@stackbone/cli 0.5.2 → 0.5.4

package/CHANGELOG.md

@@ -7,6 +7,52 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.4] - 2026-10-01
+
+### Added
+
+- **`stackbone dev` says why the tunnel closed.** When `frpc` stops after the
+  tunnel came up, `stackbone dev` keeps running and prints the cause: the
+  ticket reached its 8-hour limit, the control plane revoked the grant, or
+  another cause, with the last lines `frpc` printed. Each message says to
+  restart `stackbone dev` for a new URL. Before, the tunnel closed without a
+  word (PLA-1892).
+
+### Changed
+
+- **`frpc` now sends the grant's signed ticket to the relay.** The ticket is
+  written to the `frpc` config as global metadata, with a heartbeat every 30
+  seconds so the relay sees it on every ping as well as on login. The shared
+  token is still sent. A control plane that mints no ticket still opens the
+  tunnel on the shared token alone (PLA-1892).
+
+### Fixed
+
+- **An expired tunnel grant could clear the tunnel URL of an unrelated
+  `stackbone dev` session.** The control plane matched a lapsed grant to local
+  installations by searching their URL text for its subdomain, so one grant
+  could null another session's URL, in any organization. `stackbone dev` now
+  registers its local-dev installation before the tunnel opens, or registers it
+  again when the id in `.stackbone/project.json` no longer resolves, and sends
+  that id with the grant request. The control plane writes the tunnel URL when
+  it mints the grant and clears it on revoke or expiry, so the CLI no longer
+  PATCHes the URL on start or on Ctrl-C. If no installation can be registered,
+  the tunnel still opens, with an unbound grant (PLA-1691).
+
+- **`stackbone logs --since 5` read the number as a date in 2001 and filtered
+  nothing.** A bare number is a duration with the unit forgotten; `--since`
+  and `--until` now reject it and suggest one, e.g. `5m` (PLA-1796).
+
+## [0.5.3] - 2026-09-25
+
+### Fixed
+
+- **`stackbone dev` failed at `Starting docker services` with `401 UNAUTHORIZED`
+  from quay.io.** MinIO closed anonymous pulls of `minio/minio` there too, after
+  Docker Hub. The compose files `stackbone dev` and `stackbone package` write now
+  pull the community fork `pgsty/minio:RELEASE.2026-08-04T00-00-00Z`, which needs
+  no account (PLA-1794).
+
 ## [0.5.2] - 2026-09-23
 
 ### Fixed

package/README.md

@@ -1,6 +1,6 @@
 # @stackbone/cli
 
-The CLI for [Stackbone](https://stackbone.ai) — the marketplace and runtime for containerized AI agents.
+The CLI for [Stackbone](https://stackbone.ai): scaffold, run and deploy agents and workflows written in TypeScript, on Stackbone Cloud or your own infrastructure.
 
 > **Status:** `alpha`. The contract may break between releases. Pin a version or rely on the `alpha` dist-tag.
 
@@ -15,7 +15,7 @@ cd my-workspace && npm install
 npx @stackbone/cli dev
 ```
 
-That's it. `init` scaffolds a new workspace shell (agents + workflows + coding-agent skills) and links it to your organization, so you sign in first; `dev` boots the whole workspace locally — Postgres, Redis, MinIO and Stackbone Studio at `http://localhost:4242` — so you can iterate without publishing.
+That's it. `init` scaffolds a new workspace shell (agents + workflows + coding-agent skills) and links it to your organization, so you sign in first; `dev` boots the whole workspace locally (Postgres, Redis, MinIO and Stackbone Studio at `http://localhost:4242`) so you can iterate before you deploy.
 
 ## Commands
 
@@ -45,7 +45,7 @@ Run any command with `--help` for the full flag reference. The full documentatio
 ## Links
 
 - Documentation: <https://docs.stackbone.ai>
-- Marketplace: <https://stackbone.ai>
+- Website: <https://stackbone.ai>
 - Issues & feedback: contact the team directly.
 
 ## License

package/main.js

@@ -9,7 +9,7 @@ import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep }
 import semver from "semver";
 import pino from "pino";
 import pretty from "pino-pretty";
-import { exec, execFile, spawn, spawnSync } from "node:child_process";
+import { execFile, spawn, spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
@@ -37,9 +37,9 @@ import { BinaryReader, BinaryWriter } from "@bufbuild/protobuf/wire";
 import PgQueryFactory from "pg-query-emscripten";
 import { createRemoteJWKSet, errors, jwtVerify } from "jose";
 import { CLIENT_CAPABILITIES_META_KEY, McpServer, createMcpHandler, inputRequired, inputResponse } from "@modelcontextprotocol/server";
+import { COMPOSED_HANDLER } from "hono/utils/constants";
 import Ajv from "ajv/dist/2020.js";
 import addFormats from "ajv-formats";
-import { COMPOSED_HANDLER } from "hono/utils/constants";
 import { parse } from "yaml";
 import { Queue, Worker } from "bullmq";
 import Ajv$1 from "ajv";
@@ -2045,12 +2045,15 @@ var init_user_code = __esmMin((() => {
 		if (clean.length !== 8) return raw;
 		return `${clean.slice(0, 4)}-${clean.slice(4)}`;
 	};
-})), DEV_TUNNEL_GRANT_MAX_TTL_SECONDS, devTunnelGrantResponseSchema;
+})), DEV_TUNNEL_GRANT_HARD_CAP_SECONDS, DEV_TUNNEL_GRANT_MAX_TTL_SECONDS, buildCanonicalTunnelUrl, devTunnelGrantResponseSchema, devTunnelRevocationListResponseSchema;
 var init_dev_tunnel = __esmMin((() => {
 	init_organizations();
+	DEV_TUNNEL_GRANT_HARD_CAP_SECONDS = 480 * 60;
 	DEV_TUNNEL_GRANT_MAX_TTL_SECONDS = 86400;
+	buildCanonicalTunnelUrl = (subdomain, relayHost) => `https://${subdomain}.${relayHost}`;
 	z.object({
 		agentSlug: agentSlugSchema,
+		installationId: z.uuid().optional(),
 		ttlSeconds: z.number().int().positive().max(DEV_TUNNEL_GRANT_MAX_TTL_SECONDS, { message: `ttlSeconds must not exceed ${DEV_TUNNEL_GRANT_MAX_TTL_SECONDS}` }).optional()
 	});
 	z.object({ subdomain: z.string().min(8).max(64).regex(/^[a-z0-9-]+$/, "subdomain must be lowercase alphanumeric with optional hyphens") });
@@ -2059,8 +2062,18 @@ var init_dev_tunnel = __esmMin((() => {
 		relayPort: z.number().int().positive(),
 		subdomain: z.string().min(1),
 		frpcToken: z.string().min(1),
+		ticket: z.string().min(1),
 		expiresAt: z.iso.datetime()
 	});
+	devTunnelRevocationListResponseSchema = z.object({ revocationList: z.string().min(1) });
+	z.object({ keys: z.array(z.object({
+		kty: z.literal("OKP"),
+		crv: z.literal("Ed25519"),
+		x: z.string().min(1),
+		kid: z.string().min(1),
+		alg: z.literal("EdDSA"),
+		use: z.literal("sig")
+	})) });
 }));
 //#endregion
 //#region ../../libs/shared/validators/src/lib/studio/studio-config.ts
@@ -4846,7 +4859,7 @@ var maybeWarnCliUpgrade = (opts) => {
 	if (!required && !belowMinimum) return;
 	const channel = channelForVersion$1(cliVersion);
 	const target = minVersion ?? "the latest release";
-	logger.warn(`Your Stackbone CLI (${cliVersion}) is older than the minimum supported by the control plane (${target}). Upgrade with \`npm i -g @stackbone/cli@${channel}\`.`);
+	logger.warn(`Your Stackbone CLI (${cliVersion}) is older than the minimum supported by the control plane (${target}). Upgrade with \`pnpm add -g @stackbone/cli@${channel}\`.`);
 };
 //#endregion
 //#region src/infra/url.ts
@@ -4991,7 +5004,7 @@ var statusToError = (status, body) => {
 		default: code = "generic";
 	}
 	const inferredMessage = withIssueLines(typeof body === "object" && body !== null && "message" in body ? String(body.message) : `HTTP ${status}`, body);
-	const serverUpgrade = readUpgradeCommand(body) ?? "npm i -g @stackbone/cli";
+	const serverUpgrade = readUpgradeCommand(body) ?? "pnpm add -g @stackbone/cli";
 	const suggestion = code === "auth" ? "Run `stackbone login`" : code === "cli_upgrade_required" ? `Upgrade with \`${serverUpgrade}\`, then retry.` : void 0;
 	return new StackboneCliError({
 		code,
@@ -5273,7 +5286,7 @@ var formatUnsupportedPlatformBanner = (colors) => {
 		`    ${dim("•")} Git Bash: open a Git Bash terminal and re-run the command`,
 		`    ${dim("•")} WSL2:`,
 		`      ${dim("1.")} wsl --install -d Ubuntu          ${dim("# one-time, requires reboot")}`,
-		`      ${dim("2.")} (in the Ubuntu shell) pnpm install -g @stackbone/cli`,
+		`      ${dim("2.")} (in the Ubuntu shell) pnpm add -g @stackbone/cli`,
 		`      ${dim("3.")} stackbone <command>`,
 		""
 	].join("\n");
@@ -5391,7 +5404,7 @@ var isNewerVersion = (latest, current) => {
 	}
 };
 /** Discreet two-line banner, terminated with a newline. */
-var formatUpdateBanner = (current, latest, channel) => `\nA new release of the Stackbone CLI is available: ${current} → ${latest}\nUpgrade with: npm i -g @stackbone/cli@${channel}\n`;
+var formatUpdateBanner = (current, latest, channel) => `\nA new release of the Stackbone CLI is available: ${current} → ${latest}\nUpgrade with: pnpm add -g @stackbone/cli@${channel}\n`;
 var isSilenced = (opts) => {
 	const { env } = opts;
 	if (env["STACKBONE_NO_UPDATE_CHECK"]) return true;
@@ -15739,7 +15752,7 @@ var emulatorCors = (allowlist) => cors({
 var STACKBONE_CLI_BUILD_VERSION, EMULATOR_CAPABILITY_ROUTES, EMULATOR_CAPABILITIES, buildContractResponse;
 var init_contract = __esmMin((() => {
 	init_src$19();
-	STACKBONE_CLI_BUILD_VERSION = "0.5.2";
+	STACKBONE_CLI_BUILD_VERSION = "0.5.4";
 	EMULATOR_CAPABILITY_ROUTES = {
 		"database.postgres_direct": "/api/db",
 		"rag.basic": "/api/rag",
@@ -23226,7 +23239,7 @@ var renderStudioStub = (input) => {
     <li><b>GET</b> <a href="/api/docs">/api/docs</a> <span>· full API reference (Scalar, generated from this box's own route table)</span></li>
     <li><b>GET</b> <a href="/api/contract">/api/contract</a> <span>· Stackbone Agent Protocol handshake</span></li>
     <li><b>GET</b> <a href="/api/health">/api/health</a> <span>· emulator status</span></li>
-    <li><b>GET</b> <a href="/api/services">/api/services</a> <span>· postgres / s3 connection info</span></li>
+    <li><b>GET</b> <a href="/api/services">/api/services</a> <span>· postgres / s3 endpoints, password removed (a deployed box asks for a credential)</span></li>
     <li><b>GET</b> <a href="/api/discovery">/api/discovery</a> <span>· deep agents + workflows in this workspace</span></li>
     <li><b>POST</b> <code>/openai/v1/chat/completions</code> <span>· chat with a deep agent (OpenAI-compatible; pick the agent via <code>model</code>)</span></li>
     <li><b>POST</b> <code>/anthropic/v1/messages</code> <span>· chat with a deep agent (Anthropic-compatible)</span></li>
@@ -23239,19 +23252,71 @@ var renderStudioStub = (input) => {
   <h2>Try it</h2>
   <p>Chat with a deep agent from any OpenAI-compatible client — paste this base URL + any bearer key, and select the agent by its name in the <code>model</code> field:</p>
   <p><code>curl -N -X POST ${e(input.emulatorUrl)}/openai/v1/chat/completions -H 'content-type: application/json' -H 'authorization: Bearer dev' -d '{"model":"&lt;name&gt;","messages":[{"role":"user","content":"hi"}],"stream":true}'</code></p>
-
-  <h2>Connections</h2>
-  <ul>
-    <li><b>Postgres</b> <span>· ${e(input.postgresUrl)}</span></li>
-    <li><b>S3 (MinIO)</b> <span>· ${e(input.s3Endpoint)}</span></li>
-    <li><b>Agent</b> <span>· ${e(input.agentUrl)}</span></li>
-  </ul>
 </main>
 </body>
 </html>
 `;
 };
 //#endregion
+//#region ../../libs/runtime/workspace-runtime/src/lib/db/postgres-dsn.ts
+/** Query parameters libpq reads a password from. */
+var PASSWORD_PARAM = /^(ssl)?password=/i;
+/**
+* The DSN without the userinfo password and the `password` / `sslpassword`
+* query parameters; everything else stays byte for byte.
+*
+* Answers `''` when `URL` cannot parse it (a multi-host DSN) or misread the
+* userinfo (an unencoded `#`, `?` or `/` in the password), since the password
+* would survive in the raw string.
+*/
+var withoutPostgresPassword = (dsn) => {
+	const url = URL.parse(dsn);
+	if (url === null || url.username === "" && dsn.includes("@")) return "";
+	url.password = "";
+	url.search = url.search.slice(1).split("&").filter((pair) => !PASSWORD_PARAM.test(pair)).join("&");
+	return url.toString();
+};
+//#endregion
+//#region ../../libs/runtime/workspace-runtime/src/lib/http/require-capability.ts
+var CAPABILITY_NATURE, CAPABILITY_GATE, requireCapability, capabilityGateOf, identityHolds;
+var init_require_capability = __esmMin((() => {
+	init_box_auth_gate();
+	CAPABILITY_NATURE = {
+		"activity:read": "read",
+		"db:query": "read",
+		"logs:read": "read",
+		"secrets:reveal": "read",
+		"api-keys:manage": "write",
+		"config:write": "write",
+		"connections:manage": "write",
+		"evals:run": "write",
+		"hitl:decide": "write",
+		"rag:write": "write",
+		"runs:invoke": "write",
+		"secrets:rotate": "write"
+	};
+	CAPABILITY_GATE = Symbol("stackbone.capabilityGate");
+	requireCapability = (capability) => {
+		const gate = async (c, next) => {
+			const identity = readVerifiedIdentity(c);
+			if (!identity) return next();
+			if (!identityHolds(identity, capability)) return c.json({
+				code: "forbidden",
+				message: `This action requires the ${capability} capability.`
+			}, 403);
+			return next();
+		};
+		return Object.assign(gate, { [CAPABILITY_GATE]: capability });
+	};
+	capabilityGateOf = (handler) => {
+		if (typeof handler !== "function") return void 0;
+		if (CAPABILITY_GATE in handler) return handler[CAPABILITY_GATE];
+		const composed = handler[COMPOSED_HANDLER];
+		return composed === void 0 ? void 0 : capabilityGateOf(composed);
+	};
+	identityHolds = (identity, capability) => identity.caps?.includes(capability) ?? false;
+}));
+//#endregion
 //#region ../../libs/runtime/workspace-runtime/src/lib/agent-contract/log-tail.ts
 init_src$19();
 function recordMatchesFilters(record, filters) {
@@ -25325,6 +25390,7 @@ var SimulatedMailbox = class {
 			from: draft.from,
 			to: [...draft.to],
 			body: draft.body,
+			headers: [...draft.headers ?? []],
 			receivedAt: this.now().toISOString()
 		};
 		const sent = this.runs.get(runId) ?? [];
@@ -25423,7 +25489,8 @@ var OutlookDouble = class {
 			from: mailboxOwner(args),
 			to: recipients,
 			subject: textOf(message["subject"]),
-			body: bodyContent(message["body"])
+			body: bodyContent(message["body"]),
+			headers: internetHeaders(message["internetMessageHeaders"])
 		});
 		return {
 			ok: true,
@@ -25446,7 +25513,8 @@ var OutlookDouble = class {
 			from: mailboxOwner(args),
 			to: [parent.from],
 			subject: replySubject(parent.subject),
-			body
+			body,
+			headers: internetHeaders(draft["internetMessageHeaders"])
 		});
 		return {
 			ok: true,
@@ -25486,9 +25554,18 @@ function toGraphMessage(message) {
 		},
 		from: { emailAddress: { address: message.from } },
 		toRecipients: message.to.map((address) => ({ emailAddress: { address } })),
-		receivedDateTime: message.receivedAt
+		receivedDateTime: message.receivedAt,
+		internetMessageHeaders: message.headers.length > 0 ? message.headers.map((h) => ({ ...h })) : null
 	};
 }
+/** `[{ name, value }]` → the headers, dropping malformed entries. */
+function internetHeaders(value) {
+	if (!Array.isArray(value)) return [];
+	return value.map((entry) => ({
+		name: textOf(asObject$2(entry)["name"]),
+		value: textOf(asObject$2(entry)["value"])
+	})).filter((header) => header.name !== "");
+}
 /**
 * Whose mailbox this is: Graph names it in the `{user-id}` path segment, so the
 * double sends AS that address, the way the real provider would.
@@ -26037,46 +26114,6 @@ var isMutationOutsideCatalog = (method, path) => matches(MUTATIONS_OUTSIDE_CATAL
 /** Whether `method`+`path` is a read that happens to travel as POST. Exact, never a prefix. */
 var isPostShapedRead = (method, path) => matches(POST_SHAPED_READS, method, path);
 //#endregion
-//#region ../../libs/runtime/workspace-runtime/src/lib/http/require-capability.ts
-var CAPABILITY_NATURE, CAPABILITY_GATE, requireCapability, capabilityGateOf, identityHolds;
-var init_require_capability = __esmMin((() => {
-	init_box_auth_gate();
-	CAPABILITY_NATURE = {
-		"activity:read": "read",
-		"db:query": "read",
-		"logs:read": "read",
-		"secrets:reveal": "read",
-		"api-keys:manage": "write",
-		"config:write": "write",
-		"connections:manage": "write",
-		"evals:run": "write",
-		"hitl:decide": "write",
-		"rag:write": "write",
-		"runs:invoke": "write",
-		"secrets:rotate": "write"
-	};
-	CAPABILITY_GATE = Symbol("stackbone.capabilityGate");
-	requireCapability = (capability) => {
-		const gate = async (c, next) => {
-			const identity = readVerifiedIdentity(c);
-			if (!identity) return next();
-			if (!identityHolds(identity, capability)) return c.json({
-				code: "forbidden",
-				message: `This action requires the ${capability} capability.`
-			}, 403);
-			return next();
-		};
-		return Object.assign(gate, { [CAPABILITY_GATE]: capability });
-	};
-	capabilityGateOf = (handler) => {
-		if (typeof handler !== "function") return void 0;
-		if (CAPABILITY_GATE in handler) return handler[CAPABILITY_GATE];
-		const composed = handler[COMPOSED_HANDLER];
-		return composed === void 0 ? void 0 : capabilityGateOf(composed);
-	};
-	identityHolds = (identity, capability) => identity.caps?.includes(capability) ?? false;
-}));
-//#endregion
 //#region ../../libs/runtime/workspace-runtime/src/lib/server/route-registry-generation.ts
 var generations = /* @__PURE__ */ new WeakMap();
 /** The generation `app`'s registry is at. Zero until something bumps it. */
@@ -72090,6 +72127,7 @@ init_invocation_guard();
 init_well_known();
 init_contract();
 init_error_boundary();
+init_require_capability();
 init_route_helpers();
 init_resource_ledger();
 init_teardown_order();
@@ -72137,11 +72175,12 @@ var SUBSYSTEM_HEALTH = named("SubsystemHealth", z.object({
 * spell out (a shape a SECOND author reads goes to `@stackbone/validators` beside
 * its surface) has nothing to bind here.
 *
-* The secret key is deliberately NOT in it: `s3SecretKey` is on the endpoints
-* object this reads from, and the answer carries the access key alone.
+* No secret is in it. `s3SecretKey` is on the endpoints object this reads from,
+* and the answer carries the access key alone; the Postgres DSN goes out through
+* {@link withoutPostgresPassword} (PLA-1754).
 */
 var boxServicesSchema = z.object({
-	postgres: z.object({ url: z.string().openapi({ description: "The Postgres DSN the agent was given, credentials included. Under `stackbone dev` it points at the local stack; on a deployed box it is whatever the operator configured." }) }),
+	postgres: z.object({ url: z.string().openapi({ description: "The Postgres DSN the agent was given, with the password removed. Under `stackbone dev` it points at the local stack; on a deployed box it is whatever the operator configured. Empty when the box cannot tell where a password in it ends." }) }),
 	storage: z.object({
 		endpoint: z.string().openapi({ description: "The S3-compatible endpoint the agent writes to." }),
 		bucket: z.string(),
@@ -72190,10 +72229,7 @@ var buildEmulatorApp = (opts, hooks = {}) => {
 	app.get("/", (c) => c.html(renderStudioStub({
 		agentSlug: opts.agent.slug,
 		agentName: opts.agent.name,
-		emulatorUrl: ctx.emulatorBaseUrl,
-		agentUrl: ctx.agentBaseUrl,
-		postgresUrl: opts.injection.services.postgresUrl,
-		s3Endpoint: opts.injection.services.s3Endpoint
+		emulatorUrl: new URL(c.req.url).origin
 	})));
 	const hostKind = opts.host;
 	app.openapi(createRoute({
@@ -72258,15 +72294,20 @@ var buildEmulatorApp = (opts, hooks = {}) => {
 			checks
 		}, 503);
 	});
+	const servicesPostgresUrl = withoutPostgresPassword(opts.injection.services.postgresUrl);
 	app.openapi(createRoute({
 		method: "get",
 		path: "/api/services",
 		tags: [LIFECYCLE_TAG],
+		middleware: [requireCapability("db:query")],
 		summary: "Injected service endpoints",
-		description: "The Postgres, object-storage and agent-process endpoints this box injected into the agent, read back. A creator uses it to point `psql` or an S3 client at the same stack their agent is running against. The storage SECRET key is not in the answer; the access key is.",
-		responses: { 200: jsonResponse(boxServicesSchema, "The endpoints this box handed the agent.") }
+		description: "The Postgres, object-storage and agent-process endpoints this box injected into the agent, read back. A creator uses it to point `psql` or an S3 client at the same stack their agent is running against. No secret is in the answer: the Postgres password is removed from the DSN, and the storage secret key is left out (the access key is in).",
+		responses: {
+			200: jsonResponse(boxServicesSchema, "The endpoints this box handed the agent."),
+			403: errorResponse("The caller's role does not grant `db:query`. Only a browser-direct identity token carries a role; a signed call and the self-host operator token are not checked against one.")
+		}
 	}), (c) => c.json({
-		postgres: { url: opts.injection.services.postgresUrl },
+		postgres: { url: servicesPostgresUrl },
 		storage: {
 			endpoint: opts.injection.services.s3Endpoint,
 			bucket: opts.injection.services.s3Bucket,
@@ -73665,7 +73706,7 @@ var createAddCommand = defineGroup({
 		}),
 		workflow: defineVerb({
 			name: "workflow",
-			description: "Add a durable workflow (dev-only; never touches the control plane).",
+			description: "Add a durable workflow to the current workspace (offline scaffold).",
 			args: {
 				name: {
 					type: "positional",
@@ -76803,8 +76844,15 @@ var REDIS_IMAGE$1 = "redis:7-alpine";
 *
 * Same image and pin as `stackbone dev`'s compose, so the emulator and the
 * deliverable run the identical backend.
+*
+* The community fork, not `minio/minio`. MinIO closed anonymous pulls of its own
+* image on Docker Hub (2026-09-12, PLA-1423) and then on quay.io (401 on every
+* tag by 2026-09-25, PLA-1794). A first-run `stackbone dev`, and the operator
+* running a packaged folder, pull with no credentials. `pgsty/minio` publishes
+* amd64 + arm64, keeps the upstream entrypoint and ships `mc` and `sh`, which the
+* healthcheck and the bucket-init container call.
 */
-var MINIO_IMAGE$1 = "quay.io/minio/minio:RELEASE.2025-03-12T18-04-18Z";
+var MINIO_IMAGE = "pgsty/minio:RELEASE.2026-08-04T00-00-00Z";
 /** Access key the bundled MinIO is created with. The secret is generated per package. */
 var MINIO_ACCESS_KEY = "stackbone";
 /** Bucket the init container creates, and the agent's `STACKBONE_S3_BUCKET`. */
@@ -76902,7 +76950,7 @@ var renderInfraServices = () => `  postgres:
   minio:
     # S3-compatible object storage: the agent's own files (\`client.storage\`), the
     # originals managed RAG ingests, and what Studio's file browser lists.
-    image: ${MINIO_IMAGE$1}
+    image: ${MINIO_IMAGE}
     command: ['server', '/data']
     environment:
       MINIO_ROOT_USER: ${MINIO_ACCESS_KEY}
@@ -76945,7 +76993,7 @@ var renderInfraServices = () => `  postgres:
     # alphabet contains \`-\`, so about one packaged folder in 64 minted one. One
     # of them took \`next\` red on 2026-08-31 (run 33430510314) on a
     # comments-only commit.
-    image: ${MINIO_IMAGE$1}
+    image: ${MINIO_IMAGE}
     restart: 'no'
     depends_on:
       minio:
@@ -80114,11 +80162,23 @@ var EVAL_RUN_SCREEN_PATH = "/studio/eval-runs";
 /**
 * Which Studio a given control plane belongs to.
 *
-* One ternary, in one place: `stackbone dev` prints it in its banner and
+* One resolver, in one place: `stackbone dev` prints it in its banner and
 * `stackbone eval` prints it beside a run's result, and two copies would drift
 * the first time either host changed.
+*
+* `STACKBONE_WEB_URL` (the web origin, no `/app`) wins when set, even against a
+* cloud API: `scripts/worktree-env.sh` exports it next to `WEB_PORT`, because a
+* worktree with a port offset serves its web on `4200 + offset*10` and the
+* literal 4200 would open another checkout's web. The `STACKBONE_` prefix keeps
+* it apart from an `APP_URL` a creator's workspace `.env` defines for its own
+* app. Unset, a local control plane maps to `localhost:4200`, anything else to
+* the cloud Studio.
 */
-var resolveStudioBaseUrl = (apiUrl) => apiUrl.includes("localhost") ? "http://localhost:4200/app" : "https://app.stackbone.ai/app";
+var resolveStudioBaseUrl = (apiUrl, env = {}) => {
+	const webUrl = env["STACKBONE_WEB_URL"]?.trim().replace(/\/+$/, "");
+	if (webUrl) return `${webUrl}/app`;
+	return apiUrl.includes("localhost") ? "http://localhost:4200/app" : "https://app.stackbone.ai/app";
+};
 /**
 * The link to one eval run, with NO `?stackbone-dev=` pin.
 *
@@ -80173,7 +80233,6 @@ var readStackboneConfig = async (cwd) => readJsonFile(stackboneConfigPath(cwd),
 //#region src/dev/compose-template.ts
 var POSTGRES_IMAGE = "pgvector/pgvector:pg17";
 var REDIS_IMAGE = "redis:7-alpine";
-var MINIO_IMAGE = "quay.io/minio/minio:RELEASE.2025-03-12T18-04-18Z";
 var PGVECTOR_INIT_SQL = `-- Generated by stackbone dev. Runs once on Postgres first boot via
 -- /docker-entrypoint-initdb.d. The queue extension is gone (BullMQ over Redis
 -- is the only job engine); only pgvector is enabled here.
@@ -81827,7 +81886,13 @@ var getAgentByOwnerAndSlug = async (ctx, ownerOrgSlug, templateSlug) => {
 init_src$19();
 var GRANT_PATH = "/api/dev-tunnel/grants";
 var DEFAULT_STATUS_URL = "https://status.stackbone.ai";
-var REVOKE_TIMEOUT_MS = 3e3;
+var SIDE_CALL_TIMEOUT_MS = 3e3;
+var REVOCATIONS_PATH = "/api/dev-tunnel/revocations";
+var cliHeaders = (cliVersion) => ({
+	Accept: "application/json",
+	"User-Agent": `stackbone-cli/${cliVersion}`
+});
+var cliGrantResponseSchema = devTunnelGrantResponseSchema.extend({ ticket: devTunnelGrantResponseSchema.shape.ticket.optional() });
 /** Relay status page from the canonical envelope. */
 var readRelayStatusUrl = (body) => {
 	if (typeof body !== "object" || body === null) return null;
@@ -81849,17 +81914,17 @@ var requestDevTunnelGrant = async (input) => {
 	const url = composeUrl(input.ctx.apiUrl, GRANT_PATH);
 	const body = {
 		agentSlug: input.agentSlug,
-		...input.ttlSeconds !== void 0 ? { ttlSeconds: input.ttlSeconds } : {}
+		...input.ttlSeconds !== void 0 ? { ttlSeconds: input.ttlSeconds } : {},
+		...input.installationId !== void 0 ? { installationId: input.installationId } : {}
 	};
 	let response;
 	try {
 		response = await fetchImpl(url, {
 			method: "POST",
 			headers: {
+				...cliHeaders(input.ctx.cliVersion),
 				"Content-Type": "application/json",
-				Accept: "application/json",
-				Authorization: `Bearer ${session.session.token}`,
-				"User-Agent": `stackbone-cli/${input.ctx.cliVersion}`
+				Authorization: `Bearer ${session.session.token}`
 			},
 			body: JSON.stringify(body)
 		});
@@ -81904,7 +81969,7 @@ var requestDevTunnelGrant = async (input) => {
 		message: `Unexpected ${response.status} response from ${GRANT_PATH}`,
 		cause: parsedBody
 	});
-	return parseResponse$1(devTunnelGrantResponseSchema, parsedBody, GRANT_PATH);
+	return parseResponse$1(cliGrantResponseSchema, parsedBody, GRANT_PATH);
 };
 var revokeDevTunnelGrant = async (input) => {
 	const session = await input.ctx.tokenStore.activeSession(input.ctx.apiUrl).catch(() => null);
@@ -81919,11 +81984,10 @@ var revokeDevTunnelGrant = async (input) => {
 		response = await fetchImpl(url, {
 			method: "DELETE",
 			headers: {
-				Accept: "application/json",
-				Authorization: `Bearer ${session.session.token}`,
-				"User-Agent": `stackbone-cli/${input.ctx.cliVersion}`
+				...cliHeaders(input.ctx.cliVersion),
+				Authorization: `Bearer ${session.session.token}`
 			},
-			signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+			signal: AbortSignal.timeout(SIDE_CALL_TIMEOUT_MS)
 		});
 	} catch (err) {
 		input.ctx.logger.warn({
@@ -81940,9 +82004,29 @@ var revokeDevTunnelGrant = async (input) => {
 		subdomain: input.subdomain
 	}, "Unexpected response while revoking dev-tunnel grant (slot will free on TTL)");
 };
+var fetchDevTunnelRevocationList = async (input) => {
+	const fetchImpl = input.fetchImpl ?? fetch;
+	const url = composeUrl(input.ctx.apiUrl, REVOCATIONS_PATH);
+	try {
+		const response = await fetchImpl(url, {
+			method: "GET",
+			headers: cliHeaders(input.ctx.cliVersion),
+			signal: AbortSignal.timeout(SIDE_CALL_TIMEOUT_MS)
+		});
+		if (!response.ok) {
+			input.ctx.logger.debug({ status: response.status }, "dev-tunnel revocation list request was not answered 200");
+			return null;
+		}
+		const parsed = devTunnelRevocationListResponseSchema.safeParse(await response.json());
+		return parsed.success ? parsed.data.revocationList : null;
+	} catch (err) {
+		input.ctx.logger.debug({ err }, "Could not fetch the dev-tunnel revocation list");
+		return null;
+	}
+};
 //#endregion
 //#region src/dev/frpc-bin.ts
-var execp = promisify(exec);
+var execFilep = promisify(execFile);
 var PINNED_FRPC_VERSION = "0.68.1";
 var assetForPlatform = (platform, arch) => {
 	const version = PINNED_FRPC_VERSION;
@@ -81991,9 +82075,27 @@ var streamToFile = async (body, path) => {
 	});
 };
 var archiveStem = (asset) => asset.name.replace(/\.(tar\.gz|zip)$/, "");
+var psQuote = (value) => `'${value.replaceAll("'", "''")}'`;
+var extractCommand = (archive, archivePath, destDir) => archive === "tgz" ? {
+	file: "tar",
+	args: [
+		"-xzf",
+		archivePath,
+		"-C",
+		destDir
+	]
+} : {
+	file: "powershell",
+	args: [
+		"-NoProfile",
+		"-NonInteractive",
+		"-Command",
+		`Expand-Archive -LiteralPath ${psQuote(archivePath)} -DestinationPath ${psQuote(destDir)} -Force`
+	]
+};
 var extractTarball = async (archivePath, asset, destBinary) => {
-	if (asset.archive === "tgz") await execp(`tar -xzf "${archivePath}" -C "${cacheDir()}"`);
-	else await execp(`unzip -o -q "${archivePath}" -d "${cacheDir()}"`);
+	const { file, args } = extractCommand(asset.archive, archivePath, cacheDir());
+	await execFilep(file, args);
 	await rename(join(cacheDir(), archiveStem(asset), process.platform === "win32" ? "frpc.exe" : "frpc"), destBinary);
 };
 var resolveFrpcBin = async (input) => {
@@ -82016,24 +82118,27 @@ var resolveFrpcBin = async (input) => {
 	const archivePath = `${cached}.${asset.archive === "tgz" ? "tar.gz" : "zip"}`;
 	const s = spinner();
 	s.start(`Downloading frpc ${version} (${asset.name})`);
+	let stage = "download";
 	try {
 		const res = await fetch(url, { redirect: "follow" });
 		if (!res.ok || !res.body) throw new Error(`HTTP ${res.status} ${res.statusText} fetching ${url}`);
 		await streamToFile(res.body, archivePath);
+		stage = "extract";
 		await extractTarball(archivePath, asset, cached);
 		if (process.platform !== "win32") await chmod(cached, 493);
 		s.stop(`Downloaded frpc ${version}`);
 		return cached;
 	} catch (err) {
-		s.error("Failed to download frpc");
+		s.error(stage === "download" ? "Failed to download frpc" : "Failed to extract frpc");
 		await Promise.all([unlink(cached).catch(() => void 0), rm(join(cacheDir(), archiveStem(asset)), {
 			recursive: true,
 			force: true
 		}).catch(() => void 0)]);
+		const manualInstall = `download frp ${version} from https://github.com/fatedier/frp/releases, and put its frpc binary at ${cached} (or point STACKBONE_FRPC_BIN at it) before re-running.`;
 		throw new StackboneCliError({
 			code: "generic",
-			message: "Could not auto-fetch frpc",
-			suggestion: "Check your network, or install frpc manually from https://github.com/fatedier/frp/releases and point STACKBONE_FRPC_BIN at the binary before re-running.",
+			message: stage === "download" ? `Could not download frpc ${version}` : `Downloaded frpc ${version} but could not extract it`,
+			suggestion: stage === "download" ? `Check your network, or ${manualInstall}` : `Extract ${asset.name} by hand: ${manualInstall}`,
 			cause: err
 		});
 	} finally {
@@ -82109,10 +82214,85 @@ var clearLastTunnelGrant = async (projectRoot, logger) => {
 	}
 };
 //#endregion
+//#region src/dev/tunnel-drop.ts
+init_src$19();
+var BASE64URL_SEGMENT = /^[A-Za-z0-9_-]+$/;
+var decodeJwtPayload = (token) => {
+	const segments = token.split(".");
+	const payload = segments[1];
+	if (segments.length !== 3 || payload === void 0 || !BASE64URL_SEGMENT.test(payload)) return null;
+	try {
+		const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+		return typeof claims === "object" && claims !== null && !Array.isArray(claims) ? claims : null;
+	} catch {
+		return null;
+	}
+};
+var MAX_EPOCH_SECONDS = 1e10;
+var readTicketClaims = (ticket) => {
+	const claims = decodeJwtPayload(ticket);
+	if (!claims) return null;
+	const { jti, exp } = claims;
+	if (typeof jti !== "string" || jti.length === 0) return null;
+	if (typeof exp !== "number" || !Number.isFinite(exp) || exp <= 0 || exp >= MAX_EPOCH_SECONDS) return null;
+	return {
+		jti,
+		exp
+	};
+};
+var readRevokedIds = (revocationList) => {
+	const claims = decodeJwtPayload(revocationList);
+	return claims && Array.isArray(claims["revoked"]) ? claims["revoked"] : null;
+};
+var classifyTunnelDrop = async (input) => {
+	const claims = input.ticket === void 0 ? null : readTicketClaims(input.ticket);
+	if (!claims) return "other";
+	if (input.nowMs / 1e3 > claims.exp) return "cap";
+	const list = await input.fetchRevocationList();
+	return (list === null ? null : readRevokedIds(list))?.some((jti) => jti === claims.jti) ? "revoked" : "other";
+};
+var CAP_HOURS = DEV_TUNNEL_GRANT_HARD_CAP_SECONDS / 3600;
+var RESTART_HINT = "`stackbone dev` is still running, but its public URL no longer works. Restart `stackbone dev` to get a new URL.";
+var describeExit = (code, signal) => code !== null ? `code ${code}` : `signal ${signal ?? "unknown"}`;
+var describeCause = (input) => {
+	if (input.cause === "cap") return [`The dev tunnel closed: its ticket reached the ${CAP_HOURS}-hour limit.`];
+	if (input.cause === "revoked") return ["The dev tunnel closed: the control plane revoked its grant."];
+	const tail = input.lastOutput.trim();
+	return [`The dev tunnel closed: frpc exited with ${describeExit(input.code, input.signal)}.`, ...tail.length > 0 ? ["last frpc output:", tail] : []];
+};
+var reportTunnelDrop = async (input, code, signal) => {
+	const cause = await classifyTunnelDrop({
+		ticket: input.ticket,
+		nowMs: Date.now(),
+		fetchRevocationList: () => fetchDevTunnelRevocationList({ ctx: input.ctx })
+	}).catch(() => "other");
+	try {
+		const lines = describeCause({
+			cause,
+			code,
+			signal,
+			lastOutput: input.lastOutput()
+		});
+		input.ctx.logger.warn({
+			cause,
+			code,
+			signal
+		}, [...lines, RESTART_HINT].join("\n"));
+	} catch {}
+};
+var watchTunnelDrop = (input) => {
+	input.child.once("close", (code, signal) => {
+		if (input.isStopping()) return;
+		reportTunnelDrop(input, code, signal);
+	});
+};
+//#endregion
 //#region src/dev/tunnel.ts
+init_src$19();
 var STARTUP_TIMEOUT_MS = 3e4;
 var STOP_GRACE_MS = 3e3;
 var TAIL_BYTES = 4 * 1024;
+var FRPC_HEARTBEAT_INTERVAL_SECONDS = 30;
 var TUNNEL_HOST_SUFFIX = "tun.stackbone.ai";
 var TUNNEL_OPEN_DEFAULT_ATTEMPTS = 3;
 var TUNNEL_OPEN_DEFAULT_RETRY_DELAY_MS = 2500;
@@ -82125,13 +82305,21 @@ var frpcNotInstalledError = (cause) => new StackboneCliError({
 	suggestion: "Install frpc from https://github.com/fatedier/frp/releases, or set STACKBONE_FRPC_BIN to point at an existing binary. The tunnel is mandatory — there is no opt-out flag.",
 	cause
 });
+var frpcBlockedError = (binPath, cause) => new StackboneCliError({
+	code: "permission",
+	message: `The OS refused to run frpc (${binPath})`,
+	suggestion: process.platform === "win32" ? "Windows is blocking the binary. Unblock it (right-click > Properties > Unblock), check Smart App Control and Defender exclusions, or run the CLI from WSL2. See https://docs.stackbone.ai/docs/cli/guides/windows" : `Make it executable with \`chmod +x ${binPath}\`, or point STACKBONE_FRPC_BIN at a binary you can run.`,
+	cause
+});
 var buildFrpcConfig = (grant, targetUrl) => {
 	const port = targetUrl.port ? Number.parseInt(targetUrl.port, 10) : targetUrl.protocol === "https:" ? 443 : 80;
+	const ticketLines = grant.ticket === void 0 ? [] : [`transport.heartbeatInterval = ${FRPC_HEARTBEAT_INTERVAL_SECONDS}`, `metadatas.ticket = "${grant.ticket}"`];
 	return [
 		`serverAddr = "${grant.relayHost}"`,
 		`serverPort = ${grant.relayPort}`,
 		`auth.method = "token"`,
 		`auth.token = "${grant.frpcToken}"`,
+		...ticketLines,
 		"",
 		"[[proxies]]",
 		`name = "stackbone-dev-${grant.subdomain}"`,
@@ -82182,7 +82370,7 @@ var spawnFrpc = async (input) => {
 	child.once("exit", () => process.off("exit", killOnParentExit));
 	const tail = createTail();
 	const successRegex = /start proxy success/i;
-	const expectedPublicUrl = `https://${input.expectedSubdomain}.${TUNNEL_HOST_SUFFIX}`;
+	const expectedPublicUrl = buildCanonicalTunnelUrl(input.expectedSubdomain, TUNNEL_HOST_SUFFIX);
 	const publicUrl = await new Promise((resolve, reject) => {
 		const timer = setTimeout(() => {
 			child.kill("SIGINT");
@@ -82209,6 +82397,10 @@ var spawnFrpc = async (input) => {
 				reject(frpcNotInstalledError(err));
 				return;
 			}
+			if (err.code === "EACCES" || err.code === "EPERM") {
+				reject(frpcBlockedError(input.binPath, err));
+				return;
+			}
 			reject(new StackboneCliError({
 				code: "generic",
 				message: "frpc failed to start",
@@ -82235,7 +82427,8 @@ var spawnFrpc = async (input) => {
 	});
 	return {
 		child,
-		publicUrl
+		publicUrl,
+		lastOutput: () => tail.snapshot()
 	};
 };
 var stopChild = async (child) => {
@@ -82268,7 +82461,8 @@ var stopChild = async (child) => {
 * `auth_required`, `workspace_tunnel_cap_reached`, or
 * `tunnel_relay_unhealthy` to the thrown StackboneCliError before
 * propagation, and `spawnFrpc` adds the captured output tail when frpc
-* dies before opening the tunnel.
+* dies before opening the tunnel. A frpc exit after the tunnel is up never
+* throws: `watchTunnelDrop` logs its cause and the session keeps running.
 */
 var openDevTunnel = async (input) => {
 	const targetUrl = new URL(input.targetUrl);
@@ -82296,19 +82490,29 @@ var openDevTunnel = async (input) => {
 		try {
 			const grant = await requestDevTunnelGrant({
 				ctx: input.ctx,
-				agentSlug
+				agentSlug,
+				...input.installationId !== void 0 ? { installationId: input.installationId } : {}
 			});
 			await writeLastTunnelGrant(input.projectRoot, grant.subdomain, input.ctx.logger);
 			try {
-				const { child, publicUrl } = await spawnFrpc({
+				const { child, publicUrl, lastOutput } = await spawnFrpc({
 					binPath,
 					config: buildFrpcConfig(grant, targetUrl),
 					logger: input.ctx.logger,
 					expectedSubdomain: grant.subdomain
 				});
+				let stopping = false;
+				watchTunnelDrop({
+					child,
+					ctx: input.ctx,
+					ticket: grant.ticket,
+					lastOutput,
+					isStopping: () => stopping
+				});
 				return {
 					publicUrl,
 					stop: async () => {
+						stopping = true;
 						try {
 							await revokeDevTunnelGrant({
 								ctx: input.ctx,
@@ -82979,7 +83183,8 @@ var startDevSession = async (input) => {
 				tunnel = await openDevTunnel({
 					targetUrl: emulator.url,
 					ctx: input.ctx,
-					projectRoot: input.projectRoot
+					projectRoot: input.projectRoot,
+					...input.installationId !== void 0 ? { installationId: input.installationId } : {}
 				});
 				onStage({
 					stage: "tunnel",
@@ -83109,10 +83314,6 @@ init_src$19();
 var upsertLocalDevInstallation = async (ctx, body) => {
 	return parseResponse$1(localDevInstallationResponseSchema, await ctx.http.post("/api/v1/installations/local-dev", body), "POST /api/v1/installations/local-dev");
 };
-var patchLocalDevInstallation = async (ctx, id, body) => {
-	const path = `/api/v1/installations/local-dev/${encodeURIComponent(id)}`;
-	return parseResponse$1(localDevInstallationResponseSchema, await ctx.http.patch(path, body), `PATCH ${path}`);
-};
 var heartbeatLocalDevInstallation = async (ctx, id) => {
 	const path = `/api/v1/installations/local-dev/${encodeURIComponent(id)}/heartbeat`;
 	await ctx.http.post(path, {});
@@ -83435,6 +83636,62 @@ var printContract = (deps = {}) => {
 	writeStdout(`${JSON.stringify(payload)}\n`);
 };
 //#endregion
+//#region src/commands/dev/resolve-local-dev-installation.ts
+/**
+* - No stored id: register (upsert) and persist the id to project.json.
+* - A stored id: heartbeat it once. `not_found` means the row is gone (GC'd,
+*   dev DB wiped) or is not the caller's, so register again, once. Any other
+*   failure says nothing about the row: warn and keep the stored id.
+* - A failed registration warns and resolves no id instead of throwing.
+*/
+var resolveLocalDevInstallation = async (ctx, config, agent) => {
+	const linkedOrgSlug = async () => config.organizationSlug ?? (await getActiveOrganization(ctx)).slug;
+	const register = async () => {
+		let upserted;
+		try {
+			upserted = await upsertLocalDevInstallation(ctx, {
+				creatorOrganizationSlug: await linkedOrgSlug(),
+				agentTemplateSlug: agent.slug
+			});
+		} catch (err) {
+			ctx.logger.warn({ err: err.message }, "failed to register the local-dev installation, the tunnel opens unbound (continuing)");
+			return {
+				id: void 0,
+				orgSlug: config.organizationSlug
+			};
+		}
+		try {
+			await ctx.projectConfig.write({
+				...config,
+				localDevInstallationId: upserted.id,
+				organizationSlug: upserted.organizationSlug,
+				agentSlug: upserted.agentSlug
+			});
+		} catch (err) {
+			ctx.logger.warn({ err: err.message }, "registered the local-dev installation but could not persist its id to project.json (continuing)");
+		}
+		return {
+			id: upserted.id,
+			orgSlug: upserted.organizationSlug
+		};
+	};
+	const storedId = config.localDevInstallationId;
+	if (!storedId) return register();
+	try {
+		await heartbeatLocalDevInstallation(ctx, storedId);
+	} catch (err) {
+		if (err instanceof StackboneCliError && err.code === "not_found") {
+			ctx.logger.warn("local-dev row not found, re-registering");
+			return register();
+		}
+		ctx.logger.warn({ err: err.message }, "local-dev pre-flight heartbeat failed, keeping the stored id (continuing)");
+	}
+	return {
+		id: storedId,
+		orgSlug: await linkedOrgSlug()
+	};
+};
+//#endregion
 //#region src/commands/dev/dev.command.ts
 init_src$19();
 var STAGE_LABELS = {
@@ -83546,6 +83803,7 @@ var buildHandler$2 = (ctx, flags) => protectedCommand(async (innerCtx) => {
 		suggestion: "Run `stackbone link --force --agent <slug> --installation <installationId> --url <url> --secret <secret> --tag <tag>` to re-link to a different agent (see `stackbone link --help`)"
 	});
 	await assertSdkCompatible(innerCtx, { mode: "warn" });
+	const { id: localDevId, orgSlug: installationOrgSlug } = await resolveLocalDevInstallation(innerCtx, config, agent);
 	const renderStage = innerCtx.flags.json ? null : createStageRenderer();
 	const renderReload = innerCtx.flags.json ? null : createReloadRenderer();
 	let republishPointer = null;
@@ -83559,6 +83817,7 @@ var buildHandler$2 = (ctx, flags) => protectedCommand(async (innerCtx) => {
 		},
 		emulatorPort: flags.port,
 		tunnel: true,
+		...localDevId ? { installationId: localDevId } : {},
 		listen: flags.listen,
 		verbose: flags.verbose,
 		...flags.autoMigrate !== void 0 ? { autoMigrateOverride: flags.autoMigrate } : {},
@@ -83570,48 +83829,6 @@ var buildHandler$2 = (ctx, flags) => protectedCommand(async (innerCtx) => {
 		}
 	});
 	declaredPieces = session.declaredPieces;
-	const registerLocalDev = async () => {
-		const upserted = await upsertLocalDevInstallation(innerCtx, {
-			creatorOrganizationSlug: config.organizationSlug ?? (await getActiveOrganization(innerCtx)).slug,
-			agentTemplateSlug: agent.slug
-		});
-		await innerCtx.projectConfig.write({
-			...config,
-			localDevInstallationId: upserted.id,
-			organizationSlug: upserted.organizationSlug,
-			agentSlug: upserted.agentSlug
-		});
-		return {
-			id: upserted.id,
-			orgSlug: upserted.organizationSlug
-		};
-	};
-	let localDevId = config.localDevInstallationId;
-	let installationOrgSlug = config.organizationSlug;
-	if (!localDevId) {
-		const registered = await registerLocalDev();
-		localDevId = registered.id;
-		installationOrgSlug = registered.orgSlug;
-	} else if (!installationOrgSlug) installationOrgSlug = (await getActiveOrganization(innerCtx)).slug;
-	const publicUrl = session.publicUrl;
-	if (publicUrl) {
-		const patchTunnel = (id) => patchLocalDevInstallation(innerCtx, id, { localTunnelUrl: publicUrl });
-		const patched = await patchTunnel(localDevId).catch(async (err) => {
-			if (err instanceof StackboneCliError && err.code === "not_found") {
-				innerCtx.logger.warn("local-dev row not found, re-registering");
-				const registered = await registerLocalDev();
-				localDevId = registered.id;
-				installationOrgSlug = registered.orgSlug;
-				return patchTunnel(localDevId).catch((retryErr) => {
-					innerCtx.logger.warn({ err: retryErr.message }, "failed to PATCH local-dev tunnel URL after re-register (continuing)");
-					return null;
-				});
-			}
-			innerCtx.logger.warn({ err: err.message }, "failed to PATCH local-dev tunnel URL (continuing)");
-			return null;
-		});
-		if (patched) installationOrgSlug = patched.organizationSlug;
-	}
 	if (localDevId) {
 		const installId = localDevId;
 		const startedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -83627,7 +83844,7 @@ var buildHandler$2 = (ctx, flags) => protectedCommand(async (innerCtx) => {
 		}, innerCtx.logger);
 		await republishPointer();
 	}
-	const studioBaseUrl = resolveStudioBaseUrl(innerCtx.apiUrl);
+	const studioBaseUrl = resolveStudioBaseUrl(innerCtx.apiUrl, innerCtx.env);
 	const linkTo = (screenPath) => studioDeeplink({
 		studioBaseUrl,
 		orgSlug: installationOrgSlug,
@@ -83691,15 +83908,7 @@ var buildHandler$2 = (ctx, flags) => protectedCommand(async (innerCtx) => {
 	const sigintHandler = () => {
 		if (heartbeatTimer) clearInterval(heartbeatTimer);
 		shutdownAndExit(async () => {
-			const patch = localDevId ? patchLocalDevInstallation(innerCtx, localDevId, { localTunnelUrl: null }).catch((err) => {
-				innerCtx.logger.debug({ err: err.message }, "failed to null local-dev tunnel URL on exit (safety net will catch up)");
-				return null;
-			}) : Promise.resolve(null);
-			await Promise.allSettled([
-				patch,
-				session.stop(),
-				clearDevSession(projectRoot, innerCtx.logger)
-			]);
+			await Promise.allSettled([session.stop(), clearDevSession(projectRoot, innerCtx.logger)]);
 			goodbye();
 		}, { onForced: () => {
 			if (!innerCtx.flags.json) log.warn("Shutdown did not finish in time — leaving anyway.");
@@ -84370,7 +84579,7 @@ var runEval = async (ctx, args, deps = {}) => {
 	};
 	const launched = await launch(callCtx, basePath, suite.id, body);
 	const url = evalRunUrl({
-		studioBaseUrl: resolveStudioBaseUrl(ctx.apiUrl),
+		studioBaseUrl: resolveStudioBaseUrl(ctx.apiUrl, ctx.env),
 		orgSlug,
 		installationId,
 		evalRunId: launched.id
@@ -86375,16 +86584,29 @@ var parseLimit = (raw) => {
 * a relative duration (`15m`, `2h`, `30s`, `1d`) measured back from `now`, or an
 * absolute ISO timestamp. Returns `undefined` when the flag is absent. A value
 * that is neither a known duration nor a parseable date is a CLI-side error.
+*
+* A bare number is rejected before `Date.parse`, which would read it as a date
+* (`5` is April 2001, `2026` is 2026-01-01) and leave the window filtering
+* nothing. It is a duration with the unit forgotten.
 */
 var parseTimeBound = (flag, raw, now) => {
 	if (raw === void 0) return void 0;
-	const duration = /^(\d+)(s|m|h|d)$/.exec(raw.trim());
+	const trimmed = raw.trim();
+	const duration = /^(\d+)(s|m|h|d)$/.exec(trimmed);
 	if (duration) return now - Number(duration[1]) * ({
 		s: 1e3,
 		m: 6e4,
 		h: 36e5,
 		d: 864e5
 	}[duration[2] ?? ""] ?? 0);
+	if (/^[+-]?(\d+\.?\d*|\.\d+)$/.test(trimmed)) {
+		const example = /^\d+$/.test(trimmed) ? `${trimmed}m` : "15m";
+		throw new StackboneCliError({
+			code: "generic",
+			message: `Invalid ${flag} '${raw}'. A duration needs a unit: s, m, h or d.`,
+			suggestion: `Pass e.g. \`${flag} ${example}\`, or an ISO timestamp such as \`${flag} 2026-05-22T00:00:00Z\`.`
+		});
+	}
 	const ms = Date.parse(raw);
 	if (Number.isNaN(ms)) throw new StackboneCliError({
 		code: "generic",
@@ -88351,7 +88573,7 @@ var buildRootCommand = (ctx) => defineCommand({
 	meta: {
 		name: "stackbone",
 		version: STACKBONE_CLI_BUILD_VERSION,
-		description: "Marketplace + hosting for AI agents — see `stackbone docs`."
+		description: "Build, run and deploy Stackbone agents and workflows. See `stackbone docs`."
 	},
 	args: {
 		json: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackbone/cli",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "license": "UNLICENSED",
   "type": "module",
   "bin": {