@maintainer-pro/ai-bridge 0.1.7 → 0.1.10

package/src/daemon.mjs

@@ -3,9 +3,8 @@
  * Maintainer Pro bridge — partner machine daemon.
  *
  * Pair once with a code from admin, then manage many sandboxes/folders:
- *   npx @maintainer-pro/ai-bridge --pair ABCD-EF01
- *   npx @maintainer-pro/ai-bridge
- *   npx @maintainer-pro/ai-bridge --admin-url https://… --pair ABCD-EF01
+ *   npx --yes --prefer-online @maintainer-pro/ai-bridge@latest --pair ABCD-EF01
+ *   npm run bridge -- --pair ABCD-EF01 --admin-url http://localhost:4100
  */
 import { spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
@@ -17,14 +16,17 @@ import os from "node:os";
 import path from "node:path";
 import readline from "node:readline";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { createLogger } from "@maintainer-pro/ai-cli";
+import { createLogger, ensureProjectDataDir } from "@maintainer-pro/ai-cli";
+import { findIife, startAiServer } from "@maintainer-pro/ai-server";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PACKAGE_VERSION = readPackageVersion();
 const HEARTBEAT_MS = 15_000;
 const WS_PING_MS = 10_000;
-const WS_RECONNECT_MIN_MS = 500;
-const WS_RECONNECT_MAX_MS = 8_000;
+const WS_RECONNECT_MIN_MS = 1_000;
+const WS_RECONNECT_MAX_MS = 30_000;
+const WS_CONNECT_TIMEOUT_MS = 20_000;
+const WS_WATCHDOG_MS = 5_000;
 
 /** @type {import("@maintainer-pro/ai-cli").Logger} */
 let logger = createLogger("ai-bridge");
@@ -35,6 +37,31 @@ const fail = (msg) => {
   process.exit(1);
 };
 
+/** @type {Map<string, Array<{ at: string, level: string, message: string }>>} */
+const activityBySandbox = new Map();
+
+/** @type {(payload: Record<string, unknown>) => boolean} */
+let bridgeSend = () => false;
+
+function activity(sandboxId, level, message) {
+  const text = String(message || "").trim();
+  if (!text) return;
+  if (level === "error" || level === "warn") warn(text);
+  else log(text);
+  if (!sandboxId) return;
+  const list = activityBySandbox.get(sandboxId) || [];
+  list.push({
+    at: new Date().toISOString(),
+    level: level === "error" || level === "warn" ? level : "info",
+    message: text.slice(0, 500),
+  });
+  activityBySandbox.set(sandboxId, list.slice(-40));
+}
+
+function activityLogFor(sandboxId) {
+  return activityBySandbox.get(sandboxId) || [];
+}
+
 function shortId(value) {
   const text = String(value || "");
   return text.length > 12 ? `${text.slice(0, 8)}…` : text;
@@ -83,6 +110,28 @@ function readPackageVersion() {
   }
 }
 
+async function warnIfBridgeOutdated() {
+  const fromWorkspace = path
+    .normalize(__dirname)
+    .includes(`${path.sep}packages${path.sep}ai-bridge${path.sep}`);
+  if (fromWorkspace) return;
+  try {
+    const res = await fetch(
+      "https://registry.npmjs.org/@maintainer-pro/ai-bridge/latest",
+      { signal: AbortSignal.timeout(2500) }
+    );
+    if (!res.ok) return;
+    const body = await res.json();
+    const latest = typeof body?.version === "string" ? body.version : "";
+    if (!latest || latest === PACKAGE_VERSION) return;
+    warn(
+      `this process is v${PACKAGE_VERSION}; npm latest is v${latest}. Re-run: npx --yes --prefer-online @maintainer-pro/ai-bridge@${latest}`
+    );
+  } catch {
+    // Registry unreachable — keep running the local copy.
+  }
+}
+
 function parseArgs(argv) {
   /** @type {Record<string, string | boolean>} */
   const out = {};
@@ -120,17 +169,19 @@ Pair this machine to your partner account, then configure folders for any
 client sandbox from the Maintainer Pro admin UI.
 
 Usage:
-  npx @maintainer-pro/ai-bridge --pair ABCD-EF01 --admin-url https://admin.example.com
-  npx @maintainer-pro/ai-bridge
-  npx @maintainer-pro/ai-bridge --offer-folder D:\\apps\\client-a
+  npx --yes --prefer-online @maintainer-pro/ai-bridge@latest --pair ABCD-EF01 --admin-url https://admin.example.com
+  npx --yes --prefer-online @maintainer-pro/ai-bridge@latest
+
+  From the SDK repo (local development):
+  npm run bridge -- --pair ABCD-EF01 --admin-url http://localhost:4100
+  npm run bridge
 
 Config is stored in ~/.maintainer-pro/bridge.json (not the cwd).
 
 Flags:
   --pair <code>           Claim a pair code from admin → Bridges page
   --admin-url <url>       Maintainer Pro base URL (required for first pair)
-  --offer-folder <path>   Suggest this folder in admin (repeatable via config)
-  --no-ai-server          Do not open ai-server terminals for workspaces
+  --no-ai-server          Do not start in-process chat for workspaces
   --help
 
 Logging (env):
@@ -143,6 +194,14 @@ function configDir() {
   return path.join(os.homedir(), ".maintainer-pro");
 }
 
+/** Per-sandbox data (apps cache, uploads, logs) — never the host app folder. */
+function dataDirFor(folder, sandboxId) {
+  return ensureProjectDataDir({
+    workspaceDir: folder || "",
+    sandboxId: sandboxId || undefined,
+  });
+}
+
 function configPath() {
   return path.join(configDir(), "bridge.json");
 }
@@ -263,15 +322,11 @@ let aiCliModule = null;
 async function loadAiCli() {
   if (!aiCliModule) {
     aiCliModule = (async () => {
-      try {
-        return await import("@maintainer-pro/ai-cli");
-      } catch {
-        const local = path.resolve(__dirname, "..", "..", "ai-cli", "dist", "index.js");
-        if (fs.existsSync(local)) {
-          return await import(pathToFileURL(local).href);
-        }
-        throw new Error("@maintainer-pro/ai-cli is not installed");
+      const local = path.resolve(__dirname, "..", "..", "ai-cli", "dist", "index.js");
+      if (fs.existsSync(local)) {
+        return await import(pathToFileURL(local).href);
       }
+      return await import("@maintainer-pro/ai-cli");
     })();
   }
   return aiCliModule;
@@ -295,6 +350,85 @@ async function detectCliProviders() {
   }
 }
 
+async function resolveWorkspaceHostApps(ws, opts = {}) {
+  const folder = path.resolve(ws.folderPath || "");
+  const label = ws.sandboxName || shortId(ws.sandboxId) || "sandbox";
+  const desired = Array.isArray(opts.desired)
+    ? opts.desired
+    : Array.isArray(ws.hostApps)
+      ? ws.hostApps
+      : [];
+  try {
+    const cli = await loadAiCli();
+    if (typeof cli.resolveHostApps !== "function") {
+      throw new Error("ai-cli is missing resolveHostApps — update @maintainer-pro/ai-cli");
+    }
+    activity(
+      ws.sandboxId,
+      "info",
+      `detecting ports for ${label} in ${folder} (env first${opts.force ? ", redetect" : ""})`
+    );
+    const result = await cli.resolveHostApps({
+      workspaceDir: folder,
+      appName: ws.applicationName || ws.sandboxName,
+      preferredAiPort: Number(ws.port) || 3100,
+      desired: opts.ignoreDesired ? [] : desired,
+      force: Boolean(opts.force),
+      allowAi: Boolean(opts.allowAi),
+      sandboxId: ws.sandboxId,
+    });
+    const previous = Array.isArray(ws.hostApps) ? ws.hostApps : [];
+    result.apps = result.apps.map((app) => {
+      const match = previous.find((row) => row && row.id === app.id);
+      if (!match || (app.envMaps && app.envMaps.length)) return app;
+      return { ...app, envMaps: match.envMaps || [] };
+    });
+    ws.hostApps = result.apps;
+    if (opts.cfg) persistWorkspaceEntry(opts.cfg, ws);
+    const summary = result.apps
+      .map((app) => `${app.name}:${app.port}`)
+      .join(", ");
+    activity(
+      ws.sandboxId,
+      result.confused ? "warn" : "info",
+      `ports ${result.source}${result.cached ? " cache" : ""}${
+        result.usedAi ? " + ai-cli" : ""
+      }: ${summary || "none"}`
+    );
+    for (const reason of result.reasons || []) {
+      activity(ws.sandboxId, "warn", reason);
+    }
+    return result;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    activity(
+      ws.sandboxId,
+      "warn",
+      `port detect failed (${message}) — using AI server ${Number(ws.port) || 3100} so setup can continue`
+    );
+    if (!Array.isArray(ws.hostApps) || !ws.hostApps.length) {
+      ws.hostApps = [
+        {
+          id: "ai-server",
+          name: "AI server",
+          role: "ai-server",
+          port: Number(ws.port) || 3100,
+          source: "default",
+          locked: true,
+        },
+      ];
+    }
+    return {
+      apps: ws.hostApps,
+      source: "default",
+      cached: false,
+      usedAi: false,
+      confused: true,
+      reasons: [message],
+    };
+  }
+}
+
 function applyProjectInfo(ws, info, cfg) {
   if (!ws || !info) return;
   const folder = path.resolve(ws.folderPath || "");
@@ -328,8 +462,8 @@ function applyProjectInfo(ws, info, cfg) {
 
 const PROJECT_INSPECT_CACHE = "project-inspect.json";
 
-function projectInspectCachePath(folder) {
-  return path.join(folder, ".maintainer-pro", PROJECT_INSPECT_CACHE);
+function projectInspectCachePath(folder, sandboxId) {
+  return path.join(dataDirFor(folder, sandboxId), PROJECT_INSPECT_CACHE);
 }
 
 /** Invalidate cache when package.json / common config files change. */
@@ -378,10 +512,10 @@ function usableCachedProjectInfo(info) {
   return hasKind || hasScript || Boolean(info.summary);
 }
 
-function readProjectInspectCache(folder) {
+function readProjectInspectCache(folder, sandboxId) {
   const resolved = path.resolve(folder || "");
   try {
-    const file = projectInspectCachePath(resolved);
+    const file = projectInspectCachePath(resolved, sandboxId);
     if (!fs.existsSync(file)) return null;
     const data = JSON.parse(fs.readFileSync(file, "utf8"));
     if (!data || typeof data !== "object") return null;
@@ -399,11 +533,11 @@ function readProjectInspectCache(folder) {
   }
 }
 
-function writeProjectInspectCache(folder, info) {
+function writeProjectInspectCache(folder, info, sandboxId) {
   const resolved = path.resolve(folder || "");
   if (!info || !usableCachedProjectInfo(info)) return;
   try {
-    const dir = path.join(resolved, ".maintainer-pro");
+    const dir = dataDirFor(resolved, sandboxId);
     fs.mkdirSync(dir, { recursive: true });
     const fingerprint = projectFingerprint(resolved);
     const payload = {
@@ -423,7 +557,7 @@ function writeProjectInspectCache(folder, info) {
       },
     };
     fs.writeFileSync(
-      projectInspectCachePath(resolved),
+      projectInspectCachePath(resolved, sandboxId),
       `${JSON.stringify(payload, null, 2)}\n`,
       "utf8"
     );
@@ -447,7 +581,7 @@ async function inspectProjectWithAiCli(ws, opts = {}) {
 
   if (!force) {
     const fingerprint = projectFingerprint(folder);
-    const fromDisk = readProjectInspectCache(folder);
+    const fromDisk = readProjectInspectCache(folder, ws.sandboxId);
     const fromWs =
       usableCachedProjectInfo(ws.projectInfo) &&
       (!ws.projectInfo.fingerprint ||
@@ -458,7 +592,7 @@ async function inspectProjectWithAiCli(ws, opts = {}) {
     if (cached) {
       log(`using cached project inspect for ${folder}`);
       applyProjectInfo(ws, { ...cached, fingerprint }, opts.cfg);
-      if (!fromDisk) writeProjectInspectCache(folder, cached);
+      if (!fromDisk) writeProjectInspectCache(folder, cached, ws.sandboxId);
       clearProcessProblem(ws.sandboxId, "project_issue", "inspect");
       return { ...cached, fingerprint, cached: true };
     }
@@ -475,7 +609,7 @@ async function inspectProjectWithAiCli(ws, opts = {}) {
     });
     const fingerprint = projectFingerprint(folder);
     applyProjectInfo(ws, { ...info, fingerprint }, opts.cfg);
-    writeProjectInspectCache(folder, info);
+    writeProjectInspectCache(folder, info, ws.sandboxId);
     if (info.issues?.length) {
       recordProcessProblem({
         sandboxId: ws.sandboxId,
@@ -498,7 +632,7 @@ async function inspectProjectWithAiCli(ws, opts = {}) {
     warn(`ai-cli inspect failed: ${message}`);
     // Fall back to any stale cache so Start Apps can still try.
     const fallback =
-      readProjectInspectCache(folder) ||
+      readProjectInspectCache(folder, ws.sandboxId) ||
       (usableCachedProjectInfo(ws.projectInfo) ? ws.projectInfo : null);
     if (fallback) {
       warn(`falling back to cached project inspect after ai-cli error`);
@@ -559,10 +693,14 @@ function urlWithPort(url, port) {
 
 function isLocalAppUrl(url) {
   try {
-    const host = new URL(url).hostname;
-    return host === "localhost" || host === "127.0.0.1";
+    const parsed = new URL(String(url || "").trim());
+    // Share proxy paths live on the admin host; they are not the listen URL.
+    if (parsed.pathname === "/p" || parsed.pathname.startsWith("/p/")) {
+      return false;
+    }
+    return parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
   } catch {
-    return true;
+    return false;
   }
 }
 
@@ -575,6 +713,71 @@ function persistWorkspaceEntry(cfg, ws) {
   saveConfig(cfg);
 }
 
+/**
+ * Sandbox store keys live on the workspace (and ~/.maintainer-pro/bridge.json),
+ * not in the app .env. Never use the bridge machine token as MAINTAINER_PRO_API_KEY.
+ */
+async function loadSandboxStoreEnv(ws, cfg) {
+  const cached = ws?.store && typeof ws.store === "object" ? ws.store : {};
+  const cachedServer = String(cached.serverKey || "").trim();
+  const cachedClient = String(cached.clientKey || "").trim();
+  if (cachedServer) {
+    return {
+      MAINTAINER_PRO_URL: cfg?.adminUrl || "",
+      MAINTAINER_PRO_API_KEY: cachedServer,
+      MAINTAINER_PRO_CLIENT_API_KEY: cachedClient,
+      NEXT_PUBLIC_MAINTAINER_PRO_CLIENT_API_KEY: cachedClient,
+      NEXT_PUBLIC_MAINTAINER_PRO_URL: cfg?.adminUrl || "",
+    };
+  }
+  if (!cfg?.adminUrl || !cfg.token || !ws?.sandboxId) {
+    return {
+      MAINTAINER_PRO_URL: cfg?.adminUrl || "",
+      MAINTAINER_PRO_API_KEY: "",
+      MAINTAINER_PRO_CLIENT_API_KEY: cachedClient,
+    };
+  }
+  try {
+    const config = await api(
+      cfg.adminUrl,
+      cfg.token,
+      "GET",
+      `/api/v1/bridge/machine/sandboxes/${ws.sandboxId}/setup-config?port=${
+        Number(ws.port) || 3100
+      }`
+    );
+    const env = config?.env && typeof config.env === "object" ? config.env : {};
+    const serverKey = String(env.MAINTAINER_PRO_API_KEY || "").trim();
+    const clientKey = String(
+      env.MAINTAINER_PRO_CLIENT_API_KEY ||
+        env.NEXT_PUBLIC_MAINTAINER_PRO_CLIENT_API_KEY ||
+        ""
+    ).trim();
+    ws.store = { serverKey, clientKey };
+    persistWorkspaceEntry(cfg, ws);
+    return {
+      MAINTAINER_PRO_URL: String(env.MAINTAINER_PRO_URL || cfg.adminUrl || ""),
+      MAINTAINER_PRO_API_KEY: serverKey,
+      MAINTAINER_PRO_CLIENT_API_KEY: clientKey,
+      NEXT_PUBLIC_MAINTAINER_PRO_CLIENT_API_KEY: clientKey,
+      NEXT_PUBLIC_MAINTAINER_PRO_URL: String(
+        env.NEXT_PUBLIC_MAINTAINER_PRO_URL || cfg.adminUrl || ""
+      ),
+    };
+  } catch (err) {
+    warn(
+      `setup-config ${shortId(ws.sandboxId)}: ${
+        err instanceof Error ? err.message : String(err)
+      }`
+    );
+    return {
+      MAINTAINER_PRO_URL: cfg.adminUrl || "",
+      MAINTAINER_PRO_API_KEY: "",
+      MAINTAINER_PRO_CLIENT_API_KEY: cachedClient,
+    };
+  }
+}
+
 function probeUrl(url, timeoutMs = 2500) {
   return new Promise((resolve) => {
     let settled = false;
@@ -609,6 +812,88 @@ function probeUrl(url, timeoutMs = 2500) {
   });
 }
 
+function adminListenPort(cfg = bridgeCfg) {
+  try {
+    const u = new URL(String(cfg?.adminUrl || "http://localhost:4100"));
+    if (u.port) return Number(u.port);
+    return u.protocol === "https:" ? 443 : 80;
+  } catch {
+    return 4100;
+  }
+}
+
+function isAdminListenPort(port, cfg = bridgeCfg) {
+  return Number(port) === adminListenPort(cfg);
+}
+
+function looksLikeEmbedConfig(body, contentType) {
+  const text = String(body || "").trim();
+  if (!text || text.startsWith("<")) return false;
+  const ct = String(contentType || "").toLowerCase();
+  if (ct.includes("html")) return false;
+  return (
+    text.includes("__MAINTAINER_PRO__") || /javascript|ecmascript/.test(ct)
+  );
+}
+
+function probeEmbedConfig(url, timeoutMs = 2500) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (ok) => {
+      if (settled) return;
+      settled = true;
+      resolve(ok);
+    };
+    try {
+      const parsed = new URL(String(url));
+      const lib = parsed.protocol === "https:" ? https : http;
+      const req = lib.get(
+        parsed,
+        {
+          timeout: timeoutMs,
+          rejectUnauthorized: true,
+          headers: { Accept: "application/javascript,*/*" },
+        },
+        (res) => {
+          const chunks = [];
+          res.on("data", (d) => {
+            if (chunks.reduce((n, c) => n + c.length, 0) < 8192) chunks.push(d);
+          });
+          res.on("end", () => {
+            const body = Buffer.concat(chunks).toString("utf8");
+            done(
+              Boolean(res.statusCode && res.statusCode < 400) &&
+                looksLikeEmbedConfig(body, res.headers["content-type"])
+            );
+          });
+        }
+      );
+      req.on("error", () => done(false));
+      req.on("timeout", () => {
+        req.destroy();
+        done(false);
+      });
+    } catch {
+      done(false);
+    }
+  });
+}
+
+function sanitizeAiServerPort(ws) {
+  if (!ws || typeof ws !== "object") return;
+  const apps = Array.isArray(ws.hostApps) ? ws.hostApps : [];
+  for (const app of apps) {
+    if (
+      app &&
+      (app.role === "ai-server" || app.id === "ai-server") &&
+      isAdminListenPort(app.port)
+    ) {
+      app.port = 3100;
+    }
+  }
+  if (isAdminListenPort(ws.port)) ws.port = 3100;
+}
+
 function fetchText(url, timeoutMs = 8000) {
   return new Promise((resolve) => {
     try {
@@ -645,43 +930,33 @@ function fetchText(url, timeoutMs = 8000) {
   });
 }
 
-function listDriveRoots() {
-  if (process.platform !== "win32") return ["/"];
-  const roots = [];
-  for (const letter of "CDEFGHIJKLMNOPQRSTUVWXYZAB") {
-    const root = `${letter}:\\`;
-    try {
-      if (fs.existsSync(root)) roots.push(root);
-    } catch {
-      /* skip */
-    }
-  }
-  return roots.length ? roots : ["C:\\"];
-}
-
-function listDirEntries(dirPath) {
+function listDirEntries(dirPath, allowed) {
   const raw = String(dirPath || "").trim();
   const home = os.homedir();
+  const roots =
+    Array.isArray(allowed) && allowed.length > 0
+      ? allowed.map((p) => path.resolve(p))
+      : [process.cwd()];
+
   if (!raw || raw === "roots") {
-    const roots = listDriveRoots();
+    return listLaunchRoots(roots);
+  }
+
+  const resolved = path.resolve(raw);
+  if (!roots.some((root) => pathInside(resolved, root))) {
     return {
-      path: "",
+      error: "That folder is outside the directory where the bridge is running.",
+      path: resolved,
       parent: null,
       home,
-      entries: roots.map((root) => ({
-        name: root,
-        path: root,
-        isDir: true,
-      })),
+      entries: [],
     };
   }
-
-  const resolved = path.resolve(raw);
   if (!fs.existsSync(resolved) || !fs.statSync(resolved).isDirectory()) {
     return {
       error: "Not a directory",
       path: resolved,
-      parent: path.dirname(resolved),
+      parent: isLaunchRoot(resolved, roots) ? null : path.dirname(resolved),
       home,
       entries: [],
     };
@@ -706,10 +981,11 @@ function listDirEntries(dirPath) {
     if (a.isDir !== b.isDir) return a.isDir ? -1 : 1;
     return a.name.localeCompare(b.name);
   });
+  const atRoot = isLaunchRoot(resolved, roots);
   const parent = path.dirname(resolved);
   return {
     path: resolved,
-    parent: parent === resolved ? null : parent,
+    parent: atRoot ? (roots.length > 1 ? "" : null) : parent === resolved ? null : parent,
     home,
     entries: entries.slice(0, 400),
   };
@@ -743,54 +1019,20 @@ function mergeEnvFile(file, values, opts = {}) {
   fs.writeFileSync(file, body + "\n", "utf8");
 }
 
-function writeProjectEnv(folder, values, opts = {}) {
-  const remove = opts.remove || [];
-  const next = values && typeof values === "object" ? values : {};
-  if (!folder || (!Object.keys(next).length && !remove.length)) return;
-  mergeEnvFile(path.join(folder, ".env"), next, { remove });
-  const localValues = {};
-  for (const [key, value] of Object.entries(next)) {
-    if (
-      key === "PORT" ||
-      key === "APP_URL" ||
-      key === "PUBLIC_URL" ||
-      key === "CORS_ORIGIN" ||
-      key === "AI_SERVER_URL" ||
-      key.startsWith("NEXT_PUBLIC_") ||
-      key.startsWith("VITE_") ||
-      key.startsWith("REACT_APP_")
-    ) {
-      localValues[key] = value;
-    }
-  }
-  const localRemove = remove.filter(
-    (key) =>
-      key === "PORT" ||
-      key === "APP_URL" ||
-      key === "PUBLIC_URL" ||
-      key === "CORS_ORIGIN" ||
-      key === "AI_SERVER_URL" ||
-      key.startsWith("NEXT_PUBLIC_") ||
-      key.startsWith("VITE_") ||
-      key.startsWith("REACT_APP_")
-  );
-  if (Object.keys(localValues).length || localRemove.length) {
-    mergeEnvFile(path.join(folder, ".env.local"), localValues, {
-      remove: localRemove,
-    });
+/**
+ * Do not write Maintainer Pro keys into the app. The bridge injects env into
+ * the process it launches (terminal script / in-process chat).
+ * Only strip leftover trycloudflare values we previously wrote.
+ */
+function writeProjectEnv(folder, _values, opts = {}) {
+  const remove = (opts.remove || []).filter(Boolean);
+  if (!folder || !remove.length) return;
+  for (const name of [".env", ".env.local"]) {
+    const file = path.join(folder, name);
+    if (!fs.existsSync(file)) continue;
+    mergeEnvFile(file, {}, { remove });
   }
-  const keys = Object.entries(next)
-    .map(([key, value]) => `${key}=${value}`)
-    .join(" ");
-  log(
-    `env write ${folder} .env${
-      Object.keys(localValues).length || localRemove.length
-        ? " +.env.local"
-        : ""
-    }${remove.length ? ` remove=${remove.join(",")}` : ""}${
-      keys ? ` ${keys}` : ""
-    }`
-  );
+  log(`env strip ${folder} remove=${remove.join(",")}`);
 }
 
 function originFromUrl(value) {
@@ -822,11 +1064,6 @@ function isTryCloudflareUrl(value) {
   }
 }
 
-function normalizePublicOrigin(value) {
-  const origin = originFromUrl(value);
-  return origin || null;
-}
-
 function readCloudflareTunnelFile(folder) {
   if (!folder) return null;
   const file = path.join(path.resolve(folder), ".cloudflare-tunnel-url");
@@ -856,9 +1093,9 @@ function clearCloudflareTunnelFile(folder) {
 }
 
 /** Stop rediscovering dead trycloudflare URLs from old cloudflared logs. */
-function archiveStaleCloudflareLogs(folder) {
+function archiveStaleCloudflareLogs(folder, sandboxId) {
   if (!folder) return;
-  const logDir = path.join(path.resolve(folder), ".maintainer-pro");
+  const logDir = dataDirFor(folder, sandboxId);
   if (!fs.existsSync(logDir)) return;
   let names = [];
   try {
@@ -883,6 +1120,7 @@ const CLOUDFLARE_ENV_KEYS = [
   "APP_URL",
   "PUBLIC_URL",
   "CORS_ORIGIN",
+  "CORS_ORIGINS",
   "NEXT_PUBLIC_APP_URL",
   "VITE_APP_URL",
   "REACT_APP_APP_URL",
@@ -938,7 +1176,7 @@ function purgeUnreachableCloudflare(ws, cfg, opts = {}) {
   }
 
   // Always archive cf-*.log so dead trycloudflare hosts are not rediscovered.
-  archiveStaleCloudflareLogs(folder);
+  archiveStaleCloudflareLogs(folder, ws.sandboxId);
   if (keep && Object.keys(keep).length) {
     writeTunnelEnv(ws, keep);
   } else {
@@ -958,12 +1196,7 @@ function purgeUnreachableCloudflare(ws, cfg, opts = {}) {
     remove.push(key);
   }
   if (remove.length) {
-    /** @type {Record<string, string>} */
-    const localFallback = {};
-    if (opts.localEnv && typeof opts.localEnv === "object") {
-      Object.assign(localFallback, opts.localEnv);
-    }
-    writeProjectEnv(folder, localFallback, { remove });
+    writeProjectEnv(folder, {}, { remove });
   }
 
   persistWorkspaceEntry(cfg, ws);
@@ -1026,7 +1259,7 @@ function discoverCloudflareTunnels(ws) {
   ];
   for (const [role, value] of envRoles) setRole(role, value);
 
-  const logDir = path.join(folder, ".maintainer-pro");
+  const logDir = dataDirFor(folder, ws.sandboxId);
   if (fs.existsSync(logDir)) {
     const sandboxPrefix = `cf-${String(ws.sandboxId || "").slice(0, 8)}-`;
     let names = [];
@@ -1064,31 +1297,6 @@ function discoverCloudflareTunnels(ws) {
   return Object.keys(tunnels).length ? tunnels : null;
 }
 
-function rememberCloudflareTunnels(sandboxId, tunnels) {
-  if (!sandboxId || !tunnels) return;
-  cloudflareTunnels.set(sandboxId, {
-    tunnels: Object.entries(tunnels)
-      .filter(([, url]) => Boolean(url))
-      .map(([role, publicUrl]) => ({
-        role,
-        localUrl: "",
-        publicUrl: String(publicUrl),
-        logFile: "",
-      })),
-  });
-}
-
-function cloudflareLive(ws) {
-  if (!ws?.sandboxId) return false;
-  if (ws.cloudflarePending) return false;
-  // Only tunnels managed in this process count as live. Persisted
-  // cloudflareUrl / discovered log URLs go stale when apps stop.
-  const row = cloudflareTunnels.get(ws.sandboxId);
-  return Boolean(
-    row?.tunnels?.some((t) => isTryCloudflareUrl(t.publicUrl))
-  );
-}
-
 function workspaceHostReport(ws) {
   /** @type {string[]} */
   const origins = [];
@@ -1097,41 +1305,22 @@ function workspaceHostReport(ws) {
     if (origin && !origins.includes(origin)) origins.push(origin);
   };
   const env = readProjectEnvValues(ws.folderPath);
-  const discovered = discoverCloudflareTunnels(ws);
-  const liveCf = cloudflareLive(ws);
   const chatPort = Number(env.AI_SERVER_PORT || ws.port);
   const uiPort = Number(
     env.PORT || ws.projectInfo?.ports?.ui || ws.projectInfo?.ports?.app
   );
-  const cf =
-    liveCf || discovered
-      ? {
-          ...(typeof ws.cloudflare === "object" && ws.cloudflare
-            ? ws.cloudflare
-            : {}),
-          ...(discovered || {}),
-        }
-      : null;
 
-  if (cf && Object.keys(cf).length) {
-    add(ws.cloudflareUrl);
-    for (const value of Object.values(cf)) add(value);
-    add(env.NEXT_PUBLIC_AI_SERVER_URL);
-    add(env.AI_SERVER_URL);
-    add(env.APP_URL);
-    add(env.NEXT_PUBLIC_APP_URL);
-  } else {
-    for (const value of [
-      env.CORS_ORIGIN,
-      env.APP_URL,
-      env.NEXT_PUBLIC_APP_URL,
-      env.PUBLIC_URL,
-      ws.appUrl,
-    ]) {
-      if (value && isLocalAppUrl(value)) add(value);
-    }
-    add(env.AI_SERVER_URL);
-    add(env.NEXT_PUBLIC_AI_SERVER_URL);
+  for (const value of [
+    env.CORS_ORIGIN,
+    env.APP_URL,
+    env.NEXT_PUBLIC_APP_URL,
+    env.PUBLIC_URL,
+    env.AI_SERVER_URL,
+    env.NEXT_PUBLIC_AI_SERVER_URL,
+    ws.appUrl,
+  ]) {
+    if (!value || isTryCloudflareUrl(value)) continue;
+    add(value);
   }
   if (chatPort) {
     add(`http://localhost:${chatPort}`);
@@ -1142,13 +1331,13 @@ function workspaceHostReport(ws) {
     add(`http://127.0.0.1:${uiPort}`);
   }
 
+  const uiShare = proxyUrlForApp(
+    ws,
+    hostAppOf(ws) || { id: "ui", role: "ui", host: true }
+  );
   let appUrl = null;
-  if (cf?.ui && isTryCloudflareUrl(cf.ui)) {
-    appUrl = normalizePublicOrigin(cf.ui);
-  } else if (ws.cloudflareUrl && isTryCloudflareUrl(ws.cloudflareUrl)) {
-    appUrl = normalizePublicOrigin(ws.cloudflareUrl);
-  } else if (cf?.ai && isTryCloudflareUrl(cf.ai)) {
-    appUrl = normalizePublicOrigin(cf.ai);
+  if (uiShare) {
+    appUrl = uiShare;
   } else if (env.APP_URL && isLocalAppUrl(env.APP_URL)) {
     appUrl = originFromUrl(env.APP_URL);
   } else if (ws.appUrl && isLocalAppUrl(ws.appUrl)) {
@@ -1161,59 +1350,17 @@ function workspaceHostReport(ws) {
   return { appUrl, origins };
 }
 
-/**
- * Probe discovered public URLs and keep only ones that respond.
- * @returns {Promise<{ live: Record<string, string> | null, dead: Record<string, string> }>}
- */
-async function filterReachableCloudflareTunnels(tunnels) {
-  /** @type {Record<string, string>} */
-  const live = {};
-  /** @type {Record<string, string>} */
-  const dead = {};
-  if (!tunnels || !Object.keys(tunnels).length) {
-    return { live: null, dead };
-  }
-  for (const [role, url] of Object.entries(tunnels)) {
-    if (!isTryCloudflareUrl(url)) continue;
-    const normalized = String(url).replace(/\/$/, "");
-    const target =
-      role === "ai"
-        ? `${normalized}/embed-config.js`
-        : normalized;
-    if (await probeUrl(target, 8_000)) {
-      live[role] = normalized;
-    } else {
-      dead[role] = normalized;
-    }
-  }
-  return {
-    live: Object.keys(live).length ? live : null,
-    dead,
-  };
-}
-
-function envNeedsUpdate(folder, desired) {
-  if (!desired || !Object.keys(desired).length) return false;
-  const current = readProjectEnvValues(folder);
-  return Object.entries(desired).some(
-    ([key, value]) => String(current[key] || "") !== String(value)
-  );
-}
-
 /**
  * Status-only reconcile for a workspace:
  * 1) probe chat / ui / backend
- * 2) detect reachable Cloudflare (never starts tunnels)
- * 3) sync base URLs in env when mode or ports changed
- * 4) compute host appUrl + CORS origins for Maintainer Pro
+ * 2) drop leftover trycloudflare URLs (never start or reuse tunnels)
+ * 3) compute host appUrl + CORS origins for Maintainer Pro
  *
- * Does not start apps or Cloudflare.
+ * Does not start apps. Does not write the app's .env files.
  */
 async function reconcileWorkspacePresence(ws, cfg, opts = {}) {
-  const label = ws.sandboxName || shortId(ws.sandboxId) || "sandbox";
-  const writeEnv = opts.writeEnv !== false;
   const timeoutMs = opts.timeoutMs || 800;
-  const folder = path.resolve(ws.folderPath || "");
+  sanitizeAiServerPort(ws);
 
   // 1. Local process probes
   const probe = await probeRunningApps(ws, timeoutMs);
@@ -1221,133 +1368,29 @@ async function reconcileWorkspacePresence(ws, cfg, opts = {}) {
     ws.port = probe.chatPort;
   }
 
-  // 2. Cloudflare detection (never starts tunnels). Purge stale URLs so we
-  // do not keep re-probing dead trycloudflare links from env/logs every tick.
-  const discovered = discoverCloudflareTunnels(ws);
-  const cfCheck = discovered
-    ? await filterReachableCloudflareTunnels(discovered)
-    : { live: null, dead: {} };
-  const reachableCf = cfCheck.live;
-  const deadCf = cfCheck.dead;
-  const managedLive = cloudflareLive(ws);
-
-  if (Object.keys(deadCf).length > 0) {
-    /** @type {Record<string, string>} */
-    let localEnv = {};
-    if (probe.running) {
-      const jobs = probe.hosts
-        .filter((h) => h.up)
-        .map((h) => ({ role: h.role, port: h.port, preferredPort: h.port }));
-      localEnv = envForWorkspacePorts(ws, jobs);
-    }
-    /** @type {Record<string, string> | null} */
-    let keep = reachableCf;
-    if (!keep && managedLive) {
-      const managed = {};
-      for (const t of cloudflareTunnels.get(ws.sandboxId)?.tunnels || []) {
-        if (t?.role && isTryCloudflareUrl(t.publicUrl)) {
-          managed[t.role] = String(t.publicUrl).replace(/\/$/, "");
-        }
-      }
-      keep = Object.keys(managed).length ? managed : null;
-    }
+  // 2. Remove leftover Cloudflare tunnels / env — share URLs replace them.
+  const leftover = discoverCloudflareTunnels(ws);
+  if (leftover || ws.cloudflareUrl || ws.cloudflare) {
     purgeUnreachableCloudflare(ws, cfg, {
-      deadUrls: Object.values(deadCf),
-      keep,
-      localEnv,
+      deadUrls: leftover ? Object.values(leftover) : [],
+      keep: null,
     });
-  }
-
-  const usingCloudflare = Boolean(
-    managedLive || (reachableCf && Object.keys(reachableCf).length)
-  );
-
-  if (reachableCf) {
-    ws.cloudflare = { ...(ws.cloudflare || {}), ...reachableCf };
-    ws.cloudflareUrl = reachableCf.ui || reachableCf.ai || ws.cloudflareUrl || null;
-    if (reachableCf.ui || reachableCf.ai) {
-      ws.appUrl = reachableCf.ui || reachableCf.ai;
-    }
-  } else if (!managedLive) {
-    ws.cloudflareUrl = null;
-    ws.cloudflare = null;
-    if (ws.appUrl && !isLocalAppUrl(ws.appUrl)) ws.appUrl = null;
-  }
-
-  const cfTunnels =
-    usingCloudflare
-      ? {
-          ...(typeof ws.cloudflare === "object" && ws.cloudflare
-            ? ws.cloudflare
-            : {}),
-          ...(reachableCf || {}),
-        }
-      : null;
-
-  // 3. Sync env base URLs when apps are up or Cloudflare is live
-  if (writeEnv && folder && fs.existsSync(folder)) {
-    /** @type {Record<string, string>} */
-    let desired = {};
-    if (cfTunnels && Object.keys(cfTunnels).length) {
-      desired = {
-        ...uiPublicEnv(cfTunnels),
-        AI_SERVER_PORT: String(probe.chatPort || ws.port || 3100),
-      };
-      if (probe.hosts.some((h) => h.role === "ui" || h.role === "app")) {
-        const ui = probe.hosts.find(
-          (h) => (h.role === "ui" || h.role === "app") && h.up
-        );
-        if (ui?.port) desired.PORT = String(ui.port);
-      }
-      if (envNeedsUpdate(folder, desired)) {
-        log(
-          `env sync ${label}: cloudflare urls (${Object.keys(cfTunnels).join(",")})`
-        );
-        writeTunnelEnv(ws, cfTunnels);
-        writeProjectEnv(folder, desired);
-      }
-    } else if (probe.running) {
-      const jobs = probe.hosts
-        .filter((h) => h.up)
-        .map((h) => ({ role: h.role, port: h.port, preferredPort: h.port }));
-      desired = envForWorkspacePorts(ws, jobs);
-      // Drop stale trycloudflare values when running local-only.
-      const current = readProjectEnvValues(folder);
-      /** @type {string[]} */
-      const remove = [];
-      for (const key of [
-        "APP_URL",
-        "PUBLIC_URL",
-        "CORS_ORIGIN",
-        "NEXT_PUBLIC_APP_URL",
-        "VITE_APP_URL",
-        "AI_SERVER_URL",
-        "NEXT_PUBLIC_AI_SERVER_URL",
-        "VITE_AI_SERVER_URL",
-        "REACT_APP_AI_SERVER_URL",
-        "API_URL",
-        "VITE_API_URL",
-        "NEXT_PUBLIC_API_URL",
-      ]) {
-        if (isTryCloudflareUrl(current[key]) && desired[key]) {
-          // overwritten by desired
-        } else if (isTryCloudflareUrl(current[key]) && !desired[key]) {
-          remove.push(key);
-        }
-      }
-      if (envNeedsUpdate(folder, desired) || remove.length) {
-        log(`env sync ${label}: local app urls`);
-        writeProjectEnv(folder, desired, { remove });
-      }
+    try {
+      await stopCloudflare(ws.sandboxId, ws.folderPath);
+    } catch {
+      /* leftover cloudflared */
     }
   }
 
-  // 4. Host + CORS origins for Maintainer Pro
+  // 3. Host + CORS origins for Maintainer Pro
   const host = workspaceHostReport(ws);
-  if (cfTunnels?.ui && isTryCloudflareUrl(cfTunnels.ui)) {
-    host.appUrl = normalizePublicOrigin(cfTunnels.ui);
-  } else if (cfTunnels?.ai && isTryCloudflareUrl(cfTunnels.ai)) {
-    host.appUrl = normalizePublicOrigin(cfTunnels.ai);
+  const uiShare = proxyUrlForApp(ws, hostAppOf(ws) || { id: "ui", role: "ui", host: true });
+  const aiShare = proxyUrlForApp(ws, {
+    id: "ai-server",
+    role: "ai-server",
+  });
+  if (uiShare) {
+    host.appUrl = uiShare;
   } else if (probe.running) {
     const ui = probe.hosts.find(
       (h) => (h.role === "ui" || h.role === "app") && h.up
@@ -1358,6 +1401,12 @@ async function reconcileWorkspacePresence(ws, cfg, opts = {}) {
       host.appUrl = `http://localhost:${probe.chatPort}`;
     }
   }
+  if (uiShare && !host.origins.includes(uiShare)) host.origins.push(uiShare);
+  if (aiShare && !host.origins.includes(aiShare)) host.origins.push(aiShare);
+  const proxyOrigin = String(ws?.proxy?.origin || "").replace(/\/$/, "");
+  if (proxyOrigin && !host.origins.includes(proxyOrigin)) {
+    host.origins.push(proxyOrigin);
+  }
 
   // Ensure probed local origins are always included when processes are up.
   for (const h of probe.hosts) {
@@ -1371,12 +1420,6 @@ async function reconcileWorkspacePresence(ws, cfg, opts = {}) {
     const chatOrigin = `http://localhost:${probe.chatPort}`;
     if (!host.origins.includes(chatOrigin)) host.origins.push(chatOrigin);
   }
-  if (cfTunnels) {
-    for (const value of Object.values(cfTunnels)) {
-      const origin = normalizePublicOrigin(value);
-      if (origin && !host.origins.includes(origin)) host.origins.push(origin);
-    }
-  }
 
   if (host.appUrl) ws.appUrl = host.appUrl;
 
@@ -1395,146 +1438,77 @@ async function reconcileWorkspacePresence(ws, cfg, opts = {}) {
 
   return {
     probe,
-    usingCloudflare,
-    cloudflare: cfTunnels,
+    usingCloudflare: false,
+    cloudflare: null,
     host,
     appsRunning: probe.running,
     aiServerUp: probe.chatUp,
   };
 }
 
-async function reconcileCloudflareState(ws, cfg) {
-  const status = await reconcileWorkspacePresence(ws, cfg, {
-    writeEnv: true,
-    timeoutMs: 2500,
+async function probeHttpPaths(port, paths, timeoutMs = 2500) {
+  const n = Number(port);
+  if (!n) return false;
+  for (const host of ["127.0.0.1", "localhost"]) {
+    for (const suffix of paths) {
+      if (await probeUrl(`http://${host}:${n}${suffix}`, timeoutMs)) return true;
+    }
+  }
+  return false;
+}
+
+function probePortOpen(port, timeoutMs = 800) {
+  const n = Number(port);
+  if (!n) return Promise.resolve(false);
+  return new Promise((resolve) => {
+    const socket = net.connect({ host: "127.0.0.1", port: n });
+    const done = (ok) => {
+      socket.removeAllListeners();
+      socket.destroy();
+      resolve(ok);
+    };
+    socket.setTimeout(timeoutMs);
+    socket.once("connect", () => done(true));
+    socket.once("timeout", () => done(false));
+    socket.once("error", () => done(false));
   });
-  return status.usingCloudflare;
 }
 
-/**
- * If Cloudflare is already running for this folder, attach and share with MP
- * instead of creating new tunnels.
- */
-async function tryAttachExistingCloudflare(ws, cfg, opts = {}) {
-  const progress =
-    typeof opts.onProgress === "function" ? opts.onProgress : async () => {};
-  const label = ws.sandboxName || shortId(ws.sandboxId) || "sandbox";
-  await progress(
-    "Looking for Cloudflare tunnels that are already running for this project…"
-  );
-  const discovered = discoverCloudflareTunnels(ws);
-  if (!discovered) {
-    await progress("No existing Cloudflare tunnel URLs found yet.");
-    return null;
-  }
-  await progress(
-    `Found candidate tunnels: ${Object.entries(discovered)
-      .map(([role, url]) => `${role}=${url}`)
-      .join(", ")}`
-  );
-  const { live, dead } = await filterReachableCloudflareTunnels(discovered);
-  if (!live || (!live.ai && !live.ui)) {
-    if (Object.keys(dead).length) {
-      purgeUnreachableCloudflare(ws, cfg, {
-        deadUrls: Object.values(dead),
-      });
-    }
-    await progress(
-      "Those Cloudflare URLs did not respond — will create fresh tunnels."
-    );
-    return null;
+async function portIsLive(port, timeoutMs = 1200) {
+  const n = Number(port);
+  if (!n) return false;
+  if (
+    await probeHttpPaths(
+      n,
+      ["/", "/embed-config.js", "/health", "/index.html"],
+      timeoutMs
+    )
+  ) {
+    return true;
   }
+  return probePortOpen(n, Math.min(timeoutMs, 800));
+}
 
-  writeTunnelEnv(ws, live);
-  // Make sure the chat script advertises the public AI URL when we have one.
-  if (live.ai) {
-    const reserved = reservedPortsFor(cfg, ws.sandboxId);
-    const up = await probeUrl(
-      `http://127.0.0.1:${Number(ws.port) || 3100}/embed-config.js`
-    );
-    if (up) {
-      launchedAt.delete(`${ws.sandboxId}:${path.resolve(ws.folderPath)}:ai`);
-      await killPort(ws.port);
-      await sleep(1200);
-    }
-    await startAiServerForWorkspace(ws, {
-      reserved,
-      cfg,
-      port: ws.port,
-      env: uiPublicEnv(live),
-    });
-    await waitUntilReachable(
-      `http://127.0.0.1:${ws.port}/embed-config.js`,
-      45_000,
-      "the chat script",
-      progress
-    );
-  }
-
-  const validation = await validateCloudflareGoLive(ws, live, {
-    onProgress: progress,
-  });
-  if (!validation.ok) {
-    await progress(
-      "Existing tunnels failed go-live checks — will recreate if needed."
-    );
-    return null;
-  }
-
-  const appUrl = live.ui || live.ai;
-  ws.cloudflareUrl = appUrl;
-  ws.cloudflare = live;
-  ws.appUrl = appUrl;
-  ws.cloudflarePending = false;
-  ws.appsRequested = true;
-  persistWorkspaceEntry(cfg, ws);
-  rememberCloudflareTunnels(ws.sandboxId, live);
-  clearProcessProblem(ws.sandboxId, "cloudflare_launch", "tunnel");
-  const host = workspaceHostReport(ws);
-  await progress(`Attached to existing Cloudflare: ${host.appUrl || appUrl}`);
-  log(`cloudflare attached (reuse) ${label}: ${appUrl}`);
-
-  return {
-    sandboxId: ws.sandboxId,
-    folderPath: ws.folderPath,
-    port: ws.port,
-    appUrl: host.appUrl || appUrl,
-    origins: host.origins.length
-      ? host.origins
-      : Object.values(live).filter(Boolean),
-    tunnels: live,
-    validation,
-    cloudflare: true,
-    reused: true,
-    attached: true,
-  };
-}
-
-function clearStaleCloudflare(ws) {
-  if (cloudflareLive(ws)) return;
-  if (!ws.cloudflareUrl && !ws.cloudflare) return;
-  if (discoverCloudflareTunnels(ws)) return;
-  const label = ws.sandboxName || shortId(ws.sandboxId) || "sandbox";
-  log(`clearing stale Cloudflare URL for ${label}`);
-  ws.cloudflareUrl = null;
-  ws.cloudflare = null;
-  if (ws.appUrl && !isLocalAppUrl(ws.appUrl)) {
-    ws.appUrl = null;
-  }
-}
-
-async function probeHttpPaths(port, paths, timeoutMs = 2500) {
+async function isChatServerOnPort(port, timeoutMs = 2500) {
   const n = Number(port);
-  if (!n) return false;
-  for (const host of ["127.0.0.1", "localhost"]) {
-    for (const suffix of paths) {
-      if (await probeUrl(`http://${host}:${n}${suffix}`, timeoutMs)) return true;
-    }
-  }
-  return false;
+  if (!n || isAdminListenPort(n)) return false;
+  return (
+    (await probeEmbedConfig(
+      `http://127.0.0.1:${n}/embed-config.js`,
+      timeoutMs
+    )) ||
+    (await probeEmbedConfig(
+      `http://localhost:${n}/embed-config.js`,
+      timeoutMs
+    ))
+  );
 }
 
 async function discoverChatPort(ws, timeoutMs = 2500) {
+  const embedded = ws?.sandboxId ? embeddedChat.get(ws.sandboxId) : null;
+  if (embedded?.port) {
+    return { port: embedded.port, up: true };
+  }
   const env = readProjectEnvValues(ws.folderPath);
   const candidates = [
     Number(ws.port),
@@ -1542,72 +1516,182 @@ async function discoverChatPort(ws, timeoutMs = 2500) {
     portFromText(env.AI_SERVER_URL, 0),
     portFromText(env.NEXT_PUBLIC_AI_SERVER_URL, 0),
     3100,
-  ].filter((port) => port >= 1024);
+  ].filter((port) => port >= 1024 && !isAdminListenPort(port));
   const unique = [...new Set(candidates)];
-  const chatPaths = ["/embed-config.js", "/", "/health"];
   for (const port of unique) {
-    if (await probeHttpPaths(port, chatPaths, timeoutMs)) {
+    if (await isChatServerOnPort(port, timeoutMs)) {
       return { port, up: true };
     }
   }
-  return { port: unique[0] || Number(ws.port) || 3100, up: false };
+  return { port: unique[0] || 3100, up: false };
+}
+
+function hostAppOf(ws) {
+  const apps = Array.isArray(ws.hostApps) ? ws.hostApps : [];
+  return (
+    apps.find((app) => app && app.host === true && app.role !== "ai-server") ||
+    apps.find((app) => app && (app.role === "ui" || app.role === "app")) ||
+    null
+  );
+}
+
+function isBackendApp(app) {
+  if (!app) return false;
+  if (app.role === "backend") return true;
+  if (app.role === "ai-server" || app.id === "ai-server") return false;
+  if (app.host || app.role === "ui") return false;
+  return /backend|api|server/i.test(`${app.id || ""} ${app.name || ""}`);
+}
+
+function usesBridgeProxy(app) {
+  return Boolean(app && proxySlugForApp(app));
+}
+
+function proxySlugForApp(app) {
+  if (!app) return "";
+  if (app.role === "ai-server" || app.id === "ai-server") return "ai";
+  if (isBackendApp(app)) return "backend";
+  if (app.host || app.role === "ui" || app.role === "app") return "ui";
+  const id = String(app.id || "")
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9_-]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+  return id || "app";
+}
+
+function applyAssignedProxy(ws, remote, cfg) {
+  const proxy =
+    remote?.proxy && typeof remote.proxy === "object" ? remote.proxy : null;
+  if (!proxy?.token) return;
+  const origin = String(proxy.origin || cfg?.adminUrl || "").replace(/\/$/, "");
+  const slugs =
+    proxy.slugs && typeof proxy.slugs === "object" ? proxy.slugs : {};
+  /** @type {Record<string, string>} */
+  const urls = {};
+  const apps = Array.isArray(ws.hostApps)
+    ? ws.hostApps
+    : Array.isArray(remote.hostApps)
+      ? remote.hostApps
+      : [];
+  for (const app of apps) {
+    const slug = slugs[app.id] || proxySlugForApp(app);
+    if (!slug || !origin) continue;
+    urls[app.id] = `${origin}/p/${proxy.token}/${slug}`;
+  }
+  ws.proxy = { origin, token: String(proxy.token), slugs, urls };
+}
+
+function proxyUrlForApp(ws, app) {
+  if (!usesBridgeProxy(app)) return "";
+  const urls =
+    ws?.proxy?.urls && typeof ws.proxy.urls === "object" ? ws.proxy.urls : {};
+  if (typeof urls[app?.id] === "string" && urls[app.id]) {
+    return String(urls[app.id]).replace(/\/$/, "");
+  }
+  const origin = String(ws?.proxy?.origin || "").replace(/\/$/, "");
+  const token = String(ws?.proxy?.token || "");
+  const slug =
+    (ws?.proxy?.slugs && app?.id && ws.proxy.slugs[app.id]) ||
+    proxySlugForApp(app);
+  if (!origin || !token || !slug) return "";
+  return `${origin}/p/${token}/${slug}`;
+}
+
+function tunnelRoleForApp(app) {
+  if (!app) return "app";
+  if (app.role === "ai-server") return "ai";
+  if (app.host === true || app.role === "ui" || app.role === "app") return "ui";
+  if (isBackendApp(app)) return "backend";
+  if (app.role === "custom") return "app";
+  return app.role;
+}
+
+function jobsFromHostApps(ws) {
+  const apps = Array.isArray(ws.hostApps) ? ws.hostApps : [];
+  const hostId = hostAppOf(ws)?.id;
+  return apps
+    .filter((app) => app && app.role !== "ai-server")
+    .map((app) => {
+      const port = Number(app.port) || 3000;
+      const command = String(app.startCommand || "").trim();
+      const script = command.replace(/^npm\s+run\s+/, "") || "dev";
+      return {
+        role: isBackendApp(app)
+          ? "backend"
+          : app.role === "custom"
+            ? "app"
+            : app.role || "app",
+        host: app.id === hostId || app.host === true,
+        script,
+        command: command || `npm run ${script}`,
+        preferredPort: port,
+        port,
+        probeUrl: `http://127.0.0.1:${port}`,
+        appId: app.id,
+      };
+    });
 }
 
 async function probeRunningApps(ws, timeoutMs = 2500) {
   const folder = path.resolve(ws.folderPath || "");
-  const env = readProjectEnvValues(ws.folderPath);
   const chat = await discoverChatPort(ws, timeoutMs);
   if (chat.up && Number(ws.port) !== chat.port) {
     ws.port = chat.port;
   }
-  const jobs = planHostJobs(
-    folder,
-    ws.appUrl && isLocalAppUrl(ws.appUrl) ? ws.appUrl : null,
-    ws.projectInfo
-  );
-  /** @type {Array<{ role: string, port: number, up: boolean }>} */
+  const jobs = jobsFromHostApps(ws).length
+    ? jobsFromHostApps(ws)
+    : planHostJobs(
+        folder,
+        ws.appUrl && isLocalAppUrl(ws.appUrl) ? ws.appUrl : null,
+        ws.projectInfo
+      );
+  /** @type {Array<{ role: string, port: number, up: boolean, appId?: string }>} */
   const hosts = [];
   for (const job of jobs) {
-    const candidates = [
-      Number(job.port),
-      Number(job.preferredPort),
-      Number(env.PORT),
-      portFromText(env.APP_URL, 0),
-      portFromText(ws.appUrl, 0),
-    ].filter((port) => port >= 1024);
-    const unique = [...new Set(candidates.length ? candidates : [3000])];
-    let up = false;
-    let port = unique[0];
-    for (const candidate of unique) {
-      const probe = (
-        job.probeUrl || `http://127.0.0.1:${candidate}`
-      ).replace("localhost", "127.0.0.1");
-      const ok =
-        (await probeUrl(probe, timeoutMs)) ||
-        (await probeHttpPaths(candidate, ["/"], timeoutMs));
-      if (ok) {
-        up = true;
-        port = candidate;
-        break;
-      }
-    }
-    hosts.push({ role: job.role, port, up });
+    const port = Number(job.port || job.preferredPort) || 0;
+    const up = port ? await portIsLive(port, timeoutMs) : false;
+    hosts.push({
+      role: job.role,
+      port,
+      up,
+      appId: job.appId || job.role,
+    });
   }
+  const listed = Array.isArray(ws.hostApps) ? ws.hostApps : [];
+  const hostApps = await Promise.all(
+    listed.map(async (app) => {
+      const port = Number(app.port) || 0;
+      const up =
+        (app.role === "ai-server" &&
+          chat.up &&
+          (!port || Number(chat.port) === port)) ||
+        (port ? await portIsLive(port, timeoutMs) : false);
+      return {
+        ...app,
+        port: port || app.port,
+        running: Boolean(up),
+        cloudflareUrl: null,
+        publicUrl: proxyUrlForApp(ws, app) || null,
+        lastCheckedAt: new Date().toISOString(),
+      };
+    })
+  );
   return {
     chatUp: chat.up,
     chatPort: chat.port,
     hosts,
-    running: chat.up || hosts.some((host) => host.up),
+    hostApps,
+    running: chat.up || hosts.some((host) => host.up) || hostApps.some((app) => app.running),
   };
 }
 
 async function restoreHostsAfterReconnect(cfg) {
   for (const ws of cfg.workspaces || []) {
     const label = ws.sandboxName || shortId(ws.sandboxId) || "sandbox";
-    // Status-only: probe apps + Cloudflare, sync env/origins for MP.
-    // Never start apps or tunnels on reconnect.
+    // Status-only: probe apps, drop leftover tunnels, report origins.
+    // Never start apps on reconnect. Never write the app's .env.
     const status = await reconcileWorkspacePresence(ws, cfg, {
-      writeEnv: true,
       timeoutMs: 2500,
     });
     const hostSummary = status.probe.hosts
@@ -1617,17 +1701,15 @@ async function restoreHostsAfterReconnect(cfg) {
       log(
         `found running apps for ${label}: chat=${status.probe.chatPort}${
           status.probe.chatUp ? "(up)" : "(down)"
-        }${hostSummary ? ` ${hostSummary}` : ""} cloudflare=${
-          status.usingCloudflare ? "yes" : "no"
-        } app=${status.host.appUrl || "(none)"} origins=${
+        }${hostSummary ? ` ${hostSummary}` : ""} share=${
+          status.host.appUrl || "(none)"
+        } origins=${
           status.host.origins.join(",") || "none"
         }`
       );
     } else {
       log(
-        `no apps running for ${label}${
-          status.usingCloudflare ? " (cloudflare urls present)" : ""
-        } — waiting for Start Apps from Maintainer Pro`
+        `no apps running for ${label} — waiting for Start Apps from Maintainer Pro`
       );
     }
   }
@@ -1635,11 +1717,10 @@ async function restoreHostsAfterReconnect(cfg) {
 
 function envForWorkspacePorts(ws, jobs) {
   const aiPort = Number(ws.port) || 3100;
-  const publicAi =
-    (typeof ws.cloudflare?.ai === "string" &&
-      isTryCloudflareUrl(ws.cloudflare.ai) &&
-      String(ws.cloudflare.ai).replace(/\/$/, "")) ||
-    "";
+  const aiApp = (Array.isArray(ws.hostApps) ? ws.hostApps : []).find(
+    (app) => app.role === "ai-server" || app.id === "ai-server"
+  ) || { id: "ai-server", role: "ai-server" };
+  const publicAi = proxyUrlForApp(ws, aiApp) || "";
   const ai = publicAi || `http://localhost:${aiPort}`;
   /** @type {Record<string, string>} */
   const env = {
@@ -1648,13 +1729,19 @@ function envForWorkspacePorts(ws, jobs) {
     NEXT_PUBLIC_AI_SERVER_URL: ai,
     VITE_AI_SERVER_URL: ai,
     REACT_APP_AI_SERVER_URL: ai,
+    MAINTAINER_PRO_DATA_DIR: dataDirFor(ws.folderPath, ws.sandboxId),
+    MAINTAINER_PRO_SANDBOX_ID: String(ws.sandboxId || ""),
   };
-  const ui = jobs.find((job) => job.role === "ui" || job.role === "app");
-  const publicUi =
-    (typeof ws.cloudflare?.ui === "string" &&
-      isTryCloudflareUrl(ws.cloudflare.ui) &&
-      String(ws.cloudflare.ui).replace(/\/$/, "")) ||
-    "";
+  const ui =
+    jobs.find((job) => job.host) ||
+    jobs.find((job) => job.role === "ui" || job.role === "app");
+  const uiApp =
+    hostAppOf(ws) ||
+    (Array.isArray(ws.hostApps) ? ws.hostApps : []).find(
+      (app) => app && (app.host || app.role === "ui" || app.role === "app")
+    ) ||
+    { id: "ui", role: "ui", host: true };
+  const publicUi = proxyUrlForApp(ws, uiApp) || "";
   if (publicUi) {
     env.PORT = ui?.port ? String(ui.port) : env.PORT;
     env.APP_URL = publicUi;
@@ -1672,16 +1759,20 @@ function envForWorkspacePorts(ws, jobs) {
   }
   const backend = jobs.find((job) => job.role === "backend");
   if (backend?.port) {
-    const publicBackend =
-      (typeof ws.cloudflare?.backend === "string" &&
-        isTryCloudflareUrl(ws.cloudflare.backend) &&
-        String(ws.cloudflare.backend).replace(/\/$/, "")) ||
-      "";
+    const backendApp = (Array.isArray(ws.hostApps) ? ws.hostApps : []).find(
+      (app) => isBackendApp(app)
+    ) || { id: "backend", role: "backend", port: backend.port };
+    const publicBackend = proxyUrlForApp(ws, backendApp) || "";
     const api = publicBackend || `http://localhost:${backend.port}`;
     env.API_URL = api;
+    env.API_BASE_URL = api;
     env.API_PORT = String(backend.port);
+    env.BACKEND_URL = api;
     env.VITE_API_URL = api;
+    env.VITE_API_BASE_URL = api;
     env.NEXT_PUBLIC_API_URL = api;
+    env.NEXT_PUBLIC_API_BASE_URL = api;
+    env.REACT_APP_API_URL = api;
   }
   return env;
 }
@@ -1695,10 +1786,12 @@ async function prepareWorkspaceLaunch(ws, cfg, reserved) {
     return { aiPort, jobs: [], env: {} };
   }
   log(`ports pick ${label} in ${folder}`);
-  const preferredAi = Number(ws.port) || 3100;
-  const aiUp = await probeUrl(
-    `http://127.0.0.1:${preferredAi}/embed-config.js`
-  );
+  const listedAi = Array.isArray(ws.hostApps)
+    ? ws.hostApps.find((app) => app.role === "ai-server" || app.id === "ai-server")
+    : null;
+  const preferredRaw = Number(listedAi?.port || ws.port) || 3100;
+  const preferredAi = isAdminListenPort(preferredRaw) ? 3100 : preferredRaw;
+  const aiUp = await isChatServerOnPort(preferredAi);
   const aiPort = aiUp
     ? (reserved.add(preferredAi), preferredAi)
     : await findFreePort(preferredAi, reserved);
@@ -1711,11 +1804,13 @@ async function prepareWorkspaceLaunch(ws, cfg, reserved) {
   );
   ws.port = aiPort;
 
-  const jobs = planHostJobs(
-    folder,
-    ws.appUrl && isLocalAppUrl(ws.appUrl) ? ws.appUrl : null,
-    ws.projectInfo
-  );
+  const jobs = jobsFromHostApps(ws).length
+    ? jobsFromHostApps(ws)
+    : planHostJobs(
+        folder,
+        ws.appUrl && isLocalAppUrl(ws.appUrl) ? ws.appUrl : null,
+        ws.projectInfo
+      );
   log(
     jobs.length
       ? `ports jobs ${jobs.map((job) => `${job.role}:${job.script}:${job.preferredPort}`).join(" ")}`
@@ -1749,7 +1844,9 @@ async function prepareWorkspaceLaunch(ws, cfg, reserved) {
   }
 
   const env = envForWorkspacePorts(ws, planned);
-  writeProjectEnv(folder, env);
+  log(
+    `env inject ${label} (process only): ${Object.keys(env).join(" ") || "(none)"}`
+  );
   if (planned.length) {
     ws.projectInfo = {
       ...(ws.projectInfo || {}),
@@ -1768,14 +1865,11 @@ async function prepareWorkspaceLaunch(ws, cfg, reserved) {
   return { aiPort, jobs: planned, env };
 }
 
-const ACCESS_IGNORE_BEGIN = "# maintainer-pro:access-begin";
-const ACCESS_IGNORE_END = "# maintainer-pro:access-end";
 const DEFAULT_AI_IGNORE_PATHS = [
   ".env",
   ".env.*",
   "**/.env",
   "**/.env.*",
-  ".maintainer-pro/",
 ];
 
 function normalizeIgnorePaths(paths) {
@@ -1798,51 +1892,20 @@ function resolveIgnorePaths(partnerPaths) {
   return normalizeIgnorePaths([...DEFAULT_AI_IGNORE_PATHS, ...(partnerPaths || [])]);
 }
 
-function upsertManagedIgnoreFile(existing, ignorePaths) {
-  const block = [
-    ACCESS_IGNORE_BEGIN,
-    "# Managed by Maintainer Pro — do not edit this block by hand.",
-    ...ignorePaths,
-    ACCESS_IGNORE_END,
-    "",
-  ].join("\n");
-  const begin = existing.indexOf(ACCESS_IGNORE_BEGIN);
-  const end = existing.indexOf(ACCESS_IGNORE_END);
-  if (begin >= 0 && end > begin) {
-    const afterEnd = end + ACCESS_IGNORE_END.length;
-    const before = existing.slice(0, begin).replace(/\s+$/, "");
-    const after = existing.slice(afterEnd).replace(/^\r?\n/, "");
-    const parts = [before, block.trimEnd(), after.trimStart()].filter(Boolean);
-    return `${parts.join("\n\n")}\n`;
-  }
-  const trimmed = existing.replace(/\s+$/, "");
-  return trimmed ? `${trimmed}\n\n${block}` : block;
-}
-
 /**
- * Restrict AI CLI to this project folder and write partner ignore paths.
- * @param {string} folder
- * @param {string[]} partnerIgnorePaths
+ * Store partner ignore paths next to the bridge. Does not write into the host app.
  */
-function applyAccessPolicy(folder, partnerIgnorePaths) {
+function applyAccessPolicy(folder, partnerIgnorePaths, sandboxId) {
   const resolved = path.resolve(folder);
   fs.mkdirSync(resolved, { recursive: true });
   const ignorePaths = resolveIgnorePaths(partnerIgnorePaths);
-  const envPath = path.join(resolved, ".env");
-  mergeEnvFile(envPath, {
-    AI_CLI_WORKSPACE: ".",
-    AI_CLI_IGNORE_PATHS: JSON.stringify(
-      normalizeIgnorePaths(partnerIgnorePaths || [])
-    ),
-  });
 
-  const mpDir = path.join(resolved, ".maintainer-pro");
-  fs.mkdirSync(mpDir, { recursive: true });
+  const mpDir = dataDirFor(resolved, sandboxId);
   fs.writeFileSync(
     path.join(mpDir, "access.json"),
     JSON.stringify(
       {
-        workspace: ".",
+        workspace: resolved,
         ignorePaths,
         partnerIgnorePaths: normalizeIgnorePaths(partnerIgnorePaths || []),
         updatedAt: new Date().toISOString(),
@@ -1853,15 +1916,7 @@ function applyAccessPolicy(folder, partnerIgnorePaths) {
     "utf8"
   );
 
-  for (const name of [".cursorignore"]) {
-    const file = path.join(resolved, name);
-    const existing = fs.existsSync(file)
-      ? fs.readFileSync(file, "utf8")
-      : "";
-    fs.writeFileSync(file, upsertManagedIgnoreFile(existing, ignorePaths), "utf8");
-  }
-
-  return { ignorePaths };
+  return { ignorePaths, dataDir: mpDir };
 }
 
 const IGNORE_NAMES = new Set([
@@ -1870,6 +1925,7 @@ const IGNORE_NAMES = new Set([
   "Thumbs.db",
   "node_modules",
   ".maintainer-pro",
+  ".collaborater",
   ".maintainer-pro-bridge.json",
   ".cloudflare-tunnel-url",
 ]);
@@ -1968,161 +2024,9 @@ function emptyProjectIndexHtml(appName) {
 `;
 }
 
-const WIDGET_MARKER = "AiUi.init";
-
-function injectHtmlWidget(html, aiServerUrl) {
-  if (html.includes(WIDGET_MARKER) || html.includes("ai-ui.iife.js")) {
-    return { html, injected: false };
-  }
-  const snippet = `
-<script src="${aiServerUrl}/embed-config.js"></script>
-<script src="${aiServerUrl}/ai-ui.iife.js"></script>
-<script>
-  (function () {
-    var cfg = window.__MAINTAINER_PRO__ || {};
-    if (!cfg.apiUrl) {
-      console.error("Maintainer Pro: embed-config.js missing apiUrl (is ai-server running?)");
-      return;
-    }
-    AiUi.init({
-      apiUrl: cfg.apiUrl,
-      title: "AI Assistant",
-      maintainerProUrl: cfg.maintainerProUrl || undefined,
-      maintainerProApiKey: cfg.maintainerProApiKey || undefined,
-    });
-  })();
-</script>
-`;
-  if (/<\/body>/i.test(html)) {
-    return {
-      html: html.replace(/<\/body>/i, `${snippet}</body>`),
-      injected: true,
-    };
-  }
-  return { html: html + snippet, injected: true };
-}
-
-function nextWidgetComponentSource() {
-  return `"use client";
-
-import { useEffect } from "react";
-
-declare global {
-  interface Window {
-    AiUi?: { init: (opts: Record<string, unknown>) => void; destroy?: () => void };
-    __MAINTAINER_PRO__?: {
-      aiServerUrl?: string;
-      apiUrl?: string;
-      maintainerProUrl?: string;
-      maintainerProApiKey?: string;
-    };
-  }
-}
-
-const AI_SERVER_URL = (process.env.NEXT_PUBLIC_AI_SERVER_URL || "").replace(/\\/$/, "");
-
-export function MaintainerProWidget() {
-  useEffect(() => {
-    if (!AI_SERVER_URL) {
-      console.error("Set NEXT_PUBLIC_AI_SERVER_URL to the ai-server origin");
-      return;
-    }
-    let cancelled = false;
-
-    const start = (cfg: {
-      apiUrl?: string;
-      maintainerProUrl?: string;
-      maintainerProApiKey?: string;
-    }) => {
-      if (cancelled) return;
-      const AiUi = window.AiUi;
-      if (!AiUi?.init) {
-        setTimeout(() => start(cfg), 40);
-        return;
-      }
-      AiUi.init({
-        apiUrl: cfg.apiUrl || \`\${AI_SERVER_URL}/api/chat\`,
-        title: "AI Assistant",
-        maintainerProUrl: cfg.maintainerProUrl,
-        maintainerProApiKey: cfg.maintainerProApiKey,
-      });
-    };
-
-    const ensureScript = (src: string) =>
-      new Promise<void>((resolve, reject) => {
-        const existing = document.querySelector<HTMLScriptElement>(\`script[src="\${src}"]\`);
-        if (existing) {
-          if (existing.dataset.loaded === "1") resolve();
-          else existing.addEventListener("load", () => resolve(), { once: true });
-          return;
-        }
-        const script = document.createElement("script");
-        script.src = src;
-        script.async = true;
-        script.onload = () => {
-          script.dataset.loaded = "1";
-          resolve();
-        };
-        script.onerror = () => reject(new Error(\`Failed to load \${src}\`));
-        document.body.appendChild(script);
-      });
-
-    void (async () => {
-      try {
-        await ensureScript(\`\${AI_SERVER_URL}/embed-config.js\`);
-        await ensureScript(\`\${AI_SERVER_URL}/ai-ui.iife.js\`);
-        start(window.__MAINTAINER_PRO__ || {});
-      } catch (err) {
-        console.error(err);
-      }
-    })();
-
-    return () => {
-      cancelled = true;
-      window.AiUi?.destroy?.();
-    };
-  }, []);
-
-  return null;
-}
-`;
-}
-
-function tryMountNextWidget(dir) {
-  const candidates = [
-    path.join(dir, "app", "layout.tsx"),
-    path.join(dir, "app", "layout.jsx"),
-    path.join(dir, "src", "app", "layout.tsx"),
-    path.join(dir, "src", "app", "layout.jsx"),
-  ];
-  for (const layout of candidates) {
-    if (!fs.existsSync(layout)) continue;
-    let text = fs.readFileSync(layout, "utf8");
-    if (text.includes("MaintainerProWidget")) {
-      return { mounted: false, reason: "already mounted" };
-    }
-    const fromAppRoot =
-      /[/\\]app[/\\]layout\.(t|j)sx$/.test(layout) &&
-      !/[/\\]src[/\\]app[/\\]/.test(layout);
-    const imp = fromAppRoot
-      ? "../components/MaintainerProWidget"
-      : "@/components/MaintainerProWidget";
-
-    text = `import { MaintainerProWidget } from "${imp}";\n` + text;
-    if (/\{children\}/.test(text)) {
-      text = text.replace(
-        /\{children\}/,
-        "{children}\n        <MaintainerProWidget />"
-      );
-      fs.writeFileSync(layout, text, "utf8");
-      return { mounted: true, layout };
-    }
-  }
-  return { mounted: false, reason: "no layout found" };
-}
-
 /**
- * Configure client files for a workspace.
+ * Detect project kind only. Existing host files are never rewritten —
+ * the share proxy injects chat, and Start Apps injects process env.
  */
 function configureClient(opts) {
   const {
@@ -2159,7 +2063,7 @@ function configureClient(opts) {
     if (!fs.existsSync(indexPath)) {
       fs.writeFileSync(indexPath, emptyProjectIndexHtml(appName), "utf8");
       filesWritten.push("index.html");
-      notes.push("Created index.html (served by ai-server).");
+      notes.push("Created index.html (chat served in-process).");
     } else {
       notes.push("index.html already present.");
     }
@@ -2174,27 +2078,13 @@ function configureClient(opts) {
   }
 
   if (kind === "html") {
-    const candidates = [
-      path.join(dir, "index.html"),
-      path.join(dir, "public", "index.html"),
-    ];
-    for (const htmlPath of candidates) {
-      if (!fs.existsSync(htmlPath)) continue;
-      const raw = fs.readFileSync(htmlPath, "utf8");
-      const { html, injected } = injectHtmlWidget(raw, aiOrigin);
-      if (injected) {
-        fs.writeFileSync(htmlPath, html, "utf8");
-        filesWritten.push(path.relative(dir, htmlPath));
-        notes.push(`Injected widget into ${path.relative(dir, htmlPath)}.`);
-      } else {
-        notes.push(`Widget already present in ${path.relative(dir, htmlPath)}.`);
-      }
-      break;
-    }
     const origin = hostAppUrl || "http://localhost:3000";
     return {
       kind: "html",
-      notes,
+      notes: [
+        ...notes,
+        "Existing HTML app — chat is injected on the share URL, the host files are not changed.",
+      ],
       filesWritten,
       corsOrigin: origin,
       appUrl: origin,
@@ -2203,36 +2093,12 @@ function configureClient(opts) {
   }
 
   if (kind === "next") {
-    const envLocal = path.join(dir, ".env.local");
-    mergeEnvFile(envLocal, {
-      NEXT_PUBLIC_AI_SERVER_URL: aiOrigin,
-    });
-    filesWritten.push(".env.local");
-    notes.push("Set NEXT_PUBLIC_AI_SERVER_URL in .env.local.");
-
-    const useSrc = fs.existsSync(path.join(dir, "src", "app"));
-    const compDir = useSrc
-      ? path.join(dir, "src", "components")
-      : path.join(dir, "components");
-    fs.mkdirSync(compDir, { recursive: true });
-    const widgetPath = path.join(compDir, "MaintainerProWidget.tsx");
-    if (!fs.existsSync(widgetPath)) {
-      fs.writeFileSync(widgetPath, nextWidgetComponentSource(), "utf8");
-      filesWritten.push(path.relative(dir, widgetPath));
-      notes.push("Added MaintainerProWidget.tsx.");
-    }
-    const mount = tryMountNextWidget(dir);
-    if (mount.mounted) {
-      notes.push(`Mounted widget in ${path.relative(dir, mount.layout)}.`);
-    } else {
-      notes.push(
-        "Add <MaintainerProWidget /> to your root layout if it is not mounted yet."
-      );
-    }
     const origin = hostAppUrl || "http://localhost:3000";
     return {
       kind: "next",
-      notes,
+      notes: [
+        "Existing Next.js app — chat is injected on the share URL, the host files are not changed.",
+      ],
       filesWritten,
       corsOrigin: origin,
       appUrl: origin,
@@ -2240,14 +2106,10 @@ function configureClient(opts) {
     };
   }
 
-  // other — write host env hints only
+  // other — leave the host app untouched
   const origin = hostAppUrl || "http://localhost:3000";
-  mergeEnvFile(path.join(dir, ".env"), {
-    AI_SERVER_URL: aiOrigin,
-    NEXT_PUBLIC_AI_SERVER_URL: aiOrigin,
-  });
   notes.push(
-    "Existing project detected. Set AI_SERVER_URL / mount the widget manually if needed."
+    "Existing project detected. The bridge injects chat/share env when it starts the app."
   );
   return {
     kind: "other",
@@ -2259,104 +2121,629 @@ function configureClient(opts) {
   };
 }
 
-function collectOfferedFolders(cfg) {
-  /** @type {string[]} */
-  const folders = [];
-  const add = (p) => {
-    if (!p) return;
-    const resolved = path.resolve(p);
-    if (!folders.includes(resolved)) folders.push(resolved);
-  };
-  add(process.cwd());
-  for (const f of cfg.offeredFolders || []) add(f);
-  for (const w of cfg.workspaces || []) add(w.folderPath);
-  return folders;
+function collectOfferedFolders() {
+  return [browseRootFromCwd()];
 }
 
-/** Prevents opening a new window on every heartbeat while a process is starting. */
-const launchedAt = new Map();
-/** @type {Map<string, { tunnels: Array<{ role: string, localUrl: string, publicUrl: string | null, logFile: string }> }>} */
-const cloudflareTunnels = new Map();
+/**
+ * Folder picker root — not `/` or a drive letter.
+ * Windows: `D:\Projects\app` → `D:\Projects`.
+ * macOS/Linux: `~/projects/app` → `~/projects`.
+ */
+function browseRootFromCwd() {
+  const cwd = path.resolve(process.cwd());
+  if (process.platform === "win32") {
+    const drive = path.parse(cwd).root;
+    const first = cwd.slice(drive.length).split(/[\\/]/).filter(Boolean)[0];
+    if (first) return path.resolve(path.join(drive, first));
+    return cwd;
+  }
+  const home = path.resolve(os.homedir());
+  if (pathInside(cwd, home)) {
+    const first = cwd.slice(home.length).split("/").filter(Boolean)[0];
+    if (first) return path.join(home, first);
+    return home;
+  }
+  const bits = cwd.split("/").filter(Boolean);
+  if (bits[0] === "Volumes" && bits[1]) {
+    return path.join("/", bits[0], bits[1]);
+  }
+  if (bits[0]) return path.join("/", bits[0]);
+  return cwd;
+}
 
-/** Last process problems to send on heartbeat. Key: sandboxId::code::role */
-const processProblems = new Map();
+function normalizeFsPath(p) {
+  let s = path.resolve(String(p || "").trim());
+  if (process.platform === "win32") {
+    s = s.replace(/\//g, "\\");
+    if (/^[a-zA-Z]:$/.test(s)) s = `${s}\\`;
+    else s = s.replace(/\\+$/, "");
+    if (/^[a-zA-Z]:$/.test(s)) s = `${s}\\`;
+    return s.toLowerCase();
+  }
+  if (s !== "/") s = s.replace(/\/+$/, "");
+  return s;
+}
 
-/** @type {Map<string, Set<string>>} sandboxId -> CMD/terminal titles we opened */
-const openedTerminalTitles = new Map();
+function pathInside(inner, outer) {
+  const a = normalizeFsPath(inner);
+  const b = normalizeFsPath(outer);
+  if (!a || !b) return false;
+  if (a === b) return true;
+  const sep = process.platform === "win32" ? "\\" : "/";
+  const prefix = b.endsWith(sep) ? b : `${b}${sep}`;
+  return a.startsWith(prefix);
+}
 
-function rememberTerminalTitle(sandboxId, title) {
-  const id = String(sandboxId || "").trim();
-  const name = String(title || "").trim();
-  if (!id || !name) return;
-  let titles = openedTerminalTitles.get(id);
-  if (!titles) {
-    titles = new Set();
-    openedTerminalTitles.set(id, titles);
-  }
-  titles.add(name);
+function isLaunchRoot(dirPath, allowed) {
+  const resolved = path.resolve(dirPath);
+  return allowed.some((root) => normalizeFsPath(root) === normalizeFsPath(resolved));
 }
 
-function closeWindowsByTitle(title) {
-  const name = String(title || "").trim();
-  if (!name) return Promise.resolve();
-  return new Promise((resolve) => {
-    const done = () => resolve();
-    if (process.platform === "win32") {
-      const child = spawn(
-        "taskkill",
-        ["/F", "/T", "/FI", `WINDOWTITLE eq ${name}*`],
-        { windowsHide: true, stdio: "ignore" }
-      );
-      child.on("exit", done);
-      child.on("error", done);
-      setTimeout(done, 4000);
-      return;
-    }
-    if (process.platform === "darwin") {
-      const child = spawn(
-        "osascript",
-        [
-          "-e",
-          `tell application "Terminal" to close (every window whose name contains ${JSON.stringify(name)})`,
-        ],
-        { stdio: "ignore" }
-      );
-      child.on("exit", done);
-      child.on("error", done);
-      setTimeout(done, 4000);
-      return;
-    }
-    done();
-  });
+function listLaunchRoots(allowed) {
+  const home = os.homedir();
+  if (allowed.length === 1) return listDirEntries(allowed[0], allowed);
+  return {
+    path: "",
+    parent: null,
+    home,
+    entries: allowed.map((root) => ({
+      name: root.split(/[/\\]/).filter(Boolean).slice(-1)[0] || root,
+      path: root,
+      isDir: true,
+    })),
+  };
 }
 
-async function closeRememberedTerminals(sandboxId) {
-  const titles = openedTerminalTitles.get(sandboxId);
-  if (!titles) return;
-  for (const title of titles) {
-    await closeWindowsByTitle(title);
+/** Prevents opening a new window on every heartbeat while a process is starting. */
+const launchedAt = new Map();
+/** @type {Map<string, { tunnels: Array<{ role: string, localUrl: string, publicUrl: string | null, logFile: string }> }>} */
+const cloudflareTunnels = new Map();
+/** In-process chat servers, one per sandbox/project. */
+/** @type {Map<string, { port: number, workspaceDir: string, close: () => Promise<void>, runChat: (body: Record<string, unknown>) => Promise<{ ok: boolean, status: number, data: Record<string, unknown> }>, handleHttp?: Function }>} */
+const embeddedChat = new Map();
+/** @type {Map<string, Promise<object | null>>} */
+const embeddedChatStarting = new Map();
+
+const PROXY_CHUNK_BYTES = 32 * 1024;
+/** @type {Map<string, import("node:http").ClientRequest>} */
+const proxyHttpReqs = new Map();
+/** @type {Map<string, WebSocket>} */
+const proxyLocalSockets = new Map();
+/** @type {Record<string, unknown> | null} */
+let bridgeCfg = null;
+
+function safeProxyPath(path) {
+  const raw = String(path || "/");
+  if (!raw.startsWith("/") || raw.startsWith("//")) return "/";
+  return raw;
+}
+
+function workspaceForProxy(sandboxId) {
+  return (
+    (Array.isArray(bridgeCfg?.workspaces) ? bridgeCfg.workspaces : []).find(
+      (row) => row.sandboxId === sandboxId
+    ) || null
+  );
+}
+
+function localPortForProxy(ws, appId) {
+  const apps = Array.isArray(ws?.hostApps) ? ws.hostApps : [];
+  const app = apps.find((row) => row.id === appId);
+  let port = 0;
+  if (app && usesBridgeProxy(app) && Number(app.port)) port = Number(app.port);
+  else if (appId === "ai-server" || app?.role === "ai-server") {
+    port = Number(ws.port) || 3100;
   }
-  openedTerminalTitles.delete(sandboxId);
+  if (
+    (appId === "ai-server" || app?.role === "ai-server") &&
+    isAdminListenPort(port)
+  ) {
+    return 3100;
+  }
+  return port;
 }
 
-async function forgetLaunch(sandboxId) {
-  for (const key of [...launchedAt.keys()]) {
-    if (key === sandboxId || key.startsWith(`${sandboxId}:`)) {
-      launchedAt.delete(key);
+function proxyReqHeaders(incoming) {
+  /** @type {Record<string, string>} */
+  const headers = {};
+  if (!incoming || typeof incoming !== "object") return headers;
+  for (const [key, value] of Object.entries(incoming)) {
+    const lower = String(key).toLowerCase();
+    if (
+      [
+        "connection",
+        "keep-alive",
+        "transfer-encoding",
+        "upgrade",
+        "host",
+        "content-length",
+        "te",
+        "trailer",
+      ].includes(lower)
+    ) {
+      continue;
     }
+    if (typeof value === "string" && value) headers[key] = value;
   }
-  for (const key of [...processProblems.keys()]) {
-    if (key.startsWith(`${sandboxId}::`)) processProblems.delete(key);
-  }
-  await closeRememberedTerminals(sandboxId);
-  await stopCloudflare(sandboxId);
+  return headers;
 }
 
-function problemKey(sandboxId, code, role = "") {
-  return `${sandboxId || ""}::${code}::${role}`;
+function isAiServerAppId(appId, ws) {
+  if (appId === "ai-server") return true;
+  const apps = Array.isArray(ws?.hostApps) ? ws.hostApps : [];
+  const app = apps.find((row) => row.id === appId);
+  return Boolean(app && (app.role === "ai-server" || app.id === "ai-server"));
 }
 
-function clipIssueText(text, max) {
+function replyProxyHttp(id, status, headers, body) {
+  const stream = randomBytes(8).toString("hex");
+  const buf = Buffer.isBuffer(body) ? body : Buffer.from(body || "");
+  /** @type {Record<string, string>} */
+  const out = {};
+  for (const [key, value] of Object.entries(headers || {})) {
+    if (value == null) continue;
+    out[String(key)] = String(value);
+  }
+  bridgeSend({ type: "proxy.http.start", id, stream, status, headers: out });
+  for (let offset = 0; offset < buf.length; offset += PROXY_CHUNK_BYTES) {
+    const end = Math.min(offset + PROXY_CHUNK_BYTES, buf.length);
+    bridgeSend({
+      type: "proxy.http.chunk",
+      id,
+      stream,
+      data: buf.subarray(offset, end).toString("base64"),
+      eof: false,
+    });
+  }
+  bridgeSend({ type: "proxy.http.chunk", id, stream, data: "", eof: true });
+}
+
+function bridgeEmbedConfigJs(ws) {
+  const store = ws?.store && typeof ws.store === "object" ? ws.store : {};
+  const aiApp = { id: "ai-server", role: "ai-server" };
+  const ai = (
+    proxyUrlForApp(ws, aiApp) ||
+    `http://127.0.0.1:${Number(ws.port) || 3100}`
+  ).replace(/\/$/, "");
+  const wsUrl = ai.replace(/^http/i, "ws");
+  const payload = {
+    aiServerUrl: ai,
+    apiUrl: `${ai}/api/chat`,
+    aiServerWsUrl: `${wsUrl}/api/ws`,
+    debug: true,
+    logLevel: "debug",
+    maintainerProUrl: bridgeCfg?.adminUrl || "",
+    maintainerProApiKey: String(store.clientKey || "").trim(),
+  };
+  return `window.__MAINTAINER_PRO__=${JSON.stringify(payload)};`;
+}
+
+async function handleAiProxyHttpFromAdmin(msg, ws) {
+  const id = typeof msg.id === "string" ? msg.id : "";
+  const method = String(msg.method || "GET").toUpperCase();
+  const reqPath = safeProxyPath(msg.path);
+  const pathname = reqPath.split("?")[0] || "/";
+  const headers = proxyReqHeaders(msg.headers);
+  const body =
+    typeof msg.body === "string" && msg.body
+      ? Buffer.from(msg.body, "base64")
+      : Buffer.alloc(0);
+
+  if (pathname === "/ai-ui.iife.js") {
+    const file = findIife();
+    if (!file || !fs.existsSync(file)) {
+      replyProxyHttp(
+        id,
+        404,
+        { "content-type": "text/plain; charset=utf-8" },
+        "Not found"
+      );
+      return;
+    }
+    replyProxyHttp(
+      id,
+      200,
+      {
+        "content-type": "text/javascript; charset=utf-8",
+        "cache-control": "no-store",
+      },
+      fs.readFileSync(file)
+    );
+    return;
+  }
+
+  if (pathname === "/embed-config.js") {
+    const cfg = bridgeCfg || loadConfig();
+    await loadSandboxStoreEnv(ws, cfg);
+    replyProxyHttp(
+      id,
+      200,
+      {
+        "content-type": "text/javascript; charset=utf-8",
+        "cache-control": "no-store",
+      },
+      bridgeEmbedConfigJs(ws)
+    );
+    return;
+  }
+
+  let embedded = ws.sandboxId ? embeddedChat.get(ws.sandboxId) : null;
+  if (!embedded?.handleHttp) {
+    embedded = await ensureEmbeddedChat(ws);
+  }
+  if (embedded?.handleHttp) {
+    try {
+      const result = await embedded.handleHttp({
+        method,
+        url: reqPath,
+        headers,
+        body,
+      });
+      replyProxyHttp(id, result.status, result.headers, result.body);
+    } catch (err) {
+      bridgeSend({
+        type: "proxy.http.error",
+        id,
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+    return;
+  }
+
+  bridgeSend({
+    type: "proxy.http.error",
+    id,
+    error: "AI chat is not running. Use Start Apps in Maintainer Pro.",
+  });
+}
+
+function handleProxyHttpFromAdmin(msg) {
+  const id = typeof msg.id === "string" ? msg.id : "";
+  const sandboxId = typeof msg.sandboxId === "string" ? msg.sandboxId : "";
+  const appId = typeof msg.appId === "string" ? msg.appId : "";
+  if (!id) return;
+  const ws = workspaceForProxy(sandboxId);
+  if (!ws) {
+    bridgeSend({
+      type: "proxy.http.error",
+      id,
+      error: "No local port mapped for that app",
+    });
+    return;
+  }
+  if (isAiServerAppId(appId, ws)) {
+    void handleAiProxyHttpFromAdmin(msg, ws);
+    return;
+  }
+  const existing = proxyHttpReqs.get(id);
+  if (existing) {
+    try {
+      existing.destroy();
+    } catch {
+      /* ignore */
+    }
+    proxyHttpReqs.delete(id);
+  }
+  const port = localPortForProxy(ws, appId);
+  if (!port) {
+    bridgeSend({
+      type: "proxy.http.error",
+      id,
+      error: "No local port mapped for that app",
+    });
+    return;
+  }
+  const method = String(msg.method || "GET").toUpperCase();
+  const path = safeProxyPath(msg.path);
+  const headers = proxyReqHeaders(msg.headers);
+  headers.host = `127.0.0.1:${port}`;
+  // Next.js dev 403s `/_next` when Origin/sec-fetch look cross-site.
+  // This hop is server-to-server; drop those so chunks always load.
+  for (const key of Object.keys(headers)) {
+    const lower = key.toLowerCase();
+    if (
+      lower === "origin" ||
+      lower === "referer" ||
+      lower === "referrer" ||
+      lower === "sec-fetch-site" ||
+      lower === "sec-fetch-mode" ||
+      lower === "sec-fetch-dest"
+    ) {
+      delete headers[key];
+    }
+  }
+  const stream = randomBytes(8).toString("hex");
+  let req;
+  try {
+    req = http.request(
+      {
+        hostname: "127.0.0.1",
+        port,
+        path,
+        method,
+        headers,
+        agent: false,
+      },
+      (res) => {
+        /** @type {Record<string, string>} */
+        const outHeaders = {};
+        for (const [key, value] of Object.entries(res.headers)) {
+          if (value == null) continue;
+          outHeaders[key] = Array.isArray(value) ? value.join(", ") : String(value);
+        }
+        bridgeSend({
+          type: "proxy.http.start",
+          id,
+          stream,
+          status: res.statusCode || 502,
+          headers: outHeaders,
+        });
+        res.on("data", (chunk) => {
+          const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+          for (let offset = 0; offset < buf.length; offset += PROXY_CHUNK_BYTES) {
+            const end = Math.min(offset + PROXY_CHUNK_BYTES, buf.length);
+            bridgeSend({
+              type: "proxy.http.chunk",
+              id,
+              stream,
+              data: Buffer.from(buf.subarray(offset, end)).toString("base64"),
+              eof: false,
+            });
+          }
+        });
+        res.on("end", () => {
+          proxyHttpReqs.delete(id);
+          bridgeSend({ type: "proxy.http.chunk", id, stream, data: "", eof: true });
+        });
+      }
+    );
+  } catch (err) {
+    bridgeSend({
+      type: "proxy.http.error",
+      id,
+      error: err instanceof Error ? err.message : String(err),
+    });
+    return;
+  }
+  req.on("error", (err) => {
+    proxyHttpReqs.delete(id);
+    bridgeSend({
+      type: "proxy.http.error",
+      id,
+      error: err instanceof Error ? err.message : String(err),
+    });
+  });
+  proxyHttpReqs.set(id, req);
+  if (typeof msg.body === "string" && msg.body) {
+    req.write(Buffer.from(msg.body, "base64"));
+  }
+  if (msg.bodyEof !== false) req.end();
+}
+
+function handleProxyHttpBodyFromAdmin(msg) {
+  const id = typeof msg.id === "string" ? msg.id : "";
+  const req = proxyHttpReqs.get(id);
+  if (!req) return;
+  if (typeof msg.data === "string" && msg.data) {
+    req.write(Buffer.from(msg.data, "base64"));
+  }
+  if (msg.eof === true) req.end();
+}
+
+function wsDataToBuffer(data) {
+  if (typeof data === "string") return Buffer.from(data);
+  if (Buffer.isBuffer(data)) return data;
+  if (data instanceof ArrayBuffer) return Buffer.from(data);
+  if (ArrayBuffer.isView(data)) {
+    return Buffer.from(data.buffer, data.byteOffset, data.byteLength);
+  }
+  throw new Error("Unsupported WebSocket payload type");
+}
+
+function attachProxyLocalWs(id, socket) {
+  try {
+    socket.binaryType = "arraybuffer";
+  } catch {
+    /* WHATWG WebSocket in Node 22 */
+  }
+  proxyLocalSockets.set(id, socket);
+  socket.addEventListener("open", () => {
+    bridgeSend({ type: "proxy.ws.opened", id });
+  });
+  socket.addEventListener("message", (event) => {
+    try {
+      if (typeof event.data === "string") {
+        bridgeSend({
+          type: "proxy.ws.frame",
+          id,
+          data: event.data,
+          binary: false,
+        });
+        return;
+      }
+      const buf = wsDataToBuffer(event.data);
+      bridgeSend({
+        type: "proxy.ws.frame",
+        id,
+        data: buf.toString("base64"),
+        binary: true,
+      });
+    } catch (err) {
+      logger.warn(
+        `proxy ws frame encode failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  });
+  socket.addEventListener("close", (event) => {
+    proxyLocalSockets.delete(id);
+    bridgeSend({
+      type: "proxy.ws.close",
+      id,
+      code: event.code,
+      reason: event.reason || "",
+    });
+  });
+  socket.addEventListener("error", () => {
+    /* close handler follows */
+  });
+}
+
+function openProxyLocalWs(id, port, path) {
+  let socket;
+  try {
+    socket = new WebSocket(`ws://127.0.0.1:${port}${path}`);
+  } catch (err) {
+    bridgeSend({
+      type: "proxy.ws.error",
+      id,
+      error: err instanceof Error ? err.message : String(err),
+    });
+    return;
+  }
+  attachProxyLocalWs(id, socket);
+}
+
+function handleProxyWsOpenFromAdmin(msg) {
+  const id = typeof msg.id === "string" ? msg.id : "";
+  const sandboxId = typeof msg.sandboxId === "string" ? msg.sandboxId : "";
+  const appId = typeof msg.appId === "string" ? msg.appId : "";
+  if (!id) return;
+  const ws = workspaceForProxy(sandboxId);
+  if (!ws) {
+    bridgeSend({ type: "proxy.ws.error", id, error: "No local port mapped" });
+    return;
+  }
+  const path = safeProxyPath(msg.path);
+  if (isAiServerAppId(appId, ws)) {
+    void (async () => {
+      const embedded = await ensureEmbeddedChat(ws);
+      const port = Number(embedded?.port) || localPortForProxy(ws, appId);
+      if (!port) {
+        bridgeSend({ type: "proxy.ws.error", id, error: "AI chat is not running" });
+        return;
+      }
+      openProxyLocalWs(id, port, path);
+    })();
+    return;
+  }
+  const port = localPortForProxy(ws, appId);
+  if (!port) {
+    bridgeSend({ type: "proxy.ws.error", id, error: "No local port mapped" });
+    return;
+  }
+  openProxyLocalWs(id, port, path);
+}
+
+function handleProxyWsFrameFromAdmin(msg) {
+  const id = typeof msg.id === "string" ? msg.id : "";
+  const socket = proxyLocalSockets.get(id);
+  if (!socket || socket.readyState !== 1) return;
+  try {
+    if (msg.binary === true) {
+      socket.send(Buffer.from(String(msg.data || ""), "base64"));
+    } else {
+      socket.send(String(msg.data || ""));
+    }
+  } catch {
+    /* ignore */
+  }
+}
+
+function handleProxyWsCloseFromAdmin(msg) {
+  const id = typeof msg.id === "string" ? msg.id : "";
+  const socket = proxyLocalSockets.get(id);
+  if (!socket) return;
+  proxyLocalSockets.delete(id);
+  try {
+    socket.close(
+      typeof msg.code === "number" ? msg.code : 1000,
+      typeof msg.reason === "string" ? msg.reason.slice(0, 120) : ""
+    );
+  } catch {
+    /* ignore */
+  }
+}
+
+/** Last process problems to send on heartbeat. Key: sandboxId::code::role */
+const processProblems = new Map();
+
+/** @type {Map<string, Set<string>>} sandboxId -> CMD/terminal titles we opened */
+const openedTerminalTitles = new Map();
+
+function rememberTerminalTitle(sandboxId, title) {
+  const id = String(sandboxId || "").trim();
+  const name = String(title || "").trim();
+  if (!id || !name) return;
+  let titles = openedTerminalTitles.get(id);
+  if (!titles) {
+    titles = new Set();
+    openedTerminalTitles.set(id, titles);
+  }
+  titles.add(name);
+}
+
+function closeWindowsByTitle(title) {
+  const name = String(title || "").trim();
+  if (!name) return Promise.resolve();
+  return new Promise((resolve) => {
+    const done = () => resolve();
+    if (process.platform === "win32") {
+      const child = spawn(
+        "taskkill",
+        ["/F", "/T", "/FI", `WINDOWTITLE eq ${name}*`],
+        { windowsHide: true, stdio: "ignore" }
+      );
+      child.on("exit", done);
+      child.on("error", done);
+      setTimeout(done, 4000);
+      return;
+    }
+    if (process.platform === "darwin") {
+      const child = spawn(
+        "osascript",
+        [
+          "-e",
+          `tell application "Terminal" to close (every window whose name contains ${JSON.stringify(name)})`,
+        ],
+        { stdio: "ignore" }
+      );
+      child.on("exit", done);
+      child.on("error", done);
+      setTimeout(done, 4000);
+      return;
+    }
+    done();
+  });
+}
+
+async function closeRememberedTerminals(sandboxId) {
+  const titles = openedTerminalTitles.get(sandboxId);
+  if (!titles) return;
+  for (const title of titles) {
+    await closeWindowsByTitle(title);
+  }
+  openedTerminalTitles.delete(sandboxId);
+}
+
+async function forgetLaunch(sandboxId) {
+  for (const key of [...launchedAt.keys()]) {
+    if (key === sandboxId || key.startsWith(`${sandboxId}:`)) {
+      launchedAt.delete(key);
+    }
+  }
+  for (const key of [...processProblems.keys()]) {
+    if (key.startsWith(`${sandboxId}::`)) processProblems.delete(key);
+  }
+  await closeRememberedTerminals(sandboxId);
+  await stopCloudflare(sandboxId);
+}
+
+function problemKey(sandboxId, code, role = "") {
+  return `${sandboxId || ""}::${code}::${role}`;
+}
+
+function clipIssueText(text, max) {
   const value = String(text || "").trim();
   if (value.length <= max) return value;
   return `${value.slice(0, max - 1)}…`;
@@ -2518,8 +2905,8 @@ function friendlyLaunchError(raw, title) {
   return text || `Could not open a terminal for "${title}".`;
 }
 
-function writeWinLaunchScript(folder, title, command, env) {
-  const dir = path.join(folder, ".maintainer-pro");
+function writeWinLaunchScript(folder, title, command, env, sandboxId) {
+  const dir = dataDirFor(folder, sandboxId);
   fs.mkdirSync(dir, { recursive: true });
   const safe = String(title || "app").replace(/[^a-zA-Z0-9._-]+/g, "-");
   const file = path.join(dir, `launch-${safe}.cmd`);
@@ -2651,7 +3038,13 @@ async function openInNewTerminal(opts) {
       const safeTitle =
         String(title || "Maintainer Pro").replace(/["&<>|^]/g, " ").trim() ||
         "Maintainer Pro";
-      const script = writeWinLaunchScript(folder, safeTitle, command, env);
+      const script = writeWinLaunchScript(
+        folder,
+        safeTitle,
+        command,
+        env,
+        sandboxId
+      );
       log(`terminal script [${title}] ${script}`);
       const opened = await openWindowsConsole(script, folder);
       if (!opened.ok) {
@@ -2708,12 +3101,56 @@ function commandWithPort(job, scripts, port) {
   return job.command;
 }
 
+async function stopEmbeddedChat(sandboxId) {
+  const inst = embeddedChat.get(sandboxId);
+  if (!inst) return;
+  embeddedChat.delete(sandboxId);
+  try {
+    await inst.close();
+  } catch {
+    /* ignore */
+  }
+}
+
+async function stopAllEmbeddedChat() {
+  const ids = [...embeddedChat.keys()];
+  await Promise.all(ids.map((id) => stopEmbeddedChat(id)));
+}
+
+async function ensureEmbeddedChat(ws) {
+  if (!ws?.sandboxId) return null;
+  const existing = embeddedChat.get(ws.sandboxId);
+  if (existing?.handleHttp) return existing;
+  const inflight = embeddedChatStarting.get(ws.sandboxId);
+  if (inflight) return inflight;
+  const task = (async () => {
+    const cfg = bridgeCfg || loadConfig();
+    const jobs = jobsFromHostApps(ws);
+    const shareEnv = {
+      ...envForWorkspacePorts(ws, jobs),
+      ...uiPublicEnv({}, ws),
+    };
+    log(`lazy-start in-process chat for ${ws.sandboxName || shortId(ws.sandboxId)}`);
+    const result = await startAiServerForWorkspace(ws, {
+      cfg,
+      env: shareEnv,
+      forceEmbed: true,
+    });
+    if (!result.up) return null;
+    return embeddedChat.get(ws.sandboxId) || null;
+  })().finally(() => {
+    embeddedChatStarting.delete(ws.sandboxId);
+  });
+  embeddedChatStarting.set(ws.sandboxId, task);
+  return task;
+}
+
 async function startAiServerForWorkspace(ws, opts = {}) {
   const reserved = opts.reserved instanceof Set ? opts.reserved : new Set();
   const cfg = opts.cfg || null;
   const folder = path.resolve(ws.folderPath);
-  const preferred = Number(ws.port) || 3100;
-  const launchKey = `${ws.sandboxId}:${folder}:ai`;
+  const preferredRaw = Number(ws.port) || 3100;
+  const preferred = isAdminListenPort(preferredRaw) ? 3100 : preferredRaw;
   const label = ws.sandboxName || "this sandbox";
 
   if (!fs.existsSync(folder)) {
@@ -2728,19 +3165,28 @@ async function startAiServerForWorkspace(ws, opts = {}) {
     return { port: preferred, up: false, launched: false };
   }
 
-  if (await probeUrl(`http://127.0.0.1:${preferred}/embed-config.js`)) {
+  const existing = embeddedChat.get(ws.sandboxId);
+  if (existing && existing.workspaceDir === folder) {
+    if (await isChatServerOnPort(existing.port)) {
+      reserved.add(existing.port);
+      ws.port = existing.port;
+      clearProcessProblem(ws.sandboxId, "ai_server_launch", "ai");
+      log(`start chat skip ${label}: already in-process on ${existing.port}`);
+      return { port: existing.port, up: true, launched: false };
+    }
+    await stopEmbeddedChat(ws.sandboxId);
+  } else if (existing) {
+    await stopEmbeddedChat(ws.sandboxId);
+  }
+
+  if (!opts.forceEmbed && (await isChatServerOnPort(preferred))) {
     reserved.add(preferred);
+    ws.port = preferred;
     clearProcessProblem(ws.sandboxId, "ai_server_launch", "ai");
     log(`start chat skip ${label}: already up on ${preferred}`);
     return { port: preferred, up: true, launched: false };
   }
 
-  if (recentlyLaunched(launchKey)) {
-    reserved.add(preferred);
-    log(`start chat skip ${label}: already launching on ${preferred}`);
-    return { port: preferred, up: false, launched: false, starting: true };
-  }
-
   let port = Number(opts.port) || preferred;
   try {
     if (!opts.port) {
@@ -2762,7 +3208,7 @@ async function startAiServerForWorkspace(ws, opts = {}) {
     return { port: preferred, up: false, launched: false };
   }
   if (port !== preferred) {
-    log(`port ${preferred} busy; using ${port} for chat script`);
+    log(`port ${preferred} busy; using ${port} for chat`);
   }
   ws.port = port;
   const localAi = `http://localhost:${port}`;
@@ -2776,59 +3222,52 @@ async function startAiServerForWorkspace(ws, opts = {}) {
     (typeof ws.cloudflare?.ai === "string" && ws.cloudflare.ai.trim()) ||
     "";
   const aiUrl = publicAi || localAi;
-  writeProjectEnv(folder, {
-    AI_SERVER_URL: aiUrl,
-    NEXT_PUBLIC_AI_SERVER_URL: aiUrl,
-    VITE_AI_SERVER_URL: aiUrl,
-    ...overrideEnv,
-  });
   persistWorkspaceEntry(cfg, ws);
 
-  const localCli = path.resolve(
-    __dirname,
-    "..",
-    "..",
-    "ai-server",
-    "bin",
-    "cli.js"
-  );
-  const useLocal = fs.existsSync(localCli);
-  const run = useLocal
-    ? process.platform === "win32"
-      ? `"${process.execPath}" "${localCli}" --port ${port}`
-      : `${JSON.stringify(process.execPath)} ${JSON.stringify(localCli)} --port ${port}`
-    : `npx --yes @maintainer-pro/ai-server --port ${port}`;
-
-  const opened = await openInNewTerminal({
-    title: `MP-ai-${port}`,
-    folder,
-    command: run,
-    env: {
-      AI_SERVER_PORT: String(port),
-      AI_SERVER_URL: aiUrl,
-      NEXT_PUBLIC_AI_SERVER_URL: aiUrl,
-      VITE_AI_SERVER_URL: aiUrl,
-      ...overrideEnv,
-    },
-    launchKey,
-    sandboxId: ws.sandboxId,
-  });
-  if (opened.skipped) {
-    return { port, up: false, launched: false, starting: true };
-  }
-  if (!opened.ok) {
+  const storeEnv = await loadSandboxStoreEnv(ws, cfg);
+  const folderEnv = readProjectEnvValues(folder);
+  const dataDir = dataDirFor(folder, ws.sandboxId);
+  const instanceEnv = {
+    ...folderEnv,
+    ...overrideEnv,
+    ...storeEnv,
+    AI_SERVER_URL: aiUrl,
+    CORS_ORIGIN: overrideEnv.CORS_ORIGIN || folderEnv.CORS_ORIGIN || "",
+    CORS_ORIGINS: overrideEnv.CORS_ORIGINS || folderEnv.CORS_ORIGINS || "",
+    MAINTAINER_PRO_DATA_DIR: dataDir,
+    MAINTAINER_PRO_SANDBOX_ID: String(ws.sandboxId || ""),
+  };
+
+  try {
+    const instance = await startAiServer({
+      port,
+      workspaceDir: folder,
+      uiDir: folder,
+      dataDir,
+      env: instanceEnv,
+      logger: createLogger(`ai-server:${shortId(ws.sandboxId)}`),
+      label: `ai-server:${shortId(ws.sandboxId)}`,
+      listen: true,
+    });
+    embeddedChat.set(ws.sandboxId, instance);
+    ws.port = instance.port;
+    persistWorkspaceEntry(cfg, ws);
+    clearProcessProblem(ws.sandboxId, "ai_server_launch", "ai");
+    log(`chat in-process for ${label} on ${instance.port} (${folder})`);
+    return { port: instance.port, up: true, launched: true };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
     recordProcessProblem({
       sandboxId: ws.sandboxId,
       code: "ai_server_launch",
       role: "ai",
-      title: `Could not start the chat script (${label})`,
-      message: opened.error,
+      title: `Could not start chat for ${label}`,
+      message,
       resolution:
-        "Allow the bridge to open terminal windows, or start the script manually in that folder.",
+        "Keep the bridge connected to Maintainer Pro, then Start Apps.",
     });
     return { port, up: false, launched: false };
   }
-  return { port, up: false, launched: true, starting: true };
 }
 
 function sleep(ms) {
@@ -2839,10 +3278,6 @@ function stopAllCloudflare() {
   for (const id of [...cloudflareTunnels.keys()]) stopCloudflare(id);
 }
 
-function parseTryCloudflareUrl(text) {
-  return lastTryCloudflareUrl(text);
-}
-
 function killProcessesByCommand(fragment) {
   if (!fragment) return Promise.resolve();
   return new Promise((resolve) => {
@@ -2901,11 +3336,27 @@ function killPort(port) {
   });
 }
 
-function stopCloudflare(sandboxId) {
+function stopCloudflare(sandboxId, folder) {
   const row = cloudflareTunnels.get(sandboxId);
-  const files = row?.tunnels?.map((t) => t.logFile).filter(Boolean) ?? [];
+  const files = new Set(
+    (row?.tunnels?.map((t) => t.logFile).filter(Boolean) ?? [])
+  );
   cloudflareTunnels.delete(sandboxId);
-  return Promise.all(files.map((file) => killProcessesByCommand(file)));
+  const logDir = folder
+    ? dataDirFor(folder, sandboxId)
+    : null;
+  if (logDir && fs.existsSync(logDir)) {
+    try {
+      for (const name of fs.readdirSync(logDir)) {
+        if (/^cf-.*\.log$/i.test(name) && !name.endsWith(".stale")) {
+          files.add(path.join(logDir, name));
+        }
+      }
+    } catch {
+      /* ignore */
+    }
+  }
+  return Promise.all([...files].map((file) => killProcessesByCommand(file)));
 }
 
 function forgetProcessLaunches(sandboxId) {
@@ -2918,12 +3369,18 @@ function forgetProcessLaunches(sandboxId) {
 
 async function stopWorkspaceApps(ws) {
   const folder = path.resolve(ws.folderPath || "");
-  const jobs = planHostJobs(folder, null, ws.projectInfo);
+  const jobs = jobsFromHostApps(ws).length
+    ? jobsFromHostApps(ws)
+    : planHostJobs(folder, null, ws.projectInfo);
   const ports = new Set();
   if (ws.port) ports.add(Number(ws.port));
   for (const job of jobs) {
+    if (job.port) ports.add(Number(job.port));
     if (job.preferredPort) ports.add(Number(job.preferredPort));
   }
+  for (const app of Array.isArray(ws.hostApps) ? ws.hostApps : []) {
+    if (app?.port) ports.add(Number(app.port));
+  }
   if (ws.appUrl && isLocalAppUrl(ws.appUrl)) {
     try {
       const port = Number(new URL(ws.appUrl).port);
@@ -2933,12 +3390,13 @@ async function stopWorkspaceApps(ws) {
     }
   }
   log(`stopping local apps on ports ${[...ports].join(", ") || "(none)"}`);
+  await stopEmbeddedChat(ws.sandboxId);
   await closeRememberedTerminals(ws.sandboxId);
   for (const port of ports) {
     await killPort(port);
   }
   forgetProcessLaunches(ws.sandboxId);
-  await sleep(400);
+  await sleep(800);
 }
 
 async function waitUntilReachable(url, timeoutMs, label, onWait) {
@@ -2958,82 +3416,45 @@ async function waitUntilReachable(url, timeoutMs, label, onWait) {
   throw new Error(`${label} did not become reachable at ${url}`);
 }
 
-async function waitForUrlInFile(file, timeoutMs = 90_000, onWait) {
-  const start = Date.now();
-  let last = 0;
-  while (Date.now() - start < timeoutMs) {
-    if (fs.existsSync(file)) {
-      const url = parseTryCloudflareUrl(fs.readFileSync(file, "utf8"));
-      if (url) return url;
-    }
-    const elapsed = Date.now() - start;
-    if (onWait && elapsed - last >= 8_000) {
-      last = elapsed;
-      await onWait(
-        `Still waiting for a Cloudflare URL (${Math.round(elapsed / 1000)}s)…`
-      );
-    }
-    await sleep(500);
-  }
-  throw new Error(
-    `Cloudflare did not publish a URL in time (${path.basename(file)}). Check that terminal.`
-  );
-}
-
-function cloudflaredCommand(localUrl, logFile) {
-  const logArg = JSON.stringify(logFile);
-  const run = `npx --yes cloudflared tunnel --url ${localUrl} --no-autoupdate --logfile ${logArg}`;
-  if (process.platform === "win32") return run;
-  return `${run} 2>&1 | tee ${logArg}`;
-}
-
-async function startCloudflareTerminal(ws, role, localUrl, onWait) {
-  const folder = path.resolve(ws.folderPath);
-  const logDir = path.join(folder, ".maintainer-pro");
-  fs.mkdirSync(logDir, { recursive: true });
-  const logFile = path.join(
-    logDir,
-    `cf-${String(ws.sandboxId).slice(0, 8)}-${role}.log`
-  );
-  try {
-    fs.unlinkSync(logFile);
-  } catch {
-    /* ignore */
-  }
-  const opened = await openInNewTerminal({
-    title: `MP-cf-${role}`,
-    folder,
-    command: cloudflaredCommand(localUrl, logFile),
-    launchKey: `${ws.sandboxId}:cf:${role}`,
-    sandboxId: ws.sandboxId,
-    force: true,
-  });
-  if (!opened.ok) {
-    throw new Error(opened.error || `Could not open a Cloudflare terminal for ${role}`);
-  }
-  const publicUrl = await waitForUrlInFile(logFile, 90_000, onWait);
-  return { role, localUrl, publicUrl, logFile };
+function applyBackendPublicEnv(env, url) {
+  const backend = String(url || "").replace(/\/$/, "");
+  if (!backend) return env;
+  env.API_URL = backend;
+  env.API_BASE_URL = backend;
+  env.BACKEND_URL = backend;
+  env.VITE_API_URL = backend;
+  env.VITE_API_BASE_URL = backend;
+  env.NEXT_PUBLIC_API_URL = backend;
+  env.NEXT_PUBLIC_API_BASE_URL = backend;
+  env.REACT_APP_API_URL = backend;
+  return env;
 }
 
-function uiPublicEnv(tunnels) {
+function uiPublicEnv(tunnels, ws) {
   /** @type {Record<string, string>} */
   const env = {};
-  if (tunnels.ai) {
-    const ai = String(tunnels.ai).replace(/\/$/, "");
+  const aiApp = (Array.isArray(ws?.hostApps) ? ws.hostApps : []).find(
+    (app) => app.role === "ai-server" || app.id === "ai-server"
+  ) || { id: "ai-server", role: "ai-server" };
+  const ai =
+    proxyUrlForApp(ws, aiApp) ||
+    (tunnels.ai ? String(tunnels.ai).replace(/\/$/, "") : "");
+  if (ai) {
     env.AI_SERVER_URL = ai;
     env.NEXT_PUBLIC_AI_SERVER_URL = ai;
     env.VITE_AI_SERVER_URL = ai;
     env.REACT_APP_AI_SERVER_URL = ai;
   }
-  if (tunnels.backend) {
-    const backend = String(tunnels.backend).replace(/\/$/, "");
-    env.API_URL = backend;
-    env.API_BASE_URL = backend;
-    env.VITE_API_URL = backend;
-    env.VITE_API_BASE_URL = backend;
-    env.NEXT_PUBLIC_API_URL = backend;
-    env.NEXT_PUBLIC_API_BASE_URL = backend;
-    env.BACKEND_URL = backend;
+  const backendApp = (Array.isArray(ws?.hostApps) ? ws.hostApps : []).find(
+    (app) => isBackendApp(app)
+  );
+  const backendUrl =
+    (backendApp ? proxyUrlForApp(ws, backendApp) : "") ||
+    (typeof tunnels.backend === "string" && tunnels.backend) ||
+    (backendApp ? publicUrlForApp(ws, backendApp) : "") ||
+    "";
+  if (backendUrl && backendApp) {
+    applyBackendPublicEnv(env, backendUrl);
   }
   if (tunnels.ui) {
     const ui = String(tunnels.ui).replace(/\/$/, "");
@@ -3043,156 +3464,181 @@ function uiPublicEnv(tunnels) {
     env.NEXT_PUBLIC_APP_URL = ui;
     env.VITE_APP_URL = ui;
     env.REACT_APP_APP_URL = ui;
-  } else if (tunnels.ai) {
-    const ai = String(tunnels.ai).replace(/\/$/, "");
-    env.CORS_ORIGIN = ai;
-    env.APP_URL = ai;
-    env.PUBLIC_URL = ai;
-    env.NEXT_PUBLIC_APP_URL = ai;
-    env.VITE_APP_URL = ai;
+  } else if (tunnels.app) {
+    const app = String(tunnels.app).replace(/\/$/, "");
+    env.APP_URL = app;
+    env.PUBLIC_URL = app;
+    env.CORS_ORIGIN = app;
+    env.NEXT_PUBLIC_APP_URL = app;
+    env.VITE_APP_URL = app;
+    env.REACT_APP_APP_URL = app;
+  } else if (ai) {
+    const hostUi = (Array.isArray(ws?.hostApps) ? ws.hostApps : []).some(
+      (app) => app.host || app.role === "ui" || app.role === "app"
+    );
+    if (!hostUi) {
+      env.CORS_ORIGIN = ai;
+      env.APP_URL = ai;
+      env.PUBLIC_URL = ai;
+      env.NEXT_PUBLIC_APP_URL = ai;
+      env.VITE_APP_URL = ai;
+    }
   }
   return env;
 }
 
-function writeTunnelEnv(ws, tunnels) {
-  const folder = ws.folderPath ? path.resolve(ws.folderPath) : null;
-  if (!folder || !fs.existsSync(folder)) return { ok: false, env: {} };
-  const env = uiPublicEnv(tunnels);
-  const lines = Object.entries(tunnels)
-    .filter(([, url]) => url)
-    .map(([role, url]) => `${role}=${String(url).replace(/\/$/, "")}`);
-  fs.writeFileSync(
-    path.join(folder, ".cloudflare-tunnel-url"),
-    `${lines.join("\n")}\n`,
-    "utf8"
-  );
-  if (Object.keys(env).length) writeProjectEnv(folder, env);
-  return { ok: true, env };
+function publicUrlForApp(ws, app) {
+  if (!app) return "";
+  const proxied = proxyUrlForApp(ws, app);
+  if (proxied) return proxied;
+  const port = Number(app.port) || 0;
+  return port ? `http://localhost:${port}` : "";
 }
 
-/**
- * Validate tunnels + frontend env before sharing URLs with Maintainer Pro.
- * @returns {Promise<{ ok: boolean, checks: Array<{ id: string, ok: boolean, detail: string }> }>}
- */
-async function validateCloudflareGoLive(ws, tunnels, opts = {}) {
-  const folder = path.resolve(ws.folderPath || "");
+function envFromConfiguredMaps(ws) {
+  /** @type {Record<string, string>} */
+  const env = {};
+  const apps = Array.isArray(ws.hostApps) ? ws.hostApps : [];
+  for (const app of apps) {
+    const maps = Array.isArray(app.envMaps) ? app.envMaps : [];
+    for (const row of maps) {
+      const key = String(row?.key || "").trim();
+      const sourceId = String(row?.sourceAppId || "").trim();
+      if (!key || !sourceId) continue;
+      const source =
+        sourceId === "self"
+          ? app
+          : apps.find((item) => item.id === sourceId) || null;
+      const url = publicUrlForApp(ws, source);
+      if (url) env[key] = url;
+    }
+  }
+  return env;
+}
+
+function cloudflarePublicEnv(ws) {
+  const tunnels =
+    ws.cloudflare && typeof ws.cloudflare === "object" ? ws.cloudflare : {};
+  const jobs = jobsFromHostApps(ws);
+  const env = {
+    ...envForWorkspacePorts(ws, jobs),
+    ...uiPublicEnv(tunnels, ws),
+  };
+  const origins = [];
+  const add = (value) => {
+    const origin = originFromUrl(value);
+    if (origin && !origins.includes(origin)) origins.push(origin);
+  };
+  add(tunnels.ui);
+  add(tunnels.app);
+  add(tunnels.backend);
+  add(tunnels.ai);
+  add(env.APP_URL);
+  add(env.CORS_ORIGIN);
+  for (const job of jobs) {
+    if (job.port) add(`http://localhost:${job.port}`);
+  }
+  add(`http://localhost:${Number(ws.port) || 3100}`);
+  if (origins.length) {
+    env.CORS_ORIGIN = origins.join(",");
+    env.CORS_ORIGINS = origins.join(",");
+  }
+  Object.assign(env, envFromConfiguredMaps(ws));
+  return env;
+}
+
+async function applyPublicUrlsToRunningApps(ws, cfg, opts = {}) {
+  const folder = ws.folderPath ? path.resolve(ws.folderPath) : "";
   const progress =
     typeof opts.onProgress === "function" ? opts.onProgress : async () => {};
-  /** @type {Array<{ id: string, ok: boolean, detail: string }>} */
-  const checks = [];
-  const add = (id, ok, detail) => {
-    checks.push({ id, ok, detail });
-    log(`go-live ${ok ? "ok" : "FAIL"} ${id}: ${detail}`);
+  const tunnels =
+    ws.cloudflare && typeof ws.cloudflare === "object" ? ws.cloudflare : {};
+  const hasProxy = Boolean(ws.proxy?.token);
+  if (
+    !folder ||
+    !fs.existsSync(folder) ||
+    (!Object.keys(tunnels).length && !hasProxy)
+  ) {
+    return { restarted: [], rewritten: [] };
+  }
+  const env = {
+    ...cloudflarePublicEnv(ws),
   };
-
-  await progress(
-    "Validating Cloudflare setup before sharing with Maintainer Pro…"
-  );
-
-  writeTunnelEnv(ws, tunnels);
-  const env = readProjectEnvValues(folder);
-
-  if (!tunnels.ai) {
-    add("ai_tunnel", false, "Missing chat-script Cloudflare URL");
-  } else {
-    const ai = String(tunnels.ai).replace(/\/$/, "");
-    const embed = `${ai}/embed-config.js`;
-    const reachable = await probeUrl(embed, 10_000);
-    add(
-      "ai_tunnel",
-      reachable,
-      reachable ? `Reachable ${embed}` : `Unreachable ${embed}`
+  if (Object.keys(tunnels).length) writeTunnelEnv(ws, tunnels);
+  const mappedKeys = Object.keys(envFromConfiguredMaps(ws));
+  if (mappedKeys.length) {
+    activity(
+      ws.sandboxId,
+      "info",
+      `Injecting public URLs into process env for ${mappedKeys.join(", ")}`
     );
-    if (reachable) {
-      const body = await fetchText(embed, 10_000);
-      const advertises =
-        Boolean(body) &&
-        (body.includes(ai) ||
-          body.includes(ai.replace(/^https:\/\//, "")));
-      add(
-        "embed_config",
-        advertises,
-        advertises
-          ? "embed-config.js advertises the public AI URL"
-          : `embed-config.js does not advertise ${ai}`
-      );
-    }
+    await progress(`Passing ${mappedKeys.join(", ")} via process env`);
   }
 
-  if (tunnels.ui) {
-    const ui = String(tunnels.ui).replace(/\/$/, "");
-    const reachable = await probeUrl(ui, 10_000);
-    add(
-      "ui_tunnel",
-      reachable,
-      reachable ? `Reachable ${ui}` : `Unreachable ${ui}`
-    );
-  } else {
-    add(
-      "ui_tunnel",
-      true,
-      "No separate UI tunnel (AI-only / same-origin share)"
-    );
+  const probe = await probeRunningApps(ws, 1200);
+  const runningRoles = new Set(
+    (probe.hostApps || [])
+      .filter((app) => app.running)
+      .map((app) =>
+        app.role === "ai-server" ? "ai-server" : app.role === "custom" ? "app" : app.role
+      )
+  );
+  const reserved = reservedPortsFor(cfg, ws.sandboxId);
+  const restarted = [];
+
+  if (probe.chatUp || runningRoles.has("ai-server") || embeddedChat.has(ws.sandboxId)) {
+    await progress("Restarting in-process chat with public URLs and CORS…");
+    launchedAt.delete(`${ws.sandboxId}:${folder}:ai`);
+    await stopEmbeddedChat(ws.sandboxId);
+    await startAiServerForWorkspace(ws, {
+      reserved,
+      cfg,
+      port: ws.port,
+      env,
+    });
+    restarted.push("ai-server");
   }
 
-  const ai = String(tunnels.ai || "").replace(/\/$/, "");
-  if (ai) {
-    const envAi = [
-      env.NEXT_PUBLIC_AI_SERVER_URL,
-      env.VITE_AI_SERVER_URL,
-      env.AI_SERVER_URL,
-      env.REACT_APP_AI_SERVER_URL,
-    ]
-      .map((value) => String(value || "").replace(/\/$/, ""))
-      .filter(Boolean);
-    const envOk = envAi.some((value) => value === ai);
-    add(
-      "frontend_env",
-      envOk,
-      envOk
-        ? `Frontend env has AI URL ${ai}`
-        : `Frontend env missing AI URL (NEXT_PUBLIC=${
-            env.NEXT_PUBLIC_AI_SERVER_URL || "(empty)"
-          }, VITE=${env.VITE_AI_SERVER_URL || "(empty)"}, AI_SERVER_URL=${
-            env.AI_SERVER_URL || "(empty)"
-          })`
+  const jobs = jobsFromHostApps(ws).filter((job) =>
+    runningRoles.has(job.role === "custom" ? "app" : job.role)
+  );
+  if (jobs.length) {
+    const roles = [...new Set(jobs.map((job) => job.role))];
+    await progress(
+      `Restarting ${roles.join(", ")} so they load the public URLs…`
     );
+    for (const job of jobs) {
+      launchedAt.delete(`${ws.sandboxId}:${folder}:${job.script}`);
+      await killPort(job.port);
+    }
+    await sleep(1500);
+    await ensureHostProcesses(ws, {
+      reserved,
+      cfg,
+      onlyRoles: roles,
+      extraEnv: env,
+      force: true,
+      plannedJobs: jobsFromHostApps(ws),
+    });
+    restarted.push(...roles);
   }
 
-  if (tunnels.ui) {
-    const ui = String(tunnels.ui).replace(/\/$/, "");
-    const envApp = [
-      env.APP_URL,
-      env.NEXT_PUBLIC_APP_URL,
-      env.PUBLIC_URL,
-      env.VITE_APP_URL,
-      env.CORS_ORIGIN,
-    ]
-      .map((value) => String(value || "").replace(/\/$/, ""))
-      .filter(Boolean);
-    const appOk = envApp.some((value) => value === ui);
-    add(
-      "app_url_env",
-      appOk,
-      appOk
-        ? `App URL env has ${ui}`
-        : `App URL env missing ${ui} (APP_URL=${env.APP_URL || "(empty)"}, NEXT_PUBLIC_APP_URL=${
-            env.NEXT_PUBLIC_APP_URL || "(empty)"
-          })`
+  if (restarted.length) {
+    activity(
+      ws.sandboxId,
+      "info",
+      `Restarted ${[...new Set(restarted)].join(", ")} with public URLs`
     );
   }
+  return { restarted: [...new Set(restarted)], rewritten: [], env };
+}
 
-  const ok = checks.every((check) => check.ok);
-  if (ok) {
-    await progress("Validation passed — sharing public URLs with Maintainer Pro.");
-  } else {
-    const failed = checks
-      .filter((check) => !check.ok)
-      .map((check) => `${check.id}: ${check.detail}`)
-      .join(" | ");
-    await progress(`Validation failed — not sharing yet. ${failed}`);
-  }
-  return { ok, checks };
+function writeTunnelEnv(ws, tunnels) {
+  const folder = ws.folderPath ? path.resolve(ws.folderPath) : null;
+  if (!folder || !fs.existsSync(folder)) return { ok: false, env: {} };
+  clearCloudflareTunnelFile(folder);
+  const env = uiPublicEnv(tunnels, ws);
+  return { ok: true, env };
 }
 
 function reservedPortsFor(cfg, sandboxId) {
@@ -3211,271 +3657,35 @@ function appsWanted(ws) {
 
 async function configureCloudflareForWorkspace(ws, cfg, opts = {}) {
   const sandboxId = ws.sandboxId;
-  const label = ws.sandboxName || "this sandbox";
-  const progress = (message) =>
-    reportActionProgress(cfg, opts.actionId, message);
-
-  // If tunnels are already up, attach instead of tearing them down.
-  const attached = await tryAttachExistingCloudflare(ws, cfg, {
-    onProgress: progress,
-  });
-  if (attached) {
-    return {
-      ...attached,
-      pending: false,
-      cloudflarePending: false,
-      waitingForStart: false,
-      warning: null,
-    };
-  }
-
-  await progress(
-    `Preparing Cloudflare for ${label}. Stopping local apps first — this can take a minute.`
-  );
-  await stopCloudflare(sandboxId);
-  await progress("Stopping local app terminals and freeing their ports…");
-  await stopWorkspaceApps(ws);
-  await forgetLaunch(sandboxId);
-  ws.cloudflarePending = true;
-  ws.appsRequested = false;
-  persistWorkspaceEntry(cfg, ws);
-  await progress(
-    "Cloudflare is queued. Use Start Apps to create the public URLs."
-  );
-
-  return {
-    sandboxId,
-    folderPath: ws.folderPath,
-    port: ws.port,
-    pending: true,
-    cloudflarePending: true,
-    waitingForStart: true,
-    warning:
-      "Cloudflare is ready in Maintainer Pro. Use Start Apps when you want to launch the apps and create the public URLs.",
-  };
-}
-
-async function launchCloudflareTunnels(ws, cfg, opts = {}) {
-  const sandboxId = ws.sandboxId;
-  const label = ws.sandboxName || "this sandbox";
-  const folder = path.resolve(ws.folderPath || "");
-  const reserved = reservedPortsFor(cfg, sandboxId);
   const progress = (message) =>
     reportActionProgress(cfg, opts.actionId, message);
-
-  const attached = await tryAttachExistingCloudflare(ws, cfg, {
-    onProgress: progress,
-  });
-  if (attached) return attached;
-
-  await progress(
-    `Creating Cloudflare tunnels for ${label}. This usually takes 1–2 minutes.`
-  );
+  await progress("Using Maintainer Pro share URLs (no Cloudflare).");
   try {
-  const plan = await prepareWorkspaceLaunch(ws, cfg, reserved);
-  if (!cfg.noAiServer) {
-    await progress(`Starting the chat script on port ${plan.aiPort}…`);
-    await startAiServerForWorkspace(ws, {
-      reserved,
-      cfg,
-      port: plan.aiPort,
-    });
-    await waitUntilReachable(
-      `http://127.0.0.1:${ws.port}/embed-config.js`,
-      45_000,
-      "the chat script",
-      progress
-    );
-  }
-
-  const backendJob = plan.jobs.find((job) => job.role === "backend");
-  const uiJob = plan.jobs.find((job) => job.role === "ui" || job.role === "app");
-
-  if (backendJob) {
-    await progress(`Starting the backend on port ${backendJob.port}…`);
-    await ensureHostProcesses(ws, {
-      reserved,
-      cfg,
-      onlyRoles: ["backend"],
-      force: true,
-      plannedJobs: plan.jobs,
-    });
-    const backendPort = Number(backendJob.port) || 4100;
-    await waitUntilReachable(
-      `http://127.0.0.1:${backendPort}`,
-      45_000,
-      "the backend",
-      progress
-    );
-  }
-
-  /** @type {Record<string, string>} */
-  const tunnels = {};
-  /** @type {Array<{ role: string, localUrl: string, publicUrl: string | null, logFile: string }>} */
-  const started = [];
-
-  const aiLocal = `http://127.0.0.1:${Number(ws.port) || 3100}`;
-  await progress(`Opening a Cloudflare tunnel for the chat script (${aiLocal})…`);
-  const aiTunnel = await startCloudflareTerminal(ws, "ai", aiLocal, progress);
-  tunnels.ai = aiTunnel.publicUrl;
-  started.push(aiTunnel);
-  await progress(`Chat script public URL: ${aiTunnel.publicUrl}`);
-
-  if (backendJob) {
-    const backendLocal = `http://127.0.0.1:${Number(backendJob.port) || 4100}`;
-    await progress(`Opening a Cloudflare tunnel for the backend (${backendLocal})…`);
-    const backendTunnel = await startCloudflareTerminal(
-      ws,
-      "backend",
-      backendLocal,
-      progress
-    );
-    tunnels.backend = backendTunnel.publicUrl;
-    started.push(backendTunnel);
-    await progress(`Backend public URL: ${backendTunnel.publicUrl}`);
-  }
-
-  writeTunnelEnv(ws, tunnels);
-  let uiEnv = uiPublicEnv(tunnels);
-  const uiPort = uiJob ? Number(uiJob.port) || 5173 : null;
-
-  if (uiJob) {
-    await progress(`Starting the app UI on port ${uiPort}…`);
-    await ensureHostProcesses(ws, {
-      reserved,
-      cfg,
-      onlyRoles: ["ui", "app"],
-      extraEnv: uiEnv,
-      force: true,
-      plannedJobs: plan.jobs,
-    });
-    await waitUntilReachable(
-      `http://127.0.0.1:${uiPort}`,
-      60_000,
-      "the app UI",
-      progress
-    );
-    await progress(
-      `Opening a Cloudflare tunnel for the app UI (http://127.0.0.1:${uiPort})…`
-    );
-    const uiTunnel = await startCloudflareTerminal(
-      ws,
-      "ui",
-      `http://127.0.0.1:${uiPort}`,
-      progress
-    );
-    tunnels.ui = uiTunnel.publicUrl;
-    started.push(uiTunnel);
-    await progress(`App UI public URL: ${uiTunnel.publicUrl}`);
-    writeTunnelEnv(ws, tunnels);
-    uiEnv = uiPublicEnv(tunnels);
-
-    // Restart UI so Vite/Next pick up APP_URL + public AI URL from env files.
-    await progress(
-      "Restarting the app UI so it loads the public base URL from env…"
-    );
-    for (const job of plan.jobs) {
-      if (job.role === "ui" || job.role === "app") {
-        launchedAt.delete(`${sandboxId}:${folder}:${job.script}`);
-      }
-    }
-    await killPort(uiPort);
-    await sleep(1500);
-    await ensureHostProcesses(ws, {
-      reserved,
-      cfg,
-      onlyRoles: ["ui", "app"],
-      extraEnv: uiEnv,
-      force: true,
-      plannedJobs: plan.jobs,
-    });
-    await waitUntilReachable(
-      `http://127.0.0.1:${uiPort}`,
-      60_000,
-      "the app UI",
-      progress
-    );
-  }
-
-  // Restart chat script with the public AI URL (and CORS/app origins).
-  if (tunnels.ai) {
-    await progress("Restarting the chat script with the public AI URL…");
-    launchedAt.delete(`${sandboxId}:${folder}:ai`);
-    await killPort(ws.port);
-    await sleep(1500);
-    await startAiServerForWorkspace(ws, {
-      reserved,
-      cfg,
-      port: ws.port,
-      env: uiPublicEnv(tunnels),
-    });
-    writeTunnelEnv(ws, tunnels);
-    await waitUntilReachable(
-      `http://127.0.0.1:${ws.port}/embed-config.js`,
-      45_000,
-      "the chat script",
-      progress
-    );
-  }
-
-  const validation = await validateCloudflareGoLive(ws, tunnels, {
-    onProgress: progress,
-  });
-  if (!validation.ok) {
-    const failed = validation.checks
-      .filter((check) => !check.ok)
-      .map((check) => `${check.id}: ${check.detail}`)
-      .join("\n");
-    ws.cloudflarePending = true;
-    ws.cloudflare = tunnels;
-    ws.cloudflareUrl = null;
-    persistWorkspaceEntry(cfg, ws);
-    rememberCloudflareTunnels(sandboxId, tunnels);
-    throw new Error(
-      `Cloudflare validation failed — public URLs were not shared with Maintainer Pro yet.\n${failed}`
-    );
+    await stopCloudflare(sandboxId, ws.folderPath);
+  } catch {
+    /* leftover tunnels */
   }
-
-  const appUrl = tunnels.ui || tunnels.ai;
-  ws.cloudflareUrl = appUrl;
-  ws.cloudflare = tunnels;
-  ws.appUrl = appUrl;
   ws.cloudflarePending = false;
-  ws.appsRequested = true;
   persistWorkspaceEntry(cfg, ws);
-  rememberCloudflareTunnels(sandboxId, tunnels);
-  cloudflareTunnels.set(sandboxId, { tunnels: started });
-  clearProcessProblem(sandboxId, "cloudflare_launch", "tunnel");
-  const host = workspaceHostReport(ws);
-  await progress(`Cloudflare is ready: ${host.appUrl || appUrl}`);
-
-  return {
-    sandboxId,
-    folderPath: ws.folderPath,
-    port: ws.port,
-    appUrl: host.appUrl || appUrl,
-    origins: host.origins.length
-      ? host.origins
-      : Object.values(tunnels).filter(Boolean),
-    tunnels,
-    validation,
-    cloudflare: true,
-    reused: false,
-  };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    recordProcessProblem({
-      sandboxId,
-      code: "cloudflare_launch",
-      role: "tunnel",
-      title: `Could not start Cloudflare (${label})`,
-      message,
-      resolution:
-        "Install cloudflared or allow npx to download it, then use Start Apps again.",
-      actionCode: "start_ai_server",
-    });
-    throw err;
-  }
+  const status = await reconcileWorkspacePresence(ws, cfg, {
+    timeoutMs: 2500,
+  });
+  const share = proxyUrlForApp(
+    ws,
+    hostAppOf(ws) || { id: "ui", role: "ui", host: true }
+  );
+  return {
+    sandboxId,
+    folderPath: ws.folderPath,
+    port: ws.port,
+    pending: false,
+    cloudflarePending: false,
+    waitingForStart: false,
+    appUrl: status.host.appUrl || share,
+    origins: status.host.origins,
+    publicUrl: share || null,
+    cloudflare: false,
+  };
 }
 
 async function startAppsForWorkspace(ws, cfg, opts = {}) {
@@ -3483,12 +3693,17 @@ async function startAppsForWorkspace(ws, cfg, opts = {}) {
   await reportActionProgress(
     cfg,
     opts.actionId,
-    `Checking running apps and Cloudflare for ${label}…`
+    `Checking running apps for ${label}…`
   );
 
-  // Status + env sync first (never starts Cloudflare here).
+  try {
+    await stopCloudflare(ws.sandboxId, ws.folderPath);
+  } catch {
+    /* leftover cloudflared */
+  }
+  ws.cloudflarePending = false;
+
   let status = await reconcileWorkspacePresence(ws, cfg, {
-    writeEnv: true,
     timeoutMs: 2500,
   });
   log(
@@ -3498,15 +3713,9 @@ async function startAppsForWorkspace(ws, cfg, opts = {}) {
       status.probe.hosts
         .map((h) => `${h.role}:${h.up ? "up" : "down"}`)
         .join(",") || "none"
-    } cloudflare=${status.usingCloudflare ? "yes" : "no"}`
+    }`
   );
 
-  // Cloudflare tunnels only when Maintainer Pro left a pending Share signal.
-  if (ws.cloudflarePending) {
-    log(`start apps ${label}: Cloudflare pending, launching tunnels`);
-    return launchCloudflareTunnels(ws, cfg, opts);
-  }
-
   await reportActionProgress(
     cfg,
     opts.actionId,
@@ -3516,16 +3725,15 @@ async function startAppsForWorkspace(ws, cfg, opts = {}) {
   const reserved = reservedPortsFor(cfg, ws.sandboxId);
   const plan = await prepareWorkspaceLaunch(ws, cfg, reserved);
 
-  // Re-sync env after port assignment (local or cloudflare urls).
   status = await reconcileWorkspacePresence(ws, cfg, {
-    writeEnv: true,
     timeoutMs: 800,
   });
 
-  const cfEnv =
-    status.usingCloudflare && status.cloudflare
-      ? uiPublicEnv(status.cloudflare)
-      : {};
+  const shareEnv = {
+    ...envForWorkspacePorts(ws, plan.jobs),
+    ...uiPublicEnv({}, ws),
+    ...envFromConfiguredMaps(ws),
+  };
 
   if (!cfg.noAiServer) {
     if (status.probe.chatUp) {
@@ -3538,7 +3746,7 @@ async function startAppsForWorkspace(ws, cfg, opts = {}) {
         reserved,
         cfg,
         port: plan.aiPort,
-        env: cfEnv,
+        env: shareEnv,
       });
       await sleep(1500);
     }
@@ -3553,12 +3761,15 @@ async function startAppsForWorkspace(ws, cfg, opts = {}) {
       const probed = status.probe.hosts.find((h) => h.role === job.role);
       return probed?.up ? { ...job, up: true, port: probed.port } : job;
     }),
-    extraEnv: cfEnv,
+    extraEnv: shareEnv,
   });
   await sleep(800);
 
+  await applyPublicUrlsToRunningApps(ws, cfg, {
+    onProgress: (message) => reportActionProgress(cfg, opts.actionId, message),
+  });
+
   status = await reconcileWorkspacePresence(ws, cfg, {
-    writeEnv: true,
     timeoutMs: 2500,
   });
   await inspectHostJobs(ws);
@@ -3570,11 +3781,11 @@ async function startAppsForWorkspace(ws, cfg, opts = {}) {
   log(
     `start apps done ${label}: chat=${ws.port} chatUp=${
       status.aiServerUp
-    } hosts=${startedHosts.join(",") || "none"} cloudflare=${
-      status.usingCloudflare ? "yes" : "no"
-    }${status.host.appUrl ? ` app=${status.host.appUrl}` : ""} origins=${
-      status.host.origins.join(",") || "none"
-    }${warning ? ` warning=${warning}` : ""}`
+    } hosts=${startedHosts.join(",") || "none"}${
+      status.host.appUrl ? ` app=${status.host.appUrl}` : ""
+    } origins=${status.host.origins.join(",") || "none"}${
+      warning ? ` warning=${warning}` : ""
+    }`
   );
   return {
     up: status.aiServerUp,
@@ -3584,12 +3795,196 @@ async function startAppsForWorkspace(ws, cfg, opts = {}) {
     port: ws.port,
     appUrl: status.host.appUrl || ws.appUrl,
     origins: status.host.origins,
-    cloudflare: status.usingCloudflare,
+    publicUrl:
+      proxyUrlForApp(
+        ws,
+        hostAppOf(ws) || { id: "ui", role: "ui", host: true }
+      ) || null,
+    cloudflare: false,
+    hostApps: status.probe.hostApps || ws.hostApps || [],
     processIssues,
     warning,
   };
 }
 
+function findHostApp(ws, payload = {}) {
+  const apps = Array.isArray(ws.hostApps) ? ws.hostApps : [];
+  const id = String(payload.appId || payload.id || "").trim();
+  const role = String(payload.role || "").trim();
+  const port = Number(payload.port) || 0;
+  return (
+    apps.find((app) => id && app.id === id) ||
+    apps.find((app) => role && app.role === role) ||
+    apps.find((app) => port && Number(app.port) === port) ||
+    null
+  );
+}
+
+async function startSingleApp(ws, cfg, payload = {}, opts = {}) {
+  const app = findHostApp(ws, payload);
+  if (!app) {
+    activity(ws.sandboxId, "error", "Start app failed: unknown app/port");
+    return { error: "Unknown app. Detect or add the port first." };
+  }
+  const progress = (message) => reportActionProgress(cfg, opts.actionId, message);
+  const alreadyUp = await portIsLive(app.port, 1200);
+  if (alreadyUp) {
+    activity(ws.sandboxId, "info", `${app.name} already running on ${app.port}`);
+    await progress(`${app.name} is already running on port ${app.port}.`);
+    const status = await reconcileWorkspacePresence(ws, cfg, {
+      timeoutMs: 1200,
+    });
+    return {
+      app,
+      running: true,
+      port: app.port,
+      hostApps: status.probe.hostApps || [],
+      log: activityLogFor(ws.sandboxId),
+    };
+  }
+  activity(ws.sandboxId, "info", `Start ${app.name} on port ${app.port}`);
+  await progress(`Starting ${app.name} on port ${app.port}…`);
+  ws.appsRequested = true;
+  persistWorkspaceEntry(cfg, ws);
+  const publicEnv = {
+    ...cloudflarePublicEnv(ws),
+  };
+  if (app.role === "ai-server") {
+    const reserved = reservedPortsFor(cfg, ws.sandboxId);
+    const chat = await discoverChatPort(ws, 1200);
+    if (chat.up) {
+      activity(ws.sandboxId, "info", `AI server already running on ${chat.port}`);
+      ws.port = chat.port;
+    } else {
+      await startAiServerForWorkspace(ws, {
+        reserved,
+        cfg,
+        port: Number(app.port) || ws.port || 3100,
+        env: publicEnv,
+      });
+    }
+  } else {
+    const reserved = reservedPortsFor(cfg, ws.sandboxId);
+    await ensureHostProcesses(ws, {
+      reserved,
+      cfg,
+      onlyRoles: [app.role === "custom" ? "app" : app.role],
+      extraEnv: publicEnv,
+      force: true,
+      plannedJobs: jobsFromHostApps(ws),
+    });
+  }
+  const status = await reconcileWorkspacePresence(ws, cfg, {
+    timeoutMs: 2500,
+  });
+  const live = (status.probe.hostApps || []).find((row) => row.id === app.id);
+  activity(
+    ws.sandboxId,
+    live?.running ? "info" : "warn",
+    live?.running
+      ? `${app.name} is running on ${live.port}`
+      : `${app.name} did not answer on port ${app.port}. Check the MP terminal.`
+  );
+  return {
+    app,
+    running: Boolean(live?.running),
+    port: live?.port || app.port,
+    hostApps: status.probe.hostApps || [],
+    log: activityLogFor(ws.sandboxId),
+    warning: live?.running
+      ? null
+      : `${app.name} did not answer on port ${app.port}. Check the terminal on that computer.`,
+  };
+}
+
+async function stopSingleApp(ws, app) {
+  const port = Number(app.port) || 0;
+  const role =
+    app.role === "ai-server"
+      ? "ai-server"
+      : app.role === "custom"
+        ? "app"
+        : app.role || "app";
+  const folder = path.resolve(ws.folderPath || "");
+  await closeWindowsByTitle(`MP-${role}-${port}`);
+  if (role === "app") await closeWindowsByTitle(`MP-custom-${port}`);
+  if (app.role === "ai-server" || app.id === "ai-server") {
+    await stopEmbeddedChat(ws.sandboxId);
+  }
+  if (port) {
+    await killPort(port);
+    const until = Date.now() + 4000;
+    while (Date.now() < until && (await portIsLive(port, 300))) {
+      await killPort(port);
+      await sleep(300);
+    }
+  }
+  const job = jobsFromHostApps(ws).find((row) => row.appId === app.id);
+  if (job) launchedAt.delete(`${ws.sandboxId}:${folder}:${job.script}`);
+  launchedAt.delete(`${ws.sandboxId}:${folder}:ai`);
+  await sleep(800);
+}
+
+async function restartSingleApp(ws, cfg, payload = {}, opts = {}) {
+  const app = findHostApp(ws, payload);
+  if (!app) {
+    activity(ws.sandboxId, "error", "Restart app failed: unknown app/port");
+    return { error: "Unknown app. Detect or add the port first." };
+  }
+  const progress = (message) =>
+    reportActionProgress(cfg, opts.actionId, message);
+  activity(ws.sandboxId, "info", `Restart ${app.name} on ${app.port}`);
+  await progress(`Stopping ${app.name} on port ${app.port}…`);
+  await stopSingleApp(ws, app);
+  return startSingleApp(ws, cfg, payload, opts);
+}
+
+async function startCloudflareForApp(ws, cfg, payload = {}, opts = {}) {
+  const app = findHostApp(ws, payload);
+  if (!app) {
+    activity(ws.sandboxId, "error", "Share URL failed: unknown app/port");
+    return { error: "Unknown app. Detect or add the port first." };
+  }
+  const progress = (message) => reportActionProgress(cfg, opts.actionId, message);
+  if (usesBridgeProxy(app)) {
+    const shareUrl = proxyUrlForApp(ws, app);
+    if (!shareUrl) {
+      return {
+        error:
+          "Share URL is not ready. Keep the bridge connected to Maintainer Pro.",
+      };
+    }
+    await progress(`Using the Maintainer Pro share URL for ${app.name}…`);
+    const started = await startSingleApp(ws, cfg, { appId: app.id }, opts);
+    if (started.error) return started;
+    const applied = await applyPublicUrlsToRunningApps(ws, cfg, {
+      onProgress: progress,
+    });
+    const status = await reconcileWorkspacePresence(ws, cfg, {
+      timeoutMs: 2500,
+    });
+    activity(ws.sandboxId, "info", `${app.name} share URL: ${shareUrl}`);
+    return {
+      app,
+      running: Boolean(started.running),
+      port: started.port,
+      publicUrl: shareUrl,
+      cloudflareUrl: null,
+      appUrl: status.host.appUrl,
+      origins: status.host.origins,
+      hostApps: status.probe.hostApps || [],
+      rewritten: applied.rewritten,
+      restarted: applied.restarted,
+      log: activityLogFor(ws.sandboxId),
+    };
+  }
+  return {
+    error:
+      "Share URL is not ready. Keep the bridge connected to Maintainer Pro.",
+    app,
+  };
+}
+
 async function ensureHostProcesses(ws, opts = {}) {
   const reserved = opts.reserved instanceof Set ? opts.reserved : new Set();
   const cfg = opts.cfg || null;
@@ -3708,7 +4103,13 @@ async function ensureHostProcesses(ws, opts = {}) {
       continue;
     }
     started.push(job.role);
-    log(`start ${job.role} launched ${label} on ${port}: ${command}`);
+    log(
+      `start ${job.role} launched ${label} on ${port}: ${command}${
+        Object.keys(extraEnv).length
+          ? ` env=${Object.keys(extraEnv).join(",")}`
+          : ""
+      }`
+    );
     if (
       (job.role === "ui" || job.role === "app") &&
       (!ws.appUrl || isLocalAppUrl(ws.appUrl))
@@ -3724,11 +4125,13 @@ async function ensureHostProcesses(ws, opts = {}) {
 
 async function inspectHostJobs(ws) {
   const folder = path.resolve(ws.folderPath || "");
-  const jobs = planHostJobs(
-    folder,
-    ws.appUrl && isLocalAppUrl(ws.appUrl) ? ws.appUrl : null,
-    ws.projectInfo
-  );
+  const jobs = jobsFromHostApps(ws).length
+    ? jobsFromHostApps(ws)
+    : planHostJobs(
+        folder,
+        ws.appUrl && isLocalAppUrl(ws.appUrl) ? ws.appUrl : null,
+        ws.projectInfo
+      );
   const label = ws.sandboxName || "this sandbox";
   const hosts = [];
   for (const job of jobs) {
@@ -3788,7 +4191,7 @@ async function setupWorkspace(cfg, action) {
     }
   }
   let port = requestedPort;
-  if (await probeUrl(`http://127.0.0.1:${requestedPort}/embed-config.js`)) {
+  if (await isChatServerOnPort(requestedPort)) {
     reserved.add(requestedPort);
     log(`setup chat port ${requestedPort} already up`);
   } else {
@@ -3810,6 +4213,12 @@ async function setupWorkspace(cfg, action) {
     throw new Error("setup_workspace requires folderPath and sandboxId");
   }
   const resolved = path.resolve(folderPath);
+  const allowed = collectOfferedFolders();
+  if (!allowed.some((root) => pathInside(resolved, root))) {
+    throw new Error(
+      "That folder is outside the directory where the bridge is running. Start the bridge from the project folder you want to share."
+    );
+  }
   fs.mkdirSync(resolved, { recursive: true });
 
   const config = await api(
@@ -3836,30 +4245,10 @@ async function setupWorkspace(cfg, action) {
   const corsOrigin = client.corsOrigin || aiOrigin;
   const appUrl = client.appUrl || corsOrigin;
 
-  const envPath = path.join(resolved, ".env");
   const partnerIgnorePaths = Array.isArray(config.aiIgnorePaths)
     ? config.aiIgnorePaths
     : [];
-  const envValues = {
-    ...config.env,
-    AI_CLI_WORKSPACE: ".",
-    AI_CLI_IGNORE_PATHS: JSON.stringify(
-      normalizeIgnorePaths(partnerIgnorePaths)
-    ),
-    AI_SERVER_UI: client.sameOrigin || client.kind === "empty" ? "." : ".",
-    AI_SERVER_PORT: String(port),
-    AI_SERVER_URL: aiOrigin,
-    NEXT_PUBLIC_AI_SERVER_URL: aiOrigin,
-    CORS_ORIGIN: corsOrigin,
-    APP_URL: appUrl,
-    AI_SERVER_PRODUCT_DESCRIPTION: appName,
-  };
-  mergeEnvFile(envPath, envValues, { remove: ["PORT"] });
-  const envLocal = path.join(resolved, ".env.local");
-  if (fs.existsSync(envLocal)) {
-    mergeEnvFile(envLocal, {}, { remove: ["PORT"] });
-  }
-  const access = applyAccessPolicy(resolved, partnerIgnorePaths);
+  const access = applyAccessPolicy(resolved, partnerIgnorePaths, sandboxId);
 
   cfg.workspaces = cfg.workspaces || [];
   const existing = cfg.workspaces.findIndex((w) => w.sandboxId === sandboxId);
@@ -3874,36 +4263,42 @@ async function setupWorkspace(cfg, action) {
     sameOrigin: Boolean(client.sameOrigin),
     appsRequested: false,
     cloudflarePending: false,
+    store: {
+      serverKey: String(config.env?.MAINTAINER_PRO_API_KEY || "").trim(),
+      clientKey: String(
+        config.env?.MAINTAINER_PRO_CLIENT_API_KEY ||
+          config.env?.NEXT_PUBLIC_MAINTAINER_PRO_CLIENT_API_KEY ||
+          ""
+      ).trim(),
+    },
   };
   if (existing >= 0) cfg.workspaces[existing] = entry;
   else cfg.workspaces.push(entry);
-  if (!cfg.offeredFolders) cfg.offeredFolders = [];
-  if (!cfg.offeredFolders.includes(resolved)) cfg.offeredFolders.push(resolved);
   saveConfig(cfg);
 
-  const projectInfo = await inspectProjectWithAiCli(entry, {
+  const ports = await resolveWorkspaceHostApps(entry, {
     cfg,
-    extraContext: [
-      `Scaffold kind: ${client.kind}`,
-      `Chat script port: ${port}`,
-      client.notes.join(" "),
-    ]
-      .filter(Boolean)
-      .join("\n"),
+    allowAi: false,
   });
+  const needsReview =
+    Boolean(ports.confused) ||
+    !(ports.apps || []).some((app) => app && app.role !== "ai-server");
+  if (needsReview) {
+    activity(
+      sandboxId,
+      "warn",
+      "Review the suggested apps and ports in Maintainer Pro before Start Apps."
+    );
+  }
+  // Do not auto-repair the repo on attach — interactive Review setup handles suggestions.
+  const projectInfo = entry.projectInfo || null;
 
   await inspectHostJobs(entry);
-  const planned = planHostJobs(
-    resolved,
-    entry.appUrl && isLocalAppUrl(entry.appUrl) ? entry.appUrl : null,
-    entry.projectInfo
-  ).map((job) => ({ ...job, port: job.preferredPort }));
-  writeProjectEnv(resolved, envForWorkspacePorts(entry, planned));
 
   const openUrl = client.sameOrigin
     ? `http://localhost:${entry.port}`
     : entry.appUrl || appUrl;
-  const aiServerUp = await probeUrl(`http://127.0.0.1:${entry.port}/embed-config.js`);
+  const aiServerUp = await isChatServerOnPort(entry.port);
   if (aiServerUp) {
     clearProcessProblem(sandboxId, "ai_server_launch", "ai");
     clearProcessProblem(sandboxId, "apps_not_started");
@@ -3914,7 +4309,9 @@ async function setupWorkspace(cfg, action) {
   );
   const waitingForStart = !aiServerUp;
   const warning = waitingForStart
-    ? "Folder is attached in Maintainer Pro. Use Start Apps when you want to launch the apps."
+    ? needsReview
+      ? "Folder attached. Review the suggested apps and ports in Maintainer Pro, then Start Apps."
+      : "Folder is attached in Maintainer Pro. Review apps if needed, then use Start Apps."
     : processIssues[0]?.message || null;
 
   for (const note of client.notes) log(`setup note ${note}`);
@@ -3933,7 +4330,7 @@ async function setupWorkspace(cfg, action) {
     origins: host.origins.length
       ? host.origins
       : [...new Set([corsOrigin, aiOrigin, entry.appUrl].filter(Boolean))],
-    wroteEnv: true,
+    wroteEnv: false,
     clientKind: client.kind,
     clientFiles: client.filesWritten,
     clientNotes: client.notes,
@@ -3943,11 +4340,98 @@ async function setupWorkspace(cfg, action) {
     processIssues,
     warning,
     waitingForStart,
+    needsReview,
+    hostApps: ports.apps || entry.hostApps || [],
+    reasons: ports.reasons || [],
     projectInfo,
     ignorePaths: access.ignorePaths,
   };
 }
 
+async function proposeSetupForWorkspace(ws, cfg, opts = {}) {
+  const folder = path.resolve(ws.folderPath || "");
+  const label = ws.sandboxName || shortId(ws.sandboxId) || "sandbox";
+  activity(ws.sandboxId, "info", `Suggesting setup for ${label} from config files`);
+  try {
+    const cli = await loadAiCli();
+    if (typeof cli.proposeHostAppsFromConfig !== "function") {
+      throw new Error(
+        "ai-cli is missing proposeHostAppsFromConfig — update @maintainer-pro/ai-cli"
+      );
+    }
+    const proposal = await cli.proposeHostAppsFromConfig({
+      workspaceDir: folder,
+      appName: ws.applicationName || ws.sandboxName,
+      preferredAiPort: Number(ws.port) || 3100,
+      allowAi: opts.allowAi !== false,
+    });
+    const previous = Array.isArray(ws.hostApps) ? ws.hostApps : [];
+    const apps = (proposal.apps || []).map((app) => {
+      const match = previous.find((row) => row && row.id === app.id);
+      if (!match || (app.envMaps && app.envMaps.length)) return app;
+      return { ...app, envMaps: match.envMaps || [] };
+    });
+    // Keep last known apps on the workspace; do not auto-apply proposal.
+    if (!Array.isArray(ws.hostApps) || !ws.hostApps.length) {
+      ws.hostApps = apps;
+      persistWorkspaceEntry(cfg, ws);
+    }
+    activity(
+      ws.sandboxId,
+      proposal.needsReview ? "warn" : "info",
+      `setup suggestion ${proposal.confidence}${proposal.usedAi ? " + ai" : ""}: ${
+        proposal.projectSummary || apps.map((a) => `${a.name}:${a.port}`).join(", ")
+      }`
+    );
+    for (const reason of proposal.reasons || []) {
+      activity(ws.sandboxId, "warn", reason);
+    }
+    return {
+      proposal: {
+        apps,
+        alternatives: proposal.alternatives || [],
+        reasons: proposal.reasons || [],
+        confidence: proposal.confidence,
+        projectSummary: proposal.projectSummary || "",
+        usedAi: Boolean(proposal.usedAi),
+        needsReview: Boolean(proposal.needsReview),
+        fingerprint: proposal.fingerprint || null,
+      },
+      hostApps: apps,
+      reasons: proposal.reasons || [],
+      usedAi: Boolean(proposal.usedAi),
+      needsReview: Boolean(proposal.needsReview),
+      log: activityLogFor(ws.sandboxId),
+    };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    activity(ws.sandboxId, "warn", `setup suggestion failed: ${message}`);
+    const fallback = await resolveWorkspaceHostApps(ws, {
+      cfg,
+      force: true,
+      ignoreDesired: true,
+      allowAi: false,
+    });
+    return {
+      proposal: {
+        apps: fallback.apps,
+        alternatives: [],
+        reasons: [...(fallback.reasons || []), message],
+        confidence: "low",
+        projectSummary: "Could not finish AI suggest — showing file detection.",
+        usedAi: false,
+        needsReview: true,
+        fingerprint: fallback.fingerprint || null,
+      },
+      hostApps: fallback.apps,
+      reasons: fallback.reasons || [],
+      usedAi: false,
+      needsReview: true,
+      log: activityLogFor(ws.sandboxId),
+    };
+  }
+}
+
 async function runActions(cfg, actions) {
   if (!actions.length) return;
   log(`actions received ${actions.length}: ${actions.map((a) => a.code).join(", ")}`);
@@ -3960,9 +4444,11 @@ async function runActions(cfg, actions) {
     let result = {};
     try {
       if (action.code === "browse") {
-        const p = String(action.payload?.path || process.cwd());
+        const allowed = collectOfferedFolders();
+        const p = String(action.payload?.path || "roots");
         log(`${label} browse ${p}`);
-        result = listDirEntries(p);
+        result = listDirEntries(p, allowed);
+        if (result.error) ok = false;
         log(`${label} browse ${result.entries?.length ?? 0} entries`);
       } else if (action.code === "setup_workspace") {
         result = await setupWorkspace(cfg, action);
@@ -3984,7 +4470,11 @@ async function runActions(cfg, actions) {
           const partnerIgnorePaths = Array.isArray(action.payload?.aiIgnorePaths)
             ? action.payload.aiIgnorePaths
             : [];
-          const access = applyAccessPolicy(ws.folderPath, partnerIgnorePaths);
+          const access = applyAccessPolicy(
+            ws.folderPath,
+            partnerIgnorePaths,
+            ws.sandboxId
+          );
           log(
             `access policy synced for ${ws.folderPath} (${access.ignorePaths.length} ignore rules)`
           );
@@ -4000,14 +4490,96 @@ async function runActions(cfg, actions) {
         if (!ws) {
           log(`${label} recheck: no local workspace`);
         }
-        const projectInfo = ws
-          ? await inspectProjectWithAiCli(ws, { cfg, force: true })
+        const hostApps = ws
+          ? await resolveWorkspaceHostApps(ws, { cfg, force: true, allowAi: false })
           : null;
         result = {
           recheckedAt: new Date().toISOString(),
-          projectInfo,
+          hostApps: hostApps?.apps || [],
+          projectInfo: ws?.projectInfo || null,
         };
-      } else if (action.code === "start_ai_server") {
+      } else if (action.code === "redetect_ports" || action.code === "propose_setup") {
+        const sandboxId = action.sandboxId || action.payload?.sandboxId;
+        const ws = (cfg.workspaces || []).find((w) => w.sandboxId === sandboxId);
+        if (!ws) {
+          ok = false;
+          result = { error: "No folder is attached for this sandbox" };
+        } else {
+          activity(
+            ws.sandboxId,
+            "info",
+            action.code === "propose_setup"
+              ? "Setup suggestions requested from Maintainer Pro"
+              : "Detect ports requested from Maintainer Pro"
+          );
+          result = await proposeSetupForWorkspace(ws, cfg, {
+            allowAi: action.payload?.allowAi !== false,
+          });
+        }
+      } else if (action.code === "update_host_apps") {
+        const sandboxId = action.sandboxId || action.payload?.sandboxId;
+        const ws = (cfg.workspaces || []).find((w) => w.sandboxId === sandboxId);
+        if (!ws) {
+          ok = false;
+          result = { error: "No folder is attached for this sandbox" };
+        } else {
+          const desired = Array.isArray(action.payload?.hostApps)
+            ? action.payload.hostApps
+            : [];
+          activity(
+            ws.sandboxId,
+            "info",
+            `Applying ports from Maintainer Pro: ${desired
+              .map((app) => `${app.name || app.id}:${app.port}`)
+              .join(", ")}`
+          );
+          const resolved = await resolveWorkspaceHostApps(ws, {
+            cfg,
+            desired,
+            allowAi: false,
+          });
+          result = { hostApps: resolved.apps, log: activityLogFor(ws.sandboxId) };
+        }
+      } else if (action.code === "start_app") {
+        const sandboxId = action.sandboxId || action.payload?.sandboxId;
+        const ws = (cfg.workspaces || []).find((w) => w.sandboxId === sandboxId);
+        if (!ws) {
+          ok = false;
+          result = { error: "No folder is attached for this sandbox" };
+        } else {
+          result = await startSingleApp(ws, cfg, action.payload || {}, {
+            actionId: action.id,
+          });
+          if (result.error) ok = false;
+        }
+      } else if (action.code === "restart_app") {
+        const sandboxId = action.sandboxId || action.payload?.sandboxId;
+        const ws = (cfg.workspaces || []).find((w) => w.sandboxId === sandboxId);
+        if (!ws) {
+          ok = false;
+          result = { error: "No folder is attached for this sandbox" };
+        } else {
+          result = await restartSingleApp(ws, cfg, action.payload || {}, {
+            actionId: action.id,
+          });
+          if (result.error) ok = false;
+        }
+      } else if (action.code === "start_cloudflare_app") {
+        const sandboxId = action.sandboxId || action.payload?.sandboxId;
+        const ws = (cfg.workspaces || []).find((w) => w.sandboxId === sandboxId);
+        if (!ws) {
+          ok = false;
+          result = { error: "No folder is attached for this sandbox" };
+        } else {
+          result = await startCloudflareForApp(ws, cfg, action.payload || {}, {
+            actionId: action.id,
+          });
+          if (result.error) ok = false;
+        }
+      } else if (
+        action.code === "start_ai_server" ||
+        action.code === "restart_apps"
+      ) {
         const sandboxId = action.sandboxId || action.payload?.sandboxId;
         const ws =
           (cfg.workspaces || []).find((w) => w.sandboxId === sandboxId) ||
@@ -4023,10 +4595,24 @@ async function runActions(cfg, actions) {
           result = { error: "No workspace or --no-ai-server" };
           warn(`${label} skipped: ${result.error}`);
         } else {
+          const restarting = action.code === "restart_apps";
+          log(
+            `${label} ${restarting ? "restart" : "start"} ${ws.folderPath}`
+          );
+          if (restarting) {
+            await reportActionProgress(
+              cfg,
+              action.id,
+              `Stopping apps for ${ws.sandboxName || shortId(ws.sandboxId)}…`
+            );
+            await stopWorkspaceApps(ws);
+          }
           // Prefer cached project inspect; only call ai-cli when missing or
           // after a failed start that used the cache.
-          log(`${label} start ${ws.folderPath}`);
-          let projectInfo = await inspectProjectWithAiCli(ws, { cfg });
+          let projectInfo = await resolveWorkspaceHostApps(ws, {
+            cfg,
+            allowAi: false,
+          });
           let started = await startAppsForWorkspace(ws, cfg, {
             actionId: action.id,
           });
@@ -4182,7 +4768,6 @@ async function collectWorkspaceStates(cfg) {
   for (const ws of cfg.workspaces || []) {
     const folder = path.resolve(ws.folderPath || "");
     const status = await reconcileWorkspacePresence(ws, cfg, {
-      writeEnv: true,
       timeoutMs: 800,
     });
     localStates.push({
@@ -4194,14 +4779,13 @@ async function collectWorkspaceStates(cfg) {
       appsRunning: status.appsRunning,
       startingAi: recentlyLaunched(`${ws.sandboxId}:${folder}:ai`),
       appUrl:
-        status.appsRunning || status.usingCloudflare
+        status.appsRunning
           ? status.host.appUrl || ws.appUrl || null
           : null,
-      origins:
-        status.appsRunning || status.usingCloudflare
-          ? status.host.origins
-          : [],
+      origins: status.appsRunning ? status.host.origins : [],
       appsRequested: appsWanted(ws) || status.appsRunning,
+      hostApps: status.probe.hostApps || ws.hostApps || [],
+      activityLog: activityLogFor(ws.sandboxId),
     });
   }
   return localStates;
@@ -4213,24 +4797,36 @@ const lastHostReports = new Map();
 function syncAssignedWorkspaces(cfg, remotes) {
   if (!Array.isArray(remotes)) return;
   for (const remote of remotes) {
-    const local = (cfg.workspaces || []).find(
+    let local = (cfg.workspaces || []).find(
       (w) => w.sandboxId === remote.sandboxId
     );
     if (!local) {
       cfg.workspaces = cfg.workspaces || [];
-      cfg.workspaces.push({
+      local = {
         sandboxId: remote.sandboxId,
         folderPath: remote.folderPath,
         port: remote.port,
         sandboxName: remote.sandboxName,
         applicationName: remote.applicationName,
-      });
+      };
+      cfg.workspaces.push(local);
       saveConfig(cfg);
     } else if (local.folderPath !== remote.folderPath) {
       local.folderPath = remote.folderPath;
       local.port = remote.port;
       saveConfig(cfg);
     }
+    if (Array.isArray(remote.hostApps) && remote.hostApps.length) {
+      const localCount = Array.isArray(local.hostApps) ? local.hostApps.length : 0;
+      if (remote.hostApps.length >= localCount) {
+        local.hostApps = remote.hostApps;
+      }
+    }
+    const prevToken = local.proxy?.token;
+    applyAssignedProxy(local, remote, cfg);
+    if (local.proxy?.token && local.proxy.token !== prevToken) {
+      persistWorkspaceEntry(cfg, local);
+    }
   }
 }
 
@@ -4263,6 +4859,8 @@ async function sendHeartbeat(cfg, folders, localStates) {
           ? st.origins
           : undefined,
       appsRequested: Boolean(st.appsRequested),
+      hostApps: st.hostApps || [],
+      activityLog: st.activityLog || [],
     })),
   };
   return api(
@@ -4314,6 +4912,8 @@ async function buildHeartbeatPayload(cfg, folders, localStates) {
           ? st.origins
           : undefined,
       appsRequested: Boolean(st.appsRequested),
+      hostApps: st.hostApps || [],
+      activityLog: st.activityLog || [],
     })),
   };
 }
@@ -4464,32 +5064,24 @@ async function main() {
     { logLevel: logger.level, nodeEnv: process.env.NODE_ENV },
     "bridge starting"
   );
+  void warnIfBridgeOutdated();
 
   let cfg = loadConfig() || {};
   ensureMachineId(cfg);
 
-  if (typeof args.offerFolder === "string") {
-    cfg.offeredFolders = cfg.offeredFolders || [];
-    const resolved = path.resolve(args.offerFolder);
-    if (!cfg.offeredFolders.includes(resolved)) {
-      cfg.offeredFolders.push(resolved);
-      saveConfig(cfg);
-      log(`offering folder ${resolved}`);
-    }
-  }
-
   if (args.pair || !cfg.token || !cfg.adminUrl) {
     cfg = await pairFlow(args);
   }
 
   cfg.noAiServer = Boolean(args.noAiServer);
   saveConfig(cfg);
+  bridgeCfg = cfg;
 
   log(`machine ${cfg.machineId}`);
   log(`admin ${cfg.adminUrl}`);
   log(`config ${configPath()}`);
   log(
-    `online via websocket (presence every ${HEARTBEAT_MS / 1000}s, ping every ${WS_PING_MS / 1000}s)`
+    `online via websocket (presence every ${HEARTBEAT_MS / 1000}s, ping every ${WS_PING_MS / 1000}s; reconnects until stopped)`
   );
   await restoreHostsAfterReconnect(cfg);
 
@@ -4519,25 +5111,37 @@ async function main() {
     void runWork();
   };
 
-  /** @type {import('ws').WebSocket | null} */
+  /** @type {WebSocket | null} */
   let socket = null;
   let heartbeatTimer = null;
   let pingTimer = null;
   let reconnectTimer = null;
+  let watchdogTimer = null;
   let wsGeneration = 0;
   let reconnectAttempt = 0;
+  let connectStartedAt = 0;
   let stopped = false;
   let presenceBusy = false;
 
+  let sendChain = Promise.resolve();
   const sendJson = (payload) => {
-    if (!socket || socket.readyState !== 1) return false;
+    const current = socket;
+    if (!current || current.readyState !== 1) return false;
+    let text;
     try {
-      socket.send(JSON.stringify(payload));
-      return true;
+      text = JSON.stringify(payload);
     } catch {
       return false;
     }
+    sendChain = sendChain
+      .then(() => {
+        if (!socket || socket !== current || socket.readyState !== 1) return;
+        socket.send(text);
+      })
+      .catch(() => {});
+    return true;
   };
+  bridgeSend = sendJson;
 
   const clearHeartbeatTimer = () => {
     if (heartbeatTimer) {
@@ -4566,7 +5170,7 @@ async function main() {
   };
 
   const sendLightPresence = () => {
-    const folders = collectOfferedFolders(cfg);
+    const folders = collectOfferedFolders();
     sendJson(buildLightHeartbeatPayload(cfg, folders));
   };
 
@@ -4574,7 +5178,7 @@ async function main() {
     if (!socket || socket.readyState !== 1 || presenceBusy) return;
     presenceBusy = true;
     try {
-      const folders = collectOfferedFolders(cfg);
+      const folders = collectOfferedFolders();
       const localStates = await collectWorkspaceStates(cfg);
       const payload = await buildHeartbeatPayload(cfg, folders, localStates);
       sendJson(payload);
@@ -4627,6 +5231,38 @@ async function main() {
       fail(`no local workspace for sandbox ${sandboxId || "?"}`);
       return;
     }
+    const body = {
+      conversationId,
+      messages: payloadMessages,
+      userMessage: content || undefined,
+      skipPersistUser: true,
+      userMessageId: userMessageId || undefined,
+      senderType: msg.senderType === "client" ? "client" : undefined,
+      senderName:
+        typeof msg.senderName === "string" ? msg.senderName : undefined,
+    };
+    const embedded = embeddedChat.get(sandboxId);
+    if (embedded?.runChat) {
+      log(`chat.run → in-process ${embedded.workspaceDir} (${conversationId})`);
+      try {
+        const result = await embedded.runChat(body);
+        if (!result.ok) {
+          fail(result.data?.error || `AI server ${result.status}`);
+          return;
+        }
+        log(`chat.run ok (${conversationId})`);
+        sendJson({
+          type: "chat.run.result",
+          ok: true,
+          sandboxId,
+          conversationId,
+          userMessageId,
+        });
+      } catch (err) {
+        fail(err instanceof Error ? err.message : String(err));
+      }
+      return;
+    }
     const chat = await discoverChatPort(ws, 2500);
     if (chat.up) ws.port = chat.port;
     const port = Number(chat.port || ws.port) || 3100;
@@ -4639,16 +5275,7 @@ async function main() {
           "content-type": "application/json",
           accept: "application/json",
         },
-        body: JSON.stringify({
-          conversationId,
-          messages: payloadMessages,
-          userMessage: content || undefined,
-          skipPersistUser: true,
-          userMessageId: userMessageId || undefined,
-          senderType: msg.senderType === "client" ? "client" : undefined,
-          senderName:
-            typeof msg.senderName === "string" ? msg.senderName : undefined,
-        }),
+        body: JSON.stringify(body),
       });
       const text = await res.text();
       let data = null;
@@ -4692,6 +5319,26 @@ async function main() {
       queueActions(msg.actions);
       return;
     }
+    if (msg.type === "proxy.http") {
+      handleProxyHttpFromAdmin(msg);
+      return;
+    }
+    if (msg.type === "proxy.http.body") {
+      handleProxyHttpBodyFromAdmin(msg);
+      return;
+    }
+    if (msg.type === "proxy.ws.open") {
+      handleProxyWsOpenFromAdmin(msg);
+      return;
+    }
+    if (msg.type === "proxy.ws.frame") {
+      handleProxyWsFrameFromAdmin(msg);
+      return;
+    }
+    if (msg.type === "proxy.ws.close") {
+      handleProxyWsCloseFromAdmin(msg);
+      return;
+    }
     if (msg.type === "chat.run") {
       void handleChatRun(msg);
       return;
@@ -4701,37 +5348,56 @@ async function main() {
     }
   };
 
+  const socketState = () => {
+    if (!socket) return -1;
+    return socket.readyState;
+  };
+
+  const dropSocket = (ws) => {
+    if (!ws) return;
+    try {
+      ws.close();
+    } catch {
+      /* ignore */
+    }
+    if (socket === ws) socket = null;
+  };
+
   const scheduleReconnect = (code, reason) => {
     if (stopped || reconnectTimer) return;
+    const state = socketState();
+    if (state === 0 || state === 1) return;
     const delay = Math.min(
       WS_RECONNECT_MAX_MS,
-      WS_RECONNECT_MIN_MS * 2 ** Math.min(reconnectAttempt, 4)
+      WS_RECONNECT_MIN_MS * 2 ** Math.min(reconnectAttempt, 5)
     );
     reconnectAttempt += 1;
     const detail = reason ? ` ${reason}` : "";
     const wait =
       delay < 1000 ? `${delay}ms` : `${Math.round(delay / 1000)}s`;
     warn(
-      `websocket closed (${code || "?"}${detail}); reconnecting in ${wait}`
+      `admin connection lost (${code || "?"}${detail}); retrying in ${wait}`
     );
     reconnectTimer = setTimeout(() => {
       reconnectTimer = null;
+      if (stopped) return;
+      const next = socketState();
+      if (next === 0 || next === 1) return;
       connectWs();
     }, delay);
   };
 
   const connectWs = () => {
     if (stopped) return;
+    const state = socketState();
+    if (state === 0 || state === 1) return;
     clearReconnectTimer();
     const generation = ++wsGeneration;
     if (socket) {
-      try {
-        socket.close();
-      } catch {
-        /* ignore */
-      }
+      dropSocket(socket);
       socket = null;
     }
+    sendChain = Promise.resolve();
     const url = adminWsUrl(cfg.adminUrl, cfg.token);
     log(
       reconnectAttempt
@@ -4739,12 +5405,35 @@ async function main() {
         : "websocket connecting…"
     );
     /** @type {WebSocket} */
-    const ws = new WebSocket(url);
+    let ws;
+    try {
+      ws = new WebSocket(url);
+    } catch (err) {
+      warn(
+        `websocket connect failed: ${
+          err instanceof Error ? err.message : String(err)
+        }`
+      );
+      scheduleReconnect(0, "connect failed");
+      return;
+    }
     socket = ws;
+    connectStartedAt = Date.now();
+
+    const onDisconnected = (code, reason) => {
+      if (generation !== wsGeneration) return;
+      // Node fires `error` while CONNECTING/OPEN; that is not a drop.
+      if (ws.readyState === 0 || ws.readyState === 1) return;
+      clearHeartbeatTimer();
+      clearPingTimer();
+      if (socket === ws) socket = null;
+      scheduleReconnect(code, reason);
+    };
 
     ws.addEventListener("open", () => {
       if (generation !== wsGeneration) return;
       reconnectAttempt = 0;
+      connectStartedAt = Date.now();
       log("websocket connected");
       clearHeartbeatTimer();
       clearPingTimer();
@@ -4763,34 +5452,61 @@ async function main() {
     });
 
     ws.addEventListener("close", (event) => {
-      if (generation !== wsGeneration) return;
-      clearHeartbeatTimer();
-      clearPingTimer();
-      if (socket === ws) socket = null;
-      scheduleReconnect(event.code, event.reason);
+      onDisconnected(event.code, event.reason);
     });
 
     ws.addEventListener("error", () => {
-      // close handler drives reconnect
+      // `close` follows for real failures. Reconnecting here races `open`
+      // and makes admin close the live socket with 1000 "replaced".
     });
   };
 
+  const watchdogTick = () => {
+    if (stopped) return;
+    const state = socketState();
+    if (state === 1) return;
+    if (state === 0) {
+      if (Date.now() - connectStartedAt > WS_CONNECT_TIMEOUT_MS) {
+        warn("websocket connect timed out; retrying");
+        wsGeneration += 1;
+        dropSocket(socket);
+        socket = null;
+        scheduleReconnect(0, "connect timeout");
+      }
+      return;
+    }
+    scheduleReconnect(0, "watchdog");
+  };
+
   connectWs();
+  watchdogTimer = setInterval(watchdogTick, WS_WATCHDOG_MS);
+
+  const onFatal = (kind, err) => {
+    const msg = err instanceof Error ? err.message : String(err || kind);
+    warn(`${kind}: ${msg}`);
+    if (!stopped) scheduleReconnect(kind, msg);
+  };
+  process.on("uncaughtException", (err) => onFatal("uncaughtException", err));
+  process.on("unhandledRejection", (err) =>
+    onFatal("unhandledRejection", err)
+  );
 
   const shutdown = () => {
+    if (stopped) return;
     stopped = true;
     wsGeneration += 1;
     clearHeartbeatTimer();
     clearPingTimer();
     clearReconnectTimer();
-    stopAllCloudflare();
-    try {
-      socket?.close();
-    } catch {
-      /* ignore */
+    if (watchdogTimer) {
+      clearInterval(watchdogTimer);
+      watchdogTimer = null;
     }
+    stopAllCloudflare();
+    dropSocket(socket);
+    socket = null;
     log("shutting down (other terminals stay open)");
-    process.exit(0);
+    void stopAllEmbeddedChat().finally(() => process.exit(0));
   };
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);