@maintainer-pro/ai-bridge 0.1.15 → 0.1.18

package/src/daemon.mjs

@@ -23,8 +23,20 @@ import {
   lookupShareResponse,
   prepareShareHttpRequest,
   processShareHttpResponse,
+  rewriteMappedLocalUrls,
+  rewriteShareRequestBody,
+  shareServiceWorkerScript,
+  shareShimScript,
+  shareTokenRoot,
   shouldProcessShareResponse,
+  shouldRewriteBody,
 } from "./share-rewrite.mjs";
+import {
+  canonicalActionCode,
+  isDiscardedTunnelUrl,
+  leftoverStateKeys,
+  LEGACY_TUNNEL_FILE,
+} from "./discarded-tunnels.mjs";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PACKAGE_VERSION = readPackageVersion();
@@ -74,6 +86,34 @@ function shortId(value) {
   return text.length > 12 ? `${text.slice(0, 8)}…` : text;
 }
 
+function sameFolder(a, b) {
+  const na = path.resolve(String(a || ""));
+  const nb = path.resolve(String(b || ""));
+  if (process.platform === "win32") return na.toLowerCase() === nb.toLowerCase();
+  return na === nb;
+}
+
+function workspaceFolders(ws) {
+  const primary = String(ws?.folderPath || "").trim();
+  const extra = Array.isArray(ws?.extraFolders) ? ws.extraFolders : [];
+  const out = [];
+  const seen = new Set();
+  for (const raw of [primary, ...extra]) {
+    if (!raw || typeof raw !== "string") continue;
+    const resolved = path.resolve(raw);
+    const key = process.platform === "win32" ? resolved.toLowerCase() : resolved;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(resolved);
+  }
+  return out;
+}
+
+function folderForApp(ws, app) {
+  if (app?.folderPath) return path.resolve(String(app.folderPath));
+  return path.resolve(ws?.folderPath || "");
+}
+
 function actionLabel(action) {
   const sandbox = action.sandboxId || action.payload?.sandboxId;
   const folder = action.payload?.folderPath;
@@ -358,7 +398,8 @@ async function detectCliProviders() {
 }
 
 async function resolveWorkspaceHostApps(ws, opts = {}) {
-  const folder = path.resolve(ws.folderPath || "");
+  const folders = workspaceFolders(ws);
+  const folder = folders[0] || path.resolve(ws.folderPath || "");
   const label = ws.sandboxName || shortId(ws.sandboxId) || "sandbox";
   const desired = Array.isArray(opts.desired)
     ? opts.desired
@@ -373,10 +414,11 @@ async function resolveWorkspaceHostApps(ws, opts = {}) {
     activity(
       ws.sandboxId,
       "info",
-      `detecting ports for ${label} in ${folder} (env first${opts.force ? ", redetect" : ""})`
+      `detecting ports for ${label} in ${folders.join(", ") || folder} (env first${opts.force ? ", redetect" : ""})`
     );
     const result = await cli.resolveHostApps({
       workspaceDir: folder,
+      workspaceDirs: folders,
       appName: ws.applicationName || ws.sandboxName,
       preferredAiPort: Number(ws.port) || 3100,
       desired: opts.ignoreDesired ? [] : desired,
@@ -385,10 +427,12 @@ async function resolveWorkspaceHostApps(ws, opts = {}) {
       sandboxId: ws.sandboxId,
     });
     const previous = Array.isArray(ws.hostApps) ? ws.hostApps : [];
+    if (opts.unionDetected && previous.length && typeof cli.unionHostApps === "function") {
+      result.apps = cli.unionHostApps(previous, result.apps);
+    }
     result.apps = result.apps.map((app) => {
       const match = previous.find((row) => row && row.id === app.id);
-      if (!match || (app.envMaps && app.envMaps.length)) return app;
-      return { ...app, envMaps: match.envMaps || [] };
+      return match ? { ...app, host: match.host === true || app.host === true } : app;
     });
     ws.hostApps = result.apps;
     if (opts.cfg) persistWorkspaceEntry(opts.cfg, ws);
@@ -489,6 +533,14 @@ function projectFingerprint(folder) {
     "next.config.js",
     "next.config.mjs",
     "next.config.ts",
+    "pom.xml",
+    "build.gradle",
+    "build.gradle.kts",
+    "build.sbt",
+    "src/main/resources/application.yml",
+    "src/main/resources/application.properties",
+    "src/main/resources/application.conf",
+    "conf/application.conf",
   ]) {
     const file = path.join(resolved, rel);
     if (!fs.existsSync(file)) continue;
@@ -819,6 +871,67 @@ function probeUrl(url, timeoutMs = 2500) {
   });
 }
 
+/** Some Windows apps bind `localhost` (::1) but refuse `127.0.0.1`. */
+const LOOPBACK_HOSTS = ["127.0.0.1", "localhost"];
+/** @type {Map<number, string>} */
+const loopbackHostByPort = new Map();
+
+function isLoopbackConnError(err) {
+  const code = err && typeof err === "object" ? String(err.code || "") : "";
+  return (
+    code === "ECONNREFUSED" ||
+    code === "EHOSTUNREACH" ||
+    code === "EADDRNOTAVAIL" ||
+    code === "ENOTFOUND" ||
+    code === "ETIMEDOUT"
+  );
+}
+
+function loopbackHostsForPort(port) {
+  const cached = loopbackHostByPort.get(Number(port));
+  if (cached === "localhost") return ["localhost", "127.0.0.1"];
+  return LOOPBACK_HOSTS;
+}
+
+function rememberLoopbackHost(port, host) {
+  const n = Number(port);
+  const name = String(host || "").trim();
+  if (n && (name === "127.0.0.1" || name === "localhost")) {
+    loopbackHostByPort.set(n, name);
+  }
+}
+
+function loopbackUrlVariants(url) {
+  try {
+    const parsed = new URL(String(url));
+    const host = String(parsed.hostname || "").toLowerCase();
+    if (host !== "localhost" && host !== "127.0.0.1") return [String(url)];
+    const port = parsed.port || (parsed.protocol === "https:" ? "443" : "80");
+    return loopbackHostsForPort(port).map((name) => {
+      const next = new URL(parsed);
+      next.hostname = name;
+      return next.toString();
+    });
+  } catch {
+    return [String(url)];
+  }
+}
+
+async function probeLoopbackUrl(url, timeoutMs = 2500) {
+  for (const candidate of loopbackUrlVariants(url)) {
+    if (await probeUrl(candidate, timeoutMs)) {
+      try {
+        const parsed = new URL(candidate);
+        rememberLoopbackHost(parsed.port, parsed.hostname);
+      } catch {
+        /* ignore */
+      }
+      return true;
+    }
+  }
+  return false;
+}
+
 function adminListenPort(cfg = bridgeCfg) {
   try {
     const u = new URL(String(cfg?.adminUrl || "http://localhost:4100"));
@@ -1027,9 +1140,8 @@ function mergeEnvFile(file, values, opts = {}) {
 }
 
 /**
- * Do not write Maintainer Pro keys into the app. The bridge injects env into
- * the process it launches (terminal script / in-process chat).
- * Only strip leftover trycloudflare values we previously wrote.
+ * Do not write Maintainer Pro keys or share URLs into the app.
+ * Only strip leftover tunnel URLs we previously wrote.
  */
 function writeProjectEnv(folder, _values, opts = {}) {
   const remove = (opts.remove || []).filter(Boolean);
@@ -1061,37 +1173,9 @@ function readProjectEnvValues(folder) {
   return map;
 }
 
-function isTryCloudflareUrl(value) {
-  try {
-    return new URL(String(value || "").trim()).hostname.endsWith(
-      ".trycloudflare.com"
-    );
-  } catch {
-    return false;
-  }
-}
-
-function readCloudflareTunnelFile(folder) {
-  if (!folder) return null;
-  const file = path.join(path.resolve(folder), ".cloudflare-tunnel-url");
-  if (!fs.existsSync(file)) return null;
-  /** @type {Record<string, string>} */
-  const tunnels = {};
-  for (const raw of fs.readFileSync(file, "utf8").split(/\r?\n/)) {
-    const line = raw.trim();
-    if (!line || line.startsWith("#")) continue;
-    const eq = line.indexOf("=");
-    if (eq < 1) continue;
-    const role = line.slice(0, eq).trim();
-    const url = line.slice(eq + 1).trim().replace(/\/$/, "");
-    if (role && isTryCloudflareUrl(url)) tunnels[role] = url;
-  }
-  return Object.keys(tunnels).length ? tunnels : null;
-}
-
-function clearCloudflareTunnelFile(folder) {
+function clearLegacyTunnelFile(folder) {
   if (!folder) return;
-  const file = path.join(path.resolve(folder), ".cloudflare-tunnel-url");
+  const file = path.join(path.resolve(folder), LEGACY_TUNNEL_FILE);
   try {
     if (fs.existsSync(file)) fs.unlinkSync(file);
   } catch {
@@ -1099,8 +1183,7 @@ function clearCloudflareTunnelFile(folder) {
   }
 }
 
-/** Stop rediscovering dead trycloudflare URLs from old cloudflared logs. */
-function archiveStaleCloudflareLogs(folder, sandboxId) {
+function archiveLegacyTunnelLogs(folder, sandboxId) {
   if (!folder) return;
   const logDir = dataDirFor(folder, sandboxId);
   if (!fs.existsSync(logDir)) return;
@@ -1123,185 +1206,25 @@ function archiveStaleCloudflareLogs(folder, sandboxId) {
   }
 }
 
-const CLOUDFLARE_ENV_KEYS = [
-  "APP_URL",
-  "PUBLIC_URL",
-  "CORS_ORIGIN",
-  "CORS_ORIGINS",
-  "NEXT_PUBLIC_APP_URL",
-  "VITE_APP_URL",
-  "REACT_APP_APP_URL",
-  "AI_SERVER_URL",
-  "NEXT_PUBLIC_AI_SERVER_URL",
-  "VITE_AI_SERVER_URL",
-  "REACT_APP_AI_SERVER_URL",
-  "API_URL",
-  "API_BASE_URL",
-  "VITE_API_URL",
-  "VITE_API_BASE_URL",
-  "NEXT_PUBLIC_API_URL",
-  "NEXT_PUBLIC_API_BASE_URL",
-  "BACKEND_URL",
-];
-
-/**
- * Remove dead trycloudflare URLs from workspace state, tunnel file, env, and
- * archived logs so heartbeats stop re-probing them.
- */
-function purgeUnreachableCloudflare(ws, cfg, opts = {}) {
+/** Drop leftover tunnel state so heartbeats never revive old public URLs. */
+function stripDiscardedTunnelState(ws, cfg) {
   const folder = ws.folderPath ? path.resolve(ws.folderPath) : null;
-  const label = ws.sandboxName || shortId(ws.sandboxId) || "sandbox";
-  const deadUrls = (opts.deadUrls || [])
-    .map((u) => String(u || "").replace(/\/$/, ""))
-    .filter((u) => isTryCloudflareUrl(u));
-  const keep = opts.keep && typeof opts.keep === "object" ? opts.keep : null;
-
-  if (deadUrls.length) {
-    log(
-      `clearing stale Cloudflare for ${label}: ${deadUrls.join(", ")}`
+  const leftoverKeys = leftoverStateKeys(ws);
+  const had = leftoverKeys.length > 0 || isDiscardedTunnelUrl(ws.appUrl);
+  for (const key of leftoverKeys) delete ws[key];
+  if (isDiscardedTunnelUrl(ws.appUrl)) ws.appUrl = null;
+
+  if (folder && fs.existsSync(folder)) {
+    archiveLegacyTunnelLogs(folder, ws.sandboxId);
+    clearLegacyTunnelFile(folder);
+    const current = readProjectEnvValues(folder);
+    const remove = Object.keys(current).filter((key) =>
+      isDiscardedTunnelUrl(current[key])
     );
-  } else {
-    log(`clearing stale Cloudflare for ${label}`);
-  }
-
-  ws.cloudflareUrl = null;
-  ws.cloudflare = keep && Object.keys(keep).length ? { ...keep } : null;
-  if (keep?.ui || keep?.ai) {
-    ws.cloudflareUrl = keep.ui || keep.ai;
-    ws.appUrl = keep.ui || keep.ai;
-  } else if (ws.appUrl && !isLocalAppUrl(ws.appUrl)) {
-    ws.appUrl = null;
-  }
-
-  if (ws.sandboxId && !(keep && Object.keys(keep).length)) {
-    cloudflareTunnels.delete(ws.sandboxId);
-  }
-
-  if (!folder || !fs.existsSync(folder)) {
-    persistWorkspaceEntry(cfg, ws);
-    return;
-  }
-
-  // Always archive cf-*.log so dead trycloudflare hosts are not rediscovered.
-  archiveStaleCloudflareLogs(folder, ws.sandboxId);
-  if (keep && Object.keys(keep).length) {
-    writeTunnelEnv(ws, keep);
-  } else {
-    clearCloudflareTunnelFile(folder);
-  }
-
-  const current = readProjectEnvValues(folder);
-  /** @type {string[]} */
-  const remove = [];
-  for (const key of CLOUDFLARE_ENV_KEYS) {
-    const value = current[key];
-    if (!isTryCloudflareUrl(value)) continue;
-    const normalized = String(value).replace(/\/$/, "");
-    if (keep && Object.values(keep).some((u) => String(u).replace(/\/$/, "") === normalized)) {
-      continue;
-    }
-    remove.push(key);
-  }
-  if (remove.length) {
-    writeProjectEnv(folder, {}, { remove });
-  }
-
-  persistWorkspaceEntry(cfg, ws);
-}
-
-function parseAllTryCloudflareUrls(text) {
-  const matches = [
-    ...String(text || "").matchAll(
-      /https:\/\/[a-z0-9-]+\.trycloudflare\.com/gi
-    ),
-  ];
-  return matches.map((m) => m[0].replace(/\/$/, ""));
-}
-
-function lastTryCloudflareUrl(text) {
-  const all = parseAllTryCloudflareUrls(text);
-  return all.length ? all[all.length - 1] : null;
-}
-
-/**
- * Discover Cloudflare tunnel URLs from bridge state, tunnel file, project env,
- * and cloudflared log files — even if this bridge process did not start them.
- * @returns {Record<string, string> | null}
- */
-function discoverCloudflareTunnels(ws) {
-  if (!ws?.folderPath) return null;
-  const folder = path.resolve(ws.folderPath);
-  /** @type {Record<string, string>} */
-  const tunnels = {};
-  const setRole = (role, value) => {
-    if (!role || tunnels[role] || !isTryCloudflareUrl(value)) return;
-    tunnels[role] = String(value).replace(/\/$/, "");
-  };
-
-  if (ws.cloudflare && typeof ws.cloudflare === "object") {
-    for (const [role, value] of Object.entries(ws.cloudflare)) {
-      setRole(role, value);
-    }
+    if (remove.length) writeProjectEnv(folder, {}, { remove });
   }
-  if (ws.cloudflareUrl) setRole("ui", ws.cloudflareUrl);
-
-  const fromFile = readCloudflareTunnelFile(folder);
-  if (fromFile) {
-    for (const [role, value] of Object.entries(fromFile)) setRole(role, value);
-  }
-
-  const env = readProjectEnvValues(folder);
-  const envRoles = [
-    ["ai", env.NEXT_PUBLIC_AI_SERVER_URL],
-    ["ai", env.VITE_AI_SERVER_URL],
-    ["ai", env.AI_SERVER_URL],
-    ["ai", env.REACT_APP_AI_SERVER_URL],
-    ["ui", env.NEXT_PUBLIC_APP_URL],
-    ["ui", env.VITE_APP_URL],
-    ["ui", env.APP_URL],
-    ["ui", env.PUBLIC_URL],
-    ["backend", env.NEXT_PUBLIC_API_URL],
-    ["backend", env.VITE_API_URL],
-    ["backend", env.API_URL],
-  ];
-  for (const [role, value] of envRoles) setRole(role, value);
 
-  const logDir = dataDirFor(folder, ws.sandboxId);
-  if (fs.existsSync(logDir)) {
-    const sandboxPrefix = `cf-${String(ws.sandboxId || "").slice(0, 8)}-`;
-    let names = [];
-    try {
-      names = fs.readdirSync(logDir);
-    } catch {
-      names = [];
-    }
-    // Prefer sandbox-scoped logs, then any cf-*-role.log in the project.
-    const ranked = names
-      .filter((name) => /^cf-.*\.log$/i.test(name) && !name.endsWith(".stale"))
-      .sort((a, b) => {
-        const aScore = a.startsWith(sandboxPrefix) ? 0 : 1;
-        const bScore = b.startsWith(sandboxPrefix) ? 0 : 1;
-        return aScore - bScore || a.localeCompare(b);
-      });
-    for (const name of ranked) {
-      const roleMatch = name.match(
-        /cf-(?:[a-f0-9]{6,}-)?(ai|ui|backend|app)\.log$/i
-      );
-      if (!roleMatch) continue;
-      let role = roleMatch[1].toLowerCase();
-      if (role === "app") role = "ui";
-      if (tunnels[role]) continue;
-      try {
-        const text = fs.readFileSync(path.join(logDir, name), "utf8");
-        const url = lastTryCloudflareUrl(text);
-        if (url) setRole(role, url);
-      } catch {
-        /* ignore unreadable logs */
-      }
-    }
-  }
-
-  return Object.keys(tunnels).length ? tunnels : null;
+  if (had) persistWorkspaceEntry(cfg, ws);
 }
 
 function workspaceHostReport(ws) {
@@ -1326,7 +1249,7 @@ function workspaceHostReport(ws) {
     env.NEXT_PUBLIC_AI_SERVER_URL,
     ws.appUrl,
   ]) {
-    if (!value || isTryCloudflareUrl(value)) continue;
+    if (!value || isDiscardedTunnelUrl(value)) continue;
     add(value);
   }
   if (chatPort) {
@@ -1360,7 +1283,7 @@ function workspaceHostReport(ws) {
 /**
  * Status-only reconcile for a workspace:
  * 1) probe chat / ui / backend
- * 2) drop leftover trycloudflare URLs (never start or reuse tunnels)
+ * 2) drop leftover tunnel URLs
  * 3) compute host appUrl + CORS origins for Maintainer Pro
  *
  * Does not start apps. Does not write the app's .env files.
@@ -1375,19 +1298,8 @@ async function reconcileWorkspacePresence(ws, cfg, opts = {}) {
     ws.port = probe.chatPort;
   }
 
-  // 2. Remove leftover Cloudflare tunnels / env — share URLs replace them.
-  const leftover = discoverCloudflareTunnels(ws);
-  if (leftover || ws.cloudflareUrl || ws.cloudflare) {
-    purgeUnreachableCloudflare(ws, cfg, {
-      deadUrls: leftover ? Object.values(leftover) : [],
-      keep: null,
-    });
-    try {
-      await stopCloudflare(ws.sandboxId, ws.folderPath);
-    } catch {
-      /* leftover cloudflared */
-    }
-  }
+  // 2. Remove leftover tunnel URLs / env — share URLs replace them.
+  stripDiscardedTunnelState(ws, cfg);
 
   // 3. Host + CORS origins for Maintainer Pro
   const host = workspaceHostReport(ws);
@@ -1445,8 +1357,6 @@ async function reconcileWorkspacePresence(ws, cfg, opts = {}) {
 
   return {
     probe,
-    usingCloudflare: false,
-    cloudflare: null,
     host,
     appsRunning: probe.running,
     aiServerUp: probe.chatUp,
@@ -1467,18 +1377,28 @@ async function probeHttpPaths(port, paths, timeoutMs = 2500) {
 function probePortOpen(port, timeoutMs = 800) {
   const n = Number(port);
   if (!n) return Promise.resolve(false);
-  return new Promise((resolve) => {
-    const socket = net.connect({ host: "127.0.0.1", port: n });
-    const done = (ok) => {
-      socket.removeAllListeners();
-      socket.destroy();
-      resolve(ok);
-    };
-    socket.setTimeout(timeoutMs);
-    socket.once("connect", () => done(true));
-    socket.once("timeout", () => done(false));
-    socket.once("error", () => done(false));
-  });
+  const tryHost = (host) =>
+    new Promise((resolve) => {
+      const socket = net.connect({ host, port: n });
+      const done = (ok) => {
+        socket.removeAllListeners();
+        socket.destroy();
+        resolve(ok);
+      };
+      socket.setTimeout(timeoutMs);
+      socket.once("connect", () => done(true));
+      socket.once("timeout", () => done(false));
+      socket.once("error", () => done(false));
+    });
+  return (async () => {
+    for (const host of loopbackHostsForPort(n)) {
+      if (await tryHost(host)) {
+        rememberLoopbackHost(n, host);
+        return true;
+      }
+    }
+    return false;
+  })();
 }
 
 async function portIsLive(port, timeoutMs = 1200) {
@@ -1567,28 +1487,71 @@ function proxySlugForApp(app) {
   return id || "app";
 }
 
+function uniqueProxySlugs(apps) {
+  const used = new Set();
+  /** @type {Record<string, string>} */
+  const slugs = {};
+  for (const app of apps || []) {
+    let slug = proxySlugForApp(app);
+    if (!slug || !app?.id) continue;
+    if (used.has(slug)) {
+      const fromId = String(app.id)
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9_-]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+      slug =
+        fromId && !used.has(fromId)
+          ? fromId
+          : `${slug}-${Number(app.port) || used.size}`;
+    }
+    used.add(slug);
+    slugs[app.id] = slug;
+  }
+  return slugs;
+}
+
+function sharePortUrls(ws) {
+  const apps = Array.isArray(ws?.hostApps) ? ws.hostApps : [];
+  /** @type {Record<string, string>} */
+  const out = {};
+  for (const app of apps) {
+    const port = Number(app.port);
+    if (!port) continue;
+    const url = proxyUrlForApp(ws, app);
+    if (url) out[String(port)] = url.replace(/\/$/, "");
+  }
+  return out;
+}
+
 function applyAssignedProxy(ws, remote, cfg) {
   const proxy =
     remote?.proxy && typeof remote.proxy === "object" ? remote.proxy : null;
   if (!proxy?.token) return;
   const origin = String(proxy.origin || cfg?.adminUrl || "").replace(/\/$/, "");
-  const slugs =
+  const assigned =
     proxy.slugs && typeof proxy.slugs === "object" ? proxy.slugs : {};
+  const unique = uniqueProxySlugs(appsFrom(ws, remote));
+  /** @type {Record<string, string>} */
+  const slugs = {};
   /** @type {Record<string, string>} */
   const urls = {};
-  const apps = Array.isArray(ws.hostApps)
-    ? ws.hostApps
-    : Array.isArray(remote.hostApps)
-      ? remote.hostApps
-      : [];
+  const apps = appsFrom(ws, remote);
   for (const app of apps) {
-    const slug = slugs[app.id] || proxySlugForApp(app);
+    const slug = assigned[app.id] || unique[app.id] || proxySlugForApp(app);
     if (!slug || !origin) continue;
+    slugs[app.id] = slug;
     urls[app.id] = `${origin}/p/${proxy.token}/${slug}`;
   }
   ws.proxy = { origin, token: String(proxy.token), slugs, urls };
 }
 
+function appsFrom(ws, remote) {
+  if (Array.isArray(ws?.hostApps) && ws.hostApps.length) return ws.hostApps;
+  if (Array.isArray(remote?.hostApps)) return remote.hostApps;
+  return [];
+}
+
 function proxyUrlForApp(ws, app) {
   if (!usesBridgeProxy(app)) return "";
   const urls =
@@ -1605,24 +1568,17 @@ function proxyUrlForApp(ws, app) {
   return `${origin}/p/${token}/${slug}`;
 }
 
-function tunnelRoleForApp(app) {
-  if (!app) return "app";
-  if (app.role === "ai-server") return "ai";
-  if (app.host === true || app.role === "ui" || app.role === "app") return "ui";
-  if (isBackendApp(app)) return "backend";
-  if (app.role === "custom") return "app";
-  return app.role;
-}
-
-function jobsFromHostApps(ws) {
+function jobsFromHostApps(ws, filter = {}) {
   const apps = Array.isArray(ws.hostApps) ? ws.hostApps : [];
   const hostId = hostAppOf(ws)?.id;
   return apps
     .filter((app) => app && app.role !== "ai-server")
+    .filter((app) => (filter.appId ? app.id === filter.appId : true))
     .map((app) => {
       const port = Number(app.port) || 3000;
       const command = String(app.startCommand || "").trim();
-      const script = command.replace(/^npm\s+run\s+/, "") || "dev";
+      const script = command.replace(/^npm\s+run\s+/, "") || command || "dev";
+      const folder = folderForApp(ws, app);
       return {
         role: isBackendApp(app)
           ? "backend"
@@ -1636,6 +1592,7 @@ function jobsFromHostApps(ws) {
         port,
         probeUrl: `http://127.0.0.1:${port}`,
         appId: app.id,
+        folder,
       };
     });
 }
@@ -1678,7 +1635,6 @@ async function probeRunningApps(ws, timeoutMs = 2500) {
         ...app,
         port: port || app.port,
         running: Boolean(up),
-        cloudflareUrl: null,
         publicUrl: proxyUrlForApp(ws, app) || null,
         lastCheckedAt: new Date().toISOString(),
       };
@@ -1722,66 +1678,20 @@ async function restoreHostsAfterReconnect(cfg) {
   }
 }
 
-function envForWorkspacePorts(ws, jobs) {
+function chatLaunchEnv(ws, cfg) {
   const aiPort = Number(ws.port) || 3100;
-  const aiApp = (Array.isArray(ws.hostApps) ? ws.hostApps : []).find(
-    (app) => app.role === "ai-server" || app.id === "ai-server"
-  ) || { id: "ai-server", role: "ai-server" };
-  const publicAi = proxyUrlForApp(ws, aiApp) || "";
-  const ai = publicAi || `http://localhost:${aiPort}`;
-  /** @type {Record<string, string>} */
-  const env = {
+  const admin = originFromUrl(cfg?.adminUrl);
+  const origins = [];
+  if (admin) origins.push(admin);
+  origins.push(`http://localhost:${aiPort}`);
+  origins.push(`http://127.0.0.1:${aiPort}`);
+  return {
     AI_SERVER_PORT: String(aiPort),
-    AI_SERVER_URL: ai,
-    NEXT_PUBLIC_AI_SERVER_URL: ai,
-    VITE_AI_SERVER_URL: ai,
-    REACT_APP_AI_SERVER_URL: ai,
     MAINTAINER_PRO_DATA_DIR: dataDirFor(ws.folderPath, ws.sandboxId),
     MAINTAINER_PRO_SANDBOX_ID: String(ws.sandboxId || ""),
+    CORS_ORIGIN: origins.join(","),
+    CORS_ORIGINS: origins.join(","),
   };
-  const ui =
-    jobs.find((job) => job.host) ||
-    jobs.find((job) => job.role === "ui" || job.role === "app");
-  const uiApp =
-    hostAppOf(ws) ||
-    (Array.isArray(ws.hostApps) ? ws.hostApps : []).find(
-      (app) => app && (app.host || app.role === "ui" || app.role === "app")
-    ) ||
-    { id: "ui", role: "ui", host: true };
-  const publicUi = proxyUrlForApp(ws, uiApp) || "";
-  if (publicUi) {
-    env.PORT = ui?.port ? String(ui.port) : env.PORT;
-    env.APP_URL = publicUi;
-    env.CORS_ORIGIN = publicUi;
-    env.PUBLIC_URL = publicUi;
-    env.NEXT_PUBLIC_APP_URL = publicUi;
-    env.VITE_APP_URL = publicUi;
-  } else if (ui?.port) {
-    const app = `http://localhost:${ui.port}`;
-    env.PORT = String(ui.port);
-    env.APP_URL = app;
-    env.CORS_ORIGIN = app;
-    env.NEXT_PUBLIC_APP_URL = app;
-    env.VITE_APP_URL = app;
-  }
-  const backend = jobs.find((job) => job.role === "backend");
-  if (backend?.port) {
-    const backendApp = (Array.isArray(ws.hostApps) ? ws.hostApps : []).find(
-      (app) => isBackendApp(app)
-    ) || { id: "backend", role: "backend", port: backend.port };
-    const publicBackend = proxyUrlForApp(ws, backendApp) || "";
-    const api = publicBackend || `http://localhost:${backend.port}`;
-    env.API_URL = api;
-    env.API_BASE_URL = api;
-    env.API_PORT = String(backend.port);
-    env.BACKEND_URL = api;
-    env.VITE_API_URL = api;
-    env.VITE_API_BASE_URL = api;
-    env.NEXT_PUBLIC_API_URL = api;
-    env.NEXT_PUBLIC_API_BASE_URL = api;
-    env.REACT_APP_API_URL = api;
-  }
-  return env;
 }
 
 async function prepareWorkspaceLaunch(ws, cfg, reserved) {
@@ -1790,7 +1700,7 @@ async function prepareWorkspaceLaunch(ws, cfg, reserved) {
   if (!folder || !fs.existsSync(folder)) {
     const aiPort = Number(ws.port) || 3100;
     log(`ports skip ${label}: folder missing (${folder || "none"})`);
-    return { aiPort, jobs: [], env: {} };
+    return { aiPort, jobs: [] };
   }
   log(`ports pick ${label} in ${folder}`);
   const listedAi = Array.isArray(ws.hostApps)
@@ -1826,11 +1736,8 @@ async function prepareWorkspaceLaunch(ws, cfg, reserved) {
   const planned = [];
   for (const job of jobs) {
     const preferred = Number(job.preferredPort) || 3000;
-    const probe = (job.probeUrl || `http://127.0.0.1:${preferred}`).replace(
-      "localhost",
-      "127.0.0.1"
-    );
-    const up = await probeUrl(probe);
+    const probe = job.probeUrl || `http://127.0.0.1:${preferred}`;
+    const up = await probeLoopbackUrl(probe);
     const port = up
       ? (reserved.add(portFromText(probe, preferred)), portFromText(probe, preferred))
       : await findFreePort(preferred, reserved);
@@ -1850,10 +1757,6 @@ async function prepareWorkspaceLaunch(ws, cfg, reserved) {
     }
   }
 
-  const env = envForWorkspacePorts(ws, planned);
-  log(
-    `env inject ${label} (process only): ${Object.keys(env).join(" ") || "(none)"}`
-  );
   if (planned.length) {
     ws.projectInfo = {
       ...(ws.projectInfo || {}),
@@ -1869,7 +1772,7 @@ async function prepareWorkspaceLaunch(ws, cfg, reserved) {
       .map((job) => ` ${job.role}=${job.port}${job.up ? "(up)" : ""}`)
       .join("")}`
   );
-  return { aiPort, jobs: planned, env };
+  return { aiPort, jobs: planned };
 }
 
 const DEFAULT_AI_IGNORE_PATHS = [
@@ -1934,7 +1837,7 @@ const IGNORE_NAMES = new Set([
   ".maintainer-pro",
   ".collaborater",
   ".maintainer-pro-bridge.json",
-  ".cloudflare-tunnel-url",
+  LEGACY_TUNNEL_FILE,
 ]);
 
 function isIgnorableEntry(name) {
@@ -2204,8 +2107,6 @@ function listLaunchRoots(allowed) {
 
 /** Prevents opening a new window on every heartbeat while a process is starting. */
 const launchedAt = new Map();
-/** @type {Map<string, { tunnels: Array<{ role: string, localUrl: string, publicUrl: string | null, logFile: string }> }>} */
-const cloudflareTunnels = new Map();
 /** In-process chat servers, one per sandbox/project. */
 /** @type {Map<string, { port: number, workspaceDir: string, close: () => Promise<void>, runChat: (body: Record<string, unknown>) => Promise<{ ok: boolean, status: number, data: Record<string, unknown> }>, handleHttp?: Function }>} */
 const embeddedChat = new Map();
@@ -2213,7 +2114,7 @@ const embeddedChat = new Map();
 const embeddedChatStarting = new Map();
 
 const PROXY_CHUNK_BYTES = 256 * 1024;
-/** @type {Map<string, import("node:http").ClientRequest>} */
+/** @type {Map<string, { req: import("node:http").ClientRequest, rewrite?: boolean, chunks?: Buffer[], headers?: Record<string, string>, portUrls?: Record<string, string> } | import("node:http").ClientRequest>} */
 const proxyHttpReqs = new Map();
 /** Reuse sockets to the local app — Next/Vite fetch many files per page. */
 const proxyKeepAliveAgent = new http.Agent({
@@ -2224,6 +2125,8 @@ const proxyKeepAliveAgent = new http.Agent({
 });
 /** @type {Map<string, WebSocket>} */
 const proxyLocalSockets = new Map();
+/** @type {Map<string, Record<string, string>>} */
+const proxyWsPortUrls = new Map();
 /** @type {Record<string, unknown> | null} */
 let bridgeCfg = null;
 
@@ -2337,6 +2240,9 @@ function shareProxyContext(msg, ws, appId) {
   ).replace(/\/$/, "");
   const acceptEncoding =
     typeof msg.acceptEncoding === "string" ? msg.acceptEncoding : "";
+  const fromWs = sharePortUrls(ws);
+  const fromMsg =
+    msg?.portUrls && typeof msg.portUrls === "object" ? msg.portUrls : {};
   return {
     path: safeProxyPath(msg.path),
     slug,
@@ -2344,6 +2250,7 @@ function shareProxyContext(msg, ws, appId) {
     aiPublicBase,
     acceptEncoding,
     port: localPortForProxy(ws, appId),
+    portUrls: { ...fromWs, ...fromMsg },
   };
 }
 
@@ -2357,6 +2264,43 @@ function sendProcessedProxyHttp(id, ctx, status, headers, body) {
   replyProxyHttp(id, processed.status, processed.headers, processed.body);
 }
 
+function publicPathPrefix(publicBase) {
+  try {
+    return new URL(String(publicBase || "")).pathname.replace(/\/$/, "") || "";
+  } catch {
+    return "";
+  }
+}
+
+function replyShareInterceptor(id, ctx, path) {
+  const pathname = String(path || "").split("?")[0] || "";
+  if (pathname !== "/__mp/shim.js" && pathname !== "/__mp/sw.js") return false;
+  const tokenRoot = shareTokenRoot(ctx.publicBase) || "/";
+  /** @type {Record<string, string>} */
+  const headers = {
+    "content-type": "application/javascript; charset=utf-8",
+    "cache-control": "private, no-store",
+  };
+  let body = "";
+  if (pathname === "/__mp/sw.js") {
+    headers["service-worker-allowed"] = tokenRoot;
+    body = shareServiceWorkerScript(ctx.portUrls, tokenRoot);
+  } else {
+    body = shareShimScript(publicPathPrefix(ctx.publicBase), ctx.portUrls);
+  }
+  replyProxyHttp(id, 200, headers, body);
+  return true;
+}
+
+function destroyProxyHttpReq(entry) {
+  const req = entry?.req || entry;
+  try {
+    req?.destroy?.();
+  } catch {
+    /* ignore */
+  }
+}
+
 function bridgeEmbedConfigJs(ws) {
   const store = ws?.store && typeof ws.store === "object" ? ws.store : {};
   const aiApp = { id: "ai-server", role: "ai-server" };
@@ -2383,19 +2327,24 @@ async function handleAiProxyHttpFromAdmin(msg, ws) {
   const reqPath = safeProxyPath(msg.path);
   const pathname = reqPath.split("?")[0] || "/";
   const ctx = shareProxyContext(msg, ws, "ai-server");
+  if (replyShareInterceptor(id, ctx, reqPath)) return;
   const prepared = prepareShareHttpRequest(
     proxyReqHeaders(msg.headers),
     ctx.publicBase,
     ctx.acceptEncoding,
-    reqPath
+    reqPath,
+    ctx.portUrls
   );
   ctx.acceptEncoding = prepared.acceptEncoding;
   ctx.ifNoneMatch = prepared.ifNoneMatch;
   const headers = prepared.headers;
-  const body =
+  const body = rewriteShareRequestBody(
     typeof msg.body === "string" && msg.body
       ? Buffer.from(msg.body, "base64")
-      : Buffer.alloc(0);
+      : Buffer.alloc(0),
+    headers,
+    ctx.portUrls
+  );
 
   if (pathname === "/ai-ui.iife.js") {
     const file = findIife();
@@ -2487,11 +2436,7 @@ function handleProxyHttpFromAdmin(msg) {
   }
   const existing = proxyHttpReqs.get(id);
   if (existing) {
-    try {
-      existing.destroy();
-    } catch {
-      /* ignore */
-    }
+    destroyProxyHttpReq(existing);
     proxyHttpReqs.delete(id);
   }
   const port = localPortForProxy(ws, appId);
@@ -2507,11 +2452,13 @@ function handleProxyHttpFromAdmin(msg) {
   const path = safeProxyPath(msg.path);
   const ctx = shareProxyContext(msg, ws, appId);
   ctx.port = port;
+  if (replyShareInterceptor(id, ctx, path)) return;
   const prepared = prepareShareHttpRequest(
     proxyReqHeaders(msg.headers),
     ctx.publicBase,
     ctx.acceptEncoding,
-    path
+    path,
+    ctx.portUrls
   );
   ctx.acceptEncoding = prepared.acceptEncoding;
   ctx.ifNoneMatch = prepared.ifNoneMatch;
@@ -2528,7 +2475,6 @@ function handleProxyHttpFromAdmin(msg) {
     }
   }
   const headers = prepared.headers;
-  headers.host = `127.0.0.1:${port}`;
   // Next.js dev 403s `/_next` when Origin/sec-fetch look cross-site.
   // This hop is server-to-server; drop those so chunks always load.
   for (const key of Object.keys(headers)) {
@@ -2545,100 +2491,174 @@ function handleProxyHttpFromAdmin(msg) {
     }
   }
   const stream = randomBytes(8).toString("hex");
-  let req;
-  try {
-    req = http.request(
-      {
-        hostname: "127.0.0.1",
-        port,
-        path,
-        method,
-        headers,
-        agent: proxyKeepAliveAgent,
-      },
-      (res) => {
-        /** @type {Record<string, string>} */
-        const outHeaders = {};
-        for (const [key, value] of Object.entries(res.headers)) {
-          if (value == null) continue;
-          outHeaders[key] = Array.isArray(value) ? value.join(", ") : String(value);
-        }
-        const status = res.statusCode || 502;
-        applyShareCacheHeaders(outHeaders, path);
-        if (shouldProcessShareResponse(outHeaders)) {
-          /** @type {Buffer[]} */
-          const chunks = [];
+  const initialBody =
+    typeof msg.body === "string" && msg.body
+      ? Buffer.from(msg.body, "base64")
+      : null;
+  const endAfter = msg.bodyEof !== false;
+  const hosts = loopbackHostsForPort(port);
+  let hostIndex = 0;
+
+  const connect = () => {
+    const host = hosts[hostIndex];
+    const reqHeaders = { ...headers, host: `${host}:${port}` };
+    let req;
+    try {
+      req = http.request(
+        {
+          hostname: host,
+          port,
+          path,
+          method,
+          headers: reqHeaders,
+          agent: proxyKeepAliveAgent,
+        },
+        (res) => {
+          rememberLoopbackHost(port, host);
+          /** @type {Record<string, string>} */
+          const outHeaders = {};
+          for (const [key, value] of Object.entries(res.headers)) {
+            if (value == null) continue;
+            outHeaders[key] = Array.isArray(value)
+              ? value.join(", ")
+              : String(value);
+          }
+          const status = res.statusCode || 502;
+          applyShareCacheHeaders(outHeaders, path);
+          if (shouldProcessShareResponse(outHeaders)) {
+            /** @type {Buffer[]} */
+            const chunks = [];
+            res.on("data", (chunk) => {
+              chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+            });
+            res.on("end", () => {
+              proxyHttpReqs.delete(id);
+              sendProcessedProxyHttp(
+                id,
+                ctx,
+                status,
+                outHeaders,
+                Buffer.concat(chunks)
+              );
+            });
+            return;
+          }
+          bridgeSend({
+            type: "proxy.http.start",
+            id,
+            stream,
+            status,
+            headers: outHeaders,
+          });
           res.on("data", (chunk) => {
-            chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+            const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            for (
+              let offset = 0;
+              offset < buf.length;
+              offset += PROXY_CHUNK_BYTES
+            ) {
+              const end = Math.min(offset + PROXY_CHUNK_BYTES, buf.length);
+              bridgeSend({
+                type: "proxy.http.chunk",
+                id,
+                stream,
+                data: Buffer.from(buf.subarray(offset, end)).toString("base64"),
+                eof: false,
+              });
+            }
           });
           res.on("end", () => {
             proxyHttpReqs.delete(id);
-            sendProcessedProxyHttp(
-              id,
-              ctx,
-              status,
-              outHeaders,
-              Buffer.concat(chunks)
-            );
-          });
-          return;
-        }
-        bridgeSend({
-          type: "proxy.http.start",
-          id,
-          stream,
-          status,
-          headers: outHeaders,
-        });
-        res.on("data", (chunk) => {
-          const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-          for (let offset = 0; offset < buf.length; offset += PROXY_CHUNK_BYTES) {
-            const end = Math.min(offset + PROXY_CHUNK_BYTES, buf.length);
             bridgeSend({
               type: "proxy.http.chunk",
               id,
               stream,
-              data: Buffer.from(buf.subarray(offset, end)).toString("base64"),
-              eof: false,
+              data: "",
+              eof: true,
             });
-          }
-        });
-        res.on("end", () => {
-          proxyHttpReqs.delete(id);
-          bridgeSend({ type: "proxy.http.chunk", id, stream, data: "", eof: true });
-        });
+          });
+        }
+      );
+    } catch (err) {
+      if (hostIndex + 1 < hosts.length) {
+        hostIndex += 1;
+        connect();
+        return;
       }
-    );
-  } catch (err) {
-    bridgeSend({
-      type: "proxy.http.error",
-      id,
-      error: err instanceof Error ? err.message : String(err),
+      bridgeSend({
+        type: "proxy.http.error",
+        id,
+        error: err instanceof Error ? err.message : String(err),
+      });
+      return;
+    }
+    req.on("error", (err) => {
+      if (isLoopbackConnError(err) && hostIndex + 1 < hosts.length) {
+        proxyHttpReqs.delete(id);
+        hostIndex += 1;
+        connect();
+        return;
+      }
+      proxyHttpReqs.delete(id);
+      bridgeSend({
+        type: "proxy.http.error",
+        id,
+        error: err instanceof Error ? err.message : String(err),
+      });
     });
-    return;
-  }
-  req.on("error", (err) => {
-    proxyHttpReqs.delete(id);
-    bridgeSend({
-      type: "proxy.http.error",
-      id,
-      error: err instanceof Error ? err.message : String(err),
+    proxyHttpReqs.set(id, {
+      req,
+      rewrite:
+        shouldRewriteBody(headers) &&
+        ctx.portUrls &&
+        Object.keys(ctx.portUrls).length > 0,
+      chunks: [],
+      headers,
+      portUrls: ctx.portUrls,
     });
-  });
-  proxyHttpReqs.set(id, req);
-  if (typeof msg.body === "string" && msg.body) {
-    req.write(Buffer.from(msg.body, "base64"));
-  }
-  if (msg.bodyEof !== false) req.end();
+    const entry = proxyHttpReqs.get(id);
+    if (entry.rewrite) {
+      if (initialBody?.length) entry.chunks.push(initialBody);
+      if (endAfter) {
+        const body = rewriteShareRequestBody(
+          Buffer.concat(entry.chunks),
+          headers,
+          ctx.portUrls
+        );
+        if (body?.length) req.write(body);
+        req.end();
+      }
+    } else {
+      if (initialBody?.length) req.write(initialBody);
+      if (endAfter) req.end();
+    }
+  };
+  connect();
 }
 
 function handleProxyHttpBodyFromAdmin(msg) {
   const id = typeof msg.id === "string" ? msg.id : "";
-  const req = proxyHttpReqs.get(id);
-  if (!req) return;
-  if (typeof msg.data === "string" && msg.data) {
-    req.write(Buffer.from(msg.data, "base64"));
+  const entry = proxyHttpReqs.get(id);
+  if (!entry) return;
+  const req = entry.req || entry;
+  const chunk =
+    typeof msg.data === "string" && msg.data
+      ? Buffer.from(msg.data, "base64")
+      : null;
+  if (entry.rewrite) {
+    if (chunk?.length) entry.chunks.push(chunk);
+    if (msg.eof === true) {
+      const body = rewriteShareRequestBody(
+        Buffer.concat(entry.chunks || []),
+        entry.headers,
+        entry.portUrls
+      );
+      if (body?.length) req.write(body);
+      req.end();
+    }
+    return;
   }
+  if (chunk?.length) req.write(chunk);
   if (msg.eof === true) req.end();
 }
 
@@ -2659,16 +2679,22 @@ function attachProxyLocalWs(id, socket) {
     /* WHATWG WebSocket in Node 22 */
   }
   proxyLocalSockets.set(id, socket);
-  socket.addEventListener("open", () => {
+  const announceOpen = () => {
     bridgeSend({ type: "proxy.ws.opened", id });
-  });
+  };
+  if (socket.readyState === 1) announceOpen();
+  else socket.addEventListener("open", announceOpen);
   socket.addEventListener("message", (event) => {
     try {
       if (typeof event.data === "string") {
+        const portUrls = proxyWsPortUrls.get(id);
+        const data = portUrls
+          ? rewriteMappedLocalUrls(event.data, portUrls)
+          : event.data;
         bridgeSend({
           type: "proxy.ws.frame",
           id,
-          data: event.data,
+          data,
           binary: false,
         });
         return;
@@ -2688,6 +2714,7 @@ function attachProxyLocalWs(id, socket) {
   });
   socket.addEventListener("close", (event) => {
     proxyLocalSockets.delete(id);
+    proxyWsPortUrls.delete(id);
     bridgeSend({
       type: "proxy.ws.close",
       id,
@@ -2713,23 +2740,51 @@ function wsProtocolsFromMsg(msg) {
 }
 
 function openProxyLocalWs(id, port, path, protocols) {
-  let socket;
-  try {
-    const url = `ws://127.0.0.1:${port}${path}`;
-    const proto = Array.isArray(protocols)
-      ? protocols.map((p) => String(p || "").trim()).filter(Boolean)
-      : [];
-    // Vite HMR only accepts upgrades with subprotocol `vite-hmr` / `vite-ping`.
-    socket = proto.length ? new WebSocket(url, proto) : new WebSocket(url);
-  } catch (err) {
-    bridgeSend({
-      type: "proxy.ws.error",
-      id,
-      error: err instanceof Error ? err.message : String(err),
+  const proto = Array.isArray(protocols)
+    ? protocols.map((p) => String(p || "").trim()).filter(Boolean)
+    : [];
+  const hosts = loopbackHostsForPort(port);
+  const tryHost = (index) => {
+    const host = hosts[index];
+    const url = `ws://${host}:${port}${path}`;
+    let socket;
+    try {
+      // Vite HMR only accepts upgrades with subprotocol `vite-hmr` / `vite-ping`.
+      socket = proto.length ? new WebSocket(url, proto) : new WebSocket(url);
+    } catch (err) {
+      if (index + 1 < hosts.length) {
+        tryHost(index + 1);
+        return;
+      }
+      bridgeSend({
+        type: "proxy.ws.error",
+        id,
+        error: err instanceof Error ? err.message : String(err),
+      });
+      return;
+    }
+    let settled = false;
+    socket.addEventListener("open", () => {
+      if (settled) return;
+      settled = true;
+      rememberLoopbackHost(port, host);
+      attachProxyLocalWs(id, socket);
     });
-    return;
-  }
-  attachProxyLocalWs(id, socket);
+    socket.addEventListener("close", () => {
+      if (settled) return;
+      settled = true;
+      if (index + 1 < hosts.length) {
+        tryHost(index + 1);
+        return;
+      }
+      bridgeSend({
+        type: "proxy.ws.error",
+        id,
+        error: `Cannot reach ${url}`,
+      });
+    });
+  };
+  tryHost(0);
 }
 
 function handleProxyWsOpenFromAdmin(msg) {
@@ -2744,6 +2799,9 @@ function handleProxyWsOpenFromAdmin(msg) {
   }
   const path = safeProxyPath(msg.path);
   const protocols = wsProtocolsFromMsg(msg);
+  const fromMsg =
+    msg?.portUrls && typeof msg.portUrls === "object" ? msg.portUrls : {};
+  proxyWsPortUrls.set(id, { ...sharePortUrls(ws), ...fromMsg });
   if (isAiServerAppId(appId, ws)) {
     void (async () => {
       const embedded = await ensureEmbeddedChat(ws);
@@ -2772,7 +2830,9 @@ function handleProxyWsFrameFromAdmin(msg) {
     if (msg.binary === true) {
       socket.send(Buffer.from(String(msg.data || ""), "base64"));
     } else {
-      socket.send(String(msg.data || ""));
+      const portUrls = proxyWsPortUrls.get(id);
+      const data = String(msg.data || "");
+      socket.send(portUrls ? rewriteMappedLocalUrls(data, portUrls) : data);
     }
   } catch {
     /* ignore */
@@ -2784,6 +2844,7 @@ function handleProxyWsCloseFromAdmin(msg) {
   const socket = proxyLocalSockets.get(id);
   if (!socket) return;
   proxyLocalSockets.delete(id);
+  proxyWsPortUrls.delete(id);
   try {
     socket.close(
       typeof msg.code === "number" ? msg.code : 1000,
@@ -2865,7 +2926,6 @@ async function forgetLaunch(sandboxId) {
     if (key.startsWith(`${sandboxId}::`)) processProblems.delete(key);
   }
   await closeRememberedTerminals(sandboxId);
-  await stopCloudflare(sandboxId);
 }
 
 function problemKey(sandboxId, code, role = "") {
@@ -3218,6 +3278,10 @@ async function openInNewTerminal(opts) {
 }
 
 function commandWithPort(job, scripts, port) {
+  const command = String(job.command || "");
+  if (!/^(npm|pnpm|yarn|npx)\s/i.test(command)) {
+    return command;
+  }
   const raw = String(scripts?.[job.script] || "");
   if (
     job.role === "ui" ||
@@ -3225,9 +3289,9 @@ function commandWithPort(job, scripts, port) {
     isUiCommand(raw) ||
     /--port\b/i.test(raw)
   ) {
-    return `${job.command} -- --port ${port}`;
+    return `${command} -- --port ${port}`;
   }
-  return job.command;
+  return command;
 }
 
 async function stopEmbeddedChat(sandboxId) {
@@ -3254,15 +3318,10 @@ async function ensureEmbeddedChat(ws) {
   if (inflight) return inflight;
   const task = (async () => {
     const cfg = bridgeCfg || loadConfig();
-    const jobs = jobsFromHostApps(ws);
-    const shareEnv = {
-      ...envForWorkspacePorts(ws, jobs),
-      ...uiPublicEnv({}, ws),
-    };
     log(`lazy-start in-process chat for ${ws.sandboxName || shortId(ws.sandboxId)}`);
     const result = await startAiServerForWorkspace(ws, {
       cfg,
-      env: shareEnv,
+      env: chatLaunchEnv(ws, cfg),
       forceEmbed: true,
     });
     if (!result.up) return null;
@@ -3343,14 +3402,6 @@ async function startAiServerForWorkspace(ws, opts = {}) {
   const localAi = `http://localhost:${port}`;
   const overrideEnv =
     opts.env && typeof opts.env === "object" ? opts.env : {};
-  const publicAi =
-    (typeof overrideEnv.AI_SERVER_URL === "string" &&
-      overrideEnv.AI_SERVER_URL.trim()) ||
-    (typeof overrideEnv.NEXT_PUBLIC_AI_SERVER_URL === "string" &&
-      overrideEnv.NEXT_PUBLIC_AI_SERVER_URL.trim()) ||
-    (typeof ws.cloudflare?.ai === "string" && ws.cloudflare.ai.trim()) ||
-    "";
-  const aiUrl = publicAi || localAi;
   persistWorkspaceEntry(cfg, ws);
 
   const storeEnv = await loadSandboxStoreEnv(ws, cfg);
@@ -3360,7 +3411,7 @@ async function startAiServerForWorkspace(ws, opts = {}) {
     ...folderEnv,
     ...overrideEnv,
     ...storeEnv,
-    AI_SERVER_URL: aiUrl,
+    AI_SERVER_URL: localAi,
     CORS_ORIGIN: overrideEnv.CORS_ORIGIN || folderEnv.CORS_ORIGIN || "",
     CORS_ORIGINS: overrideEnv.CORS_ORIGINS || folderEnv.CORS_ORIGINS || "",
     MAINTAINER_PRO_DATA_DIR: dataDir,
@@ -3403,37 +3454,6 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-function stopAllCloudflare() {
-  for (const id of [...cloudflareTunnels.keys()]) stopCloudflare(id);
-}
-
-function killProcessesByCommand(fragment) {
-  if (!fragment) return Promise.resolve();
-  return new Promise((resolve) => {
-    const done = () => resolve();
-    if (process.platform === "win32") {
-      const escaped = String(fragment).replace(/'/g, "''");
-      const child = spawn(
-        "powershell.exe",
-        [
-          "-NoProfile",
-          "-Command",
-          `Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -like '*${escaped}*' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }`,
-        ],
-        { windowsHide: true, stdio: "ignore" }
-      );
-      child.on("exit", done);
-      child.on("error", done);
-      setTimeout(done, 8000);
-      return;
-    }
-    const child = spawn("pkill", ["-f", String(fragment)], { stdio: "ignore" });
-    child.on("exit", done);
-    child.on("error", done);
-    setTimeout(done, 4000);
-  });
-}
-
 function killPort(port) {
   const n = Number(port);
   if (!n) return Promise.resolve();
@@ -3465,29 +3485,6 @@ function killPort(port) {
   });
 }
 
-function stopCloudflare(sandboxId, folder) {
-  const row = cloudflareTunnels.get(sandboxId);
-  const files = new Set(
-    (row?.tunnels?.map((t) => t.logFile).filter(Boolean) ?? [])
-  );
-  cloudflareTunnels.delete(sandboxId);
-  const logDir = folder
-    ? dataDirFor(folder, sandboxId)
-    : null;
-  if (logDir && fs.existsSync(logDir)) {
-    try {
-      for (const name of fs.readdirSync(logDir)) {
-        if (/^cf-.*\.log$/i.test(name) && !name.endsWith(".stale")) {
-          files.add(path.join(logDir, name));
-        }
-      }
-    } catch {
-      /* ignore */
-    }
-  }
-  return Promise.all([...files].map((file) => killProcessesByCommand(file)));
-}
-
 function forgetProcessLaunches(sandboxId) {
   for (const key of [...launchedAt.keys()]) {
     if (key === sandboxId || key.startsWith(`${sandboxId}:`)) {
@@ -3545,231 +3542,6 @@ async function waitUntilReachable(url, timeoutMs, label, onWait) {
   throw new Error(`${label} did not become reachable at ${url}`);
 }
 
-function applyBackendPublicEnv(env, url) {
-  const backend = String(url || "").replace(/\/$/, "");
-  if (!backend) return env;
-  env.API_URL = backend;
-  env.API_BASE_URL = backend;
-  env.BACKEND_URL = backend;
-  env.VITE_API_URL = backend;
-  env.VITE_API_BASE_URL = backend;
-  env.NEXT_PUBLIC_API_URL = backend;
-  env.NEXT_PUBLIC_API_BASE_URL = backend;
-  env.REACT_APP_API_URL = backend;
-  return env;
-}
-
-function uiPublicEnv(tunnels, ws) {
-  /** @type {Record<string, string>} */
-  const env = {};
-  const aiApp = (Array.isArray(ws?.hostApps) ? ws.hostApps : []).find(
-    (app) => app.role === "ai-server" || app.id === "ai-server"
-  ) || { id: "ai-server", role: "ai-server" };
-  const ai =
-    proxyUrlForApp(ws, aiApp) ||
-    (tunnels.ai ? String(tunnels.ai).replace(/\/$/, "") : "");
-  if (ai) {
-    env.AI_SERVER_URL = ai;
-    env.NEXT_PUBLIC_AI_SERVER_URL = ai;
-    env.VITE_AI_SERVER_URL = ai;
-    env.REACT_APP_AI_SERVER_URL = ai;
-  }
-  const backendApp = (Array.isArray(ws?.hostApps) ? ws.hostApps : []).find(
-    (app) => isBackendApp(app)
-  );
-  const backendUrl =
-    (backendApp ? proxyUrlForApp(ws, backendApp) : "") ||
-    (typeof tunnels.backend === "string" && tunnels.backend) ||
-    (backendApp ? publicUrlForApp(ws, backendApp) : "") ||
-    "";
-  if (backendUrl && backendApp) {
-    applyBackendPublicEnv(env, backendUrl);
-  }
-  if (tunnels.ui) {
-    const ui = String(tunnels.ui).replace(/\/$/, "");
-    env.APP_URL = ui;
-    env.PUBLIC_URL = ui;
-    env.CORS_ORIGIN = ui;
-    env.NEXT_PUBLIC_APP_URL = ui;
-    env.VITE_APP_URL = ui;
-    env.REACT_APP_APP_URL = ui;
-  } else if (tunnels.app) {
-    const app = String(tunnels.app).replace(/\/$/, "");
-    env.APP_URL = app;
-    env.PUBLIC_URL = app;
-    env.CORS_ORIGIN = app;
-    env.NEXT_PUBLIC_APP_URL = app;
-    env.VITE_APP_URL = app;
-    env.REACT_APP_APP_URL = app;
-  } else if (ai) {
-    const hostUi = (Array.isArray(ws?.hostApps) ? ws.hostApps : []).some(
-      (app) => app.host || app.role === "ui" || app.role === "app"
-    );
-    if (!hostUi) {
-      env.CORS_ORIGIN = ai;
-      env.APP_URL = ai;
-      env.PUBLIC_URL = ai;
-      env.NEXT_PUBLIC_APP_URL = ai;
-      env.VITE_APP_URL = ai;
-    }
-  }
-  return env;
-}
-
-function publicUrlForApp(ws, app) {
-  if (!app) return "";
-  const proxied = proxyUrlForApp(ws, app);
-  if (proxied) return proxied;
-  const port = Number(app.port) || 0;
-  return port ? `http://localhost:${port}` : "";
-}
-
-function envFromConfiguredMaps(ws) {
-  /** @type {Record<string, string>} */
-  const env = {};
-  const apps = Array.isArray(ws.hostApps) ? ws.hostApps : [];
-  for (const app of apps) {
-    const maps = Array.isArray(app.envMaps) ? app.envMaps : [];
-    for (const row of maps) {
-      const key = String(row?.key || "").trim();
-      const sourceId = String(row?.sourceAppId || "").trim();
-      if (!key || !sourceId) continue;
-      const source =
-        sourceId === "self"
-          ? app
-          : apps.find((item) => item.id === sourceId) || null;
-      const url = publicUrlForApp(ws, source);
-      if (url) env[key] = url;
-    }
-  }
-  return env;
-}
-
-function cloudflarePublicEnv(ws) {
-  const tunnels =
-    ws.cloudflare && typeof ws.cloudflare === "object" ? ws.cloudflare : {};
-  const jobs = jobsFromHostApps(ws);
-  const env = {
-    ...envForWorkspacePorts(ws, jobs),
-    ...uiPublicEnv(tunnels, ws),
-  };
-  const origins = [];
-  const add = (value) => {
-    const origin = originFromUrl(value);
-    if (origin && !origins.includes(origin)) origins.push(origin);
-  };
-  add(tunnels.ui);
-  add(tunnels.app);
-  add(tunnels.backend);
-  add(tunnels.ai);
-  add(env.APP_URL);
-  add(env.CORS_ORIGIN);
-  for (const job of jobs) {
-    if (job.port) add(`http://localhost:${job.port}`);
-  }
-  add(`http://localhost:${Number(ws.port) || 3100}`);
-  if (origins.length) {
-    env.CORS_ORIGIN = origins.join(",");
-    env.CORS_ORIGINS = origins.join(",");
-  }
-  Object.assign(env, envFromConfiguredMaps(ws));
-  return env;
-}
-
-async function applyPublicUrlsToRunningApps(ws, cfg, opts = {}) {
-  const folder = ws.folderPath ? path.resolve(ws.folderPath) : "";
-  const progress =
-    typeof opts.onProgress === "function" ? opts.onProgress : async () => {};
-  const tunnels =
-    ws.cloudflare && typeof ws.cloudflare === "object" ? ws.cloudflare : {};
-  const hasProxy = Boolean(ws.proxy?.token);
-  if (
-    !folder ||
-    !fs.existsSync(folder) ||
-    (!Object.keys(tunnels).length && !hasProxy)
-  ) {
-    return { restarted: [], rewritten: [] };
-  }
-  const env = {
-    ...cloudflarePublicEnv(ws),
-  };
-  if (Object.keys(tunnels).length) writeTunnelEnv(ws, tunnels);
-  const mappedKeys = Object.keys(envFromConfiguredMaps(ws));
-  if (mappedKeys.length) {
-    activity(
-      ws.sandboxId,
-      "info",
-      `Injecting public URLs into process env for ${mappedKeys.join(", ")}`
-    );
-    await progress(`Passing ${mappedKeys.join(", ")} via process env`);
-  }
-
-  const probe = await probeRunningApps(ws, 1200);
-  const runningRoles = new Set(
-    (probe.hostApps || [])
-      .filter((app) => app.running)
-      .map((app) =>
-        app.role === "ai-server" ? "ai-server" : app.role === "custom" ? "app" : app.role
-      )
-  );
-  const reserved = reservedPortsFor(cfg, ws.sandboxId);
-  const restarted = [];
-
-  if (probe.chatUp || runningRoles.has("ai-server") || embeddedChat.has(ws.sandboxId)) {
-    await progress("Restarting in-process chat with public URLs and CORS…");
-    launchedAt.delete(`${ws.sandboxId}:${folder}:ai`);
-    await stopEmbeddedChat(ws.sandboxId);
-    await startAiServerForWorkspace(ws, {
-      reserved,
-      cfg,
-      port: ws.port,
-      env,
-    });
-    restarted.push("ai-server");
-  }
-
-  const jobs = jobsFromHostApps(ws).filter((job) =>
-    runningRoles.has(job.role === "custom" ? "app" : job.role)
-  );
-  if (jobs.length) {
-    const roles = [...new Set(jobs.map((job) => job.role))];
-    await progress(
-      `Restarting ${roles.join(", ")} so they load the public URLs…`
-    );
-    for (const job of jobs) {
-      launchedAt.delete(`${ws.sandboxId}:${folder}:${job.script}`);
-      await killPort(job.port);
-    }
-    await sleep(1500);
-    await ensureHostProcesses(ws, {
-      reserved,
-      cfg,
-      onlyRoles: roles,
-      extraEnv: env,
-      force: true,
-      plannedJobs: jobsFromHostApps(ws),
-    });
-    restarted.push(...roles);
-  }
-
-  if (restarted.length) {
-    activity(
-      ws.sandboxId,
-      "info",
-      `Restarted ${[...new Set(restarted)].join(", ")} with public URLs`
-    );
-  }
-  return { restarted: [...new Set(restarted)], rewritten: [], env };
-}
-
-function writeTunnelEnv(ws, tunnels) {
-  const folder = ws.folderPath ? path.resolve(ws.folderPath) : null;
-  if (!folder || !fs.existsSync(folder)) return { ok: false, env: {} };
-  clearCloudflareTunnelFile(folder);
-  const env = uiPublicEnv(tunnels, ws);
-  return { ok: true, env };
-}
-
 function reservedPortsFor(cfg, sandboxId) {
   const reserved = new Set();
   for (const other of cfg.workspaces || []) {
@@ -3784,17 +3556,12 @@ function appsWanted(ws) {
   return Boolean(ws?.appsRequested);
 }
 
-async function configureCloudflareForWorkspace(ws, cfg, opts = {}) {
+async function configureShareForWorkspace(ws, cfg, opts = {}) {
   const sandboxId = ws.sandboxId;
   const progress = (message) =>
     reportActionProgress(cfg, opts.actionId, message);
-  await progress("Using Maintainer Pro share URLs (no Cloudflare).");
-  try {
-    await stopCloudflare(sandboxId, ws.folderPath);
-  } catch {
-    /* leftover tunnels */
-  }
-  ws.cloudflarePending = false;
+  await progress("Using Maintainer Pro share URLs.");
+  stripDiscardedTunnelState(ws, cfg);
   persistWorkspaceEntry(cfg, ws);
   const status = await reconcileWorkspacePresence(ws, cfg, {
     timeoutMs: 2500,
@@ -3808,12 +3575,10 @@ async function configureCloudflareForWorkspace(ws, cfg, opts = {}) {
     folderPath: ws.folderPath,
     port: ws.port,
     pending: false,
-    cloudflarePending: false,
     waitingForStart: false,
     appUrl: status.host.appUrl || share,
     origins: status.host.origins,
     publicUrl: share || null,
-    cloudflare: false,
   };
 }
 
@@ -3825,12 +3590,7 @@ async function startAppsForWorkspace(ws, cfg, opts = {}) {
     `Checking running apps for ${label}…`
   );
 
-  try {
-    await stopCloudflare(ws.sandboxId, ws.folderPath);
-  } catch {
-    /* leftover cloudflared */
-  }
-  ws.cloudflarePending = false;
+  stripDiscardedTunnelState(ws, cfg);
 
   let status = await reconcileWorkspacePresence(ws, cfg, {
     timeoutMs: 2500,
@@ -3858,11 +3618,7 @@ async function startAppsForWorkspace(ws, cfg, opts = {}) {
     timeoutMs: 800,
   });
 
-  const shareEnv = {
-    ...envForWorkspacePorts(ws, plan.jobs),
-    ...uiPublicEnv({}, ws),
-    ...envFromConfiguredMaps(ws),
-  };
+  const chatEnv = chatLaunchEnv(ws, cfg);
 
   if (!cfg.noAiServer) {
     if (status.probe.chatUp) {
@@ -3875,7 +3631,7 @@ async function startAppsForWorkspace(ws, cfg, opts = {}) {
         reserved,
         cfg,
         port: plan.aiPort,
-        env: shareEnv,
+        env: chatEnv,
       });
       await sleep(1500);
     }
@@ -3890,14 +3646,9 @@ async function startAppsForWorkspace(ws, cfg, opts = {}) {
       const probed = status.probe.hosts.find((h) => h.role === job.role);
       return probed?.up ? { ...job, up: true, port: probed.port } : job;
     }),
-    extraEnv: shareEnv,
   });
   await sleep(800);
 
-  await applyPublicUrlsToRunningApps(ws, cfg, {
-    onProgress: (message) => reportActionProgress(cfg, opts.actionId, message),
-  });
-
   status = await reconcileWorkspacePresence(ws, cfg, {
     timeoutMs: 2500,
   });
@@ -3929,7 +3680,6 @@ async function startAppsForWorkspace(ws, cfg, opts = {}) {
         ws,
         hostAppOf(ws) || { id: "ui", role: "ui", host: true }
       ) || null,
-    cloudflare: false,
     hostApps: status.probe.hostApps || ws.hostApps || [],
     processIssues,
     warning,
@@ -3975,9 +3725,6 @@ async function startSingleApp(ws, cfg, payload = {}, opts = {}) {
   await progress(`Starting ${app.name} on port ${app.port}…`);
   ws.appsRequested = true;
   persistWorkspaceEntry(cfg, ws);
-  const publicEnv = {
-    ...cloudflarePublicEnv(ws),
-  };
   if (app.role === "ai-server") {
     const reserved = reservedPortsFor(cfg, ws.sandboxId);
     const chat = await discoverChatPort(ws, 1200);
@@ -3989,7 +3736,7 @@ async function startSingleApp(ws, cfg, payload = {}, opts = {}) {
         reserved,
         cfg,
         port: Number(app.port) || ws.port || 3100,
-        env: publicEnv,
+        env: chatLaunchEnv(ws, cfg),
       });
     }
   } else {
@@ -3997,10 +3744,8 @@ async function startSingleApp(ws, cfg, payload = {}, opts = {}) {
     await ensureHostProcesses(ws, {
       reserved,
       cfg,
-      onlyRoles: [app.role === "custom" ? "app" : app.role],
-      extraEnv: publicEnv,
       force: true,
-      plannedJobs: jobsFromHostApps(ws),
+      plannedJobs: jobsFromHostApps(ws, { appId: app.id }),
     });
   }
   const status = await reconcileWorkspacePresence(ws, cfg, {
@@ -4068,7 +3813,7 @@ async function restartSingleApp(ws, cfg, payload = {}, opts = {}) {
   return startSingleApp(ws, cfg, payload, opts);
 }
 
-async function startCloudflareForApp(ws, cfg, payload = {}, opts = {}) {
+async function startShareForApp(ws, cfg, payload = {}, opts = {}) {
   const app = findHostApp(ws, payload);
   if (!app) {
     activity(ws.sandboxId, "error", "Share URL failed: unknown app/port");
@@ -4086,9 +3831,6 @@ async function startCloudflareForApp(ws, cfg, payload = {}, opts = {}) {
     await progress(`Using the Maintainer Pro share URL for ${app.name}…`);
     const started = await startSingleApp(ws, cfg, { appId: app.id }, opts);
     if (started.error) return started;
-    const applied = await applyPublicUrlsToRunningApps(ws, cfg, {
-      onProgress: progress,
-    });
     const status = await reconcileWorkspacePresence(ws, cfg, {
       timeoutMs: 2500,
     });
@@ -4098,12 +3840,9 @@ async function startCloudflareForApp(ws, cfg, payload = {}, opts = {}) {
       running: Boolean(started.running),
       port: started.port,
       publicUrl: shareUrl,
-      cloudflareUrl: null,
       appUrl: status.host.appUrl,
       origins: status.host.origins,
       hostApps: status.probe.hostApps || [],
-      rewritten: applied.rewritten,
-      restarted: applied.restarted,
       log: activityLogFor(ws.sandboxId),
     };
   }
@@ -4118,32 +3857,21 @@ async function ensureHostProcesses(ws, opts = {}) {
   const reserved = opts.reserved instanceof Set ? opts.reserved : new Set();
   const cfg = opts.cfg || null;
   const folder = path.resolve(ws.folderPath);
-  const scripts = readPackageJson(folder)?.scripts || {};
   const jobs = Array.isArray(opts.plannedJobs)
     ? opts.plannedJobs
-    : planHostJobs(
-        folder,
-        ws.appUrl && isLocalAppUrl(ws.appUrl) ? ws.appUrl : null,
-        ws.projectInfo
-      );
+    : jobsFromHostApps(ws).length
+      ? jobsFromHostApps(ws)
+      : planHostJobs(
+          folder,
+          ws.appUrl && isLocalAppUrl(ws.appUrl) ? ws.appUrl : null,
+          ws.projectInfo
+        );
   const onlyRoles = Array.isArray(opts.onlyRoles) ? new Set(opts.onlyRoles) : null;
   const extraEnv = opts.extraEnv && typeof opts.extraEnv === "object" ? opts.extraEnv : {};
   const started = [];
   let persisted = false;
   const label = ws.sandboxName || "this sandbox";
 
-  if (jobs.length > 0 && !fs.existsSync(folder)) {
-    recordProcessProblem({
-      sandboxId: ws.sandboxId,
-      code: "host_process_launch",
-      role: "app",
-      title: `Could not start the app (${label})`,
-      message: `The project folder is missing: ${folder}`,
-      resolution: "Attach the folder again from Local setup.",
-    });
-    return started;
-  }
-
   log(
     `start hosts ${label}: ${
       jobs.length
@@ -4157,20 +3885,31 @@ async function ensureHostProcesses(ws, opts = {}) {
 
   for (const job of jobs) {
     if (onlyRoles && !onlyRoles.has(job.role)) continue;
+    const jobFolder = path.resolve(job.folder || folder);
+    if (!fs.existsSync(jobFolder)) {
+      recordProcessProblem({
+        sandboxId: ws.sandboxId,
+        code: "host_process_launch",
+        role: job.role,
+        title: `Could not start the ${processRoleLabel(job.role)} (${label})`,
+        message: `The project folder is missing: ${jobFolder}`,
+        resolution: "Attach the folder again from Local setup.",
+      });
+      continue;
+    }
+    const scripts = readPackageJson(jobFolder)?.scripts || {};
     const preferred = Number(job.port || job.preferredPort) || 3000;
-    const probe = (
-      job.port
-        ? `http://127.0.0.1:${job.port}`
-        : job.probeUrl || `http://127.0.0.1:${preferred}`
-    ).replace("localhost", "127.0.0.1");
-    if (job.up || (await probeUrl(probe))) {
+    const probe = job.port
+      ? `http://127.0.0.1:${job.port}`
+      : job.probeUrl || `http://127.0.0.1:${preferred}`;
+    if (job.up || (await probeLoopbackUrl(probe))) {
       reserved.add(portFromText(probe, preferred));
       clearProcessProblem(ws.sandboxId, "host_process_launch", job.role);
       clearProcessProblem(ws.sandboxId, "host_process_down", job.role);
       log(`${job.role} already running at ${job.probeUrl || probe}`);
       continue;
     }
-    const launchKey = `${ws.sandboxId}:${folder}:${job.script}`;
+    const launchKey = `${ws.sandboxId}:${jobFolder}:${job.command || job.script}:${preferred}`;
     if (!opts.force && recentlyLaunched(launchKey)) {
       reserved.add(preferred);
       log(`start ${job.role} skip ${label}: launched recently`);
@@ -4202,13 +3941,13 @@ async function ensureHostProcesses(ws, opts = {}) {
     }
 
     const needsInstall =
-      fs.existsSync(path.join(folder, "package.json")) &&
-      !fs.existsSync(path.join(folder, "node_modules"));
+      fs.existsSync(path.join(jobFolder, "package.json")) &&
+      !fs.existsSync(path.join(jobFolder, "node_modules"));
     const run = commandWithPort(job, scripts, port);
     const command = needsInstall ? `npm install && ${run}` : run;
     const opened = await openInNewTerminal({
       title: `MP-${job.role}-${port}`,
-      folder,
+      folder: jobFolder,
       command,
       env: { PORT: String(port), ...extraEnv },
       launchKey,
@@ -4265,12 +4004,9 @@ async function inspectHostJobs(ws) {
   const hosts = [];
   for (const job of jobs) {
     const preferred = Number(job.preferredPort) || 3000;
-    const probe = (job.probeUrl || `http://127.0.0.1:${preferred}`).replace(
-      "localhost",
-      "127.0.0.1"
-    );
-    const up = await probeUrl(probe);
-    const launchKey = `${ws.sandboxId}:${folder}:${job.script}`;
+    const probe = job.probeUrl || `http://127.0.0.1:${preferred}`;
+    const up = await probeLoopbackUrl(probe);
+    const launchKey = `${ws.sandboxId}:${job.folder || folder}:${job.command || job.script}:${preferred}`;
     const starting = recentlyLaunched(launchKey);
     hosts.push({
       role: job.role,
@@ -4362,6 +4098,79 @@ async function setupWorkspace(cfg, action) {
     config.sandbox?.name ||
     "Maintainer Pro App";
 
+  const partnerIgnorePaths = Array.isArray(config.aiIgnorePaths)
+    ? config.aiIgnorePaths
+    : [];
+  const addFolder = Boolean(action.payload?.addFolder);
+  cfg.workspaces = cfg.workspaces || [];
+  const existingIdx = cfg.workspaces.findIndex((w) => w.sandboxId === sandboxId);
+  const existingWs = existingIdx >= 0 ? cfg.workspaces[existingIdx] : null;
+
+  if (addFolder && existingWs?.folderPath) {
+    const extra = Array.isArray(existingWs.extraFolders)
+      ? [...existingWs.extraFolders]
+      : [];
+    if (
+      !sameFolder(existingWs.folderPath, resolved) &&
+      !extra.some((folder) => sameFolder(folder, resolved))
+    ) {
+      extra.push(resolved);
+    }
+    existingWs.extraFolders = extra;
+    const access = applyAccessPolicy(resolved, partnerIgnorePaths, sandboxId);
+    persistWorkspaceEntry(cfg, existingWs);
+    const ports = await resolveWorkspaceHostApps(existingWs, {
+      cfg,
+      allowAi: false,
+      ignoreDesired: true,
+      unionDetected: true,
+      force: true,
+    });
+    const needsReview =
+      Boolean(ports.confused) ||
+      !(ports.apps || []).some((app) => app && app.role !== "ai-server");
+    if (needsReview) {
+      activity(
+        sandboxId,
+        "warn",
+        "Review the suggested apps and ports in Maintainer Pro before Start Apps."
+      );
+    }
+    await inspectHostJobs(existingWs);
+    const host = workspaceHostReport(existingWs);
+    const aiServerUp = await isChatServerOnPort(existingWs.port);
+    log(`setup added folder ${resolved} sandbox=${shortId(sandboxId)}`);
+    return {
+      sandboxId,
+      folderPath: existingWs.folderPath,
+      extraFolders: extra,
+      addFolder: true,
+      addedFolder: resolved,
+      port: existingWs.port,
+      appUrl: host.appUrl || existingWs.appUrl || null,
+      origins: host.origins,
+      wroteEnv: false,
+      clientKind: existingWs.clientKind || "skip",
+      clientFiles: [],
+      clientNotes: [`Added folder ${resolved}`],
+      aiServerUp,
+      startedHosts: [],
+      openUrl: existingWs.appUrl || `http://localhost:${existingWs.port}`,
+      processIssues: issuesForSandbox(sandboxId).map(
+        ({ role: _role, ...issue }) => issue
+      ),
+      warning: needsReview
+        ? "Folder attached. Review the suggested apps and ports in Maintainer Pro, then Start Apps."
+        : "Folder attached. Review apps if needed, then use Start Apps.",
+      waitingForStart: !aiServerUp,
+      needsReview,
+      hostApps: ports.apps || existingWs.hostApps || [],
+      reasons: ports.reasons || [],
+      projectInfo: existingWs.projectInfo || null,
+      ignorePaths: access.ignorePaths,
+    };
+  }
+
   const client = configureClient({
     dir: resolved,
     port,
@@ -4374,24 +4183,22 @@ async function setupWorkspace(cfg, action) {
   const corsOrigin = client.corsOrigin || aiOrigin;
   const appUrl = client.appUrl || corsOrigin;
 
-  const partnerIgnorePaths = Array.isArray(config.aiIgnorePaths)
-    ? config.aiIgnorePaths
-    : [];
   const access = applyAccessPolicy(resolved, partnerIgnorePaths, sandboxId);
 
-  cfg.workspaces = cfg.workspaces || [];
-  const existing = cfg.workspaces.findIndex((w) => w.sandboxId === sandboxId);
   const entry = {
     sandboxId,
     folderPath: resolved,
+    extraFolders: Array.isArray(existingWs?.extraFolders)
+      ? existingWs.extraFolders.filter((folder) => !sameFolder(folder, resolved))
+      : [],
     port,
     sandboxName: config.sandbox?.name,
     applicationName: config.sandbox?.applicationName,
     clientKind: client.kind,
     appUrl,
     sameOrigin: Boolean(client.sameOrigin),
-    appsRequested: false,
-    cloudflarePending: false,
+    appsRequested: existingWs?.appsRequested || false,
+    hostApps: existingWs?.hostApps,
     store: {
       serverKey: String(config.env?.MAINTAINER_PRO_API_KEY || "").trim(),
       clientKey: String(
@@ -4401,7 +4208,7 @@ async function setupWorkspace(cfg, action) {
       ).trim(),
     },
   };
-  if (existing >= 0) cfg.workspaces[existing] = entry;
+  if (existingIdx >= 0) cfg.workspaces[existingIdx] = { ...existingWs, ...entry };
   else cfg.workspaces.push(entry);
   saveConfig(cfg);
 
@@ -4453,7 +4260,9 @@ async function setupWorkspace(cfg, action) {
   const host = workspaceHostReport(entry);
   return {
     sandboxId,
-    folderPath: resolved,
+    folderPath: entry.folderPath,
+    extraFolders: entry.extraFolders || [],
+    addFolder: false,
     port: entry.port,
     appUrl: host.appUrl || entry.appUrl || appUrl,
     origins: host.origins.length
@@ -4478,7 +4287,8 @@ async function setupWorkspace(cfg, action) {
 }
 
 async function proposeSetupForWorkspace(ws, cfg, opts = {}) {
-  const folder = path.resolve(ws.folderPath || "");
+  const folders = workspaceFolders(ws);
+  const folder = folders[0] || path.resolve(ws.folderPath || "");
   const label = ws.sandboxName || shortId(ws.sandboxId) || "sandbox";
   activity(ws.sandboxId, "info", `Suggesting setup for ${label} from config files`);
   try {
@@ -4490,6 +4300,7 @@ async function proposeSetupForWorkspace(ws, cfg, opts = {}) {
     }
     const proposal = await cli.proposeHostAppsFromConfig({
       workspaceDir: folder,
+      workspaceDirs: folders,
       appName: ws.applicationName || ws.sandboxName,
       preferredAiPort: Number(ws.port) || 3100,
       allowAi: opts.allowAi !== false,
@@ -4497,8 +4308,7 @@ async function proposeSetupForWorkspace(ws, cfg, opts = {}) {
     const previous = Array.isArray(ws.hostApps) ? ws.hostApps : [];
     const apps = (proposal.apps || []).map((app) => {
       const match = previous.find((row) => row && row.id === app.id);
-      if (!match || (app.envMaps && app.envMaps.length)) return app;
-      return { ...app, envMaps: match.envMaps || [] };
+      return match ? { ...app, host: match.host === true || app.host === true } : app;
     });
     // Keep last known apps on the workspace; do not auto-apply proposal.
     if (!Array.isArray(ws.hostApps) || !ws.hostApps.length) {
@@ -4565,6 +4375,7 @@ async function runActions(cfg, actions) {
   if (!actions.length) return;
   log(`actions received ${actions.length}: ${actions.map((a) => a.code).join(", ")}`);
   for (const action of actions) {
+    action.code = canonicalActionCode(action.code);
     const startedAt = Date.now();
     const label = actionLabel(action);
     log(`${label} start`);
@@ -4604,12 +4415,17 @@ async function runActions(cfg, actions) {
             partnerIgnorePaths,
             ws.sandboxId
           );
+          const extras = workspaceFolders(ws).slice(1).map((folder) =>
+            applyAccessPolicy(folder, partnerIgnorePaths, ws.sandboxId)
+          );
           log(
-            `access policy synced for ${ws.folderPath} (${access.ignorePaths.length} ignore rules)`
+            `access policy synced for ${workspaceFolders(ws).join(", ")} (${access.ignorePaths.length} ignore rules)`
           );
           result = {
             folderPath: path.resolve(ws.folderPath),
+            extraFolders: workspaceFolders(ws).slice(1),
             ignorePaths: access.ignorePaths,
+            extraIgnorePaths: extras.map((row) => row.ignorePaths),
             syncedAt: new Date().toISOString(),
           };
         }
@@ -4693,14 +4509,14 @@ async function runActions(cfg, actions) {
           });
           if (result.error) ok = false;
         }
-      } else if (action.code === "start_cloudflare_app") {
+      } else if (action.code === "start_share_app") {
         const sandboxId = action.sandboxId || action.payload?.sandboxId;
         const ws = (cfg.workspaces || []).find((w) => w.sandboxId === sandboxId);
         if (!ws) {
           ok = false;
           result = { error: "No folder is attached for this sandbox" };
         } else {
-          result = await startCloudflareForApp(ws, cfg, action.payload || {}, {
+          result = await startShareForApp(ws, cfg, action.payload || {}, {
             actionId: action.id,
           });
           if (result.error) ok = false;
@@ -4805,7 +4621,6 @@ async function runActions(cfg, actions) {
           sandboxId: sandboxId || ws?.sandboxId || null,
           appUrl:
             host.appUrl ||
-            ws?.cloudflareUrl ||
             ws?.appUrl ||
             process.env.APP_URL ||
             process.env.PUBLIC_URL ||
@@ -4817,7 +4632,7 @@ async function runActions(cfg, actions) {
             host.origins.join(",") || "none"
           }`
         );
-      } else if (action.code === "configure_cloudflare") {
+      } else if (action.code === "configure_share") {
         const sandboxId = action.sandboxId || action.payload?.sandboxId;
         const ws =
           (cfg.workspaces || []).find((w) => w.sandboxId === sandboxId) ||
@@ -4838,7 +4653,7 @@ async function runActions(cfg, actions) {
           result = { error: "No folder is attached for this sandbox" };
           warn(`${label} skipped: ${result.error}`);
         } else {
-          result = await configureCloudflareForWorkspace(ws, cfg, {
+          result = await configureShareForWorkspace(ws, cfg, {
             actionId: action.id,
           });
         }
@@ -4846,13 +4661,46 @@ async function runActions(cfg, actions) {
         const sandboxId = String(
           action.sandboxId || action.payload?.sandboxId || ""
         );
-        await forgetLaunch(sandboxId);
-        cfg.workspaces = (cfg.workspaces || []).filter(
-          (w) => w.sandboxId !== sandboxId
-        );
-        saveConfig(cfg);
-        result = { removedSandboxId: sandboxId };
-        log(`${label} removed workspace`);
+        if (action.payload?.keepWorkspace) {
+          const ws = (cfg.workspaces || []).find((w) => w.sandboxId === sandboxId);
+          if (!ws) {
+            ok = false;
+            result = { error: "No folder is attached for this sandbox" };
+          } else {
+            const removed = String(action.payload.folderPath || "");
+            const remaining = Array.isArray(action.payload.extraFolders)
+              ? action.payload.extraFolders
+              : workspaceFolders(ws).filter((folder) => !sameFolder(folder, removed));
+            const primary =
+              String(action.payload.folderPathRemaining || remaining[0] || ws.folderPath);
+            ws.folderPath = primary;
+            ws.extraFolders = remaining.filter((folder) => !sameFolder(folder, primary));
+            ws.hostApps = (Array.isArray(ws.hostApps) ? ws.hostApps : []).filter(
+              (app) =>
+                !app ||
+                app.role === "ai-server" ||
+                !app.folderPath ||
+                !sameFolder(app.folderPath, removed)
+            );
+            persistWorkspaceEntry(cfg, ws);
+            result = {
+              sandboxId,
+              folderPath: ws.folderPath,
+              extraFolders: ws.extraFolders,
+              port: ws.port,
+              hostApps: ws.hostApps,
+            };
+            log(`${label} removed extra folder ${removed}`);
+          }
+        } else {
+          await forgetLaunch(sandboxId);
+          cfg.workspaces = (cfg.workspaces || []).filter(
+            (w) => w.sandboxId !== sandboxId
+          );
+          saveConfig(cfg);
+          result = { removedSandboxId: sandboxId };
+          log(`${label} removed workspace`);
+        }
       } else {
         ok = false;
         result = { error: `Unknown action ${action.code}` };
@@ -5643,7 +5491,6 @@ async function main() {
       clearInterval(watchdogTimer);
       watchdogTimer = null;
     }
-    stopAllCloudflare();
     dropSocket(socket);
     socket = null;
     log("shutting down (other terminals stay open)");