@puddle-code/cli 0.2.0 → 0.2.2

package/dist/index.js

@@ -3756,7 +3756,7 @@ var init_wrapper = __esm({
 
 // src/lib/ws-client.ts
 function connectGateway(port, authority) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const ws = new wrapper_default(`ws://127.0.0.1:${port}/ws`, {
       headers: { host: `localhost:${port}` }
     });
@@ -3781,7 +3781,7 @@ function connectGateway(port, authority) {
       }
       if (parsed.t === "authenticated") {
         clearTimeout(timer);
-        resolve4({
+        resolve5({
           send(message) {
             if (resource.valid() && ws.readyState === wrapper_default.OPEN)
               ws.send(JSON.stringify(message));
@@ -3855,7 +3855,7 @@ async function attachSession(opts) {
     rows: streams.stdout.rows ?? 24
   });
   gateway.send({ t: "attach", session: session.id, term, ...dims2() });
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let settled = false;
     const finish = (outcome) => {
       if (settled) return;
@@ -3864,7 +3864,7 @@ async function attachSession(opts) {
       stdin.removeListener("data", onStdin);
       unResize?.();
       gateway.close();
-      resolve4(outcome);
+      resolve5(outcome);
     };
     gateway.onMessage((message) => {
       switch (message.t) {
@@ -3925,7 +3925,7 @@ import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
 
 // ../shared/src/protocol.ts
-var PROTOCOL_VERSION = { major: 19, minor: 0 };
+var PROTOCOL_VERSION = { major: 20, minor: 0 };
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -19807,19 +19807,25 @@ var remoteChunkSchema = external_exports.object({
 }).strict();
 
 // ../shared/src/api/cockpit-remote.ts
-var cockpitRemoteRequestSchema = external_exports.union([
+var connectorLocalRequestSchema = external_exports.union([
   remoteAdminRequestSchema,
+  external_exports.object({ t: external_exports.literal("delete_registration") }).strict()
+]);
+var cockpitRemoteRequestSchema = external_exports.union([
+  connectorLocalRequestSchema,
   external_exports.object({
     t: external_exports.literal("enable"),
     registration: external_exports.object({ service: remoteOriginSchema, app: remoteOriginSchema, code: remoteSecretSchema }).strict().optional()
   }).strict(),
   external_exports.object({ t: external_exports.literal("reset") }).strict()
 ]);
+var cockpitRegistrationCheckSchema = external_exports.object({ service: remoteOriginSchema, code: remoteSecretSchema }).strict();
 var cockpitRemoteStatusSchema = external_exports.object({
   availability: external_exports.enum(["ready", "not_installed", "upgrade_required"]),
   configured: external_exports.boolean(),
   enabled: external_exports.boolean(),
   connected: external_exports.boolean(),
+  canDeleteRegistration: external_exports.boolean().optional(),
   supervisor: external_exports.enum(["systemd", "launchd"]).nullable(),
   host: remoteIdSchema.optional(),
   peer: remotePeerSchema.optional(),
@@ -19932,6 +19938,14 @@ var remoteLoginStateSchema = external_exports.object({
 var registerHostRequestSchema = external_exports.object({ label: remoteLabelSchema }).strict();
 var registrationResponseSchema = external_exports.object({ host: remoteIdSchema, code: remoteSecretSchema, expires: external_exports.number() }).strict();
 var redeemRegistrationSchema = external_exports.object({ code: remoteSecretSchema }).strict();
+var desktopRegistrationSchema = external_exports.object({
+  challenge: remoteSecretSchema,
+  label: remoteLabelSchema,
+  service: remoteOriginSchema,
+  app: remoteOriginSchema,
+  expires: external_exports.number().int().positive()
+}).strict();
+var registrationStatusSchema = external_exports.object({ ready: external_exports.boolean() }).strict();
 var connectorRegistrationSchema = external_exports.object({
   host: remoteIdSchema,
   account: remoteAccountSchema,
@@ -19987,7 +20001,7 @@ var LocalTransport = class {
   kind = "local";
   label = "this machine";
   exec(command, opts = {}) {
-    return new Promise((resolve4) => {
+    return new Promise((resolve5) => {
       const child = spawn("sh", ["-c", command], { stdio: ["pipe", "pipe", "pipe"] });
       let stdout = "";
       let stderr = "";
@@ -20004,11 +20018,11 @@ var LocalTransport = class {
       child.stderr.on("data", (chunk) => stderr += chunk.toString());
       child.on("error", (err) => {
         if (timer) clearTimeout(timer);
-        resolve4({ code: -1, stdout, stderr: stderr + String(err) });
+        resolve5({ code: -1, stdout, stderr: stderr + String(err) });
       });
       child.on("close", (code) => {
         if (timer) clearTimeout(timer);
-        resolve4({ code: code ?? -1, stdout, stderr });
+        resolve5({ code: code ?? -1, stdout, stderr });
       });
       child.stdin.on("error", () => {
       });
@@ -20102,7 +20116,7 @@ var SshTransport = class {
    * live control socket behind.
    */
   open() {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       const child = spawn2(this.ssh, this.args(this.host, "true"), {
         // A GUI has no useful inherited terminal; OpenSSH calls its askpass
         // helper instead. The terminal CLI keeps byte-for-byte inheritance.
@@ -20114,7 +20128,7 @@ var SshTransport = class {
         (err) => reject(new CliError("ssh_unreachable", `could not run ${this.ssh}: ${err.message}`))
       );
       child.on("close", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else {
           reject(
             new CliError(
@@ -20130,13 +20144,13 @@ var SshTransport = class {
   /** Whether the master connection is still alive (-O check). */
   isAlive() {
     if (!this.hasControlMaster) return Promise.resolve(true);
-    return new Promise((resolve4) => {
+    return new Promise((resolve5) => {
       const child = spawn2(this.ssh, this.args("-O", "check", this.host), {
         stdio: "ignore",
         env: this.spawnEnv()
       });
-      child.on("error", () => resolve4(false));
-      child.on("close", (code) => resolve4(code === 0));
+      child.on("error", () => resolve5(false));
+      child.on("close", (code) => resolve5(code === 0));
     });
   }
   /**
@@ -20149,18 +20163,18 @@ var SshTransport = class {
    */
   cancelForward(localPort, remotePort) {
     if (!this.hasControlMaster) return Promise.resolve();
-    return new Promise((resolve4) => {
+    return new Promise((resolve5) => {
       const spec = `${localPort}:127.0.0.1:${remotePort}`;
       const child = spawn2(this.ssh, this.args("-O", "cancel", "-L", spec, this.host), {
         stdio: "ignore",
         env: this.spawnEnv()
       });
-      child.on("error", () => resolve4());
-      child.on("close", () => resolve4());
+      child.on("error", () => resolve5());
+      child.on("close", () => resolve5());
     });
   }
   exec(command, opts = {}) {
-    return new Promise((resolve4) => {
+    return new Promise((resolve5) => {
       const child = spawn2(this.ssh, this.args(this.host, "--", `sh -c ${shellQuote(command)}`), {
         stdio: ["pipe", "pipe", "pipe"],
         env: this.spawnEnv()
@@ -20180,11 +20194,11 @@ var SshTransport = class {
       child.stderr.on("data", (chunk) => stderr += chunk.toString());
       child.on("error", (err) => {
         if (timer) clearTimeout(timer);
-        resolve4({ code: -1, stdout, stderr: stderr + String(err) });
+        resolve5({ code: -1, stdout, stderr: stderr + String(err) });
       });
       child.on("close", (code) => {
         if (timer) clearTimeout(timer);
-        resolve4({ code: code ?? -1, stdout, stderr });
+        resolve5({ code: code ?? -1, stdout, stderr });
       });
       child.stdin.on("error", () => {
       });
@@ -20204,11 +20218,11 @@ var SshTransport = class {
     });
     let stdout = "";
     let stderr = "";
-    const result = new Promise((resolve4) => {
+    const result = new Promise((resolve5) => {
       child.stdout.on("data", (chunk) => stdout += chunk.toString());
       child.stderr.on("data", (chunk) => stderr += chunk.toString());
-      child.on("error", (err) => resolve4({ code: -1, stdout, stderr: stderr + String(err) }));
-      child.on("close", (code) => resolve4({ code: code ?? -1, stdout, stderr }));
+      child.on("error", (err) => resolve5({ code: -1, stdout, stderr: stderr + String(err) }));
+      child.on("close", (code) => resolve5({ code: code ?? -1, stdout, stderr }));
     });
     return {
       result,
@@ -20223,14 +20237,14 @@ var SshTransport = class {
   }
   async copyTo(localPath, destPath) {
     await this.exec(`mkdir -p $(dirname ${destPath})`, { timeoutMs: 15e3 });
-    await new Promise((resolve4, reject) => {
+    await new Promise((resolve5, reject) => {
       const child = spawn2(this.scp, [...this.controlArgs, localPath, `${this.host}:${destPath}`], {
         stdio: ["ignore", "ignore", "inherit"],
         env: this.spawnEnv()
       });
       child.on("error", reject);
       child.on("close", (code) => {
-        if (code === 0) resolve4();
+        if (code === 0) resolve5();
         else reject(new CliError("ssh_unreachable", `scp to ${this.host} failed (exit ${code})`));
       });
     });
@@ -20331,7 +20345,7 @@ async function registrationCode() {
   const readline = createInterface({ input: process.stdin, output: silent, terminal: true });
   try {
     return remoteSecretSchema.parse(
-      await new Promise((resolve4) => readline.question("", resolve4))
+      await new Promise((resolve5) => readline.question("", resolve5))
     );
   } finally {
     readline.close();
@@ -20733,6 +20747,9 @@ import { createHash, randomBytes } from "node:crypto";
 import {
   chmodSync,
   closeSync,
+  constants,
+  fchmodSync,
+  fstatSync,
   fsyncSync,
   lstatSync,
   mkdirSync as mkdirSync3,
@@ -20744,7 +20761,7 @@ import {
   writeFileSync
 } from "node:fs";
 import { connect, createServer } from "node:net";
-import { dirname as dirname2, join as join2 } from "node:path";
+import { dirname as dirname2, join as join2, resolve } from "node:path";
 var digest = (value) => createHash("sha256").update(value).digest("hex");
 var secret = (prefix = "") => prefix + randomBytes(32).toString("hex");
 function privatePath(path, directory = false) {
@@ -20757,6 +20774,27 @@ function privateDirectory(path) {
   mkdirSync3(path, { recursive: true, mode: 448 });
   privatePath(path, true);
 }
+function initialisePrivateHome(home) {
+  const path = resolve(home);
+  mkdirSync3(path, { recursive: true, mode: 448 });
+  if (process.platform === "win32") {
+    privatePath(path, true);
+    return;
+  }
+  const fd = openSync(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+  try {
+    const st = fstatSync(fd);
+    if (!st.isDirectory() || st.uid !== process.getuid() || (st.mode & 18) !== 0) {
+      throw new Error(
+        `Puddle home must be owned by the current user and not writable by other users: ${path}`
+      );
+    }
+    if ((st.mode & 63) !== 0) fchmodSync(fd, 448);
+  } finally {
+    closeSync(fd);
+  }
+  privatePath(path, true);
+}
 function atomicPrivateJson(path, value) {
   privateDirectory(dirname2(path));
   const tmp = `${path}.${secret()}.tmp`;
@@ -20778,7 +20816,7 @@ function readPrivateJson(path) {
   return JSON.parse(readFileSync2(path, "utf8"));
 }
 function ipcPath(home, scope) {
-  privateDirectory(home);
+  initialisePrivateHome(home);
   const key = digest(`${realpathSync(home)}\0${scope}`).slice(0, 24);
   if (process.platform === "win32") return `\\\\.\\pipe\\puddle-${key}`;
   const dir = join2("/tmp", `puddle-${process.getuid()}-${key}`);
@@ -20791,14 +20829,14 @@ async function listenPrivate(path, onConnection) {
       privatePath(path);
       const before = lstatSync(path);
       if (!before.isSocket()) throw new Error("Puddle control path is not a socket");
-      const stale = await new Promise((resolve4, reject) => {
+      const stale = await new Promise((resolve5, reject) => {
         const probe = connect(path);
         probe.once("connect", () => {
           probe.destroy();
-          resolve4(false);
+          resolve5(false);
         });
         probe.once("error", (err) => {
-          if (err.code === "ECONNREFUSED" || err.code === "ENOENT") resolve4(true);
+          if (err.code === "ECONNREFUSED" || err.code === "ENOENT") resolve5(true);
           else reject(err);
         });
       });
@@ -20811,11 +20849,11 @@ async function listenPrivate(path, onConnection) {
     }
   }
   const server = createServer(onConnection);
-  await new Promise((resolve4, reject) => {
+  await new Promise((resolve5, reject) => {
     server.once("error", reject);
     server.listen(path, () => {
       server.off("error", reject);
-      resolve4();
+      resolve5();
     });
   });
   if (process.platform !== "win32") chmodSync(path, 384);
@@ -20929,7 +20967,7 @@ var HostControlClient = class {
       }
       this.channel = channel;
       this.until = performance.now() + CONNECTION_POLICY.leaseMs;
-      await new Promise((resolve4, reject) => {
+      await new Promise((resolve5, reject) => {
         let pendingAt = null;
         let initial = true;
         const send = (message, sentAt = performance.now()) => {
@@ -20982,7 +21020,7 @@ var HostControlClient = class {
                 if (this.channel !== channel) return;
                 this.status = "ready";
                 this.emit();
-                resolve4();
+                resolve5();
               }).catch(() => channel.destroy());
             }
           },
@@ -21103,7 +21141,7 @@ async function inspectHostLocally(home) {
   }
   const socket = connect2(path);
   try {
-    const grant = await new Promise((resolve4, reject) => {
+    const grant = await new Promise((resolve5, reject) => {
       socket.setTimeout(5e3, () => socket.destroy(new Error("Host inspection timed out")));
       socket.once("error", reject);
       socket.once("close", () => reject(new Error("Host control closed")));
@@ -21113,7 +21151,7 @@ async function inspectHostLocally(home) {
           const message = controlResponseSchema.parse(value);
           if (message.t !== "authority" || !message.token)
             throw new Error("Host authority unavailable");
-          resolve4(message);
+          resolve5(message);
         },
         () => socket.destroy(new Error("Invalid host control response"))
       );
@@ -21254,12 +21292,12 @@ import {
   renameSync as renameSync2,
   writeFileSync as writeFileSync2
 } from "node:fs";
-import { dirname as dirname6, join as join7, resolve } from "node:path";
+import { dirname as dirname6, join as join7, resolve as resolve2 } from "node:path";
 
 // src/lib/desktop-update.ts
 import { createHash as createHash2 } from "node:crypto";
 import { spawn as spawn4 } from "node:child_process";
-import { constants, createReadStream, createWriteStream } from "node:fs";
+import { constants as constants2, createReadStream, createWriteStream } from "node:fs";
 import { access, chmod, mkdir, readdir, rm, writeFile } from "node:fs/promises";
 import { dirname as dirname5, join as join6 } from "node:path";
 import { Readable } from "node:stream";
@@ -21271,7 +21309,7 @@ import { readFileSync as readFileSync4 } from "node:fs";
 import { dirname as dirname4, join as join5 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function cliVersion() {
-  if (true) return "0.2.0";
+  if (true) return "0.2.2";
   const here = dirname4(fileURLToPath2(import.meta.url));
   for (const candidate of [
     join5(here, "..", "..", "package.json"),
@@ -21539,7 +21577,7 @@ async function desktopAppInstallPath(opts = {}) {
   const systemApplications = opts.systemApplicationsDir ?? "/Applications";
   const canWrite = opts.canWrite ?? (async (path) => {
     try {
-      await access(path, constants.W_OK);
+      await access(path, constants2.W_OK);
       return true;
     } catch {
       return false;
@@ -21551,12 +21589,12 @@ async function desktopAppInstallPath(opts = {}) {
   return join6(userApplications, "Puddle.app");
 }
 function isDesktopAppRunning(appPath) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const child = spawn4("/usr/bin/pgrep", ["-f", `${appPath}/Contents/MacOS/`], {
       stdio: "ignore"
     });
-    child.on("error", () => resolve4(false));
-    child.on("exit", (code) => resolve4(code === 0));
+    child.on("error", () => resolve5(false));
+    child.on("exit", (code) => resolve5(code === 0));
   });
 }
 function fileSha256(path) {
@@ -21564,12 +21602,12 @@ function fileSha256(path) {
   return pipeline(createReadStream(path), hash2).then(() => hash2.digest("hex"));
 }
 function run(command, args) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const child = spawn4(command, args, { stdio: "ignore" });
     child.on("error", reject);
     child.on(
       "exit",
-      (code) => code === 0 ? resolve4() : reject(new CliError("not_installed", `${command} exited with ${code ?? "signal"}`))
+      (code) => code === 0 ? resolve5() : reject(new CliError("not_installed", `${command} exited with ${code ?? "signal"}`))
     );
   });
 }
@@ -21644,7 +21682,9 @@ var RELEASE_PROTOCOLS = {
   "0.1.11": { major: 17, minor: 3 },
   "0.1.12": { major: 17, minor: 3 },
   "0.1.13": { major: 17, minor: 3 },
-  "0.2.0": { major: 19, minor: 0 }
+  "0.2.0": { major: 19, minor: 0 },
+  "0.2.1": { major: 19, minor: 0 },
+  "0.2.2": { major: 20, minor: 0 }
 };
 function validProtocol(value) {
   if (typeof value !== "object" || value === null) return false;
@@ -21732,7 +21772,7 @@ async function installedComponentVersions(opts = {}) {
       };
     }
   }
-  const legacyLinuxPath = resolve(home, "..", "puddle", "Puddle.AppImage");
+  const legacyLinuxPath = resolve2(home, "..", "puddle", "Puddle.AppImage");
   const legacyLinuxDesktop = desktopInstallation === null && (opts.platform ?? process.platform) === "linux" && existsSync2(legacyLinuxPath);
   const desktopProtocol = desktopInstallation?.protocol ?? (desktopInstallation ? componentProtocolForVersion(desktopInstallation.version) : void 0);
   const desktop = desktopInstallation !== null ? {
@@ -21761,7 +21801,7 @@ import { randomUUID } from "node:crypto";
 
 // src/lib/bootstrap.ts
 import { existsSync as existsSync3, readFileSync as readFileSync6 } from "node:fs";
-import { dirname as dirname7, join as join8, resolve as resolve2 } from "node:path";
+import { dirname as dirname7, join as join8, resolve as resolve3 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 init_types();
 async function installedVersion(transport) {
@@ -21780,9 +21820,9 @@ async function installDaemon(transport, opts = {}) {
       throw new CliError("not_installed", `tarball not found: ${opts.tarball}`);
     }
     if (transport.kind === "local") {
-      args.push("--tarball", resolve2(opts.tarball));
+      args.push("--tarball", resolve3(opts.tarball));
       const localSums = `${opts.tarball}.sha256`;
-      if (existsSync3(localSums)) args.push("--sums", resolve2(localSums));
+      if (existsSync3(localSums)) args.push("--sums", resolve3(localSums));
     } else {
       const base = opts.tarball.split("/").pop() ?? "puddled.tar.gz";
       const destTarball = `.puddle/cache/${base}`;
@@ -21847,22 +21887,22 @@ function readInstallScript() {
 // src/lib/net.ts
 import { connect as connect4, createServer as createServer2 } from "node:net";
 function findFreePort() {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const srv = createServer2();
     srv.once("error", reject);
     srv.listen(0, "127.0.0.1", () => {
       const address = srv.address();
       const port = typeof address === "object" && address !== null ? address.port : 0;
-      srv.close(() => resolve4(port));
+      srv.close(() => resolve5(port));
     });
   });
 }
 function tcpListening(port, timeoutMs = 500) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const sock = connect4({ host: "127.0.0.1", port });
     const done = (ok) => {
       sock.destroy();
-      resolve4(ok);
+      resolve5(ok);
     };
     sock.setTimeout(timeoutMs, () => done(false));
     sock.once("connect", () => done(true));
@@ -22311,7 +22351,7 @@ async function startLauncher(home, identity, invite) {
     path,
     close: async () => {
       for (const socket of sockets) socket.destroy();
-      await new Promise((resolve4) => server.close(() => resolve4()));
+      await new Promise((resolve5) => server.close(() => resolve5()));
     }
   };
 }
@@ -22321,14 +22361,14 @@ async function requestInvitation(home, path) {
     const stored = readPrivateJson(secretFile(home, path));
     pipeSecret = stored.secret;
   } else privatePath(path);
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const socket = connect5(path);
     socket.setTimeout(5e3, () => socket.destroy(new Error("Launcher did not answer")));
     jsonLines(
       socket,
       (value) => {
         const message = launcherResponseSchema.parse(value);
-        resolve4(message.url);
+        resolve5(message.url);
         socket.end();
       },
       () => socket.destroy(new Error("Invalid launcher reply"))
@@ -22548,7 +22588,7 @@ function writeStore(file2, store) {
   renameSync3(tmp, file2);
 }
 function readBody(req) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     let size = 0;
     const chunks = [];
     req.on("data", (chunk) => {
@@ -22560,7 +22600,7 @@ function readBody(req) {
       }
       chunks.push(chunk);
     });
-    req.on("end", () => resolve4(Buffer.concat(chunks).toString("utf8")));
+    req.on("end", () => resolve5(Buffer.concat(chunks).toString("utf8")));
     req.on("error", reject);
   });
 }
@@ -22598,7 +22638,7 @@ function handleLocalSync(req, res, opts, authorised) {
 
 // src/lib/serve/static.ts
 import { createReadStream as createReadStream2, existsSync as existsSync4, statSync } from "node:fs";
-import { extname, join as join11, normalize, resolve as resolve3, sep } from "node:path";
+import { extname, join as join11, normalize, resolve as resolve4, sep } from "node:path";
 var MIME = {
   ".html": "text/html; charset=utf-8",
   ".js": "text/javascript; charset=utf-8",
@@ -22613,7 +22653,7 @@ var MIME = {
   ".map": "application/json"
 };
 function createStaticHandler(rootDir) {
-  const root = resolve3(rootDir);
+  const root = resolve4(rootDir);
   return (req, res) => {
     if (req.method !== "GET" && req.method !== "HEAD") {
       res.writeHead(405, { allow: "GET, HEAD" }).end();
@@ -23103,6 +23143,41 @@ function remoteAccessHandler(control) {
   };
 }
 
+// src/lib/serve/remote-registration.ts
+async function checkRemoteRegistration(req, res, authorised) {
+  if (req.method !== "POST") return fail(res, 405, "method_not_allowed");
+  const { service, code } = cockpitRegistrationCheckSchema.parse(await readJson(req));
+  if (!authorised()) return fail(res, 401, "browser_rejected");
+  try {
+    const response = await fetch(`${service}/remote/registration-status`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ code }),
+      redirect: "error",
+      signal: AbortSignal.timeout(5e3)
+    });
+    if (!response.ok) {
+      await response.body?.cancel();
+      throw new Error("Service unavailable");
+    }
+    let body = "";
+    for await (const chunk of response.body ?? []) {
+      body += Buffer.from(chunk).toString("utf8");
+      if (body.length > 1024) throw new Error("Response too large");
+    }
+    const status = registrationStatusSchema.parse(JSON.parse(body));
+    if (!authorised()) return fail(res, 401, "browser_rejected");
+    json2(res, 200, status);
+  } catch {
+    fail(
+      res,
+      503,
+      "registration_unavailable",
+      "Could not check browser sign-in. Check the relay address and update the deployed service, then try again."
+    );
+  }
+}
+
 // src/lib/serve/ui-server.ts
 var DEFAULT_UI_PORT = 7433;
 var MAX_PORT_PROBES = 50;
@@ -23162,6 +23237,10 @@ async function startUiServer(opts) {
         return handleLocalSync(req, res, opts.localSync, () => browsers.valid(browser));
       if (url2.pathname === "/cockpit/remote")
         return handleRemoteAccess(req, res, () => browsers.valid(browser));
+      if (url2.pathname === "/cockpit/remote/registration") {
+        if (!opts.remoteAccess) return fail(res, 404, "remote_controls_unavailable");
+        return checkRemoteRegistration(req, res, () => browsers.valid(browser));
+      }
       if (url2.pathname === "/cockpit/refresh" && req.method === "POST") {
         if (!opts.control) return fail(res, 404, "refresh_unavailable");
         const body = cockpitRefreshRequestSchema.parse(await readJson(req));
@@ -23246,8 +23325,8 @@ async function startUiServer(opts) {
       browsers.close();
       bridge.close();
       tracker.destroyAll();
-      await new Promise((resolve4) => {
-        server.close(() => resolve4());
+      await new Promise((resolve5) => {
+        server.close(() => resolve5());
         server.closeAllConnections();
       });
     }
@@ -23257,15 +23336,15 @@ async function listen(server, startPort, strict, avoidPort) {
   for (let probe = 0; probe < MAX_PORT_PROBES; probe += 1) {
     const port = startPort + probe;
     if (!strict && port === avoidPort) continue;
-    const ok = await new Promise((resolve4, rejectListen) => {
+    const ok = await new Promise((resolve5, rejectListen) => {
       const onError = (err) => {
         server.off("listening", onListening);
-        if (err.code === "EADDRINUSE") resolve4(false);
+        if (err.code === "EADDRINUSE") resolve5(false);
         else rejectListen(err);
       };
       const onListening = () => {
         server.off("error", onError);
-        resolve4(true);
+        resolve5(true);
       };
       server.once("error", onError);
       server.once("listening", onListening);
@@ -23292,21 +23371,24 @@ var RemoteAccessControl = class {
   constructor(transport) {
     this.transport = transport;
   }
-  async availability() {
+  async capabilities() {
     const result = await this.transport.exec(
       `if test -f ${hostPaths.current}/daemon/connector.mjs; then ${binary} --version; else exit 44; fi`,
       { timeoutMs: 1e4 }
     );
-    if (result.code === 44) return "not_installed";
+    if (result.code === 44) return { availability: "not_installed", canDeleteRegistration: false };
     if (result.code !== 0)
       throw new Error("Host control is unavailable. Check the host connection.");
-    return result.stdout.includes("cockpit controls 1") ? "ready" : "upgrade_required";
+    return {
+      availability: result.stdout.includes("cockpit controls 1") ? "ready" : "upgrade_required",
+      canDeleteRegistration: result.stdout.includes("delete registration 1")
+    };
   }
   async status() {
-    const availability = await this.availability();
-    if (availability !== "ready")
+    const capabilities = await this.capabilities();
+    if (capabilities.availability !== "ready")
       return {
-        availability,
+        ...capabilities,
         configured: false,
         enabled: false,
         connected: false,
@@ -23315,12 +23397,15 @@ var RemoteAccessControl = class {
       };
     const result = await this.transport.exec(`${binary} --inspect`, { timeoutMs: 1e4 });
     if (result.code !== 0) throw new Error("Could not read remote access status on this host.");
-    return cockpitRemoteStatusSchema.parse(JSON.parse(result.stdout));
+    return cockpitRemoteStatusSchema.parse({ ...JSON.parse(result.stdout), ...capabilities });
   }
   async request(value, authorised) {
     const request = cockpitRemoteRequestSchema.parse(value);
-    if (await this.availability() !== "ready")
+    const capabilities = await this.capabilities();
+    if (capabilities.availability !== "ready")
       throw new Error("Upgrade the daemon on this host to manage remote access here.");
+    if (request.t === "delete_registration" && !capabilities.canDeleteRegistration)
+      throw new Error("Upgrade the daemon on this host to delete its remote registration.");
     if (!authorised()) throw new Error("Browser authorisation expired before dispatch.");
     const flag = request.t === "enable" ? "--configure" : request.t === "reset" ? "--reset" : "--admin";
     const payload = request.t === "enable" ? { ...request.registration, managed: true } : request;
@@ -24182,7 +24267,7 @@ async function ask(question, def) {
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
   try {
     const answer = await new Promise(
-      (resolve4) => rl.question(`${question} [${def}] `, resolve4)
+      (resolve5) => rl.question(`${question} [${def}] `, resolve5)
     );
     return answer.trim() === "" ? def : answer.trim();
   } finally {
@@ -24201,7 +24286,7 @@ async function confirm(question, opts = {}) {
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
   try {
     const answer = await new Promise(
-      (resolve4) => rl.question(`${question} [y/N] `, resolve4)
+      (resolve5) => rl.question(`${question} [y/N] `, resolve5)
     );
     return /^y(es)?$/i.test(answer.trim());
   } finally {
@@ -24320,7 +24405,7 @@ async function runUpgrade(cmd, logger) {
 function upgradeCli(version2, logger) {
   const spec = `@puddle-code/cli@${version2 ?? "latest"}`;
   logger.info(`puddle CLI ${cliVersion()} \u2014 asking npm for ${version2 ?? "the latest release"}`);
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const child = spawn7("npm", ["install", "-g", spec], { stdio: "inherit" });
     child.on(
       "error",
@@ -24335,7 +24420,7 @@ function upgradeCli(version2, logger) {
     child.on("exit", (code) => {
       if (code === 0) {
         logger.info("done \u2014 `puddle --version` shows the installed version");
-        resolve4(0);
+        resolve5(0);
       } else {
         reject(new CliError("not_installed", `npm install exited with ${code ?? "a signal"}`));
       }
@@ -24458,10 +24543,10 @@ async function runRemove(cmd, logger) {
   }
 }
 async function removeCli(yes, logger) {
-  const managed = await new Promise((resolve4) => {
+  const managed = await new Promise((resolve5) => {
     const child = spawn7("npm", ["ls", "-g", "@puddle-code/cli", "--depth=0"], { stdio: "ignore" });
-    child.on("error", () => resolve4(false));
-    child.on("exit", (code) => resolve4(code === 0));
+    child.on("error", () => resolve5(false));
+    child.on("exit", (code) => resolve5(code === 0));
   });
   if (!managed) {
     throw new CliError(
@@ -24478,13 +24563,13 @@ async function removeCli(yes, logger) {
     logger.info("nothing removed");
     return 0;
   }
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const child = spawn7("npm", ["uninstall", "-g", "@puddle-code/cli"], { stdio: "inherit" });
     child.on("error", () => reject(new CliError("not_installed", "npm is not on PATH")));
     child.on("exit", (code) => {
       if (code === 0) {
         logger.info("removed \u2014 daemons keep running (puddle remove daemon uninstalls one)");
-        resolve4(0);
+        resolve5(0);
       } else {
         reject(new CliError("not_installed", `npm uninstall exited with ${code ?? "a signal"}`));
       }
@@ -24673,7 +24758,7 @@ async function openTarget(host) {
   };
 }
 function runUntilInterrupted(stop, farewell) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let stopping = false;
     process.on("SIGINT", () => {
       if (stopping) process.exit(130);
@@ -24681,10 +24766,10 @@ function runUntilInterrupted(stop, farewell) {
       process.stderr.write(`
 ${farewell}
 `);
-      void stop().then(resolve4);
+      void stop().then(resolve5);
     });
     process.on("SIGTERM", () => {
-      void stop().then(resolve4);
+      void stop().then(resolve5);
     });
   });
 }