as existsSync16, mkdirSync as mkdirSync13, unlinkSync as unlinkSync3 } from "node:fs";
-import { dirname as dirname15, join as join31 } from "node:path";
-import { homedir as homedir15, userInfo } from "node:os";
+import { writeFileSync as writeFileSync14, existsSync as existsSync17, mkdirSync as mkdirSync14, unlinkSync as unlinkSync3 } from "node:fs";
+import { dirname as dirname15, join as join33 } from "node:path";
+import { homedir as homedir14, userInfo } from "node:os";
 
 // ../../packages/host-core/dist/service/exec.js
-import { execFile as execFile5, spawn as spawn5 } from "node:child_process";
+import { execFile as execFile5, spawn as spawn6 } from "node:child_process";
 import { promisify as promisify4 } from "node:util";
 var run = promisify4(execFile5);
 function runInherit(cmd, args) {
   return new Promise((resolve10) => {
-    const p = spawn5(cmd, args, { stdio: "inherit" });
+    const p = spawn6(cmd, args, { stdio: "inherit" });
     p.on("error", () => resolve10());
     p.on("close", () => resolve10());
   });
@@ -54433,10 +55584,10 @@ function xml(s) {
 }
 function makeLaunchd(instanceId) {
   const label = SERVICE_LABEL_BASE + (instanceId ? `.${instanceId}` : "");
-  const plistPath = () => join31(homedir15(), "Library", "LaunchAgents", `${label}.plist`);
+  const plistPath = () => join33(homedir14(), "Library", "LaunchAgents", `${label}.plist`);
   const domainTarget = () => `gui/${userInfo().uid}`;
   const serviceTarget = () => `${domainTarget()}/${label}`;
-  const logFile = () => join31(daemonDir(), "daemon.log");
+  const logFile = () => join33(daemonDir(), "daemon.log");
   function buildPlist(spec) {
     const args = [spec.exec, ...spec.args].map((a) => `      <string>${xml(a)}</string>`).join("\n");
     const env = Object.entries(spec.env).map(([k, v]) => `      <key>${xml(k)}</key>
@@ -54476,9 +55627,9 @@ ${env}
   }
   return {
     async install(spec) {
-      mkdirSync13(dirname15(plistPath()), { recursive: true });
-      mkdirSync13(dirname15(spec.logPath), { recursive: true });
-      writeFileSync13(plistPath(), buildPlist(spec));
+      mkdirSync14(dirname15(plistPath()), { recursive: true });
+      mkdirSync14(dirname15(spec.logPath), { recursive: true });
+      writeFileSync14(plistPath(), buildPlist(spec));
       await run("launchctl", ["bootout", serviceTarget()]).catch(() => {
       });
       await run("launchctl", ["bootstrap", domainTarget(), plistPath()]);
@@ -54490,7 +55641,7 @@ ${env}
     async uninstall() {
       await run("launchctl", ["bootout", serviceTarget()]).catch(() => {
       });
-      if (existsSync16(plistPath())) {
+      if (existsSync17(plistPath())) {
         try {
           unlinkSync3(plistPath());
         } catch {
@@ -54501,7 +55652,7 @@ ${env}
       await this.install(spec);
     },
     async isInstalled() {
-      return existsSync16(plistPath());
+      return existsSync17(plistPath());
     },
     async start() {
       await run("launchctl", ["bootstrap", domainTarget(), plistPath()]).catch(() => {
@@ -54518,7 +55669,7 @@ ${env}
     },
     async logs(follow) {
       const f = logFile();
-      if (!existsSync16(f)) {
+      if (!existsSync17(f)) {
         console.log(`No log yet at ${f} \u2014 has the service started?`);
         return;
       }
@@ -54528,17 +55679,17 @@ ${env}
 }
 
 // ../../packages/host-core/dist/service/systemd.js
-import { writeFileSync as writeFileSync14, existsSync as existsSync17, mkdirSync as mkdirSync14, unlinkSync as unlinkSync4 } from "node:fs";
-import { dirname as dirname16, join as join32 } from "node:path";
-import { homedir as homedir16, userInfo as userInfo2 } from "node:os";
+import { writeFileSync as writeFileSync15, existsSync as existsSync18, mkdirSync as mkdirSync15, unlinkSync as unlinkSync4 } from "node:fs";
+import { dirname as dirname16, join as join34 } from "node:path";
+import { homedir as homedir15, userInfo as userInfo2 } from "node:os";
 function shq(s) {
   return `"${s.replace(/(["\\$`])/g, "\\$1")}"`;
 }
 function makeSystemd(instanceId) {
   const unit = `tesseract-host${instanceId ? `-${instanceId}` : ""}.service`;
   const unitPath = () => {
-    const base = process.env.XDG_CONFIG_HOME || join32(homedir16(), ".config");
-    return join32(base, "systemd", "user", unit);
+    const base = process.env.XDG_CONFIG_HOME || join34(homedir15(), ".config");
+    return join34(base, "systemd", "user", unit);
   };
   function buildUnit(spec) {
     const execStart = [spec.exec, ...spec.args].map(shq).join(" ");
@@ -54563,9 +55714,9 @@ WantedBy=default.target
   }
   return {
     async install(spec) {
-      mkdirSync14(dirname16(unitPath()), { recursive: true });
-      mkdirSync14(dirname16(spec.logPath), { recursive: true });
-      writeFileSync14(unitPath(), buildUnit(spec));
+      mkdirSync15(dirname16(unitPath()), { recursive: true });
+      mkdirSync15(dirname16(spec.logPath), { recursive: true });
+      writeFileSync15(unitPath(), buildUnit(spec));
       await run("loginctl", ["enable-linger", userInfo2().username]).catch(() => {
       });
       await run("systemctl", ["--user", "daemon-reload"]).catch(() => {
@@ -54577,7 +55728,7 @@ WantedBy=default.target
     async uninstall() {
       await run("systemctl", ["--user", "disable", "--now", unit]).catch(() => {
       });
-      if (existsSync17(unitPath())) {
+      if (existsSync18(unitPath())) {
         try {
           unlinkSync4(unitPath());
         } catch {
@@ -54590,7 +55741,7 @@ WantedBy=default.target
       await this.install(spec);
     },
     async isInstalled() {
-      return existsSync17(unitPath());
+      return existsSync18(unitPath());
     },
     async start() {
       await run("systemctl", ["--user", "start", unit]);
@@ -54608,25 +55759,28 @@ WantedBy=default.target
 }
 
 // ../../packages/host-core/dist/service/windows.js
-import { writeFileSync as writeFileSync15, existsSync as existsSync18, mkdirSync as mkdirSync15, unlinkSync as unlinkSync5 } from "node:fs";
-import { dirname as dirname17, join as join33 } from "node:path";
+import { writeFileSync as writeFileSync16, existsSync as existsSync19, mkdirSync as mkdirSync16, unlinkSync as unlinkSync5 } from "node:fs";
+import { dirname as dirname17, join as join35 } from "node:path";
 function makeWindowsTask(instanceId) {
   const task = `Fineguide\\TesseractHost${instanceId ? `-${instanceId}` : ""}`;
-  const wrapperPath = () => join33(daemonDir(), `run-host${instanceId ? `-${instanceId}` : ""}.cmd`);
-  const logFile = () => join33(daemonDir(), "daemon.log");
+  const wrapperPath = () => join35(daemonDir(), `run-host${instanceId ? `-${instanceId}` : ""}.cmd`);
+  const logFile = () => join35(daemonDir(), "daemon.log");
+  const oneLine2 = (s) => s.replace(/[\r\n]+/g, " ");
+  const envVal = (v) => oneLine2(v).replace(/%/g, "%%").replace(/"/g, "");
+  const cmdArg = (a) => `"${oneLine2(a).replace(/"/g, "")}"`;
   function buildWrapper(spec) {
-    const env = Object.entries(spec.env).map(([k, v]) => `set "${k}=${v}"`).join("\r\n");
-    const cmd = [spec.exec, ...spec.args].map((a) => `"${a}"`).join(" ");
+    const env = Object.entries(spec.env).map(([k, v]) => `set "${envVal(k)}=${envVal(v)}"`).join("\r\n");
+    const cmd = [spec.exec, ...spec.args].map(cmdArg).join(" ");
     return `@echo off\r
 ${env}\r
-start "" /b ${cmd} >> "${spec.logPath}" 2>&1\r
+start "" /b ${cmd} >> "${oneLine2(spec.logPath).replace(/"/g, "")}" 2>&1\r
 `;
   }
   return {
     async install(spec) {
-      mkdirSync15(dirname17(spec.logPath), { recursive: true });
-      mkdirSync15(dirname17(wrapperPath()), { recursive: true });
-      writeFileSync15(wrapperPath(), buildWrapper(spec));
+      mkdirSync16(dirname17(spec.logPath), { recursive: true });
+      mkdirSync16(dirname17(wrapperPath()), { recursive: true });
+      writeFileSync16(wrapperPath(), buildWrapper(spec));
       await run("schtasks", ["/Create", "/TN", task, "/SC", "ONLOGON", "/RL", "LIMITED", "/F", "/TR", `"${wrapperPath()}"`]);
       await run("schtasks", ["/Run", "/TN", task]).catch(() => {
       });
@@ -54634,7 +55788,7 @@ start "" /b ${cmd} >> "${spec.logPath}" 2>&1\r
     async uninstall() {
       await run("schtasks", ["/Delete", "/TN", task, "/F"]).catch(() => {
       });
-      if (existsSync18(wrapperPath())) {
+      if (existsSync19(wrapperPath())) {
         try {
           unlinkSync5(wrapperPath());
         } catch {
@@ -54664,7 +55818,7 @@ start "" /b ${cmd} >> "${spec.logPath}" 2>&1\r
     },
     async logs(follow) {
       const f = logFile();
-      if (!existsSync18(f)) {
+      if (!existsSync19(f)) {
         console.log(`No log yet at ${f} \u2014 has the task run?`);
         return;
       }
@@ -54691,15 +55845,30 @@ function getServiceController(instanceId) {
 // src/auth.ts
 var import_qrcode_terminal = __toESM(require_main(), 1);
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { existsSync as existsSync19, rmSync } from "node:fs";
-import { join as join34 } from "node:path";
+import { existsSync as existsSync20, rmSync } from "node:fs";
+import { join as join36 } from "node:path";
 
 // src/config.ts
-import { hostname as hostname4 } from "node:os";
+import { hostname as hostname5 } from "node:os";
 var DEFAULT_API = (process.env.CCB_TESSERACT_API ?? "https://app.tesseract.dev").replace(/\/$/, "");
 function defaultRelay(api) {
   return (process.env.CCB_BACKEND_ORIGIN ?? api).replace(/\/$/, "");
 }
+function isAllowedOrigin(origin) {
+  let h, proto;
+  try {
+    const u = new URL(origin);
+    h = u.hostname;
+    proto = u.protocol;
+  } catch {
+    return false;
+  }
+  if (h === "localhost" || h === "127.0.0.1" || h === "::1") return true;
+  if (proto !== "https:" && proto !== "wss:") return false;
+  if (h === "tesseract.dev" || h.endsWith(".tesseract.dev")) return true;
+  const extra = (process.env.CCB_ALLOWED_API_HOSTS ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  return extra.some((a) => h === a || h.endsWith(`.${a}`));
+}
 function decodeJwtSub(token) {
   try {
     const part = token.split(".")[1];
@@ -54711,7 +55880,7 @@ function decodeJwtSub(token) {
   }
 }
 function defaultLabel() {
-  return hostname4() || "server";
+  return hostname5() || "server";
 }
 
 // src/auth.ts
@@ -54808,6 +55977,15 @@ function persist2(api, relay, deviceId2, dt) {
 async function login(opts) {
   const api = (opts.api ?? DEFAULT_API).replace(/\/$/, "");
   const relay = (opts.relay ?? defaultRelay(api)).replace(/\/$/, "");
+  if (!opts.allowCustomApi) {
+    const bad = [api, relay].find((o) => !isAllowedOrigin(o));
+    if (bad) {
+      console.error(`Refusing to use a non-default server origin: ${bad}`);
+      console.error("If this is intentional (self-hosted), re-run with --allow-custom-api,");
+      console.error("or set CCB_ALLOWED_API_HOSTS=your.host to allowlist it permanently.");
+      process.exit(1);
+    }
+  }
   const deviceId2 = readCredentials()?.deviceId ?? process.env.CCB_DEVICE_ID ?? randomUUID8().slice(0, 8);
   const label = opts.name ?? defaultLabel();
   if (opts.token) {
@@ -54869,8 +56047,8 @@ async function logout() {
   }
   for (const f of ["credentials.json", "status.json", "daemon.lock"]) {
     try {
-      const p = join34(daemonDir(), f);
-      if (existsSync19(p)) rmSync(p);
+      const p = join36(daemonDir(), f);
+      if (existsSync20(p)) rmSync(p);
     } catch {
     }
   }
@@ -54890,9 +56068,12 @@ function whoami() {
 }
 
 // src/self-update.ts
-import { spawn as spawn6 } from "node:child_process";
+import { spawn as spawn7 } from "node:child_process";
+import { createPublicKey, verify as cryptoVerify } from "node:crypto";
 var RESTART_EXIT_CODE = 75;
-var REGISTRY_URL = "https://registry.npmjs.org/tesseract-agent/latest";
+var REGISTRY_BASE = "https://registry.npmjs.org/tesseract-agent";
+var REGISTRY_URL = `${REGISTRY_BASE}/latest`;
+var NPM_SIGNING_KEY_SPKI_B64 = "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g==";
 var FIRST_CHECK_MS = Number(process.env.CCB_UPDATE_FIRST_MS) || 3 * 6e4;
 var INTERVAL_MS = Number(process.env.CCB_UPDATE_INTERVAL_MS) || 6 * 60 * 6e4;
 function disabled() {
@@ -54930,13 +56111,39 @@ async function fetchLatest() {
     clearTimeout(t);
   }
 }
+async function fetchVersionDist(version2) {
+  const ac = new AbortController();
+  const t = setTimeout(() => ac.abort(), 15e3);
+  try {
+    const r = await fetch(`${REGISTRY_BASE}/${encodeURIComponent(version2)}`, { headers: { accept: "application/json" }, signal: ac.signal });
+    if (!r.ok) return void 0;
+    const j = await r.json();
+    const dist = j.dist;
+    const s = dist?.signatures?.[0];
+    return { integrity: dist?.integrity, sig: s?.sig, keyid: s?.keyid };
+  } catch {
+    return void 0;
+  } finally {
+    clearTimeout(t);
+  }
+}
+function verifyNpmSignature(version2, integrity, sig) {
+  if (!integrity || !sig) return false;
+  try {
+    const key2 = createPublicKey({ key: Buffer.from(NPM_SIGNING_KEY_SPKI_B64, "base64"), format: "der", type: "spki" });
+    const message = Buffer.from(`tesseract-agent@${version2}:${integrity}`);
+    return cryptoVerify("sha256", message, { key: key2, dsaEncoding: "der" }, Buffer.from(sig, "base64"));
+  } catch {
+    return false;
+  }
+}
 function installVersion(target) {
   return new Promise((resolve10) => {
     const npm = process.platform === "win32" ? "npm.cmd" : "npm";
     log2(`installing tesseract-agent@${target} \u2026`);
     let child;
     try {
-      child = spawn6(npm, ["install", "-g", `tesseract-agent@${target}`], { stdio: ["ignore", "inherit", "inherit"] });
+      child = spawn7(npm, ["install", "-g", `tesseract-agent@${target}`], { stdio: ["ignore", "inherit", "inherit"] });
     } catch (e) {
       log2("npm spawn threw:", e instanceof Error ? e.message : String(e));
       resolve10(false);
@@ -54965,6 +56172,12 @@ async function checkOnce(current) {
     const latest = await fetchLatest();
     if (!latest || !isNewer(latest, current)) return;
     log2(`update available: ${current} \u2192 ${latest}`);
+    const dist = await fetchVersionDist(latest);
+    if (!verifyNpmSignature(latest, dist?.integrity, dist?.sig)) {
+      log2(`REFUSING update to ${latest}: registry signature did not verify \u2014 staying on ${current}`);
+      return;
+    }
+    log2(`registry signature verified for ${latest} (keyid ${dist?.keyid ?? "?"})`);
     if (await installVersion(latest)) {
       log2("restarting on the new version (supervisor re-spawns) \u2026");
       process.exit(RESTART_EXIT_CODE);
@@ -54993,9 +56206,9 @@ function startSelfUpdater(current) {
 }
 
 // src/service.ts
-import { join as join35 } from "node:path";
+import { join as join37 } from "node:path";
 import { platform as platform3 } from "node:os";
-import { existsSync as existsSync20, readFileSync as readFileSync13 } from "node:fs";
+import { existsSync as existsSync21, readFileSync as readFileSync14 } from "node:fs";
 function controller(instanceId) {
   const c = getServiceController(instanceId);
   if (!c) {
@@ -55008,7 +56221,7 @@ function buildSpec(cliEntry) {
     exec: process.execPath,
     args: [cliEntry, "run"],
     env: { CCB_DAEMON_DIR: daemonDir() },
-    logPath: join35(daemonDir(), "daemon.log")
+    logPath: join37(daemonDir(), "daemon.log")
   };
 }
 var isAlive = (pid) => {
@@ -55020,10 +56233,10 @@ var isAlive = (pid) => {
   }
 };
 function runningDaemonInfo() {
-  const lock = join35(daemonDir(), "daemon.lock");
+  const lock = join37(daemonDir(), "daemon.lock");
   try {
-    if (!existsSync20(lock)) return null;
-    const pid = Number(readFileSync13(lock, "utf-8").trim());
+    if (!existsSync21(lock)) return null;
+    const pid = Number(readFileSync14(lock, "utf-8").trim());
     if (!pid || !isAlive(pid)) return null;
     return { pid, device: readCredentials()?.deviceId };
   } catch {
@@ -55059,8 +56272,8 @@ async function logs(instanceId, follow) {
 // src/cli.ts
 function pkgVersion() {
   try {
-    const p = join36(dirname18(fileURLToPath2(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync14(p, "utf8")).version ?? "0.0.0";
+    const p = join38(dirname18(fileURLToPath2(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync15(p, "utf8")).version ?? "0.0.0";
   } catch {
     return "0.0.0";
   }
@@ -55116,7 +56329,7 @@ async function superviseDaemon(cliEntry) {
   let stopping = false;
   let child = null;
   const spawnWorker = () => {
-    const c = spawn7(process.execPath, [cliEntry, "__worker"], { stdio: "inherit", env: process.env });
+    const c = spawn8(process.execPath, [cliEntry, "__worker"], { stdio: "inherit", env: process.env });
     child = c;
     let settled = false;
     const settle = (fn) => {
@@ -55322,7 +56535,7 @@ async function main() {
       process.exit(1);
     }
     instance = flags.instance;
-    process.env.CCB_DAEMON_DIR = join36(homedir17(), ".tesseract", `daemon-${instance}`);
+    process.env.CCB_DAEMON_DIR = join38(homedir16(), ".tesseract", `daemon-${instance}`);
   }
   const force = flags.yes === true || flags.force === true;
   const cliEntry = fileURLToPath2(import.meta.url);
@@ -55332,7 +56545,8 @@ async function main() {
         api: typeof flags.api === "string" ? flags.api : void 0,
         relay: typeof flags.relay === "string" ? flags.relay : void 0,
         token: typeof flags.token === "string" ? flags.token : void 0,
-        name: typeof flags.name === "string" ? flags.name : void 0
+        name: typeof flags.name === "string" ? flags.name : void 0,
+        allowCustomApi: flags["allow-custom-api"] === true
       });
       break;
     case "logout":