@specific.dev/cli 0.1.47 → 0.1.49

package/dist/cli.js

@@ -238,15 +238,15 @@ var init_wsl_utils = __esm({
       const { stdout } = await executePowerShell(command, { powerShellPath: psPath });
       return stdout.trim();
     };
-    convertWslPathToWindows = async (path22) => {
-      if (/^[a-z]+:\/\//i.test(path22)) {
-        return path22;
+    convertWslPathToWindows = async (path24) => {
+      if (/^[a-z]+:\/\//i.test(path24)) {
+        return path24;
       }
       try {
-        const { stdout } = await execFile2("wslpath", ["-aw", path22], { encoding: "utf8" });
+        const { stdout } = await execFile2("wslpath", ["-aw", path24], { encoding: "utf8" });
         return stdout.trim();
       } catch {
-        return path22;
+        return path24;
       }
     };
   }
@@ -754,8 +754,8 @@ var require_dist = __commonJS({
       var $global, $module, $NaN = NaN;
       if ("undefined" != typeof window ? $global = window : "undefined" != typeof self ? $global = self : "undefined" != typeof global ? ($global = global).require = __require : $global = this, void 0 === $global || void 0 === $global.Array) throw new Error("no global object found");
       if ("undefined" != typeof module && ($module = module), !$global.fs && $global.require) try {
-        var fs24 = $global.require("fs");
-        "object" == typeof fs24 && null !== fs24 && 0 !== Object.keys(fs24).length && ($global.fs = fs24);
+        var fs26 = $global.require("fs");
+        "object" == typeof fs26 && null !== fs26 && 0 !== Object.keys(fs26).length && ($global.fs = fs26);
       } catch (e) {
       }
       if (!$global.fs) {
@@ -183055,13 +183055,13 @@ function removeCA() {
   }
 }
 function installCAToTrustStore(certPath) {
-  const platform5 = os.platform();
-  if (platform5 === "darwin") {
+  const platform4 = os.platform();
+  if (platform4 === "darwin") {
     execSync(
       `sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "${certPath}"`,
       { stdio: "inherit" }
     );
-  } else if (platform5 === "linux") {
+  } else if (platform4 === "linux") {
     if (fs.existsSync("/usr/local/share/ca-certificates")) {
       execSync(
         `sudo cp "${certPath}" /usr/local/share/ca-certificates/specific-local-ca.crt`,
@@ -183078,7 +183078,7 @@ function installCAToTrustStore(certPath) {
       throw new Error("Could not detect Linux certificate trust mechanism");
     }
   } else {
-    throw new Error(`Unsupported platform: ${platform5}`);
+    throw new Error(`Unsupported platform: ${platform4}`);
   }
 }
 function generateCertificate(domain, keys = []) {
@@ -183873,7 +183873,7 @@ function trackEvent(event, properties) {
     event,
     properties: {
       ...properties,
-      cli_version: "0.1.47",
+      cli_version: "0.1.49",
       platform: process.platform,
       node_version: process.version,
       project_id: getProjectId(),
@@ -183888,6 +183888,11 @@ async function shutdown() {
   }
 }
 
+// src/lib/ui/interactive.ts
+function isInteractive() {
+  return process.stdin.isTTY === true && process.stdout.isTTY === true;
+}
+
 // src/commands/init.tsx
 var SPECIFIC_INSTRUCTIONS = `Use Specific to handle all infrastructure and development environments: like deployments, databases, real-time sync, services, secrets, configuration and environment variables. Run \`specific docs\` to learn how to use Specific. ALWAYS run \`specific check\` after making changes to the Specific configuration.`;
 var CURSOR_MDC_CONTENT = `---
@@ -184156,8 +184161,77 @@ function InitUI() {
     " "
   ))));
 }
-function initCommand() {
-  render2(/* @__PURE__ */ React2.createElement(InitUI, null));
+var VALID_AGENT_IDS = options.map((o) => o.id);
+function initCommand(opts) {
+  if (isInteractive()) {
+    render2(/* @__PURE__ */ React2.createElement(InitUI, null));
+    return;
+  }
+  if (!opts.agent || opts.agent.length === 0) {
+    console.error(
+      `Error: --agent is required in non-interactive environments.
+Usage: specific init --agent cursor claude codex
+Valid agents: ${VALID_AGENT_IDS.join(", ")}`
+    );
+    process.exit(1);
+  }
+  const invalid = opts.agent.filter((a) => !VALID_AGENT_IDS.includes(a));
+  if (invalid.length > 0) {
+    console.error(
+      `Error: Unknown agent(s): ${invalid.join(", ")}
+Valid agents: ${VALID_AGENT_IDS.join(", ")}`
+    );
+    process.exit(1);
+  }
+  const checked = {};
+  for (const agent of opts.agent) {
+    checked[agent] = true;
+  }
+  const result = configureAgents(checked);
+  trackEvent("project_initialized", {
+    agents: opts.agent
+  });
+  const selectedAgents = opts.agent.length;
+  const agentChanges = result.agents.filesCreated.length > 0 || result.agents.filesModified.length > 0;
+  console.log("\u2713 Coding agents configured");
+  if (result.agents.filesCreated.length > 0) {
+    console.log(`  Created: ${result.agents.filesCreated.join(", ")}`);
+  }
+  if (result.agents.filesModified.length > 0) {
+    console.log(`  Modified: ${result.agents.filesModified.join(", ")}`);
+  }
+  if (!agentChanges && selectedAgents > 0) {
+    console.log("  No changes needed (files already configured)");
+  }
+  if (result.git) {
+    const gitChanges = result.git.filesCreated.length > 0 || result.git.filesModified.length > 0;
+    console.log("\u2713 Git configured");
+    if (result.git.filesCreated.length > 0) {
+      console.log(`  Created: ${result.git.filesCreated.join(", ")}`);
+    }
+    if (result.git.filesModified.length > 0) {
+      console.log(`  Modified: ${result.git.filesModified.join(", ")}`);
+    }
+    if (!gitChanges) {
+      console.log("  No changes needed (.gitignore already configured)");
+    }
+  }
+  if (!caFilesExist()) {
+    console.log(
+      "\u26A0 TLS certificates not installed (run `specific init` in a terminal to set up)"
+    );
+  }
+  if (result.showManualInstructions) {
+    console.log("\n\u2713 Manual configuration selected");
+    console.log("\n  Add this to your agent's system prompt:");
+    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    console.log(`  ${SPECIFIC_INSTRUCTIONS}`);
+    console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    console.log(
+      "\n  We also recommend allowing your agent to run `specific docs *`"
+    );
+    console.log("  and `specific check *` without confirmation.");
+  }
 }
 
 // src/commands/docs.tsx
@@ -184166,11 +184240,11 @@ import { join as join6, dirname as dirname2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var __dirname2 = dirname2(fileURLToPath2(import.meta.url));
 var docsDir = join6(__dirname2, "docs");
-function docsCommand(path22) {
-  const docPath = resolveDocPath(path22);
+function docsCommand(path24) {
+  const docPath = resolveDocPath(path24);
   if (!docPath) {
     console.error(
-      `Documentation not found: ${path22 || "index"}
+      `Documentation not found: ${path24 || "index"}
 
 Run 'specific docs' to see available topics.`
     );
@@ -184179,16 +184253,16 @@ Run 'specific docs' to see available topics.`
   const content = readFileSync5(docPath, "utf-8");
   console.log(content);
 }
-function resolveDocPath(path22) {
-  if (!path22) {
+function resolveDocPath(path24) {
+  if (!path24) {
     const indexPath2 = join6(docsDir, "index.md");
     return existsSync5(indexPath2) ? indexPath2 : null;
   }
-  const directPath = join6(docsDir, `${path22}.md`);
+  const directPath = join6(docsDir, `${path24}.md`);
   if (existsSync5(directPath)) {
     return directPath;
   }
-  const indexPath = join6(docsDir, path22, "index.md");
+  const indexPath = join6(docsDir, path24, "index.md");
   if (existsSync5(indexPath)) {
     return indexPath;
   }
@@ -184283,7 +184357,7 @@ function parseReferenceString(str) {
       attribute: "port"
     };
   }
-  const serviceEndpointMatch = str.match(/^service\.(\w+)\.endpoint\.(\w+)\.(url|host|port)$/);
+  const serviceEndpointMatch = str.match(/^service\.(\w+)\.endpoint\.(\w+)\.(url|private_url|host|port|public_url)$/);
   if (serviceEndpointMatch && serviceEndpointMatch[1] && serviceEndpointMatch[2] && serviceEndpointMatch[3]) {
     return {
       type: "service",
@@ -184292,7 +184366,7 @@ function parseReferenceString(str) {
       attribute: serviceEndpointMatch[3]
     };
   }
-  const serviceMatch = str.match(/^service\.(\w+)\.(url|host|port)$/);
+  const serviceMatch = str.match(/^service\.(\w+)\.(url|private_url|host|port|public_url)$/);
   if (serviceMatch && serviceMatch[1] && serviceMatch[2]) {
     return {
       type: "service",
@@ -184397,6 +184471,17 @@ function parseBuilds(buildData) {
     if (dev) {
       build.dev = dev;
     }
+    const env2 = parseEnv(fieldObj.env);
+    if (env2) {
+      for (const [key, value] of Object.entries(env2)) {
+        if (typeof value === "string")
+          continue;
+        if (value.type === "service" && value.attribute === "public_url")
+          continue;
+        throw new Error(`Build "${name}" env var "${key}" uses an unsupported reference type. Build env vars only support string literals and \${service.<name>.public_url} references.`);
+      }
+      build.env = env2;
+    }
     builds.push(build);
   }
   return builds;
@@ -184704,6 +184789,26 @@ function validateEndpointReferences(config) {
               });
             }
           }
+          if (serviceRef.attribute === "public_url") {
+            const endpointName = serviceRef.endpointName;
+            if (endpointName) {
+              const targetEndpoint = targetEndpoints.find((e) => e.name === endpointName);
+              if (targetEndpoint && !targetEndpoint.public) {
+                errors.push({
+                  service: service.name,
+                  message: `Service "${service.name}" references public_url of endpoint "${endpointName}" on service "${serviceRef.serviceName}" in env var "${key}", but that endpoint is not public. Add \`public = true\` to the endpoint.`
+                });
+              }
+            } else {
+              const defaultEndpoint = targetEndpoints.length === 1 ? targetEndpoints[0] : targetEndpoints.find((e) => e.name === "default");
+              if (defaultEndpoint && !defaultEndpoint.public) {
+                errors.push({
+                  service: service.name,
+                  message: `Service "${service.name}" references public_url of service "${serviceRef.serviceName}" in env var "${key}", but its endpoint is not public. Add \`public = true\` to the endpoint.`
+                });
+              }
+            }
+          }
         }
         if (typeof value === "object" && value.type === "endpoint") {
           const endpointRef = value;
@@ -184767,8 +184872,8 @@ function checkCommand() {
 import React6, { useState as useState5, useEffect as useEffect3, useRef } from "react";
 import { render as render4, Text as Text6, Box as Box6, useApp as useApp2, Static } from "ink";
 import Spinner4 from "ink-spinner";
-import * as fs19 from "fs";
-import * as path16 from "path";
+import * as fs20 from "fs";
+import * as path17 from "path";
 
 // node_modules/.pnpm/chokidar@5.0.0/node_modules/chokidar/index.js
 import { EventEmitter } from "node:events";
@@ -184860,7 +184965,7 @@ var ReaddirpStream = class extends Readable {
     this._directoryFilter = normalizeFilter(opts.directoryFilter);
     const statMethod = opts.lstat ? lstat : stat;
     if (wantBigintFsStats) {
-      this._stat = (path22) => statMethod(path22, { bigint: true });
+      this._stat = (path24) => statMethod(path24, { bigint: true });
     } else {
       this._stat = statMethod;
     }
@@ -184885,8 +184990,8 @@ var ReaddirpStream = class extends Readable {
         const par = this.parent;
         const fil = par && par.files;
         if (fil && fil.length > 0) {
-          const { path: path22, depth } = par;
-          const slice = fil.splice(0, batch).map((dirent) => this._formatEntry(dirent, path22));
+          const { path: path24, depth } = par;
+          const slice = fil.splice(0, batch).map((dirent) => this._formatEntry(dirent, path24));
           const awaited = await Promise.all(slice);
           for (const entry of awaited) {
             if (!entry)
@@ -184926,20 +185031,20 @@ var ReaddirpStream = class extends Readable {
       this.reading = false;
     }
   }
-  async _exploreDir(path22, depth) {
+  async _exploreDir(path24, depth) {
     let files;
     try {
-      files = await readdir(path22, this._rdOptions);
+      files = await readdir(path24, this._rdOptions);
     } catch (error) {
       this._onError(error);
     }
-    return { files, depth, path: path22 };
+    return { files, depth, path: path24 };
   }
-  async _formatEntry(dirent, path22) {
+  async _formatEntry(dirent, path24) {
     let entry;
     const basename5 = this._isDirent ? dirent.name : dirent;
     try {
-      const fullPath = presolve(pjoin(path22, basename5));
+      const fullPath = presolve(pjoin(path24, basename5));
       entry = { path: prelative(this._root, fullPath), fullPath, basename: basename5 };
       entry[this._statsProp] = this._isDirent ? dirent : await this._stat(fullPath);
     } catch (err) {
@@ -185339,16 +185444,16 @@ var delFromSet = (main, prop, item) => {
 };
 var isEmptySet = (val) => val instanceof Set ? val.size === 0 : !val;
 var FsWatchInstances = /* @__PURE__ */ new Map();
-function createFsWatchInstance(path22, options2, listener, errHandler, emitRaw) {
+function createFsWatchInstance(path24, options2, listener, errHandler, emitRaw) {
   const handleEvent = (rawEvent, evPath) => {
-    listener(path22);
-    emitRaw(rawEvent, evPath, { watchedPath: path22 });
-    if (evPath && path22 !== evPath) {
-      fsWatchBroadcast(sp.resolve(path22, evPath), KEY_LISTENERS, sp.join(path22, evPath));
+    listener(path24);
+    emitRaw(rawEvent, evPath, { watchedPath: path24 });
+    if (evPath && path24 !== evPath) {
+      fsWatchBroadcast(sp.resolve(path24, evPath), KEY_LISTENERS, sp.join(path24, evPath));
     }
   };
   try {
-    return fs_watch(path22, {
+    return fs_watch(path24, {
       persistent: options2.persistent
     }, handleEvent);
   } catch (error) {
@@ -185364,12 +185469,12 @@ var fsWatchBroadcast = (fullPath, listenerType, val1, val2, val3) => {
     listener(val1, val2, val3);
   });
 };
-var setFsWatchListener = (path22, fullPath, options2, handlers) => {
+var setFsWatchListener = (path24, fullPath, options2, handlers) => {
   const { listener, errHandler, rawEmitter } = handlers;
   let cont = FsWatchInstances.get(fullPath);
   let watcher;
   if (!options2.persistent) {
-    watcher = createFsWatchInstance(path22, options2, listener, errHandler, rawEmitter);
+    watcher = createFsWatchInstance(path24, options2, listener, errHandler, rawEmitter);
     if (!watcher)
       return;
     return watcher.close.bind(watcher);
@@ -185380,7 +185485,7 @@ var setFsWatchListener = (path22, fullPath, options2, handlers) => {
     addAndConvert(cont, KEY_RAW, rawEmitter);
   } else {
     watcher = createFsWatchInstance(
-      path22,
+      path24,
       options2,
       fsWatchBroadcast.bind(null, fullPath, KEY_LISTENERS),
       errHandler,
@@ -185395,7 +185500,7 @@ var setFsWatchListener = (path22, fullPath, options2, handlers) => {
         cont.watcherUnusable = true;
       if (isWindows && error.code === "EPERM") {
         try {
-          const fd = await open2(path22, "r");
+          const fd = await open2(path24, "r");
           await fd.close();
           broadcastErr(error);
         } catch (err) {
@@ -185426,7 +185531,7 @@ var setFsWatchListener = (path22, fullPath, options2, handlers) => {
   };
 };
 var FsWatchFileInstances = /* @__PURE__ */ new Map();
-var setFsWatchFileListener = (path22, fullPath, options2, handlers) => {
+var setFsWatchFileListener = (path24, fullPath, options2, handlers) => {
   const { listener, rawEmitter } = handlers;
   let cont = FsWatchFileInstances.get(fullPath);
   const copts = cont && cont.options;
@@ -185448,7 +185553,7 @@ var setFsWatchFileListener = (path22, fullPath, options2, handlers) => {
         });
         const currmtime = curr.mtimeMs;
         if (curr.size !== prev.size || currmtime > prev.mtimeMs || currmtime === 0) {
-          foreach(cont.listeners, (listener2) => listener2(path22, curr));
+          foreach(cont.listeners, (listener2) => listener2(path24, curr));
         }
       })
     };
@@ -185478,13 +185583,13 @@ var NodeFsHandler = class {
    * @param listener on fs change
    * @returns closer for the watcher instance
    */
-  _watchWithNodeFs(path22, listener) {
+  _watchWithNodeFs(path24, listener) {
     const opts = this.fsw.options;
-    const directory = sp.dirname(path22);
-    const basename5 = sp.basename(path22);
+    const directory = sp.dirname(path24);
+    const basename5 = sp.basename(path24);
     const parent = this.fsw._getWatchedDir(directory);
     parent.add(basename5);
-    const absolutePath = sp.resolve(path22);
+    const absolutePath = sp.resolve(path24);
     const options2 = {
       persistent: opts.persistent
     };
@@ -185494,12 +185599,12 @@ var NodeFsHandler = class {
     if (opts.usePolling) {
       const enableBin = opts.interval !== opts.binaryInterval;
       options2.interval = enableBin && isBinaryPath(basename5) ? opts.binaryInterval : opts.interval;
-      closer = setFsWatchFileListener(path22, absolutePath, options2, {
+      closer = setFsWatchFileListener(path24, absolutePath, options2, {
         listener,
         rawEmitter: this.fsw._emitRaw
       });
     } else {
-      closer = setFsWatchListener(path22, absolutePath, options2, {
+      closer = setFsWatchListener(path24, absolutePath, options2, {
         listener,
         errHandler: this._boundHandleError,
         rawEmitter: this.fsw._emitRaw
@@ -185521,7 +185626,7 @@ var NodeFsHandler = class {
     let prevStats = stats;
     if (parent.has(basename5))
       return;
-    const listener = async (path22, newStats) => {
+    const listener = async (path24, newStats) => {
       if (!this.fsw._throttle(THROTTLE_MODE_WATCH, file, 5))
         return;
       if (!newStats || newStats.mtimeMs === 0) {
@@ -185535,11 +185640,11 @@ var NodeFsHandler = class {
             this.fsw._emit(EV.CHANGE, file, newStats2);
           }
           if ((isMacos || isLinux || isFreeBSD) && prevStats.ino !== newStats2.ino) {
-            this.fsw._closeFile(path22);
+            this.fsw._closeFile(path24);
             prevStats = newStats2;
             const closer2 = this._watchWithNodeFs(file, listener);
             if (closer2)
-              this.fsw._addPathCloser(path22, closer2);
+              this.fsw._addPathCloser(path24, closer2);
           } else {
             prevStats = newStats2;
           }
@@ -185571,7 +185676,7 @@ var NodeFsHandler = class {
    * @param item basename of this item
    * @returns true if no more processing is needed for this entry.
    */
-  async _handleSymlink(entry, directory, path22, item) {
+  async _handleSymlink(entry, directory, path24, item) {
     if (this.fsw.closed) {
       return;
     }
@@ -185581,7 +185686,7 @@ var NodeFsHandler = class {
       this.fsw._incrReadyCount();
       let linkPath;
       try {
-        linkPath = await fsrealpath(path22);
+        linkPath = await fsrealpath(path24);
       } catch (e) {
         this.fsw._emitReady();
         return true;
@@ -185591,12 +185696,12 @@ var NodeFsHandler = class {
       if (dir.has(item)) {
         if (this.fsw._symlinkPaths.get(full) !== linkPath) {
           this.fsw._symlinkPaths.set(full, linkPath);
-          this.fsw._emit(EV.CHANGE, path22, entry.stats);
+          this.fsw._emit(EV.CHANGE, path24, entry.stats);
         }
       } else {
         dir.add(item);
         this.fsw._symlinkPaths.set(full, linkPath);
-        this.fsw._emit(EV.ADD, path22, entry.stats);
+        this.fsw._emit(EV.ADD, path24, entry.stats);
       }
       this.fsw._emitReady();
       return true;
@@ -185626,9 +185731,9 @@ var NodeFsHandler = class {
         return;
       }
       const item = entry.path;
-      let path22 = sp.join(directory, item);
+      let path24 = sp.join(directory, item);
       current.add(item);
-      if (entry.stats.isSymbolicLink() && await this._handleSymlink(entry, directory, path22, item)) {
+      if (entry.stats.isSymbolicLink() && await this._handleSymlink(entry, directory, path24, item)) {
         return;
       }
       if (this.fsw.closed) {
@@ -185637,8 +185742,8 @@ var NodeFsHandler = class {
       }
       if (item === target || !target && !previous.has(item)) {
         this.fsw._incrReadyCount();
-        path22 = sp.join(dir, sp.relative(dir, path22));
-        this._addToNodeFs(path22, initialAdd, wh, depth + 1);
+        path24 = sp.join(dir, sp.relative(dir, path24));
+        this._addToNodeFs(path24, initialAdd, wh, depth + 1);
       }
     }).on(EV.ERROR, this._boundHandleError);
     return new Promise((resolve7, reject) => {
@@ -185707,13 +185812,13 @@ var NodeFsHandler = class {
    * @param depth Child path actually targeted for watch
    * @param target Child path actually targeted for watch
    */
-  async _addToNodeFs(path22, initialAdd, priorWh, depth, target) {
+  async _addToNodeFs(path24, initialAdd, priorWh, depth, target) {
     const ready = this.fsw._emitReady;
-    if (this.fsw._isIgnored(path22) || this.fsw.closed) {
+    if (this.fsw._isIgnored(path24) || this.fsw.closed) {
       ready();
       return false;
     }
-    const wh = this.fsw._getWatchHelpers(path22);
+    const wh = this.fsw._getWatchHelpers(path24);
     if (priorWh) {
       wh.filterPath = (entry) => priorWh.filterPath(entry);
       wh.filterDir = (entry) => priorWh.filterDir(entry);
@@ -185729,8 +185834,8 @@ var NodeFsHandler = class {
       const follow = this.fsw.options.followSymlinks;
       let closer;
       if (stats.isDirectory()) {
-        const absPath = sp.resolve(path22);
-        const targetPath = follow ? await fsrealpath(path22) : path22;
+        const absPath = sp.resolve(path24);
+        const targetPath = follow ? await fsrealpath(path24) : path24;
         if (this.fsw.closed)
           return;
         closer = await this._handleDir(wh.watchPath, stats, initialAdd, depth, target, wh, targetPath);
@@ -185740,29 +185845,29 @@ var NodeFsHandler = class {
           this.fsw._symlinkPaths.set(absPath, targetPath);
         }
       } else if (stats.isSymbolicLink()) {
-        const targetPath = follow ? await fsrealpath(path22) : path22;
+        const targetPath = follow ? await fsrealpath(path24) : path24;
         if (this.fsw.closed)
           return;
         const parent = sp.dirname(wh.watchPath);
         this.fsw._getWatchedDir(parent).add(wh.watchPath);
         this.fsw._emit(EV.ADD, wh.watchPath, stats);
-        closer = await this._handleDir(parent, stats, initialAdd, depth, path22, wh, targetPath);
+        closer = await this._handleDir(parent, stats, initialAdd, depth, path24, wh, targetPath);
         if (this.fsw.closed)
           return;
         if (targetPath !== void 0) {
-          this.fsw._symlinkPaths.set(sp.resolve(path22), targetPath);
+          this.fsw._symlinkPaths.set(sp.resolve(path24), targetPath);
         }
       } else {
         closer = this._handleFile(wh.watchPath, stats, initialAdd);
       }
       ready();
       if (closer)
-        this.fsw._addPathCloser(path22, closer);
+        this.fsw._addPathCloser(path24, closer);
       return false;
     } catch (error) {
       if (this.fsw._handleError(error)) {
         ready();
-        return path22;
+        return path24;
       }
     }
   }
@@ -185805,24 +185910,24 @@ function createPattern(matcher) {
   }
   return () => false;
 }
-function normalizePath(path22) {
-  if (typeof path22 !== "string")
+function normalizePath(path24) {
+  if (typeof path24 !== "string")
     throw new Error("string expected");
-  path22 = sp2.normalize(path22);
-  path22 = path22.replace(/\\/g, "/");
+  path24 = sp2.normalize(path24);
+  path24 = path24.replace(/\\/g, "/");
   let prepend = false;
-  if (path22.startsWith("//"))
+  if (path24.startsWith("//"))
     prepend = true;
-  path22 = path22.replace(DOUBLE_SLASH_RE, "/");
+  path24 = path24.replace(DOUBLE_SLASH_RE, "/");
   if (prepend)
-    path22 = "/" + path22;
-  return path22;
+    path24 = "/" + path24;
+  return path24;
 }
 function matchPatterns(patterns, testString, stats) {
-  const path22 = normalizePath(testString);
+  const path24 = normalizePath(testString);
   for (let index = 0; index < patterns.length; index++) {
     const pattern = patterns[index];
-    if (pattern(path22, stats)) {
+    if (pattern(path24, stats)) {
       return true;
     }
   }
@@ -185860,19 +185965,19 @@ var toUnix = (string) => {
   }
   return str;
 };
-var normalizePathToUnix = (path22) => toUnix(sp2.normalize(toUnix(path22)));
-var normalizeIgnored = (cwd = "") => (path22) => {
-  if (typeof path22 === "string") {
-    return normalizePathToUnix(sp2.isAbsolute(path22) ? path22 : sp2.join(cwd, path22));
+var normalizePathToUnix = (path24) => toUnix(sp2.normalize(toUnix(path24)));
+var normalizeIgnored = (cwd = "") => (path24) => {
+  if (typeof path24 === "string") {
+    return normalizePathToUnix(sp2.isAbsolute(path24) ? path24 : sp2.join(cwd, path24));
   } else {
-    return path22;
+    return path24;
   }
 };
-var getAbsolutePath = (path22, cwd) => {
-  if (sp2.isAbsolute(path22)) {
-    return path22;
+var getAbsolutePath = (path24, cwd) => {
+  if (sp2.isAbsolute(path24)) {
+    return path24;
   }
-  return sp2.join(cwd, path22);
+  return sp2.join(cwd, path24);
 };
 var EMPTY_SET = Object.freeze(/* @__PURE__ */ new Set());
 var DirEntry = class {
@@ -185937,10 +186042,10 @@ var WatchHelper = class {
   dirParts;
   followSymlinks;
   statMethod;
-  constructor(path22, follow, fsw) {
+  constructor(path24, follow, fsw) {
     this.fsw = fsw;
-    const watchPath = path22;
-    this.path = path22 = path22.replace(REPLACER_RE, "");
+    const watchPath = path24;
+    this.path = path24 = path24.replace(REPLACER_RE, "");
     this.watchPath = watchPath;
     this.fullWatchPath = sp2.resolve(watchPath);
     this.dirParts = [];
@@ -186080,20 +186185,20 @@ var FSWatcher = class extends EventEmitter {
     this._closePromise = void 0;
     let paths = unifyPaths(paths_);
     if (cwd) {
-      paths = paths.map((path22) => {
-        const absPath = getAbsolutePath(path22, cwd);
+      paths = paths.map((path24) => {
+        const absPath = getAbsolutePath(path24, cwd);
         return absPath;
       });
     }
-    paths.forEach((path22) => {
-      this._removeIgnoredPath(path22);
+    paths.forEach((path24) => {
+      this._removeIgnoredPath(path24);
     });
     this._userIgnored = void 0;
     if (!this._readyCount)
       this._readyCount = 0;
     this._readyCount += paths.length;
-    Promise.all(paths.map(async (path22) => {
-      const res = await this._nodeFsHandler._addToNodeFs(path22, !_internal, void 0, 0, _origAdd);
+    Promise.all(paths.map(async (path24) => {
+      const res = await this._nodeFsHandler._addToNodeFs(path24, !_internal, void 0, 0, _origAdd);
       if (res)
         this._emitReady();
       return res;
@@ -186115,17 +186220,17 @@ var FSWatcher = class extends EventEmitter {
       return this;
     const paths = unifyPaths(paths_);
     const { cwd } = this.options;
-    paths.forEach((path22) => {
-      if (!sp2.isAbsolute(path22) && !this._closers.has(path22)) {
+    paths.forEach((path24) => {
+      if (!sp2.isAbsolute(path24) && !this._closers.has(path24)) {
         if (cwd)
-          path22 = sp2.join(cwd, path22);
-        path22 = sp2.resolve(path22);
+          path24 = sp2.join(cwd, path24);
+        path24 = sp2.resolve(path24);
       }
-      this._closePath(path22);
-      this._addIgnoredPath(path22);
-      if (this._watched.has(path22)) {
+      this._closePath(path24);
+      this._addIgnoredPath(path24);
+      if (this._watched.has(path24)) {
         this._addIgnoredPath({
-          path: path22,
+          path: path24,
           recursive: true
         });
       }
@@ -186189,38 +186294,38 @@ var FSWatcher = class extends EventEmitter {
    * @param stats arguments to be passed with event
    * @returns the error if defined, otherwise the value of the FSWatcher instance's `closed` flag
    */
-  async _emit(event, path22, stats) {
+  async _emit(event, path24, stats) {
     if (this.closed)
       return;
     const opts = this.options;
     if (isWindows)
-      path22 = sp2.normalize(path22);
+      path24 = sp2.normalize(path24);
     if (opts.cwd)
-      path22 = sp2.relative(opts.cwd, path22);
-    const args = [path22];
+      path24 = sp2.relative(opts.cwd, path24);
+    const args = [path24];
     if (stats != null)
       args.push(stats);
     const awf = opts.awaitWriteFinish;
     let pw;
-    if (awf && (pw = this._pendingWrites.get(path22))) {
+    if (awf && (pw = this._pendingWrites.get(path24))) {
       pw.lastChange = /* @__PURE__ */ new Date();
       return this;
     }
     if (opts.atomic) {
       if (event === EVENTS.UNLINK) {
-        this._pendingUnlinks.set(path22, [event, ...args]);
+        this._pendingUnlinks.set(path24, [event, ...args]);
         setTimeout(() => {
-          this._pendingUnlinks.forEach((entry, path23) => {
+          this._pendingUnlinks.forEach((entry, path25) => {
             this.emit(...entry);
             this.emit(EVENTS.ALL, ...entry);
-            this._pendingUnlinks.delete(path23);
+            this._pendingUnlinks.delete(path25);
           });
         }, typeof opts.atomic === "number" ? opts.atomic : 100);
         return this;
       }
-      if (event === EVENTS.ADD && this._pendingUnlinks.has(path22)) {
+      if (event === EVENTS.ADD && this._pendingUnlinks.has(path24)) {
         event = EVENTS.CHANGE;
-        this._pendingUnlinks.delete(path22);
+        this._pendingUnlinks.delete(path24);
       }
     }
     if (awf && (event === EVENTS.ADD || event === EVENTS.CHANGE) && this._readyEmitted) {
@@ -186238,16 +186343,16 @@ var FSWatcher = class extends EventEmitter {
           this.emitWithAll(event, args);
         }
       };
-      this._awaitWriteFinish(path22, awf.stabilityThreshold, event, awfEmit);
+      this._awaitWriteFinish(path24, awf.stabilityThreshold, event, awfEmit);
       return this;
     }
     if (event === EVENTS.CHANGE) {
-      const isThrottled = !this._throttle(EVENTS.CHANGE, path22, 50);
+      const isThrottled = !this._throttle(EVENTS.CHANGE, path24, 50);
       if (isThrottled)
         return this;
     }
     if (opts.alwaysStat && stats === void 0 && (event === EVENTS.ADD || event === EVENTS.ADD_DIR || event === EVENTS.CHANGE)) {
-      const fullPath = opts.cwd ? sp2.join(opts.cwd, path22) : path22;
+      const fullPath = opts.cwd ? sp2.join(opts.cwd, path24) : path24;
       let stats2;
       try {
         stats2 = await stat3(fullPath);
@@ -186278,23 +186383,23 @@ var FSWatcher = class extends EventEmitter {
    * @param timeout duration of time to suppress duplicate actions
    * @returns tracking object or false if action should be suppressed
    */
-  _throttle(actionType, path22, timeout) {
+  _throttle(actionType, path24, timeout) {
     if (!this._throttled.has(actionType)) {
       this._throttled.set(actionType, /* @__PURE__ */ new Map());
     }
     const action = this._throttled.get(actionType);
     if (!action)
       throw new Error("invalid throttle");
-    const actionPath = action.get(path22);
+    const actionPath = action.get(path24);
     if (actionPath) {
       actionPath.count++;
       return false;
     }
     let timeoutObject;
     const clear = () => {
-      const item = action.get(path22);
+      const item = action.get(path24);
       const count = item ? item.count : 0;
-      action.delete(path22);
+      action.delete(path24);
       clearTimeout(timeoutObject);
       if (item)
         clearTimeout(item.timeoutObject);
@@ -186302,7 +186407,7 @@ var FSWatcher = class extends EventEmitter {
     };
     timeoutObject = setTimeout(clear, timeout);
     const thr = { timeoutObject, clear, count: 0 };
-    action.set(path22, thr);
+    action.set(path24, thr);
     return thr;
   }
   _incrReadyCount() {
@@ -186316,44 +186421,44 @@ var FSWatcher = class extends EventEmitter {
    * @param event
    * @param awfEmit Callback to be called when ready for event to be emitted.
    */
-  _awaitWriteFinish(path22, threshold, event, awfEmit) {
+  _awaitWriteFinish(path24, threshold, event, awfEmit) {
     const awf = this.options.awaitWriteFinish;
     if (typeof awf !== "object")
       return;
     const pollInterval = awf.pollInterval;
     let timeoutHandler;
-    let fullPath = path22;
-    if (this.options.cwd && !sp2.isAbsolute(path22)) {
-      fullPath = sp2.join(this.options.cwd, path22);
+    let fullPath = path24;
+    if (this.options.cwd && !sp2.isAbsolute(path24)) {
+      fullPath = sp2.join(this.options.cwd, path24);
     }
     const now = /* @__PURE__ */ new Date();
     const writes = this._pendingWrites;
     function awaitWriteFinishFn(prevStat) {
       statcb(fullPath, (err, curStat) => {
-        if (err || !writes.has(path22)) {
+        if (err || !writes.has(path24)) {
           if (err && err.code !== "ENOENT")
             awfEmit(err);
           return;
         }
         const now2 = Number(/* @__PURE__ */ new Date());
         if (prevStat && curStat.size !== prevStat.size) {
-          writes.get(path22).lastChange = now2;
+          writes.get(path24).lastChange = now2;
         }
-        const pw = writes.get(path22);
+        const pw = writes.get(path24);
         const df = now2 - pw.lastChange;
         if (df >= threshold) {
-          writes.delete(path22);
+          writes.delete(path24);
           awfEmit(void 0, curStat);
         } else {
           timeoutHandler = setTimeout(awaitWriteFinishFn, pollInterval, curStat);
         }
       });
     }
-    if (!writes.has(path22)) {
-      writes.set(path22, {
+    if (!writes.has(path24)) {
+      writes.set(path24, {
         lastChange: now,
         cancelWait: () => {
-          writes.delete(path22);
+          writes.delete(path24);
           clearTimeout(timeoutHandler);
           return event;
         }
@@ -186364,8 +186469,8 @@ var FSWatcher = class extends EventEmitter {
   /**
    * Determines whether user has asked to ignore this path.
    */
-  _isIgnored(path22, stats) {
-    if (this.options.atomic && DOT_RE.test(path22))
+  _isIgnored(path24, stats) {
+    if (this.options.atomic && DOT_RE.test(path24))
       return true;
     if (!this._userIgnored) {
       const { cwd } = this.options;
@@ -186375,17 +186480,17 @@ var FSWatcher = class extends EventEmitter {
       const list = [...ignoredPaths.map(normalizeIgnored(cwd)), ...ignored];
       this._userIgnored = anymatch(list, void 0);
     }
-    return this._userIgnored(path22, stats);
+    return this._userIgnored(path24, stats);
   }
-  _isntIgnored(path22, stat4) {
-    return !this._isIgnored(path22, stat4);
+  _isntIgnored(path24, stat4) {
+    return !this._isIgnored(path24, stat4);
   }
   /**
    * Provides a set of common helpers and properties relating to symlink handling.
    * @param path file or directory pattern being watched
    */
-  _getWatchHelpers(path22) {
-    return new WatchHelper(path22, this.options.followSymlinks, this);
+  _getWatchHelpers(path24) {
+    return new WatchHelper(path24, this.options.followSymlinks, this);
   }
   // Directory helpers
   // -----------------
@@ -186417,63 +186522,63 @@ var FSWatcher = class extends EventEmitter {
    * @param item      base path of item/directory
    */
   _remove(directory, item, isDirectory) {
-    const path22 = sp2.join(directory, item);
-    const fullPath = sp2.resolve(path22);
-    isDirectory = isDirectory != null ? isDirectory : this._watched.has(path22) || this._watched.has(fullPath);
-    if (!this._throttle("remove", path22, 100))
+    const path24 = sp2.join(directory, item);
+    const fullPath = sp2.resolve(path24);
+    isDirectory = isDirectory != null ? isDirectory : this._watched.has(path24) || this._watched.has(fullPath);
+    if (!this._throttle("remove", path24, 100))
       return;
     if (!isDirectory && this._watched.size === 1) {
       this.add(directory, item, true);
     }
-    const wp = this._getWatchedDir(path22);
+    const wp = this._getWatchedDir(path24);
     const nestedDirectoryChildren = wp.getChildren();
-    nestedDirectoryChildren.forEach((nested) => this._remove(path22, nested));
+    nestedDirectoryChildren.forEach((nested) => this._remove(path24, nested));
     const parent = this._getWatchedDir(directory);
     const wasTracked = parent.has(item);
     parent.remove(item);
     if (this._symlinkPaths.has(fullPath)) {
       this._symlinkPaths.delete(fullPath);
     }
-    let relPath = path22;
+    let relPath = path24;
     if (this.options.cwd)
-      relPath = sp2.relative(this.options.cwd, path22);
+      relPath = sp2.relative(this.options.cwd, path24);
     if (this.options.awaitWriteFinish && this._pendingWrites.has(relPath)) {
       const event = this._pendingWrites.get(relPath).cancelWait();
       if (event === EVENTS.ADD)
         return;
     }
-    this._watched.delete(path22);
+    this._watched.delete(path24);
     this._watched.delete(fullPath);
     const eventName = isDirectory ? EVENTS.UNLINK_DIR : EVENTS.UNLINK;
-    if (wasTracked && !this._isIgnored(path22))
-      this._emit(eventName, path22);
-    this._closePath(path22);
+    if (wasTracked && !this._isIgnored(path24))
+      this._emit(eventName, path24);
+    this._closePath(path24);
   }
   /**
    * Closes all watchers for a path
    */
-  _closePath(path22) {
-    this._closeFile(path22);
-    const dir = sp2.dirname(path22);
-    this._getWatchedDir(dir).remove(sp2.basename(path22));
+  _closePath(path24) {
+    this._closeFile(path24);
+    const dir = sp2.dirname(path24);
+    this._getWatchedDir(dir).remove(sp2.basename(path24));
   }
   /**
    * Closes only file-specific watchers
    */
-  _closeFile(path22) {
-    const closers = this._closers.get(path22);
+  _closeFile(path24) {
+    const closers = this._closers.get(path24);
     if (!closers)
       return;
     closers.forEach((closer) => closer());
-    this._closers.delete(path22);
+    this._closers.delete(path24);
   }
-  _addPathCloser(path22, closer) {
+  _addPathCloser(path24, closer) {
     if (!closer)
       return;
-    let list = this._closers.get(path22);
+    let list = this._closers.get(path24);
     if (!list) {
       list = [];
-      this._closers.set(path22, list);
+      this._closers.set(path24, list);
     }
     list.push(closer);
   }
@@ -186591,7 +186696,6 @@ var StablePortAllocator = class {
 import * as fs14 from "fs";
 import * as path10 from "path";
 import * as net from "net";
-import * as os7 from "os";
 import { spawn } from "child_process";
 
 // src/lib/bin/types.ts
@@ -186634,15 +186738,27 @@ import * as path9 from "path";
 import * as os6 from "os";
 import { createReadStream } from "fs";
 import { createTarExtractor, extractTo } from "tar-vern";
+function getLibraryEnv(binary) {
+  if (!binary.libraryPath) {
+    return {};
+  }
+  const platform4 = os6.platform();
+  if (platform4 === "darwin") {
+    return { DYLD_LIBRARY_PATH: binary.libraryPath };
+  } else if (platform4 === "linux") {
+    return { LD_LIBRARY_PATH: binary.libraryPath };
+  }
+  return {};
+}
 function getBinBaseDir() {
   return path9.join(os6.homedir(), ".specific", "bin");
 }
 function getPlatformInfo() {
-  const platform5 = os6.platform();
+  const platform4 = os6.platform();
   const arch3 = os6.arch();
-  if (platform5 !== "darwin" && platform5 !== "linux") {
+  if (platform4 !== "darwin" && platform4 !== "linux") {
     throw new Error(
-      `Unsupported platform: ${platform5}. Only macOS and Linux are supported.`
+      `Unsupported platform: ${platform4}. Only macOS and Linux are supported.`
     );
   }
   const archStr = arch3;
@@ -186656,7 +186772,7 @@ function getPlatformInfo() {
       `Unsupported architecture: ${arch3}. Only x64 and arm64 are supported.`
     );
   }
-  return { platform: platform5, arch: mappedArch };
+  return { platform: platform4, arch: mappedArch };
 }
 function getBinaryDir(definition, version, platformInfo) {
   return path9.join(
@@ -186832,7 +186948,7 @@ var postgresBinary = {
   // Archive contains bin/ and lib/ directories at root
   stripComponents: 0,
   // Core PostgreSQL executables (in bin/ directory)
-  executables: ["bin/postgres", "bin/initdb"],
+  executables: ["bin/postgres", "bin/initdb", "bin/psql"],
   // Library directory relative to root (for setting LD_LIBRARY_PATH)
   libraryDir: "lib"
 };
@@ -186904,18 +187020,6 @@ var drizzleGatewayBinary = {
 };
 
 // src/lib/dev/database-manager.ts
-function getLibraryEnv(binary) {
-  if (!binary.libraryPath) {
-    return {};
-  }
-  const platform5 = os7.platform();
-  if (platform5 === "darwin") {
-    return { DYLD_LIBRARY_PATH: binary.libraryPath };
-  } else if (platform5 === "linux") {
-    return { LD_LIBRARY_PATH: binary.libraryPath };
-  }
-  return {};
-}
 async function startPostgres(pg, port, dataDir, onProgress) {
   const binary = await ensureBinary(postgresBinary, void 0, onProgress);
   const dbDataPath = path10.join(process.cwd(), dataDir, pg.name);
@@ -187271,7 +187375,7 @@ config {
     this.name = "MissingConfigError";
   }
 };
-function resolveEnvValue(value, resources, secrets, configs, servicePort, serviceEndpoints, currentServicePorts) {
+function resolveEnvValue(value, resources, secrets, configs, servicePort, serviceEndpoints, currentServicePorts, publicUrls) {
   if (typeof value === "string") {
     return value;
   }
@@ -187312,11 +187416,25 @@ function resolveEnvValue(value, resources, secrets, configs, servicePort, servic
       }
       switch (serviceRef.attribute) {
         case "url":
+        case "private_url":
           return `localhost:${endpoint.port}`;
         case "host":
           return "localhost";
         case "port":
           return String(endpoint.port);
+        case "public_url": {
+          if (!publicUrls) {
+            throw new Error("public_url reference used but no public URL map provided");
+          }
+          const k8sName = endpointName === "default" ? serviceRef.serviceName : `${serviceRef.serviceName}-${endpointName}`;
+          const publicUrl = publicUrls.get(k8sName);
+          if (!publicUrl) {
+            throw new Error(
+              `No public URL found for service "${serviceRef.serviceName}" endpoint "${endpointName}"`
+            );
+          }
+          return publicUrl;
+        }
         default:
           throw new Error(`Unknown service attribute: ${serviceRef.attribute}`);
       }
@@ -187421,7 +187539,7 @@ function resolveEnvValue(value, resources, secrets, configs, servicePort, servic
       throw new Error(`Unknown reference type`);
   }
 }
-function resolveEnv(env2, resources, secrets, configs, servicePort, serviceEndpoints, currentServicePorts) {
+function resolveEnv(env2, resources, secrets, configs, servicePort, serviceEndpoints, currentServicePorts, publicUrls) {
   if (!env2) {
     return {};
   }
@@ -187434,7 +187552,8 @@ function resolveEnv(env2, resources, secrets, configs, servicePort, serviceEndpo
       configs,
       servicePort,
       serviceEndpoints,
-      currentServicePorts
+      currentServicePorts,
+      publicUrls
     );
   }
   return resolved;
@@ -187458,7 +187577,7 @@ function resolveEnvForExec(env2, resources, secrets, configs) {
 }
 
 // src/lib/dev/service-runner.ts
-function startService(service, resources, secrets, configs, endpointPorts, serviceEndpoints, onLog) {
+function startService(service, resources, secrets, configs, endpointPorts, serviceEndpoints, onLog, publicUrls) {
   const command = service.dev?.command ?? service.command;
   if (!command) {
     throw new Error(`Service "${service.name}" has no command`);
@@ -187475,7 +187594,8 @@ function startService(service, resources, secrets, configs, endpointPorts, servi
     configs,
     defaultPort,
     serviceEndpoints,
-    endpointPorts
+    endpointPorts,
+    publicUrls
   );
   const child = spawn2(command, {
     shell: true,
@@ -188620,10 +188740,107 @@ function watchConfigFile(configPath, debounceMs, onChange) {
   };
 }
 
-// src/lib/dev/proxy-registry.ts
+// src/lib/dev/subdomain-generator.ts
 import * as fs18 from "fs";
 import * as path15 from "path";
-import * as os8 from "os";
+import { generateSlug } from "random-word-slugs";
+var StableSubdomainAllocator = class {
+  tunnelsDir;
+  tunnelsFilePath;
+  baseSlug = null;
+  constructor(projectRoot, key = "default") {
+    this.tunnelsDir = path15.join(projectRoot, ".specific", "keys", key);
+    this.tunnelsFilePath = path15.join(this.tunnelsDir, "tunnels.json");
+    this.loadTunnels();
+  }
+  loadTunnels() {
+    if (!fs18.existsSync(this.tunnelsFilePath)) {
+      return;
+    }
+    try {
+      const content = fs18.readFileSync(this.tunnelsFilePath, "utf-8");
+      const data = JSON.parse(content);
+      if (data.version === 1 && data.baseSlug) {
+        this.baseSlug = data.baseSlug;
+      }
+    } catch {
+      this.baseSlug = null;
+    }
+  }
+  saveTunnels() {
+    if (!fs18.existsSync(this.tunnelsDir)) {
+      fs18.mkdirSync(this.tunnelsDir, { recursive: true });
+    }
+    const data = {
+      version: 1,
+      baseSlug: this.baseSlug
+    };
+    fs18.writeFileSync(this.tunnelsFilePath, JSON.stringify(data, null, 2));
+  }
+  generateBaseSlug() {
+    return generateSlug(2, {
+      format: "kebab",
+      partsOfSpeech: ["adjective", "noun"],
+      categories: {
+        adjective: ["color", "appearance"],
+        noun: ["animals"]
+      }
+    });
+  }
+  /**
+   * Get the base slug, generating one if needed.
+   */
+  getBaseSlug() {
+    if (!this.baseSlug) {
+      this.baseSlug = this.generateBaseSlug();
+      this.saveTunnels();
+    }
+    return this.baseSlug;
+  }
+  /**
+   * Allocate a subdomain for a service.
+   * If multipleServices is true, appends the service name to the base slug.
+   */
+  allocate(serviceName, multipleServices) {
+    const baseSlug = this.getBaseSlug();
+    if (multipleServices) {
+      return `${baseSlug}-${serviceName}`;
+    }
+    return baseSlug;
+  }
+};
+
+// src/lib/dev/tunnel-manager.ts
+import localtunnel from "localtunnel";
+var TUNNEL_HOST = "https://tunnel.spcf.app";
+async function startTunnel(serviceName, endpointName, port, subdomain, callbacks) {
+  const tunnel = await localtunnel({
+    port,
+    subdomain,
+    host: TUNNEL_HOST
+  });
+  tunnel.on("error", (err) => {
+    callbacks?.onError?.(serviceName, endpointName, err);
+  });
+  tunnel.on("close", () => {
+    callbacks?.onClose?.(serviceName, endpointName);
+  });
+  return {
+    serviceName,
+    endpointName,
+    localPort: port,
+    url: tunnel.url,
+    subdomain,
+    stop: async () => {
+      tunnel.close();
+    }
+  };
+}
+
+// src/lib/dev/proxy-registry.ts
+import * as fs19 from "fs";
+import * as path16 from "path";
+import * as os7 from "os";
 import * as net4 from "net";
 var ProxyRegistryManager = class {
   proxyDir;
@@ -188633,14 +188850,14 @@ var ProxyRegistryManager = class {
   isOwner = false;
   registryWatcher = null;
   constructor() {
-    this.proxyDir = path15.join(os8.homedir(), ".specific", "proxy");
-    this.ownerPath = path15.join(this.proxyDir, "owner.json");
-    this.registryPath = path15.join(this.proxyDir, "registry.json");
-    this.lockPath = path15.join(this.proxyDir, "registry.lock");
+    this.proxyDir = path16.join(os7.homedir(), ".specific", "proxy");
+    this.ownerPath = path16.join(this.proxyDir, "owner.json");
+    this.registryPath = path16.join(this.proxyDir, "registry.json");
+    this.lockPath = path16.join(this.proxyDir, "registry.lock");
   }
   ensureProxyDir() {
-    if (!fs18.existsSync(this.proxyDir)) {
-      fs18.mkdirSync(this.proxyDir, { recursive: true });
+    if (!fs19.existsSync(this.proxyDir)) {
+      fs19.mkdirSync(this.proxyDir, { recursive: true });
     }
   }
   isProcessRunning(pid) {
@@ -188697,15 +188914,15 @@ var ProxyRegistryManager = class {
     const startTime = Date.now();
     while (Date.now() - startTime < timeoutMs) {
       try {
-        const fd = fs18.openSync(
+        const fd = fs19.openSync(
           this.lockPath,
-          fs18.constants.O_CREAT | fs18.constants.O_EXCL | fs18.constants.O_WRONLY
+          fs19.constants.O_CREAT | fs19.constants.O_EXCL | fs19.constants.O_WRONLY
         );
-        fs18.writeSync(fd, String(process.pid));
-        fs18.closeSync(fd);
+        fs19.writeSync(fd, String(process.pid));
+        fs19.closeSync(fd);
         return () => {
           try {
-            fs18.unlinkSync(this.lockPath);
+            fs19.unlinkSync(this.lockPath);
           } catch {
           }
         };
@@ -188714,16 +188931,16 @@ var ProxyRegistryManager = class {
         if (err.code === "EEXIST") {
           try {
             const lockPid = parseInt(
-              fs18.readFileSync(this.lockPath, "utf-8").trim(),
+              fs19.readFileSync(this.lockPath, "utf-8").trim(),
               10
             );
             if (!this.isProcessRunning(lockPid)) {
-              fs18.unlinkSync(this.lockPath);
+              fs19.unlinkSync(this.lockPath);
               continue;
             }
           } catch {
             try {
-              fs18.unlinkSync(this.lockPath);
+              fs19.unlinkSync(this.lockPath);
             } catch {
             }
             continue;
@@ -188743,8 +188960,8 @@ var ProxyRegistryManager = class {
   async claimProxyOwnership(key) {
     const releaseLock = await this.acquireLock();
     try {
-      if (fs18.existsSync(this.ownerPath)) {
-        const content = fs18.readFileSync(this.ownerPath, "utf-8");
+      if (fs19.existsSync(this.ownerPath)) {
+        const content = fs19.readFileSync(this.ownerPath, "utf-8");
         const ownerFile2 = JSON.parse(content);
         if (await this.isProxyOwnerHealthy(ownerFile2.owner.pid)) {
           return false;
@@ -188774,11 +188991,11 @@ var ProxyRegistryManager = class {
     }
     const releaseLock = await this.acquireLock();
     try {
-      if (fs18.existsSync(this.ownerPath)) {
-        const content = fs18.readFileSync(this.ownerPath, "utf-8");
+      if (fs19.existsSync(this.ownerPath)) {
+        const content = fs19.readFileSync(this.ownerPath, "utf-8");
         const ownerFile = JSON.parse(content);
         if (ownerFile.owner.pid === process.pid) {
-          fs18.unlinkSync(this.ownerPath);
+          fs19.unlinkSync(this.ownerPath);
         }
       }
       this.isOwner = false;
@@ -188790,12 +189007,12 @@ var ProxyRegistryManager = class {
    * Get the current proxy owner.
    */
   async getProxyOwner() {
-    if (!fs18.existsSync(this.ownerPath)) {
+    if (!fs19.existsSync(this.ownerPath)) {
       return null;
     }
     const releaseLock = await this.acquireLock();
     try {
-      const content = fs18.readFileSync(this.ownerPath, "utf-8");
+      const content = fs19.readFileSync(this.ownerPath, "utf-8");
       const ownerFile = JSON.parse(content);
       if (!await this.isProxyOwnerHealthy(ownerFile.owner.pid)) {
         return null;
@@ -188889,7 +189106,7 @@ var ProxyRegistryManager = class {
    */
   watchRegistry(onChange) {
     this.ensureProxyDir();
-    if (!fs18.existsSync(this.registryPath)) {
+    if (!fs19.existsSync(this.registryPath)) {
       const emptyRegistry = {
         version: 1,
         keys: {},
@@ -188933,13 +189150,13 @@ var ProxyRegistryManager = class {
   async attemptElection(key) {
     const releaseLock = await this.acquireLock();
     try {
-      if (fs18.existsSync(this.ownerPath)) {
-        const content = fs18.readFileSync(this.ownerPath, "utf-8");
+      if (fs19.existsSync(this.ownerPath)) {
+        const content = fs19.readFileSync(this.ownerPath, "utf-8");
         const ownerFile2 = JSON.parse(content);
         if (await this.isProxyOwnerHealthy(ownerFile2.owner.pid)) {
           return false;
         }
-        fs18.unlinkSync(this.ownerPath);
+        fs19.unlinkSync(this.ownerPath);
       }
       const ownerFile = {
         version: 1,
@@ -188957,7 +189174,7 @@ var ProxyRegistryManager = class {
     }
   }
   readRegistry() {
-    if (!fs18.existsSync(this.registryPath)) {
+    if (!fs19.existsSync(this.registryPath)) {
       return {
         version: 1,
         keys: {},
@@ -188965,7 +189182,7 @@ var ProxyRegistryManager = class {
       };
     }
     try {
-      const content = fs18.readFileSync(this.registryPath, "utf-8");
+      const content = fs19.readFileSync(this.registryPath, "utf-8");
       return JSON.parse(content);
     } catch {
       return {
@@ -188978,8 +189195,8 @@ var ProxyRegistryManager = class {
   writeFileAtomic(filePath, data) {
     this.ensureProxyDir();
     const tmpPath = filePath + ".tmp";
-    fs18.writeFileSync(tmpPath, JSON.stringify(data, null, 2));
-    fs18.renameSync(tmpPath, filePath);
+    fs19.writeFileSync(tmpPath, JSON.stringify(data, null, 2));
+    fs19.renameSync(tmpPath, filePath);
   }
 };
 
@@ -189078,17 +189295,12 @@ function ConfigInput({ configName, onSubmit, onCancel }) {
   return /* @__PURE__ */ React5.createElement(Box5, { flexDirection: "column", marginTop: 1 }, /* @__PURE__ */ React5.createElement(Text5, null, "Enter value for config ", /* @__PURE__ */ React5.createElement(Text5, { color: "cyan" }, configName), ":"), /* @__PURE__ */ React5.createElement(Box5, null, /* @__PURE__ */ React5.createElement(Text5, { color: "cyan" }, "> "), /* @__PURE__ */ React5.createElement(Text5, null, value), /* @__PURE__ */ React5.createElement(Text5, { color: "gray" }, "|")), /* @__PURE__ */ React5.createElement(Text5, { dimColor: true }, "(Press Enter to save, Esc to cancel)"));
 }
 
-// src/lib/ui/interactive.ts
-function isInteractive() {
-  return process.stdin.isTTY === true && process.stdout.isTTY === true;
-}
-
 // src/commands/dev.tsx
 var COLORS = ["cyan", "yellow", "green", "magenta", "blue"];
-function DevUI({ instanceKey }) {
+function DevUI({ instanceKey, tunnelEnabled }) {
   const { exit } = useApp2();
   const [state, setState] = useState5(() => {
-    const caExists = caFilesExist();
+    const caExists = tunnelEnabled || caFilesExist();
     return {
       status: caExists ? "loading" : "installing-ca",
       ...caExists ? {} : { caInstallPhase: "installing" },
@@ -189097,7 +189309,9 @@ function DevUI({ instanceKey }) {
       services: [],
       output: [],
       colorMap: /* @__PURE__ */ new Map(),
-      isProxyOwner: false
+      isProxyOwner: false,
+      tunnels: /* @__PURE__ */ new Map(),
+      tunnelStatus: /* @__PURE__ */ new Map()
     };
   });
   useEffect3(() => {
@@ -189129,6 +189343,7 @@ function DevUI({ instanceKey }) {
   const drizzleGatewayRef = useRef(null);
   const registryWatcherCleanupRef = useRef(null);
   const electionIntervalRef = useRef(null);
+  const tunnelsRef = useRef([]);
   const proxyRef = useRef(null);
   const adminServerRef = useRef(null);
   const servicesRef = useRef([]);
@@ -189162,7 +189377,9 @@ function DevUI({ instanceKey }) {
       // Stop Drizzle Gateway
       drizzleGatewayRef.current?.stop(),
       // Stop all resources
-      ...[...resourcesRef.current.values()].map((resource) => resource.stop())
+      ...[...resourcesRef.current.values()].map((resource) => resource.stop()),
+      // Stop all tunnels
+      ...tunnelsRef.current.map((tunnel) => tunnel.stop())
     ]);
     if (proxyRegistryRef.current) {
       await proxyRegistryRef.current.unregisterServices(instanceKey);
@@ -189199,14 +189416,20 @@ function DevUI({ instanceKey }) {
       // Stop Drizzle Gateway
       drizzleGatewayRef.current?.stop(),
       // Stop all resources
-      ...[...resourcesRef.current.values()].map((resource) => resource.stop())
+      ...[...resourcesRef.current.values()].map((resource) => resource.stop()),
+      // Stop all tunnels
+      ...tunnelsRef.current.map((tunnel) => tunnel.stop())
     ]);
+    if (tunnelsRef.current.length > 0) {
+      await new Promise((resolve7) => setTimeout(resolve7, 1500));
+    }
     electricInstancesRef.current = [];
     drizzleGatewayRef.current = null;
     proxyRef.current = null;
     adminServerRef.current = null;
     servicesRef.current = [];
     resourcesRef.current = /* @__PURE__ */ new Map();
+    tunnelsRef.current = [];
     if (proxyRegistryRef.current) {
       await proxyRegistryRef.current.unregisterServices(instanceKey);
       await proxyRegistryRef.current.releaseProxyOwnership();
@@ -189222,7 +189445,9 @@ function DevUI({ instanceKey }) {
       resourceStatus: /* @__PURE__ */ new Map(),
       services: [],
       proxy: void 0,
-      isProxyOwner: false
+      isProxyOwner: false,
+      tunnels: /* @__PURE__ */ new Map(),
+      tunnelStatus: /* @__PURE__ */ new Map()
     }));
     setReloadTrigger((t) => t + 1);
   };
@@ -189263,10 +189488,10 @@ function DevUI({ instanceKey }) {
   }, [state.status]);
   useEffect3(() => {
     if (state.status !== "running") return;
-    const configPath = path16.join(process.cwd(), "specific.hcl");
+    const configPath = path17.join(process.cwd(), "specific.hcl");
     const watcher = watchConfigFile(configPath, 1e3, () => {
       try {
-        const hcl = fs19.readFileSync(configPath, "utf-8");
+        const hcl = fs20.readFileSync(configPath, "utf-8");
         parseConfig(hcl).then(() => {
           triggerReload();
         }).catch((err) => {
@@ -189391,8 +189616,8 @@ function DevUI({ instanceKey }) {
         }));
         return;
       }
-      const configPath = path16.join(process.cwd(), "specific.hcl");
-      if (!fs19.existsSync(configPath)) {
+      const configPath = path17.join(process.cwd(), "specific.hcl");
+      if (!fs20.existsSync(configPath)) {
         writeLog("system", "Waiting for specific.hcl to appear");
         setState((s) => ({
           ...s,
@@ -189411,7 +189636,7 @@ function DevUI({ instanceKey }) {
       }
       let config2;
       try {
-        const hcl = fs19.readFileSync(configPath, "utf-8");
+        const hcl = fs20.readFileSync(configPath, "utf-8");
         config2 = await parseConfig(hcl);
       } catch (err) {
         setState((s) => ({
@@ -189517,7 +189742,7 @@ function DevUI({ instanceKey }) {
           const drizzleGateway = await startDrizzleGateway(
             postgresResources,
             drizzlePort,
-            path16.join(process.cwd(), ".specific", "keys", instanceKey)
+            path17.join(process.cwd(), ".specific", "keys", instanceKey)
           );
           startedDrizzleGateway = drizzleGateway;
           drizzleGatewayRef.current = drizzleGateway;
@@ -189617,6 +189842,39 @@ Add them to the config block in specific.local`);
         serviceEndpointPorts.set(service.name, endpointPorts);
         serviceEndpoints.set(service.name, endpointInfos);
       }
+      const serviceInfos = [];
+      const exposedServices = [];
+      for (const service of config2.services) {
+        const endpointInfos = serviceEndpoints.get(service.name) || [];
+        for (const info of endpointInfos) {
+          const endpointConfig = service.endpoints.find(
+            (e) => e.name === info.endpointName
+          );
+          if (endpointConfig?.public) {
+            const proxyName = info.endpointName === "default" ? service.name : `${service.name}-${info.endpointName}`;
+            exposedServices.push({ name: proxyName, port: info.port });
+            serviceInfos.push({
+              serviceName: proxyName,
+              port: info.port
+            });
+          }
+        }
+      }
+      const publicUrls = /* @__PURE__ */ new Map();
+      let subdomainAllocator;
+      if (tunnelEnabled && exposedServices.length > 0) {
+        subdomainAllocator = new StableSubdomainAllocator(process.cwd(), instanceKey);
+        const multipleServices = exposedServices.length > 1;
+        for (const svc of exposedServices) {
+          const subdomain = subdomainAllocator.allocate(svc.name, multipleServices);
+          publicUrls.set(svc.name, `${subdomain}.tunnel.spcf.app`);
+        }
+      } else {
+        const keySuffix = instanceKey === "default" ? "" : `.${instanceKey}`;
+        for (const svc of exposedServices) {
+          publicUrls.set(svc.name, `${svc.name}${keySuffix}.local.spcf.app`);
+        }
+      }
       const services2 = [];
       for (const service of config2.services) {
         if (cancelled) break;
@@ -189640,7 +189898,8 @@ Add them to the config block in specific.local`);
             configs,
             endpointPorts,
             serviceEndpoints,
-            (line) => addLog(line, colorMap)
+            (line) => addLog(line, colorMap),
+            publicUrls
           );
           services2.push(running);
           startedServices.push(running);
@@ -189668,154 +189927,195 @@ Add them to the config block in specific.local`);
         }
       }
       if (cancelled) return;
-      const serviceInfos = [];
-      const exposedServices = [];
-      for (const service of config2.services) {
-        const endpointInfos = serviceEndpoints.get(service.name) || [];
-        for (const info of endpointInfos) {
-          const endpointConfig = service.endpoints.find(
-            (e) => e.name === info.endpointName
-          );
-          if (endpointConfig?.public) {
-            const proxyName = info.endpointName === "default" ? service.name : `${service.name}-${info.endpointName}`;
-            exposedServices.push({ name: proxyName, port: info.port });
-            serviceInfos.push({
-              serviceName: proxyName,
-              port: info.port
-            });
-          }
-        }
-      }
-      const runningServicePorts = /* @__PURE__ */ new Map();
-      for (const s of services2) {
-        runningServicePorts.set(s.name, s.ports.get("default"));
-      }
-      const projectId = hasProjectId() ? readProjectId() : void 0;
-      const getState = () => ({
-        status: "running",
-        services: config2.services.filter((svc) => runningServicePorts.has(svc.name) || svc.serve).map((svc) => ({
-          name: svc.name,
-          port: runningServicePorts.get(svc.name),
-          exposed: !!svc.serve || svc.endpoints.some((e) => e.public),
-          env: svc.env
-        })),
-        resources: [...resources2.entries()].map(([name, r]) => ({
-          name,
-          type: r.type,
-          port: r.port,
-          host: r.host,
-          syncEnabled: r.type === "postgres" && syncDatabases.has(name)
-        })),
-        projectId
-      });
-      const adminServer = await startAdminServer(getState);
-      adminServerRef.current = adminServer;
-      writeLog("system", `Admin API server started on port ${adminServer.port}`);
-      await proxyRegistry.registerServices(
-        instanceKey,
-        adminServer.port,
-        serviceInfos,
-        startedDrizzleGateway?.port
-      );
-      writeLog("system", `Registered ${serviceInfos.length} services with proxy registry`);
-      const becameProxyOwner = await proxyRegistry.claimProxyOwnership(instanceKey);
-      if (becameProxyOwner) {
-        writeLog("system", "Claimed proxy ownership, starting HTTP proxy");
-        try {
-          const currentServices = await proxyRegistry.getAllServices();
-          const registeredKeys = [...new Set(currentServices.map((s) => s.key))];
-          const certificate = generateCertificate("local.spcf.app", registeredKeys);
-          const proxy2 = await startHttpProxy(
-            exposedServices,
-            certificate,
-            getState,
-            instanceKey
-          );
-          startedProxy = proxy2;
-          proxyRef.current = proxy2;
-          setState((s) => ({ ...s, proxy: proxy2, isProxyOwner: true }));
-          const knownKeys = new Set(registeredKeys);
-          registryWatcherCleanupRef.current = proxyRegistry.watchRegistry(async (updatedServices, updatedKeys) => {
-            writeLog("system", `Registry updated: ${updatedServices.length} services`);
-            proxy2.updateServices(updatedServices, updatedKeys);
-            const newKeyNames = Object.keys(updatedKeys).filter((k) => !knownKeys.has(k));
-            if (newKeyNames.length > 0) {
-              writeLog("system", `New keys detected: ${newKeyNames.join(", ")} - regenerating certificate`);
-              for (const key of newKeyNames) {
-                knownKeys.add(key);
+      if (tunnelEnabled) {
+        writeLog("system", "Tunnel mode enabled, starting tunnels for public services");
+        if (exposedServices.length === 0) {
+          writeLog("system", "No public services to tunnel");
+        } else {
+          const multipleServices = exposedServices.length > 1;
+          const tunnelInstances = [];
+          const tunnelStatusMap = /* @__PURE__ */ new Map();
+          for (const svc of exposedServices) {
+            tunnelStatusMap.set(svc.name, "connecting");
+          }
+          setState((s) => ({ ...s, tunnelStatus: new Map(tunnelStatusMap) }));
+          for (const svc of exposedServices) {
+            if (cancelled) return;
+            const subdomain = subdomainAllocator.allocate(svc.name, multipleServices);
+            writeLog("system", `Starting tunnel for ${svc.name} on port ${svc.port} (subdomain: ${subdomain})`);
+            try {
+              const tunnel = await startTunnel(
+                svc.name,
+                "default",
+                svc.port,
+                subdomain,
+                {
+                  onError: (serviceName, _endpointName, error) => {
+                    writeLog("system:error", `Tunnel error for ${serviceName}: ${error.message}`);
+                  },
+                  onClose: (serviceName) => {
+                    writeLog("system", `Tunnel closed for ${serviceName}`);
+                  }
+                }
+              );
+              tunnelInstances.push(tunnel);
+              tunnelsRef.current = [...tunnelInstances];
+              tunnelStatusMap.set(svc.name, "connected");
+              setState((s) => ({
+                ...s,
+                tunnels: new Map([...s.tunnels, [svc.name, tunnel]]),
+                tunnelStatus: new Map(tunnelStatusMap)
+              }));
+              writeLog("system", `Tunnel ready for ${svc.name}: ${tunnel.url}`);
+            } catch (err) {
+              const errorMsg = `Failed to start tunnel for ${svc.name}: ${err instanceof Error ? err.message : String(err)}`;
+              writeLog("system:error", errorMsg);
+              tunnelStatusMap.set(svc.name, "error");
+              for (const t of tunnelInstances) {
+                await t.stop();
               }
-              const allKeys = [...knownKeys];
-              const newCertificate = generateCertificate("local.spcf.app", allKeys);
-              proxy2.updateCertificate(newCertificate);
+              setState((s) => ({
+                ...s,
+                status: "error",
+                error: errorMsg,
+                tunnelStatus: new Map(tunnelStatusMap)
+              }));
+              return;
             }
-          });
-          const currentKeys = await proxyRegistry.getAllKeyRegistrations();
-          proxy2.updateServices(currentServices, currentKeys);
-          writeLog("system", `Loaded ${currentServices.length} services from registry`);
-        } catch (err) {
-          const errorMsg = `Failed to start HTTP proxy: ${err instanceof Error ? err.message : String(err)}`;
-          writeLog("system:error", errorMsg);
-          setState((s) => ({
-            ...s,
-            status: "error",
-            error: errorMsg
-          }));
-          return;
+          }
         }
       } else {
-        writeLog("system", "Another instance owns the proxy, starting election watcher");
-        setState((s) => ({ ...s, isProxyOwner: false }));
-        const isProcessRunning = (pid) => {
+        const runningServicePorts = /* @__PURE__ */ new Map();
+        for (const s of services2) {
+          runningServicePorts.set(s.name, s.ports.get("default"));
+        }
+        const projectId = hasProjectId() ? readProjectId() : void 0;
+        const getState = () => ({
+          status: "running",
+          services: config2.services.filter((svc) => runningServicePorts.has(svc.name) || svc.serve).map((svc) => ({
+            name: svc.name,
+            port: runningServicePorts.get(svc.name),
+            exposed: !!svc.serve || svc.endpoints.some((e) => e.public),
+            env: svc.env
+          })),
+          resources: [...resources2.entries()].map(([name, r]) => ({
+            name,
+            type: r.type,
+            port: r.port,
+            host: r.host,
+            syncEnabled: r.type === "postgres" && syncDatabases.has(name)
+          })),
+          projectId
+        });
+        const adminServer = await startAdminServer(getState);
+        adminServerRef.current = adminServer;
+        writeLog("system", `Admin API server started on port ${adminServer.port}`);
+        await proxyRegistry.registerServices(
+          instanceKey,
+          adminServer.port,
+          serviceInfos,
+          startedDrizzleGateway?.port
+        );
+        writeLog("system", `Registered ${serviceInfos.length} services with proxy registry`);
+        const becameProxyOwner = await proxyRegistry.claimProxyOwnership(instanceKey);
+        if (becameProxyOwner) {
+          writeLog("system", "Claimed proxy ownership, starting HTTP proxy");
           try {
-            process.kill(pid, 0);
-            return true;
-          } catch {
-            return false;
-          }
-        };
-        electionIntervalRef.current = setInterval(async () => {
-          if (cancelled || shuttingDown.current) {
-            if (electionIntervalRef.current) {
-              clearInterval(electionIntervalRef.current);
-              electionIntervalRef.current = null;
-            }
+            const currentServices = await proxyRegistry.getAllServices();
+            const registeredKeys = [...new Set(currentServices.map((s) => s.key))];
+            const certificate = generateCertificate("local.spcf.app", registeredKeys);
+            const proxy2 = await startHttpProxy(
+              exposedServices,
+              certificate,
+              getState,
+              instanceKey
+            );
+            startedProxy = proxy2;
+            proxyRef.current = proxy2;
+            setState((s) => ({ ...s, proxy: proxy2, isProxyOwner: true }));
+            const knownKeys = new Set(registeredKeys);
+            registryWatcherCleanupRef.current = proxyRegistry.watchRegistry(async (updatedServices, updatedKeys) => {
+              writeLog("system", `Registry updated: ${updatedServices.length} services`);
+              proxy2.updateServices(updatedServices, updatedKeys);
+              const newKeyNames = Object.keys(updatedKeys).filter((k) => !knownKeys.has(k));
+              if (newKeyNames.length > 0) {
+                writeLog("system", `New keys detected: ${newKeyNames.join(", ")} - regenerating certificate`);
+                for (const key of newKeyNames) {
+                  knownKeys.add(key);
+                }
+                const allKeys = [...knownKeys];
+                const newCertificate = generateCertificate("local.spcf.app", allKeys);
+                proxy2.updateCertificate(newCertificate);
+              }
+            });
+            const currentKeys = await proxyRegistry.getAllKeyRegistrations();
+            proxy2.updateServices(currentServices, currentKeys);
+            writeLog("system", `Loaded ${currentServices.length} services from registry`);
+          } catch (err) {
+            const errorMsg = `Failed to start HTTP proxy: ${err instanceof Error ? err.message : String(err)}`;
+            writeLog("system:error", errorMsg);
+            setState((s) => ({
+              ...s,
+              status: "error",
+              error: errorMsg
+            }));
             return;
           }
-          const owner = await proxyRegistry.getProxyOwner();
-          if (!owner || !isProcessRunning(owner.pid)) {
-            writeLog("system", "Proxy owner died, attempting election");
-            const won = await proxyRegistry.attemptElection(instanceKey);
-            if (won) {
-              writeLog("system", "Won election, starting HTTP proxy");
+        } else {
+          writeLog("system", "Another instance owns the proxy, starting election watcher");
+          setState((s) => ({ ...s, isProxyOwner: false }));
+          const isProcessRunning = (pid) => {
+            try {
+              process.kill(pid, 0);
+              return true;
+            } catch {
+              return false;
+            }
+          };
+          electionIntervalRef.current = setInterval(async () => {
+            if (cancelled || shuttingDown.current) {
               if (electionIntervalRef.current) {
                 clearInterval(electionIntervalRef.current);
                 electionIntervalRef.current = null;
               }
-              try {
-                const electionServices = await proxyRegistry.getAllServices();
-                const electionKeyRegistrations = await proxyRegistry.getAllKeyRegistrations();
-                const electionKeyNames = Object.keys(electionKeyRegistrations);
-                const certificate = generateCertificate("local.spcf.app", electionKeyNames);
-                const proxy2 = await startHttpProxy(
-                  exposedServices,
-                  certificate,
-                  getState,
-                  instanceKey
-                );
-                startedProxy = proxy2;
-                proxyRef.current = proxy2;
-                setState((s) => ({ ...s, proxy: proxy2, isProxyOwner: true }));
-                registryWatcherCleanupRef.current = proxyRegistry.watchRegistry((updatedServices, updatedKeys) => {
-                  writeLog("system", `Registry updated: ${updatedServices.length} services`);
-                  proxy2.updateServices(updatedServices, updatedKeys);
-                });
-                proxy2.updateServices(electionServices, electionKeyRegistrations);
-              } catch (err) {
-                writeLog("system:error", `Failed to start proxy after election: ${err}`);
+              return;
+            }
+            const owner = await proxyRegistry.getProxyOwner();
+            if (!owner || !isProcessRunning(owner.pid)) {
+              writeLog("system", "Proxy owner died, attempting election");
+              const won = await proxyRegistry.attemptElection(instanceKey);
+              if (won) {
+                writeLog("system", "Won election, starting HTTP proxy");
+                if (electionIntervalRef.current) {
+                  clearInterval(electionIntervalRef.current);
+                  electionIntervalRef.current = null;
+                }
+                try {
+                  const electionServices = await proxyRegistry.getAllServices();
+                  const electionKeyRegistrations = await proxyRegistry.getAllKeyRegistrations();
+                  const electionKeyNames = Object.keys(electionKeyRegistrations);
+                  const certificate = generateCertificate("local.spcf.app", electionKeyNames);
+                  const proxy2 = await startHttpProxy(
+                    exposedServices,
+                    certificate,
+                    getState,
+                    instanceKey
+                  );
+                  startedProxy = proxy2;
+                  proxyRef.current = proxy2;
+                  setState((s) => ({ ...s, proxy: proxy2, isProxyOwner: true }));
+                  registryWatcherCleanupRef.current = proxyRegistry.watchRegistry((updatedServices, updatedKeys) => {
+                    writeLog("system", `Registry updated: ${updatedServices.length} services`);
+                    proxy2.updateServices(updatedServices, updatedKeys);
+                  });
+                  proxy2.updateServices(electionServices, electionKeyRegistrations);
+                } catch (err) {
+                  writeLog("system:error", `Failed to start proxy after election: ${err}`);
+                }
               }
             }
-          }
-        }, 1e3);
+          }, 1e3);
+        }
       }
       if (cancelled) return;
       writeLog("system", "Dev server running");
@@ -189961,39 +190261,58 @@ Add them to the config block in specific.local`);
   const staticItems = [
     {
       key: "title",
-      content: /* @__PURE__ */ React6.createElement(Text6, null, /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: "cyan" }, "Specific dev server"), instanceKey !== "default" && /* @__PURE__ */ React6.createElement(Text6, { color: "yellow" }, " [", instanceKey, "]"), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " (Ctrl+C to stop)"))
+      content: /* @__PURE__ */ React6.createElement(Text6, null, /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: "cyan" }, "Specific dev server"), tunnelEnabled && /* @__PURE__ */ React6.createElement(Text6, { color: "magenta" }, " [tunnel]"), instanceKey !== "default" && /* @__PURE__ */ React6.createElement(Text6, { color: "yellow" }, " [", instanceKey, "]"), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " (Ctrl+C to stop)"))
     },
     { key: "space1", content: /* @__PURE__ */ React6.createElement(Text6, null, " ") },
-    // Show admin UI URL
-    {
-      key: "admin",
-      content: /* @__PURE__ */ React6.createElement(Text6, null, /* @__PURE__ */ React6.createElement(Text6, { bold: true }, "Admin:"), /* @__PURE__ */ React6.createElement(Text6, null, " "), /* @__PURE__ */ React6.createElement(Text6, { bold: true }, "https://", instanceKey === "default" ? "" : `${instanceKey}.`, "local.spcf.app"))
-    },
-    { key: "admin-space", content: /* @__PURE__ */ React6.createElement(Text6, null, " ") },
-    ...services.length > 0 ? [
-      { key: "svc-header", content: /* @__PURE__ */ React6.createElement(Text6, { bold: true }, "Services:") },
-      ...services.flatMap((svc) => {
-        const serviceConfig = config.services.find((s) => s.name === svc.name);
-        const endpoints = serviceConfig?.endpoints || [];
-        if (endpoints.length === 0 && svc.ports.size > 0) {
-          const defaultPort = svc.ports.get("default");
-          return [{
-            key: `svc-${svc.name}`,
-            content: /* @__PURE__ */ React6.createElement(Text6, null, /* @__PURE__ */ React6.createElement(Text6, { color: "green" }, " \u25CF "), /* @__PURE__ */ React6.createElement(Text6, null, svc.name), defaultPort && /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " (localhost:", defaultPort, ")"))
-          }];
-        }
-        return endpoints.map((endpoint) => {
-          const port = svc.ports.get(endpoint.name);
-          const displayName = endpoint.name === "default" ? svc.name : `${svc.name}:${endpoint.name}`;
-          const proxyName = endpoint.name === "default" ? svc.name : `${svc.name}-${endpoint.name}`;
+    // Show admin UI URL (only in non-tunnel mode)
+    ...!tunnelEnabled ? [
+      {
+        key: "admin",
+        content: /* @__PURE__ */ React6.createElement(Text6, null, /* @__PURE__ */ React6.createElement(Text6, { bold: true }, "Admin:"), /* @__PURE__ */ React6.createElement(Text6, null, " "), /* @__PURE__ */ React6.createElement(Text6, { bold: true }, "https://", instanceKey === "default" ? "" : `${instanceKey}.`, "local.spcf.app"))
+      },
+      { key: "admin-space", content: /* @__PURE__ */ React6.createElement(Text6, null, " ") }
+    ] : [],
+    // Services section - different rendering for tunnel mode vs local mode
+    ...tunnelEnabled ? (
+      // Tunnel mode: show tunnel URLs for public services
+      state.tunnels.size > 0 || state.tunnelStatus.size > 0 ? [
+        { key: "svc-header", content: /* @__PURE__ */ React6.createElement(Text6, { bold: true }, "Services:") },
+        ...[...state.tunnelStatus.entries()].map(([serviceName, status]) => {
+          const tunnel = state.tunnels.get(serviceName);
           return {
-            key: `svc-${svc.name}-${endpoint.name}`,
-            content: /* @__PURE__ */ React6.createElement(Text6, null, /* @__PURE__ */ React6.createElement(Text6, { color: "green" }, " \u25CF "), /* @__PURE__ */ React6.createElement(Text6, null, displayName), port ? endpoint.public ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, null, " \u2192 "), /* @__PURE__ */ React6.createElement(Text6, { bold: true }, "https://", proxyName, instanceKey === "default" ? "" : `.${instanceKey}`, ".local.spcf.app"), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " (localhost:", port, ")")) : /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " (localhost:", port, ")") : null)
+            key: `svc-${serviceName}`,
+            content: /* @__PURE__ */ React6.createElement(Text6, null, /* @__PURE__ */ React6.createElement(Text6, { color: status === "connected" ? "green" : status === "error" ? "red" : "yellow" }, " \u25CF "), /* @__PURE__ */ React6.createElement(Text6, null, serviceName), status === "connected" && tunnel ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, null, " \u2192 "), /* @__PURE__ */ React6.createElement(Text6, { bold: true }, tunnel.url)) : status === "connecting" ? /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " connecting...") : /* @__PURE__ */ React6.createElement(Text6, { color: "red" }, " error"))
           };
-        });
-      }),
-      { key: "space2", content: /* @__PURE__ */ React6.createElement(Text6, null, " ") }
-    ] : [],
+        }),
+        { key: "space2", content: /* @__PURE__ */ React6.createElement(Text6, null, " ") }
+      ] : []
+    ) : (
+      // Local mode: show local URLs
+      services.length > 0 ? [
+        { key: "svc-header", content: /* @__PURE__ */ React6.createElement(Text6, { bold: true }, "Services:") },
+        ...services.flatMap((svc) => {
+          const serviceConfig = config.services.find((s) => s.name === svc.name);
+          const endpoints = serviceConfig?.endpoints || [];
+          if (endpoints.length === 0 && svc.ports.size > 0) {
+            const defaultPort = svc.ports.get("default");
+            return [{
+              key: `svc-${svc.name}`,
+              content: /* @__PURE__ */ React6.createElement(Text6, null, /* @__PURE__ */ React6.createElement(Text6, { color: "green" }, " \u25CF "), /* @__PURE__ */ React6.createElement(Text6, null, svc.name), defaultPort && /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " (localhost:", defaultPort, ")"))
+            }];
+          }
+          return endpoints.map((endpoint) => {
+            const port = svc.ports.get(endpoint.name);
+            const displayName = endpoint.name === "default" ? svc.name : `${svc.name}:${endpoint.name}`;
+            const proxyName = endpoint.name === "default" ? svc.name : `${svc.name}-${endpoint.name}`;
+            return {
+              key: `svc-${svc.name}-${endpoint.name}`,
+              content: /* @__PURE__ */ React6.createElement(Text6, null, /* @__PURE__ */ React6.createElement(Text6, { color: "green" }, " \u25CF "), /* @__PURE__ */ React6.createElement(Text6, null, displayName), port ? endpoint.public ? /* @__PURE__ */ React6.createElement(React6.Fragment, null, /* @__PURE__ */ React6.createElement(Text6, null, " \u2192 "), /* @__PURE__ */ React6.createElement(Text6, { bold: true }, "https://", proxyName, instanceKey === "default" ? "" : `.${instanceKey}`, ".local.spcf.app"), /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " (localhost:", port, ")")) : /* @__PURE__ */ React6.createElement(Text6, { dimColor: true }, " (localhost:", port, ")") : null)
+            };
+          });
+        }),
+        { key: "space2", content: /* @__PURE__ */ React6.createElement(Text6, null, " ") }
+      ] : []
+    ),
     ...config.postgres.length > 0 ? [
       { key: "pg-header", content: /* @__PURE__ */ React6.createElement(Text6, { bold: true }, "Postgres:") },
       ...config.postgres.map((pg) => {
@@ -190041,13 +190360,13 @@ Add them to the config block in specific.local`);
   ];
   return /* @__PURE__ */ React6.createElement(Box6, { flexDirection: "column" }, /* @__PURE__ */ React6.createElement(Static, { items: staticItems }, (item) => /* @__PURE__ */ React6.createElement(Box6, { key: item.key }, item.content)));
 }
-function devCommand(instanceKey) {
-  render4(/* @__PURE__ */ React6.createElement(DevUI, { instanceKey }));
+function devCommand(instanceKey, tunnelEnabled = false) {
+  render4(/* @__PURE__ */ React6.createElement(DevUI, { instanceKey, tunnelEnabled }));
 }
 
 // src/lib/dev/git-worktree.ts
 import { execSync as execSync2 } from "child_process";
-import * as path17 from "path";
+import * as path18 from "path";
 function isInWorktree() {
   try {
     const commonDir = execSync2("git rev-parse --git-common-dir", {
@@ -190058,8 +190377,8 @@ function isInWorktree() {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
-    const resolvedCommonDir = path17.resolve(commonDir);
-    const resolvedGitDir = path17.resolve(gitDir);
+    const resolvedCommonDir = path18.resolve(commonDir);
+    const resolvedGitDir = path18.resolve(gitDir);
     return resolvedCommonDir !== resolvedGitDir;
   } catch {
     return false;
@@ -190074,7 +190393,7 @@ function getWorktreeName() {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
-    return path17.basename(gitDir);
+    return path18.basename(gitDir);
   } catch {
     return null;
   }
@@ -190089,35 +190408,35 @@ init_open();
 import React7, { useState as useState6, useEffect as useEffect4, useCallback } from "react";
 import { render as render5, Text as Text7, Box as Box7, useApp as useApp3, useInput as useInput5 } from "ink";
 import Spinner5 from "ink-spinner";
-import * as fs21 from "fs";
-import * as path19 from "path";
+import * as fs22 from "fs";
+import * as path20 from "path";
 
 // src/lib/deploy/build-tester.ts
 import { spawn as spawn5 } from "child_process";
-import { existsSync as existsSync17 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync18 } from "fs";
+import { join as join19 } from "path";
 function getDependencyInstallCommand(build, projectDir) {
   switch (build.base) {
     case "node":
-      if (existsSync17(join18(projectDir, "pnpm-lock.yaml"))) {
+      if (existsSync18(join19(projectDir, "pnpm-lock.yaml"))) {
         return "pnpm install --frozen-lockfile";
-      } else if (existsSync17(join18(projectDir, "yarn.lock"))) {
+      } else if (existsSync18(join19(projectDir, "yarn.lock"))) {
         return "yarn install --frozen-lockfile";
-      } else if (existsSync17(join18(projectDir, "package-lock.json"))) {
+      } else if (existsSync18(join19(projectDir, "package-lock.json"))) {
         return "npm ci";
       } else {
         return "npm install";
       }
     case "python":
-      if (existsSync17(join18(projectDir, "poetry.lock"))) {
+      if (existsSync18(join19(projectDir, "poetry.lock"))) {
         return "poetry install --no-interaction";
-      } else if (existsSync17(join18(projectDir, "Pipfile.lock"))) {
+      } else if (existsSync18(join19(projectDir, "Pipfile.lock"))) {
         return "pipenv install --deploy";
-      } else if (existsSync17(join18(projectDir, "Pipfile"))) {
+      } else if (existsSync18(join19(projectDir, "Pipfile"))) {
         return "pipenv install";
-      } else if (existsSync17(join18(projectDir, "pyproject.toml"))) {
+      } else if (existsSync18(join19(projectDir, "pyproject.toml"))) {
         return "pip install .";
-      } else if (existsSync17(join18(projectDir, "requirements.txt"))) {
+      } else if (existsSync18(join19(projectDir, "requirements.txt"))) {
         return "pip install -r requirements.txt";
       }
       return null;
@@ -190263,8 +190582,8 @@ async function testAllBuilds(builds, projectDir) {
 
 // src/lib/tarball/create.ts
 import { execSync as execSync3 } from "child_process";
-import * as fs20 from "fs";
-import * as path18 from "path";
+import * as fs21 from "fs";
+import * as path19 from "path";
 import { createTarPacker, createEntryItemGenerator } from "tar-vern";
 function isInsideGitRepository(dir) {
   try {
@@ -190321,10 +190640,10 @@ var EXCLUDED_DIRS = [
 ];
 async function collectPaths(baseDir, currentDir, exclude) {
   const results = [];
-  const entries = await fs20.promises.readdir(currentDir, { withFileTypes: true });
+  const entries = await fs21.promises.readdir(currentDir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = path18.join(currentDir, entry.name);
-    const relativePath = path18.relative(baseDir, fullPath);
+    const fullPath = path19.join(currentDir, entry.name);
+    const relativePath = path19.relative(baseDir, fullPath);
     if (entry.isDirectory()) {
       if (!exclude.includes(entry.name)) {
         results.push(relativePath);
@@ -190339,8 +190658,8 @@ async function collectPaths(baseDir, currentDir, exclude) {
 }
 async function createTarArchive(projectDir) {
   writeLog("tarball", "Creating tarball using tar-vern (non-git project)");
-  const configPath = path18.join(projectDir, "specific.hcl");
-  if (!fs20.existsSync(configPath)) {
+  const configPath = path19.join(projectDir, "specific.hcl");
+  if (!fs21.existsSync(configPath)) {
     throw new Error("specific.hcl not found in project directory");
   }
   const relativePaths = await collectPaths(projectDir, projectDir, EXCLUDED_DIRS);
@@ -190357,8 +190676,8 @@ async function createTarArchive(projectDir) {
 }
 function findWidestContext(projectDir, contexts) {
   if (contexts.length === 0) return ".";
-  const absolute = contexts.map((c) => path18.resolve(projectDir, c));
-  const segments = absolute.map((p) => p.split(path18.sep).filter(Boolean));
+  const absolute = contexts.map((c) => path19.resolve(projectDir, c));
+  const segments = absolute.map((p) => p.split(path19.sep).filter(Boolean));
   const firstSegments = segments[0];
   if (!firstSegments) return ".";
   const minLen = Math.min(...segments.map((s) => s.length));
@@ -190372,12 +190691,12 @@ function findWidestContext(projectDir, contexts) {
     }
   }
   const ancestorSegments = firstSegments.slice(0, commonLength);
-  const ancestor = path18.sep + ancestorSegments.join(path18.sep);
-  return path18.relative(projectDir, ancestor) || ".";
+  const ancestor = path19.sep + ancestorSegments.join(path19.sep);
+  return path19.relative(projectDir, ancestor) || ".";
 }
 async function createProjectTarball(projectDir, context = ".") {
-  const contextDir = path18.resolve(projectDir, context);
-  const appPath = path18.relative(contextDir, projectDir) || ".";
+  const contextDir = path19.resolve(projectDir, context);
+  const appPath = path19.relative(contextDir, projectDir) || ".";
   writeLog("tarball", `Context: ${contextDir}, appPath: ${appPath}`);
   let tarball;
   if (isInsideGitRepository(contextDir)) {
@@ -191264,14 +191583,14 @@ ${errorMsg}`
   ), phase === "error" && /* @__PURE__ */ React7.createElement(Box7, { marginTop: 1 }, /* @__PURE__ */ React7.createElement(Text7, { color: "red" }, "Error: ", error)), phase === "success" && /* @__PURE__ */ React7.createElement(Box7, { marginTop: 1, flexDirection: "column" }, /* @__PURE__ */ React7.createElement(Text7, { color: "green" }, "Deployment successful!"), deployment?.publicUrls && Object.keys(deployment.publicUrls).length > 0 && /* @__PURE__ */ React7.createElement(Box7, { marginTop: 1, flexDirection: "column" }, /* @__PURE__ */ React7.createElement(Text7, { bold: true }, "Public URLs:"), Object.entries(deployment.publicUrls).map(([name, url]) => /* @__PURE__ */ React7.createElement(Text7, { key: name }, "  ", name, ": ", /* @__PURE__ */ React7.createElement(Text7, { color: "cyan" }, url))))));
 }
 async function deployCommand(environment, options2) {
-  const configPath = path19.join(process.cwd(), "specific.hcl");
-  if (!fs21.existsSync(configPath)) {
+  const configPath = path20.join(process.cwd(), "specific.hcl");
+  if (!fs22.existsSync(configPath)) {
     console.error("Error: No specific.hcl found in current directory");
     process.exit(1);
   }
   let config;
   try {
-    const hcl = fs21.readFileSync(configPath, "utf-8");
+    const hcl = fs22.readFileSync(configPath, "utf-8");
     config = await parseConfig(hcl);
   } catch (err) {
     console.error(
@@ -191295,8 +191614,8 @@ async function deployCommand(environment, options2) {
 
 // src/commands/exec.tsx
 import { spawn as spawn6 } from "child_process";
-import * as fs22 from "fs";
-import * as path20 from "path";
+import * as fs23 from "fs";
+import * as path21 from "path";
 async function execCommand(serviceName, command, instanceKey = "default") {
   if (command.length === 0) {
     console.error(
@@ -191324,14 +191643,14 @@ async function execCommand(serviceName, command, instanceKey = "default") {
       }
     }
   };
-  const configPath = path20.join(process.cwd(), "specific.hcl");
-  if (!fs22.existsSync(configPath)) {
+  const configPath = path21.join(process.cwd(), "specific.hcl");
+  if (!fs23.existsSync(configPath)) {
     console.error("Error: No specific.hcl found in current directory");
     process.exit(1);
   }
   let config;
   try {
-    const hcl = fs22.readFileSync(configPath, "utf-8");
+    const hcl = fs23.readFileSync(configPath, "utf-8");
     config = await parseConfig(hcl);
   } catch (err) {
     console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
@@ -191468,27 +191787,48 @@ async function execCommand(serviceName, command, instanceKey = "default") {
 
 // src/commands/psql.tsx
 import { spawn as spawn7 } from "child_process";
-async function psqlCommand(databaseName, instanceKey = "default") {
-  const stateManager = new InstanceStateManager(process.cwd(), instanceKey);
-  await stateManager.cleanStaleState();
-  const existingInstances = await stateManager.getExistingInstances();
-  if (!existingInstances) {
-    console.error("Error: No running instances found. Run `specific dev` first.");
+import * as fs24 from "fs";
+import * as path22 from "path";
+async function psqlCommand(databaseName, instanceKey = "default", extraArgs = []) {
+  let startedResources = [];
+  let ownsInstances = false;
+  let stateManager = null;
+  const cleanup = async () => {
+    if (ownsInstances) {
+      for (const resource of startedResources) {
+        await resource.stop().catch(() => {
+        });
+      }
+      if (stateManager) {
+        await stateManager.releaseOwnership().catch(() => {
+        });
+      }
+    }
+  };
+  const configPath = path22.join(process.cwd(), "specific.hcl");
+  if (!fs24.existsSync(configPath)) {
+    console.error("Error: No specific.hcl found in current directory");
+    process.exit(1);
+  }
+  let config;
+  try {
+    const hcl = fs24.readFileSync(configPath, "utf-8");
+    config = await parseConfig(hcl);
+  } catch (err) {
+    console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
     process.exit(1);
   }
-  const availableDatabases = Object.keys(existingInstances.databases);
+  const availableDatabases = config.postgres.map((p) => p.name);
   if (availableDatabases.length === 0) {
-    console.error("Error: No databases found in running instances.");
+    console.error("Error: No postgres databases defined in specific.hcl");
     process.exit(1);
   }
   let targetDb;
+  if (databaseName && !availableDatabases.includes(databaseName)) {
+    extraArgs = [databaseName, ...extraArgs];
+    databaseName = void 0;
+  }
   if (databaseName) {
-    if (!existingInstances.databases[databaseName]) {
-      console.error(
-        `Error: Database "${databaseName}" not found. Available: ${availableDatabases.join(", ")}`
-      );
-      process.exit(1);
-    }
     targetDb = databaseName;
   } else {
     if (availableDatabases.length > 1) {
@@ -191499,24 +191839,95 @@ async function psqlCommand(databaseName, instanceKey = "default") {
     }
     targetDb = availableDatabases[0];
   }
-  const dbState = existingInstances.databases[targetDb];
-  const child = spawn7("psql", ["-h", dbState.host, "-p", String(dbState.port), "-U", dbState.user, "-d", dbState.dbName], {
+  stateManager = new InstanceStateManager(process.cwd(), instanceKey);
+  await stateManager.cleanStaleState();
+  const existingInstances = await stateManager.getExistingInstances();
+  let dbState;
+  if (existingInstances && existingInstances.databases[targetDb]) {
+    const db = existingInstances.databases[targetDb];
+    dbState = { host: db.host, port: db.port, user: db.user, password: db.password, dbName: db.dbName };
+  } else {
+    console.error("Starting database...");
+    try {
+      await stateManager.claimOwnership("psql");
+      ownsInstances = true;
+    } catch (err) {
+      console.error(
+        `Error: ${err instanceof Error ? err.message : String(err)}`
+      );
+      process.exit(1);
+    }
+    try {
+      const result = await startResources({
+        config,
+        selection: {
+          mode: "required",
+          postgres: [targetDb],
+          redis: [],
+          storage: []
+        },
+        stateManager,
+        dataDir: `.specific/keys/${instanceKey}/data`,
+        portAllocator: new PortAllocator(),
+        callbacks: {
+          log: (msg) => console.error(msg)
+        },
+        startElectric: false
+      });
+      startedResources = result.startedResources;
+      const resource = result.resources.get(targetDb);
+      if (!resource) {
+        console.error(`Error: Failed to start database "${targetDb}"`);
+        await cleanup();
+        process.exit(1);
+      }
+      dbState = {
+        host: resource.host,
+        port: resource.port,
+        user: resource.user,
+        password: resource.password,
+        dbName: resource.dbName
+      };
+    } catch (err) {
+      console.error(
+        `Error: Failed to start database: ${err instanceof Error ? err.message : String(err)}`
+      );
+      await cleanup();
+      process.exit(1);
+    }
+  }
+  const binary = await ensureBinary(postgresBinary);
+  const psqlPath = binary.executables["psql"];
+  const libraryEnv = getLibraryEnv(binary);
+  let child = null;
+  const handleSignal = async (signal) => {
+    if (child && !child.killed) {
+      child.kill(signal);
+    }
+    await cleanup();
+  };
+  process.on("SIGINT", () => handleSignal("SIGINT"));
+  process.on("SIGTERM", () => handleSignal("SIGTERM"));
+  child = spawn7(psqlPath, ["-h", dbState.host, "-p", String(dbState.port), "-U", dbState.user, "-d", dbState.dbName, ...extraArgs], {
     cwd: process.cwd(),
     env: {
       ...process.env,
+      ...libraryEnv,
       PGPASSWORD: dbState.password
     },
     stdio: "inherit"
   });
-  child.on("exit", (code, signal) => {
+  child.on("exit", async (code, signal) => {
+    await cleanup();
     if (signal) {
       process.kill(process.pid, signal);
     } else {
       process.exit(code ?? 0);
     }
   });
-  child.on("error", (err) => {
+  child.on("error", async (err) => {
     console.error(`Error: Failed to start psql: ${err.message}`);
+    await cleanup();
     process.exit(1);
   });
 }
@@ -191525,21 +191936,21 @@ async function psqlCommand(databaseName, instanceKey = "default") {
 import React8, { useState as useState7, useEffect as useEffect5 } from "react";
 import { render as render6, Text as Text8, Box as Box8 } from "ink";
 import Spinner6 from "ink-spinner";
-import * as fs23 from "fs";
-import * as path21 from "path";
+import * as fs25 from "fs";
+import * as path23 from "path";
 function CleanUI({ instanceKey }) {
   const [state, setState] = useState7({ status: "checking" });
   useEffect5(() => {
     async function clean() {
       const projectRoot = process.cwd();
-      const specificDir = path21.join(projectRoot, ".specific");
-      if (!fs23.existsSync(specificDir)) {
+      const specificDir = path23.join(projectRoot, ".specific");
+      if (!fs25.existsSync(specificDir)) {
         setState({ status: "nothing" });
         return;
       }
       if (instanceKey) {
-        const keyDir = path21.join(specificDir, "keys", instanceKey);
-        if (!fs23.existsSync(keyDir)) {
+        const keyDir = path23.join(specificDir, "keys", instanceKey);
+        if (!fs25.existsSync(keyDir)) {
           setState({ status: "nothing" });
           return;
         }
@@ -191555,7 +191966,7 @@ function CleanUI({ instanceKey }) {
         await stateManager.cleanStaleState();
         setState({ status: "cleaning" });
         try {
-          fs23.rmSync(keyDir, { recursive: true, force: true });
+          fs25.rmSync(keyDir, { recursive: true, force: true });
           setState({ status: "success" });
         } catch (err) {
           setState({
@@ -191564,10 +191975,10 @@ function CleanUI({ instanceKey }) {
           });
         }
       } else {
-        const keysDir = path21.join(specificDir, "keys");
-        if (fs23.existsSync(keysDir)) {
-          const keys = fs23.readdirSync(keysDir).filter(
-            (f) => fs23.statSync(path21.join(keysDir, f)).isDirectory()
+        const keysDir = path23.join(specificDir, "keys");
+        if (fs25.existsSync(keysDir)) {
+          const keys = fs25.readdirSync(keysDir).filter(
+            (f) => fs25.statSync(path23.join(keysDir, f)).isDirectory()
           );
           for (const key of keys) {
             const stateManager2 = new InstanceStateManager(projectRoot, key);
@@ -191592,7 +192003,7 @@ function CleanUI({ instanceKey }) {
         }
         setState({ status: "cleaning" });
         try {
-          fs23.rmSync(specificDir, { recursive: true, force: true });
+          fs25.rmSync(specificDir, { recursive: true, force: true });
           setState({ status: "success" });
         } catch (err) {
           setState({
@@ -191679,13 +192090,13 @@ function logoutCommand() {
 var program = new Command();
 var env = "production";
 var envLabel = env !== "production" ? `[${env.toUpperCase()}] ` : "";
-program.name("specific").description(`${envLabel}Infrastructure-as-code for coding agents`).version("0.1.47").enablePositionalOptions();
-program.command("init").description("Initialize project for use with a coding agent").action(initCommand);
+program.name("specific").description(`${envLabel}Infrastructure-as-code for coding agents`).version("0.1.49").enablePositionalOptions();
+program.command("init").description("Initialize project for use with a coding agent").option("--agent <name...>", "Agents to configure (cursor, claude, codex, other)").action((options2) => initCommand(options2));
 program.command("docs [topic]").description("Fetch LLM-optimized documentation").action(docsCommand);
 program.command("check").description("Validate specific.hcl configuration").action(checkCommand);
-program.command("dev").description("Start local development environment").option("-k, --key <key>", "Namespace for isolated dev environment (auto-detected from git worktree if not specified)").action((options2) => {
+program.command("dev").description("Start local development environment").option("-k, --key <key>", "Namespace for isolated dev environment (auto-detected from git worktree if not specified)").option("--tunnel", "Expose public services via localtunnel URLs").action((options2) => {
   const key = options2.key ?? getDefaultKey();
-  devCommand(key);
+  devCommand(key, options2.tunnel ?? false);
 });
 program.command("deploy [environment]").description("Deploy to Specific infrastructure").option("--skip-build-test", "Skip local build testing before deploy").action((environment, options2) => {
   deployCommand(environment, options2);
@@ -191695,9 +192106,10 @@ program.command("exec <service> [args...]").description("Run a one-off command w
   const key = options2.key ?? getDefaultKey();
   await execCommand(service, filteredArgs, key);
 });
-program.command("psql [database]").description("Connect to a running Postgres database").option("-k, --key <key>", "Dev environment namespace (auto-detected from git worktree if not specified)").action((database, options2) => {
+program.command("psql [database] [args...]").description("Connect to a Postgres database").option("-k, --key <key>", "Dev environment namespace (auto-detected from git worktree if not specified)").passThroughOptions().action((database, args, options2) => {
+  const filteredArgs = args[0] === "--" ? args.slice(1) : args;
   const key = options2.key ?? getDefaultKey();
-  psqlCommand(database, key);
+  psqlCommand(database, key, filteredArgs);
 });
 program.command("clean").description("Remove .specific directory for a clean slate").option("-k, --key <key>", "Clean only the specified dev environment key").action((options2) => {
   cleanCommand(options2.key);