@exreve/exk 1.0.44 → 1.0.46

package/dist/index.js

@@ -9,11 +9,13 @@ import os, { networkInterfaces } from 'os';
 import { Buffer } from 'buffer';
 import crypto from 'crypto';
 import { createProject, deleteProject } from './projectManager.js';
-import { agentSessionManager } from './agentSession.js';
-import { getProjectConfig, analyzeProjectWithClaude, saveProjectConfig } from './projectAnalyzer.js';
-import { generateRunnerCode } from './runnerGenerator.js';
-import { startApp, stopApp, restartApp, getAppStatuses, getAppLogs } from './appManager.js';
 import { startSending, startReceiving } from './transferService.js';
+import { registerGitHubHandlers } from './githubHandlers.js';
+import { registerFsHandlers } from './fsHandlers.js';
+import { registerAppHandlers } from './appHandlers.js';
+import { registerSessionHandlers } from './sessionHandlers.js';
+import { registerContainerHandlers } from './containerHandlers.js';
+import { registerCloudflaredHandlers } from './cloudflaredHandlers.js';
 import { spawn, execSync } from 'child_process';
 import readline from 'readline';
 import { fileURLToPath } from 'url';
@@ -68,25 +70,33 @@ async function fetchAiConfig(authToken) {
 }
 const AI_CONFIG_FILE = path.join(CONFIG_DIR, 'ai-config.json');
 const PROXY_CONFIG_FILE = path.join(CONFIG_DIR, 'proxy.json');
-/** Read proxy toggle state from disk */
-async function readProxyConfig() {
-    try {
-        const raw = await fs.readFile(PROXY_CONFIG_FILE, 'utf-8');
-        return JSON.parse(raw);
-    }
-    catch {
-        return { enabled: false };
-    }
-}
 /** Write proxy toggle state to disk */
 async function writeProxyConfig(cfg) {
     await fs.mkdir(CONFIG_DIR, { recursive: true });
     await fs.writeFile(PROXY_CONFIG_FILE, JSON.stringify(cfg, null, 2));
 }
+/** TTL cache for ai-config.json reads (shared by getProxyUrl / hasAiCredentials) */
+let _aiCfgCache = null;
+const _AI_CFG_TTL = 5_000;
+function readAiConfigCached() {
+    const now = Date.now();
+    if (_aiCfgCache && (now - _aiCfgCache.ts) < _AI_CFG_TTL)
+        return _aiCfgCache.raw;
+    try {
+        const raw = fsSync.readFileSync(AI_CONFIG_FILE, 'utf-8');
+        _aiCfgCache = { raw, ts: now };
+        return raw;
+    }
+    catch {
+        return '';
+    }
+}
 /** Get the proxy URL from ai-config.json (saved from backend) */
 function getProxyUrl() {
     try {
-        const raw = fsSync.readFileSync(AI_CONFIG_FILE, 'utf-8');
+        const raw = readAiConfigCached();
+        if (!raw)
+            return '';
         const j = JSON.parse(raw);
         return typeof j.proxy === 'string' ? j.proxy.trim() : '';
     }
@@ -97,7 +107,9 @@ function getProxyUrl() {
 /** True if ai-config.json has a model API key (not read from host ANTHROPIC_* env). */
 function hasAiCredentials() {
     try {
-        const raw = fsSync.readFileSync(AI_CONFIG_FILE, 'utf-8');
+        const raw = readAiConfigCached();
+        if (!raw)
+            return false;
         const j = JSON.parse(raw);
         return typeof j.authToken === 'string' && j.authToken.trim().length > 0;
     }
@@ -249,76 +261,6 @@ async function checkForUpdate() {
         return null;
     }
 }
-async function replaceSelf(tarballBuffer) {
-    const extractDir = path.join(os.tmpdir(), `ttc-update-${Date.now()}`);
-    await fs.mkdir(extractDir, { recursive: true });
-    const tarPath = path.join(extractDir, 'ttc-cli.tar.gz');
-    await fs.writeFile(tarPath, tarballBuffer);
-    execSync(`tar -xzf "${tarPath}" -C "${extractDir}"`);
-    await fs.unlink(tarPath);
-    // Preserve user config/token files (never overwrite on update)
-    const preserveFiles = ['device-config.json', 'device-id.json', 'config.json'];
-    const preserved = {};
-    for (const f of preserveFiles) {
-        try {
-            preserved[f] = await fs.readFile(path.join(CONFIG_DIR, f));
-        }
-        catch {
-            /* file may not exist */
-        }
-    }
-    // Replace cli/ and shared/ in CONFIG_DIR
-    const cliDest = path.join(CONFIG_DIR, 'cli');
-    const sharedDest = path.join(CONFIG_DIR, 'shared');
-    await fs.rm(cliDest, { recursive: true, force: true });
-    await fs.rm(sharedDest, { recursive: true, force: true });
-    await fs.cp(path.join(extractDir, 'cli'), cliDest, { recursive: true });
-    await fs.cp(path.join(extractDir, 'shared'), sharedDest, { recursive: true });
-    // Update package.json and npm install
-    await fs.copyFile(path.join(extractDir, 'package.json'), path.join(CONFIG_DIR, 'package.json'));
-    await fs.rm(extractDir, { recursive: true, force: true });
-    // Restore preserved config
-    for (const f of preserveFiles) {
-        if (preserved[f])
-            await fs.writeFile(path.join(CONFIG_DIR, f), preserved[f]);
-    }
-    console.log('✓ CLI updated');
-    const npmPaths = [path.join(os.homedir(), '.nvm/versions/node/v22/bin/npm'), path.join(os.homedir(), '.nvm/versions/node/v20/bin/npm')];
-    const npmBin = npmPaths.find(p => fsSync.existsSync(p)) || 'npm';
-    try {
-        execSync(`"${npmBin}" install --omit=dev`, { cwd: CONFIG_DIR, stdio: 'inherit' });
-        console.log('✓ Dependencies updated');
-    }
-    catch {
-        console.warn('⚠ npm install failed');
-    }
-}
-async function selfUpdate(force = false) {
-    const info = await checkForUpdate();
-    if (!info || !info.updateAvailable) {
-        console.log('✓ Already up to date');
-        return;
-    }
-    console.log('📦 Update available!');
-    if (!force && process.stdin.isTTY) {
-        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-        const answer = await new Promise(r => rl.question('Update now? [Y/n] ', a => { rl.close(); r(a.trim()); }));
-        if (answer.toLowerCase().startsWith('n'))
-            return;
-    }
-    if (!info.downloadUrl || !info.hash)
-        return;
-    console.log('Downloading...');
-    const res = await fetch(info.downloadUrl);
-    if (!res.ok)
-        throw new Error('Download failed');
-    const bundle = Buffer.from(await res.arrayBuffer());
-    if (createHash('sha256').update(bundle).digest('hex') !== info.hash) {
-        throw new Error('Hash mismatch');
-    }
-    await replaceSelf(bundle);
-    process.exit(0);
-}
 // ============ Commands ============
 async function registerDevice(name, email) {
     try {
@@ -480,136 +422,6 @@ async function registerDevice(name, email) {
         throw error;
     }
 }
-async function listSessions() {
-    try {
-        const socket = await connect();
-        socket.emit('sessions:list', (response) => {
-            const { sessions } = response;
-            console.log('\nSessions:');
-            console.log('-'.repeat(60));
-            sessions.forEach((session, idx) => {
-                console.log(`${idx + 1}. ${session.id}`);
-                console.log(`   Created: ${new Date(session.createdAt).toLocaleString()}`);
-                console.log();
-            });
-            socket.disconnect();
-        });
-    }
-    catch (error) {
-        console.error('Failed to list sessions:', error.message);
-        process.exit(1);
-    }
-}
-async function createSession() {
-    try {
-        const socket = await connect();
-        socket.emit('session:create', (response) => {
-            const { success, session } = response;
-            if (success && session) {
-                console.log('Session created!');
-                console.log('Session ID:', session.id);
-                socket.disconnect();
-            }
-        });
-    }
-    catch (error) {
-        console.error('Failed to create session:', error.message);
-        process.exit(1);
-    }
-}
-async function sendPrompt(sessionId, prompt) {
-    try {
-        const socket = await connect();
-        socket.emit('session:subscribe', { sessionId });
-        socket.on('prompt:output', ({ data, type }) => {
-            if (type === 'stdout') {
-                process.stdout.write(data);
-            }
-            else {
-                process.stderr.write(data);
-            }
-        });
-        socket.on('session:exited', ({ exitCode }) => {
-            console.log(`\nSession exited with code ${exitCode}`);
-            socket.disconnect();
-        });
-        socket.emit('session:prompt', { sessionId, prompt }, ({ success }) => {
-            if (!success) {
-                console.error('Failed to send prompt');
-                socket.disconnect();
-            }
-        });
-        process.on('SIGINT', () => {
-            socket.emit('session:unsubscribe', { sessionId });
-            socket.disconnect();
-            process.exit(0);
-        });
-    }
-    catch (error) {
-        console.error('Failed to send prompt:', error.message);
-        process.exit(1);
-    }
-}
-async function listDevices() {
-    try {
-        const socket = await connect();
-        socket.emit('devices:list', (response) => {
-            const { devices } = response;
-            console.log('\nRegistered Devices:');
-            console.log('-'.repeat(60));
-            devices.forEach((device, idx) => {
-                console.log(`${idx + 1}. ${device.name}`);
-                console.log(`   ID: ${device.deviceId}`);
-                console.log(`   IP Address: ${device.ipAddress || 'Unknown'}`);
-                console.log(`   Hostname: ${device.hostname || 'Unknown'}`);
-                console.log(`   Registered: ${new Date(device.registeredAt).toLocaleString()}`);
-                console.log(`   Last Seen: ${new Date(device.lastSeen).toLocaleString()}`);
-                console.log();
-            });
-            socket.disconnect();
-        });
-    }
-    catch (error) {
-        console.error('Failed to list devices:', error.message);
-        process.exit(1);
-    }
-}
-async function monitorSession(sessionId) {
-    try {
-        const socket = await connect();
-        console.log(`Monitoring session ${sessionId}...`);
-        console.log('Press Ctrl+C to stop\n');
-        socket.emit('session:subscribe', { sessionId });
-        socket.on('session:state', ({ outputs, isActive }) => {
-            console.log(`Session active: ${isActive}`);
-            console.log('Recent output:');
-            outputs.slice(-10).forEach(({ type, data }) => {
-                if (type === 'stdout') {
-                    const dataString = typeof data === 'string' ? data : JSON.stringify(data);
-                    process.stdout.write(dataString);
-                }
-            });
-        });
-        socket.on('prompt:output', ({ data, type }) => {
-            if (type === 'stdout') {
-                process.stdout.write(data);
-            }
-        });
-        socket.on('session:exited', ({ exitCode }) => {
-            console.log(`\nSession exited with code ${exitCode}`);
-            socket.disconnect();
-        });
-        process.on('SIGINT', () => {
-            socket.emit('session:unsubscribe', { sessionId });
-            socket.disconnect();
-            process.exit(0);
-        });
-    }
-    catch (error) {
-        console.error('Failed to monitor session:', error.message);
-        process.exit(1);
-    }
-}
 // Active sessions map - persists across reconnections
 const activeSessions = new Map();
 async function runDaemon(foreground = false, email) {
@@ -654,6 +466,12 @@ async function runDaemon(foreground = false, email) {
     const MAX_RECONNECT_ATTEMPTS = Infinity; // Keep trying forever
     const connectAndRegister = async () => {
         try {
+            // Destroy any existing socket to prevent zombie connections
+            if (socket) {
+                socket.removeAllListeners();
+                socket.disconnect();
+                socket = null;
+            }
             socket = io(config.apiUrl, {
                 transports: ['websocket', 'polling'],
                 reconnection: true,
@@ -739,894 +557,162 @@ async function runDaemon(foreground = false, email) {
                     callback?.({ success: false, error: error.message });
                 }
             });
-            // GitHub handlers
-            socket.on('github:status', async (data, callback) => {
+            // GitHub handlers (delegated to githubHandlers module for proper response format)
+            registerGitHubHandlers(socket, foreground);
+            // Filesystem handlers (delegated to fsHandlers module)
+            registerFsHandlers(socket);
+            // Session handlers (delegated to sessionHandlers module)
+            registerSessionHandlers(socket, foreground, activeSessions, () => socket);
+            // App control handlers (delegated to appHandlers module)
+            registerAppHandlers(socket, foreground);
+            // Handle image save request - saves base64 images to tmp directory
+            socket.on('image:save', async (data) => {
                 try {
-                    const { projectPath } = data;
-                    // Check if directory is a git repository
-                    const gitDir = path.join(projectPath, '.git');
-                    let isRepo = false;
-                    try {
-                        const stats = await fs.stat(gitDir);
-                        isRepo = stats.isDirectory();
-                    }
-                    catch {
-                        isRepo = false;
+                    const { images, saveCallbackId, projectPath } = data;
+                    if (foreground) {
+                        console.log(`[CLI] 🖼️  Received request to save ${images.length} image(s)`);
                     }
-                    if (!isRepo) {
-                        callback?.({ success: true, isRepo: false, hasChanges: false });
-                        return;
+                    // Use project-specific tmp directory (inside the project)
+                    // If projectPath is provided, use it; otherwise fall back to current working directory
+                    const basePath = projectPath || process.cwd();
+                    const tmpDir = path.join(basePath, 'tmp');
+                    await fs.mkdir(tmpDir, { recursive: true });
+                    if (foreground) {
+                        console.log(`[CLI] 📁 Saving to directory: ${tmpDir}`);
                     }
-                    // Check git status
-                    const { execSync } = await import('child_process');
-                    try {
-                        // Get current branch
-                        const branch = execSync('git rev-parse --abbrev-ref HEAD', { cwd: projectPath, encoding: 'utf-8' }).trim();
-                        // Get remote URL
-                        let remote;
-                        try {
-                            remote = execSync('git config --get remote.origin.url', { cwd: projectPath, encoding: 'utf-8' }).trim();
-                        }
-                        catch {
-                            // No remote configured
-                        }
-                        // Check for actual changes (modified, staged, deleted files - ignore untracked)
-                        // Use --short to get concise output, and check for actual changes (not just untracked files)
-                        let hasChanges = false;
-                        const changedFiles = [];
+                    let savedCount = 0;
+                    const errors = [];
+                    for (const image of images) {
                         try {
-                            const statusOutput = execSync('git status --porcelain', { cwd: projectPath, encoding: 'utf-8' });
-                            const lines = statusOutput.trim().split('\n').filter(line => line.trim().length > 0);
-                            for (const line of lines) {
-                                const status = line.substring(0, 2).trim();
-                                const filePath = line.substring(2).trim();
-                                // Skip untracked files (??)
-                                if (line.startsWith('??'))
-                                    continue;
-                                // Include modified (M), added (A), deleted (D), renamed (R), copied (C)
-                                if (status.includes('M') || status.includes('A') || status.includes('D') || status.includes('R') || status.includes('C')) {
-                                    hasChanges = true;
-                                    changedFiles.push({ path: filePath, status });
-                                }
+                            const imagePath = path.join(tmpDir, image.name);
+                            // Convert base64 to buffer and write to file
+                            const buffer = Buffer.from(image.data, 'base64');
+                            await fs.writeFile(imagePath, buffer);
+                            if (foreground) {
+                                console.log(`[CLI] ✓ Saved image: ${imagePath}`);
                             }
+                            savedCount++;
                         }
-                        catch {
-                            hasChanges = false;
+                        catch (saveError) {
+                            const errorMsg = `Failed to save ${image.name}: ${saveError.message}`;
+                            errors.push(errorMsg);
+                            if (foreground) {
+                                console.error(`[CLI] ✗ ${errorMsg}`);
+                            }
                         }
-                        callback?.({ success: true, isRepo: true, hasChanges, branch, remote, changedFiles, changesCount: changedFiles.length });
                     }
-                    catch (error) {
-                        callback?.({ success: false, error: error.message });
+                    // Send response back via app:control:response
+                    console.log(`[CLI] Sending app:control:response with appControlId=${saveCallbackId}, success=${errors.length === 0}, savedCount=${savedCount}`);
+                    socket.emit('app:control:response', {
+                        appControlId: saveCallbackId,
+                        success: errors.length === 0,
+                        savedCount,
+                        error: errors.length > 0 ? errors.join('; ') : undefined
+                    });
+                    console.log(`[CLI] Emitted app:control:response`);
+                    if (foreground) {
+                        if (errors.length > 0) {
+                            console.log(`[CLI] ⚠️  Saved ${savedCount}/${images.length} images with errors`);
+                        }
+                        else {
+                            console.log(`[CLI] ✓ Successfully saved all ${savedCount} images to ${tmpDir}`);
+                        }
                     }
                 }
                 catch (error) {
-                    callback?.({ success: false, error: error.message });
+                    console.error(`[CLI] ✗ Error saving images: ${error.message}`);
+                    // Send error response
+                    console.log(`[CLI] Sending error app:control:response with appControlId=${data.saveCallbackId}`);
+                    socket.emit('app:control:response', {
+                        appControlId: data.saveCallbackId,
+                        success: false,
+                        error: error.message
+                    });
+                    console.log(`[CLI] Emitted error app:control:response`);
                 }
             });
-            socket.on('github:commit', async (data, callback) => {
-                try {
-                    const { projectPath, message = 'changes' } = data;
-                    // Check if directory is a git repository
-                    const gitDir = path.join(projectPath, '.git');
-                    let isRepo = false;
-                    try {
-                        const stats = await fs.stat(gitDir);
-                        isRepo = stats.isDirectory();
-                    }
-                    catch {
-                        callback?.({ success: false, error: 'Not a git repository' });
-                        return;
-                    }
-                    const { execSync } = await import('child_process');
-                    try {
-                        // Stage all changes
-                        execSync('git add -A', { cwd: projectPath });
-                        // Commit with message
-                        execSync(`git commit -m "${message.replace(/"/g, '\\"')}"`, { cwd: projectPath });
-                        // Determine which branch to push to (master or main)
-                        let targetBranch;
-                        try {
-                            // Check if master branch exists
-                            execSync('git rev-parse --verify master', { cwd: projectPath, stdio: 'ignore' });
-                            targetBranch = 'master';
-                        }
-                        catch {
-                            try {
-                                // Check if main branch exists
-                                execSync('git rev-parse --verify main', { cwd: projectPath, stdio: 'ignore' });
-                                targetBranch = 'main';
-                            }
-                            catch {
-                                // Fallback to current branch if neither master nor main exists
-                                targetBranch = execSync('git rev-parse --abbrev-ref HEAD', { cwd: projectPath, encoding: 'utf-8' }).trim();
-                            }
-                        }
-                        // Push to origin after commit
-                        execSync(`git push origin ${targetBranch}`, { cwd: projectPath, stdio: 'pipe' });
-                        callback?.({ success: true });
-                    }
-                    catch (error) {
-                        callback?.({ success: false, error: error.message });
+            // Handle folder transfer — this device is the source (pack & upload)
+            socket.on('transfer:pack', (data) => {
+                if (foreground) {
+                    console.log(`[transfer] Pack request: ${data.sourcePath} (${data.selectedItems?.length || 0} items) → device ${data.destDeviceId.slice(0, 8)}`);
+                }
+                startSending(socket, data, foreground);
+            });
+            // Handle folder transfer — this device is the destination (download & extract)
+            socket.on('transfer:pull', (data) => {
+                if (foreground) {
+                    console.log(`[transfer] Pull request: device ${data.sourceDeviceId.slice(0, 8)} → ${data.destPath} (${(data.totalBytes / (1024 * 1024)).toFixed(1)} MB)`);
+                }
+                startReceiving(socket, data, foreground);
+            });
+            socket.on('connect', () => {
+                if (foreground) {
+                    console.log(`✓ Connected to backend at ${config.apiUrl}`);
+                    if (socket) {
+                        console.log(`   Socket ID: ${socket.id}`);
                     }
                 }
-                catch (error) {
-                    callback?.({ success: false, error: error.message });
+                else {
+                    console.log('Connected to backend');
+                }
+                reconnectAttempts = 0;
+                // Register as CLI device
+                if (socket) {
+                    socket.emit('register', { type: 'cli', deviceId });
                 }
             });
-            socket.on('github:push', async (data, callback) => {
-                try {
-                    const { projectPath } = data;
-                    // Check if directory is a git repository
-                    const gitDir = path.join(projectPath, '.git');
-                    let isRepo = false;
+            socket.on('registered', async ({ type }) => {
+                if (foreground) {
+                    console.log(`✓ Registered as ${type}`);
+                }
+                else {
+                    console.log(`Registered as ${type}`);
+                }
+                // Check for auth token: env TTC_AUTH_TOKEN or device-config.json (from previous approval)
+                let authToken = process.env.TTC_AUTH_TOKEN;
+                let deviceEmail = email;
+                let skipEmailFlow = false;
+                // Load from device-config if no env token (reuse state from previous approval)
+                if (!authToken) {
                     try {
-                        const stats = await fs.stat(gitDir);
-                        isRepo = stats.isDirectory();
+                        const deviceConfig = await readDiskDeviceConfig();
+                        authToken = deviceConfig.authToken;
+                        if (!deviceEmail && deviceConfig.email)
+                            deviceEmail = deviceConfig.email;
                     }
                     catch {
-                        callback?.({ success: false, error: 'Not a git repository' });
-                        return;
+                        // No device config yet
                     }
-                    const { execSync } = await import('child_process');
+                }
+                if (authToken) {
                     try {
-                        // Determine which branch to push to (master or main)
-                        let targetBranch;
-                        try {
-                            // Check if master branch exists
-                            execSync('git rev-parse --verify master', { cwd: projectPath, stdio: 'ignore' });
-                            targetBranch = 'master';
-                        }
-                        catch {
-                            try {
-                                // Check if main branch exists
-                                execSync('git rev-parse --verify main', { cwd: projectPath, stdio: 'ignore' });
-                                targetBranch = 'main';
-                            }
-                            catch {
-                                // Fallback to current branch if neither master nor main exists
-                                targetBranch = execSync('git rev-parse --abbrev-ref HEAD', { cwd: projectPath, encoding: 'utf-8' }).trim();
+                        const parts = authToken.split('.');
+                        if (parts.length === 3) {
+                            const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
+                            if (payload.type === 'device_auth' && payload.email) {
+                                deviceEmail = payload.email;
+                                skipEmailFlow = true;
+                                if (foreground) {
+                                    console.log(`✓ Using stored auth token for ${deviceEmail}`);
+                                }
                             }
                         }
-                        // Push to origin
-                        execSync(`git push origin ${targetBranch}`, { cwd: projectPath });
-                        callback?.({ success: true });
                     }
-                    catch (error) {
-                        callback?.({ success: false, error: error.message });
+                    catch (err) {
+                        if (foreground) {
+                            console.warn(`⚠️  Invalid auth token in config, falling back to normal auth`);
+                        }
+                        authToken = undefined;
                     }
                 }
-                catch (error) {
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            socket.on('github:discard', async (data, callback) => {
-                try {
-                    const { projectPath } = data;
-                    // Check if directory is a git repository
-                    const gitDir = path.join(projectPath, '.git');
-                    let isRepo = false;
+                // Load device email from config if not using token and not provided
+                if (!deviceEmail && !skipEmailFlow) {
                     try {
-                        const stats = await fs.stat(gitDir);
-                        isRepo = stats.isDirectory();
+                        const deviceConfig = await readDiskDeviceConfig();
+                        deviceEmail = deviceConfig.email;
                     }
                     catch {
-                        callback?.({ success: false, error: 'Not a git repository' });
-                        return;
-                    }
-                    const { execSync } = await import('child_process');
-                    try {
-                        // Discard all changes and revert to latest commit
-                        // Reset all changes (both staged and unstaged)
-                        execSync('git reset --hard HEAD', { cwd: projectPath });
-                        // Clean untracked files and directories
-                        execSync('git clean -fd', { cwd: projectPath });
-                        callback?.({ success: true });
-                    }
-                    catch (error) {
-                        callback?.({ success: false, error: error.message });
-                    }
-                }
-                catch (error) {
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            // Directory listing handler
-            socket.on('fs:list', async (data) => {
-                try {
-                    const { dirPath } = data;
-                    if (!dirPath) {
-                        socket?.emit('fs:list:response', { success: false, error: 'dirPath is required' });
-                        return;
-                    }
-                    const entries = [];
-                    try {
-                        const dirents = await fs.readdir(dirPath, { withFileTypes: true });
-                        for (const dirent of dirents) {
-                            if (dirent.name.startsWith('.'))
-                                continue; // Skip hidden files
-                            const fullPath = path.join(dirPath, dirent.name);
-                            entries.push({
-                                name: dirent.name,
-                                path: fullPath,
-                                isDir: dirent.isDirectory()
-                            });
-                        }
-                        // Sort: directories first, then alphabetically
-                        entries.sort((a, b) => {
-                            if (a.isDir && !b.isDir)
-                                return -1;
-                            if (!a.isDir && b.isDir)
-                                return 1;
-                            return a.name.localeCompare(b.name);
-                        });
-                        socket?.emit('fs:list:response', { success: true, entries });
-                    }
-                    catch (err) {
-                        socket?.emit('fs:list:response', { success: false, error: err.message });
-                    }
-                }
-                catch (error) {
-                    socket?.emit('fs:list:response', { success: false, error: error.message });
-                }
-            });
-            // File write handler - supports text (utf-8) and binary (base64) files
-            socket.on('fs:write', async (data) => {
-                try {
-                    const { filePath, content, encoding = 'utf-8' } = data;
-                    if (!filePath) {
-                        socket?.emit('fs:write:response', { success: false, error: 'filePath is required' });
-                        return;
-                    }
-                    try {
-                        // Ensure directory exists
-                        const dir = path.dirname(filePath);
-                        await fs.mkdir(dir, { recursive: true });
-                        // Write file - support base64 encoding for binary files
-                        if (encoding === 'base64') {
-                            const buffer = Buffer.from(content, 'base64');
-                            await fs.writeFile(filePath, buffer);
-                        }
-                        else {
-                            await fs.writeFile(filePath, content, encoding);
-                        }
-                        socket?.emit('fs:write:response', { success: true });
-                    }
-                    catch (err) {
-                        socket?.emit('fs:write:response', { success: false, error: err.message });
-                    }
-                }
-                catch (error) {
-                    socket?.emit('fs:write:response', { success: false, error: error.message });
-                }
-            });
-            // File read handler
-            socket.on('fs:read', async (data) => {
-                try {
-                    const { filePath, encoding = 'utf-8' } = data;
-                    if (!filePath) {
-                        socket?.emit('fs:read:response', { success: false, error: 'filePath is required' });
-                        return;
-                    }
-                    try {
-                        // Read file
-                        const content = await fs.readFile(filePath, encoding);
-                        socket?.emit('fs:read:response', { success: true, content });
-                    }
-                    catch (err) {
-                        socket?.emit('fs:read:response', { success: false, error: err.message });
-                    }
-                }
-                catch (error) {
-                    socket?.emit('fs:read:response', { success: false, error: error.message });
-                }
-            });
-            // Session handlers
-            socket.on('session:create', async (data) => {
-                try {
-                    let { sessionId, projectPath } = data;
-                    // Remap /home/abc to /tmp/abc if /home/abc doesn't exist (container workaround)
-                    if (projectPath === '/home/abc' && !fsSync.existsSync('/home/abc')) {
-                        const fallbackPath = '/tmp/abc';
-                        fsSync.mkdirSync(fallbackPath, { recursive: true });
-                        projectPath = fallbackPath;
-                        console.log(`[CLI] Remapped /home/abc -> ${fallbackPath}`);
-                    }
-                    activeSessions.set(sessionId, { projectPath });
-                    if (foreground) {
-                        console.log(`💬 Session created: ${sessionId}`);
-                        console.log(`   Project: ${projectPath}`);
-                    }
-                    else {
-                        console.log(`Session created: ${sessionId} in project ${projectPath}`);
-                    }
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Failed to create session: ${error.message}`);
-                    }
-                    else {
-                        console.error('Failed to create session:', error.message);
-                    }
-                }
-            });
-            socket.on('session:delete', async (data) => {
-                try {
-                    const { sessionId } = data;
-                    if (foreground) {
-                        console.log(`🗑️  Deleting session: ${sessionId}`);
-                    }
-                    await agentSessionManager.deleteSession(sessionId);
-                    activeSessions.delete(sessionId);
-                    if (foreground) {
-                        console.log(`✓ Session deleted: ${sessionId}`);
-                    }
-                    else {
-                        console.log(`Session deleted: ${sessionId}`);
-                    }
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Failed to delete session: ${error.message}`);
-                    }
-                    else {
-                        console.error('Failed to delete session:', error.message);
-                    }
-                }
-            });
-            socket.on('project:config:analyze', async (data) => {
-                try {
-                    const { projectId, projectPath, projectName, analysisId } = data;
-                    if (foreground) {
-                        console.log(`🔍 Analyzing project: ${projectName} at ${projectPath}`);
-                    }
-                    // Run Claude analysis
-                    const config = await analyzeProjectWithClaude(projectPath, projectName);
-                    // Save config file (.talk-to-code.json)
-                    await saveProjectConfig(projectPath, config);
-                    // Generate and save runner files for each app
-                    for (const app of config.apps) {
-                        const runnerCode = generateRunnerCode(app, projectPath);
-                        const runnerFileName = `${app.name}_runner.ts`;
-                        const runnerPath = path.join(projectPath, app.directory || '', runnerFileName);
-                        // Ensure directory exists
-                        const runnerDir = path.dirname(runnerPath);
-                        await fs.mkdir(runnerDir, { recursive: true });
-                        // Write runner file
-                        await fs.writeFile(runnerPath, runnerCode, 'utf-8');
-                        if (foreground) {
-                            console.log(`✓ Generated runner: ${runnerFileName}`);
-                        }
-                    }
-                    if (foreground) {
-                        console.log(`✓ Analysis complete: Found ${config.apps.length} apps`);
-                        console.log(`✓ Generated ${config.apps.length} runner files`);
-                    }
-                    // Emit result back to backend
-                    socket.emit('project:config:analyzed', {
-                        projectId,
-                        config,
-                        analysisId
-                    });
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Analysis error: ${error.message}`);
-                    }
-                    socket.emit('project:config:analyze:error', {
-                        projectId: data.projectId,
-                        error: error.message,
-                        analysisId: data.analysisId
-                    });
-                }
-            });
-            // App control handlers
-            socket.on('app:start', async (data, callback) => {
-                try {
-                    const { projectId, projectPath, appName } = data;
-                    // Load project config to get app details
-                    const config = await getProjectConfig(projectPath);
-                    if (!config) {
-                        callback?.({ success: false, error: 'Project config not found' });
-                        return;
-                    }
-                    const app = config.apps.find(a => a.name === appName);
-                    if (!app) {
-                        callback?.({ success: false, error: `App "${appName}" not found in project config` });
-                        return;
-                    }
-                    const result = await startApp(projectPath, projectId, app);
-                    if (result.success) {
-                        if (foreground) {
-                            console.log(`✓ Started app: ${appName} (PID: ${result.pid})`);
-                        }
-                        socket.emit('app:started', {
-                            projectId,
-                            appName,
-                            processId: result.processId,
-                            pid: result.pid,
-                        });
-                    }
-                    callback?.(result);
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Error starting app: ${error.message}`);
-                    }
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            socket.on('app:stop', async (data, callback) => {
-                try {
-                    const { projectId, projectPath, appName } = data;
-                    // Load project config to get app details (for custom stop command)
-                    const config = await getProjectConfig(projectPath);
-                    const app = config?.apps.find(a => a.name === appName);
-                    const result = await stopApp(projectId, appName, app);
-                    if (result.success) {
-                        if (foreground) {
-                            console.log(`✓ Stopped app: ${appName}`);
-                        }
-                        socket.emit('app:stopped', {
-                            projectId,
-                            appName,
-                            appControlId: data.appControlId,
-                        });
-                    }
-                    callback?.(result);
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Error stopping app: ${error.message}`);
-                    }
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            socket.on('app:restart', async (data, callback) => {
-                try {
-                    const { projectId, projectPath, appName } = data;
-                    // Load project config to get app details
-                    const config = await getProjectConfig(projectPath);
-                    if (!config) {
-                        callback?.({ success: false, error: 'Project config not found' });
-                        return;
-                    }
-                    const app = config.apps.find(a => a.name === appName);
-                    if (!app) {
-                        callback?.({ success: false, error: `App "${appName}" not found in project config` });
-                        return;
-                    }
-                    const result = await restartApp(projectPath, projectId, app);
-                    if (result.success) {
-                        if (foreground) {
-                            console.log(`✓ Restarted app: ${appName} (PID: ${result.pid})`);
-                        }
-                        socket.emit('app:restarted', {
-                            projectId,
-                            appName,
-                            processId: result.processId,
-                            pid: result.pid,
-                            appControlId: data.appControlId,
-                        });
-                    }
-                    callback?.(result);
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Error restarting app: ${error.message}`);
-                    }
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            socket.on('app:status', async (data, callback) => {
-                try {
-                    const { projectId, projectPath, appName } = data;
-                    // Load project config
-                    const config = await getProjectConfig(projectPath);
-                    if (!config) {
-                        callback?.({ success: false, error: 'Project config not found' });
-                        return;
-                    }
-                    const appsToCheck = appName
-                        ? config.apps.filter(a => a.name === appName)
-                        : config.apps;
-                    const statuses = getAppStatuses(projectId, appsToCheck);
-                    // Send response back to backend
-                    if (data.appControlId) {
-                        socket.emit('app:control:response', {
-                            appControlId: data.appControlId,
-                            success: true,
-                            apps: statuses,
-                        });
-                    }
-                    callback?.({ success: true, apps: statuses });
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Error getting app status: ${error.message}`);
-                    }
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            socket.on('app:logs', async (data, callback) => {
-                try {
-                    const { projectId, appName } = data;
-                    const result = await getAppLogs(projectId, appName, 100);
-                    // Send response back to backend
-                    if (data.appControlId) {
-                        socket.emit('app:control:response', {
-                            appControlId: data.appControlId,
-                            ...result,
-                        });
-                    }
-                    callback?.(result);
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Error getting app logs: ${error.message}`);
-                    }
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            socket.on('session:prompt', async (data) => {
-                try {
-                    const { sessionId, prompt, projectPath: providedProjectPath, promptId, enhancers, model } = data;
-                    // promptId is REQUIRED when routing to device
-                    if (!promptId) {
-                        if (foreground) {
-                            console.error(`✗ Missing required promptId for session: ${sessionId}`);
-                        }
-                        socket.emit('session:error', { sessionId, error: 'Missing required promptId' });
-                        return;
-                    }
-                    // Try to get projectPath from activeSessions or use provided one
-                    let projectPath = providedProjectPath || activeSessions.get(sessionId)?.projectPath;
-                    if (!projectPath) {
-                        if (foreground) {
-                            console.error(`✗ Session not found: ${sessionId} (missing projectPath)`);
-                        }
-                        socket.emit('session:error', { sessionId, error: 'Session not found or projectPath missing' });
-                        return;
-                    }
-                    // Store in activeSessions with promptId and model
-                    activeSessions.set(sessionId, { projectPath, currentPromptId: promptId, model });
-                    // Capture promptId in closure to prevent race conditions when multiple prompts arrive quickly
-                    // This ensures each prompt's messages use the correct promptId even if a new prompt arrives
-                    const capturedPromptId = promptId;
-                    if (foreground) {
-                        console.log(`\n[CLI] 📤 Received prompt for session: ${sessionId}, promptId: ${capturedPromptId}`);
-                        console.log(`[CLI]    Prompt: ${prompt.substring(0, 100)}${prompt.length > 100 ? '...' : ''}`);
-                    }
-                    // Create or get session handler
-                    await agentSessionManager.createSession({
-                        sessionId,
-                        projectPath,
-                        onOutput: (output) => {
-                            // Serialize data to string if it's an object
-                            const dataString = typeof output.data === 'string'
-                                ? output.data
-                                : JSON.stringify(output.data);
-                            // Use captured promptId (not currentPromptId from activeSessions) to prevent race conditions
-                            if (!capturedPromptId) {
-                                console.error(`[CLI] Missing promptId for session ${sessionId}, cannot emit prompt:output`);
-                                return;
-                            }
-                            socket.emit('prompt:output', {
-                                sessionId,
-                                promptId: capturedPromptId, // Use captured promptId, not currentPromptId
-                                type: output.type,
-                                data: dataString,
-                                timestamp: output.timestamp,
-                                metadata: output.metadata
-                            });
-                        },
-                        onError: (error) => {
-                            socket.emit('session:error', { sessionId, error });
-                        },
-                        onComplete: (exitCode) => {
-                            // Note: This onComplete is from createSession, not sendPrompt
-                            // The actual session:result is emitted from sendPrompt handler below
-                            // This handler is kept for backward compatibility but may not be used
-                        },
-                    });
-                    // Send prompt - status updates will be emitted from agentSession when processing starts/completes
-                    await agentSessionManager.sendPrompt(sessionId, prompt, enhancers || [], {
-                        sessionId,
-                        projectPath,
-                        promptId: capturedPromptId,
-                        model: model, // Pass the model from the session
-                        attachments: data.attachments, // Pass attachments from frontend
-                        onStatusUpdate: (status) => {
-                            // Emit status update from CLI (CLI is source of truth)
-                            // Use captured promptId to ensure correct prompt is updated
-                            if (!capturedPromptId) {
-                                console.error(`[CLI] Missing promptId for status update, cannot emit prompt:updated`);
-                                return;
-                            }
-                            // Always log status updates for debugging (even in background mode)
-                            console.log(`[CLI] 📊 Status update: promptId=${capturedPromptId}, status=${status}, sessionId=${sessionId}`);
-                            // Emit status update IMMEDIATELY (real-time)
-                            socket.emit('prompt:updated', {
-                                promptId: capturedPromptId, // CRITICAL: Use captured promptId from closure
-                                sessionId,
-                                text: prompt,
-                                status,
-                                createdAt: new Date().toISOString(),
-                                ...(status === 'running' ? { startedAt: new Date().toISOString() } : {}),
-                                ...(status === 'completed' || status === 'error' || status === 'cancelled' ? { completedAt: new Date().toISOString() } : {}),
-                                messages: []
-                            });
-                        },
-                        onOutput: (output) => {
-                            // Serialize data to string if it's an object
-                            const dataString = typeof output.data === 'string'
-                                ? output.data
-                                : JSON.stringify(output.data);
-                            // Use captured promptId (not currentPromptId from activeSessions) to prevent race conditions
-                            if (!capturedPromptId) {
-                                console.error(`[CLI] Missing promptId for session ${sessionId}, cannot emit prompt:output`);
-                                return;
-                            }
-                            if (foreground && output.type === 'stdout') {
-                                process.stdout.write(dataString);
-                            }
-                            socket.emit('prompt:output', {
-                                sessionId,
-                                promptId: capturedPromptId, // Use captured promptId, not currentPromptId
-                                type: output.type,
-                                data: dataString,
-                                timestamp: output.timestamp,
-                                metadata: output.metadata
-                            });
-                        },
-                        onError: (error) => {
-                            // Error logging is handled by AgentLogger in agentSession.ts
-                            // Additional console output for foreground mode
-                            if (foreground) {
-                                console.error(`\n[CLI] ✗ Session error: ${error}`);
-                            }
-                            socket.emit('session:error', { sessionId, error });
-                        },
-                        onComplete: (exitCode) => {
-                            // Completion logging is handled by AgentLogger in agentSession.ts
-                            // Additional console output for foreground mode
-                            if (foreground) {
-                                console.log(`\n[CLI] ✓ Session completed with exit code: ${exitCode ?? 'null'}`);
-                            }
-                            // Use captured promptId (not currentPromptId from activeSessions) to prevent race conditions
-                            if (!capturedPromptId) {
-                                console.error(`[CLI] Missing promptId for session ${sessionId}, cannot emit session:result`);
-                                return;
-                            }
-                            socket.emit('session:result', {
-                                sessionId,
-                                promptId: capturedPromptId, // Use captured promptId, not currentPromptId
-                                exitCode
-                            });
-                        }
-                    });
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Error processing prompt: ${error.message}`);
-                    }
-                    socket.emit('session:error', { sessionId: data.sessionId, error: error.message });
-                }
-            });
-            // Handle prompt cancellation
-            socket.on('prompt:cancel', async (data, callback) => {
-                try {
-                    const { promptId, sessionId } = data;
-                    if (!promptId || !sessionId) {
-                        callback?.({ success: false, error: 'Missing promptId or sessionId' });
-                        return;
-                    }
-                    if (foreground) {
-                        console.log(`[CLI] 🛑 Cancelling prompt: ${promptId}`);
-                    }
-                    // Cancel the prompt
-                    const cancelled = await agentSessionManager.cancelPrompt(promptId, sessionId, (status) => {
-                        // Emit cancelled status update
-                        socket.emit('prompt:updated', {
-                            promptId,
-                            sessionId,
-                            text: '', // Not needed for status update
-                            status: 'cancelled',
-                            createdAt: new Date().toISOString(),
-                            completedAt: new Date().toISOString(),
-                            messages: []
-                        });
-                    });
-                    if (cancelled) {
-                        callback?.({ success: true });
-                    }
-                    else {
-                        callback?.({ success: false, error: 'Prompt not found or already completed' });
-                    }
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Error cancelling prompt: ${error.message}`);
-                    }
-                    callback?.({ success: false, error: error.message });
-                }
-            });
-            // Handle emergency stop - forcefully halt all session activity
-            socket.on('emergency:stop', async (data, callback) => {
-                try {
-                    const { sessionId } = data;
-                    if (!sessionId) {
-                        callback?.({ success: false, message: 'Missing sessionId' });
-                        return;
-                    }
-                    if (foreground) {
-                        console.log(`[CLI] ☠️  EMERGENCY STOP for session: ${sessionId}`);
-                    }
-                    // Execute emergency stop
-                    const result = await agentSessionManager.emergencyStop(sessionId);
-                    // Emit status update for current prompt if any
-                    socket.emit('emergency:stopped', {
-                        sessionId,
-                        success: result.success,
-                        message: result.message,
-                        timestamp: new Date().toISOString()
-                    });
-                    callback?.(result);
-                }
-                catch (error) {
-                    if (foreground) {
-                        console.error(`✗ Error during emergency stop: ${error.message}`);
-                    }
-                    callback?.({ success: false, message: error.message });
-                }
-            });
-            // Handle image save request - saves base64 images to tmp directory
-            socket.on('image:save', async (data) => {
-                try {
-                    const { images, saveCallbackId, projectPath } = data;
-                    if (foreground) {
-                        console.log(`[CLI] 🖼️  Received request to save ${images.length} image(s)`);
-                    }
-                    // Use project-specific tmp directory (inside the project)
-                    // If projectPath is provided, use it; otherwise fall back to current working directory
-                    const basePath = projectPath || process.cwd();
-                    const tmpDir = path.join(basePath, 'tmp');
-                    await fs.mkdir(tmpDir, { recursive: true });
-                    if (foreground) {
-                        console.log(`[CLI] 📁 Saving to directory: ${tmpDir}`);
-                    }
-                    let savedCount = 0;
-                    const errors = [];
-                    for (const image of images) {
-                        try {
-                            const imagePath = path.join(tmpDir, image.name);
-                            // Convert base64 to buffer and write to file
-                            const buffer = Buffer.from(image.data, 'base64');
-                            await fs.writeFile(imagePath, buffer);
-                            if (foreground) {
-                                console.log(`[CLI] ✓ Saved image: ${imagePath}`);
-                            }
-                            savedCount++;
-                        }
-                        catch (saveError) {
-                            const errorMsg = `Failed to save ${image.name}: ${saveError.message}`;
-                            errors.push(errorMsg);
-                            if (foreground) {
-                                console.error(`[CLI] ✗ ${errorMsg}`);
-                            }
-                        }
-                    }
-                    // Send response back via app:control:response
-                    console.log(`[CLI] Sending app:control:response with appControlId=${saveCallbackId}, success=${errors.length === 0}, savedCount=${savedCount}`);
-                    socket.emit('app:control:response', {
-                        appControlId: saveCallbackId,
-                        success: errors.length === 0,
-                        savedCount,
-                        error: errors.length > 0 ? errors.join('; ') : undefined
-                    });
-                    console.log(`[CLI] Emitted app:control:response`);
-                    if (foreground) {
-                        if (errors.length > 0) {
-                            console.log(`[CLI] ⚠️  Saved ${savedCount}/${images.length} images with errors`);
-                        }
-                        else {
-                            console.log(`[CLI] ✓ Successfully saved all ${savedCount} images to ${tmpDir}`);
-                        }
-                    }
-                }
-                catch (error) {
-                    console.error(`[CLI] ✗ Error saving images: ${error.message}`);
-                    // Send error response
-                    console.log(`[CLI] Sending error app:control:response with appControlId=${data.saveCallbackId}`);
-                    socket.emit('app:control:response', {
-                        appControlId: data.saveCallbackId,
-                        success: false,
-                        error: error.message
-                    });
-                    console.log(`[CLI] Emitted error app:control:response`);
-                }
-            });
-            // Handle folder transfer — this device is the source (pack & upload)
-            socket.on('transfer:pack', (data) => {
-                if (foreground) {
-                    console.log(`[transfer] Pack request: ${data.sourcePath} (${data.selectedItems?.length || 0} items) → device ${data.destDeviceId.slice(0, 8)}`);
-                }
-                startSending(socket, data, foreground);
-            });
-            // Handle folder transfer — this device is the destination (download & extract)
-            socket.on('transfer:pull', (data) => {
-                if (foreground) {
-                    console.log(`[transfer] Pull request: device ${data.sourceDeviceId.slice(0, 8)} → ${data.destPath} (${(data.totalBytes / (1024 * 1024)).toFixed(1)} MB)`);
-                }
-                startReceiving(socket, data, foreground);
-            });
-            socket.on('connect', () => {
-                if (foreground) {
-                    console.log(`✓ Connected to backend at ${config.apiUrl}`);
-                    if (socket) {
-                        console.log(`   Socket ID: ${socket.id}`);
-                    }
-                }
-                else {
-                    console.log('Connected to backend');
-                }
-                reconnectAttempts = 0;
-                // Register as CLI device
-                if (socket) {
-                    socket.emit('register', { type: 'cli', deviceId });
-                }
-            });
-            socket.on('registered', async ({ type }) => {
-                if (foreground) {
-                    console.log(`✓ Registered as ${type}`);
-                }
-                else {
-                    console.log(`Registered as ${type}`);
-                }
-                // Check for auth token: env TTC_AUTH_TOKEN or device-config.json (from previous approval)
-                let authToken = process.env.TTC_AUTH_TOKEN;
-                let deviceEmail = email;
-                let skipEmailFlow = false;
-                // Load from device-config if no env token (reuse state from previous approval)
-                if (!authToken) {
-                    try {
-                        const deviceConfig = await readDiskDeviceConfig();
-                        authToken = deviceConfig.authToken;
-                        if (!deviceEmail && deviceConfig.email)
-                            deviceEmail = deviceConfig.email;
-                    }
-                    catch {
-                        // No device config yet
-                    }
-                }
-                if (authToken) {
-                    try {
-                        const parts = authToken.split('.');
-                        if (parts.length === 3) {
-                            const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
-                            if (payload.type === 'device_auth' && payload.email) {
-                                deviceEmail = payload.email;
-                                skipEmailFlow = true;
-                                if (foreground) {
-                                    console.log(`✓ Using stored auth token for ${deviceEmail}`);
-                                }
-                            }
-                        }
-                    }
-                    catch (err) {
-                        if (foreground) {
-                            console.warn(`⚠️  Invalid auth token in config, falling back to normal auth`);
-                        }
-                        authToken = undefined;
-                    }
-                }
-                // Load device email from config if not using token and not provided
-                if (!deviceEmail && !skipEmailFlow) {
-                    try {
-                        const deviceConfig = await readDiskDeviceConfig();
-                        deviceEmail = deviceConfig.email;
-                    }
-                    catch {
-                        // No device config yet
+                        // No device config yet
                     }
                 }
                 // Register device with backend
@@ -1788,675 +874,10 @@ async function runDaemon(foreground = false, email) {
                     }, 2000);
                 });
             });
-            // Cloudflared handlers
-            // Proxy toggle handler
-            socket.on('proxy:toggle:request', async (data, callback) => {
-                try {
-                    const { enable } = data;
-                    const proxyUrl = getProxyUrl();
-                    if (enable && !proxyUrl) {
-                        callback?.({ success: false, enabled: false });
-                        return;
-                    }
-                    await writeProxyConfig({ enabled: enable });
-                    if (foreground) {
-                        console.log(`[CLI] Proxy ${enable ? 'enabled' : 'disabled'}${proxyUrl ? `: ${proxyUrl}` : ''}`);
-                    }
-                    else {
-                        console.log(`Proxy ${enable ? 'enabled' : 'disabled'}`);
-                    }
-                    callback?.({ success: true, enabled: enable, proxyUrl: enable ? proxyUrl : undefined });
-                }
-                catch (error) {
-                    callback?.({ success: false, enabled: false });
-                }
-            });
-            // Proxy status handler
-            socket.on('proxy:status:request', async (_data, callback) => {
-                try {
-                    const proxyConfig = await readProxyConfig();
-                    const proxyUrl = getProxyUrl();
-                    callback?.({ enabled: proxyConfig.enabled, proxyUrl: proxyConfig.enabled ? proxyUrl : undefined });
-                }
-                catch {
-                    callback?.({ enabled: false });
-                }
-            });
-            socket.on('cloudflared:check:request', async () => {
-                try {
-                    let installed = false;
-                    let hasCert = false;
-                    let activeTunnelId;
-                    try {
-                        // Check if cloudflared is installed
-                        execSync('which cloudflared', { stdio: 'ignore' });
-                        installed = true;
-                        // Check if cert.pem exists
-                        const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem');
-                        try {
-                            // Use fs.stat to check if file exists (more reliable than access)
-                            const stats = await fs.stat(certPath);
-                            hasCert = stats.isFile();
-                            if (foreground && hasCert) {
-                                console.log(`✓ Found cert.pem at ${certPath}`);
-                            }
-                        }
-                        catch (err) {
-                            // File doesn't exist or can't be accessed
-                            hasCert = false;
-                            if (foreground) {
-                                console.log(`✗ cert.pem not found at ${certPath}: ${err.message}`);
-                            }
-                        }
-                        // Detect running cloudflared tunnel by inspecting processes
-                        try {
-                            const psOutput = execSync('ps aux', { encoding: 'utf-8' });
-                            const cloudflaredLines = psOutput.split('\n').filter(line => line.includes('cloudflared') && line.includes('tunnel'));
-                            for (const line of cloudflaredLines) {
-                                // Look for --token flag in the process args
-                                const tokenMatch = line.match(/--token\s+(\S+)/);
-                                if (tokenMatch && tokenMatch[1]) {
-                                    try {
-                                        // Decode base64url token to extract tunnel ID
-                                        const tokenB64 = tokenMatch[1].replace(/-/g, '+').replace(/_/g, '/');
-                                        const padded = tokenB64 + '='.repeat((4 - tokenB64.length % 4) % 4);
-                                        const tokenJson = Buffer.from(padded, 'base64').toString('utf-8');
-                                        const tokenData = JSON.parse(tokenJson);
-                                        if (tokenData.t) {
-                                            activeTunnelId = tokenData.t;
-                                            if (foreground) {
-                                                console.log(`✓ Detected active tunnel: ${activeTunnelId}`);
-                                            }
-                                            break;
-                                        }
-                                    }
-                                    catch {
-                                        // Failed to decode token, skip
-                                    }
-                                }
-                                // Also check for named tunnel (cloudflared tunnel run <name>)
-                                const nameMatch = line.match(/cloudflared.*tunnel\s+run\s+(?:--.*?\s+)?(\S+)/);
-                                if (!activeTunnelId && nameMatch && nameMatch[1] && !nameMatch[1].startsWith('-')) {
-                                    // This is a tunnel name, not an ID - we'll resolve it later via API
-                                    activeTunnelId = nameMatch[1];
-                                    if (foreground) {
-                                        console.log(`✓ Detected running tunnel name: ${activeTunnelId}`);
-                                    }
-                                    break;
-                                }
-                            }
-                        }
-                        catch {
-                            // ps failed, can't detect active tunnel
-                        }
-                    }
-                    catch {
-                        installed = false;
-                    }
-                    socket.emit('cloudflared:check:response', { installed, hasCert, activeTunnelId });
-                    if (foreground) {
-                        console.log(`Cloudflared check: installed=${installed}, hasCert=${hasCert}, activeTunnelId=${activeTunnelId || 'none'}`);
-                    }
-                }
-                catch (error) {
-                    socket.emit('cloudflared:check:response', { installed: false, hasCert: false });
-                }
-            });
-            socket.on('cloudflared:sync:request', async () => {
-                try {
-                    const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem');
-                    if (foreground) {
-                        console.log(`Syncing credentials from ${certPath}`);
-                    }
-                    // Read cert.pem file
-                    const certContent = await fs.readFile(certPath, 'utf-8');
-                    // Extract token between BEGIN and END markers
-                    const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/);
-                    if (tokenMatch && tokenMatch[1]) {
-                        // Decode base64 token
-                        const tokenBase64 = tokenMatch[1].replace(/\s/g, '');
-                        const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8');
-                        const tokenData = JSON.parse(tokenJson);
-                        // Extract API token, account ID, and zone ID
-                        const apiToken = tokenData.apiToken;
-                        const accountId = tokenData.accountID;
-                        const zoneId = tokenData.zoneID;
-                        if (foreground) {
-                            console.log(`✓ Extracted credentials: accountId=${accountId}, zoneId=${zoneId}`);
-                        }
-                        socket.emit('cloudflared:sync:complete', {
-                            accountId,
-                            accountName: undefined,
-                            apiToken,
-                            zoneId
-                        });
-                    }
-                    else {
-                        const error = 'Failed to extract token from cert.pem';
-                        if (foreground) {
-                            console.error(`✗ ${error}`);
-                        }
-                        socket.emit('cloudflared:sync:error', { error });
-                    }
-                }
-                catch (error) {
-                    const errorMsg = `Failed to read cert.pem: ${error.message}`;
-                    if (foreground) {
-                        console.error(`✗ ${errorMsg}`);
-                    }
-                    socket.emit('cloudflared:sync:error', { error: errorMsg });
-                }
-            });
-            socket.on('cloudflared:login:request', async () => {
-                try {
-                    // Run cloudflared tunnel login
-                    const loginProcess = spawn('cloudflared', ['tunnel', 'login'], {
-                        stdio: ['ignore', 'pipe', 'pipe']
-                    });
-                    let stdout = '';
-                    let stderr = '';
-                    let urlEmitted = false;
-                    let alreadyLoggedIn = false;
-                    let certPath = null;
-                    const extractCertPath = (text) => {
-                        // Look for: "You have an existing certificate at /path/to/cert.pem"
-                        const pathMatch = text.match(/existing certificate at\s+([^\s]+)/i) ||
-                            text.match(/certificate at\s+([^\s]+)/i) ||
-                            text.match(/cert\.pem.*?at\s+([^\s]+)/i);
-                        return pathMatch ? pathMatch[1] : null;
-                    };
-                    const extractLoginUrl = (text) => {
-                        // Look for URLs in the output
-                        const urlPatterns = [
-                            /https:\/\/dash\.cloudflare\.com\/argotunnel[^\s\)]+/g,
-                            /https:\/\/[^\s\)]+cloudflareaccess\.org[^\s\)]+/g,
-                            /https:\/\/[^\s\)]+cloudflare\.com[^\s\)]+/g
-                        ];
-                        for (const pattern of urlPatterns) {
-                            const matches = text.match(pattern);
-                            if (matches && matches.length > 0) {
-                                return matches[0];
-                            }
-                        }
-                        return null;
-                    };
-                    loginProcess.stdout.on('data', (data) => {
-                        const text = data.toString();
-                        stdout += text;
-                        // Check for already logged in error
-                        if (text.includes('existing certificate') || text.includes('cert.pem which login would overwrite')) {
-                            alreadyLoggedIn = true;
-                            const extractedPath = extractCertPath(text);
-                            if (extractedPath) {
-                                certPath = extractedPath;
-                            }
-                        }
-                        // Extract login URL if not already logged in
-                        if (!alreadyLoggedIn && !urlEmitted) {
-                            const url = extractLoginUrl(text);
-                            if (url) {
-                                urlEmitted = true;
-                                socket.emit('cloudflared:login:url', { loginUrl: url });
-                            }
-                        }
-                    });
-                    loginProcess.stderr.on('data', (data) => {
-                        const text = data.toString();
-                        stderr += text;
-                        // Check for already logged in error (often in stderr)
-                        if (text.includes('existing certificate') || text.includes('cert.pem which login would overwrite')) {
-                            alreadyLoggedIn = true;
-                            const extractedPath = extractCertPath(text);
-                            if (extractedPath) {
-                                certPath = extractedPath;
-                            }
-                        }
-                        // Extract login URL if not already logged in
-                        if (!alreadyLoggedIn && !urlEmitted) {
-                            const url = extractLoginUrl(text);
-                            if (url) {
-                                urlEmitted = true;
-                                socket.emit('cloudflared:login:url', { loginUrl: url });
-                            }
-                        }
-                    });
-                    loginProcess.on('close', async (code) => {
-                        if (alreadyLoggedIn && certPath) {
-                            // Already logged in - extract credentials from existing cert
-                            try {
-                                if (foreground) {
-                                    console.log(`Already logged in, extracting credentials from ${certPath}`);
-                                }
-                                const certContent = await fs.readFile(certPath, 'utf-8');
-                                const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/);
-                                if (tokenMatch && tokenMatch[1]) {
-                                    const tokenBase64 = tokenMatch[1].replace(/\s/g, '');
-                                    const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8');
-                                    const tokenData = JSON.parse(tokenJson);
-                                    if (foreground) {
-                                        console.log(`✓ Extracted credentials from existing cert`);
-                                    }
-                                    socket.emit('cloudflared:login:complete', {
-                                        accountId: tokenData.accountID,
-                                        accountName: undefined,
-                                        apiToken: tokenData.apiToken,
-                                        zoneId: tokenData.zoneID
-                                    });
-                                }
-                                else {
-                                    const error = 'Failed to extract token from existing cert.pem';
-                                    if (foreground) {
-                                        console.error(`✗ ${error}`);
-                                    }
-                                    socket.emit('cloudflared:login:error', { error });
-                                }
-                            }
-                            catch (error) {
-                                const errorMsg = `Failed to read cert.pem: ${error.message}`;
-                                if (foreground) {
-                                    console.error(`✗ ${errorMsg}`);
-                                }
-                                socket.emit('cloudflared:login:error', { error: errorMsg });
-                            }
-                        }
-                        else if (code === 0 && !alreadyLoggedIn) {
-                            // Login completed successfully - wait a moment then extract credentials
-                            if (foreground) {
-                                console.log('Login completed, extracting credentials...');
-                            }
-                            setTimeout(async () => {
-                                try {
-                                    const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem');
-                                    const certContent = await fs.readFile(certPath, 'utf-8');
-                                    const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/);
-                                    if (tokenMatch && tokenMatch[1]) {
-                                        const tokenBase64 = tokenMatch[1].replace(/\s/g, '');
-                                        const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8');
-                                        const tokenData = JSON.parse(tokenJson);
-                                        if (foreground) {
-                                            console.log(`✓ Extracted credentials after login`);
-                                        }
-                                        socket.emit('cloudflared:login:complete', {
-                                            accountId: tokenData.accountID,
-                                            accountName: undefined,
-                                            apiToken: tokenData.apiToken,
-                                            zoneId: tokenData.zoneID
-                                        });
-                                    }
-                                    else {
-                                        const error = 'Failed to extract token from cert.pem after login';
-                                        if (foreground) {
-                                            console.error(`✗ ${error}`);
-                                        }
-                                        socket.emit('cloudflared:login:error', { error });
-                                    }
-                                }
-                                catch (error) {
-                                    const errorMsg = `Failed to read cert.pem after login: ${error.message}`;
-                                    if (foreground) {
-                                        console.error(`✗ ${errorMsg}`);
-                                    }
-                                    socket.emit('cloudflared:login:error', { error: errorMsg });
-                                }
-                            }, 1000); // Wait 1 second for file to be written
-                        }
-                        else if (!alreadyLoggedIn) {
-                            const error = `Login failed with code ${code}: ${stderr || stdout}`;
-                            if (foreground) {
-                                console.error(`✗ ${error}`);
-                            }
-                            socket.emit('cloudflared:login:error', { error });
-                        }
-                    });
-                    loginProcess.on('error', (error) => {
-                        socket.emit('cloudflared:login:error', { error: error.message });
-                    });
-                }
-                catch (error) {
-                    socket.emit('cloudflared:login:error', { error: error.message });
-                }
-            });
-            socket.on('cloudflared:regenerate:request', async () => {
-                try {
-                    const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem');
-                    // Delete existing cert.pem
-                    try {
-                        await fs.unlink(certPath);
-                        if (foreground) {
-                            console.log(`✓ Deleted existing cert.pem`);
-                        }
-                    }
-                    catch (error) {
-                        // File might not exist, that's okay
-                        if (foreground && error.code !== 'ENOENT') {
-                            console.log(`Note: Could not delete cert.pem: ${error.message}`);
-                        }
-                    }
-                    // Emit success - frontend will then trigger login
-                    socket.emit('cloudflared:regenerate:complete', {});
-                }
-                catch (error) {
-                    socket.emit('cloudflared:regenerate:error', { error: error.message });
-                }
-            });
-            socket.on('cloudflared:login:request', async () => {
-                try {
-                    // First check if cloudflared is installed
-                    try {
-                        execSync('which cloudflared', { stdio: 'ignore' });
-                    }
-                    catch {
-                        socket.emit('cloudflared:login:error', { error: 'cloudflared is not installed' });
-                        return;
-                    }
-                    // Run cloudflared tunnel login
-                    // This command outputs a URL that needs to be visited
-                    const loginProcess = spawn('cloudflared', ['tunnel', 'login'], {
-                        stdio: ['ignore', 'pipe', 'pipe']
-                    });
-                    let stdout = '';
-                    let stderr = '';
-                    let urlEmitted = false;
-                    const findAndEmitUrl = (text) => {
-                        if (urlEmitted)
-                            return;
-                        // Look for URL in output - cloudflared outputs URLs in various formats
-                        const urlPatterns = [
-                            /https:\/\/[^\s\)]+/g,
-                            /https:\/\/[^\n]+/g
-                        ];
-                        for (const pattern of urlPatterns) {
-                            const matches = text.match(pattern);
-                            if (matches && matches.length > 0) {
-                                // Find the login URL (usually contains "cloudflareaccess.com" or similar)
-                                const loginUrl = matches.find(url => url.includes('cloudflareaccess.com') ||
-                                    url.includes('cloudflare.com') ||
-                                    url.includes('trycloudflare.com') ||
-                                    url.includes('dash.cloudflare.com'));
-                                if (loginUrl) {
-                                    urlEmitted = true;
-                                    socket.emit('cloudflared:login:url', { loginUrl: loginUrl.trim() });
-                                    return;
-                                }
-                            }
-                        }
-                    };
-                    loginProcess.stdout.on('data', (data) => {
-                        const text = data.toString();
-                        stdout += text;
-                        findAndEmitUrl(text);
-                    });
-                    loginProcess.stderr.on('data', (data) => {
-                        const text = data.toString();
-                        stderr += text;
-                        // cloudflared often outputs URLs to stderr
-                        findAndEmitUrl(text);
-                    });
-                    loginProcess.on('close', async (code) => {
-                        if (code === 0) {
-                            // Login successful, extract API token from cert.pem
-                            try {
-                                const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem');
-                                const certContent = await fs.readFile(certPath, 'utf-8');
-                                // Extract token between BEGIN and END markers
-                                const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/);
-                                if (tokenMatch && tokenMatch[1]) {
-                                    // Decode base64 token
-                                    const tokenBase64 = tokenMatch[1].replace(/\s/g, '');
-                                    const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8');
-                                    const tokenData = JSON.parse(tokenJson);
-                                    // Extract API token, account ID, and zone ID
-                                    const apiToken = tokenData.apiToken;
-                                    const accountId = tokenData.accountID;
-                                    const zoneId = tokenData.zoneID;
-                                    socket.emit('cloudflared:login:complete', {
-                                        accountId,
-                                        accountName: undefined,
-                                        apiToken,
-                                        zoneId
-                                    });
-                                }
-                                else {
-                                    socket.emit('cloudflared:login:error', {
-                                        error: 'Failed to extract token from cert.pem'
-                                    });
-                                }
-                            }
-                            catch (error) {
-                                socket.emit('cloudflared:login:error', {
-                                    error: `Failed to read cert.pem: ${error.message}`
-                                });
-                            }
-                        }
-                        else {
-                            socket.emit('cloudflared:login:error', {
-                                error: `Login failed with code ${code}: ${stderr}`
-                            });
-                        }
-                    });
-                    loginProcess.on('error', (error) => {
-                        socket.emit('cloudflared:login:error', { error: error.message });
-                    });
-                }
-                catch (error) {
-                    socket.emit('cloudflared:login:error', { error: error.message });
-                }
-            });
-            // ========== Container Management Handlers ==========
-            // Check if container runtime is available
-            socket.on('container:check:request', async () => {
-                try {
-                    let enabled = false;
-                    let runtime;
-                    let version = '';
-                    try {
-                        // Check for docker first
-                        execSync('which docker', { stdio: 'ignore' });
-                        runtime = 'docker';
-                        version = execSync('docker --version', { encoding: 'utf-8' }).trim();
-                        enabled = true;
-                    }
-                    catch {
-                        try {
-                            // Check for podman as fallback
-                            execSync('which podman', { stdio: 'ignore' });
-                            runtime = 'podman';
-                            version = execSync('podman --version', { encoding: 'utf-8' }).trim();
-                            enabled = true;
-                        }
-                        catch {
-                            enabled = false;
-                        }
-                    }
-                    socket.emit('container:check:response', { enabled, runtime, version });
-                    if (foreground) {
-                        console.log(`Container runtime check: ${enabled ? `${runtime} (${version})` : 'Not found'}`);
-                    }
-                }
-                catch (error) {
-                    socket.emit('container:check:response', { enabled: false, runtime: undefined, version: '' });
-                }
-            });
-            // List all containers
-            socket.on('container:list:request', async () => {
-                try {
-                    const runtime = getContainerRuntime();
-                    if (!runtime) {
-                        socket.emit('container:list:response', { success: false, error: 'No container runtime found' });
-                        return;
-                    }
-                    // List all containers including stopped ones
-                    const output = execSync(`${runtime} ps -a --format "{{json .}}"`, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
-                    const containers = output.trim().split('\n').filter(Boolean).map(line => {
-                        try {
-                            const c = JSON.parse(line);
-                            // Parse ports from the PORTS column (format: "0.0.0.0:8080->80/tcp, 0.0.0.0:9090->9090/tcp")
-                            const ports = [];
-                            if (c.Ports) {
-                                const portMatches = c.Ports.match(/(\d+)->(\d+)/g);
-                                if (portMatches) {
-                                    portMatches.forEach((p) => {
-                                        const [host, container] = p.split('->').map(Number);
-                                        ports.push({ host, container });
-                                    });
-                                }
-                            }
-                            return {
-                                containerId: c.ID,
-                                name: c.Names.replace(/^\//, ''), // Remove leading slash
-                                image: c.Image,
-                                status: c.State === 'running' ? 'running' : c.State === 'paused' ? 'paused' : c.Status === 'exited' ? 'exited' : 'stopped',
-                                ports,
-                                createdAt: new Date(c.CreatedAt).toISOString()
-                            };
-                        }
-                        catch {
-                            return null;
-                        }
-                    }).filter(Boolean);
-                    socket.emit('container:list:response', { success: true, containers });
-                }
-                catch (error) {
-                    socket.emit('container:list:response', { success: false, error: error.message });
-                }
-            });
-            // Start a new container
-            socket.on('container:start:request', async (data) => {
-                try {
-                    const runtime = getContainerRuntime();
-                    if (!runtime) {
-                        socket.emit('container:start:response', { success: false, error: 'No container runtime found' });
-                        return;
-                    }
-                    const { name, image, ports = [], env = {}, runAsRoot = false } = data;
-                    // Get CLI directory path (where this script is running from)
-                    // Use the same pattern as elsewhere in the file
-                    const cliDir = path.dirname(CURRENT_FILE);
-                    // Build docker run command
-                    let cmd = `${runtime} run -d --name ${name}`;
-                    // Security: Running as root INSIDE container is safe - it's still isolated from host
-                    // Root inside container cannot access host filesystem (read-only mounts)
-                    // Default to root to allow package installation and full container functionality
-                    // Set runAsRoot: false to run as non-root user (UID 1000) if needed
-                    if (!runAsRoot) {
-                        cmd += ' --user 1000:1000';
-                    }
-                    // Resource limits
-                    cmd += ' --memory=8g'; // Limit memory to 8GB
-                    // Auto-remove on exit (optional - commented out for persistence)
-                    // cmd += ' --rm'
-                    // Mount CLI directory into container
-                    cmd += ` -v "${cliDir}:/opt/ttc:ro"`;
-                    // Mount entrypoint script
-                    const entrypointScript = path.join(cliDir, 'container-entrypoint.sh');
-                    cmd += ` -v "${entrypointScript}:/entrypoint.sh:ro"`;
-                    // Port mappings
-                    ports.forEach(p => {
-                        cmd += ` -p ${p.host}:${p.container}`;
-                    });
-                    // Environment variables
-                    Object.entries(env).forEach(([k, v]) => {
-                        // Escape quotes in env values
-                        const escapedValue = String(v).replace(/"/g, '\\"');
-                        cmd += ` -e ${k}="${escapedValue}"`;
-                    });
-                    // Add container-specific environment variables
-                    cmd += ` -e CONTAINER_NAME="${name}"`;
-                    cmd += ` -e HOSTNAME="${name}"`;
-                    // Use entrypoint script
-                    cmd += ` --entrypoint /bin/sh ${image} /entrypoint.sh`;
-                    if (foreground) {
-                        console.log(`Starting container: ${cmd}`);
-                    }
-                    // Pull image if not exists, then run
-                    try {
-                        execSync(`${runtime} pull ${image}`, { stdio: 'ignore' });
-                    }
-                    catch {
-                        // Pull failed, but might already exist locally
-                    }
-                    const output = execSync(cmd, { encoding: 'utf-8', stdio: 'pipe' });
-                    const containerId = output.trim();
-                    socket.emit('container:start:response', { success: true, containerId });
-                    if (foreground) {
-                        console.log(`✓ Container started: ${containerId}`);
-                    }
-                }
-                catch (error) {
-                    socket.emit('container:start:response', { success: false, error: error.message });
-                }
-            });
-            // Stop a container
-            socket.on('container:stop:request', async (data) => {
-                try {
-                    const runtime = getContainerRuntime();
-                    if (!runtime) {
-                        socket.emit('container:stop:response', { success: false, error: 'No container runtime found' });
-                        return;
-                    }
-                    const { containerId } = data;
-                    execSync(`${runtime} stop ${containerId}`, { stdio: 'ignore' });
-                    socket.emit('container:stop:response', { success: true });
-                    if (foreground) {
-                        console.log(`✓ Container stopped: ${containerId}`);
-                    }
-                }
-                catch (error) {
-                    socket.emit('container:stop:response', { success: false, error: error.message });
-                }
-            });
-            // Remove a container
-            socket.on('container:remove:request', async (data) => {
-                try {
-                    const runtime = getContainerRuntime();
-                    if (!runtime) {
-                        socket.emit('container:remove:response', { success: false, error: 'No container runtime found' });
-                        return;
-                    }
-                    const { containerId } = data;
-                    // Force remove even if running
-                    execSync(`${runtime} rm -f ${containerId}`, { stdio: 'ignore' });
-                    socket.emit('container:remove:response', { success: true });
-                    if (foreground) {
-                        console.log(`✓ Container removed: ${containerId}`);
-                    }
-                }
-                catch (error) {
-                    socket.emit('container:remove:response', { success: false, error: error.message });
-                }
-            });
-            // Get container logs
-            socket.on('container:logs:request', async (data) => {
-                try {
-                    const runtime = getContainerRuntime();
-                    if (!runtime) {
-                        socket.emit('container:logs:response', { success: false, error: 'No container runtime found' });
-                        return;
-                    }
-                    const { containerId, lines = 100 } = data;
-                    const logs = execSync(`${runtime} logs --tail ${lines} ${containerId}`, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
-                    socket.emit('container:logs:response', { success: true, logs });
-                }
-                catch (error) {
-                    socket.emit('container:logs:response', { success: false, error: error.message });
-                }
-            });
-            // Helper function to get available container runtime
-            function getContainerRuntime() {
-                try {
-                    execSync('which docker', { stdio: 'ignore' });
-                    return 'docker';
-                }
-                catch {
-                    try {
-                        execSync('which podman', { stdio: 'ignore' });
-                        return 'podman';
-                    }
-                    catch {
-                        return null;
-                    }
-                }
-            }
+            // Cloudflared handlers (delegated to cloudflaredHandlers module)
+            registerCloudflaredHandlers(socket, foreground);
+            // Container handlers (delegated to containerHandlers module)
+            registerContainerHandlers(socket, foreground, __dirname);
             socket.on('disconnect', (reason) => {
                 if (foreground) {
                     console.log(`\n⚠️  Disconnected: ${reason}`);