@buda-ai/connector 0.1.6 → 0.1.8

package/dist/cli.js

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 
 // src/config.ts
-import { createHash as createHash2, randomBytes, randomUUID } from "crypto";
+import { createHash as createHash2, randomBytes, randomUUID as randomUUID2 } from "crypto";
 import { chmod, mkdir, readFile as readFile2, rename, unlink as unlink2, writeFile } from "fs/promises";
 import { homedir, hostname, platform as platform2 } from "os";
 import path from "path";
 
 // src/exclusive-file-lock.ts
+import { randomUUID } from "crypto";
 import { open, readFile, stat, unlink } from "fs/promises";
 var DEFAULT_TIMEOUT_MS = 1e4;
 var DEFAULT_STALE_MS = 12e4;
@@ -33,8 +34,11 @@ async function acquireExclusiveFileLock(targetPath, options = {}) {
       await wait(pollMs);
       continue;
     }
-    await handle.writeFile(`${JSON.stringify({ pid: process.pid, createdAt: Date.now() })}
-`);
+    const ownerToken = randomUUID();
+    await handle.writeFile(
+      `${JSON.stringify({ pid: process.pid, ownerToken, createdAt: Date.now() })}
+`
+    );
     await handle.sync();
     let released = false;
     return {
@@ -42,7 +46,8 @@ async function acquireExclusiveFileLock(targetPath, options = {}) {
         if (released) return;
         released = true;
         await handle.close();
-        await unlink(lockPath).catch(() => void 0);
+        const currentOwner = await readFile(lockPath, "utf8").then((raw) => JSON.parse(raw).ownerToken).catch(() => void 0);
+        if (currentOwner === ownerToken) await unlink(lockPath).catch(() => void 0);
       }
     };
   }
@@ -154,12 +159,23 @@ function getConnectorProfileKey(serverUrl, token) {
   const discriminator = token?.trim() ? getConnectorTokenFingerprint(token) : "legacy-no-token";
   return `${getServerOriginKey(serverUrl)}--${discriminator}`;
 }
+function getConnectorIdentityKey(deviceId, serverUrl, spaceId) {
+  const normalizedSpaceId = spaceId.trim();
+  if (!deviceId.trim() || !normalizedSpaceId) {
+    throw new Error("Connector identity requires deviceId and spaceId");
+  }
+  const digest = createHash2("sha256").update(`${deviceId.trim()}
+${normalizeServerOrigin(serverUrl)}
+${normalizedSpaceId}`, "utf8").digest("hex").slice(0, 24);
+  const spaceKey = normalizedSpaceId.replace(/[^a-z0-9_-]+/gi, "-").toLowerCase();
+  return `${getServerOriginKey(serverUrl)}--${spaceKey}--${digest}`;
+}
 function getConnectorPaths(serverUrl, configRoot = path.join(homedir(), ".buda")) {
   const scopedLegacyDir = path.join(configRoot, "servers", getServerOriginKey(serverUrl));
   return {
     configDir: configRoot,
     configPath: path.join(configRoot, "device.json"),
-    logPath: path.join(configRoot, "connector.log"),
+    logPath: path.join(configRoot, "logs", "connector.log"),
     workdirRoot: path.join(configRoot, "agents"),
     scopedLegacyConfigPath: path.join(scopedLegacyDir, "device.json"),
     scopedLegacyWorkdirRoot: path.join(scopedLegacyDir, "agents")
@@ -175,6 +191,17 @@ function getConnectorDaemonLockTarget(serverUrl, connectorId, configRoot = path.
     "connector-daemon"
   );
 }
+function getConnectorBootstrapLockTarget(launchConfig, configRoot = path.join(homedir(), ".buda")) {
+  const serverUrl = getServerUrl(launchConfig);
+  const scope = launchConfig?.spaceId?.trim() ? `space-${launchConfig.spaceId.trim()}` : getConnectorToken(launchConfig) ? `token-${getConnectorTokenFingerprint(getConnectorToken(launchConfig)).slice(0, 24)}` : "oauth-unresolved";
+  return path.join(
+    configRoot,
+    "daemons",
+    getServerOriginKey(serverUrl),
+    scope.replace(/[^a-z0-9_-]+/gi, "-").toLowerCase(),
+    "bootstrap"
+  );
+}
 function getServerUrl(launchConfig) {
   return (launchConfig?.serverUrl || process.env.BUDA_CONNECTOR_SERVER_URL || process.env.BUDA_SERVER_URL || process.env.NEXT_PUBLIC_APP_URL || DEFAULT_SERVER_URL).replace(/\/$/, "");
 }
@@ -184,6 +211,13 @@ function getConnectorRelayUrl(serverUrl, connectorId) {
   url.searchParams.set("connectorId", connectorId);
   return url.toString();
 }
+function getConnectorTerminalUrl(serverUrl, connectorId, sessionId) {
+  const url = new URL("/api/connectors/terminal", serverUrl);
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  url.searchParams.set("connectorId", connectorId);
+  url.searchParams.set("sessionId", sessionId);
+  return url.toString();
+}
 function getWorkdirRoot(launchConfig) {
   return launchConfig?.workdirRoot || process.env.BUDA_CONNECTOR_WORKDIR || getConnectorPaths(getServerUrl(launchConfig)).workdirRoot;
 }
@@ -200,15 +234,16 @@ function getBunnyDaemonPort(launchConfig) {
 function getConnectorToken(launchConfig) {
   return launchConfig?.token?.trim() || process.env.BUDA_CONNECTOR_TOKEN?.trim() || void 0;
 }
-function buildDeviceConfig(launchConfig, deviceId = `dvc_${randomUUID()}`) {
+function buildDeviceConfig(launchConfig, deviceId = `dvc_${randomUUID2()}`) {
   const host = hostname();
   const token = getConnectorToken(launchConfig);
   return {
-    connectorId: `cnr_${randomUUID()}`,
+    connectorId: `cnr_${randomUUID2()}`,
     deviceId,
     deviceName: host,
     hostLabel: `${host} (${platform2()})`,
     serverUrl: getServerUrl(launchConfig),
+    ...launchConfig?.spaceId?.trim() ? { spaceId: launchConfig.spaceId.trim() } : {},
     workdirRoot: getWorkdirRoot(launchConfig),
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     deviceToken: randomBytes(32).toString("base64url"),
@@ -220,12 +255,18 @@ function isDeviceConfig(value) {
   const config = value;
   return typeof config.connectorId === "string" && typeof config.deviceId === "string" && typeof config.serverUrl === "string";
 }
+function isCanonicalDeviceConfig(value) {
+  return isDeviceConfig(value) && typeof value.spaceId === "string" && value.spaceId.trim().length > 0;
+}
 async function readJsonFile(configPath) {
   try {
     const raw = await readFile2(configPath, "utf8");
     return JSON.parse(raw);
-  } catch {
-    return null;
+  } catch (error) {
+    if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") {
+      return null;
+    }
+    throw new Error(`Invalid Connector config ${configPath}`, { cause: error });
   }
 }
 function migrateLegacyProfiles(values) {
@@ -242,36 +283,68 @@ function migrateLegacyProfiles(values) {
 async function loadDeviceConfigStore(configPath) {
   const parsed = await readJsonFile(configPath);
   const candidate = parsed;
+  if (candidate?.version === 4 && candidate.identities && typeof candidate.identities === "object" && candidate.aliases && typeof candidate.aliases === "object") {
+    const identities = candidate.identities;
+    for (const [identityKey, value] of Object.entries(identities)) {
+      if (!isCanonicalDeviceConfig(value)) {
+        throw new Error(`Invalid canonical Connector identity ${identityKey}`);
+      }
+      const expected = getConnectorIdentityKey(value.deviceId, value.serverUrl, value.spaceId);
+      if (identityKey !== expected) {
+        throw new Error(`Connector identity key does not match ${value.deviceId}/${value.spaceId}`);
+      }
+    }
+    return {
+      store: {
+        version: 4,
+        ...typeof candidate.systemDeviceId === "string" ? { systemDeviceId: candidate.systemDeviceId } : {},
+        identities,
+        aliases: candidate.aliases
+      },
+      legacyProfiles: {},
+      needsWrite: false
+    };
+  }
   if (candidate?.version === 3 && candidate.profiles && typeof candidate.profiles === "object") {
     return {
       store: {
-        version: 3,
+        version: 4,
         ...typeof candidate.systemDeviceId === "string" ? { systemDeviceId: candidate.systemDeviceId } : {},
-        profiles: candidate.profiles
+        identities: {},
+        aliases: {}
       },
+      legacyProfiles: candidate.profiles,
       needsWrite: false
     };
   }
   if (candidate && (candidate.version === 1 || candidate.version === 2) && candidate.servers && typeof candidate.servers === "object") {
     return {
       store: {
-        version: 3,
+        version: 4,
         ...typeof candidate.systemDeviceId === "string" ? { systemDeviceId: candidate.systemDeviceId } : {},
-        profiles: migrateLegacyProfiles(Object.values(candidate.servers))
+        identities: {},
+        aliases: {}
       },
-      needsWrite: true
+      legacyProfiles: migrateLegacyProfiles(Object.values(candidate.servers)),
+      needsWrite: false
     };
   }
   if (isDeviceConfig(parsed)) {
     return {
       store: {
-        version: 3,
-        profiles: migrateLegacyProfiles([parsed])
+        version: 4,
+        identities: {},
+        aliases: {}
       },
-      needsWrite: true
+      legacyProfiles: migrateLegacyProfiles([parsed]),
+      needsWrite: false
     };
   }
-  return { store: { version: 3, profiles: {} }, needsWrite: false };
+  return {
+    store: { version: 4, identities: {}, aliases: {} },
+    legacyProfiles: {},
+    needsWrite: false
+  };
 }
 function normalizeStoredWorkdirRoot(config, paths) {
   const configuredRoot = config.workdirRoot?.trim();
@@ -289,7 +362,7 @@ function normalizeStoredWorkdirRoot(config, paths) {
 }
 async function writeDeviceConfigStore(configPath, store) {
   await mkdir(path.dirname(configPath), { recursive: true });
-  const temporaryPath = `${configPath}.${process.pid}.${randomUUID()}.tmp`;
+  const temporaryPath = `${configPath}.${process.pid}.${randomUUID2()}.tmp`;
   try {
     await writeFile(temporaryPath, `${JSON.stringify(store, null, 2)}
 `, { mode: 384 });
@@ -299,36 +372,70 @@ async function writeDeviceConfigStore(configPath, store) {
     await unlink2(temporaryPath).catch(() => void 0);
   }
 }
+function findStoredDeviceConfig(store, legacyProfiles, launchConfig, serverUrl, paths) {
+  const aliases = [
+    ...launchConfig?.spaceId?.trim() ? [`${getServerOriginKey(serverUrl)}--space--${launchConfig.spaceId.trim()}`] : [],
+    ...getConnectorToken(launchConfig) ? [getConnectorProfileKey(serverUrl, getConnectorToken(launchConfig))] : []
+  ];
+  const identityKey = aliases.map((alias) => store.aliases[alias]).find(Boolean);
+  let storedConfig = identityKey ? store.identities[identityKey] : void 0;
+  if (!storedConfig && getConnectorToken(launchConfig)) {
+    const legacyKey = getConnectorProfileKey(serverUrl, getConnectorToken(launchConfig));
+    storedConfig = legacyProfiles[legacyKey];
+  }
+  if (!isDeviceConfig(storedConfig)) return null;
+  return normalizeStoredWorkdirRoot(storedConfig, paths).config;
+}
+function putCanonicalDeviceConfig(store, config) {
+  if (!config.spaceId?.trim()) {
+    throw new Error("Cannot persist Connector identity before the server resolves spaceId");
+  }
+  const spaceId = config.spaceId.trim();
+  const identityKey = getConnectorIdentityKey(config.deviceId, config.serverUrl, spaceId);
+  store.identities[identityKey] = { ...config, spaceId };
+  store.aliases[`${getServerOriginKey(config.serverUrl)}--space--${spaceId}`] = identityKey;
+  if (config.token?.trim()) {
+    store.aliases[getConnectorProfileKey(config.serverUrl, config.token)] = identityKey;
+  }
+}
 async function readDeviceConfig(launchConfig, configRoot) {
   const serverUrl = getServerUrl(launchConfig);
   const paths = getConnectorPaths(serverUrl, configRoot);
-  const launchToken = getConnectorToken(launchConfig);
   await mkdir(paths.configDir, { recursive: true });
   return withExclusiveFileLock(paths.configPath, async () => {
-    const { store, needsWrite } = await loadDeviceConfigStore(paths.configPath);
-    const profileKey = getConnectorProfileKey(serverUrl, launchToken);
-    const storedConfig = store.profiles[profileKey];
-    let config = isDeviceConfig(storedConfig) ? storedConfig : null;
-    let normalizedWorkdirRoot = false;
-    if (config) {
-      const normalized = normalizeStoredWorkdirRoot(config, paths);
-      config = normalized.config;
-      normalizedWorkdirRoot = normalized.changed;
-      store.profiles[getConnectorProfileKey(config.serverUrl, config.token)] = config;
-    }
-    if (needsWrite || normalizedWorkdirRoot) {
-      await writeDeviceConfigStore(paths.configPath, store);
+    const { store, legacyProfiles } = await loadDeviceConfigStore(paths.configPath);
+    return findStoredDeviceConfig(store, legacyProfiles, launchConfig, serverUrl, paths);
+  });
+}
+async function listDeviceConfigs(configRoot) {
+  const paths = getConnectorPaths(DEFAULT_SERVER_URL, configRoot);
+  await mkdir(paths.configDir, { recursive: true });
+  return withExclusiveFileLock(paths.configPath, async () => {
+    const { legacyProfiles, store } = await loadDeviceConfigStore(paths.configPath);
+    const identities = [...Object.values(store.identities), ...Object.values(legacyProfiles)].filter(isCanonicalDeviceConfig).map(
+      (config) => normalizeStoredWorkdirRoot(config, getConnectorPaths(config.serverUrl, configRoot)).config
+    );
+    const unique = /* @__PURE__ */ new Map();
+    for (const config of identities) {
+      unique.set(`${normalizeServerOrigin(config.serverUrl)}
+${config.connectorId}`, config);
     }
-    return config;
+    return [...unique.values()].sort(
+      (left, right) => left.createdAt.localeCompare(right.createdAt) || left.connectorId.localeCompare(right.connectorId)
+    );
   });
 }
 async function writeDeviceConfig(config, configRoot) {
+  if (!config.spaceId?.trim()) {
+    throw new Error("Cannot persist Connector identity before the server resolves spaceId");
+  }
+  const spaceId = config.spaceId.trim();
   const paths = getConnectorPaths(config.serverUrl, configRoot);
   await mkdir(config.workdirRoot, { recursive: true });
   await mkdir(paths.configDir, { recursive: true });
   await withExclusiveFileLock(paths.configPath, async () => {
     const { store } = await loadDeviceConfigStore(paths.configPath);
-    store.profiles[getConnectorProfileKey(config.serverUrl, config.token)] = config;
+    putCanonicalDeviceConfig(store, { ...config, spaceId });
     await writeDeviceConfigStore(paths.configPath, store);
   });
 }
@@ -336,13 +443,12 @@ async function getOrCreateSystemDeviceId(configRoot, resolver = resolveSystemDev
   const paths = getConnectorPaths(DEFAULT_SERVER_URL, configRoot);
   await mkdir(paths.configDir, { recursive: true });
   return withExclusiveFileLock(paths.configPath, async () => {
-    const { store, needsWrite } = await loadDeviceConfigStore(paths.configPath);
+    const { store, legacyProfiles } = await loadDeviceConfigStore(paths.configPath);
     if (store.systemDeviceId) {
-      if (needsWrite) await writeDeviceConfigStore(paths.configPath, store);
       return store.systemDeviceId;
     }
-    const existingDeviceId = Object.values(store.profiles).find(isDeviceConfig)?.deviceId;
-    store.systemDeviceId = resolver() || existingDeviceId || `dvc_${randomUUID()}`;
+    const existingDeviceId = Object.values(store.identities).find(isDeviceConfig)?.deviceId ?? Object.values(legacyProfiles).find(isDeviceConfig)?.deviceId;
+    store.systemDeviceId = resolver() || existingDeviceId || `dvc_${randomUUID2()}`;
     await writeDeviceConfigStore(paths.configPath, store);
     return store.systemDeviceId;
   });
@@ -354,33 +460,28 @@ async function createDeviceConfig(launchConfig, configRoot, resolver) {
 async function ensureDeviceConfig(launchConfig, configRoot, resolver = resolveSystemDeviceId) {
   const serverUrl = getServerUrl(launchConfig);
   const paths = getConnectorPaths(serverUrl, configRoot);
-  const token = getConnectorToken(launchConfig);
-  const profileKey = getConnectorProfileKey(serverUrl, token);
   await mkdir(paths.configDir, { recursive: true });
   const config = await withExclusiveFileLock(paths.configPath, async () => {
-    const { store, needsWrite } = await loadDeviceConfigStore(paths.configPath);
-    const storedConfig = store.profiles[profileKey];
-    if (isDeviceConfig(storedConfig)) {
-      const normalized = normalizeStoredWorkdirRoot(storedConfig, paths);
-      if (needsWrite || normalized.changed) {
-        store.profiles[profileKey] = normalized.config;
-        await writeDeviceConfigStore(paths.configPath, store);
-      }
-      const existing = normalized.config;
-      const overrideToken = getConnectorToken(launchConfig);
-      return {
+    const { store, legacyProfiles } = await loadDeviceConfigStore(paths.configPath);
+    const existing = findStoredDeviceConfig(store, legacyProfiles, launchConfig, serverUrl, paths);
+    if (existing) {
+      const resolved = {
         ...existing,
         serverUrl,
         workdirRoot: launchConfig?.workdirRoot || process.env.BUDA_CONNECTOR_WORKDIR || existing.workdirRoot || getWorkdirRoot(launchConfig),
-        ...overrideToken ? { token: overrideToken } : {}
+        ...getConnectorToken(launchConfig) ? { token: getConnectorToken(launchConfig) } : {}
       };
+      if (isCanonicalDeviceConfig(resolved)) {
+        putCanonicalDeviceConfig(store, resolved);
+        await writeDeviceConfigStore(paths.configPath, store);
+      }
+      return resolved;
     }
-    if (!store.systemDeviceId) {
-      const existingDeviceId = Object.values(store.profiles).find(isDeviceConfig)?.deviceId;
-      store.systemDeviceId = resolver() || existingDeviceId || `dvc_${randomUUID()}`;
-    }
-    const created = buildDeviceConfig(launchConfig, store.systemDeviceId);
-    store.profiles[profileKey] = created;
+    const existingDeviceId = store.systemDeviceId ?? Object.values(store.identities).find(isDeviceConfig)?.deviceId ?? Object.values(legacyProfiles).find(isDeviceConfig)?.deviceId;
+    const deviceId = existingDeviceId || resolver() || `dvc_${randomUUID2()}`;
+    const created = buildDeviceConfig(launchConfig, deviceId);
+    store.systemDeviceId = deviceId;
+    if (isCanonicalDeviceConfig(created)) putCanonicalDeviceConfig(store, created);
     await writeDeviceConfigStore(paths.configPath, store);
     return created;
   });
@@ -393,6 +494,7 @@ function parseLaunchConfig(raw) {
   const bunnyDaemonPort = typeof parsed.bunnyDaemonPort === "number" && Number.isInteger(parsed.bunnyDaemonPort) ? parsed.bunnyDaemonPort : void 0;
   return {
     serverUrl: typeof parsed.serverUrl === "string" ? parsed.serverUrl : void 0,
+    spaceId: typeof parsed.spaceId === "string" ? parsed.spaceId : void 0,
     workdirRoot: typeof parsed.workdirRoot === "string" ? parsed.workdirRoot : void 0,
     oauthToken: typeof parsed.oauthToken === "string" ? parsed.oauthToken : void 0,
     token: typeof parsed.token === "string" ? parsed.token : void 0,
@@ -401,29 +503,1064 @@ function parseLaunchConfig(raw) {
   };
 }
 
-// src/onboard.ts
-import { cancel, intro, isCancel, log, note, outro, spinner, text } from "@clack/prompts";
+// src/console-dashboard.ts
+import { closeSync, openSync } from "fs";
+import { ReadStream, WriteStream } from "tty";
+import { format, stripVTControlCharacters } from "util";
 
-// src/bunny-daemon.ts
-import { mkdir as mkdir3 } from "fs/promises";
-import { createDaemon } from "@bunny-agent/daemon";
+// src/daemon-control.ts
+import { randomBytes as randomBytes2, randomUUID as randomUUID3 } from "crypto";
+import { chmod as chmod2, mkdir as mkdir2, readdir, readFile as readFile3, rename as rename2, unlink as unlink3, writeFile as writeFile2 } from "fs/promises";
+import { createConnection, createServer } from "net";
+import path2 from "path";
+
+// package.json
+var package_default = {
+  name: "@buda-ai/connector",
+  version: "0.1.8",
+  private: false,
+  type: "module",
+  publishConfig: {
+    access: "public"
+  },
+  files: [
+    "dist",
+    "agent-templates"
+  ],
+  bin: {
+    "buda-connector": "./dist/cli.js",
+    connector: "./dist/cli.js"
+  },
+  scripts: {
+    dev: "tsx src/cli.ts dev",
+    daemon: "tsx src/cli.ts daemon",
+    new: "tsx src/cli.ts new",
+    start: "node dist/cli.js daemon",
+    build: "tsup",
+    test: "vitest run",
+    typecheck: "tsc --noEmit",
+    lint: "biome format . --write && biome check .",
+    "lint:err": "biome format . --write && biome check . --write --diagnostic-level=error"
+  },
+  dependencies: {
+    "@bunny-agent/daemon": "0.9.51",
+    "@clack/prompts": "^1.0.0",
+    "playwright-core": "^1.52.0",
+    ws: "^8.21.0"
+  },
+  optionalDependencies: {
+    "node-pty": "^1.1.0"
+  },
+  devDependencies: {
+    "@types/node": "^24.13.2",
+    "@types/ws": "^8.18.1",
+    relaylib: "workspace:*",
+    tsup: "^8.5.0",
+    tsx: "^4.20.5",
+    typescript: "^5.9.3",
+    vitest: "^2.1.8"
+  },
+  engines: {
+    node: ">=24.18.0"
+  }
+};
+
+// src/daemon-control.ts
+var CONNECTOR_CONTROL_PROTOCOL_VERSION = 1;
+var CONNECTOR_RUNTIME_VERSION = package_default.version;
+var DEFAULT_CONTROL_REQUEST_TIMEOUT_MS = 3e3;
+var getDaemonControlMetadataPath = (config, configRoot) => `${getConnectorDaemonLockTarget(config.serverUrl, config.connectorId, configRoot)}.control.json`;
+var writeMetadata = async (metadataPath, metadata) => {
+  await mkdir2(path2.dirname(metadataPath), { recursive: true, mode: 448 });
+  const temporaryPath = `${metadataPath}.${process.pid}.${randomUUID3()}.tmp`;
+  try {
+    await writeFile2(temporaryPath, `${JSON.stringify(metadata)}
+`, { mode: 384 });
+    await rename2(temporaryPath, metadataPath);
+    await chmod2(metadataPath, 384);
+  } finally {
+    await unlink3(temporaryPath).catch(() => void 0);
+  }
+};
+var publicStatus = (metadata) => ({
+  connectorId: metadata.connectorId,
+  idle: metadata.idle,
+  instanceId: metadata.instanceId,
+  ...metadata.lastHeartbeatAt ? { lastHeartbeatAt: metadata.lastHeartbeatAt } : {},
+  mode: metadata.mode,
+  pid: metadata.pid,
+  protocolVersion: metadata.protocolVersion,
+  relayConnected: metadata.relayConnected,
+  serverUrl: metadata.serverUrl,
+  ...metadata.spaceId ? { spaceId: metadata.spaceId } : {},
+  startedAt: metadata.startedAt,
+  version: metadata.version
+});
+var parseRequest = (raw) => {
+  try {
+    const value = JSON.parse(raw);
+    if (typeof value.secret !== "string" || !["hold", "persist", "release", "status", "stop", "stop-if-idle"].includes(
+      value.command ?? ""
+    )) {
+      return null;
+    }
+    return value;
+  } catch {
+    return null;
+  }
+};
+async function startDaemonControlServer(options) {
+  const metadataPath = getDaemonControlMetadataPath(options.config, options.configRoot);
+  let stopping = false;
+  let desktopHolds = 0;
+  let metadata;
+  let startupGrace;
+  const sockets = /* @__PURE__ */ new Set();
+  const requestStop = () => {
+    if (stopping) return;
+    stopping = true;
+    void Promise.resolve(options.onStop());
+  };
+  const server = createServer((socket) => {
+    sockets.add(socket);
+    socket.setEncoding("utf8");
+    let buffer = "";
+    let holding = false;
+    socket.on("data", (chunk) => {
+      buffer += chunk;
+      const newline = buffer.indexOf("\n");
+      if (newline < 0) return;
+      const request = parseRequest(buffer.slice(0, newline));
+      buffer = buffer.slice(newline + 1);
+      if (!request || request.secret !== metadata.secret) {
+        socket.end(
+          `${JSON.stringify({ ok: false, error: "unauthorized" })}
+`
+        );
+        return;
+      }
+      metadata.idle = options.isIdle?.() ?? metadata.idle;
+      metadata.lastHeartbeatAt = options.getLastHeartbeatAt?.() ?? metadata.lastHeartbeatAt;
+      metadata.relayConnected = options.isRelayConnected?.() ?? metadata.relayConnected;
+      if (request.command === "persist") {
+        if (startupGrace) clearTimeout(startupGrace);
+        metadata.mode = "persistent";
+        void writeMetadata(metadataPath, metadata);
+      } else if (request.command === "hold") {
+        if (startupGrace) clearTimeout(startupGrace);
+        holding = true;
+        desktopHolds += 1;
+      } else if (request.command === "release") {
+        if (metadata.mode === "transient" && desktopHolds === 0) requestStop();
+      } else if (request.command === "stop") {
+        requestStop();
+      } else if (request.command === "stop-if-idle" && metadata.idle) {
+        requestStop();
+      }
+      socket.write(
+        `${JSON.stringify({ ok: true, status: publicStatus(metadata) })}
+`
+      );
+      if (request.command !== "hold") socket.end();
+    });
+    socket.on("close", () => {
+      sockets.delete(socket);
+      if (!holding) return;
+      desktopHolds = Math.max(0, desktopHolds - 1);
+      if (metadata.mode === "transient" && desktopHolds === 0) requestStop();
+    });
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+  const address = server.address();
+  if (!address || typeof address === "string")
+    throw new Error("Failed to bind daemon control port");
+  metadata = {
+    connectorId: options.config.connectorId,
+    idle: options.isIdle?.() ?? true,
+    instanceId: randomUUID3(),
+    mode: options.mode,
+    pid: process.pid,
+    port: address.port,
+    protocolVersion: CONNECTOR_CONTROL_PROTOCOL_VERSION,
+    relayConnected: options.isRelayConnected?.() ?? false,
+    secret: randomBytes2(32).toString("base64url"),
+    serverUrl: options.config.serverUrl,
+    ...options.config.spaceId ? { spaceId: options.config.spaceId } : {},
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    version: options.version ?? CONNECTOR_RUNTIME_VERSION
+  };
+  await writeMetadata(metadataPath, metadata);
+  if (metadata.mode === "transient") {
+    startupGrace = setTimeout(requestStop, options.transientGraceMs ?? 3e4);
+  }
+  return {
+    close: async () => {
+      if (startupGrace) clearTimeout(startupGrace);
+      for (const socket of sockets) socket.destroy();
+      await new Promise((resolve) => server.close(() => resolve()));
+      const activeInstanceId = await readFile3(metadataPath, "utf8").then((raw) => JSON.parse(raw).instanceId).catch(() => void 0);
+      if (activeInstanceId === metadata.instanceId) {
+        await unlink3(metadataPath).catch(() => void 0);
+      }
+    },
+    setIdle: (idle) => {
+      metadata.idle = idle;
+    },
+    status: () => publicStatus(metadata)
+  };
+}
+var parseMetadata = (raw, expectedConnectorId) => {
+  const metadata = JSON.parse(raw);
+  if (metadata.protocolVersion !== CONNECTOR_CONTROL_PROTOCOL_VERSION || typeof metadata.port !== "number" || typeof metadata.secret !== "string" || typeof metadata.connectorId !== "string" || typeof metadata.serverUrl !== "string" || expectedConnectorId && metadata.connectorId !== expectedConnectorId) {
+    throw new Error("Invalid Connector daemon control metadata");
+  }
+  return metadata;
+};
+var readMetadata = async (config, configRoot) => {
+  const metadataPath = getDaemonControlMetadataPath(config, configRoot);
+  return parseMetadata(await readFile3(metadataPath, "utf8"), config.connectorId);
+};
+async function listPersistedDaemonStatuses(configRoot) {
+  const daemonRoot = path2.join(
+    getConnectorPaths(DEFAULT_SERVER_URL, configRoot).configDir,
+    "daemons"
+  );
+  const serverDirectories = await readdir(daemonRoot, { withFileTypes: true }).catch(() => []);
+  const statuses = await Promise.all(
+    serverDirectories.filter((entry) => entry.isDirectory()).map(async (serverEntry) => {
+      const serverDirectory = path2.join(daemonRoot, serverEntry.name);
+      const connectorEntries = await readdir(serverDirectory, { withFileTypes: true }).catch(
+        () => []
+      );
+      return Promise.all(
+        connectorEntries.filter((entry) => entry.isDirectory()).map(
+          (entry) => readFile3(
+            path2.join(serverDirectory, entry.name, "connector-daemon.control.json"),
+            "utf8"
+          ).then((raw) => publicStatus(parseMetadata(raw))).catch(() => null)
+        )
+      );
+    })
+  );
+  const unique = /* @__PURE__ */ new Map();
+  for (const status of statuses.flat()) {
+    if (!status) continue;
+    unique.set(`${status.serverUrl}
+${status.connectorId}`, status);
+  }
+  return [...unique.values()];
+}
+var connectControl = async (metadata, command, timeoutMs = DEFAULT_CONTROL_REQUEST_TIMEOUT_MS) => new Promise((resolve, reject) => {
+  const socket = createConnection({ host: "127.0.0.1", port: metadata.port });
+  let buffer = "";
+  let settled = false;
+  const cleanup = () => {
+    socket.setTimeout(0);
+    socket.off("data", onData);
+    socket.off("error", fail);
+    socket.off("timeout", onTimeout);
+  };
+  const fail = (error) => {
+    if (settled) return;
+    settled = true;
+    cleanup();
+    socket.destroy();
+    reject(error);
+  };
+  const onTimeout = () => {
+    fail(new Error(`Connector daemon control timed out after ${timeoutMs}ms`));
+  };
+  const onData = (chunk) => {
+    buffer += chunk;
+    const newline = buffer.indexOf("\n");
+    if (newline < 0) return;
+    try {
+      const response = JSON.parse(buffer.slice(0, newline));
+      if (!response.ok) return fail(new Error(response.error ?? "Daemon control request failed"));
+      settled = true;
+      cleanup();
+      resolve({ response, socket });
+    } catch (error) {
+      fail(error instanceof Error ? error : new Error(String(error)));
+    }
+  };
+  socket.once("error", fail);
+  socket.once("timeout", onTimeout);
+  socket.setTimeout(timeoutMs);
+  socket.once("connect", () => {
+    socket.write(
+      `${JSON.stringify({ command, secret: metadata.secret })}
+`
+    );
+  });
+  socket.setEncoding("utf8");
+  socket.on("data", onData);
+});
+async function readPersistedDaemonStatus(config, configRoot) {
+  return publicStatus(await readMetadata(config, configRoot));
+}
+async function requestDaemonControl(config, command, configRoot, options = {}) {
+  const metadata = await readMetadata(config, configRoot);
+  const { response, socket } = await connectControl(metadata, command, options.timeoutMs);
+  socket.end();
+  if (!response.status) throw new Error("Daemon control response did not include status");
+  return response.status;
+}
+async function holdDaemonControl(config, configRoot) {
+  const metadata = await readMetadata(config, configRoot);
+  const { response, socket } = await connectControl(metadata, "hold");
+  if (!response.status) {
+    socket.destroy();
+    throw new Error("Daemon hold response did not include status");
+  }
+  const closed = new Promise((resolve) => socket.once("close", () => resolve()));
+  return { close: () => socket.end(), closed, status: response.status };
+}
+
+// src/console-dashboard.ts
+var MAX_LINES_PER_PANE = 500;
+var MIN_DASHBOARD_WIDTH = 60;
+var MIN_DASHBOARD_HEIGHT = 18;
+var DASHBOARD_TITLE = `Buda Connector v${CONNECTOR_RUNTIME_VERSION}`;
+var colors = {
+  cyan: "\x1B[36m",
+  dim: "\x1B[2m",
+  red: "\x1B[31m",
+  reset: "\x1B[0m",
+  reverse: "\x1B[7m",
+  yellow: "\x1B[33m"
+};
+var openControllingTerminal = () => {
+  const inputPath = process.platform === "win32" ? "CONIN$" : "/dev/tty";
+  const outputPath = process.platform === "win32" ? "CONOUT$" : "/dev/tty";
+  let inputFd;
+  let outputFd;
+  try {
+    inputFd = openSync(inputPath, "r");
+    outputFd = openSync(outputPath, "w");
+    const input = new ReadStream(inputFd);
+    const output = new WriteStream(outputFd);
+    return {
+      input,
+      output,
+      close: () => {
+        input.destroy();
+        output.destroy();
+      }
+    };
+  } catch {
+    if (inputFd !== void 0) closeSync(inputFd);
+    if (outputFd !== void 0) closeSync(outputFd);
+    return void 0;
+  }
+};
+var resolveDashboardStreams = () => {
+  if (process.stdin.isTTY && process.stdout.isTTY) {
+    return { input: process.stdin, output: process.stdout };
+  }
+  if (process.stdin.isTTY && process.stderr.isTTY) {
+    return { input: process.stdin, output: process.stderr };
+  }
+  return openControllingTerminal();
+};
+var sanitize = (value) => Array.from(stripVTControlCharacters(value).replaceAll("\r", "")).filter((character) => {
+  const code = character.charCodeAt(0);
+  return code === 9 || code >= 32;
+}).join("");
+var truncate = (value, width) => {
+  if (width <= 0) return "";
+  if (value.length <= width) return value.padEnd(width);
+  if (width === 1) return value.slice(0, 1);
+  return `${value.slice(0, width - 1)}~`;
+};
+var formatDuration = (durationMs) => {
+  const totalSeconds = Math.max(0, Math.floor(durationMs / 1e3));
+  const hours = Math.floor(totalSeconds / 3600);
+  const minutes = Math.floor(totalSeconds % 3600 / 60);
+  const seconds = totalSeconds % 60;
+  return [hours, minutes, seconds].map((part) => String(part).padStart(2, "0")).join(":");
+};
+var createDashboardState = (startedAt = Date.now()) => ({
+  activeSection: "activity",
+  activePane: "activity",
+  activity: [],
+  agentDebug: [],
+  connectorLogs: {},
+  connectors: [],
+  heartbeat: "Waiting",
+  relay: "Starting",
+  agent: "Starting",
+  server: "Unknown",
+  startedAt,
+  scroll: { activity: 0, agentDebug: 0 }
+});
+var classifyDashboardLine = (rawLine) => {
+  const line = sanitize(rawLine).trimEnd();
+  const prefix = "[buda-connector] ";
+  if (line.startsWith(prefix)) {
+    const message = line.slice(prefix.length);
+    const routineHealthCheck = /^relay request GET \/healthz\b/i.test(message);
+    return { pane: routineHealthCheck ? "agentDebug" : "activity", message };
+  }
+  return { pane: "agentDebug", message: line };
+};
+var classifyDashboardLevel = (fallback, formattedMessage, rawLine) => {
+  const normalizedLine = sanitize(rawLine).toLowerCase();
+  if (normalizedLine.includes("[error]") || normalizedLine.includes("[fatal]")) return "error";
+  if (normalizedLine.includes("[warning]") || normalizedLine.includes("[warn]")) return "warn";
+  const benignBunnyDiagnostic = [
+    "[bunny-agent:pi] getappendsystemprompt:",
+    "[bunny-agent:pi] loadskills",
+    "[bunny-agent:pi] resume:",
+    "[bunny-agent:pi] runner:"
+  ].some((prefix) => formattedMessage.toLowerCase().startsWith(prefix));
+  return benignBunnyDiagnostic ? "info" : fallback;
+};
+var updateStatusFromActivity = (state, message) => {
+  const normalized = message.toLowerCase();
+  if (normalized.startsWith("server ")) return { ...state, server: message.slice(7) };
+  if (normalized.startsWith("relay connected")) return { ...state, relay: "Connected" };
+  if (normalized.startsWith("relay reconnecting")) return { ...state, relay: "Retrying" };
+  if (normalized.startsWith("relay access revoked"))
+    return { ...state, relay: "Waiting for access" };
+  if (normalized.startsWith("relay disconnected") || normalized.startsWith("relay error") || normalized.startsWith("relay ping failed")) {
+    return { ...state, relay: "Disconnected" };
+  }
+  if (normalized.startsWith("bunny daemon listening") || normalized.startsWith("bunny daemon http")) {
+    return { ...state, agent: "Ready" };
+  }
+  if (normalized.startsWith("bunny daemon stopped")) return { ...state, agent: "Stopped" };
+  if (normalized.startsWith("heartbeat failed")) return { ...state, heartbeat: "Failed" };
+  return state;
+};
+var appendDashboardLine = (state, pane, level, message, time = (/* @__PURE__ */ new Date()).toLocaleTimeString("en-GB", { hour12: false })) => {
+  const current = state[pane];
+  const last = current.at(-1);
+  const nextLines = last?.message === message && last.level === level ? [...current.slice(0, -1), { ...last, count: last.count + 1, time }] : [...current, { count: 1, level, message, time }];
+  const trimmed = nextLines.slice(-MAX_LINES_PER_PANE);
+  const scroll = state.scroll[pane] > 0 ? { ...state.scroll, [pane]: Math.min(trimmed.length - 1, state.scroll[pane] + 1) } : state.scroll;
+  const next = { ...state, [pane]: trimmed, scroll };
+  return pane === "activity" ? updateStatusFromActivity(next, message) : next;
+};
+var scrollDashboardPane = (state, pane, delta) => {
+  const maxScroll = Math.max(0, state[pane].length - 1);
+  const nextScroll = delta === "follow" ? 0 : delta === "oldest" ? maxScroll : Math.max(0, Math.min(maxScroll, state.scroll[pane] + delta));
+  return { ...state, scroll: { ...state.scroll, [pane]: nextScroll } };
+};
+var selectedConnector = (state) => state.connectors.find((connector) => connector.connectorId === state.selectedConnectorId);
+var applySelectedConnector = (state, resetScroll = true) => {
+  const connector = selectedConnector(state);
+  const logs = connector ? state.connectorLogs[connector.connectorId] : void 0;
+  return {
+    ...state,
+    activity: logs?.activity ?? [],
+    agent: connector?.agent ?? "Stopped",
+    agentDebug: logs?.agentDebug ?? [],
+    heartbeat: connector?.heartbeat ?? "Stopped",
+    relay: connector?.relay ?? "Disconnected",
+    server: connector?.serverUrl ?? "Unknown",
+    scroll: resetScroll ? { activity: 0, agentDebug: 0 } : state.scroll
+  };
+};
+var updateDashboardConnectors = (state, connectors, preferredConnectorId) => {
+  const selectedStillExists = connectors.some(
+    (connector) => connector.connectorId === state.selectedConnectorId
+  );
+  const selectedConnectorId = selectedStillExists ? state.selectedConnectorId : connectors.find((connector) => connector.connectorId === preferredConnectorId)?.connectorId ?? connectors[0]?.connectorId;
+  return applySelectedConnector(
+    {
+      ...state,
+      activeSection: connectors.length > 0 && state.connectors.length === 0 ? "connectors" : state.activeSection,
+      connectors,
+      selectedConnectorId
+    },
+    selectedConnectorId !== state.selectedConnectorId
+  );
+};
+var selectConnectorByOffset = (state, offset) => {
+  if (state.connectors.length === 0) return state;
+  const currentIndex = Math.max(
+    0,
+    state.connectors.findIndex((connector) => connector.connectorId === state.selectedConnectorId)
+  );
+  const nextIndex = Math.max(0, Math.min(state.connectors.length - 1, currentIndex + offset));
+  return applySelectedConnector({
+    ...state,
+    selectedConnectorId: state.connectors[nextIndex]?.connectorId
+  });
+};
+var promptOptionCount = (prompt) => prompt.kind === "exit-choice" ? 3 : 2;
+var isUpKey = (key) => ["\x1B[A", "\x1BOA", "k", "K"].includes(key);
+var isDownKey = (key) => ["\x1B[B", "\x1BOB", "j", "J"].includes(key);
+var getConnectorSectionHeight = (state, height) => state.connectors.length ? Math.min(
+  Math.max(4, state.connectors.length + 2),
+  Math.max(4, Math.min(Math.floor(height / 3), height - 13))
+) : 0;
+var parseDashboardMouseWheel = (input, state, size) => {
+  const event = input.split("\x1B[<").at(-1);
+  const match = event?.match(/^(64|65);\d+;(\d+)[Mm]/);
+  if (!match) return void 0;
+  const row = Number(match[2]);
+  const connectorHeight = getConnectorSectionHeight(state, size.height);
+  const availablePaneRows = size.height - 7 - connectorHeight;
+  const activityHeight = Math.floor(availablePaneRows / 2);
+  const activityStartRow = 7 + connectorHeight;
+  const debugStartRow = activityStartRow + activityHeight;
+  const pane = row >= activityStartRow && row < debugStartRow ? "activity" : row >= debugStartRow && row < size.height ? "agentDebug" : void 0;
+  if (!pane) return void 0;
+  return { delta: match[1] === "64" ? 3 : -3, pane };
+};
+var reduceDashboardInput = (state, key, managerEnabled) => {
+  if (state.prompt) {
+    if (key === "\x1B") return { state: { ...state, prompt: void 0 } };
+    if (isUpKey(key) || isDownKey(key)) {
+      const delta = isUpKey(key) ? -1 : 1;
+      const optionCount = promptOptionCount(state.prompt);
+      const option = (state.prompt.option + delta + optionCount) % optionCount;
+      return { state: { ...state, prompt: { ...state.prompt, option } } };
+    }
+    if (key !== "\r" && key !== "\n") return { state };
+    if (state.prompt.kind === "stop-selected") {
+      const connector = selectedConnector(state);
+      return state.prompt.option === 1 && connector ? {
+        command: {
+          connectorId: connector.connectorId,
+          serverUrl: connector.serverUrl,
+          type: "stop-selected"
+        },
+        state: { ...state, prompt: void 0 }
+      } : { state: { ...state, prompt: void 0 } };
+    }
+    if (state.prompt.kind === "stop-all-confirm") {
+      return state.prompt.option === 1 ? { command: { type: "stop-all" }, state: { ...state, prompt: void 0 } } : { state: { ...state, prompt: void 0 } };
+    }
+    if (state.prompt.option === 0) {
+      return { state: { ...state, prompt: { kind: "stop-all-confirm", option: 0 } } };
+    }
+    if (state.prompt.option === 1) {
+      return { command: { type: "exit-dashboard" }, state: { ...state, prompt: void 0 } };
+    }
+    return { state: { ...state, prompt: void 0 } };
+  }
+  if (managerEnabled && key === "") {
+    return { state: { ...state, prompt: { kind: "exit-choice", option: 1 } } };
+  }
+  if (managerEnabled && key === "\x1B") {
+    return { command: { type: "exit-dashboard" }, state };
+  }
+  if (managerEnabled && (key === "s" || key === "S") && ["Online", "Running"].includes(selectedConnector(state)?.status ?? "")) {
+    return { state: { ...state, prompt: { kind: "stop-selected", option: 0 } } };
+  }
+  if (key === "	") {
+    const sections = managerEnabled ? ["connectors", "activity", "agentDebug"] : ["activity", "agentDebug"];
+    const index = sections.indexOf(state.activeSection);
+    const activeSection = sections[(index + 1) % sections.length] ?? sections[0];
+    return {
+      state: {
+        ...state,
+        activePane: activeSection === "connectors" ? state.activePane : activeSection,
+        activeSection
+      }
+    };
+  }
+  if (state.activeSection === "connectors" && (isUpKey(key) || isDownKey(key))) {
+    return { state: selectConnectorByOffset(state, isUpKey(key) ? -1 : 1) };
+  }
+  const pane = state.activePane;
+  if (key === "f" || key === "F" || key === "\x1B[F") {
+    return { state: scrollDashboardPane(state, pane, "follow") };
+  }
+  if (key === "\x1B[H") return { state: scrollDashboardPane(state, pane, "oldest") };
+  if (isUpKey(key)) return { state: scrollDashboardPane(state, pane, 1) };
+  if (isDownKey(key)) return { state: scrollDashboardPane(state, pane, -1) };
+  if (key === "\x1B[5~") return { state: scrollDashboardPane(state, pane, 8) };
+  if (key === "\x1B[6~") return { state: scrollDashboardPane(state, pane, -8) };
+  return { state };
+};
+var renderStatus = (state, width, now) => {
+  const innerWidth = width - 2;
+  const status = (value) => value;
+  const connector = selectedConnector(state);
+  return [
+    `+${"-".repeat(innerWidth)}+`,
+    `|${colors.cyan}${truncate(` ${DASHBOARD_TITLE}`, innerWidth)}${colors.reset}|`,
+    `|${truncate(` Connector ${connector?.label ?? connector?.connectorId ?? "None"}   Space ${connector?.spaceId ?? "Unknown"}`, innerWidth)}|`,
+    `|${truncate(` Relay ${status(state.relay)}   Agent ${status(state.agent)}   Heartbeat ${status(state.heartbeat)}`, innerWidth)}|`,
+    `|${truncate(` Server ${state.server}   Uptime ${formatDuration(now - state.startedAt)}`, innerWidth)}|`,
+    `+${"-".repeat(innerWidth)}+`
+  ];
+};
+var renderConnectors = (state, height, width) => {
+  const innerWidth = width - 2;
+  const contentHeight = Math.max(1, height - 2);
+  const selectedIndex = Math.max(
+    0,
+    state.connectors.findIndex((connector) => connector.connectorId === state.selectedConnectorId)
+  );
+  const start = Math.max(
+    0,
+    Math.min(
+      selectedIndex - Math.floor(contentHeight / 2),
+      state.connectors.length - contentHeight
+    )
+  );
+  const visible = state.connectors.slice(start, start + contentHeight);
+  const range = state.connectors.length ? `${start + 1}-${start + visible.length}/${state.connectors.length}` : "0/0";
+  const title = ` Connectors ${state.activeSection === "connectors" ? "[active]" : ""}`;
+  const headerFill = Math.max(1, innerWidth - title.length - range.length);
+  const output = [
+    `${state.activeSection === "connectors" ? colors.reverse : ""}+${title}${"-".repeat(headerFill)}${range}+${colors.reset}`
+  ];
+  for (let index = 0; index < contentHeight; index += 1) {
+    const connector = visible[index];
+    if (!connector) {
+      output.push(`|${" ".repeat(innerWidth)}|`);
+      continue;
+    }
+    const marker = connector.connectorId === state.selectedConnectorId ? ">" : " ";
+    const statusText = connector.status.padEnd(8);
+    const availableFieldWidth = Math.max(24, innerWidth - 18);
+    const connectorWidth = Math.max(10, Math.floor(availableFieldWidth * 0.4));
+    const spaceWidth = Math.max(8, Math.floor(availableFieldWidth * 0.25));
+    const serverWidth = Math.max(8, availableFieldWidth - connectorWidth - spaceWidth);
+    const content = `${marker} ${statusText} ${truncate(connector.label ?? connector.connectorId, connectorWidth)} | ${truncate(connector.spaceId, spaceWidth)} | ${truncate(connector.serverUrl, serverWidth)}`;
+    const color = connector.status === "Stopped" ? colors.dim : connector.status === "Online" ? colors.cyan : connector.status === "Connecting" || connector.status === "Stopping" ? colors.yellow : connector.status === "Error" || connector.status === "Unresponsive" ? colors.red : "";
+    output.push(`|${color}${truncate(content, innerWidth)}${colors.reset}|`);
+  }
+  output.push(`+${"-".repeat(innerWidth)}+`);
+  return output;
+};
+var renderPane = (title, lines, height, width, active, scroll) => {
+  const innerWidth = width - 2;
+  const contentHeight = Math.max(1, height - 2);
+  const end = Math.max(0, lines.length - scroll);
+  const visible = lines.slice(Math.max(0, end - contentHeight), end);
+  const headerSuffix = scroll === 0 ? "following" : `${scroll} lines behind`;
+  const titleText = ` ${title} ${active ? "[active]" : ""}`;
+  const headerFill = Math.max(1, innerWidth - titleText.length - headerSuffix.length);
+  const output = [
+    `${active ? colors.reverse : ""}+${titleText}${"-".repeat(headerFill)}${headerSuffix}+${colors.reset}`
+  ];
+  for (let index = 0; index < contentHeight; index += 1) {
+    const line = visible[index];
+    if (!line) {
+      output.push(`|${" ".repeat(innerWidth)}|`);
+      continue;
+    }
+    const levelColor = line.level === "error" ? colors.red : line.level === "warn" ? colors.yellow : colors.dim;
+    const count = line.count > 1 ? ` x${line.count}` : "";
+    const content = `${line.time} ${line.level.toUpperCase().padEnd(5)} ${line.message}${count}`;
+    output.push(`|${levelColor}${truncate(content, innerWidth)}${colors.reset}|`);
+  }
+  output.push(`+${"-".repeat(innerWidth)}+`);
+  return output;
+};
+var renderFooter = (state, width) => {
+  const managerKeys = state.connectors.length ? "Up/Down select | S stop | Esc exit | " : "";
+  return `${colors.dim}${truncate(` ${managerKeys}Tab switch pane | F follow`, width)}${colors.reset}`;
+};
+var renderPrompt = (state, size) => {
+  const width = Math.max(10, size.width);
+  const height = Math.max(4, size.height);
+  const connector = selectedConnector(state);
+  const prompt = state.prompt;
+  if (!prompt) return "";
+  const content = prompt.kind === "exit-choice" ? {
+    options: ["Stop all local Connectors and exit", "Exit Dashboard only", "Cancel"],
+    title: "Exit Buda Connector Dashboard?",
+    warning: "Dashboard exit does not stop background Connector processes."
+  } : prompt.kind === "stop-all-confirm" ? {
+    options: ["Cancel", "Stop all local Connectors and exit"],
+    title: "Stop every local Connector?",
+    warning: "Running agent tasks will be interrupted."
+  } : {
+    options: ["Cancel", "Stop selected Connector"],
+    title: `Stop ${connector?.connectorId ?? "selected Connector"}?`,
+    warning: "The Dashboard will remain open."
+  };
+  const lines = [
+    content.title,
+    "",
+    content.warning,
+    "",
+    ...content.options.map((option, index) => `${index === prompt.option ? ">" : " "} ${option}`),
+    "",
+    "Up/Down choose | Enter confirm | Esc cancel"
+  ];
+  const visible = lines.slice(0, height);
+  while (visible.length < height) visible.push("");
+  return visible.map((line) => truncate(line, width)).join("\n");
+};
+var renderDashboard = (state, size, now = Date.now()) => {
+  const width = Math.max(10, size.width);
+  const height = Math.max(4, size.height);
+  if (width < MIN_DASHBOARD_WIDTH || height < MIN_DASHBOARD_HEIGHT) {
+    return [
+      truncate(DASHBOARD_TITLE, width),
+      truncate("Terminal too small for dashboard. Resize or restart with --plain.", width),
+      truncate(`Relay ${state.relay} | Agent ${state.agent}`, width),
+      truncate(`Heartbeat ${state.heartbeat}`, width)
+    ].slice(0, height).join("\n");
+  }
+  if (state.prompt) return renderPrompt(state, size);
+  const connectorHeight = getConnectorSectionHeight(state, height);
+  const availablePaneRows = height - 7 - connectorHeight;
+  const activityHeight = Math.floor(availablePaneRows / 2);
+  const debugHeight = availablePaneRows - activityHeight;
+  return [
+    ...renderStatus(state, width, now),
+    ...connectorHeight ? renderConnectors(state, connectorHeight, width) : [],
+    ...renderPane(
+      "Activity",
+      state.activity,
+      activityHeight,
+      width,
+      state.activeSection === "activity",
+      state.scroll.activity
+    ),
+    ...renderPane(
+      "Agent Debug",
+      state.agentDebug,
+      debugHeight,
+      width,
+      state.activeSection === "agentDebug",
+      state.scroll.agentDebug
+    ),
+    renderFooter(state, width)
+  ].join("\n");
+};
+var ConnectorConsoleDashboard = class {
+  constructor(streams, manager) {
+    this.streams = streams;
+    this.manager = manager;
+  }
+  state = createDashboardState();
+  stopped = false;
+  renderQueued = false;
+  originalConsole = {
+    error: console.error,
+    log: console.log,
+    warn: console.warn
+  };
+  start() {
+    console.log = (...args) => this.capture("info", args);
+    console.warn = (...args) => this.capture("warn", args);
+    console.error = (...args) => this.capture("error", args);
+    this.streams.output.write("\x1B[?1049h\x1B[?25l\x1B[?1000h\x1B[?1006h");
+    if (this.streams.input.isTTY) this.streams.input.setRawMode(true);
+    this.streams.input.resume();
+    this.streams.input.on("data", this.handleInput);
+    this.streams.output.on("resize", this.scheduleRender);
+    process.once("exit", this.stop);
+    this.scheduleRender();
+  }
+  updateStatus(update) {
+    this.state = { ...this.state, ...update };
+    this.scheduleRender();
+  }
+  updateConnectors(connectors, preferredConnectorId) {
+    this.state = updateDashboardConnectors(this.state, connectors, preferredConnectorId);
+    this.scheduleRender();
+  }
+  appendConnectorLog(connectorId, level, raw) {
+    const current = this.state.connectorLogs[connectorId] ?? { activity: [], agentDebug: [] };
+    let connectorState = { ...this.state, ...current };
+    const formatted = raw;
+    for (const rawLine of formatted.split("\n")) {
+      const { pane, message } = classifyDashboardLine(rawLine);
+      if (!message) continue;
+      connectorState = appendDashboardLine(
+        connectorState,
+        pane,
+        classifyDashboardLevel(level, formatted, rawLine),
+        message
+      );
+    }
+    const connectorLogs = {
+      ...this.state.connectorLogs,
+      [connectorId]: {
+        activity: connectorState.activity,
+        agentDebug: connectorState.agentDebug
+      }
+    };
+    this.state = {
+      ...this.state,
+      connectorLogs,
+      ...connectorId === this.state.selectedConnectorId ? { activity: connectorState.activity, agentDebug: connectorState.agentDebug } : {}
+    };
+    this.scheduleRender();
+  }
+  stop = () => {
+    if (this.stopped) return;
+    this.stopped = true;
+    console.log = this.originalConsole.log;
+    console.warn = this.originalConsole.warn;
+    console.error = this.originalConsole.error;
+    this.streams.input.off("data", this.handleInput);
+    this.streams.output.off("resize", this.scheduleRender);
+    process.off("exit", this.stop);
+    if (this.streams.input.isTTY) this.streams.input.setRawMode(false);
+    this.streams.input.pause();
+    this.streams.output.write("\x1B[?1006l\x1B[?1000l\x1B[?25h\x1B[?1049l");
+    this.streams.close?.();
+    if (activeDashboard === this) activeDashboard = void 0;
+  };
+  capture(level, args) {
+    const formatted = format(...args);
+    for (const rawLine of formatted.split("\n")) {
+      const { pane, message } = classifyDashboardLine(rawLine);
+      if (!message) continue;
+      this.state = appendDashboardLine(
+        this.state,
+        pane,
+        classifyDashboardLevel(level, formatted, rawLine),
+        message
+      );
+    }
+    this.scheduleRender();
+  }
+  handleInput = (chunk) => {
+    const key = chunk.toString();
+    if (key === "" && !this.manager) {
+      this.stop();
+      process.kill(process.pid, "SIGINT");
+      return;
+    }
+    const mouseWheel = parseDashboardMouseWheel(key, this.state, {
+      height: this.streams.output.rows || 24,
+      width: this.streams.output.columns || 80
+    });
+    if (mouseWheel) {
+      this.state = scrollDashboardPane(
+        {
+          ...this.state,
+          activePane: mouseWheel.pane,
+          activeSection: mouseWheel.pane
+        },
+        mouseWheel.pane,
+        mouseWheel.delta
+      );
+      this.scheduleRender();
+      return;
+    }
+    const result = reduceDashboardInput(this.state, key, Boolean(this.manager));
+    this.state = result.state;
+    this.scheduleRender();
+    if (result.command) void this.runCommand(result.command);
+  };
+  async runCommand(command) {
+    if (!this.manager) return;
+    if (command.type === "exit-dashboard") {
+      this.stop();
+      this.manager.onExit();
+      return;
+    }
+    try {
+      if (command.type === "stop-selected") {
+        this.state = {
+          ...this.state,
+          connectors: this.state.connectors.map(
+            (connector) => connector.connectorId === command.connectorId ? { ...connector, status: "Stopping" } : connector
+          )
+        };
+        this.scheduleRender();
+        await this.manager.onStopConnector(command.connectorId, command.serverUrl);
+        return;
+      }
+      await this.manager.onStopAll();
+      this.stop();
+      this.manager.onExit();
+    } catch (error) {
+      this.capture("error", [error instanceof Error ? error.message : String(error)]);
+    }
+  }
+  scheduleRender = () => {
+    if (this.stopped || this.renderQueued) return;
+    this.renderQueued = true;
+    setImmediate(() => {
+      this.renderQueued = false;
+      if (this.stopped) return;
+      const width = this.streams.output.columns || 80;
+      const height = this.streams.output.rows || 24;
+      this.streams.output.write(`\x1B[H\x1B[2J${renderDashboard(this.state, { width, height })}`);
+    });
+  };
+};
+var activeDashboard;
+var startConnectorConsoleDashboard = (options = {}) => {
+  if (options.plain) return void 0;
+  const streams = options.streams ?? resolveDashboardStreams();
+  if (!streams?.input.isTTY || !streams.output.isTTY) return void 0;
+  if (activeDashboard) return activeDashboard;
+  activeDashboard = new ConnectorConsoleDashboard(streams, options.manager);
+  activeDashboard.start();
+  return activeDashboard;
+};
+var updateConnectorDashboardStatus = (update) => {
+  activeDashboard?.updateStatus(update);
+};
+var updateConnectorDashboardConnectors = (connectors, preferredConnectorId) => {
+  activeDashboard?.updateConnectors(connectors, preferredConnectorId);
+};
+var appendConnectorDashboardLog = (connectorId, level, raw) => {
+  activeDashboard?.appendConnectorLog(connectorId, level, raw);
+};
+
+// src/daemon-client.ts
+import { spawn } from "child_process";
+import { mkdir as mkdir6, readFile as readFile6 } from "fs/promises";
+import path7 from "path";
+
+// src/cloud-client.ts
+import { createHash as createHash4 } from "crypto";
+import { platform as platform3, release } from "os";
+
+// src/browser.ts
+import { accessSync, constants, statSync } from "fs";
+import { mkdir as mkdir4 } from "fs/promises";
+import { platform as getPlatform, homedir as homedir2 } from "os";
+import path4 from "path";
 
 // src/logger.ts
-import { appendFile, mkdir as mkdir2 } from "fs/promises";
+import { appendFile, mkdir as mkdir3, readdir as readdir2, rename as rename3, stat as stat2, unlink as unlink4 } from "fs/promises";
+import path3 from "path";
+import { format as format2 } from "util";
+var CONNECTOR_LOG_MAX_BYTES = 2 * 1024 * 1024;
+var CONNECTOR_LOG_BACKUP_COUNT = 2;
+var CONNECTOR_LOG_RETENTION_DAYS = 7;
 var pendingLogs = [];
+var fileWriteQueue = Promise.resolve();
+var lastPrunedDate = "";
+var activeLogContext;
+var setConnectorLogContext = (context) => {
+  activeLogContext = { ...activeLogContext, ...context };
+};
+var ignoreMissingFile = (error) => {
+  if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") {
+    return;
+  }
+  throw error;
+};
+var formatConnectorLogDate = (date) => {
+  const year = date.getFullYear();
+  const month = String(date.getMonth() + 1).padStart(2, "0");
+  const day = String(date.getDate()).padStart(2, "0");
+  return `${year}-${month}-${day}`;
+};
+var getDatedConnectorLogPath = (baseLogPath, date = /* @__PURE__ */ new Date()) => {
+  const parsed = path3.parse(baseLogPath);
+  return path3.join(parsed.dir, `${parsed.name}-${formatConnectorLogDate(date)}${parsed.ext}`);
+};
+async function pruneConnectorLogs(baseLogPath, now = /* @__PURE__ */ new Date(), retentionDays = CONNECTOR_LOG_RETENTION_DAYS) {
+  const parsed = path3.parse(baseLogPath);
+  const prefix = `${parsed.name}-`;
+  const cutoff = new Date(now);
+  cutoff.setHours(0, 0, 0, 0);
+  cutoff.setDate(cutoff.getDate() - Math.max(0, retentionDays - 1));
+  const cutoffDate = formatConnectorLogDate(cutoff);
+  const files = await readdir2(parsed.dir).catch(() => []);
+  const expired = files.filter((fileName) => {
+    if (!fileName.startsWith(prefix)) return false;
+    const date = fileName.slice(prefix.length, prefix.length + 10);
+    const suffix = fileName.slice(prefix.length + 10);
+    const isDatedLog = /^\d{4}-\d{2}-\d{2}$/.test(date);
+    const segment = suffix.startsWith(`${parsed.ext}.`) ? suffix.slice(parsed.ext.length + 1) : "";
+    const isLogSegment = suffix === parsed.ext || /^\d+$/.test(segment);
+    return isDatedLog && isLogSegment && date < cutoffDate;
+  });
+  await Promise.all(expired.map((fileName) => unlink4(path3.join(parsed.dir, fileName))));
+  return expired.length;
+}
+async function rotateConnectorLogIfNeeded(logPath, maxBytes = CONNECTOR_LOG_MAX_BYTES, backupCount = CONNECTOR_LOG_BACKUP_COUNT) {
+  const currentSize = await stat2(logPath).then((value) => value.size).catch((error) => {
+    ignoreMissingFile(error);
+    return 0;
+  });
+  if (currentSize < maxBytes) return false;
+  await unlink4(`${logPath}.${backupCount}`).catch(ignoreMissingFile);
+  for (let index = backupCount - 1; index >= 1; index -= 1) {
+    await rename3(`${logPath}.${index}`, `${logPath}.${index + 1}`).catch(ignoreMissingFile);
+  }
+  await rename3(logPath, `${logPath}.1`).catch(ignoreMissingFile);
+  return true;
+}
+var appendConnectorLog = (baseLogPath, line, now = /* @__PURE__ */ new Date()) => {
+  const date = formatConnectorLogDate(now);
+  const logPath = getDatedConnectorLogPath(baseLogPath, now);
+  const write = async () => {
+    if (lastPrunedDate !== date) {
+      await pruneConnectorLogs(baseLogPath, now).catch(() => void 0);
+      lastPrunedDate = date;
+    }
+    await rotateConnectorLogIfNeeded(logPath);
+    await appendFile(logPath, line);
+  };
+  const queuedWrite = fileWriteQueue.then(write, write);
+  fileWriteQueue = queuedWrite.catch(() => void 0);
+  return queuedWrite;
+};
+var persistLocalEntry = async (entry) => {
+  const paths = getConnectorPaths(
+    activeLogContext?.serverUrl ?? getServerUrl(),
+    activeLogContext?.configRoot
+  );
+  await mkdir3(path3.dirname(paths.logPath), { recursive: true }).catch(() => void 0);
+  await appendConnectorLog(paths.logPath, `${JSON.stringify(entry)}
+`).catch(() => void 0);
+};
+var installConnectorConsoleCapture = () => {
+  const writes = [];
+  const original = {
+    error: console.error,
+    log: console.log,
+    warn: console.warn
+  };
+  const capture = (level, output) => (...args) => {
+    const message = format2(...args);
+    if (!message.startsWith("[buda-connector]")) {
+      writes.push(
+        persistLocalEntry({
+          level,
+          message,
+          metadata: {
+            source: "daemon-console",
+            ...activeLogContext?.connectorId ? { connectorId: activeLogContext.connectorId } : {}
+          },
+          createdAt: (/* @__PURE__ */ new Date()).toISOString()
+        })
+      );
+    }
+    output(...args);
+  };
+  console.log = capture("info", original.log);
+  console.warn = capture("warn", original.warn);
+  console.error = capture("error", original.error);
+  return async () => {
+    console.log = original.log;
+    console.warn = original.warn;
+    console.error = original.error;
+    await Promise.all(writes);
+  };
+};
 async function writeLog(level, message, metadata) {
   const entry = {
     level,
     message,
-    metadata,
+    metadata: {
+      ...metadata ?? {},
+      ...activeLogContext?.connectorId ? { connectorId: activeLogContext.connectorId } : {}
+    },
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   pendingLogs.push(entry);
   if (pendingLogs.length > 100) pendingLogs.splice(0, pendingLogs.length - 100);
-  const paths = getConnectorPaths(getServerUrl());
-  await mkdir2(paths.configDir, { recursive: true }).catch(() => void 0);
-  await appendFile(paths.logPath, `${JSON.stringify(entry)}
-`).catch(() => void 0);
+  await persistLocalEntry(entry);
   const line = `[buda-connector] ${message}`;
   if (level === "error") console.error(line);
   else if (level === "warn") console.warn(line);
@@ -434,58 +1571,9 @@ function takePendingLogs() {
 }
 function restorePendingLogs(logs) {
   pendingLogs.unshift(...logs);
-}
-
-// src/bunny-daemon.ts
-async function startEmbeddedBunnyDaemon(config, launchConfig) {
-  const host = getBunnyDaemonHost(launchConfig);
-  const port = getBunnyDaemonPort(launchConfig);
-  const root = config.workdirRoot;
-  await mkdir3(root, { recursive: true });
-  const server = createDaemon({ host, port, root });
-  await new Promise((resolve, reject) => {
-    const onError = (error) => {
-      server.off("listening", onListening);
-      reject(error);
-    };
-    const onListening = () => {
-      server.off("error", onError);
-      resolve();
-    };
-    server.once("error", onError);
-    server.once("listening", onListening);
-    server.listen(port, host);
-  });
-  const address = server.address();
-  const actualPort = typeof address === "object" && address ? address.port : port;
-  const baseUrl = `http://${host}:${actualPort}`;
-  await writeLog("info", `bunny daemon listening ${baseUrl}`, {
-    root
-  });
-  return {
-    server,
-    host,
-    port: actualPort,
-    baseUrl,
-    root
-  };
-}
-async function stopEmbeddedBunnyDaemon(daemon) {
-  await new Promise((resolve) => {
-    daemon.server.close(() => resolve());
-  });
-  await writeLog("info", `bunny daemon stopped ${daemon.baseUrl}`);
-}
-
-// src/cloud-client.ts
-import { createHash as createHash4 } from "crypto";
-import { platform as platform3, release } from "os";
+}
 
 // src/browser.ts
-import { accessSync, constants, statSync } from "fs";
-import { mkdir as mkdir4 } from "fs/promises";
-import { platform as getPlatform, homedir as homedir2 } from "os";
-import path2 from "path";
 var DEFAULT_VIEWPORT = { width: 1280, height: 800 };
 var MAX_SCREENCAST_DIMENSION = 2560;
 var SESSION_ID_PATTERN = /^[A-Za-z0-9_.:-]{1,320}$/;
@@ -791,15 +1879,15 @@ var resolveScreenshotPath = (workdirRoot, filePath) => {
   if (!workdirRoot) throw new Error("Connector workdir is unavailable for screenshots.");
   const raw = typeof filePath === "string" ? filePath.trim() : "";
   if (!raw) throw new Error("file_path is required");
-  const agentRoot = path2.resolve(workdirRoot, "agent");
+  const agentRoot = path4.resolve(workdirRoot, "agent");
   const relativeInput = raw === "/agent" ? "" : raw.startsWith("/agent/") ? raw.slice(7) : raw;
-  const absolutePath = path2.resolve(agentRoot, relativeInput);
-  if (absolutePath === agentRoot || !absolutePath.startsWith(`${agentRoot}${path2.sep}`)) {
+  const absolutePath = path4.resolve(agentRoot, relativeInput);
+  if (absolutePath === agentRoot || !absolutePath.startsWith(`${agentRoot}${path4.sep}`)) {
     throw new Error("file_path must stay under the connector agent drive");
   }
   return {
     absolutePath,
-    relativePath: path2.relative(agentRoot, absolutePath).split(path2.sep).join("/")
+    relativePath: path4.relative(agentRoot, absolutePath).split(path4.sep).join("/")
   };
 };
 async function handleBrowserRequest(requestPath, method, body, context = {}) {
@@ -915,7 +2003,7 @@ async function handleBrowserRequest(requestPath, method, body, context = {}) {
     const input = body ?? {};
     const s = await ensureSession(sessionId);
     const screenshotPath = resolveScreenshotPath(context.workdirRoot, input.file_path);
-    await mkdir4(path2.dirname(screenshotPath.absolutePath), { recursive: true });
+    await mkdir4(path4.dirname(screenshotPath.absolutePath), { recursive: true });
     await s.page.screenshot({
       path: screenshotPath.absolutePath,
       fullPage: input.fullPage !== false
@@ -998,30 +2086,61 @@ async function handleBrowserRequest(requestPath, method, body, context = {}) {
 
 // src/bundled.ts
 import { createHash as createHash3 } from "crypto";
-import { cpSync, existsSync, rmSync } from "fs";
-import { readdir, readFile as readFile3 } from "fs/promises";
-import path3 from "path";
+import {
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+  statSync as statSync2
+} from "fs";
+import { readdir as readdir3, readFile as readFile4 } from "fs/promises";
+import path5 from "path";
 import { fileURLToPath } from "url";
-var PKG_ROOT = path3.resolve(fileURLToPath(import.meta.url), "../..");
-var BUNDLED_DIR = path3.join(PKG_ROOT, "agent-templates");
-var SYSTEM_SKILLS_DIR = path3.join(BUNDLED_DIR, "system-skills");
-var SCRIPTS_DIR = path3.join(BUNDLED_DIR, "scripts");
-var SHARED_DIR = path3.join(BUNDLED_DIR, "shared");
-var MONOREPO_SRC = path3.resolve(PKG_ROOT, "../buda/agent-templates");
-function syncTemplatesFromMonorepo() {
+var PKG_ROOT = path5.resolve(fileURLToPath(import.meta.url), "../..");
+var BUNDLED_DIR = path5.join(PKG_ROOT, "agent-templates");
+var SYSTEM_SKILLS_DIR = path5.join(BUNDLED_DIR, "system-skills");
+var SCRIPTS_DIR = path5.join(BUNDLED_DIR, "scripts");
+var SHARED_DIR = path5.join(BUNDLED_DIR, "shared");
+var MONOREPO_SRC = path5.resolve(PKG_ROOT, "../buda/agent-templates");
+function syncTemplatesFromMonorepo(options = {}) {
   if (!existsSync(MONOREPO_SRC)) {
     throw new Error(`Cannot sync agent-templates: source missing at ${MONOREPO_SRC}`);
   }
-  rmSync(BUNDLED_DIR, { recursive: true, force: true });
-  cpSync(MONOREPO_SRC, BUNDLED_DIR, {
-    recursive: true,
-    dereference: true,
-    filter: (src) => !src.split(path3.sep).includes("extensions")
-  });
+  mkdirSync(BUNDLED_DIR, { recursive: true });
+  syncDirectory(MONOREPO_SRC, BUNDLED_DIR, Boolean(options.prune));
+}
+function syncDirectory(sourceDirectory, destinationDirectory, prune) {
+  const sourceEntries = /* @__PURE__ */ new Set();
+  for (const entry of readdirSync(sourceDirectory, { withFileTypes: true })) {
+    if (entry.name === "extensions") continue;
+    sourceEntries.add(entry.name);
+    const source = path5.join(sourceDirectory, entry.name);
+    const destination = path5.join(destinationDirectory, entry.name);
+    if (statSync2(source).isDirectory()) {
+      mkdirSync(destination, { recursive: true });
+      syncDirectory(source, destination, prune);
+      continue;
+    }
+    const temporary = `${destination}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+    copyFileSync(source, temporary);
+    try {
+      renameSync(temporary, destination);
+    } catch {
+      copyFileSync(temporary, destination);
+      rmSync(temporary, { force: true });
+    }
+  }
+  if (!prune) return;
+  for (const entry of readdirSync(destinationDirectory, { withFileTypes: true })) {
+    if (sourceEntries.has(entry.name)) continue;
+    rmSync(path5.join(destinationDirectory, entry.name), { recursive: true, force: true });
+  }
 }
 ensureBundledDir();
 function ensureBundledDir() {
-  const missingRequiredTemplate = !existsSync(path3.join(SHARED_DIR, "BOOTSTRAP.md"));
+  const missingRequiredTemplate = !existsSync(path5.join(SHARED_DIR, "BOOTSTRAP.md"));
   if (existsSync(BUNDLED_DIR) && !missingRequiredTemplate) return;
   if (!existsSync(MONOREPO_SRC)) {
     console.warn(
@@ -1035,7 +2154,7 @@ function ensureBundledDir() {
 var cached = null;
 async function readBundledManifest() {
   if (cached) return cached;
-  const systemSkillNames = (await readdir(SYSTEM_SKILLS_DIR, { withFileTypes: true }).catch(() => [])).filter((e) => e.isDirectory()).map((e) => e.name).sort();
+  const systemSkillNames = (await readdir3(SYSTEM_SKILLS_DIR, { withFileTypes: true }).catch(() => [])).filter((e) => e.isDirectory()).map((e) => e.name).sort();
   const version = await hashDir(BUNDLED_DIR);
   cached = {
     version,
@@ -1050,19 +2169,19 @@ async function readBundledManifest() {
 async function hashDir(dir) {
   const hash = createHash3("sha256");
   await walk(dir, async (relPath, abs) => {
-    hash.update(`${relPath}:`).update(await readFile3(abs));
+    hash.update(`${relPath}:`).update(await readFile4(abs));
   });
   return hash.digest("hex");
 }
 async function walk(dir, visit, base = dir) {
-  const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
+  const entries = await readdir3(dir, { withFileTypes: true }).catch(() => []);
   entries.sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of entries) {
-    const abs = path3.join(dir, entry.name);
+    const abs = path5.join(dir, entry.name);
     if (entry.isDirectory()) {
       await walk(abs, visit, base);
     } else if (entry.isFile()) {
-      await visit(path3.relative(base, abs), abs);
+      await visit(path5.relative(base, abs), abs);
     }
   }
 }
@@ -1080,6 +2199,30 @@ var BASE_CONNECTOR_CAPABILITIES = [
   "shell",
   "git"
 ];
+async function resolveConnectorScope(deviceId, launchConfig) {
+  const serverUrl = normalizeServerOrigin(getServerUrl(launchConfig));
+  const headers = { "Content-Type": "application/json" };
+  const oauthToken = launchConfig?.oauthToken?.trim();
+  const token = getConnectorToken(launchConfig);
+  if (oauthToken) headers.Authorization = `Bearer ${oauthToken}`;
+  if (token) headers["X-Buda-Connector-Token"] = token;
+  const response = await fetch(`${serverUrl}/api/connectors/scope`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ deviceId })
+  });
+  if (!response.ok) {
+    throw new Error(`/api/connectors/scope failed: ${response.status} ${await response.text()}`);
+  }
+  const result = await response.json();
+  if (typeof result.spaceId !== "string" || !result.spaceId.trim()) {
+    throw new Error("Connector scope response did not include spaceId");
+  }
+  return {
+    ...typeof result.connectorId === "string" ? { connectorId: result.connectorId } : {},
+    spaceId: result.spaceId.trim()
+  };
+}
 var browserAvailabilityWarningLogged = false;
 var getBrowserAvailabilityWarning = (browserAvailability) => browserAvailability.available ? null : `${browserAvailability.error} Browser automation is disabled, but shell, filesystem, Git, and coding capabilities remain available.`;
 var getAdvertisedCapabilities = (browserAvailability = resolveBrowserAvailability(), deviceToken) => [
@@ -1101,7 +2244,7 @@ async function buildPayload(config, extra) {
     deviceName: config.deviceName,
     hostLabel: config.hostLabel,
     platform: `${platform3()} ${release()}`,
-    version: "dev",
+    version: CONNECTOR_RUNTIME_VERSION,
     pid: process.pid,
     workdirRoot: config.workdirRoot,
     baseUrl: extra?.bunnyDaemon?.baseUrl,
@@ -1136,6 +2279,8 @@ function buildAuthHeaders(config, launchConfig) {
     "X-Buda-Connector-Id": config.connectorId
   };
   const token = config.token?.trim() || getConnectorToken(launchConfig);
+  const oauthToken = launchConfig?.oauthToken?.trim();
+  if (oauthToken) headers.Authorization = `Bearer ${oauthToken}`;
   if (token) headers["X-Buda-Connector-Token"] = token;
   if (config.deviceToken) headers["X-Buda-Connector-Device-Token"] = config.deviceToken;
   return headers;
@@ -1149,108 +2294,1043 @@ async function postJson(serverUrl, pathname, body, config, launchConfig) {
     },
     body: JSON.stringify(body)
   });
-  if (!response.ok) {
-    const text2 = await response.text().catch(() => "");
-    let errorCode;
-    let errorMessage3 = text2;
+  if (!response.ok) {
+    const text2 = await response.text().catch(() => "");
+    let errorCode;
+    let errorMessage3 = text2;
+    try {
+      const payload = JSON.parse(text2);
+      errorCode = typeof payload.code === "string" ? payload.code : void 0;
+      errorMessage3 = typeof payload.error === "string" ? payload.error : text2;
+    } catch {
+    }
+    if (errorCode === "device_revoked") {
+      throw new Error(
+        `This device is prohibited/revoked and cannot reconnect. Contact support. (${errorMessage3})`
+      );
+    }
+    throw new Error(`${pathname} failed: ${response.status} ${errorMessage3}`);
+  }
+  return await response.json();
+}
+function formatConnectorOwner(connector) {
+  return connector.userEmail ?? connector.userId ?? "anonymous";
+}
+async function warnIfStaleBundle(result) {
+  if (!result.bundle?.staleClient) return;
+  await writeLog(
+    "warn",
+    `connector bundle out of date \u2014 server expects ${result.bundle.expectedVersion ?? "newer"}; run \`pnpm up @buda-ai/connector\``
+  );
+}
+async function registerConnector(config, launchConfig, bunnyDaemon, options) {
+  const result = await postJson(
+    config.serverUrl,
+    "/api/connectors/register",
+    await buildPayload(config, {
+      bunnyDaemon,
+      ...options?.recoverMissingProfile ? { recovery: "missing_local_profile" } : {}
+    }),
+    config,
+    launchConfig
+  );
+  await writeLog(
+    "info",
+    `registered connector=${result.connector.connectorId} status=${result.connector.status} owner=${formatConnectorOwner(result.connector)}`
+  );
+  await warnIfStaleBundle(result);
+  return {
+    connectorId: result.connector.connectorId,
+    spaceId: result.connector.spaceId ?? result.spaceId,
+    relayProtocol: result.relayProtocol
+  };
+}
+async function heartbeatConnector(config, launchConfig, bunnyDaemon) {
+  const logs = takePendingLogs();
+  const result = await postJson(
+    config.serverUrl,
+    "/api/connectors/heartbeat",
+    await buildPayload(config, {
+      bunnyDaemon,
+      logs
+    }),
+    config,
+    launchConfig
+  ).catch((error) => {
+    restorePendingLogs(logs);
+    throw error;
+  });
+  return { relayProtocol: result.relayProtocol };
+}
+async function unregisterConnector(config, launchConfig) {
+  await postJson(
+    config.serverUrl,
+    "/api/connectors/unregister",
+    {
+      connectorId: config.connectorId
+    },
+    config,
+    launchConfig
+  ).catch((error) => {
+    void writeLog("warn", `unregister failed: ${error instanceof Error ? error.message : error}`);
+  });
+}
+
+// src/runtime-install.ts
+import { execFile } from "child_process";
+import { randomUUID as randomUUID4 } from "crypto";
+import { access, cp, mkdir as mkdir5, readFile as readFile5, rename as rename4, rm, writeFile as writeFile3 } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import path6 from "path";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var RUNTIME_INSTALL_TIMEOUT_MS = 5 * 6e4;
+var exists = async (filePath) => access(filePath).then(() => true).catch(() => false);
+var runtimeRoot = () => process.env.BUDA_CONNECTOR_RUNTIME_ROOT || path6.join(homedir3(), ".buda", "runtime");
+var runtimePlatformKey = `${process.platform}-${process.arch}-node${process.versions.modules}`;
+var versionDirectory = () => path6.join(runtimeRoot(), runtimePlatformKey, CONNECTOR_RUNTIME_VERSION);
+var manifestPath = () => path6.join(versionDirectory(), "runtime.json");
+var readRuntimeManifest = async () => {
+  try {
+    const parsed = JSON.parse(await readFile5(manifestPath(), "utf8"));
+    if (parsed.version !== CONNECTOR_RUNTIME_VERSION || !await exists(parsed.entrypoint) || !await exists(parsed.nodeExecutable)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+};
+var writeManifest = async (directory, manifest) => {
+  await writeFile3(path6.join(directory, "runtime.json"), `${JSON.stringify(manifest, null, 2)}
+`, {
+    mode: 384
+  });
+};
+var validateRuntime = async (runtime) => {
+  const { stdout } = await execFileAsync(
+    runtime.nodeExecutable,
+    [...runtime.nodeArgs ?? [], runtime.entrypoint, "--help"],
+    { timeout: 15e3 }
+  );
+  if (!stdout.includes("Help: buda-connector")) {
+    throw new Error("Staged Connector runtime failed its CLI validation");
+  }
+};
+var installFromNpm = async (directory) => {
+  await mkdir5(directory, { recursive: true, mode: 448 });
+  await execFileAsync(
+    process.platform === "win32" ? "npm.cmd" : "npm",
+    [
+      "install",
+      "--ignore-scripts=false",
+      "--no-audit",
+      "--no-fund",
+      "--omit=dev",
+      "--prefix",
+      directory,
+      `@buda-ai/connector@${CONNECTOR_RUNTIME_VERSION}`
+    ],
+    { env: process.env, timeout: RUNTIME_INSTALL_TIMEOUT_MS }
+  );
+  const entrypoint = path6.join(
+    directory,
+    "node_modules",
+    "@buda-ai",
+    "connector",
+    "dist",
+    "cli.js"
+  );
+  const nodeExecutable = path6.join(directory, "node", path6.basename(process.execPath));
+  await mkdir5(path6.dirname(nodeExecutable), { recursive: true });
+  await cp(process.execPath, nodeExecutable, { force: true });
+  if (!await exists(entrypoint)) throw new Error("Installed Connector runtime is incomplete");
+  return { entrypoint, nodeExecutable, version: CONNECTOR_RUNTIME_VERSION };
+};
+var installFromBundledRuntime = async (directory, sourceRoot) => {
+  const sourceNode = process.env.BUDA_CONNECTOR_RUNTIME_NODE || process.execPath;
+  const sourceEntrypoint = process.env.BUDA_CONNECTOR_RUNTIME_ENTRYPOINT || process.argv[1];
+  if (!sourceEntrypoint) throw new Error("Bundled Connector runtime entrypoint is missing");
+  await cp(sourceRoot, directory, { recursive: true, force: true });
+  const relativeEntrypoint = path6.relative(sourceRoot, sourceEntrypoint);
+  if (relativeEntrypoint.startsWith("..") || path6.isAbsolute(relativeEntrypoint)) {
+    throw new Error("Bundled Connector entrypoint must be inside its runtime root");
+  }
+  const relativeNode = path6.relative(sourceRoot, sourceNode);
+  const entrypoint = path6.join(directory, relativeEntrypoint);
+  const nodeExecutable = relativeNode.startsWith("..") ? path6.join(directory, "node", path6.basename(sourceNode)) : path6.join(directory, relativeNode);
+  if (relativeNode.startsWith("..")) {
+    await mkdir5(path6.dirname(nodeExecutable), { recursive: true });
+    await cp(sourceNode, nodeExecutable, { force: true });
+  }
+  if (!await exists(entrypoint))
+    throw new Error("Copied Connector runtime entrypoint is missing");
+  return { entrypoint, nodeExecutable, version: CONNECTOR_RUNTIME_VERSION };
+};
+async function ensureStableConnectorRuntime() {
+  if (process.env.BUDA_CONNECTOR_SKIP_RUNTIME_STAGE === "1" || process.argv[1]?.endsWith(".ts")) {
+    const entrypoint = process.argv[1];
+    if (!entrypoint) throw new Error("Connector CLI entrypoint is missing");
+    return {
+      entrypoint,
+      ...entrypoint.endsWith(".ts") ? { nodeArgs: [...process.execArgv] } : {},
+      nodeExecutable: process.execPath,
+      version: CONNECTOR_RUNTIME_VERSION
+    };
+  }
+  const existing = await readRuntimeManifest();
+  if (existing) return existing;
+  const platformRoot = path6.join(runtimeRoot(), runtimePlatformKey);
+  await mkdir5(platformRoot, { recursive: true, mode: 448 });
+  return withExclusiveFileLock(
+    path6.join(platformRoot, `install-${CONNECTOR_RUNTIME_VERSION}`),
+    async () => {
+      const installed = await readRuntimeManifest();
+      if (installed) return installed;
+      const temporary = path6.join(
+        platformRoot,
+        `.${CONNECTOR_RUNTIME_VERSION}.${randomUUID4()}.tmp`
+      );
+      await rm(temporary, { recursive: true, force: true });
+      try {
+        const bundledSource = process.env.BUDA_CONNECTOR_BUNDLED_RUNTIME_ROOT;
+        const manifest = bundledSource ? await installFromBundledRuntime(temporary, bundledSource) : await installFromNpm(temporary);
+        await validateRuntime(manifest);
+        const finalDirectory = versionDirectory();
+        const rebased = {
+          ...manifest,
+          entrypoint: path6.join(finalDirectory, path6.relative(temporary, manifest.entrypoint)),
+          nodeExecutable: path6.join(
+            finalDirectory,
+            path6.relative(temporary, manifest.nodeExecutable)
+          )
+        };
+        await writeManifest(temporary, rebased);
+        await rm(finalDirectory, { recursive: true, force: true });
+        await rename4(temporary, finalDirectory);
+        return rebased;
+      } catch (error) {
+        await rm(temporary, { recursive: true, force: true });
+        throw error;
+      }
+    },
+    { timeoutMs: RUNTIME_INSTALL_TIMEOUT_MS }
+  );
+}
+
+// src/daemon-client.ts
+var START_TIMEOUT_MS = 45e3;
+var BOOTSTRAP_TIMEOUT_MS = 5 * 6e4;
+var POLL_INTERVAL_MS = 250;
+var wait2 = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
+var getConfigRoot = () => process.env.BUDA_CONNECTOR_CONFIG_ROOT;
+var readLiveStatus = async (config, configRoot = getConfigRoot(), timeoutMs) => requestDaemonControl(config, "status", configRoot, { timeoutMs }).catch(() => null);
+var isProcessAlive2 = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return !(typeof error === "object" && error !== null && "code" in error && error.code === "ESRCH");
+  }
+};
+var getRuntimeCommandArgs = (runtime, mode) => [
+  ...runtime.nodeArgs ?? [],
+  runtime.entrypoint,
+  "daemon",
+  "--internal-daemon",
+  "--daemon-mode",
+  mode,
+  "--plain"
+];
+var compareVersions = (left, right) => {
+  const leftParts = left.split(/[.-]/).map((part) => Number.parseInt(part, 10) || 0);
+  const rightParts = right.split(/[.-]/).map((part) => Number.parseInt(part, 10) || 0);
+  for (let index = 0; index < Math.max(leftParts.length, rightParts.length); index += 1) {
+    const difference = (leftParts[index] ?? 0) - (rightParts[index] ?? 0);
+    if (difference !== 0) return difference;
+  }
+  return 0;
+};
+var shouldReplaceDaemonVersion = (runningVersion, candidateVersion) => compareVersions(candidateVersion, runningVersion) > 0;
+var waitForDaemon = async (launchConfig, deadline) => {
+  let lastConfig = null;
+  while (Date.now() < deadline) {
+    lastConfig = await readDeviceConfig(launchConfig, getConfigRoot());
+    if (lastConfig) {
+      const status = await readLiveStatus(lastConfig);
+      if (status) return { config: lastConfig, status };
+    }
+    await wait2(POLL_INTERVAL_MS);
+  }
+  throw new Error(
+    lastConfig ? "Connector daemon did not expose its control channel in time" : "Connector registration did not create a canonical local identity in time"
+  );
+};
+var spawnInternalDaemon = async (launchConfig, mode, preparedRuntime) => {
+  const runtime = preparedRuntime ?? await ensureStableConnectorRuntime();
+  const child = spawn(runtime.nodeExecutable, getRuntimeCommandArgs(runtime, mode), {
+    detached: true,
+    env: {
+      ...process.env,
+      BUDA_CONNECTOR_INTERNAL_LAUNCH_CONFIG: JSON.stringify(launchConfig ?? {})
+    },
+    stdio: "ignore",
+    windowsHide: true
+  });
+  child.unref();
+};
+var stopOlderIdleDaemon = async (config, status) => {
+  if (!shouldReplaceDaemonVersion(status.version, CONNECTOR_RUNTIME_VERSION)) return false;
+  if (!status.idle) return false;
+  const stopStatus = await requestDaemonControl(config, "stop-if-idle", getConfigRoot());
+  if (!stopStatus.idle) return false;
+  const deadline = Date.now() + 1e4;
+  while (Date.now() < deadline) {
+    if (!await readLiveStatus(config)) return true;
+    await wait2(POLL_INTERVAL_MS);
+  }
+  throw new Error("Older Connector daemon did not stop cleanly; existing identity was preserved");
+};
+async function ensureConnectorDaemon(launchConfig, mode) {
+  const deviceId = await getOrCreateSystemDeviceId(getConfigRoot());
+  const scope = await resolveConnectorScope(deviceId, launchConfig);
+  launchConfig = { ...launchConfig, spaceId: scope.spaceId };
+  const bootstrapTarget = getConnectorBootstrapLockTarget(launchConfig, getConfigRoot());
+  await mkdir6(path7.dirname(bootstrapTarget), { recursive: true, mode: 448 });
+  const bootstrapLock = await acquireExclusiveFileLock(bootstrapTarget, {
+    timeoutMs: BOOTSTRAP_TIMEOUT_MS
+  });
+  try {
+    const existingConfig = await readDeviceConfig(launchConfig, getConfigRoot());
+    if (existingConfig) {
+      const existingStatus = await readLiveStatus(existingConfig);
+      if (existingStatus) {
+        const preparedRuntime = !shouldReplaceDaemonVersion(existingStatus.version, CONNECTOR_RUNTIME_VERSION) || !existingStatus.idle ? void 0 : await ensureStableConnectorRuntime();
+        const replaced = await stopOlderIdleDaemon(existingConfig, existingStatus);
+        if (!replaced) {
+          const status = mode === "persistent" ? await requestDaemonControl(existingConfig, "persist", getConfigRoot()) : existingStatus;
+          return { config: existingConfig, status };
+        }
+        await spawnInternalDaemon(launchConfig, mode, preparedRuntime);
+        return await waitForDaemon(launchConfig, Date.now() + START_TIMEOUT_MS);
+      }
+      const persistedStatus = await readPersistedDaemonStatus(
+        existingConfig,
+        getConfigRoot()
+      ).catch(() => null);
+      if (persistedStatus && isProcessAlive2(persistedStatus.pid)) {
+        throw new Error(
+          `Connector daemon PID ${persistedStatus.pid} is running but its local control channel is not responding. Stop that process and retry.`
+        );
+      }
+    }
+    await spawnInternalDaemon(launchConfig, mode);
+    return await waitForDaemon(launchConfig, Date.now() + START_TIMEOUT_MS);
+  } finally {
+    await bootstrapLock.release();
+  }
+}
+var streamDaemonLogs = (options) => {
+  const logPath = getConnectorPaths(options.serverUrl, getConfigRoot()).logPath;
+  let activePath = "";
+  let seenLines = 0;
+  const poll = async () => {
+    const datedPath = getDatedConnectorLogPath(logPath);
+    const raw = await readFile6(datedPath, "utf8").catch(() => "");
+    const lines = raw.split("\n").filter(Boolean);
+    if (datedPath !== activePath || lines.length < seenLines) {
+      activePath = datedPath;
+      seenLines = 0;
+    }
+    for (const line of lines.slice(seenLines)) {
+      try {
+        const entry = JSON.parse(line);
+        const connectorId = entry.metadata?.connectorId;
+        if (options.dashboardActive && typeof connectorId === "string") {
+          const output2 = entry.metadata?.source === "daemon-console" ? entry.message : `[buda-connector] ${entry.message}`;
+          appendConnectorDashboardLog(connectorId, entry.level, output2);
+          continue;
+        }
+        if (connectorId !== options.connectorId) continue;
+        const output = entry.metadata?.source === "daemon-console" ? entry.message : `[buda-connector] ${entry.message}`;
+        if (entry.level === "error") console.error(output);
+        else if (entry.level === "warn") console.warn(output);
+        else console.log(output);
+      } catch {
+        if (options.plain) console.log(line);
+      }
+    }
+    seenLines = lines.length;
+  };
+  void poll();
+  const timer = setInterval(() => void poll(), 500);
+  return () => clearInterval(timer);
+};
+var toDashboardConnector = (config, status) => ({
+  agent: status ? status.idle ? "Ready" : "Busy" : "Stopped",
+  connectorId: config.connectorId,
+  heartbeat: status?.lastHeartbeatAt ? `OK ${new Date(status.lastHeartbeatAt).toLocaleTimeString("en-GB", { hour12: false })}` : status ? "Waiting" : "Stopped",
+  relay: status?.relayConnected ? "Connected" : "Disconnected",
+  serverUrl: config.serverUrl,
+  spaceId: config.spaceId ?? "Unknown",
+  status: status ? status.relayConnected ? "Online" : "Running" : "Stopped"
+});
+async function readLocalConnectorDashboardRows(configRoot = getConfigRoot()) {
+  const configs = await listDeviceConfigs(configRoot);
+  const persistedStatuses = await listPersistedDaemonStatuses(configRoot);
+  const persistedByIdentity = new Map(
+    persistedStatuses.map((status) => [
+      `${normalizeServerOrigin(status.serverUrl)}
+${status.connectorId}`,
+      status
+    ])
+  );
+  const identities = /* @__PURE__ */ new Map();
+  for (const config of configs) {
+    identities.set(`${normalizeServerOrigin(config.serverUrl)}
+${config.connectorId}`, {
+      identity: config,
+      stored: true
+    });
+  }
+  for (const status of persistedStatuses) {
+    const key = `${normalizeServerOrigin(status.serverUrl)}
+${status.connectorId}`;
+    if (!identities.has(key)) {
+      identities.set(key, { identity: status, stored: false });
+    }
+  }
+  const rows = await Promise.all(
+    [...identities.entries()].map(async ([key, { identity, stored }]) => {
+      const status = await readLiveStatus(identity, configRoot, 1500);
+      if (status) return toDashboardConnector(identity, status);
+      const persistedStatus = persistedByIdentity.get(key) ?? await readPersistedDaemonStatus(identity, configRoot).catch(() => null);
+      const row = toDashboardConnector(identity, null);
+      if (!stored && (!persistedStatus || !isProcessAlive2(persistedStatus.pid))) return null;
+      return persistedStatus && isProcessAlive2(persistedStatus.pid) ? { ...row, status: "Unresponsive" } : row;
+    })
+  );
+  return rows.filter((row) => row !== null);
+}
+async function stopLocalConnectorDaemon(connectorId, serverUrl, configRoot = getConfigRoot()) {
+  const configs = await listDeviceConfigs(configRoot);
+  const persistedStatuses = await listPersistedDaemonStatuses(configRoot);
+  const serverOrigin = normalizeServerOrigin(serverUrl);
+  const config = [...configs, ...persistedStatuses].find(
+    (candidate) => candidate.connectorId === connectorId && normalizeServerOrigin(candidate.serverUrl) === serverOrigin
+  );
+  if (!config) throw new Error(`Local Connector ${connectorId} was not found`);
+  const status = await readLiveStatus(config, configRoot);
+  if (!status) return;
+  await requestDaemonControl(config, "stop", configRoot);
+}
+async function stopAllLocalConnectorDaemons(configRoot = getConfigRoot()) {
+  const configs = await listDeviceConfigs(configRoot);
+  const persistedStatuses = await listPersistedDaemonStatuses(configRoot);
+  const identities = /* @__PURE__ */ new Map();
+  for (const config of [...configs, ...persistedStatuses]) {
+    identities.set(`${normalizeServerOrigin(config.serverUrl)}
+${config.connectorId}`, config);
+  }
+  const results = await Promise.allSettled(
+    [...identities.values()].map(async (config) => {
+      const status = await readLiveStatus(config, configRoot);
+      if (status) await requestDaemonControl(config, "stop", configRoot);
+    })
+  );
+  const failures = results.filter((result) => result.status === "rejected");
+  if (failures.length) {
+    throw new Error(`Failed to stop ${failures.length} local Connector daemon(s)`);
+  }
+}
+var waitForConnectorViewerExit = async (dashboardClosed) => {
+  let finishSignal = () => void 0;
+  const signal = new Promise((resolve) => {
+    finishSignal = resolve;
+  });
+  process.once("SIGINT", finishSignal);
+  process.once("SIGTERM", finishSignal);
+  await (dashboardClosed ? Promise.race([dashboardClosed, signal]) : signal);
+  process.off("SIGINT", finishSignal);
+  process.off("SIGTERM", finishSignal);
+};
+async function runConnectorDashboard(launchConfig, options = {}) {
+  let finishDashboard = () => void 0;
+  const dashboardClosed = new Promise((resolve) => {
+    finishDashboard = resolve;
+  });
+  const dashboard = startConnectorConsoleDashboard({
+    manager: {
+      onExit: finishDashboard,
+      onStopAll: () => stopAllLocalConnectorDaemons(),
+      onStopConnector: (connectorId, serverUrl) => stopLocalConnectorDaemon(connectorId, serverUrl)
+    },
+    plain: options.plain
+  });
+  if (!dashboard) {
+    const { config } = await ensureConnectorDaemon(launchConfig, "persistent");
+    const stopLogs2 = streamDaemonLogs({
+      connectorId: config.connectorId,
+      dashboardActive: false,
+      plain: Boolean(options.plain),
+      serverUrl: config.serverUrl
+    });
+    if (!process.stdin.isTTY) {
+      stopLogs2();
+      console.log(`Buda Connector ${config.connectorId} is running in the background.`);
+      return;
+    }
+    await waitForConnectorViewerExit();
+    stopLogs2();
+    return;
+  }
+  const pendingConnectorId = `pending:${normalizeServerOrigin(getServerUrl(launchConfig))}`;
+  let pendingConnector = {
+    agent: "Starting",
+    connectorId: pendingConnectorId,
+    heartbeat: "Waiting",
+    label: "New Connector",
+    relay: "Connecting",
+    serverUrl: getServerUrl(launchConfig),
+    spaceId: "Resolving Space",
+    status: "Connecting"
+  };
+  let preferredConnectorId = pendingConnectorId;
+  let bootstrapSettled = false;
+  const stopLogs = streamDaemonLogs({
+    dashboardActive: true,
+    plain: false,
+    serverUrl: getServerUrl(launchConfig)
+  });
+  let refreshing = false;
+  const refresh = async () => {
+    if (refreshing) return;
+    refreshing = true;
+    try {
+      const connectors = await readLocalConnectorDashboardRows();
+      updateConnectorDashboardConnectors(
+        pendingConnector ? [...connectors, pendingConnector] : connectors,
+        preferredConnectorId
+      );
+    } finally {
+      refreshing = false;
+    }
+  };
+  updateConnectorDashboardConnectors([pendingConnector], pendingConnectorId);
+  void readDeviceConfig(launchConfig, getConfigRoot()).then((config) => {
+    if (!config) return;
+    pendingConnector = void 0;
+    preferredConnectorId = config.connectorId;
+  }).catch(() => void 0).finally(() => refresh());
+  const timer = setInterval(() => void refresh(), 1e3);
+  void ensureConnectorDaemon(launchConfig, "persistent").then(async ({ config }) => {
+    pendingConnector = void 0;
+    preferredConnectorId = config.connectorId;
+    await refresh();
+  }).catch(async (error) => {
+    const config = await readDeviceConfig(launchConfig, getConfigRoot()).catch(() => null);
+    const message = `connector startup failed: ${error instanceof Error ? error.message : String(error)}`;
+    if (config) {
+      pendingConnector = void 0;
+      preferredConnectorId = config.connectorId;
+      appendConnectorDashboardLog(config.connectorId, "error", `[buda-connector] ${message}`);
+      await refresh();
+    } else {
+      pendingConnector = {
+        ...pendingConnector,
+        agent: "Error",
+        heartbeat: "Failed",
+        relay: "Failed",
+        status: "Error"
+      };
+      appendConnectorDashboardLog(pendingConnectorId, "error", `[buda-connector] ${message}`);
+      await refresh();
+    }
+  }).finally(() => {
+    bootstrapSettled = true;
+  });
+  await waitForConnectorViewerExit(dashboardClosed);
+  clearInterval(timer);
+  stopLogs();
+  dashboard.stop();
+  if (!bootstrapSettled) process.exit(0);
+}
+async function runDesktopConnectorController(launchConfig) {
+  const { config } = await ensureConnectorDaemon(launchConfig, "transient");
+  if (!config.spaceId?.trim()) {
+    throw new Error("Connector scope did not resolve a canonical spaceId");
+  }
+  const lease = await holdDaemonControl(config, getConfigRoot());
+  process.stdout.write(
+    `${JSON.stringify({
+      type: "buda-connector-ready",
+      connectorId: lease.status.connectorId,
+      pid: lease.status.pid,
+      spaceId: lease.status.spaceId
+    })}
+`
+  );
+  const stopped = new Promise((resolve) => {
+    process.once("SIGINT", resolve);
+    process.once("SIGTERM", resolve);
+    process.stdin.once("end", resolve);
+    process.stdin.once("close", resolve);
+    if (process.stdin.readableEnded || process.stdin.destroyed) resolve();
+  });
+  await Promise.race([lease.closed, stopped]);
+  lease.close();
+}
+async function releaseDesktopConnector(launchConfig) {
+  if (!launchConfig?.spaceId?.trim()) return;
+  const config = await readDeviceConfig(launchConfig, getConfigRoot());
+  if (!config) return;
+  await requestDaemonControl(config, "release", getConfigRoot()).catch(() => void 0);
+}
+var getInternalLaunchConfig = () => {
+  const raw = process.env.BUDA_CONNECTOR_INTERNAL_LAUNCH_CONFIG;
+  if (!raw) return void 0;
+  return JSON.parse(raw);
+};
+var getDaemonModeFlag = () => {
+  const index = process.argv.indexOf("--daemon-mode");
+  return process.argv[index + 1] === "transient" ? "transient" : "persistent";
+};
+
+// src/onboard.ts
+import { cancel, intro, isCancel, log, note, outro, spinner, text } from "@clack/prompts";
+
+// src/bunny-daemon.ts
+import { mkdir as mkdir7 } from "fs/promises";
+import { createDaemon } from "@bunny-agent/daemon";
+
+// src/terminal.ts
+import { randomBytes as randomBytes3 } from "crypto";
+import { chmod as chmod3, stat as stat3 } from "fs/promises";
+import { createRequire } from "module";
+import path8 from "path";
+import WebSocket, { WebSocketServer } from "ws";
+var TERMINAL_IDLE_TTL_MS = 10 * 6e4;
+var TERMINAL_HANDSHAKE_TIMEOUT_MS = 1e4;
+var LOCAL_TERMINAL_GRANT_TTL_MS = 3e4;
+var LOCAL_TERMINAL_CLOSE_SPAWN_FAILED = 4401;
+var MAX_BUFFER_CHUNKS = 1e3;
+var MAX_TERMINAL_FRAME_BYTES = 1024 * 1024;
+var require2 = createRequire(import.meta.url);
+var ensureNodePtySpawnHelperExecutable = async (options = {}) => {
+  const platform4 = options.platform ?? process.platform;
+  if (platform4 !== "darwin") return;
+  const arch = options.arch ?? process.arch;
+  const entryPath = options.entryPath ?? require2.resolve("node-pty");
+  const packageRoot = path8.dirname(path8.dirname(entryPath));
+  const helperPath = path8.join(packageRoot, "prebuilds", `${platform4}-${arch}`, "spawn-helper");
+  const helper = await stat3(helperPath);
+  if ((helper.mode & 64) === 0) await chmod3(helperPath, helper.mode | 64);
+};
+var loadNodePty = async () => {
+  await ensureNodePtySpawnHelperExecutable();
+  return import("node-pty");
+};
+var normalizeTerminalCloseCode = (code, fallback = 1011) => code >= 1e3 && code <= 1014 && ![1004, 1005, 1006].includes(code) || code >= 3e3 && code <= 4999 ? code : fallback;
+var truncateTerminalCloseReason = (reason, maxBytes = 120) => {
+  let result = reason;
+  while (Buffer.byteLength(result, "utf8") > maxBytes) result = result.slice(0, -1);
+  return result;
+};
+var sessions2 = /* @__PURE__ */ new Map();
+var localGrants = /* @__PURE__ */ new Map();
+var installedServers = /* @__PURE__ */ new WeakSet();
+var isSafeId = (value) => typeof value === "string" && /^[A-Za-z0-9_.:-]{1,160}$/.test(value);
+var parseDimension = (value, fallback, min, max) => typeof value === "number" && Number.isSafeInteger(value) ? Math.max(min, Math.min(max, value)) : fallback;
+var parseConnectorTerminalRequest = (request) => {
+  if (request.method !== "CONNECT" || request.path !== "/api/terminal") {
+    throw new Error("Invalid connector terminal request.");
+  }
+  if (!request.body || typeof request.body !== "object" || Array.isArray(request.body)) {
+    throw new Error("Connector terminal request body is invalid.");
+  }
+  const body = request.body;
+  if (!isSafeId(body.sessionId) || !isSafeId(body.tabId)) {
+    throw new Error("Connector terminal session identity is invalid.");
+  }
+  if (typeof body.token !== "string" || body.token.length < 32 || body.token.length > 2048) {
+    throw new Error("Connector terminal token is invalid.");
+  }
+  return {
+    sessionId: body.sessionId,
+    tabId: body.tabId,
+    token: body.token,
+    cols: parseDimension(body.cols, 80, 10, 500),
+    rows: parseDimension(body.rows, 24, 5, 200)
+  };
+};
+var clearIdleTimer = (session) => {
+  if (!session.idleTimer) return;
+  clearTimeout(session.idleTimer);
+  session.idleTimer = null;
+};
+var scheduleIdleCleanup = (sessionKey, session) => {
+  clearIdleTimer(session);
+  session.idleTimer = setTimeout(() => {
+    if (session.clients.size > 0 || sessions2.get(sessionKey) !== session) return;
+    sessions2.delete(sessionKey);
+    try {
+      session.pty.kill();
+    } catch {
+    }
+  }, TERMINAL_IDLE_TTL_MS);
+  session.idleTimer.unref();
+};
+var sendJson = (socket, value) => {
+  if (socket.readyState === WebSocket.OPEN) socket.send(JSON.stringify(value));
+};
+var LocalTerminalUnavailableError = class extends Error {
+};
+var serializeErrorMessage = (error) => error instanceof Error ? error.message : "Unknown error";
+var createTerminalSession = async (grant, nodePtyLoader) => {
+  let nodePty;
+  try {
+    nodePty = await nodePtyLoader();
+  } catch (error) {
+    void writeLog(
+      "error",
+      `local terminal could not load node-pty: ${serializeErrorMessage(error)}`
+    );
+    throw new LocalTerminalUnavailableError(
+      "Local terminal is unavailable because node-pty could not be loaded. The connector remains available for other capabilities."
+    );
+  }
+  const shell = process.platform === "win32" ? "powershell.exe" : process.env.SHELL || "/bin/bash";
+  const shellArgs = process.platform === "win32" ? [] : ["-l"];
+  let pty;
+  try {
+    pty = nodePty.spawn(shell, shellArgs, {
+      name: "xterm-256color",
+      cols: grant.cols,
+      rows: grant.rows,
+      cwd: path8.resolve(grant.cwd),
+      env: { ...process.env, TERM: "xterm-256color" }
+    });
+  } catch (error) {
+    const message = serializeErrorMessage(error);
+    void writeLog(
+      "error",
+      `local terminal failed to spawn shell=${shell} cwd=${grant.cwd}: ${message}`
+    );
+    throw new LocalTerminalUnavailableError(
+      "Local terminal is unavailable because node-pty could not start a shell. The connector remains available for other capabilities."
+    );
+  }
+  const session = {
+    pty,
+    clients: /* @__PURE__ */ new Set(),
+    buffer: [],
+    cols: grant.cols,
+    rows: grant.rows,
+    idleTimer: null
+  };
+  sessions2.set(grant.sessionKey, session);
+  pty.onData((data) => {
+    session.buffer.push(data);
+    if (session.buffer.length > MAX_BUFFER_CHUNKS) session.buffer.shift();
+    for (const socket of session.clients) {
+      if (socket.readyState === WebSocket.OPEN) socket.send(data);
+    }
+  });
+  pty.onExit(({ exitCode }) => {
+    if (sessions2.get(grant.sessionKey) === session) sessions2.delete(grant.sessionKey);
+    clearIdleTimer(session);
+    for (const socket of session.clients) {
+      sendJson(socket, { type: "status", message: `exited (code ${exitCode})` });
+      socket.close(1e3, "Terminal exited");
+    }
+    session.clients.clear();
+  });
+  return session;
+};
+var attachLocalTerminal = async (socket, grant, nodePtyLoader) => {
+  const pendingMessages = [];
+  let session;
+  let started = false;
+  const handleMessage = (data) => {
+    if (!session) {
+      pendingMessages.push(data);
+      return;
+    }
     try {
-      const payload = JSON.parse(text2);
-      errorCode = typeof payload.code === "string" ? payload.code : void 0;
-      errorMessage3 = typeof payload.error === "string" ? payload.error : text2;
+      const message = JSON.parse(data);
+      if (message.type === "bridge-start") {
+        if (!started) {
+          started = true;
+          sendJson(socket, { type: "status", message: "connected" });
+          for (const chunk of session.buffer) socket.send(chunk);
+        }
+        return;
+      }
+      if (message.type === "input" && typeof message.data === "string") {
+        session.pty.write(message.data);
+        return;
+      }
+      if (message.type === "resize") {
+        const cols = parseDimension(message.cols, session.cols, 10, 500);
+        const rows = parseDimension(message.rows, session.rows, 5, 200);
+        if (cols !== session.cols || rows !== session.rows) {
+          session.cols = cols;
+          session.rows = rows;
+          session.pty.resize(cols, rows);
+        }
+        return;
+      }
     } catch {
     }
-    if (errorCode === "device_revoked") {
-      throw new Error(
-        `This device is prohibited/revoked and cannot reconnect. Contact support. (${errorMessage3})`
+    session.pty.write(data);
+  };
+  socket.on("message", (raw) => handleMessage(raw.toString()));
+  session = sessions2.get(grant.sessionKey);
+  if (!session) session = await createTerminalSession(grant, nodePtyLoader);
+  else clearIdleTimer(session);
+  session.clients.add(socket);
+  for (const data of pendingMessages.splice(0)) handleMessage(data);
+  const detach = () => {
+    if (!session) return;
+    session.clients.delete(socket);
+    if (session.clients.size === 0) scheduleIdleCleanup(grant.sessionKey, session);
+  };
+  socket.once("close", detach);
+  socket.once("error", detach);
+};
+var installConnectorTerminalEndpoint = (server, options = {}) => {
+  if (installedServers.has(server)) return;
+  installedServers.add(server);
+  const terminalServer = new WebSocketServer({ noServer: true });
+  server.on("upgrade", (request, socket, head) => {
+    const url = new URL(request.url ?? "/", "http://connector.local");
+    if (url.pathname !== "/api/terminal") return;
+    const tokenHeader = request.headers["x-buda-local-terminal-token"];
+    const token = Array.isArray(tokenHeader) ? tokenHeader[0] : tokenHeader;
+    const grant = token ? localGrants.get(token) : void 0;
+    if (!token || !grant || grant.expiresAt <= Date.now()) {
+      if (token) localGrants.delete(token);
+      socket.destroy();
+      return;
+    }
+    localGrants.delete(token);
+    terminalServer.handleUpgrade(request, socket, head, (client) => {
+      void attachLocalTerminal(client, grant, options.nodePtyLoader ?? loadNodePty).catch(
+        (error) => {
+          const message = error instanceof LocalTerminalUnavailableError ? error.message : "Local terminal is unavailable. The connector remains available for other capabilities.";
+          sendJson(client, { type: "error", fatal: true, message });
+          client.close(LOCAL_TERMINAL_CLOSE_SPAWN_FAILED, "Local terminal unavailable");
+        }
       );
+    });
+  });
+  server.once("close", () => {
+    for (const client of terminalServer.clients) client.terminate();
+    terminalServer.close();
+    localGrants.clear();
+    for (const session of sessions2.values()) {
+      clearIdleTimer(session);
+      try {
+        session.pty.kill();
+      } catch {
+      }
+    }
+    sessions2.clear();
+  });
+};
+var registerLocalTerminal = (input) => {
+  if (!isSafeId(input.workspaceKey) || !isSafeId(input.tabId)) {
+    throw new Error("Invalid local terminal workspace session.");
+  }
+  const token = randomBytes3(32).toString("base64url");
+  localGrants.set(token, {
+    sessionKey: `${input.workspaceKey}:${input.tabId}`,
+    workspaceKey: input.workspaceKey,
+    cwd: input.cwd,
+    cols: input.cols,
+    rows: input.rows,
+    expiresAt: Date.now() + LOCAL_TERMINAL_GRANT_TTL_MS
+  });
+  const cleanupTimer = setTimeout(() => localGrants.delete(token), LOCAL_TERMINAL_GRANT_TTL_MS);
+  cleanupTimer.unref();
+  return token;
+};
+var toLocalTerminalUrl = (baseUrl) => {
+  const url = new URL("/api/terminal", baseUrl);
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  return url.toString();
+};
+var connectSocket = async (socket) => new Promise((resolve, reject) => {
+  const onOpen = () => {
+    socket.removeListener("error", onError);
+    resolve();
+  };
+  const onError = (error) => {
+    socket.removeListener("open", onOpen);
+    reject(error);
+  };
+  socket.once("open", onOpen);
+  socket.once("error", onError);
+});
+var proxyConnectorTerminalTunnel = async (input) => {
+  const cloud = new WebSocket(
+    getConnectorTerminalUrl(input.serverUrl, input.connectorId, input.sessionId),
+    {
+      headers: { "X-Buda-Terminal-Token": input.cloudToken },
+      handshakeTimeout: TERMINAL_HANDSHAKE_TIMEOUT_MS
     }
-    throw new Error(`${pathname} failed: ${response.status} ${errorMessage3}`);
-  }
-  return await response.json();
-}
-function formatConnectorOwner(connector) {
-  return connector.userEmail ?? connector.userId ?? "anonymous";
-}
-async function warnIfStaleBundle(result) {
-  if (!result.bundle?.staleClient) return;
-  await writeLog(
-    "warn",
-    `connector bundle out of date \u2014 server expects ${result.bundle.expectedVersion ?? "newer"}; run \`pnpm up @buda-ai/connector\``
-  );
-}
-async function registerConnector(config, launchConfig, bunnyDaemon, options) {
-  const result = await postJson(
-    config.serverUrl,
-    "/api/connectors/register",
-    await buildPayload(config, {
-      bunnyDaemon,
-      ...options?.recoverMissingProfile ? { recovery: "missing_local_profile" } : {}
-    }),
-    config,
-    launchConfig
   );
+  const local = new WebSocket(toLocalTerminalUrl(input.localBaseUrl), {
+    headers: { "X-Buda-Local-Terminal-Token": input.localToken },
+    handshakeTimeout: TERMINAL_HANDSHAKE_TIMEOUT_MS
+  });
+  try {
+    await Promise.all([connectSocket(cloud), connectSocket(local)]);
+  } catch (error) {
+    cloud.terminate();
+    local.terminate();
+    throw error;
+  }
+  let bridgeAccepted = false;
+  let activityEnded = false;
+  const endActivity = () => {
+    if (activityEnded) return;
+    activityEnded = true;
+    input.onActivityEnd?.();
+  };
+  let pendingBytes = 0;
+  const pendingCloudFrames = [];
+  const pendingLocalFrames = [];
+  const bufferFrame = (frames, data, isBinary) => {
+    const bytes = Array.isArray(data) ? data.reduce((total, chunk) => total + chunk.byteLength, 0) : data.byteLength;
+    if (pendingBytes + bytes > MAX_TERMINAL_FRAME_BYTES) {
+      cloud.close(1009, "Terminal handshake buffer too large");
+      local.close(1009, "Terminal handshake buffer too large");
+      return false;
+    }
+    pendingBytes += bytes;
+    frames.push([data, isBinary]);
+    return true;
+  };
+  cloud.on("message", (data, isBinary) => {
+    if (!bridgeAccepted) {
+      if (!isBinary && data.toString() === '{"type":"bridge-accepted"}') {
+        bridgeAccepted = true;
+        local.send(JSON.stringify({ type: "bridge-start" }));
+        for (const [frame, binary] of pendingCloudFrames) {
+          if (local.readyState === WebSocket.OPEN) local.send(frame, { binary });
+        }
+        for (const [frame, binary] of pendingLocalFrames) {
+          if (cloud.readyState === WebSocket.OPEN) cloud.send(frame, { binary });
+        }
+        pendingCloudFrames.length = 0;
+        pendingLocalFrames.length = 0;
+        pendingBytes = 0;
+        return;
+      }
+      bufferFrame(pendingCloudFrames, data, isBinary);
+      return;
+    }
+    if (local.readyState === WebSocket.OPEN) local.send(data, { binary: isBinary });
+  });
+  local.on("message", (data, isBinary) => {
+    if (!bridgeAccepted) {
+      bufferFrame(pendingLocalFrames, data, isBinary);
+      return;
+    }
+    if (cloud.readyState === WebSocket.OPEN) cloud.send(data, { binary: isBinary });
+  });
+  cloud.once("close", (code, reason) => {
+    endActivity();
+    if (!bridgeAccepted) {
+      void writeLog(
+        "warn",
+        `terminal cloud tunnel closed before readiness session=${input.sessionId} code=${code} reason=${truncateTerminalCloseReason(reason.toString())}`
+      );
+    }
+    if (local.readyState === WebSocket.OPEN) {
+      local.close(normalizeTerminalCloseCode(code), truncateTerminalCloseReason(reason.toString()));
+    }
+  });
+  local.once("close", (code, reason) => {
+    endActivity();
+    if (cloud.readyState === WebSocket.OPEN) {
+      cloud.close(normalizeTerminalCloseCode(code), truncateTerminalCloseReason(reason.toString()));
+    }
+  });
+  cloud.once("error", () => local.terminate());
+  local.once("error", () => cloud.terminate());
+  input.onActivityStart?.();
+  cloud.send(JSON.stringify({ type: "bridge-ready" }));
   await writeLog(
     "info",
-    `registered connector=${result.connector.connectorId} status=${result.connector.status} owner=${formatConnectorOwner(result.connector)}`
+    `terminal proxy connected session=${input.sessionId} workspace=${input.workspaceKey}`
   );
-  await warnIfStaleBundle(result);
+};
+
+// src/bunny-daemon.ts
+async function startEmbeddedBunnyDaemon(config, launchConfig) {
+  const host = getBunnyDaemonHost(launchConfig);
+  const port = getBunnyDaemonPort(launchConfig);
+  const root = config.workdirRoot;
+  await mkdir7(root, { recursive: true });
+  const server = createDaemon({ host, port, root });
+  installConnectorTerminalEndpoint(server);
+  await new Promise((resolve, reject) => {
+    const onError = (error) => {
+      server.off("listening", onListening);
+      reject(error);
+    };
+    const onListening = () => {
+      server.off("error", onError);
+      resolve();
+    };
+    server.once("error", onError);
+    server.once("listening", onListening);
+    server.listen(port, host);
+  });
+  const address = server.address();
+  const actualPort = typeof address === "object" && address ? address.port : port;
+  const baseUrl = `http://${host}:${actualPort}`;
+  await writeLog("info", `bunny daemon listening ${baseUrl}`, {
+    root
+  });
   return {
-    connectorId: result.connector.connectorId,
-    relayProtocol: result.relayProtocol
+    server,
+    host,
+    port: actualPort,
+    baseUrl,
+    root
   };
 }
-async function heartbeatConnector(config, launchConfig, bunnyDaemon) {
-  const logs = takePendingLogs();
-  const result = await postJson(
-    config.serverUrl,
-    "/api/connectors/heartbeat",
-    await buildPayload(config, {
-      bunnyDaemon,
-      logs
-    }),
-    config,
-    launchConfig
-  ).catch((error) => {
-    restorePendingLogs(logs);
-    throw error;
-  });
-  return { relayProtocol: result.relayProtocol };
-}
-async function unregisterConnector(config, launchConfig) {
-  await postJson(
-    config.serverUrl,
-    "/api/connectors/unregister",
-    {
-      connectorId: config.connectorId
-    },
-    config,
-    launchConfig
-  ).catch((error) => {
-    void writeLog("warn", `unregister failed: ${error instanceof Error ? error.message : error}`);
+async function stopEmbeddedBunnyDaemon(daemon) {
+  await new Promise((resolve) => {
+    daemon.server.close(() => resolve());
   });
+  await writeLog("info", `bunny daemon stopped ${daemon.baseUrl}`);
 }
 
 // src/legacy-workspace-migration.ts
-import { createHash as createHash5, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash5, randomUUID as randomUUID5 } from "crypto";
 import { constants as constants2, createReadStream } from "fs";
 import {
-  chmod as chmod2,
+  chmod as chmod4,
   copyFile,
   lstat,
-  mkdir as mkdir5,
+  mkdir as mkdir8,
   open as open2,
-  readdir as readdir2,
-  readFile as readFile4,
+  readdir as readdir4,
+  readFile as readFile7,
   readlink,
   realpath,
-  rename as rename2,
-  rm,
+  rename as rename5,
+  rm as rm2,
   symlink,
-  unlink as unlink3
+  unlink as unlink5
 } from "fs/promises";
-import path4 from "path";
+import path9 from "path";
 var MIGRATION_VERSION = 1;
-var MIGRATION_DIRECTORY = path4.join(".buda", "migrations", "legacy-workspace-v1");
+var MIGRATION_DIRECTORY = path9.join(".buda", "migrations", "legacy-workspace-v1");
 var JOURNAL_FILENAME = "journal.json";
 var IMMUTABLE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
 var LEGACY_TEMPLATE_FILES = [
@@ -1286,7 +3366,7 @@ var LegacyWorkspaceMigrationError = class extends Error {
   recoverable = true;
 };
 var migrateLegacyWorkspaceRoot = async (storageRoot, options = {}) => {
-  await mkdir5(storageRoot, { recursive: true, mode: 448 });
+  await mkdir8(storageRoot, { recursive: true, mode: 448 });
   const rootInfo = await lstat(storageRoot);
   if (rootInfo.isSymbolicLink() || !rootInfo.isDirectory()) {
     throw new LegacyWorkspaceMigrationError(
@@ -1295,9 +3375,9 @@ var migrateLegacyWorkspaceRoot = async (storageRoot, options = {}) => {
     );
   }
   const canonicalRoot = await realpath(storageRoot);
-  const migrationDirectory = path4.join(canonicalRoot, MIGRATION_DIRECTORY);
+  const migrationDirectory = path9.join(canonicalRoot, MIGRATION_DIRECTORY);
   await ensurePrivateDirectoryWithin(canonicalRoot, migrationDirectory);
-  const journalPath = path4.join(migrationDirectory, JOURNAL_FILENAME);
+  const journalPath = path9.join(migrationDirectory, JOURNAL_FILENAME);
   let journal = await readJournal(journalPath);
   if (journal) validateJournalPaths(journal, canonicalRoot, migrationDirectory);
   if (journal?.status === "complete") {
@@ -1330,8 +3410,8 @@ var migrateLegacyWorkspaceRoot = async (storageRoot, options = {}) => {
 };
 var migrateItem = async (storageRoot, journalPath, journal, item, options) => {
   if (item.phase === "committed") return;
-  if (await exists(item.target)) {
-    if (!await exists(item.staging) && ["verified", "copied", "copying"].includes(item.phase)) {
+  if (await exists2(item.target)) {
+    if (!await exists2(item.staging) && ["verified", "copied", "copying"].includes(item.phase)) {
       await verifyTree(item.source, item.target);
       item.phase = "committed";
       await writeJournal(journalPath, journal);
@@ -1346,8 +3426,8 @@ var migrateItem = async (storageRoot, journalPath, journal, item, options) => {
     item.phase = "copying";
     await writeJournal(journalPath, journal);
     await checkpoint(options, "before-copy", item.id);
-    await rm(item.staging, { recursive: true, force: true });
-    await ensurePrivateDirectoryWithin(storageRoot, path4.dirname(item.staging));
+    await rm2(item.staging, { recursive: true, force: true });
+    await ensurePrivateDirectoryWithin(storageRoot, path9.dirname(item.staging));
     await copyTree(item.source, item.staging, () => checkpoint(options, "during-copy", item.id));
     await checkpoint(options, "after-copy", item.id);
     item.phase = "copied";
@@ -1358,7 +3438,7 @@ var migrateItem = async (storageRoot, journalPath, journal, item, options) => {
     try {
       await verifyTree(item.source, item.staging);
     } catch (error) {
-      await rm(item.staging, { recursive: true, force: true });
+      await rm2(item.staging, { recursive: true, force: true });
       item.phase = "copying";
       await writeJournal(journalPath, journal);
       throw error;
@@ -1369,9 +3449,9 @@ var migrateItem = async (storageRoot, journalPath, journal, item, options) => {
   }
   if (item.phase === "verified") {
     await checkpoint(options, "before-rename", item.id);
-    await ensurePrivateDirectoryWithin(storageRoot, path4.dirname(item.target));
-    await rename2(item.staging, item.target);
-    await syncDirectory(path4.dirname(item.target));
+    await ensurePrivateDirectoryWithin(storageRoot, path9.dirname(item.target));
+    await rename5(item.staging, item.target);
+    await syncDirectory2(path9.dirname(item.target));
     await checkpoint(options, "after-rename", item.id);
     item.phase = "committed";
     await writeJournal(journalPath, journal);
@@ -1381,14 +3461,14 @@ var resumeRollback = async (journalPath, journal, options) => {
   for (const item of [...journal.items].reverse()) {
     if (item.phase === "rolled-back") continue;
     await checkpoint(options, "before-rollback", item.id);
-    if (!await exists(item.source)) {
+    if (!await exists2(item.source)) {
       throw new LegacyWorkspaceMigrationError(
         "MIGRATION_VERIFY_FAILED",
         `Cannot roll back ${item.id}: the preserved legacy source is missing`
       );
     }
-    await rm(item.staging, { recursive: true, force: true });
-    await rm(item.target, { recursive: true, force: true });
+    await rm2(item.staging, { recursive: true, force: true });
+    await rm2(item.target, { recursive: true, force: true });
     await checkpoint(options, "after-rollback", item.id);
     item.phase = "rolled-back";
     await writeJournal(journalPath, journal);
@@ -1402,12 +3482,12 @@ var createJournal = async (storageRoot, migrationDirectory, owner) => {
   const ownership = owner ? "explicit-owner" : "shared-legacy";
   const label = owner ? `Legacy Connector root assigned to ${owner.spaceId}/${owner.agentId}` : "Shared legacy Connector root (ownership unassigned)";
   const sources = await inventoryLegacySources(storageRoot);
-  const stagingRoot = path4.join(migrationDirectory, "staging", randomUUID2());
+  const stagingRoot = path9.join(migrationDirectory, "staging", randomUUID5());
   const items = sources.map(({ id, source }) => ({
     id,
     source,
     target: deriveTarget(storageRoot, id, owner),
-    staging: path4.join(stagingRoot, id),
+    staging: path9.join(stagingRoot, id),
     phase: "pending"
   }));
   assertDistinctTargets(items);
@@ -1424,29 +3504,29 @@ var createJournal = async (storageRoot, migrationDirectory, owner) => {
   };
 };
 var inventoryLegacySources = async (storageRoot) => {
-  const rootEntries = await readdir2(storageRoot, { withFileTypes: true });
+  const rootEntries = await readdir4(storageRoot, { withFileTypes: true });
   const templateNames = new Set(LEGACY_TEMPLATE_FILES);
   for (const entry of rootEntries) {
     if (entry.name.endsWith(".md")) templateNames.add(entry.name);
   }
   const candidates = [
-    { id: "agent", source: path4.join(storageRoot, "agent") },
-    { id: "space", source: path4.join(storageRoot, "space") },
-    { id: "logs", source: path4.join(storageRoot, "logs") },
-    { id: "connector-log", source: path4.join(storageRoot, "connector.log") },
-    { id: "runtime-config", source: path4.join(storageRoot, "runtime-config") },
-    { id: "runtime-config-hidden", source: path4.join(storageRoot, ".runtime-config") },
-    { id: "runtime-config-file", source: path4.join(storageRoot, "runtime-config.json") },
-    { id: "runtime-config-hidden-file", source: path4.join(storageRoot, ".runtime-config.json") },
-    { id: "bunny-runtime", source: path4.join(storageRoot, ".bunny") },
+    { id: "agent", source: path9.join(storageRoot, "agent") },
+    { id: "space", source: path9.join(storageRoot, "space") },
+    { id: "logs", source: path9.join(storageRoot, "logs") },
+    { id: "connector-log", source: path9.join(storageRoot, "connector.log") },
+    { id: "runtime-config", source: path9.join(storageRoot, "runtime-config") },
+    { id: "runtime-config-hidden", source: path9.join(storageRoot, ".runtime-config") },
+    { id: "runtime-config-file", source: path9.join(storageRoot, "runtime-config.json") },
+    { id: "runtime-config-hidden-file", source: path9.join(storageRoot, ".runtime-config.json") },
+    { id: "bunny-runtime", source: path9.join(storageRoot, ".bunny") },
     ...[...templateNames].sort().map((name) => ({
       id: `template-${name}`,
-      source: path4.join(storageRoot, name)
+      source: path9.join(storageRoot, name)
     }))
   ];
   const found = [];
   for (const candidate of candidates) {
-    if (!await exists(candidate.source)) continue;
+    if (!await exists2(candidate.source)) continue;
     const info = await lstat(candidate.source);
     if (info.isSymbolicLink()) {
       throw new LegacyWorkspaceMigrationError(
@@ -1454,36 +3534,36 @@ var inventoryLegacySources = async (storageRoot) => {
         `Legacy migration source ${candidate.id} must not be a symbolic link`
       );
     }
-    if (info.isDirectory() && (await readdir2(candidate.source)).length === 0) continue;
+    if (info.isDirectory() && (await readdir4(candidate.source)).length === 0) continue;
     found.push(candidate);
   }
   return found;
 };
 var deriveTarget = (storageRoot, id, owner) => {
-  if (!owner) return path4.join(storageRoot, ".buda", "legacy", "shared", id);
-  const spaceRoot = path4.join(storageRoot, ".buda", "spaces", owner.spaceId);
-  const agentRoot = path4.join(spaceRoot, "agents", owner.agentId);
-  if (id === "agent") return path4.join(agentRoot, "workspace", "legacy-connector-root");
-  if (id === "space") return path4.join(spaceRoot, "shared", "legacy-connector-root");
+  if (!owner) return path9.join(storageRoot, ".buda", "legacy", "shared", id);
+  const spaceRoot = path9.join(storageRoot, ".buda", "spaces", owner.spaceId);
+  const agentRoot = path9.join(spaceRoot, "agents", owner.agentId);
+  if (id === "agent") return path9.join(agentRoot, "workspace", "legacy-connector-root");
+  if (id === "space") return path9.join(spaceRoot, "shared", "legacy-connector-root");
   if (id.startsWith("template-")) {
-    return path4.join(spaceRoot, "shared", "legacy-templates", id.slice("template-".length));
+    return path9.join(spaceRoot, "shared", "legacy-templates", id.slice("template-".length));
   }
-  return path4.join(agentRoot, "state", "legacy-connector-root", id);
+  return path9.join(agentRoot, "state", "legacy-connector-root", id);
 };
 var copyTree = async (source, destination, onEntryCopied) => {
   const info = await lstat(source);
   if (info.isDirectory()) {
-    await mkdir5(destination, { mode: info.mode & 4095 });
-    const entries = (await readdir2(source)).sort();
+    await mkdir8(destination, { mode: info.mode & 4095 });
+    const entries = (await readdir4(source)).sort();
     for (const entry of entries) {
-      await copyTree(path4.join(source, entry), path4.join(destination, entry), onEntryCopied);
+      await copyTree(path9.join(source, entry), path9.join(destination, entry), onEntryCopied);
     }
-    await chmod2(destination, info.mode & 4095);
+    await chmod4(destination, info.mode & 4095);
     return;
   }
   if (info.isFile()) {
     await copyFile(source, destination, constants2.COPYFILE_EXCL);
-    await chmod2(destination, info.mode & 4095);
+    await chmod4(destination, info.mode & 4095);
     await onEntryCopied();
     return;
   }
@@ -1511,8 +3591,8 @@ var verifyTree = async (source, destination) => {
   }
   if (sourceInfo.isDirectory()) {
     const [sourceEntries, destinationEntries] = await Promise.all([
-      readdir2(source),
-      readdir2(destination)
+      readdir4(source),
+      readdir4(destination)
     ]);
     sourceEntries.sort();
     destinationEntries.sort();
@@ -1520,7 +3600,7 @@ var verifyTree = async (source, destination) => {
       throw verifyFailure("directory entries differ");
     }
     for (const entry of sourceEntries) {
-      await verifyTree(path4.join(source, entry), path4.join(destination, entry));
+      await verifyTree(path9.join(source, entry), path9.join(destination, entry));
     }
     return;
   }
@@ -1550,7 +3630,7 @@ var hashFile = async (filePath) => {
 var readJournal = async (journalPath) => {
   let raw;
   try {
-    raw = await readFile4(journalPath, "utf8");
+    raw = await readFile7(journalPath, "utf8");
   } catch (error) {
     if (isMissing(error)) return void 0;
     throw error;
@@ -1562,13 +3642,13 @@ var readJournal = async (journalPath) => {
     throw corrupt("Legacy migration journal contains invalid JSON");
   }
   if (!isJournal(value)) throw corrupt("Legacy migration journal is malformed");
-  await chmod2(journalPath, 384);
+  await chmod4(journalPath, 384);
   return value;
 };
 var writeJournal = async (journalPath, journal) => {
   journal.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  await ensurePrivateDirectory(path4.dirname(journalPath));
-  const temporaryPath = `${journalPath}.${process.pid}.${randomUUID2()}.tmp`;
+  await ensurePrivateDirectory(path9.dirname(journalPath));
+  const temporaryPath = `${journalPath}.${process.pid}.${randomUUID5()}.tmp`;
   const handle = await open2(
     temporaryPath,
     constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY,
@@ -1582,14 +3662,14 @@ var writeJournal = async (journalPath, journal) => {
     await handle.close();
   }
   try {
-    await rename2(temporaryPath, journalPath);
-    await chmod2(journalPath, 384);
-    await syncDirectory(path4.dirname(journalPath));
+    await rename5(temporaryPath, journalPath);
+    await chmod4(journalPath, 384);
+    await syncDirectory2(path9.dirname(journalPath));
   } finally {
-    await unlink3(temporaryPath).catch(() => void 0);
+    await unlink5(temporaryPath).catch(() => void 0);
   }
 };
-var syncDirectory = async (directory) => {
+var syncDirectory2 = async (directory) => {
   const handle = await open2(directory, constants2.O_RDONLY);
   try {
     await handle.sync();
@@ -1598,7 +3678,7 @@ var syncDirectory = async (directory) => {
   }
 };
 var ensurePrivateDirectory = async (directory) => {
-  await mkdir5(directory, { mode: 448 }).catch((error) => {
+  await mkdir8(directory, { mode: 448 }).catch((error) => {
     if (!isAlreadyExists2(error)) throw error;
   });
   const info = await lstat(directory);
@@ -1608,16 +3688,16 @@ var ensurePrivateDirectory = async (directory) => {
       "Legacy migration control path must be a real directory"
     );
   }
-  await chmod2(directory, 448);
+  await chmod4(directory, 448);
 };
 var ensurePrivateDirectoryWithin = async (storageRoot, directory) => {
   if (directory !== storageRoot && !isPathInside(storageRoot, directory)) {
     throw corrupt("Legacy migration control path escapes protected storage");
   }
-  const relative = path4.relative(storageRoot, directory);
+  const relative = path9.relative(storageRoot, directory);
   let current = storageRoot;
-  for (const segment of relative.split(path4.sep).filter(Boolean)) {
-    current = path4.join(current, segment);
+  for (const segment of relative.split(path9.sep).filter(Boolean)) {
+    current = path9.join(current, segment);
     await ensurePrivateDirectory(current);
   }
 };
@@ -1642,7 +3722,7 @@ var validateJournalPaths = (journal, storageRoot, migrationDirectory) => {
   const stagingPaths = /* @__PURE__ */ new Set();
   for (const item of journal.items) {
     const sourceRelative = sourceRelativePath(item.id);
-    if (!sourceRelative || item.source !== path4.join(storageRoot, sourceRelative)) {
+    if (!sourceRelative || item.source !== path9.join(storageRoot, sourceRelative)) {
       throw corrupt("Legacy migration journal contains an unexpected source path");
     }
     if (item.target !== deriveTarget(storageRoot, item.id, journal.owner)) {
@@ -1651,8 +3731,8 @@ var validateJournalPaths = (journal, storageRoot, migrationDirectory) => {
     if (!isPathInside(migrationDirectory, item.staging)) {
       throw corrupt("Legacy migration journal staging path escapes the migration directory");
     }
-    const stagingParent = path4.dirname(item.staging);
-    if (path4.dirname(stagingParent) !== path4.join(migrationDirectory, "staging") || item.staging !== path4.join(stagingParent, item.id)) {
+    const stagingParent = path9.dirname(item.staging);
+    if (path9.dirname(stagingParent) !== path9.join(migrationDirectory, "staging") || item.staging !== path9.join(stagingParent, item.id)) {
       throw corrupt("Legacy migration journal staging path is not canonical");
     }
     stagingParents.add(stagingParent);
@@ -1682,7 +3762,7 @@ var sourceRelativePath = (id) => {
   if (known[id]) return known[id];
   if (!id.startsWith("template-")) return null;
   const name = id.slice("template-".length);
-  return name.endsWith(".md") && path4.basename(name) === name ? name : null;
+  return name.endsWith(".md") && path9.basename(name) === name ? name : null;
 };
 var validateJournalOwnership = (journal) => {
   if (journal.ownership === "explicit-owner") {
@@ -1745,7 +3825,7 @@ var isJournal = (value) => {
     (item) => item && typeof item === "object" && typeof item.id === "string" && typeof item.source === "string" && typeof item.target === "string" && typeof item.staging === "string" && typeof item.phase === "string" && ITEM_PHASES.has(item.phase)
   );
 };
-var exists = async (filePath) => {
+var exists2 = async (filePath) => {
   try {
     await lstat(filePath);
     return true;
@@ -1755,8 +3835,8 @@ var exists = async (filePath) => {
   }
 };
 var isPathInside = (parent, child) => {
-  const relative = path4.relative(parent, child);
-  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path4.sep}`) && !path4.isAbsolute(relative);
+  const relative = path9.relative(parent, child);
+  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path9.sep}`) && !path9.isAbsolute(relative);
 };
 var isMissing = (error) => error instanceof Error && "code" in error && error.code === "ENOENT";
 var isAlreadyExists2 = (error) => error instanceof Error && "code" in error && error.code === "EEXIST";
@@ -1768,9 +3848,9 @@ var corrupt = (message) => new LegacyWorkspaceMigrationError("MIGRATION_CORRUPT"
 var errorMessage = (error) => error instanceof Error ? error.message : String(error);
 
 // src/relay.ts
-import path6 from "path";
+import path11 from "path";
 import { createNextHandler } from "@bunny-agent/daemon/nextjs";
-import WebSocket from "ws";
+import WebSocket2 from "ws";
 
 // src/execution-identity.ts
 import {
@@ -1940,15 +4020,15 @@ import { constants as constants3 } from "fs";
 import {
   copyFile as copyFile2,
   lstat as lstat2,
-  mkdir as mkdir6,
-  readdir as readdir3,
-  readFile as readFile5,
+  mkdir as mkdir9,
+  readdir as readdir5,
+  readFile as readFile8,
   realpath as realpath2,
-  rm as rm2,
+  rm as rm3,
   symlink as symlink2,
-  writeFile as writeFile2
+  writeFile as writeFile4
 } from "fs/promises";
-import path5 from "path";
+import path10 from "path";
 var MOUNT_DIRECTORY = "mount";
 var ARCHIVE_MARKER = "archived.json";
 var AGENT_CONTEXT_TEMPLATE_FILES = [
@@ -1960,8 +4040,8 @@ var AGENT_CONTEXT_TEMPLATE_FILES = [
   "BOOTSTRAP.md",
   "MEMORY.md"
 ];
-var deriveSystemVolume = (descriptor) => path5.join(
-  path5.dirname(path5.dirname(path5.dirname(path5.dirname(descriptor.sharedVolume)))),
+var deriveSystemVolume = (descriptor) => path10.join(
+  path10.dirname(path10.dirname(path10.dirname(path10.dirname(descriptor.sharedVolume)))),
   "system"
 );
 var WorkspaceVolumeLifecycle = class {
@@ -1973,14 +4053,14 @@ var WorkspaceVolumeLifecycle = class {
   async mount() {
     await this.ensureVolumes();
     await this.bootstrapAgentTemplates((await readBundledManifest()).sharedDir);
-    const mountRoot = path5.join(this.descriptor.stateVolume, MOUNT_DIRECTORY);
-    await mkdir6(mountRoot, { recursive: true, mode: 448 });
+    const mountRoot = path10.join(this.descriptor.stateVolume, MOUNT_DIRECTORY);
+    await mkdir9(mountRoot, { recursive: true, mode: 448 });
     const mounts = {
       mountRoot,
-      agent: path5.join(mountRoot, "agent"),
-      space: path5.join(mountRoot, "space"),
-      system: path5.join(mountRoot, "system"),
-      temporary: path5.join(mountRoot, "tmp")
+      agent: path10.join(mountRoot, "agent"),
+      space: path10.join(mountRoot, "space"),
+      system: path10.join(mountRoot, "system"),
+      temporary: path10.join(mountRoot, "tmp")
     };
     await Promise.all([
       ensureVolumeLink(this.descriptor.privateVolume, mounts.agent),
@@ -1988,69 +4068,69 @@ var WorkspaceVolumeLifecycle = class {
       ensureVolumeLink(this.systemVolume, mounts.system),
       ensureVolumeLink(this.descriptor.temporaryVolume, mounts.temporary)
     ]);
-    const daemonVolumes = path5.join(mountRoot, "volumes");
-    await mkdir6(daemonVolumes, { recursive: true, mode: 448 });
+    const daemonVolumes = path10.join(mountRoot, "volumes");
+    await mkdir9(daemonVolumes, { recursive: true, mode: 448 });
     await Promise.all([
-      ensureVolumeLink(this.descriptor.privateVolume, path5.join(daemonVolumes, "agent")),
-      ensureVolumeLink(this.descriptor.sharedVolume, path5.join(daemonVolumes, "space")),
-      ensureVolumeLink(this.systemVolume, path5.join(daemonVolumes, "system")),
-      ensureVolumeLink(this.descriptor.temporaryVolume, path5.join(daemonVolumes, "tmp"))
+      ensureVolumeLink(this.descriptor.privateVolume, path10.join(daemonVolumes, "agent")),
+      ensureVolumeLink(this.descriptor.sharedVolume, path10.join(daemonVolumes, "space")),
+      ensureVolumeLink(this.systemVolume, path10.join(daemonVolumes, "system")),
+      ensureVolumeLink(this.descriptor.temporaryVolume, path10.join(daemonVolumes, "tmp"))
     ]);
     return mounts;
   }
   async unmount() {
-    await rm2(path5.join(this.descriptor.stateVolume, MOUNT_DIRECTORY), {
+    await rm3(path10.join(this.descriptor.stateVolume, MOUNT_DIRECTORY), {
       recursive: true,
       force: true
     });
   }
   async archiveAgent() {
     await this.unmount();
-    await mkdir6(this.descriptor.stateVolume, { recursive: true, mode: 448 });
-    await writeFile2(
-      path5.join(this.descriptor.stateVolume, ARCHIVE_MARKER),
+    await mkdir9(this.descriptor.stateVolume, { recursive: true, mode: 448 });
+    await writeFile4(
+      path10.join(this.descriptor.stateVolume, ARCHIVE_MARKER),
       `${JSON.stringify({ archivedAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `,
       { encoding: "utf8", mode: 384 }
     );
   }
   async restoreAgent() {
-    await rm2(path5.join(this.descriptor.stateVolume, ARCHIVE_MARKER), { force: true });
+    await rm3(path10.join(this.descriptor.stateVolume, ARCHIVE_MARKER), { force: true });
     return this.mount();
   }
   async deleteAgent(options) {
     requireConfirmation(options);
     await this.unmount();
-    const agentRoot = path5.dirname(this.descriptor.privateVolume);
-    await rm2(agentRoot, { recursive: true, force: true });
+    const agentRoot = path10.dirname(this.descriptor.privateVolume);
+    await rm3(agentRoot, { recursive: true, force: true });
   }
   async archiveSpace() {
-    await mkdir6(this.descriptor.sharedVolume, { recursive: true, mode: 448 });
-    await writeFile2(
-      path5.join(this.descriptor.sharedVolume, ARCHIVE_MARKER),
+    await mkdir9(this.descriptor.sharedVolume, { recursive: true, mode: 448 });
+    await writeFile4(
+      path10.join(this.descriptor.sharedVolume, ARCHIVE_MARKER),
       `${JSON.stringify({ archivedAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `,
       { encoding: "utf8", mode: 384 }
     );
   }
   async restoreSpace() {
-    await rm2(path5.join(this.descriptor.sharedVolume, ARCHIVE_MARKER), { force: true });
+    await rm3(path10.join(this.descriptor.sharedVolume, ARCHIVE_MARKER), { force: true });
   }
   async deleteSpace(options) {
     requireConfirmation(options);
     await this.unmount();
-    await rm2(this.descriptor.sharedVolume, { recursive: true, force: true });
+    await rm3(this.descriptor.sharedVolume, { recursive: true, force: true });
   }
   async bootstrapAgentTemplates(templateDirectory) {
-    await mkdir6(this.descriptor.privateVolume, { recursive: true, mode: 448 });
+    await mkdir9(this.descriptor.privateVolume, { recursive: true, mode: 448 });
     const bootstrapped = [];
     const skipped = [];
     const entries = new Set(
-      (await readdir3(templateDirectory, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isFile()).map((entry) => entry.name)
+      (await readdir5(templateDirectory, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isFile()).map((entry) => entry.name)
     );
     for (const filename of AGENT_CONTEXT_TEMPLATE_FILES) {
       if (!entries.has(filename)) continue;
-      const destination = path5.join(this.descriptor.privateVolume, filename);
+      const destination = path10.join(this.descriptor.privateVolume, filename);
       try {
         await lstat2(destination);
         skipped.push(filename);
@@ -2058,7 +4138,7 @@ var WorkspaceVolumeLifecycle = class {
         if (!isMissingFile(error)) throw error;
         try {
           await copyFile2(
-            path5.join(templateDirectory, filename),
+            path10.join(templateDirectory, filename),
             destination,
             constants3.COPYFILE_EXCL
           );
@@ -2079,7 +4159,7 @@ var WorkspaceVolumeLifecycle = class {
       this.descriptor.temporaryVolume,
       this.systemVolume
     ]) {
-      await mkdir6(volume, { recursive: true, mode: 448 });
+      await mkdir9(volume, { recursive: true, mode: 448 });
       const info = await lstat2(volume);
       if (info.isSymbolicLink() || !info.isDirectory() || await realpath2(volume) !== volume) {
         throw new Error("Workspace volume must be a canonical real directory");
@@ -2121,6 +4201,20 @@ var RELAY_RECONNECT_JITTER = 0.2;
 var RELAY_FAST_RECONNECT_MS = 500;
 var CONNECTOR_SOCKET_REPLACED_CLOSE_CODE = 4001;
 var CONNECTOR_SOCKET_REVOKED_CLOSE_CODE = 4003;
+var SAFE_TRACE_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+var getBudaCodingRunSessionId = (body) => {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return void 0;
+  const record = body;
+  for (const key of ["systemEnv", "env"]) {
+    const env = record[key];
+    if (!env || typeof env !== "object" || Array.isArray(env)) continue;
+    const value = env.BUDA_SESSION_ID;
+    if (typeof value !== "string") continue;
+    const normalized = value.trim();
+    if (SAFE_TRACE_ID_PATTERN.test(normalized)) return normalized;
+  }
+  return void 0;
+};
 var shouldReconnectConnectorRelay = (closeCode) => closeCode !== CONNECTOR_SOCKET_REPLACED_CLOSE_CODE && closeCode !== CONNECTOR_SOCKET_REVOKED_CLOSE_CODE;
 var getConnectorRelayReconnectBaseDelay = (hadOpenConnection, backoffMs) => hadOpenConnection ? RELAY_FAST_RECONNECT_MS : backoffMs;
 var formatConnectorRelayError = (error, depth = 0) => {
@@ -2149,6 +4243,8 @@ function startConnectorRelay(config, bunnyDaemon, relayProtocol, workspaceRegist
   let reconnectDelayMs = RELAY_RECONNECT_INTERVAL_MS;
   let hadOpenConnection = false;
   let activeRelayProtocol = relayProtocol;
+  let currentInflight = /* @__PURE__ */ new Map();
+  let activeTerminalTunnels = 0;
   const replayGuard = new ConnectorExecutionReplayGuard();
   const clearTimers = () => {
     if (pingTimer) {
@@ -2196,12 +4292,13 @@ function startConnectorRelay(config, bunnyDaemon, relayProtocol, workspaceRegist
     if (token) headers["X-Buda-Connector-Token"] = token;
     headers["X-Buda-Connector-Id"] = config.connectorId;
     if (config.deviceToken) headers["X-Buda-Connector-Device-Token"] = config.deviceToken;
-    const ws = new WebSocket(relayUrl, {
+    const ws = new WebSocket2(relayUrl, {
       headers: Object.keys(headers).length > 0 ? headers : void 0,
       handshakeTimeout: RELAY_HANDSHAKE_TIMEOUT_MS
     });
     socket = ws;
     const inflight = /* @__PURE__ */ new Map();
+    currentInflight = inflight;
     let detached = false;
     const detach = () => {
       if (detached) return;
@@ -2215,7 +4312,7 @@ function startConnectorRelay(config, bunnyDaemon, relayProtocol, workspaceRegist
       hadOpenConnection = true;
       reconnectDelayMs = RELAY_RECONNECT_INTERVAL_MS;
       pingTimer = setInterval(() => {
-        if (ws.readyState !== WebSocket.OPEN) return;
+        if (ws.readyState !== WebSocket2.OPEN) return;
         try {
           ws.ping();
         } catch (error) {
@@ -2245,7 +4342,17 @@ function startConnectorRelay(config, bunnyDaemon, relayProtocol, workspaceRegist
         config.connectorId,
         activeRelayProtocol,
         replayGuard,
-        workspaceRegistry
+        workspaceRegistry,
+        config.serverUrl,
+        bunnyDaemon.baseUrl,
+        {
+          onTerminalOpen: () => {
+            activeTerminalTunnels += 1;
+          },
+          onTerminalClose: () => {
+            activeTerminalTunnels = Math.max(0, activeTerminalTunnels - 1);
+          }
+        }
       );
     });
     ws.on("close", (code) => {
@@ -2277,6 +4384,12 @@ function startConnectorRelay(config, bunnyDaemon, relayProtocol, workspaceRegist
     scheduleReconnect("connect-throw");
   }
   return {
+    isIdle() {
+      return currentInflight.size === 0 && activeTerminalTunnels === 0;
+    },
+    isConnected() {
+      return socket?.readyState === WebSocket2.OPEN && !suspendedForAccessRevocation;
+    },
     updateRelayProtocol(nextRelayProtocol) {
       const previousKeyId = activeRelayProtocol?.keyId;
       activeRelayProtocol = nextRelayProtocol;
@@ -2308,8 +4421,8 @@ function startConnectorRelay(config, bunnyDaemon, relayProtocol, workspaceRegist
     }
   };
 }
-async function handleRelayMessage(socket, bunnyDaemon, raw, inflight, expectedConnectorId, relayProtocol, replayGuard, workspaceRegistry) {
-  if (!socket || socket.readyState !== WebSocket.OPEN) return;
+async function handleRelayMessage(socket, bunnyDaemon, raw, inflight, expectedConnectorId, relayProtocol, replayGuard, workspaceRegistry, serverUrl, localDaemonBaseUrl, activity) {
+  if (!socket || socket.readyState !== WebSocket2.OPEN) return;
   let message;
   try {
     message = JSON.parse(raw);
@@ -2326,6 +4439,54 @@ async function handleRelayMessage(socket, bunnyDaemon, raw, inflight, expectedCo
     return;
   }
   if (message.type === "event") {
+    if (message.event.channel === "terminal-open") {
+      try {
+        if (!workspaceRegistry || !serverUrl || !localDaemonBaseUrl) {
+          throw new ConnectorRelayProtocolError("PROTOCOL_UNSUPPORTED");
+        }
+        const identity = verifyConnectorExecutionIdentity({
+          protocolVersion: message.event.payload.protocolVersion,
+          executionIdentity: message.event.payload.executionIdentity,
+          request: message.event.payload.request,
+          protocol: relayProtocol,
+          expectedConnectorId,
+          replayGuard
+        });
+        const terminal = parseConnectorTerminalRequest(message.event.payload.request);
+        if (terminal.sessionId !== message.event.sessionId) {
+          throw new ConnectorRelayProtocolError("IDENTITY_INVALID");
+        }
+        const descriptor = await workspaceRegistry.resolve(identity.spaceId, identity.agentId);
+        if (descriptor.spaceId !== identity.spaceId || descriptor.agentId !== identity.agentId) {
+          throw new ConnectorRelayProtocolError("WORKSPACE_MISMATCH");
+        }
+        const mounts = await new WorkspaceVolumeLifecycle(descriptor).mount();
+        const localToken = registerLocalTerminal({
+          workspaceKey: descriptor.workspaceKey,
+          tabId: terminal.tabId,
+          cwd: mounts.agent,
+          cols: terminal.cols,
+          rows: terminal.rows
+        });
+        await proxyConnectorTerminalTunnel({
+          serverUrl,
+          connectorId: expectedConnectorId,
+          sessionId: terminal.sessionId,
+          cloudToken: terminal.token,
+          localBaseUrl: localDaemonBaseUrl,
+          localToken,
+          workspaceKey: descriptor.workspaceKey,
+          onActivityStart: activity?.onTerminalOpen,
+          onActivityEnd: activity?.onTerminalClose
+        });
+      } catch (error) {
+        await writeLog(
+          "warn",
+          `terminal open rejected: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+      return;
+    }
     await writeLog("warn", "relay rejected unsigned browser input event");
     return;
   }
@@ -2351,6 +4512,15 @@ async function handleRelayMessage(socket, bunnyDaemon, raw, inflight, expectedCo
   }
   const controller = new AbortController();
   inflight.set(message.requestId, controller);
+  const codingRunStartedAt = message.request.path === "/api/coding/run" ? Date.now() : void 0;
+  const codingRunTrace = codingRunStartedAt !== void 0 && executionIdentity ? {
+    requestId: message.requestId,
+    connectorId: executionIdentity.connectorId,
+    agentId: executionIdentity.agentId,
+    runId: executionIdentity.runId,
+    budaSessionId: getBudaCodingRunSessionId(message.request.body) ?? null
+  } : void 0;
+  let codingRunStatus = null;
   try {
     const requestPath = message.request.path;
     const isBrowserRequest = requestPath.startsWith("/browser/") || requestPath === "/browser";
@@ -2411,6 +4581,14 @@ async function handleRelayMessage(socket, bunnyDaemon, raw, inflight, expectedCo
         signal: controller.signal
       });
     }
+    if (codingRunTrace && codingRunStartedAt !== void 0) {
+      codingRunStatus = response.status;
+      await writeLog("info", "relay request coding run started", {
+        ...codingRunTrace,
+        status: codingRunStatus,
+        durationMs: Date.now() - codingRunStartedAt
+      });
+    }
     sendRelayMessage(socket, {
       type: "start",
       requestId: message.requestId,
@@ -2453,7 +4631,21 @@ async function handleRelayMessage(socket, bunnyDaemon, raw, inflight, expectedCo
       type: "end",
       requestId: message.requestId
     });
+    if (codingRunTrace && codingRunStartedAt !== void 0) {
+      await writeLog("info", "relay request coding run completed", {
+        ...codingRunTrace,
+        status: codingRunStatus,
+        durationMs: Date.now() - codingRunStartedAt
+      });
+    }
   } catch (error) {
+    if (codingRunTrace && codingRunStartedAt !== void 0) {
+      await writeLog("error", "relay request coding run error", {
+        ...codingRunTrace,
+        status: codingRunStatus,
+        durationMs: Date.now() - codingRunStartedAt
+      });
+    }
     sendRelayError(socket, message.requestId, error);
   } finally {
     inflight.delete(message.requestId);
@@ -2478,12 +4670,12 @@ var normalizeWorkspaceRequest = (request, mounts) => {
   }
   const body = request.body;
   const cwd = typeof body.cwd === "string" ? body.cwd : "/agent";
-  const normalized = path6.posix.normalize(cwd);
+  const normalized = path11.posix.normalize(cwd);
   const [mount, relative] = normalized === "/agent" || normalized.startsWith("/agent/") ? [mounts.agent, normalized.slice("/agent".length)] : normalized === "/space" || normalized.startsWith("/space/") ? [mounts.space, normalized.slice("/space".length)] : [];
   if (!mount || relative === void 0) {
     throw new ConnectorRelayProtocolError("WORKSPACE_MISMATCH");
   }
-  return { ...request, body: { ...body, cwd: path6.join(mount, relative) } };
+  return { ...request, body: { ...body, cwd: path11.join(mount, relative) } };
 };
 function sendRelayError(socket, requestId, error) {
   sendRelayMessage(socket, {
@@ -2494,7 +4686,7 @@ function sendRelayError(socket, requestId, error) {
   });
 }
 function sendRelayMessage(socket, message) {
-  if (socket.readyState !== WebSocket.OPEN) return;
+  if (socket.readyState !== WebSocket2.OPEN) return;
   socket.send(JSON.stringify(message));
 }
 function headersToRecord(headers) {
@@ -2514,14 +4706,14 @@ function getHeaderValue(headers, name) {
 }
 
 // src/workdir-layout.ts
-import { lstat as lstat3, mkdir as mkdir7, symlink as symlink3, unlink as unlink4 } from "fs/promises";
-import path7 from "path";
+import { lstat as lstat3, mkdir as mkdir10, symlink as symlink3, unlink as unlink6 } from "fs/promises";
+import path12 from "path";
 async function provisionWorkdirLayout(workdirRoot) {
   const manifest = await readBundledManifest();
-  await mkdir7(workdirRoot, { recursive: true });
-  await mkdir7(path7.join(workdirRoot, "system", ".agents"), { recursive: true });
-  const systemSkillsLink = path7.join(workdirRoot, "system", ".agents", "skills");
-  const systemScriptsLink = path7.join(workdirRoot, "system", "scripts");
+  await mkdir10(workdirRoot, { recursive: true });
+  await mkdir10(path12.join(workdirRoot, "system", ".agents"), { recursive: true });
+  const systemSkillsLink = path12.join(workdirRoot, "system", ".agents", "skills");
+  const systemScriptsLink = path12.join(workdirRoot, "system", "scripts");
   await ensureSymlink(manifest.systemSkillsDir, systemSkillsLink);
   await ensureSymlink(manifest.scriptsDir, systemScriptsLink);
   await writeLog("info", "workdir layout provisioned", {
@@ -2541,7 +4733,7 @@ async function ensureSymlink(target, linkPath) {
   try {
     const existing = await lstat3(linkPath);
     if (existing.isSymbolicLink()) {
-      await unlink4(linkPath);
+      await unlink6(linkPath);
     } else if (existing.isDirectory()) {
       await writeLog(
         "warn",
@@ -2549,28 +4741,28 @@ async function ensureSymlink(target, linkPath) {
       );
       return;
     } else {
-      await unlink4(linkPath);
+      await unlink6(linkPath);
     }
   } catch {
   }
-  await mkdir7(path7.dirname(linkPath), { recursive: true });
+  await mkdir10(path12.dirname(linkPath), { recursive: true });
   await symlink3(target, linkPath, "dir");
 }
 
 // src/workspace-registry.ts
 import { constants as constants4 } from "fs";
 import {
-  chmod as chmod3,
+  chmod as chmod5,
   lstat as lstat4,
-  mkdir as mkdir8,
+  mkdir as mkdir11,
   open as open3,
-  readFile as readFile6,
+  readFile as readFile9,
   realpath as realpath3,
-  rename as rename3,
+  rename as rename6,
   statfs,
-  unlink as unlink5
+  unlink as unlink7
 } from "fs/promises";
-import path8 from "path";
+import path13 from "path";
 var REGISTRY_VERSION = 1;
 var REGISTRY_DIRECTORY = ".buda";
 var REGISTRY_FILENAME = "workspace-registry.json";
@@ -2591,16 +4783,16 @@ var LocalWorkspaceRegistry = class _LocalWorkspaceRegistry {
     this.document = document;
   }
   static async open(storageRoot) {
-    await mkdir8(storageRoot, { recursive: true, mode: 448 });
+    await mkdir11(storageRoot, { recursive: true, mode: 448 });
     await rejectUnsafeFilesystem(storageRoot);
     const canonicalRoot = await canonicalDirectory(storageRoot, "storage root");
-    const registryDirectory = path8.join(canonicalRoot, REGISTRY_DIRECTORY);
+    const registryDirectory = path13.join(canonicalRoot, REGISTRY_DIRECTORY);
     await ensurePrivateDirectory2(registryDirectory);
-    const registryPath = path8.join(registryDirectory, REGISTRY_FILENAME);
+    const registryPath = path13.join(registryDirectory, REGISTRY_FILENAME);
     const document = await withExclusiveFileLock(registryPath, async () => {
       let current;
       try {
-        current = parseRegistry(await readFile6(registryPath, "utf8"));
+        current = parseRegistry(await readFile9(registryPath, "utf8"));
       } catch (error) {
         if (isMissingFile2(error)) {
           current = { version: REGISTRY_VERSION, storageRoot: canonicalRoot, workspaces: {} };
@@ -2614,11 +4806,11 @@ var LocalWorkspaceRegistry = class _LocalWorkspaceRegistry {
       if (current.storageRoot !== canonicalRoot) {
         throw corrupt2("Registry storage root does not match the selected storage root");
       }
-      await chmod3(registryPath, 384);
+      await chmod5(registryPath, 384);
       await reconcileDocument(current, canonicalRoot);
       return current;
     });
-    await chmod3(registryPath, 384);
+    await chmod5(registryPath, 384);
     return new _LocalWorkspaceRegistry(registryPath, canonicalRoot, document);
   }
   async resolve(spaceId, agentId) {
@@ -2665,23 +4857,23 @@ var LocalWorkspaceRegistry = class _LocalWorkspaceRegistry {
 };
 var readRegistryDocument = async (registryPath) => {
   try {
-    return parseRegistry(await readFile6(registryPath, "utf8"));
+    return parseRegistry(await readFile9(registryPath, "utf8"));
   } catch (error) {
     if (error instanceof WorkspaceRegistryError) throw error;
     throw corrupt2(`Cannot read local workspace registry: ${errorMessage2(error)}`);
   }
 };
 var deriveWorkspace = (storageRoot, spaceId, agentId) => {
-  const spaceRoot = path8.join(storageRoot, REGISTRY_DIRECTORY, "spaces", spaceId);
-  const agentRoot = path8.join(spaceRoot, "agents", agentId);
+  const spaceRoot = path13.join(storageRoot, REGISTRY_DIRECTORY, "spaces", spaceId);
+  const agentRoot = path13.join(spaceRoot, "agents", agentId);
   return {
     workspaceKey: `${spaceId}:${agentId}`,
     spaceId,
     agentId,
-    privateVolume: path8.join(agentRoot, "workspace"),
-    sharedVolume: path8.join(spaceRoot, "shared"),
-    stateVolume: path8.join(agentRoot, "state"),
-    temporaryVolume: path8.join(agentRoot, "tmp")
+    privateVolume: path13.join(agentRoot, "workspace"),
+    sharedVolume: path13.join(spaceRoot, "shared"),
+    stateVolume: path13.join(agentRoot, "state"),
+    temporaryVolume: path13.join(agentRoot, "tmp")
   };
 };
 var parseRegistry = (raw) => {
@@ -2763,12 +4955,12 @@ var assertNoCollision = (workspaces, candidate) => {
   }
 };
 var ensurePrivateDirectory2 = async (directory) => {
-  await mkdir8(directory, { recursive: true, mode: 448 });
+  await mkdir11(directory, { recursive: true, mode: 448 });
   const info = await lstat4(directory);
   if (info.isSymbolicLink() || !info.isDirectory()) {
     throw corrupt2("Workspace registry path is not a real directory");
   }
-  await chmod3(directory, 448);
+  await chmod5(directory, 448);
 };
 var canonicalDirectory = async (directory, label) => {
   const info = await lstat4(directory);
@@ -2802,10 +4994,10 @@ var writeRegistryAtomically = async (registryPath, document) => {
     await handle.close();
   }
   try {
-    await rename3(temporaryPath, registryPath);
-    await chmod3(registryPath, 384);
+    await rename6(temporaryPath, registryPath);
+    await chmod5(registryPath, 384);
   } catch (error) {
-    await unlink5(temporaryPath).catch(() => void 0);
+    await unlink7(temporaryPath).catch(() => void 0);
     throw error;
   }
 };
@@ -2828,8 +5020,8 @@ var assertContained = (root, candidate) => {
   if (!isPathInside2(root, candidate)) throw corrupt2("Workspace path escapes the storage root");
 };
 var isPathInside2 = (parent, child) => {
-  const relative = path8.relative(parent, child);
-  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path8.sep}`) && !path8.isAbsolute(relative);
+  const relative = path13.relative(parent, child);
+  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path13.sep}`) && !path13.isAbsolute(relative);
 };
 var toDescriptor = (workspace) => ({
   workspaceKey: workspace.workspaceKey,
@@ -2859,7 +5051,7 @@ var corrupt2 = (message) => new WorkspaceRegistryError("REGISTRY_CORRUPT", messa
 var collision = (message) => new WorkspaceRegistryError("WORKSPACE_COLLISION", message);
 
 // src/onboard.ts
-async function runOnboard(launchConfig) {
+async function runOnboard(launchConfig, options = {}) {
   intro("Welcome to Buda Connector");
   const existing = await readDeviceConfig(launchConfig);
   let relayProtocol;
@@ -2905,10 +5097,12 @@ async function runOnboard(launchConfig) {
     await provisionWorkdirLayout(config2.workdirRoot);
     try {
       const registration = await registerConnector(config2, launchConfig, void 0, {
-        recoverMissingProfile: true
+        recoverMissingProfile: false
       });
       config2.connectorId = registration.connectorId;
+      config2.spaceId = registration.spaceId ?? config2.spaceId;
       relayProtocol = registration.relayProtocol;
+      if (!config2.spaceId) throw new Error("Registration did not resolve a Space");
       await writeDeviceConfig(config2);
     } catch (error) {
       s2.stop("Registration failed");
@@ -2952,23 +5146,33 @@ async function runOnboard(launchConfig) {
     launchConfig
   );
   s.stop("Daemon running");
-  await writeLog("info", `server ${config.serverUrl}`);
-  await writeLog("info", `config ${paths.configPath}`);
-  await writeLog("info", `workdir root ${config.workdirRoot}`);
-  await writeLog("info", `bunny daemon ${bunnyDaemon.baseUrl}`);
-  await writeLog("info", `log file ${paths.logPath}`);
   note(
     [
       `Server: ${config.serverUrl}`,
       `Bunny daemon: ${bunnyDaemon.baseUrl}`,
       `Relay: connected`,
-      `Logs: ${paths.logPath}`
+      `Logs: ${getDatedConnectorLogPath(paths.logPath)}`
     ].join("\n"),
     "Status"
   );
   outro("Buda Connector is running. Press Ctrl+C to stop.");
+  const dashboard = startConnectorConsoleDashboard({ plain: options.plain });
+  updateConnectorDashboardStatus({
+    agent: "Ready",
+    relay: "Connected",
+    server: config.serverUrl
+  });
+  await writeLog("info", `server ${config.serverUrl}`);
+  await writeLog("info", `config ${paths.configPath}`);
+  await writeLog("info", `workdir root ${config.workdirRoot}`);
+  await writeLog("info", `bunny daemon ${bunnyDaemon.baseUrl}`);
+  await writeLog("info", `log file ${getDatedConnectorLogPath(paths.logPath)}`);
   const interval = setInterval(() => {
-    heartbeatConnector(config, launchConfig, bunnyDaemon).catch((error) => {
+    heartbeatConnector(config, launchConfig, bunnyDaemon).then(() => {
+      updateConnectorDashboardStatus({
+        heartbeat: `OK ${(/* @__PURE__ */ new Date()).toLocaleTimeString("en-GB", { hour12: false })}`
+      });
+    }).catch((error) => {
       void writeLog(
         "warn",
         `heartbeat failed: ${error instanceof Error ? error.message : String(error)}`
@@ -2976,6 +5180,7 @@ async function runOnboard(launchConfig) {
     });
   }, HEARTBEAT_INTERVAL_MS);
   const shutdown = async () => {
+    dashboard?.stop();
     clearInterval(interval);
     relay.stop();
     await unregisterConnector(config, launchConfig);
@@ -2987,8 +5192,31 @@ async function runOnboard(launchConfig) {
 }
 
 // src/runtime.ts
-import { mkdir as mkdir9 } from "fs/promises";
-import path9 from "path";
+import { mkdir as mkdir12 } from "fs/promises";
+import path14 from "path";
+var RECOVERED_DAEMON_STOP_TIMEOUT_MS = 1e4;
+var RECOVERED_DAEMON_STOP_POLL_MS = 100;
+var wait3 = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
+async function stopRecoveredIdleDaemon(config, configRoot) {
+  const stopStatus = await requestDaemonControl(config, "stop-if-idle", configRoot).catch(
+    () => null
+  );
+  if (!stopStatus) return;
+  if (!stopStatus.idle) {
+    throw new Error(
+      `The recovered Connector ${config.connectorId} is still running an Agent task and cannot be replaced yet.`
+    );
+  }
+  const deadline = Date.now() + RECOVERED_DAEMON_STOP_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    const status = await requestDaemonControl(config, "status", configRoot, {
+      timeoutMs: 500
+    }).catch(() => null);
+    if (!status) return;
+    await wait3(RECOVERED_DAEMON_STOP_POLL_MS);
+  }
+  throw new Error(`Recovered Connector ${config.connectorId} did not stop cleanly.`);
+}
 async function runNewConnector(launchConfig) {
   const existing = await readDeviceConfig(launchConfig);
   const config = await ensureDeviceConfig(launchConfig);
@@ -2997,27 +5225,41 @@ async function runNewConnector(launchConfig) {
   await provisionWorkdirLayout(config.workdirRoot);
   await LocalWorkspaceRegistry.open(config.workdirRoot);
   const registration = await registerConnector(config, launchConfig, void 0, {
-    recoverMissingProfile: !existing
+    recoverMissingProfile: shouldRecoverMissingProfile(Boolean(existing), launchConfig)
   });
   config.connectorId = registration.connectorId;
+  config.spaceId = registration.spaceId ?? config.spaceId;
   await writeDeviceConfig(config);
   await writeLog("info", `wrote ${paths.configPath}`);
   await writeLog("info", `workdir root ${config.workdirRoot}`);
-  await writeLog("info", `log file ${paths.logPath}`);
+  await writeLog("info", `log file ${getDatedConnectorLogPath(paths.logPath)}`);
 }
-async function runConnectorDaemon(launchConfig) {
-  const existing = await readDeviceConfig(launchConfig);
-  const config = await ensureDeviceConfig(launchConfig);
-  const paths = getConnectorPaths(config.serverUrl);
-  const daemonLockTarget = getConnectorDaemonLockTarget(config.serverUrl, config.connectorId);
-  await mkdir9(path9.dirname(daemonLockTarget), { recursive: true, mode: 448 });
+async function runConnectorDaemon(launchConfig, options = {}) {
+  const configRoot = options.configRoot ?? process.env.BUDA_CONNECTOR_CONFIG_ROOT;
+  const existing = await readDeviceConfig(launchConfig, configRoot);
+  const config = await ensureDeviceConfig(launchConfig, configRoot);
+  setConnectorLogContext({
+    configRoot,
+    connectorId: config.connectorId,
+    serverUrl: config.serverUrl
+  });
+  const paths = getConnectorPaths(config.serverUrl, configRoot);
+  const daemonLockTarget = getConnectorDaemonLockTarget(
+    config.serverUrl,
+    config.connectorId,
+    configRoot
+  );
+  await mkdir12(path14.dirname(daemonLockTarget), { recursive: true, mode: 448 });
   let daemonLock = await acquireExclusiveFileLock(daemonLockTarget, { timeoutMs: 0 }).catch(() => {
     throw new Error(
       `Another Buda Connector daemon is already running for this profile on ${config.serverUrl}. Stop it before starting another instance.`
     );
   });
+  const restoreConsole = options.captureConsole ? installConnectorConsoleCapture() : void 0;
   let bunnyDaemon;
   let relayProtocol;
+  let control;
+  let lastHeartbeatAt;
   try {
     await migrateLegacyWorkspaceRoot(config.workdirRoot);
     await provisionWorkdirLayout(config.workdirRoot);
@@ -3025,15 +5267,22 @@ async function runConnectorDaemon(launchConfig) {
     bunnyDaemon = await startEmbeddedBunnyDaemon(config, launchConfig);
     const activeBunnyDaemon = bunnyDaemon;
     const registration = await registerConnector(config, launchConfig, activeBunnyDaemon, {
-      recoverMissingProfile: !existing
+      recoverMissingProfile: shouldRecoverMissingProfile(Boolean(existing), launchConfig)
     });
     const connectorIdChanged = config.connectorId !== registration.connectorId;
     if (connectorIdChanged) {
+      const registeredConfig = {
+        ...config,
+        connectorId: registration.connectorId,
+        spaceId: registration.spaceId ?? config.spaceId
+      };
+      await stopRecoveredIdleDaemon(registeredConfig, configRoot);
       const registeredLockTarget = getConnectorDaemonLockTarget(
         config.serverUrl,
-        registration.connectorId
+        registration.connectorId,
+        configRoot
       );
-      await mkdir9(path9.dirname(registeredLockTarget), { recursive: true, mode: 448 });
+      await mkdir12(path14.dirname(registeredLockTarget), { recursive: true, mode: 448 });
       const registeredLock = await acquireExclusiveFileLock(registeredLockTarget, {
         timeoutMs: 0
       }).catch(() => {
@@ -3045,8 +5294,15 @@ async function runConnectorDaemon(launchConfig) {
       daemonLock = registeredLock;
     }
     config.connectorId = registration.connectorId;
+    setConnectorLogContext({ connectorId: config.connectorId });
+    config.spaceId = registration.spaceId ?? config.spaceId;
     relayProtocol = registration.relayProtocol;
-    if (!existing || connectorIdChanged) await writeDeviceConfig(config);
+    if (!config.spaceId) {
+      throw new Error("Connector registration did not return a canonical spaceId");
+    }
+    if (!existing || connectorIdChanged || existing.spaceId !== config.spaceId) {
+      await writeDeviceConfig(config, configRoot);
+    }
     const relay = startConnectorRelay(
       config,
       activeBunnyDaemon,
@@ -3057,12 +5313,16 @@ async function runConnectorDaemon(launchConfig) {
     await writeLog("info", `server ${config.serverUrl}`);
     await writeLog("info", `config ${paths.configPath}`);
     await writeLog("info", `workdir root ${config.workdirRoot}`);
-    await writeLog("info", `log file ${paths.logPath}`);
+    await writeLog("info", `log file ${getDatedConnectorLogPath(paths.logPath)}`);
     await writeLog("info", `bunny daemon ${activeBunnyDaemon.baseUrl}`);
     const interval = setInterval(() => {
       heartbeatConnector(config, launchConfig, activeBunnyDaemon).then(({ relayProtocol: nextRelayProtocol }) => {
+        lastHeartbeatAt = (/* @__PURE__ */ new Date()).toISOString();
         relay.updateRelayProtocol(nextRelayProtocol);
         relay.resumeAfterAccessRestore();
+        updateConnectorDashboardStatus({
+          heartbeat: `OK ${(/* @__PURE__ */ new Date()).toLocaleTimeString("en-GB", { hour12: false })}`
+        });
       }).catch((error) => {
         void writeLog(
           "warn",
@@ -3081,23 +5341,37 @@ async function runConnectorDaemon(launchConfig) {
         await unregisterConnector(config, launchConfig);
         await stopEmbeddedBunnyDaemon(activeBunnyDaemon);
       } finally {
+        await control?.close();
         await daemonLock.release();
-        process.exit(0);
+        await restoreConsole?.();
+        if (options.exitOnShutdown !== false) process.exit(0);
       }
     };
+    control = await startDaemonControlServer({
+      config,
+      configRoot,
+      getLastHeartbeatAt: () => lastHeartbeatAt,
+      isIdle: () => relay.isIdle(),
+      isRelayConnected: () => relay.isConnected(),
+      mode: options.mode ?? "persistent",
+      onStop: shutdown,
+      version: options.version
+    });
     process.once("SIGINT", () => void shutdown());
     process.once("SIGTERM", () => void shutdown());
   } catch (error) {
     if (bunnyDaemon) await stopEmbeddedBunnyDaemon(bunnyDaemon);
     await daemonLock.release();
+    await restoreConsole?.();
     throw error;
   }
 }
+var shouldRecoverMissingProfile = (hasExistingProfile, launchConfig) => !hasExistingProfile && Boolean(getConnectorToken(launchConfig)) && !launchConfig?.oauthToken?.trim();
 
 // src/cli.ts
 function printHelp() {
   console.log(
-    "Help: buda-connector [onboard | new | dev | daemon] [--token <token>] [--server-url <url>] [--workdir <path>] [--launch-config-stdin]\n       pnpm --filter @buda-ai/connector dev\n\nCommands (default: onboard in TTY, daemon otherwise):\n  onboard  Interactive first-time setup + start daemon\n  new      Create/register a new connector identity\n  dev      Run the connector daemon in development\n  daemon   Run the connector daemon for sidecar/service usage"
+    "Help: buda-connector [onboard | new | dev | daemon] [--token <token>] [--server-url <url>] [--workdir <path>] [--plain] [--launch-config-stdin]\n       pnpm --filter @buda-ai/connector dev\n\nCommands (default: onboard in TTY, daemon otherwise):\n  onboard  Interactive first-time setup + start daemon\n  new      Create/register a new connector identity\n  dev      Run the connector daemon in development\n  daemon   Run the connector daemon for sidecar/service usage\n\nOptions:\n  --plain  Disable the interactive dashboard and print ordinary logs"
   );
 }
 function readFlagValue(name) {
@@ -3110,6 +5384,7 @@ function readCliLaunchConfig() {
   const bunnyDaemonPort = readFlagValue("--bunny-daemon-port");
   return {
     serverUrl: readFlagValue("--server-url"),
+    spaceId: readFlagValue("--space-id"),
     workdirRoot: readFlagValue("--workdir"),
     oauthToken: readFlagValue("--oauth-token"),
     token: readFlagValue("--token"),
@@ -3157,25 +5432,49 @@ async function main() {
   const isTTY = process.stdin.isTTY && process.stdout.isTTY;
   const defaultCommand = isTTY ? "onboard" : "daemon";
   const command = !rawCommand || rawCommand.startsWith("-") ? defaultCommand : rawCommand;
+  const configRoot = readFlagValue("--config-root");
+  if (configRoot) process.env.BUDA_CONNECTOR_CONFIG_ROOT = configRoot;
   process.on("unhandledRejection", (reason) => {
     console.error("[buda-connector] unhandledRejection:", reason);
   });
   process.on("uncaughtException", (error) => {
     console.error("[buda-connector] uncaughtException:", error);
   });
-  const launchConfig = await readLaunchConfig();
+  const launchConfig = process.argv.includes("--internal-daemon") ? getInternalLaunchConfig() : await readLaunchConfig();
+  const plain = process.argv.includes("--plain");
   if (command === "new") {
     await runNewConnector(launchConfig);
     return;
   }
   if (command === "onboard") {
-    await runOnboard(launchConfig);
+    await runOnboard(launchConfig, { plain });
     return;
   }
-  if (command === "dev" || command === "daemon") {
+  if (command === "dev" || process.argv.includes("--foreground")) {
+    startConnectorConsoleDashboard({ plain });
     await runConnectorDaemon(launchConfig);
     return;
   }
+  if (command === "daemon" && process.argv.includes("--internal-daemon")) {
+    await runConnectorDaemon(launchConfig, {
+      captureConsole: true,
+      mode: getDaemonModeFlag(),
+      version: CONNECTOR_RUNTIME_VERSION
+    });
+    return;
+  }
+  if (command === "daemon" && process.argv.includes("--desktop-release")) {
+    await releaseDesktopConnector(launchConfig);
+    return;
+  }
+  if (command === "daemon" && process.argv.includes("--desktop")) {
+    await runDesktopConnectorController(launchConfig);
+    return;
+  }
+  if (command === "daemon") {
+    await runConnectorDashboard(launchConfig, { plain });
+    return;
+  }
   printHelp();
   process.exit(1);
 }