@instafy/cli 0.2.3 → 0.3.0

package/dist/cli.js

@@ -1263,7 +1263,7 @@ var org_exports = {};
 __export(org_exports, {
   listOrganizations: () => listOrganizations
 });
-import kleur17 from "kleur";
+import kleur18 from "kleur";
 function getTeamDisplayName2(name) {
   const trimmed = (name ?? "").trim();
   if (!trimmed || trimmed === "Personal organization" || trimmed === "Personal team" || trimmed === "Personal workspace") {
@@ -1301,11 +1301,11 @@ async function listOrganizations(params) {
     console.log(JSON.stringify(orgs, null, 2));
   } else {
     if (orgs.length === 0) {
-      console.log(kleur17.yellow("No teams found for this account."));
+      console.log(kleur18.yellow("No teams found for this account."));
     } else {
       for (const org of orgs) {
         const role = org.role ? ` [${org.role}]` : "";
-        console.log(`${kleur17.green(getTeamDisplayName2(org.name))} (${org.id}${role})`);
+        console.log(`${kleur18.green(getTeamDisplayName2(org.name))} (${org.id}${role})`);
       }
     }
   }
@@ -1335,9 +1335,9 @@ var init_hardwareProvider2 = __esm({
 });
 
 // ../instafy-sdk/src/hardwareNode.ts
-import fs14 from "node:fs";
-import os5 from "node:os";
-import path15 from "node:path";
+import fs17 from "node:fs";
+import os7 from "node:os";
+import path18 from "node:path";
 function uniqueStrings(values) {
   const seen = /* @__PURE__ */ new Set();
   const result = [];
@@ -1376,14 +1376,14 @@ function classifySerialPort(fileName, fullPath) {
   return null;
 }
 function inspectPort(portPath) {
-  const resolvedPath = path15.resolve(portPath);
+  const resolvedPath = path18.resolve(portPath);
   let exists = false;
   let readable = false;
   let writable = false;
   let isCharacterDevice = false;
   let error = null;
   try {
-    const stat = fs14.statSync(resolvedPath);
+    const stat = fs17.statSync(resolvedPath);
     exists = true;
     isCharacterDevice = stat.isCharacterDevice();
   } catch (caught) {
@@ -1391,13 +1391,13 @@ function inspectPort(portPath) {
   }
   if (exists) {
     try {
-      fs14.accessSync(resolvedPath, fs14.constants.R_OK);
+      fs17.accessSync(resolvedPath, fs17.constants.R_OK);
       readable = true;
     } catch {
       readable = false;
     }
     try {
-      fs14.accessSync(resolvedPath, fs14.constants.W_OK);
+      fs17.accessSync(resolvedPath, fs17.constants.W_OK);
       writable = true;
     } catch {
       writable = false;
@@ -1419,12 +1419,12 @@ function listCandidates(scanDirs) {
   for (const scanDir of scanDirs) {
     let entries = [];
     try {
-      entries = fs14.readdirSync(scanDir);
+      entries = fs17.readdirSync(scanDir);
     } catch {
       continue;
     }
     for (const entry of entries) {
-      const fullPath = path15.join(scanDir, entry);
+      const fullPath = path18.join(scanDir, entry);
       const kind = classifySerialPort(entry, fullPath);
       if (!kind) {
         continue;
@@ -1432,7 +1432,7 @@ function listCandidates(scanDirs) {
       candidates.push({
         path: fullPath,
         kind,
-        displayName: path15.basename(fullPath)
+        displayName: path18.basename(fullPath)
       });
     }
   }
@@ -1458,7 +1458,7 @@ function listHardwareSerialPorts(options = {}) {
   }
   return {
     providerId: SERIAL_HARDWARE_PROVIDER_ID2,
-    platform: os5.platform(),
+    platform: os7.platform(),
     ports: [...byPath.values()].sort((left, right) => left.path.localeCompare(right.path))
   };
 }
@@ -1598,37 +1598,37 @@ __export(hardware_exports, {
   hardwareSerialList: () => hardwareSerialList,
   hardwareSerialProbe: () => hardwareSerialProbe
 });
-import kleur18 from "kleur";
+import kleur19 from "kleur";
 function printSerialPorts(result) {
   if (result.ports.length === 0) {
-    console.log(kleur18.yellow("No local serial devices were discovered."));
+    console.log(kleur19.yellow("No local serial devices were discovered."));
     return;
   }
-  console.log(kleur18.cyan(`Local serial devices (${result.platform}):`));
+  console.log(kleur19.cyan(`Local serial devices (${result.platform}):`));
   for (const port of result.ports) {
-    const status = port.available ? kleur18.green("available") : kleur18.yellow("not ready");
+    const status = port.available ? kleur19.green("available") : kleur19.yellow("not ready");
     console.log(`- ${port.path} (${port.kind}, ${status})`);
   }
 }
 function printProbe(probe) {
-  console.log(kleur18.cyan(`Serial device: ${probe.path}`));
+  console.log(kleur19.cyan(`Serial device: ${probe.path}`));
   console.log(`Exists: ${probe.exists ? "yes" : "no"}`);
   console.log(`Readable: ${probe.readable ? "yes" : "no"}`);
   console.log(`Writable: ${probe.writable ? "yes" : "no"}`);
   console.log(`Character device: ${probe.isCharacterDevice ? "yes" : "no"}`);
-  console.log(`Available: ${probe.available ? kleur18.green("yes") : kleur18.yellow("no")}`);
+  console.log(`Available: ${probe.available ? kleur19.green("yes") : kleur19.yellow("no")}`);
   if (probe.error) {
     console.log(`Detail: ${probe.error}`);
   }
 }
 function printIoOpportunities(result) {
   if (result.opportunities.length === 0) {
-    console.log(kleur18.yellow("No local IO opportunities were discovered."));
+    console.log(kleur19.yellow("No local IO opportunities were discovered."));
     return;
   }
-  console.log(kleur18.cyan(`Local IO opportunities (${result.platform}):`));
+  console.log(kleur19.cyan(`Local IO opportunities (${result.platform}):`));
   for (const opportunity of result.opportunities) {
-    const status = opportunity.available ? kleur18.green("available") : kleur18.yellow("not ready");
+    const status = opportunity.available ? kleur19.green("available") : kleur19.yellow("not ready");
     console.log(`- ${opportunity.title} (${status})`);
     console.log(`  Resource: ${opportunity.resource.path}`);
     const available = opportunity.actions.filter((action) => action.status === "available").map((action) => action.id);
@@ -1642,8 +1642,8 @@ function printIoOpportunities(result) {
   }
 }
 function printIoActionResult(result) {
-  const status = result.ok ? kleur18.green("ok") : kleur18.red("failed");
-  console.log(kleur18.cyan(`Local IO action: ${result.actionId} (${status})`));
+  const status = result.ok ? kleur19.green("ok") : kleur19.red("failed");
+  console.log(kleur19.cyan(`Local IO action: ${result.actionId} (${status})`));
   console.log(result.message);
   if (result.serialProbe) {
     printProbe(result.serialProbe);
@@ -1652,11 +1652,11 @@ function printIoActionResult(result) {
     const exit = result.process.exitCode ?? result.process.signal ?? "unknown";
     console.log(`Process exit: ${exit}`);
     if (result.process.stdout.trim()) {
-      console.log(kleur18.dim("stdout:"));
+      console.log(kleur19.dim("stdout:"));
       console.log(result.process.stdout.trimEnd());
     }
     if (result.process.stderr.trim()) {
-      console.log(kleur18.dim("stderr:"));
+      console.log(kleur19.dim("stderr:"));
       console.log(result.process.stderr.trimEnd());
     }
   }
@@ -1717,9 +1717,9 @@ var init_hardware = __esm({
 
 // src/index.ts
 import { Command, Option } from "commander";
-import { pathToFileURL as pathToFileURL2 } from "node:url";
-import { createRequire as createRequire3 } from "node:module";
-import kleur19 from "kleur";
+import { pathToFileURL as pathToFileURL3 } from "node:url";
+import { createRequire as createRequire4 } from "node:module";
+import kleur20 from "kleur";
 
 // src/runtime.ts
 import { spawn as spawn2, spawnSync } from "node:child_process";
@@ -3672,21 +3672,45 @@ function resolveRequestHost(request) {
 function splitCsv(value) {
   return (value ?? "").split(",").map((entry) => entry.trim().toLowerCase()).filter(Boolean);
 }
+var DEFAULT_HOSTED_GIT_HOST = "git.instafy.dev";
+function hostOfUrl(raw) {
+  if (!raw?.trim()) return null;
+  try {
+    return new URL(raw.trim()).host.toLowerCase() || null;
+  } catch {
+    return null;
+  }
+}
+function configuredGitHosts() {
+  let controllerHost = null;
+  try {
+    controllerHost = hostOfUrl(resolveControllerUrl({ controllerUrl: null }));
+  } catch {
+    controllerHost = null;
+  }
+  return [
+    DEFAULT_HOSTED_GIT_HOST,
+    controllerHost,
+    hostOfUrl(process.env["ORIGIN_GIT_REMOTE_URL"]),
+    ...splitCsv(process.env["INSTAFY_GIT_HOSTS"])
+  ].filter((host) => Boolean(host));
+}
+var LOCAL_STACK_GIT_HOST = /^(?:git-edge|git-shard(?:-[a-z0-9]+)*)$/;
 function isAllowedGitHost(rawHost) {
   if (!rawHost) return false;
   const normalized = normalizeHost(rawHost);
   if (!normalized) return false;
-  const allowHosts = splitCsv(process.env["INSTAFY_GIT_HOSTS"]);
+  const allowHosts = configuredGitHosts();
   if (allowHosts.includes(normalized.host) || allowHosts.includes(normalized.hostname)) {
     return true;
   }
   if (normalized.hostname === "localhost" || normalized.hostname === "127.0.0.1" || normalized.hostname === "::1" || normalized.hostname === "host.docker.internal") {
     return true;
   }
-  if (normalized.hostname === "git-edge" || normalized.hostname.startsWith("git-shard")) {
+  if (LOCAL_STACK_GIT_HOST.test(normalized.hostname)) {
     return true;
   }
-  return normalized.hostname.endsWith(".instafy.dev");
+  return false;
 }
 function normalizeRepoName(raw) {
   const trimmed = raw.trim().replace(/^\/+/, "");
@@ -5028,7 +5052,7 @@ async function credentialsRevoke(options) {
 import fs7 from "node:fs";
 import os4 from "node:os";
 import path8 from "node:path";
-import { spawn as spawn3 } from "node:child_process";
+import { execFileSync, spawn as spawn3 } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import kleur7 from "kleur";
 init_config();
@@ -5075,7 +5099,9 @@ function buildRatholeEnvironment(source = process.env) {
   return environment;
 }
 function cleanUrl(raw) {
-  return raw.replace(/\/+$/, "");
+  let end = raw.length;
+  while (end > 0 && raw[end - 1] === "/") end -= 1;
+  return raw.slice(0, end);
 }
 function normalizeTunnelPurpose(raw) {
   const trimmed = raw.trim();
@@ -5090,7 +5116,11 @@ function normalizeTunnelPurpose(raw) {
       normalized += "_";
     }
   }
-  normalized = normalized.replace(/^_+/, "").replace(/_+$/, "");
+  let start = 0;
+  let end = normalized.length;
+  while (start < end && normalized[start] === "_") start += 1;
+  while (end > start && normalized[end - 1] === "_") end -= 1;
+  normalized = normalized.slice(start, end);
   return normalized ? normalized : null;
 }
 function readEnv(key) {
@@ -5278,6 +5308,71 @@ async function waitForProcessExit(pid, timeoutMs) {
   }
   return !isProcessAlive2(pid);
 }
+function readProcessCommandLine(pid) {
+  if (!isProcessAlive2(pid)) return null;
+  try {
+    if (process.platform === "linux") {
+      const raw = fs7.readFileSync(`/proc/${pid}/cmdline`, "utf8");
+      return raw.split("\0").filter(Boolean).join(" ") || null;
+    }
+    if (process.platform === "win32") {
+      const out2 = execFileSync(
+        "powershell.exe",
+        [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `(Get-CimInstance Win32_Process -Filter 'ProcessId=${Math.trunc(pid)}').CommandLine`
+        ],
+        { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 1e4, windowsHide: true }
+      );
+      return out2.trim() || null;
+    }
+    const out = execFileSync("ps", ["-ww", "-o", "command=", "-p", String(Math.trunc(pid))], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5e3
+    });
+    return out.trim() || null;
+  } catch {
+    return null;
+  }
+}
+function isRatholeClientFor(pid, configPath2, binary) {
+  if (!configPath2) return false;
+  const commandLine = readProcessCommandLine(pid);
+  return commandLine !== null && commandLineIsRatholeClient(commandLine, configPath2, binary);
+}
+function endsWithProgram(program2, binary) {
+  if (program2 === binary) return true;
+  if (!program2.endsWith(binary)) return false;
+  const before = program2[program2.length - binary.length - 1];
+  return before === " " || before === "/" || before === "\\";
+}
+function commandLineIsRatholeClient(commandLine, configPath2, binary) {
+  if (!configPath2) return false;
+  const line = commandLine.split('"').join("").trim();
+  const tail = ` -c ${configPath2}`;
+  if (!line.endsWith(tail)) return false;
+  const program2 = line.slice(0, line.length - tail.length).trimEnd();
+  if (!program2) return false;
+  if (binary && endsWithProgram(program2, binary)) return true;
+  const name = program2.split(/[\\/]/).pop() ?? "";
+  return name.toLowerCase().includes("rathole");
+}
+async function stopRatholeClient(pid, configPath2, binary) {
+  if (!isRatholeClientFor(pid, configPath2, binary)) return;
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch {
+  }
+  if (await waitForProcessExit(pid, 4e3)) return;
+  if (!isRatholeClientFor(pid, configPath2, binary)) return;
+  try {
+    process.kill(pid, "SIGKILL");
+  } catch {
+  }
+}
 function upsertTunnelState(entry) {
   const state = readStateFile();
   const next = state.tunnels.filter((tunnel) => tunnel.tunnelId !== entry.tunnelId);
@@ -5367,8 +5462,19 @@ async function revokeTunnel(controllerUrl, auth, projectId2, tunnelId) {
     throw new Error(`Tunnel revoke failed (${response.status} ${response.statusText}): ${text2}`);
   }
 }
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+function resolveTunnelServerAddress(server, env = process.env, inContainer = fs7.existsSync("/.dockerenv")) {
+  const match = /^(\[[^\]]+\]|[^:]+):(\d+)$/.exec(server.trim());
+  if (!match) return server;
+  const [, host, port] = match;
+  const override = env["INSTAFY_TUNNEL_SERVER_HOST"]?.trim();
+  if (override) return `${override}:${port}`;
+  if (inContainer && LOOPBACK_HOSTS.has(host.toLowerCase())) return `host.docker.internal:${port}`;
+  return server;
+}
 function buildRatholeConfig(creds, port) {
-  const server = typeof creds["server"] === "string" ? creds["server"] : null;
+  const advertised = typeof creds["server"] === "string" ? creds["server"] : null;
+  const server = advertised ? resolveTunnelServerAddress(advertised) : null;
   const token = typeof creds["token"] === "string" ? creds["token"] : null;
   const service = typeof creds["service"] === "string" && creds["service"] || typeof creds["serviceName"] === "string" && creds["serviceName"] || "runtime";
   const protocol = typeof creds["protocol"] === "string" && creds["protocol"] || "tcp";
@@ -5471,6 +5577,40 @@ async function runTunnelCommand(opts, options) {
     process.once("SIGTERM", handle);
   });
 }
+async function spawnRatholeDetached(params) {
+  const logFd = fs7.openSync(params.logFile, "a");
+  const child = spawn3(params.rathole, ["-c", params.configPath], {
+    stdio: ["ignore", logFd, logFd],
+    cwd: params.workdir,
+    detached: true,
+    env: buildRatholeEnvironment()
+  });
+  fs7.closeSync(logFd);
+  let exitedEarly = false;
+  let exitMessage = "";
+  child.on("error", (error) => {
+    exitedEarly = true;
+    exitMessage = error.message;
+  });
+  child.on("exit", (code, signal) => {
+    exitedEarly = true;
+    exitMessage = code !== null ? `code ${code}` : `signal ${signal}`;
+  });
+  await new Promise((resolve) => setTimeout(resolve, 250));
+  if (exitedEarly || !isProcessAlive2(child.pid ?? -1)) {
+    return { pid: -1, exit: exitMessage || "unknown", logTail: readLogTail(params.logFile) };
+  }
+  child.unref();
+  return { pid: child.pid ?? -1, exit: null, logTail: "" };
+}
+function readLogTail(logFile, lines = 20) {
+  try {
+    const text2 = fs7.readFileSync(logFile, "utf8");
+    return text2.split(/\r?\n/).filter(Boolean).slice(-lines).join("\n");
+  } catch {
+    return "";
+  }
+}
 async function startTunnelDetached(opts) {
   const projectId2 = resolveProject(opts);
   const controllerToken = resolveControllerToken(opts);
@@ -5505,39 +5645,16 @@ async function startTunnelDetached(opts) {
   const configPath2 = path8.join(workdir, "rathole.toml");
   fs7.writeFileSync(configPath2, configBody, { encoding: "utf8", mode: 384 });
   const logFile = opts.logFile?.trim() ? path8.resolve(opts.logFile.trim()) : path8.join(TUNNEL_LOG_DIR, `tunnel-${tunnelIdSafe}.log`);
-  const logFd = fs7.openSync(logFile, "a");
-  const child = spawn3(rathole, ["-c", configPath2], {
-    stdio: ["ignore", logFd, logFd],
-    cwd: workdir,
-    detached: true,
-    env: buildRatholeEnvironment()
-  });
-  let exitedEarly = false;
-  let exitMessage = "";
-  child.on("exit", (code, signal) => {
-    exitedEarly = true;
-    exitMessage = code !== null ? `code ${code}` : `signal ${signal}`;
-  });
-  await new Promise((resolve) => setTimeout(resolve, 250));
-  if (exitedEarly || !isProcessAlive2(child.pid ?? -1)) {
-    const logTail = (() => {
-      try {
-        const text2 = fs7.readFileSync(logFile, "utf8");
-        const lines = text2.split(/\r?\n/).filter(Boolean);
-        return lines.slice(-20).join("\n");
-      } catch {
-        return "";
-      }
-    })();
+  const started = await spawnRatholeDetached({ rathole, configPath: configPath2, workdir, logFile });
+  if (started.exit !== null) {
     await revokeTunnel(controllerUrl, controllerToken, projectId2, grant.tunnelId).catch(() => {
     });
-    const suffix = logTail ? `
+    const suffix = started.logTail ? `
 
 Last logs:
-${logTail}` : "";
-    throw new Error(`Tunnel process exited (${exitMessage || "unknown"}).${suffix}`);
+${started.logTail}` : "";
+    throw new Error(`Tunnel process exited (${started.exit}).${suffix}`);
   }
-  child.unref();
   const entry = {
     tunnelId: grant.tunnelId,
     projectId: projectId2,
@@ -5545,10 +5662,11 @@ ${logTail}` : "";
     url: grant.url ?? `https://${grant.hostname}`,
     localPort: port,
     controllerUrl: cleanUrl(controllerUrl),
-    pid: child.pid ?? -1,
+    pid: started.pid,
     logFile,
     workdir,
-    startedAt: (/* @__PURE__ */ new Date()).toISOString()
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    binary: rathole
   };
   upsertTunnelState(entry);
   return entry;
@@ -5573,19 +5691,7 @@ async function stopTunnelSession(opts) {
   if (!entry) {
     throw new Error(`Tunnel not found in local state: ${tunnelId}`);
   }
-  if (isProcessAlive2(entry.pid)) {
-    try {
-      process.kill(entry.pid, "SIGTERM");
-    } catch {
-    }
-    const stopped = await waitForProcessExit(entry.pid, 4e3);
-    if (!stopped) {
-      try {
-        process.kill(entry.pid, "SIGKILL");
-      } catch {
-      }
-    }
-  }
+  await stopRatholeClient(entry.pid, path8.join(entry.workdir, "rathole.toml"), entry.binary);
   const controllerToken = resolveControllerToken(opts, `instafy tunnel stop ${tunnelId}`);
   if (controllerToken.runtimeControllerUrl) {
     try {
@@ -5643,30 +5749,1111 @@ async function tailTunnelLogs(options) {
     console.log(tail.join("\n"));
     return;
   }
-  const child = process.platform === "win32" ? spawn3(
-    "powershell.exe",
-    [
-      "-NoProfile",
-      "-Command",
-      `Get-Content -LiteralPath '${logFile.replace(/'/g, "''")}' -Tail ${lineCount} -Wait`
-    ],
-    { stdio: "inherit" }
-  ) : spawn3("tail", ["-n", String(lineCount), "-f", logFile], { stdio: "inherit" });
-  const handleExit = () => {
-    try {
-      child.kill("SIGTERM");
-    } catch {
-    }
-  };
-  process.once("SIGINT", handleExit);
-  process.once("SIGTERM", handleExit);
-  await new Promise((resolve) => child.on("exit", () => resolve()));
+  const child = process.platform === "win32" ? spawn3(
+    "powershell.exe",
+    [
+      "-NoProfile",
+      "-Command",
+      `Get-Content -LiteralPath '${logFile.replace(/'/g, "''")}' -Tail ${lineCount} -Wait`
+    ],
+    { stdio: "inherit" }
+  ) : spawn3("tail", ["-n", String(lineCount), "-f", logFile], { stdio: "inherit" });
+  const handleExit = () => {
+    try {
+      child.kill("SIGTERM");
+    } catch {
+    }
+  };
+  process.once("SIGINT", handleExit);
+  process.once("SIGTERM", handleExit);
+  await new Promise((resolve) => child.on("exit", () => resolve()));
+}
+
+// src/preview.ts
+import { spawn as spawn5 } from "node:child_process";
+import fs9 from "node:fs";
+import os5 from "node:os";
+import path10 from "node:path";
+import kleur8 from "kleur";
+
+// src/bind.ts
+import { spawn as spawn4 } from "node:child_process";
+import fs8 from "node:fs";
+import path9 from "node:path";
+import { fileURLToPath as fileURLToPath2, pathToFileURL } from "node:url";
+var BIN_REL = path9.join("bin", "instafy-bind.mjs");
+function resolveBindBin(env = process.env) {
+  const fromEnv = env.INSTAFY_BIND_BIN?.trim();
+  if (fromEnv) return fs8.existsSync(fromEnv) ? path9.resolve(fromEnv) : null;
+  const here = path9.dirname(fileURLToPath2(import.meta.url));
+  for (const candidate of [path9.join(here, "bind", BIN_REL), path9.resolve(here, "..", "..", "instafy-bind", BIN_REL)]) {
+    if (fs8.existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+function bundledBindRoot() {
+  const here = path9.dirname(fileURLToPath2(import.meta.url));
+  for (const candidate of [path9.join(here, "bind"), path9.resolve(here, "..", "..", "instafy-bind")]) {
+    if (fs8.existsSync(path9.join(candidate, BIN_REL))) return candidate;
+  }
+  return null;
+}
+async function loadCredentialFreeEnv() {
+  const root = bundledBindRoot();
+  const file = root ? path9.join(root, "src", "detached-env.mjs") : null;
+  if (!file || !fs8.existsSync(file)) {
+    throw new Error("the bundled binder (dist/bind) was not found, so a site cannot be started without credentials; rebuild the CLI");
+  }
+  const module = await import(pathToFileURL(file).href);
+  if (typeof module.credentialFreeEnv !== "function") {
+    throw new Error(`${file} does not export credentialFreeEnv; rebuild the CLI`);
+  }
+  return module.credentialFreeEnv;
+}
+function runBind(args) {
+  const bin = resolveBindBin();
+  if (!bin) {
+    process.stderr.write(
+      "instafy bind: the bundled binder (dist/bind) was not found; rebuild the CLI, or set INSTAFY_BIND_BIN to packages/instafy-bind/bin/instafy-bind.mjs, or run it directly: node packages/instafy-bind/bin/instafy-bind.mjs <command>\n"
+    );
+    return Promise.resolve(1);
+  }
+  return new Promise((resolve) => {
+    const child = spawn4(process.execPath, [bin, ...args], { stdio: "inherit", env: process.env });
+    const forward = (signal) => {
+      if (!child.killed) child.kill(signal);
+    };
+    process.on("SIGINT", forward);
+    process.on("SIGTERM", forward);
+    child.on("error", (error) => {
+      process.stderr.write(`instafy bind: ${error.message}
+`);
+      resolve(1);
+    });
+    child.on("exit", (code, signal) => {
+      process.off("SIGINT", forward);
+      process.off("SIGTERM", forward);
+      resolve(code ?? (signal ? 130 : 1));
+    });
+  });
+}
+
+// src/preview.ts
+init_controller_fetch();
+init_errors();
+
+// src/local-site.ts
+import http2 from "node:http";
+var PREVIEW_EXIT_NOT_LISTENING = 2;
+var PREVIEW_EXIT_PORT_NOT_ALLOWED = 3;
+var PreviewCommandError = class extends Error {
+  constructor(message, exitCode) {
+    super(message);
+    this.exitCode = exitCode;
+  }
+};
+var RESERVED_PORTS = [
+  { env: "INSTAFY_VNC_PORT", kind: "port", port: 5900 },
+  { env: "INSTAFY_PROVIDER_HOST_URL", kind: "url", port: 8789 },
+  { env: "PROXY_BASE_URL", kind: "url", port: 8789 },
+  { port: 9222 },
+  { env: "INSTAFY_PLAYWRIGHT_CDP_PORT", kind: "port", port: 9223 },
+  { env: "INSTAFY_PLAYWRIGHT_CDP_URL", kind: "url", port: 9223 },
+  { port: 9225 },
+  { env: "INSTAFY_BROWSER_EGRESS_PROXY_BIND", kind: "bind", port: 9226 },
+  { env: "INSTAFY_PERSONAL_BROWSER_CONTROL_URL", kind: "url", port: 43127 },
+  { env: "ORIGIN_BIND_PORT", kind: "port", port: 54332 }
+];
+var PREVIEW_DENY_PORTS_ENV = "INSTAFY_PREVIEW_DENY_PORTS";
+var MIN_PREVIEW_PORT = 1024;
+var MAX_PREVIEW_PORT = 65535;
+var PROBE_TIMEOUT_MS = 5e3;
+function portNumber(raw) {
+  if (!/^\d{1,5}$/.test(raw)) return null;
+  const port = Number(raw);
+  return port >= 1 && port <= MAX_PREVIEW_PORT ? port : null;
+}
+function portFromSetting(kind, raw) {
+  const value = raw.trim();
+  if (!value) return null;
+  if (kind === "port") return portNumber(value);
+  if (kind === "bind") return portNumber(value.slice(value.lastIndexOf(":") + 1));
+  try {
+    const url = new URL(value);
+    return portNumber(url.port || (url.protocol === "https:" ? "443" : url.protocol === "http:" ? "80" : ""));
+  } catch {
+    return null;
+  }
+}
+function reservedPreviewPorts(env = process.env) {
+  const denied = /* @__PURE__ */ new Set();
+  for (const entry of RESERVED_PORTS) {
+    denied.add(entry.port);
+    const raw = entry.env ? env[entry.env] : void 0;
+    const port = entry.kind && raw ? portFromSetting(entry.kind, raw) : null;
+    if (port !== null) denied.add(port);
+  }
+  for (const raw of (env[PREVIEW_DENY_PORTS_ENV] ?? "").split(",")) {
+    if (!raw.trim()) continue;
+    const port = portNumber(raw.trim());
+    if (port === null) {
+      throw new PreviewCommandError(
+        `${PREVIEW_DENY_PORTS_ENV} has an entry that is not a port (${JSON.stringify(raw.trim().slice(0, 20))}), so no port is allowed until it is fixed.`,
+        PREVIEW_EXIT_PORT_NOT_ALLOWED
+      );
+    }
+    denied.add(port);
+  }
+  return denied;
+}
+function parsePreviewPort(raw, env = process.env) {
+  const value = typeof raw === "number" ? raw : Number(String(raw ?? "").trim());
+  if (!Number.isInteger(value) || value < MIN_PREVIEW_PORT || value > MAX_PREVIEW_PORT) {
+    throw new PreviewCommandError(
+      `Port must be a number from ${MIN_PREVIEW_PORT} to ${MAX_PREVIEW_PORT}.`,
+      PREVIEW_EXIT_PORT_NOT_ALLOWED
+    );
+  }
+  if (reservedPreviewPorts(env).has(value)) {
+    throw new PreviewCommandError(
+      `Port ${value} is reserved for Instafy and cannot be previewed. Serve the site on another port.`,
+      PREVIEW_EXIT_PORT_NOT_ALLOWED
+    );
+  }
+  return value;
+}
+function noAnswerMessage(port, probe, where, retry) {
+  if (probe.timedOut) {
+    return `A server accepted the connection on port ${port} but did not answer (${probe.reason ?? "no answer"}). It may still be starting or compiling: do not start a second server; wait for it, then ${retry}.`;
+  }
+  return `Nothing is answering on ${where} (${probe.reason ?? "no answer"}). Start the site first, then ${retry}.`;
+}
+var LOOPBACK_HOSTS2 = ["127.0.0.1", "::1"];
+function urlHost(host) {
+  return host.includes(":") ? `[${host}]` : host;
+}
+function probeHost(host, port, sitePath, timeoutMs) {
+  return new Promise((resolve) => {
+    const request = http2.get({ host, port, path: sitePath, agent: false, timeout: timeoutMs }, (response) => {
+      const status = response.statusCode ?? 0;
+      response.resume();
+      request.destroy();
+      resolve({ listening: status > 0 && status < 500, status, reason: `HTTP ${status}`, host: urlHost(host) });
+    });
+    request.on("timeout", () => {
+      request.destroy();
+      resolve({ listening: false, status: null, reason: `no answer within ${timeoutMs / 1e3} s`, host: null, code: "TIMEOUT" });
+    });
+    request.on("error", (error) => {
+      const code = error.code;
+      resolve({ listening: false, status: null, reason: code ?? error.message, host: null, code });
+    });
+  });
+}
+async function probeLocalSite(port, sitePath, timeoutMs = PROBE_TIMEOUT_MS, hosts = LOOPBACK_HOSTS2) {
+  const tried = [];
+  let last = { listening: false, status: null, reason: "no answer", host: null };
+  for (const host of hosts) {
+    const { code, ...result } = await probeHost(host, port, sitePath, timeoutMs);
+    if (result.status !== null) return result;
+    tried.push(`${urlHost(host)}: ${result.reason}`);
+    last = { ...result, reason: tried.join(", ") };
+    if (code === "TIMEOUT") return { ...last, timedOut: true };
+  }
+  return last;
+}
+
+// src/preview.ts
+var PREVIEW_EXIT_UNAVAILABLE = 5;
+var PREVIEWS_UNAVAILABLE_MESSAGE = "Previews are not available on this server";
+var RATHOLE_LOCAL_HOSTS = ["127.0.0.1"];
+var MAX_TITLE_LENGTH = 120;
+var MAX_PATH_LENGTH = 512;
+var STATE_LOCK_WAIT_MS = 12e4;
+var STATE_LOCK_STALE_MS = 10 * 6e4;
+function instafyDir() {
+  return path10.join(os5.homedir(), ".instafy");
+}
+function previewStateFile() {
+  return path10.join(instafyDir(), "cli-preview-state.json");
+}
+function previewStateLockFile() {
+  return path10.join(instafyDir(), "cli-preview-state.lock");
+}
+function workdirsRoot() {
+  return path10.join(instafyDir(), "cli-preview-workdirs");
+}
+function workdirFor(previewId) {
+  return path10.join(workdirsRoot(), safePathSegment2(previewId));
+}
+var HOST_SUFFIX_RE = /^[a-z0-9-]+(?:\.[a-z0-9-]+)*(?::\d{1,5})?$/;
+function parseViewerHostSuffix(raw) {
+  if (typeof raw !== "string") return void 0;
+  const suffix = raw.trim().toLowerCase();
+  return suffix.length <= 253 && HOST_SUFFIX_RE.test(suffix) ? suffix : void 0;
+}
+function parseStudioOrigin(raw) {
+  if (typeof raw !== "string" || raw.length > 300) return void 0;
+  let url;
+  try {
+    url = new URL(raw.trim());
+  } catch {
+    return void 0;
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") return void 0;
+  if (url.username || url.password || url.search || url.hash || url.pathname !== "/" && url.pathname !== "") return void 0;
+  return url.origin;
+}
+var CONTROL_CHARS_RE = /[\u0000-\u001f\u007f-\u009f]/;
+function parsePreviewTitle(raw) {
+  const title = (raw ?? "").replace(/\s+/g, " ").trim();
+  if (!title) {
+    throw new Error('A title is required: --title "<name>".');
+  }
+  if ([...title].length > MAX_TITLE_LENGTH) {
+    throw new Error(`Title must be at most ${MAX_TITLE_LENGTH} characters.`);
+  }
+  if (CONTROL_CHARS_RE.test(title)) {
+    throw new Error("Title must not contain control characters.");
+  }
+  return title;
+}
+function parsePreviewPath(raw) {
+  const value = raw?.trim() || "/";
+  let printable = true;
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code < 33 || code > 126 || code === 92 || code === 35) {
+      printable = false;
+      break;
+    }
+  }
+  if (!value.startsWith("/") || value.startsWith("//") || value.length > MAX_PATH_LENGTH || !printable) {
+    throw new Error(
+      `Path must start with / (not //) and be at most ${MAX_PATH_LENGTH} printable ASCII characters with no spaces, backslashes or #.`
+    );
+  }
+  return value;
+}
+function readStateFile2() {
+  try {
+    const parsed = JSON.parse(fs9.readFileSync(previewStateFile(), "utf8"));
+    if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.previews)) {
+      return { version: 1, previews: [] };
+    }
+    return { version: 1, previews: parsed.previews.filter(Boolean) };
+  } catch {
+    return { version: 1, previews: [] };
+  }
+}
+function writeStateFile2(state) {
+  fs9.mkdirSync(instafyDir(), { recursive: true });
+  fs9.writeFileSync(previewStateFile(), JSON.stringify(state, null, 2), { encoding: "utf8", mode: 384 });
+}
+function upsertPreviewState(entry) {
+  const state = readStateFile2();
+  const next = state.previews.filter((preview) => preview.previewId !== entry.previewId);
+  next.unshift(entry);
+  writeStateFile2({ version: 1, previews: next });
+}
+function removePreviewState(previewId) {
+  const state = readStateFile2();
+  const existing = state.previews.find((preview) => preview.previewId === previewId) ?? null;
+  writeStateFile2({ version: 1, previews: state.previews.filter((preview) => preview.previewId !== previewId) });
+  return existing;
+}
+function removeWorkdir(previewId) {
+  fs9.rmSync(workdirFor(previewId), { recursive: true, force: true });
+}
+function forgetPreview(previewId) {
+  const entry = removePreviewState(previewId);
+  removeWorkdir(previewId);
+  return entry;
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function lockHolderIsGone(lockFile) {
+  try {
+    const stat = fs9.statSync(lockFile);
+    if (Date.now() - stat.mtimeMs > STATE_LOCK_STALE_MS) return true;
+    const pid = Number.parseInt(fs9.readFileSync(lockFile, "utf8").trim(), 10);
+    if (!Number.isInteger(pid) || pid <= 0) return Date.now() - stat.mtimeMs > 5e3;
+    try {
+      process.kill(pid, 0);
+      return false;
+    } catch (error) {
+      return error.code === "ESRCH";
+    }
+  } catch {
+    return false;
+  }
+}
+async function withStateLock(fn) {
+  const lockFile = previewStateLockFile();
+  fs9.mkdirSync(instafyDir(), { recursive: true });
+  const deadline = Date.now() + STATE_LOCK_WAIT_MS;
+  for (; ; ) {
+    try {
+      const fd = fs9.openSync(lockFile, "wx", 384);
+      fs9.writeSync(fd, String(process.pid));
+      fs9.closeSync(fd);
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (lockHolderIsGone(lockFile)) {
+        fs9.rmSync(lockFile, { force: true });
+        continue;
+      }
+      if (Date.now() > deadline) {
+        throw new Error("Another instafy preview command on this machine is still running. Retry when it is done.");
+      }
+      await sleep(100);
+    }
+  }
+  try {
+    return await fn();
+  } finally {
+    fs9.rmSync(lockFile, { force: true });
+  }
+}
+function configPathFor(workdir) {
+  return path10.join(workdir, "rathole.toml");
+}
+async function stopClient(entry) {
+  await stopRatholeClient(entry.pid, configPathFor(entry.workdir), entry.binary);
+}
+function shellQuote2(value) {
+  return `'${value.split("'").join(`'\\''`)}'`;
+}
+function safePathSegment2(value) {
+  return value.trim().replace(/[^a-zA-Z0-9._-]/g, "_") || "preview";
+}
+function stringField(record2, ...keys) {
+  for (const key of keys) {
+    const value = record2[key];
+    if (typeof value === "string" && value.trim()) return value;
+  }
+  return null;
+}
+function numberField(record2, ...keys) {
+  for (const key of keys) {
+    const value = record2[key];
+    if (typeof value === "number" && Number.isFinite(value)) return value;
+  }
+  return null;
+}
+function previewsUnavailable() {
+  return new PreviewCommandError(`${PREVIEWS_UNAVAILABLE_MESSAGE}.`, PREVIEW_EXIT_UNAVAILABLE);
+}
+async function controllerRequest(params) {
+  const { response } = await fetchWithControllerAuth({
+    url: `${cleanUrl(params.controllerUrl)}${params.route}`,
+    init: {
+      method: params.method,
+      headers: {
+        accept: "application/json",
+        ...params.body === void 0 ? {} : { "content-type": "application/json" }
+      },
+      body: params.body === void 0 ? void 0 : JSON.stringify(params.body)
+    },
+    accessToken: params.auth.token,
+    tokenSource: params.auth.source,
+    profile: params.auth.profile,
+    cwd: process.cwd()
+  });
+  const text2 = await response.text().catch(() => "");
+  if (!response.ok) {
+    const code = errorCode(text2);
+    if (response.status === 503 && code === "previews_unavailable" || response.status === 404 && params.notFoundMeansUnavailable && !isStructuredError(text2)) {
+      throw previewsUnavailable();
+    }
+    if (response.status === 401 || response.status === 403) {
+      throw formatAuthRejectedError({
+        status: response.status,
+        responseBody: text2,
+        retryCommand: params.retryCommand
+      });
+    }
+    if (response.status === 400 && code === "port_not_allowed") {
+      throw new PreviewCommandError(
+        `The server does not allow previews on this port: ${extractControllerErrorMessage(text2) ?? "port_not_allowed"}`,
+        PREVIEW_EXIT_PORT_NOT_ALLOWED
+      );
+    }
+    const message = extractControllerErrorMessage(text2) ?? response.statusText;
+    throw new Error(`Preview request failed (${response.status}): ${message}`);
+  }
+  if (!text2.trim()) return { status: response.status, body: null };
+  try {
+    return { status: response.status, body: JSON.parse(text2) };
+  } catch {
+    throw new Error(`Preview request returned invalid JSON (${response.status}).`);
+  }
+}
+function isStructuredError(body) {
+  try {
+    const parsed = JSON.parse(body);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return false;
+    const record2 = parsed;
+    return ["message", "code", "error"].some((key) => typeof record2[key] === "string" && String(record2[key]).trim() !== "");
+  } catch {
+    return false;
+  }
+}
+function errorCode(body) {
+  try {
+    const parsed = JSON.parse(body);
+    for (const key of ["code", "error"]) {
+      const value = parsed?.[key];
+      if (typeof value === "string" && /^[a-z0-9_]{1,64}$/.test(value)) return value;
+    }
+  } catch {
+  }
+  return null;
+}
+function resolveAuth(opts, retryCommand) {
+  const auth = resolveControllerToken({ controllerToken: opts.controllerToken }, retryCommand);
+  const controllerUrl = resolveTunnelControllerUrl({ controllerUrl: opts.controllerUrl }, auth);
+  return { auth, controllerUrl };
+}
+function previewsRoute(projectId2, previewId, action) {
+  const base = `/projects/${encodeURIComponent(projectId2)}/previews`;
+  if (!previewId) return base;
+  return `${base}/${encodeURIComponent(previewId)}${action ? `/${action}` : ""}`;
+}
+async function closePreviewOnServer(controllerUrl, auth, projectId2, previewId) {
+  await controllerRequest({
+    controllerUrl,
+    auth,
+    method: "POST",
+    route: previewsRoute(projectId2, previewId, "close"),
+    body: {},
+    retryCommand: `instafy preview close ${previewId}`
+  });
+}
+async function resolveRathole(ratholeBin, log) {
+  if (ratholeBin) {
+    process.env.RATHOLE_BIN = ratholeBin;
+  }
+  const rathole = await resolveRatholeBinaryForCli({
+    env: process.env,
+    version: process.env.RATHOLE_VERSION ?? null,
+    cacheDir: process.env.RATHOLE_CACHE_DIR ?? null,
+    logger: (message) => log(`[rathole] ${message}`),
+    warn: (message) => console.error(kleur8.yellow(message))
+  });
+  if (!rathole) {
+    throw new Error("rathole is required to open a preview. Set RATHOLE_BIN or ensure it is on PATH.");
+  }
+  return rathole;
+}
+function readFileOrNull(file) {
+  try {
+    return fs9.readFileSync(file, "utf8");
+  } catch {
+    return null;
+  }
+}
+function readyHealth(readyBody) {
+  return readyBody["health"] && typeof readyBody["health"] === "object" && !Array.isArray(readyBody["health"]) ? readyBody["health"] : null;
+}
+function previewStatusFromHealth(readyBody) {
+  const health = readyHealth(readyBody);
+  if (health?.["listening"] === true) return "live";
+  if (health?.["listening"] === false) return "not_responding";
+  return "unknown";
+}
+function previewHttpStatusFromHealth(readyBody) {
+  const status = readyHealth(readyBody)?.["status"];
+  return typeof status === "number" && Number.isInteger(status) && status >= 100 && status <= 599 ? status : null;
+}
+async function notListeningError(port, sitePath, probe) {
+  const where = `http://127.0.0.1:${port}${sitePath}`;
+  if (probe.status !== null) {
+    return new PreviewCommandError(
+      `The site at ${where} answered HTTP ${probe.status}. Fix the server error, then retry.`,
+      PREVIEW_EXIT_NOT_LISTENING
+    );
+  }
+  if (probe.timedOut) {
+    return new PreviewCommandError(noAnswerMessage(port, probe, where, "retry"), PREVIEW_EXIT_NOT_LISTENING);
+  }
+  const ipv6 = await probeLocalSite(port, sitePath, void 0, ["::1"]);
+  if (ipv6.status !== null) {
+    return new PreviewCommandError(
+      `The site answers only on [::1]:${port}, and the preview reaches it on 127.0.0.1. It is running: do not start it again. Bind it to 127.0.0.1 or 0.0.0.0 instead (for example --host 127.0.0.1), restart it, then retry.`,
+      PREVIEW_EXIT_NOT_LISTENING
+    );
+  }
+  return new PreviewCommandError(noAnswerMessage(port, probe, where, "retry"), PREVIEW_EXIT_NOT_LISTENING);
+}
+var SERVE_MAX_ARGS = 64;
+var SERVE_MAX_ARG_LENGTH = 2048;
+var EPHEMERAL_PREFIXES = ["/tmp/", "/var/tmp/", "/dev/shm/", "/run/"];
+function parseServeCommand(raw) {
+  const argv = [];
+  let current = "";
+  let inWord = false;
+  let quote = null;
+  const text2 = String(raw ?? "");
+  for (let index = 0; index < text2.length; index += 1) {
+    const ch = text2[index];
+    if (quote === "'") {
+      if (ch === "'") quote = null;
+      else current += ch;
+      continue;
+    }
+    if (quote === '"') {
+      if (ch === '"') {
+        quote = null;
+      } else if (ch === "\\" && index + 1 < text2.length && '"\\$`'.includes(text2[index + 1])) {
+        current += text2[index + 1];
+        index += 1;
+      } else if (ch === "$" || ch === "`") {
+        throw new Error(`--serve-cmd takes one command and its arguments, not shell syntax (found ${ch} in quotes).`);
+      } else {
+        current += ch;
+      }
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      inWord = true;
+      continue;
+    }
+    if (ch === "\\") {
+      if (index + 1 >= text2.length) throw new Error("--serve-cmd ends with a lone backslash.");
+      current += text2[index + 1];
+      index += 1;
+      inWord = true;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (ch === "\n" || ch === "\r") {
+        throw new Error("--serve-cmd takes one command on one line.");
+      }
+      if (inWord) {
+        argv.push(current);
+        current = "";
+        inWord = false;
+      }
+      continue;
+    }
+    if ("|&;<>()$`".includes(ch)) {
+      throw new Error(
+        `--serve-cmd takes one command and its arguments, not shell syntax (found ${ch}). Put a pipeline or several commands in a script and pass the script.`
+      );
+    }
+    current += ch;
+    inWord = true;
+  }
+  if (quote) throw new Error("--serve-cmd has an unterminated quote.");
+  if (inWord) argv.push(current);
+  if (argv.length === 0) throw new Error("--serve-cmd is empty.");
+  if (argv.length > SERVE_MAX_ARGS || argv.some((arg) => arg.length > SERVE_MAX_ARG_LENGTH || arg.includes("\0"))) {
+    throw new Error(`--serve-cmd must have at most ${SERVE_MAX_ARGS} arguments of at most ${SERVE_MAX_ARG_LENGTH} characters.`);
+  }
+  return argv;
+}
+function realDir(dir) {
+  try {
+    const resolved = fs9.realpathSync(dir);
+    return fs9.statSync(resolved).isDirectory() ? resolved : null;
+  } catch {
+    return null;
+  }
+}
+function resolveWorkspaceRoot(env, projectId2) {
+  const explicit = env["WORKSPACE_PROJECT_DIR"]?.trim();
+  if (explicit) return realDir(explicit);
+  const base = env["WORKSPACE_DIR"]?.trim();
+  if (!base || !projectId2) return null;
+  return realDir(path10.join(base, projectId2));
+}
+function workspaceRelativeDir(root, dir) {
+  const resolved = realDir(dir);
+  if (!resolved) return null;
+  const relative = path10.relative(root, resolved);
+  if (relative === "") return ".";
+  if (relative.startsWith("..") || path10.isAbsolute(relative)) return null;
+  return relative.split(path10.sep).join("/");
+}
+function listeningSocketInodes(procRoot, port) {
+  const inodes = /* @__PURE__ */ new Set();
+  for (const table of ["net/tcp", "net/tcp6"]) {
+    let text2 = "";
+    try {
+      text2 = fs9.readFileSync(path10.join(procRoot, table), "utf8");
+    } catch {
+      continue;
+    }
+    for (const line of text2.split("\n").slice(1)) {
+      const fields = line.trim().split(/\s+/);
+      if (fields.length < 10) continue;
+      const local = fields[1] ?? "";
+      const portHex = local.slice(local.lastIndexOf(":") + 1);
+      if (fields[3] === "0A" && Number.parseInt(portHex, 16) === port && fields[9] !== "0") {
+        inodes.add(fields[9]);
+      }
+    }
+  }
+  return inodes;
+}
+function detectListeningProcess(port, procRoot = "/proc") {
+  const inodes = listeningSocketInodes(procRoot, port);
+  if (inodes.size === 0) return null;
+  let pids = [];
+  try {
+    pids = fs9.readdirSync(procRoot).filter((name) => /^\d+$/.test(name)).map(Number).sort((a, b) => a - b);
+  } catch {
+    return null;
+  }
+  for (const pid of pids) {
+    let fds = [];
+    try {
+      fds = fs9.readdirSync(path10.join(procRoot, String(pid), "fd"));
+    } catch {
+      continue;
+    }
+    const holds = fds.some((fd) => {
+      try {
+        const target = fs9.readlinkSync(path10.join(procRoot, String(pid), "fd", fd));
+        const match = /^socket:\[(\d+)\]$/.exec(target);
+        return Boolean(match && inodes.has(match[1]));
+      } catch {
+        return false;
+      }
+    });
+    if (!holds) continue;
+    try {
+      const argv = fs9.readFileSync(path10.join(procRoot, String(pid), "cmdline"), "utf8").split("\0");
+      while (argv.length > 0 && argv[argv.length - 1] === "") argv.pop();
+      const cwd = fs9.readlinkSync(path10.join(procRoot, String(pid), "cwd"));
+      if (argv.length === 0) continue;
+      return { pid, argv, cwd };
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+var SECRET_FLAG = /^-{1,2}(?!-|no-)[\w.-]*(token|secret|passw(or)?d|passwd|api[-_]?key|access[-_]?key|private[-_]?key|credentials?|auth(?![a-z]))[\w.-]*$/i;
+var SECRET_ENV = /^(?=[A-Za-z_])\w*(TOKEN|SECRET|PASSWORD|PASSWD|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|CREDENTIALS?)[\w]*=./i;
+var SECRET_VALUE = /^(sk|pk|rk)[-_][A-Za-z0-9_-]{12,}|^gh[pousr]_[A-Za-z0-9]{20,}|^xox[abposr]-|^AKIA[0-9A-Z]{12,}|^eyJ[A-Za-z0-9_-]{20,}\./;
+var URL_USERINFO = /^[a-z][a-z0-9+.-]*:\/\/[^/\s@]*:[^/\s@]*@/i;
+function secretInServeCommand(argv) {
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    const eq = arg.indexOf("=");
+    const flag = arg.startsWith("-") ? eq > 0 ? arg.slice(0, eq) : arg : null;
+    if (flag && SECRET_FLAG.test(flag)) {
+      const value = eq > 0 ? arg.slice(eq + 1) : argv[i + 1];
+      if (value && !value.startsWith("-")) return flag;
+    }
+    if (SECRET_ENV.test(arg)) return arg.slice(0, arg.indexOf("="));
+    const bare = eq > 0 && arg.startsWith("-") ? arg.slice(eq + 1) : arg;
+    if (URL_USERINFO.test(bare)) return "a URL with a password";
+    if (SECRET_VALUE.test(bare)) return "a key";
+  }
+  return null;
+}
+function parseExplicitServeCommand(raw) {
+  const argv = parseServeCommand(raw);
+  const secret = secretInServeCommand(argv);
+  if (secret) {
+    throw new Error(
+      `--serve-cmd carries what looks like a secret (${secret}), which is not recorded. Have the site read it from an env file and pass the command without it.`
+    );
+  }
+  return argv;
+}
+function resolvePreviewServe(params) {
+  const env = params.env ?? process.env;
+  const root = resolveWorkspaceRoot(env, params.projectId);
+  const explicit = params.serveCmd?.trim();
+  if (explicit) {
+    const argv = parseExplicitServeCommand(explicit);
+    if (!root) {
+      throw new Error("--serve-cmd needs the space's workspace (WORKSPACE_DIR); run it inside the space.");
+    }
+    const cwd2 = workspaceRelativeDir(root, params.cwd ?? process.cwd());
+    if (!cwd2) {
+      throw new Error(`--serve-cmd runs from the current directory, which must be inside the space's workspace (${root}).`);
+    }
+    return { serve: { argv, cwd: cwd2 } };
+  }
+  const notRestartable = (note) => ({ serve: null, note });
+  const platform = params.platform ?? process.platform;
+  if (platform !== "linux" && !params.procRoot) {
+    return notRestartable("the start command can only be read on a Linux space; pass --serve-cmd");
+  }
+  if (!root) return notRestartable("this is not running inside a space's workspace");
+  const found = detectListeningProcess(params.port, params.procRoot);
+  if (!found) return notRestartable(`could not see which process listens on port ${params.port}; pass --serve-cmd`);
+  const cwd = workspaceRelativeDir(root, found.cwd);
+  if (!cwd) {
+    return notRestartable(`the site runs from ${found.cwd}, outside the workspace, which does not survive a sleep`);
+  }
+  const ephemeral = found.argv.find((arg) => EPHEMERAL_PREFIXES.some((prefix) => arg.startsWith(prefix)));
+  if (ephemeral) {
+    return notRestartable(`its command uses ${ephemeral}, which does not survive a sleep; pass --serve-cmd`);
+  }
+  if (found.argv.length > SERVE_MAX_ARGS || found.argv.some((arg) => arg.length > SERVE_MAX_ARG_LENGTH)) {
+    return notRestartable("its command line is too long to record; pass --serve-cmd");
+  }
+  const secret = secretInServeCommand(found.argv);
+  if (secret) {
+    return notRestartable(
+      `its command line carries what looks like a secret (${secret}), which is not recorded; read it from an env file and pass --serve-cmd`
+    );
+  }
+  return { serve: { argv: found.argv, cwd } };
+}
+var START_PORT_WAIT_MS = 6e4;
+var START_POLL_MS = 300;
+var START_PROBE_TIMEOUT_MS = 2e3;
+var START_LOGS_DIR = path10.join(".instafy", "agent", "logs");
+function displayPath(file, cwd = process.cwd()) {
+  const relative = path10.relative(cwd, file);
+  return relative && !relative.startsWith("..") && !path10.isAbsolute(relative) ? relative : file;
+}
+async function startPreviewSite(params) {
+  const { port, sitePath, serve, root } = params;
+  const credentialFreeEnv = await loadCredentialFreeEnv();
+  const env = credentialFreeEnv(params.env ?? process.env);
+  const cwd = path10.join(root, serve.cwd);
+  const logFile = path10.join(root, START_LOGS_DIR, `preview-${port}.log`);
+  fs9.mkdirSync(path10.dirname(logFile), { recursive: true });
+  const fd = fs9.openSync(logFile, "a", 384);
+  let exit = null;
+  let spawnError = null;
+  let pid;
+  try {
+    fs9.writeSync(fd, `
+[instafy preview open --start] ${(/* @__PURE__ */ new Date()).toISOString()} ${JSON.stringify(serve.argv)} in ${serve.cwd}
+`);
+    const child = spawn5(serve.argv[0], serve.argv.slice(1), {
+      cwd,
+      env,
+      detached: true,
+      stdio: ["ignore", fd, fd]
+    });
+    child.on("error", (error) => {
+      spawnError = error.code ?? error.message;
+    });
+    child.on("exit", (code, signal) => {
+      exit = signal ? `signal ${signal}` : `exit status ${code}`;
+    });
+    child.unref();
+    pid = child.pid;
+  } finally {
+    fs9.closeSync(fd);
+  }
+  await new Promise((resolve) => setImmediate(resolve));
+  const shownLog = displayPath(logFile);
+  const fail = (why) => new PreviewCommandError(`The site ${why} and did not answer on 127.0.0.1:${port}; log: ${shownLog}`, PREVIEW_EXIT_NOT_LISTENING);
+  const deadline = Date.now() + (params.timeoutMs ?? START_PORT_WAIT_MS);
+  for (; ; ) {
+    if (spawnError || pid === void 0) throw fail(`could not be started (${spawnError ?? "no process"})`);
+    if (exit) throw fail(`started with --serve-cmd exited (${exit})`);
+    const probe = await probeLocalSite(port, sitePath, START_PROBE_TIMEOUT_MS, RATHOLE_LOCAL_HOSTS);
+    if (probe.listening) return { pid, logFile };
+    if (exit) throw fail(`started with --serve-cmd exited (${exit})`);
+    if (Date.now() >= deadline) {
+      try {
+        process.kill(-pid, "SIGTERM");
+      } catch {
+      }
+      throw fail(`started with --serve-cmd was stopped after ${Math.round((params.timeoutMs ?? START_PORT_WAIT_MS) / 1e3)} s`);
+    }
+    await new Promise((resolve) => setTimeout(resolve, START_POLL_MS));
+  }
+}
+async function createAndStartClient(params) {
+  const { opts, port, title, sitePath, projectId: projectId2, retryCommand, auth, controllerUrl, serverUrl, log, serve } = params;
+  const conversationId = opts.conversationId?.trim() || void 0;
+  const created = await controllerRequest({
+    controllerUrl,
+    auth,
+    method: "POST",
+    route: previewsRoute(projectId2),
+    body: {
+      runtimeId: readEnv("RUNTIME_ID"),
+      runtimeLeaseId: readEnv("RUNTIME_LEASE_ID"),
+      conversationId,
+      port,
+      path: sitePath,
+      title,
+      metadata: { source: "instafy-cli" },
+      ...serve ? { serve } : {}
+    },
+    retryCommand,
+    notFoundMeansUnavailable: true
+  });
+  const grant = created.body && !Array.isArray(created.body) ? created.body : {};
+  const previewId = stringField(grant, "previewId");
+  if (!previewId) {
+    throw new Error("Preview response is missing previewId.");
+  }
+  const workdir = workdirFor(previewId);
+  const logFile = path10.join(instafyDir(), "cli-preview-logs", `preview-${safePathSegment2(previewId)}.log`);
+  const configPath2 = configPathFor(workdir);
+  const hostSuffix = parseViewerHostSuffix(grant["viewerHostSuffix"]);
+  const studioOrigin = parseStudioOrigin(grant["studioOrigin"]);
+  const state = readStateFile2();
+  const current = state.previews.find((preview) => preview.previewId === previewId) ?? null;
+  let pid = null;
+  let binary = current?.binary;
+  try {
+    const credentials = grant["credentials"] && typeof grant["credentials"] === "object" ? grant["credentials"] : {};
+    const configBody = buildRatholeConfig(credentials, port);
+    fs9.mkdirSync(workdir, { recursive: true });
+    fs9.mkdirSync(path10.dirname(logFile), { recursive: true });
+    if (current && readFileOrNull(configPath2) === configBody && isRatholeClientFor(current.pid, configPath2, current.binary)) {
+      pid = current.pid;
+    }
+    for (const stale of state.previews) {
+      if (stale.previewId === previewId) {
+        if (pid === null) await stopClient(stale);
+        continue;
+      }
+      if (stale.localPort !== port) continue;
+      await stopClient(stale);
+      forgetPreview(stale.previewId);
+      if (cleanUrl(stale.controllerUrl) === serverUrl) {
+        await closePreviewOnServer(controllerUrl, auth, stale.projectId, stale.previewId).catch(() => {
+        });
+      }
+    }
+    if (pid === null) {
+      const rathole = await resolveRathole(opts.ratholeBin, log);
+      fs9.writeFileSync(configPath2, configBody, { encoding: "utf8", mode: 384 });
+      binary = rathole;
+      const started = await spawnRatholeDetached({ rathole, configPath: configPath2, workdir, logFile });
+      if (started.exit !== null) {
+        const suffix = started.logTail ? `
+
+Last logs:
+${started.logTail}` : "";
+        throw new Error(`Preview tunnel exited (${started.exit}).${suffix}`);
+      }
+      pid = started.pid;
+    } else {
+      log(`Reusing the running preview client (pid ${pid}).`);
+    }
+  } catch (error) {
+    if (pid !== null) await stopRatholeClient(pid, configPath2, binary);
+    forgetPreview(previewId);
+    await closePreviewOnServer(controllerUrl, auth, projectId2, previewId).catch(() => {
+    });
+    const message = error instanceof Error ? error.message : String(error);
+    const [first, ...rest] = message.split("\n");
+    const closed = [`${first} The preview was closed.`, ...rest].join("\n");
+    if (error instanceof PreviewCommandError) throw new PreviewCommandError(closed, error.exitCode);
+    throw new Error(closed);
+  }
+  const entry = {
+    previewId,
+    projectId: projectId2,
+    title,
+    localPort: port,
+    path: sitePath,
+    controllerUrl: serverUrl,
+    pid,
+    logFile,
+    workdir,
+    startedAt: current?.pid === pid ? current.startedAt : (/* @__PURE__ */ new Date()).toISOString(),
+    ...binary ? { binary } : {},
+    ...hostSuffix ? { hostSuffix } : {},
+    ...studioOrigin ? { studioOrigin } : {}
+  };
+  upsertPreviewState(entry);
+  return { grant, previewId, entry, current };
+}
+async function previewOpen(opts) {
+  const port = parsePreviewPort(opts.port);
+  const title = parsePreviewTitle(opts.title);
+  const sitePath = parsePreviewPath(opts.path);
+  if (opts.serveCmd?.trim()) parseExplicitServeCommand(opts.serveCmd);
+  const projectId2 = resolveProject({ project: opts.project });
+  const retryCommand = `instafy preview open --port ${port} --title ${shellQuote2(title)}`;
+  const { auth, controllerUrl } = resolveAuth(opts, retryCommand);
+  const serverUrl = cleanUrl(controllerUrl);
+  const log = (message) => console.error(kleur8.cyan(message));
+  const explicitServe = opts.start && opts.serveCmd?.trim() ? resolvePreviewServe({ port, serveCmd: opts.serveCmd, projectId: projectId2, cwd: opts.cwd }).serve : null;
+  let probe = await probeLocalSite(port, sitePath, void 0, RATHOLE_LOCAL_HOSTS);
+  let started = null;
+  if (!probe.listening && opts.start && probe.status === null && !probe.timedOut) {
+    const ipv6 = await probeLocalSite(port, sitePath, void 0, ["::1"]);
+    if (ipv6.status === null && !ipv6.timedOut) {
+      if (!explicitServe) {
+        throw new PreviewCommandError(
+          `Nothing answers on 127.0.0.1:${port}, and --start needs --serve-cmd "<command>" to start the site.`,
+          PREVIEW_EXIT_NOT_LISTENING
+        );
+      }
+      const root = resolveWorkspaceRoot(process.env, projectId2);
+      started = await startPreviewSite({ port, sitePath, serve: explicitServe, root, timeoutMs: opts.startTimeoutMs });
+      log(`Started the site (pid ${started.pid}); log: ${displayPath(started.logFile)}`);
+      probe = await probeLocalSite(port, sitePath, void 0, RATHOLE_LOCAL_HOSTS);
+    }
+  }
+  if (!probe.listening) {
+    throw await notListeningError(port, sitePath, probe);
+  }
+  const { serve, note: restartNote } = resolvePreviewServe({ port, serveCmd: opts.serveCmd, projectId: projectId2, cwd: opts.cwd });
+  const { grant, previewId, entry } = await withStateLock(
+    () => createAndStartClient({ opts, port, title, sitePath, projectId: projectId2, retryCommand, auth, controllerUrl, serverUrl, log, serve })
+  );
+  let ready;
+  try {
+    ready = await controllerRequest({
+      controllerUrl,
+      auth,
+      method: "POST",
+      route: previewsRoute(projectId2, previewId, "ready"),
+      body: {},
+      retryCommand
+    });
+  } catch (error) {
+    if (error instanceof PreviewCommandError && error.exitCode === PREVIEW_EXIT_UNAVAILABLE) {
+      await withStateLock(async () => {
+        await stopClient(entry);
+        forgetPreview(previewId);
+      });
+    }
+    throw error;
+  }
+  const readyBody = ready.body && !Array.isArray(ready.body) ? ready.body : {};
+  const restartable = serve !== null && grant["restartable"] === true;
+  return {
+    previewId,
+    title,
+    port,
+    path: sitePath,
+    status: previewStatusFromHealth(readyBody),
+    httpStatus: previewHttpStatusFromHealth(readyBody),
+    messageId: stringField(readyBody, "messageId"),
+    viewerHostSuffix: parseViewerHostSuffix(grant["viewerHostSuffix"]) ?? null,
+    restartable,
+    ...restartable ? {} : { restartNote: restartNote ?? "the server did not record a start command" },
+    ...opts.start ? { startedPid: started?.pid ?? null, logFile: started?.logFile ?? null } : {}
+  };
+}
+function toPreviewSummary(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const record2 = raw;
+  const previewId = stringField(record2, "previewId", "id");
+  if (!previewId) return null;
+  return {
+    previewId,
+    title: stringField(record2, "title") ?? "",
+    port: numberField(record2, "port", "localPort") ?? 0,
+    path: stringField(record2, "path") ?? "/",
+    status: stringField(record2, "status") ?? "unknown",
+    ...typeof record2["restartable"] === "boolean" ? { restartable: record2["restartable"] } : {}
+  };
+}
+async function previewList(opts) {
+  const projectId2 = resolveProject({ project: opts.project });
+  const { auth, controllerUrl } = resolveAuth(opts, "instafy preview list");
+  const listed = await controllerRequest({
+    controllerUrl,
+    auth,
+    method: "GET",
+    route: previewsRoute(projectId2),
+    retryCommand: "instafy preview list",
+    notFoundMeansUnavailable: true
+  });
+  const rows = Array.isArray(listed.body) ? listed.body : listed.body && Array.isArray(listed.body["previews"]) ? listed.body["previews"] : [];
+  return rows.map(toPreviewSummary).filter((row) => row !== null);
+}
+async function previewClose(opts) {
+  const previewId = opts.previewId?.trim() ?? "";
+  if (!previewId) {
+    throw new Error("Preview id is required. Use `instafy preview list` to find it.");
+  }
+  const entry = await withStateLock(async () => {
+    const removed = removePreviewState(previewId);
+    if (removed) await stopClient(removed);
+    return removed;
+  });
+  const projectId2 = entry?.projectId ?? resolveProject({ project: opts.project });
+  try {
+    const { auth, controllerUrl } = resolveAuth(
+      { ...opts, controllerUrl: opts.controllerUrl ?? entry?.controllerUrl },
+      `instafy preview close ${previewId}`
+    );
+    await closePreviewOnServer(controllerUrl, auth, projectId2, previewId);
+  } catch (error) {
+    if (entry) await withStateLock(async () => upsertPreviewState({ ...entry, pid: -1 }));
+    throw error;
+  }
+  removeWorkdir(previewId);
+  return { ok: true, previewId };
+}
+function printPreviewOpen(result, json) {
+  if (json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  const label = result.status === "live" ? kleur8.green("Ready to preview") : result.status === "not_responding" ? kleur8.yellow("Not responding yet") : kleur8.yellow("Preview opened (the server did not report whether the site answers)");
+  console.log(`${label}: ${result.title} (port ${result.port}). Open it from the card in the conversation.`);
+  if (result.startedPid) {
+    console.log(kleur8.gray(`Started the site in the background (pid ${result.startedPid}); log: ${displayPath(result.logFile ?? "")}`));
+  } else if (result.startedPid === null) {
+    console.log(kleur8.gray("The site was already running; nothing was started."));
+  }
+  if (result.restartable) {
+    console.log(kleur8.gray("Open starts the site again when the process that started it exits, or the space sleeps."));
+  } else {
+    console.log(
+      kleur8.yellow(
+        `When the process that started it exits, or the space sleeps, Open cannot start the site by itself: ${result.restartNote}.`
+      )
+    );
+  }
+  console.log(kleur8.gray(`previewId=${result.previewId}`));
+  if (result.httpStatus !== null && result.httpStatus >= 400) {
+    console.log(kleur8.yellow(`The site answered HTTP ${result.httpStatus} through the preview.`));
+  }
+  if (result.viewerHostSuffix) {
+    console.log(kleur8.gray(`viewerHostSuffix=${result.viewerHostSuffix}`));
+  }
+  console.log("");
+  console.log("Next:");
+  console.log(`- ${kleur8.cyan("instafy preview list")}`);
+  console.log(`- ${kleur8.cyan(`instafy preview close ${result.previewId}`)}`);
+}
+function printPreviewList(previews, json) {
+  if (json) {
+    console.log(JSON.stringify(previews, null, 2));
+    return;
+  }
+  const stoppedNote = "A preview whose machine stopped or restarted is not listed; its card reads Stopped, and Open on a restartable card starts the site again.";
+  if (previews.length === 0) {
+    console.log(kleur8.yellow("No open previews."));
+    console.log(kleur8.gray(stoppedNote));
+    return;
+  }
+  for (const preview of previews) {
+    const restart = preview.restartable === void 0 ? "" : preview.restartable ? " \xB7 restartable" : " \xB7 not restartable";
+    console.log(
+      `${preview.previewId} \xB7 ${preview.title || "(untitled)"} \xB7 port=${preview.port}${preview.path === "/" ? "" : ` \xB7 path=${preview.path}`} \xB7 preview ${preview.status}${restart}`
+    );
+  }
+  console.log(
+    kleur8.gray(
+      `This lists open previews; it does not check whether a site answers (${kleur8.cyan("instafy preview check --port <port>")} does). ${stoppedNote}`
+    )
+  );
 }
 
 // src/config-command.ts
 init_config();
 init_config();
-import kleur8 from "kleur";
+import kleur9 from "kleur";
 function normalizeKey(raw) {
   const key = raw.trim().toLowerCase().replace(/_/g, "-");
   if (key === "controller-url" || key === "controllerurl" || key === "server-url") {
@@ -5708,12 +6895,12 @@ function clearConfig(key) {
   }
 }
 function configPath(options) {
-  const path16 = getInstafyConfigPath();
+  const path19 = getInstafyConfigPath();
   if (options?.json) {
-    console.log(JSON.stringify({ path: path16 }, null, 2));
+    console.log(JSON.stringify({ path: path19 }, null, 2));
     return;
   }
-  console.log(path16);
+  console.log(path19);
 }
 function configList(options) {
   const config = readInstafyCliConfig();
@@ -5730,13 +6917,13 @@ function configList(options) {
     console.log(JSON.stringify(payload, null, 2));
     return;
   }
-  console.log(kleur8.green("Instafy CLI config"));
+  console.log(kleur9.green("Instafy CLI config"));
   console.log(`Path: ${payload.path}`);
-  console.log(`controller-url: ${payload.controllerUrl ?? kleur8.yellow("(not set)")}`);
+  console.log(`controller-url: ${payload.controllerUrl ?? kleur9.yellow("(not set)")}`);
   console.log(`controller-url (effective): ${payload.effectiveControllerUrl}`);
-  console.log(`studio-url: ${payload.studioUrl ?? kleur8.yellow("(not set)")}`);
-  console.log(`access-token: ${payload.accessTokenSet ? kleur8.green("(set)") : kleur8.yellow("(not set)")}`);
-  console.log(`refresh-token: ${payload.refreshTokenSet ? kleur8.green("(set)") : kleur8.yellow("(not set)")}`);
+  console.log(`studio-url: ${payload.studioUrl ?? kleur9.yellow("(not set)")}`);
+  console.log(`access-token: ${payload.accessTokenSet ? kleur9.green("(set)") : kleur9.yellow("(not set)")}`);
+  console.log(`refresh-token: ${payload.refreshTokenSet ? kleur9.green("(set)") : kleur9.yellow("(not set)")}`);
   if (payload.updatedAt) {
     console.log(`updated-at: ${payload.updatedAt}`);
   }
@@ -5765,7 +6952,7 @@ function configSet(params) {
     console.log(JSON.stringify({ key, value, path: getInstafyConfigPath() }, null, 2));
     return;
   }
-  console.log(kleur8.green(`Set ${key}`));
+  console.log(kleur9.green(`Set ${key}`));
   console.log(value);
 }
 function configUnset(params) {
@@ -5775,7 +6962,7 @@ function configUnset(params) {
     console.log(JSON.stringify({ ok: true, key }, null, 2));
     return;
   }
-  console.log(kleur8.green(`Unset ${key}`));
+  console.log(kleur9.green(`Unset ${key}`));
 }
 
 // src/index.ts
@@ -5784,27 +6971,27 @@ init_config();
 // src/git-wrapper.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { randomUUID as randomUUID2 } from "node:crypto";
-import fs8 from "node:fs";
-import path9 from "node:path";
-import kleur9 from "kleur";
+import fs10 from "node:fs";
+import path11 from "node:path";
+import kleur10 from "kleur";
 function pathExists(candidate) {
   try {
-    fs8.statSync(candidate);
+    fs10.statSync(candidate);
     return true;
   } catch {
     return false;
   }
 }
 function findInstafyGitContext(startDir) {
-  let current = path9.resolve(startDir);
-  const root = path9.parse(current).root;
+  let current = path11.resolve(startDir);
+  const root = path11.parse(current).root;
   while (true) {
-    const gitDir = path9.join(current, ".instafy", ".git");
+    const gitDir = path11.join(current, ".instafy", ".git");
     if (pathExists(gitDir)) {
       return { workTree: current, gitDir };
     }
     if (current === root) break;
-    current = path9.dirname(current);
+    current = path11.dirname(current);
   }
   return null;
 }
@@ -5851,9 +7038,9 @@ function validateGitArgs(userArgs) {
     }
     if (arg === "--git-dir" || arg.startsWith("--git-dir=") || arg === "--work-tree" || arg.startsWith("--work-tree=") || arg === "-C") {
       throw new Error(
-        `Unsupported argument "${arg}". Use ${kleur9.cyan(
+        `Unsupported argument "${arg}". Use ${kleur10.cyan(
           "cd"
-        )} instead; ${kleur9.cyan("instafy git")} manages --git-dir/--work-tree automatically.`
+        )} instead; ${kleur10.cyan("instafy git")} manages --git-dir/--work-tree automatically.`
       );
     }
     if (arg === "-c" || arg === "--config-env" || arg === "--exec-path" || arg === "--namespace") {
@@ -5960,7 +7147,7 @@ function collectDirtyPaths(context, options) {
   return unique;
 }
 function findEmbeddedGitDirs(context, pathSpecs) {
-  const instafyGitDir = path9.resolve(context.gitDir);
+  const instafyGitDir = path11.resolve(context.gitDir);
   const seen = /* @__PURE__ */ new Set();
   for (const rawPath of pathSpecs) {
     const normalized = normalizePathSpec(rawPath).replace(/\/+$/, "");
@@ -5969,11 +7156,11 @@ function findEmbeddedGitDirs(context, pathSpecs) {
     }
     let cursor = normalized;
     while (cursor && cursor !== ".") {
-      const candidate = path9.join(context.workTree, ...cursor.split("/"), ".git");
-      if (pathExists(candidate) && path9.resolve(candidate) !== instafyGitDir) {
-        seen.add(path9.resolve(candidate));
+      const candidate = path11.join(context.workTree, ...cursor.split("/"), ".git");
+      if (pathExists(candidate) && path11.resolve(candidate) !== instafyGitDir) {
+        seen.add(path11.resolve(candidate));
       }
-      const next = path9.posix.dirname(cursor);
+      const next = path11.posix.dirname(cursor);
       if (next === "." || next === cursor) {
         break;
       }
@@ -5982,8 +7169,8 @@ function findEmbeddedGitDirs(context, pathSpecs) {
   }
   const candidates = Array.from(seen);
   candidates.sort((a, b) => {
-    const depthA = a.split(path9.sep).length;
-    const depthB = b.split(path9.sep).length;
+    const depthA = a.split(path11.sep).length;
+    const depthB = b.split(path11.sep).length;
     return depthB - depthA;
   });
   return candidates;
@@ -5993,16 +7180,16 @@ function hideEmbeddedGitDirs(context, pathSpecs) {
   if (candidates.length === 0) {
     return [];
   }
-  const stagingBase = path9.join(context.workTree, ".instafy", "origin-staging", "embedded-git");
-  fs8.mkdirSync(stagingBase, { recursive: true });
+  const stagingBase = path11.join(context.workTree, ".instafy", "origin-staging", "embedded-git");
+  fs10.mkdirSync(stagingBase, { recursive: true });
   const renames = [];
   for (const candidate of candidates) {
-    let hidden = path9.join(stagingBase, randomUUID2());
+    let hidden = path11.join(stagingBase, randomUUID2());
     for (let attempt = 0; attempt < 8; attempt += 1) {
       if (!pathExists(hidden)) break;
-      hidden = path9.join(stagingBase, randomUUID2());
+      hidden = path11.join(stagingBase, randomUUID2());
     }
-    fs8.renameSync(candidate, hidden);
+    fs10.renameSync(candidate, hidden);
     renames.push({ original: candidate, hidden });
   }
   return renames;
@@ -6012,7 +7199,7 @@ function restoreEmbeddedGitDirs(renames) {
     const rename = renames[index];
     if (!rename) continue;
     try {
-      fs8.renameSync(rename.hidden, rename.original);
+      fs10.renameSync(rename.hidden, rename.original);
     } catch {
     }
   }
@@ -6082,15 +7269,15 @@ function runInstafyGit(userArgs, options) {
     console.log("instafy git <git-args...>");
     console.log("");
     console.log(
-      `Runs ${kleur9.cyan("git")} against the Instafy canonical repo at ${kleur9.cyan(
+      `Runs ${kleur10.cyan("git")} against the Instafy canonical repo at ${kleur10.cyan(
         ".instafy/.git"
       )} (auto-detected by walking up from cwd).`
     );
     console.log("");
     console.log("Example:");
-    console.log(`  ${kleur9.cyan("instafy git status")}`);
-    console.log(`  ${kleur9.cyan("instafy git add -A")}`);
-    console.log(`  ${kleur9.cyan('instafy git commit -am "instafy: checkpoint"')}`);
+    console.log(`  ${kleur10.cyan("instafy git status")}`);
+    console.log(`  ${kleur10.cyan("instafy git add -A")}`);
+    console.log(`  ${kleur10.cyan('instafy git commit -am "instafy: checkpoint"')}`);
     return 0;
   }
   const context = findInstafyGitContext(cwd);
@@ -6100,8 +7287,8 @@ function runInstafyGit(userArgs, options) {
         "No Instafy canonical git checkout found (expected .instafy/.git).",
         "",
         "Tips:",
-        `- Run this inside a git-canonical workspace (where ${kleur9.cyan(".instafy/.git")} exists).`,
-        `- If you're trying to operate on a user repo, use normal ${kleur9.cyan("git")} (it uses .git).`
+        `- Run this inside a git-canonical workspace (where ${kleur10.cyan(".instafy/.git")} exists).`,
+        `- If you're trying to operate on a user repo, use normal ${kleur10.cyan("git")} (it uses .git).`
       ].join("\n")
     );
   }
@@ -6376,7 +7563,7 @@ async function runInstafyGitSync(args, options) {
       }
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      console.warn(kleur9.yellow(`[instafy git sync] ${message}; falling back to environment token.`));
+      console.warn(kleur10.yellow(`[instafy git sync] ${message}; falling back to environment token.`));
     }
   }
   if (!originToken) {
@@ -6424,7 +7611,7 @@ async function runInstafyGitSync(args, options) {
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       console.warn(
-        kleur9.yellow(
+        kleur10.yellow(
           `[instafy git sync] failed to recover from invalid origin token: ${message}`
         )
       );
@@ -6438,18 +7625,18 @@ async function runInstafyGitSync(args, options) {
         console.log(JSON.stringify(saveReportJson(report, notSaved2), null, 2));
       } else {
         for (const sentence of notSaved2) {
-          console.error(kleur9.red(`${sentence}.`));
+          console.error(kleur10.red(`${sentence}.`));
         }
       }
       return 1;
     }
     const suffix = text2.trim() ? `: ${text2.trim()}` : "";
-    console.error(kleur9.red(`Origin git sync failed (${response.status} ${response.statusText})${suffix}`));
+    console.error(kleur10.red(`Origin git sync failed (${response.status} ${response.statusText})${suffix}`));
     return 1;
   }
   const rev = report.rev ?? "";
   if (!rev) {
-    console.error(kleur9.red("Origin git sync response missing rev field."));
+    console.error(kleur10.red("Origin git sync response missing rev field."));
     return 1;
   }
   const notSaved = notSavedSentences(report, { failedWhole: false });
@@ -6458,7 +7645,7 @@ async function runInstafyGitSync(args, options) {
   } else {
     console.log(rev);
     for (const sentence of notSaved) {
-      console.error(kleur9.yellow(`${sentence}.`));
+      console.error(kleur10.yellow(`${sentence}.`));
     }
   }
   return notSaved.length > 0 ? 1 : 0;
@@ -6477,21 +7664,21 @@ function parseSaveReport(text2) {
     payload = {};
   }
   const conflictedPaths = Array.isArray(payload["conflictedPaths"]) ? payload["conflictedPaths"].flatMap((entry) => {
-    const path16 = optionalString(entry);
-    return path16 ? [path16] : [];
+    const path19 = optionalString(entry);
+    return path19 ? [path19] : [];
   }) : [];
   const rejectedPaths = Array.isArray(payload["rejectedPaths"]) ? payload["rejectedPaths"].flatMap((entry) => {
     if (typeof entry === "string") {
-      const path17 = optionalString(entry);
-      return path17 ? [{ path: path17, reason: "", keptSavedVersion: false }] : [];
+      const path20 = optionalString(entry);
+      return path20 ? [{ path: path20, reason: "", keptSavedVersion: false }] : [];
     }
     if (!entry || typeof entry !== "object") return [];
     const record2 = entry;
-    const path16 = optionalString(record2["path"]);
-    if (!path16) return [];
+    const path19 = optionalString(record2["path"]);
+    if (!path19) return [];
     return [
       {
-        path: path16,
+        path: path19,
         reason: optionalString(record2["reason"]) ?? "",
         keptSavedVersion: record2["keptSavedVersion"] === true
       }
@@ -6571,11 +7758,511 @@ function saveReportJson(report, notSaved) {
   };
 }
 
+// src/site-check.ts
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { once } from "node:events";
+import fs11 from "node:fs";
+import http3 from "node:http";
+import { createRequire as createRequire3 } from "node:module";
+import os6 from "node:os";
+import path12 from "node:path";
+var CHECK_EXIT_OK = 0;
+var CHECK_EXIT_PROBLEMS = 1;
+var CHECK_EXIT_NOT_LISTENING = PREVIEW_EXIT_NOT_LISTENING;
+var CHECK_EXIT_NO_BROWSER = 4;
+var CHECK_EXIT_USAGE = 64;
+var CHECK_EXIT_INTERNAL = 70;
+var MAX_PATH_LENGTH2 = 512;
+var MAX_LIST = 20;
+var MAX_TEXT = 300;
+var CHROMIUM_ARGS = ["--use-angle=swiftshader", "--enable-unsafe-swiftshader", "--ignore-gpu-blocklist", "--disable-dev-shm-usage"];
+var SOFTWARE_GL_NOISE = /GL Driver Message|GPU stall due to ReadPixels|READ-usage buffer was written|WebGL: too many errors|Automatic fallback to software WebGL/;
+var PHONE_UA = "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1";
+var VIEWPORTS = [
+  { name: "desktop", width: 1280, height: 800, mobile: false },
+  { name: "phone", width: 390, height: 844, mobile: true }
+];
+var TRUSTED_PLAYWRIGHT_PATH_ENV = "INSTAFY_SHARED_BROWSER_PLAYWRIGHT_PATH";
+var TRUSTED_NODE_MODULES_ROOT_ENV = "INSTAFY_SHARED_BROWSER_TRUSTED_NODE_MODULES_ROOT";
+function isPlaywrightDir(dir) {
+  try {
+    const pkg2 = JSON.parse(fs11.readFileSync(path12.join(dir, "package.json"), "utf8"));
+    return pkg2.name === "playwright" || pkg2.name === "playwright-core";
+  } catch {
+    return false;
+  }
+}
+function playwrightIn(nodeModules) {
+  const found = [];
+  for (const name of ["playwright", "playwright-core"]) {
+    const dir = path12.join(nodeModules, name);
+    if (isPlaywrightDir(dir)) found.push(dir);
+  }
+  try {
+    const store = path12.join(nodeModules, ".pnpm");
+    for (const entry of fs11.readdirSync(store).filter((e) => /^playwright(-core)?@\d/.test(e)).sort().reverse()) {
+      const name = entry.startsWith("playwright-core@") ? "playwright-core" : "playwright";
+      const dir = path12.join(store, entry, "node_modules", name);
+      if (isPlaywrightDir(dir)) found.push(dir);
+    }
+  } catch {
+  }
+  return found;
+}
+var npmRootCache;
+function npmGlobalRoot() {
+  if (npmRootCache !== void 0) return npmRootCache;
+  try {
+    const out = spawnSync5("npm", ["root", "-g"], { cwd: path12.parse(process.cwd()).root, encoding: "utf8", timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] });
+    npmRootCache = out.status === 0 && out.stdout.trim() ? out.stdout.trim() : null;
+  } catch {
+    npmRootCache = null;
+  }
+  return npmRootCache;
+}
+function defaultGlobalRoots(env = process.env) {
+  const roots = [];
+  for (const entry of (env.NODE_PATH ?? "").split(path12.delimiter)) if (path12.isAbsolute(entry.trim())) roots.push(entry.trim());
+  const npmRoot = npmGlobalRoot();
+  if (npmRoot && path12.isAbsolute(npmRoot)) roots.push(npmRoot);
+  roots.push("/usr/lib/node_modules", "/usr/local/lib/node_modules", "/opt/homebrew/lib/node_modules");
+  return [...new Set(roots)];
+}
+function locateBrowserEngine(o = {}) {
+  const env = o.env ?? process.env;
+  const tried = [];
+  const trustedPath = env[TRUSTED_PLAYWRIGHT_PATH_ENV]?.trim();
+  if (trustedPath) {
+    if (path12.isAbsolute(trustedPath) && isPlaywrightDir(trustedPath)) return { engine: { playwright: trustedPath, source: "trusted" }, tried };
+    tried.push(`$${TRUSTED_PLAYWRIGHT_PATH_ENV} is not an absolute path to a playwright package`);
+  }
+  const trustedRoot = env[TRUSTED_NODE_MODULES_ROOT_ENV]?.trim();
+  if (trustedRoot) {
+    const found = path12.isAbsolute(trustedRoot) ? playwrightIn(trustedRoot) : [];
+    if (found.length) return { engine: { playwright: found[0], source: "trusted" }, tried };
+    tried.push(`no playwright in $${TRUSTED_NODE_MODULES_ROOT_ENV}`);
+  }
+  for (const root of o.globalRoots ?? defaultGlobalRoots(env)) {
+    const found = playwrightIn(root);
+    if (found.length) return { engine: { playwright: found[0], source: "global" }, tried };
+    tried.push(`none in ${root}`);
+  }
+  if (!o.workspace) {
+    tried.push("the workspace was not searched (--workspace-playwright)");
+    return { engine: null, tried };
+  }
+  let dir = path12.resolve(o.cwd ?? process.cwd());
+  for (let i = 0; i < 16; i += 1) {
+    const found = playwrightIn(path12.join(dir, "node_modules"));
+    if (found.length) return { engine: { playwright: found[0], source: "workspace" }, tried };
+    const up = path12.dirname(dir);
+    if (up === dir) break;
+    dir = up;
+  }
+  tried.push(`no node_modules/playwright from ${o.cwd ?? process.cwd()} upwards`);
+  return { engine: null, tried };
+}
+function chromiumCandidates(env = process.env, exists = fs11.existsSync) {
+  const out = [];
+  const browsersRoots = [env.PLAYWRIGHT_BROWSERS_PATH, "/ms-playwright", path12.join(os6.homedir(), ".cache", "ms-playwright")].filter((x) => Boolean(x && x !== "0"));
+  for (const root of [...new Set(browsersRoots)]) {
+    let entries = [];
+    try {
+      entries = fs11.readdirSync(root).sort().reverse();
+    } catch {
+      continue;
+    }
+    for (const e of entries.filter((x) => x.startsWith("chromium_headless_shell-"))) {
+      out.push(path12.join(root, e, "chrome-headless-shell-linux64", "chrome-headless-shell"));
+      out.push(path12.join(root, e, "chrome-linux", "headless_shell"));
+    }
+    for (const e of entries.filter((x) => /^chromium-\d/.test(x))) {
+      out.push(path12.join(root, e, "chrome-linux64", "chrome"), path12.join(root, e, "chrome-linux", "chrome"));
+    }
+  }
+  out.push(
+    "/usr/bin/chromium",
+    "/usr/bin/chromium-browser",
+    "/usr/bin/google-chrome",
+    "/usr/bin/google-chrome-stable",
+    "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+    "/Applications/Chromium.app/Contents/MacOS/Chromium"
+  );
+  return out.filter((p) => exists(p));
+}
+function loadPlaywright(engine) {
+  const req = createRequire3(path12.join(engine.playwright, "package.json"));
+  const mod = req(engine.playwright);
+  const pw = mod?.chromium ? mod : mod?.default;
+  if (!pw?.chromium) throw new Error(`${engine.playwright} has no chromium export`);
+  return pw;
+}
+async function launchChromium(pw, env = process.env) {
+  const errors = [];
+  try {
+    const browser = await pw.chromium.launch({ headless: true, args: CHROMIUM_ARGS });
+    return { browser, executable: "playwright" };
+  } catch (error) {
+    errors.push(firstLine(error));
+  }
+  for (const executablePath of chromiumCandidates(env)) {
+    try {
+      const browser = await pw.chromium.launch({ headless: true, executablePath, args: CHROMIUM_ARGS });
+      return { browser, executable: executablePath };
+    } catch (error) {
+      errors.push(`${executablePath}: ${firstLine(error)}`);
+    }
+  }
+  throw new NoBrowserError(`No Chromium would start (${errors.join("; ") || "none found"})`);
+}
+var NoBrowserError = class extends Error {
+};
+function firstLine(error) {
+  return String(error?.message ?? error).split("\n")[0].slice(0, MAX_TEXT);
+}
+function parseCheckPath(raw) {
+  const value = raw?.trim() || "/";
+  if (!value.startsWith("/") || value.startsWith("//") || value.length > MAX_PATH_LENGTH2 || /[\s\\]/.test(value)) {
+    throw new PreviewCommandError("Path must start with / and contain no spaces or backslashes (a ?query and #hash are fine).", CHECK_EXIT_USAGE);
+  }
+  return value;
+}
+function siteUrlFor(siteOrigin, sitePath) {
+  const url = new URL(sitePath, siteOrigin);
+  if (url.origin !== siteOrigin) throw new PreviewCommandError("Path must stay on the site's own origin.", CHECK_EXIT_USAGE);
+  return url.href;
+}
+function isSiteUrl(url, siteOrigin) {
+  try {
+    return new URL(url).origin === siteOrigin;
+  } catch {
+    return false;
+  }
+}
+function makeDefaultOutDir(port) {
+  return fs11.mkdtempSync(path12.join(os6.tmpdir(), `instafy-preview-check-${port}-`));
+}
+function escapeAttribute(value) {
+  return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function framePage(siteUrl) {
+  return `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>instafy preview check</title>
+<style>html,body{margin:0;height:100%;background:#fff}iframe{display:block;border:0;width:100%;height:100%}</style>
+<iframe id="site" src="${escapeAttribute(siteUrl)}" allow="fullscreen; clipboard-write"></iframe>`;
+}
+async function startFrameHost(siteUrl) {
+  const body = framePage(siteUrl);
+  const server = http3.createServer((req, res) => {
+    if (req.url !== "/") {
+      res.writeHead(404, { "content-type": "text/plain" });
+      res.end();
+      return;
+    }
+    res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+    res.end(body);
+  });
+  server.listen(0, "127.0.0.1");
+  await once(server, "listening");
+  const { port } = server.address();
+  return { url: `http://localhost:${port}/`, close: () => server.close() };
+}
+function blankVerdict(input3) {
+  if (input3.framed === "refused") {
+    return { blank: true, reason: "the site refuses to be framed (X-Frame-Options or CSP frame-ancestors), so the frame stays empty" };
+  }
+  if (input3.framed === "missing") return { blank: true, reason: "the page did not load" };
+  if (input3.dominant !== null && input3.dominant >= 0.995 && input3.text === 0) return { blank: true, reason: "the screen is a single colour" };
+  if (input3.text === 0 && input3.media === 0 && input3.elements < 3) return { blank: true, reason: "the page has no text, images or canvas" };
+  return { blank: false, reason: null };
+}
+async function measureDominantShare(measure) {
+  try {
+    const share = await measure();
+    return Number.isFinite(share) && share >= 0 && share <= 1 ? share : null;
+  } catch {
+    return null;
+  }
+}
+function incompleteBlankCheck(dominant, text2) {
+  if (dominant !== null) return null;
+  return text2 === 0 ? { error: true, message: "blank check incomplete: could not read the screenshot, and the page has no text to show it drew anything" } : { error: false, message: "blank check incomplete: could not read the screenshot, so a single-colour screen would not be caught" };
+}
+var FRAME_SNAPSHOT = () => {
+  const visible = (el) => {
+    const r = el.getBoundingClientRect();
+    if (r.width < 2 || r.height < 2 || r.bottom < 0 || r.right < 0 || r.top > innerHeight || r.left > innerWidth) return false;
+    const s = getComputedStyle(el);
+    return s.visibility !== "hidden" && s.display !== "none" && Number(s.opacity) > 0.05;
+  };
+  const body = document.body;
+  const text2 = (body?.innerText ?? "").replace(/\s+/g, " ").trim().length;
+  let media = 0;
+  let elements = 0;
+  for (const el of Array.from(body?.querySelectorAll("*") ?? [])) {
+    if (/^(SCRIPT|STYLE|NOSCRIPT|TEMPLATE|LINK|META)$/.test(el.tagName)) continue;
+    if (!visible(el)) continue;
+    elements += 1;
+    if (/^(CANVAS|IMG|SVG|VIDEO|IFRAME|PICTURE|OBJECT|EMBED)$/i.test(el.tagName)) media += 1;
+  }
+  return { text: text2, media, elements, title: document.title };
+};
+var DOMINANT_COLOUR = async (b64) => {
+  const img = new Image();
+  img.src = `data:image/png;base64,${b64}`;
+  await img.decode();
+  const w = 160;
+  const h = Math.max(1, Math.round(img.height / img.width * w));
+  const c = document.createElement("canvas");
+  c.width = w;
+  c.height = h;
+  const g = c.getContext("2d");
+  g.imageSmoothingEnabled = false;
+  g.drawImage(img, 0, 0, w, h);
+  const data = g.getImageData(0, 0, w, h).data;
+  const counts = /* @__PURE__ */ new Map();
+  let max = 0;
+  for (let i = 0; i < data.length; i += 4) {
+    const key = data[i] >> 3 << 10 | data[i + 1] >> 3 << 5 | data[i + 2] >> 3;
+    const n = (counts.get(key) ?? 0) + 1;
+    counts.set(key, n);
+    if (n > max) max = n;
+  }
+  return max / (w * h);
+};
+async function checkViewport(browser, target, vp, siteOrigin, outDir, timeoutMs, waitMs) {
+  const errors = [];
+  const warnings = [];
+  const context = await browser.newContext({
+    viewport: { width: vp.width, height: vp.height },
+    deviceScaleFactor: vp.mobile ? 2 : 1,
+    isMobile: vp.mobile,
+    hasTouch: vp.mobile,
+    ...vp.mobile ? { userAgent: PHONE_UA } : {},
+    reducedMotion: "reduce",
+    serviceWorkers: "block",
+    acceptDownloads: false
+  });
+  const t0 = Date.now();
+  let status = null;
+  try {
+    const page = await context.newPage();
+    const ours = (u) => isSiteUrl(u, siteOrigin);
+    const shortUrl = (u) => (ours(u) ? u.slice(siteOrigin.length) || "/" : u).slice(0, 200);
+    page.on("console", (m) => {
+      const text2 = String(m.text());
+      if (/^Failed to load resource/.test(text2)) return;
+      if (SOFTWARE_GL_NOISE.test(text2)) return;
+      if (/^Refused to display .* in a frame/.test(text2)) return;
+      if (m.type() === "error") errors.push(`console.error: ${text2.slice(0, MAX_TEXT)}`);
+    });
+    page.on("pageerror", (e) => errors.push(`uncaught: ${String(e?.message ?? e).split("\n")[0].slice(0, MAX_TEXT)}`));
+    let refused = false;
+    page.on("requestfailed", (r) => {
+      const u = String(r.url());
+      if (/\/favicon\.ico(\?|$)/.test(u)) return;
+      const why = r.failure()?.errorText ?? "failed";
+      if (target.framed && ours(u) && r.isNavigationRequest() && /ERR_BLOCKED_BY_RESPONSE/.test(why)) {
+        refused = true;
+        return;
+      }
+      if (/ERR_ABORTED/.test(why)) return;
+      (ours(u) ? errors : warnings).push(`request failed: ${shortUrl(u)} (${why})`);
+    });
+    page.on("response", (r) => {
+      const u = String(r.url());
+      const s = Number(r.status());
+      if (r.request().isNavigationRequest() && ours(u) && status === null) status = s;
+      if (s < 400 || /\/favicon\.ico(\?|$)/.test(u)) return;
+      (ours(u) ? errors : warnings).push(`HTTP ${s}: ${shortUrl(u)}`);
+    });
+    await page.goto(target.pageUrl, { waitUntil: "load", timeout: timeoutMs });
+    await page.waitForLoadState("networkidle", { timeout: Math.min(8e3, timeoutMs) }).catch(() => {
+      warnings.push("the network was still busy after 8 s (screenshot taken anyway)");
+    });
+    const frame = target.framed ? page.frames().find((f) => f !== page.mainFrame() && isSiteUrl(String(f.url()), siteOrigin)) : page.mainFrame();
+    let framed = "ok";
+    let snap = { text: 0, media: 0, elements: 0, title: "" };
+    if (refused) framed = "refused";
+    else if (!frame) framed = "missing";
+    else {
+      await frame.evaluate(() => document.fonts?.ready).catch(() => {
+      });
+      await page.waitForTimeout(waitMs);
+      snap = await frame.evaluate(FRAME_SNAPSHOT).catch(() => snap);
+    }
+    if (status !== null && status >= 400) framed = "missing";
+    const file = path12.join(outDir, `${vp.name}.png`);
+    const png = await page.screenshot({ path: file });
+    const dominant = await measureDominantShare(async () => {
+      const helper = await context.newPage();
+      try {
+        return await helper.evaluate(DOMINANT_COLOUR, png.toString("base64"));
+      } finally {
+        await helper.close().catch(() => {
+        });
+      }
+    });
+    const blank = blankVerdict({ dominant, text: snap.text, media: snap.media, elements: snap.elements, framed });
+    if (blank.blank) errors.push(`blank page: ${blank.reason}`);
+    else {
+      const incomplete = incompleteBlankCheck(dominant, snap.text);
+      if (incomplete) (incomplete.error ? errors : warnings).push(incomplete.message);
+    }
+    return {
+      name: vp.name,
+      width: vp.width,
+      height: vp.height,
+      screenshot: file,
+      title: snap.title.slice(0, 200),
+      status,
+      ms: Date.now() - t0,
+      blank,
+      errors: [...new Set(errors)].slice(0, MAX_LIST),
+      warnings: [...new Set(warnings)].slice(0, MAX_LIST)
+    };
+  } catch (error) {
+    errors.push(`the page did not load: ${firstLine(error)}`);
+    return {
+      name: vp.name,
+      width: vp.width,
+      height: vp.height,
+      screenshot: null,
+      title: "",
+      status,
+      ms: Date.now() - t0,
+      blank: { blank: true, reason: "the page did not load" },
+      errors: [...new Set(errors)].slice(0, MAX_LIST),
+      warnings: [...new Set(warnings)].slice(0, MAX_LIST)
+    };
+  } finally {
+    await context.close().catch(() => {
+    });
+  }
+}
+async function runSiteCheck(opts) {
+  const env = opts.env ?? process.env;
+  const port = parsePreviewPort(opts.port, env);
+  const sitePath = parseCheckPath(opts.path);
+  const timeoutMs = opts.timeoutMs ?? 3e4;
+  const viewports = VIEWPORTS.filter((v) => !opts.phone || v.name === "phone");
+  let outDir = null;
+  if (opts.outDir !== void 0) {
+    outDir = path12.resolve(opts.outDir);
+    fs11.mkdirSync(outDir, { recursive: true });
+    for (const v of VIEWPORTS) fs11.rmSync(path12.join(outDir, `${v.name}.png`), { force: true });
+  }
+  const probePath = sitePath.replace(/[?#].*$/, "") || "/";
+  const probe = await probeLocalSite(port, probePath, timeoutMs);
+  if (!probe.host) {
+    return {
+      code: CHECK_EXIT_NOT_LISTENING,
+      report: null,
+      message: noAnswerMessage(port, probe, `port ${port} at 127.0.0.1 or [::1]`, "check again")
+    };
+  }
+  const siteOrigin = `http://${probe.host}:${port}`;
+  const url = siteUrlFor(siteOrigin, sitePath);
+  const { engine, tried } = locateBrowserEngine({ env, cwd: opts.cwd, globalRoots: opts.globalRoots, workspace: opts.workspacePlaywright });
+  if (!engine) {
+    return { code: CHECK_EXIT_NO_BROWSER, report: null, message: `SKIPPED, nothing was checked: Playwright not found (${tried.join("; ")}).` };
+  }
+  let launched;
+  try {
+    launched = await launchChromium(loadPlaywright(engine), env);
+  } catch (error) {
+    return { code: CHECK_EXIT_NO_BROWSER, report: null, message: `SKIPPED, nothing was checked: ${firstLine(error)}` };
+  }
+  const reports = [];
+  let host = null;
+  try {
+    const shots = outDir ?? makeDefaultOutDir(port);
+    host = opts.framed ? await startFrameHost(url) : null;
+    const target = { pageUrl: host?.url ?? url, framed: Boolean(opts.framed) };
+    for (const vp of viewports) {
+      reports.push(await checkViewport(launched.browser, target, vp, siteOrigin, shots, timeoutMs, opts.waitMs ?? 600));
+    }
+  } finally {
+    await launched.browser.close().catch(() => {
+    });
+    host?.close();
+  }
+  const problems = reports.reduce((n, r) => n + r.errors.length, 0);
+  const report = {
+    ok: problems === 0,
+    url,
+    title: reports.find((r) => r.title)?.title ?? "",
+    framed: Boolean(opts.framed),
+    engine: { playwright: engine.playwright, chromium: launched.executable },
+    viewports: reports,
+    problems
+  };
+  return { code: problems ? CHECK_EXIT_PROBLEMS : CHECK_EXIT_OK, report };
+}
+function formatSiteCheck(report) {
+  const lines = [];
+  lines.push(`${report.ok ? "\u2713" : "\u2717"} ${report.url}${report.framed ? " (framed)" : ""} \xB7 "${report.title || "(no title)"}"`);
+  for (const r of report.viewports) {
+    const timing = `${(r.ms / 1e3).toFixed(1)} s${r.status ? `, HTTP ${r.status}` : ""}`;
+    lines.push(`${r.errors.length ? "\u2717" : "\u2713"} ${r.name} ${r.width}\xD7${r.height}: ${r.screenshot ?? "no screenshot"} (${timing})`);
+    for (const e of r.errors) lines.push(`    error: ${e}`);
+    for (const w of r.warnings.slice(0, 8)) lines.push(`    warn:  ${w}`);
+  }
+  lines.push(
+    report.ok ? "No problems found. Open the screenshots and check layout, legibility and overlap on both sizes." : "Fix every error above, reload the site, and run the check again. Open the screenshots either way."
+  );
+  return lines.join("\n");
+}
+async function runPreviewCheckCli(opts, io = { out: console.log, err: console.error }) {
+  const env = io.env ?? process.env;
+  const num = (raw, name, min, max) => {
+    if (raw === void 0) return void 0;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n < min || n > max) throw new PreviewCommandError(`${name} must be a whole number from ${min} to ${max}.`, CHECK_EXIT_USAGE);
+    return n;
+  };
+  try {
+    if (opts.port === void 0) throw new PreviewCommandError("--port <port> is required.", CHECK_EXIT_USAGE);
+    const result = await runSiteCheck({
+      port: parsePreviewPort(opts.port, env),
+      path: opts.path,
+      phone: opts.phone,
+      framed: opts.framed,
+      workspacePlaywright: opts.workspacePlaywright,
+      outDir: opts.out,
+      timeoutMs: num(opts.timeout, "--timeout", 1e3, 12e4),
+      waitMs: num(opts.wait, "--wait", 0, 3e4),
+      env
+    });
+    if (!result.report) {
+      if (opts.json) io.out(JSON.stringify({ ok: false, exitCode: result.code, error: result.message, skipped: result.code === CHECK_EXIT_NO_BROWSER }));
+      else io.err(result.message ?? "check failed");
+      return result.code;
+    }
+    io.out(opts.json ? JSON.stringify(result.report) : formatSiteCheck(result.report));
+    return result.code;
+  } catch (error) {
+    const known = error instanceof PreviewCommandError;
+    const code = known ? error.exitCode : CHECK_EXIT_INTERNAL;
+    const message = known ? firstLine(error) : `The check itself failed, so nothing was checked: ${firstLine(error)}`;
+    if (opts.json) io.out(JSON.stringify({ ok: false, exitCode: code, error: message, skipped: !known }));
+    else io.err(message);
+    return code;
+  }
+}
+function registerPreviewCheckCommand(preview) {
+  return preview.command("check").description(
+    "Load a local site in a headless browser and report its title, errors, failed requests and a blank page; writes desktop and phone screenshots (exit 1: problems, 2: nothing answering, 3: port not allowed, 4: no browser, 64: bad options, 70: the check itself failed)"
+  ).option("--port <port>", "Local port the site listens on (1024-65535)").option("--path <path>", "Path to load (default /); a ?query and #hash are fine").option("--phone", "Only the phone size (390\xD7844); default: desktop 1280\xD7800 and phone").option("--framed", "Load the site inside a frame on another origin, and report a site that refuses to be framed").option("--workspace-playwright", "Also look for Playwright in this project's node_modules (runs the project's own copy)").option("--out <dir>", "Folder for desktop.png and phone.png (default: a new private folder under the temp folder each run; the report names it)").option("--timeout <ms>", "Page load timeout in ms (default 30000)").option("--wait <ms>", "Extra settle time after load in ms (default 600)").option("--json", "Output JSON").action(async (opts) => {
+    process.exitCode = await runPreviewCheckCli(opts);
+  });
+}
+
 // src/api.ts
 init_config();
 init_errors();
 init_controller_fetch();
-import fs9 from "node:fs";
+import fs12 from "node:fs";
 function normalizeUrl5(raw) {
   const value = (raw ?? "").trim();
   if (!value) return "http://127.0.0.1:8788";
@@ -6652,7 +8339,7 @@ function parseHeader(raw) {
 }
 function parseJsonBody(options) {
   if (options.jsonFile) {
-    const raw = fs9.readFileSync(options.jsonFile, "utf8");
+    const raw = fs12.readFileSync(options.jsonFile, "utf8");
     const parsed = JSON.parse(raw);
     return JSON.stringify(parsed);
   }
@@ -6796,7 +8483,7 @@ async function requestControllerApi(options) {
 
 // src/conversations.ts
 init_project_manifest();
-import kleur10 from "kleur";
+import kleur11 from "kleur";
 var DEFAULT_CONVERSATION_LIMIT = 50;
 var DEFAULT_MESSAGE_LIMIT = 80;
 var MAX_LIMIT = 200;
@@ -7103,7 +8790,7 @@ async function buildSearchMatches(conversations, options) {
   }));
 }
 function formatConversationMatch(match) {
-  const lines = [`- ${kleur10.green(match.title)} (${match.id})`];
+  const lines = [`- ${kleur11.green(match.title)} (${match.id})`];
   const details = [];
   if (match.matchedIn.length > 0) {
     details.push(`match: ${match.matchedIn.join(", ")}`);
@@ -7115,7 +8802,7 @@ function formatConversationMatch(match) {
     lines.push(`  ${details.join(" \xB7 ")}`);
   }
   if (match.preview) {
-    lines.push(`  ${kleur10.gray(summarizeContent(match.preview))}`);
+    lines.push(`  ${kleur11.gray(summarizeContent(match.preview))}`);
   }
   return lines.join("\n");
 }
@@ -7174,16 +8861,16 @@ async function createConversation(options) {
     console.log(JSON.stringify(payload, null, 2));
     return;
   }
-  console.log(kleur10.green("Created conversation"));
-  console.log(`${kleur10.gray("ID:")} ${conversationId}`);
+  console.log(kleur11.green("Created conversation"));
+  console.log(`${kleur11.gray("ID:")} ${conversationId}`);
   if (title) {
-    console.log(`${kleur10.gray("Title:")} ${title}`);
+    console.log(`${kleur11.gray("Title:")} ${title}`);
   }
   if (parentConversationId) {
-    console.log(`${kleur10.gray("Parent:")} ${parentConversationId}`);
+    console.log(`${kleur11.gray("Parent:")} ${parentConversationId}`);
   }
   if (threadKind) {
-    console.log(`${kleur10.gray("Thread kind:")} ${threadKind}`);
+    console.log(`${kleur11.gray("Thread kind:")} ${threadKind}`);
   }
 }
 async function listConversations(options) {
@@ -7210,10 +8897,10 @@ async function listConversations(options) {
     return;
   }
   if (items.length === 0) {
-    console.log(kleur10.yellow("No conversations found for this space."));
+    console.log(kleur11.yellow("No conversations found for this space."));
     return;
   }
-  console.log(kleur10.green(`Conversations (${items.length})`));
+  console.log(kleur11.green(`Conversations (${items.length})`));
   for (const item of items) {
     console.log(formatConversationMatch({ ...item, score: 0, matchedIn: [] }));
   }
@@ -7235,10 +8922,10 @@ async function searchConversations(options) {
     return matches;
   }
   if (matches.length === 0) {
-    console.log(kleur10.yellow(`No conversations matched "${options.query}".`));
+    console.log(kleur11.yellow(`No conversations matched "${options.query}".`));
     return matches;
   }
-  console.log(kleur10.green(`Matches for "${options.query}"`));
+  console.log(kleur11.green(`Matches for "${options.query}"`));
   for (const match of matches.slice(0, Math.min(limit, matches.length))) {
     console.log(formatConversationMatch(match));
   }
@@ -7356,27 +9043,27 @@ async function showConversation(options) {
     );
     return;
   }
-  console.log(kleur10.green(selected.title));
-  console.log(`${kleur10.gray("ID:")} ${selected.id}`);
+  console.log(kleur11.green(selected.title));
+  console.log(`${kleur11.gray("ID:")} ${selected.id}`);
   if (selected.updatedAt) {
-    console.log(`${kleur10.gray("Updated:")} ${selected.updatedAt}`);
+    console.log(`${kleur11.gray("Updated:")} ${selected.updatedAt}`);
   }
   if (selected.preview) {
-    console.log(`${kleur10.gray("Preview:")} ${summarizeContent(selected.preview, 240)}`);
+    console.log(`${kleur11.gray("Preview:")} ${summarizeContent(selected.preview, 240)}`);
   }
   console.log("");
   if (transcript?.hasMore) {
-    console.log(kleur10.yellow(`Older rows remain; continue with --transcript --cursor ${transcript.nextCursor}.`));
+    console.log(kleur11.yellow(`Older rows remain; continue with --transcript --cursor ${transcript.nextCursor}.`));
   }
   if (messages.length === 0) {
-    console.log(kleur10.yellow(transcript ? "No transcript messages in the scanned rows." : "No messages found in this conversation."));
+    console.log(kleur11.yellow(transcript ? "No transcript messages in the scanned rows." : "No messages found in this conversation."));
     return;
   }
   for (const message of messages.slice().reverse()) {
     const role = (message.role ?? "unknown").trim().toLowerCase();
     const createdAt = trimOrNull(message.createdAt) ?? trimOrNull(message.created_at);
     const header = createdAt ? `${role} \xB7 ${createdAt}` : role;
-    console.log(kleur10.cyan(`[${header}${transcript ? ` \xB7 ${message.id}` : ""}]`));
+    console.log(kleur11.cyan(`[${header}${transcript ? ` \xB7 ${message.id}` : ""}]`));
     console.log(transcript ? message.content : summarizeContent(message.content ?? "", 4e3));
     console.log("");
   }
@@ -7473,9 +9160,9 @@ async function historyConversations(options) {
 
 // src/hardware-bindings.ts
 init_project_manifest();
-import fs10 from "node:fs";
-import path10 from "node:path";
-import kleur11 from "kleur";
+import fs13 from "node:fs";
+import path13 from "node:path";
+import kleur12 from "kleur";
 var SERIAL_HARDWARE_PROVIDER_ID = "hardware.serial";
 var DEFAULT_SERIAL_CAPABILITIES = [
   "hardware_serial_list",
@@ -7485,7 +9172,7 @@ var SUPPORTED_HARDWARE_CAPABILITIES = new Set(
   DEFAULT_SERIAL_CAPABILITIES
 );
 function resolveHardwareBindingContext(startDir) {
-  const lookup = findProjectManifest(path10.resolve(startDir));
+  const lookup = findProjectManifest(path13.resolve(startDir));
   if (!lookup.manifest || !lookup.path) {
     throw new Error(
       "Linked space manifest required. Run `instafy space init` in this folder or pass --path <dir>."
@@ -7495,17 +9182,17 @@ function resolveHardwareBindingContext(startDir) {
   if (!projectId2) {
     throw new Error("Linked space manifest is missing a spaceId.");
   }
-  const instafyDir = path10.dirname(lookup.path);
+  const instafyDir2 = path13.dirname(lookup.path);
   return {
-    bindingsPath: path10.join(instafyDir, "hardware-bindings.json"),
+    bindingsPath: path13.join(instafyDir2, "hardware-bindings.json"),
     projectId: projectId2
   };
 }
 function readHardwareBindingStore(bindingsPath) {
-  if (!fs10.existsSync(bindingsPath)) {
+  if (!fs13.existsSync(bindingsPath)) {
     return { version: 1, bindings: {} };
   }
-  const raw = JSON.parse(fs10.readFileSync(bindingsPath, "utf8"));
+  const raw = JSON.parse(fs13.readFileSync(bindingsPath, "utf8"));
   const bindings = raw && typeof raw.bindings === "object" && raw.bindings !== null ? raw.bindings : {};
   return {
     version: 1,
@@ -7513,8 +9200,8 @@ function readHardwareBindingStore(bindingsPath) {
   };
 }
 function writeHardwareBindingStore(bindingsPath, store) {
-  fs10.mkdirSync(path10.dirname(bindingsPath), { recursive: true });
-  fs10.writeFileSync(bindingsPath, JSON.stringify(store, null, 2), "utf8");
+  fs13.mkdirSync(path13.dirname(bindingsPath), { recursive: true });
+  fs13.writeFileSync(bindingsPath, JSON.stringify(store, null, 2), "utf8");
 }
 function normalizeCapabilities(providerId, values) {
   const requested = Array.isArray(values) && values.length > 0 ? values : providerId === SERIAL_HARDWARE_PROVIDER_ID ? DEFAULT_SERIAL_CAPABILITIES : [];
@@ -7542,18 +9229,18 @@ function normalizeDevices(values) {
     if (!trimmed) {
       continue;
     }
-    const resolved = path10.resolve(trimmed);
+    const resolved = path13.resolve(trimmed);
     unique.set(resolved, {
       kind: "serial_device",
       id: resolved,
       path: resolved,
-      displayName: path10.basename(resolved)
+      displayName: path13.basename(resolved)
     });
   }
   return [...unique.values()];
 }
 function printHardwareBinding(record2) {
-  console.log(kleur11.cyan(`Hardware provider: ${record2.providerId}`));
+  console.log(kleur12.cyan(`Hardware provider: ${record2.providerId}`));
   console.log(`Status: ${record2.status}`);
   console.log(`Project: ${record2.projectId}`);
   console.log(`Capabilities: ${record2.grantedCapabilities.join(", ") || "(none)"}`);
@@ -7599,10 +9286,10 @@ function showHardwareBinding(options) {
     return;
   }
   if (bindings.length === 0) {
-    console.log(kleur11.yellow("No hardware bindings recorded for this space."));
+    console.log(kleur12.yellow("No hardware bindings recorded for this space."));
     return;
   }
-  console.log(kleur11.cyan(`Hardware bindings for ${context.projectId}:`));
+  console.log(kleur12.cyan(`Hardware bindings for ${context.projectId}:`));
   for (const record2 of bindings) {
     console.log(`- ${record2.providerId} (${record2.status})`);
   }
@@ -7635,9 +9322,9 @@ function grantHardwareBinding(options) {
     console.log(JSON.stringify(record2));
     return;
   }
-  console.log(kleur11.green(`Hardware binding granted: ${providerId}`));
+  console.log(kleur12.green(`Hardware binding granted: ${providerId}`));
   printHardwareBinding(record2);
-  console.log(kleur11.cyan(`Stored at ${context.bindingsPath}`));
+  console.log(kleur12.cyan(`Stored at ${context.bindingsPath}`));
 }
 function revokeHardwareBinding(options) {
   const providerId = options.providerId.trim();
@@ -7656,12 +9343,12 @@ function revokeHardwareBinding(options) {
     console.log(JSON.stringify({ revoked: true, providerId }));
     return;
   }
-  console.log(kleur11.green(`Hardware binding revoked: ${providerId}`));
-  console.log(kleur11.cyan(`Updated ${context.bindingsPath}`));
+  console.log(kleur12.green(`Hardware binding revoked: ${providerId}`));
+  console.log(kleur12.cyan(`Updated ${context.bindingsPath}`));
 }
 
 // src/agents.ts
-import kleur12 from "kleur";
+import kleur13 from "kleur";
 init_project_manifest();
 var DEFAULT_CONTEXT_LIMIT = 50;
 var MAX_CONTEXT_LIMIT = 200;
@@ -7770,20 +9457,107 @@ async function agentsList(options) {
     return;
   }
   if (!agents.length) {
-    console.log(kleur12.yellow("No agents found."));
+    console.log(kleur13.yellow("No agents found."));
     return;
   }
-  console.log(kleur12.bold("Agents"));
+  console.log(kleur13.bold("Agents"));
   for (const agent of agents) {
     const provider = trimOrNull2(agent.provider);
     const model = trimOrNull2(agent.model);
     const details = [provider, model].filter(Boolean).join(" \xB7 ");
     console.log(
-      `- ${kleur12.cyan(`@${agent.handle}`)} ${displayName(agent)}${details ? ` (${details})` : ""}`
+      `- ${kleur13.cyan(`@${agent.handle}`)} ${displayName(agent)}${details ? ` (${details})` : ""}`
     );
     console.log(`  id: ${agent.id}`);
   }
 }
+var agentSettingFields = [
+  { key: "maxAgentsPerPlan", flag: "--max-agents-per-plan", label: "Maximum agents per plan" },
+  { key: "maxConcurrentAgents", flag: "--max-concurrent-agents", label: "Maximum concurrent team workers across this space" }
+];
+function parseAgentSetting(value, label) {
+  if (!/^[1-9]\d*$/.test(value.trim()) || !Number.isSafeInteger(Number(value))) {
+    throw new Error(`${label} must be a positive whole number.`);
+  }
+  return Number(value);
+}
+async function agentSettings(options) {
+  const patch = {};
+  for (const field of agentSettingFields) {
+    if (options[field.key] !== void 0) {
+      patch[field.key] = parseAgentSetting(options[field.key], field.flag);
+    }
+  }
+  if (options.interactive) {
+    if (options.json || Object.keys(patch).length) {
+      throw new Error("Use --interactive without --json or setting flags.");
+    }
+    if (!process.stdin.isTTY || !process.stdout.isTTY || process.env.CI === "true") {
+      throw new Error("--interactive requires a terminal. Use --max-agents-per-plan or --max-concurrent-agents instead.");
+    }
+  }
+  const projectId2 = resolveProjectId6(options.project);
+  const request = {
+    path: `/projects/${encodeURIComponent(projectId2)}/multi-agent-settings`,
+    controllerUrl: options.controllerUrl,
+    accessToken: options.accessToken,
+    serviceToken: options.serviceToken
+  };
+  let settings = await requestControllerApiJson({ ...request, method: "GET" });
+  if ((options.interactive || Object.keys(patch).length) && !settings.canManage) {
+    throw new Error("You do not have permission to manage this space's multi-agent settings.");
+  }
+  if (options.interactive) {
+    const { isCancel, text: text2 } = await import("@clack/prompts");
+    console.log("These settings are shared by everyone in this space. Runtime capacity can limit concurrency further; lead and root jobs are excluded.");
+    for (const field of agentSettingFields) {
+      const bounds = settings.limits[field.key];
+      const entered = await text2({
+        message: `${field.label} (${bounds.min}\u2013${bounds.max}; default ${bounds.default})`,
+        placeholder: String(settings[field.key]),
+        defaultValue: String(settings[field.key]),
+        validate(value2) {
+          try {
+            const parsed = parseAgentSetting(value2 || String(settings[field.key]), field.label);
+            if (parsed < bounds.min || parsed > bounds.max) {
+              return `Enter a whole number from ${bounds.min} to ${bounds.max}.`;
+            }
+          } catch (error) {
+            return error.message;
+          }
+        }
+      });
+      if (isCancel(entered)) throw new Error("Cancelled. No settings were changed.");
+      const value = parseAgentSetting(String(entered), field.label);
+      if (value !== settings[field.key]) patch[field.key] = value;
+    }
+  }
+  for (const field of agentSettingFields) {
+    const value = patch[field.key];
+    const bounds = settings.limits[field.key];
+    if (value !== void 0 && (value < bounds.min || value > bounds.max)) {
+      throw new Error(`${field.flag} must be between ${bounds.min} and ${bounds.max}.`);
+    }
+  }
+  if (Object.keys(patch).length) {
+    settings = await requestControllerApiJson({
+      ...request,
+      method: "PATCH",
+      jsonBody: patch
+    });
+  }
+  if (options.json) {
+    console.log(JSON.stringify(settings, null, 2));
+    return;
+  }
+  console.log(kleur13.bold(`Multi-agent settings for space ${projectId2}`));
+  for (const field of agentSettingFields) {
+    const bounds = settings.limits[field.key];
+    console.log(`${field.label}: ${settings[field.key]} (range ${bounds.min}\u2013${bounds.max}; default ${bounds.default})`);
+  }
+  console.log("Shared across this space. Lead/root jobs are excluded from the concurrent worker limit; runtime capacity can limit concurrency further.");
+  if (!settings.canManage) console.log("Read-only: your role cannot change these settings.");
+}
 async function agentContextsList(options) {
   const projectId2 = resolveProjectId6(options.project);
   const contexts = await requestControllerApiJson({
@@ -7799,15 +9573,15 @@ async function agentContextsList(options) {
     return;
   }
   if (!contexts.length) {
-    console.log(kleur12.yellow("No agent context cards found."));
+    console.log(kleur13.yellow("No agent context cards found."));
     return;
   }
-  console.log(kleur12.bold("Agent context"));
+  console.log(kleur13.bold("Agent context"));
   for (const card of contexts) {
     const title = trimOrNull2(card.title);
     const updatedAt = trimOrNull2(card.updatedAt) ?? trimOrNull2(card.updated_at);
     console.log(
-      `- ${kleur12.cyan(contextAgentLabel(card))} ${kleur12.gray(`[${contextScope(card)}]`)}${title ? ` ${title}` : ""}`
+      `- ${kleur13.cyan(contextAgentLabel(card))} ${kleur13.gray(`[${contextScope(card)}]`)}${title ? ` ${title}` : ""}`
     );
     console.log(`  ${summarize(card.context)}`);
     if (updatedAt) {
@@ -7844,7 +9618,7 @@ async function agentContextPut(options) {
     return;
   }
   console.log(
-    `${kleur12.green("Saved")} ${kleur12.cyan(contextAgentLabel(saved))} context for ${kleur12.gray(contextScope(saved))}.`
+    `${kleur13.green("Saved")} ${kleur13.cyan(contextAgentLabel(saved))} context for ${kleur13.gray(contextScope(saved))}.`
   );
 }
 function workerLabel(worker) {
@@ -7870,7 +9644,7 @@ async function agentPlanGroupStatus(options) {
     console.log(JSON.stringify(status, null, 2));
     return;
   }
-  console.log(kleur12.bold(`Plan group ${trimOrNull2(status.groupId) ?? groupId}`));
+  console.log(kleur13.bold(`Plan group ${trimOrNull2(status.groupId) ?? groupId}`));
   const conversationId = trimOrNull2(status.conversationId);
   if (conversationId) {
     console.log(`  conversation: ${conversationId}`);
@@ -7880,13 +9654,13 @@ async function agentPlanGroupStatus(options) {
   );
   const workers = status.workers ?? [];
   if (!workers.length) {
-    console.log(kleur12.yellow("No worker jobs found."));
+    console.log(kleur13.yellow("No worker jobs found."));
     return;
   }
   for (const worker of workers) {
     const marker = worker.terminal ? "terminal" : "running";
     const details = [trimOrNull2(worker.status) ?? "unknown", marker, trimOrNull2(worker.outcome)].filter(Boolean).join(" \xB7 ");
-    console.log(`- ${kleur12.cyan(workerLabel(worker))} ${kleur12.gray(`[${details}]`)}`);
+    console.log(`- ${kleur13.cyan(workerLabel(worker))} ${kleur13.gray(`[${details}]`)}`);
     const scope = trimOrNull2(worker.scopeSummary);
     if (scope) {
       console.log(`  scope: ${scope}`);
@@ -7897,7 +9671,7 @@ async function agentPlanGroupStatus(options) {
     }
     const errorMessage = trimOrNull2(worker.errorMessage);
     if (errorMessage) {
-      console.log(`  ${kleur12.red(`error: ${summarize(errorMessage)}`)}`);
+      console.log(`  ${kleur13.red(`error: ${summarize(errorMessage)}`)}`);
     }
   }
 }
@@ -7924,11 +9698,11 @@ async function agentJobsCancel(options) {
   const canceledJobs = result.canceledJobIds?.length ?? 0;
   const canceledRuns = result.canceledRunIds?.length ?? 0;
   if (!canceledJobs && !canceledRuns) {
-    console.log(kleur12.yellow(`Nothing to cancel for ${target} (no queued or leased jobs).`));
+    console.log(kleur13.yellow(`Nothing to cancel for ${target} (no queued or leased jobs).`));
     return;
   }
   console.log(
-    `${kleur12.green("Canceled")} ${canceledJobs} job(s) and ${canceledRuns} run(s) for ${target}.`
+    `${kleur13.green("Canceled")} ${canceledJobs} job(s) and ${canceledRuns} run(s) for ${target}.`
   );
 }
 
@@ -8080,7 +9854,7 @@ function isAssistantReplyCandidate(message, runId, options) {
   }
   return typeof message.content === "string" && message.content.trim().length > 0;
 }
-async function sleep(ms) {
+async function sleep2(ms) {
   await new Promise((resolve) => setTimeout(resolve, ms));
 }
 async function dispatchPrompt(options) {
@@ -8188,7 +9962,7 @@ async function waitForAssistantReply(conversationId, runId, options) {
         break;
       }
     }
-    await sleep(pollMs);
+    await sleep2(pollMs);
   }
   const finalMessages = await fetchConversationMessages2(conversationId, options);
   const assistant = findLatestAssistantReply(finalMessages, runId, options);
@@ -8234,8 +10008,8 @@ async function chatPrompt(options) {
 }
 
 // src/recommendations.ts
-import fs11 from "node:fs";
-import path11 from "node:path";
+import fs14 from "node:fs";
+import path14 from "node:path";
 init_project_manifest();
 var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var MAX_FILE_BYTES = 65536;
@@ -8264,26 +10038,26 @@ function text(value, label, max) {
 }
 function readProposalFile(file) {
   const manifestPath = findProjectManifest(process.cwd()).path;
-  const root = fs11.realpathSync(manifestPath ? path11.dirname(path11.dirname(manifestPath)) : process.cwd());
-  const selected = path11.resolve(file);
-  const canonical = path11.join(fs11.realpathSync(path11.dirname(selected)), path11.basename(selected));
-  const relative = path11.relative(root, canonical);
-  if (relative === ".." || relative.startsWith(`..${path11.sep}`) || path11.isAbsolute(relative)) {
+  const root = fs14.realpathSync(manifestPath ? path14.dirname(path14.dirname(manifestPath)) : process.cwd());
+  const selected = path14.resolve(file);
+  const canonical = path14.join(fs14.realpathSync(path14.dirname(selected)), path14.basename(selected));
+  const relative = path14.relative(root, canonical);
+  if (relative === ".." || relative.startsWith(`..${path14.sep}`) || path14.isAbsolute(relative)) {
     throw new Error("Recommendation file must stay inside the active Instafy workspace.");
   }
-  const initial = fs11.lstatSync(canonical);
+  const initial = fs14.lstatSync(canonical);
   if (!initial.isFile() || initial.isSymbolicLink()) throw new Error("Recommendation file must be a regular file, not a symlink.");
-  const descriptor = fs11.openSync(canonical, fs11.constants.O_RDONLY | (fs11.constants.O_NOFOLLOW ?? 0));
+  const descriptor = fs14.openSync(canonical, fs14.constants.O_RDONLY | (fs14.constants.O_NOFOLLOW ?? 0));
   let bytes;
   try {
-    const opened = fs11.fstatSync(descriptor);
+    const opened = fs14.fstatSync(descriptor);
     if (!opened.isFile() || opened.dev !== initial.dev || opened.ino !== initial.ino || opened.size > MAX_FILE_BYTES) {
       throw new Error(`Recommendation file must be a regular file no larger than ${MAX_FILE_BYTES} bytes.`);
     }
-    bytes = fs11.readFileSync(descriptor);
+    bytes = fs14.readFileSync(descriptor);
     if (bytes.length > MAX_FILE_BYTES) throw new Error(`Recommendation file must be ${MAX_FILE_BYTES} bytes or smaller.`);
   } finally {
-    fs11.closeSync(descriptor);
+    fs14.closeSync(descriptor);
   }
   return bytes;
 }
@@ -8615,11 +10389,11 @@ async function showConversationContext(options) {
 }
 
 // src/invitations.ts
-import kleur13 from "kleur";
-import path12 from "node:path";
+import kleur14 from "kleur";
+import path15 from "node:path";
 init_project_manifest();
 function resolveStartDir(rawPath) {
-  return path12.resolve(rawPath ?? process.cwd());
+  return path15.resolve(rawPath ?? process.cwd());
 }
 function trimOrNull3(value) {
   const trimmed = value?.trim() ?? "";
@@ -8761,7 +10535,7 @@ async function inviteSpaceMember(options) {
     return normalized;
   }
   const scopeLabel = orgName ? `${orgName}` : "this space";
-  console.log(kleur13.green(`Invitation sent to ${normalized.email}`));
+  console.log(kleur14.green(`Invitation sent to ${normalized.email}`));
   console.log(`Scope: ${scopeLabel}`);
   console.log(`Role: ${normalized.role}`);
   if (normalized.expiresAt) {
@@ -8821,7 +10595,7 @@ async function setSpaceMemberRole(options) {
       return normalized;
     }
     console.log(
-      kleur13.green(
+      kleur14.green(
         normalized.status === "updated" ? `Updated ${normalized.email} to ${normalized.role}` : `${normalized.email} already has role ${normalized.role}`
       )
     );
@@ -8860,7 +10634,7 @@ async function setSpaceMemberRole(options) {
       return normalized;
     }
     console.log(
-      kleur13.green(
+      kleur14.green(
         normalized.status === "updated" ? `Updated pending invite for ${normalized.email} to ${normalized.role}` : `Pending invite for ${normalized.email} already has role ${normalized.role}`
       )
     );
@@ -8910,7 +10684,7 @@ async function sendSpaceInvitation(options) {
 init_config();
 init_controller_fetch();
 init_errors();
-import kleur14 from "kleur";
+import kleur15 from "kleur";
 var DEFAULT_STUDIO_URL = "https://instafy.dev";
 var ORG_ROLES = ["owner", "admin", "builder", "viewer"];
 var INVITE_LINK_ROLES = ["builder", "viewer"];
@@ -9065,7 +10839,7 @@ function printTable(headers, rows) {
     (header, index) => Math.max(header.length, ...rows.map((row) => (row[index] ?? "").length))
   );
   const format = (cells) => cells.map((cell, index) => (cell ?? "").padEnd(widths[index])).join("  ").trimEnd();
-  console.log(kleur14.bold(format(headers)));
+  console.log(kleur15.bold(format(headers)));
   for (const row of rows) {
     console.log(format(row));
   }
@@ -9094,7 +10868,7 @@ async function teamMembersList(options) {
     return;
   }
   if (members.length === 0) {
-    console.log(kleur14.gray("No members."));
+    console.log(kleur15.gray("No members."));
     return;
   }
   const rows = members.map((member) => [
@@ -9150,7 +10924,7 @@ If they already have an Instafy account, add them directly with:
     );
     return;
   }
-  console.log(kleur14.green(`Invitation sent to ${invitation.email}`));
+  console.log(kleur15.green(`Invitation sent to ${invitation.email}`));
   console.log(`Role: ${invitation.role}`);
   if (invitation.expiresAt) {
     console.log(`Expires: ${invitation.expiresAt}`);
@@ -9181,7 +10955,7 @@ async function teamInviteLink(options) {
     console.log(JSON.stringify({ inviteLink, acceptUrl }, null, 2));
     return;
   }
-  console.log(kleur14.green("Shareable invite link created."));
+  console.log(kleur15.green("Shareable invite link created."));
   console.log(`Role: ${inviteLink.role}`);
   console.log(`Link: ${acceptUrl}`);
   console.log(`Token: ${inviteLink.token}`);
@@ -9213,11 +10987,11 @@ async function teamInvites(options) {
     return;
   }
   if (invitations.length === 0 && inviteLinks.length === 0) {
-    console.log(kleur14.gray("No pending invitations or invite links."));
+    console.log(kleur15.gray("No pending invitations or invite links."));
     return;
   }
   if (invitations.length > 0) {
-    console.log(kleur14.bold("Email invitations"));
+    console.log(kleur15.bold("Email invitations"));
     const rows = invitations.map((invitation) => [
       shortId(invitation.id),
       invitation.email,
@@ -9228,7 +11002,7 @@ async function teamInvites(options) {
   }
   if (inviteLinks.length > 0) {
     if (invitations.length > 0) console.log("");
-    console.log(kleur14.bold("Invite links (shareable, grant join on sign-in)"));
+    console.log(kleur15.bold("Invite links (shareable, grant join on sign-in)"));
     const rows = inviteLinks.map((link) => [
       shortId(link.id),
       link.role,
@@ -9259,7 +11033,7 @@ async function teamAddMember(options) {
     return;
   }
   const label = (member.email ?? "").trim() || member.userId;
-  console.log(kleur14.green(`Added ${label} as ${member.role}.`));
+  console.log(kleur15.green(`Added ${label} as ${member.role}.`));
 }
 async function teamAccept(options) {
   const auth = resolveControllerAuth4(options, "instafy team accept");
@@ -9274,7 +11048,7 @@ async function teamAccept(options) {
     return;
   }
   const name = (payload?.orgName ?? "").trim() || payload?.orgSlug || payload?.orgId || "team";
-  console.log(kleur14.green(`Joined ${name} as ${payload?.role ?? "member"}.`));
+  console.log(kleur15.green(`Joined ${name} as ${payload?.role ?? "member"}.`));
 }
 async function confirmDestructive(message, yes, json) {
   if (yes) return;
@@ -9308,7 +11082,7 @@ async function teamRevokeInvite(options) {
     console.log(JSON.stringify({ ok: true, invitationId }, null, 2));
     return;
   }
-  console.log(kleur14.green(`Revoked invitation ${invitationId}.`));
+  console.log(kleur15.green(`Revoked invitation ${invitationId}.`));
 }
 async function teamRevokeLink(options) {
   const auth = resolveControllerAuth4(options, "instafy team revoke-link");
@@ -9327,17 +11101,17 @@ async function teamRevokeLink(options) {
     console.log(JSON.stringify({ ok: true, inviteLinkId }, null, 2));
     return;
   }
-  console.log(kleur14.green(`Revoked invite link ${inviteLinkId}.`));
+  console.log(kleur15.green(`Revoked invite link ${inviteLinkId}.`));
 }
 
 // src/provider-bindings.ts
 init_project_manifest();
-import fs12 from "node:fs";
-import path13 from "node:path";
-import { pathToFileURL } from "node:url";
-import kleur15 from "kleur";
+import fs15 from "node:fs";
+import path16 from "node:path";
+import { pathToFileURL as pathToFileURL2 } from "node:url";
+import kleur16 from "kleur";
 function resolveBindingContext(startDir) {
-  const lookup = findProjectManifest(path13.resolve(startDir));
+  const lookup = findProjectManifest(path16.resolve(startDir));
   if (!lookup.manifest || !lookup.path) {
     throw new Error(
       "Linked space manifest required. Run `instafy space init` in this folder or pass --path <dir>."
@@ -9347,19 +11121,19 @@ function resolveBindingContext(startDir) {
   if (!projectId2) {
     throw new Error("Linked space manifest is missing a spaceId.");
   }
-  const instafyDir = path13.dirname(lookup.path);
-  const projectRoot = path13.dirname(instafyDir);
+  const instafyDir2 = path16.dirname(lookup.path);
+  const projectRoot = path16.dirname(instafyDir2);
   return {
-    bindingsPath: path13.join(instafyDir, "provider-bindings.json"),
+    bindingsPath: path16.join(instafyDir2, "provider-bindings.json"),
     projectId: projectId2,
     projectRoot
   };
 }
 function readBindingStore(bindingsPath) {
-  if (!fs12.existsSync(bindingsPath)) {
+  if (!fs15.existsSync(bindingsPath)) {
     return { version: 1, bindings: {} };
   }
-  const raw = JSON.parse(fs12.readFileSync(bindingsPath, "utf8"));
+  const raw = JSON.parse(fs15.readFileSync(bindingsPath, "utf8"));
   const bindings = raw && typeof raw.bindings === "object" && raw.bindings !== null ? raw.bindings : {};
   return {
     version: 1,
@@ -9367,8 +11141,8 @@ function readBindingStore(bindingsPath) {
   };
 }
 function writeBindingStore(bindingsPath, store) {
-  fs12.mkdirSync(path13.dirname(bindingsPath), { recursive: true });
-  fs12.writeFileSync(bindingsPath, JSON.stringify(store, null, 2), "utf8");
+  fs15.mkdirSync(path16.dirname(bindingsPath), { recursive: true });
+  fs15.writeFileSync(bindingsPath, JSON.stringify(store, null, 2), "utf8");
 }
 function normalizeCapabilities2(values) {
   const requested = Array.isArray(values) && values.length > 0 ? values : ["project_content_read", "project_content_write"];
@@ -9391,7 +11165,7 @@ function deriveStatus(capabilities) {
   return "bound_read_only";
 }
 function printBinding(record2) {
-  console.log(kleur15.cyan(`Provider: ${record2.providerId}`));
+  console.log(kleur16.cyan(`Provider: ${record2.providerId}`));
   console.log(`Status: ${record2.status}`);
   console.log(`Project: ${record2.projectId}`);
   console.log(`Root URI: ${record2.rootUri}`);
@@ -9433,10 +11207,10 @@ function showProviderBinding(options) {
     return;
   }
   if (bindings.length === 0) {
-    console.log(kleur15.yellow("No provider bindings recorded for this space."));
+    console.log(kleur16.yellow("No provider bindings recorded for this space."));
     return;
   }
-  console.log(kleur15.cyan(`Bindings for ${context.projectId}:`));
+  console.log(kleur16.cyan(`Bindings for ${context.projectId}:`));
   for (const record2 of bindings) {
     console.log(`- ${record2.providerId} (${record2.status})`);
   }
@@ -9454,7 +11228,7 @@ function grantProviderBinding(options) {
   const record2 = {
     providerId,
     projectId: context.projectId,
-    rootUri: pathToFileURL(context.projectRoot).toString(),
+    rootUri: pathToFileURL2(context.projectRoot).toString(),
     grantedCapabilities: capabilities,
     grantedPrefix: options.prefix?.trim() || `.instafy/providers/${providerId}/`,
     purpose: options.purpose?.trim() || null,
@@ -9468,9 +11242,9 @@ function grantProviderBinding(options) {
     console.log(JSON.stringify(record2));
     return;
   }
-  console.log(kleur15.green(`Provider binding granted: ${providerId}`));
+  console.log(kleur16.green(`Provider binding granted: ${providerId}`));
   printBinding(record2);
-  console.log(kleur15.cyan(`Stored at ${context.bindingsPath}`));
+  console.log(kleur16.cyan(`Stored at ${context.bindingsPath}`));
 }
 function revokeProviderBinding(options) {
   const providerId = options.providerId.trim();
@@ -9489,12 +11263,12 @@ function revokeProviderBinding(options) {
     console.log(JSON.stringify({ revoked: true, providerId }));
     return;
   }
-  console.log(kleur15.green(`Provider binding revoked: ${providerId}`));
-  console.log(kleur15.cyan(`Updated ${context.bindingsPath}`));
+  console.log(kleur16.green(`Provider binding revoked: ${providerId}`));
+  console.log(kleur16.cyan(`Updated ${context.bindingsPath}`));
 }
 
 // src/providers.ts
-import kleur16 from "kleur";
+import kleur17 from "kleur";
 
 // ../provider-client/index.js
 var DEFAULT_PROVIDER_HOST_BASE_URL = "http://127.0.0.1:8797";
@@ -9566,12 +11340,12 @@ function resolveFetchImplementation(fetchImpl) {
 function createProviderHostClient(options = {}) {
   const fetchImpl = resolveFetchImplementation(options.fetch);
   const baseUrl = normalizeProviderHostBaseUrl(options.baseUrl);
-  async function jsonRequest(path16, init) {
-    const response = await fetchImpl(`${baseUrl}${path16}`, init);
+  async function jsonRequest(path19, init) {
+    const response = await fetchImpl(`${baseUrl}${path19}`, init);
     const json = await response.json();
     if (!response.ok || json?.ok === false) {
       throw new Error(
-        json?.error || json?.stderr || `provider host request failed for ${path16}`
+        json?.error || json?.stderr || `provider host request failed for ${path19}`
       );
     }
     return json;
@@ -9664,7 +11438,7 @@ function formatProviderLabel(provider) {
   return provider.title?.trim().length ? provider.title.trim() : provider.id;
 }
 function printProviderSummary(provider) {
-  console.log(kleur16.green(formatProviderLabel(provider)));
+  console.log(kleur17.green(formatProviderLabel(provider)));
   console.log(`  id: ${provider.id}`);
   if (provider.description) {
     console.log(`  description: ${provider.description}`);
@@ -9676,7 +11450,7 @@ function printProviderSummary(provider) {
     console.log(`  type: ${provider.providerType}`);
   }
   console.log(
-    `  discoverable: ${provider.discoverable !== false ? kleur16.green("yes") : kleur16.yellow("no")}`
+    `  discoverable: ${provider.discoverable !== false ? kleur17.green("yes") : kleur17.yellow("no")}`
   );
   if (provider.capabilityIds?.length) {
     console.log(`  capabilities: ${provider.capabilityIds.join(", ")}`);
@@ -9688,7 +11462,7 @@ function printProviderSummary(provider) {
     console.log(`  resources: ${provider.resourceUris.join(", ")}`);
   }
   if (provider.error) {
-    console.log(`  error: ${kleur16.yellow(provider.error)}`);
+    console.log(`  error: ${kleur17.yellow(provider.error)}`);
   }
 }
 function parseCommandJson(commandJson) {
@@ -9708,10 +11482,10 @@ async function providersList(options = {}) {
     });
     return;
   }
-  console.log(kleur16.green("Local providers"));
+  console.log(kleur17.green("Local providers"));
   console.log(`Host: ${providerHostUrl}`);
   if (!result.providers.length) {
-    console.log(kleur16.yellow("No providers discovered."));
+    console.log(kleur17.yellow("No providers discovered."));
     return;
   }
   for (const provider of result.providers) {
@@ -9728,7 +11502,7 @@ async function providersDiscover(params) {
     });
     return;
   }
-  console.log(kleur16.green(`Provider discovery: ${params.providerId}`));
+  console.log(kleur17.green(`Provider discovery: ${params.providerId}`));
   console.log(`Host: ${providerHostUrl}`);
   console.log(JSON.stringify(result.provider ?? result, null, 2));
 }
@@ -9742,10 +11516,10 @@ async function providersRead(params) {
     });
     return;
   }
-  console.log(kleur16.green(`Provider resource: ${params.uri}`));
+  console.log(kleur17.green(`Provider resource: ${params.uri}`));
   console.log(`Host: ${providerHostUrl}`);
   if (result.exists === false) {
-    console.log(kleur16.yellow("Resource does not exist."));
+    console.log(kleur17.yellow("Resource does not exist."));
     return;
   }
   console.log(JSON.stringify(result.value ?? result, null, 2));
@@ -9771,7 +11545,7 @@ async function providersProbe(params) {
     });
     return;
   }
-  console.log(kleur16.green(`Provider transport probe: ${params.providerId}`));
+  console.log(kleur17.green(`Provider transport probe: ${params.providerId}`));
   console.log(`Host: ${providerHostUrl}`);
   console.log(JSON.stringify(result, null, 2));
 }
@@ -9873,9 +11647,9 @@ async function diagnosticsRunResult(options) {
 }
 
 // src/support.ts
-import fs13 from "node:fs";
+import fs16 from "node:fs";
 import { randomUUID as randomUUID3 } from "node:crypto";
-import path14 from "node:path";
+import path17 from "node:path";
 init_project_manifest();
 var MAX_SUMMARY_CHARS = 500;
 var MAX_DETAILS_BYTES = 2e4;
@@ -9924,34 +11698,34 @@ function requiredCursorUuid(value, flag) {
   return id;
 }
 function readRegularFile(filePath, maxBytes, label) {
-  const resolved = path14.resolve(filePath);
+  const resolved = path17.resolve(filePath);
   const manifestPath = findProjectManifest(process.cwd()).path;
-  const workspaceRoot = manifestPath ? path14.dirname(path14.dirname(manifestPath)) : process.cwd();
-  const canonicalRoot = fs13.realpathSync(workspaceRoot);
-  const canonicalParent = fs13.realpathSync(path14.dirname(resolved));
-  const canonicalTarget = path14.join(canonicalParent, path14.basename(resolved));
-  const relativeTarget = path14.relative(canonicalRoot, canonicalTarget);
-  if (relativeTarget === ".." || relativeTarget.startsWith(`..${path14.sep}`) || path14.isAbsolute(relativeTarget)) {
+  const workspaceRoot = manifestPath ? path17.dirname(path17.dirname(manifestPath)) : process.cwd();
+  const canonicalRoot = fs16.realpathSync(workspaceRoot);
+  const canonicalParent = fs16.realpathSync(path17.dirname(resolved));
+  const canonicalTarget = path17.join(canonicalParent, path17.basename(resolved));
+  const relativeTarget = path17.relative(canonicalRoot, canonicalTarget);
+  if (relativeTarget === ".." || relativeTarget.startsWith(`..${path17.sep}`) || path17.isAbsolute(relativeTarget)) {
     throw new Error(`${label} must stay inside the active Instafy workspace.`);
   }
-  const initialStat = fs13.lstatSync(canonicalTarget);
+  const initialStat = fs16.lstatSync(canonicalTarget);
   if (initialStat.isSymbolicLink() || !initialStat.isFile()) {
     throw new Error(`${label} must be a regular file, not a symlink.`);
   }
-  const noFollow = typeof fs13.constants.O_NOFOLLOW === "number" ? fs13.constants.O_NOFOLLOW : 0;
-  const descriptor = fs13.openSync(canonicalTarget, fs13.constants.O_RDONLY | noFollow);
+  const noFollow = typeof fs16.constants.O_NOFOLLOW === "number" ? fs16.constants.O_NOFOLLOW : 0;
+  const descriptor = fs16.openSync(canonicalTarget, fs16.constants.O_RDONLY | noFollow);
   try {
-    const openedStat = fs13.fstatSync(descriptor);
+    const openedStat = fs16.fstatSync(descriptor);
     if (!openedStat.isFile() || openedStat.dev !== initialStat.dev || openedStat.ino !== initialStat.ino || openedStat.size > maxBytes) {
       throw new Error(`${label} must be a regular file no larger than ${maxBytes} bytes.`);
     }
-    const bytes = fs13.readFileSync(descriptor);
+    const bytes = fs16.readFileSync(descriptor);
     if (bytes.length > maxBytes) {
       throw new Error(`${label} must be ${maxBytes} bytes or smaller.`);
     }
     return bytes;
   } finally {
-    fs13.closeSync(descriptor);
+    fs16.closeSync(descriptor);
   }
 }
 function readJsonFile(filePath, maxBytes, label) {
@@ -10025,7 +11799,7 @@ function resolveScreenshots(filePaths = []) {
       );
     }
     return {
-      fileName: path14.basename(filePath),
+      fileName: path17.basename(filePath),
       mediaType,
       dataBase64: bytes.toString("base64"),
       byteLength: bytes.length
@@ -10423,7 +12197,7 @@ function failWithGroupHelp(command) {
     process.exitCode = 1;
   });
 }
-var require4 = createRequire3(import.meta.url);
+var require4 = createRequire4(import.meta.url);
 var pkg = require4("../package.json");
 function addServerUrlOptions(command) {
   return command.option(
@@ -10508,7 +12282,7 @@ program.command("login").description("Log in and save an access token for future
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -10516,7 +12290,7 @@ program.command("logout").description("Clear the saved CLI access token").option
   try {
     await logout({ json: opts.json, profile: opts.profile });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -10540,7 +12314,7 @@ chatCommand.option("--json", "Output JSON").action(async (promptParts, opts) =>
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -10564,7 +12338,7 @@ function registerSpaceCommand(command) {
         json: opts.json
       });
     } catch (error) {
-      console.error(kleur19.red(String(error)));
+      console.error(kleur20.red(String(error)));
       process.exit(1);
     }
   });
@@ -10580,7 +12354,7 @@ function registerSpaceCommand(command) {
         json: opts.json
       });
     } catch (error) {
-      console.error(kleur19.red(String(error)));
+      console.error(kleur20.red(String(error)));
       process.exit(1);
     }
   });
@@ -10594,7 +12368,7 @@ function registerSpaceCommand(command) {
         json: opts.json
       });
     } catch (error) {
-      console.error(kleur19.red(String(error)));
+      console.error(kleur20.red(String(error)));
       process.exit(1);
     }
   });
@@ -10617,7 +12391,7 @@ function registerSpaceCommand(command) {
         json: opts.json
       });
     } catch (error) {
-      console.error(kleur19.red(String(error)));
+      console.error(kleur20.red(String(error)));
       process.exit(1);
     }
   });
@@ -10629,7 +12403,7 @@ function registerSpaceCommand(command) {
         json: opts.json
       });
     } catch (error) {
-      console.error(kleur19.red(String(error)));
+      console.error(kleur20.red(String(error)));
       process.exit(1);
     }
   });
@@ -10651,7 +12425,7 @@ function registerSpaceCommand(command) {
         json: opts.json
       });
     } catch (error) {
-      console.error(kleur19.red(String(error)));
+      console.error(kleur20.red(String(error)));
       process.exit(1);
     }
   });
@@ -10667,7 +12441,7 @@ function registerSpaceCommand(command) {
         json: opts.json
       });
     } catch (error) {
-      console.error(kleur19.red(String(error)));
+      console.error(kleur20.red(String(error)));
       process.exit(1);
     }
   });
@@ -10693,7 +12467,7 @@ function registerSpaceCommand(command) {
         json: opts.json
       });
     } catch (error) {
-      console.error(kleur19.red(String(error)));
+      console.error(kleur20.red(String(error)));
       process.exit(1);
     }
   });
@@ -10718,7 +12492,7 @@ function registerSpaceCommand(command) {
         json: opts.json
       });
     } catch (error) {
-      console.error(kleur19.red(String(error)));
+      console.error(kleur20.red(String(error)));
       process.exit(1);
     }
   });
@@ -10738,7 +12512,7 @@ hardwareBindingsCommand.command("show").description("Show hardware bindings for
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -10758,7 +12532,7 @@ hardwareBindingsCommand.command("grant").description("Grant a local hardware pro
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -10770,7 +12544,7 @@ hardwareBindingsCommand.command("revoke").description("Revoke a local hardware b
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -10784,7 +12558,7 @@ hardwareSerialCommand.command("list").description("List local serial devices vis
       scanDirs: opts.scanDir
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -10796,7 +12570,7 @@ hardwareSerialCommand.command("probe").description("Probe host permissions for o
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -10808,7 +12582,7 @@ hardwareCommand.command("opportunities").description("List host-local IO opportu
       scanDirs: opts.scanDir
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -10821,7 +12595,7 @@ hardwareCommand.command("run").description("Run one available host-local IO acti
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -10836,7 +12610,7 @@ providersListCommand.option("--json", "Output JSON").action(async (opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -10850,7 +12624,7 @@ providersDiscoverCommand.option("--json", "Output JSON").action(async (providerI
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -10865,7 +12639,7 @@ providersReadCommand.option("--json", "Output JSON").action(async (providerId, u
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -10888,7 +12662,7 @@ providersProbeCommand.option("--json", "Output JSON").action(async (providerId,
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -10908,7 +12682,7 @@ for (const operation of ["list", "submit"]) {
       if (operation === "list") await recommendationsList({ ...common, limit: opts.limit });
       else await recommendationsSubmit({ ...common, file: opts.file });
     } catch (error) {
-      console.error(kleur19.red(String(error)));
+      console.error(kleur20.red(String(error)));
       process.exit(1);
     }
   });
@@ -10932,13 +12706,33 @@ for (const operation of ["current", "dismiss", "remind"]) {
       else if (operation === "dismiss") await recommendationsDismiss(common);
       else await recommendationsRemind({ ...common, at: opts.at, timezone: opts.timezone });
     } catch (error) {
-      console.error(kleur19.red(String(error)));
+      console.error(kleur20.red(String(error)));
       process.exit(1);
     }
   });
 }
-var agentsCommand = program.command("agents").description("Inspect agents and scoped agent context");
+var agentsCommand = program.command("agents").description("Inspect agents, shared multi-agent settings, and scoped agent context");
 failWithGroupHelp(agentsCommand);
+var agentsSettingsCommand = agentsCommand.command("settings").description("Inspect or change the space's shared multi-agent planning and concurrency limits");
+addSpaceOption(agentsSettingsCommand, "Space UUID (defaults to .instafy/space.json or SPACE_ID)");
+addServerUrlOptions(agentsSettingsCommand);
+addAccessTokenOptions(agentsSettingsCommand, "Instafy access token");
+agentsSettingsCommand.option("--max-agents-per-plan <n>", "Set the maximum team workers in one plan (default: 64; range: 1\u2013256)").option("--max-concurrent-agents <n>", "Set the maximum running team workers across this space (default: 8; range: 1\u201364)").option("--interactive", "Interactively edit both shared settings").option("--json", "Output JSON (noninteractive)").action(async (opts) => {
+  try {
+    await agentSettings({
+      project: resolveSpaceIdOption(opts),
+      controllerUrl: opts.serverUrl,
+      accessToken: opts.accessToken,
+      maxAgentsPerPlan: opts.maxAgentsPerPlan,
+      maxConcurrentAgents: opts.maxConcurrentAgents,
+      interactive: opts.interactive,
+      json: opts.json
+    });
+  } catch (error) {
+    console.error(kleur20.red(String(error)));
+    process.exit(1);
+  }
+});
 var agentsListCommand = agentsCommand.command("list").description("List agents available to this account");
 addSpaceOption(
   agentsListCommand,
@@ -10955,7 +12749,7 @@ agentsListCommand.option("--json", "Output JSON").action(async (opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -10983,7 +12777,7 @@ agentsContextListCommand.option("--agent <handle>", "Filter by agent handle (for
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11009,7 +12803,7 @@ agentsContextPutCommand.action(async (contextParts, opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11025,7 +12819,7 @@ agentsStatusCommand.option("--json", "Output JSON").action(async (groupId, opts)
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11043,7 +12837,7 @@ agentsCancelCommand.option("--json", "Output JSON").action(async (opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11065,7 +12859,7 @@ secretsListCommand.option("--json", "Output JSON").action(async (opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11086,7 +12880,7 @@ secretsGetCommand.option("--json", "Output JSON").action(async (nameOrId, opts)
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11111,7 +12905,7 @@ secretsPutCommand.option("--json", "Output JSON").action(async (name, opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11132,7 +12926,7 @@ secretsRevokeCommand.option("--json", "Output JSON").action(async (nameOrId, opt
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11166,7 +12960,7 @@ automationsListCommand.option("--json", "Output JSON").action(async (opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11212,7 +13006,7 @@ automationsCreateCommand.option("--json", "Output JSON").action(async (opts) =>
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11258,7 +13052,7 @@ automationsUpdateCommand.option("--json", "Output JSON").action(async (automatio
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11275,7 +13069,7 @@ automationsPauseCommand.option("--json", "Output JSON").action(async (automation
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11292,7 +13086,7 @@ automationsResumeCommand.option("--json", "Output JSON").action(async (automatio
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11308,7 +13102,7 @@ automationsRunCommand.option("--json", "Output JSON").action(async (automationId
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11324,7 +13118,7 @@ automationsDeleteCommand.option("--json", "Output JSON").action(async (automatio
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11342,7 +13136,7 @@ credentialsListCommand.option("--json", "Output JSON").action(async (opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11361,7 +13155,7 @@ credentialsTestCommand.option("--json", "Output JSON").action(async (idOrPrefix,
       process.exitCode = 1;
     }
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11392,7 +13186,7 @@ credentialsDefaultCommand.option("--json", "Output JSON").action(async (idOrPref
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11409,7 +13203,7 @@ credentialsRevokeCommand.option("--json", "Output JSON").action(async (idOrPrefi
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11419,7 +13213,7 @@ configCommand.command("path").description("Print the config file path").option("
   try {
     configPath({ json: opts.json });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11427,7 +13221,7 @@ configCommand.command("list").description("List saved configuration").option("--
   try {
     configList({ json: opts.json });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11435,7 +13229,7 @@ configCommand.command("get").description("Get a config value (controller-url, st
   try {
     configGet({ key, json: opts.json });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11443,7 +13237,7 @@ configCommand.command("set").description("Set a config value (controller-url, st
   try {
     configSet({ key, value, json: opts.json });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11451,7 +13245,7 @@ configCommand.command("unset").description("Unset a config value (controller-url
   try {
     configUnset({ key, json: opts.json });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11471,7 +13265,7 @@ runtimeStartCommand.option("--supabase-access-token <token>", "Supabase session
       controllerAccessToken: opts.accessToken
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11479,7 +13273,7 @@ runtimeCommand.command("status").description("Show runtime health").option("--js
   try {
     await runtimeStatus({ json: opts.json });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11487,7 +13281,7 @@ runtimeCommand.command("stop").description("Stop the local Instafy runtime").opt
   try {
     await runtimeStop({ json: opts.json });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11513,7 +13307,7 @@ runtimeTokenCommand.option("--runtime-id <uuid>", "Runtime ID to bind token to")
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11535,7 +13329,7 @@ diagnosticsRuntimeEventsCommand.action(async (opts) => {
       accessToken: opts.accessToken
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11550,7 +13344,7 @@ diagnosticsRunResultCommand.action(async (runId, opts) => {
       accessToken: opts.accessToken
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11588,7 +13382,7 @@ supportReportCommand.action(async (summaryParts, opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11623,7 +13417,7 @@ supportListCommand.action(async (opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11639,7 +13433,7 @@ supportShowCommand.action(async (reportId, opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11664,7 +13458,7 @@ supportMessagesCommand.action(async (reportId, opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11685,11 +13479,12 @@ supportReplyCommand.action(async (reportId, messageParts, opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
 program.command("git").description("Run git against the Instafy canonical checkout (.instafy/.git)").allowUnknownOption(true);
+program.command("bind").description("Bound sites: serve a website whose clicks run scripts and stream records back to every viewer (instafy-bind)").allowUnknownOption(true);
 var tunnelCommand = program.command("tunnel").description("Create and manage shareable tunnels");
 failWithGroupHelp(tunnelCommand);
 var tunnelStartCommand = tunnelCommand.command("start").description("Create (or reuse) a shareable tunnel URL for a local port (defaults to detached)").option("--port <port>", "Local port to expose (default 3000)").option("--name <name>", "Stable tunnel name (default web)").option("--rotate", "Rotate the stable tunnel hostname before starting");
@@ -11730,19 +13525,19 @@ tunnelStartCommand.option("--no-detach", "Run in foreground until interrupted").
       console.log(JSON.stringify(started, null, 2));
       return;
     }
-    console.log(kleur19.green(`Tunnel started: ${started.url} (tunnelId=${started.tunnelId})`));
-    console.log(kleur19.gray(`pid=${started.pid} \xB7 port=${started.localPort}`));
-    console.log(kleur19.gray(`log: ${started.logFile}`));
+    console.log(kleur20.green(`Tunnel started: ${started.url} (tunnelId=${started.tunnelId})`));
+    console.log(kleur20.gray(`pid=${started.pid} \xB7 port=${started.localPort}`));
+    console.log(kleur20.gray(`log: ${started.logFile}`));
     console.log("");
     console.log("Next:");
-    console.log(`- ${kleur19.cyan(`instafy tunnel list`)}`);
-    console.log(`- ${kleur19.cyan(`instafy tunnel logs ${started.tunnelId} --follow`)}`);
-    console.log(`- ${kleur19.cyan(`instafy tunnel stop ${started.tunnelId}`)}`);
+    console.log(`- ${kleur20.cyan(`instafy tunnel list`)}`);
+    console.log(`- ${kleur20.cyan(`instafy tunnel logs ${started.tunnelId} --follow`)}`);
+    console.log(`- ${kleur20.cyan(`instafy tunnel stop ${started.tunnelId}`)}`);
     if (process.platform !== "win32") {
-      console.log(kleur19.gray(`(or) tail -n 200 -f ${started.logFile}`));
+      console.log(kleur20.gray(`(or) tail -n 200 -f ${started.logFile}`));
     }
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11754,14 +13549,14 @@ tunnelCommand.command("list").description("List local tunnel sessions started by
       return;
     }
     if (tunnels.length === 0) {
-      console.log(kleur19.yellow("No tunnels found."));
+      console.log(kleur20.yellow("No tunnels found."));
       return;
     }
     for (const tunnel of tunnels) {
       console.log(`${tunnel.tunnelId} \xB7 ${tunnel.url} \xB7 port=${tunnel.localPort} \xB7 pid=${tunnel.pid}`);
     }
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11777,9 +13572,9 @@ tunnelCommand.command("stop").description("Stop a local tunnel session and revok
       console.log(JSON.stringify(result, null, 2));
       return;
     }
-    console.log(kleur19.green(`Tunnel stopped: ${result.tunnelId}`));
+    console.log(kleur20.green(`Tunnel stopped: ${result.tunnelId}`));
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11793,10 +13588,85 @@ tunnelCommand.command("logs").description("Show logs for a local tunnel session"
       json: Boolean(opts.json)
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
+function exitWithPreviewError(error) {
+  console.error(kleur20.red(error instanceof Error ? error.message : String(error)));
+  process.exit(error instanceof PreviewCommandError ? error.exitCode : 1);
+}
+var previewCommand = program.command("preview").description("Look at sites running in this space, and show them in Studio as a private Ready to preview card");
+failWithGroupHelp(previewCommand);
+registerPreviewCheckCommand(previewCommand);
+var previewOpenCommand = previewCommand.command("open").description(
+  "Open a private preview of a local port (exit 2: nothing listening, 3: port not allowed, 5: previews not available)"
+).requiredOption("--port <port>", "Local port the site listens on (1024-65535)").requiredOption("--title <title>", "Card title (at most 120 characters)").option("--path <path>", "Path the preview opens at (default /)");
+addSpaceOption(previewOpenCommand, "Space UUID (defaults to .instafy/space.json or SPACE_ID)");
+addServerUrlOptions(previewOpenCommand);
+addAccessTokenOptions(previewOpenCommand, "Instafy access token (defaults to the job token, then the saved `instafy login` token)");
+previewOpenCommand.option("--conversation <id>", "Conversation for the card (only needed without a job token)").option("--rathole-bin <path>", "Path to rathole binary (or set RATHOLE_BIN)").option(
+  "--serve-cmd <command>",
+  "How to start the site again when the process that started it exits, or the space sleeps, run from the current directory (one command, no shell); default: read from the process listening on the port"
+).option(
+  "--start",
+  "Start --serve-cmd in the background, in its own session, without Instafy credentials, logging to .instafy/agent/logs, and wait for the port (nothing is started when the port already answers)"
+).option("--json", "Output JSON").action(async (opts) => {
+  try {
+    const result = await previewOpen({
+      project: resolveSpaceIdOption(opts),
+      controllerUrl: opts.serverUrl,
+      controllerToken: opts.accessToken,
+      conversationId: opts.conversation,
+      port: opts.port,
+      title: opts.title,
+      path: opts.path,
+      ratholeBin: opts.ratholeBin,
+      serveCmd: opts.serveCmd,
+      start: Boolean(opts.start)
+    });
+    printPreviewOpen(result, Boolean(opts.json));
+  } catch (error) {
+    exitWithPreviewError(error);
+  }
+});
+var previewListCommand = previewCommand.command("list").description("List this space's open previews (it does not check the sites: `instafy preview check` does)");
+addSpaceOption(previewListCommand, "Space UUID (defaults to .instafy/space.json or SPACE_ID)");
+addServerUrlOptions(previewListCommand);
+addAccessTokenOptions(previewListCommand, "Instafy access token (defaults to the job token, then the saved `instafy login` token)");
+previewListCommand.option("--json", "Output JSON").action(async (opts) => {
+  try {
+    const previews = await previewList({
+      project: resolveSpaceIdOption(opts),
+      controllerUrl: opts.serverUrl,
+      controllerToken: opts.accessToken
+    });
+    printPreviewList(previews, Boolean(opts.json));
+  } catch (error) {
+    exitWithPreviewError(error);
+  }
+});
+var previewCloseCommand = previewCommand.command("close").description("Close a preview: stop its local client and revoke it").argument("<previewId>", "Preview ID (from `instafy preview list`)");
+addSpaceOption(previewCloseCommand, "Space UUID (defaults to .instafy/space.json or SPACE_ID)");
+addServerUrlOptions(previewCloseCommand);
+addAccessTokenOptions(previewCloseCommand, "Instafy access token (defaults to the job token, then the saved `instafy login` token)");
+previewCloseCommand.option("--json", "Output JSON").action(async (previewId, opts) => {
+  try {
+    const result = await previewClose({
+      previewId,
+      project: resolveSpaceIdOption(opts),
+      controllerUrl: opts.serverUrl,
+      controllerToken: opts.accessToken
+    });
+    if (opts.json) {
+      console.log(JSON.stringify(result, null, 2));
+      return;
+    }
+    console.log(kleur20.green(`Preview closed: ${result.previewId}`));
+  } catch (error) {
+    exitWithPreviewError(error);
+  }
+});
 var orgCommand = program.command("team").alias("org").description("Team utilities");
 failWithGroupHelp(orgCommand);
 var orgListCommand = orgCommand.command("list").description("List teams for your account");
@@ -11809,7 +13679,7 @@ orgListCommand.option("--access-token <token>", "Instafy or Supabase access toke
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11830,7 +13700,7 @@ teamMembersCommand.action(async (opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11849,7 +13719,7 @@ teamInviteCommand.option("--role <role>", "owner, admin, builder, or viewer (def
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11868,7 +13738,7 @@ teamInviteLinkCommand.option("--role <role>", "builder or viewer (default: build
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11885,7 +13755,7 @@ teamInvitesCommand.action(async (opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11904,7 +13774,7 @@ teamAddMemberCommand.requiredOption("--user-id <uuid>", "User id of an existing
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11922,7 +13792,7 @@ teamAcceptCommand.action(async (token, opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11941,7 +13811,7 @@ teamRevokeInviteCommand.option("--yes", "Skip the confirmation prompt").action(a
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11960,7 +13830,7 @@ teamRevokeLinkCommand.option("--yes", "Skip the confirmation prompt").action(asy
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -11985,17 +13855,17 @@ profileCommand.command("list").description("List saved CLI profiles").option("--
       return;
     }
     if (profiles.length === 0) {
-      console.log(kleur19.yellow("No profiles found."));
-      console.log(`Create one with: ${kleur19.cyan("instafy login --profile <name>")}`);
+      console.log(kleur20.yellow("No profiles found."));
+      console.log(`Create one with: ${kleur20.cyan("instafy login --profile <name>")}`);
       return;
     }
-    console.log(kleur19.green("Instafy CLI profiles"));
+    console.log(kleur20.green("Instafy CLI profiles"));
     for (const profile of profiles) {
-      const token = profile.accessTokenSet ? kleur19.green("token") : kleur19.yellow("no-token");
-      console.log(`- ${kleur19.cyan(profile.name)} (${token})`);
+      const token = profile.accessTokenSet ? kleur20.green("token") : kleur20.yellow("no-token");
+      console.log(`- ${kleur20.cyan(profile.name)} (${token})`);
     }
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -12015,7 +13885,7 @@ historyMessagesCommand.option("--limit <n>", "Max messages to return (1-200, def
       pretty: opts.pretty
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -12032,7 +13902,7 @@ historyRunsCommand.option("--limit <n>", "Max runs to return (1-200, default: 50
       pretty: opts.pretty
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -12049,7 +13919,7 @@ historyConversationsCommand.option("--limit <n>", "Max conversations to return (
       pretty: opts.pretty
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -12070,7 +13940,7 @@ conversationCreateCommand.action(async (opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -12088,7 +13958,7 @@ conversationListCommand.action(async (opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -12107,7 +13977,7 @@ conversationSearchCommand.action(async (queryParts, opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -12131,7 +14001,7 @@ conversationGrepCommand.action(async (parts, opts) => {
     });
     process.exitCode = found ? 0 : 1;
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exitCode = 2;
   }
 });
@@ -12151,7 +14021,7 @@ conversationContextCommand.action(async (conversationId, messageId, opts) => {
       accessToken: opts.accessToken
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exitCode = 2;
   }
 });
@@ -12173,7 +14043,7 @@ conversationShowCommand.action(async (targetParts, opts) => {
       json: opts.json
     });
   } catch (error) {
-    console.error(kleur19.red(String(error)));
+    console.error(kleur20.red(String(error)));
     process.exit(1);
   }
 });
@@ -12183,6 +14053,10 @@ async function runCli(argv = process.argv) {
     return;
   }
   const args = argv.slice(2);
+  if (args[0] === "bind") {
+    process.exitCode = await runBind(args.slice(1));
+    return;
+  }
   if (args[0] === "git") {
     if (args[1] === "credential") {
       try {
@@ -12204,7 +14078,7 @@ async function runCli(argv = process.argv) {
   }
   await program.parseAsync(argv);
 }
-if (import.meta.url === pathToFileURL2(process.argv[1] ?? "").href) {
+if (import.meta.url === pathToFileURL3(process.argv[1] ?? "").href) {
   void runCli(process.argv);
 }
 export {