@puddle-code/cli 0.2.6 → 0.2.8

package/CHANGELOG.md

@@ -1,14 +1,22 @@
 <!--
-Rolling changelog for the NEXT release. Governance lives in CLAUDE.md §"Changelog discipline".
-On publish: retitle [Unreleased] to [X.Y.Z] — date, archive a copy to
-docs/changelogs/CHANGELOG-vX.Y.Z.md, then reset this file to this template.
-Past releases: see docs/changelogs/.
+Archived release changelog. Governance lives in CLAUDE.md §"Changelog discipline".
 -->
 
 # Changelog
 
-## [0.2.6] — 2026-09-23
+## [0.2.8] — 2026-09-24
+
+### Added
+
+- Register each host profile independently with a remote account, with separate browser approvals, identities and controls; restrict remote discovery, session operations and terminal events to that profile.
+- Show the bundled connector’s remote protocol as a `-cN` suffix on the daemon line in `puddle --version`, using offline metadata without changing compatibility comparisons.
+
+### Changed
+
+- Require `--profile <profile-id>` for remote CLI administration; keep `remote run` as the supervisor for all registrations.
+- Advance daemon/cockpit protocol to 22.0 and remote protocol to 3 for profile-scoped authority; delete legacy host-wide registrations and revoke their approvals on connector startup, retrying relay removal when offline.
+- Switch to Files and reveal the file when clicking a filename in Search; keep per-line results in Search.
 
 ### Fixed
 
-- Fix standalone CLI distribution checks on Linux and macOS by retaining gzip on the isolated PATH and invoking system utilities at their original paths.
+- Leave 2.5 rows of blank space below file trees so the directory context menu remains accessible in long lists.

package/README.md

@@ -56,7 +56,7 @@ This connects Puddle to the remote host over SSH, bootstrapping the Puddle daemo
 
 **To connect from a phone or another browser over the internet:** deploy your own
 [mobile access service and trusted web application](docs/mobile-access.md), then
-use `puddle remote enable` and `puddle remote pair`. The host connects outward;
+use `puddle remote enable --profile <profile-id>` and `puddle remote pair --profile <profile-id>`. Each profile registers independently. The host connects outward;
 there is no public daemon port or VPN requirement. Each browser needs explicit
 host approval. The phone view provides live terminals, prompt input and read-only
 text/diff review over a pinned Noise connection through the relay.

package/dist/host-control.mjs

@@ -14834,6 +14834,7 @@ var agentTypeSchema = external_exports.object({
 var repoSchema = external_exports.object({
   id: rowId,
   path: external_exports.string(),
+  /** Empty follows the branch currently checked out at path, resolved for each new session. */
   default_base_branch: external_exports.string(),
   onboarding_notes: external_exports.string().nullable(),
   fetch_enabled: external_exports.boolean(),
@@ -14844,7 +14845,8 @@ var repoWithOrphansSchema = repoSchema.extend({
 });
 var createRepoRequestSchema = external_exports.object({
   path: external_exports.string().min(1),
-  default_base_branch: external_exports.string().min(1).optional(),
+  /** Empty follows the clone's current branch; omitted snapshots it at registration. */
+  default_base_branch: external_exports.string().optional(),
   onboarding_notes: external_exports.string().nullable().optional(),
   fetch_enabled: external_exports.boolean().optional()
 });
@@ -14885,7 +14887,8 @@ var repoWorktreesResponseSchema = external_exports.object({
   orphan_branches: external_exports.array(orphanBranchSchema)
 });
 var patchRepoRequestSchema = external_exports.object({
-  default_base_branch: external_exports.string().min(1).optional(),
+  /** Empty follows the clone's current branch; omitted leaves the setting unchanged. */
+  default_base_branch: external_exports.string().optional(),
   onboarding_notes: external_exports.string().nullable().optional(),
   fetch_enabled: external_exports.boolean().optional()
 });
@@ -15772,7 +15775,7 @@ var wsServerMessageSchema = external_exports.discriminatedUnion("t", [
 ]);
 
 // ../shared/src/remote/protocol.ts
-var REMOTE_PROTOCOL_VERSION = 2;
+var REMOTE_PROTOCOL_VERSION = 3;
 var REMOTE_POLICY = {
   chunkBytes: 32 * 1024,
   frameBytes: 48 * 1024,
@@ -15893,6 +15896,65 @@ var remoteChunkSchema = external_exports.object({
   data: external_exports.string().max(REMOTE_POLICY.chunkBytes)
 }).strict();
 
+// ../shared/src/remote/service.ts
+var remoteHostSchema = external_exports.object({
+  id: remoteIdSchema,
+  label: remoteLabelSchema,
+  online: external_exports.boolean()
+});
+var remoteHostsSchema = external_exports.array(remoteHostSchema);
+var remoteServiceInfoSchema = external_exports.object({
+  providers: external_exports.array(external_exports.enum(["google", "github"])),
+  protocol: external_exports.literal(REMOTE_PROTOCOL_VERSION)
+});
+var remoteLoginStateSchema = external_exports.object({
+  user: external_exports.object({
+    id: remoteAccountSchema,
+    name: external_exports.string(),
+    email: external_exports.string(),
+    emailVerified: external_exports.boolean(),
+    twoFactorEnabled: external_exports.boolean()
+  }).nullable(),
+  mfaRequired: external_exports.boolean()
+});
+var registerHostRequestSchema = external_exports.object({ label: remoteLabelSchema }).strict();
+var registrationResponseSchema = external_exports.object({ host: remoteIdSchema, code: remoteSecretSchema, expires: external_exports.number() }).strict();
+var redeemRegistrationSchema = external_exports.object({ code: remoteSecretSchema }).strict();
+var unregisterHostRequestSchema = external_exports.object({ credential: remoteSecretSchema }).strict();
+var desktopRegistrationSchema = external_exports.object({
+  challenge: remoteSecretSchema,
+  label: remoteLabelSchema,
+  service: remoteOriginSchema,
+  app: remoteOriginSchema,
+  expires: external_exports.number().int().positive()
+}).strict();
+var registrationStatusSchema = external_exports.object({ ready: external_exports.boolean() }).strict();
+var connectorRegistrationSchema = external_exports.object({
+  host: remoteIdSchema,
+  account: remoteAccountSchema,
+  credential: remoteSecretSchema
+}).strict();
+var connectorConfigSchema = connectorRegistrationSchema.extend({
+  service: remoteOriginSchema,
+  app: remoteOriginSchema,
+  enabled: external_exports.boolean()
+}).strict();
+var connectorSetupSchema = external_exports.object({
+  service: remoteOriginSchema.optional(),
+  app: remoteOriginSchema.optional(),
+  code: remoteSecretSchema.optional(),
+  managed: external_exports.boolean().default(true)
+}).strict();
+var remoteIdentitySchema = external_exports.array(external_exports.number().int().min(0).max(255)).min(32).max(256);
+var remoteBrowserHostSchema = external_exports.object({
+  host: remoteIdSchema,
+  peer: remotePeerSchema,
+  account: remoteAccountSchema,
+  service: remoteOriginSchema,
+  label: external_exports.string(),
+  privateKey: remoteIdentitySchema
+}).strict();
+
 // ../shared/src/api/cockpit-remote.ts
 var connectorLocalRequestSchema = external_exports.union([
   remoteAdminRequestSchema,
@@ -15920,6 +15982,9 @@ var cockpitRemoteStatusSchema = external_exports.object({
   app: remoteOriginSchema.optional(),
   devices: external_exports.array(remoteDeviceSchema)
 });
+var connectorProfileSchema = external_exports.object({ profile: profileId }).strict();
+var connectorAdminSchema = external_exports.object({ profile: profileId, request: connectorLocalRequestSchema }).strict();
+var connectorConfigureSchema = external_exports.object({ profile: profileId, setup: connectorSetupSchema }).strict();
 
 // ../shared/src/api/connection-auth.ts
 var CONNECTION_POLICY = {
@@ -15942,7 +16007,7 @@ var authErrorCodeSchema = external_exports.enum([
   "protocol_mismatch"
 ]);
 var controlRequestSchema = external_exports.discriminatedUnion("t", [
-  external_exports.object({ t: external_exports.literal("open") }).strict(),
+  external_exports.object({ t: external_exports.literal("open"), profile: profileId.optional() }).strict(),
   external_exports.object({ t: external_exports.literal("renew"), resources: external_exports.array(resourceIdSchema).max(2048) }).strict(),
   external_exports.object({ t: external_exports.literal("close") }).strict()
 ]);
@@ -16031,65 +16096,6 @@ var imageUploadProgressSchema = external_exports.object({
   received: external_exports.number().int().nonnegative().max(IMAGE_UPLOAD_POLICY.imageBytes)
 });
 
-// ../shared/src/remote/service.ts
-var remoteHostSchema = external_exports.object({
-  id: remoteIdSchema,
-  label: remoteLabelSchema,
-  online: external_exports.boolean()
-});
-var remoteHostsSchema = external_exports.array(remoteHostSchema);
-var remoteServiceInfoSchema = external_exports.object({
-  providers: external_exports.array(external_exports.enum(["google", "github"])),
-  protocol: external_exports.literal(REMOTE_PROTOCOL_VERSION)
-});
-var remoteLoginStateSchema = external_exports.object({
-  user: external_exports.object({
-    id: remoteAccountSchema,
-    name: external_exports.string(),
-    email: external_exports.string(),
-    emailVerified: external_exports.boolean(),
-    twoFactorEnabled: external_exports.boolean()
-  }).nullable(),
-  mfaRequired: external_exports.boolean()
-});
-var registerHostRequestSchema = external_exports.object({ label: remoteLabelSchema }).strict();
-var registrationResponseSchema = external_exports.object({ host: remoteIdSchema, code: remoteSecretSchema, expires: external_exports.number() }).strict();
-var redeemRegistrationSchema = external_exports.object({ code: remoteSecretSchema }).strict();
-var unregisterHostRequestSchema = external_exports.object({ credential: remoteSecretSchema }).strict();
-var desktopRegistrationSchema = external_exports.object({
-  challenge: remoteSecretSchema,
-  label: remoteLabelSchema,
-  service: remoteOriginSchema,
-  app: remoteOriginSchema,
-  expires: external_exports.number().int().positive()
-}).strict();
-var registrationStatusSchema = external_exports.object({ ready: external_exports.boolean() }).strict();
-var connectorRegistrationSchema = external_exports.object({
-  host: remoteIdSchema,
-  account: remoteAccountSchema,
-  credential: remoteSecretSchema
-}).strict();
-var connectorConfigSchema = connectorRegistrationSchema.extend({
-  service: remoteOriginSchema,
-  app: remoteOriginSchema,
-  enabled: external_exports.boolean()
-}).strict();
-var connectorSetupSchema = external_exports.object({
-  service: remoteOriginSchema.optional(),
-  app: remoteOriginSchema.optional(),
-  code: remoteSecretSchema.optional(),
-  managed: external_exports.boolean().default(true)
-}).strict();
-var remoteIdentitySchema = external_exports.array(external_exports.number().int().min(0).max(255)).min(32).max(256);
-var remoteBrowserHostSchema = external_exports.object({
-  host: remoteIdSchema,
-  peer: remotePeerSchema,
-  account: remoteAccountSchema,
-  service: remoteOriginSchema,
-  label: external_exports.string(),
-  privateKey: remoteIdentitySchema
-}).strict();
-
 // ../shared/src/node/security.ts
 import { createHash, randomBytes } from "node:crypto";
 import {

package/dist/index.js

@@ -3925,7 +3925,7 @@ import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
 
 // ../shared/src/protocol.ts
-var PROTOCOL_VERSION = { major: 21, minor: 2 };
+var PROTOCOL_VERSION = { major: 22, minor: 0 };
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -18754,6 +18754,7 @@ var agentTypeSchema = external_exports.object({
 var repoSchema = external_exports.object({
   id: rowId,
   path: external_exports.string(),
+  /** Empty follows the branch currently checked out at path, resolved for each new session. */
   default_base_branch: external_exports.string(),
   onboarding_notes: external_exports.string().nullable(),
   fetch_enabled: external_exports.boolean(),
@@ -18764,7 +18765,8 @@ var repoWithOrphansSchema = repoSchema.extend({
 });
 var createRepoRequestSchema = external_exports.object({
   path: external_exports.string().min(1),
-  default_base_branch: external_exports.string().min(1).optional(),
+  /** Empty follows the clone's current branch; omitted snapshots it at registration. */
+  default_base_branch: external_exports.string().optional(),
   onboarding_notes: external_exports.string().nullable().optional(),
   fetch_enabled: external_exports.boolean().optional()
 });
@@ -18805,7 +18807,8 @@ var repoWorktreesResponseSchema = external_exports.object({
   orphan_branches: external_exports.array(orphanBranchSchema)
 });
 var patchRepoRequestSchema = external_exports.object({
-  default_base_branch: external_exports.string().min(1).optional(),
+  /** Empty follows the clone's current branch; omitted leaves the setting unchanged. */
+  default_base_branch: external_exports.string().optional(),
   onboarding_notes: external_exports.string().nullable().optional(),
   fetch_enabled: external_exports.boolean().optional()
 });
@@ -19692,7 +19695,7 @@ var wsServerMessageSchema = external_exports.discriminatedUnion("t", [
 ]);
 
 // ../shared/src/remote/protocol.ts
-var REMOTE_PROTOCOL_VERSION = 2;
+var REMOTE_PROTOCOL_VERSION = 3;
 var REMOTE_POLICY = {
   chunkBytes: 32 * 1024,
   frameBytes: 48 * 1024,
@@ -19813,6 +19816,65 @@ var remoteChunkSchema = external_exports.object({
   data: external_exports.string().max(REMOTE_POLICY.chunkBytes)
 }).strict();
 
+// ../shared/src/remote/service.ts
+var remoteHostSchema = external_exports.object({
+  id: remoteIdSchema,
+  label: remoteLabelSchema,
+  online: external_exports.boolean()
+});
+var remoteHostsSchema = external_exports.array(remoteHostSchema);
+var remoteServiceInfoSchema = external_exports.object({
+  providers: external_exports.array(external_exports.enum(["google", "github"])),
+  protocol: external_exports.literal(REMOTE_PROTOCOL_VERSION)
+});
+var remoteLoginStateSchema = external_exports.object({
+  user: external_exports.object({
+    id: remoteAccountSchema,
+    name: external_exports.string(),
+    email: external_exports.string(),
+    emailVerified: external_exports.boolean(),
+    twoFactorEnabled: external_exports.boolean()
+  }).nullable(),
+  mfaRequired: external_exports.boolean()
+});
+var registerHostRequestSchema = external_exports.object({ label: remoteLabelSchema }).strict();
+var registrationResponseSchema = external_exports.object({ host: remoteIdSchema, code: remoteSecretSchema, expires: external_exports.number() }).strict();
+var redeemRegistrationSchema = external_exports.object({ code: remoteSecretSchema }).strict();
+var unregisterHostRequestSchema = external_exports.object({ credential: remoteSecretSchema }).strict();
+var desktopRegistrationSchema = external_exports.object({
+  challenge: remoteSecretSchema,
+  label: remoteLabelSchema,
+  service: remoteOriginSchema,
+  app: remoteOriginSchema,
+  expires: external_exports.number().int().positive()
+}).strict();
+var registrationStatusSchema = external_exports.object({ ready: external_exports.boolean() }).strict();
+var connectorRegistrationSchema = external_exports.object({
+  host: remoteIdSchema,
+  account: remoteAccountSchema,
+  credential: remoteSecretSchema
+}).strict();
+var connectorConfigSchema = connectorRegistrationSchema.extend({
+  service: remoteOriginSchema,
+  app: remoteOriginSchema,
+  enabled: external_exports.boolean()
+}).strict();
+var connectorSetupSchema = external_exports.object({
+  service: remoteOriginSchema.optional(),
+  app: remoteOriginSchema.optional(),
+  code: remoteSecretSchema.optional(),
+  managed: external_exports.boolean().default(true)
+}).strict();
+var remoteIdentitySchema = external_exports.array(external_exports.number().int().min(0).max(255)).min(32).max(256);
+var remoteBrowserHostSchema = external_exports.object({
+  host: remoteIdSchema,
+  peer: remotePeerSchema,
+  account: remoteAccountSchema,
+  service: remoteOriginSchema,
+  label: external_exports.string(),
+  privateKey: remoteIdentitySchema
+}).strict();
+
 // ../shared/src/api/cockpit-remote.ts
 var connectorLocalRequestSchema = external_exports.union([
   remoteAdminRequestSchema,
@@ -19840,6 +19902,9 @@ var cockpitRemoteStatusSchema = external_exports.object({
   app: remoteOriginSchema.optional(),
   devices: external_exports.array(remoteDeviceSchema)
 });
+var connectorProfileSchema = external_exports.object({ profile: profileId }).strict();
+var connectorAdminSchema = external_exports.object({ profile: profileId, request: connectorLocalRequestSchema }).strict();
+var connectorConfigureSchema = external_exports.object({ profile: profileId, setup: connectorSetupSchema }).strict();
 
 // ../shared/src/api/connection-auth.ts
 var CONNECTION_POLICY = {
@@ -19862,7 +19927,7 @@ var authErrorCodeSchema = external_exports.enum([
   "protocol_mismatch"
 ]);
 var controlRequestSchema = external_exports.discriminatedUnion("t", [
-  external_exports.object({ t: external_exports.literal("open") }).strict(),
+  external_exports.object({ t: external_exports.literal("open"), profile: profileId.optional() }).strict(),
   external_exports.object({ t: external_exports.literal("renew"), resources: external_exports.array(resourceIdSchema).max(2048) }).strict(),
   external_exports.object({ t: external_exports.literal("close") }).strict()
 ]);
@@ -19951,65 +20016,6 @@ var imageUploadProgressSchema = external_exports.object({
   received: external_exports.number().int().nonnegative().max(IMAGE_UPLOAD_POLICY.imageBytes)
 });
 
-// ../shared/src/remote/service.ts
-var remoteHostSchema = external_exports.object({
-  id: remoteIdSchema,
-  label: remoteLabelSchema,
-  online: external_exports.boolean()
-});
-var remoteHostsSchema = external_exports.array(remoteHostSchema);
-var remoteServiceInfoSchema = external_exports.object({
-  providers: external_exports.array(external_exports.enum(["google", "github"])),
-  protocol: external_exports.literal(REMOTE_PROTOCOL_VERSION)
-});
-var remoteLoginStateSchema = external_exports.object({
-  user: external_exports.object({
-    id: remoteAccountSchema,
-    name: external_exports.string(),
-    email: external_exports.string(),
-    emailVerified: external_exports.boolean(),
-    twoFactorEnabled: external_exports.boolean()
-  }).nullable(),
-  mfaRequired: external_exports.boolean()
-});
-var registerHostRequestSchema = external_exports.object({ label: remoteLabelSchema }).strict();
-var registrationResponseSchema = external_exports.object({ host: remoteIdSchema, code: remoteSecretSchema, expires: external_exports.number() }).strict();
-var redeemRegistrationSchema = external_exports.object({ code: remoteSecretSchema }).strict();
-var unregisterHostRequestSchema = external_exports.object({ credential: remoteSecretSchema }).strict();
-var desktopRegistrationSchema = external_exports.object({
-  challenge: remoteSecretSchema,
-  label: remoteLabelSchema,
-  service: remoteOriginSchema,
-  app: remoteOriginSchema,
-  expires: external_exports.number().int().positive()
-}).strict();
-var registrationStatusSchema = external_exports.object({ ready: external_exports.boolean() }).strict();
-var connectorRegistrationSchema = external_exports.object({
-  host: remoteIdSchema,
-  account: remoteAccountSchema,
-  credential: remoteSecretSchema
-}).strict();
-var connectorConfigSchema = connectorRegistrationSchema.extend({
-  service: remoteOriginSchema,
-  app: remoteOriginSchema,
-  enabled: external_exports.boolean()
-}).strict();
-var connectorSetupSchema = external_exports.object({
-  service: remoteOriginSchema.optional(),
-  app: remoteOriginSchema.optional(),
-  code: remoteSecretSchema.optional(),
-  managed: external_exports.boolean().default(true)
-}).strict();
-var remoteIdentitySchema = external_exports.array(external_exports.number().int().min(0).max(255)).min(32).max(256);
-var remoteBrowserHostSchema = external_exports.object({
-  host: remoteIdSchema,
-  peer: remotePeerSchema,
-  account: remoteAccountSchema,
-  service: remoteOriginSchema,
-  label: external_exports.string(),
-  privateKey: remoteIdentitySchema
-}).strict();
-
 // src/lib/transport/local.ts
 import { spawn } from "node:child_process";
 import { copyFileSync, mkdirSync, readFileSync } from "node:fs";
@@ -20338,7 +20344,12 @@ function parseRemoteArgs(args) {
   for (let i = 0; i < rest.length; i++) {
     const arg = rest[i];
     if (arg === "--foreground") command.foreground = true;
-    else if (arg === "--service" || arg === "--app-origin") {
+    else if (arg === "--profile") {
+      const parsed = profileId.safeParse(rest[++i]);
+      if (!parsed.success)
+        throw new CliError("bad_arguments", "--profile requires an exact profile id");
+      command.profile = parsed.data;
+    } else if (arg === "--service" || arg === "--app-origin") {
       const value = remoteOriginSchema.safeParse(rest[++i]);
       if (!value.success) throw new CliError("bad_arguments", `${arg} needs an exact HTTPS origin`);
       if (arg === "--service") command.service = value.data;
@@ -20363,6 +20374,10 @@ function parseRemoteArgs(args) {
     throw new CliError("bad_arguments", "Configuration options apply only to remote enable");
   if (!!command.service !== !!command.app)
     throw new CliError("bad_arguments", "Specify both --service and --app-origin");
+  if (action !== "run" && !command.profile)
+    throw new CliError("bad_arguments", "Select a profile with --profile <profile-id>");
+  if (action === "run" && command.profile)
+    throw new CliError("bad_arguments", "remote run supervises all registered profiles");
   return command;
 }
 async function registrationCode() {
@@ -20402,12 +20417,21 @@ async function runRemote(command) {
         "The installed daemon does not include mobile access",
         `puddle upgrade daemon${command.host ? ` ${command.host}` : ""}`
       );
+    const capabilities = await transport.exec(`${base} --version`, { timeoutMs: 1e4 });
+    if (capabilities.code !== 0 || !capabilities.stdout.includes("cockpit controls 2"))
+      throw new CliError(
+        "protocol_mismatch",
+        "Upgrade the host daemon before managing profile registrations."
+      );
     if (command.action === "run") {
       const result2 = await transport.exec(base, { onStdout: (text) => process.stdout.write(text) });
       return result2.code;
     }
     if (command.action === "reset") {
-      const result2 = await transport.exec(`${base} --reset`, { timeoutMs: 3e4 });
+      const result2 = await transport.exec(`${base} --reset`, {
+        timeoutMs: 3e4,
+        stdin: JSON.stringify({ profile: command.profile }) + "\n"
+      });
       if (result2.code !== 0)
         throw new CliError("bad_arguments", result2.stderr.trim() || "Reset failed");
       process.stdout.write(
@@ -20424,7 +20448,9 @@ async function runRemote(command) {
     const result = await transport.exec(
       `${base} ${command.action === "enable" ? "--configure" : "--admin"}`,
       {
-        stdin: JSON.stringify(payload) + "\n",
+        stdin: JSON.stringify(
+          command.action === "enable" ? { profile: command.profile, setup: payload } : { profile: command.profile, request: payload }
+        ) + "\n",
         timeoutMs: 3e4
       }
     );
@@ -20491,14 +20517,15 @@ usage:
   puddle install <daemon|desktop>[@version] [user@host] [--tarball <path>]
   puddle upgrade [cli|daemon|desktop][@version] [user@host] [--tarball <path>]
   puddle remove  <cli|daemon|desktop> [user@host] [--yes] [--purge]
-  puddle remote enable [user@host] --service <https-origin> --app-origin <https-origin>
+  puddle remote enable --profile <profile-id> [user@host] --service <https-origin> --app-origin <https-origin>
                        [--foreground]
-  puddle remote status|pair|devices|disable|reset|run [user@host]
-  puddle remote approve|revoke <device-id> [user@host]
+  puddle remote status|pair|devices|disable|reset --profile <profile-id> [user@host]
+  puddle remote run [user@host]
+  puddle remote approve|revoke <device-id> --profile <profile-id> [user@host]
   puddle --version | --help
 
 --version lists the installed CLI, daemon, and desktop app with the protocol
-each speaks; absent local components are reported as not installed.
+each speaks (daemon -cN reports the connector\u2019s remote protocol); absent local components are reported as not installed.
 
 launch serves the cockpit at http://localhost:7433 against the daemon on this
 machine when no host (or 'local') is given \u2014 installing it under ~/.puddle if
@@ -21105,10 +21132,11 @@ function jsonLines(stream, receive, fail2) {
 
 // ../shared/src/node/host-control.ts
 var HostControlClient = class {
-  constructor(openChannel, automatic = true, error51 = (_code, message) => new Error(message)) {
+  constructor(openChannel, automatic = true, error51 = (_code, message) => new Error(message), profile) {
     this.openChannel = openChannel;
     this.automatic = automatic;
     this.error = error51;
+    this.profile = profile;
     this.timer = setInterval(() => {
       if (this.channel && performance.now() >= this.until)
         this.lose(this.channel, "upstream_expired");
@@ -21251,7 +21279,7 @@ var HostControlClient = class {
         channel.once("error", closed);
         channel.once("close", closed);
         channel.once("end", closed);
-        send({ t: "open" });
+        send({ t: "open", ...this.profile ? { profile: this.profile } : {} });
       });
     } finally {
       this.connecting = false;
@@ -21525,7 +21553,7 @@ import { readFileSync as readFileSync4 } from "node:fs";
 import { dirname as dirname4, join as join5 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function cliVersion() {
-  if (true) return "0.2.6";
+  if (true) return "0.2.8";
   const here = dirname4(fileURLToPath2(import.meta.url));
   for (const candidate of [
     join5(here, "..", "..", "package.json"),
@@ -21904,7 +21932,9 @@ var RELEASE_PROTOCOLS = {
   "0.2.3": { major: 20, minor: 0 },
   "0.2.4": { major: 21, minor: 2 },
   "0.2.5": { major: 21, minor: 2 },
-  "0.2.6": { major: 21, minor: 2 }
+  "0.2.6": { major: 21, minor: 2 },
+  "0.2.7": { major: 21, minor: 3 },
+  "0.2.8": { major: 22, minor: 0 }
 };
 function validProtocol(value) {
   if (typeof value !== "object" || value === null) return false;
@@ -21963,6 +21993,15 @@ function daemonProtocol(home, version2) {
   }
   return releasedProtocol(version2);
 }
+function daemonConnectorProtocol(home, version2) {
+  try {
+    const raw = readFileSync5(join7(home, "bin", "current", "CONNECTOR_PROTOCOL"), "utf8").trim();
+    if (/^[1-9][0-9]*$/.test(raw) && Number.isSafeInteger(Number(raw))) return Number(raw);
+    return void 0;
+  } catch {
+    return /^0\.2\.[0-7]$/.test(version2) ? 2 : void 0;
+  }
+}
 async function installedComponentVersions(opts = {}) {
   const home = opts.home ?? clientHome();
   const cli = {
@@ -21973,10 +22012,12 @@ async function installedComponentVersions(opts = {}) {
   };
   const installedDaemon = daemonVersion(home);
   const installedDaemonProtocol = installedDaemon === void 0 ? void 0 : daemonProtocol(home, installedDaemon);
+  const connectorProtocol = installedDaemon === void 0 ? void 0 : daemonConnectorProtocol(home, installedDaemon);
   const daemon = installedDaemon === void 0 ? { component: "daemon", installed: false } : {
     component: "daemon",
     installed: true,
     version: installedDaemon,
+    ...connectorProtocol !== void 0 ? { connectorProtocol } : {},
     ...installedDaemonProtocol ? { protocol: installedDaemonProtocol } : {}
   };
   const recordedDesktop = readDesktopInstallation(desktopRecordFile(home));
@@ -22008,7 +22049,7 @@ function formatComponentVersions(components) {
     const name = component.component.padEnd(7);
     if (!component.installed) return `${name} not installed`;
     const version2 = component.version ?? "unknown version";
-    const protocol = component.protocol ? `protocol ${component.protocol.major}.${component.protocol.minor}` : "protocol unknown";
+    const protocol = component.protocol ? `protocol ${component.protocol.major}.${component.protocol.minor}${component.component === "daemon" && component.connectorProtocol !== void 0 ? `-c${component.connectorProtocol}` : ""}` : "protocol unknown";
     return `${name} ${version2} (${protocol})`;
   }).join("\n");
 }
@@ -23277,13 +23318,18 @@ function remoteAccessHandler(control) {
   return async (req, res, authorised) => {
     if (!control) return fail(res, 404, "remote_controls_unavailable");
     if (req.method !== "GET" && req.method !== "POST") return fail(res, 405, "method_not_allowed");
+    const url2 = new URL(req.url, "http://localhost");
+    const scope = connectorProfileSchema.safeParse(Object.fromEntries(url2.searchParams));
+    if (!scope.success || url2.searchParams.getAll("profile").length !== 1)
+      return fail(res, 400, "invalid_profile", "Select the profile to manage remote access.");
+    const { profile } = scope.data;
     const request = req.method === "POST" ? cockpitRemoteRequestSchema.parse(await readJson(req)) : null;
     if (!authorised()) return fail(res, 401, "browser_rejected");
     if (busy)
       return fail(res, 409, "remote_control_busy", "A host operation is already in progress.");
     busy = true;
     try {
-      const response = request ? await control.request(request, authorised) : await control.status();
+      const response = request ? await control.request(request, authorised, profile) : await control.status(profile);
       if (!authorised()) return fail(res, 401, "browser_rejected");
       json2(res, 200, response);
     } catch (error51) {
@@ -23536,11 +23582,12 @@ var RemoteAccessControl = class {
     if (result.code !== 0)
       throw new Error("Host control is unavailable. Check the host connection.");
     return {
-      availability: result.stdout.includes("cockpit controls 1") ? "ready" : "upgrade_required",
+      availability: result.stdout.includes("cockpit controls 2") ? "ready" : "upgrade_required",
       canDeleteRegistration: result.stdout.includes("delete registration 1")
     };
   }
-  async status() {
+  async status(profile) {
+    profileId.parse(profile);
     const capabilities = await this.capabilities();
     if (capabilities.availability !== "ready")
       return {
@@ -23551,12 +23598,16 @@ var RemoteAccessControl = class {
         supervisor: null,
         devices: []
       };
-    const result = await this.transport.exec(`${binary} --inspect`, { timeoutMs: 1e4 });
+    const result = await this.transport.exec(`${binary} --inspect`, {
+      timeoutMs: 1e4,
+      stdin: JSON.stringify({ profile }) + "\n"
+    });
     if (result.code !== 0) throw new Error("Could not read remote access status on this host.");
     return cockpitRemoteStatusSchema.parse({ ...JSON.parse(result.stdout), ...capabilities });
   }
-  async request(value, authorised) {
+  async request(value, authorised, profile) {
     const request = cockpitRemoteRequestSchema.parse(value);
+    profileId.parse(profile);
     const capabilities = await this.capabilities();
     if (capabilities.availability !== "ready")
       throw new Error("Upgrade the daemon on this host to manage remote access here.");
@@ -23564,7 +23615,7 @@ var RemoteAccessControl = class {
       throw new Error("Upgrade the daemon on this host to delete its remote registration.");
     if (!authorised()) throw new Error("Browser authorisation expired before dispatch.");
     const flag = request.t === "enable" ? "--configure" : request.t === "reset" ? "--reset" : "--admin";
-    const payload = request.t === "enable" ? { ...request.registration, managed: true } : request;
+    const payload = request.t === "enable" ? { profile, setup: { ...request.registration, managed: true } } : request.t === "reset" ? { profile } : { profile, request };
     const result = await this.transport.exec(`${binary} ${flag}`, {
       stdin: JSON.stringify(payload) + "\n",
       timeoutMs: 3e4
@@ -24353,8 +24404,12 @@ HOME_DIR="\${PUDDLE_HOME:-$HOME/.puddle}"
 say() { printf 'puddled remove: %s\\n' "$1"; }
 
 # Persist remote disable before unregistering either supervisor.
-if [ -f "$HOME_DIR/bin/current/daemon/connector.mjs" ] && [ -f "$HOME_DIR/remote/config.json" ]; then
-  printf '%s\\n' '{"t":"disable"}' | "$HOME_DIR/bin/current/bin/node" "$HOME_DIR/bin/current/daemon/connector.mjs" --admin >/dev/null 2>&1 || exit 1
+if [ -f "$HOME_DIR/bin/current/daemon/connector.mjs" ] && [ -d "$HOME_DIR/remote" ]; then
+  if [ -f "$HOME_DIR/bin/current/CONNECTOR_PROTOCOL" ]; then
+    "$HOME_DIR/bin/current/bin/node" "$HOME_DIR/bin/current/daemon/connector.mjs" --disable-all >/dev/null 2>&1 || exit 1
+  elif [ -f "$HOME_DIR/remote/config.json" ]; then
+    printf '%s\\n' '{"t":"disable"}' | "$HOME_DIR/bin/current/bin/node" "$HOME_DIR/bin/current/daemon/connector.mjs" --admin >/dev/null 2>&1 || exit 1
+  fi
 fi
 
 # systemd user unit

package/dist/install.sh

@@ -254,7 +254,7 @@ fi
 
 printf '%s\n' "$KIND" > "$HOME_DIR/supervisor"
 # An upgrade replaces the supervised connector too. Never opt a new host in.
-if [ "$START" = 1 ] && [ -f "$HOME_DIR/remote/config.json" ]; then
+if [ "$START" = 1 ] && [ -d "$HOME_DIR/remote" ]; then
   if [ "$KIND" = systemd ] && [ -f "$HOME/.config/systemd/user/puddle-connector.service" ]; then
     systemctl --user restart puddle-connector || die "connector restart failed"
   elif [ "$KIND" = launchd ] && [ -f "$HOME/Library/LaunchAgents/dev.puddle.connector.plist" ]; then