@vibedeckx/linux-x64 0.3.3 → 0.3.4

package/dist/bin.js

@@ -13356,12 +13356,12 @@ var require_semver = __commonJS({
     }
     function replaceHyphen(comp, options) {
       const r = HYPHENRANGE_REGEXP;
-      return comp.replace(r, (_3, from, fM, fm, fp35, fpr, fb, to, tM, tm, tp, tpr) => {
+      return comp.replace(r, (_3, from, fM, fm, fp36, fpr, fb, to, tM, tm, tp, tpr) => {
         if (isX(fM)) {
           from = "";
         } else if (isX(fm)) {
           from = `>=${fM}.0.0${options?.includePrerelease ? "-0" : ""}`;
-        } else if (isX(fp35)) {
+        } else if (isX(fp36)) {
           from = `>=${fM}.${fm}.0${options?.includePrerelease ? "-0" : ""}`;
         } else if (fpr) {
           from = `>=${from}`;
@@ -87525,12 +87525,12 @@ var require_range = __commonJS({
       debug("replaceGTE0", comp, options);
       return comp.trim().replace(re2[options.includePrerelease ? t.GTE0PRE : t.GTE0], "");
     };
-    var hyphenReplace = (incPr) => ($0, from, fM, fm, fp35, fpr, fb, to, tM, tm, tp, tpr) => {
+    var hyphenReplace = (incPr) => ($0, from, fM, fm, fp36, fpr, fb, to, tM, tm, tp, tpr) => {
       if (isX(fM)) {
         from = "";
       } else if (isX(fm)) {
         from = `>=${fM}.0.0${incPr ? "-0" : ""}`;
-      } else if (isX(fp35)) {
+      } else if (isX(fp36)) {
         from = `>=${fM}.${fm}.0${incPr ? "-0" : ""}`;
       } else if (fpr) {
         from = `>=${from}`;
@@ -90111,8 +90111,8 @@ var require_pretty_print = __commonJS({
       serializedRoute += serializeMetaData(route.metaData);
       return serializedRoute;
     }
-    function mergeSimilarRoutes(routes34) {
-      return routes34.reduce((mergedRoutes, route) => {
+    function mergeSimilarRoutes(routes35) {
+      return routes35.reduce((mergedRoutes, route) => {
         for (const nodeRoute of mergedRoutes) {
           if (deepEqual(route.opts.constraints, nodeRoute.opts.constraints) && deepEqual(route.metaData, nodeRoute.metaData)) {
             nodeRoute.method += ", " + route.method;
@@ -90124,18 +90124,18 @@ var require_pretty_print = __commonJS({
       }, []);
     }
     function serializeNode(node, prefix, options) {
-      let routes34 = node.routes;
+      let routes35 = node.routes;
       if (options.method === void 0) {
-        routes34 = routes34.map(normalizeRoute);
+        routes35 = routes35.map(normalizeRoute);
       }
-      routes34 = routes34.map((route) => {
+      routes35 = routes35.map((route) => {
         route.metaData = getRouteMetaData(route, options);
         return route;
       });
       if (options.method === void 0) {
-        routes34 = mergeSimilarRoutes(routes34);
+        routes35 = mergeSimilarRoutes(routes35);
       }
-      return routes34.map(serializeRoute).join(`
+      return routes35.map(serializeRoute).join(`
 ${prefix}`);
     }
     function buildObjectTree(node, tree, prefix, options) {
@@ -91402,9 +91402,9 @@ var require_find_my_way = __commonJS({
         pathIndex = paramEndIndex;
       }
     };
-    Router.prototype._rebuild = function(routes34) {
+    Router.prototype._rebuild = function(routes35) {
       this.reset();
-      for (const route of routes34) {
+      for (const route of routes35) {
         const { method, path: path22, opts, handler, store } = route;
         this._on(method, path22, opts, handler, store);
       }
@@ -100612,8 +100612,8 @@ var require_commonjs6 = __commonJS({
           return this.#fullpath = this.name;
         }
         const pv = p2.fullpath();
-        const fp35 = pv + (!p2.parent ? "" : this.sep) + name25;
-        return this.#fullpath = fp35;
+        const fp36 = pv + (!p2.parent ? "" : this.sep) + name25;
+        return this.#fullpath = fp36;
       }
       /**
        * On platforms other than windows, this is identical to fullpath.
@@ -105329,7 +105329,7 @@ var require_static = __commonJS({
     var { fileURLToPath: fileURLToPath4 } = __require("node:url");
     var { statSync: statSync2 } = __require("node:fs");
     var { glob } = require_commonjs7();
-    var fp35 = require_plugin2();
+    var fp36 = require_plugin2();
     var send = require_send2();
     var encodingNegotiator = require_accept_negotiator();
     var contentDisposition = require_content_disposition();
@@ -105433,7 +105433,7 @@ var require_static = __commonJS({
         } else {
           const indexes = new Set(opts.index === void 0 ? ["index.html"] : [].concat(opts.index));
           const indexDirs = /* @__PURE__ */ new Map();
-          const routes34 = /* @__PURE__ */ new Set();
+          const routes35 = /* @__PURE__ */ new Set();
           const roots = Array.isArray(sendOptions.root) ? sendOptions.root : [sendOptions.root];
           for (let rootPath of roots) {
             rootPath = rootPath.split(path22.win32.sep).join(path22.posix.sep);
@@ -105449,10 +105449,10 @@ var require_static = __commonJS({
             for (let file2 of files) {
               file2 = file2.split(path22.win32.sep).join(path22.posix.sep);
               const route = prefix + file2;
-              if (routes34.has(route)) {
+              if (routes35.has(route)) {
                 continue;
               }
-              routes34.add(route);
+              routes35.add(route);
               setUpHeadAndGet(routeOpts, route, `/${file2}`, rootPath);
               const key = path22.posix.basename(route);
               if (indexes.has(key) && !indexDirs.has(key)) {
@@ -105747,7 +105747,7 @@ var require_static = __commonJS({
         throw err;
       }
     }
-    module.exports = fp35(fastifyStatic2, {
+    module.exports = fp36(fastifyStatic2, {
       fastify: "5.x",
       name: "@fastify/static"
     });
@@ -112390,7 +112390,7 @@ var require_websocket2 = __commonJS({
     var { ServerResponse } = __require("node:http");
     var { PassThrough } = __require("node:stream");
     var { randomBytes: randomBytes3 } = __require("node:crypto");
-    var fp35 = require_plugin2();
+    var fp36 = require_plugin2();
     var WebSocket2 = require_ws();
     var Duplexify = require_duplexify();
     var kWs = /* @__PURE__ */ Symbol("ws-socket");
@@ -112576,7 +112576,7 @@ var require_websocket2 = __commonJS({
       }
       next();
     }
-    module.exports = fp35(fastifyWebsocket2, {
+    module.exports = fp36(fastifyWebsocket2, {
       fastify: "5.x",
       name: "@fastify/websocket"
     });
@@ -115020,7 +115020,7 @@ var require_multipart2 = __commonJS({
     "use strict";
     var Busboy = require_main();
     var os2 = __require("node:os");
-    var fp35 = require_plugin2();
+    var fp36 = require_plugin2();
     var { createWriteStream: createWriteStream2 } = __require("node:fs");
     var { unlink: unlink2 } = __require("node:fs/promises");
     var path22 = __require("node:path");
@@ -115469,7 +115469,7 @@ var require_multipart2 = __commonJS({
         }
       });
     }
-    module.exports = fp35(fastifyMultipart2, {
+    module.exports = fp36(fastifyMultipart2, {
       fastify: "5.x",
       name: "@fastify/multipart"
     });
@@ -154378,6 +154378,7 @@ var VIBEDECKX_HOME = path.join(homedir(), ".vibedeckx");
 var DB_PATH = path.join(VIBEDECKX_HOME, "data.sqlite");
 var DEFAULT_PORT = 5173;
 var MIN_WORKER_VERSION = "0.0.0";
+var WORKER_VERSION_REPORTING_SINCE = "2026-08-03";
 
 // src/load-env.ts
 function getArg(argv, name25) {
@@ -169020,11 +169021,11 @@ function buildCommand(builderArgs) {
     }
   };
 }
-function* generateRouteMapHelpLines(routes34, docs, args) {
+function* generateRouteMapHelpLines(routes35, docs, args) {
   const { brief, fullDescription, hideRoute } = docs;
   const { headers } = args.text;
   yield args.ansiColor ? `\x1B[1m${headers.usage}\x1B[22m` : headers.usage;
-  for (const [name25, route] of Object.entries(routes34)) {
+  for (const [name25, route] of Object.entries(routes35)) {
     if (!hideRoute || !hideRoute[name25] || args.includeHidden) {
       const externalRouteName = args.config.caseStyle === "convert-camel-to-kebab" ? convertCamelCaseToKebabCase(name25) : name25;
       yield `  ${route.formatUsageLine({
@@ -169054,7 +169055,7 @@ function* generateRouteMapHelpLines(routes34, docs, args) {
   }
   yield "";
   yield args.ansiColor ? `\x1B[1m${headers.commands}\x1B[22m` : headers.commands;
-  const visibleRoutes = Object.entries(routes34).filter(
+  const visibleRoutes = Object.entries(routes35).filter(
     ([name25]) => !hideRoute || !hideRoute[name25] || args.includeHidden
   );
   const rows = visibleRoutes.map(([internalRouteName, route]) => {
@@ -169082,24 +169083,24 @@ function* generateRouteMapHelpLines(routes34, docs, args) {
   }
 }
 function buildRouteMap({
-  routes: routes34,
+  routes: routes35,
   defaultCommand: defaultCommandRoute,
   docs,
   aliases
 }) {
-  if (Object.entries(routes34).length === 0) {
+  if (Object.entries(routes35).length === 0) {
     throw new InternalError("Route map must contain at least one route");
   }
   const activeAliases = aliases ?? {};
   const aliasesByRoute = /* @__PURE__ */ new Map();
   for (const [alias, routeName] of Object.entries(activeAliases)) {
-    if (alias in routes34) {
+    if (alias in routes35) {
       throw new InternalError(`Cannot use "${alias}" as an alias when a route with that name already exists`);
     }
     const routeAliases = aliasesByRoute.get(routeName) ?? [];
     aliasesByRoute.set(routeName, [...routeAliases, alias]);
   }
-  const defaultCommand = defaultCommandRoute ? routes34[defaultCommandRoute] : void 0;
+  const defaultCommand = defaultCommandRoute ? routes35[defaultCommandRoute] : void 0;
   if (defaultCommand && defaultCommand.kind === RouteMapSymbol) {
     throw new InternalError(
       `Cannot use "${defaultCommandRoute}" as the default command because it is not a Command`
@@ -169108,7 +169109,7 @@ function buildRouteMap({
   const resolveRouteName = (input) => {
     if (input in activeAliases) {
       return activeAliases[input];
-    } else if (input in routes34) {
+    } else if (input in routes35) {
       return input;
     }
   };
@@ -169126,7 +169127,7 @@ function buildRouteMap({
       return `${args.prefix.join(" ")} ${routeNames.join("|")} ...`;
     },
     formatHelp: (config2) => {
-      const lines = [...generateRouteMapHelpLines(routes34, docs, config2)];
+      const lines = [...generateRouteMapHelpLines(routes35, docs, config2)];
       const text2 = lines.join("\n");
       return text2 + "\n";
     },
@@ -169169,11 +169170,11 @@ function buildRouteMap({
     },
     getRoutingTargetForInput: (input) => {
       const routeName = input in activeAliases ? activeAliases[input] : input;
-      return routes34[routeName];
+      return routes35[routeName];
     },
     getAllEntries() {
       const hiddenRoutes = docs.hideRoute;
-      return Object.entries(routes34).map(([originalRouteName, target]) => {
+      return Object.entries(routes35).map(([originalRouteName, target]) => {
         return {
           name: {
             original: originalRouteName,
@@ -185911,8 +185912,6 @@ var mapProject = (row) => ({
   path: row.path,
   is_remote: fromDbBool(row.is_remote),
   remote_path: row.remote_path ?? void 0,
-  remote_url: row.remote_url ?? void 0,
-  remote_api_key: row.remote_api_key ?? void 0,
   agent_mode: row.agent_mode ?? "local",
   executor_mode: row.executor_mode ?? "local",
   sync_up_config: row.sync_up_config ? JSON.parse(row.sync_up_config) : void 0,
@@ -185928,10 +185927,10 @@ var createCoreRepos = (kdb, h) => ({
         path: opts.path ?? null,
         remote_path: opts.remote_path ?? null,
         is_remote: h.toDbBool(false),
-        remote_url: null,
-        remote_api_key: null,
-        // Dead column: never populated by any current caller (kept only so
-        // legacy DDL/back-compat readers relying on its presence don't break).
+        // Dead columns: never populated by any current caller (kept only so
+        // legacy DDL/back-compat readers relying on their presence don't break).
+        // remote_url/remote_api_key are leftovers from the removed direct-URL
+        // (outbound) transport — all remote traffic rides reverse-connect now.
         remote_project_id: null,
         agent_mode: opts.agent_mode ?? "local",
         executor_mode: opts.executor_mode ?? "local",
@@ -186114,9 +186113,6 @@ var createRemoteServerRepos = (kdb, _h) => ({
       await kdb.insertInto("remote_servers").values({
         id,
         name: server.name,
-        url: null,
-        api_key: null,
-        connection_mode: "inbound",
         connect_token: null,
         connect_token_created_at: null,
         last_connected_at: null,
@@ -186339,8 +186335,17 @@ var mapExecutorProcess = (row) => ({
   status: row.status
 });
 var mapRemoteExecutorProcess = (row) => ({
-  ...row,
-  status: row.status
+  local_process_id: row.local_process_id,
+  remote_server_id: row.remote_server_id,
+  remote_process_id: row.remote_process_id,
+  executor_id: row.executor_id,
+  project_id: row.project_id,
+  branch: row.branch,
+  started_at: row.started_at,
+  status: row.status,
+  exit_code: row.exit_code,
+  finished_at: row.finished_at,
+  machine_id: row.machine_id
 });
 var createExecutorRepos = (kdb, h) => ({
   executorGroups: {
@@ -187170,6 +187175,10 @@ var createSearchCacheRepos = (kdb, _h) => ({
       ]).executeTakeFirstOrThrow();
       return { running: Number(row.running) };
     },
+    countRunningRemoteSessions: async () => {
+      const row = await kdb.selectFrom("session_search_cache as c").innerJoin("remote_session_mappings as mapping", (join2) => join2.onRef("mapping.local_session_id", "=", "c.local_session_id").onRef("mapping.project_id", "=", "c.project_id").onRef("mapping.remote_server_id", "=", "c.target_id")).innerJoin("project_remotes as association", (join2) => join2.onRef("association.project_id", "=", "c.project_id").onRef("association.remote_server_id", "=", "c.target_id")).where("c.target_id", "!=", "local").where("c.deleted_at", "is", null).where("c.status", "=", "running").select([sql`count(*)`.as("n")]).executeTakeFirstOrThrow();
+      return Number(row.n);
+    },
     updateRemoteSessionActivity: async (entry) => {
       return kdb.transaction().execute(async (trx) => {
         const authorized = await trx.selectFrom("remote_session_mappings as mapping").innerJoin("project_remotes as association", (join2) => join2.onRef("association.project_id", "=", "mapping.project_id").onRef("association.remote_server_id", "=", "mapping.remote_server_id")).select("mapping.branch").where("mapping.local_session_id", "=", entry.localSessionId).where("mapping.project_id", "=", entry.projectId).where("mapping.remote_server_id", "=", entry.targetId).where("mapping.remote_session_id", "=", entry.remoteSessionId).executeTakeFirst();
@@ -238530,16 +238539,12 @@ function resolveUserId(authResult) {
 }
 
 // src/routes/project-routes.ts
-function sanitizeProject(project) {
-  const { remote_api_key, ...safe } = project;
-  return { ...safe, has_remote_api_key: !!remote_api_key };
-}
 var routes2 = async (fastify2) => {
   fastify2.get("/api/projects", async (req, reply) => {
     const authResult = requireAuth(req, reply);
     if (authResult === null) return;
     const userId = resolveUserId(authResult);
-    const projects = (await fastify2.storage.projects.getAll(userId)).map(sanitizeProject);
+    const projects = await fastify2.storage.projects.getAll(userId);
     return reply.code(200).send({ projects });
   });
   fastify2.get("/api/projects/:id", async (req, reply) => {
@@ -238550,7 +238555,7 @@ var routes2 = async (fastify2) => {
     if (!project) {
       return reply.code(404).send({ error: "Project not found" });
     }
-    return reply.code(200).send({ project: sanitizeProject(project) });
+    return reply.code(200).send({ project });
   });
   fastify2.post("/api/dialog/select-folder", async (req, reply) => {
     const folderPath = await selectFolder();
@@ -238621,7 +238626,7 @@ var routes2 = async (fastify2) => {
       agent_mode: agentMode,
       executor_mode: executorMode
     }, userId);
-    return reply.code(201).send({ project: sanitizeProject(project) });
+    return reply.code(201).send({ project });
   });
   fastify2.put("/api/projects/:id", async (req, reply) => {
     const authResult = requireAuth(req, reply);
@@ -238661,7 +238666,7 @@ var routes2 = async (fastify2) => {
     if (!updated) {
       return reply.code(404).send({ error: "Project not found" });
     }
-    return reply.code(200).send({ project: sanitizeProject(updated) });
+    return reply.code(200).send({ project: updated });
   });
   fastify2.delete("/api/projects/:id", async (req, reply) => {
     const authResult = requireAuth(req, reply);
@@ -238800,11 +238805,101 @@ function requireUserFacingOrTrustedProxyUserId(request, reply) {
   return authResult === void 0 && request.server.authEnabled ? void 0 : resolveUserId(authResult);
 }
 
+// src/update-check.ts
+var SEMVER_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?$/;
+async function fetchLatestPublishedVersion(pkg = "vibedeckx", fetchImpl = fetch) {
+  try {
+    const response = await fetchImpl(
+      `https://registry.npmjs.org/${pkg}/latest`,
+      { signal: AbortSignal.timeout(4e3) }
+    );
+    if (!response.ok) return void 0;
+    const body = await response.json();
+    return typeof body.version === "string" && parseSemver(body.version) ? body.version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function parseSemver(version2) {
+  const match2 = SEMVER_RE.exec(version2);
+  if (!match2) return void 0;
+  return {
+    core: [match2[1], match2[2], match2[3]],
+    prerelease: match2[4]?.split(".")
+  };
+}
+function compareNumericStrings(a, b2) {
+  if (a.length !== b2.length) return a.length - b2.length;
+  return a < b2 ? -1 : a > b2 ? 1 : 0;
+}
+function comparePrereleaseIdentifiers(a, b2) {
+  const aNumeric = /^\d+$/.test(a);
+  const bNumeric = /^\d+$/.test(b2);
+  if (aNumeric && bNumeric) return compareNumericStrings(a, b2);
+  if (aNumeric !== bNumeric) return aNumeric ? -1 : 1;
+  return a < b2 ? -1 : a > b2 ? 1 : 0;
+}
+function compareSemver(a, b2) {
+  for (let i = 0; i < 3; i += 1) {
+    const compared = compareNumericStrings(a.core[i], b2.core[i]);
+    if (compared !== 0) return compared;
+  }
+  if (!a.prerelease && !b2.prerelease) return 0;
+  if (!a.prerelease) return 1;
+  if (!b2.prerelease) return -1;
+  const length = Math.max(a.prerelease.length, b2.prerelease.length);
+  for (let i = 0; i < length; i += 1) {
+    const aId = a.prerelease[i];
+    const bId = b2.prerelease[i];
+    if (aId === void 0) return -1;
+    if (bId === void 0) return 1;
+    const compared = comparePrereleaseIdentifiers(aId, bId);
+    if (compared !== 0) return compared;
+  }
+  return 0;
+}
+function compareVersionStrings(a, b2) {
+  const parsedA = parseSemver(a);
+  const parsedB = parseSemver(b2);
+  if (!parsedA || !parsedB) return void 0;
+  return compareSemver(parsedA, parsedB);
+}
+function compareUpdateStatus(current, latest) {
+  if (latest === void 0) return "unknown";
+  const currentParsed = parseSemver(current);
+  const latestParsed = parseSemver(latest);
+  if (!currentParsed || !latestParsed) return "unknown";
+  return compareSemver(latestParsed, currentParsed) > 0 ? "update-available" : "up-to-date";
+}
+
 // src/routes/remote-server-routes.ts
 function sanitizeServer(server) {
   const { connect_token: _t, ...safe } = server;
   return safe;
 }
+var npmLatestCache;
+var npmLatestRefreshInFlight = false;
+function getLatestWorkerVersion() {
+  const ttlMs = npmLatestCache?.value !== void 0 ? 60 * 60 * 1e3 : 5 * 60 * 1e3;
+  const fresh = npmLatestCache !== void 0 && Date.now() - npmLatestCache.fetchedAt < ttlMs;
+  if (!fresh && !npmLatestRefreshInFlight) {
+    npmLatestRefreshInFlight = true;
+    void fetchLatestPublishedVersion().then((value) => {
+      npmLatestCache = { value, fetchedAt: Date.now() };
+    }).finally(() => {
+      npmLatestRefreshInFlight = false;
+    });
+  }
+  return npmLatestCache?.value;
+}
+function workerUpdateStatus(workerVersion, latest) {
+  if (!workerVersion) return "unreported";
+  const vsMin = compareVersionStrings(workerVersion, MIN_WORKER_VERSION);
+  if (vsMin !== void 0 && vsMin < 0) return "behind-min";
+  const vsLatest = latest === void 0 ? void 0 : compareVersionStrings(workerVersion, latest);
+  if (vsLatest !== void 0 && vsLatest < 0) return "behind-latest";
+  return "current";
+}
 var CROSS_REMOTE_ACCESS_VALUES = ["off", "read", "exec"];
 var isCrossRemoteAccess = (value) => typeof value === "string" && CROSS_REMOTE_ACCESS_VALUES.includes(value);
 var routes3 = async (fastify2) => {
@@ -238812,7 +238907,12 @@ var routes3 = async (fastify2) => {
     const userId = requireUserFacingUserId(request, reply);
     if (userId === null) return;
     const servers = await fastify2.storage.remoteServers.getAll(userId);
-    return reply.send(servers.map(sanitizeServer));
+    const latest = getLatestWorkerVersion();
+    return reply.send(servers.map((server) => ({
+      ...sanitizeServer(server),
+      latest_worker_version: latest,
+      worker_update_status: workerUpdateStatus(server.worker_version, latest)
+    })));
   });
   fastify2.post("/api/remote-servers", async (request, reply) => {
     const userId = requireUserFacingUserId(request, reply);
@@ -238971,12 +239071,94 @@ var routes3 = async (fastify2) => {
 };
 var remote_server_routes_default = (0, import_fastify_plugin4.default)(routes3, { name: "remote-server-routes" });
 
-// src/routes/project-remote-routes.ts
+// src/routes/worker-stats-routes.ts
 var import_fastify_plugin5 = __toESM(require_plugin2(), 1);
+var API_KEY = process.env.VIBEDECKX_API_KEY || void 0;
+var STALE_WORKER_THRESHOLD_MS = 7 * 24 * 60 * 60 * 1e3;
+var PHASE4_UNKNOWN_SHARE_MAX = 0.05;
+var PHASE4_DEPRECATION_DAYS = 60;
+function parseDbTimestamp3(ts) {
+  if (!ts) return void 0;
+  const ms = Date.parse(ts.replace(" ", "T") + "Z");
+  return Number.isNaN(ms) ? void 0 : ms;
+}
+function countByVersion(versions) {
+  const counts = {};
+  for (const version2 of versions) {
+    const key = version2 ?? "unknown";
+    counts[key] = (counts[key] ?? 0) + 1;
+  }
+  return counts;
+}
+function oldestVersion(versions) {
+  let oldest;
+  for (const version2 of versions) {
+    if (oldest === void 0) {
+      oldest = version2;
+      continue;
+    }
+    const cmp = compareVersionStrings(version2, oldest);
+    if (cmp !== void 0 && cmp < 0) oldest = version2;
+  }
+  return oldest;
+}
+var routes4 = async (fastify2) => {
+  fastify2.get("/api/admin/worker-version-stats", async (request, reply) => {
+    const apiKeyHeader = request.headers["x-vibedeckx-api-key"];
+    const isOperator = API_KEY !== void 0 && apiKeyHeader !== void 0 || !fastify2.authEnabled && API_KEY === void 0;
+    if (!isOperator) return reply.code(404).send({ error: "Not found" });
+    const now3 = Date.now();
+    const servers = await fastify2.storage.remoteServers.getAll();
+    const connected = servers.filter((server) => fastify2.reverseConnectManager.isConnected(server.id));
+    const everActive = servers.filter((server) => server.last_connected_at !== void 0);
+    const connectedVersions = connected.map((server) => server.worker_version);
+    const unknownConnected = connectedVersions.filter((v2) => v2 === void 0).length;
+    const unknownShareConnected = connected.length > 0 ? unknownConnected / connected.length : null;
+    const daysSinceReporting = Math.floor(
+      (now3 - Date.parse(WORKER_VERSION_REPORTING_SINCE)) / (24 * 60 * 60 * 1e3)
+    );
+    return reply.send({
+      min_worker_version: MIN_WORKER_VERSION,
+      reporting_since: WORKER_VERSION_REPORTING_SINCE,
+      workers_total: servers.length,
+      connected_workers: connected.length,
+      // Two lenses on the distribution: _all accumulates dead rows forever
+      // (abandoned trials), _connected is the one Phase 4 decisions use.
+      versions_all: countByVersion(servers.map((server) => server.worker_version)),
+      versions_connected: countByVersion(connectedVersions),
+      oldest_connected_version: oldestVersion(
+        connectedVersions.filter((v2) => v2 !== void 0)
+      ) ?? null,
+      // Deploy blast radius: how many live tunnels a restart would sever, and
+      // how many of those are mid-turn (the actual user harm — idle sessions
+      // recover on reconnect).
+      active_remote_sessions: fastify2.remoteSessionMap.size,
+      active_turns: await fastify2.storage.searchCache.countRunningRemoteSessions(),
+      // Upgrade-failure tripwire: workers that were active once but have been
+      // offline > 7 days — the classic "daemon didn't come back" signature.
+      stale_workers_7d: everActive.filter((server) => {
+        if (fastify2.reverseConnectManager.isConnected(server.id)) return false;
+        const lastSeen = parseDbTimestamp3(server.last_connected_at);
+        return lastSeen !== void 0 && now3 - lastSeen > STALE_WORKER_THRESHOLD_MS;
+      }).length,
+      phase4_ready: {
+        unknown_share_connected: unknownShareConnected,
+        unknown_share_max: PHASE4_UNKNOWN_SHARE_MAX,
+        days_since_reporting_release: daysSinceReporting,
+        deprecation_days: PHASE4_DEPRECATION_DAYS,
+        verdict: unknownShareConnected !== null && unknownShareConnected < PHASE4_UNKNOWN_SHARE_MAX && daysSinceReporting >= PHASE4_DEPRECATION_DAYS
+      }
+    });
+  });
+};
+var worker_stats_routes_default = (0, import_fastify_plugin5.default)(routes4, { name: "worker-stats-routes" });
+
+// src/routes/project-remote-routes.ts
+var import_fastify_plugin6 = __toESM(require_plugin2(), 1);
 function sanitizeProjectRemote(pr) {
   return pr;
 }
-var routes4 = async (fastify2) => {
+var routes5 = async (fastify2) => {
   fastify2.get(
     "/api/projects/:id/remotes",
     async (request, reply) => {
@@ -239076,12 +239258,12 @@ var routes4 = async (fastify2) => {
     }
   );
 };
-var project_remote_routes_default = (0, import_fastify_plugin5.default)(routes4, { name: "project-remote-routes" });
+var project_remote_routes_default = (0, import_fastify_plugin6.default)(routes5, { name: "project-remote-routes" });
 
 // src/routes/executor-group-routes.ts
-var import_fastify_plugin6 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin7 = __toESM(require_plugin2(), 1);
 import { randomUUID as randomUUID11 } from "crypto";
-var routes5 = async (fastify2) => {
+var routes6 = async (fastify2) => {
   fastify2.get(
     "/api/projects/:projectId/executor-groups",
     async (req, reply) => {
@@ -239152,17 +239334,17 @@ var routes5 = async (fastify2) => {
     }
   );
 };
-var executor_group_routes_default = (0, import_fastify_plugin6.default)(routes5, { name: "executor-group-routes" });
+var executor_group_routes_default = (0, import_fastify_plugin7.default)(routes6, { name: "executor-group-routes" });
 
 // src/routes/executor-routes.ts
-var import_fastify_plugin7 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin8 = __toESM(require_plugin2(), 1);
 import { randomUUID as randomUUID12 } from "crypto";
 function normalizeSqlTimestamp(value) {
   if (!value) return null;
   if (value.includes("T") && /(Z|[+-]\d{2}:?\d{2})$/.test(value)) return value;
   return value.replace(" ", "T") + "Z";
 }
-var routes6 = async (fastify2) => {
+var routes7 = async (fastify2) => {
   fastify2.get(
     "/api/projects/:projectId/executors",
     async (req, reply) => {
@@ -239301,13 +239483,13 @@ var routes6 = async (fastify2) => {
     return reply.code(200).send({ success: true });
   });
 };
-var executor_routes_default = (0, import_fastify_plugin7.default)(routes6, { name: "executor-routes" });
+var executor_routes_default = (0, import_fastify_plugin8.default)(routes7, { name: "executor-routes" });
 
 // src/routes/process-routes.ts
-var import_fastify_plugin8 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin9 = __toESM(require_plugin2(), 1);
 import path9 from "path";
 import { randomUUID as randomUUID13 } from "crypto";
-var routes7 = async (fastify2) => {
+var routes8 = async (fastify2) => {
   fastify2.post("/api/path/execute", async (req, reply) => {
     const userId = requireAuth(req, reply);
     if (userId === null) return;
@@ -239519,10 +239701,10 @@ var routes7 = async (fastify2) => {
     return reply.code(200).send({ processes });
   });
 };
-var process_routes_default = (0, import_fastify_plugin8.default)(routes7, { name: "process-routes" });
+var process_routes_default = (0, import_fastify_plugin9.default)(routes8, { name: "process-routes" });
 
 // src/routes/worktree-routes.ts
-var import_fastify_plugin9 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin10 = __toESM(require_plugin2(), 1);
 import { mkdir as mkdir3 } from "fs/promises";
 async function getAllRemoteConfigs(fastify2, project) {
   const remotes = await fastify2.storage.projectRemotes.getByProject(project.id);
@@ -239535,7 +239717,7 @@ async function getRemoteConfig(fastify2, project) {
   const all = await getAllRemoteConfigs(fastify2, project);
   return all.length > 0 ? all[0] : null;
 }
-var routes8 = async (fastify2) => {
+var routes9 = async (fastify2) => {
   fastify2.get("/api/path/branches", async (req, reply) => {
     const projectPath = req.query.path;
     if (!projectPath) {
@@ -240063,10 +240245,10 @@ var routes8 = async (fastify2) => {
     });
   });
 };
-var worktree_routes_default = (0, import_fastify_plugin9.default)(routes8, { name: "worktree-routes" });
+var worktree_routes_default = (0, import_fastify_plugin10.default)(routes9, { name: "worktree-routes" });
 
 // src/routes/diff-routes.ts
-var import_fastify_plugin10 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin11 = __toESM(require_plugin2(), 1);
 import path10 from "path";
 import { readFileSync as readFileSync4 } from "fs";
 import { execFileSync as execFileSync5 } from "child_process";
@@ -240374,7 +240556,7 @@ async function getUntrackedFiles(cwd) {
   }
   return files;
 }
-var routes9 = async (fastify2) => {
+var routes10 = async (fastify2) => {
   fastify2.get("/api/path/diff", async (req, reply) => {
     const projectPath = req.query.path;
     if (!projectPath) {
@@ -240565,10 +240747,10 @@ var routes9 = async (fastify2) => {
     }
   });
 };
-var diff_routes_default = (0, import_fastify_plugin10.default)(routes9, { name: "diff-routes" });
+var diff_routes_default = (0, import_fastify_plugin11.default)(routes10, { name: "diff-routes" });
 
 // src/routes/file-routes.ts
-var import_fastify_plugin11 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin12 = __toESM(require_plugin2(), 1);
 import path11 from "path";
 import fs2 from "fs/promises";
 import { createReadStream, constants as fsConstants } from "fs";
@@ -240791,7 +240973,7 @@ async function searchSymbol(basePath33, symbol26) {
   }
   return { hits, truncated };
 }
-var routes10 = async (fastify2) => {
+var routes11 = async (fastify2) => {
   fastify2.get("/api/path/browse", async (req, reply) => {
     const projectPath = req.query.path;
     if (!projectPath) {
@@ -241352,10 +241534,10 @@ var routes10 = async (fastify2) => {
     }
   });
 };
-var file_routes_default = (0, import_fastify_plugin11.default)(routes10, { name: "file-routes" });
+var file_routes_default = (0, import_fastify_plugin12.default)(routes11, { name: "file-routes" });
 
 // src/routes/agent-session-routes.ts
-var import_fastify_plugin12 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin13 = __toESM(require_plugin2(), 1);
 
 // src/utils/paste-file.ts
 import { chmod, mkdir as mkdir4, open } from "node:fs/promises";
@@ -241406,7 +241588,7 @@ function messageTextLength(content) {
   }
   return n;
 }
-var routes11 = async (fastify2) => {
+var routes12 = async (fastify2) => {
   const instructionReceiverToken = randomUUID15();
   const instructionDeliveryLocks = /* @__PURE__ */ new Map();
   async function serializeInstructionDelivery(key, effect) {
@@ -242760,10 +242942,10 @@ var routes11 = async (fastify2) => {
     return reply.code(200).send({ success: true, favorited });
   });
 };
-var agent_session_routes_default = (0, import_fastify_plugin12.default)(routes11, { name: "agent-session-routes" });
+var agent_session_routes_default = (0, import_fastify_plugin13.default)(routes12, { name: "agent-session-routes" });
 
 // src/routes/branch-activity-routes.ts
-var import_fastify_plugin13 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin14 = __toESM(require_plugin2(), 1);
 function toResponse(map2) {
   return {
     branches: Array.from(map2.entries()).map(([branch, state]) => ({
@@ -242778,7 +242960,7 @@ function fromResponse(resp) {
     resp.branches.map((b2) => [b2.branch ?? "", { activity: b2.activity, since: b2.since }])
   );
 }
-var routes12 = async (fastify2) => {
+var routes13 = async (fastify2) => {
   function proxyAuto(remoteServerId, method, apiPath, body) {
     return proxyToRemoteAuto(remoteServerId, method, apiPath, body, {
       reverseConnectManager: fastify2.reverseConnectManager
@@ -242843,10 +243025,10 @@ var routes12 = async (fastify2) => {
     }
   );
 };
-var branch_activity_routes_default = (0, import_fastify_plugin13.default)(routes12, { name: "branch-activity-routes" });
+var branch_activity_routes_default = (0, import_fastify_plugin14.default)(routes13, { name: "branch-activity-routes" });
 
 // src/routes/merge-status-routes.ts
-var import_fastify_plugin14 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin15 = __toESM(require_plugin2(), 1);
 function resolveTargets(comparisons, storedTargets) {
   const sources = [];
   const effective = comparisons.map((comparison) => {
@@ -242960,7 +243142,7 @@ function sendComputed(reply, repoPath, comparisons, repository) {
     return reply.code(statusCode).send({ error: message });
   }
 }
-var routes13 = async (fastify2) => {
+var routes14 = async (fastify2) => {
   fastify2.post(
     "/api/path/branches/merge-status",
     async (req, reply) => {
@@ -243082,11 +243264,11 @@ var routes13 = async (fastify2) => {
     }
   );
 };
-var merge_status_routes_default = (0, import_fastify_plugin14.default)(routes13, { name: "merge-status-routes" });
+var merge_status_routes_default = (0, import_fastify_plugin15.default)(routes14, { name: "merge-status-routes" });
 
 // src/routes/chat-session-routes.ts
-var import_fastify_plugin15 = __toESM(require_plugin2(), 1);
-var routes14 = async (fastify2) => {
+var import_fastify_plugin16 = __toESM(require_plugin2(), 1);
+var routes15 = async (fastify2) => {
   const getAuthorizedSession = (req, reply, sessionId) => {
     const authResult = requireUserFacingUserId(req, reply);
     if (authResult === null) return null;
@@ -243191,10 +243373,10 @@ var routes14 = async (fastify2) => {
     return reply.send({ ok: true });
   });
 };
-var chat_session_routes_default = (0, import_fastify_plugin15.default)(routes14, { name: "chat-session-routes" });
+var chat_session_routes_default = (0, import_fastify_plugin16.default)(routes15, { name: "chat-session-routes" });
 
 // src/routes/project-chat-routes.ts
-var import_fastify_plugin16 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin17 = __toESM(require_plugin2(), 1);
 import { createHash as createHash6, randomUUID as randomUUID16 } from "crypto";
 var MAX_TITLE_LENGTH = 200;
 var MAX_MESSAGE_LENGTH = 1e5;
@@ -243307,7 +243489,7 @@ function parseWorkspaceSelectionBody(body) {
   if (!requestId || requestId.length > MAX_TOOL_SELECTOR_ID || !workspaceId || workspaceId.length > MAX_TOOL_SELECTOR_ID) return null;
   return { requestId, workspaceId };
 }
-var routes15 = async (fastify2) => {
+var routes16 = async (fastify2) => {
   const getOwnedThread = async (req, reply, threadId) => {
     const authResult = requireAuth(req, reply);
     if (authResult === null) return null;
@@ -243526,10 +243708,10 @@ var routes15 = async (fastify2) => {
     }
   });
 };
-var project_chat_routes_default = (0, import_fastify_plugin16.default)(routes15, { name: "project-chat-routes" });
+var project_chat_routes_default = (0, import_fastify_plugin17.default)(routes16, { name: "project-chat-routes" });
 
 // src/routes/project-activity-routes.ts
-var import_fastify_plugin17 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin18 = __toESM(require_plugin2(), 1);
 
 // src/project-activity.ts
 var RECENT_THREAD_LIMIT = 5;
@@ -243537,7 +243719,7 @@ var RECENT_SESSION_LIMIT = 8;
 var RECENT_RUN_LIMIT = 5;
 var PRIORITY_TASK_LIMIT = 5;
 var ATTENTION_LIMIT = 10;
-var parseDbTimestamp3 = (value) => {
+var parseDbTimestamp4 = (value) => {
   if (!value) return null;
   const explicitZone = /(?:Z|[+-]\d\d:\d\d)$/i.test(value);
   const parsed = Date.parse(explicitZone ? value : `${value.replace(" ", "T")}Z`);
@@ -243562,8 +243744,8 @@ var localActivity = (session) => {
     lastActiveAt: maxTimestamp(
       session.last_user_message_at,
       session.last_completed_at,
-      parseDbTimestamp3(session.updated_at),
-      parseDbTimestamp3(session.created_at)
+      parseDbTimestamp4(session.updated_at),
+      parseDbTimestamp4(session.created_at)
     ),
     lastUserMessageAt: session.last_user_message_at ?? null,
     lastCompletedAt: session.last_completed_at ?? null
@@ -243627,7 +243809,7 @@ async function getProjectActivity(storage, projectId, userId) {
       entityId: run2.id,
       status: run2.status,
       title: run2.scheduleName,
-      occurredAtMs: parseDbTimestamp3(run2.finished_at ?? run2.started_at) ?? 0
+      occurredAtMs: parseDbTimestamp4(run2.finished_at ?? run2.started_at) ?? 0
     }))
   ].sort((left, right) => right.occurredAtMs - left.occurredAtMs || right.entityId.localeCompare(left.entityId)).slice(0, ATTENTION_LIMIT).map(({ occurredAtMs, ...item }) => ({
     ...item,
@@ -243647,7 +243829,7 @@ async function getProjectActivity(storage, projectId, userId) {
 }
 
 // src/routes/project-activity-routes.ts
-var routes16 = async (fastify2) => {
+var routes17 = async (fastify2) => {
   fastify2.get(
     "/api/projects/:projectId/activity",
     async (req, reply) => {
@@ -243663,12 +243845,12 @@ var routes16 = async (fastify2) => {
     }
   );
 };
-var project_activity_routes_default = (0, import_fastify_plugin17.default)(routes16);
+var project_activity_routes_default = (0, import_fastify_plugin18.default)(routes17);
 
 // src/routes/task-routes.ts
-var import_fastify_plugin18 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin19 = __toESM(require_plugin2(), 1);
 import { randomUUID as randomUUID17 } from "crypto";
-var routes17 = async (fastify2) => {
+var routes18 = async (fastify2) => {
   fastify2.get(
     "/api/projects/:projectId/tasks",
     async (req, reply) => {
@@ -243828,12 +244010,12 @@ Description: ${description}`,
     return reply.code(200).send({ success: true });
   });
 };
-var task_routes_default = (0, import_fastify_plugin18.default)(routes17, { name: "task-routes" });
+var task_routes_default = (0, import_fastify_plugin19.default)(routes18, { name: "task-routes" });
 
 // src/routes/rule-routes.ts
-var import_fastify_plugin19 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin20 = __toESM(require_plugin2(), 1);
 import { randomUUID as randomUUID18 } from "crypto";
-var routes18 = async (fastify2) => {
+var routes19 = async (fastify2) => {
   fastify2.get(
     "/api/projects/:projectId/rules",
     async (req, reply) => {
@@ -243919,12 +244101,12 @@ var routes18 = async (fastify2) => {
     return reply.code(200).send({ success: true });
   });
 };
-var rule_routes_default = (0, import_fastify_plugin19.default)(routes18, { name: "rule-routes" });
+var rule_routes_default = (0, import_fastify_plugin20.default)(routes19, { name: "rule-routes" });
 
 // src/routes/command-routes.ts
-var import_fastify_plugin20 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin21 = __toESM(require_plugin2(), 1);
 import { randomUUID as randomUUID19 } from "crypto";
-var routes19 = async (fastify2) => {
+var routes20 = async (fastify2) => {
   fastify2.get(
     "/api/projects/:projectId/commands",
     async (req, reply) => {
@@ -243993,10 +244175,10 @@ var routes19 = async (fastify2) => {
     return reply.code(200).send({ success: true });
   });
 };
-var command_routes_default = (0, import_fastify_plugin20.default)(routes19, { name: "command-routes" });
+var command_routes_default = (0, import_fastify_plugin21.default)(routes20, { name: "command-routes" });
 
 // src/routes/workflow-run-routes.ts
-var import_fastify_plugin21 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin22 = __toESM(require_plugin2(), 1);
 
 // src/utils/review-brief.ts
 var BASE_TIMEOUT_MS = 15e3;
@@ -244328,7 +244510,7 @@ function errStatus(err) {
       return 500;
   }
 }
-async function routes20(fastify2) {
+async function routes21(fastify2) {
   const remoteRunMap = /* @__PURE__ */ new Map();
   const TERMINAL_RUN_STATUSES = /* @__PURE__ */ new Set(["completed", "cancelled", "failed"]);
   const trackRemoteRun = (localRun, info) => {
@@ -244793,10 +244975,10 @@ async function routes20(fastify2) {
     return reply.send({ runs });
   });
 }
-var workflow_run_routes_default = (0, import_fastify_plugin21.default)(routes20, { name: "workflow-run-routes" });
+var workflow_run_routes_default = (0, import_fastify_plugin22.default)(routes21, { name: "workflow-run-routes" });
 
 // src/routes/settings-routes.ts
-var import_fastify_plugin22 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin23 = __toESM(require_plugin2(), 1);
 var SettingsValidationError = class extends Error {
 };
 var DEFAULT_PROXY_CONFIG = { type: "none", host: "", port: 0 };
@@ -244860,7 +245042,7 @@ function requireSettingsUser(req, reply) {
   if (auth === null) return null;
   return resolveUserId(auth);
 }
-var routes21 = async (fastify2) => {
+var routes22 = async (fastify2) => {
   fastify2.get("/api/settings/agent-processes", async (req, reply) => {
     if (requireAuth(req, reply) === null) return;
     const saved = await fastify2.storage.settings.get("agentProcesses");
@@ -245134,11 +245316,11 @@ var routes21 = async (fastify2) => {
     return reply.code(200).send(updated);
   });
 };
-var settings_routes_default = (0, import_fastify_plugin22.default)(routes21, { name: "settings-routes" });
+var settings_routes_default = (0, import_fastify_plugin23.default)(routes22, { name: "settings-routes" });
 
 // src/routes/translate-routes.ts
-var import_fastify_plugin23 = __toESM(require_plugin2(), 1);
-var routes22 = async (fastify2) => {
+var import_fastify_plugin24 = __toESM(require_plugin2(), 1);
+var routes23 = async (fastify2) => {
   fastify2.post(
     "/api/translate",
     async (req, reply) => {
@@ -245179,10 +245361,10 @@ ${text2}`,
     }
   );
 };
-var translate_routes_default = (0, import_fastify_plugin23.default)(routes22, { name: "translate-routes" });
+var translate_routes_default = (0, import_fastify_plugin24.default)(routes23, { name: "translate-routes" });
 
 // src/routes/websocket-routes.ts
-var import_fastify_plugin24 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin25 = __toESM(require_plugin2(), 1);
 
 // src/routes/executor-stream-handlers.ts
 import { randomUUID as randomUUID20 } from "crypto";
@@ -245393,7 +245575,6 @@ async function verifyWsToken(token) {
 }
 async function authenticateWs(authEnabled, query, socket) {
   if (!authEnabled) return { userId: null, kind: "solo" };
-  if (process.env.VIBEDECKX_API_KEY && query.apiKey) return { userId: null, kind: "api_key" };
   const reject = (error48) => {
     try {
       socket.send(JSON.stringify({ error: error48 }));
@@ -245450,7 +245631,7 @@ async function userOwnsSession(fastify2, sessionId, userId) {
 }
 
 // src/routes/websocket-routes.ts
-var routes23 = async (fastify2) => {
+var routes24 = async (fastify2) => {
   fastify2.reverseConnectManager.setStatusChangeHandler((remoteServerId, status) => {
     if (status !== "online") return;
     const cache2 = fastify2.remotePatchCache;
@@ -245666,25 +245847,21 @@ var routes23 = async (fastify2) => {
         console.log(`[AgentWS] Connection attempt for session ${sessionId} (auth=${fastify2.authEnabled})`);
         let principalUserId = fastify2.authEnabled ? null : "local";
         if (fastify2.authEnabled) {
-          const apiKey = req.query.apiKey;
           const token = req.query.token;
-          const apiKeyTrusted = !!process.env.VIBEDECKX_API_KEY && !!apiKey;
-          if (!apiKeyTrusted) {
-            if (!token) {
-              console.log(`[AgentWS] Auth rejected: no token (session=${sessionId})`);
-              socket.send(JSON.stringify({ error: "Authentication required" }));
-              socket.close();
-              return;
-            }
-            const userId = await verifyWsToken(token);
-            if (!userId) {
-              console.log(`[AgentWS] Auth rejected: invalid token (session=${sessionId})`);
-              socket.send(JSON.stringify({ error: "Invalid authentication token" }));
-              socket.close();
-              return;
-            }
-            principalUserId = userId;
+          if (!token) {
+            console.log(`[AgentWS] Auth rejected: no token (session=${sessionId})`);
+            socket.send(JSON.stringify({ error: "Authentication required" }));
+            socket.close();
+            return;
           }
+          const userId = await verifyWsToken(token);
+          if (!userId) {
+            console.log(`[AgentWS] Auth rejected: invalid token (session=${sessionId})`);
+            socket.send(JSON.stringify({ error: "Invalid authentication token" }));
+            socket.close();
+            return;
+          }
+          principalUserId = userId;
         }
         if (principalUserId !== null && !await userOwnsSession(fastify2, sessionId, principalUserId)) {
           console.log(`[AgentWS] Ownership denied for session ${sessionId} (user=${principalUserId})`);
@@ -245814,37 +245991,33 @@ var routes23 = async (fastify2) => {
         const { sessionId } = req.params;
         let principalUserId = fastify2.authEnabled ? null : "local";
         if (fastify2.authEnabled) {
-          const apiKey = req.query.apiKey;
           const token = req.query.token;
-          const apiKeyTrusted = !!process.env.VIBEDECKX_API_KEY && !!apiKey;
-          if (!apiKeyTrusted) {
-            if (!token) {
-              console.log(`[ChatWS] Auth rejected: no token (session=${sessionId})`);
-              try {
-                socket.send(JSON.stringify({ error: "Authentication required" }));
-              } catch {
-              }
-              try {
-                socket.close();
-              } catch {
-              }
-              return;
+          if (!token) {
+            console.log(`[ChatWS] Auth rejected: no token (session=${sessionId})`);
+            try {
+              socket.send(JSON.stringify({ error: "Authentication required" }));
+            } catch {
             }
-            const userId = await verifyWsToken(token);
-            if (!userId) {
-              console.log(`[ChatWS] Auth rejected: invalid token (session=${sessionId})`);
-              try {
-                socket.send(JSON.stringify({ error: "Invalid authentication token" }));
-              } catch {
-              }
-              try {
-                socket.close();
-              } catch {
-              }
-              return;
+            try {
+              socket.close();
+            } catch {
             }
-            principalUserId = userId;
+            return;
           }
+          const userId = await verifyWsToken(token);
+          if (!userId) {
+            console.log(`[ChatWS] Auth rejected: invalid token (session=${sessionId})`);
+            try {
+              socket.send(JSON.stringify({ error: "Invalid authentication token" }));
+            } catch {
+            }
+            try {
+              socket.close();
+            } catch {
+            }
+            return;
+          }
+          principalUserId = userId;
         }
         if (principalUserId !== null) {
           const owned = fastify2.chatSessionManager.getSession(sessionId);
@@ -245897,10 +246070,10 @@ var routes23 = async (fastify2) => {
     );
   });
 };
-var websocket_routes_default = (0, import_fastify_plugin24.default)(routes23, { name: "websocket-routes" });
+var websocket_routes_default = (0, import_fastify_plugin25.default)(routes24, { name: "websocket-routes" });
 
 // src/routes/reverse-connect-routes.ts
-var import_fastify_plugin25 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin26 = __toESM(require_plugin2(), 1);
 import { randomBytes as randomBytes2, createHash as createHash7, verify as cryptoVerify } from "crypto";
 
 // src/utils/rate-limited-warn.ts
@@ -245936,73 +246109,6 @@ function createRateLimitedWarn(windowMs, maxKeys) {
   };
 }
 
-// src/update-check.ts
-var SEMVER_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?$/;
-async function fetchLatestPublishedVersion(pkg = "vibedeckx", fetchImpl = fetch) {
-  try {
-    const response = await fetchImpl(
-      `https://registry.npmjs.org/${pkg}/latest`,
-      { signal: AbortSignal.timeout(4e3) }
-    );
-    if (!response.ok) return void 0;
-    const body = await response.json();
-    return typeof body.version === "string" && parseSemver(body.version) ? body.version : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function parseSemver(version2) {
-  const match2 = SEMVER_RE.exec(version2);
-  if (!match2) return void 0;
-  return {
-    core: [match2[1], match2[2], match2[3]],
-    prerelease: match2[4]?.split(".")
-  };
-}
-function compareNumericStrings(a, b2) {
-  if (a.length !== b2.length) return a.length - b2.length;
-  return a < b2 ? -1 : a > b2 ? 1 : 0;
-}
-function comparePrereleaseIdentifiers(a, b2) {
-  const aNumeric = /^\d+$/.test(a);
-  const bNumeric = /^\d+$/.test(b2);
-  if (aNumeric && bNumeric) return compareNumericStrings(a, b2);
-  if (aNumeric !== bNumeric) return aNumeric ? -1 : 1;
-  return a < b2 ? -1 : a > b2 ? 1 : 0;
-}
-function compareSemver(a, b2) {
-  for (let i = 0; i < 3; i += 1) {
-    const compared = compareNumericStrings(a.core[i], b2.core[i]);
-    if (compared !== 0) return compared;
-  }
-  if (!a.prerelease && !b2.prerelease) return 0;
-  if (!a.prerelease) return 1;
-  if (!b2.prerelease) return -1;
-  const length = Math.max(a.prerelease.length, b2.prerelease.length);
-  for (let i = 0; i < length; i += 1) {
-    const aId = a.prerelease[i];
-    const bId = b2.prerelease[i];
-    if (aId === void 0) return -1;
-    if (bId === void 0) return 1;
-    const compared = comparePrereleaseIdentifiers(aId, bId);
-    if (compared !== 0) return compared;
-  }
-  return 0;
-}
-function compareVersionStrings(a, b2) {
-  const parsedA = parseSemver(a);
-  const parsedB = parseSemver(b2);
-  if (!parsedA || !parsedB) return void 0;
-  return compareSemver(parsedA, parsedB);
-}
-function compareUpdateStatus(current, latest) {
-  if (latest === void 0) return "unknown";
-  const currentParsed = parseSemver(current);
-  const latestParsed = parseSemver(latest);
-  if (!currentParsed || !latestParsed) return "unknown";
-  return compareSemver(latestParsed, currentParsed) > 0 ? "update-available" : "up-to-date";
-}
-
 // src/routes/reverse-connect-routes.ts
 function extractReportedVersion(frame) {
   if (typeof frame.version !== "string" || frame.version.length === 0) return void 0;
@@ -246012,7 +246118,7 @@ function extractReportedVersion(frame) {
 var MACHINE_HANDSHAKE_TIMEOUT_MS = 5e3;
 var REJECT_LOG_WINDOW_MS = 3e4;
 var REJECT_LOG_MAX_KEYS = 500;
-var routes24 = async (fastify2) => {
+var routes25 = async (fastify2) => {
   const logRejectedUpgrade = createRateLimitedWarn(REJECT_LOG_WINDOW_MS, REJECT_LOG_MAX_KEYS);
   fastify2.get("/api/reverse-connect/identity", async (req, reply) => {
     const token = req.headers["x-vibedeckx-connect-token"];
@@ -246059,7 +246165,11 @@ var routes24 = async (fastify2) => {
             console.log(`[ReverseConnect] Worker ${serverId} reported no version (pre-reporting release)`);
             return;
           }
+          const previous = (await fastify2.storage.remoteServers.getById(serverId))?.worker_version;
           await fastify2.storage.remoteServers.updateWorkerVersion(serverId, reported.version, reported.capabilities);
+          if (previous !== reported.version) {
+            console.log(`[ReverseConnect] Worker ${serverId} version ${previous ?? "unreported"} \u2192 ${reported.version}`);
+          }
           const cmp = compareVersionStrings(reported.version, MIN_WORKER_VERSION);
           if (cmp !== void 0 && cmp < 0) {
             console.warn(
@@ -246142,10 +246252,10 @@ var routes24 = async (fastify2) => {
     );
   });
 };
-var reverse_connect_routes_default = (0, import_fastify_plugin25.default)(routes24, { name: "reverse-connect-routes" });
+var reverse_connect_routes_default = (0, import_fastify_plugin26.default)(routes25, { name: "reverse-connect-routes" });
 
 // src/routes/event-routes.ts
-var import_fastify_plugin26 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin27 = __toESM(require_plugin2(), 1);
 function toWireEvent(event) {
   if (event.type === "executor:stopped" && (event.tailOutput !== void 0 || event.finalResult !== void 0)) {
     const { tailOutput: _tailOutput, finalResult: _finalResult, ...rest } = event;
@@ -246153,31 +246263,28 @@ function toWireEvent(event) {
   }
   return event;
 }
-var routes25 = async (fastify2) => {
+var routes26 = async (fastify2) => {
   fastify2.get("/api/events", async (req, reply) => {
     let userId = null;
     if (fastify2.authEnabled) {
-      const apiKey = req.headers["x-vibedeckx-api-key"];
-      if (!(process.env.VIBEDECKX_API_KEY && apiKey)) {
-        const token = req.query.token;
-        if (!token) {
-          return reply.code(401).send({ error: "Unauthorized" });
-        }
-        try {
-          const { verifyToken: verifyToken3 } = await Promise.resolve().then(() => (init_dist(), dist_exports));
-          const payload = await verifyToken3(token, {
-            secretKey: process.env.CLERK_SECRET_KEY,
-            clockSkewInMs: CLERK_CLOCK_SKEW_MS
-          });
-          if (!payload.sub) {
-            return reply.code(401).send({ error: "Unauthorized" });
-          }
-          userId = payload.sub;
-        } catch (err) {
-          const reason = err?.reason;
-          if (reason) console.log(`[EventsSSE] token verification failed: ${reason}`);
+      const token = req.query.token;
+      if (!token) {
+        return reply.code(401).send({ error: "Unauthorized" });
+      }
+      try {
+        const { verifyToken: verifyToken3 } = await Promise.resolve().then(() => (init_dist(), dist_exports));
+        const payload = await verifyToken3(token, {
+          secretKey: process.env.CLERK_SECRET_KEY,
+          clockSkewInMs: CLERK_CLOCK_SKEW_MS
+        });
+        if (!payload.sub) {
           return reply.code(401).send({ error: "Unauthorized" });
         }
+        userId = payload.sub;
+      } catch (err) {
+        const reason = err?.reason;
+        if (reason) console.log(`[EventsSSE] token verification failed: ${reason}`);
+        return reply.code(401).send({ error: "Unauthorized" });
       }
     }
     reply.raw.writeHead(200, {
@@ -246211,10 +246318,10 @@ var routes25 = async (fastify2) => {
     await reply;
   });
 };
-var event_routes_default = (0, import_fastify_plugin26.default)(routes25, { name: "event-routes" });
+var event_routes_default = (0, import_fastify_plugin27.default)(routes26, { name: "event-routes" });
 
 // src/routes/terminal-routes.ts
-var import_fastify_plugin27 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin28 = __toESM(require_plugin2(), 1);
 import path13 from "path";
 
 // src/utils/path-project.ts
@@ -246242,7 +246349,7 @@ async function getRemoteConfig5(fastify2, project, remoteServerId) {
     remotePath: target.remote_path
   };
 }
-var routes26 = async (fastify2) => {
+var routes27 = async (fastify2) => {
   fastify2.post("/api/path/terminals", async (req, reply) => {
     const { path: projectPath, branch } = req.body;
     if (!projectPath) {
@@ -246418,11 +246525,11 @@ var routes26 = async (fastify2) => {
     }
   );
 };
-var terminal_routes_default = (0, import_fastify_plugin27.default)(routes26, { name: "terminal-routes" });
+var terminal_routes_default = (0, import_fastify_plugin28.default)(routes27, { name: "terminal-routes" });
 
 // src/routes/browser-routes.ts
-var import_fastify_plugin28 = __toESM(require_plugin2(), 1);
-var routes27 = async (fastify2) => {
+var import_fastify_plugin29 = __toESM(require_plugin2(), 1);
+var routes28 = async (fastify2) => {
   const ensureProjectAccess = async (req, reply) => {
     const userId = requireUserFacingUserId(req, reply);
     if (userId === null) return null;
@@ -246493,10 +246600,10 @@ var routes27 = async (fastify2) => {
     return reply.code(200).send({ ok: true });
   });
 };
-var browser_routes_default = (0, import_fastify_plugin28.default)(routes27, { name: "browser-routes" });
+var browser_routes_default = (0, import_fastify_plugin29.default)(routes28, { name: "browser-routes" });
 
 // src/routes/browser-proxy-routes.ts
-var import_fastify_plugin29 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin30 = __toESM(require_plugin2(), 1);
 import { randomUUID as randomUUID21 } from "crypto";
 
 // src/utils/ssrf-guard.ts
@@ -246992,7 +247099,7 @@ function generateInjectedScript(projectId, targetOrigin, proxyWsPrefix) {
 })();
 </script>`;
 }
-var routes28 = async (fastify2) => {
+var routes29 = async (fastify2) => {
   fastify2.get("/api/projects/:id/browser/proxy/*", async (req, reply) => {
     const userId = requireUserFacingOrTrustedProxyUserId(req, reply);
     if (userId === null) return;
@@ -247061,7 +247168,7 @@ var routes28 = async (fastify2) => {
     const { id: projectId } = req.params;
     const principal = await authenticateWs(fastify2.authEnabled, req.query, socket);
     if (!principal) return;
-    const projectOwner = principal.kind === "api_key" ? void 0 : principal.userId ?? "local";
+    const projectOwner = principal.userId ?? "local";
     if (!await fastify2.storage.projects.getById(projectId, projectOwner)) {
       try {
         socket.send(JSON.stringify({ error: "Forbidden" }));
@@ -247164,10 +247271,10 @@ var routes28 = async (fastify2) => {
     });
   });
 };
-var browser_proxy_routes_default = (0, import_fastify_plugin29.default)(routes28, { name: "browser-proxy-routes" });
+var browser_proxy_routes_default = (0, import_fastify_plugin30.default)(routes29, { name: "browser-proxy-routes" });
 
 // src/routes/cross-remote-target-routes.ts
-var import_fastify_plugin30 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin31 = __toESM(require_plugin2(), 1);
 import path14 from "path";
 import { promises as fs3 } from "fs";
 
@@ -247247,7 +247354,7 @@ var clampTimeoutMs = (timeoutSec) => {
   const requested = typeof timeoutSec === "number" && Number.isFinite(timeoutSec) && timeoutSec > 0 ? timeoutSec : DEFAULT_TIMEOUT_SEC;
   return Math.min(requested, MAX_TIMEOUT_SEC) * 1e3;
 };
-var routes29 = async (fastify2) => {
+var routes30 = async (fastify2) => {
   fastify2.post(
     "/api/path/cross-remote/exec",
     async (request, reply) => {
@@ -247355,10 +247462,10 @@ var routes29 = async (fastify2) => {
     return reply.send(result);
   });
 };
-var cross_remote_target_routes_default = (0, import_fastify_plugin30.default)(routes29, { name: "cross-remote-target-routes" });
+var cross_remote_target_routes_default = (0, import_fastify_plugin31.default)(routes30, { name: "cross-remote-target-routes" });
 
 // src/routes/cross-remote-mcp-routes.ts
-var import_fastify_plugin31 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin32 = __toESM(require_plugin2(), 1);
 var PROTOCOL_VERSION = "2024-11-05";
 var AUDIT_ARGS_MAX = 1024;
 var NOT_ACCESSIBLE = "remote not found or not accessible";
@@ -247461,7 +247568,7 @@ var textResult = (text2, isError = false) => ({
   content: [{ type: "text", text: text2 }],
   ...isError ? { isError: true } : {}
 });
-var routes30 = async (fastify2) => {
+var routes31 = async (fastify2) => {
   const guard = new SessionConcurrencyGuard();
   let cachedSecret;
   const getSecret = () => {
@@ -247582,10 +247689,10 @@ var routes30 = async (fastify2) => {
     }
   });
 };
-var cross_remote_mcp_routes_default = (0, import_fastify_plugin31.default)(routes30, { name: "cross-remote-mcp-routes" });
+var cross_remote_mcp_routes_default = (0, import_fastify_plugin32.default)(routes31, { name: "cross-remote-mcp-routes" });
 
 // src/routes/schedule-routes.ts
-var import_fastify_plugin32 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin33 = __toESM(require_plugin2(), 1);
 import { randomUUID as randomUUID22 } from "crypto";
 import path15 from "path";
 var RUN_TYPES = ["command", "prompt"];
@@ -247604,7 +247711,7 @@ function validateResolved(b2) {
   if (cronError) return `Invalid cron expression: ${cronError}`;
   return null;
 }
-var routes31 = async (fastify2) => {
+var routes32 = async (fastify2) => {
   const sendTerminalManualOutcome = (reply, request, replay) => {
     if (!request.terminalStatus || request.terminalResponseStatus === null) return null;
     const common = { runId: request.runId, status: request.terminalStatus, durable: true, replay };
@@ -247835,10 +247942,10 @@ var routes31 = async (fastify2) => {
     }
   );
 };
-var schedule_routes_default = (0, import_fastify_plugin32.default)(routes31, { name: "schedule-routes" });
+var schedule_routes_default = (0, import_fastify_plugin33.default)(routes32, { name: "schedule-routes" });
 
 // src/search/catalog.ts
-var parseDbTimestamp4 = (ts) => {
+var parseDbTimestamp5 = (ts) => {
   if (!ts) return null;
   const ms = Date.parse(ts.replace(" ", "T") + "Z");
   return Number.isNaN(ms) ? null : ms;
@@ -247860,7 +247967,7 @@ async function buildSearchCatalog(deps, projectId, projectPath) {
       id: s3.id,
       branch: s3.branch === "" ? null : s3.branch,
       title: s3.title ?? null,
-      lastActiveAt: s3.last_user_message_at ?? parseDbTimestamp4(s3.updated_at),
+      lastActiveAt: s3.last_user_message_at ?? parseDbTimestamp5(s3.updated_at),
       favoritedAt: s3.favorited_at ?? null,
       entryCount,
       status: s3.status,
@@ -248127,10 +248234,10 @@ var searchRoutes = async (fastify2) => {
 var search_routes_default = searchRoutes;
 
 // src/routes/notification-routes.ts
-var import_fastify_plugin33 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin34 = __toESM(require_plugin2(), 1);
 var MAX_LIMIT = 500;
 var DEFAULT_LIMIT = 100;
-var routes32 = async (fastify2) => {
+var routes33 = async (fastify2) => {
   fastify2.get(
     "/api/notifications",
     async (req, reply) => {
@@ -248162,7 +248269,7 @@ var routes32 = async (fastify2) => {
     return reply.code(200).send({ ok: true });
   });
 };
-var notification_routes_default = (0, import_fastify_plugin33.default)(routes32, { name: "notification-routes" });
+var notification_routes_default = (0, import_fastify_plugin34.default)(routes33, { name: "notification-routes" });
 
 // ../../node_modules/.pnpm/@clerk+fastify@3.1.2_fastify@5.7.2_react-dom@19.2.3_react@19.2.3__react@19.2.3/node_modules/@clerk/fastify/dist/chunk-RY4T2JMQ.mjs
 import { Readable as Readable2 } from "stream";
@@ -248214,7 +248321,7 @@ var requestToProxyRequest = (req) => {
 
 // ../../node_modules/.pnpm/@clerk+fastify@3.1.2_fastify@5.7.2_react-dom@19.2.3_react@19.2.3__react@19.2.3/node_modules/@clerk/fastify/dist/index.mjs
 init_dist();
-var import_fastify_plugin34 = __toESM(require_plugin2(), 1);
+var import_fastify_plugin35 = __toESM(require_plugin2(), 1);
 
 // ../../node_modules/.pnpm/@clerk+backend@3.2.0_react-dom@19.2.3_react@19.2.3__react@19.2.3/node_modules/@clerk/backend/dist/internal.mjs
 init_chunk_JW73PKED();
@@ -248502,7 +248609,7 @@ var plugin = (instance, opts, done) => {
   instance.addHook(hookName, withClerkMiddleware(opts));
   done();
 };
-var clerkPlugin = (0, import_fastify_plugin34.default)(plugin, {
+var clerkPlugin = (0, import_fastify_plugin35.default)(plugin, {
   name: "@clerk/fastify",
   fastify: "5.x"
 });
@@ -249250,12 +249357,10 @@ async function shutdownLogging() {
 }
 
 // src/server.ts
-var API_KEY = process.env.VIBEDECKX_API_KEY;
+var API_KEY2 = process.env.VIBEDECKX_API_KEY || void 0;
 function requireAuth(req, reply) {
   const server = req.server;
   if (!server.authEnabled) return void 0;
-  const apiKeyHeader = req.headers["x-vibedeckx-api-key"];
-  if (API_KEY && apiKeyHeader) return void 0;
   try {
     const { userId } = getAuth(req);
     if (!userId) {
@@ -249342,19 +249447,12 @@ var createServer = async (opts) => {
     done();
   });
   server.addHook("onRequest", (req, reply, done) => {
-    if (!API_KEY) return done();
-    if (!req.url.startsWith("/api/")) return done();
+    if (!API_KEY2) return done();
+    if (!req.url.startsWith("/api/admin/")) return done();
     if (req.method === "OPTIONS") return done();
-    const pathname = req.url.split("?")[0];
-    if (pathname === "/api/config" || pathname === "/api/reverse-connect" || pathname === "/api/reverse-connect/identity") {
-      return done();
-    }
     const providedKey = req.headers["x-vibedeckx-api-key"] || req.query?.apiKey;
-    if (!providedKey && authEnabled) {
-      return done();
-    }
-    if (providedKey !== API_KEY) {
-      return reply.code(401).send({ error: "Unauthorized" });
+    if (providedKey !== API_KEY2) {
+      return reply.code(404).send({ error: "Not found" });
     }
     done();
   });
@@ -249430,6 +249528,7 @@ var createServer = async (opts) => {
   server.register(reverse_connect_routes_default);
   server.register(project_routes_default);
   server.register(remote_server_routes_default);
+  server.register(worker_stats_routes_default);
   server.register(project_remote_routes_default);
   server.register(search_routes_default);
   server.register(executor_group_routes_default);
@@ -249919,14 +250018,10 @@ var ReverseConnectClient = class {
         });
         body = await response.text();
       } else {
-        const injectHeaders = { ...frame.headers ?? {} };
-        if (process.env.VIBEDECKX_API_KEY) {
-          injectHeaders["x-vibedeckx-api-key"] = process.env.VIBEDECKX_API_KEY;
-        }
         const response = await this.localServer.inject({
           method: frame.method,
           url: frame.path,
-          headers: injectHeaders,
+          headers: frame.headers ?? {},
           payload: frame.body
         });
         status = response.statusCode;
@@ -249966,11 +250061,7 @@ var ReverseConnectClient = class {
     }
   }
   handleWsOpen(frame) {
-    const queryParts = [
-      ...frame.query ? [frame.query] : [],
-      ...process.env.VIBEDECKX_API_KEY ? [`apiKey=${encodeURIComponent(process.env.VIBEDECKX_API_KEY)}`] : []
-    ];
-    const wsUrl = `ws://127.0.0.1:${this.localPort}${frame.path}${queryParts.length ? `?${queryParts.join("&")}` : ""}`;
+    const wsUrl = `ws://127.0.0.1:${this.localPort}${frame.path}${frame.query ? `?${frame.query}` : ""}`;
     console.log(`[ReverseClient] Opening local WS channel ${frame.channelId} \u2192 ${frame.path}`);
     const localWs = new wrapper_default(wsUrl);
     localWs.on("open", () => {
@@ -251477,7 +251568,7 @@ var startCommand = buildCommand({
       host: {
         kind: "parsed",
         parse: String,
-        brief: "Network interface to bind (default: 127.0.0.1, loopback only). Use 0.0.0.0 to expose on all interfaces \u2014 only do so behind --auth, VIBEDECKX_API_KEY, or a trusted tunnel/proxy.",
+        brief: "Network interface to bind (default: 127.0.0.1, loopback only). Use 0.0.0.0 to expose on all interfaces \u2014 only do so behind --auth or an authenticating proxy.",
         optional: true
       },
       auth: {
@@ -251548,11 +251639,16 @@ var startCommand = buildCommand({
     const noLocalProjects = flags["no-local-projects"] ?? false;
     const tls = loadTLSOptions(flags);
     const isLoopbackHost = host === "127.0.0.1" || host === "::1" || host === "localhost";
-    if (!isLoopbackHost && !authEnabled && !process.env.VIBEDECKX_API_KEY) {
+    if (!isLoopbackHost && !authEnabled) {
       console.warn(
         `Warning: binding to ${host} exposes vibedeckx on the network with no authentication.
-Anyone who can reach this host can run commands via the executor API. Enable --auth or
-set VIBEDECKX_API_KEY, or keep the default loopback bind (127.0.0.1) behind a trusted tunnel/proxy.`
+Anyone who can reach this host can run commands via the executor API. Enable --auth, or put
+an authenticating proxy in front, or keep the default loopback bind (127.0.0.1).`
+      );
+    }
+    if (process.env.VIBEDECKX_API_KEY) {
+      console.log(
+        "VIBEDECKX_API_KEY is set: it authenticates operator-only endpoints (/api/admin/*).\nIt does not lock the rest of the API and is not user authentication \u2014 use --auth or a\nproxy in front for that."
       );
     }
     console.log(`Starting vibedeckx${tls ? " (HTTPS)" : ""}...`);
@@ -251828,7 +251924,7 @@ var connectRoutes = buildRouteMap({
   defaultCommand: "run",
   docs: { brief: "Connect to a Vibedeckx server as an inbound node" }
 });
-var routes33 = buildRouteMap({
+var routes34 = buildRouteMap({
   routes: {
     start: startCommand,
     connect: connectRoutes
@@ -251838,7 +251934,7 @@ var routes33 = buildRouteMap({
     brief: "Vibedeckx - AI-powered app generator"
   }
 });
-var program = buildApplication(routes33, {
+var program = buildApplication(routes34, {
   name: "vibedeckx",
   versionInfo: {
     currentVersion: readPackageVersion()