tesseract-agent 0.9.20 → 0.9.22

package/dist-bundle/cli.js

@@ -63238,7 +63238,7 @@ var mesh_ca_exports = {};
 __export(mesh_ca_exports, {
   netCaCommand: () => netCaCommand
 });
-import { chmodSync as chmodSync7, existsSync as existsSync35, mkdirSync as mkdirSync31, readFileSync as readFileSync33, writeFileSync as writeFileSync30 } from "node:fs";
+import { chmodSync as chmodSync7, existsSync as existsSync35, mkdirSync as mkdirSync31, readFileSync as readFileSync34, writeFileSync as writeFileSync31 } from "node:fs";
 import { join as join62, resolve as resolve11 } from "node:path";
 import { createInterface } from "node:readline";
 function die(msg) {
@@ -63270,7 +63270,7 @@ async function readPassphrase(prompt) {
   }
 }
 function writeSecretFile(p, bytes2) {
-  writeFileSync30(p, bytes2, { mode: 384 });
+  writeFileSync31(p, bytes2, { mode: 384 });
   try {
     chmodSync7(p, 384);
   } catch {
@@ -63289,9 +63289,9 @@ async function openCa(dir2) {
   if (!existsSync35(gPath) || !existsSync35(sPath)) {
     die(`No mesh CA in ${dir2}. Run: tesseract-agent net init --org NAME --ca-dir ${dir2}`);
   }
-  const genesisBytes = new Uint8Array(readFileSync33(gPath));
+  const genesisBytes = new Uint8Array(readFileSync34(gPath));
   const genesis = decodeGenesis(genesisBytes);
-  const sealed = decodeRecoveryBundle(new Uint8Array(readFileSync33(sPath)));
+  const sealed = decodeRecoveryBundle(new Uint8Array(readFileSync34(sPath)));
   const pass = await readPassphrase("CA passphrase: ");
   let seed;
   try {
@@ -63329,7 +63329,7 @@ async function netCaCommand(rest, flags) {
     const genesisBytes = encodeGenesis(genesis);
     const fp = await genesisFingerprint(genesis);
     ensureDir(caDir);
-    writeFileSync30(join62(caDir, "genesis.bin"), genesisBytes);
+    writeFileSync31(join62(caDir, "genesis.bin"), genesisBytes);
     writeSecretFile(join62(caDir, "ca.sealed"), encodeRecoveryBundle(await sealCaKey(seed, pass, `${org} mesh CA`)));
     writeSecretFile(join62(caDir, "disablement.secret"), hex3(disable.secret));
     console.log(`
@@ -63399,8 +63399,8 @@ Next, issue an identity for a machine (pick a free address in ${formatPrefix(gen
       [{ keyIndex: 0, privateKey: ca.privateKey }]
     );
     ensureDir(outDir);
-    writeFileSync30(join62(outDir, "genesis.bin"), genesisBytes);
-    writeFileSync30(join62(outDir, "node.cert"), encodeCert(cert));
+    writeFileSync31(join62(outDir, "genesis.bin"), genesisBytes);
+    writeFileSync31(join62(outDir, "node.cert"), encodeCert(cert));
     writeSecretFile(join62(outDir, "node.key"), await exportStaticPrivate(nodeKey));
     console.log(`Minted "${name}" at ${ip4}.`);
     console.log(`  ${outDir}`);
@@ -63443,7 +63443,7 @@ Next, issue an identity for a machine (pick a free address in ${formatPrefix(gen
     };
     const signed = await signBundle(bundle, [{ keyIndex: 0, privateKey: ca.privateKey }]);
     const out = resolve11(typeof flags.out === "string" ? flags.out : join62(caDir, "bundle.bin"));
-    writeFileSync30(out, encodeSignedBundle(signed));
+    writeFileSync31(out, encodeSignedBundle(signed));
     console.log(`Signed policy bundle (epoch ${epoch2}) \u2192 ${out}`);
     console.log("Every node must receive it; the relay distributes it, or copy it to");
     console.log(`each node's mesh directory as bundle.bin.`);
@@ -63465,9 +63465,9 @@ var init_mesh_ca = __esm({
 
 // src/cli.ts
 init_base_paths();
-import { existsSync as existsSync36, mkdtempSync as mkdtempSync2, readFileSync as readFileSync35, rmSync as rmSync10 } from "node:fs";
+import { existsSync as existsSync36, mkdtempSync as mkdtempSync2, readFileSync as readFileSync36, rmSync as rmSync10 } from "node:fs";
 import { createHash as createHash8 } from "node:crypto";
-import { execFileSync as execFileSync5, spawn as spawn12 } from "node:child_process";
+import { execFileSync as execFileSync5, spawn as spawn13 } from "node:child_process";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { tmpdir as tmpdir4 } from "node:os";
 import { dirname as dirname27, join as join63, resolve as resolve13 } from "node:path";
@@ -67085,6 +67085,7 @@ import { join as join20 } from "node:path";
 // ../../packages/host-core/dist/gui/daemon-gui.js
 import { join as join19, dirname as dirname8 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { spawn as spawn6, spawnSync } from "node:child_process";
 import { existsSync as existsSync9 } from "node:fs";
 var el = null;
 var guiReady = false;
@@ -67256,6 +67257,9 @@ function electronModule() {
 function daemonGuiTrayActive() {
   return guiReady && tray !== null;
 }
+function daemonGuiReady() {
+  return guiReady;
+}
 var uiDirOverride = null;
 var resolvedUiDir;
 function daemonUiDir() {
@@ -67301,14 +67305,48 @@ Set CCB_DAEMON_UI_DIR to the directory containing preload.cjs, or rebuild the da
 function daemonPreloadPath() {
   return join19(daemonUiDir(), "preload.cjs");
 }
+function devAppPath() {
+  const env = process.env.CCB_APP_DIR;
+  if (env)
+    return env;
+  const daemonEntry = process.argv[1];
+  if (daemonEntry) {
+    const cand = join19(dirname8(daemonEntry), "..", "..", "desktop");
+    if (existsSync9(join19(cand, "package.json")))
+      return cand;
+  }
+  return null;
+}
+async function reExecMainApp(url2) {
+  try {
+    const env = { ...process.env };
+    delete env.CCB_DAEMON_GUI;
+    delete env.CCB_FORCE_DAEMON_GUI;
+    delete env.ELECTRON_RUN_AS_NODE;
+    const appPath = el?.app?.isPackaged === false ? devAppPath() : null;
+    const args = appPath ? [appPath, url2] : [url2];
+    log2(`openMainApp: re-exec ${process.execPath} ${args.join(" ")}`);
+    const child = spawn6(process.execPath, args, { detached: true, stdio: "ignore", env });
+    child.on("error", (e) => log2("openMainApp: spawn failed:", e instanceof Error ? e.message : String(e)));
+    child.unref();
+  } catch (e) {
+    log2("openMainApp failed:", e instanceof Error ? e.message : String(e));
+  }
+}
+async function openMainApp(sessionId) {
+  return reExecMainApp(sessionId ? `tesseract://resume/${encodeURIComponent(sessionId)}` : "tesseract://open");
+}
+async function openMainAppSettings() {
+  return reExecMainApp("tesseract://settings");
+}
 
 // ../../packages/host-core/dist/os-control-runner.js
-import { spawn as spawn6 } from "node:child_process";
+import { spawn as spawn7 } from "node:child_process";
 var IS_MAC = process.platform === "darwin";
 var log3 = (...a) => console.log("[os-control]", ...a);
 function capture(command, args, opts = {}) {
   return new Promise((resolve14) => {
-    const child = spawn6(command, args, { cwd: opts.cwd, windowsHide: true });
+    const child = spawn7(command, args, { cwd: opts.cwd, windowsHide: true });
     const max = opts.maxBuffer ?? 4 * 1024 * 1024;
     let out = "";
     let err2 = "";
@@ -67667,10 +67705,11 @@ function askRdeskConsent(opts) {
   win3.setAlwaysOnTop(true, "screen-saver");
   win3.setVisibleOnAllWorkspaces(true, { visibleOnFullScreen: true });
   const reqId = randomUUID9();
-  const who = opts.viewerName ? `\u201C${opts.viewerName}\u201D` : "Someone";
+  const who = opts.viewerName ? `Someone calling themselves \u201C${opts.viewerName}\u201D` : "Someone";
   void win3.loadFile(uiPath("consent.html")).then(() => {
     try {
-      win3.webContents.send("consent:show", { reqId, title: "Allow remote desktop access?", body: `${who} wants to view and control this computer.` });
+      const how = opts.grant === "password" ? " They used this machine\u2019s unattended password." : "";
+      win3.webContents.send("consent:show", { reqId, title: "Allow remote desktop access?", body: `${who} wants to view and control this computer.${how}` });
       win3.show();
       win3.focus();
       el2.app.focus?.({ steal: true });
@@ -71682,14 +71721,14 @@ import { randomUUID as randomUUID14 } from "node:crypto";
 
 // ../../packages/host-core/dist/video-edit.js
 init_base_paths();
-import { spawn as spawn7 } from "node:child_process";
+import { spawn as spawn8 } from "node:child_process";
 import { mkdirSync as mkdirSync11, readFileSync as readFileSync16, rmSync as rmSync4, writeFileSync as writeFileSync12 } from "node:fs";
 import { join as join25, isAbsolute as isAbsolute4 } from "node:path";
 import { randomUUID as randomUUID13 } from "node:crypto";
 
 // ../../packages/host-core/dist/ffmpeg.js
 import { existsSync as existsSync11 } from "node:fs";
-import { spawnSync } from "node:child_process";
+import { spawnSync as spawnSync2 } from "node:child_process";
 import { sep as sep4 } from "node:path";
 import { createRequire as createRequire3 } from "node:module";
 var require_ = createRequire3(import.meta.url);
@@ -71708,7 +71747,7 @@ function fromPackage(name) {
 }
 function fromPath(cmd) {
   try {
-    const r = spawnSync(cmd, ["-version"], { stdio: "ignore", timeout: 5e3 });
+    const r = spawnSync2(cmd, ["-version"], { stdio: "ignore", timeout: 5e3 });
     return r.status === 0 ? cmd : null;
   } catch {
     return null;
@@ -71790,7 +71829,7 @@ function run(bin, args, opts) {
     let timedOut = false;
     let child;
     try {
-      child = spawn7(bin, args, { cwd: opts?.cwd ?? mediaSpawnCwd(), stdio: ["ignore", "pipe", "pipe"] });
+      child = spawn8(bin, args, { cwd: opts?.cwd ?? mediaSpawnCwd(), stdio: ["ignore", "pipe", "pipe"] });
     } catch (e) {
       reject(e instanceof Error ? e : new Error(String(e)));
       return;
@@ -71869,7 +71908,7 @@ async function renderEdl(edl, opts) {
   const { args, expectedDurationSec } = compileEdl(edl, { outPath, assFile, encoder, assetInfo });
   const watchdogMs = Math.min(45 * 6e4, Math.max(LONG_TIMEOUT_MS, Math.round((expectedDurationSec ?? 0) * 4e3)));
   await new Promise((resolve14, reject) => {
-    const child = spawn7(resolveFfmpeg(), ["-y", "-hide_banner", "-nostats", "-progress", "pipe:1", ...args], { cwd: mediaSpawnCwd(), stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn8(resolveFfmpeg(), ["-y", "-hide_banner", "-nostats", "-progress", "pipe:1", ...args], { cwd: mediaSpawnCwd(), stdio: ["ignore", "pipe", "pipe"] });
     let stderrTail = "";
     let stdoutBuf = "";
     let timedOut = false;
@@ -71953,7 +71992,7 @@ async function enhanceVideo(path6, spec, opts) {
   const watchdogMs = Math.min(45 * 6e4, Math.max(LONG_TIMEOUT_MS, Math.round(expected * 8e3)));
   const summary = chain2.steps.join(" \xB7 ");
   await new Promise((resolve14, reject) => {
-    const child = spawn7(resolveFfmpeg(), ["-y", "-hide_banner", "-nostats", "-progress", "pipe:1", ...args], { cwd: mediaSpawnCwd(), stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn8(resolveFfmpeg(), ["-y", "-hide_banner", "-nostats", "-progress", "pipe:1", ...args], { cwd: mediaSpawnCwd(), stdio: ["ignore", "pipe", "pipe"] });
     let stderrTail = "";
     let stdoutBuf = "";
     let timedOut = false;
@@ -72117,7 +72156,7 @@ function readChunkBase64(path6) {
 
 // ../../packages/host-core/dist/video-upscale.js
 init_base_paths();
-import { spawn as spawn8 } from "node:child_process";
+import { spawn as spawn9 } from "node:child_process";
 import { existsSync as existsSync12, mkdirSync as mkdirSync12, readFileSync as readFileSync17, readdirSync as readdirSync5 } from "node:fs";
 import { join as join26, dirname as dirname11 } from "node:path";
 var upscaleCwd;
@@ -72145,7 +72184,7 @@ function resolveRealesrgan() {
 }
 function fromPath2(cmd) {
   try {
-    const r = spawn8(cmd, ["-h"], { stdio: "ignore" });
+    const r = spawn9(cmd, ["-h"], { stdio: "ignore" });
     r.on("error", () => {
     });
     r.kill();
@@ -72190,7 +72229,7 @@ async function realesrganGpuWorks() {
       return false;
     }
     await new Promise((resolve14, reject) => {
-      const c = spawn8(re.bin, ["-i", inP, "-o", outP, "-n", model, "-s", "2", "-m", re.models, "-g", "0"], { cwd: upscaleSpawnCwd(), stdio: "ignore" });
+      const c = spawn9(re.bin, ["-i", inP, "-o", outP, "-n", model, "-s", "2", "-m", re.models, "-g", "0"], { cwd: upscaleSpawnCwd(), stdio: "ignore" });
       const t = setTimeout(() => {
         c.kill("SIGKILL");
         reject(new Error("probe timeout"));
@@ -72289,7 +72328,7 @@ async function realesrganUpscale(path6, opts) {
   if (!nFrames)
     throw new Error("No frames extracted.");
   await new Promise((resolve14, reject) => {
-    const child = spawn8(re.bin, ["-i", fin, "-o", fup, "-n", model, "-s", String(scale), "-m", re.models, "-f", "png", "-g", "0"], { cwd: upscaleSpawnCwd(), stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn9(re.bin, ["-i", fin, "-o", fup, "-n", model, "-s", String(scale), "-m", re.models, "-f", "png", "-g", "0"], { cwd: upscaleSpawnCwd(), stdio: ["ignore", "pipe", "pipe"] });
     let tail3 = "";
     const timer = setTimeout(() => child.kill("SIGKILL"), 45 * 6e4);
     child.stderr.on("data", (d) => {
@@ -72368,8 +72407,8 @@ async function falTopazEnhance(path6, spec, opts) {
   const dir2 = opts.outDir ?? workDir();
   mkdirSync12(dir2, { recursive: true });
   const outPath = join26(dir2, "enhanced.mp4");
-  const { writeFileSync: writeFileSync31 } = await import("node:fs");
-  writeFileSync31(outPath, Buffer.from(await dl.arrayBuffer()));
+  const { writeFileSync: writeFileSync32 } = await import("node:fs");
+  writeFileSync32(outPath, Buffer.from(await dl.arrayBuffer()));
   const out = await probeMedia(outPath).catch(() => null);
   opts.onProgress?.(100, "Enhance complete");
   return { path: outPath, mime: MIME, width: out?.width ?? null, height: out?.height ?? null, durationSec: out?.durationSec ?? p.durationSec, summary: `fal Topaz ${spec.model ?? "Proteus"} \xD7${spec.upscaleFactor ?? 2}` };
@@ -74223,12 +74262,12 @@ async function dirStats(root, opts) {
 }
 async function codeStats(root) {
   const start3 = Date.now();
-  const MAX_FILES = 25e3, MAX_BYTES = 256 * 1024 * 1024, TIME_MS = 12e3;
+  const MAX_FILES = 25e3, MAX_BYTES2 = 256 * 1024 * 1024, TIME_MS = 12e3;
   const byLang = /* @__PURE__ */ new Map();
   let totalFiles = 0, totalLines = 0, bytes2 = 0, truncated = false;
   const stack = [root];
   while (stack.length) {
-    if (totalFiles >= MAX_FILES || bytes2 >= MAX_BYTES || Date.now() - start3 > TIME_MS) {
+    if (totalFiles >= MAX_FILES || bytes2 >= MAX_BYTES2 || Date.now() - start3 > TIME_MS) {
       truncated = true;
       break;
     }
@@ -74240,7 +74279,7 @@ async function codeStats(root) {
       continue;
     }
     for (const e of ents) {
-      if (totalFiles >= MAX_FILES || bytes2 >= MAX_BYTES || Date.now() - start3 > TIME_MS) {
+      if (totalFiles >= MAX_FILES || bytes2 >= MAX_BYTES2 || Date.now() - start3 > TIME_MS) {
         truncated = true;
         break;
       }
@@ -78509,8 +78548,8 @@ var FSWatcher = class extends EventEmitter2 {
     }
     return this._userIgnored(path6, stats);
   }
-  _isntIgnored(path6, stat7) {
-    return !this._isIgnored(path6, stat7);
+  _isntIgnored(path6, stat8) {
+    return !this._isIgnored(path6, stat8);
   }
   /**
    * Provides a set of common helpers and properties relating to symlink handling.
@@ -80079,18 +80118,40 @@ function assertServerSelection() {
   send2("host", { type: "host:select", hostId: serverSelected ? SERVER_HOST_ID : ownHostId() });
 }
 var iceWaiters = [];
+var lastIce = null;
+var ICE_CACHE_MAX_AGE_MS = 5 * 6e4;
+var iceReqSeq = 0;
+function rememberIce(servers) {
+  lastIce = { servers, at: Date.now() };
+}
 function fetchIceServers() {
-  return new Promise((resolve14) => {
-    iceWaiters.push(resolve14);
-    send2("signal", { type: "signal:get-ice" });
+  const ask2 = () => new Promise((resolve14) => {
+    const id = `ice-${++iceReqSeq}`;
+    const waiter = (servers) => resolve14(servers);
+    iceWaiters.push(waiter);
+    send2("signal", { type: "signal:get-ice" }, { browserId: id });
     setTimeout(() => {
-      const i = iceWaiters.indexOf(resolve14);
+      const i = iceWaiters.indexOf(waiter);
       if (i >= 0) {
         iceWaiters.splice(i, 1);
-        resolve14(DEFAULT_ICE_SERVERS);
+        resolve14(null);
       }
     }, 2500);
   });
+  return (async () => {
+    const first = await ask2();
+    if (first)
+      return first;
+    const second = await ask2();
+    if (second)
+      return second;
+    if (lastIce && Date.now() - lastIce.at < ICE_CACHE_MAX_AGE_MS) {
+      console.log("[control-link] ice: relay did not answer get-ice; reusing the last minted list (TURN still available)");
+      return lastIce.servers;
+    }
+    console.log("[control-link] ice: relay did not answer get-ice; falling back to public STUN \u2014 NO TURN, a session that needs a relay will fail");
+    return DEFAULT_ICE_SERVERS;
+  })();
 }
 function relayBrowser(payload, clientId) {
   send2("browser", payload, { clientId });
@@ -80803,7 +80864,8 @@ function registerAsHost() {
   const kind = process.env.CCB_HOST_KIND === "cloud" ? "cloud" : void 0;
   const name = kind === "cloud" ? "Cloud agent" : hostname3();
   const caps = hostSessions ? ["agent", "fs", "term", "e2e"] : ["agent", "fs", "term"];
-  caps.push("rdesk");
+  if (hooks?.onRdesk)
+    caps.push("rdesk");
   caps.push("xfer");
   const upAdvert = upscaleAdvert();
   if (upAdvert.gpu)
@@ -80888,6 +80950,10 @@ function connect() {
       hooks?.onDrop?.(env.payload);
       return;
     }
+    if (channel === "rdesk-req") {
+      hooks?.onRdeskRequest?.(env.payload);
+      return;
+    }
     if (channel === "p2p") {
       const m = env.payload;
       for (const cb of [...p2pSubscribers])
@@ -81042,6 +81108,7 @@ function connect() {
     if (channel === "signal") {
       const p = env.payload;
       if (p?.type === "signal:ready" && Array.isArray(p.iceServers)) {
+        rememberIce(p.iceServers);
         const waiters = iceWaiters;
         iceWaiters = [];
         for (const r of waiters)
@@ -81265,9 +81332,17 @@ async function createRemoteDesktopEngine(kind, ctx2) {
 function grantOf(msg) {
   return msg.auth.kind;
 }
+var PW_FREE_ATTEMPTS = 3;
+var PW_BACKOFF_BASE_MS = 2e3;
+var PW_BACKOFF_MAX_MS = 15 * 6e4;
+var PW_FAILURE_DECAY_MS = 30 * 6e4;
 var RdeskSessionManager = class {
   sessions = /* @__PURE__ */ new Map();
   deps;
+  /** Consecutive failed password attempts, and the time the lockout expires. */
+  pwFailures = 0;
+  pwLockedUntil = 0;
+  pwLastFailureAt = 0;
   constructor(deps) {
     this.deps = deps;
   }
@@ -81282,7 +81357,14 @@ var RdeskSessionManager = class {
     this.deps.log?.(`[rdesk] ${msg}`);
   }
   now() {
-    return Date.now();
+    return this.deps.now?.() ?? Date.now();
+  }
+  /** How long the password gate stays shut after repeated failures (exponential, capped). */
+  pwBackoffMs() {
+    const over = this.pwFailures - PW_FREE_ATTEMPTS;
+    if (over <= 0)
+      return 0;
+    return Math.min(PW_BACKOFF_BASE_MS * 2 ** (over - 1), PW_BACKOFF_MAX_MS);
   }
   audit(e) {
     this.deps.audit?.({ at: this.now(), ...e });
@@ -81303,7 +81385,9 @@ var RdeskSessionManager = class {
   }
   /** Handle a viewer's `rdesk:connect`. Runs the grant→consent policy, then builds +
    *  starts the engine and replies `rdesk:accepted`, or replies `rdesk:denied`. */
-  async onConnect(sessionId, viewer, msg) {
+  async onConnect(sessionId, viewerIn, msg) {
+    const declared = typeof msg.viewerName === "string" ? msg.viewerName.trim().slice(0, 60) : "";
+    const viewer = viewerIn.name || !declared ? viewerIn : { ...viewerIn, name: declared };
     const grant0 = grantOf(msg);
     this.audit({ event: "connect", sessionId, viewerUserId: viewer.userId, viewerName: viewer.name, grant: grant0 });
     const deny = (reason) => {
@@ -81315,24 +81399,48 @@ var RdeskSessionManager = class {
       return deny("entitlement");
     if (this.sessions.has(sessionId))
       return deny("busy");
+    const maxSessions = this.deps.maxSessions ?? 3;
+    if (maxSessions > 0 && this.sessions.size >= maxSessions) {
+      this.log(`connect refused sessionId=${sessionId} \u2014 at the ${maxSessions}-session limit`);
+      return deny("busy");
+    }
     const grant = grantOf(msg);
     if (grant === "password") {
+      if (this.now() < this.pwLockedUntil) {
+        this.log(`password attempt refused \u2014 locked for ${Math.ceil((this.pwLockedUntil - this.now()) / 1e3)}s`);
+        this.audit({ event: "deny", sessionId, grant, detail: "password-locked" });
+        return deny("password");
+      }
+      if (this.pwLastFailureAt && this.now() - this.pwLastFailureAt > PW_FAILURE_DECAY_MS) {
+        this.pwFailures = 0;
+        this.pwLockedUntil = 0;
+      }
       const pw = msg.auth.kind === "password" ? msg.auth.password : "";
       const ok = await this.deps.checkPassword(pw);
-      if (!ok)
+      if (!ok) {
+        this.pwFailures += 1;
+        this.pwLastFailureAt = this.now();
+        const backoff = this.pwBackoffMs();
+        if (backoff > 0) {
+          this.pwLockedUntil = this.now() + backoff;
+          this.log(`password failed ${this.pwFailures}\xD7 \u2014 locking the password gate for ${Math.round(backoff / 1e3)}s`);
+        }
         return deny("password");
+      }
+      this.pwFailures = 0;
+      this.pwLockedUntil = 0;
+      this.pwLastFailureAt = 0;
     } else if (grant === "code") {
       const allowed = await this.deps.consent({ sessionId, viewerName: viewer.name, grant });
       if (!allowed)
         return deny("consent");
     }
-    const forceRelay = grant !== "registry";
-    const accessLevel = this.deps.defaultAccess ?? "view";
+    const da = this.deps.defaultAccess;
+    const accessLevel = (typeof da === "function" ? da() : da) ?? "view";
     const engineKind = msg.engine ?? "tesseract";
     const ctx2 = {
       sessionId,
       accessLevel,
-      forceRelay,
       sendSignal: (m) => this.deps.sendSignal(sessionId, viewer.clientId, m),
       sendControl: (m) => this.deps.sendControl(sessionId, viewer.clientId, m),
       sendData: (_m) => {
@@ -81342,7 +81450,8 @@ var RdeskSessionManager = class {
     let engine;
     try {
       engine = await this.deps.createEngine(engineKind, ctx2);
-      await engine.start({ monitorId: void 0, quality: "auto" });
+      const dq = this.deps.defaultQuality;
+      await engine.start({ monitorId: void 0, quality: (typeof dq === "function" ? dq() : dq) ?? "auto" });
     } catch (e) {
       this.log(`engine start failed sessionId=${sessionId}: ${e instanceof Error ? e.message : String(e)}`);
       return deny("offline");
@@ -81351,9 +81460,9 @@ var RdeskSessionManager = class {
     const sources = await engine.listSources?.().catch(() => []) ?? [];
     const activeMonitor = monitors.find((m) => m.primary)?.id ?? monitors[0]?.id ?? "";
     const activeSource = sources.find((s) => s.kind === "screen" && s.primary)?.id ?? sources[0]?.id ?? "";
-    const session = { sessionId, viewer, grant, accessLevel, forceRelay, engine, startedAt: this.now() };
+    const session = { sessionId, viewer, grant, accessLevel, engine, startedAt: this.now() };
     this.sessions.set(sessionId, session);
-    this.log(`accepted sessionId=${sessionId} grant=${grant} engine=${engine.id} access=${accessLevel} forceRelay=${forceRelay}`);
+    this.log(`accepted sessionId=${sessionId} grant=${grant} engine=${engine.id} access=${accessLevel}`);
     this.audit({ event: "accept", sessionId, viewerUserId: viewer.userId, viewerName: viewer.name, grant, detail: `engine=${engine.id}` });
     this.deps.sendControl(sessionId, viewer.clientId, {
       type: "rdesk:accepted",
@@ -81363,8 +81472,7 @@ var RdeskSessionManager = class {
       activeMonitor,
       sources,
       activeSource,
-      caps: engine.capabilities(),
-      forceRelay
+      caps: engine.capabilities()
     });
     this.changed();
   }
@@ -81387,12 +81495,20 @@ var RdeskSessionManager = class {
     this.changed();
   }
   /** A viewer asks for control (view→control). Own-fleet auto-grants; cross-account
-   *  runs the consent prompt. Denial simply leaves the session view-only. */
+   *  runs the consent prompt. Denial simply leaves the session view-only.
+   *
+   *  The decision keys off `grant` ALONE. It used to also accept `viewer.sameAccount`, but
+   *  that flag was hardcoded `true` at every production call site (the relay hook has no
+   *  userId to derive it from), so this test always passed and ANY cross-account viewer —
+   *  including an unattended password one — could silently escalate view→control with no
+   *  prompt, and could instantly undo a host that demoted them back to view. `grant` is
+   *  resolved in onConnect, stored per session and immutable, and `registry` IS same-account
+   *  by construction (the relay only exposes own-account hosts in host:list). */
   async requestControl(sessionId) {
     const s = this.sessions.get(sessionId);
     if (!s || s.accessLevel === "control")
       return;
-    let allow = s.grant === "registry" || s.viewer.sameAccount;
+    let allow = s.grant === "registry";
     if (!allow)
       allow = await this.deps.consent({ sessionId, viewerName: s.viewer.name, grant: s.grant });
     if (allow)
@@ -81469,6 +81585,7 @@ var RdeskSessionManager = class {
     }
     if (msg.type === "rdesk:av") {
       const s = this.sessions.get(sessionId);
+      s?.engine.setAv?.(msg.on);
       this.deps.onCall?.({ sessionId, on: msg.on, viewerName: s?.viewer.name });
       this.audit({ event: "call", sessionId, detail: msg.on ? "viewer joined call" : "viewer left call" });
       return;
@@ -81537,6 +81654,7 @@ function ensureIpc() {
   }));
   el2.ipcMain.on("rdesk:pub:ready", (_e, p) => route2(p, (w) => w.handlers.onReady()));
   el2.ipcMain.on("rdesk:pub:error", (_e, p) => route2(p, (w, x) => w.handlers.onError(String(x.error ?? "publisher error"))));
+  el2.ipcMain.on("rdesk:pub:path", (_e, p) => route2(p, (w, x) => w.handlers.onPath?.(String(x.path ?? "unknown"), { localType: x.localType ?? null, remoteType: x.remoteType ?? null })));
   el2.ipcMain.on("rdesk:pub:stopped", (_e, p) => route2(p, (w) => w.onStoppedAck()));
 }
 async function listPublisherMonitors() {
@@ -81639,7 +81757,6 @@ var PublisherWindow = class {
       sessionId: this.sessionId,
       sourceId,
       iceServers: opts.iceServers,
-      forceRelay: opts.forceRelay,
       quality: opts.quality ?? "auto",
       systemAudio: opts.systemAudio ?? false,
       maxWidth: opts.maxWidth,
@@ -81654,6 +81771,10 @@ var PublisherWindow = class {
   /** Create the hidden window in CANVAS mode: no local capture — the RDP/VNC engine
    *  pushes framebuffer rects via {@link pushFrame}, which are painted to a canvas that
    *  is captureStream()'d into the same WebRTC PeerConnection. Reuses the whole pipeline. */
+  /** Turn two-way voice on/off on THIS peer connection (the publisher re-offers). */
+  setAv(on) {
+    this.win?.webContents.send("rdesk:pub:av", { sessionId: this.sessionId, on });
+  }
   async startCanvas(opts) {
     const el2 = electronModule();
     if (!el2?.BrowserWindow)
@@ -81681,7 +81802,6 @@ var PublisherWindow = class {
       sessionId: this.sessionId,
       mode: "canvas",
       iceServers: opts.iceServers,
-      forceRelay: opts.forceRelay,
       quality: opts.quality ?? "auto",
       width: opts.width,
       height: opts.height,
@@ -81719,7 +81839,6 @@ var PublisherWindow = class {
       sessionId: this.sessionId,
       sourceId,
       iceServers: opts.iceServers,
-      forceRelay: opts.forceRelay,
       quality: opts.quality ?? "auto",
       systemAudio: opts.systemAudio ?? false,
       maxWidth: opts.maxWidth,
@@ -81931,21 +82050,32 @@ var TesseractEngine = class {
     this.deps = deps;
     this.access = ctx2.accessLevel;
   }
+  /**
+   * What this session can ACTUALLY do, derived at runtime.
+   *
+   * This used to be a hardcoded constant returned identically on every platform, so a
+   * viewer was told `input: true` by a Wayland host that cannot inject a keystroke, and
+   * offered a system-audio toggle on macOS where the capture is known to be silent. A
+   * capability flag that doesn't track reality is worse than no flag: the viewer renders
+   * a control that quietly does nothing.
+   */
   capabilities() {
     return {
-      input: true,
+      // False until an input runner was actually obtained (see start()): on Wayland
+      // without the portal, control is impossible and the session is view-only.
+      input: !!this.injector,
       clipboard: true,
-      fileTransfer: true,
-      // reuses the existing fs channel (Phase 6)
+      // No drag/drop or upload surface exists inside an rdesk session today. It was
+      // advertised as if it did; nothing in either viewer ever read it.
+      fileTransfer: false,
       multiMonitor: true,
       windowCapture: true,
       // share a single window/app (privacy)
+      // Voice now rides this session's own peer connection (setAv).
       bidiAudioVideo: true,
-      // Phase 5 (viewer mic ↔ host mic/webcam)
-      // System-audio loopback: Windows/Linux capture it natively via getUserMedia
-      // (desktop audio); macOS needs a loopback (best-effort — may be silent until a
-      // ScreenCaptureKit audio addon lands). Advertised so the viewer shows the toggle.
-      systemAudio: true
+      // Windows/Linux capture desktop audio natively; macOS needs a loopback we don't
+      // ship, so claiming it there just produces a toggle that yields silence.
+      systemAudio: process.platform !== "darwin"
     };
   }
   listMonitors() {
@@ -81955,7 +82085,7 @@ var TesseractEngine = class {
     return listPublisherSources();
   }
   startOpts(iceServers) {
-    return { iceServers, forceRelay: this.ctx.forceRelay, quality: this.quality, systemAudio: this.systemAudio };
+    return { iceServers, quality: this.quality, systemAudio: this.systemAudio };
   }
   async setSource(sourceId) {
     this.sourceId = sourceId;
@@ -82008,12 +82138,14 @@ var TesseractEngine = class {
         }
       },
       onReady: () => this.ctx.log("publisher connected"),
-      onError: (err2) => this.ctx.log(`publisher error: ${err2}`)
+      onError: (err2) => this.ctx.log(`publisher error: ${err2}`),
+      // Media is direct-first; log which path actually won so a regression to relay
+      // (which costs real bandwidth) is visible instead of silent. Types only, no IPs.
+      onPath: (path6, d) => this.ctx.log(`media path=${path6} (local=${d.localType ?? "?"} remote=${d.remoteType ?? "?"})`)
     });
     this.pub = pub;
     await pub.start({
       iceServers,
-      forceRelay: this.ctx.forceRelay,
       monitorId: this.monitorId,
       quality: this.quality,
       systemAudio: this.systemAudio
@@ -82043,6 +82175,9 @@ var TesseractEngine = class {
     const iceServers = await this.deps.getIceServers().catch(() => []);
     await this.pub?.setMonitor(monitorId, this.startOpts(iceServers));
   }
+  setAv(on) {
+    this.pub?.setAv(on);
+  }
   setQuality(preset) {
     this.quality = preset;
     this.pub?.setQuality(preset);
@@ -82064,13 +82199,156 @@ function registerTesseractEngine(deps) {
 }
 
 // ../../packages/host-core/dist/local-server.js
-import { timingSafeEqual as timingSafeEqual4 } from "node:crypto";
+import { timingSafeEqual as timingSafeEqual5 } from "node:crypto";
+
+// ../../packages/host-core/dist/rdesk/server-prefs.js
+import { readFileSync as readFileSync25, writeFileSync as writeFileSync17 } from "node:fs";
+import { join as join44 } from "node:path";
+function rdeskServerPrefsPath() {
+  return join44(daemonDir2(), "rdesk-server.json");
+}
+var DEFAULTS2 = {
+  enabled: true,
+  defaultAccess: "control",
+  quality: "auto",
+  autostart: true,
+  hideTray: false,
+  noticeShownAt: 0
+};
+function readRdeskServerPrefs() {
+  try {
+    const p = JSON.parse(readFileSync25(rdeskServerPrefsPath(), "utf8"));
+    return {
+      // `!== false` (not `?? true`): only an explicit opt-out disables sharing, so a
+      // partially-written or older prefs file never silently turns the machine off.
+      enabled: p.enabled !== false,
+      defaultAccess: p.defaultAccess === "view" ? "view" : "control",
+      quality: p.quality ?? DEFAULTS2.quality,
+      autostart: p.autostart ?? DEFAULTS2.autostart,
+      hideTray: p.hideTray ?? DEFAULTS2.hideTray,
+      noticeShownAt: typeof p.noticeShownAt === "number" ? p.noticeShownAt : 0
+    };
+  } catch {
+    return { ...DEFAULTS2 };
+  }
+}
+function writeRdeskServerPrefs(patch) {
+  try {
+    const next = { ...readRdeskServerPrefs(), ...patch };
+    writeFileSync17(rdeskServerPrefsPath(), JSON.stringify(next), { mode: 384 });
+  } catch {
+  }
+}
+function rdeskSharingEnabled() {
+  if (process.env.CCB_RDESK_ENABLED === "0")
+    return false;
+  if (process.env.CCB_RDESK_ENABLED === "1")
+    return true;
+  return readRdeskServerPrefs().enabled;
+}
+
+// ../../packages/host-core/dist/rdesk/password.js
+import { scryptSync, randomBytes as randomBytes5, timingSafeEqual as timingSafeEqual4, randomInt } from "node:crypto";
+import { readFileSync as readFileSync26, writeFileSync as writeFileSync18, existsSync as existsSync21, unlinkSync as unlinkSync2 } from "node:fs";
+import { join as join45 } from "node:path";
+function pwFile() {
+  return join45(daemonDir2(), "rdesk-password.json");
+}
+function pwPlainFile() {
+  return join45(daemonDir2(), "rdesk-password.enc");
+}
+var PW_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789";
+var PW_LENGTH = 16;
+function generatePassword() {
+  let out = "";
+  for (let i = 0; i < PW_LENGTH; i++)
+    out += PW_ALPHABET[randomInt(PW_ALPHABET.length)];
+  return (out.match(/.{1,4}/g) ?? [out]).join("-");
+}
+function writePlain(password) {
+  try {
+    const safe = electronModule()?.safeStorage;
+    if (!safe?.isEncryptionAvailable())
+      return;
+    writeFileSync18(pwPlainFile(), safe.encryptString(password), { mode: 384 });
+  } catch {
+  }
+}
+function canRevealRdeskPassword() {
+  try {
+    const safe = electronModule()?.safeStorage;
+    return !!safe?.isEncryptionAvailable() && existsSync21(pwPlainFile());
+  } catch {
+    return false;
+  }
+}
+function readRdeskPasswordPlain() {
+  try {
+    const safe = electronModule()?.safeStorage;
+    if (!safe?.isEncryptionAvailable())
+      return null;
+    return safe.decryptString(readFileSync26(pwPlainFile()));
+  } catch {
+    return null;
+  }
+}
+function setRdeskPassword(password) {
+  if (!password) {
+    try {
+      unlinkSync2(pwFile());
+    } catch {
+    }
+    try {
+      unlinkSync2(pwPlainFile());
+    } catch {
+    }
+    return;
+  }
+  const salt = randomBytes5(16);
+  const hash2 = scryptSync(password, salt, 32);
+  writeFileSync18(pwFile(), JSON.stringify({ salt: salt.toString("hex"), hash: hash2.toString("hex") }), { mode: 384 });
+  writePlain(password);
+}
+function regenerateRdeskPassword() {
+  const pw = generatePassword();
+  setRdeskPassword(pw);
+  return pw;
+}
+function ensureRdeskPassword() {
+  if (hasRdeskPassword())
+    return null;
+  return regenerateRdeskPassword();
+}
+function hasRdeskPassword() {
+  return !!process.env.CCB_RDESK_PASSWORD || existsSync21(pwFile());
+}
+function verifyRdeskPassword(password) {
+  if (!password)
+    return false;
+  const override = process.env.CCB_RDESK_PASSWORD;
+  if (override)
+    return password.length === override.length && timingSafeEqual4(Buffer.from(password), Buffer.from(override));
+  try {
+    const { salt, hash: hash2 } = JSON.parse(readFileSync26(pwFile(), "utf8"));
+    const got = scryptSync(password, Buffer.from(salt, "hex"), 32);
+    const want = Buffer.from(hash2, "hex");
+    return got.length === want.length && timingSafeEqual4(got, want);
+  } catch {
+    return false;
+  }
+}
+
+// ../../packages/host-core/dist/rdesk/server-auth.js
+var DEFAULT_API = (process.env.CCB_TESSERACT_API ?? "https://app.tesseract.dev").replace(/\/$/, "");
+function getMachinePublicId() {
+  return readCredentials()?.publicId ?? null;
+}
 
 // ../../packages/host-core/dist/vault/manager.js
 import { createHash as createHash7 } from "node:crypto";
 
 // ../../packages/host-core/dist/vault/passkey.js
-import { createHash as createHash6, createPrivateKey, createSign, sign as rawSign, generateKeyPairSync, randomBytes as randomBytes5 } from "node:crypto";
+import { createHash as createHash6, createPrivateKey, createSign, sign as rawSign, generateKeyPairSync, randomBytes as randomBytes6 } from "node:crypto";
 function buildAuthenticatorData(rpId, signCount) {
   const rpIdHash = createHash6("sha256").update(rpId).digest();
   const counter = Buffer.alloc(4);
@@ -82126,7 +82404,7 @@ function createPasskeyRegistration(rpId) {
   const pkcs8 = privateKey.export({ type: "pkcs8", format: "der" });
   const jwk = publicKey.export({ format: "jwk" });
   const cose = coseEs256(Buffer.from(jwk.x, "base64url"), Buffer.from(jwk.y, "base64url"));
-  const credentialId = randomBytes5(32);
+  const credentialId = randomBytes6(32);
   const rpIdHash = createHash6("sha256").update(rpId).digest();
   const flags = Buffer.from([69]);
   const signCount = Buffer.alloc(4);
@@ -82151,7 +82429,7 @@ function createPasskeyRegistration(rpId) {
 
 // ../../packages/host-core/dist/vault/manager.js
 init_base_paths();
-import { mkdirSync as mkdirSync21, readFileSync as readFileSync27, writeFileSync as writeFileSync19 } from "node:fs";
+import { mkdirSync as mkdirSync21, readFileSync as readFileSync29, writeFileSync as writeFileSync21 } from "node:fs";
 import { dirname as dirname20 } from "node:path";
 
 // ../../packages/vault-core/dist/crypto.js
@@ -82322,7 +82600,7 @@ function tombstone(id, updatedAt) {
 // ../../packages/vault-core/dist/authenticator.js
 var subtle2 = globalThis.crypto.subtle;
 var bs2 = (b) => b;
-var DEFAULTS2 = { algorithm: "SHA1", digits: 6, period: 30, counter: 0 };
+var DEFAULTS3 = { algorithm: "SHA1", digits: 6, period: 30, counter: 0 };
 async function hmac(algorithm, keyBytes, msg) {
   const hash2 = algorithm === "SHA512" ? "SHA-512" : algorithm === "SHA256" ? "SHA-256" : "SHA-1";
   const key2 = await subtle2.importKey("raw", bs2(keyBytes), { name: "HMAC", hash: hash2 }, false, ["sign"]);
@@ -82354,7 +82632,7 @@ async function generateTotp(params, atMs = Date.now()) {
   return { code, secondsRemaining: period - seconds % period, period };
 }
 async function generateFromUri(uriOrSecret, atMs = Date.now()) {
-  const params = uriOrSecret.startsWith("otpauth://") ? parseOtpauthUri(uriOrSecret) : { ...DEFAULTS2, type: "totp", secret: uriOrSecret.replace(/\s+/g, "").toUpperCase() };
+  const params = uriOrSecret.startsWith("otpauth://") ? parseOtpauthUri(uriOrSecret) : { ...DEFAULTS3, type: "totp", secret: uriOrSecret.replace(/\s+/g, "").toUpperCase() };
   return generateTotp(params, atMs);
 }
 function parseOtpauthUri(uri) {
@@ -82400,7 +82678,7 @@ var SETS = {
   symbol: "!@#$%^&*()-_=+[]{};:,.<>?"
 };
 var AMBIGUOUS = new Set("O0Il1");
-function randomInt(maxExclusive) {
+function randomInt2(maxExclusive) {
   const limit = Math.floor(256 / maxExclusive) * maxExclusive;
   let x;
   do {
@@ -82409,9 +82687,9 @@ function randomInt(maxExclusive) {
   return x % maxExclusive;
 }
 function pick2(pool) {
-  return pool[randomInt(pool.length)];
+  return pool[randomInt2(pool.length)];
 }
-function generatePassword(opts = {}) {
+function generatePassword2(opts = {}) {
   const o = {
     length: 20,
     uppercase: true,
@@ -82452,7 +82730,7 @@ function generatePassword(opts = {}) {
 }
 function shuffle(arr) {
   for (let i = arr.length - 1; i > 0; i--) {
-    const j = randomInt(i + 1);
+    const j = randomInt2(i + 1);
     [arr[i], arr[j]] = [arr[j], arr[i]];
   }
   return arr;
@@ -83173,7 +83451,7 @@ function makeDaemonVaultApi(getOrigin, getToken2) {
 
 // ../../packages/host-core/dist/vault/persistence.js
 init_base_paths();
-import { existsSync as existsSync21, mkdirSync as mkdirSync19, readFileSync as readFileSync25, writeFileSync as writeFileSync17, unlinkSync as unlinkSync2 } from "node:fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync19, readFileSync as readFileSync27, writeFileSync as writeFileSync19, unlinkSync as unlinkSync3 } from "node:fs";
 import { dirname as dirname19 } from "node:path";
 function vaultStoreFile() {
   return homePath(".tesseract", "vault", "vault.json");
@@ -83185,9 +83463,9 @@ function makeVaultPersistence(file2 = vaultStoreFile, deviceKeyFile = vaultDevic
   return {
     load() {
       try {
-        if (!existsSync21(file2()))
+        if (!existsSync22(file2()))
           return null;
-        const parsed = JSON.parse(readFileSync25(file2(), "utf8"));
+        const parsed = JSON.parse(readFileSync27(file2(), "utf8"));
         if (!parsed || typeof parsed !== "object")
           return null;
         return { meta: parsed.meta ?? null, items: Array.isArray(parsed.items) ? parsed.items : [] };
@@ -83198,13 +83476,13 @@ function makeVaultPersistence(file2 = vaultStoreFile, deviceKeyFile = vaultDevic
     save(state2) {
       try {
         mkdirSync19(dirname19(file2()), { recursive: true, mode: 448 });
-        writeFileSync17(file2(), JSON.stringify(state2), { mode: 384 });
+        writeFileSync19(file2(), JSON.stringify(state2), { mode: 384 });
       } catch {
       }
     },
     loadDeviceKey() {
       try {
-        return existsSync21(deviceKeyFile()) ? readFileSync25(deviceKeyFile(), "utf8").trim() || null : null;
+        return existsSync22(deviceKeyFile()) ? readFileSync27(deviceKeyFile(), "utf8").trim() || null : null;
       } catch {
         return null;
       }
@@ -83212,14 +83490,14 @@ function makeVaultPersistence(file2 = vaultStoreFile, deviceKeyFile = vaultDevic
     saveDeviceKey(base64Key) {
       try {
         mkdirSync19(dirname19(deviceKeyFile()), { recursive: true, mode: 448 });
-        writeFileSync17(deviceKeyFile(), base64Key, { mode: 384 });
+        writeFileSync19(deviceKeyFile(), base64Key, { mode: 384 });
       } catch {
       }
     },
     clearDeviceKey() {
       try {
-        if (existsSync21(deviceKeyFile()))
-          unlinkSync2(deviceKeyFile());
+        if (existsSync22(deviceKeyFile()))
+          unlinkSync3(deviceKeyFile());
       } catch {
       }
     }
@@ -83228,8 +83506,8 @@ function makeVaultPersistence(file2 = vaultStoreFile, deviceKeyFile = vaultDevic
 
 // ../../packages/host-core/dist/vault/biometric.js
 init_base_paths();
-import { existsSync as existsSync22, mkdirSync as mkdirSync20, readFileSync as readFileSync26, rmSync as rmSync6, writeFileSync as writeFileSync18 } from "node:fs";
-import { join as join44 } from "node:path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync20, readFileSync as readFileSync28, rmSync as rmSync6, writeFileSync as writeFileSync20 } from "node:fs";
+import { join as join46 } from "node:path";
 async function electronBio() {
   if (!electronModule())
     return null;
@@ -83250,7 +83528,7 @@ function bioDir() {
   return d;
 }
 function bioFile(id) {
-  return join44(bioDir(), `${String(id).replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 64)}.enc`);
+  return join46(bioDir(), `${String(id).replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 64)}.enc`);
 }
 async function biometricAvailable() {
   if (process.platform !== "darwin")
@@ -83265,24 +83543,24 @@ async function biometricAvailable() {
   }
 }
 function biometricEnrolled(id) {
-  return existsSync22(bioFile(id));
+  return existsSync23(bioFile(id));
 }
 async function biometricEnroll(id, base64Key) {
   const bio = await electronBio();
   if (!bio)
     throw new Error("Touch ID is not available on this device.");
   await bio.systemPreferences.promptTouchID("enable Touch ID for your vault");
-  writeFileSync18(bioFile(id), bio.safeStorage.encryptString(base64Key), { mode: 384 });
+  writeFileSync20(bioFile(id), bio.safeStorage.encryptString(base64Key), { mode: 384 });
 }
 async function biometricUnlock(id) {
   const f = bioFile(id);
-  if (!existsSync22(f))
+  if (!existsSync23(f))
     throw new Error("Touch ID is not set up for this vault.");
   const bio = await electronBio();
   if (!bio)
     throw new Error("Touch ID is not available on this device.");
   await bio.systemPreferences.promptTouchID("unlock your vault");
-  return bio.safeStorage.decryptString(readFileSync26(f));
+  return bio.safeStorage.decryptString(readFileSync28(f));
 }
 function biometricDisable(id) {
   try {
@@ -83312,7 +83590,7 @@ var VaultManager = class {
   // ── auto-lock ────────────────────────────────────────────────────────────────────
   loadAutoLock() {
     try {
-      const raw = JSON.parse(readFileSync27(settingsFile(), "utf8"));
+      const raw = JSON.parse(readFileSync29(settingsFile(), "utf8"));
       return Number.isFinite(raw.autoLockMinutes) ? Math.max(0, raw.autoLockMinutes) : 0;
     } catch {
       return 0;
@@ -83321,7 +83599,7 @@ var VaultManager = class {
   saveAutoLock() {
     try {
       mkdirSync21(dirname20(settingsFile()), { recursive: true, mode: 448 });
-      writeFileSync19(settingsFile(), JSON.stringify({ autoLockMinutes: this.autoLockMinutes }), { mode: 384 });
+      writeFileSync21(settingsFile(), JSON.stringify({ autoLockMinutes: this.autoLockMinutes }), { mode: 384 });
     } catch {
     }
   }
@@ -83600,7 +83878,7 @@ var VaultManager = class {
   }
   // ── misc ─────────────────────────────────────────────────────────────────────────
   generatePassword(opts) {
-    return generatePassword(opts);
+    return generatePassword2(opts);
   }
   async syncNow() {
     await this.sync.ensureSynced();
@@ -83628,7 +83906,7 @@ function tokenMatches(got, want) {
     return false;
   const a = Buffer.from(got);
   const b = Buffer.from(want);
-  return a.length === b.length && timingSafeEqual4(a, b);
+  return a.length === b.length && timingSafeEqual5(a, b);
 }
 function originAllowed(origin) {
   if (!origin)
@@ -83715,6 +83993,8 @@ async function startLocalServer(opts) {
         void handleVault(env.payload);
       else if (env.channel === "term")
         void handleTerm(env.payload);
+      else if (env.channel === "rdeskadmin")
+        void handleRdeskAdmin(env.payload);
       else if (env.channel === "voice")
         void handleVoice(env.payload);
       else if (env.channel === "present") {
@@ -83733,7 +84013,7 @@ async function startLocalServer(opts) {
         const rd = opts.getRdesk?.();
         if (rd && env.sessionId) {
           rdeskSessions.add(env.sessionId);
-          void rd.onClientMessage(env.sessionId, { clientId: loopbackOrigin, sameAccount: true, name: "This device" }, env.payload);
+          void rd.onClientMessage(env.sessionId, { clientId: loopbackOrigin, name: "This device" }, env.payload);
         }
       } else if (env.channel === "signal") {
         const rd = opts.getRdesk?.();
@@ -83775,6 +84055,39 @@ async function startLocalServer(opts) {
     });
     ws.on("error", () => {
     });
+    async function handleRdeskAdmin(msg) {
+      const reply3 = (payload) => send3("rdeskadmin", { requestId: msg.requestId, ...payload });
+      const state2 = () => ({
+        prefs: readRdeskServerPrefs(),
+        machineId: getMachinePublicId(),
+        hasPassword: hasRdeskPassword(),
+        canReveal: canRevealRdeskPassword(),
+        sessions: opts.getRdeskSessions?.() ?? []
+      });
+      switch (msg.type) {
+        case "rdesk:state":
+          reply3({ type: "rdesk:state", ...state2() });
+          break;
+        case "rdesk:set":
+          if (msg.patch)
+            writeRdeskServerPrefs(msg.patch);
+          reply3({ type: "rdesk:state", ...state2() });
+          break;
+        case "rdesk:reveal-password":
+          reply3({ type: "rdesk:password", password: readRdeskPasswordPlain() });
+          break;
+        case "rdesk:regenerate-password":
+          reply3({ type: "rdesk:state", password: regenerateRdeskPassword(), ...state2() });
+          break;
+        case "rdesk:disconnect":
+          if (msg.sessionId)
+            await opts.getRdesk?.()?.disconnect(msg.sessionId, "host");
+          reply3({ type: "rdesk:state", ...state2() });
+          break;
+        default:
+          reply3({ type: "rdesk:error", error: `unknown rdeskadmin message: ${String(msg.type)}` });
+      }
+    }
     async function handleAgent(msg) {
       const b = await getSharedBackend();
       switch (msg.type) {
@@ -84149,24 +84462,24 @@ async function startLocalServer(opts) {
 
 // ../../packages/host-core/dist/daemon-runtime.js
 init_base_paths();
-import { readFileSync as readFileSync31, writeFileSync as writeFileSync26, existsSync as existsSync29, mkdirSync as mkdirSync27, unlinkSync as unlinkSync4, chmodSync as chmodSync6 } from "node:fs";
+import { readFileSync as readFileSync32, writeFileSync as writeFileSync27, existsSync as existsSync29, mkdirSync as mkdirSync27, unlinkSync as unlinkSync4, chmodSync as chmodSync6 } from "node:fs";
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { join as join55 } from "node:path";
 import { randomBytes as randomBytes8 } from "node:crypto";
 import { hostname as hostname4 } from "node:os";
 
 // ../../packages/host-core/dist/device-identity.js
-import { join as join45 } from "node:path";
-import { readFileSync as readFileSync28, writeFileSync as writeFileSync20, existsSync as existsSync23, mkdirSync as mkdirSync22, renameSync as renameSync8, chmodSync as chmodSync3 } from "node:fs";
+import { join as join47 } from "node:path";
+import { readFileSync as readFileSync30, writeFileSync as writeFileSync22, existsSync as existsSync24, mkdirSync as mkdirSync22, renameSync as renameSync8, chmodSync as chmodSync3 } from "node:fs";
 var cached2 = null;
 function identityPath() {
-  return join45(daemonDir2(), "identity.json");
+  return join47(daemonDir2(), "identity.json");
 }
 async function loadOrCreateDeviceIdentity() {
   if (cached2)
     return cached2;
   try {
-    const stored = JSON.parse(readFileSync28(identityPath(), "utf-8"));
+    const stored = JSON.parse(readFileSync30(identityPath(), "utf-8"));
     if (stored?.privateJwk) {
       cached2 = await importIdentity(stored.privateJwk);
       return cached2;
@@ -84176,10 +84489,10 @@ async function loadOrCreateDeviceIdentity() {
   const kp = await generateIdentityKeyPair(true);
   const { privateJwk, publicRaw } = await exportIdentity(kp);
   const dir2 = daemonDir2();
-  if (!existsSync23(dir2))
+  if (!existsSync24(dir2))
     mkdirSync22(dir2, { recursive: true, mode: 448 });
   const tmp = `${identityPath()}.tmp`;
-  writeFileSync20(tmp, JSON.stringify({ privateJwk, publicRaw, alg: "P256-ECDSA" }, null, 2), { mode: 384 });
+  writeFileSync22(tmp, JSON.stringify({ privateJwk, publicRaw, alg: "P256-ECDSA" }, null, 2), { mode: 384 });
   renameSync8(tmp, identityPath());
   try {
     chmodSync3(identityPath(), 384);
@@ -84190,7 +84503,7 @@ async function loadOrCreateDeviceIdentity() {
 }
 var sealingCached = null;
 function sealingPath() {
-  return join45(daemonDir2(), "sealing.json");
+  return join47(daemonDir2(), "sealing.json");
 }
 var EC_DH = { name: "ECDH", namedCurve: "P-256" };
 async function loadOrCreateSealingKey() {
@@ -84198,7 +84511,7 @@ async function loadOrCreateSealingKey() {
     return sealingCached;
   const { subtle: subtle5 } = globalThis.crypto;
   try {
-    const stored = JSON.parse(readFileSync28(sealingPath(), "utf-8"));
+    const stored = JSON.parse(readFileSync30(sealingPath(), "utf-8"));
     if (stored?.privateJwk && stored.publicRaw) {
       const privateKey = await subtle5.importKey("jwk", stored.privateJwk, EC_DH, true, ["deriveBits"]);
       sealingCached = { privateKey, publicRaw: unb64u(stored.publicRaw) };
@@ -84210,10 +84523,10 @@ async function loadOrCreateSealingKey() {
   const publicRaw = new Uint8Array(await subtle5.exportKey("raw", kp.publicKey));
   const privateJwk = await subtle5.exportKey("jwk", kp.privateKey);
   const dir2 = daemonDir2();
-  if (!existsSync23(dir2))
+  if (!existsSync24(dir2))
     mkdirSync22(dir2, { recursive: true, mode: 448 });
   const tmp = `${sealingPath()}.tmp`;
-  writeFileSync20(tmp, JSON.stringify({ privateJwk, publicRaw: b64u(publicRaw), alg: "P256-ECDH" }, null, 2), { mode: 384 });
+  writeFileSync22(tmp, JSON.stringify({ privateJwk, publicRaw: b64u(publicRaw), alg: "P256-ECDH" }, null, 2), { mode: 384 });
   renameSync8(tmp, sealingPath());
   try {
     chmodSync3(sealingPath(), 384);
@@ -84276,10 +84589,10 @@ import { createSocket as createSocket2 } from "node:dgram";
 import { createRequire as createRequire4 } from "node:module";
 
 // ../../packages/host-core/dist/mesh/config.js
-import { chmodSync as chmodSync4, existsSync as existsSync24, mkdirSync as mkdirSync23, readFileSync as readFileSync29, rmSync as rmSync7, writeFileSync as writeFileSync21 } from "node:fs";
-import { join as join46 } from "node:path";
+import { chmodSync as chmodSync4, existsSync as existsSync25, mkdirSync as mkdirSync23, readFileSync as readFileSync31, rmSync as rmSync7, writeFileSync as writeFileSync23 } from "node:fs";
+import { join as join48 } from "node:path";
 function meshDir() {
-  return join46(daemonDir2(), "mesh");
+  return join48(daemonDir2(), "mesh");
 }
 var FILES = {
   genesis: "genesis.bin",
@@ -84288,9 +84601,9 @@ var FILES = {
   bundle: "bundle.bin"
 };
 function readIfPresent(name) {
-  const p = join46(meshDir(), name);
+  const p = join48(meshDir(), name);
   try {
-    return existsSync24(p) ? new Uint8Array(readFileSync29(p)) : void 0;
+    return existsSync25(p) ? new Uint8Array(readFileSync31(p)) : void 0;
   } catch {
     return void 0;
   }
@@ -84307,8 +84620,8 @@ function loadMeshIdentity() {
   return { genesis, cert, staticPrivate, ...bundle ? { bundle } : {} };
 }
 function writeSecret(name, bytes2) {
-  const p = join46(meshDir(), name);
-  writeFileSync21(p, bytes2, { mode: 384 });
+  const p = join48(meshDir(), name);
+  writeFileSync23(p, bytes2, { mode: 384 });
   try {
     chmodSync4(p, 384);
   } catch {
@@ -84320,21 +84633,21 @@ function saveMeshIdentity(id) {
     chmodSync4(meshDir(), 448);
   } catch {
   }
-  writeFileSync21(join46(meshDir(), FILES.genesis), id.genesis);
-  writeFileSync21(join46(meshDir(), FILES.cert), id.cert);
+  writeFileSync23(join48(meshDir(), FILES.genesis), id.genesis);
+  writeFileSync23(join48(meshDir(), FILES.cert), id.cert);
   writeSecret(FILES.key, id.staticPrivate);
   if (id.bundle)
-    writeFileSync21(join46(meshDir(), FILES.bundle), id.bundle);
+    writeFileSync23(join48(meshDir(), FILES.bundle), id.bundle);
 }
 var STATUS_REFRESH_MS = 5e3;
 var STATUS_STALE_MS = 2e4;
 function statusPath() {
-  return join46(meshDir(), "status.json");
+  return join48(meshDir(), "status.json");
 }
 function writeStatus(status2) {
   try {
     mkdirSync23(meshDir(), { recursive: true, mode: 448 });
-    writeFileSync21(statusPath(), JSON.stringify({ ...status2, at: Date.now() }, null, 2));
+    writeFileSync23(statusPath(), JSON.stringify({ ...status2, at: Date.now() }, null, 2));
   } catch {
   }
 }
@@ -84346,7 +84659,7 @@ function clearStatus() {
 }
 function readStatus() {
   try {
-    const raw = JSON.parse(readFileSync29(statusPath(), "utf8"));
+    const raw = JSON.parse(readFileSync31(statusPath(), "utf8"));
     if (typeof raw.at !== "number")
       return null;
     return { ...raw, at: raw.at, stale: Date.now() - raw.at > STATUS_STALE_MS };
@@ -84357,7 +84670,7 @@ function readStatus() {
 function cacheBundle(bundle) {
   try {
     mkdirSync23(meshDir(), { recursive: true, mode: 448 });
-    writeFileSync21(join46(meshDir(), FILES.bundle), bundle);
+    writeFileSync23(join48(meshDir(), FILES.bundle), bundle);
   } catch {
   }
 }
@@ -84970,7 +85283,7 @@ import { basename as basename11 } from "node:path";
 // ../../packages/host-core/dist/drops/paths.js
 init_base_paths();
 import { mkdir as mkdir11 } from "node:fs/promises";
-import { join as join47 } from "node:path";
+import { join as join49 } from "node:path";
 
 // ../../packages/host-core/dist/drops/names.js
 var WINDOWS_RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i;
@@ -85059,7 +85372,7 @@ function basenameOf(p) {
 function resolveDropsRoot() {
   const root = resolveHostRoot();
   const preferred = dropsDir();
-  return isInsideRoot(preferred, root) ? preferred : join47(root, "Drops");
+  return isInsideRoot(preferred, root) ? preferred : join49(root, "Drops");
 }
 async function ensureDropsRoot() {
   const dir2 = resolveDropsRoot();
@@ -85075,7 +85388,7 @@ async function ensureDropDir(opts) {
     parts.push(sanitizeDropName(opts.sender, "Unknown sender"));
   if (!opts.singleItem && opts.label)
     parts.push(sanitizeDropName(opts.label, "Files"));
-  const dir2 = join47(...parts);
+  const dir2 = join49(...parts);
   await mkdir11(dir2, { recursive: true });
   return dir2;
 }
@@ -85218,7 +85531,7 @@ function createDropHandler(deps) {
 // ../../packages/host-core/dist/drops/blob-fetch.js
 import { createWriteStream as createWriteStream2 } from "node:fs";
 import { mkdir as mkdir12, rm as rm4, chmod as chmod3 } from "node:fs/promises";
-import { dirname as dirname22, join as join48 } from "node:path";
+import { dirname as dirname22, join as join50 } from "node:path";
 import { Readable as Readable2 } from "node:stream";
 import { pipeline } from "node:stream/promises";
 
@@ -85390,7 +85703,7 @@ async function fetchBlobDrop(opts) {
         log7(`drop ${opts.dropId}: refusing directory "${item.rel}"`);
         continue;
       }
-      const abs = join48(opts.destDir, rel);
+      const abs = join50(opts.destDir, rel);
       if (!isInsideRoot(abs, opts.destDir)) {
         log7(`drop ${opts.dropId}: refusing directory outside the destination`);
         continue;
@@ -85411,7 +85724,7 @@ async function fetchBlobDrop(opts) {
         log7(`drop ${opts.dropId}: refusing "${item.rel}"`);
         continue;
       }
-      let abs = join48(opts.destDir, rel);
+      let abs = join50(opts.destDir, rel);
       if (!isInsideRoot(abs, opts.destDir)) {
         log7(`drop ${opts.dropId}: refusing a path outside the destination`);
         continue;
@@ -85654,7 +85967,7 @@ var VncEngine = class {
       const c = client;
       this.fbw = c.width ?? 1280;
       this.fbh = c.height ?? 800;
-      void this.pub?.startCanvas({ iceServers: [], forceRelay: this.ctx.forceRelay, quality: "auto", width: this.fbw, height: this.fbh, maxFps: 30 });
+      void this.pub?.startCanvas({ iceServers: [], quality: "auto", width: this.fbw, height: this.fbh, maxFps: 30 });
       client.requestUpdate?.(false, 0, 0, this.fbw, this.fbh);
     });
     client.on("rect", (rect) => {
@@ -85756,38 +86069,47 @@ function registerRdpEngine() {
 }
 
 // ../../packages/host-core/dist/rdesk/audit.js
-import { appendFileSync as appendFileSync2 } from "node:fs";
-import { join as join49 } from "node:path";
+import { appendFile, stat as stat7, rename as rename3 } from "node:fs/promises";
+import { join as join51 } from "node:path";
+var MAX_BYTES = 2 * 1024 * 1024;
 function rdeskAuditPath() {
-  return join49(daemonDir2(), "rdesk-audit.jsonl");
+  return join51(daemonDir2(), "rdesk-audit.jsonl");
 }
-function appendRdeskAudit(e) {
+var queue = [];
+var draining = false;
+async function rotateIfNeeded(path6) {
   try {
-    appendFileSync2(rdeskAuditPath(), JSON.stringify(e) + "\n", { mode: 384 });
+    const st = await stat7(path6);
+    if (st.size < MAX_BYTES)
+      return;
+    await rename3(path6, `${path6}.1`);
   } catch {
   }
 }
-
-// ../../packages/host-core/dist/rdesk/password.js
-import { scryptSync, randomBytes as randomBytes6, timingSafeEqual as timingSafeEqual5 } from "node:crypto";
-import { readFileSync as readFileSync30, writeFileSync as writeFileSync22, existsSync as existsSync25, unlinkSync as unlinkSync3 } from "node:fs";
-import { join as join50 } from "node:path";
-function pwFile() {
-  return join50(daemonDir2(), "rdesk-password.json");
+async function drain() {
+  if (draining)
+    return;
+  draining = true;
+  try {
+    while (queue.length) {
+      const batch = queue.join("");
+      queue = [];
+      const path6 = rdeskAuditPath();
+      await rotateIfNeeded(path6);
+      await appendFile(path6, batch, { mode: 384 });
+    }
+  } catch {
+  } finally {
+    draining = false;
+    if (queue.length)
+      void drain();
+  }
 }
-function verifyRdeskPassword(password) {
-  if (!password)
-    return false;
-  const override = process.env.CCB_RDESK_PASSWORD;
-  if (override)
-    return password.length === override.length && timingSafeEqual5(Buffer.from(password), Buffer.from(override));
+function appendRdeskAudit(e) {
   try {
-    const { salt, hash: hash2 } = JSON.parse(readFileSync30(pwFile(), "utf8"));
-    const got = scryptSync(password, Buffer.from(salt, "hex"), 32);
-    const want = Buffer.from(hash2, "hex");
-    return got.length === want.length && timingSafeEqual5(got, want);
+    queue.push(JSON.stringify(e) + "\n");
+    void drain();
   } catch {
-    return false;
   }
 }
 
@@ -85923,9 +86245,9 @@ function bindBridge(i, log9) {
 
 // ../../packages/host-core/dist/vault/autofill-bridge.js
 import { randomBytes as randomBytes7 } from "node:crypto";
-import { existsSync as existsSync26, mkdirSync as mkdirSync24, writeFileSync as writeFileSync23, rmSync as rmSync8 } from "node:fs";
+import { existsSync as existsSync26, mkdirSync as mkdirSync24, writeFileSync as writeFileSync24, rmSync as rmSync8 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join51 } from "node:path";
+import { join as join52 } from "node:path";
 
 // ../../packages/host-core/dist/vault/peer-verify.js
 import { execFile as execFile6 } from "node:child_process";
@@ -85987,10 +86309,10 @@ async function isTrustedAutofillPeer(remotePort) {
 var APPEX_BUNDLE_ID = "dev.tesseract.AutoFill";
 var BRIDGE_PORTS2 = [17872, 17873, 17874, 17875];
 function appexContainerData() {
-  return join51(homedir6(), "Library", "Containers", APPEX_BUNDLE_ID, "Data");
+  return join52(homedir6(), "Library", "Containers", APPEX_BUNDLE_ID, "Data");
 }
 function bridgeInfoPath() {
-  return join51(appexContainerData(), "Library", "Application Support", "tesseract-autofill-bridge.json");
+  return join52(appexContainerData(), "Library", "Application Support", "tesseract-autofill-bridge.json");
 }
 var infoLoggedOnce = false;
 function writeBridgeInfo(port, token3, log9) {
@@ -86005,9 +86327,9 @@ function writeBridgeInfo(port, token3, log9) {
       }
       return;
     }
-    const dir2 = join51(containerData, "Library", "Application Support");
+    const dir2 = join52(containerData, "Library", "Application Support");
     mkdirSync24(dir2, { recursive: true });
-    writeFileSync23(bridgeInfoPath(), JSON.stringify({ port, token: token3, pid: process.pid, ts: Date.now() }), { mode: 384 });
+    writeFileSync24(bridgeInfoPath(), JSON.stringify({ port, token: token3, pid: process.pid, ts: Date.now() }), { mode: 384 });
     if (!infoLoggedOnce) {
       infoLoggedOnce = true;
       log9("autofill bridge-info WROTE", port, "\u2192", dir2);
@@ -86163,7 +86485,7 @@ function startAutofillBridge(log9 = () => {
 }
 
 // ../../packages/host-core/dist/power-node.js
-import { spawn as spawn9 } from "node:child_process";
+import { spawn as spawn10 } from "node:child_process";
 import { platform } from "node:os";
 function createNodePowerController() {
   const active = /* @__PURE__ */ new Set();
@@ -86171,9 +86493,9 @@ function createNodePowerController() {
   function spawnInhibitor() {
     try {
       if (platform() === "darwin")
-        return spawn9("caffeinate", ["-i"], { stdio: "ignore" });
+        return spawn10("caffeinate", ["-i"], { stdio: "ignore" });
       if (platform() === "linux") {
-        return spawn9("systemd-inhibit", ["--what=sleep", "--why=tesseract agent running", "--mode=block", "sleep", "infinity"], { stdio: "ignore" });
+        return spawn10("systemd-inhibit", ["--what=sleep", "--why=tesseract agent running", "--mode=block", "sleep", "infinity"], { stdio: "ignore" });
       }
     } catch {
     }
@@ -86221,9 +86543,9 @@ function createNodePowerController() {
 
 // ../../packages/host-core/dist/native-host.js
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { chmodSync as chmodSync5, existsSync as existsSync27, mkdirSync as mkdirSync25, writeFileSync as writeFileSync24 } from "node:fs";
+import { chmodSync as chmodSync5, existsSync as existsSync27, mkdirSync as mkdirSync25, writeFileSync as writeFileSync25 } from "node:fs";
 import { homedir as homedir7, platform as platform2 } from "node:os";
-import { dirname as dirname23, join as join52, resolve as resolve10 } from "node:path";
+import { dirname as dirname23, join as join53, resolve as resolve10 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var HOST_NAME = "com.tesseract.companion";
 var EXTENSION_IDS = ["icpnghhpcmaonjckkpilpajblfehpplo", "giolfpookdhjfafcchaflhmigghaeffn"];
@@ -86232,18 +86554,18 @@ function browserProfileDirs() {
   const home = homedir7();
   const p = platform2();
   if (p === "darwin") {
-    const base = join52(home, "Library/Application Support");
-    return ["Google/Chrome", "Google/Chrome Beta", "Google/Chrome Dev", "Google/Chrome Canary", "Chromium", "Microsoft Edge", "BraveSoftware/Brave-Browser", "Vivaldi", "Arc"].map((b) => join52(base, b));
+    const base = join53(home, "Library/Application Support");
+    return ["Google/Chrome", "Google/Chrome Beta", "Google/Chrome Dev", "Google/Chrome Canary", "Chromium", "Microsoft Edge", "BraveSoftware/Brave-Browser", "Vivaldi", "Arc"].map((b) => join53(base, b));
   }
   if (p === "win32")
     return [];
-  const cfg2 = join52(home, ".config");
-  return ["google-chrome", "google-chrome-beta", "chromium", "microsoft-edge", "BraveSoftware/Brave-Browser", "vivaldi"].map((b) => join52(cfg2, b));
+  const cfg2 = join53(home, ".config");
+  return ["google-chrome", "google-chrome-beta", "chromium", "microsoft-edge", "BraveSoftware/Brave-Browser", "vivaldi"].map((b) => join53(cfg2, b));
 }
 function resolveBridge(log9) {
   const candidates = [
     process.env.CCB_COMPANION_HOST_JS,
-    process.resourcesPath ? join52(process.resourcesPath, "companion-host", BRIDGE_BASENAME) : void 0
+    process.resourcesPath ? join53(process.resourcesPath, "companion-host", BRIDGE_BASENAME) : void 0
   ];
   try {
     const here = dirname23(fileURLToPath3(import.meta.url));
@@ -86259,14 +86581,14 @@ function resolveBridge(log9) {
 }
 function writeLauncher(daemonDir3, bridge, runtime) {
   const isWin = platform2() === "win32";
-  const launcher = join52(daemonDir3, isWin ? "companion-host.cmd" : "companion-host.sh");
+  const launcher = join53(daemonDir3, isWin ? "companion-host.cmd" : "companion-host.sh");
   if (isWin) {
-    writeFileSync24(launcher, `@echo off\r
+    writeFileSync25(launcher, `@echo off\r
 set ELECTRON_RUN_AS_NODE=1\r
 "${runtime}" "${bridge}" %*\r
 `);
   } else {
-    writeFileSync24(launcher, `#!/bin/sh
+    writeFileSync25(launcher, `#!/bin/sh
 # Tesseract Companion native-messaging launcher (auto-written by the daemon).
 ELECTRON_RUN_AS_NODE=1 exec "${runtime}" "${bridge}" "$@"
 `);
@@ -86297,9 +86619,9 @@ function registerNativeHost(opts) {
       if (!existsSync27(profile))
         continue;
       try {
-        const dir2 = join52(profile, "NativeMessagingHosts");
+        const dir2 = join53(profile, "NativeMessagingHosts");
         mkdirSync25(dir2, { recursive: true });
-        writeFileSync24(join52(dir2, `${HOST_NAME}.json`), manifestJson);
+        writeFileSync25(join53(dir2, `${HOST_NAME}.json`), manifestJson);
         wrote++;
       } catch {
       }
@@ -86311,8 +86633,8 @@ function registerNativeHost(opts) {
 }
 function registerWindows(daemonDir3, manifestJson, log9) {
   try {
-    const manifestPath = join52(daemonDir3, `${HOST_NAME}.json`);
-    writeFileSync24(manifestPath, manifestJson);
+    const manifestPath = join53(daemonDir3, `${HOST_NAME}.json`);
+    writeFileSync25(manifestPath, manifestJson);
     for (const root of ["Software\\Google\\Chrome", "Software\\Microsoft\\Edge", "Software\\BraveSoftware\\Brave-Browser"]) {
       try {
         execFileSync3("reg", ["add", `HKCU\\${root}\\NativeMessagingHosts\\${HOST_NAME}`, "/ve", "/t", "REG_SZ", "/d", manifestPath, "/f"], { stdio: "ignore" });
@@ -86326,10 +86648,10 @@ function registerWindows(daemonDir3, manifestJson, log9) {
 }
 
 // ../../packages/host-core/dist/activity/activity-tracker.js
-import { promises as fsp, writeFileSync as writeFileSync25, mkdirSync as mkdirSync26, existsSync as existsSync28 } from "node:fs";
-import { join as join53 } from "node:path";
+import { promises as fsp, writeFileSync as writeFileSync26, mkdirSync as mkdirSync26, existsSync as existsSync28 } from "node:fs";
+import { join as join54 } from "node:path";
 function activityProfilePath() {
-  return join53(daemonDir2(), "activity-profile.json");
+  return join54(daemonDir2(), "activity-profile.json");
 }
 var MAX_APPS = 300;
 var MAX_AGE_DAYS = 120;
@@ -86441,7 +86763,7 @@ function createActivityTracker(opts = {}) {
           pruneProfile(profile);
           profile.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
           mkdirSync26(daemonDir2(), { recursive: true, mode: 448 });
-          writeFileSync25(activityProfilePath(), JSON.stringify(profile), { mode: 384 });
+          writeFileSync26(activityProfilePath(), JSON.stringify(profile), { mode: 384 });
           dirty = 0;
         }
       } catch (e) {
@@ -86455,9 +86777,6 @@ function createActivityTracker(opts = {}) {
   };
 }
 
-// ../../packages/host-core/dist/rdesk/server-auth.js
-var DEFAULT_API = (process.env.CCB_TESSERACT_API ?? "https://app.tesseract.dev").replace(/\/$/, "");
-
 // ../../packages/host-core/dist/gui/rdesk-client-window.js
 var win = null;
 function getRdeskClientWebContents() {
@@ -86475,46 +86794,7 @@ function getRdeskClientWebContents() {
 }
 
 // ../../packages/host-core/dist/gui/rdesk-call-window.js
-import { join as join54 } from "node:path";
 var win2 = null;
-function showRdeskCallWindow(opts) {
-  const el2 = electronModule();
-  if (!el2?.BrowserWindow)
-    return;
-  if (win2 && !win2.isDestroyed()) {
-    try {
-      win2.focus();
-    } catch {
-    }
-    return;
-  }
-  const w = new el2.BrowserWindow({
-    width: 380,
-    height: 320,
-    resizable: true,
-    minimizable: true,
-    fullscreenable: false,
-    alwaysOnTop: true,
-    skipTaskbar: false,
-    title: "Remote desktop \u2014 call",
-    backgroundColor: "#15151a",
-    webPreferences: { contextIsolation: true, sandbox: false }
-  });
-  try {
-    w.setAlwaysOnTop(true, "floating");
-  } catch {
-  }
-  w.on("closed", () => {
-    win2 = null;
-    try {
-      opts.onClosed?.();
-    } catch {
-    }
-  });
-  const loadFile = w.loadFile;
-  void loadFile(join54(daemonUiDir(), "rdesk-call.html"), { query: { url: opts.url, token: opts.token, room: opts.room } }).catch((e) => console.error("[rdesk-call] loadFile FAILED", e?.message ?? e));
-  win2 = w;
-}
 function closeRdeskCallWindow() {
   const w = win2;
   win2 = null;
@@ -86575,11 +86855,11 @@ async function runDaemon(opts = {}) {
     }
     for (let attempt = 0; attempt < 2; attempt++) {
       try {
-        writeFileSync26(f, String(process.pid), { flag: "wx" });
+        writeFileSync27(f, String(process.pid), { flag: "wx" });
         return true;
       } catch {
         try {
-          const prev = Number(readFileSync31(f, "utf-8").trim());
+          const prev = Number(readFileSync32(f, "utf-8").trim());
           if (!prev)
             return false;
           if (prev !== process.pid && isAlive2(prev))
@@ -86595,7 +86875,7 @@ async function runDaemon(opts = {}) {
   function releaseLock() {
     try {
       const f = pidfile();
-      if (existsSync29(f) && Number(readFileSync31(f, "utf-8").trim()) === process.pid)
+      if (existsSync29(f) && Number(readFileSync32(f, "utf-8").trim()) === process.pid)
         unlinkSync4(f);
     } catch {
     }
@@ -86640,11 +86920,11 @@ async function runDaemon(opts = {}) {
     let lockPid = 0, statusPid = 0;
     const otherPids = [];
     try {
-      lockPid = Number(readFileSync31(pidfile(), "utf-8").trim());
+      lockPid = Number(readFileSync32(pidfile(), "utf-8").trim());
     } catch {
     }
     try {
-      statusPid = Number(JSON.parse(readFileSync31(statusFile(), "utf-8")).pid ?? 0);
+      statusPid = Number(JSON.parse(readFileSync32(statusFile(), "utf-8")).pid ?? 0);
     } catch {
     }
     for (const p of otherDaemonPids())
@@ -86661,7 +86941,7 @@ async function runDaemon(opts = {}) {
   }
   function writeStatus2(s) {
     try {
-      writeFileSync26(statusFile(), JSON.stringify({ pid: process.pid, version: VERSION2, execPath: process.execPath, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), gui: daemonGuiTrayActive(), ...localInfo ?? {}, ...s }));
+      writeFileSync27(statusFile(), JSON.stringify({ pid: process.pid, version: VERSION2, execPath: process.execPath, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), gui: daemonGuiTrayActive(), ...localInfo ?? {}, ...s }));
       chmodSync6(statusFile(), 384);
     } catch {
     }
@@ -86675,7 +86955,7 @@ async function runDaemon(opts = {}) {
       }
       if (!acquireLock2()) {
         try {
-          writeFileSync26(pidfile(), String(process.pid));
+          writeFileSync27(pidfile(), String(process.pid));
         } catch {
         }
       }
@@ -86845,7 +87125,7 @@ async function runDaemon(opts = {}) {
     process.env.CCB_HOST_DAEMON = "1";
   const localToken = randomBytes8(24).toString("hex");
   try {
-    localServer = await startLocalServer({ hostRoot: resolveHostRoot(), token: localToken, log: log9, getRdesk: () => rdeskManager, loopbackRdeskSend });
+    localServer = await startLocalServer({ hostRoot: resolveHostRoot(), token: localToken, log: log9, getRdesk: () => rdeskManager, loopbackRdeskSend, getRdeskSessions: () => rdeskRef?.sessionInfos() ?? [] });
     localInfo = { localPort: localServer.port, localToken };
   } catch (e) {
     log9("local listener failed to start", e.message);
@@ -86975,7 +87255,7 @@ async function runDaemon(opts = {}) {
   let rdeskRef = null;
   const rdesk = new RdeskSessionManager({
     createEngine: createRemoteDesktopEngine,
-    consent: ({ viewerName }) => askRdeskConsent({ viewerName }),
+    consent: ({ viewerName, grant }) => askRdeskConsent({ viewerName, grant }),
     // Unattended-access password (Phase 4): a scrypt hash in daemon settings, opt-in.
     checkPassword: (pw) => verifyRdeskPassword(pw),
     // Route to the local viewer over loopback when this session's viewer connected via
@@ -86994,8 +87274,20 @@ async function runDaemon(opts = {}) {
       else
         relayRdeskSignal(msg, { clientId }, sessionId);
     },
-    canServe: () => daemonGuiTrayActive(),
-    defaultAccess: "view",
+    // Two independent conditions: the GUI/tray must be up (we need it to capture), AND the
+    // user must not have switched sharing off. Read FRESH so the Settings toggle applies to
+    // the next connect with no daemon restart. NOTE this is deliberately rdesk-scoped — the
+    // `sharing`/`driving` flag in control-link gates fs/term/agent TOGETHER, so turning
+    // screen sharing on must never be implemented there.
+    canServe: () => daemonGuiReady() && rdeskSharingEnabled(),
+    // Read per connect (not captured once) for the same reason.
+    defaultAccess: () => readRdeskServerPrefs().defaultAccess,
+    // Was persisted by the settings UI and then ignored — sessions always started at 'auto'.
+    defaultQuality: () => readRdeskServerPrefs().quality,
+    // Each viewer costs a capture+encode window; cap the count so a runaway or hostile
+    // client can't spawn them until the machine falls over. Override for a genuine
+    // multi-viewer use case (training/demo) once there's a setting for it.
+    maxSessions: Number(process.env.CCB_RDESK_MAX_SESSIONS ?? "3") || 3,
     // Phase 3 host control plane: append every lifecycle event to the audit log, and
     // reflect live sessions in the tray ("Sharing this screen — N viewers" + Stop all).
     audit: (e) => appendRdeskAudit(e),
@@ -87009,33 +87301,23 @@ async function runDaemon(opts = {}) {
     // joined to the SAME LiveKit room (= the rdesk sessionId) the viewer is in, so the person at the
     // host can talk. Reuses the team-chat/huddle conferencing; the daemon mints its own join token
     // with the device token (identity `${sub}#host`, distinct from the viewer's).
-    onCall: ({ sessionId, on }) => {
+    // Voice now rides the session's own peer connection (session-manager → engine.setAv),
+    // so the host no longer mints a LiveKit token or opens an SFU call window for rdesk.
+    // `onCall` is just the local surface: tell the person at this machine that the viewer
+    // switched voice on. LiveKit stays exactly as it is for team huddles, which are 3+ way
+    // and genuinely need an SFU.
+    onCall: ({ sessionId, on, viewerName }) => {
+      log9(`[rdesk call] ${viewerName ?? "viewer"} ${on ? "started" : "ended"} voice on ${sessionId}`);
       if (!on) {
         closeRdeskCallWindow();
         return;
       }
-      void (async () => {
-        try {
-          const r = await fetch(`${c.apiOrigin.replace(/\/$/, "")}/api/core/tesseract/conferencing/token`, {
-            method: "POST",
-            headers: { "content-type": "application/json", authorization: `Bearer ${accessToken}` },
-            body: JSON.stringify({ room: sessionId, identity: "host", name: hostname4() }),
-            signal: AbortSignal.timeout(1e4)
-          });
-          if (!r.ok) {
-            log9(`[rdesk call] token mint ${r.status} (conferencing configured?)`);
-            return;
-          }
-          const j = await r.json().catch(() => ({}));
-          if (!j.token || !j.url) {
-            log9("[rdesk call] token response missing token/url");
-            return;
-          }
-          showRdeskCallWindow({ url: j.url, token: j.token, room: sessionId });
-        } catch (e) {
-          log9("[rdesk call] token mint failed", e instanceof Error ? e.message : String(e));
-        }
-      })();
+      try {
+        const NotifCtor = electronModule()?.Notification;
+        if (NotifCtor)
+          new NotifCtor({ title: "Remote desktop", body: `${viewerName ?? "The viewer"} turned on voice.` }).show();
+      } catch {
+      }
     },
     // In-session chat from the viewer → surface it to the operator as a native notification.
     // On macOS the notification carries an inline REPLY box (hasReply) whose text is sent
@@ -87062,6 +87344,42 @@ async function runDaemon(opts = {}) {
     log: (m) => log9(m)
   });
   rdeskRef = rdesk;
+  try {
+    if (rdeskSharingEnabled()) {
+      const generated = ensureRdeskPassword();
+      const prefs = readRdeskServerPrefs();
+      if (generated && !prefs.noticeShownAt) {
+        const id = getMachinePublicId();
+        log9(`rdesk: generated an unattended password; this machine is reachable as ${id ?? "(id pending)"}`);
+        try {
+          const NotifCtor = electronModule()?.Notification;
+          if (NotifCtor) {
+            const n = new NotifCtor({
+              title: "Remote Desktop is on",
+              body: id ? `This machine can be reached with ID ${id} and its password. Open Settings to see it or turn it off.` : "This machine can be reached remotely. Open Settings to see its ID and password, or turn it off."
+            });
+            n.on("click", () => {
+              void openMainAppSettings();
+            });
+            n.show();
+          }
+        } catch {
+        }
+        writeRdeskServerPrefs({ noticeShownAt: Date.now() });
+      }
+    }
+  } catch (e) {
+    log9(`rdesk: password/notice setup failed: ${e instanceof Error ? e.message : e}`);
+  }
+  let rdeskWasEnabled = rdeskSharingEnabled();
+  setInterval(() => {
+    const on = rdeskSharingEnabled();
+    if (rdeskWasEnabled && !on) {
+      log9("rdesk: sharing turned off \u2014 disconnecting live sessions");
+      void rdeskRef?.disconnectAll("revoked");
+    }
+    rdeskWasEnabled = on;
+  }, 3e4).unref?.();
   rdeskManager = rdesk;
   const chatAgent = createChatAgentRunner({
     apiUrl: c.apiOrigin.replace(/\/$/, ""),
@@ -87104,7 +87422,7 @@ async function runDaemon(opts = {}) {
     // Remote-desktop host: a viewer drives an rdesk session on this machine.
     onRdesk: (payload, clientId, sessionId) => {
       if (rdesk && clientId)
-        void rdesk.onClientMessage(sessionId, { clientId, sameAccount: true }, payload);
+        void rdesk.onClientMessage(sessionId, { clientId }, payload);
     },
     onRdeskSignal: (payload, _clientId, sessionId) => {
       rdesk?.onSignal(sessionId, payload);
@@ -87112,6 +87430,27 @@ async function runDaemon(opts = {}) {
     // Standalone CLIENT (viewer) receive-side: forward the host's rdesk control events, WebRTC
     // SDP/ICE signals, and session events to the client window. No client window ⇒ no-op, so
     // the daemon-as-HOST path above is unchanged.
+    // Someone is asking to connect to this account's machines. The daemon can't run the
+    // approval UI, but it CAN say so — otherwise, with the app closed, the request reaches an
+    // online host that ignores it AND the push is suppressed for exactly that reason (the
+    // fan-out only pushes when nothing is online), so nobody ever hears about it.
+    onRdeskRequest: (m) => {
+      if (m?.type !== "rdesk:request")
+        return;
+      const who = typeof m.fromName === "string" ? m.fromName : "Someone";
+      log9(`[rdesk request] ${who} is asking to connect`);
+      try {
+        const NotifCtor = electronModule()?.Notification;
+        if (!NotifCtor)
+          return;
+        const n = new NotifCtor({ title: "Remote desktop request", body: `${who} wants to connect to your computer. Open Tesseract to answer.` });
+        n.on("click", () => {
+          void openMainApp();
+        });
+        n.show();
+      } catch {
+      }
+    },
     onSessionEvent: (msg) => {
       getRdeskClientWebContents()?.send("session:event", msg);
     },
@@ -87185,17 +87524,17 @@ var CHUNK_BYTES = 256 * 1024;
 import { platform as platform3 } from "node:os";
 
 // ../../packages/host-core/dist/service/launchd.js
-import { writeFileSync as writeFileSync27, existsSync as existsSync30, mkdirSync as mkdirSync28, unlinkSync as unlinkSync5 } from "node:fs";
+import { writeFileSync as writeFileSync28, existsSync as existsSync30, mkdirSync as mkdirSync28, unlinkSync as unlinkSync5 } from "node:fs";
 import { dirname as dirname24, join as join56 } from "node:path";
 import { homedir as homedir8, userInfo } from "node:os";
 
 // ../../packages/host-core/dist/service/exec.js
-import { execFile as execFile7, spawn as spawn10 } from "node:child_process";
+import { execFile as execFile7, spawn as spawn11 } from "node:child_process";
 import { promisify as promisify6 } from "node:util";
 var run3 = promisify6(execFile7);
 function runInherit(cmd, args) {
   return new Promise((resolve14) => {
-    const p = spawn10(cmd, args, { stdio: "inherit" });
+    const p = spawn11(cmd, args, { stdio: "inherit" });
     p.on("error", () => resolve14());
     p.on("close", () => resolve14());
   });
@@ -87261,7 +87600,7 @@ ${env}
       mkdirSync28(workDirOf(spec), { recursive: true });
       mkdirSync28(dirname24(plistPath()), { recursive: true });
       mkdirSync28(dirname24(spec.logPath), { recursive: true });
-      writeFileSync27(plistPath(), buildPlist(spec));
+      writeFileSync28(plistPath(), buildPlist(spec));
       await run3("launchctl", ["bootout", serviceTarget()]).catch(() => {
       });
       await run3("launchctl", ["bootstrap", domainTarget(), plistPath()]);
@@ -87311,7 +87650,7 @@ ${env}
 }
 
 // ../../packages/host-core/dist/service/systemd.js
-import { writeFileSync as writeFileSync28, existsSync as existsSync31, mkdirSync as mkdirSync29, unlinkSync as unlinkSync6 } from "node:fs";
+import { writeFileSync as writeFileSync29, existsSync as existsSync31, mkdirSync as mkdirSync29, unlinkSync as unlinkSync6 } from "node:fs";
 import { dirname as dirname25, join as join57 } from "node:path";
 import { homedir as homedir9, userInfo as userInfo2 } from "node:os";
 function unitVal(v) {
@@ -87354,7 +87693,7 @@ WantedBy=default.target
       mkdirSync29(workDirOf(spec), { recursive: true });
       mkdirSync29(dirname25(unitPath()), { recursive: true });
       mkdirSync29(dirname25(spec.logPath), { recursive: true });
-      writeFileSync28(unitPath(), buildUnit(spec));
+      writeFileSync29(unitPath(), buildUnit(spec));
       await run3("loginctl", ["enable-linger", userInfo2().username]).catch(() => {
       });
       await run3("systemctl", ["--user", "daemon-reload"]).catch(() => {
@@ -87397,7 +87736,7 @@ WantedBy=default.target
 }
 
 // ../../packages/host-core/dist/service/windows.js
-import { writeFileSync as writeFileSync29, existsSync as existsSync32, mkdirSync as mkdirSync30, unlinkSync as unlinkSync7 } from "node:fs";
+import { writeFileSync as writeFileSync30, existsSync as existsSync32, mkdirSync as mkdirSync30, unlinkSync as unlinkSync7 } from "node:fs";
 import { dirname as dirname26, join as join58 } from "node:path";
 function makeWindowsTask(instanceId) {
   const task = `Fineguide\\TesseractHost${instanceId ? `-${instanceId}` : ""}`;
@@ -87421,7 +87760,7 @@ start "" /b ${cmd} >> "${oneLine2(spec.logPath).replace(/"/g, "")}" 2>&1\r
       mkdirSync30(spec.workingDirectory ?? daemonDir2(), { recursive: true });
       mkdirSync30(dirname26(spec.logPath), { recursive: true });
       mkdirSync30(dirname26(wrapperPath()), { recursive: true });
-      writeFileSync29(wrapperPath(), buildWrapper(spec));
+      writeFileSync30(wrapperPath(), buildWrapper(spec));
       await run3("schtasks", ["/Create", "/TN", task, "/SC", "ONLOGON", "/RL", "LIMITED", "/F", "/TR", `"${wrapperPath()}"`]);
       await run3("schtasks", ["/Run", "/TN", task]).catch(() => {
       });
@@ -87709,7 +88048,7 @@ function whoami() {
 }
 
 // src/self-update.ts
-import { spawn as spawn11 } from "node:child_process";
+import { spawn as spawn12 } from "node:child_process";
 import { createPublicKey, verify as cryptoVerify } from "node:crypto";
 var RESTART_EXIT_CODE = 75;
 var REGISTRY_BASE = "https://registry.npmjs.org/tesseract-agent";
@@ -87784,7 +88123,7 @@ function installVersion(target) {
     log8(`installing tesseract-agent@${target} \u2026`);
     let child;
     try {
-      child = spawn11(npm, ["install", "-g", `tesseract-agent@${target}`], { stdio: ["ignore", "inherit", "inherit"] });
+      child = spawn12(npm, ["install", "-g", `tesseract-agent@${target}`], { stdio: ["ignore", "inherit", "inherit"] });
     } catch (e) {
       log8("npm spawn threw:", e instanceof Error ? e.message : String(e));
       resolve14(false);
@@ -87849,7 +88188,7 @@ function startSelfUpdater(current) {
 // src/service.ts
 import { join as join60 } from "node:path";
 import { platform as platform4 } from "node:os";
-import { existsSync as existsSync34, readFileSync as readFileSync32 } from "node:fs";
+import { existsSync as existsSync34, readFileSync as readFileSync33 } from "node:fs";
 function controller(instanceId) {
   const c = getServiceController(instanceId);
   if (!c) {
@@ -87877,7 +88216,7 @@ function runningDaemonInfo() {
   const lock = join60(daemonDir2(), "daemon.lock");
   try {
     if (!existsSync34(lock)) return null;
-    const pid = Number(readFileSync32(lock, "utf-8").trim());
+    const pid = Number(readFileSync33(lock, "utf-8").trim());
     if (!pid || !isAlive(pid)) return null;
     return { pid, device: readCredentials()?.deviceId };
   } catch {
@@ -87911,7 +88250,7 @@ async function logs(instanceId, follow) {
 }
 
 // src/net.ts
-import { readFileSync as readFileSync34 } from "node:fs";
+import { readFileSync as readFileSync35 } from "node:fs";
 import { resolve as resolve12 } from "node:path";
 function usage() {
   console.log(`Usage:
@@ -87934,7 +88273,7 @@ function readOrDie(label, p) {
     process.exit(1);
   }
   try {
-    return new Uint8Array(readFileSync34(resolve12(p)));
+    return new Uint8Array(readFileSync35(resolve12(p)));
   } catch (e) {
     console.error(`net enroll: could not read --${label} ${p}: ${e instanceof Error ? e.message : e}`);
     process.exit(1);
@@ -88037,7 +88376,7 @@ async function netCommand(rest, flags) {
 function pkgVersion() {
   try {
     const p = join63(dirname27(fileURLToPath4(import.meta.url)), "..", "package.json");
-    return JSON.parse(readFileSync35(p, "utf8")).version ?? "0.0.0";
+    return JSON.parse(readFileSync36(p, "utf8")).version ?? "0.0.0";
   } catch {
     return "0.0.0";
   }
@@ -88093,7 +88432,7 @@ async function superviseDaemon(cliEntry) {
   let stopping3 = false;
   let child = null;
   const spawnWorker = () => {
-    const c = spawn12(process.execPath, [cliEntry, "__worker"], { stdio: "inherit", env: process.env });
+    const c = spawn13(process.execPath, [cliEntry, "__worker"], { stdio: "inherit", env: process.env });
     child = c;
     let settled = false;
     const settle = (fn) => {
@@ -88242,7 +88581,7 @@ async function captureClaudeSubscription(flags) {
   console.log("Open the authorization URL in any browser; paste the returned code here if Claude asks for it.");
   try {
     const code = await new Promise((resolveCode, reject) => {
-      const child = spawn12(binary, args, {
+      const child = spawn13(binary, args, {
         env: { ...process.env, CLAUDE_CONFIG_DIR: home },
         stdio: "inherit"
       });
@@ -88251,7 +88590,7 @@ async function captureClaudeSubscription(flags) {
     });
     if (code !== 0) throw new Error(`Claude sign-in did not complete (exit ${code}).`);
     const file2 = join63(home, ".credentials.json");
-    if (existsSync36(file2)) return readFileSync35(file2, "utf8");
+    if (existsSync36(file2)) return readFileSync36(file2, "utf8");
     if (process.platform === "darwin") {
       const value = execFileSync5("security", [
         "find-generic-password",
@@ -88333,7 +88672,7 @@ async function runnerCommand(rest, flags) {
       process.exit(1);
     }
     const oauthFilePath = typeof flags["oauth-file"] === "string" ? resolve13(flags["oauth-file"]) : void 0;
-    const oauthAuthFile = oauthFilePath ? readFileSync35(oauthFilePath, "utf8") : void 0;
+    const oauthAuthFile = oauthFilePath ? readFileSync36(oauthFilePath, "utf8") : void 0;
     if (oauthAuthFile) {
       try {
         JSON.parse(oauthAuthFile);