@tenux/cli 0.0.22 → 0.0.23

package/dist/cli.js

@@ -13,7 +13,7 @@ import {
 
 // src/cli.ts
 import { Command } from "commander";
-import chalk3 from "chalk";
+import chalk4 from "chalk";
 import { hostname } from "os";
 import { homedir } from "os";
 import { join as join2, dirname } from "path";
@@ -381,10 +381,305 @@ async function handleProjectDelete(command, supabase) {
 }
 
 // src/handlers/server.ts
-import { spawn as spawn2, exec, execSync as execSync2 } from "child_process";
+import { spawn as spawn2, execSync as execSync2 } from "child_process";
 import { resolve as resolve2 } from "path";
 import { existsSync as existsSync2 } from "fs";
+
+// src/lib/tunnel.ts
+import http from "http";
+import WebSocket from "ws";
 import chalk2 from "chalk";
+var MSG_HTTP_REQUEST = 1;
+var MSG_HTTP_RESPONSE = 2;
+var MSG_WS_OPEN = 3;
+var MSG_WS_FRAME = 4;
+var MSG_WS_CLOSE = 5;
+function getMessageType(data) {
+  return new DataView(data).getUint8(0);
+}
+function decodeHttpRequest(data) {
+  const view = new DataView(data);
+  const bytes = new Uint8Array(data);
+  let offset = 1;
+  const requestId = view.getUint32(offset);
+  offset += 4;
+  const methodLen = view.getUint16(offset);
+  offset += 2;
+  const method = Buffer.from(bytes.slice(offset, offset + methodLen)).toString();
+  offset += methodLen;
+  const pathLen = view.getUint16(offset);
+  offset += 2;
+  const path = Buffer.from(bytes.slice(offset, offset + pathLen)).toString();
+  offset += pathLen;
+  const headersLen = view.getUint32(offset);
+  offset += 4;
+  const headersJson = Buffer.from(bytes.slice(offset, offset + headersLen)).toString();
+  offset += headersLen;
+  const headers = JSON.parse(headersJson);
+  const body = Buffer.from(bytes.slice(offset));
+  return { requestId, method, path, headers, body };
+}
+function encodeHttpResponse(requestId, status, headers, body) {
+  const headersJson = Buffer.from(JSON.stringify(headers));
+  const totalLen = 1 + 4 + 2 + 4 + headersJson.length + body.length;
+  const buf = Buffer.alloc(totalLen);
+  let offset = 0;
+  buf.writeUInt8(MSG_HTTP_RESPONSE, offset);
+  offset += 1;
+  buf.writeUInt32BE(requestId, offset);
+  offset += 4;
+  buf.writeUInt16BE(status, offset);
+  offset += 2;
+  buf.writeUInt32BE(headersJson.length, offset);
+  offset += 4;
+  headersJson.copy(buf, offset);
+  offset += headersJson.length;
+  body.copy(buf, offset);
+  return buf;
+}
+function decodeWsOpen(data) {
+  const view = new DataView(data);
+  const bytes = new Uint8Array(data);
+  let offset = 1;
+  const channelId = view.getUint32(offset);
+  offset += 4;
+  const pathLen = view.getUint16(offset);
+  offset += 2;
+  const path = Buffer.from(bytes.slice(offset, offset + pathLen)).toString();
+  offset += pathLen;
+  const headersLen = view.getUint32(offset);
+  offset += 4;
+  const headersJson = Buffer.from(bytes.slice(offset, offset + headersLen)).toString();
+  const headers = JSON.parse(headersJson);
+  return { channelId, path, headers };
+}
+function getChannelId(data) {
+  return new DataView(data).getUint32(1);
+}
+function getWsFramePayload(data) {
+  return Buffer.from(new Uint8Array(data, 5));
+}
+function getWsCloseCode(data) {
+  return new DataView(data).getUint16(5);
+}
+function encodeWsFrame(channelId, payload) {
+  const buf = Buffer.alloc(5 + payload.length);
+  buf.writeUInt8(MSG_WS_FRAME, 0);
+  buf.writeUInt32BE(channelId, 1);
+  payload.copy(buf, 5);
+  return buf;
+}
+function encodeWsClose(channelId, closeCode) {
+  const buf = Buffer.alloc(7);
+  buf.writeUInt8(MSG_WS_CLOSE, 0);
+  buf.writeUInt32BE(channelId, 1);
+  buf.writeUInt16BE(closeCode, 5);
+  return buf;
+}
+var TUNNEL_HOST = "tenux.dev";
+var activeTunnels = /* @__PURE__ */ new Map();
+function connectTunnel(instanceId, localPort, accessToken, userId) {
+  disconnectTunnel(instanceId);
+  const tunnelUrl = `https://r-${instanceId}.${TUNNEL_HOST}`;
+  const wsUrl = `wss://r-${instanceId}.${TUNNEL_HOST}/_tunnel/connect`;
+  const conn = {
+    ws: null,
+    localPort,
+    instanceId,
+    localWsSockets: /* @__PURE__ */ new Map(),
+    closed: false
+  };
+  function connect() {
+    if (conn.closed) return;
+    const ws = new WebSocket(wsUrl, {
+      headers: {
+        "Authorization": `Bearer ${accessToken}`,
+        "X-User-Id": userId
+      }
+    });
+    ws.binaryType = "arraybuffer";
+    conn.ws = ws;
+    ws.on("open", () => {
+      console.log(chalk2.green("\u2713"), `[tunnel] Connected: ${tunnelUrl}`);
+    });
+    ws.on("message", (data) => {
+      const ab = data instanceof ArrayBuffer ? data : data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength);
+      handleRelayMessage(conn, ab);
+    });
+    ws.on("close", () => {
+      if (conn.closed) return;
+      console.log(chalk2.yellow("!"), `[tunnel] Disconnected, reconnecting in 3s...`);
+      conn.reconnectTimer = setTimeout(connect, 3e3);
+    });
+    ws.on("error", (err) => {
+      console.log(chalk2.yellow("!"), `[tunnel] Error: ${err.message}`);
+    });
+  }
+  connect();
+  activeTunnels.set(instanceId, conn);
+  return tunnelUrl;
+}
+function disconnectTunnel(instanceId) {
+  const conn = activeTunnels.get(instanceId);
+  if (!conn) return;
+  conn.closed = true;
+  if (conn.reconnectTimer) clearTimeout(conn.reconnectTimer);
+  for (const [, localWs] of conn.localWsSockets) {
+    try {
+      localWs.close();
+    } catch {
+    }
+  }
+  conn.localWsSockets.clear();
+  try {
+    conn.ws.close(1e3, "tunnel disconnect");
+  } catch {
+  }
+  activeTunnels.delete(instanceId);
+  console.log(chalk2.dim("  [tunnel] Disconnected:", instanceId));
+}
+function disconnectAllTunnels() {
+  for (const instanceId of activeTunnels.keys()) {
+    disconnectTunnel(instanceId);
+  }
+}
+function handleRelayMessage(conn, data) {
+  const type = getMessageType(data);
+  switch (type) {
+    case MSG_HTTP_REQUEST:
+      handleHttpRequest(conn, data);
+      break;
+    case MSG_WS_OPEN:
+      handleWsOpen(conn, data);
+      break;
+    case MSG_WS_FRAME:
+      handleWsFrame(conn, data);
+      break;
+    case MSG_WS_CLOSE:
+      handleWsClose(conn, data);
+      break;
+  }
+}
+function handleHttpRequest(conn, data) {
+  const req = decodeHttpRequest(data);
+  const options = {
+    hostname: "127.0.0.1",
+    port: conn.localPort,
+    path: req.path,
+    method: req.method,
+    headers: {
+      ...req.headers,
+      host: `127.0.0.1:${conn.localPort}`
+    }
+  };
+  const localReq = http.request(options, (localRes) => {
+    const chunks = [];
+    localRes.on("data", (chunk) => {
+      chunks.push(chunk);
+    });
+    localRes.on("end", () => {
+      const body = Buffer.concat(chunks);
+      const headers = {};
+      for (const [key, value] of Object.entries(localRes.headers)) {
+        if (value) {
+          headers[key] = Array.isArray(value) ? value.join(", ") : value;
+        }
+      }
+      const responseMsg = encodeHttpResponse(req.requestId, localRes.statusCode ?? 500, headers, body);
+      try {
+        if (conn.ws.readyState === WebSocket.OPEN) {
+          conn.ws.send(responseMsg);
+        }
+      } catch (err) {
+        console.log(chalk2.yellow("!"), `[tunnel] Failed to send response: ${err.message}`);
+      }
+    });
+  });
+  localReq.on("error", (err) => {
+    const body = Buffer.from(`Local server error: ${err.message}`);
+    const headers = { "content-type": "text/plain" };
+    const responseMsg = encodeHttpResponse(req.requestId, 502, headers, body);
+    try {
+      if (conn.ws.readyState === WebSocket.OPEN) {
+        conn.ws.send(responseMsg);
+      }
+    } catch {
+    }
+  });
+  if (req.body.length > 0) {
+    localReq.write(req.body);
+  }
+  localReq.end();
+}
+function handleWsOpen(conn, data) {
+  const { channelId, path, headers } = decodeWsOpen(data);
+  const wsUrl = `ws://127.0.0.1:${conn.localPort}${path}`;
+  const localWs = new WebSocket(wsUrl, {
+    headers: {
+      ...headers,
+      host: `127.0.0.1:${conn.localPort}`
+    }
+  });
+  localWs.binaryType = "arraybuffer";
+  conn.localWsSockets.set(channelId, localWs);
+  localWs.on("message", (data2) => {
+    const payload = Buffer.isBuffer(data2) ? data2 : Buffer.from(data2);
+    const frame = encodeWsFrame(channelId, payload);
+    try {
+      if (conn.ws.readyState === WebSocket.OPEN) {
+        conn.ws.send(frame);
+      }
+    } catch {
+    }
+  });
+  localWs.on("close", (code) => {
+    conn.localWsSockets.delete(channelId);
+    const closeMsg = encodeWsClose(channelId, code || 1e3);
+    try {
+      if (conn.ws.readyState === WebSocket.OPEN) {
+        conn.ws.send(closeMsg);
+      }
+    } catch {
+    }
+  });
+  localWs.on("error", (err) => {
+    console.log(chalk2.dim(`  [tunnel] Local WS error (channel ${channelId}): ${err.message}`));
+    conn.localWsSockets.delete(channelId);
+    const closeMsg = encodeWsClose(channelId, 1011);
+    try {
+      if (conn.ws.readyState === WebSocket.OPEN) {
+        conn.ws.send(closeMsg);
+      }
+    } catch {
+    }
+  });
+}
+function handleWsFrame(conn, data) {
+  const channelId = getChannelId(data);
+  const payload = getWsFramePayload(data);
+  const localWs = conn.localWsSockets.get(channelId);
+  if (localWs && localWs.readyState === WebSocket.OPEN) {
+    try {
+      localWs.send(payload);
+    } catch {
+    }
+  }
+}
+function handleWsClose(conn, data) {
+  const channelId = getChannelId(data);
+  const closeCode = getWsCloseCode(data);
+  const localWs = conn.localWsSockets.get(channelId);
+  if (localWs) {
+    conn.localWsSockets.delete(channelId);
+    try {
+      localWs.close(closeCode);
+    } catch {
+    }
+  }
+}
+
+// src/handlers/server.ts
+import chalk3 from "chalk";
 var MAX_LOG_LINES = 500;
 var LOG_PUSH_INTERVAL = 2e3;
 var runningServers = /* @__PURE__ */ new Map();
@@ -408,39 +703,6 @@ function killTree(child) {
     child.kill("SIGTERM");
   }
 }
-var tailscalePorts = /* @__PURE__ */ new Set();
-function setupTailscaleServe(port) {
-  if (tailscalePorts.has(port)) return;
-  tailscalePorts.add(port);
-  exec(`tailscale serve --bg --https=${port} localhost:${port}`, (err) => {
-    if (err) {
-      console.log(chalk2.yellow("!"), `[tailscale] Failed for port ${port}: ${err.message}`);
-      tailscalePorts.delete(port);
-    } else {
-      console.log(chalk2.green("\u2713"), `[tailscale] HTTPS proxy on :${port}`);
-    }
-  });
-}
-function teardownTailscaleServe(port) {
-  if (!tailscalePorts.has(port)) return;
-  tailscalePorts.delete(port);
-  exec(`tailscale serve --https=${port} off`, (err) => {
-    if (err) {
-      console.log(chalk2.yellow("!"), `[tailscale] Failed to remove :${port}: ${err.message}`);
-    } else {
-      console.log(chalk2.dim("  [tailscale] Removed :${port}"));
-    }
-  });
-}
-function getTailscaleHostname() {
-  try {
-    const output = execSync2("tailscale status --json", { timeout: 5e3 }).toString();
-    const status = JSON.parse(output);
-    return status.Self?.DNSName?.replace(/\.$/, "") ?? null;
-  } catch {
-    return null;
-  }
-}
 async function handleServerStart(command, supabase) {
   const payload = command.payload;
   const config = loadConfig();
@@ -453,6 +715,7 @@ async function handleServerStart(command, supabase) {
   if (existing) {
     clearInterval(existing.logInterval);
     killTree(existing.process);
+    if (existing.tunnelUrl) disconnectTunnel(existing.instanceId);
     runningServers.delete(key);
   }
   const { data: instance, error: upsertErr } = await supabase.from("server_instances").upsert(
@@ -466,7 +729,7 @@ async function handleServerStart(command, supabase) {
       port: payload.port ?? null,
       pid: null,
       detected_port: null,
-      tailscale_url: null,
+      tunnel_url: null,
       logs: [],
       error_message: null,
       started_at: (/* @__PURE__ */ new Date()).toISOString(),
@@ -478,9 +741,11 @@ async function handleServerStart(command, supabase) {
   if (upsertErr || !instance) {
     throw new Error(`Failed to create server instance: ${upsertErr?.message}`);
   }
-  console.log(chalk2.blue("\u2192"), `Starting server: ${payload.project_name}::${payload.command_name}`);
-  console.log(chalk2.dim(`  cmd: ${payload.command}`));
-  console.log(chalk2.dim(`  cwd: ${fullPath}`));
+  console.log(chalk3.blue("\u2192"), `Starting server: ${payload.project_name}::${payload.command_name}`);
+  console.log(chalk3.dim(`  cmd: ${payload.command}`));
+  console.log(chalk3.dim(`  cwd: ${fullPath}`));
+  const { data: sessionData } = await supabase.auth.getSession();
+  const accessToken = sessionData?.session?.access_token ?? "";
   const env = { ...process.env, FORCE_COLOR: "0" };
   delete env.PORT;
   delete env.NODE_OPTIONS;
@@ -510,17 +775,22 @@ async function handleServerStart(command, supabase) {
             const actualPort = parseInt(portMatch[1], 10);
             detectedPort = true;
             managed.detectedPort = actualPort;
-            setupTailscaleServe(actualPort);
-            const hostname2 = getTailscaleHostname();
-            const tsUrl = hostname2 ? `https://${hostname2}:${actualPort}` : null;
+            const tunnelUrl = connectTunnel(
+              instance.id,
+              actualPort,
+              accessToken,
+              command.user_id
+            );
+            managed.tunnelUrl = tunnelUrl;
             supabase.from("server_instances").update({
               status: "running",
               detected_port: actualPort,
-              tailscale_url: tsUrl,
+              tunnel_url: tunnelUrl,
               pid: child.pid ?? null,
               updated_at: (/* @__PURE__ */ new Date()).toISOString()
             }).eq("id", instance.id).then(() => {
-              console.log(chalk2.green("\u2713"), `Server running on :${actualPort}`);
+              console.log(chalk3.green("\u2713"), `Server running on :${actualPort}`);
+              console.log(chalk3.green("\u2713"), `Tunnel: ${tunnelUrl}`);
             });
           }
         }
@@ -549,19 +819,18 @@ async function handleServerStart(command, supabase) {
   child.on("close", async (code) => {
     clearInterval(logInterval);
     logs.push(`[Process exited with code ${code}]`);
-    if (managed.detectedPort) {
-      teardownTailscaleServe(managed.detectedPort);
-    }
+    disconnectTunnel(managed.instanceId);
     runningServers.delete(key);
     await supabase.from("server_instances").update({
       status: code === 0 ? "stopped" : "error",
       error_message: code !== 0 ? `Exited with code ${code}` : null,
       logs: logs.slice(-100),
+      tunnel_url: null,
       stopped_at: (/* @__PURE__ */ new Date()).toISOString(),
       updated_at: (/* @__PURE__ */ new Date()).toISOString()
     }).eq("id", instance.id);
     console.log(
-      code === 0 ? chalk2.dim("  Server stopped") : chalk2.yellow("!"),
+      code === 0 ? chalk3.dim("  Server stopped") : chalk3.yellow("!"),
       `${payload.project_name}::${payload.command_name} exited (code ${code})`
     );
   });
@@ -576,13 +845,17 @@ async function handleServerStart(command, supabase) {
       const configuredPort = payload.port;
       if (configuredPort) {
         managed.detectedPort = configuredPort;
-        setupTailscaleServe(configuredPort);
-        const hostname2 = getTailscaleHostname();
-        const tsUrl = hostname2 ? `https://${hostname2}:${configuredPort}` : null;
+        const tunnelUrl = connectTunnel(
+          instance.id,
+          configuredPort,
+          accessToken,
+          command.user_id
+        );
+        managed.tunnelUrl = tunnelUrl;
         await supabase.from("server_instances").update({
           status: "running",
           detected_port: configuredPort,
-          tailscale_url: tsUrl,
+          tunnel_url: tunnelUrl,
           updated_at: (/* @__PURE__ */ new Date()).toISOString()
         }).eq("id", instance.id);
       } else {
@@ -601,13 +874,14 @@ async function handleServerStop(command, supabase) {
   const key = makeKey(payload.project_name, payload.command_name);
   const managed = runningServers.get(key);
   if (managed) {
-    console.log(chalk2.blue("\u2192"), `Stopping server: ${key}`);
+    console.log(chalk3.blue("\u2192"), `Stopping server: ${key}`);
     clearInterval(managed.logInterval);
     killTree(managed.process);
   } else {
     if (payload.server_instance_id) {
       await supabase.from("server_instances").update({
         status: "stopped",
+        tunnel_url: null,
         stopped_at: (/* @__PURE__ */ new Date()).toISOString(),
         updated_at: (/* @__PURE__ */ new Date()).toISOString()
       }).eq("id", payload.server_instance_id);
@@ -628,6 +902,7 @@ async function handleServerStatus(command, supabase) {
       running: managed.process.exitCode === null,
       pid: managed.process.pid,
       detectedPort: managed.detectedPort,
+      tunnelUrl: managed.tunnelUrl,
       logCount: managed.logs.length
     });
   }
@@ -639,18 +914,17 @@ async function handleServerStatus(command, supabase) {
 }
 async function cleanupServers(supabase, deviceId) {
   for (const [key, managed] of runningServers) {
-    console.log(chalk2.dim(`  Stopping server: ${key}`));
+    console.log(chalk3.dim(`  Stopping server: ${key}`));
     clearInterval(managed.logInterval);
     if (managed.process.exitCode === null) {
       killTree(managed.process);
     }
-    if (managed.detectedPort) {
-      teardownTailscaleServe(managed.detectedPort);
-    }
   }
   runningServers.clear();
+  disconnectAllTunnels();
   await supabase.from("server_instances").update({
     status: "stopped",
+    tunnel_url: null,
     stopped_at: (/* @__PURE__ */ new Date()).toISOString(),
     updated_at: (/* @__PURE__ */ new Date()).toISOString()
   }).eq("device_id", deviceId).in("status", ["starting", "running"]);
@@ -658,12 +932,13 @@ async function cleanupServers(supabase, deviceId) {
 async function cleanupStaleServers(supabase, deviceId) {
   const { data, error } = await supabase.from("server_instances").update({
     status: "stopped",
+    tunnel_url: null,
     error_message: "Agent restarted",
     stopped_at: (/* @__PURE__ */ new Date()).toISOString(),
     updated_at: (/* @__PURE__ */ new Date()).toISOString()
   }).eq("device_id", deviceId).in("status", ["starting", "running"]).select("id");
   if (data && data.length > 0) {
-    console.log(chalk2.yellow("!"), `Cleaned up ${data.length} stale server instance(s)`);
+    console.log(chalk3.yellow("!"), `Cleaned up ${data.length} stale server instance(s)`);
   }
 }
 
@@ -691,15 +966,15 @@ async function sleep(ms) {
   return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 program.command("login").description("Authenticate with Tenux via browser-based device auth").option("--url <url>", "Tenux app URL").action(async (opts) => {
-  console.log(chalk3.bold("\n  tenux"), chalk3.dim("desktop agent\n"));
+  console.log(chalk4.bold("\n  tenux"), chalk4.dim("desktop agent\n"));
   const appUrl = (opts.url ?? process.env.TENUX_APP_URL ?? "https://tenux.dev").replace(/\/+$/, "");
-  console.log(chalk3.dim("  App:"), appUrl);
+  console.log(chalk4.dim("  App:"), appUrl);
   const deviceName = hostname();
   const platform = process.platform;
-  console.log(chalk3.dim("  Device:"), deviceName);
-  console.log(chalk3.dim("  Platform:"), platform);
+  console.log(chalk4.dim("  Device:"), deviceName);
+  console.log(chalk4.dim("  Platform:"), platform);
   console.log();
-  console.log(chalk3.dim("  Requesting device code..."));
+  console.log(chalk4.dim("  Requesting device code..."));
   let code;
   let expiresAt;
   let supabaseUrl;
@@ -716,7 +991,7 @@ program.command("login").description("Authenticate with Tenux via browser-based
     });
     if (!res.ok) {
       const text = await res.text();
-      console.log(chalk3.red("  \u2717"), `Failed to get device code: ${res.status} ${text}`);
+      console.log(chalk4.red("  \u2717"), `Failed to get device code: ${res.status} ${text}`);
       process.exit(1);
     }
     const data = await res.json();
@@ -726,26 +1001,26 @@ program.command("login").description("Authenticate with Tenux via browser-based
     supabaseAnonKey = data.supabase_anon_key;
   } catch (err) {
     console.log(
-      chalk3.red("  \u2717"),
+      chalk4.red("  \u2717"),
       `Could not reach ${appUrl}: ${err instanceof Error ? err.message : String(err)}`
     );
     process.exit(1);
   }
   console.log();
-  console.log(chalk3.bold.cyan(`  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510`));
-  console.log(chalk3.bold.cyan(`  \u2502                         \u2502`));
-  console.log(chalk3.bold.cyan(`  \u2502   Code: ${chalk3.white.bold(code)}   \u2502`));
-  console.log(chalk3.bold.cyan(`  \u2502                         \u2502`));
-  console.log(chalk3.bold.cyan(`  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518`));
+  console.log(chalk4.bold.cyan(`  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510`));
+  console.log(chalk4.bold.cyan(`  \u2502                         \u2502`));
+  console.log(chalk4.bold.cyan(`  \u2502   Code: ${chalk4.white.bold(code)}   \u2502`));
+  console.log(chalk4.bold.cyan(`  \u2502                         \u2502`));
+  console.log(chalk4.bold.cyan(`  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518`));
   console.log();
   const linkUrl = `${appUrl}/link?code=${code}`;
-  console.log(chalk3.dim("  Opening browser to:"), chalk3.underline(linkUrl));
+  console.log(chalk4.dim("  Opening browser to:"), chalk4.underline(linkUrl));
   try {
     const open = (await import("open")).default;
     await open(linkUrl);
   } catch {
-    console.log(chalk3.yellow("  !"), "Could not open browser automatically.");
-    console.log(chalk3.dim("    Open this URL manually:"), chalk3.underline(linkUrl));
+    console.log(chalk4.yellow("  !"), "Could not open browser automatically.");
+    console.log(chalk4.dim("    Open this URL manually:"), chalk4.underline(linkUrl));
   }
   console.log();
   const dots = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
@@ -757,11 +1032,11 @@ program.command("login").description("Authenticate with Tenux via browser-based
   const expiresTime = new Date(expiresAt).getTime();
   while (!approved) {
     if (Date.now() > expiresTime) {
-      console.log(chalk3.red("\n  \u2717"), "Device code expired. Please run `tenux login` again.");
+      console.log(chalk4.red("\n  \u2717"), "Device code expired. Please run `tenux login` again.");
       process.exit(1);
     }
     process.stdout.write(
-      `\r  ${chalk3.cyan(dots[dotIndex % dots.length])} Waiting for approval...`
+      `\r  ${chalk4.cyan(dots[dotIndex % dots.length])} Waiting for approval...`
     );
     dotIndex++;
     await sleep(2e3);
@@ -779,16 +1054,16 @@ program.command("login").description("Authenticate with Tenux via browser-based
         userId = data.user_id || "";
         approved = true;
       } else if (data.status === "expired") {
-        console.log(chalk3.red("\n  \u2717"), "Device code expired. Please run `tenux login` again.");
+        console.log(chalk4.red("\n  \u2717"), "Device code expired. Please run `tenux login` again.");
         process.exit(1);
       }
     } catch {
     }
   }
   process.stdout.write("\r" + " ".repeat(60) + "\r");
-  console.log(chalk3.green("  \u2713"), "Device approved!");
+  console.log(chalk4.green("  \u2713"), "Device approved!");
   console.log();
-  console.log(chalk3.dim("  Exchanging token for session..."));
+  console.log(chalk4.dim("  Exchanging token for session..."));
   let accessToken = "";
   let refreshToken = "";
   try {
@@ -800,11 +1075,11 @@ program.command("login").description("Authenticate with Tenux via browser-based
       type: "magiclink"
     });
     if (error) {
-      console.log(chalk3.red("  \u2717"), `Auth failed: ${error.message}`);
+      console.log(chalk4.red("  \u2717"), `Auth failed: ${error.message}`);
       process.exit(1);
     }
     if (!session.session) {
-      console.log(chalk3.red("  \u2717"), "No session returned from auth exchange.");
+      console.log(chalk4.red("  \u2717"), "No session returned from auth exchange.");
       process.exit(1);
     }
     accessToken = session.session.access_token;
@@ -812,12 +1087,12 @@ program.command("login").description("Authenticate with Tenux via browser-based
     userId = session.session.user?.id || userId;
   } catch (err) {
     console.log(
-      chalk3.red("  \u2717"),
+      chalk4.red("  \u2717"),
       `Token exchange failed: ${err instanceof Error ? err.message : String(err)}`
     );
     process.exit(1);
   }
-  console.log(chalk3.green("  \u2713"), "Session established.");
+  console.log(chalk4.green("  \u2713"), "Session established.");
   const config = {
     appUrl,
     supabaseUrl,
@@ -830,66 +1105,66 @@ program.command("login").description("Authenticate with Tenux via browser-based
     projectsDir: join2(homedir(), ".tenux", "projects")
   };
   saveConfig(config);
-  console.log(chalk3.green("  \u2713"), "Config saved to", chalk3.dim(getConfigPath()));
+  console.log(chalk4.green("  \u2713"), "Config saved to", chalk4.dim(getConfigPath()));
   console.log();
   const claude = detectClaudeCode();
   if (claude.installed) {
-    console.log(chalk3.green("  \u2713"), "Claude Code detected");
+    console.log(chalk4.green("  \u2713"), "Claude Code detected");
     if (claude.authenticated) {
-      console.log(chalk3.green("  \u2713"), "Claude Code authenticated (~/.claude exists)");
+      console.log(chalk4.green("  \u2713"), "Claude Code authenticated (~/.claude exists)");
     } else {
       console.log(
-        chalk3.yellow("  !"),
+        chalk4.yellow("  !"),
         "Claude Code found but ~/.claude not detected.",
-        chalk3.dim("Run `claude login` to authenticate.")
+        chalk4.dim("Run `claude login` to authenticate.")
       );
     }
   } else {
-    console.log(chalk3.yellow("  !"), "Claude Code not found.");
+    console.log(chalk4.yellow("  !"), "Claude Code not found.");
     console.log(
-      chalk3.dim("    Install it:"),
-      chalk3.underline("https://docs.anthropic.com/en/docs/claude-code")
+      chalk4.dim("    Install it:"),
+      chalk4.underline("https://docs.anthropic.com/en/docs/claude-code")
     );
     console.log(
-      chalk3.dim("    Then run:"),
-      chalk3.cyan("claude login")
+      chalk4.dim("    Then run:"),
+      chalk4.cyan("claude login")
     );
   }
   console.log();
-  console.log(chalk3.dim("  Device:"), deviceName);
-  console.log(chalk3.dim("  Device ID:"), deviceId);
-  console.log(chalk3.dim("  User ID:"), userId);
-  console.log(chalk3.dim("  Projects:"), config.projectsDir);
+  console.log(chalk4.dim("  Device:"), deviceName);
+  console.log(chalk4.dim("  Device ID:"), deviceId);
+  console.log(chalk4.dim("  User ID:"), userId);
+  console.log(chalk4.dim("  Projects:"), config.projectsDir);
   console.log();
   console.log(
-    chalk3.dim("  Next: start the agent:"),
-    chalk3.cyan("tenux start")
+    chalk4.dim("  Next: start the agent:"),
+    chalk4.cyan("tenux start")
   );
   console.log();
 });
 program.command("start").description("Start the agent and listen for commands").action(async () => {
   if (!configExists()) {
-    console.log(chalk3.red("\u2717"), "Not logged in. Run `tenux login` first.");
+    console.log(chalk4.red("\u2717"), "Not logged in. Run `tenux login` first.");
     process.exit(1);
   }
   const claude = detectClaudeCode();
   if (!claude.installed) {
-    console.log(chalk3.red("\u2717"), "Claude Code not found.");
-    console.log(chalk3.dim("  Install it:"), chalk3.cyan("npm i -g @anthropic-ai/claude-code"));
-    console.log(chalk3.dim("  Then run:"), chalk3.cyan("claude login"));
+    console.log(chalk4.red("\u2717"), "Claude Code not found.");
+    console.log(chalk4.dim("  Install it:"), chalk4.cyan("npm i -g @anthropic-ai/claude-code"));
+    console.log(chalk4.dim("  Then run:"), chalk4.cyan("claude login"));
     process.exit(1);
   }
   const config = loadConfig();
-  console.log(chalk3.bold("\n  tenux"), chalk3.dim("desktop agent\n"));
-  console.log(chalk3.dim("  Device:"), config.deviceName);
-  console.log(chalk3.dim("  Projects:"), config.projectsDir);
+  console.log(chalk4.bold("\n  tenux"), chalk4.dim("desktop agent\n"));
+  console.log(chalk4.dim("  Device:"), config.deviceName);
+  console.log(chalk4.dim("  Projects:"), config.projectsDir);
   console.log();
   const supabase = getSupabase();
   try {
     await initSupabaseSession();
   } catch (err) {
-    console.log(chalk3.red("\u2717"), `Session expired: ${err.message}`);
-    console.log(chalk3.dim("  Run `tenux login` to re-authenticate."));
+    console.log(chalk4.red("\u2717"), `Session expired: ${err.message}`);
+    console.log(chalk4.dim("  Run `tenux login` to re-authenticate."));
     process.exit(1);
   }
   await supabase.from("devices").update({
@@ -901,12 +1176,12 @@ program.command("start").description("Start the agent and listen for commands").
   const heartbeat = setInterval(async () => {
     const { error } = await supabase.from("devices").update({ last_seen_at: (/* @__PURE__ */ new Date()).toISOString(), is_online: true }).eq("id", config.deviceId);
     if (error) {
-      console.log(chalk3.red("\u2717"), chalk3.dim(`Heartbeat failed: ${error.message}`));
+      console.log(chalk4.red("\u2717"), chalk4.dim(`Heartbeat failed: ${error.message}`));
     }
   }, 3e4);
   const relay = new Relay(supabase);
   const shutdown = async () => {
-    console.log(chalk3.dim("\n  Shutting down..."));
+    console.log(chalk4.dim("\n  Shutting down..."));
     clearInterval(heartbeat);
     await cleanupServers(supabase, config.deviceId);
     await relay.stop();
@@ -914,41 +1189,41 @@ program.command("start").description("Start the agent and listen for commands").
     process.exit(0);
   };
   relay.on("claude.query", handleClaudeQuery).on("project.clone", handleProjectClone).on("project.create", handleProjectCreate).on("project.tree", handleProjectTree).on("project.git_status", handleProjectGitStatus).on("project.delete", handleProjectDelete).on("server.start", handleServerStart).on("server.stop", handleServerStop).on("server.status", handleServerStatus).on("agent.shutdown", async () => {
-    console.log(chalk3.yellow("\n  \u26A1 Remote shutdown requested"));
+    console.log(chalk4.yellow("\n  \u26A1 Remote shutdown requested"));
     await shutdown();
   });
   await relay.start();
-  console.log(chalk3.green("  \u2713"), "Agent running. Press Ctrl+C to stop.\n");
+  console.log(chalk4.green("  \u2713"), "Agent running. Press Ctrl+C to stop.\n");
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);
 });
 program.command("status").description("Show agent configuration and status").action(() => {
   if (!configExists()) {
-    console.log(chalk3.red("\u2717"), "Not configured. Run `tenux login` first.");
+    console.log(chalk4.red("\u2717"), "Not configured. Run `tenux login` first.");
     process.exit(1);
   }
   const config = loadConfig();
   const claude = detectClaudeCode();
-  console.log(chalk3.bold("\n  tenux"), chalk3.dim("agent status\n"));
-  console.log(chalk3.dim("  Config:"), getConfigPath());
-  console.log(chalk3.dim("  App URL:"), config.appUrl);
-  console.log(chalk3.dim("  Device:"), config.deviceName);
-  console.log(chalk3.dim("  Device ID:"), config.deviceId);
-  console.log(chalk3.dim("  User ID:"), config.userId);
-  console.log(chalk3.dim("  Supabase:"), config.supabaseUrl);
-  console.log(chalk3.dim("  Projects:"), config.projectsDir);
+  console.log(chalk4.bold("\n  tenux"), chalk4.dim("agent status\n"));
+  console.log(chalk4.dim("  Config:"), getConfigPath());
+  console.log(chalk4.dim("  App URL:"), config.appUrl);
+  console.log(chalk4.dim("  Device:"), config.deviceName);
+  console.log(chalk4.dim("  Device ID:"), config.deviceId);
+  console.log(chalk4.dim("  User ID:"), config.userId);
+  console.log(chalk4.dim("  Supabase:"), config.supabaseUrl);
+  console.log(chalk4.dim("  Projects:"), config.projectsDir);
   console.log(
-    chalk3.dim("  Auth:"),
-    config.accessToken ? chalk3.green("authenticated") : chalk3.yellow("not authenticated")
+    chalk4.dim("  Auth:"),
+    config.accessToken ? chalk4.green("authenticated") : chalk4.yellow("not authenticated")
   );
   console.log(
-    chalk3.dim("  Claude Code:"),
-    claude.installed ? chalk3.green("installed") : chalk3.yellow("not installed")
+    chalk4.dim("  Claude Code:"),
+    claude.installed ? chalk4.green("installed") : chalk4.yellow("not installed")
   );
   if (claude.installed) {
     console.log(
-      chalk3.dim("  Claude Auth:"),
-      claude.authenticated ? chalk3.green("yes (~/.claude exists)") : chalk3.yellow("not authenticated")
+      chalk4.dim("  Claude Auth:"),
+      claude.authenticated ? chalk4.green("yes (~/.claude exists)") : chalk4.yellow("not authenticated")
     );
   }
   console.log();
@@ -956,7 +1231,7 @@ program.command("status").description("Show agent configuration and status").act
 var configCmd = program.command("config").description("Manage agent configuration");
 configCmd.command("set <key> <value>").description("Set a config value").action((key, value) => {
   if (!configExists()) {
-    console.log(chalk3.red("\u2717"), "Not configured. Run `tenux login` first.");
+    console.log(chalk4.red("\u2717"), "Not configured. Run `tenux login` first.");
     process.exit(1);
   }
   const keyMap = {
@@ -967,17 +1242,17 @@ configCmd.command("set <key> <value>").description("Set a config value").action(
   const configKey = keyMap[key];
   if (!configKey) {
     console.log(
-      chalk3.red("\u2717"),
+      chalk4.red("\u2717"),
       `Unknown config key: ${key}. Valid keys: ${Object.keys(keyMap).join(", ")}`
     );
     process.exit(1);
   }
   updateConfig({ [configKey]: value });
-  console.log(chalk3.green("\u2713"), `Set ${key}`);
+  console.log(chalk4.green("\u2713"), `Set ${key}`);
 });
 configCmd.command("get <key>").description("Get a config value").action((key) => {
   if (!configExists()) {
-    console.log(chalk3.red("\u2717"), "Not configured. Run `tenux login` first.");
+    console.log(chalk4.red("\u2717"), "Not configured. Run `tenux login` first.");
     process.exit(1);
   }
   const config = loadConfig();
@@ -992,12 +1267,12 @@ configCmd.command("get <key>").description("Get a config value").action((key) =>
   const configKey = keyMap[key];
   if (!configKey) {
     console.log(
-      chalk3.red("\u2717"),
+      chalk4.red("\u2717"),
       `Unknown key: ${key}. Valid keys: ${Object.keys(keyMap).join(", ")}`
     );
     process.exit(1);
   }
   const val = config[configKey];
-  console.log(val ?? chalk3.dim("(not set)"));
+  console.log(val ?? chalk4.dim("(not set)"));
 });
 program.parse();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tenux/cli",
-  "version": "0.0.22",
+  "version": "0.0.23",
   "description": "Tenux — mobile-first IDE for 10x engineering",
   "author": "Antelogic LLC",
   "license": "MIT",