@exreve/exk 1.0.7 → 1.0.8

package/index.ts

@@ -1,3049 +0,0 @@
-#!/usr/bin/env node
-import { Command } from 'commander'
-import { io, Socket } from 'socket.io-client'
-import { v4 as uuidv4 } from 'uuid'
-import fs from 'fs/promises'
-import fsSync from 'fs'
-import path from 'path'
-import os, { networkInterfaces } from 'os'
-import { Buffer } from 'buffer'
-import crypto from 'crypto'
-import type {
-  Session,
-  Device,
-  SessionOutput,
-  Project,
-  ProjectCreateData,
-  ProjectDeleteData,
-  SessionCreateData,
-  SessionPromptData,
-  SessionSubscribeData,
-  SuccessResponse,
-  SessionResponse,
-  SessionsListResponse,
-  DevicesListResponse,
-} from './shared/types.js'
-import { createProject, deleteProject } from './projectManager.js'
-import { agentSessionManager } from './agentSession.js'
-import { getProjectConfig, analyzeProjectWithClaude, saveProjectConfig } from './projectAnalyzer.js'
-import { generateRunnerCode } from './runnerGenerator.js'
-import { startApp, stopApp, restartApp, getAppStatuses, getAppLogs } from './appManager.js'
-import { spawn, execSync } from 'child_process'
-import readline from 'readline'
-import { fileURLToPath } from 'url'
-import { createHash } from 'crypto'
-
-// ============ Types ============
-
-interface Config {
-  apiUrl: string
-}
-
-interface DeviceData {
-  deviceId: string
-}
-
-// ============ Constants ============
-
-const CONFIG_DIR = path.join(os.homedir(), '.talk-to-code')
-const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json')
-const DEVICE_ID_FILE = path.join(CONFIG_DIR, 'device-id.json')
-const DEVICE_CONFIG_FILE = path.join(CONFIG_DIR, 'device-config.json')
-const DEFAULT_API_URL = 'https://api.talk-to-code.com'
-
-// ============ Helpers ============
-
-async function readConfig(): Promise<Config> {
-  try {
-    const data = await fs.readFile(CONFIG_FILE, 'utf-8')
-    return JSON.parse(data)
-  } catch {
-    return { apiUrl: DEFAULT_API_URL }
-  }
-}
-
-async function writeConfig(config: Config): Promise<void> {
-  await fs.mkdir(CONFIG_DIR, { recursive: true })
-  await fs.writeFile(CONFIG_FILE, JSON.stringify(config, null, 2))
-}
-
-/**
- * Fetch AI config from server and save to ~/.talk-to-code/ai-config.json
- * Called after device registration and on daemon start
- */
-async function fetchAiConfig(authToken: string): Promise<boolean> {
-  try {
-    const config = await readConfig()
-    const res = await fetch(`${config.apiUrl}/config/ai`, {
-      headers: { Authorization: `Bearer ${authToken}` }
-    })
-    if (!res.ok) {
-      console.log(`[fetchAiConfig] Server returned ${res.status}`)
-      return false
-    }
-    const data = await res.json() as { success: boolean; aiConfig?: { authToken: string; baseUrl: string; model: string } }
-    if (!data.success || !data.aiConfig) {
-      console.log('[fetchAiConfig] No AI config available for this user')
-      return false
-    }
-    await fs.writeFile(AI_CONFIG_FILE, JSON.stringify(data.aiConfig, null, 2))
-    console.log('[fetchAiConfig] AI config saved successfully')
-    return true
-  } catch (error: any) {
-    console.log(`[fetchAiConfig] Failed: ${error.message}`)
-    return false
-  }
-}
-
-const AI_CONFIG_FILE = path.join(CONFIG_DIR, 'ai-config.json')
-
-/** True if ai-config.json has a model API key (not read from host ANTHROPIC_* env). */
-function hasAiCredentials(): boolean {
-  try {
-    const raw = fsSync.readFileSync(AI_CONFIG_FILE, 'utf-8')
-    const j = JSON.parse(raw) as { authToken?: string }
-    return typeof j.authToken === 'string' && j.authToken.trim().length > 0
-  } catch {
-    return false
-  }
-}
-
-async function readDeviceAuthToken(): Promise<string | undefined> {
-  const env = process.env.TTC_AUTH_TOKEN?.trim()
-  if (env) return env
-  try {
-    const raw = await fs.readFile(DEVICE_CONFIG_FILE, 'utf-8')
-    const j = JSON.parse(raw) as { authToken?: string }
-    return typeof j.authToken === 'string' ? j.authToken.trim() : undefined
-  } catch {
-    return undefined
-  }
-}
-
-type DiskDeviceConfig = { email?: string; authToken?: string }
-
-async function readDiskDeviceConfig(): Promise<DiskDeviceConfig> {
-  try {
-    const raw = await fs.readFile(DEVICE_CONFIG_FILE, 'utf-8')
-    return JSON.parse(raw) as DiskDeviceConfig
-  } catch {
-    return {}
-  }
-}
-
-/**
- * Update device-config.json without dropping an existing authToken.
- * Omit authToken to keep the file’s current token; pass authToken: '' to clear (rare).
- */
-async function writeDeviceConfigMerged(partial: { email?: string; authToken?: string }): Promise<void> {
-  const prev = await readDiskDeviceConfig()
-  const email = partial.email !== undefined ? partial.email : prev.email
-  let token: string | undefined
-  if (partial.authToken !== undefined) {
-    token = partial.authToken.trim() || undefined
-  } else {
-    token = typeof prev.authToken === 'string' && prev.authToken.trim() ? prev.authToken.trim() : undefined
-  }
-  const out: DiskDeviceConfig = {}
-  if (email) out.email = email
-  if (token) out.authToken = token
-  await fs.mkdir(CONFIG_DIR, { recursive: true })
-  await fs.writeFile(DEVICE_CONFIG_FILE, JSON.stringify(out, null, 2))
-}
-
-/** If AI cache is empty but we have a device JWT, try GET /config/ai once (non-fatal). */
-async function maybeFetchAiConfigIfMissing(): Promise<void> {
-  if (hasAiCredentials()) return
-  const jwt = await readDeviceAuthToken()
-  if (!jwt) return
-  const ok = await fetchAiConfig(jwt)
-  if (!ok && !hasAiCredentials()) {
-    const cfg = await readConfig()
-    console.warn(`[CLI] No AI key in ai-config.json yet. Could not sync from ${cfg.apiUrl}/config/ai — agent prompts will fail until this succeeds.`)
-  }
-}
-
-function scheduleAiConfigSync(authToken: string): void {
-  void fetchAiConfig(authToken).then((ok) => {
-    if (!ok && !hasAiCredentials()) {
-      console.warn('[CLI] AI config sync failed; check backend /config/ai and apiUrl.')
-    }
-  })
-}
-
-async function getDeviceId(): Promise<string> {
-  try {
-    const data = await fs.readFile(DEVICE_ID_FILE, 'utf-8')
-    return JSON.parse(data).deviceId
-  } catch {
-    const deviceId = uuidv4()
-    await fs.mkdir(CONFIG_DIR, { recursive: true })
-    await fs.writeFile(DEVICE_ID_FILE, JSON.stringify({ deviceId }, null, 2))
-    return deviceId
-  }
-}
-
-function getLocalIpAddress(): string {
-  const nets = networkInterfaces()
-  for (const name of Object.keys(nets)) {
-    for (const net of nets[name]!) {
-      if (net.family === 'IPv4' && !net.internal) {
-        return net.address
-      }
-    }
-  }
-  return 'Unknown'
-}
-
-function getHostname(): string {
-  return os.hostname() || 'Unknown'
-}
-
-async function connect(): Promise<Socket> {
-  const config = await readConfig()
-  const deviceId = await getDeviceId()
-
-  return new Promise((resolve, reject) => {
-    const socket: Socket = io(config.apiUrl, {
-      transports: ['websocket', 'polling'],
-    })
-
-    socket.on('connect', () => {
-      socket.emit('register', { type: 'cli', deviceId })
-      resolve(socket)
-    })
-
-    socket.on('registered', ({ type }: { type: string }) => {
-      console.log(`Connected as ${type}`)
-    })
-
-    socket.on('connect_error', (err) => {
-      reject(err)
-    })
-  })
-}
-
-// ============ Version Helpers ============
-
-/** Read CLI version from the npm package.json (works when installed via npm i -g @exreve/exk) */
-function getCliVersion(): string {
-  try {
-    // When installed via npm, package.json is at ../package.json relative to index.ts
-    const pkgPath = path.join(__dirname, 'package.json')
-    const raw = fsSync.readFileSync(pkgPath, 'utf-8')
-    const pkg = JSON.parse(raw) as { version?: string }
-    return pkg.version || '0.0.0'
-  } catch {
-    return '0.0.0'
-  }
-}
-
-// ============ Update Helpers ============
-
-type UpdateCheckResponse = {
-  updateAvailable: boolean
-  downloadUrl?: string
-  hash?: string
-}
-
-const CURRENT_FILE = fileURLToPath(import.meta.url)
-const __dirname = path.dirname(CURRENT_FILE)
-
-function getCliHash(): string {
-  return createHash('sha256').update(fsSync.readFileSync(CURRENT_FILE)).digest('hex')
-}
-
-async function checkForUpdate(): Promise<UpdateCheckResponse | null> {
-  try {
-    const config = await readConfig()
-    const res = await fetch(`${config.apiUrl}/update/check`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ hash: getCliHash(), platform: os.platform() })
-    })
-    if (!res.ok) return null
-    return await res.json() as UpdateCheckResponse
-  } catch {
-    return null
-  }
-}
-
-async function replaceSelf(tarballBuffer: Buffer): Promise<void> {
-  const extractDir = path.join(os.tmpdir(), `ttc-update-${Date.now()}`)
-  await fs.mkdir(extractDir, { recursive: true })
-  const tarPath = path.join(extractDir, 'ttc-cli.tar.gz')
-  await fs.writeFile(tarPath, tarballBuffer)
-  execSync(`tar -xzf "${tarPath}" -C "${extractDir}"`)
-  await fs.unlink(tarPath)
-
-  // Preserve user config/token files (never overwrite on update)
-  const preserveFiles = ['device-config.json', 'device-id.json', 'config.json']
-  const preserved: Record<string, Buffer> = {}
-  for (const f of preserveFiles) {
-    try {
-      preserved[f] = await fs.readFile(path.join(CONFIG_DIR, f))
-    } catch {
-      /* file may not exist */
-    }
-  }
-
-  // Replace cli/ and shared/ in CONFIG_DIR
-  const cliDest = path.join(CONFIG_DIR, 'cli')
-  const sharedDest = path.join(CONFIG_DIR, 'shared')
-  await fs.rm(cliDest, { recursive: true, force: true })
-  await fs.rm(sharedDest, { recursive: true, force: true })
-  await fs.cp(path.join(extractDir, 'cli'), cliDest, { recursive: true })
-  await fs.cp(path.join(extractDir, 'shared'), sharedDest, { recursive: true })
-
-  // Update package.json and npm install
-  await fs.copyFile(path.join(extractDir, 'package.json'), path.join(CONFIG_DIR, 'package.json'))
-  await fs.rm(extractDir, { recursive: true, force: true })
-
-  // Restore preserved config
-  for (const f of preserveFiles) {
-    if (preserved[f]) await fs.writeFile(path.join(CONFIG_DIR, f), preserved[f])
-  }
-
-  console.log('✓ CLI updated')
-
-  const npmPaths = [path.join(os.homedir(), '.nvm/versions/node/v22/bin/npm'), path.join(os.homedir(), '.nvm/versions/node/v20/bin/npm')]
-  const npmBin = npmPaths.find(p => fsSync.existsSync(p)) || 'npm'
-  try {
-    execSync(`"${npmBin}" install --omit=dev`, { cwd: CONFIG_DIR, stdio: 'inherit' })
-    console.log('✓ Dependencies updated')
-  } catch {
-    console.warn('⚠ npm install failed')
-  }
-}
-
-async function selfUpdate(force = false): Promise<void> {
-  const info = await checkForUpdate()
-  if (!info || !info.updateAvailable) {
-    console.log('✓ Already up to date')
-    return
-  }
-
-  console.log('📦 Update available!')
-  if (!force && process.stdin.isTTY) {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout })
-    const answer = await new Promise<string>(r => rl.question('Update now? [Y/n] ', a => { rl.close(); r(a.trim()) }))
-    if (answer.toLowerCase().startsWith('n')) return
-  }
-
-  if (!info.downloadUrl || !info.hash) return
-
-  console.log('Downloading...')
-  const res = await fetch(info.downloadUrl)
-  if (!res.ok) throw new Error('Download failed')
-
-  const bundle = Buffer.from(await res.arrayBuffer())
-  if (createHash('sha256').update(bundle).digest('hex') !== info.hash) {
-    throw new Error('Hash mismatch')
-  }
-
-  await replaceSelf(bundle)
-  process.exit(0)
-}
-
-// ============ Commands ============
-
-async function registerDevice(name: string | undefined, email: string | undefined): Promise<void> {
-  try {
-    const deviceId = await getDeviceId()
-    let deviceEmail = email
-
-    // If we already have a valid token, skip approval email and just register
-    try {
-      const deviceConfig = await readDiskDeviceConfig()
-      const existingToken = deviceConfig.authToken
-      if (existingToken && typeof existingToken === 'string') {
-        const config = await readConfig()
-        const meRes = await fetch(`${config.apiUrl}/auth/me`, {
-          headers: { Authorization: `Bearer ${existingToken}` }
-        })
-        const meData = await meRes.json() as { success?: boolean; user?: { email?: string }; error?: string }
-        if (meRes.ok && meData.success && meData.user?.email) {
-          console.log(`✓ Using existing auth token for ${meData.user.email}`)
-          deviceEmail = deviceEmail || meData.user.email
-          const socket = await connect()
-          await new Promise<void>((resolve, reject) => {
-            socket.emit('device:register', {
-              deviceId,
-              name: name || `CLI Device ${deviceId.slice(0, 8)}`,
-              ipAddress: getLocalIpAddress(),
-              hostname: getHostname(),
-              email: deviceEmail,
-              cliVersion: getCliVersion()
-            }, ({ success, device, error }: {
-              success: boolean
-              device?: Device
-              error?: string
-            }) => {
-              socket.disconnect()
-              if (success && device) {
-                console.log(`✓ Device registered!`)
-                console.log(`Device ID: ${device.deviceId}`)
-                console.log(`Name: ${device.name}`)
-                console.log(`Email: ${device.email}`)
-                resolve()
-              } else {
-                reject(new Error(error || 'Registration failed'))
-              }
-            })
-          })
-
-          // Fetch AI config from server after registration
-          await fetchAiConfig(existingToken)
-
-          return
-        }
-      }
-    } catch {
-      // No config or invalid token - continue with approval flow
-    }
-
-    // Prompt for email if not provided
-    if (!deviceEmail) {
-      const rl = readline.createInterface({ input: process.stdin, output: process.stdout })
-      deviceEmail = await new Promise<string>((resolve) => {
-        rl.question('Enter your email address: ', (answer) => {
-          rl.close()
-          resolve(answer.trim())
-        })
-      })
-    }
-
-    if (!deviceEmail?.includes('@')) {
-      console.error('✗ Valid email address is required')
-      throw new Error('Valid email address is required')
-    }
-
-    // Generate 32-byte random token (base64url encoded)
-    const randomBytes = crypto.randomBytes(32)
-    const approvalToken = randomBytes.toString('base64url') // base64url encoding (no padding, URL-safe)
-
-    console.log(`\n📧 Sending approval request to ${deviceEmail}...`)
-
-    // Send approval request
-    const config = await readConfig()
-    const response = await fetch(`${config.apiUrl}/auth/approval-request`, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json'
-      },
-      body: JSON.stringify({
-        email: deviceEmail,
-        deviceId,
-        approvalToken
-      })
-    })
-
-    const result = await response.json() as { success: boolean; error?: string }
-
-    if (!result.success) {
-      console.error(`✗ Failed to send approval request: ${result.error || 'Unknown error'}`)
-      throw new Error(result.error || 'Failed to send approval request')
-    }
-
-    console.log(`✓ Approval email sent! Check your inbox (${deviceEmail})`)
-    console.log(`⏳ Waiting for approval...`)
-
-    // Poll every 5 seconds for approval
-    const maxAttempts = 120 // 10 minutes max (120 * 5s)
-    let attempts = 0
-
-    const checkApproval = async (): Promise<string | null> => {
-      attempts++
-
-      try {
-        const statusResponse = await fetch(`${config.apiUrl}/auth/approval-status?token=${approvalToken}`)
-        const statusResult = await statusResponse.json() as { success?: boolean; approved?: boolean; token?: string; error?: string; pending?: boolean }
-
-        if (statusResult.success && statusResult.approved) {
-          return statusResult.token || null // Return permanent auth token
-        }
-
-        if (statusResult.error && !statusResult.pending) {
-          console.error(`\n✗ ${statusResult.error}`)
-          return null
-        }
-
-        return null // Still pending
-      } catch (error: any) {
-        console.error(`\n✗ Error checking approval status: ${error.message}`)
-        return null
-      }
-    }
-
-    // Poll until approved or timeout
-    while (attempts < maxAttempts) {
-      await new Promise(resolve => setTimeout(resolve, 5000)) // Wait 5 seconds
-
-      const token = await checkApproval()
-      if (token) {
-        // Device approved! Store permanent token
-        await writeDeviceConfigMerged({ email: deviceEmail, authToken: token })
-
-        console.log(`\n✓ Device approved!`)
-
-        // Register device with backend and wait for completion
-        const socket = await connect()
-
-        await new Promise<void>((resolve, reject) => {
-          socket.emit('device:register', {
-            deviceId,
-            name: name || `CLI Device ${deviceId.slice(0, 8)}`,
-            ipAddress: getLocalIpAddress(),
-            hostname: getHostname(),
-            email: deviceEmail,
-            cliVersion: getCliVersion()
-          }, ({ success, device, error }: {
-            success: boolean
-            device?: Device
-            error?: string
-          }) => {
-            socket.disconnect()
-            if (success && device) {
-              console.log(`✓ Device registered!`)
-              console.log(`Device ID: ${device.deviceId}`)
-              console.log(`Name: ${device.name}`)
-              console.log(`Email: ${device.email}`)
-              console.log(`IP Address: ${device.ipAddress || 'Unknown'}`)
-              console.log(`Hostname: ${device.hostname || 'Unknown'}`)
-              resolve()
-            } else {
-              reject(new Error(error || 'Registration failed'))
-            }
-          })
-        })
-
-        // Fetch AI config from server after registration
-        await fetchAiConfig(token)
-
-        return // Successfully registered
-      }
-
-      // Show progress every 30 seconds
-      if (attempts % 6 === 0) {
-        process.stdout.write(`\r⏳ Still waiting... (${attempts * 5}s)`)
-      }
-    }
-
-    console.error(`\n✗ Approval timeout. Please check your email and try again.`)
-    throw new Error('Approval timeout')
-  } catch (error) {
-    console.error('Failed to register device:', (error as Error).message)
-    throw error
-  }
-}
-
-async function listSessions(): Promise<void> {
-  try {
-    const socket = await connect()
-
-    socket.emit('sessions:list', (response: SessionsListResponse) => {
-      const { sessions } = response
-      console.log('\nSessions:')
-      console.log('-'.repeat(60))
-      sessions.forEach((session, idx) => {
-        console.log(`${idx + 1}. ${session.id}`)
-        console.log(`   Created: ${new Date(session.createdAt).toLocaleString()}`)
-        console.log()
-      })
-      socket.disconnect()
-    })
-  } catch (error) {
-    console.error('Failed to list sessions:', (error as Error).message)
-    process.exit(1)
-  }
-}
-
-async function createSession(): Promise<void> {
-  try {
-    const socket = await connect()
-
-    socket.emit('session:create', (response: SessionResponse) => {
-      const { success, session } = response
-      if (success && session) {
-        console.log('Session created!')
-        console.log('Session ID:', session.id)
-        socket.disconnect()
-      }
-    })
-  } catch (error) {
-    console.error('Failed to create session:', (error as Error).message)
-    process.exit(1)
-  }
-}
-
-async function sendPrompt(sessionId: string, prompt: string): Promise<void> {
-  try {
-    const socket = await connect()
-
-    socket.emit('session:subscribe', { sessionId })
-
-    socket.on('prompt:output', ({ data, type }: { data: string; type: string }) => {
-      if (type === 'stdout') {
-        process.stdout.write(data)
-      } else {
-        process.stderr.write(data)
-      }
-    })
-
-    socket.on('session:exited', ({ exitCode }: { exitCode: number | null }) => {
-      console.log(`\nSession exited with code ${exitCode}`)
-      socket.disconnect()
-    })
-
-    socket.emit('session:prompt', { sessionId, prompt }, ({ success }: { success: boolean }) => {
-      if (!success) {
-        console.error('Failed to send prompt')
-        socket.disconnect()
-      }
-    })
-
-    process.on('SIGINT', () => {
-      socket.emit('session:unsubscribe', { sessionId } as SessionSubscribeData)
-      socket.disconnect()
-      process.exit(0)
-    })
-  } catch (error) {
-    console.error('Failed to send prompt:', (error as Error).message)
-    process.exit(1)
-  }
-}
-
-async function listDevices(): Promise<void> {
-  try {
-    const socket = await connect()
-
-    socket.emit('devices:list', (response: DevicesListResponse) => {
-      const { devices } = response
-      console.log('\nRegistered Devices:')
-      console.log('-'.repeat(60))
-      devices.forEach((device, idx) => {
-        console.log(`${idx + 1}. ${device.name}`)
-        console.log(`   ID: ${device.deviceId}`)
-        console.log(`   IP Address: ${device.ipAddress || 'Unknown'}`)
-        console.log(`   Hostname: ${device.hostname || 'Unknown'}`)
-        console.log(`   Registered: ${new Date(device.registeredAt).toLocaleString()}`)
-        console.log(`   Last Seen: ${new Date(device.lastSeen).toLocaleString()}`)
-        console.log()
-      })
-      socket.disconnect()
-    })
-  } catch (error) {
-    console.error('Failed to list devices:', (error as Error).message)
-    process.exit(1)
-  }
-}
-
-async function monitorSession(sessionId: string): Promise<void> {
-  try {
-    const socket = await connect()
-
-    console.log(`Monitoring session ${sessionId}...`)
-    console.log('Press Ctrl+C to stop\n')
-
-    socket.emit('session:subscribe', { sessionId })
-
-    socket.on('session:state', ({ outputs, isActive }: { outputs: SessionOutput[]; isActive: boolean }) => {
-      console.log(`Session active: ${isActive}`)
-      console.log('Recent output:')
-      outputs.slice(-10).forEach(({ type, data }) => {
-        if (type === 'stdout') {
-          const dataString = typeof data === 'string' ? data : JSON.stringify(data)
-          process.stdout.write(dataString)
-        }
-      })
-    })
-
-    socket.on('prompt:output', ({ data, type }: { data: string; type: string }) => {
-      if (type === 'stdout') {
-        process.stdout.write(data)
-      }
-    })
-
-    socket.on('session:exited', ({ exitCode }: { exitCode: number | null }) => {
-      console.log(`\nSession exited with code ${exitCode}`)
-      socket.disconnect()
-    })
-
-    process.on('SIGINT', () => {
-      socket.emit('session:unsubscribe', { sessionId } as SessionSubscribeData)
-      socket.disconnect()
-      process.exit(0)
-    })
-  } catch (error) {
-    console.error('Failed to monitor session:', (error as Error).message)
-    process.exit(1)
-  }
-}
-
-// Active sessions map - persists across reconnections
-const activeSessions = new Map<string, { projectPath: string; currentPromptId?: string; model?: string }>()
-
-async function runDaemon(foreground = false, email?: string): Promise<void> {
-  const config = await readConfig()
-  const deviceId = await getDeviceId()
-  const ipAddress = getLocalIpAddress()
-  const hostname = getHostname()
-
-  // Silent update check on startup
-  checkForUpdate().then(info => {
-    if (info?.updateAvailable) console.log('📦 Update available: run "ttc update"')
-  }).catch(() => {})
-
-  if (foreground) console.log('=== TalkToCode CLI (Foreground) ===')
-  else console.log('Starting daemon...')
-  console.log(`API: ${config.apiUrl}`)
-  console.log(`Device: ${deviceId}`)
-  console.log(`Host: ${hostname}`)
-
-  // Test if server is reachable
-  if (foreground) {
-    try {
-      const url = new URL(config.apiUrl)
-      const testUrl = `${url.protocol}//${url.host}`
-      console.log(`Testing connection to ${testUrl}...`)
-      const response = await fetch(testUrl, { 
-        method: 'GET',
-        signal: AbortSignal.timeout(5000)
-      })
-      console.log(`✓ Server is reachable (HTTP ${response.status})`)
-    } catch (error: any) {
-      console.error(`✗ Cannot reach server: ${error.message}`)
-      console.error(`  Make sure the backend server is running at ${config.apiUrl}`)
-    }
-  }
-  console.log('')
-
-  await maybeFetchAiConfigIfMissing()
-
-  let socket: Socket | null = null
-  let reconnectTimeout: ReturnType<typeof setTimeout> | null = null
-  let reconnectAttempts = 0
-  const MAX_RECONNECT_ATTEMPTS = Infinity // Keep trying forever
-
-  const connectAndRegister = async () => {
-    try {
-      socket = io(config.apiUrl, {
-        transports: ['websocket', 'polling'],
-        reconnection: true,
-        reconnectionDelay: 1000,
-        reconnectionDelayMax: 10000,
-        reconnectionAttempts: MAX_RECONNECT_ATTEMPTS,
-        timeout: 20000,
-        forceNew: true,
-        upgrade: true,
-      })
-      
-      if (foreground) {
-        console.log(`Attempting to connect to: ${config.apiUrl}`)
-      }
-
-      // Register event handlers once (outside registered callback to prevent duplicates)
-      // Project handlers
-      socket.on('project:create', async (data: ProjectCreateData, callback: (response: SuccessResponse & { actualPath?: string }) => void) => {
-        try {
-          if (foreground) {
-            console.log(`📁 Creating project: ${data.name} at ${data.path}`)
-          }
-          const result = await createProject({
-            projectId: data.projectId || uuidv4(),
-            name: data.name,
-            path: data.path,
-            sourcePath: data.sourcePath
-          })
-
-          if (result.success) {
-            if (foreground) {
-              console.log(`✓ Project created: ${data.name} at ${result.actualPath || data.path}`)
-            } else {
-              console.log(`Project created: ${data.name} at ${result.actualPath || data.path}`)
-            }
-          } else {
-            if (foreground) {
-              console.error(`✗ Failed to create project: ${result.error || 'Unknown error'}`)
-            }
-          }
-
-          callback?.({
-            success: result.success,
-            error: result.error,
-            actualPath: result.actualPath
-          })
-        } catch (error: any) {
-          if (foreground) {
-            console.error(`✗ Error creating project: ${error.message}`)
-          }
-          callback?.({ success: false, error: error.message })
-        }
-      })
-
-      socket.on('project:delete', async (data: ProjectDeleteData & { path?: string }, callback: (response: SuccessResponse) => void) => {
-        try {
-          const { projectId, path } = data
-          if (!path) {
-            callback?.({ success: false, error: 'Project path required for deletion' })
-            return
-          }
-
-          if (foreground) {
-            console.log(`🗑️  Deleting project: ${projectId} at ${path}`)
-          }
-          
-          const result = await deleteProject(path)
-          
-          if (result.success) {
-            if (foreground) {
-              console.log(`✓ Project deleted: ${projectId} at ${path}`)
-            } else {
-              console.log(`Project deleted: ${projectId} at ${path}`)
-            }
-          } else {
-            if (foreground) {
-              console.error(`✗ Failed to delete project: ${result.error || 'Unknown error'}`)
-            }
-          }
-          
-          callback?.(result)
-        } catch (error: any) {
-          if (foreground) {
-            console.error(`✗ Error deleting project: ${error.message}`)
-          }
-          callback?.({ success: false, error: error.message })
-        }
-      })
-
-      // GitHub handlers
-      socket.on('github:status', async (data: { projectId: string; projectPath: string }, callback?: (response: { success: boolean; isRepo?: boolean; hasChanges?: boolean; branch?: string; remote?: string; changedFiles?: Array<{ path: string; status: string }>; changesCount?: number; error?: string }) => void) => {
-        try {
-          const { projectPath } = data
-          
-          // Check if directory is a git repository
-          const gitDir = path.join(projectPath, '.git')
-          let isRepo = false
-          try {
-            const stats = await fs.stat(gitDir)
-            isRepo = stats.isDirectory()
-          } catch {
-            isRepo = false
-          }
-
-          if (!isRepo) {
-            callback?.({ success: true, isRepo: false, hasChanges: false })
-            return
-          }
-
-          // Check git status
-          const { execSync } = await import('child_process')
-          try {
-            // Get current branch
-            const branch = execSync('git rev-parse --abbrev-ref HEAD', { cwd: projectPath, encoding: 'utf-8' }).trim()
-            
-            // Get remote URL
-            let remote: string | undefined
-            try {
-              remote = execSync('git config --get remote.origin.url', { cwd: projectPath, encoding: 'utf-8' }).trim()
-            } catch {
-              // No remote configured
-            }
-
-            // Check for actual changes (modified, staged, deleted files - ignore untracked)
-            // Use --short to get concise output, and check for actual changes (not just untracked files)
-            let hasChanges = false
-            const changedFiles: Array<{ path: string; status: string }> = []
-            try {
-              const statusOutput = execSync('git status --porcelain', { cwd: projectPath, encoding: 'utf-8' })
-              const lines = statusOutput.trim().split('\n').filter(line => line.trim().length > 0)
-
-              for (const line of lines) {
-                const status = line.substring(0, 2).trim()
-                const filePath = line.substring(2).trim()
-
-                // Skip untracked files (??)
-                if (line.startsWith('??')) continue
-
-                // Include modified (M), added (A), deleted (D), renamed (R), copied (C)
-                if (status.includes('M') || status.includes('A') || status.includes('D') || status.includes('R') || status.includes('C')) {
-                  hasChanges = true
-                  changedFiles.push({ path: filePath, status })
-                }
-              }
-            } catch {
-              hasChanges = false
-            }
-
-            callback?.({ success: true, isRepo: true, hasChanges, branch, remote, changedFiles, changesCount: changedFiles.length })
-          } catch (error: any) {
-            callback?.({ success: false, error: error.message })
-          }
-        } catch (error: any) {
-          callback?.({ success: false, error: error.message })
-        }
-      })
-
-      socket.on('github:commit', async (data: { projectId: string; projectPath: string; message?: string }, callback?: (response: { success: boolean; error?: string }) => void) => {
-        try {
-          const { projectPath, message = 'changes' } = data
-
-          // Check if directory is a git repository
-          const gitDir = path.join(projectPath, '.git')
-          let isRepo = false
-          try {
-            const stats = await fs.stat(gitDir)
-            isRepo = stats.isDirectory()
-          } catch {
-            callback?.({ success: false, error: 'Not a git repository' })
-            return
-          }
-
-          const { execSync } = await import('child_process')
-          try {
-            // Stage all changes
-            execSync('git add -A', { cwd: projectPath })
-
-            // Commit with message
-            execSync(`git commit -m "${message.replace(/"/g, '\\"')}"`, { cwd: projectPath })
-
-            // Determine which branch to push to (master or main)
-            let targetBranch: string
-            try {
-              // Check if master branch exists
-              execSync('git rev-parse --verify master', { cwd: projectPath, stdio: 'ignore' })
-              targetBranch = 'master'
-            } catch {
-              try {
-                // Check if main branch exists
-                execSync('git rev-parse --verify main', { cwd: projectPath, stdio: 'ignore' })
-                targetBranch = 'main'
-              } catch {
-                // Fallback to current branch if neither master nor main exists
-                targetBranch = execSync('git rev-parse --abbrev-ref HEAD', { cwd: projectPath, encoding: 'utf-8' }).trim()
-              }
-            }
-
-            // Push to origin after commit
-            execSync(`git push origin ${targetBranch}`, { cwd: projectPath, stdio: 'pipe' })
-
-            callback?.({ success: true })
-          } catch (error: any) {
-            callback?.({ success: false, error: error.message })
-          }
-        } catch (error: any) {
-          callback?.({ success: false, error: error.message })
-        }
-      })
-
-      socket.on('github:push', async (data: { projectId: string; projectPath: string }, callback?: (response: { success: boolean; error?: string }) => void) => {
-        try {
-          const { projectPath } = data
-          
-          // Check if directory is a git repository
-          const gitDir = path.join(projectPath, '.git')
-          let isRepo = false
-          try {
-            const stats = await fs.stat(gitDir)
-            isRepo = stats.isDirectory()
-          } catch {
-            callback?.({ success: false, error: 'Not a git repository' })
-            return
-          }
-
-          const { execSync } = await import('child_process')
-          try {
-            // Determine which branch to push to (master or main)
-            let targetBranch: string
-            try {
-              // Check if master branch exists
-              execSync('git rev-parse --verify master', { cwd: projectPath, stdio: 'ignore' })
-              targetBranch = 'master'
-            } catch {
-              try {
-                // Check if main branch exists
-                execSync('git rev-parse --verify main', { cwd: projectPath, stdio: 'ignore' })
-                targetBranch = 'main'
-              } catch {
-                // Fallback to current branch if neither master nor main exists
-                targetBranch = execSync('git rev-parse --abbrev-ref HEAD', { cwd: projectPath, encoding: 'utf-8' }).trim()
-              }
-            }
-            
-            // Push to origin
-            execSync(`git push origin ${targetBranch}`, { cwd: projectPath })
-            
-            callback?.({ success: true })
-          } catch (error: any) {
-            callback?.({ success: false, error: error.message })
-          }
-        } catch (error: any) {
-          callback?.({ success: false, error: error.message })
-        }
-      })
-
-      socket.on('github:discard', async (data: { projectId: string; projectPath: string }, callback?: (response: { success: boolean; error?: string }) => void) => {
-        try {
-          const { projectPath } = data
-          
-          // Check if directory is a git repository
-          const gitDir = path.join(projectPath, '.git')
-          let isRepo = false
-          try {
-            const stats = await fs.stat(gitDir)
-            isRepo = stats.isDirectory()
-          } catch {
-            callback?.({ success: false, error: 'Not a git repository' })
-            return
-          }
-
-          const { execSync } = await import('child_process')
-          try {
-            // Discard all changes and revert to latest commit
-            // Reset all changes (both staged and unstaged)
-            execSync('git reset --hard HEAD', { cwd: projectPath })
-            // Clean untracked files and directories
-            execSync('git clean -fd', { cwd: projectPath })
-            
-            callback?.({ success: true })
-          } catch (error: any) {
-            callback?.({ success: false, error: error.message })
-          }
-        } catch (error: any) {
-          callback?.({ success: false, error: error.message })
-        }
-      })
-
-      // Directory listing handler
-      socket.on('fs:list', async (data: { dirPath: string }) => {
-        try {
-          const { dirPath } = data
-          if (!dirPath) {
-            socket?.emit('fs:list:response', { success: false, error: 'dirPath is required' })
-            return
-          }
-
-          const entries: Array<{ name: string; path: string; isDir: boolean }> = []
-          try {
-            const dirents = await fs.readdir(dirPath, { withFileTypes: true })
-            for (const dirent of dirents) {
-              if (dirent.name.startsWith('.')) continue // Skip hidden files
-              const fullPath = path.join(dirPath, dirent.name)
-              entries.push({
-                name: dirent.name,
-                path: fullPath,
-                isDir: dirent.isDirectory()
-              })
-            }
-            // Sort: directories first, then alphabetically
-            entries.sort((a, b) => {
-              if (a.isDir && !b.isDir) return -1
-              if (!a.isDir && b.isDir) return 1
-              return a.name.localeCompare(b.name)
-            })
-            socket?.emit('fs:list:response', { success: true, entries })
-          } catch (err: any) {
-            socket?.emit('fs:list:response', { success: false, error: err.message })
-          }
-        } catch (error: any) {
-          socket?.emit('fs:list:response', { success: false, error: error.message })
-        }
-      })
-
-      // File write handler
-      socket.on('fs:write', async (data: { filePath: string; content: string; encoding?: string }) => {
-        try {
-          const { filePath, content, encoding = 'utf-8' } = data
-          if (!filePath) {
-            socket?.emit('fs:write:response', { success: false, error: 'filePath is required' })
-            return
-          }
-
-          try {
-            // Ensure directory exists
-            const dir = path.dirname(filePath)
-            await fs.mkdir(dir, { recursive: true })
-
-            // Write file
-            await fs.writeFile(filePath, content, encoding as BufferEncoding)
-
-            socket?.emit('fs:write:response', { success: true })
-          } catch (err: any) {
-            socket?.emit('fs:write:response', { success: false, error: err.message })
-          }
-        } catch (error: any) {
-          socket?.emit('fs:write:response', { success: false, error: error.message })
-        }
-      })
-
-      // File read handler
-      socket.on('fs:read', async (data: { filePath: string; encoding?: string }) => {
-        try {
-          const { filePath, encoding = 'utf-8' } = data
-          if (!filePath) {
-            socket?.emit('fs:read:response', { success: false, error: 'filePath is required' })
-            return
-          }
-
-          try {
-            // Read file
-            const content = await fs.readFile(filePath, encoding as BufferEncoding)
-
-            socket?.emit('fs:read:response', { success: true, content })
-          } catch (err: any) {
-            socket?.emit('fs:read:response', { success: false, error: err.message })
-          }
-        } catch (error: any) {
-          socket?.emit('fs:read:response', { success: false, error: error.message })
-        }
-      })
-
-      // Session handlers
-      socket.on('session:create', async (data: { sessionId: string; projectId: string; projectPath: string }) => {
-        try {
-          let { sessionId, projectPath } = data
-
-          // Remap /home/abc to /tmp/abc if /home/abc doesn't exist (container workaround)
-          if (projectPath === '/home/abc' && !fsSync.existsSync('/home/abc')) {
-            const fallbackPath = '/tmp/abc'
-            fsSync.mkdirSync(fallbackPath, { recursive: true })
-            projectPath = fallbackPath
-            console.log(`[CLI] Remapped /home/abc -> ${fallbackPath}`)
-          }
-
-          activeSessions.set(sessionId, { projectPath })
-          if (foreground) {
-            console.log(`💬 Session created: ${sessionId}`)
-            console.log(`   Project: ${projectPath}`)
-          } else {
-            console.log(`Session created: ${sessionId} in project ${projectPath}`)
-          }
-        } catch (error: any) {
-          if (foreground) {
-            console.error(`✗ Failed to create session: ${error.message}`)
-          } else {
-            console.error('Failed to create session:', error.message)
-          }
-        }
-      })
-
-      socket.on('session:delete', async (data: { sessionId: string }) => {
-        try {
-          const { sessionId } = data
-          if (foreground) {
-            console.log(`🗑️  Deleting session: ${sessionId}`)
-          }
-          await agentSessionManager.deleteSession(sessionId)
-          activeSessions.delete(sessionId)
-          if (foreground) {
-            console.log(`✓ Session deleted: ${sessionId}`)
-          } else {
-            console.log(`Session deleted: ${sessionId}`)
-          }
-        } catch (error: any) {
-          if (foreground) {
-            console.error(`✗ Failed to delete session: ${error.message}`)
-          } else {
-            console.error('Failed to delete session:', error.message)
-          }
-        }
-      })
-
-      socket.on('project:config:analyze', async (data: { projectId: string; projectPath: string; projectName: string; analysisId?: string }) => {
-        try {
-          const { projectId, projectPath, projectName, analysisId } = data
-          
-          if (foreground) {
-            console.log(`🔍 Analyzing project: ${projectName} at ${projectPath}`)
-          }
-          
-          
-          // Run Claude analysis
-          const config = await analyzeProjectWithClaude(projectPath, projectName)
-          
-          // Save config file (.talk-to-code.json)
-          await saveProjectConfig(projectPath, config)
-          
-          // Generate and save runner files for each app
-          for (const app of config.apps) {
-            const runnerCode = generateRunnerCode(app, projectPath)
-            const runnerFileName = `${app.name}_runner.ts`
-            const runnerPath = path.join(projectPath, app.directory || '', runnerFileName)
-            
-            // Ensure directory exists
-            const runnerDir = path.dirname(runnerPath)
-            await fs.mkdir(runnerDir, { recursive: true })
-            
-            // Write runner file
-            await fs.writeFile(runnerPath, runnerCode, 'utf-8')
-            
-            if (foreground) {
-              console.log(`✓ Generated runner: ${runnerFileName}`)
-            }
-          }
-          
-          if (foreground) {
-            console.log(`✓ Analysis complete: Found ${config.apps.length} apps`)
-            console.log(`✓ Generated ${config.apps.length} runner files`)
-          }
-          
-          // Emit result back to backend
-          socket!.emit('project:config:analyzed', {
-            projectId,
-            config,
-            analysisId
-          })
-        } catch (error: any) {
-          if (foreground) {
-            console.error(`✗ Analysis error: ${error.message}`)
-          }
-          socket!.emit('project:config:analyze:error', {
-            projectId: data.projectId,
-            error: error.message,
-            analysisId: data.analysisId
-          })
-        }
-      })
-
-      // App control handlers
-      socket.on('app:start', async (data: { projectId: string; projectPath: string; appName: string; appControlId?: string }, callback: (response: { success: boolean; error?: string; processId?: string; pid?: number }) => void) => {
-        try {
-          const { projectId, projectPath, appName } = data
-          
-          // Load project config to get app details
-          const config = await getProjectConfig(projectPath)
-          
-          if (!config) {
-            callback?.({ success: false, error: 'Project config not found' })
-            return
-          }
-          
-          const app = config.apps.find(a => a.name === appName)
-          if (!app) {
-            callback?.({ success: false, error: `App "${appName}" not found in project config` })
-            return
-          }
-          
-          const result = await startApp(projectPath, projectId, app)
-          
-          if (result.success) {
-            if (foreground) {
-              console.log(`✓ Started app: ${appName} (PID: ${result.pid})`)
-            }
-            socket!.emit('app:started', {
-              projectId,
-              appName,
-              processId: result.processId,
-              pid: result.pid,
-            })
-          }
-          
-          callback?.(result)
-        } catch (error: any) {
-          if (foreground) {
-            console.error(`✗ Error starting app: ${error.message}`)
-          }
-          callback?.({ success: false, error: error.message })
-        }
-      })
-
-      socket.on('app:stop', async (data: { projectId: string; projectPath: string; appName: string; appControlId?: string }, callback: (response: { success: boolean; error?: string }) => void) => {
-        try {
-          const { projectId, projectPath, appName } = data
-          
-          // Load project config to get app details (for custom stop command)
-          const config = await getProjectConfig(projectPath)
-          const app = config?.apps.find(a => a.name === appName)
-          
-          const result = await stopApp(projectId, appName, app)
-          
-          if (result.success) {
-            if (foreground) {
-              console.log(`✓ Stopped app: ${appName}`)
-            }
-            socket!.emit('app:stopped', {
-              projectId,
-              appName,
-              appControlId: data.appControlId,
-            })
-          }
-          
-          callback?.(result)
-        } catch (error: any) {
-          if (foreground) {
-            console.error(`✗ Error stopping app: ${error.message}`)
-          }
-          callback?.({ success: false, error: error.message })
-        }
-      })
-
-      socket.on('app:restart', async (data: { projectId: string; projectPath: string; appName: string; appControlId?: string }, callback: (response: { success: boolean; error?: string; processId?: string; pid?: number }) => void) => {
-        try {
-          const { projectId, projectPath, appName } = data
-          
-          // Load project config to get app details
-          const config = await getProjectConfig(projectPath)
-          
-          if (!config) {
-            callback?.({ success: false, error: 'Project config not found' })
-            return
-          }
-          
-          const app = config.apps.find(a => a.name === appName)
-          if (!app) {
-            callback?.({ success: false, error: `App "${appName}" not found in project config` })
-            return
-          }
-          
-          const result = await restartApp(projectPath, projectId, app)
-          
-          if (result.success) {
-            if (foreground) {
-              console.log(`✓ Restarted app: ${appName} (PID: ${result.pid})`)
-            }
-            socket!.emit('app:restarted', {
-              projectId,
-              appName,
-              processId: result.processId,
-              pid: result.pid,
-              appControlId: data.appControlId,
-            })
-          }
-          
-          callback?.(result)
-        } catch (error: any) {
-          if (foreground) {
-            console.error(`✗ Error restarting app: ${error.message}`)
-          }
-          callback?.({ success: false, error: error.message })
-        }
-      })
-
-      socket.on('app:status', async (data: { projectId: string; projectPath: string; appName?: string; appControlId?: string }, callback: (response: { success: boolean; apps?: Array<{ name: string; running: boolean; processId?: string; pid?: number }>; error?: string }) => void) => {
-        try {
-          const { projectId, projectPath, appName } = data
-          
-          // Load project config
-          const config = await getProjectConfig(projectPath)
-          
-          if (!config) {
-            callback?.({ success: false, error: 'Project config not found' })
-            return
-          }
-          
-          const appsToCheck = appName
-            ? config.apps.filter(a => a.name === appName)
-            : config.apps
-          
-          const statuses = getAppStatuses(projectId, appsToCheck)
-          
-          // Send response back to backend
-          if (data.appControlId) {
-            socket!.emit('app:control:response', {
-              appControlId: data.appControlId,
-              success: true,
-              apps: statuses,
-            })
-          }
-          
-          callback?.({ success: true, apps: statuses })
-        } catch (error: any) {
-          if (foreground) {
-            console.error(`✗ Error getting app status: ${error.message}`)
-          }
-          callback?.({ success: false, error: error.message })
-        }
-      })
-
-      socket.on('app:logs', async (data: { projectId: string; appName: string; follow?: boolean; appControlId?: string }, callback: (response: { success: boolean; logs?: string; error?: string }) => void) => {
-        try {
-          const { projectId, appName } = data
-          
-          const result = await getAppLogs(projectId, appName, 100)
-          
-          // Send response back to backend
-          if (data.appControlId) {
-            socket!.emit('app:control:response', {
-              appControlId: data.appControlId,
-              ...result,
-            })
-          }
-          
-          callback?.(result)
-        } catch (error: any) {
-          if (foreground) {
-            console.error(`✗ Error getting app logs: ${error.message}`)
-          }
-          callback?.({ success: false, error: error.message })
-        }
-      })
-
-      socket.on('session:prompt', async (data: SessionPromptData & { projectPath?: string; promptId?: string; model?: string }) => {
-        try {
-          const { sessionId, prompt, projectPath: providedProjectPath, promptId, enhancers, model } = data
-
-          // promptId is REQUIRED when routing to device
-          if (!promptId) {
-            if (foreground) {
-              console.error(`✗ Missing required promptId for session: ${sessionId}`)
-            }
-            socket!.emit('session:error', { sessionId, error: 'Missing required promptId' })
-            return
-          }
-
-          // Try to get projectPath from activeSessions or use provided one
-          let projectPath: string | undefined = providedProjectPath || activeSessions.get(sessionId)?.projectPath
-
-          if (!projectPath) {
-            if (foreground) {
-              console.error(`✗ Session not found: ${sessionId} (missing projectPath)`)
-            }
-            socket!.emit('session:error', { sessionId, error: 'Session not found or projectPath missing' })
-            return
-          }
-
-          // Check if user choice is enabled from the prompt data (sent by backend)
-          // Backend now includes enabledModules in the session:prompt event
-          const enabledModules = data.enabledModules || []
-          const moduleSettings = data.moduleSettings || {}
-          const userChoiceEnabled = enabledModules.includes('user-choice') || false
-
-          if (foreground) {
-            console.log(`[CLI] Enabled modules: ${enabledModules.join(', ') || 'none'}`)
-            console.log(`[CLI] User choice enabled: ${userChoiceEnabled}`)
-          }
-
-          // Store in activeSessions with promptId and model
-          activeSessions.set(sessionId, { projectPath, currentPromptId: promptId, model })
-
-          if (!projectPath) {
-            if (foreground) {
-              console.error(`✗ Session not found: ${sessionId} (missing projectPath)`)
-            }
-            socket!.emit('session:error', { sessionId, error: 'Session not found or projectPath missing' })
-            return
-          }
-
-          // Store in activeSessions with promptId and model
-          activeSessions.set(sessionId, { projectPath, currentPromptId: promptId, model })
-          
-          // Capture promptId in closure to prevent race conditions when multiple prompts arrive quickly
-          // This ensures each prompt's messages use the correct promptId even if a new prompt arrives
-          const capturedPromptId = promptId
-          
-          if (foreground) {
-            console.log(`\n[CLI] 📤 Received prompt for session: ${sessionId}, promptId: ${capturedPromptId}`)
-            console.log(`[CLI]    Prompt: ${prompt.substring(0, 100)}${prompt.length > 100 ? '...' : ''}`)
-          }
-
-          // Create or get session handler
-          await agentSessionManager.createSession({
-            sessionId,
-            projectPath,
-            userChoiceEnabled, // Pass user choice enabled setting from backend
-            enabledModules, // Pass enabled modules for MCP server
-            moduleSettings, // Pass module settings for MCP server
-            onOutput: (output: SessionOutput) => {
-              // Serialize data to string if it's an object
-              const dataString = typeof output.data === 'string'
-                ? output.data
-                : JSON.stringify(output.data)
-
-              // Use captured promptId (not currentPromptId from activeSessions) to prevent race conditions
-              if (!capturedPromptId) {
-                console.error(`[CLI] Missing promptId for session ${sessionId}, cannot emit prompt:output`)
-                return
-              }
-
-              socket!.emit('prompt:output', {
-                sessionId,
-                promptId: capturedPromptId, // Use captured promptId, not currentPromptId
-                type: output.type,
-                data: dataString,
-                timestamp: output.timestamp,
-                metadata: output.metadata
-              })
-            },
-            onError: (error: string) => {
-              socket!.emit('session:error', { sessionId, error })
-            },
-            onComplete: (exitCode: number | null) => {
-              // Note: This onComplete is from createSession, not sendPrompt
-              // The actual session:result is emitted from sendPrompt handler below
-              // This handler is kept for backward compatibility but may not be used
-            },
-            onChoiceRequest: (request) => {
-              // Emit choice request to frontend
-              socket!.emit('user:choice:request', {
-                sessionId,
-                choiceId: request.choiceId,
-                question: request.question,
-                options: request.options,
-                timeout: request.timeout
-              })
-            }
-          })
-
-          // Send prompt - status updates will be emitted from agentSession when processing starts/completes
-          await agentSessionManager.sendPrompt(sessionId, prompt, enhancers || [], {
-            sessionId,
-            projectPath,
-            promptId: capturedPromptId,
-            model: model, // Pass the model from the session
-            onStatusUpdate: (status: 'running' | 'completed' | 'error' | 'cancelled') => {
-              // Emit status update from CLI (CLI is source of truth)
-              // Use captured promptId to ensure correct prompt is updated
-              if (!capturedPromptId) {
-                console.error(`[CLI] Missing promptId for status update, cannot emit prompt:updated`)
-                return
-              }
-              
-              // Always log status updates for debugging (even in background mode)
-              console.log(`[CLI] 📊 Status update: promptId=${capturedPromptId}, status=${status}, sessionId=${sessionId}`)
-              
-              // Emit status update IMMEDIATELY (real-time)
-              socket!.emit('prompt:updated', {
-                promptId: capturedPromptId, // CRITICAL: Use captured promptId from closure
-                sessionId,
-                text: prompt,
-                status,
-                createdAt: new Date().toISOString(),
-                ...(status === 'running' ? { startedAt: new Date().toISOString() } : {}),
-                ...(status === 'completed' || status === 'error' || status === 'cancelled' ? { completedAt: new Date().toISOString() } : {}),
-                messages: []
-              })
-            },
-            onOutput: (output: SessionOutput) => {
-              // Serialize data to string if it's an object
-              const dataString = typeof output.data === 'string' 
-                ? output.data 
-                : JSON.stringify(output.data)
-              
-              // Use captured promptId (not currentPromptId from activeSessions) to prevent race conditions
-              if (!capturedPromptId) {
-                console.error(`[CLI] Missing promptId for session ${sessionId}, cannot emit prompt:output`)
-                return
-              }
-              
-              if (foreground && output.type === 'stdout') {
-                process.stdout.write(dataString)
-              }
-              socket!.emit('prompt:output', {
-                sessionId,
-                promptId: capturedPromptId, // Use captured promptId, not currentPromptId
-                type: output.type,
-                data: dataString,
-                timestamp: output.timestamp,
-                metadata: output.metadata
-              })
-            },
-            onError: (error: string) => {
-              // Error logging is handled by AgentLogger in agentSession.ts
-              // Additional console output for foreground mode
-              if (foreground) {
-                console.error(`\n[CLI] ✗ Session error: ${error}`)
-              }
-              socket!.emit('session:error', { sessionId, error })
-            },
-            onComplete: (exitCode: number | null) => {
-              // Completion logging is handled by AgentLogger in agentSession.ts
-              // Additional console output for foreground mode
-              if (foreground) {
-                console.log(`\n[CLI] ✓ Session completed with exit code: ${exitCode ?? 'null'}`)
-              }
-              
-              // Use captured promptId (not currentPromptId from activeSessions) to prevent race conditions
-              if (!capturedPromptId) {
-                console.error(`[CLI] Missing promptId for session ${sessionId}, cannot emit session:result`)
-                return
-              }
-              
-              socket!.emit('session:result', { 
-                sessionId, 
-                promptId: capturedPromptId, // Use captured promptId, not currentPromptId
-                exitCode 
-              })
-            }
-          })
-        } catch (error: any) {
-          if (foreground) {
-            console.error(`✗ Error processing prompt: ${error.message}`)
-          }
-          socket!.emit('session:error', { sessionId: data.sessionId, error: error.message })
-        }
-      })
-
-      // Handle prompt cancellation
-      socket.on('prompt:cancel', async (data: { promptId: string; sessionId: string }, callback: (response: { success: boolean; error?: string }) => void) => {
-        try {
-          const { promptId, sessionId } = data
-
-          if (!promptId || !sessionId) {
-            callback?.({ success: false, error: 'Missing promptId or sessionId' })
-            return
-          }
-
-          if (foreground) {
-            console.log(`[CLI] 🛑 Cancelling prompt: ${promptId}`)
-          }
-
-          // Cancel the prompt
-          const cancelled = await agentSessionManager.cancelPrompt(
-            promptId,
-            sessionId,
-            (status) => {
-              // Emit cancelled status update
-              socket!.emit('prompt:updated', {
-                promptId,
-                sessionId,
-                text: '', // Not needed for status update
-                status: 'cancelled',
-                createdAt: new Date().toISOString(),
-                completedAt: new Date().toISOString(),
-                messages: []
-              })
-            }
-          )
-
-          if (cancelled) {
-            callback?.({ success: true })
-          } else {
-            callback?.({ success: false, error: 'Prompt not found or already completed' })
-          }
-        } catch (error: any) {
-          if (foreground) {
-            console.error(`✗ Error cancelling prompt: ${error.message}`)
-          }
-          callback?.({ success: false, error: error.message })
-        }
-      })
-
-      // Handle emergency stop - forcefully halt all session activity
-      socket.on('emergency:stop', async (data: { sessionId: string }, callback: (response: { success: boolean; message?: string }) => void) => {
-        try {
-          const { sessionId } = data
-
-          if (!sessionId) {
-            callback?.({ success: false, message: 'Missing sessionId' })
-            return
-          }
-
-          if (foreground) {
-            console.log(`[CLI] ☠️  EMERGENCY STOP for session: ${sessionId}`)
-          }
-
-          // Execute emergency stop
-          const result = await agentSessionManager.emergencyStop(sessionId)
-
-          // Emit status update for current prompt if any
-          socket!.emit('emergency:stopped', {
-            sessionId,
-            success: result.success,
-            message: result.message,
-            timestamp: new Date().toISOString()
-          })
-
-          callback?.(result)
-        } catch (error: any) {
-          if (foreground) {
-            console.error(`✗ Error during emergency stop: ${error.message}`)
-          }
-          callback?.({ success: false, message: error.message })
-        }
-      })
-
-      // Handle user choice response from frontend
-      socket.on('user:choice:response', async (data: { sessionId: string; choiceId: string; selectedValue: string | null }) => {
-        try {
-          const { sessionId, choiceId, selectedValue } = data
-
-          if (foreground) {
-            console.log(`[CLI] 📝 Received user choice response: choiceId=${choiceId}, selectedValue=${selectedValue}`)
-          }
-
-          // Forward the response to the agent session manager
-          await agentSessionManager.handleChoiceResponse(sessionId, {
-            choiceId,
-            selectedValue
-          })
-        } catch (error: any) {
-          if (foreground) {
-            console.error(`✗ Error handling user choice response: ${error.message}`)
-          }
-        }
-      })
-
-      // Handle image save request - saves base64 images to tmp directory
-      socket.on('image:save', async (data: { images: Array<{ name: string; data: string }>; saveCallbackId: string; projectPath?: string }) => {
-        try {
-          const { images, saveCallbackId, projectPath } = data
-
-          if (foreground) {
-            console.log(`[CLI] 🖼️  Received request to save ${images.length} image(s)`)
-          }
-
-          // Use project-specific tmp directory (inside the project)
-          // If projectPath is provided, use it; otherwise fall back to current working directory
-          const basePath = projectPath || process.cwd()
-          const tmpDir = path.join(basePath, 'tmp')
-          await fs.mkdir(tmpDir, { recursive: true })
-
-          if (foreground) {
-            console.log(`[CLI] 📁 Saving to directory: ${tmpDir}`)
-          }
-
-          let savedCount = 0
-          const errors: string[] = []
-
-          for (const image of images) {
-            try {
-              const imagePath = path.join(tmpDir, image.name)
-
-              // Convert base64 to buffer and write to file
-              const buffer = Buffer.from(image.data, 'base64')
-              await fs.writeFile(imagePath, buffer)
-
-              if (foreground) {
-                console.log(`[CLI] ✓ Saved image: ${imagePath}`)
-              }
-              savedCount++
-            } catch (saveError: any) {
-              const errorMsg = `Failed to save ${image.name}: ${saveError.message}`
-              errors.push(errorMsg)
-              if (foreground) {
-                console.error(`[CLI] ✗ ${errorMsg}`)
-              }
-            }
-          }
-
-          // Send response back via app:control:response
-          console.log(`[CLI] Sending app:control:response with appControlId=${saveCallbackId}, success=${errors.length === 0}, savedCount=${savedCount}`)
-          socket!.emit('app:control:response', {
-            appControlId: saveCallbackId,
-            success: errors.length === 0,
-            savedCount,
-            error: errors.length > 0 ? errors.join('; ') : undefined
-          })
-          console.log(`[CLI] Emitted app:control:response`)
-
-          if (foreground) {
-            if (errors.length > 0) {
-              console.log(`[CLI] ⚠️  Saved ${savedCount}/${images.length} images with errors`)
-            } else {
-              console.log(`[CLI] ✓ Successfully saved all ${savedCount} images to ${tmpDir}`)
-            }
-          }
-        } catch (error: any) {
-          console.error(`[CLI] ✗ Error saving images: ${error.message}`)
-          // Send error response
-          console.log(`[CLI] Sending error app:control:response with appControlId=${data.saveCallbackId}`)
-          socket!.emit('app:control:response', {
-            appControlId: data.saveCallbackId,
-            success: false,
-            error: error.message
-          })
-          console.log(`[CLI] Emitted error app:control:response`)
-        }
-      })
-
-      socket.on('connect', () => {
-        if (foreground) {
-          console.log(`✓ Connected to backend at ${config.apiUrl}`)
-          if (socket) {
-            console.log(`   Socket ID: ${socket.id}`)
-          }
-        } else {
-          console.log('Connected to backend')
-        }
-        reconnectAttempts = 0
-        
-        // Register as CLI device
-        if (socket) {
-          socket.emit('register', { type: 'cli', deviceId })
-        }
-      })
-
-      socket.on('registered', async ({ type }: { type: string }) => {
-        if (foreground) {
-          console.log(`✓ Registered as ${type}`)
-        } else {
-          console.log(`Registered as ${type}`)
-        }
-
-        // Check for auth token: env TTC_AUTH_TOKEN or device-config.json (from previous approval)
-        let authToken = process.env.TTC_AUTH_TOKEN
-        let deviceEmail: string | undefined = email
-        let skipEmailFlow = false
-
-        // Load from device-config if no env token (reuse state from previous approval)
-        if (!authToken) {
-          try {
-            const deviceConfig = await readDiskDeviceConfig()
-            authToken = deviceConfig.authToken
-            if (!deviceEmail && deviceConfig.email) deviceEmail = deviceConfig.email
-          } catch {
-            // No device config yet
-          }
-        }
-
-        if (authToken) {
-          try {
-            const parts = authToken.split('.')
-            if (parts.length === 3) {
-              const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString())
-              if (payload.type === 'device_auth' && payload.email) {
-                deviceEmail = payload.email
-                skipEmailFlow = true
-                if (foreground) {
-                  console.log(`✓ Using stored auth token for ${deviceEmail}`)
-                }
-              }
-            }
-          } catch (err) {
-            if (foreground) {
-              console.warn(`⚠️  Invalid auth token in config, falling back to normal auth`)
-            }
-            authToken = undefined
-          }
-        }
-
-        // Load device email from config if not using token and not provided
-        if (!deviceEmail && !skipEmailFlow) {
-          try {
-            const deviceConfig = await readDiskDeviceConfig()
-            deviceEmail = deviceConfig.email
-          } catch {
-            // No device config yet
-          }
-        }
-        
-        // Register device with backend
-        let needsApprovalLoggedOnce = false
-        const registerDevice = () => {
-          // Determine device name
-          const containerName = process.env.CONTAINER_NAME
-          const deviceName = containerName ? `Container: ${containerName}` : `CLI Device ${hostname}`
-
-          socket!.emit('device:register', {
-            deviceId,
-            name: deviceName,
-            ipAddress,
-            hostname,
-            email: deviceEmail,
-            cliVersion: getCliVersion(),
-            // When using auth token, include the token for verification
-            authToken: skipEmailFlow ? authToken : undefined
-          }, ({ success, needsApproval, message, device, error }: {
-            success: boolean
-            needsApproval?: boolean
-            message?: string
-            device?: Device
-            error?: string
-          }) => {
-            if (success && device) {
-              needsApprovalLoggedOnce = false
-              if (foreground) {
-                console.log(`✓ Device registered: ${device.name}`)
-                if (device.approved) {
-                  console.log(`✓ Device approved and ready`)
-                }
-              } else {
-                console.log(`Device registered: ${device.name}${device.approved ? ' (approved)' : ' (pending approval)'}`)
-              }
-              // Save config: merge email; keep existing file authToken if in-memory token absent
-              if (device.email) {
-                void writeDeviceConfigMerged({
-                  email: device.email,
-                  ...(authToken ? { authToken } : {}),
-                }).catch(() => {})
-              }
-              if (authToken) {
-                scheduleAiConfigSync(authToken)
-              }
-            } else if (needsApproval) {
-              // Persist email when approval was requested; do not wipe authToken
-              if (deviceEmail) {
-                void writeDeviceConfigMerged({ email: deviceEmail }).catch(() => {})
-              }
-              // Only log once to avoid flooding logs every 30s on heartbeat
-              if (!needsApprovalLoggedOnce) {
-                needsApprovalLoggedOnce = true
-                if (foreground) {
-                  console.log(`\n⚠️  ${message || 'Device approval required'}`)
-                  if (!deviceEmail) {
-                    console.log(`   Please run: npx tsx index.ts register --email your@email.com`)
-                  } else {
-                    console.log(`   Check your email (${deviceEmail}) and click the approval link.`)
-                  }
-                } else {
-                  console.log(`⚠️  Device approval required: ${message || 'Please approve device'}`)
-                }
-              }
-            } else if (error) {
-              console.error(`✗ Registration error: ${error}`)
-            }
-          })
-        }
-        
-        registerDevice()
-        
-        // Update lastSeen every 30 seconds while connected
-        const heartbeatInterval = setInterval(() => {
-          if (socket?.connected) {
-            registerDevice()
-          } else {
-            clearInterval(heartbeatInterval)
-          }
-        }, 30000)
-        
-        // Store interval ID for cleanup
-        ;(socket as any).heartbeatInterval = heartbeatInterval
-      })
-
-      // ========== Version & Update Handlers ==========
-
-      // Respond with CLI version info
-      socket.on('version:info', (_data: Record<string, never>, callback: (response: {
-        success: boolean
-        version?: string
-        hash?: string
-        date?: string
-        nodeVersion?: string
-        platform?: string
-        arch?: string
-        error?: string
-      }) => void) => {
-        callback({
-          success: true,
-          version: getCliVersion(),
-          hash: getCliHash(),
-          date: new Date().toISOString(),
-          nodeVersion: process.version,
-          platform: os.platform(),
-          arch: os.arch()
-        })
-      })
-
-      // Force update: npm update -g @exreve/exk then restart PM2
-      socket.on('force-update', (_data: Record<string, never>, callback: (response: {
-        success: boolean
-        message?: string
-        error?: string
-      }) => void) => {
-        if (foreground) {
-          console.log('[force-update] Received force update command from server')
-        }
-
-        callback?.({ success: true, message: 'Update initiated' })
-
-        // Run npm update in background, then restart
-        const npmPaths = [
-          path.join(os.homedir(), '.nvm/versions/node/v22/bin/npm'),
-          path.join(os.homedir(), '.nvm/versions/node/v20/bin/npm')
-        ]
-        const npmBin = npmPaths.find(p => fsSync.existsSync(p)) || 'npm'
-
-        const updateProcess = spawn(npmBin, ['update', '-g', '@exreve/exk'], {
-          stdio: 'pipe',
-          detached: true
-        })
-
-        let output = ''
-        updateProcess.stdout?.on('data', (d: Buffer) => { output += d.toString() })
-        updateProcess.stderr?.on('data', (d: Buffer) => { output += d.toString() })
-
-        updateProcess.on('close', (code) => {
-          if (foreground) {
-            console.log(`[force-update] npm update exited with code ${code}`)
-            if (output) console.log(output)
-          }
-
-          // Restart PM2 process "cli" after a short delay
-          setTimeout(() => {
-            try {
-              execSync('pm2 restart cli', { stdio: 'inherit' })
-            } catch {
-              // If pm2 restart fails, just exit and let pm2 restart us
-              process.exit(0)
-            }
-          }, 2000)
-        })
-
-        updateProcess.on('error', (err) => {
-          if (foreground) {
-            console.error(`[force-update] npm update failed: ${err.message}`)
-          }
-        })
-      })
-
-      // ========== update:start handler (legacy compatibility) ==========
-      socket.on('update:start', (_data: Record<string, never>, callback: (response: {
-        success: boolean
-        message?: string
-        error?: string
-      }) => void) => {
-        // Use npm-based self-update
-        if (foreground) {
-          console.log('[update:start] Starting npm self-update...')
-        }
-
-        callback?.({ success: true, message: 'Update started via npm' })
-
-        const npmPaths = [
-          path.join(os.homedir(), '.nvm/versions/node/v22/bin/npm'),
-          path.join(os.homedir(), '.nvm/versions/node/v20/bin/npm')
-        ]
-        const npmBin = npmPaths.find(p => fsSync.existsSync(p)) || 'npm'
-
-        const updateProcess = spawn(npmBin, ['update', '-g', '@exreve/exk'], {
-          stdio: 'pipe',
-          detached: true
-        })
-
-        updateProcess.on('close', () => {
-          setTimeout(() => {
-            try {
-              execSync('pm2 restart cli', { stdio: 'inherit' })
-            } catch {
-              process.exit(0)
-            }
-          }, 2000)
-        })
-      })
-
-      // Cloudflared handlers
-      socket.on('cloudflared:check:request', async () => {
-        try {
-          let installed = false
-          let hasCert = false
-          let activeTunnelId: string | undefined
-
-          try {
-            // Check if cloudflared is installed
-            execSync('which cloudflared', { stdio: 'ignore' })
-            installed = true
-
-            // Check if cert.pem exists
-            const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem')
-            try {
-              // Use fs.stat to check if file exists (more reliable than access)
-              const stats = await fs.stat(certPath)
-              hasCert = stats.isFile()
-              if (foreground && hasCert) {
-                console.log(`✓ Found cert.pem at ${certPath}`)
-              }
-            } catch (err: any) {
-              // File doesn't exist or can't be accessed
-              hasCert = false
-              if (foreground) {
-                console.log(`✗ cert.pem not found at ${certPath}: ${err.message}`)
-              }
-            }
-
-            // Detect running cloudflared tunnel by inspecting processes
-            try {
-              const psOutput = execSync('ps aux', { encoding: 'utf-8' })
-              const cloudflaredLines = psOutput.split('\n').filter(line => line.includes('cloudflared') && line.includes('tunnel'))
-
-              for (const line of cloudflaredLines) {
-                // Look for --token flag in the process args
-                const tokenMatch = line.match(/--token\s+(\S+)/)
-                if (tokenMatch && tokenMatch[1]) {
-                  try {
-                    // Decode base64url token to extract tunnel ID
-                    const tokenB64 = tokenMatch[1].replace(/-/g, '+').replace(/_/g, '/')
-                    const padded = tokenB64 + '='.repeat((4 - tokenB64.length % 4) % 4)
-                    const tokenJson = Buffer.from(padded, 'base64').toString('utf-8')
-                    const tokenData = JSON.parse(tokenJson)
-                    if (tokenData.t) {
-                      activeTunnelId = tokenData.t
-                      if (foreground) {
-                        console.log(`✓ Detected active tunnel: ${activeTunnelId}`)
-                      }
-                      break
-                    }
-                  } catch {
-                    // Failed to decode token, skip
-                  }
-                }
-
-                // Also check for named tunnel (cloudflared tunnel run <name>)
-                const nameMatch = line.match(/cloudflared.*tunnel\s+run\s+(?:--.*?\s+)?(\S+)/)
-                if (!activeTunnelId && nameMatch && nameMatch[1] && !nameMatch[1].startsWith('-')) {
-                  // This is a tunnel name, not an ID - we'll resolve it later via API
-                  activeTunnelId = nameMatch[1]
-                  if (foreground) {
-                    console.log(`✓ Detected running tunnel name: ${activeTunnelId}`)
-                  }
-                  break
-                }
-              }
-            } catch {
-              // ps failed, can't detect active tunnel
-            }
-          } catch {
-            installed = false
-          }
-
-          socket!.emit('cloudflared:check:response', { installed, hasCert, activeTunnelId })
-          if (foreground) {
-            console.log(`Cloudflared check: installed=${installed}, hasCert=${hasCert}, activeTunnelId=${activeTunnelId || 'none'}`)
-          }
-        } catch (error: any) {
-          socket!.emit('cloudflared:check:response', { installed: false, hasCert: false })
-        }
-      })
-
-      socket.on('cloudflared:sync:request', async () => {
-        try {
-          const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem')
-          
-          if (foreground) {
-            console.log(`Syncing credentials from ${certPath}`)
-          }
-          
-          // Read cert.pem file
-          const certContent = await fs.readFile(certPath, 'utf-8')
-          
-          // Extract token between BEGIN and END markers
-          const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/)
-          if (tokenMatch && tokenMatch[1]) {
-            // Decode base64 token
-            const tokenBase64 = tokenMatch[1].replace(/\s/g, '')
-            const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8')
-            const tokenData = JSON.parse(tokenJson)
-            
-            // Extract API token, account ID, and zone ID
-            const apiToken = tokenData.apiToken
-            const accountId = tokenData.accountID
-            const zoneId = tokenData.zoneID
-            
-            if (foreground) {
-              console.log(`✓ Extracted credentials: accountId=${accountId}, zoneId=${zoneId}`)
-            }
-            
-            socket!.emit('cloudflared:sync:complete', {
-              accountId,
-              accountName: undefined,
-              apiToken,
-              zoneId
-            })
-          } else {
-            const error = 'Failed to extract token from cert.pem'
-            if (foreground) {
-              console.error(`✗ ${error}`)
-            }
-            socket!.emit('cloudflared:sync:error', { error })
-          }
-        } catch (error: any) {
-          const errorMsg = `Failed to read cert.pem: ${error.message}`
-          if (foreground) {
-            console.error(`✗ ${errorMsg}`)
-          }
-          socket!.emit('cloudflared:sync:error', { error: errorMsg })
-        }
-      })
-
-      socket.on('cloudflared:login:request', async () => {
-        try {
-          
-          // Run cloudflared tunnel login
-          const loginProcess = spawn('cloudflared', ['tunnel', 'login'], {
-            stdio: ['ignore', 'pipe', 'pipe']
-          })
-
-          let stdout = ''
-          let stderr = ''
-          let urlEmitted = false
-          let alreadyLoggedIn = false
-          let certPath: string | null = null
-
-          const extractCertPath = (text: string): string | null => {
-            // Look for: "You have an existing certificate at /path/to/cert.pem"
-            const pathMatch = text.match(/existing certificate at\s+([^\s]+)/i) ||
-                            text.match(/certificate at\s+([^\s]+)/i) ||
-                            text.match(/cert\.pem.*?at\s+([^\s]+)/i)
-            return pathMatch ? pathMatch[1] : null
-          }
-
-          const extractLoginUrl = (text: string): string | null => {
-            // Look for URLs in the output
-            const urlPatterns = [
-              /https:\/\/dash\.cloudflare\.com\/argotunnel[^\s\)]+/g,
-              /https:\/\/[^\s\)]+cloudflareaccess\.org[^\s\)]+/g,
-              /https:\/\/[^\s\)]+cloudflare\.com[^\s\)]+/g
-            ]
-            
-            for (const pattern of urlPatterns) {
-              const matches = text.match(pattern)
-              if (matches && matches.length > 0) {
-                return matches[0]
-              }
-            }
-            return null
-          }
-
-          loginProcess.stdout.on('data', (data) => {
-            const text = data.toString()
-            stdout += text
-            
-            // Check for already logged in error
-            if (text.includes('existing certificate') || text.includes('cert.pem which login would overwrite')) {
-              alreadyLoggedIn = true
-              const extractedPath = extractCertPath(text)
-              if (extractedPath) {
-                certPath = extractedPath
-              }
-            }
-            
-            // Extract login URL if not already logged in
-            if (!alreadyLoggedIn && !urlEmitted) {
-              const url = extractLoginUrl(text)
-              if (url) {
-                urlEmitted = true
-                socket!.emit('cloudflared:login:url', { loginUrl: url })
-              }
-            }
-          })
-
-          loginProcess.stderr.on('data', (data) => {
-            const text = data.toString()
-            stderr += text
-            
-            // Check for already logged in error (often in stderr)
-            if (text.includes('existing certificate') || text.includes('cert.pem which login would overwrite')) {
-              alreadyLoggedIn = true
-              const extractedPath = extractCertPath(text)
-              if (extractedPath) {
-                certPath = extractedPath
-              }
-            }
-            
-            // Extract login URL if not already logged in
-            if (!alreadyLoggedIn && !urlEmitted) {
-              const url = extractLoginUrl(text)
-              if (url) {
-                urlEmitted = true
-                socket!.emit('cloudflared:login:url', { loginUrl: url })
-              }
-            }
-          })
-
-          loginProcess.on('close', async (code) => {
-            if (alreadyLoggedIn && certPath) {
-              // Already logged in - extract credentials from existing cert
-              try {
-                if (foreground) {
-                  console.log(`Already logged in, extracting credentials from ${certPath}`)
-                }
-                const certContent = await fs.readFile(certPath, 'utf-8')
-                const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/)
-                if (tokenMatch && tokenMatch[1]) {
-                  const tokenBase64 = tokenMatch[1].replace(/\s/g, '')
-                  const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8')
-                  const tokenData = JSON.parse(tokenJson)
-                  
-                  if (foreground) {
-                    console.log(`✓ Extracted credentials from existing cert`)
-                  }
-                  
-                  socket!.emit('cloudflared:login:complete', {
-                    accountId: tokenData.accountID,
-                    accountName: undefined,
-                    apiToken: tokenData.apiToken,
-                    zoneId: tokenData.zoneID
-                  })
-                } else {
-                  const error = 'Failed to extract token from existing cert.pem'
-                  if (foreground) {
-                    console.error(`✗ ${error}`)
-                  }
-                  socket!.emit('cloudflared:login:error', { error })
-                }
-              } catch (error: any) {
-                const errorMsg = `Failed to read cert.pem: ${error.message}`
-                if (foreground) {
-                  console.error(`✗ ${errorMsg}`)
-                }
-                socket!.emit('cloudflared:login:error', { error: errorMsg })
-              }
-            } else if (code === 0 && !alreadyLoggedIn) {
-              // Login completed successfully - wait a moment then extract credentials
-              if (foreground) {
-                console.log('Login completed, extracting credentials...')
-              }
-              setTimeout(async () => {
-                try {
-                  const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem')
-                  const certContent = await fs.readFile(certPath, 'utf-8')
-                  const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/)
-                  if (tokenMatch && tokenMatch[1]) {
-                    const tokenBase64 = tokenMatch[1].replace(/\s/g, '')
-                    const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8')
-                    const tokenData = JSON.parse(tokenJson)
-                    
-                    if (foreground) {
-                      console.log(`✓ Extracted credentials after login`)
-                    }
-                    
-                    socket!.emit('cloudflared:login:complete', {
-                      accountId: tokenData.accountID,
-                      accountName: undefined,
-                      apiToken: tokenData.apiToken,
-                      zoneId: tokenData.zoneID
-                    })
-                  } else {
-                    const error = 'Failed to extract token from cert.pem after login'
-                    if (foreground) {
-                      console.error(`✗ ${error}`)
-                    }
-                    socket!.emit('cloudflared:login:error', { error })
-                  }
-                } catch (error: any) {
-                  const errorMsg = `Failed to read cert.pem after login: ${error.message}`
-                  if (foreground) {
-                    console.error(`✗ ${errorMsg}`)
-                  }
-                  socket!.emit('cloudflared:login:error', { error: errorMsg })
-                }
-              }, 1000) // Wait 1 second for file to be written
-            } else if (!alreadyLoggedIn) {
-              const error = `Login failed with code ${code}: ${stderr || stdout}`
-              if (foreground) {
-                console.error(`✗ ${error}`)
-              }
-              socket!.emit('cloudflared:login:error', { error })
-            }
-          })
-
-          loginProcess.on('error', (error) => {
-            socket!.emit('cloudflared:login:error', { error: error.message })
-          })
-        } catch (error: any) {
-          socket!.emit('cloudflared:login:error', { error: error.message })
-        }
-      })
-
-      socket.on('cloudflared:regenerate:request', async () => {
-        try {
-          const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem')
-          
-          // Delete existing cert.pem
-          try {
-            await fs.unlink(certPath)
-            if (foreground) {
-              console.log(`✓ Deleted existing cert.pem`)
-            }
-          } catch (error: any) {
-            // File might not exist, that's okay
-            if (foreground && error.code !== 'ENOENT') {
-              console.log(`Note: Could not delete cert.pem: ${error.message}`)
-            }
-          }
-          
-          // Emit success - frontend will then trigger login
-          socket!.emit('cloudflared:regenerate:complete', {})
-        } catch (error: any) {
-          socket!.emit('cloudflared:regenerate:error', { error: error.message })
-        }
-      })
-
-      socket.on('cloudflared:login:request', async () => {
-        try {
-          
-          // First check if cloudflared is installed
-          try {
-            execSync('which cloudflared', { stdio: 'ignore' })
-          } catch {
-            socket!.emit('cloudflared:login:error', { error: 'cloudflared is not installed' })
-            return
-          }
-
-          // Run cloudflared tunnel login
-          // This command outputs a URL that needs to be visited
-          const loginProcess = spawn('cloudflared', ['tunnel', 'login'], {
-            stdio: ['ignore', 'pipe', 'pipe']
-          })
-
-          let stdout = ''
-          let stderr = ''
-          let urlEmitted = false
-
-          const findAndEmitUrl = (text: string) => {
-            if (urlEmitted) return
-            
-            // Look for URL in output - cloudflared outputs URLs in various formats
-            const urlPatterns = [
-              /https:\/\/[^\s\)]+/g,
-              /https:\/\/[^\n]+/g
-            ]
-            
-            for (const pattern of urlPatterns) {
-              const matches = text.match(pattern)
-              if (matches && matches.length > 0) {
-                // Find the login URL (usually contains "cloudflareaccess.com" or similar)
-                const loginUrl = matches.find(url => 
-                  url.includes('cloudflareaccess.com') || 
-                  url.includes('cloudflare.com') ||
-                  url.includes('trycloudflare.com') ||
-                  url.includes('dash.cloudflare.com')
-                )
-                if (loginUrl) {
-                  urlEmitted = true
-                  socket!.emit('cloudflared:login:url', { loginUrl: loginUrl.trim() })
-                  return
-                }
-              }
-            }
-          }
-
-          loginProcess.stdout.on('data', (data) => {
-            const text = data.toString()
-            stdout += text
-            findAndEmitUrl(text)
-          })
-
-          loginProcess.stderr.on('data', (data) => {
-            const text = data.toString()
-            stderr += text
-            // cloudflared often outputs URLs to stderr
-            findAndEmitUrl(text)
-          })
-
-          loginProcess.on('close', async (code) => {
-            if (code === 0) {
-              // Login successful, extract API token from cert.pem
-              try {
-                const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem')
-                const certContent = await fs.readFile(certPath, 'utf-8')
-                
-                // Extract token between BEGIN and END markers
-                const tokenMatch = certContent.match(/-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/)
-                if (tokenMatch && tokenMatch[1]) {
-                  // Decode base64 token
-                  const tokenBase64 = tokenMatch[1].replace(/\s/g, '')
-                  const tokenJson = Buffer.from(tokenBase64, 'base64').toString('utf-8')
-                  const tokenData = JSON.parse(tokenJson)
-                  
-                  // Extract API token, account ID, and zone ID
-                  const apiToken = tokenData.apiToken
-                  const accountId = tokenData.accountID
-                  const zoneId = tokenData.zoneID
-                  
-                  socket!.emit('cloudflared:login:complete', {
-                    accountId,
-                    accountName: undefined,
-                    apiToken,
-                    zoneId
-                  })
-                } else {
-                  socket!.emit('cloudflared:login:error', { 
-                    error: 'Failed to extract token from cert.pem' 
-                  })
-                }
-              } catch (error: any) {
-                socket!.emit('cloudflared:login:error', { 
-                  error: `Failed to read cert.pem: ${error.message}` 
-                })
-              }
-            } else {
-              socket!.emit('cloudflared:login:error', { 
-                error: `Login failed with code ${code}: ${stderr}` 
-              })
-            }
-          })
-
-          loginProcess.on('error', (error) => {
-            socket!.emit('cloudflared:login:error', { error: error.message })
-          })
-        } catch (error: any) {
-          socket!.emit('cloudflared:login:error', { error: error.message })
-        }
-      })
-
-      // ========== Container Management Handlers ==========
-
-      // Check if container runtime is available
-      socket.on('container:check:request', async () => {
-        try {
-          let enabled = false
-          let runtime: 'docker' | 'podman' | undefined
-          let version = ''
-
-          try {
-            // Check for docker first
-            execSync('which docker', { stdio: 'ignore' })
-            runtime = 'docker'
-            version = execSync('docker --version', { encoding: 'utf-8' }).trim()
-            enabled = true
-          } catch {
-            try {
-              // Check for podman as fallback
-              execSync('which podman', { stdio: 'ignore' })
-              runtime = 'podman'
-              version = execSync('podman --version', { encoding: 'utf-8' }).trim()
-              enabled = true
-            } catch {
-              enabled = false
-            }
-          }
-
-          socket!.emit('container:check:response', { enabled, runtime, version })
-          if (foreground) {
-            console.log(`Container runtime check: ${enabled ? `${runtime} (${version})` : 'Not found'}`)
-          }
-        } catch (error: any) {
-          socket!.emit('container:check:response', { enabled: false, runtime: undefined, version: '' })
-        }
-      })
-
-      // List all containers
-      socket.on('container:list:request', async () => {
-        try {
-          const runtime = getContainerRuntime()
-          if (!runtime) {
-            socket!.emit('container:list:response', { success: false, error: 'No container runtime found' })
-            return
-          }
-
-          // List all containers including stopped ones
-          const output = execSync(
-            `${runtime} ps -a --format "{{json .}}"`,
-            { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 }
-          )
-
-          const containers = output.trim().split('\n').filter(Boolean).map(line => {
-            try {
-              const c = JSON.parse(line)
-              // Parse ports from the PORTS column (format: "0.0.0.0:8080->80/tcp, 0.0.0.0:9090->9090/tcp")
-              const ports: Array<{ host: number; container: number }> = []
-              if (c.Ports) {
-                const portMatches = c.Ports.match(/(\d+)->(\d+)/g)
-                if (portMatches) {
-                  portMatches.forEach((p: string) => {
-                    const [host, container] = p.split('->').map(Number)
-                    ports.push({ host, container })
-                  })
-                }
-              }
-              return {
-                containerId: c.ID,
-                name: c.Names.replace(/^\//, ''), // Remove leading slash
-                image: c.Image,
-                status: c.State === 'running' ? 'running' : c.State === 'paused' ? 'paused' : c.Status === 'exited' ? 'exited' : 'stopped',
-                ports,
-                createdAt: new Date(c.CreatedAt).toISOString()
-              }
-            } catch {
-              return null
-            }
-          }).filter(Boolean)
-
-          socket!.emit('container:list:response', { success: true, containers })
-        } catch (error: any) {
-          socket!.emit('container:list:response', { success: false, error: error.message })
-        }
-      })
-
-      // Start a new container
-      socket.on('container:start:request', async (data: {
-        name: string
-        image: string
-        ports?: Array<{ host: number; container: number }>
-        env?: Record<string, string>
-        runAsRoot?: boolean  // Allow running as root inside container (safe, still isolated)
-      }) => {
-        try {
-          const runtime = getContainerRuntime()
-          if (!runtime) {
-            socket!.emit('container:start:response', { success: false, error: 'No container runtime found' })
-            return
-          }
-
-          const { name, image, ports = [], env = {}, runAsRoot = false } = data
-
-          // Get CLI directory path (where this script is running from)
-          // Use the same pattern as elsewhere in the file
-          const cliDir = path.dirname(CURRENT_FILE)
-
-          // Build docker run command
-          let cmd = `${runtime} run -d --name ${name}`
-
-          // Security: Running as root INSIDE container is safe - it's still isolated from host
-          // Root inside container cannot access host filesystem (read-only mounts)
-          // Default to root to allow package installation and full container functionality
-          // Set runAsRoot: false to run as non-root user (UID 1000) if needed
-          if (!runAsRoot) {
-            cmd += ' --user 1000:1000'
-          }
-
-          // Resource limits
-          cmd += ' --memory=8g'       // Limit memory to 8GB
-
-          // Auto-remove on exit (optional - commented out for persistence)
-          // cmd += ' --rm'
-
-          // Mount CLI directory into container
-          cmd += ` -v "${cliDir}:/opt/ttc:ro"`
-
-          // Mount entrypoint script
-          const entrypointScript = path.join(cliDir, 'container-entrypoint.sh')
-          cmd += ` -v "${entrypointScript}:/entrypoint.sh:ro"`
-
-          // Port mappings
-          ports.forEach(p => {
-            cmd += ` -p ${p.host}:${p.container}`
-          })
-
-          // Environment variables
-          Object.entries(env).forEach(([k, v]) => {
-            // Escape quotes in env values
-            const escapedValue = String(v).replace(/"/g, '\\"')
-            cmd += ` -e ${k}="${escapedValue}"`
-          })
-
-          // Add container-specific environment variables
-          cmd += ` -e CONTAINER_NAME="${name}"`
-          cmd += ` -e HOSTNAME="${name}"`
-
-          // Use entrypoint script
-          cmd += ` --entrypoint /bin/sh ${image} /entrypoint.sh`
-
-          if (foreground) {
-            console.log(`Starting container: ${cmd}`)
-          }
-
-          // Pull image if not exists, then run
-          try {
-            execSync(`${runtime} pull ${image}`, { stdio: 'ignore' })
-          } catch {
-            // Pull failed, but might already exist locally
-          }
-
-          const output = execSync(cmd, { encoding: 'utf-8', stdio: 'pipe' })
-          const containerId = output.trim()
-
-          socket!.emit('container:start:response', { success: true, containerId })
-
-          if (foreground) {
-            console.log(`✓ Container started: ${containerId}`)
-          }
-        } catch (error: any) {
-          socket!.emit('container:start:response', { success: false, error: error.message })
-        }
-      })
-
-      // Stop a container
-      socket.on('container:stop:request', async (data: { containerId: string }) => {
-        try {
-          const runtime = getContainerRuntime()
-          if (!runtime) {
-            socket!.emit('container:stop:response', { success: false, error: 'No container runtime found' })
-            return
-          }
-
-          const { containerId } = data
-
-          execSync(`${runtime} stop ${containerId}`, { stdio: 'ignore' })
-
-          socket!.emit('container:stop:response', { success: true })
-
-          if (foreground) {
-            console.log(`✓ Container stopped: ${containerId}`)
-          }
-        } catch (error: any) {
-          socket!.emit('container:stop:response', { success: false, error: error.message })
-        }
-      })
-
-      // Remove a container
-      socket.on('container:remove:request', async (data: { containerId: string }) => {
-        try {
-          const runtime = getContainerRuntime()
-          if (!runtime) {
-            socket!.emit('container:remove:response', { success: false, error: 'No container runtime found' })
-            return
-          }
-
-          const { containerId } = data
-
-          // Force remove even if running
-          execSync(`${runtime} rm -f ${containerId}`, { stdio: 'ignore' })
-
-          socket!.emit('container:remove:response', { success: true })
-
-          if (foreground) {
-            console.log(`✓ Container removed: ${containerId}`)
-          }
-        } catch (error: any) {
-          socket!.emit('container:remove:response', { success: false, error: error.message })
-        }
-      })
-
-      // Get container logs
-      socket.on('container:logs:request', async (data: { containerId: string; lines?: number }) => {
-        try {
-          const runtime = getContainerRuntime()
-          if (!runtime) {
-            socket!.emit('container:logs:response', { success: false, error: 'No container runtime found' })
-            return
-          }
-
-          const { containerId, lines = 100 } = data
-
-          const logs = execSync(
-            `${runtime} logs --tail ${lines} ${containerId}`,
-            { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 }
-          )
-
-          socket!.emit('container:logs:response', { success: true, logs })
-        } catch (error: any) {
-          socket!.emit('container:logs:response', { success: false, error: error.message })
-        }
-      })
-
-      // Helper function to get available container runtime
-      function getContainerRuntime(): 'docker' | 'podman' | null {
-        try {
-          execSync('which docker', { stdio: 'ignore' })
-          return 'docker'
-        } catch {
-          try {
-            execSync('which podman', { stdio: 'ignore' })
-            return 'podman'
-          } catch {
-            return null
-          }
-        }
-      }
-
-      socket.on('disconnect', (reason) => {
-        if (foreground) {
-          console.log(`\n⚠️  Disconnected: ${reason}`)
-          console.log('   Attempting to reconnect...')
-        } else {
-          console.log(`Disconnected: ${reason}`)
-        }
-        
-        // Clear heartbeat interval
-        if ((socket as any).heartbeatInterval) {
-          clearInterval((socket as any).heartbeatInterval)
-        }
-        
-        if (reason === 'io server disconnect') {
-          // Server disconnected, reconnect manually
-          socket!.connect()
-        } else {
-          // Client disconnect or transport close: schedule full reconnect so process stays alive
-          if (reconnectTimeout) clearTimeout(reconnectTimeout)
-          const delay = 2000
-          if (!foreground) console.log(`Reconnecting in ${delay}ms...`)
-          reconnectTimeout = setTimeout(connectAndRegister, delay)
-        }
-      })
-
-      socket.on('connect_error', (err: Error & { type?: string; description?: string; cause?: any }) => {
-        reconnectAttempts++
-        if (foreground) {
-          console.error(`✗ Connection error (attempt ${reconnectAttempts}): ${err.message}`)
-          if (err.type) {
-            console.error(`   Error type: ${err.type}`)
-          }
-          if (err.description) {
-            console.error(`   Error description: ${err.description}`)
-          }
-          console.error(`   Connecting to: ${config.apiUrl}`)
-          if (err.cause) {
-            console.error(`   Cause:`, err.cause)
-          }
-        } else {
-          console.error(`Connection error (attempt ${reconnectAttempts}):`, err.message)
-        }
-      })
-
-      // Keep process alive
-      socket.on('error', (err) => {
-        if (foreground) {
-          console.error(`✗ Socket error: ${err}`)
-        } else {
-          console.error('Socket error:', err)
-        }
-      })
-
-    } catch (error) {
-      if (foreground) {
-        console.error(`✗ Failed to connect: ${(error as Error).message}`)
-      } else {
-        console.error('Failed to connect:', (error as Error).message)
-      }
-      reconnectAttempts++
-      
-      if (reconnectAttempts < MAX_RECONNECT_ATTEMPTS) {
-        const delay = Math.min(1000 * Math.pow(2, reconnectAttempts), 30000)
-        if (foreground) {
-          console.log(`⏳ Reconnecting in ${delay}ms...`)
-        } else {
-          console.log(`Reconnecting in ${delay}ms...`)
-        }
-        reconnectTimeout = setTimeout(connectAndRegister, delay)
-      }
-    }
-  }
-
-  // Handle graceful shutdown
-  const shutdown = () => {
-    if (foreground) {
-      console.log('\n\n🛑 Shutting down gracefully...')
-    } else {
-      console.log('\nShutting down...')
-    }
-    if (reconnectTimeout) {
-      clearTimeout(reconnectTimeout)
-    }
-    if (socket) {
-      // Clear heartbeat interval
-      if ((socket as any).heartbeatInterval) {
-        clearInterval((socket as any).heartbeatInterval)
-      }
-      socket.disconnect()
-    }
-    process.exit(0)
-  }
-
-  process.on('SIGTERM', shutdown)
-  process.on('SIGINT', shutdown)
-  process.on('SIGHUP', shutdown)
-
-  // Start connection
-  await connectAndRegister()
-
-  // Keep process alive
-  process.stdin.resume()
-}
-
-// ============ CLI Program ============
-
-const program = new Command()
-
-program
-  .name('exk')
-  .description('exk - Control Claude CLI with voice and programmable interfaces')
-  .version(getCliVersion())
-
-// Config command
-program
-  .command('config')
-  .description('Get or set config (api-url)')
-  .option('--api-url <url>', 'API base URL')
-  .action(async (opts: { apiUrl?: string }) => {
-    const config = await readConfig()
-    if (opts.apiUrl !== undefined) {
-      config.apiUrl = opts.apiUrl
-      await writeConfig(config)
-      console.log('Set api-url:', config.apiUrl)
-    } else {
-      console.log('Config:', JSON.stringify(config, null, 2))
-    }
-    process.exit(0)
-  })
-
-// Register command
-program
-  .command('register')
-  .description('Register this device and install as persistent daemon')
-  .argument('[email]', 'Email address for device approval')
-  .action(async (email: string | undefined) => {
-    try {
-      // First register the device
-      await registerDevice(undefined, email)
-
-      // After successful registration, install as PM2 service (Linux/macOS only)
-      if (process.platform === 'win32') {
-        console.log('\n✓ Device registered.')
-        console.log('On Windows, run the daemon manually: exk daemon')
-      } else {
-        console.log('\n📦 Installing exk daemon with pm2...')
-
-        const exkBin = process.argv[1] || 'exk'
-
-        try {
-          // Check if pm2 is installed
-          try {
-            execSync('which pm2', { stdio: 'ignore' })
-          } catch {
-            console.log('Installing pm2...')
-            execSync('npm i -g pm2', { stdio: 'inherit' })
-          }
-
-          // Delete existing pm2 process if any, then start fresh
-          try { execSync('pm2 delete cli 2>/dev/null', { stdio: 'ignore' }) } catch {}
-
-          // Start exk daemon with pm2
-          execSync(`pm2 start "${exkBin}" --name cli --interpreter none -- daemon`, {
-            stdio: 'inherit'
-          })
-
-          // Save pm2 process list for auto-restart on reboot
-          try {
-            execSync('pm2 save', { stdio: 'inherit' })
-          } catch {
-            // Non-critical
-          }
-
-          console.log('\n✓ exk installation complete!')
-          console.log('The service is now running in the background.')
-          console.log('\nUseful commands:')
-          console.log('  pm2 logs cli     - View logs')
-          console.log('  pm2 restart cli  - Restart service')
-          console.log('  pm2 stop cli     - Stop service')
-          console.log('  pm2 delete cli   - Remove service')
-        } catch (err: unknown) {
-          const error = err as Error
-          console.log('\n⚠ PM2 installation had issues, but device is registered.')
-          const execErr = error as { stderr?: Buffer; stdout?: Buffer }
-          const errDetail = execErr.stderr?.toString() || execErr.stdout?.toString() || error.message
-          if (errDetail) console.error('Error:', errDetail)
-          console.log('You can start the daemon manually with: exk daemon')
-        }
-      }
-    } catch (error) {
-      const err = error as Error
-      const errorMsg = err.message || String(error)
-      if (errorMsg.includes('approval') || errorMsg.includes('email')) {
-        // Registration failed - exit with error
-        process.exit(1)
-      }
-      // Service installation failed, but device is registered
-      console.log('\n⚠ Service installation had issues, but device is registered.')
-      console.error('Error:', (err as { stderr?: Buffer }).stderr?.toString() || errorMsg)
-      console.log('You can start the daemon manually with: exk daemon')
-    }
-
-    // Exit after install is complete
-    process.exit(0)
-  })
-
-// Uninstall command
-program
-  .command('uninstall')
-  .description('Uninstall exk daemon (removes pm2 service and config)')
-  .action(async () => {
-    console.log('Uninstalling exk daemon...')
-
-    if (process.platform === 'win32') {
-      console.log('On Windows there is no service to remove.')
-      console.log('To remove exk completely: npm uninstall -g @exreve/exk')
-    } else {
-      try {
-        execSync('pm2 delete cli', { stdio: 'inherit' })
-        try {
-          execSync('pm2 save', { stdio: 'inherit' })
-        } catch { /* non-critical */ }
-        console.log('\n✓ Service uninstalled!')
-        console.log('To remove the package completely: npm uninstall -g @exreve/exk')
-      } catch {
-        console.log('\n⚠ PM2 service not found or already removed.')
-        console.log('To remove exk: npm uninstall -g @exreve/exk')
-        console.log('  rm -rf ~/.talk-to-code')
-      }
-    }
-
-    // Exit after uninstall is complete
-    process.exit(0)
-  })
-
-// Update command - uses npm to update the global package
-program
-  .command('update')
-  .description('Update exk to the latest version via npm')
-  .option('-f, --force', 'Update without confirmation')
-  .action(async (options: { force?: boolean }) => {
-    const currentVersion = getCliVersion()
-    console.log(`Current version: ${currentVersion}`)
-
-    // Check latest version from npm
-    try {
-      const latestVersion = execSync('npm view @exreve/exk version', { encoding: 'utf-8' }).trim()
-      console.log(`Latest version: ${latestVersion}`)
-
-      if (latestVersion === currentVersion) {
-        console.log('✓ Already up to date')
-        process.exit(0)
-      }
-
-      if (!options.force && process.stdin.isTTY) {
-        const rl = readline.createInterface({ input: process.stdin, output: process.stdout })
-        const answer = await new Promise<string>(r => rl.question('Update now? [Y/n] ', a => { rl.close(); r(a.trim()) }))
-        if (answer.toLowerCase().startsWith('n')) {
-          process.exit(0)
-        }
-      }
-
-      console.log('Updating...')
-      execSync('npm i -g @exreve/exk@latest', { stdio: 'inherit' })
-      console.log(`\n✓ Updated to ${latestVersion}`)
-
-      // Restart PM2 if running
-      try {
-        execSync('pm2 restart cli', { stdio: 'inherit' })
-      } catch {
-        // Not running under PM2, that's fine
-      }
-    } catch (error: any) {
-      console.error('Update failed:', error.message)
-      process.exit(1)
-    }
-
-    process.exit(0)
-  })
-
-program
-  .command('check-update')
-  .description('Check for updates')
-  .action(async () => {
-    const currentVersion = getCliVersion()
-    console.log(`Current version: ${currentVersion}`)
-
-    try {
-      const latestVersion = execSync('npm view @exreve/exk version', { encoding: 'utf-8' }).trim()
-      console.log(`Latest version: ${latestVersion}`)
-
-      if (latestVersion === currentVersion) {
-        console.log('✓ Up to date')
-      } else {
-        console.log(`📦 Update available: ${currentVersion} → ${latestVersion}`)
-        console.log('Run "exk update" to install')
-      }
-    } catch (error: any) {
-      console.error('Failed to check for updates:', error.message)
-      process.exit(1)
-    }
-    process.exit(0)
-  })
-
-// Run (connect to backend and process prompts)
-program
-  .command('run')
-  .description('Run CLI and connect to backend')
-  .option('--email <email>', 'Email for device approval')
-  .action((options: { email?: string }) => {
-    runDaemon(false, options.email).catch((error) => {
-      console.error('Run error:', (error as Error).message)
-      process.exit(1)
-    })
-  })
-
-// Hidden daemon command (internal alias)
-program
-  .command('daemon', { hidden: true })
-  .description('Run daemon (internal)')
-  .option('--foreground', 'Run in foreground', false)
-  .option('--email <email>', 'Email address')
-  .action((options: { foreground?: boolean; email?: string }) => {
-    runDaemon(options.foreground, options.email).catch((error) => {
-      console.error('Daemon error:', (error as Error).message)
-      process.exit(1)
-    })
-  })
-
-program.parse()