@buda-ai/connector 0.1.7 → 0.1.8

package/dist/cli.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import "./chunk-MCKGQKYU.js";
 
 // src/config.ts
-import { createHash as createHash2, randomBytes, randomUUID } from "crypto";
+import { createHash as createHash2, randomBytes, randomUUID as randomUUID2 } from "crypto";
 import { chmod, mkdir, readFile as readFile2, rename, unlink as unlink2, writeFile } from "fs/promises";
 import { homedir, hostname, platform as platform2 } from "os";
 import path from "path";
 
 // src/exclusive-file-lock.ts
+import { randomUUID } from "crypto";
 import { open, readFile, stat, unlink } from "fs/promises";
 var DEFAULT_TIMEOUT_MS = 1e4;
 var DEFAULT_STALE_MS = 12e4;
@@ -34,8 +34,11 @@ async function acquireExclusiveFileLock(targetPath, options = {}) {
       await wait(pollMs);
       continue;
     }
-    await handle.writeFile(`${JSON.stringify({ pid: process.pid, createdAt: Date.now() })}
-`);
+    const ownerToken = randomUUID();
+    await handle.writeFile(
+      `${JSON.stringify({ pid: process.pid, ownerToken, createdAt: Date.now() })}
+`
+    );
     await handle.sync();
     let released = false;
     return {
@@ -43,7 +46,8 @@ async function acquireExclusiveFileLock(targetPath, options = {}) {
         if (released) return;
         released = true;
         await handle.close();
-        await unlink(lockPath).catch(() => void 0);
+        const currentOwner = await readFile(lockPath, "utf8").then((raw) => JSON.parse(raw).ownerToken).catch(() => void 0);
+        if (currentOwner === ownerToken) await unlink(lockPath).catch(() => void 0);
       }
     };
   }
@@ -155,6 +159,17 @@ function getConnectorProfileKey(serverUrl, token) {
   const discriminator = token?.trim() ? getConnectorTokenFingerprint(token) : "legacy-no-token";
   return `${getServerOriginKey(serverUrl)}--${discriminator}`;
 }
+function getConnectorIdentityKey(deviceId, serverUrl, spaceId) {
+  const normalizedSpaceId = spaceId.trim();
+  if (!deviceId.trim() || !normalizedSpaceId) {
+    throw new Error("Connector identity requires deviceId and spaceId");
+  }
+  const digest = createHash2("sha256").update(`${deviceId.trim()}
+${normalizeServerOrigin(serverUrl)}
+${normalizedSpaceId}`, "utf8").digest("hex").slice(0, 24);
+  const spaceKey = normalizedSpaceId.replace(/[^a-z0-9_-]+/gi, "-").toLowerCase();
+  return `${getServerOriginKey(serverUrl)}--${spaceKey}--${digest}`;
+}
 function getConnectorPaths(serverUrl, configRoot = path.join(homedir(), ".buda")) {
   const scopedLegacyDir = path.join(configRoot, "servers", getServerOriginKey(serverUrl));
   return {
@@ -176,6 +191,17 @@ function getConnectorDaemonLockTarget(serverUrl, connectorId, configRoot = path.
     "connector-daemon"
   );
 }
+function getConnectorBootstrapLockTarget(launchConfig, configRoot = path.join(homedir(), ".buda")) {
+  const serverUrl = getServerUrl(launchConfig);
+  const scope = launchConfig?.spaceId?.trim() ? `space-${launchConfig.spaceId.trim()}` : getConnectorToken(launchConfig) ? `token-${getConnectorTokenFingerprint(getConnectorToken(launchConfig)).slice(0, 24)}` : "oauth-unresolved";
+  return path.join(
+    configRoot,
+    "daemons",
+    getServerOriginKey(serverUrl),
+    scope.replace(/[^a-z0-9_-]+/gi, "-").toLowerCase(),
+    "bootstrap"
+  );
+}
 function getServerUrl(launchConfig) {
   return (launchConfig?.serverUrl || process.env.BUDA_CONNECTOR_SERVER_URL || process.env.BUDA_SERVER_URL || process.env.NEXT_PUBLIC_APP_URL || DEFAULT_SERVER_URL).replace(/\/$/, "");
 }
@@ -208,15 +234,16 @@ function getBunnyDaemonPort(launchConfig) {
 function getConnectorToken(launchConfig) {
   return launchConfig?.token?.trim() || process.env.BUDA_CONNECTOR_TOKEN?.trim() || void 0;
 }
-function buildDeviceConfig(launchConfig, deviceId = `dvc_${randomUUID()}`) {
+function buildDeviceConfig(launchConfig, deviceId = `dvc_${randomUUID2()}`) {
   const host = hostname();
   const token = getConnectorToken(launchConfig);
   return {
-    connectorId: `cnr_${randomUUID()}`,
+    connectorId: `cnr_${randomUUID2()}`,
     deviceId,
     deviceName: host,
     hostLabel: `${host} (${platform2()})`,
     serverUrl: getServerUrl(launchConfig),
+    ...launchConfig?.spaceId?.trim() ? { spaceId: launchConfig.spaceId.trim() } : {},
     workdirRoot: getWorkdirRoot(launchConfig),
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     deviceToken: randomBytes(32).toString("base64url"),
@@ -228,12 +255,18 @@ function isDeviceConfig(value) {
   const config = value;
   return typeof config.connectorId === "string" && typeof config.deviceId === "string" && typeof config.serverUrl === "string";
 }
+function isCanonicalDeviceConfig(value) {
+  return isDeviceConfig(value) && typeof value.spaceId === "string" && value.spaceId.trim().length > 0;
+}
 async function readJsonFile(configPath) {
   try {
     const raw = await readFile2(configPath, "utf8");
     return JSON.parse(raw);
-  } catch {
-    return null;
+  } catch (error) {
+    if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") {
+      return null;
+    }
+    throw new Error(`Invalid Connector config ${configPath}`, { cause: error });
   }
 }
 function migrateLegacyProfiles(values) {
@@ -250,36 +283,68 @@ function migrateLegacyProfiles(values) {
 async function loadDeviceConfigStore(configPath) {
   const parsed = await readJsonFile(configPath);
   const candidate = parsed;
+  if (candidate?.version === 4 && candidate.identities && typeof candidate.identities === "object" && candidate.aliases && typeof candidate.aliases === "object") {
+    const identities = candidate.identities;
+    for (const [identityKey, value] of Object.entries(identities)) {
+      if (!isCanonicalDeviceConfig(value)) {
+        throw new Error(`Invalid canonical Connector identity ${identityKey}`);
+      }
+      const expected = getConnectorIdentityKey(value.deviceId, value.serverUrl, value.spaceId);
+      if (identityKey !== expected) {
+        throw new Error(`Connector identity key does not match ${value.deviceId}/${value.spaceId}`);
+      }
+    }
+    return {
+      store: {
+        version: 4,
+        ...typeof candidate.systemDeviceId === "string" ? { systemDeviceId: candidate.systemDeviceId } : {},
+        identities,
+        aliases: candidate.aliases
+      },
+      legacyProfiles: {},
+      needsWrite: false
+    };
+  }
   if (candidate?.version === 3 && candidate.profiles && typeof candidate.profiles === "object") {
     return {
       store: {
-        version: 3,
+        version: 4,
         ...typeof candidate.systemDeviceId === "string" ? { systemDeviceId: candidate.systemDeviceId } : {},
-        profiles: candidate.profiles
+        identities: {},
+        aliases: {}
       },
+      legacyProfiles: candidate.profiles,
       needsWrite: false
     };
   }
   if (candidate && (candidate.version === 1 || candidate.version === 2) && candidate.servers && typeof candidate.servers === "object") {
     return {
       store: {
-        version: 3,
+        version: 4,
         ...typeof candidate.systemDeviceId === "string" ? { systemDeviceId: candidate.systemDeviceId } : {},
-        profiles: migrateLegacyProfiles(Object.values(candidate.servers))
+        identities: {},
+        aliases: {}
       },
-      needsWrite: true
+      legacyProfiles: migrateLegacyProfiles(Object.values(candidate.servers)),
+      needsWrite: false
     };
   }
   if (isDeviceConfig(parsed)) {
     return {
       store: {
-        version: 3,
-        profiles: migrateLegacyProfiles([parsed])
+        version: 4,
+        identities: {},
+        aliases: {}
       },
-      needsWrite: true
+      legacyProfiles: migrateLegacyProfiles([parsed]),
+      needsWrite: false
     };
   }
-  return { store: { version: 3, profiles: {} }, needsWrite: false };
+  return {
+    store: { version: 4, identities: {}, aliases: {} },
+    legacyProfiles: {},
+    needsWrite: false
+  };
 }
 function normalizeStoredWorkdirRoot(config, paths) {
   const configuredRoot = config.workdirRoot?.trim();
@@ -297,7 +362,7 @@ function normalizeStoredWorkdirRoot(config, paths) {
 }
 async function writeDeviceConfigStore(configPath, store) {
   await mkdir(path.dirname(configPath), { recursive: true });
-  const temporaryPath = `${configPath}.${process.pid}.${randomUUID()}.tmp`;
+  const temporaryPath = `${configPath}.${process.pid}.${randomUUID2()}.tmp`;
   try {
     await writeFile(temporaryPath, `${JSON.stringify(store, null, 2)}
 `, { mode: 384 });
@@ -307,36 +372,70 @@ async function writeDeviceConfigStore(configPath, store) {
     await unlink2(temporaryPath).catch(() => void 0);
   }
 }
+function findStoredDeviceConfig(store, legacyProfiles, launchConfig, serverUrl, paths) {
+  const aliases = [
+    ...launchConfig?.spaceId?.trim() ? [`${getServerOriginKey(serverUrl)}--space--${launchConfig.spaceId.trim()}`] : [],
+    ...getConnectorToken(launchConfig) ? [getConnectorProfileKey(serverUrl, getConnectorToken(launchConfig))] : []
+  ];
+  const identityKey = aliases.map((alias) => store.aliases[alias]).find(Boolean);
+  let storedConfig = identityKey ? store.identities[identityKey] : void 0;
+  if (!storedConfig && getConnectorToken(launchConfig)) {
+    const legacyKey = getConnectorProfileKey(serverUrl, getConnectorToken(launchConfig));
+    storedConfig = legacyProfiles[legacyKey];
+  }
+  if (!isDeviceConfig(storedConfig)) return null;
+  return normalizeStoredWorkdirRoot(storedConfig, paths).config;
+}
+function putCanonicalDeviceConfig(store, config) {
+  if (!config.spaceId?.trim()) {
+    throw new Error("Cannot persist Connector identity before the server resolves spaceId");
+  }
+  const spaceId = config.spaceId.trim();
+  const identityKey = getConnectorIdentityKey(config.deviceId, config.serverUrl, spaceId);
+  store.identities[identityKey] = { ...config, spaceId };
+  store.aliases[`${getServerOriginKey(config.serverUrl)}--space--${spaceId}`] = identityKey;
+  if (config.token?.trim()) {
+    store.aliases[getConnectorProfileKey(config.serverUrl, config.token)] = identityKey;
+  }
+}
 async function readDeviceConfig(launchConfig, configRoot) {
   const serverUrl = getServerUrl(launchConfig);
   const paths = getConnectorPaths(serverUrl, configRoot);
-  const launchToken = getConnectorToken(launchConfig);
   await mkdir(paths.configDir, { recursive: true });
   return withExclusiveFileLock(paths.configPath, async () => {
-    const { store, needsWrite } = await loadDeviceConfigStore(paths.configPath);
-    const profileKey = getConnectorProfileKey(serverUrl, launchToken);
-    const storedConfig = store.profiles[profileKey];
-    let config = isDeviceConfig(storedConfig) ? storedConfig : null;
-    let normalizedWorkdirRoot = false;
-    if (config) {
-      const normalized = normalizeStoredWorkdirRoot(config, paths);
-      config = normalized.config;
-      normalizedWorkdirRoot = normalized.changed;
-      store.profiles[getConnectorProfileKey(config.serverUrl, config.token)] = config;
-    }
-    if (needsWrite || normalizedWorkdirRoot) {
-      await writeDeviceConfigStore(paths.configPath, store);
+    const { store, legacyProfiles } = await loadDeviceConfigStore(paths.configPath);
+    return findStoredDeviceConfig(store, legacyProfiles, launchConfig, serverUrl, paths);
+  });
+}
+async function listDeviceConfigs(configRoot) {
+  const paths = getConnectorPaths(DEFAULT_SERVER_URL, configRoot);
+  await mkdir(paths.configDir, { recursive: true });
+  return withExclusiveFileLock(paths.configPath, async () => {
+    const { legacyProfiles, store } = await loadDeviceConfigStore(paths.configPath);
+    const identities = [...Object.values(store.identities), ...Object.values(legacyProfiles)].filter(isCanonicalDeviceConfig).map(
+      (config) => normalizeStoredWorkdirRoot(config, getConnectorPaths(config.serverUrl, configRoot)).config
+    );
+    const unique = /* @__PURE__ */ new Map();
+    for (const config of identities) {
+      unique.set(`${normalizeServerOrigin(config.serverUrl)}
+${config.connectorId}`, config);
     }
-    return config;
+    return [...unique.values()].sort(
+      (left, right) => left.createdAt.localeCompare(right.createdAt) || left.connectorId.localeCompare(right.connectorId)
+    );
   });
 }
 async function writeDeviceConfig(config, configRoot) {
+  if (!config.spaceId?.trim()) {
+    throw new Error("Cannot persist Connector identity before the server resolves spaceId");
+  }
+  const spaceId = config.spaceId.trim();
   const paths = getConnectorPaths(config.serverUrl, configRoot);
   await mkdir(config.workdirRoot, { recursive: true });
   await mkdir(paths.configDir, { recursive: true });
   await withExclusiveFileLock(paths.configPath, async () => {
     const { store } = await loadDeviceConfigStore(paths.configPath);
-    store.profiles[getConnectorProfileKey(config.serverUrl, config.token)] = config;
+    putCanonicalDeviceConfig(store, { ...config, spaceId });
     await writeDeviceConfigStore(paths.configPath, store);
   });
 }
@@ -344,13 +443,12 @@ async function getOrCreateSystemDeviceId(configRoot, resolver = resolveSystemDev
   const paths = getConnectorPaths(DEFAULT_SERVER_URL, configRoot);
   await mkdir(paths.configDir, { recursive: true });
   return withExclusiveFileLock(paths.configPath, async () => {
-    const { store, needsWrite } = await loadDeviceConfigStore(paths.configPath);
+    const { store, legacyProfiles } = await loadDeviceConfigStore(paths.configPath);
     if (store.systemDeviceId) {
-      if (needsWrite) await writeDeviceConfigStore(paths.configPath, store);
       return store.systemDeviceId;
     }
-    const existingDeviceId = Object.values(store.profiles).find(isDeviceConfig)?.deviceId;
-    store.systemDeviceId = resolver() || existingDeviceId || `dvc_${randomUUID()}`;
+    const existingDeviceId = Object.values(store.identities).find(isDeviceConfig)?.deviceId ?? Object.values(legacyProfiles).find(isDeviceConfig)?.deviceId;
+    store.systemDeviceId = resolver() || existingDeviceId || `dvc_${randomUUID2()}`;
     await writeDeviceConfigStore(paths.configPath, store);
     return store.systemDeviceId;
   });
@@ -362,33 +460,28 @@ async function createDeviceConfig(launchConfig, configRoot, resolver) {
 async function ensureDeviceConfig(launchConfig, configRoot, resolver = resolveSystemDeviceId) {
   const serverUrl = getServerUrl(launchConfig);
   const paths = getConnectorPaths(serverUrl, configRoot);
-  const token = getConnectorToken(launchConfig);
-  const profileKey = getConnectorProfileKey(serverUrl, token);
   await mkdir(paths.configDir, { recursive: true });
   const config = await withExclusiveFileLock(paths.configPath, async () => {
-    const { store, needsWrite } = await loadDeviceConfigStore(paths.configPath);
-    const storedConfig = store.profiles[profileKey];
-    if (isDeviceConfig(storedConfig)) {
-      const normalized = normalizeStoredWorkdirRoot(storedConfig, paths);
-      if (needsWrite || normalized.changed) {
-        store.profiles[profileKey] = normalized.config;
-        await writeDeviceConfigStore(paths.configPath, store);
-      }
-      const existing = normalized.config;
-      const overrideToken = getConnectorToken(launchConfig);
-      return {
+    const { store, legacyProfiles } = await loadDeviceConfigStore(paths.configPath);
+    const existing = findStoredDeviceConfig(store, legacyProfiles, launchConfig, serverUrl, paths);
+    if (existing) {
+      const resolved = {
         ...existing,
         serverUrl,
         workdirRoot: launchConfig?.workdirRoot || process.env.BUDA_CONNECTOR_WORKDIR || existing.workdirRoot || getWorkdirRoot(launchConfig),
-        ...overrideToken ? { token: overrideToken } : {}
+        ...getConnectorToken(launchConfig) ? { token: getConnectorToken(launchConfig) } : {}
       };
+      if (isCanonicalDeviceConfig(resolved)) {
+        putCanonicalDeviceConfig(store, resolved);
+        await writeDeviceConfigStore(paths.configPath, store);
+      }
+      return resolved;
     }
-    if (!store.systemDeviceId) {
-      const existingDeviceId = Object.values(store.profiles).find(isDeviceConfig)?.deviceId;
-      store.systemDeviceId = resolver() || existingDeviceId || `dvc_${randomUUID()}`;
-    }
-    const created = buildDeviceConfig(launchConfig, store.systemDeviceId);
-    store.profiles[profileKey] = created;
+    const existingDeviceId = store.systemDeviceId ?? Object.values(store.identities).find(isDeviceConfig)?.deviceId ?? Object.values(legacyProfiles).find(isDeviceConfig)?.deviceId;
+    const deviceId = existingDeviceId || resolver() || `dvc_${randomUUID2()}`;
+    const created = buildDeviceConfig(launchConfig, deviceId);
+    store.systemDeviceId = deviceId;
+    if (isCanonicalDeviceConfig(created)) putCanonicalDeviceConfig(store, created);
     await writeDeviceConfigStore(paths.configPath, store);
     return created;
   });
@@ -401,6 +494,7 @@ function parseLaunchConfig(raw) {
   const bunnyDaemonPort = typeof parsed.bunnyDaemonPort === "number" && Number.isInteger(parsed.bunnyDaemonPort) ? parsed.bunnyDaemonPort : void 0;
   return {
     serverUrl: typeof parsed.serverUrl === "string" ? parsed.serverUrl : void 0,
+    spaceId: typeof parsed.spaceId === "string" ? parsed.spaceId : void 0,
     workdirRoot: typeof parsed.workdirRoot === "string" ? parsed.workdirRoot : void 0,
     oauthToken: typeof parsed.oauthToken === "string" ? parsed.oauthToken : void 0,
     token: typeof parsed.token === "string" ? parsed.token : void 0,
@@ -413,9 +507,327 @@ function parseLaunchConfig(raw) {
 import { closeSync, openSync } from "fs";
 import { ReadStream, WriteStream } from "tty";
 import { format, stripVTControlCharacters } from "util";
+
+// src/daemon-control.ts
+import { randomBytes as randomBytes2, randomUUID as randomUUID3 } from "crypto";
+import { chmod as chmod2, mkdir as mkdir2, readdir, readFile as readFile3, rename as rename2, unlink as unlink3, writeFile as writeFile2 } from "fs/promises";
+import { createConnection, createServer } from "net";
+import path2 from "path";
+
+// package.json
+var package_default = {
+  name: "@buda-ai/connector",
+  version: "0.1.8",
+  private: false,
+  type: "module",
+  publishConfig: {
+    access: "public"
+  },
+  files: [
+    "dist",
+    "agent-templates"
+  ],
+  bin: {
+    "buda-connector": "./dist/cli.js",
+    connector: "./dist/cli.js"
+  },
+  scripts: {
+    dev: "tsx src/cli.ts dev",
+    daemon: "tsx src/cli.ts daemon",
+    new: "tsx src/cli.ts new",
+    start: "node dist/cli.js daemon",
+    build: "tsup",
+    test: "vitest run",
+    typecheck: "tsc --noEmit",
+    lint: "biome format . --write && biome check .",
+    "lint:err": "biome format . --write && biome check . --write --diagnostic-level=error"
+  },
+  dependencies: {
+    "@bunny-agent/daemon": "0.9.51",
+    "@clack/prompts": "^1.0.0",
+    "playwright-core": "^1.52.0",
+    ws: "^8.21.0"
+  },
+  optionalDependencies: {
+    "node-pty": "^1.1.0"
+  },
+  devDependencies: {
+    "@types/node": "^24.13.2",
+    "@types/ws": "^8.18.1",
+    relaylib: "workspace:*",
+    tsup: "^8.5.0",
+    tsx: "^4.20.5",
+    typescript: "^5.9.3",
+    vitest: "^2.1.8"
+  },
+  engines: {
+    node: ">=24.18.0"
+  }
+};
+
+// src/daemon-control.ts
+var CONNECTOR_CONTROL_PROTOCOL_VERSION = 1;
+var CONNECTOR_RUNTIME_VERSION = package_default.version;
+var DEFAULT_CONTROL_REQUEST_TIMEOUT_MS = 3e3;
+var getDaemonControlMetadataPath = (config, configRoot) => `${getConnectorDaemonLockTarget(config.serverUrl, config.connectorId, configRoot)}.control.json`;
+var writeMetadata = async (metadataPath, metadata) => {
+  await mkdir2(path2.dirname(metadataPath), { recursive: true, mode: 448 });
+  const temporaryPath = `${metadataPath}.${process.pid}.${randomUUID3()}.tmp`;
+  try {
+    await writeFile2(temporaryPath, `${JSON.stringify(metadata)}
+`, { mode: 384 });
+    await rename2(temporaryPath, metadataPath);
+    await chmod2(metadataPath, 384);
+  } finally {
+    await unlink3(temporaryPath).catch(() => void 0);
+  }
+};
+var publicStatus = (metadata) => ({
+  connectorId: metadata.connectorId,
+  idle: metadata.idle,
+  instanceId: metadata.instanceId,
+  ...metadata.lastHeartbeatAt ? { lastHeartbeatAt: metadata.lastHeartbeatAt } : {},
+  mode: metadata.mode,
+  pid: metadata.pid,
+  protocolVersion: metadata.protocolVersion,
+  relayConnected: metadata.relayConnected,
+  serverUrl: metadata.serverUrl,
+  ...metadata.spaceId ? { spaceId: metadata.spaceId } : {},
+  startedAt: metadata.startedAt,
+  version: metadata.version
+});
+var parseRequest = (raw) => {
+  try {
+    const value = JSON.parse(raw);
+    if (typeof value.secret !== "string" || !["hold", "persist", "release", "status", "stop", "stop-if-idle"].includes(
+      value.command ?? ""
+    )) {
+      return null;
+    }
+    return value;
+  } catch {
+    return null;
+  }
+};
+async function startDaemonControlServer(options) {
+  const metadataPath = getDaemonControlMetadataPath(options.config, options.configRoot);
+  let stopping = false;
+  let desktopHolds = 0;
+  let metadata;
+  let startupGrace;
+  const sockets = /* @__PURE__ */ new Set();
+  const requestStop = () => {
+    if (stopping) return;
+    stopping = true;
+    void Promise.resolve(options.onStop());
+  };
+  const server = createServer((socket) => {
+    sockets.add(socket);
+    socket.setEncoding("utf8");
+    let buffer = "";
+    let holding = false;
+    socket.on("data", (chunk) => {
+      buffer += chunk;
+      const newline = buffer.indexOf("\n");
+      if (newline < 0) return;
+      const request = parseRequest(buffer.slice(0, newline));
+      buffer = buffer.slice(newline + 1);
+      if (!request || request.secret !== metadata.secret) {
+        socket.end(
+          `${JSON.stringify({ ok: false, error: "unauthorized" })}
+`
+        );
+        return;
+      }
+      metadata.idle = options.isIdle?.() ?? metadata.idle;
+      metadata.lastHeartbeatAt = options.getLastHeartbeatAt?.() ?? metadata.lastHeartbeatAt;
+      metadata.relayConnected = options.isRelayConnected?.() ?? metadata.relayConnected;
+      if (request.command === "persist") {
+        if (startupGrace) clearTimeout(startupGrace);
+        metadata.mode = "persistent";
+        void writeMetadata(metadataPath, metadata);
+      } else if (request.command === "hold") {
+        if (startupGrace) clearTimeout(startupGrace);
+        holding = true;
+        desktopHolds += 1;
+      } else if (request.command === "release") {
+        if (metadata.mode === "transient" && desktopHolds === 0) requestStop();
+      } else if (request.command === "stop") {
+        requestStop();
+      } else if (request.command === "stop-if-idle" && metadata.idle) {
+        requestStop();
+      }
+      socket.write(
+        `${JSON.stringify({ ok: true, status: publicStatus(metadata) })}
+`
+      );
+      if (request.command !== "hold") socket.end();
+    });
+    socket.on("close", () => {
+      sockets.delete(socket);
+      if (!holding) return;
+      desktopHolds = Math.max(0, desktopHolds - 1);
+      if (metadata.mode === "transient" && desktopHolds === 0) requestStop();
+    });
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+  const address = server.address();
+  if (!address || typeof address === "string")
+    throw new Error("Failed to bind daemon control port");
+  metadata = {
+    connectorId: options.config.connectorId,
+    idle: options.isIdle?.() ?? true,
+    instanceId: randomUUID3(),
+    mode: options.mode,
+    pid: process.pid,
+    port: address.port,
+    protocolVersion: CONNECTOR_CONTROL_PROTOCOL_VERSION,
+    relayConnected: options.isRelayConnected?.() ?? false,
+    secret: randomBytes2(32).toString("base64url"),
+    serverUrl: options.config.serverUrl,
+    ...options.config.spaceId ? { spaceId: options.config.spaceId } : {},
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    version: options.version ?? CONNECTOR_RUNTIME_VERSION
+  };
+  await writeMetadata(metadataPath, metadata);
+  if (metadata.mode === "transient") {
+    startupGrace = setTimeout(requestStop, options.transientGraceMs ?? 3e4);
+  }
+  return {
+    close: async () => {
+      if (startupGrace) clearTimeout(startupGrace);
+      for (const socket of sockets) socket.destroy();
+      await new Promise((resolve) => server.close(() => resolve()));
+      const activeInstanceId = await readFile3(metadataPath, "utf8").then((raw) => JSON.parse(raw).instanceId).catch(() => void 0);
+      if (activeInstanceId === metadata.instanceId) {
+        await unlink3(metadataPath).catch(() => void 0);
+      }
+    },
+    setIdle: (idle) => {
+      metadata.idle = idle;
+    },
+    status: () => publicStatus(metadata)
+  };
+}
+var parseMetadata = (raw, expectedConnectorId) => {
+  const metadata = JSON.parse(raw);
+  if (metadata.protocolVersion !== CONNECTOR_CONTROL_PROTOCOL_VERSION || typeof metadata.port !== "number" || typeof metadata.secret !== "string" || typeof metadata.connectorId !== "string" || typeof metadata.serverUrl !== "string" || expectedConnectorId && metadata.connectorId !== expectedConnectorId) {
+    throw new Error("Invalid Connector daemon control metadata");
+  }
+  return metadata;
+};
+var readMetadata = async (config, configRoot) => {
+  const metadataPath = getDaemonControlMetadataPath(config, configRoot);
+  return parseMetadata(await readFile3(metadataPath, "utf8"), config.connectorId);
+};
+async function listPersistedDaemonStatuses(configRoot) {
+  const daemonRoot = path2.join(
+    getConnectorPaths(DEFAULT_SERVER_URL, configRoot).configDir,
+    "daemons"
+  );
+  const serverDirectories = await readdir(daemonRoot, { withFileTypes: true }).catch(() => []);
+  const statuses = await Promise.all(
+    serverDirectories.filter((entry) => entry.isDirectory()).map(async (serverEntry) => {
+      const serverDirectory = path2.join(daemonRoot, serverEntry.name);
+      const connectorEntries = await readdir(serverDirectory, { withFileTypes: true }).catch(
+        () => []
+      );
+      return Promise.all(
+        connectorEntries.filter((entry) => entry.isDirectory()).map(
+          (entry) => readFile3(
+            path2.join(serverDirectory, entry.name, "connector-daemon.control.json"),
+            "utf8"
+          ).then((raw) => publicStatus(parseMetadata(raw))).catch(() => null)
+        )
+      );
+    })
+  );
+  const unique = /* @__PURE__ */ new Map();
+  for (const status of statuses.flat()) {
+    if (!status) continue;
+    unique.set(`${status.serverUrl}
+${status.connectorId}`, status);
+  }
+  return [...unique.values()];
+}
+var connectControl = async (metadata, command, timeoutMs = DEFAULT_CONTROL_REQUEST_TIMEOUT_MS) => new Promise((resolve, reject) => {
+  const socket = createConnection({ host: "127.0.0.1", port: metadata.port });
+  let buffer = "";
+  let settled = false;
+  const cleanup = () => {
+    socket.setTimeout(0);
+    socket.off("data", onData);
+    socket.off("error", fail);
+    socket.off("timeout", onTimeout);
+  };
+  const fail = (error) => {
+    if (settled) return;
+    settled = true;
+    cleanup();
+    socket.destroy();
+    reject(error);
+  };
+  const onTimeout = () => {
+    fail(new Error(`Connector daemon control timed out after ${timeoutMs}ms`));
+  };
+  const onData = (chunk) => {
+    buffer += chunk;
+    const newline = buffer.indexOf("\n");
+    if (newline < 0) return;
+    try {
+      const response = JSON.parse(buffer.slice(0, newline));
+      if (!response.ok) return fail(new Error(response.error ?? "Daemon control request failed"));
+      settled = true;
+      cleanup();
+      resolve({ response, socket });
+    } catch (error) {
+      fail(error instanceof Error ? error : new Error(String(error)));
+    }
+  };
+  socket.once("error", fail);
+  socket.once("timeout", onTimeout);
+  socket.setTimeout(timeoutMs);
+  socket.once("connect", () => {
+    socket.write(
+      `${JSON.stringify({ command, secret: metadata.secret })}
+`
+    );
+  });
+  socket.setEncoding("utf8");
+  socket.on("data", onData);
+});
+async function readPersistedDaemonStatus(config, configRoot) {
+  return publicStatus(await readMetadata(config, configRoot));
+}
+async function requestDaemonControl(config, command, configRoot, options = {}) {
+  const metadata = await readMetadata(config, configRoot);
+  const { response, socket } = await connectControl(metadata, command, options.timeoutMs);
+  socket.end();
+  if (!response.status) throw new Error("Daemon control response did not include status");
+  return response.status;
+}
+async function holdDaemonControl(config, configRoot) {
+  const metadata = await readMetadata(config, configRoot);
+  const { response, socket } = await connectControl(metadata, "hold");
+  if (!response.status) {
+    socket.destroy();
+    throw new Error("Daemon hold response did not include status");
+  }
+  const closed = new Promise((resolve) => socket.once("close", () => resolve()));
+  return { close: () => socket.end(), closed, status: response.status };
+}
+
+// src/console-dashboard.ts
 var MAX_LINES_PER_PANE = 500;
 var MIN_DASHBOARD_WIDTH = 60;
 var MIN_DASHBOARD_HEIGHT = 18;
+var DASHBOARD_TITLE = `Buda Connector v${CONNECTOR_RUNTIME_VERSION}`;
 var colors = {
   cyan: "\x1B[36m",
   dim: "\x1B[2m",
@@ -475,9 +887,12 @@ var formatDuration = (durationMs) => {
   return [hours, minutes, seconds].map((part) => String(part).padStart(2, "0")).join(":");
 };
 var createDashboardState = (startedAt = Date.now()) => ({
+  activeSection: "activity",
   activePane: "activity",
   activity: [],
   agentDebug: [],
+  connectorLogs: {},
+  connectors: [],
   heartbeat: "Waiting",
   relay: "Starting",
   agent: "Starting",
@@ -538,37 +953,189 @@ var scrollDashboardPane = (state, pane, delta) => {
   const nextScroll = delta === "follow" ? 0 : delta === "oldest" ? maxScroll : Math.max(0, Math.min(maxScroll, state.scroll[pane] + delta));
   return { ...state, scroll: { ...state.scroll, [pane]: nextScroll } };
 };
-var parseDashboardMouseAction = (input, size) => {
-  const mouseEventPrefix = "\x1B[<";
-  if (!input.includes(mouseEventPrefix)) return void 0;
-  const event = input.split(mouseEventPrefix).at(-1);
-  const match = event?.match(/^(\d+);\d+;(\d+)[Mm]/);
+var selectedConnector = (state) => state.connectors.find((connector) => connector.connectorId === state.selectedConnectorId);
+var applySelectedConnector = (state, resetScroll = true) => {
+  const connector = selectedConnector(state);
+  const logs = connector ? state.connectorLogs[connector.connectorId] : void 0;
+  return {
+    ...state,
+    activity: logs?.activity ?? [],
+    agent: connector?.agent ?? "Stopped",
+    agentDebug: logs?.agentDebug ?? [],
+    heartbeat: connector?.heartbeat ?? "Stopped",
+    relay: connector?.relay ?? "Disconnected",
+    server: connector?.serverUrl ?? "Unknown",
+    scroll: resetScroll ? { activity: 0, agentDebug: 0 } : state.scroll
+  };
+};
+var updateDashboardConnectors = (state, connectors, preferredConnectorId) => {
+  const selectedStillExists = connectors.some(
+    (connector) => connector.connectorId === state.selectedConnectorId
+  );
+  const selectedConnectorId = selectedStillExists ? state.selectedConnectorId : connectors.find((connector) => connector.connectorId === preferredConnectorId)?.connectorId ?? connectors[0]?.connectorId;
+  return applySelectedConnector(
+    {
+      ...state,
+      activeSection: connectors.length > 0 && state.connectors.length === 0 ? "connectors" : state.activeSection,
+      connectors,
+      selectedConnectorId
+    },
+    selectedConnectorId !== state.selectedConnectorId
+  );
+};
+var selectConnectorByOffset = (state, offset) => {
+  if (state.connectors.length === 0) return state;
+  const currentIndex = Math.max(
+    0,
+    state.connectors.findIndex((connector) => connector.connectorId === state.selectedConnectorId)
+  );
+  const nextIndex = Math.max(0, Math.min(state.connectors.length - 1, currentIndex + offset));
+  return applySelectedConnector({
+    ...state,
+    selectedConnectorId: state.connectors[nextIndex]?.connectorId
+  });
+};
+var promptOptionCount = (prompt) => prompt.kind === "exit-choice" ? 3 : 2;
+var isUpKey = (key) => ["\x1B[A", "\x1BOA", "k", "K"].includes(key);
+var isDownKey = (key) => ["\x1B[B", "\x1BOB", "j", "J"].includes(key);
+var getConnectorSectionHeight = (state, height) => state.connectors.length ? Math.min(
+  Math.max(4, state.connectors.length + 2),
+  Math.max(4, Math.min(Math.floor(height / 3), height - 13))
+) : 0;
+var parseDashboardMouseWheel = (input, state, size) => {
+  const event = input.split("\x1B[<").at(-1);
+  const match = event?.match(/^(64|65);\d+;(\d+)[Mm]/);
   if (!match) return void 0;
-  const button = Number(match[1]);
   const row = Number(match[2]);
-  const availablePaneRows = Math.max(0, size.height - 6);
+  const connectorHeight = getConnectorSectionHeight(state, size.height);
+  const availablePaneRows = size.height - 7 - connectorHeight;
   const activityHeight = Math.floor(availablePaneRows / 2);
-  const activityStart = 6;
-  const debugStart = activityStart + activityHeight;
-  const pane = row >= activityStart && row < debugStart ? "activity" : row >= debugStart && row < size.height ? "agentDebug" : void 0;
+  const activityStartRow = 7 + connectorHeight;
+  const debugStartRow = activityStartRow + activityHeight;
+  const pane = row >= activityStartRow && row < debugStartRow ? "activity" : row >= debugStartRow && row < size.height ? "agentDebug" : void 0;
   if (!pane) return void 0;
-  if (button === 64) return { pane, delta: 3 };
-  if (button === 65) return { pane, delta: -3 };
-  if (button === 0) return { pane };
-  return void 0;
+  return { delta: match[1] === "64" ? 3 : -3, pane };
+};
+var reduceDashboardInput = (state, key, managerEnabled) => {
+  if (state.prompt) {
+    if (key === "\x1B") return { state: { ...state, prompt: void 0 } };
+    if (isUpKey(key) || isDownKey(key)) {
+      const delta = isUpKey(key) ? -1 : 1;
+      const optionCount = promptOptionCount(state.prompt);
+      const option = (state.prompt.option + delta + optionCount) % optionCount;
+      return { state: { ...state, prompt: { ...state.prompt, option } } };
+    }
+    if (key !== "\r" && key !== "\n") return { state };
+    if (state.prompt.kind === "stop-selected") {
+      const connector = selectedConnector(state);
+      return state.prompt.option === 1 && connector ? {
+        command: {
+          connectorId: connector.connectorId,
+          serverUrl: connector.serverUrl,
+          type: "stop-selected"
+        },
+        state: { ...state, prompt: void 0 }
+      } : { state: { ...state, prompt: void 0 } };
+    }
+    if (state.prompt.kind === "stop-all-confirm") {
+      return state.prompt.option === 1 ? { command: { type: "stop-all" }, state: { ...state, prompt: void 0 } } : { state: { ...state, prompt: void 0 } };
+    }
+    if (state.prompt.option === 0) {
+      return { state: { ...state, prompt: { kind: "stop-all-confirm", option: 0 } } };
+    }
+    if (state.prompt.option === 1) {
+      return { command: { type: "exit-dashboard" }, state: { ...state, prompt: void 0 } };
+    }
+    return { state: { ...state, prompt: void 0 } };
+  }
+  if (managerEnabled && key === "") {
+    return { state: { ...state, prompt: { kind: "exit-choice", option: 1 } } };
+  }
+  if (managerEnabled && key === "\x1B") {
+    return { command: { type: "exit-dashboard" }, state };
+  }
+  if (managerEnabled && (key === "s" || key === "S") && ["Online", "Running"].includes(selectedConnector(state)?.status ?? "")) {
+    return { state: { ...state, prompt: { kind: "stop-selected", option: 0 } } };
+  }
+  if (key === "	") {
+    const sections = managerEnabled ? ["connectors", "activity", "agentDebug"] : ["activity", "agentDebug"];
+    const index = sections.indexOf(state.activeSection);
+    const activeSection = sections[(index + 1) % sections.length] ?? sections[0];
+    return {
+      state: {
+        ...state,
+        activePane: activeSection === "connectors" ? state.activePane : activeSection,
+        activeSection
+      }
+    };
+  }
+  if (state.activeSection === "connectors" && (isUpKey(key) || isDownKey(key))) {
+    return { state: selectConnectorByOffset(state, isUpKey(key) ? -1 : 1) };
+  }
+  const pane = state.activePane;
+  if (key === "f" || key === "F" || key === "\x1B[F") {
+    return { state: scrollDashboardPane(state, pane, "follow") };
+  }
+  if (key === "\x1B[H") return { state: scrollDashboardPane(state, pane, "oldest") };
+  if (isUpKey(key)) return { state: scrollDashboardPane(state, pane, 1) };
+  if (isDownKey(key)) return { state: scrollDashboardPane(state, pane, -1) };
+  if (key === "\x1B[5~") return { state: scrollDashboardPane(state, pane, 8) };
+  if (key === "\x1B[6~") return { state: scrollDashboardPane(state, pane, -8) };
+  return { state };
 };
-var getTerminalCopyGesture = (termProgram = process.env.TERM_PROGRAM) => termProgram === "Apple_Terminal" ? "Fn+drag copy" : "Shift+drag copy";
 var renderStatus = (state, width, now) => {
   const innerWidth = width - 2;
   const status = (value) => value;
+  const connector = selectedConnector(state);
   return [
     `+${"-".repeat(innerWidth)}+`,
-    `|${colors.cyan}${truncate(" Buda Connector", innerWidth)}${colors.reset}|`,
+    `|${colors.cyan}${truncate(` ${DASHBOARD_TITLE}`, innerWidth)}${colors.reset}|`,
+    `|${truncate(` Connector ${connector?.label ?? connector?.connectorId ?? "None"}   Space ${connector?.spaceId ?? "Unknown"}`, innerWidth)}|`,
     `|${truncate(` Relay ${status(state.relay)}   Agent ${status(state.agent)}   Heartbeat ${status(state.heartbeat)}`, innerWidth)}|`,
     `|${truncate(` Server ${state.server}   Uptime ${formatDuration(now - state.startedAt)}`, innerWidth)}|`,
     `+${"-".repeat(innerWidth)}+`
   ];
 };
+var renderConnectors = (state, height, width) => {
+  const innerWidth = width - 2;
+  const contentHeight = Math.max(1, height - 2);
+  const selectedIndex = Math.max(
+    0,
+    state.connectors.findIndex((connector) => connector.connectorId === state.selectedConnectorId)
+  );
+  const start = Math.max(
+    0,
+    Math.min(
+      selectedIndex - Math.floor(contentHeight / 2),
+      state.connectors.length - contentHeight
+    )
+  );
+  const visible = state.connectors.slice(start, start + contentHeight);
+  const range = state.connectors.length ? `${start + 1}-${start + visible.length}/${state.connectors.length}` : "0/0";
+  const title = ` Connectors ${state.activeSection === "connectors" ? "[active]" : ""}`;
+  const headerFill = Math.max(1, innerWidth - title.length - range.length);
+  const output = [
+    `${state.activeSection === "connectors" ? colors.reverse : ""}+${title}${"-".repeat(headerFill)}${range}+${colors.reset}`
+  ];
+  for (let index = 0; index < contentHeight; index += 1) {
+    const connector = visible[index];
+    if (!connector) {
+      output.push(`|${" ".repeat(innerWidth)}|`);
+      continue;
+    }
+    const marker = connector.connectorId === state.selectedConnectorId ? ">" : " ";
+    const statusText = connector.status.padEnd(8);
+    const availableFieldWidth = Math.max(24, innerWidth - 18);
+    const connectorWidth = Math.max(10, Math.floor(availableFieldWidth * 0.4));
+    const spaceWidth = Math.max(8, Math.floor(availableFieldWidth * 0.25));
+    const serverWidth = Math.max(8, availableFieldWidth - connectorWidth - spaceWidth);
+    const content = `${marker} ${statusText} ${truncate(connector.label ?? connector.connectorId, connectorWidth)} | ${truncate(connector.spaceId, spaceWidth)} | ${truncate(connector.serverUrl, serverWidth)}`;
+    const color = connector.status === "Stopped" ? colors.dim : connector.status === "Online" ? colors.cyan : connector.status === "Connecting" || connector.status === "Stopping" ? colors.yellow : connector.status === "Error" || connector.status === "Unresponsive" ? colors.red : "";
+    output.push(`|${color}${truncate(content, innerWidth)}${colors.reset}|`);
+  }
+  output.push(`+${"-".repeat(innerWidth)}+`);
+  return output;
+};
 var renderPane = (title, lines, height, width, active, scroll) => {
   const innerWidth = width - 2;
   const contentHeight = Math.max(1, height - 2);
@@ -594,29 +1161,67 @@ var renderPane = (title, lines, height, width, active, scroll) => {
   output.push(`+${"-".repeat(innerWidth)}+`);
   return output;
 };
-var renderFooter = (width) => `${colors.dim}${truncate(` ${getTerminalCopyGesture()} | Click/wheel pane | Tab switch pane | F follow`, width)}${colors.reset}`;
+var renderFooter = (state, width) => {
+  const managerKeys = state.connectors.length ? "Up/Down select | S stop | Esc exit | " : "";
+  return `${colors.dim}${truncate(` ${managerKeys}Tab switch pane | F follow`, width)}${colors.reset}`;
+};
+var renderPrompt = (state, size) => {
+  const width = Math.max(10, size.width);
+  const height = Math.max(4, size.height);
+  const connector = selectedConnector(state);
+  const prompt = state.prompt;
+  if (!prompt) return "";
+  const content = prompt.kind === "exit-choice" ? {
+    options: ["Stop all local Connectors and exit", "Exit Dashboard only", "Cancel"],
+    title: "Exit Buda Connector Dashboard?",
+    warning: "Dashboard exit does not stop background Connector processes."
+  } : prompt.kind === "stop-all-confirm" ? {
+    options: ["Cancel", "Stop all local Connectors and exit"],
+    title: "Stop every local Connector?",
+    warning: "Running agent tasks will be interrupted."
+  } : {
+    options: ["Cancel", "Stop selected Connector"],
+    title: `Stop ${connector?.connectorId ?? "selected Connector"}?`,
+    warning: "The Dashboard will remain open."
+  };
+  const lines = [
+    content.title,
+    "",
+    content.warning,
+    "",
+    ...content.options.map((option, index) => `${index === prompt.option ? ">" : " "} ${option}`),
+    "",
+    "Up/Down choose | Enter confirm | Esc cancel"
+  ];
+  const visible = lines.slice(0, height);
+  while (visible.length < height) visible.push("");
+  return visible.map((line) => truncate(line, width)).join("\n");
+};
 var renderDashboard = (state, size, now = Date.now()) => {
   const width = Math.max(10, size.width);
   const height = Math.max(4, size.height);
   if (width < MIN_DASHBOARD_WIDTH || height < MIN_DASHBOARD_HEIGHT) {
     return [
-      truncate("Buda Connector", width),
+      truncate(DASHBOARD_TITLE, width),
       truncate("Terminal too small for dashboard. Resize or restart with --plain.", width),
       truncate(`Relay ${state.relay} | Agent ${state.agent}`, width),
       truncate(`Heartbeat ${state.heartbeat}`, width)
     ].slice(0, height).join("\n");
   }
-  const availablePaneRows = height - 6;
+  if (state.prompt) return renderPrompt(state, size);
+  const connectorHeight = getConnectorSectionHeight(state, height);
+  const availablePaneRows = height - 7 - connectorHeight;
   const activityHeight = Math.floor(availablePaneRows / 2);
   const debugHeight = availablePaneRows - activityHeight;
   return [
     ...renderStatus(state, width, now),
+    ...connectorHeight ? renderConnectors(state, connectorHeight, width) : [],
     ...renderPane(
       "Activity",
       state.activity,
       activityHeight,
       width,
-      state.activePane === "activity",
+      state.activeSection === "activity",
       state.scroll.activity
     ),
     ...renderPane(
@@ -624,15 +1229,16 @@ var renderDashboard = (state, size, now = Date.now()) => {
       state.agentDebug,
       debugHeight,
       width,
-      state.activePane === "agentDebug",
+      state.activeSection === "agentDebug",
       state.scroll.agentDebug
     ),
-    renderFooter(width)
+    renderFooter(state, width)
   ].join("\n");
 };
 var ConnectorConsoleDashboard = class {
-  constructor(streams) {
+  constructor(streams, manager) {
     this.streams = streams;
+    this.manager = manager;
   }
   state = createDashboardState();
   stopped = false;
@@ -658,6 +1264,38 @@ var ConnectorConsoleDashboard = class {
     this.state = { ...this.state, ...update };
     this.scheduleRender();
   }
+  updateConnectors(connectors, preferredConnectorId) {
+    this.state = updateDashboardConnectors(this.state, connectors, preferredConnectorId);
+    this.scheduleRender();
+  }
+  appendConnectorLog(connectorId, level, raw) {
+    const current = this.state.connectorLogs[connectorId] ?? { activity: [], agentDebug: [] };
+    let connectorState = { ...this.state, ...current };
+    const formatted = raw;
+    for (const rawLine of formatted.split("\n")) {
+      const { pane, message } = classifyDashboardLine(rawLine);
+      if (!message) continue;
+      connectorState = appendDashboardLine(
+        connectorState,
+        pane,
+        classifyDashboardLevel(level, formatted, rawLine),
+        message
+      );
+    }
+    const connectorLogs = {
+      ...this.state.connectorLogs,
+      [connectorId]: {
+        activity: connectorState.activity,
+        agentDebug: connectorState.agentDebug
+      }
+    };
+    this.state = {
+      ...this.state,
+      connectorLogs,
+      ...connectorId === this.state.selectedConnectorId ? { activity: connectorState.activity, agentDebug: connectorState.agentDebug } : {}
+    };
+    this.scheduleRender();
+  }
   stop = () => {
     if (this.stopped) return;
     this.stopped = true;
@@ -689,43 +1327,59 @@ var ConnectorConsoleDashboard = class {
   }
   handleInput = (chunk) => {
     const key = chunk.toString();
-    if (key === "") {
+    if (key === "" && !this.manager) {
       this.stop();
       process.kill(process.pid, "SIGINT");
       return;
     }
-    const size = {
-      width: this.streams.output.columns || 80,
-      height: this.streams.output.rows || 24
-    };
-    const mouseAction = parseDashboardMouseAction(key, size);
-    if (mouseAction) {
-      this.state = { ...this.state, activePane: mouseAction.pane };
-      if (mouseAction.delta !== void 0) {
-        this.state = scrollDashboardPane(this.state, mouseAction.pane, mouseAction.delta);
-      }
-    } else if (key === "	") {
-      this.state = {
-        ...this.state,
-        activePane: this.state.activePane === "activity" ? "agentDebug" : "activity"
-      };
-    } else if (key === "f" || key === "F" || key === "\x1B[F") {
-      this.state = scrollDashboardPane(this.state, this.state.activePane, "follow");
-    } else if (key === "\x1B[H") {
-      this.state = scrollDashboardPane(this.state, this.state.activePane, "oldest");
-    } else if (key === "\x1B[A") {
-      this.state = scrollDashboardPane(this.state, this.state.activePane, 1);
-    } else if (key === "\x1B[B") {
-      this.state = scrollDashboardPane(this.state, this.state.activePane, -1);
-    } else if (key === "\x1B[5~") {
-      this.state = scrollDashboardPane(this.state, this.state.activePane, 8);
-    } else if (key === "\x1B[6~") {
-      this.state = scrollDashboardPane(this.state, this.state.activePane, -8);
-    } else {
+    const mouseWheel = parseDashboardMouseWheel(key, this.state, {
+      height: this.streams.output.rows || 24,
+      width: this.streams.output.columns || 80
+    });
+    if (mouseWheel) {
+      this.state = scrollDashboardPane(
+        {
+          ...this.state,
+          activePane: mouseWheel.pane,
+          activeSection: mouseWheel.pane
+        },
+        mouseWheel.pane,
+        mouseWheel.delta
+      );
+      this.scheduleRender();
       return;
     }
+    const result = reduceDashboardInput(this.state, key, Boolean(this.manager));
+    this.state = result.state;
     this.scheduleRender();
+    if (result.command) void this.runCommand(result.command);
   };
+  async runCommand(command) {
+    if (!this.manager) return;
+    if (command.type === "exit-dashboard") {
+      this.stop();
+      this.manager.onExit();
+      return;
+    }
+    try {
+      if (command.type === "stop-selected") {
+        this.state = {
+          ...this.state,
+          connectors: this.state.connectors.map(
+            (connector) => connector.connectorId === command.connectorId ? { ...connector, status: "Stopping" } : connector
+          )
+        };
+        this.scheduleRender();
+        await this.manager.onStopConnector(command.connectorId, command.serverUrl);
+        return;
+      }
+      await this.manager.onStopAll();
+      this.stop();
+      this.manager.onExit();
+    } catch (error) {
+      this.capture("error", [error instanceof Error ? error.message : String(error)]);
+    }
+  }
   scheduleRender = () => {
     if (this.stopped || this.renderQueued) return;
     this.renderQueued = true;
@@ -744,30 +1398,49 @@ var startConnectorConsoleDashboard = (options = {}) => {
   const streams = options.streams ?? resolveDashboardStreams();
   if (!streams?.input.isTTY || !streams.output.isTTY) return void 0;
   if (activeDashboard) return activeDashboard;
-  activeDashboard = new ConnectorConsoleDashboard(streams);
+  activeDashboard = new ConnectorConsoleDashboard(streams, options.manager);
   activeDashboard.start();
   return activeDashboard;
 };
 var updateConnectorDashboardStatus = (update) => {
   activeDashboard?.updateStatus(update);
 };
+var updateConnectorDashboardConnectors = (connectors, preferredConnectorId) => {
+  activeDashboard?.updateConnectors(connectors, preferredConnectorId);
+};
+var appendConnectorDashboardLog = (connectorId, level, raw) => {
+  activeDashboard?.appendConnectorLog(connectorId, level, raw);
+};
 
-// src/onboard.ts
-import { cancel, intro, isCancel, log, note, outro, spinner, text } from "@clack/prompts";
+// src/daemon-client.ts
+import { spawn } from "child_process";
+import { mkdir as mkdir6, readFile as readFile6 } from "fs/promises";
+import path7 from "path";
 
-// src/bunny-daemon.ts
-import { mkdir as mkdir3 } from "fs/promises";
-import { createDaemon } from "@bunny-agent/daemon";
+// src/cloud-client.ts
+import { createHash as createHash4 } from "crypto";
+import { platform as platform3, release } from "os";
+
+// src/browser.ts
+import { accessSync, constants, statSync } from "fs";
+import { mkdir as mkdir4 } from "fs/promises";
+import { platform as getPlatform, homedir as homedir2 } from "os";
+import path4 from "path";
 
 // src/logger.ts
-import { appendFile, mkdir as mkdir2, readdir, rename as rename2, stat as stat2, unlink as unlink3 } from "fs/promises";
-import path2 from "path";
+import { appendFile, mkdir as mkdir3, readdir as readdir2, rename as rename3, stat as stat2, unlink as unlink4 } from "fs/promises";
+import path3 from "path";
+import { format as format2 } from "util";
 var CONNECTOR_LOG_MAX_BYTES = 2 * 1024 * 1024;
 var CONNECTOR_LOG_BACKUP_COUNT = 2;
 var CONNECTOR_LOG_RETENTION_DAYS = 7;
 var pendingLogs = [];
 var fileWriteQueue = Promise.resolve();
 var lastPrunedDate = "";
+var activeLogContext;
+var setConnectorLogContext = (context) => {
+  activeLogContext = { ...activeLogContext, ...context };
+};
 var ignoreMissingFile = (error) => {
   if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") {
     return;
@@ -781,17 +1454,17 @@ var formatConnectorLogDate = (date) => {
   return `${year}-${month}-${day}`;
 };
 var getDatedConnectorLogPath = (baseLogPath, date = /* @__PURE__ */ new Date()) => {
-  const parsed = path2.parse(baseLogPath);
-  return path2.join(parsed.dir, `${parsed.name}-${formatConnectorLogDate(date)}${parsed.ext}`);
+  const parsed = path3.parse(baseLogPath);
+  return path3.join(parsed.dir, `${parsed.name}-${formatConnectorLogDate(date)}${parsed.ext}`);
 };
 async function pruneConnectorLogs(baseLogPath, now = /* @__PURE__ */ new Date(), retentionDays = CONNECTOR_LOG_RETENTION_DAYS) {
-  const parsed = path2.parse(baseLogPath);
+  const parsed = path3.parse(baseLogPath);
   const prefix = `${parsed.name}-`;
   const cutoff = new Date(now);
   cutoff.setHours(0, 0, 0, 0);
   cutoff.setDate(cutoff.getDate() - Math.max(0, retentionDays - 1));
   const cutoffDate = formatConnectorLogDate(cutoff);
-  const files = await readdir(parsed.dir).catch(() => []);
+  const files = await readdir2(parsed.dir).catch(() => []);
   const expired = files.filter((fileName) => {
     if (!fileName.startsWith(prefix)) return false;
     const date = fileName.slice(prefix.length, prefix.length + 10);
@@ -801,7 +1474,7 @@ async function pruneConnectorLogs(baseLogPath, now = /* @__PURE__ */ new Date(),
     const isLogSegment = suffix === parsed.ext || /^\d+$/.test(segment);
     return isDatedLog && isLogSegment && date < cutoffDate;
   });
-  await Promise.all(expired.map((fileName) => unlink3(path2.join(parsed.dir, fileName))));
+  await Promise.all(expired.map((fileName) => unlink4(path3.join(parsed.dir, fileName))));
   return expired.length;
 }
 async function rotateConnectorLogIfNeeded(logPath, maxBytes = CONNECTOR_LOG_MAX_BYTES, backupCount = CONNECTOR_LOG_BACKUP_COUNT) {
@@ -810,11 +1483,11 @@ async function rotateConnectorLogIfNeeded(logPath, maxBytes = CONNECTOR_LOG_MAX_
     return 0;
   });
   if (currentSize < maxBytes) return false;
-  await unlink3(`${logPath}.${backupCount}`).catch(ignoreMissingFile);
+  await unlink4(`${logPath}.${backupCount}`).catch(ignoreMissingFile);
   for (let index = backupCount - 1; index >= 1; index -= 1) {
-    await rename2(`${logPath}.${index}`, `${logPath}.${index + 1}`).catch(ignoreMissingFile);
+    await rename3(`${logPath}.${index}`, `${logPath}.${index + 1}`).catch(ignoreMissingFile);
   }
-  await rename2(logPath, `${logPath}.1`).catch(ignoreMissingFile);
+  await rename3(logPath, `${logPath}.1`).catch(ignoreMissingFile);
   return true;
 }
 var appendConnectorLog = (baseLogPath, line, now = /* @__PURE__ */ new Date()) => {
@@ -832,19 +1505,62 @@ var appendConnectorLog = (baseLogPath, line, now = /* @__PURE__ */ new Date()) =
   fileWriteQueue = queuedWrite.catch(() => void 0);
   return queuedWrite;
 };
+var persistLocalEntry = async (entry) => {
+  const paths = getConnectorPaths(
+    activeLogContext?.serverUrl ?? getServerUrl(),
+    activeLogContext?.configRoot
+  );
+  await mkdir3(path3.dirname(paths.logPath), { recursive: true }).catch(() => void 0);
+  await appendConnectorLog(paths.logPath, `${JSON.stringify(entry)}
+`).catch(() => void 0);
+};
+var installConnectorConsoleCapture = () => {
+  const writes = [];
+  const original = {
+    error: console.error,
+    log: console.log,
+    warn: console.warn
+  };
+  const capture = (level, output) => (...args) => {
+    const message = format2(...args);
+    if (!message.startsWith("[buda-connector]")) {
+      writes.push(
+        persistLocalEntry({
+          level,
+          message,
+          metadata: {
+            source: "daemon-console",
+            ...activeLogContext?.connectorId ? { connectorId: activeLogContext.connectorId } : {}
+          },
+          createdAt: (/* @__PURE__ */ new Date()).toISOString()
+        })
+      );
+    }
+    output(...args);
+  };
+  console.log = capture("info", original.log);
+  console.warn = capture("warn", original.warn);
+  console.error = capture("error", original.error);
+  return async () => {
+    console.log = original.log;
+    console.warn = original.warn;
+    console.error = original.error;
+    await Promise.all(writes);
+  };
+};
 async function writeLog(level, message, metadata) {
   const entry = {
     level,
     message,
-    metadata,
+    metadata: {
+      ...metadata ?? {},
+      ...activeLogContext?.connectorId ? { connectorId: activeLogContext.connectorId } : {}
+    },
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   pendingLogs.push(entry);
   if (pendingLogs.length > 100) pendingLogs.splice(0, pendingLogs.length - 100);
-  const paths = getConnectorPaths(getServerUrl());
-  await mkdir2(path2.dirname(paths.logPath), { recursive: true }).catch(() => void 0);
-  await appendConnectorLog(paths.logPath, `${JSON.stringify(entry)}
-`).catch(() => void 0);
+  await persistLocalEntry(entry);
   const line = `[buda-connector] ${message}`;
   if (level === "error") console.error(line);
   else if (level === "warn") console.warn(line);
@@ -857,767 +1573,376 @@ function restorePendingLogs(logs) {
   pendingLogs.unshift(...logs);
 }
 
-// src/terminal.ts
-import { randomBytes as randomBytes2 } from "crypto";
-import path3 from "path";
-import WebSocket, { WebSocketServer } from "ws";
-var TERMINAL_IDLE_TTL_MS = 10 * 6e4;
-var TERMINAL_HANDSHAKE_TIMEOUT_MS = 1e4;
-var LOCAL_TERMINAL_GRANT_TTL_MS = 3e4;
-var LOCAL_TERMINAL_CLOSE_SPAWN_FAILED = 4401;
-var MAX_BUFFER_CHUNKS = 1e3;
-var MAX_TERMINAL_FRAME_BYTES = 1024 * 1024;
-var normalizeTerminalCloseCode = (code, fallback = 1011) => code >= 1e3 && code <= 1014 && ![1004, 1005, 1006].includes(code) || code >= 3e3 && code <= 4999 ? code : fallback;
-var truncateTerminalCloseReason = (reason, maxBytes = 120) => {
-  let result = reason;
-  while (Buffer.byteLength(result, "utf8") > maxBytes) result = result.slice(0, -1);
-  return result;
-};
+// src/browser.ts
+var DEFAULT_VIEWPORT = { width: 1280, height: 800 };
+var MAX_SCREENCAST_DIMENSION = 2560;
+var SESSION_ID_PATTERN = /^[A-Za-z0-9_.:-]{1,320}$/;
 var sessions = /* @__PURE__ */ new Map();
-var localGrants = /* @__PURE__ */ new Map();
-var installedServers = /* @__PURE__ */ new WeakSet();
-var isSafeId = (value) => typeof value === "string" && /^[A-Za-z0-9_.:-]{1,160}$/.test(value);
-var parseDimension = (value, fallback, min, max) => typeof value === "number" && Number.isSafeInteger(value) ? Math.max(min, Math.min(max, value)) : fallback;
-var parseConnectorTerminalRequest = (request) => {
-  if (request.method !== "CONNECT" || request.path !== "/api/terminal") {
-    throw new Error("Invalid connector terminal request.");
+var sessionPromises = /* @__PURE__ */ new Map();
+var getBrowserMode = () => {
+  const configured = process.env.BUDA_CONNECTOR_BROWSER_MODE?.trim().toLowerCase();
+  return configured === "auto" || configured === "headed" || configured === "headless" ? configured : "headless";
+};
+var getSystemBrowserCandidates = (platform4, homeDirectory, env) => {
+  if (platform4 === "darwin") {
+    return [
+      "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+      "/Applications/Chromium.app/Contents/MacOS/Chromium",
+      "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge",
+      `${homeDirectory}/Applications/Google Chrome.app/Contents/MacOS/Google Chrome`,
+      `${homeDirectory}/Applications/Chromium.app/Contents/MacOS/Chromium`,
+      `${homeDirectory}/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge`
+    ];
   }
-  if (!request.body || typeof request.body !== "object" || Array.isArray(request.body)) {
-    throw new Error("Connector terminal request body is invalid.");
+  if (platform4 === "win32") {
+    const localAppData = env.LOCALAPPDATA;
+    const programFiles = env.PROGRAMFILES;
+    const programFilesX86 = env["PROGRAMFILES(X86)"];
+    return [
+      localAppData ? `${localAppData}\\Google\\Chrome\\Application\\chrome.exe` : "",
+      localAppData ? `${localAppData}\\Chromium\\Application\\chrome.exe` : "",
+      programFiles ? `${programFiles}\\Google\\Chrome\\Application\\chrome.exe` : "",
+      programFilesX86 ? `${programFilesX86}\\Google\\Chrome\\Application\\chrome.exe` : "",
+      programFiles ? `${programFiles}\\Microsoft\\Edge\\Application\\msedge.exe` : "",
+      programFilesX86 ? `${programFilesX86}\\Microsoft\\Edge\\Application\\msedge.exe` : ""
+    ];
   }
-  const body = request.body;
-  if (!isSafeId(body.sessionId) || !isSafeId(body.tabId)) {
-    throw new Error("Connector terminal session identity is invalid.");
+  return [
+    "/usr/bin/google-chrome",
+    "/usr/bin/google-chrome-stable",
+    "/usr/bin/chromium",
+    "/usr/bin/chromium-browser",
+    "/snap/bin/chromium",
+    "/usr/bin/microsoft-edge",
+    "/usr/bin/microsoft-edge-stable"
+  ];
+};
+var resolveBrowserAvailability = (options = {}) => {
+  const env = options.env ?? process.env;
+  const platform4 = options.platform ?? getPlatform();
+  const homeDirectory = options.homeDirectory ?? homedir2();
+  const pathIsExecutable = options.pathIsExecutable ?? ((candidate) => {
+    try {
+      if (!statSync(candidate).isFile()) return false;
+      accessSync(candidate, constants.X_OK);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+  const configuredPath = env.BUDA_CONNECTOR_BROWSER_PATH?.trim();
+  if (configuredPath) {
+    if (pathIsExecutable(configuredPath)) {
+      return { available: true, executablePath: configuredPath };
+    }
+    return {
+      available: false,
+      error: `BUDA_CONNECTOR_BROWSER_PATH is missing or not executable: ${configuredPath}. Set it to a Chrome, Chromium, or Edge executable.`
+    };
   }
-  if (typeof body.token !== "string" || body.token.length < 32 || body.token.length > 2048) {
-    throw new Error("Connector terminal token is invalid.");
+  const executablePath = getSystemBrowserCandidates(platform4, homeDirectory, env).find(
+    (candidate) => candidate && pathIsExecutable(candidate)
+  );
+  if (executablePath) {
+    return { available: true, executablePath };
   }
   return {
-    sessionId: body.sessionId,
-    tabId: body.tabId,
-    token: body.token,
-    cols: parseDimension(body.cols, 80, 10, 500),
-    rows: parseDimension(body.rows, 24, 5, 200)
+    available: false,
+    error: "No supported system browser was found. Install Google Chrome, Chromium, or Microsoft Edge, or set BUDA_CONNECTOR_BROWSER_PATH to its executable. The connector browser capability will not be advertised."
   };
 };
-var clearIdleTimer = (session) => {
-  if (!session.idleTimer) return;
-  clearTimeout(session.idleTimer);
-  session.idleTimer = null;
-};
-var scheduleIdleCleanup = (sessionKey, session) => {
-  clearIdleTimer(session);
-  session.idleTimer = setTimeout(() => {
-    if (session.clients.size > 0 || sessions.get(sessionKey) !== session) return;
-    sessions.delete(sessionKey);
+async function launchPlaywright(viewport = DEFAULT_VIEWPORT) {
+  const availability = resolveBrowserAvailability();
+  if (!availability.available) throw new Error(availability.error);
+  const { chromium } = await import("playwright-core");
+  const mode = getBrowserMode();
+  const executablePath = availability.executablePath;
+  let browser = null;
+  if (mode !== "headless") {
     try {
-      session.pty.kill();
-    } catch {
+      await writeLog("info", `launching headed system browser ${executablePath}`);
+      browser = await chromium.launch({
+        executablePath,
+        headless: false,
+        args: ["--no-sandbox", "--disable-setuid-sandbox"]
+      });
+    } catch (error) {
+      if (mode === "headed") throw error;
+      await writeLog(
+        "warn",
+        `headed browser launch failed, falling back to headless: ${error instanceof Error ? error.message : String(error)}`
+      );
     }
-  }, TERMINAL_IDLE_TTL_MS);
-  session.idleTimer.unref();
-};
-var sendJson = (socket, value) => {
-  if (socket.readyState === WebSocket.OPEN) socket.send(JSON.stringify(value));
-};
-var LocalTerminalUnavailableError = class extends Error {
+  }
+  if (!browser) {
+    await writeLog("info", `launching headless system browser ${executablePath}`);
+    browser = await chromium.launch({
+      executablePath,
+      headless: true,
+      args: ["--no-sandbox", "--disable-setuid-sandbox", "--disable-gpu"]
+    });
+  }
+  const context = await browser.newContext({ viewport, deviceScaleFactor: 1 });
+  const page = await context.newPage();
+  const cdpSession = await context.newCDPSession(page);
+  return { browser, page, cdpSession };
+}
+var normalizeSessionId = (value) => {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim();
+  return SESSION_ID_PATTERN.test(normalized) ? normalized : null;
 };
-var serializeErrorMessage = (error) => error instanceof Error ? error.message : "Unknown error";
-var createTerminalSession = async (grant, nodePtyLoader) => {
-  let nodePty;
-  try {
-    nodePty = await nodePtyLoader();
-  } catch (error) {
-    void writeLog(
-      "error",
-      `local terminal could not load node-pty: ${serializeErrorMessage(error)}`
-    );
-    throw new LocalTerminalUnavailableError(
-      "Local terminal is unavailable because node-pty could not be loaded. The connector remains available for other capabilities."
-    );
+async function ensureSession(sessionId, initialViewport = DEFAULT_VIEWPORT) {
+  const activeSession = sessions.get(sessionId);
+  if (activeSession) return activeSession;
+  let sessionPromise = sessionPromises.get(sessionId);
+  if (!sessionPromise) {
+    sessionPromise = (async () => {
+      await writeLog("info", `launching local browser session ${sessionId}`);
+      const { browser, page, cdpSession } = await launchPlaywright(initialViewport);
+      const nextSession = {
+        page,
+        browser,
+        cdpSession,
+        screencastClients: /* @__PURE__ */ new Set(),
+        isScreencasting: false,
+        screencastListenerAttached: false,
+        resizeQueue: Promise.resolve(),
+        inputQueue: Promise.resolve(),
+        navigationQueue: Promise.resolve(),
+        clientIds: /* @__PURE__ */ new Set()
+      };
+      sessions.set(sessionId, nextSession);
+      browser.on("disconnected", () => {
+        if (sessions.get(sessionId) === nextSession) sessions.delete(sessionId);
+      });
+      return nextSession;
+    })();
+    sessionPromises.set(sessionId, sessionPromise);
   }
-  const shell = process.platform === "win32" ? "powershell.exe" : process.env.SHELL || "/bin/bash";
-  const shellArgs = process.platform === "win32" ? [] : ["-l"];
-  let pty;
   try {
-    pty = nodePty.spawn(shell, shellArgs, {
-      name: "xterm-256color",
-      cols: grant.cols,
-      rows: grant.rows,
-      cwd: path3.resolve(grant.cwd),
-      env: { ...process.env, TERM: "xterm-256color" }
+    return await sessionPromise;
+  } finally {
+    if (sessionPromises.get(sessionId) === sessionPromise) sessionPromises.delete(sessionId);
+  }
+}
+async function startScreencast(s) {
+  if (s.isScreencasting) return;
+  if (!s.screencastListenerAttached) {
+    s.screencastListenerAttached = true;
+    s.cdpSession.on("Page.screencastFrame", (params) => {
+      const metadata = params.metadata;
+      const viewport = s.page.viewportSize() ?? DEFAULT_VIEWPORT;
+      const frame = {
+        data: params.data,
+        viewportWidth: metadata.deviceWidth ?? viewport.width,
+        viewportHeight: metadata.deviceHeight ?? viewport.height
+      };
+      for (const listener of s.screencastClients) listener(frame);
+      void s.cdpSession.send("Page.screencastFrameAck", { sessionId: params.sessionId }).catch(() => {
+      });
     });
-  } catch (error) {
-    const message = serializeErrorMessage(error);
-    void writeLog(
-      "error",
-      `local terminal failed to spawn shell=${shell} cwd=${grant.cwd}: ${message}`
-    );
-    throw new LocalTerminalUnavailableError(
-      "Local terminal is unavailable because node-pty could not start a shell. The connector remains available for other capabilities."
-    );
   }
-  const session = {
-    pty,
-    clients: /* @__PURE__ */ new Set(),
-    buffer: [],
-    cols: grant.cols,
-    rows: grant.rows,
-    idleTimer: null
-  };
-  sessions.set(grant.sessionKey, session);
-  pty.onData((data) => {
-    session.buffer.push(data);
-    if (session.buffer.length > MAX_BUFFER_CHUNKS) session.buffer.shift();
-    for (const socket of session.clients) {
-      if (socket.readyState === WebSocket.OPEN) socket.send(data);
-    }
+  await s.cdpSession.send("Page.startScreencast", {
+    format: "jpeg",
+    quality: 90,
+    maxWidth: MAX_SCREENCAST_DIMENSION,
+    maxHeight: MAX_SCREENCAST_DIMENSION,
+    everyNthFrame: 2
   });
-  pty.onExit(({ exitCode }) => {
-    if (sessions.get(grant.sessionKey) === session) sessions.delete(grant.sessionKey);
-    clearIdleTimer(session);
-    for (const socket of session.clients) {
-      sendJson(socket, { type: "status", message: `exited (code ${exitCode})` });
-      socket.close(1e3, "Terminal exited");
-    }
-    session.clients.clear();
+  s.isScreencasting = true;
+}
+async function stopScreencast(s) {
+  if (!s.isScreencasting) return;
+  await s.cdpSession.send("Page.stopScreencast").catch(() => {
   });
-  return session;
-};
-var attachLocalTerminal = async (socket, grant, nodePtyLoader) => {
-  const pendingMessages = [];
-  let session;
-  let started = false;
-  const handleMessage = (data) => {
-    if (!session) {
-      pendingMessages.push(data);
-      return;
-    }
-    try {
-      const message = JSON.parse(data);
-      if (message.type === "bridge-start") {
-        if (!started) {
-          started = true;
-          sendJson(socket, { type: "status", message: "connected" });
-          for (const chunk of session.buffer) socket.send(chunk);
-        }
-        return;
-      }
-      if (message.type === "input" && typeof message.data === "string") {
-        session.pty.write(message.data);
-        return;
-      }
-      if (message.type === "resize") {
-        const cols = parseDimension(message.cols, session.cols, 10, 500);
-        const rows = parseDimension(message.rows, session.rows, 5, 200);
-        if (cols !== session.cols || rows !== session.rows) {
-          session.cols = cols;
-          session.rows = rows;
-          session.pty.resize(cols, rows);
-        }
-        return;
-      }
-    } catch {
-    }
-    session.pty.write(data);
-  };
-  socket.on("message", (raw) => handleMessage(raw.toString()));
-  session = sessions.get(grant.sessionKey);
-  if (!session) session = await createTerminalSession(grant, nodePtyLoader);
-  else clearIdleTimer(session);
-  session.clients.add(socket);
-  for (const data of pendingMessages.splice(0)) handleMessage(data);
-  const detach = () => {
-    if (!session) return;
-    session.clients.delete(socket);
-    if (session.clients.size === 0) scheduleIdleCleanup(grant.sessionKey, session);
-  };
-  socket.once("close", detach);
-  socket.once("error", detach);
-};
-var installConnectorTerminalEndpoint = (server, options = {}) => {
-  if (installedServers.has(server)) return;
-  installedServers.add(server);
-  const terminalServer = new WebSocketServer({ noServer: true });
-  server.on("upgrade", (request, socket, head) => {
-    const url = new URL(request.url ?? "/", "http://connector.local");
-    if (url.pathname !== "/api/terminal") return;
-    const tokenHeader = request.headers["x-buda-local-terminal-token"];
-    const token = Array.isArray(tokenHeader) ? tokenHeader[0] : tokenHeader;
-    const grant = token ? localGrants.get(token) : void 0;
-    if (!token || !grant || grant.expiresAt <= Date.now()) {
-      if (token) localGrants.delete(token);
-      socket.destroy();
-      return;
-    }
-    localGrants.delete(token);
-    terminalServer.handleUpgrade(request, socket, head, (client) => {
-      void attachLocalTerminal(
-        client,
-        grant,
-        options.nodePtyLoader ?? (() => import("./lib-UX6C35VI.js"))
-      ).catch((error) => {
-        const message = error instanceof LocalTerminalUnavailableError ? error.message : "Local terminal is unavailable. The connector remains available for other capabilities.";
-        sendJson(client, { type: "error", fatal: true, message });
-        client.close(LOCAL_TERMINAL_CLOSE_SPAWN_FAILED, "Local terminal unavailable");
-      });
-    });
+  s.isScreencasting = false;
+}
+async function closeSession(sessionId) {
+  const activeSession = sessions.get(sessionId) ?? await sessionPromises.get(sessionId)?.catch(() => null);
+  if (!activeSession) return;
+  if (sessions.get(sessionId) === activeSession) sessions.delete(sessionId);
+  await stopScreencast(activeSession);
+  await activeSession.cdpSession.detach().catch(() => {
   });
-  server.once("close", () => {
-    for (const client of terminalServer.clients) client.terminate();
-    terminalServer.close();
-    localGrants.clear();
-    for (const session of sessions.values()) {
-      clearIdleTimer(session);
-      try {
-        session.pty.kill();
-      } catch {
-      }
-    }
-    sessions.clear();
+  await activeSession.browser.close().catch(() => {
   });
-};
-var registerLocalTerminal = (input) => {
-  if (!isSafeId(input.workspaceKey) || !isSafeId(input.tabId)) {
-    throw new Error("Invalid local terminal workspace session.");
-  }
-  const token = randomBytes2(32).toString("base64url");
-  localGrants.set(token, {
-    sessionKey: `${input.workspaceKey}:${input.tabId}`,
-    workspaceKey: input.workspaceKey,
-    cwd: input.cwd,
-    cols: input.cols,
-    rows: input.rows,
-    expiresAt: Date.now() + LOCAL_TERMINAL_GRANT_TTL_MS
+  await writeLog("info", `browser session stopped ${sessionId}`);
+}
+async function closeAllBrowserSessions() {
+  const sessionIds = /* @__PURE__ */ new Set([...sessions.keys(), ...sessionPromises.keys()]);
+  await Promise.all([...sessionIds].map((sessionId) => closeSession(sessionId)));
+}
+async function resizeBrowser(s, viewport) {
+  const resize = s.resizeQueue.catch(() => {
+  }).then(async () => {
+    const current = s.page.viewportSize();
+    if (current?.width === viewport.width && current.height === viewport.height) return;
+    const wasScreencasting = s.isScreencasting;
+    if (wasScreencasting) await stopScreencast(s);
+    await s.page.setViewportSize(viewport);
+    if (wasScreencasting) await startScreencast(s);
+    await writeLog("info", `browser resized to ${viewport.width}x${viewport.height}`);
   });
-  const cleanupTimer = setTimeout(() => localGrants.delete(token), LOCAL_TERMINAL_GRANT_TTL_MS);
-  cleanupTimer.unref();
-  return token;
-};
-var toLocalTerminalUrl = (baseUrl) => {
-  const url = new URL("/api/terminal", baseUrl);
-  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
-  return url.toString();
+  s.resizeQueue = resize;
+  await resize;
+}
+async function navigateBrowser(s, url, options) {
+  const navigation = s.navigationQueue.catch(() => {
+  }).then(async () => {
+    if (s.page.url() === url) return null;
+    return s.page.goto(url, options);
+  });
+  s.navigationQueue = navigation.then(() => {
+  });
+  return navigation;
+}
+var normalizeViewportDimension = (value, min, max, fallback) => {
+  const dimension = typeof value === "number" && Number.isFinite(value) ? Math.round(value) : fallback;
+  return Math.min(max, Math.max(min, dimension));
 };
-var connectSocket = async (socket) => new Promise((resolve, reject) => {
-  const onOpen = () => {
-    socket.removeListener("error", onError);
-    resolve();
-  };
-  const onError = (error) => {
-    socket.removeListener("open", onOpen);
-    reject(error);
-  };
-  socket.once("open", onOpen);
-  socket.once("error", onError);
-});
-var proxyConnectorTerminalTunnel = async (input) => {
-  const cloud = new WebSocket(
-    getConnectorTerminalUrl(input.serverUrl, input.connectorId, input.sessionId),
-    {
-      headers: { "X-Buda-Terminal-Token": input.cloudToken },
-      handshakeTimeout: TERMINAL_HANDSHAKE_TIMEOUT_MS
-    }
-  );
-  const local = new WebSocket(toLocalTerminalUrl(input.localBaseUrl), {
-    headers: { "X-Buda-Local-Terminal-Token": input.localToken },
-    handshakeTimeout: TERMINAL_HANDSHAKE_TIMEOUT_MS
+var normalizeTimeout = (value, fallback, max) => typeof value === "number" && Number.isFinite(value) ? Math.min(max, Math.max(1e3, Math.round(value))) : fallback;
+function jsonResponse(status, body) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json" }
   });
-  try {
-    await Promise.all([connectSocket(cloud), connectSocket(local)]);
-  } catch (error) {
-    cloud.terminate();
-    local.terminate();
-    throw error;
-  }
-  let bridgeAccepted = false;
-  let pendingBytes = 0;
-  const pendingCloudFrames = [];
-  const pendingLocalFrames = [];
-  const bufferFrame = (frames, data, isBinary) => {
-    const bytes = Array.isArray(data) ? data.reduce((total, chunk) => total + chunk.byteLength, 0) : data.byteLength;
-    if (pendingBytes + bytes > MAX_TERMINAL_FRAME_BYTES) {
-      cloud.close(1009, "Terminal handshake buffer too large");
-      local.close(1009, "Terminal handshake buffer too large");
-      return false;
-    }
-    pendingBytes += bytes;
-    frames.push([data, isBinary]);
-    return true;
-  };
-  cloud.on("message", (data, isBinary) => {
-    if (!bridgeAccepted) {
-      if (!isBinary && data.toString() === '{"type":"bridge-accepted"}') {
-        bridgeAccepted = true;
-        local.send(JSON.stringify({ type: "bridge-start" }));
-        for (const [frame, binary] of pendingCloudFrames) {
-          if (local.readyState === WebSocket.OPEN) local.send(frame, { binary });
-        }
-        for (const [frame, binary] of pendingLocalFrames) {
-          if (cloud.readyState === WebSocket.OPEN) cloud.send(frame, { binary });
-        }
-        pendingCloudFrames.length = 0;
-        pendingLocalFrames.length = 0;
-        pendingBytes = 0;
+}
+var getRequestSessionId = (context) => normalizeSessionId(context.sessionId);
+async function handleBrowserInput(sessionIdValue, body) {
+  const sessionId = normalizeSessionId(sessionIdValue);
+  if (!sessionId) throw new Error("A valid browser session id is required.");
+  const ev = body ?? {};
+  const s = await ensureSession(sessionId);
+  const input = s.inputQueue.catch(() => {
+  }).then(async () => {
+    switch (ev.type) {
+      case "mouseMove":
+        await s.cdpSession.send("Input.dispatchMouseEvent", {
+          type: "mouseMoved",
+          x: ev.x,
+          y: ev.y
+        });
         return;
-      }
-      bufferFrame(pendingCloudFrames, data, isBinary);
-      return;
+      case "mouseDown":
+        await s.cdpSession.send("Input.dispatchMouseEvent", {
+          type: "mousePressed",
+          x: ev.x,
+          y: ev.y,
+          button: "left",
+          clickCount: 1
+        });
+        return;
+      case "mouseUp":
+        await s.cdpSession.send("Input.dispatchMouseEvent", {
+          type: "mouseReleased",
+          x: ev.x,
+          y: ev.y,
+          button: "left",
+          clickCount: 1
+        });
+        return;
+      case "keyDown":
+        await s.cdpSession.send("Input.dispatchKeyEvent", {
+          type: "keyDown",
+          key: ev.key,
+          text: ev.text ?? ""
+        });
+        return;
+      case "keyUp":
+        await s.cdpSession.send("Input.dispatchKeyEvent", {
+          type: "keyUp",
+          key: ev.key
+        });
+        return;
+      case "scroll":
+        await s.cdpSession.send("Input.dispatchMouseEvent", {
+          type: "mouseWheel",
+          x: ev.x,
+          y: ev.y,
+          deltaX: 0,
+          deltaY: ev.deltaY
+        });
+        return;
+      default:
+        throw new Error(`Unknown browser input event: ${String(ev.type)}`);
     }
-    if (local.readyState === WebSocket.OPEN) local.send(data, { binary: isBinary });
   });
-  local.on("message", (data, isBinary) => {
-    if (!bridgeAccepted) {
-      bufferFrame(pendingLocalFrames, data, isBinary);
-      return;
-    }
-    if (cloud.readyState === WebSocket.OPEN) cloud.send(data, { binary: isBinary });
-  });
-  cloud.once("close", (code, reason) => {
-    if (!bridgeAccepted) {
-      void writeLog(
-        "warn",
-        `terminal cloud tunnel closed before readiness session=${input.sessionId} code=${code} reason=${truncateTerminalCloseReason(reason.toString())}`
-      );
-    }
-    if (local.readyState === WebSocket.OPEN) {
-      local.close(normalizeTerminalCloseCode(code), truncateTerminalCloseReason(reason.toString()));
-    }
-  });
-  local.once("close", (code, reason) => {
-    if (cloud.readyState === WebSocket.OPEN) {
-      cloud.close(normalizeTerminalCloseCode(code), truncateTerminalCloseReason(reason.toString()));
-    }
-  });
-  cloud.once("error", () => local.terminate());
-  local.once("error", () => cloud.terminate());
-  cloud.send(JSON.stringify({ type: "bridge-ready" }));
-  await writeLog(
-    "info",
-    `terminal proxy connected session=${input.sessionId} workspace=${input.workspaceKey}`
-  );
-};
-
-// src/bunny-daemon.ts
-async function startEmbeddedBunnyDaemon(config, launchConfig) {
-  const host = getBunnyDaemonHost(launchConfig);
-  const port = getBunnyDaemonPort(launchConfig);
-  const root = config.workdirRoot;
-  await mkdir3(root, { recursive: true });
-  const server = createDaemon({ host, port, root });
-  installConnectorTerminalEndpoint(server);
-  await new Promise((resolve, reject) => {
-    const onError = (error) => {
-      server.off("listening", onListening);
-      reject(error);
-    };
-    const onListening = () => {
-      server.off("error", onError);
-      resolve();
-    };
-    server.once("error", onError);
-    server.once("listening", onListening);
-    server.listen(port, host);
-  });
-  const address = server.address();
-  const actualPort = typeof address === "object" && address ? address.port : port;
-  const baseUrl = `http://${host}:${actualPort}`;
-  await writeLog("info", `bunny daemon listening ${baseUrl}`, {
-    root
-  });
-  return {
-    server,
-    host,
-    port: actualPort,
-    baseUrl,
-    root
-  };
-}
-async function stopEmbeddedBunnyDaemon(daemon) {
-  await new Promise((resolve) => {
-    daemon.server.close(() => resolve());
-  });
-  await writeLog("info", `bunny daemon stopped ${daemon.baseUrl}`);
+  s.inputQueue = input;
+  await input;
 }
-
-// src/cloud-client.ts
-import { createHash as createHash4 } from "crypto";
-import { platform as platform3, release } from "os";
-
-// src/browser.ts
-import { accessSync, constants, statSync } from "fs";
-import { mkdir as mkdir4 } from "fs/promises";
-import { platform as getPlatform, homedir as homedir2 } from "os";
-import path4 from "path";
-var DEFAULT_VIEWPORT = { width: 1280, height: 800 };
-var MAX_SCREENCAST_DIMENSION = 2560;
-var SESSION_ID_PATTERN = /^[A-Za-z0-9_.:-]{1,320}$/;
-var sessions2 = /* @__PURE__ */ new Map();
-var sessionPromises = /* @__PURE__ */ new Map();
-var getBrowserMode = () => {
-  const configured = process.env.BUDA_CONNECTOR_BROWSER_MODE?.trim().toLowerCase();
-  return configured === "auto" || configured === "headed" || configured === "headless" ? configured : "headless";
-};
-var getSystemBrowserCandidates = (platform4, homeDirectory, env) => {
-  if (platform4 === "darwin") {
-    return [
-      "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
-      "/Applications/Chromium.app/Contents/MacOS/Chromium",
-      "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge",
-      `${homeDirectory}/Applications/Google Chrome.app/Contents/MacOS/Google Chrome`,
-      `${homeDirectory}/Applications/Chromium.app/Contents/MacOS/Chromium`,
-      `${homeDirectory}/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge`
-    ];
-  }
-  if (platform4 === "win32") {
-    const localAppData = env.LOCALAPPDATA;
-    const programFiles = env.PROGRAMFILES;
-    const programFilesX86 = env["PROGRAMFILES(X86)"];
-    return [
-      localAppData ? `${localAppData}\\Google\\Chrome\\Application\\chrome.exe` : "",
-      localAppData ? `${localAppData}\\Chromium\\Application\\chrome.exe` : "",
-      programFiles ? `${programFiles}\\Google\\Chrome\\Application\\chrome.exe` : "",
-      programFilesX86 ? `${programFilesX86}\\Google\\Chrome\\Application\\chrome.exe` : "",
-      programFiles ? `${programFiles}\\Microsoft\\Edge\\Application\\msedge.exe` : "",
-      programFilesX86 ? `${programFilesX86}\\Microsoft\\Edge\\Application\\msedge.exe` : ""
-    ];
+var getPageResult = async (s) => ({
+  url: s.page.url(),
+  title: await s.page.title().catch(() => "")
+});
+var resolveScreenshotPath = (workdirRoot, filePath) => {
+  if (!workdirRoot) throw new Error("Connector workdir is unavailable for screenshots.");
+  const raw = typeof filePath === "string" ? filePath.trim() : "";
+  if (!raw) throw new Error("file_path is required");
+  const agentRoot = path4.resolve(workdirRoot, "agent");
+  const relativeInput = raw === "/agent" ? "" : raw.startsWith("/agent/") ? raw.slice(7) : raw;
+  const absolutePath = path4.resolve(agentRoot, relativeInput);
+  if (absolutePath === agentRoot || !absolutePath.startsWith(`${agentRoot}${path4.sep}`)) {
+    throw new Error("file_path must stay under the connector agent drive");
   }
-  return [
-    "/usr/bin/google-chrome",
-    "/usr/bin/google-chrome-stable",
-    "/usr/bin/chromium",
-    "/usr/bin/chromium-browser",
-    "/snap/bin/chromium",
-    "/usr/bin/microsoft-edge",
-    "/usr/bin/microsoft-edge-stable"
-  ];
+  return {
+    absolutePath,
+    relativePath: path4.relative(agentRoot, absolutePath).split(path4.sep).join("/")
+  };
 };
-var resolveBrowserAvailability = (options = {}) => {
-  const env = options.env ?? process.env;
-  const platform4 = options.platform ?? getPlatform();
-  const homeDirectory = options.homeDirectory ?? homedir2();
-  const pathIsExecutable = options.pathIsExecutable ?? ((candidate) => {
-    try {
-      if (!statSync(candidate).isFile()) return false;
-      accessSync(candidate, constants.X_OK);
-      return true;
-    } catch {
-      return false;
-    }
-  });
-  const configuredPath = env.BUDA_CONNECTOR_BROWSER_PATH?.trim();
-  if (configuredPath) {
-    if (pathIsExecutable(configuredPath)) {
-      return { available: true, executablePath: configuredPath };
-    }
-    return {
-      available: false,
-      error: `BUDA_CONNECTOR_BROWSER_PATH is missing or not executable: ${configuredPath}. Set it to a Chrome, Chromium, or Edge executable.`
+async function handleBrowserRequest(requestPath, method, body, context = {}) {
+  const route = new URL(requestPath, "http://connector.local").pathname.replace(
+    /^\/browser\/?/,
+    ""
+  );
+  const sessionId = getRequestSessionId(context);
+  if (!sessionId)
+    return jsonResponse(400, { ok: false, error: "valid browser session id required" });
+  if (route === "start" && method === "POST") {
+    const input = body ?? {};
+    const viewport = {
+      width: normalizeViewportDimension(input.width, 320, 2560, DEFAULT_VIEWPORT.width),
+      height: normalizeViewportDimension(input.height, 240, 2560, DEFAULT_VIEWPORT.height)
     };
+    const s = await ensureSession(sessionId, viewport);
+    const clientId = normalizeSessionId(input.clientId);
+    if (clientId) s.clientIds.add(clientId);
+    await resizeBrowser(s, viewport);
+    const url = input.url?.trim() || "about:blank";
+    await writeLog("info", `browser viewport ${viewport.width}x${viewport.height}`);
+    await navigateBrowser(s, url);
+    await writeLog("info", `browser ready at ${s.page.url()}`);
+    return jsonResponse(200, { ok: true, ...await getPageResult(s) });
   }
-  const executablePath = getSystemBrowserCandidates(platform4, homeDirectory, env).find(
-    (candidate) => candidate && pathIsExecutable(candidate)
-  );
-  if (executablePath) {
-    return { available: true, executablePath };
+  if (route === "stop" && method === "POST") {
+    await closeSession(sessionId);
+    return jsonResponse(200, { ok: true });
   }
-  return {
-    available: false,
-    error: "No supported system browser was found. Install Google Chrome, Chromium, or Microsoft Edge, or set BUDA_CONNECTOR_BROWSER_PATH to its executable. The connector browser capability will not be advertised."
-  };
-};
-async function launchPlaywright(viewport = DEFAULT_VIEWPORT) {
-  const availability = resolveBrowserAvailability();
-  if (!availability.available) throw new Error(availability.error);
-  const { chromium } = await import("playwright-core");
-  const mode = getBrowserMode();
-  const executablePath = availability.executablePath;
-  let browser = null;
-  if (mode !== "headless") {
-    try {
-      await writeLog("info", `launching headed system browser ${executablePath}`);
-      browser = await chromium.launch({
-        executablePath,
-        headless: false,
-        args: ["--no-sandbox", "--disable-setuid-sandbox"]
-      });
-    } catch (error) {
-      if (mode === "headed") throw error;
-      await writeLog(
-        "warn",
-        `headed browser launch failed, falling back to headless: ${error instanceof Error ? error.message : String(error)}`
-      );
-    }
+  if (route === "release" && method === "POST") {
+    const input = body ?? {};
+    const clientId = normalizeSessionId(input.clientId);
+    if (!clientId) return jsonResponse(400, { ok: false, error: "valid client id required" });
+    const s = sessions.get(sessionId);
+    if (!s) return jsonResponse(200, { ok: true, closed: false });
+    s.clientIds.delete(clientId);
+    if (s.clientIds.size > 0) return jsonResponse(200, { ok: true, closed: false });
+    await closeSession(sessionId);
+    return jsonResponse(200, { ok: true, closed: true });
   }
-  if (!browser) {
-    await writeLog("info", `launching headless system browser ${executablePath}`);
-    browser = await chromium.launch({
-      executablePath,
-      headless: true,
-      args: ["--no-sandbox", "--disable-setuid-sandbox", "--disable-gpu"]
-    });
-  }
-  const context = await browser.newContext({ viewport, deviceScaleFactor: 1 });
-  const page = await context.newPage();
-  const cdpSession = await context.newCDPSession(page);
-  return { browser, page, cdpSession };
-}
-var normalizeSessionId = (value) => {
-  if (typeof value !== "string") return null;
-  const normalized = value.trim();
-  return SESSION_ID_PATTERN.test(normalized) ? normalized : null;
-};
-async function ensureSession(sessionId, initialViewport = DEFAULT_VIEWPORT) {
-  const activeSession = sessions2.get(sessionId);
-  if (activeSession) return activeSession;
-  let sessionPromise = sessionPromises.get(sessionId);
-  if (!sessionPromise) {
-    sessionPromise = (async () => {
-      await writeLog("info", `launching local browser session ${sessionId}`);
-      const { browser, page, cdpSession } = await launchPlaywright(initialViewport);
-      const nextSession = {
-        page,
-        browser,
-        cdpSession,
-        screencastClients: /* @__PURE__ */ new Set(),
-        isScreencasting: false,
-        screencastListenerAttached: false,
-        resizeQueue: Promise.resolve(),
-        inputQueue: Promise.resolve(),
-        navigationQueue: Promise.resolve(),
-        clientIds: /* @__PURE__ */ new Set()
-      };
-      sessions2.set(sessionId, nextSession);
-      browser.on("disconnected", () => {
-        if (sessions2.get(sessionId) === nextSession) sessions2.delete(sessionId);
-      });
-      return nextSession;
-    })();
-    sessionPromises.set(sessionId, sessionPromise);
-  }
-  try {
-    return await sessionPromise;
-  } finally {
-    if (sessionPromises.get(sessionId) === sessionPromise) sessionPromises.delete(sessionId);
-  }
-}
-async function startScreencast(s) {
-  if (s.isScreencasting) return;
-  if (!s.screencastListenerAttached) {
-    s.screencastListenerAttached = true;
-    s.cdpSession.on("Page.screencastFrame", (params) => {
-      const metadata = params.metadata;
-      const viewport = s.page.viewportSize() ?? DEFAULT_VIEWPORT;
-      const frame = {
-        data: params.data,
-        viewportWidth: metadata.deviceWidth ?? viewport.width,
-        viewportHeight: metadata.deviceHeight ?? viewport.height
-      };
-      for (const listener of s.screencastClients) listener(frame);
-      void s.cdpSession.send("Page.screencastFrameAck", { sessionId: params.sessionId }).catch(() => {
-      });
-    });
-  }
-  await s.cdpSession.send("Page.startScreencast", {
-    format: "jpeg",
-    quality: 90,
-    maxWidth: MAX_SCREENCAST_DIMENSION,
-    maxHeight: MAX_SCREENCAST_DIMENSION,
-    everyNthFrame: 2
-  });
-  s.isScreencasting = true;
-}
-async function stopScreencast(s) {
-  if (!s.isScreencasting) return;
-  await s.cdpSession.send("Page.stopScreencast").catch(() => {
-  });
-  s.isScreencasting = false;
-}
-async function closeSession(sessionId) {
-  const activeSession = sessions2.get(sessionId) ?? await sessionPromises.get(sessionId)?.catch(() => null);
-  if (!activeSession) return;
-  if (sessions2.get(sessionId) === activeSession) sessions2.delete(sessionId);
-  await stopScreencast(activeSession);
-  await activeSession.cdpSession.detach().catch(() => {
-  });
-  await activeSession.browser.close().catch(() => {
-  });
-  await writeLog("info", `browser session stopped ${sessionId}`);
-}
-async function closeAllBrowserSessions() {
-  const sessionIds = /* @__PURE__ */ new Set([...sessions2.keys(), ...sessionPromises.keys()]);
-  await Promise.all([...sessionIds].map((sessionId) => closeSession(sessionId)));
-}
-async function resizeBrowser(s, viewport) {
-  const resize = s.resizeQueue.catch(() => {
-  }).then(async () => {
-    const current = s.page.viewportSize();
-    if (current?.width === viewport.width && current.height === viewport.height) return;
-    const wasScreencasting = s.isScreencasting;
-    if (wasScreencasting) await stopScreencast(s);
-    await s.page.setViewportSize(viewport);
-    if (wasScreencasting) await startScreencast(s);
-    await writeLog("info", `browser resized to ${viewport.width}x${viewport.height}`);
-  });
-  s.resizeQueue = resize;
-  await resize;
-}
-async function navigateBrowser(s, url, options) {
-  const navigation = s.navigationQueue.catch(() => {
-  }).then(async () => {
-    if (s.page.url() === url) return null;
-    return s.page.goto(url, options);
-  });
-  s.navigationQueue = navigation.then(() => {
-  });
-  return navigation;
-}
-var normalizeViewportDimension = (value, min, max, fallback) => {
-  const dimension = typeof value === "number" && Number.isFinite(value) ? Math.round(value) : fallback;
-  return Math.min(max, Math.max(min, dimension));
-};
-var normalizeTimeout = (value, fallback, max) => typeof value === "number" && Number.isFinite(value) ? Math.min(max, Math.max(1e3, Math.round(value))) : fallback;
-function jsonResponse(status, body) {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "content-type": "application/json" }
-  });
-}
-var getRequestSessionId = (context) => normalizeSessionId(context.sessionId);
-async function handleBrowserInput(sessionIdValue, body) {
-  const sessionId = normalizeSessionId(sessionIdValue);
-  if (!sessionId) throw new Error("A valid browser session id is required.");
-  const ev = body ?? {};
-  const s = await ensureSession(sessionId);
-  const input = s.inputQueue.catch(() => {
-  }).then(async () => {
-    switch (ev.type) {
-      case "mouseMove":
-        await s.cdpSession.send("Input.dispatchMouseEvent", {
-          type: "mouseMoved",
-          x: ev.x,
-          y: ev.y
-        });
-        return;
-      case "mouseDown":
-        await s.cdpSession.send("Input.dispatchMouseEvent", {
-          type: "mousePressed",
-          x: ev.x,
-          y: ev.y,
-          button: "left",
-          clickCount: 1
-        });
-        return;
-      case "mouseUp":
-        await s.cdpSession.send("Input.dispatchMouseEvent", {
-          type: "mouseReleased",
-          x: ev.x,
-          y: ev.y,
-          button: "left",
-          clickCount: 1
-        });
-        return;
-      case "keyDown":
-        await s.cdpSession.send("Input.dispatchKeyEvent", {
-          type: "keyDown",
-          key: ev.key,
-          text: ev.text ?? ""
-        });
-        return;
-      case "keyUp":
-        await s.cdpSession.send("Input.dispatchKeyEvent", {
-          type: "keyUp",
-          key: ev.key
-        });
-        return;
-      case "scroll":
-        await s.cdpSession.send("Input.dispatchMouseEvent", {
-          type: "mouseWheel",
-          x: ev.x,
-          y: ev.y,
-          deltaX: 0,
-          deltaY: ev.deltaY
-        });
-        return;
-      default:
-        throw new Error(`Unknown browser input event: ${String(ev.type)}`);
-    }
-  });
-  s.inputQueue = input;
-  await input;
-}
-var getPageResult = async (s) => ({
-  url: s.page.url(),
-  title: await s.page.title().catch(() => "")
-});
-var resolveScreenshotPath = (workdirRoot, filePath) => {
-  if (!workdirRoot) throw new Error("Connector workdir is unavailable for screenshots.");
-  const raw = typeof filePath === "string" ? filePath.trim() : "";
-  if (!raw) throw new Error("file_path is required");
-  const agentRoot = path4.resolve(workdirRoot, "agent");
-  const relativeInput = raw === "/agent" ? "" : raw.startsWith("/agent/") ? raw.slice(7) : raw;
-  const absolutePath = path4.resolve(agentRoot, relativeInput);
-  if (absolutePath === agentRoot || !absolutePath.startsWith(`${agentRoot}${path4.sep}`)) {
-    throw new Error("file_path must stay under the connector agent drive");
-  }
-  return {
-    absolutePath,
-    relativePath: path4.relative(agentRoot, absolutePath).split(path4.sep).join("/")
-  };
-};
-async function handleBrowserRequest(requestPath, method, body, context = {}) {
-  const route = new URL(requestPath, "http://connector.local").pathname.replace(
-    /^\/browser\/?/,
-    ""
-  );
-  const sessionId = getRequestSessionId(context);
-  if (!sessionId)
-    return jsonResponse(400, { ok: false, error: "valid browser session id required" });
-  if (route === "start" && method === "POST") {
-    const input = body ?? {};
-    const viewport = {
-      width: normalizeViewportDimension(input.width, 320, 2560, DEFAULT_VIEWPORT.width),
-      height: normalizeViewportDimension(input.height, 240, 2560, DEFAULT_VIEWPORT.height)
-    };
-    const s = await ensureSession(sessionId, viewport);
-    const clientId = normalizeSessionId(input.clientId);
-    if (clientId) s.clientIds.add(clientId);
-    await resizeBrowser(s, viewport);
-    const url = input.url?.trim() || "about:blank";
-    await writeLog("info", `browser viewport ${viewport.width}x${viewport.height}`);
-    await navigateBrowser(s, url);
-    await writeLog("info", `browser ready at ${s.page.url()}`);
-    return jsonResponse(200, { ok: true, ...await getPageResult(s) });
-  }
-  if (route === "stop" && method === "POST") {
-    await closeSession(sessionId);
-    return jsonResponse(200, { ok: true });
-  }
-  if (route === "release" && method === "POST") {
-    const input = body ?? {};
-    const clientId = normalizeSessionId(input.clientId);
-    if (!clientId) return jsonResponse(400, { ok: false, error: "valid client id required" });
-    const s = sessions2.get(sessionId);
-    if (!s) return jsonResponse(200, { ok: true, closed: false });
-    s.clientIds.delete(clientId);
-    if (s.clientIds.size > 0) return jsonResponse(200, { ok: true, closed: false });
-    await closeSession(sessionId);
-    return jsonResponse(200, { ok: true, closed: true });
-  }
-  if (route === "navigate" && method === "POST") {
-    const input = body ?? {};
-    const url = input.url?.trim();
-    if (!url) return jsonResponse(400, { ok: false, error: "url required" });
-    const s = await ensureSession(sessionId);
-    const response = await navigateBrowser(s, url, {
-      waitUntil: input.waitUntil ?? "domcontentloaded",
-      timeout: normalizeTimeout(input.timeoutMs, 3e4, 6e4)
-    });
-    return jsonResponse(200, {
-      ok: true,
-      action: "navigate",
-      ...await getPageResult(s),
-      status: response?.status() ?? null
+  if (route === "navigate" && method === "POST") {
+    const input = body ?? {};
+    const url = input.url?.trim();
+    if (!url) return jsonResponse(400, { ok: false, error: "url required" });
+    const s = await ensureSession(sessionId);
+    const response = await navigateBrowser(s, url, {
+      waitUntil: input.waitUntil ?? "domcontentloaded",
+      timeout: normalizeTimeout(input.timeoutMs, 3e4, 6e4)
+    });
+    return jsonResponse(200, {
+      ok: true,
+      action: "navigate",
+      ...await getPageResult(s),
+      status: response?.status() ?? null
     });
   }
   if (route === "click" && method === "POST") {
@@ -1706,7 +2031,7 @@ async function handleBrowserRequest(requestPath, method, body, context = {}) {
     return jsonResponse(200, { ok: true });
   }
   if (route === "location" && method === "GET") {
-    const s = sessions2.get(sessionId);
+    const s = sessions.get(sessionId);
     if (!s) return jsonResponse(200, { ok: true, url: "", title: "" });
     return jsonResponse(200, { ok: true, ...await getPageResult(s) });
   }
@@ -1737,7 +2062,7 @@ async function handleBrowserRequest(requestPath, method, body, context = {}) {
           if (s.screencastClients.size === 0) void stopScreencast(s);
         };
         checkInterval = setInterval(() => {
-          if (sessions2.get(sessionId) !== s) {
+          if (sessions.get(sessionId) !== s) {
             cleanup();
             controller.close();
           }
@@ -1761,8 +2086,16 @@ async function handleBrowserRequest(requestPath, method, body, context = {}) {
 
 // src/bundled.ts
 import { createHash as createHash3 } from "crypto";
-import { cpSync, existsSync, rmSync } from "fs";
-import { readdir as readdir2, readFile as readFile3 } from "fs/promises";
+import {
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+  statSync as statSync2
+} from "fs";
+import { readdir as readdir3, readFile as readFile4 } from "fs/promises";
 import path5 from "path";
 import { fileURLToPath } from "url";
 var PKG_ROOT = path5.resolve(fileURLToPath(import.meta.url), "../..");
@@ -1771,16 +2104,39 @@ var SYSTEM_SKILLS_DIR = path5.join(BUNDLED_DIR, "system-skills");
 var SCRIPTS_DIR = path5.join(BUNDLED_DIR, "scripts");
 var SHARED_DIR = path5.join(BUNDLED_DIR, "shared");
 var MONOREPO_SRC = path5.resolve(PKG_ROOT, "../buda/agent-templates");
-function syncTemplatesFromMonorepo() {
+function syncTemplatesFromMonorepo(options = {}) {
   if (!existsSync(MONOREPO_SRC)) {
     throw new Error(`Cannot sync agent-templates: source missing at ${MONOREPO_SRC}`);
   }
-  rmSync(BUNDLED_DIR, { recursive: true, force: true });
-  cpSync(MONOREPO_SRC, BUNDLED_DIR, {
-    recursive: true,
-    dereference: true,
-    filter: (src) => !src.split(path5.sep).includes("extensions")
-  });
+  mkdirSync(BUNDLED_DIR, { recursive: true });
+  syncDirectory(MONOREPO_SRC, BUNDLED_DIR, Boolean(options.prune));
+}
+function syncDirectory(sourceDirectory, destinationDirectory, prune) {
+  const sourceEntries = /* @__PURE__ */ new Set();
+  for (const entry of readdirSync(sourceDirectory, { withFileTypes: true })) {
+    if (entry.name === "extensions") continue;
+    sourceEntries.add(entry.name);
+    const source = path5.join(sourceDirectory, entry.name);
+    const destination = path5.join(destinationDirectory, entry.name);
+    if (statSync2(source).isDirectory()) {
+      mkdirSync(destination, { recursive: true });
+      syncDirectory(source, destination, prune);
+      continue;
+    }
+    const temporary = `${destination}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+    copyFileSync(source, temporary);
+    try {
+      renameSync(temporary, destination);
+    } catch {
+      copyFileSync(temporary, destination);
+      rmSync(temporary, { force: true });
+    }
+  }
+  if (!prune) return;
+  for (const entry of readdirSync(destinationDirectory, { withFileTypes: true })) {
+    if (sourceEntries.has(entry.name)) continue;
+    rmSync(path5.join(destinationDirectory, entry.name), { recursive: true, force: true });
+  }
 }
 ensureBundledDir();
 function ensureBundledDir() {
@@ -1798,7 +2154,7 @@ function ensureBundledDir() {
 var cached = null;
 async function readBundledManifest() {
   if (cached) return cached;
-  const systemSkillNames = (await readdir2(SYSTEM_SKILLS_DIR, { withFileTypes: true }).catch(() => [])).filter((e) => e.isDirectory()).map((e) => e.name).sort();
+  const systemSkillNames = (await readdir3(SYSTEM_SKILLS_DIR, { withFileTypes: true }).catch(() => [])).filter((e) => e.isDirectory()).map((e) => e.name).sort();
   const version = await hashDir(BUNDLED_DIR);
   cached = {
     version,
@@ -1813,12 +2169,12 @@ async function readBundledManifest() {
 async function hashDir(dir) {
   const hash = createHash3("sha256");
   await walk(dir, async (relPath, abs) => {
-    hash.update(`${relPath}:`).update(await readFile3(abs));
+    hash.update(`${relPath}:`).update(await readFile4(abs));
   });
   return hash.digest("hex");
 }
 async function walk(dir, visit, base = dir) {
-  const entries = await readdir2(dir, { withFileTypes: true }).catch(() => []);
+  const entries = await readdir3(dir, { withFileTypes: true }).catch(() => []);
   entries.sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of entries) {
     const abs = path5.join(dir, entry.name);
@@ -1843,6 +2199,30 @@ var BASE_CONNECTOR_CAPABILITIES = [
   "shell",
   "git"
 ];
+async function resolveConnectorScope(deviceId, launchConfig) {
+  const serverUrl = normalizeServerOrigin(getServerUrl(launchConfig));
+  const headers = { "Content-Type": "application/json" };
+  const oauthToken = launchConfig?.oauthToken?.trim();
+  const token = getConnectorToken(launchConfig);
+  if (oauthToken) headers.Authorization = `Bearer ${oauthToken}`;
+  if (token) headers["X-Buda-Connector-Token"] = token;
+  const response = await fetch(`${serverUrl}/api/connectors/scope`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ deviceId })
+  });
+  if (!response.ok) {
+    throw new Error(`/api/connectors/scope failed: ${response.status} ${await response.text()}`);
+  }
+  const result = await response.json();
+  if (typeof result.spaceId !== "string" || !result.spaceId.trim()) {
+    throw new Error("Connector scope response did not include spaceId");
+  }
+  return {
+    ...typeof result.connectorId === "string" ? { connectorId: result.connectorId } : {},
+    spaceId: result.spaceId.trim()
+  };
+}
 var browserAvailabilityWarningLogged = false;
 var getBrowserAvailabilityWarning = (browserAvailability) => browserAvailability.available ? null : `${browserAvailability.error} Browser automation is disabled, but shell, filesystem, Git, and coding capabilities remain available.`;
 var getAdvertisedCapabilities = (browserAvailability = resolveBrowserAvailability(), deviceToken) => [
@@ -1864,7 +2244,7 @@ async function buildPayload(config, extra) {
     deviceName: config.deviceName,
     hostLabel: config.hostLabel,
     platform: `${platform3()} ${release()}`,
-    version: "dev",
+    version: CONNECTOR_RUNTIME_VERSION,
     pid: process.pid,
     workdirRoot: config.workdirRoot,
     baseUrl: extra?.bunnyDaemon?.baseUrl,
@@ -1893,127 +2273,1064 @@ async function buildPayload(config, extra) {
     ...extra?.logs?.length ? { logs: extra.logs } : {},
     ...extra?.recovery ? { recovery: extra.recovery } : {}
   };
-}
-function buildAuthHeaders(config, launchConfig) {
-  const headers = {
-    "X-Buda-Connector-Id": config.connectorId
+}
+function buildAuthHeaders(config, launchConfig) {
+  const headers = {
+    "X-Buda-Connector-Id": config.connectorId
+  };
+  const token = config.token?.trim() || getConnectorToken(launchConfig);
+  const oauthToken = launchConfig?.oauthToken?.trim();
+  if (oauthToken) headers.Authorization = `Bearer ${oauthToken}`;
+  if (token) headers["X-Buda-Connector-Token"] = token;
+  if (config.deviceToken) headers["X-Buda-Connector-Device-Token"] = config.deviceToken;
+  return headers;
+}
+async function postJson(serverUrl, pathname, body, config, launchConfig) {
+  const response = await fetch(`${serverUrl}${pathname}`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...buildAuthHeaders(config, launchConfig)
+    },
+    body: JSON.stringify(body)
+  });
+  if (!response.ok) {
+    const text2 = await response.text().catch(() => "");
+    let errorCode;
+    let errorMessage3 = text2;
+    try {
+      const payload = JSON.parse(text2);
+      errorCode = typeof payload.code === "string" ? payload.code : void 0;
+      errorMessage3 = typeof payload.error === "string" ? payload.error : text2;
+    } catch {
+    }
+    if (errorCode === "device_revoked") {
+      throw new Error(
+        `This device is prohibited/revoked and cannot reconnect. Contact support. (${errorMessage3})`
+      );
+    }
+    throw new Error(`${pathname} failed: ${response.status} ${errorMessage3}`);
+  }
+  return await response.json();
+}
+function formatConnectorOwner(connector) {
+  return connector.userEmail ?? connector.userId ?? "anonymous";
+}
+async function warnIfStaleBundle(result) {
+  if (!result.bundle?.staleClient) return;
+  await writeLog(
+    "warn",
+    `connector bundle out of date \u2014 server expects ${result.bundle.expectedVersion ?? "newer"}; run \`pnpm up @buda-ai/connector\``
+  );
+}
+async function registerConnector(config, launchConfig, bunnyDaemon, options) {
+  const result = await postJson(
+    config.serverUrl,
+    "/api/connectors/register",
+    await buildPayload(config, {
+      bunnyDaemon,
+      ...options?.recoverMissingProfile ? { recovery: "missing_local_profile" } : {}
+    }),
+    config,
+    launchConfig
+  );
+  await writeLog(
+    "info",
+    `registered connector=${result.connector.connectorId} status=${result.connector.status} owner=${formatConnectorOwner(result.connector)}`
+  );
+  await warnIfStaleBundle(result);
+  return {
+    connectorId: result.connector.connectorId,
+    spaceId: result.connector.spaceId ?? result.spaceId,
+    relayProtocol: result.relayProtocol
+  };
+}
+async function heartbeatConnector(config, launchConfig, bunnyDaemon) {
+  const logs = takePendingLogs();
+  const result = await postJson(
+    config.serverUrl,
+    "/api/connectors/heartbeat",
+    await buildPayload(config, {
+      bunnyDaemon,
+      logs
+    }),
+    config,
+    launchConfig
+  ).catch((error) => {
+    restorePendingLogs(logs);
+    throw error;
+  });
+  return { relayProtocol: result.relayProtocol };
+}
+async function unregisterConnector(config, launchConfig) {
+  await postJson(
+    config.serverUrl,
+    "/api/connectors/unregister",
+    {
+      connectorId: config.connectorId
+    },
+    config,
+    launchConfig
+  ).catch((error) => {
+    void writeLog("warn", `unregister failed: ${error instanceof Error ? error.message : error}`);
+  });
+}
+
+// src/runtime-install.ts
+import { execFile } from "child_process";
+import { randomUUID as randomUUID4 } from "crypto";
+import { access, cp, mkdir as mkdir5, readFile as readFile5, rename as rename4, rm, writeFile as writeFile3 } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import path6 from "path";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var RUNTIME_INSTALL_TIMEOUT_MS = 5 * 6e4;
+var exists = async (filePath) => access(filePath).then(() => true).catch(() => false);
+var runtimeRoot = () => process.env.BUDA_CONNECTOR_RUNTIME_ROOT || path6.join(homedir3(), ".buda", "runtime");
+var runtimePlatformKey = `${process.platform}-${process.arch}-node${process.versions.modules}`;
+var versionDirectory = () => path6.join(runtimeRoot(), runtimePlatformKey, CONNECTOR_RUNTIME_VERSION);
+var manifestPath = () => path6.join(versionDirectory(), "runtime.json");
+var readRuntimeManifest = async () => {
+  try {
+    const parsed = JSON.parse(await readFile5(manifestPath(), "utf8"));
+    if (parsed.version !== CONNECTOR_RUNTIME_VERSION || !await exists(parsed.entrypoint) || !await exists(parsed.nodeExecutable)) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+};
+var writeManifest = async (directory, manifest) => {
+  await writeFile3(path6.join(directory, "runtime.json"), `${JSON.stringify(manifest, null, 2)}
+`, {
+    mode: 384
+  });
+};
+var validateRuntime = async (runtime) => {
+  const { stdout } = await execFileAsync(
+    runtime.nodeExecutable,
+    [...runtime.nodeArgs ?? [], runtime.entrypoint, "--help"],
+    { timeout: 15e3 }
+  );
+  if (!stdout.includes("Help: buda-connector")) {
+    throw new Error("Staged Connector runtime failed its CLI validation");
+  }
+};
+var installFromNpm = async (directory) => {
+  await mkdir5(directory, { recursive: true, mode: 448 });
+  await execFileAsync(
+    process.platform === "win32" ? "npm.cmd" : "npm",
+    [
+      "install",
+      "--ignore-scripts=false",
+      "--no-audit",
+      "--no-fund",
+      "--omit=dev",
+      "--prefix",
+      directory,
+      `@buda-ai/connector@${CONNECTOR_RUNTIME_VERSION}`
+    ],
+    { env: process.env, timeout: RUNTIME_INSTALL_TIMEOUT_MS }
+  );
+  const entrypoint = path6.join(
+    directory,
+    "node_modules",
+    "@buda-ai",
+    "connector",
+    "dist",
+    "cli.js"
+  );
+  const nodeExecutable = path6.join(directory, "node", path6.basename(process.execPath));
+  await mkdir5(path6.dirname(nodeExecutable), { recursive: true });
+  await cp(process.execPath, nodeExecutable, { force: true });
+  if (!await exists(entrypoint)) throw new Error("Installed Connector runtime is incomplete");
+  return { entrypoint, nodeExecutable, version: CONNECTOR_RUNTIME_VERSION };
+};
+var installFromBundledRuntime = async (directory, sourceRoot) => {
+  const sourceNode = process.env.BUDA_CONNECTOR_RUNTIME_NODE || process.execPath;
+  const sourceEntrypoint = process.env.BUDA_CONNECTOR_RUNTIME_ENTRYPOINT || process.argv[1];
+  if (!sourceEntrypoint) throw new Error("Bundled Connector runtime entrypoint is missing");
+  await cp(sourceRoot, directory, { recursive: true, force: true });
+  const relativeEntrypoint = path6.relative(sourceRoot, sourceEntrypoint);
+  if (relativeEntrypoint.startsWith("..") || path6.isAbsolute(relativeEntrypoint)) {
+    throw new Error("Bundled Connector entrypoint must be inside its runtime root");
+  }
+  const relativeNode = path6.relative(sourceRoot, sourceNode);
+  const entrypoint = path6.join(directory, relativeEntrypoint);
+  const nodeExecutable = relativeNode.startsWith("..") ? path6.join(directory, "node", path6.basename(sourceNode)) : path6.join(directory, relativeNode);
+  if (relativeNode.startsWith("..")) {
+    await mkdir5(path6.dirname(nodeExecutable), { recursive: true });
+    await cp(sourceNode, nodeExecutable, { force: true });
+  }
+  if (!await exists(entrypoint))
+    throw new Error("Copied Connector runtime entrypoint is missing");
+  return { entrypoint, nodeExecutable, version: CONNECTOR_RUNTIME_VERSION };
+};
+async function ensureStableConnectorRuntime() {
+  if (process.env.BUDA_CONNECTOR_SKIP_RUNTIME_STAGE === "1" || process.argv[1]?.endsWith(".ts")) {
+    const entrypoint = process.argv[1];
+    if (!entrypoint) throw new Error("Connector CLI entrypoint is missing");
+    return {
+      entrypoint,
+      ...entrypoint.endsWith(".ts") ? { nodeArgs: [...process.execArgv] } : {},
+      nodeExecutable: process.execPath,
+      version: CONNECTOR_RUNTIME_VERSION
+    };
+  }
+  const existing = await readRuntimeManifest();
+  if (existing) return existing;
+  const platformRoot = path6.join(runtimeRoot(), runtimePlatformKey);
+  await mkdir5(platformRoot, { recursive: true, mode: 448 });
+  return withExclusiveFileLock(
+    path6.join(platformRoot, `install-${CONNECTOR_RUNTIME_VERSION}`),
+    async () => {
+      const installed = await readRuntimeManifest();
+      if (installed) return installed;
+      const temporary = path6.join(
+        platformRoot,
+        `.${CONNECTOR_RUNTIME_VERSION}.${randomUUID4()}.tmp`
+      );
+      await rm(temporary, { recursive: true, force: true });
+      try {
+        const bundledSource = process.env.BUDA_CONNECTOR_BUNDLED_RUNTIME_ROOT;
+        const manifest = bundledSource ? await installFromBundledRuntime(temporary, bundledSource) : await installFromNpm(temporary);
+        await validateRuntime(manifest);
+        const finalDirectory = versionDirectory();
+        const rebased = {
+          ...manifest,
+          entrypoint: path6.join(finalDirectory, path6.relative(temporary, manifest.entrypoint)),
+          nodeExecutable: path6.join(
+            finalDirectory,
+            path6.relative(temporary, manifest.nodeExecutable)
+          )
+        };
+        await writeManifest(temporary, rebased);
+        await rm(finalDirectory, { recursive: true, force: true });
+        await rename4(temporary, finalDirectory);
+        return rebased;
+      } catch (error) {
+        await rm(temporary, { recursive: true, force: true });
+        throw error;
+      }
+    },
+    { timeoutMs: RUNTIME_INSTALL_TIMEOUT_MS }
+  );
+}
+
+// src/daemon-client.ts
+var START_TIMEOUT_MS = 45e3;
+var BOOTSTRAP_TIMEOUT_MS = 5 * 6e4;
+var POLL_INTERVAL_MS = 250;
+var wait2 = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
+var getConfigRoot = () => process.env.BUDA_CONNECTOR_CONFIG_ROOT;
+var readLiveStatus = async (config, configRoot = getConfigRoot(), timeoutMs) => requestDaemonControl(config, "status", configRoot, { timeoutMs }).catch(() => null);
+var isProcessAlive2 = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return !(typeof error === "object" && error !== null && "code" in error && error.code === "ESRCH");
+  }
+};
+var getRuntimeCommandArgs = (runtime, mode) => [
+  ...runtime.nodeArgs ?? [],
+  runtime.entrypoint,
+  "daemon",
+  "--internal-daemon",
+  "--daemon-mode",
+  mode,
+  "--plain"
+];
+var compareVersions = (left, right) => {
+  const leftParts = left.split(/[.-]/).map((part) => Number.parseInt(part, 10) || 0);
+  const rightParts = right.split(/[.-]/).map((part) => Number.parseInt(part, 10) || 0);
+  for (let index = 0; index < Math.max(leftParts.length, rightParts.length); index += 1) {
+    const difference = (leftParts[index] ?? 0) - (rightParts[index] ?? 0);
+    if (difference !== 0) return difference;
+  }
+  return 0;
+};
+var shouldReplaceDaemonVersion = (runningVersion, candidateVersion) => compareVersions(candidateVersion, runningVersion) > 0;
+var waitForDaemon = async (launchConfig, deadline) => {
+  let lastConfig = null;
+  while (Date.now() < deadline) {
+    lastConfig = await readDeviceConfig(launchConfig, getConfigRoot());
+    if (lastConfig) {
+      const status = await readLiveStatus(lastConfig);
+      if (status) return { config: lastConfig, status };
+    }
+    await wait2(POLL_INTERVAL_MS);
+  }
+  throw new Error(
+    lastConfig ? "Connector daemon did not expose its control channel in time" : "Connector registration did not create a canonical local identity in time"
+  );
+};
+var spawnInternalDaemon = async (launchConfig, mode, preparedRuntime) => {
+  const runtime = preparedRuntime ?? await ensureStableConnectorRuntime();
+  const child = spawn(runtime.nodeExecutable, getRuntimeCommandArgs(runtime, mode), {
+    detached: true,
+    env: {
+      ...process.env,
+      BUDA_CONNECTOR_INTERNAL_LAUNCH_CONFIG: JSON.stringify(launchConfig ?? {})
+    },
+    stdio: "ignore",
+    windowsHide: true
+  });
+  child.unref();
+};
+var stopOlderIdleDaemon = async (config, status) => {
+  if (!shouldReplaceDaemonVersion(status.version, CONNECTOR_RUNTIME_VERSION)) return false;
+  if (!status.idle) return false;
+  const stopStatus = await requestDaemonControl(config, "stop-if-idle", getConfigRoot());
+  if (!stopStatus.idle) return false;
+  const deadline = Date.now() + 1e4;
+  while (Date.now() < deadline) {
+    if (!await readLiveStatus(config)) return true;
+    await wait2(POLL_INTERVAL_MS);
+  }
+  throw new Error("Older Connector daemon did not stop cleanly; existing identity was preserved");
+};
+async function ensureConnectorDaemon(launchConfig, mode) {
+  const deviceId = await getOrCreateSystemDeviceId(getConfigRoot());
+  const scope = await resolveConnectorScope(deviceId, launchConfig);
+  launchConfig = { ...launchConfig, spaceId: scope.spaceId };
+  const bootstrapTarget = getConnectorBootstrapLockTarget(launchConfig, getConfigRoot());
+  await mkdir6(path7.dirname(bootstrapTarget), { recursive: true, mode: 448 });
+  const bootstrapLock = await acquireExclusiveFileLock(bootstrapTarget, {
+    timeoutMs: BOOTSTRAP_TIMEOUT_MS
+  });
+  try {
+    const existingConfig = await readDeviceConfig(launchConfig, getConfigRoot());
+    if (existingConfig) {
+      const existingStatus = await readLiveStatus(existingConfig);
+      if (existingStatus) {
+        const preparedRuntime = !shouldReplaceDaemonVersion(existingStatus.version, CONNECTOR_RUNTIME_VERSION) || !existingStatus.idle ? void 0 : await ensureStableConnectorRuntime();
+        const replaced = await stopOlderIdleDaemon(existingConfig, existingStatus);
+        if (!replaced) {
+          const status = mode === "persistent" ? await requestDaemonControl(existingConfig, "persist", getConfigRoot()) : existingStatus;
+          return { config: existingConfig, status };
+        }
+        await spawnInternalDaemon(launchConfig, mode, preparedRuntime);
+        return await waitForDaemon(launchConfig, Date.now() + START_TIMEOUT_MS);
+      }
+      const persistedStatus = await readPersistedDaemonStatus(
+        existingConfig,
+        getConfigRoot()
+      ).catch(() => null);
+      if (persistedStatus && isProcessAlive2(persistedStatus.pid)) {
+        throw new Error(
+          `Connector daemon PID ${persistedStatus.pid} is running but its local control channel is not responding. Stop that process and retry.`
+        );
+      }
+    }
+    await spawnInternalDaemon(launchConfig, mode);
+    return await waitForDaemon(launchConfig, Date.now() + START_TIMEOUT_MS);
+  } finally {
+    await bootstrapLock.release();
+  }
+}
+var streamDaemonLogs = (options) => {
+  const logPath = getConnectorPaths(options.serverUrl, getConfigRoot()).logPath;
+  let activePath = "";
+  let seenLines = 0;
+  const poll = async () => {
+    const datedPath = getDatedConnectorLogPath(logPath);
+    const raw = await readFile6(datedPath, "utf8").catch(() => "");
+    const lines = raw.split("\n").filter(Boolean);
+    if (datedPath !== activePath || lines.length < seenLines) {
+      activePath = datedPath;
+      seenLines = 0;
+    }
+    for (const line of lines.slice(seenLines)) {
+      try {
+        const entry = JSON.parse(line);
+        const connectorId = entry.metadata?.connectorId;
+        if (options.dashboardActive && typeof connectorId === "string") {
+          const output2 = entry.metadata?.source === "daemon-console" ? entry.message : `[buda-connector] ${entry.message}`;
+          appendConnectorDashboardLog(connectorId, entry.level, output2);
+          continue;
+        }
+        if (connectorId !== options.connectorId) continue;
+        const output = entry.metadata?.source === "daemon-console" ? entry.message : `[buda-connector] ${entry.message}`;
+        if (entry.level === "error") console.error(output);
+        else if (entry.level === "warn") console.warn(output);
+        else console.log(output);
+      } catch {
+        if (options.plain) console.log(line);
+      }
+    }
+    seenLines = lines.length;
+  };
+  void poll();
+  const timer = setInterval(() => void poll(), 500);
+  return () => clearInterval(timer);
+};
+var toDashboardConnector = (config, status) => ({
+  agent: status ? status.idle ? "Ready" : "Busy" : "Stopped",
+  connectorId: config.connectorId,
+  heartbeat: status?.lastHeartbeatAt ? `OK ${new Date(status.lastHeartbeatAt).toLocaleTimeString("en-GB", { hour12: false })}` : status ? "Waiting" : "Stopped",
+  relay: status?.relayConnected ? "Connected" : "Disconnected",
+  serverUrl: config.serverUrl,
+  spaceId: config.spaceId ?? "Unknown",
+  status: status ? status.relayConnected ? "Online" : "Running" : "Stopped"
+});
+async function readLocalConnectorDashboardRows(configRoot = getConfigRoot()) {
+  const configs = await listDeviceConfigs(configRoot);
+  const persistedStatuses = await listPersistedDaemonStatuses(configRoot);
+  const persistedByIdentity = new Map(
+    persistedStatuses.map((status) => [
+      `${normalizeServerOrigin(status.serverUrl)}
+${status.connectorId}`,
+      status
+    ])
+  );
+  const identities = /* @__PURE__ */ new Map();
+  for (const config of configs) {
+    identities.set(`${normalizeServerOrigin(config.serverUrl)}
+${config.connectorId}`, {
+      identity: config,
+      stored: true
+    });
+  }
+  for (const status of persistedStatuses) {
+    const key = `${normalizeServerOrigin(status.serverUrl)}
+${status.connectorId}`;
+    if (!identities.has(key)) {
+      identities.set(key, { identity: status, stored: false });
+    }
+  }
+  const rows = await Promise.all(
+    [...identities.entries()].map(async ([key, { identity, stored }]) => {
+      const status = await readLiveStatus(identity, configRoot, 1500);
+      if (status) return toDashboardConnector(identity, status);
+      const persistedStatus = persistedByIdentity.get(key) ?? await readPersistedDaemonStatus(identity, configRoot).catch(() => null);
+      const row = toDashboardConnector(identity, null);
+      if (!stored && (!persistedStatus || !isProcessAlive2(persistedStatus.pid))) return null;
+      return persistedStatus && isProcessAlive2(persistedStatus.pid) ? { ...row, status: "Unresponsive" } : row;
+    })
+  );
+  return rows.filter((row) => row !== null);
+}
+async function stopLocalConnectorDaemon(connectorId, serverUrl, configRoot = getConfigRoot()) {
+  const configs = await listDeviceConfigs(configRoot);
+  const persistedStatuses = await listPersistedDaemonStatuses(configRoot);
+  const serverOrigin = normalizeServerOrigin(serverUrl);
+  const config = [...configs, ...persistedStatuses].find(
+    (candidate) => candidate.connectorId === connectorId && normalizeServerOrigin(candidate.serverUrl) === serverOrigin
+  );
+  if (!config) throw new Error(`Local Connector ${connectorId} was not found`);
+  const status = await readLiveStatus(config, configRoot);
+  if (!status) return;
+  await requestDaemonControl(config, "stop", configRoot);
+}
+async function stopAllLocalConnectorDaemons(configRoot = getConfigRoot()) {
+  const configs = await listDeviceConfigs(configRoot);
+  const persistedStatuses = await listPersistedDaemonStatuses(configRoot);
+  const identities = /* @__PURE__ */ new Map();
+  for (const config of [...configs, ...persistedStatuses]) {
+    identities.set(`${normalizeServerOrigin(config.serverUrl)}
+${config.connectorId}`, config);
+  }
+  const results = await Promise.allSettled(
+    [...identities.values()].map(async (config) => {
+      const status = await readLiveStatus(config, configRoot);
+      if (status) await requestDaemonControl(config, "stop", configRoot);
+    })
+  );
+  const failures = results.filter((result) => result.status === "rejected");
+  if (failures.length) {
+    throw new Error(`Failed to stop ${failures.length} local Connector daemon(s)`);
+  }
+}
+var waitForConnectorViewerExit = async (dashboardClosed) => {
+  let finishSignal = () => void 0;
+  const signal = new Promise((resolve) => {
+    finishSignal = resolve;
+  });
+  process.once("SIGINT", finishSignal);
+  process.once("SIGTERM", finishSignal);
+  await (dashboardClosed ? Promise.race([dashboardClosed, signal]) : signal);
+  process.off("SIGINT", finishSignal);
+  process.off("SIGTERM", finishSignal);
+};
+async function runConnectorDashboard(launchConfig, options = {}) {
+  let finishDashboard = () => void 0;
+  const dashboardClosed = new Promise((resolve) => {
+    finishDashboard = resolve;
+  });
+  const dashboard = startConnectorConsoleDashboard({
+    manager: {
+      onExit: finishDashboard,
+      onStopAll: () => stopAllLocalConnectorDaemons(),
+      onStopConnector: (connectorId, serverUrl) => stopLocalConnectorDaemon(connectorId, serverUrl)
+    },
+    plain: options.plain
+  });
+  if (!dashboard) {
+    const { config } = await ensureConnectorDaemon(launchConfig, "persistent");
+    const stopLogs2 = streamDaemonLogs({
+      connectorId: config.connectorId,
+      dashboardActive: false,
+      plain: Boolean(options.plain),
+      serverUrl: config.serverUrl
+    });
+    if (!process.stdin.isTTY) {
+      stopLogs2();
+      console.log(`Buda Connector ${config.connectorId} is running in the background.`);
+      return;
+    }
+    await waitForConnectorViewerExit();
+    stopLogs2();
+    return;
+  }
+  const pendingConnectorId = `pending:${normalizeServerOrigin(getServerUrl(launchConfig))}`;
+  let pendingConnector = {
+    agent: "Starting",
+    connectorId: pendingConnectorId,
+    heartbeat: "Waiting",
+    label: "New Connector",
+    relay: "Connecting",
+    serverUrl: getServerUrl(launchConfig),
+    spaceId: "Resolving Space",
+    status: "Connecting"
+  };
+  let preferredConnectorId = pendingConnectorId;
+  let bootstrapSettled = false;
+  const stopLogs = streamDaemonLogs({
+    dashboardActive: true,
+    plain: false,
+    serverUrl: getServerUrl(launchConfig)
+  });
+  let refreshing = false;
+  const refresh = async () => {
+    if (refreshing) return;
+    refreshing = true;
+    try {
+      const connectors = await readLocalConnectorDashboardRows();
+      updateConnectorDashboardConnectors(
+        pendingConnector ? [...connectors, pendingConnector] : connectors,
+        preferredConnectorId
+      );
+    } finally {
+      refreshing = false;
+    }
+  };
+  updateConnectorDashboardConnectors([pendingConnector], pendingConnectorId);
+  void readDeviceConfig(launchConfig, getConfigRoot()).then((config) => {
+    if (!config) return;
+    pendingConnector = void 0;
+    preferredConnectorId = config.connectorId;
+  }).catch(() => void 0).finally(() => refresh());
+  const timer = setInterval(() => void refresh(), 1e3);
+  void ensureConnectorDaemon(launchConfig, "persistent").then(async ({ config }) => {
+    pendingConnector = void 0;
+    preferredConnectorId = config.connectorId;
+    await refresh();
+  }).catch(async (error) => {
+    const config = await readDeviceConfig(launchConfig, getConfigRoot()).catch(() => null);
+    const message = `connector startup failed: ${error instanceof Error ? error.message : String(error)}`;
+    if (config) {
+      pendingConnector = void 0;
+      preferredConnectorId = config.connectorId;
+      appendConnectorDashboardLog(config.connectorId, "error", `[buda-connector] ${message}`);
+      await refresh();
+    } else {
+      pendingConnector = {
+        ...pendingConnector,
+        agent: "Error",
+        heartbeat: "Failed",
+        relay: "Failed",
+        status: "Error"
+      };
+      appendConnectorDashboardLog(pendingConnectorId, "error", `[buda-connector] ${message}`);
+      await refresh();
+    }
+  }).finally(() => {
+    bootstrapSettled = true;
+  });
+  await waitForConnectorViewerExit(dashboardClosed);
+  clearInterval(timer);
+  stopLogs();
+  dashboard.stop();
+  if (!bootstrapSettled) process.exit(0);
+}
+async function runDesktopConnectorController(launchConfig) {
+  const { config } = await ensureConnectorDaemon(launchConfig, "transient");
+  if (!config.spaceId?.trim()) {
+    throw new Error("Connector scope did not resolve a canonical spaceId");
+  }
+  const lease = await holdDaemonControl(config, getConfigRoot());
+  process.stdout.write(
+    `${JSON.stringify({
+      type: "buda-connector-ready",
+      connectorId: lease.status.connectorId,
+      pid: lease.status.pid,
+      spaceId: lease.status.spaceId
+    })}
+`
+  );
+  const stopped = new Promise((resolve) => {
+    process.once("SIGINT", resolve);
+    process.once("SIGTERM", resolve);
+    process.stdin.once("end", resolve);
+    process.stdin.once("close", resolve);
+    if (process.stdin.readableEnded || process.stdin.destroyed) resolve();
+  });
+  await Promise.race([lease.closed, stopped]);
+  lease.close();
+}
+async function releaseDesktopConnector(launchConfig) {
+  if (!launchConfig?.spaceId?.trim()) return;
+  const config = await readDeviceConfig(launchConfig, getConfigRoot());
+  if (!config) return;
+  await requestDaemonControl(config, "release", getConfigRoot()).catch(() => void 0);
+}
+var getInternalLaunchConfig = () => {
+  const raw = process.env.BUDA_CONNECTOR_INTERNAL_LAUNCH_CONFIG;
+  if (!raw) return void 0;
+  return JSON.parse(raw);
+};
+var getDaemonModeFlag = () => {
+  const index = process.argv.indexOf("--daemon-mode");
+  return process.argv[index + 1] === "transient" ? "transient" : "persistent";
+};
+
+// src/onboard.ts
+import { cancel, intro, isCancel, log, note, outro, spinner, text } from "@clack/prompts";
+
+// src/bunny-daemon.ts
+import { mkdir as mkdir7 } from "fs/promises";
+import { createDaemon } from "@bunny-agent/daemon";
+
+// src/terminal.ts
+import { randomBytes as randomBytes3 } from "crypto";
+import { chmod as chmod3, stat as stat3 } from "fs/promises";
+import { createRequire } from "module";
+import path8 from "path";
+import WebSocket, { WebSocketServer } from "ws";
+var TERMINAL_IDLE_TTL_MS = 10 * 6e4;
+var TERMINAL_HANDSHAKE_TIMEOUT_MS = 1e4;
+var LOCAL_TERMINAL_GRANT_TTL_MS = 3e4;
+var LOCAL_TERMINAL_CLOSE_SPAWN_FAILED = 4401;
+var MAX_BUFFER_CHUNKS = 1e3;
+var MAX_TERMINAL_FRAME_BYTES = 1024 * 1024;
+var require2 = createRequire(import.meta.url);
+var ensureNodePtySpawnHelperExecutable = async (options = {}) => {
+  const platform4 = options.platform ?? process.platform;
+  if (platform4 !== "darwin") return;
+  const arch = options.arch ?? process.arch;
+  const entryPath = options.entryPath ?? require2.resolve("node-pty");
+  const packageRoot = path8.dirname(path8.dirname(entryPath));
+  const helperPath = path8.join(packageRoot, "prebuilds", `${platform4}-${arch}`, "spawn-helper");
+  const helper = await stat3(helperPath);
+  if ((helper.mode & 64) === 0) await chmod3(helperPath, helper.mode | 64);
+};
+var loadNodePty = async () => {
+  await ensureNodePtySpawnHelperExecutable();
+  return import("node-pty");
+};
+var normalizeTerminalCloseCode = (code, fallback = 1011) => code >= 1e3 && code <= 1014 && ![1004, 1005, 1006].includes(code) || code >= 3e3 && code <= 4999 ? code : fallback;
+var truncateTerminalCloseReason = (reason, maxBytes = 120) => {
+  let result = reason;
+  while (Buffer.byteLength(result, "utf8") > maxBytes) result = result.slice(0, -1);
+  return result;
+};
+var sessions2 = /* @__PURE__ */ new Map();
+var localGrants = /* @__PURE__ */ new Map();
+var installedServers = /* @__PURE__ */ new WeakSet();
+var isSafeId = (value) => typeof value === "string" && /^[A-Za-z0-9_.:-]{1,160}$/.test(value);
+var parseDimension = (value, fallback, min, max) => typeof value === "number" && Number.isSafeInteger(value) ? Math.max(min, Math.min(max, value)) : fallback;
+var parseConnectorTerminalRequest = (request) => {
+  if (request.method !== "CONNECT" || request.path !== "/api/terminal") {
+    throw new Error("Invalid connector terminal request.");
+  }
+  if (!request.body || typeof request.body !== "object" || Array.isArray(request.body)) {
+    throw new Error("Connector terminal request body is invalid.");
+  }
+  const body = request.body;
+  if (!isSafeId(body.sessionId) || !isSafeId(body.tabId)) {
+    throw new Error("Connector terminal session identity is invalid.");
+  }
+  if (typeof body.token !== "string" || body.token.length < 32 || body.token.length > 2048) {
+    throw new Error("Connector terminal token is invalid.");
+  }
+  return {
+    sessionId: body.sessionId,
+    tabId: body.tabId,
+    token: body.token,
+    cols: parseDimension(body.cols, 80, 10, 500),
+    rows: parseDimension(body.rows, 24, 5, 200)
+  };
+};
+var clearIdleTimer = (session) => {
+  if (!session.idleTimer) return;
+  clearTimeout(session.idleTimer);
+  session.idleTimer = null;
+};
+var scheduleIdleCleanup = (sessionKey, session) => {
+  clearIdleTimer(session);
+  session.idleTimer = setTimeout(() => {
+    if (session.clients.size > 0 || sessions2.get(sessionKey) !== session) return;
+    sessions2.delete(sessionKey);
+    try {
+      session.pty.kill();
+    } catch {
+    }
+  }, TERMINAL_IDLE_TTL_MS);
+  session.idleTimer.unref();
+};
+var sendJson = (socket, value) => {
+  if (socket.readyState === WebSocket.OPEN) socket.send(JSON.stringify(value));
+};
+var LocalTerminalUnavailableError = class extends Error {
+};
+var serializeErrorMessage = (error) => error instanceof Error ? error.message : "Unknown error";
+var createTerminalSession = async (grant, nodePtyLoader) => {
+  let nodePty;
+  try {
+    nodePty = await nodePtyLoader();
+  } catch (error) {
+    void writeLog(
+      "error",
+      `local terminal could not load node-pty: ${serializeErrorMessage(error)}`
+    );
+    throw new LocalTerminalUnavailableError(
+      "Local terminal is unavailable because node-pty could not be loaded. The connector remains available for other capabilities."
+    );
+  }
+  const shell = process.platform === "win32" ? "powershell.exe" : process.env.SHELL || "/bin/bash";
+  const shellArgs = process.platform === "win32" ? [] : ["-l"];
+  let pty;
+  try {
+    pty = nodePty.spawn(shell, shellArgs, {
+      name: "xterm-256color",
+      cols: grant.cols,
+      rows: grant.rows,
+      cwd: path8.resolve(grant.cwd),
+      env: { ...process.env, TERM: "xterm-256color" }
+    });
+  } catch (error) {
+    const message = serializeErrorMessage(error);
+    void writeLog(
+      "error",
+      `local terminal failed to spawn shell=${shell} cwd=${grant.cwd}: ${message}`
+    );
+    throw new LocalTerminalUnavailableError(
+      "Local terminal is unavailable because node-pty could not start a shell. The connector remains available for other capabilities."
+    );
+  }
+  const session = {
+    pty,
+    clients: /* @__PURE__ */ new Set(),
+    buffer: [],
+    cols: grant.cols,
+    rows: grant.rows,
+    idleTimer: null
+  };
+  sessions2.set(grant.sessionKey, session);
+  pty.onData((data) => {
+    session.buffer.push(data);
+    if (session.buffer.length > MAX_BUFFER_CHUNKS) session.buffer.shift();
+    for (const socket of session.clients) {
+      if (socket.readyState === WebSocket.OPEN) socket.send(data);
+    }
+  });
+  pty.onExit(({ exitCode }) => {
+    if (sessions2.get(grant.sessionKey) === session) sessions2.delete(grant.sessionKey);
+    clearIdleTimer(session);
+    for (const socket of session.clients) {
+      sendJson(socket, { type: "status", message: `exited (code ${exitCode})` });
+      socket.close(1e3, "Terminal exited");
+    }
+    session.clients.clear();
+  });
+  return session;
+};
+var attachLocalTerminal = async (socket, grant, nodePtyLoader) => {
+  const pendingMessages = [];
+  let session;
+  let started = false;
+  const handleMessage = (data) => {
+    if (!session) {
+      pendingMessages.push(data);
+      return;
+    }
+    try {
+      const message = JSON.parse(data);
+      if (message.type === "bridge-start") {
+        if (!started) {
+          started = true;
+          sendJson(socket, { type: "status", message: "connected" });
+          for (const chunk of session.buffer) socket.send(chunk);
+        }
+        return;
+      }
+      if (message.type === "input" && typeof message.data === "string") {
+        session.pty.write(message.data);
+        return;
+      }
+      if (message.type === "resize") {
+        const cols = parseDimension(message.cols, session.cols, 10, 500);
+        const rows = parseDimension(message.rows, session.rows, 5, 200);
+        if (cols !== session.cols || rows !== session.rows) {
+          session.cols = cols;
+          session.rows = rows;
+          session.pty.resize(cols, rows);
+        }
+        return;
+      }
+    } catch {
+    }
+    session.pty.write(data);
+  };
+  socket.on("message", (raw) => handleMessage(raw.toString()));
+  session = sessions2.get(grant.sessionKey);
+  if (!session) session = await createTerminalSession(grant, nodePtyLoader);
+  else clearIdleTimer(session);
+  session.clients.add(socket);
+  for (const data of pendingMessages.splice(0)) handleMessage(data);
+  const detach = () => {
+    if (!session) return;
+    session.clients.delete(socket);
+    if (session.clients.size === 0) scheduleIdleCleanup(grant.sessionKey, session);
+  };
+  socket.once("close", detach);
+  socket.once("error", detach);
+};
+var installConnectorTerminalEndpoint = (server, options = {}) => {
+  if (installedServers.has(server)) return;
+  installedServers.add(server);
+  const terminalServer = new WebSocketServer({ noServer: true });
+  server.on("upgrade", (request, socket, head) => {
+    const url = new URL(request.url ?? "/", "http://connector.local");
+    if (url.pathname !== "/api/terminal") return;
+    const tokenHeader = request.headers["x-buda-local-terminal-token"];
+    const token = Array.isArray(tokenHeader) ? tokenHeader[0] : tokenHeader;
+    const grant = token ? localGrants.get(token) : void 0;
+    if (!token || !grant || grant.expiresAt <= Date.now()) {
+      if (token) localGrants.delete(token);
+      socket.destroy();
+      return;
+    }
+    localGrants.delete(token);
+    terminalServer.handleUpgrade(request, socket, head, (client) => {
+      void attachLocalTerminal(client, grant, options.nodePtyLoader ?? loadNodePty).catch(
+        (error) => {
+          const message = error instanceof LocalTerminalUnavailableError ? error.message : "Local terminal is unavailable. The connector remains available for other capabilities.";
+          sendJson(client, { type: "error", fatal: true, message });
+          client.close(LOCAL_TERMINAL_CLOSE_SPAWN_FAILED, "Local terminal unavailable");
+        }
+      );
+    });
+  });
+  server.once("close", () => {
+    for (const client of terminalServer.clients) client.terminate();
+    terminalServer.close();
+    localGrants.clear();
+    for (const session of sessions2.values()) {
+      clearIdleTimer(session);
+      try {
+        session.pty.kill();
+      } catch {
+      }
+    }
+    sessions2.clear();
+  });
+};
+var registerLocalTerminal = (input) => {
+  if (!isSafeId(input.workspaceKey) || !isSafeId(input.tabId)) {
+    throw new Error("Invalid local terminal workspace session.");
+  }
+  const token = randomBytes3(32).toString("base64url");
+  localGrants.set(token, {
+    sessionKey: `${input.workspaceKey}:${input.tabId}`,
+    workspaceKey: input.workspaceKey,
+    cwd: input.cwd,
+    cols: input.cols,
+    rows: input.rows,
+    expiresAt: Date.now() + LOCAL_TERMINAL_GRANT_TTL_MS
+  });
+  const cleanupTimer = setTimeout(() => localGrants.delete(token), LOCAL_TERMINAL_GRANT_TTL_MS);
+  cleanupTimer.unref();
+  return token;
+};
+var toLocalTerminalUrl = (baseUrl) => {
+  const url = new URL("/api/terminal", baseUrl);
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  return url.toString();
+};
+var connectSocket = async (socket) => new Promise((resolve, reject) => {
+  const onOpen = () => {
+    socket.removeListener("error", onError);
+    resolve();
+  };
+  const onError = (error) => {
+    socket.removeListener("open", onOpen);
+    reject(error);
+  };
+  socket.once("open", onOpen);
+  socket.once("error", onError);
+});
+var proxyConnectorTerminalTunnel = async (input) => {
+  const cloud = new WebSocket(
+    getConnectorTerminalUrl(input.serverUrl, input.connectorId, input.sessionId),
+    {
+      headers: { "X-Buda-Terminal-Token": input.cloudToken },
+      handshakeTimeout: TERMINAL_HANDSHAKE_TIMEOUT_MS
+    }
+  );
+  const local = new WebSocket(toLocalTerminalUrl(input.localBaseUrl), {
+    headers: { "X-Buda-Local-Terminal-Token": input.localToken },
+    handshakeTimeout: TERMINAL_HANDSHAKE_TIMEOUT_MS
+  });
+  try {
+    await Promise.all([connectSocket(cloud), connectSocket(local)]);
+  } catch (error) {
+    cloud.terminate();
+    local.terminate();
+    throw error;
+  }
+  let bridgeAccepted = false;
+  let activityEnded = false;
+  const endActivity = () => {
+    if (activityEnded) return;
+    activityEnded = true;
+    input.onActivityEnd?.();
   };
-  const token = config.token?.trim() || getConnectorToken(launchConfig);
-  if (token) headers["X-Buda-Connector-Token"] = token;
-  if (config.deviceToken) headers["X-Buda-Connector-Device-Token"] = config.deviceToken;
-  return headers;
-}
-async function postJson(serverUrl, pathname, body, config, launchConfig) {
-  const response = await fetch(`${serverUrl}${pathname}`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      ...buildAuthHeaders(config, launchConfig)
-    },
-    body: JSON.stringify(body)
+  let pendingBytes = 0;
+  const pendingCloudFrames = [];
+  const pendingLocalFrames = [];
+  const bufferFrame = (frames, data, isBinary) => {
+    const bytes = Array.isArray(data) ? data.reduce((total, chunk) => total + chunk.byteLength, 0) : data.byteLength;
+    if (pendingBytes + bytes > MAX_TERMINAL_FRAME_BYTES) {
+      cloud.close(1009, "Terminal handshake buffer too large");
+      local.close(1009, "Terminal handshake buffer too large");
+      return false;
+    }
+    pendingBytes += bytes;
+    frames.push([data, isBinary]);
+    return true;
+  };
+  cloud.on("message", (data, isBinary) => {
+    if (!bridgeAccepted) {
+      if (!isBinary && data.toString() === '{"type":"bridge-accepted"}') {
+        bridgeAccepted = true;
+        local.send(JSON.stringify({ type: "bridge-start" }));
+        for (const [frame, binary] of pendingCloudFrames) {
+          if (local.readyState === WebSocket.OPEN) local.send(frame, { binary });
+        }
+        for (const [frame, binary] of pendingLocalFrames) {
+          if (cloud.readyState === WebSocket.OPEN) cloud.send(frame, { binary });
+        }
+        pendingCloudFrames.length = 0;
+        pendingLocalFrames.length = 0;
+        pendingBytes = 0;
+        return;
+      }
+      bufferFrame(pendingCloudFrames, data, isBinary);
+      return;
+    }
+    if (local.readyState === WebSocket.OPEN) local.send(data, { binary: isBinary });
   });
-  if (!response.ok) {
-    const text2 = await response.text().catch(() => "");
-    let errorCode;
-    let errorMessage3 = text2;
-    try {
-      const payload = JSON.parse(text2);
-      errorCode = typeof payload.code === "string" ? payload.code : void 0;
-      errorMessage3 = typeof payload.error === "string" ? payload.error : text2;
-    } catch {
+  local.on("message", (data, isBinary) => {
+    if (!bridgeAccepted) {
+      bufferFrame(pendingLocalFrames, data, isBinary);
+      return;
     }
-    if (errorCode === "device_revoked") {
-      throw new Error(
-        `This device is prohibited/revoked and cannot reconnect. Contact support. (${errorMessage3})`
+    if (cloud.readyState === WebSocket.OPEN) cloud.send(data, { binary: isBinary });
+  });
+  cloud.once("close", (code, reason) => {
+    endActivity();
+    if (!bridgeAccepted) {
+      void writeLog(
+        "warn",
+        `terminal cloud tunnel closed before readiness session=${input.sessionId} code=${code} reason=${truncateTerminalCloseReason(reason.toString())}`
       );
     }
-    throw new Error(`${pathname} failed: ${response.status} ${errorMessage3}`);
-  }
-  return await response.json();
-}
-function formatConnectorOwner(connector) {
-  return connector.userEmail ?? connector.userId ?? "anonymous";
-}
-async function warnIfStaleBundle(result) {
-  if (!result.bundle?.staleClient) return;
-  await writeLog(
-    "warn",
-    `connector bundle out of date \u2014 server expects ${result.bundle.expectedVersion ?? "newer"}; run \`pnpm up @buda-ai/connector\``
-  );
-}
-async function registerConnector(config, launchConfig, bunnyDaemon, options) {
-  const result = await postJson(
-    config.serverUrl,
-    "/api/connectors/register",
-    await buildPayload(config, {
-      bunnyDaemon,
-      ...options?.recoverMissingProfile ? { recovery: "missing_local_profile" } : {}
-    }),
-    config,
-    launchConfig
-  );
+    if (local.readyState === WebSocket.OPEN) {
+      local.close(normalizeTerminalCloseCode(code), truncateTerminalCloseReason(reason.toString()));
+    }
+  });
+  local.once("close", (code, reason) => {
+    endActivity();
+    if (cloud.readyState === WebSocket.OPEN) {
+      cloud.close(normalizeTerminalCloseCode(code), truncateTerminalCloseReason(reason.toString()));
+    }
+  });
+  cloud.once("error", () => local.terminate());
+  local.once("error", () => cloud.terminate());
+  input.onActivityStart?.();
+  cloud.send(JSON.stringify({ type: "bridge-ready" }));
   await writeLog(
     "info",
-    `registered connector=${result.connector.connectorId} status=${result.connector.status} owner=${formatConnectorOwner(result.connector)}`
+    `terminal proxy connected session=${input.sessionId} workspace=${input.workspaceKey}`
   );
-  await warnIfStaleBundle(result);
+};
+
+// src/bunny-daemon.ts
+async function startEmbeddedBunnyDaemon(config, launchConfig) {
+  const host = getBunnyDaemonHost(launchConfig);
+  const port = getBunnyDaemonPort(launchConfig);
+  const root = config.workdirRoot;
+  await mkdir7(root, { recursive: true });
+  const server = createDaemon({ host, port, root });
+  installConnectorTerminalEndpoint(server);
+  await new Promise((resolve, reject) => {
+    const onError = (error) => {
+      server.off("listening", onListening);
+      reject(error);
+    };
+    const onListening = () => {
+      server.off("error", onError);
+      resolve();
+    };
+    server.once("error", onError);
+    server.once("listening", onListening);
+    server.listen(port, host);
+  });
+  const address = server.address();
+  const actualPort = typeof address === "object" && address ? address.port : port;
+  const baseUrl = `http://${host}:${actualPort}`;
+  await writeLog("info", `bunny daemon listening ${baseUrl}`, {
+    root
+  });
   return {
-    connectorId: result.connector.connectorId,
-    relayProtocol: result.relayProtocol
+    server,
+    host,
+    port: actualPort,
+    baseUrl,
+    root
   };
 }
-async function heartbeatConnector(config, launchConfig, bunnyDaemon) {
-  const logs = takePendingLogs();
-  const result = await postJson(
-    config.serverUrl,
-    "/api/connectors/heartbeat",
-    await buildPayload(config, {
-      bunnyDaemon,
-      logs
-    }),
-    config,
-    launchConfig
-  ).catch((error) => {
-    restorePendingLogs(logs);
-    throw error;
-  });
-  return { relayProtocol: result.relayProtocol };
-}
-async function unregisterConnector(config, launchConfig) {
-  await postJson(
-    config.serverUrl,
-    "/api/connectors/unregister",
-    {
-      connectorId: config.connectorId
-    },
-    config,
-    launchConfig
-  ).catch((error) => {
-    void writeLog("warn", `unregister failed: ${error instanceof Error ? error.message : error}`);
+async function stopEmbeddedBunnyDaemon(daemon) {
+  await new Promise((resolve) => {
+    daemon.server.close(() => resolve());
   });
+  await writeLog("info", `bunny daemon stopped ${daemon.baseUrl}`);
 }
 
 // src/legacy-workspace-migration.ts
-import { createHash as createHash5, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash5, randomUUID as randomUUID5 } from "crypto";
 import { constants as constants2, createReadStream } from "fs";
 import {
-  chmod as chmod2,
+  chmod as chmod4,
   copyFile,
   lstat,
-  mkdir as mkdir5,
+  mkdir as mkdir8,
   open as open2,
-  readdir as readdir3,
-  readFile as readFile4,
+  readdir as readdir4,
+  readFile as readFile7,
   readlink,
   realpath,
-  rename as rename3,
-  rm,
+  rename as rename5,
+  rm as rm2,
   symlink,
-  unlink as unlink4
+  unlink as unlink5
 } from "fs/promises";
-import path6 from "path";
+import path9 from "path";
 var MIGRATION_VERSION = 1;
-var MIGRATION_DIRECTORY = path6.join(".buda", "migrations", "legacy-workspace-v1");
+var MIGRATION_DIRECTORY = path9.join(".buda", "migrations", "legacy-workspace-v1");
 var JOURNAL_FILENAME = "journal.json";
 var IMMUTABLE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
 var LEGACY_TEMPLATE_FILES = [
@@ -2049,7 +3366,7 @@ var LegacyWorkspaceMigrationError = class extends Error {
   recoverable = true;
 };
 var migrateLegacyWorkspaceRoot = async (storageRoot, options = {}) => {
-  await mkdir5(storageRoot, { recursive: true, mode: 448 });
+  await mkdir8(storageRoot, { recursive: true, mode: 448 });
   const rootInfo = await lstat(storageRoot);
   if (rootInfo.isSymbolicLink() || !rootInfo.isDirectory()) {
     throw new LegacyWorkspaceMigrationError(
@@ -2058,9 +3375,9 @@ var migrateLegacyWorkspaceRoot = async (storageRoot, options = {}) => {
     );
   }
   const canonicalRoot = await realpath(storageRoot);
-  const migrationDirectory = path6.join(canonicalRoot, MIGRATION_DIRECTORY);
+  const migrationDirectory = path9.join(canonicalRoot, MIGRATION_DIRECTORY);
   await ensurePrivateDirectoryWithin(canonicalRoot, migrationDirectory);
-  const journalPath = path6.join(migrationDirectory, JOURNAL_FILENAME);
+  const journalPath = path9.join(migrationDirectory, JOURNAL_FILENAME);
   let journal = await readJournal(journalPath);
   if (journal) validateJournalPaths(journal, canonicalRoot, migrationDirectory);
   if (journal?.status === "complete") {
@@ -2093,8 +3410,8 @@ var migrateLegacyWorkspaceRoot = async (storageRoot, options = {}) => {
 };
 var migrateItem = async (storageRoot, journalPath, journal, item, options) => {
   if (item.phase === "committed") return;
-  if (await exists(item.target)) {
-    if (!await exists(item.staging) && ["verified", "copied", "copying"].includes(item.phase)) {
+  if (await exists2(item.target)) {
+    if (!await exists2(item.staging) && ["verified", "copied", "copying"].includes(item.phase)) {
       await verifyTree(item.source, item.target);
       item.phase = "committed";
       await writeJournal(journalPath, journal);
@@ -2109,8 +3426,8 @@ var migrateItem = async (storageRoot, journalPath, journal, item, options) => {
     item.phase = "copying";
     await writeJournal(journalPath, journal);
     await checkpoint(options, "before-copy", item.id);
-    await rm(item.staging, { recursive: true, force: true });
-    await ensurePrivateDirectoryWithin(storageRoot, path6.dirname(item.staging));
+    await rm2(item.staging, { recursive: true, force: true });
+    await ensurePrivateDirectoryWithin(storageRoot, path9.dirname(item.staging));
     await copyTree(item.source, item.staging, () => checkpoint(options, "during-copy", item.id));
     await checkpoint(options, "after-copy", item.id);
     item.phase = "copied";
@@ -2121,7 +3438,7 @@ var migrateItem = async (storageRoot, journalPath, journal, item, options) => {
     try {
       await verifyTree(item.source, item.staging);
     } catch (error) {
-      await rm(item.staging, { recursive: true, force: true });
+      await rm2(item.staging, { recursive: true, force: true });
       item.phase = "copying";
       await writeJournal(journalPath, journal);
       throw error;
@@ -2132,9 +3449,9 @@ var migrateItem = async (storageRoot, journalPath, journal, item, options) => {
   }
   if (item.phase === "verified") {
     await checkpoint(options, "before-rename", item.id);
-    await ensurePrivateDirectoryWithin(storageRoot, path6.dirname(item.target));
-    await rename3(item.staging, item.target);
-    await syncDirectory(path6.dirname(item.target));
+    await ensurePrivateDirectoryWithin(storageRoot, path9.dirname(item.target));
+    await rename5(item.staging, item.target);
+    await syncDirectory2(path9.dirname(item.target));
     await checkpoint(options, "after-rename", item.id);
     item.phase = "committed";
     await writeJournal(journalPath, journal);
@@ -2144,14 +3461,14 @@ var resumeRollback = async (journalPath, journal, options) => {
   for (const item of [...journal.items].reverse()) {
     if (item.phase === "rolled-back") continue;
     await checkpoint(options, "before-rollback", item.id);
-    if (!await exists(item.source)) {
+    if (!await exists2(item.source)) {
       throw new LegacyWorkspaceMigrationError(
         "MIGRATION_VERIFY_FAILED",
         `Cannot roll back ${item.id}: the preserved legacy source is missing`
       );
     }
-    await rm(item.staging, { recursive: true, force: true });
-    await rm(item.target, { recursive: true, force: true });
+    await rm2(item.staging, { recursive: true, force: true });
+    await rm2(item.target, { recursive: true, force: true });
     await checkpoint(options, "after-rollback", item.id);
     item.phase = "rolled-back";
     await writeJournal(journalPath, journal);
@@ -2165,12 +3482,12 @@ var createJournal = async (storageRoot, migrationDirectory, owner) => {
   const ownership = owner ? "explicit-owner" : "shared-legacy";
   const label = owner ? `Legacy Connector root assigned to ${owner.spaceId}/${owner.agentId}` : "Shared legacy Connector root (ownership unassigned)";
   const sources = await inventoryLegacySources(storageRoot);
-  const stagingRoot = path6.join(migrationDirectory, "staging", randomUUID2());
+  const stagingRoot = path9.join(migrationDirectory, "staging", randomUUID5());
   const items = sources.map(({ id, source }) => ({
     id,
     source,
     target: deriveTarget(storageRoot, id, owner),
-    staging: path6.join(stagingRoot, id),
+    staging: path9.join(stagingRoot, id),
     phase: "pending"
   }));
   assertDistinctTargets(items);
@@ -2187,29 +3504,29 @@ var createJournal = async (storageRoot, migrationDirectory, owner) => {
   };
 };
 var inventoryLegacySources = async (storageRoot) => {
-  const rootEntries = await readdir3(storageRoot, { withFileTypes: true });
+  const rootEntries = await readdir4(storageRoot, { withFileTypes: true });
   const templateNames = new Set(LEGACY_TEMPLATE_FILES);
   for (const entry of rootEntries) {
     if (entry.name.endsWith(".md")) templateNames.add(entry.name);
   }
   const candidates = [
-    { id: "agent", source: path6.join(storageRoot, "agent") },
-    { id: "space", source: path6.join(storageRoot, "space") },
-    { id: "logs", source: path6.join(storageRoot, "logs") },
-    { id: "connector-log", source: path6.join(storageRoot, "connector.log") },
-    { id: "runtime-config", source: path6.join(storageRoot, "runtime-config") },
-    { id: "runtime-config-hidden", source: path6.join(storageRoot, ".runtime-config") },
-    { id: "runtime-config-file", source: path6.join(storageRoot, "runtime-config.json") },
-    { id: "runtime-config-hidden-file", source: path6.join(storageRoot, ".runtime-config.json") },
-    { id: "bunny-runtime", source: path6.join(storageRoot, ".bunny") },
+    { id: "agent", source: path9.join(storageRoot, "agent") },
+    { id: "space", source: path9.join(storageRoot, "space") },
+    { id: "logs", source: path9.join(storageRoot, "logs") },
+    { id: "connector-log", source: path9.join(storageRoot, "connector.log") },
+    { id: "runtime-config", source: path9.join(storageRoot, "runtime-config") },
+    { id: "runtime-config-hidden", source: path9.join(storageRoot, ".runtime-config") },
+    { id: "runtime-config-file", source: path9.join(storageRoot, "runtime-config.json") },
+    { id: "runtime-config-hidden-file", source: path9.join(storageRoot, ".runtime-config.json") },
+    { id: "bunny-runtime", source: path9.join(storageRoot, ".bunny") },
     ...[...templateNames].sort().map((name) => ({
       id: `template-${name}`,
-      source: path6.join(storageRoot, name)
+      source: path9.join(storageRoot, name)
     }))
   ];
   const found = [];
   for (const candidate of candidates) {
-    if (!await exists(candidate.source)) continue;
+    if (!await exists2(candidate.source)) continue;
     const info = await lstat(candidate.source);
     if (info.isSymbolicLink()) {
       throw new LegacyWorkspaceMigrationError(
@@ -2217,36 +3534,36 @@ var inventoryLegacySources = async (storageRoot) => {
         `Legacy migration source ${candidate.id} must not be a symbolic link`
       );
     }
-    if (info.isDirectory() && (await readdir3(candidate.source)).length === 0) continue;
+    if (info.isDirectory() && (await readdir4(candidate.source)).length === 0) continue;
     found.push(candidate);
   }
   return found;
 };
 var deriveTarget = (storageRoot, id, owner) => {
-  if (!owner) return path6.join(storageRoot, ".buda", "legacy", "shared", id);
-  const spaceRoot = path6.join(storageRoot, ".buda", "spaces", owner.spaceId);
-  const agentRoot = path6.join(spaceRoot, "agents", owner.agentId);
-  if (id === "agent") return path6.join(agentRoot, "workspace", "legacy-connector-root");
-  if (id === "space") return path6.join(spaceRoot, "shared", "legacy-connector-root");
+  if (!owner) return path9.join(storageRoot, ".buda", "legacy", "shared", id);
+  const spaceRoot = path9.join(storageRoot, ".buda", "spaces", owner.spaceId);
+  const agentRoot = path9.join(spaceRoot, "agents", owner.agentId);
+  if (id === "agent") return path9.join(agentRoot, "workspace", "legacy-connector-root");
+  if (id === "space") return path9.join(spaceRoot, "shared", "legacy-connector-root");
   if (id.startsWith("template-")) {
-    return path6.join(spaceRoot, "shared", "legacy-templates", id.slice("template-".length));
+    return path9.join(spaceRoot, "shared", "legacy-templates", id.slice("template-".length));
   }
-  return path6.join(agentRoot, "state", "legacy-connector-root", id);
+  return path9.join(agentRoot, "state", "legacy-connector-root", id);
 };
 var copyTree = async (source, destination, onEntryCopied) => {
   const info = await lstat(source);
   if (info.isDirectory()) {
-    await mkdir5(destination, { mode: info.mode & 4095 });
-    const entries = (await readdir3(source)).sort();
+    await mkdir8(destination, { mode: info.mode & 4095 });
+    const entries = (await readdir4(source)).sort();
     for (const entry of entries) {
-      await copyTree(path6.join(source, entry), path6.join(destination, entry), onEntryCopied);
+      await copyTree(path9.join(source, entry), path9.join(destination, entry), onEntryCopied);
     }
-    await chmod2(destination, info.mode & 4095);
+    await chmod4(destination, info.mode & 4095);
     return;
   }
   if (info.isFile()) {
     await copyFile(source, destination, constants2.COPYFILE_EXCL);
-    await chmod2(destination, info.mode & 4095);
+    await chmod4(destination, info.mode & 4095);
     await onEntryCopied();
     return;
   }
@@ -2274,8 +3591,8 @@ var verifyTree = async (source, destination) => {
   }
   if (sourceInfo.isDirectory()) {
     const [sourceEntries, destinationEntries] = await Promise.all([
-      readdir3(source),
-      readdir3(destination)
+      readdir4(source),
+      readdir4(destination)
     ]);
     sourceEntries.sort();
     destinationEntries.sort();
@@ -2283,7 +3600,7 @@ var verifyTree = async (source, destination) => {
       throw verifyFailure("directory entries differ");
     }
     for (const entry of sourceEntries) {
-      await verifyTree(path6.join(source, entry), path6.join(destination, entry));
+      await verifyTree(path9.join(source, entry), path9.join(destination, entry));
     }
     return;
   }
@@ -2313,7 +3630,7 @@ var hashFile = async (filePath) => {
 var readJournal = async (journalPath) => {
   let raw;
   try {
-    raw = await readFile4(journalPath, "utf8");
+    raw = await readFile7(journalPath, "utf8");
   } catch (error) {
     if (isMissing(error)) return void 0;
     throw error;
@@ -2325,13 +3642,13 @@ var readJournal = async (journalPath) => {
     throw corrupt("Legacy migration journal contains invalid JSON");
   }
   if (!isJournal(value)) throw corrupt("Legacy migration journal is malformed");
-  await chmod2(journalPath, 384);
+  await chmod4(journalPath, 384);
   return value;
 };
 var writeJournal = async (journalPath, journal) => {
   journal.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  await ensurePrivateDirectory(path6.dirname(journalPath));
-  const temporaryPath = `${journalPath}.${process.pid}.${randomUUID2()}.tmp`;
+  await ensurePrivateDirectory(path9.dirname(journalPath));
+  const temporaryPath = `${journalPath}.${process.pid}.${randomUUID5()}.tmp`;
   const handle = await open2(
     temporaryPath,
     constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY,
@@ -2345,14 +3662,14 @@ var writeJournal = async (journalPath, journal) => {
     await handle.close();
   }
   try {
-    await rename3(temporaryPath, journalPath);
-    await chmod2(journalPath, 384);
-    await syncDirectory(path6.dirname(journalPath));
+    await rename5(temporaryPath, journalPath);
+    await chmod4(journalPath, 384);
+    await syncDirectory2(path9.dirname(journalPath));
   } finally {
-    await unlink4(temporaryPath).catch(() => void 0);
+    await unlink5(temporaryPath).catch(() => void 0);
   }
 };
-var syncDirectory = async (directory) => {
+var syncDirectory2 = async (directory) => {
   const handle = await open2(directory, constants2.O_RDONLY);
   try {
     await handle.sync();
@@ -2361,7 +3678,7 @@ var syncDirectory = async (directory) => {
   }
 };
 var ensurePrivateDirectory = async (directory) => {
-  await mkdir5(directory, { mode: 448 }).catch((error) => {
+  await mkdir8(directory, { mode: 448 }).catch((error) => {
     if (!isAlreadyExists2(error)) throw error;
   });
   const info = await lstat(directory);
@@ -2371,16 +3688,16 @@ var ensurePrivateDirectory = async (directory) => {
       "Legacy migration control path must be a real directory"
     );
   }
-  await chmod2(directory, 448);
+  await chmod4(directory, 448);
 };
 var ensurePrivateDirectoryWithin = async (storageRoot, directory) => {
   if (directory !== storageRoot && !isPathInside(storageRoot, directory)) {
     throw corrupt("Legacy migration control path escapes protected storage");
   }
-  const relative = path6.relative(storageRoot, directory);
+  const relative = path9.relative(storageRoot, directory);
   let current = storageRoot;
-  for (const segment of relative.split(path6.sep).filter(Boolean)) {
-    current = path6.join(current, segment);
+  for (const segment of relative.split(path9.sep).filter(Boolean)) {
+    current = path9.join(current, segment);
     await ensurePrivateDirectory(current);
   }
 };
@@ -2405,7 +3722,7 @@ var validateJournalPaths = (journal, storageRoot, migrationDirectory) => {
   const stagingPaths = /* @__PURE__ */ new Set();
   for (const item of journal.items) {
     const sourceRelative = sourceRelativePath(item.id);
-    if (!sourceRelative || item.source !== path6.join(storageRoot, sourceRelative)) {
+    if (!sourceRelative || item.source !== path9.join(storageRoot, sourceRelative)) {
       throw corrupt("Legacy migration journal contains an unexpected source path");
     }
     if (item.target !== deriveTarget(storageRoot, item.id, journal.owner)) {
@@ -2414,8 +3731,8 @@ var validateJournalPaths = (journal, storageRoot, migrationDirectory) => {
     if (!isPathInside(migrationDirectory, item.staging)) {
       throw corrupt("Legacy migration journal staging path escapes the migration directory");
     }
-    const stagingParent = path6.dirname(item.staging);
-    if (path6.dirname(stagingParent) !== path6.join(migrationDirectory, "staging") || item.staging !== path6.join(stagingParent, item.id)) {
+    const stagingParent = path9.dirname(item.staging);
+    if (path9.dirname(stagingParent) !== path9.join(migrationDirectory, "staging") || item.staging !== path9.join(stagingParent, item.id)) {
       throw corrupt("Legacy migration journal staging path is not canonical");
     }
     stagingParents.add(stagingParent);
@@ -2445,7 +3762,7 @@ var sourceRelativePath = (id) => {
   if (known[id]) return known[id];
   if (!id.startsWith("template-")) return null;
   const name = id.slice("template-".length);
-  return name.endsWith(".md") && path6.basename(name) === name ? name : null;
+  return name.endsWith(".md") && path9.basename(name) === name ? name : null;
 };
 var validateJournalOwnership = (journal) => {
   if (journal.ownership === "explicit-owner") {
@@ -2508,7 +3825,7 @@ var isJournal = (value) => {
     (item) => item && typeof item === "object" && typeof item.id === "string" && typeof item.source === "string" && typeof item.target === "string" && typeof item.staging === "string" && typeof item.phase === "string" && ITEM_PHASES.has(item.phase)
   );
 };
-var exists = async (filePath) => {
+var exists2 = async (filePath) => {
   try {
     await lstat(filePath);
     return true;
@@ -2518,8 +3835,8 @@ var exists = async (filePath) => {
   }
 };
 var isPathInside = (parent, child) => {
-  const relative = path6.relative(parent, child);
-  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path6.sep}`) && !path6.isAbsolute(relative);
+  const relative = path9.relative(parent, child);
+  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path9.sep}`) && !path9.isAbsolute(relative);
 };
 var isMissing = (error) => error instanceof Error && "code" in error && error.code === "ENOENT";
 var isAlreadyExists2 = (error) => error instanceof Error && "code" in error && error.code === "EEXIST";
@@ -2531,7 +3848,7 @@ var corrupt = (message) => new LegacyWorkspaceMigrationError("MIGRATION_CORRUPT"
 var errorMessage = (error) => error instanceof Error ? error.message : String(error);
 
 // src/relay.ts
-import path8 from "path";
+import path11 from "path";
 import { createNextHandler } from "@bunny-agent/daemon/nextjs";
 import WebSocket2 from "ws";
 
@@ -2703,15 +4020,15 @@ import { constants as constants3 } from "fs";
 import {
   copyFile as copyFile2,
   lstat as lstat2,
-  mkdir as mkdir6,
-  readdir as readdir4,
-  readFile as readFile5,
+  mkdir as mkdir9,
+  readdir as readdir5,
+  readFile as readFile8,
   realpath as realpath2,
-  rm as rm2,
+  rm as rm3,
   symlink as symlink2,
-  writeFile as writeFile2
+  writeFile as writeFile4
 } from "fs/promises";
-import path7 from "path";
+import path10 from "path";
 var MOUNT_DIRECTORY = "mount";
 var ARCHIVE_MARKER = "archived.json";
 var AGENT_CONTEXT_TEMPLATE_FILES = [
@@ -2723,8 +4040,8 @@ var AGENT_CONTEXT_TEMPLATE_FILES = [
   "BOOTSTRAP.md",
   "MEMORY.md"
 ];
-var deriveSystemVolume = (descriptor) => path7.join(
-  path7.dirname(path7.dirname(path7.dirname(path7.dirname(descriptor.sharedVolume)))),
+var deriveSystemVolume = (descriptor) => path10.join(
+  path10.dirname(path10.dirname(path10.dirname(path10.dirname(descriptor.sharedVolume)))),
   "system"
 );
 var WorkspaceVolumeLifecycle = class {
@@ -2736,14 +4053,14 @@ var WorkspaceVolumeLifecycle = class {
   async mount() {
     await this.ensureVolumes();
     await this.bootstrapAgentTemplates((await readBundledManifest()).sharedDir);
-    const mountRoot = path7.join(this.descriptor.stateVolume, MOUNT_DIRECTORY);
-    await mkdir6(mountRoot, { recursive: true, mode: 448 });
+    const mountRoot = path10.join(this.descriptor.stateVolume, MOUNT_DIRECTORY);
+    await mkdir9(mountRoot, { recursive: true, mode: 448 });
     const mounts = {
       mountRoot,
-      agent: path7.join(mountRoot, "agent"),
-      space: path7.join(mountRoot, "space"),
-      system: path7.join(mountRoot, "system"),
-      temporary: path7.join(mountRoot, "tmp")
+      agent: path10.join(mountRoot, "agent"),
+      space: path10.join(mountRoot, "space"),
+      system: path10.join(mountRoot, "system"),
+      temporary: path10.join(mountRoot, "tmp")
     };
     await Promise.all([
       ensureVolumeLink(this.descriptor.privateVolume, mounts.agent),
@@ -2751,69 +4068,69 @@ var WorkspaceVolumeLifecycle = class {
       ensureVolumeLink(this.systemVolume, mounts.system),
       ensureVolumeLink(this.descriptor.temporaryVolume, mounts.temporary)
     ]);
-    const daemonVolumes = path7.join(mountRoot, "volumes");
-    await mkdir6(daemonVolumes, { recursive: true, mode: 448 });
+    const daemonVolumes = path10.join(mountRoot, "volumes");
+    await mkdir9(daemonVolumes, { recursive: true, mode: 448 });
     await Promise.all([
-      ensureVolumeLink(this.descriptor.privateVolume, path7.join(daemonVolumes, "agent")),
-      ensureVolumeLink(this.descriptor.sharedVolume, path7.join(daemonVolumes, "space")),
-      ensureVolumeLink(this.systemVolume, path7.join(daemonVolumes, "system")),
-      ensureVolumeLink(this.descriptor.temporaryVolume, path7.join(daemonVolumes, "tmp"))
+      ensureVolumeLink(this.descriptor.privateVolume, path10.join(daemonVolumes, "agent")),
+      ensureVolumeLink(this.descriptor.sharedVolume, path10.join(daemonVolumes, "space")),
+      ensureVolumeLink(this.systemVolume, path10.join(daemonVolumes, "system")),
+      ensureVolumeLink(this.descriptor.temporaryVolume, path10.join(daemonVolumes, "tmp"))
     ]);
     return mounts;
   }
   async unmount() {
-    await rm2(path7.join(this.descriptor.stateVolume, MOUNT_DIRECTORY), {
+    await rm3(path10.join(this.descriptor.stateVolume, MOUNT_DIRECTORY), {
       recursive: true,
       force: true
     });
   }
   async archiveAgent() {
     await this.unmount();
-    await mkdir6(this.descriptor.stateVolume, { recursive: true, mode: 448 });
-    await writeFile2(
-      path7.join(this.descriptor.stateVolume, ARCHIVE_MARKER),
+    await mkdir9(this.descriptor.stateVolume, { recursive: true, mode: 448 });
+    await writeFile4(
+      path10.join(this.descriptor.stateVolume, ARCHIVE_MARKER),
       `${JSON.stringify({ archivedAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `,
       { encoding: "utf8", mode: 384 }
     );
   }
   async restoreAgent() {
-    await rm2(path7.join(this.descriptor.stateVolume, ARCHIVE_MARKER), { force: true });
+    await rm3(path10.join(this.descriptor.stateVolume, ARCHIVE_MARKER), { force: true });
     return this.mount();
   }
   async deleteAgent(options) {
     requireConfirmation(options);
     await this.unmount();
-    const agentRoot = path7.dirname(this.descriptor.privateVolume);
-    await rm2(agentRoot, { recursive: true, force: true });
+    const agentRoot = path10.dirname(this.descriptor.privateVolume);
+    await rm3(agentRoot, { recursive: true, force: true });
   }
   async archiveSpace() {
-    await mkdir6(this.descriptor.sharedVolume, { recursive: true, mode: 448 });
-    await writeFile2(
-      path7.join(this.descriptor.sharedVolume, ARCHIVE_MARKER),
+    await mkdir9(this.descriptor.sharedVolume, { recursive: true, mode: 448 });
+    await writeFile4(
+      path10.join(this.descriptor.sharedVolume, ARCHIVE_MARKER),
       `${JSON.stringify({ archivedAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `,
       { encoding: "utf8", mode: 384 }
     );
   }
   async restoreSpace() {
-    await rm2(path7.join(this.descriptor.sharedVolume, ARCHIVE_MARKER), { force: true });
+    await rm3(path10.join(this.descriptor.sharedVolume, ARCHIVE_MARKER), { force: true });
   }
   async deleteSpace(options) {
     requireConfirmation(options);
     await this.unmount();
-    await rm2(this.descriptor.sharedVolume, { recursive: true, force: true });
+    await rm3(this.descriptor.sharedVolume, { recursive: true, force: true });
   }
   async bootstrapAgentTemplates(templateDirectory) {
-    await mkdir6(this.descriptor.privateVolume, { recursive: true, mode: 448 });
+    await mkdir9(this.descriptor.privateVolume, { recursive: true, mode: 448 });
     const bootstrapped = [];
     const skipped = [];
     const entries = new Set(
-      (await readdir4(templateDirectory, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isFile()).map((entry) => entry.name)
+      (await readdir5(templateDirectory, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isFile()).map((entry) => entry.name)
     );
     for (const filename of AGENT_CONTEXT_TEMPLATE_FILES) {
       if (!entries.has(filename)) continue;
-      const destination = path7.join(this.descriptor.privateVolume, filename);
+      const destination = path10.join(this.descriptor.privateVolume, filename);
       try {
         await lstat2(destination);
         skipped.push(filename);
@@ -2821,7 +4138,7 @@ var WorkspaceVolumeLifecycle = class {
         if (!isMissingFile(error)) throw error;
         try {
           await copyFile2(
-            path7.join(templateDirectory, filename),
+            path10.join(templateDirectory, filename),
             destination,
             constants3.COPYFILE_EXCL
           );
@@ -2842,7 +4159,7 @@ var WorkspaceVolumeLifecycle = class {
       this.descriptor.temporaryVolume,
       this.systemVolume
     ]) {
-      await mkdir6(volume, { recursive: true, mode: 448 });
+      await mkdir9(volume, { recursive: true, mode: 448 });
       const info = await lstat2(volume);
       if (info.isSymbolicLink() || !info.isDirectory() || await realpath2(volume) !== volume) {
         throw new Error("Workspace volume must be a canonical real directory");
@@ -2926,6 +4243,8 @@ function startConnectorRelay(config, bunnyDaemon, relayProtocol, workspaceRegist
   let reconnectDelayMs = RELAY_RECONNECT_INTERVAL_MS;
   let hadOpenConnection = false;
   let activeRelayProtocol = relayProtocol;
+  let currentInflight = /* @__PURE__ */ new Map();
+  let activeTerminalTunnels = 0;
   const replayGuard = new ConnectorExecutionReplayGuard();
   const clearTimers = () => {
     if (pingTimer) {
@@ -2979,6 +4298,7 @@ function startConnectorRelay(config, bunnyDaemon, relayProtocol, workspaceRegist
     });
     socket = ws;
     const inflight = /* @__PURE__ */ new Map();
+    currentInflight = inflight;
     let detached = false;
     const detach = () => {
       if (detached) return;
@@ -3024,7 +4344,15 @@ function startConnectorRelay(config, bunnyDaemon, relayProtocol, workspaceRegist
         replayGuard,
         workspaceRegistry,
         config.serverUrl,
-        bunnyDaemon.baseUrl
+        bunnyDaemon.baseUrl,
+        {
+          onTerminalOpen: () => {
+            activeTerminalTunnels += 1;
+          },
+          onTerminalClose: () => {
+            activeTerminalTunnels = Math.max(0, activeTerminalTunnels - 1);
+          }
+        }
       );
     });
     ws.on("close", (code) => {
@@ -3056,6 +4384,12 @@ function startConnectorRelay(config, bunnyDaemon, relayProtocol, workspaceRegist
     scheduleReconnect("connect-throw");
   }
   return {
+    isIdle() {
+      return currentInflight.size === 0 && activeTerminalTunnels === 0;
+    },
+    isConnected() {
+      return socket?.readyState === WebSocket2.OPEN && !suspendedForAccessRevocation;
+    },
     updateRelayProtocol(nextRelayProtocol) {
       const previousKeyId = activeRelayProtocol?.keyId;
       activeRelayProtocol = nextRelayProtocol;
@@ -3087,7 +4421,7 @@ function startConnectorRelay(config, bunnyDaemon, relayProtocol, workspaceRegist
     }
   };
 }
-async function handleRelayMessage(socket, bunnyDaemon, raw, inflight, expectedConnectorId, relayProtocol, replayGuard, workspaceRegistry, serverUrl, localDaemonBaseUrl) {
+async function handleRelayMessage(socket, bunnyDaemon, raw, inflight, expectedConnectorId, relayProtocol, replayGuard, workspaceRegistry, serverUrl, localDaemonBaseUrl, activity) {
   if (!socket || socket.readyState !== WebSocket2.OPEN) return;
   let message;
   try {
@@ -3141,7 +4475,9 @@ async function handleRelayMessage(socket, bunnyDaemon, raw, inflight, expectedCo
           cloudToken: terminal.token,
           localBaseUrl: localDaemonBaseUrl,
           localToken,
-          workspaceKey: descriptor.workspaceKey
+          workspaceKey: descriptor.workspaceKey,
+          onActivityStart: activity?.onTerminalOpen,
+          onActivityEnd: activity?.onTerminalClose
         });
       } catch (error) {
         await writeLog(
@@ -3334,12 +4670,12 @@ var normalizeWorkspaceRequest = (request, mounts) => {
   }
   const body = request.body;
   const cwd = typeof body.cwd === "string" ? body.cwd : "/agent";
-  const normalized = path8.posix.normalize(cwd);
+  const normalized = path11.posix.normalize(cwd);
   const [mount, relative] = normalized === "/agent" || normalized.startsWith("/agent/") ? [mounts.agent, normalized.slice("/agent".length)] : normalized === "/space" || normalized.startsWith("/space/") ? [mounts.space, normalized.slice("/space".length)] : [];
   if (!mount || relative === void 0) {
     throw new ConnectorRelayProtocolError("WORKSPACE_MISMATCH");
   }
-  return { ...request, body: { ...body, cwd: path8.join(mount, relative) } };
+  return { ...request, body: { ...body, cwd: path11.join(mount, relative) } };
 };
 function sendRelayError(socket, requestId, error) {
   sendRelayMessage(socket, {
@@ -3370,14 +4706,14 @@ function getHeaderValue(headers, name) {
 }
 
 // src/workdir-layout.ts
-import { lstat as lstat3, mkdir as mkdir7, symlink as symlink3, unlink as unlink5 } from "fs/promises";
-import path9 from "path";
+import { lstat as lstat3, mkdir as mkdir10, symlink as symlink3, unlink as unlink6 } from "fs/promises";
+import path12 from "path";
 async function provisionWorkdirLayout(workdirRoot) {
   const manifest = await readBundledManifest();
-  await mkdir7(workdirRoot, { recursive: true });
-  await mkdir7(path9.join(workdirRoot, "system", ".agents"), { recursive: true });
-  const systemSkillsLink = path9.join(workdirRoot, "system", ".agents", "skills");
-  const systemScriptsLink = path9.join(workdirRoot, "system", "scripts");
+  await mkdir10(workdirRoot, { recursive: true });
+  await mkdir10(path12.join(workdirRoot, "system", ".agents"), { recursive: true });
+  const systemSkillsLink = path12.join(workdirRoot, "system", ".agents", "skills");
+  const systemScriptsLink = path12.join(workdirRoot, "system", "scripts");
   await ensureSymlink(manifest.systemSkillsDir, systemSkillsLink);
   await ensureSymlink(manifest.scriptsDir, systemScriptsLink);
   await writeLog("info", "workdir layout provisioned", {
@@ -3397,7 +4733,7 @@ async function ensureSymlink(target, linkPath) {
   try {
     const existing = await lstat3(linkPath);
     if (existing.isSymbolicLink()) {
-      await unlink5(linkPath);
+      await unlink6(linkPath);
     } else if (existing.isDirectory()) {
       await writeLog(
         "warn",
@@ -3405,28 +4741,28 @@ async function ensureSymlink(target, linkPath) {
       );
       return;
     } else {
-      await unlink5(linkPath);
+      await unlink6(linkPath);
     }
   } catch {
   }
-  await mkdir7(path9.dirname(linkPath), { recursive: true });
+  await mkdir10(path12.dirname(linkPath), { recursive: true });
   await symlink3(target, linkPath, "dir");
 }
 
 // src/workspace-registry.ts
 import { constants as constants4 } from "fs";
 import {
-  chmod as chmod3,
+  chmod as chmod5,
   lstat as lstat4,
-  mkdir as mkdir8,
+  mkdir as mkdir11,
   open as open3,
-  readFile as readFile6,
+  readFile as readFile9,
   realpath as realpath3,
-  rename as rename4,
+  rename as rename6,
   statfs,
-  unlink as unlink6
+  unlink as unlink7
 } from "fs/promises";
-import path10 from "path";
+import path13 from "path";
 var REGISTRY_VERSION = 1;
 var REGISTRY_DIRECTORY = ".buda";
 var REGISTRY_FILENAME = "workspace-registry.json";
@@ -3447,16 +4783,16 @@ var LocalWorkspaceRegistry = class _LocalWorkspaceRegistry {
     this.document = document;
   }
   static async open(storageRoot) {
-    await mkdir8(storageRoot, { recursive: true, mode: 448 });
+    await mkdir11(storageRoot, { recursive: true, mode: 448 });
     await rejectUnsafeFilesystem(storageRoot);
     const canonicalRoot = await canonicalDirectory(storageRoot, "storage root");
-    const registryDirectory = path10.join(canonicalRoot, REGISTRY_DIRECTORY);
+    const registryDirectory = path13.join(canonicalRoot, REGISTRY_DIRECTORY);
     await ensurePrivateDirectory2(registryDirectory);
-    const registryPath = path10.join(registryDirectory, REGISTRY_FILENAME);
+    const registryPath = path13.join(registryDirectory, REGISTRY_FILENAME);
     const document = await withExclusiveFileLock(registryPath, async () => {
       let current;
       try {
-        current = parseRegistry(await readFile6(registryPath, "utf8"));
+        current = parseRegistry(await readFile9(registryPath, "utf8"));
       } catch (error) {
         if (isMissingFile2(error)) {
           current = { version: REGISTRY_VERSION, storageRoot: canonicalRoot, workspaces: {} };
@@ -3470,11 +4806,11 @@ var LocalWorkspaceRegistry = class _LocalWorkspaceRegistry {
       if (current.storageRoot !== canonicalRoot) {
         throw corrupt2("Registry storage root does not match the selected storage root");
       }
-      await chmod3(registryPath, 384);
+      await chmod5(registryPath, 384);
       await reconcileDocument(current, canonicalRoot);
       return current;
     });
-    await chmod3(registryPath, 384);
+    await chmod5(registryPath, 384);
     return new _LocalWorkspaceRegistry(registryPath, canonicalRoot, document);
   }
   async resolve(spaceId, agentId) {
@@ -3521,23 +4857,23 @@ var LocalWorkspaceRegistry = class _LocalWorkspaceRegistry {
 };
 var readRegistryDocument = async (registryPath) => {
   try {
-    return parseRegistry(await readFile6(registryPath, "utf8"));
+    return parseRegistry(await readFile9(registryPath, "utf8"));
   } catch (error) {
     if (error instanceof WorkspaceRegistryError) throw error;
     throw corrupt2(`Cannot read local workspace registry: ${errorMessage2(error)}`);
   }
 };
 var deriveWorkspace = (storageRoot, spaceId, agentId) => {
-  const spaceRoot = path10.join(storageRoot, REGISTRY_DIRECTORY, "spaces", spaceId);
-  const agentRoot = path10.join(spaceRoot, "agents", agentId);
+  const spaceRoot = path13.join(storageRoot, REGISTRY_DIRECTORY, "spaces", spaceId);
+  const agentRoot = path13.join(spaceRoot, "agents", agentId);
   return {
     workspaceKey: `${spaceId}:${agentId}`,
     spaceId,
     agentId,
-    privateVolume: path10.join(agentRoot, "workspace"),
-    sharedVolume: path10.join(spaceRoot, "shared"),
-    stateVolume: path10.join(agentRoot, "state"),
-    temporaryVolume: path10.join(agentRoot, "tmp")
+    privateVolume: path13.join(agentRoot, "workspace"),
+    sharedVolume: path13.join(spaceRoot, "shared"),
+    stateVolume: path13.join(agentRoot, "state"),
+    temporaryVolume: path13.join(agentRoot, "tmp")
   };
 };
 var parseRegistry = (raw) => {
@@ -3619,12 +4955,12 @@ var assertNoCollision = (workspaces, candidate) => {
   }
 };
 var ensurePrivateDirectory2 = async (directory) => {
-  await mkdir8(directory, { recursive: true, mode: 448 });
+  await mkdir11(directory, { recursive: true, mode: 448 });
   const info = await lstat4(directory);
   if (info.isSymbolicLink() || !info.isDirectory()) {
     throw corrupt2("Workspace registry path is not a real directory");
   }
-  await chmod3(directory, 448);
+  await chmod5(directory, 448);
 };
 var canonicalDirectory = async (directory, label) => {
   const info = await lstat4(directory);
@@ -3658,10 +4994,10 @@ var writeRegistryAtomically = async (registryPath, document) => {
     await handle.close();
   }
   try {
-    await rename4(temporaryPath, registryPath);
-    await chmod3(registryPath, 384);
+    await rename6(temporaryPath, registryPath);
+    await chmod5(registryPath, 384);
   } catch (error) {
-    await unlink6(temporaryPath).catch(() => void 0);
+    await unlink7(temporaryPath).catch(() => void 0);
     throw error;
   }
 };
@@ -3684,8 +5020,8 @@ var assertContained = (root, candidate) => {
   if (!isPathInside2(root, candidate)) throw corrupt2("Workspace path escapes the storage root");
 };
 var isPathInside2 = (parent, child) => {
-  const relative = path10.relative(parent, child);
-  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path10.sep}`) && !path10.isAbsolute(relative);
+  const relative = path13.relative(parent, child);
+  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path13.sep}`) && !path13.isAbsolute(relative);
 };
 var toDescriptor = (workspace) => ({
   workspaceKey: workspace.workspaceKey,
@@ -3761,10 +5097,12 @@ async function runOnboard(launchConfig, options = {}) {
     await provisionWorkdirLayout(config2.workdirRoot);
     try {
       const registration = await registerConnector(config2, launchConfig, void 0, {
-        recoverMissingProfile: true
+        recoverMissingProfile: false
       });
       config2.connectorId = registration.connectorId;
+      config2.spaceId = registration.spaceId ?? config2.spaceId;
       relayProtocol = registration.relayProtocol;
+      if (!config2.spaceId) throw new Error("Registration did not resolve a Space");
       await writeDeviceConfig(config2);
     } catch (error) {
       s2.stop("Registration failed");
@@ -3854,8 +5192,31 @@ async function runOnboard(launchConfig, options = {}) {
 }
 
 // src/runtime.ts
-import { mkdir as mkdir9 } from "fs/promises";
-import path11 from "path";
+import { mkdir as mkdir12 } from "fs/promises";
+import path14 from "path";
+var RECOVERED_DAEMON_STOP_TIMEOUT_MS = 1e4;
+var RECOVERED_DAEMON_STOP_POLL_MS = 100;
+var wait3 = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
+async function stopRecoveredIdleDaemon(config, configRoot) {
+  const stopStatus = await requestDaemonControl(config, "stop-if-idle", configRoot).catch(
+    () => null
+  );
+  if (!stopStatus) return;
+  if (!stopStatus.idle) {
+    throw new Error(
+      `The recovered Connector ${config.connectorId} is still running an Agent task and cannot be replaced yet.`
+    );
+  }
+  const deadline = Date.now() + RECOVERED_DAEMON_STOP_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    const status = await requestDaemonControl(config, "status", configRoot, {
+      timeoutMs: 500
+    }).catch(() => null);
+    if (!status) return;
+    await wait3(RECOVERED_DAEMON_STOP_POLL_MS);
+  }
+  throw new Error(`Recovered Connector ${config.connectorId} did not stop cleanly.`);
+}
 async function runNewConnector(launchConfig) {
   const existing = await readDeviceConfig(launchConfig);
   const config = await ensureDeviceConfig(launchConfig);
@@ -3864,27 +5225,41 @@ async function runNewConnector(launchConfig) {
   await provisionWorkdirLayout(config.workdirRoot);
   await LocalWorkspaceRegistry.open(config.workdirRoot);
   const registration = await registerConnector(config, launchConfig, void 0, {
-    recoverMissingProfile: !existing
+    recoverMissingProfile: shouldRecoverMissingProfile(Boolean(existing), launchConfig)
   });
   config.connectorId = registration.connectorId;
+  config.spaceId = registration.spaceId ?? config.spaceId;
   await writeDeviceConfig(config);
   await writeLog("info", `wrote ${paths.configPath}`);
   await writeLog("info", `workdir root ${config.workdirRoot}`);
   await writeLog("info", `log file ${getDatedConnectorLogPath(paths.logPath)}`);
 }
-async function runConnectorDaemon(launchConfig) {
-  const existing = await readDeviceConfig(launchConfig);
-  const config = await ensureDeviceConfig(launchConfig);
-  const paths = getConnectorPaths(config.serverUrl);
-  const daemonLockTarget = getConnectorDaemonLockTarget(config.serverUrl, config.connectorId);
-  await mkdir9(path11.dirname(daemonLockTarget), { recursive: true, mode: 448 });
+async function runConnectorDaemon(launchConfig, options = {}) {
+  const configRoot = options.configRoot ?? process.env.BUDA_CONNECTOR_CONFIG_ROOT;
+  const existing = await readDeviceConfig(launchConfig, configRoot);
+  const config = await ensureDeviceConfig(launchConfig, configRoot);
+  setConnectorLogContext({
+    configRoot,
+    connectorId: config.connectorId,
+    serverUrl: config.serverUrl
+  });
+  const paths = getConnectorPaths(config.serverUrl, configRoot);
+  const daemonLockTarget = getConnectorDaemonLockTarget(
+    config.serverUrl,
+    config.connectorId,
+    configRoot
+  );
+  await mkdir12(path14.dirname(daemonLockTarget), { recursive: true, mode: 448 });
   let daemonLock = await acquireExclusiveFileLock(daemonLockTarget, { timeoutMs: 0 }).catch(() => {
     throw new Error(
       `Another Buda Connector daemon is already running for this profile on ${config.serverUrl}. Stop it before starting another instance.`
     );
   });
+  const restoreConsole = options.captureConsole ? installConnectorConsoleCapture() : void 0;
   let bunnyDaemon;
   let relayProtocol;
+  let control;
+  let lastHeartbeatAt;
   try {
     await migrateLegacyWorkspaceRoot(config.workdirRoot);
     await provisionWorkdirLayout(config.workdirRoot);
@@ -3892,15 +5267,22 @@ async function runConnectorDaemon(launchConfig) {
     bunnyDaemon = await startEmbeddedBunnyDaemon(config, launchConfig);
     const activeBunnyDaemon = bunnyDaemon;
     const registration = await registerConnector(config, launchConfig, activeBunnyDaemon, {
-      recoverMissingProfile: !existing
+      recoverMissingProfile: shouldRecoverMissingProfile(Boolean(existing), launchConfig)
     });
     const connectorIdChanged = config.connectorId !== registration.connectorId;
     if (connectorIdChanged) {
+      const registeredConfig = {
+        ...config,
+        connectorId: registration.connectorId,
+        spaceId: registration.spaceId ?? config.spaceId
+      };
+      await stopRecoveredIdleDaemon(registeredConfig, configRoot);
       const registeredLockTarget = getConnectorDaemonLockTarget(
         config.serverUrl,
-        registration.connectorId
+        registration.connectorId,
+        configRoot
       );
-      await mkdir9(path11.dirname(registeredLockTarget), { recursive: true, mode: 448 });
+      await mkdir12(path14.dirname(registeredLockTarget), { recursive: true, mode: 448 });
       const registeredLock = await acquireExclusiveFileLock(registeredLockTarget, {
         timeoutMs: 0
       }).catch(() => {
@@ -3912,8 +5294,15 @@ async function runConnectorDaemon(launchConfig) {
       daemonLock = registeredLock;
     }
     config.connectorId = registration.connectorId;
+    setConnectorLogContext({ connectorId: config.connectorId });
+    config.spaceId = registration.spaceId ?? config.spaceId;
     relayProtocol = registration.relayProtocol;
-    if (!existing || connectorIdChanged) await writeDeviceConfig(config);
+    if (!config.spaceId) {
+      throw new Error("Connector registration did not return a canonical spaceId");
+    }
+    if (!existing || connectorIdChanged || existing.spaceId !== config.spaceId) {
+      await writeDeviceConfig(config, configRoot);
+    }
     const relay = startConnectorRelay(
       config,
       activeBunnyDaemon,
@@ -3928,6 +5317,7 @@ async function runConnectorDaemon(launchConfig) {
     await writeLog("info", `bunny daemon ${activeBunnyDaemon.baseUrl}`);
     const interval = setInterval(() => {
       heartbeatConnector(config, launchConfig, activeBunnyDaemon).then(({ relayProtocol: nextRelayProtocol }) => {
+        lastHeartbeatAt = (/* @__PURE__ */ new Date()).toISOString();
         relay.updateRelayProtocol(nextRelayProtocol);
         relay.resumeAfterAccessRestore();
         updateConnectorDashboardStatus({
@@ -3951,18 +5341,32 @@ async function runConnectorDaemon(launchConfig) {
         await unregisterConnector(config, launchConfig);
         await stopEmbeddedBunnyDaemon(activeBunnyDaemon);
       } finally {
+        await control?.close();
         await daemonLock.release();
-        process.exit(0);
+        await restoreConsole?.();
+        if (options.exitOnShutdown !== false) process.exit(0);
       }
     };
+    control = await startDaemonControlServer({
+      config,
+      configRoot,
+      getLastHeartbeatAt: () => lastHeartbeatAt,
+      isIdle: () => relay.isIdle(),
+      isRelayConnected: () => relay.isConnected(),
+      mode: options.mode ?? "persistent",
+      onStop: shutdown,
+      version: options.version
+    });
     process.once("SIGINT", () => void shutdown());
     process.once("SIGTERM", () => void shutdown());
   } catch (error) {
     if (bunnyDaemon) await stopEmbeddedBunnyDaemon(bunnyDaemon);
     await daemonLock.release();
+    await restoreConsole?.();
     throw error;
   }
 }
+var shouldRecoverMissingProfile = (hasExistingProfile, launchConfig) => !hasExistingProfile && Boolean(getConnectorToken(launchConfig)) && !launchConfig?.oauthToken?.trim();
 
 // src/cli.ts
 function printHelp() {
@@ -3980,6 +5384,7 @@ function readCliLaunchConfig() {
   const bunnyDaemonPort = readFlagValue("--bunny-daemon-port");
   return {
     serverUrl: readFlagValue("--server-url"),
+    spaceId: readFlagValue("--space-id"),
     workdirRoot: readFlagValue("--workdir"),
     oauthToken: readFlagValue("--oauth-token"),
     token: readFlagValue("--token"),
@@ -4027,13 +5432,15 @@ async function main() {
   const isTTY = process.stdin.isTTY && process.stdout.isTTY;
   const defaultCommand = isTTY ? "onboard" : "daemon";
   const command = !rawCommand || rawCommand.startsWith("-") ? defaultCommand : rawCommand;
+  const configRoot = readFlagValue("--config-root");
+  if (configRoot) process.env.BUDA_CONNECTOR_CONFIG_ROOT = configRoot;
   process.on("unhandledRejection", (reason) => {
     console.error("[buda-connector] unhandledRejection:", reason);
   });
   process.on("uncaughtException", (error) => {
     console.error("[buda-connector] uncaughtException:", error);
   });
-  const launchConfig = await readLaunchConfig();
+  const launchConfig = process.argv.includes("--internal-daemon") ? getInternalLaunchConfig() : await readLaunchConfig();
   const plain = process.argv.includes("--plain");
   if (command === "new") {
     await runNewConnector(launchConfig);
@@ -4043,11 +5450,31 @@ async function main() {
     await runOnboard(launchConfig, { plain });
     return;
   }
-  if (command === "dev" || command === "daemon") {
+  if (command === "dev" || process.argv.includes("--foreground")) {
     startConnectorConsoleDashboard({ plain });
     await runConnectorDaemon(launchConfig);
     return;
   }
+  if (command === "daemon" && process.argv.includes("--internal-daemon")) {
+    await runConnectorDaemon(launchConfig, {
+      captureConsole: true,
+      mode: getDaemonModeFlag(),
+      version: CONNECTOR_RUNTIME_VERSION
+    });
+    return;
+  }
+  if (command === "daemon" && process.argv.includes("--desktop-release")) {
+    await releaseDesktopConnector(launchConfig);
+    return;
+  }
+  if (command === "daemon" && process.argv.includes("--desktop")) {
+    await runDesktopConnectorController(launchConfig);
+    return;
+  }
+  if (command === "daemon") {
+    await runConnectorDashboard(launchConfig, { plain });
+    return;
+  }
   printHelp();
   process.exit(1);
 }