@treeport/treeport 0.4.0 → 0.6.1

package/dist/node/cli/index.js

@@ -1,15 +1,11 @@
 #!/usr/bin/env node
-import { A as parseEventsSnapshot, M as SOCKET_IO_PATH, j as parseProductEvent, k as webPanelInputSchema, n as parseDurationMs, r as TERMINAL_CAPTURE_MAX_LINES, t as assertLoopbackHost } from "../../loopback-D7k_J_Wl.js";
+import { B as parseEventsSnapshot, H as SOCKET_IO_PATH, R as webPanelInputSchema, V as parseProductEvent, t as TERMINAL_CAPTURE_MAX_LINES } from "../../dist-Crk_Xr82.js";
+import { A as treeportVersion, C as disableTailscaleRemote, D as resolvePackagePath, E as resolveLocalApiUrl, M as parseDurationMs, O as runDoctor, S as daemonUp, T as readDaemonLogs, _ as serviceStatus, b as daemonHealth, d as serviceDisable, f as serviceDoctorCheck, g as serviceStart, h as serviceRun, k as tailscaleRemoteStatus, l as readServiceLogs, m as serviceInstalled, p as serviceEnable, s as runLocalUpdate, t as LocalUpdateError, u as serviceApply, v as serviceStop, w as enableTailscaleRemote, x as daemonStatus, y as daemonDown } from "../../update-qVp7yL5D.js";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { Command, CommanderError } from "commander";
 import { io } from "socket.io-client";
-import { z } from "zod";
 import { spawn } from "node:child_process";
-import crypto from "node:crypto";
-import fsSync, { constants } from "node:fs";
-import os from "node:os";
-import { fileURLToPath, pathToFileURL } from "node:url";
 //#region src/cli/args.ts
 function extractJsonOutput(args) {
 	const separator = args.indexOf("--");
@@ -82,1568 +78,6 @@ async function openWorkspace(workspaceUrl, options = {}) {
 	throw new OpenWorkspaceError(`Treeport registered the folder, but could not open it automatically.${browser.stderr ? ` ${browser.stderr}` : ""}\nOpen this URL manually: ${workspaceUrl}`);
 }
 //#endregion
-//#region src/cli/lifecycle.ts
-const DEFAULT_HOST = "127.0.0.1";
-const DEFAULT_PORT = 8733;
-function listenerUrl(host, port) {
-	return `http://${host.includes(":") && !host.startsWith("[") ? `[${host}]` : host}:${port}`;
-}
-function expandHome(value) {
-	return value === "~" || value.startsWith("~/") ? path.join(os.homedir(), value.slice(2)) : value;
-}
-function localPaths(env = process.env) {
-	const defaultDataDir = env.XDG_DATA_HOME ? path.join(expandHome(env.XDG_DATA_HOME), "treeport") : process.platform === "darwin" ? path.join(os.homedir(), "Library", "Application Support", "treeport") : path.join(os.homedir(), ".local", "share", "treeport");
-	const dataDir = path.resolve(expandHome(env.TREEPORT_DATA_DIR?.trim() || defaultDataDir));
-	const runtimeDir = path.resolve(expandHome(env.TREEPORT_RUNTIME_DIR?.trim() || (env.XDG_RUNTIME_DIR ? path.join(env.XDG_RUNTIME_DIR, "treeport") : path.join(os.tmpdir(), `treeport-${process.getuid?.() ?? "user"}`))));
-	return {
-		dataDir,
-		runtimeDir,
-		preferencesPath: path.join(dataDir, "config.json"),
-		statePath: path.join(runtimeDir, "daemon.json"),
-		lockPath: path.join(dataDir, "daemon.lock"),
-		logPath: path.join(dataDir, "logs", "daemon.log")
-	};
-}
-async function readJson$1(filePath, schema) {
-	return fs.readFile(filePath, "utf8").then((value) => schema.parse(JSON.parse(value))).catch(() => null);
-}
-const preferencesSchema = z.looseObject({
-	host: z.string().optional(),
-	port: z.number().optional(),
-	remote: z.strictObject({
-		port: z.number(),
-		target: z.string()
-	}).optional()
-});
-const daemonRecordSchema = z.strictObject({
-	pid: z.number(),
-	instanceId: z.string(),
-	version: z.string(),
-	apiUrl: z.string(),
-	dataDir: z.string(),
-	startedAt: z.string(),
-	installationMethod: z.string(),
-	daemonLifecycle: z.enum([
-		"treeport",
-		"service",
-		"external"
-	])
-});
-const healthRecordSchema = z.strictObject({
-	ok: z.literal(true),
-	version: z.string(),
-	protocolVersion: z.number(),
-	hostname: z.string().optional(),
-	pid: z.number(),
-	instanceId: z.string().nullable(),
-	installationMethod: z.string(),
-	daemonLifecycle: z.enum([
-		"treeport",
-		"service",
-		"external"
-	]),
-	url: z.string()
-});
-async function preferences(env = process.env) {
-	return await readJson$1(localPaths(env).preferencesPath, preferencesSchema) ?? {};
-}
-async function savePreferences(value) {
-	const paths = localPaths();
-	await fs.mkdir(paths.dataDir, {
-		recursive: true,
-		mode: 448
-	});
-	const temporaryPath = `${paths.preferencesPath}.${process.pid}.tmp`;
-	await fs.writeFile(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, { mode: 384 });
-	await fs.rename(temporaryPath, paths.preferencesPath);
-}
-async function resolveLocalApiUrl(env = process.env) {
-	const explicit = env.TREEPORT_API_URL?.trim();
-	const managedApiUrl = env.TREEPORT_MANAGED_API_URL?.trim();
-	const daemonRecordPath = env.TREEPORT_DAEMON_RECORD?.trim();
-	if (explicit && explicit !== managedApiUrl) return explicit.replace(/\/$/, "");
-	if (managedApiUrl && daemonRecordPath) {
-		const record = await readJson$1(path.resolve(expandHome(daemonRecordPath)), daemonRecordSchema);
-		if (record) return record.apiUrl.replace(/\/$/, "");
-	}
-	if (explicit) return explicit.replace(/\/$/, "");
-	const saved = await preferences(env);
-	return listenerUrl(env.TREEPORT_HOST?.trim() || env.HOST?.trim() || saved.host || DEFAULT_HOST, Number.parseInt(env.TREEPORT_PORT?.trim() || env.PORT?.trim() || String(saved.port ?? DEFAULT_PORT), 10));
-}
-async function resolvePackagePath(...segments) {
-	const candidates = [fileURLToPath(new URL("../../../", import.meta.url)), fileURLToPath(new URL("../../", import.meta.url))];
-	for (const candidate of candidates) if (await fs.access(path.join(candidate, "package.json")).then(() => true).catch(() => false)) return path.join(candidate, ...segments);
-	throw new Error("Could not locate the Treeport package directory");
-}
-async function treeportVersion() {
-	return (await readJson$1(await resolvePackagePath("package.json"), z.looseObject({ version: z.string().optional() })))?.version ?? "development";
-}
-function processExists(pid) {
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch (error) {
-		return error.code === "EPERM";
-	}
-}
-async function daemonHealth(apiUrl, timeoutMs = 1500) {
-	const signal = AbortSignal.timeout(timeoutMs);
-	return fetch(`${apiUrl}/api/health`, { signal }).then(async (response) => {
-		if (!response.ok) return null;
-		const result = healthRecordSchema.safeParse(await response.json());
-		return result.success ? result.data : null;
-	}).catch(() => null);
-}
-function matchesOwnership(state, observed) {
-	return observed.pid === state.pid && observed.instanceId === state.instanceId && path.resolve(state.dataDir) === localPaths().dataDir;
-}
-async function readState() {
-	return readJson$1(localPaths().statePath, daemonRecordSchema);
-}
-async function removeStaleState(state) {
-	const paths = localPaths();
-	for (const filePath of [paths.statePath, paths.lockPath]) if ((await readJson$1(filePath, z.looseObject({ instanceId: z.string() })))?.instanceId === state.instanceId) await fs.rm(filePath, { force: true });
-}
-async function stopOwned(state) {
-	if (!processExists(state.pid)) {
-		await removeStaleState(state);
-		return;
-	}
-	const observed = await daemonHealth(state.apiUrl);
-	if (!observed || !matchesOwnership(state, observed)) throw new Error(`Refusing to stop PID ${state.pid}: Treeport could not verify ownership. Check ${localPaths().statePath}.`);
-	process.kill(state.pid, "SIGTERM");
-	const deadline = Date.now() + 7e3;
-	while (Date.now() < deadline) {
-		if (!processExists(state.pid)) {
-			await removeStaleState(state);
-			return;
-		}
-		await new Promise((resolve) => setTimeout(resolve, 100));
-	}
-	throw new Error(`Treeport did not stop within 7 seconds. See ${localPaths().logPath}.`);
-}
-async function executableCheck(executable, args) {
-	return new Promise((resolve) => {
-		const child = spawn(executable, args, { stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		] });
-		let output = "";
-		child.stdout.setEncoding("utf8");
-		child.stderr.setEncoding("utf8");
-		child.stdout.on("data", (chunk) => {
-			output += chunk;
-		});
-		child.stderr.on("data", (chunk) => {
-			output += chunk;
-		});
-		child.once("error", (error) => resolve({
-			ok: false,
-			detail: error.message
-		}));
-		child.once("close", (code) => resolve({
-			ok: code === 0,
-			detail: output.trim() || `exited with status ${code ?? 1}`
-		}));
-	});
-}
-const tailscaleStatusResponseSchema = z.looseObject({
-	BackendState: z.string().optional(),
-	Self: z.looseObject({ DNSName: z.string().optional() }).optional()
-});
-const tailscaleServeConfigurationSchema = z.lazy(() => z.looseObject({
-	TCP: z.record(z.string(), z.looseObject({})).optional(),
-	Foreground: z.record(z.string(), tailscaleServeConfigurationSchema).optional(),
-	Web: z.record(z.string(), z.looseObject({ Handlers: z.record(z.string(), z.looseObject({ Proxy: z.string().optional() })).optional() })).optional()
-}));
-async function tailscale(args) {
-	return new Promise((resolve, reject) => {
-		const child = spawn("tailscale", args, { stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		] });
-		let stdout = "";
-		let stderr = "";
-		child.stdout.setEncoding("utf8");
-		child.stderr.setEncoding("utf8");
-		child.stdout.on("data", (chunk) => {
-			stdout += chunk;
-		});
-		child.stderr.on("data", (chunk) => {
-			stderr += chunk;
-		});
-		child.once("error", (error) => reject(/* @__PURE__ */ new Error(error.code === "ENOENT" ? "Tailscale is required for remote access. Install it from https://tailscale.com/download, run `tailscale up`, then retry." : `Could not run Tailscale: ${error.message}`)));
-		child.once("close", (code) => {
-			if (code === 0) {
-				resolve(stdout);
-				return;
-			}
-			const detail = [stderr.trim(), stdout.trim()].filter(Boolean).join("\n");
-			reject(/* @__PURE__ */ new Error(`Tailscale ${args[0]} failed${detail ? `: ${detail}` : ` (status ${code ?? 1})`}`));
-		});
-	});
-}
-function tailscaleJson(value, command, schema) {
-	const result = schema.safeParse(JSON.parse(value));
-	if (!result.success) throw new Error(`Tailscale ${command} returned an invalid JSON response`);
-	return result.data;
-}
-function remotePreference(value) {
-	if (value.remote === void 0) return null;
-	if (!Number.isInteger(value.remote.port) || value.remote.port < 1 || value.remote.port > 65535 || !value.remote.target) throw new Error("Treeport remote access preferences are invalid");
-	return value.remote;
-}
-function localProxyTarget(apiUrl) {
-	if (!URL.canParse(apiUrl)) throw new Error("Treeport remote access requires a loopback daemon URL");
-	const url = new URL(apiUrl);
-	if (url.protocol !== "http:" || ![
-		"127.0.0.1",
-		"localhost",
-		"::1",
-		"[::1]"
-	].includes(url.hostname)) throw new Error("Treeport remote access requires a loopback daemon. Run `treeport start --host 127.0.0.1`, then try again.");
-	return `http://${url.host}`;
-}
-function portIsServed(config, port) {
-	const tcp = config.TCP;
-	if (tcp && Object.hasOwn(tcp, String(port))) return true;
-	return Object.values(config.Foreground ?? {}).some((value) => portIsServed(value, port));
-}
-function rootProxyForPort(config, port) {
-	for (const [hostPort, server] of Object.entries(config.Web ?? {})) {
-		if (!hostPort.endsWith(`:${port}`)) continue;
-		const proxy = server.Handlers?.["/"]?.Proxy;
-		if (proxy !== void 0) return proxy;
-	}
-	return null;
-}
-function proxyMatches(actual, expected) {
-	return actual !== null && expected !== void 0 && actual.replace(/\/$/, "") === expected.replace(/\/$/, "");
-}
-async function tailscaleServeConfig() {
-	return tailscaleJson(await tailscale([
-		"serve",
-		"status",
-		"--json"
-	]), "serve status", tailscaleServeConfigurationSchema);
-}
-async function tailscaleRemoteUrl(port) {
-	const status = tailscaleJson(await tailscale(["status", "--json"]), "status", tailscaleStatusResponseSchema);
-	if (status.BackendState !== "Running") throw new Error("Tailscale is not connected. Run `tailscale up` then try again.");
-	const dnsName = status.Self?.DNSName;
-	if (!dnsName?.trim()) throw new Error("Tailscale did not report a DNS name. Enable MagicDNS, then try again.");
-	return `https://${dnsName.trim().replace(/\.$/, "")}${port === 443 ? "" : `:${port}`}`;
-}
-async function enableTailscaleRemote(options) {
-	if (options.port !== void 0 && (!Number.isInteger(options.port) || options.port < 1 || options.port > 65535)) throw new Error("--port must be an integer between 1 and 65535");
-	const saved = await preferences();
-	const remote = remotePreference(saved);
-	const port = options.port ?? remote?.port ?? DEFAULT_PORT;
-	if (remote && remote.port !== port) throw new Error(`Treeport remote access is already configured on port ${remote.port}. Run \`treeport remote disable\` before choosing another port.`);
-	const expectedTarget = localProxyTarget((await daemonStatus()).state?.apiUrl ?? await resolveLocalApiUrl());
-	const [url, config] = await Promise.all([tailscaleRemoteUrl(port), tailscaleServeConfig()]);
-	const existingTarget = rootProxyForPort(config, port);
-	if ((portIsServed(config, port) || existingTarget !== null) && !proxyMatches(existingTarget, expectedTarget) && !proxyMatches(existingTarget, remote?.target)) throw new Error(`Tailscale Serve already uses port ${port}. Choose another port with \`treeport remote enable --port <port>\`.`);
-	const target = localProxyTarget((options.daemon ?? await daemonUp({})).apiUrl);
-	const alreadyEnabled = proxyMatches(existingTarget, target);
-	if (!alreadyEnabled) await tailscale([
-		"serve",
-		"--bg",
-		`--https=${port}`,
-		target
-	]);
-	await savePreferences({
-		...saved,
-		remote: {
-			port,
-			target
-		}
-	});
-	return {
-		alreadyEnabled,
-		port,
-		url
-	};
-}
-async function tailscaleRemoteStatus() {
-	const remote = remotePreference(await preferences());
-	if (!remote) return {
-		configured: false,
-		active: false,
-		port: null,
-		url: null
-	};
-	const [url, config] = await Promise.all([tailscaleRemoteUrl(remote.port), tailscaleServeConfig()]);
-	return {
-		configured: true,
-		active: proxyMatches(rootProxyForPort(config, remote.port), remote.target),
-		port: remote.port,
-		url
-	};
-}
-async function disableTailscaleRemote() {
-	const saved = await preferences();
-	const remote = remotePreference(saved);
-	if (!remote) return {
-		wasEnabled: false,
-		changedTailscale: false
-	};
-	if (proxyMatches(rootProxyForPort(await tailscaleServeConfig(), remote.port), remote.target)) {
-		await tailscale([
-			"serve",
-			`--https=${remote.port}`,
-			"off"
-		]);
-		delete saved.remote;
-		await savePreferences(saved);
-		return {
-			wasEnabled: true,
-			changedTailscale: true
-		};
-	}
-	delete saved.remote;
-	await savePreferences(saved);
-	return {
-		wasEnabled: false,
-		changedTailscale: false
-	};
-}
-async function runDoctor() {
-	const paths = localPaths();
-	const gitPath = process.env.TREEPORT_GIT_PATH?.trim() || "git";
-	const tmuxPath = process.env.TREEPORT_TMUX_PATH?.trim() || "tmux";
-	const [git, tmux] = await Promise.all([executableCheck(gitPath, ["--version"]), executableCheck(tmuxPath, ["-V"])]);
-	const tmuxMatch = /tmux\s+(\d+)\.(\d+)/i.exec(tmux.detail);
-	const tmuxSupported = Boolean(tmux.ok && tmuxMatch && (Number(tmuxMatch[1]) > 3 || Number(tmuxMatch[1]) === 3 && Number(tmuxMatch[2]) >= 2));
-	const checkDirectory = (directoryPath) => fs.mkdir(directoryPath, {
-		recursive: true,
-		mode: 448
-	}).then(() => ({
-		ok: true,
-		detail: directoryPath
-	})).catch((error) => ({
-		ok: false,
-		detail: `${directoryPath}: ${error instanceof Error ? error.message : String(error)}`
-	}));
-	const [dataDirectory, runtimeDirectory] = await Promise.all([checkDirectory(paths.dataDir), checkDirectory(paths.runtimeDir)]);
-	return [
-		{
-			name: "Node",
-			ok: true,
-			detail: process.version
-		},
-		{
-			name: "Git",
-			...git
-		},
-		{
-			name: "tmux",
-			ok: tmuxSupported,
-			detail: tmuxSupported ? tmux.detail : `${tmux.detail}. Treeport requires tmux 3.2 or newer.`
-		},
-		{
-			name: "Data directory",
-			...dataDirectory
-		},
-		{
-			name: "Runtime directory",
-			...runtimeDirectory
-		}
-	];
-}
-async function daemonStatus() {
-	const state = await readState();
-	if (!state) return {
-		running: false,
-		state: null,
-		health: null,
-		verified: false
-	};
-	if (!processExists(state.pid)) {
-		await removeStaleState(state);
-		return {
-			running: false,
-			state: null,
-			health: null,
-			verified: false
-		};
-	}
-	const observed = await daemonHealth(state.apiUrl);
-	return {
-		running: Boolean(observed),
-		state,
-		health: observed,
-		verified: Boolean(observed && matchesOwnership(state, observed))
-	};
-}
-async function daemonUp(options) {
-	if (options.port !== void 0 && (!Number.isInteger(options.port) || options.port < 1 || options.port > 65535)) throw new Error("--port must be an integer between 1 and 65535");
-	const paths = localPaths();
-	const saved = await preferences();
-	const next = {
-		...saved,
-		host: options.host?.trim() || saved.host || DEFAULT_HOST,
-		port: options.port ?? saved.port ?? DEFAULT_PORT
-	};
-	const host = options.host?.trim() || process.env.TREEPORT_HOST?.trim() || process.env.HOST?.trim() || next.host;
-	assertLoopbackHost(host);
-	if (options.host !== void 0 || options.port !== void 0) await savePreferences(next);
-	const port = Number.parseInt(options.port === void 0 ? process.env.TREEPORT_PORT?.trim() || process.env.PORT?.trim() || String(next.port) : String(options.port), 10);
-	const apiUrl = options.host !== void 0 || options.port !== void 0 ? listenerUrl(host, port) : process.env.TREEPORT_API_URL?.trim() || listenerUrl(host, port);
-	const currentVersion = await treeportVersion();
-	const existing = await daemonStatus();
-	if (existing.state) {
-		if (!existing.running || !existing.verified) throw new Error(`Treeport PID ${existing.state.pid} is running but ownership or health could not be verified. See ${paths.logPath}.`);
-		if (existing.health?.version === currentVersion && existing.state.apiUrl === apiUrl) return {
-			alreadyRunning: true,
-			apiUrl: existing.state.apiUrl,
-			pid: existing.state.pid
-		};
-		await stopOwned(existing.state);
-	}
-	const failedChecks = (await runDoctor()).filter((check) => !check.ok);
-	if (failedChecks.length) throw new Error(failedChecks.map((check) => `${check.name}: ${check.detail}`).join("\n"));
-	const serverEntry = await resolvePackagePath("dist", "node", "server", "index.js");
-	const webDist = await resolvePackagePath("dist", "web");
-	await fs.access(serverEntry);
-	await fs.mkdir(path.dirname(paths.logPath), {
-		recursive: true,
-		mode: 448
-	});
-	if (await fs.stat(paths.logPath).then((value) => value.size).catch(() => 0) > 5 * 1024 * 1024) {
-		await fs.rm(`${paths.logPath}.1`, { force: true });
-		await fs.rename(paths.logPath, `${paths.logPath}.1`);
-	}
-	const instanceId = crypto.randomUUID();
-	const childEnvironment = {
-		...process.env,
-		TREEPORT_HOST: host,
-		TREEPORT_PORT: String(port),
-		TREEPORT_API_URL: apiUrl,
-		TREEPORT_DATA_DIR: paths.dataDir,
-		TREEPORT_RUNTIME_DIR: paths.runtimeDir,
-		TREEPORT_APP_VERSION: currentVersion,
-		TREEPORT_INSTANCE_ID: instanceId,
-		TREEPORT_INSTALLATION_METHOD: process.env.TREEPORT_INSTALLATION_METHOD?.trim() || "npm",
-		TREEPORT_DAEMON_LIFECYCLE: "treeport",
-		TREEPORT_WEB_DIST: webDist
-	};
-	if (options.foreground) {
-		console.log(`Treeport will listen on ${apiUrl}`);
-		const child = spawn(process.execPath, [serverEntry], {
-			env: childEnvironment,
-			stdio: "inherit"
-		});
-		const code = await new Promise((resolve, reject) => {
-			child.once("error", reject);
-			child.once("close", (value) => resolve(value ?? 1));
-		});
-		if (code !== 0) throw new Error(`Treeport exited with status ${code}`);
-		return {
-			alreadyRunning: false,
-			apiUrl,
-			pid: child.pid ?? 0
-		};
-	}
-	const log = fsSync.openSync(paths.logPath, "a", 384);
-	const child = spawn(process.execPath, [serverEntry], {
-		env: childEnvironment,
-		detached: true,
-		stdio: [
-			"ignore",
-			log,
-			log
-		]
-	});
-	child.unref();
-	fsSync.closeSync(log);
-	const deadline = Date.now() + 15e3;
-	while (Date.now() < deadline) {
-		const observed = await daemonHealth(apiUrl, 500);
-		if (observed && observed.pid === child.pid && observed.instanceId === instanceId && observed.version === currentVersion) return {
-			alreadyRunning: false,
-			apiUrl,
-			pid: child.pid ?? observed.pid
-		};
-		if (child.pid && !processExists(child.pid)) break;
-		await new Promise((resolve) => setTimeout(resolve, 100));
-	}
-	const recentLog = await fs.readFile(paths.logPath, "utf8").then((value) => value.split("\n").slice(-20).join("\n").trim()).catch(() => "");
-	throw new Error(`Treeport did not become ready at ${apiUrl}. See ${paths.logPath}.${recentLog ? `\n\n${recentLog}` : ""}`);
-}
-async function daemonDown() {
-	const state = await readState();
-	if (!state) return { wasRunning: false };
-	await stopOwned(state);
-	return { wasRunning: true };
-}
-async function readDaemonLogs(lines = 100) {
-	return (await fs.readFile(localPaths().logPath, "utf8").catch((error) => {
-		if (error.code === "ENOENT") return "";
-		throw error;
-	})).split("\n").slice(-lines - 1).join("\n");
-}
-//#endregion
-//#region src/cli/service.ts
-const serviceRecordSchema = z.strictObject({
-	schemaVersion: z.literal(1),
-	manager: z.enum(["launchd", "systemd"]),
-	platform: z.string(),
-	uid: z.number().int().nonnegative(),
-	gid: z.number().int().nonnegative(),
-	username: z.string().min(1),
-	group: z.string().min(1),
-	home: z.string().min(1),
-	dataDir: z.string().min(1),
-	runtimeDir: z.string().min(1),
-	logPath: z.string().min(1),
-	apiUrl: z.string().min(1),
-	cliEntrypoint: z.string().min(1),
-	runtimeExecutable: z.string().min(1).nullable().default(null),
-	runtimeEntrypoint: z.string().min(1).nullable().default(null),
-	installationMethod: z.enum(["curl", "npm"]),
-	definitionName: z.string().min(1),
-	definitionPath: z.string().min(1),
-	definitionHash: z.string().length(64),
-	environmentHash: z.string().length(64),
-	environment: z.record(z.string(), z.string()),
-	requestedState: z.enum(["running", "stopped"]),
-	pendingAdministratorRequestId: z.string().nullable(),
-	createdAt: z.string(),
-	updatedAt: z.string()
-});
-const administratorRequestSchema = z.strictObject({
-	schemaVersion: z.literal(1),
-	id: z.string().uuid(),
-	operation: z.enum([
-		"enable",
-		"start",
-		"stop",
-		"disable"
-	]),
-	createdAt: z.string(),
-	expiresAt: z.string(),
-	uid: z.number().int().nonnegative(),
-	gid: z.number().int().nonnegative(),
-	username: z.string().min(1),
-	group: z.string().min(1),
-	home: z.string().min(1),
-	serviceRecordPath: z.string().min(1),
-	runnerPath: z.string().min(1),
-	definitionName: z.string().min(1),
-	definitionPath: z.string().min(1),
-	stagedDefinitionPath: z.string().min(1),
-	definitionHash: z.string().length(64),
-	apiUrl: z.string().min(1),
-	cliEntrypoint: z.string().min(1),
-	runtimeExecutable: z.string().min(1),
-	runtimeEntrypoint: z.string().min(1)
-});
-function managerForPlatform(platform = process.platform) {
-	return platform === "darwin" ? "launchd" : platform === "linux" ? "systemd" : null;
-}
-function servicePaths(env = process.env) {
-	const paths = localPaths(env);
-	const directory = path.join(paths.dataDir, "service");
-	return {
-		directory,
-		recordPath: path.join(directory, "service.json"),
-		runnerPath: path.join(directory, "run"),
-		requestsDirectory: path.join(directory, "requests"),
-		stagedDefinitionPath: path.join(directory, "treeport.plist")
-	};
-}
-async function readJson(filePath, schema) {
-	return fs.readFile(filePath, "utf8").then((value) => schema.parse(JSON.parse(value))).catch(() => null);
-}
-async function writeJson(filePath, value) {
-	await fs.mkdir(path.dirname(filePath), {
-		recursive: true,
-		mode: 448
-	});
-	const temporaryPath = `${filePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
-	await fs.writeFile(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, { mode: 384 });
-	await fs.rename(temporaryPath, filePath);
-}
-function fingerprint(value) {
-	const parsed = z.string().safeParse(value);
-	const source = parsed.success ? parsed.data : JSON.stringify(Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right))));
-	return crypto.createHash("sha256").update(source).digest("hex");
-}
-function xml(value) {
-	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&apos;");
-}
-function shellQuote(value) {
-	return `'${value.replaceAll("'", `'\\''`)}'`;
-}
-function createAdministratorCommand(input) {
-	return `sudo ${input.installationMethod === "curl" ? shellQuote(input.cliEntrypoint) : `${shellQuote(input.runtimeExecutable)} ${shellQuote(input.runtimeEntrypoint)}`} service apply --request ${shellQuote(input.requestPath)}`;
-}
-function systemdValue(value) {
-	return value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"").replaceAll("%", "%%").replaceAll("\n", "\\n");
-}
-function createLaunchdDefinition(input) {
-	return {
-		label: input.label,
-		programArguments: [input.runnerPath],
-		username: input.username,
-		group: input.group,
-		environment: input.environment,
-		workingDirectory: input.home,
-		standardOutPath: input.logPath,
-		standardErrorPath: input.logPath,
-		keepAlive: true,
-		processType: "Background",
-		throttleInterval: 10,
-		exitTimeOut: 10,
-		abandonProcessGroup: true,
-		umask: 63
-	};
-}
-function serializeLaunchdDefinition(definition) {
-	const environment = Object.entries(definition.environment).sort(([left], [right]) => left.localeCompare(right)).map(([name, value]) => `      <key>${xml(name)}</key>\n      <string>${xml(value)}</string>`).join("\n");
-	const argumentsXml = definition.programArguments.map((argument) => `      <string>${xml(argument)}</string>`).join("\n");
-	return `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-  <dict>
-    <key>Label</key>
-    <string>${xml(definition.label)}</string>
-    <key>ProgramArguments</key>
-    <array>
-${argumentsXml}
-    </array>
-    <key>UserName</key>
-    <string>${xml(definition.username)}</string>
-    <key>GroupName</key>
-    <string>${xml(definition.group)}</string>
-    <key>EnvironmentVariables</key>
-    <dict>
-${environment}
-    </dict>
-    <key>WorkingDirectory</key>
-    <string>${xml(definition.workingDirectory)}</string>
-    <key>StandardOutPath</key>
-    <string>${xml(definition.standardOutPath)}</string>
-    <key>StandardErrorPath</key>
-    <string>${xml(definition.standardErrorPath)}</string>
-    <key>KeepAlive</key>
-    <true/>
-    <key>ProcessType</key>
-    <string>${definition.processType}</string>
-    <key>ThrottleInterval</key>
-    <integer>${definition.throttleInterval}</integer>
-    <key>ExitTimeOut</key>
-    <integer>${definition.exitTimeOut}</integer>
-    <key>AbandonProcessGroup</key>
-    <true/>
-    <key>Umask</key>
-    <integer>${definition.umask}</integer>
-  </dict>
-</plist>
-`;
-}
-function createSystemdDefinition(input) {
-	return {
-		description: "Treeport daemon",
-		execStart: input.runnerPath,
-		environment: input.environment,
-		restart: "always",
-		restartSeconds: 5,
-		timeoutStopSeconds: 10,
-		killMode: "process",
-		wantedBy: "default.target"
-	};
-}
-function serializeSystemdDefinition(definition) {
-	const environment = Object.entries(definition.environment).sort(([left], [right]) => left.localeCompare(right)).map(([name, value]) => `Environment="${systemdValue(name)}=${systemdValue(value)}"`).join("\n");
-	return `[Unit]
-Description=${definition.description}
-
-[Service]
-Type=simple
-ExecStart="${systemdValue(definition.execStart)}"
-${environment}
-Restart=${definition.restart}
-RestartSec=${definition.restartSeconds}
-TimeoutStopSec=${definition.timeoutStopSeconds}
-KillMode=${definition.killMode}
-
-[Install]
-WantedBy=${definition.wantedBy}
-`;
-}
-async function runCommand(executable, args, environment = process.env) {
-	return new Promise((resolve) => {
-		const child = spawn(executable, args, {
-			env: environment,
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			]
-		});
-		let stdout = "";
-		let stderr = "";
-		child.stdout.setEncoding("utf8");
-		child.stderr.setEncoding("utf8");
-		child.stdout.on("data", (value) => {
-			stdout += value;
-		});
-		child.stderr.on("data", (value) => {
-			stderr += value;
-		});
-		child.once("error", (error) => {
-			resolve({
-				code: 127,
-				stdout,
-				stderr: error.message
-			});
-		});
-		child.once("close", (code) => {
-			resolve({
-				code: code ?? 1,
-				stdout,
-				stderr
-			});
-		});
-	});
-}
-function commandError(command, result) {
-	const detail = [result.stderr.trim(), result.stdout.trim()].filter(Boolean).join("\n");
-	return /* @__PURE__ */ new Error(`${command} failed${detail ? `: ${detail}` : ` with status ${result.code}`}`);
-}
-async function executablePath(name) {
-	const candidates = name === "launchctl" ? ["/bin/launchctl", "/usr/bin/launchctl"] : [`/usr/bin/${name}`, `/bin/${name}`];
-	for (const candidate of candidates) if (await fs.access(candidate, constants.X_OK).then(() => true).catch(() => false)) return candidate;
-	return name;
-}
-async function primaryGroup(username) {
-	const result = await runCommand(await executablePath("id"), ["-gn", username]);
-	if (result.code !== 0 || !result.stdout.trim()) throw commandError("id -gn", result);
-	return result.stdout.trim();
-}
-function currentEntrypoint() {
-	const value = process.env.TREEPORT_CLI_ENTRYPOINT?.trim() || process.argv[1]?.trim();
-	return value ? path.resolve(value) : null;
-}
-async function ensureEntrypoint(installationMethod) {
-	const entrypoint = currentEntrypoint();
-	if (!entrypoint) throw new Error("Treeport could not identify a stable CLI entrypoint. Install Treeport with npm or the curl installer, then retry.");
-	await fs.access(entrypoint, constants.X_OK).catch(() => {
-		throw new Error(`Treeport cannot execute its stable CLI entrypoint at ${entrypoint}. Reinstall Treeport, then retry.`);
-	});
-	if (installationMethod === "npm") {
-		const [actual, expected] = await Promise.all([fs.realpath(entrypoint), fs.realpath(await resolvePackagePath("bin", "treeport.mjs"))]);
-		if (actual !== expected) throw new Error(`The current CLI entrypoint is not the installed Treeport npm bin: ${entrypoint}`);
-	}
-	return entrypoint;
-}
-async function currentAdministratorRuntime() {
-	const invokedEntrypoint = process.argv[1]?.trim();
-	if (!invokedEntrypoint) throw new Error("Treeport could not identify its Node entrypoint.");
-	const runtimeEntrypoint = path.resolve(invokedEntrypoint);
-	const [runtimeExecutable, actualEntrypoint, packageBinEntrypoint, packageCliEntrypoint] = await Promise.all([
-		fs.realpath(process.execPath),
-		fs.realpath(runtimeEntrypoint),
-		fs.realpath(await resolvePackagePath("bin", "treeport.mjs")),
-		fs.realpath(await resolvePackagePath("dist", "node", "cli", "index.js"))
-	]);
-	if (actualEntrypoint !== packageBinEntrypoint && actualEntrypoint !== packageCliEntrypoint) throw new Error(`Treeport cannot use an unrecognized package entrypoint for administrator commands: ${runtimeEntrypoint}`);
-	await Promise.all([fs.access(runtimeExecutable, constants.X_OK), fs.access(runtimeEntrypoint, constants.R_OK)]);
-	return {
-		runtimeExecutable,
-		runtimeEntrypoint
-	};
-}
-function cacheDirectory(home, env) {
-	const configured = env.TREEPORT_CACHE_DIR?.trim();
-	if (configured) return path.resolve(configured.replace(/^~(?=\/|$)/, home));
-	if (env.XDG_CACHE_HOME?.trim()) return path.join(path.resolve(env.XDG_CACHE_HOME.replace(/^~(?=\/|$)/, home)), "treeport");
-	return process.platform === "darwin" ? path.join(home, "Library", "Caches", "treeport") : path.join(home, ".cache", "treeport");
-}
-function createServiceEnvironment(input) {
-	const env = input.env ?? process.env;
-	const url = new URL(input.apiUrl);
-	assertLoopbackHost(url.hostname);
-	const result = {
-		HOME: input.user.homedir,
-		USER: input.user.username,
-		LOGNAME: input.user.username,
-		PATH: env.PATH?.trim() || "/usr/local/bin:/usr/bin:/bin",
-		TREEPORT_HOST: url.hostname,
-		TREEPORT_PORT: url.port || "80",
-		TREEPORT_API_URL: input.apiUrl,
-		TREEPORT_DATA_DIR: input.paths.dataDir,
-		TREEPORT_RUNTIME_DIR: input.paths.runtimeDir,
-		TREEPORT_CACHE_DIR: cacheDirectory(input.user.homedir, env),
-		TREEPORT_DATABASE_PATH: env.TREEPORT_DATABASE_PATH?.trim() || path.join(input.paths.dataDir, "treeport.db"),
-		TREEPORT_SHELL: env.TREEPORT_SHELL?.trim() || env.SHELL?.trim() || "/bin/sh",
-		TREEPORT_TMUX_PATH: env.TREEPORT_TMUX_PATH?.trim() || "tmux",
-		TREEPORT_GIT_PATH: env.TREEPORT_GIT_PATH?.trim() || "git",
-		TREEPORT_GH_PATH: env.TREEPORT_GH_PATH?.trim() || "gh",
-		TREEPORT_DAEMON_LIFECYCLE: "service",
-		TREEPORT_INSTALLATION_METHOD: input.installationMethod,
-		TREEPORT_SERVICE_RECORD: input.recordPath
-	};
-	for (const [name, value] of Object.entries(env)) if (value !== void 0 && (name === "LANG" || name === "LC_ALL" || name.startsWith("LC_"))) result[name] = value;
-	return result;
-}
-function definitionForRecord(record) {
-	if (record.manager === "launchd") return serializeLaunchdDefinition(createLaunchdDefinition({
-		label: record.definitionName,
-		runnerPath: servicePaths({ TREEPORT_DATA_DIR: record.dataDir }).runnerPath,
-		username: record.username,
-		group: record.group,
-		environment: record.environment,
-		home: record.home,
-		logPath: record.logPath
-	}));
-	return serializeSystemdDefinition(createSystemdDefinition({
-		runnerPath: servicePaths({ TREEPORT_DATA_DIR: record.dataDir }).runnerPath,
-		environment: record.environment
-	}));
-}
-function runnerSource(record) {
-	return `#!/bin/sh
-set -u
-entrypoint=${shellQuote(record.cliEntrypoint)}
-record=${shellQuote(servicePaths({ TREEPORT_DATA_DIR: record.dataDir }).recordPath)}
-log=${shellQuote(record.logPath)}
-reported=0
-while [ ! -x "$entrypoint" ]; do
-  if [ "$reported" -eq 0 ]; then
-    mkdir -p "$(dirname "$log")"
-    printf '%s Treeport service cannot start because %s is missing. Reinstall Treeport, then run treeport service enable or treeport service disable.\n' "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" "$entrypoint" >> "$log"
-    reported=1
-  fi
-  sleep 60
-done
-export TREEPORT_SERVICE_RECORD="$record"
-exec "$entrypoint" service run
-`;
-}
-async function currentRecord() {
-	return readJson(servicePaths().recordPath, serviceRecordSchema);
-}
-async function saveRecord(record) {
-	await writeJson(servicePaths({ TREEPORT_DATA_DIR: record.dataDir }).recordPath, record);
-}
-async function managerState(record) {
-	if (record.manager === "launchd") {
-		const launchctl = await executablePath("launchctl");
-		const [active, disabled, definitionExists] = await Promise.all([
-			runCommand(launchctl, ["print", `system/${record.definitionName}`]),
-			runCommand(launchctl, ["print-disabled", "system"]),
-			fs.access(record.definitionPath).then(() => true).catch(() => false)
-		]);
-		return {
-			active: active.code === 0,
-			enabled: definitionExists && !disabled.stdout.includes(`"${record.definitionName}" => true`),
-			lingering: true,
-			managerIssue: null
-		};
-	}
-	const systemctl = await executablePath("systemctl");
-	const [active, enabled, linger] = await Promise.all([
-		runCommand(systemctl, [
-			"--user",
-			"is-active",
-			record.definitionName
-		]),
-		runCommand(systemctl, [
-			"--user",
-			"is-enabled",
-			record.definitionName
-		]),
-		runCommand(await executablePath("loginctl"), [
-			"show-user",
-			record.username,
-			"-p",
-			"Linger",
-			"--value"
-		])
-	]);
-	return {
-		active: active.code === 0 && active.stdout.trim() === "active",
-		enabled: enabled.code === 0 && enabled.stdout.trim() === "enabled",
-		lingering: linger.code === 0 && linger.stdout.trim() === "yes",
-		managerIssue: active.code === 127 || active.stderr.includes("Failed to connect to bus") || active.stderr.includes("No medium found") ? "The systemd user manager is not available." : linger.code === 127 ? "loginctl is not available." : null
-	};
-}
-function administratorCommand(record) {
-	const requestId = record.pendingAdministratorRequestId;
-	if (!requestId || !record.runtimeExecutable || !record.runtimeEntrypoint) return null;
-	const requestPath = path.join(servicePaths({ TREEPORT_DATA_DIR: record.dataDir }).requestsDirectory, `${requestId}.json`);
-	return createAdministratorCommand({
-		installationMethod: record.installationMethod,
-		cliEntrypoint: record.cliEntrypoint,
-		runtimeExecutable: record.runtimeExecutable,
-		runtimeEntrypoint: record.runtimeEntrypoint,
-		requestPath
-	});
-}
-async function untrackedDefinition() {
-	const manager = managerForPlatform();
-	if (!manager) return null;
-	const user = os.userInfo();
-	const name = manager === "launchd" ? `app.treeport.daemon.${user.uid}` : "treeport.service";
-	const definitionPath = manager === "launchd" ? `/Library/LaunchDaemons/${name}.plist` : path.join(process.env.XDG_CONFIG_HOME?.trim() || path.join(user.homedir, ".config"), "systemd", "user", name);
-	return await fs.access(definitionPath).then(() => true).catch(() => false) ? {
-		manager,
-		name,
-		path: definitionPath
-	} : null;
-}
-async function serviceInstalled() {
-	return await currentRecord() !== null || await untrackedDefinition() !== null;
-}
-async function serviceStatus() {
-	const manager = managerForPlatform();
-	const record = await currentRecord();
-	if (!manager) return {
-		supported: false,
-		manager: null,
-		state: "disabled",
-		installed: false,
-		enabledAtBoot: false,
-		active: false,
-		healthy: false,
-		rebootReady: false,
-		definitionMatches: false,
-		environmentMatches: false,
-		entrypointMatches: false,
-		requestedState: null,
-		definitionPath: null,
-		entrypoint: null,
-		daemon: null,
-		issues: [`Treeport service mode does not support ${process.platform}.`],
-		recoveryCommands: [],
-		administratorCommand: null
-	};
-	if (!record) {
-		const untracked = await untrackedDefinition();
-		if (!untracked) return {
-			supported: true,
-			manager,
-			state: "disabled",
-			installed: false,
-			enabledAtBoot: false,
-			active: false,
-			healthy: false,
-			rebootReady: false,
-			definitionMatches: false,
-			environmentMatches: false,
-			entrypointMatches: false,
-			requestedState: null,
-			definitionPath: null,
-			entrypoint: null,
-			daemon: null,
-			issues: [],
-			recoveryCommands: ["treeport service enable"],
-			administratorCommand: null
-		};
-		return {
-			supported: true,
-			manager,
-			state: "stale",
-			installed: true,
-			enabledAtBoot: true,
-			active: (untracked.manager === "launchd" ? await runCommand(await executablePath("launchctl"), ["print", `system/${untracked.name}`]) : await runCommand(await executablePath("systemctl"), [
-				"--user",
-				"is-active",
-				untracked.name
-			])).code === 0,
-			healthy: false,
-			rebootReady: false,
-			definitionMatches: false,
-			environmentMatches: false,
-			entrypointMatches: false,
-			requestedState: null,
-			definitionPath: untracked.path,
-			entrypoint: null,
-			daemon: null,
-			issues: [`A Treeport service definition exists at ${untracked.path}, but its service record is missing. Restore the original Treeport data directory or ask an administrator to inspect and remove the definition.`],
-			recoveryCommands: [],
-			administratorCommand: null
-		};
-	}
-	const paths = servicePaths({ TREEPORT_DATA_DIR: record.dataDir });
-	const [managerStatus, definitionContent, entrypointExists, runtimeExecutableExists, runtimeEntrypointExists, currentRuntime, daemon] = await Promise.all([
-		managerState(record),
-		fs.readFile(record.definitionPath, "utf8").catch(() => ""),
-		fs.access(record.cliEntrypoint, constants.X_OK).then(() => true).catch(() => false),
-		record.runtimeExecutable ? fs.access(record.runtimeExecutable, constants.X_OK).then(() => true).catch(() => false) : Promise.resolve(false),
-		record.runtimeEntrypoint ? fs.access(record.runtimeEntrypoint, constants.R_OK).then(() => true).catch(() => false) : Promise.resolve(false),
-		currentAdministratorRuntime().catch(() => null),
-		daemonStatus()
-	]);
-	const definitionPresent = definitionContent !== "";
-	const definitionMatches = definitionPresent && fingerprint(definitionContent) === record.definitionHash;
-	const invokedEntrypoint = currentEntrypoint();
-	const entrypointMatches = Boolean(entrypointExists && runtimeExecutableExists && runtimeEntrypointExists && currentRuntime && record.runtimeExecutable === currentRuntime.runtimeExecutable && record.runtimeEntrypoint === currentRuntime.runtimeEntrypoint && (invokedEntrypoint === null || path.resolve(invokedEntrypoint) === path.resolve(record.cliEntrypoint)));
-	const environmentMatches = fingerprint(createServiceEnvironment({
-		user: {
-			uid: record.uid,
-			gid: record.gid,
-			username: record.username,
-			homedir: record.home,
-			shell: record.environment.TREEPORT_SHELL ?? null
-		},
-		paths: localPaths({
-			TREEPORT_DATA_DIR: record.dataDir,
-			TREEPORT_RUNTIME_DIR: record.runtimeDir
-		}),
-		apiUrl: record.apiUrl,
-		recordPath: paths.recordPath,
-		installationMethod: record.installationMethod
-	})) === record.environmentHash;
-	const healthy = Boolean(daemon.verified && daemon.health?.daemonLifecycle === "service" && daemon.state?.daemonLifecycle === "service" && path.resolve(daemon.state.dataDir) === path.resolve(record.dataDir));
-	const installed = managerStatus.enabled;
-	const rebootReady = installed && (record.manager === "launchd" || managerStatus.lingering);
-	const pendingCommand = administratorCommand(record) ?? (record.manager === "systemd" && managerStatus.enabled && !managerStatus.lingering ? `sudo loginctl enable-linger ${record.username}` : null);
-	const issues = [];
-	const recoveryCommands = [];
-	if (record.manager !== manager) issues.push(`The service record uses ${record.manager}, but this host requires ${manager}.`);
-	if (!definitionMatches && !record.pendingAdministratorRequestId) {
-		issues.push(definitionPresent ? `The service definition at ${record.definitionPath} was changed.` : `The service definition is missing at ${record.definitionPath}.`);
-		recoveryCommands.push("treeport service enable");
-	}
-	if (definitionMatches && !installed && !record.pendingAdministratorRequestId) {
-		issues.push("The service definition is not enabled for startup after reboot.");
-		recoveryCommands.push("treeport service enable");
-	}
-	if (!entrypointMatches) {
-		issues.push(`The service CLI entrypoint or Node runtime is unavailable or moved: ${record.cliEntrypoint}`);
-		recoveryCommands.push("treeport service enable");
-	}
-	if (!environmentMatches) {
-		issues.push("The service environment differs from the current Treeport environment.");
-		recoveryCommands.push("treeport service enable");
-	}
-	if (record.manager === "systemd" && installed && !managerStatus.lingering) {
-		issues.push(`User lingering is disabled for ${record.username}.`);
-		recoveryCommands.push(`sudo loginctl enable-linger ${record.username}`);
-	}
-	if (managerStatus.managerIssue) issues.push(managerStatus.managerIssue);
-	if (installed && record.requestedState === "running" && !healthy && !record.pendingAdministratorRequestId) {
-		issues.push("The supervised Treeport daemon is not healthy.");
-		recoveryCommands.push("treeport start");
-	}
-	const stale = record.manager !== manager || !definitionMatches || !environmentMatches || !entrypointMatches || definitionPresent && !installed || managerStatus.managerIssue !== null;
-	return {
-		supported: true,
-		manager,
-		state: record.pendingAdministratorRequestId || record.manager === "systemd" && installed && !managerStatus.lingering ? "action_required" : stale ? "stale" : healthy ? "healthy" : installed && record.requestedState === "stopped" ? "stopped" : installed && managerStatus.active ? "starting" : installed ? "unhealthy" : "disabled",
-		installed,
-		enabledAtBoot: installed,
-		active: managerStatus.active,
-		healthy,
-		rebootReady,
-		definitionMatches,
-		environmentMatches,
-		entrypointMatches,
-		requestedState: record.requestedState,
-		definitionPath: record.definitionPath,
-		entrypoint: record.cliEntrypoint,
-		daemon,
-		issues,
-		recoveryCommands: [...new Set(recoveryCommands)],
-		administratorCommand: pendingCommand
-	};
-}
-async function prepareRecord() {
-	if (process.getuid?.() === 0) throw new Error("Run `treeport service enable` as the user who will run Treeport, not as root.");
-	const manager = managerForPlatform();
-	if (!manager) throw new Error(`Treeport service mode supports macOS launchd and Linux systemd; found ${process.platform}.`);
-	const explicitApiUrl = process.env.TREEPORT_API_URL?.trim();
-	if (explicitApiUrl) assertLoopbackHost(new URL(explicitApiUrl).hostname);
-	const user = os.userInfo();
-	const paths = localPaths();
-	const locations = servicePaths();
-	const apiUrl = await resolveLocalApiUrl();
-	const listener = new URL(apiUrl);
-	if (listener.protocol !== "http:") throw new Error("Treeport service mode requires a local HTTP loopback URL.");
-	assertLoopbackHost(listener.hostname);
-	const installationMethod = process.env.TREEPORT_INSTALLATION_METHOD?.trim() === "curl" ? "curl" : "npm";
-	const [cliEntrypoint, administratorRuntime] = await Promise.all([ensureEntrypoint(installationMethod), currentAdministratorRuntime()]);
-	const group = await primaryGroup(user.username);
-	const definitionName = manager === "launchd" ? `app.treeport.daemon.${user.uid}` : "treeport.service";
-	const definitionPath = manager === "launchd" ? `/Library/LaunchDaemons/${definitionName}.plist` : path.join(process.env.XDG_CONFIG_HOME?.trim() || path.join(user.homedir, ".config"), "systemd", "user", definitionName);
-	const environment = createServiceEnvironment({
-		user,
-		paths,
-		apiUrl,
-		recordPath: locations.recordPath,
-		installationMethod
-	});
-	const now = (/* @__PURE__ */ new Date()).toISOString();
-	const previous = await currentRecord();
-	if (await fs.access(definitionPath).then(() => true).catch(() => false) && !previous) throw new Error(`A Treeport service definition already exists at ${definitionPath}. Disable it from its original data directory before enabling another service.`);
-	if (previous && path.resolve(previous.dataDir) !== paths.dataDir) throw new Error(`Treeport service mode already uses ${previous.dataDir}. Disable it before enabling ${paths.dataDir}.`);
-	const base = {
-		schemaVersion: 1,
-		manager,
-		platform: process.platform,
-		uid: user.uid,
-		gid: user.gid,
-		username: user.username,
-		group,
-		home: user.homedir,
-		dataDir: paths.dataDir,
-		runtimeDir: paths.runtimeDir,
-		logPath: paths.logPath,
-		apiUrl,
-		cliEntrypoint,
-		runtimeExecutable: administratorRuntime.runtimeExecutable,
-		runtimeEntrypoint: administratorRuntime.runtimeEntrypoint,
-		installationMethod,
-		definitionName,
-		definitionPath,
-		definitionHash: "0".repeat(64),
-		environmentHash: fingerprint(environment),
-		environment,
-		requestedState: "running",
-		pendingAdministratorRequestId: null,
-		createdAt: previous?.createdAt ?? now,
-		updatedAt: now
-	};
-	const definition = definitionForRecord(base);
-	return {
-		record: {
-			...base,
-			definitionHash: fingerprint(definition)
-		},
-		definition
-	};
-}
-async function writeServiceFiles(record, definition) {
-	const locations = servicePaths({ TREEPORT_DATA_DIR: record.dataDir });
-	await Promise.all([fs.mkdir(path.dirname(record.logPath), {
-		recursive: true,
-		mode: 448
-	}), fs.mkdir(locations.requestsDirectory, {
-		recursive: true,
-		mode: 448
-	})]);
-	await fs.writeFile(locations.runnerPath, runnerSource(record), { mode: 448 });
-	await fs.chmod(locations.runnerPath, 448);
-	if (record.manager === "launchd") await fs.writeFile(locations.stagedDefinitionPath, definition, { mode: 384 });
-	else {
-		await fs.mkdir(path.dirname(record.definitionPath), {
-			recursive: true,
-			mode: 448
-		});
-		const temporaryPath = `${record.definitionPath}.${process.pid}.tmp`;
-		await fs.writeFile(temporaryPath, definition, { mode: 384 });
-		await fs.rename(temporaryPath, record.definitionPath);
-	}
-	await saveRecord(record);
-}
-async function prepareAdministratorRequest(record, operation) {
-	const runtime = record.runtimeExecutable && record.runtimeEntrypoint ? {
-		runtimeExecutable: record.runtimeExecutable,
-		runtimeEntrypoint: record.runtimeEntrypoint
-	} : await currentAdministratorRuntime();
-	const requestRecord = {
-		...record,
-		...runtime
-	};
-	const locations = servicePaths({ TREEPORT_DATA_DIR: record.dataDir });
-	const id = crypto.randomUUID();
-	const now = /* @__PURE__ */ new Date();
-	const request = {
-		schemaVersion: 1,
-		id,
-		operation,
-		createdAt: now.toISOString(),
-		expiresAt: new Date(now.getTime() + 15 * 6e4).toISOString(),
-		uid: record.uid,
-		gid: record.gid,
-		username: record.username,
-		group: record.group,
-		home: record.home,
-		serviceRecordPath: locations.recordPath,
-		runnerPath: locations.runnerPath,
-		definitionName: record.definitionName,
-		definitionPath: record.definitionPath,
-		stagedDefinitionPath: locations.stagedDefinitionPath,
-		definitionHash: record.definitionHash,
-		apiUrl: record.apiUrl,
-		cliEntrypoint: record.cliEntrypoint,
-		runtimeExecutable: requestRecord.runtimeExecutable,
-		runtimeEntrypoint: requestRecord.runtimeEntrypoint
-	};
-	await writeJson(path.join(locations.requestsDirectory, `${id}.json`), request);
-	const next = {
-		...requestRecord,
-		pendingAdministratorRequestId: id,
-		updatedAt: now.toISOString()
-	};
-	await saveRecord(next);
-	return {
-		record: next,
-		command: administratorCommand(next)
-	};
-}
-async function waitForService(record) {
-	const deadline = Date.now() + 15e3;
-	const version = await treeportVersion();
-	while (Date.now() < deadline) {
-		const observed = await daemonHealth(record.apiUrl, 500);
-		if (observed?.daemonLifecycle === "service" && observed.instanceId && observed.version === version) return;
-		await new Promise((resolve) => setTimeout(resolve, 150));
-	}
-	throw new Error(`Treeport service did not become ready at ${record.apiUrl}. See ${record.logPath}.`);
-}
-async function serviceEnable() {
-	const existing = await serviceStatus();
-	if (existing.state === "healthy" && existing.definitionMatches && existing.environmentMatches && existing.entrypointMatches) return {
-		status: existing,
-		changed: false,
-		administratorCommand: null
-	};
-	const { record, definition } = await prepareRecord();
-	const failedChecks = (await runDoctor()).filter((check) => !check.ok);
-	if (failedChecks.length) throw new Error(failedChecks.map((check) => `${check.name}: ${check.detail}`).join("\n"));
-	const systemctl = record.manager === "systemd" ? await executablePath("systemctl") : null;
-	if (systemctl) {
-		const managerAvailable = await runCommand(systemctl, ["--user", "show-environment"]);
-		if (managerAvailable.code !== 0) throw commandError("systemctl --user", managerAvailable);
-	}
-	await writeServiceFiles(record, definition);
-	if (record.manager === "launchd") {
-		await daemonDown();
-		const prepared = await prepareAdministratorRequest(record, "enable");
-		return {
-			status: await serviceStatus(),
-			changed: true,
-			administratorCommand: prepared.command
-		};
-	}
-	if (!systemctl) throw new Error("Treeport could not resolve the systemd command.");
-	await daemonDown();
-	const reload = await runCommand(systemctl, ["--user", "daemon-reload"]);
-	if (reload.code !== 0) {
-		await Promise.all([fs.rm(record.definitionPath, { force: true }), fs.rm(servicePaths().directory, {
-			recursive: true,
-			force: true
-		})]);
-		await daemonUp({});
-		throw commandError("systemctl --user daemon-reload", reload);
-	}
-	const enabled = await runCommand(systemctl, [
-		"--user",
-		"enable",
-		"--now",
-		record.definitionName
-	]);
-	if (enabled.code !== 0) {
-		await fs.rm(record.definitionPath, { force: true });
-		await runCommand(systemctl, ["--user", "daemon-reload"]);
-		await fs.rm(servicePaths().directory, {
-			recursive: true,
-			force: true
-		});
-		await daemonUp({});
-		throw commandError("systemctl --user enable --now", enabled);
-	}
-	const startupError = await waitForService(record).then(() => null, (error) => error);
-	if (startupError) {
-		await runCommand(systemctl, [
-			"--user",
-			"disable",
-			"--now",
-			record.definitionName
-		]);
-		await fs.rm(record.definitionPath, { force: true });
-		await runCommand(systemctl, ["--user", "daemon-reload"]);
-		await fs.rm(servicePaths().directory, {
-			recursive: true,
-			force: true
-		});
-		await daemonUp({});
-		throw startupError;
-	}
-	const status = await serviceStatus();
-	return {
-		status,
-		changed: true,
-		administratorCommand: status.administratorCommand
-	};
-}
-async function serviceStart() {
-	const record = await currentRecord();
-	if (!record) throw new Error("Treeport service mode is disabled. Run `treeport service enable` first.");
-	const current = await serviceStatus();
-	if (current.state === "healthy") return {
-		status: current,
-		changed: false,
-		administratorCommand: null
-	};
-	if (current.administratorCommand) return {
-		status: current,
-		changed: false,
-		administratorCommand: current.administratorCommand
-	};
-	if (!current.definitionMatches || !current.entrypointMatches) throw new Error("The Treeport service definition is stale. Run `treeport service enable` to repair it.");
-	const next = {
-		...record,
-		requestedState: "running",
-		pendingAdministratorRequestId: null,
-		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-	await saveRecord(next);
-	if (record.manager === "launchd") {
-		const prepared = await prepareAdministratorRequest(next, "start");
-		return {
-			status: await serviceStatus(),
-			changed: true,
-			administratorCommand: prepared.command
-		};
-	}
-	const result = await runCommand(await executablePath("systemctl"), [
-		"--user",
-		"start",
-		record.definitionName
-	]);
-	if (result.code !== 0) throw commandError("systemctl --user start", result);
-	await waitForService(next);
-	return {
-		status: await serviceStatus(),
-		changed: true,
-		administratorCommand: null
-	};
-}
-async function serviceStop() {
-	const record = await currentRecord();
-	if (!record) throw new Error("Treeport service mode is disabled.");
-	const current = await serviceStatus();
-	if (current.state === "stopped") return {
-		status: current,
-		changed: false,
-		administratorCommand: null
-	};
-	const next = {
-		...record,
-		requestedState: "stopped",
-		pendingAdministratorRequestId: null,
-		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-	await saveRecord(next);
-	if (record.manager === "launchd") {
-		const prepared = await prepareAdministratorRequest(next, "stop");
-		return {
-			status: await serviceStatus(),
-			changed: true,
-			administratorCommand: prepared.command
-		};
-	}
-	const result = await runCommand(await executablePath("systemctl"), [
-		"--user",
-		"stop",
-		record.definitionName
-	]);
-	if (result.code !== 0) {
-		await saveRecord(record);
-		throw commandError("systemctl --user stop", result);
-	}
-	return {
-		status: await serviceStatus(),
-		changed: true,
-		administratorCommand: null
-	};
-}
-async function serviceDisable() {
-	const record = await currentRecord();
-	if (!record) return {
-		status: await serviceStatus(),
-		changed: false,
-		administratorCommand: null
-	};
-	if (record.manager === "launchd") {
-		const prepared = await prepareAdministratorRequest({
-			...record,
-			pendingAdministratorRequestId: null
-		}, "disable");
-		return {
-			status: await serviceStatus(),
-			changed: true,
-			administratorCommand: prepared.command
-		};
-	}
-	const systemctl = await executablePath("systemctl");
-	const disabled = await runCommand(systemctl, [
-		"--user",
-		"disable",
-		"--now",
-		record.definitionName
-	]);
-	if (disabled.code !== 0 && !disabled.stderr.includes("does not exist")) throw commandError("systemctl --user disable --now", disabled);
-	await fs.rm(record.definitionPath, { force: true });
-	await runCommand(systemctl, ["--user", "daemon-reload"]);
-	await fs.rm(servicePaths().directory, {
-		recursive: true,
-		force: true
-	});
-	return {
-		status: await serviceStatus(),
-		changed: true,
-		administratorCommand: null
-	};
-}
-async function serviceApply(requestPath) {
-	if (process.platform !== "darwin") throw new Error("Treeport service apply is only available for macOS LaunchDaemons.");
-	if (process.getuid?.() !== 0) throw new Error("Run the printed service apply command with sudo or as root.");
-	if (!path.isAbsolute(requestPath)) throw new Error("The service apply request path must be absolute.");
-	const metadata = await fs.lstat(requestPath);
-	if (!metadata.isFile() || metadata.isSymbolicLink()) throw new Error("The service apply request must be a regular file, not a symlink.");
-	if ((metadata.mode & 63) !== 0) throw new Error("The service apply request must not be readable or writable by other users.");
-	const request = await readJson(requestPath, administratorRequestSchema);
-	if (!request) throw new Error("The service apply request is invalid.");
-	if (metadata.uid !== request.uid) throw new Error("The service apply request owner does not match its target user.");
-	if (Date.parse(request.expiresAt) <= Date.now()) throw new Error("The service apply request expired. Run the original Treeport command again.");
-	const currentRuntime = await currentAdministratorRuntime().catch(() => null);
-	const invokedRuntimeEntrypoint = process.argv[1] ? path.resolve(process.argv[1]) : null;
-	if (!currentRuntime || currentRuntime.runtimeExecutable !== request.runtimeExecutable || currentRuntime.runtimeEntrypoint !== request.runtimeEntrypoint || invokedRuntimeEntrypoint !== request.runtimeEntrypoint) throw new Error("The service apply command did not use the approved Treeport Node runtime and package entrypoint.");
-	const usedPath = `${requestPath}.used`;
-	if (await fs.access(usedPath).then(() => true).catch(() => false)) throw new Error("The service apply request was already used.");
-	const account = os.userInfo({ encoding: "utf8" });
-	const idResult = await runCommand(await executablePath("id"), ["-u", request.username]);
-	if (idResult.code !== 0 || Number(idResult.stdout.trim()) !== request.uid) throw new Error("The service apply target user no longer matches the host account.");
-	const record = await readJson(request.serviceRecordPath, serviceRecordSchema);
-	if (!record || record.uid !== request.uid || record.username !== request.username || record.manager !== "launchd" || record.definitionName !== request.definitionName || record.definitionPath !== request.definitionPath || record.cliEntrypoint !== request.cliEntrypoint || record.runtimeExecutable !== request.runtimeExecutable || record.runtimeEntrypoint !== request.runtimeEntrypoint || record.definitionHash !== request.definitionHash || record.pendingAdministratorRequestId !== request.id) throw new Error("The service apply request does not match the current Treeport service record.");
-	if (account.uid !== 0) throw new Error("Treeport service apply lost root privileges.");
-	const launchctl = await executablePath("launchctl");
-	const target = `system/${request.definitionName}`;
-	if (request.operation === "enable") {
-		const staged = await fs.readFile(request.stagedDefinitionPath, "utf8");
-		if (fingerprint(staged) !== request.definitionHash || !staged.includes(`<string>${xml(request.username)}</string>`) || !staged.includes(`<string>${xml(request.runnerPath)}</string>`)) throw new Error("The staged LaunchDaemon definition does not match the approved request.");
-		const temporaryPath = `${request.definitionPath}.${process.pid}.tmp`;
-		await fs.copyFile(request.stagedDefinitionPath, temporaryPath);
-		await fs.chown(temporaryPath, 0, 0);
-		await fs.chmod(temporaryPath, 420);
-		await fs.rename(temporaryPath, request.definitionPath);
-		await runCommand(launchctl, ["bootout", target]);
-		const enabled = await runCommand(launchctl, ["enable", target]);
-		if (enabled.code !== 0) throw commandError("launchctl enable", enabled);
-		const bootstrapped = await runCommand(launchctl, [
-			"bootstrap",
-			"system",
-			request.definitionPath
-		]);
-		if (bootstrapped.code !== 0) throw commandError("launchctl bootstrap", bootstrapped);
-	} else if (request.operation === "start") {
-		const enabled = await runCommand(launchctl, ["enable", target]);
-		if (enabled.code !== 0) throw commandError("launchctl enable", enabled);
-		const started = (await runCommand(launchctl, ["print", target])).code === 0 ? await runCommand(launchctl, ["kickstart", target]) : await runCommand(launchctl, [
-			"bootstrap",
-			"system",
-			request.definitionPath
-		]);
-		if (started.code !== 0) throw commandError("launchctl start", started);
-	} else if (request.operation === "stop") {
-		const stopped = await runCommand(launchctl, ["bootout", target]);
-		if (stopped.code !== 0 && !stopped.stderr.includes("No such process")) throw commandError("launchctl bootout", stopped);
-	} else {
-		const installed = await fs.readFile(request.definitionPath, "utf8").catch(() => "");
-		if (installed && fingerprint(installed) !== request.definitionHash) throw new Error("Refusing to remove a LaunchDaemon definition that Treeport did not create.");
-		await runCommand(launchctl, ["bootout", target]);
-		await fs.rm(request.definitionPath, { force: true });
-	}
-	if (request.operation === "enable" || request.operation === "start") await waitForService(record);
-	await fs.rename(requestPath, usedPath);
-	if (request.operation === "disable") await fs.rm(path.dirname(request.serviceRecordPath), {
-		recursive: true,
-		force: true
-	});
-	else {
-		await writeJson(request.serviceRecordPath, {
-			...record,
-			requestedState: request.operation === "stop" ? "stopped" : "running",
-			pendingAdministratorRequestId: null,
-			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-		});
-		await fs.chown(request.serviceRecordPath, request.uid, request.gid);
-	}
-	return {
-		operation: request.operation,
-		applied: true
-	};
-}
-async function serviceRun() {
-	const recordPath = process.env.TREEPORT_SERVICE_RECORD?.trim();
-	if (!recordPath || !path.isAbsolute(recordPath)) throw new Error("Treeport service run requires a valid service record.");
-	const record = await readJson(recordPath, serviceRecordSchema);
-	if (!record) throw new Error(`Treeport service record is invalid: ${recordPath}`);
-	if (process.getuid?.() === 0 || process.getuid?.() !== record.uid) throw new Error(`Treeport service must run as ${record.username} (UID ${record.uid}), never as root.`);
-	await writeJson(recordPath, {
-		...record,
-		requestedState: "running",
-		pendingAdministratorRequestId: null,
-		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-	});
-	const [version, serverEntry, webDist] = await Promise.all([
-		treeportVersion(),
-		resolvePackagePath("dist", "node", "server", "index.js"),
-		resolvePackagePath("dist", "web")
-	]);
-	Object.assign(process.env, record.environment, {
-		TREEPORT_APP_VERSION: version,
-		TREEPORT_INSTANCE_ID: crypto.randomUUID(),
-		TREEPORT_WEB_DIST: webDist,
-		TREEPORT_DAEMON_LIFECYCLE: "service"
-	});
-	await import(pathToFileURL(serverEntry).href);
-}
-async function readServiceLogs(lines) {
-	const record = await currentRecord();
-	if (!record || record.manager === "launchd") return (await fs.readFile(record?.logPath ?? localPaths().logPath, "utf8").catch((error) => {
-		if (error.code === "ENOENT") return "";
-		throw error;
-	})).split("\n").slice(-lines - 1).join("\n");
-	const result = await runCommand(await executablePath("journalctl"), [
-		"--user",
-		"--unit",
-		record.definitionName,
-		"--no-pager",
-		"--lines",
-		String(lines)
-	]);
-	if (result.code !== 0) throw commandError("journalctl --user", result);
-	return result.stdout;
-}
-async function serviceDoctorCheck() {
-	const status = await serviceStatus();
-	if (!status.supported) return {
-		name: "Service supervision",
-		ok: false,
-		detail: status.issues.join(" ")
-	};
-	if (status.state === "disabled") return {
-		name: "Service supervision",
-		ok: true,
-		detail: "disabled (opt in with `treeport service enable`)"
-	};
-	if (status.state === "healthy") return {
-		name: "Service supervision",
-		ok: true,
-		detail: `${status.manager}; enabled at boot and healthy`
-	};
-	if (status.state === "stopped") return {
-		name: "Service supervision",
-		ok: true,
-		detail: `${status.manager}; intentionally stopped and enabled for next boot`
-	};
-	return {
-		name: "Service supervision",
-		ok: false,
-		detail: status.issues.join(" ") || `state: ${status.state}`
-	};
-}
-//#endregion
 //#region src/cli/application.ts
 const contextPrefix = "TREEPORT";
 let configuredApiUrl;
@@ -1661,6 +95,7 @@ let writeStderr = (value) => {
 	process.stderr.write(value);
 };
 let requestedExitCode = 0;
+let cliEnvironment = process.env;
 var CliError = class extends Error {
 	exitCode;
 	code;
@@ -1682,10 +117,12 @@ async function resolveDaemonLifecycle() {
 	return await serviceInstalled() ? "service" : "treeport";
 }
 function formatServiceStatus(status) {
+	const mode = status.mode === "headless" ? "advanced headless (starts before login)" : status.mode === "user" && status.manager === "launchd" ? "user/login (starts after login)" : status.mode === "user" ? "user service" : "not installed";
 	const lines = [
 		`Treeport service: ${status.state}`,
+		`Mode: ${mode}`,
 		`Manager: ${status.manager ?? "unsupported"}`,
-		`Starts at boot: ${status.enabledAtBoot ? "yes" : "no"}`,
+		`Starts before login: ${status.enabledAtBoot ? "yes" : "no"}`,
 		`Active: ${status.active ? "yes" : "no"}`,
 		`Definition: ${status.definitionPath ?? "not installed"}`
 	];
@@ -1789,9 +226,12 @@ async function resolveProject(identifier) {
 		const environmentMatch = list.find((project) => project.id === contextProjectId);
 		if (environmentMatch) return environmentMatch;
 	}
-	const candidate = await canonical(identifier);
-	const match = list.find((project) => pathContains(candidate, project.repositoryPath) || project.worktrees.some((worktree) => pathContains(candidate, worktree.path)));
-	if (!match) throw new CliError(`No registered project matches ${identifier}`, 5);
+	const candidate = await canonical(identifier ?? ".");
+	const match = list.flatMap((project) => [project.rootPath, ...project.worktrees.map((item) => item.path)].map((root) => ({
+		project,
+		root
+	}))).filter(({ root }) => pathContains(candidate, root)).sort((left, right) => right.root.length - left.root.length)[0]?.project;
+	if (!match) throw new CliError(identifier === void 0 ? `No registered project contains ${candidate}. Specify --project <id-or-path>.` : `No registered project matches ${identifier}`, 5);
 	return match;
 }
 async function packageSource(value) {
@@ -1846,7 +286,37 @@ async function webPanelLaunchCwd(worktree) {
 	});
 	return path.relative(worktreeRoot, cwd) || ".";
 }
-function webPanelUrl(worktree, panelId) {
+async function resolveBrowserPanel(panelId) {
+	const candidates = (await projects()).flatMap((project) => project.worktrees.flatMap((worktree) => worktree.panels.filter((panel) => panel.kind === "browser").map((panel) => ({
+		panel,
+		worktree
+	}))));
+	if (panelId) {
+		const match = candidates.find((candidate) => candidate.panel.id === panelId);
+		if (!match) throw new CliError(`Browser ${panelId} was not found`, 5);
+		return match;
+	}
+	const worktree = await resolveWorktree(".");
+	const matches = candidates.filter((candidate) => candidate.worktree.id === worktree.id);
+	if (matches.length === 1) return matches[0];
+	if (matches.length === 0) throw new CliError(`No Browser is open in worktree ${worktree.name}`, 5, "BROWSER_PANEL_NOT_FOUND");
+	throw new CliError(`More than one Browser is open in worktree ${worktree.name}; specify --panel`, 5, "BROWSER_PANEL_AMBIGUOUS", { panelIds: matches.map((candidate) => candidate.panel.id) });
+}
+async function runBrowserAgentCommand(command, args, panelId) {
+	const { panel } = await resolveBrowserPanel(panelId);
+	const result = await request(`/api/panels/${encodeURIComponent(panel.id)}/browser-agent`, {
+		method: "POST",
+		body: JSON.stringify({
+			command,
+			args
+		})
+	});
+	return {
+		panelId: panel.id,
+		output: result.output
+	};
+}
+function panelUrl(worktree, panelId) {
 	const target = new URL(apiUrl);
 	target.pathname = `/projects/${encodeURIComponent(worktree.projectId)}/worktrees/${encodeURIComponent(worktree.id)}/panels/${encodeURIComponent(panelId)}`;
 	target.search = "";
@@ -2002,13 +472,10 @@ async function waitForTerminal(terminalId, condition, timeoutMs) {
 function print(value, human) {
 	writeStdout(`${jsonOutput ? JSON.stringify(value) : human ? human() : JSON.stringify(value, null, 2)}\n`);
 }
-const agentGuidance = `AI agents:
-  If you're an AI agent, use \`treeport skills\` to see the usage guide.
-`;
 async function main(args) {
 	const argv = args[0] === "spawn" || args[0] === "terminal" && args[1] === "create" ? commandArgv(args) : void 0;
 	let parserError = "";
-	const program = new Command().name("treeport").usage("[options] [folder] [command]").description("Manage Treeport projects, trees, and terminals.").argument("[folder]", "folder inside a Git repository to open").option("--json", "emit machine-readable JSON").addHelpText("beforeAll", agentGuidance).configureOutput({
+	const program = new Command().name("treeport").usage("[options] [folder] [command]").description("Manage Treeport projects, trees, and terminals.").argument("[folder]", "folder or folder inside a Git repository to open").option("--json", "emit machine-readable JSON").configureOutput({
 		writeOut: writeStdout,
 		writeErr: (value) => {
 			parserError += value;
@@ -2035,12 +502,9 @@ async function main(args) {
 		const registered = await request("/api/projects", {
 			method: "POST",
 			body: JSON.stringify({ path: canonicalFolder })
-		}).catch((error) => {
-			if (error instanceof CliError && error.code === "NOT_A_GIT_REPOSITORY") throw new CliError(`No Git repository contains ${canonicalFolder}.`, error.exitCode, error.code, error.details);
-			throw error;
 		});
 		const targetWorktree = registered.project.worktrees.filter((worktree) => !worktree.prunable && pathContains(canonicalFolder, worktree.path)).sort((left, right) => right.path.length - left.path.length)[0];
-		if (!targetWorktree) throw new CliError(`Git did not report an active worktree containing ${canonicalFolder}.`, 5, "WORKTREE_NOT_FOUND", {
+		if (!targetWorktree) throw new CliError(`Treeport did not find a workspace containing ${canonicalFolder}.`, 5, "WORKTREE_NOT_FOUND", {
 			path: canonicalFolder,
 			projectId: registered.project.id
 		});
@@ -2048,7 +512,10 @@ async function main(args) {
 		target.pathname = `/projects/${encodeURIComponent(registered.project.id)}/worktrees/${encodeURIComponent(targetWorktree.id)}`;
 		target.search = "";
 		target.hash = "";
-		const opened = await openWorkspace(target.href).catch((error) => {
+		const opened = contextTerminalId ? await request(`/api/worktrees/${encodeURIComponent(targetWorktree.id)}/open`, {
+			method: "POST",
+			body: JSON.stringify({ sourceTerminalId: contextTerminalId })
+		}).then(() => ({ client: "current" })) : await openWorkspace(target.href).catch((error) => {
 			if (error instanceof OpenWorkspaceError) throw new CliError(error.message, 1, "OPEN_FAILED", { url: target.href });
 			throw error;
 		});
@@ -2056,9 +523,10 @@ async function main(args) {
 			projectId: registered.project.id,
 			worktreeId: targetWorktree.id,
 			path: canonicalFolder,
+			projectKind: registered.project.kind,
 			url: target.href,
 			client: opened.client
-		}, () => `Opened ${registered.project.name} / ${targetWorktree.name} in the ${opened.client === "desktop" ? "Treeport desktop app" : "browser"}\n${target.href}`);
+		}, () => `Opened ${registered.project.name} / ${targetWorktree.name} in the ${opened.client === "desktop" ? "Treeport desktop app" : opened.client === "current" ? "current Treeport client" : "browser"}\n${target.href}`);
 	});
 	const startCommand = program.command("start").description("Ensure the local Treeport daemon is running").option("--host <address>", "loopback listener address").option("--port <port>", "listener port").option("--foreground", "run in the foreground").option("--json", "emit machine-readable JSON");
 	startCommand.action(async () => {
@@ -2101,8 +569,9 @@ async function main(args) {
 	serviceCommand.action(() => {
 		writeStdout(serviceCommand.helpInformation());
 	});
-	serviceCommand.command("enable").description("Enable startup after reboot and unexpected-exit restarts").option("--json", "emit machine-readable JSON").action(async () => {
-		const result = await serviceEnable();
+	const serviceEnableCommand = serviceCommand.command("enable").description("Enable automatic startup and unexpected-exit restarts").option("--headless", "use advanced macOS startup before login (requires an administrator)").option("--json", "emit machine-readable JSON");
+	serviceEnableCommand.action(async () => {
+		const result = await serviceEnable(serviceEnableCommand.opts().headless ? "headless" : "user");
 		print(result, () => formatServiceStatus(result.status));
 		if (result.status.state === "action_required") requestedExitCode = 1;
 	});
@@ -2232,6 +701,7 @@ async function main(args) {
 			worktreeId,
 			terminalId
 		});
+		const treeContext = (await request(`/api/worktrees/${encodeURIComponent(worktree.id)}/context`)).context;
 		const context = {
 			managed: true,
 			apiUrl,
@@ -2239,6 +709,8 @@ async function main(args) {
 			project: {
 				id: project.id,
 				name: project.name,
+				kind: project.kind,
+				rootPath: project.rootPath,
 				repositoryPath: project.repositoryPath,
 				mainWorktreePath: project.mainWorktreePath,
 				defaultBranch: project.defaultBranch,
@@ -2252,7 +724,8 @@ async function main(args) {
 				head: worktree.head,
 				branch: worktree.branch,
 				detached: worktree.detached,
-				kind: worktree.kind
+				kind: worktree.kind,
+				context: treeContext
 			},
 			terminal: {
 				id: terminal.id,
@@ -2262,8 +735,108 @@ async function main(args) {
 				exitCode: terminal.exitCode
 			}
 		};
-		print(context, () => `Treeport context\n\nProject:  ${context.project.name} (${context.project.id})\nTree:     ${context.worktree.name} (${context.worktree.id})\nPath:     ${context.worktree.path}\nTerminal: ${context.terminal.name} (${context.terminal.id}) — ${context.terminal.status}\nAPI:      ${context.apiUrl}\nLifecycle: ${context.daemonLifecycle === "external" ? "externally managed" : context.daemonLifecycle === "service" ? "managed by the OS service" : "managed by Treeport"}`);
+		print(context, () => {
+			const entries = Object.entries(context.worktree.context);
+			const treeContextText = entries.length === 0 ? "—" : entries.map(([key, value]) => {
+				const [first = "", ...rest] = [...value].map((character) => {
+					const code = character.charCodeAt(0);
+					return code !== 10 && (code <= 31 || code >= 127 && code <= 159) ? `\\u${code.toString(16).padStart(4, "0")}` : character;
+				}).join("").split("\n");
+				return `  ${key}: ${first}${rest.length > 0 ? `\n${rest.map((line) => `    ${line}`).join("\n")}` : ""}`;
+			}).join("\n");
+			return `Treeport context\n\nProject:  ${context.project.name} (${context.project.id})\nTree:     ${context.worktree.name} (${context.worktree.id})\nPath:     ${context.worktree.path}\nContext:\n${treeContextText}\nTerminal: ${context.terminal.name} (${context.terminal.id}) — ${context.terminal.status}\nAPI:      ${context.apiUrl}\nLifecycle: ${context.daemonLifecycle === "external" ? "externally managed" : context.daemonLifecycle === "service" ? "managed by the OS service" : "managed by Treeport"}`;
+		});
+	});
+	const browserCommand = program.command("browser").description("Manage Browser and its hosted Chromium");
+	browserCommand.action(() => {
+		writeStdout(browserCommand.helpInformation());
+	});
+	const browserOpenCommand = browserCommand.command("open").description("Open Browser and request client navigation").argument("[url]", "absolute HTTP or HTTPS URL").requiredOption("--worktree <id-or-path-or-dot>", "owning tree").option("--json", "emit machine-readable JSON");
+	browserOpenCommand.action(async (url) => {
+		const worktree = await resolveWorktree(browserOpenCommand.opts().worktree);
+		const body = {
+			url,
+			sourceTerminalId: contextWorktreeId === worktree.id ? contextTerminalId ?? null : null
+		};
+		const result = await request(`/api/worktrees/${encodeURIComponent(worktree.id)}/browser-panels`, {
+			method: "POST",
+			body: JSON.stringify(body)
+		});
+		const output = {
+			...result,
+			url: panelUrl(worktree, result.panel.id)
+		};
+		print(output, () => `Opened ${result.panel.title} (${result.panel.id})\n${output.url}`);
+	});
+	browserCommand.command("install").description("Install the Chromium build used by Browser").option("--json", "emit machine-readable JSON").action(async () => {
+		const result = await request("/api/browser/install", { method: "POST" });
+		print(result, () => result.message);
+	});
+	browserCommand.command("status").description("Show hosted browser installation status").option("--json", "emit machine-readable JSON").action(async () => {
+		const result = await request("/api/browser/status");
+		print(result, () => `${result.installed ? "Chromium is installed" : "Chromium is not installed"}\nLaunch ready: ${result.launchReady ? "yes" : "no"}\nPlaywright: ${result.playwrightVersion}\nBrowser: ${result.channel} ${result.browserRevision}\nExecutable: ${result.executablePath}${result.launchError ? `\nLaunch error: ${result.launchError}` : ""}`);
 	});
+	browserCommand.command("remove").description("Remove Treeport's hosted Chromium build").option("--json", "emit machine-readable JSON").action(async () => {
+		await request("/api/browser/install", { method: "DELETE" });
+		print({ removed: true }, () => "Removed Treeport hosted Chromium");
+	});
+	browserCommand.command("list").description("List open Browser sessions").option("--json", "emit machine-readable JSON").action(async () => {
+		const panels = (await projects()).flatMap((project) => project.worktrees.flatMap((worktree) => worktree.panels.filter((panel) => panel.kind === "browser").map((panel) => ({
+			panelId: panel.id,
+			title: panel.title,
+			worktreeId: worktree.id,
+			worktree: worktree.name,
+			projectId: project.id,
+			project: project.name
+		}))));
+		print(panels, () => panels.length ? panels.map((panel) => `${panel.panelId}\t${panel.project} / ${panel.worktree}\t${panel.title}`).join("\n") : "Browser is not open.");
+	});
+	const printAgentResult = async (command, args, panelId) => {
+		const result = await runBrowserAgentCommand(command, args, panelId);
+		print(result, () => result.output);
+	};
+	const browserSnapshotCommand = browserCommand.command("snapshot").description("Capture an accessibility snapshot of the hosted page").option("--panel <panel-id>", "Browser ID").option("--json", "emit machine-readable JSON");
+	browserSnapshotCommand.action(async () => printAgentResult("snapshot", [], browserSnapshotCommand.opts().panel));
+	const browserClickCommand = browserCommand.command("click").description("Click an element from the latest browser snapshot").argument("<target>", "Playwright element reference or selector").option("--panel <panel-id>", "Browser ID").option("--json", "emit machine-readable JSON");
+	browserClickCommand.action(async (target) => printAgentResult("click", [target], browserClickCommand.opts().panel));
+	const browserFillCommand = browserCommand.command("fill").description("Fill an editable element from the latest browser snapshot").argument("<target>", "Playwright element reference or selector").argument("<text>", "text to enter").option("--panel <panel-id>", "Browser ID").option("--json", "emit machine-readable JSON");
+	browserFillCommand.action(async (target, text) => printAgentResult("fill", [target, text], browserFillCommand.opts().panel));
+	const browserPressCommand = browserCommand.command("press").description("Press a key in the hosted page").argument("<key>", "Playwright key name").option("--panel <panel-id>", "Browser ID").option("--json", "emit machine-readable JSON");
+	browserPressCommand.action(async (key) => printAgentResult("press", [key], browserPressCommand.opts().panel));
+	const browserGotoCommand = browserCommand.command("goto").description("Navigate the hosted page").argument("<url>", "absolute HTTP or HTTPS URL").option("--panel <panel-id>", "Browser ID").option("--json", "emit machine-readable JSON");
+	browserGotoCommand.action(async (url) => printAgentResult("goto", [url], browserGotoCommand.opts().panel));
+	const browserConsoleCommand = browserCommand.command("console").description("List page console messages").argument("[level]", "minimum console level").option("--panel <panel-id>", "Browser ID").option("--json", "emit machine-readable JSON");
+	browserConsoleCommand.action(async (level) => printAgentResult("console", level ? [level] : [], browserConsoleCommand.opts().panel));
+	for (const [name, description, agentName] of [
+		[
+			"back",
+			"Go back in the hosted page",
+			"go-back"
+		],
+		[
+			"forward",
+			"Go forward in the hosted page",
+			"go-forward"
+		],
+		[
+			"reload",
+			"Reload the hosted page",
+			"reload"
+		],
+		[
+			"network",
+			"List page network requests",
+			"requests"
+		],
+		[
+			"screenshot",
+			"Capture a screenshot of the hosted page",
+			"screenshot"
+		]
+	]) {
+		const command = browserCommand.command(name).description(description).option("--panel <panel-id>", "Browser ID").option("--json", "emit machine-readable JSON");
+		command.action(async () => printAgentResult(agentName, [], command.opts().panel));
+	}
 	const installCommand = program.command("install").description("Install and configure a Treeport package").argument("<source>", "npm: source or local directory").option("-l, --local", "configure the registered project containing the current directory").option("--json", "emit machine-readable JSON");
 	installCommand.action(async (source) => {
 		const options = installCommand.opts();
@@ -2296,10 +869,24 @@ async function main(args) {
 			return lines.join("\n");
 		});
 	});
-	const updatePackagesCommand = program.command("update").description("Explicitly update configured Treeport packages").argument("[source]", "one configured npm: source").option("--packages", "update every eligible configured package").option("--json", "emit machine-readable JSON");
+	const updatePackagesCommand = program.command("update").description("Update Treeport or explicitly update configured packages").argument("[source]", "one configured npm: source").option("--packages", "update every eligible configured package").option("--json", "emit machine-readable JSON");
 	updatePackagesCommand.action(async (source) => {
 		const options = updatePackagesCommand.opts();
-		if (!source && !options.packages || source && options.packages) throw new CliError("Specify a package source or --packages. Bare `treeport update` is reserved for a future Treeport self-update.", 2);
+		if (source && options.packages) throw new CliError("Specify a package source or --packages, not both.", 2);
+		if (!source && !options.packages) {
+			if (await resolveDaemonLifecycle() === "external") throw new CliError("Cannot update Treeport because this daemon lifecycle is externally managed.", 5, "UPDATE_EXTERNAL_REFUSED");
+			const selfUpdateOptions = { environment: cliEnvironment };
+			if (!jsonOutput) selfUpdateOptions.progress = (message) => writeStderr(`${message}\n`);
+			const result = await runLocalUpdate(selfUpdateOptions).catch((error) => {
+				if (error instanceof LocalUpdateError) throw new CliError(error.message, error.exitCode, error.code, error.details);
+				throw error;
+			});
+			print(result, () => {
+				if (result.status === "current") return `Treeport ${result.toVersion} is current`;
+				return result.daemon.wasRunning ? `Updated Treeport from ${result.fromVersion} to ${result.toVersion} and restarted the ${result.daemon.lifecycle === "service" ? "service" : "daemon"}` : `Updated Treeport from ${result.fromVersion} to ${result.toVersion}; Treeport remains stopped`;
+			});
+			return;
+		}
 		const results = (await request("/api/packages/update", {
 			method: "POST",
 			body: JSON.stringify(source ? { source: await packageSource(source) } : {})
@@ -2321,16 +908,16 @@ async function main(args) {
 	projectCommand.action(() => {
 		throw new CliError(projectCommand.helpInformation(), 2);
 	});
-	projectCommand.command("add").description("Register a Git repository").argument("<path>", "repository path").option("--json", "emit machine-readable JSON").action(async (repository) => {
+	projectCommand.command("add").description("Register a folder or Git repository").argument("<path>", "folder path").option("--json", "emit machine-readable JSON").action(async (repository) => {
 		const body = await request("/api/projects", {
 			method: "POST",
 			body: JSON.stringify({ path: await canonical(repository) })
 		});
-		print(body.project, () => `Registered ${body.project.name} (${body.project.id})\n${body.project.repositoryPath}`);
+		print(body.project, () => `Registered ${body.project.name} (${body.project.id})\n${body.project.rootPath}`);
 	});
 	projectCommand.command("list").description("List registered projects").option("--json", "emit machine-readable JSON").action(async () => {
 		const list = await projects();
-		print(list, () => list.map((project) => `${project.id}\t${project.name}\t${project.repositoryPath}`).join("\n"));
+		print(list, () => list.map((project) => `${project.id}\t${project.name}\t${project.kind}\t${project.rootPath}`).join("\n"));
 	});
 	const worktreeCommand = program.command("worktree").description("List, create, and remove trees");
 	worktreeCommand.action(() => {
@@ -2340,9 +927,9 @@ async function main(args) {
 	worktreeListCommand.action(async () => {
 		const { project: projectIdentifier } = worktreeListCommand.opts();
 		const list = projectIdentifier ? (await resolveProject(projectIdentifier)).worktrees : (await projects()).flatMap((project) => project.worktrees);
-		print(list, () => list.map((worktree) => `${worktree.id}\t${worktree.name}\t${worktree.branch ?? `detached@${worktree.head.slice(0, 8)}`}\t${worktree.path}`).join("\n"));
+		print(list, () => list.map((worktree) => `${worktree.id}\t${worktree.name}\t${worktree.kind === "folder" ? "folder" : worktree.branch ?? `detached@${worktree.head.slice(0, 8)}`}\t${worktree.path}`).join("\n"));
 	});
-	const worktreeCreateCommand = worktreeCommand.command("create").description("Create a linked tree").requiredOption("--project <id-or-path>", "project to create from").requiredOption("--name <name>", "Tree name").option("--from-current", "base the tree on the current tree").option("--json", "emit machine-readable JSON");
+	const worktreeCreateCommand = worktreeCommand.command("create").description("Create a linked tree").option("--project <id-or-path>", "project to create from (default: current folder)").requiredOption("--name <name>", "Tree name").option("--from-current", "base the tree on the current tree").option("--json", "emit machine-readable JSON");
 	worktreeCreateCommand.action(async () => {
 		const options = worktreeCreateCommand.opts();
 		const project = await resolveProject(options.project);
@@ -2401,7 +988,7 @@ async function main(args) {
 		});
 		const output = {
 			...result,
-			url: webPanelUrl(worktree, result.panel.id)
+			url: panelUrl(worktree, result.panel.id)
 		};
 		print(output, () => `${result.reused ? "Reused" : "Opened"} ${result.panel.title} (${result.panel.id})\n${output.url}`);
 	});
@@ -2467,7 +1054,7 @@ async function main(args) {
 			terminalId
 		}, () => `Deleted ${terminalId}`);
 	});
-	const spawnCommand = program.command("spawn").description("Create a tree and its first terminal").usage("[options] [-- <command> args...]").requiredOption("--project <id-or-path-or-dot>", "project to create from").requiredOption("--worktree-name <name>", "Tree name").requiredOption("--name <terminal-name>", "terminal name").option("--from-current", "base the tree on the current tree").option("--json", "emit machine-readable JSON").addHelpText("after", "\nCommand arguments may be passed after --.\n");
+	const spawnCommand = program.command("spawn").description("Create a tree and its first terminal").usage("[options] [-- <command> args...]").option("--project <id-or-path-or-dot>", "project to create from (default: current folder)").requiredOption("--worktree-name <name>", "Tree name").requiredOption("--name <terminal-name>", "terminal name").option("--from-current", "base the tree on the current tree").option("--json", "emit machine-readable JSON").addHelpText("after", "\nCommand arguments may be passed after --.\n");
 	spawnCommand.action(async () => {
 		const options = spawnCommand.opts();
 		const project = await resolveProject(options.project);
@@ -2495,6 +1082,7 @@ async function main(args) {
 }
 async function runCliApplication(options) {
 	const environment = options.environment ?? process.env;
+	cliEnvironment = environment;
 	configuredApiUrl = environment.TREEPORT_API_URL?.trim();
 	apiUrl = (await resolveLocalApiUrl(environment)).replace(/\/$/, "");
 	contextProjectId = environment.TREEPORT_PROJECT_ID?.trim() || void 0;