@exreve/exk 1.0.44 → 1.0.46

package/dist/app-child.js

@@ -18,10 +18,14 @@ import { Buffer } from 'buffer';
 import crypto from 'crypto';
 import { createProject, deleteProject } from './projectManager.js';
 import { agentSessionManager } from './agentSession.js';
-import { getProjectConfig, analyzeProjectWithClaude, saveProjectConfig } from './projectAnalyzer.js';
-import { generateRunnerCode } from './runnerGenerator.js';
-import { startApp, stopApp, restartApp, getAppStatuses, getAppLogs } from './appManager.js';
-import { spawn, execSync } from 'child_process';
+import { registerGitHubHandlers } from './githubHandlers.js';
+import { registerCloudflaredHandlers } from './cloudflaredHandlers.js';
+import { registerContainerHandlers } from './containerHandlers.js';
+import { registerSessionHandlers } from './sessionHandlers.js';
+import { registerAppHandlers } from './appHandlers.js';
+import { registerFsHandlers } from './fsHandlers.js';
+import { registerUpdateHandlers } from './updateHandlers.js';
+import { execSync } from 'child_process';
 import readline from 'readline';
 import { fileURLToPath } from 'url';
 import { createHash } from 'crypto';
@@ -41,21 +45,6 @@ function requestUpdateFromParent() {
         }
     }
 }
-/**
- * Notify parent that we want to restart after update
- */
-function requestRestartFromParent() {
-    const updaterPid = process.env.TTC_UPDATER_PID;
-    if (updaterPid) {
-        try {
-            // Send SIGUSR2 to parent to request restart
-            process.kill(parseInt(updaterPid, 10), 'SIGUSR2');
-        }
-        catch (error) {
-            console.error('Failed to request restart from parent:', error);
-        }
-    }
-}
 // ============ Constants ============
 const CONFIG_DIR = path.join(os.homedir(), '.talk-to-code');
 const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
@@ -104,9 +93,27 @@ async function fetchAiConfig(authToken) {
         return false;
     }
 }
-function hasAiCredentials() {
+/** TTL cache for ai-config.json reads */
+let _aiCfgCache = null;
+const _AI_CFG_TTL = 5_000;
+function readAiConfigCached() {
+    const now = Date.now();
+    if (_aiCfgCache && (now - _aiCfgCache.ts) < _AI_CFG_TTL)
+        return _aiCfgCache.raw;
     try {
         const raw = fsSync.readFileSync(AI_CONFIG_FILE, 'utf-8');
+        _aiCfgCache = { raw, ts: now };
+        return raw;
+    }
+    catch {
+        return '';
+    }
+}
+function hasAiCredentials() {
+    try {
+        const raw = readAiConfigCached();
+        if (!raw)
+            return false;
         const j = JSON.parse(raw);
         return typeof j.authToken === 'string' && j.authToken.trim().length > 0;
     }
@@ -464,136 +471,6 @@ async function registerDevice(name, email) {
         throw error;
     }
 }
-async function listSessions() {
-    try {
-        const socket = await connect();
-        socket.emit('sessions:list', (response) => {
-            const { sessions } = response;
-            console.log('\nSessions:');
-            console.log('-'.repeat(60));
-            sessions.forEach((session, idx) => {
-                console.log(`${idx + 1}. ${session.id}`);
-                console.log(`   Created: ${new Date(session.createdAt).toLocaleString()}`);
-                console.log();
-            });
-            socket.disconnect();
-        });
-    }
-    catch (error) {
-        console.error('Failed to list sessions:', error.message);
-        process.exit(1);
-    }
-}
-async function createSession() {
-    try {
-        const socket = await connect();
-        socket.emit('session:create', (response) => {
-            const { success, session } = response;
-            if (success && session) {
-                console.log('Session created!');
-                console.log('Session ID:', session.id);
-                socket.disconnect();
-            }
-        });
-    }
-    catch (error) {
-        console.error('Failed to create session:', error.message);
-        process.exit(1);
-    }
-}
-async function sendPrompt(sessionId, prompt) {
-    try {
-        const socket = await connect();
-        socket.emit('session:subscribe', { sessionId });
-        socket.on('prompt:output', ({ data, type }) => {
-            if (type === 'stdout') {
-                process.stdout.write(data);
-            }
-            else {
-                process.stderr.write(data);
-            }
-        });
-        socket.on('session:exited', ({ exitCode }) => {
-            console.log(`\nSession exited with code ${exitCode}`);
-            socket.disconnect();
-        });
-        socket.emit('session:prompt', { sessionId, prompt }, ({ success }) => {
-            if (!success) {
-                console.error('Failed to send prompt');
-                socket.disconnect();
-            }
-        });
-        process.on('SIGINT', () => {
-            socket.emit('session:unsubscribe', { sessionId });
-            socket.disconnect();
-            process.exit(0);
-        });
-    }
-    catch (error) {
-        console.error('Failed to send prompt:', error.message);
-        process.exit(1);
-    }
-}
-async function listDevices() {
-    try {
-        const socket = await connect();
-        socket.emit('devices:list', (response) => {
-            const { devices } = response;
-            console.log('\nRegistered Devices:');
-            console.log('-'.repeat(60));
-            devices.forEach((device, idx) => {
-                console.log(`${idx + 1}. ${device.name}`);
-                console.log(`   ID: ${device.deviceId}`);
-                console.log(`   IP Address: ${device.ipAddress || 'Unknown'}`);
-                console.log(`   Hostname: ${device.hostname || 'Unknown'}`);
-                console.log(`   Registered: ${new Date(device.registeredAt).toLocaleString()}`);
-                console.log(`   Last Seen: ${new Date(device.lastSeen).toLocaleString()}`);
-                console.log();
-            });
-            socket.disconnect();
-        });
-    }
-    catch (error) {
-        console.error('Failed to list devices:', error.message);
-        process.exit(1);
-    }
-}
-async function monitorSession(sessionId) {
-    try {
-        const socket = await connect();
-        console.log(`Monitoring session ${sessionId}...`);
-        console.log('Press Ctrl+C to stop\n');
-        socket.emit('session:subscribe', { sessionId });
-        socket.on('session:state', ({ outputs, isActive }) => {
-            console.log(`Session active: ${isActive}`);
-            console.log('Recent output:');
-            outputs.slice(-10).forEach(({ type, data }) => {
-                if (type === 'stdout') {
-                    const dataString = typeof data === 'string' ? data : JSON.stringify(data);
-                    process.stdout.write(dataString);
-                }
-            });
-        });
-        socket.on('prompt:output', ({ data, type }) => {
-            if (type === 'stdout') {
-                process.stdout.write(data);
-            }
-        });
-        socket.on('session:exited', ({ exitCode }) => {
-            console.log(`\nSession exited with code ${exitCode}`);
-            socket.disconnect();
-        });
-        process.on('SIGINT', () => {
-            socket.emit('session:unsubscribe', { sessionId });
-            socket.disconnect();
-            process.exit(0);
-        });
-    }
-    catch (error) {
-        console.error('Failed to monitor session:', error.message);
-        process.exit(1);
-    }
-}
 // Active sessions map - persists across reconnections
 const activeSessions = new Map();
 async function runDaemon(foreground = false, email) {
@@ -648,6 +525,8 @@ async function runDaemon(foreground = false, email) {
                 forceNew: true,
                 upgrade: true,
             });
+            // Wire socket reference for agentSession to fetch history from backend
+            agentSessionManager.setSocketRef(socket);
             if (foreground) {
                 console.log(`Attempting to connect to: ${config.apiUrl}`);
             }
@@ -723,1556 +602,166 @@ async function runDaemon(foreground = false, email) {
                     callback?.({ success: false, error: error.message });
                 }
             });
-            // GitHub handlers
-            socket.on('github:status', async (data, callback) => {
-                try {
-                    const { projectPath } = data;
-                    // Check if directory is a git repository
-                    const gitDir = path.join(projectPath, '.git');
-                    let isRepo = false;
-                    try {
-                        const stats = await fs.stat(gitDir);
-                        isRepo = stats.isDirectory();
-                    }
-                    catch {
-                        isRepo = false;
-                    }
-                    if (!isRepo) {
-                        callback?.({ success: true, isRepo: false, hasChanges: false });
-                        return;
-                    }
-                    // Check git status
-                    const { execSync } = await import('child_process');
-                    try {
-                        // Get current branch
-                        const branch = execSync('git rev-parse --abbrev-ref HEAD', { cwd: projectPath, encoding: 'utf-8' }).trim();
-                        // Get remote URL
-                        let remote;
-                        try {
-                            remote = execSync('git config --get remote.origin.url', { cwd: projectPath, encoding: 'utf-8' }).trim();
-                        }
-                        catch {
-                            // No remote configured
-                        }
-                        // Check for actual changes (modified, staged, deleted files - ignore untracked)
-                        // Use --short to get concise output, and check for actual changes (not just untracked files)
-                        let hasChanges = false;
-                        const changedFiles = [];
-                        try {
-                            const statusOutput = execSync('git status --porcelain', { cwd: projectPath, encoding: 'utf-8' });
-                            const lines = statusOutput.trim().split('\n').filter(line => line.trim().length > 0);
-                            for (const line of lines) {
-                                const status = line.substring(0, 2).trim();
-                                const filePath = line.substring(2).trim();
-                                // Skip untracked files (??)
-                                if (line.startsWith('??'))
-                                    continue;
-                                // Include modified (M), added (A), deleted (D), renamed (R), copied (C)
-                                if (status.includes('M') || status.includes('A') || status.includes('D') || status.includes('R') || status.includes('C')) {
-                                    hasChanges = true;
-                                    changedFiles.push({ path: filePath, status });
-                                }
-                            }
-                        }
-                        catch {
-                            hasChanges = false;
-                        }
-                        callback?.({ success: true, isRepo: true, hasChanges, branch, remote, changedFiles, changesCount: changedFiles.length });
-                    }
-                    catch (error) {
-                        callback?.({ success: false, error: error.message });
+            // GitHub handlers (extracted to cli/githubHandlers.ts)
+            registerGitHubHandlers(socket, foreground);
+            // FS handlers (extracted to cli/fsHandlers.ts)
+            registerFsHandlers(socket);
+            // Update handlers (extracted to cli/updateHandlers.ts)
+            registerUpdateHandlers(socket, foreground, readConfig, requestUpdateFromParent);
+            // Session handlers (extracted to cli/sessionHandlers.ts)
+            registerSessionHandlers(socket, foreground, activeSessions, () => socket);
+            // App control handlers (extracted to cli/appHandlers.ts)
+            registerAppHandlers(socket, foreground);
+            socket.on('connect', () => {
+                if (foreground) {
+                    console.log(`✓ Connected to backend at ${config.apiUrl}`);
+                    if (socket) {
+                        console.log(`   Socket ID: ${socket.id}`);
                     }
                 }
-                catch (error) {
-                    callback?.({ success: false, error: error.message });
+                else {
+                    console.log('Connected to backend');
+                }
+                reconnectAttempts = 0;
+                // Register as CLI device
+                if (socket) {
+                    socket.emit('register', { type: 'cli', deviceId });
                 }
             });
-            socket.on('github:commit', async (data, callback) => {
-                try {
-                    const { projectPath, message = 'changes' } = data;
-                    // Check if directory is a git repository
-                    const gitDir = path.join(projectPath, '.git');
-                    let isRepo = false;
+            socket.on('registered', async ({ type }) => {
+                if (foreground) {
+                    console.log(`✓ Registered as ${type}`);
+                }
+                else {
+                    console.log(`Registered as ${type}`);
+                }
+                // Check for auth token: env TTC_AUTH_TOKEN or device-config.json (from previous approval)
+                let authToken = process.env.TTC_AUTH_TOKEN;
+                let deviceEmail = email;
+                let skipEmailFlow = false;
+                // Load from device-config if no env token (reuse state from previous approval)
+                if (!authToken) {
                     try {
-                        const stats = await fs.stat(gitDir);
-                        isRepo = stats.isDirectory();
+                        const deviceConfig = await readDiskDeviceConfig();
+                        authToken = deviceConfig.authToken;
+                        if (!deviceEmail && deviceConfig.email)
+                            deviceEmail = deviceConfig.email;
                     }
                     catch {
-                        callback?.({ success: false, error: 'Not a git repository' });
-                        return;
+                        // No device config yet
                     }
-                    const { execSync } = await import('child_process');
+                }
+                if (authToken) {
                     try {
-                        // Stage all changes
-                        execSync('git add -A', { cwd: projectPath });
-                        // Commit with message
-                        execSync(`git commit -m "${message.replace(/"/g, '\\"')}"`, { cwd: projectPath });
-                        // Determine which branch to push to (master or main)
-                        let targetBranch;
-                        try {
-                            // Check if master branch exists
-                            execSync('git rev-parse --verify master', { cwd: projectPath, stdio: 'ignore' });
-                            targetBranch = 'master';
-                        }
-                        catch {
-                            try {
-                                // Check if main branch exists
-                                execSync('git rev-parse --verify main', { cwd: projectPath, stdio: 'ignore' });
-                                targetBranch = 'main';
-                            }
-                            catch {
-                                // Fallback to current branch if neither master nor main exists
-                                targetBranch = execSync('git rev-parse --abbrev-ref HEAD', { cwd: projectPath, encoding: 'utf-8' }).trim();
+                        const parts = authToken.split('.');
+                        if (parts.length === 3) {
+                            const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
+                            if (payload.type === 'device_auth' && payload.email) {
+                                deviceEmail = payload.email;
+                                skipEmailFlow = true;
+                                if (foreground) {
+                                    console.log(`✓ Using stored auth token for ${deviceEmail}`);
+                                }
                             }
                         }
-                        // Push to origin after commit
-                        execSync(`git push origin ${targetBranch}`, { cwd: projectPath, stdio: 'pipe' });
-                        callback?.({ success: true });
                     }
-                    catch (error) {
-                        callback?.({ success: false, error: error.message });
+                    catch (err) {
+                        if (foreground) {
+                            console.warn(`⚠️  Invalid auth token in config, falling back to normal auth`);
+                        }
+                        authToken = undefined;
                     }
                 }
-                catch (error) {
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            socket.on('github:push', async (data, callback) => {
-                try {
-                    const { projectPath } = data;
-                    // Check if directory is a git repository
-                    const gitDir = path.join(projectPath, '.git');
-                    let isRepo = false;
+                // Load device email from config if not using token and not provided
+                if (!deviceEmail && !skipEmailFlow) {
                     try {
-                        const stats = await fs.stat(gitDir);
-                        isRepo = stats.isDirectory();
+                        const deviceConfig = await readDiskDeviceConfig();
+                        deviceEmail = deviceConfig.email;
                     }
                     catch {
-                        callback?.({ success: false, error: 'Not a git repository' });
-                        return;
+                        // No device config yet
                     }
-                    const { execSync } = await import('child_process');
-                    try {
-                        // Determine which branch to push to (master or main)
-                        let targetBranch;
-                        try {
-                            // Check if master branch exists
-                            execSync('git rev-parse --verify master', { cwd: projectPath, stdio: 'ignore' });
-                            targetBranch = 'master';
+                }
+                // Register device with backend
+                let needsApprovalLoggedOnce = false;
+                const registerDevice = () => {
+                    // Determine device name
+                    const containerName = process.env.CONTAINER_NAME;
+                    const deviceName = containerName ? `Container: ${containerName}` : `CLI Device ${hostname}`;
+                    socket.emit('device:register', {
+                        deviceId,
+                        name: deviceName,
+                        ipAddress,
+                        hostname,
+                        email: deviceEmail,
+                        // When using auth token, include the token for verification
+                        authToken: skipEmailFlow ? authToken : undefined
+                    }, ({ success, needsApproval, message, device, error }) => {
+                        if (success && device) {
+                            needsApprovalLoggedOnce = false;
+                            if (foreground) {
+                                console.log(`✓ Device registered: ${device.name}`);
+                                if (device.approved) {
+                                    console.log(`✓ Device approved and ready`);
+                                }
+                            }
+                            else {
+                                console.log(`Device registered: ${device.name}${device.approved ? ' (approved)' : ' (pending approval)'}`);
+                            }
+                            // Save config: email + authToken (preserve token so next run can reuse)
+                            if (device.email) {
+                                void writeDeviceConfigMerged({
+                                    email: device.email,
+                                    ...(authToken ? { authToken } : {}),
+                                }).catch(() => { });
+                            }
+                            if (authToken) {
+                                scheduleAiConfigSync(authToken);
+                            }
                         }
-                        catch {
-                            try {
-                                // Check if main branch exists
-                                execSync('git rev-parse --verify main', { cwd: projectPath, stdio: 'ignore' });
-                                targetBranch = 'main';
+                        else if (needsApproval) {
+                            // Persist email when approval was requested so restarts don't prompt again
+                            if (deviceEmail) {
+                                void writeDeviceConfigMerged({ email: deviceEmail }).catch(() => { });
                             }
-                            catch {
-                                // Fallback to current branch if neither master nor main exists
-                                targetBranch = execSync('git rev-parse --abbrev-ref HEAD', { cwd: projectPath, encoding: 'utf-8' }).trim();
+                            // Only log once to avoid flooding logs every 30s on heartbeat
+                            if (!needsApprovalLoggedOnce) {
+                                needsApprovalLoggedOnce = true;
+                                if (foreground) {
+                                    console.log(`\n⚠️  ${message || 'Device approval required'}`);
+                                    if (!deviceEmail) {
+                                        console.log(`   Please run: npx tsx index.ts register --email your@email.com`);
+                                    }
+                                    else {
+                                        console.log(`   Check your email (${deviceEmail}) and click the approval link.`);
+                                    }
+                                }
+                                else {
+                                    console.log(`⚠️  Device approval required: ${message || 'Please approve device'}`);
+                                }
                             }
                         }
-                        // Push to origin
-                        execSync(`git push origin ${targetBranch}`, { cwd: projectPath });
-                        callback?.({ success: true });
-                    }
-                    catch (error) {
-                        callback?.({ success: false, error: error.message });
-                    }
-                }
-                catch (error) {
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            socket.on('github:discard', async (data, callback) => {
-                try {
-                    const { projectPath } = data;
-                    // Check if directory is a git repository
-                    const gitDir = path.join(projectPath, '.git');
-                    let isRepo = false;
-                    try {
-                        const stats = await fs.stat(gitDir);
-                        isRepo = stats.isDirectory();
-                    }
-                    catch {
-                        callback?.({ success: false, error: 'Not a git repository' });
-                        return;
-                    }
-                    const { execSync } = await import('child_process');
-                    try {
-                        // Discard all changes and revert to latest commit
-                        // Reset all changes (both staged and unstaged)
-                        execSync('git reset --hard HEAD', { cwd: projectPath });
-                        // Clean untracked files and directories
-                        execSync('git clean -fd', { cwd: projectPath });
-                        callback?.({ success: true });
-                    }
-                    catch (error) {
-                        callback?.({ success: false, error: error.message });
-                    }
-                }
-                catch (error) {
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            // Directory listing handler
-            socket.on('fs:list', async (data) => {
-                try {
-                    const { dirPath } = data;
-                    if (!dirPath) {
-                        socket?.emit('fs:list:response', { success: false, error: 'dirPath is required' });
-                        return;
-                    }
-                    const entries = [];
-                    try {
-                        const dirents = await fs.readdir(dirPath, { withFileTypes: true });
-                        for (const dirent of dirents) {
-                            if (dirent.name.startsWith('.'))
-                                continue; // Skip hidden files
-                            const fullPath = path.join(dirPath, dirent.name);
-                            entries.push({
-                                name: dirent.name,
-                                path: fullPath,
-                                isDir: dirent.isDirectory()
-                            });
+                        else if (error) {
+                            console.error(`✗ Registration error: ${error}`);
                         }
-                        // Sort: directories first, then alphabetically
-                        entries.sort((a, b) => {
-                            if (a.isDir && !b.isDir)
-                                return -1;
-                            if (!a.isDir && b.isDir)
-                                return 1;
-                            return a.name.localeCompare(b.name);
-                        });
-                        socket?.emit('fs:list:response', { success: true, entries });
+                    });
+                };
+                registerDevice();
+                // Update lastSeen every 30 seconds while connected
+                const heartbeatInterval = setInterval(() => {
+                    if (socket?.connected) {
+                        registerDevice();
                     }
-                    catch (err) {
-                        socket?.emit('fs:list:response', { success: false, error: err.message });
+                    else {
+                        clearInterval(heartbeatInterval);
                     }
-                }
-                catch (error) {
-                    socket?.emit('fs:list:response', { success: false, error: error.message });
-                }
+                }, 30000);
+                socket.heartbeatInterval = heartbeatInterval;
             });
-            // File write handler
-            socket.on('fs:write', async (data) => {
-                try {
-                    const { filePath, content, encoding = 'utf-8' } = data;
-                    if (!filePath) {
-                        socket?.emit('fs:write:response', { success: false, error: 'filePath is required' });
-                        return;
-                    }
-                    try {
-                        // Ensure directory exists
-                        const dir = path.dirname(filePath);
-                        await fs.mkdir(dir, { recursive: true });
-                        // Write file
-                        await fs.writeFile(filePath, content, encoding);
-                        socket?.emit('fs:write:response', { success: true });
-                    }
-                    catch (err) {
-                        socket?.emit('fs:write:response', { success: false, error: err.message });
-                    }
-                }
-                catch (error) {
-                    socket?.emit('fs:write:response', { success: false, error: error.message });
-                }
-            });
-            // File read handler
-            socket.on('fs:read', async (data) => {
-                try {
-                    const { filePath, encoding = 'utf-8' } = data;
-                    if (!filePath) {
-                        socket?.emit('fs:read:response', { success: false, error: 'filePath is required' });
-                        return;
-                    }
-                    try {
-                        // Read file
-                        const content = await fs.readFile(filePath, encoding);
-                        socket?.emit('fs:read:response', { success: true, content });
-                    }
-                    catch (err) {
-                        socket?.emit('fs:read:response', { success: false, error: err.message });
-                    }
-                }
-                catch (error) {
-                    socket?.emit('fs:read:response', { success: false, error: error.message });
-                }
-            });
-            // ========== Update Handlers ==========
-            // Check for updates
-            socket.on('update:check', async (data, callback) => {
-                try {
-                    const config = await readConfig();
-                    const currentHash = createHash('sha256').update(fsSync.readFileSync(fileURLToPath(import.meta.url))).digest('hex');
-                    const response = await fetch(`${config.apiUrl}/update/check`, {
-                        method: 'POST',
-                        headers: { 'Content-Type': 'application/json' },
-                        body: JSON.stringify({
-                            hash: currentHash,
-                            platform: os.platform(),
-                            arch: os.arch()
-                        })
-                    });
-                    if (!response.ok) {
-                        callback?.({ success: false, error: `HTTP ${response.status}` });
-                        return;
-                    }
-                    const info = await response.json();
-                    callback?.({
-                        success: true,
-                        updateAvailable: info.updateAvailable,
-                        version: info.version,
-                        changelog: info.changelog,
-                        size: info.size
-                    });
-                }
-                catch (error) {
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            // Start update
-            socket.on('update:start', async (data, callback) => {
-                try {
-                    // Request update from parent updater process
-                    requestUpdateFromParent();
-                    callback?.({
-                        success: true,
-                        message: 'Update initiated. The CLI will restart automatically when complete.'
-                    });
-                }
-                catch (error) {
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            // Get version info
-            socket.on('version:info', async (data, callback) => {
-                try {
-                    const currentHash = createHash('sha256').update(fsSync.readFileSync(fileURLToPath(import.meta.url))).digest('hex');
-                    // Try to read version from binary-hashes.json
-                    let version = 'unknown';
-                    let date = undefined;
-                    try {
-                        const hashesPath = path.join(path.dirname(fileURLToPath(import.meta.url)), 'binary-hashes.json');
-                        const hashes = JSON.parse(fsSync.readFileSync(hashesPath, 'utf-8'));
-                        if (hashes['js-bundle']) {
-                            version = hashes['js-bundle'].version || version;
-                            date = hashes['js-bundle'].date;
-                        }
-                    }
-                    catch { }
-                    callback?.({
-                        success: true,
-                        version,
-                        hash: currentHash.substring(0, 16) + '...',
-                        date,
-                        nodeVersion: process.version,
-                        platform: os.platform(),
-                        arch: os.arch()
-                    });
-                }
-                catch (error) {
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            // Session handlers
-            socket.on('session:create', async (data) => {
-                try {
-                    let { sessionId, projectPath } = data;
-                    // Remap /home/abc to /tmp/abc if /home/abc doesn't exist (container workaround)
-                    if (projectPath === '/home/abc' && !fsSync.existsSync('/home/abc')) {
-                        const fallbackPath = '/tmp/abc';
-                        fsSync.mkdirSync(fallbackPath, { recursive: true });
-                        projectPath = fallbackPath;
-                        console.log(`[CLI] Remapped /home/abc -> ${fallbackPath}`);
-                    }
-                    activeSessions.set(sessionId, { projectPath });
-                    if (foreground) {
-                        console.log(`💬 Session created: ${sessionId}`);
-                        console.log(`   Project: ${projectPath}`);
-                    }
-                    else {
-                        console.log(`Session created: ${sessionId} in project ${projectPath}`);
-                    }
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Failed to create session: ${error.message}`);
-                    }
-                    else {
-                        console.error('Failed to create session:', error.message);
-                    }
-                }
-            });
-            socket.on('session:delete', async (data) => {
-                try {
-                    const { sessionId } = data;
-                    if (foreground) {
-                        console.log(`🗑️  Deleting session: ${sessionId}`);
-                    }
-                    await agentSessionManager.deleteSession(sessionId);
-                    activeSessions.delete(sessionId);
-                    if (foreground) {
-                        console.log(`✓ Session deleted: ${sessionId}`);
-                    }
-                    else {
-                        console.log(`Session deleted: ${sessionId}`);
-                    }
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Failed to delete session: ${error.message}`);
-                    }
-                    else {
-                        console.error('Failed to delete session:', error.message);
-                    }
-                }
-            });
-            socket.on('project:config:analyze', async (data) => {
-                try {
-                    const { projectId, projectPath, projectName, analysisId } = data;
-                    if (foreground) {
-                        console.log(`🔍 Analyzing project: ${projectName} at ${projectPath}`);
-                    }
-                    // Run Claude analysis
-                    const config = await analyzeProjectWithClaude(projectPath, projectName);
-                    // Save config file (.talk-to-code.json)
-                    await saveProjectConfig(projectPath, config);
-                    // Generate and save runner files for each app
-                    for (const app of config.apps) {
-                        const runnerCode = generateRunnerCode(app, projectPath);
-                        const runnerFileName = `${app.name}_runner.ts`;
-                        const runnerPath = path.join(projectPath, app.directory || '', runnerFileName);
-                        // Ensure directory exists
-                        const runnerDir = path.dirname(runnerPath);
-                        await fs.mkdir(runnerDir, { recursive: true });
-                        // Write runner file
-                        await fs.writeFile(runnerPath, runnerCode, 'utf-8');
-                        if (foreground) {
-                            console.log(`✓ Generated runner: ${runnerFileName}`);
-                        }
-                    }
-                    if (foreground) {
-                        console.log(`✓ Analysis complete: Found ${config.apps.length} apps`);
-                        console.log(`✓ Generated ${config.apps.length} runner files`);
-                    }
-                    // Emit result back to backend
-                    socket.emit('project:config:analyzed', {
-                        projectId,
-                        config,
-                        analysisId
-                    });
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Analysis error: ${error.message}`);
-                    }
-                    socket.emit('project:config:analyze:error', {
-                        projectId: data.projectId,
-                        error: error.message,
-                        analysisId: data.analysisId
-                    });
-                }
-            });
-            // App control handlers
-            socket.on('app:start', async (data, callback) => {
-                try {
-                    const { projectId, projectPath, appName } = data;
-                    // Load project config to get app details
-                    const config = await getProjectConfig(projectPath);
-                    if (!config) {
-                        callback?.({ success: false, error: 'Project config not found' });
-                        return;
-                    }
-                    const app = config.apps.find(a => a.name === appName);
-                    if (!app) {
-                        callback?.({ success: false, error: `App "${appName}" not found in project config` });
-                        return;
-                    }
-                    const result = await startApp(projectPath, projectId, app);
-                    if (result.success) {
-                        if (foreground) {
-                            console.log(`✓ Started app: ${appName} (PID: ${result.pid})`);
-                        }
-                        socket.emit('app:started', {
-                            projectId,
-                            appName,
-                            processId: result.processId,
-                            pid: result.pid,
-                        });
-                    }
-                    callback?.(result);
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Error starting app: ${error.message}`);
-                    }
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            socket.on('app:stop', async (data, callback) => {
-                try {
-                    const { projectId, projectPath, appName } = data;
-                    // Load project config to get app details (for custom stop command)
-                    const config = await getProjectConfig(projectPath);
-                    const app = config?.apps.find(a => a.name === appName);
-                    const result = await stopApp(projectId, appName, app);
-                    if (result.success) {
-                        if (foreground) {
-                            console.log(`✓ Stopped app: ${appName}`);
-                        }
-                        socket.emit('app:stopped', {
-                            projectId,
-                            appName,
-                            appControlId: data.appControlId,
-                        });
-                    }
-                    callback?.(result);
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Error stopping app: ${error.message}`);
-                    }
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            socket.on('app:restart', async (data, callback) => {
-                try {
-                    const { projectId, projectPath, appName } = data;
-                    // Load project config to get app details
-                    const config = await getProjectConfig(projectPath);
-                    if (!config) {
-                        callback?.({ success: false, error: 'Project config not found' });
-                        return;
-                    }
-                    const app = config.apps.find(a => a.name === appName);
-                    if (!app) {
-                        callback?.({ success: false, error: `App "${appName}" not found in project config` });
-                        return;
-                    }
-                    const result = await restartApp(projectPath, projectId, app);
-                    if (result.success) {
-                        if (foreground) {
-                            console.log(`✓ Restarted app: ${appName} (PID: ${result.pid})`);
-                        }
-                        socket.emit('app:restarted', {
-                            projectId,
-                            appName,
-                            processId: result.processId,
-                            pid: result.pid,
-                            appControlId: data.appControlId,
-                        });
-                    }
-                    callback?.(result);
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Error restarting app: ${error.message}`);
-                    }
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            socket.on('app:status', async (data, callback) => {
-                try {
-                    const { projectId, projectPath, appName } = data;
-                    // Load project config
-                    const config = await getProjectConfig(projectPath);
-                    if (!config) {
-                        callback?.({ success: false, error: 'Project config not found' });
-                        return;
-                    }
-                    const appsToCheck = appName
-                        ? config.apps.filter(a => a.name === appName)
-                        : config.apps;
-                    const statuses = getAppStatuses(projectId, appsToCheck);
-                    // Send response back to backend
-                    if (data.appControlId) {
-                        socket.emit('app:control:response', {
-                            appControlId: data.appControlId,
-                            success: true,
-                            apps: statuses,
-                        });
-                    }
-                    callback?.({ success: true, apps: statuses });
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Error getting app status: ${error.message}`);
-                    }
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            socket.on('app:logs', async (data, callback) => {
-                try {
-                    const { projectId, appName } = data;
-                    const result = await getAppLogs(projectId, appName, 100);
-                    // Send response back to backend
-                    if (data.appControlId) {
-                        socket.emit('app:control:response', {
-                            appControlId: data.appControlId,
-                            ...result,
-                        });
-                    }
-                    callback?.(result);
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Error getting app logs: ${error.message}`);
-                    }
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            socket.on('session:prompt', async (data) => {
-                try {
-                    const { sessionId, prompt, projectPath: providedProjectPath, promptId, enhancers, model } = data;
-                    // promptId is REQUIRED when routing to device
-                    if (!promptId) {
-                        if (foreground) {
-                            console.error(`✗ Missing required promptId for session: ${sessionId}`);
-                        }
-                        socket.emit('session:error', { sessionId, error: 'Missing required promptId' });
-                        return;
-                    }
-                    // Try to get projectPath from activeSessions or use provided one
-                    let projectPath = providedProjectPath || activeSessions.get(sessionId)?.projectPath;
-                    if (!projectPath) {
-                        if (foreground) {
-                            console.error(`✗ Session not found: ${sessionId} (missing projectPath)`);
-                        }
-                        socket.emit('session:error', { sessionId, error: 'Session not found or projectPath missing' });
-                        return;
-                    }
-                    // Store in activeSessions with promptId and model
-                    activeSessions.set(sessionId, { projectPath, currentPromptId: promptId, model });
-                    // Capture promptId in closure to prevent race conditions when multiple prompts arrive quickly
-                    // This ensures each prompt's messages use the correct promptId even if a new prompt arrives
-                    const capturedPromptId = promptId;
-                    if (foreground) {
-                        console.log(`\n[CLI] 📤 Received prompt for session: ${sessionId}, promptId: ${capturedPromptId}`);
-                        console.log(`[CLI]    Prompt: ${prompt.substring(0, 100)}${prompt.length > 100 ? '...' : ''}`);
-                    }
-                    // Create or get session handler
-                    await agentSessionManager.createSession({
-                        sessionId,
-                        projectPath,
-                        onOutput: (output) => {
-                            // Serialize data to string if it's an object
-                            const dataString = typeof output.data === 'string'
-                                ? output.data
-                                : JSON.stringify(output.data);
-                            // Use captured promptId (not currentPromptId from activeSessions) to prevent race conditions
-                            if (!capturedPromptId) {
-                                console.error(`[CLI] Missing promptId for session ${sessionId}, cannot emit prompt:output`);
-                                return;
-                            }
-                            socket.emit('prompt:output', {
-                                sessionId,
-                                promptId: capturedPromptId, // Use captured promptId, not currentPromptId
-                                type: output.type,
-                                data: dataString,
-                                timestamp: output.timestamp,
-                                metadata: output.metadata
-                            });
-                        },
-                        onError: (error) => {
-                            socket.emit('session:error', { sessionId, error });
-                        },
-                        onComplete: (exitCode) => {
-                            // Note: This onComplete is from createSession, not sendPrompt
-                            // The actual session:result is emitted from sendPrompt handler below
-                            // This handler is kept for backward compatibility but may not be used
-                        },
-                    });
-                    // Send prompt - status updates will be emitted from agentSession when processing starts/completes
-                    await agentSessionManager.sendPrompt(sessionId, prompt, enhancers || [], {
-                        sessionId,
-                        projectPath,
-                        promptId: capturedPromptId,
-                        model: model, // Pass the model from the session
-                        attachments: data.attachments, // Pass attachments from frontend
-                        onStatusUpdate: (status) => {
-                            // Emit status update from CLI (CLI is source of truth)
-                            // Use captured promptId to ensure correct prompt is updated
-                            if (!capturedPromptId) {
-                                console.error(`[CLI] Missing promptId for status update, cannot emit prompt:updated`);
-                                return;
-                            }
-                            // Always log status updates for debugging (even in background mode)
-                            console.log(`[CLI] 📊 Status update: promptId=${capturedPromptId}, status=${status}, sessionId=${sessionId}`);
-                            // Emit status update IMMEDIATELY (real-time)
-                            socket.emit('prompt:updated', {
-                                promptId: capturedPromptId, // CRITICAL: Use captured promptId from closure
-                                sessionId,
-                                text: prompt,
-                                status,
-                                createdAt: new Date().toISOString(),
-                                ...(status === 'running' ? { startedAt: new Date().toISOString() } : {}),
-                                ...(status === 'completed' || status === 'error' || status === 'cancelled' ? { completedAt: new Date().toISOString() } : {}),
-                                messages: []
-                            });
-                        },
-                        onOutput: (output) => {
-                            // Serialize data to string if it's an object
-                            const dataString = typeof output.data === 'string'
-                                ? output.data
-                                : JSON.stringify(output.data);
-                            // Use captured promptId (not currentPromptId from activeSessions) to prevent race conditions
-                            if (!capturedPromptId) {
-                                console.error(`[CLI] Missing promptId for session ${sessionId}, cannot emit prompt:output`);
-                                return;
-                            }
-                            if (foreground && output.type === 'stdout') {
-                                process.stdout.write(dataString);
-                            }
-                            socket.emit('prompt:output', {
-                                sessionId,
-                                promptId: capturedPromptId, // Use captured promptId, not currentPromptId
-                                type: output.type,
-                                data: dataString,
-                                timestamp: output.timestamp,
-                                metadata: output.metadata
-                            });
-                        },
-                        onError: (error) => {
-                            // Error logging is handled by AgentLogger in agentSession.ts
-                            // Additional console output for foreground mode
-                            if (foreground) {
-                                console.error(`\n[CLI] ✗ Session error: ${error}`);
-                            }
-                            socket.emit('session:error', { sessionId, error });
-                        },
-                        onComplete: (exitCode) => {
-                            // Completion logging is handled by AgentLogger in agentSession.ts
-                            // Additional console output for foreground mode
-                            if (foreground) {
-                                console.log(`\n[CLI] ✓ Session completed with exit code: ${exitCode ?? 'null'}`);
-                            }
-                            // Use captured promptId (not currentPromptId from activeSessions) to prevent race conditions
-                            if (!capturedPromptId) {
-                                console.error(`[CLI] Missing promptId for session ${sessionId}, cannot emit session:result`);
-                                return;
-                            }
-                            socket.emit('session:result', {
-                                sessionId,
-                                promptId: capturedPromptId, // Use captured promptId, not currentPromptId
-                                exitCode
-                            });
-                        }
-                    });
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Error processing prompt: ${error.message}`);
-                    }
-                    socket.emit('session:error', { sessionId: data.sessionId, error: error.message });
-                }
-            });
-            // Handle prompt cancellation
-            socket.on('prompt:cancel', async (data, callback) => {
-                try {
-                    const { promptId, sessionId } = data;
-                    if (!promptId || !sessionId) {
-                        callback?.({ success: false, error: 'Missing promptId or sessionId' });
-                        return;
-                    }
-                    if (foreground) {
-                        console.log(`[CLI] 🛑 Cancelling prompt: ${promptId}`);
-                    }
-                    // Cancel the prompt
-                    const cancelled = await agentSessionManager.cancelPrompt(promptId, sessionId, (status) => {
-                        // Emit cancelled status update
-                        socket.emit('prompt:updated', {
-                            promptId,
-                            sessionId,
-                            text: '', // Not needed for status update
-                            status: 'cancelled',
-                            createdAt: new Date().toISOString(),
-                            completedAt: new Date().toISOString(),
-                            messages: []
-                        });
-                    });
-                    if (cancelled) {
-                        callback?.({ success: true });
-                    }
-                    else {
-                        callback?.({ success: false, error: 'Prompt not found or already completed' });
-                    }
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Error cancelling prompt: ${error.message}`);
-                    }
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            // Handle emergency stop - forcefully halt all session activity
-            socket.on('emergency:stop', async (data, callback) => {
-                try {
-                    const { sessionId } = data;
-                    if (!sessionId) {
-                        callback?.({ success: false, message: 'Missing sessionId' });
-                        return;
-                    }
-                    if (foreground) {
-                        console.log(`[CLI] ☠️  EMERGENCY STOP for session: ${sessionId}`);
-                    }
-                    // Execute emergency stop
-                    const result = await agentSessionManager.emergencyStop(sessionId);
-                    // Emit status update for current prompt if any
-                    socket.emit('emergency:stopped', {
-                        sessionId,
-                        success: result.success,
-                        message: result.message,
-                        timestamp: new Date().toISOString()
-                    });
-                    callback?.(result);
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Error during emergency stop: ${error.message}`);
-                    }
-                    callback?.({ success: false, message: error.message });
-                }
-            });
-            socket.on('connect', () => {
-                if (foreground) {
-                    console.log(`✓ Connected to backend at ${config.apiUrl}`);
-                    if (socket) {
-                        console.log(`   Socket ID: ${socket.id}`);
-                    }
-                }
-                else {
-                    console.log('Connected to backend');
-                }
-                reconnectAttempts = 0;
-                // Register as CLI device
-                if (socket) {
-                    socket.emit('register', { type: 'cli', deviceId });
-                }
-            });
-            socket.on('registered', async ({ type }) => {
-                if (foreground) {
-                    console.log(`✓ Registered as ${type}`);
-                }
-                else {
-                    console.log(`Registered as ${type}`);
-                }
-                // Check for auth token: env TTC_AUTH_TOKEN or device-config.json (from previous approval)
-                let authToken = process.env.TTC_AUTH_TOKEN;
-                let deviceEmail = email;
-                let skipEmailFlow = false;
-                // Load from device-config if no env token (reuse state from previous approval)
-                if (!authToken) {
-                    try {
-                        const deviceConfig = await readDiskDeviceConfig();
-                        authToken = deviceConfig.authToken;
-                        if (!deviceEmail && deviceConfig.email)
-                            deviceEmail = deviceConfig.email;
-                    }
-                    catch {
-                        // No device config yet
-                    }
-                }
-                if (authToken) {
-                    try {
-                        const parts = authToken.split('.');
-                        if (parts.length === 3) {
-                            const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
-                            if (payload.type === 'device_auth' && payload.email) {
-                                deviceEmail = payload.email;
-                                skipEmailFlow = true;
-                                if (foreground) {
-                                    console.log(`✓ Using stored auth token for ${deviceEmail}`);
-                                }
-                            }
-                        }
-                    }
-                    catch (err) {
-                        if (foreground) {
-                            console.warn(`⚠️  Invalid auth token in config, falling back to normal auth`);
-                        }
-                        authToken = undefined;
-                    }
-                }
-                // Load device email from config if not using token and not provided
-                if (!deviceEmail && !skipEmailFlow) {
-                    try {
-                        const deviceConfig = await readDiskDeviceConfig();
-                        deviceEmail = deviceConfig.email;
-                    }
-                    catch {
-                        // No device config yet
-                    }
-                }
-                // Register device with backend
-                let needsApprovalLoggedOnce = false;
-                const registerDevice = () => {
-                    // Determine device name
-                    const containerName = process.env.CONTAINER_NAME;
-                    const deviceName = containerName ? `Container: ${containerName}` : `CLI Device ${hostname}`;
-                    socket.emit('device:register', {
-                        deviceId,
-                        name: deviceName,
-                        ipAddress,
-                        hostname,
-                        email: deviceEmail,
-                        // When using auth token, include the token for verification
-                        authToken: skipEmailFlow ? authToken : undefined
-                    }, ({ success, needsApproval, message, device, error }) => {
-                        if (success && device) {
-                            needsApprovalLoggedOnce = false;
-                            if (foreground) {
-                                console.log(`✓ Device registered: ${device.name}`);
-                                if (device.approved) {
-                                    console.log(`✓ Device approved and ready`);
-                                }
-                            }
-                            else {
-                                console.log(`Device registered: ${device.name}${device.approved ? ' (approved)' : ' (pending approval)'}`);
-                            }
-                            // Save config: email + authToken (preserve token so next run can reuse)
-                            if (device.email) {
-                                void writeDeviceConfigMerged({
-                                    email: device.email,
-                                    ...(authToken ? { authToken } : {}),
-                                }).catch(() => { });
-                            }
-                            if (authToken) {
-                                scheduleAiConfigSync(authToken);
-                            }
-                        }
-                        else if (needsApproval) {
-                            // Persist email when approval was requested so restarts don't prompt again
-                            if (deviceEmail) {
-                                void writeDeviceConfigMerged({ email: deviceEmail }).catch(() => { });
-                            }
-                            // Only log once to avoid flooding logs every 30s on heartbeat
-                            if (!needsApprovalLoggedOnce) {
-                                needsApprovalLoggedOnce = true;
-                                if (foreground) {
-                                    console.log(`\n⚠️  ${message || 'Device approval required'}`);
-                                    if (!deviceEmail) {
-                                        console.log(`   Please run: npx tsx index.ts register --email your@email.com`);
-                                    }
-                                    else {
-                                        console.log(`   Check your email (${deviceEmail}) and click the approval link.`);
-                                    }
-                                }
-                                else {
-                                    console.log(`⚠️  Device approval required: ${message || 'Please approve device'}`);
-                                }
-                            }
-                        }
-                        else if (error) {
-                            console.error(`✗ Registration error: ${error}`);
-                        }
-                    });
-                };
-                registerDevice();
-                // Update lastSeen every 30 seconds while connected
-                const heartbeatInterval = setInterval(() => {
-                    if (socket?.connected) {
-                        registerDevice();
-                    }
-                    else {
-                        clearInterval(heartbeatInterval);
-                    }
-                }, 30000);
-                socket.heartbeatInterval = heartbeatInterval;
-            });
-            // Cloudflared handlers
-            socket.on('cloudflared:check:request', async () => {
-                try {
-                    let installed = false;
-                    let hasCert = false;
-                    try {
-                        // Check if cloudflared is installed
-                        execSync('which cloudflared', { stdio: 'ignore' });
-                        installed = true;
-                        // Check if cert.pem exists
-                        const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem');
-                        try {
-                            // Use fs.stat to check if file exists (more reliable than access)
-                            const stats = await fs.stat(certPath);
-                            hasCert = stats.isFile();
-                            if (foreground && hasCert) {
-                                console.log(`✓ Found cert.pem at ${certPath}`);
-                            }
-                        }
-                        catch (err) {
-                            // File doesn't exist or can't be accessed
-                            hasCert = false;
-                            if (foreground) {
-                                console.log(`✗ cert.pem not found at ${certPath}: ${err.message}`);
-                            }
-                        }
-                    }
-                    catch {
-                        installed = false;
-                    }
-                    socket.emit('cloudflared:check:response', { installed, hasCert });
-                    if (foreground) {
-                        console.log(`Cloudflared check: installed=${installed}, hasCert=${hasCert}`);
-                    }
-                }
-                catch (error) {
-                    socket.emit('cloudflared:check:response', { installed: false, hasCert: false });
-                }
-            });
-            socket.on('cloudflared:sync:request', async () => {
-                try {
-                    const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem');
-                    if (foreground) {
-                        console.log(`Syncing credentials from ${certPath}`);
-                    }
-                    // Read cert.pem file
-                    const certContent = await fs.readFile(certPath, 'utf-8');
-                    // Extract token between BEGIN and END markers
-                    const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/);
-                    if (tokenMatch && tokenMatch[1]) {
-                        // Decode base64 token
-                        const tokenBase64 = tokenMatch[1].replace(/\s/g, '');
-                        const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8');
-                        const tokenData = JSON.parse(tokenJson);
-                        // Extract API token, account ID, and zone ID
-                        const apiToken = tokenData.apiToken;
-                        const accountId = tokenData.accountID;
-                        const zoneId = tokenData.zoneID;
-                        if (foreground) {
-                            console.log(`✓ Extracted credentials: accountId=${accountId}, zoneId=${zoneId}`);
-                        }
-                        socket.emit('cloudflared:sync:complete', {
-                            accountId,
-                            accountName: undefined,
-                            apiToken,
-                            zoneId
-                        });
-                    }
-                    else {
-                        const error = 'Failed to extract token from cert.pem';
-                        if (foreground) {
-                            console.error(`✗ ${error}`);
-                        }
-                        socket.emit('cloudflared:sync:error', { error });
-                    }
-                }
-                catch (error) {
-                    const errorMsg = `Failed to read cert.pem: ${error.message}`;
-                    if (foreground) {
-                        console.error(`✗ ${errorMsg}`);
-                    }
-                    socket.emit('cloudflared:sync:error', { error: errorMsg });
-                }
-            });
-            socket.on('cloudflared:login:request', async () => {
-                try {
-                    // Run cloudflared tunnel login
-                    const loginProcess = spawn('cloudflared', ['tunnel', 'login'], {
-                        stdio: ['ignore', 'pipe', 'pipe']
-                    });
-                    let stdout = '';
-                    let stderr = '';
-                    let urlEmitted = false;
-                    let alreadyLoggedIn = false;
-                    let certPath = null;
-                    const extractCertPath = (text) => {
-                        // Look for: "You have an existing certificate at /path/to/cert.pem"
-                        const pathMatch = text.match(/existing certificate at\s+([^\s]+)/i) ||
-                            text.match(/certificate at\s+([^\s]+)/i) ||
-                            text.match(/cert\.pem.*?at\s+([^\s]+)/i);
-                        return pathMatch ? pathMatch[1] : null;
-                    };
-                    const extractLoginUrl = (text) => {
-                        // Look for URLs in the output
-                        const urlPatterns = [
-                            /https:\/\/dash\.cloudflare\.com\/argotunnel[^\s\)]+/g,
-                            /https:\/\/[^\s\)]+cloudflareaccess\.org[^\s\)]+/g,
-                            /https:\/\/[^\s\)]+cloudflare\.com[^\s\)]+/g
-                        ];
-                        for (const pattern of urlPatterns) {
-                            const matches = text.match(pattern);
-                            if (matches && matches.length > 0) {
-                                return matches[0];
-                            }
-                        }
-                        return null;
-                    };
-                    loginProcess.stdout.on('data', (data) => {
-                        const text = data.toString();
-                        stdout += text;
-                        // Check for already logged in error
-                        if (text.includes('existing certificate') || text.includes('cert.pem which login would overwrite')) {
-                            alreadyLoggedIn = true;
-                            const extractedPath = extractCertPath(text);
-                            if (extractedPath) {
-                                certPath = extractedPath;
-                            }
-                        }
-                        // Extract login URL if not already logged in
-                        if (!alreadyLoggedIn && !urlEmitted) {
-                            const url = extractLoginUrl(text);
-                            if (url) {
-                                urlEmitted = true;
-                                socket.emit('cloudflared:login:url', { loginUrl: url });
-                            }
-                        }
-                    });
-                    loginProcess.stderr.on('data', (data) => {
-                        const text = data.toString();
-                        stderr += text;
-                        // Check for already logged in error (often in stderr)
-                        if (text.includes('existing certificate') || text.includes('cert.pem which login would overwrite')) {
-                            alreadyLoggedIn = true;
-                            const extractedPath = extractCertPath(text);
-                            if (extractedPath) {
-                                certPath = extractedPath;
-                            }
-                        }
-                        // Extract login URL if not already logged in
-                        if (!alreadyLoggedIn && !urlEmitted) {
-                            const url = extractLoginUrl(text);
-                            if (url) {
-                                urlEmitted = true;
-                                socket.emit('cloudflared:login:url', { loginUrl: url });
-                            }
-                        }
-                    });
-                    loginProcess.on('close', async (code) => {
-                        if (alreadyLoggedIn && certPath) {
-                            // Already logged in - extract credentials from existing cert
-                            try {
-                                if (foreground) {
-                                    console.log(`Already logged in, extracting credentials from ${certPath}`);
-                                }
-                                const certContent = await fs.readFile(certPath, 'utf-8');
-                                const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/);
-                                if (tokenMatch && tokenMatch[1]) {
-                                    const tokenBase64 = tokenMatch[1].replace(/\s/g, '');
-                                    const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8');
-                                    const tokenData = JSON.parse(tokenJson);
-                                    if (foreground) {
-                                        console.log(`✓ Extracted credentials from existing cert`);
-                                    }
-                                    socket.emit('cloudflared:login:complete', {
-                                        accountId: tokenData.accountID,
-                                        accountName: undefined,
-                                        apiToken: tokenData.apiToken,
-                                        zoneId: tokenData.zoneID
-                                    });
-                                }
-                                else {
-                                    const error = 'Failed to extract token from existing cert.pem';
-                                    if (foreground) {
-                                        console.error(`✗ ${error}`);
-                                    }
-                                    socket.emit('cloudflared:login:error', { error });
-                                }
-                            }
-                            catch (error) {
-                                const errorMsg = `Failed to read cert.pem: ${error.message}`;
-                                if (foreground) {
-                                    console.error(`✗ ${errorMsg}`);
-                                }
-                                socket.emit('cloudflared:login:error', { error: errorMsg });
-                            }
-                        }
-                        else if (code === 0 && !alreadyLoggedIn) {
-                            // Login completed successfully - wait a moment then extract credentials
-                            if (foreground) {
-                                console.log('Login completed, extracting credentials...');
-                            }
-                            setTimeout(async () => {
-                                try {
-                                    const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem');
-                                    const certContent = await fs.readFile(certPath, 'utf-8');
-                                    const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/);
-                                    if (tokenMatch && tokenMatch[1]) {
-                                        const tokenBase64 = tokenMatch[1].replace(/\s/g, '');
-                                        const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8');
-                                        const tokenData = JSON.parse(tokenJson);
-                                        if (foreground) {
-                                            console.log(`✓ Extracted credentials after login`);
-                                        }
-                                        socket.emit('cloudflared:login:complete', {
-                                            accountId: tokenData.accountID,
-                                            accountName: undefined,
-                                            apiToken: tokenData.apiToken,
-                                            zoneId: tokenData.zoneID
-                                        });
-                                    }
-                                    else {
-                                        const error = 'Failed to extract token from cert.pem after login';
-                                        if (foreground) {
-                                            console.error(`✗ ${error}`);
-                                        }
-                                        socket.emit('cloudflared:login:error', { error });
-                                    }
-                                }
-                                catch (error) {
-                                    const errorMsg = `Failed to read cert.pem after login: ${error.message}`;
-                                    if (foreground) {
-                                        console.error(`✗ ${errorMsg}`);
-                                    }
-                                    socket.emit('cloudflared:login:error', { error: errorMsg });
-                                }
-                            }, 1000); // Wait 1 second for file to be written
-                        }
-                        else if (!alreadyLoggedIn) {
-                            const error = `Login failed with code ${code}: ${stderr || stdout}`;
-                            if (foreground) {
-                                console.error(`✗ ${error}`);
-                            }
-                            socket.emit('cloudflared:login:error', { error });
-                        }
-                    });
-                    loginProcess.on('error', (error) => {
-                        socket.emit('cloudflared:login:error', { error: error.message });
-                    });
-                }
-                catch (error) {
-                    socket.emit('cloudflared:login:error', { error: error.message });
-                }
-            });
-            socket.on('cloudflared:regenerate:request', async () => {
-                try {
-                    const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem');
-                    // Delete existing cert.pem
-                    try {
-                        await fs.unlink(certPath);
-                        if (foreground) {
-                            console.log(`✓ Deleted existing cert.pem`);
-                        }
-                    }
-                    catch (error) {
-                        // File might not exist, that's okay
-                        if (foreground && error.code !== 'ENOENT') {
-                            console.log(`Note: Could not delete cert.pem: ${error.message}`);
-                        }
-                    }
-                    // Emit success - frontend will then trigger login
-                    socket.emit('cloudflared:regenerate:complete', {});
-                }
-                catch (error) {
-                    socket.emit('cloudflared:regenerate:error', { error: error.message });
-                }
-            });
-            socket.on('cloudflared:login:request', async () => {
-                try {
-                    // First check if cloudflared is installed
-                    try {
-                        execSync('which cloudflared', { stdio: 'ignore' });
-                    }
-                    catch {
-                        socket.emit('cloudflared:login:error', { error: 'cloudflared is not installed' });
-                        return;
-                    }
-                    // Run cloudflared tunnel login
-                    // This command outputs a URL that needs to be visited
-                    const loginProcess = spawn('cloudflared', ['tunnel', 'login'], {
-                        stdio: ['ignore', 'pipe', 'pipe']
-                    });
-                    let stdout = '';
-                    let stderr = '';
-                    let urlEmitted = false;
-                    const findAndEmitUrl = (text) => {
-                        if (urlEmitted)
-                            return;
-                        // Look for URL in output - cloudflared outputs URLs in various formats
-                        const urlPatterns = [
-                            /https:\/\/[^\s\)]+/g,
-                            /https:\/\/[^\n]+/g
-                        ];
-                        for (const pattern of urlPatterns) {
-                            const matches = text.match(pattern);
-                            if (matches && matches.length > 0) {
-                                // Find the login URL (usually contains "cloudflareaccess.com" or similar)
-                                const loginUrl = matches.find(url => url.includes('cloudflareaccess.com') ||
-                                    url.includes('cloudflare.com') ||
-                                    url.includes('trycloudflare.com') ||
-                                    url.includes('dash.cloudflare.com'));
-                                if (loginUrl) {
-                                    urlEmitted = true;
-                                    socket.emit('cloudflared:login:url', { loginUrl: loginUrl.trim() });
-                                    return;
-                                }
-                            }
-                        }
-                    };
-                    loginProcess.stdout.on('data', (data) => {
-                        const text = data.toString();
-                        stdout += text;
-                        findAndEmitUrl(text);
-                    });
-                    loginProcess.stderr.on('data', (data) => {
-                        const text = data.toString();
-                        stderr += text;
-                        // cloudflared often outputs URLs to stderr
-                        findAndEmitUrl(text);
-                    });
-                    loginProcess.on('close', async (code) => {
-                        if (code === 0) {
-                            // Login successful, extract API token from cert.pem
-                            try {
-                                const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem');
-                                const certContent = await fs.readFile(certPath, 'utf-8');
-                                // Extract token between BEGIN and END markers
-                                const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/);
-                                if (tokenMatch && tokenMatch[1]) {
-                                    // Decode base64 token
-                                    const tokenBase64 = tokenMatch[1].replace(/\s/g, '');
-                                    const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8');
-                                    const tokenData = JSON.parse(tokenJson);
-                                    // Extract API token, account ID, and zone ID
-                                    const apiToken = tokenData.apiToken;
-                                    const accountId = tokenData.accountID;
-                                    const zoneId = tokenData.zoneID;
-                                    socket.emit('cloudflared:login:complete', {
-                                        accountId,
-                                        accountName: undefined,
-                                        apiToken,
-                                        zoneId
-                                    });
-                                }
-                                else {
-                                    socket.emit('cloudflared:login:error', {
-                                        error: 'Failed to extract token from cert.pem'
-                                    });
-                                }
-                            }
-                            catch (error) {
-                                socket.emit('cloudflared:login:error', {
-                                    error: `Failed to read cert.pem: ${error.message}`
-                                });
-                            }
-                        }
-                        else {
-                            socket.emit('cloudflared:login:error', {
-                                error: `Login failed with code ${code}: ${stderr}`
-                            });
-                        }
-                    });
-                    loginProcess.on('error', (error) => {
-                        socket.emit('cloudflared:login:error', { error: error.message });
-                    });
-                }
-                catch (error) {
-                    socket.emit('cloudflared:login:error', { error: error.message });
-                }
-            });
-            // ========== Container Management Handlers ==========
-            // Check if container runtime is available
-            socket.on('container:check:request', async () => {
-                try {
-                    let enabled = false;
-                    let runtime;
-                    let version = '';
-                    try {
-                        // Check for docker first
-                        execSync('which docker', { stdio: 'ignore' });
-                        runtime = 'docker';
-                        version = execSync('docker --version', { encoding: 'utf-8' }).trim();
-                        enabled = true;
-                    }
-                    catch {
-                        try {
-                            // Check for podman as fallback
-                            execSync('which podman', { stdio: 'ignore' });
-                            runtime = 'podman';
-                            version = execSync('podman --version', { encoding: 'utf-8' }).trim();
-                            enabled = true;
-                        }
-                        catch {
-                            enabled = false;
-                        }
-                    }
-                    socket.emit('container:check:response', { enabled, runtime, version });
-                    if (foreground) {
-                        console.log(`Container runtime check: ${enabled ? `${runtime} (${version})` : 'Not found'}`);
-                    }
-                }
-                catch (error) {
-                    socket.emit('container:check:response', { enabled: false, runtime: undefined, version: '' });
-                }
-            });
-            // List all containers
-            socket.on('container:list:request', async () => {
-                try {
-                    const runtime = getContainerRuntime();
-                    if (!runtime) {
-                        socket.emit('container:list:response', { success: false, error: 'No container runtime found' });
-                        return;
-                    }
-                    // List all containers including stopped ones
-                    const output = execSync(`${runtime} ps -a --format "{{json .}}"`, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
-                    const containers = output.trim().split('\n').filter(Boolean).map(line => {
-                        try {
-                            const c = JSON.parse(line);
-                            // Parse ports from the PORTS column (format: "0.0.0.0:8080->80/tcp, 0.0.0.0:9090->9090/tcp")
-                            const ports = [];
-                            if (c.Ports) {
-                                const portMatches = c.Ports.match(/(\d+)->(\d+)/g);
-                                if (portMatches) {
-                                    portMatches.forEach((p) => {
-                                        const [host, container] = p.split('->').map(Number);
-                                        ports.push({ host, container });
-                                    });
-                                }
-                            }
-                            return {
-                                containerId: c.ID,
-                                name: c.Names.replace(/^\//, ''), // Remove leading slash
-                                image: c.Image,
-                                status: c.State === 'running' ? 'running' : c.State === 'paused' ? 'paused' : c.Status === 'exited' ? 'exited' : 'stopped',
-                                ports,
-                                createdAt: new Date(c.CreatedAt).toISOString()
-                            };
-                        }
-                        catch {
-                            return null;
-                        }
-                    }).filter(Boolean);
-                    socket.emit('container:list:response', { success: true, containers });
-                }
-                catch (error) {
-                    socket.emit('container:list:response', { success: false, error: error.message });
-                }
-            });
-            // Start a new container
-            socket.on('container:start:request', async (data) => {
-                try {
-                    const runtime = getContainerRuntime();
-                    if (!runtime) {
-                        socket.emit('container:start:response', { success: false, error: 'No container runtime found' });
-                        return;
-                    }
-                    const { name, image, ports = [], env = {}, runAsRoot = false } = data;
-                    // Get CLI directory path (where this script is running from)
-                    // Use the same pattern as elsewhere in the file
-                    const cliDir = path.dirname(CURRENT_FILE);
-                    // Build docker run command
-                    let cmd = `${runtime} run -d --name ${name}`;
-                    // Security: Running as root INSIDE container is safe - it's still isolated from host
-                    // Root inside container cannot access host filesystem (read-only mounts)
-                    // Default to root to allow package installation and full container functionality
-                    // Set runAsRoot: false to run as non-root user (UID 1000) if needed
-                    if (!runAsRoot) {
-                        cmd += ' --user 1000:1000';
-                    }
-                    // Resource limits
-                    cmd += ' --memory=8g'; // Limit memory to 8GB
-                    // Auto-remove on exit (optional - commented out for persistence)
-                    // cmd += ' --rm'
-                    // Mount CLI directory into container
-                    cmd += ` -v "${cliDir}:/opt/ttc:ro"`;
-                    // Mount entrypoint script
-                    const entrypointScript = path.join(cliDir, 'container-entrypoint.sh');
-                    cmd += ` -v "${entrypointScript}:/entrypoint.sh:ro"`;
-                    // Port mappings
-                    ports.forEach(p => {
-                        cmd += ` -p ${p.host}:${p.container}`;
-                    });
-                    // Environment variables
-                    Object.entries(env).forEach(([k, v]) => {
-                        // Escape quotes in env values
-                        const escapedValue = String(v).replace(/"/g, '\\"');
-                        cmd += ` -e ${k}="${escapedValue}"`;
-                    });
-                    // Add container-specific environment variables
-                    cmd += ` -e CONTAINER_NAME="${name}"`;
-                    cmd += ` -e HOSTNAME="${name}"`;
-                    // Use entrypoint script
-                    cmd += ` --entrypoint /bin/sh ${image} /entrypoint.sh`;
-                    if (foreground) {
-                        console.log(`Starting container: ${cmd}`);
-                    }
-                    // Pull image if not exists, then run
-                    try {
-                        execSync(`${runtime} pull ${image}`, { stdio: 'ignore' });
-                    }
-                    catch {
-                        // Pull failed, but might already exist locally
-                    }
-                    const output = execSync(cmd, { encoding: 'utf-8', stdio: 'pipe' });
-                    const containerId = output.trim();
-                    socket.emit('container:start:response', { success: true, containerId });
-                    if (foreground) {
-                        console.log(`✓ Container started: ${containerId}`);
-                    }
-                }
-                catch (error) {
-                    socket.emit('container:start:response', { success: false, error: error.message });
-                }
-            });
-            // Stop a container
-            socket.on('container:stop:request', async (data) => {
-                try {
-                    const runtime = getContainerRuntime();
-                    if (!runtime) {
-                        socket.emit('container:stop:response', { success: false, error: 'No container runtime found' });
-                        return;
-                    }
-                    const { containerId } = data;
-                    execSync(`${runtime} stop ${containerId}`, { stdio: 'ignore' });
-                    socket.emit('container:stop:response', { success: true });
-                    if (foreground) {
-                        console.log(`✓ Container stopped: ${containerId}`);
-                    }
-                }
-                catch (error) {
-                    socket.emit('container:stop:response', { success: false, error: error.message });
-                }
-            });
-            // Remove a container
-            socket.on('container:remove:request', async (data) => {
-                try {
-                    const runtime = getContainerRuntime();
-                    if (!runtime) {
-                        socket.emit('container:remove:response', { success: false, error: 'No container runtime found' });
-                        return;
-                    }
-                    const { containerId } = data;
-                    // Force remove even if running
-                    execSync(`${runtime} rm -f ${containerId}`, { stdio: 'ignore' });
-                    socket.emit('container:remove:response', { success: true });
-                    if (foreground) {
-                        console.log(`✓ Container removed: ${containerId}`);
-                    }
-                }
-                catch (error) {
-                    socket.emit('container:remove:response', { success: false, error: error.message });
-                }
-            });
-            // Get container logs
-            socket.on('container:logs:request', async (data) => {
-                try {
-                    const runtime = getContainerRuntime();
-                    if (!runtime) {
-                        socket.emit('container:logs:response', { success: false, error: 'No container runtime found' });
-                        return;
-                    }
-                    const { containerId, lines = 100 } = data;
-                    const logs = execSync(`${runtime} logs --tail ${lines} ${containerId}`, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
-                    socket.emit('container:logs:response', { success: true, logs });
-                }
-                catch (error) {
-                    socket.emit('container:logs:response', { success: false, error: error.message });
-                }
-            });
-            // Helper function to get available container runtime
-            function getContainerRuntime() {
-                try {
-                    execSync('which docker', { stdio: 'ignore' });
-                    return 'docker';
-                }
-                catch {
-                    try {
-                        execSync('which podman', { stdio: 'ignore' });
-                        return 'podman';
-                    }
-                    catch {
-                        return null;
-                    }
-                }
-            }
+            // Cloudflared handlers (extracted to cli/cloudflaredHandlers.ts)
+            registerCloudflaredHandlers(socket, foreground);
+            // Container handlers (extracted to cli/containerHandlers.ts)
+            registerContainerHandlers(socket, foreground, path.dirname(CURRENT_FILE));
             socket.on('disconnect', (reason) => {
                 if (foreground) {
                     console.log(`\n⚠️  Disconnected: ${reason}`);