@edgible-team/cli 1.0.1

package/dist/services/edgible.js

@@ -0,0 +1,3060 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EdgibleService = void 0;
+const client_1 = require("../client");
+const passwordValidation_1 = require("../utils/passwordValidation");
+const config_1 = require("../state/config");
+const aws_1 = require("./aws");
+const ConnectivityTester_1 = require("./ConnectivityTester");
+const LocalAgentManager_1 = require("./LocalAgentManager");
+const urls_1 = require("../utils/urls");
+const chalk_1 = __importDefault(require("chalk"));
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
+const PathResolver_1 = require("../utils/PathResolver");
+/**
+ * Edgible service interface
+ * Uses the real API client for authentication and device management
+ */
+class EdgibleService {
+    constructor(baseUrl) {
+        this.applications = [];
+        this.baseUrl = baseUrl || (0, urls_1.getApiBaseUrl)();
+        this.apiClient = (0, client_1.createApiClient)(this.baseUrl);
+        this.configManager = new config_1.ConfigManager();
+        // Restore tokens from config if available (synchronous)
+        this.restoreTokensFromConfigSync();
+    }
+    restoreTokensFromConfigSync() {
+        const config = this.configManager.getConfig();
+        if (config.accessToken) {
+            this.apiClient.setAccessToken(config.accessToken);
+        }
+        if (config.idToken) {
+            this.apiClient.setIdToken(config.idToken);
+        }
+        if (config.refreshToken) {
+            this.apiClient.setRefreshToken(config.refreshToken);
+        }
+        // Log token restoration status for debugging
+        console.log('[EdgibleService] Token restoration:', {
+            hasAccessToken: !!config.accessToken,
+            hasIdToken: !!config.idToken,
+            hasRefreshToken: !!config.refreshToken,
+            organizationId: config.organizationId,
+            deviceId: config.deviceId
+        });
+    }
+    async attemptAutoRelogin() {
+        const config = this.configManager.getConfig();
+        // If no tokens but we have device credentials, attempt automatic re-login
+        if (!config.idToken && !config.accessToken && config.deviceId && config.devicePassword) {
+            console.log('[EdgibleService] No tokens available, attempting automatic device re-login...');
+            try {
+                await this.loginDevice(config.deviceId, config.devicePassword);
+                console.log('[EdgibleService] Automatic re-login successful');
+                return true;
+            }
+            catch (error) {
+                console.log('[EdgibleService] Automatic re-login failed:', error instanceof Error ? error.message : String(error));
+                return false;
+            }
+        }
+        return false;
+    }
+    saveTokensToConfig() {
+        const accessToken = this.apiClient.getAccessToken();
+        const idToken = this.apiClient.getIdToken();
+        const refreshToken = this.apiClient.getRefreshToken();
+        console.log('[EdgibleService] Saving tokens:', {
+            hasAccessToken: !!accessToken,
+            hasIdToken: !!idToken,
+            hasRefreshToken: !!refreshToken
+        });
+        this.configManager.updateConfig({
+            accessToken,
+            idToken,
+            refreshToken
+        });
+    }
+    /**
+     * Authenticate user with email and password
+     * @param email - Email address
+     * @param password - Password
+     * @returns Promise<LoginResponse> - Login response with tokens
+     */
+    async loginUser(email, password) {
+        try {
+            const loginRequest = { email, password };
+            const response = await this.apiClient.login(loginRequest);
+            // The API client already sets the tokens internally, just save them to config
+            this.saveTokensToConfig();
+            return response;
+        }
+        catch (error) {
+            console.error('Error logging in user:', error);
+            throw error;
+        }
+    }
+    /**
+     * Create a device with orphaned organization (device login without user account)
+     * @param deviceName - Name of the device
+     * @param password - Password for the device (must meet Cognito requirements)
+     * @param userEmail - Optional user email for invite
+     * @returns Promise<CreateDeviceWithOrphanedOrganizationResponse> - Device creation response
+     */
+    async createDeviceWithOrganization(deviceName, password, userEmail) {
+        try {
+            // Validate password meets Cognito requirements
+            const passwordValidation = (0, passwordValidation_1.validateCognitoPassword)(password);
+            if (!passwordValidation.isValid) {
+                throw new Error(`Password validation failed: ${passwordValidation.errors.join(', ')}`);
+            }
+            const request = {
+                name: deviceName,
+                description: `CLI device: ${deviceName}`,
+                type: 'laptop', // Default type for CLI devices
+                organizationName: `${deviceName} Organization`,
+                organizationDescription: `Organization created for device ${deviceName}`,
+                userEmail: userEmail,
+                password: password
+            };
+            const response = await this.apiClient.createDeviceWithOrphanedOrganization(request);
+            // Note: The createDeviceWithOrphanedOrganization response doesn't include tokens
+            // Tokens would be obtained through a separate login call with the device credentials
+            return response;
+        }
+        catch (error) {
+            console.error('Error creating device with organization:', error);
+            throw error;
+        }
+    }
+    /**
+     * Check if an account exists for the given email
+     * @param email - Email address to check
+     * @returns Promise<boolean> - True if account exists
+     */
+    async checkAccount(email) {
+        try {
+            // Clear any existing tokens before checking account to ensure a clean login attempt
+            // This prevents interference from previous sessions
+            this.apiClient.clearTokens();
+            // Try to authenticate with a dummy password to check if account exists
+            // This is a simple way to check account existence without exposing real authentication
+            try {
+                await this.apiClient.login({ email, password: 'dummy' });
+                // Clear tokens again after check since we used a dummy password
+                this.apiClient.clearTokens();
+                return true;
+            }
+            catch (error) {
+                // Clear tokens in case any were set during the failed attempt
+                this.apiClient.clearTokens();
+                // If error is "UserNotFoundException", account doesn't exist
+                if (error.message?.includes('UserNotFoundException') || error.message?.includes('NotAuthorizedException')) {
+                    return false;
+                }
+                // For other errors, assume account exists but password is wrong
+                return true;
+            }
+        }
+        catch (error) {
+            // Ensure tokens are cleared even on unexpected errors
+            this.apiClient.clearTokens();
+            console.error('Error checking account:', error);
+            return false;
+        }
+    }
+    /**
+     * Authenticate device with device ID and password
+     * This method is used when the CLI needs to authenticate as a device.
+     * NOTE: This will overwrite user tokens. Use verifyDeviceCredentials() for verification only.
+     * @param deviceId - Device ID
+     * @param password - Device password
+     * @returns Promise<LoginResponse> - Login response with tokens
+     */
+    async loginDevice(deviceId, password) {
+        try {
+            const loginRequest = { email: deviceId, password };
+            const response = await this.apiClient.login(loginRequest);
+            // The API client already sets the tokens internally, just save them to config
+            // NOTE: This overwrites user tokens - use this only when CLI needs to act as device
+            this.saveTokensToConfig();
+            return response;
+        }
+        catch (error) {
+            console.error('Error logging in device:', error);
+            throw error;
+        }
+    }
+    /**
+     * Verify device credentials without overwriting user tokens
+     * This creates a temporary API client instance for verification
+     * @param deviceId - Device ID
+     * @param password - Device password
+     * @returns Promise<boolean> - True if credentials are valid
+     */
+    async verifyDeviceCredentials(deviceId, password) {
+        try {
+            // Save current user tokens to restore later
+            const currentAccessToken = this.apiClient.getAccessToken();
+            const currentIdToken = this.apiClient.getIdToken();
+            const currentRefreshToken = this.apiClient.getRefreshToken();
+            // Create a temporary API client for verification
+            const tempApiClient = (0, client_1.createApiClient)(this.baseUrl);
+            const loginRequest = { email: deviceId, password };
+            try {
+                await tempApiClient.login(loginRequest);
+                // Verification successful
+                // Restore user tokens
+                if (currentAccessToken) {
+                    this.apiClient.setAccessToken(currentAccessToken);
+                }
+                if (currentIdToken) {
+                    this.apiClient.setIdToken(currentIdToken);
+                }
+                if (currentRefreshToken) {
+                    this.apiClient.setRefreshToken(currentRefreshToken);
+                }
+                return true;
+            }
+            catch (error) {
+                // Verification failed, but restore user tokens anyway
+                if (currentAccessToken) {
+                    this.apiClient.setAccessToken(currentAccessToken);
+                }
+                if (currentIdToken) {
+                    this.apiClient.setIdToken(currentIdToken);
+                }
+                if (currentRefreshToken) {
+                    this.apiClient.setRefreshToken(currentRefreshToken);
+                }
+                return false;
+            }
+        }
+        catch (error) {
+            console.error('Error verifying device credentials:', error);
+            return false;
+        }
+    }
+    /**
+     * Refresh authentication tokens
+     * @param refreshToken - Refresh token
+     * @returns Promise<RefreshTokenResponse> - New tokens
+     */
+    async refreshToken(refreshToken) {
+        try {
+            const response = await this.apiClient.refreshToken({ refreshToken });
+            // Save new tokens to config
+            this.saveTokensToConfig();
+            return response;
+        }
+        catch (error) {
+            console.error('Error refreshing token:', error);
+            throw error;
+        }
+    }
+    /**
+     * Get access token
+     * @returns string | undefined - Access token
+     */
+    getAccessToken() {
+        return this.apiClient.getAccessToken();
+    }
+    /**
+     * Get ID token
+     * @returns string | undefined - ID token
+     */
+    getIdToken() {
+        return this.apiClient.getIdToken();
+    }
+    /**
+     * Get refresh token
+     * @returns string | undefined - Refresh token
+     */
+    getRefreshToken() {
+        return this.apiClient.getRefreshToken();
+    }
+    /**
+     * Create a new account
+     * @param email - Email address
+     * @param name - Full name
+     * @returns Promise<boolean> - True if account created successfully
+     */
+    async createAccount(email, name) {
+        try {
+            // This would typically redirect to web signup or use a different endpoint
+            console.log(`Creating account for: ${email} (${name})`);
+            console.log('Account creation should be done through the web interface');
+            return true;
+        }
+        catch (error) {
+            console.error('Error creating account:', error);
+            return false;
+        }
+    }
+    /**
+     * Get account status
+     * @param email - Email address
+     * @returns Promise<object> - Account status information
+     */
+    async getAccountStatus(email) {
+        try {
+            // In a real implementation, this would make an API call
+            console.log(`Getting account status for: ${email}`);
+            // Simulate API call delay
+            await new Promise(resolve => setTimeout(resolve, 1000));
+            // For demo purposes, return mock data
+            return {
+                email,
+                status: 'active',
+                createdAt: new Date().toISOString(),
+                lastLogin: new Date().toISOString()
+            };
+        }
+        catch (error) {
+            console.error('Error getting account status:', error);
+            throw error;
+        }
+    }
+    /**
+     * Set up an application for a workload
+     * @param workload - The workload to set up an application for
+     * @param port - The port to expose
+     * @param protocol - The protocol to use
+     * @param description - Optional description
+     * @returns Promise<Application> - The created application
+     */
+    async setupApplication(workload, port, protocol = 'http', description, gatewayId) {
+        try {
+            // Attempt auto re-login if tokens are missing but credentials are available
+            await this.attemptAutoRelogin();
+            console.log(`Setting up application for workload: ${workload.name}`);
+            // Get organization ID from config
+            const configManager = new config_1.ConfigManager();
+            const config = configManager.getConfig();
+            if (!config.organizationId) {
+                throw new Error('No organization ID found. Please login first.');
+            }
+            // Generate a serving IP (in real implementation, this would come from the API)
+            const servingIp = this.generateServingIp();
+            const url = `${protocol}://${servingIp}:${port}`;
+            // Create application via API
+            const deviceIds = [config.deviceId || 'unknown'];
+            const createRequest = {
+                name: `${workload.name}-app`,
+                description: description || `Application for ${workload.name}`,
+                organizationId: config.organizationId,
+                configuration: {
+                    port: port,
+                    protocol: protocol,
+                    url
+                },
+                deviceIds: deviceIds,
+                gatewayIds: gatewayId ? [gatewayId] : [],
+                subtype: 'local-preexisting'
+            };
+            const response = await this.apiClient.createApplication(createRequest);
+            // Validate API response
+            if (!response || !response.application) {
+                throw new Error('Invalid API response: missing application data');
+            }
+            if (!response.application.id) {
+                throw new Error('Invalid API response: missing application ID');
+            }
+            // Map API response to CLI Application format
+            const application = {
+                id: response.application.id,
+                name: `${workload.name}-app`,
+                workloadId: workload.id,
+                servingIp: servingIp,
+                port: port,
+                protocol: protocol,
+                status: 'active',
+                createdAt: new Date().toISOString(),
+                description: description || `Application for ${workload.name}`
+            };
+            return application;
+        }
+        catch (error) {
+            console.error('Error setting up application:', error);
+            throw error;
+        }
+    }
+    /**
+     * Get all applications
+     * @returns Promise<Application[]> - List of applications
+     */
+    async getApplications() {
+        try {
+            // Attempt auto re-login if tokens are missing but credentials are available
+            await this.attemptAutoRelogin();
+            console.log('Getting applications...');
+            const configManager = new config_1.ConfigManager();
+            const config = configManager.getConfig();
+            let organizationId;
+            // Check if we have an organization ID in the config (device login)
+            if (config.organizationId) {
+                organizationId = config.organizationId;
+            }
+            else if (config.email) {
+                // User login - get their organizations first
+                console.log('Getting user organizations...');
+                const userOrgs = await this.apiClient.getUserOrganizations(config.email);
+                // Filter for standard (non-billing) organizations only
+                const standardOrgs = userOrgs.organizations.filter((org) => org.organizationType !== 'billing');
+                if (standardOrgs.length === 0) {
+                    console.log('No standard organizations found for this user.');
+                    return [];
+                }
+                // Use the first standard organization
+                organizationId = standardOrgs[0].organizationId;
+                console.log(`Using organization: ${standardOrgs[0].name}`);
+            }
+            else {
+                console.log('No organization ID or email found. Please login first.');
+                return [];
+            }
+            // Call the real API to get organization applications
+            const response = await this.apiClient.getOrganizationApplications(organizationId);
+            // Map API response to CLI Application format
+            const applications = response.applications.map(app => ({
+                id: app.id,
+                name: app.name,
+                workloadId: app.deviceIds[0] || 'unknown', // Use first device ID as workload ID
+                servingIp: app.url ? new URL(app.url).hostname : 'unknown',
+                port: app.url ? parseInt(new URL(app.url).port) || 80 : 80,
+                protocol: app.url && app.url.startsWith('https') ? 'https' : 'http',
+                status: app.status === 'running' ? 'active' : 'inactive',
+                createdAt: app.createdAt,
+                description: app.description
+            }));
+            return applications;
+        }
+        catch (error) {
+            console.error('Error getting applications:', error);
+            throw error;
+        }
+    }
+    /**
+     * Get application by ID
+     * @param id - Application ID
+     * @returns Promise<Application | null> - The application or null if not found
+     */
+    async getApplication(id) {
+        try {
+            // Try to get from API first
+            try {
+                const response = await this.apiClient.getApplication(id);
+                const appData = response.application;
+                // Extract port and protocol from configuration if needed
+                const port = appData.configuration?.port || 3000;
+                const protocol = (appData.configuration?.protocol || 'http');
+                const workloadId = appData.configuration?.workloadId || '';
+                return {
+                    id: appData.id,
+                    name: appData.name,
+                    description: appData.description || '',
+                    servingIp: this.generateServingIp(),
+                    port: typeof port === 'number' ? port : 3000,
+                    protocol: protocol,
+                    status: appData.status === 'running' ? 'active' : 'inactive',
+                    workloadId: workloadId || undefined,
+                    createdAt: appData.createdAt || new Date().toISOString(),
+                    url: appData.url
+                };
+            }
+            catch (apiError) {
+                // Fall back to local storage if API fails
+                const application = this.applications.find(app => app.id === id);
+                if (application) {
+                    return application;
+                }
+                throw new Error(`Application not found: ${id}`);
+            }
+        }
+        catch (error) {
+            console.error('Error getting application:', error);
+            throw error;
+        }
+    }
+    /**
+     * Delete an application
+     * @param id - Application ID
+     * @returns Promise<boolean> - True if deleted successfully
+     */
+    async deleteApplication(id) {
+        try {
+            console.log(`Deleting application: ${id}`);
+            // Simulate API call delay
+            await new Promise(resolve => setTimeout(resolve, 1000));
+            const index = this.applications.findIndex(app => app.id === id);
+            if (index !== -1) {
+                this.applications.splice(index, 1);
+                return true;
+            }
+            return false;
+        }
+        catch (error) {
+            console.error('Error deleting application:', error);
+            throw error;
+        }
+    }
+    /**
+     * Generate a mock serving IP address
+     * In a real implementation, this would be provided by the Edgible service
+     */
+    generateServingIp() {
+        // Generate a mock IP in the 10.x.x.x range
+        const octet1 = 10;
+        const octet2 = Math.floor(Math.random() * 255);
+        const octet3 = Math.floor(Math.random() * 255);
+        const octet4 = Math.floor(Math.random() * 254) + 1; // Avoid .0
+        return `${octet1}.${octet2}.${octet3}.${octet4}`;
+    }
+    /**
+     * Get user organizations
+     * @param email - Email address
+     * @returns Promise<GetUserOrganizationsResponse> - User organizations
+     */
+    async getUserOrganizations(email) {
+        try {
+            return await this.apiClient.getUserOrganizations(email);
+        }
+        catch (error) {
+            console.error('Error getting user organizations:', error);
+            throw error;
+        }
+    }
+    // Gateway Management Methods
+    /**
+     * Create a gateway device and EC2 instance
+     */
+    async createGateway(config) {
+        try {
+            // Attempt auto re-login if tokens are missing but credentials are available
+            await this.attemptAutoRelogin();
+            console.log(chalk_1.default.blue('Creating gateway...'));
+            // Get organization ID
+            const configManager = new config_1.ConfigManager();
+            const userConfig = configManager.getConfig();
+            if (!userConfig.organizationId) {
+                throw new Error('No organization ID found. Please login first.');
+            }
+            // Initialize AWS service
+            const awsService = new aws_1.AWSService(config.awsProfile, config.region);
+            // Check AWS CLI availability
+            const awsCheck = await awsService.checkAWSCLI();
+            if (!awsCheck.available) {
+                throw new Error('AWS CLI is not installed or not available');
+            }
+            // Validate AWS credentials
+            const credentialsValid = await awsService.validateCredentials(config.awsProfile);
+            if (!credentialsValid) {
+                throw new Error('AWS credentials are invalid or not configured');
+            }
+            // Generate unique key pair name
+            const keyPairName = `edgible-gateway-${Date.now()}`;
+            // Create key pair
+            console.log(chalk_1.default.gray('Creating SSH key pair...'));
+            const keyPair = await awsService.createKeyPair(keyPairName);
+            // Save SSH key locally
+            const keyPath = awsService.saveSSHKey(keyPair, keyPairName);
+            console.log(chalk_1.default.green(`✓ SSH key saved to: ${keyPath}`));
+            // Create EC2 instance
+            console.log(chalk_1.default.gray('Creating EC2 instance...'));
+            const ec2Instance = await awsService.createEC2Instance({
+                name: config.name,
+                instanceType: config.instanceType || 't3.micro',
+                keyPairName: keyPairName,
+                userData: this.generateAgentUserData(userConfig.deviceId || 'unknown')
+            });
+            console.log(chalk_1.default.green(`✓ EC2 instance created: ${ec2Instance.instanceId}`));
+            // Create gateway device via API (regular device with gateway type)
+            console.log(chalk_1.default.gray('Creating gateway device...'));
+            const deviceRequest = {
+                name: config.name,
+                description: config.description || `Gateway: ${config.name}`,
+                organizationId: userConfig.organizationId,
+                type: 'gateway',
+                userEmail: userConfig.email || '',
+                configuration: {
+                    awsProfile: config.awsProfile,
+                    region: config.region || 'us-east-1',
+                    instanceType: config.instanceType || 't3.micro',
+                    keyPairName: keyPairName,
+                    ec2InstanceId: ec2Instance.instanceId,
+                    publicIp: ec2Instance.publicIp,
+                    privateIp: ec2Instance.privateIp,
+                    state: ec2Instance.state
+                }
+            };
+            const response = await this.apiClient.createDevice(deviceRequest);
+            // Store gateway info in config
+            configManager.addGateway(response.device.id, {
+                name: config.name,
+                deviceId: response.device.id,
+                ec2InstanceId: ec2Instance.instanceId,
+                publicIp: ec2Instance.publicIp,
+                privateIp: ec2Instance.privateIp,
+                keyPairName: keyPairName,
+                keyPath: keyPath,
+                region: config.region || 'us-east-1'
+            });
+            // Store AWS profile and region
+            if (config.awsProfile) {
+                configManager.setAWSProfile(config.awsProfile);
+            }
+            if (config.region) {
+                configManager.setAWSRegion(config.region);
+            }
+            console.log(chalk_1.default.green('✓ Gateway created successfully!'));
+            return {
+                message: 'Gateway created successfully',
+                gateway: {
+                    id: response.device.id,
+                    name: response.device.name,
+                    description: response.device.description,
+                    organizationId: response.device.organizationId,
+                    createdAt: response.device.createdAt
+                },
+                ec2Instance: {
+                    instanceId: ec2Instance.instanceId,
+                    publicIp: ec2Instance.publicIp,
+                    privateIp: ec2Instance.privateIp,
+                    state: ec2Instance.state,
+                    keyPairName: keyPairName,
+                    region: config.region || 'us-east-1'
+                },
+                sshKey: {
+                    privateKey: keyPair.privateKey,
+                    publicKey: keyPair.publicKey,
+                    keyName: keyPairName
+                }
+            };
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Error creating gateway:'), error);
+            throw error;
+        }
+    }
+    /**
+     * Create a serving device in the organization
+     */
+    async createServingDevice(config) {
+        try {
+            // Attempt auto re-login if tokens are missing but credentials are available
+            await this.attemptAutoRelogin();
+            const userConfig = this.configManager.getConfig();
+            if (!userConfig.organizationId) {
+                throw new Error('No organization ID found. Please login first.');
+            }
+            // Create device via API - password will be generated by the API
+            const deviceRequest = {
+                name: config.name,
+                description: config.description || `Serving device: ${config.name}`,
+                organizationId: userConfig.organizationId,
+                type: 'server',
+                userEmail: userConfig.email || ''
+            };
+            const response = await this.apiClient.createDevice(deviceRequest);
+            return {
+                device: {
+                    id: response.device.id,
+                    name: response.device.name,
+                    description: response.device.description,
+                    type: response.device.type,
+                    organizationId: response.device.organizationId,
+                    createdAt: response.device.createdAt,
+                    password: response.device.password // Include password from API response
+                }
+            };
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Error creating serving device:'), error);
+            throw error;
+        }
+    }
+    /**
+     * List all serving devices
+     */
+    async listServingDevices() {
+        try {
+            // Attempt auto re-login if tokens are missing but credentials are available
+            await this.attemptAutoRelogin();
+            const configManager = new config_1.ConfigManager();
+            const userConfig = configManager.getConfig();
+            if (!userConfig.organizationId) {
+                throw new Error('No organization ID found. Please login first.');
+            }
+            // Get all devices from the organization
+            const devicesResponse = await this.apiClient.getOrganizationDevices(userConfig.organizationId);
+            // Filter for serving devices (devices with type 'server')
+            const servingDevices = devicesResponse.devices.filter((device) => device.type === 'server');
+            // Map serving devices
+            const devices = servingDevices.map((device) => ({
+                id: device.id,
+                name: device.name,
+                description: device.description,
+                type: device.type,
+                organizationId: device.organizationId,
+                createdAt: device.createdAt
+            }));
+            return {
+                devices
+            };
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Error listing serving devices:'), error);
+            throw error;
+        }
+    }
+    /**
+     * Get a specific device by ID
+     */
+    async getDevice(deviceId) {
+        try {
+            // Attempt auto re-login if tokens are missing but credentials are available
+            await this.attemptAutoRelogin();
+            // Call the API to get device details
+            const deviceResponse = await this.apiClient.getDevice(deviceId);
+            return deviceResponse;
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Error fetching device:'), error);
+            throw error;
+        }
+    }
+    /**
+     * List all gateways
+     */
+    async listGateways() {
+        try {
+            // Attempt auto re-login if tokens are missing but credentials are available
+            await this.attemptAutoRelogin();
+            const configManager = new config_1.ConfigManager();
+            const userConfig = configManager.getConfig();
+            if (!userConfig.organizationId) {
+                throw new Error('No organization ID found. Please login first.');
+            }
+            // Get all devices from the organization
+            const devicesResponse = await this.apiClient.getOrganizationDevices(userConfig.organizationId);
+            // Filter for gateway devices
+            const gatewayDevices = devicesResponse.devices.filter((device) => device.type === 'gateway');
+            // Enrich with local gateway info
+            const gateways = gatewayDevices.map((device) => {
+                const localInfo = configManager.getGateway(device.id);
+                return {
+                    device: {
+                        id: device.id,
+                        name: device.name,
+                        description: device.description,
+                        type: device.type,
+                        organizationId: device.organizationId,
+                        createdAt: device.createdAt
+                    },
+                    ec2Instance: localInfo ? {
+                        instanceId: localInfo.ec2InstanceId,
+                        publicIp: localInfo.publicIp,
+                        privateIp: localInfo.privateIp,
+                        state: 'running', // Assume running if in config
+                        region: localInfo.region
+                    } : undefined,
+                    applicationsCount: 0 // TODO: Calculate from local applications
+                };
+            });
+            return {
+                gateways
+            };
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Error listing gateways:'), error);
+            throw error;
+        }
+    }
+    /**
+     * Delete a gateway
+     */
+    async deleteGateway(gatewayId, force = false) {
+        try {
+            // Attempt auto re-login if tokens are missing but credentials are available
+            await this.attemptAutoRelogin();
+            const configManager = new config_1.ConfigManager();
+            const gatewayInfo = configManager.getGateway(gatewayId);
+            if (!gatewayInfo) {
+                throw new Error('Gateway not found in local configuration');
+            }
+            // Check if gateway has active applications (unless forced)
+            if (!force) {
+                const applications = await this.getGatewayApplications(gatewayId);
+                if (applications.length > 0) {
+                    throw new Error(`Gateway has ${applications.length} active applications. Use --force to delete anyway.`);
+                }
+            }
+            // Terminate EC2 instance
+            const awsService = new aws_1.AWSService(configManager.getAWSProfile(), gatewayInfo.region);
+            await awsService.terminateInstance(gatewayInfo.ec2InstanceId);
+            console.log(chalk_1.default.green(`✓ EC2 instance terminated: ${gatewayInfo.ec2InstanceId}`));
+            // Delete key pair
+            await awsService.deleteKeyPair(gatewayInfo.keyPairName);
+            console.log(chalk_1.default.green(`✓ Key pair deleted: ${gatewayInfo.keyPairName}`));
+            // Delete gateway device via API
+            const response = await this.apiClient.deleteDevice(gatewayId);
+            // Remove from local config
+            configManager.removeGateway(gatewayId);
+            console.log(chalk_1.default.green('✓ Gateway deleted successfully!'));
+            return {
+                success: true,
+                message: 'Gateway deleted successfully'
+            };
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Error deleting gateway:'), error);
+            throw error;
+        }
+    }
+    /**
+     * Resync agent on gateway
+     */
+    // Managed Gateway Methods (admin/debug only)
+    /**
+     * Create a managed gateway (admin only)
+     */
+    async createManagedGateway(config) {
+        try {
+            await this.attemptAutoRelogin();
+            console.log(chalk_1.default.blue('Creating managed gateway...'));
+            const response = await this.apiClient.createManagedGateway({
+                region: config.region || 'us-east-1',
+                instanceType: config.instanceType || 't3.micro',
+                name: config.name
+            });
+            console.log(chalk_1.default.green('✓ Managed gateway created successfully!'));
+            return response;
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Error creating managed gateway:'), error);
+            throw error;
+        }
+    }
+    /**
+     * List all managed gateways (admin only)
+     */
+    async listManagedGateways() {
+        try {
+            await this.attemptAutoRelogin();
+            const response = await this.apiClient.listManagedGateways();
+            return response;
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Error listing managed gateways:'), error);
+            throw error;
+        }
+    }
+    /**
+     * Get managed gateway details (admin only)
+     */
+    async getManagedGateway(gatewayId) {
+        try {
+            await this.attemptAutoRelogin();
+            const response = await this.apiClient.getManagedGateway({ gatewayId });
+            return response;
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Error getting managed gateway:'), error);
+            throw error;
+        }
+    }
+    /**
+     * Delete a managed gateway (admin only)
+     */
+    async deleteManagedGateway(gatewayId, force = false) {
+        try {
+            await this.attemptAutoRelogin();
+            await this.apiClient.deleteManagedGateway({
+                gatewayId,
+                force
+            });
+            console.log(chalk_1.default.green('✓ Managed gateway deleted successfully!'));
+            return { success: true };
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Error deleting managed gateway:'), error);
+            throw error;
+        }
+    }
+    /**
+     * Resync agent on a managed gateway (admin only)
+     */
+    async resyncManagedGatewayAgent(gatewayId, agentVersion, installFromLocal, reboot, wipeLogs, debug) {
+        try {
+            await this.attemptAutoRelogin();
+            // Get managed gateway details to get SSH info
+            const gatewayDetails = await this.getManagedGateway(gatewayId);
+            if (!gatewayDetails.success || !gatewayDetails.gateway) {
+                throw new Error('Managed gateway not found');
+            }
+            const gateway = gatewayDetails.gateway;
+            const ipAddress = gateway.ipAddress;
+            if (!ipAddress) {
+                throw new Error('Gateway IP address not available');
+            }
+            // Get SSH key from backend
+            console.log(chalk_1.default.gray('Fetching SSH key from backend...'));
+            const sshKeyResponse = await this.apiClient.getManagedGatewaySSHKey({ gatewayId });
+            if (!sshKeyResponse.success || !sshKeyResponse.sshPrivateKey) {
+                throw new Error('Failed to retrieve SSH key for managed gateway');
+            }
+            const sshPrivateKey = sshKeyResponse.sshPrivateKey;
+            // Use AWSService to handle SSH operations
+            const { AWSService } = await Promise.resolve().then(() => __importStar(require('./aws')));
+            const awsService = new AWSService();
+            // Create temporary SSH key file
+            const os = require('os');
+            const path = require('path');
+            const fs = require('fs');
+            const tempKeyPath = path.join(os.tmpdir(), `edgible-mgw-${gatewayId}-${Date.now()}.pem`);
+            try {
+                // Write SSH key to temp file
+                fs.writeFileSync(tempKeyPath, sshPrivateKey, { mode: 0o600 });
+                // Create SSH connection
+                const connection = {
+                    host: ipAddress,
+                    port: 22,
+                    username: 'ec2-user',
+                    privateKey: sshPrivateKey
+                };
+                // Wait for instance to be ready for SSH
+                console.log(chalk_1.default.gray('Waiting for instance to be ready for SSH...'));
+                // Note: For managed gateways, we may not have the EC2 instance ID readily available
+                // We'll try to connect directly
+                await new Promise(resolve => setTimeout(resolve, 2000)); // Brief wait
+                // Test SSH connection
+                console.log(chalk_1.default.gray('Testing SSH connection...'));
+                try {
+                    await awsService.executeSSHCommand(connection, 'echo "SSH connection successful"');
+                    console.log(chalk_1.default.green('✓ SSH connection established'));
+                }
+                catch (sshError) {
+                    console.error(chalk_1.default.red('✗ SSH connection failed:'), sshError);
+                    throw new Error(`SSH connection failed: ${sshError instanceof Error ? sshError.message : 'Unknown error'}`);
+                }
+                // Wipe logs if requested (before stopping service)
+                let logsWiped = false;
+                if (wipeLogs) {
+                    console.log(chalk_1.default.gray('Wiping agent logs...'));
+                    try {
+                        const wipeResult = await this.wipeManagedGatewayLogs(gatewayId);
+                        if (wipeResult.success) {
+                            console.log(chalk_1.default.green('✓ Logs wiped successfully'));
+                            logsWiped = true;
+                        }
+                        else {
+                            console.log(chalk_1.default.yellow('⚠ Failed to wipe logs, continuing with resync'));
+                        }
+                    }
+                    catch (wipeError) {
+                        console.log(chalk_1.default.yellow(`⚠ Error wiping logs: ${wipeError instanceof Error ? wipeError.message : String(wipeError)}, continuing with resync`));
+                    }
+                }
+                // Use the same resync logic as regular gateways
+                // Stop agent service
+                console.log(chalk_1.default.gray('Stopping agent service...'));
+                await awsService.executeSSHCommand(connection, 'sudo systemctl stop edgible-agent');
+                // Ensure the agent directory exists
+                console.log(chalk_1.default.gray('Creating agent directory...'));
+                await awsService.executeSSHCommand(connection, 'sudo mkdir -p /opt/edgible-agent');
+                await awsService.executeSSHCommand(connection, 'sudo chown root:root /opt/edgible-agent');
+                // Check Node.js installation and path
+                console.log(chalk_1.default.gray('Checking Node.js installation...'));
+                const nodeCheck = await awsService.executeSSHCommand(connection, 'which node || echo "node not found"');
+                const nodePath = nodeCheck.stdout.trim();
+                console.log(chalk_1.default.gray(`Node.js path: ${nodePath}`));
+                if (nodePath === 'node not found') {
+                    console.log(chalk_1.default.gray('Installing Node.js...'));
+                    await awsService.executeSSHCommand(connection, 'curl -fsSL https://rpm.nodesource.com/setup_18.x | sudo bash -');
+                    await awsService.executeSSHCommand(connection, 'sudo yum install -y nodejs');
+                }
+                // Check and install required system dependencies
+                console.log(chalk_1.default.gray('Checking system dependencies...'));
+                // Check iptables
+                const iptablesCheck = await awsService.executeSSHCommand(connection, 'which iptables || echo "iptables not found"');
+                if (iptablesCheck.stdout.trim() === 'iptables not found') {
+                    console.log(chalk_1.default.gray('Installing iptables...'));
+                    await awsService.executeSSHCommand(connection, 'sudo yum install -y iptables');
+                }
+                else {
+                    console.log(chalk_1.default.gray('✓ iptables is installed'));
+                }
+                // Check WireGuard
+                const wireguardCheck = await awsService.executeSSHCommand(connection, 'which wg || echo "wireguard not found"');
+                if (wireguardCheck.stdout.trim() === 'wireguard not found') {
+                    console.log(chalk_1.default.gray('Installing WireGuard...'));
+                    await awsService.executeSSHCommand(connection, 'sudo amazon-linux-extras install epel -y || sudo yum install -y epel-release');
+                    await awsService.executeSSHCommand(connection, 'sudo yum install -y wireguard-tools');
+                    await awsService.executeSSHCommand(connection, 'sudo modprobe wireguard || true');
+                }
+                else {
+                    console.log(chalk_1.default.gray('✓ WireGuard is installed'));
+                }
+                // Check HAProxy (gateway devices use HAProxy instead of Caddy)
+                const haproxyCheck = await awsService.executeSSHCommand(connection, 'which haproxy 2>/dev/null || test -f /usr/sbin/haproxy && echo "haproxy found" || echo "haproxy not found"');
+                if (haproxyCheck.stdout.trim() === 'haproxy not found' || (haproxyCheck.stdout.trim() === '' && !haproxyCheck.stdout.includes('haproxy found'))) {
+                    console.log(chalk_1.default.gray('Installing HAProxy...'));
+                    // Install HAProxy via package manager
+                    await awsService.executeSSHCommand(connection, 'sudo yum install -y haproxy');
+                    // Create HAProxy config directory
+                    await awsService.executeSSHCommand(connection, 'sudo mkdir -p /etc/haproxy');
+                    // Create HAProxy runtime socket directory
+                    await awsService.executeSSHCommand(connection, 'sudo mkdir -p /var/run/haproxy');
+                    // Set capabilities for HAProxy to bind to privileged ports
+                    await awsService.executeSSHCommand(connection, 'sudo setcap cap_net_bind_service=+ep /usr/sbin/haproxy || true');
+                    // Create HAProxy chroot directory
+                    await awsService.executeSSHCommand(connection, 'sudo mkdir -p /var/lib/haproxy');
+                    await awsService.executeSSHCommand(connection, 'sudo chown haproxy:haproxy /var/lib/haproxy || sudo chown root:root /var/lib/haproxy || true');
+                    // Verify installation
+                    const verifyResult = await awsService.executeSSHCommand(connection, '/usr/sbin/haproxy -v 2>&1');
+                    if (!verifyResult.stdout.includes('HAProxy') && !verifyResult.stdout.includes('version')) {
+                        throw new Error(`HAProxy installation verification failed. Output: ${verifyResult.stdout}`);
+                    }
+                    console.log(chalk_1.default.green('✓ HAProxy installed successfully'));
+                }
+                else {
+                    console.log(chalk_1.default.gray('✓ HAProxy is installed'));
+                    // Verify it's accessible
+                    const verifyResult = await awsService.executeSSHCommand(connection, 'haproxy -v 2>&1 || /usr/sbin/haproxy -v 2>&1');
+                    if (verifyResult.stdout.includes('command not found') && !verifyResult.stdout.includes('HAProxy') && !verifyResult.stdout.includes('version')) {
+                        console.log(chalk_1.default.yellow('⚠ HAProxy found but not accessible, verifying...'));
+                        // Re-verify
+                        const reVerifyResult = await awsService.executeSSHCommand(connection, 'haproxy -v 2>&1 || /usr/sbin/haproxy -v 2>&1');
+                        if (!reVerifyResult.stdout.includes('HAProxy') && !reVerifyResult.stdout.includes('version')) {
+                            console.log(chalk_1.default.yellow('⚠ HAProxy verification still failing, but continuing...'));
+                        }
+                    }
+                }
+                // Get device password from API
+                console.log(chalk_1.default.gray('Retrieving device credentials...'));
+                const deviceResponse = await this.apiClient.getDevice(gatewayId);
+                const devicePassword = deviceResponse.device?.password || '';
+                if (!devicePassword) {
+                    throw new Error('Could not retrieve device password from API');
+                }
+                // Create agent configuration file
+                console.log(chalk_1.default.gray('Creating agent configuration...'));
+                const configManager = new config_1.ConfigManager();
+                const userConfig = configManager.getConfig();
+                const agentConfig = {
+                    deviceId: gatewayId,
+                    devicePassword: devicePassword,
+                    deviceType: 'gateway',
+                    apiBaseUrl: (0, urls_1.getApiBaseUrl)(),
+                    organizationId: gateway.organizationId || '',
+                    firewallEnabled: true,
+                    pollingInterval: 60000,
+                    healthCheckTimeout: 5000,
+                    maxRetries: 3,
+                    logLevel: debug ? 'debug' : 'info',
+                    updateEnabled: true,
+                    updateCheckInterval: 3600000,
+                    wireguardMode: userConfig.wireguardMode || 'kernel',
+                    wireguardGoBinary: userConfig.wireguardGoBinary || 'wireguard-go'
+                };
+                const configFile = `/tmp/agent-config-${Date.now()}.json`;
+                fs.writeFileSync(configFile, JSON.stringify(agentConfig, null, 2));
+                try {
+                    console.log(chalk_1.default.gray('Uploading agent configuration...'));
+                    // Upload to user's home directory first (where we have write permissions)
+                    // Then move to /opt/edgible-agent with sudo
+                    const homeDir = connection.username === 'ec2-user' ? '/home/ec2-user' : `/home/${connection.username}`;
+                    const remoteHomeConfigPath = `${homeDir}/agent-config-${Date.now()}.json`;
+                    const remoteConfigPath = '/opt/edgible-agent/agent.config.json';
+                    console.log(chalk_1.default.gray(`  Local file: ${configFile}`));
+                    console.log(chalk_1.default.gray(`  Uploading to: ${remoteHomeConfigPath}`));
+                    try {
+                        await awsService.uploadFile(connection, configFile, remoteHomeConfigPath);
+                        console.log(chalk_1.default.green('  ✓ Config file uploaded successfully'));
+                        // Move to final location with sudo and set ownership
+                        console.log(chalk_1.default.gray(`  Moving to: ${remoteConfigPath}`));
+                        const moveResult = await awsService.executeSSHCommand(connection, `sudo mv ${remoteHomeConfigPath} ${remoteConfigPath} && sudo chown root:root ${remoteConfigPath} && echo "OK" || echo "FAIL"`);
+                        if (moveResult.stdout.trim() === 'OK') {
+                            console.log(chalk_1.default.green('  ✓ Config file moved and ownership set'));
+                        }
+                        else {
+                            throw new Error(`Failed to move config file: ${moveResult.stderr || moveResult.stdout}`);
+                        }
+                    }
+                    catch (configError) {
+                        console.error(chalk_1.default.red(`  ✗ Config upload failed: ${configError instanceof Error ? configError.message : String(configError)}`));
+                        throw new Error(`Failed to upload agent configuration: ${configError instanceof Error ? configError.message : String(configError)}`);
+                    }
+                }
+                finally {
+                    if (fs.existsSync(configFile)) {
+                        fs.unlinkSync(configFile);
+                    }
+                }
+                // Create systemd service file
+                console.log(chalk_1.default.gray('Creating systemd service...'));
+                const finalNodePath = nodePath === 'node not found' ? '/usr/bin/node' : nodePath;
+                const systemAgentPath = PathResolver_1.PathResolver.getSystemDataPath() + '/agent';
+                const serviceContent = `[Unit]
+Description=Edgible Agent
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/edgible-agent
+ExecStart=${finalNodePath} /opt/edgible-agent/index.js start -c /opt/edgible-agent/agent.config.json
+Restart=always
+RestartSec=10
+Environment=NODE_ENV=production
+Environment=EDGIBLE_CONFIG_PATH=${systemAgentPath}
+Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+[Install]
+WantedBy=multi-user.target`;
+                const serviceFile = `/tmp/edgible-agent-${Date.now()}.service`;
+                fs.writeFileSync(serviceFile, serviceContent);
+                try {
+                    await awsService.uploadFile(connection, serviceFile, '/tmp/edgible-agent.service');
+                    await awsService.executeSSHCommand(connection, 'sudo mv /tmp/edgible-agent.service /etc/systemd/system/edgible-agent.service');
+                    await awsService.executeSSHCommand(connection, 'sudo systemctl daemon-reload');
+                    await awsService.executeSSHCommand(connection, 'sudo systemctl enable edgible-agent.service');
+                }
+                finally {
+                    if (fs.existsSync(serviceFile)) {
+                        fs.unlinkSync(serviceFile);
+                    }
+                }
+                // Upload or download agent code
+                if (installFromLocal) {
+                    // Use existing local upload behavior
+                    // Gateway resync always uses gateway build
+                    console.log(chalk_1.default.gray('Uploading agent code from local directory...'));
+                    const agentV2Path = path.resolve(__dirname, '../../../agent-v2');
+                    const agentDistPath = path.join(agentV2Path, 'dist');
+                    const agentPackageJsonPath = path.join(agentV2Path, 'package.json');
+                    // Ensure gateway build exists (gateway resync always needs gateway code)
+                    const { execSync } = require('child_process');
+                    const gatewayCodePath = path.join(agentDistPath, 'gateway');
+                    const hasGatewayCode = fs.existsSync(gatewayCodePath);
+                    if (!fs.existsSync(agentDistPath) || !hasGatewayCode) {
+                        console.log(chalk_1.default.yellow('⚠ Building gateway agent (required for gateway resync)...'));
+                        try {
+                            execSync('npm run build:gateway', {
+                                cwd: agentV2Path,
+                                stdio: 'inherit'
+                            });
+                            console.log(chalk_1.default.green('✓ Gateway build completed'));
+                        }
+                        catch (buildError) {
+                            throw new Error(`Failed to build gateway agent: ${buildError instanceof Error ? buildError.message : String(buildError)}\n\n` +
+                                `Please build manually:\n` +
+                                `  cd agent-v2\n` +
+                                `  npm run build:gateway`);
+                        }
+                    }
+                    if (!fs.existsSync(agentDistPath)) {
+                        throw new Error('Agent distribution not found. This feature requires development environment setup. Please use S3 download instead.');
+                    }
+                    if (!fs.existsSync(agentPackageJsonPath)) {
+                        throw new Error('Agent package.json not found.');
+                    }
+                    // Create a tarball of the dist directory and package.json
+                    const tarPath = `/tmp/agent-dist-${Date.now()}.tar.gz`;
+                    try {
+                        console.log(chalk_1.default.gray('Creating agent distribution tarball...'));
+                        console.log(chalk_1.default.gray(`  Source dist: ${agentDistPath}`));
+                        console.log(chalk_1.default.gray(`  Source package.json: ${agentPackageJsonPath}`));
+                        // Create tarball with dist contents at root level and package.json
+                        const tempDir = `/tmp/agent-upload-${Date.now()}`;
+                        console.log(chalk_1.default.gray(`  Creating temp directory: ${tempDir}`));
+                        fs.mkdirSync(tempDir, { recursive: true });
+                        fs.copyFileSync(agentPackageJsonPath, path.join(tempDir, 'package.json'));
+                        // Copy contents of dist/ directly to tempDir root (so index.js ends up at /opt/edgible-agent/index.js)
+                        // Copy all files from dist including hidden files, but exclude . and ..
+                        execSync(`sh -c 'cd "${agentDistPath}" && find . -mindepth 1 -maxdepth 1 -exec cp -r {} "${tempDir}/" \\;'`, { stdio: 'inherit' });
+                        console.log(chalk_1.default.gray(`  Creating tarball: ${tarPath}`));
+                        execSync(`cd "${tempDir}" && tar -czf "${tarPath}" .`, { stdio: 'inherit' });
+                        // Verify tarball was created
+                        if (!fs.existsSync(tarPath)) {
+                            throw new Error(`Failed to create tarball at ${tarPath}`);
+                        }
+                        const tarStats = fs.statSync(tarPath);
+                        const tarSizeMB = (tarStats.size / (1024 * 1024)).toFixed(2);
+                        console.log(chalk_1.default.gray(`  Tarball created: ${tarSizeMB} MB`));
+                        // Clean up temp directory
+                        console.log(chalk_1.default.gray('  Cleaning up temp directory...'));
+                        fs.rmSync(tempDir, { recursive: true, force: true });
+                        // Upload tarball to user's home directory first (where we have write permissions)
+                        // Then move to /tmp with sudo if needed
+                        // Use explicit home directory path since SFTP might not expand ~
+                        const homeDir = connection.username === 'ec2-user' ? '/home/ec2-user' : `/home/${connection.username}`;
+                        const remoteHomePath = `${homeDir}/agent-dist-${Date.now()}.tar.gz`;
+                        const remoteTmpPath = `/tmp/agent-dist.tar.gz`;
+                        console.log(chalk_1.default.gray('Checking remote directory permissions...'));
+                        try {
+                            const homeDirCheck = await awsService.executeSSHCommand(connection, `test -d ${homeDir} && test -w ${homeDir} && echo "OK" || echo "FAIL"`);
+                            if (homeDirCheck.stdout.trim() !== 'OK') {
+                                console.log(chalk_1.default.yellow(`  Warning: Home directory ${homeDir} may not be writable`));
+                                console.log(chalk_1.default.gray(`  Attempting to verify with ls -ld: ${homeDir}`));
+                                const lsResult = await awsService.executeSSHCommand(connection, `ls -ld ${homeDir} 2>&1 || echo "directory_not_found"`);
+                                console.log(chalk_1.default.gray(`  Directory info: ${lsResult.stdout.trim()}`));
+                            }
+                            else {
+                                console.log(chalk_1.default.gray(`  ✓ Home directory ${homeDir} is writable`));
+                            }
+                        }
+                        catch (checkError) {
+                            console.log(chalk_1.default.yellow(`  Warning: Could not verify directory permissions: ${checkError instanceof Error ? checkError.message : String(checkError)}`));
+                        }
+                        console.log(chalk_1.default.blue('Uploading tarball to remote server...'));
+                        console.log(chalk_1.default.gray(`  Local file: ${tarPath}`));
+                        console.log(chalk_1.default.gray(`  Remote path: ${remoteHomePath}`));
+                        console.log(chalk_1.default.gray(`  File size: ${tarSizeMB} MB`));
+                        try {
+                            await awsService.uploadFile(connection, tarPath, remoteHomePath);
+                            console.log(chalk_1.default.green('  ✓ Upload completed successfully'));
+                            // Verify file was uploaded
+                            console.log(chalk_1.default.gray('  Verifying uploaded file...'));
+                            const verifyResult = await awsService.executeSSHCommand(connection, `test -f ${remoteHomePath} && ls -lh ${remoteHomePath} || echo "file_not_found"`);
+                            if (verifyResult.stdout.includes('file_not_found')) {
+                                throw new Error(`Upload verification failed: file not found at ${remoteHomePath}`);
+                            }
+                            console.log(chalk_1.default.gray(`  File verified: ${verifyResult.stdout.trim()}`));
+                        }
+                        catch (uploadError) {
+                            console.error(chalk_1.default.red(`  ✗ Upload failed: ${uploadError instanceof Error ? uploadError.message : String(uploadError)}`));
+                            throw new Error(`Failed to upload file to ${remoteHomePath}: ${uploadError instanceof Error ? uploadError.message : String(uploadError)}`);
+                        }
+                        // Move to /tmp using sudo (in case /tmp has permission restrictions)
+                        console.log(chalk_1.default.gray(`Moving file from ${remoteHomePath} to ${remoteTmpPath}...`));
+                        try {
+                            const moveResult = await awsService.executeSSHCommand(connection, `sudo mv ${remoteHomePath} ${remoteTmpPath} && sudo chmod 644 ${remoteTmpPath} && echo "OK" || echo "FAIL"`);
+                            if (moveResult.stdout.trim() === 'OK') {
+                                console.log(chalk_1.default.green('  ✓ File moved successfully'));
+                            }
+                            else {
+                                throw new Error(`Failed to move file: ${moveResult.stderr || moveResult.stdout}`);
+                            }
+                        }
+                        catch (moveError) {
+                            console.error(chalk_1.default.red(`  ✗ Move failed: ${moveError instanceof Error ? moveError.message : String(moveError)}`));
+                            throw new Error(`Failed to move file from ${remoteHomePath} to ${remoteTmpPath}: ${moveError instanceof Error ? moveError.message : String(moveError)}`);
+                        }
+                        // Extract on remote server
+                        console.log(chalk_1.default.gray('Extracting agent code...'));
+                        try {
+                            const extractResult = await awsService.executeSSHCommand(connection, 'cd /opt/edgible-agent && sudo tar -xzf /tmp/agent-dist.tar.gz && sudo rm /tmp/agent-dist.tar.gz && echo "OK" || echo "FAIL"');
+                            if (extractResult.stdout.trim() === 'OK') {
+                                console.log(chalk_1.default.green('  ✓ Extraction completed successfully'));
+                            }
+                            else {
+                                console.log(chalk_1.default.yellow(`  Warning: Extraction may have failed: ${extractResult.stderr || extractResult.stdout}`));
+                            }
+                        }
+                        catch (extractError) {
+                            console.error(chalk_1.default.red(`  ✗ Extraction failed: ${extractError instanceof Error ? extractError.message : String(extractError)}`));
+                            throw new Error(`Failed to extract agent code: ${extractError instanceof Error ? extractError.message : String(extractError)}`);
+                        }
+                        // Install production dependencies (run as root since directory is owned by root)
+                        console.log(chalk_1.default.gray('Installing agent dependencies...'));
+                        try {
+                            const installResult = await awsService.executeSSHCommand(connection, 'cd /opt/edgible-agent && sudo npm install --production --no-save');
+                            if (installResult.exitCode === 0) {
+                                console.log(chalk_1.default.green('  ✓ Dependencies installed successfully'));
+                            }
+                            else {
+                                console.log(chalk_1.default.yellow(`  Warning: npm install exited with code ${installResult.exitCode}`));
+                                console.log(chalk_1.default.gray(`  stdout: ${installResult.stdout}`));
+                                if (installResult.stderr) {
+                                    console.log(chalk_1.default.gray(`  stderr: ${installResult.stderr}`));
+                                }
+                            }
+                        }
+                        catch (installError) {
+                            console.error(chalk_1.default.red(`  ✗ Dependency installation failed: ${installError instanceof Error ? installError.message : String(installError)}`));
+                            throw new Error(`Failed to install dependencies: ${installError instanceof Error ? installError.message : String(installError)}`);
+                        }
+                        // Ensure index.js is executable
+                        console.log(chalk_1.default.gray('Setting file permissions...'));
+                        try {
+                            await awsService.executeSSHCommand(connection, 'sudo chmod +x /opt/edgible-agent/index.js || true');
+                            // Set proper ownership (root will own everything)
+                            await awsService.executeSSHCommand(connection, 'sudo chown -R root:root /opt/edgible-agent');
+                            // Create logs directory for root user
+                            const systemAgentPath = PathResolver_1.PathResolver.getSystemDataPath() + '/agent';
+                            await awsService.executeSSHCommand(connection, `sudo mkdir -p ${systemAgentPath}/logs`);
+                            await awsService.executeSSHCommand(connection, `sudo chown -R root:root ${PathResolver_1.PathResolver.getSystemDataPath()}`);
+                            await awsService.executeSSHCommand(connection, `sudo chmod -R 755 ${PathResolver_1.PathResolver.getSystemDataPath()}`);
+                            console.log(chalk_1.default.green('  ✓ Permissions and ownership set correctly'));
+                        }
+                        catch (permError) {
+                            console.error(chalk_1.default.red(`  ✗ Failed to set permissions: ${permError instanceof Error ? permError.message : String(permError)}`));
+                            throw new Error(`Failed to set file permissions: ${permError instanceof Error ? permError.message : String(permError)}`);
+                        }
+                    }
+                    finally {
+                        if (fs.existsSync(tarPath)) {
+                            fs.unlinkSync(tarPath);
+                        }
+                    }
+                }
+                else {
+                    // Download from CloudFront on remote server
+                    console.log(chalk_1.default.gray('Downloading agent from CloudFront...'));
+                    const distributionUrl = (0, urls_1.getDistributionUrl)();
+                    const version = agentVersion || 'latest';
+                    // Gateway resync always uses gateway build
+                    // Build CloudFront URL with gateway device type prefix
+                    // Format: {distributionUrl}/gateway/{version}.zip
+                    const downloadUrl = `${distributionUrl}/gateway/${version}.zip`;
+                    console.log(chalk_1.default.gray(`  Distribution: ${distributionUrl}`));
+                    console.log(chalk_1.default.gray(`  Device Type: gateway`));
+                    console.log(chalk_1.default.gray(`  Version: ${version}`));
+                    console.log(chalk_1.default.gray(`  URL: ${downloadUrl}`));
+                    // Check if unzip is installed, install if needed
+                    console.log(chalk_1.default.gray('Checking for unzip utility...'));
+                    const unzipCheck = await awsService.executeSSHCommand(connection, 'which unzip || echo "unzip not found"');
+                    if (unzipCheck.stdout.trim() === 'unzip not found') {
+                        console.log(chalk_1.default.gray('Installing unzip...'));
+                        await awsService.executeSSHCommand(connection, 'sudo yum install -y unzip || sudo apt-get install -y unzip');
+                    }
+                    else {
+                        console.log(chalk_1.default.gray('✓ unzip is installed'));
+                    }
+                    // Download and extract on remote server with verbose output
+                    const downloadScript = `
+set -e
+echo "Step 1: Cleaning old files..."
+cd /opt/edgible-agent && sudo rm -rf dist package.json node_modules index.js *.map && echo "✓ Cleaned"
+echo "Step 2: Downloading agent..."
+sudo curl -L -f --max-time 300 --connect-timeout 30 -w "Downloaded %{size_download} bytes in %{time_total}s\\n" -o /tmp/agent.zip "${downloadUrl}" && echo "✓ Downloaded"
+echo "Step 3: Extracting agent..."
+sudo unzip -o -q /tmp/agent.zip -d /opt/edgible-agent && echo "✓ Extracted"
+echo "Step 4: Cleaning up..."
+sudo rm /tmp/agent.zip && echo "✓ Cleanup complete"
+echo "OK"
+`;
+                    console.log(chalk_1.default.gray('  Downloading agent (this may take a moment)...'));
+                    try {
+                        const downloadResult = await awsService.executeSSHCommand(connection, downloadScript);
+                        // Log the output for debugging
+                        if (downloadResult.stdout) {
+                            console.log(chalk_1.default.gray('  Output:'), downloadResult.stdout.trim());
+                        }
+                        if (downloadResult.stderr) {
+                            console.log(chalk_1.default.yellow('  Stderr:'), downloadResult.stderr.trim());
+                        }
+                        if (downloadResult.stdout.includes('OK')) {
+                            console.log(chalk_1.default.green('  ✓ Download and extraction completed successfully'));
+                        }
+                        else {
+                            throw new Error(`Download failed: ${downloadResult.stderr || downloadResult.stdout}`);
+                        }
+                    }
+                    catch (downloadError) {
+                        console.error(chalk_1.default.red(`  ✗ Download failed: ${downloadError instanceof Error ? downloadError.message : String(downloadError)}`));
+                        throw downloadError;
+                    }
+                    // Verify dependencies are present (already included in zip)
+                    console.log(chalk_1.default.gray('Verifying agent dependencies...'));
+                    try {
+                        const verifyResult = await awsService.executeSSHCommand(connection, 'test -d /opt/edgible-agent/node_modules/commander && echo "OK" || echo "MISSING"');
+                        if (verifyResult.stdout.trim() === 'OK') {
+                            console.log(chalk_1.default.green('  ✓ Dependencies verified (included in package)'));
+                        }
+                        else {
+                            console.log(chalk_1.default.yellow('  ⚠ Dependencies missing, installing...'));
+                            const installResult = await awsService.executeSSHCommand(connection, 'cd /opt/edgible-agent && sudo npm install --production --no-save --no-audit --no-fund --loglevel=error');
+                            if (installResult.exitCode === 0) {
+                                console.log(chalk_1.default.green('  ✓ Dependencies installed successfully'));
+                            }
+                            else {
+                                console.log(chalk_1.default.yellow(`  Warning: npm install exited with code ${installResult.exitCode}`));
+                            }
+                        }
+                    }
+                    catch (verifyError) {
+                        console.log(chalk_1.default.yellow(`  ⚠ Could not verify dependencies: ${verifyError instanceof Error ? verifyError.message : String(verifyError)}`));
+                    }
+                    // Set file permissions
+                    console.log(chalk_1.default.gray('Setting file permissions...'));
+                    try {
+                        await awsService.executeSSHCommand(connection, 'sudo chmod +x /opt/edgible-agent/index.js || true');
+                        await awsService.executeSSHCommand(connection, 'sudo chown -R root:root /opt/edgible-agent');
+                        const systemAgentPath = PathResolver_1.PathResolver.getSystemDataPath() + '/agent';
+                        await awsService.executeSSHCommand(connection, `sudo mkdir -p ${systemAgentPath}/logs`);
+                        await awsService.executeSSHCommand(connection, `sudo chown -R root:root ${PathResolver_1.PathResolver.getSystemDataPath()}`);
+                        await awsService.executeSSHCommand(connection, `sudo chmod -R 755 ${PathResolver_1.PathResolver.getSystemDataPath()}`);
+                        console.log(chalk_1.default.green('  ✓ Permissions and ownership set correctly'));
+                    }
+                    catch (permError) {
+                        console.error(chalk_1.default.red(`  ✗ Failed to set permissions: ${permError instanceof Error ? permError.message : String(permError)}`));
+                        throw new Error(`Failed to set file permissions: ${permError instanceof Error ? permError.message : String(permError)}`);
+                    }
+                }
+                // Start agent service
+                console.log(chalk_1.default.gray('Starting agent service...'));
+                try {
+                    await awsService.executeSSHCommand(connection, 'sudo systemctl restart edgible-agent');
+                }
+                catch (startError) {
+                    console.error(chalk_1.default.red('Failed to start service:'), startError);
+                    // Check service status and logs
+                    const statusResult = await awsService.executeSSHCommand(connection, 'sudo systemctl status edgible-agent');
+                    console.log(chalk_1.default.red('Service status:'), statusResult.stdout);
+                    console.log(chalk_1.default.red('Service stderr:'), statusResult.stderr);
+                    throw new Error('Agent service failed to start');
+                }
+                // Verify agent is running
+                const statusResult = await awsService.executeSSHCommand(connection, 'sudo systemctl is-active edgible-agent');
+                if (statusResult.stdout.trim() !== 'active') {
+                    // Get more details about why it failed
+                    const statusDetails = await awsService.executeSSHCommand(connection, 'sudo systemctl status edgible-agent');
+                    console.log(chalk_1.default.red('Service status details:'), statusDetails.stdout);
+                    throw new Error('Agent service failed to start');
+                }
+                console.log(chalk_1.default.green('✓ Agent resynced successfully!'));
+                // Reboot if requested
+                let rebooted = false;
+                if (reboot) {
+                    console.log(chalk_1.default.blue('Rebooting gateway...'));
+                    try {
+                        const rebootResult = await this.executeManagedGatewayCommand(gatewayId, 'sudo reboot');
+                        // Note: The command may not return successfully because the gateway reboots
+                        // and disconnects the SSH session. We check if we got an error that suggests
+                        // the connection was lost (which is expected during reboot)
+                        if (rebootResult.success || (rebootResult.error && rebootResult.error.includes('ECONNRESET'))) {
+                            console.log(chalk_1.default.green('✓ Reboot command sent successfully'));
+                            console.log(chalk_1.default.yellow('⚠ Gateway is rebooting. SSH connection will be lost.'));
+                            console.log(chalk_1.default.gray('  The gateway should be back online in a few minutes.'));
+                            rebooted = true;
+                        }
+                        else {
+                            console.log(chalk_1.default.yellow('⚠ Reboot command may have failed, but continuing...'));
+                            if (rebootResult.error) {
+                                console.log(chalk_1.default.gray(`  Error: ${rebootResult.error}`));
+                            }
+                        }
+                    }
+                    catch (rebootError) {
+                        // If the error is a connection reset, that's expected during reboot
+                        if (rebootError instanceof Error && (rebootError.message.includes('ECONNRESET') || rebootError.message.includes('connection'))) {
+                            console.log(chalk_1.default.green('✓ Reboot command sent (connection lost as expected)'));
+                            console.log(chalk_1.default.yellow('⚠ Gateway is rebooting.'));
+                            rebooted = true;
+                        }
+                        else {
+                            console.log(chalk_1.default.yellow(`⚠ Error sending reboot command: ${rebootError instanceof Error ? rebootError.message : String(rebootError)}`));
+                        }
+                    }
+                }
+                return {
+                    message: 'Agent resynced successfully',
+                    success: true,
+                    agentVersion: agentVersion || 'latest',
+                    syncTimestamp: new Date().toISOString(),
+                    logsWiped: logsWiped,
+                    rebooted: rebooted
+                };
+            }
+            finally {
+                // Clean up temp key file
+                try {
+                    if (fs.existsSync(tempKeyPath)) {
+                        fs.unlinkSync(tempKeyPath);
+                    }
+                }
+                catch (cleanupError) {
+                    // Ignore cleanup errors
+                }
+            }
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Error resyncing managed gateway agent:'), error);
+            throw error;
+        }
+    }
+    async resyncGatewayAgent(gatewayId, agentVersion, installFromLocal) {
+        try {
+            // Attempt auto re-login if tokens are missing but credentials are available
+            await this.attemptAutoRelogin();
+            const configManager = new config_1.ConfigManager();
+            const gatewayInfo = configManager.getGateway(gatewayId);
+            if (!gatewayInfo) {
+                throw new Error('Gateway not found in local configuration');
+            }
+            // Load SSH key
+            const awsService = new aws_1.AWSService(configManager.getAWSProfile(), gatewayInfo.region);
+            const privateKey = awsService.loadSSHKey(gatewayInfo.keyPath);
+            // Wait for instance to be ready for SSH
+            const isReady = await awsService.waitForSSHReady(gatewayInfo.ec2InstanceId);
+            if (!isReady) {
+                throw new Error('Instance is not ready for SSH connections');
+            }
+            // Create SSH connection
+            const connection = {
+                host: gatewayInfo.publicIp,
+                port: 22,
+                username: 'ec2-user',
+                privateKey: privateKey
+            };
+            console.log(chalk_1.default.blue('Connecting to gateway...'));
+            console.log(chalk_1.default.gray(`SSH Host: ${connection.host}:${connection.port}`));
+            console.log(chalk_1.default.gray(`SSH User: ${connection.username}`));
+            console.log(chalk_1.default.gray(`SSH Key: ${gatewayInfo.keyPath}`));
+            // Test SSH connection first
+            console.log(chalk_1.default.gray('Testing SSH connection...'));
+            try {
+                await awsService.executeSSHCommand(connection, 'echo "SSH connection successful"');
+                console.log(chalk_1.default.green('✓ SSH connection established'));
+            }
+            catch (sshError) {
+                console.error(chalk_1.default.red('✗ SSH connection failed:'), sshError);
+                throw new Error(`SSH connection failed: ${sshError instanceof Error ? sshError.message : 'Unknown error'}`);
+            }
+            // Stop agent service
+            console.log(chalk_1.default.gray('Stopping agent service...'));
+            await awsService.executeSSHCommand(connection, 'sudo systemctl stop edgible-agent');
+            // Ensure the agent directory exists
+            console.log(chalk_1.default.gray('Creating agent directory...'));
+            await awsService.executeSSHCommand(connection, 'sudo mkdir -p /opt/edgible-agent');
+            await awsService.executeSSHCommand(connection, 'sudo chown root:root /opt/edgible-agent');
+            // Check Node.js installation and path
+            console.log(chalk_1.default.gray('Checking Node.js installation...'));
+            const nodeCheck = await awsService.executeSSHCommand(connection, 'which node || echo "node not found"');
+            const nodePath = nodeCheck.stdout.trim();
+            console.log(chalk_1.default.gray(`Node.js path: ${nodePath}`));
+            if (nodePath === 'node not found') {
+                console.log(chalk_1.default.gray('Installing Node.js...'));
+                await awsService.executeSSHCommand(connection, 'curl -fsSL https://rpm.nodesource.com/setup_18.x | sudo bash -');
+                await awsService.executeSSHCommand(connection, 'sudo yum install -y nodejs');
+            }
+            // Check and install required system dependencies
+            console.log(chalk_1.default.gray('Checking system dependencies...'));
+            // Check iptables
+            const iptablesCheck = await awsService.executeSSHCommand(connection, 'which iptables || echo "iptables not found"');
+            if (iptablesCheck.stdout.trim() === 'iptables not found') {
+                console.log(chalk_1.default.gray('Installing iptables...'));
+                await awsService.executeSSHCommand(connection, 'sudo yum install -y iptables');
+            }
+            else {
+                console.log(chalk_1.default.gray('✓ iptables is installed'));
+            }
+            // Check WireGuard
+            const wireguardCheck = await awsService.executeSSHCommand(connection, 'which wg || echo "wireguard not found"');
+            if (wireguardCheck.stdout.trim() === 'wireguard not found') {
+                console.log(chalk_1.default.gray('Installing WireGuard...'));
+                // For Amazon Linux 2, we need to install WireGuard from EPEL
+                await awsService.executeSSHCommand(connection, 'sudo amazon-linux-extras install epel -y || sudo yum install -y epel-release');
+                await awsService.executeSSHCommand(connection, 'sudo yum install -y wireguard-tools');
+                // Load the kernel module (if not already loaded)
+                await awsService.executeSSHCommand(connection, 'sudo modprobe wireguard || true');
+            }
+            else {
+                console.log(chalk_1.default.gray('✓ WireGuard is installed'));
+            }
+            // Check HAProxy (gateway devices use HAProxy instead of Caddy)
+            const haproxyCheck = await awsService.executeSSHCommand(connection, 'which haproxy 2>/dev/null || test -f /usr/sbin/haproxy && echo "haproxy found" || echo "haproxy not found"');
+            if (haproxyCheck.stdout.trim() === 'haproxy not found' || (haproxyCheck.stdout.trim() === '' && !haproxyCheck.stdout.includes('haproxy found'))) {
+                console.log(chalk_1.default.gray('Installing HAProxy...'));
+                // Install HAProxy via package manager
+                await awsService.executeSSHCommand(connection, 'sudo yum install -y haproxy');
+                // Create HAProxy config directory
+                await awsService.executeSSHCommand(connection, 'sudo mkdir -p /etc/haproxy');
+                // Create HAProxy runtime socket directory (required for admin socket)
+                await awsService.executeSSHCommand(connection, 'sudo mkdir -p /var/run/haproxy');
+                await awsService.executeSSHCommand(connection, 'sudo chmod 755 /var/run/haproxy');
+                // Set capabilities for HAProxy to bind to privileged ports
+                await awsService.executeSSHCommand(connection, 'sudo setcap cap_net_bind_service=+ep /usr/sbin/haproxy || true');
+                // Create HAProxy chroot directory
+                await awsService.executeSSHCommand(connection, 'sudo mkdir -p /var/lib/haproxy');
+                await awsService.executeSSHCommand(connection, 'sudo chown haproxy:haproxy /var/lib/haproxy || sudo chown root:root /var/lib/haproxy || true');
+                // Verify installation
+                const verifyResult = await awsService.executeSSHCommand(connection, '/usr/sbin/haproxy -v 2>&1');
+                if (!verifyResult.stdout.includes('HAProxy') && !verifyResult.stdout.includes('version')) {
+                    throw new Error(`HAProxy installation verification failed. Output: ${verifyResult.stdout}`);
+                }
+                console.log(chalk_1.default.green('✓ HAProxy installed successfully'));
+            }
+            else {
+                console.log(chalk_1.default.gray('✓ HAProxy is installed'));
+                // Verify it's accessible
+                const verifyResult = await awsService.executeSSHCommand(connection, 'haproxy -v 2>&1 || /usr/sbin/haproxy -v 2>&1');
+                if (verifyResult.stdout.includes('command not found') && !verifyResult.stdout.includes('HAProxy') && !verifyResult.stdout.includes('version')) {
+                    console.log(chalk_1.default.yellow('⚠ HAProxy found but not accessible, verifying...'));
+                    // Re-verify
+                    const reVerifyResult = await awsService.executeSSHCommand(connection, 'haproxy -v 2>&1 || /usr/sbin/haproxy -v 2>&1');
+                    if (!reVerifyResult.stdout.includes('HAProxy') && !reVerifyResult.stdout.includes('version')) {
+                        console.log(chalk_1.default.yellow('⚠ HAProxy verification still failing, but continuing...'));
+                    }
+                }
+            }
+            // Get device password from API
+            console.log(chalk_1.default.gray('Retrieving device credentials...'));
+            const deviceResponse = await this.apiClient.getDevice(gatewayInfo.deviceId);
+            const devicePassword = deviceResponse.device?.password || '';
+            if (!devicePassword) {
+                throw new Error('Could not retrieve device password from API');
+            }
+            // Create agent configuration file
+            console.log(chalk_1.default.gray('Creating agent configuration...'));
+            const userConfig = configManager.getConfig();
+            const agentConfig = {
+                deviceId: gatewayInfo.deviceId,
+                devicePassword: devicePassword,
+                deviceType: 'gateway',
+                apiBaseUrl: (0, urls_1.getApiBaseUrl)(),
+                organizationId: userConfig.organizationId || '',
+                firewallEnabled: true,
+                pollingInterval: 60000,
+                healthCheckTimeout: 5000,
+                maxRetries: 3,
+                logLevel: 'info',
+                updateEnabled: true,
+                updateCheckInterval: 3600000,
+                wireguardMode: userConfig.wireguardMode || 'kernel',
+                wireguardGoBinary: userConfig.wireguardGoBinary || 'wireguard-go'
+            };
+            const configFile = `/tmp/agent-config-${Date.now()}.json`;
+            fs.writeFileSync(configFile, JSON.stringify(agentConfig, null, 2));
+            try {
+                console.log(chalk_1.default.gray('Uploading agent configuration...'));
+                // Upload to user's home directory first (where we have write permissions)
+                // Then move to /opt/edgible-agent with sudo
+                const homeDir = connection.username === 'ec2-user' ? '/home/ec2-user' : `/home/${connection.username}`;
+                const remoteHomeConfigPath = `${homeDir}/agent-config-${Date.now()}.json`;
+                const remoteConfigPath = '/opt/edgible-agent/agent.config.json';
+                console.log(chalk_1.default.gray(`  Local file: ${configFile}`));
+                console.log(chalk_1.default.gray(`  Uploading to: ${remoteHomeConfigPath}`));
+                try {
+                    await awsService.uploadFile(connection, configFile, remoteHomeConfigPath);
+                    console.log(chalk_1.default.green('  ✓ Config file uploaded successfully'));
+                    // Move to final location with sudo and set ownership
+                    console.log(chalk_1.default.gray(`  Moving to: ${remoteConfigPath}`));
+                    const moveResult = await awsService.executeSSHCommand(connection, `sudo mv ${remoteHomeConfigPath} ${remoteConfigPath} && sudo chown root:root ${remoteConfigPath} && echo "OK" || echo "FAIL"`);
+                    if (moveResult.stdout.trim() === 'OK') {
+                        console.log(chalk_1.default.green('  ✓ Config file moved and ownership set'));
+                    }
+                    else {
+                        throw new Error(`Failed to move config file: ${moveResult.stderr || moveResult.stdout}`);
+                    }
+                }
+                catch (configError) {
+                    console.error(chalk_1.default.red(`  ✗ Config upload failed: ${configError instanceof Error ? configError.message : String(configError)}`));
+                    throw new Error(`Failed to upload agent configuration: ${configError instanceof Error ? configError.message : String(configError)}`);
+                }
+            }
+            finally {
+                if (fs.existsSync(configFile)) {
+                    fs.unlinkSync(configFile);
+                }
+            }
+            // Create systemd service file
+            console.log(chalk_1.default.gray('Creating systemd service...'));
+            const finalNodePath = nodePath === 'node not found' ? '/usr/bin/node' : nodePath;
+            const systemAgentPath = PathResolver_1.PathResolver.getSystemDataPath() + '/agent';
+            const serviceContent = `[Unit]
+Description=Edgible Agent
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/edgible-agent
+ExecStart=${finalNodePath} /opt/edgible-agent/index.js start -c /opt/edgible-agent/agent.config.json
+Restart=always
+RestartSec=10
+Environment=NODE_ENV=production
+Environment=EDGIBLE_CONFIG_PATH=${systemAgentPath}
+Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+[Install]
+WantedBy=multi-user.target`;
+            const serviceFile = `/tmp/edgible-agent-${Date.now()}.service`;
+            fs.writeFileSync(serviceFile, serviceContent);
+            try {
+                await awsService.uploadFile(connection, serviceFile, '/tmp/edgible-agent.service');
+                await awsService.executeSSHCommand(connection, 'sudo mv /tmp/edgible-agent.service /etc/systemd/system/edgible-agent.service');
+                await awsService.executeSSHCommand(connection, 'sudo systemctl daemon-reload');
+                await awsService.executeSSHCommand(connection, 'sudo systemctl enable edgible-agent.service');
+            }
+            finally {
+                if (fs.existsSync(serviceFile)) {
+                    fs.unlinkSync(serviceFile);
+                }
+            }
+            // Upload or download agent code
+            if (installFromLocal) {
+                // Use existing local upload behavior
+                console.log(chalk_1.default.gray('Uploading agent code from local directory...'));
+                const agentV2Path = path.resolve(__dirname, '../../../agent-v2');
+                const agentDistPath = path.join(agentV2Path, 'dist');
+                const agentPackageJsonPath = path.join(agentV2Path, 'package.json');
+                if (!fs.existsSync(agentDistPath)) {
+                    throw new Error('Agent distribution not found. This feature requires development environment setup. Please use S3 download instead.');
+                }
+                if (!fs.existsSync(agentPackageJsonPath)) {
+                    throw new Error('Agent package.json not found.');
+                }
+                // Create a tarball of the dist directory and package.json
+                const { execSync } = require('child_process');
+                const tarPath = `/tmp/agent-dist-${Date.now()}.tar.gz`;
+                try {
+                    console.log(chalk_1.default.gray('Creating agent distribution tarball...'));
+                    console.log(chalk_1.default.gray(`  Source dist: ${agentDistPath}`));
+                    console.log(chalk_1.default.gray(`  Source package.json: ${agentPackageJsonPath}`));
+                    // Create tarball with both dist and package.json
+                    const tempDir = `/tmp/agent-upload-${Date.now()}`;
+                    console.log(chalk_1.default.gray(`  Creating temp directory: ${tempDir}`));
+                    fs.mkdirSync(tempDir, { recursive: true });
+                    fs.copyFileSync(agentPackageJsonPath, path.join(tempDir, 'package.json'));
+                    execSync(`cp -r "${agentDistPath}" "${tempDir}/dist"`, { stdio: 'inherit' });
+                    console.log(chalk_1.default.gray(`  Creating tarball: ${tarPath}`));
+                    execSync(`cd "${tempDir}" && tar -czf "${tarPath}" .`, { stdio: 'inherit' });
+                    // Verify tarball was created
+                    if (!fs.existsSync(tarPath)) {
+                        throw new Error(`Failed to create tarball at ${tarPath}`);
+                    }
+                    const tarStats = fs.statSync(tarPath);
+                    const tarSizeMB = (tarStats.size / (1024 * 1024)).toFixed(2);
+                    console.log(chalk_1.default.gray(`  Tarball created: ${tarSizeMB} MB`));
+                    // Clean up temp directory
+                    console.log(chalk_1.default.gray('  Cleaning up temp directory...'));
+                    fs.rmSync(tempDir, { recursive: true, force: true });
+                    // Upload tarball to user's home directory first (where we have write permissions)
+                    // Then move to /tmp with sudo if needed
+                    // Use explicit home directory path since SFTP might not expand ~
+                    const homeDir = connection.username === 'ec2-user' ? '/home/ec2-user' : `/home/${connection.username}`;
+                    const remoteHomePath = `${homeDir}/agent-dist-${Date.now()}.tar.gz`;
+                    const remoteTmpPath = `/tmp/agent-dist.tar.gz`;
+                    console.log(chalk_1.default.gray('Checking remote directory permissions...'));
+                    try {
+                        const homeDirCheck = await awsService.executeSSHCommand(connection, `test -d ${homeDir} && test -w ${homeDir} && echo "OK" || echo "FAIL"`);
+                        if (homeDirCheck.stdout.trim() !== 'OK') {
+                            console.log(chalk_1.default.yellow(`  Warning: Home directory ${homeDir} may not be writable`));
+                            console.log(chalk_1.default.gray(`  Attempting to verify with ls -ld: ${homeDir}`));
+                            const lsResult = await awsService.executeSSHCommand(connection, `ls -ld ${homeDir} 2>&1 || echo "directory_not_found"`);
+                            console.log(chalk_1.default.gray(`  Directory info: ${lsResult.stdout.trim()}`));
+                        }
+                        else {
+                            console.log(chalk_1.default.gray(`  ✓ Home directory ${homeDir} is writable`));
+                        }
+                    }
+                    catch (checkError) {
+                        console.log(chalk_1.default.yellow(`  Warning: Could not verify directory permissions: ${checkError instanceof Error ? checkError.message : String(checkError)}`));
+                    }
+                    console.log(chalk_1.default.blue('Uploading tarball to remote server...'));
+                    console.log(chalk_1.default.gray(`  Local file: ${tarPath}`));
+                    console.log(chalk_1.default.gray(`  Remote path: ${remoteHomePath}`));
+                    console.log(chalk_1.default.gray(`  File size: ${tarSizeMB} MB`));
+                    try {
+                        await awsService.uploadFile(connection, tarPath, remoteHomePath);
+                        console.log(chalk_1.default.green('  ✓ Upload completed successfully'));
+                        // Verify file was uploaded
+                        console.log(chalk_1.default.gray('  Verifying uploaded file...'));
+                        const verifyResult = await awsService.executeSSHCommand(connection, `test -f ${remoteHomePath} && ls -lh ${remoteHomePath} || echo "file_not_found"`);
+                        if (verifyResult.stdout.includes('file_not_found')) {
+                            throw new Error(`Upload verification failed: file not found at ${remoteHomePath}`);
+                        }
+                        console.log(chalk_1.default.gray(`  File verified: ${verifyResult.stdout.trim()}`));
+                    }
+                    catch (uploadError) {
+                        console.error(chalk_1.default.red(`  ✗ Upload failed: ${uploadError instanceof Error ? uploadError.message : String(uploadError)}`));
+                        throw new Error(`Failed to upload file to ${remoteHomePath}: ${uploadError instanceof Error ? uploadError.message : String(uploadError)}`);
+                    }
+                    // Move to /tmp using sudo (in case /tmp has permission restrictions)
+                    console.log(chalk_1.default.gray(`Moving file from ${remoteHomePath} to ${remoteTmpPath}...`));
+                    try {
+                        const moveResult = await awsService.executeSSHCommand(connection, `sudo mv ${remoteHomePath} ${remoteTmpPath} && sudo chmod 644 ${remoteTmpPath} && echo "OK" || echo "FAIL"`);
+                        if (moveResult.stdout.trim() === 'OK') {
+                            console.log(chalk_1.default.green('  ✓ File moved successfully'));
+                        }
+                        else {
+                            throw new Error(`Failed to move file: ${moveResult.stderr || moveResult.stdout}`);
+                        }
+                    }
+                    catch (moveError) {
+                        console.error(chalk_1.default.red(`  ✗ Move failed: ${moveError instanceof Error ? moveError.message : String(moveError)}`));
+                        throw new Error(`Failed to move file from ${remoteHomePath} to ${remoteTmpPath}: ${moveError instanceof Error ? moveError.message : String(moveError)}`);
+                    }
+                    // Extract on remote server
+                    console.log(chalk_1.default.gray('Extracting agent code...'));
+                    try {
+                        const extractResult = await awsService.executeSSHCommand(connection, 'cd /opt/edgible-agent && sudo tar -xzf /tmp/agent-dist.tar.gz && sudo rm /tmp/agent-dist.tar.gz && echo "OK" || echo "FAIL"');
+                        if (extractResult.stdout.trim() === 'OK') {
+                            console.log(chalk_1.default.green('  ✓ Extraction completed successfully'));
+                        }
+                        else {
+                            console.log(chalk_1.default.yellow(`  Warning: Extraction may have failed: ${extractResult.stderr || extractResult.stdout}`));
+                        }
+                    }
+                    catch (extractError) {
+                        console.error(chalk_1.default.red(`  ✗ Extraction failed: ${extractError instanceof Error ? extractError.message : String(extractError)}`));
+                        throw new Error(`Failed to extract agent code: ${extractError instanceof Error ? extractError.message : String(extractError)}`);
+                    }
+                    // Install production dependencies (run as root since directory is owned by root)
+                    console.log(chalk_1.default.gray('Installing agent dependencies...'));
+                    try {
+                        const installResult = await awsService.executeSSHCommand(connection, 'cd /opt/edgible-agent && sudo npm install --production --no-save');
+                        if (installResult.exitCode === 0) {
+                            console.log(chalk_1.default.green('  ✓ Dependencies installed successfully'));
+                        }
+                        else {
+                            console.log(chalk_1.default.yellow(`  Warning: npm install exited with code ${installResult.exitCode}`));
+                            console.log(chalk_1.default.gray(`  stdout: ${installResult.stdout}`));
+                            if (installResult.stderr) {
+                                console.log(chalk_1.default.gray(`  stderr: ${installResult.stderr}`));
+                            }
+                        }
+                    }
+                    catch (installError) {
+                        console.error(chalk_1.default.red(`  ✗ Dependency installation failed: ${installError instanceof Error ? installError.message : String(installError)}`));
+                        throw new Error(`Failed to install dependencies: ${installError instanceof Error ? installError.message : String(installError)}`);
+                    }
+                    // Ensure index.js is executable
+                    console.log(chalk_1.default.gray('Setting file permissions...'));
+                    try {
+                        await awsService.executeSSHCommand(connection, 'sudo chmod +x /opt/edgible-agent/dist/index.js || true');
+                        // Set proper ownership (root will own everything)
+                        await awsService.executeSSHCommand(connection, 'sudo chown -R root:root /opt/edgible-agent');
+                        // Create logs directory for root user
+                        await awsService.executeSSHCommand(connection, 'sudo mkdir -p /opt/edgible-agent/.edgible/agent/logs');
+                        await awsService.executeSSHCommand(connection, 'sudo chown -R root:root /opt/edgible-agent/.edgible');
+                        await awsService.executeSSHCommand(connection, 'sudo chmod -R 755 /opt/edgible-agent/.edgible');
+                        console.log(chalk_1.default.green('  ✓ Permissions and ownership set correctly'));
+                    }
+                    catch (permError) {
+                        console.error(chalk_1.default.red(`  ✗ Failed to set permissions: ${permError instanceof Error ? permError.message : String(permError)}`));
+                        throw new Error(`Failed to set file permissions: ${permError instanceof Error ? permError.message : String(permError)}`);
+                    }
+                }
+                finally {
+                    // Clean up tarball if it exists
+                    if (fs.existsSync(tarPath)) {
+                        fs.unlinkSync(tarPath);
+                    }
+                }
+            }
+            else {
+                // Download from CloudFront on remote server
+                console.log(chalk_1.default.gray('Downloading agent from CloudFront...'));
+                const distributionUrl = (0, urls_1.getDistributionUrl)();
+                const version = agentVersion || 'latest';
+                // Build CloudFront URL directly - no bucket or S3 path needed
+                // Stage determines both the distribution URL and the bucket (backend detail)
+                const downloadUrl = `${distributionUrl}/${version}.zip`;
+                console.log(chalk_1.default.gray(`  Distribution: ${distributionUrl}`));
+                console.log(chalk_1.default.gray(`  Version: ${version}`));
+                console.log(chalk_1.default.gray(`  URL: ${downloadUrl}`));
+                // Check if unzip is installed, install if needed
+                console.log(chalk_1.default.gray('Checking for unzip utility...'));
+                const unzipCheck = await awsService.executeSSHCommand(connection, 'which unzip || echo "unzip not found"');
+                if (unzipCheck.stdout.trim() === 'unzip not found') {
+                    console.log(chalk_1.default.gray('Installing unzip...'));
+                    await awsService.executeSSHCommand(connection, 'sudo yum install -y unzip || sudo apt-get install -y unzip');
+                }
+                else {
+                    console.log(chalk_1.default.gray('✓ unzip is installed'));
+                }
+                // Download and extract on remote server with verbose output
+                const downloadScript = `
+set -e
+echo "Step 1: Cleaning old files..."
+cd /opt/edgible-agent && sudo rm -rf dist package.json node_modules index.js *.map && echo "✓ Cleaned"
+echo "Step 2: Downloading agent..."
+sudo curl -L -f --max-time 300 --connect-timeout 30 -w "Downloaded %{size_download} bytes in %{time_total}s\\n" -o /tmp/agent.zip "${downloadUrl}" && echo "✓ Downloaded"
+echo "Step 3: Extracting agent..."
+sudo unzip -o -q /tmp/agent.zip -d /opt/edgible-agent && echo "✓ Extracted"
+echo "Step 4: Cleaning up..."
+sudo rm /tmp/agent.zip && echo "✓ Cleanup complete"
+echo "OK"
+`;
+                console.log(chalk_1.default.gray('  Downloading agent (this may take a moment)...'));
+                try {
+                    const downloadResult = await awsService.executeSSHCommand(connection, downloadScript);
+                    // Log the output for debugging
+                    if (downloadResult.stdout) {
+                        console.log(chalk_1.default.gray('  Output:'), downloadResult.stdout.trim());
+                    }
+                    if (downloadResult.stderr) {
+                        console.log(chalk_1.default.yellow('  Stderr:'), downloadResult.stderr.trim());
+                    }
+                    if (downloadResult.stdout.includes('OK')) {
+                        console.log(chalk_1.default.green('  ✓ Download and extraction completed successfully'));
+                    }
+                    else {
+                        throw new Error(`Download failed: ${downloadResult.stderr || downloadResult.stdout}`);
+                    }
+                }
+                catch (downloadError) {
+                    console.error(chalk_1.default.red(`  ✗ Download failed: ${downloadError instanceof Error ? downloadError.message : String(downloadError)}`));
+                    throw downloadError;
+                }
+                // Verify dependencies are present (already included in zip)
+                console.log(chalk_1.default.gray('Verifying agent dependencies...'));
+                try {
+                    const verifyResult = await awsService.executeSSHCommand(connection, 'test -d /opt/edgible-agent/node_modules/commander && echo "OK" || echo "MISSING"');
+                    if (verifyResult.stdout.trim() === 'OK') {
+                        console.log(chalk_1.default.green('  ✓ Dependencies verified (included in package)'));
+                    }
+                    else {
+                        console.log(chalk_1.default.yellow('  ⚠ Dependencies missing, installing...'));
+                        const installResult = await awsService.executeSSHCommand(connection, 'cd /opt/edgible-agent && sudo npm install --production --no-save --no-audit --no-fund --loglevel=error');
+                        if (installResult.exitCode === 0) {
+                            console.log(chalk_1.default.green('  ✓ Dependencies installed successfully'));
+                        }
+                        else {
+                            console.log(chalk_1.default.yellow(`  Warning: npm install exited with code ${installResult.exitCode}`));
+                        }
+                    }
+                }
+                catch (verifyError) {
+                    console.log(chalk_1.default.yellow(`  ⚠ Could not verify dependencies: ${verifyError instanceof Error ? verifyError.message : String(verifyError)}`));
+                }
+                // Set file permissions
+                console.log(chalk_1.default.gray('Setting file permissions...'));
+                try {
+                    await awsService.executeSSHCommand(connection, 'sudo chmod +x /opt/edgible-agent/index.js || true');
+                    await awsService.executeSSHCommand(connection, 'sudo chown -R root:root /opt/edgible-agent');
+                    await awsService.executeSSHCommand(connection, 'sudo mkdir -p /opt/edgible-agent/.edgible/agent/logs');
+                    await awsService.executeSSHCommand(connection, 'sudo chown -R root:root /opt/edgible-agent/.edgible');
+                    await awsService.executeSSHCommand(connection, 'sudo chmod -R 755 /opt/edgible-agent/.edgible');
+                    console.log(chalk_1.default.green('  ✓ Permissions and ownership set correctly'));
+                }
+                catch (permError) {
+                    console.error(chalk_1.default.red(`  ✗ Failed to set permissions: ${permError instanceof Error ? permError.message : String(permError)}`));
+                    throw new Error(`Failed to set file permissions: ${permError instanceof Error ? permError.message : String(permError)}`);
+                }
+            }
+            // Start agent service
+            console.log(chalk_1.default.gray('Starting agent service...'));
+            try {
+                await awsService.executeSSHCommand(connection, 'sudo systemctl restart edgible-agent');
+            }
+            catch (startError) {
+                console.error(chalk_1.default.red('Failed to start service:'), startError);
+                // Check service status and logs
+                const statusResult = await awsService.executeSSHCommand(connection, 'sudo systemctl status edgible-agent');
+                console.log(chalk_1.default.red('Service status:'), statusResult.stdout);
+                console.log(chalk_1.default.red('Service stderr:'), statusResult.stderr);
+                throw new Error('Agent service failed to start');
+            }
+            // Verify agent is running
+            const statusResult = await awsService.executeSSHCommand(connection, 'sudo systemctl is-active edgible-agent');
+            if (statusResult.stdout.trim() !== 'active') {
+                // Get more details about why it failed
+                const statusDetails = await awsService.executeSSHCommand(connection, 'sudo systemctl status edgible-agent');
+                console.log(chalk_1.default.red('Service status details:'), statusDetails.stdout);
+                throw new Error('Agent service failed to start');
+            }
+            console.log(chalk_1.default.green('✓ Agent resynced successfully!'));
+            return {
+                message: 'Agent resynced successfully',
+                success: true,
+                agentVersion: agentVersion || 'latest',
+                syncTimestamp: new Date().toISOString()
+            };
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Error resyncing agent:'), error);
+            throw error;
+        }
+    }
+    /**
+     * Get comprehensive gateway diagnostics including status, logs, and system info
+     */
+    async getGatewayDiagnostics(gatewayId) {
+        try {
+            // Attempt auto re-login if tokens are missing but credentials are available
+            await this.attemptAutoRelogin();
+            const configManager = new config_1.ConfigManager();
+            const gatewayInfo = configManager.getGateway(gatewayId);
+            if (!gatewayInfo) {
+                throw new Error('Gateway not found in local configuration');
+            }
+            // Load SSH key
+            const awsService = new aws_1.AWSService(configManager.getAWSProfile(), gatewayInfo.region);
+            const privateKey = awsService.loadSSHKey(gatewayInfo.keyPath);
+            // Wait for instance to be ready for SSH
+            const isReady = await awsService.waitForSSHReady(gatewayInfo.ec2InstanceId);
+            if (!isReady) {
+                throw new Error('Instance is not ready for SSH connections');
+            }
+            // Create SSH connection
+            const connection = {
+                host: gatewayInfo.publicIp,
+                port: 22,
+                username: 'ec2-user',
+                privateKey: privateKey
+            };
+            // Execute multiple commands in parallel where possible
+            // For logs, try multiple locations and fall back to journalctl
+            const commands = {
+                status: 'cat ~/.edgible/agent/status.json /opt/edgible-agent/.edgible/agent/status.json 2>/dev/null | head -1 || echo "Status file not found"',
+                agentLogs: '(test -f ~/.edgible/agent/logs/agent.log && tail -n 100 ~/.edgible/agent/logs/agent.log) || (test -f /opt/edgible-agent/.edgible/agent/logs/agent.log && tail -n 100 /opt/edgible-agent/.edgible/agent/logs/agent.log) || (sudo journalctl -u edgible-agent.service -n 100 --no-pager 2>/dev/null) || echo "No logs available (checking journalctl...)"',
+                systemInfo: 'echo "=== System Resources ===" && free -h && echo "" && echo "=== Disk Usage ===" && df -h / && echo "" && echo "=== Uptime ===" && uptime && echo "" && echo "=== Load Average ===" && cat /proc/loadavg',
+                wireguardStatus: 'sudo wg show 2>/dev/null || echo "WireGuard not running or no interfaces"',
+                caddyStatus: 'curl -s http://localhost:2019/config/ 2>/dev/null | head -50 || echo "Caddy API not accessible"',
+                serviceStatus: 'sudo systemctl status edgible-agent.service --no-pager -l 2>/dev/null || echo "Service status unavailable"',
+                networkInfo: 'echo "=== Network Interfaces ===" && ip addr show && echo "" && echo "=== WireGuard Interfaces ===" && ip link show type wireguard 2>/dev/null || echo "No WireGuard interfaces"',
+                logPaths: 'echo "=== Checking log paths ===" && (test -d ~/.edgible/agent/logs && echo "~/.edgible/agent/logs exists" && ls -la ~/.edgible/agent/logs/ 2>/dev/null) || echo "~/.edgible/agent/logs not found" && (test -d /opt/edgible-agent/.edgible/agent/logs && echo "/opt/edgible-agent/.edgible/agent/logs exists" && ls -la /opt/edgible-agent/.edgible/agent/logs/ 2>/dev/null) || echo "/opt/edgible-agent/.edgible/agent/logs not found"'
+            };
+            const results = {};
+            // Execute all commands
+            for (const [key, command] of Object.entries(commands)) {
+                try {
+                    const result = await awsService.executeSSHCommand(connection, command);
+                    results[key] = result.stdout || result.stderr || '';
+                }
+                catch (error) {
+                    results[key] = `Error executing command: ${error instanceof Error ? error.message : String(error)}`;
+                }
+            }
+            return {
+                status: results.status,
+                agentLogs: results.agentLogs,
+                systemInfo: results.systemInfo,
+                wireguardStatus: results.wireguardStatus,
+                caddyStatus: results.caddyStatus,
+                serviceStatus: results.serviceStatus,
+                networkInfo: results.networkInfo,
+                logPaths: results.logPaths || '',
+                success: true
+            };
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Error retrieving gateway diagnostics:'), error);
+            throw error;
+        }
+    }
+    /**
+     * Get agent logs from a gateway
+     */
+    /**
+     * Get logs from a managed gateway (admin only)
+     */
+    async getManagedGatewayLogs(gatewayId, options) {
+        try {
+            await this.attemptAutoRelogin();
+            // Get managed gateway details
+            const gatewayDetails = await this.getManagedGateway(gatewayId);
+            if (!gatewayDetails.success || !gatewayDetails.gateway) {
+                throw new Error('Managed gateway not found');
+            }
+            const gateway = gatewayDetails.gateway;
+            const ipAddress = gateway.ipAddress;
+            if (!ipAddress) {
+                throw new Error('Gateway IP address not available');
+            }
+            // Get SSH key from backend
+            const sshKeyResponse = await this.apiClient.getManagedGatewaySSHKey({ gatewayId });
+            if (!sshKeyResponse.success || !sshKeyResponse.sshPrivateKey) {
+                throw new Error('Failed to retrieve SSH key for managed gateway');
+            }
+            const sshPrivateKey = sshKeyResponse.sshPrivateKey;
+            // Create SSH connection
+            const connection = {
+                host: ipAddress,
+                port: 22,
+                username: 'ec2-user',
+                privateKey: sshPrivateKey
+            };
+            // Use the same logic as getGatewayLogs but with custom connection
+            return await this.executeGatewayLogs(connection, options);
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Error getting managed gateway logs:'), error);
+            throw error;
+        }
+    }
+    /**
+     * Execute a command on a managed gateway
+     */
+    async executeManagedGatewayCommand(gatewayId, command) {
+        try {
+            await this.attemptAutoRelogin();
+            // Get managed gateway details
+            const gatewayDetails = await this.getManagedGateway(gatewayId);
+            if (!gatewayDetails.success || !gatewayDetails.gateway) {
+                throw new Error('Managed gateway not found');
+            }
+            const gateway = gatewayDetails.gateway;
+            const ipAddress = gateway.ipAddress;
+            if (!ipAddress) {
+                throw new Error('Gateway IP address not available');
+            }
+            // Get SSH key from backend
+            const sshKeyResponse = await this.apiClient.getManagedGatewaySSHKey({ gatewayId });
+            if (!sshKeyResponse.success || !sshKeyResponse.sshPrivateKey) {
+                throw new Error('Failed to retrieve SSH key for managed gateway');
+            }
+            const sshPrivateKey = sshKeyResponse.sshPrivateKey;
+            // Create SSH connection
+            const connection = {
+                host: ipAddress,
+                port: 22,
+                username: 'ec2-user',
+                privateKey: sshPrivateKey
+            };
+            const { AWSService } = await Promise.resolve().then(() => __importStar(require('./aws')));
+            const awsService = new AWSService();
+            // Test SSH connection
+            try {
+                await awsService.executeSSHCommand(connection, 'echo "SSH connection successful"');
+            }
+            catch (sshError) {
+                throw new Error(`SSH connection failed: ${sshError instanceof Error ? sshError.message : 'Unknown error'}`);
+            }
+            // Execute the command
+            const result = await awsService.executeSSHCommand(connection, command);
+            return {
+                success: result.exitCode === 0,
+                output: result.stdout,
+                error: result.stderr || undefined
+            };
+        }
+        catch (error) {
+            return {
+                success: false,
+                output: '',
+                error: error instanceof Error ? error.message : String(error)
+            };
+        }
+    }
+    /**
+     * Execute gateway logs retrieval (internal method)
+     */
+    async executeGatewayLogs(connection, options) {
+        const { AWSService } = await Promise.resolve().then(() => __importStar(require('./aws')));
+        const awsService = new AWSService();
+        // Test SSH connection
+        try {
+            await awsService.executeSSHCommand(connection, 'echo "SSH connection successful"');
+        }
+        catch (sshError) {
+            throw new Error(`SSH connection failed: ${sshError instanceof Error ? sshError.message : 'Unknown error'}`);
+        }
+        const lines = options.lines || 50;
+        const follow = options.follow || false;
+        const level = options.level || 'all';
+        const comprehensive = options.comprehensive || false;
+        if (comprehensive) {
+            // Comprehensive diagnostics
+            const commands = [
+                'systemctl status edgible-agent --no-pager || echo "Service not found"',
+                'hostname && uname -a',
+                'wg show || echo "WireGuard not configured"',
+                'haproxy -v 2>&1 || echo "HAProxy not found"',
+                'iptables -L -n -v | head -20 || echo "iptables not available"',
+                'df -h',
+                'free -h',
+                'uptime'
+            ];
+            let output = '';
+            for (const cmd of commands) {
+                try {
+                    const result = await awsService.executeSSHCommand(connection, cmd);
+                    output += `\n=== ${cmd} ===\n${result.stdout}\n`;
+                }
+                catch (error) {
+                    output += `\n=== ${cmd} ===\nError: ${error instanceof Error ? error.message : String(error)}\n`;
+                }
+            }
+            return { success: true, logs: output };
+        }
+        // Regular logs
+        const journalCommand = 'journalctl -u edgible-agent --no-pager';
+        // Map log levels to journalctl priority levels
+        // journalctl -p uses syslog priorities: emerg(0), alert(1), crit(2), err(3), warning(4), notice(5), info(6), debug(7)
+        // Using -p shows that priority and above, so -p debug shows all logs including debug
+        let levelFilter = '';
+        if (level !== 'all') {
+            // Map our level names to journalctl priority names
+            const priorityMap = {
+                'error': 'err',
+                'warn': 'warning',
+                'info': 'info',
+                'debug': 'debug'
+            };
+            const journalPriority = priorityMap[level] || level;
+            levelFilter = ` -p ${journalPriority}`;
+        }
+        else {
+            // When level is 'all', explicitly include all priorities including debug
+            // Some systems may filter debug logs by default, so we explicitly include them
+            levelFilter = ' --priority=0..7';
+        }
+        const linesArg = follow ? '' : ` -n ${lines}`;
+        if (follow) {
+            // Follow logs in real-time
+            const result = await awsService.executeSSHCommand(connection, journalCommand + levelFilter + ' -f');
+            return { success: true, logs: result.stdout };
+        }
+        else {
+            const result = await awsService.executeSSHCommand(connection, journalCommand + levelFilter + linesArg);
+            return { success: true, logs: result.stdout };
+        }
+    }
+    async getGatewayLogs(gatewayId, options = {}) {
+        try {
+            // Attempt auto re-login if tokens are missing but credentials are available
+            await this.attemptAutoRelogin();
+            const configManager = new config_1.ConfigManager();
+            const gatewayInfo = configManager.getGateway(gatewayId);
+            if (!gatewayInfo) {
+                throw new Error('Gateway not found in local configuration');
+            }
+            // Load SSH key
+            const awsService = new aws_1.AWSService(configManager.getAWSProfile(), gatewayInfo.region);
+            const privateKey = awsService.loadSSHKey(gatewayInfo.keyPath);
+            // Wait for instance to be ready for SSH
+            const isReady = await awsService.waitForSSHReady(gatewayInfo.ec2InstanceId);
+            if (!isReady) {
+                throw new Error('Instance is not ready for SSH connections');
+            }
+            // If comprehensive mode, return diagnostics (this handles SSH connection internally)
+            if (options.comprehensive) {
+                const diagnostics = await this.getGatewayDiagnostics(gatewayId);
+                let output = chalk_1.default.blue.bold('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n');
+                output += chalk_1.default.blue.bold('                    GATEWAY DIAGNOSTICS\n');
+                output += chalk_1.default.blue.bold('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n');
+                // Agent Status
+                output += chalk_1.default.yellow.bold('📊 AGENT STATUS\n');
+                output += chalk_1.default.gray('─'.repeat(80) + '\n');
+                try {
+                    const status = JSON.parse(diagnostics.status);
+                    output += chalk_1.default.white(`Running: ${status.running ? chalk_1.default.green('✓ Yes') : chalk_1.default.red('✗ No')}\n`);
+                    output += chalk_1.default.white(`Health: ${status.health || 'unknown'}\n`);
+                    output += chalk_1.default.white(`Device ID: ${status.deviceId || 'N/A'}\n`);
+                    output += chalk_1.default.white(`Device Type: ${status.deviceType || 'N/A'}\n`);
+                    output += chalk_1.default.white(`Uptime: ${status.uptime ? Math.round(status.uptime / 1000 / 60) + ' minutes' : 'N/A'}\n`);
+                    output += chalk_1.default.white(`Last Poll: ${status.lastPoll || 'N/A'}\n`);
+                    output += chalk_1.default.white(`API Connected: ${status.apiConnected ? chalk_1.default.green('✓ Yes') : chalk_1.default.red('✗ No')}\n`);
+                    output += chalk_1.default.white(`Applications: ${status.applications?.length || 0}\n`);
+                    if (status.lastError) {
+                        output += chalk_1.default.red(`Last Error: ${status.lastError}\n`);
+                    }
+                }
+                catch {
+                    output += chalk_1.default.gray(diagnostics.status + '\n');
+                }
+                output += '\n';
+                // System Information
+                output += chalk_1.default.yellow.bold('🖥️  SYSTEM INFORMATION\n');
+                output += chalk_1.default.gray('─'.repeat(80) + '\n');
+                output += chalk_1.default.white(diagnostics.systemInfo + '\n');
+                output += '\n';
+                // Service Status
+                output += chalk_1.default.yellow.bold('⚙️  SERVICE STATUS\n');
+                output += chalk_1.default.gray('─'.repeat(80) + '\n');
+                output += chalk_1.default.white(diagnostics.serviceStatus + '\n');
+                output += '\n';
+                // WireGuard Status
+                output += chalk_1.default.yellow.bold('🔐 WIREGUARD STATUS\n');
+                output += chalk_1.default.gray('─'.repeat(80) + '\n');
+                output += chalk_1.default.white(diagnostics.wireguardStatus + '\n');
+                output += '\n';
+                // Network Information
+                output += chalk_1.default.yellow.bold('🌐 NETWORK INFORMATION\n');
+                output += chalk_1.default.gray('─'.repeat(80) + '\n');
+                output += chalk_1.default.white(diagnostics.networkInfo + '\n');
+                output += '\n';
+                // Caddy Status
+                output += chalk_1.default.yellow.bold('🚀 CADDY STATUS\n');
+                output += chalk_1.default.gray('─'.repeat(80) + '\n');
+                output += chalk_1.default.white(diagnostics.caddyStatus + '\n');
+                output += '\n';
+                // Log Paths Info (if available)
+                if (diagnostics.logPaths && diagnostics.logPaths.trim() && !diagnostics.logPaths.includes('Checking log paths')) {
+                    output += chalk_1.default.yellow.bold('📁 LOG FILE PATHS\n');
+                    output += chalk_1.default.gray('─'.repeat(80) + '\n');
+                    output += chalk_1.default.white(diagnostics.logPaths + '\n');
+                    output += '\n';
+                }
+                // Agent Logs
+                output += chalk_1.default.yellow.bold('📋 AGENT LOGS (Last 100 lines)\n');
+                output += chalk_1.default.gray('─'.repeat(80) + '\n');
+                if (diagnostics.agentLogs && diagnostics.agentLogs.trim() &&
+                    !diagnostics.agentLogs.includes('No logs available') &&
+                    !diagnostics.agentLogs.includes('Log file not found')) {
+                    output += chalk_1.default.white(diagnostics.agentLogs + '\n');
+                }
+                else {
+                    // Logs not found in file, try journalctl
+                    output += chalk_1.default.yellow('⚠ Log file not found. Using journalctl (systemd logs):\n');
+                    output += chalk_1.default.gray('   (Logs may only be available via systemd journal)\n\n');
+                    // The agentLogs command already tries journalctl as fallback, so it should have the logs
+                    // But if it still failed, show what we got
+                    if (diagnostics.agentLogs && diagnostics.agentLogs.trim()) {
+                        output += chalk_1.default.white(diagnostics.agentLogs + '\n');
+                    }
+                    else {
+                        output += chalk_1.default.red('✗ Could not retrieve logs from any source\n');
+                    }
+                }
+                output += '\n';
+                output += chalk_1.default.blue.bold('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n');
+                return {
+                    logs: output,
+                    success: true
+                };
+            }
+            // Create SSH connection for regular log retrieval
+            const connection = {
+                host: gatewayInfo.publicIp,
+                port: 22,
+                username: 'ec2-user',
+                privateKey: privateKey
+            };
+            console.log(chalk_1.default.blue('Connecting to gateway...'));
+            console.log(chalk_1.default.gray(`SSH Host: ${connection.host}:${connection.port}`));
+            // Test SSH connection first
+            console.log(chalk_1.default.gray('Testing SSH connection...'));
+            try {
+                await awsService.executeSSHCommand(connection, 'echo "SSH connection successful"');
+                console.log(chalk_1.default.green('✓ SSH connection established'));
+            }
+            catch (sshError) {
+                console.error(chalk_1.default.red('✗ SSH connection failed:'), sshError);
+                throw new Error(`SSH connection failed: ${sshError instanceof Error ? sshError.message : 'Unknown error'}`);
+            }
+            // Build journalctl command
+            let journalCommand = 'sudo journalctl -u edgible-agent.service --no-pager';
+            if (options.lines) {
+                journalCommand += ` -n ${options.lines}`;
+            }
+            if (options.level && options.level !== 'all') {
+                journalCommand += ` --priority=${options.level}`;
+            }
+            console.log(chalk_1.default.gray('Retrieving agent logs...'));
+            if (options.follow) {
+                console.log(chalk_1.default.yellow('Following logs (press Ctrl+C to stop)...'));
+                // For follow mode, we'll stream the logs
+                const result = await awsService.executeSSHCommand(connection, journalCommand + ' -f');
+                return {
+                    logs: result.stdout,
+                    success: true
+                };
+            }
+            else {
+                // For regular mode, get the logs and return
+                const result = await awsService.executeSSHCommand(connection, journalCommand);
+                return {
+                    logs: result.stdout,
+                    success: true
+                };
+            }
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Error retrieving gateway logs:'), error);
+            throw error;
+        }
+    }
+    /**
+     * Wipe agent log file on a gateway
+     */
+    async wipeGatewayLogs(gatewayId) {
+        try {
+            await this.attemptAutoRelogin();
+            const configManager = new config_1.ConfigManager();
+            const gatewayInfo = configManager.getGateway(gatewayId);
+            if (!gatewayInfo) {
+                throw new Error('Gateway not found in local configuration');
+            }
+            // Load SSH key
+            const awsService = new aws_1.AWSService(configManager.getAWSProfile(), gatewayInfo.region);
+            const privateKey = awsService.loadSSHKey(gatewayInfo.keyPath);
+            // Wait for instance to be ready for SSH
+            const isReady = await awsService.waitForSSHReady(gatewayInfo.ec2InstanceId);
+            if (!isReady) {
+                throw new Error('Instance is not ready for SSH connections');
+            }
+            // Create SSH connection
+            const connection = {
+                host: gatewayInfo.publicIp,
+                port: 22,
+                username: 'ec2-user',
+                privateKey: privateKey
+            };
+            // Test SSH connection
+            await awsService.executeSSHCommand(connection, 'echo "SSH connection successful"');
+            // Log file locations (try both locations)
+            const logPaths = [
+                '/opt/edgible-agent/.edgible/agent/logs/agent.log',
+                '~/.edgible/agent/logs/agent.log'
+            ];
+            let wipedFiles = [];
+            let errors = [];
+            for (const logPath of logPaths) {
+                try {
+                    // Check if file exists and wipe it
+                    const checkResult = await awsService.executeSSHCommand(connection, `test -f ${logPath} && echo "EXISTS" || echo "NOT_FOUND"`);
+                    if (checkResult.stdout.trim() === 'EXISTS') {
+                        // Wipe the log file (truncate to 0 bytes)
+                        await awsService.executeSSHCommand(connection, `sudo truncate -s 0 ${logPath} || sudo > ${logPath}`);
+                        wipedFiles.push(logPath);
+                        console.log(chalk_1.default.green(`  ✓ Cleared ${logPath}`));
+                    }
+                }
+                catch (error) {
+                    errors.push(`Failed to clear ${logPath}: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            // Also clear systemd journal logs if requested (optional)
+            try {
+                await awsService.executeSSHCommand(connection, 'sudo journalctl --vacuum-time=1s -u edgible-agent.service || true');
+                console.log(chalk_1.default.gray('  ✓ Cleared systemd journal logs'));
+            }
+            catch (error) {
+                // Ignore journalctl errors
+            }
+            if (wipedFiles.length === 0 && errors.length > 0) {
+                return {
+                    success: false,
+                    message: `No log files found or cleared. Errors: ${errors.join('; ')}`
+                };
+            }
+            return {
+                success: true,
+                logFile: wipedFiles.length > 0 ? wipedFiles[0] : undefined,
+                message: wipedFiles.length > 0 ? `Cleared ${wipedFiles.length} log file(s)` : 'No log files found to clear'
+            };
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Error wiping gateway logs:'), error);
+            throw error;
+        }
+    }
+    /**
+     * Wipe agent log file on a managed gateway
+     */
+    async wipeManagedGatewayLogs(gatewayId) {
+        try {
+            await this.attemptAutoRelogin();
+            // Get managed gateway details
+            const gatewayDetails = await this.getManagedGateway(gatewayId);
+            if (!gatewayDetails.success || !gatewayDetails.gateway) {
+                throw new Error('Managed gateway not found');
+            }
+            const gateway = gatewayDetails.gateway;
+            const ipAddress = gateway.ipAddress;
+            if (!ipAddress) {
+                throw new Error('Gateway IP address not available');
+            }
+            // Get SSH key from backend
+            const sshKeyResponse = await this.apiClient.getManagedGatewaySSHKey({ gatewayId });
+            if (!sshKeyResponse.success || !sshKeyResponse.sshPrivateKey) {
+                throw new Error('Failed to retrieve SSH key for managed gateway');
+            }
+            const sshPrivateKey = sshKeyResponse.sshPrivateKey;
+            // Create SSH connection
+            const connection = {
+                host: ipAddress,
+                port: 22,
+                username: 'ec2-user',
+                privateKey: sshPrivateKey
+            };
+            // Use AWSService to handle SSH operations
+            const { AWSService } = await Promise.resolve().then(() => __importStar(require('./aws')));
+            const awsService = new AWSService();
+            // Test SSH connection
+            await awsService.executeSSHCommand(connection, 'echo "SSH connection successful"');
+            // Log file locations (try both locations)
+            const logPaths = [
+                '/opt/edgible-agent/.edgible/agent/logs/agent.log',
+                '~/.edgible/agent/logs/agent.log'
+            ];
+            let wipedFiles = [];
+            let errors = [];
+            for (const logPath of logPaths) {
+                try {
+                    // Check if file exists and wipe it
+                    const checkResult = await awsService.executeSSHCommand(connection, `test -f ${logPath} && echo "EXISTS" || echo "NOT_FOUND"`);
+                    if (checkResult.stdout.trim() === 'EXISTS') {
+                        // Wipe the log file (truncate to 0 bytes)
+                        await awsService.executeSSHCommand(connection, `sudo truncate -s 0 ${logPath} || sudo > ${logPath}`);
+                        wipedFiles.push(logPath);
+                        console.log(chalk_1.default.green(`  ✓ Cleared ${logPath}`));
+                    }
+                }
+                catch (error) {
+                    errors.push(`Failed to clear ${logPath}: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            // Also clear systemd journal logs if requested (optional)
+            try {
+                await awsService.executeSSHCommand(connection, 'sudo journalctl --vacuum-time=1s -u edgible-agent.service || true');
+                console.log(chalk_1.default.gray('  ✓ Cleared systemd journal logs'));
+            }
+            catch (error) {
+                // Ignore journalctl errors
+            }
+            if (wipedFiles.length === 0 && errors.length > 0) {
+                return {
+                    success: false,
+                    message: `No log files found or cleared. Errors: ${errors.join('; ')}`
+                };
+            }
+            return {
+                success: true,
+                logFile: wipedFiles.length > 0 ? wipedFiles[0] : undefined,
+                message: wipedFiles.length > 0 ? `Cleared ${wipedFiles.length} log file(s)` : 'No log files found to clear'
+            };
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Error wiping managed gateway logs:'), error);
+            throw error;
+        }
+    }
+    /**
+     * Get applications for a specific gateway
+     */
+    async getGatewayApplications(gatewayId) {
+        try {
+            // Attempt auto re-login if tokens are missing but credentials are available
+            await this.attemptAutoRelogin();
+            const configManager = new config_1.ConfigManager();
+            const userConfig = configManager.getConfig();
+            if (!userConfig.organizationId) {
+                throw new Error('No organization ID found. Please login first.');
+            }
+            // Get all applications from the organization
+            const applicationsResponse = await this.apiClient.getOrganizationApplications(userConfig.organizationId);
+            // Filter for applications that use this gateway
+            const gatewayApplications = applicationsResponse.applications.filter((app) => app.deviceIds && app.deviceIds.includes(gatewayId));
+            // Map API response to CLI Application format
+            const applications = gatewayApplications.map((app) => ({
+                id: app.id,
+                name: app.name,
+                workloadId: app.deviceIds[0] || 'unknown',
+                servingIp: app.url ? new URL(app.url).hostname : 'unknown',
+                port: app.url ? parseInt(new URL(app.url).port) || 80 : 80,
+                protocol: app.url && app.url.startsWith('https') ? 'https' : 'http',
+                status: app.status === 'running' ? 'active' : 'inactive',
+                createdAt: app.createdAt,
+                description: app.description
+            }));
+            return applications;
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('Error getting gateway applications:'), error);
+            throw error;
+        }
+    }
+    /**
+     * Generate user data script for agent
+     */
+    generateAgentUserData(deviceId) {
+        const systemAgentPath = PathResolver_1.PathResolver.getSystemDataPath() + '/agent';
+        return `#!/bin/bash
+# Update system
+yum update -y
+
+# Install required system dependencies
+# Install iptables (usually pre-installed, but ensure it's there)
+yum install -y iptables
+
+# Install WireGuard
+amazon-linux-extras install epel -y || yum install -y epel-release
+yum install -y wireguard-tools
+modprobe wireguard || true
+
+# Install Caddy
+yum install -y tar curl grep
+CADDY_VERSION=$(curl -s "https://api.github.com/repos/caddyserver/caddy/releases/latest" | grep -Po '"tag_name": "\\K[^"]*')
+curl -1sLf "https://github.com/caddyserver/caddy/releases/download/\${CADDY_VERSION}/caddy_\${CADDY_VERSION}_linux_amd64.tar.gz" | tar -C /usr/bin -xzf - caddy
+chmod +x /usr/bin/caddy
+setcap cap_net_bind_service=+ep /usr/bin/caddy
+# Ensure it's in PATH
+ln -sf /usr/bin/caddy /usr/local/bin/caddy || true
+
+# Install Node.js
+curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash
+export NVM_DIR="$HOME/.nvm"
+[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
+nvm install 18
+nvm use 18
+
+# Create system-wide symlink for Node.js (so root can access it)
+NODE_VERSION=$(nvm list | grep -oE 'v18\.[0-9]+\.[0-9]+' | head -1)
+if [ -n "$NODE_VERSION" ]; then
+  sudo ln -sf "/home/ec2-user/.nvm/versions/node/$NODE_VERSION/bin/node" /usr/local/bin/node
+  sudo ln -sf "/home/ec2-user/.nvm/versions/node/$NODE_VERSION/bin/npm" /usr/local/bin/npm
+fi
+
+# Install PM2 for process management (install globally for root as well)
+npm install -g pm2
+sudo npm install -g pm2 || true
+
+# Create directory for agent (owned by root)
+sudo mkdir -p /opt/edgible-agent
+cd /opt/edgible-agent
+sudo chown root:root /opt/edgible-agent
+
+# Set up systemd service for agent (running as root)
+cat > /tmp/edgible-agent.service << 'EOF'
+[Unit]
+Description=Edgible Agent
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/edgible-agent
+ExecStart=/usr/local/bin/node index.js start -c /opt/edgible-agent/agent.config.json
+Restart=always
+RestartSec=10
+Environment=NODE_ENV=production
+Environment=EDGIBLE_CONFIG_PATH=${systemAgentPath}
+Environment=DEVICE_ID=${deviceId}
+Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+[Install]
+WantedBy=multi-user.target
+EOF
+sudo mv /tmp/edgible-agent.service /etc/systemd/system/edgible-agent.service
+
+# Enable service
+systemctl enable edgible-agent.service
+
+echo "Edgible Agent setup complete for device: ${deviceId}"
+`;
+    }
+    /**
+     * Generate placeholder agent code
+     */
+    generateAgentCode(deviceId) {
+        return `#!/usr/bin/env node
+
+console.log('Edgible Agent starting...');
+console.log('Device ID:', process.env.DEVICE_ID || '${deviceId}');
+
+// Placeholder agent code
+// In a real implementation, this would be the actual agent-v2 code
+
+setInterval(() => {
+  console.log('Agent heartbeat:', new Date().toISOString());
+}, 30000);
+
+console.log('Edgible Agent started successfully');
+`;
+    }
+    // Enhanced Application Setup with Validation
+    /**
+     * Enhanced setup with full validation
+     */
+    async setupApplicationWithValidation(workload, port, protocol = 'http', description, gatewayId) {
+        const startTime = Date.now();
+        const warnings = [];
+        const errors = [];
+        try {
+            // Attempt auto re-login if tokens are missing but credentials are available
+            await this.attemptAutoRelogin();
+            console.log(chalk_1.default.blue('Setting up application with validation...'));
+            // Step 1: Check local agent status
+            console.log(chalk_1.default.gray('Checking local agent status...'));
+            const localAgentManager = new LocalAgentManager_1.LocalAgentManager();
+            let localAgentStatus = await localAgentManager.checkLocalAgentStatus();
+            if (!localAgentStatus.installed) {
+                warnings.push('Local serving agent is not installed');
+                console.log(chalk_1.default.yellow('⚠ Local serving agent not found. Installing...'));
+                const installResult = await localAgentManager.installLocalAgent({
+                    autoStart: true
+                });
+                if (!installResult.success) {
+                    errors.push(`Failed to install local agent: ${installResult.error}`);
+                }
+                else {
+                    console.log(chalk_1.default.green('✓ Local agent installed successfully'));
+                    // Wait and verify the agent is running
+                    console.log(chalk_1.default.gray('Verifying agent is running...'));
+                    let retries = 0;
+                    const maxRetries = 5;
+                    let isRunning = false;
+                    while (retries < maxRetries && !isRunning) {
+                        await new Promise(resolve => setTimeout(resolve, 1000)); // Wait 1 second
+                        localAgentStatus = await localAgentManager.checkLocalAgentStatus();
+                        isRunning = localAgentStatus.running;
+                        retries++;
+                        if (!isRunning) {
+                            console.log(chalk_1.default.gray(`Waiting for agent to start... (${retries}/${maxRetries})`));
+                        }
+                    }
+                    if (!isRunning) {
+                        warnings.push('Local serving agent installation completed but may not be running');
+                    }
+                }
+            }
+            else if (!localAgentStatus.running) {
+                warnings.push('Local serving agent is not running');
+                console.log(chalk_1.default.yellow('⚠ Starting local serving agent...'));
+                const started = await localAgentManager.startLocalAgent();
+                if (!started) {
+                    errors.push('Failed to start local serving agent');
+                }
+                else {
+                    console.log(chalk_1.default.green('✓ Local serving agent started'));
+                    // Verify the agent is actually running
+                    localAgentStatus = await localAgentManager.checkLocalAgentStatus();
+                    if (!localAgentStatus.running) {
+                        warnings.push('Agent start command succeeded but agent may not be running');
+                    }
+                }
+            }
+            else {
+                console.log(chalk_1.default.green('✓ Local serving agent is running'));
+            }
+            // Final status check
+            if (errors.length === 0 && !localAgentStatus.running) {
+                warnings.push('Local serving agent may not be running properly');
+            }
+            // Step 2: Create application
+            console.log(chalk_1.default.gray('Creating application...'));
+            const application = await this.setupApplication(workload, port, protocol, description, gatewayId);
+            // Step 3: Configure local agent for application
+            console.log(chalk_1.default.gray('Configuring local agent for application...'));
+            const configResult = await localAgentManager.configureAgentForApplication(application);
+            if (!configResult.success) {
+                warnings.push(`Failed to configure agent: ${configResult.error}`);
+            }
+            // Step 4: Test connectivity
+            console.log(chalk_1.default.gray('Testing connectivity...'));
+            const connectivityTester = new ConnectivityTester_1.ConnectivityTester();
+            let connectivityTest;
+            if (gatewayId) {
+                // Get gateway information
+                const gatewaysResponse = await this.listGateways();
+                const gateway = gatewaysResponse.gateways.find((g) => g.device.id === gatewayId);
+                if (gateway) {
+                    const gatewayInfo = {
+                        id: gateway.device.id,
+                        name: gateway.device.name,
+                        publicIp: gateway.ec2Instance?.publicIp || '',
+                        privateIp: gateway.ec2Instance?.privateIp,
+                        region: gateway.ec2Instance?.region || 'us-east-1',
+                        status: gateway.device.status,
+                        deviceId: gateway.device.id,
+                        ec2InstanceId: gateway.ec2Instance?.instanceId
+                    };
+                    connectivityTest = await connectivityTester.testGatewayToWorkloadConnectivity(gatewayInfo, workload, port);
+                }
+                else {
+                    // Fallback connectivity test without gateway
+                    const portTest = await connectivityTester.testPortConnectivity(workload.ipAddress || 'localhost', port, 'tcp', 5000);
+                    connectivityTest = {
+                        overall: portTest.success,
+                        tests: [{
+                                success: portTest.success,
+                                applicationId: application.id,
+                                gatewayIp: 'localhost',
+                                workloadIp: workload.ipAddress || 'localhost',
+                                port,
+                                protocol: 'tcp',
+                                testType: 'connectivity',
+                                host: workload.ipAddress || 'localhost',
+                                latency: portTest.latency,
+                                error: portTest.error,
+                                timestamp: portTest.timestamp,
+                                url: `tcp://${workload.ipAddress || 'localhost'}:${port}`,
+                                method: 'CONNECT'
+                            }],
+                        diagnostics: {
+                            networkIssues: [],
+                            configurationIssues: [],
+                            serviceIssues: [],
+                            suggestions: []
+                        },
+                        recommendations: [],
+                        timestamp: new Date(),
+                        duration: 0
+                    };
+                }
+            }
+            else {
+                // Test local connectivity only
+                const portTest = await connectivityTester.testPortConnectivity(workload.ipAddress || 'localhost', port, 'tcp', 5000);
+                connectivityTest = {
+                    overall: portTest.success,
+                    tests: [{
+                            success: portTest.success,
+                            applicationId: application.id,
+                            gatewayIp: 'localhost',
+                            workloadIp: workload.ipAddress || 'localhost',
+                            port,
+                            protocol: 'tcp',
+                            testType: 'connectivity',
+                            host: workload.ipAddress || 'localhost',
+                            latency: portTest.latency,
+                            error: portTest.error,
+                            timestamp: portTest.timestamp,
+                            url: `tcp://${workload.ipAddress || 'localhost'}:${port}`,
+                            method: 'CONNECT'
+                        }],
+                    diagnostics: {
+                        networkIssues: [],
+                        configurationIssues: [],
+                        serviceIssues: [],
+                        suggestions: []
+                    },
+                    recommendations: [],
+                    timestamp: new Date(),
+                    duration: 0
+                };
+            }
+            if (!connectivityTest.overall) {
+                errors.push('Connectivity test failed');
+                console.log(chalk_1.default.red('✗ Connectivity test failed'));
+                connectivityTest.recommendations.forEach(rec => {
+                    console.log(chalk_1.default.yellow(`  • ${rec}`));
+                });
+            }
+            else {
+                console.log(chalk_1.default.green('✓ Connectivity test passed'));
+            }
+            // Step 5: Health validation
+            console.log(chalk_1.default.gray('Performing health validation...'));
+            const healthValidation = await this.getApplicationHealth(application.id);
+            if (healthValidation.overall !== 'healthy') {
+                warnings.push('Application health check failed');
+                console.log(chalk_1.default.yellow('⚠ Application health check failed'));
+            }
+            else {
+                console.log(chalk_1.default.green('✓ Application health check passed'));
+            }
+            // Step 6: Final status
+            const setupComplete = errors.length === 0;
+            const duration = Date.now() - startTime;
+            if (setupComplete) {
+                console.log(chalk_1.default.green('\n✓ Application setup completed successfully!'));
+            }
+            else {
+                console.log(chalk_1.default.red('\n✗ Application setup completed with errors'));
+            }
+            return {
+                application: application,
+                localAgentStatus: localAgentStatus,
+                connectivityTest,
+                healthValidation,
+                setupComplete,
+                warnings,
+                errors,
+                duration,
+                timestamp: new Date()
+            };
+        }
+        catch (error) {
+            const duration = Date.now() - startTime;
+            const errorMessage = error instanceof Error ? error.message : 'Unknown error occurred';
+            return {
+                application: {},
+                localAgentStatus: {
+                    running: false,
+                    health: 'unknown',
+                    uptime: 0,
+                    version: 'unknown',
+                    timestamp: Date.now(),
+                    deviceId: '',
+                    deviceType: 'serving',
+                    apiConnected: false,
+                    apiAuthenticated: false,
+                    applications: [],
+                    configurationValid: false,
+                    installed: false,
+                    lastError: errorMessage,
+                    pid: 0
+                },
+                connectivityTest: {
+                    overall: false,
+                    tests: [],
+                    diagnostics: {
+                        networkIssues: [],
+                        configurationIssues: [],
+                        serviceIssues: [],
+                        suggestions: []
+                    },
+                    recommendations: [],
+                    timestamp: new Date(),
+                    duration: 0
+                },
+                healthValidation: {
+                    overall: 'unknown',
+                    checks: [],
+                    lastChecked: new Date(),
+                    uptime: 0,
+                    version: 'unknown'
+                },
+                setupComplete: false,
+                warnings,
+                errors: [errorMessage],
+                duration,
+                timestamp: new Date()
+            };
+        }
+    }
+    /**
+     * Test application after setup
+     */
+    async validateApplicationSetup(application) {
+        const checks = [];
+        const recommendations = [];
+        try {
+            // Check 1: Application exists
+            checks.push({
+                name: 'application_exists',
+                status: application.id ? 'pass' : 'fail',
+                message: application.id ? 'Application exists' : 'Application not found',
+                duration: 0
+            });
+            // Check 2: Port connectivity
+            const connectivityTester = new ConnectivityTester_1.ConnectivityTester();
+            const portTest = await connectivityTester.testPortConnectivity(application.servingIp, application.port, 'tcp', 5000);
+            checks.push({
+                name: 'port_connectivity',
+                status: portTest.success ? 'pass' : 'fail',
+                message: portTest.success ? 'Port is accessible' : `Port connectivity failed: ${portTest.error}`,
+                duration: portTest.latency || 0
+            });
+            // Check 3: HTTP endpoint (if applicable)
+            if (application.protocol === 'http' || application.protocol === 'https') {
+                const url = `${application.protocol}://${application.servingIp}:${application.port}`;
+                const httpTest = await connectivityTester.testHttpEndpoint(url, 200, 5000);
+                checks.push({
+                    name: 'http_endpoint',
+                    status: httpTest.success ? 'pass' : 'fail',
+                    message: httpTest.success ? 'HTTP endpoint is responding' : `HTTP endpoint failed: ${httpTest.error}`,
+                    duration: httpTest.responseTime || 0
+                });
+            }
+            // Check 4: Local agent status
+            const localAgentManager = new LocalAgentManager_1.LocalAgentManager();
+            const agentStatus = await localAgentManager.checkLocalAgentStatus();
+            checks.push({
+                name: 'local_agent',
+                status: agentStatus.running ? 'pass' : 'warn',
+                message: agentStatus.running ? 'Local agent is running' : 'Local agent is not running',
+                duration: 0
+            });
+            // Generate recommendations
+            if (!portTest.success) {
+                recommendations.push('Check if the workload service is running and listening on the correct port');
+                recommendations.push('Verify firewall settings allow connections to the port');
+            }
+            if (agentStatus.installed && !agentStatus.running) {
+                recommendations.push('Start the local serving agent');
+            }
+            const overall = checks.every(c => c.status === 'pass') ? 'pass' :
+                checks.some(c => c.status === 'fail') ? 'fail' : 'warn';
+            return {
+                success: overall === 'pass',
+                checks,
+                overall,
+                recommendations
+            };
+        }
+        catch (error) {
+            return {
+                success: false,
+                checks: [{
+                        name: 'validation_error',
+                        status: 'fail',
+                        message: error instanceof Error ? error.message : 'Validation failed',
+                        duration: 0
+                    }],
+                overall: 'fail',
+                recommendations: ['Check application configuration and try again']
+            };
+        }
+    }
+    /**
+     * Get application health status
+     */
+    async getApplicationHealth(applicationId) {
+        try {
+            const localAgentManager = new LocalAgentManager_1.LocalAgentManager();
+            return await localAgentManager.monitorAgentHealth();
+        }
+        catch (error) {
+            return {
+                overall: 'unknown',
+                checks: [{
+                        name: 'health_check_error',
+                        status: 'fail',
+                        message: error instanceof Error ? error.message : 'Health check failed',
+                        timestamp: new Date()
+                    }],
+                lastChecked: new Date(),
+                uptime: 0,
+                version: 'unknown'
+            };
+        }
+    }
+    /**
+     * Create application programmatically without interactive prompts
+     */
+    async createApplicationProgrammatically(params) {
+        try {
+            // Attempt auto re-login if tokens are missing but credentials are available
+            await this.attemptAutoRelogin();
+            const config = this.configManager.getConfig();
+            if (!config.organizationId) {
+                throw new Error('Not logged in. Please run "edgible login" first.');
+            }
+            const createRequest = {
+                name: params.name,
+                description: params.description,
+                organizationId: config.organizationId,
+                configuration: { port: params.port, protocol: params.protocol },
+                hostnames: params.hostnames,
+                deviceIds: params.deviceIds,
+                gatewayIds: params.gatewayIds,
+                subtype: params.subtype
+            };
+            const response = await this.apiClient.createApplication(createRequest);
+            return response.application;
+        }
+        catch (error) {
+            throw new Error(`Failed to create application: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+    }
+}
+exports.EdgibleService = EdgibleService;
+//# sourceMappingURL=edgible.js.map