@exreve/exk 1.0.0

package/app-child.ts

@@ -0,0 +1,2769 @@
+#!/usr/bin/env node
+/**
+ * TalkToCode CLI - Child Process (App Bundle)
+ *
+ * This is the child process that contains all application logic.
+ * It is spawned by the updater process (updater.ts).
+ *
+ * This file is what gets updated during updates - the updater stays constant.
+ */
+
+import { Command } from 'commander'
+import { io, Socket } from 'socket.io-client'
+import { v4 as uuidv4 } from 'uuid'
+import fs from 'fs/promises'
+import fsSync from 'fs'
+import path from 'path'
+import os, { networkInterfaces } from 'os'
+import { Buffer } from 'buffer'
+import crypto from 'crypto'
+import type {
+  Session,
+  Device,
+  SessionOutput,
+  Project,
+  ProjectCreateData,
+  ProjectDeleteData,
+  SessionCreateData,
+  SessionPromptData,
+  SessionSubscribeData,
+  SuccessResponse,
+  SessionResponse,
+  SessionsListResponse,
+  DevicesListResponse,
+} from './shared/types'
+import { createProject, deleteProject } from './projectManager'
+import { agentSessionManager } from './agentSession'
+import { getProjectConfig, analyzeProjectWithClaude, saveProjectConfig } from './projectAnalyzer'
+import { generateRunnerCode } from './runnerGenerator'
+import { startApp, stopApp, restartApp, getAppStatuses, getAppLogs } from './appManager'
+import { spawn, execSync } from 'child_process'
+import readline from 'readline'
+import { fileURLToPath } from 'url'
+import { createHash } from 'crypto'
+
+// ============ Update IPC (Child -> Updater) ============
+
+/**
+ * Request update from parent updater process
+ */
+function requestUpdateFromParent(): void {
+  const updaterPid = process.env.TTC_UPDATER_PID
+  if (updaterPid) {
+    try {
+      // Send SIGUSR1 to parent to request update
+      process.kill(parseInt(updaterPid, 10), 'SIGUSR1')
+    } catch (error) {
+      console.error('Failed to request update from parent:', error)
+    }
+  }
+}
+
+/**
+ * Notify parent that we want to restart after update
+ */
+function requestRestartFromParent(): void {
+  const updaterPid = process.env.TTC_UPDATER_PID
+  if (updaterPid) {
+    try {
+      // Send SIGUSR2 to parent to request restart
+      process.kill(parseInt(updaterPid, 10), 'SIGUSR2')
+    } catch (error) {
+      console.error('Failed to request restart from parent:', error)
+    }
+  }
+}
+
+// ============ Types ============
+
+interface Config {
+  apiUrl: string
+}
+
+interface DeviceData {
+  deviceId: string
+}
+
+// ============ Constants ============
+
+const CONFIG_DIR = path.join(os.homedir(), '.talk-to-code')
+const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json')
+const DEVICE_ID_FILE = path.join(CONFIG_DIR, 'device-id.json')
+const DEFAULT_API_URL = 'https://api.talk-to-code.com'
+
+// ============ Helpers ============
+
+async function readConfig(): Promise<Config> {
+  try {
+    const data = await fs.readFile(CONFIG_FILE, 'utf-8')
+    return JSON.parse(data)
+  } catch {
+    return { apiUrl: DEFAULT_API_URL }
+  }
+}
+
+async function writeConfig(config: Config): Promise<void> {
+  await fs.mkdir(CONFIG_DIR, { recursive: true })
+  await fs.writeFile(CONFIG_FILE, JSON.stringify(config, null, 2))
+}
+
+async function getDeviceId(): Promise<string> {
+  try {
+    const data = await fs.readFile(DEVICE_ID_FILE, 'utf-8')
+    return JSON.parse(data).deviceId
+  } catch {
+    const deviceId = uuidv4()
+    await fs.mkdir(CONFIG_DIR, { recursive: true })
+    await fs.writeFile(DEVICE_ID_FILE, JSON.stringify({ deviceId }, null, 2))
+    return deviceId
+  }
+}
+
+function getLocalIpAddress(): string {
+  const nets = networkInterfaces()
+  for (const name of Object.keys(nets)) {
+    for (const net of nets[name]!) {
+      if (net.family === 'IPv4' && !net.internal) {
+        return net.address
+      }
+    }
+  }
+  return 'Unknown'
+}
+
+function getHostname(): string {
+  return os.hostname() || 'Unknown'
+}
+
+async function connect(): Promise<Socket> {
+  const config = await readConfig()
+  const deviceId = await getDeviceId()
+
+  return new Promise((resolve, reject) => {
+    const socket: Socket = io(config.apiUrl, {
+      transports: ['websocket', 'polling'],
+    })
+
+    socket.on('connect', () => {
+      socket.emit('register', { type: 'cli', deviceId })
+      resolve(socket)
+    })
+
+    socket.on('registered', ({ type }: { type: string }) => {
+      console.log(`Connected as ${type}`)
+    })
+
+    socket.on('connect_error', (err) => {
+      reject(err)
+    })
+  })
+}
+
+// ============ Update Helpers ============
+
+type UpdateCheckResponse = {
+  updateAvailable: boolean
+  downloadUrl?: string
+  hash?: string
+}
+
+const CURRENT_FILE = fileURLToPath(import.meta.url)
+const __dirname = path.dirname(CURRENT_FILE)
+
+function getCliHash(): string {
+  return createHash('sha256').update(fsSync.readFileSync(CURRENT_FILE)).digest('hex')
+}
+
+async function checkForUpdate(): Promise<UpdateCheckResponse | null> {
+  try {
+    const config = await readConfig()
+    const res = await fetch(`${config.apiUrl}/update/check`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ hash: getCliHash(), platform: os.platform() })
+    })
+    if (!res.ok) return null
+    return await res.json() as UpdateCheckResponse
+  } catch {
+    return null
+  }
+}
+
+async function replaceSelf(tarballBuffer: Buffer): Promise<void> {
+  const extractDir = path.join(os.tmpdir(), `ttc-update-${Date.now()}`)
+  await fs.mkdir(extractDir, { recursive: true })
+  const tarPath = path.join(extractDir, 'ttc-cli.tar.gz')
+  await fs.writeFile(tarPath, tarballBuffer)
+  execSync(`tar -xzf "${tarPath}" -C "${extractDir}"`)
+  await fs.unlink(tarPath)
+
+  // Preserve user config/token files (never overwrite on update)
+  const preserveFiles = ['device-config.json', 'device-id.json', 'config.json']
+  const preserved: Record<string, Buffer> = {}
+  for (const f of preserveFiles) {
+    try {
+      preserved[f] = await fs.readFile(path.join(CONFIG_DIR, f))
+    } catch {
+      /* file may not exist */
+    }
+  }
+
+  const cliDest = path.join(CONFIG_DIR, 'cli')
+  const sharedDest = path.join(CONFIG_DIR, 'shared')
+  await fs.rm(cliDest, { recursive: true, force: true })
+  await fs.rm(sharedDest, { recursive: true, force: true })
+  await fs.cp(path.join(extractDir, 'cli'), cliDest, { recursive: true })
+  await fs.cp(path.join(extractDir, 'shared'), sharedDest, { recursive: true })
+  await fs.copyFile(path.join(extractDir, 'package.json'), path.join(CONFIG_DIR, 'package.json'))
+  await fs.rm(extractDir, { recursive: true, force: true })
+
+  // Restore preserved config
+  for (const f of preserveFiles) {
+    if (preserved[f]) await fs.writeFile(path.join(CONFIG_DIR, f), preserved[f])
+  }
+
+  console.log('✓ CLI updated')
+
+  const npmPaths = [path.join(os.homedir(), '.nvm/versions/node/v22/bin/npm'), path.join(os.homedir(), '.nvm/versions/node/v20/bin/npm')]
+  const npmBin = npmPaths.find(p => fsSync.existsSync(p)) || 'npm'
+  try {
+    execSync(`"${npmBin}" install --omit=dev`, { cwd: CONFIG_DIR, stdio: 'inherit' })
+    console.log('✓ Dependencies updated')
+  } catch {
+    console.warn('⚠ npm install failed')
+  }
+}
+
+async function selfUpdate(force = false): Promise<void> {
+  const info = await checkForUpdate()
+  if (!info || !info.updateAvailable) {
+    console.log('✓ Already up to date')
+    return
+  }
+
+  console.log('📦 Update available!')
+  if (!force && process.stdin.isTTY) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout })
+    const answer = await new Promise<string>(r => rl.question('Update now? [Y/n] ', a => { rl.close(); r(a.trim()) }))
+    if (answer.toLowerCase().startsWith('n')) return
+  }
+
+  if (!info.downloadUrl || !info.hash) return
+
+  console.log('Downloading...')
+  const res = await fetch(info.downloadUrl)
+  if (!res.ok) throw new Error('Download failed')
+
+  const bundle = Buffer.from(await res.arrayBuffer())
+  if (createHash('sha256').update(bundle).digest('hex') !== info.hash) {
+    throw new Error('Hash mismatch')
+  }
+
+  await replaceSelf(bundle)
+  process.exit(0)
+}
+
+// ============ Commands ============
+
+async function registerDevice(name: string | undefined, email: string | undefined): Promise<void> {
+  try {
+    const deviceId = await getDeviceId()
+    let deviceEmail = email
+
+    // If we already have a valid token, skip approval email and just register
+    const deviceConfigFile = path.join(CONFIG_DIR, 'device-config.json')
+    try {
+      const deviceConfig = JSON.parse(await fs.readFile(deviceConfigFile, 'utf-8'))
+      const existingToken = deviceConfig.authToken
+      if (existingToken && typeof existingToken === 'string') {
+        const config = await readConfig()
+        const meRes = await fetch(`${config.apiUrl}/auth/me`, {
+          headers: { Authorization: `Bearer ${existingToken}` }
+        })
+        const meData = await meRes.json() as { success?: boolean; user?: { email?: string }; error?: string }
+        if (meRes.ok && meData.success && meData.user?.email) {
+          console.log(`✓ Using existing auth token for ${meData.user.email}`)
+          deviceEmail = deviceEmail || meData.user.email
+          const socket = await connect()
+          await new Promise<void>((resolve, reject) => {
+            socket.emit('device:register', {
+              deviceId,
+              name: name || `CLI Device ${deviceId.slice(0, 8)}`,
+              ipAddress: getLocalIpAddress(),
+              hostname: getHostname(),
+              email: deviceEmail
+            }, ({ success, device, error }: {
+              success: boolean
+              device?: Device
+              error?: string
+            }) => {
+              socket.disconnect()
+              if (success && device) {
+                console.log(`✓ Device registered!`)
+                console.log(`Device ID: ${device.deviceId}`)
+                console.log(`Name: ${device.name}`)
+                console.log(`Email: ${device.email}`)
+                resolve()
+              } else {
+                reject(new Error(error || 'Registration failed'))
+              }
+            })
+          })
+          return
+        }
+      }
+    } catch {
+      // No config or invalid token - continue with approval flow
+    }
+
+    // Prompt for email if not provided
+    if (!deviceEmail) {
+      const rl = readline.createInterface({ input: process.stdin, output: process.stdout })
+      deviceEmail = await new Promise<string>((resolve) => {
+        rl.question('Enter your email address: ', (answer) => {
+          rl.close()
+          resolve(answer.trim())
+        })
+      })
+    }
+
+    if (!deviceEmail?.includes('@')) {
+      console.error('✗ Valid email address is required')
+      throw new Error('Valid email address is required')
+    }
+
+    // Generate 32-byte random token (base64url encoded)
+    const randomBytes = crypto.randomBytes(32)
+    const approvalToken = randomBytes.toString('base64url') // base64url encoding (no padding, URL-safe)
+
+    console.log(`\n📧 Sending approval request to ${deviceEmail}...`)
+
+    // Send approval request
+    const config = await readConfig()
+    const response = await fetch(`${config.apiUrl}/auth/approval-request`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({
+        email: deviceEmail,
+        deviceId,
+        approvalToken
+      })
+    })
+
+    const result = await response.json() as { success: boolean; error?: string }
+
+    if (!result.success) {
+      console.error(`✗ Failed to send approval request: ${result.error || 'Unknown error'}`)
+      throw new Error(result.error || 'Failed to send approval request')
+    }
+
+    console.log(`✓ Approval email sent! Check your inbox (${deviceEmail})`)
+    console.log(`⏳ Waiting for approval...`)
+
+    // Poll every 5 seconds for approval
+    const maxAttempts = 120 // 10 minutes max (120 * 5s)
+    let attempts = 0
+
+    const checkApproval = async (): Promise<string | null> => {
+      attempts++
+
+      try {
+        const statusResponse = await fetch(`${config.apiUrl}/auth/approval-status?token=${approvalToken}`)
+        const statusResult = await statusResponse.json() as { success?: boolean; approved?: boolean; token?: string; error?: string; pending?: boolean }
+
+        if (statusResult.success && statusResult.approved) {
+          return statusResult.token || null // Return permanent auth token
+        }
+
+        if (statusResult.error && !statusResult.pending) {
+          console.error(`\n✗ ${statusResult.error}`)
+          return null
+        }
+
+        return null // Still pending
+      } catch (error: any) {
+        console.error(`\n✗ Error checking approval status: ${error.message}`)
+        return null
+      }
+    }
+
+    // Poll until approved or timeout
+    while (attempts < maxAttempts) {
+      await new Promise(resolve => setTimeout(resolve, 5000)) // Wait 5 seconds
+
+      const token = await checkApproval()
+      if (token) {
+        // Device approved! Store permanent token
+        const deviceConfigFile = path.join(CONFIG_DIR, 'device-config.json')
+        await fs.writeFile(deviceConfigFile, JSON.stringify({
+          email: deviceEmail,
+          authToken: token
+        }, null, 2))
+
+        console.log(`\n✓ Device approved!`)
+
+        // Register device with backend and wait for completion
+        const socket = await connect()
+
+        await new Promise<void>((resolve, reject) => {
+          socket.emit('device:register', {
+            deviceId,
+            name: name || `CLI Device ${deviceId.slice(0, 8)}`,
+            ipAddress: getLocalIpAddress(),
+            hostname: getHostname(),
+            email: deviceEmail
+          }, ({ success, device, error }: {
+            success: boolean
+            device?: Device
+            error?: string
+          }) => {
+            socket.disconnect()
+            if (success && device) {
+              console.log(`✓ Device registered!`)
+              console.log(`Device ID: ${device.deviceId}`)
+              console.log(`Name: ${device.name}`)
+              console.log(`Email: ${device.email}`)
+              console.log(`IP Address: ${device.ipAddress || 'Unknown'}`)
+              console.log(`Hostname: ${device.hostname || 'Unknown'}`)
+              resolve()
+            } else {
+              reject(new Error(error || 'Registration failed'))
+            }
+          })
+        })
+
+        return // Successfully registered
+      }
+
+      // Show progress every 30 seconds
+      if (attempts % 6 === 0) {
+        process.stdout.write(`\r⏳ Still waiting... (${attempts * 5}s)`)
+      }
+    }
+
+    console.error(`\n✗ Approval timeout. Please check your email and try again.`)
+    throw new Error('Approval timeout')
+  } catch (error) {
+    console.error('Failed to register device:', (error as Error).message)
+    throw error
+  }
+}
+
+async function listSessions(): Promise<void> {
+  try {
+    const socket = await connect()
+
+    socket.emit('sessions:list', (response: SessionsListResponse) => {
+      const { sessions } = response
+      console.log('\nSessions:')
+      console.log('-'.repeat(60))
+      sessions.forEach((session, idx) => {
+        console.log(`${idx + 1}. ${session.id}`)
+        console.log(`   Created: ${new Date(session.createdAt).toLocaleString()}`)
+        console.log()
+      })
+      socket.disconnect()
+    })
+  } catch (error) {
+    console.error('Failed to list sessions:', (error as Error).message)
+    process.exit(1)
+  }
+}
+
+async function createSession(): Promise<void> {
+  try {
+    const socket = await connect()
+
+    socket.emit('session:create', (response: SessionResponse) => {
+      const { success, session } = response
+      if (success && session) {
+        console.log('Session created!')
+        console.log('Session ID:', session.id)
+        socket.disconnect()
+      }
+    })
+  } catch (error) {
+    console.error('Failed to create session:', (error as Error).message)
+    process.exit(1)
+  }
+}
+
+async function sendPrompt(sessionId: string, prompt: string): Promise<void> {
+  try {
+    const socket = await connect()
+
+    socket.emit('session:subscribe', { sessionId })
+
+    socket.on('prompt:output', ({ data, type }: { data: string; type: string }) => {
+      if (type === 'stdout') {
+        process.stdout.write(data)
+      } else {
+        process.stderr.write(data)
+      }
+    })
+
+    socket.on('session:exited', ({ exitCode }: { exitCode: number | null }) => {
+      console.log(`\nSession exited with code ${exitCode}`)
+      socket.disconnect()
+    })
+
+    socket.emit('session:prompt', { sessionId, prompt }, ({ success }: { success: boolean }) => {
+      if (!success) {
+        console.error('Failed to send prompt')
+        socket.disconnect()
+      }
+    })
+
+    process.on('SIGINT', () => {
+      socket.emit('session:unsubscribe', { sessionId } as SessionSubscribeData)
+      socket.disconnect()
+      process.exit(0)
+    })
+  } catch (error) {
+    console.error('Failed to send prompt:', (error as Error).message)
+    process.exit(1)
+  }
+}
+
+async function listDevices(): Promise<void> {
+  try {
+    const socket = await connect()
+
+    socket.emit('devices:list', (response: DevicesListResponse) => {
+      const { devices } = response
+      console.log('\nRegistered Devices:')
+      console.log('-'.repeat(60))
+      devices.forEach((device, idx) => {
+        console.log(`${idx + 1}. ${device.name}`)
+        console.log(`   ID: ${device.deviceId}`)
+        console.log(`   IP Address: ${device.ipAddress || 'Unknown'}`)
+        console.log(`   Hostname: ${device.hostname || 'Unknown'}`)
+        console.log(`   Registered: ${new Date(device.registeredAt).toLocaleString()}`)
+        console.log(`   Last Seen: ${new Date(device.lastSeen).toLocaleString()}`)
+        console.log()
+      })
+      socket.disconnect()
+    })
+  } catch (error) {
+    console.error('Failed to list devices:', (error as Error).message)
+    process.exit(1)
+  }
+}
+
+async function monitorSession(sessionId: string): Promise<void> {
+  try {
+    const socket = await connect()
+
+    console.log(`Monitoring session ${sessionId}...`)
+    console.log('Press Ctrl+C to stop\n')
+
+    socket.emit('session:subscribe', { sessionId })
+
+    socket.on('session:state', ({ outputs, isActive }: { outputs: SessionOutput[]; isActive: boolean }) => {
+      console.log(`Session active: ${isActive}`)
+      console.log('Recent output:')
+      outputs.slice(-10).forEach(({ type, data }) => {
+        if (type === 'stdout') {
+          const dataString = typeof data === 'string' ? data : JSON.stringify(data)
+          process.stdout.write(dataString)
+        }
+      })
+    })
+
+    socket.on('prompt:output', ({ data, type }: { data: string; type: string }) => {
+      if (type === 'stdout') {
+        process.stdout.write(data)
+      }
+    })
+
+    socket.on('session:exited', ({ exitCode }: { exitCode: number | null }) => {
+      console.log(`\nSession exited with code ${exitCode}`)
+      socket.disconnect()
+    })
+
+    process.on('SIGINT', () => {
+      socket.emit('session:unsubscribe', { sessionId } as SessionSubscribeData)
+      socket.disconnect()
+      process.exit(0)
+    })
+  } catch (error) {
+    console.error('Failed to monitor session:', (error as Error).message)
+    process.exit(1)
+  }
+}
+
+// Active sessions map - persists across reconnections
+const activeSessions = new Map<string, { projectPath: string; currentPromptId?: string; model?: string }>()
+
+async function runDaemon(foreground = false, email?: string): Promise<void> {
+  const config = await readConfig()
+  const deviceId = await getDeviceId()
+  const ipAddress = getLocalIpAddress()
+  const hostname = getHostname()
+
+  // Silent update check on startup
+  checkForUpdate().then(info => {
+    if (info?.updateAvailable) console.log('📦 Update available: run "ttc update"')
+  }).catch(() => {})
+
+  if (foreground) console.log('=== TalkToCode CLI (Foreground) ===')
+  else console.log('Starting daemon...')
+  console.log(`API: ${config.apiUrl}`)
+  console.log(`Device: ${deviceId}`)
+  console.log(`Host: ${hostname}`)
+
+  // Test if server is reachable
+  if (foreground) {
+    try {
+      const url = new URL(config.apiUrl)
+      const testUrl = `${url.protocol}//${url.host}`
+      console.log(`Testing connection to ${testUrl}...`)
+      const response = await fetch(testUrl, { 
+        method: 'GET',
+        signal: AbortSignal.timeout(5000)
+      })
+      console.log(`✓ Server is reachable (HTTP ${response.status})`)
+    } catch (error: any) {
+      console.error(`✗ Cannot reach server: ${error.message}`)
+      console.error(`  Make sure the backend server is running at ${config.apiUrl}`)
+    }
+  }
+  console.log('')
+
+  let socket: Socket | null = null
+  let reconnectTimeout: ReturnType<typeof setTimeout> | null = null
+  let reconnectAttempts = 0
+  const MAX_RECONNECT_ATTEMPTS = Infinity // Keep trying forever
+
+  const connectAndRegister = async () => {
+    try {
+      socket = io(config.apiUrl, {
+        transports: ['websocket', 'polling'],
+        reconnection: true,
+        reconnectionDelay: 1000,
+        reconnectionDelayMax: 10000,
+        reconnectionAttempts: MAX_RECONNECT_ATTEMPTS,
+        timeout: 20000,
+        forceNew: true,
+        upgrade: true,
+      })
+      
+      if (foreground) {
+        console.log(`Attempting to connect to: ${config.apiUrl}`)
+      }
+
+      // Register event handlers once (outside registered callback to prevent duplicates)
+      // Project handlers
+      socket.on('project:create', async (data: ProjectCreateData, callback: (response: SuccessResponse & { actualPath?: string }) => void) => {
+        try {
+          if (foreground) {
+            console.log(`📁 Creating project: ${data.name} at ${data.path}`)
+          }
+          const result = await createProject({
+            projectId: data.projectId || uuidv4(),
+            name: data.name,
+            path: data.path,
+            sourcePath: data.sourcePath
+          })
+
+          if (result.success) {
+            if (foreground) {
+              console.log(`✓ Project created: ${data.name} at ${result.actualPath || data.path}`)
+            } else {
+              console.log(`Project created: ${data.name} at ${result.actualPath || data.path}`)
+            }
+          } else {
+            if (foreground) {
+              console.error(`✗ Failed to create project: ${result.error || 'Unknown error'}`)
+            }
+          }
+
+          callback?.({
+            success: result.success,
+            error: result.error,
+            actualPath: result.actualPath
+          })
+        } catch (error: any) {
+          if (foreground) {
+            console.error(`✗ Error creating project: ${error.message}`)
+          }
+          callback?.({ success: false, error: error.message })
+        }
+      })
+
+      socket.on('project:delete', async (data: ProjectDeleteData & { path?: string }, callback: (response: SuccessResponse) => void) => {
+        try {
+          const { projectId, path } = data
+          if (!path) {
+            callback?.({ success: false, error: 'Project path required for deletion' })
+            return
+          }
+
+          if (foreground) {
+            console.log(`🗑️  Deleting project: ${projectId} at ${path}`)
+          }
+          
+          const result = await deleteProject(path)
+          
+          if (result.success) {
+            if (foreground) {
+              console.log(`✓ Project deleted: ${projectId} at ${path}`)
+            } else {
+              console.log(`Project deleted: ${projectId} at ${path}`)
+            }
+          } else {
+            if (foreground) {
+              console.error(`✗ Failed to delete project: ${result.error || 'Unknown error'}`)
+            }
+          }
+          
+          callback?.(result)
+        } catch (error: any) {
+          if (foreground) {
+            console.error(`✗ Error deleting project: ${error.message}`)
+          }
+          callback?.({ success: false, error: error.message })
+        }
+      })
+
+      // GitHub handlers
+      socket.on('github:status', async (data: { projectId: string; projectPath: string }, callback?: (response: { success: boolean; isRepo?: boolean; hasChanges?: boolean; branch?: string; remote?: string; changedFiles?: Array<{ path: string; status: string }>; changesCount?: number; error?: string }) => void) => {
+        try {
+          const { projectPath } = data
+          
+          // Check if directory is a git repository
+          const gitDir = path.join(projectPath, '.git')
+          let isRepo = false
+          try {
+            const stats = await fs.stat(gitDir)
+            isRepo = stats.isDirectory()
+          } catch {
+            isRepo = false
+          }
+
+          if (!isRepo) {
+            callback?.({ success: true, isRepo: false, hasChanges: false })
+            return
+          }
+
+          // Check git status
+          const { execSync } = await import('child_process')
+          try {
+            // Get current branch
+            const branch = execSync('git rev-parse --abbrev-ref HEAD', { cwd: projectPath, encoding: 'utf-8' }).trim()
+            
+            // Get remote URL
+            let remote: string | undefined
+            try {
+              remote = execSync('git config --get remote.origin.url', { cwd: projectPath, encoding: 'utf-8' }).trim()
+            } catch {
+              // No remote configured
+            }
+
+            // Check for actual changes (modified, staged, deleted files - ignore untracked)
+            // Use --short to get concise output, and check for actual changes (not just untracked files)
+            let hasChanges = false
+            const changedFiles: Array<{ path: string; status: string }> = []
+            try {
+              const statusOutput = execSync('git status --porcelain', { cwd: projectPath, encoding: 'utf-8' })
+              const lines = statusOutput.trim().split('\n').filter(line => line.trim().length > 0)
+
+              for (const line of lines) {
+                const status = line.substring(0, 2).trim()
+                const filePath = line.substring(2).trim()
+
+                // Skip untracked files (??)
+                if (line.startsWith('??')) continue
+
+                // Include modified (M), added (A), deleted (D), renamed (R), copied (C)
+                if (status.includes('M') || status.includes('A') || status.includes('D') || status.includes('R') || status.includes('C')) {
+                  hasChanges = true
+                  changedFiles.push({ path: filePath, status })
+                }
+              }
+            } catch {
+              hasChanges = false
+            }
+
+            callback?.({ success: true, isRepo: true, hasChanges, branch, remote, changedFiles, changesCount: changedFiles.length })
+          } catch (error: any) {
+            callback?.({ success: false, error: error.message })
+          }
+        } catch (error: any) {
+          callback?.({ success: false, error: error.message })
+        }
+      })
+
+      socket.on('github:commit', async (data: { projectId: string; projectPath: string; message?: string }, callback?: (response: { success: boolean; error?: string }) => void) => {
+        try {
+          const { projectPath, message = 'changes' } = data
+
+          // Check if directory is a git repository
+          const gitDir = path.join(projectPath, '.git')
+          let isRepo = false
+          try {
+            const stats = await fs.stat(gitDir)
+            isRepo = stats.isDirectory()
+          } catch {
+            callback?.({ success: false, error: 'Not a git repository' })
+            return
+          }
+
+          const { execSync } = await import('child_process')
+          try {
+            // Stage all changes
+            execSync('git add -A', { cwd: projectPath })
+
+            // Commit with message
+            execSync(`git commit -m "${message.replace(/"/g, '\\"')}"`, { cwd: projectPath })
+
+            // Determine which branch to push to (master or main)
+            let targetBranch: string
+            try {
+              // Check if master branch exists
+              execSync('git rev-parse --verify master', { cwd: projectPath, stdio: 'ignore' })
+              targetBranch = 'master'
+            } catch {
+              try {
+                // Check if main branch exists
+                execSync('git rev-parse --verify main', { cwd: projectPath, stdio: 'ignore' })
+                targetBranch = 'main'
+              } catch {
+                // Fallback to current branch if neither master nor main exists
+                targetBranch = execSync('git rev-parse --abbrev-ref HEAD', { cwd: projectPath, encoding: 'utf-8' }).trim()
+              }
+            }
+
+            // Push to origin after commit
+            execSync(`git push origin ${targetBranch}`, { cwd: projectPath, stdio: 'pipe' })
+
+            callback?.({ success: true })
+          } catch (error: any) {
+            callback?.({ success: false, error: error.message })
+          }
+        } catch (error: any) {
+          callback?.({ success: false, error: error.message })
+        }
+      })
+
+      socket.on('github:push', async (data: { projectId: string; projectPath: string }, callback?: (response: { success: boolean; error?: string }) => void) => {
+        try {
+          const { projectPath } = data
+          
+          // Check if directory is a git repository
+          const gitDir = path.join(projectPath, '.git')
+          let isRepo = false
+          try {
+            const stats = await fs.stat(gitDir)
+            isRepo = stats.isDirectory()
+          } catch {
+            callback?.({ success: false, error: 'Not a git repository' })
+            return
+          }
+
+          const { execSync } = await import('child_process')
+          try {
+            // Determine which branch to push to (master or main)
+            let targetBranch: string
+            try {
+              // Check if master branch exists
+              execSync('git rev-parse --verify master', { cwd: projectPath, stdio: 'ignore' })
+              targetBranch = 'master'
+            } catch {
+              try {
+                // Check if main branch exists
+                execSync('git rev-parse --verify main', { cwd: projectPath, stdio: 'ignore' })
+                targetBranch = 'main'
+              } catch {
+                // Fallback to current branch if neither master nor main exists
+                targetBranch = execSync('git rev-parse --abbrev-ref HEAD', { cwd: projectPath, encoding: 'utf-8' }).trim()
+              }
+            }
+            
+            // Push to origin
+            execSync(`git push origin ${targetBranch}`, { cwd: projectPath })
+            
+            callback?.({ success: true })
+          } catch (error: any) {
+            callback?.({ success: false, error: error.message })
+          }
+        } catch (error: any) {
+          callback?.({ success: false, error: error.message })
+        }
+      })
+
+      socket.on('github:discard', async (data: { projectId: string; projectPath: string }, callback?: (response: { success: boolean; error?: string }) => void) => {
+        try {
+          const { projectPath } = data
+          
+          // Check if directory is a git repository
+          const gitDir = path.join(projectPath, '.git')
+          let isRepo = false
+          try {
+            const stats = await fs.stat(gitDir)
+            isRepo = stats.isDirectory()
+          } catch {
+            callback?.({ success: false, error: 'Not a git repository' })
+            return
+          }
+
+          const { execSync } = await import('child_process')
+          try {
+            // Discard all changes and revert to latest commit
+            // Reset all changes (both staged and unstaged)
+            execSync('git reset --hard HEAD', { cwd: projectPath })
+            // Clean untracked files and directories
+            execSync('git clean -fd', { cwd: projectPath })
+            
+            callback?.({ success: true })
+          } catch (error: any) {
+            callback?.({ success: false, error: error.message })
+          }
+        } catch (error: any) {
+          callback?.({ success: false, error: error.message })
+        }
+      })
+
+      // Directory listing handler
+      socket.on('fs:list', async (data: { dirPath: string }) => {
+        try {
+          const { dirPath } = data
+          if (!dirPath) {
+            socket?.emit('fs:list:response', { success: false, error: 'dirPath is required' })
+            return
+          }
+
+          const entries: Array<{ name: string; path: string; isDir: boolean }> = []
+          try {
+            const dirents = await fs.readdir(dirPath, { withFileTypes: true })
+            for (const dirent of dirents) {
+              if (dirent.name.startsWith('.')) continue // Skip hidden files
+              const fullPath = path.join(dirPath, dirent.name)
+              entries.push({
+                name: dirent.name,
+                path: fullPath,
+                isDir: dirent.isDirectory()
+              })
+            }
+            // Sort: directories first, then alphabetically
+            entries.sort((a, b) => {
+              if (a.isDir && !b.isDir) return -1
+              if (!a.isDir && b.isDir) return 1
+              return a.name.localeCompare(b.name)
+            })
+            socket?.emit('fs:list:response', { success: true, entries })
+          } catch (err: any) {
+            socket?.emit('fs:list:response', { success: false, error: err.message })
+          }
+        } catch (error: any) {
+          socket?.emit('fs:list:response', { success: false, error: error.message })
+        }
+      })
+
+      // File write handler
+      socket.on('fs:write', async (data: { filePath: string; content: string; encoding?: string }) => {
+        try {
+          const { filePath, content, encoding = 'utf-8' } = data
+          if (!filePath) {
+            socket?.emit('fs:write:response', { success: false, error: 'filePath is required' })
+            return
+          }
+
+          try {
+            // Ensure directory exists
+            const dir = path.dirname(filePath)
+            await fs.mkdir(dir, { recursive: true })
+
+            // Write file
+            await fs.writeFile(filePath, content, encoding as BufferEncoding)
+
+            socket?.emit('fs:write:response', { success: true })
+          } catch (err: any) {
+            socket?.emit('fs:write:response', { success: false, error: err.message })
+          }
+        } catch (error: any) {
+          socket?.emit('fs:write:response', { success: false, error: error.message })
+        }
+      })
+
+      // File read handler
+      socket.on('fs:read', async (data: { filePath: string; encoding?: string }) => {
+        try {
+          const { filePath, encoding = 'utf-8' } = data
+          if (!filePath) {
+            socket?.emit('fs:read:response', { success: false, error: 'filePath is required' })
+            return
+          }
+
+          try {
+            // Read file
+            const content = await fs.readFile(filePath, encoding as BufferEncoding)
+
+            socket?.emit('fs:read:response', { success: true, content })
+          } catch (err: any) {
+            socket?.emit('fs:read:response', { success: false, error: err.message })
+          }
+        } catch (error: any) {
+          socket?.emit('fs:read:response', { success: false, error: error.message })
+        }
+      })
+
+      // ========== Update Handlers ==========
+
+      // Check for updates
+      socket.on('update:check', async (data: {}, callback?: (response: {
+        success: boolean
+        updateAvailable?: boolean
+        version?: string
+        changelog?: string
+        size?: number
+        error?: string
+      }) => void) => {
+        try {
+          const config = await readConfig()
+          const currentHash = createHash('sha256').update(fsSync.readFileSync(fileURLToPath(import.meta.url))).digest('hex')
+
+          const response = await fetch(`${config.apiUrl}/update/check`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+              hash: currentHash,
+              platform: os.platform(),
+              arch: os.arch()
+            })
+          })
+
+          if (!response.ok) {
+            callback?.({ success: false, error: `HTTP ${response.status}` })
+            return
+          }
+
+          const info = await response.json() as any
+          callback?.({
+            success: true,
+            updateAvailable: info.updateAvailable,
+            version: info.version,
+            changelog: info.changelog,
+            size: info.size
+          })
+        } catch (error: any) {
+          callback?.({ success: false, error: error.message })
+        }
+      })
+
+      // Start update
+      socket.on('update:start', async (data: {}, callback?: (response: {
+        success: boolean
+        message?: string
+        error?: string
+      }) => void) => {
+        try {
+          // Request update from parent updater process
+          requestUpdateFromParent()
+
+          callback?.({
+            success: true,
+            message: 'Update initiated. The CLI will restart automatically when complete.'
+          })
+        } catch (error: any) {
+          callback?.({ success: false, error: error.message })
+        }
+      })
+
+      // Get version info
+      socket.on('version:info', async (data: {}, callback?: (response: {
+        success: boolean
+        version?: string
+        hash?: string
+        date?: string
+        nodeVersion?: string
+        platform?: string
+        arch?: string
+        error?: string
+      }) => void) => {
+        try {
+          const currentHash = createHash('sha256').update(fsSync.readFileSync(fileURLToPath(import.meta.url))).digest('hex')
+
+          // Try to read version from binary-hashes.json
+          let version = 'unknown'
+          let date = undefined
+          try {
+            const hashesPath = path.join(path.dirname(fileURLToPath(import.meta.url)), 'binary-hashes.json')
+            const hashes = JSON.parse(fsSync.readFileSync(hashesPath, 'utf-8'))
+            if (hashes['js-bundle']) {
+              version = hashes['js-bundle'].version || version
+              date = hashes['js-bundle'].date
+            }
+          } catch {}
+
+          callback?.({
+            success: true,
+            version,
+            hash: currentHash.substring(0, 16) + '...',
+            date,
+            nodeVersion: process.version,
+            platform: os.platform(),
+            arch: os.arch()
+          })
+        } catch (error: any) {
+          callback?.({ success: false, error: error.message })
+        }
+      })
+
+      // Session handlers
+      socket.on('session:create', async (data: { sessionId: string; projectId: string; projectPath: string }) => {
+        try {
+          let { sessionId, projectPath } = data
+
+          // Remap /home/abc to /tmp/abc if /home/abc doesn't exist (container workaround)
+          if (projectPath === '/home/abc' && !fsSync.existsSync('/home/abc')) {
+            const fallbackPath = '/tmp/abc'
+            fsSync.mkdirSync(fallbackPath, { recursive: true })
+            projectPath = fallbackPath
+            console.log(`[CLI] Remapped /home/abc -> ${fallbackPath}`)
+          }
+
+          activeSessions.set(sessionId, { projectPath })
+          if (foreground) {
+            console.log(`💬 Session created: ${sessionId}`)
+            console.log(`   Project: ${projectPath}`)
+          } else {
+            console.log(`Session created: ${sessionId} in project ${projectPath}`)
+          }
+        } catch (error: any) {
+          if (foreground) {
+            console.error(`✗ Failed to create session: ${error.message}`)
+          } else {
+            console.error('Failed to create session:', error.message)
+          }
+        }
+      })
+
+      socket.on('session:delete', async (data: { sessionId: string }) => {
+        try {
+          const { sessionId } = data
+          if (foreground) {
+            console.log(`🗑️  Deleting session: ${sessionId}`)
+          }
+          await agentSessionManager.deleteSession(sessionId)
+          activeSessions.delete(sessionId)
+          if (foreground) {
+            console.log(`✓ Session deleted: ${sessionId}`)
+          } else {
+            console.log(`Session deleted: ${sessionId}`)
+          }
+        } catch (error: any) {
+          if (foreground) {
+            console.error(`✗ Failed to delete session: ${error.message}`)
+          } else {
+            console.error('Failed to delete session:', error.message)
+          }
+        }
+      })
+
+      socket.on('project:config:analyze', async (data: { projectId: string; projectPath: string; projectName: string; analysisId?: string }) => {
+        try {
+          const { projectId, projectPath, projectName, analysisId } = data
+          
+          if (foreground) {
+            console.log(`🔍 Analyzing project: ${projectName} at ${projectPath}`)
+          }
+          
+          
+          // Run Claude analysis
+          const config = await analyzeProjectWithClaude(projectPath, projectName)
+          
+          // Save config file (.talk-to-code.json)
+          await saveProjectConfig(projectPath, config)
+          
+          // Generate and save runner files for each app
+          for (const app of config.apps) {
+            const runnerCode = generateRunnerCode(app, projectPath)
+            const runnerFileName = `${app.name}_runner.ts`
+            const runnerPath = path.join(projectPath, app.directory || '', runnerFileName)
+            
+            // Ensure directory exists
+            const runnerDir = path.dirname(runnerPath)
+            await fs.mkdir(runnerDir, { recursive: true })
+            
+            // Write runner file
+            await fs.writeFile(runnerPath, runnerCode, 'utf-8')
+            
+            if (foreground) {
+              console.log(`✓ Generated runner: ${runnerFileName}`)
+            }
+          }
+          
+          if (foreground) {
+            console.log(`✓ Analysis complete: Found ${config.apps.length} apps`)
+            console.log(`✓ Generated ${config.apps.length} runner files`)
+          }
+          
+          // Emit result back to backend
+          socket!.emit('project:config:analyzed', {
+            projectId,
+            config,
+            analysisId
+          })
+        } catch (error: any) {
+          if (foreground) {
+            console.error(`✗ Analysis error: ${error.message}`)
+          }
+          socket!.emit('project:config:analyze:error', {
+            projectId: data.projectId,
+            error: error.message,
+            analysisId: data.analysisId
+          })
+        }
+      })
+
+      // App control handlers
+      socket.on('app:start', async (data: { projectId: string; projectPath: string; appName: string; appControlId?: string }, callback: (response: { success: boolean; error?: string; processId?: string; pid?: number }) => void) => {
+        try {
+          const { projectId, projectPath, appName } = data
+          
+          // Load project config to get app details
+          const config = await getProjectConfig(projectPath)
+          
+          if (!config) {
+            callback?.({ success: false, error: 'Project config not found' })
+            return
+          }
+          
+          const app = config.apps.find(a => a.name === appName)
+          if (!app) {
+            callback?.({ success: false, error: `App "${appName}" not found in project config` })
+            return
+          }
+          
+          const result = await startApp(projectPath, projectId, app)
+          
+          if (result.success) {
+            if (foreground) {
+              console.log(`✓ Started app: ${appName} (PID: ${result.pid})`)
+            }
+            socket!.emit('app:started', {
+              projectId,
+              appName,
+              processId: result.processId,
+              pid: result.pid,
+            })
+          }
+          
+          callback?.(result)
+        } catch (error: any) {
+          if (foreground) {
+            console.error(`✗ Error starting app: ${error.message}`)
+          }
+          callback?.({ success: false, error: error.message })
+        }
+      })
+
+      socket.on('app:stop', async (data: { projectId: string; projectPath: string; appName: string; appControlId?: string }, callback: (response: { success: boolean; error?: string }) => void) => {
+        try {
+          const { projectId, projectPath, appName } = data
+          
+          // Load project config to get app details (for custom stop command)
+          const config = await getProjectConfig(projectPath)
+          const app = config?.apps.find(a => a.name === appName)
+          
+          const result = await stopApp(projectId, appName, app)
+          
+          if (result.success) {
+            if (foreground) {
+              console.log(`✓ Stopped app: ${appName}`)
+            }
+            socket!.emit('app:stopped', {
+              projectId,
+              appName,
+              appControlId: data.appControlId,
+            })
+          }
+          
+          callback?.(result)
+        } catch (error: any) {
+          if (foreground) {
+            console.error(`✗ Error stopping app: ${error.message}`)
+          }
+          callback?.({ success: false, error: error.message })
+        }
+      })
+
+      socket.on('app:restart', async (data: { projectId: string; projectPath: string; appName: string; appControlId?: string }, callback: (response: { success: boolean; error?: string; processId?: string; pid?: number }) => void) => {
+        try {
+          const { projectId, projectPath, appName } = data
+          
+          // Load project config to get app details
+          const config = await getProjectConfig(projectPath)
+          
+          if (!config) {
+            callback?.({ success: false, error: 'Project config not found' })
+            return
+          }
+          
+          const app = config.apps.find(a => a.name === appName)
+          if (!app) {
+            callback?.({ success: false, error: `App "${appName}" not found in project config` })
+            return
+          }
+          
+          const result = await restartApp(projectPath, projectId, app)
+          
+          if (result.success) {
+            if (foreground) {
+              console.log(`✓ Restarted app: ${appName} (PID: ${result.pid})`)
+            }
+            socket!.emit('app:restarted', {
+              projectId,
+              appName,
+              processId: result.processId,
+              pid: result.pid,
+              appControlId: data.appControlId,
+            })
+          }
+          
+          callback?.(result)
+        } catch (error: any) {
+          if (foreground) {
+            console.error(`✗ Error restarting app: ${error.message}`)
+          }
+          callback?.({ success: false, error: error.message })
+        }
+      })
+
+      socket.on('app:status', async (data: { projectId: string; projectPath: string; appName?: string; appControlId?: string }, callback: (response: { success: boolean; apps?: Array<{ name: string; running: boolean; processId?: string; pid?: number }>; error?: string }) => void) => {
+        try {
+          const { projectId, projectPath, appName } = data
+          
+          // Load project config
+          const config = await getProjectConfig(projectPath)
+          
+          if (!config) {
+            callback?.({ success: false, error: 'Project config not found' })
+            return
+          }
+          
+          const appsToCheck = appName
+            ? config.apps.filter(a => a.name === appName)
+            : config.apps
+          
+          const statuses = getAppStatuses(projectId, appsToCheck)
+          
+          // Send response back to backend
+          if (data.appControlId) {
+            socket!.emit('app:control:response', {
+              appControlId: data.appControlId,
+              success: true,
+              apps: statuses,
+            })
+          }
+          
+          callback?.({ success: true, apps: statuses })
+        } catch (error: any) {
+          if (foreground) {
+            console.error(`✗ Error getting app status: ${error.message}`)
+          }
+          callback?.({ success: false, error: error.message })
+        }
+      })
+
+      socket.on('app:logs', async (data: { projectId: string; appName: string; follow?: boolean; appControlId?: string }, callback: (response: { success: boolean; logs?: string; error?: string }) => void) => {
+        try {
+          const { projectId, appName } = data
+          
+          const result = await getAppLogs(projectId, appName, 100)
+          
+          // Send response back to backend
+          if (data.appControlId) {
+            socket!.emit('app:control:response', {
+              appControlId: data.appControlId,
+              ...result,
+            })
+          }
+          
+          callback?.(result)
+        } catch (error: any) {
+          if (foreground) {
+            console.error(`✗ Error getting app logs: ${error.message}`)
+          }
+          callback?.({ success: false, error: error.message })
+        }
+      })
+
+      socket.on('session:prompt', async (data: SessionPromptData & { projectPath?: string; promptId?: string; model?: string }) => {
+        try {
+          const { sessionId, prompt, projectPath: providedProjectPath, promptId, enhancers, model } = data
+
+          // promptId is REQUIRED when routing to device
+          if (!promptId) {
+            if (foreground) {
+              console.error(`✗ Missing required promptId for session: ${sessionId}`)
+            }
+            socket!.emit('session:error', { sessionId, error: 'Missing required promptId' })
+            return
+          }
+
+          // Try to get projectPath from activeSessions or use provided one
+          let projectPath: string | undefined = providedProjectPath || activeSessions.get(sessionId)?.projectPath
+
+          if (!projectPath) {
+            if (foreground) {
+              console.error(`✗ Session not found: ${sessionId} (missing projectPath)`)
+            }
+            socket!.emit('session:error', { sessionId, error: 'Session not found or projectPath missing' })
+            return
+          }
+
+          // Check if user choice is enabled from the prompt data (sent by backend)
+          // Backend now includes enabledModules in the session:prompt event
+          const enabledModules = data.enabledModules || []
+          const moduleSettings = data.moduleSettings || {}
+          const userChoiceEnabled = enabledModules.includes('user-choice') || false
+
+          if (foreground) {
+            console.log(`[CLI] Enabled modules: ${enabledModules.join(', ') || 'none'}`)
+            console.log(`[CLI] User choice enabled: ${userChoiceEnabled}`)
+          }
+
+          // Store in activeSessions with promptId and model
+          activeSessions.set(sessionId, { projectPath, currentPromptId: promptId, model })
+
+          // Capture promptId in closure to prevent race conditions when multiple prompts arrive quickly
+          // This ensures each prompt's messages use the correct promptId even if a new prompt arrives
+          const capturedPromptId = promptId
+
+          if (foreground) {
+            console.log(`\n[CLI] 📤 Received prompt for session: ${sessionId}, promptId: ${capturedPromptId}`)
+            console.log(`[CLI]    Prompt: ${prompt.substring(0, 100)}${prompt.length > 100 ? '...' : ''}`)
+          }
+
+          // Create or get session handler
+          await agentSessionManager.createSession({
+            sessionId,
+            projectPath,
+            userChoiceEnabled, // Pass user choice enabled setting from backend
+            enabledModules, // Pass enabled modules for MCP server
+            moduleSettings, // Pass module settings for MCP server
+            onOutput: (output: SessionOutput) => {
+              // Serialize data to string if it's an object
+              const dataString = typeof output.data === 'string' 
+                ? output.data 
+                : JSON.stringify(output.data)
+              
+              // Use captured promptId (not currentPromptId from activeSessions) to prevent race conditions
+              if (!capturedPromptId) {
+                console.error(`[CLI] Missing promptId for session ${sessionId}, cannot emit prompt:output`)
+                return
+              }
+              
+              socket!.emit('prompt:output', {
+                sessionId,
+                promptId: capturedPromptId, // Use captured promptId, not currentPromptId
+                type: output.type,
+                data: dataString,
+                timestamp: output.timestamp,
+                metadata: output.metadata
+              })
+            },
+            onError: (error: string) => {
+              socket!.emit('session:error', { sessionId, error })
+            },
+            onComplete: (exitCode: number | null) => {
+              // Note: This onComplete is from createSession, not sendPrompt
+              // The actual session:result is emitted from sendPrompt handler below
+              // This handler is kept for backward compatibility but may not be used
+            },
+            onChoiceRequest: (request) => {
+              // Emit choice request to frontend
+              socket!.emit('user:choice:request', {
+                sessionId,
+                choiceId: request.choiceId,
+                question: request.question,
+                options: request.options,
+                timeout: request.timeout
+              })
+            }
+          })
+
+          // Send prompt - status updates will be emitted from agentSession when processing starts/completes
+          await agentSessionManager.sendPrompt(sessionId, prompt, enhancers || [], {
+            sessionId,
+            projectPath,
+            promptId: capturedPromptId,
+            model: model, // Pass the model from the session
+            onStatusUpdate: (status: 'running' | 'completed' | 'error' | 'cancelled') => {
+              // Emit status update from CLI (CLI is source of truth)
+              // Use captured promptId to ensure correct prompt is updated
+              if (!capturedPromptId) {
+                console.error(`[CLI] Missing promptId for status update, cannot emit prompt:updated`)
+                return
+              }
+              
+              // Always log status updates for debugging (even in background mode)
+              console.log(`[CLI] 📊 Status update: promptId=${capturedPromptId}, status=${status}, sessionId=${sessionId}`)
+              
+              // Emit status update IMMEDIATELY (real-time)
+              socket!.emit('prompt:updated', {
+                promptId: capturedPromptId, // CRITICAL: Use captured promptId from closure
+                sessionId,
+                text: prompt,
+                status,
+                createdAt: new Date().toISOString(),
+                ...(status === 'running' ? { startedAt: new Date().toISOString() } : {}),
+                ...(status === 'completed' || status === 'error' || status === 'cancelled' ? { completedAt: new Date().toISOString() } : {}),
+                messages: []
+              })
+            },
+            onOutput: (output: SessionOutput) => {
+              // Serialize data to string if it's an object
+              const dataString = typeof output.data === 'string' 
+                ? output.data 
+                : JSON.stringify(output.data)
+              
+              // Use captured promptId (not currentPromptId from activeSessions) to prevent race conditions
+              if (!capturedPromptId) {
+                console.error(`[CLI] Missing promptId for session ${sessionId}, cannot emit prompt:output`)
+                return
+              }
+              
+              if (foreground && output.type === 'stdout') {
+                process.stdout.write(dataString)
+              }
+              socket!.emit('prompt:output', {
+                sessionId,
+                promptId: capturedPromptId, // Use captured promptId, not currentPromptId
+                type: output.type,
+                data: dataString,
+                timestamp: output.timestamp,
+                metadata: output.metadata
+              })
+            },
+            onError: (error: string) => {
+              // Error logging is handled by AgentLogger in agentSession.ts
+              // Additional console output for foreground mode
+              if (foreground) {
+                console.error(`\n[CLI] ✗ Session error: ${error}`)
+              }
+              socket!.emit('session:error', { sessionId, error })
+            },
+            onComplete: (exitCode: number | null) => {
+              // Completion logging is handled by AgentLogger in agentSession.ts
+              // Additional console output for foreground mode
+              if (foreground) {
+                console.log(`\n[CLI] ✓ Session completed with exit code: ${exitCode ?? 'null'}`)
+              }
+              
+              // Use captured promptId (not currentPromptId from activeSessions) to prevent race conditions
+              if (!capturedPromptId) {
+                console.error(`[CLI] Missing promptId for session ${sessionId}, cannot emit session:result`)
+                return
+              }
+              
+              socket!.emit('session:result', { 
+                sessionId, 
+                promptId: capturedPromptId, // Use captured promptId, not currentPromptId
+                exitCode 
+              })
+            }
+          })
+        } catch (error: any) {
+          if (foreground) {
+            console.error(`✗ Error processing prompt: ${error.message}`)
+          }
+          socket!.emit('session:error', { sessionId: data.sessionId, error: error.message })
+        }
+      })
+
+      // Handle prompt cancellation
+      socket.on('prompt:cancel', async (data: { promptId: string; sessionId: string }, callback: (response: { success: boolean; error?: string }) => void) => {
+        try {
+          const { promptId, sessionId } = data
+
+          if (!promptId || !sessionId) {
+            callback?.({ success: false, error: 'Missing promptId or sessionId' })
+            return
+          }
+
+          if (foreground) {
+            console.log(`[CLI] 🛑 Cancelling prompt: ${promptId}`)
+          }
+
+          // Cancel the prompt
+          const cancelled = await agentSessionManager.cancelPrompt(
+            promptId,
+            sessionId,
+            (status) => {
+              // Emit cancelled status update
+              socket!.emit('prompt:updated', {
+                promptId,
+                sessionId,
+                text: '', // Not needed for status update
+                status: 'cancelled',
+                createdAt: new Date().toISOString(),
+                completedAt: new Date().toISOString(),
+                messages: []
+              })
+            }
+          )
+
+          if (cancelled) {
+            callback?.({ success: true })
+          } else {
+            callback?.({ success: false, error: 'Prompt not found or already completed' })
+          }
+        } catch (error: any) {
+          if (foreground) {
+            console.error(`✗ Error cancelling prompt: ${error.message}`)
+          }
+          callback?.({ success: false, error: error.message })
+        }
+      })
+
+      // Handle emergency stop - forcefully halt all session activity
+      socket.on('emergency:stop', async (data: { sessionId: string }, callback: (response: { success: boolean; message?: string }) => void) => {
+        try {
+          const { sessionId } = data
+
+          if (!sessionId) {
+            callback?.({ success: false, message: 'Missing sessionId' })
+            return
+          }
+
+          if (foreground) {
+            console.log(`[CLI] ☠️  EMERGENCY STOP for session: ${sessionId}`)
+          }
+
+          // Execute emergency stop
+          const result = await agentSessionManager.emergencyStop(sessionId)
+
+          // Emit status update for current prompt if any
+          socket!.emit('emergency:stopped', {
+            sessionId,
+            success: result.success,
+            message: result.message,
+            timestamp: new Date().toISOString()
+          })
+
+          callback?.(result)
+        } catch (error: any) {
+          if (foreground) {
+            console.error(`✗ Error during emergency stop: ${error.message}`)
+          }
+          callback?.({ success: false, message: error.message })
+        }
+      })
+
+      // Handle user choice response from frontend
+      socket.on('user:choice:response', async (data: { sessionId: string; choiceId: string; selectedValue: string | null }) => {
+        try {
+          const { sessionId, choiceId, selectedValue } = data
+
+          if (foreground) {
+            console.log(`[CLI] 📝 Received user choice response: choiceId=${choiceId}, selectedValue=${selectedValue}`)
+          }
+
+          // Forward the response to the agent session manager
+          await agentSessionManager.handleChoiceResponse(sessionId, {
+            choiceId,
+            selectedValue
+          })
+        } catch (error: any) {
+          if (foreground) {
+            console.error(`✗ Error handling user choice response: ${error.message}`)
+          }
+        }
+      })
+
+      socket.on('connect', () => {
+        if (foreground) {
+          console.log(`✓ Connected to backend at ${config.apiUrl}`)
+          if (socket) {
+            console.log(`   Socket ID: ${socket.id}`)
+          }
+        } else {
+          console.log('Connected to backend')
+        }
+        reconnectAttempts = 0
+        
+        // Register as CLI device
+        if (socket) {
+          socket.emit('register', { type: 'cli', deviceId })
+        }
+      })
+
+      socket.on('registered', async ({ type }: { type: string }) => {
+        if (foreground) {
+          console.log(`✓ Registered as ${type}`)
+        } else {
+          console.log(`Registered as ${type}`)
+        }
+
+        // Check for auth token: env TTC_AUTH_TOKEN or device-config.json (from previous approval)
+        const deviceConfigFile = path.join(CONFIG_DIR, 'device-config.json')
+        let authToken = process.env.TTC_AUTH_TOKEN
+        let deviceEmail: string | undefined = email
+        let skipEmailFlow = false
+
+        // Load from device-config if no env token (reuse state from previous approval)
+        if (!authToken) {
+          try {
+            const deviceConfig = JSON.parse(await fs.readFile(deviceConfigFile, 'utf-8'))
+            authToken = deviceConfig.authToken
+            if (!deviceEmail && deviceConfig.email) deviceEmail = deviceConfig.email
+          } catch {
+            // No device config yet
+          }
+        }
+
+        if (authToken) {
+          try {
+            const parts = authToken.split('.')
+            if (parts.length === 3) {
+              const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString())
+              if (payload.type === 'device_auth' && payload.email) {
+                deviceEmail = payload.email
+                skipEmailFlow = true
+                if (foreground) {
+                  console.log(`✓ Using stored auth token for ${deviceEmail}`)
+                }
+              }
+            }
+          } catch (err) {
+            if (foreground) {
+              console.warn(`⚠️  Invalid auth token in config, falling back to normal auth`)
+            }
+            authToken = undefined
+          }
+        }
+
+        // Load device email from config if not using token and not provided
+        if (!deviceEmail && !skipEmailFlow) {
+          try {
+            const deviceConfig = JSON.parse(await fs.readFile(deviceConfigFile, 'utf-8'))
+            deviceEmail = deviceConfig.email
+          } catch {
+            // No device config yet
+          }
+        }
+        
+        // Register device with backend
+        let needsApprovalLoggedOnce = false
+        const registerDevice = () => {
+          // Determine device name
+          const containerName = process.env.CONTAINER_NAME
+          const deviceName = containerName ? `Container: ${containerName}` : `CLI Device ${hostname}`
+
+          socket!.emit('device:register', {
+            deviceId,
+            name: deviceName,
+            ipAddress,
+            hostname,
+            email: deviceEmail,
+            // When using auth token, include the token for verification
+            authToken: skipEmailFlow ? authToken : undefined
+          }, ({ success, needsApproval, message, device, error }: {
+            success: boolean
+            needsApproval?: boolean
+            message?: string
+            device?: Device
+            error?: string
+          }) => {
+            if (success && device) {
+              needsApprovalLoggedOnce = false
+              if (foreground) {
+                console.log(`✓ Device registered: ${device.name}`)
+                if (device.approved) {
+                  console.log(`✓ Device approved and ready`)
+                }
+              } else {
+                console.log(`Device registered: ${device.name}${device.approved ? ' (approved)' : ' (pending approval)'}`)
+              }
+              // Save config: email + authToken (preserve token so next run can reuse)
+              if (device.email) {
+                const toSave = { email: device.email, ...(authToken ? { authToken } : {}) }
+                fs.writeFile(deviceConfigFile, JSON.stringify(toSave, null, 2)).catch(() => {})
+              }
+            } else if (needsApproval) {
+              // Persist email when approval was requested so restarts don't prompt again
+              if (deviceEmail) {
+                fs.writeFile(deviceConfigFile, JSON.stringify({ email: deviceEmail }, null, 2)).catch(() => {})
+              }
+              // Only log once to avoid flooding logs every 30s on heartbeat
+              if (!needsApprovalLoggedOnce) {
+                needsApprovalLoggedOnce = true
+                if (foreground) {
+                  console.log(`\n⚠️  ${message || 'Device approval required'}`)
+                  if (!deviceEmail) {
+                    console.log(`   Please run: npx tsx index.ts register --email your@email.com`)
+                  } else {
+                    console.log(`   Check your email (${deviceEmail}) and click the approval link.`)
+                  }
+                } else {
+                  console.log(`⚠️  Device approval required: ${message || 'Please approve device'}`)
+                }
+              }
+            } else if (error) {
+              console.error(`✗ Registration error: ${error}`)
+            }
+          })
+        }
+        
+        registerDevice()
+        
+        // Update lastSeen every 30 seconds while connected
+        const heartbeatInterval = setInterval(() => {
+          if (socket?.connected) {
+            registerDevice()
+          } else {
+            clearInterval(heartbeatInterval)
+          }
+        }, 30000)
+        
+        // Store interval ID for cleanup
+        ;(socket as any).heartbeatInterval = heartbeatInterval
+      })
+
+      // Cloudflared handlers
+      socket.on('cloudflared:check:request', async () => {
+        try {
+          let installed = false
+          let hasCert = false
+
+          try {
+            // Check if cloudflared is installed
+            execSync('which cloudflared', { stdio: 'ignore' })
+            installed = true
+
+            // Check if cert.pem exists
+            const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem')
+            try {
+              // Use fs.stat to check if file exists (more reliable than access)
+              const stats = await fs.stat(certPath)
+              hasCert = stats.isFile()
+              if (foreground && hasCert) {
+                console.log(`✓ Found cert.pem at ${certPath}`)
+              }
+            } catch (err: any) {
+              // File doesn't exist or can't be accessed
+              hasCert = false
+              if (foreground) {
+                console.log(`✗ cert.pem not found at ${certPath}: ${err.message}`)
+              }
+            }
+          } catch {
+            installed = false
+          }
+
+          socket!.emit('cloudflared:check:response', { installed, hasCert })
+          if (foreground) {
+            console.log(`Cloudflared check: installed=${installed}, hasCert=${hasCert}`)
+          }
+        } catch (error: any) {
+          socket!.emit('cloudflared:check:response', { installed: false, hasCert: false })
+        }
+      })
+
+      socket.on('cloudflared:sync:request', async () => {
+        try {
+          const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem')
+          
+          if (foreground) {
+            console.log(`Syncing credentials from ${certPath}`)
+          }
+          
+          // Read cert.pem file
+          const certContent = await fs.readFile(certPath, 'utf-8')
+          
+          // Extract token between BEGIN and END markers
+          const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/)
+          if (tokenMatch && tokenMatch[1]) {
+            // Decode base64 token
+            const tokenBase64 = tokenMatch[1].replace(/\s/g, '')
+            const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8')
+            const tokenData = JSON.parse(tokenJson)
+            
+            // Extract API token, account ID, and zone ID
+            const apiToken = tokenData.apiToken
+            const accountId = tokenData.accountID
+            const zoneId = tokenData.zoneID
+            
+            if (foreground) {
+              console.log(`✓ Extracted credentials: accountId=${accountId}, zoneId=${zoneId}`)
+            }
+            
+            socket!.emit('cloudflared:sync:complete', {
+              accountId,
+              accountName: undefined,
+              apiToken,
+              zoneId
+            })
+          } else {
+            const error = 'Failed to extract token from cert.pem'
+            if (foreground) {
+              console.error(`✗ ${error}`)
+            }
+            socket!.emit('cloudflared:sync:error', { error })
+          }
+        } catch (error: any) {
+          const errorMsg = `Failed to read cert.pem: ${error.message}`
+          if (foreground) {
+            console.error(`✗ ${errorMsg}`)
+          }
+          socket!.emit('cloudflared:sync:error', { error: errorMsg })
+        }
+      })
+
+      socket.on('cloudflared:login:request', async () => {
+        try {
+          
+          // Run cloudflared tunnel login
+          const loginProcess = spawn('cloudflared', ['tunnel', 'login'], {
+            stdio: ['ignore', 'pipe', 'pipe']
+          })
+
+          let stdout = ''
+          let stderr = ''
+          let urlEmitted = false
+          let alreadyLoggedIn = false
+          let certPath: string | null = null
+
+          const extractCertPath = (text: string): string | null => {
+            // Look for: "You have an existing certificate at /path/to/cert.pem"
+            const pathMatch = text.match(/existing certificate at\s+([^\s]+)/i) ||
+                            text.match(/certificate at\s+([^\s]+)/i) ||
+                            text.match(/cert\.pem.*?at\s+([^\s]+)/i)
+            return pathMatch ? pathMatch[1] : null
+          }
+
+          const extractLoginUrl = (text: string): string | null => {
+            // Look for URLs in the output
+            const urlPatterns = [
+              /https:\/\/dash\.cloudflare\.com\/argotunnel[^\s\)]+/g,
+              /https:\/\/[^\s\)]+cloudflareaccess\.org[^\s\)]+/g,
+              /https:\/\/[^\s\)]+cloudflare\.com[^\s\)]+/g
+            ]
+            
+            for (const pattern of urlPatterns) {
+              const matches = text.match(pattern)
+              if (matches && matches.length > 0) {
+                return matches[0]
+              }
+            }
+            return null
+          }
+
+          loginProcess.stdout.on('data', (data) => {
+            const text = data.toString()
+            stdout += text
+            
+            // Check for already logged in error
+            if (text.includes('existing certificate') || text.includes('cert.pem which login would overwrite')) {
+              alreadyLoggedIn = true
+              const extractedPath = extractCertPath(text)
+              if (extractedPath) {
+                certPath = extractedPath
+              }
+            }
+            
+            // Extract login URL if not already logged in
+            if (!alreadyLoggedIn && !urlEmitted) {
+              const url = extractLoginUrl(text)
+              if (url) {
+                urlEmitted = true
+                socket!.emit('cloudflared:login:url', { loginUrl: url })
+              }
+            }
+          })
+
+          loginProcess.stderr.on('data', (data) => {
+            const text = data.toString()
+            stderr += text
+            
+            // Check for already logged in error (often in stderr)
+            if (text.includes('existing certificate') || text.includes('cert.pem which login would overwrite')) {
+              alreadyLoggedIn = true
+              const extractedPath = extractCertPath(text)
+              if (extractedPath) {
+                certPath = extractedPath
+              }
+            }
+            
+            // Extract login URL if not already logged in
+            if (!alreadyLoggedIn && !urlEmitted) {
+              const url = extractLoginUrl(text)
+              if (url) {
+                urlEmitted = true
+                socket!.emit('cloudflared:login:url', { loginUrl: url })
+              }
+            }
+          })
+
+          loginProcess.on('close', async (code) => {
+            if (alreadyLoggedIn && certPath) {
+              // Already logged in - extract credentials from existing cert
+              try {
+                if (foreground) {
+                  console.log(`Already logged in, extracting credentials from ${certPath}`)
+                }
+                const certContent = await fs.readFile(certPath, 'utf-8')
+                const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/)
+                if (tokenMatch && tokenMatch[1]) {
+                  const tokenBase64 = tokenMatch[1].replace(/\s/g, '')
+                  const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8')
+                  const tokenData = JSON.parse(tokenJson)
+                  
+                  if (foreground) {
+                    console.log(`✓ Extracted credentials from existing cert`)
+                  }
+                  
+                  socket!.emit('cloudflared:login:complete', {
+                    accountId: tokenData.accountID,
+                    accountName: undefined,
+                    apiToken: tokenData.apiToken,
+                    zoneId: tokenData.zoneID
+                  })
+                } else {
+                  const error = 'Failed to extract token from existing cert.pem'
+                  if (foreground) {
+                    console.error(`✗ ${error}`)
+                  }
+                  socket!.emit('cloudflared:login:error', { error })
+                }
+              } catch (error: any) {
+                const errorMsg = `Failed to read cert.pem: ${error.message}`
+                if (foreground) {
+                  console.error(`✗ ${errorMsg}`)
+                }
+                socket!.emit('cloudflared:login:error', { error: errorMsg })
+              }
+            } else if (code === 0 && !alreadyLoggedIn) {
+              // Login completed successfully - wait a moment then extract credentials
+              if (foreground) {
+                console.log('Login completed, extracting credentials...')
+              }
+              setTimeout(async () => {
+                try {
+                  const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem')
+                  const certContent = await fs.readFile(certPath, 'utf-8')
+                  const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/)
+                  if (tokenMatch && tokenMatch[1]) {
+                    const tokenBase64 = tokenMatch[1].replace(/\s/g, '')
+                    const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8')
+                    const tokenData = JSON.parse(tokenJson)
+                    
+                    if (foreground) {
+                      console.log(`✓ Extracted credentials after login`)
+                    }
+                    
+                    socket!.emit('cloudflared:login:complete', {
+                      accountId: tokenData.accountID,
+                      accountName: undefined,
+                      apiToken: tokenData.apiToken,
+                      zoneId: tokenData.zoneID
+                    })
+                  } else {
+                    const error = 'Failed to extract token from cert.pem after login'
+                    if (foreground) {
+                      console.error(`✗ ${error}`)
+                    }
+                    socket!.emit('cloudflared:login:error', { error })
+                  }
+                } catch (error: any) {
+                  const errorMsg = `Failed to read cert.pem after login: ${error.message}`
+                  if (foreground) {
+                    console.error(`✗ ${errorMsg}`)
+                  }
+                  socket!.emit('cloudflared:login:error', { error: errorMsg })
+                }
+              }, 1000) // Wait 1 second for file to be written
+            } else if (!alreadyLoggedIn) {
+              const error = `Login failed with code ${code}: ${stderr || stdout}`
+              if (foreground) {
+                console.error(`✗ ${error}`)
+              }
+              socket!.emit('cloudflared:login:error', { error })
+            }
+          })
+
+          loginProcess.on('error', (error) => {
+            socket!.emit('cloudflared:login:error', { error: error.message })
+          })
+        } catch (error: any) {
+          socket!.emit('cloudflared:login:error', { error: error.message })
+        }
+      })
+
+      socket.on('cloudflared:regenerate:request', async () => {
+        try {
+          const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem')
+          
+          // Delete existing cert.pem
+          try {
+            await fs.unlink(certPath)
+            if (foreground) {
+              console.log(`✓ Deleted existing cert.pem`)
+            }
+          } catch (error: any) {
+            // File might not exist, that's okay
+            if (foreground && error.code !== 'ENOENT') {
+              console.log(`Note: Could not delete cert.pem: ${error.message}`)
+            }
+          }
+          
+          // Emit success - frontend will then trigger login
+          socket!.emit('cloudflared:regenerate:complete', {})
+        } catch (error: any) {
+          socket!.emit('cloudflared:regenerate:error', { error: error.message })
+        }
+      })
+
+      socket.on('cloudflared:login:request', async () => {
+        try {
+          
+          // First check if cloudflared is installed
+          try {
+            execSync('which cloudflared', { stdio: 'ignore' })
+          } catch {
+            socket!.emit('cloudflared:login:error', { error: 'cloudflared is not installed' })
+            return
+          }
+
+          // Run cloudflared tunnel login
+          // This command outputs a URL that needs to be visited
+          const loginProcess = spawn('cloudflared', ['tunnel', 'login'], {
+            stdio: ['ignore', 'pipe', 'pipe']
+          })
+
+          let stdout = ''
+          let stderr = ''
+          let urlEmitted = false
+
+          const findAndEmitUrl = (text: string) => {
+            if (urlEmitted) return
+            
+            // Look for URL in output - cloudflared outputs URLs in various formats
+            const urlPatterns = [
+              /https:\/\/[^\s\)]+/g,
+              /https:\/\/[^\n]+/g
+            ]
+            
+            for (const pattern of urlPatterns) {
+              const matches = text.match(pattern)
+              if (matches && matches.length > 0) {
+                // Find the login URL (usually contains "cloudflareaccess.com" or similar)
+                const loginUrl = matches.find(url => 
+                  url.includes('cloudflareaccess.com') || 
+                  url.includes('cloudflare.com') ||
+                  url.includes('trycloudflare.com') ||
+                  url.includes('dash.cloudflare.com')
+                )
+                if (loginUrl) {
+                  urlEmitted = true
+                  socket!.emit('cloudflared:login:url', { loginUrl: loginUrl.trim() })
+                  return
+                }
+              }
+            }
+          }
+
+          loginProcess.stdout.on('data', (data) => {
+            const text = data.toString()
+            stdout += text
+            findAndEmitUrl(text)
+          })
+
+          loginProcess.stderr.on('data', (data) => {
+            const text = data.toString()
+            stderr += text
+            // cloudflared often outputs URLs to stderr
+            findAndEmitUrl(text)
+          })
+
+          loginProcess.on('close', async (code) => {
+            if (code === 0) {
+              // Login successful, extract API token from cert.pem
+              try {
+                const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem')
+                const certContent = await fs.readFile(certPath, 'utf-8')
+                
+                // Extract token between BEGIN and END markers
+                const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/)
+                if (tokenMatch && tokenMatch[1]) {
+                  // Decode base64 token
+                  const tokenBase64 = tokenMatch[1].replace(/\s/g, '')
+                  const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8')
+                  const tokenData = JSON.parse(tokenJson)
+                  
+                  // Extract API token, account ID, and zone ID
+                  const apiToken = tokenData.apiToken
+                  const accountId = tokenData.accountID
+                  const zoneId = tokenData.zoneID
+                  
+                  socket!.emit('cloudflared:login:complete', {
+                    accountId,
+                    accountName: undefined,
+                    apiToken,
+                    zoneId
+                  })
+                } else {
+                  socket!.emit('cloudflared:login:error', { 
+                    error: 'Failed to extract token from cert.pem' 
+                  })
+                }
+              } catch (error: any) {
+                socket!.emit('cloudflared:login:error', { 
+                  error: `Failed to read cert.pem: ${error.message}` 
+                })
+              }
+            } else {
+              socket!.emit('cloudflared:login:error', { 
+                error: `Login failed with code ${code}: ${stderr}` 
+              })
+            }
+          })
+
+          loginProcess.on('error', (error) => {
+            socket!.emit('cloudflared:login:error', { error: error.message })
+          })
+        } catch (error: any) {
+          socket!.emit('cloudflared:login:error', { error: error.message })
+        }
+      })
+
+      // ========== Container Management Handlers ==========
+
+      // Check if container runtime is available
+      socket.on('container:check:request', async () => {
+        try {
+          let enabled = false
+          let runtime: 'docker' | 'podman' | undefined
+          let version = ''
+
+          try {
+            // Check for docker first
+            execSync('which docker', { stdio: 'ignore' })
+            runtime = 'docker'
+            version = execSync('docker --version', { encoding: 'utf-8' }).trim()
+            enabled = true
+          } catch {
+            try {
+              // Check for podman as fallback
+              execSync('which podman', { stdio: 'ignore' })
+              runtime = 'podman'
+              version = execSync('podman --version', { encoding: 'utf-8' }).trim()
+              enabled = true
+            } catch {
+              enabled = false
+            }
+          }
+
+          socket!.emit('container:check:response', { enabled, runtime, version })
+          if (foreground) {
+            console.log(`Container runtime check: ${enabled ? `${runtime} (${version})` : 'Not found'}`)
+          }
+        } catch (error: any) {
+          socket!.emit('container:check:response', { enabled: false, runtime: undefined, version: '' })
+        }
+      })
+
+      // List all containers
+      socket.on('container:list:request', async () => {
+        try {
+          const runtime = getContainerRuntime()
+          if (!runtime) {
+            socket!.emit('container:list:response', { success: false, error: 'No container runtime found' })
+            return
+          }
+
+          // List all containers including stopped ones
+          const output = execSync(
+            `${runtime} ps -a --format "{{json .}}"`,
+            { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 }
+          )
+
+          const containers = output.trim().split('\n').filter(Boolean).map(line => {
+            try {
+              const c = JSON.parse(line)
+              // Parse ports from the PORTS column (format: "0.0.0.0:8080->80/tcp, 0.0.0.0:9090->9090/tcp")
+              const ports: Array<{ host: number; container: number }> = []
+              if (c.Ports) {
+                const portMatches = c.Ports.match(/(\d+)->(\d+)/g)
+                if (portMatches) {
+                  portMatches.forEach((p: string) => {
+                    const [host, container] = p.split('->').map(Number)
+                    ports.push({ host, container })
+                  })
+                }
+              }
+              return {
+                containerId: c.ID,
+                name: c.Names.replace(/^\//, ''), // Remove leading slash
+                image: c.Image,
+                status: c.State === 'running' ? 'running' : c.State === 'paused' ? 'paused' : c.Status === 'exited' ? 'exited' : 'stopped',
+                ports,
+                createdAt: new Date(c.CreatedAt).toISOString()
+              }
+            } catch {
+              return null
+            }
+          }).filter(Boolean)
+
+          socket!.emit('container:list:response', { success: true, containers })
+        } catch (error: any) {
+          socket!.emit('container:list:response', { success: false, error: error.message })
+        }
+      })
+
+      // Start a new container
+      socket.on('container:start:request', async (data: {
+        name: string
+        image: string
+        ports?: Array<{ host: number; container: number }>
+        env?: Record<string, string>
+        runAsRoot?: boolean  // Allow running as root inside container (safe, still isolated)
+      }) => {
+        try {
+          const runtime = getContainerRuntime()
+          if (!runtime) {
+            socket!.emit('container:start:response', { success: false, error: 'No container runtime found' })
+            return
+          }
+
+          const { name, image, ports = [], env = {}, runAsRoot = false } = data
+
+          // Get CLI directory path (where this script is running from)
+          // Use the same pattern as elsewhere in the file
+          const cliDir = path.dirname(CURRENT_FILE)
+
+          // Build docker run command
+          let cmd = `${runtime} run -d --name ${name}`
+
+          // Security: Running as root INSIDE container is safe - it's still isolated from host
+          // Root inside container cannot access host filesystem (read-only mounts)
+          // Default to root to allow package installation and full container functionality
+          // Set runAsRoot: false to run as non-root user (UID 1000) if needed
+          if (!runAsRoot) {
+            cmd += ' --user 1000:1000'
+          }
+
+          // Resource limits
+          cmd += ' --memory=8g'       // Limit memory to 8GB
+
+          // Auto-remove on exit (optional - commented out for persistence)
+          // cmd += ' --rm'
+
+          // Mount CLI directory into container
+          cmd += ` -v "${cliDir}:/opt/ttc:ro"`
+
+          // Mount entrypoint script
+          const entrypointScript = path.join(cliDir, 'container-entrypoint.sh')
+          cmd += ` -v "${entrypointScript}:/entrypoint.sh:ro"`
+
+          // Port mappings
+          ports.forEach(p => {
+            cmd += ` -p ${p.host}:${p.container}`
+          })
+
+          // Environment variables
+          Object.entries(env).forEach(([k, v]) => {
+            // Escape quotes in env values
+            const escapedValue = String(v).replace(/"/g, '\\"')
+            cmd += ` -e ${k}="${escapedValue}"`
+          })
+
+          // Add container-specific environment variables
+          cmd += ` -e CONTAINER_NAME="${name}"`
+          cmd += ` -e HOSTNAME="${name}"`
+
+          // Use entrypoint script
+          cmd += ` --entrypoint /bin/sh ${image} /entrypoint.sh`
+
+          if (foreground) {
+            console.log(`Starting container: ${cmd}`)
+          }
+
+          // Pull image if not exists, then run
+          try {
+            execSync(`${runtime} pull ${image}`, { stdio: 'ignore' })
+          } catch {
+            // Pull failed, but might already exist locally
+          }
+
+          const output = execSync(cmd, { encoding: 'utf-8', stdio: 'pipe' })
+          const containerId = output.trim()
+
+          socket!.emit('container:start:response', { success: true, containerId })
+
+          if (foreground) {
+            console.log(`✓ Container started: ${containerId}`)
+          }
+        } catch (error: any) {
+          socket!.emit('container:start:response', { success: false, error: error.message })
+        }
+      })
+
+      // Stop a container
+      socket.on('container:stop:request', async (data: { containerId: string }) => {
+        try {
+          const runtime = getContainerRuntime()
+          if (!runtime) {
+            socket!.emit('container:stop:response', { success: false, error: 'No container runtime found' })
+            return
+          }
+
+          const { containerId } = data
+
+          execSync(`${runtime} stop ${containerId}`, { stdio: 'ignore' })
+
+          socket!.emit('container:stop:response', { success: true })
+
+          if (foreground) {
+            console.log(`✓ Container stopped: ${containerId}`)
+          }
+        } catch (error: any) {
+          socket!.emit('container:stop:response', { success: false, error: error.message })
+        }
+      })
+
+      // Remove a container
+      socket.on('container:remove:request', async (data: { containerId: string }) => {
+        try {
+          const runtime = getContainerRuntime()
+          if (!runtime) {
+            socket!.emit('container:remove:response', { success: false, error: 'No container runtime found' })
+            return
+          }
+
+          const { containerId } = data
+
+          // Force remove even if running
+          execSync(`${runtime} rm -f ${containerId}`, { stdio: 'ignore' })
+
+          socket!.emit('container:remove:response', { success: true })
+
+          if (foreground) {
+            console.log(`✓ Container removed: ${containerId}`)
+          }
+        } catch (error: any) {
+          socket!.emit('container:remove:response', { success: false, error: error.message })
+        }
+      })
+
+      // Get container logs
+      socket.on('container:logs:request', async (data: { containerId: string; lines?: number }) => {
+        try {
+          const runtime = getContainerRuntime()
+          if (!runtime) {
+            socket!.emit('container:logs:response', { success: false, error: 'No container runtime found' })
+            return
+          }
+
+          const { containerId, lines = 100 } = data
+
+          const logs = execSync(
+            `${runtime} logs --tail ${lines} ${containerId}`,
+            { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 }
+          )
+
+          socket!.emit('container:logs:response', { success: true, logs })
+        } catch (error: any) {
+          socket!.emit('container:logs:response', { success: false, error: error.message })
+        }
+      })
+
+      // Helper function to get available container runtime
+      function getContainerRuntime(): 'docker' | 'podman' | null {
+        try {
+          execSync('which docker', { stdio: 'ignore' })
+          return 'docker'
+        } catch {
+          try {
+            execSync('which podman', { stdio: 'ignore' })
+            return 'podman'
+          } catch {
+            return null
+          }
+        }
+      }
+
+      socket.on('disconnect', (reason) => {
+        if (foreground) {
+          console.log(`\n⚠️  Disconnected: ${reason}`)
+          console.log('   Attempting to reconnect...')
+        } else {
+          console.log(`Disconnected: ${reason}`)
+        }
+        
+        // Clear heartbeat interval
+        if ((socket as any).heartbeatInterval) {
+          clearInterval((socket as any).heartbeatInterval)
+        }
+        
+        if (reason === 'io server disconnect') {
+          // Server disconnected, reconnect manually
+          socket!.connect()
+        } else {
+          // Client disconnect or transport close: schedule full reconnect so process stays alive
+          if (reconnectTimeout) clearTimeout(reconnectTimeout)
+          const delay = 2000
+          if (!foreground) console.log(`Reconnecting in ${delay}ms...`)
+          reconnectTimeout = setTimeout(connectAndRegister, delay)
+        }
+      })
+
+      socket.on('connect_error', (err: Error & { type?: string; description?: string; cause?: any }) => {
+        reconnectAttempts++
+        if (foreground) {
+          console.error(`✗ Connection error (attempt ${reconnectAttempts}): ${err.message}`)
+          if (err.type) {
+            console.error(`   Error type: ${err.type}`)
+          }
+          if (err.description) {
+            console.error(`   Error description: ${err.description}`)
+          }
+          console.error(`   Connecting to: ${config.apiUrl}`)
+          if (err.cause) {
+            console.error(`   Cause:`, err.cause)
+          }
+        } else {
+          console.error(`Connection error (attempt ${reconnectAttempts}):`, err.message)
+        }
+      })
+
+      // Keep process alive
+      socket.on('error', (err) => {
+        if (foreground) {
+          console.error(`✗ Socket error: ${err}`)
+        } else {
+          console.error('Socket error:', err)
+        }
+      })
+
+    } catch (error) {
+      if (foreground) {
+        console.error(`✗ Failed to connect: ${(error as Error).message}`)
+      } else {
+        console.error('Failed to connect:', (error as Error).message)
+      }
+      reconnectAttempts++
+      
+      if (reconnectAttempts < MAX_RECONNECT_ATTEMPTS) {
+        const delay = Math.min(1000 * Math.pow(2, reconnectAttempts), 30000)
+        if (foreground) {
+          console.log(`⏳ Reconnecting in ${delay}ms...`)
+        } else {
+          console.log(`Reconnecting in ${delay}ms...`)
+        }
+        reconnectTimeout = setTimeout(connectAndRegister, delay)
+      }
+    }
+  }
+
+  // Handle graceful shutdown
+  const shutdown = () => {
+    if (foreground) {
+      console.log('\n\n🛑 Shutting down gracefully...')
+    } else {
+      console.log('\nShutting down...')
+    }
+    if (reconnectTimeout) {
+      clearTimeout(reconnectTimeout)
+    }
+    if (socket) {
+      // Clear heartbeat interval
+      if ((socket as any).heartbeatInterval) {
+        clearInterval((socket as any).heartbeatInterval)
+      }
+      socket.disconnect()
+    }
+    process.exit(0)
+  }
+
+  process.on('SIGTERM', shutdown)
+  process.on('SIGINT', shutdown)
+  process.on('SIGHUP', shutdown)
+
+  // Start connection
+  await connectAndRegister()
+
+  // Keep process alive
+  process.stdin.resume()
+}
+
+// ============ CLI Program ============
+
+const program = new Command()
+
+program
+  .name('ttc')
+  .description('TalkToCode CLI - Simple install and manage')
+  .version('1.0.0')
+
+// Config command
+program
+  .command('config')
+  .description('Get or set config (api-url)')
+  .option('--api-url <url>', 'API base URL')
+  .action(async (opts: { apiUrl?: string }) => {
+    const config = await readConfig()
+    if (opts.apiUrl !== undefined) {
+      config.apiUrl = opts.apiUrl
+      await writeConfig(config)
+      console.log('Set api-url:', config.apiUrl)
+    } else {
+      console.log('Config:', JSON.stringify(config, null, 2))
+    }
+    process.exit(0)
+  })
+
+// Install command
+program
+  .command('install')
+  .description('Install and register TTC CLI (installs as pm2 daemon)')
+  .argument('[email]', 'Email address for device approval')
+  .action(async (email: string | undefined) => {
+    try {
+      // First register the device
+      await registerDevice(undefined, email)
+
+      // After successful registration, install as service (Linux only)
+      if (process.platform === 'win32') {
+        console.log('\n✓ Device registered.')
+        console.log('On Windows, run the daemon manually: ttc daemon')
+        console.log('To run in background: start /B node path\\to\\ttc daemon')
+      } else {
+        console.log('\n📦 Installing TTC with pm2...')
+        // install-service.sh: bundled at __dirname, or in ~/.talk-to-code for curl install
+        let installScript = path.join(__dirname, 'install-service.sh')
+        if (!fsSync.existsSync(installScript)) {
+          installScript = path.join(CONFIG_DIR, 'install-service.sh')
+        }
+        if (!fsSync.existsSync(installScript)) {
+          installScript = path.join(__dirname, '..', 'install-service.sh')
+        }
+        const scriptDir = path.dirname(installScript)
+        try {
+          await fs.access(installScript)
+          const { execSync } = await import('child_process')
+          execSync(`bash "${installScript}"`, {
+            stdio: 'inherit',
+            cwd: scriptDir,
+            env: { ...process.env, PATH: process.env.PATH }
+          })
+          console.log('\n✓ TTC installation complete!')
+          console.log('The service is now running in the background.')
+        } catch (scriptErr: unknown) {
+          const err = scriptErr as Error
+          console.log('\n⚠ Service installation had issues, but device is registered.')
+          if (err.message) console.error('Error:', err.message)
+          console.log('You can start the daemon manually with: ttc daemon')
+        }
+      }
+    } catch (error) {
+      const errorMsg = (error as Error).message
+      if (errorMsg.includes('approval') || errorMsg.includes('email')) {
+        // Registration failed - exit with error
+        process.exit(1)
+      }
+      // Service installation failed, but device is registered
+      console.log('\n⚠ Service installation had issues, but device is registered.')
+      console.log('You can start the daemon manually with: ttc daemon')
+    }
+
+    // Exit after install is complete
+    process.exit(0)
+  })
+
+// Uninstall command
+program
+  .command('uninstall')
+  .description('Uninstall TTC CLI (removes service and config)')
+  .action(async () => {
+    console.log('🗑️  Uninstalling TTC CLI...')
+
+    if (process.platform === 'win32') {
+      console.log('On Windows there is no service to remove.')
+      console.log('To remove TTC completely:')
+      console.log('  1. Delete the ttc executable or folder')
+      console.log('  2. Remove config: rmdir /s /q "%USERPROFILE%\\.talk-to-code"')
+    } else {
+      let installScript = path.join(__dirname, 'install-service.sh')
+      if (!fsSync.existsSync(installScript)) installScript = path.join(CONFIG_DIR, 'install-service.sh')
+      if (!fsSync.existsSync(installScript)) installScript = path.join(__dirname, '..', 'install-service.sh')
+      const scriptDir = path.dirname(installScript)
+      try {
+        await fs.access(installScript)
+        const { execSync } = await import('child_process')
+        execSync(`bash "${installScript}" --uninstall`, {
+          stdio: 'inherit',
+          cwd: scriptDir,
+          env: { ...process.env, PATH: process.env.PATH }
+        })
+        console.log('\n✓ Service uninstalled!')
+        console.log('To remove TTC completely, delete the binary:')
+        console.log('  rm ~/.local/bin/ttc')
+      } catch (error) {
+        console.log('\n⚠ Service uninstall script not found or failed.')
+        console.log('To remove TTC completely, delete:')
+        console.log('  rm ~/.local/bin/ttc')
+        console.log('  rm -rf ~/.talk-to-code')
+      }
+    }
+
+    // Exit after uninstall is complete
+    process.exit(0)
+  })
+
+// Update command
+program
+  .command('update')
+  .description('Check for and apply CLI updates')
+  .option('-f, --force', 'Update without confirmation')
+  .action(async (options: { force?: boolean }) => {
+    await selfUpdate(options.force)
+    process.exit(0)
+  })
+
+program
+  .command('check-update')
+  .description('Check for updates')
+  .action(async () => {
+    const info = await checkForUpdate()
+    if (!info) process.exit(1)
+    if (!info.updateAvailable) {
+      console.log('✓ Up to date')
+      process.exit(0)
+    }
+    console.log('📦 Update available')
+    console.log('Run "ttc update" to install')
+    process.exit(0)
+  })
+
+// Run (connect to backend and process prompts)
+program
+  .command('run')
+  .description('Run CLI and connect to backend')
+  .option('--email <email>', 'Email for device approval')
+  .action((options: { email?: string }) => {
+    runDaemon(false, options.email).catch((error) => {
+      console.error('Run error:', (error as Error).message)
+      process.exit(1)
+    })
+  })
+
+// Hidden daemon command (internal alias)
+program
+  .command('daemon', { hidden: true })
+  .description('Run daemon (internal)')
+  .option('--foreground', 'Run in foreground', false)
+  .option('--email <email>', 'Email address')
+  .action((options: { foreground?: boolean; email?: string }) => {
+    runDaemon(options.foreground, options.email).catch((error) => {
+      console.error('Daemon error:', (error as Error).message)
+      process.exit(1)
+    })
+  })
+
+program.parse()