tesseract-agent 0.9.5 → 0.9.6

package/dist-bundle/cli.js

@@ -137,7 +137,7 @@ function sealBasePaths() {
   claudeConfigDir();
   return snapshotBasePaths();
 }
-var STARTUP_CWD, USER_HOME, TEMP_DIR, systemDirs, envRoot, peeking;
+var STARTUP_CWD, USER_HOME, TEMP_DIR, systemDirs, envRoot, peeking, dropsDir;
 var init_base_paths = __esm({
   "../../packages/shared/dist/base-paths.js"() {
     "use strict";
@@ -147,6 +147,7 @@ var init_base_paths = __esm({
     systemDirs = deriveSystemDirs(USER_HOME);
     envRoot = memoEnvRoot();
     peeking = false;
+    dropsDir = () => join(systemDirs.downloads, "Tesseract");
   }
 });
 
@@ -2399,7 +2400,7 @@ var require_websocket = __commonJS({
     var net = __require("net");
     var tls2 = __require("tls");
     var { randomBytes: randomBytes9, createHash: createHash9 } = __require("crypto");
-    var { Duplex, Readable: Readable2 } = __require("stream");
+    var { Duplex, Readable: Readable3 } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
     var Receiver2 = require_receiver();
@@ -22264,10 +22265,10 @@ ${r?.url ?? ""}`);
     tool3("browser_screenshot", `Capture a PNG screenshot of the visible page (for visual inspection; use browser_snapshot to get actionable elements). ${REAL}`, {}, async () => {
       const r = await drive("screenshot");
       const dataUrl = r?.dataUrl ?? "";
-      const b64 = dataUrl.startsWith("data:") ? dataUrl.slice(dataUrl.indexOf(",") + 1) : dataUrl;
-      if (!b64)
+      const b642 = dataUrl.startsWith("data:") ? dataUrl.slice(dataUrl.indexOf(",") + 1) : dataUrl;
+      if (!b642)
         return text2("No screenshot data returned.", true);
-      return { content: [{ type: "image", data: b64, mimeType: "image/png" }] };
+      return { content: [{ type: "image", data: b642, mimeType: "image/png" }] };
     }),
     tool3("browser_click", `Click an element by CSS selector (from browser_snapshot). ${REAL}`, { selector: external_exports.string().describe("CSS selector of the element to click.") }, async (a) => {
       const r = await drive("click", { selector: a.selector });
@@ -23214,11 +23215,11 @@ function makeApi(deps, toolId, tier) {
   };
   return api;
 }
-function buildToolCtx(deps, sessionId, toolId, log5 = NOOP_LOG, tier = "third-party") {
+function buildToolCtx(deps, sessionId, toolId, log9 = NOOP_LOG, tier = "third-party") {
   const getSid = typeof sessionId === "function" ? sessionId : () => sessionId;
   return { ui: makeApi(deps, toolId, tier), get sessionId() {
     return getSid();
-  }, toolId, log: log5 };
+  }, toolId, log: log9 };
 }
 function wrapCtxTool(tool18, ctx2) {
   const raw = tool18.__ctxHandler;
@@ -26463,9 +26464,9 @@ function sourcesEqual(a, b) {
   if (a.length !== b.length)
     return false;
   const as = [...a].sort();
-  const bs3 = [...b].sort();
+  const bs4 = [...b].sort();
   for (let i = 0; i < as.length; i++)
-    if (as[i] !== bs3[i])
+    if (as[i] !== bs4[i])
       return false;
   return true;
 }
@@ -36728,9 +36729,9 @@ var require_encoder = __commonJS({
           RGB_YUV_TABLE[i + 1792 >> 0] = -5329 * i;
         }
       }
-      function writeBits(bs3) {
-        var value = bs3[0];
-        var posval = bs3[1] - 1;
+      function writeBits(bs4) {
+        var value = bs4[0];
+        var posval = bs4[1] - 1;
         while (posval >= 0) {
           if (value & 1 << posval) {
             bytenew |= 1 << bytepos;
@@ -58598,12 +58599,12 @@ import { createHash as createHash8 } from "node:crypto";
 import { execFileSync as execFileSync5, spawn as spawn12 } from "node:child_process";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { tmpdir as tmpdir4 } from "node:os";
-import { dirname as dirname25, join as join56, resolve as resolve11 } from "node:path";
+import { dirname as dirname27, join as join60, resolve as resolve11 } from "node:path";
 import { createInterface } from "node:readline/promises";
 
 // ../../packages/host-core/dist/control-link.js
 import { hostname as hostname3 } from "node:os";
-import { join as join41, basename as basename8 } from "node:path";
+import { join as join42, basename as basename9 } from "node:path";
 import { mkdirSync as mkdirSync18 } from "node:fs";
 
 // ../../node_modules/ws/wrapper.mjs
@@ -59030,13 +59031,27 @@ var E2ESessions = class {
 
 // ../../packages/e2e/dist/seal.js
 var SEAL_INFO = utf8("tesseract-seal-v1");
+async function openFromPrivateKey(recipientPrivate, sealed, aad = new Uint8Array()) {
+  const shared = await ecdh(recipientPrivate, unb64u(sealed.epk));
+  const key2 = await importAesKey(await hkdf(shared, new Uint8Array(), SEAL_INFO, 32));
+  return aesOpen(key2, unb64u(sealed.nonce), unb64u(sealed.ct), aad);
+}
 
 // ../../packages/e2e/dist/attest.js
 var SEALING_ATTEST_CTX = utf8("tesseract-sealing-attest-v1");
+function attestMessage(sealingPubRaw) {
+  const out = new Uint8Array(SEALING_ATTEST_CTX.length + sealingPubRaw.length);
+  out.set(SEALING_ATTEST_CTX, 0);
+  out.set(sealingPubRaw, SEALING_ATTEST_CTX.length);
+  return out;
+}
+async function attestSealingKey(identityPrivate, sealingPubRaw) {
+  return b64u(await sign(identityPrivate, attestMessage(sealingPubRaw)));
+}
 
 // ../../packages/host-core/dist/daemon-agent.js
 init_base_paths();
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 
 // ../../packages/host-core/dist/surface-hub.js
 init_dist();
@@ -60712,7 +60727,7 @@ function convertTool(t) {
   if (!t || typeof t.name !== "string" || typeof t.execute !== "function")
     return null;
   const shape = t.parameters?.shape ?? t.inputSchema?.shape ?? {};
-  const exec = t.execute;
+  const exec2 = t.execute;
   return {
     name: t.name,
     description: t.description ?? t.name,
@@ -60720,12 +60735,12 @@ function convertTool(t) {
     // Fallback handler — used when no surface host is wired (off-daemon / no session): the
     // OpenClaw tool still runs with a DEGRADED ctx whose ui methods no-op (open → an
     // already-closed handle), so `ctx.ui.notify(...)` degrades instead of throwing on `{}`.
-    handler: async (args) => toCallToolResult(await exec(args, NOOP_UI_CTX)),
+    handler: async (args) => toCallToolResult(await exec2(args, NOOP_UI_CTX)),
     // Ctx-aware path (Pillar 1 P4): agent-manager's wrapCtxTool injects a per-session ctx
     // ({ ui, sessionId, toolId }) here, so the OpenClaw tool's execute(args, ctx) can open
     // and drive surfaces via ctx.ui. Unknown ctx members (channel/secret/log) read as
     // undefined — graceful, matching the Proxy no-op contract.
-    __ctxHandler: async (args, ctx2) => toCallToolResult(await exec(args, ctx2))
+    __ctxHandler: async (args, ctx2) => toCallToolResult(await exec2(args, ctx2))
     // Our narrow CallToolResult is a structural subset of the SDK's (which carries an
     // index signature + a richer content union); cast through unknown intentionally.
   };
@@ -62192,12 +62207,17 @@ async function closeEnginePage(browserId) {
   }
 }
 
+// ../../packages/host-core/dist/gui/windows.js
+import { randomUUID as randomUUID8 } from "node:crypto";
+import { join as join20 } from "node:path";
+
 // ../../packages/host-core/dist/gui/daemon-gui.js
 import { join as join19, dirname as dirname8 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { existsSync as existsSync9 } from "node:fs";
 var el = null;
 var guiReady = false;
+var log2 = (...a) => console.log("[daemon-gui]", ...a);
 var tray = null;
 function formatAccelerator(accel) {
   const sym = {
@@ -62256,6 +62276,68 @@ function buildTrayMenu(deps) {
   ]);
 }
 var rdeskPowerBlockerId = null;
+var trayActivity = null;
+function trayTooltip() {
+  if (process.env.CCB_RDESK_ROLE === "server")
+    return "Tesseract Remote Desktop \u2014 this machine";
+  if (process.env.CCB_RDESK_ROLE === "client")
+    return "Tesseract Remote Desktop";
+  const bits = [];
+  if (rdeskActive > 0)
+    bits.push(`sharing screen (${rdeskActive})`);
+  if (trayActivity)
+    bits.push(trayActivity);
+  return bits.length ? `Tesseract \u2014 ${bits.join(" \xB7 ")}` : "Tesseract";
+}
+function setTrayActivity(label) {
+  trayActivity = label;
+  if (!tray)
+    return;
+  try {
+    tray.setToolTip(trayTooltip());
+  } catch {
+  }
+}
+function daemonNotify(opts) {
+  if (!guiReady || !el)
+    return false;
+  try {
+    if (!el.Notification.isSupported())
+      return false;
+    const actions = (opts.actions ?? []).slice(0, 3);
+    const n = new el.Notification({
+      title: opts.title,
+      body: opts.body,
+      silent: opts.silent,
+      ...actions.length ? { actions: actions.map((a) => ({ type: "button", text: a.label })) } : {}
+    });
+    if (actions.length && opts.onAction) {
+      n.on("action", (...a) => {
+        const ix = typeof a[1] === "number" ? a[1] : -1;
+        const chosen = actions[ix];
+        if (chosen) {
+          try {
+            opts.onAction(chosen.id);
+          } catch (e) {
+            log2("notify action failed:", e instanceof Error ? e.message : String(e));
+          }
+        }
+      });
+    }
+    if (opts.onClick)
+      n.on("click", () => {
+        try {
+          opts.onClick();
+        } catch {
+        }
+      });
+    n.show();
+    return true;
+  } catch (e) {
+    log2("notify failed:", e instanceof Error ? e.message : String(e));
+    return false;
+  }
+}
 function setRdeskTraySessions(count, onStopAll) {
   rdeskActive = count;
   rdeskStopAll = onStopAll;
@@ -62277,7 +62359,7 @@ function setRdeskTraySessions(count, onStopAll) {
   if (!tray || !trayDeps)
     return;
   try {
-    tray.setToolTip(count > 0 ? `Tesseract \u2014 sharing screen (${count})` : "Tesseract");
+    tray.setToolTip(trayTooltip());
     tray.setContextMenu(buildTrayMenu(trayDeps));
   } catch {
   }
@@ -62352,7 +62434,7 @@ function daemonPreloadPath() {
 // ../../packages/host-core/dist/os-control-runner.js
 import { spawn as spawn6 } from "node:child_process";
 var IS_MAC = process.platform === "darwin";
-var log2 = (...a) => console.log("[os-control]", ...a);
+var log3 = (...a) => console.log("[os-control]", ...a);
 function capture(command, args, opts = {}) {
   return new Promise((resolve12) => {
     const child = spawn6(command, args, { cwd: opts.cwd, windowsHide: true });
@@ -62499,7 +62581,7 @@ function createDaemonOsControlRunner() {
       if (o.at)
         n.moveMouse(Math.round(o.at.x), Math.round(o.at.y));
       n.mouseClick(NUT_BTN[o.button ?? "left"], o.double === true);
-      log2(`${o.button ?? "left"}${o.double ? "-double" : ""}-click${o.at ? ` @ ${Math.round(o.at.x)},${Math.round(o.at.y)}` : ""}`);
+      log3(`${o.button ?? "left"}${o.double ? "-double" : ""}-click${o.at ? ` @ ${Math.round(o.at.x)},${Math.round(o.at.y)}` : ""}`);
     },
     async mouseDrag(from, to, o) {
       const n = await nutOrThrow();
@@ -62561,7 +62643,7 @@ function createDaemonOsControlRunner() {
     async typeText(t) {
       const n = await nutOrThrow();
       n.typeString(t);
-      log2(`type "${t.length > 50 ? `${t.slice(0, 50)}\u2026` : t}"`);
+      log3(`type "${t.length > 50 ? `${t.slice(0, 50)}\u2026` : t}"`);
     },
     async pressKeys(combo) {
       const n = await nutOrThrow();
@@ -62569,7 +62651,7 @@ function createDaemonOsControlRunner() {
       if (!key2)
         throw new Error(`Empty key combo: "${combo}"`);
       n.keyTap(key2, modifiers);
-      log2(`key ${combo}`);
+      log3(`key ${combo}`);
     },
     // App launch (the one non-input capability the voice path needs — shells `open`)
     async appLaunch(app) {
@@ -62581,6 +62663,83 @@ function createDaemonOsControlRunner() {
 }
 
 // ../../packages/host-core/dist/gui/windows.js
+function uiFile(name) {
+  return join20(daemonUiDir(), name);
+}
+function notReady(what) {
+  throw new Error(`${what} requires the on-screen co-worker (the GUI daemon) \u2014 it isn't active. Enable it (CCB_FORCE_DAEMON_GUI=1) on a signed build.`);
+}
+var ipcWired = false;
+var pendingInput = /* @__PURE__ */ new Map();
+function wireIpcOnce() {
+  const el2 = electronModule();
+  if (!el2 || ipcWired)
+    return;
+  ipcWired = true;
+  el2.ipcMain.on("input:submit", (_e, payload) => {
+    const p = payload;
+    const resolve12 = pendingInput.get(p.reqId);
+    if (resolve12) {
+      pendingInput.delete(p.reqId);
+      resolve12({ submitted: !!p.submitted, values: p.values ?? {} });
+    }
+  });
+}
+function showFormWindow(kind, payload, signal) {
+  const el2 = electronModule();
+  if (!el2)
+    notReady("Asking for input");
+  wireIpcOnce();
+  const reqId = randomUUID8();
+  const win3 = new el2.BrowserWindow({
+    width: 460,
+    height: 320,
+    transparent: true,
+    frame: false,
+    resizable: false,
+    alwaysOnTop: true,
+    skipTaskbar: true,
+    fullscreenable: false,
+    show: false,
+    webPreferences: { preload: daemonPreloadPath(), contextIsolation: true, sandbox: false }
+  });
+  win3.setAlwaysOnTop(true, "screen-saver");
+  win3.setVisibleOnAllWorkspaces(true, { visibleOnFullScreen: true });
+  void win3.loadFile(uiFile("input.html"));
+  win3.webContents.on("did-finish-load", () => {
+    win3.webContents.send(`${kind}:show`, { reqId, ...payload });
+    win3.center();
+    win3.show();
+    win3.focus();
+  });
+  return new Promise((resolve12) => {
+    let done = false;
+    const onAbort = () => finish({ submitted: false, values: {} });
+    const finish = (r) => {
+      if (done)
+        return;
+      done = true;
+      signal?.removeEventListener("abort", onAbort);
+      pendingInput.delete(reqId);
+      try {
+        if (!win3.isDestroyed())
+          win3.close();
+      } catch {
+      }
+      resolve12(r);
+    };
+    pendingInput.set(reqId, finish);
+    win3.on("closed", () => finish({ submitted: false, values: {} }));
+    if (signal?.aborted)
+      onAbort();
+    else
+      signal?.addEventListener("abort", onAbort);
+  });
+}
+async function confirmAction(spec, opts) {
+  const r = await showFormWindow("confirm", { spec }, opts?.signal);
+  return { confirmed: r.submitted };
+}
 var spotlightWin = null;
 function widgetDisplayRect() {
   return widgetDisplayBounds(spotlightWin) ?? null;
@@ -62598,15 +62757,15 @@ function widgetDisplayBounds(w) {
 }
 
 // ../../packages/host-core/dist/gui/ai-control.js
-import { join as join20, dirname as dirname9 } from "node:path";
-import { randomUUID as randomUUID8 } from "node:crypto";
+import { join as join21, dirname as dirname9 } from "node:path";
+import { randomUUID as randomUUID9 } from "node:crypto";
 init_dist4();
 var OWN_PID = process.pid;
 var runner = createDaemonOsControlRunner();
 var controlAbort = new AbortController();
 var IDLE_RELEASE_MS = 15 * 6e4;
 function uiPath(name) {
-  return join20(daemonUiDir(), name);
+  return join21(daemonUiDir(), name);
 }
 var consentWin = null;
 var pendingConsent = /* @__PURE__ */ new Map();
@@ -62616,7 +62775,7 @@ function askRdeskConsent(opts) {
     return Promise.resolve(false);
   const disp = widgetDisplayRect() ?? el2.screen.getPrimaryDisplay().bounds;
   const W = 470, H = 320;
-  const win2 = new el2.BrowserWindow({
+  const win3 = new el2.BrowserWindow({
     x: disp.x + Math.round((disp.width - W) / 2),
     y: disp.y + Math.round((disp.height - H) / 3),
     width: W,
@@ -62634,15 +62793,15 @@ function askRdeskConsent(opts) {
     backgroundColor: "#00000000",
     webPreferences: { preload: daemonPreloadPath(), contextIsolation: true, sandbox: false }
   });
-  win2.setAlwaysOnTop(true, "screen-saver");
-  win2.setVisibleOnAllWorkspaces(true, { visibleOnFullScreen: true });
-  const reqId = randomUUID8();
+  win3.setAlwaysOnTop(true, "screen-saver");
+  win3.setVisibleOnAllWorkspaces(true, { visibleOnFullScreen: true });
+  const reqId = randomUUID9();
   const who = opts.viewerName ? `\u201C${opts.viewerName}\u201D` : "Someone";
-  void win2.loadFile(uiPath("consent.html")).then(() => {
+  void win3.loadFile(uiPath("consent.html")).then(() => {
     try {
-      win2.webContents.send("consent:show", { reqId, title: "Allow remote desktop access?", body: `${who} wants to view and control this computer.` });
-      win2.show();
-      win2.focus();
+      win3.webContents.send("consent:show", { reqId, title: "Allow remote desktop access?", body: `${who} wants to view and control this computer.` });
+      win3.show();
+      win3.focus();
       el2.app.focus?.({ steal: true });
       log("rdesk: consent dialog shown");
     } catch (e) {
@@ -62657,16 +62816,16 @@ function askRdeskConsent(opts) {
       done = true;
       pendingConsent.delete(reqId);
       try {
-        if (!win2.isDestroyed())
-          win2.close();
+        if (!win3.isDestroyed())
+          win3.close();
       } catch {
       }
-      if (consentWin === win2)
+      if (consentWin === win3)
         consentWin = null;
       resolve12(r.ok);
     };
     pendingConsent.set(reqId, finish);
-    win2.on("closed", () => finish({ ok: false, remember: false }));
+    win3.on("closed", () => finish({ ok: false, remember: false }));
     setTimeout(() => finish({ ok: false, remember: false }), 6e4);
   });
 }
@@ -62676,7 +62835,7 @@ var MOONDREAM_URL = (process.env.CCB_MOONDREAM_URL?.trim() || "http://127.0.0.1:
 // ../../packages/host-core/dist/voice-control.js
 init_base_paths();
 import { existsSync as existsSync10, readFileSync as readFileSync12 } from "node:fs";
-import { basename as basename2, join as join21 } from "node:path";
+import { basename as basename2, join as join22 } from "node:path";
 
 // ../../packages/voice-core/dist/providers/tool-adapters.js
 function toELClientTool(t) {
@@ -62936,7 +63095,7 @@ async function createElevenLabsAgent(args) {
 }
 
 // ../../packages/voice-core/dist/orchestrator.js
-import { randomUUID as randomUUID9 } from "node:crypto";
+import { randomUUID as randomUUID10 } from "node:crypto";
 
 // ../../packages/voice-core/dist/summarizer.js
 var TURN_SYSTEM = [
@@ -63294,7 +63453,7 @@ Additional context: ${context}` : task;
     this.emitFocusedState();
     const sessionId = track.sessionId || void 0;
     this.deps.emit({ type: "voice:dispatched", text: message, sessionId });
-    const clientRequestId = randomUUID9();
+    const clientRequestId = randomUUID10();
     track.pendingClientRequestId = clientRequestId;
     try {
       const sid = await this.deps.agent.dispatch({ message, clientRequestId, sessionId });
@@ -63327,7 +63486,7 @@ Additional context: ${context}` : task;
     this.emitFocusedState();
     const sessionId = track.sessionId || void 0;
     this.deps.emit({ type: "voice:dispatched", text: message, sessionId });
-    const clientRequestId = randomUUID9();
+    const clientRequestId = randomUUID10();
     track.pendingClientRequestId = clientRequestId;
     try {
       const sid = await this.deps.agent.dispatch({ message, clientRequestId, sessionId });
@@ -63350,7 +63509,7 @@ Additional context: ${context}` : task;
     this.voice?.respondToTool(inv.callId, "Got it \u2014 passing that along.");
     this.focusTrack(track);
     this.deps.emit({ type: "voice:dispatched", text: addendum, sessionId: track.sessionId });
-    const clientRequestId = randomUUID9();
+    const clientRequestId = randomUUID10();
     track.pendingClientRequestId = clientRequestId;
     try {
       await this.deps.agent.dispatch({ message: addendum, sessionId: track.sessionId, clientRequestId });
@@ -63388,7 +63547,7 @@ Additional context: ${context}` : task;
       this.voice?.respondToTool(inv.callId, "Got it \u2014 passing that along.");
       this.focusTrack(track);
       this.deps.emit({ type: "voice:dispatched", text: answer, sessionId: track.sessionId });
-      const clientRequestId = randomUUID9();
+      const clientRequestId = randomUUID10();
       track.pendingClientRequestId = clientRequestId;
       void this.deps.agent.dispatch({ message: answer, sessionId: track.sessionId, clientRequestId }).catch((err2) => this.say(`I couldn't send that: ${errMsg(err2)}.`, { urgent: true }));
       track.state = "working";
@@ -63921,7 +64080,7 @@ async function mintOpenAi(apiKey, model, voice) {
 function readGeminiKeyFile() {
   try {
     const home = tesseractHome();
-    const f = join21(home, "daemon", "gemini.key");
+    const f = join22(home, "daemon", "gemini.key");
     if (existsSync10(f)) {
       const k = readFileSync12(f, "utf-8").trim();
       if (k)
@@ -64345,9 +64504,9 @@ import { mkdirSync as mkdirSync14 } from "node:fs";
 
 // ../../packages/host-core/dist/image-gen-runner.js
 init_base_paths();
-import { randomUUID as randomUUID10 } from "node:crypto";
+import { randomUUID as randomUUID11 } from "node:crypto";
 import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync10, readFileSync as readFileSync13 } from "node:fs";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 
 // ../../packages/image-edit-core/dist/transparent.js
 var import_fast_png = __toESM(require_lib(), 1);
@@ -64552,8 +64711,8 @@ var ImageEditError = class extends Error {
 function toBase64(bytes2) {
   return Buffer.from(bytes2).toString("base64");
 }
-function fromBase64(b64) {
-  return new Uint8Array(Buffer.from(b64, "base64"));
+function fromBase64(b642) {
+  return new Uint8Array(Buffer.from(b642, "base64"));
 }
 function toBlob(img) {
   return new Blob([img.bytes], { type: img.mime });
@@ -64694,7 +64853,7 @@ var OpenAiImageProvider = class {
     if (!res.ok) {
       throw new ImageEditError(json2.error?.message ?? `OpenAI request failed (${res.status})`, this.id, res.status);
     }
-    const out = (json2.data ?? []).map((d) => d.b64_json).filter((b) => !!b).map((b64) => ({ bytes: fromBase64(b64), mime: "image/png" }));
+    const out = (json2.data ?? []).map((d) => d.b64_json).filter((b) => !!b).map((b642) => ({ bytes: fromBase64(b642), mime: "image/png" }));
     if (!out.length)
       throw new ImageEditError("OpenAI returned no image", this.id, res.status);
     return out;
@@ -64723,10 +64882,10 @@ var OpenAiImageProvider = class {
     if (!res.ok) {
       throw new ImageEditError(json2.error?.message ?? `OpenAI request failed (${res.status})`, this.id, res.status);
     }
-    const b64 = json2.data?.[0]?.b64_json;
-    if (!b64)
+    const b642 = json2.data?.[0]?.b64_json;
+    if (!b642)
       throw new ImageEditError("OpenAI returned no image", this.id, res.status);
-    return { bytes: fromBase64(b64), mime: "image/png" };
+    return { bytes: fromBase64(b642), mime: "image/png" };
   }
 };
 
@@ -64802,7 +64961,7 @@ function createImageEditProvider(id, cfg2) {
 // ../../packages/host-core/dist/image-gen-runner.js
 function generatedImagesDir() {
   const home = tesseractHome();
-  return join22(home, "generated-images");
+  return join23(home, "generated-images");
 }
 function creds() {
   return readDaemonAgentSettings().imageGen;
@@ -64854,11 +65013,11 @@ function createDaemonImageGenRunner() {
         });
         if (!images.length)
           return { ok: false, error: "The provider returned no image." };
-        const dir2 = req.outDir ?? join22(generatedImagesDir(), randomUUID10());
+        const dir2 = req.outDir ?? join23(generatedImagesDir(), randomUUID11());
         mkdirSync9(dir2, { recursive: true });
         const files = images.map((img, i) => {
           const ext = img.mime.split("/")[1]?.split("+")[0] || "png";
-          const path6 = join22(dir2, `${i + 1}.${ext}`);
+          const path6 = join23(dir2, `${i + 1}.${ext}`);
           writeFileSync10(path6, img.bytes);
           return { path: path6, mime: img.mime };
         });
@@ -64908,8 +65067,8 @@ var VideoGenError = class extends Error {
 function toBase642(bytes2) {
   return Buffer.from(bytes2).toString("base64");
 }
-function fromBase642(b64) {
-  return new Uint8Array(Buffer.from(b64, "base64"));
+function fromBase642(b642) {
+  return new Uint8Array(Buffer.from(b642, "base64"));
 }
 
 // ../../packages/video-core/dist/gemini.js
@@ -66270,11 +66429,11 @@ function createVideoProvider(id, cfg2) {
 init_base_paths();
 import { mkdirSync as mkdirSync10, readdirSync as readdirSync4, readFileSync as readFileSync14, writeFileSync as writeFileSync11, rmSync as rmSync3 } from "node:fs";
 import { mkdir as mkdir5, writeFile as writeFile6 } from "node:fs/promises";
-import { dirname as dirname10, join as join23 } from "node:path";
-import { randomUUID as randomUUID11 } from "node:crypto";
+import { dirname as dirname10, join as join24 } from "node:path";
+import { randomUUID as randomUUID12 } from "node:crypto";
 function mediaJobsDir() {
   const home = tesseractHome();
-  return join23(home, "media-jobs");
+  return join24(home, "media-jobs");
 }
 var TERMINAL = /* @__PURE__ */ new Set(["succeeded", "failed", "canceled"]);
 var POLL_MS2 = 1e4;
@@ -66291,8 +66450,8 @@ var VideoJobRegistry = class {
   /** Submit a spec and start tracking it. Returns the persisted record. */
   async submit(provider, spec, meta4) {
     const handle3 = await provider.submit(spec);
-    const id = randomUUID11();
-    const outDir = meta4.outDir ?? join23(mediaJobsDir(), id);
+    const id = randomUUID12();
+    const outDir = meta4.outDir ?? join24(mediaJobsDir(), id);
     const job = {
       id,
       sessionId: meta4.sessionId,
@@ -66305,7 +66464,7 @@ var VideoJobRegistry = class {
       resolution: spec.resolution ?? "720p",
       estimateUsd: meta4.estimateUsd,
       state: "running",
-      outPath: join23(outDir, "video.mp4"),
+      outPath: join24(outDir, "video.mp4"),
       createdAt: Date.now(),
       updatedAt: Date.now()
     };
@@ -66319,7 +66478,7 @@ var VideoJobRegistry = class {
     if (mem)
       return { ...mem };
     try {
-      const raw = readFileSync14(join23(mediaJobsDir(), `${jobId}.json`), "utf-8");
+      const raw = readFileSync14(join24(mediaJobsDir(), `${jobId}.json`), "utf-8");
       return JSON.parse(raw);
     } catch {
       return null;
@@ -66369,7 +66528,7 @@ var VideoJobRegistry = class {
     }
     const now2 = Date.now();
     for (const f of files) {
-      const fp = join23(mediaJobsDir(), f);
+      const fp = join24(mediaJobsDir(), f);
       try {
         const job = JSON.parse(readFileSync14(fp, "utf-8"));
         if (TERMINAL.has(job.state)) {
@@ -66492,7 +66651,7 @@ var VideoJobRegistry = class {
     this.jobs.set(job.id, job);
     try {
       mkdirSync10(mediaJobsDir(), { recursive: true });
-      writeFileSync11(join23(mediaJobsDir(), `${job.id}.json`), JSON.stringify(job, null, 2));
+      writeFileSync11(join24(mediaJobsDir(), `${job.id}.json`), JSON.stringify(job, null, 2));
     } catch {
     }
   }
@@ -66646,15 +66805,15 @@ function createDaemonVideoGenRunner() {
 init_base_paths();
 import { existsSync as existsSync13, readFileSync as readFileSync20 } from "node:fs";
 import { mkdir as mkdir6, writeFile as writeFile7 } from "node:fs/promises";
-import { join as join27, basename as basename4 } from "node:path";
-import { randomUUID as randomUUID13 } from "node:crypto";
+import { join as join28, basename as basename4 } from "node:path";
+import { randomUUID as randomUUID14 } from "node:crypto";
 
 // ../../packages/host-core/dist/video-edit.js
 init_base_paths();
 import { spawn as spawn7 } from "node:child_process";
 import { mkdirSync as mkdirSync11, readFileSync as readFileSync16, rmSync as rmSync4, writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join24, isAbsolute as isAbsolute4 } from "node:path";
-import { randomUUID as randomUUID12 } from "node:crypto";
+import { join as join25, isAbsolute as isAbsolute4 } from "node:path";
+import { randomUUID as randomUUID13 } from "node:crypto";
 
 // ../../packages/host-core/dist/ffmpeg.js
 import { existsSync as existsSync11 } from "node:fs";
@@ -66718,9 +66877,9 @@ function requireAbsolutePath(p, label = "path") {
   const raw = typeof p === "string" ? p.trim() : "";
   if (!raw)
     throw new Error(`${label} is required.`);
-  const expanded = raw === "~" ? userHome() : raw.startsWith("~/") || raw.startsWith("~\\") ? join24(userHome(), raw.slice(2)) : raw;
+  const expanded = raw === "~" ? userHome() : raw.startsWith("~/") || raw.startsWith("~\\") ? join25(userHome(), raw.slice(2)) : raw;
   if (!isAbsolute4(expanded)) {
-    throw new Error(`${label} must be an ABSOLUTE path (got "${raw}"). A relative path would be resolved against the background service's own directory, not your project, so it could silently act on the wrong file. Pass the full path, e.g. ${join24(userHome(), "Movies", "clip.mp4")}.`);
+    throw new Error(`${label} must be an ABSOLUTE path (got "${raw}"). A relative path would be resolved against the background service's own directory, not your project, so it could silently act on the wrong file. Pass the full path, e.g. ${join25(userHome(), "Movies", "clip.mp4")}.`);
   }
   return expanded;
 }
@@ -66734,7 +66893,7 @@ function mediaSpawnCwd() {
 }
 var workDir = () => {
   const home = tesseractHome();
-  const dir2 = join24(home, "media-work", randomUUID12());
+  const dir2 = join25(home, "media-work", randomUUID13());
   mkdirSync11(dir2, { recursive: true });
   return dir2;
 };
@@ -66826,10 +66985,10 @@ async function renderEdl(edl, opts) {
   const dir2 = opts.outDir ?? workDir();
   mkdirSync11(dir2, { recursive: true });
   const format = edl.output?.format ?? "mp4";
-  const outPath = join24(dir2, `edit.${format}`);
+  const outPath = join25(dir2, `edit.${format}`);
   let assFile;
   if (edl.captions?.cues.length) {
-    assFile = join24(dir2, "captions.ass");
+    assFile = join25(dir2, "captions.ass");
     const W = edl.output?.width ?? 1920;
     const H = edl.output?.height ?? 1080;
     writeFileSync12(assFile, buildAssSubtitles(edl.captions.cues, edl.captions.style ?? "tiktok-bold", W, H));
@@ -66899,7 +67058,7 @@ async function enhanceVideo(path6, spec, opts) {
   }
   const dir2 = opts?.outDir ?? workDir();
   mkdirSync11(dir2, { recursive: true });
-  const outPath = join24(dir2, "enhanced.mp4");
+  const outPath = join25(dir2, "enhanced.mp4");
   const audioArgs = probe.hasAudio ? ["-c:a", "copy"] : ["-an"];
   const args = [
     "-i",
@@ -66979,7 +67138,7 @@ async function extractFrames(path6, timestamps, outDir) {
   mkdirSync11(dir2, { recursive: true });
   const out = [];
   for (const [i, ts] of timestamps.slice(0, 20).entries()) {
-    const file2 = join24(dir2, `frame-${i + 1}-${Math.round(ts * 1e3)}ms.jpg`);
+    const file2 = join25(dir2, `frame-${i + 1}-${Math.round(ts * 1e3)}ms.jpg`);
     const r = await run(resolveFfmpeg(), ["-y", "-ss", String(Math.max(0, ts)), "-i", path6, "-frames:v", "1", "-q:v", "2", file2]);
     if (!r.ok)
       throw new Error(`Frame extraction at ${ts}s failed: ${r.stderr.slice(-300)}`);
@@ -67012,7 +67171,7 @@ async function extractAudio(path6, format, outDir, opts) {
   path6 = requireAbsolutePath(path6, "path");
   const dir2 = outDir ?? workDir();
   mkdirSync11(dir2, { recursive: true });
-  const out = join24(dir2, `audio.${format}`);
+  const out = join25(dir2, `audio.${format}`);
   const codec2 = format === "mp3" ? ["-c:a", "libmp3lame", "-q:a", "2"] : format === "wav" ? ["-c:a", "pcm_s16le"] : ["-c:a", "aac", "-b:a", "192k"];
   const gain = opts?.gainDb ? ["-af", `volume=${opts.gainDb}dB`] : [];
   const r = await run(resolveFfmpeg(), ["-y", "-i", path6, "-vn", ...gain, ...codec2, out], { timeoutMs: LONG_TIMEOUT_MS });
@@ -67028,7 +67187,7 @@ async function isolateSpeakerAudio(path6, windows2, outDir) {
   const enable = merged.map((w) => `between(t,${w.startSec},${w.endSec})`).join("+");
   const dir2 = outDir ?? workDir();
   mkdirSync11(dir2, { recursive: true });
-  const out = join24(dir2, "speaker.m4a");
+  const out = join25(dir2, "speaker.m4a");
   const r = await run(resolveFfmpeg(), ["-y", "-i", path6, "-vn", "-af", `volume=enable='1-min(1,${enable})':volume=0`, "-c:a", "aac", "-b:a", "192k", out], {
     timeoutMs: LONG_TIMEOUT_MS
   });
@@ -67059,7 +67218,7 @@ async function extractAudioChunks(path6, opts) {
   const chunks = [];
   try {
     for (let start3 = 0, i = 0; start3 < total; start3 += chunkSec, i++) {
-      const out = join24(chunkDir, `chunk-${i}.m4a`);
+      const out = join25(chunkDir, `chunk-${i}.m4a`);
       const len = Math.min(chunkSec + overlapSec, total - start3);
       const r = await run(resolveFfmpeg(), ["-y", "-ss", String(start3), "-t", String(len), "-i", path6, "-vn", "-c:a", "aac", "-b:a", "64k", "-ac", "1", out], {
         timeoutMs: LONG_TIMEOUT_MS
@@ -67088,7 +67247,7 @@ function readChunkBase64(path6) {
 init_base_paths();
 import { spawn as spawn8 } from "node:child_process";
 import { existsSync as existsSync12, mkdirSync as mkdirSync12, readFileSync as readFileSync17, readdirSync as readdirSync5 } from "node:fs";
-import { join as join25, dirname as dirname11 } from "node:path";
+import { join as join26, dirname as dirname11 } from "node:path";
 var upscaleCwd;
 function upscaleSpawnCwd() {
   if (!upscaleCwd) {
@@ -67104,12 +67263,12 @@ function resolveRealesrgan() {
   const candidates = [
     envBin,
     // Packaged app: extraResources → Resources/vendor/realesrgan/<plat>/…
-    process.resourcesPath ? join25(process.resourcesPath, "vendor", "realesrgan", platDir, exe) : void 0
+    process.resourcesPath ? join26(process.resourcesPath, "vendor", "realesrgan", platDir, exe) : void 0
   ].filter((p) => !!p && existsSync12(p));
   const bin = candidates[0] ?? fromPath2("realesrgan-ncnn-vulkan");
   if (!bin)
     return null;
-  const models = process.env.TESSERACT_REALESRGAN_MODELS?.trim() || join25(dirname11(bin), "models");
+  const models = process.env.TESSERACT_REALESRGAN_MODELS?.trim() || join26(dirname11(bin), "models");
   return existsSync12(models) ? { bin, models } : null;
 }
 function fromPath2(cmd) {
@@ -67132,8 +67291,8 @@ function installedRealesrModels() {
     return [];
   return REALESRGAN_MODELS.filter((m) => {
     if (m.scales.length > 1)
-      return m.scales.some((s) => existsSync12(join25(re.models, `${m.id}-x${s}.bin`)));
-    return existsSync12(join25(re.models, `${m.id}.bin`));
+      return m.scales.some((s) => existsSync12(join26(re.models, `${m.id}-x${s}.bin`)));
+    return existsSync12(join26(re.models, `${m.id}.bin`));
   }).map((m) => m.id);
 }
 function upscaleAdvert() {
@@ -67152,7 +67311,7 @@ async function realesrganGpuWorks() {
   }
   try {
     const dir2 = workDir();
-    const inP = join25(dir2, "p.png"), outP = join25(dir2, "p2.png");
+    const inP = join26(dir2, "p.png"), outP = join26(dir2, "p2.png");
     const gen = await run(resolveFfmpeg(), ["-y", "-f", "lavfi", "-i", "testsrc=size=64x64:duration=1", "-frames:v", "1", inP], { timeoutMs: 15e3 });
     if (!gen.ok || !existsSync12(inP)) {
       gpuProbe = false;
@@ -67191,7 +67350,7 @@ async function upscaleCapabilities(opts) {
 }
 function resolveFalKey() {
   const home = tesseractHome();
-  const file2 = join25(home, "daemon", "fal.key");
+  const file2 = join26(home, "daemon", "fal.key");
   if (existsSync12(file2)) {
     const k = readFileSync17(file2, "utf-8").trim();
     if (k)
@@ -67239,19 +67398,19 @@ async function realesrganUpscale(path6, opts) {
   const model = opts.model ?? "realesr-animevideov3";
   const scale = opts.scale ?? 2;
   const dir2 = opts.outDir ?? workDir();
-  const fin = join25(dir2, "in"), fup = join25(dir2, "up");
+  const fin = join26(dir2, "in"), fup = join26(dir2, "up");
   mkdirSync12(fin, { recursive: true });
   mkdirSync12(fup, { recursive: true });
   const fps = p.fps ?? 30;
   const src = path6;
   let extractSrc = src;
   if (opts.restore && Object.keys(opts.restore).length) {
-    const cleaned = await enhanceVideo(src, { ...opts.restore, sharpen: opts.restore.sharpen ?? "none" }, { outDir: join25(dir2, "restore") }).catch(() => null);
+    const cleaned = await enhanceVideo(src, { ...opts.restore, sharpen: opts.restore.sharpen ?? "none" }, { outDir: join26(dir2, "restore") }).catch(() => null);
     if (cleaned)
       extractSrc = cleaned.path;
   }
   opts.onProgress?.(2, "Extracting frames\u2026");
-  const ext = await run(resolveFfmpeg(), ["-i", extractSrc, "-fps_mode", "passthrough", join25(fin, "f%08d.png")], { timeoutMs: LONG });
+  const ext = await run(resolveFfmpeg(), ["-i", extractSrc, "-fps_mode", "passthrough", join26(fin, "f%08d.png")], { timeoutMs: LONG });
   if (!ext.ok)
     throw new Error(`Frame extraction failed: ${ext.stderr.slice(-300)}`);
   const nFrames = readdirSync5(fin).filter((f) => f.endsWith(".png")).length;
@@ -67277,14 +67436,14 @@ async function realesrganUpscale(path6, opts) {
     });
   });
   opts.onProgress?.(96, "Reassembling\u2026");
-  const outPath = join25(dir2, "enhanced.mp4");
+  const outPath = join26(dir2, "enhanced.mp4");
   const vf = opts.targetHeight ? `scale=w=-2:h=${Math.round(opts.targetHeight / 2) * 2}:flags=lanczos` : "null";
   const audio = p.hasAudio ? ["-i", src, "-map", "0:v:0", "-map", "1:a:0?", "-c:a", "copy"] : [];
   const asm = await run(resolveFfmpeg(), [
     "-r",
     String(fps),
     "-i",
-    join25(fup, "f%08d.png"),
+    join26(fup, "f%08d.png"),
     ...audio,
     "-vf",
     vf,
@@ -67336,7 +67495,7 @@ async function falTopazEnhance(path6, spec, opts) {
     throw new Error(`Downloading the fal result failed (HTTP ${dl.status}).`);
   const dir2 = opts.outDir ?? workDir();
   mkdirSync12(dir2, { recursive: true });
-  const outPath = join25(dir2, "enhanced.mp4");
+  const outPath = join26(dir2, "enhanced.mp4");
   const { writeFileSync: writeFileSync29 } = await import("node:fs");
   writeFileSync29(outPath, Buffer.from(await dl.arrayBuffer()));
   const out = await probeMedia(outPath).catch(() => null);
@@ -67382,7 +67541,7 @@ async function smartEnhance(path6, args) {
 
 // ../../packages/host-core/dist/video-effects.js
 import { readFileSync as readFileSync18, mkdirSync as mkdirSync13, writeFileSync as writeFileSync13 } from "node:fs";
-import { join as join26, basename as basename3, extname } from "node:path";
+import { join as join27, basename as basename3, extname } from "node:path";
 var IMG_MIME = { jpg: "image/jpeg", jpeg: "image/jpeg", png: "image/png", webp: "image/webp", heic: "image/heic" };
 var LONG2 = 6e5;
 function listEffects() {
@@ -67469,7 +67628,7 @@ async function applyEffect(effectId, inputs, opts) {
   const dir2 = opts?.outDir ?? workDir();
   mkdirSync13(dir2, { recursive: true });
   const ext = media.isVideo ? "mp4" : extname(new URL(media.url).pathname).slice(1) || "png";
-  const outPath = join26(dir2, `${effectId}.${ext}`);
+  const outPath = join27(dir2, `${effectId}.${ext}`);
   writeFileSync13(outPath, Buffer.from(await dl.arrayBuffer()));
   opts?.onProgress?.(100, "Done");
   return { path: outPath, mime: media.isVideo ? "video/mp4" : IMG_MIME[ext] ?? "image/png", isVideo: media.isVideo, effectId, label: def.label };
@@ -67495,7 +67654,7 @@ ${inputs.prompt}` : "");
   const out = await runImageEdit(provider, { op: "prompt", imageB64: readFileSync18(imgPath).toString("base64"), mime: IMG_MIME[ext] ?? "image/jpeg", prompt });
   const dir2 = opts?.outDir ?? workDir();
   mkdirSync13(dir2, { recursive: true });
-  const outPath = join26(dir2, `${def.id}.png`);
+  const outPath = join27(dir2, `${def.id}.png`);
   writeFileSync13(outPath, Buffer.from(out.bytes));
   opts?.onProgress?.(100, "Done");
   return { path: outPath, mime: out.mime || "image/png", isVideo: false, effectId: def.id, label: def.label };
@@ -67620,13 +67779,13 @@ var MODEL = "gemini-3.5-flash";
 var TIMEOUT_MS = 6e4;
 async function reviewFrameGemini(framePath, intent, apiKey) {
   try {
-    const b64 = readFileSync19(framePath).toString("base64");
+    const b642 = readFileSync19(framePath).toString("base64");
     const prompt = `This is a frame from an AI-generated video clip meant to show: "${intent}". Judge ONLY for obvious defects: melted/warped faces or hands, garbled text, broken anatomy, severe artifacts. Reply with STRICT JSON: {"acceptable": <true|false>, "note": "<\u226412 words, only if not acceptable>"}.`;
     const res = await fetch(`${BASE_URL4}/models/${MODEL}:generateContent`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "x-goog-api-key": apiKey },
       body: JSON.stringify({
-        contents: [{ role: "user", parts: [{ text: prompt }, { inlineData: { mimeType: "image/jpeg", data: b64 } }] }],
+        contents: [{ role: "user", parts: [{ text: prompt }, { inlineData: { mimeType: "image/jpeg", data: b642 } }] }],
         generationConfig: { temperature: 0, responseMimeType: "application/json" }
       }),
       signal: AbortSignal.timeout(TIMEOUT_MS)
@@ -67656,7 +67815,7 @@ function heygenKey() {
 function readDaemonKeyFile(name) {
   try {
     const home = tesseractHome();
-    const f = join27(home, "daemon", name);
+    const f = join28(home, "daemon", name);
     if (existsSync13(f)) {
       const k = readFileSync20(f, "utf-8").trim();
       if (k)
@@ -67670,7 +67829,7 @@ var HEYGEN_POLL_MS = 8e3;
 var HEYGEN_MAX_MS = 8 * 6e4;
 function musicDir() {
   const home = tesseractHome();
-  return join27(home, "generated-music");
+  return join28(home, "generated-music");
 }
 function audioMimeForPath(p) {
   const lower = p.toLowerCase();
@@ -67786,10 +67945,10 @@ function createDaemonVideoEditRunner() {
         return { ok: false, error: "Music generation needs an ElevenLabs key \u2014 ask the user to add one in Settings \u2192 Voice." };
       try {
         const music = await generateMusicElevenLabs({ prompt, durationSec }, { apiKey });
-        const dir2 = outDir ?? join27(musicDir(), randomUUID13());
+        const dir2 = outDir ?? join28(musicDir(), randomUUID14());
         await mkdir6(dir2, { recursive: true });
         const ext = music.mime.includes("wav") ? "wav" : music.mime.includes("mp4") ? "m4a" : "mp3";
-        const path6 = join27(dir2, `music.${ext}`);
+        const path6 = join28(dir2, `music.${ext}`);
         await writeFile7(path6, music.bytes);
         return { ok: true, file: { path: path6, mime: music.mime } };
       } catch (e) {
@@ -67857,9 +68016,9 @@ function createDaemonVideoEditRunner() {
             if (!poll.videoUrl)
               return { ok: false, error: "HeyGen reported the render complete but returned no video URL." };
             const dl = await downloadHeyGenVideo(poll.videoUrl);
-            const dir2 = outDir ?? join27(musicDir(), randomUUID13());
+            const dir2 = outDir ?? join28(musicDir(), randomUUID14());
             await mkdir6(dir2, { recursive: true });
-            const path6 = join27(dir2, "avatar.mp4");
+            const path6 = join28(dir2, "avatar.mp4");
             await writeFile7(path6, dl.bytes);
             return { ok: true, file: { path: path6, mime: dl.mime } };
           }
@@ -67877,9 +68036,9 @@ function createDaemonVideoEditRunner() {
         return { ok: false, error: "Text-to-speech needs an ElevenLabs key (Settings \u2192 Voice)." };
       try {
         const audio = await synthesizeSpeechElevenLabs(text8, voiceId, { apiKey, stability: opts?.stability, similarityBoost: opts?.similarityBoost, speed: opts?.speed });
-        const dir2 = outDir ?? join27(musicDir(), randomUUID13());
+        const dir2 = outDir ?? join28(musicDir(), randomUUID14());
         await mkdir6(dir2, { recursive: true });
-        const path6 = join27(dir2, "speech.mp3");
+        const path6 = join28(dir2, "speech.mp3");
         await writeFile7(path6, audio.bytes);
         return { ok: true, file: { path: path6, mime: audio.mime } };
       } catch (e) {
@@ -67913,7 +68072,7 @@ function createDaemonVideoEditRunner() {
 
 // ../../packages/host-core/dist/support-submit.js
 import { openSync as openSync3, fstatSync, readSync as readSync2, closeSync as closeSync3 } from "node:fs";
-import { join as join28 } from "node:path";
+import { join as join29 } from "node:path";
 
 // ../../packages/host-core/dist/host-metrics.js
 import os from "node:os";
@@ -67976,7 +68135,7 @@ function createDaemonSupportSubmit() {
     if (!creds3) {
       throw new Error("Not signed in on this machine \u2014 sign in (or share this machine) to file a report from chat.");
     }
-    const daemonLog = tail2(join28(daemonDir2(), "daemon.log"));
+    const daemonLog = tail2(join29(daemonDir2(), "daemon.log"));
     const diagnostics = {
       collectedAt: (/* @__PURE__ */ new Date()).toISOString(),
       source: "daemon",
@@ -68018,12 +68177,12 @@ function createDaemonSupportSubmit() {
 init_dist4();
 
 // ../../packages/host-core/dist/app-control-bridge.js
-import { randomUUID as randomUUID14 } from "node:crypto";
+import { randomUUID as randomUUID15 } from "node:crypto";
 var DEFAULT_APP_REQUEST_TIMEOUT_MS = 2e4;
 var pending = /* @__PURE__ */ new Map();
 function requestDesktopApp(emit2, origin, capabilityId, input, timeoutMs = DEFAULT_APP_REQUEST_TIMEOUT_MS, sessionId) {
   return new Promise((resolve12, reject) => {
-    const requestId = `app:${randomUUID14()}`;
+    const requestId = `app:${randomUUID15()}`;
     const timer = setTimeout(() => {
       pending.delete(requestId);
       reject(new Error("App request timed out \u2014 the Tesseract desktop app did not respond."));
@@ -68078,7 +68237,7 @@ var flushTimer = null;
 var keepalive = null;
 var gateTimer = null;
 var stageGraceTimer = null;
-var log3 = () => {
+var log4 = () => {
 };
 function snapshot() {
   if (!state)
@@ -68179,7 +68338,7 @@ function attach(sub, hello) {
   if (!accepted)
     return;
   subs.set(sub.deviceId, s);
-  log3(`[present] attach ${sub.role} ${sub.deviceId} (${sub.name})`);
+  log4(`[present] attach ${sub.role} ${sub.deviceId} (${sub.name})`);
   if (sub.role === "stage" && stageGraceTimer) {
     clearTimeout(stageGraceTimer);
     stageGraceTimer = null;
@@ -68199,7 +68358,7 @@ function detach(deviceId2) {
   if (!s)
     return;
   subs.delete(deviceId2);
-  log3(`[present] detach ${s.role} ${deviceId2}`);
+  log4(`[present] detach ${s.role} ${deviceId2}`);
   if (s.role === "stage" && state) {
     state.phase = "idle";
     if (!stageGraceTimer) {
@@ -68263,7 +68422,7 @@ function start(msg, actorId) {
   ensureKeepalive();
   lastContextIndex = -1;
   scheduleContext();
-  log3(`[present] start "${msg.deckTitle}" epoch=${epoch} slides=${slides.length}`);
+  log4(`[present] start "${msg.deckTitle}" epoch=${epoch} slides=${slides.length}`);
   for (const s of subs.values())
     sendSlides(s);
   bump();
@@ -68272,7 +68431,7 @@ function end(reason = "ended") {
   if (!presentId)
     return;
   const id = presentId;
-  log3(`[present] end (${reason})`);
+  log4(`[present] end (${reason})`);
   for (const s of subs.values()) {
     try {
       s.send({ type: "present:closed", presentId: id, reason });
@@ -68311,7 +68470,7 @@ function gotoIndex(index, by = "remote") {
     state.build = 0;
     scheduleContext();
   }
-  log3(`[present] goto ${next} by=${by}`);
+  log4(`[present] goto ${next} by=${by}`);
   return bump();
 }
 function gotoSlideId(slideId, by = "remote") {
@@ -68367,7 +68526,7 @@ function setAiListening(listening, holdMs) {
     gateTimer = setTimeout(() => {
       gateTimer = null;
       if (state?.ai.listening) {
-        log3("[present] AI input gate expired (dead-man) \u2014 closing");
+        log4("[present] AI input gate expired (dead-man) \u2014 closing");
         state.ai.listening = false;
         bump();
       }
@@ -68478,7 +68637,7 @@ function onClientFrame(deviceId2, msg, send3, meta4) {
     return;
   }
   if (!sub) {
-    log3(`[present] auto-attaching ${deviceId2} on ${msg.type} \u2014 no hello, protocol assumed v${PRESENT_PROTOCOL_VERSION}`);
+    log4(`[present] auto-attaching ${deviceId2} on ${msg.type} \u2014 no hello, protocol assumed v${PRESENT_PROTOCOL_VERSION}`);
     attach({ deviceId: deviceId2, role: meta4?.role ?? "remote", name: meta4?.name ?? deviceId2, send: send3 }, {
       presentId: msg.presentId ?? "",
       protocolVersion: PRESENT_PROTOCOL_VERSION
@@ -68976,7 +69135,7 @@ function buildSharedBackend(engineId) {
     },
     resolver,
     // Daemon plugins (review #3): operator-controlled <daemonDir>/plugins, env-var secrets.
-    buildDaemonPluginLoader(join29(daemonDir2(), "plugins"))
+    buildDaemonPluginLoader(join30(daemonDir2(), "plugins"))
   ).then((b) => {
     const sendMessage = b.sendMessage.bind(b);
     b.sendMessage = (params) => {
@@ -69083,7 +69242,7 @@ function refreshDaemonScheduling(b) {
   }
   b.configureScheduling({
     enabled,
-    file: join29(dir2, "scheduled_tasks.json"),
+    file: join30(dir2, "scheduled_tasks.json"),
     // projectDir omitted ⇒ fires track the daemon's currently-open project (setConfig).
     isOwner: schedulingLock ? () => schedulingLock.isOwner() : void 0
   });
@@ -69102,14 +69261,14 @@ var VOICE_GATEWAY = process.env.CCB_VOICE_GATEWAY !== "0";
 import { readdir as readdir3, readFile as readFile9, writeFile as writeFile8, mkdir as mkdir7, cp, rm, rename as renameAsync, stat as stat2 } from "node:fs/promises";
 import { openSync as openSync4, readSync as readSync3, writeSync, closeSync as closeSync4, statSync as statSync5, existsSync as existsSync14, mkdtempSync, rmSync as rmSync5, readFileSync as readFileSync21, readdirSync as readdirSync6, watch, realpathSync as realpathSync3, constants as fsConstants } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { basename as basename5, dirname as dirname12, join as join31, relative as relative4, resolve as resolve6, sep as sep5, isAbsolute as isAbsolute5 } from "node:path";
+import { basename as basename5, dirname as dirname12, join as join32, relative as relative4, resolve as resolve6, sep as sep5, isAbsolute as isAbsolute5 } from "node:path";
 import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
 
 // ../../packages/host-core/dist/fs-stats.js
 init_dist();
 import { readdir as readdir2, lstat, readFile as readFile8 } from "node:fs/promises";
-import { join as join30 } from "node:path";
+import { join as join31 } from "node:path";
 var TEXT_CAP = 5 * 1024 * 1024;
 async function dirStats(root, opts) {
   const start3 = Date.now();
@@ -69140,11 +69299,11 @@ async function dirStats(root, opts) {
         if (opts?.excludeHeavy && STATS_HEAVY_DIRS.has(e.name))
           continue;
         dirCount++;
-        stack.push(join30(dir2, e.name));
+        stack.push(join31(dir2, e.name));
       } else if (e.isFile()) {
         fileCount++;
         try {
-          totalBytes += (await lstat(join30(dir2, e.name))).size;
+          totalBytes += (await lstat(join31(dir2, e.name))).size;
         } catch {
         }
       }
@@ -69179,7 +69338,7 @@ async function codeStats(root) {
         continue;
       if (e.isDirectory()) {
         if (!STATS_HEAVY_DIRS.has(e.name))
-          stack.push(join30(dir2, e.name));
+          stack.push(join31(dir2, e.name));
         continue;
       }
       if (!e.isFile())
@@ -69187,7 +69346,7 @@ async function codeStats(root) {
       const lang = langForFilename(e.name);
       if (!lang)
         continue;
-      const full = join30(dir2, e.name);
+      const full = join31(dir2, e.name);
       let size = 0;
       try {
         size = (await lstat(full)).size;
@@ -69280,7 +69439,7 @@ async function listAllFilesUnder(dir2) {
           return;
         if (ent.name === ".DS_Store")
           continue;
-        const full = join31(d, ent.name);
+        const full = join32(d, ent.name);
         if (ent.isDirectory()) {
           if (!LISTALL_SKIP_DIRS.has(ent.name))
             await walk(full);
@@ -69397,18 +69556,18 @@ function resolveParent(raw, root) {
   if (raw === "" || raw === "~")
     return root;
   if (raw.startsWith("~/"))
-    return join31(root, raw.slice(2));
-  return isAbsolute5(raw) ? raw : join31(root, raw);
+    return join32(root, raw.slice(2));
+  return isAbsolute5(raw) ? raw : join32(root, raw);
 }
 function resolveUniqueName(dir2, name) {
-  const direct = join31(dir2, name);
+  const direct = join32(dir2, name);
   if (!existsSync14(direct))
     return direct;
   const dot = name.lastIndexOf(".");
   const base = dot > 0 ? name.slice(0, dot) : name;
   const ext = dot > 0 ? name.slice(dot) : "";
   for (let i = 2; i < 1e4; i++) {
-    const candidate = join31(dir2, `${base} ${i}${ext}`);
+    const candidate = join32(dir2, `${base} ${i}${ext}`);
     if (!existsSync14(candidate))
       return candidate;
   }
@@ -69481,12 +69640,12 @@ async function renderThumbnailImpl(real, maxPx) {
     return { error: "Thumbnails are only available on macOS hosts." };
   let dir2 = null;
   try {
-    dir2 = mkdtempSync(join31(tmpdir3(), "fp-thumb-"));
+    dir2 = mkdtempSync(join32(tmpdir3(), "fp-thumb-"));
     await execFileAsync("qlmanage", ["-t", "-s", String(maxPx), "-o", dir2, real], { timeout: 1e4, killSignal: "SIGKILL" }).catch(() => void 0);
     const produced = readdirSync6(dir2).find((f) => f.toLowerCase().endsWith(".png"));
     if (!produced)
       return { error: "No thumbnail available." };
-    return { png: readFileSync21(join31(dir2, produced)).toString("base64") };
+    return { png: readFileSync21(join32(dir2, produced)).toString("base64") };
   } catch (err2) {
     return { error: String(err2.message) };
   } finally {
@@ -69526,7 +69685,7 @@ var MAX_STAT_PATHS = 4096;
 var SAFE_SEG = /^[A-Za-z0-9._-]+$/;
 var TRASH_RETENTION_MS = 14 * 24 * 60 * 60 * 1e3;
 function pruneTrash(root) {
-  const trashDir = join31(root, TRASH_DIR);
+  const trashDir = join32(root, TRASH_DIR);
   if (!existsSync14(trashDir))
     return;
   const cutoff = Date.now() - TRASH_RETENTION_MS;
@@ -69535,9 +69694,9 @@ function pruneTrash(root) {
       if (!e.isDirectory())
         continue;
       try {
-        const meta4 = JSON.parse(readFileSync21(join31(trashDir, e.name, ".fp-meta.json"), "utf-8"));
+        const meta4 = JSON.parse(readFileSync21(join32(trashDir, e.name, ".fp-meta.json"), "utf-8"));
         if ((meta4.deletedAt ?? 0) < cutoff)
-          rmSync5(join31(trashDir, e.name), { recursive: true, force: true });
+          rmSync5(join32(trashDir, e.name), { recursive: true, force: true });
       } catch {
       }
     }
@@ -69563,12 +69722,12 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
         return entries.map((e) => {
           let id = null;
           try {
-            id = statId(join31(real, e.name));
+            id = statId(join32(real, e.name));
           } catch {
           }
           return {
             name: e.name,
-            path: join31(dir2, e.name),
+            path: join32(dir2, e.name),
             isDir: e.isDirectory(),
             ignored: ignored.has(e.name),
             size: id?.size,
@@ -69735,7 +69894,7 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
       const name = String(a[1] ?? "").trim();
       if (!validName(name))
         return { ok: false, error: "Invalid project name." };
-      const target = join31(parent, name);
+      const target = join32(parent, name);
       if (!insideOk(target))
         return { ok: false, error: "Refusing to create a project outside the shared root." };
       if (existsSync14(target))
@@ -69753,7 +69912,7 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
       const name = String(a[1] ?? "").trim();
       if (!validName(name))
         return { ok: false, error: "Invalid name." };
-      const target = join31(parent, name);
+      const target = join32(parent, name);
       if (!insideOk(target))
         return OUTSIDE("create");
       if (existsSync14(target))
@@ -69775,7 +69934,7 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
         return { ok: false, error: "Invalid name." };
       if (!insideOk(oldPath))
         return OUTSIDE("rename");
-      const newPath = join31(dirname12(oldPath), newName);
+      const newPath = join32(dirname12(oldPath), newName);
       if (existsSync14(newPath))
         return { ok: false, error: `A file named "${newName}" already exists.` };
       try {
@@ -69809,19 +69968,19 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
       try {
         pruneTrash(root);
         const id = `${Date.now().toString(36)}-${(trashSeq++).toString(36)}`;
-        const itemDir = join31(root, TRASH_DIR, id);
+        const itemDir = join32(root, TRASH_DIR, id);
         await mkdir7(itemDir, { recursive: true });
         const name = basename5(p);
-        const trashedPath = join31(itemDir, name);
+        const trashedPath = join32(itemDir, name);
         await moveItem(p, trashedPath);
-        await writeFile8(join31(itemDir, ".fp-meta.json"), JSON.stringify({ originalPath: resolve6(p), name, deletedAt: Date.now() }));
+        await writeFile8(join32(itemDir, ".fp-meta.json"), JSON.stringify({ originalPath: resolve6(p), name, deletedAt: Date.now() }));
         return { ok: true, trashId: id, path: trashedPath };
       } catch (err2) {
         return { ok: false, error: String(err2.message) };
       }
     }
     case "listTrash": {
-      const trashDir = join31(root, TRASH_DIR);
+      const trashDir = join32(root, TRASH_DIR);
       if (!existsSync14(trashDir))
         return [];
       try {
@@ -69830,8 +69989,8 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
           if (!e.isDirectory())
             continue;
           try {
-            const meta4 = JSON.parse(readFileSync21(join31(trashDir, e.name, ".fp-meta.json"), "utf-8"));
-            out.push({ trashId: e.name, name: meta4.name, path: join31(trashDir, e.name, meta4.name), originalPath: meta4.originalPath, deletedAt: meta4.deletedAt });
+            const meta4 = JSON.parse(readFileSync21(join32(trashDir, e.name, ".fp-meta.json"), "utf-8"));
+            out.push({ trashId: e.name, name: meta4.name, path: join32(trashDir, e.name, meta4.name), originalPath: meta4.originalPath, deletedAt: meta4.deletedAt });
           } catch {
           }
         }
@@ -69844,14 +70003,14 @@ async function runRemoteFsOp(root, op, args, quotaKey) {
       const id = String(a[0] ?? "");
       if (!SAFE_SEG.test(id))
         return { ok: false, error: "Bad trash id." };
-      const itemDir = join31(root, TRASH_DIR, id);
+      const itemDir = join32(root, TRASH_DIR, id);
       if (!existsSync14(itemDir))
         return { ok: false, error: "Not in trash." };
       try {
-        const meta4 = JSON.parse(readFileSync21(join31(itemDir, ".fp-meta.json"), "utf-8"));
+        const meta4 = JSON.parse(readFileSync21(join32(itemDir, ".fp-meta.json"), "utf-8"));
         if (!validName(meta4.name))
           return { ok: false, error: "Bad trashed name." };
-        const src = join31(itemDir, meta4.name);
+        const src = join32(itemDir, meta4.name);
         let dest = meta4.originalPath;
         if (!insideOk(dest))
           return OUTSIDE("restore");
@@ -69945,7 +70104,7 @@ function watchRemoteRoot(root, key2, onChange) {
       const rel = String(filename);
       if (rel.split(sep5).some((seg) => IGNORED.has(seg)))
         return;
-      pending2.add(join31(resolved, rel));
+      pending2.add(join32(resolved, rel));
       if (timer)
         clearTimeout(timer);
       timer = setTimeout(() => {
@@ -70160,11 +70319,11 @@ function releaseDcClient(clientId) {
 // ../../packages/host-core/dist/fs-transfer.js
 import { readdir as readdir4, lstat as lstat2, mkdir as mkdir8, chmod, rm as rm2, readlink, symlink, stat as stat3 } from "node:fs/promises";
 import { openSync as openSync5, readSync as readSync4, closeSync as closeSync5, existsSync as existsSync15, createWriteStream } from "node:fs";
-import { dirname as dirname13, join as join33, relative as relative6, sep as sep7 } from "node:path";
+import { basename as basename6, dirname as dirname13, join as join34, relative as relative6, sep as sep7 } from "node:path";
 
 // ../../packages/host-core/dist/active-link/paths.js
 init_base_paths();
-import { join as join32, relative as relative5, sep as sep6 } from "node:path";
+import { join as join33, relative as relative5, sep as sep6 } from "node:path";
 function activeLinkEnabled() {
   return process.env.CCB_ACTIVE_LINK !== "0";
 }
@@ -70190,7 +70349,7 @@ function toPosixRel(root, abs) {
   return relative5(root, abs).split(sep6).join("/");
 }
 function fromPosixRel(root, rel) {
-  return join32(root, rel.split("/").join(sep6));
+  return join33(root, rel.split("/").join(sep6));
 }
 function isExcludedAbs(abs, root) {
   const rel = toPosixRel(root, abs);
@@ -70202,7 +70361,7 @@ function activeLinkRoot() {
   return process.env.CCB_ACTIVE_LINK_DIR ?? tessPath("active-link");
 }
 function linkStateDir(linkId) {
-  return join32(activeLinkRoot(), linkId);
+  return join33(activeLinkRoot(), linkId);
 }
 
 // ../../packages/host-core/dist/fs-transfer.js
@@ -70215,11 +70374,43 @@ function clearTimer(t) {
   return null;
 }
 function uniqueDir(parent, name) {
-  let candidate = join33(parent, name);
+  let candidate = join34(parent, name);
+  for (let i = 2; existsSync15(candidate) && i < 1e4; i++)
+    candidate = join34(parent, `${name} ${i}`);
+  return candidate;
+}
+function uniqueFile(parent, name) {
+  const dot = name.lastIndexOf(".");
+  const stem = dot > 0 ? name.slice(0, dot) : name;
+  const ext = dot > 0 ? name.slice(dot) : "";
+  let candidate = join34(parent, name);
   for (let i = 2; existsSync15(candidate) && i < 1e4; i++)
-    candidate = join33(parent, `${name} ${i}`);
+    candidate = join34(parent, `${stem} ${i}${ext}`);
   return candidate;
 }
+var inboundObserver = null;
+function setInboundTransferObserver(cb) {
+  inboundObserver = cb;
+}
+function notifyInbound(s, phase, transferId, extra) {
+  if (!inboundObserver)
+    return;
+  try {
+    inboundObserver({
+      transferId,
+      phase,
+      fromHost: s.fromHost,
+      destPath: s.singleFilePath ?? s.destRoot,
+      singleFile: !!s.singleFilePath,
+      totalFiles: s.totalFiles,
+      totalBytes: s.totalBytes,
+      filesDone: s.filesDone,
+      bytesDone: s.bytesDone,
+      ...extra
+    });
+  } catch {
+  }
+}
 var producers = /* @__PURE__ */ new Map();
 function failProducer(transferId, message) {
   const s = producers.get(transferId);
@@ -70260,7 +70451,7 @@ async function buildManifest(root, followSymlinks, excludeHeavy) {
         continue;
       if (e.isDirectory() && excludeHeavy && HEAVY_DIRS.has(e.name))
         continue;
-      const abs = join33(dir2, e.name);
+      const abs = join34(dir2, e.name);
       const rel = relative6(root, abs).split(sep7).join("/");
       const st = await lstat2(abs).catch(() => null);
       if (!st)
@@ -70285,15 +70476,30 @@ async function buildManifest(root, followSymlinks, excludeHeavy) {
       }
     }
   }
+  const rootSt = await lstat2(root);
+  if (!rootSt.isDirectory()) {
+    const name = basename6(root);
+    if (rootSt.isSymbolicLink()) {
+      if (!followSymlinks)
+        return { dirs, files: [{ rel: name, mode: rootSt.mode, kind: "symlink", size: 0 }], totalBytes: 0, singleFile: true };
+      const real = await stat3(root);
+      if (real.isDirectory()) {
+        await walk(root);
+        return { dirs, files, totalBytes, singleFile: false };
+      }
+      return { dirs, files: [{ rel: name, mode: real.mode, kind: "file", size: real.size }], totalBytes: real.size, singleFile: true };
+    }
+    return { dirs, files: [{ rel: name, mode: rootSt.mode, kind: "file", size: rootSt.size }], totalBytes: rootSt.size, singleFile: true };
+  }
   await walk(root);
-  return { dirs, files, totalBytes };
+  return { dirs, files, totalBytes, singleFile: false };
 }
 async function startOutboundTransfer(msg, controllerClientId, ownHostId2, hostRoot, send3) {
   const { transferId, toHost, srcPath } = msg;
   const state2 = { toHost, controllerClientId, send: send3, sentBytes: 0, ackedBytes: 0, done: false, cancelled: false, wake: null, idle: null };
   producers.set(transferId, state2);
   if (!isInsideRoot(srcPath, hostRoot)) {
-    failProducer(transferId, "Source folder is outside the shared root.");
+    failProducer(transferId, "Source is outside the shared root.");
     return;
   }
   armProducerWatchdog(transferId);
@@ -70301,22 +70507,24 @@ async function startOutboundTransfer(msg, controllerClientId, ownHostId2, hostRo
   try {
     manifest = await buildManifest(srcPath, msg.followSymlinks, msg.excludeHeavy);
   } catch (e) {
-    failProducer(transferId, `Couldn't read the source folder: ${e.message}`);
+    failProducer(transferId, `Couldn't read the source: ${e.message}`);
     return;
   }
   if (state2.cancelled) {
     producers.delete(transferId);
     return;
   }
+  const srcBase = manifest.singleFile ? dirname13(srcPath) : srcPath;
   send3({
     type: "fs:transferManifest",
     transferId,
     toHost,
     fromHost: ownHostId2,
     controllerClientId,
-    destName: msg.destName,
+    destName: manifest.singleFile ? msg.destName || basename6(srcPath) : msg.destName,
     destParent: msg.destParent,
     onCollision: msg.onCollision,
+    singleFile: manifest.singleFile,
     totalFiles: manifest.files.length,
     totalBytes: manifest.totalBytes,
     dirs: manifest.dirs
@@ -70327,11 +70535,11 @@ async function startOutboundTransfer(msg, controllerClientId, ownHostId2, hostRo
   for (let fileIx = 0; fileIx < manifest.files.length && !state2.cancelled; fileIx++) {
     const f = manifest.files[fileIx];
     if (f.kind === "symlink") {
-      const target = await readlink(join33(srcPath, f.rel.split("/").join(sep7))).catch(() => "");
+      const target = await readlink(join34(srcBase, f.rel.split("/").join(sep7))).catch(() => "");
       send3({ type: "fs:transferChunk", transferId, toHost, fileIx, rel: f.rel, mode: f.mode, kind: "symlink", offset: 0, base64: Buffer.from(target, "utf-8").toString("base64"), eof: true }, { hostId: toHost });
       continue;
     }
-    const abs = join33(srcPath, f.rel.split("/").join(sep7));
+    const abs = join34(srcBase, f.rel.split("/").join(sep7));
     let fd = null;
     try {
       fd = openSync5(abs, "r");
@@ -70388,6 +70596,7 @@ function emitProgress(transferId, send3, currentFile) {
   const s = consumers.get(transferId);
   if (!s)
     return;
+  notifyInbound(s, "progress", transferId, { currentFile });
   send3({ type: "fs:transferProgress", transferId, filesDone: s.filesDone, totalFiles: s.totalFiles, bytesDone: s.bytesDone, totalBytes: s.totalBytes, currentFile }, { clientId: s.controllerClientId });
 }
 function finishConsumer(transferId, send3) {
@@ -70395,7 +70604,8 @@ function finishConsumer(transferId, send3) {
   if (!s)
     return;
   s.idle = clearTimer(s.idle);
-  send3({ type: "fs:transferDone", transferId, destRoot: s.destRoot, filesWritten: s.filesDone, bytesWritten: s.bytesDone }, { clientId: s.controllerClientId });
+  notifyInbound(s, "done", transferId);
+  send3({ type: "fs:transferDone", transferId, destRoot: s.singleFilePath ?? s.destRoot, filesWritten: s.filesDone, bytesWritten: s.bytesDone }, { clientId: s.controllerClientId });
   consumers.delete(transferId);
 }
 async function abortConsumer(transferId) {
@@ -70416,13 +70626,20 @@ async function abortConsumer(transferId) {
       await rm2(s.destRoot, { recursive: true, force: true });
     } catch {
     }
+  } else if (s.singleFilePath && s.createdFile) {
+    try {
+      await rm2(s.singleFilePath, { force: true });
+    } catch {
+    }
   }
   consumers.delete(transferId);
 }
 function failConsumer(transferId, message, send3) {
   const s = consumers.get(transferId);
-  if (s)
+  if (s) {
+    notifyInbound(s, "error", transferId, { message });
     send3({ type: "fs:transferError", transferId, where: "dest", message }, { clientId: s.controllerClientId });
+  }
   void abortConsumer(transferId);
 }
 function armConsumerWatchdog(transferId, send3) {
@@ -70438,12 +70655,56 @@ async function beginInboundTransfer(msg, hostRoot, send3) {
     send3({ type: "fs:transferError", transferId, where: "dest", message }, { clientId: controllerClientId });
     send3({ type: "fs:transferCancel", transferId, toHost: fromHost }, { hostId: fromHost });
   };
-  const parent = msg.destParent && isInsideRoot(msg.destParent, hostRoot) ? msg.destParent : hostRoot;
+  const parent = canonicalForGuard(msg.destParent && isInsideRoot(msg.destParent, hostRoot) ? msg.destParent : hostRoot);
   if (!msg.destName || msg.destName.includes("/") || msg.destName.includes("\\") || msg.destName.includes("..")) {
     failNoState("Invalid destination name.");
     return;
   }
-  let destRoot = join33(parent, msg.destName);
+  const register = (state2) => {
+    consumers.set(transferId, {
+      ...state2,
+      totalFiles: msg.totalFiles,
+      totalBytes: msg.totalBytes,
+      filesDone: 0,
+      bytesDone: 0,
+      curIx: -1,
+      curStream: null,
+      cancelled: false,
+      lastProgress: 0,
+      idle: null
+    });
+    armConsumerWatchdog(transferId, send3);
+    const s = consumers.get(transferId);
+    notifyInbound(s, "begin", transferId);
+    emitProgress(transferId, send3, "");
+  };
+  if (msg.singleFile) {
+    let destFile = join34(parent, msg.destName);
+    let createdFile = true;
+    if (existsSync15(destFile)) {
+      if (msg.onCollision === "abort") {
+        failNoState(`"${msg.destName}" already exists on the destination.`);
+        return;
+      }
+      if (msg.onCollision === "suffix")
+        destFile = uniqueFile(parent, msg.destName);
+      else
+        createdFile = false;
+    }
+    if (!isInsideRoot(destFile, hostRoot)) {
+      failNoState("Destination is outside the shared root.");
+      return;
+    }
+    register({ fromHost, controllerClientId, destRoot: parent, createdRoot: false, singleFilePath: destFile, createdFile });
+    if (msg.totalFiles === 0) {
+      finishConsumer(transferId, send3);
+      return;
+    }
+    await mkdir8(parent, { recursive: true }).catch(() => {
+    });
+    return;
+  }
+  let destRoot = join34(parent, msg.destName);
   let createdRoot = false;
   if (existsSync15(destRoot)) {
     if (msg.onCollision === "abort") {
@@ -70461,23 +70722,7 @@ async function beginInboundTransfer(msg, hostRoot, send3) {
     failNoState("Destination is outside the shared root.");
     return;
   }
-  consumers.set(transferId, {
-    fromHost,
-    controllerClientId,
-    destRoot,
-    createdRoot,
-    totalFiles: msg.totalFiles,
-    totalBytes: msg.totalBytes,
-    filesDone: 0,
-    bytesDone: 0,
-    curIx: -1,
-    curStream: null,
-    cancelled: false,
-    lastProgress: 0,
-    idle: null
-  });
-  armConsumerWatchdog(transferId, send3);
-  emitProgress(transferId, send3, "");
+  register({ fromHost, controllerClientId, destRoot, createdRoot, singleFilePath: null, createdFile: false });
   if (msg.totalFiles === 0) {
     finishConsumer(transferId, send3);
     return;
@@ -70485,7 +70730,7 @@ async function beginInboundTransfer(msg, hostRoot, send3) {
   try {
     await mkdir8(destRoot, { recursive: true });
     for (const d of msg.dirs) {
-      const abs = join33(destRoot, d.rel.split("/").join(sep7));
+      const abs = join34(destRoot, d.rel.split("/").join(sep7));
       if (isInsideRoot(abs, destRoot))
         await mkdir8(abs, { recursive: true }).catch(() => {
         });
@@ -70499,15 +70744,15 @@ async function writeInboundChunk(msg, send3) {
   if (!s || s.cancelled)
     return;
   armConsumerWatchdog(msg.transferId, send3);
-  const abs = join33(s.destRoot, msg.rel.split("/").join(sep7));
-  if (msg.rel.includes("..") || !isInsideRoot(abs, s.destRoot)) {
+  const abs = s.singleFilePath ?? join34(s.destRoot, msg.rel.split("/").join(sep7));
+  if (!s.singleFilePath && (msg.rel.includes("..") || !isInsideRoot(abs, s.destRoot))) {
     failConsumer(msg.transferId, `Refusing a path outside the destination: ${msg.rel}`, send3);
     return;
   }
   try {
     if (msg.kind === "symlink") {
       const target = Buffer.from(msg.base64, "base64").toString("utf-8");
-      const resolved = join33(dirname13(abs), target);
+      const resolved = join34(dirname13(abs), target);
       if (isInsideRoot(resolved, s.destRoot)) {
         await mkdir8(dirname13(abs), { recursive: true }).catch(() => {
         });
@@ -70594,7 +70839,7 @@ function cancelTransfersForClient(clientId, send3) {
 
 // ../../packages/host-core/dist/peer-link/index.js
 init_base_paths();
-import { join as join34 } from "node:path";
+import { join as join35 } from "node:path";
 
 // ../../packages/host-core/dist/peer-link/manager.js
 init_tls_direct();
@@ -70778,7 +71023,7 @@ var PeerLinkManager = class {
       }
       const socket2 = await q.makeQuicSocket(this.udpPort);
       this.quicSocket = socket2;
-      await q.startQuicServerOnSocket({ socket: socket2, identity, onStream: (bs3) => this.acceptInbound(bs3, "punch") });
+      await q.startQuicServerOnSocket({ socket: socket2, identity, onStream: (bs4) => this.acceptInbound(bs4, "punch") });
       const refresh = async () => {
         const found = [];
         for (const { host, port } of resolveStunServers()) {
@@ -71097,7 +71342,7 @@ var PeerLinkManager = class {
 var P2P_ENABLED = process.env.CCB_P2P !== "0";
 function identityPaths() {
   const dir2 = process.env.CCB_P2P_DIR ?? tesseractHome();
-  return { certPath: join34(dir2, "peer-cert.pem"), keyPath: join34(dir2, "peer-key.pem") };
+  return { certPath: join35(dir2, "peer-cert.pem"), keyPath: join35(dir2, "peer-key.pem") };
 }
 var manager = null;
 function peerLinkManager() {
@@ -71114,7 +71359,7 @@ async function openPeerLink(peerHostId, ctx2) {
 // ../../packages/host-core/dist/active-link/engine.js
 import { lstat as lstat7, readlink as readlink4, rm as rm3, mkdir as mkdir10, symlink as symlink2, rename as rename2, utimes as utimes2, writeFile as writeFile9 } from "node:fs/promises";
 import { existsSync as existsSync18 } from "node:fs";
-import { dirname as dirname18, join as join39, resolve as resolve9 } from "node:path";
+import { dirname as dirname18, join as join40, resolve as resolve9 } from "node:path";
 
 // ../../packages/host-core/dist/active-link/blocks.js
 import { createHash as createHash4 } from "node:crypto";
@@ -71379,7 +71624,7 @@ var BlockAssembler = class {
 
 // ../../packages/host-core/dist/active-link/manifest.js
 import { readFileSync as readFileSync23, writeFileSync as writeFileSync15, mkdirSync as mkdirSync16, existsSync as existsSync17, renameSync as renameSync6 } from "node:fs";
-import { join as join35 } from "node:path";
+import { join as join36 } from "node:path";
 
 // ../../packages/host-core/dist/active-link/reconcile.js
 var ABSENT = { kind: "absent", t: -Infinity, hash: "" };
@@ -71415,7 +71660,7 @@ var LinkManifest = class {
     this.dir = dir2;
   }
   file() {
-    return join35(this.dir, "manifest.json");
+    return join36(this.dir, "manifest.json");
   }
   load() {
     try {
@@ -71517,7 +71762,7 @@ var LinkManifest = class {
 
 // ../../packages/host-core/dist/active-link/scanner.js
 import { readdir as readdir5, lstat as lstat3, readlink as readlink2 } from "node:fs/promises";
-import { join as join36, sep as sep8 } from "node:path";
+import { join as join37, sep as sep8 } from "node:path";
 async function walkRels(root, extraIgnore) {
   const out = [];
   async function rec(dir2) {
@@ -71532,7 +71777,7 @@ async function walkRels(root, extraIgnore) {
         continue;
       if (e.isDirectory() && HEAVY_DIRS.has(e.name))
         continue;
-      const abs = join36(dir2, e.name);
+      const abs = join37(dir2, e.name);
       if (extraIgnore?.(abs))
         continue;
       if (e.isDirectory())
@@ -71571,7 +71816,7 @@ async function scanTree(root, prior, allow, extraIgnore) {
   return { records };
 }
 function absOf(root, rel) {
-  return join36(root, rel.split("/").join(sep8));
+  return join37(root, rel.split("/").join(sep8));
 }
 
 // ../../packages/host-core/dist/active-link/gitignore.js
@@ -71941,10 +72186,10 @@ var ReaddirpStream = class extends Readable {
   }
   async _formatEntry(dirent, path6) {
     let entry;
-    const basename9 = this._isDirent ? dirent.name : dirent;
+    const basename12 = this._isDirent ? dirent.name : dirent;
     try {
-      const fullPath = presolve(pjoin(path6, basename9));
-      entry = { path: prelative(this._root, fullPath), fullPath, basename: basename9 };
+      const fullPath = presolve(pjoin(path6, basename12));
+      entry = { path: prelative(this._root, fullPath), fullPath, basename: basename12 };
       entry[this._statsProp] = this._isDirent ? dirent : await this._stat(fullPath);
     } catch (err2) {
       this._onError(err2);
@@ -72483,9 +72728,9 @@ var NodeFsHandler = class {
   _watchWithNodeFs(path6, listener) {
     const opts = this.fsw.options;
     const directory = sysPath.dirname(path6);
-    const basename9 = sysPath.basename(path6);
+    const basename12 = sysPath.basename(path6);
     const parent = this.fsw._getWatchedDir(directory);
-    parent.add(basename9);
+    parent.add(basename12);
     const absolutePath = sysPath.resolve(path6);
     const options = {
       persistent: opts.persistent
@@ -72495,7 +72740,7 @@ var NodeFsHandler = class {
     let closer;
     if (opts.usePolling) {
       const enableBin = opts.interval !== opts.binaryInterval;
-      options.interval = enableBin && isBinaryPath(basename9) ? opts.binaryInterval : opts.interval;
+      options.interval = enableBin && isBinaryPath(basename12) ? opts.binaryInterval : opts.interval;
       closer = setFsWatchFileListener(path6, absolutePath, options, {
         listener,
         rawEmitter: this.fsw._emitRaw
@@ -72517,11 +72762,11 @@ var NodeFsHandler = class {
     if (this.fsw.closed) {
       return;
     }
-    const dirname26 = sysPath.dirname(file2);
-    const basename9 = sysPath.basename(file2);
-    const parent = this.fsw._getWatchedDir(dirname26);
+    const dirname28 = sysPath.dirname(file2);
+    const basename12 = sysPath.basename(file2);
+    const parent = this.fsw._getWatchedDir(dirname28);
     let prevStats = stats;
-    if (parent.has(basename9))
+    if (parent.has(basename12))
       return;
     const listener = async (path6, newStats) => {
       if (!this.fsw._throttle(THROTTLE_MODE_WATCH, file2, 5))
@@ -72546,9 +72791,9 @@ var NodeFsHandler = class {
             prevStats = newStats2;
           }
         } catch (error51) {
-          this.fsw._remove(dirname26, basename9);
+          this.fsw._remove(dirname28, basename12);
         }
-      } else if (parent.has(basename9)) {
+      } else if (parent.has(basename12)) {
         const at = newStats.atimeMs;
         const mt = newStats.mtimeMs;
         if (!at || at <= mt || mt !== prevStats.mtimeMs) {
@@ -73596,7 +73841,7 @@ var ActiveLinkEngine = class {
   }
   async start() {
     this.emit({ type: "status", linkId: this.opts.linkId, state: "scanning" });
-    await rm3(join39(this.stateDir, ".staging"), { recursive: true, force: true }).catch(() => {
+    await rm3(join40(this.stateDir, ".staging"), { recursive: true, force: true }).catch(() => {
     });
     this.manifest.load();
     await this.reconcileScan();
@@ -74224,7 +74469,7 @@ var ActiveLinkEngine = class {
     this.inboundWatchdog.clear();
   }
   stagingPath(rel, tag) {
-    return join39(this.stateDir, ".staging", `${hashString(rel)}.${tag}`);
+    return join40(this.stateDir, ".staging", `${hashString(rel)}.${tag}`);
   }
   pruneSuppress() {
     const now2 = this.now();
@@ -74250,9 +74495,9 @@ var ActiveLinkEngine = class {
 
 // ../../packages/host-core/dist/active-link/config.js
 import { readFileSync as readFileSync24, writeFileSync as writeFileSync16, mkdirSync as mkdirSync17, existsSync as existsSync19, renameSync as renameSync7, watch as watch3 } from "node:fs";
-import { join as join40 } from "node:path";
+import { join as join41 } from "node:path";
 function configPath2() {
-  return join40(activeLinkRoot(), "links.json");
+  return join41(activeLinkRoot(), "links.json");
 }
 function loadLinkConfigs() {
   try {
@@ -74289,7 +74534,7 @@ function saveLinkConfig(cfg2) {
   writeAll(links);
 }
 function pendingPath() {
-  return join40(activeLinkRoot(), "pending-deprovisions.json");
+  return join41(activeLinkRoot(), "pending-deprovisions.json");
 }
 function loadPendingDeprovisions() {
   try {
@@ -74911,6 +75156,12 @@ function connectedFsHosts() {
   const mine = ownHostId();
   return serverHosts.filter((h) => h.online && h.hostId !== mine && !h.hostId.endsWith(`:${deviceId}`)).filter((h) => h.kind === "electron" || h.kind === "cloud").filter((h) => !h.caps || h.caps.includes("fs")).map((h) => ({ hostId: h.hostId, label: h.name || (h.kind === "cloud" ? "Cloud agent" : "Remote machine") }));
 }
+function listHosts() {
+  return presentedHosts();
+}
+function ownHost() {
+  return ownHostId();
+}
 function assertServerSelection() {
   if (!socket || socket.readyState !== 1)
     return;
@@ -75088,7 +75339,7 @@ function sendActiveLinkProvision(cfg2) {
     type: "provision",
     linkId: cfg2.linkId,
     fromHost: ownHostId(),
-    projectName: cfg2.remoteSubfolder ?? basename8(cfg2.localRoot),
+    projectName: cfg2.remoteSubfolder ?? basename9(cfg2.localRoot),
     ...cfg2.remoteParent ? { remoteParent: cfg2.remoteParent } : {},
     ...cfg2.remoteSubfolder ? { remoteSubfolder: cfg2.remoteSubfolder } : {},
     ...cfg2.workspaceLinkId ? { workspaceLinkId: cfg2.workspaceLinkId } : {}
@@ -75115,9 +75366,9 @@ function provisionActiveLinkMirror(payload) {
   const remoteSubfolder = typeof payload.remoteSubfolder === "string" ? payload.remoteSubfolder : void 0;
   let localRoot;
   if (remoteParent && remoteSubfolder) {
-    localRoot = join41(remoteParent, safeFolderName(remoteSubfolder));
+    localRoot = join42(remoteParent, safeFolderName(remoteSubfolder));
   } else {
-    localRoot = join41(HOST_ROOT, "Tesseract Mirrors", safeFolderName(projectName));
+    localRoot = join42(HOST_ROOT, "Tesseract Mirrors", safeFolderName(projectName));
   }
   if (loadLinkConfigs().some((c) => c.localRoot === localRoot && c.linkId !== linkId)) {
     localRoot = `${localRoot}-${linkId.slice(0, 6)}`;
@@ -75630,6 +75881,7 @@ function registerAsHost() {
   const name = kind === "cloud" ? "Cloud agent" : hostname3();
   const caps = hostSessions ? ["agent", "fs", "term", "e2e"] : ["agent", "fs", "term"];
   caps.push("rdesk");
+  caps.push("xfer");
   const upAdvert = upscaleAdvert();
   if (upAdvert.gpu)
     caps.push("gpu");
@@ -75703,6 +75955,10 @@ function connect() {
       hooks?.onChat?.(env.payload);
       return;
     }
+    if (channel === "drop") {
+      hooks?.onDrop?.(env.payload);
+      return;
+    }
     if (channel === "p2p") {
       const m = env.payload;
       for (const cb of [...p2pSubscribers])
@@ -76233,6 +76489,14 @@ var RdeskSessionManager = class {
     this.audit({ event: "mute", sessionId, detail: `mic=${!!mute.mic} sys=${!!mute.systemAudio}` });
     this.deps.sendControl(sessionId, s.viewer.clientId, { type: "rdesk:muted", mic: !!mute.mic, systemAudio: !!mute.systemAudio });
   }
+  /** Host operator → viewer: send an in-session chat line. No-op if the session is gone. */
+  sendChat(sessionId, text8) {
+    const s = this.sessions.get(sessionId);
+    if (!s)
+      return;
+    this.deps.sendControl(sessionId, s.viewer.clientId, { type: "rdesk:chat", text: text8, from: "host", at: Date.now() });
+    this.audit({ event: "chat", sessionId, detail: `host: ${text8.slice(0, 80)}` });
+  }
   /** Switch the captured display. */
   async setMonitor(sessionId, monitorId) {
     const s = this.sessions.get(sessionId);
@@ -76261,6 +76525,19 @@ var RdeskSessionManager = class {
       return this.setSource(sessionId, msg.sourceId);
     if (msg.type === "rdesk:send-keys")
       return this.sendKeys(sessionId, msg.combo);
+    if (msg.type === "rdesk:chat") {
+      const s = this.sessions.get(sessionId);
+      const text8 = msg.text.slice(0, 4e3);
+      this.deps.onChat?.({ sessionId, viewerName: s?.viewer.name, text: text8 });
+      this.audit({ event: "chat", sessionId, detail: text8.slice(0, 80) });
+      return;
+    }
+    if (msg.type === "rdesk:av") {
+      const s = this.sessions.get(sessionId);
+      this.deps.onCall?.({ sessionId, on: msg.on, viewerName: s?.viewer.name });
+      this.audit({ event: "call", sessionId, detail: msg.on ? "viewer joined call" : "viewer left call" });
+      return;
+    }
     if (msg.type === "rdesk:set-av") {
       if (typeof msg.systemAudio === "boolean")
         this.sessions.get(sessionId)?.engine.setMute({ systemAudio: msg.systemAudio });
@@ -76290,7 +76567,7 @@ var RdeskSessionManager = class {
 };
 
 // ../../packages/host-core/dist/rdesk/publisher-window.js
-import { join as join42 } from "node:path";
+import { join as join43 } from "node:path";
 var windows = /* @__PURE__ */ new Map();
 var ipcInstalled = false;
 function ensureIpc() {
@@ -76404,7 +76681,7 @@ var PublisherWindow = class {
       throw new Error("Publisher requires the daemon GUI shell (no BrowserWindow).");
     ensureIpc();
     const sourceId = opts.sourceId ?? await sourceIdForMonitor(opts.monitorId ?? await this.primaryMonitorId());
-    const win2 = new el2.BrowserWindow({
+    const win3 = new el2.BrowserWindow({
       width: 320,
       height: 200,
       show: false,
@@ -76416,13 +76693,13 @@ var PublisherWindow = class {
       y: -32e3,
       webPreferences: { preload: daemonPreloadPath(), contextIsolation: true, sandbox: false, backgroundThrottling: false }
     });
-    this.win = win2;
+    this.win = win3;
     windows.set(this.sessionId, this);
     try {
-      win2.setContentProtection(true);
+      win3.setContentProtection(true);
     } catch {
     }
-    await win2.loadFile(join42(daemonUiDir(), "publisher.html"));
+    await win3.loadFile(join43(daemonUiDir(), "publisher.html"));
     this.send("rdesk:pub:start", {
       sessionId: this.sessionId,
       sourceId,
@@ -76447,7 +76724,7 @@ var PublisherWindow = class {
     if (!el2?.BrowserWindow)
       throw new Error("Publisher requires the daemon GUI shell (no BrowserWindow).");
     ensureIpc();
-    const win2 = new el2.BrowserWindow({
+    const win3 = new el2.BrowserWindow({
       width: 320,
       height: 200,
       show: false,
@@ -76458,13 +76735,13 @@ var PublisherWindow = class {
       y: -32e3,
       webPreferences: { preload: daemonPreloadPath(), contextIsolation: true, sandbox: false, backgroundThrottling: false }
     });
-    this.win = win2;
+    this.win = win3;
     windows.set(this.sessionId, this);
     try {
-      win2.setContentProtection(true);
+      win3.setContentProtection(true);
     } catch {
     }
-    await win2.loadFile(join42(daemonUiDir(), "publisher.html"));
+    await win3.loadFile(join43(daemonUiDir(), "publisher.html"));
     this.send("rdesk:pub:start", {
       sessionId: this.sessionId,
       mode: "canvas",
@@ -78299,7 +78576,17 @@ var XAAD = utf8("tesseract-vault-export-v1");
 var XJSON_AAD = utf8("tesseract-vault-encrypted-json-v1");
 
 // ../../packages/host-core/dist/vault/store.js
-import { randomUUID as randomUUID15 } from "node:crypto";
+import { randomUUID as randomUUID16 } from "node:crypto";
+var b64 = (u) => Buffer.from(u).toString("base64");
+var u82 = (s) => new Uint8Array(Buffer.from(s, "base64"));
+var isServerRecoverableMeta = (m) => !m.wrappedVaultKey;
+var metaFromWire = (w) => ({
+  format: "TVK1",
+  kdf: w.kdf,
+  wrappedVaultKey: w.wrappedVaultKey,
+  recoveryWrappedVaultKey: w.recoveryWrappedVaultKey ?? void 0,
+  clientUpdatedAt: w.updatedAt
+});
 var TOMBSTONE_TTL_MS = 180 * 24 * 60 * 60 * 1e3;
 var VaultStore = class {
   persistence;
@@ -78311,6 +78598,15 @@ var VaultStore = class {
   // decrypted, only while unlocked
   dirty = /* @__PURE__ */ new Set();
   // item ids changed locally since last successful push
+  // Mode 1: a no-password local vault whose random key is cached in the 0600 daemon dir (zero
+  // friction; a fresh install starts with an empty usable vault). Upgraded via setMasterPassword,
+  // or merged into the account + deleted on sign-in.
+  deviceVault = false;
+  // Mode 3: signed-in with NO master password. The key is cached locally (non-ZK by design → offline
+  // auto-unlock) AND server-recoverable so any signed-in device auto-unlocks.
+  serverRecoverable = false;
+  // One-shot: on the mode-3 → mode-4 upgrade, tell the server to drop its recoverable key copy.
+  pendingClearServerKey = false;
   constructor(persistence, now2 = () => Date.now()) {
     this.persistence = persistence;
     this.now = now2;
@@ -78324,7 +78620,163 @@ var VaultStore = class {
     for (const it of this.enc.values())
       if (!it.deleted)
         live++;
-    return { exists: this.meta !== null, unlocked: this.vaultKey !== null, itemCount: live };
+    return {
+      exists: this.meta !== null || this.deviceVault,
+      unlocked: this.vaultKey !== null,
+      itemCount: live,
+      deviceVault: this.deviceVault,
+      serverRecoverable: this.serverRecoverable,
+      hasMasterPassword: !!(this.meta && this.meta.wrappedVaultKey && !this.serverRecoverable)
+    };
+  }
+  isDeviceVault() {
+    return this.deviceVault;
+  }
+  isServerRecoverable() {
+    return this.serverRecoverable;
+  }
+  /** For sync push: the raw key to hand the server to seal (mode 3), so other devices auto-unlock. */
+  serverRecoverableKeyForPush() {
+    return this.serverRecoverable && this.vaultKey ? b64(this.vaultKey) : null;
+  }
+  /** For sync push: consume the one-shot "clear the server's recoverable key" flag (mode-4 upgrade). */
+  /** Peek the one-shot "clear the server's recoverable key" flag (mode-4 upgrade) WITHOUT consuming it. */
+  hasPendingClearServerKey() {
+    return this.pendingClearServerKey;
+  }
+  /** Consume the flag — call ONLY after the meta PUT carrying `serverRecoverableKey: null` succeeds. */
+  clearPendingServerKeyFlag() {
+    this.pendingClearServerKey = false;
+  }
+  /** On sign-out, drop an ACCOUNT vault's local state so this process-wide singleton can't leak one
+   *  user's vault into the next user's sync (the daemon isn't restarted on an in-process account
+   *  switch). The account's ciphertext + meta are safe on the server (re-pulled on the next sign-in),
+   *  and the mode-3 device key IS the account key, so it's cleared too. A machine-local NO-PASSWORD
+   *  device vault (mode 1) is NOT account-bound — it's left intact. The next ensureVault re-establishes
+   *  a fresh device vault from the now-empty state. */
+  resetForSignOut() {
+    if (this.deviceVault)
+      return;
+    this.meta = null;
+    this.enc.clear();
+    this.vaultKey = null;
+    this.items = null;
+    this.dirty.clear();
+    this.serverRecoverable = false;
+    this.pendingClearServerKey = false;
+    this.persistence.clearDeviceKey();
+    this.persist();
+  }
+  // ── zero-friction lifecycle (device vault / server-recoverable / merge) ────────────
+  /** Call once on load: if no vault exists, AUTO-CREATE an empty no-password device vault (mode 1,
+   *  no prompt); if a mode-3 (server-recoverable) meta + cached key exist, auto-unlock. No-op when a
+   *  master-password vault exists (it stays locked for the unlock screen). Mirrors the extension. */
+  async ensureVault() {
+    const stored = this.persistence.loadDeviceKey();
+    if (this.meta) {
+      if (isServerRecoverableMeta(this.meta) && stored) {
+        this.vaultKey = u82(stored);
+        this.serverRecoverable = true;
+        await this.decryptAll();
+      }
+      return;
+    }
+    if (stored) {
+      this.vaultKey = u82(stored);
+    } else {
+      this.vaultKey = newVaultKey();
+      this.persistence.saveDeviceKey(b64(this.vaultKey));
+      this.items = /* @__PURE__ */ new Map();
+    }
+    this.deviceVault = true;
+    if (this.enc.size)
+      await this.decryptAll();
+    else
+      this.items = this.items ?? /* @__PURE__ */ new Map();
+  }
+  /** On sign-in, reconcile the local vault against the account snapshot:
+   *  - account has a master-password vault → `needsMasterPassword` (caller collects it → mergeIntoAccount);
+   *  - else establish mode 3 from the device/server key + fold local items in (auto-unlock, no prompt). */
+  async reconcileSignIn(snap) {
+    if (snap.meta && !snap.meta.serverKey && snap.meta.wrappedVaultKey) {
+      return { status: "needsMasterPassword" };
+    }
+    const localItems = this.items ? [...this.items.values()] : [];
+    const cached3 = this.persistence.loadDeviceKey();
+    let key2;
+    if (snap.meta?.serverKey)
+      key2 = u82(snap.meta.serverKey);
+    else if (this.vaultKey)
+      key2 = this.vaultKey;
+    else if (cached3)
+      key2 = u82(cached3);
+    else
+      key2 = newVaultKey();
+    this.vaultKey = key2;
+    this.persistence.saveDeviceKey(b64(key2));
+    this.serverRecoverable = true;
+    this.deviceVault = false;
+    this.meta = { format: "TVK1", kdf: defaultKdfParams(), wrappedVaultKey: "", recoveryWrappedVaultKey: void 0, clientUpdatedAt: this.now() };
+    this.enc = new Map((snap.items ?? []).map((i) => [i.id, i]));
+    for (const it of localItems) {
+      this.enc.set(it.id, await encryptItem(key2, it));
+      this.dirty.add(it.id);
+    }
+    await this.decryptAll();
+    this.persist();
+    return { status: "unlocked" };
+  }
+  /** Merge the local vault's items INTO the account vault: unlock it with the master password (or
+   *  create it if the account has none), re-encrypt local items under the account key, and drop the
+   *  device vault. Returns a recovery key only when a NEW account vault was created. */
+  async reconcileMergeIntoAccount(password, snap) {
+    const localItems = this.items ? [...this.items.values()] : [];
+    let accountKey;
+    let recoveryKey;
+    if (snap.meta) {
+      const accountMeta = metaFromWire(snap.meta);
+      accountKey = await unlockVault(password, accountMeta);
+      this.meta = accountMeta;
+    } else {
+      const created = await createVault(password);
+      const rec = await createRecoveryKey(created.vaultKey);
+      this.meta = { ...created.meta, recoveryWrappedVaultKey: rec.recoveryWrappedVaultKey, clientUpdatedAt: this.now() };
+      accountKey = created.vaultKey;
+      recoveryKey = rec.recoveryKey;
+    }
+    this.enc = new Map((snap.items ?? []).map((i) => [i.id, i]));
+    for (const it of localItems) {
+      this.enc.set(it.id, await encryptItem(accountKey, it));
+      this.dirty.add(it.id);
+    }
+    this.vaultKey = accountKey;
+    this.deviceVault = false;
+    this.serverRecoverable = false;
+    this.persistence.clearDeviceKey();
+    await this.decryptAll();
+    this.persist();
+    return { recoveryKey };
+  }
+  /** Set a master password on a no-password vault (mode 1 → 2, or mode 3 → 4). Same key, re-wrapped;
+   *  items unchanged. Drops the local key cache (now zero-knowledge) and — if it was server-recoverable
+   *  — schedules clearing the server's recoverable key copy on the next sync. Returns a recovery key. */
+  async setMasterPassword(password) {
+    if (!this.vaultKey)
+      throw new Error("Vault is locked.");
+    if (this.meta && this.meta.wrappedVaultKey && !this.serverRecoverable)
+      throw new Error("A master password is already set.");
+    const kdf = defaultKdfParams();
+    const wrappedVaultKey = await wrapVaultKey(deriveMasterKey(password, kdf), this.vaultKey);
+    const rec = await createRecoveryKey(this.vaultKey);
+    const wasServerRecoverable = this.serverRecoverable;
+    this.meta = { format: "TVK1", kdf, wrappedVaultKey, recoveryWrappedVaultKey: rec.recoveryWrappedVaultKey, clientUpdatedAt: this.now() };
+    this.deviceVault = false;
+    this.serverRecoverable = false;
+    this.persistence.clearDeviceKey();
+    if (wasServerRecoverable)
+      this.pendingClearServerKey = true;
+    this.persist();
+    return { recoveryKey: rec.recoveryKey };
   }
   isUnlocked() {
     return this.vaultKey !== null;
@@ -78342,6 +78794,12 @@ var VaultStore = class {
       throw new Error("No vault to unlock");
     this.vaultKey = new Uint8Array(Buffer.from(base64Key, "base64"));
     await this.decryptAll();
+    const live = [...this.enc.values()].filter((e) => !e.deleted).length;
+    if (live > 0 && (this.items?.size ?? 0) === 0) {
+      this.vaultKey = null;
+      this.items = null;
+      throw new Error("Key did not match this vault");
+    }
   }
   persist() {
     this.persistence.save({ meta: this.meta, items: [...this.enc.values()] });
@@ -78386,7 +78844,8 @@ var VaultStore = class {
       if (enc.deleted)
         continue;
       try {
-        map2.set(enc.id, await decryptItem(key2, enc));
+        const it = await decryptItem(key2, enc);
+        map2.set(it.id, it);
       } catch {
       }
     }
@@ -78419,7 +78878,7 @@ var VaultStore = class {
     const existing = input.id ? items.get(input.id) : void 0;
     const { id: _drop, name, folderId, favorite, reprompt, notes, tags, ...content } = input;
     const item = {
-      id: input.id ?? randomUUID15(),
+      id: input.id ?? randomUUID16(),
       name,
       folderId,
       favorite,
@@ -78448,7 +78907,7 @@ var VaultStore = class {
     const now2 = this.now();
     for (const d of drafts) {
       const { name, notes, favorite, tags, ...content } = d;
-      const item = { id: randomUUID15(), name, notes, favorite, tags, createdAt: now2, updatedAt: now2, ...content };
+      const item = { id: randomUUID16(), name, notes, favorite, tags, createdAt: now2, updatedAt: now2, ...content };
       items.set(item.id, item);
       this.enc.set(item.id, await encryptItem(key2, item));
       this.dirty.add(item.id);
@@ -78474,6 +78933,8 @@ var VaultStore = class {
   }
   /** Adopt a newer remote meta (e.g. a master-password change on another device). */
   applyRemoteMeta(meta4) {
+    if (this.deviceVault)
+      return;
     if (meta4 && (!this.meta || (meta4.clientUpdatedAt ?? 0) > (this.meta.clientUpdatedAt ?? 0))) {
       this.meta = meta4;
       this.persist();
@@ -78531,9 +78992,18 @@ var VaultSync = class {
     this.getToken = getToken2;
     this.debounceMs = debounceMs;
   }
+  /** A local NO-PASSWORD device vault (mode 1) has no account to sync with — its items are encrypted
+   *  under the on-disk device key, so pushing them would poison the account with undecryptable
+   *  ciphertext AND pulling the account meta would overwrite the device vault's null meta → orphan
+   *  the local items on the next lock/restart (the exact data-loss reconcileSignIn guards against).
+   *  Sign-in (reconcileSignIn/mergeIntoAccount) is what turns a device vault INTO an account vault;
+   *  until then, sync must stay OFF. Mirrors the extension/WebVaultClient `if (deviceVault) return`. */
+  syncable() {
+    return !!this.getToken() && !this.store.isDeviceVault();
+  }
   /** Call after any local mutation (upsert/remove/import/meta change). Debounced. */
   markLocalChange() {
-    if (!this.getToken())
+    if (!this.syncable())
       return;
     if (this.timer)
       clearTimeout(this.timer);
@@ -78543,13 +79013,19 @@ var VaultSync = class {
   /** Once per signed-in session (deduped by token): pull + reconcile, then push. */
   async ensureSynced() {
     const token3 = this.getToken();
-    if (!token3 || token3 === this.lastSyncedToken)
+    if (!this.syncable() || token3 === this.lastSyncedToken)
       return;
     this.lastSyncedToken = token3;
     await this.pullAndReconcile().catch(() => {
       this.lastSyncedToken = null;
     });
   }
+  /** Push the current cache (dirty items + meta, incl. mode-3 serverRecoverableKey) NOW — used right
+   *  after a sign-in reconcile / merge so the account is updated immediately, not on the debounce. */
+  async pushNow() {
+    await this.push().catch(() => {
+    });
+  }
   onSignedOut() {
     this.lastSyncedToken = null;
     this.lastMetaPushed = -1;
@@ -78573,7 +79049,7 @@ var VaultSync = class {
     }
   }
   async push() {
-    if (!this.getToken())
+    if (!this.syncable())
       return;
     const dirty = this.store.takeDirty();
     if (dirty.length) {
@@ -78583,8 +79059,17 @@ var VaultSync = class {
     const { meta: meta4 } = this.store.metaForPush();
     const clock = meta4?.clientUpdatedAt ?? -1;
     if (meta4 && clock > this.lastMetaPushed) {
-      await this.api.putMeta(toWire(meta4));
+      const wire = toWire(meta4);
+      const srk = this.store.serverRecoverableKeyForPush();
+      const clearing = !srk && this.store.hasPendingClearServerKey();
+      if (srk)
+        wire.serverRecoverableKey = srk;
+      else if (clearing)
+        wire.serverRecoverableKey = null;
+      await this.api.putMeta(wire);
       this.lastMetaPushed = clock;
+      if (clearing)
+        this.store.clearPendingServerKeyFlag();
     }
   }
 };
@@ -78608,12 +79093,15 @@ function makeDaemonVaultApi(getOrigin, getToken2) {
 
 // ../../packages/host-core/dist/vault/persistence.js
 init_base_paths();
-import { existsSync as existsSync21, mkdirSync as mkdirSync19, readFileSync as readFileSync25, writeFileSync as writeFileSync17 } from "node:fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync19, readFileSync as readFileSync25, writeFileSync as writeFileSync17, unlinkSync as unlinkSync2 } from "node:fs";
 import { dirname as dirname19 } from "node:path";
 function vaultStoreFile() {
   return homePath(".tesseract", "vault", "vault.json");
 }
-function makeVaultPersistence(file2 = vaultStoreFile) {
+function vaultDeviceKeyFile() {
+  return homePath(".tesseract", "vault", "device-key");
+}
+function makeVaultPersistence(file2 = vaultStoreFile, deviceKeyFile = vaultDeviceKeyFile) {
   return {
     load() {
       try {
@@ -78633,6 +79121,27 @@ function makeVaultPersistence(file2 = vaultStoreFile) {
         writeFileSync17(file2(), JSON.stringify(state2), { mode: 384 });
       } catch {
       }
+    },
+    loadDeviceKey() {
+      try {
+        return existsSync21(deviceKeyFile()) ? readFileSync25(deviceKeyFile(), "utf8").trim() || null : null;
+      } catch {
+        return null;
+      }
+    },
+    saveDeviceKey(base64Key) {
+      try {
+        mkdirSync19(dirname19(deviceKeyFile()), { recursive: true, mode: 448 });
+        writeFileSync17(deviceKeyFile(), base64Key, { mode: 384 });
+      } catch {
+      }
+    },
+    clearDeviceKey() {
+      try {
+        if (existsSync21(deviceKeyFile()))
+          unlinkSync2(deviceKeyFile());
+      } catch {
+      }
     }
   };
 }
@@ -78640,7 +79149,7 @@ function makeVaultPersistence(file2 = vaultStoreFile) {
 // ../../packages/host-core/dist/vault/biometric.js
 init_base_paths();
 import { existsSync as existsSync22, mkdirSync as mkdirSync20, readFileSync as readFileSync26, rmSync as rmSync6, writeFileSync as writeFileSync18 } from "node:fs";
-import { join as join43 } from "node:path";
+import { join as join44 } from "node:path";
 async function electronBio() {
   if (!electronModule())
     return null;
@@ -78661,7 +79170,7 @@ function bioDir() {
   return d;
 }
 function bioFile(id) {
-  return join43(bioDir(), `${String(id).replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 64)}.enc`);
+  return join44(bioDir(), `${String(id).replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 64)}.enc`);
 }
 async function biometricAvailable() {
   if (process.platform !== "darwin")
@@ -78709,13 +79218,15 @@ function settingsFile() {
 var VaultManager = class {
   store;
   sync;
+  api;
   autoLockMinutes = 0;
   idleTimer = null;
   constructor() {
     this.store = new VaultStore(makeVaultPersistence());
-    this.sync = new VaultSync(this.store, makeDaemonVaultApi(() => readCredentials()?.apiOrigin ?? "", () => readCredentials()?.accessToken ?? null), () => readCredentials()?.accessToken ?? null);
+    this.api = makeDaemonVaultApi(() => readCredentials()?.apiOrigin ?? "", () => readCredentials()?.accessToken ?? null);
+    this.sync = new VaultSync(this.store, this.api, () => readCredentials()?.accessToken ?? null);
     this.autoLockMinutes = this.loadAutoLock();
-    void this.sync.ensureSynced().catch(() => {
+    void this.ensureVault().then(() => this.sync.ensureSynced()).catch(() => {
     });
   }
   // ── auto-lock ────────────────────────────────────────────────────────────────────
@@ -78764,12 +79275,49 @@ var VaultManager = class {
       exists: s.exists,
       unlocked: s.unlocked,
       itemCount: s.itemCount,
-      hasMasterPassword: s.exists,
+      hasMasterPassword: !!s.hasMasterPassword,
+      deviceVault: !!s.deviceVault,
+      serverRecoverable: !!s.serverRecoverable,
       biometricAvailable: await biometricAvailable(),
       biometricEnrolled: id ? biometricEnrolled(id) : false,
       autoLockMinutes: this.autoLockMinutes
     };
   }
+  // ── zero-friction lifecycle (device vault / sign-in reconcile / merge) ─────────────
+  /** Auto-create/auto-unlock the no-password device vault (mode 1) or auto-unlock mode 3. Idempotent;
+   *  called on construction + on the app's vault-tab mount. Mirrors the extension's ensureLoaded. */
+  async ensureVault() {
+    await this.store.ensureVault();
+    if (this.store.isServerRecoverable())
+      void this.sync.ensureSynced().catch(() => {
+      });
+    this.touch();
+  }
+  /** On sign-in: reconcile local ↔ account. `needsMasterPassword` → the app collects it + calls
+   *  mergeIntoAccount; `unlocked` → mode 3 established from the device key + local items folded in. */
+  async signIn() {
+    const snap = await this.api.getSnapshot();
+    const r = await this.store.reconcileSignIn(snap);
+    if (r.status === "unlocked")
+      await this.sync.pushNow();
+    this.touch();
+    return r;
+  }
+  /** Merge the local vault into the account (unlock/create it with `masterPassword`), then sync. */
+  async mergeIntoAccount(masterPassword) {
+    const snap = await this.api.getSnapshot();
+    const r = await this.store.reconcileMergeIntoAccount(masterPassword, snap);
+    await this.sync.pushNow();
+    this.touch();
+    return r;
+  }
+  /** Optional upgrade: set a master password on a no-password vault (mode 1→2 or 3→4). */
+  async setMasterPassword(masterPassword) {
+    const r = await this.store.setMasterPassword(masterPassword);
+    await this.sync.pushNow();
+    this.touch();
+    return r;
+  }
   // ── lifecycle ────────────────────────────────────────────────────────────────────
   async create(masterPassword) {
     const res = await this.store.create(masterPassword);
@@ -78820,6 +79368,20 @@ var VaultManager = class {
     });
     this.touch();
   }
+  // ── cross-device unlock (phone approve → desktop unlock) ───────────────────────────
+  /** The (non-secret) vault crypto header for the QR-unlock payload — kdf + wrapped keys, NO raw key.
+   *  Returned to the renderer so it can render the QR; the raw key never leaves the daemon. */
+  exportMetaWire() {
+    const m = this.store.getMeta();
+    return m ? { format: m.format, kdf: m.kdf, wrappedVaultKey: m.wrappedVaultKey, recoveryWrappedVaultKey: m.recoveryWrappedVaultKey ?? null, updatedAt: m.clientUpdatedAt ?? 0 } : null;
+  }
+  /** Adopt a raw vault key recovered cross-device (the phone approved + sealed it back over the relay). */
+  async adoptKey(base64Key) {
+    await this.store.adoptVaultKeyBase64(base64Key);
+    void this.sync.ensureSynced().catch(() => {
+    });
+    this.touch();
+  }
   disableBiometric() {
     const id = this.accountId();
     if (id)
@@ -78966,6 +79528,9 @@ var VaultManager = class {
   onSignedOut() {
     this.sync.onSignedOut();
     this.lock();
+    this.store.resetForSignOut();
+    void this.store.ensureVault().catch(() => {
+    });
   }
 };
 var singleton = null;
@@ -78996,7 +79561,7 @@ function originAllowed(origin) {
   }
 }
 async function startLocalServer(opts) {
-  const log5 = opts.log ?? (() => {
+  const log9 = opts.log ?? (() => {
   });
   const wss3 = new import_websocket_server.default({ host: "127.0.0.1", port: 0 });
   await new Promise((resolve12, reject) => {
@@ -79005,7 +79570,7 @@ async function startLocalServer(opts) {
   });
   const addr = wss3.address();
   const port = typeof addr === "object" && addr ? addr.port : 0;
-  log5(`local listener on 127.0.0.1:${port}`);
+  log9(`local listener on 127.0.0.1:${port}`);
   wss3.on("connection", (ws, req) => {
     const url2 = new URL(req.url ?? "/", "http://127.0.0.1");
     const origin = req.headers.origin ?? void 0;
@@ -79365,6 +79930,19 @@ async function startLocalServer(opts) {
           case "status":
             result = await vm.status();
             break;
+          case "ensureVault":
+            await vm.ensureVault();
+            result = { ok: true };
+            break;
+          case "signIn":
+            result = await vm.signIn();
+            break;
+          case "mergeIntoAccount":
+            result = await vm.mergeIntoAccount(String(a[0]));
+            break;
+          case "setMasterPassword":
+            result = await vm.setMasterPassword(String(a[0]));
+            break;
           case "create":
             result = await vm.create(String(a[0]));
             break;
@@ -79380,6 +79958,13 @@ async function startLocalServer(opts) {
             await vm.unlockBiometric();
             result = { ok: true };
             break;
+          case "exportMeta":
+            result = vm.exportMetaWire();
+            break;
+          case "adoptKey":
+            await vm.adoptKey(String(a[0]));
+            result = { ok: true };
+            break;
           case "lock":
             vm.lock();
             result = { ok: true };
@@ -79482,18 +80067,18 @@ async function startLocalServer(opts) {
 
 // ../../packages/host-core/dist/daemon-runtime.js
 init_base_paths();
-import { readFileSync as readFileSync30, writeFileSync as writeFileSync25, existsSync as existsSync28, mkdirSync as mkdirSync26, unlinkSync as unlinkSync3, chmodSync as chmodSync5 } from "node:fs";
+import { readFileSync as readFileSync30, writeFileSync as writeFileSync25, existsSync as existsSync28, mkdirSync as mkdirSync26, unlinkSync as unlinkSync4, chmodSync as chmodSync5 } from "node:fs";
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { join as join50 } from "node:path";
+import { join as join54 } from "node:path";
 import { randomBytes as randomBytes8 } from "node:crypto";
 import { hostname as hostname4 } from "node:os";
 
 // ../../packages/host-core/dist/device-identity.js
-import { join as join44 } from "node:path";
+import { join as join45 } from "node:path";
 import { readFileSync as readFileSync28, writeFileSync as writeFileSync20, existsSync as existsSync23, mkdirSync as mkdirSync22, renameSync as renameSync8, chmodSync as chmodSync3 } from "node:fs";
 var cached2 = null;
 function identityPath() {
-  return join44(daemonDir2(), "identity.json");
+  return join45(daemonDir2(), "identity.json");
 }
 async function loadOrCreateDeviceIdentity() {
   if (cached2)
@@ -79521,6 +80106,40 @@ async function loadOrCreateDeviceIdentity() {
   cached2 = kp;
   return kp;
 }
+var sealingCached = null;
+function sealingPath() {
+  return join45(daemonDir2(), "sealing.json");
+}
+var EC_DH = { name: "ECDH", namedCurve: "P-256" };
+async function loadOrCreateSealingKey() {
+  if (sealingCached)
+    return sealingCached;
+  const { subtle: subtle4 } = globalThis.crypto;
+  try {
+    const stored = JSON.parse(readFileSync28(sealingPath(), "utf-8"));
+    if (stored?.privateJwk && stored.publicRaw) {
+      const privateKey = await subtle4.importKey("jwk", stored.privateJwk, EC_DH, true, ["deriveBits"]);
+      sealingCached = { privateKey, publicRaw: unb64u(stored.publicRaw) };
+      return sealingCached;
+    }
+  } catch {
+  }
+  const kp = await subtle4.generateKey(EC_DH, true, ["deriveBits"]);
+  const publicRaw = new Uint8Array(await subtle4.exportKey("raw", kp.publicKey));
+  const privateJwk = await subtle4.exportKey("jwk", kp.privateKey);
+  const dir2 = daemonDir2();
+  if (!existsSync23(dir2))
+    mkdirSync22(dir2, { recursive: true, mode: 448 });
+  const tmp = `${sealingPath()}.tmp`;
+  writeFileSync20(tmp, JSON.stringify({ privateJwk, publicRaw: b64u(publicRaw), alg: "P256-ECDH" }, null, 2), { mode: 384 });
+  renameSync8(tmp, sealingPath());
+  try {
+    chmodSync3(sealingPath(), 384);
+  } catch {
+  }
+  sealingCached = { privateKey: kp.privateKey, publicRaw };
+  return sealingCached;
+}
 var DEVICES_BASE = (apiOrigin) => `${apiOrigin.replace(/\/$/, "")}/api/core/tesseract/devices`;
 async function registerDeviceKey(opts) {
   try {
@@ -79532,7 +80151,8 @@ async function registerDeviceKey(opts) {
         identityPub: b64u(opts.publicRaw),
         alg: "P256-ECDSA",
         tlsFingerprint256: opts.tlsFingerprint256,
-        label: opts.label
+        label: opts.label,
+        ...opts.sealingPub ? { sealingPub: opts.sealingPub, sealingPubSig: opts.sealingPubSig } : {}
       })
     });
     return r.ok;
@@ -79569,12 +80189,584 @@ async function getPeerIdentityPub(opts) {
   }
 }
 
+// ../../packages/host-core/dist/drops/receive-ui.js
+import { basename as basename10, dirname as dirname21 } from "node:path";
+var log5 = (...a) => console.log("[drops]", ...a);
+function formatBytes(n) {
+  if (!Number.isFinite(n) || n <= 0)
+    return "0 B";
+  const units = ["B", "KB", "MB", "GB", "TB"];
+  const i = Math.min(units.length - 1, Math.floor(Math.log(n) / Math.log(1024)));
+  const v = n / 1024 ** i;
+  return `${i === 0 ? v : v.toFixed(v < 10 ? 1 : 0)} ${units[i]}`;
+}
+function initDropReceiveUi(deps = {}) {
+  const live = /* @__PURE__ */ new Map();
+  const clearActivity = () => {
+    if (live.size === 0)
+      setTrayActivity(null);
+  };
+  const describe3 = (e) => {
+    const from = deps.hostLabel?.(e.fromHost) ?? "another machine";
+    const what = e.singleFile || e.totalFiles === 1 ? basename10(e.destPath) : `${e.totalFiles} items`;
+    return `${what} from ${from}`;
+  };
+  setInboundTransferObserver((e) => {
+    try {
+      if (e.phase === "begin") {
+        live.set(e.transferId, { destPath: e.destPath, singleFile: e.singleFile, totalFiles: e.totalFiles, lastTrayAt: 0 });
+        setTrayActivity(`receiving ${e.totalFiles === 1 ? "1 file" : `${e.totalFiles} files`}`);
+        return;
+      }
+      const l = live.get(e.transferId);
+      if (e.phase === "progress") {
+        if (!l)
+          return;
+        const now2 = Date.now();
+        if (now2 - l.lastTrayAt < 1e3)
+          return;
+        l.lastTrayAt = now2;
+        const pct = e.totalBytes > 0 ? Math.min(99, Math.floor(e.bytesDone / e.totalBytes * 100)) : 0;
+        setTrayActivity(`receiving ${formatBytes(e.totalBytes)} (${pct}%)`);
+        return;
+      }
+      live.delete(e.transferId);
+      clearActivity();
+      if (e.phase === "error") {
+        log5(`transfer ${e.transferId} failed: ${e.message ?? "unknown error"}`);
+        if (deps.appIsUp?.())
+          return;
+        daemonNotify({ title: "Couldn't receive files", body: e.message ?? "The transfer failed.", silent: true });
+        return;
+      }
+      const destPath = e.destPath || l?.destPath || "";
+      if (!destPath)
+        return;
+      log5(`received ${e.totalFiles} item(s), ${formatBytes(e.bytesDone)} \u2192 ${destPath}`);
+      if (deps.appIsUp?.())
+        return;
+      const reveal = () => {
+        const el2 = electronModule();
+        if (!el2)
+          return;
+        try {
+          el2.shell.showItemInFolder(destPath);
+        } catch (err2) {
+          log5("reveal failed:", err2 instanceof Error ? err2.message : String(err2));
+        }
+      };
+      const open5 = () => {
+        const el2 = electronModule();
+        if (!el2)
+          return;
+        void el2.shell.openPath(destPath).catch(() => {
+        });
+      };
+      daemonNotify({
+        title: "Files received",
+        body: `${describe3(e)} \xB7 ${formatBytes(e.bytesDone)}`,
+        actions: [{ id: "reveal", label: "Show in Finder" }, { id: "open", label: "Open" }],
+        onAction: (id) => id === "open" ? open5() : reveal(),
+        // Clicking the banner body is the only reliable action on macOS (buttons need
+        // an expanded banner and are suppressed under Focus), so make it do the useful
+        // thing rather than nothing.
+        onClick: reveal
+      });
+    } catch (err2) {
+      log5("receive-ui error:", err2 instanceof Error ? err2.message : String(err2));
+    }
+  });
+}
+
+// ../../packages/host-core/dist/drops/handler.js
+import { basename as basename11 } from "node:path";
+
+// ../../packages/host-core/dist/drops/paths.js
+init_base_paths();
+import { mkdir as mkdir11 } from "node:fs/promises";
+import { join as join46 } from "node:path";
+
+// ../../packages/host-core/dist/drops/names.js
+var WINDOWS_RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i;
+var CONTROL = /[\u0000-\u001f\u007f-\u009f]/g;
+var BIDI = /[\u200e\u200f\u202a-\u202e\u2066-\u2069]/g;
+var MAX_NAME_BYTES = 200;
+var MAX_EXT_BYTES = 32;
+var MAX_DEPTH = 32;
+var utf82 = new TextEncoder();
+var byteLen = (s) => utf82.encode(s).length;
+function capBytes(stem, ext, max) {
+  if (byteLen(stem + ext) <= max)
+    return stem + ext;
+  const budget = Math.max(1, max - byteLen(ext));
+  let out = "";
+  let used = 0;
+  for (const ch of stem) {
+    const n = byteLen(ch);
+    if (used + n > budget)
+      break;
+    out += ch;
+    used += n;
+  }
+  return out + ext;
+}
+function sanitizeDropName(raw, fallback = "file") {
+  let s = String(raw ?? "").split(/[/\\]/).pop() ?? "";
+  s = s.replace(CONTROL, "").replace(BIDI, "").normalize("NFC");
+  s = s.replace(/[ .]+$/g, "");
+  s = s.replace(/^\.+/, "");
+  s = s.trim();
+  if (!s)
+    return fallback;
+  const dot = s.lastIndexOf(".");
+  let stem = dot > 0 ? s.slice(0, dot) : s;
+  let ext = dot > 0 ? s.slice(dot) : "";
+  if (byteLen(ext) > MAX_EXT_BYTES) {
+    stem = s;
+    ext = "";
+  }
+  if (!stem)
+    return fallback;
+  if (WINDOWS_RESERVED.test(stem))
+    stem = `_${stem}`;
+  const out = capBytes(stem, ext, MAX_NAME_BYTES);
+  return out || fallback;
+}
+function sanitizeDropRel(rel) {
+  const parts = String(rel ?? "").split("/").filter((p) => p !== "");
+  if (!parts.length || parts.length > MAX_DEPTH)
+    return null;
+  const out = [];
+  for (const p of parts) {
+    if (p === "." || p === "..")
+      return null;
+    const clean = sanitizeDropName(p, "");
+    if (!clean)
+      return null;
+    out.push(clean);
+  }
+  return out.join("/");
+}
+async function uniqueDropPath(abs) {
+  const { access } = await import("node:fs/promises");
+  const exists2 = async (p) => access(p).then(() => true, () => false);
+  if (!await exists2(abs))
+    return abs;
+  const dir2 = abs.slice(0, abs.length - basenameOf(abs).length);
+  const name = basenameOf(abs);
+  const dot = name.lastIndexOf(".");
+  const stem = dot > 0 ? name.slice(0, dot) : name;
+  const ext = dot > 0 ? name.slice(dot) : "";
+  for (let i = 2; i < 1e4; i++) {
+    const candidate = `${dir2}${stem} ${i}${ext}`;
+    if (!await exists2(candidate))
+      return candidate;
+  }
+  return `${dir2}${stem} ${Date.now()}${ext}`;
+}
+function basenameOf(p) {
+  const i = Math.max(p.lastIndexOf("/"), p.lastIndexOf("\\"));
+  return i === -1 ? p : p.slice(i + 1);
+}
+
+// ../../packages/host-core/dist/drops/paths.js
+function resolveDropsRoot() {
+  const root = resolveHostRoot();
+  const preferred = dropsDir();
+  return isInsideRoot(preferred, root) ? preferred : join46(root, "Drops");
+}
+async function ensureDropsRoot() {
+  const dir2 = resolveDropsRoot();
+  await mkdir11(dir2, { recursive: true });
+  return dir2;
+}
+async function ensureDropDir(opts) {
+  const root = await ensureDropsRoot();
+  if (opts.singleItem && !opts.sender)
+    return root;
+  const parts = [root];
+  if (opts.sender)
+    parts.push(sanitizeDropName(opts.sender, "Unknown sender"));
+  if (!opts.singleItem && opts.label)
+    parts.push(sanitizeDropName(opts.label, "Files"));
+  const dir2 = join46(...parts);
+  await mkdir11(dir2, { recursive: true });
+  return dir2;
+}
+
+// ../../packages/host-core/dist/drops/handler.js
+var log6 = (...a) => console.log("[drops]", ...a);
+var CONSENT_TIMEOUT_MS = 12e4;
+function createDropHandler(deps) {
+  const pending2 = /* @__PURE__ */ new Map();
+  const seen = /* @__PURE__ */ new Set();
+  async function claim(offer) {
+    const hostId = deps.ownHostId();
+    if (!hostId) {
+      log6(`drop ${offer.dropId}: no hostId yet, leaving it to another device`);
+      return;
+    }
+    const singleItem = offer.totalFiles === 1;
+    const destDir = await ensureDropDir({
+      singleItem,
+      // Cross-user drops are grouped by sender so "delete everything they sent me" is
+      // one action. Safe only because the name is sanitized on the way in.
+      sender: offer.kind === "peer" ? offer.from.email || offer.from.name : void 0,
+      label: offer.label
+    });
+    let res;
+    try {
+      res = await deps.api(`/${offer.dropId}/claim`, {
+        method: "POST",
+        body: {
+          deviceId: deps.deviceId(),
+          hostId,
+          // We run the transfer engine, so a LIVE drop is ours to take.
+          caps: ["fs", "xfer"],
+          destParent: destDir,
+          destName: sanitizeDropName(singleItem ? basename11(offer.label) : offer.label, "Files")
+        }
+      });
+    } catch (e) {
+      log6(`drop ${offer.dropId}: claim failed:`, e instanceof Error ? e.message : String(e));
+      return;
+    }
+    if (!res.won) {
+      log6(`drop ${offer.dropId}: ${res.reason ?? "not available"}`);
+      return;
+    }
+    if (res.transport === "blob" && deps.fetchBlobDrop) {
+      try {
+        await deps.fetchBlobDrop({
+          dropId: offer.dropId,
+          destDir,
+          claim: res,
+          sender: offer.kind === "peer" ? offer.from.email || offer.from.name : void 0
+        });
+        await deps.api(`/${offer.dropId}/complete`, { method: "POST", body: { ok: true } });
+      } catch (e) {
+        const message = e instanceof Error ? e.message : String(e);
+        log6(`drop ${offer.dropId}: download failed:`, message);
+        await deps.api(`/${offer.dropId}/complete`, { method: "POST", body: { ok: false, error: message } }).catch(() => {
+        });
+      }
+    }
+  }
+  async function handleOffer(offer) {
+    if (seen.has(offer.dropId))
+      return;
+    seen.add(offer.dropId);
+    if (seen.size > 500)
+      seen.clear();
+    if (offer.autoAccept) {
+      await claim(offer);
+      return;
+    }
+    if (!deps.canPrompt()) {
+      log6(`drop ${offer.dropId}: headless, staying silent`);
+      return;
+    }
+    const ac = new AbortController();
+    pending2.set(offer.dropId, ac);
+    const timer = setTimeout(() => ac.abort(), CONSENT_TIMEOUT_MS);
+    let accepted = false;
+    try {
+      accepted = await deps.confirm({
+        title: "Accept files?",
+        // Sender identity is the SERVER-RESOLVED one. Rendering a sender-supplied
+        // display name here would make "IT Department ✓" a one-line phishing kit.
+        // No thumbnails and no raw filenames: the offer rings every device the user
+        // owns, so the preview is the harassment payload.
+        body: `${offer.from.email || offer.from.name} wants to send you ${offer.totalFiles === 1 ? "1 file" : `${offer.totalFiles} files`} (${formatBytes(offer.totalBytes)}).`
+      }, ac.signal);
+    } finally {
+      clearTimeout(timer);
+      pending2.delete(offer.dropId);
+    }
+    if (ac.signal.aborted) {
+      log6(`drop ${offer.dropId}: prompt withdrawn`);
+      return;
+    }
+    if (!accepted) {
+      await deps.api(`/${offer.dropId}/decline`, { method: "POST" }).catch(() => {
+      });
+      return;
+    }
+    await claim(offer);
+  }
+  return {
+    onFrame(msg) {
+      switch (msg.type) {
+        case "drop:offer":
+          void handleOffer(msg).catch((e) => log6("offer failed:", e instanceof Error ? e.message : String(e)));
+          return;
+        case "drop:dismiss":
+          pending2.get(msg.dropId)?.abort();
+          pending2.delete(msg.dropId);
+          seen.add(msg.dropId);
+          return;
+        case "drop:claimed":
+          if (msg.senderHostId && msg.senderHostId === deps.ownHostId())
+            deps.startLiveSend?.(msg);
+          return;
+        default:
+          return;
+      }
+    },
+    /** Catches offers that arrived while this device was offline. */
+    async reconcile() {
+      try {
+        const rows = await deps.api("/inbox");
+        for (const r of rows) {
+          if (r.status && r.status !== "PENDING")
+            continue;
+          void handleOffer({ ...r, type: "drop:offer" });
+        }
+      } catch (e) {
+        log6("inbox reconcile failed:", e instanceof Error ? e.message : String(e));
+      }
+    }
+  };
+}
+
+// ../../packages/host-core/dist/drops/blob-fetch.js
+import { createWriteStream as createWriteStream2 } from "node:fs";
+import { mkdir as mkdir12, rm as rm4, chmod as chmod3 } from "node:fs/promises";
+import { dirname as dirname22, join as join47 } from "node:path";
+import { Readable as Readable2 } from "node:stream";
+import { pipeline } from "node:stream/promises";
+
+// ../../packages/host-core/dist/drops/crypto.js
+import { Transform } from "node:stream";
+var MAGIC = Buffer.from("TSD1", "ascii");
+var NONCE_BYTES = 12;
+var HEADER_BYTES = MAGIC.length + NONCE_BYTES;
+var FRAME_BYTES = 1024 * 1024;
+var TAG_BYTES = 16;
+var MAX_FRAME_CIPHERTEXT = FRAME_BYTES + TAG_BYTES + 1024;
+var subtle3 = () => globalThis.crypto.subtle;
+var bs3 = (b) => b;
+async function importKey(raw) {
+  return subtle3().importKey("raw", bs3(raw), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+}
+function nonceFor(base, index) {
+  const n = Buffer.from(base);
+  n[8] ^= index >>> 24 & 255;
+  n[9] ^= index >>> 16 & 255;
+  n[10] ^= index >>> 8 & 255;
+  n[11] ^= index & 255;
+  return n;
+}
+function aadFor(index) {
+  const a = Buffer.alloc(4);
+  a.writeUInt32BE(index >>> 0, 0);
+  return a;
+}
+var ByteQueue = class {
+  chunks = [];
+  length = 0;
+  push(b) {
+    if (b.length) {
+      this.chunks.push(b);
+      this.length += b.length;
+    }
+  }
+  /** The first `n` bytes, or null when we don't have them yet. Does not consume. */
+  peek(n) {
+    if (this.length < n)
+      return null;
+    const first = this.chunks[0];
+    if (first.length >= n)
+      return first.subarray(0, n);
+    const out = Buffer.allocUnsafe(n);
+    let off = 0;
+    for (const c of this.chunks) {
+      const take = Math.min(c.length, n - off);
+      c.copy(out, off, 0, take);
+      off += take;
+      if (off === n)
+        break;
+    }
+    return out;
+  }
+  consume(n) {
+    let left = n;
+    while (left > 0) {
+      const c = this.chunks[0];
+      if (c.length <= left) {
+        left -= c.length;
+        this.length -= c.length;
+        this.chunks.shift();
+      } else {
+        this.chunks[0] = c.subarray(left);
+        this.length -= left;
+        left = 0;
+      }
+    }
+  }
+};
+function decryptStream(source, keyRaw) {
+  let key2 = null;
+  let index = 0;
+  let base = null;
+  const q = new ByteQueue();
+  let sawEnd = false;
+  const t = new Transform({
+    async transform(chunk, _enc, cb) {
+      try {
+        q.push(chunk);
+        if (!base) {
+          const head = q.peek(HEADER_BYTES);
+          if (!head) {
+            cb();
+            return;
+          }
+          if (!head.subarray(0, MAGIC.length).equals(MAGIC))
+            throw new Error("not an encrypted drop");
+          base = Buffer.from(head.subarray(MAGIC.length, HEADER_BYTES));
+          q.consume(HEADER_BYTES);
+          key2 = await importKey(keyRaw);
+        }
+        while (!sawEnd) {
+          const lenBuf = q.peek(4);
+          if (!lenBuf)
+            break;
+          const len = lenBuf.readUInt32BE(0);
+          if (len === 0) {
+            sawEnd = true;
+            q.consume(4);
+            break;
+          }
+          if (len > MAX_FRAME_CIPHERTEXT)
+            throw new Error("encrypted frame is implausibly large");
+          const frame = q.peek(4 + len);
+          if (!frame)
+            break;
+          const plain = Buffer.from(await subtle3().decrypt({ name: "AES-GCM", iv: bs3(nonceFor(base, index)), additionalData: bs3(aadFor(index)) }, key2, bs3(frame.subarray(4))));
+          this.push(plain);
+          index += 1;
+          q.consume(4 + len);
+        }
+        cb();
+      } catch (e) {
+        cb(e);
+      }
+    },
+    flush(cb) {
+      cb(sawEnd ? null : new Error("the transfer ended early (incomplete or tampered)"));
+    }
+  });
+  source.on("error", (e) => t.destroy(e));
+  source.pipe(t);
+  return t;
+}
+
+// ../../packages/host-core/dist/drops/quarantine.js
+import { execFile as execFile5 } from "node:child_process";
+import { writeFile as writeFile10 } from "node:fs/promises";
+import { promisify as promisify4 } from "node:util";
+var exec = promisify4(execFile5);
+async function markQuarantined(path6, sourceLabel) {
+  try {
+    if (process.platform === "darwin") {
+      const stamp2 = Math.floor(Date.now() / 1e3).toString(16);
+      const agent = sourceLabel.replace(/[^\w.@-]/g, "_").slice(0, 64) || "Tesseract";
+      await exec("xattr", ["-w", "com.apple.quarantine", `0081;${stamp2};Tesseract;${agent}`, path6]);
+      return;
+    }
+    if (process.platform === "win32") {
+      await writeFile10(`${path6}:Zone.Identifier`, "[ZoneTransfer]\r\nZoneId=3\r\n", "utf-8");
+    }
+  } catch {
+  }
+}
+
+// ../../packages/host-core/dist/drops/blob-fetch.js
+var log7 = (...a) => console.log("[drops]", ...a);
+async function fetchBlobDrop(opts) {
+  const fetchFn = opts.fetchImpl ?? fetch;
+  const written = [];
+  let contentKey;
+  if (opts.sealedKey) {
+    if (!opts.sealingPrivate)
+      throw new Error("This device has no sealing key, so it cannot open the transfer.");
+    const open5 = opts.openSeal ?? openFromPrivateKey;
+    contentKey = await open5(await opts.sealingPrivate(), opts.sealedKey, new TextEncoder().encode(opts.dropId));
+  }
+  const totalBytes = opts.items.reduce((n, i) => n + (i.kind === "file" ? i.size : 0), 0);
+  let bytesDone = 0;
+  try {
+    for (const item of opts.items) {
+      if (item.kind !== "dir")
+        continue;
+      const rel = sanitizeDropRel(item.rel);
+      if (!rel) {
+        log7(`drop ${opts.dropId}: refusing directory "${item.rel}"`);
+        continue;
+      }
+      const abs = join47(opts.destDir, rel);
+      if (!isInsideRoot(abs, opts.destDir)) {
+        log7(`drop ${opts.dropId}: refusing directory outside the destination`);
+        continue;
+      }
+      await mkdir12(abs, { recursive: true });
+    }
+    for (const item of opts.items) {
+      if (opts.signal?.aborted)
+        throw new Error("Cancelled.");
+      if (item.kind !== "file")
+        continue;
+      if (!item.url) {
+        log7(`drop ${opts.dropId}: item ${item.itemId} has no bytes, skipping`);
+        continue;
+      }
+      const rel = sanitizeDropRel(item.rel);
+      if (!rel) {
+        log7(`drop ${opts.dropId}: refusing "${item.rel}"`);
+        continue;
+      }
+      let abs = join47(opts.destDir, rel);
+      if (!isInsideRoot(abs, opts.destDir)) {
+        log7(`drop ${opts.dropId}: refusing a path outside the destination`);
+        continue;
+      }
+      await mkdir12(dirname22(abs), { recursive: true });
+      abs = await uniqueDropPath(abs);
+      const res = await fetchFn(new URL(item.url, opts.apiOrigin).toString(), { signal: opts.signal });
+      if (!res.ok || !res.body)
+        throw new Error(`Download failed (${res.status}).`);
+      const body = Readable2.fromWeb(res.body);
+      const plain = contentKey ? decryptStream(body, contentKey) : body;
+      try {
+        await pipeline(plain, createWriteStream2(abs));
+      } catch (e) {
+        await rm4(abs, { force: true }).catch(() => {
+        });
+        throw e;
+      }
+      await chmod3(abs, 420).catch(() => {
+      });
+      if (opts.sender)
+        await markQuarantined(abs, opts.sender);
+      written.push(abs);
+      bytesDone += item.size;
+      opts.onProgress?.(bytesDone, totalBytes);
+    }
+  } catch (e) {
+    for (const p of written)
+      await rm4(p, { force: true }).catch(() => {
+      });
+    throw e;
+  }
+  return { written };
+}
+
 // ../../packages/host-core/dist/chat-agent.js
-import { randomUUID as randomUUID16 } from "node:crypto";
+import { randomUUID as randomUUID17 } from "node:crypto";
 var TURN_TIMEOUT_MS = 4 * 6e4;
 var PARTIAL_INTERVAL_MS = 700;
 function createChatAgentRunner(deps) {
-  const log5 = deps.log ?? (() => {
+  const log9 = deps.log ?? (() => {
   });
   const active = /* @__PURE__ */ new Set();
   async function api(path6, init) {
@@ -79598,7 +80790,7 @@ function createChatAgentRunner(deps) {
   }
   async function runTurn(prompt, onPartial) {
     const backend2 = await getSharedBackend();
-    const clientRequestId = `chat-agent-${randomUUID16()}`;
+    const clientRequestId = `chat-agent-${randomUUID17()}`;
     return new Promise((resolve12, reject) => {
       let text8 = "";
       let settled = false;
@@ -79662,7 +80854,7 @@ function createChatAgentRunner(deps) {
         body: { deviceId: deps.deviceId }
       });
       if (!claimed) {
-        log5("chat-agent: job already claimed elsewhere", event.jobId);
+        log9("chat-agent: job already claimed elsewhere", event.jobId);
         return;
       }
       const ctx2 = await api(`/api/core/tesseract/chat/agent-jobs/${event.jobId}/context`);
@@ -79686,10 +80878,10 @@ function createChatAgentRunner(deps) {
         await api(`/api/core/tesseract/chat/agent-jobs/${event.jobId}/reply`, { method: "POST", body: { markdown: trimmed } });
       }
       await api(`/api/core/tesseract/chat/agent-jobs/${event.jobId}/complete`, { method: "POST", body: {} });
-      log5("chat-agent: answered", event.jobId);
+      log9("chat-agent: answered", event.jobId);
     } catch (err2) {
       const message = err2 instanceof Error ? err2.message : String(err2);
-      log5("chat-agent: job failed", event.jobId, message);
+      log9("chat-agent: job failed", event.jobId, message);
       await api(`/api/core/tesseract/chat/agent-jobs/${event.jobId}/complete`, {
         method: "POST",
         body: { error: message }
@@ -79879,9 +81071,9 @@ function registerRdpEngine() {
 
 // ../../packages/host-core/dist/rdesk/audit.js
 import { appendFileSync as appendFileSync2 } from "node:fs";
-import { join as join45 } from "node:path";
+import { join as join48 } from "node:path";
 function rdeskAuditPath() {
-  return join45(daemonDir2(), "rdesk-audit.jsonl");
+  return join48(daemonDir2(), "rdesk-audit.jsonl");
 }
 function appendRdeskAudit(e) {
   try {
@@ -79892,10 +81084,10 @@ function appendRdeskAudit(e) {
 
 // ../../packages/host-core/dist/rdesk/password.js
 import { scryptSync, randomBytes as randomBytes6, timingSafeEqual as timingSafeEqual5 } from "node:crypto";
-import { readFileSync as readFileSync29, writeFileSync as writeFileSync21, existsSync as existsSync24, unlinkSync as unlinkSync2 } from "node:fs";
-import { join as join46 } from "node:path";
+import { readFileSync as readFileSync29, writeFileSync as writeFileSync21, existsSync as existsSync24, unlinkSync as unlinkSync3 } from "node:fs";
+import { join as join49 } from "node:path";
 function pwFile() {
-  return join46(daemonDir2(), "rdesk-password.json");
+  return join49(daemonDir2(), "rdesk-password.json");
 }
 function verifyRdeskPassword(password) {
   if (!password)
@@ -79992,26 +81184,26 @@ function broadcastFileProviderHostsChanged() {
 }
 var BRIDGE_PORTS = [47821, 47822, 47823, 47824, 47825, 47826, 47827, 47828];
 var BRIDGE_TOKEN = "b7c1f9a4e25d4c3a8f06e1d72b9a3c5e";
-function startFileProviderBridge(log5 = () => {
+function startFileProviderBridge(log9 = () => {
 }) {
   if (process.platform !== "darwin" || wss)
     return;
   stopping = false;
   token = BRIDGE_TOKEN;
-  bindBridge(0, log5);
+  bindBridge(0, log9);
 }
-function bindBridge(i, log5) {
+function bindBridge(i, log9) {
   if (stopping || wss)
     return;
   if (i >= BRIDGE_PORTS.length) {
-    log5("fileprovider: no free bridge port in the fixed set");
+    log9("fileprovider: no free bridge port in the fixed set");
     return;
   }
   const port = BRIDGE_PORTS[i];
   const server = new import_websocket_server.default({ host: "127.0.0.1", port });
   server.on("listening", () => {
     wss = server;
-    log5(`fileprovider bridge listening on 127.0.0.1:${port}`);
+    log9(`fileprovider bridge listening on 127.0.0.1:${port}`);
   });
   server.on("connection", (ws, req) => {
     let ok = false;
@@ -80037,9 +81229,9 @@ function bindBridge(i, log5) {
         server.close();
       } catch {
       }
-      bindBridge(i + 1, log5);
+      bindBridge(i + 1, log9);
     } else
-      log5("fileprovider bridge error", e?.message);
+      log9("fileprovider bridge error", e?.message);
   });
 }
 
@@ -80047,12 +81239,12 @@ function bindBridge(i, log5) {
 import { randomBytes as randomBytes7 } from "node:crypto";
 import { existsSync as existsSync25, mkdirSync as mkdirSync23, writeFileSync as writeFileSync22, rmSync as rmSync7 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join47 } from "node:path";
+import { join as join50 } from "node:path";
 
 // ../../packages/host-core/dist/vault/peer-verify.js
-import { execFile as execFile5 } from "node:child_process";
-import { promisify as promisify4 } from "node:util";
-var run2 = promisify4(execFile5);
+import { execFile as execFile6 } from "node:child_process";
+import { promisify as promisify5 } from "node:util";
+var run2 = promisify5(execFile6);
 var APPEX_IDENTIFIER = "dev.tesseract.AutoFill";
 async function teamIdOf(path6) {
   try {
@@ -80109,13 +81301,13 @@ async function isTrustedAutofillPeer(remotePort) {
 var APPEX_BUNDLE_ID = "dev.tesseract.AutoFill";
 var BRIDGE_PORTS2 = [17872, 17873, 17874, 17875];
 function appexContainerData() {
-  return join47(homedir6(), "Library", "Containers", APPEX_BUNDLE_ID, "Data");
+  return join50(homedir6(), "Library", "Containers", APPEX_BUNDLE_ID, "Data");
 }
 function bridgeInfoPath() {
-  return join47(appexContainerData(), "Library", "Application Support", "tesseract-autofill-bridge.json");
+  return join50(appexContainerData(), "Library", "Application Support", "tesseract-autofill-bridge.json");
 }
 var infoLoggedOnce = false;
-function writeBridgeInfo(port, token3, log5) {
+function writeBridgeInfo(port, token3, log9) {
   if (process.platform !== "darwin")
     return;
   const containerData = appexContainerData();
@@ -80123,21 +81315,21 @@ function writeBridgeInfo(port, token3, log5) {
     if (!existsSync25(containerData)) {
       if (!infoLoggedOnce) {
         infoLoggedOnce = true;
-        log5("autofill bridge-info SKIP: no appex container yet at", containerData);
+        log9("autofill bridge-info SKIP: no appex container yet at", containerData);
       }
       return;
     }
-    const dir2 = join47(containerData, "Library", "Application Support");
+    const dir2 = join50(containerData, "Library", "Application Support");
     mkdirSync23(dir2, { recursive: true });
     writeFileSync22(bridgeInfoPath(), JSON.stringify({ port, token: token3, pid: process.pid, ts: Date.now() }), { mode: 384 });
     if (!infoLoggedOnce) {
       infoLoggedOnce = true;
-      log5("autofill bridge-info WROTE", port, "\u2192", dir2);
+      log9("autofill bridge-info WROTE", port, "\u2192", dir2);
     }
   } catch (e) {
     if (!infoLoggedOnce) {
       infoLoggedOnce = true;
-      log5("autofill bridge-info FAILED:", e?.message);
+      log9("autofill bridge-info FAILED:", e?.message);
     }
   }
 }
@@ -80229,20 +81421,20 @@ var token2 = "";
 var infoTimer = null;
 var stopping2 = false;
 var sockets2 = /* @__PURE__ */ new Set();
-function bind(i, log5) {
+function bind(i, log9) {
   if (stopping2 || wss2)
     return;
   if (i >= BRIDGE_PORTS2.length) {
-    log5("autofill: no free bridge port in the fixed set");
+    log9("autofill: no free bridge port in the fixed set");
     return;
   }
   const port = BRIDGE_PORTS2[i];
   const server = new import_websocket_server.default({ host: "127.0.0.1", port });
   server.on("listening", () => {
     wss2 = server;
-    log5(`autofill bridge listening on 127.0.0.1:${port}`);
-    writeBridgeInfo(port, token2, log5);
-    infoTimer = setInterval(() => writeBridgeInfo(port, token2, log5), 15e3);
+    log9(`autofill bridge listening on 127.0.0.1:${port}`);
+    writeBridgeInfo(port, token2, log9);
+    infoTimer = setInterval(() => writeBridgeInfo(port, token2, log9), 15e3);
     infoTimer.unref?.();
   });
   server.on("connection", (ws, req) => {
@@ -80270,18 +81462,18 @@ function bind(i, log5) {
         server.close();
       } catch {
       }
-      bind(i + 1, log5);
+      bind(i + 1, log9);
     } else
-      log5("autofill bridge error", e?.message);
+      log9("autofill bridge error", e?.message);
   });
 }
-function startAutofillBridge(log5 = () => {
+function startAutofillBridge(log9 = () => {
 }) {
   if (process.platform !== "darwin" || wss2)
     return;
   stopping2 = false;
   token2 = randomBytes7(24).toString("base64url");
-  bind(0, log5);
+  bind(0, log9);
 }
 
 // ../../packages/host-core/dist/power-node.js
@@ -80345,7 +81537,7 @@ function createNodePowerController() {
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { chmodSync as chmodSync4, existsSync as existsSync26, mkdirSync as mkdirSync24, writeFileSync as writeFileSync23 } from "node:fs";
 import { homedir as homedir7, platform as platform2 } from "node:os";
-import { dirname as dirname21, join as join48, resolve as resolve10 } from "node:path";
+import { dirname as dirname23, join as join51, resolve as resolve10 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var HOST_NAME = "com.tesseract.companion";
 var EXTENSION_IDS = ["icpnghhpcmaonjckkpilpajblfehpplo", "giolfpookdhjfafcchaflhmigghaeffn"];
@@ -80354,21 +81546,21 @@ function browserProfileDirs() {
   const home = homedir7();
   const p = platform2();
   if (p === "darwin") {
-    const base = join48(home, "Library/Application Support");
-    return ["Google/Chrome", "Google/Chrome Beta", "Google/Chrome Dev", "Google/Chrome Canary", "Chromium", "Microsoft Edge", "BraveSoftware/Brave-Browser", "Vivaldi", "Arc"].map((b) => join48(base, b));
+    const base = join51(home, "Library/Application Support");
+    return ["Google/Chrome", "Google/Chrome Beta", "Google/Chrome Dev", "Google/Chrome Canary", "Chromium", "Microsoft Edge", "BraveSoftware/Brave-Browser", "Vivaldi", "Arc"].map((b) => join51(base, b));
   }
   if (p === "win32")
     return [];
-  const cfg2 = join48(home, ".config");
-  return ["google-chrome", "google-chrome-beta", "chromium", "microsoft-edge", "BraveSoftware/Brave-Browser", "vivaldi"].map((b) => join48(cfg2, b));
+  const cfg2 = join51(home, ".config");
+  return ["google-chrome", "google-chrome-beta", "chromium", "microsoft-edge", "BraveSoftware/Brave-Browser", "vivaldi"].map((b) => join51(cfg2, b));
 }
-function resolveBridge(log5) {
+function resolveBridge(log9) {
   const candidates = [
     process.env.CCB_COMPANION_HOST_JS,
-    process.resourcesPath ? join48(process.resourcesPath, "companion-host", BRIDGE_BASENAME) : void 0
+    process.resourcesPath ? join51(process.resourcesPath, "companion-host", BRIDGE_BASENAME) : void 0
   ];
   try {
-    const here = dirname21(fileURLToPath3(import.meta.url));
+    const here = dirname23(fileURLToPath3(import.meta.url));
     candidates.push(resolve10(here, "../../../apps/companion-host/dist", BRIDGE_BASENAME));
     candidates.push(resolve10(here, "../../apps/companion-host/dist", BRIDGE_BASENAME));
   } catch {
@@ -80376,12 +81568,12 @@ function resolveBridge(log5) {
   for (const c of candidates)
     if (c && existsSync26(c))
       return c;
-  log5("companion native-host: bridge not found; skipping registration (looked in", candidates.filter(Boolean).join(" , "), ")");
+  log9("companion native-host: bridge not found; skipping registration (looked in", candidates.filter(Boolean).join(" , "), ")");
   return null;
 }
 function writeLauncher(daemonDir3, bridge, runtime) {
   const isWin = platform2() === "win32";
-  const launcher = join48(daemonDir3, isWin ? "companion-host.cmd" : "companion-host.sh");
+  const launcher = join51(daemonDir3, isWin ? "companion-host.cmd" : "companion-host.sh");
   if (isWin) {
     writeFileSync23(launcher, `@echo off\r
 set ELECTRON_RUN_AS_NODE=1\r
@@ -80397,9 +81589,9 @@ ELECTRON_RUN_AS_NODE=1 exec "${runtime}" "${bridge}" "$@"
   return launcher;
 }
 function registerNativeHost(opts) {
-  const log5 = opts.log ?? (() => void 0);
+  const log9 = opts.log ?? (() => void 0);
   try {
-    const bridge = resolveBridge(log5);
+    const bridge = resolveBridge(log9);
     if (!bridge)
       return;
     const runtime = opts.runtime ?? process.execPath;
@@ -80413,27 +81605,27 @@ function registerNativeHost(opts) {
       allowed_origins: EXTENSION_IDS.map((id) => `chrome-extension://${id}/`)
     }, null, 2);
     if (platform2() === "win32")
-      return registerWindows(opts.daemonDir, manifestJson, log5);
+      return registerWindows(opts.daemonDir, manifestJson, log9);
     let wrote = 0;
     for (const profile of browserProfileDirs()) {
       if (!existsSync26(profile))
         continue;
       try {
-        const dir2 = join48(profile, "NativeMessagingHosts");
+        const dir2 = join51(profile, "NativeMessagingHosts");
         mkdirSync24(dir2, { recursive: true });
-        writeFileSync23(join48(dir2, `${HOST_NAME}.json`), manifestJson);
+        writeFileSync23(join51(dir2, `${HOST_NAME}.json`), manifestJson);
         wrote++;
       } catch {
       }
     }
-    log5(`companion native-host: registered for ${wrote} browser(s) \u2192 ${launcher}`);
+    log9(`companion native-host: registered for ${wrote} browser(s) \u2192 ${launcher}`);
   } catch (e) {
-    log5("companion native-host: registration failed", e.message);
+    log9("companion native-host: registration failed", e.message);
   }
 }
-function registerWindows(daemonDir3, manifestJson, log5) {
+function registerWindows(daemonDir3, manifestJson, log9) {
   try {
-    const manifestPath = join48(daemonDir3, `${HOST_NAME}.json`);
+    const manifestPath = join51(daemonDir3, `${HOST_NAME}.json`);
     writeFileSync23(manifestPath, manifestJson);
     for (const root of ["Software\\Google\\Chrome", "Software\\Microsoft\\Edge", "Software\\BraveSoftware\\Brave-Browser"]) {
       try {
@@ -80441,17 +81633,17 @@ function registerWindows(daemonDir3, manifestJson, log5) {
       } catch {
       }
     }
-    log5("companion native-host: registered (Windows registry)");
+    log9("companion native-host: registered (Windows registry)");
   } catch (e) {
-    log5("companion native-host: Windows registration failed", e.message);
+    log9("companion native-host: Windows registration failed", e.message);
   }
 }
 
 // ../../packages/host-core/dist/activity/activity-tracker.js
 import { promises as fsp, writeFileSync as writeFileSync24, mkdirSync as mkdirSync25, existsSync as existsSync27 } from "node:fs";
-import { join as join49 } from "node:path";
+import { join as join52 } from "node:path";
 function activityProfilePath() {
-  return join49(daemonDir2(), "activity-profile.json");
+  return join52(daemonDir2(), "activity-profile.json");
 }
 var MAX_APPS = 300;
 var MAX_AGE_DAYS = 120;
@@ -80494,7 +81686,7 @@ function loadMacAx2() {
 function createActivityTracker(opts = {}) {
   const intervalMs = opts.intervalMs ?? 5e3;
   const flushEvery = opts.flushEvery ?? 12;
-  const log5 = opts.log ?? (() => {
+  const log9 = opts.log ?? (() => {
   });
   let timer = null;
   let profile = null;
@@ -80512,10 +81704,10 @@ function createActivityTracker(opts = {}) {
     try {
       await fsp.mkdir(daemonDir2(), { recursive: true, mode: 448 });
       await fsp.writeFile(activityProfilePath(), JSON.stringify(profile), { mode: 384 });
-      log5(`activity flushed (${Object.keys(profile.apps).length} apps tracked)`);
+      log9(`activity flushed (${Object.keys(profile.apps).length} apps tracked)`);
       dirty = 0;
     } catch (e) {
-      log5("activity flush failed", e instanceof Error ? e.message : String(e));
+      log9("activity flush failed", e instanceof Error ? e.message : String(e));
     }
   }
   async function sample() {
@@ -80527,7 +81719,7 @@ function createActivityTracker(opts = {}) {
       const key2 = front.bundleId || front.name;
       await ensureLoaded();
       if (profile && Object.keys(profile.apps).length && !existsSync27(activityProfilePath())) {
-        log5("activity profile cleared externally \u2014 resetting in-memory");
+        log9("activity profile cleared externally \u2014 resetting in-memory");
         profile = { version: 1, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), apps: {} };
       }
       const p = profile;
@@ -80541,14 +81733,14 @@ function createActivityTracker(opts = {}) {
       if (++dirty >= flushEvery)
         await flush2();
     } catch (e) {
-      log5("activity sample failed", e instanceof Error ? e.message : String(e));
+      log9("activity sample failed", e instanceof Error ? e.message : String(e));
     }
   }
   return {
     start() {
       if (timer)
         return;
-      log5("activity tracking ON (local-only)");
+      log9("activity tracking ON (local-only)");
       timer = setInterval(() => {
         void sample();
       }, intervalMs);
@@ -80567,9 +81759,9 @@ function createActivityTracker(opts = {}) {
           dirty = 0;
         }
       } catch (e) {
-        log5("activity final flush failed", e instanceof Error ? e.message : String(e));
+        log9("activity final flush failed", e instanceof Error ? e.message : String(e));
       }
-      log5("activity tracking OFF");
+      log9("activity tracking OFF");
     },
     running() {
       return timer !== null;
@@ -80596,16 +81788,68 @@ function getRdeskClientWebContents() {
   } };
 }
 
+// ../../packages/host-core/dist/gui/rdesk-call-window.js
+import { join as join53 } from "node:path";
+var win2 = null;
+function showRdeskCallWindow(opts) {
+  const el2 = electronModule();
+  if (!el2?.BrowserWindow)
+    return;
+  if (win2 && !win2.isDestroyed()) {
+    try {
+      win2.focus();
+    } catch {
+    }
+    return;
+  }
+  const w = new el2.BrowserWindow({
+    width: 380,
+    height: 320,
+    resizable: true,
+    minimizable: true,
+    fullscreenable: false,
+    alwaysOnTop: true,
+    skipTaskbar: false,
+    title: "Remote desktop \u2014 call",
+    backgroundColor: "#15151a",
+    webPreferences: { contextIsolation: true, sandbox: false }
+  });
+  try {
+    w.setAlwaysOnTop(true, "floating");
+  } catch {
+  }
+  w.on("closed", () => {
+    win2 = null;
+    try {
+      opts.onClosed?.();
+    } catch {
+    }
+  });
+  const loadFile = w.loadFile;
+  void loadFile(join53(daemonUiDir(), "rdesk-call.html"), { query: { url: opts.url, token: opts.token, room: opts.room } }).catch((e) => console.error("[rdesk-call] loadFile FAILED", e?.message ?? e));
+  win2 = w;
+}
+function closeRdeskCallWindow() {
+  const w = win2;
+  win2 = null;
+  if (w && !w.isDestroyed()) {
+    try {
+      w.close();
+    } catch {
+    }
+  }
+}
+
 // ../../packages/host-core/dist/daemon-runtime.js
 var daemonClipboardSync = null;
 var REFRESH_INTERVAL_MS = 12 * 60 * 60 * 1e3;
 async function runDaemon(opts = {}) {
   const VERSION = opts.version ?? process.env.CCB_DAEMON_VERSION ?? "dev";
   const TAG = opts.tag ?? "host-daemon";
-  const log5 = (...args) => console.log(`[${TAG} ${(/* @__PURE__ */ new Date()).toISOString()}]`, ...args);
-  log5("paths", JSON.stringify(sealBasePaths()));
-  const pidfile = () => join50(daemonDir2(), "daemon.lock");
-  const statusFile = () => join50(daemonDir2(), "status.json");
+  const log9 = (...args) => console.log(`[${TAG} ${(/* @__PURE__ */ new Date()).toISOString()}]`, ...args);
+  log9("paths", JSON.stringify(sealBasePaths()));
+  const pidfile = () => join54(daemonDir2(), "daemon.lock");
+  const statusFile = () => join54(daemonDir2(), "status.json");
   const isAlive2 = (pid) => {
     try {
       process.kill(pid, 0);
@@ -80632,7 +81876,7 @@ async function runDaemon(opts = {}) {
             return false;
           if (prev !== process.pid && isAlive2(prev))
             return false;
-          unlinkSync3(f);
+          unlinkSync4(f);
         } catch {
           return false;
         }
@@ -80644,7 +81888,7 @@ async function runDaemon(opts = {}) {
     try {
       const f = pidfile();
       if (existsSync28(f) && Number(readFileSync30(f, "utf-8").trim()) === process.pid)
-        unlinkSync3(f);
+        unlinkSync4(f);
     } catch {
     }
   }
@@ -80704,7 +81948,7 @@ async function runDaemon(opts = {}) {
     const live = [...rivals].filter(isAlive2);
     if (live.length) {
       for (const pid of live) {
-        log5(`takeover: killing rival daemon pid=${pid} (latest-wins single-instance)`);
+        log9(`takeover: killing rival daemon pid=${pid} (latest-wins single-instance)`);
         try {
           process.kill(pid, "SIGTERM");
         } catch {
@@ -80714,7 +81958,7 @@ async function runDaemon(opts = {}) {
         await new Promise((r) => setTimeout(r, 100));
       for (const pid of live)
         if (isAlive2(pid)) {
-          log5(`takeover: SIGKILL rival pid=${pid} (ignored SIGTERM)`);
+          log9(`takeover: SIGKILL rival pid=${pid} (ignored SIGTERM)`);
           try {
             process.kill(pid, "SIGKILL");
           } catch {
@@ -80723,7 +81967,7 @@ async function runDaemon(opts = {}) {
     }
     try {
       if (existsSync28(pidfile()))
-        unlinkSync3(pidfile());
+        unlinkSync4(pidfile());
     } catch {
     }
   }
@@ -80738,7 +81982,7 @@ async function runDaemon(opts = {}) {
     await takeoverMachine();
     if (!acquireLock2()) {
       try {
-        unlinkSync3(pidfile());
+        unlinkSync4(pidfile());
       } catch {
       }
       if (!acquireLock2()) {
@@ -80749,26 +81993,30 @@ async function runDaemon(opts = {}) {
       }
     }
   }
+  try {
+    unlinkSync4(join54(daemonDir2(), "daemon.booting"));
+  } catch {
+  }
   let timer = null;
   let localServer = null;
   let localInfo = null;
   let rdeskManager = null;
   const loopbackRdeskSend = /* @__PURE__ */ new Map();
-  const activityTracker = createActivityTracker({ log: log5 });
+  const activityTracker = createActivityTracker({ log: log9 });
   let activityTimer = null;
   const creds3 = readCredentials();
   const deviceId2 = creds3?.deviceId;
   const daemonStartedAt = Date.now();
   process.on("exit", (code) => {
     try {
-      log5(`PROCESS EXIT code=${code} uptimeMs=${Date.now() - daemonStartedAt}`);
+      log9(`PROCESS EXIT code=${code} uptimeMs=${Date.now() - daemonStartedAt}`);
     } catch {
     }
   });
   function shutdown(code, reason = "unknown") {
     try {
-      log5(`SHUTDOWN reason=${reason} code=${code} uptimeMs=${Date.now() - daemonStartedAt} ppid=${process.ppid} pid=${process.pid}`);
-      log5(`SHUTDOWN caller: ${(new Error("shutdown").stack ?? "").split("\n").slice(2, 7).map((l) => l.trim()).join("  <-  ")}`);
+      log9(`SHUTDOWN reason=${reason} code=${code} uptimeMs=${Date.now() - daemonStartedAt} ppid=${process.ppid} pid=${process.pid}`);
+      log9(`SHUTDOWN caller: ${(new Error("shutdown").stack ?? "").split("\n").slice(2, 7).map((l) => l.trim()).join("  <-  ")}`);
     } catch {
     }
     if (timer) {
@@ -80799,18 +82047,60 @@ async function runDaemon(opts = {}) {
   }
   process.on("SIGTERM", () => shutdown(0, "signal:SIGTERM"));
   process.on("SIGINT", () => shutdown(0, "signal:SIGINT"));
+  process.on("uncaughtException", (e) => {
+    try {
+      log9(`UNCAUGHT (kept alive): ${e instanceof Error ? e.stack ?? e.message : String(e)}`);
+    } catch {
+    }
+  });
+  process.on("unhandledRejection", (r) => {
+    try {
+      log9(`UNHANDLED REJECTION (kept alive): ${r instanceof Error ? r.stack ?? r.message : String(r)}`);
+    } catch {
+    }
+  });
+  setInterval(() => {
+  }, 1 << 30);
+  try {
+    const eapp = electronModule()?.app;
+    if (eapp) {
+      eapp.on("before-quit", (e) => {
+        try {
+          log9("APP before-quit \u2014 PREVENTED (daemon never self-quits via Electron)");
+        } catch {
+        }
+        try {
+          e?.preventDefault?.();
+        } catch {
+        }
+      });
+      eapp.on("render-process-gone", (_e, d) => {
+        try {
+          log9(`render-process-gone (kept alive): ${JSON.stringify(d)}`);
+        } catch {
+        }
+      });
+      eapp.on("child-process-gone", (_e, d) => {
+        try {
+          log9(`child-process-gone (kept alive): ${JSON.stringify(d)}`);
+        } catch {
+        }
+      });
+    }
+  } catch {
+  }
   if (process.env.CCB_RDESK_ROLE !== "client")
     process.env.CCB_HOST_DAEMON = "1";
   const localToken = randomBytes8(24).toString("hex");
   try {
-    localServer = await startLocalServer({ hostRoot: resolveHostRoot(), token: localToken, log: log5, getRdesk: () => rdeskManager, loopbackRdeskSend });
+    localServer = await startLocalServer({ hostRoot: resolveHostRoot(), token: localToken, log: log9, getRdesk: () => rdeskManager, loopbackRdeskSend });
     localInfo = { localPort: localServer.port, localToken };
   } catch (e) {
-    log5("local listener failed to start", e.message);
+    log9("local listener failed to start", e.message);
   }
   writeStatus({ deviceId: deviceId2, connected: false });
   try {
-    registerNativeHost({ daemonDir: daemonDir2(), log: log5 });
+    registerNativeHost({ daemonDir: daemonDir2(), log: log9 });
   } catch {
   }
   const syncActivity = () => {
@@ -80829,12 +82119,12 @@ async function runDaemon(opts = {}) {
   try {
     await opts.onOwned?.();
   } catch (e) {
-    log5("onOwned hook failed", e.message);
+    log9("onOwned hook failed", e.message);
   }
   if (!creds3) {
     timer = setInterval(() => writeStatus({ deviceId: deviceId2, connected: false, localOnly: true }), 6e4);
     writeStatus({ deviceId: deviceId2, connected: false, localOnly: true });
-    log5(`started LOCAL-ONLY (not signed in) \u2014 local :${localInfo?.localPort ?? "off"}, version ${VERSION}`);
+    log9(`started LOCAL-ONLY (not signed in) \u2014 local :${localInfo?.localPort ?? "off"}, version ${VERSION}`);
     return;
   }
   const c = creds3;
@@ -80843,10 +82133,20 @@ async function runDaemon(opts = {}) {
   void (async () => {
     try {
       const id = await loadOrCreateDeviceIdentity();
-      const ok = await registerDeviceKey({ apiOrigin: c.apiOrigin, accessToken, deviceId: c.deviceId, publicRaw: id.publicRaw, label: hostname4() });
-      log5(ok ? "e2e identity registered" : "e2e identity registration not accepted (will retry on restart)");
+      const sealing = await loadOrCreateSealingKey();
+      const sealingPubSig = await attestSealingKey(id.privateKey, sealing.publicRaw);
+      const ok = await registerDeviceKey({
+        apiOrigin: c.apiOrigin,
+        accessToken,
+        deviceId: c.deviceId,
+        publicRaw: id.publicRaw,
+        label: hostname4(),
+        sealingPub: b64u(sealing.publicRaw),
+        sealingPubSig
+      });
+      log9(ok ? "e2e identity + sealing key registered" : "e2e identity registration not accepted (will retry on restart)");
     } catch (e) {
-      log5("e2e identity registration failed (non-fatal)", e.message);
+      log9("e2e identity registration failed (non-fatal)", e.message);
     }
   })();
   async function refresh() {
@@ -80857,11 +82157,11 @@ async function runDaemon(opts = {}) {
         body: JSON.stringify({ dtid: c.dtid, refreshSecret: c.refreshSecret })
       });
       if (!r.ok) {
-        log5("token refresh rejected", r.status);
+        log9("token refresh rejected", r.status);
         if (r.status === 401) {
-          log5("device token no longer valid \u2014 dropping to local-only on restart");
+          log9("device token no longer valid \u2014 dropping to local-only on restart");
           try {
-            unlinkSync3(join50(daemonDir2(), "credentials.json"));
+            unlinkSync4(join54(daemonDir2(), "credentials.json"));
           } catch {
           }
           shutdown(0, "token-revoked-401");
@@ -80873,15 +82173,53 @@ async function runDaemon(opts = {}) {
         accessToken = data.accessToken;
         writeCredentials({ ...c, accessToken: data.accessToken, expiresAt: data.expiresAt ?? c.expiresAt, publicId: data.publicId ?? c.publicId });
         refreshControlLink();
-        log5("token refreshed");
+        log9("token refreshed");
       }
     } catch (e) {
-      log5("token refresh failed (will retry)", e.message);
+      log9("token refresh failed (will retry)", e.message);
     }
   }
   registerTesseractEngine({ getIceServers: () => fetchIceServers() });
   registerVncEngine();
   registerRdpEngine();
+  initDropReceiveUi({ hostLabel: (hostId) => listHosts().find((h) => h.hostId === hostId)?.name });
+  const dropsBase = `${c.apiOrigin.replace(/\/$/, "")}/api/core/tesseract/drops`;
+  const drops = createDropHandler({
+    api: async (path6, init) => {
+      const method = init?.method ?? "GET";
+      const hasBody = method !== "GET" && method !== "HEAD";
+      const r = await fetch(`${dropsBase}${path6}`, {
+        method,
+        headers: { authorization: `Bearer ${accessToken}`, ...hasBody ? { "content-type": "application/json" } : {} },
+        ...hasBody ? { body: JSON.stringify(init?.body ?? {}) } : {},
+        signal: AbortSignal.timeout(1e4)
+      });
+      if (!r.ok)
+        throw new Error(`drops ${path6} \u2192 ${r.status}`);
+      return await r.json().catch(() => ({}));
+    },
+    deviceId: () => c.deviceId,
+    ownHostId: () => ownHost() || null,
+    canPrompt: () => !!electronModule(),
+    confirm: async (spec, signal) => (await confirmAction(spec, { signal })).confirmed,
+    // Store-and-forward: we won the claim, so pull the bytes and (for cross-user
+    // drops) open the one seal in the fan-out that was made for THIS device.
+    fetchBlobDrop: async ({ dropId, destDir, claim, sender }) => {
+      await fetchBlobDrop({
+        dropId,
+        destDir,
+        apiOrigin: c.apiOrigin,
+        items: claim.items ?? [],
+        sealedKey: claim.sealedKey,
+        sealingPrivate: async () => (await loadOrCreateSealingKey()).privateKey,
+        // Present ⇒ cross-user ⇒ quarantine, so the OS treats the file as foreign.
+        sender
+      });
+    }
+    // No startLiveSend here: SENDING is driven by the app (a client tells the source
+    // host to begin, exactly like the existing copy-to-machine flow). The daemon is
+    // the receiving half, and the source host it addresses may well be this daemon.
+  });
   let rdeskRef = null;
   const rdesk = new RdeskSessionManager({
     createEngine: createRemoteDesktopEngine,
@@ -80912,8 +82250,64 @@ async function runDaemon(opts = {}) {
     onSessionsChanged: (sessions3) => {
       writeStatus({ deviceId: c.deviceId, connected: true, rdeskSessions: sessions3.length });
       setRdeskTraySessions(sessions3.length, () => void rdeskRef?.disconnectAll("host"));
+      if (sessions3.length === 0)
+        closeRdeskCallWindow();
+    },
+    // A viewer joined/left the in-session voice/video call → open/close the operator call window,
+    // joined to the SAME LiveKit room (= the rdesk sessionId) the viewer is in, so the person at the
+    // host can talk. Reuses the team-chat/huddle conferencing; the daemon mints its own join token
+    // with the device token (identity `${sub}#host`, distinct from the viewer's).
+    onCall: ({ sessionId, on }) => {
+      if (!on) {
+        closeRdeskCallWindow();
+        return;
+      }
+      void (async () => {
+        try {
+          const r = await fetch(`${c.apiOrigin.replace(/\/$/, "")}/api/core/tesseract/conferencing/token`, {
+            method: "POST",
+            headers: { "content-type": "application/json", authorization: `Bearer ${accessToken}` },
+            body: JSON.stringify({ room: sessionId, identity: "host", name: hostname4() }),
+            signal: AbortSignal.timeout(1e4)
+          });
+          if (!r.ok) {
+            log9(`[rdesk call] token mint ${r.status} (conferencing configured?)`);
+            return;
+          }
+          const j = await r.json().catch(() => ({}));
+          if (!j.token || !j.url) {
+            log9("[rdesk call] token response missing token/url");
+            return;
+          }
+          showRdeskCallWindow({ url: j.url, token: j.token, room: sessionId });
+        } catch (e) {
+          log9("[rdesk call] token mint failed", e instanceof Error ? e.message : String(e));
+        }
+      })();
+    },
+    // In-session chat from the viewer → surface it to the operator as a native notification.
+    // On macOS the notification carries an inline REPLY box (hasReply) whose text is sent
+    // straight back via sendChat — a full operator chat loop with no extra window. Off-mac (no
+    // hasReply) it's receive-only for now; the daemon log always records it as a fallback.
+    onChat: ({ sessionId, viewerName, text: text8 }) => {
+      const NotifCtor = electronModule()?.Notification;
+      if (!NotifCtor) {
+        log9(`[rdesk chat] ${viewerName ?? "viewer"}: ${text8}`);
+        return;
+      }
+      try {
+        const n = new NotifCtor({ title: `${viewerName ?? "Remote viewer"} \u2014 remote desktop`, body: text8, hasReply: true, replyPlaceholder: "Reply\u2026" });
+        n.on("reply", (_e, reply3) => {
+          const r = typeof reply3 === "string" ? reply3.trim() : "";
+          if (r)
+            rdeskRef?.sendChat(sessionId, r);
+        });
+        n.show();
+      } catch (e) {
+        log9("[rdesk chat] notify failed", e instanceof Error ? e.message : String(e));
+      }
     },
-    log: (m) => log5(m)
+    log: (m) => log9(m)
   });
   rdeskRef = rdesk;
   rdeskManager = rdesk;
@@ -80922,7 +82316,7 @@ async function runDaemon(opts = {}) {
     token: async () => accessToken,
     deviceId: c.deviceId,
     projectDir: daemonWorkspaceDir(),
-    log: (...args) => log5("chat-agent", ...args.map((a) => String(a)))
+    log: (...args) => log9("chat-agent", ...args.map((a) => String(a)))
   });
   const hooks2 = {
     deliverToRenderer: () => {
@@ -80939,7 +82333,7 @@ async function runDaemon(opts = {}) {
       getRdeskClientWebContents()?.send("hostlink:own", own2);
     },
     notify: (n) => {
-      log5("notify", JSON.stringify(n));
+      log9("notify", JSON.stringify(n));
       getRdeskClientWebContents()?.send("ccb:notify", n);
     },
     // No renderer, but DO forward remote change feeds to the macOS File Provider extension
@@ -80952,6 +82346,7 @@ async function runDaemon(opts = {}) {
     onHostsChanged: () => broadcastFileProviderHostsChanged(),
     pushTransferEvent: () => {
     },
+    onDrop: (msg) => drops.onFrame(msg),
     pushTerm: () => {
     },
     // Remote-desktop host: a viewer drives an rdesk session on this machine.
@@ -81003,13 +82398,13 @@ async function runDaemon(opts = {}) {
         getPeerIdentityPub: (d) => getPeerIdentityPub({ apiOrigin: c.apiOrigin, accessToken, deviceId: d })
       };
     } catch (err2) {
-      log5("e2e responder init failed (staying plaintext)", err2.message);
+      log9("e2e responder init failed (staying plaintext)", err2.message);
     }
   }
   startControlLink({ deviceId: c.deviceId, power: createNodePowerController(), tokenSource, version: VERSION, e2e }, hooks2);
-  startFileProviderBridge(log5);
-  startAutofillBridge(log5);
-  log5(`started \u2014 device ${c.deviceId}, user ${c.userId}, relay ${c.backendOrigin}, local :${localInfo?.localPort ?? "off"}, version ${VERSION}`);
+  startFileProviderBridge(log9);
+  startAutofillBridge(log9);
+  log9(`started \u2014 device ${c.deviceId}, user ${c.userId}, relay ${c.backendOrigin}, local :${localInfo?.localPort ?? "off"}, version ${VERSION}`);
   await refresh();
   timer = setInterval(() => {
     void refresh();
@@ -81034,14 +82429,14 @@ var CHUNK_BYTES = 256 * 1024;
 import { platform as platform3 } from "node:os";
 
 // ../../packages/host-core/dist/service/launchd.js
-import { writeFileSync as writeFileSync26, existsSync as existsSync29, mkdirSync as mkdirSync27, unlinkSync as unlinkSync4 } from "node:fs";
-import { dirname as dirname22, join as join51 } from "node:path";
+import { writeFileSync as writeFileSync26, existsSync as existsSync29, mkdirSync as mkdirSync27, unlinkSync as unlinkSync5 } from "node:fs";
+import { dirname as dirname24, join as join55 } from "node:path";
 import { homedir as homedir8, userInfo } from "node:os";
 
 // ../../packages/host-core/dist/service/exec.js
-import { execFile as execFile6, spawn as spawn10 } from "node:child_process";
-import { promisify as promisify5 } from "node:util";
-var run3 = promisify5(execFile6);
+import { execFile as execFile7, spawn as spawn10 } from "node:child_process";
+import { promisify as promisify6 } from "node:util";
+var run3 = promisify6(execFile7);
 function runInherit(cmd, args) {
   return new Promise((resolve12) => {
     const p = spawn10(cmd, args, { stdio: "inherit" });
@@ -81059,10 +82454,10 @@ function xml(s) {
 }
 function makeLaunchd(instanceId) {
   const label = SERVICE_LABEL_BASE + (instanceId ? `.${instanceId}` : "");
-  const plistPath = () => join51(homedir8(), "Library", "LaunchAgents", `${label}.plist`);
+  const plistPath = () => join55(homedir8(), "Library", "LaunchAgents", `${label}.plist`);
   const domainTarget = () => `gui/${userInfo().uid}`;
   const serviceTarget = () => `${domainTarget()}/${label}`;
-  const logFile = () => join51(daemonDir2(), "daemon.log");
+  const logFile = () => join55(daemonDir2(), "daemon.log");
   const workDirOf = (spec) => spec.workingDirectory ?? daemonDir2();
   function buildPlist(spec) {
     const args = [spec.exec, ...spec.args].map((a) => `      <string>${xml(a)}</string>`).join("\n");
@@ -81108,8 +82503,8 @@ ${env}
   return {
     async install(spec) {
       mkdirSync27(workDirOf(spec), { recursive: true });
-      mkdirSync27(dirname22(plistPath()), { recursive: true });
-      mkdirSync27(dirname22(spec.logPath), { recursive: true });
+      mkdirSync27(dirname24(plistPath()), { recursive: true });
+      mkdirSync27(dirname24(spec.logPath), { recursive: true });
       writeFileSync26(plistPath(), buildPlist(spec));
       await run3("launchctl", ["bootout", serviceTarget()]).catch(() => {
       });
@@ -81124,7 +82519,7 @@ ${env}
       });
       if (existsSync29(plistPath())) {
         try {
-          unlinkSync4(plistPath());
+          unlinkSync5(plistPath());
         } catch {
         }
       }
@@ -81160,8 +82555,8 @@ ${env}
 }
 
 // ../../packages/host-core/dist/service/systemd.js
-import { writeFileSync as writeFileSync27, existsSync as existsSync30, mkdirSync as mkdirSync28, unlinkSync as unlinkSync5 } from "node:fs";
-import { dirname as dirname23, join as join52 } from "node:path";
+import { writeFileSync as writeFileSync27, existsSync as existsSync30, mkdirSync as mkdirSync28, unlinkSync as unlinkSync6 } from "node:fs";
+import { dirname as dirname25, join as join56 } from "node:path";
 import { homedir as homedir9, userInfo as userInfo2 } from "node:os";
 function unitVal(v) {
   return v.replace(/%/g, "%%");
@@ -81172,8 +82567,8 @@ function shq(s) {
 function makeSystemd(instanceId) {
   const unit = `tesseract-host${instanceId ? `-${instanceId}` : ""}.service`;
   const unitPath = () => {
-    const base = process.env.XDG_CONFIG_HOME || join52(homedir9(), ".config");
-    return join52(base, "systemd", "user", unit);
+    const base = process.env.XDG_CONFIG_HOME || join56(homedir9(), ".config");
+    return join56(base, "systemd", "user", unit);
   };
   const workDirOf = (spec) => spec.workingDirectory ?? daemonDir2();
   function buildUnit(spec) {
@@ -81201,8 +82596,8 @@ WantedBy=default.target
   return {
     async install(spec) {
       mkdirSync28(workDirOf(spec), { recursive: true });
-      mkdirSync28(dirname23(unitPath()), { recursive: true });
-      mkdirSync28(dirname23(spec.logPath), { recursive: true });
+      mkdirSync28(dirname25(unitPath()), { recursive: true });
+      mkdirSync28(dirname25(spec.logPath), { recursive: true });
       writeFileSync27(unitPath(), buildUnit(spec));
       await run3("loginctl", ["enable-linger", userInfo2().username]).catch(() => {
       });
@@ -81217,7 +82612,7 @@ WantedBy=default.target
       });
       if (existsSync30(unitPath())) {
         try {
-          unlinkSync5(unitPath());
+          unlinkSync6(unitPath());
         } catch {
         }
       }
@@ -81246,12 +82641,12 @@ WantedBy=default.target
 }
 
 // ../../packages/host-core/dist/service/windows.js
-import { writeFileSync as writeFileSync28, existsSync as existsSync31, mkdirSync as mkdirSync29, unlinkSync as unlinkSync6 } from "node:fs";
-import { dirname as dirname24, join as join53 } from "node:path";
+import { writeFileSync as writeFileSync28, existsSync as existsSync31, mkdirSync as mkdirSync29, unlinkSync as unlinkSync7 } from "node:fs";
+import { dirname as dirname26, join as join57 } from "node:path";
 function makeWindowsTask(instanceId) {
   const task = `Fineguide\\TesseractHost${instanceId ? `-${instanceId}` : ""}`;
-  const wrapperPath = () => join53(daemonDir2(), `run-host${instanceId ? `-${instanceId}` : ""}.cmd`);
-  const logFile = () => join53(daemonDir2(), "daemon.log");
+  const wrapperPath = () => join57(daemonDir2(), `run-host${instanceId ? `-${instanceId}` : ""}.cmd`);
+  const logFile = () => join57(daemonDir2(), "daemon.log");
   const oneLine2 = (s) => s.replace(/[\r\n]+/g, " ");
   const envVal = (v) => oneLine2(v).replace(/%/g, "%%").replace(/"/g, "");
   const cmdArg = (a) => `"${oneLine2(a).replace(/"/g, "")}"`;
@@ -81268,8 +82663,8 @@ start "" /b ${cmd} >> "${oneLine2(spec.logPath).replace(/"/g, "")}" 2>&1\r
   return {
     async install(spec) {
       mkdirSync29(spec.workingDirectory ?? daemonDir2(), { recursive: true });
-      mkdirSync29(dirname24(spec.logPath), { recursive: true });
-      mkdirSync29(dirname24(wrapperPath()), { recursive: true });
+      mkdirSync29(dirname26(spec.logPath), { recursive: true });
+      mkdirSync29(dirname26(wrapperPath()), { recursive: true });
       writeFileSync28(wrapperPath(), buildWrapper(spec));
       await run3("schtasks", ["/Create", "/TN", task, "/SC", "ONLOGON", "/RL", "LIMITED", "/F", "/TR", `"${wrapperPath()}"`]);
       await run3("schtasks", ["/Run", "/TN", task]).catch(() => {
@@ -81280,7 +82675,7 @@ start "" /b ${cmd} >> "${oneLine2(spec.logPath).replace(/"/g, "")}" 2>&1\r
       });
       if (existsSync31(wrapperPath())) {
         try {
-          unlinkSync6(wrapperPath());
+          unlinkSync7(wrapperPath());
         } catch {
         }
       }
@@ -81334,9 +82729,9 @@ function getServiceController(instanceId) {
 
 // src/auth.ts
 var import_qrcode_terminal = __toESM(require_main(), 1);
-import { randomUUID as randomUUID17 } from "node:crypto";
+import { randomUUID as randomUUID18 } from "node:crypto";
 import { existsSync as existsSync32, rmSync as rmSync8 } from "node:fs";
-import { join as join54 } from "node:path";
+import { join as join58 } from "node:path";
 
 // src/config.ts
 import { hostname as hostname5 } from "node:os";
@@ -81476,7 +82871,7 @@ async function login(opts) {
       process.exit(1);
     }
   }
-  const deviceId2 = readCredentials()?.deviceId ?? process.env.CCB_DEVICE_ID ?? randomUUID17().slice(0, 8);
+  const deviceId2 = readCredentials()?.deviceId ?? process.env.CCB_DEVICE_ID ?? randomUUID18().slice(0, 8);
   const label = opts.name ?? defaultLabel();
   if (opts.token) {
     const dt = await fetchJson(`${api}/auth/device-token`, {
@@ -81537,7 +82932,7 @@ async function logout() {
   }
   for (const f of ["credentials.json", "status.json", "daemon.lock"]) {
     try {
-      const p = join54(daemonDir2(), f);
+      const p = join58(daemonDir2(), f);
       if (existsSync32(p)) rmSync8(p);
     } catch {
     }
@@ -81584,7 +82979,7 @@ function isNewer(latest, current) {
   for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] > b[i];
   return false;
 }
-function log4(...args) {
+function log8(...args) {
   console.log(`[self-update ${(/* @__PURE__ */ new Date()).toISOString()}]`, ...args);
 }
 async function fetchLatest() {
@@ -81630,25 +83025,25 @@ function verifyNpmSignature(version2, integrity, sig) {
 function installVersion(target) {
   return new Promise((resolve12) => {
     const npm = process.platform === "win32" ? "npm.cmd" : "npm";
-    log4(`installing tesseract-agent@${target} \u2026`);
+    log8(`installing tesseract-agent@${target} \u2026`);
     let child;
     try {
       child = spawn11(npm, ["install", "-g", `tesseract-agent@${target}`], { stdio: ["ignore", "inherit", "inherit"] });
     } catch (e) {
-      log4("npm spawn threw:", e instanceof Error ? e.message : String(e));
+      log8("npm spawn threw:", e instanceof Error ? e.message : String(e));
       resolve12(false);
       return;
     }
     child.on("error", (e) => {
-      log4("npm not runnable:", e.message);
+      log8("npm not runnable:", e.message);
       resolve12(false);
     });
     child.on("close", (code) => {
       if (code === 0) {
-        log4(`installed ${target}`);
+        log8(`installed ${target}`);
         resolve12(true);
       } else {
-        log4(`npm install exited ${code} \u2014 staying on the current version`);
+        log8(`npm install exited ${code} \u2014 staying on the current version`);
         resolve12(false);
       }
     });
@@ -81661,15 +83056,15 @@ async function checkOnce(current) {
   try {
     const latest = await fetchLatest();
     if (!latest || !isNewer(latest, current)) return;
-    log4(`update available: ${current} \u2192 ${latest}`);
+    log8(`update available: ${current} \u2192 ${latest}`);
     const dist = await fetchVersionDist(latest);
     if (!verifyNpmSignature(latest, dist?.integrity, dist?.sig)) {
-      log4(`REFUSING update to ${latest}: registry signature did not verify \u2014 staying on ${current}`);
+      log8(`REFUSING update to ${latest}: registry signature did not verify \u2014 staying on ${current}`);
       return;
     }
-    log4(`registry signature verified for ${latest} (keyid ${dist?.keyid ?? "?"})`);
+    log8(`registry signature verified for ${latest} (keyid ${dist?.keyid ?? "?"})`);
     if (await installVersion(latest)) {
-      log4("restarting on the new version (supervisor re-spawns) \u2026");
+      log8("restarting on the new version (supervisor re-spawns) \u2026");
       process.exit(RESTART_EXIT_CODE);
     }
   } finally {
@@ -81678,11 +83073,11 @@ async function checkOnce(current) {
 }
 function startSelfUpdater(current) {
   if (disabled()) {
-    log4("disabled via TESSERACT_AUTO_UPDATE/CCB_AUTO_UPDATE");
+    log8("disabled via TESSERACT_AUTO_UPDATE/CCB_AUTO_UPDATE");
     return;
   }
   if (!isReleaseVersion(current)) {
-    log4(`skipped \u2014 non-release version "${current}"`);
+    log8(`skipped \u2014 non-release version "${current}"`);
     return;
   }
   const first = setTimeout(() => {
@@ -81696,7 +83091,7 @@ function startSelfUpdater(current) {
 }
 
 // src/service.ts
-import { join as join55 } from "node:path";
+import { join as join59 } from "node:path";
 import { platform as platform4 } from "node:os";
 import { existsSync as existsSync33, readFileSync as readFileSync31 } from "node:fs";
 function controller(instanceId) {
@@ -81711,7 +83106,7 @@ function buildSpec(cliEntry) {
     exec: process.execPath,
     args: [cliEntry, "run"],
     env: { CCB_DAEMON_DIR: daemonDir2() },
-    logPath: join55(daemonDir2(), "daemon.log")
+    logPath: join59(daemonDir2(), "daemon.log")
   };
 }
 var isAlive = (pid) => {
@@ -81723,7 +83118,7 @@ var isAlive = (pid) => {
   }
 };
 function runningDaemonInfo() {
-  const lock = join55(daemonDir2(), "daemon.lock");
+  const lock = join59(daemonDir2(), "daemon.lock");
   try {
     if (!existsSync33(lock)) return null;
     const pid = Number(readFileSync31(lock, "utf-8").trim());
@@ -81762,7 +83157,7 @@ async function logs(instanceId, follow) {
 // src/cli.ts
 function pkgVersion() {
   try {
-    const p = join56(dirname25(fileURLToPath4(import.meta.url)), "..", "package.json");
+    const p = join60(dirname27(fileURLToPath4(import.meta.url)), "..", "package.json");
     return JSON.parse(readFileSync32(p, "utf8")).version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -81955,7 +83350,7 @@ async function linkCommand(rest, flags) {
   process.exit(1);
 }
 async function captureClaudeSubscription(flags) {
-  const home = mkdtempSync2(join56(tmpdir4(), "tesseract-claude-login-"));
+  const home = mkdtempSync2(join60(tmpdir4(), "tesseract-claude-login-"));
   const binary = typeof flags["claude-path"] === "string" ? flags["claude-path"] : process.env.CCB_ENGINE_PATH_CLAUDE_CODE || "claude";
   const args = ["auth", "login", "--claudeai"];
   if (typeof flags.email === "string") args.push("--email", flags.email);
@@ -81972,7 +83367,7 @@ async function captureClaudeSubscription(flags) {
       child.once("close", (exitCode, signal) => resolveCode(signal ? 1 : exitCode ?? 1));
     });
     if (code !== 0) throw new Error(`Claude sign-in did not complete (exit ${code}).`);
-    const file2 = join56(home, ".credentials.json");
+    const file2 = join60(home, ".credentials.json");
     if (existsSync34(file2)) return readFileSync32(file2, "utf8");
     if (process.platform === "darwin") {
       const value = execFileSync5("security", [