@exreve/exk 1.0.26 → 1.0.28

package/dist/app-child.js

@@ -0,0 +1,2590 @@
+#!/usr/bin/env node
+/**
+ * TalkToCode CLI - Child Process (App Bundle)
+ *
+ * This is the child process that contains all application logic.
+ * It is spawned by the updater process (updater.ts).
+ *
+ * This file is what gets updated during updates - the updater stays constant.
+ */
+import { Command } from 'commander';
+import { io } from 'socket.io-client';
+import { v4 as uuidv4 } from 'uuid';
+import fs from 'fs/promises';
+import fsSync from 'fs';
+import path from 'path';
+import os, { networkInterfaces } from 'os';
+import { Buffer } from 'buffer';
+import crypto from 'crypto';
+import { createProject, deleteProject } from './projectManager.js';
+import { agentSessionManager } from './agentSession.js';
+import { getProjectConfig, analyzeProjectWithClaude, saveProjectConfig } from './projectAnalyzer.js';
+import { generateRunnerCode } from './runnerGenerator.js';
+import { startApp, stopApp, restartApp, getAppStatuses, getAppLogs } from './appManager.js';
+import { spawn, execSync } from 'child_process';
+import readline from 'readline';
+import { fileURLToPath } from 'url';
+import { createHash } from 'crypto';
+// ============ Update IPC (Child -> Updater) ============
+/**
+ * Request update from parent updater process
+ */
+function requestUpdateFromParent() {
+    const updaterPid = process.env.TTC_UPDATER_PID;
+    if (updaterPid) {
+        try {
+            // Send SIGUSR1 to parent to request update
+            process.kill(parseInt(updaterPid, 10), 'SIGUSR1');
+        }
+        catch (error) {
+            console.error('Failed to request update from parent:', error);
+        }
+    }
+}
+/**
+ * Notify parent that we want to restart after update
+ */
+function requestRestartFromParent() {
+    const updaterPid = process.env.TTC_UPDATER_PID;
+    if (updaterPid) {
+        try {
+            // Send SIGUSR2 to parent to request restart
+            process.kill(parseInt(updaterPid, 10), 'SIGUSR2');
+        }
+        catch (error) {
+            console.error('Failed to request restart from parent:', error);
+        }
+    }
+}
+// ============ Constants ============
+const CONFIG_DIR = path.join(os.homedir(), '.talk-to-code');
+const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
+const DEVICE_ID_FILE = path.join(CONFIG_DIR, 'device-id.json');
+const DEVICE_CONFIG_FILE = path.join(CONFIG_DIR, 'device-config.json');
+const AI_CONFIG_FILE = path.join(CONFIG_DIR, 'ai-config.json');
+const DEFAULT_API_URL = 'https://api.talk-to-code.com';
+// ============ Helpers ============
+async function readConfig() {
+    try {
+        const data = await fs.readFile(CONFIG_FILE, 'utf-8');
+        return JSON.parse(data);
+    }
+    catch {
+        return { apiUrl: DEFAULT_API_URL };
+    }
+}
+async function writeConfig(config) {
+    await fs.mkdir(CONFIG_DIR, { recursive: true });
+    await fs.writeFile(CONFIG_FILE, JSON.stringify(config, null, 2));
+}
+/**
+ * Fetch AI config from server and save to ~/.talk-to-code/ai-config.json
+ */
+async function fetchAiConfig(authToken) {
+    try {
+        const config = await readConfig();
+        const res = await fetch(`${config.apiUrl}/config/ai`, {
+            headers: { Authorization: `Bearer ${authToken}` },
+        });
+        if (!res.ok) {
+            console.log(`[fetchAiConfig] Server returned ${res.status}`);
+            return false;
+        }
+        const data = await res.json();
+        if (!data.success || !data.aiConfig) {
+            console.log('[fetchAiConfig] No AI config available for this user');
+            return false;
+        }
+        await fs.writeFile(AI_CONFIG_FILE, JSON.stringify(data.aiConfig, null, 2));
+        console.log('[fetchAiConfig] AI config saved successfully');
+        return true;
+    }
+    catch (error) {
+        console.log(`[fetchAiConfig] Failed: ${error.message}`);
+        return false;
+    }
+}
+function hasAiCredentials() {
+    try {
+        const raw = fsSync.readFileSync(AI_CONFIG_FILE, 'utf-8');
+        const j = JSON.parse(raw);
+        return typeof j.authToken === 'string' && j.authToken.trim().length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+async function readDeviceAuthToken() {
+    const env = process.env.TTC_AUTH_TOKEN?.trim();
+    if (env)
+        return env;
+    try {
+        const raw = await fs.readFile(DEVICE_CONFIG_FILE, 'utf-8');
+        const j = JSON.parse(raw);
+        return typeof j.authToken === 'string' ? j.authToken.trim() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function readDiskDeviceConfig() {
+    try {
+        const raw = await fs.readFile(DEVICE_CONFIG_FILE, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return {};
+    }
+}
+async function writeDeviceConfigMerged(partial) {
+    const prev = await readDiskDeviceConfig();
+    const email = partial.email !== undefined ? partial.email : prev.email;
+    let token;
+    if (partial.authToken !== undefined) {
+        token = partial.authToken.trim() || undefined;
+    }
+    else {
+        token = typeof prev.authToken === 'string' && prev.authToken.trim() ? prev.authToken.trim() : undefined;
+    }
+    const out = {};
+    if (email)
+        out.email = email;
+    if (token)
+        out.authToken = token;
+    await fs.mkdir(CONFIG_DIR, { recursive: true });
+    await fs.writeFile(DEVICE_CONFIG_FILE, JSON.stringify(out, null, 2));
+}
+async function maybeFetchAiConfigIfMissing() {
+    if (hasAiCredentials())
+        return;
+    const jwt = await readDeviceAuthToken();
+    if (!jwt)
+        return;
+    const ok = await fetchAiConfig(jwt);
+    if (!ok && !hasAiCredentials()) {
+        const cfg = await readConfig();
+        console.warn(`[CLI] No AI key in ai-config.json yet. Could not sync from ${cfg.apiUrl}/config/ai — agent prompts will fail until this succeeds.`);
+    }
+}
+function scheduleAiConfigSync(authToken) {
+    void fetchAiConfig(authToken).then((ok) => {
+        if (!ok && !hasAiCredentials()) {
+            console.warn('[CLI] AI config sync failed; check backend /config/ai and apiUrl.');
+        }
+    });
+}
+async function getDeviceId() {
+    try {
+        const data = await fs.readFile(DEVICE_ID_FILE, 'utf-8');
+        return JSON.parse(data).deviceId;
+    }
+    catch {
+        const deviceId = uuidv4();
+        await fs.mkdir(CONFIG_DIR, { recursive: true });
+        await fs.writeFile(DEVICE_ID_FILE, JSON.stringify({ deviceId }, null, 2));
+        return deviceId;
+    }
+}
+function getLocalIpAddress() {
+    const nets = networkInterfaces();
+    for (const name of Object.keys(nets)) {
+        for (const net of nets[name]) {
+            if (net.family === 'IPv4' && !net.internal) {
+                return net.address;
+            }
+        }
+    }
+    return 'Unknown';
+}
+function getHostname() {
+    return os.hostname() || 'Unknown';
+}
+async function connect() {
+    const config = await readConfig();
+    const deviceId = await getDeviceId();
+    return new Promise((resolve, reject) => {
+        const socket = io(config.apiUrl, {
+            transports: ['websocket', 'polling'],
+        });
+        socket.on('connect', () => {
+            socket.emit('register', { type: 'cli', deviceId });
+            resolve(socket);
+        });
+        socket.on('registered', ({ type }) => {
+            console.log(`Connected as ${type}`);
+        });
+        socket.on('connect_error', (err) => {
+            reject(err);
+        });
+    });
+}
+const CURRENT_FILE = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(CURRENT_FILE);
+function getCliHash() {
+    return createHash('sha256').update(fsSync.readFileSync(CURRENT_FILE)).digest('hex');
+}
+async function checkForUpdate() {
+    try {
+        const config = await readConfig();
+        const res = await fetch(`${config.apiUrl}/update/check`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ hash: getCliHash(), platform: os.platform() })
+        });
+        if (!res.ok)
+            return null;
+        return await res.json();
+    }
+    catch {
+        return null;
+    }
+}
+async function replaceSelf(tarballBuffer) {
+    const extractDir = path.join(os.tmpdir(), `ttc-update-${Date.now()}`);
+    await fs.mkdir(extractDir, { recursive: true });
+    const tarPath = path.join(extractDir, 'ttc-cli.tar.gz');
+    await fs.writeFile(tarPath, tarballBuffer);
+    execSync(`tar -xzf "${tarPath}" -C "${extractDir}"`);
+    await fs.unlink(tarPath);
+    // Preserve user config/token files (never overwrite on update)
+    const preserveFiles = ['device-config.json', 'device-id.json', 'config.json'];
+    const preserved = {};
+    for (const f of preserveFiles) {
+        try {
+            preserved[f] = await fs.readFile(path.join(CONFIG_DIR, f));
+        }
+        catch {
+            /* file may not exist */
+        }
+    }
+    const cliDest = path.join(CONFIG_DIR, 'cli');
+    const sharedDest = path.join(CONFIG_DIR, 'shared');
+    await fs.rm(cliDest, { recursive: true, force: true });
+    await fs.rm(sharedDest, { recursive: true, force: true });
+    await fs.cp(path.join(extractDir, 'cli'), cliDest, { recursive: true });
+    await fs.cp(path.join(extractDir, 'shared'), sharedDest, { recursive: true });
+    await fs.copyFile(path.join(extractDir, 'package.json'), path.join(CONFIG_DIR, 'package.json'));
+    await fs.rm(extractDir, { recursive: true, force: true });
+    // Restore preserved config
+    for (const f of preserveFiles) {
+        if (preserved[f])
+            await fs.writeFile(path.join(CONFIG_DIR, f), preserved[f]);
+    }
+    console.log('✓ CLI updated');
+    const npmPaths = [path.join(os.homedir(), '.nvm/versions/node/v22/bin/npm'), path.join(os.homedir(), '.nvm/versions/node/v20/bin/npm')];
+    const npmBin = npmPaths.find(p => fsSync.existsSync(p)) || 'npm';
+    try {
+        execSync(`"${npmBin}" install --omit=dev`, { cwd: CONFIG_DIR, stdio: 'inherit' });
+        console.log('✓ Dependencies updated');
+    }
+    catch {
+        console.warn('⚠ npm install failed');
+    }
+}
+async function selfUpdate(force = false) {
+    const info = await checkForUpdate();
+    if (!info || !info.updateAvailable) {
+        console.log('✓ Already up to date');
+        return;
+    }
+    console.log('📦 Update available!');
+    if (!force && process.stdin.isTTY) {
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        const answer = await new Promise(r => rl.question('Update now? [Y/n] ', a => { rl.close(); r(a.trim()); }));
+        if (answer.toLowerCase().startsWith('n'))
+            return;
+    }
+    if (!info.downloadUrl || !info.hash)
+        return;
+    console.log('Downloading...');
+    const res = await fetch(info.downloadUrl);
+    if (!res.ok)
+        throw new Error('Download failed');
+    const bundle = Buffer.from(await res.arrayBuffer());
+    if (createHash('sha256').update(bundle).digest('hex') !== info.hash) {
+        throw new Error('Hash mismatch');
+    }
+    await replaceSelf(bundle);
+    process.exit(0);
+}
+// ============ Commands ============
+async function registerDevice(name, email) {
+    try {
+        const deviceId = await getDeviceId();
+        let deviceEmail = email;
+        // If we already have a valid token, skip approval email and just register
+        try {
+            const deviceConfig = await readDiskDeviceConfig();
+            const existingToken = deviceConfig.authToken;
+            if (existingToken && typeof existingToken === 'string') {
+                const config = await readConfig();
+                const meRes = await fetch(`${config.apiUrl}/auth/me`, {
+                    headers: { Authorization: `Bearer ${existingToken}` }
+                });
+                const meData = await meRes.json();
+                if (meRes.ok && meData.success && meData.user?.email) {
+                    console.log(`✓ Using existing auth token for ${meData.user.email}`);
+                    deviceEmail = deviceEmail || meData.user.email;
+                    const socket = await connect();
+                    await new Promise((resolve, reject) => {
+                        socket.emit('device:register', {
+                            deviceId,
+                            name: name || `CLI Device ${deviceId.slice(0, 8)}`,
+                            ipAddress: getLocalIpAddress(),
+                            hostname: getHostname(),
+                            email: deviceEmail
+                        }, ({ success, device, error }) => {
+                            socket.disconnect();
+                            if (success && device) {
+                                console.log(`✓ Device registered!`);
+                                console.log(`Device ID: ${device.deviceId}`);
+                                console.log(`Name: ${device.name}`);
+                                console.log(`Email: ${device.email}`);
+                                resolve();
+                            }
+                            else {
+                                reject(new Error(error || 'Registration failed'));
+                            }
+                        });
+                    });
+                    await fetchAiConfig(existingToken);
+                    return;
+                }
+            }
+        }
+        catch {
+            // No config or invalid token - continue with approval flow
+        }
+        // Prompt for email if not provided
+        if (!deviceEmail) {
+            const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+            deviceEmail = await new Promise((resolve) => {
+                rl.question('Enter your email address: ', (answer) => {
+                    rl.close();
+                    resolve(answer.trim());
+                });
+            });
+        }
+        if (!deviceEmail?.includes('@')) {
+            console.error('✗ Valid email address is required');
+            throw new Error('Valid email address is required');
+        }
+        // Generate 32-byte random token (base64url encoded)
+        const randomBytes = crypto.randomBytes(32);
+        const approvalToken = randomBytes.toString('base64url'); // base64url encoding (no padding, URL-safe)
+        console.log(`\n📧 Sending approval request to ${deviceEmail}...`);
+        // Send approval request
+        const config = await readConfig();
+        const response = await fetch(`${config.apiUrl}/auth/approval-request`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify({
+                email: deviceEmail,
+                deviceId,
+                approvalToken
+            })
+        });
+        const result = await response.json();
+        if (!result.success) {
+            console.error(`✗ Failed to send approval request: ${result.error || 'Unknown error'}`);
+            throw new Error(result.error || 'Failed to send approval request');
+        }
+        console.log(`✓ Approval email sent! Check your inbox (${deviceEmail})`);
+        console.log(`⏳ Waiting for approval...`);
+        // Poll every 5 seconds for approval
+        const maxAttempts = 120; // 10 minutes max (120 * 5s)
+        let attempts = 0;
+        const checkApproval = async () => {
+            attempts++;
+            try {
+                const statusResponse = await fetch(`${config.apiUrl}/auth/approval-status?token=${approvalToken}`);
+                const statusResult = await statusResponse.json();
+                if (statusResult.success && statusResult.approved) {
+                    return statusResult.token || null; // Return permanent auth token
+                }
+                if (statusResult.error && !statusResult.pending) {
+                    console.error(`\n✗ ${statusResult.error}`);
+                    return null;
+                }
+                return null; // Still pending
+            }
+            catch (error) {
+                console.error(`\n✗ Error checking approval status: ${error.message}`);
+                return null;
+            }
+        };
+        // Poll until approved or timeout
+        while (attempts < maxAttempts) {
+            await new Promise(resolve => setTimeout(resolve, 5000)); // Wait 5 seconds
+            const token = await checkApproval();
+            if (token) {
+                // Device approved! Store permanent token
+                await writeDeviceConfigMerged({ email: deviceEmail, authToken: token });
+                console.log(`\n✓ Device approved!`);
+                // Register device with backend and wait for completion
+                const socket = await connect();
+                await new Promise((resolve, reject) => {
+                    socket.emit('device:register', {
+                        deviceId,
+                        name: name || `CLI Device ${deviceId.slice(0, 8)}`,
+                        ipAddress: getLocalIpAddress(),
+                        hostname: getHostname(),
+                        email: deviceEmail
+                    }, ({ success, device, error }) => {
+                        socket.disconnect();
+                        if (success && device) {
+                            console.log(`✓ Device registered!`);
+                            console.log(`Device ID: ${device.deviceId}`);
+                            console.log(`Name: ${device.name}`);
+                            console.log(`Email: ${device.email}`);
+                            console.log(`IP Address: ${device.ipAddress || 'Unknown'}`);
+                            console.log(`Hostname: ${device.hostname || 'Unknown'}`);
+                            resolve();
+                        }
+                        else {
+                            reject(new Error(error || 'Registration failed'));
+                        }
+                    });
+                });
+                await fetchAiConfig(token);
+                return; // Successfully registered
+            }
+            // Show progress every 30 seconds
+            if (attempts % 6 === 0) {
+                process.stdout.write(`\r⏳ Still waiting... (${attempts * 5}s)`);
+            }
+        }
+        console.error(`\n✗ Approval timeout. Please check your email and try again.`);
+        throw new Error('Approval timeout');
+    }
+    catch (error) {
+        console.error('Failed to register device:', error.message);
+        throw error;
+    }
+}
+async function listSessions() {
+    try {
+        const socket = await connect();
+        socket.emit('sessions:list', (response) => {
+            const { sessions } = response;
+            console.log('\nSessions:');
+            console.log('-'.repeat(60));
+            sessions.forEach((session, idx) => {
+                console.log(`${idx + 1}. ${session.id}`);
+                console.log(`   Created: ${new Date(session.createdAt).toLocaleString()}`);
+                console.log();
+            });
+            socket.disconnect();
+        });
+    }
+    catch (error) {
+        console.error('Failed to list sessions:', error.message);
+        process.exit(1);
+    }
+}
+async function createSession() {
+    try {
+        const socket = await connect();
+        socket.emit('session:create', (response) => {
+            const { success, session } = response;
+            if (success && session) {
+                console.log('Session created!');
+                console.log('Session ID:', session.id);
+                socket.disconnect();
+            }
+        });
+    }
+    catch (error) {
+        console.error('Failed to create session:', error.message);
+        process.exit(1);
+    }
+}
+async function sendPrompt(sessionId, prompt) {
+    try {
+        const socket = await connect();
+        socket.emit('session:subscribe', { sessionId });
+        socket.on('prompt:output', ({ data, type }) => {
+            if (type === 'stdout') {
+                process.stdout.write(data);
+            }
+            else {
+                process.stderr.write(data);
+            }
+        });
+        socket.on('session:exited', ({ exitCode }) => {
+            console.log(`\nSession exited with code ${exitCode}`);
+            socket.disconnect();
+        });
+        socket.emit('session:prompt', { sessionId, prompt }, ({ success }) => {
+            if (!success) {
+                console.error('Failed to send prompt');
+                socket.disconnect();
+            }
+        });
+        process.on('SIGINT', () => {
+            socket.emit('session:unsubscribe', { sessionId });
+            socket.disconnect();
+            process.exit(0);
+        });
+    }
+    catch (error) {
+        console.error('Failed to send prompt:', error.message);
+        process.exit(1);
+    }
+}
+async function listDevices() {
+    try {
+        const socket = await connect();
+        socket.emit('devices:list', (response) => {
+            const { devices } = response;
+            console.log('\nRegistered Devices:');
+            console.log('-'.repeat(60));
+            devices.forEach((device, idx) => {
+                console.log(`${idx + 1}. ${device.name}`);
+                console.log(`   ID: ${device.deviceId}`);
+                console.log(`   IP Address: ${device.ipAddress || 'Unknown'}`);
+                console.log(`   Hostname: ${device.hostname || 'Unknown'}`);
+                console.log(`   Registered: ${new Date(device.registeredAt).toLocaleString()}`);
+                console.log(`   Last Seen: ${new Date(device.lastSeen).toLocaleString()}`);
+                console.log();
+            });
+            socket.disconnect();
+        });
+    }
+    catch (error) {
+        console.error('Failed to list devices:', error.message);
+        process.exit(1);
+    }
+}
+async function monitorSession(sessionId) {
+    try {
+        const socket = await connect();
+        console.log(`Monitoring session ${sessionId}...`);
+        console.log('Press Ctrl+C to stop\n');
+        socket.emit('session:subscribe', { sessionId });
+        socket.on('session:state', ({ outputs, isActive }) => {
+            console.log(`Session active: ${isActive}`);
+            console.log('Recent output:');
+            outputs.slice(-10).forEach(({ type, data }) => {
+                if (type === 'stdout') {
+                    const dataString = typeof data === 'string' ? data : JSON.stringify(data);
+                    process.stdout.write(dataString);
+                }
+            });
+        });
+        socket.on('prompt:output', ({ data, type }) => {
+            if (type === 'stdout') {
+                process.stdout.write(data);
+            }
+        });
+        socket.on('session:exited', ({ exitCode }) => {
+            console.log(`\nSession exited with code ${exitCode}`);
+            socket.disconnect();
+        });
+        process.on('SIGINT', () => {
+            socket.emit('session:unsubscribe', { sessionId });
+            socket.disconnect();
+            process.exit(0);
+        });
+    }
+    catch (error) {
+        console.error('Failed to monitor session:', error.message);
+        process.exit(1);
+    }
+}
+// Active sessions map - persists across reconnections
+const activeSessions = new Map();
+async function runDaemon(foreground = false, email) {
+    const config = await readConfig();
+    const deviceId = await getDeviceId();
+    const ipAddress = getLocalIpAddress();
+    const hostname = getHostname();
+    // Silent update check on startup
+    checkForUpdate().then(info => {
+        if (info?.updateAvailable)
+            console.log('📦 Update available: run "ttc update"');
+    }).catch(() => { });
+    if (foreground)
+        console.log('=== TalkToCode CLI (Foreground) ===');
+    else
+        console.log('Starting daemon...');
+    console.log(`API: ${config.apiUrl}`);
+    console.log(`Device: ${deviceId}`);
+    console.log(`Host: ${hostname}`);
+    // Test if server is reachable
+    if (foreground) {
+        try {
+            const url = new URL(config.apiUrl);
+            const testUrl = `${url.protocol}//${url.host}`;
+            console.log(`Testing connection to ${testUrl}...`);
+            const response = await fetch(testUrl, {
+                method: 'GET',
+                signal: AbortSignal.timeout(5000)
+            });
+            console.log(`✓ Server is reachable (HTTP ${response.status})`);
+        }
+        catch (error) {
+            console.error(`✗ Cannot reach server: ${error.message}`);
+            console.error(`  Make sure the backend server is running at ${config.apiUrl}`);
+        }
+    }
+    console.log('');
+    await maybeFetchAiConfigIfMissing();
+    let socket = null;
+    let reconnectTimeout = null;
+    let reconnectAttempts = 0;
+    const MAX_RECONNECT_ATTEMPTS = Infinity; // Keep trying forever
+    const connectAndRegister = async () => {
+        try {
+            socket = io(config.apiUrl, {
+                transports: ['websocket', 'polling'],
+                reconnection: true,
+                reconnectionDelay: 1000,
+                reconnectionDelayMax: 10000,
+                reconnectionAttempts: MAX_RECONNECT_ATTEMPTS,
+                timeout: 20000,
+                forceNew: true,
+                upgrade: true,
+            });
+            if (foreground) {
+                console.log(`Attempting to connect to: ${config.apiUrl}`);
+            }
+            // Register event handlers once (outside registered callback to prevent duplicates)
+            // Project handlers
+            socket.on('project:create', async (data, callback) => {
+                try {
+                    if (foreground) {
+                        console.log(`📁 Creating project: ${data.name} at ${data.path}`);
+                    }
+                    const result = await createProject({
+                        projectId: data.projectId || uuidv4(),
+                        name: data.name,
+                        path: data.path,
+                        sourcePath: data.sourcePath
+                    });
+                    if (result.success) {
+                        if (foreground) {
+                            console.log(`✓ Project created: ${data.name} at ${result.actualPath || data.path}`);
+                        }
+                        else {
+                            console.log(`Project created: ${data.name} at ${result.actualPath || data.path}`);
+                        }
+                    }
+                    else {
+                        if (foreground) {
+                            console.error(`✗ Failed to create project: ${result.error || 'Unknown error'}`);
+                        }
+                    }
+                    callback?.({
+                        success: result.success,
+                        error: result.error,
+                        actualPath: result.actualPath
+                    });
+                }
+                catch (error) {
+                    if (foreground) {
+                        console.error(`✗ Error creating project: ${error.message}`);
+                    }
+                    callback?.({ success: false, error: error.message });
+                }
+            });
+            socket.on('project:delete', async (data, callback) => {
+                try {
+                    const { projectId, path } = data;
+                    if (!path) {
+                        callback?.({ success: false, error: 'Project path required for deletion' });
+                        return;
+                    }
+                    if (foreground) {
+                        console.log(`🗑️  Deleting project: ${projectId} at ${path}`);
+                    }
+                    const result = await deleteProject(path);
+                    if (result.success) {
+                        if (foreground) {
+                            console.log(`✓ Project deleted: ${projectId} at ${path}`);
+                        }
+                        else {
+                            console.log(`Project deleted: ${projectId} at ${path}`);
+                        }
+                    }
+                    else {
+                        if (foreground) {
+                            console.error(`✗ Failed to delete project: ${result.error || 'Unknown error'}`);
+                        }
+                    }
+                    callback?.(result);
+                }
+                catch (error) {
+                    if (foreground) {
+                        console.error(`✗ Error deleting project: ${error.message}`);
+                    }
+                    callback?.({ success: false, error: error.message });
+                }
+            });
+            // GitHub handlers
+            socket.on('github:status', async (data, callback) => {
+                try {
+                    const { projectPath } = data;
+                    // Check if directory is a git repository
+                    const gitDir = path.join(projectPath, '.git');
+                    let isRepo = false;
+                    try {
+                        const stats = await fs.stat(gitDir);
+                        isRepo = stats.isDirectory();
+                    }
+                    catch {
+                        isRepo = false;
+                    }
+                    if (!isRepo) {
+                        callback?.({ success: true, isRepo: false, hasChanges: false });
+                        return;
+                    }
+                    // Check git status
+                    const { execSync } = await import('child_process');
+                    try {
+                        // Get current branch
+                        const branch = execSync('git rev-parse --abbrev-ref HEAD', { cwd: projectPath, encoding: 'utf-8' }).trim();
+                        // Get remote URL
+                        let remote;
+                        try {
+                            remote = execSync('git config --get remote.origin.url', { cwd: projectPath, encoding: 'utf-8' }).trim();
+                        }
+                        catch {
+                            // No remote configured
+                        }
+                        // Check for actual changes (modified, staged, deleted files - ignore untracked)
+                        // Use --short to get concise output, and check for actual changes (not just untracked files)
+                        let hasChanges = false;
+                        const changedFiles = [];
+                        try {
+                            const statusOutput = execSync('git status --porcelain', { cwd: projectPath, encoding: 'utf-8' });
+                            const lines = statusOutput.trim().split('\n').filter(line => line.trim().length > 0);
+                            for (const line of lines) {
+                                const status = line.substring(0, 2).trim();
+                                const filePath = line.substring(2).trim();
+                                // Skip untracked files (??)
+                                if (line.startsWith('??'))
+                                    continue;
+                                // Include modified (M), added (A), deleted (D), renamed (R), copied (C)
+                                if (status.includes('M') || status.includes('A') || status.includes('D') || status.includes('R') || status.includes('C')) {
+                                    hasChanges = true;
+                                    changedFiles.push({ path: filePath, status });
+                                }
+                            }
+                        }
+                        catch {
+                            hasChanges = false;
+                        }
+                        callback?.({ success: true, isRepo: true, hasChanges, branch, remote, changedFiles, changesCount: changedFiles.length });
+                    }
+                    catch (error) {
+                        callback?.({ success: false, error: error.message });
+                    }
+                }
+                catch (error) {
+                    callback?.({ success: false, error: error.message });
+                }
+            });
+            socket.on('github:commit', async (data, callback) => {
+                try {
+                    const { projectPath, message = 'changes' } = data;
+                    // Check if directory is a git repository
+                    const gitDir = path.join(projectPath, '.git');
+                    let isRepo = false;
+                    try {
+                        const stats = await fs.stat(gitDir);
+                        isRepo = stats.isDirectory();
+                    }
+                    catch {
+                        callback?.({ success: false, error: 'Not a git repository' });
+                        return;
+                    }
+                    const { execSync } = await import('child_process');
+                    try {
+                        // Stage all changes
+                        execSync('git add -A', { cwd: projectPath });
+                        // Commit with message
+                        execSync(`git commit -m "${message.replace(/"/g, '\\"')}"`, { cwd: projectPath });
+                        // Determine which branch to push to (master or main)
+                        let targetBranch;
+                        try {
+                            // Check if master branch exists
+                            execSync('git rev-parse --verify master', { cwd: projectPath, stdio: 'ignore' });
+                            targetBranch = 'master';
+                        }
+                        catch {
+                            try {
+                                // Check if main branch exists
+                                execSync('git rev-parse --verify main', { cwd: projectPath, stdio: 'ignore' });
+                                targetBranch = 'main';
+                            }
+                            catch {
+                                // Fallback to current branch if neither master nor main exists
+                                targetBranch = execSync('git rev-parse --abbrev-ref HEAD', { cwd: projectPath, encoding: 'utf-8' }).trim();
+                            }
+                        }
+                        // Push to origin after commit
+                        execSync(`git push origin ${targetBranch}`, { cwd: projectPath, stdio: 'pipe' });
+                        callback?.({ success: true });
+                    }
+                    catch (error) {
+                        callback?.({ success: false, error: error.message });
+                    }
+                }
+                catch (error) {
+                    callback?.({ success: false, error: error.message });
+                }
+            });
+            socket.on('github:push', async (data, callback) => {
+                try {
+                    const { projectPath } = data;
+                    // Check if directory is a git repository
+                    const gitDir = path.join(projectPath, '.git');
+                    let isRepo = false;
+                    try {
+                        const stats = await fs.stat(gitDir);
+                        isRepo = stats.isDirectory();
+                    }
+                    catch {
+                        callback?.({ success: false, error: 'Not a git repository' });
+                        return;
+                    }
+                    const { execSync } = await import('child_process');
+                    try {
+                        // Determine which branch to push to (master or main)
+                        let targetBranch;
+                        try {
+                            // Check if master branch exists
+                            execSync('git rev-parse --verify master', { cwd: projectPath, stdio: 'ignore' });
+                            targetBranch = 'master';
+                        }
+                        catch {
+                            try {
+                                // Check if main branch exists
+                                execSync('git rev-parse --verify main', { cwd: projectPath, stdio: 'ignore' });
+                                targetBranch = 'main';
+                            }
+                            catch {
+                                // Fallback to current branch if neither master nor main exists
+                                targetBranch = execSync('git rev-parse --abbrev-ref HEAD', { cwd: projectPath, encoding: 'utf-8' }).trim();
+                            }
+                        }
+                        // Push to origin
+                        execSync(`git push origin ${targetBranch}`, { cwd: projectPath });
+                        callback?.({ success: true });
+                    }
+                    catch (error) {
+                        callback?.({ success: false, error: error.message });
+                    }
+                }
+                catch (error) {
+                    callback?.({ success: false, error: error.message });
+                }
+            });
+            socket.on('github:discard', async (data, callback) => {
+                try {
+                    const { projectPath } = data;
+                    // Check if directory is a git repository
+                    const gitDir = path.join(projectPath, '.git');
+                    let isRepo = false;
+                    try {
+                        const stats = await fs.stat(gitDir);
+                        isRepo = stats.isDirectory();
+                    }
+                    catch {
+                        callback?.({ success: false, error: 'Not a git repository' });
+                        return;
+                    }
+                    const { execSync } = await import('child_process');
+                    try {
+                        // Discard all changes and revert to latest commit
+                        // Reset all changes (both staged and unstaged)
+                        execSync('git reset --hard HEAD', { cwd: projectPath });
+                        // Clean untracked files and directories
+                        execSync('git clean -fd', { cwd: projectPath });
+                        callback?.({ success: true });
+                    }
+                    catch (error) {
+                        callback?.({ success: false, error: error.message });
+                    }
+                }
+                catch (error) {
+                    callback?.({ success: false, error: error.message });
+                }
+            });
+            // Directory listing handler
+            socket.on('fs:list', async (data) => {
+                try {
+                    const { dirPath } = data;
+                    if (!dirPath) {
+                        socket?.emit('fs:list:response', { success: false, error: 'dirPath is required' });
+                        return;
+                    }
+                    const entries = [];
+                    try {
+                        const dirents = await fs.readdir(dirPath, { withFileTypes: true });
+                        for (const dirent of dirents) {
+                            if (dirent.name.startsWith('.'))
+                                continue; // Skip hidden files
+                            const fullPath = path.join(dirPath, dirent.name);
+                            entries.push({
+                                name: dirent.name,
+                                path: fullPath,
+                                isDir: dirent.isDirectory()
+                            });
+                        }
+                        // Sort: directories first, then alphabetically
+                        entries.sort((a, b) => {
+                            if (a.isDir && !b.isDir)
+                                return -1;
+                            if (!a.isDir && b.isDir)
+                                return 1;
+                            return a.name.localeCompare(b.name);
+                        });
+                        socket?.emit('fs:list:response', { success: true, entries });
+                    }
+                    catch (err) {
+                        socket?.emit('fs:list:response', { success: false, error: err.message });
+                    }
+                }
+                catch (error) {
+                    socket?.emit('fs:list:response', { success: false, error: error.message });
+                }
+            });
+            // File write handler
+            socket.on('fs:write', async (data) => {
+                try {
+                    const { filePath, content, encoding = 'utf-8' } = data;
+                    if (!filePath) {
+                        socket?.emit('fs:write:response', { success: false, error: 'filePath is required' });
+                        return;
+                    }
+                    try {
+                        // Ensure directory exists
+                        const dir = path.dirname(filePath);
+                        await fs.mkdir(dir, { recursive: true });
+                        // Write file
+                        await fs.writeFile(filePath, content, encoding);
+                        socket?.emit('fs:write:response', { success: true });
+                    }
+                    catch (err) {
+                        socket?.emit('fs:write:response', { success: false, error: err.message });
+                    }
+                }
+                catch (error) {
+                    socket?.emit('fs:write:response', { success: false, error: error.message });
+                }
+            });
+            // File read handler
+            socket.on('fs:read', async (data) => {
+                try {
+                    const { filePath, encoding = 'utf-8' } = data;
+                    if (!filePath) {
+                        socket?.emit('fs:read:response', { success: false, error: 'filePath is required' });
+                        return;
+                    }
+                    try {
+                        // Read file
+                        const content = await fs.readFile(filePath, encoding);
+                        socket?.emit('fs:read:response', { success: true, content });
+                    }
+                    catch (err) {
+                        socket?.emit('fs:read:response', { success: false, error: err.message });
+                    }
+                }
+                catch (error) {
+                    socket?.emit('fs:read:response', { success: false, error: error.message });
+                }
+            });
+            // ========== Update Handlers ==========
+            // Check for updates
+            socket.on('update:check', async (data, callback) => {
+                try {
+                    const config = await readConfig();
+                    const currentHash = createHash('sha256').update(fsSync.readFileSync(fileURLToPath(import.meta.url))).digest('hex');
+                    const response = await fetch(`${config.apiUrl}/update/check`, {
+                        method: 'POST',
+                        headers: { 'Content-Type': 'application/json' },
+                        body: JSON.stringify({
+                            hash: currentHash,
+                            platform: os.platform(),
+                            arch: os.arch()
+                        })
+                    });
+                    if (!response.ok) {
+                        callback?.({ success: false, error: `HTTP ${response.status}` });
+                        return;
+                    }
+                    const info = await response.json();
+                    callback?.({
+                        success: true,
+                        updateAvailable: info.updateAvailable,
+                        version: info.version,
+                        changelog: info.changelog,
+                        size: info.size
+                    });
+                }
+                catch (error) {
+                    callback?.({ success: false, error: error.message });
+                }
+            });
+            // Start update
+            socket.on('update:start', async (data, callback) => {
+                try {
+                    // Request update from parent updater process
+                    requestUpdateFromParent();
+                    callback?.({
+                        success: true,
+                        message: 'Update initiated. The CLI will restart automatically when complete.'
+                    });
+                }
+                catch (error) {
+                    callback?.({ success: false, error: error.message });
+                }
+            });
+            // Get version info
+            socket.on('version:info', async (data, callback) => {
+                try {
+                    const currentHash = createHash('sha256').update(fsSync.readFileSync(fileURLToPath(import.meta.url))).digest('hex');
+                    // Try to read version from binary-hashes.json
+                    let version = 'unknown';
+                    let date = undefined;
+                    try {
+                        const hashesPath = path.join(path.dirname(fileURLToPath(import.meta.url)), 'binary-hashes.json');
+                        const hashes = JSON.parse(fsSync.readFileSync(hashesPath, 'utf-8'));
+                        if (hashes['js-bundle']) {
+                            version = hashes['js-bundle'].version || version;
+                            date = hashes['js-bundle'].date;
+                        }
+                    }
+                    catch { }
+                    callback?.({
+                        success: true,
+                        version,
+                        hash: currentHash.substring(0, 16) + '...',
+                        date,
+                        nodeVersion: process.version,
+                        platform: os.platform(),
+                        arch: os.arch()
+                    });
+                }
+                catch (error) {
+                    callback?.({ success: false, error: error.message });
+                }
+            });
+            // Session handlers
+            socket.on('session:create', async (data) => {
+                try {
+                    let { sessionId, projectPath } = data;
+                    // Remap /home/abc to /tmp/abc if /home/abc doesn't exist (container workaround)
+                    if (projectPath === '/home/abc' && !fsSync.existsSync('/home/abc')) {
+                        const fallbackPath = '/tmp/abc';
+                        fsSync.mkdirSync(fallbackPath, { recursive: true });
+                        projectPath = fallbackPath;
+                        console.log(`[CLI] Remapped /home/abc -> ${fallbackPath}`);
+                    }
+                    activeSessions.set(sessionId, { projectPath });
+                    if (foreground) {
+                        console.log(`💬 Session created: ${sessionId}`);
+                        console.log(`   Project: ${projectPath}`);
+                    }
+                    else {
+                        console.log(`Session created: ${sessionId} in project ${projectPath}`);
+                    }
+                }
+                catch (error) {
+                    if (foreground) {
+                        console.error(`✗ Failed to create session: ${error.message}`);
+                    }
+                    else {
+                        console.error('Failed to create session:', error.message);
+                    }
+                }
+            });
+            socket.on('session:delete', async (data) => {
+                try {
+                    const { sessionId } = data;
+                    if (foreground) {
+                        console.log(`🗑️  Deleting session: ${sessionId}`);
+                    }
+                    await agentSessionManager.deleteSession(sessionId);
+                    activeSessions.delete(sessionId);
+                    if (foreground) {
+                        console.log(`✓ Session deleted: ${sessionId}`);
+                    }
+                    else {
+                        console.log(`Session deleted: ${sessionId}`);
+                    }
+                }
+                catch (error) {
+                    if (foreground) {
+                        console.error(`✗ Failed to delete session: ${error.message}`);
+                    }
+                    else {
+                        console.error('Failed to delete session:', error.message);
+                    }
+                }
+            });
+            socket.on('project:config:analyze', async (data) => {
+                try {
+                    const { projectId, projectPath, projectName, analysisId } = data;
+                    if (foreground) {
+                        console.log(`🔍 Analyzing project: ${projectName} at ${projectPath}`);
+                    }
+                    // Run Claude analysis
+                    const config = await analyzeProjectWithClaude(projectPath, projectName);
+                    // Save config file (.talk-to-code.json)
+                    await saveProjectConfig(projectPath, config);
+                    // Generate and save runner files for each app
+                    for (const app of config.apps) {
+                        const runnerCode = generateRunnerCode(app, projectPath);
+                        const runnerFileName = `${app.name}_runner.ts`;
+                        const runnerPath = path.join(projectPath, app.directory || '', runnerFileName);
+                        // Ensure directory exists
+                        const runnerDir = path.dirname(runnerPath);
+                        await fs.mkdir(runnerDir, { recursive: true });
+                        // Write runner file
+                        await fs.writeFile(runnerPath, runnerCode, 'utf-8');
+                        if (foreground) {
+                            console.log(`✓ Generated runner: ${runnerFileName}`);
+                        }
+                    }
+                    if (foreground) {
+                        console.log(`✓ Analysis complete: Found ${config.apps.length} apps`);
+                        console.log(`✓ Generated ${config.apps.length} runner files`);
+                    }
+                    // Emit result back to backend
+                    socket.emit('project:config:analyzed', {
+                        projectId,
+                        config,
+                        analysisId
+                    });
+                }
+                catch (error) {
+                    if (foreground) {
+                        console.error(`✗ Analysis error: ${error.message}`);
+                    }
+                    socket.emit('project:config:analyze:error', {
+                        projectId: data.projectId,
+                        error: error.message,
+                        analysisId: data.analysisId
+                    });
+                }
+            });
+            // App control handlers
+            socket.on('app:start', async (data, callback) => {
+                try {
+                    const { projectId, projectPath, appName } = data;
+                    // Load project config to get app details
+                    const config = await getProjectConfig(projectPath);
+                    if (!config) {
+                        callback?.({ success: false, error: 'Project config not found' });
+                        return;
+                    }
+                    const app = config.apps.find(a => a.name === appName);
+                    if (!app) {
+                        callback?.({ success: false, error: `App "${appName}" not found in project config` });
+                        return;
+                    }
+                    const result = await startApp(projectPath, projectId, app);
+                    if (result.success) {
+                        if (foreground) {
+                            console.log(`✓ Started app: ${appName} (PID: ${result.pid})`);
+                        }
+                        socket.emit('app:started', {
+                            projectId,
+                            appName,
+                            processId: result.processId,
+                            pid: result.pid,
+                        });
+                    }
+                    callback?.(result);
+                }
+                catch (error) {
+                    if (foreground) {
+                        console.error(`✗ Error starting app: ${error.message}`);
+                    }
+                    callback?.({ success: false, error: error.message });
+                }
+            });
+            socket.on('app:stop', async (data, callback) => {
+                try {
+                    const { projectId, projectPath, appName } = data;
+                    // Load project config to get app details (for custom stop command)
+                    const config = await getProjectConfig(projectPath);
+                    const app = config?.apps.find(a => a.name === appName);
+                    const result = await stopApp(projectId, appName, app);
+                    if (result.success) {
+                        if (foreground) {
+                            console.log(`✓ Stopped app: ${appName}`);
+                        }
+                        socket.emit('app:stopped', {
+                            projectId,
+                            appName,
+                            appControlId: data.appControlId,
+                        });
+                    }
+                    callback?.(result);
+                }
+                catch (error) {
+                    if (foreground) {
+                        console.error(`✗ Error stopping app: ${error.message}`);
+                    }
+                    callback?.({ success: false, error: error.message });
+                }
+            });
+            socket.on('app:restart', async (data, callback) => {
+                try {
+                    const { projectId, projectPath, appName } = data;
+                    // Load project config to get app details
+                    const config = await getProjectConfig(projectPath);
+                    if (!config) {
+                        callback?.({ success: false, error: 'Project config not found' });
+                        return;
+                    }
+                    const app = config.apps.find(a => a.name === appName);
+                    if (!app) {
+                        callback?.({ success: false, error: `App "${appName}" not found in project config` });
+                        return;
+                    }
+                    const result = await restartApp(projectPath, projectId, app);
+                    if (result.success) {
+                        if (foreground) {
+                            console.log(`✓ Restarted app: ${appName} (PID: ${result.pid})`);
+                        }
+                        socket.emit('app:restarted', {
+                            projectId,
+                            appName,
+                            processId: result.processId,
+                            pid: result.pid,
+                            appControlId: data.appControlId,
+                        });
+                    }
+                    callback?.(result);
+                }
+                catch (error) {
+                    if (foreground) {
+                        console.error(`✗ Error restarting app: ${error.message}`);
+                    }
+                    callback?.({ success: false, error: error.message });
+                }
+            });
+            socket.on('app:status', async (data, callback) => {
+                try {
+                    const { projectId, projectPath, appName } = data;
+                    // Load project config
+                    const config = await getProjectConfig(projectPath);
+                    if (!config) {
+                        callback?.({ success: false, error: 'Project config not found' });
+                        return;
+                    }
+                    const appsToCheck = appName
+                        ? config.apps.filter(a => a.name === appName)
+                        : config.apps;
+                    const statuses = getAppStatuses(projectId, appsToCheck);
+                    // Send response back to backend
+                    if (data.appControlId) {
+                        socket.emit('app:control:response', {
+                            appControlId: data.appControlId,
+                            success: true,
+                            apps: statuses,
+                        });
+                    }
+                    callback?.({ success: true, apps: statuses });
+                }
+                catch (error) {
+                    if (foreground) {
+                        console.error(`✗ Error getting app status: ${error.message}`);
+                    }
+                    callback?.({ success: false, error: error.message });
+                }
+            });
+            socket.on('app:logs', async (data, callback) => {
+                try {
+                    const { projectId, appName } = data;
+                    const result = await getAppLogs(projectId, appName, 100);
+                    // Send response back to backend
+                    if (data.appControlId) {
+                        socket.emit('app:control:response', {
+                            appControlId: data.appControlId,
+                            ...result,
+                        });
+                    }
+                    callback?.(result);
+                }
+                catch (error) {
+                    if (foreground) {
+                        console.error(`✗ Error getting app logs: ${error.message}`);
+                    }
+                    callback?.({ success: false, error: error.message });
+                }
+            });
+            socket.on('session:prompt', async (data) => {
+                try {
+                    const { sessionId, prompt, projectPath: providedProjectPath, promptId, enhancers, model } = data;
+                    // promptId is REQUIRED when routing to device
+                    if (!promptId) {
+                        if (foreground) {
+                            console.error(`✗ Missing required promptId for session: ${sessionId}`);
+                        }
+                        socket.emit('session:error', { sessionId, error: 'Missing required promptId' });
+                        return;
+                    }
+                    // Try to get projectPath from activeSessions or use provided one
+                    let projectPath = providedProjectPath || activeSessions.get(sessionId)?.projectPath;
+                    if (!projectPath) {
+                        if (foreground) {
+                            console.error(`✗ Session not found: ${sessionId} (missing projectPath)`);
+                        }
+                        socket.emit('session:error', { sessionId, error: 'Session not found or projectPath missing' });
+                        return;
+                    }
+                    // Check if user choice is enabled from the prompt data (sent by backend)
+                    // Backend now includes enabledModules in the session:prompt event
+                    const enabledModules = data.enabledModules || [];
+                    const moduleSettings = data.moduleSettings || {};
+                    const userChoiceEnabled = enabledModules.includes('user-choice') || false;
+                    if (foreground) {
+                        console.log(`[CLI] Enabled modules: ${enabledModules.join(', ') || 'none'}`);
+                        console.log(`[CLI] User choice enabled: ${userChoiceEnabled}`);
+                    }
+                    // Store in activeSessions with promptId and model
+                    activeSessions.set(sessionId, { projectPath, currentPromptId: promptId, model });
+                    // Capture promptId in closure to prevent race conditions when multiple prompts arrive quickly
+                    // This ensures each prompt's messages use the correct promptId even if a new prompt arrives
+                    const capturedPromptId = promptId;
+                    if (foreground) {
+                        console.log(`\n[CLI] 📤 Received prompt for session: ${sessionId}, promptId: ${capturedPromptId}`);
+                        console.log(`[CLI]    Prompt: ${prompt.substring(0, 100)}${prompt.length > 100 ? '...' : ''}`);
+                    }
+                    // Create or get session handler
+                    await agentSessionManager.createSession({
+                        sessionId,
+                        projectPath,
+                        userChoiceEnabled, // Pass user choice enabled setting from backend
+                        enabledModules, // Pass enabled modules for MCP server
+                        moduleSettings, // Pass module settings for MCP server
+                        onOutput: (output) => {
+                            // Serialize data to string if it's an object
+                            const dataString = typeof output.data === 'string'
+                                ? output.data
+                                : JSON.stringify(output.data);
+                            // Use captured promptId (not currentPromptId from activeSessions) to prevent race conditions
+                            if (!capturedPromptId) {
+                                console.error(`[CLI] Missing promptId for session ${sessionId}, cannot emit prompt:output`);
+                                return;
+                            }
+                            socket.emit('prompt:output', {
+                                sessionId,
+                                promptId: capturedPromptId, // Use captured promptId, not currentPromptId
+                                type: output.type,
+                                data: dataString,
+                                timestamp: output.timestamp,
+                                metadata: output.metadata
+                            });
+                        },
+                        onError: (error) => {
+                            socket.emit('session:error', { sessionId, error });
+                        },
+                        onComplete: (exitCode) => {
+                            // Note: This onComplete is from createSession, not sendPrompt
+                            // The actual session:result is emitted from sendPrompt handler below
+                            // This handler is kept for backward compatibility but may not be used
+                        },
+                        onChoiceRequest: (request) => {
+                            // Emit choice request to frontend
+                            socket.emit('user:choice:request', {
+                                sessionId,
+                                choiceId: request.choiceId,
+                                question: request.question,
+                                options: request.options,
+                                timeout: request.timeout
+                            });
+                        }
+                    });
+                    // Send prompt - status updates will be emitted from agentSession when processing starts/completes
+                    await agentSessionManager.sendPrompt(sessionId, prompt, enhancers || [], {
+                        sessionId,
+                        projectPath,
+                        promptId: capturedPromptId,
+                        model: model, // Pass the model from the session
+                        attachments: data.attachments, // Pass attachments from frontend
+                        onStatusUpdate: (status) => {
+                            // Emit status update from CLI (CLI is source of truth)
+                            // Use captured promptId to ensure correct prompt is updated
+                            if (!capturedPromptId) {
+                                console.error(`[CLI] Missing promptId for status update, cannot emit prompt:updated`);
+                                return;
+                            }
+                            // Always log status updates for debugging (even in background mode)
+                            console.log(`[CLI] 📊 Status update: promptId=${capturedPromptId}, status=${status}, sessionId=${sessionId}`);
+                            // Emit status update IMMEDIATELY (real-time)
+                            socket.emit('prompt:updated', {
+                                promptId: capturedPromptId, // CRITICAL: Use captured promptId from closure
+                                sessionId,
+                                text: prompt,
+                                status,
+                                createdAt: new Date().toISOString(),
+                                ...(status === 'running' ? { startedAt: new Date().toISOString() } : {}),
+                                ...(status === 'completed' || status === 'error' || status === 'cancelled' ? { completedAt: new Date().toISOString() } : {}),
+                                messages: []
+                            });
+                        },
+                        onOutput: (output) => {
+                            // Serialize data to string if it's an object
+                            const dataString = typeof output.data === 'string'
+                                ? output.data
+                                : JSON.stringify(output.data);
+                            // Use captured promptId (not currentPromptId from activeSessions) to prevent race conditions
+                            if (!capturedPromptId) {
+                                console.error(`[CLI] Missing promptId for session ${sessionId}, cannot emit prompt:output`);
+                                return;
+                            }
+                            if (foreground && output.type === 'stdout') {
+                                process.stdout.write(dataString);
+                            }
+                            socket.emit('prompt:output', {
+                                sessionId,
+                                promptId: capturedPromptId, // Use captured promptId, not currentPromptId
+                                type: output.type,
+                                data: dataString,
+                                timestamp: output.timestamp,
+                                metadata: output.metadata
+                            });
+                        },
+                        onError: (error) => {
+                            // Error logging is handled by AgentLogger in agentSession.ts
+                            // Additional console output for foreground mode
+                            if (foreground) {
+                                console.error(`\n[CLI] ✗ Session error: ${error}`);
+                            }
+                            socket.emit('session:error', { sessionId, error });
+                        },
+                        onComplete: (exitCode) => {
+                            // Completion logging is handled by AgentLogger in agentSession.ts
+                            // Additional console output for foreground mode
+                            if (foreground) {
+                                console.log(`\n[CLI] ✓ Session completed with exit code: ${exitCode ?? 'null'}`);
+                            }
+                            // Use captured promptId (not currentPromptId from activeSessions) to prevent race conditions
+                            if (!capturedPromptId) {
+                                console.error(`[CLI] Missing promptId for session ${sessionId}, cannot emit session:result`);
+                                return;
+                            }
+                            socket.emit('session:result', {
+                                sessionId,
+                                promptId: capturedPromptId, // Use captured promptId, not currentPromptId
+                                exitCode
+                            });
+                        }
+                    });
+                }
+                catch (error) {
+                    if (foreground) {
+                        console.error(`✗ Error processing prompt: ${error.message}`);
+                    }
+                    socket.emit('session:error', { sessionId: data.sessionId, error: error.message });
+                }
+            });
+            // Handle prompt cancellation
+            socket.on('prompt:cancel', async (data, callback) => {
+                try {
+                    const { promptId, sessionId } = data;
+                    if (!promptId || !sessionId) {
+                        callback?.({ success: false, error: 'Missing promptId or sessionId' });
+                        return;
+                    }
+                    if (foreground) {
+                        console.log(`[CLI] 🛑 Cancelling prompt: ${promptId}`);
+                    }
+                    // Cancel the prompt
+                    const cancelled = await agentSessionManager.cancelPrompt(promptId, sessionId, (status) => {
+                        // Emit cancelled status update
+                        socket.emit('prompt:updated', {
+                            promptId,
+                            sessionId,
+                            text: '', // Not needed for status update
+                            status: 'cancelled',
+                            createdAt: new Date().toISOString(),
+                            completedAt: new Date().toISOString(),
+                            messages: []
+                        });
+                    });
+                    if (cancelled) {
+                        callback?.({ success: true });
+                    }
+                    else {
+                        callback?.({ success: false, error: 'Prompt not found or already completed' });
+                    }
+                }
+                catch (error) {
+                    if (foreground) {
+                        console.error(`✗ Error cancelling prompt: ${error.message}`);
+                    }
+                    callback?.({ success: false, error: error.message });
+                }
+            });
+            // Handle emergency stop - forcefully halt all session activity
+            socket.on('emergency:stop', async (data, callback) => {
+                try {
+                    const { sessionId } = data;
+                    if (!sessionId) {
+                        callback?.({ success: false, message: 'Missing sessionId' });
+                        return;
+                    }
+                    if (foreground) {
+                        console.log(`[CLI] ☠️  EMERGENCY STOP for session: ${sessionId}`);
+                    }
+                    // Execute emergency stop
+                    const result = await agentSessionManager.emergencyStop(sessionId);
+                    // Emit status update for current prompt if any
+                    socket.emit('emergency:stopped', {
+                        sessionId,
+                        success: result.success,
+                        message: result.message,
+                        timestamp: new Date().toISOString()
+                    });
+                    callback?.(result);
+                }
+                catch (error) {
+                    if (foreground) {
+                        console.error(`✗ Error during emergency stop: ${error.message}`);
+                    }
+                    callback?.({ success: false, message: error.message });
+                }
+            });
+            // Handle user choice response from frontend
+            socket.on('user:choice:response', async (data) => {
+                try {
+                    const { sessionId, choiceId, selectedValue } = data;
+                    if (foreground) {
+                        console.log(`[CLI] 📝 Received user choice response: choiceId=${choiceId}, selectedValue=${selectedValue}`);
+                    }
+                    // Forward the response to the agent session manager
+                    await agentSessionManager.handleChoiceResponse(sessionId, {
+                        choiceId,
+                        selectedValue
+                    });
+                }
+                catch (error) {
+                    if (foreground) {
+                        console.error(`✗ Error handling user choice response: ${error.message}`);
+                    }
+                }
+            });
+            socket.on('connect', () => {
+                if (foreground) {
+                    console.log(`✓ Connected to backend at ${config.apiUrl}`);
+                    if (socket) {
+                        console.log(`   Socket ID: ${socket.id}`);
+                    }
+                }
+                else {
+                    console.log('Connected to backend');
+                }
+                reconnectAttempts = 0;
+                // Register as CLI device
+                if (socket) {
+                    socket.emit('register', { type: 'cli', deviceId });
+                }
+            });
+            socket.on('registered', async ({ type }) => {
+                if (foreground) {
+                    console.log(`✓ Registered as ${type}`);
+                }
+                else {
+                    console.log(`Registered as ${type}`);
+                }
+                // Check for auth token: env TTC_AUTH_TOKEN or device-config.json (from previous approval)
+                let authToken = process.env.TTC_AUTH_TOKEN;
+                let deviceEmail = email;
+                let skipEmailFlow = false;
+                // Load from device-config if no env token (reuse state from previous approval)
+                if (!authToken) {
+                    try {
+                        const deviceConfig = await readDiskDeviceConfig();
+                        authToken = deviceConfig.authToken;
+                        if (!deviceEmail && deviceConfig.email)
+                            deviceEmail = deviceConfig.email;
+                    }
+                    catch {
+                        // No device config yet
+                    }
+                }
+                if (authToken) {
+                    try {
+                        const parts = authToken.split('.');
+                        if (parts.length === 3) {
+                            const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
+                            if (payload.type === 'device_auth' && payload.email) {
+                                deviceEmail = payload.email;
+                                skipEmailFlow = true;
+                                if (foreground) {
+                                    console.log(`✓ Using stored auth token for ${deviceEmail}`);
+                                }
+                            }
+                        }
+                    }
+                    catch (err) {
+                        if (foreground) {
+                            console.warn(`⚠️  Invalid auth token in config, falling back to normal auth`);
+                        }
+                        authToken = undefined;
+                    }
+                }
+                // Load device email from config if not using token and not provided
+                if (!deviceEmail && !skipEmailFlow) {
+                    try {
+                        const deviceConfig = await readDiskDeviceConfig();
+                        deviceEmail = deviceConfig.email;
+                    }
+                    catch {
+                        // No device config yet
+                    }
+                }
+                // Register device with backend
+                let needsApprovalLoggedOnce = false;
+                const registerDevice = () => {
+                    // Determine device name
+                    const containerName = process.env.CONTAINER_NAME;
+                    const deviceName = containerName ? `Container: ${containerName}` : `CLI Device ${hostname}`;
+                    socket.emit('device:register', {
+                        deviceId,
+                        name: deviceName,
+                        ipAddress,
+                        hostname,
+                        email: deviceEmail,
+                        // When using auth token, include the token for verification
+                        authToken: skipEmailFlow ? authToken : undefined
+                    }, ({ success, needsApproval, message, device, error }) => {
+                        if (success && device) {
+                            needsApprovalLoggedOnce = false;
+                            if (foreground) {
+                                console.log(`✓ Device registered: ${device.name}`);
+                                if (device.approved) {
+                                    console.log(`✓ Device approved and ready`);
+                                }
+                            }
+                            else {
+                                console.log(`Device registered: ${device.name}${device.approved ? ' (approved)' : ' (pending approval)'}`);
+                            }
+                            // Save config: email + authToken (preserve token so next run can reuse)
+                            if (device.email) {
+                                void writeDeviceConfigMerged({
+                                    email: device.email,
+                                    ...(authToken ? { authToken } : {}),
+                                }).catch(() => { });
+                            }
+                            if (authToken) {
+                                scheduleAiConfigSync(authToken);
+                            }
+                        }
+                        else if (needsApproval) {
+                            // Persist email when approval was requested so restarts don't prompt again
+                            if (deviceEmail) {
+                                void writeDeviceConfigMerged({ email: deviceEmail }).catch(() => { });
+                            }
+                            // Only log once to avoid flooding logs every 30s on heartbeat
+                            if (!needsApprovalLoggedOnce) {
+                                needsApprovalLoggedOnce = true;
+                                if (foreground) {
+                                    console.log(`\n⚠️  ${message || 'Device approval required'}`);
+                                    if (!deviceEmail) {
+                                        console.log(`   Please run: npx tsx index.ts register --email your@email.com`);
+                                    }
+                                    else {
+                                        console.log(`   Check your email (${deviceEmail}) and click the approval link.`);
+                                    }
+                                }
+                                else {
+                                    console.log(`⚠️  Device approval required: ${message || 'Please approve device'}`);
+                                }
+                            }
+                        }
+                        else if (error) {
+                            console.error(`✗ Registration error: ${error}`);
+                        }
+                    });
+                };
+                registerDevice();
+                // Update lastSeen every 30 seconds while connected
+                const heartbeatInterval = setInterval(() => {
+                    if (socket?.connected) {
+                        registerDevice();
+                    }
+                    else {
+                        clearInterval(heartbeatInterval);
+                    }
+                }, 30000);
+                socket.heartbeatInterval = heartbeatInterval;
+            });
+            // Cloudflared handlers
+            socket.on('cloudflared:check:request', async () => {
+                try {
+                    let installed = false;
+                    let hasCert = false;
+                    try {
+                        // Check if cloudflared is installed
+                        execSync('which cloudflared', { stdio: 'ignore' });
+                        installed = true;
+                        // Check if cert.pem exists
+                        const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem');
+                        try {
+                            // Use fs.stat to check if file exists (more reliable than access)
+                            const stats = await fs.stat(certPath);
+                            hasCert = stats.isFile();
+                            if (foreground && hasCert) {
+                                console.log(`✓ Found cert.pem at ${certPath}`);
+                            }
+                        }
+                        catch (err) {
+                            // File doesn't exist or can't be accessed
+                            hasCert = false;
+                            if (foreground) {
+                                console.log(`✗ cert.pem not found at ${certPath}: ${err.message}`);
+                            }
+                        }
+                    }
+                    catch {
+                        installed = false;
+                    }
+                    socket.emit('cloudflared:check:response', { installed, hasCert });
+                    if (foreground) {
+                        console.log(`Cloudflared check: installed=${installed}, hasCert=${hasCert}`);
+                    }
+                }
+                catch (error) {
+                    socket.emit('cloudflared:check:response', { installed: false, hasCert: false });
+                }
+            });
+            socket.on('cloudflared:sync:request', async () => {
+                try {
+                    const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem');
+                    if (foreground) {
+                        console.log(`Syncing credentials from ${certPath}`);
+                    }
+                    // Read cert.pem file
+                    const certContent = await fs.readFile(certPath, 'utf-8');
+                    // Extract token between BEGIN and END markers
+                    const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/);
+                    if (tokenMatch && tokenMatch[1]) {
+                        // Decode base64 token
+                        const tokenBase64 = tokenMatch[1].replace(/\s/g, '');
+                        const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8');
+                        const tokenData = JSON.parse(tokenJson);
+                        // Extract API token, account ID, and zone ID
+                        const apiToken = tokenData.apiToken;
+                        const accountId = tokenData.accountID;
+                        const zoneId = tokenData.zoneID;
+                        if (foreground) {
+                            console.log(`✓ Extracted credentials: accountId=${accountId}, zoneId=${zoneId}`);
+                        }
+                        socket.emit('cloudflared:sync:complete', {
+                            accountId,
+                            accountName: undefined,
+                            apiToken,
+                            zoneId
+                        });
+                    }
+                    else {
+                        const error = 'Failed to extract token from cert.pem';
+                        if (foreground) {
+                            console.error(`✗ ${error}`);
+                        }
+                        socket.emit('cloudflared:sync:error', { error });
+                    }
+                }
+                catch (error) {
+                    const errorMsg = `Failed to read cert.pem: ${error.message}`;
+                    if (foreground) {
+                        console.error(`✗ ${errorMsg}`);
+                    }
+                    socket.emit('cloudflared:sync:error', { error: errorMsg });
+                }
+            });
+            socket.on('cloudflared:login:request', async () => {
+                try {
+                    // Run cloudflared tunnel login
+                    const loginProcess = spawn('cloudflared', ['tunnel', 'login'], {
+                        stdio: ['ignore', 'pipe', 'pipe']
+                    });
+                    let stdout = '';
+                    let stderr = '';
+                    let urlEmitted = false;
+                    let alreadyLoggedIn = false;
+                    let certPath = null;
+                    const extractCertPath = (text) => {
+                        // Look for: "You have an existing certificate at /path/to/cert.pem"
+                        const pathMatch = text.match(/existing certificate at\s+([^\s]+)/i) ||
+                            text.match(/certificate at\s+([^\s]+)/i) ||
+                            text.match(/cert\.pem.*?at\s+([^\s]+)/i);
+                        return pathMatch ? pathMatch[1] : null;
+                    };
+                    const extractLoginUrl = (text) => {
+                        // Look for URLs in the output
+                        const urlPatterns = [
+                            /https:\/\/dash\.cloudflare\.com\/argotunnel[^\s\)]+/g,
+                            /https:\/\/[^\s\)]+cloudflareaccess\.org[^\s\)]+/g,
+                            /https:\/\/[^\s\)]+cloudflare\.com[^\s\)]+/g
+                        ];
+                        for (const pattern of urlPatterns) {
+                            const matches = text.match(pattern);
+                            if (matches && matches.length > 0) {
+                                return matches[0];
+                            }
+                        }
+                        return null;
+                    };
+                    loginProcess.stdout.on('data', (data) => {
+                        const text = data.toString();
+                        stdout += text;
+                        // Check for already logged in error
+                        if (text.includes('existing certificate') || text.includes('cert.pem which login would overwrite')) {
+                            alreadyLoggedIn = true;
+                            const extractedPath = extractCertPath(text);
+                            if (extractedPath) {
+                                certPath = extractedPath;
+                            }
+                        }
+                        // Extract login URL if not already logged in
+                        if (!alreadyLoggedIn && !urlEmitted) {
+                            const url = extractLoginUrl(text);
+                            if (url) {
+                                urlEmitted = true;
+                                socket.emit('cloudflared:login:url', { loginUrl: url });
+                            }
+                        }
+                    });
+                    loginProcess.stderr.on('data', (data) => {
+                        const text = data.toString();
+                        stderr += text;
+                        // Check for already logged in error (often in stderr)
+                        if (text.includes('existing certificate') || text.includes('cert.pem which login would overwrite')) {
+                            alreadyLoggedIn = true;
+                            const extractedPath = extractCertPath(text);
+                            if (extractedPath) {
+                                certPath = extractedPath;
+                            }
+                        }
+                        // Extract login URL if not already logged in
+                        if (!alreadyLoggedIn && !urlEmitted) {
+                            const url = extractLoginUrl(text);
+                            if (url) {
+                                urlEmitted = true;
+                                socket.emit('cloudflared:login:url', { loginUrl: url });
+                            }
+                        }
+                    });
+                    loginProcess.on('close', async (code) => {
+                        if (alreadyLoggedIn && certPath) {
+                            // Already logged in - extract credentials from existing cert
+                            try {
+                                if (foreground) {
+                                    console.log(`Already logged in, extracting credentials from ${certPath}`);
+                                }
+                                const certContent = await fs.readFile(certPath, 'utf-8');
+                                const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/);
+                                if (tokenMatch && tokenMatch[1]) {
+                                    const tokenBase64 = tokenMatch[1].replace(/\s/g, '');
+                                    const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8');
+                                    const tokenData = JSON.parse(tokenJson);
+                                    if (foreground) {
+                                        console.log(`✓ Extracted credentials from existing cert`);
+                                    }
+                                    socket.emit('cloudflared:login:complete', {
+                                        accountId: tokenData.accountID,
+                                        accountName: undefined,
+                                        apiToken: tokenData.apiToken,
+                                        zoneId: tokenData.zoneID
+                                    });
+                                }
+                                else {
+                                    const error = 'Failed to extract token from existing cert.pem';
+                                    if (foreground) {
+                                        console.error(`✗ ${error}`);
+                                    }
+                                    socket.emit('cloudflared:login:error', { error });
+                                }
+                            }
+                            catch (error) {
+                                const errorMsg = `Failed to read cert.pem: ${error.message}`;
+                                if (foreground) {
+                                    console.error(`✗ ${errorMsg}`);
+                                }
+                                socket.emit('cloudflared:login:error', { error: errorMsg });
+                            }
+                        }
+                        else if (code === 0 && !alreadyLoggedIn) {
+                            // Login completed successfully - wait a moment then extract credentials
+                            if (foreground) {
+                                console.log('Login completed, extracting credentials...');
+                            }
+                            setTimeout(async () => {
+                                try {
+                                    const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem');
+                                    const certContent = await fs.readFile(certPath, 'utf-8');
+                                    const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/);
+                                    if (tokenMatch && tokenMatch[1]) {
+                                        const tokenBase64 = tokenMatch[1].replace(/\s/g, '');
+                                        const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8');
+                                        const tokenData = JSON.parse(tokenJson);
+                                        if (foreground) {
+                                            console.log(`✓ Extracted credentials after login`);
+                                        }
+                                        socket.emit('cloudflared:login:complete', {
+                                            accountId: tokenData.accountID,
+                                            accountName: undefined,
+                                            apiToken: tokenData.apiToken,
+                                            zoneId: tokenData.zoneID
+                                        });
+                                    }
+                                    else {
+                                        const error = 'Failed to extract token from cert.pem after login';
+                                        if (foreground) {
+                                            console.error(`✗ ${error}`);
+                                        }
+                                        socket.emit('cloudflared:login:error', { error });
+                                    }
+                                }
+                                catch (error) {
+                                    const errorMsg = `Failed to read cert.pem after login: ${error.message}`;
+                                    if (foreground) {
+                                        console.error(`✗ ${errorMsg}`);
+                                    }
+                                    socket.emit('cloudflared:login:error', { error: errorMsg });
+                                }
+                            }, 1000); // Wait 1 second for file to be written
+                        }
+                        else if (!alreadyLoggedIn) {
+                            const error = `Login failed with code ${code}: ${stderr || stdout}`;
+                            if (foreground) {
+                                console.error(`✗ ${error}`);
+                            }
+                            socket.emit('cloudflared:login:error', { error });
+                        }
+                    });
+                    loginProcess.on('error', (error) => {
+                        socket.emit('cloudflared:login:error', { error: error.message });
+                    });
+                }
+                catch (error) {
+                    socket.emit('cloudflared:login:error', { error: error.message });
+                }
+            });
+            socket.on('cloudflared:regenerate:request', async () => {
+                try {
+                    const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem');
+                    // Delete existing cert.pem
+                    try {
+                        await fs.unlink(certPath);
+                        if (foreground) {
+                            console.log(`✓ Deleted existing cert.pem`);
+                        }
+                    }
+                    catch (error) {
+                        // File might not exist, that's okay
+                        if (foreground && error.code !== 'ENOENT') {
+                            console.log(`Note: Could not delete cert.pem: ${error.message}`);
+                        }
+                    }
+                    // Emit success - frontend will then trigger login
+                    socket.emit('cloudflared:regenerate:complete', {});
+                }
+                catch (error) {
+                    socket.emit('cloudflared:regenerate:error', { error: error.message });
+                }
+            });
+            socket.on('cloudflared:login:request', async () => {
+                try {
+                    // First check if cloudflared is installed
+                    try {
+                        execSync('which cloudflared', { stdio: 'ignore' });
+                    }
+                    catch {
+                        socket.emit('cloudflared:login:error', { error: 'cloudflared is not installed' });
+                        return;
+                    }
+                    // Run cloudflared tunnel login
+                    // This command outputs a URL that needs to be visited
+                    const loginProcess = spawn('cloudflared', ['tunnel', 'login'], {
+                        stdio: ['ignore', 'pipe', 'pipe']
+                    });
+                    let stdout = '';
+                    let stderr = '';
+                    let urlEmitted = false;
+                    const findAndEmitUrl = (text) => {
+                        if (urlEmitted)
+                            return;
+                        // Look for URL in output - cloudflared outputs URLs in various formats
+                        const urlPatterns = [
+                            /https:\/\/[^\s\)]+/g,
+                            /https:\/\/[^\n]+/g
+                        ];
+                        for (const pattern of urlPatterns) {
+                            const matches = text.match(pattern);
+                            if (matches && matches.length > 0) {
+                                // Find the login URL (usually contains "cloudflareaccess.com" or similar)
+                                const loginUrl = matches.find(url => url.includes('cloudflareaccess.com') ||
+                                    url.includes('cloudflare.com') ||
+                                    url.includes('trycloudflare.com') ||
+                                    url.includes('dash.cloudflare.com'));
+                                if (loginUrl) {
+                                    urlEmitted = true;
+                                    socket.emit('cloudflared:login:url', { loginUrl: loginUrl.trim() });
+                                    return;
+                                }
+                            }
+                        }
+                    };
+                    loginProcess.stdout.on('data', (data) => {
+                        const text = data.toString();
+                        stdout += text;
+                        findAndEmitUrl(text);
+                    });
+                    loginProcess.stderr.on('data', (data) => {
+                        const text = data.toString();
+                        stderr += text;
+                        // cloudflared often outputs URLs to stderr
+                        findAndEmitUrl(text);
+                    });
+                    loginProcess.on('close', async (code) => {
+                        if (code === 0) {
+                            // Login successful, extract API token from cert.pem
+                            try {
+                                const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem');
+                                const certContent = await fs.readFile(certPath, 'utf-8');
+                                // Extract token between BEGIN and END markers
+                                const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/);
+                                if (tokenMatch && tokenMatch[1]) {
+                                    // Decode base64 token
+                                    const tokenBase64 = tokenMatch[1].replace(/\s/g, '');
+                                    const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8');
+                                    const tokenData = JSON.parse(tokenJson);
+                                    // Extract API token, account ID, and zone ID
+                                    const apiToken = tokenData.apiToken;
+                                    const accountId = tokenData.accountID;
+                                    const zoneId = tokenData.zoneID;
+                                    socket.emit('cloudflared:login:complete', {
+                                        accountId,
+                                        accountName: undefined,
+                                        apiToken,
+                                        zoneId
+                                    });
+                                }
+                                else {
+                                    socket.emit('cloudflared:login:error', {
+                                        error: 'Failed to extract token from cert.pem'
+                                    });
+                                }
+                            }
+                            catch (error) {
+                                socket.emit('cloudflared:login:error', {
+                                    error: `Failed to read cert.pem: ${error.message}`
+                                });
+                            }
+                        }
+                        else {
+                            socket.emit('cloudflared:login:error', {
+                                error: `Login failed with code ${code}: ${stderr}`
+                            });
+                        }
+                    });
+                    loginProcess.on('error', (error) => {
+                        socket.emit('cloudflared:login:error', { error: error.message });
+                    });
+                }
+                catch (error) {
+                    socket.emit('cloudflared:login:error', { error: error.message });
+                }
+            });
+            // ========== Container Management Handlers ==========
+            // Check if container runtime is available
+            socket.on('container:check:request', async () => {
+                try {
+                    let enabled = false;
+                    let runtime;
+                    let version = '';
+                    try {
+                        // Check for docker first
+                        execSync('which docker', { stdio: 'ignore' });
+                        runtime = 'docker';
+                        version = execSync('docker --version', { encoding: 'utf-8' }).trim();
+                        enabled = true;
+                    }
+                    catch {
+                        try {
+                            // Check for podman as fallback
+                            execSync('which podman', { stdio: 'ignore' });
+                            runtime = 'podman';
+                            version = execSync('podman --version', { encoding: 'utf-8' }).trim();
+                            enabled = true;
+                        }
+                        catch {
+                            enabled = false;
+                        }
+                    }
+                    socket.emit('container:check:response', { enabled, runtime, version });
+                    if (foreground) {
+                        console.log(`Container runtime check: ${enabled ? `${runtime} (${version})` : 'Not found'}`);
+                    }
+                }
+                catch (error) {
+                    socket.emit('container:check:response', { enabled: false, runtime: undefined, version: '' });
+                }
+            });
+            // List all containers
+            socket.on('container:list:request', async () => {
+                try {
+                    const runtime = getContainerRuntime();
+                    if (!runtime) {
+                        socket.emit('container:list:response', { success: false, error: 'No container runtime found' });
+                        return;
+                    }
+                    // List all containers including stopped ones
+                    const output = execSync(`${runtime} ps -a --format "{{json .}}"`, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
+                    const containers = output.trim().split('\n').filter(Boolean).map(line => {
+                        try {
+                            const c = JSON.parse(line);
+                            // Parse ports from the PORTS column (format: "0.0.0.0:8080->80/tcp, 0.0.0.0:9090->9090/tcp")
+                            const ports = [];
+                            if (c.Ports) {
+                                const portMatches = c.Ports.match(/(\d+)->(\d+)/g);
+                                if (portMatches) {
+                                    portMatches.forEach((p) => {
+                                        const [host, container] = p.split('->').map(Number);
+                                        ports.push({ host, container });
+                                    });
+                                }
+                            }
+                            return {
+                                containerId: c.ID,
+                                name: c.Names.replace(/^\//, ''), // Remove leading slash
+                                image: c.Image,
+                                status: c.State === 'running' ? 'running' : c.State === 'paused' ? 'paused' : c.Status === 'exited' ? 'exited' : 'stopped',
+                                ports,
+                                createdAt: new Date(c.CreatedAt).toISOString()
+                            };
+                        }
+                        catch {
+                            return null;
+                        }
+                    }).filter(Boolean);
+                    socket.emit('container:list:response', { success: true, containers });
+                }
+                catch (error) {
+                    socket.emit('container:list:response', { success: false, error: error.message });
+                }
+            });
+            // Start a new container
+            socket.on('container:start:request', async (data) => {
+                try {
+                    const runtime = getContainerRuntime();
+                    if (!runtime) {
+                        socket.emit('container:start:response', { success: false, error: 'No container runtime found' });
+                        return;
+                    }
+                    const { name, image, ports = [], env = {}, runAsRoot = false } = data;
+                    // Get CLI directory path (where this script is running from)
+                    // Use the same pattern as elsewhere in the file
+                    const cliDir = path.dirname(CURRENT_FILE);
+                    // Build docker run command
+                    let cmd = `${runtime} run -d --name ${name}`;
+                    // Security: Running as root INSIDE container is safe - it's still isolated from host
+                    // Root inside container cannot access host filesystem (read-only mounts)
+                    // Default to root to allow package installation and full container functionality
+                    // Set runAsRoot: false to run as non-root user (UID 1000) if needed
+                    if (!runAsRoot) {
+                        cmd += ' --user 1000:1000';
+                    }
+                    // Resource limits
+                    cmd += ' --memory=8g'; // Limit memory to 8GB
+                    // Auto-remove on exit (optional - commented out for persistence)
+                    // cmd += ' --rm'
+                    // Mount CLI directory into container
+                    cmd += ` -v "${cliDir}:/opt/ttc:ro"`;
+                    // Mount entrypoint script
+                    const entrypointScript = path.join(cliDir, 'container-entrypoint.sh');
+                    cmd += ` -v "${entrypointScript}:/entrypoint.sh:ro"`;
+                    // Port mappings
+                    ports.forEach(p => {
+                        cmd += ` -p ${p.host}:${p.container}`;
+                    });
+                    // Environment variables
+                    Object.entries(env).forEach(([k, v]) => {
+                        // Escape quotes in env values
+                        const escapedValue = String(v).replace(/"/g, '\\"');
+                        cmd += ` -e ${k}="${escapedValue}"`;
+                    });
+                    // Add container-specific environment variables
+                    cmd += ` -e CONTAINER_NAME="${name}"`;
+                    cmd += ` -e HOSTNAME="${name}"`;
+                    // Use entrypoint script
+                    cmd += ` --entrypoint /bin/sh ${image} /entrypoint.sh`;
+                    if (foreground) {
+                        console.log(`Starting container: ${cmd}`);
+                    }
+                    // Pull image if not exists, then run
+                    try {
+                        execSync(`${runtime} pull ${image}`, { stdio: 'ignore' });
+                    }
+                    catch {
+                        // Pull failed, but might already exist locally
+                    }
+                    const output = execSync(cmd, { encoding: 'utf-8', stdio: 'pipe' });
+                    const containerId = output.trim();
+                    socket.emit('container:start:response', { success: true, containerId });
+                    if (foreground) {
+                        console.log(`✓ Container started: ${containerId}`);
+                    }
+                }
+                catch (error) {
+                    socket.emit('container:start:response', { success: false, error: error.message });
+                }
+            });
+            // Stop a container
+            socket.on('container:stop:request', async (data) => {
+                try {
+                    const runtime = getContainerRuntime();
+                    if (!runtime) {
+                        socket.emit('container:stop:response', { success: false, error: 'No container runtime found' });
+                        return;
+                    }
+                    const { containerId } = data;
+                    execSync(`${runtime} stop ${containerId}`, { stdio: 'ignore' });
+                    socket.emit('container:stop:response', { success: true });
+                    if (foreground) {
+                        console.log(`✓ Container stopped: ${containerId}`);
+                    }
+                }
+                catch (error) {
+                    socket.emit('container:stop:response', { success: false, error: error.message });
+                }
+            });
+            // Remove a container
+            socket.on('container:remove:request', async (data) => {
+                try {
+                    const runtime = getContainerRuntime();
+                    if (!runtime) {
+                        socket.emit('container:remove:response', { success: false, error: 'No container runtime found' });
+                        return;
+                    }
+                    const { containerId } = data;
+                    // Force remove even if running
+                    execSync(`${runtime} rm -f ${containerId}`, { stdio: 'ignore' });
+                    socket.emit('container:remove:response', { success: true });
+                    if (foreground) {
+                        console.log(`✓ Container removed: ${containerId}`);
+                    }
+                }
+                catch (error) {
+                    socket.emit('container:remove:response', { success: false, error: error.message });
+                }
+            });
+            // Get container logs
+            socket.on('container:logs:request', async (data) => {
+                try {
+                    const runtime = getContainerRuntime();
+                    if (!runtime) {
+                        socket.emit('container:logs:response', { success: false, error: 'No container runtime found' });
+                        return;
+                    }
+                    const { containerId, lines = 100 } = data;
+                    const logs = execSync(`${runtime} logs --tail ${lines} ${containerId}`, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
+                    socket.emit('container:logs:response', { success: true, logs });
+                }
+                catch (error) {
+                    socket.emit('container:logs:response', { success: false, error: error.message });
+                }
+            });
+            // Helper function to get available container runtime
+            function getContainerRuntime() {
+                try {
+                    execSync('which docker', { stdio: 'ignore' });
+                    return 'docker';
+                }
+                catch {
+                    try {
+                        execSync('which podman', { stdio: 'ignore' });
+                        return 'podman';
+                    }
+                    catch {
+                        return null;
+                    }
+                }
+            }
+            socket.on('disconnect', (reason) => {
+                if (foreground) {
+                    console.log(`\n⚠️  Disconnected: ${reason}`);
+                    console.log('   Attempting to reconnect...');
+                }
+                else {
+                    console.log(`Disconnected: ${reason}`);
+                }
+                // Clear heartbeat interval
+                if (socket.heartbeatInterval) {
+                    clearInterval(socket.heartbeatInterval);
+                }
+                if (reason === 'io server disconnect') {
+                    // Server disconnected, reconnect manually
+                    socket.connect();
+                }
+                else {
+                    // Client disconnect or transport close: schedule full reconnect so process stays alive
+                    if (reconnectTimeout)
+                        clearTimeout(reconnectTimeout);
+                    const delay = 2000;
+                    if (!foreground)
+                        console.log(`Reconnecting in ${delay}ms...`);
+                    reconnectTimeout = setTimeout(connectAndRegister, delay);
+                }
+            });
+            socket.on('connect_error', (err) => {
+                reconnectAttempts++;
+                if (foreground) {
+                    console.error(`✗ Connection error (attempt ${reconnectAttempts}): ${err.message}`);
+                    if (err.type) {
+                        console.error(`   Error type: ${err.type}`);
+                    }
+                    if (err.description) {
+                        console.error(`   Error description: ${err.description}`);
+                    }
+                    console.error(`   Connecting to: ${config.apiUrl}`);
+                    if (err.cause) {
+                        console.error(`   Cause:`, err.cause);
+                    }
+                }
+                else {
+                    console.error(`Connection error (attempt ${reconnectAttempts}):`, err.message);
+                }
+            });
+            // Keep process alive
+            socket.on('error', (err) => {
+                if (foreground) {
+                    console.error(`✗ Socket error: ${err}`);
+                }
+                else {
+                    console.error('Socket error:', err);
+                }
+            });
+        }
+        catch (error) {
+            if (foreground) {
+                console.error(`✗ Failed to connect: ${error.message}`);
+            }
+            else {
+                console.error('Failed to connect:', error.message);
+            }
+            reconnectAttempts++;
+            if (reconnectAttempts < MAX_RECONNECT_ATTEMPTS) {
+                const delay = Math.min(1000 * Math.pow(2, reconnectAttempts), 30000);
+                if (foreground) {
+                    console.log(`⏳ Reconnecting in ${delay}ms...`);
+                }
+                else {
+                    console.log(`Reconnecting in ${delay}ms...`);
+                }
+                reconnectTimeout = setTimeout(connectAndRegister, delay);
+            }
+        }
+    };
+    // Handle graceful shutdown
+    const shutdown = () => {
+        if (foreground) {
+            console.log('\n\n🛑 Shutting down gracefully...');
+        }
+        else {
+            console.log('\nShutting down...');
+        }
+        if (reconnectTimeout) {
+            clearTimeout(reconnectTimeout);
+        }
+        if (socket) {
+            // Clear heartbeat interval
+            if (socket.heartbeatInterval) {
+                clearInterval(socket.heartbeatInterval);
+            }
+            socket.disconnect();
+        }
+        process.exit(0);
+    };
+    process.on('SIGTERM', shutdown);
+    process.on('SIGINT', shutdown);
+    process.on('SIGHUP', shutdown);
+    // Start connection
+    await connectAndRegister();
+    // Keep process alive
+    process.stdin.resume();
+}
+// ============ CLI Program ============
+const program = new Command();
+program
+    .name('ttc')
+    .description('TalkToCode CLI - Simple install and manage')
+    .version('1.0.0');
+// Config command
+program
+    .command('config')
+    .description('Get or set config (api-url)')
+    .option('--api-url <url>', 'API base URL')
+    .action(async (opts) => {
+    const config = await readConfig();
+    if (opts.apiUrl !== undefined) {
+        config.apiUrl = opts.apiUrl;
+        await writeConfig(config);
+        console.log('Set api-url:', config.apiUrl);
+    }
+    else {
+        console.log('Config:', JSON.stringify(config, null, 2));
+    }
+    process.exit(0);
+});
+// Install command
+program
+    .command('install')
+    .description('Install and register TTC CLI (installs as pm2 daemon)')
+    .argument('[email]', 'Email address for device approval')
+    .action(async (email) => {
+    try {
+        // First register the device
+        await registerDevice(undefined, email);
+        // After successful registration, install as service (Linux only)
+        if (process.platform === 'win32') {
+            console.log('\n✓ Device registered.');
+            console.log('On Windows, run the daemon manually: ttc daemon');
+            console.log('To run in background: start /B node path\\to\\ttc daemon');
+        }
+        else {
+            console.log('\n📦 Installing TTC with pm2...');
+            // install-service.sh: bundled at __dirname, or in ~/.talk-to-code for curl install
+            let installScript = path.join(__dirname, 'install-service.sh');
+            if (!fsSync.existsSync(installScript)) {
+                installScript = path.join(CONFIG_DIR, 'install-service.sh');
+            }
+            if (!fsSync.existsSync(installScript)) {
+                installScript = path.join(__dirname, '..', 'install-service.sh');
+            }
+            const scriptDir = path.dirname(installScript);
+            try {
+                await fs.access(installScript);
+                const { execSync } = await import('child_process');
+                execSync(`bash "${installScript}"`, {
+                    stdio: 'inherit',
+                    cwd: scriptDir,
+                    env: { ...process.env, PATH: process.env.PATH }
+                });
+                console.log('\n✓ TTC installation complete!');
+                console.log('The service is now running in the background.');
+            }
+            catch (scriptErr) {
+                const err = scriptErr;
+                console.log('\n⚠ Service installation had issues, but device is registered.');
+                if (err.message)
+                    console.error('Error:', err.message);
+                console.log('You can start the daemon manually with: ttc daemon');
+            }
+        }
+    }
+    catch (error) {
+        const errorMsg = error.message;
+        if (errorMsg.includes('approval') || errorMsg.includes('email')) {
+            // Registration failed - exit with error
+            process.exit(1);
+        }
+        // Service installation failed, but device is registered
+        console.log('\n⚠ Service installation had issues, but device is registered.');
+        console.log('You can start the daemon manually with: ttc daemon');
+    }
+    // Exit after install is complete
+    process.exit(0);
+});
+// Uninstall command
+program
+    .command('uninstall')
+    .description('Uninstall TTC CLI (removes service and config)')
+    .action(async () => {
+    console.log('🗑️  Uninstalling TTC CLI...');
+    if (process.platform === 'win32') {
+        console.log('On Windows there is no service to remove.');
+        console.log('To remove TTC completely:');
+        console.log('  1. Delete the ttc executable or folder');
+        console.log('  2. Remove config: rmdir /s /q "%USERPROFILE%\\.talk-to-code"');
+    }
+    else {
+        let installScript = path.join(__dirname, 'install-service.sh');
+        if (!fsSync.existsSync(installScript))
+            installScript = path.join(CONFIG_DIR, 'install-service.sh');
+        if (!fsSync.existsSync(installScript))
+            installScript = path.join(__dirname, '..', 'install-service.sh');
+        const scriptDir = path.dirname(installScript);
+        try {
+            await fs.access(installScript);
+            const { execSync } = await import('child_process');
+            execSync(`bash "${installScript}" --uninstall`, {
+                stdio: 'inherit',
+                cwd: scriptDir,
+                env: { ...process.env, PATH: process.env.PATH }
+            });
+            console.log('\n✓ Service uninstalled!');
+            console.log('To remove TTC completely, delete the binary:');
+            console.log('  rm ~/.local/bin/ttc');
+        }
+        catch (error) {
+            console.log('\n⚠ Service uninstall script not found or failed.');
+            console.log('To remove TTC completely, delete:');
+            console.log('  rm ~/.local/bin/ttc');
+            console.log('  rm -rf ~/.talk-to-code');
+        }
+    }
+    // Exit after uninstall is complete
+    process.exit(0);
+});
+// Update command
+program
+    .command('update')
+    .description('Check for and apply CLI updates')
+    .option('-f, --force', 'Update without confirmation')
+    .action(async (options) => {
+    await selfUpdate(options.force);
+    process.exit(0);
+});
+program
+    .command('check-update')
+    .description('Check for updates')
+    .action(async () => {
+    const info = await checkForUpdate();
+    if (!info)
+        process.exit(1);
+    if (!info.updateAvailable) {
+        console.log('✓ Up to date');
+        process.exit(0);
+    }
+    console.log('📦 Update available');
+    console.log('Run "ttc update" to install');
+    process.exit(0);
+});
+// Run (connect to backend and process prompts)
+program
+    .command('run')
+    .description('Run CLI and connect to backend')
+    .option('--email <email>', 'Email for device approval')
+    .action((options) => {
+    runDaemon(false, options.email).catch((error) => {
+        console.error('Run error:', error.message);
+        process.exit(1);
+    });
+});
+// Hidden daemon command (internal alias)
+program
+    .command('daemon', { hidden: true })
+    .description('Run daemon (internal)')
+    .option('--foreground', 'Run in foreground', false)
+    .option('--email <email>', 'Email address')
+    .action((options) => {
+    runDaemon(options.foreground, options.email).catch((error) => {
+        console.error('Daemon error:', error.message);
+        process.exit(1);
+    });
+});
+program.parse();