@lifeaitools/clauth 1.31.1 → 2.0.1

package/cli/commands/serve.js

@@ -14,7 +14,7 @@ import { getMachineHash, deriveToken, deriveSeedHash } from "../fingerprint.js";
 import * as api from "../api.js";
 import chalk from "chalk";
 import ora from "ora";
-import { execFileSync, execSync as execSyncTop } from "child_process";
+import { execFileSync, execSync as execSyncTop, spawn } from "child_process";
 import Conf from "conf";
 import { getConfOptions } from "../conf-path.js";
 import { appendFile, readdir, readFile, writeFile, rm, mkdir, stat, rename, cp } from "node:fs/promises";
@@ -30,6 +30,25 @@ import {
   readWatchdogEvents,
   restartWatchdogService,
 } from "../watchdog-registry.js";
+import {
+  discoverPlugins,
+  getSupervisorDir,
+  getSupervisorPort,
+  loadSupervisorState,
+  listPlugins,
+  listRoutes,
+  listSurfaces,
+  listTunnels,
+  readSupervisorEvents,
+  addTunnelRoute,
+  removeTunnelRoute,
+  reconcileSurfaceHealth,
+  runPluginAction,
+  runSurfaceAction,
+  setPluginEnabled,
+  supervisorHealth,
+  operation,
+} from "../supervisor-registry.js";
 import {
   AgentPool,
   DelegationLane,
@@ -40,6 +59,14 @@ import {
   DEFAULT_BOOTSTRAP,
 } from "./agent-pool.js";
 import { AgentCron, cronEnabled, nextRun } from "./agent-cron.js";
+import pm2 from "pm2";
+import { createPm2Adapter, PM2_OPERATION_CATALOG } from "../ops/pm2-adapter.js";
+import { createOperationPolicy } from "../ops/operation-policy.js";
+import { createJobStore } from "../ops/job-store.js";
+import { createCoolifyAdapter, deploymentUuidFrom } from "../ops/coolify-adapter.js";
+import { createDeploymentAdapter, parseDeploymentRegistry } from "../ops/deployment-adapter.js";
+import { createSerializedExecutor } from "../ops/serialized-executor.js";
+import { requestOps } from "./ops.js";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "../../package.json"), "utf8"));
@@ -463,6 +490,7 @@ function createRotationEngine(password, machineHash, logFile) {
 
 const PID_FILE = path.join(os.tmpdir(), "clauth-serve.pid");
 const STAGED_PID_FILE = path.join(os.tmpdir(), "clauth-serve-staged.pid");
+const SUPERVISOR_PID_FILE = path.join(os.tmpdir(), "clauth-supervisor.pid");
 const LOG_FILE = path.join(os.tmpdir(), "clauth-serve.log");
 const LIVE_PORT = 52437;
 const STAGED_PORT = 52438;
@@ -487,6 +515,74 @@ function validateWriteToken(req, writeSession) {
   return a.length === b.length && crypto.timingSafeEqual(a, b);
 }
 
+export function isLoopbackAddress(remote) {
+  return remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
+}
+
+function summarizeSupervisorTarget(target) {
+  if (!target || typeof target !== "object") return null;
+  return {
+    plugin_id: typeof target.plugin_id === "string" ? target.plugin_id : undefined,
+    surface_id: typeof target.surface_id === "string" ? target.surface_id : undefined,
+    tunnel_id: typeof target.tunnel_id === "string" ? target.tunnel_id : undefined,
+    route_id: typeof target.route_id === "string" ? target.route_id : undefined,
+  };
+}
+
+function summarizeSupervisorState(value) {
+  if (!value || typeof value !== "object") return null;
+  return {
+    ok: typeof value.ok === "boolean" ? value.ok : undefined,
+    state: typeof value.state === "string" ? value.state : undefined,
+    reason: typeof value.reason === "string" ? value.reason : undefined,
+    status: typeof value.status === "number" ? value.status : undefined,
+    private: typeof value.private === "boolean" ? value.private : undefined,
+    public_route: typeof value.public_route === "boolean" ? value.public_route : undefined,
+    evidence: Array.isArray(value.evidence) ? value.evidence.map((item) => String(item).slice(0, 200)).slice(0, 5) : [],
+  };
+}
+
+export function supervisorLogDto(event) {
+  if (!event || typeof event !== "object") return { kind: "unknown" };
+  if (event.kind === "operation") {
+    return {
+      ts: event.ts || event.created_at,
+      kind: "operation",
+      operationId: event.operationId,
+      actor: event.actor,
+      action: event.action,
+      target: summarizeSupervisorTarget(event.target),
+      resulting_state: summarizeSupervisorState(event.resulting_state),
+      completed_at: event.completed_at,
+    };
+  }
+  return {
+    ts: event.ts,
+    kind: event.kind,
+    plugin_id: event.plugin_id,
+    source: event.source,
+    state: event.state,
+  };
+}
+
+function supervisorOperationDto(receipt) {
+  return {
+    operationId: receipt.operationId,
+    actor: receipt.actor,
+    action: receipt.action,
+    target: summarizeSupervisorTarget(receipt.target),
+    resulting_state: summarizeSupervisorState(receipt.resulting_state),
+    evidence: Array.isArray(receipt.evidence) ? receipt.evidence.map((item) => String(item).slice(0, 200)).slice(0, 5) : [],
+    created_at: receipt.created_at,
+    completed_at: receipt.completed_at,
+  };
+}
+
+export function supervisorRequiresWriteToken(port = getSupervisorPort(), env = process.env) {
+  if (port !== getSupervisorPort()) return true;
+  return env.CLAUTH_SUPERVISOR_REQUIRE_WRITE_TOKEN === "1";
+}
+
 // ── PID helpers ──────────────────────────────────────────────
 function readPid() {
   try {
@@ -512,6 +608,18 @@ function writeStagedPid(pid, port) {
   fs.writeFileSync(STAGED_PID_FILE, `${pid}:${port}`, "utf8");
 }
 
+function readSupervisorPid() {
+  try {
+    const raw = fs.readFileSync(SUPERVISOR_PID_FILE, "utf8").trim();
+    const [pid, port] = raw.split(":");
+    return { pid: parseInt(pid, 10), port: parseInt(port, 10) };
+  } catch { return null; }
+}
+
+function writeSupervisorPid(pid, port) {
+  fs.writeFileSync(SUPERVISOR_PID_FILE, `${pid}:${port}`, "utf8");
+}
+
 function removeStagedPid() {
   try { fs.unlinkSync(STAGED_PID_FILE); } catch {}
 }
@@ -520,6 +628,10 @@ function removePid() {
   try { fs.unlinkSync(PID_FILE); } catch {}
 }
 
+function removeSupervisorPid() {
+  try { fs.unlinkSync(SUPERVISOR_PID_FILE); } catch {}
+}
+
 function isProcessAlive(pid) {
   try { process.kill(pid, 0); return true; } catch { return false; }
 }
@@ -550,7 +662,9 @@ function openBrowser(url) {
 }
 
 // ── Dashboard HTML ───────────────────────────────────────────
-function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null) {
+// Exported so cli/supervisor-ui.test.js can extract the served dashboard script
+// and drive its real functions, instead of asserting on source text.
+export function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null) {
   return `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -574,6 +688,9 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   .btn-unlock:hover{background:#2563eb}
   .btn-unlock:disabled{background:#1e3a5f;color:#4a6fa5;cursor:not-allowed}
   .lock-err{color:#f87171;font-size:.82rem;margin-top:.75rem;min-height:1.2em}
+  #write-unlock-overlay{display:none;position:fixed;inset:0;background:rgba(2,6,23,.72);z-index:9999;align-items:center;justify-content:center;padding:2rem}
+  .write-unlock-cancel{width:100%;background:transparent;color:#94a3b8;border:1px solid #334155;border-radius:8px;padding:8px;font-size:.85rem;cursor:pointer;margin-top:.6rem;transition:border-color .15s}
+  .write-unlock-cancel:hover{border-color:#64748b;color:#cbd5e1}
   /* ── Main view ── */
   #main-view{display:none;padding:2rem}
   .header{display:flex;align-items:center;gap:10px;margin-bottom:1.5rem;flex-wrap:wrap}
@@ -658,15 +775,13 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   .btn-ccandme{background:linear-gradient(135deg,#1a1a2e,#16213e);color:#a78bfa;border:1px solid #4c1d95;padding:7px 16px;font-size:.85rem;border-radius:7px;cursor:pointer;font-weight:600;transition:all .15s;white-space:nowrap}
   .btn-ccandme:hover{background:linear-gradient(135deg,#2d1b69,#1e1b4b);border-color:#7c3aed;color:#c4b5fd;transform:translateY(-1px)}
   .btn-ccandme:disabled{opacity:.5;cursor:not-allowed;transform:none}
-  .btn-tintin{background:linear-gradient(135deg,#103c2f,#0f2f3f);color:#86efac;border:1px solid #166534;padding:7px 16px;font-size:.85rem;border-radius:7px;cursor:pointer;font-weight:700;transition:all .15s;white-space:nowrap}
-  .btn-tintin:hover{background:linear-gradient(135deg,#14532d,#155e75);border-color:#22c55e;color:#bbf7d0;transform:translateY(-1px)}
-  .btn-tintin:disabled{opacity:.5;cursor:not-allowed;transform:none}
   .btn-claude{background:linear-gradient(135deg,#d97706,#f59e0b);color:#0a0f1a;padding:8px 18px;font-size:.85rem;border-radius:7px;border:none;cursor:pointer;font-weight:700;letter-spacing:.3px;transition:all .15s;white-space:nowrap}
   .btn-claude:hover{filter:brightness(1.1);transform:translateY(-1px)}
   .btn-claude:disabled{opacity:.4;cursor:not-allowed;transform:none;filter:none}
   .btn-tunnel-stop{background:#1e293b;color:#f87171;border:1px solid #334155;padding:6px 12px;font-size:.8rem;border-radius:6px;cursor:pointer;font-weight:500}
   .btn-tunnel-stop:hover{background:#2d1f1f;border-color:#f87171}
   .tunnel-err{font-size:.78rem;color:#f87171;width:100%;margin-top:4px}
+  .dash-panel{margin-bottom:1.25rem}
   .build-panel{background:#0f1a2d;border:1px solid #1e3a5f;border-radius:8px;padding:1rem 1.25rem;margin-bottom:1.25rem;display:flex;align-items:center;gap:12px;flex-wrap:wrap}
   .build-dot{width:10px;height:10px;border-radius:50%;flex-shrink:0}
   .build-dot.idle{background:#64748b}
@@ -677,25 +792,6 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   .build-label{font-size:.85rem;color:#94a3b8;flex:1}
   .build-label strong{color:#e2e8f0}
   .build-meta{font-family:'Courier New',monospace;font-size:.75rem;color:#64748b}
-  .tintin-tab{position:fixed;top:50%;right:0;transform:translateY(-50%);z-index:81;writing-mode:vertical-rl;text-orientation:mixed;background:linear-gradient(180deg,#103c2f,#0f2f3f);color:#86efac;border:1px solid #166534;border-right:none;border-radius:8px 0 0 8px;padding:14px 6px;font-size:.78rem;font-weight:700;cursor:pointer;letter-spacing:.5px;transition:all .2s}
-  .tintin-tab:hover{background:linear-gradient(180deg,#14532d,#155e75);color:#bbf7d0;padding-right:10px}
-  .tintin-tab.active{background:#081c1a;border-color:#22c55e;color:#bbf7d0}
-  .tintin-panel{position:fixed;top:0;right:-440px;bottom:0;z-index:80;width:min(420px,calc(100vw - 24px));background:#081c1a;border-left:1px solid #14532d;padding:0;box-shadow:-22px 0 60px rgba(0,0,0,.42);display:flex;flex-direction:column;transition:right .25s ease}
-  .tintin-panel.open{right:0}
-  .tintin-head{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-bottom:.8rem}
-  .tintin-title{font-size:.95rem;font-weight:700;color:#dcfce7}
-  .tintin-sub{font-size:.78rem;color:#6ee7b7;margin-top:2px}
-  .tintin-grid{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin-bottom:10px}
-  .tintin-field{display:flex;flex-direction:column;gap:4px}
-  .tintin-field label{font-size:.72rem;color:#94a3b8;text-transform:uppercase;letter-spacing:.04em;font-weight:700}
-  .tintin-input,.tintin-textarea{background:#031312;border:1px solid #14532d;border-radius:6px;color:#e2e8f0;font-family:'Courier New',monospace;font-size:.85rem;padding:8px 10px;outline:none;transition:border-color .15s}
-  .tintin-input:focus,.tintin-textarea:focus{border-color:#22c55e}
-  .tintin-textarea{width:100%;min-height:92px;resize:vertical;line-height:1.45;margin-bottom:10px}
-  .tintin-actions{display:flex;align-items:center;gap:8px;flex-wrap:wrap}
-  .tintin-status{font-family:'Courier New',monospace;font-size:.78rem;color:#94a3b8}
-  .tintin-result{display:none;margin-top:12px;background:#020b0a;border:1px solid #134e4a;border-radius:8px;padding:10px;white-space:pre-wrap;word-break:break-word;font-family:'Courier New',monospace;font-size:.82rem;color:#bbf7d0;max-height:240px;overflow:auto}
-  .tintin-result.open{display:block}
-  @media (max-width:720px){.tintin-panel{width:100vw}.tintin-grid{grid-template-columns:1fr}}
   .mcp-row{display:flex;align-items:center;gap:8px;margin-bottom:8px}
   .mcp-label{font-size:.72rem;color:#64748b;min-width:80px;text-transform:uppercase;letter-spacing:.5px;font-weight:600}
   .mcp-val{flex:1;font-family:'Courier New',monospace;font-size:.82rem;color:#60a5fa;background:#0a0f1a;border:1px solid #1e3a5f;border-radius:4px;padding:6px 10px;word-break:break-all;user-select:all}
@@ -805,6 +901,36 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   .wiz-test-result{padding:12px 14px;border-radius:8px;font-size:.85rem;margin-top:10px;display:none}
   .wiz-test-result.ok{background:rgba(74,222,128,.08);border:1px solid rgba(74,222,128,.2);color:#4ade80}
   .wiz-test-result.fail{background:rgba(248,113,113,.08);border:1px solid rgba(248,113,113,.2);color:#f87171}
+  .supervisor-panel{margin:14px 16px;border:1px solid #233249;background:linear-gradient(135deg,rgba(15,23,42,.96),rgba(10,15,26,.98));border-radius:12px;padding:14px}
+  .supervisor-head{display:flex;align-items:flex-start;justify-content:space-between;gap:12px;margin-bottom:12px}
+  .supervisor-title{font-size:.95rem;font-weight:700;color:#e2e8f0}
+  .supervisor-sub{font-size:.76rem;color:#94a3b8;margin-top:3px;line-height:1.35}
+  .supervisor-actions{display:flex;gap:8px;flex-wrap:wrap}
+  .supervisor-action{background:#0f172a;color:#cbd5e1;border:1px solid #334155;border-radius:6px;padding:6px 10px;font-size:.75rem;cursor:pointer}
+  .supervisor-action:hover{border-color:#38bdf8;color:#e0f2fe}
+  .supervisor-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:10px}
+  .supervisor-card{border:1px solid #1e293b;background:rgba(2,6,23,.52);border-radius:10px;padding:10px;min-width:0}
+  .supervisor-card h4{margin:0 0 8px;color:#cbd5e1;font-size:.75rem;letter-spacing:.08em;text-transform:uppercase}
+  .supervisor-kpi{font-size:1.35rem;font-weight:700;color:#f8fafc}
+  .supervisor-meta{font-size:.72rem;color:#94a3b8;font-family:'Courier New',monospace;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+  .supervisor-pill{display:inline-flex;align-items:center;border-radius:999px;padding:2px 7px;margin:2px 4px 2px 0;font-size:.68rem;border:1px solid #334155;color:#cbd5e1;background:#0f172a}
+  .supervisor-pill.ok{border-color:rgba(74,222,128,.35);color:#86efac;background:rgba(34,197,94,.08)}
+  .supervisor-pill.warn{border-color:rgba(250,204,21,.35);color:#fde68a;background:rgba(250,204,21,.08)}
+  .supervisor-pill.bad{border-color:rgba(248,113,113,.35);color:#fecaca;background:rgba(248,113,113,.08)}
+  .supervisor-list{display:flex;flex-direction:column;gap:8px;max-height:320px;overflow:auto}
+  .supervisor-row{border:1px solid #1e293b;border-radius:8px;padding:6px 8px;background:rgba(15,23,42,.45);cursor:pointer}
+  .supervisor-row:hover{border-color:#334155}
+  .supervisor-row.selected{border-color:#38bdf8;background:rgba(56,189,248,.08)}
+  .supervisor-row.readonly{cursor:default}
+  .supervisor-row-top{display:flex;justify-content:space-between;gap:8px;align-items:center}
+  .supervisor-name{font-size:.82rem;color:#e2e8f0;font-weight:600;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+  .supervisor-row-actions{display:flex;gap:5px;flex-wrap:wrap;margin-top:7px}
+  .supervisor-cmdbar{display:flex;gap:6px;flex-wrap:wrap;align-items:center;margin-bottom:8px;padding:8px;border:1px solid #1e293b;border-radius:8px;background:rgba(2,6,23,.4);min-height:36px}
+  .supervisor-cmdbar-empty{font-size:.74rem;color:#64748b}
+  .supervisor-cmdbar-name{font-size:.78rem;color:#e2e8f0;font-weight:600;margin-right:4px}
+  .supervisor-log{font-family:'Courier New',monospace;font-size:.7rem;color:#94a3b8;white-space:pre-wrap;word-break:break-word;max-height:280px;overflow:auto}
+  .supervisor-feedback{margin-top:8px;padding:7px 9px;border-radius:6px;font-family:'Courier New',monospace;font-size:.72rem;color:#86efac;background:rgba(34,197,94,.08);border:1px solid rgba(74,222,128,.22);display:none}
+  .supervisor-feedback.bad{color:#fecaca;background:rgba(248,113,113,.08);border-color:rgba(248,113,113,.25)}
 </style>
 </head>
 <body>
@@ -824,15 +950,27 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
   </div>
 </div>
 
+<!-- Write-unlock modal (replaces window.prompt(), which silently no-ops in
+     embedded/webview browser contexts and after a browser suppresses repeated
+     native dialogs) -->
+<div id="write-unlock-overlay">
+  <div class="lock-card">
+    <div class="lock-icon">🔒</div>
+    <div class="lock-title">Enable writes</div>
+    <div class="lock-sub">Enter your vault password to enable saving changes (30-minute write session)</div>
+    <form onsubmit="submitWriteUnlock();return false;" autocomplete="on">
+      <input type="text" name="username" value="clauth" autocomplete="username" style="display:none">
+      <input class="lock-input" id="write-unlock-input" type="password" placeholder="••••••••••••" autocomplete="current-password">
+      <button class="btn-unlock" id="write-unlock-btn" type="submit">Unlock Writes</button>
+    </form>
+    <div class="lock-err" id="write-unlock-err"></div>
+    <button type="button" class="write-unlock-cancel" onclick="closeWriteUnlockModal()">Cancel</button>
+  </div>
+</div>
+
 <!-- ── Main view (shown after unlock) ──────── -->
 <div id="main-view">
-  <div id="upgrade-banner" style="display:none" class="upgrade-banner">
-    <div class="upgrade-content">
-      <strong>⬆ clauth upgraded to v<span id="upgrade-to-version"></span></strong>
-      <span id="upgrade-details"></span>
-      <button onclick="dismissUpgrade()">Dismiss ✕</button>
-    </div>
-  </div>
+  <section class="dash-panel" data-panel="title-status">
   <div class="header">
     <div class="dot" id="dot"></div>
     <h1>🔐 clauth vault <span style="font-size:0.55em;opacity:0.45;font-weight:400">v${VERSION}</span>${isStaged ? `<span style="font-size:0.5em;background:#b45309;color:#fef3c7;border-radius:4px;padding:2px 10px;margin-left:12px;font-weight:600;letter-spacing:.5px">STAGED</span>` : ""}</h1>
@@ -851,6 +989,16 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
     <div>Services: <span id="s-services">${whitelist ? whitelist.join(", ") : "all"}</span></div>
     <div>Failures: <span id="s-fails">—</span></div>
   </div>
+  </section>
+
+  <section class="dash-panel" data-panel="status-area">
+  <div id="upgrade-banner" style="display:none" class="upgrade-banner">
+    <div class="upgrade-content">
+      <strong>⬆ clauth upgraded to v<span id="upgrade-to-version"></span></strong>
+      <span id="upgrade-details"></span>
+      <button onclick="dismissUpgrade()">Dismiss ✕</button>
+    </div>
+  </div>
   <div class="build-panel" id="build-panel">
     <div class="build-dot idle" id="build-dot"></div>
     <div class="build-label" id="build-label">
@@ -859,8 +1007,9 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
     <span id="build-sha" style="font-family:'Courier New',monospace;font-size:.72rem;color:#60a5fa;background:#0a0f1a;border:1px solid #1e3a5f;border-radius:4px;padding:2px 8px;letter-spacing:.3px"></span>
     <div class="build-meta" id="build-meta" style="width:100%;margin-top:4px"></div>
   </div>
+  </section>
 
-  <div class="toolbar">
+  <div class="toolbar" data-panel="menu-bar">
     <button class="btn-refresh" onclick="loadServices()">↻ Refresh</button>
     <button class="btn-add" onclick="toggleAddService()">+ Add Service</button>
     <button class="btn-check" id="check-btn" onclick="checkAll()">⬤ Check All</button>
@@ -952,7 +1101,7 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
     </form>
   </div>
 
-  <div class="tunnel-panel" id="tunnel-panel">
+  <div class="tunnel-panel" id="tunnel-panel" data-panel="tunnel-bar">
     <!-- not_configured -->
     <div class="tunnel-state not-configured" style="display:none;align-items:center;gap:10px;width:100%;flex-wrap:wrap">
       <div class="tunnel-dot off"></div>
@@ -993,40 +1142,38 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
     </div>
   </div>
 
-  <div class="tintin-tab" id="tintin-tab" onclick="toggleTinTinPanel()">TinTin</div>
-  <div class="tintin-panel" id="tintin-panel">
-    <div class="tintin-head" style="padding:12px 16px;border-bottom:1px solid #14532d;flex-shrink:0">
-      <div style="display:flex;align-items:center;justify-content:space-between">
-        <div class="tintin-title">TinTin</div>
-        <button class="btn-cancel" onclick="toggleTinTinPanel()" style="font-size:16px;padding:2px 6px">x</button>
+  <section class="supervisor-panel" id="supervisor-panel" data-panel="surfaces-log">
+    <div class="supervisor-head">
+      <div>
+        <div class="supervisor-title">Local Software Factory Supervisor</div>
+        <div class="supervisor-sub">clauth owns local LIFEAI plugin discovery, candidate tests, clauth-owned surface operations, receipts, and supervisor event logs. Dev Center should call this surface instead of PM2 directly.</div>
+      </div>
+      <div class="supervisor-actions">
+        <button class="supervisor-action" onclick="loadSupervisorCockpit()">Refresh</button>
+        <button class="supervisor-action" onclick="rescanSupervisorPlugins()">Rescan plugins</button>
       </div>
-      <div class="tintin-sub">claude-sonnet-4-6 · clauth CLI dispatch</div>
-      <div style="margin-top:6px"><a href="/tintin/settings/ui" target="_blank" rel="noopener" style="font-size:.72rem;color:#86efac;text-decoration:none;border:1px solid #14532d;padding:2px 6px;border-radius:4px">Agent settings</a></div>
-    </div>
-    <div id="tintin-messages" style="flex:1;min-height:0;overflow-y:auto;padding:12px 16px;display:flex;flex-direction:column;gap:10px">
-      <div style="font-size:.78rem;color:#6ee7b7;font-style:italic">Ask anything. Runs a Claude CLI agent with full clauth + repo context.</div>
     </div>
-    <div style="padding:10px 16px;border-top:1px solid #14532d;flex-shrink:0">
-      <div class="tintin-grid" style="margin-bottom:8px">
-        <div class="tintin-field">
-          <label>CWD</label>
-          <input class="tintin-input" id="tintin-cwd" value="C:\\Dev\\regen-root" spellcheck="false" autocomplete="off">
-        </div>
-        <div class="tintin-field">
-          <label>App</label>
-          <input class="tintin-input" id="tintin-app" value="clauth" spellcheck="false" autocomplete="off">
-        </div>
+    <div id="supervisor-status" class="supervisor-sub">Loading supervisor state…</div>
+    <div id="supervisor-feedback" class="supervisor-feedback" role="status"></div>
+    <div class="supervisor-grid" style="margin-top:10px">
+      <div class="supervisor-card">
+        <h4>Surfaces</h4>
+        <div class="supervisor-kpi" id="supervisor-surface-count">—</div>
+        <div class="supervisor-meta" id="supervisor-surface-meta">destination + owner matrix</div>
+        <div class="supervisor-cmdbar" id="supervisor-cmdbar"><span class="supervisor-cmdbar-empty">Select a surface below to act on it.</span></div>
+        <div class="supervisor-list" id="supervisor-surfaces" style="margin-top:8px"></div>
       </div>
-      <textarea class="tintin-textarea" id="tintin-prompt" spellcheck="false" placeholder="Ask TinTin..." style="min-height:64px;margin-bottom:8px"></textarea>
-      <div style="display:flex;gap:8px;align-items:center">
-        <button class="btn-tintin" id="tintin-send" onclick="sendTinTinMessage()" style="flex:1">Send</button>
-        <span class="tintin-status" id="tintin-status">idle</span>
+      <div class="supervisor-card">
+        <h4>Operations + log</h4>
+        <div class="supervisor-kpi" id="supervisor-operation-count">—</div>
+        <div class="supervisor-meta" id="supervisor-log-path">events.jsonl</div>
+        <div class="supervisor-log" id="supervisor-events" style="margin-top:8px">No events loaded.</div>
       </div>
     </div>
-  </div>
+  </section>
 
 
-  <div class="tunnel-panel" id="webdav-panel" style="flex-direction:column;align-items:stretch;gap:8px">
+  <div class="tunnel-panel" id="webdav-panel" data-panel="webdav-mounts" style="flex-direction:column;align-items:stretch;gap:8px">
     <div style="display:flex;align-items:center;gap:10px;width:100%">
       <div class="tunnel-dot off" id="webdav-dot"></div>
       <strong style="color:#e2e8f0;font-size:.88rem">WebDAV Mounts</strong>
@@ -1062,6 +1209,7 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
     <div class="wizard-foot" id="wizard-foot"></div>
   </div>
 
+  <section class="dash-panel" data-panel="search-credentials">
   <div id="project-tabs" class="project-tabs" style="display:none"></div>
   <div id="service-search" class="service-search">
     <span class="service-search-label">Search</span>
@@ -1069,11 +1217,17 @@ function dashboardHtml(port, whitelist, isStaged = false, initWriteToken = null)
     <span id="service-search-count" class="service-search-count"></span>
   </div>
   <div id="grid" class="grid"><p class="loading">Loading services…</p></div>
-  <div class="footer">localhost:${port} · 127.0.0.1 only · 10-strike lockout</div>
+  </section>
+  <div class="footer" id="originFooter" data-panel="footer">checking origin… · 10-strike lockout</div>
 </div>
 
 <script>
-const BASE = "http://127.0.0.1:${port}";
+const BASE = location.origin;
+(function reportOrigin() {
+  const isLocal = /^(127\\.0\\.0\\.1|localhost|\\[::1\\])$/.test(location.hostname);
+  const el = document.getElementById("originFooter");
+  if (el) el.textContent = (isLocal ? "LOCAL" : "REMOTE") + " · " + BASE + " · 10-strike lockout";
+})();
 
 const SERVICE_HINTS = {
   "neo4j":           "neo4j+s://username:password@instance.databases.neo4j.io",
@@ -1217,10 +1371,130 @@ function renderSetPanel(serviceOrName) {
 let writeToken = ${JSON.stringify(initWriteToken)};
 
 function writeHeaders(extra) {
-  if (!writeToken) throw new Error("Write access requires password unlock in this browser session.");
+  if (!writeToken) throw new Error("Writes are locked — click 🔓 Unlock Writes to enable saving.");
   return { ...(extra || {}), "X-Clauth-Write-Token": writeToken };
 }
 
+// ── Write-access choke point ────────────────
+// ONE mechanism sits in front of every write action.
+//
+// A button on this dashboard IS the human being present — they are past the
+// lock screen already. So a click must never demand a second password. Before
+// each action the page silently acquires a current write token from
+// POST /write-token, which succeeds whenever the vault is unlocked. The
+// password modal is the LOCKED-VAULT fallback only, and the common case never
+// reaches it.
+//
+// Acquiring per action (rather than trusting the token injected at page load)
+// is what makes staleness structurally impossible: the server session has a
+// 10-minute TTL while a dashboard tab can stay open for hours. That gap is the
+// actual defect behind "adding a service says I need write unlock" — the page
+// kept sending a token the daemon had already expired, and writeGuard answered
+// 403 "write token required". One loopback round-trip per click closes it.
+//
+// If the vault really is locked, the action is parked, the modal opens, and a
+// successful unlock re-fires it exactly once. Cancelling clears the park, so no
+// delayed write can fire later.
+//
+// writeHeaders() above still throws, but only as a backstop for a write path
+// that never went through here — WRITE_ACTIONS is asserted complete against
+// every writeHeaders() call site by cli/supervisor-ui.test.js.
+let pendingWriteAction = null;
+
+// Returns true when writeToken now holds a token the daemon will accept.
+// False means the vault is genuinely locked (or the daemon is unreachable),
+// which is the only case that deserves a password prompt.
+async function ensureWriteAccess() {
+  try {
+    const r = await fetch(BASE + "/write-token", { method: "POST" }).then(res => res.json());
+    if (r && r.write_token) {
+      writeToken = r.write_token;
+      refreshWriteLockUi();
+      return true;
+    }
+  } catch {}
+  return false;
+}
+
+// Every dashboard function whose body calls writeHeaders(). Adding a write
+// action without adding it here fails the registry-completeness test.
+const WRITE_ACTIONS = [
+  "rescanSupervisorPlugins",
+  "runSupervisorSurface",
+  "rotateKey",
+  "setExpiry",
+  "saveProject",
+  "saveLabel",
+  "deleteService",
+  "saveKey",
+  "toggleService",
+  "changePassword",
+  "addService",
+  "enrollMachine",
+  "submitMount",
+  "deleteMount",
+  "wizSubmitCfToken",
+];
+
+function withWriteAccess(name, fn) {
+  // async, so every path returns a thenable — a caller doing action(x).catch(…)
+  // must not TypeError on the no-write-access path only.
+  const guarded = async function (...args) {
+    if (!(await ensureWriteAccess())) {
+      // Vault is locked. Park the WHOLE call — nothing has run yet, so a
+      // confirm() inside the action is asked once, on the retry, rather than
+      // before a no-op.
+      pendingWriteAction = { name, fn, self: this, args };
+      openWriteUnlockModal();
+      return undefined;
+    }
+    return fn.apply(this, args);
+  };
+  guarded.__writeGuarded = true;
+  guarded.__unguarded = fn;
+  return guarded;
+}
+
+function clearPendingWriteAction() { pendingWriteAction = null; }
+
+// Read-only seams so tests (and the console) can observe park state without
+// reaching into a module-scoped binding.
+function hasPendingWriteAction() { return pendingWriteAction !== null; }
+function pendingWriteActionName() { return pendingWriteAction ? pendingWriteAction.name : null; }
+
+function takePendingWriteAction() {
+  const pending = pendingWriteAction;
+  pendingWriteAction = null;
+  return pending;
+}
+
+function installWriteAccessGuards(scope) {
+  for (const name of WRITE_ACTIONS) {
+    const fn = scope[name];
+    if (typeof fn === "function" && fn.__writeGuarded) continue;
+    if (typeof fn !== "function") {
+      // Fail loud, not silent. A registered name that is not a global function
+      // is almost always a write action refactored from a function declaration
+      // to a const/arrow binding: const/let create no global property, so
+      // scope[name] is undefined, the guard would no-op, and the inline
+      // onclick="" would resolve through the lexical binding straight to the
+      // UNGUARDED function — silently restoring the write-lock defect for that
+      // action. Skipping it here is how that regression would ship green.
+      throw new Error(
+        "clauth write-guard install failed: '" + name + "' is registered in WRITE_ACTIONS but is not a " +
+        "global function. Declare it as 'function " + name + "(...)' — a const/let/arrow binding cannot be guarded."
+      );
+    }
+    scope[name] = withWriteAccess(name, fn);
+  }
+}
+
+// Safe to run here: every dashboard function is a top-level function
+// declaration, so all of them are hoisted and initialised before this
+// statement executes. Inline onclick="" handlers resolve through the same
+// global properties, so they get the guarded versions.
+installWriteAccessGuards(typeof window !== "undefined" ? window : globalThis);
+
 async function boot() {
   try {
     const ping = await fetch(BASE + "/ping").then(r => r.json());
@@ -1305,9 +1579,173 @@ function showMain(ping) {
   pollTunnel();
   loadWebdavMounts();
   updateBuildStatus();
+  loadSupervisorCockpit();
+  startSupervisorLogTail();
   refreshWriteLockUi();
 }
 
+let supervisorLogTailStarted = false;
+function startSupervisorLogTail() {
+  if (supervisorLogTailStarted) return; // showMain() can run more than once per page load
+  supervisorLogTailStarted = true;
+  setInterval(loadSupervisorCockpit, 3000);
+}
+
+function supervisorBadge(text, kind) {
+  return '<span class="supervisor-pill ' + (kind || '') + '">' + htmlEscape(text) + '</span>';
+}
+
+async function supervisorJson(path, options) {
+  const response = await fetch(BASE + path, { cache: "no-store", ...(options || {}) });
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok || data.error) throw new Error(data.error || ("HTTP " + response.status));
+  return data;
+}
+
+function supervisorFeedback(text, bad) {
+  const el = document.getElementById("supervisor-feedback");
+  if (!el) return;
+  el.textContent = text || "";
+  el.className = "supervisor-feedback" + (bad ? " bad" : "");
+  el.style.display = text ? "block" : "none";
+}
+
+const SUPERVISOR_SURFACE_ACTIONS = ["start", "stop", "restart", "reconcile", "test", "promote", "rollback"];
+let selectedSupervisorSurface = null; // { id, name } | null
+let lastSupervisorSurfaceRows = [];
+
+const CLAUTH_SELF_PSEUDO_SURFACE = {
+  __pseudo: true,
+  id: "clauth:mcp-sse",
+  plugin_id: "clauth",
+  name: "clauth (self)",
+  lifecycle_owner: "external",
+  destination: "self",
+  state: "self_managed",
+  port: null,
+  health: null,
+};
+
+async function loadSupervisorCockpit() {
+  const status = document.getElementById("supervisor-status");
+  if (status) status.textContent = "Loading supervisor state…";
+  try {
+    const [health, surfaces, logs] = await Promise.all([
+      supervisorJson("/health"),
+      supervisorJson("/v1/surfaces"),
+      supervisorJson("/v1/logs?limit=40"),
+    ]);
+    const surfaceRows = [CLAUTH_SELF_PSEUDO_SURFACE, ...(surfaces.surfaces || [])];
+    lastSupervisorSurfaceRows = surfaceRows;
+    if (selectedSupervisorSurface && !surfaceRows.some(s => (s.plugin_id + ":" + s.id) === selectedSupervisorSurface.id)) {
+      selectedSupervisorSurface = null;
+    }
+    document.getElementById("supervisor-surface-count").textContent = String(surfaceRows.length - 1);
+    document.getElementById("supervisor-operation-count").textContent = String((logs.operations || []).length);
+    document.getElementById("supervisor-surface-meta").textContent = "pm2 home: " + (health.pm2_home || "—");
+    document.getElementById("supervisor-log-path").textContent = logs.log_path || "events.jsonl";
+    document.getElementById("supervisor-surfaces").innerHTML = surfaceRows.map(renderSupervisorSurface).join("");
+    renderSupervisorCmdbar();
+    const logEl = document.getElementById("supervisor-events");
+    // Newest-at-bottom, like a real tail -- and only auto-scroll if the
+    // reader was already at the bottom, so scrolling up to read history
+    // during a poll tick doesn't get yanked back down.
+    const wasAtBottom = logEl.scrollHeight - logEl.scrollTop - logEl.clientHeight < 12;
+    logEl.textContent = (logs.events || []).slice(-40).map(e => {
+      const label = e.kind === "operation" ? (e.action + " " + JSON.stringify(e.target || {})) : (e.kind + " " + (e.plugin_id || ""));
+      return (e.ts || e.created_at || "") + "  " + label;
+    }).join("\\n") || "No events yet.";
+    if (wasAtBottom) logEl.scrollTop = logEl.scrollHeight;
+    if (status) status.innerHTML = supervisorBadge("supervisor " + (health.status === "ok" ? "healthy" : (health.status || "unknown")), health.status === "ok" ? "ok" : "warn") + supervisorBadge("vault " + (health.vault_locked ? "locked" : "unlocked"), health.vault_locked ? "warn" : "ok") + supervisorBadge("v" + (health.clauth_version || "${VERSION}"), "");
+  } catch (err) {
+    if (status) status.innerHTML = supervisorBadge("supervisor unreachable", "bad") + " " + htmlEscape(err.message || err);
+    supervisorFeedback("Supervisor unavailable — actions are disabled until the local control plane returns.", true);
+  }
+}
+
+// Derives an "Open UI" target for a surface without storing one on disk —
+// a real localhost port wins, else the first externally-routable URL.
+function openUiUrlForSurface(surface) {
+  if (surface.port && surface.port !== "auto") return "http://127.0.0.1:" + surface.port + "/";
+  const external = (surface.routes || []).find(r => r.kind === "external" && r.url);
+  return external ? external.url : null;
+}
+
+function selectSupervisorSurface(compositeId, name) {
+  selectedSupervisorSurface = selectedSupervisorSurface && selectedSupervisorSurface.id === compositeId
+    ? null // clicking the already-selected card deselects it
+    : { id: compositeId, name };
+  document.querySelectorAll(".supervisor-row[data-surface-id]").forEach(row => {
+    row.classList.toggle("selected", row.dataset.surfaceId === (selectedSupervisorSurface && selectedSupervisorSurface.id));
+  });
+  renderSupervisorCmdbar();
+}
+
+function renderSupervisorCmdbar() {
+  const bar = document.getElementById("supervisor-cmdbar");
+  if (!bar) return;
+  if (!selectedSupervisorSurface) {
+    bar.innerHTML = '<span class="supervisor-cmdbar-empty">Select a surface below to act on it.</span>';
+    return;
+  }
+  const { id, name } = selectedSupervisorSurface;
+  bar.innerHTML = '<span class="supervisor-cmdbar-name">' + htmlEscape(name) + '</span>' +
+    SUPERVISOR_SURFACE_ACTIONS.map(a => '<button class="supervisor-action" data-supervisor-action="' + a + '" onclick="runSupervisorSurface(' + jsArg(id) + ',' + jsArg(a) + ')">' + a + '</button>').join("");
+}
+
+function renderSupervisorSurface(surface) {
+  const compositeId = surface.plugin_id + ":" + surface.id;
+  const ownerKind = surface.lifecycle_owner === "clauth" ? "ok" : (surface.lifecycle_owner === "plugin" ? "warn" : "");
+  const stateKind = surface.state === "current" || surface.status === "healthy" ? "ok" : (surface.state === "unavailable" ? "bad" : "warn");
+  const openUrl = surface.__pseudo ? null : openUiUrlForSurface(surface);
+  const isSelected = selectedSupervisorSurface && selectedSupervisorSurface.id === compositeId;
+  const rowClass = "supervisor-row" + (surface.__pseudo ? " readonly" : "") + (isSelected ? " selected" : "");
+  const onclick = surface.__pseudo ? "" : ' onclick="selectSupervisorSurface(' + jsArg(compositeId) + ',' + jsArg(surface.name || compositeId) + ')"';
+  const openBtn = surface.__pseudo
+    ? '<button class="supervisor-action" onclick="event.stopPropagation();openClauthSelfMcp()" title="Open clauth\\'s own MCP endpoint">Open</button>'
+    : (openUrl ? '<button class="supervisor-action" onclick="event.stopPropagation();window.open(' + jsArg(openUrl) + ',\\'_blank\\')" title="Open this surface\\'s UI">Open UI</button>' : "");
+  return '<div class="' + rowClass + '" data-surface-id="' + htmlEscape(compositeId) + '"' + onclick + '>' +
+    '<div class="supervisor-row-top"><span class="supervisor-name">' + htmlEscape(surface.name || compositeId) + '</span>' +
+    supervisorBadge(surface.lifecycle_owner || "unknown", ownerKind) + supervisorBadge(surface.state || surface.status || "unknown", stateKind) +
+    openBtn +
+    '</div>' +
+    '<div class="supervisor-meta">' + htmlEscape(surface.destination || "—") + ' · port ' + htmlEscape(surface.port || "—") + '</div>' +
+    '<div class="supervisor-meta">' + htmlEscape(surface.health || surface.health_url || "no health") + '</div>' +
+    '</div>';
+}
+
+async function rescanSupervisorPlugins() {
+  try {
+    await supervisorJson("/v1/plugins/rescan", { method: "POST", headers: writeHeaders() });
+    supervisorFeedback("Plugin rescan completed.", false);
+    await loadSupervisorCockpit();
+  } catch (err) { supervisorFeedback("Plugin rescan failed: " + (err.message || err), true); }
+}
+
+async function runSupervisorSurface(id, action) {
+  try {
+    const receipt = await supervisorJson("/v1/surfaces/" + encodeURIComponent(id) + "/actions", { method: "POST", headers: writeHeaders({ "Content-Type": "application/json" }), body: JSON.stringify({ action }) });
+    const result = receipt.resulting_state || {};
+    supervisorFeedback("Surface " + action + " receipt " + (receipt.operationId || "recorded") + " · " + (result.state || "completed"), result.ok === false);
+    await loadSupervisorCockpit();
+  } catch (err) { supervisorFeedback("Surface " + action + " failed: " + (err.message || err), true); }
+}
+
+// clauth doesn't manage itself as a plugin, so its own MCP endpoint has no
+// entry in the real surfaces registry — this reads the vault value directly
+// (never hardcoded) rather than storing a synthetic surfaces row.
+async function openClauthSelfMcp() {
+  try {
+    const res = await fetch(BASE + "/v/mcp-clauth-endpoint");
+    const text = (await res.text()).trim();
+    if (!res.ok) {
+      supervisorFeedback("Could not read clauth's own MCP endpoint: " + text, true);
+      return;
+    }
+    window.open(text, "_blank");
+  } catch (err) { supervisorFeedback("Could not read clauth's own MCP endpoint: " + (err.message || err), true); }
+}
+
 // ── Unlock ──────────────────────────────────
 async function unlock() {
   const input = document.getElementById("lock-input");
@@ -1365,6 +1803,9 @@ async function unlock() {
     }
 
     writeToken = r.write_token || null;
+    // Full-vault unlock is a fresh page state, not a retry of a parked write.
+    // Kept symmetric with unlockWrites() so no path can carry a stale park.
+    clearPendingWriteAction();
     input.value = "";
     const ping = await fetch(BASE + "/ping").then(r => r.json());
     showMain(ping);
@@ -1389,21 +1830,68 @@ async function lockVault() {
 // ── Unlock writes (re-establish write scope without locking) ──
 // Needed when the daemon auto-unlocks via --pw/boot.key: the page never sees the
 // unlock screen, so it holds no write token. POST /auth mints one (10-min TTL).
-async function unlockWrites() {
-  if (writeToken && !confirm("Writes are already unlocked this session. Re-unlock?")) return;
-  const pw = prompt("Enter your vault password to enable saving changes (10-minute write session):");
-  if (!pw) return;
+function unlockWrites() {
+  // Manual unlock from the toolbar — nothing is parked, so make sure a stale
+  // park from an earlier dismissed attempt cannot ride along on this unlock.
+  clearPendingWriteAction();
+  openWriteUnlockModal();
+}
+
+function openWriteUnlockModal() {
+  const overlay = document.getElementById("write-unlock-overlay");
+  const input = document.getElementById("write-unlock-input");
+  const err = document.getElementById("write-unlock-err");
+  if (err) err.textContent = "";
+  if (input) { input.value = ""; input.className = "lock-input"; }
+  if (overlay) overlay.style.display = "flex";
+  if (input) setTimeout(() => input.focus(), 50);
+}
+
+function closeWriteUnlockModal() {
+  // Dismissing the modal must disarm the parked write. submitWriteUnlock()
+  // takes the park before it calls this, so a successful unlock still retries.
+  clearPendingWriteAction();
+  const overlay = document.getElementById("write-unlock-overlay");
+  if (overlay) overlay.style.display = "none";
+}
+
+async function submitWriteUnlock() {
+  const input = document.getElementById("write-unlock-input");
+  const btn = document.getElementById("write-unlock-btn");
+  const err = document.getElementById("write-unlock-err");
+  const pw = input ? input.value : "";
+  if (!pw) { if (err) err.textContent = "Password is required."; return; }
+  if (btn) { btn.disabled = true; btn.textContent = "Verifying..."; }
   try {
     const r = await fetch(BASE + "/auth", {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ password: pw }),
     }).then(r => r.json());
-    if (r.error) { alert("Unlock failed: " + r.error); return; }
+    if (r.error) {
+      if (input) { input.className = "lock-input error"; setTimeout(() => input.className = "lock-input", 600); }
+      if (err) err.textContent = "Invalid: " + (r.error || "Invalid password");
+      return;
+    }
     writeToken = r.write_token || null;
+    // Take the park BEFORE closing — closeWriteUnlockModal() clears it.
+    const pending = takePendingWriteAction();
     refreshWriteLockUi();
-    alert(writeToken ? "Writes unlocked for 10 minutes." : "Unlock did not return a write token.");
-  } catch (e) { alert("Unlock error: " + (e.message || e)); }
+    closeWriteUnlockModal();
+    if (pending && writeToken) {
+      // Re-fire the ORIGINAL unguarded action, exactly once. Using the
+      // unguarded reference means it can never re-park itself into a loop.
+      try {
+        await pending.fn.apply(pending.self, pending.args);
+      } catch (retryErr) {
+        console.error("[clauth] write action '" + pending.name + "' failed after unlock:", retryErr);
+      }
+    }
+  } catch (e) {
+    if (err) err.textContent = "Unlock error: " + (e.message || e);
+  } finally {
+    if (btn) { btn.disabled = false; btn.textContent = "Unlock Writes"; }
+  }
 }
 
 // Reflect write-lock state on the button so it is obvious when a save will fail.
@@ -1451,124 +1939,6 @@ async function launchCCandMe() {
   }
 }
 
-// ── TinTin local CLI dispatch sidebar ──
-let tintinPollTimer = null;
-
-function toggleTinTinPanel() {
-  const panel = document.getElementById("tintin-panel");
-  const tab = document.getElementById("tintin-tab");
-  if (!panel) return;
-  panel.classList.toggle("open");
-  if (tab) tab.classList.toggle("active");
-}
-
-function fillTinTinSmoke() {
-  const prompt = document.getElementById("tintin-prompt");
-  const app = document.getElementById("tintin-app");
-  if (app) app.value = "clauth-dashboard";
-  if (prompt) prompt.value = "Reply exactly: tintin-dashboard-ok";
-}
-
-function setTinTinStatus(text) {
-  const el = document.getElementById("tintin-status");
-  if (el) el.textContent = text || "";
-}
-
-function appendTinTinMessage(role, text) {
-  const container = document.getElementById("tintin-messages");
-  if (!container || !text) return;
-  const bubble = document.createElement("div");
-  bubble.style.cssText = role === "user"
-    ? "background:#14532d;border:1px solid #166534;border-radius:8px;padding:8px 10px;font-size:.82rem;color:#bbf7d0;white-space:pre-wrap;word-break:break-word;align-self:flex-end;max-width:90%"
-    : "background:#0a1f1a;border:1px solid #134e4a;border-radius:8px;padding:8px 10px;font-size:.82rem;color:#86efac;font-family:'Courier New',monospace;white-space:pre-wrap;word-break:break-word;max-width:95%;max-height:300px;overflow:auto";
-  bubble.textContent = text;
-  container.appendChild(bubble);
-  container.scrollTop = container.scrollHeight;
-}
-
-function setTinTinResult(text, open) {
-  if (open && text) appendTinTinMessage("assistant", text);
-}
-
-async function sendTinTinMessage() {
-  const sendBtn = document.getElementById("tintin-send");
-  const promptEl = document.getElementById("tintin-prompt");
-  const appEl = document.getElementById("tintin-app");
-  const cwdEl = document.getElementById("tintin-cwd");
-  const prompt = (promptEl && promptEl.value || "").trim();
-  const appSlug = (appEl && appEl.value || "clauth-dashboard").trim() || "clauth-dashboard";
-  const cwd = (cwdEl && cwdEl.value || "").trim();
-  if (!prompt) {
-    setTinTinStatus("prompt required");
-    return;
-  }
-  if (tintinPollTimer) {
-    clearTimeout(tintinPollTimer);
-    tintinPollTimer = null;
-  }
-  const jobId = "tintin-" + Date.now();
-  const body = {
-    prompt,
-    job_id: jobId,
-    cwd,
-    agent_context: {
-      app: { slug: appSlug, route: "/clauth-dashboard", origin: window.location.origin },
-      repo: { root: cwd, cwd },
-      runtime: { agent: "clauth-cli", requested_by: "clauth-dashboard", model: "claude-sonnet-4-6" },
-      task: { intent: "general_chat", thread_id: jobId }
-    }
-  };
-
-  appendTinTinMessage("user", prompt);
-  if (promptEl) promptEl.value = "";
-  if (sendBtn) { sendBtn.disabled = true; sendBtn.textContent = "Dispatching..."; }
-  setTinTinStatus("dispatching");
-  try {
-    const response = await fetch(BASE + "/tintin/dispatch", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body)
-    });
-    const result = await response.json();
-    if (!response.ok || result.error) {
-      setTinTinStatus("dispatch failed");
-      setTinTinResult(JSON.stringify(result, null, 2), true);
-      return;
-    }
-    setTinTinStatus("spawned pid " + result.pid + " - polling");
-    pollTinTinJob(jobId, 0);
-  } catch (err) {
-    setTinTinStatus("dispatch error");
-    setTinTinResult(err && err.message ? err.message : String(err), true);
-  } finally {
-    if (sendBtn) { sendBtn.disabled = false; sendBtn.textContent = "Dispatch"; }
-  }
-}
-
-async function pollTinTinJob(jobId, attempt) {
-  try {
-    const response = await fetch(BASE + "/tintin/dispatch/" + encodeURIComponent(jobId), { cache: "no-store" });
-    const job = await response.json();
-    if (!response.ok || job.error) {
-      setTinTinStatus("job lookup failed");
-      setTinTinResult(JSON.stringify(job, null, 2), true);
-      return;
-    }
-    if (job.status === "running" && attempt < 60) {
-      setTinTinStatus("running pid " + (job.pid || "?") + " - " + (attempt + 1));
-      tintinPollTimer = setTimeout(function() { pollTinTinJob(jobId, attempt + 1); }, 1500);
-      return;
-    }
-    setTinTinStatus(job.status === "completed" ? "done" : job.status);
-    const out = (job.stdout || "").trim();
-    if (out) appendTinTinMessage("assistant", out);
-    if (job.stderr && job.stderr.trim()) appendTinTinMessage("assistant", "stderr: " + job.stderr.trim());
-  } catch (err) {
-    setTinTinStatus("poll error");
-    setTinTinResult(err && err.message ? err.message : String(err), true);
-  }
-}
-
 // ── Restart daemon (keeps boot.key — vault stays unlocked) ──
 async function restartDaemon() {
   if (!confirm("Restart the daemon?\\n\\nThe vault will stay unlocked (boot.key kept).")) return;
@@ -1640,8 +2010,16 @@ function switchProjectTab(key) {
   renderServiceGrid(allServices);
 }
 
+const MCP_SURFACE_DUPLICATE_SERVICES = new Set([
+  "mcp-clauth-endpoint",
+  "mcp-fs-endpoint",
+  "mcp-regen-media-endpoint",
+  "mcp-web-research-endpoint",
+]);
+
 function renderServiceGrid(services) {
   const grid = document.getElementById("grid");
+  services = services.filter(s => !MCP_SURFACE_DUPLICATE_SERVICES.has(s.name));
   let filtered = services;
   if (activeProjectTab === "unassigned") {
     filtered = services.filter(s => !s.project);
@@ -3034,11 +3412,6 @@ setInterval(async () => {
 }, 5000);
 
 boot();
-
-const tintinSidebarScript = document.createElement("script");
-tintinSidebarScript.src = "/tintin/sidebar.user.js";
-tintinSidebarScript.defer = true;
-document.body.appendChild(tintinSidebarScript);
 </script>
 </body>
 </html>`;
@@ -3061,610 +3434,55 @@ function clauthConfigDir() {
   return path.join(os.homedir(), ".config", "clauth");
 }
 
-function tintinConfigPath() {
-  return process.env.CLAUTH_MONKEY_CONFIG || path.join(clauthConfigDir(), "monkey.config.json");
-}
-
-function defaultTinTinConfig() {
-  return {
-    schema_version: 3,
-    trust_mode: process.env.CLAUTH_MONKEY_TRUST_MODE || "open-local",
-    agent_settings: {
-      default_repo_root: process.env.CLAUTH_TINTIN_REPO_ROOT || "C:\\Dev\\regen-root",
-      worktree_root: process.env.CLAUTH_TINTIN_WORKTREE_ROOT || "C:\\Dev\\regen-root.wt",
-      base_branch: process.env.CLAUTH_TINTIN_BASE_BRANCH || "develop",
-      isolation: process.env.CLAUTH_TINTIN_ISOLATION || "worktree",
-      launch_mode: "setup_only",
-      agents: {
-        claude: {
-          runtime: "claude",
-          model: process.env.CLAUTH_TINTIN_CLAUDE_MODEL || "claude-sonnet-4-6",
-          command: process.env.CLAUDE_BIN || "claude",
-          enabled: true,
-        },
-        codex: {
-          runtime: "codex",
-          model: process.env.CLAUTH_TINTIN_CODEX_MODEL || "gpt-5-codex",
-          command: process.env.CODEX_BIN || "codex",
-          enabled: true,
-        },
-      },
-    },
-    sidebar_settings: {
-      enabled: true,
-      default_app_slug: "tintin-console",
-      session_ttl_hours: 24,
-      event_history_limit: 200,
-    },
-    dispatch_settings: {
-      enabled: true,
-      default_agent: "claude",
-      default_model: process.env.CLAUTH_TINTIN_CLAUDE_MODEL || "claude-sonnet-4-6",
-      max_concurrent_workers: 2,
-    },
-    codevelop_settings: {
-      enabled: true,
-      default_repo: process.env.CLAUTH_TINTIN_REPO_ROOT || "C:\\Dev\\regen-root",
-      message_retention_limit: 500,
-      require_peer_join: true,
-    },
-    agent_sessions: [],
-    apps: [
-      {
-        slug: "rdc-marketing-engine",
-        origins: [
-          "http://localhost:3000",
-          "http://127.0.0.1:3000",
-          "https://app.regendevcorp.com",
-          "https://rdc-marketing-engine.dev.regendevcorp.com",
-        ],
-        manifest_url: "https://app.regendevcorp.com/.well-known/monkey.json",
-        cwd: "C:\\Dev\\regen-root",
-        capabilities: ["general_chat", "skill_request", "handoff"],
-      },
-    ],
-  };
-}
-
-function mergeTinTinAgentSettings(input = {}) {
-  const defaults = defaultTinTinConfig().agent_settings;
-  const incoming = input && typeof input === "object" ? input : {};
-  return {
-    ...defaults,
-    ...incoming,
-    agents: {
-      ...defaults.agents,
-      ...(incoming.agents && typeof incoming.agents === "object" ? incoming.agents : {}),
-    },
-  };
-}
-
-function mergeTinTinSectionSettings(sectionName, input = {}) {
-  const defaults = defaultTinTinConfig()[sectionName] || {};
-  const incoming = input && typeof input === "object" ? input : {};
-  return { ...defaults, ...incoming };
-}
-
-function normalizeTinTinConfig(input = {}) {
-  const defaults = defaultTinTinConfig();
-  return {
-    schema_version: Math.max(Number(input.schema_version || 0), defaults.schema_version),
-    trust_mode: typeof input.trust_mode === "string" ? input.trust_mode : defaults.trust_mode,
-    agent_settings: mergeTinTinAgentSettings(input.agent_settings),
-    sidebar_settings: mergeTinTinSectionSettings("sidebar_settings", input.sidebar_settings),
-    dispatch_settings: mergeTinTinSectionSettings("dispatch_settings", input.dispatch_settings),
-    codevelop_settings: mergeTinTinSectionSettings("codevelop_settings", input.codevelop_settings),
-    agent_sessions: Array.isArray(input.agent_sessions) ? input.agent_sessions : defaults.agent_sessions,
-    apps: Array.isArray(input.apps) ? input.apps : defaults.apps,
-  };
-}
-
-function loadTinTinConfig() {
-  const configPath = tintinConfigPath();
-  try {
-    if (!fs.existsSync(configPath)) return { ...normalizeTinTinConfig(), path: configPath, exists: false };
-    const parsed = JSON.parse(fs.readFileSync(configPath, "utf8"));
-    return {
-      ...normalizeTinTinConfig(parsed),
-      path: configPath,
-      exists: true,
-    };
-  } catch (err) {
-    return {
-      ...normalizeTinTinConfig(),
-      path: configPath,
-      exists: false,
-      error: err.message,
-    };
+// ── call_agent noauth-host guard (Gate B, bearer-gated tunnel) ───────────────
+// Pure decision function so the policy is testable without a daemon. Decides
+// whether a /call-agent request may proceed.
+//   - Browser Origin → reject (CSRF), unchanged, regardless of host/token.
+//   - Local (127.0.0.1, noAuthHost=false) → allow without a token, as today.
+//   - Noauth tunnel host (clauth.regendevcorp.com etc.) → allow ONLY when the
+//     request carries `Authorization: Bearer <expectedToken>` and the token is
+//     a non-empty exact match. Missing/wrong bearer → reject (unchanged
+//     unauthenticated behaviour). If no expectedToken is configured server-side,
+//     the noauth host stays fully closed (cannot be unlocked by any bearer).
+// Returns { allow: true } or { allow: false, status, error }.
+export function evaluateCallAgentGuard({ origin, noAuthHost, authHeader, expectedToken }) {
+  if (origin) {
+    return { allow: false, status: 403, error: "call_agent_rejects_browser_origin", origin };
   }
+  if (!noAuthHost) {
+    return { allow: true };
+  }
+  // Noauth tunnel host: require a valid bearer token.
+  const presented = typeof authHeader === "string"
+    ? (authHeader.match(/^Bearer\s+(.+)$/i)?.[1] || "").trim()
+    : "";
+  if (expectedToken && presented && presented === expectedToken) {
+    return { allow: true };
+  }
+  return { allow: false, status: 403, error: "call_agent_not_available_on_noauth_host" };
 }
 
-function saveTinTinConfig(input = {}) {
-  const configPath = tintinConfigPath();
-  const next = normalizeTinTinConfig(input);
-  fs.mkdirSync(path.dirname(configPath), { recursive: true });
-  fs.writeFileSync(configPath, `${JSON.stringify(next, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
-  return { ...next, path: configPath, exists: true };
-}
-
-function slugPart(value, fallback = "session") {
-  return String(value || fallback).toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64) || fallback;
-}
-
-function assertInside(parent, child) {
-  const rel = path.relative(path.resolve(parent), path.resolve(child));
-  return rel && !rel.startsWith("..") && !path.isAbsolute(rel);
-}
+// ── Server logic (shared by foreground + daemon) ─────────────
+function createServer(initPassword, whitelist, port, tunnelHostnameInit = null, isStaged = false) {
+  mcpHttpBaseUrl = `http://127.0.0.1:${port}`;
 
-function gitTopLevel(repoRoot) {
-  try {
-    return execSyncTop("git rev-parse --show-toplevel", {
-      cwd: repoRoot,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"],
-      windowsHide: true,
-    }).trim();
-  } catch {
-    return null;
-  }
-}
+  // tunnelHostname may be updated at runtime (fetched from DB after unlock)
+  let tunnelHostname = tunnelHostnameInit;
 
-function createTinTinAgentSession(input = {}) {
-  const config = loadTinTinConfig();
-  const settings = mergeTinTinAgentSettings(config.agent_settings);
-  const agentKey = slugPart(input.agent || input.runtime || "claude", "claude");
-  const agent = settings.agents?.[agentKey] || { runtime: agentKey, model: input.model || "", command: agentKey, enabled: true };
-  if (agent.enabled === false) return { ok: false, error: "agent_disabled", agent: agentKey };
-
-  const sessionId = slugPart(input.session_id || makeTinTinId("agent"), "agent");
-  const repoRoot = path.resolve(String(input.repo_root || settings.default_repo_root || settings.cwd || process.cwd()));
-  const top = gitTopLevel(repoRoot);
-  if (!top) return { ok: false, error: "not_git_repo", repo_root: repoRoot };
-
-  const isolation = String(input.isolation || settings.isolation || "worktree");
-  const baseBranch = slugPart(input.base_branch || settings.base_branch || "develop", "develop");
-  let cwd = top;
-  let branch = null;
-  let worktreePath = null;
-  let worktreeCreated = false;
-  const commands = [];
-
-  if (isolation === "worktree") {
-    const worktreeRoot = path.resolve(String(input.worktree_root || settings.worktree_root || path.join(path.dirname(top), `${path.basename(top)}.wt`)));
-    fs.mkdirSync(worktreeRoot, { recursive: true });
-    worktreePath = path.join(worktreeRoot, `tintin-${agentKey}-${sessionId}`);
-    if (!assertInside(worktreeRoot, worktreePath)) return { ok: false, error: "worktree_path_escape", worktree_root: worktreeRoot, worktree_path: worktreePath };
-    branch = `wt/tintin/${agentKey}/${sessionId}`;
-    if (!fs.existsSync(worktreePath)) {
-      execSyncTop(`git worktree add -b ${JSON.stringify(branch)} ${JSON.stringify(worktreePath)} ${JSON.stringify(baseBranch)}`, {
-        cwd: top,
-        stdio: ["ignore", "pipe", "pipe"],
-        timeout: 60_000,
-        windowsHide: true,
-      });
-      worktreeCreated = true;
-      commands.push(`git worktree add -b ${branch} ${worktreePath} ${baseBranch}`);
+  // Ensure Windows system tools are reachable (bash shells may lack these on PATH)
+  if (os.platform() === "win32") {
+    const sys32 = "C:\\Windows\\System32";
+    if (!process.env.PATH?.includes(sys32 + "\\Wbem")) {
+      process.env.PATH = (process.env.PATH || "") + ";" + sys32 + "\\Wbem";
+    }
+    if (!process.env.PATH?.includes(sys32 + ";") && !process.env.PATH?.endsWith(sys32)) {
+      process.env.PATH = (process.env.PATH || "") + ";" + sys32;
     }
-    cwd = worktreePath;
-  } else if (isolation !== "cwd") {
-    return { ok: false, error: "unsupported_isolation", isolation };
   }
-
-  const runtime = agent.runtime || agentKey;
-  const command = agent.command || runtime;
-  const model = input.model || agent.model || "";
-  const launchCommand = runtime === "codex"
-    ? `${command} exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check -C ${JSON.stringify(cwd)} -`
-    : `${command} -p <prompt> --dangerously-skip-permissions`;
-
-  const result = {
-    ok: true,
-    agent_session_id: sessionId,
-    agent: agentKey,
-    runtime,
-    model,
-    isolation,
-    repo_root: top,
-    cwd,
-    worktree_root: isolation === "worktree" ? path.dirname(worktreePath) : null,
-    worktree_path: worktreePath,
-    worktree_created: worktreeCreated,
-    branch,
-    base_branch: baseBranch,
-    launch_mode: settings.launch_mode || "setup_only",
-    launch_command: launchCommand,
-    commands,
-  };
-  const sessionRecord = {
-    agent_session_id: result.agent_session_id,
-    agent: result.agent,
-    runtime: result.runtime,
-    model: result.model,
-    isolation: result.isolation,
-    repo_root: result.repo_root,
-    cwd: result.cwd,
-    worktree_path: result.worktree_path,
-    branch: result.branch,
-    base_branch: result.base_branch,
-    launch_mode: result.launch_mode,
-    created_at: new Date().toISOString(),
-  };
-  const sessions = [sessionRecord, ...(Array.isArray(config.agent_sessions) ? config.agent_sessions : [])
-    .filter((item) => item && item.agent_session_id !== sessionId)]
-    .slice(0, 100);
-  saveTinTinConfig({ ...config, agent_sessions: sessions });
-  return result;
-}
-
-function isLoopbackOrigin(origin) {
-  if (!origin) return false;
-  try {
-    const parsed = new URL(origin);
-    return ["localhost", "127.0.0.1", "::1"].includes(parsed.hostname);
-  } catch {
-    return false;
-  }
-}
-
-function tintinAppForOrigin(config, origin) {
-  if (!origin) return null;
-  return (config.apps || []).find((app) => (
-    Array.isArray(app.origins) && app.origins.some((allowed) => allowed === origin || allowed === "*")
-  )) || null;
-}
-
-function checkTinTinBrowserAccess(req) {
-  const config = loadTinTinConfig();
-  const origin = req.headers.origin || "";
-  const trustMode = config.trust_mode || "open-local";
-  const matchedApp = tintinAppForOrigin(config, origin);
-
-  if (trustMode === "disabled") {
-    return { allowed: false, config, reason: "monkey_disabled" };
-  }
-  if (!origin) {
-    return { allowed: true, config, app: null, reason: "non_browser_local" };
-  }
-  if (matchedApp) {
-    return { allowed: true, config, app: matchedApp, reason: "configured_origin" };
-  }
-  if (trustMode === "open-local" && isLoopbackOrigin(origin)) {
-    return { allowed: true, config, app: null, reason: "open_local_loopback" };
-  }
-  return { allowed: false, config, reason: "origin_not_allowed", origin };
-}
-
-function publicTinTinConfig(config) {
-  return {
-    schema_version: config.schema_version || 1,
-    trust_mode: config.trust_mode || "open-local",
-    config_path: config.path,
-    config_exists: !!config.exists,
-    config_error: config.error || null,
-    agent_settings: mergeTinTinAgentSettings(config.agent_settings),
-    sidebar_settings: mergeTinTinSectionSettings("sidebar_settings", config.sidebar_settings),
-    dispatch_settings: mergeTinTinSectionSettings("dispatch_settings", config.dispatch_settings),
-    codevelop_settings: mergeTinTinSectionSettings("codevelop_settings", config.codevelop_settings),
-    agent_sessions: Array.isArray(config.agent_sessions) ? config.agent_sessions : [],
-    apps: (config.apps || []).map((app) => ({
-      slug: app.slug,
-      origins: app.origins || [],
-      manifest_url: app.manifest_url || null,
-      cwd: app.cwd || null,
-      capabilities: app.capabilities || [],
-    })),
-  };
-}
-
-function tintinSettingsHtml() {
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width,initial-scale=1">
-<title>clauth TinTin Settings</title>
-<style>
-body{margin:0;background:#07100e;color:#d9fbe8;font-family:system-ui,-apple-system,Segoe UI,sans-serif}
-header{display:flex;align-items:center;justify-content:space-between;gap:12px;padding:16px 20px;border-bottom:1px solid #14352f;background:#091814}
-h1{font-size:20px;margin:0}.sub{font-size:12px;color:#8dd8c2;margin-top:3px}.pill{display:inline-flex;align-items:center;border:1px solid #14532d;color:#86efac;padding:2px 7px;font-size:11px;margin-top:7px}
-main{display:grid;grid-template-columns:minmax(300px,430px) 1fr;gap:14px;padding:14px}
-.stack{display:grid;gap:14px}.wide{display:grid;gap:14px}
-section{border:1px solid #14352f;background:#091814;padding:14px}
-h2{font-size:15px;margin:0 0 10px;color:#dcfce7}
-label{display:block;font-size:11px;text-transform:uppercase;letter-spacing:.05em;color:#8dd8c2;font-weight:700;margin:10px 0 4px}
-input,select,textarea{box-sizing:border-box;width:100%;border:1px solid #1d4d43;background:#031312;color:#d9fbe8;padding:8px 9px;font:13px ui-monospace,SFMono-Regular,Consolas,monospace;outline:none}
-textarea{min-height:170px;resize:vertical}.short{min-height:92px}.tiny{min-height:58px}
-.row{display:grid;grid-template-columns:1fr 1fr;gap:8px}.actions{display:flex;gap:8px;flex-wrap:wrap;margin-top:12px}
-button,a.btn{border:1px solid #2d6a5e;background:#08231f;color:#b8ffe1;padding:7px 10px;font-size:12px;font-weight:700;text-decoration:none;cursor:pointer}
-button:hover,a.btn:hover{background:#0f2a24}.danger{border-color:#5f3b3b;color:#fecaca;background:#241010}
-pre{white-space:pre-wrap;word-break:break-word;border:1px solid #0d2a25;background:#020b09;color:#c8f9df;padding:10px;max-height:460px;overflow:auto;font-size:12px}
-.status{font:12px ui-monospace,SFMono-Regular,Consolas,monospace;color:#86efac}.hint{font-size:12px;color:#7dd3c0;line-height:1.4}.check{display:flex;align-items:center;gap:8px;margin-top:10px;color:#d9fbe8;font-size:13px}.check input{width:auto}
-@media(max-width:900px){main{grid-template-columns:1fr}.row{grid-template-columns:1fr}}
-</style>
-</head>
-<body>
-<header>
-  <div><h1>TinTin Settings</h1><div class="sub">Persistent clauth control plane for agent setup, app sidebars, blackboard dispatch, and co-develop relay.</div><div class="pill">GET/PUT /tintin/settings</div></div>
-  <a class="btn" href="/">Vault Dashboard</a>
-</header>
-<main>
-  <div class="stack">
-    <section>
-      <h2>Agent Setup</h2>
-      <div class="hint">Creates a proper isolated cwd for Claude or Codex. Worktree setup is explicit and returned before any supervisor launches a process.</div>
-      <div class="row">
-        <div><label>agent</label><select id="agent"><option value="claude">claude</option><option value="codex">codex</option></select></div>
-        <div><label>isolation</label><select id="isolation"><option value="worktree">worktree</option><option value="cwd">cwd</option></select></div>
-      </div>
-      <label>repo root</label><input id="repoRoot">
-      <label>worktree root</label><input id="worktreeRoot">
-      <div class="row">
-        <div><label>base branch</label><input id="baseBranch"></div>
-        <div><label>session id</label><input id="sessionId" placeholder="auto if blank"></div>
-      </div>
-      <div class="actions">
-        <button onclick="loadSettings()" title="GET /tintin/settings">Load</button>
-        <button onclick="saveSettings()" title="PUT /tintin/settings">Save</button>
-        <button onclick="setupAgent()" title="POST /tintin/agent-sessions">Setup Agent</button>
-      </div>
-      <p class="status" id="status">idle</p>
-    </section>
-    <section>
-      <h2>Stored Agent Sessions</h2>
-      <pre id="agentSessions">No sessions loaded.</pre>
-    </section>
-    <section>
-      <h2>Return</h2>
-      <pre id="result">No return yet.</pre>
-    </section>
-  </div>
-  <div class="wide">
-    <section>
-      <h2>Agent Defaults</h2>
-      <div class="row">
-        <div><label>Claude model</label><input id="claudeModel"></div>
-        <div><label>Codex model</label><input id="codexModel"></div>
-      </div>
-      <div class="row">
-        <div><label>Claude command</label><input id="claudeCommand"></div>
-        <div><label>Codex command</label><input id="codexCommand"></div>
-      </div>
-      <div class="row">
-        <label class="check"><input type="checkbox" id="claudeEnabled"> Claude enabled</label>
-        <label class="check"><input type="checkbox" id="codexEnabled"> Codex enabled</label>
-      </div>
-    </section>
-    <section>
-      <h2>Sidebar Apps</h2>
-      <div class="row">
-        <div><label>trust mode</label><select id="trustMode"><option value="open-local">open-local</option><option value="configured-origins">configured-origins</option><option value="disabled">disabled</option></select></div>
-        <div><label>default app slug</label><input id="defaultAppSlug"></div>
-      </div>
-      <div class="row">
-        <div><label>session ttl hours</label><input id="sessionTtlHours" type="number" min="1" step="1"></div>
-        <div><label>event history limit</label><input id="eventHistoryLimit" type="number" min="1" step="1"></div>
-      </div>
-      <label class="check"><input type="checkbox" id="sidebarEnabled"> Sidebar sessions enabled</label>
-      <label>apps JSON</label><textarea class="short" id="appsJson" spellcheck="false"></textarea>
-    </section>
-    <section>
-      <h2>Blackboard Dispatch</h2>
-      <div class="row">
-        <div><label>default agent</label><select id="dispatchDefaultAgent"><option value="claude">claude</option><option value="codex">codex</option></select></div>
-        <div><label>default model</label><input id="dispatchDefaultModel"></div>
-      </div>
-      <div class="row">
-        <div><label>max workers</label><input id="dispatchMaxWorkers" type="number" min="1" step="1"></div>
-        <label class="check"><input type="checkbox" id="dispatchEnabled"> Dispatch enabled</label>
-      </div>
-    </section>
-    <section>
-      <h2>Co-develop Relay</h2>
-      <div class="row">
-        <div><label>default repo</label><input id="codevelopDefaultRepo"></div>
-        <div><label>message retention</label><input id="codevelopRetention" type="number" min="1" step="1"></div>
-      </div>
-      <div class="row">
-        <label class="check"><input type="checkbox" id="codevelopEnabled"> Co-develop enabled</label>
-        <label class="check"><input type="checkbox" id="codevelopRequirePeer"> Require peer join</label>
-      </div>
-    </section>
-    <section>
-      <h2>Settings JSON</h2>
-      <textarea id="settingsJson" spellcheck="false"></textarea>
-    </section>
-  </div>
-</main>
-<script>
-const BASE = location.origin;
-let currentSettings = {};
-function setStatus(text){ document.getElementById("status").textContent = text; }
-function show(value){ document.getElementById("result").textContent = typeof value === "string" ? value : JSON.stringify(value,null,2); }
-function num(id, fallback){ const n = Number(document.getElementById(id).value); return Number.isFinite(n) ? n : fallback; }
-function applySettings(data){
-  const cfg = data.agent_settings ? data : data.config || data;
-  currentSettings = cfg;
-  const s = cfg.agent_settings || {};
-  const side = cfg.sidebar_settings || {};
-  const dispatch = cfg.dispatch_settings || {};
-  const codevelop = cfg.codevelop_settings || {};
-  const agents = s.agents || {};
-  const claude = agents.claude || {};
-  const codex = agents.codex || {};
-  document.getElementById("trustMode").value = cfg.trust_mode || "open-local";
-  document.getElementById("repoRoot").value = s.default_repo_root || "";
-  document.getElementById("worktreeRoot").value = s.worktree_root || "";
-  document.getElementById("baseBranch").value = s.base_branch || "develop";
-  document.getElementById("isolation").value = s.isolation || "worktree";
-  document.getElementById("claudeModel").value = claude.model || "";
-  document.getElementById("codexModel").value = codex.model || "";
-  document.getElementById("claudeCommand").value = claude.command || "claude";
-  document.getElementById("codexCommand").value = codex.command || "codex";
-  document.getElementById("claudeEnabled").checked = claude.enabled !== false;
-  document.getElementById("codexEnabled").checked = codex.enabled !== false;
-  document.getElementById("sidebarEnabled").checked = side.enabled !== false;
-  document.getElementById("defaultAppSlug").value = side.default_app_slug || "";
-  document.getElementById("sessionTtlHours").value = side.session_ttl_hours || 24;
-  document.getElementById("eventHistoryLimit").value = side.event_history_limit || 200;
-  document.getElementById("appsJson").value = JSON.stringify(cfg.apps || [],null,2);
-  document.getElementById("dispatchEnabled").checked = dispatch.enabled !== false;
-  document.getElementById("dispatchDefaultAgent").value = dispatch.default_agent || "claude";
-  document.getElementById("dispatchDefaultModel").value = dispatch.default_model || "";
-  document.getElementById("dispatchMaxWorkers").value = dispatch.max_concurrent_workers || 2;
-  document.getElementById("codevelopEnabled").checked = codevelop.enabled !== false;
-  document.getElementById("codevelopDefaultRepo").value = codevelop.default_repo || "";
-  document.getElementById("codevelopRetention").value = codevelop.message_retention_limit || 500;
-  document.getElementById("codevelopRequirePeer").checked = codevelop.require_peer_join !== false;
-  document.getElementById("agentSessions").textContent = JSON.stringify(cfg.agent_sessions || [],null,2);
-  document.getElementById("settingsJson").value = JSON.stringify(cfg,null,2);
-}
-function collectSettings(){
-  let apps;
-  try { apps = JSON.parse(document.getElementById("appsJson").value || "[]"); }
-  catch(e){ throw new Error("apps JSON: " + e.message); }
-  const parsed = JSON.parse(document.getElementById("settingsJson").value || "{}");
-  return {
-    ...parsed,
-    trust_mode: document.getElementById("trustMode").value,
-    agent_settings: {
-      ...(parsed.agent_settings || {}),
-      default_repo_root: document.getElementById("repoRoot").value,
-      worktree_root: document.getElementById("worktreeRoot").value,
-      base_branch: document.getElementById("baseBranch").value,
-      isolation: document.getElementById("isolation").value,
-      agents: {
-        ...((parsed.agent_settings || {}).agents || {}),
-        claude: {
-          ...(((parsed.agent_settings || {}).agents || {}).claude || {}),
-          runtime: "claude",
-          model: document.getElementById("claudeModel").value,
-          command: document.getElementById("claudeCommand").value,
-          enabled: document.getElementById("claudeEnabled").checked
-        },
-        codex: {
-          ...(((parsed.agent_settings || {}).agents || {}).codex || {}),
-          runtime: "codex",
-          model: document.getElementById("codexModel").value,
-          command: document.getElementById("codexCommand").value,
-          enabled: document.getElementById("codexEnabled").checked
-        }
-      }
-    },
-    sidebar_settings: {
-      ...(parsed.sidebar_settings || {}),
-      enabled: document.getElementById("sidebarEnabled").checked,
-      default_app_slug: document.getElementById("defaultAppSlug").value,
-      session_ttl_hours: num("sessionTtlHours", 24),
-      event_history_limit: num("eventHistoryLimit", 200)
-    },
-    dispatch_settings: {
-      ...(parsed.dispatch_settings || {}),
-      enabled: document.getElementById("dispatchEnabled").checked,
-      default_agent: document.getElementById("dispatchDefaultAgent").value,
-      default_model: document.getElementById("dispatchDefaultModel").value,
-      max_concurrent_workers: num("dispatchMaxWorkers", 2)
-    },
-    codevelop_settings: {
-      ...(parsed.codevelop_settings || {}),
-      enabled: document.getElementById("codevelopEnabled").checked,
-      default_repo: document.getElementById("codevelopDefaultRepo").value,
-      message_retention_limit: num("codevelopRetention", 500),
-      require_peer_join: document.getElementById("codevelopRequirePeer").checked
-    },
-    agent_sessions: Array.isArray(parsed.agent_sessions) ? parsed.agent_sessions : (currentSettings.agent_sessions || []),
-    apps
-  };
-}
-async function loadSettings(){
-  setStatus("GET /tintin/settings");
-  const r = await fetch(BASE + "/tintin/settings", { cache:"no-store" });
-  const data = await r.json();
-  applySettings(data);
-  show(data);
-  setStatus(r.ok ? "loaded" : "load failed");
-}
-async function saveSettings(){
-  setStatus("PUT /tintin/settings");
-  let body;
-  try { body = collectSettings(); }
-  catch(e){ setStatus("invalid JSON"); show(e.message); return; }
-  const r = await fetch(BASE + "/tintin/settings", { method:"PUT", headers:{ "Content-Type":"application/json" }, body: JSON.stringify(body) });
-  const data = await r.json();
-  applySettings(data);
-  show(data);
-  setStatus(r.ok ? "saved" : "save failed");
-}
-async function setupAgent(){
-  const body = {
-    agent: document.getElementById("agent").value,
-    isolation: document.getElementById("isolation").value,
-    repo_root: document.getElementById("repoRoot").value,
-    worktree_root: document.getElementById("worktreeRoot").value,
-    base_branch: document.getElementById("baseBranch").value,
-    session_id: document.getElementById("sessionId").value || undefined
-  };
-  setStatus("POST /tintin/agent-sessions");
-  const r = await fetch(BASE + "/tintin/agent-sessions", { method:"POST", headers:{ "Content-Type":"application/json" }, body: JSON.stringify(body) });
-  const data = await r.json();
-  show(data);
-  setStatus(r.ok && data.ok ? "agent setup ready" : "agent setup failed");
-  if (r.ok && data.ok) loadSettings().catch(function(){});
-}
-loadSettings().catch(err => { setStatus("load failed"); show(err.message || String(err)); });
-</script>
-</body>
-</html>`;
-}
-
-// ── call_agent noauth-host guard (Gate B, bearer-gated tunnel) ───────────────
-// Pure decision function so the policy is testable without a daemon. Decides
-// whether a /call-agent request may proceed.
-//   - Browser Origin → reject (CSRF), unchanged, regardless of host/token.
-//   - Local (127.0.0.1, noAuthHost=false) → allow without a token, as today.
-//   - Noauth tunnel host (clauth.regendevcorp.com etc.) → allow ONLY when the
-//     request carries `Authorization: Bearer <expectedToken>` and the token is
-//     a non-empty exact match. Missing/wrong bearer → reject (unchanged
-//     unauthenticated behaviour). If no expectedToken is configured server-side,
-//     the noauth host stays fully closed (cannot be unlocked by any bearer).
-// Returns { allow: true } or { allow: false, status, error }.
-export function evaluateCallAgentGuard({ origin, noAuthHost, authHeader, expectedToken }) {
-  if (origin) {
-    return { allow: false, status: 403, error: "call_agent_rejects_browser_origin", origin };
-  }
-  if (!noAuthHost) {
-    return { allow: true };
-  }
-  // Noauth tunnel host: require a valid bearer token.
-  const presented = typeof authHeader === "string"
-    ? (authHeader.match(/^Bearer\s+(.+)$/i)?.[1] || "").trim()
-    : "";
-  if (expectedToken && presented && presented === expectedToken) {
-    return { allow: true };
-  }
-  return { allow: false, status: 403, error: "call_agent_not_available_on_noauth_host" };
-}
-
-// ── Server logic (shared by foreground + daemon) ─────────────
-function createServer(initPassword, whitelist, port, tunnelHostnameInit = null, isStaged = false) {
-  mcpHttpBaseUrl = `http://127.0.0.1:${port}`;
-
-  // tunnelHostname may be updated at runtime (fetched from DB after unlock)
-  let tunnelHostname = tunnelHostnameInit;
-
-  // Ensure Windows system tools are reachable (bash shells may lack these on PATH)
-  if (os.platform() === "win32") {
-    const sys32 = "C:\\Windows\\System32";
-    if (!process.env.PATH?.includes(sys32 + "\\Wbem")) {
-      process.env.PATH = (process.env.PATH || "") + ";" + sys32 + "\\Wbem";
-    }
-    if (!process.env.PATH?.includes(sys32 + ";") && !process.env.PATH?.endsWith(sys32)) {
-      process.env.PATH = (process.env.PATH || "") + ";" + sys32;
-    }
-  }
-  const MAX_FAILS = 10;
-  let failCount = 0;
-  const MAX_AUTH_FAILS = 10;
-  let authFailCount = 0;
+  const MAX_FAILS = 10;
+  let failCount = 0;
+  const MAX_AUTH_FAILS = 10;
+  let authFailCount = 0;
 
   // Per-IP unknown-service strike counter — separate from auth failure budget.
   // Caller typos / stale memory should NOT burn the 10-strike lockout.
@@ -3770,6 +3588,187 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       });
     },
   });
+  const isSupervisorPort = port === getSupervisorPort();
+  const supervisorTestNoToken = process.env.CLAUTH_SUPERVISOR_TEST_NO_TOKEN === "1";
+  const opsAdapter = createPm2Adapter(pm2);
+  const executePm2 = createSerializedExecutor();
+  const opsPolicy = createOperationPolicy({
+    enabled: String(process.env.CLAUTH_OPS_ENABLED || "").split(",").map((item) => item.trim()).filter(Boolean),
+    applications: (() => { try { return JSON.parse(process.env.CLAUTH_OPS_APPLICATIONS || "{}"); } catch { return {}; } })(),
+    adminEnabled: String(process.env.CLAUTH_OPS_ADMIN_ENABLED || "").split(",").map((item) => item.trim()).filter(Boolean),
+    adminApplications: (() => { try { return JSON.parse(process.env.CLAUTH_OPS_ADMIN_APPLICATIONS || "{}"); } catch { return {}; } })(),
+    allowHostWide: process.env.CLAUTH_OPS_ALLOW_HOST_WIDE === "1",
+  });
+  const opsJobs = createJobStore({
+    filePath: process.env.CLAUTH_OPS_JOB_STORE_PATH || path.join(getSupervisorDir(), "ops-jobs.json"),
+  });
+
+  async function getLoopbackSecret(service) {
+    const response = await fetch(`http://127.0.0.1:${LIVE_PORT}/v/${encodeURIComponent(service)}`, { signal: AbortSignal.timeout(5000) });
+    if (!response.ok) throw new Error(`${service} unavailable from local clauth`);
+    const value = (await response.text()).trim();
+    if (!value) throw new Error(`${service} is empty`);
+    return value;
+  }
+  const coolify = createCoolifyAdapter({
+    baseUrl: process.env.CLAUTH_COOLIFY_BASE_URL || "https://deploy.regendevcorp.com",
+    getToken: () => getLoopbackSecret("coolify-api"),
+  });
+  const deployments = (() => { try { return parseDeploymentRegistry(process.env.CLAUTH_OPS_DEPLOYMENTS || "{}"); } catch { return {}; } })();
+  const deploymentAdapter = createDeploymentAdapter({
+    deployments,
+    reload: async (target) => {
+      await executePm2(async () => {
+        await opsAdapter.connect();
+        try { await opsAdapter.execute("reload", { target, options: { updateEnv: true } }); } finally { await opsAdapter.disconnect(); }
+      });
+    },
+  });
+
+  /**
+   * Record an ops failure's upstream message to the LOCAL log only.
+   *
+   * job-store's sanitizer deliberately drops free-form `error` text so an
+   * upstream message cannot carry a credential into the persisted job file or
+   * the API response. That protection left every failure with an empty detail,
+   * so jobs reported `failed` with no reason at all. Jobs now carry an
+   * enumerated `code`; the underlying message goes here, to the same
+   * operator-only log as the rest of the daemon's diagnostics.
+   */
+  function logOpsFailure(kind, operation, error) {
+    const message = String(error?.message || error || "unknown");
+    try {
+      fs.appendFileSync(LOG_FILE, `[${new Date().toISOString()}] [OPS ${kind}/${operation}] ${message}\n`);
+    } catch {}
+  }
+
+  async function opsBearerRole(req) {
+    const header = req.headers.authorization;
+    const supplied = Array.isArray(header) ? header[0] : header;
+    if (!supplied || !String(supplied).startsWith("Bearer ")) return null;
+    const actual = String(supplied).slice(7).trim();
+    let admin; let agent;
+    try { admin = await getLoopbackSecret(process.env.CLAUTH_OPS_ADMIN_TOKEN_SERVICE || "vultr-ops-admin-token"); } catch {}
+    try { agent = await getLoopbackSecret(process.env.CLAUTH_OPS_AGENT_TOKEN_SERVICE || "vultr-ops-api-token"); } catch {}
+    if (admin && agent && admin === agent) return null;
+    for (const [role, expected] of [["admin", admin], ["agent", agent]]) {
+      if (!expected) continue;
+      const a = Buffer.from(actual); const b = Buffer.from(expected);
+      if (a.length === b.length && crypto.timingSafeEqual(a, b)) return role;
+    }
+    return null;
+  }
+
+  async function requireOpsBearer(req, res) {
+    const role = await opsBearerRole(req);
+    if (role) { req._opsRole = role; return true; }
+    res.writeHead(401, { "Content-Type": "application/json", ...CORS });
+    res.end(JSON.stringify({ error: "ops_bearer_required" }));
+    return false;
+  }
+
+  function submitOpsJob(operation, input, role = "agent") {
+    const authorization = opsPolicy.authorize(operation, input, role);
+    const job = opsJobs.create({ kind: "pm2", operation, target: input.target || input.name || null });
+    if (!authorization.ok) {
+      return opsJobs.event(job.id, "rejected", { code: authorization.code });
+    }
+    void (async () => {
+      opsJobs.event(job.id, "running");
+      try {
+        const result = await executePm2(async () => {
+          await opsAdapter.connect();
+          try { return await opsAdapter.execute(operation, input); } finally { await opsAdapter.disconnect(); }
+        });
+        opsJobs.event(job.id, "succeeded", operationReceipt(operation, result, authorization.allowed_targets || []));
+      } catch (error) {
+        // `error` alone is dropped by job-store's sanitizer (it refuses
+        // free-form upstream text so a credential cannot ride along), which
+        // left every failure with an empty detail. Emit an enumerated code so
+        // the failure has a reason; keep the message for the local log only.
+        logOpsFailure("pm2", operation, error);
+        opsJobs.event(job.id, "failed", { code: "pm2_operation_failed" });
+      }
+    })();
+    return opsJobs.get(job.id);
+  }
+
+  function operationReceipt(operation, result, allowedTargets) {
+    if (["list", "describe", "logs"].includes(operation)) {
+      const processes = Array.isArray(result)
+        ? result.filter((process) => allowedTargets.includes("*") || allowedTargets.includes(process?.name))
+        : [];
+      return { processes };
+    }
+    if (operation === "ping") return { status: "connected" };
+    return { status: "completed" };
+  }
+
+  function submitPromotionJob(applicationUuid) {
+    const job = opsJobs.create({ kind: "coolify", operation: "promote", target: applicationUuid });
+    const enabled = String(process.env.CLAUTH_OPS_ENABLED || "").split(",").map((item) => item.trim()).includes("coolify_promote");
+    const allowlist = (() => { try { return JSON.parse(process.env.CLAUTH_COOLIFY_PROMOTE_UUIDS || "[]"); } catch { return []; } })();
+    if (!enabled || !Array.isArray(allowlist) || !allowlist.includes(applicationUuid)) {
+      return opsJobs.event(job.id, "rejected", { code: "service_not_available" });
+    }
+    void (async () => {
+      opsJobs.event(job.id, "running");
+      try {
+        const deployment = await coolify.promote(applicationUuid);
+        // Coolify answers with a `deployments` ARRAY, not a flat object — see
+        // deploymentUuidFrom. Reading the flat field alone marked the job failed
+        // while the deployment was actually running.
+        const deploymentUuid = deploymentUuidFrom(deployment);
+        if (!deploymentUuid) {
+          // The deploy request itself SUCCEEDED (no throw); only the UUID was
+          // unreadable, so the deployment may well be RUNNING. The code says so
+          // explicitly rather than a bare "failed", because a plain failure
+          // invites a retry and a duplicate production deploy.
+          //
+          // An enumerated code, not a free-form error: job-store's sanitizer
+          // drops `error` on purpose to keep upstream text (and any credential
+          // inside it) out of the persisted job.
+          return opsJobs.event(job.id, "failed", { code: "coolify_deploy_accepted_uuid_unreadable" });
+        }
+        opsJobs.event(job.id, "waiting", { deployment_uuid: deploymentUuid });
+        const terminal = await coolify.poll(deploymentUuid, { attempts: Number(process.env.CLAUTH_COOLIFY_POLL_ATTEMPTS || 60), delay: () => new Promise((resolve) => setTimeout(resolve, 5000)) });
+        opsJobs.event(job.id, terminal.state === "succeeded" ? "succeeded" : terminal.state, { deployment_uuid: deploymentUuid, status: terminal.deployment?.status || null });
+      } catch (error) {
+        // The throw may have happened AFTER Coolify accepted the deploy (e.g.
+        // the poll lost the network), so this is not proof nothing shipped.
+        logOpsFailure("coolify", "promote", error);
+        opsJobs.event(job.id, "failed", { code: "coolify_promote_failed" });
+      }
+    })();
+    return opsJobs.get(job.id);
+  }
+
+  function submitDeploymentJob(application, ref) {
+    const job = opsJobs.create({ kind: "deployment", operation: "deploy", target: application });
+    const enabled = String(process.env.CLAUTH_OPS_ENABLED || "").split(",").map((item) => item.trim()).includes("deploy");
+    if (!enabled || !deployments[application]) return opsJobs.event(job.id, "rejected", { code: "service_not_available" });
+    void (async () => {
+      opsJobs.event(job.id, "running");
+      try { opsJobs.event(job.id, "building"); opsJobs.event(job.id, "succeeded", { result: await deploymentAdapter.deploy({ application, ref }) }); }
+      catch (error) { logOpsFailure("deployment", "deploy", error); opsJobs.event(job.id, "failed", { code: "deployment_failed" }); }
+    })();
+    return opsJobs.get(job.id);
+  }
+
+  function hasSupervisorWrite(req) {
+    if (validateWriteToken(req, writeSession)) return true;
+    if (!isSupervisorPort) return false;
+    if (!isLoopbackAddress(req.socket?.remoteAddress)) return false;
+    return supervisorTestNoToken || !supervisorRequiresWriteToken(port);
+  }
+
+  function rejectSupervisorWrite(res) {
+    res.writeHead(403, { "Content-Type": "application/json", ...CORS });
+    return res.end(JSON.stringify({
+      error: "write_token_required",
+      hint: "Unlock clauth writes, unset CLAUTH_SUPERVISOR_REQUIRE_WRITE_TOKEN for localhost supervisor operations, or set CLAUTH_SUPERVISOR_TEST_NO_TOKEN=1 for temporary localhost-only supervisor tests.",
+    }));
+  }
 
   // ── MCP SSE session tracking ──────────────────────────────
   const sseSessions = new Map(); // sessionId → { res, initialized }
@@ -4310,7 +4309,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
   const server = http.createServer(async (req, res) => {
     const remote = req.socket.remoteAddress;
-    const isLocal = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
+    const isLocal = isLoopbackAddress(remote);
 
     const url    = new URL(req.url, `http://127.0.0.1:${port}`);
     const reqPath = url.pathname;
@@ -4350,6 +4349,205 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       return res.end(JSON.stringify(result));
     }
 
+    if (method === "GET" && reqPath === "/health") {
+      return ok(res, { ...supervisorHealth(), listening_port: port, process_id: process.pid, vault_locked: !password, clauth_version: VERSION });
+    }
+
+    // Bearer-gated remote operations surface. It remains loopback-only at this
+    // layer; ingress/tunnel policy decides whether it is reachable remotely.
+    if (method === "GET" && reqPath === "/v1/ops/catalog") {
+      if (!await requireOpsBearer(req, res)) return;
+      return ok(res, { schema: "clauth.ops.v1", operations: PM2_OPERATION_CATALOG });
+    }
+
+    if (method === "GET" && reqPath === "/v1/ops/processes") {
+      if (!await requireOpsBearer(req, res)) return;
+      const job = submitOpsJob("list", {}, req._opsRole);
+      res.writeHead(job.phase === "rejected" ? 403 : 202, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify(job));
+    }
+
+    const opsProcessMatch = reqPath.match(/^\/v1\/ops\/processes\/([^/]+)$/);
+    if (method === "GET" && opsProcessMatch) {
+      if (!await requireOpsBearer(req, res)) return;
+      const job = submitOpsJob("describe", { target: decodeURIComponent(opsProcessMatch[1]) }, req._opsRole);
+      res.writeHead(job.phase === "rejected" ? 403 : 202, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify(job));
+    }
+
+    if (method === "POST" && reqPath === "/v1/ops/operations") {
+      if (!await requireOpsBearer(req, res)) return;
+      let body;
+      try { body = await readBody(req); } catch {
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "invalid_json" }));
+      }
+      const operation = String(body?.operation || "");
+      if (!PM2_OPERATION_CATALOG[operation]) {
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "unknown_operation" }));
+      }
+      const job = submitOpsJob(operation, body?.input && typeof body.input === "object" ? body.input : {}, req._opsRole);
+      res.writeHead(job.phase === "rejected" ? 403 : 202, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify(job));
+    }
+
+    if (method === "POST" && reqPath === "/v1/ops/promotions") {
+      if (!await requireOpsBearer(req, res)) return;
+      let body;
+      try { body = await readBody(req); } catch {
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "invalid_json" }));
+      }
+      const applicationUuid = String(body?.application_uuid || "").trim();
+      if (!applicationUuid) {
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "application_uuid_required" }));
+      }
+      const job = submitPromotionJob(applicationUuid);
+      res.writeHead(job.phase === "rejected" ? 403 : 202, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify(job));
+    }
+
+    if (method === "POST" && reqPath === "/v1/ops/deployments") {
+      if (!await requireOpsBearer(req, res)) return;
+      let body;
+      try { body = await readBody(req); } catch {
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "invalid_json" }));
+      }
+      const application = String(body?.application || "").trim();
+      if (!application) {
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "application_required" }));
+      }
+      const job = submitDeploymentJob(application, body?.ref ? String(body.ref) : undefined);
+      res.writeHead(job.phase === "rejected" ? 403 : 202, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify(job));
+    }
+
+    const opsJobMatch = reqPath.match(/^\/v1\/ops\/jobs\/([^/]+)$/);
+    if (method === "GET" && opsJobMatch) {
+      if (!await requireOpsBearer(req, res)) return;
+      const job = opsJobs.get(decodeURIComponent(opsJobMatch[1]));
+      res.writeHead(job ? 200 : 404, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify(job || { error: "job_not_found" }));
+    }
+
+    const opsJobEventsMatch = reqPath.match(/^\/v1\/ops\/jobs\/([^/]+)\/events$/);
+    if (method === "GET" && opsJobEventsMatch) {
+      if (!await requireOpsBearer(req, res)) return;
+      const jobId = decodeURIComponent(opsJobEventsMatch[1]);
+      if (!opsJobs.get(jobId)) {
+        res.writeHead(404, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "job_not_found" }));
+      }
+      res.writeHead(200, { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", Connection: "keep-alive", ...CORS });
+      const unsubscribe = opsJobs.subscribe(jobId, (job) => {
+        if (!res.writableEnded) res.write(`event: job\ndata: ${JSON.stringify(job)}\n\n`);
+      });
+      req.on("close", unsubscribe);
+      return;
+    }
+
+    if (method === "GET" && reqPath === "/v1/plugins") {
+      return ok(res, { plugins: listPlugins() });
+    }
+
+    if (method === "POST" && reqPath === "/v1/plugins/rescan") {
+      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
+      return ok(res, discoverPlugins());
+    }
+
+    const pluginEnableMatch = reqPath.match(/^\/v1\/plugins\/([^/]+)\/(enable|disable|test|promote)$/);
+    if (method === "POST" && pluginEnableMatch) {
+      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
+      const pluginId = decodeURIComponent(pluginEnableMatch[1]);
+      const op = pluginEnableMatch[2];
+      const result = op === "enable"
+        ? setPluginEnabled(pluginId, true)
+        : op === "disable"
+          ? setPluginEnabled(pluginId, false)
+          : runPluginAction(pluginId, op);
+      res.writeHead(result.error ? 400 : 200, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify(result));
+    }
+
+    if (method === "GET" && reqPath === "/v1/surfaces") {
+      return ok(res, { surfaces: listSurfaces() });
+    }
+
+    const surfaceActionMatch = reqPath.match(/^\/v1\/surfaces\/([^/]+)\/actions$/);
+    if (method === "POST" && surfaceActionMatch) {
+      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
+      let body;
+      try { body = await readBody(req); } catch {
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "Invalid JSON" }));
+      }
+      const result = runSurfaceAction(decodeURIComponent(surfaceActionMatch[1]), body?.action || "reconcile");
+      res.writeHead(result.error ? 400 : 200, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify(result));
+    }
+
+    if (method === "GET" && reqPath === "/v1/routes") {
+      return ok(res, { routes: listRoutes() });
+    }
+
+    if (method === "GET" && reqPath === "/v1/tunnels") {
+      return ok(res, { tunnels: listTunnels() });
+    }
+
+    if (method === "GET" && reqPath === "/v1/logs") {
+      const limit = Number(url.searchParams.get("limit") || 100);
+      const boundedLimit = Number.isFinite(limit) ? Math.max(1, Math.min(limit, 500)) : 100;
+      const state = loadSupervisorState();
+      return ok(res, {
+        schema: "clauth.supervisor.logs.v1",
+        log_path: path.join(getSupervisorDir(), "events.jsonl"),
+        events: readSupervisorEvents(boundedLimit).map(supervisorLogDto),
+        operations: (state.operations || []).slice(0, boundedLimit).map(supervisorOperationDto),
+      });
+    }
+
+    const tunnelRoutesMatch = reqPath.match(/^\/v1\/tunnels\/([^/]+)\/routes$/);
+    if (method === "POST" && tunnelRoutesMatch) {
+      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
+      let body;
+      try { body = await readBody(req); } catch {
+        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "Invalid JSON" }));
+      }
+      return ok(res, addTunnelRoute(decodeURIComponent(tunnelRoutesMatch[1]), body, "localhost"));
+    }
+
+    const tunnelRouteDeleteMatch = reqPath.match(/^\/v1\/tunnels\/([^/]+)\/routes\/([^/]+)$/);
+    if (method === "DELETE" && tunnelRouteDeleteMatch) {
+      if (!hasSupervisorWrite(req)) return rejectSupervisorWrite(res);
+      return ok(res, removeTunnelRoute(decodeURIComponent(tunnelRouteDeleteMatch[1]), decodeURIComponent(tunnelRouteDeleteMatch[2]), "localhost"));
+    }
+
+    if (method === "GET" && reqPath.startsWith("/v1/operations/")) {
+      const id = decodeURIComponent(reqPath.split("/").pop());
+      const operation = (supervisorHealth(), readSupervisorEvents(500)).find((event) => event.operationId === id);
+      res.writeHead(operation ? 200 : 404, { "Content-Type": "application/json", ...CORS });
+      return res.end(JSON.stringify(operation ? supervisorLogDto(operation) : { error: "operation_not_found" }));
+    }
+
+    if (method === "GET" && reqPath === "/v1/events") {
+      res.writeHead(200, {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache",
+        "Connection": "keep-alive",
+        ...CORS,
+      });
+      for (const event of readSupervisorEvents(Number(url.searchParams.get("limit") || 100))) {
+        res.write(`event: supervisor\ndata: ${JSON.stringify(supervisorLogDto(event))}\n\n`);
+      }
+      res.end();
+      return;
+    }
+
     // ── Hosts that bypass OAuth (fresh domains for claude.ai compatibility) ──
     const NOAUTH_HOSTS = ["fs.regendevcorp.com", "clauth.regendevcorp.com", "chitchat.regendevcorp.com"];
     const requestHost = (req.headers.host || "").split(":")[0].toLowerCase();
@@ -4419,6 +4617,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       saveClients(oauthClients);
       const logMsg = `[${new Date().toISOString()}] OAuth: registered public client ${clientId} (${client.client_name})\n`;
       try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
+      operation("oauth.client_register", { client_id: clientId, client_name: client.client_name }, null, { ok: true });
       res.writeHead(201, { "Content-Type": "application/json", "Cache-Control": "no-store", ...CORS });
       return res.end(JSON.stringify(client));
     }
@@ -4542,6 +4741,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
       const logMsg = `[${new Date().toISOString()}] OAuth: token issued for ${stored.client_id} (token=${accessToken.slice(0,8)}…)\n`;
       try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
+      operation("oauth.token_issue", { client_id: stored.client_id }, null, { ok: true });
       res.writeHead(200, { "Content-Type": "application/json", "Cache-Control": "no-store", ...CORS });
       return res.end(JSON.stringify({ access_token: accessToken, token_type: "Bearer", scope: "mcp:tools", expires_in: 86400 }));
     }
@@ -4552,7 +4752,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     function toolsForPath(p) {
       const tools = filterMcpToolsForWriteMode(MCP_TOOLS);
       if (p === "/gws")      return tools.filter(t => t.name.startsWith("gws_"));
-      if (p === "/clauth")   return tools.filter(t => t.name.startsWith("clauth_") || t.name === "tintin_dispatch" || t.name === "call_agent" || t.name.startsWith("terminal_") || t.name.startsWith("channel_") || t.name.startsWith("handoff_"));
+      if (p === "/clauth")   return tools.filter(t => t.name.startsWith("clauth_") || t.name === "call_agent" || t.name.startsWith("terminal_") || t.name.startsWith("channel_") || t.name.startsWith("handoff_"));
       if (p === "/fs")       return tools.filter(t => t.name.startsWith("fs_"));
       if (p === "/chitchat") return tools.filter(t => t.name.startsWith("chitchat_"));
       if (p === "/codevelop") return tools.filter(t => t.name.startsWith("codevelop_"));
@@ -4858,8 +5058,12 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         return res.end(JSON.stringify({ error: "name and path are required" }));
       }
       const result = webdavService.addMount(name.trim(), mountPath.trim());
-      if (result.error) { res.writeHead(409, { "Content-Type": "application/json", ...CORS }); return res.end(JSON.stringify(result)); }
+      if (result.error) {
+        operation("webdav.mount_add", { name: name.trim() }, null, { ok: false, error: result.error });
+        res.writeHead(409, { "Content-Type": "application/json", ...CORS }); return res.end(JSON.stringify(result));
+      }
       webdavService.shutdown();
+      operation("webdav.mount_add", { name: name.trim(), path: mountPath.trim() }, null, { ok: true });
       return ok(res, result);
     }
 
@@ -4867,8 +5071,12 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       if (writeGuard(req, res)) return;
       const mountName = decodeURIComponent(reqPath.slice("/webdav/mounts/".length));
       const result = webdavService.removeMount(mountName);
-      if (result.error) { res.writeHead(404, { "Content-Type": "application/json", ...CORS }); return res.end(JSON.stringify(result)); }
+      if (result.error) {
+        operation("webdav.mount_remove", { name: mountName }, null, { ok: false, error: result.error });
+        res.writeHead(404, { "Content-Type": "application/json", ...CORS }); return res.end(JSON.stringify(result));
+      }
       webdavService.shutdown();
+      operation("webdav.mount_remove", { name: mountName }, null, { ok: true });
       return ok(res, result);
     }
 
@@ -4882,6 +5090,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         return res.end(JSON.stringify({ error: "Invalid JSON" }));
       }
       const result = startCodevelopSession(body || {});
+      operation("codevelop.start", { session_id: result?.session_id }, null, { ok: !result?.error, error: result?.error });
       return ok(res, result);
     }
 
@@ -4893,12 +5102,19 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       }
       const result = joinCodevelopSession(body || {});
       if (result.error) {
+        operation("codevelop.join", { session_id: body?.session_id }, null, { ok: false, error: result.error });
         res.writeHead(result.error === "not_found" ? 404 : 400, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify(result));
       }
+      operation("codevelop.join", { session_id: body?.session_id }, null, { ok: true });
       return ok(res, result);
     }
 
+    // codevelop/send is a genuine mutation (adds a message) but excluded from
+    // per-route logging by design — a live peer-to-peer relay can send at a
+    // frequency that would bloat events.jsonl (same risk noted in the audit-
+    // logging retrofit plan for codevelop/poll). Session lifecycle
+    // (start/join/stop) is logged; message throughput is not.
     if (method === "POST" && reqPath === "/codevelop/send") {
       let body;
       try { body = await readBody(req); } catch {
@@ -4982,9 +5198,11 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       }
       const result = stopCodevelopSession(body?.session_id);
       if (result.error) {
+        operation("codevelop.stop", { session_id: body?.session_id }, null, { ok: false, error: result.error });
         res.writeHead(404, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify(result));
       }
+      operation("codevelop.stop", { session_id: body?.session_id }, null, { ok: true });
       return ok(res, result);
     }
 
@@ -5172,6 +5390,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       saveTokens(oauthTokens);
       const logMsg = `[${new Date().toISOString()}] OAuth: rolled credentials — all clients and tokens invalidated\n`;
       try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
+      operation("oauth.roll_creds", {}, null, { ok: true });
       return ok(res, { clients_cleared: true, tokens_invalidated: true });
     }
 
@@ -5185,10 +5404,12 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       }
       if (body.action === "stop") {
         stopTunnel();
+        operation("tunnel.stop", {}, null, { ok: true });
         return ok(res, { status: tunnelStatus, running: false });
       }
       // start
       await startTunnel();
+      operation("tunnel.start", {}, null, { ok: !!tunnelProc, url: tunnelUrl, error: tunnelError });
       return ok(res, { status: tunnelStatus, running: !!tunnelProc, url: tunnelUrl, error: tunnelError });
     }
 
@@ -5198,6 +5419,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       if (tunnelProc) return ok(res, { status: tunnelStatus, message: "already running" });
       tunnelStatus = "starting";
       startTunnel().catch(() => {});
+      operation("tunnel.start", {}, null, { ok: true, status: "starting" });
       return ok(res, { status: "starting" });
     }
 
@@ -5205,6 +5427,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     if (method === "POST" && reqPath === "/tunnel/stop") {
       if (lockedGuard(res)) return;
       stopTunnel();
+      operation("tunnel.stop", {}, null, { ok: true });
       return ok(res, { status: tunnelStatus });
     }
 
@@ -5224,505 +5447,60 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         const wezExe = wezCandidates.find(existsSync) || "wezterm";
 
         // Render the lua config from the CCandMe template (skip the kill-existing step)
-        const CCANDME_DIR = "C:/Dev/CCandMe";
-        const WORK_DIR = "C:/Dev/regen-root";
-        const templatePath = path.join(CCANDME_DIR, "templates", "wezterm.lua");
-        const luaOutPath  = path.join(CCANDME_DIR, ".ccandme-wezterm.lua");
-
-        if (existsSync(templatePath)) {
-          const lua = readFileSync(templatePath, "utf8")
-            .replaceAll("__SUPERVISOR_DIR__", CCANDME_DIR.replace(/\//g, "\\\\"))
-            .replaceAll("__WORK_DIR__",       WORK_DIR.replace(/\//g, "\\\\"))
-            .replaceAll("__WORKSPACE__",      "ccandme")
-            .replaceAll("__CLAUDE_CMD__",     "claude")
-            .replaceAll("__CODEX_CMD__",      "codex")
-            .replaceAll("__PACKAGE_ROOT__",   CCANDME_DIR.replace(/\//g, "\\\\"));
-          writeFileSync(luaOutPath, lua, "utf8");
-        }
-
-        // Launch WezTerm with the CCandMe config — no kill of existing sessions
-        const luaArg = existsSync(luaOutPath) ? luaOutPath : path.join(CCANDME_DIR, ".ccandme-wezterm.lua");
-        const child = spawn(wezExe, ["--config-file", luaArg, "start"], {
-          detached: true,
-          stdio: "ignore",
-        });
-        child.unref();
-        return ok(res, { ok: true, message: "CCandMe launched" });
-      } catch (err) {
-        res.writeHead(500, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: err.message }));
-      }
-    }
-
-    // POST /restart — spawn fresh process then exit (keeps boot.key, vault stays unlocked)
-    if (method === "POST" && reqPath === "/restart") {
-      ok(res, { ok: true, message: "restarting" });
-      const { spawn } = await import("child_process");
-      const cliEntry = path.resolve(__dirname, "../index.js");
-      const childArgs = [cliEntry, "serve", "start", "--port", String(port)];
-      if (password) childArgs.push("--pw", password);
-      if (whitelist) childArgs.push("--services", whitelist.join(","));
-      if (tunnelHostname) childArgs.push("--tunnel", tunnelHostname);
-      const out = fs.openSync(LOG_FILE, "a");
-      const child = spawn(process.execPath, childArgs, {
-        detached: true,
-        stdio: ["ignore", out, out],
-        env: { ...process.env, __CLAUTH_DAEMON: "1" },
-        windowsHide: true,
-      });
-      child.unref();
-      stopTunnel();
-      removePid();
-      setTimeout(() => process.exit(0), 300);
-      return;
-    }
-
-    // GET /tintin/manifest — app manifest for the TinTin sidebar loader.
-    // GET /monkey/manifest — backward-compat alias.
-    if (method === "GET" && (reqPath === "/tintin/manifest" || reqPath === "/monkey/manifest")) {
-      return ok(res, {
-        schema_version: 1,
-        app: {
-          slug: "clauth-dashboard",
-          name: "clauth Dashboard",
-        },
-        load: {
-          mode: "external-sidebar",
-          requires_compile_in: false,
-          recommended_loader: "chrome-extension-or-tampermonkey",
-          userscript_url: "/tintin/sidebar.user.js",
-        },
-        local_clauth: {
-          base_url: `http://127.0.0.1:${port}`,
-          capabilities_endpoint: "/tintin/capabilities",
-          session_endpoint: "/tintin/sessions",
-          transport: "tintin",
-        },
-        repo: {
-          root_hint: "C:\\Dev\\regen-root",
-          cwd_hint: "C:\\Dev\\regen-root",
-        },
-        capabilities: ["general_chat", "skill_request", "handoff", "dashboard_test"],
-        agent_context: {
-          app: { slug: "clauth-dashboard" },
-          runtime: { requested_by: "clauth-dashboard-monkey" },
-        },
-      });
-    }
-
-    // GET /tintin/sidebar.user.js — shared app-side TinTin sidebar loader.
-    // GET /monkey/sidebar.user.js — backward-compat alias.
-    if (method === "GET" && (reqPath === "/tintin/sidebar.user.js" || reqPath === "/monkey/sidebar.user.js")) {
-      const candidates = [
-        process.env.CLAUTH_MONKEY_SIDEBAR_SCRIPT,
-        "C:\\Dev\\regen-root\\scripts\\monkey-sidebar.user.js",
-        path.resolve(process.cwd(), "..", "regen-root", "scripts", "monkey-sidebar.user.js"),
-      ].filter(Boolean);
-      const scriptPath = candidates.find((candidate) => {
-        try { return fs.existsSync(candidate); } catch { return false; }
-      });
-      if (!scriptPath) {
-        res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "monkey_sidebar_script_not_found" }));
-      }
-      res.writeHead(200, { "Content-Type": "text/javascript; charset=utf-8", "Cache-Control": "no-cache, no-store, must-revalidate", ...CORS });
-      return res.end(fs.readFileSync(scriptPath, "utf8"));
-    }
-
-    // GET /tintin/capabilities — browser-safe local TinTin sidebar capability probe.
-    // GET /monkey/capabilities — backward-compat alias.
-    if (method === "GET" && (reqPath === "/tintin/capabilities" || reqPath === "/monkey/capabilities")) {
-      const access = checkTinTinBrowserAccess(req);
-      if (!access.allowed) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-      }
-      return ok(res, {
-        ok: true,
-        status: password ? "available" : "locked",
-        locked: !password,
-        trust_mode: access.config.trust_mode || "open-local",
-        app: access.app?.slug || null,
-        config: publicTinTinConfig(access.config),
-        transports: ["dispatch", "sse", "polling", "result"],
-        endpoints: {
-          sessions: "/tintin/sessions",
-          events: "/tintin/sessions/:session_id/events",
-          messages: "/tintin/sessions/:session_id/messages",
-          result: "/tintin/messages/:message_id/result",
-        },
-      });
-    }
-
-    // GET /tintin/config — local operator view of the app allowlist/config.
-    // GET /monkey/config — backward-compat alias.
-    if (method === "GET" && (reqPath === "/tintin/config" || reqPath === "/monkey/config")) {
-      const access = checkTinTinBrowserAccess(req);
-      if (!access.allowed) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-      }
-      return ok(res, { ok: true, ...publicTinTinConfig(access.config) });
-    }
-
-    if (method === "GET" && reqPath === "/tintin/settings/ui") {
-      res.writeHead(200, { "Content-Type": "text/html", ...CORS });
-      return res.end(tintinSettingsHtml());
-    }
-
-    if (method === "GET" && (reqPath === "/tintin/settings" || reqPath === "/monkey/settings")) {
-      const config = loadTinTinConfig();
-      return ok(res, { ok: true, ...publicTinTinConfig(config) });
-    }
-
-    if ((method === "PUT" || method === "POST") && (reqPath === "/tintin/settings" || reqPath === "/monkey/settings")) {
-      let body;
-      try { body = await readBody(req); } catch {
-        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: "Invalid JSON body" }));
-      }
-      try {
-        const saved = saveTinTinConfig(body || {});
-        return ok(res, { ok: true, ...publicTinTinConfig(saved) });
-      } catch (err) {
-        res.writeHead(500, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: "settings_save_failed", message: err.message }));
-      }
-    }
-
-    if (method === "POST" && (reqPath === "/tintin/agent-sessions" || reqPath === "/monkey/agent-sessions")) {
-      let body;
-      try { body = await readBody(req); } catch {
-        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: "Invalid JSON body" }));
-      }
-      try {
-        const result = createTinTinAgentSession(body || {});
-        if (!result.ok) {
-          res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-          return res.end(JSON.stringify(result));
-        }
-        return ok(res, result);
-      } catch (err) {
-        res.writeHead(500, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: "agent_session_setup_failed", message: err.message }));
-      }
-    }
-
-    // POST /tintin/sessions — create or attach to a local CLI-backed TinTin session.
-    // POST /monkey/sessions — backward-compat alias.
-    if (method === "POST" && (reqPath === "/tintin/sessions" || reqPath === "/monkey/sessions")) {
-      const access = checkTinTinBrowserAccess(req);
-      if (!access.allowed) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-      }
-      let body;
-      try { body = await readBody(req); } catch {
-        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "Invalid JSON body" }));
-      }
-      const session = createTinTinSession(body || {});
-      pushTinTinEvent(session.id, {
-        source: "clauth",
-        type: "status",
-        content: "session ready",
-        payload: { status: "ready" },
-      });
-      return ok(res, {
-        ok: true,
-        session_id: session.id,
-        status: session.status,
-        agent_context: session.agent_context,
-        last_seq: session.seq,
-      });
-    }
-
-    // GET /tintin/sessions — list in-memory local TinTin sessions.
-    // GET /monkey/sessions — backward-compat alias.
-    if (method === "GET" && (reqPath === "/tintin/sessions" || reqPath === "/monkey/sessions")) {
-      const access = checkTinTinBrowserAccess(req);
-      if (!access.allowed) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-      }
-      return ok(res, {
-        ok: true,
-        sessions: [...tintinSessions.values()].map((session) => ({
-          session_id: session.id,
-          status: session.status,
-          created_at: session.created_at,
-          updated_at: session.updated_at,
-          last_seq: session.seq,
-          agent_context: session.agent_context,
-        })),
-      });
-    }
-
-    const tintinSessionMatch = reqPath.match(/^\/(?:tintin|monkey)\/sessions\/([^/]+)$/);
-    if (method === "GET" && tintinSessionMatch) {
-      const access = checkTinTinBrowserAccess(req);
-      if (!access.allowed) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-      }
-      const sessionId = decodeURIComponent(tintinSessionMatch[1]);
-      const session = getTinTinSession(sessionId);
-      if (!session) {
-        res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "not_found", session_id: sessionId }));
-      }
-      return ok(res, {
-        ok: true,
-        session_id: session.id,
-        status: session.status,
-        created_at: session.created_at,
-        updated_at: session.updated_at,
-        last_seq: session.seq,
-        agent_context: session.agent_context,
-      });
-    }
-
-    const tintinMessagesMatch = reqPath.match(/^\/(?:tintin|monkey)\/sessions\/([^/]+)\/messages$/);
-    if (method === "GET" && tintinMessagesMatch) {
-      const access = checkTinTinBrowserAccess(req);
-      if (!access.allowed) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-      }
-      const sessionId = decodeURIComponent(tintinMessagesMatch[1]);
-      const afterSeq = Number(url.searchParams.get("after_seq") || url.searchParams.get("after") || 0);
-      const events = listTinTinEvents(sessionId, Number.isFinite(afterSeq) ? afterSeq : 0);
-      if (!events) {
-        res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "not_found", session_id: sessionId }));
-      }
-      return ok(res, { ok: true, session_id: sessionId, events });
-    }
-
-    if (method === "POST" && tintinMessagesMatch) {
-      const access = checkTinTinBrowserAccess(req);
-      if (!access.allowed) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-      }
-      if (!password) {
-        res.writeHead(401, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "Vault is locked", locked: true }));
-      }
-      const sessionId = decodeURIComponent(tintinMessagesMatch[1]);
-      let session = getTinTinSession(sessionId);
-      let body;
-      try { body = await readBody(req); } catch {
-        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "Invalid JSON body" }));
-      }
-      if (!session) session = createTinTinSession({ ...(body || {}), session_id: sessionId });
-      const content = String(body?.content || body?.prompt || "").trim();
-      if (!content) {
-        res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "content required" }));
-      }
-
-      const messageId = body.message_id || makeTinTinId("msg");
-      const jobId = body.job_id || messageId;
-      const agentContext = normalizeAgentContext(body.agent_context || {
-        ...session.agent_context,
-        task: {
-          ...(session.agent_context?.task || {}),
-          intent: body.skill ? "skill_request" : "general_chat",
-          thread_id: sessionId,
-        },
-      });
-      pushTinTinEvent(sessionId, {
-        source: "sidebar",
-        type: "message",
-        role: "user",
-        message_id: messageId,
-        job_id: jobId,
-        content,
-        payload: { skill: body.skill || null },
-      });
-
-      const prompt = buildTinTinPrompt({
-        prompt: body.skill ? `Skill: ${body.skill}\n\n${content}` : content,
-        job_id: jobId,
-        agent_context: agentContext,
-      });
-      const dispatchCwd = resolveDispatchCwd(body.cwd || session.cwd, agentContext);
-      const result = spawnClaudeTask(prompt, jobId, dispatchCwd, agentContext);
-      if (result.error) {
-        pushTinTinEvent(sessionId, {
-          source: "clauth",
-          type: "error",
-          role: "assistant",
-          message_id: messageId,
-          job_id: jobId,
-          content: result.message || result.error,
-          payload: { code: result.error, retryable: result.error === "concurrency_limit" },
-        });
-        res.writeHead(503, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify(result));
-      }
-
-      tintinMessageIndex.set(messageId, { session_id: sessionId, job_id: jobId });
-      pushTinTinEvent(sessionId, {
-        source: "clauth",
-        type: "status",
-        role: "assistant",
-        message_id: messageId,
-        job_id: jobId,
-        content: "spawned",
-        payload: result,
-      });
-      startTinTinMessageMonitor(sessionId, messageId, jobId);
-      return ok(res, {
-        ok: true,
-        session_id: sessionId,
-        message_id: messageId,
-        job_id: jobId,
-        status: "spawned",
-        dispatch: result,
-      });
-    }
-
-    const tintinEventsMatch = reqPath.match(/^\/(?:tintin|monkey)\/sessions\/([^/]+)\/events$/);
-    if (method === "GET" && tintinEventsMatch) {
-      const access = checkTinTinBrowserAccess(req);
-      if (!access.allowed) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-      }
-      const sessionId = decodeURIComponent(tintinEventsMatch[1]);
-      const afterSeq = Number(url.searchParams.get("after_seq") || url.searchParams.get("after") || 0);
-      const session = getTinTinSession(sessionId);
-      if (!session) {
-        res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "not_found", session_id: sessionId }));
-      }
-
-      res.writeHead(200, { "Content-Type": "text/event-stream", "Cache-Control": "no-store", "Connection": "keep-alive", ...CORS });
-      const send = (event) => {
-        const eventType = event.type || "message";
-        res.write(`event: ${eventType}\ndata: ${JSON.stringify(event)}\n\n`);
-      };
-      res.write(`event: ready\ndata: ${JSON.stringify({ ok: true, session_id: sessionId, last_seq: session.seq })}\n\n`);
-      for (const event of listTinTinEvents(sessionId, Number.isFinite(afterSeq) ? afterSeq : 0) || []) send(event);
-      const unsubscribe = subscribeTinTinEvents(sessionId, send);
-      const heartbeat = setInterval(() => {
-        try { res.write(`event: heartbeat\ndata: ${JSON.stringify({ session_id: sessionId, at: new Date().toISOString() })}\n\n`); }
-        catch { clearInterval(heartbeat); unsubscribe(); }
-      }, 15000);
-      req.on("close", () => {
-        clearInterval(heartbeat);
-        unsubscribe();
-      });
-      return;
-    }
-
-    const tintinResultMatch = reqPath.match(/^\/(?:tintin|monkey)\/messages\/([^/]+)\/result$/);
-    if (method === "GET" && tintinResultMatch) {
-      const access = checkTinTinBrowserAccess(req);
-      if (!access.allowed) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-      }
-      const messageId = decodeURIComponent(tintinResultMatch[1]);
-      const ref = tintinMessageIndex.get(messageId);
-      if (!ref) {
-        res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "not_found", message_id: messageId }));
-      }
-      const job = tintinJobs.get(ref.job_id);
-      const session = getTinTinSession(ref.session_id);
-      return ok(res, {
-        ok: true,
-        message_id: messageId,
-        session_id: ref.session_id,
-        job_id: ref.job_id,
-        status: job?.status || "unknown",
-        stdout: job?.stdout || "",
-        stderr: job?.stderr || "",
-        events: session?.events.filter((event) => event.message_id === messageId) || [],
-      });
-    }
+        const CCANDME_DIR = "C:/Dev/CCandMe";
+        const WORK_DIR = "C:/Dev/regen-root";
+        const templatePath = path.join(CCANDME_DIR, "templates", "wezterm.lua");
+        const luaOutPath  = path.join(CCANDME_DIR, ".ccandme-wezterm.lua");
 
-    // POST /tintin/dispatch — browser-safe, config-checked CLI worker spawn.
-    // POST /monkey/dispatch, /dispatch, and /monkey-dispatch remain legacy backward-compat aliases.
-    if (method === "POST" && (reqPath === "/tintin/dispatch" || reqPath === "/dispatch" || reqPath === "/monkey-dispatch" || reqPath === "/monkey/dispatch")) {
-      if (reqPath === "/tintin/dispatch" || reqPath === "/monkey/dispatch") {
-        const access = checkTinTinBrowserAccess(req);
-        if (!access.allowed) {
-          res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-          return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-        }
-      } else if (req.headers.origin) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: "legacy_dispatch_rejects_browser_origin", use: "/tintin/dispatch" }));
-      }
-      let body = "";
-      req.on("data", d => body += d);
-      req.on("end", () => {
-        try {
-          const { prompt, job_id, cwd, agent_context } = JSON.parse(body || "{}");
-          if (!prompt && !job_id) {
-            res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-            return res.end(JSON.stringify({ error: "prompt required" }));
-          }
-          const normalizedContext = normalizeAgentContext(agent_context);
-          const wrappedPrompt = buildTinTinPrompt({ prompt, job_id, agent_context: normalizedContext });
-          const dispatchCwd = resolveDispatchCwd(cwd, normalizedContext);
-          const result = spawnClaudeTask(wrappedPrompt, job_id || "untracked", dispatchCwd, normalizedContext);
-          const status = result.error ? 503 : 200;
-          res.writeHead(status, { "Content-Type": "application/json", ...CORS });
-          res.end(JSON.stringify({ ...result, context: normalizedContext }));
-        } catch {
-          res.writeHead(400, { "Content-Type": "application/json", ...CORS });
-          res.end(JSON.stringify({ error: "invalid JSON" }));
+        if (existsSync(templatePath)) {
+          const lua = readFileSync(templatePath, "utf8")
+            .replaceAll("__SUPERVISOR_DIR__", CCANDME_DIR.replace(/\//g, "\\\\"))
+            .replaceAll("__WORK_DIR__",       WORK_DIR.replace(/\//g, "\\\\"))
+            .replaceAll("__WORKSPACE__",      "ccandme")
+            .replaceAll("__CLAUDE_CMD__",     "claude")
+            .replaceAll("__CODEX_CMD__",      "codex")
+            .replaceAll("__PACKAGE_ROOT__",   CCANDME_DIR.replace(/\//g, "\\\\"));
+          writeFileSync(luaOutPath, lua, "utf8");
         }
-      });
-      return;
-    }
 
-    // POST /tintin/dispatch/:jobId/kill — kill a running dispatch job.
-    // POST /monkey/dispatch/:jobId/kill — backward-compat alias.
-    const dispatchKillMatch = reqPath.match(/^\/(?:tintin|monkey)\/dispatch\/([^/]+)\/kill$/);
-    if (method === "POST" && dispatchKillMatch) {
-      const jobId = decodeURIComponent(dispatchKillMatch[1]);
-      const job = tintinJobs.get(jobId);
-      if (!job) {
-        res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: "not_found" }));
-      }
-      if (job.pid && job.status === "running") {
-        try { process.kill(job.pid); } catch {}
-        job.status = "killed";
-        job.completed_at = new Date().toISOString();
+        // Launch WezTerm with the CCandMe config — no kill of existing sessions
+        const luaArg = existsSync(luaOutPath) ? luaOutPath : path.join(CCANDME_DIR, ".ccandme-wezterm.lua");
+        const child = spawn(wezExe, ["--config-file", luaArg, "start"], {
+          detached: true,
+          stdio: "ignore",
+        });
+        child.unref();
+        operation("ccandme.launch", {}, null, { ok: true });
+        return ok(res, { ok: true, message: "CCandMe launched" });
+      } catch (err) {
+        operation("ccandme.launch", {}, null, { ok: false, error: err.message });
+        res.writeHead(500, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: err.message }));
       }
-      res.writeHead(200, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify({ ok: true, status: job.status, jobId }));
     }
 
-    const dispatchStatusMatch = reqPath.match(/^\/(?:tintin|monkey)\/dispatch\/([^/]+)$/) || reqPath.match(/^\/dispatch\/([^/]+)$/);
-    if (method === "GET" && dispatchStatusMatch) {
-      if (reqPath.startsWith("/tintin/dispatch/") || reqPath.startsWith("/monkey/dispatch/")) {
-        const access = checkTinTinBrowserAccess(req);
-        if (!access.allowed) {
-          res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-          return res.end(JSON.stringify({ ok: false, error: access.reason, origin: access.origin || null }));
-        }
-      } else if (req.headers.origin) {
-        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ ok: false, error: "legacy_dispatch_rejects_browser_origin", use: "/tintin/dispatch/:job_id" }));
-      }
-      const jobId = decodeURIComponent(dispatchStatusMatch[1]);
-      const job = tintinJobs.get(jobId);
-      if (!job) {
-        res.writeHead(404, { "Content-Type": "application/json", ...CORS });
-        return res.end(JSON.stringify({ error: "not_found", job_id: jobId }));
-      }
-      res.writeHead(200, { "Content-Type": "application/json", ...CORS });
-      return res.end(JSON.stringify(job));
+    // POST /restart — spawn fresh process then exit (keeps boot.key, vault stays unlocked)
+    if (method === "POST" && reqPath === "/restart") {
+      operation("daemon.restart_requested", { port }, null, { ok: true });
+      ok(res, { ok: true, message: "restarting" });
+      const { spawn } = await import("child_process");
+      const cliEntry = path.resolve(__dirname, "../index.js");
+      const childArgs = [cliEntry, "serve", "start", "--port", String(port)];
+      if (password) childArgs.push("--pw", password);
+      if (whitelist) childArgs.push("--services", whitelist.join(","));
+      if (tunnelHostname) childArgs.push("--tunnel", tunnelHostname);
+      const out = fs.openSync(LOG_FILE, "a");
+      const child = spawn(process.execPath, childArgs, {
+        detached: true,
+        stdio: ["ignore", out, out],
+        env: { ...process.env, __CLAUTH_DAEMON: "1" },
+        windowsHide: true,
+      });
+      child.unref();
+      stopTunnel();
+      removePid();
+      setTimeout(() => process.exit(0), 300);
+      return;
     }
 
     // ── call_agent (Gate B) ───────────────────────────────────────────────────
@@ -5863,6 +5641,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         try {
           const { name } = JSON.parse(body || "{}");
           const result = await startChitchatSession(name || "collab");
+          operation("chitchat.start", { name: name || "collab" }, null, { ok: !result?.error, session_id: result?.session_id, error: result?.error });
           res.writeHead(200, { "Content-Type": "application/json", ...CORS });
           res.end(JSON.stringify(result));
         } catch (e) {
@@ -5873,14 +5652,15 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       return;
     }
 
-    // POST /handoff, /tintin/handoff, and /monkey/handoff — visible local handoff from claude.ai or a sidebar.
-    if (method === "POST" && (reqPath === "/handoff" || reqPath === "/tintin/handoff" || reqPath === "/monkey/handoff")) {
+    // POST /handoff — visible local handoff from claude.ai or a sidebar.
+    if (method === "POST" && reqPath === "/handoff") {
       let body;
       try { body = await readBody(req); } catch {
         res.writeHead(400, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify({ error: "invalid JSON" }));
       }
       const result = await startHandoffSession(body || {});
+      operation("handoff.start", {}, null, { ok: !result.error, error: result.error });
       const status = result.error ? 503 : 200;
       res.writeHead(status, { "Content-Type": "application/json", ...CORS });
       return res.end(JSON.stringify(result));
@@ -5898,6 +5678,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
             return res.end(JSON.stringify({ error: "session_id and message required" }));
           }
           const result = sendChitchatMessage(session_id, message);
+          operation("chitchat.send", { session_id }, null, { ok: !result.error, error: result.error });
           const status = result.error === 'not_found' ? 404 : result.error ? 400 : 200;
           res.writeHead(status, { "Content-Type": "application/json", ...CORS });
           res.end(JSON.stringify(result));
@@ -5922,6 +5703,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           }
           const tier = knowledge_tier || 'db_only';
           const result = startTerminalSession(name, tier, context_md || null);
+          operation("terminal.start", { name, tier }, null, { ok: !result.error, error: result.error });
           const status = result.error ? 503 : 200;
           res.writeHead(status, { "Content-Type": "application/json", ...CORS });
           res.end(JSON.stringify(result));
@@ -5945,6 +5727,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
             return res.end(JSON.stringify({ error: "session_id and message required" }));
           }
           const result = sendTerminalMessage(session_id, message);
+          operation("terminal.send", { session_id }, null, { ok: !result.error, error: result.error });
           const status = result.error === 'session_busy' ? 409 : result.error ? 404 : 200;
           res.writeHead(status, { "Content-Type": "application/json", ...CORS });
           res.end(JSON.stringify(result));
@@ -5998,6 +5781,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
             return res.end(JSON.stringify({ error: "session_id required" }));
           }
           const result = stopTerminalSession(session_id);
+          operation("terminal.stop", { session_id }, null, { ok: !result.error, error: result.error });
           const status = result.error ? 404 : 200;
           res.writeHead(status, { "Content-Type": "application/json", ...CORS });
           res.end(JSON.stringify(result));
@@ -6057,6 +5841,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           channelEvents.push(entry);
           if (channelEvents.length > MAX_CHANNEL_EVENTS) channelEvents.shift();
           console.log(`[channel] queued event ${eventId} type=${event}`);
+          operation("channel.event", { event, resource, repository }, null, { ok: true, event_id: eventId });
           return ok(res, { received: true, event_id: eventId });
         } catch {
           res.writeHead(400, { "Content-Type": "application/json", ...CORS });
@@ -6069,6 +5854,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     // GET|POST /shutdown (for daemon stop — programmatic, keeps boot.key)
     // Accept POST as well — older scripts and curl default to POST
     if ((method === "GET" || method === "POST") && reqPath === "/shutdown") {
+      operation("daemon.shutdown", { port }, null, { ok: true });
       stopTunnel();
       ok(res, { ok: true, message: "shutting down" });
       removePid();
@@ -6078,6 +5864,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
     // POST /shutdown-ui (user-initiated stop — clears boot.key so password is required on restart)
     if (method === "POST" && reqPath === "/shutdown-ui") {
+      operation("daemon.shutdown_ui", { port }, null, { ok: true });
       stopTunnel();
       // Clear boot.key so watchdog can't auto-unlock on restart
       const bootKeyPath = getBootKeyPath();
@@ -6159,10 +5946,12 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       if (promoted) {
         const okLog = `[${new Date().toISOString()}] Make-live: promoted to live on port ${LIVE_PORT}\n`;
         try { fs.appendFileSync(LOG_FILE, okLog); } catch {}
+        operation("daemon.make_live", { from_port: port, live_port: LIVE_PORT }, null, { ok: true });
         ok(res, { ok: true, message: "promoted to live", live_port: LIVE_PORT });
       } else {
         const failLog = `[${new Date().toISOString()}] Make-live: new daemon failed to start on port ${LIVE_PORT}\n`;
         try { fs.appendFileSync(LOG_FILE, failLog); } catch {}
+        operation("daemon.make_live", { from_port: port, live_port: LIVE_PORT }, null, { ok: false, error: "new daemon failed to start" });
         ok(res, { ok: false, error: "New daemon failed to start on live port — check log" });
       }
 
@@ -6416,6 +6205,36 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       }
     }
 
+    // POST /write-token — hand the dashboard a current write token for an
+    // ALREADY-UNLOCKED vault, with no second password prompt.
+    //
+    // A human looking at the dashboard has already passed the lock screen (or
+    // the daemon was auto-unlocked via --pw/boot.key). Making them re-enter the
+    // password to press a button is ceremony, not security: GET / at the route
+    // above already embeds a write token on exactly this condition. This route
+    // just lets the page RENEW it, which GET / could only do on a full reload.
+    //
+    // Why the write token still exists at all: every request reaching this
+    // server is already loopback-only (hard 403 above), but cloudflared proxies
+    // the public tunnel FROM localhost, so a remote request and a local one are
+    // indistinguishable by address. The token is what a page-driven write has
+    // and a blind remote POST does not, so the gate stays; only the prompt goes.
+    //
+    // Mint-or-reuse, mirroring GET /: reusing a still-valid session keeps
+    // multiple open tabs working instead of each one invalidating the last.
+    if (method === "POST" && reqPath === "/write-token") {
+      if (!password) {
+        res.writeHead(403, { "Content-Type": "application/json", ...CORS });
+        return res.end(JSON.stringify({ error: "vault_locked", locked: true }));
+      }
+      if (!writeSession || Date.now() > writeSession.expiresAt) writeSession = makeWriteToken();
+      return ok(res, {
+        ok: true,
+        write_token: writeSession.token,
+        write_expires_at: new Date(writeSession.expiresAt).toISOString(),
+      });
+    }
+
     // POST /auth — unlock the vault with a password (verifies against Edge Function)
     if (method === "POST" && reqPath === "/auth") {
       let body;
@@ -6501,6 +6320,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           tunnelStatus = "starting";
           startTunnel().catch(() => {});
         }
+        operation("vault.unlock", {}, null, { ok: true });
         return ok(res, { ok: true, locked: false, write_token: writeSession.token, write_expires_at: new Date(writeSession.expiresAt).toISOString() });
       } catch (authErr) {
         const msg = authErr.message || "";
@@ -6526,6 +6346,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           // No strike, no hard-lock — the verdict was never rendered.
           const failLog = `[${new Date().toISOString()}] [BACKEND ${backendKind}] vault backend unreachable, no auth strike — ${detail}\n`;
           try { fs.appendFileSync(LOG_FILE, failLog); } catch {}
+          operation("vault.unlock", {}, null, { ok: false, backend_error: true, kind: backendKind });
           res.writeHead(503, { "Content-Type": "application/json", ...CORS });
           return res.end(JSON.stringify({
             error: friendly,
@@ -6550,6 +6371,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           authHardLocked = true;
           const lockLog = `[${new Date().toISOString()}] Server rejected with terminal verdict${reasonSuffix} — hard-locking locally to stop strike accrual; recover via the runbook (unlock machine + re-seal boot.key)\n`;
           try { fs.appendFileSync(LOG_FILE, lockLog); } catch {}
+          operation("vault.unlock", {}, null, { ok: false, terminal: true, reason: serverReason });
           res.writeHead(401, { "Content-Type": "application/json", ...CORS });
           return res.end(JSON.stringify({ error: "Vault rejected credentials — recovery required", reason: serverReason, hard_locked: true, terminal: true }));
         }
@@ -6557,9 +6379,11 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           authHardLocked = true;
           const lockLog = `[${new Date().toISOString()}] Auth failure limit reached — vault hard-locked\n`;
           try { fs.appendFileSync(LOG_FILE, lockLog); } catch {}
+          operation("vault.unlock", {}, null, { ok: false, hard_locked: true, reason: serverReason });
           res.writeHead(401, { "Content-Type": "application/json", ...CORS });
           return res.end(JSON.stringify({ error: "Too many failed attempts — restart daemon to try again", reason: serverReason, hard_locked: true }));
         }
+        operation("vault.unlock", {}, null, { ok: false, reason: serverReason, failures_remaining: authRemaining });
         res.writeHead(401, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify({ error: "Invalid password", reason: serverReason, failures_remaining: authRemaining }));
       }
@@ -6573,6 +6397,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       stopTunnel();
       const logLine = `[${new Date().toISOString()}] Vault locked\n`;
       try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
+      operation("vault.lock", {}, null, { ok: true });
       return ok(res, { ok: true, locked: true, hard_locked: authHardLocked });
     }
 
@@ -6594,10 +6419,15 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       try {
         const { token, timestamp } = deriveToken(password, machineHash);
         const result = await api.updateService(password, machineHash, token, timestamp, service, { name: newName, label: newName });
-        if (result.error) return strike(res, 502, result.error);
+        if (result.error) {
+          operation("service.rename", { service, new_name: newName }, null, { ok: false, error: result.error });
+          return strike(res, 502, result.error);
+        }
         invalidateServiceStatusCache(machineHash);
+        operation("service.rename", { service, new_name: newName }, null, { ok: true });
         return ok(res, { ok: true, old_name: service, new_name: newName });
       } catch (err) {
+        operation("service.rename", { service, new_name: newName }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -6610,10 +6440,15 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       try {
         const { token, timestamp } = deriveToken(password, machineHash);
         const result = await api.removeService(password, machineHash, token, timestamp, service, `CONFIRM REMOVE ${service.toUpperCase()}`);
-        if (result.error) return strike(res, 502, result.error);
+        if (result.error) {
+          operation("service.delete", { service }, null, { ok: false, error: result.error });
+          return strike(res, 502, result.error);
+        }
         invalidateServiceStatusCache(machineHash);
+        operation("service.delete", { service }, null, { ok: true });
         return ok(res, { ok: true, deleted: service });
       } catch (err) {
+        operation("service.delete", { service }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -6639,10 +6474,15 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       try {
         const { token, timestamp } = deriveToken(password, machineHash);
         const result = await api.enable(password, machineHash, token, timestamp, service, enabled);
-        if (result.error) return strike(res, 502, result.error);
+        if (result.error) {
+          operation("service.toggle", { service, enabled }, null, { ok: false, error: result.error });
+          return strike(res, 502, result.error);
+        }
         invalidateServiceStatusCache(machineHash);
+        operation("service.toggle", { service, enabled }, null, { ok: true });
         return ok(res, { ok: true, service, enabled });
       } catch (err) {
+        operation("service.toggle", { service, enabled }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -6729,6 +6569,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         return res.end(JSON.stringify({ error: "Service name required" }));
       }
       const result = await rotationEngine.rotateService(service);
+      operation("service.rotate", { service }, null, { ok: !result?.error, error: result?.error });
       return ok(res, result);
     }
 
@@ -6742,6 +6583,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         return res.end(JSON.stringify({ error: "Invalid JSON body" }));
       }
       rotationEngine.setExpiry(service, body.expires_at, body.rotation_days);
+      operation("service.set_expiry", { service }, null, { ok: true, expires_at: body.expires_at, rotation_days: body.rotation_days });
       return ok(res, { ok: true, service, expires_at: body.expires_at });
     }
 
@@ -6925,8 +6767,10 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           });
         }
 
+        operation("tunnel.setup.cf_token", {}, null, { ok: true, accountId, accountName });
         return ok(res, { ok: true, accountId, accountName });
       } catch (err) {
+        operation("tunnel.setup.cf_token", {}, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -6997,8 +6841,10 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         tunnelHostname = hostname;
         tunnelUrl = `https://${hostname}`;
 
+        operation("tunnel.setup.cf_save", { hostname, tunnelId }, null, { ok: true });
         return ok(res, { ok: true, hostname });
       } catch (err) {
+        operation("tunnel.setup.cf_save", { hostname }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -7078,8 +6924,10 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         tunnelHostname = hostname;
         tunnelUrl = `https://${hostname}`;
 
+        operation("tunnel.setup.cf_create_api", { hostname, tunnelId }, null, { ok: true });
         return ok(res, { ok: true, tunnelId, hostname });
       } catch (err) {
+        operation("tunnel.setup.cf_create_api", { hostname }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -7120,9 +6968,13 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         const proc = spawn("cloudflared", ["tunnel", "login"], { stdio: ["ignore","pipe","pipe"], windowsHide: true });
         proc.stdout.on("data", d => d.toString().split("\n").forEach(l => l.trim() && sendEvt({ line: l })));
         proc.stderr.on("data", d => d.toString().split("\n").forEach(l => l.trim() && sendEvt({ line: l })));
-        proc.on("close", code => { sendEvt({ done: true, code }); res.end(); });
+        proc.on("close", code => {
+          operation("tunnel.setup.cf_login", {}, null, { ok: code === 0, exit_code: code });
+          sendEvt({ done: true, code }); res.end();
+        });
         req.on("close", () => { try { proc.kill(); } catch {} });
       } catch (err) {
+        operation("tunnel.setup.cf_login", {}, null, { ok: false, error: err.message });
         sendEvt({ done: true, code: 1, error: err.message });
         res.end();
       }
@@ -7194,9 +7046,11 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         tunnelHostname = hostname;
         tunnelUrl = `https://${hostname}`;
 
+        operation("tunnel.setup.cf_create", { name, hostname, tunnelId }, null, { ok: true });
         sendEvt({ done: true, tunnelId, hostname });
         res.end();
       } catch (err) {
+        operation("tunnel.setup.cf_create", { name, hostname }, null, { ok: false, error: err.message });
         sendEvt({ error: err.message, done: true });
         res.end();
       }
@@ -7228,8 +7082,10 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
         writeSession = makeWriteToken();
         const logLine = `[${new Date().toISOString()}] Password changed\n`;
         try { fs.appendFileSync(LOG_FILE, logLine); } catch {}
+        operation("vault.change_password", {}, null, { ok: true });
         return ok(res, { ok: true, write_token: writeSession.token, write_expires_at: new Date(writeSession.expiresAt).toISOString() });
       } catch (err) {
+        operation("vault.change_password", {}, null, { ok: false, error: err.message });
         res.writeHead(502, { "Content-Type": "application/json", ...CORS });
         return res.end(JSON.stringify({ error: err.message }));
       }
@@ -7257,11 +7113,17 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       }
 
       try {
+        // NEVER log `value` — it is the secret being written.
         const { result, snapshot, normalized } = await writeCredentialWithRecovery({ password, machineHash, service, value, logFile: LOG_FILE });
-        if (result.error) return strike(res, 502, result.error);
+        if (result.error) {
+          operation("service.set", { service }, null, { ok: false, error: result.error });
+          return strike(res, 502, result.error);
+        }
         invalidateServiceStatusCache(machineHash);
+        operation("service.set", { service }, null, { ok: true, normalized });
         return ok(res, { ok: true, service, recovery_snapshot: snapshot?.ok ? true : false, normalized });
       } catch (err) {
+        operation("service.set", { service }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -7290,11 +7152,17 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       try {
         const randomHex = crypto.randomBytes(32).toString("hex");
         const token = `${prefix}${randomHex}`;
+        // NEVER log `token` — it is the secret being generated/stored.
         const { result, snapshot } = await writeCredentialWithRecovery({ password, machineHash, service, value: token, logFile: LOG_FILE, normalize: false });
-        if (result.error) return strike(res, 502, result.error);
+        if (result.error) {
+          operation("service.generate_token", { service }, null, { ok: false, error: result.error });
+          return strike(res, 502, result.error);
+        }
         invalidateServiceStatusCache(machineHash);
+        operation("service.generate_token", { service }, null, { ok: true });
         return ok(res, { token, service, stored: true, recovery_snapshot: snapshot?.ok ? true : false });
       } catch (err) {
+        operation("service.generate_token", { service }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -7324,10 +7192,15 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       try {
         const { token, timestamp } = deriveToken(password, machineHash);
         const result = await api.addService(password, machineHash, token, timestamp, name.trim().toLowerCase(), label || name.trim(), type, description || "", project || undefined);
-        if (result.error) return strike(res, 502, result.error);
+        if (result.error) {
+          operation("service.add", { name: name.trim().toLowerCase() }, null, { ok: false, error: result.error });
+          return strike(res, 502, result.error);
+        }
         invalidateServiceStatusCache(machineHash);
+        operation("service.add", { name: name.trim().toLowerCase() }, null, { ok: true, key_type: type });
         return ok(res, { ok: true, service: name.trim().toLowerCase() });
       } catch (err) {
+        operation("service.add", { name: name.trim().toLowerCase() }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -7361,10 +7234,15 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       try {
         const { token, timestamp } = deriveToken(password, machineHash);
         const result = await api.updateService(password, machineHash, token, timestamp, service.toLowerCase(), updates);
-        if (result.error) return strike(res, 502, result.error);
+        if (result.error) {
+          operation("service.update", { name: service.toLowerCase() }, null, { ok: false, error: result.error });
+          return strike(res, 502, result.error);
+        }
         invalidateServiceStatusCache(machineHash);
+        operation("service.update", { name: service.toLowerCase() }, null, { ok: true, fields: Object.keys(updates) });
         return ok(res, { ok: true, service: service.toLowerCase(), ...updates });
       } catch (err) {
+        operation("service.update", { name: service.toLowerCase() }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -7415,11 +7293,16 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       try {
         const { token, timestamp } = deriveToken(password, machineHash);
         const result = await api.createEnrollment(password, machineHash, token, timestamp, label, ttlMinutes);
-        if (result.error) return strike(res, 502, result.error);
+        if (result.error) {
+          operation("machine.enroll", { label, target }, null, { ok: false, error: result.error });
+          return strike(res, 502, result.error);
+        }
         const localConfig = new Conf(getConfOptions());
         const supabaseUrl = localConfig.get("supabase_url") || process.env.CLAUTH_SUPABASE_URL || "";
         const anonKey = localConfig.get("supabase_anon_key") || process.env.CLAUTH_SUPABASE_ANON_KEY || "";
+        // NEVER log `enrollment_code` — it is a one-time credential.
         const scriptPath = writeEnrollmentScript({ supabaseUrl, anonKey, enrollmentCode: result.enrollment_code, label, target });
+        operation("machine.enroll", { label, target }, null, { ok: true, expires_at: result.expires_at });
         return ok(res, {
           ok: true,
           enrollment_code: result.enrollment_code,
@@ -7427,6 +7310,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           script_path: scriptPath,
         });
       } catch (err) {
+        operation("machine.enroll", { label, target }, null, { ok: false, error: err.message });
         return strike(res, 502, err.message);
       }
     }
@@ -7465,6 +7349,27 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     });
   }
 
+  // The localhost supervisor is the only process allowed to repair clauth-owned
+  // local surfaces. Keep this loop out of the vault/staged instances and make
+  // the cadence configurable for deterministic tests.
+  if (port === getSupervisorPort() && process.env.CLAUTH_SUPERVISOR_HEALTH_RECONCILE !== "0") {
+    const configuredInterval = Number(process.env.CLAUTH_SUPERVISOR_HEALTH_INTERVAL_MS || 10000);
+    const intervalMs = Number.isFinite(configuredInterval) ? Math.max(1000, Math.min(configuredInterval, 300000)) : 10000;
+    let healthReconcileInFlight = false;
+    const runHealthReconcile = () => {
+      if (healthReconcileInFlight) return;
+      healthReconcileInFlight = true;
+      reconcileSurfaceHealth().catch((err) => {
+        try { fs.appendFileSync(LOG_FILE, `[${new Date().toISOString()}] supervisor health reconcile failed: ${err.message}\n`); } catch {}
+      }).finally(() => { healthReconcileInFlight = false; });
+    };
+    const healthTimer = setInterval(runHealthReconcile, intervalMs);
+    healthTimer.unref?.();
+    server.__supervisorHealthTimer = healthTimer;
+    server.on("close", () => clearInterval(healthTimer));
+    setImmediate(runHealthReconcile);
+  }
+
   return server;
 }
 
@@ -7480,6 +7385,61 @@ async function verifyAuth(password) {
   }
 }
 
+async function supervisorResponds(port = getSupervisorPort()) {
+  try {
+    const resp = await fetch(`http://127.0.0.1:${port}/health`);
+    return resp.ok;
+  } catch {
+    return false;
+  }
+}
+
+async function ensureSupervisorStarted(cliEntry) {
+  const port = getSupervisorPort();
+  const existing = readSupervisorPid();
+  if (existing && isProcessAlive(existing.pid) && await supervisorResponds(existing.port)) {
+    return { started: false, pid: existing.pid, port: existing.port, state: "already_running" };
+  }
+  if (existing && !isProcessAlive(existing.pid)) removeSupervisorPid();
+  if (await supervisorResponds(port)) {
+    return { started: false, pid: existing?.pid || null, port, state: "port_already_live" };
+  }
+
+  const out = fs.openSync(LOG_FILE, "a");
+  const child = spawn(process.execPath, [cliEntry, "serve", "supervisor", "--port", String(port)], {
+    detached: true,
+    stdio: ["ignore", out, out],
+    env: { ...process.env, __CLAUTH_SUPERVISOR_DAEMON: "1" },
+  });
+  child.unref();
+  writeSupervisorPid(child.pid, port);
+
+  for (let attempt = 0; attempt < 5; attempt++) {
+    await new Promise(r => setTimeout(r, 500));
+    if (await supervisorResponds(port)) {
+      return { started: true, pid: child.pid, port, state: "started" };
+    }
+  }
+  return { started: true, pid: child.pid, port, state: "start_unverified" };
+}
+
+async function stopSupervisorSibling() {
+  const info = readSupervisorPid();
+  if (!info) return null;
+  if (!isProcessAlive(info.pid)) {
+    removeSupervisorPid();
+    return { stopped: false, pid: info.pid, port: info.port, state: "stale" };
+  }
+  try {
+    process.kill(info.pid, "SIGTERM");
+    await new Promise(r => setTimeout(r, 300));
+    removeSupervisorPid();
+    return { stopped: true, pid: info.pid, port: info.port, state: "stopped" };
+  } catch (err) {
+    return { stopped: false, pid: info.pid, port: info.port, state: "stop_failed", error: err.message };
+  }
+}
+
 async function actionStart(opts) {
   if (opts.isolated) {
     return actionForeground(opts);
@@ -7681,6 +7641,11 @@ async function actionStart(opts) {
     console.log(chalk.gray(`  Port:     127.0.0.1:${info.port}`));
     console.log(chalk.gray(`  Services: ${whitelist ? whitelist.join(", ") : "all"}`));
     console.log(chalk.gray(`  Log:      ${LOG_FILE}`));
+    if (!isStaged) {
+      const supervisor = await ensureSupervisorStarted(cliEntry);
+      const verb = supervisor.started ? "started" : "available";
+      console.log(chalk.gray(`  Supervisor: ${verb} on 127.0.0.1:${supervisor.port}${supervisor.pid ? ` (PID ${supervisor.pid})` : ""}`));
+    }
     if (isStaged) {
       console.log(chalk.yellow(`\n  ⚡ Staged on port ${port} — open dashboard to verify, then click "Make Live"`));
     } else if (!password) {
@@ -7698,6 +7663,7 @@ async function actionStart(opts) {
 async function actionStop() {
   const info = readPid();
   if (!info) {
+    await stopSupervisorSibling();
     console.log(chalk.yellow("\n  No clauth serve PID file found — not running.\n"));
     return;
   }
@@ -7705,6 +7671,7 @@ async function actionStop() {
   if (!isProcessAlive(info.pid)) {
     console.log(chalk.yellow(`\n  PID ${info.pid} is not running (stale PID file). Cleaning up.\n`));
     removePid();
+    await stopSupervisorSibling();
     return;
   }
 
@@ -7715,6 +7682,7 @@ async function actionStop() {
       await new Promise(r => setTimeout(r, 300));
       console.log(chalk.green(`\n  🛑 clauth serve stopped (was PID ${info.pid}, port ${info.port})\n`));
       removePid();
+      await stopSupervisorSibling();
       return;
     }
   } catch {}
@@ -7728,6 +7696,7 @@ async function actionStop() {
     console.log(chalk.yellow(`\n  Could not kill PID ${info.pid}: ${err.message}\n`));
   }
   removePid();
+  await stopSupervisorSibling();
 }
 
 async function actionPing() {
@@ -7772,7 +7741,9 @@ async function actionRestart(opts) {
 async function actionForeground(opts) {
   const port      = parseInt(opts.port || "52437", 10);
   const isolated  = !!opts.isolated;
-  const password  = isolated ? null : (opts.pw || null);
+  const containerPassword = process.env.CLAUTH_MASTER_PASSWORD || process.env["clauth-master-password"] || null;
+  const password  = isolated ? null : (opts.pw || containerPassword);
+  const bindHost  = process.env.CLAUTH_BIND_HOST || "127.0.0.1";
   const tunnelHostname = opts.tunnel || null;
   const whitelist = opts.services
     ? opts.services.split(",").map(s => s.trim().toLowerCase())
@@ -7798,14 +7769,40 @@ async function actionForeground(opts) {
     console.log(chalk.yellow("\n  Starting in locked state — open browser to unlock"));
   }
 
-  console.log(chalk.gray(`  Port:     127.0.0.1:${port}`));
+  console.log(chalk.gray(`  Port:     ${bindHost}:${port}`));
   console.log(chalk.gray(`  Services: ${whitelist ? whitelist.join(", ") : "all"}`));
   console.log(chalk.gray(`  Lockout:  3 failures → exit\n`));
 
+  // Plugin discovery previously only ran under `serve supervisor` or an
+  // on-demand rescan — normal `serve start`/`foreground` boot never ran it,
+  // so a stale/never-discovered plugin list could sit unnoticed until
+  // someone happened to hit rescan. Discovery touching disk must never be
+  // allowed to crash daemon boot, hence the try/catch.
+  let discoveryResult = null;
+  let discoveryError = null;
+  try {
+    discoveryResult = discoverPlugins();
+  } catch (err) {
+    discoveryError = err;
+    console.log(chalk.yellow(`  ⚠ plugin discovery failed at boot: ${err.message}`));
+  }
+
   const server = createServer(password, whitelist, port, tunnelHostname);
-  server.listen(port, "127.0.0.1", () => {
+  server.listen(port, bindHost, () => {
     if (!isolated) writePid(process.pid, port);
-    console.log(chalk.green(`  clauth serve → http://127.0.0.1:${port}`));
+    try {
+      operation("daemon.started", { port, isolated }, null, { ok: true, version: VERSION }, "system");
+      operation(
+        "daemon.plugin_discovery",
+        { port },
+        null,
+        discoveryError
+          ? { ok: false, error: discoveryError.message }
+          : { ok: true, plugin_count: (discoveryResult?.plugins || discoveryResult || []).length },
+        "system",
+      );
+    } catch { /* startup logging must never block the daemon from serving */ }
+    console.log(chalk.green(`  clauth serve → http://${bindHost}:${port}`));
     if (tunnelHostname) {
       console.log(chalk.cyan(`  Tunnel:   https://${tunnelHostname}/sse`));
       console.log("");
@@ -7845,7 +7842,7 @@ async function actionForeground(opts) {
 import { createInterface } from "readline";
 import { execSync, spawn as spawnProc, spawnSync } from "child_process";
 
-// ── TinTin dispatch (formerly Monkey) — headless Claude CLI worker ───
+// ── Shared headless Claude CLI worker helpers (used by call-agent, terminal, codevelop) ───
 function findClaudeBinary() {
   const candidates = [
     process.env.CLAUDE_BIN,
@@ -8336,7 +8333,7 @@ async function runCallAgent(args = {}) {
   const persistMeta = { prompt, skill_slug: args.skill_slug, model, agent_context: args.agent_context };
 
   if (mode === "async") {
-    const jobId = makeTinTinId("call");
+    const jobId = `call-${crypto.randomUUID()}`;
     // Persist the queued row FIRST so the { jobId } we return is recoverable
     // even if the daemon restarts before the worker settles.
     await persistCallAgentDispatch({ jobId, ...persistMeta });
@@ -8360,307 +8357,6 @@ async function runCallAgent(args = {}) {
   return { ok: true, package: rec.package, jobId: rec.jobId, model: rec.model, ms: rec.ms };
 }
 
-const tintinJobs = new Map();
-const MAX_TINTIN_JOBS = 100;
-const tintinSessions = new Map();
-const tintinMessageIndex = new Map();
-const tintinEventStreams = new Map();
-const tintinMessageMonitors = new Map();
-const MAX_TINTIN_SESSION_EVENTS = 500;
-
-function normalizeAgentContext(input = {}) {
-  const context = input && typeof input === "object" ? input : {};
-  const app = context.app && typeof context.app === "object" ? context.app : {};
-  const repo = context.repo && typeof context.repo === "object" ? context.repo : {};
-  const runtime = context.runtime && typeof context.runtime === "object" ? context.runtime : {};
-  const task = context.task && typeof context.task === "object" ? context.task : {};
-
-  return {
-    app: {
-      slug: String(app.slug || context.app_slug || "unknown-app"),
-      route: String(app.route || context.route || "/"),
-      origin: String(app.origin || context.origin || "unknown-origin"),
-    },
-    repo: {
-      root: String(repo.root || context.repo_root || ""),
-      cwd: String(repo.cwd || context.cwd || ""),
-    },
-    runtime: {
-      agent: String(runtime.agent || context.agent || "clauth-cli"),
-      requested_by: String(runtime.requested_by || context.requested_by || "tintin"),
-    },
-    task: {
-      intent: String(task.intent || context.intent || "tintin-dispatch"),
-      thread_id: task.thread_id || context.thread_id || null,
-    },
-  };
-}
-
-function makeTinTinId(prefix) {
-  return `${prefix}-${Date.now()}-${crypto.randomBytes(4).toString("hex")}`;
-}
-
-function createTinTinSession(input = {}) {
-  const sessionId = input.session_id || input.thread_id || makeTinTinId("ms");
-  const agentContext = normalizeAgentContext(input.agent_context || {
-    app: {
-      slug: input.app_id || input.app_slug || "unknown-app",
-      route: input.route || "/",
-      origin: input.origin || "unknown-origin",
-    },
-    repo: {
-      root: input.repo_root || "",
-      cwd: input.cwd || "",
-    },
-    runtime: {
-      agent: "clauth-cli",
-      requested_by: "tintin-sidebar",
-    },
-    task: {
-      intent: input.intent || "general_chat",
-      thread_id: sessionId,
-    },
-  });
-  const existing = tintinSessions.get(sessionId);
-  if (existing) {
-    existing.agent_context = agentContext;
-    existing.updated_at = new Date().toISOString();
-    tintinSessions.set(sessionId, existing);
-    return existing;
-  }
-  const session = {
-    id: sessionId,
-    status: "ready",
-    created_at: new Date().toISOString(),
-    updated_at: new Date().toISOString(),
-    seq: 0,
-    agent_context: agentContext,
-    cwd: input.cwd || agentContext.repo.cwd || agentContext.repo.root || "",
-    events: [],
-  };
-  tintinSessions.set(sessionId, session);
-  return session;
-}
-
-function getTinTinSession(sessionId) {
-  return tintinSessions.get(sessionId);
-}
-
-function pushTinTinEvent(sessionId, event) {
-  const session = getTinTinSession(sessionId);
-  if (!session) return null;
-  session.seq += 1;
-  session.updated_at = new Date().toISOString();
-  const fullEvent = {
-    id: event.id || makeTinTinId("mev"),
-    session_id: sessionId,
-    seq: session.seq,
-    source: event.source || "clauth",
-    type: event.type || "status",
-    role: event.role,
-    message_id: event.message_id,
-    job_id: event.job_id,
-    content: event.content,
-    payload: event.payload || {},
-    created_at: new Date().toISOString(),
-  };
-  session.events.push(fullEvent);
-  session.events = session.events.slice(-MAX_TINTIN_SESSION_EVENTS);
-  tintinSessions.set(sessionId, session);
-  const streams = tintinEventStreams.get(sessionId);
-  if (streams) {
-    for (const send of [...streams]) {
-      try {
-        send(fullEvent);
-      } catch {
-        streams.delete(send);
-      }
-    }
-  }
-  return fullEvent;
-}
-
-function listTinTinEvents(sessionId, afterSeq = 0) {
-  const session = getTinTinSession(sessionId);
-  if (!session) return null;
-  return session.events.filter((event) => event.seq > afterSeq);
-}
-
-function subscribeTinTinEvents(sessionId, send) {
-  const streams = tintinEventStreams.get(sessionId) || new Set();
-  streams.add(send);
-  tintinEventStreams.set(sessionId, streams);
-  return () => {
-    const current = tintinEventStreams.get(sessionId);
-    if (!current) return;
-    current.delete(send);
-    if (current.size === 0) tintinEventStreams.delete(sessionId);
-  };
-}
-
-function startTinTinMessageMonitor(sessionId, messageId, jobId) {
-  const key = `${sessionId}:${messageId}`;
-  if (tintinMessageMonitors.has(key)) return;
-  let lastStdoutLength = 0;
-  const timer = setInterval(() => {
-    const job = tintinJobs.get(jobId);
-    if (!job) return;
-    const stdout = job.stdout || "";
-    if (stdout.length > lastStdoutLength) {
-      const chunk = stdout.slice(lastStdoutLength);
-      lastStdoutLength = stdout.length;
-      pushTinTinEvent(sessionId, {
-        source: "claude",
-        type: "delta",
-        role: "assistant",
-        message_id: messageId,
-        job_id: jobId,
-        content: chunk,
-      });
-    }
-    if (job.status !== "running") {
-      clearInterval(timer);
-      tintinMessageMonitors.delete(key);
-      pushTinTinEvent(sessionId, {
-        source: "clauth",
-        type: job.status === "completed" ? "done" : "error",
-        role: "assistant",
-        message_id: messageId,
-        job_id: jobId,
-        content: job.status === "completed" ? "" : (job.stderr || job.stdout || "TinTin worker failed"),
-        payload: {
-          status: job.status,
-          exit_code: job.exit_code,
-          completed_at: job.completed_at,
-        },
-      });
-    }
-  }, 500);
-  tintinMessageMonitors.set(key, timer);
-}
-
-function resolveDispatchCwd(requestedCwd, agentContext = {}) {
-  const raw = requestedCwd || agentContext?.repo?.cwd || agentContext?.repo?.root || CHITCHAT_FALLBACK_CWD;
-  if (!raw || typeof raw !== "string") return CHITCHAT_FALLBACK_CWD;
-  const resolved = path.resolve(raw);
-  try {
-    const st = fs.statSync(resolved);
-    if (!st.isDirectory()) return CHITCHAT_FALLBACK_CWD;
-    return resolved;
-  } catch {
-    return CHITCHAT_FALLBACK_CWD;
-  }
-}
-
-function buildTinTinPrompt({ prompt, job_id, agent_context }) {
-  const normalized = normalizeAgentContext(agent_context);
-  const jobInstruction = job_id
-    ? [
-        `TinTin job id: ${job_id}`,
-        "If the prompt does not contain all job details, use clauth at http://127.0.0.1:52437 to fetch exact credentials and query the app database/API directly.",
-        "Do not assume agent MCP/plugin tools are available to this spawned CLI process.",
-      ].join("\n")
-    : "";
-
-  const body = prompt || [
-    "Process this TinTin job using the provided agent context.",
-    jobInstruction,
-    "Find the job payload from the consuming app's declared data path before making changes.",
-  ].filter(Boolean).join("\n\n");
-
-  return [
-    "You are a clauth-spawned TinTin CLI agent (model: claude-sonnet-4-6).",
-    "Agent context setup follows. Treat it as the runtime contract for this task.",
-    "```json",
-    JSON.stringify(normalized, null, 2),
-    "```",
-    "",
-    "Execution rules:",
-    "- You are a local CLI process, not the parent agent runtime.",
-    "- You do not inherit Codex/Claude MCP or plugin tools.",
-    "- Use clauth HTTP, direct HTTP APIs, repo files, or app endpoints for access.",
-    "- Keep results tied to the supplied app, route, cwd, thread, and job id.",
-    "",
-    jobInstruction,
-    "",
-    body,
-  ].filter(Boolean).join("\n");
-}
-
-function spawnClaudeTask(prompt, jobId, cwd, agentContext) {
-  if (activeCliWorkers >= MAX_CLI_WORKERS) {
-    return { error: 'concurrency_limit', message: `Max ${MAX_CLI_WORKERS} CLI workers active` };
-  }
-  const binary = findClaudeBinary();
-  if (!binary) {
-    return { error: 'binary_not_found', message: 'claude CLI not found in PATH or AppData/npm' };
-  }
-
-  const resolvedCwd = resolveDispatchCwd(cwd, agentContext);
-  activeCliWorkers++;
-  const startedAtIso = new Date().toISOString();
-  tintinJobs.set(jobId, {
-    jobId,
-    status: "running",
-    cwd: resolvedCwd,
-    pid: null,
-    started_at: startedAtIso,
-    completed_at: null,
-    exit_code: null,
-    stdout: "",
-    stderr: "",
-    context: normalizeAgentContext(agentContext),
-  });
-  while (tintinJobs.size > MAX_TINTIN_JOBS) {
-    const firstKey = tintinJobs.keys().next().value;
-    tintinJobs.delete(firstKey);
-  }
-  const isCmdShim = process.platform === "win32" && /\.cmd$/i.test(binary);
-  const command = isCmdShim ? "cmd" : binary;
-  const args = isCmdShim
-    ? ["/d", "/s", "/c", `"${binary}"`, "-p", prompt, "--dangerously-skip-permissions"]
-    : ["-p", prompt, "--dangerously-skip-permissions"];
-  const proc = spawnProc(command, args, {
-    cwd: resolvedCwd,
-    env: process.env,
-    stdio: ['ignore', 'pipe', 'pipe'],
-    shell: false,
-    windowsHide: true,
-  });
-
-  const tracked = tintinJobs.get(jobId);
-  if (tracked) {
-    tracked.pid = proc.pid;
-    tintinJobs.set(jobId, tracked);
-  }
-
-  const startedAt = Date.now();
-  proc.stdout?.on("data", (chunk) => {
-    const trackedJob = tintinJobs.get(jobId);
-    if (!trackedJob) return;
-    trackedJob.stdout = `${trackedJob.stdout}${chunk.toString()}`.slice(-20000);
-    tintinJobs.set(jobId, trackedJob);
-  });
-  proc.stderr?.on("data", (chunk) => {
-    const trackedJob = tintinJobs.get(jobId);
-    if (!trackedJob) return;
-    trackedJob.stderr = `${trackedJob.stderr}${chunk.toString()}`.slice(-20000);
-    tintinJobs.set(jobId, trackedJob);
-  });
-  proc.on('close', (code) => {
-    activeCliWorkers--;
-    const trackedJob = tintinJobs.get(jobId);
-    if (trackedJob) {
-      trackedJob.status = code === 0 ? "completed" : "failed";
-      trackedJob.exit_code = code;
-      trackedJob.completed_at = new Date().toISOString();
-      tintinJobs.set(jobId, trackedJob);
-    }
-    console.log(`[tintin] job ${jobId} exited code=${code} in ${Date.now() - startedAt}ms`);
-  });
-
-  return { status: 'spawned', pid: proc.pid, jobId, cwd: resolvedCwd, activeWorkers: activeCliWorkers };
-}
 
 // ── Terminal session manager ─────────────────────────────────────
 // Rolling-context approach: each session stores a context string.
@@ -8678,7 +8374,7 @@ function generateSessionId() {
 }
 
 function defaultTerminalCwd() {
-  const dir = process.env.CLAUTH_TERMINAL_CWD || path.join(os.tmpdir(), "clauth-tintin-terminal");
+  const dir = process.env.CLAUTH_TERMINAL_CWD || path.join(os.tmpdir(), "clauth-terminal");
   try {
     fs.mkdirSync(dir, { recursive: true });
   } catch {
@@ -8712,7 +8408,7 @@ function startTerminalSession(name, knowledge_tier, context_md, cwd, use_warm =
   };
 
   // Try to acquire a warm worker only when explicitly requested. The warm pool
-  // is optimized for call_agent one-shots; TinTin browser chat needs reliable
+  // is optimized for call_agent one-shots; a terminal session needs reliable
   // repeated turns more than experimental low-latency pinning.
   if (use_warm) {
     try {
@@ -8920,12 +8616,12 @@ function showTerminalSession(session_id) {
 
   if (process.platform === "win32") {
     try {
-      const title = `TinTin ${session.name || session_id}`;
+      const title = `clauth terminal ${session.name || session_id}`;
       const lines = [
         `$Host.UI.RawUI.WindowTitle = ${JSON.stringify(title)}`,
         `Set-Location -LiteralPath ${JSON.stringify(session.cwd || os.homedir())}`,
         "Clear-Host",
-        `Write-Host ${JSON.stringify(`TinTin session ${session_id}`)} -ForegroundColor Cyan`,
+        `Write-Host ${JSON.stringify(`clauth terminal session ${session_id}`)} -ForegroundColor Cyan`,
         `Write-Host ${JSON.stringify(`Name: ${session.name || ""}`)}`,
         `Write-Host ${JSON.stringify(`Status: ${session.status}`)}`,
         `Write-Host ${JSON.stringify(`CWD: ${session.cwd || ""}`)}`,
@@ -9894,7 +9590,7 @@ function isAllowedGitImportPath(p, allowedPrefixes = FS_GIT_IMPORT_ALLOWED_PREFI
   return allowedPrefixes.some((prefix) => p === prefix.replace(/\/$/, "") || p.startsWith(prefix));
 }
 
-const MCP_TOOLS = [
+export const MCP_TOOLS = [
   {
     name: "clauth_ping",
     description: "Check if the vault is locked or unlocked, show failure count",
@@ -10044,7 +9740,7 @@ const MCP_TOOLS = [
   },
   {
     name: "call_agent",
-    description: "Call a headless Haiku agent for a single prompt or skill and get the answer back. Lean one-shot through a warm pool (model default claude-haiku-4-5, ~4-5s warm). sync mode (default) blocks and returns { ok, package, jobId, model, ms }; async returns { ok, jobId } for polling. Use this for call-and-return — not tintin_dispatch (which is fire-and-poll).",
+    description: "Call a headless Haiku agent for a single prompt or skill and get the answer back. Lean one-shot through a warm pool (model default claude-haiku-4-5, ~4-5s warm). sync mode (default) blocks and returns { ok, package, jobId, model, ms }; async returns { ok, jobId } for polling.",
     inputSchema: {
       type: "object",
       properties: {
@@ -10085,24 +9781,6 @@ const MCP_TOOLS = [
       additionalProperties: false,
     },
   },
-  {
-    name: "tintin_dispatch", // formerly monkey_dispatch
-    description: "Dispatch a TinTin job to a headless Claude Code CLI worker with an app/repo/runtime/task agent_context envelope. Max 2 concurrent workers.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        prompt: { type: "string", description: "Full prompt for the CLI worker to execute. Optional when job_id is supplied." },
-        job_id: { type: "string", description: "tintin job UUID or app job id for tracking" },
-        cwd: { type: "string", description: "Existing local directory where the CLI worker should run" },
-        agent_context: {
-          type: "object",
-          description: "App-neutral context envelope with app, repo, runtime, and task fields",
-          additionalProperties: true,
-        },
-      },
-      additionalProperties: false,
-    },
-  },
   {
     name: "handoff_start",
     description: "Start a visible local Claude Code handoff session from a /handoff command and return immediately with session metadata.",
@@ -10154,7 +9832,7 @@ const MCP_TOOLS = [
   },
   {
     name: "terminal_show",
-    description: "Reveal/focus a TinTin terminal session on this Windows machine. If no live Claude process window exists, opens a visible session inspector at the session cwd.",
+    description: "Reveal/focus a clauth terminal session on this Windows machine. If no live Claude process window exists, opens a visible session inspector at the session cwd.",
     inputSchema: {
       type: "object",
       properties: {
@@ -10882,6 +10560,41 @@ const MCP_TOOLS = [
       additionalProperties: false,
     },
   },
+  {
+    name: "clauth_ops_catalog",
+    description: "Return the Vultr deployment-control API catalog. Availability is still decided on Vultr.",
+    inputSchema: { type: "object", properties: {}, additionalProperties: false },
+  },
+  {
+    name: "clauth_ops_processes",
+    description: "Submit a scoped PM2 process-status query to the Vultr control plane. Only server-approved applications are returned.",
+    inputSchema: { type: "object", properties: {}, additionalProperties: false },
+  },
+  {
+    name: "clauth_ops_describe",
+    description: "Submit a scoped PM2 status query for one server-approved application.",
+    inputSchema: { type: "object", properties: { application: { type: "string" } }, required: ["application"], additionalProperties: false },
+  },
+  {
+    name: "clauth_ops_deploy",
+    description: "Submit one manifest-scoped development deployment to Vultr. The server chooses the repository, build, PM2 process, and allowed ref.",
+    inputSchema: { type: "object", properties: { application: { type: "string" }, ref: { type: "string" } }, required: ["application"], additionalProperties: false },
+  },
+  {
+    name: "clauth_ops_promote",
+    description: "Submit one server-allowlisted Coolify promotion and return its asynchronous job receipt.",
+    inputSchema: { type: "object", properties: { application_uuid: { type: "string" } }, required: ["application_uuid"], additionalProperties: false },
+  },
+  {
+    name: "clauth_ops_job",
+    description: "Read the terminal or in-progress receipt for a deployment-control job.",
+    inputSchema: { type: "object", properties: { job_id: { type: "string" } }, required: ["job_id"], additionalProperties: false },
+  },
+  {
+    name: "clauth_ops_run",
+    description: "Submit one PM2 operation through the Vultr control plane. The remote agent/admin profile decides whether the operation and target are available.",
+    inputSchema: { type: "object", properties: { operation: { type: "string" }, input: { type: "object" } }, required: ["operation"], additionalProperties: false },
+  },
 ];
 
 const MCP_WRITE_TOOL_NAMES = new Set([
@@ -10889,6 +10602,9 @@ const MCP_WRITE_TOOL_NAMES = new Set([
   "clauth_disable",
   "clauth_set_project",
   "clauth_generate_token",
+  "clauth_ops_deploy",
+  "clauth_ops_promote",
+  "clauth_ops_run",
 ]);
 
 function filterMcpToolsForWriteMode(tools) {
@@ -10922,6 +10638,24 @@ function mcpError(text) {
   return { content: [{ type: "text", text }], isError: true };
 }
 
+async function callOpsFromMcp(vault, method, requestPath, body, { write = false } = {}) {
+  if (write && !vault.writeEnabled) return mcpError("MCP write tools are disabled by default. Launch clauth with CLAUTH_MCP_WRITE=1 for an explicit write-capable session.");
+  if (!vault.password) return mcpError("Vault is locked — call clauth_unlock first");
+    const endpoint = process.env.CLAUTH_OPS_APPROVED_ORIGIN;
+    if (!endpoint) return mcpError("service_not_available");
+  try {
+    const url = new URL(endpoint);
+    if (url.protocol !== "https:") return mcpError("service_not_available");
+    const service = process.env.CLAUTH_OPS_TOKEN_SERVICE || "vultr-ops-api-token";
+    const credential = await vaultRetrieveValue(vault, service);
+    if (credential.error || !credential.value) return mcpError("service_not_available");
+    const payload = await requestOps({ endpoint: url.toString().replace(/\/$/, ""), token: String(credential.value), method, path: requestPath, body });
+    return mcpResult(JSON.stringify(payload, null, 2));
+  } catch {
+    return mcpError("service_not_available");
+  }
+}
+
 // Windows cmd.exe doesn't support single quotes — use bash for gws JSON args
 const GWS_EXEC_OPTS = { encoding: "utf8", timeout: 30000, windowsHide: true, shell: os.platform() === "win32" ? "bash" : undefined };
 
@@ -10932,6 +10666,13 @@ async function handleMcpTool(vault, name, args) {
   };
 
   switch (name) {
+    case "clauth_ops_catalog": return callOpsFromMcp(vault, "GET", "/v1/ops/catalog");
+    case "clauth_ops_processes": return callOpsFromMcp(vault, "GET", "/v1/ops/processes");
+    case "clauth_ops_describe": return callOpsFromMcp(vault, "GET", `/v1/ops/processes/${encodeURIComponent(args.application || "")}`);
+    case "clauth_ops_deploy": return callOpsFromMcp(vault, "POST", "/v1/ops/deployments", { application: args.application, ...(args.ref ? { ref: args.ref } : {}) }, { write: true });
+    case "clauth_ops_promote": return callOpsFromMcp(vault, "POST", "/v1/ops/promotions", { application_uuid: args.application_uuid }, { write: true });
+    case "clauth_ops_job": return callOpsFromMcp(vault, "GET", `/v1/ops/jobs/${encodeURIComponent(args.job_id || "")}`);
+    case "clauth_ops_run": return callOpsFromMcp(vault, "POST", "/v1/ops/operations", { operation: args.operation, input: args.input && typeof args.input === "object" ? args.input : {} }, { write: true });
     case "clauth_ping": {
       return mcpResult(
         vault.password
@@ -11997,19 +11738,6 @@ async function handleMcpTool(vault, name, args) {
       return mcpResult(JSON.stringify(result));
     }
 
-    case "tintin_dispatch": // formerly monkey_dispatch
-    case "monkey_dispatch": {
-      const { prompt, job_id, cwd: requestedCwd, agent_context } = args;
-      if (!prompt && !job_id) return mcpError("prompt required");
-      const fallbackCwd = await resolveChitchatRoot(vault);
-      const normalizedContext = normalizeAgentContext(agent_context);
-      const dispatchCwd = resolveDispatchCwd(requestedCwd || fallbackCwd, normalizedContext);
-      const wrappedPrompt = buildTinTinPrompt({ prompt, job_id, agent_context: normalizedContext });
-      const result = spawnClaudeTask(wrappedPrompt, job_id || "untracked", dispatchCwd, normalizedContext);
-      if (result.error) return mcpError(`${result.error}: ${result.message}`);
-      return mcpResult(JSON.stringify({ ...result, context: normalizedContext }));
-    }
-
     case "handoff_start": {
       const result = await startHandoffSession(args || {}, vault);
       if (result.error) return mcpError(`${result.error}: ${result.message}`);
@@ -13132,6 +12860,14 @@ async function actionUpgrade(opts) {
   return actionStart(opts);
 }
 
+async function actionSupervisor(opts) {
+  opts.isolated = true;
+  opts.port = String(opts.port || getSupervisorPort());
+  // discoverPlugins() now runs unconditionally inside actionForeground at
+  // every boot — calling it here too would double-run discovery.
+  return actionForeground(opts);
+}
+
 export async function runServe(opts) {
   const action = opts.action || "foreground";
 
@@ -13142,12 +12878,13 @@ export async function runServe(opts) {
     case "ping":       return actionPing();
     case "foreground": return actionForeground(opts);
     case "mcp":        return actionMcp(opts);
+    case "supervisor": return actionSupervisor(opts);
     case "install":    return actionInstall(opts);
     case "uninstall":  return actionUninstall();
     case "upgrade":    return actionUpgrade(opts);
     default:
       console.log(chalk.red(`\n  Unknown serve action: ${action}`));
-      console.log(chalk.gray("  Actions: start | stop | restart | ping | foreground | mcp | install | uninstall | upgrade\n"));
+      console.log(chalk.gray("  Actions: start | stop | restart | ping | foreground | mcp | supervisor | install | uninstall | upgrade\n"));
       process.exit(1);
   }
 }