tesseract-agent 0.9.32 → 0.9.33

package/dist-bundle/cli.js

@@ -64867,7 +64867,7 @@ function compareUtf8(a, b) {
 function canonicalStrs(items) {
   return [...new Set(items)].sort(compareUtf8);
 }
-var MeshCodecError, fail2, LIMITS, Writer, Reader;
+var MeshCodecError, fail, LIMITS, Writer, Reader;
 var init_codec = __esm({
   "../../packages/mesh-pki/dist/codec.js"() {
     "use strict";
@@ -64879,7 +64879,7 @@ var init_codec = __esm({
         this.reason = reason;
       }
     };
-    fail2 = (reason, detail) => {
+    fail = (reason, detail) => {
       throw new MeshCodecError(reason, detail);
     };
     LIMITS = {
@@ -64913,17 +64913,17 @@ var init_codec = __esm({
       }
       u8(v) {
         if (!Number.isInteger(v) || v < 0 || v > 255)
-          fail2("bad-value", `u8 ${v}`);
+          fail("bad-value", `u8 ${v}`);
         return this.#push(new Uint8Array([v]));
       }
       u16(v) {
         if (!Number.isInteger(v) || v < 0 || v > 65535)
-          fail2("bad-value", `u16 ${v}`);
+          fail("bad-value", `u16 ${v}`);
         return this.#push(new Uint8Array([v >>> 8 & 255, v & 255]));
       }
       u32(v) {
         if (!Number.isInteger(v) || v < 0 || v > 4294967295)
-          fail2("bad-value", `u32 ${v}`);
+          fail("bad-value", `u32 ${v}`);
         return this.#push(new Uint8Array([v >>> 24 & 255, v >>> 16 & 255, v >>> 8 & 255, v & 255]));
       }
       /** Milliseconds-since-epoch and similar. JS numbers are exact to 2^53, which is
@@ -64931,7 +64931,7 @@ var init_codec = __esm({
        *  than silently losing precision. */
       u64(v) {
         if (!Number.isInteger(v) || v < 0 || v > Number.MAX_SAFE_INTEGER)
-          fail2("bad-value", `u64 ${v}`);
+          fail("bad-value", `u64 ${v}`);
         const hi = Math.floor(v / 4294967296);
         const lo = v >>> 0;
         return this.u32(hi).u32(lo);
@@ -64939,13 +64939,13 @@ var init_codec = __esm({
       /** Fixed-width opaque bytes — no length prefix; the field's width is positional. */
       fixed(b, width) {
         if (b.length !== width)
-          fail2("bad-value", `fixed expected ${width} got ${b.length}`);
+          fail("bad-value", `fixed expected ${width} got ${b.length}`);
         return this.#push(b);
       }
       /** Length-prefixed opaque bytes. */
       bytes(b, max = LIMITS.STR) {
         if (b.length > max)
-          fail2("too-long", `bytes ${b.length} > ${max}`);
+          fail("too-long", `bytes ${b.length} > ${max}`);
         return this.u16(b.length).#push(b);
       }
       /** Length-prefixed UTF-8 string. */
@@ -64958,13 +64958,13 @@ var init_codec = __esm({
        */
       sortedStrs(items, max = LIMITS.VEC) {
         if (items.length > max)
-          fail2("too-long", `vec ${items.length} > ${max}`);
+          fail("too-long", `vec ${items.length} > ${max}`);
         for (let i = 1; i < items.length; i++) {
           const cmp = compareUtf8(items[i - 1], items[i]);
           if (cmp === 0)
-            fail2("duplicate", items[i]);
+            fail("duplicate", items[i]);
           if (cmp > 0)
-            fail2("not-sorted", `${items[i - 1]} > ${items[i]}`);
+            fail("not-sorted", `${items[i - 1]} > ${items[i]}`);
         }
         this.u16(items.length);
         for (const s of items)
@@ -64974,7 +64974,7 @@ var init_codec = __esm({
       /** A sequence whose order is meaningful (signatures, key lists). */
       vec(items, each, max = LIMITS.VEC) {
         if (items.length > max)
-          fail2("too-long", `vec ${items.length} > ${max}`);
+          fail("too-long", `vec ${items.length} > ${max}`);
         this.u16(items.length);
         for (const it of items)
           each(this, it);
@@ -65004,7 +65004,7 @@ var init_codec = __esm({
       }
       #need(n) {
         if (n < 0 || this.#o + n > this.#b.length) {
-          fail2("truncated", `need ${n} at ${this.#o}, have ${this.#b.length - this.#o}`);
+          fail("truncated", `need ${n} at ${this.#o}, have ${this.#b.length - this.#o}`);
         }
       }
       u8() {
@@ -65028,7 +65028,7 @@ var init_codec = __esm({
         const lo = this.u32();
         const v = hi * 4294967296 + lo;
         if (!Number.isSafeInteger(v))
-          fail2("bad-value", "u64 exceeds 2^53");
+          fail("bad-value", "u64 exceeds 2^53");
         return v;
       }
       fixed(width) {
@@ -65040,7 +65040,7 @@ var init_codec = __esm({
       bytes(max = LIMITS.STR) {
         const n = this.u16();
         if (n > max)
-          fail2("too-long", `bytes ${n} > ${max}`);
+          fail("too-long", `bytes ${n} > ${max}`);
         return this.fixed(n);
       }
       str(max = LIMITS.STR) {
@@ -65049,7 +65049,7 @@ var init_codec = __esm({
         try {
           s = new TextDecoder("utf-8", { fatal: true }).decode(raw);
         } catch {
-          return fail2("bad-utf8");
+          return fail("bad-utf8");
         }
         return s;
       }
@@ -65057,16 +65057,16 @@ var init_codec = __esm({
       sortedStrs(max = LIMITS.VEC) {
         const n = this.u16();
         if (n > max)
-          fail2("too-long", `vec ${n} > ${max}`);
+          fail("too-long", `vec ${n} > ${max}`);
         const out = [];
         for (let i = 0; i < n; i++) {
           const s = this.str();
           if (i > 0) {
             const cmp = compareUtf8(out[i - 1], s);
             if (cmp === 0)
-              fail2("duplicate", s);
+              fail("duplicate", s);
             if (cmp > 0)
-              fail2("not-sorted", `${out[i - 1]} > ${s}`);
+              fail("not-sorted", `${out[i - 1]} > ${s}`);
           }
           out.push(s);
         }
@@ -65075,7 +65075,7 @@ var init_codec = __esm({
       vec(each, max = LIMITS.VEC) {
         const n = this.u16();
         if (n > max)
-          fail2("too-long", `vec ${n} > ${max}`);
+          fail("too-long", `vec ${n} > ${max}`);
         const out = [];
         for (let i = 0; i < n; i++)
           out.push(each(this));
@@ -65084,7 +65084,7 @@ var init_codec = __esm({
       /** Assert the value consumed the whole buffer. Trailing bytes are an error. */
       finish() {
         if (this.#o !== this.#b.length) {
-          fail2("trailing", `${this.#b.length - this.#o} byte(s) after value`);
+          fail("trailing", `${this.#b.length - this.#o} byte(s) after value`);
         }
       }
     };
@@ -65473,18 +65473,18 @@ var init_blake2s = __esm({
 });
 
 // ../../packages/mesh-pki/dist/crypto.js
-function randomBytes9(n) {
+function randomBytes7(n) {
   return globalThis.crypto.getRandomValues(new Uint8Array(n));
 }
 async function generateSigningKey(extractable = true) {
-  const kp = await subtle4.generateKey(ED25519, extractable, ["sign", "verify"]);
-  const publicRaw = new Uint8Array(await subtle4.exportKey("raw", kp.publicKey));
+  const kp = await subtle3.generateKey(ED25519, extractable, ["sign", "verify"]);
+  const publicRaw = new Uint8Array(await subtle3.exportKey("raw", kp.publicKey));
   return { privateKey: kp.privateKey, publicRaw };
 }
 async function importSigningPublic(raw) {
   if (raw.length !== 32)
     throw new Error(`Ed25519 public key must be 32 bytes, got ${raw.length}`);
-  return subtle4.importKey("raw", bs4(raw), ED25519, true, ["verify"]);
+  return subtle3.importKey("raw", bs3(raw), ED25519, true, ["verify"]);
 }
 async function signingKeyFromSeed(seed) {
   if (seed.length !== 32)
@@ -65508,14 +65508,14 @@ async function signingKeyFromSeed(seed) {
     32
   ]);
   const pkcs8 = concat2(prefix, seed);
-  const privateKey = await subtle4.importKey("pkcs8", bs4(pkcs8), ED25519, true, ["sign"]);
-  const jwk = await subtle4.exportKey("jwk", privateKey);
+  const privateKey = await subtle3.importKey("pkcs8", bs3(pkcs8), ED25519, true, ["sign"]);
+  const jwk = await subtle3.exportKey("jwk", privateKey);
   if (typeof jwk.x !== "string")
     throw new Error("Ed25519 JWK missing x");
   return { privateKey, publicRaw: unb64u2(jwk.x) };
 }
 async function exportStaticPrivate(kp) {
-  const jwk = await subtle4.exportKey("jwk", kp.privateKey);
+  const jwk = await subtle3.exportKey("jwk", kp.privateKey);
   if (typeof jwk.d !== "string")
     throw new Error("X25519 JWK missing d");
   const raw = unb64u2(jwk.d);
@@ -65524,34 +65524,34 @@ async function exportStaticPrivate(kp) {
   return raw;
 }
 async function exportSigningPrivate(kp) {
-  return subtle4.exportKey("jwk", kp.privateKey);
+  return subtle3.exportKey("jwk", kp.privateKey);
 }
 async function importSigningPrivate(jwk) {
-  const privateKey = await subtle4.importKey("jwk", jwk, ED25519, true, ["sign"]);
+  const privateKey = await subtle3.importKey("jwk", jwk, ED25519, true, ["sign"]);
   if (typeof jwk.x !== "string")
     throw new Error("Ed25519 JWK missing x");
   return { privateKey, publicRaw: unb64u2(jwk.x) };
 }
 async function sign2(privateKey, message) {
-  return new Uint8Array(await subtle4.sign(ED25519, privateKey, bs4(message)));
+  return new Uint8Array(await subtle3.sign(ED25519, privateKey, bs3(message)));
 }
 async function verify2(publicRaw, message, sig) {
   if (sig.length !== 64 || publicRaw.length !== 32)
     return false;
   try {
     const key2 = await importSigningPublic(publicRaw);
-    return await subtle4.verify(ED25519, key2, bs4(sig), bs4(message));
+    return await subtle3.verify(ED25519, key2, bs3(sig), bs3(message));
   } catch {
     return false;
   }
 }
 async function generateStaticKey(extractable = true) {
-  const kp = await subtle4.generateKey(X25519, extractable, ["deriveBits"]);
-  const publicRaw = new Uint8Array(await subtle4.exportKey("raw", kp.publicKey));
+  const kp = await subtle3.generateKey(X25519, extractable, ["deriveBits"]);
+  const publicRaw = new Uint8Array(await subtle3.exportKey("raw", kp.publicKey));
   return { privateKey: kp.privateKey, publicRaw };
 }
 async function sha2562(bytes2) {
-  return new Uint8Array(await subtle4.digest("SHA-256", bs4(bytes2)));
+  return new Uint8Array(await subtle3.digest("SHA-256", bs3(bytes2)));
 }
 function blake2s256(bytes2) {
   return blake2s(bytes2, { dkLen: 32 });
@@ -65570,10 +65570,10 @@ function unb64u2(s) {
     out[i] = b.charCodeAt(i);
   return out;
 }
-function hex4(bytes2) {
+function hex3(bytes2) {
   return Array.from(bytes2, (b) => b.toString(16).padStart(2, "0")).join("");
 }
-function utf83(s) {
+function utf82(s) {
   return new TextEncoder().encode(s);
 }
 function concat2(...parts) {
@@ -65594,13 +65594,13 @@ function bytesEqual(a, b) {
     diff |= a[i] ^ b[i];
   return diff === 0;
 }
-var subtle4, bs4, ED25519, X25519;
+var subtle3, bs3, ED25519, X25519;
 var init_crypto = __esm({
   "../../packages/mesh-pki/dist/crypto.js"() {
     "use strict";
     init_blake2s();
-    subtle4 = globalThis.crypto.subtle;
-    bs4 = (b) => b;
+    subtle3 = globalThis.crypto.subtle;
+    bs3 = (b) => b;
     ED25519 = "Ed25519";
     X25519 = "X25519";
   }
@@ -65705,7 +65705,7 @@ async function genesisFingerprint(g) {
   return sha2562(encodeGenesis(g));
 }
 function fingerprintShort(fp, groups = 12) {
-  const h = hex4(fp.subarray(0, Math.min(fp.length, groups * 2)));
+  const h = hex3(fp.subarray(0, Math.min(fp.length, groups * 2)));
   return (h.match(/.{1,4}/g) ?? []).join(" ");
 }
 async function signGenesis(block2, signers) {
@@ -66066,8 +66066,8 @@ var init_addr = __esm({
     init_crypto();
     init_prefix();
     init_codec();
-    CTX_V6 = utf83("tsr-addr6-v1");
-    CTX_V4 = utf83("tsr-addr4-v1");
+    CTX_V6 = utf82("tsr-addr6-v1");
+    CTX_V4 = utf82("tsr-addr4-v1");
   }
 });
 
@@ -68642,7 +68642,7 @@ var init_sas = __esm({
     WORD_MASK = (1 << WORD_BITS) - 1;
     SAS_WORDS = 6;
     SAS_MIN_BITS = 64;
-    CTX_ENROLL = utf83("tsr-enroll-sas-v1");
+    CTX_ENROLL = utf82("tsr-enroll-sas-v1");
     if (wordlist.length !== 1 << WORD_BITS) {
       throw new Error(`BIP-39 wordlist must have ${1 << WORD_BITS} entries, got ${wordlist.length}`);
     }
@@ -69061,7 +69061,7 @@ function alphabet(letters) {
   };
 }
 // @__NO_SIDE_EFFECTS__
-function join70(separator = "") {
+function join61(separator = "") {
   astr("join", separator);
   return {
     encode: (from) => {
@@ -69266,7 +69266,7 @@ var init_esm = __esm({
       convertRadix2,
       radix,
       radix2,
-      join: join70,
+      join: join61,
       padding
     };
   }
@@ -69337,7 +69337,7 @@ function validateKdf2(k) {
     throw new MeshCodecError("bad-value", `unsupported KDF cost (m=${k.m} t=${k.t} p=${k.p})`);
 }
 function kdf(passphrase, salt, cost) {
-  return argon2id(utf83(passphrase.normalize("NFKC")), salt, { ...cost, dkLen: KEY_LEN });
+  return argon2id(utf82(passphrase.normalize("NFKC")), salt, { ...cost, dkLen: KEY_LEN });
 }
 function header(version2, label, kdfCost, salt, nonce2) {
   const w = new Writer();
@@ -69355,8 +69355,8 @@ async function sealCaKey(seed, passphrase, label = "mesh CA", cost = DEFAULT_KDF
   if (label.length > MAX_LABEL)
     throw new MeshCodecError("too-long", "label too long");
   validateKdf2(cost);
-  const salt = randomBytes9(SALT_LEN);
-  const nonce2 = randomBytes9(NONCE_LEN);
+  const salt = randomBytes7(SALT_LEN);
+  const nonce2 = randomBytes7(NONCE_LEN);
   const aad = header(RECOVERY_VERSION, label, cost, salt, nonce2);
   const key2 = await aesKey(kdf(passphrase, salt, cost));
   const ct = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv: nonce2, additionalData: aad }, key2, seed));
@@ -69412,7 +69412,7 @@ function caKeyFromMnemonic(mnemonic) {
   return mnemonicToEntropy(norm, wordlist);
 }
 async function newDisablement() {
-  const secret = randomBytes9(SECRET_LEN);
+  const secret = randomBytes7(SECRET_LEN);
   return { secret, hash: await sha2562(secret) };
 }
 async function verifyDisablement(secret, committedHash) {
@@ -69442,7 +69442,7 @@ var init_recovery = __esm({
     NONCE_LEN = 12;
     KEY_LEN = 32;
     MAX_LABEL = 128;
-    DOMAIN = utf83("tesseract-mesh-recovery-v1");
+    DOMAIN = utf82("tesseract-mesh-recovery-v1");
   }
 });
 
@@ -69452,7 +69452,7 @@ async function mintJoinTicket(opts) {
   const ttl = opts.ttlMs ?? DEFAULT_TICKET_TTL_MS;
   const details = {
     version: 1,
-    serial: randomBytes9(16),
+    serial: randomBytes7(16),
     genesisFp,
     nodeId: opts.nodeId,
     name: opts.name,
@@ -69516,7 +69516,7 @@ async function redeemJoinTicket(opts) {
   const genesisFp = await genesisFingerprint(ticket.genesis);
   const details = {
     version: 1,
-    serial: randomBytes9(16),
+    serial: randomBytes7(16),
     genesisFp,
     nodeId: opts.nodeId ?? ca.nodeId,
     name: opts.name ?? ca.name,
@@ -69661,7 +69661,7 @@ __export(dist_exports3, {
   generateSigningKey: () => generateSigningKey,
   generateStaticKey: () => generateStaticKey,
   genesisFingerprint: () => genesisFingerprint,
-  hex: () => hex4,
+  hex: () => hex3,
   importSigningPrivate: () => importSigningPrivate,
   importSigningPublic: () => importSigningPublic,
   isCa: () => isCa,
@@ -69690,7 +69690,7 @@ __export(dist_exports3, {
   prefixContains: () => prefixContains,
   prefixContainsAddr: () => prefixContainsAddr,
   prefixEqual: () => prefixEqual,
-  randomBytes: () => randomBytes9,
+  randomBytes: () => randomBytes7,
   readPrefix: () => readPrefix,
   readPrefixes: () => readPrefixes,
   readRule: () => readRule,
@@ -69706,7 +69706,7 @@ __export(dist_exports3, {
   signingKeyFromSeed: () => signingKeyFromSeed,
   u32ToAddr: () => u32ToAddr,
   unb64u: () => unb64u2,
-  utf8: () => utf83,
+  utf8: () => utf82,
   validateBundle: () => validateBundle,
   validateDetails: () => validateDetails,
   validateGenesis: () => validateGenesis,
@@ -70889,7 +70889,7 @@ async function netCaCommand(rest, flags) {
     if (pass.length < 12) die("Use a passphrase of at least 12 characters \u2014 this key issues every identity on the mesh.");
     const confirm2 = await readPassphrase("Confirm: ");
     if (pass !== confirm2) die("Passphrases did not match.");
-    const seed = randomBytes9(SEED_LEN);
+    const seed = randomBytes7(SEED_LEN);
     const ca = await signingKeyFromSeed(seed);
     const pol = ca;
     const disable = await newDisablement();
@@ -70906,10 +70906,10 @@ async function netCaCommand(rest, flags) {
     ensureDir(caDir);
     writeFileSync42(join76(caDir, "genesis.bin"), genesisBytes);
     writeSecretFile(join76(caDir, "ca.sealed"), encodeRecoveryBundle(await sealCaKey(seed, pass, `${org} mesh CA`)));
-    writeSecretFile(join76(caDir, "disablement.secret"), hex4(disable.secret));
+    writeSecretFile(join76(caDir, "disablement.secret"), hex3(disable.secret));
     console.log(`
 Mesh created for "${org}".`);
-    console.log(`  fingerprint: ${hex4(fp)}`);
+    console.log(`  fingerprint: ${hex3(fp)}`);
     console.log(`  CA directory: ${caDir}`);
     console.log("\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
     console.log("WRITE THESE DOWN NOW. They are not shown again.\n");
@@ -70918,7 +70918,7 @@ Mesh created for "${org}".`);
 `);
     console.log("Disablement secret (last resort if the CA AND the mnemonic are gone \u2014");
     console.log("it drops every node back to relay-trusted mode, permanently):");
-    console.log(`  ${hex4(disable.secret)}`);
+    console.log(`  ${hex3(disable.secret)}`);
     console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
     console.log(`
 A copy of the disablement secret is in ${join76(caDir, "disablement.secret")}.`);
@@ -70954,7 +70954,7 @@ Next, issue an identity for a machine (pick a free address in ${formatPrefix(gen
     const cert = await issueCert(
       {
         version: 1,
-        serial: randomBytes9(16),
+        serial: randomBytes7(16),
         genesisFp: fp,
         nodeId: name,
         name,
@@ -92628,6 +92628,15 @@ function ownHostId() {
   const mine = serverHosts.find((h) => h.hostId.endsWith(`:${deviceId}`));
   return mine?.hostId ?? "local";
 }
+var lastOwnHostLog = null;
+function logOwnHostVerdict() {
+  const own2 = ownHostId();
+  const verdict = own2 === "local" ? `NOT REGISTERED \u2014 the account lists ${serverHosts.length} host(s), none matching this deviceId=${deviceId.slice(0, 8)}; this machine is invisible to every client` : `registered as ${own2}`;
+  if (verdict === lastOwnHostLog)
+    return;
+  lastOwnHostLog = verdict;
+  console.log(`[control-link] own host: ${verdict}`);
+}
 function presentedHosts() {
   const out = serverHosts.slice();
   if (!out.some((h) => h.hostId.endsWith(`:${deviceId}`))) {
@@ -93428,6 +93437,8 @@ function handleHostChannel(payload) {
     entitlementDenied = true;
     stopHeartbeat();
     const message = typeof payload.message === "string" ? payload.message : "Running agents on your own machines requires a paid plan.";
+    const d = payload;
+    console.log(`[control-link] host:register DENIED reason=${String(d.reason ?? "?")} feature=${String(d.feature ?? "?")} limit=${String(d.limit ?? "?")} \u2014 ${message}`);
     hooks?.notify({ type: "notify", level: "warning", message });
     scheduleEntitlementRetry();
     return;
@@ -93451,6 +93462,7 @@ function handleHostChannel(payload) {
         setActiveLinkPeerOnline(l.linkId, true);
   }
   assertServerSelection();
+  logOwnHostVerdict();
   hooks?.ownHostResolved(ownHostId());
   hooks?.pushHosts(presentedHosts());
   resumeActiveLinks();
@@ -93472,6 +93484,7 @@ function registerAsHost() {
   const upAdvert = upscaleAdvert();
   if (upAdvert.gpu)
     caps.push("gpu");
+  console.log(`[control-link] host:register \u2192 deviceId=${deviceId.slice(0, 8)} machineId=${getMachinePublicId() ?? "none"} kind=${kind ?? "electron"} caps=${caps.join(",")}`);
   send3("host", { type: "host:register", name, platform: process.platform, deviceId, publicMachineId: getMachinePublicId(), caps, ...kind ? { kind } : {}, ...staticMetrics(hostVersion), gpu: upAdvert.gpu, upscaleModels: upAdvert.upscaleModels, ...p2pAdvert ?? {} });
   if (!heartbeat)
     heartbeat = setInterval(() => send3("host", { type: "host:heartbeat", ...dynamicMetrics() }), 2e4);
@@ -93793,7 +93806,7 @@ function connect() {
       } else if (rdSession && typeof p?.type === "string" && p.type.startsWith("rdesk:")) {
         if (inbound) {
           if (driving)
-            hooks?.onRdesk?.(env.payload, clientId, rdSession);
+            hooks?.onRdesk?.(env.payload, clientId, rdSession, env.viewerOwner === true);
         } else
           hooks?.deliverRdesk?.(env.payload, typeof env.hostId === "string" ? env.hostId : void 0, rdSession);
       }
@@ -93806,7 +93819,7 @@ function connect() {
         return;
       if (inbound) {
         if (driving)
-          hooks?.onRdesk?.(p, clientId, sessionId);
+          hooks?.onRdesk?.(p, clientId, sessionId, env.viewerOwner === true);
         return;
       }
       hooks?.deliverRdesk?.(p, typeof env.hostId === "string" ? env.hostId : void 0, sessionId);
@@ -94038,6 +94051,32 @@ var RdeskSessionManager = class {
       return 0;
     return Math.min(PW_BACKOFF_BASE_MS * 2 ** (over - 1), PW_BACKOFF_MAX_MS);
   }
+  /** Tell the viewer that this host is (or is again) producing a picture.
+   *
+   *  Sent by the HOST because only the host can know why: the OS reports a muted or ended
+   *  capture track as a fact, whereas a viewer sees an absence of frames and cannot tell a
+   *  slept display from a slow link from a genuinely black screen. Audited too, so "it just
+   *  showed black" is answerable after the fact. */
+  reportCapture(sessionId, clientId, ok, message) {
+    this.log(`capture ${ok ? "restored" : `lost \u2014 ${message}`} sessionId=${sessionId}`);
+    this.audit({ event: "capture", sessionId, detail: ok ? "ok" : message });
+    this.deps.sendControl(sessionId, clientId, { type: "rdesk:capture", ok, ...message ? { message } : {} });
+  }
+  /** Record which path a session's media actually took, once ICE has settled.
+   *
+   *  Media is direct-first (no relay pinning); TURN exists only as a last resort for NATs
+   *  that never punch through. That makes relay usage a COST we pay, so it is written to
+   *  the audit trail rather than only logged — `path` events in rdesk-audit.jsonl answer
+   *  "what fraction of sessions actually relayed?" without grepping daemon logs. Candidate
+   *  types only: an audit file is not the place for peer addresses. */
+  recordPath(sessionId, viewerUserId, path6, d) {
+    this.audit({
+      event: "path",
+      sessionId,
+      viewerUserId,
+      detail: `${path6} local=${d.localType ?? "?"} remote=${d.remoteType ?? "?"}`
+    });
+  }
   audit(e) {
     this.deps.audit?.({ at: this.now(), ...e });
   }
@@ -94062,10 +94101,10 @@ var RdeskSessionManager = class {
     const viewer = viewerIn.name || !declared ? viewerIn : { ...viewerIn, name: declared };
     const grant0 = grantOf(msg);
     this.audit({ event: "connect", sessionId, viewerUserId: viewer.userId, viewerName: viewer.name, grant: grant0 });
-    const deny = (reason) => {
-      this.log(`connect denied sessionId=${sessionId} reason=${reason}`);
-      this.audit({ event: "deny", sessionId, viewerUserId: viewer.userId, grant: grant0, detail: reason });
-      this.deps.sendControl(sessionId, viewer.clientId, { type: "rdesk:denied", reason });
+    const deny = (reason, message) => {
+      this.log(`connect denied sessionId=${sessionId} reason=${reason}${message ? ` \u2014 ${message}` : ""}`);
+      this.audit({ event: "deny", sessionId, viewerUserId: viewer.userId, grant: grant0, detail: message ? `${reason}: ${message}` : reason });
+      this.deps.sendControl(sessionId, viewer.clientId, { type: "rdesk:denied", reason, ...message ? { message } : {} });
     };
     if (!this.deps.canServe())
       return deny("entitlement");
@@ -94083,6 +94122,10 @@ var RdeskSessionManager = class {
       return deny("busy");
     }
     const grant = grantOf(msg);
+    if (grant === "registry" && viewer.sameAccount !== true) {
+      this.log(`connect denied sessionId=${sessionId} \u2014 'registry' claimed by a viewer the relay does not consider the owner`);
+      return deny("consent");
+    }
     if (grant === "password") {
       if (this.now() < this.pwLockedUntil) {
         this.log(`password attempt refused \u2014 locked for ${Math.ceil((this.pwLockedUntil - this.now()) / 1e3)}s`);
@@ -94123,7 +94166,9 @@ var RdeskSessionManager = class {
       sendControl: (m) => this.deps.sendControl(sessionId, viewer.clientId, m),
       sendData: (_m) => {
       },
-      log: (m) => this.log(`${sessionId}: ${m}`)
+      log: (m) => this.log(`${sessionId}: ${m}`),
+      onPath: (path6, d) => this.recordPath(sessionId, viewer.userId, path6, d),
+      onCapture: (ok, message) => this.reportCapture(sessionId, viewer.clientId, ok, message)
     };
     let engine;
     try {
@@ -94134,7 +94179,7 @@ var RdeskSessionManager = class {
       const err2 = e instanceof Error ? e.message : String(e);
       this.log(`engine start failed sessionId=${sessionId}: ${err2}`);
       this.deps.onCaptureBlocked?.({ sessionId, viewerName: viewer.name, error: err2 });
-      return deny("offline");
+      return deny("offline", err2);
     }
     const monitors = await engine.listMonitors().catch(() => []);
     const sources = await engine.listSources?.().catch(() => []) ?? [];
@@ -94203,7 +94248,9 @@ var RdeskSessionManager = class {
       sendControl: (m) => this.deps.sendControl(s.sessionId, s.viewer.clientId, m),
       sendData: () => {
       },
-      log: (m) => this.log(`${s.sessionId}: ${m}`)
+      log: (m) => this.log(`${s.sessionId}: ${m}`),
+      onPath: (path6, d) => this.recordPath(s.sessionId, s.viewer.userId, path6, d),
+      onCapture: (ok, message) => this.reportCapture(s.sessionId, s.viewer.clientId, ok, message)
     };
     try {
       s.engine = await this.deps.createEngine("tesseract", ctx2);
@@ -94378,6 +94425,93 @@ var RdeskSessionManager = class {
   }
 };
 
+// ../../packages/host-core/dist/daemon-identity-reload.js
+var reload = null;
+function setDaemonIdentityReload(fn) {
+  reload = fn;
+}
+function nextDaemonIdentity(fresh, current) {
+  if (!fresh?.accessToken)
+    return { kind: "machine" };
+  if (fresh.accessToken === current.accessToken && (fresh.userId ?? "") === current.userId)
+    return { kind: "unchanged" };
+  return { kind: "account" };
+}
+
+// ../../packages/host-core/dist/rdesk/screen-permission.js
+function screenRecordingStatus() {
+  if (process.platform !== "darwin")
+    return "unsupported";
+  try {
+    const sp = electronModule()?.systemPreferences;
+    const s = sp?.getMediaAccessStatus("screen");
+    if (s === "granted" || s === "denied" || s === "restricted" || s === "not-determined")
+      return s;
+    return "not-determined";
+  } catch {
+    return "not-determined";
+  }
+}
+function canCaptureScreen() {
+  const s = screenRecordingStatus();
+  return s === "granted" || s === "unsupported";
+}
+async function registerForScreenRecording() {
+  try {
+    const dc = electronModule()?.desktopCapturer;
+    await dc?.getSources({ types: ["screen"], thumbnailSize: { width: 1, height: 1 } });
+  } catch {
+  }
+}
+async function openScreenRecordingSettings() {
+  if (process.platform !== "darwin")
+    return;
+  await registerForScreenRecording();
+  try {
+    const shell = electronModule()?.shell;
+    await shell?.openExternal("x-apple.systempreferences:com.apple.preference.security?Privacy_ScreenCapture");
+  } catch {
+  }
+}
+var PROMPT_COOLDOWN_MS = 6e4;
+var lastPromptAt = 0;
+async function promptForScreenRecording(opts = {}) {
+  if (process.platform !== "darwin")
+    return false;
+  if (screenRecordingStatus() === "granted") {
+    opts.log?.("capture failed although Screen Recording IS granted \u2014 the capture stack is wedged (seen after a GPU-process crash); restarting Tesseract clears it");
+    return false;
+  }
+  const now2 = Date.now();
+  if (now2 - lastPromptAt < PROMPT_COOLDOWN_MS)
+    return false;
+  lastPromptAt = now2;
+  const el2 = electronModule();
+  const who = opts.viewerName ? `${opts.viewerName} is` : "Someone is";
+  opts.log?.(`screen recording not granted \u2014 prompting (${who} waiting)`);
+  if (!el2?.dialog) {
+    opts.log?.("no GUI to prompt with \u2014 grant Screen Recording in System Settings \u2192 Privacy & Security");
+    return false;
+  }
+  try {
+    const { response } = await el2.dialog.showMessageBox({
+      type: "warning",
+      buttons: ["Open System Settings", "Not Now"],
+      defaultId: 0,
+      cancelId: 1,
+      message: "Allow screen sharing on this Mac?",
+      detail: `${who} trying to connect to this computer, but macOS is blocking screen capture.
+
+Open System Settings \u2192 Privacy & Security \u2192 Screen Recording and switch on Tesseract Remote Desktop, then ask them to connect again.`
+    });
+    if (response === 0)
+      await openScreenRecordingSettings();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // ../../packages/host-core/dist/rdesk/publisher-window.js
 import { join as join54 } from "node:path";
 var windows = /* @__PURE__ */ new Map();
@@ -94415,6 +94549,7 @@ function ensureIpc() {
   el2.ipcMain.on("rdesk:pub:ready", (_e, p) => route2(p, (w) => w.handlers.onReady()));
   el2.ipcMain.on("rdesk:pub:error", (_e, p) => route2(p, (w, x) => w.handlers.onError(String(x.error ?? "publisher error"))));
   el2.ipcMain.on("rdesk:pub:path", (_e, p) => route2(p, (w, x) => w.handlers.onPath?.(String(x.path ?? "unknown"), { localType: x.localType ?? null, remoteType: x.remoteType ?? null })));
+  el2.ipcMain.on("rdesk:pub:capture", (_e, p) => route2(p, (w, x) => w.handlers.onCapture?.(x.ok !== false, String(x.message ?? ""))));
   el2.ipcMain.on("rdesk:pub:stopped", (_e, p) => route2(p, (w) => w.onStoppedAck()));
 }
 async function listPublisherMonitors() {
@@ -94461,21 +94596,41 @@ function displayBoundsById(monitorId) {
   const d = el2.screen.getAllDisplays().find((x) => String(x.id) === monitorId) ?? el2.screen.getPrimaryDisplay();
   return d ? { x: d.bounds.x, y: d.bounds.y, width: d.bounds.width, height: d.bounds.height } : null;
 }
-async function sourceIdForMonitor(monitorId) {
+async function wakeDisplay(log9) {
+  if (process.platform !== "darwin")
+    return;
+  try {
+    const { spawn: spawn17 } = await import("node:child_process");
+    spawn17("caffeinate", ["-u", "-t", "5"], { detached: true, stdio: "ignore" }).unref();
+    log9?.("display was asleep \u2014 declared user activity to wake it");
+    await new Promise((r) => setTimeout(r, 1200));
+  } catch {
+  }
+}
+async function sourceIdForMonitor(monitorId, log9) {
   const el2 = electronModule();
   if (!el2?.desktopCapturer || !el2.screen)
     throw new Error("Screen capture unavailable (Electron desktopCapturer/screen missing).");
   const display = el2.screen.getAllDisplays().find((d) => String(d.id) === monitorId) ?? el2.screen.getPrimaryDisplay();
-  const sources = await el2.desktopCapturer.getSources({ types: ["screen"], thumbnailSize: { width: 1, height: 1 } });
+  const list = async () => el2.desktopCapturer.getSources({ types: ["screen"], thumbnailSize: { width: 1, height: 1 } });
+  let sources = await list();
+  if (sources.length === 0) {
+    await wakeDisplay(log9);
+    sources = await list();
+  }
   const match = sources.find((s) => s.display_id === String(display.id)) ?? sources[0];
-  if (!match)
-    throw new Error("Screen capture failed: no screen source (grant Screen Recording permission).");
+  if (!match) {
+    const denied = !canCaptureScreen();
+    throw new Error(denied ? "Screen capture failed: Screen Recording permission is not granted to this app." : "Screen capture failed: no screen source. Screen Recording IS granted, so this is usually a display that stayed asleep, or a Mac with no active display attached.");
+  }
   return match.id;
 }
 var PublisherWindow = class {
   sessionId;
   handlers;
   win = null;
+  /** powerSaveBlocker id held for the life of the session — see startDisplayHold(). */
+  displayHold = null;
   stopAck = null;
   constructor(sessionId, handlers) {
     this.sessionId = sessionId;
@@ -94493,6 +94648,7 @@ var PublisherWindow = class {
     if (!el2?.BrowserWindow)
       throw new Error("Publisher requires the daemon GUI shell (no BrowserWindow).");
     ensureIpc();
+    this.startDisplayHold();
     const sourceId = opts.sourceId ?? await sourceIdForMonitor(opts.monitorId ?? await this.primaryMonitorId());
     const win3 = new el2.BrowserWindow({
       width: 320,
@@ -94606,7 +94762,36 @@ var PublisherWindow = class {
       maxFps: opts.maxFps
     });
   }
+  /** Hold the display awake for as long as this session lives.
+   *
+   *  Waking it once at start is not enough: the idle timer keeps running, so an unattended
+   *  host would go dark again a few minutes into a session and capture would die with the
+   *  same empty source list it started with. Released in stop() — never leaked, or the host
+   *  can never sleep again. */
+  startDisplayHold() {
+    if (this.displayHold !== null)
+      return;
+    try {
+      const psb = electronModule()?.powerSaveBlocker;
+      if (psb)
+        this.displayHold = psb.start("prevent-display-sleep");
+    } catch {
+    }
+  }
+  releaseDisplayHold() {
+    const id = this.displayHold;
+    this.displayHold = null;
+    if (id === null)
+      return;
+    try {
+      const psb = electronModule()?.powerSaveBlocker;
+      if (psb?.isStarted(id))
+        psb.stop(id);
+    } catch {
+    }
+  }
   async stop() {
+    this.releaseDisplayHold();
     const w = this.win;
     this.win = null;
     if (!w || w.isDestroyed()) {
@@ -94968,10 +95153,20 @@ var TesseractEngine = class {
         }
       },
       onReady: () => this.ctx.log("publisher connected"),
-      onError: (err2) => this.ctx.log(`publisher error: ${err2}`),
+      onError: (err2) => {
+        this.ctx.log(`publisher error: ${err2}`);
+        this.ctx.sendControl({ type: "rdesk:closed", reason: "network" });
+      },
       // Media is direct-first; log which path actually won so a regression to relay
       // (which costs real bandwidth) is visible instead of silent. Types only, no IPs.
-      onPath: (path6, d) => this.ctx.log(`media path=${path6} (local=${d.localType ?? "?"} remote=${d.remoteType ?? "?"})`)
+      onCapture: (ok, message) => {
+        this.ctx.log(`capture ${ok ? "ok" : `LOST \u2014 ${message}`}`);
+        this.ctx.onCapture?.(ok, message);
+      },
+      onPath: (path6, d) => {
+        this.ctx.log(`media path=${path6} (local=${d.localType ?? "?"} remote=${d.remoteType ?? "?"})`);
+        this.ctx.onPath?.(path6, d);
+      }
     });
     this.pub = pub;
     await pub.start({
@@ -97440,7 +97635,7 @@ async function startLocalServer(opts) {
           const rd = opts.getRdesk?.();
           if (rd && env.sessionId) {
             rdeskSessions.add(env.sessionId);
-            void rd.onClientMessage(env.sessionId, { clientId: loopbackOrigin, name: "This device" }, env.payload);
+            void rd.onClientMessage(env.sessionId, { clientId: loopbackOrigin, name: "This device", sameAccount: true }, env.payload);
           }
         }
       } else if (env.channel === "signal") {
@@ -98025,8 +98220,8 @@ async function startLocalServer(opts) {
 init_base_paths();
 import { readFileSync as readFileSync45, writeFileSync as writeFileSync38, existsSync as existsSync35, mkdirSync as mkdirSync37, unlinkSync as unlinkSync6, chmodSync as chmodSync7, statSync as statSync9 } from "node:fs";
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { join as join69 } from "node:path";
-import { randomBytes as randomBytes8 } from "node:crypto";
+import { join as join70 } from "node:path";
+import { randomBytes as randomBytes10 } from "node:crypto";
 import { hostname as hostname5 } from "node:os";
 
 // ../../packages/shared/dist/daemon-registry.js
@@ -98855,9 +99050,54 @@ var MeshNode = class {
   #relayed = /* @__PURE__ */ new Set();
   /** staticPub hex → the Buffer, so events can be matched back to a peer. */
   #peers = /* @__PURE__ */ new Map();
+  /**
+   * Peers whose CERTIFICATE says they are this network's way out, by display name.
+   *
+   * A hint for the UI, never an authorisation: the engine checks the same signed bit per
+   * packet, alongside our own selection and a bundle capability. This exists so a person
+   * can be offered a choice that has somewhere to go.
+   */
+  #exitNodes = /* @__PURE__ */ new Map();
   #lan = null;
   #offRejoin = null;
   #statusTimer = null;
+  /**
+   * Route this machine's non-mesh traffic through the network's exit node, or stop.
+   *
+   * GATE 1 OF THREE, and the only one that lives on this machine. `Engine::exit_allowed`
+   * additionally requires that the CA marked the peer's certificate and that the signed
+   * bundle grants CAP_EXIT_NODE, both checked per packet — so selecting a peer widens
+   * nothing by itself, and selecting one that turns out not to qualify simply drops the
+   * traffic rather than misrouting it.
+   *
+   * Without this call netd installs the routes and the engine refuses every packet that
+   * arrives on them: a machine with its default route captured and nothing carrying it,
+   * which is the worst of both states.
+   *
+   * Returns the name selected, or null when there is nobody to select.
+   */
+  useExitNode(on) {
+    const engine = this.#engine;
+    if (!engine)
+      return null;
+    if (!on) {
+      try {
+        engine.setExitNode?.(null);
+      } catch {
+      }
+      return null;
+    }
+    const first = [...this.#exitNodes.entries()][0];
+    if (first === void 0)
+      return null;
+    const [hex6, name] = first;
+    try {
+      engine.setExitNode?.(Buffer.from(hex6, "hex"));
+    } catch {
+      return null;
+    }
+    return name;
+  }
   status() {
     return {
       available: meshCore.available,
@@ -98869,6 +99109,14 @@ var MeshNode = class {
       peers: this.#engine?.peerCount() ?? 0,
       established: [...this.#established],
       relayed: [...this.#relayed],
+      exitNodes: [...this.#exitNodes.values()],
+      // Derived from the SAME sets the peer list is: an exit node with no established
+      // session is one that cannot carry traffic yet, and saying "waiting" is different
+      // from saying "none". Keyed by name so a caller never has to hold a key to read it.
+      exitPaths: Object.fromEntries([...this.#exitNodes.entries()].map(([hex6, name]) => [
+        name,
+        this.#established.has(hex6) ? this.#relayed.has(hex6) ? "relay" : "direct" : "none"
+      ])),
       meter: this.#engine?.meter() ?? null,
       lastError: this.#lastError,
       // Surfaced so `net status` can say "removed" rather than "not running". Those look
@@ -99137,6 +99385,8 @@ var MeshNode = class {
         }
         case "mesh:gone": {
           const pk = Buffer.from(m.staticPub, "base64");
+          if (pk.length === 32)
+            this.#exitNodes.delete(pk.toString("hex"));
           if (pk.length === 32) {
             const hex6 = pk.toString("hex");
             this.#peers.delete(hex6);
@@ -99166,6 +99416,18 @@ var MeshNode = class {
     if (pk.length !== 32)
       return;
     const hex6 = pk.toString("hex");
+    if (p.cert) {
+      try {
+        const bytes2 = Buffer.from(p.cert, "base64");
+        const pki = (init_dist6(), __toCommonJS(dist_exports3));
+        const details = pki.decodeCert(new Uint8Array(bytes2)).details;
+        if (pki.isExitNode(details))
+          this.#exitNodes.set(hex6, details.name);
+        else
+          this.#exitNodes.delete(hex6);
+      } catch {
+      }
+    }
     if (!this.#peers.has(hex6)) {
       engine.addPeer(pk, 0, Buffer.alloc(16));
       this.#peers.set(hex6, pk);
@@ -99364,7 +99626,7 @@ function netdEndpoint() {
 function endpointOverride() {
   return process.env.CCB_NETD_SOCKET ?? null;
 }
-function fail(code, detail) {
+function fail2(code, detail) {
   return { ok: false, code, detail };
 }
 async function call(line) {
@@ -99385,28 +99647,28 @@ async function call(line) {
     try {
       sock = connect2(endpoint2);
     } catch (e) {
-      return resolve16(fail("not-installed", e instanceof Error ? e.message : String(e)));
+      return resolve16(fail2("not-installed", e instanceof Error ? e.message : String(e)));
     }
     const timer2 = setTimeout(() => {
-      done(fail("timeout", `no answer from the network helper in ${TIMEOUT_MS2}ms`));
+      done(fail2("timeout", `no answer from the network helper in ${TIMEOUT_MS2}ms`));
     }, TIMEOUT_MS2);
     timer2.unref?.();
     sock.setTimeout(TIMEOUT_MS2);
     sock.on("timeout", () => {
       clearTimeout(timer2);
-      done(fail("timeout", "socket idle"));
+      done(fail2("timeout", "socket idle"));
     });
     sock.on("error", (e) => {
       clearTimeout(timer2);
       const absent = e.code === "ENOENT" || e.code === "ECONNREFUSED";
-      done(fail(absent ? "not-installed" : "io", e.message));
+      done(fail2(absent ? "not-installed" : "io", e.message));
     });
     let buf = "";
     sock.on("data", (chunk) => {
       buf += chunk.toString("utf8");
       if (buf.length > MAX_LINE) {
         clearTimeout(timer2);
-        done(fail("protocol", "the helper sent an oversized line"));
+        done(fail2("protocol", "the helper sent an oversized line"));
         return;
       }
       const nl = buf.indexOf("\n");
@@ -99417,7 +99679,7 @@ async function call(line) {
     });
     sock.on("close", () => {
       clearTimeout(timer2);
-      done(fail("protocol", "the helper closed the connection without answering"));
+      done(fail2("protocol", "the helper closed the connection without answering"));
     });
     sock.on("connect", () => {
       sock.write(`${line}
@@ -99430,26 +99692,26 @@ function parse3(line) {
   try {
     body = JSON.parse(line);
   } catch {
-    return fail("protocol", "the helper sent something that is not JSON");
+    return fail2("protocol", "the helper sent something that is not JSON");
   }
   if (typeof body !== "object" || body === null) {
-    return fail("protocol", "the helper sent something that is not an object");
+    return fail2("protocol", "the helper sent something that is not an object");
   }
   const o = body;
   if (o.ok === false) {
     const code = typeof o.code === "string" ? o.code : "refused";
     const detail = typeof o.detail === "string" ? o.detail : "the helper refused";
-    return fail(code, detail);
+    return fail2(code, detail);
   }
   if (o.ok !== true)
-    return fail("protocol", "the helper did not say whether it succeeded");
+    return fail2("protocol", "the helper did not say whether it succeeded");
   return { ok: true, body: o };
 }
 async function request(line) {
   const r = await call(line);
   return r.ok ? parse3(r.line) : r;
 }
-function hex3(b) {
+function hex4(b) {
   return Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
 }
 async function netdHello() {
@@ -99458,9 +99720,9 @@ async function netdHello() {
     return r;
   const v = r.body.wireVersion;
   if (typeof v !== "number")
-    return fail("protocol", "the helper did not report a wire version");
+    return fail2("protocol", "the helper did not report a wire version");
   if (v !== NETD_WIRE_VERSION) {
-    return fail("wire-version", `the helper speaks ${v}, this build speaks ${NETD_WIRE_VERSION}`);
+    return fail2("wire-version", `the helper speaks ${v}, this build speaks ${NETD_WIRE_VERSION}`);
   }
   return { ok: true, wireVersion: v };
 }
@@ -99476,8 +99738,8 @@ async function netdUp(args) {
   const r = await request(JSON.stringify({
     op: "up",
     meshId: args.meshId,
-    genesis: hex3(args.genesis),
-    cert: hex3(args.cert),
+    genesis: hex4(args.genesis),
+    cert: hex4(args.cert),
     fullTunnel: args.fullTunnel === true
   }));
   return r.ok ? { ok: true } : r;
@@ -99677,7 +99939,7 @@ import { basename as basename13 } from "node:path";
 // ../../packages/host-core/dist/drops/paths.js
 init_base_paths();
 import { mkdir as mkdir12 } from "node:fs/promises";
-import { join as join61 } from "node:path";
+import { join as join62 } from "node:path";
 
 // ../../packages/host-core/dist/drops/names.js
 var WINDOWS_RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i;
@@ -99686,8 +99948,8 @@ var BIDI = /[\u200e\u200f\u202a-\u202e\u2066-\u2069]/g;
 var MAX_NAME_BYTES = 200;
 var MAX_EXT_BYTES = 32;
 var MAX_DEPTH2 = 32;
-var utf82 = new TextEncoder();
-var byteLen = (s) => utf82.encode(s).length;
+var utf83 = new TextEncoder();
+var byteLen = (s) => utf83.encode(s).length;
 function capBytes(stem, ext, max) {
   if (byteLen(stem + ext) <= max)
     return stem + ext;
@@ -99766,7 +100028,7 @@ function basenameOf(p) {
 function resolveDropsRoot() {
   const root = resolveHostRoot();
   const preferred = dropsDir();
-  return isInsideRoot(preferred, root) ? preferred : join61(root, "Drops");
+  return isInsideRoot(preferred, root) ? preferred : join62(root, "Drops");
 }
 async function ensureDropsRoot() {
   const dir2 = resolveDropsRoot();
@@ -99782,7 +100044,7 @@ async function ensureDropDir(opts) {
     parts.push(sanitizeDropName(opts.sender, "Unknown sender"));
   if (!opts.singleItem && opts.label)
     parts.push(sanitizeDropName(opts.label, "Files"));
-  const dir2 = join61(...parts);
+  const dir2 = join62(...parts);
   await mkdir12(dir2, { recursive: true });
   return dir2;
 }
@@ -99925,7 +100187,7 @@ function createDropHandler(deps) {
 // ../../packages/host-core/dist/drops/blob-fetch.js
 import { createWriteStream as createWriteStream2 } from "node:fs";
 import { mkdir as mkdir13, rm as rm5, chmod as chmod3 } from "node:fs/promises";
-import { dirname as dirname26, join as join62 } from "node:path";
+import { dirname as dirname26, join as join63 } from "node:path";
 import { Readable as Readable2 } from "node:stream";
 import { pipeline } from "node:stream/promises";
 
@@ -99937,10 +100199,10 @@ var HEADER_BYTES = MAGIC2.length + NONCE_BYTES;
 var FRAME_BYTES = 1024 * 1024;
 var TAG_BYTES = 16;
 var MAX_FRAME_CIPHERTEXT = FRAME_BYTES + TAG_BYTES + 1024;
-var subtle3 = () => globalThis.crypto.subtle;
-var bs3 = (b) => b;
+var subtle4 = () => globalThis.crypto.subtle;
+var bs4 = (b) => b;
 async function importKey(raw) {
-  return subtle3().importKey("raw", bs3(raw), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+  return subtle4().importKey("raw", bs4(raw), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
 }
 function nonceFor(base, index) {
   const n = Buffer.from(base);
@@ -100035,7 +100297,7 @@ function decryptStream(source, keyRaw) {
           const frame = q.peek(4 + len);
           if (!frame)
             break;
-          const plain = Buffer.from(await subtle3().decrypt({ name: "AES-GCM", iv: bs3(nonceFor(base, index)), additionalData: bs3(aadFor(index)) }, key2, bs3(frame.subarray(4))));
+          const plain = Buffer.from(await subtle4().decrypt({ name: "AES-GCM", iv: bs4(nonceFor(base, index)), additionalData: bs4(aadFor(index)) }, key2, bs4(frame.subarray(4))));
           this.push(plain);
           index += 1;
           q.consume(4 + len);
@@ -100097,7 +100359,7 @@ async function fetchBlobDrop(opts) {
         log7(`drop ${opts.dropId}: refusing directory "${item.rel}"`);
         continue;
       }
-      const abs = join62(opts.destDir, rel);
+      const abs = join63(opts.destDir, rel);
       if (!isInsideRoot(abs, opts.destDir)) {
         log7(`drop ${opts.dropId}: refusing directory outside the destination`);
         continue;
@@ -100118,7 +100380,7 @@ async function fetchBlobDrop(opts) {
         log7(`drop ${opts.dropId}: refusing "${item.rel}"`);
         continue;
       }
-      let abs = join62(opts.destDir, rel);
+      let abs = join63(opts.destDir, rel);
       if (!isInsideRoot(abs, opts.destDir)) {
         log7(`drop ${opts.dropId}: refusing a path outside the destination`);
         continue;
@@ -100396,12 +100658,12 @@ var RdeskServerChannel = class {
 
 // ../../packages/host-core/dist/rdesk/channel-client.js
 import { readFileSync as readFileSync44 } from "node:fs";
-import { join as join63 } from "node:path";
+import { join as join64 } from "node:path";
 var RECONNECT_MS = 2e3;
 var CLAIM_RETRY_MS = 5e3;
 function readEndpoint(dir2, selfPid) {
   try {
-    const s = JSON.parse(readFileSync44(join63(dir2, "status.json"), "utf8"));
+    const s = JSON.parse(readFileSync44(join64(dir2, "status.json"), "utf8"));
     if (selfPid && s.pid === selfPid)
       return null;
     return s.localPort && s.localToken ? `ws://127.0.0.1:${s.localPort}/?token=${s.localToken}` : null;
@@ -100542,19 +100804,6 @@ function setRdeskServerAdmin(a) {
   admin = a;
 }
 
-// ../../packages/host-core/dist/daemon-identity-reload.js
-var reload = null;
-function setDaemonIdentityReload(fn) {
-  reload = fn;
-}
-function nextDaemonIdentity(fresh, current) {
-  if (!fresh?.accessToken)
-    return { kind: "machine" };
-  if (fresh.accessToken === current.accessToken && (fresh.userId ?? "") === current.userId)
-    return { kind: "unchanged" };
-  return { kind: "account" };
-}
-
 // ../../packages/host-core/dist/daemon-online-watch.js
 var FIRST_DELAY_MS = 5e3;
 var MAX_DELAY_MS = 3e4;
@@ -100847,10 +101096,10 @@ function registerRdpEngine() {
 // ../../packages/host-core/dist/rdesk/audit.js
 init_credentials();
 import { appendFile, stat as stat8, rename as rename3 } from "node:fs/promises";
-import { join as join64 } from "node:path";
+import { join as join65 } from "node:path";
 var MAX_BYTES = 2 * 1024 * 1024;
 function rdeskAuditPath() {
-  return join64(daemonDir2(), "rdesk-audit.jsonl");
+  return join65(daemonDir2(), "rdesk-audit.jsonl");
 }
 var queue = [];
 var draining = false;
@@ -100890,81 +101139,13 @@ function appendRdeskAudit(e) {
   }
 }
 
-// ../../packages/host-core/dist/rdesk/screen-permission.js
-function screenRecordingStatus() {
-  if (process.platform !== "darwin")
-    return "unsupported";
-  try {
-    const sp = electronModule()?.systemPreferences;
-    const s = sp?.getMediaAccessStatus("screen");
-    if (s === "granted" || s === "denied" || s === "restricted" || s === "not-determined")
-      return s;
-    return "not-determined";
-  } catch {
-    return "not-determined";
-  }
-}
-async function registerForScreenRecording() {
-  try {
-    const dc = electronModule()?.desktopCapturer;
-    await dc?.getSources({ types: ["screen"], thumbnailSize: { width: 1, height: 1 } });
-  } catch {
-  }
-}
-async function openScreenRecordingSettings() {
-  if (process.platform !== "darwin")
-    return;
-  await registerForScreenRecording();
-  try {
-    const shell = electronModule()?.shell;
-    await shell?.openExternal("x-apple.systempreferences:com.apple.preference.security?Privacy_ScreenCapture");
-  } catch {
-  }
-}
-var PROMPT_COOLDOWN_MS = 6e4;
-var lastPromptAt = 0;
-async function promptForScreenRecording(opts = {}) {
-  if (process.platform !== "darwin")
-    return false;
-  if (screenRecordingStatus() === "granted")
-    return false;
-  const now2 = Date.now();
-  if (now2 - lastPromptAt < PROMPT_COOLDOWN_MS)
-    return false;
-  lastPromptAt = now2;
-  const el2 = electronModule();
-  const who = opts.viewerName ? `${opts.viewerName} is` : "Someone is";
-  opts.log?.(`screen recording not granted \u2014 prompting (${who} waiting)`);
-  if (!el2?.dialog) {
-    opts.log?.("no GUI to prompt with \u2014 grant Screen Recording in System Settings \u2192 Privacy & Security");
-    return false;
-  }
-  try {
-    const { response } = await el2.dialog.showMessageBox({
-      type: "warning",
-      buttons: ["Open System Settings", "Not Now"],
-      defaultId: 0,
-      cancelId: 1,
-      message: "Allow screen sharing on this Mac?",
-      detail: `${who} trying to connect to this computer, but macOS is blocking screen capture.
-
-Open System Settings \u2192 Privacy & Security \u2192 Screen Recording and switch on Tesseract Remote Desktop, then ask them to connect again.`
-    });
-    if (response === 0)
-      await openScreenRecordingSettings();
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 // ../../packages/host-core/dist/fileprovider-bridge.js
 import { writeFileSync as writeFileSync34, mkdirSync as mkdirSync33, rmSync as rmSync8, existsSync as existsSync31 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { join as join65 } from "node:path";
+import { join as join66 } from "node:path";
 var APPEX_BUNDLE_ID = "dev.tesseract.FileProvider";
 function appexBridgeInfoPath() {
-  return join65(homedir9(), "Library", "Containers", APPEX_BUNDLE_ID, "Data", "Library", "Application Support", "tesseract-bridge.json");
+  return join66(homedir9(), "Library", "Containers", APPEX_BUNDLE_ID, "Data", "Library", "Application Support", "tesseract-bridge.json");
 }
 function clearBridgeInfo() {
   if (process.platform !== "darwin")
@@ -101131,10 +101312,10 @@ function stopFileProviderBridge() {
 }
 
 // ../../packages/host-core/dist/vault/autofill-bridge.js
-import { randomBytes as randomBytes7 } from "node:crypto";
+import { randomBytes as randomBytes9 } from "node:crypto";
 import { existsSync as existsSync32, mkdirSync as mkdirSync34, writeFileSync as writeFileSync35, rmSync as rmSync9 } from "node:fs";
 import { homedir as homedir10 } from "node:os";
-import { join as join66 } from "node:path";
+import { join as join67 } from "node:path";
 
 // ../../packages/host-core/dist/vault/peer-verify.js
 import { execFile as execFile9 } from "node:child_process";
@@ -101196,10 +101377,10 @@ async function isTrustedAutofillPeer(remotePort) {
 var APPEX_BUNDLE_ID2 = "dev.tesseract.AutoFill";
 var BRIDGE_PORTS2 = [17872, 17873, 17874, 17875];
 function appexContainerData() {
-  return join66(homedir10(), "Library", "Containers", APPEX_BUNDLE_ID2, "Data");
+  return join67(homedir10(), "Library", "Containers", APPEX_BUNDLE_ID2, "Data");
 }
 function bridgeInfoPath() {
-  return join66(appexContainerData(), "Library", "Application Support", "tesseract-autofill-bridge.json");
+  return join67(appexContainerData(), "Library", "Application Support", "tesseract-autofill-bridge.json");
 }
 var infoLoggedOnce = false;
 function writeBridgeInfo(port, token3, log9) {
@@ -101214,7 +101395,7 @@ function writeBridgeInfo(port, token3, log9) {
       }
       return;
     }
-    const dir2 = join66(containerData, "Library", "Application Support");
+    const dir2 = join67(containerData, "Library", "Application Support");
     mkdirSync34(dir2, { recursive: true });
     writeFileSync35(bridgeInfoPath(), JSON.stringify({ port, token: token3, pid: process.pid, ts: Date.now() }), { mode: 384 });
     if (!infoLoggedOnce) {
@@ -101375,7 +101556,7 @@ function startAutofillBridge(log9 = () => {
   if (process.platform !== "darwin" || wss2)
     return;
   stopping2 = false;
-  token2 = randomBytes7(24).toString("base64url");
+  token2 = randomBytes9(24).toString("base64url");
   bind(0, log9);
 }
 function stopAutofillBridge() {
@@ -101460,7 +101641,7 @@ function createNodePowerController() {
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { chmodSync as chmodSync6, existsSync as existsSync33, mkdirSync as mkdirSync35, writeFileSync as writeFileSync36 } from "node:fs";
 import { homedir as homedir11, platform as platform5 } from "node:os";
-import { dirname as dirname27, join as join67, resolve as resolve12 } from "node:path";
+import { dirname as dirname27, join as join68, resolve as resolve12 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 var HOST_NAME = "com.tesseract.companion";
 var EXTENSION_IDS = ["icpnghhpcmaonjckkpilpajblfehpplo", "giolfpookdhjfafcchaflhmigghaeffn"];
@@ -101469,18 +101650,18 @@ function browserProfileDirs() {
   const home = homedir11();
   const p = platform5();
   if (p === "darwin") {
-    const base = join67(home, "Library/Application Support");
-    return ["Google/Chrome", "Google/Chrome Beta", "Google/Chrome Dev", "Google/Chrome Canary", "Chromium", "Microsoft Edge", "BraveSoftware/Brave-Browser", "Vivaldi", "Arc"].map((b) => join67(base, b));
+    const base = join68(home, "Library/Application Support");
+    return ["Google/Chrome", "Google/Chrome Beta", "Google/Chrome Dev", "Google/Chrome Canary", "Chromium", "Microsoft Edge", "BraveSoftware/Brave-Browser", "Vivaldi", "Arc"].map((b) => join68(base, b));
   }
   if (p === "win32")
     return [];
-  const cfg2 = join67(home, ".config");
-  return ["google-chrome", "google-chrome-beta", "chromium", "microsoft-edge", "BraveSoftware/Brave-Browser", "vivaldi"].map((b) => join67(cfg2, b));
+  const cfg2 = join68(home, ".config");
+  return ["google-chrome", "google-chrome-beta", "chromium", "microsoft-edge", "BraveSoftware/Brave-Browser", "vivaldi"].map((b) => join68(cfg2, b));
 }
 function resolveBridge(log9) {
   const candidates = [
     process.env.CCB_COMPANION_HOST_JS,
-    process.resourcesPath ? join67(process.resourcesPath, "companion-host", BRIDGE_BASENAME) : void 0
+    process.resourcesPath ? join68(process.resourcesPath, "companion-host", BRIDGE_BASENAME) : void 0
   ];
   try {
     const here = dirname27(fileURLToPath5(import.meta.url));
@@ -101496,7 +101677,7 @@ function resolveBridge(log9) {
 }
 function writeLauncher(daemonDir3, bridge, runtime) {
   const isWin = platform5() === "win32";
-  const launcher = join67(daemonDir3, isWin ? "companion-host.cmd" : "companion-host.sh");
+  const launcher = join68(daemonDir3, isWin ? "companion-host.cmd" : "companion-host.sh");
   if (isWin) {
     writeFileSync36(launcher, `@echo off\r
 set ELECTRON_RUN_AS_NODE=1\r
@@ -101534,9 +101715,9 @@ function registerNativeHost(opts) {
       if (!existsSync33(profile))
         continue;
       try {
-        const dir2 = join67(profile, "NativeMessagingHosts");
+        const dir2 = join68(profile, "NativeMessagingHosts");
         mkdirSync35(dir2, { recursive: true });
-        writeFileSync36(join67(dir2, `${HOST_NAME}.json`), manifestJson);
+        writeFileSync36(join68(dir2, `${HOST_NAME}.json`), manifestJson);
         wrote++;
       } catch {
       }
@@ -101548,7 +101729,7 @@ function registerNativeHost(opts) {
 }
 function registerWindows(daemonDir3, manifestJson, log9) {
   try {
-    const manifestPath = join67(daemonDir3, `${HOST_NAME}.json`);
+    const manifestPath = join68(daemonDir3, `${HOST_NAME}.json`);
     writeFileSync36(manifestPath, manifestJson);
     for (const root of ["Software\\Google\\Chrome", "Software\\Microsoft\\Edge", "Software\\BraveSoftware\\Brave-Browser"]) {
       try {
@@ -101568,9 +101749,9 @@ init_daemon_settings();
 // ../../packages/host-core/dist/activity/activity-tracker.js
 init_credentials();
 import { promises as fsp, writeFileSync as writeFileSync37, mkdirSync as mkdirSync36, existsSync as existsSync34 } from "node:fs";
-import { join as join68 } from "node:path";
+import { join as join69 } from "node:path";
 function activityProfilePath() {
-  return join68(daemonDir2(), "activity-profile.json");
+  return join69(daemonDir2(), "activity-profile.json");
 }
 var MAX_APPS = 300;
 var MAX_AGE_DAYS = 120;
@@ -101879,8 +102060,8 @@ async function runDaemon(opts = {}) {
   log9("paths", JSON.stringify(sealBasePaths()));
   const OUR_STARTED_AT = procStartedAt(process.pid);
   let ownsMachine = false;
-  const pidfile = () => join69(daemonDir2(), "daemon.lock");
-  const statusFile = () => join69(daemonDir2(), "status.json");
+  const pidfile = () => join70(daemonDir2(), "daemon.lock");
+  const statusFile = () => join70(daemonDir2(), "status.json");
   const isAlive2 = (pid) => {
     try {
       process.kill(pid, 0);
@@ -102320,12 +102501,43 @@ async function runDaemon(opts = {}) {
         } catch {
         }
       });
-      eapp.on("render-process-gone", (_e, d) => {
+      const renderRecoveries = [];
+      const RECOVER_WINDOW_MS = 6e4, RECOVER_MAX = 4, RECOVER_DELAY_MS = 300;
+      const recoverRenderer = (wc, reason) => {
+        if (!mergedProcess || deliberateMergedQuit())
+          return;
+        if (reason && !["killed", "crashed", "abnormal-exit", "oom", "launch-failed", "integrity-failure"].includes(reason))
+          return;
+        const now2 = Date.now();
+        while (renderRecoveries.length && now2 - renderRecoveries[0] > RECOVER_WINDOW_MS)
+          renderRecoveries.shift();
+        if (renderRecoveries.length >= RECOVER_MAX) {
+          try {
+            log9(`render-recover: ${RECOVER_MAX} reloads in <60s \u2014 backing off (page may be genuinely crashing)`);
+          } catch {
+          }
+          return;
+        }
+        renderRecoveries.push(now2);
+        const contents = wc;
+        setTimeout(() => {
+          try {
+            if (!contents || contents.isDestroyed?.())
+              return;
+            log9(`render-recover: reloading window after '${reason ?? "unknown"}' (recovery #${renderRecoveries.length})`);
+            contents.reload?.();
+          } catch {
+          }
+        }, RECOVER_DELAY_MS).unref?.();
+      };
+      eapp.on("render-process-gone", (_e, wc, details) => {
+        const reason = details?.reason;
         try {
-          log9(`render-process-gone (kept alive) uptime=${Date.now() - daemonStartedAt}ms: ${JSON.stringify(d)}`);
+          log9(`render-process-gone (kept alive) uptime=${Date.now() - daemonStartedAt}ms: ${JSON.stringify(details ?? {})}`);
           snapshotProcs("render-gone");
         } catch {
         }
+        recoverRenderer(wc, reason);
       });
       eapp.on("child-process-gone", (_e, d) => {
         try {
@@ -102344,7 +102556,7 @@ async function runDaemon(opts = {}) {
   }
   if (ownsMachine)
     setHostDaemonRole(true);
-  const localToken = randomBytes8(24).toString("hex");
+  const localToken = randomBytes10(24).toString("hex");
   const sendToViewer = (kind, sessionId, clientId, msg) => {
     const lb = loopbackRdeskSend.get(clientId);
     if (lb) {
@@ -102503,7 +102715,7 @@ async function runDaemon(opts = {}) {
         if (r.status === 401) {
           log9("device token no longer valid \u2014 dropping to local-only on restart");
           try {
-            unlinkSync6(join69(daemonDir2(), "credentials.json"));
+            unlinkSync6(join70(daemonDir2(), "credentials.json"));
           } catch {
           }
           shutdown(0, "token-revoked-401");
@@ -102901,14 +103113,14 @@ async function runDaemon(opts = {}) {
     // is on; with it off it is the standalone Remote Desktop app, and we forward rather than
     // handle. `provider()` re-reads the setting every time, so switching it back on takes the
     // channel away from the claimant mid-flight — there is never a moment with two servers.
-    onRdesk: (payload, clientId, sessionId) => {
+    onRdesk: (payload, clientId, sessionId, viewerOwner) => {
       const p = rdeskChannel.provider();
       if (p && clientId) {
         p.control(sessionId, clientId, payload);
         return;
       }
       if (rdesk && clientId)
-        void rdesk.onClientMessage(sessionId, { clientId }, payload);
+        void rdesk.onClientMessage(sessionId, { clientId, sameAccount: viewerOwner }, payload);
     },
     onRdeskSignal: (payload, clientId, sessionId) => {
       const p = rdeskChannel.provider();
@@ -103001,7 +103213,7 @@ async function runDaemon(opts = {}) {
     if (appPid > 0 && appPid !== process.pid) {
       const quitMarker = () => {
         try {
-          return Number(readFileSync45(join69(daemonDir2(), "app-quit.marker"), "utf-8").trim()) || 0;
+          return Number(readFileSync45(join70(daemonDir2(), "app-quit.marker"), "utf-8").trim()) || 0;
         } catch {
           return 0;
         }
@@ -103026,7 +103238,7 @@ async function runDaemon(opts = {}) {
           log9(`desktop app (pid ${appPid}) is gone with NO clean-quit marker \u2014 reporting`);
           const tail3 = (name) => {
             try {
-              const buf = readFileSync45(join69(daemonDir2(), name), "utf-8");
+              const buf = readFileSync45(join70(daemonDir2(), name), "utf-8");
               return buf.length > 4096 ? buf.slice(-4096) : buf;
             } catch {
               return void 0;
@@ -103057,7 +103269,7 @@ async function runDaemon(opts = {}) {
   }
   try {
     const DAEMON_LOG_CAP = 2 * 1024 * 1024;
-    const daemonLogFile = join69(daemonDir2(), "daemon.log");
+    const daemonLogFile = join70(daemonDir2(), "daemon.log");
     const capTimer = setInterval(() => {
       try {
         if (existsSync35(daemonLogFile) && statSync9(daemonLogFile).size > DAEMON_LOG_CAP) {