bindler 1.2.0 → 1.3.0

package/dist/cli.js

@@ -1,14 +1,20 @@
 #!/usr/bin/env node
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 
 // src/cli.ts
 import { Command } from "commander";
-import chalk29 from "chalk";
+import chalk30 from "chalk";
 
 // src/commands/new.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync3 } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3 } from "fs";
 import { basename as basename2 } from "path";
 import inquirer from "inquirer";
-import chalk from "chalk";
+import chalk2 from "chalk";
 
 // src/lib/config.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync } from "fs";
@@ -694,9 +700,175 @@ function mergeYamlWithProject(project, yamlConfig) {
   };
 }
 
+// src/lib/validation.ts
+import { existsSync as existsSync5, accessSync, constants } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join5 } from "path";
+import chalk from "chalk";
+var MACOS_PROTECTED_PATHS = [
+  join5(homedir2(), "Desktop"),
+  join5(homedir2(), "Documents"),
+  join5(homedir2(), "Downloads")
+];
+function isProtectedPath(path) {
+  if (process.platform !== "darwin") return false;
+  const normalizedPath = path.replace(/\/+$/, "");
+  return MACOS_PROTECTED_PATHS.some(
+    (protected_) => normalizedPath === protected_ || normalizedPath.startsWith(protected_ + "/")
+  );
+}
+function checkPortAvailable(port) {
+  const result = execCommandSafe(`lsof -i :${port} -P -n 2>/dev/null | grep LISTEN | head -1`);
+  if (!result.success || !result.output) {
+    return { available: true };
+  }
+  const parts = result.output.trim().split(/\s+/);
+  const processName = parts[0] || "unknown";
+  return { available: false, usedBy: processName };
+}
+function validateProject(project) {
+  const errors = [];
+  const warnings = [];
+  if (!existsSync5(project.path)) {
+    errors.push(`Path does not exist: ${project.path}`);
+  }
+  if (isProtectedPath(project.path)) {
+    errors.push(
+      `Path is in a macOS protected folder (${project.path}). Nginx cannot access Desktop/Documents/Downloads without Full Disk Access. Move your project to ~/projects or grant nginx Full Disk Access in System Settings.`
+    );
+  }
+  if (project.type === "npm" && project.port) {
+    const portCheck = checkPortAvailable(project.port);
+    if (!portCheck.available) {
+      warnings.push(`Port ${project.port} is in use by ${portCheck.usedBy}`);
+    }
+  }
+  if (!project.hostname.match(/^[a-zA-Z0-9][a-zA-Z0-9.-]*[a-zA-Z0-9]$/)) {
+    warnings.push(`Hostname "${project.hostname}" may be invalid`);
+  }
+  if (project.type === "npm" && !project.start) {
+    const pkgPath = join5(project.path, "package.json");
+    if (existsSync5(pkgPath)) {
+      try {
+        const pkg = JSON.parse(__require("fs").readFileSync(pkgPath, "utf-8"));
+        if (!pkg.scripts?.start) {
+          warnings.push('No start command specified and package.json has no "start" script');
+        }
+      } catch {
+      }
+    }
+  }
+  return {
+    valid: errors.length === 0,
+    errors,
+    warnings
+  };
+}
+function validateConfig(config) {
+  const errors = [];
+  const warnings = [];
+  const listenPort = parseInt(config.defaults.nginxListen.split(":").pop() || "80", 10);
+  if (listenPort === 80 || listenPort === 443) {
+    if (process.getuid && process.getuid() !== 0) {
+      warnings.push(
+        `Nginx is configured to listen on port ${listenPort}, which requires root/sudo. Run 'sudo bindler apply' or use a higher port like 8080.`
+      );
+    }
+  }
+  const nginxPath = config.defaults.nginxManagedPath;
+  const nginxDir = nginxPath.substring(0, nginxPath.lastIndexOf("/"));
+  if (!existsSync5(nginxDir)) {
+    errors.push(`Nginx config directory does not exist: ${nginxDir}`);
+  }
+  for (const project of config.projects) {
+    if (project.enabled === false) continue;
+    const projectResult = validateProject(project);
+    for (const err of projectResult.errors) {
+      errors.push(`[${project.name}] ${err}`);
+    }
+    for (const warn of projectResult.warnings) {
+      warnings.push(`[${project.name}] ${warn}`);
+    }
+  }
+  const hostnames = config.projects.filter((p) => p.enabled !== false).map((p) => p.hostname);
+  const duplicates = hostnames.filter((h, i) => hostnames.indexOf(h) !== i);
+  if (duplicates.length > 0) {
+    const uniqueDupes = [...new Set(duplicates)];
+    for (const dupe of uniqueDupes) {
+      const projects = config.projects.filter((p) => p.hostname === dupe).map((p) => p.name);
+      if (!projects.every((p, i, arr) => {
+        const proj = config.projects.find((x) => x.name === p);
+        const firstProj = config.projects.find((x) => x.name === arr[0]);
+        return proj?.basePath !== firstProj?.basePath || i === 0;
+      })) {
+        warnings.push(`Hostname "${dupe}" is shared by: ${projects.join(", ")} (ensure they have different base paths)`);
+      }
+    }
+  }
+  const ports = config.projects.filter((p) => p.enabled !== false && p.type === "npm" && p.port).map((p) => ({ name: p.name, port: p.port }));
+  const portMap = /* @__PURE__ */ new Map();
+  for (const { name, port } of ports) {
+    const existing = portMap.get(port) || [];
+    existing.push(name);
+    portMap.set(port, existing);
+  }
+  for (const [port, names] of portMap) {
+    if (names.length > 1) {
+      errors.push(`Port ${port} is used by multiple projects: ${names.join(", ")}`);
+    }
+  }
+  return {
+    valid: errors.length === 0,
+    errors,
+    warnings
+  };
+}
+function printValidationResult(result) {
+  if (result.errors.length > 0) {
+    console.log(chalk.red("\n\u2717 Validation errors:"));
+    for (const err of result.errors) {
+      console.log(chalk.red(`  \u2022 ${err}`));
+    }
+  }
+  if (result.warnings.length > 0) {
+    console.log(chalk.yellow("\n\u26A0 Warnings:"));
+    for (const warn of result.warnings) {
+      console.log(chalk.yellow(`  \u2022 ${warn}`));
+    }
+  }
+  if (result.valid && result.warnings.length === 0) {
+    console.log(chalk.green("\u2713 All checks passed"));
+  }
+}
+function runPreflightChecks(config) {
+  const result = validateConfig(config);
+  const nginxCheck = execCommandSafe("which nginx");
+  if (!nginxCheck.success) {
+    result.errors.push("Nginx is not installed. Run: brew install nginx");
+  }
+  const nginxRunning = execCommandSafe("pgrep nginx");
+  if (!nginxRunning.success) {
+    result.warnings.push("Nginx is not running. After apply, start it with: brew services start nginx");
+  }
+  const localProjects = config.projects.filter((p) => p.local && p.enabled !== false);
+  if (localProjects.length > 0) {
+    const hostsResult = execCommandSafe("cat /etc/hosts");
+    if (hostsResult.success) {
+      for (const project of localProjects) {
+        if (!hostsResult.output.includes(project.hostname)) {
+          result.warnings.push(
+            `Hostname "${project.hostname}" not in /etc/hosts. Add: 127.0.0.1  ${project.hostname}`
+          );
+        }
+      }
+    }
+  }
+  return result;
+}
+
 // src/commands/new.ts
 async function newCommand(options) {
-  console.log(chalk.dim("Checking prerequisites...\n"));
+  console.log(chalk2.dim("Checking prerequisites...\n"));
   const issues = [];
   if (!isNginxInstalled()) {
     issues.push("nginx is not installed. Install: brew install nginx (macOS) or apt install nginx (Linux)");
@@ -705,11 +877,11 @@ async function newCommand(options) {
     issues.push("PM2 is not installed. Install: npm install -g pm2");
   }
   if (issues.length > 0) {
-    console.log(chalk.red("Missing prerequisites:\n"));
+    console.log(chalk2.red("Missing prerequisites:\n"));
     for (const issue of issues) {
-      console.log(chalk.red(`  \u2717 ${issue}`));
+      console.log(chalk2.red(`  \u2717 ${issue}`));
     }
-    console.log(chalk.dim("\nRun `bindler doctor` for full diagnostics."));
+    console.log(chalk2.dim("\nRun `bindler doctor` for full diagnostics."));
     const { proceed } = await inquirer.prompt([
       {
         type: "confirm",
@@ -723,17 +895,17 @@ async function newCommand(options) {
     }
     console.log("");
   } else {
-    console.log(chalk.green("\u2713 Prerequisites OK\n"));
+    console.log(chalk2.green("\u2713 Prerequisites OK\n"));
   }
   const defaults = getDefaults();
   let project = {};
   const cwd = process.cwd();
   const cwdName = basename2(cwd);
   const initialPath = options.path || cwd;
-  const yamlConfig = existsSync5(initialPath) ? readBindlerYaml(initialPath) : null;
+  const yamlConfig = existsSync6(initialPath) ? readBindlerYaml(initialPath) : null;
   let yamlDefaults = {};
   if (yamlConfig) {
-    console.log(chalk.cyan("Found bindler.yaml - using as defaults\n"));
+    console.log(chalk2.cyan("Found bindler.yaml - using as defaults\n"));
     yamlDefaults = yamlToProject(yamlConfig, initialPath);
   }
   if (!options.name) {
@@ -767,7 +939,7 @@ async function newCommand(options) {
         name: "type",
         message: "Project type:",
         choices: (answers2) => {
-          const detected = existsSync5(answers2.path) ? detectProjectType(answers2.path) : "static";
+          const detected = existsSync6(answers2.path) ? detectProjectType(answers2.path) : "static";
           return [
             { name: `npm (Node.js app)${detected === "npm" ? " - detected" : ""}`, value: "npm" },
             { name: `static (HTML/CSS/JS)${detected === "static" ? " - detected" : ""}`, value: "static" }
@@ -775,7 +947,7 @@ async function newCommand(options) {
         },
         default: (answers2) => {
           if (yamlDefaults.type) return yamlDefaults.type;
-          return existsSync5(answers2.path) ? detectProjectType(answers2.path) : "static";
+          return existsSync6(answers2.path) ? detectProjectType(answers2.path) : "static";
         }
       },
       {
@@ -808,7 +980,7 @@ async function newCommand(options) {
     if (yamlDefaults.security) project.security = yamlDefaults.security;
     if (yamlDefaults.environments) project.environments = yamlDefaults.environments;
     if (answers.type === "npm") {
-      const scripts = existsSync5(answers.path) ? getPackageJsonScripts(answers.path) : [];
+      const scripts = existsSync6(answers.path) ? getPackageJsonScripts(answers.path) : [];
       const suggestedPort = yamlDefaults.port || findAvailablePort();
       const npmAnswers = await inquirer.prompt([
         {
@@ -862,7 +1034,7 @@ async function newCommand(options) {
     }
   } else {
     if (!options.hostname) {
-      console.error(chalk.red("Error: --hostname is required"));
+      console.error(chalk2.red("Error: --hostname is required"));
       process.exit(1);
     }
     project.name = options.name;
@@ -882,14 +1054,14 @@ async function newCommand(options) {
     }
   }
   if (!validateProjectName(project.name)) {
-    console.error(chalk.red("Error: Invalid project name"));
+    console.error(chalk2.red("Error: Invalid project name"));
     process.exit(1);
   }
   if (!validateHostname(project.hostname)) {
-    console.error(chalk.red("Error: Invalid hostname"));
+    console.error(chalk2.red("Error: Invalid hostname"));
     process.exit(1);
   }
-  if (!existsSync5(project.path)) {
+  if (!existsSync6(project.path)) {
     const createDir = options.name ? true : (await inquirer.prompt([
       {
         type: "confirm",
@@ -900,51 +1072,72 @@ async function newCommand(options) {
     ])).create;
     if (createDir) {
       mkdirSync3(project.path, { recursive: true });
-      console.log(chalk.green(`Created directory: ${project.path}`));
+      console.log(chalk2.green(`Created directory: ${project.path}`));
+    }
+  }
+  const validationResult = validateProject(project);
+  if (!validationResult.valid || validationResult.warnings.length > 0) {
+    console.log("");
+    printValidationResult(validationResult);
+    if (!validationResult.valid) {
+      console.log(chalk2.red("\n\u2717 Cannot add project due to validation errors."));
+      process.exit(1);
+    }
+    const { proceed } = await inquirer.prompt([
+      {
+        type: "confirm",
+        name: "proceed",
+        message: "Continue with these warnings?",
+        default: true
+      }
+    ]);
+    if (!proceed) {
+      console.log(chalk2.yellow("Aborted."));
+      process.exit(0);
     }
   }
   try {
     addProject(project);
-    console.log(chalk.green(`
+    console.log(chalk2.green(`
 Project "${project.name}" added successfully!`));
     if (project.local) {
-      console.log(chalk.yellow(`
+      console.log(chalk2.yellow(`
 Local project - add to /etc/hosts:`));
-      console.log(chalk.cyan(`  echo "127.0.0.1  ${project.hostname}" | sudo tee -a /etc/hosts`));
-      console.log(chalk.dim(`
-Run ${chalk.cyan("sudo bindler apply")} to update nginx.`));
-      console.log(chalk.dim(`Then access at: ${chalk.cyan(`http://${project.hostname}:8080`)}`));
+      console.log(chalk2.cyan(`  echo "127.0.0.1  ${project.hostname}" | sudo tee -a /etc/hosts`));
+      console.log(chalk2.dim(`
+Run ${chalk2.cyan("sudo bindler apply")} to update nginx.`));
+      console.log(chalk2.dim(`Then access at: ${chalk2.cyan(`http://${project.hostname}:8080`)}`));
     } else {
-      console.log(chalk.dim(`
-Configuration saved. Run ${chalk.cyan("sudo bindler apply")} to update nginx and cloudflare.`));
+      console.log(chalk2.dim(`
+Configuration saved. Run ${chalk2.cyan("sudo bindler apply")} to update nginx and cloudflare.`));
     }
     if (project.type === "npm") {
-      console.log(chalk.dim(`Run ${chalk.cyan(`bindler start ${project.name}`)} to start the application.`));
+      console.log(chalk2.dim(`Run ${chalk2.cyan(`bindler start ${project.name}`)} to start the application.`));
     }
   } catch (error) {
-    console.error(chalk.red(`Error: ${error instanceof Error ? error.message : error}`));
+    console.error(chalk2.red(`Error: ${error instanceof Error ? error.message : error}`));
     process.exit(1);
   }
 }
 
 // src/commands/list.ts
-import chalk2 from "chalk";
+import chalk3 from "chalk";
 import Table from "cli-table3";
 async function listCommand() {
   const projects = listProjects();
   if (projects.length === 0) {
-    console.log(chalk2.yellow("No projects registered."));
-    console.log(chalk2.dim(`Run ${chalk2.cyan("bindler new")} to create one.`));
+    console.log(chalk3.yellow("No projects registered."));
+    console.log(chalk3.dim(`Run ${chalk3.cyan("bindler new")} to create one.`));
     return;
   }
   const table = new Table({
     head: [
-      chalk2.cyan("Name"),
-      chalk2.cyan("Type"),
-      chalk2.cyan("Hostname"),
-      chalk2.cyan("Port"),
-      chalk2.cyan("Path"),
-      chalk2.cyan("Status")
+      chalk3.cyan("Name"),
+      chalk3.cyan("Type"),
+      chalk3.cyan("Hostname"),
+      chalk3.cyan("Port"),
+      chalk3.cyan("Path"),
+      chalk3.cyan("Status")
     ],
     style: {
       head: [],
@@ -956,15 +1149,15 @@ async function listCommand() {
     if (project.type === "npm") {
       const process2 = getProcessByName(project.name);
       if (process2) {
-        status = process2.status === "online" ? chalk2.green("online") : process2.status === "stopped" ? chalk2.yellow("stopped") : chalk2.red(process2.status);
+        status = process2.status === "online" ? chalk3.green("online") : process2.status === "stopped" ? chalk3.yellow("stopped") : chalk3.red(process2.status);
       } else {
-        status = chalk2.dim("not started");
+        status = chalk3.dim("not started");
       }
     } else {
-      status = project.enabled !== false ? chalk2.green("serving") : chalk2.yellow("disabled");
+      status = project.enabled !== false ? chalk3.green("serving") : chalk3.yellow("disabled");
     }
     if (project.enabled === false) {
-      status = chalk2.yellow("disabled");
+      status = chalk3.yellow("disabled");
     }
     table.push([
       project.name,
@@ -976,17 +1169,17 @@ async function listCommand() {
     ]);
   }
   console.log(table.toString());
-  console.log(chalk2.dim(`
+  console.log(chalk3.dim(`
 ${projects.length} project(s) registered`));
 }
 
 // src/commands/status.ts
-import chalk3 from "chalk";
+import chalk4 from "chalk";
 import Table2 from "cli-table3";
 async function statusCommand() {
   const projects = listProjects();
   if (projects.length === 0) {
-    console.log(chalk3.yellow("No projects registered."));
+    console.log(chalk4.yellow("No projects registered."));
     return;
   }
   const statuses = [];
@@ -1010,12 +1203,12 @@ async function statusCommand() {
   }
   const table = new Table2({
     head: [
-      chalk3.cyan("Name"),
-      chalk3.cyan("Type"),
-      chalk3.cyan("Hostname"),
-      chalk3.cyan("Port"),
-      chalk3.cyan("PM2 Status"),
-      chalk3.cyan("Port Check")
+      chalk4.cyan("Name"),
+      chalk4.cyan("Type"),
+      chalk4.cyan("Hostname"),
+      chalk4.cyan("Port"),
+      chalk4.cyan("PM2 Status"),
+      chalk4.cyan("Port Check")
     ],
     style: {
       head: [],
@@ -1028,25 +1221,25 @@ async function statusCommand() {
     if (status.type === "npm") {
       switch (status.pm2Status) {
         case "online":
-          pm2StatusStr = chalk3.green("online");
+          pm2StatusStr = chalk4.green("online");
           break;
         case "stopped":
-          pm2StatusStr = chalk3.yellow("stopped");
+          pm2StatusStr = chalk4.yellow("stopped");
           break;
         case "errored":
-          pm2StatusStr = chalk3.red("errored");
+          pm2StatusStr = chalk4.red("errored");
           break;
         case "not_managed":
-          pm2StatusStr = chalk3.dim("not started");
+          pm2StatusStr = chalk4.dim("not started");
           break;
         default:
-          pm2StatusStr = chalk3.dim(status.pm2Status || "-");
+          pm2StatusStr = chalk4.dim(status.pm2Status || "-");
       }
-      portCheckStr = status.portListening ? chalk3.green("listening") : chalk3.red("not listening");
+      portCheckStr = status.portListening ? chalk4.green("listening") : chalk4.red("not listening");
     }
     if (status.enabled === false) {
-      pm2StatusStr = chalk3.yellow("disabled");
-      portCheckStr = chalk3.dim("-");
+      pm2StatusStr = chalk4.yellow("disabled");
+      portCheckStr = chalk4.dim("-");
     }
     table.push([
       status.name,
@@ -1060,14 +1253,14 @@ async function statusCommand() {
   console.log(table.toString());
   const runningProcesses = getPm2List().filter((p) => p.name.startsWith("bindler:"));
   if (runningProcesses.length > 0) {
-    console.log(chalk3.bold("\nPM2 Process Details:"));
+    console.log(chalk4.bold("\nPM2 Process Details:"));
     const detailTable = new Table2({
       head: [
-        chalk3.cyan("Process"),
-        chalk3.cyan("CPU"),
-        chalk3.cyan("Memory"),
-        chalk3.cyan("Uptime"),
-        chalk3.cyan("Restarts")
+        chalk4.cyan("Process"),
+        chalk4.cyan("CPU"),
+        chalk4.cyan("Memory"),
+        chalk4.cyan("Uptime"),
+        chalk4.cyan("Restarts")
       ],
       style: {
         head: [],
@@ -1088,197 +1281,198 @@ async function statusCommand() {
 }
 
 // src/commands/start.ts
-import chalk4 from "chalk";
+import chalk5 from "chalk";
 async function startCommand(name, options) {
   if (options.all) {
     const projects = listProjects();
     const npmProjects = projects.filter((p) => p.type === "npm");
     if (npmProjects.length === 0) {
-      console.log(chalk4.yellow("No npm projects to start."));
+      console.log(chalk5.yellow("No npm projects to start."));
       return;
     }
-    console.log(chalk4.blue(`Starting ${npmProjects.length} npm project(s)...`));
+    console.log(chalk5.blue(`Starting ${npmProjects.length} npm project(s)...`));
     const results = startAllProjects(npmProjects);
     for (const result2 of results) {
       if (result2.success) {
-        console.log(chalk4.green(`  \u2713 ${result2.name}`));
+        console.log(chalk5.green(`  \u2713 ${result2.name}`));
       } else {
-        console.log(chalk4.red(`  \u2717 ${result2.name}: ${result2.error}`));
+        console.log(chalk5.red(`  \u2717 ${result2.name}: ${result2.error}`));
       }
     }
     const succeeded = results.filter((r) => r.success).length;
-    console.log(chalk4.dim(`
+    console.log(chalk5.dim(`
 ${succeeded}/${results.length} started successfully`));
     return;
   }
   if (!name) {
-    console.error(chalk4.red("Error: Project name is required. Use --all to start all projects."));
+    console.error(chalk5.red("Error: Project name is required. Use --all to start all projects."));
     process.exit(1);
   }
   const project = getProject(name);
   if (!project) {
-    console.error(chalk4.red(`Error: Project "${name}" not found`));
+    console.error(chalk5.red(`Error: Project "${name}" not found`));
     process.exit(1);
   }
   if (project.type !== "npm") {
-    console.log(chalk4.blue(`Project "${name}" is a static site - no process to start.`));
-    console.log(chalk4.dim("Static sites are served directly by nginx."));
+    console.log(chalk5.blue(`Project "${name}" is a static site - no process to start.`));
+    console.log(chalk5.dim("Static sites are served directly by nginx."));
     return;
   }
-  console.log(chalk4.blue(`Starting ${name}...`));
+  console.log(chalk5.blue(`Starting ${name}...`));
   const result = startProject(project);
   if (result.success) {
-    console.log(chalk4.green(`\u2713 ${name} started successfully`));
-    console.log(chalk4.dim(`  Port: ${project.port}`));
-    console.log(chalk4.dim(`  URL: https://${project.hostname}`));
+    console.log(chalk5.green(`\u2713 ${name} started successfully`));
+    console.log(chalk5.dim(`  Port: ${project.port}`));
+    console.log(chalk5.dim(`  URL: https://${project.hostname}`));
   } else {
-    console.error(chalk4.red(`\u2717 Failed to start ${name}: ${result.error}`));
+    console.error(chalk5.red(`\u2717 Failed to start ${name}: ${result.error}`));
     process.exit(1);
   }
 }
 
 // src/commands/stop.ts
-import chalk5 from "chalk";
+import chalk6 from "chalk";
 async function stopCommand(name, options) {
   if (options.all) {
     const projects = listProjects();
     const npmProjects = projects.filter((p) => p.type === "npm");
     if (npmProjects.length === 0) {
-      console.log(chalk5.yellow("No npm projects to stop."));
+      console.log(chalk6.yellow("No npm projects to stop."));
       return;
     }
-    console.log(chalk5.blue(`Stopping ${npmProjects.length} npm project(s)...`));
+    console.log(chalk6.blue(`Stopping ${npmProjects.length} npm project(s)...`));
     const results = stopAllProjects(npmProjects);
     for (const result2 of results) {
       if (result2.success) {
-        console.log(chalk5.green(`  \u2713 ${result2.name}`));
+        console.log(chalk6.green(`  \u2713 ${result2.name}`));
       } else {
-        console.log(chalk5.red(`  \u2717 ${result2.name}: ${result2.error}`));
+        console.log(chalk6.red(`  \u2717 ${result2.name}: ${result2.error}`));
       }
     }
     const succeeded = results.filter((r) => r.success).length;
-    console.log(chalk5.dim(`
+    console.log(chalk6.dim(`
 ${succeeded}/${results.length} stopped successfully`));
     return;
   }
   if (!name) {
-    console.error(chalk5.red("Error: Project name is required. Use --all to stop all projects."));
+    console.error(chalk6.red("Error: Project name is required. Use --all to stop all projects."));
     process.exit(1);
   }
   const project = getProject(name);
   if (!project) {
-    console.error(chalk5.red(`Error: Project "${name}" not found`));
+    console.error(chalk6.red(`Error: Project "${name}" not found`));
     process.exit(1);
   }
   if (project.type !== "npm") {
-    console.log(chalk5.yellow(`Project "${name}" is a static site - no process to stop.`));
+    console.log(chalk6.yellow(`Project "${name}" is a static site - no process to stop.`));
     return;
   }
-  console.log(chalk5.blue(`Stopping ${name}...`));
+  console.log(chalk6.blue(`Stopping ${name}...`));
   const result = stopProject(name);
   if (result.success) {
-    console.log(chalk5.green(`\u2713 ${name} stopped successfully`));
+    console.log(chalk6.green(`\u2713 ${name} stopped successfully`));
   } else {
-    console.error(chalk5.red(`\u2717 Failed to stop ${name}: ${result.error}`));
+    console.error(chalk6.red(`\u2717 Failed to stop ${name}: ${result.error}`));
     process.exit(1);
   }
 }
 
 // src/commands/restart.ts
-import chalk6 from "chalk";
+import chalk7 from "chalk";
 async function restartCommand(name, options) {
   if (options.all) {
     const projects = listProjects();
     const npmProjects = projects.filter((p) => p.type === "npm");
     if (npmProjects.length === 0) {
-      console.log(chalk6.yellow("No npm projects to restart."));
+      console.log(chalk7.yellow("No npm projects to restart."));
       return;
     }
-    console.log(chalk6.blue(`Restarting ${npmProjects.length} npm project(s)...`));
+    console.log(chalk7.blue(`Restarting ${npmProjects.length} npm project(s)...`));
     const results = restartAllProjects(npmProjects);
     for (const result2 of results) {
       if (result2.success) {
-        console.log(chalk6.green(`  \u2713 ${result2.name}`));
+        console.log(chalk7.green(`  \u2713 ${result2.name}`));
       } else {
-        console.log(chalk6.red(`  \u2717 ${result2.name}: ${result2.error}`));
+        console.log(chalk7.red(`  \u2717 ${result2.name}: ${result2.error}`));
       }
     }
     const succeeded = results.filter((r) => r.success).length;
-    console.log(chalk6.dim(`
+    console.log(chalk7.dim(`
 ${succeeded}/${results.length} restarted successfully`));
     return;
   }
   if (!name) {
-    console.error(chalk6.red("Error: Project name is required. Use --all to restart all projects."));
+    console.error(chalk7.red("Error: Project name is required. Use --all to restart all projects."));
     process2.exit(1);
   }
   const project = getProject(name);
   if (!project) {
-    console.error(chalk6.red(`Error: Project "${name}" not found`));
+    console.error(chalk7.red(`Error: Project "${name}" not found`));
     process2.exit(1);
   }
   if (project.type !== "npm") {
-    console.log(chalk6.yellow(`Project "${name}" is a static site - no process to restart.`));
+    console.log(chalk7.yellow(`Project "${name}" is a static site - no process to restart.`));
     return;
   }
-  console.log(chalk6.blue(`Restarting ${name}...`));
+  console.log(chalk7.blue(`Restarting ${name}...`));
   const process2 = getProcessByName(name);
   let result;
   if (process2) {
     result = restartProject(name);
   } else {
-    console.log(chalk6.dim("Process not running, starting..."));
+    console.log(chalk7.dim("Process not running, starting..."));
     result = startProject(project);
   }
   if (result.success) {
-    console.log(chalk6.green(`\u2713 ${name} restarted successfully`));
+    console.log(chalk7.green(`\u2713 ${name} restarted successfully`));
   } else {
-    console.error(chalk6.red(`\u2717 Failed to restart ${name}: ${result.error}`));
+    console.error(chalk7.red(`\u2717 Failed to restart ${name}: ${result.error}`));
     process2.exit(1);
   }
 }
 
 // src/commands/logs.ts
-import chalk7 from "chalk";
+import chalk8 from "chalk";
 async function logsCommand(name, options) {
   const project = getProject(name);
   if (!project) {
-    console.error(chalk7.red(`Error: Project "${name}" not found`));
+    console.error(chalk8.red(`Error: Project "${name}" not found`));
     process2.exit(1);
   }
   if (project.type !== "npm") {
-    console.log(chalk7.yellow(`Project "${name}" is a static site - no logs available.`));
-    console.log(chalk7.dim("Check nginx access/error logs instead:"));
-    console.log(chalk7.dim("  /var/log/nginx/access.log"));
-    console.log(chalk7.dim("  /var/log/nginx/error.log"));
+    console.log(chalk8.yellow(`Project "${name}" is a static site - no logs available.`));
+    console.log(chalk8.dim("Check nginx access/error logs instead:"));
+    console.log(chalk8.dim("  /var/log/nginx/access.log"));
+    console.log(chalk8.dim("  /var/log/nginx/error.log"));
     return;
   }
   const process2 = getProcessByName(name);
   if (!process2) {
-    console.log(chalk7.yellow(`Project "${name}" has not been started yet.`));
-    console.log(chalk7.dim(`Run ${chalk7.cyan(`bindler start ${name}`)} first.`));
+    console.log(chalk8.yellow(`Project "${name}" has not been started yet.`));
+    console.log(chalk8.dim(`Run ${chalk8.cyan(`bindler start ${name}`)} first.`));
     return;
   }
   const lines = options.lines || 200;
   const follow = options.follow || false;
   if (follow) {
-    console.log(chalk7.dim(`Following logs for ${name}... (Ctrl+C to exit)`));
+    console.log(chalk8.dim(`Following logs for ${name}... (Ctrl+C to exit)`));
   }
   await showLogs(name, follow, lines);
 }
 
 // src/commands/update.ts
-import chalk8 from "chalk";
+import chalk9 from "chalk";
+import { existsSync as existsSync7 } from "fs";
 async function updateCommand(name, options) {
   const project = getProject(name);
   if (!project) {
-    console.error(chalk8.red(`Error: Project "${name}" not found`));
+    console.error(chalk9.red(`Error: Project "${name}" not found`));
     process.exit(1);
   }
   const updates = {};
   if (options.hostname) {
     if (!validateHostname(options.hostname)) {
-      console.error(chalk8.red("Error: Invalid hostname format"));
+      console.error(chalk9.red("Error: Invalid hostname format"));
       process.exit(1);
     }
     updates.hostname = options.hostname;
@@ -1286,11 +1480,11 @@ async function updateCommand(name, options) {
   if (options.port) {
     const port = parseInt(options.port, 10);
     if (!validatePort(port)) {
-      console.error(chalk8.red("Error: Invalid port. Use a number between 1024 and 65535."));
+      console.error(chalk9.red("Error: Invalid port. Use a number between 1024 and 65535."));
       process.exit(1);
     }
     if (!isPortAvailable(port) && port !== project.port) {
-      console.error(chalk8.red(`Error: Port ${port} is already in use by another project.`));
+      console.error(chalk9.red(`Error: Port ${port} is already in use by another project.`));
       process.exit(1);
     }
     updates.port = port;
@@ -1300,12 +1494,22 @@ async function updateCommand(name, options) {
   }
   if (options.start) {
     if (project.type !== "npm") {
-      console.error(chalk8.red("Error: Start command only applies to npm projects"));
+      console.error(chalk9.red("Error: Start command only applies to npm projects"));
       process.exit(1);
     }
     updates.start = options.start;
   }
   if (options.path) {
+    if (!existsSync7(options.path)) {
+      console.error(chalk9.red(`Error: Path does not exist: ${options.path}`));
+      process.exit(1);
+    }
+    if (isProtectedPath(options.path)) {
+      console.error(chalk9.red(`Error: Path is in a macOS protected folder (Desktop/Documents/Downloads).`));
+      console.error(chalk9.yellow(`Nginx cannot access these folders without Full Disk Access.`));
+      console.error(chalk9.dim(`Move your project to ~/projects or another accessible location.`));
+      process.exit(1);
+    }
     updates.path = options.path;
   }
   if (options.env && options.env.length > 0) {
@@ -1313,7 +1517,7 @@ async function updateCommand(name, options) {
     for (const envStr of options.env) {
       const [key, ...valueParts] = envStr.split("=");
       if (!key) {
-        console.error(chalk8.red(`Error: Invalid env format: ${envStr}. Use KEY=value`));
+        console.error(chalk9.red(`Error: Invalid env format: ${envStr}. Use KEY=value`));
         process.exit(1);
       }
       env[key] = valueParts.join("=");
@@ -1326,23 +1530,23 @@ async function updateCommand(name, options) {
     updates.enabled = false;
   }
   if (Object.keys(updates).length === 0) {
-    console.log(chalk8.yellow("No updates specified."));
-    console.log(chalk8.dim("Available options: --hostname, --port, --start, --path, --env, --enable, --disable"));
+    console.log(chalk9.yellow("No updates specified."));
+    console.log(chalk9.dim("Available options: --hostname, --port, --start, --path, --env, --enable, --disable"));
     return;
   }
   try {
     updateProject(name, updates);
-    console.log(chalk8.green(`\u2713 Project "${name}" updated successfully`));
+    console.log(chalk9.green(`\u2713 Project "${name}" updated successfully`));
     for (const [key, value] of Object.entries(updates)) {
-      console.log(chalk8.dim(`  ${key}: ${typeof value === "object" ? JSON.stringify(value) : value}`));
+      console.log(chalk9.dim(`  ${key}: ${typeof value === "object" ? JSON.stringify(value) : value}`));
     }
-    console.log(chalk8.dim(`
-Run ${chalk8.cyan("sudo bindler apply")} to apply changes to nginx.`));
+    console.log(chalk9.dim(`
+Run ${chalk9.cyan("sudo bindler apply")} to apply changes to nginx.`));
     if (project.type === "npm" && (updates.port || updates.start || updates.env)) {
-      console.log(chalk8.dim(`Run ${chalk8.cyan(`bindler restart ${name}`)} to apply changes to the running process.`));
+      console.log(chalk9.dim(`Run ${chalk9.cyan(`bindler restart ${name}`)} to apply changes to the running process.`));
     }
   } catch (error) {
-    console.error(chalk8.red(`Error: ${error instanceof Error ? error.message : error}`));
+    console.error(chalk9.red(`Error: ${error instanceof Error ? error.message : error}`));
     process.exit(1);
   }
 }
@@ -1350,21 +1554,21 @@ Run ${chalk8.cyan("sudo bindler apply")} to apply changes to nginx.`));
 // src/commands/edit.ts
 import { writeFileSync as writeFileSync4, readFileSync as readFileSync4, unlinkSync } from "fs";
 import { tmpdir } from "os";
-import { join as join5 } from "path";
-import chalk9 from "chalk";
+import { join as join6 } from "path";
+import chalk10 from "chalk";
 async function editCommand(name) {
   const project = getProject(name);
   if (!project) {
-    console.error(chalk9.red(`Error: Project "${name}" not found`));
+    console.error(chalk10.red(`Error: Project "${name}" not found`));
     process.exit(1);
   }
   const editor = process.env.EDITOR || process.env.VISUAL || "vi";
-  const tmpFile = join5(tmpdir(), `bindler-${name}-${Date.now()}.json`);
+  const tmpFile = join6(tmpdir(), `bindler-${name}-${Date.now()}.json`);
   writeFileSync4(tmpFile, JSON.stringify(project, null, 2) + "\n");
-  console.log(chalk9.dim(`Opening ${name} config in ${editor}...`));
+  console.log(chalk10.dim(`Opening ${name} config in ${editor}...`));
   const exitCode = await spawnInteractive(editor, [tmpFile]);
   if (exitCode !== 0) {
-    console.error(chalk9.red("Editor exited with error"));
+    console.error(chalk10.red("Editor exited with error"));
     unlinkSync(tmpFile);
     process.exit(1);
   }
@@ -1372,7 +1576,7 @@ async function editCommand(name) {
   try {
     editedContent = readFileSync4(tmpFile, "utf-8");
   } catch (error) {
-    console.error(chalk9.red("Failed to read edited file"));
+    console.error(chalk10.red("Failed to read edited file"));
     process.exit(1);
   } finally {
     unlinkSync(tmpFile);
@@ -1381,44 +1585,44 @@ async function editCommand(name) {
   try {
     editedProject = JSON.parse(editedContent);
   } catch (error) {
-    console.error(chalk9.red("Error: Invalid JSON in edited file"));
+    console.error(chalk10.red("Error: Invalid JSON in edited file"));
     process.exit(1);
   }
   if (editedProject.name !== project.name) {
-    console.error(chalk9.red("Error: Cannot change project name via edit. Use a new project instead."));
+    console.error(chalk10.red("Error: Cannot change project name via edit. Use a new project instead."));
     process.exit(1);
   }
   const originalStr = JSON.stringify(project);
   const editedStr = JSON.stringify(editedProject);
   if (originalStr === editedStr) {
-    console.log(chalk9.yellow("No changes made."));
+    console.log(chalk10.yellow("No changes made."));
     return;
   }
   try {
     const config = readConfig();
     const index = config.projects.findIndex((p) => p.name === name);
     if (index === -1) {
-      console.error(chalk9.red("Error: Project not found"));
+      console.error(chalk10.red("Error: Project not found"));
       process.exit(1);
     }
     config.projects[index] = editedProject;
     writeConfig(config);
-    console.log(chalk9.green(`\u2713 Project "${name}" updated successfully`));
-    console.log(chalk9.dim(`
-Run ${chalk9.cyan("sudo bindler apply")} to apply changes to nginx.`));
+    console.log(chalk10.green(`\u2713 Project "${name}" updated successfully`));
+    console.log(chalk10.dim(`
+Run ${chalk10.cyan("sudo bindler apply")} to apply changes to nginx.`));
   } catch (error) {
-    console.error(chalk9.red(`Error: ${error instanceof Error ? error.message : error}`));
+    console.error(chalk10.red(`Error: ${error instanceof Error ? error.message : error}`));
     process.exit(1);
   }
 }
 
 // src/commands/remove.ts
 import inquirer2 from "inquirer";
-import chalk10 from "chalk";
+import chalk11 from "chalk";
 async function removeCommand(name, options) {
   const project = getProject(name);
   if (!project) {
-    console.error(chalk10.red(`Error: Project "${name}" not found`));
+    console.error(chalk11.red(`Error: Project "${name}" not found`));
     process.exit(1);
   }
   if (!options.force) {
@@ -1431,34 +1635,34 @@ async function removeCommand(name, options) {
       }
     ]);
     if (!confirm) {
-      console.log(chalk10.yellow("Cancelled."));
+      console.log(chalk11.yellow("Cancelled."));
       return;
     }
   }
   if (project.type === "npm") {
     const process2 = getProcessByName(name);
     if (process2) {
-      console.log(chalk10.dim("Stopping PM2 process..."));
+      console.log(chalk11.dim("Stopping PM2 process..."));
       deleteProject(name);
     }
   }
   try {
     removeProject(name);
-    console.log(chalk10.green(`\u2713 Project "${name}" removed from registry`));
-    console.log(chalk10.dim(`
-Run ${chalk10.cyan("sudo bindler apply")} to update nginx configuration.`));
-    console.log(chalk10.yellow("\nNote: The project files and Cloudflare DNS routes were not removed."));
-    console.log(chalk10.dim(`  Project path: ${project.path}`));
-    console.log(chalk10.dim(`  To remove DNS route manually: cloudflared tunnel route dns --remove ${project.hostname}`));
+    console.log(chalk11.green(`\u2713 Project "${name}" removed from registry`));
+    console.log(chalk11.dim(`
+Run ${chalk11.cyan("sudo bindler apply")} to update nginx configuration.`));
+    console.log(chalk11.yellow("\nNote: The project files and Cloudflare DNS routes were not removed."));
+    console.log(chalk11.dim(`  Project path: ${project.path}`));
+    console.log(chalk11.dim(`  To remove DNS route manually: cloudflared tunnel route dns --remove ${project.hostname}`));
   } catch (error) {
-    console.error(chalk10.red(`Error: ${error instanceof Error ? error.message : error}`));
+    console.error(chalk11.red(`Error: ${error instanceof Error ? error.message : error}`));
     process.exit(1);
   }
 }
 
 // src/commands/apply.ts
-import chalk11 from "chalk";
-import { existsSync as existsSync6 } from "fs";
+import chalk12 from "chalk";
+import { existsSync as existsSync8 } from "fs";
 
 // src/lib/cloudflare.ts
 function isCloudflaredInstalled() {
@@ -1553,56 +1757,72 @@ async function applyCommand(options) {
   let config = readConfig();
   const defaults = getDefaults();
   if (options.sync) {
-    console.log(chalk11.dim("Syncing bindler.yaml from project directories...\n"));
+    console.log(chalk12.dim("Syncing bindler.yaml from project directories...\n"));
     let synced = 0;
     for (const project of config.projects) {
-      if (!existsSync6(project.path)) continue;
+      if (!existsSync8(project.path)) continue;
       const yamlConfig = readBindlerYaml(project.path);
       if (yamlConfig) {
         const merged = mergeYamlWithProject(project, yamlConfig);
         updateProject(project.name, merged);
-        console.log(chalk11.green(`  \u2713 Synced ${project.name} from bindler.yaml`));
+        console.log(chalk12.green(`  \u2713 Synced ${project.name} from bindler.yaml`));
         synced++;
       }
     }
     if (synced === 0) {
-      console.log(chalk11.dim("  No bindler.yaml files found in project directories"));
+      console.log(chalk12.dim("  No bindler.yaml files found in project directories"));
     } else {
-      console.log(chalk11.dim(`
+      console.log(chalk12.dim(`
   Synced ${synced} project(s)
 `));
     }
     config = readConfig();
   }
   if (options.env) {
-    console.log(chalk11.dim(`Using ${options.env} environment configuration...
+    console.log(chalk12.dim(`Using ${options.env} environment configuration...
 `));
     const envProjects = listProjectsForEnv(options.env);
     config = { ...config, projects: envProjects };
   }
   if (config.projects.length === 0) {
-    console.log(chalk11.yellow("No projects registered. Nothing to apply."));
+    console.log(chalk12.yellow("No projects registered. Nothing to apply."));
     return;
   }
-  console.log(chalk11.blue("Applying configuration...\n"));
-  console.log(chalk11.dim("Generating nginx configuration..."));
+  console.log(chalk12.blue("Applying configuration...\n"));
+  if (!options.skipChecks) {
+    console.log(chalk12.dim("Running preflight checks..."));
+    const checkResult = runPreflightChecks(config);
+    if (!checkResult.valid) {
+      printValidationResult(checkResult);
+      console.log(chalk12.red("\n\u2717 Preflight checks failed. Fix the errors above before applying."));
+      console.log(chalk12.dim("  Use --skip-checks to bypass (not recommended)"));
+      process.exit(1);
+    }
+    if (checkResult.warnings.length > 0) {
+      printValidationResult(checkResult);
+      console.log("");
+    } else {
+      console.log(chalk12.green("  \u2713 Preflight checks passed"));
+    }
+  }
+  console.log(chalk12.dim("Generating nginx configuration..."));
   if (options.dryRun) {
     const nginxConfig = generateNginxConfig(config);
-    console.log(chalk11.cyan("\n--- Generated nginx config (dry-run) ---\n"));
+    console.log(chalk12.cyan("\n--- Generated nginx config (dry-run) ---\n"));
     console.log(nginxConfig);
-    console.log(chalk11.cyan("--- End of config ---\n"));
-    console.log(chalk11.yellow("Dry run mode - no changes were made."));
+    console.log(chalk12.cyan("--- End of config ---\n"));
+    console.log(chalk12.yellow("Dry run mode - no changes were made."));
     return;
   }
   try {
     const { path, content } = writeNginxConfig(config);
-    console.log(chalk11.green(`  \u2713 Wrote nginx config to ${path}`));
+    console.log(chalk12.green(`  \u2713 Wrote nginx config to ${path}`));
   } catch (error) {
     const errMsg = error instanceof Error ? error.message : String(error);
-    console.error(chalk11.red(`  \u2717 Failed to write nginx config: ${errMsg}`));
+    console.error(chalk12.red(`  \u2717 Failed to write nginx config: ${errMsg}`));
     if (errMsg.includes("EACCES") || errMsg.includes("permission denied")) {
-      console.log(chalk11.yellow(`
-Try running with sudo: ${chalk11.cyan("sudo bindler apply")}`));
+      console.log(chalk12.yellow(`
+Try running with sudo: ${chalk12.cyan("sudo bindler apply")}`));
     }
     process.exit(1);
   }
@@ -1610,106 +1830,106 @@ Try running with sudo: ${chalk11.cyan("sudo bindler apply")}`));
     (p) => p.security?.basicAuth?.enabled && p.security.basicAuth.users?.length
   );
   if (authProjects.length > 0) {
-    console.log(chalk11.dim("Generating htpasswd files..."));
+    console.log(chalk12.dim("Generating htpasswd files..."));
     try {
       generateHtpasswdFiles(config.projects);
-      console.log(chalk11.green(`  \u2713 Generated htpasswd files for ${authProjects.length} project(s)`));
+      console.log(chalk12.green(`  \u2713 Generated htpasswd files for ${authProjects.length} project(s)`));
     } catch (error) {
-      console.log(chalk11.yellow(`  ! Failed to generate htpasswd files: ${error}`));
+      console.log(chalk12.yellow(`  ! Failed to generate htpasswd files: ${error}`));
     }
   }
-  console.log(chalk11.dim("Testing nginx configuration..."));
+  console.log(chalk12.dim("Testing nginx configuration..."));
   const testResult = testNginxConfig();
   if (!testResult.success) {
-    console.error(chalk11.red("  \u2717 Nginx configuration test failed:"));
-    console.error(chalk11.red(testResult.output));
-    console.log(chalk11.yellow("\nConfiguration was written but nginx was NOT reloaded."));
-    console.log(chalk11.dim("Fix the configuration and run `sudo bindler apply` again."));
+    console.error(chalk12.red("  \u2717 Nginx configuration test failed:"));
+    console.error(chalk12.red(testResult.output));
+    console.log(chalk12.yellow("\nConfiguration was written but nginx was NOT reloaded."));
+    console.log(chalk12.dim("Fix the configuration and run `sudo bindler apply` again."));
     process.exit(1);
   }
-  console.log(chalk11.green("  \u2713 Nginx configuration test passed"));
+  console.log(chalk12.green("  \u2713 Nginx configuration test passed"));
   if (!options.noReload) {
-    console.log(chalk11.dim("Reloading nginx..."));
+    console.log(chalk12.dim("Reloading nginx..."));
     const reloadResult = reloadNginx();
     if (!reloadResult.success) {
-      console.error(chalk11.red(`  \u2717 Failed to reload nginx: ${reloadResult.error}`));
-      console.log(chalk11.dim("You may need to reload nginx manually: sudo systemctl reload nginx"));
+      console.error(chalk12.red(`  \u2717 Failed to reload nginx: ${reloadResult.error}`));
+      console.log(chalk12.dim("You may need to reload nginx manually: sudo systemctl reload nginx"));
       process.exit(1);
     }
-    console.log(chalk11.green("  \u2713 Nginx reloaded successfully"));
+    console.log(chalk12.green("  \u2713 Nginx reloaded successfully"));
   } else {
-    console.log(chalk11.yellow("  - Skipped nginx reload (--no-reload)"));
+    console.log(chalk12.yellow("  - Skipped nginx reload (--no-reload)"));
   }
   const isDirectMode = defaults.mode === "direct";
   if (isDirectMode) {
-    console.log(chalk11.dim("\n  - Direct mode: skipping Cloudflare DNS routes"));
+    console.log(chalk12.dim("\n  - Direct mode: skipping Cloudflare DNS routes"));
   } else if (!options.noCloudflare && defaults.applyCloudflareDnsRoutes) {
-    console.log(chalk11.dim("\nConfiguring Cloudflare DNS routes..."));
+    console.log(chalk12.dim("\nConfiguring Cloudflare DNS routes..."));
     if (!isCloudflaredInstalled()) {
-      console.log(chalk11.yellow("  - cloudflared not installed, skipping DNS routes"));
+      console.log(chalk12.yellow("  - cloudflared not installed, skipping DNS routes"));
     } else {
       const dnsResults = routeDnsForAllProjects();
       if (dnsResults.length === 0) {
-        console.log(chalk11.dim("  No hostnames to route"));
+        console.log(chalk12.dim("  No hostnames to route"));
       } else {
         for (const result of dnsResults) {
           if (result.skipped) {
-            console.log(chalk11.dim(`  - ${result.hostname} (local - skipped)`));
+            console.log(chalk12.dim(`  - ${result.hostname} (local - skipped)`));
           } else if (result.success) {
             const msg = result.output?.includes("already exists") ? "exists" : "routed";
-            console.log(chalk11.green(`  \u2713 ${result.hostname} (${msg})`));
+            console.log(chalk12.green(`  \u2713 ${result.hostname} (${msg})`));
           } else {
-            console.log(chalk11.red(`  \u2717 ${result.hostname}: ${result.error}`));
+            console.log(chalk12.red(`  \u2717 ${result.hostname}: ${result.error}`));
           }
         }
       }
     }
   } else if (options.noCloudflare) {
-    console.log(chalk11.dim("\n  - Skipped Cloudflare DNS routes (--no-cloudflare)"));
+    console.log(chalk12.dim("\n  - Skipped Cloudflare DNS routes (--no-cloudflare)"));
   }
   if (isDirectMode && defaults.sslEnabled && options.ssl !== false) {
-    console.log(chalk11.dim("\nSetting up SSL certificates..."));
+    console.log(chalk12.dim("\nSetting up SSL certificates..."));
     const hostnames = config.projects.filter((p) => p.enabled !== false && !p.local).map((p) => p.hostname);
     if (hostnames.length === 0) {
-      console.log(chalk11.dim("  No hostnames to secure"));
+      console.log(chalk12.dim("  No hostnames to secure"));
     } else {
       const certbotResult = execCommandSafe("which certbot");
       if (!certbotResult.success) {
-        console.log(chalk11.yellow("  - certbot not installed, skipping SSL"));
-        console.log(chalk11.dim("    Run: bindler setup --direct"));
+        console.log(chalk12.yellow("  - certbot not installed, skipping SSL"));
+        console.log(chalk12.dim("    Run: bindler setup --direct"));
       } else {
         for (const hostname of hostnames) {
-          console.log(chalk11.dim(`  Requesting certificate for ${hostname}...`));
+          console.log(chalk12.dim(`  Requesting certificate for ${hostname}...`));
           const email = defaults.sslEmail || "admin@" + hostname.split(".").slice(-2).join(".");
           const result = execCommandSafe(
             `sudo certbot --nginx -d ${hostname} --non-interactive --agree-tos --email ${email} 2>&1`
           );
           if (result.success || result.output?.includes("Certificate not yet due for renewal")) {
-            console.log(chalk11.green(`  \u2713 ${hostname} (secured)`));
+            console.log(chalk12.green(`  \u2713 ${hostname} (secured)`));
           } else if (result.output?.includes("already exists")) {
-            console.log(chalk11.green(`  \u2713 ${hostname} (exists)`));
+            console.log(chalk12.green(`  \u2713 ${hostname} (exists)`));
           } else {
-            console.log(chalk11.yellow(`  ! ${hostname}: ${result.error || "failed"}`));
-            console.log(chalk11.dim("    Run manually: sudo certbot --nginx -d " + hostname));
+            console.log(chalk12.yellow(`  ! ${hostname}: ${result.error || "failed"}`));
+            console.log(chalk12.dim("    Run manually: sudo certbot --nginx -d " + hostname));
           }
         }
       }
     }
   }
-  console.log(chalk11.green("\n\u2713 Configuration applied successfully!"));
-  console.log(chalk11.dim(`
+  console.log(chalk12.green("\n\u2713 Configuration applied successfully!"));
+  console.log(chalk12.dim(`
 ${config.projects.length} project(s) configured:`));
   for (const project of config.projects) {
-    const status = project.enabled !== false ? chalk11.green("enabled") : chalk11.yellow("disabled");
-    console.log(chalk11.dim(`  - ${project.name} \u2192 ${project.hostname} (${status})`));
+    const status = project.enabled !== false ? chalk12.green("enabled") : chalk12.yellow("disabled");
+    console.log(chalk12.dim(`  - ${project.name} \u2192 ${project.hostname} (${status})`));
   }
 }
 
 // src/commands/doctor.ts
-import chalk12 from "chalk";
-import { existsSync as existsSync7 } from "fs";
+import chalk13 from "chalk";
+import { existsSync as existsSync9 } from "fs";
 async function doctorCommand() {
-  console.log(chalk12.blue("Running diagnostics...\n"));
+  console.log(chalk13.blue("Running diagnostics...\n"));
   const checks = [];
   const nodeVersion = process.version;
   const nodeMajor = parseInt(nodeVersion.slice(1).split(".")[0], 10);
@@ -1845,7 +2065,7 @@ async function doctorCommand() {
       }
     }
     const defaults = getDefaults();
-    if (existsSync7(defaults.nginxManagedPath)) {
+    if (existsSync9(defaults.nginxManagedPath)) {
       checks.push({
         name: "Nginx config file",
         status: "ok",
@@ -1859,7 +2079,7 @@ async function doctorCommand() {
         fix: "Run: sudo bindler apply"
       });
     }
-    if (existsSync7(defaults.projectsRoot)) {
+    if (existsSync9(defaults.projectsRoot)) {
       checks.push({
         name: "Projects root",
         status: "ok",
@@ -1870,7 +2090,67 @@ async function doctorCommand() {
         name: "Projects root",
         status: "warning",
         message: `Not found at ${defaults.projectsRoot}`,
-        fix: `Create directory: sudo mkdir -p ${defaults.projectsRoot}`
+        fix: `Create directory: mkdir -p ${defaults.projectsRoot}`
+      });
+    }
+    const validation = validateConfig(config);
+    if (validation.errors.length > 0) {
+      for (const error of validation.errors) {
+        checks.push({
+          name: "Project validation",
+          status: "error",
+          message: error
+        });
+      }
+    }
+    if (validation.warnings.length > 0) {
+      for (const warning of validation.warnings) {
+        checks.push({
+          name: "Project validation",
+          status: "warning",
+          message: warning
+        });
+      }
+    }
+    if (validation.valid && validation.warnings.length === 0) {
+      checks.push({
+        name: "Project validation",
+        status: "ok",
+        message: "All projects validated successfully"
+      });
+    }
+    const localProjects = config.projects.filter((p) => p.local && p.enabled !== false);
+    if (localProjects.length > 0) {
+      const hostsResult = execCommandSafe("cat /etc/hosts");
+      if (hostsResult.success) {
+        const missingHosts = localProjects.filter(
+          (p) => !hostsResult.output.includes(p.hostname)
+        );
+        if (missingHosts.length > 0) {
+          for (const p of missingHosts) {
+            checks.push({
+              name: "Hosts file",
+              status: "warning",
+              message: `Missing entry for ${p.hostname}`,
+              fix: `echo "127.0.0.1  ${p.hostname}" | sudo tee -a /etc/hosts`
+            });
+          }
+        } else {
+          checks.push({
+            name: "Hosts file",
+            status: "ok",
+            message: `All ${localProjects.length} local hostname(s) configured`
+          });
+        }
+      }
+    }
+    const listenPort = parseInt(defaults.nginxListen.split(":").pop() || "80", 10);
+    if (listenPort <= 1024 && process.getuid && process.getuid() !== 0) {
+      checks.push({
+        name: "Nginx port",
+        status: "warning",
+        message: `Port ${listenPort} requires root privileges`,
+        fix: "Run: sudo bindler apply (or change nginxListen to a port > 1024)"
       });
     }
   } else {
@@ -1889,47 +2169,47 @@ async function doctorCommand() {
     switch (check.status) {
       case "ok":
         icon = "\u2713";
-        color = chalk12.green;
+        color = chalk13.green;
         break;
       case "warning":
         icon = "!";
-        color = chalk12.yellow;
+        color = chalk13.yellow;
         hasWarnings = true;
         break;
       case "error":
         icon = "\u2717";
-        color = chalk12.red;
+        color = chalk13.red;
         hasErrors = true;
         break;
     }
-    console.log(`${color(icon)} ${chalk12.bold(check.name)}: ${check.message}`);
+    console.log(`${color(icon)} ${chalk13.bold(check.name)}: ${check.message}`);
     if (check.fix) {
-      console.log(chalk12.dim(`  Fix: ${check.fix}`));
+      console.log(chalk13.dim(`  Fix: ${check.fix}`));
     }
   }
   console.log("");
   if (hasErrors) {
-    console.log(chalk12.red("Some checks failed. Please fix the issues above."));
+    console.log(chalk13.red("Some checks failed. Please fix the issues above."));
     process.exit(1);
   } else if (hasWarnings) {
-    console.log(chalk12.yellow("Some warnings detected. Review the suggestions above."));
+    console.log(chalk13.yellow("Some warnings detected. Review the suggestions above."));
   } else {
-    console.log(chalk12.green("All checks passed!"));
+    console.log(chalk13.green("All checks passed!"));
   }
 }
 
 // src/commands/ports.ts
-import chalk13 from "chalk";
+import chalk14 from "chalk";
 import Table3 from "cli-table3";
 async function portsCommand() {
   const ports = getPortsTable();
   if (ports.length === 0) {
-    console.log(chalk13.yellow("No ports allocated."));
-    console.log(chalk13.dim("npm projects will have ports allocated when created."));
+    console.log(chalk14.yellow("No ports allocated."));
+    console.log(chalk14.dim("npm projects will have ports allocated when created."));
     return;
   }
   const table = new Table3({
-    head: [chalk13.cyan("Port"), chalk13.cyan("Project"), chalk13.cyan("Hostname")],
+    head: [chalk14.cyan("Port"), chalk14.cyan("Project"), chalk14.cyan("Hostname")],
     style: {
       head: [],
       border: []
@@ -1939,25 +2219,25 @@ async function portsCommand() {
     table.push([String(entry.port), entry.project, entry.hostname]);
   }
   console.log(table.toString());
-  console.log(chalk13.dim(`
+  console.log(chalk14.dim(`
 ${ports.length} port(s) allocated`));
 }
 
 // src/commands/info.ts
-import chalk14 from "chalk";
+import chalk15 from "chalk";
 async function infoCommand() {
-  console.log(chalk14.bold.cyan(String.raw`
+  console.log(chalk15.bold.cyan(String.raw`
    _   _       _ _
   | |_|_|___ _| | |___ ___
   | . | |   | . | | -_|  _|
   |___|_|_|_|___|_|___|_|
   `));
-  console.log(chalk14.white("  Manage multiple projects behind Cloudflare Tunnel"));
-  console.log(chalk14.white("  with Nginx and PM2\n"));
-  console.log(chalk14.dim("  Version:  ") + chalk14.white("1.2.0"));
-  console.log(chalk14.dim("  Author:   ") + chalk14.white("alfaoz"));
-  console.log(chalk14.dim("  License:  ") + chalk14.white("MIT"));
-  console.log(chalk14.dim("  GitHub:   ") + chalk14.cyan("https://github.com/alfaoz/bindler"));
+  console.log(chalk15.white("  Manage multiple projects behind Cloudflare Tunnel"));
+  console.log(chalk15.white("  with Nginx and PM2\n"));
+  console.log(chalk15.dim("  Version:  ") + chalk15.white("1.3.0"));
+  console.log(chalk15.dim("  Author:   ") + chalk15.white("alfaoz"));
+  console.log(chalk15.dim("  License:  ") + chalk15.white("MIT"));
+  console.log(chalk15.dim("  GitHub:   ") + chalk15.cyan("https://github.com/alfaoz/bindler"));
   console.log("");
   if (configExists()) {
     const config = readConfig();
@@ -1965,23 +2245,23 @@ async function infoCommand() {
     const runningCount = pm2Processes.filter((p) => p.status === "online").length;
     const npmProjects = config.projects.filter((p) => p.type === "npm").length;
     const staticProjects = config.projects.filter((p) => p.type === "static").length;
-    console.log(chalk14.dim("  Config:   ") + chalk14.white(getConfigPath()));
-    console.log(chalk14.dim("  Nginx:    ") + chalk14.white(config.defaults.nginxManagedPath));
-    console.log(chalk14.dim("  Tunnel:   ") + chalk14.white(config.defaults.tunnelName));
+    console.log(chalk15.dim("  Config:   ") + chalk15.white(getConfigPath()));
+    console.log(chalk15.dim("  Nginx:    ") + chalk15.white(config.defaults.nginxManagedPath));
+    console.log(chalk15.dim("  Tunnel:   ") + chalk15.white(config.defaults.tunnelName));
     console.log("");
-    console.log(chalk14.dim("  Projects: ") + chalk14.white(`${config.projects.length} total (${staticProjects} static, ${npmProjects} npm)`));
+    console.log(chalk15.dim("  Projects: ") + chalk15.white(`${config.projects.length} total (${staticProjects} static, ${npmProjects} npm)`));
     if (npmProjects > 0) {
-      console.log(chalk14.dim("  Running:  ") + chalk14.green(`${runningCount}/${npmProjects} npm apps online`));
+      console.log(chalk15.dim("  Running:  ") + chalk15.green(`${runningCount}/${npmProjects} npm apps online`));
     }
   } else {
-    console.log(chalk14.dim("  Config:   ") + chalk14.yellow("Not initialized"));
-    console.log(chalk14.dim("            ") + chalk14.dim("Run `bindler new` to get started"));
+    console.log(chalk15.dim("  Config:   ") + chalk15.yellow("Not initialized"));
+    console.log(chalk15.dim("            ") + chalk15.dim("Run `bindler new` to get started"));
   }
   console.log("");
 }
 
 // src/commands/check.ts
-import chalk15 from "chalk";
+import chalk16 from "chalk";
 import { resolve4, resolve6, resolveCname } from "dns/promises";
 async function checkDns(hostname) {
   const result = {
@@ -2042,111 +2322,111 @@ async function checkCommand(hostnameOrName, options) {
   const hostname = project ? project.hostname : hostnameOrName;
   const basePath = project?.basePath || "/";
   const isLocal = project?.local || hostname.endsWith(".local") || hostname.endsWith(".localhost");
-  console.log(chalk15.blue(`
+  console.log(chalk16.blue(`
 Checking ${hostname}...
 `));
-  console.log(chalk15.bold("DNS Resolution:"));
+  console.log(chalk16.bold("DNS Resolution:"));
   const dns = await checkDns(hostname);
   if (!dns.resolved) {
-    console.log(chalk15.red("  \u2717 DNS not resolving"));
+    console.log(chalk16.red("  \u2717 DNS not resolving"));
     if (isLocal) {
-      console.log(chalk15.dim("    Local hostname - add to /etc/hosts:"));
-      console.log(chalk15.cyan(`    echo "127.0.0.1  ${hostname}" | sudo tee -a /etc/hosts`));
+      console.log(chalk16.dim("    Local hostname - add to /etc/hosts:"));
+      console.log(chalk16.cyan(`    echo "127.0.0.1  ${hostname}" | sudo tee -a /etc/hosts`));
     } else {
-      console.log(chalk15.dim("    No DNS records found for this hostname."));
-      console.log(chalk15.dim("    If using Cloudflare Tunnel, run: bindler apply"));
-      console.log(chalk15.dim("    If using direct mode, add an A record pointing to your server IP."));
+      console.log(chalk16.dim("    No DNS records found for this hostname."));
+      console.log(chalk16.dim("    If using Cloudflare Tunnel, run: bindler apply"));
+      console.log(chalk16.dim("    If using direct mode, add an A record pointing to your server IP."));
     }
     console.log("");
     return;
   }
   if (dns.cname.length > 0) {
-    console.log(chalk15.green("  \u2713 CNAME: ") + dns.cname.join(", "));
+    console.log(chalk16.green("  \u2713 CNAME: ") + dns.cname.join(", "));
     if (dns.isCloudflare) {
-      console.log(chalk15.green("  \u2713 Points to Cloudflare Tunnel"));
+      console.log(chalk16.green("  \u2713 Points to Cloudflare Tunnel"));
     }
   }
   if (dns.ipv4.length > 0) {
-    console.log(chalk15.green("  \u2713 A (IPv4): ") + dns.ipv4.join(", "));
+    console.log(chalk16.green("  \u2713 A (IPv4): ") + dns.ipv4.join(", "));
   }
   if (dns.ipv6.length > 0) {
-    console.log(chalk15.green("  \u2713 AAAA (IPv6): ") + dns.ipv6.join(", "));
+    console.log(chalk16.green("  \u2713 AAAA (IPv6): ") + dns.ipv6.join(", "));
   }
   console.log("");
-  console.log(chalk15.bold("HTTP Check:"));
+  console.log(chalk16.bold("HTTP Check:"));
   const http = await checkHttp(hostname, basePath);
   if (!http.reachable) {
-    console.log(chalk15.red("  \u2717 Not reachable"));
+    console.log(chalk16.red("  \u2717 Not reachable"));
     const err = http.error || "";
     if (err.includes("ECONNREFUSED")) {
-      console.log(chalk15.dim("    Connection refused - server not accepting connections"));
-      console.log(chalk15.yellow("\n  Check:"));
-      console.log(chalk15.dim("    - Is nginx running? Run: bindler doctor"));
+      console.log(chalk16.dim("    Connection refused - server not accepting connections"));
+      console.log(chalk16.yellow("\n  Check:"));
+      console.log(chalk16.dim("    - Is nginx running? Run: bindler doctor"));
       if (project?.type === "npm") {
-        console.log(chalk15.dim(`    - Is the app running? Run: bindler start ${project.name}`));
+        console.log(chalk16.dim(`    - Is the app running? Run: bindler start ${project.name}`));
       }
     } else if (err.includes("ENOTFOUND")) {
-      console.log(chalk15.dim("    Hostname not found"));
-      console.log(chalk15.yellow("\n  Check:"));
-      console.log(chalk15.dim("    - DNS may not be propagated yet (wait a few minutes)"));
-      console.log(chalk15.dim("    - Verify DNS records are correct"));
+      console.log(chalk16.dim("    Hostname not found"));
+      console.log(chalk16.yellow("\n  Check:"));
+      console.log(chalk16.dim("    - DNS may not be propagated yet (wait a few minutes)"));
+      console.log(chalk16.dim("    - Verify DNS records are correct"));
     } else if (err.includes("ETIMEDOUT") || err.includes("timeout")) {
-      console.log(chalk15.dim("    Connection timed out"));
-      console.log(chalk15.yellow("\n  Check:"));
+      console.log(chalk16.dim("    Connection timed out"));
+      console.log(chalk16.yellow("\n  Check:"));
       if (isLocal) {
-        console.log(chalk15.dim("    - Is nginx running on port 8080?"));
+        console.log(chalk16.dim("    - Is nginx running on port 8080?"));
       } else {
-        console.log(chalk15.dim("    - Is your server/tunnel reachable from the internet?"));
-        console.log(chalk15.dim("    - Check firewall rules"));
+        console.log(chalk16.dim("    - Is your server/tunnel reachable from the internet?"));
+        console.log(chalk16.dim("    - Check firewall rules"));
       }
     } else if (err.includes("CERT") || err.includes("SSL") || err.includes("certificate")) {
-      console.log(chalk15.dim("    SSL/TLS certificate error"));
-      console.log(chalk15.yellow("\n  Check:"));
-      console.log(chalk15.dim("    - Run: sudo bindler apply (to refresh SSL certs)"));
-      console.log(chalk15.dim("    - Or check certbot: sudo certbot certificates"));
+      console.log(chalk16.dim("    SSL/TLS certificate error"));
+      console.log(chalk16.yellow("\n  Check:"));
+      console.log(chalk16.dim("    - Run: sudo bindler apply (to refresh SSL certs)"));
+      console.log(chalk16.dim("    - Or check certbot: sudo certbot certificates"));
     } else {
-      console.log(chalk15.dim(`    Error: ${err}`));
-      console.log(chalk15.yellow("\n  Possible issues:"));
+      console.log(chalk16.dim(`    Error: ${err}`));
+      console.log(chalk16.yellow("\n  Possible issues:"));
       if (!isLocal) {
-        console.log(chalk15.dim("    - Cloudflare tunnel not running"));
+        console.log(chalk16.dim("    - Cloudflare tunnel not running"));
       }
-      console.log(chalk15.dim("    - Nginx not running or misconfigured"));
+      console.log(chalk16.dim("    - Nginx not running or misconfigured"));
       if (project?.type === "npm") {
-        console.log(chalk15.dim("    - Project not started"));
+        console.log(chalk16.dim("    - Project not started"));
       }
     }
     console.log("");
     return;
   }
-  const statusColor = http.statusCode < 400 ? chalk15.green : chalk15.red;
+  const statusColor = http.statusCode < 400 ? chalk16.green : chalk16.red;
   console.log(statusColor(`  \u2713 Status: ${http.statusCode}`));
-  console.log(chalk15.dim(`  Response time: ${http.responseTime}ms`));
+  console.log(chalk16.dim(`  Response time: ${http.responseTime}ms`));
   if (http.redirectUrl) {
-    console.log(chalk15.dim(`  Redirects to: ${http.redirectUrl}`));
+    console.log(chalk16.dim(`  Redirects to: ${http.redirectUrl}`));
   }
   console.log("");
   if (dns.resolved && http.reachable && http.statusCode < 400) {
-    console.log(chalk15.green("\u2713 All checks passed! Site is accessible."));
+    console.log(chalk16.green("\u2713 All checks passed! Site is accessible."));
   } else if (dns.resolved && http.reachable) {
-    console.log(chalk15.yellow("! Site is reachable but returned an error status."));
+    console.log(chalk16.yellow("! Site is reachable but returned an error status."));
   } else {
-    console.log(chalk15.red("\u2717 Some checks failed. See details above."));
+    console.log(chalk16.red("\u2717 Some checks failed. See details above."));
   }
   if (project) {
-    console.log(chalk15.dim(`
+    console.log(chalk16.dim(`
 Project: ${project.name} (${project.type})`));
     if (project.type === "npm") {
-      console.log(chalk15.dim(`Port: ${project.port}`));
+      console.log(chalk16.dim(`Port: ${project.port}`));
     }
   }
   console.log("");
 }
 
 // src/commands/setup.ts
-import chalk16 from "chalk";
+import chalk17 from "chalk";
 import inquirer3 from "inquirer";
 import { execSync as execSync2 } from "child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync5 } from "fs";
 function detectOs() {
   const platform = process.platform;
   if (platform === "darwin") {
@@ -2157,7 +2437,7 @@ function detectOs() {
   }
   if (platform === "linux") {
     try {
-      if (existsSync8("/etc/os-release")) {
+      if (existsSync10("/etc/os-release")) {
         const osRelease = readFileSync5("/etc/os-release", "utf-8");
         const lines = osRelease.split("\n");
         const info = {};
@@ -2174,7 +2454,7 @@ function detectOs() {
         if (["ubuntu", "debian", "pop", "mint", "elementary"].includes(distro)) {
           packageManager = "apt";
         } else if (["fedora", "rhel", "centos", "rocky", "alma"].includes(distro)) {
-          packageManager = existsSync8("/usr/bin/dnf") ? "dnf" : "yum";
+          packageManager = existsSync10("/usr/bin/dnf") ? "dnf" : "yum";
         } else if (["amzn"].includes(distro)) {
           packageManager = "yum";
         }
@@ -2187,7 +2467,7 @@ function detectOs() {
   return { platform: "unknown" };
 }
 function runCommand(command, description) {
-  console.log(chalk16.dim(`  \u2192 ${description}...`));
+  console.log(chalk17.dim(`  \u2192 ${description}...`));
   try {
     execSync2(command, { stdio: "inherit" });
     return true;
@@ -2196,7 +2476,7 @@ function runCommand(command, description) {
   }
 }
 async function installNginx(os) {
-  console.log(chalk16.blue("\nInstalling nginx...\n"));
+  console.log(chalk17.blue("\nInstalling nginx...\n"));
   if (os.platform === "darwin") {
     return runCommand("brew install nginx", "Installing via Homebrew");
   }
@@ -2207,16 +2487,16 @@ async function installNginx(os) {
   if (os.platform === "linux" && (os.packageManager === "yum" || os.packageManager === "dnf")) {
     return runCommand(`sudo ${os.packageManager} install -y nginx`, "Installing nginx");
   }
-  console.log(chalk16.yellow("  Automatic installation not supported for your OS."));
-  console.log(chalk16.dim("  Please install nginx manually."));
+  console.log(chalk17.yellow("  Automatic installation not supported for your OS."));
+  console.log(chalk17.dim("  Please install nginx manually."));
   return false;
 }
 async function installPm2() {
-  console.log(chalk16.blue("\nInstalling PM2...\n"));
+  console.log(chalk17.blue("\nInstalling PM2...\n"));
   return runCommand("npm install -g pm2", "Installing via npm");
 }
 async function installCertbot(os) {
-  console.log(chalk16.blue("\nInstalling certbot (Let's Encrypt)...\n"));
+  console.log(chalk17.blue("\nInstalling certbot (Let's Encrypt)...\n"));
   if (os.platform === "darwin") {
     return runCommand("brew install certbot", "Installing via Homebrew");
   }
@@ -2227,8 +2507,8 @@ async function installCertbot(os) {
   if (os.platform === "linux" && (os.packageManager === "yum" || os.packageManager === "dnf")) {
     return runCommand(`sudo ${os.packageManager} install -y certbot python3-certbot-nginx`, "Installing certbot");
   }
-  console.log(chalk16.yellow("  Automatic installation not supported for your OS."));
-  console.log(chalk16.dim("  Please install certbot manually."));
+  console.log(chalk17.yellow("  Automatic installation not supported for your OS."));
+  console.log(chalk17.dim("  Please install certbot manually."));
   return false;
 }
 function isCertbotInstalled() {
@@ -2236,7 +2516,7 @@ function isCertbotInstalled() {
   return result.success;
 }
 async function installCloudflared(os) {
-  console.log(chalk16.blue("\nInstalling cloudflared...\n"));
+  console.log(chalk17.blue("\nInstalling cloudflared...\n"));
   if (os.platform === "darwin") {
     return runCommand("brew install cloudflared", "Installing via Homebrew");
   }
@@ -2270,21 +2550,21 @@ async function installCloudflared(os) {
     );
     return runCommand(`sudo ${os.packageManager} install -y cloudflared`, "Installing cloudflared");
   }
-  console.log(chalk16.yellow("  Automatic installation not supported for your OS."));
-  console.log(chalk16.dim("  Visit: https://pkg.cloudflare.com/index.html"));
+  console.log(chalk17.yellow("  Automatic installation not supported for your OS."));
+  console.log(chalk17.dim("  Visit: https://pkg.cloudflare.com/index.html"));
   return false;
 }
 async function setupCommand(options = {}) {
-  console.log(chalk16.bold.cyan("\nBindler Setup\n"));
+  console.log(chalk17.bold.cyan("\nBindler Setup\n"));
   const os = detectOs();
-  console.log(chalk16.dim(`Detected: ${os.distro || os.platform}${os.version ? ` ${os.version}` : ""}${os.codename ? ` (${os.codename})` : ""}`));
+  console.log(chalk17.dim(`Detected: ${os.distro || os.platform}${os.version ? ` ${os.version}` : ""}${os.codename ? ` (${os.codename})` : ""}`));
   const isDirect = options.direct;
   if (isDirect) {
-    console.log(chalk16.cyan("\nDirect mode (VPS without Cloudflare Tunnel)"));
-    console.log(chalk16.dim("nginx will listen on port 80/443 directly\n"));
+    console.log(chalk17.cyan("\nDirect mode (VPS without Cloudflare Tunnel)"));
+    console.log(chalk17.dim("nginx will listen on port 80/443 directly\n"));
   } else {
-    console.log(chalk16.cyan("\nTunnel mode (via Cloudflare Tunnel)"));
-    console.log(chalk16.dim("nginx will listen on 127.0.0.1:8080\n"));
+    console.log(chalk17.cyan("\nTunnel mode (via Cloudflare Tunnel)"));
+    console.log(chalk17.dim("nginx will listen on 127.0.0.1:8080\n"));
   }
   const missing = [];
   if (!isNginxInstalled()) {
@@ -2303,11 +2583,11 @@ async function setupCommand(options = {}) {
     }
   }
   if (missing.length === 0) {
-    console.log(chalk16.green("\u2713 All dependencies are already installed!\n"));
+    console.log(chalk17.green("\u2713 All dependencies are already installed!\n"));
   } else {
-    console.log(chalk16.yellow("Missing dependencies:\n"));
+    console.log(chalk17.yellow("Missing dependencies:\n"));
     for (const dep of missing) {
-      console.log(chalk16.red(`  \u2717 ${dep.name}`));
+      console.log(chalk17.red(`  \u2717 ${dep.name}`));
     }
     console.log("");
     const { toInstall } = await inquirer3.prompt([
@@ -2331,12 +2611,12 @@ async function setupCommand(options = {}) {
           results.push({ name: depName, success });
         }
       }
-      console.log(chalk16.bold("\n\nInstallation Summary:\n"));
+      console.log(chalk17.bold("\n\nInstallation Summary:\n"));
       for (const result of results) {
         if (result.success) {
-          console.log(chalk16.green(`  \u2713 ${result.name} installed`));
+          console.log(chalk17.green(`  \u2713 ${result.name} installed`));
         } else {
-          console.log(chalk16.red(`  \u2717 ${result.name} failed`));
+          console.log(chalk17.red(`  \u2717 ${result.name} failed`));
         }
       }
       console.log("");
@@ -2378,32 +2658,32 @@ async function setupCommand(options = {}) {
     config.defaults.applyCloudflareDnsRoutes = true;
   }
   writeConfig(config);
-  console.log(chalk16.green("\n\u2713 Setup complete!\n"));
-  console.log(chalk16.dim(`Mode: ${config.defaults.mode}`));
-  console.log(chalk16.dim(`nginx listen: ${config.defaults.nginxListen}`));
+  console.log(chalk17.green("\n\u2713 Setup complete!\n"));
+  console.log(chalk17.dim(`Mode: ${config.defaults.mode}`));
+  console.log(chalk17.dim(`nginx listen: ${config.defaults.nginxListen}`));
   if (config.defaults.sslEnabled) {
-    console.log(chalk16.dim(`SSL: enabled (${config.defaults.sslEmail})`));
+    console.log(chalk17.dim(`SSL: enabled (${config.defaults.sslEmail})`));
   }
-  console.log(chalk16.dim("\nRun `bindler new` to create your first project."));
+  console.log(chalk17.dim("\nRun `bindler new` to create your first project."));
 }
 
 // src/commands/init.ts
-import chalk17 from "chalk";
+import chalk18 from "chalk";
 import inquirer4 from "inquirer";
 async function initCommand() {
-  console.log(chalk17.bold.cyan(`
+  console.log(chalk18.bold.cyan(`
    _   _       _ _
   | |_|_|___ _| | |___ ___
   | . | |   | . | | -_|  _|
   |___|_|_|_|___|_|___|_|
   `));
-  console.log(chalk17.white("  Welcome to bindler!\n"));
+  console.log(chalk18.white("  Welcome to bindler!\n"));
   if (configExists()) {
     const config2 = readConfig();
-    console.log(chalk17.yellow("Bindler is already initialized."));
-    console.log(chalk17.dim(`  Config: ~/.config/bindler/config.json`));
-    console.log(chalk17.dim(`  Mode: ${config2.defaults.mode || "tunnel"}`));
-    console.log(chalk17.dim(`  Projects: ${config2.projects.length}`));
+    console.log(chalk18.yellow("Bindler is already initialized."));
+    console.log(chalk18.dim(`  Config: ~/.config/bindler/config.json`));
+    console.log(chalk18.dim(`  Mode: ${config2.defaults.mode || "tunnel"}`));
+    console.log(chalk18.dim(`  Projects: ${config2.projects.length}`));
     console.log("");
     const { reinit } = await inquirer4.prompt([
       {
@@ -2414,11 +2694,11 @@ async function initCommand() {
       }
     ]);
     if (!reinit) {
-      console.log(chalk17.dim("\nRun `bindler new` to add a project."));
+      console.log(chalk18.dim("\nRun `bindler new` to add a project."));
       return;
     }
   }
-  console.log(chalk17.bold("\n1. Choose your setup:\n"));
+  console.log(chalk18.bold("\n1. Choose your setup:\n"));
   const { mode } = await inquirer4.prompt([
     {
       type: "list",
@@ -2440,19 +2720,19 @@ async function initCommand() {
       ]
     }
   ]);
-  console.log(chalk17.bold("\n2. Checking dependencies...\n"));
+  console.log(chalk18.bold("\n2. Checking dependencies...\n"));
   const deps = {
     nginx: isNginxInstalled(),
     pm2: isPm2Installed(),
     cloudflared: isCloudflaredInstalled()
   };
   const nginxRunning = deps.nginx && isNginxRunning();
-  console.log(deps.nginx ? chalk17.green("  \u2713 nginx") : chalk17.red("  \u2717 nginx"));
-  console.log(deps.pm2 ? chalk17.green("  \u2713 pm2") : chalk17.red("  \u2717 pm2"));
+  console.log(deps.nginx ? chalk18.green("  \u2713 nginx") : chalk18.red("  \u2717 nginx"));
+  console.log(deps.pm2 ? chalk18.green("  \u2713 pm2") : chalk18.red("  \u2717 pm2"));
   if (mode === "tunnel") {
-    console.log(deps.cloudflared ? chalk17.green("  \u2713 cloudflared") : chalk17.red("  \u2717 cloudflared"));
+    console.log(deps.cloudflared ? chalk18.green("  \u2713 cloudflared") : chalk18.red("  \u2717 cloudflared"));
   } else if (mode === "direct") {
-    console.log(chalk17.dim("  - cloudflared (not needed for direct mode)"));
+    console.log(chalk18.dim("  - cloudflared (not needed for direct mode)"));
   }
   const missingDeps = !deps.nginx || !deps.pm2 || mode === "tunnel" && !deps.cloudflared;
   if (missingDeps) {
@@ -2469,7 +2749,7 @@ async function initCommand() {
       await setupCommand({ direct: mode === "direct" });
     }
   }
-  console.log(chalk17.bold("\n3. Configuration:\n"));
+  console.log(chalk18.bold("\n3. Configuration:\n"));
   let tunnelName = "homelab";
   let sslEmail = "";
   if (mode === "tunnel") {
@@ -2521,29 +2801,29 @@ async function initCommand() {
     config.defaults.nginxListen = "127.0.0.1:8080";
   }
   writeConfig(config);
-  console.log(chalk17.green("\n\u2713 Bindler initialized!\n"));
-  console.log(chalk17.dim("  Mode:    ") + chalk17.white(mode));
-  console.log(chalk17.dim("  Listen:  ") + chalk17.white(config.defaults.nginxListen));
+  console.log(chalk18.green("\n\u2713 Bindler initialized!\n"));
+  console.log(chalk18.dim("  Mode:    ") + chalk18.white(mode));
+  console.log(chalk18.dim("  Listen:  ") + chalk18.white(config.defaults.nginxListen));
   if (mode === "tunnel") {
-    console.log(chalk17.dim("  Tunnel:  ") + chalk17.white(tunnelName));
+    console.log(chalk18.dim("  Tunnel:  ") + chalk18.white(tunnelName));
   }
   if (sslEmail) {
-    console.log(chalk17.dim("  SSL:     ") + chalk17.white(sslEmail));
+    console.log(chalk18.dim("  SSL:     ") + chalk18.white(sslEmail));
   }
-  console.log(chalk17.bold("\nNext steps:\n"));
-  console.log(chalk17.dim("  1. ") + chalk17.white("bindler new") + chalk17.dim("        # add your first project"));
-  console.log(chalk17.dim("  2. ") + chalk17.white("bindler apply") + chalk17.dim("      # apply nginx config"));
+  console.log(chalk18.bold("\nNext steps:\n"));
+  console.log(chalk18.dim("  1. ") + chalk18.white("bindler new") + chalk18.dim("        # add your first project"));
+  console.log(chalk18.dim("  2. ") + chalk18.white("bindler apply") + chalk18.dim("      # apply nginx config"));
   if (mode === "tunnel") {
-    console.log(chalk17.dim("  3. ") + chalk17.white(`cloudflared tunnel run ${tunnelName}`) + chalk17.dim("  # start tunnel"));
+    console.log(chalk18.dim("  3. ") + chalk18.white(`cloudflared tunnel run ${tunnelName}`) + chalk18.dim("  # start tunnel"));
   }
   console.log("");
 }
 
 // src/commands/deploy.ts
-import chalk18 from "chalk";
+import chalk19 from "chalk";
 import { execSync as execSync3 } from "child_process";
-import { existsSync as existsSync9 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync11 } from "fs";
+import { join as join7 } from "path";
 function runInDir(command, cwd) {
   try {
     const output = execSync3(command, { cwd, encoding: "utf-8", stdio: "pipe" });
@@ -2555,101 +2835,101 @@ function runInDir(command, cwd) {
 }
 async function deployCommand(name, options) {
   if (!name) {
-    console.log(chalk18.red("Usage: bindler deploy <name>"));
-    console.log(chalk18.dim("\nDeploys a project: git pull + npm install + restart"));
-    console.log(chalk18.dim("\nExamples:"));
-    console.log(chalk18.dim("  bindler deploy myapp"));
-    console.log(chalk18.dim("  bindler deploy myapp --skip-install"));
-    console.log(chalk18.dim("  bindler deploy myapp --skip-pull"));
+    console.log(chalk19.red("Usage: bindler deploy <name>"));
+    console.log(chalk19.dim("\nDeploys a project: git pull + npm install + restart"));
+    console.log(chalk19.dim("\nExamples:"));
+    console.log(chalk19.dim("  bindler deploy myapp"));
+    console.log(chalk19.dim("  bindler deploy myapp --skip-install"));
+    console.log(chalk19.dim("  bindler deploy myapp --skip-pull"));
     process.exit(1);
   }
   const project = getProject(name);
   if (!project) {
-    console.log(chalk18.red(`Project "${name}" not found.`));
-    console.log(chalk18.dim("\nAvailable projects:"));
+    console.log(chalk19.red(`Project "${name}" not found.`));
+    console.log(chalk19.dim("\nAvailable projects:"));
     const projects = listProjects();
     for (const p of projects) {
-      console.log(chalk18.dim(`  - ${p.name}`));
+      console.log(chalk19.dim(`  - ${p.name}`));
     }
     process.exit(1);
   }
-  if (!existsSync9(project.path)) {
-    console.log(chalk18.red(`Project path does not exist: ${project.path}`));
+  if (!existsSync11(project.path)) {
+    console.log(chalk19.red(`Project path does not exist: ${project.path}`));
     process.exit(1);
   }
-  console.log(chalk18.blue(`
+  console.log(chalk19.blue(`
 Deploying ${project.name}...
 `));
   if (!options.skipPull) {
-    const isGitRepo = existsSync9(join6(project.path, ".git"));
+    const isGitRepo = existsSync11(join7(project.path, ".git"));
     if (isGitRepo) {
-      console.log(chalk18.dim("Pulling latest changes..."));
+      console.log(chalk19.dim("Pulling latest changes..."));
       const result = runInDir("git pull", project.path);
       if (result.success) {
         if (result.output.includes("Already up to date")) {
-          console.log(chalk18.green("  \u2713 Already up to date"));
+          console.log(chalk19.green("  \u2713 Already up to date"));
         } else {
-          console.log(chalk18.green("  \u2713 Pulled latest changes"));
+          console.log(chalk19.green("  \u2713 Pulled latest changes"));
           if (result.output) {
-            console.log(chalk18.dim(`    ${result.output.split("\n")[0]}`));
+            console.log(chalk19.dim(`    ${result.output.split("\n")[0]}`));
           }
         }
       } else {
-        console.log(chalk18.yellow("  ! Git pull failed"));
-        console.log(chalk18.dim(`    ${result.output}`));
+        console.log(chalk19.yellow("  ! Git pull failed"));
+        console.log(chalk19.dim(`    ${result.output}`));
       }
     } else {
-      console.log(chalk18.dim("  - Not a git repository, skipping pull"));
+      console.log(chalk19.dim("  - Not a git repository, skipping pull"));
     }
   } else {
-    console.log(chalk18.dim("  - Skipped git pull (--skip-pull)"));
+    console.log(chalk19.dim("  - Skipped git pull (--skip-pull)"));
   }
   if (project.type === "npm" && !options.skipInstall) {
-    const hasPackageJson = existsSync9(join6(project.path, "package.json"));
+    const hasPackageJson = existsSync11(join7(project.path, "package.json"));
     if (hasPackageJson) {
-      console.log(chalk18.dim("Installing dependencies..."));
+      console.log(chalk19.dim("Installing dependencies..."));
       const result = runInDir("npm install", project.path);
       if (result.success) {
-        console.log(chalk18.green("  \u2713 Dependencies installed"));
+        console.log(chalk19.green("  \u2713 Dependencies installed"));
       } else {
-        console.log(chalk18.yellow("  ! npm install failed"));
-        console.log(chalk18.dim(`    ${result.output.split("\n")[0]}`));
+        console.log(chalk19.yellow("  ! npm install failed"));
+        console.log(chalk19.dim(`    ${result.output.split("\n")[0]}`));
       }
     }
   } else if (options.skipInstall) {
-    console.log(chalk18.dim("  - Skipped npm install (--skip-install)"));
+    console.log(chalk19.dim("  - Skipped npm install (--skip-install)"));
   }
   if (project.type === "npm" && !options.skipRestart) {
-    console.log(chalk18.dim("Restarting application..."));
+    console.log(chalk19.dim("Restarting application..."));
     const result = restartProject(name);
     if (result.success) {
-      console.log(chalk18.green("  \u2713 Application restarted"));
+      console.log(chalk19.green("  \u2713 Application restarted"));
     } else {
-      console.log(chalk18.yellow(`  ! Restart failed: ${result.error}`));
-      console.log(chalk18.dim(`    Try: bindler start ${name}`));
+      console.log(chalk19.yellow(`  ! Restart failed: ${result.error}`));
+      console.log(chalk19.dim(`    Try: bindler start ${name}`));
     }
   } else if (project.type === "static") {
-    console.log(chalk18.dim("  - Static project, no restart needed"));
+    console.log(chalk19.dim("  - Static project, no restart needed"));
   } else if (options.skipRestart) {
-    console.log(chalk18.dim("  - Skipped restart (--skip-restart)"));
+    console.log(chalk19.dim("  - Skipped restart (--skip-restart)"));
   }
-  console.log(chalk18.green(`
+  console.log(chalk19.green(`
 \u2713 Deploy complete for ${project.name}
 `));
 }
 
 // src/commands/backup.ts
-import chalk19 from "chalk";
-import { existsSync as existsSync10, readFileSync as readFileSync6, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4 } from "fs";
+import chalk20 from "chalk";
+import { existsSync as existsSync12, readFileSync as readFileSync6, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4 } from "fs";
 import { dirname as dirname3, resolve } from "path";
-import { homedir as homedir2 } from "os";
+import { homedir as homedir3 } from "os";
 async function backupCommand(options) {
   const config = readConfig();
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
-  const defaultPath = resolve(homedir2(), `bindler-backup-${timestamp}.json`);
+  const defaultPath = resolve(homedir3(), `bindler-backup-${timestamp}.json`);
   const outputPath = options.output || defaultPath;
   const dir = dirname3(outputPath);
-  if (!existsSync10(dir)) {
+  if (!existsSync12(dir)) {
     mkdirSync4(dir, { recursive: true });
   }
   const backup = {
@@ -2658,27 +2938,27 @@ async function backupCommand(options) {
     config
   };
   writeFileSync5(outputPath, JSON.stringify(backup, null, 2) + "\n");
-  console.log(chalk19.green(`
+  console.log(chalk20.green(`
 \u2713 Backup saved to ${outputPath}
 `));
-  console.log(chalk19.dim(`  Projects: ${config.projects.length}`));
-  console.log(chalk19.dim(`  Mode: ${config.defaults.mode || "tunnel"}`));
+  console.log(chalk20.dim(`  Projects: ${config.projects.length}`));
+  console.log(chalk20.dim(`  Mode: ${config.defaults.mode || "tunnel"}`));
   console.log("");
-  console.log(chalk19.dim("Restore with:"));
-  console.log(chalk19.cyan(`  bindler restore ${outputPath}`));
+  console.log(chalk20.dim("Restore with:"));
+  console.log(chalk20.cyan(`  bindler restore ${outputPath}`));
   console.log("");
 }
 async function restoreCommand(file, options) {
   if (!file) {
-    console.log(chalk19.red("Usage: bindler restore <file>"));
-    console.log(chalk19.dim("\nExamples:"));
-    console.log(chalk19.dim("  bindler restore ~/bindler-backup.json"));
-    console.log(chalk19.dim("  bindler restore backup.json --force"));
+    console.log(chalk20.red("Usage: bindler restore <file>"));
+    console.log(chalk20.dim("\nExamples:"));
+    console.log(chalk20.dim("  bindler restore ~/bindler-backup.json"));
+    console.log(chalk20.dim("  bindler restore backup.json --force"));
     process.exit(1);
   }
   const filePath = resolve(file);
-  if (!existsSync10(filePath)) {
-    console.log(chalk19.red(`File not found: ${filePath}`));
+  if (!existsSync12(filePath)) {
+    console.log(chalk20.red(`File not found: ${filePath}`));
     process.exit(1);
   }
   let backup;
@@ -2686,140 +2966,140 @@ async function restoreCommand(file, options) {
     const content = readFileSync6(filePath, "utf-8");
     backup = JSON.parse(content);
   } catch (error) {
-    console.log(chalk19.red("Invalid backup file. Must be valid JSON."));
+    console.log(chalk20.red("Invalid backup file. Must be valid JSON."));
     process.exit(1);
   }
   if (!backup.config || !backup.config.defaults || !Array.isArray(backup.config.projects)) {
-    console.log(chalk19.red("Invalid backup format. Missing config data."));
+    console.log(chalk20.red("Invalid backup format. Missing config data."));
     process.exit(1);
   }
-  console.log(chalk19.blue("\nBackup info:\n"));
-  console.log(chalk19.dim("  Exported: ") + chalk19.white(backup.exportedAt || "unknown"));
-  console.log(chalk19.dim("  Projects: ") + chalk19.white(backup.config.projects.length));
-  console.log(chalk19.dim("  Mode:     ") + chalk19.white(backup.config.defaults.mode || "tunnel"));
+  console.log(chalk20.blue("\nBackup info:\n"));
+  console.log(chalk20.dim("  Exported: ") + chalk20.white(backup.exportedAt || "unknown"));
+  console.log(chalk20.dim("  Projects: ") + chalk20.white(backup.config.projects.length));
+  console.log(chalk20.dim("  Mode:     ") + chalk20.white(backup.config.defaults.mode || "tunnel"));
   console.log("");
   const currentConfig = readConfig();
   if (currentConfig.projects.length > 0 && !options.force) {
-    console.log(chalk19.yellow(`Warning: You have ${currentConfig.projects.length} existing project(s).`));
-    console.log(chalk19.dim("Use --force to overwrite.\n"));
+    console.log(chalk20.yellow(`Warning: You have ${currentConfig.projects.length} existing project(s).`));
+    console.log(chalk20.dim("Use --force to overwrite.\n"));
     process.exit(1);
   }
   writeConfig(backup.config);
-  console.log(chalk19.green("\u2713 Config restored!\n"));
-  console.log(chalk19.dim("Run `bindler apply` to apply nginx configuration."));
+  console.log(chalk20.green("\u2713 Config restored!\n"));
+  console.log(chalk20.dim("Run `bindler apply` to apply nginx configuration."));
   console.log("");
 }
 
 // src/commands/ssl.ts
-import chalk20 from "chalk";
+import chalk21 from "chalk";
 async function sslCommand(hostname, options) {
   if (!hostname) {
-    console.log(chalk20.red("Usage: bindler ssl <hostname>"));
-    console.log(chalk20.dim("\nRequest SSL certificate for a hostname"));
-    console.log(chalk20.dim("\nExamples:"));
-    console.log(chalk20.dim("  bindler ssl myapp.example.com"));
-    console.log(chalk20.dim("  bindler ssl myapp              # uses project hostname"));
-    console.log(chalk20.dim("  bindler ssl myapp --email me@example.com"));
+    console.log(chalk21.red("Usage: bindler ssl <hostname>"));
+    console.log(chalk21.dim("\nRequest SSL certificate for a hostname"));
+    console.log(chalk21.dim("\nExamples:"));
+    console.log(chalk21.dim("  bindler ssl myapp.example.com"));
+    console.log(chalk21.dim("  bindler ssl myapp              # uses project hostname"));
+    console.log(chalk21.dim("  bindler ssl myapp --email me@example.com"));
     process.exit(1);
   }
   const project = getProject(hostname);
   const targetHostname = project ? project.hostname : hostname;
   const certbotCheck = execCommandSafe("which certbot");
   if (!certbotCheck.success) {
-    console.log(chalk20.red("certbot is not installed."));
-    console.log(chalk20.dim("\nInstall with:"));
-    console.log(chalk20.dim("  macOS: brew install certbot"));
-    console.log(chalk20.dim("  Linux: apt install certbot python3-certbot-nginx"));
+    console.log(chalk21.red("certbot is not installed."));
+    console.log(chalk21.dim("\nInstall with:"));
+    console.log(chalk21.dim("  macOS: brew install certbot"));
+    console.log(chalk21.dim("  Linux: apt install certbot python3-certbot-nginx"));
     process.exit(1);
   }
   const defaults = getDefaults();
   const email = options.email || defaults.sslEmail || `admin@${targetHostname.split(".").slice(-2).join(".")}`;
-  console.log(chalk20.blue(`
+  console.log(chalk21.blue(`
 Requesting SSL certificate for ${targetHostname}...
 `));
   let cmd = `sudo certbot --nginx -d ${targetHostname} --non-interactive --agree-tos --email ${email}`;
   if (options.staging) {
     cmd += " --staging";
-    console.log(chalk20.yellow("Using staging server (test certificate)\n"));
+    console.log(chalk21.yellow("Using staging server (test certificate)\n"));
   }
-  console.log(chalk20.dim(`Running: ${cmd}
+  console.log(chalk21.dim(`Running: ${cmd}
 `));
   const result = execCommandSafe(cmd + " 2>&1");
   if (result.success) {
-    console.log(chalk20.green(`
+    console.log(chalk21.green(`
 \u2713 SSL certificate installed for ${targetHostname}
 `));
-    console.log(chalk20.dim("Certificate will auto-renew via certbot timer."));
+    console.log(chalk21.dim("Certificate will auto-renew via certbot timer."));
   } else if (result.output?.includes("Certificate not yet due for renewal")) {
-    console.log(chalk20.green(`
+    console.log(chalk21.green(`
 \u2713 Certificate already exists and is valid
 `));
-    console.log(chalk20.dim("Use --force with certbot to renew early if needed."));
+    console.log(chalk21.dim("Use --force with certbot to renew early if needed."));
   } else if (result.output?.includes("too many certificates")) {
-    console.log(chalk20.red("\n\u2717 Rate limit reached"));
-    console.log(chalk20.dim("Let's Encrypt limits certificates per domain."));
-    console.log(chalk20.dim("Try again later or use --staging for testing."));
+    console.log(chalk21.red("\n\u2717 Rate limit reached"));
+    console.log(chalk21.dim("Let's Encrypt limits certificates per domain."));
+    console.log(chalk21.dim("Try again later or use --staging for testing."));
   } else if (result.output?.includes("Could not bind")) {
-    console.log(chalk20.red("\n\u2717 Port 80 is in use"));
-    console.log(chalk20.dim("Stop nginx temporarily or use webroot method."));
+    console.log(chalk21.red("\n\u2717 Port 80 is in use"));
+    console.log(chalk21.dim("Stop nginx temporarily or use webroot method."));
   } else {
-    console.log(chalk20.red("\n\u2717 Certificate request failed\n"));
+    console.log(chalk21.red("\n\u2717 Certificate request failed\n"));
     if (result.output) {
       const lines = result.output.split("\n").filter(
         (l) => l.includes("Error") || l.includes("error") || l.includes("failed") || l.includes("Challenge")
       );
       for (const line of lines.slice(0, 5)) {
-        console.log(chalk20.dim(`  ${line.trim()}`));
+        console.log(chalk21.dim(`  ${line.trim()}`));
       }
     }
-    console.log(chalk20.dim("\nCommon issues:"));
-    console.log(chalk20.dim("  - DNS not pointing to this server"));
-    console.log(chalk20.dim("  - Port 80 not accessible from internet"));
-    console.log(chalk20.dim("  - Firewall blocking HTTP validation"));
+    console.log(chalk21.dim("\nCommon issues:"));
+    console.log(chalk21.dim("  - DNS not pointing to this server"));
+    console.log(chalk21.dim("  - Port 80 not accessible from internet"));
+    console.log(chalk21.dim("  - Firewall blocking HTTP validation"));
   }
   console.log("");
 }
 
 // src/commands/tunnel.ts
-import chalk21 from "chalk";
+import chalk22 from "chalk";
 import { execSync as execSync4, spawn as spawn2 } from "child_process";
 async function tunnelCommand(action, options) {
   if (!action) {
-    console.log(chalk21.red("Usage: bindler tunnel <action>"));
-    console.log(chalk21.dim("\nActions:"));
-    console.log(chalk21.dim("  status    Show tunnel status"));
-    console.log(chalk21.dim("  start     Start the tunnel"));
-    console.log(chalk21.dim("  stop      Stop the tunnel"));
-    console.log(chalk21.dim("  login     Authenticate with Cloudflare"));
-    console.log(chalk21.dim("  create    Create a new tunnel"));
-    console.log(chalk21.dim("  list      List all tunnels"));
-    console.log(chalk21.dim("\nExamples:"));
-    console.log(chalk21.dim("  bindler tunnel status"));
-    console.log(chalk21.dim("  bindler tunnel start"));
-    console.log(chalk21.dim("  bindler tunnel create --name mytunnel"));
+    console.log(chalk22.red("Usage: bindler tunnel <action>"));
+    console.log(chalk22.dim("\nActions:"));
+    console.log(chalk22.dim("  status    Show tunnel status"));
+    console.log(chalk22.dim("  start     Start the tunnel"));
+    console.log(chalk22.dim("  stop      Stop the tunnel"));
+    console.log(chalk22.dim("  login     Authenticate with Cloudflare"));
+    console.log(chalk22.dim("  create    Create a new tunnel"));
+    console.log(chalk22.dim("  list      List all tunnels"));
+    console.log(chalk22.dim("\nExamples:"));
+    console.log(chalk22.dim("  bindler tunnel status"));
+    console.log(chalk22.dim("  bindler tunnel start"));
+    console.log(chalk22.dim("  bindler tunnel create --name mytunnel"));
     process.exit(1);
   }
   if (!isCloudflaredInstalled()) {
-    console.log(chalk21.red("cloudflared is not installed."));
-    console.log(chalk21.dim("\nInstall with: bindler setup"));
+    console.log(chalk22.red("cloudflared is not installed."));
+    console.log(chalk22.dim("\nInstall with: bindler setup"));
     process.exit(1);
   }
   const defaults = getDefaults();
   const tunnelName = options.name || defaults.tunnelName;
   switch (action) {
     case "status": {
-      console.log(chalk21.blue("\nTunnel Status\n"));
+      console.log(chalk22.blue("\nTunnel Status\n"));
       const info = getTunnelInfo(tunnelName);
       if (!info.exists) {
-        console.log(chalk21.yellow(`Tunnel "${tunnelName}" does not exist.`));
-        console.log(chalk21.dim(`
+        console.log(chalk22.yellow(`Tunnel "${tunnelName}" does not exist.`));
+        console.log(chalk22.dim(`
 Create with: bindler tunnel create --name ${tunnelName}`));
       } else {
-        console.log(chalk21.dim("  Name:    ") + chalk21.white(tunnelName));
-        console.log(chalk21.dim("  ID:      ") + chalk21.white(info.id || "unknown"));
-        console.log(chalk21.dim("  Running: ") + (info.running ? chalk21.green("yes") : chalk21.red("no")));
+        console.log(chalk22.dim("  Name:    ") + chalk22.white(tunnelName));
+        console.log(chalk22.dim("  ID:      ") + chalk22.white(info.id || "unknown"));
+        console.log(chalk22.dim("  Running: ") + (info.running ? chalk22.green("yes") : chalk22.red("no")));
         if (!info.running) {
-          console.log(chalk21.dim(`
+          console.log(chalk22.dim(`
 Start with: bindler tunnel start`));
         }
       }
@@ -2829,50 +3109,50 @@ Start with: bindler tunnel start`));
     case "start": {
       const info = getTunnelInfo(tunnelName);
       if (!info.exists) {
-        console.log(chalk21.red(`Tunnel "${tunnelName}" does not exist.`));
-        console.log(chalk21.dim(`Create with: bindler tunnel create`));
+        console.log(chalk22.red(`Tunnel "${tunnelName}" does not exist.`));
+        console.log(chalk22.dim(`Create with: bindler tunnel create`));
         process.exit(1);
       }
       if (info.running) {
-        console.log(chalk21.yellow(`Tunnel "${tunnelName}" is already running.`));
+        console.log(chalk22.yellow(`Tunnel "${tunnelName}" is already running.`));
         process.exit(0);
       }
-      console.log(chalk21.blue(`Starting tunnel "${tunnelName}"...
+      console.log(chalk22.blue(`Starting tunnel "${tunnelName}"...
 `));
-      console.log(chalk21.dim("Running in foreground. Press Ctrl+C to stop.\n"));
+      console.log(chalk22.dim("Running in foreground. Press Ctrl+C to stop.\n"));
       const child = spawn2("cloudflared", ["tunnel", "run", tunnelName], {
         stdio: "inherit"
       });
       child.on("error", (err) => {
-        console.log(chalk21.red(`Failed to start tunnel: ${err.message}`));
+        console.log(chalk22.red(`Failed to start tunnel: ${err.message}`));
         process.exit(1);
       });
       child.on("exit", (code) => {
-        console.log(chalk21.dim(`
+        console.log(chalk22.dim(`
 Tunnel exited with code ${code}`));
         process.exit(code || 0);
       });
       break;
     }
     case "stop": {
-      console.log(chalk21.blue("Stopping tunnel...\n"));
+      console.log(chalk22.blue("Stopping tunnel...\n"));
       const result = execCommandSafe(`pkill -f "cloudflared.*tunnel.*run.*${tunnelName}"`);
       if (result.success) {
-        console.log(chalk21.green(`\u2713 Tunnel "${tunnelName}" stopped`));
+        console.log(chalk22.green(`\u2713 Tunnel "${tunnelName}" stopped`));
       } else {
-        console.log(chalk21.yellow(`Tunnel "${tunnelName}" was not running.`));
+        console.log(chalk22.yellow(`Tunnel "${tunnelName}" was not running.`));
       }
       console.log("");
       break;
     }
     case "login": {
-      console.log(chalk21.blue("Authenticating with Cloudflare...\n"));
-      console.log(chalk21.dim("A browser window will open. Follow the instructions.\n"));
+      console.log(chalk22.blue("Authenticating with Cloudflare...\n"));
+      console.log(chalk22.dim("A browser window will open. Follow the instructions.\n"));
       try {
         execSync4("cloudflared tunnel login", { stdio: "inherit" });
-        console.log(chalk21.green("\n\u2713 Authentication successful!"));
+        console.log(chalk22.green("\n\u2713 Authentication successful!"));
       } catch {
-        console.log(chalk21.red("\n\u2717 Authentication failed or cancelled."));
+        console.log(chalk22.red("\n\u2717 Authentication failed or cancelled."));
       }
       console.log("");
       break;
@@ -2881,69 +3161,69 @@ Tunnel exited with code ${code}`));
       const existingTunnels = listTunnels();
       const exists = existingTunnels.some((t) => t.name === tunnelName);
       if (exists) {
-        console.log(chalk21.yellow(`Tunnel "${tunnelName}" already exists.`));
-        console.log(chalk21.dim("\nUse a different name with --name"));
+        console.log(chalk22.yellow(`Tunnel "${tunnelName}" already exists.`));
+        console.log(chalk22.dim("\nUse a different name with --name"));
         process.exit(1);
       }
-      console.log(chalk21.blue(`Creating tunnel "${tunnelName}"...
+      console.log(chalk22.blue(`Creating tunnel "${tunnelName}"...
 `));
       try {
         execSync4(`cloudflared tunnel create ${tunnelName}`, { stdio: "inherit" });
-        console.log(chalk21.green(`
+        console.log(chalk22.green(`
 \u2713 Tunnel "${tunnelName}" created!`));
-        console.log(chalk21.dim("\nNext steps:"));
-        console.log(chalk21.dim("  1. Create ~/.cloudflared/config.yml"));
-        console.log(chalk21.dim("  2. Run: bindler tunnel start"));
+        console.log(chalk22.dim("\nNext steps:"));
+        console.log(chalk22.dim("  1. Create ~/.cloudflared/config.yml"));
+        console.log(chalk22.dim("  2. Run: bindler tunnel start"));
       } catch {
-        console.log(chalk21.red("\n\u2717 Failed to create tunnel."));
-        console.log(chalk21.dim("Make sure you're logged in: bindler tunnel login"));
+        console.log(chalk22.red("\n\u2717 Failed to create tunnel."));
+        console.log(chalk22.dim("Make sure you're logged in: bindler tunnel login"));
       }
       console.log("");
       break;
     }
     case "list": {
-      console.log(chalk21.blue("\nCloudflare Tunnels\n"));
+      console.log(chalk22.blue("\nCloudflare Tunnels\n"));
       const tunnels = listTunnels();
       if (tunnels.length === 0) {
-        console.log(chalk21.dim("No tunnels found."));
-        console.log(chalk21.dim("\nCreate one with: bindler tunnel create"));
+        console.log(chalk22.dim("No tunnels found."));
+        console.log(chalk22.dim("\nCreate one with: bindler tunnel create"));
       } else {
         for (const tunnel of tunnels) {
           const isDefault = tunnel.name === tunnelName;
-          const prefix = isDefault ? chalk21.cyan("\u2192 ") : "  ";
-          console.log(prefix + chalk21.white(tunnel.name) + chalk21.dim(` (${tunnel.id.slice(0, 8)}...)`));
+          const prefix = isDefault ? chalk22.cyan("\u2192 ") : "  ";
+          console.log(prefix + chalk22.white(tunnel.name) + chalk22.dim(` (${tunnel.id.slice(0, 8)}...)`));
         }
-        console.log(chalk21.dim(`
+        console.log(chalk22.dim(`
 ${tunnels.length} tunnel(s)`));
       }
       console.log("");
       break;
     }
     default:
-      console.log(chalk21.red(`Unknown action: ${action}`));
-      console.log(chalk21.dim("Run `bindler tunnel` for usage."));
+      console.log(chalk22.red(`Unknown action: ${action}`));
+      console.log(chalk22.dim("Run `bindler tunnel` for usage."));
       process.exit(1);
   }
 }
 
 // src/commands/open.ts
-import chalk22 from "chalk";
+import chalk23 from "chalk";
 import { exec } from "child_process";
 async function openCommand(name) {
   if (!name) {
-    console.log(chalk22.red("Usage: bindler open <name>"));
-    console.log(chalk22.dim("\nOpen a project in your browser"));
-    console.log(chalk22.dim("\nExamples:"));
-    console.log(chalk22.dim("  bindler open myapp"));
+    console.log(chalk23.red("Usage: bindler open <name>"));
+    console.log(chalk23.dim("\nOpen a project in your browser"));
+    console.log(chalk23.dim("\nExamples:"));
+    console.log(chalk23.dim("  bindler open myapp"));
     process.exit(1);
   }
   const project = getProject(name);
   if (!project) {
-    console.log(chalk22.red(`Project "${name}" not found.`));
-    console.log(chalk22.dim("\nAvailable projects:"));
+    console.log(chalk23.red(`Project "${name}" not found.`));
+    console.log(chalk23.dim("\nAvailable projects:"));
     const projects = listProjects();
     for (const p of projects) {
-      console.log(chalk22.dim(`  - ${p.name}`));
+      console.log(chalk23.dim(`  - ${p.name}`));
     }
     process.exit(1);
   }
@@ -2964,7 +3244,7 @@ async function openCommand(name) {
   if (project.basePath && project.basePath !== "/") {
     url += project.basePath;
   }
-  console.log(chalk22.dim(`Opening ${url}...`));
+  console.log(chalk23.dim(`Opening ${url}...`));
   const platform = process.platform;
   let cmd;
   if (platform === "darwin") {
@@ -2976,15 +3256,15 @@ async function openCommand(name) {
   }
   exec(cmd, (error) => {
     if (error) {
-      console.log(chalk22.yellow(`Could not open browser automatically.`));
-      console.log(chalk22.dim(`
-Open manually: ${chalk22.cyan(url)}`));
+      console.log(chalk23.yellow(`Could not open browser automatically.`));
+      console.log(chalk23.dim(`
+Open manually: ${chalk23.cyan(url)}`));
     }
   });
 }
 
 // src/commands/health.ts
-import chalk23 from "chalk";
+import chalk24 from "chalk";
 async function pingUrl(url, timeout = 5e3) {
   const start = Date.now();
   try {
@@ -3014,15 +3294,15 @@ async function healthCommand() {
   const projects = listProjects();
   const defaults = getDefaults();
   if (projects.length === 0) {
-    console.log(chalk23.yellow("\nNo projects registered."));
-    console.log(chalk23.dim("Run `bindler new` to add a project.\n"));
+    console.log(chalk24.yellow("\nNo projects registered."));
+    console.log(chalk24.dim("Run `bindler new` to add a project.\n"));
     return;
   }
-  console.log(chalk23.blue("\nHealth Check\n"));
+  console.log(chalk24.blue("\nHealth Check\n"));
   const results = [];
   for (const project of projects) {
     if (project.enabled === false) {
-      console.log(chalk23.dim(`  - ${project.name} (disabled)`));
+      console.log(chalk24.dim(`  - ${project.name} (disabled)`));
       continue;
     }
     const isLocal = project.local || project.hostname.endsWith(".local");
@@ -3041,33 +3321,33 @@ async function healthCommand() {
     if (project.basePath && project.basePath !== "/") {
       url += project.basePath;
     }
-    process.stdout.write(chalk23.dim(`  Checking ${project.name}...`));
+    process.stdout.write(chalk24.dim(`  Checking ${project.name}...`));
     const result = await pingUrl(url);
     results.push({ name: project.name, hostname: project.hostname, ...result });
     process.stdout.write("\r\x1B[K");
     if (result.ok) {
-      console.log(chalk23.green("  \u2713 ") + chalk23.white(project.name) + chalk23.dim(` (${result.time}ms)`));
+      console.log(chalk24.green("  \u2713 ") + chalk24.white(project.name) + chalk24.dim(` (${result.time}ms)`));
     } else if (result.status) {
-      console.log(chalk23.yellow("  ! ") + chalk23.white(project.name) + chalk23.dim(` (${result.status})`));
+      console.log(chalk24.yellow("  ! ") + chalk24.white(project.name) + chalk24.dim(` (${result.status})`));
     } else {
-      console.log(chalk23.red("  \u2717 ") + chalk23.white(project.name) + chalk23.dim(` (${result.error})`));
+      console.log(chalk24.red("  \u2717 ") + chalk24.white(project.name) + chalk24.dim(` (${result.error})`));
     }
   }
   const healthy = results.filter((r) => r.ok).length;
   const unhealthy = results.filter((r) => !r.ok).length;
   console.log("");
   if (unhealthy === 0) {
-    console.log(chalk23.green(`\u2713 All ${healthy} project(s) healthy`));
+    console.log(chalk24.green(`\u2713 All ${healthy} project(s) healthy`));
   } else if (healthy === 0) {
-    console.log(chalk23.red(`\u2717 All ${unhealthy} project(s) down`));
+    console.log(chalk24.red(`\u2717 All ${unhealthy} project(s) down`));
   } else {
-    console.log(chalk23.yellow(`! ${healthy} healthy, ${unhealthy} down`));
+    console.log(chalk24.yellow(`! ${healthy} healthy, ${unhealthy} down`));
   }
   console.log("");
 }
 
 // src/commands/stats.ts
-import chalk24 from "chalk";
+import chalk25 from "chalk";
 function formatBytes2(bytes) {
   if (bytes === 0) return "0 B";
   const k = 1024;
@@ -3090,15 +3370,15 @@ async function statsCommand() {
   const pm2Processes = getPm2List();
   const npmProjects = projects.filter((p) => p.type === "npm");
   if (npmProjects.length === 0) {
-    console.log(chalk24.yellow("\nNo npm projects registered."));
-    console.log(chalk24.dim("Stats are only available for npm projects.\n"));
+    console.log(chalk25.yellow("\nNo npm projects registered."));
+    console.log(chalk25.dim("Stats are only available for npm projects.\n"));
     return;
   }
-  console.log(chalk24.blue("\nProject Stats\n"));
+  console.log(chalk25.blue("\nProject Stats\n"));
   console.log(
-    chalk24.dim("  ") + chalk24.dim("NAME".padEnd(20)) + chalk24.dim("STATUS".padEnd(10)) + chalk24.dim("CPU".padEnd(8)) + chalk24.dim("MEM".padEnd(10)) + chalk24.dim("UPTIME".padEnd(10)) + chalk24.dim("RESTARTS")
+    chalk25.dim("  ") + chalk25.dim("NAME".padEnd(20)) + chalk25.dim("STATUS".padEnd(10)) + chalk25.dim("CPU".padEnd(8)) + chalk25.dim("MEM".padEnd(10)) + chalk25.dim("UPTIME".padEnd(10)) + chalk25.dim("RESTARTS")
   );
-  console.log(chalk24.dim("  " + "-".repeat(70)));
+  console.log(chalk25.dim("  " + "-".repeat(70)));
   let totalCpu = 0;
   let totalMem = 0;
   for (const project of npmProjects) {
@@ -3107,11 +3387,11 @@ async function statsCommand() {
     const name = project.name.slice(0, 18).padEnd(20);
     if (!pm2Process) {
       console.log(
-        "  " + chalk24.white(name) + chalk24.dim("not managed".padEnd(10)) + chalk24.dim("-".padEnd(8)) + chalk24.dim("-".padEnd(10)) + chalk24.dim("-".padEnd(10)) + chalk24.dim("-")
+        "  " + chalk25.white(name) + chalk25.dim("not managed".padEnd(10)) + chalk25.dim("-".padEnd(8)) + chalk25.dim("-".padEnd(10)) + chalk25.dim("-".padEnd(10)) + chalk25.dim("-")
       );
       continue;
     }
-    const statusColor = pm2Process.status === "online" ? chalk24.green : chalk24.red;
+    const statusColor = pm2Process.status === "online" ? chalk25.green : chalk25.red;
     const status = statusColor(pm2Process.status.padEnd(10));
     const cpu = `${pm2Process.cpu.toFixed(1)}%`.padEnd(8);
     const mem = formatBytes2(pm2Process.memory).padEnd(10);
@@ -3120,19 +3400,19 @@ async function statsCommand() {
     totalCpu += pm2Process.cpu;
     totalMem += pm2Process.memory;
     console.log(
-      "  " + chalk24.white(name) + status + (pm2Process.cpu > 50 ? chalk24.yellow(cpu) : chalk24.dim(cpu)) + (pm2Process.memory > 500 * 1024 * 1024 ? chalk24.yellow(mem) : chalk24.dim(mem)) + chalk24.dim(uptime) + (pm2Process.restarts > 0 ? chalk24.yellow(restarts) : chalk24.dim(restarts))
+      "  " + chalk25.white(name) + status + (pm2Process.cpu > 50 ? chalk25.yellow(cpu) : chalk25.dim(cpu)) + (pm2Process.memory > 500 * 1024 * 1024 ? chalk25.yellow(mem) : chalk25.dim(mem)) + chalk25.dim(uptime) + (pm2Process.restarts > 0 ? chalk25.yellow(restarts) : chalk25.dim(restarts))
     );
   }
   const runningCount = pm2Processes.filter((p) => p.name.startsWith("bindler:") && p.status === "online").length;
-  console.log(chalk24.dim("  " + "-".repeat(70)));
+  console.log(chalk25.dim("  " + "-".repeat(70)));
   console.log(
-    "  " + chalk24.bold("TOTAL".padEnd(20)) + chalk24.dim(`${runningCount}/${npmProjects.length}`.padEnd(10)) + chalk24.dim(`${totalCpu.toFixed(1)}%`.padEnd(8)) + chalk24.dim(formatBytes2(totalMem).padEnd(10))
+    "  " + chalk25.bold("TOTAL".padEnd(20)) + chalk25.dim(`${runningCount}/${npmProjects.length}`.padEnd(10)) + chalk25.dim(`${totalCpu.toFixed(1)}%`.padEnd(8)) + chalk25.dim(formatBytes2(totalMem).padEnd(10))
   );
   console.log("");
 }
 
 // src/commands/completion.ts
-import chalk25 from "chalk";
+import chalk26 from "chalk";
 var BASH_COMPLETION = `
 # bindler bash completion
 _bindler_completions() {
@@ -3265,12 +3545,12 @@ complete -c bindler -n '__fish_seen_subcommand_from tunnel' -a 'status start sto
 `;
 async function completionCommand(shell) {
   if (!shell) {
-    console.log(chalk25.red("Usage: bindler completion <shell>"));
-    console.log(chalk25.dim("\nSupported shells: bash, zsh, fish"));
-    console.log(chalk25.dim("\nSetup:"));
-    console.log(chalk25.dim("  bash: bindler completion bash >> ~/.bashrc"));
-    console.log(chalk25.dim("  zsh:  bindler completion zsh >> ~/.zshrc"));
-    console.log(chalk25.dim("  fish: bindler completion fish > ~/.config/fish/completions/bindler.fish"));
+    console.log(chalk26.red("Usage: bindler completion <shell>"));
+    console.log(chalk26.dim("\nSupported shells: bash, zsh, fish"));
+    console.log(chalk26.dim("\nSetup:"));
+    console.log(chalk26.dim("  bash: bindler completion bash >> ~/.bashrc"));
+    console.log(chalk26.dim("  zsh:  bindler completion zsh >> ~/.zshrc"));
+    console.log(chalk26.dim("  fish: bindler completion fish > ~/.config/fish/completions/bindler.fish"));
     process.exit(1);
   }
   switch (shell) {
@@ -3284,32 +3564,32 @@ async function completionCommand(shell) {
       console.log(FISH_COMPLETION.trim());
       break;
     default:
-      console.log(chalk25.red(`Unknown shell: ${shell}`));
-      console.log(chalk25.dim("Supported: bash, zsh, fish"));
+      console.log(chalk26.red(`Unknown shell: ${shell}`));
+      console.log(chalk26.dim("Supported: bash, zsh, fish"));
       process.exit(1);
   }
 }
 
 // src/commands/clone.ts
-import chalk26 from "chalk";
+import chalk27 from "chalk";
 import inquirer5 from "inquirer";
 async function cloneCommand(source, newName, options) {
   if (!source) {
-    console.log(chalk26.red("Usage: bindler clone <source> <new-name>"));
-    console.log(chalk26.dim("\nClones a project configuration with a new name"));
-    console.log(chalk26.dim("\nExamples:"));
-    console.log(chalk26.dim("  bindler clone myapp myapp-staging"));
-    console.log(chalk26.dim("  bindler clone myapp myapp-v2 --hostname newapp.example.com"));
-    console.log(chalk26.dim("  bindler clone myapp myapp-copy --path /var/www/newapp"));
+    console.log(chalk27.red("Usage: bindler clone <source> <new-name>"));
+    console.log(chalk27.dim("\nClones a project configuration with a new name"));
+    console.log(chalk27.dim("\nExamples:"));
+    console.log(chalk27.dim("  bindler clone myapp myapp-staging"));
+    console.log(chalk27.dim("  bindler clone myapp myapp-v2 --hostname newapp.example.com"));
+    console.log(chalk27.dim("  bindler clone myapp myapp-copy --path /var/www/newapp"));
     process.exit(1);
   }
   const sourceProject = getProject(source);
   if (!sourceProject) {
-    console.log(chalk26.red(`Project "${source}" not found.`));
-    console.log(chalk26.dim("\nAvailable projects:"));
+    console.log(chalk27.red(`Project "${source}" not found.`));
+    console.log(chalk27.dim("\nAvailable projects:"));
     const projects = listProjects();
     for (const p of projects) {
-      console.log(chalk26.dim(`  - ${p.name}`));
+      console.log(chalk27.dim(`  - ${p.name}`));
     }
     process.exit(1);
   }
@@ -3335,11 +3615,11 @@ async function cloneCommand(source, newName, options) {
     targetName = answer.name;
   } else {
     if (!validateProjectName(targetName)) {
-      console.log(chalk26.red("Invalid project name. Use alphanumeric characters, dashes, and underscores."));
+      console.log(chalk27.red("Invalid project name. Use alphanumeric characters, dashes, and underscores."));
       process.exit(1);
     }
     if (getProject(targetName)) {
-      console.log(chalk26.red(`Project "${targetName}" already exists.`));
+      console.log(chalk27.red(`Project "${targetName}" already exists.`));
       process.exit(1);
     }
   }
@@ -3362,7 +3642,7 @@ async function cloneCommand(source, newName, options) {
     targetHostname = answer.hostname;
   } else {
     if (!validateHostname(targetHostname)) {
-      console.log(chalk26.red("Invalid hostname format."));
+      console.log(chalk27.red("Invalid hostname format."));
       process.exit(1);
     }
   }
@@ -3380,36 +3660,36 @@ async function cloneCommand(source, newName, options) {
   }
   try {
     addProject(newProject);
-    console.log(chalk26.green(`
+    console.log(chalk27.green(`
 Project "${targetName}" cloned from "${source}"!
 `));
-    console.log(chalk26.dim("Configuration:"));
-    console.log(chalk26.dim(`  Name:     ${newProject.name}`));
-    console.log(chalk26.dim(`  Type:     ${newProject.type}`));
-    console.log(chalk26.dim(`  Path:     ${newProject.path}`));
-    console.log(chalk26.dim(`  Hostname: ${newProject.hostname}`));
+    console.log(chalk27.dim("Configuration:"));
+    console.log(chalk27.dim(`  Name:     ${newProject.name}`));
+    console.log(chalk27.dim(`  Type:     ${newProject.type}`));
+    console.log(chalk27.dim(`  Path:     ${newProject.path}`));
+    console.log(chalk27.dim(`  Hostname: ${newProject.hostname}`));
     if (newProject.port) {
-      console.log(chalk26.dim(`  Port:     ${newProject.port}`));
+      console.log(chalk27.dim(`  Port:     ${newProject.port}`));
     }
-    console.log(chalk26.dim(`
-Run ${chalk26.cyan("sudo bindler apply")} to update nginx configuration.`));
+    console.log(chalk27.dim(`
+Run ${chalk27.cyan("sudo bindler apply")} to update nginx configuration.`));
     if (newProject.type === "npm") {
-      console.log(chalk26.dim(`Run ${chalk26.cyan(`bindler start ${targetName}`)} to start the application.`));
+      console.log(chalk27.dim(`Run ${chalk27.cyan(`bindler start ${targetName}`)} to start the application.`));
     }
   } catch (error) {
-    console.error(chalk26.red(`Error: ${error instanceof Error ? error.message : error}`));
+    console.error(chalk27.red(`Error: ${error instanceof Error ? error.message : error}`));
     process.exit(1);
   }
 }
 
 // src/commands/dev.ts
-import chalk27 from "chalk";
+import chalk28 from "chalk";
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync11, readFileSync as readFileSync7 } from "fs";
-import { basename as basename3, join as join7 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync7 } from "fs";
+import { basename as basename3, join as join8 } from "path";
 function getPackageJson(dir) {
-  const pkgPath = join7(dir, "package.json");
-  if (!existsSync11(pkgPath)) return null;
+  const pkgPath = join8(dir, "package.json");
+  if (!existsSync13(pkgPath)) return null;
   try {
     return JSON.parse(readFileSync7(pkgPath, "utf-8"));
   } catch {
@@ -3433,11 +3713,11 @@ async function devCommand(name, options) {
   if (name) {
     project = getProject(name);
     if (!project) {
-      console.log(chalk27.red(`Project "${name}" not found.`));
-      console.log(chalk27.dim("\nAvailable projects:"));
+      console.log(chalk28.red(`Project "${name}" not found.`));
+      console.log(chalk28.dim("\nAvailable projects:"));
       const projects = listProjects();
       for (const p of projects) {
-        console.log(chalk27.dim(`  - ${p.name}`));
+        console.log(chalk28.dim(`  - ${p.name}`));
       }
       process.exit(1);
     }
@@ -3448,7 +3728,7 @@ async function devCommand(name, options) {
     if (!project) {
       const yamlConfig = readBindlerYaml(cwd);
       if (yamlConfig) {
-        console.log(chalk27.cyan("Found bindler.yaml - creating temporary dev project\n"));
+        console.log(chalk28.cyan("Found bindler.yaml - creating temporary dev project\n"));
         const yamlProject = yamlToProject(yamlConfig, cwd);
         project = {
           name: yamlProject.name || basename3(cwd),
@@ -3462,9 +3742,9 @@ async function devCommand(name, options) {
       } else {
         const pkg = getPackageJson(cwd);
         if (!pkg) {
-          console.log(chalk27.red("No package.json found in current directory."));
-          console.log(chalk27.dim("\nUsage: bindler dev [name]"));
-          console.log(chalk27.dim("  Run in a project directory or specify a project name"));
+          console.log(chalk28.red("No package.json found in current directory."));
+          console.log(chalk28.dim("\nUsage: bindler dev [name]"));
+          console.log(chalk28.dim("  Run in a project directory or specify a project name"));
           process.exit(1);
         }
         project = {
@@ -3480,35 +3760,35 @@ async function devCommand(name, options) {
     projectDir = cwd;
   }
   if (project.type !== "npm") {
-    console.log(chalk27.red("Dev mode is only supported for npm projects."));
-    console.log(chalk27.dim("\nFor static projects, use a local web server:"));
-    console.log(chalk27.dim("  npx serve " + project.path));
+    console.log(chalk28.red("Dev mode is only supported for npm projects."));
+    console.log(chalk28.dim("\nFor static projects, use a local web server:"));
+    console.log(chalk28.dim("  npx serve " + project.path));
     process.exit(1);
   }
-  if (!existsSync11(projectDir)) {
-    console.log(chalk27.red(`Project directory not found: ${projectDir}`));
+  if (!existsSync13(projectDir)) {
+    console.log(chalk28.red(`Project directory not found: ${projectDir}`));
     process.exit(1);
   }
   const devCmd = getDevCommand(projectDir) || project.start || "npm start";
   const port = options.port || project.port || findAvailablePort();
-  console.log(chalk27.blue(`
+  console.log(chalk28.blue(`
 Starting ${project.name} in dev mode...
 `));
-  console.log(chalk27.dim(`  Directory: ${projectDir}`));
-  console.log(chalk27.dim(`  Command:   ${devCmd}`));
-  console.log(chalk27.dim(`  Port:      ${port}`));
-  console.log(chalk27.dim(`  Hostname:  ${project.hostname}`));
+  console.log(chalk28.dim(`  Directory: ${projectDir}`));
+  console.log(chalk28.dim(`  Command:   ${devCmd}`));
+  console.log(chalk28.dim(`  Port:      ${port}`));
+  console.log(chalk28.dim(`  Hostname:  ${project.hostname}`));
   if (project.hostname.endsWith(".local") || project.local) {
-    console.log(chalk27.yellow(`
+    console.log(chalk28.yellow(`
 Note: Add to /etc/hosts if not already:`));
-    console.log(chalk27.cyan(`  echo "127.0.0.1  ${project.hostname}" | sudo tee -a /etc/hosts`));
+    console.log(chalk28.cyan(`  echo "127.0.0.1  ${project.hostname}" | sudo tee -a /etc/hosts`));
   }
   const defaults = getDefaults();
   const listenPort = defaults.nginxListen.split(":")[1] || "8080";
-  console.log(chalk27.green(`
+  console.log(chalk28.green(`
 Access at: http://${project.hostname}:${listenPort}`));
-  console.log(chalk27.dim("Press Ctrl+C to stop\n"));
-  console.log(chalk27.dim("---"));
+  console.log(chalk28.dim("Press Ctrl+C to stop\n"));
+  console.log(chalk28.dim("---"));
   const env = {
     ...process.env,
     PORT: String(port),
@@ -3522,19 +3802,19 @@ Access at: http://${project.hostname}:${listenPort}`));
     shell: true
   });
   child.on("error", (error) => {
-    console.error(chalk27.red(`
+    console.error(chalk28.red(`
 Failed to start: ${error.message}`));
     process.exit(1);
   });
   child.on("exit", (code) => {
     if (code !== 0) {
-      console.log(chalk27.yellow(`
+      console.log(chalk28.yellow(`
 Process exited with code ${code}`));
     }
     process.exit(code || 0);
   });
   process.on("SIGINT", () => {
-    console.log(chalk27.dim("\n\nStopping dev server..."));
+    console.log(chalk28.dim("\n\nStopping dev server..."));
     child.kill("SIGINT");
   });
   process.on("SIGTERM", () => {
@@ -3543,16 +3823,16 @@ Process exited with code ${code}`));
 }
 
 // src/lib/update-check.ts
-import chalk28 from "chalk";
-import { existsSync as existsSync12, readFileSync as readFileSync8, writeFileSync as writeFileSync6, mkdirSync as mkdirSync5 } from "fs";
-import { join as join8 } from "path";
-import { homedir as homedir3 } from "os";
+import chalk29 from "chalk";
+import { existsSync as existsSync14, readFileSync as readFileSync8, writeFileSync as writeFileSync6, mkdirSync as mkdirSync5 } from "fs";
+import { join as join9 } from "path";
+import { homedir as homedir4 } from "os";
 var CHECK_INTERVAL = 24 * 60 * 60 * 1e3;
-var CACHE_DIR = join8(homedir3(), ".config", "bindler");
-var CACHE_FILE = join8(CACHE_DIR, ".update-check");
+var CACHE_DIR = join9(homedir4(), ".config", "bindler");
+var CACHE_FILE = join9(CACHE_DIR, ".update-check");
 function readCache() {
   try {
-    if (existsSync12(CACHE_FILE)) {
+    if (existsSync14(CACHE_FILE)) {
       return JSON.parse(readFileSync8(CACHE_FILE, "utf-8"));
     }
   } catch {
@@ -3561,7 +3841,7 @@ function readCache() {
 }
 function writeCache(data) {
   try {
-    if (!existsSync12(CACHE_DIR)) {
+    if (!existsSync14(CACHE_DIR)) {
       mkdirSync5(CACHE_DIR, { recursive: true });
     }
     writeFileSync6(CACHE_FILE, JSON.stringify(data));
@@ -3596,28 +3876,28 @@ async function checkForUpdates() {
   const cache = readCache();
   const now = Date.now();
   if (now - cache.lastCheck < CHECK_INTERVAL) {
-    if (cache.latestVersion && compareVersions("1.2.0", cache.latestVersion) < 0) {
+    if (cache.latestVersion && compareVersions("1.3.0", cache.latestVersion) < 0) {
       showUpdateMessage(cache.latestVersion);
     }
     return;
   }
   fetchLatestVersion().then((latestVersion) => {
     writeCache({ lastCheck: now, latestVersion });
-    if (latestVersion && compareVersions("1.2.0", latestVersion) < 0) {
+    if (latestVersion && compareVersions("1.3.0", latestVersion) < 0) {
       showUpdateMessage(latestVersion);
     }
   });
 }
 function showUpdateMessage(latestVersion) {
   console.log("");
-  console.log(chalk28.yellow(`  Update available: ${"1.2.0"} \u2192 ${latestVersion}`));
-  console.log(chalk28.dim(`  Run: npm update -g bindler`));
+  console.log(chalk29.yellow(`  Update available: ${"1.3.0"} \u2192 ${latestVersion}`));
+  console.log(chalk29.dim(`  Run: npm update -g bindler`));
   console.log("");
 }
 
 // src/cli.ts
 var program = new Command();
-program.name("bindler").description("Manage multiple projects behind Cloudflare Tunnel with Nginx and PM2").version("1.2.0");
+program.name("bindler").description("Manage multiple projects behind Cloudflare Tunnel with Nginx and PM2").version("1.3.0");
 program.hook("preAction", async () => {
   try {
     initConfig();
@@ -3636,78 +3916,78 @@ program.command("status").description("Show detailed status of all projects").ac
 });
 program.command("start [name]").description("Start an npm project with PM2").option("-a, --all", "Start all npm projects").action(async (name, options) => {
   if (!name && !options.all) {
-    console.log(chalk29.red("Usage: bindler start <name> or bindler start --all"));
-    console.log(chalk29.dim("\nExamples:"));
-    console.log(chalk29.dim("  bindler start myapp"));
-    console.log(chalk29.dim("  bindler start --all    # start all npm projects"));
+    console.log(chalk30.red("Usage: bindler start <name> or bindler start --all"));
+    console.log(chalk30.dim("\nExamples:"));
+    console.log(chalk30.dim("  bindler start myapp"));
+    console.log(chalk30.dim("  bindler start --all    # start all npm projects"));
     process.exit(1);
   }
   await startCommand(name, options);
 });
 program.command("stop [name]").description("Stop an npm project").option("-a, --all", "Stop all npm projects").action(async (name, options) => {
   if (!name && !options.all) {
-    console.log(chalk29.red("Usage: bindler stop <name> or bindler stop --all"));
-    console.log(chalk29.dim("\nExamples:"));
-    console.log(chalk29.dim("  bindler stop myapp"));
-    console.log(chalk29.dim("  bindler stop --all    # stop all npm projects"));
+    console.log(chalk30.red("Usage: bindler stop <name> or bindler stop --all"));
+    console.log(chalk30.dim("\nExamples:"));
+    console.log(chalk30.dim("  bindler stop myapp"));
+    console.log(chalk30.dim("  bindler stop --all    # stop all npm projects"));
     process.exit(1);
   }
   await stopCommand(name, options);
 });
 program.command("restart [name]").description("Restart an npm project").option("-a, --all", "Restart all npm projects").action(async (name, options) => {
   if (!name && !options.all) {
-    console.log(chalk29.red("Usage: bindler restart <name> or bindler restart --all"));
-    console.log(chalk29.dim("\nExamples:"));
-    console.log(chalk29.dim("  bindler restart myapp"));
-    console.log(chalk29.dim("  bindler restart --all    # restart all npm projects"));
+    console.log(chalk30.red("Usage: bindler restart <name> or bindler restart --all"));
+    console.log(chalk30.dim("\nExamples:"));
+    console.log(chalk30.dim("  bindler restart myapp"));
+    console.log(chalk30.dim("  bindler restart --all    # restart all npm projects"));
     process.exit(1);
   }
   await restartCommand(name, options);
 });
 program.command("logs [name]").description("Show logs for an npm project").option("-f, --follow", "Follow log output").option("-l, --lines <n>", "Number of lines to show", "200").action(async (name, options) => {
   if (!name) {
-    console.log(chalk29.red("Usage: bindler logs <name>"));
-    console.log(chalk29.dim("\nExamples:"));
-    console.log(chalk29.dim("  bindler logs myapp"));
-    console.log(chalk29.dim("  bindler logs myapp --follow"));
-    console.log(chalk29.dim("  bindler logs myapp --lines 500"));
+    console.log(chalk30.red("Usage: bindler logs <name>"));
+    console.log(chalk30.dim("\nExamples:"));
+    console.log(chalk30.dim("  bindler logs myapp"));
+    console.log(chalk30.dim("  bindler logs myapp --follow"));
+    console.log(chalk30.dim("  bindler logs myapp --lines 500"));
     process.exit(1);
   }
   await logsCommand(name, { ...options, lines: parseInt(options.lines, 10) });
 });
 program.command("update [name]").description("Update project configuration").option("-h, --hostname <hostname>", "New hostname").option("--port <port>", "New port number").option("-s, --start <command>", "New start command").option("-p, --path <path>", "New project path").option("-e, --env <vars...>", "Environment variables (KEY=value)").option("--enable", "Enable the project").option("--disable", "Disable the project").action(async (name, options) => {
   if (!name) {
-    console.log(chalk29.red("Usage: bindler update <name> [options]"));
-    console.log(chalk29.dim("\nExamples:"));
-    console.log(chalk29.dim("  bindler update myapp --hostname newapp.example.com"));
-    console.log(chalk29.dim("  bindler update myapp --port 4000"));
-    console.log(chalk29.dim("  bindler update myapp --disable"));
+    console.log(chalk30.red("Usage: bindler update <name> [options]"));
+    console.log(chalk30.dim("\nExamples:"));
+    console.log(chalk30.dim("  bindler update myapp --hostname newapp.example.com"));
+    console.log(chalk30.dim("  bindler update myapp --port 4000"));
+    console.log(chalk30.dim("  bindler update myapp --disable"));
     process.exit(1);
   }
   await updateCommand(name, options);
 });
 program.command("edit [name]").description("Edit project configuration in $EDITOR").action(async (name) => {
   if (!name) {
-    console.log(chalk29.red("Usage: bindler edit <name>"));
-    console.log(chalk29.dim("\nOpens the project config in your $EDITOR"));
-    console.log(chalk29.dim("\nExample:"));
-    console.log(chalk29.dim("  bindler edit myapp"));
+    console.log(chalk30.red("Usage: bindler edit <name>"));
+    console.log(chalk30.dim("\nOpens the project config in your $EDITOR"));
+    console.log(chalk30.dim("\nExample:"));
+    console.log(chalk30.dim("  bindler edit myapp"));
     process.exit(1);
   }
   await editCommand(name);
 });
 program.command("remove [name]").alias("rm").description("Remove a project from registry").option("-f, --force", "Skip confirmation").option("--apply", "Apply nginx config after removing").action(async (name, options) => {
   if (!name) {
-    console.log(chalk29.red("Usage: bindler remove <name>"));
-    console.log(chalk29.dim("\nExamples:"));
-    console.log(chalk29.dim("  bindler remove myapp"));
-    console.log(chalk29.dim("  bindler remove myapp --force    # skip confirmation"));
-    console.log(chalk29.dim("  bindler rm myapp                # alias"));
+    console.log(chalk30.red("Usage: bindler remove <name>"));
+    console.log(chalk30.dim("\nExamples:"));
+    console.log(chalk30.dim("  bindler remove myapp"));
+    console.log(chalk30.dim("  bindler remove myapp --force    # skip confirmation"));
+    console.log(chalk30.dim("  bindler rm myapp                # alias"));
     process.exit(1);
   }
   await removeCommand(name, options);
 });
-program.command("apply").description("Generate and apply nginx configuration + Cloudflare DNS routes").option("-d, --dry-run", "Print config without applying").option("--no-reload", "Write config but do not reload nginx").option("--no-cloudflare", "Skip Cloudflare DNS route configuration").option("--no-ssl", "Skip SSL certificate setup (direct mode)").option("--sync", "Sync bindler.yaml from project directories before applying").option("-e, --env <env>", "Use environment-specific config (staging, production)").action(async (options) => {
+program.command("apply").description("Generate and apply nginx configuration + Cloudflare DNS routes").option("-d, --dry-run", "Print config without applying").option("--no-reload", "Write config but do not reload nginx").option("--no-cloudflare", "Skip Cloudflare DNS route configuration").option("--no-ssl", "Skip SSL certificate setup (direct mode)").option("--sync", "Sync bindler.yaml from project directories before applying").option("-e, --env <env>", "Use environment-specific config (staging, production)").option("--skip-checks", "Skip preflight validation checks (not recommended)").action(async (options) => {
   await applyCommand(options);
 });
 program.command("doctor").description("Run system diagnostics and check dependencies").action(async () => {
@@ -3721,10 +4001,10 @@ program.command("info").description("Show bindler information and stats").action
 });
 program.command("check [hostname]").description("Check DNS propagation and HTTP accessibility for a hostname").option("-v, --verbose", "Show verbose output").action(async (hostname, options) => {
   if (!hostname) {
-    console.log(chalk29.red("Usage: bindler check <hostname>"));
-    console.log(chalk29.dim("\nExamples:"));
-    console.log(chalk29.dim("  bindler check myapp.example.com"));
-    console.log(chalk29.dim("  bindler check myapp          # uses project name"));
+    console.log(chalk30.red("Usage: bindler check <hostname>"));
+    console.log(chalk30.dim("\nExamples:"));
+    console.log(chalk30.dim("  bindler check myapp.example.com"));
+    console.log(chalk30.dim("  bindler check myapp          # uses project name"));
     process.exit(1);
   }
   await checkCommand(hostname, options);