@kortix/agent-tunnel 0.12.7 → 0.13.0

package/dist/agent-cli.js

@@ -2968,6 +2968,14 @@ if (typeof globalThis.WebSocket === "undefined") {
   }
 }
 
+// src/agent/cli.ts
+import { existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { hostname as hostname4 } from "os";
+import { join as join10 } from "path";
+
+// src/agent/agent.ts
+import { hostname, platform, arch, release } from "os";
+
 // src/agent/config.ts
 import { chmodSync, existsSync, lstatSync, readFileSync } from "fs";
 import { join } from "path";
@@ -3402,6 +3410,14 @@ function absoluteWsPath(value) {
   }
   return value;
 }
+function buildTunnelWsUrl(config) {
+  const base = trustedHttpUrl(config.apiUrl).replace(/^http:/, "ws:").replace(/^https:/, "wss:");
+  const wsPath = absoluteWsPath(config.wsPath || "/ws");
+  const params = new URLSearchParams({
+    tunnelId: trustedCredential(config.tunnelId, "tunnelId")
+  });
+  return `${base}${wsPath}?${params.toString()}`;
+}
 function loadConfig(overrides = {}) {
   let fileConfig = {};
   if (existsSync(CONFIG_FILE)) {
@@ -3442,8 +3458,78 @@ function loadConfig(overrides = {}) {
   return merged;
 }
 
-// src/agent/agent.ts
-import { hostname, platform, arch, release } from "os";
+// src/agent/version.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { dirname, join as join2 } from "path";
+import { fileURLToPath } from "url";
+var PACKAGE_NAME = "@kortix/agent-tunnel";
+var MAX_LOOKUP_DEPTH = 8;
+var cached = null;
+function moduleDirectory() {
+  try {
+    return dirname(fileURLToPath(import.meta.url));
+  } catch {
+    return process.cwd();
+  }
+}
+function agentTunnelVersion() {
+  if (cached !== null)
+    return cached;
+  let directory = moduleDirectory();
+  for (let depth = 0;depth < MAX_LOOKUP_DEPTH; depth++) {
+    try {
+      const manifest = JSON.parse(readFileSync2(join2(directory, "package.json"), "utf8"));
+      if (manifest?.name === PACKAGE_NAME && typeof manifest.version === "string") {
+        const version = manifest.version;
+        cached = version;
+        return version;
+      }
+    } catch {}
+    const parent = dirname(directory);
+    if (parent === directory)
+      break;
+    directory = parent;
+  }
+  cached = "unknown";
+  return cached;
+}
+
+// src/agent/terminal.ts
+var c = {
+  reset: "\x1B[0m",
+  bold: "\x1B[1m",
+  dim: "\x1B[2m",
+  cyan: "\x1B[36m",
+  green: "\x1B[32m",
+  yellow: "\x1B[33m",
+  red: "\x1B[31m",
+  white: "\x1B[97m",
+  gray: "\x1B[90m"
+};
+var ANSI = /\x1b\[[0-9;]*m/g;
+function stripAnsi(value) {
+  return value.replace(ANSI, "");
+}
+function visibleLength(value) {
+  return stripAnsi(value).length;
+}
+function clearScreen() {
+  process.stdout.write("\x1B[2J\x1B[3J\x1B[H");
+}
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var glyph = {
+  on: `${c.green}●${c.reset}`,
+  off: `${c.gray}○${c.reset}`,
+  warn: `${c.yellow}!${c.reset}`,
+  bad: `${c.red}✗${c.reset}`,
+  mark: `${c.cyan}◆${c.reset}`
+};
+function field(label, value, width = 14) {
+  console.log(`  ${c.dim}${label.padEnd(width)}${c.reset}${value}`);
+}
+function blankLine() {
+  console.log("");
+}
 
 // src/agent/security/permission-guard.ts
 class PermissionGuard {
@@ -3518,19 +3604,10 @@ function verifyMessageSignature(signingKey, payload, nonce, signature) {
 }
 
 // src/agent/agent.ts
-var AGENT_VERSION = "0.1.2";
+var AGENT_VERSION = agentTunnelVersion();
+var AUTH_REJECTED_CLOSE_CODES = [4001, 4003];
+var AGENT_REPLACED_CLOSE_CODE = 4004;
 var MAX_RPC_MESSAGE_SIZE = 5 * 1024 * 1024;
-var c = {
-  reset: "\x1B[0m",
-  bold: "\x1B[1m",
-  dim: "\x1B[2m",
-  cyan: "\x1B[36m",
-  green: "\x1B[32m",
-  yellow: "\x1B[33m",
-  red: "\x1B[31m",
-  white: "\x1B[97m",
-  gray: "\x1B[90m"
-};
 function log(icon, msg) {
   const safeIcon = icon.replace(/[\r\n]/g, " ");
   const safeMsg = msg.replace(/[\r\n]/g, " ");
@@ -3539,6 +3616,7 @@ function log(icon, msg) {
 }
 
 class TunnelAgent {
+  hooks;
   ws = null;
   registry;
   permissionGuard;
@@ -3554,10 +3632,11 @@ class TunnelAgent {
   signingKey = null;
   lastNonce = 0;
   responseNonce = 0;
-  constructor(config, registry) {
+  constructor(config, registry, hooks = {}) {
     this.config = config;
     this.registry = registry;
     this.permissionGuard = new PermissionGuard;
+    this.hooks = hooks;
   }
   connect() {
     if (this.ws) {
@@ -3627,16 +3706,21 @@ class TunnelAgent {
       }
       if (!this.isShuttingDown) {
         if (event.code === 4001) {
-          log(`${c.red}✗${c.reset}`, `Authentication failed — check your token`);
+          this.isShuttingDown = true;
+          log(`${c.red}✗${c.reset}`, `Credential rejected — run \`agent-tunnel connect --reauth\` to pair again`);
+          this.hooks.onTerminalClose?.({ code: event.code, reason: "credential-rejected" });
           return;
         }
         if (event.code === 4003) {
-          log(`${c.red}✗${c.reset}`, `Device credential was revoked — run connect again`);
+          this.isShuttingDown = true;
+          log(`${c.red}✗${c.reset}`, `Device credential was revoked — run \`agent-tunnel connect --reauth\` to pair again`);
+          this.hooks.onTerminalClose?.({ code: event.code, reason: "credential-rejected" });
           return;
         }
-        if (event.code === 4004) {
+        if (event.code === AGENT_REPLACED_CLOSE_CODE) {
           this.isShuttingDown = true;
           log(`${c.yellow}○${c.reset}`, `Another Agent Tunnel process connected with these credentials — stopping this process`);
+          this.hooks.onTerminalClose?.({ code: event.code, reason: "replaced" });
           return;
         }
         log(`${c.yellow}○${c.reset}`, `Disconnected ${c.gray}(code: ${event.code})${c.reset}`);
@@ -3664,7 +3748,12 @@ class TunnelAgent {
     }
     if (msg.type === "auth_ok" && msg.signingKey) {
       this.signingKey = msg.signingKey;
-      log(`${c.green}●${c.reset}`, `Connected ${c.reset}${c.gray}(${this.registry.getCapabilityNames().join(", ")})${c.reset}`);
+      const capabilityNames = this.registry.getCapabilityNames();
+      if (capabilityNames.length === 0) {
+        log(`${c.yellow}!${c.reset}`, `Connected, but no capabilities are enabled — this tunnel cannot do anything. Run \`agent-tunnel connect --reauth\` to pair again.`);
+      } else {
+        log(`${c.green}●${c.reset}`, `Connected ${c.reset}${c.gray}(${capabilityNames.join(", ")})${c.reset}`);
+      }
       if (this.stableConnectionTimer)
         clearTimeout(this.stableConnectionTimer);
       this.stableConnectionTimer = setTimeout(() => {
@@ -3829,13 +3918,66 @@ class TunnelAgent {
     }, delay);
   }
   buildWsUrl() {
-    const base = trustedHttpUrl(this.config.apiUrl).replace(/^http:/, "ws:").replace(/^https:/, "wss:");
-    const wsPath = this.config.wsPath || "/ws";
-    const params = new URLSearchParams({
-      tunnelId: trustedCredential(this.config.tunnelId, "tunnelId")
-    });
-    return `${base}${wsPath}?${params.toString()}`;
+    return buildTunnelWsUrl(this.config);
+  }
+}
+
+// src/agent/banner.ts
+import { arch as arch2, hostname as hostname2, platform as platform2 } from "os";
+var BOX_WIDTH = 60;
+var BAR_WIDTH = 50;
+var BAR_FRAMES = 14;
+var WORDMARK = [
+  `${c.cyan}▄▀█ █▀▀ █▀▀ █▄ █ ▀█▀${c.reset}   ${c.cyan}▀█▀ █ █ █▄ █ █▄ █ █▀▀ █  ${c.reset}`,
+  `${c.cyan}█▀█ █▄█ ██▄ █ ▀█  █${c.reset}    ${c.cyan} █  █▄█ █ ▀█ █ ▀█ ██▄ █▄▄${c.reset}`
+];
+function truncate(value, max) {
+  return value.length > max ? `${value.slice(0, max)}…` : value;
+}
+async function animateConnectingBar() {
+  for (let frame = 0;frame <= BAR_FRAMES; frame++) {
+    const filled = Math.round(frame / BAR_FRAMES * BAR_WIDTH);
+    process.stdout.write(`\r      ${c.cyan}◇${c.reset} ${c.cyan}${"═".repeat(filled)}${c.reset}${c.gray}${"─".repeat(BAR_WIDTH - filled)}${c.reset}  `);
+    await sleep(20);
   }
+  process.stdout.write(`\r      ${c.cyan}◇ ${"═".repeat(BAR_WIDTH)} ◆${c.reset}  
+`);
+  await sleep(120);
+}
+async function printStartupBanner({
+  tunnelId,
+  apiUrl,
+  capabilities,
+  version
+}) {
+  console.log("");
+  for (const line of WORDMARK)
+    console.log(`      ${line}`);
+  console.log("");
+  await animateConnectingBar();
+  const row = (content) => {
+    const pad = Math.max(0, BOX_WIDTH - visibleLength(content));
+    console.log(`  ${c.gray}│${c.reset}${content}${" ".repeat(pad)}${c.gray}│${c.reset}`);
+  };
+  const blank = () => row("");
+  const titleLeft = `   ${c.cyan}◆${c.reset}  ${c.bold}${c.white}Agent Tunnel${c.reset}`;
+  const titleRight = `${c.dim}v${version}${c.reset}   `;
+  const titlePad = Math.max(1, BOX_WIDTH - visibleLength(titleLeft) - visibleLength(titleRight));
+  const capabilityRow = capabilities.length > 0 ? capabilities.map((name) => `${c.green}●${c.reset} ${c.white}${name}${c.reset}`).join("   ") : `${c.yellow}none — this tunnel cannot act${c.reset}`;
+  const brand = "created by kortix";
+  console.log("");
+  console.log(`  ${c.gray}╭${"─".repeat(BOX_WIDTH)}╮${c.reset}`);
+  blank();
+  row(`${titleLeft}${" ".repeat(titlePad)}${titleRight}`);
+  row(`   ${c.dim}Bridge between AI agents & local machines${c.reset}`);
+  blank();
+  row(`   ${c.dim}tunnel${c.reset}    ${c.white}${truncate(tunnelId, 40)}${c.reset}`);
+  row(`   ${c.dim}relay${c.reset}     ${c.white}${truncate(apiUrl, 40)}${c.reset}`);
+  row(`   ${c.dim}machine${c.reset}   ${c.white}${truncate(hostname2(), 28)}${c.reset} ${c.dim}(${platform2()} ${arch2()})${c.reset}`);
+  row(`   ${c.dim}access${c.reset}    ${capabilityRow}`);
+  blank();
+  console.log(`  ${c.gray}╰${"─".repeat(BOX_WIDTH - brand.length - 3)} ${c.dim}created by ${c.cyan}kortix${c.reset} ${c.gray}─╯${c.reset}`);
+  console.log("");
 }
 
 // src/agent/capabilities/index.ts
@@ -3866,8 +4008,8 @@ class CapabilityRegistry {
 // src/agent/capabilities/desktop/cua-driver.ts
 import { spawn } from "child_process";
 import { existsSync as existsSync2, realpathSync, statSync } from "fs";
-import { homedir as homedir2, platform as platform2 } from "os";
-import { join as join2 } from "path";
+import { homedir as homedir2, platform as platform3 } from "os";
+import { join as join3 } from "path";
 var MAX_DRIVER_OUTPUT_BYTES = 5 * 1024 * 1024;
 var DRIVER_ENV_KEYS = [
   "PATH",
@@ -3886,7 +4028,7 @@ var DRIVER_ENV_KEYS = [
 function candidateBins() {
   const candidates = [
     process.env.CUA_DRIVER_BIN,
-    join2(homedir2(), ".local", "bin", process.platform === "win32" ? "cua-driver.exe" : "cua-driver"),
+    join3(homedir2(), ".local", "bin", process.platform === "win32" ? "cua-driver.exe" : "cua-driver"),
     "/usr/local/bin/cua-driver",
     "/opt/homebrew/bin/cua-driver"
   ];
@@ -3991,7 +4133,7 @@ function parseJsonOutput(stdout) {
 function isDaemonProxyFallback(message) {
   return message.includes("daemon proxy") && message.includes("Resource temporarily unavailable");
 }
-async function sleep(ms) {
+async function sleep2(ms) {
   await new Promise((resolve) => setTimeout(resolve, ms));
 }
 function sanitizeArgs(args) {
@@ -4050,7 +4192,7 @@ class CuaDriver {
         const { stdout, stderr } = await execFile(bin, ["call", tool, payload], 60000);
         if (isDaemonProxyFallback(stderr)) {
           lastError = new Error(stderr.trim());
-          await sleep(150 * (attempt + 1));
+          await sleep2(150 * (attempt + 1));
           continue;
         }
         return parseJsonOutput(stdout);
@@ -4060,14 +4202,14 @@ class CuaDriver {
           throw err;
         }
         lastError = err;
-        await sleep(150 * (attempt + 1));
+        await sleep2(150 * (attempt + 1));
       }
     }
     throw lastError instanceof Error ? lastError : new Error(String(lastError));
   }
   async startDaemon() {
     const bin = await this.ensureInstalled();
-    if (platform2() === "darwin") {
+    if (platform3() === "darwin") {
       const child = spawn("open", ["-n", "-g", "-a", "CuaDriver", "--args", "serve"], {
         detached: true,
         stdio: "ignore",
@@ -4222,10 +4364,10 @@ function createDesktopCapability() {
 
 // src/agent/capabilities/filesystem.ts
 import { open, writeFile, readdir, stat, unlink, mkdir } from "fs/promises";
-import { join as join4, dirname as dirname2 } from "path";
+import { join as join5, dirname as dirname3 } from "path";
 
 // src/agent/security/path-validator.ts
-import { dirname, basename, join as join3, resolve, normalize, relative, isAbsolute } from "path";
+import { dirname as dirname2, basename, join as join4, resolve, normalize, relative, isAbsolute } from "path";
 import { realpathSync as realpathSync2 } from "fs";
 function resolveExistingRoot(path) {
   const normalized = normalize(resolve(path));
@@ -4244,10 +4386,10 @@ function resolvePathForValidation(path) {
     if (code !== "ENOENT") {
       throw new Error(`Access denied: cannot resolve path "${path}" (${code})`);
     }
-    const parent = dirname(normalized);
+    const parent = dirname2(normalized);
     if (parent === normalized)
       return normalized;
-    return join3(resolvePathForValidation(parent), basename(normalized));
+    return join4(resolvePathForValidation(parent), basename(normalized));
   }
 }
 function assertAllowedResolvedPath(originalPath, resolved, allowedPaths, blockedPaths = []) {
@@ -4281,8 +4423,8 @@ function validatePath(path, allowedPaths, blockedPaths = []) {
 }
 function validateWritePath(path, allowedPaths, blockedPaths = []) {
   const resolved = validatePath(path, allowedPaths, blockedPaths);
-  let parent = dirname(normalize(resolve(path)));
-  while (parent && parent !== dirname(parent)) {
+  let parent = dirname2(normalize(resolve(path)));
+  while (parent && parent !== dirname2(parent)) {
     try {
       const resolvedParent = realpathSync2(parent);
       assertAllowedResolvedPath(path, resolvedParent, allowedPaths, blockedPaths);
@@ -4292,7 +4434,7 @@ function validateWritePath(path, allowedPaths, blockedPaths = []) {
       if (code !== "ENOENT") {
         throw new Error(`Access denied: cannot resolve parent for "${path}" (${code})`);
       }
-      parent = dirname(parent);
+      parent = dirname2(parent);
     }
   }
   throw new Error(`Access denied: cannot resolve parent for "${path}"`);
@@ -4387,7 +4529,7 @@ function createFilesystemCapability(config) {
     if (contentBytes > maxFileSize) {
       throw new Error(`Content exceeds max size (${contentBytes} > ${maxFileSize})`);
     }
-    await mkdir(dirname2(path), { recursive: true });
+    await mkdir(dirname3(path), { recursive: true });
     validateFilesystemPath(path, config, params, true);
     await writeFile(path, content, { encoding });
     validateFilesystemPath(path, config, params);
@@ -4405,7 +4547,7 @@ function createFilesystemCapability(config) {
     const entries = await readdir(path, { withFileTypes: true });
     const result = entries.map((entry) => ({
       name: entry.name,
-      path: join4(path, entry.name),
+      path: join5(path, entry.name),
       isDirectory: entry.isDirectory(),
       isFile: entry.isFile(),
       isSymlink: entry.isSymbolicLink()
@@ -4418,7 +4560,7 @@ function createFilesystemCapability(config) {
           for (const sub of subEntries) {
             result.push({
               name: sub.name,
-              path: join4(dir.path, sub.name),
+              path: join5(dir.path, sub.name),
               isDirectory: sub.isDirectory(),
               isFile: sub.isFile(),
               isSymlink: sub.isSymbolicLink()
@@ -4597,771 +4739,868 @@ function createEnabledCapabilityRegistry(config, findDesktopDriver = findCuaDriv
   return registry;
 }
 
-// src/agent/service.ts
-import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs";
-import { homedir as homedir3, platform as platform3, userInfo } from "os";
-import { dirname as dirname3, join as join5 } from "path";
-import { spawnSync } from "child_process";
-var SERVICE_LABEL = "ai.kortix.agent-tunnel";
-var DEFAULT_INSTALL_BACKGROUND_SERVICE = true;
-function getServicePaths() {
-  const home = homedir3();
-  const configDir = join5(home, ".agent-tunnel");
-  return {
-    configDir,
-    logDir: join5(configDir, "logs"),
-    launchdPlist: join5(home, "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`),
-    systemdUnit: join5(home, ".config", "systemd", "user", `${SERVICE_LABEL}.service`),
-    windowsScript: join5(configDir, "agent-tunnel-service.ps1")
-  };
-}
-function shellQuote(value) {
-  return `'${value.replace(/'/g, `'\\''`)}'`;
+// src/agent/credential-store.ts
+import { chmodSync as chmodSync2, existsSync as existsSync3, mkdirSync, readFileSync as readFileSync3, renameSync, rmSync, writeFileSync } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join6 } from "path";
+var CONFIG_DIR2 = join6(homedir3(), ".agent-tunnel");
+var CONFIG_FILE2 = join6(CONFIG_DIR2, "config.json");
+var PAIRING_FIELDS = ["token", "tunnelId", "enabledCapabilities"];
+function readConfigFile() {
+  try {
+    const parsed = JSON.parse(readFileSync3(CONFIG_FILE2, "utf-8"));
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
 }
-function powershellQuote(value) {
-  return `'${value.replace(/'/g, "''")}'`;
+function writeConfigFileAtomic(next) {
+  mkdirSync(CONFIG_DIR2, { recursive: true, mode: 448 });
+  try {
+    chmodSync2(CONFIG_DIR2, 448);
+  } catch {}
+  const tmpFile = join6(CONFIG_DIR2, `config.${process.pid}.${Date.now()}.tmp`);
+  writeFileSync(tmpFile, JSON.stringify(next, null, 2), { mode: 384, flag: "wx" });
+  try {
+    chmodSync2(tmpFile, 384);
+  } catch {}
+  renameSync(tmpFile, CONFIG_FILE2);
+  try {
+    chmodSync2(CONFIG_FILE2, 384);
+  } catch {}
 }
-function xmlEscape(value) {
-  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+function saveCredentials(tunnelId, token, apiUrl, enabledCapabilities) {
+  writeConfigFileAtomic({
+    ...readConfigFile(),
+    tunnelId,
+    token,
+    apiUrl,
+    ...enabledCapabilities !== undefined ? { enabledCapabilities } : {}
+  });
 }
-function currentRunnerParts() {
-  const exec = process.execPath;
-  const script = process.argv[1];
-  if (script && existsSync3(script)) {
-    return { command: exec, args: [script, "run", "--service"] };
+function clearSavedCredentials() {
+  if (!existsSync3(CONFIG_FILE2))
+    return false;
+  let existing;
+  try {
+    existing = JSON.parse(readFileSync3(CONFIG_FILE2, "utf-8"));
+  } catch {
+    rmSync(CONFIG_FILE2, { force: true });
+    return true;
   }
-  throw new Error("Cannot install the background service because the current Agent Tunnel executable was not found");
+  const hadCredentials = PAIRING_FIELDS.some((key) => (key in existing) && existing[key] != null);
+  for (const key of PAIRING_FIELDS)
+    delete existing[key];
+  writeConfigFileAtomic(existing);
+  return hadCredentials;
 }
-function currentRunnerCommand() {
-  const runner = currentRunnerParts();
-  return [runner.command, ...runner.args].map(shellQuote).join(" ");
+
+// src/agent/credential-probe.ts
+var DEFAULT_PROBE_TIMEOUT_MS = 1e4;
+function probeCredentials(config, options = {}) {
+  return new Promise((resolve2) => {
+    let socket;
+    try {
+      socket = new WebSocket(new URL(buildTunnelWsUrl(config)));
+    } catch {
+      resolve2("unreachable");
+      return;
+    }
+    const settle = (result) => {
+      clearTimeout(timer);
+      try {
+        socket.close(1000, "probe complete");
+      } catch {}
+      resolve2(result);
+    };
+    const timer = setTimeout(() => settle("unreachable"), options.timeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS);
+    socket.addEventListener("open", () => {
+      try {
+        socket.send(JSON.stringify({
+          type: "auth",
+          token: trustedCredential(config.token, "token"),
+          capabilities: options.capabilities ?? [],
+          agentVersion: AGENT_VERSION
+        }));
+      } catch {
+        settle("unreachable");
+      }
+    });
+    socket.addEventListener("message", (event) => {
+      try {
+        const message = JSON.parse(String(event.data));
+        if (isJsonRecord(message) && message.type === "auth_ok")
+          settle("valid");
+      } catch {}
+    });
+    socket.addEventListener("close", (event) => {
+      const { code } = event;
+      if (AUTH_REJECTED_CLOSE_CODES.includes(code))
+        return settle("rejected");
+      if (code === AGENT_REPLACED_CLOSE_CODE)
+        return settle("valid");
+      settle("unreachable");
+    });
+    socket.addEventListener("error", () => settle("unreachable"));
+  });
 }
-function buildServiceShellCommand() {
-  return `exec ${currentRunnerCommand()}`;
+function isJsonRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function renderWindowsPowerShellScript(runner = currentRunnerParts()) {
-  const command = powershellQuote(runner.command);
-  const args = runner.args.map(powershellQuote).join(" ");
-  return `$ErrorActionPreference = 'Continue'
-while ($true) {
-  & ${command}${args ? ` ${args}` : ""}
-  Start-Sleep -Seconds 5
+
+// src/agent/device-auth.ts
+import { spawn as spawn3 } from "child_process";
+import { hostname as hostname3, platform as platform4 } from "os";
+var TUNNEL_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var SETUP_TOKEN_PATTERN = /^kortix_tnl_[A-Za-z0-9_-]{32,64}$/;
+var DEVICE_CODE_PATTERN = /^[A-Z]{4}-[0-9]{4}$/;
+var DEVICE_SECRET_PATTERN = /^[A-Za-z0-9]{32}$/;
+var MAX_CHALLENGE_LIFETIME_MS = 10 * 60000;
+
+class InvalidDeviceAuthResponseError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InvalidDeviceAuthResponseError";
+  }
 }
-`;
+function invalid(what) {
+  throw new InvalidDeviceAuthResponseError(`Authorization server returned an invalid ${what}`);
 }
-function windowsTaskCommand(paths) {
-  return `powershell.exe -NoProfile -ExecutionPolicy Bypass -File "${paths.windowsScript}"`;
+function isJsonRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function renderLaunchdPlist(command, paths = getServicePaths()) {
-  const stdout = join5(paths.logDir, "agent-tunnel.out.log");
-  const stderr = join5(paths.logDir, "agent-tunnel.err.log");
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>${xmlEscape(SERVICE_LABEL)}</string>
-  <key>ProgramArguments</key>
-  <array>
-    <string>/bin/sh</string>
-    <string>-lc</string>
-    <string>${xmlEscape(command)}</string>
-  </array>
-  <key>RunAtLoad</key>
-  <true/>
-  <key>KeepAlive</key>
-  <true/>
-  <key>Umask</key>
-  <integer>63</integer>
-  <key>StandardOutPath</key>
-  <string>${xmlEscape(stdout)}</string>
-  <key>StandardErrorPath</key>
-  <string>${xmlEscape(stderr)}</string>
-  <key>WorkingDirectory</key>
-  <string>${xmlEscape(homedir3())}</string>
-  <key>EnvironmentVariables</key>
-  <dict>
-    <key>PATH</key>
-    <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
-  </dict>
-</dict>
-</plist>
-`;
+function normalizeBrowserUrl(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" || url.protocol === "http:" ? url.toString() : null;
+  } catch {
+    return null;
+  }
 }
-function renderSystemdUnit(command, paths = getServicePaths()) {
-  const stdout = join5(paths.logDir, "agent-tunnel.out.log");
-  const stderr = join5(paths.logDir, "agent-tunnel.err.log");
-  return `[Unit]
-Description=Kortix Agent Tunnel
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-UMask=0077
-ExecStart=/bin/sh -lc ${shellQuote(command)}
-Restart=always
-RestartSec=5
-WorkingDirectory=${homedir3()}
-Environment=PATH=/usr/local/bin:/usr/bin:/bin
-StandardOutput=append:${stdout}
-StandardError=append:${stderr}
-
-[Install]
-WantedBy=default.target
-`;
+function isLoopback(url) {
+  return ["localhost", "127.0.0.1", "[::1]", "::1"].includes(url.hostname);
 }
-function run(command, args) {
-  const result = spawnSync(command, args, { encoding: "utf8" });
-  const detail = [result.stdout, result.stderr].filter(Boolean).join(`
-`).trim();
-  return { ok: result.status === 0, detail };
+function assertSafeVerificationUrl(value) {
+  if (value.length > 2048)
+    invalid("verification URL");
+  const browserUrl = normalizeBrowserUrl(value);
+  if (!browserUrl)
+    invalid("verification URL");
+  const url = new URL(browserUrl);
+  if (url.username || url.password || url.protocol !== "https:" && !isLoopback(url)) {
+    throw new InvalidDeviceAuthResponseError("Authorization server returned an unsafe verification URL");
+  }
+  return browserUrl;
 }
-function launchdTarget() {
-  const uid = typeof process.getuid === "function" ? process.getuid() : userInfo().uid;
-  return `gui/${uid}`;
+function parseDeviceAuthChallenge(value) {
+  if (!isJsonRecord2(value))
+    invalid("challenge");
+  const { deviceCode, deviceSecret, verificationUrl, expiresAt, pollIntervalMs } = value;
+  if (typeof deviceCode !== "string" || !DEVICE_CODE_PATTERN.test(deviceCode))
+    invalid("device code");
+  if (typeof deviceSecret !== "string" || !DEVICE_SECRET_PATTERN.test(deviceSecret)) {
+    invalid("device secret");
+  }
+  if (typeof verificationUrl !== "string")
+    invalid("verification URL");
+  if (typeof expiresAt !== "string")
+    invalid("expiration");
+  const expiresAtMs = Date.parse(expiresAt);
+  const now = Date.now();
+  if (!Number.isFinite(expiresAtMs) || expiresAtMs <= now || expiresAtMs > now + MAX_CHALLENGE_LIFETIME_MS) {
+    invalid("expiration");
+  }
+  if (!Number.isSafeInteger(pollIntervalMs) || pollIntervalMs < 250 || pollIntervalMs > 1e4) {
+    invalid("poll interval");
+  }
+  return {
+    deviceCode,
+    deviceSecret,
+    verificationUrl: assertSafeVerificationUrl(verificationUrl),
+    expiresAt,
+    pollIntervalMs
+  };
 }
-function installService() {
-  const paths = getServicePaths();
-  mkdirSync(paths.configDir, { recursive: true, mode: 448 });
-  mkdirSync(paths.logDir, { recursive: true, mode: 448 });
-  const command = buildServiceShellCommand();
-  if (platform3() === "darwin") {
-    mkdirSync(dirname3(paths.launchdPlist), { recursive: true });
-    writeFileSync(paths.launchdPlist, renderLaunchdPlist(command, paths), { mode: 384 });
-    run("launchctl", ["bootout", launchdTarget(), paths.launchdPlist]);
-    const boot = run("launchctl", ["bootstrap", launchdTarget(), paths.launchdPlist]);
-    const kick = run("launchctl", ["kickstart", "-k", `${launchdTarget()}/${SERVICE_LABEL}`]);
-    return {
-      platform: platform3(),
-      installed: true,
-      active: boot.ok || kick.ok ? true : null,
-      path: paths.launchdPlist,
-      detail: [boot.detail, kick.detail].filter(Boolean).join(`
-`)
-    };
+function parseApprovedCredentials(value) {
+  const { tunnelId, token } = value;
+  if (typeof tunnelId !== "string" || !TUNNEL_ID_PATTERN.test(tunnelId))
+    invalid("tunnel ID");
+  if (typeof token !== "string" || !SETUP_TOKEN_PATTERN.test(token))
+    invalid("setup token");
+  return { tunnelId, token };
+}
+function parseApprovedCapabilities(value) {
+  if (!Array.isArray(value))
+    return [];
+  return [...new Set(value)].filter((item) => isTunnelCapability(item));
+}
+function parseDeviceAuthStatus(value) {
+  if (!isJsonRecord2(value) || typeof value.status !== "string")
+    invalid("status response");
+  switch (value.status) {
+    case "approved": {
+      if (!value.tunnelId || !value.token)
+        return { status: "approved-without-token" };
+      return {
+        status: "approved",
+        ...parseApprovedCredentials(value),
+        capabilities: parseApprovedCapabilities(value.capabilities)
+      };
+    }
+    case "denied":
+      return { status: "denied" };
+    case "expired":
+      return { status: "expired" };
+    default:
+      return null;
   }
-  if (platform3() === "linux") {
-    mkdirSync(dirname3(paths.systemdUnit), { recursive: true });
-    writeFileSync(paths.systemdUnit, renderSystemdUnit(command, paths), { mode: 384 });
-    const reload = run("systemctl", ["--user", "daemon-reload"]);
-    const enable = run("systemctl", ["--user", "enable", "--now", `${SERVICE_LABEL}.service`]);
-    return {
-      platform: platform3(),
-      installed: true,
-      active: enable.ok ? true : null,
-      path: paths.systemdUnit,
-      detail: [reload.detail, enable.detail].filter(Boolean).join(`
-`)
-    };
+}
+async function requestDeviceAuthorization(apiUrl) {
+  const response = await fetch(`${apiUrl}/device-auth`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ machineHostname: hostname3() })
+  });
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    throw new InvalidDeviceAuthResponseError(`Failed to create device auth request: ${response.status} ${body.slice(0, 200)}`);
   }
-  if (platform3() === "win32") {
-    writeFileSync(paths.windowsScript, renderWindowsPowerShellScript(), { mode: 384 });
-    const create = run("schtasks.exe", [
-      "/Create",
-      "/TN",
-      SERVICE_LABEL,
-      "/TR",
-      windowsTaskCommand(paths),
-      "/SC",
-      "ONLOGON",
-      "/F",
-      "/RL",
-      "LIMITED"
-    ]);
-    const start = run("schtasks.exe", ["/Run", "/TN", SERVICE_LABEL]);
-    return {
-      platform: platform3(),
-      installed: create.ok,
-      active: start.ok ? true : null,
-      path: paths.windowsScript,
-      detail: [create.detail, start.detail].filter(Boolean).join(`
-`)
-    };
+  return parseDeviceAuthChallenge(await response.json());
+}
+async function awaitDeviceAuthorization(apiUrl, challenge, options = {}) {
+  const wait = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const expiresAtMs = Date.parse(challenge.expiresAt);
+  for (;; ) {
+    const secondsRemaining = Math.max(0, Math.floor((expiresAtMs - Date.now()) / 1000));
+    if (secondsRemaining <= 0)
+      return { status: "expired" };
+    options.onWaiting?.(secondsRemaining);
+    let payload;
+    try {
+      const response = await fetch(`${apiUrl}/device-auth/${challenge.deviceCode}/status`, {
+        headers: { Authorization: `Bearer ${challenge.deviceSecret}` }
+      });
+      if (!response.ok) {
+        await wait(challenge.pollIntervalMs);
+        continue;
+      }
+      payload = await response.json();
+    } catch {
+      await wait(challenge.pollIntervalMs);
+      continue;
+    }
+    const outcome = parseDeviceAuthStatus(payload);
+    if (outcome)
+      return outcome;
+    await wait(challenge.pollIntervalMs);
   }
-  throw new Error("Background service install is currently supported on macOS launchd, Linux systemd user services, and Windows Scheduled Tasks.");
 }
-function uninstallService() {
-  const paths = getServicePaths();
-  if (platform3() === "darwin") {
-    const existed = existsSync3(paths.launchdPlist);
+function openBrowser(url) {
+  if (process.env.KORTIX_AGENT_TUNNEL_NO_BROWSER === "1")
+    return;
+  const safeUrl = normalizeBrowserUrl(url);
+  if (!safeUrl)
+    return;
+  const opener = {
+    darwin: ["open", [safeUrl]],
+    win32: ["rundll32.exe", ["url.dll,FileProtocolHandler", safeUrl]]
+  };
+  const [command, args] = opener[platform4()] ?? ["xdg-open", [safeUrl]];
+  try {
+    spawn3(command, args, { detached: true, stdio: "ignore" }).unref();
+  } catch {}
+}
+
+// src/agent/log-format.ts
+function collapseRepeatedLines(lines) {
+  const collapsed = [];
+  let index = 0;
+  while (index < lines.length) {
+    let repeats = 1;
+    while (index + repeats < lines.length && lines[index + repeats] === lines[index])
+      repeats++;
+    collapsed.push(repeats > 1 ? `${lines[index]}  (x${repeats})` : lines[index]);
+    index += repeats;
+  }
+  return collapsed;
+}
+function isShellStartupNoise(line) {
+  return /\/\.(profile|bash_profile|zprofile|zshrc|bashrc)\b.*:.*(No such file or directory|command not found)/.test(line);
+}
+
+// src/agent/prompts.ts
+import { createInterface } from "readline/promises";
+function isInteractiveTerminal() {
+  return process.stdin.isTTY === true && process.stdout.isTTY === true;
+}
+function isTruthyFlag(value) {
+  return value === "true" || value === "1" || value === "yes";
+}
+function anyFlag(flags, names) {
+  return names.some((name) => isTruthyFlag(flags[name]));
+}
+async function promptYesNo(question, defaultValue) {
+  const suffix = defaultValue ? " [Y/n] " : " [y/N] ";
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    for (;; ) {
+      const answer = (await rl.question(`${question}${suffix}`)).trim().toLowerCase();
+      if (!answer)
+        return defaultValue;
+      if (["y", "yes"].includes(answer))
+        return true;
+      if (["n", "no"].includes(answer))
+        return false;
+      console.log(`  ${c.yellow}!${c.reset} Please answer yes or no.`);
+    }
+  } catch (error) {
+    if (error instanceof Error && error.name === "AbortError") {
+      process.stdout.write(`
+`);
+      process.exit(130);
+    }
+    throw error;
+  } finally {
+    rl.close();
+  }
+}
+
+// src/agent/service.ts
+import { chmodSync as chmodSync3, copyFileSync, existsSync as existsSync5, mkdirSync as mkdirSync3, realpathSync as realpathSync3, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
+import { platform as platform6 } from "os";
+import { join as join9 } from "path";
+
+// src/agent/service-drivers.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir5, platform as platform5, userInfo } from "os";
+import { dirname as dirname4, join as join8 } from "path";
+
+// src/agent/service-quoting.ts
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function powershellQuote(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+function xmlEscape(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+
+// src/agent/service-paths.ts
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join7 } from "path";
+var SERVICE_LABEL = "ai.kortix.agent-tunnel";
+var DEFAULT_INSTALL_BACKGROUND_SERVICE = true;
+var TERMINAL_SERVICE_EXIT_CODE = 0;
+var MAX_SERVICE_LOG_BYTES = 5 * 1024 * 1024;
+var RETAINED_LOG_LINES = 500;
+function getServicePaths() {
+  const home = homedir4();
+  const configDir = join7(home, ".agent-tunnel");
+  const binDir = join7(configDir, "bin");
+  return {
+    configDir,
+    logDir: join7(configDir, "logs"),
+    binDir,
+    vendoredRunner: join7(binDir, "agent-cli.js"),
+    launchdPlist: join7(home, "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`),
+    systemdUnit: join7(home, ".config", "systemd", "user", `${SERVICE_LABEL}.service`),
+    windowsScript: join7(configDir, "agent-tunnel-service.ps1")
+  };
+}
+function serviceLogFiles(paths = getServicePaths()) {
+  return [
+    join7(paths.logDir, "agent-tunnel.out.log"),
+    join7(paths.logDir, "agent-tunnel.err.log")
+  ];
+}
+function rotateServiceLogs(paths = getServicePaths(), maxBytes = MAX_SERVICE_LOG_BYTES) {
+  const rotated = [];
+  for (const file of serviceLogFiles(paths)) {
+    try {
+      const contents = readFileSync4(file, "utf8");
+      if (Buffer.byteLength(contents, "utf8") <= maxBytes)
+        continue;
+      const kept = contents.split(/\r?\n/).slice(-RETAINED_LOG_LINES).join(`
+`);
+      writeFileSync2(file, `[agent-tunnel] earlier entries trimmed
+${kept}`, { mode: 384 });
+      rotated.push(file);
+    } catch {}
+  }
+  return rotated;
+}
+
+// src/agent/service-drivers.ts
+function posixShellCommand(runner) {
+  const interpreter = `"$(command -v ${shellQuote(runner.command)} 2>/dev/null || command -v node)"`;
+  return `exec ${interpreter} ${runner.args.map(shellQuote).join(" ")}`;
+}
+function run(command, args) {
+  const result = spawnSync(command, args, { encoding: "utf8" });
+  return {
+    ok: result.status === 0,
+    detail: [result.stdout, result.stderr].filter(Boolean).join(`
+`).trim()
+  };
+}
+var notInstalled = (what) => ({ ok: false, detail: `${what} is not installed.` });
+function joinDetails(...results) {
+  return results.map((result) => result.detail).filter(Boolean).join(`
+`);
+}
+function launchdTarget() {
+  const uid = typeof process.getuid === "function" ? process.getuid() : userInfo().uid;
+  return `gui/${uid}`;
+}
+function logPaths(paths) {
+  return {
+    stdout: join8(paths.logDir, "agent-tunnel.out.log"),
+    stderr: join8(paths.logDir, "agent-tunnel.err.log")
+  };
+}
+function renderLaunchdPlist(command, paths = getServicePaths()) {
+  const { stdout, stderr } = logPaths(paths);
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${xmlEscape(SERVICE_LABEL)}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/bin/sh</string>
+    <string>-lc</string>
+    <string>${xmlEscape(command)}</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>
+  <key>Umask</key>
+  <integer>63</integer>
+  <key>StandardOutPath</key>
+  <string>${xmlEscape(stdout)}</string>
+  <key>StandardErrorPath</key>
+  <string>${xmlEscape(stderr)}</string>
+  <key>WorkingDirectory</key>
+  <string>${xmlEscape(homedir5())}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+  </dict>
+</dict>
+</plist>
+`;
+}
+function renderSystemdUnit(command, paths = getServicePaths()) {
+  const { stdout, stderr } = logPaths(paths);
+  return `[Unit]
+Description=Kortix Agent Tunnel
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+UMask=0077
+ExecStart=/bin/sh -lc ${shellQuote(command)}
+Restart=on-failure
+RestartSec=5
+WorkingDirectory=${homedir5()}
+Environment=PATH=/usr/local/bin:/usr/bin:/bin
+StandardOutput=append:${stdout}
+StandardError=append:${stderr}
+
+[Install]
+WantedBy=default.target
+`;
+}
+function renderWindowsPowerShellScript(runner) {
+  const command = powershellQuote(runner.command);
+  const args = runner.args.map(powershellQuote).join(" ");
+  return `$ErrorActionPreference = 'Continue'
+while ($true) {
+  & ${command}${args ? ` ${args}` : ""}
+  # A clean exit means the agent stopped for a reason restarting cannot fix,
+  # such as a missing or revoked credential. Anything else is a crash worth retrying.
+  if ($LASTEXITCODE -eq ${TERMINAL_SERVICE_EXIT_CODE}) { break }
+  Start-Sleep -Seconds 5
+}
+`;
+}
+var launchd = {
+  unitPath: (paths) => paths.launchdPlist,
+  install(paths, runner) {
+    mkdirSync2(dirname4(paths.launchdPlist), { recursive: true });
+    writeFileSync3(paths.launchdPlist, renderLaunchdPlist(posixShellCommand(runner), paths), { mode: 384 });
+    run("launchctl", ["bootout", launchdTarget(), paths.launchdPlist]);
+    const boot = run("launchctl", ["bootstrap", launchdTarget(), paths.launchdPlist]);
+    const kick = run("launchctl", ["kickstart", "-k", `${launchdTarget()}/${SERVICE_LABEL}`]);
+    return { installed: true, active: boot.ok || kick.ok ? true : null, detail: joinDetails(boot, kick) };
+  },
+  uninstall(paths) {
+    const existed = existsSync4(paths.launchdPlist);
     const stop = run("launchctl", ["bootout", launchdTarget(), paths.launchdPlist]);
     if (existed)
-      rmSync(paths.launchdPlist, { force: true });
+      rmSync2(paths.launchdPlist, { force: true });
+    return { detail: stop.detail };
+  },
+  start(paths, installed) {
+    const boot = installed ? run("launchctl", ["bootstrap", launchdTarget(), paths.launchdPlist]) : notInstalled("LaunchAgent");
+    const kick = run("launchctl", ["kickstart", "-k", `${launchdTarget()}/${SERVICE_LABEL}`]);
+    return { active: boot.ok || kick.ok ? true : null, detail: joinDetails(boot, kick) };
+  },
+  stop(paths, installed) {
+    const stop = installed ? run("launchctl", ["bootout", launchdTarget(), paths.launchdPlist]) : notInstalled("LaunchAgent");
+    return { detail: stop.detail };
+  },
+  status(paths, installed) {
+    const status = run("launchctl", ["print", `${launchdTarget()}/${SERVICE_LABEL}`]);
     return {
-      platform: platform3(),
-      installed: false,
-      active: false,
-      path: paths.launchdPlist,
-      detail: stop.detail
+      active: status.ok,
+      detail: status.detail || (installed ? readFileSync5(paths.launchdPlist, "utf8") : undefined)
     };
   }
-  if (platform3() === "linux") {
-    const existed = existsSync3(paths.systemdUnit);
+};
+var systemd = {
+  unitPath: (paths) => paths.systemdUnit,
+  install(paths, runner) {
+    mkdirSync2(dirname4(paths.systemdUnit), { recursive: true });
+    writeFileSync3(paths.systemdUnit, renderSystemdUnit(posixShellCommand(runner), paths), { mode: 384 });
+    const reload = run("systemctl", ["--user", "daemon-reload"]);
+    const enable = run("systemctl", ["--user", "enable", "--now", `${SERVICE_LABEL}.service`]);
+    return { installed: true, active: enable.ok ? true : null, detail: joinDetails(reload, enable) };
+  },
+  uninstall(paths) {
+    const existed = existsSync4(paths.systemdUnit);
     const disable = run("systemctl", ["--user", "disable", "--now", `${SERVICE_LABEL}.service`]);
     if (existed)
-      rmSync(paths.systemdUnit, { force: true });
+      rmSync2(paths.systemdUnit, { force: true });
     run("systemctl", ["--user", "daemon-reload"]);
-    return {
-      platform: platform3(),
-      installed: false,
-      active: false,
-      path: paths.systemdUnit,
-      detail: disable.detail
-    };
+    return { detail: disable.detail };
+  },
+  start(_paths, installed) {
+    const start = installed ? run("systemctl", ["--user", "start", `${SERVICE_LABEL}.service`]) : notInstalled("systemd unit");
+    return { active: start.ok ? true : null, detail: start.detail };
+  },
+  stop(_paths, installed) {
+    const stop = installed ? run("systemctl", ["--user", "stop", `${SERVICE_LABEL}.service`]) : notInstalled("systemd unit");
+    return { detail: stop.detail };
+  },
+  status() {
+    const status = run("systemctl", ["--user", "is-active", `${SERVICE_LABEL}.service`]);
+    return { active: status.ok, detail: status.detail };
   }
-  if (platform3() === "win32") {
-    const existed = existsSync3(paths.windowsScript);
+};
+var scheduledTask = {
+  unitPath: (paths) => paths.windowsScript,
+  install(paths, runner) {
+    writeFileSync3(paths.windowsScript, renderWindowsPowerShellScript(runner), { mode: 384 });
+    const create = run("schtasks.exe", [
+      "/Create",
+      "/TN",
+      SERVICE_LABEL,
+      "/TR",
+      `powershell.exe -NoProfile -ExecutionPolicy Bypass -File "${paths.windowsScript}"`,
+      "/SC",
+      "ONLOGON",
+      "/F",
+      "/RL",
+      "LIMITED"
+    ]);
+    const start = run("schtasks.exe", ["/Run", "/TN", SERVICE_LABEL]);
+    return { installed: create.ok, active: start.ok ? true : null, detail: joinDetails(create, start) };
+  },
+  uninstall(paths) {
+    const existed = existsSync4(paths.windowsScript);
     const stop = run("schtasks.exe", ["/End", "/TN", SERVICE_LABEL]);
     const del = run("schtasks.exe", ["/Delete", "/TN", SERVICE_LABEL, "/F"]);
     if (existed)
-      rmSync(paths.windowsScript, { force: true });
-    return {
-      platform: platform3(),
-      installed: false,
-      active: false,
-      path: paths.windowsScript,
-      detail: [stop.detail, del.detail].filter(Boolean).join(`
-`)
-    };
+      rmSync2(paths.windowsScript, { force: true });
+    return { detail: joinDetails(stop, del) };
+  },
+  start(_paths, installed) {
+    const start = installed ? run("schtasks.exe", ["/Run", "/TN", SERVICE_LABEL]) : notInstalled("Scheduled Task");
+    return { active: start.ok ? true : null, detail: start.detail };
+  },
+  stop(_paths, installed) {
+    const stop = installed ? run("schtasks.exe", ["/End", "/TN", SERVICE_LABEL]) : notInstalled("Scheduled Task");
+    return { detail: stop.detail };
+  },
+  status(paths, installed) {
+    const status = run("schtasks.exe", ["/Query", "/TN", SERVICE_LABEL, "/FO", "LIST", "/V"]);
+    const detail = status.detail || (installed ? readFileSync5(paths.windowsScript, "utf8") : undefined);
+    return { active: status.ok ? /Status:\s*Running/i.test(detail ?? "") : false, detail };
   }
-  throw new Error("Background service uninstall is currently supported on macOS launchd, Linux systemd user services, and Windows Scheduled Tasks.");
+};
+var DRIVERS = {
+  darwin: launchd,
+  linux: systemd,
+  win32: scheduledTask
+};
+var SUPPORTED_PLATFORMS_MESSAGE = "Background services are supported on macOS launchd, Linux systemd user services, and Windows Scheduled Tasks.";
+function serviceDriver() {
+  return DRIVERS[platform5()];
 }
-function startService() {
-  const paths = getServicePaths();
-  if (platform3() === "darwin") {
-    const installed = existsSync3(paths.launchdPlist);
-    const boot = installed ? run("launchctl", ["bootstrap", launchdTarget(), paths.launchdPlist]) : { ok: false, detail: "LaunchAgent is not installed." };
-    const kick = run("launchctl", ["kickstart", "-k", `${launchdTarget()}/${SERVICE_LABEL}`]);
-    return {
-      platform: platform3(),
-      installed,
-      active: boot.ok || kick.ok ? true : null,
-      path: paths.launchdPlist,
-      detail: [boot.detail, kick.detail].filter(Boolean).join(`
-`)
-    };
-  }
-  if (platform3() === "linux") {
-    const installed = existsSync3(paths.systemdUnit);
-    const start = installed ? run("systemctl", ["--user", "start", `${SERVICE_LABEL}.service`]) : { ok: false, detail: "systemd unit is not installed." };
-    return {
-      platform: platform3(),
-      installed,
-      active: start.ok ? true : null,
-      path: paths.systemdUnit,
-      detail: start.detail
-    };
-  }
-  if (platform3() === "win32") {
-    const installed = existsSync3(paths.windowsScript);
-    const start = installed ? run("schtasks.exe", ["/Run", "/TN", SERVICE_LABEL]) : { ok: false, detail: "Scheduled Task is not installed." };
-    return {
-      platform: platform3(),
-      installed,
-      active: start.ok ? true : null,
-      path: paths.windowsScript,
-      detail: start.detail
-    };
+
+// src/agent/service.ts
+function isEphemeralRunnerPath(path) {
+  const normalized = path.replace(/\\/g, "/");
+  return normalized.includes("/_npx/") || normalized.includes("/_cacache/") || normalized.includes("/.pnpm-store/") || normalized.includes("/.yarn/$$virtual/");
+}
+function vendorRunner(scriptPath, paths = getServicePaths()) {
+  if (!isEphemeralRunnerPath(scriptPath))
+    return scriptPath;
+  mkdirSync3(paths.binDir, { recursive: true, mode: 448 });
+  const source = realpathSync3(scriptPath);
+  copyFileSync(source, paths.vendoredRunner);
+  try {
+    chmodSync3(paths.vendoredRunner, 448);
+  } catch {}
+  writeFileSync4(join9(paths.binDir, "agent-cli.source.json"), JSON.stringify({ source, vendoredFrom: scriptPath }, null, 2), { mode: 384 });
+  return paths.vendoredRunner;
+}
+function currentRunnerParts() {
+  const script = process.argv[1];
+  if (script && existsSync5(script)) {
+    return { command: process.execPath, args: [vendorRunner(script), "run", "--service"] };
   }
-  throw new Error("Background service start is currently supported on macOS, Linux, and Windows.");
+  throw new Error("Cannot install the background service because the current Agent Tunnel executable was not found");
 }
-function stopService() {
+function withDriver(operate, fallback) {
+  const driver = serviceDriver();
   const paths = getServicePaths();
-  if (platform3() === "darwin") {
-    const installed = existsSync3(paths.launchdPlist);
-    const stop = installed ? run("launchctl", ["bootout", launchdTarget(), paths.launchdPlist]) : { ok: false, detail: "LaunchAgent is not installed." };
-    return {
-      platform: platform3(),
-      installed,
-      active: false,
-      path: paths.launchdPlist,
-      detail: stop.detail
-    };
-  }
-  if (platform3() === "linux") {
-    const installed = existsSync3(paths.systemdUnit);
-    const stop = installed ? run("systemctl", ["--user", "stop", `${SERVICE_LABEL}.service`]) : { ok: false, detail: "systemd unit is not installed." };
-    return {
-      platform: platform3(),
-      installed,
-      active: false,
-      path: paths.systemdUnit,
-      detail: stop.detail
-    };
-  }
-  if (platform3() === "win32") {
-    const installed = existsSync3(paths.windowsScript);
-    const stop = installed ? run("schtasks.exe", ["/End", "/TN", SERVICE_LABEL]) : { ok: false, detail: "Scheduled Task is not installed." };
-    return {
-      platform: platform3(),
-      installed,
-      active: false,
-      path: paths.windowsScript,
-      detail: stop.detail
-    };
-  }
-  throw new Error("Background service stop is currently supported on macOS, Linux, and Windows.");
+  if (!driver)
+    throw new Error(SUPPORTED_PLATFORMS_MESSAGE);
+  const path = driver.unitPath(paths);
+  const installed = existsSync5(path);
+  const outcome = operate(driver, paths, installed);
+  return {
+    platform: platform6(),
+    installed: outcome.installed ?? installed,
+    active: outcome.active ?? fallback.active,
+    path,
+    detail: outcome.detail
+  };
+}
+function installService() {
+  const paths = getServicePaths();
+  mkdirSync3(paths.configDir, { recursive: true, mode: 448 });
+  mkdirSync3(paths.logDir, { recursive: true, mode: 448 });
+  rotateServiceLogs(paths);
+  const runner = currentRunnerParts();
+  return withDriver((driver, servicePaths) => driver.install(servicePaths, runner), { installed: false, active: null });
+}
+function uninstallService() {
+  rmSync3(getServicePaths().binDir, { recursive: true, force: true });
+  return withDriver((driver, paths) => ({ ...driver.uninstall(paths), installed: false, active: false }), { installed: false, active: false });
+}
+function startService() {
+  return withDriver((driver, paths, installed) => driver.start(paths, installed), { installed: false, active: null });
+}
+function stopService() {
+  return withDriver((driver, paths, installed) => ({ ...driver.stop(paths, installed), active: false }), { installed: false, active: false });
 }
 function restartService() {
   stopService();
   return startService();
 }
 function getServiceStatus() {
-  const paths = getServicePaths();
-  if (platform3() === "darwin") {
-    const installed = existsSync3(paths.launchdPlist);
-    const status = run("launchctl", ["print", `${launchdTarget()}/${SERVICE_LABEL}`]);
-    return {
-      platform: platform3(),
-      installed,
-      active: status.ok,
-      path: paths.launchdPlist,
-      detail: status.detail || (installed ? readFileSync2(paths.launchdPlist, "utf8") : undefined)
-    };
-  }
-  if (platform3() === "linux") {
-    const installed = existsSync3(paths.systemdUnit);
-    const status = run("systemctl", ["--user", "is-active", `${SERVICE_LABEL}.service`]);
-    return {
-      platform: platform3(),
-      installed,
-      active: status.ok,
-      path: paths.systemdUnit,
-      detail: status.detail
-    };
-  }
-  if (platform3() === "win32") {
-    const installed = existsSync3(paths.windowsScript);
-    const status = run("schtasks.exe", ["/Query", "/TN", SERVICE_LABEL, "/FO", "LIST", "/V"]);
-    const detail = status.detail || (installed ? readFileSync2(paths.windowsScript, "utf8") : undefined);
+  if (!serviceDriver()) {
     return {
-      platform: platform3(),
-      installed,
-      active: status.ok ? /Status:\s*Running/i.test(detail ?? "") : false,
-      path: paths.windowsScript,
-      detail
-    };
-  }
-  return {
-    platform: platform3(),
-    installed: false,
-    active: null,
-    detail: "Background service status is currently supported on macOS launchd, Linux systemd user services, and Windows Scheduled Tasks."
-  };
-}
-
-// src/agent/cli.ts
-import { hostname as hostname2, platform as platform4, arch as arch2 } from "os";
-import { chmodSync as chmodSync2, existsSync as existsSync4, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, readFileSync as readFileSync3, renameSync } from "fs";
-import { join as join6 } from "path";
-import { homedir as homedir4 } from "os";
-import { spawn as spawn3 } from "child_process";
-import { createInterface } from "readline/promises";
-var c2 = {
-  reset: "\x1B[0m",
-  bold: "\x1B[1m",
-  dim: "\x1B[2m",
-  italic: "\x1B[3m",
-  cyan: "\x1B[36m",
-  blue: "\x1B[34m",
-  green: "\x1B[32m",
-  yellow: "\x1B[33m",
-  red: "\x1B[31m",
-  magenta: "\x1B[35m",
-  white: "\x1B[97m",
-  gray: "\x1B[90m",
-  bgCyan: "\x1B[46m",
-  bgBlue: "\x1B[44m"
-};
-function parseArgs(argv) {
-  const command = argv[2] || "help";
-  const flags = {};
-  for (let i = 3;i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg.startsWith("--")) {
-      const key = arg.slice(2);
-      const value = argv[i + 1] && !argv[i + 1].startsWith("--") ? argv[++i] : "true";
-      flags[key] = value;
-    }
+      platform: platform6(),
+      installed: false,
+      active: null,
+      detail: SUPPORTED_PLATFORMS_MESSAGE
+    };
   }
-  return { command, flags };
-}
-function clearScreen() {
-  process.stdout.write("\x1B[2J\x1B[3J\x1B[H");
+  return withDriver((driver, paths, installed) => driver.status(paths, installed), { installed: false, active: null });
 }
-var sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
-var TUNNEL_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-var SETUP_TOKEN_PATTERN = /^kortix_tnl_[A-Za-z0-9_-]{32,64}$/;
 
-class InvalidDeviceAuthResponseError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "InvalidDeviceAuthResponseError";
-  }
+// src/agent/service-control.ts
+function acquireTunnelLease() {
+  const serviceWasActive = getServiceStatus().active === true;
+  if (serviceWasActive)
+    stopService();
+  let resumed = false;
+  return {
+    serviceWasActive,
+    resumeService() {
+      if (!serviceWasActive || resumed)
+        return;
+      resumed = true;
+      startService();
+    }
+  };
 }
-function isJsonRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
+var SERVICE_ACTIONS = {
+  start: { run: startService, label: "started" },
+  stop: { run: stopService, label: "stopped" },
+  restart: { run: restartService, label: "restarted" },
+  uninstall: { run: uninstallService, label: "removed" },
+  install: { run: installService, label: "installed" }
+};
+function describeService(status) {
+  if (!status.installed)
+    return `${glyph.off} not installed`;
+  if (status.active)
+    return `${glyph.on} running ${c.dim}· starts at login${c.reset}`;
+  return `${c.yellow}○${c.reset} installed ${c.dim}· stopped${c.reset}`;
 }
-function parseApprovedDeviceCredentials(value) {
-  const { tunnelId, token } = value;
-  if (typeof tunnelId !== "string" || !TUNNEL_ID_PATTERN.test(tunnelId)) {
-    throw new InvalidDeviceAuthResponseError("Authorization server returned an invalid tunnel ID");
-  }
-  if (typeof token !== "string" || !SETUP_TOKEN_PATTERN.test(token)) {
-    throw new InvalidDeviceAuthResponseError("Authorization server returned an invalid setup token");
-  }
-  return { tunnelId, token };
+function renderServiceAction(action, status) {
+  blankLine();
+  console.log(`  ${glyph.on} ${c.bold}Background service ${SERVICE_ACTIONS[action].label}${c.reset}`);
+  if (status.path)
+    field("", `${c.dim}${status.path}${c.reset}`);
+  if (status.detail)
+    field("", `${c.gray}${status.detail}${c.reset}`);
+  blankLine();
 }
-function parseDeviceAuthChallenge(value) {
-  if (!isJsonRecord(value)) {
-    throw new InvalidDeviceAuthResponseError("Authorization server returned an invalid challenge");
-  }
-  const { deviceCode, deviceSecret, verificationUrl, expiresAt, pollIntervalMs } = value;
-  if (typeof deviceCode !== "string" || !/^[A-Z]{4}-[0-9]{4}$/.test(deviceCode)) {
-    throw new InvalidDeviceAuthResponseError("Authorization server returned an invalid device code");
-  }
-  if (typeof deviceSecret !== "string" || !/^[A-Za-z0-9]{32}$/.test(deviceSecret)) {
-    throw new InvalidDeviceAuthResponseError("Authorization server returned an invalid device secret");
-  }
-  if (typeof verificationUrl !== "string" || verificationUrl.length > 2048) {
-    throw new InvalidDeviceAuthResponseError("Authorization server returned an invalid verification URL");
-  }
-  const browserUrl = normalizeBrowserUrl(verificationUrl);
-  if (!browserUrl) {
-    throw new InvalidDeviceAuthResponseError("Authorization server returned an invalid verification URL");
-  }
-  const parsedVerificationUrl = new URL(browserUrl);
-  const loopback = parsedVerificationUrl.hostname === "localhost" || parsedVerificationUrl.hostname === "127.0.0.1" || parsedVerificationUrl.hostname === "[::1]" || parsedVerificationUrl.hostname === "::1";
-  if (parsedVerificationUrl.username || parsedVerificationUrl.password || parsedVerificationUrl.protocol !== "https:" && !loopback) {
-    throw new InvalidDeviceAuthResponseError("Authorization server returned an unsafe verification URL");
-  }
-  if (typeof expiresAt !== "string") {
-    throw new InvalidDeviceAuthResponseError("Authorization server returned an invalid expiration");
-  }
-  const expiresAtMs = Date.parse(expiresAt);
-  const now = Date.now();
-  if (!Number.isFinite(expiresAtMs) || expiresAtMs <= now || expiresAtMs > now + 10 * 60000) {
-    throw new InvalidDeviceAuthResponseError("Authorization server returned an invalid expiration");
-  }
-  if (!Number.isSafeInteger(pollIntervalMs) || pollIntervalMs < 250 || pollIntervalMs > 1e4) {
-    throw new InvalidDeviceAuthResponseError("Authorization server returned an invalid poll interval");
+
+// src/agent/cli.ts
+var ALL_CAPABILITIES = ["filesystem", "shell", "desktop"];
+var BACKGROUND_FLAGS = ["daemon", "service", "background", "always-online"];
+var FOREGROUND_FLAGS = ["foreground", "no-daemon", "no-service", "no-background"];
+var DEFAULT_LOG_LINES = 60;
+function parseArgs(argv) {
+  const flags = {};
+  for (let i = 3;i < argv.length; i++) {
+    const arg = argv[i];
+    if (!arg.startsWith("--"))
+      continue;
+    const next = argv[i + 1];
+    flags[arg.slice(2)] = next && !next.startsWith("--") ? argv[++i] : "true";
   }
-  return {
-    deviceCode,
-    deviceSecret,
-    verificationUrl: browserUrl,
-    expiresAt,
-    pollIntervalMs
-  };
+  return { command: argv[2] || "help", flags };
 }
-async function printStartup(config, capabilities, version) {
-  const machine = hostname2();
-  const plat = `${platform4()} ${arch2()}`;
-  const truncate = (s, max) => s.length > max ? s.slice(0, max) + "…" : s;
-  const tunnelDisplay = truncate(config.tunnelId, 40);
-  const apiDisplay = truncate(config.apiUrl, 40);
-  const machineDisplay = truncate(machine, 28);
-  console.log("");
-  console.log(`      ${c2.cyan}▄▀█ █▀▀ █▀▀ █▄ █ ▀█▀${c2.reset}   ${c2.cyan}▀█▀ █ █ █▄ █ █▄ █ █▀▀ █  ${c2.reset}`);
-  console.log(`      ${c2.cyan}█▀█ █▄█ ██▄ █ ▀█  █${c2.reset}    ${c2.cyan} █  █▄█ █ ▀█ █ ▀█ ██▄ █▄▄${c2.reset}`);
-  console.log("");
-  const barW = 50;
-  const frames = 14;
-  for (let i = 0;i <= frames; i++) {
-    const filled = Math.round(i / frames * barW);
-    const empty = barW - filled;
-    process.stdout.write(`\r      ${c2.cyan}◇${c2.reset} ${c2.cyan}${"═".repeat(filled)}${c2.reset}${c2.gray}${"─".repeat(empty)}${c2.reset}  `);
-    await sleep2(20);
-  }
-  process.stdout.write(`\r      ${c2.cyan}◇ ${"═".repeat(barW)} ◆${c2.reset}  
-`);
-  await sleep2(120);
-  const W = 60;
-  const vLen = (s) => s.replace(/\x1b\[[0-9;]*m/g, "").length;
-  const row = (content) => {
-    const pad = Math.max(0, W - vLen(content));
-    console.log(`  ${c2.gray}│${c2.reset}${content}${" ".repeat(pad)}${c2.gray}│${c2.reset}`);
-  };
-  const blank = () => console.log(`  ${c2.gray}│${c2.reset}${" ".repeat(W)}${c2.gray}│${c2.reset}`);
-  const titleL = `   ${c2.cyan}◆${c2.reset}  ${c2.bold}${c2.white}Agent Tunnel${c2.reset}`;
-  const titleR = `${c2.dim}v${version}${c2.reset}   `;
-  const titleLLen = 18;
-  const titleRLen = 1 + version.length + 3;
-  const titlePad = Math.max(1, W - titleLLen - titleRLen);
-  const capStr = capabilities.map((name) => `${c2.green}●${c2.reset} ${c2.white}${name}${c2.reset}`).join("   ");
-  const brand = "created by kortix";
-  const brandFill = W - brand.length - 3;
-  console.log("");
-  console.log(`  ${c2.gray}╭${"─".repeat(W)}╮${c2.reset}`);
-  blank();
-  row(`${titleL}${" ".repeat(titlePad)}${titleR}`);
-  row(`   ${c2.dim}Bridge between AI agents & local machines${c2.reset}`);
-  blank();
-  row(`   ${c2.dim}tunnel${c2.reset}    ${c2.white}${tunnelDisplay}${c2.reset}`);
-  row(`   ${c2.dim}relay${c2.reset}     ${c2.white}${apiDisplay}${c2.reset}`);
-  row(`   ${c2.dim}machine${c2.reset}   ${c2.white}${machineDisplay}${c2.reset} ${c2.dim}(${plat})${c2.reset}`);
-  blank();
-  console.log(`  ${c2.gray}╰${"─".repeat(brandFill)} ${c2.dim}created by ${c2.cyan}kortix${c2.reset} ${c2.gray}─╯${c2.reset}`);
-  console.log("");
+function fail(message) {
+  console.error(`  ${glyph.bad} ${message}`);
+  process.exit(1);
+}
+function shortenHomePath(path) {
+  const home = process.env.HOME ?? "";
+  return home && path.startsWith(home) ? `~${path.slice(home.length)}` : path;
 }
 function startAgent(config, options = {}) {
   const registry = createEnabledCapabilityRegistry(config);
   if (config.enabledCapabilities?.includes("desktop") && !registry.has("desktop")) {
     console.error("[agent-tunnel] Computer Use is approved but unavailable: install the trusted cua-driver locally, then restart Agent Tunnel.");
   }
-  if (!options.service) {
-    clearScreen();
-    printStartup(config, registry.getCapabilityNames(), "0.1.2");
-  } else {
+  if (options.service) {
     console.log(`[agent-tunnel] service starting: ${config.tunnelId} -> ${config.apiUrl}`);
+  } else {
+    clearScreen();
+    printStartupBanner({
+      tunnelId: config.tunnelId,
+      apiUrl: config.apiUrl,
+      capabilities: registry.getCapabilityNames(),
+      version: agentTunnelVersion()
+    });
   }
-  const agent = new TunnelAgent(config, registry);
+  const agent = new TunnelAgent(config, registry, {
+    onTerminalClose: ({ reason }) => {
+      if (!options.service)
+        return;
+      console.log(`[agent-tunnel] stopping service: ${reason}`);
+      process.exit(TERMINAL_SERVICE_EXIT_CODE);
+    }
+  });
   agent.connect();
   const shutdown = () => {
     if (!options.service)
       console.log(`
-${c2.dim}  Shutting down…${c2.reset}`);
+${c.dim}  Shutting down…${c.reset}`);
     agent.disconnect();
     process.exit(0);
   };
   process.on("SIGTERM", shutdown);
   process.on("SIGINT", shutdown);
 }
-function normalizeBrowserUrl(value) {
-  try {
-    const url = new URL(value);
-    return url.protocol === "https:" || url.protocol === "http:" ? url.toString() : null;
-  } catch {
-    return null;
-  }
+async function chooseBackgroundMode(flags) {
+  if (anyFlag(flags, BACKGROUND_FLAGS))
+    return true;
+  if (anyFlag(flags, FOREGROUND_FLAGS))
+    return false;
+  if (!isInteractiveTerminal())
+    return false;
+  blankLine();
+  console.log(`  ${glyph.warn} ${c.bold}Security note${c.reset}`);
+  console.log(`  ${c.dim}Background mode starts at login, continues after this terminal closes, and restarts after failures.${c.reset}`);
+  console.log(`  ${c.dim}The computer must remain powered on, awake, and connected to the internet.${c.reset}`);
+  blankLine();
+  return promptYesNo("  Install the background service now?", DEFAULT_INSTALL_BACKGROUND_SERVICE);
 }
-function openBrowser(url) {
-  if (process.env.KORTIX_AGENT_TUNNEL_NO_BROWSER === "1")
-    return;
-  const safeUrl = normalizeBrowserUrl(url);
-  if (!safeUrl)
+async function launch(config, flags, lease) {
+  if (await chooseBackgroundMode(flags)) {
+    saveCredentials(config.tunnelId, config.token, config.apiUrl);
+    renderServiceAction("install", SERVICE_ACTIONS.install.run());
     return;
-  try {
-    const plat = platform4();
-    let command;
-    let args;
-    if (plat === "darwin") {
-      command = "open";
-      args = [safeUrl];
-    } else if (plat === "win32") {
-      command = "rundll32.exe";
-      args = ["url.dll,FileProtocolHandler", safeUrl];
-    } else {
-      command = "xdg-open";
-      args = [safeUrl];
-    }
-    const child = spawn3(command, args, { detached: true, stdio: "ignore" });
-    child.unref();
-  } catch {}
-}
-var CONFIG_DIR2 = join6(homedir4(), ".agent-tunnel");
-var CONFIG_FILE2 = join6(CONFIG_DIR2, "config.json");
-function isSetupTunnelToken(token) {
-  return token.startsWith("kortix_tnl_") || token.startsWith("tnl_");
-}
-function isTruthyFlag(value) {
-  return value === "true" || value === "1" || value === "yes";
-}
-function isInteractiveTerminal() {
-  return process.stdin.isTTY === true && process.stdout.isTTY === true;
-}
-async function promptYesNo(question, defaultValue) {
-  const suffix = defaultValue ? " [Y/n] " : " [y/N] ";
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  try {
-    for (;; ) {
-      const answer = (await rl.question(`${question}${suffix}`)).trim().toLowerCase();
-      if (!answer)
-        return defaultValue;
-      if (["y", "yes"].includes(answer))
-        return true;
-      if (["n", "no"].includes(answer))
-        return false;
-      console.log(`  ${c2.yellow}!${c2.reset} Please answer yes or no.`);
-    }
-  } catch (error) {
-    if (error instanceof Error && error.name === "AbortError") {
-      process.stdout.write(`
-`);
-      process.exit(130);
-    }
-    throw error;
-  } finally {
-    rl.close();
-  }
-}
-async function chooseConnectMode(flags) {
-  const explicitBackground = isTruthyFlag(flags.daemon) || isTruthyFlag(flags.service) || isTruthyFlag(flags.background) || isTruthyFlag(flags["always-online"]);
-  const explicitForeground = isTruthyFlag(flags.foreground) || isTruthyFlag(flags["no-daemon"]) || isTruthyFlag(flags["no-service"]) || isTruthyFlag(flags["no-background"]);
-  if (explicitBackground) {
-    return { background: true };
   }
-  if (explicitForeground) {
-    return { background: false };
+  if (lease?.serviceWasActive) {
+    console.log(`  ${c.dim}Background service stays paused while this terminal holds the tunnel.${c.reset}`);
+    console.log(`  ${c.dim}Resume it with${c.reset} ${c.white}agent-tunnel start${c.reset}${c.dim}, or leave it — it starts again at login.${c.reset}`);
   }
-  if (!isInteractiveTerminal()) {
-    return { background: false };
-  }
-  console.log("");
-  console.log(`  ${c2.yellow}!${c2.reset} ${c2.bold}Security note${c2.reset}`);
-  console.log(`  ${c2.dim}Background mode starts at login, continues after this terminal closes, and restarts after failures.${c2.reset}`);
-  console.log(`  ${c2.dim}The computer must remain powered on, awake, and connected to the internet.${c2.reset}`);
-  console.log("");
-  const background = await promptYesNo("  Install the background service now?", DEFAULT_INSTALL_BACKGROUND_SERVICE);
-  return { background };
-}
-function installBackgroundService() {
-  const status = installService();
-  console.log("");
-  console.log(`  ${c2.green}●${c2.reset} ${c2.bold}Background service installed${c2.reset}`);
-  if (status.path)
-    console.log(`  ${c2.dim}${status.path}${c2.reset}`);
-  console.log(`  ${c2.dim}Starts at login and restarts after failures.${c2.reset}`);
-  if (status.detail)
-    console.log(`  ${c2.gray}${status.detail}${c2.reset}`);
-  console.log("");
+  startAgent(config);
 }
-function saveCredentials(tunnelId, token, apiUrl, enabledCapabilities) {
-  mkdirSync2(CONFIG_DIR2, { recursive: true, mode: 448 });
-  try {
-    chmodSync2(CONFIG_DIR2, 448);
-  } catch {}
-  let existing = {};
-  if (existsSync4(CONFIG_FILE2)) {
-    try {
-      existing = JSON.parse(readFileSync3(CONFIG_FILE2, "utf-8"));
-    } catch {}
-  }
-  const tmpFile = join6(CONFIG_DIR2, `config.${process.pid}.${Date.now()}.tmp`);
-  const next = {
-    ...existing,
-    tunnelId,
-    token,
-    apiUrl,
-    ...enabledCapabilities !== undefined ? { enabledCapabilities } : {}
-  };
-  writeFileSync2(tmpFile, JSON.stringify(next, null, 2), { mode: 384, flag: "wx" });
-  try {
-    chmodSync2(tmpFile, 384);
-  } catch {}
-  renameSync(tmpFile, CONFIG_FILE2);
+async function pairThisMachine(apiUrl, flags) {
+  blankLine();
+  console.log(`  ${glyph.mark} ${c.bold}Device Authorization${c.reset}`);
+  blankLine();
+  let challenge;
   try {
-    chmodSync2(CONFIG_FILE2, 384);
-  } catch {}
-}
-async function commandConnectDeviceAuth(config, flags) {
-  console.log("");
-  console.log(`  ${c2.cyan}◆${c2.reset} ${c2.bold}Device Authorization${c2.reset}`);
-  console.log("");
-  let deviceCode;
-  let deviceSecret;
-  let verificationUrl;
-  let expiresAt;
-  let pollIntervalMs;
+    challenge = await requestDeviceAuthorization(apiUrl);
+  } catch (error) {
+    fail(error instanceof InvalidDeviceAuthResponseError ? error.message : "Failed to start device authorization");
+  }
+  console.log(`  ${c.dim}Code:${c.reset}  ${c.bold}${c.white}${challenge.deviceCode}${c.reset}`);
+  blankLine();
+  console.log(`  ${c.dim}Open this URL on any device to approve:${c.reset}`);
+  console.log(`  ${c.cyan}${challenge.verificationUrl}${c.reset}`);
+  blankLine();
+  openBrowser(challenge.verificationUrl);
+  let outcome;
   try {
-    const res = await fetch(`${config.apiUrl}/device-auth`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ machineHostname: hostname2() })
+    outcome = await awaitDeviceAuthorization(apiUrl, challenge, {
+      onWaiting: (secondsRemaining) => {
+        const minutes = Math.floor(secondsRemaining / 60);
+        const seconds = String(secondsRemaining % 60).padStart(2, "0");
+        process.stdout.write(`\r  ${c.dim}Waiting for approval... ${c.white}${minutes}:${seconds}${c.reset}  `);
+      }
     });
-    if (!res.ok) {
-      const text = await res.text().catch(() => "");
-      console.error(`  ${c2.red}✗${c2.reset} Failed to create device auth request: ${res.status} ${text.slice(0, 200)}`);
-      process.exit(1);
-    }
-    const challenge = parseDeviceAuthChallenge(await res.json());
-    deviceCode = challenge.deviceCode;
-    deviceSecret = challenge.deviceSecret;
-    verificationUrl = challenge.verificationUrl;
-    expiresAt = challenge.expiresAt;
-    pollIntervalMs = challenge.pollIntervalMs;
-  } catch (err) {
-    const detail = err instanceof InvalidDeviceAuthResponseError ? `: ${err.message}` : "";
-    console.error(`  ${c2.red}✗${c2.reset} Failed to start device authorization${detail}`);
+  } catch (error) {
+    process.stdout.write(`\r${" ".repeat(60)}\r`);
+    fail(error instanceof Error ? error.message : "Device authorization failed");
+  }
+  process.stdout.write(`\r${" ".repeat(60)}\r`);
+  if (outcome.status === "denied")
+    fail("Authorization denied.");
+  if (outcome.status === "expired")
+    fail("Authorization expired. Please try again.");
+  if (outcome.status === "approved-without-token") {
+    fail("Authorization was approved, but the setup token was not available. Run connect again.");
+  }
+  if (outcome.capabilities.length === 0) {
+    console.log(`  ${glyph.bad} ${c.bold}No capabilities were approved${c.reset}`);
+    blankLine();
+    console.log(`  ${c.dim}A tunnel with no capabilities connects but cannot act, and the${c.reset}`);
+    console.log(`  ${c.dim}approved set can only be changed by pairing again. Nothing was saved.${c.reset}`);
+    blankLine();
+    console.log(`  ${c.dim}Run connect again and approve at least one of${c.reset} ${c.white}${ALL_CAPABILITIES.join(", ")}${c.reset}${c.dim}.${c.reset}`);
+    blankLine();
     process.exit(1);
-    return;
-  }
-  console.log(`  ${c2.dim}Code:${c2.reset}  ${c2.bold}${c2.white}${deviceCode}${c2.reset}`);
-  console.log("");
-  console.log(`  ${c2.dim}Open this URL on any device to approve:${c2.reset}`);
-  console.log(`  ${c2.cyan}${verificationUrl}${c2.reset}`);
-  console.log("");
-  openBrowser(verificationUrl);
-  const expiresAtMs = new Date(expiresAt).getTime();
-  while (true) {
-    const remaining = Math.max(0, Math.floor((expiresAtMs - Date.now()) / 1000));
-    if (remaining <= 0) {
-      console.log(`
-  ${c2.red}✗${c2.reset} Authorization expired. Please try again.`);
-      process.exit(1);
-    }
-    const min = Math.floor(remaining / 60);
-    const sec = remaining % 60;
-    process.stdout.write(`\r  ${c2.dim}Waiting for approval... ${c2.white}${min}:${sec.toString().padStart(2, "0")}${c2.reset}  `);
-    try {
-      const res = await fetch(`${config.apiUrl}/device-auth/${deviceCode}/status`, {
-        headers: { Authorization: `Bearer ${deviceSecret}` }
-      });
-      if (res.ok) {
-        const data = await res.json();
-        if (!isJsonRecord(data) || typeof data.status !== "string") {
-          throw new InvalidDeviceAuthResponseError("Authorization server returned an invalid status response");
-        }
-        if (data.status === "approved" && data.tunnelId && data.token) {
-          const credentials = parseApprovedDeviceCredentials(data);
-          process.stdout.write("\r" + " ".repeat(60) + "\r");
-          console.log(`  ${c2.green}●${c2.reset} ${c2.bold}Authorized!${c2.reset}`);
-          console.log("");
-          const enabledCapabilities = Array.isArray(data.capabilities) ? [...new Set(data.capabilities)].filter((capability) => typeof capability === "string" && ["filesystem", "shell", "desktop"].includes(capability)) : [];
-          saveCredentials(credentials.tunnelId, credentials.token, config.apiUrl, enabledCapabilities);
-          console.log(`  ${c2.dim}Credentials saved to ${CONFIG_FILE2}${c2.reset}`);
-          console.log(`  ${c2.dim}Local capabilities: ${enabledCapabilities.join(", ") || "none"}${c2.reset}`);
-          console.log("");
-          const mode = await chooseConnectMode(flags);
-          if (mode.background) {
-            installBackgroundService();
-            return;
-          }
-          const fullConfig = loadConfig({
-            token: credentials.token,
-            tunnelId: credentials.tunnelId,
-            apiUrl: config.apiUrl
-          });
-          startAgent(fullConfig);
-          return;
-        }
-        if (data.status === "approved") {
-          process.stdout.write("\r" + " ".repeat(60) + "\r");
-          console.log(`  ${c2.red}✗${c2.reset} Authorization was approved, but the setup token was not available.`);
-          console.log(`  ${c2.dim}Run the connect command again to create a fresh device authorization code.${c2.reset}`);
-          process.exit(1);
-        }
-        if (data.status === "denied") {
-          process.stdout.write("\r" + " ".repeat(60) + "\r");
-          console.log(`  ${c2.red}✗${c2.reset} Authorization denied.`);
-          process.exit(1);
-        }
-        if (data.status === "expired") {
-          process.stdout.write("\r" + " ".repeat(60) + "\r");
-          console.log(`  ${c2.red}✗${c2.reset} Authorization expired. Please try again.`);
-          process.exit(1);
-        }
-      }
-    } catch (error) {
-      if (error instanceof InvalidDeviceAuthResponseError) {
-        process.stdout.write("\r" + " ".repeat(60) + "\r");
-        console.error(`  ${c2.red}✗${c2.reset} ${error.message}`);
-        process.exit(1);
-      }
-    }
-    await sleep2(pollIntervalMs);
   }
+  console.log(`  ${glyph.on} ${c.bold}Authorized${c.reset}`);
+  saveCredentials(outcome.tunnelId, outcome.token, apiUrl, outcome.capabilities);
+  console.log(`  ${c.dim}Saved to ${CONFIG_FILE2}${c.reset}`);
+  console.log(`  ${c.dim}Access: ${outcome.capabilities.join(", ")}${c.reset}`);
+  blankLine();
+  await launch(loadConfig({ apiUrl }), flags);
 }
 async function commandConnect(flags) {
   const config = loadConfig({
@@ -5369,195 +5608,260 @@ async function commandConnect(flags) {
     tunnelId: flags["tunnel-id"],
     apiUrl: flags["api-url"]
   });
-  if (config.token && config.tunnelId) {
-    const mode = await chooseConnectMode(flags);
-    if (mode.background) {
-      saveCredentials(config.tunnelId, config.token, config.apiUrl);
-      installBackgroundService();
-      return;
-    }
-    startAgent(config);
+  const explicitCredentials = Boolean(flags.token && flags["tunnel-id"]);
+  if (Boolean(config.token) !== Boolean(config.tunnelId)) {
+    fail("Provide both --token and --tunnel-id, or neither (for device auth)");
+  }
+  if (!config.token) {
+    await pairThisMachine(config.apiUrl, flags);
     return;
   }
-  if (!config.token && !config.tunnelId) {
-    await commandConnectDeviceAuth(config, flags);
+  if (isTruthyFlag(flags.reauth) && !explicitCredentials) {
+    clearSavedCredentials();
+    await pairThisMachine(config.apiUrl, flags);
     return;
   }
-  console.error(`${c2.red}${c2.bold} error${c2.reset} Provide both --token and --tunnel-id, or neither (for device auth)`);
-  process.exit(1);
+  const lease = acquireTunnelLease();
+  blankLine();
+  console.log(`  ${glyph.mark} ${c.dim}Checking saved credentials…${c.reset}`);
+  let probe;
+  try {
+    probe = await probeCredentials(config, {
+      capabilities: createEnabledCapabilityRegistry(config).getCapabilityNames()
+    });
+  } catch (error) {
+    lease.resumeService();
+    throw error;
+  }
+  if (probe === "unreachable") {
+    lease.resumeService();
+    fail(`Cannot reach the relay at ${config.apiUrl}. Check your network, then run connect again.`);
+  }
+  if (probe === "rejected") {
+    if (explicitCredentials)
+      fail("The supplied --token was rejected for this tunnel.");
+    console.log(`  ${glyph.warn} ${c.dim}Saved token rejected — re-authorizing${c.reset}`);
+    clearSavedCredentials();
+    await pairThisMachine(config.apiUrl, flags);
+    return;
+  }
+  await launch(config, flags, lease);
 }
-async function commandRun(flags) {
+function commandRun(flags) {
   const config = loadConfig({
     token: flags.token,
     tunnelId: flags["tunnel-id"],
     apiUrl: flags["api-url"]
   });
+  const asService = flags.service === "true";
   if (!config.token || !config.tunnelId) {
-    console.error(`${c2.red}${c2.bold} error${c2.reset} No saved tunnel credentials found. Run \`agent-tunnel connect\` first.`);
-    process.exit(1);
+    console.error(`  ${glyph.bad} No saved tunnel credentials found. Run \`agent-tunnel connect\` first.`);
+    process.exit(asService ? TERMINAL_SERVICE_EXIT_CODE : 1);
   }
-  startAgent(config, { service: flags.service === "true" });
+  if (asService)
+    rotateServiceLogs();
+  startAgent(config, { service: asService });
 }
-async function commandStatus(flags) {
-  const config = loadConfig({
-    token: flags.token,
-    tunnelId: flags["tunnel-id"],
-    apiUrl: flags["api-url"]
-  });
-  if (!config.token || !config.tunnelId) {
-    console.error("Error: --token and --tunnel-id are required");
-    process.exit(1);
+function lastServiceActivity() {
+  try {
+    const lines = readFileSync6(join10(getServicePaths().logDir, "agent-tunnel.out.log"), "utf8").split(/\r?\n/).map((line) => stripAnsi(line).trim()).filter((line) => line.length > 0);
+    return lines.at(-1) ?? null;
+  } catch {
+    return null;
   }
-  if (isSetupTunnelToken(config.token)) {
+}
+function commandStatus(flags) {
+  const config = loadConfig({ apiUrl: flags["api-url"] });
+  const service = getServiceStatus();
+  const paired = Boolean(config.token && config.tunnelId);
+  const approved = new Set(config.enabledCapabilities ?? []);
+  if (isTruthyFlag(flags.json)) {
     console.log(JSON.stringify({
-      tunnelId: config.tunnelId,
+      paired,
+      tunnelId: paired ? config.tunnelId : null,
       apiUrl: config.apiUrl,
-      credential: "device-setup-token",
-      note: "Saved device credentials authenticate the local WebSocket agent. HTTP live status requires a user or sandbox API key.",
-      service: getServiceStatus()
+      capabilities: [...approved],
+      version: agentTunnelVersion(),
+      service,
+      lastActivity: lastServiceActivity()
     }, null, 2));
     return;
   }
-  try {
-    const res = await fetch(`${config.apiUrl}/connections/${config.tunnelId}`, {
-      headers: { Authorization: `Bearer ${config.token}` }
-    });
-    if (!res.ok) {
-      console.error(`Error: ${res.status} ${await res.text()}`);
-      process.exit(1);
-    }
-    const data = await res.json();
-    console.log(JSON.stringify(data, null, 2));
-  } catch (err) {
-    console.error("Error:", err);
-    process.exit(1);
-  }
-}
-function commandInstallService(flags) {
-  const config = loadConfig({
-    token: flags.token,
-    tunnelId: flags["tunnel-id"],
-    apiUrl: flags["api-url"]
-  });
-  if (!config.token || !config.tunnelId) {
-    console.error(`${c2.red}${c2.bold} error${c2.reset} No saved tunnel credentials found. Run \`agent-tunnel connect\` first, or pass --token and --tunnel-id.`);
-    process.exit(1);
-  }
-  if (flags.token && flags["tunnel-id"]) {
-    saveCredentials(config.tunnelId, config.token, config.apiUrl);
+  blankLine();
+  console.log(`  ${glyph.mark}  ${c.bold}${c.white}Agent Tunnel${c.reset} ${c.dim}v${agentTunnelVersion()}${c.reset}   ${c.dim}${hostname4()}${c.reset}`);
+  blankLine();
+  if (!paired) {
+    console.log(`  ${glyph.off} ${c.bold}Not paired${c.reset}`);
+    blankLine();
+    console.log(`  ${c.dim}Pair this machine:${c.reset} ${c.white}agent-tunnel connect --api-url <url>${c.reset}`);
+    blankLine();
+    return;
   }
-  const status = installService();
-  console.log(JSON.stringify(status, null, 2));
-}
-function commandUninstallService() {
-  console.log(JSON.stringify(uninstallService(), null, 2));
-}
-function commandStartService() {
-  console.log(JSON.stringify(startService(), null, 2));
+  field("tunnel", `${c.white}${config.tunnelId}${c.reset}`);
+  field("relay", `${c.white}${config.apiUrl}${c.reset}`);
+  field("capabilities", ALL_CAPABILITIES.map((name) => approved.has(name) ? `${glyph.on} ${c.white}${name}${c.reset}` : `${c.gray}○ ${name}${c.reset}`).join("   "));
+  blankLine();
+  field("service", describeService(service));
+  if (service.installed && service.path)
+    field("", `${c.dim}${shortenHomePath(service.path)}${c.reset}`);
+  const activity = lastServiceActivity();
+  if (activity)
+    field("last log", `${c.dim}${activity}${c.reset}`);
+  blankLine();
+  if (approved.size === 0) {
+    console.log(`  ${glyph.warn} ${c.dim}No capabilities approved — this tunnel cannot act.${c.reset}`);
+    console.log(`  ${c.dim}Pair again with${c.reset} ${c.white}agent-tunnel connect --reauth${c.reset}`);
+    blankLine();
+  }
+  console.log(`  ${c.dim}Recent logs:${c.reset} ${c.white}agent-tunnel logs${c.reset}`);
+  blankLine();
 }
-function commandStopService() {
-  console.log(JSON.stringify(stopService(), null, 2));
+function commandLogout(flags) {
+  const removed = clearSavedCredentials();
+  const keepService = isTruthyFlag(flags["keep-service"]);
+  if (!keepService)
+    SERVICE_ACTIONS.uninstall.run();
+  blankLine();
+  console.log(removed ? `  ${glyph.on} ${c.bold}Signed out${c.reset} ${c.dim}(credentials cleared from ${CONFIG_FILE2})${c.reset}` : `  ${glyph.off} ${c.dim}No saved credentials to clear${c.reset}`);
+  console.log(keepService ? `  ${glyph.warn} ${c.dim}Background service kept — it cannot authenticate until you connect again${c.reset}` : `  ${c.dim}Background service removed${c.reset}`);
+  blankLine();
+  console.log(`  ${c.dim}Pair again with:${c.reset} ${c.white}agent-tunnel connect --api-url <url>${c.reset}`);
+  blankLine();
 }
-function commandRestartService() {
-  console.log(JSON.stringify(restartService(), null, 2));
-}
-function commandServiceStatus() {
-  console.log(JSON.stringify(getServiceStatus(), null, 2));
-}
-function commandLogs() {
+function commandLogs(flags) {
   const paths = getServicePaths();
-  const files = [
-    join6(paths.logDir, "agent-tunnel.out.log"),
-    join6(paths.logDir, "agent-tunnel.err.log")
-  ];
-  for (const file of files) {
-    console.log(`
-${c2.bold}${file}${c2.reset}`);
-    if (!existsSync4(file)) {
-      console.log(`${c2.dim}not created yet${c2.reset}`);
+  if (isTruthyFlag(flags.clear)) {
+    for (const file of serviceLogFiles(paths)) {
+      try {
+        writeFileSync5(file, "", { mode: 384 });
+      } catch {}
+    }
+    blankLine();
+    console.log(`  ${glyph.on} ${c.dim}Service logs cleared${c.reset}`);
+    blankLine();
+    return;
+  }
+  const requested = Number.parseInt(flags.lines ?? "", 10);
+  const limit = Number.isSafeInteger(requested) && requested > 0 ? requested : DEFAULT_LOG_LINES;
+  const showAll = isTruthyFlag(flags.all);
+  for (const [label, file] of [
+    ["output", join10(paths.logDir, "agent-tunnel.out.log")],
+    ["errors", join10(paths.logDir, "agent-tunnel.err.log")]
+  ]) {
+    blankLine();
+    console.log(`  ${c.bold}${c.white}${label}${c.reset}  ${c.dim}${shortenHomePath(file)}${c.reset}`);
+    if (!existsSync6(file)) {
+      console.log(`  ${c.dim}not created yet${c.reset}`);
+      continue;
+    }
+    const kept = readFileSync6(file, "utf8").split(/\r?\n/).map((line) => line.trimEnd()).filter((line) => line.trim().length > 0).filter((line) => showAll || !isShellStartupNoise(line));
+    const lines = collapseRepeatedLines(kept).slice(-limit);
+    if (lines.length === 0) {
+      console.log(`  ${c.dim}empty${c.reset}`);
       continue;
     }
-    const body = readFileSync3(file, "utf8");
-    const lines = body.split(/\r?\n/).slice(-120).join(`
-`).trim();
-    console.log(lines || `${c2.dim}empty${c2.reset}`);
+    for (const line of lines)
+      console.log(`  ${line}`);
+  }
+  blankLine();
+  console.log(`  ${c.dim}--lines <n> to show more, --all to keep shell noise, --clear to empty them.${c.reset}`);
+  blankLine();
+}
+function commandServiceAction(action, flags) {
+  if (action === "install") {
+    const config = loadConfig({
+      token: flags.token,
+      tunnelId: flags["tunnel-id"],
+      apiUrl: flags["api-url"]
+    });
+    if (!config.token || !config.tunnelId) {
+      fail("No saved tunnel credentials found. Run `agent-tunnel connect` first, or pass --token and --tunnel-id.");
+    }
+    if (flags.token && flags["tunnel-id"]) {
+      saveCredentials(config.tunnelId, config.token, config.apiUrl);
+    }
   }
+  renderServiceAction(action, SERVICE_ACTIONS[action].run());
 }
+var COMMANDS = {
+  connect: {
+    summary: "Pair this machine, then run it in the background or this terminal",
+    run: commandConnect
+  },
+  status: { summary: "Show pairing, capabilities, and service state (--json)", run: commandStatus },
+  logs: { summary: "Show recent service logs (--lines <n>, --all, --clear)", run: commandLogs },
+  start: { summary: "Start the background service", run: (f) => commandServiceAction("start", f) },
+  stop: {
+    summary: "Stop the background service (keeps it installed)",
+    run: (f) => commandServiceAction("stop", f),
+    aliases: ["disable"]
+  },
+  restart: { summary: "Restart the background service", run: (f) => commandServiceAction("restart", f) },
+  "install-service": {
+    summary: "Install and start the background service",
+    run: (f) => commandServiceAction("install", f)
+  },
+  "uninstall-service": {
+    summary: "Stop and remove the background service",
+    run: (f) => commandServiceAction("uninstall", f)
+  },
+  "service-status": {
+    summary: "Show the background service state (same view as status)",
+    run: commandStatus
+  },
+  logout: { summary: "Clear saved credentials and remove the service", run: commandLogout },
+  run: { summary: "Run using saved credentials (used by the service)", run: commandRun },
+  "start-service": { summary: "", run: (f) => commandServiceAction("start", f), hidden: true },
+  "stop-service": { summary: "", run: (f) => commandServiceAction("stop", f), hidden: true },
+  "restart-service": { summary: "", run: (f) => commandServiceAction("restart", f), hidden: true },
+  "sign-out": { summary: "", run: commandLogout, hidden: true },
+  unpair: { summary: "", run: commandLogout, hidden: true }
+};
+var OPTIONS = [
+  ["--api-url <url>", "Relay API URL"],
+  ["--token <token> --tunnel-id <id>", "Skip device auth and use an explicit credential"],
+  ["--reauth", "With connect: discard the saved credential and pair again"],
+  ["--daemon / --foreground", "With connect: skip the prompt and choose the mode"],
+  ["--json", "With status: machine-readable output"],
+  ["--keep-service", "With logout: keep the background service installed"]
+];
 function showHelp() {
-  console.log("");
-  console.log(`  ${c2.cyan}▄▀█ █▀▀ █▀▀ █▄ █ ▀█▀${c2.reset}   ${c2.cyan}▀█▀ █ █ █▄ █ █▄ █ █▀▀ █  ${c2.reset}`);
-  console.log(`  ${c2.cyan}█▀█ █▄█ ██▄ █ ▀█  █${c2.reset}    ${c2.cyan} █  █▄█ █ ▀█ █ ▀█ ██▄ █▄▄${c2.reset}`);
-  console.log("");
-  console.log(`  ${c2.dim}Secure bridge between AI agents & local machines${c2.reset}`);
-  console.log("");
-  console.log(`  ${c2.bold}Usage${c2.reset}   ${c2.dim}npx --yes @kortix/agent-tunnel@latest <command> [options]${c2.reset}`);
-  console.log("");
-  console.log(`${c2.gray}  ── Commands ────────────────────────────────────────${c2.reset}`);
-  console.log(`  ${c2.cyan}connect${c2.reset}       Connect via device auth; interactively choose foreground/background`);
-  console.log(`  ${c2.cyan}run${c2.reset}           Run using saved credentials ${c2.dim}(used by service)${c2.reset}`);
-  console.log(`  ${c2.cyan}install-service${c2.reset} Install/start a persistent background service`);
-  console.log(`  ${c2.cyan}start${c2.reset}         Start the installed background service`);
-  console.log(`  ${c2.cyan}stop${c2.reset}          Stop the installed background service ${c2.dim}(keeps it installed)${c2.reset}`);
-  console.log(`  ${c2.cyan}restart${c2.reset}       Restart the installed background service`);
-  console.log(`  ${c2.cyan}service-status${c2.reset} Check persistent service status`);
-  console.log(`  ${c2.cyan}logs${c2.reset}          Show recent service logs`);
-  console.log(`  ${c2.cyan}uninstall-service${c2.reset} Stop/remove the persistent service`);
-  console.log(`  ${c2.cyan}status${c2.reset}        Check tunnel connection status`);
-  console.log(`  ${c2.cyan}help${c2.reset}          Show this help message`);
-  console.log("");
-  console.log(`${c2.gray}  ── Options ─────────────────────────────────────────${c2.reset}`);
-  console.log(`  ${c2.white}--token${c2.reset} ${c2.dim}<token>${c2.reset}       Skip device auth, connect directly`);
-  console.log(`  ${c2.white}--tunnel-id${c2.reset} ${c2.dim}<id>${c2.reset}     Tunnel ID ${c2.dim}(required with --token)${c2.reset}`);
-  console.log(`  ${c2.white}--api-url${c2.reset} ${c2.dim}<url>${c2.reset}       API URL ${c2.dim}(default: http://localhost:8080)${c2.reset}`);
-  console.log(`  ${c2.white}--daemon${c2.reset}             With connect: skip the prompt and install the background service`);
-  console.log(`  ${c2.white}--foreground${c2.reset}         With connect: skip prompts and run only in this terminal`);
-  console.log("");
-  console.log(`  ${c2.dim}Config: ~/.agent-tunnel/config.json${c2.reset}`);
-  console.log(`  ${c2.dim}powered by ${c2.cyan}kortix${c2.reset}`);
-  console.log("");
+  blankLine();
+  console.log(`  ${c.cyan}▄▀█ █▀▀ █▀▀ █▄ █ ▀█▀${c.reset}   ${c.cyan}▀█▀ █ █ █▄ █ █▄ █ █▀▀ █  ${c.reset}`);
+  console.log(`  ${c.cyan}█▀█ █▄█ ██▄ █ ▀█  █${c.reset}    ${c.cyan} █  █▄█ █ ▀█ █ ▀█ ██▄ █▄▄${c.reset}`);
+  blankLine();
+  console.log(`  ${c.dim}Secure bridge between AI agents & local machines${c.reset}`);
+  blankLine();
+  console.log(`  ${c.bold}Usage${c.reset}   ${c.dim}npx --yes @kortix/agent-tunnel@latest <command> [options]${c.reset}`);
+  blankLine();
+  console.log(`${c.gray}  ── Commands ────────────────────────────────────────${c.reset}`);
+  const visible = Object.entries(COMMANDS).filter(([, command]) => !command.hidden);
+  const width = Math.max(...visible.map(([name]) => name.length)) + 2;
+  for (const [name, command] of visible) {
+    console.log(`  ${c.cyan}${name.padEnd(width)}${c.reset}${command.summary}`);
+  }
+  blankLine();
+  console.log(`${c.gray}  ── Options ─────────────────────────────────────────${c.reset}`);
+  const optionWidth = Math.max(...OPTIONS.map(([flag]) => flag.length)) + 2;
+  for (const [flag, description] of OPTIONS) {
+    console.log(`  ${c.white}${flag.padEnd(optionWidth)}${c.reset}${c.dim}${description}${c.reset}`);
+  }
+  blankLine();
+  console.log(`  ${c.dim}Config: ${CONFIG_FILE2}${c.reset}`);
+  console.log(`  ${c.dim}powered by ${c.cyan}kortix${c.reset}`);
+  blankLine();
 }
 var { command, flags } = parseArgs(process.argv);
 if (Object.prototype.hasOwnProperty.call(flags, "keep-awake")) {
-  console.error(`${c2.red}${c2.bold} error${c2.reset} --keep-awake is not supported. Configure sleep behavior in the operating system.`);
+  console.error(`  ${glyph.bad} --keep-awake is not supported. Configure sleep behavior in the operating system.`);
   process.exit(2);
 }
-switch (command) {
-  case "connect":
-    commandConnect(flags);
-    break;
-  case "run":
-    commandRun(flags);
-    break;
-  case "install-service":
-    commandInstallService(flags);
-    break;
-  case "start":
-  case "start-service":
-    commandStartService();
-    break;
-  case "stop":
-  case "stop-service":
-  case "disable":
-    commandStopService();
-    break;
-  case "restart":
-  case "restart-service":
-    commandRestartService();
-    break;
-  case "service-status":
-    commandServiceStatus();
-    break;
-  case "logs":
-    commandLogs();
-    break;
-  case "uninstall-service":
-    commandUninstallService();
-    break;
-  case "status":
-    commandStatus(flags);
-    break;
-  case "help":
-  default:
-    showHelp();
-    break;
+var resolved = COMMANDS[command] ?? Object.values(COMMANDS).find((entry) => entry.aliases?.includes(command));
+if (!resolved) {
+  showHelp();
+} else {
+  Promise.resolve(resolved.run(flags)).catch((error) => {
+    console.error(`  ${glyph.bad} ${error instanceof Error ? error.message : String(error)}`);
+    process.exit(1);
+  });
 }