@puddle-code/cli 0.0.42 → 0.0.46

package/dist/index.js

@@ -3756,7 +3756,7 @@ var init_wrapper = __esm({
 
 // src/lib/ws-client.ts
 function connectGateway(port, token) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const ws = new wrapper_default(`ws://127.0.0.1:${port}/ws`, {
       headers: { host: `localhost:${port}` }
     });
@@ -3778,7 +3778,7 @@ function connectGateway(port, token) {
     ws.on("close", () => closeCbs.forEach((cb) => cb()));
     ws.once("open", () => {
       ws.send(JSON.stringify({ t: "auth", token }));
-      resolve3({
+      resolve4({
         send(message) {
           if (ws.readyState === wrapper_default.OPEN) ws.send(JSON.stringify(message));
         },
@@ -3841,7 +3841,7 @@ async function attachSession(opts) {
     rows: streams.stdout.rows ?? 24
   });
   gateway.send({ t: "attach", session: session.id, term, ...dims2() });
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let settled = false;
     const finish = (outcome) => {
       if (settled) return;
@@ -3850,7 +3850,7 @@ async function attachSession(opts) {
       stdin.removeListener("data", onStdin);
       unResize?.();
       gateway.close();
-      resolve3(outcome);
+      resolve4(outcome);
     };
     gateway.onMessage((message) => {
       switch (message.t) {
@@ -3945,6 +3945,9 @@ usage:
   puddle remove  <cli|daemon|desktop> [user@host] [--yes] [--purge]
   puddle --version | --help
 
+--version lists the installed CLI, daemon, and desktop app with the protocol
+each speaks; absent local components are reported as not installed.
+
 launch serves the cockpit at http://localhost:7433 against the daemon on this
 machine when no host (or 'local') is given \u2014 installing it under ~/.puddle if
 needed \u2014 and does the same for an SSH host through one tunnel. It keeps
@@ -3952,8 +3955,8 @@ running in the background once ready, so the terminal may close (--foreground
 to stay attached; Ctrl-C then stops the cockpit). refresh stops a target's
 cockpit (even a wedged one) and runs the full launch flow again \u2014 tunnel,
 daemon restart if needed \u2014 keeping the old UI port so open tabs survive.
-list shows running cockpits; kill stops one \u2014 sessions keep running on the
-host either way.
+list shows running cockpits; kill stops one. Sessions keep running under a
+persistent supervisor; an SSH-attached daemon keeps their state for the next launch.
 
 install puts a component in place: 'daemon' under ~/.puddle on this machine
 or a user@host, 'desktop' as the macOS app bundle \u2014 or, on Linux, an
@@ -4226,8 +4229,8 @@ function argvFor(command) {
 
 // src/cli/run.ts
 init_attach();
-import { existsSync as existsSync4 } from "node:fs";
-import { dirname as dirname7, join as join10 } from "node:path";
+import { existsSync as existsSync5 } from "node:fs";
+import { dirname as dirname8, join as join11 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/lib/browser.ts
@@ -4245,11 +4248,19 @@ function openBrowser(url2, platform = process.platform) {
   }
 }
 
-// src/lib/connect.ts
-import { join as join5 } from "node:path";
+// src/lib/component-versions.ts
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync as readFileSync2,
+  readlinkSync,
+  renameSync,
+  writeFileSync
+} from "node:fs";
+import { dirname as dirname3, join as join4, resolve } from "node:path";
 
 // ../shared/src/protocol.ts
-var PROTOCOL_VERSION = { major: 16, minor: 0 };
+var PROTOCOL_VERSION = { major: 16, minor: 1 };
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -19517,6 +19528,12 @@ var resolvePathResponseSchema = external_exports.object({
   line: external_exports.number().int().nullable(),
   /** What resolved (15.2). Absent means `file` — pre-15.2 daemons only answered files. */
   kind: external_exports.enum(["file", "dir"]).optional(),
+  /**
+   * For a directory contained by the resolution root, its root-relative path
+   * (16.1). This lets Files reveal it in the existing tree instead of entering
+   * an external pinned browse. Absent for directories outside that root.
+   */
+  relative_path: external_exports.string().optional(),
   /**
    * Absolute browse root when the file lies OUTSIDE the worktree (15.2):
    * `path` is then relative to it — the `external` tab convention (SPEC §8).
@@ -19789,54 +19806,14 @@ var wsClientMessageSchema = external_exports.discriminatedUnion("t", [
   })
 ]);
 
-// src/lib/net.ts
-import { connect, createServer } from "node:net";
-function findFreePort() {
-  return new Promise((resolve3, reject) => {
-    const srv = createServer();
-    srv.once("error", reject);
-    srv.listen(0, "127.0.0.1", () => {
-      const address = srv.address();
-      const port = typeof address === "object" && address !== null ? address.port : 0;
-      srv.close(() => resolve3(port));
-    });
-  });
-}
-function tcpListening(port, timeoutMs = 500) {
-  return new Promise((resolve3) => {
-    const sock = connect({ host: "127.0.0.1", port });
-    const done = (ok) => {
-      sock.destroy();
-      resolve3(ok);
-    };
-    sock.setTimeout(timeoutMs, () => done(false));
-    sock.once("connect", () => done(true));
-    sock.once("error", () => done(false));
-  });
-}
-async function waitForTcp(port, timeoutMs) {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    if (await tcpListening(port)) return true;
-    await sleep(150);
-  }
-  return false;
-}
-async function waitForHttp(url2, timeoutMs) {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    try {
-      await fetch(url2, { signal: AbortSignal.timeout(2e3) });
-      return true;
-    } catch {
-      await sleep(250);
-    }
-  }
-  return false;
-}
-function sleep(ms) {
-  return new Promise((r) => setTimeout(r, ms));
-}
+// src/lib/desktop-update.ts
+import { createHash } from "node:crypto";
+import { spawn as spawn2 } from "node:child_process";
+import { constants, createReadStream, createWriteStream } from "node:fs";
+import { access, chmod, mkdir, readdir, rm, writeFile } from "node:fs/promises";
+import { dirname as dirname2, join as join3 } from "node:path";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
 
 // src/lib/paths.ts
 import { homedir } from "node:os";
@@ -19852,116 +19829,12 @@ var hostPaths = {
   runtime: `${HOST_HOME}/runtime.json`,
   current: `${HOST_HOME}/bin/current`,
   cache: `${HOST_HOME}/cache`,
-  logs: `${HOST_HOME}/logs`
-};
-
-// src/lib/daemon-client.ts
-init_types();
-var LIVE = /* @__PURE__ */ new Set(["starting", "running", "waiting_input"]);
-var DaemonClient = class {
-  constructor(port, token) {
-    this.port = port;
-    this.token = token;
-  }
-  setPort(port) {
-    this.port = port;
-  }
-  async get(path) {
-    let res;
-    try {
-      res = await fetch(`http://127.0.0.1:${this.port}${path}`, {
-        headers: { authorization: `Bearer ${this.token}` },
-        signal: AbortSignal.timeout(1e4)
-      });
-    } catch {
-      throw new CliError("daemon_unreachable", "the Puddle daemon is not reachable");
-    }
-    if (res.status === 401) {
-      throw new CliError(
-        "token_rejected",
-        "the stored token was rejected by the daemon",
-        "inspect ~/.puddle/token on the host \u2014 it may have been regenerated"
-      );
-    }
-    if (!res.ok) {
-      throw new CliError("daemon_unreachable", `the daemon answered ${res.status} for ${path}`);
-    }
-    return res.json();
-  }
-  version() {
-    return this.get("/api/version").then((body) => versionResponseSchema.parse(body));
-  }
-  host() {
-    return this.get("/api/host").then((body) => hostInfoSchema.parse(body));
-  }
-  sessions() {
-    return this.get("/api/sessions").then((body) => sessionSchema.array().parse(body));
-  }
-  profiles() {
-    return this.get("/api/profiles").then((body) => profileSchema.array().parse(body));
-  }
-  /** The live subset of sessions() — what an upgrade/removal interrupts. */
-  async liveSessions() {
-    return (await this.sessions()).filter((s) => LIVE.has(s.status));
-  }
-  async liveSessionCount() {
-    return (await this.sessions()).filter((s) => LIVE.has(s.status)).length;
-  }
-  /** Whether anything daemon-shaped answers /api/version (401 counts as alive). */
-  async responds() {
-    try {
-      const res = await fetch(`http://127.0.0.1:${this.port}/api/version`, {
-        headers: { authorization: `Bearer ${this.token}` },
-        signal: AbortSignal.timeout(2e3)
-      });
-      return res.status < 500;
-    } catch {
-      return false;
-    }
-  }
+  logs: `${HOST_HOME}/logs`,
+  supervisor: `${HOST_HOME}/supervisor`,
+  pid: `${HOST_HOME}/puddled.pid`
 };
-async function readDaemonPort(transport) {
-  const runtime = await transport.readFile(hostPaths.runtime);
-  if (runtime !== null) {
-    try {
-      const parsed = JSON.parse(runtime);
-      if (typeof parsed.port === "number") return parsed.port;
-    } catch {
-    }
-  }
-  const raw = await transport.readFile(hostPaths.config);
-  if (raw !== null) {
-    try {
-      const parsed = JSON.parse(raw);
-      if (typeof parsed.port === "number") return parsed.port;
-    } catch {
-    }
-  }
-  return 7434;
-}
-async function readToken(transport) {
-  const raw = await transport.readFile(hostPaths.token);
-  const token = raw?.trim() ?? "";
-  return /^[0-9a-f]{32,}$/.test(token) ? token : null;
-}
-async function waitForToken(transport, timeoutMs) {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    const token = await readToken(transport);
-    if (token !== null) return token;
-    await sleep(500);
-  }
-  throw new CliError(
-    "daemon_start_timeout",
-    `puddled did not come up on ${transport.label}`,
-    transport.kind === "ssh" ? `inspect it with: puddle logs ${transport.label}` : "inspect it with: puddle logs"
-  );
-}
 
-// src/lib/bootstrap.ts
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
-import { dirname as dirname2, join as join3, resolve } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+// src/lib/desktop-update.ts
 init_types();
 
 // src/lib/version.ts
@@ -19969,7 +19842,7 @@ import { readFileSync } from "node:fs";
 import { dirname, join as join2 } from "node:path";
 import { fileURLToPath } from "node:url";
 function cliVersion() {
-  if (true) return "0.0.42";
+  if (true) return "0.0.46";
   const here = dirname(fileURLToPath(import.meta.url));
   for (const candidate of [
     join2(here, "..", "..", "package.json"),
@@ -19992,103 +19865,696 @@ function repoSlug(env = process.env) {
   return void 0;
 }
 
-// src/lib/bootstrap.ts
-async function installedVersion(transport) {
-  const result = await transport.exec(`readlink ${hostPaths.current}`, { timeoutMs: 15e3 });
-  if (result.code !== 0) return null;
-  const match = /versions\/([^/\s]+)\s*$/.exec(result.stdout.trim());
-  return match?.[1] ?? null;
-}
-async function installDaemon(transport, opts = {}) {
-  const logger = opts.logger ?? silentLogger;
-  const version2 = opts.version ?? pinnedDaemonVersion();
-  const script = readInstallScript();
-  const args = ["--version", version2];
-  if (opts.tarball !== void 0 && !/^https?:\/\//.test(opts.tarball)) {
-    if (!existsSync(opts.tarball)) {
-      throw new CliError("not_installed", `tarball not found: ${opts.tarball}`);
-    }
-    if (transport.kind === "local") {
-      args.push("--tarball", resolve(opts.tarball));
-      const localSums = `${opts.tarball}.sha256`;
-      if (existsSync(localSums)) args.push("--sums", resolve(localSums));
-    } else {
-      const base = opts.tarball.split("/").pop() ?? "puddled.tar.gz";
-      const destTarball = `.puddle/cache/${base}`;
-      logger.info(`delivering ${base} to ${transport.label}`);
-      await transport.copyTo(opts.tarball, destTarball);
-      const sums = `${opts.tarball}.sha256`;
-      if (existsSync(sums)) {
-        await transport.copyTo(sums, `${destTarball}.sha256`);
-        args.push("--tarball", destTarball, "--sums", `${destTarball}.sha256`);
-      } else {
-        args.push("--tarball", destTarball);
-      }
-    }
-  } else {
-    const slug2 = repoSlug();
-    if (opts.tarball !== void 0) {
-      throw new CliError("bad_arguments", "--tarball must be a local file path");
-    }
-    if (slug2 === void 0) {
-      throw new CliError(
-        "not_installed",
-        "no release source is configured for this build",
-        "pass --tarball <path> (pnpm build:tarball produces one) or set PUDDLE_REPO=owner/repo"
-      );
-    }
-    args.push("--repo", slug2);
-  }
-  logger.info(`installing puddled ${version2} on ${transport.label}`);
-  const quoted = args.map((a) => `'${a.replaceAll("'", `'\\''`)}'`).join(" ");
-  const result = await transport.exec(`sh -s -- ${quoted}`, {
-    stdin: script,
-    timeoutMs: 10 * 6e4,
-    onStdout: (chunk) => {
-      for (const line of chunk.split("\n")) if (line.trim() !== "") logger.info(line.trimEnd());
-    }
-  });
-  if (result.code !== 0) {
-    throw new CliError(
-      "not_installed",
-      `the installer failed on ${transport.label} (exit ${result.code})`,
-      lastLines(result.stderr || result.stdout)
-    );
+// src/lib/desktop-update.ts
+function isNewerVersion(candidate, current) {
+  const parse3 = (v) => {
+    const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(v.trim());
+    return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
+  };
+  const a = parse3(candidate);
+  const b = parse3(current);
+  if (a === null || b === null) return false;
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] > b[i];
   }
+  return false;
 }
-function lastLines(text, count = 3) {
-  return text.trim().split("\n").slice(-count).join("\n");
+function pickDesktopAsset(assets, platform, arch) {
+  const suffix = platform === "darwin" ? "-mac.zip" : platform === "linux" ? ".AppImage" : null;
+  if (suffix === null) return null;
+  return assets.find(
+    (a) => a.name.endsWith(suffix) && a.name.includes("-arm64") === (arch === "arm64")
+  ) ?? null;
 }
-function readInstallScript() {
-  const here = dirname2(fileURLToPath2(import.meta.url));
-  const candidates = [
-    join3(here, "install.sh"),
-    // dist/index.js → dist/install.sh
-    join3(here, "..", "..", "..", "..", "scripts", "install.sh")
-    // src/lib/ → repo root
-  ];
-  for (const candidate of candidates) {
-    if (existsSync(candidate)) return readFileSync2(candidate, "utf8");
+function parseSums(text) {
+  const sums = /* @__PURE__ */ new Map();
+  for (const line of text.split("\n")) {
+    const match = /^([0-9a-f]{64})\s+\*?(.+?)\s*$/.exec(line.trim());
+    if (match) sums.set(match[2], match[1]);
   }
-  throw new CliError("not_installed", "install.sh is missing from this build");
+  return sums;
 }
-
-// src/lib/cockpit.ts
-init_types();
-async function ensureDaemon(transport, opts) {
+async function checkForDesktopUpdate(currentVersion, opts = {}) {
+  const slug2 = repoSlug();
+  if (slug2 === void 0) return null;
+  const fetchFn = opts.fetchFn ?? fetch;
+  const response = await fetchFn(`https://api.github.com/repos/${slug2}/releases/latest`, {
+    headers: { accept: "application/vnd.github+json", "user-agent": "puddle-desktop" }
+  });
+  if (!response.ok) {
+    throw new CliError("not_installed", `release lookup failed (HTTP ${response.status})`);
+  }
+  const release = await response.json();
+  const version2 = (release.tag_name ?? "").replace(/^v/, "");
+  if (!isNewerVersion(version2, currentVersion)) return null;
+  return updateFromRelease(version2, release.assets ?? [], opts);
+}
+async function desktopUpdateAt(version2, opts = {}) {
+  const slug2 = repoSlug();
+  if (slug2 === void 0) {
+    throw new CliError(
+      "not_installed",
+      "no release source is configured for this build",
+      "set PUDDLE_REPO=owner/repo"
+    );
+  }
+  const fetchFn = opts.fetchFn ?? fetch;
+  const response = await fetchFn(`https://api.github.com/repos/${slug2}/releases/tags/v${version2}`, {
+    headers: { accept: "application/vnd.github+json", "user-agent": "puddle-desktop" }
+  });
+  if (response.status === 404) {
+    throw new CliError("not_installed", `no release v${version2} exists in ${slug2}`);
+  }
+  if (!response.ok) {
+    throw new CliError("not_installed", `release lookup failed (HTTP ${response.status})`);
+  }
+  const release = await response.json();
+  return updateFromRelease(version2, release.assets ?? [], opts);
+}
+function updateFromRelease(version2, assets, opts) {
+  const asset = pickDesktopAsset(
+    assets,
+    opts.platform ?? process.platform,
+    opts.arch ?? process.arch
+  );
+  const sums = assets.find((a) => a.name === "SHA256SUMS");
+  if (asset === null || sums === void 0) return null;
+  return {
+    version: version2,
+    asset: { name: asset.name, url: asset.browser_download_url },
+    sumsUrl: sums.browser_download_url
+  };
+}
+async function stageDesktopUpdate(update, opts = {}) {
+  const logger = opts.logger ?? silentLogger;
+  const fetchFn = opts.fetchFn ?? fetch;
+  const dir = join3(opts.cacheDir ?? join3(clientHome(), "cache", "desktop"), update.version);
+  await rm(dir, { recursive: true, force: true });
+  await mkdir(dir, { recursive: true });
+  try {
+    logger.info(`downloading ${update.asset.name}`);
+    const archive = join3(dir, update.asset.name);
+    const response = await fetchFn(update.asset.url, {
+      headers: { "user-agent": "puddle-desktop" }
+    });
+    if (!response.ok || response.body === null) {
+      throw new CliError("not_installed", `download failed (HTTP ${response.status})`);
+    }
+    await pipeline(
+      Readable.fromWeb(response.body),
+      createWriteStream(archive)
+    );
+    const sumsResponse = await fetchFn(update.sumsUrl, {
+      headers: { "user-agent": "puddle-desktop" }
+    });
+    if (!sumsResponse.ok) {
+      throw new CliError("not_installed", `SHA256SUMS fetch failed (HTTP ${sumsResponse.status})`);
+    }
+    const expected = parseSums(await sumsResponse.text()).get(update.asset.name);
+    if (expected === void 0) {
+      throw new CliError("not_installed", `${update.asset.name} is not in SHA256SUMS`);
+    }
+    const actual = await fileSha256(archive);
+    if (actual !== expected) {
+      throw new CliError(
+        "not_installed",
+        `checksum mismatch for ${update.asset.name}`,
+        `expected ${expected}, got ${actual}`
+      );
+    }
+    if (update.asset.name.endsWith(".zip")) {
+      const extractDir = join3(dir, "extract");
+      await run("/usr/bin/ditto", ["-x", "-k", archive, extractDir]);
+      const bundle = (await readdir(extractDir)).find((name) => name.endsWith(".app"));
+      if (bundle === void 0) {
+        throw new CliError("not_installed", "the update zip contains no .app bundle");
+      }
+      logger.info(`staged ${update.version} at ${join3(extractDir, bundle)}`);
+      return {
+        version: update.version,
+        kind: "mac-app",
+        stagedPath: join3(extractDir, bundle),
+        dir
+      };
+    }
+    await chmod(archive, 493);
+    logger.info(`staged ${update.version} at ${archive}`);
+    return { version: update.version, kind: "appimage", stagedPath: archive, dir };
+  } catch (e) {
+    await rm(dir, { recursive: true, force: true });
+    throw e;
+  }
+}
+async function pruneDesktopUpdateCache(keep = [], opts = {}) {
+  const dir = opts.cacheDir ?? join3(clientHome(), "cache", "desktop");
+  let entries;
+  try {
+    entries = await readdir(dir);
+  } catch {
+    return;
+  }
+  await Promise.all(
+    entries.filter((name) => !keep.includes(name)).map((name) => rm(join3(dir, name), { recursive: true, force: true }).catch(() => {
+    }))
+  );
+}
+async function applyDesktopUpdate(staged, opts) {
+  const logger = opts.logger ?? silentLogger;
+  const script = swapScript(staged, opts);
+  const scriptPath = join3(staged.dir, "apply.sh");
+  await writeFile(scriptPath, script, { mode: 493 });
+  logger.info(`applying ${staged.version} via ${scriptPath}`);
+  if (opts.detach ?? true) {
+    const child = spawn2("/bin/sh", [scriptPath], { detached: true, stdio: "ignore" });
+    child.unref();
+    return;
+  }
+  await run("/bin/sh", [scriptPath]);
+}
+var q = (s) => `'${s.replaceAll("'", `'\\''`)}'`;
+function swapScript(staged, opts) {
+  const wait = opts.waitPid === void 0 ? [] : [
+    `i=0`,
+    `while kill -0 ${opts.waitPid} 2>/dev/null; do`,
+    `  i=$((i+1)); [ "$i" -gt 600 ] && exit 1`,
+    `  sleep 0.1`,
+    `done`
+  ];
+  if (staged.kind === "mac-app") {
+    return [
+      `#!/bin/sh`,
+      `# Puddle desktop update ${staged.version} \u2014 swap once the app exits`,
+      ...wait,
+      `target=${q(opts.targetPath)}`,
+      `target_dir=${q(dirname2(opts.targetPath))}`,
+      `staged=${q(staged.stagedPath)}`,
+      `mkdir -p "$target_dir" || exit 1`,
+      `rm -rf "$target.old"`,
+      `had_old=0`,
+      `if [ -e "$target" ]; then`,
+      `  mv "$target" "$target.old" || exit 1`,
+      `  had_old=1`,
+      `fi`,
+      `if mv "$staged" "$target" 2>/dev/null || /usr/bin/ditto "$staged" "$target"; then`,
+      // Defence in depth: the normal path never quarantines (node's fetch is
+      // not a quarantine-opted-in app, and ditto only propagates what the
+      // zip already carries), but if the bundle ever acquires the attribute
+      // the swap must not resurrect the Gatekeeper prompt.
+      `  /usr/bin/xattr -dr com.apple.quarantine "$target" 2>/dev/null`,
+      `  rm -rf "$target.old" ${q(staged.dir)}`,
+      ...opts.relaunch ? [`  open "$target"`] : [],
+      `else`,
+      `  rm -rf "$target"`,
+      `  [ "$had_old" -eq 0 ] || mv "$target.old" "$target"`,
+      `  exit 1`,
+      `fi`,
+      ``
+    ].join("\n");
+  }
+  return [
+    `#!/bin/sh`,
+    `# Puddle desktop update ${staged.version} \u2014 swap once the app exits`,
+    ...wait,
+    `target=${q(opts.targetPath)}`,
+    `cp -f ${q(staged.stagedPath)} "$target" || exit 1`,
+    `chmod +x "$target"`,
+    `rm -rf ${q(staged.dir)}`,
+    ...opts.relaunch ? [`"$target" >/dev/null 2>&1 &`] : [],
+    ``
+  ].join("\n");
+}
+async function findInstalledDesktopApp(opts = {}) {
+  if ((opts.platform ?? process.platform) !== "darwin") return null;
+  const { readFile } = await import("node:fs/promises");
+  const { homedir: homedir3 } = await import("node:os");
+  const systemApplications = opts.systemApplicationsDir ?? "/Applications";
+  const home = opts.homeDir ?? homedir3();
+  for (const appPath of [
+    join3(systemApplications, "Puddle.app"),
+    join3(home, "Applications", "Puddle.app")
+  ]) {
+    try {
+      const plist = await readFile(join3(appPath, "Contents/Info.plist"), "utf8");
+      const match = /<key>CFBundleShortVersionString<\/key>\s*<string>([^<]+)<\/string>/.exec(
+        plist
+      );
+      if (match) return { appPath, version: match[1] };
+    } catch {
+    }
+  }
+  return null;
+}
+async function desktopAppInstallPath(opts = {}) {
+  if ((opts.platform ?? process.platform) !== "darwin") return null;
+  const { homedir: homedir3 } = await import("node:os");
+  const systemApplications = opts.systemApplicationsDir ?? "/Applications";
+  const canWrite = opts.canWrite ?? (async (path) => {
+    try {
+      await access(path, constants.W_OK);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+  if (await canWrite(systemApplications)) return join3(systemApplications, "Puddle.app");
+  const userApplications = join3(opts.homeDir ?? homedir3(), "Applications");
+  await mkdir(userApplications, { recursive: true });
+  return join3(userApplications, "Puddle.app");
+}
+function isDesktopAppRunning(appPath) {
+  return new Promise((resolve4) => {
+    const child = spawn2("/usr/bin/pgrep", ["-f", `${appPath}/Contents/MacOS/`], {
+      stdio: "ignore"
+    });
+    child.on("error", () => resolve4(false));
+    child.on("exit", (code) => resolve4(code === 0));
+  });
+}
+function fileSha256(path) {
+  const hash2 = createHash("sha256");
+  return pipeline(createReadStream(path), hash2).then(() => hash2.digest("hex"));
+}
+function run(command, args) {
+  return new Promise((resolve4, reject) => {
+    const child = spawn2(command, args, { stdio: "ignore" });
+    child.on("error", reject);
+    child.on(
+      "exit",
+      (code) => code === 0 ? resolve4() : reject(new CliError("not_installed", `${command} exited with ${code ?? "signal"}`))
+    );
+  });
+}
+
+// src/lib/component-versions.ts
+var RELEASE_PROTOCOLS = {
+  "0.0.1": { major: 5, minor: 1 },
+  "0.0.2": { major: 6, minor: 0 },
+  "0.0.3": { major: 6, minor: 2 },
+  "0.0.4": { major: 6, minor: 2 },
+  "0.0.5": { major: 7, minor: 0 },
+  "0.0.6": { major: 7, minor: 1 },
+  "0.0.7": { major: 7, minor: 1 },
+  "0.0.8": { major: 7, minor: 4 },
+  "0.0.9": { major: 8, minor: 0 },
+  "0.0.10": { major: 9, minor: 1 },
+  "0.0.11": { major: 9, minor: 2 },
+  "0.0.12": { major: 10, minor: 1 },
+  "0.0.13": { major: 10, minor: 1 },
+  "0.0.14": { major: 10, minor: 1 },
+  "0.0.15": { major: 10, minor: 1 },
+  "0.0.16": { major: 10, minor: 4 },
+  "0.0.17": { major: 10, minor: 7 },
+  "0.0.18": { major: 11, minor: 0 },
+  "0.0.19": { major: 11, minor: 1 },
+  "0.0.20": { major: 11, minor: 1 },
+  "0.0.21": { major: 11, minor: 1 },
+  "0.0.22": { major: 12, minor: 3 },
+  "0.0.23": { major: 12, minor: 3 },
+  "0.0.24": { major: 12, minor: 3 },
+  "0.0.25": { major: 13, minor: 0 },
+  "0.0.26": { major: 13, minor: 0 },
+  "0.0.27": { major: 13, minor: 0 },
+  "0.0.28": { major: 13, minor: 0 },
+  "0.0.29": { major: 13, minor: 1 },
+  "0.0.30": { major: 13, minor: 1 },
+  "0.0.31": { major: 13, minor: 1 },
+  "0.0.32": { major: 14, minor: 0 },
+  "0.0.33": { major: 14, minor: 2 },
+  "0.0.34": { major: 14, minor: 2 },
+  "0.0.35": { major: 15, minor: 1 },
+  "0.0.36": { major: 15, minor: 2 },
+  "0.0.37": { major: 15, minor: 2 },
+  "0.0.38": { major: 15, minor: 2 },
+  "0.0.39": { major: 15, minor: 3 },
+  "0.0.40": { major: 15, minor: 3 },
+  "0.0.41": { major: 15, minor: 3 },
+  "0.0.42": { major: 16, minor: 0 },
+  "0.0.43": { major: 16, minor: 0 },
+  "0.0.44": { major: 16, minor: 0 }
+};
+function validProtocol(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const protocol = value;
+  return typeof protocol["major"] === "number" && Number.isInteger(protocol["major"]) && protocol["major"] >= 0 && typeof protocol["minor"] === "number" && Number.isInteger(protocol["minor"]) && protocol["minor"] >= 0;
+}
+function releasedProtocol(version2) {
+  return RELEASE_PROTOCOLS[version2];
+}
+function componentProtocolForVersion(version2) {
+  return releasedProtocol(version2) ?? (version2 === cliVersion() ? PROTOCOL_VERSION : void 0);
+}
+function desktopRecordFile(home) {
+  return join4(home, "desktop-install.json");
+}
+function readDesktopInstallation(file2) {
+  try {
+    const value = JSON.parse(readFileSync2(file2, "utf8"));
+    if (typeof value !== "object" || value === null) return null;
+    const record2 = value;
+    if (typeof record2["path"] !== "string" || typeof record2["version"] !== "string") return null;
+    const protocol = validProtocol(record2["protocol"]) ? record2["protocol"] : void 0;
+    return {
+      path: record2["path"],
+      version: record2["version"],
+      ...protocol ? { protocol } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function recordDesktopInstallation(installation, file2 = desktopRecordFile(clientHome())) {
+  try {
+    mkdirSync(dirname3(file2), { recursive: true });
+    const temp = `${file2}.${process.pid}.tmp`;
+    writeFileSync(temp, `${JSON.stringify(installation, null, 2)}
+`);
+    renameSync(temp, file2);
+  } catch {
+  }
+}
+function daemonVersion(home) {
+  try {
+    const target = readlinkSync(join4(home, "bin", "current"));
+    return /(?:^|\/)versions\/([^/\s]+)$/.exec(target)?.[1];
+  } catch {
+    return void 0;
+  }
+}
+function daemonProtocol(home, version2) {
+  try {
+    const raw = readFileSync2(join4(home, "bin", "current", "PROTOCOL"), "utf8").trim();
+    const match = /^(\d+)\.(\d+)$/.exec(raw);
+    if (match) return { major: Number(match[1]), minor: Number(match[2]) };
+  } catch {
+  }
+  return releasedProtocol(version2);
+}
+async function installedComponentVersions(opts = {}) {
+  const home = opts.home ?? clientHome();
+  const cli = {
+    component: "cli",
+    installed: true,
+    version: cliVersion(),
+    protocol: PROTOCOL_VERSION
+  };
+  const installedDaemon = daemonVersion(home);
+  const installedDaemonProtocol = installedDaemon === void 0 ? void 0 : daemonProtocol(home, installedDaemon);
+  const daemon = installedDaemon === void 0 ? { component: "daemon", installed: false } : {
+    component: "daemon",
+    installed: true,
+    version: installedDaemon,
+    ...installedDaemonProtocol ? { protocol: installedDaemonProtocol } : {}
+  };
+  const recordedDesktop = readDesktopInstallation(desktopRecordFile(home));
+  let desktopInstallation = recordedDesktop !== null && existsSync(recordedDesktop.path) ? recordedDesktop : null;
+  if (desktopInstallation === null && (opts.platform ?? process.platform) === "darwin") {
+    const found = await (opts.findDesktop ?? findInstalledDesktopApp)();
+    if (found !== null) {
+      const protocol = componentProtocolForVersion(found.version);
+      desktopInstallation = {
+        path: found.appPath,
+        version: found.version,
+        ...protocol ? { protocol } : {}
+      };
+    }
+  }
+  const legacyLinuxPath = resolve(home, "..", "puddle", "Puddle.AppImage");
+  const legacyLinuxDesktop = desktopInstallation === null && (opts.platform ?? process.platform) === "linux" && existsSync(legacyLinuxPath);
+  const desktopProtocol = desktopInstallation?.protocol ?? (desktopInstallation ? componentProtocolForVersion(desktopInstallation.version) : void 0);
+  const desktop = desktopInstallation !== null ? {
+    component: "desktop",
+    installed: true,
+    version: desktopInstallation.version,
+    ...desktopProtocol ? { protocol: desktopProtocol } : {}
+  } : legacyLinuxDesktop ? { component: "desktop", installed: true } : { component: "desktop", installed: false };
+  return [cli, daemon, desktop];
+}
+function formatComponentVersions(components) {
+  return components.map((component) => {
+    const name = component.component.padEnd(7);
+    if (!component.installed) return `${name} not installed`;
+    const version2 = component.version ?? "unknown version";
+    const protocol = component.protocol ? `protocol ${component.protocol.major}.${component.protocol.minor}` : "protocol unknown";
+    return `${name} ${version2} (${protocol})`;
+  }).join("\n");
+}
+
+// src/lib/connect.ts
+import { join as join7 } from "node:path";
+
+// src/lib/attached-daemon.ts
+import { randomUUID } from "node:crypto";
+
+// src/lib/bootstrap.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+import { dirname as dirname4, join as join5, resolve as resolve2 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+init_types();
+async function installedVersion(transport) {
+  const result = await transport.exec(`readlink ${hostPaths.current}`, { timeoutMs: 15e3 });
+  if (result.code !== 0) return null;
+  const match = /versions\/([^/\s]+)\s*$/.exec(result.stdout.trim());
+  return match?.[1] ?? null;
+}
+async function installDaemon(transport, opts = {}) {
+  const logger = opts.logger ?? silentLogger;
+  const version2 = opts.version ?? pinnedDaemonVersion();
+  const script = readInstallScript();
+  const args = ["--version", version2];
+  if (opts.tarball !== void 0 && !/^https?:\/\//.test(opts.tarball)) {
+    if (!existsSync2(opts.tarball)) {
+      throw new CliError("not_installed", `tarball not found: ${opts.tarball}`);
+    }
+    if (transport.kind === "local") {
+      args.push("--tarball", resolve2(opts.tarball));
+      const localSums = `${opts.tarball}.sha256`;
+      if (existsSync2(localSums)) args.push("--sums", resolve2(localSums));
+    } else {
+      const base = opts.tarball.split("/").pop() ?? "puddled.tar.gz";
+      const destTarball = `.puddle/cache/${base}`;
+      logger.info(`delivering ${base} to ${transport.label}`);
+      await transport.copyTo(opts.tarball, destTarball);
+      const sums = `${opts.tarball}.sha256`;
+      if (existsSync2(sums)) {
+        await transport.copyTo(sums, `${destTarball}.sha256`);
+        args.push("--tarball", destTarball, "--sums", `${destTarball}.sha256`);
+      } else {
+        args.push("--tarball", destTarball);
+      }
+    }
+  } else {
+    const slug2 = repoSlug();
+    if (opts.tarball !== void 0) {
+      throw new CliError("bad_arguments", "--tarball must be a local file path");
+    }
+    if (slug2 === void 0) {
+      throw new CliError(
+        "not_installed",
+        "no release source is configured for this build",
+        "pass --tarball <path> (pnpm build:tarball produces one) or set PUDDLE_REPO=owner/repo"
+      );
+    }
+    args.push("--repo", slug2);
+  }
+  logger.info(`installing puddled ${version2} on ${transport.label}`);
+  const quoted = args.map((a) => `'${a.replaceAll("'", `'\\''`)}'`).join(" ");
+  const result = await transport.exec(`sh -s -- ${quoted}`, {
+    stdin: script,
+    timeoutMs: 10 * 6e4,
+    onStdout: (chunk) => {
+      for (const line of chunk.split("\n")) if (line.trim() !== "") logger.info(line.trimEnd());
+    }
+  });
+  if (result.code !== 0) {
+    throw new CliError(
+      "not_installed",
+      `the installer failed on ${transport.label} (exit ${result.code})`,
+      lastLines(result.stderr || result.stdout)
+    );
+  }
+}
+function lastLines(text, count = 3) {
+  return text.trim().split("\n").slice(-count).join("\n");
+}
+function readInstallScript() {
+  const here = dirname4(fileURLToPath2(import.meta.url));
+  const candidates = [
+    join5(here, "install.sh"),
+    // dist/index.js → dist/install.sh
+    join5(here, "..", "..", "..", "..", "scripts", "install.sh")
+    // src/lib/ → repo root
+  ];
+  for (const candidate of candidates) {
+    if (existsSync2(candidate)) return readFileSync3(candidate, "utf8");
+  }
+  throw new CliError("not_installed", "install.sh is missing from this build");
+}
+
+// src/lib/net.ts
+import { connect, createServer } from "node:net";
+function findFreePort() {
+  return new Promise((resolve4, reject) => {
+    const srv = createServer();
+    srv.once("error", reject);
+    srv.listen(0, "127.0.0.1", () => {
+      const address = srv.address();
+      const port = typeof address === "object" && address !== null ? address.port : 0;
+      srv.close(() => resolve4(port));
+    });
+  });
+}
+function tcpListening(port, timeoutMs = 500) {
+  return new Promise((resolve4) => {
+    const sock = connect({ host: "127.0.0.1", port });
+    const done = (ok) => {
+      sock.destroy();
+      resolve4(ok);
+    };
+    sock.setTimeout(timeoutMs, () => done(false));
+    sock.once("connect", () => done(true));
+    sock.once("error", () => done(false));
+  });
+}
+async function waitForTcp(port, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (await tcpListening(port)) return true;
+    await sleep(150);
+  }
+  return false;
+}
+async function waitForHttp(url2, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      await fetch(url2, { signal: AbortSignal.timeout(2e3) });
+      return true;
+    } catch {
+      await sleep(250);
+    }
+  }
+  return false;
+}
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+// src/lib/daemon-client.ts
+init_types();
+var LIVE = /* @__PURE__ */ new Set(["starting", "running", "waiting_input"]);
+var DaemonClient = class {
+  constructor(port, token) {
+    this.port = port;
+    this.token = token;
+  }
+  setPort(port) {
+    this.port = port;
+  }
+  async get(path) {
+    let res;
+    try {
+      res = await fetch(`http://127.0.0.1:${this.port}${path}`, {
+        headers: { authorization: `Bearer ${this.token}` },
+        signal: AbortSignal.timeout(1e4)
+      });
+    } catch {
+      throw new CliError("daemon_unreachable", "the Puddle daemon is not reachable");
+    }
+    if (res.status === 401) {
+      throw new CliError(
+        "token_rejected",
+        "the stored token was rejected by the daemon",
+        "inspect ~/.puddle/token on the host \u2014 it may have been regenerated"
+      );
+    }
+    if (!res.ok) {
+      throw new CliError("daemon_unreachable", `the daemon answered ${res.status} for ${path}`);
+    }
+    return res.json();
+  }
+  version() {
+    return this.get("/api/version").then((body) => versionResponseSchema.parse(body));
+  }
+  host() {
+    return this.get("/api/host").then((body) => hostInfoSchema.parse(body));
+  }
+  sessions() {
+    return this.get("/api/sessions").then((body) => sessionSchema.array().parse(body));
+  }
+  profiles() {
+    return this.get("/api/profiles").then((body) => profileSchema.array().parse(body));
+  }
+  /** The live subset of sessions() — what an upgrade/removal interrupts. */
+  async liveSessions() {
+    return (await this.sessions()).filter((s) => LIVE.has(s.status));
+  }
+  async liveSessionCount() {
+    return (await this.sessions()).filter((s) => LIVE.has(s.status)).length;
+  }
+  /** Whether anything daemon-shaped answers /api/version (401 counts as alive). */
+  async responds() {
+    try {
+      const res = await fetch(`http://127.0.0.1:${this.port}/api/version`, {
+        headers: { authorization: `Bearer ${this.token}` },
+        signal: AbortSignal.timeout(2e3)
+      });
+      return res.status < 500;
+    } catch {
+      return false;
+    }
+  }
+};
+async function readDaemonPort(transport) {
+  const runtime = await transport.readFile(hostPaths.runtime);
+  if (runtime !== null) {
+    try {
+      const parsed = JSON.parse(runtime);
+      if (typeof parsed.port === "number") return parsed.port;
+    } catch {
+    }
+  }
+  const raw = await transport.readFile(hostPaths.config);
+  if (raw !== null) {
+    try {
+      const parsed = JSON.parse(raw);
+      if (typeof parsed.port === "number") return parsed.port;
+    } catch {
+    }
+  }
+  return 7434;
+}
+async function readToken(transport) {
+  const raw = await transport.readFile(hostPaths.token);
+  const token = raw?.trim() ?? "";
+  return /^[0-9a-f]{32,}$/.test(token) ? token : null;
+}
+async function waitForToken(transport, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const token = await readToken(transport);
+    if (token !== null) return token;
+    await sleep(500);
+  }
+  throw new CliError(
+    "daemon_start_timeout",
+    `puddled did not come up on ${transport.label}`,
+    transport.kind === "ssh" ? `inspect it with: puddle logs ${transport.label}` : "inspect it with: puddle logs"
+  );
+}
+
+// src/lib/cockpit.ts
+init_types();
+async function ensureDaemon(transport, opts) {
   const logger = opts.logger ?? silentLogger;
+  const startTimeoutMs = opts.startTimeoutMs ?? (opts.attachedFallback === void 0 ? 2e4 : 5e3);
   let bootstrapped = false;
-  let token = await readToken(transport);
+  const token = await readToken(transport);
   if (token === null) {
     await installDaemon(transport, opts);
     bootstrapped = true;
-    token = await waitForToken(transport, 2e4);
-    const up = await waitForHostProbe(transport, token, 2e4);
-    if (up.result === "unauthorised") throw portConflict(transport, up.port);
-    if (up.result !== "ok") throw startTimeout(transport);
-    return { port: up.port, token, bootstrapped };
+    return waitAfterInstall(transport, opts, logger, bootstrapped, startTimeoutMs);
   }
-  let port = await readDaemonPort(transport);
+  const port = await readDaemonPort(transport);
   const probe = await hostProbe(transport, port, token);
   if (probe === "unauthorised") throw portConflict(transport, port);
   if (probe === "down") {
@@ -20099,13 +20565,39 @@ async function ensureDaemon(transport, opts) {
     }
     await installDaemon(transport, opts);
     bootstrapped = true;
-    token = await readToken(transport) ?? token;
-    const after = await waitForHostProbe(transport, token, 2e4);
-    if (after.result === "unauthorised") throw portConflict(transport, after.port);
-    if (after.result !== "ok") throw startTimeout(transport);
-    port = after.port;
+    return waitAfterInstall(transport, opts, logger, bootstrapped, startTimeoutMs);
+  }
+  return { port, token, bootstrapped, daemonLifetime: "persistent" };
+}
+async function waitAfterInstall(transport, opts, logger, bootstrapped, timeoutMs) {
+  try {
+    const started = await waitForStartedDaemon(transport, timeoutMs);
+    return { ...started, bootstrapped, daemonLifetime: "persistent" };
+  } catch (err) {
+    if (!(err instanceof CliError) || err.code !== "daemon_start_timeout" || opts.attachedFallback === void 0 || !await detachedNohupWasReaped(transport)) {
+      throw err;
+    }
+    logger.warn(
+      `puddled could not stay detached on ${transport.label} \u2014 keeping it attached to this cockpit; session state stays on disk and can resume on the next launch`
+    );
+    return opts.attachedFallback();
   }
-  return { port, token, bootstrapped };
+}
+async function detachedNohupWasReaped(transport) {
+  if (transport.kind !== "ssh") return false;
+  const supervisor = (await transport.readFile(hostPaths.supervisor))?.trim();
+  if (supervisor !== "nohup") return false;
+  const rawPid = (await transport.readFile(hostPaths.pid))?.trim() ?? "";
+  if (!/^[1-9][0-9]*$/.test(rawPid)) return true;
+  const probe = await transport.exec(`kill -0 ${rawPid}`, { timeoutMs: 5e3 });
+  return probe.code !== 0;
+}
+async function waitForStartedDaemon(transport, timeoutMs) {
+  const token = await waitForToken(transport, timeoutMs);
+  const up = await waitForHostProbe(transport, token, timeoutMs);
+  if (up.result === "unauthorised") throw portConflict(transport, up.port);
+  if (up.result !== "ok") throw startTimeout(transport);
+  return { port: up.port, token };
 }
 function startTimeout(transport) {
   return new CliError(
@@ -20141,9 +20633,10 @@ async function waitForHostProbe(transport, token, timeoutMs) {
   }
   return { result: last, port };
 }
-function makeUpgrader(transport, client, opts) {
+function makeUpgrader(transport, client, opts, lease) {
   return async () => {
     await installDaemon(transport, opts);
+    await lease?.ensureRunning();
     const deadline = Date.now() + 3e4;
     while (Date.now() < deadline) {
       if (await client.responds()) return;
@@ -20156,6 +20649,150 @@ function makeUpgrader(transport, client, opts) {
   };
 }
 
+// src/lib/attached-daemon.ts
+init_types();
+var AttachedDaemon = class {
+  constructor(ssh, logger = silentLogger) {
+    this.ssh = ssh;
+    this.logger = logger;
+  }
+  command = null;
+  commandExited = true;
+  pid = null;
+  port;
+  leasePidPath = null;
+  async start() {
+    const started = await this.launchAndWait();
+    return {
+      ...started,
+      bootstrapped: true,
+      daemonLifetime: "cockpit",
+      lease: this
+    };
+  }
+  async ensureRunning() {
+    if (!this.commandExited) return;
+    this.logger.info(`restarting SSH-attached puddled on ${this.ssh.label}`);
+    if (this.leasePidPath !== null) {
+      await this.ssh.exec(`rm -f ${this.leasePidPath}`, { timeoutMs: 5e3 });
+    }
+    this.pid = null;
+    this.leasePidPath = null;
+    await this.launchAndWait(this.port);
+  }
+  async stop() {
+    const command = this.command;
+    if (command === null) return;
+    const pid = this.pid;
+    const leasePidPath = this.leasePidPath;
+    if (pid !== null) {
+      await this.ssh.exec(`kill ${pid}`, { timeoutMs: 5e3 });
+    }
+    const exited = await Promise.race([
+      command.result.then(() => true),
+      sleep(5e3).then(() => false)
+    ]);
+    if (!exited) command.terminate();
+    if (pid !== null) {
+      await this.ssh.exec(
+        `if [ -f ${hostPaths.pid} ] && [ "$(cat ${hostPaths.pid})" = "${pid}" ]; then rm -f ${hostPaths.pid}; fi`,
+        { timeoutMs: 5e3 }
+      );
+    }
+    if (leasePidPath !== null) {
+      await this.ssh.exec(`rm -f ${leasePidPath}`, { timeoutMs: 5e3 });
+    }
+    this.command = null;
+    this.commandExited = true;
+    this.pid = null;
+    this.leasePidPath = null;
+  }
+  async launchAndWait(preferredPort) {
+    const portFlag = preferredPort === void 0 ? "" : ` --port ${preferredPort}`;
+    const leasePidPath = `${hostPaths.home}/attached-${randomUUID()}.pid`;
+    this.leasePidPath = leasePidPath;
+    const command = this.ssh.runAttached(
+      `printf '%s\\n' "$$" > ${leasePidPath}; exec ${hostPaths.current}/puddled${portFlag} >> ${hostPaths.logs}/puddled.out.log 2>&1`
+    );
+    this.command = command;
+    this.commandExited = false;
+    void command.result.then(() => {
+      if (this.command === command) {
+        this.commandExited = true;
+        this.pid = null;
+      }
+    });
+    let outcome;
+    try {
+      outcome = await Promise.race([
+        waitForStartedDaemon(this.ssh, 2e4).then((started) => ({
+          kind: "started",
+          started
+        })),
+        command.result.then((result) => ({ kind: "exited", result }))
+      ]);
+    } catch (err) {
+      command.terminate();
+      await this.clearFailedLaunch(leasePidPath);
+      throw err;
+    }
+    if (outcome.kind === "exited") {
+      await this.clearFailedLaunch(leasePidPath);
+      throw await this.startFailure(outcome.result.stderr || outcome.result.stdout);
+    }
+    this.port = outcome.started.port;
+    const [claimedPid, runtimePid] = await Promise.all([
+      this.readPidFile(leasePidPath),
+      this.readPidFile(hostPaths.runtime, true)
+    ]);
+    if (claimedPid === null || runtimePid !== claimedPid) {
+      command.terminate();
+      await this.clearFailedLaunch(leasePidPath);
+      throw new CliError(
+        "daemon_start_timeout",
+        `another puddled process won the startup race on ${this.ssh.label}`,
+        "close the other cockpit or wait for its daemon to stop, then launch again"
+      );
+    }
+    this.pid = claimedPid;
+    await this.ssh.exec(`printf '%s\\n' '${this.pid}' > ${hostPaths.pid}`, { timeoutMs: 5e3 });
+    return outcome.started;
+  }
+  async readPidFile(path, json2 = false) {
+    const raw = await this.ssh.readFile(path);
+    if (raw === null) return null;
+    try {
+      const value = json2 ? JSON.parse(raw).pid : Number(raw.trim());
+      return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : null;
+    } catch {
+      return null;
+    }
+  }
+  async clearFailedLaunch(leasePidPath) {
+    try {
+      await this.ssh.exec(`rm -f ${leasePidPath}`, { timeoutMs: 5e3 });
+    } catch {
+    }
+    this.command = null;
+    this.commandExited = true;
+    this.pid = null;
+    if (this.leasePidPath === leasePidPath) this.leasePidPath = null;
+  }
+  async startFailure(channelOutput) {
+    this.command = null;
+    this.commandExited = true;
+    const log = await this.ssh.exec(`tail -n 20 ${hostPaths.logs}/puddled.out.log`, {
+      timeoutMs: 5e3
+    });
+    const detail = (log.stdout || log.stderr || channelOutput).trim().split("\n").slice(-8).join("\n");
+    return new CliError(
+      "daemon_start_timeout",
+      `puddled exited while starting on ${this.ssh.label}`,
+      detail || `inspect it with: puddle logs ${this.ssh.label}`
+    );
+  }
+};
+
 // src/lib/handshake.ts
 init_types();
 var CLI_UPGRADE_COMMAND = "npm install -g @puddle-code/cli";
@@ -20201,7 +20838,7 @@ async function runHandshake(opts) {
 
 // src/lib/serve/ui-server.ts
 init_types();
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 import { createServer as createServer2 } from "node:http";
 
 // src/lib/serve/guard.ts
@@ -20223,12 +20860,12 @@ function isLocalOrigin(origin) {
 }
 
 // src/lib/serve/local-sync.ts
-import { mkdirSync, readFileSync as readFileSync3, renameSync, writeFileSync } from "node:fs";
-import { dirname as dirname3 } from "node:path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync4, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname5 } from "node:path";
 var MAX_BODY_BYTES = 5 * 1024 * 1024;
 function readStore(file2) {
   try {
-    const raw = JSON.parse(readFileSync3(file2, "utf8"));
+    const raw = JSON.parse(readFileSync4(file2, "utf8"));
     if (raw && typeof raw === "object" && raw.profiles && typeof raw.profiles === "object") {
       return { version: 1, profiles: raw.profiles };
     }
@@ -20237,13 +20874,13 @@ function readStore(file2) {
   return { version: 1, profiles: {} };
 }
 function writeStore(file2, store) {
-  mkdirSync(dirname3(file2), { recursive: true });
+  mkdirSync2(dirname5(file2), { recursive: true });
   const tmp = `${file2}.tmp-${process.pid}`;
-  writeFileSync(tmp, JSON.stringify(store, null, 2) + "\n");
-  renameSync(tmp, file2);
+  writeFileSync2(tmp, JSON.stringify(store, null, 2) + "\n");
+  renameSync2(tmp, file2);
 }
 function readBody(req) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     let size = 0;
     const chunks = [];
     req.on("data", (chunk) => {
@@ -20255,7 +20892,7 @@ function readBody(req) {
       }
       chunks.push(chunk);
     });
-    req.on("end", () => resolve3(Buffer.concat(chunks).toString("utf8")));
+    req.on("end", () => resolve4(Buffer.concat(chunks).toString("utf8")));
     req.on("error", reject);
   });
 }
@@ -20312,8 +20949,8 @@ function recoverProxiedPath(referer, requestUrl) {
 }
 
 // src/lib/serve/static.ts
-import { createReadStream, existsSync as existsSync2, statSync } from "node:fs";
-import { extname, join as join4, normalize, resolve as resolve2, sep } from "node:path";
+import { createReadStream as createReadStream2, existsSync as existsSync3, statSync } from "node:fs";
+import { extname, join as join6, normalize, resolve as resolve3, sep } from "node:path";
 var MIME = {
   ".html": "text/html; charset=utf-8",
   ".js": "text/javascript; charset=utf-8",
@@ -20327,7 +20964,7 @@ var MIME = {
   ".map": "application/json"
 };
 function createStaticHandler(rootDir) {
-  const root = resolve2(rootDir);
+  const root = resolve3(rootDir);
   return (req, res) => {
     if (req.method !== "GET" && req.method !== "HEAD") {
       res.writeHead(405, { allow: "GET, HEAD" }).end();
@@ -20341,15 +20978,15 @@ function createStaticHandler(rootDir) {
       res.writeHead(404, { "content-type": "text/plain" }).end("not found");
       return;
     }
-    const requested = normalize(join4(root, decoded));
+    const requested = normalize(join6(root, decoded));
     const candidate = requested.startsWith(root + sep) || requested === root ? requested : root;
-    const isFile = existsSync2(candidate) && statSync(candidate).isFile();
+    const isFile = existsSync3(candidate) && statSync(candidate).isFile();
     if (!isFile && extname(pathname) !== "") {
       res.writeHead(404, { "content-type": "text/plain" }).end("not found");
       return;
     }
-    const file2 = isFile ? candidate : join4(root, "index.html");
-    if (!existsSync2(file2)) {
+    const file2 = isFile ? candidate : join6(root, "index.html");
+    if (!existsSync3(file2)) {
       res.writeHead(404, { "content-type": "text/plain" }).end("not found");
       return;
     }
@@ -20361,7 +20998,7 @@ function createStaticHandler(rootDir) {
       res.end();
       return;
     }
-    createReadStream(file2).pipe(res);
+    createReadStream2(file2).pipe(res);
   };
 }
 
@@ -20510,7 +21147,7 @@ async function startUiServer(opts) {
   const target = { ...opts.target };
   const tracker = new ProxySocketTracker();
   const serveStatic = createStaticHandler(opts.assetsDir);
-  const nonce = randomUUID();
+  const nonce = randomUUID2();
   const server = createServer2((req, res) => {
     res.setHeader("x-puddle-cockpit", nonce);
     const url2 = req.url ?? "/";
@@ -20566,8 +21203,8 @@ async function startUiServer(opts) {
     },
     close() {
       tracker.destroyAll();
-      return new Promise((resolve3) => {
-        server.close(() => resolve3());
+      return new Promise((resolve4) => {
+        server.close(() => resolve4());
         server.closeAllConnections();
       });
     }
@@ -20596,15 +21233,15 @@ async function listen(server, startPort, strict, avoidPort) {
   for (let probe = 0; probe < MAX_PORT_PROBES; probe += 1) {
     const port = startPort + probe;
     if (!strict && port === avoidPort) continue;
-    const ok = await new Promise((resolve3, rejectListen) => {
+    const ok = await new Promise((resolve4, rejectListen) => {
       const onError = (err) => {
         server.off("listening", onListening);
-        if (err.code === "EADDRINUSE") resolve3(false);
+        if (err.code === "EADDRINUSE") resolve4(false);
         else rejectListen(err);
       };
       const onListening = () => {
         server.off("error", onError);
-        resolve3(true);
+        resolve4(true);
       };
       server.once("error", onError);
       server.once("listening", onListening);
@@ -20626,7 +21263,7 @@ async function listen(server, startPort, strict, avoidPort) {
 }
 
 // src/lib/tunnel.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 init_types();
 var RECONNECT_INITIAL_MS = 500;
 var RECONNECT_MAX_MS = 1e4;
@@ -20642,10 +21279,10 @@ async function openCallbackForward(ssh, port, opts = {}) {
     return null;
   };
   if (await tcpListening(port)) return skip("local port busy");
-  const child = spawn2(
+  const child = spawn3(
     opts.sshBinary ?? "ssh",
     ssh.args("-N", "-L", `${port}:127.0.0.1:${port}`, ssh.host),
-    { stdio: ["ignore", "ignore", "inherit"] }
+    { stdio: ["ignore", "ignore", "inherit"], env: ssh.spawnEnv() }
   );
   if (!await waitForTcp(port, 5e3)) {
     child.kill("SIGTERM");
@@ -20674,10 +21311,10 @@ async function openTunnel(ssh, remotePort, opts = {}) {
   let healthTimer = null;
   const spawnForward = async (port) => {
     if (stopping) return false;
-    const child = spawn2(
+    const child = spawn3(
       sshBinary,
       ssh.args("-N", "-L", `${port}:127.0.0.1:${remotePort}`, ssh.host),
-      { stdio: ["ignore", "ignore", "inherit"] }
+      { stdio: ["ignore", "ignore", "inherit"], env: ssh.spawnEnv() }
     );
     state.child = child;
     const ready = await waitForTcp(port, 5e3) && await isReady(port);
@@ -20797,15 +21434,15 @@ async function openTunnel(ssh, remotePort, opts = {}) {
 }
 
 // src/lib/transport/local.ts
-import { spawn as spawn3 } from "node:child_process";
-import { copyFileSync, mkdirSync as mkdirSync2, readFileSync as readFileSync4 } from "node:fs";
-import { dirname as dirname4 } from "node:path";
+import { spawn as spawn4 } from "node:child_process";
+import { copyFileSync, mkdirSync as mkdirSync3, readFileSync as readFileSync5 } from "node:fs";
+import { dirname as dirname6 } from "node:path";
 var LocalTransport = class {
   kind = "local";
   label = "this machine";
   exec(command, opts = {}) {
-    return new Promise((resolve3) => {
-      const child = spawn3("sh", ["-c", command], { stdio: ["pipe", "pipe", "pipe"] });
+    return new Promise((resolve4) => {
+      const child = spawn4("sh", ["-c", command], { stdio: ["pipe", "pipe", "pipe"] });
       let stdout = "";
       let stderr = "";
       let timer;
@@ -20821,11 +21458,11 @@ var LocalTransport = class {
       child.stderr.on("data", (chunk) => stderr += chunk.toString());
       child.on("error", (err) => {
         if (timer) clearTimeout(timer);
-        resolve3({ code: -1, stdout, stderr: stderr + String(err) });
+        resolve4({ code: -1, stdout, stderr: stderr + String(err) });
       });
       child.on("close", (code) => {
         if (timer) clearTimeout(timer);
-        resolve3({ code: code ?? -1, stdout, stderr });
+        resolve4({ code: code ?? -1, stdout, stderr });
       });
       if (opts.stdin !== void 0) child.stdin.end(opts.stdin);
       else child.stdin.end();
@@ -20833,14 +21470,14 @@ var LocalTransport = class {
   }
   readFile(path) {
     try {
-      return Promise.resolve(readFileSync4(expandHome(path), "utf8"));
+      return Promise.resolve(readFileSync5(expandHome(path), "utf8"));
     } catch {
       return Promise.resolve(null);
     }
   }
   copyTo(localPath, destPath) {
     const dest = expandHome(destPath);
-    mkdirSync2(dirname4(dest), { recursive: true });
+    mkdirSync3(dirname6(dest), { recursive: true });
     copyFileSync(localPath, dest);
     return Promise.resolve();
   }
@@ -20852,8 +21489,8 @@ function expandHome(path) {
 }
 
 // src/lib/transport/ssh.ts
-import { spawn as spawn4 } from "node:child_process";
-import { mkdirSync as mkdirSync3 } from "node:fs";
+import { spawn as spawn5 } from "node:child_process";
+import { mkdirSync as mkdirSync4 } from "node:fs";
 init_types();
 var SshTransport = class {
   constructor(host, opts = {}) {
@@ -20861,12 +21498,13 @@ var SshTransport = class {
     this.label = host;
     this.ssh = opts.sshBinary ?? "ssh";
     this.scp = opts.scpBinary ?? "scp";
+    this.askpassProgram = opts.askpassProgram;
     const platform = opts.platform ?? process.platform;
     if (platform === "win32") {
       this.controlArgs = [];
     } else {
       const home = clientHome();
-      mkdirSync3(home, { recursive: true });
+      mkdirSync4(home, { recursive: true });
       this.controlArgs = [
         "-o",
         "ControlMaster=auto",
@@ -20886,6 +21524,7 @@ var SshTransport = class {
   scp;
   controlArgs;
   keepaliveArgs;
+  askpassProgram;
   get hasControlMaster() {
     return this.controlArgs.length > 0;
   }
@@ -20894,18 +21533,39 @@ var SshTransport = class {
     return [...this.controlArgs, ...this.keepaliveArgs, ...rest];
   }
   /**
-   * Open the master interactively — ssh's own prompts go straight to the
-   * user's TTY. Exit 0 leaves a live control socket behind.
+   * Environment for every ssh/scp child. `force` is scoped to graphical
+   * embedders that supplied a helper; normal CLI launches still talk to the
+   * inherited TTY exactly as before. OpenSSH also requires DISPLAY to be set
+   * before it considers askpass, even when the helper is not an X11 program.
+   */
+  spawnEnv() {
+    if (this.askpassProgram === void 0) return void 0;
+    return {
+      ...process.env,
+      SSH_ASKPASS: this.askpassProgram,
+      SSH_ASKPASS_REQUIRE: "force",
+      DISPLAY: process.env.DISPLAY ?? "puddle"
+    };
+  }
+  /**
+   * Open the master through the caller's authentication surface: the CLI's
+   * inherited TTY or a graphical embedder's askpass helper. Exit 0 leaves a
+   * live control socket behind.
    */
   open() {
-    return new Promise((resolve3, reject) => {
-      const child = spawn4(this.ssh, this.args(this.host, "true"), { stdio: "inherit" });
+    return new Promise((resolve4, reject) => {
+      const child = spawn5(this.ssh, this.args(this.host, "true"), {
+        // A GUI has no useful inherited terminal; OpenSSH calls its askpass
+        // helper instead. The terminal CLI keeps byte-for-byte inheritance.
+        stdio: this.askpassProgram === void 0 ? "inherit" : "ignore",
+        env: this.spawnEnv()
+      });
       child.on(
         "error",
         (err) => reject(new CliError("ssh_unreachable", `could not run ${this.ssh}: ${err.message}`))
       );
       child.on("close", (code) => {
-        if (code === 0) resolve3();
+        if (code === 0) resolve4();
         else {
           reject(
             new CliError(
@@ -20921,10 +21581,13 @@ var SshTransport = class {
   /** Whether the master connection is still alive (-O check). */
   isAlive() {
     if (!this.hasControlMaster) return Promise.resolve(true);
-    return new Promise((resolve3) => {
-      const child = spawn4(this.ssh, this.args("-O", "check", this.host), { stdio: "ignore" });
-      child.on("error", () => resolve3(false));
-      child.on("close", (code) => resolve3(code === 0));
+    return new Promise((resolve4) => {
+      const child = spawn5(this.ssh, this.args("-O", "check", this.host), {
+        stdio: "ignore",
+        env: this.spawnEnv()
+      });
+      child.on("error", () => resolve4(false));
+      child.on("close", (code) => resolve4(code === 0));
     });
   }
   /**
@@ -20937,19 +21600,21 @@ var SshTransport = class {
    */
   cancelForward(localPort, remotePort) {
     if (!this.hasControlMaster) return Promise.resolve();
-    return new Promise((resolve3) => {
+    return new Promise((resolve4) => {
       const spec = `${localPort}:127.0.0.1:${remotePort}`;
-      const child = spawn4(this.ssh, this.args("-O", "cancel", "-L", spec, this.host), {
-        stdio: "ignore"
+      const child = spawn5(this.ssh, this.args("-O", "cancel", "-L", spec, this.host), {
+        stdio: "ignore",
+        env: this.spawnEnv()
       });
-      child.on("error", () => resolve3());
-      child.on("close", () => resolve3());
+      child.on("error", () => resolve4());
+      child.on("close", () => resolve4());
     });
   }
   exec(command, opts = {}) {
-    return new Promise((resolve3) => {
-      const child = spawn4(this.ssh, this.args(this.host, "--", `sh -c ${shellQuote(command)}`), {
-        stdio: ["pipe", "pipe", "pipe"]
+    return new Promise((resolve4) => {
+      const child = spawn5(this.ssh, this.args(this.host, "--", `sh -c ${shellQuote(command)}`), {
+        stdio: ["pipe", "pipe", "pipe"],
+        env: this.spawnEnv()
       });
       let stdout = "";
       let stderr = "";
@@ -20966,573 +21631,358 @@ var SshTransport = class {
       child.stderr.on("data", (chunk) => stderr += chunk.toString());
       child.on("error", (err) => {
         if (timer) clearTimeout(timer);
-        resolve3({ code: -1, stdout, stderr: stderr + String(err) });
+        resolve4({ code: -1, stdout, stderr: stderr + String(err) });
       });
       child.on("close", (code) => {
         if (timer) clearTimeout(timer);
-        resolve3({ code: code ?? -1, stdout, stderr });
+        resolve4({ code: code ?? -1, stdout, stderr });
       });
       if (opts.stdin !== void 0) child.stdin.end(opts.stdin);
       else child.stdin.end();
     });
   }
-  async readFile(path) {
-    const result = await this.exec(`cat ${path}`, { timeoutMs: 15e3 });
-    return result.code === 0 ? result.stdout : null;
-  }
-  async copyTo(localPath, destPath) {
-    await this.exec(`mkdir -p $(dirname ${destPath})`, { timeoutMs: 15e3 });
-    await new Promise((resolve3, reject) => {
-      const child = spawn4(this.scp, [...this.controlArgs, localPath, `${this.host}:${destPath}`], {
-        stdio: ["ignore", "ignore", "inherit"]
-      });
-      child.on("error", reject);
-      child.on("close", (code) => {
-        if (code === 0) resolve3();
-        else reject(new CliError("ssh_unreachable", `scp to ${this.host} failed (exit ${code})`));
-      });
-    });
-  }
-  dispose() {
-  }
-};
-function shellQuote(text) {
-  return `'${text.replaceAll("'", `'\\''`)}'`;
-}
-
-// src/lib/connect.ts
-init_types();
-var CODEX_OAUTH_PORT = 1455;
-async function connectRemote(opts) {
-  const logger = opts.logger ?? silentLogger;
-  const platform = opts.platform ?? process.platform;
-  const ssh = new SshTransport(opts.host, {
-    sshBinary: opts.sshBinary,
-    scpBinary: opts.scpBinary,
-    platform
-  });
-  if (platform === "win32") {
-    logger.warn(
-      "Windows OpenSSH cannot share a connection; you may be asked to authenticate more than once. An SSH key (ssh-copy-id) avoids the prompts."
-    );
-  }
-  await ssh.open();
-  const bootstrap = { tarball: opts.tarball, logger };
-  const endpoint = await ensureDaemon(ssh, bootstrap);
-  const remotePort = opts.remotePort ?? endpoint.port;
-  const tunnel = await openTunnel(ssh, remotePort, {
-    sshBinary: opts.sshBinary,
-    logger,
-    ready: (localPort) => waitForHttp(`http://127.0.0.1:${localPort}/api/version`, 8e3)
-  });
-  const client = new DaemonClient(tunnel.localPort, endpoint.token);
-  tunnel.onPortChange((port) => client.setPort(port));
-  const oauthForward = await openCallbackForward(ssh, CODEX_OAUTH_PORT, {
-    sshBinary: opts.sshBinary,
-    logger
-  });
-  const daemon = await runHandshake({
-    client,
-    noUpgrade: opts.noUpgrade,
-    upgradeDaemon: makeUpgrader(ssh, client, bootstrap),
-    logger
-  });
-  const avoidPort = await readDaemonPort(new LocalTransport());
-  const ui = await startUiServer({
-    assetsDir: opts.assetsDir,
-    port: opts.port ?? opts.preferPort,
-    strictPort: opts.port !== void 0,
-    // a preferred port stays non-strict
-    avoidPort,
-    target: { host: "127.0.0.1", port: tunnel.localPort },
-    ...opts.onRefreshRequest !== void 0 ? { control: { token: endpoint.token, onRefresh: opts.onRefreshRequest } } : {},
-    // The store lives on the CLIENT machine — every cockpit here shares it,
-    // whichever remote daemon each one drives.
-    localSync: { token: endpoint.token, file: join5(clientHome(), "local-sync.json") }
-  });
-  tunnel.onPortChange((port) => ui.setTarget({ host: "127.0.0.1", port }));
-  const eventCbs = /* @__PURE__ */ new Set();
-  tunnel.onEvent((e) => {
-    if (e.t === "tunnel-down") logger.warn(`tunnel to ${opts.host} lost \u2014 reconnecting\u2026`);
-    if (e.t === "tunnel-up") logger.info("tunnel restored");
-    eventCbs.forEach((cb) => cb(e));
-  });
-  return {
-    origin: ui.origin,
-    browserUrl: `${ui.origin}/?host=${encodeURIComponent(opts.host)}#token=${endpoint.token}`,
-    nonce: ui.nonce,
-    daemon,
-    onEvent(cb) {
-      eventCbs.add(cb);
-      return () => eventCbs.delete(cb);
-    },
-    async stop() {
-      await ui.close();
-      await oauthForward?.();
-      await tunnel.close();
-      ssh.dispose();
-    }
-  };
-}
-
-// src/lib/logs.ts
-init_types();
-async function showLogs(transport, opts) {
-  if (opts.session !== void 0) {
-    const file2 = `${hostPaths.logs}/${opts.session}/${opts.term ?? "agent"}.log`;
-    const command2 = opts.follow ? `tail -f -c 262144 ${file2}` : `tail -c 262144 ${file2}`;
-    const result = await transport.exec(command2, {
-      onStdout: opts.write,
-      ...opts.follow ? {} : { timeoutMs: 3e4 }
+  /**
+   * Run a command through a live SSH channel instead of waiting for a detached
+   * supervisor to adopt it. Used by the daemon lease on hosts that reap nohup
+   * children when an SSH exec channel closes.
+   */
+  runAttached(command) {
+    const child = spawn5(this.ssh, this.args(this.host, "--", `sh -c ${shellQuote(command)}`), {
+      stdio: ["ignore", "pipe", "pipe"],
+      env: this.spawnEnv()
     });
-    if (result.code !== 0 && !opts.follow) {
-      throw new CliError(
-        "unknown_session",
-        `no log at ${file2}`,
-        "list sessions with: puddle status \u2014 the id is the log directory name"
-      );
-    }
-    return;
-  }
-  const command = `if command -v journalctl >/dev/null 2>&1 && journalctl --user -u puddled -n 1 >/dev/null 2>&1; then journalctl --user -u puddled -n 200 --no-pager${opts.follow ? " -f" : ""}; elif [ -f ${hostPaths.logs}/puddled.out.log ]; then tail ${opts.follow ? "-f " : ""}-n 200 ${hostPaths.logs}/puddled.out.log ${hostPaths.logs}/puddled.err.log 2>/dev/null; else echo 'no daemon logs found \u2014 the daemon logs to its supervisor (journalctl --user -u puddled / ~/.puddle/logs)'; fi`;
-  await transport.exec(command, { onStdout: opts.write });
-}
-
-// src/lib/registry.ts
-import { mkdirSync as mkdirSync4, readdirSync, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join6 } from "node:path";
-function cockpitsDir(env) {
-  return join6(clientHome(env), "cockpits");
-}
-function slug(target) {
-  return target.replace(/[^A-Za-z0-9@._-]/g, "_");
-}
-function cockpitRecordPath(target) {
-  return join6(cockpitsDir(), `${slug(target)}.json`);
-}
-function cockpitLogPath(target) {
-  return join6(clientHome(), "logs", `cockpit-${slug(target)}.log`);
-}
-function writeCockpitRecord(record2) {
-  mkdirSync4(cockpitsDir(), { recursive: true, mode: 448 });
-  writeFileSync2(cockpitRecordPath(record2.target), JSON.stringify(record2, null, 2) + "\n", {
-    mode: 384
-  });
-}
-function readCockpitRecord(target) {
-  try {
-    return JSON.parse(readFileSync5(cockpitRecordPath(target), "utf8"));
-  } catch {
-    return null;
-  }
-}
-function removeCockpitRecord(target) {
-  rmSync(cockpitRecordPath(target), { force: true });
-}
-function listCockpitRecords() {
-  let names;
-  try {
-    names = readdirSync(cockpitsDir());
-  } catch {
-    return [];
-  }
-  const records = [];
-  for (const name of names) {
-    if (!name.endsWith(".json")) continue;
-    try {
-      records.push(JSON.parse(readFileSync5(join6(cockpitsDir(), name), "utf8")));
-    } catch {
-    }
-  }
-  return records.sort((a, b) => a.target.localeCompare(b.target));
-}
-function isPidAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
+    let stdout = "";
+    let stderr = "";
+    const result = new Promise((resolve4) => {
+      child.stdout.on("data", (chunk) => stdout += chunk.toString());
+      child.stderr.on("data", (chunk) => stderr += chunk.toString());
+      child.on("error", (err) => resolve4({ code: -1, stdout, stderr: stderr + String(err) }));
+      child.on("close", (code) => resolve4({ code: code ?? -1, stdout, stderr }));
+    });
+    return {
+      result,
+      terminate() {
+        child.kill("SIGTERM");
+      }
+    };
   }
-}
-async function checkCockpit(record2) {
-  if (!isPidAlive(record2.pid)) return "dead";
-  if (record2.status === "starting") return "starting";
-  if (record2.status !== "ready" || record2.origin === void 0 || record2.nonce === void 0) {
-    return "unverified";
+  async readFile(path) {
+    const result = await this.exec(`cat ${path}`, { timeoutMs: 15e3 });
+    return result.code === 0 ? result.stdout : null;
   }
-  try {
-    const res = await fetch(`${record2.origin}/`, {
-      method: "HEAD",
-      signal: AbortSignal.timeout(1500)
+  async copyTo(localPath, destPath) {
+    await this.exec(`mkdir -p $(dirname ${destPath})`, { timeoutMs: 15e3 });
+    await new Promise((resolve4, reject) => {
+      const child = spawn5(this.scp, [...this.controlArgs, localPath, `${this.host}:${destPath}`], {
+        stdio: ["ignore", "ignore", "inherit"],
+        env: this.spawnEnv()
+      });
+      child.on("error", reject);
+      child.on("close", (code) => {
+        if (code === 0) resolve4();
+        else reject(new CliError("ssh_unreachable", `scp to ${this.host} failed (exit ${code})`));
+      });
     });
-    return res.headers.get("x-puddle-cockpit") === record2.nonce ? "running" : "unverified";
-  } catch {
-    return "unverified";
   }
-}
-
-// src/lib/start.ts
-import { join as join7 } from "node:path";
-init_types();
-async function startLocal(opts) {
-  const logger = opts.logger ?? silentLogger;
-  const transport = new LocalTransport();
-  const bootstrap = { tarball: opts.tarball, logger };
-  const endpoint = await ensureDaemon(transport, bootstrap);
-  const client = new DaemonClient(endpoint.port, endpoint.token);
-  const daemon = await runHandshake({
-    client,
-    noUpgrade: opts.noUpgrade,
-    upgradeDaemon: makeUpgrader(transport, client, bootstrap),
-    logger
-  });
-  const ui = await startUiServer({
-    assetsDir: opts.assetsDir,
-    port: opts.port ?? opts.preferPort,
-    strictPort: opts.port !== void 0,
-    // a preferred port stays non-strict
-    avoidPort: endpoint.port,
-    // never squat the daemon's own port
-    target: { host: "127.0.0.1", port: endpoint.port },
-    ...opts.onRefreshRequest !== void 0 ? { control: { token: endpoint.token, onRefresh: opts.onRefreshRequest } } : {},
-    localSync: { token: endpoint.token, file: join7(clientHome(), "local-sync.json") }
-  });
-  const eventCbs = /* @__PURE__ */ new Set();
-  return {
-    origin: ui.origin,
-    browserUrl: `${ui.origin}/#token=${endpoint.token}`,
-    nonce: ui.nonce,
-    daemon,
-    onEvent(cb) {
-      eventCbs.add(cb);
-      return () => eventCbs.delete(cb);
-    },
-    async stop() {
-      await ui.close();
-      transport.dispose();
-    }
-  };
-}
-
-// src/lib/status.ts
-var LIVE_FIRST = {
-  running: 0,
-  waiting_input: 1,
-  starting: 2,
-  interrupted: 3,
-  exited: 4,
-  archived: 5
+  dispose() {
+  }
 };
-async function statusReport(client) {
-  const [daemon, host, sessions] = await Promise.all([
-    client.version(),
-    client.host(),
-    client.sessions()
-  ]);
-  sessions.sort(
-    (a, b) => (LIVE_FIRST[a.status] ?? 9) - (LIVE_FIRST[b.status] ?? 9) || (b.last_activity_at ?? "").localeCompare(a.last_activity_at ?? "")
-  );
-  return { daemon, host, sessions: sessions.filter((s) => s.status !== "archived") };
+function shellQuote(text) {
+  return `'${text.replaceAll("'", `'\\''`)}'`;
 }
 
-// src/cli/run.ts
-init_types();
-
-// src/cli/manage.ts
-import { spawn as spawn7 } from "node:child_process";
-import { existsSync as existsSync3 } from "node:fs";
-import { chmod as chmod2, copyFile, mkdir as mkdir2, rename, rm as rm2 } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import { join as join9 } from "node:path";
-
-// src/lib/desktop-update.ts
-import { createHash } from "node:crypto";
-import { spawn as spawn5 } from "node:child_process";
-import { constants, createReadStream as createReadStream2, createWriteStream } from "node:fs";
-import { access, chmod, mkdir, readdir, rm, writeFile } from "node:fs/promises";
-import { dirname as dirname5, join as join8 } from "node:path";
-import { Readable } from "node:stream";
-import { pipeline } from "node:stream/promises";
+// src/lib/connect.ts
 init_types();
-function isNewerVersion(candidate, current) {
-  const parse3 = (v) => {
-    const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(v.trim());
-    return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
-  };
-  const a = parse3(candidate);
-  const b = parse3(current);
-  if (a === null || b === null) return false;
-  for (let i = 0; i < 3; i++) {
-    if (a[i] !== b[i]) return a[i] > b[i];
-  }
-  return false;
-}
-function pickDesktopAsset(assets, platform, arch) {
-  const suffix = platform === "darwin" ? "-mac.zip" : platform === "linux" ? ".AppImage" : null;
-  if (suffix === null) return null;
-  return assets.find(
-    (a) => a.name.endsWith(suffix) && a.name.includes("-arm64") === (arch === "arm64")
-  ) ?? null;
-}
-function parseSums(text) {
-  const sums = /* @__PURE__ */ new Map();
-  for (const line of text.split("\n")) {
-    const match = /^([0-9a-f]{64})\s+\*?(.+?)\s*$/.exec(line.trim());
-    if (match) sums.set(match[2], match[1]);
-  }
-  return sums;
-}
-async function checkForDesktopUpdate(currentVersion, opts = {}) {
-  const slug2 = repoSlug();
-  if (slug2 === void 0) return null;
-  const fetchFn = opts.fetchFn ?? fetch;
-  const response = await fetchFn(`https://api.github.com/repos/${slug2}/releases/latest`, {
-    headers: { accept: "application/vnd.github+json", "user-agent": "puddle-desktop" }
+var CODEX_OAUTH_PORT = 1455;
+async function connectRemote(opts) {
+  const logger = opts.logger ?? silentLogger;
+  const platform = opts.platform ?? process.platform;
+  const ssh = new SshTransport(opts.host, {
+    sshBinary: opts.sshBinary,
+    scpBinary: opts.scpBinary,
+    platform,
+    askpassProgram: opts.sshAskpassProgram
   });
-  if (!response.ok) {
-    throw new CliError("not_installed", `release lookup failed (HTTP ${response.status})`);
-  }
-  const release = await response.json();
-  const version2 = (release.tag_name ?? "").replace(/^v/, "");
-  if (!isNewerVersion(version2, currentVersion)) return null;
-  return updateFromRelease(version2, release.assets ?? [], opts);
-}
-async function desktopUpdateAt(version2, opts = {}) {
-  const slug2 = repoSlug();
-  if (slug2 === void 0) {
-    throw new CliError(
-      "not_installed",
-      "no release source is configured for this build",
-      "set PUDDLE_REPO=owner/repo"
+  if (platform === "win32") {
+    logger.warn(
+      "Windows OpenSSH cannot share a connection; you may be asked to authenticate more than once. An SSH key (ssh-copy-id) avoids the prompts."
     );
   }
-  const fetchFn = opts.fetchFn ?? fetch;
-  const response = await fetchFn(`https://api.github.com/repos/${slug2}/releases/tags/v${version2}`, {
-    headers: { accept: "application/vnd.github+json", "user-agent": "puddle-desktop" }
-  });
-  if (response.status === 404) {
-    throw new CliError("not_installed", `no release v${version2} exists in ${slug2}`);
-  }
-  if (!response.ok) {
-    throw new CliError("not_installed", `release lookup failed (HTTP ${response.status})`);
-  }
-  const release = await response.json();
-  return updateFromRelease(version2, release.assets ?? [], opts);
-}
-function updateFromRelease(version2, assets, opts) {
-  const asset = pickDesktopAsset(
-    assets,
-    opts.platform ?? process.platform,
-    opts.arch ?? process.arch
-  );
-  const sums = assets.find((a) => a.name === "SHA256SUMS");
-  if (asset === null || sums === void 0) return null;
-  return {
-    version: version2,
-    asset: { name: asset.name, url: asset.browser_download_url },
-    sumsUrl: sums.browser_download_url
-  };
-}
-async function stageDesktopUpdate(update, opts = {}) {
-  const logger = opts.logger ?? silentLogger;
-  const fetchFn = opts.fetchFn ?? fetch;
-  const dir = join8(opts.cacheDir ?? join8(clientHome(), "cache", "desktop"), update.version);
-  await rm(dir, { recursive: true, force: true });
-  await mkdir(dir, { recursive: true });
+  await ssh.open();
+  let tunnelResource;
+  let oauthForwardResource;
+  let uiResource;
+  let endpointResource;
   try {
-    logger.info(`downloading ${update.asset.name}`);
-    const archive = join8(dir, update.asset.name);
-    const response = await fetchFn(update.asset.url, {
-      headers: { "user-agent": "puddle-desktop" }
+    const bootstrap = { tarball: opts.tarball, logger };
+    const attachedDaemon = new AttachedDaemon(ssh, logger);
+    const endpoint = await ensureDaemon(ssh, {
+      ...bootstrap,
+      attachedFallback: () => attachedDaemon.start()
     });
-    if (!response.ok || response.body === null) {
-      throw new CliError("not_installed", `download failed (HTTP ${response.status})`);
-    }
-    await pipeline(
-      Readable.fromWeb(response.body),
-      createWriteStream(archive)
-    );
-    const sumsResponse = await fetchFn(update.sumsUrl, {
-      headers: { "user-agent": "puddle-desktop" }
+    endpointResource = endpoint;
+    const remotePort = opts.remotePort ?? endpoint.port;
+    const tunnel = await openTunnel(ssh, remotePort, {
+      sshBinary: opts.sshBinary,
+      logger,
+      ready: async (localPort) => {
+        await endpoint.lease?.ensureRunning();
+        return waitForHttp(`http://127.0.0.1:${localPort}/api/version`, 8e3);
+      }
     });
-    if (!sumsResponse.ok) {
-      throw new CliError("not_installed", `SHA256SUMS fetch failed (HTTP ${sumsResponse.status})`);
+    tunnelResource = tunnel;
+    const client = new DaemonClient(tunnel.localPort, endpoint.token);
+    tunnel.onPortChange((port) => client.setPort(port));
+    const oauthForward = await openCallbackForward(ssh, CODEX_OAUTH_PORT, {
+      sshBinary: opts.sshBinary,
+      logger
+    });
+    oauthForwardResource = oauthForward;
+    const daemon = await runHandshake({
+      client,
+      noUpgrade: opts.noUpgrade,
+      upgradeDaemon: makeUpgrader(ssh, client, bootstrap, endpoint.lease),
+      logger
+    });
+    const avoidPort = await readDaemonPort(new LocalTransport());
+    const ui = await startUiServer({
+      assetsDir: opts.assetsDir,
+      port: opts.port ?? opts.preferPort,
+      strictPort: opts.port !== void 0,
+      // a preferred port stays non-strict
+      avoidPort,
+      target: { host: "127.0.0.1", port: tunnel.localPort },
+      ...opts.onRefreshRequest !== void 0 ? { control: { token: endpoint.token, onRefresh: opts.onRefreshRequest } } : {},
+      // The store lives on the CLIENT machine — every cockpit here shares it,
+      // whichever remote daemon each one drives.
+      localSync: { token: endpoint.token, file: join7(clientHome(), "local-sync.json") }
+    });
+    uiResource = ui;
+    tunnel.onPortChange((port) => ui.setTarget({ host: "127.0.0.1", port }));
+    const eventCbs = /* @__PURE__ */ new Set();
+    tunnel.onEvent((e) => {
+      if (e.t === "tunnel-down") logger.warn(`tunnel to ${opts.host} lost \u2014 reconnecting\u2026`);
+      if (e.t === "tunnel-up") logger.info("tunnel restored");
+      eventCbs.forEach((cb) => cb(e));
+    });
+    return {
+      origin: ui.origin,
+      browserUrl: `${ui.origin}/?host=${encodeURIComponent(opts.host)}#token=${endpoint.token}`,
+      nonce: ui.nonce,
+      daemon,
+      daemonLifetime: endpoint.daemonLifetime,
+      onEvent(cb) {
+        eventCbs.add(cb);
+        return () => eventCbs.delete(cb);
+      },
+      async stop() {
+        await closeRemoteResources(ui, oauthForward, endpoint, tunnel, ssh);
+      }
+    };
+  } catch (err) {
+    try {
+      await closeRemoteResources(
+        uiResource,
+        oauthForwardResource,
+        endpointResource,
+        tunnelResource,
+        ssh
+      );
+    } catch {
     }
-    const expected = parseSums(await sumsResponse.text()).get(update.asset.name);
-    if (expected === void 0) {
-      throw new CliError("not_installed", `${update.asset.name} is not in SHA256SUMS`);
+    throw err;
+  }
+}
+async function closeRemoteResources(ui, oauthForward, endpoint, tunnel, ssh) {
+  const actions = [
+    () => ui?.close(),
+    () => oauthForward?.(),
+    () => endpoint?.lease?.stop(),
+    () => tunnel?.close(),
+    () => ssh.dispose()
+  ];
+  let firstError;
+  for (const action of actions) {
+    try {
+      await action();
+    } catch (err) {
+      if (firstError === void 0) firstError = err;
     }
-    const actual = await fileSha256(archive);
-    if (actual !== expected) {
+  }
+  if (firstError !== void 0) throw firstError;
+}
+
+// src/lib/logs.ts
+init_types();
+async function showLogs(transport, opts) {
+  if (opts.session !== void 0) {
+    const file2 = `${hostPaths.logs}/${opts.session}/${opts.term ?? "agent"}.log`;
+    const command2 = opts.follow ? `tail -f -c 262144 ${file2}` : `tail -c 262144 ${file2}`;
+    const result = await transport.exec(command2, {
+      onStdout: opts.write,
+      ...opts.follow ? {} : { timeoutMs: 3e4 }
+    });
+    if (result.code !== 0 && !opts.follow) {
       throw new CliError(
-        "not_installed",
-        `checksum mismatch for ${update.asset.name}`,
-        `expected ${expected}, got ${actual}`
+        "unknown_session",
+        `no log at ${file2}`,
+        "list sessions with: puddle status \u2014 the id is the log directory name"
       );
     }
-    if (update.asset.name.endsWith(".zip")) {
-      const extractDir = join8(dir, "extract");
-      await run("/usr/bin/ditto", ["-x", "-k", archive, extractDir]);
-      const bundle = (await readdir(extractDir)).find((name) => name.endsWith(".app"));
-      if (bundle === void 0) {
-        throw new CliError("not_installed", "the update zip contains no .app bundle");
-      }
-      logger.info(`staged ${update.version} at ${join8(extractDir, bundle)}`);
-      return {
-        version: update.version,
-        kind: "mac-app",
-        stagedPath: join8(extractDir, bundle),
-        dir
-      };
-    }
-    await chmod(archive, 493);
-    logger.info(`staged ${update.version} at ${archive}`);
-    return { version: update.version, kind: "appimage", stagedPath: archive, dir };
-  } catch (e) {
-    await rm(dir, { recursive: true, force: true });
-    throw e;
+    return;
   }
+  const command = `if command -v journalctl >/dev/null 2>&1 && journalctl --user -u puddled -n 1 >/dev/null 2>&1; then journalctl --user -u puddled -n 200 --no-pager${opts.follow ? " -f" : ""}; elif [ -f ${hostPaths.logs}/puddled.out.log ]; then tail ${opts.follow ? "-f " : ""}-n 200 ${hostPaths.logs}/puddled.out.log ${hostPaths.logs}/puddled.err.log 2>/dev/null; else echo 'no daemon logs found \u2014 the daemon logs to its supervisor (journalctl --user -u puddled / ~/.puddle/logs)'; fi`;
+  await transport.exec(command, { onStdout: opts.write });
 }
-async function pruneDesktopUpdateCache(keep = [], opts = {}) {
-  const dir = opts.cacheDir ?? join8(clientHome(), "cache", "desktop");
-  let entries;
+
+// src/lib/registry.ts
+import { mkdirSync as mkdirSync5, readdirSync, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join8 } from "node:path";
+function cockpitsDir(env) {
+  return join8(clientHome(env), "cockpits");
+}
+function slug(target) {
+  return target.replace(/[^A-Za-z0-9@._-]/g, "_");
+}
+function cockpitRecordPath(target) {
+  return join8(cockpitsDir(), `${slug(target)}.json`);
+}
+function cockpitLogPath(target) {
+  return join8(clientHome(), "logs", `cockpit-${slug(target)}.log`);
+}
+function writeCockpitRecord(record2) {
+  mkdirSync5(cockpitsDir(), { recursive: true, mode: 448 });
+  writeFileSync3(cockpitRecordPath(record2.target), JSON.stringify(record2, null, 2) + "\n", {
+    mode: 384
+  });
+}
+function readCockpitRecord(target) {
   try {
-    entries = await readdir(dir);
+    return JSON.parse(readFileSync6(cockpitRecordPath(target), "utf8"));
   } catch {
-    return;
+    return null;
   }
-  await Promise.all(
-    entries.filter((name) => !keep.includes(name)).map((name) => rm(join8(dir, name), { recursive: true, force: true }).catch(() => {
-    }))
-  );
 }
-async function applyDesktopUpdate(staged, opts) {
-  const logger = opts.logger ?? silentLogger;
-  const script = swapScript(staged, opts);
-  const scriptPath = join8(staged.dir, "apply.sh");
-  await writeFile(scriptPath, script, { mode: 493 });
-  logger.info(`applying ${staged.version} via ${scriptPath}`);
-  if (opts.detach ?? true) {
-    const child = spawn5("/bin/sh", [scriptPath], { detached: true, stdio: "ignore" });
-    child.unref();
-    return;
-  }
-  await run("/bin/sh", [scriptPath]);
+function removeCockpitRecord(target) {
+  rmSync(cockpitRecordPath(target), { force: true });
 }
-var q = (s) => `'${s.replaceAll("'", `'\\''`)}'`;
-function swapScript(staged, opts) {
-  const wait = opts.waitPid === void 0 ? [] : [
-    `i=0`,
-    `while kill -0 ${opts.waitPid} 2>/dev/null; do`,
-    `  i=$((i+1)); [ "$i" -gt 600 ] && exit 1`,
-    `  sleep 0.1`,
-    `done`
-  ];
-  if (staged.kind === "mac-app") {
-    return [
-      `#!/bin/sh`,
-      `# Puddle desktop update ${staged.version} \u2014 swap once the app exits`,
-      ...wait,
-      `target=${q(opts.targetPath)}`,
-      `target_dir=${q(dirname5(opts.targetPath))}`,
-      `staged=${q(staged.stagedPath)}`,
-      `mkdir -p "$target_dir" || exit 1`,
-      `rm -rf "$target.old"`,
-      `had_old=0`,
-      `if [ -e "$target" ]; then`,
-      `  mv "$target" "$target.old" || exit 1`,
-      `  had_old=1`,
-      `fi`,
-      `if mv "$staged" "$target" 2>/dev/null || /usr/bin/ditto "$staged" "$target"; then`,
-      // Defence in depth: the normal path never quarantines (node's fetch is
-      // not a quarantine-opted-in app, and ditto only propagates what the
-      // zip already carries), but if the bundle ever acquires the attribute
-      // the swap must not resurrect the Gatekeeper prompt.
-      `  /usr/bin/xattr -dr com.apple.quarantine "$target" 2>/dev/null`,
-      `  rm -rf "$target.old" ${q(staged.dir)}`,
-      ...opts.relaunch ? [`  open "$target"`] : [],
-      `else`,
-      `  rm -rf "$target"`,
-      `  [ "$had_old" -eq 0 ] || mv "$target.old" "$target"`,
-      `  exit 1`,
-      `fi`,
-      ``
-    ].join("\n");
+function listCockpitRecords() {
+  let names;
+  try {
+    names = readdirSync(cockpitsDir());
+  } catch {
+    return [];
   }
-  return [
-    `#!/bin/sh`,
-    `# Puddle desktop update ${staged.version} \u2014 swap once the app exits`,
-    ...wait,
-    `target=${q(opts.targetPath)}`,
-    `cp -f ${q(staged.stagedPath)} "$target" || exit 1`,
-    `chmod +x "$target"`,
-    `rm -rf ${q(staged.dir)}`,
-    ...opts.relaunch ? [`"$target" >/dev/null 2>&1 &`] : [],
-    ``
-  ].join("\n");
-}
-async function findInstalledDesktopApp(opts = {}) {
-  if ((opts.platform ?? process.platform) !== "darwin") return null;
-  const { readFile } = await import("node:fs/promises");
-  const { homedir: homedir3 } = await import("node:os");
-  const systemApplications = opts.systemApplicationsDir ?? "/Applications";
-  const home = opts.homeDir ?? homedir3();
-  for (const appPath of [
-    join8(systemApplications, "Puddle.app"),
-    join8(home, "Applications", "Puddle.app")
-  ]) {
+  const records = [];
+  for (const name of names) {
+    if (!name.endsWith(".json")) continue;
     try {
-      const plist = await readFile(join8(appPath, "Contents/Info.plist"), "utf8");
-      const match = /<key>CFBundleShortVersionString<\/key>\s*<string>([^<]+)<\/string>/.exec(
-        plist
-      );
-      if (match) return { appPath, version: match[1] };
+      records.push(JSON.parse(readFileSync6(join8(cockpitsDir(), name), "utf8")));
     } catch {
     }
   }
-  return null;
+  return records.sort((a, b) => a.target.localeCompare(b.target));
 }
-async function desktopAppInstallPath(opts = {}) {
-  if ((opts.platform ?? process.platform) !== "darwin") return null;
-  const { homedir: homedir3 } = await import("node:os");
-  const systemApplications = opts.systemApplicationsDir ?? "/Applications";
-  const canWrite = opts.canWrite ?? (async (path) => {
-    try {
-      await access(path, constants.W_OK);
-      return true;
-    } catch {
-      return false;
-    }
-  });
-  if (await canWrite(systemApplications)) return join8(systemApplications, "Puddle.app");
-  const userApplications = join8(opts.homeDir ?? homedir3(), "Applications");
-  await mkdir(userApplications, { recursive: true });
-  return join8(userApplications, "Puddle.app");
+function isPidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
 }
-function isDesktopAppRunning(appPath) {
-  return new Promise((resolve3) => {
-    const child = spawn5("/usr/bin/pgrep", ["-f", `${appPath}/Contents/MacOS/`], {
-      stdio: "ignore"
+async function checkCockpit(record2) {
+  if (!isPidAlive(record2.pid)) return "dead";
+  if (record2.status === "starting") return "starting";
+  if (record2.status !== "ready" || record2.origin === void 0 || record2.nonce === void 0) {
+    return "unverified";
+  }
+  try {
+    const res = await fetch(`${record2.origin}/`, {
+      method: "HEAD",
+      signal: AbortSignal.timeout(1500)
     });
-    child.on("error", () => resolve3(false));
-    child.on("exit", (code) => resolve3(code === 0));
-  });
-}
-function fileSha256(path) {
-  const hash2 = createHash("sha256");
-  return pipeline(createReadStream2(path), hash2).then(() => hash2.digest("hex"));
+    return res.headers.get("x-puddle-cockpit") === record2.nonce ? "running" : "unverified";
+  } catch {
+    return "unverified";
+  }
 }
-function run(command, args) {
-  return new Promise((resolve3, reject) => {
-    const child = spawn5(command, args, { stdio: "ignore" });
-    child.on("error", reject);
-    child.on(
-      "exit",
-      (code) => code === 0 ? resolve3() : reject(new CliError("not_installed", `${command} exited with ${code ?? "signal"}`))
-    );
+
+// src/lib/start.ts
+import { join as join9 } from "node:path";
+init_types();
+async function startLocal(opts) {
+  const logger = opts.logger ?? silentLogger;
+  const transport = new LocalTransport();
+  const bootstrap = { tarball: opts.tarball, logger };
+  const endpoint = await ensureDaemon(transport, bootstrap);
+  const client = new DaemonClient(endpoint.port, endpoint.token);
+  const daemon = await runHandshake({
+    client,
+    noUpgrade: opts.noUpgrade,
+    upgradeDaemon: makeUpgrader(transport, client, bootstrap),
+    logger
+  });
+  const ui = await startUiServer({
+    assetsDir: opts.assetsDir,
+    port: opts.port ?? opts.preferPort,
+    strictPort: opts.port !== void 0,
+    // a preferred port stays non-strict
+    avoidPort: endpoint.port,
+    // never squat the daemon's own port
+    target: { host: "127.0.0.1", port: endpoint.port },
+    ...opts.onRefreshRequest !== void 0 ? { control: { token: endpoint.token, onRefresh: opts.onRefreshRequest } } : {},
+    localSync: { token: endpoint.token, file: join9(clientHome(), "local-sync.json") }
   });
+  const eventCbs = /* @__PURE__ */ new Set();
+  return {
+    origin: ui.origin,
+    browserUrl: `${ui.origin}/#token=${endpoint.token}`,
+    nonce: ui.nonce,
+    daemon,
+    daemonLifetime: "persistent",
+    onEvent(cb) {
+      eventCbs.add(cb);
+      return () => eventCbs.delete(cb);
+    },
+    async stop() {
+      await ui.close();
+      transport.dispose();
+    }
+  };
+}
+
+// src/lib/status.ts
+var LIVE_FIRST = {
+  running: 0,
+  waiting_input: 1,
+  starting: 2,
+  interrupted: 3,
+  exited: 4,
+  archived: 5
+};
+async function statusReport(client) {
+  const [daemon, host, sessions] = await Promise.all([
+    client.version(),
+    client.host(),
+    client.sessions()
+  ]);
+  sessions.sort(
+    (a, b) => (LIVE_FIRST[a.status] ?? 9) - (LIVE_FIRST[b.status] ?? 9) || (b.last_activity_at ?? "").localeCompare(a.last_activity_at ?? "")
+  );
+  return { daemon, host, sessions: sessions.filter((s) => s.status !== "archived") };
 }
 
+// src/cli/run.ts
+init_types();
+
+// src/cli/manage.ts
+import { spawn as spawn7 } from "node:child_process";
+import { existsSync as existsSync4 } from "node:fs";
+import { chmod as chmod2, copyFile, mkdir as mkdir2, rename, rm as rm2 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { join as join10 } from "node:path";
+
 // src/lib/releases.ts
 init_types();
 async function latestReleaseVersion(opts = {}) {
@@ -21614,7 +22064,7 @@ if [ "\${PUDDLE_PURGE:-0}" = 1 ]; then
   rm -rf "$HOME_DIR"
   say "deleted $HOME_DIR"
 else
-  rm -rf "$HOME_DIR/bin" "$HOME_DIR/cache" "$HOME_DIR/runtime.json"
+  rm -rf "$HOME_DIR/bin" "$HOME_DIR/cache" "$HOME_DIR/runtime.json" "$HOME_DIR/supervisor"
   say "removed the install; data kept under $HOME_DIR"
 fi`;
   const result = await transport.exec(`PUDDLE_PURGE=${opts.purge ? 1 : 0} sh -s`, {
@@ -21656,8 +22106,8 @@ async function upgradeDaemon(transport, opts = {}) {
 
 // src/cli/detach.ts
 import { spawn as spawn6 } from "node:child_process";
-import { closeSync, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync6 } from "node:fs";
-import { dirname as dirname6 } from "node:path";
+import { closeSync, mkdirSync as mkdirSync6, openSync, readFileSync as readFileSync7 } from "node:fs";
+import { dirname as dirname7 } from "node:path";
 init_types();
 var COCKPIT_CHILD_ENV = "PUDDLE_COCKPIT_CHILD";
 var READY_TIMEOUT_MS = 3e5;
@@ -21698,7 +22148,7 @@ async function launchDetached(opts) {
   }
   if (target !== "local") await new SshTransport(target).open();
   const logFile = cockpitLogPath(target);
-  mkdirSync5(dirname6(logFile), { recursive: true });
+  mkdirSync6(dirname7(logFile), { recursive: true });
   const fd = openSync(logFile, "w");
   const argv = opts.argv ?? process.argv.slice(2);
   const child = spawn6(process.execPath, [process.argv[1] ?? "", ...argv], {
@@ -21738,7 +22188,7 @@ async function followStartup(target, childPid, logFile) {
   let offset = 0;
   const relay = () => {
     try {
-      const buf = readFileSync6(logFile);
+      const buf = readFileSync7(logFile);
       if (buf.length > offset) {
         process.stderr.write(buf.subarray(offset));
         offset = buf.length;
@@ -21763,7 +22213,7 @@ async function followStartup(target, childPid, logFile) {
 }
 function spawnDetachedRefresh(target, argv) {
   const logFile = cockpitLogPath(target);
-  mkdirSync5(dirname6(logFile), { recursive: true });
+  mkdirSync6(dirname7(logFile), { recursive: true });
   const fd = openSync(logFile, "a");
   const env = { ...process.env };
   delete env[COCKPIT_CHILD_ENV];
@@ -21780,7 +22230,7 @@ async function terminateCockpit(record2) {
     process.kill(record2.pid, "SIGTERM");
   } catch {
   }
-  const deadline = Date.now() + 5e3;
+  const deadline = Date.now() + 1e4;
   while (Date.now() < deadline && isPidAlive(record2.pid)) await sleep(100);
   if (isPidAlive(record2.pid)) {
     try {
@@ -21800,7 +22250,7 @@ async function ask(question, def) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
     const answer = await new Promise(
-      (resolve3) => rl.question(`${question} [${def}] `, resolve3)
+      (resolve4) => rl.question(`${question} [${def}] `, resolve4)
     );
     return answer.trim() === "" ? def : answer.trim();
   } finally {
@@ -21819,7 +22269,7 @@ async function confirm(question, opts = {}) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
     const answer = await new Promise(
-      (resolve3) => rl.question(`${question} [y/N] `, resolve3)
+      (resolve4) => rl.question(`${question} [y/N] `, resolve4)
     );
     return /^y(es)?$/i.test(answer.trim());
   } finally {
@@ -21938,7 +22388,7 @@ async function runUpgrade(cmd, logger) {
 function upgradeCli(version2, logger) {
   const spec = `@puddle-code/cli@${version2 ?? "latest"}`;
   logger.info(`puddle CLI ${cliVersion()} \u2014 asking npm for ${version2 ?? "the latest release"}`);
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const child = spawn7("npm", ["install", "-g", spec], { stdio: "inherit" });
     child.on(
       "error",
@@ -21953,7 +22403,7 @@ function upgradeCli(version2, logger) {
     child.on("exit", (code) => {
       if (code === 0) {
         logger.info("done \u2014 `puddle --version` shows the installed version");
-        resolve3(0);
+        resolve4(0);
       } else {
         reject(new CliError("not_installed", `npm install exited with ${code ?? "a signal"}`));
       }
@@ -22013,6 +22463,12 @@ async function setDesktop(opts, logger) {
   logger.info(move);
   const staged = await stageDesktopUpdate(update, { logger });
   await applyDesktopUpdate(staged, { targetPath, detach: false, relaunch: false, logger });
+  const protocol = componentProtocolForVersion(update.version);
+  recordDesktopInstallation({
+    path: targetPath,
+    version: update.version,
+    ...protocol ? { protocol } : {}
+  });
   logger.info(`Puddle ${update.version} installed at ${targetPath}`);
   return 0;
 }
@@ -22025,8 +22481,8 @@ async function installDesktopAppImage(version2, logger) {
     );
   }
   const dir = expandHome2(await ask("Where should the AppImage be stored?", "~/puddle"));
-  const target = join9(dir, "Puddle.AppImage");
-  if (existsSync3(target) && version2 === void 0) {
+  const target = join10(dir, "Puddle.AppImage");
+  if (existsSync4(target) && version2 === void 0) {
     logger.info(`${target} already exists \u2014 the app updates itself in-app (its update toast)`);
     return 0;
   }
@@ -22041,6 +22497,12 @@ async function installDesktopAppImage(version2, logger) {
     await chmod2(target, 493);
   }
   await rm2(staged.dir, { recursive: true, force: true });
+  const protocol = componentProtocolForVersion(update.version);
+  recordDesktopInstallation({
+    path: target,
+    version: update.version,
+    ...protocol ? { protocol } : {}
+  });
   logger.info(`installed \u2014 run it directly (${target}) or add it to your launcher`);
   const opener = spawn7("xdg-open", [dir], { stdio: "ignore", detached: true });
   opener.on("error", () => void 0);
@@ -22049,7 +22511,7 @@ async function installDesktopAppImage(version2, logger) {
 }
 function expandHome2(path) {
   if (path === "~") return homedir2();
-  return path.startsWith("~/") ? join9(homedir2(), path.slice(2)) : path;
+  return path.startsWith("~/") ? join10(homedir2(), path.slice(2)) : path;
 }
 async function runRemove(cmd, logger) {
   switch (cmd.what) {
@@ -22064,10 +22526,10 @@ async function runRemove(cmd, logger) {
   }
 }
 async function removeCli(yes, logger) {
-  const managed = await new Promise((resolve3) => {
+  const managed = await new Promise((resolve4) => {
     const child = spawn7("npm", ["ls", "-g", "@puddle-code/cli", "--depth=0"], { stdio: "ignore" });
-    child.on("error", () => resolve3(false));
-    child.on("exit", (code) => resolve3(code === 0));
+    child.on("error", () => resolve4(false));
+    child.on("exit", (code) => resolve4(code === 0));
   });
   if (!managed) {
     throw new CliError(
@@ -22084,13 +22546,13 @@ async function removeCli(yes, logger) {
     logger.info("nothing removed");
     return 0;
   }
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const child = spawn7("npm", ["uninstall", "-g", "@puddle-code/cli"], { stdio: "inherit" });
     child.on("error", () => reject(new CliError("not_installed", "npm is not on PATH")));
     child.on("exit", (code) => {
       if (code === 0) {
         logger.info("removed \u2014 daemons keep running (puddle remove daemon uninstalls one)");
-        resolve3(0);
+        resolve4(0);
       } else {
         reject(new CliError("not_installed", `npm uninstall exited with ${code ?? "a signal"}`));
       }
@@ -22241,9 +22703,9 @@ function timestampedLogger() {
 
 // src/cli/run.ts
 function assetsDir() {
-  const here = dirname7(fileURLToPath3(import.meta.url));
-  for (const candidate of [join10(here, "public"), join10(here, "..", "..", "dist", "public")]) {
-    if (existsSync4(join10(candidate, "index.html"))) return candidate;
+  const here = dirname8(fileURLToPath3(import.meta.url));
+  for (const candidate of [join11(here, "public"), join11(here, "..", "..", "dist", "public")]) {
+    if (existsSync5(join11(candidate, "index.html"))) return candidate;
   }
   throw new CliError(
     "not_installed",
@@ -22283,7 +22745,7 @@ async function openTarget(host) {
   };
 }
 function runUntilInterrupted(stop, farewell) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let stopping = false;
     process.on("SIGINT", () => {
       if (stopping) process.exit(130);
@@ -22291,10 +22753,10 @@ function runUntilInterrupted(stop, farewell) {
       process.stderr.write(`
 ${farewell}
 `);
-      void stop().then(resolve3);
+      void stop().then(resolve4);
     });
     process.on("SIGTERM", () => {
-      void stop().then(resolve3);
+      void stop().then(resolve4);
     });
   });
 }
@@ -22305,7 +22767,7 @@ async function run2(command) {
       process.stdout.write(USAGE + "\n");
       return 0;
     case "version":
-      process.stdout.write(`Puddle ${cliVersion()}
+      process.stdout.write(`${formatComponentVersions(await installedComponentVersions())}
 `);
       return 0;
     case "launch": {
@@ -22438,7 +22900,9 @@ async function run2(command) {
       for (const victim of victims) {
         await terminateCockpit(victim);
         const where = victim.target === "local" ? "this machine" : victim.target;
-        logger.info(`stopped the cockpit for ${victim.target} \u2014 sessions keep running on ${where}`);
+        logger.info(
+          victim.daemonLifetime === "cockpit" ? `stopped the cockpit for ${victim.target} \u2014 daemon data remains on ${where}; interrupted sessions can resume on the next launch` : `stopped the cockpit for ${victim.target} \u2014 sessions keep running on ${where}`
+        );
       }
       return 0;
     }
@@ -22591,7 +23055,8 @@ async function runCockpit(command, target, terminal) {
     status: "ready",
     origin: cockpit.origin,
     browserUrl: cockpit.browserUrl,
-    nonce: cockpit.nonce
+    nonce: cockpit.nonce,
+    daemonLifetime: cockpit.daemonLifetime
   });
   const arrow = command.target === "local" ? "" : ` \u2192 ${command.target}`;
   logger.info(`Puddle cockpit at ${cockpit.origin}${arrow} (daemon ${cockpit.daemon.version})`);
@@ -22600,10 +23065,13 @@ async function runCockpit(command, target, terminal) {
     logger.info(`open: ${cockpit.browserUrl}`);
   }
   const where = command.target === "local" ? "this machine" : command.target;
-  await runUntilInterrupted(async () => {
-    await cockpit.stop();
-    removeCockpitRecord(target);
-  }, `cockpit closed \u2014 sessions keep running on ${where}`);
+  await runUntilInterrupted(
+    async () => {
+      await cockpit.stop();
+      removeCockpitRecord(target);
+    },
+    cockpit.daemonLifetime === "cockpit" ? `cockpit closed \u2014 daemon data remains on ${where}; interrupted sessions can resume on the next launch` : `cockpit closed \u2014 sessions keep running on ${where}`
+  );
   return 0;
 }
 function pad(text, width) {