bloby-bot 0.17.2

package/bin/cli.js

@@ -0,0 +1,1788 @@
+#!/usr/bin/env node
+
+import { spawn, execSync, spawnSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import readline from 'readline';
+import { fileURLToPath } from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+const REPO_ROOT = path.resolve(__dirname, '..');
+const DATA_DIR = path.join(process.env.BLOBY_REAL_HOME || os.homedir(), '.bloby');
+const IS_DEV = fs.existsSync(path.join(REPO_ROOT, '.git'));
+const ROOT = IS_DEV ? REPO_ROOT : DATA_DIR;
+const CONFIG_PATH = path.join(DATA_DIR, 'config.json');
+const BIN_DIR = path.join(DATA_DIR, 'bin');
+const CF_PATH = path.join(BIN_DIR, 'cloudflared');
+
+const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf-8'));
+const args = process.argv.slice(2);
+const command = args[0];
+const subcommand = args[1];
+const flags = new Set(args.filter(a => a.startsWith('--')));
+const HOSTED = flags.has('--hosted');
+
+// ── Daemon constants & helpers ──
+
+const PLATFORM = os.platform();
+
+// --- systemd (Linux) ---
+const SERVICE_NAME = 'bloby';
+const SERVICE_PATH = `/etc/systemd/system/${SERVICE_NAME}.service`;
+
+function needsSudo() {
+  return process.getuid() !== 0;
+}
+
+function sudoReExec() {
+  const nodePath = process.env.BLOBY_NODE_PATH || process.execPath;
+  const realHome = getRealHome();
+  const args = process.argv.slice(1);
+  const result = spawnSync('sudo', [
+    `BLOBY_NODE_PATH=${nodePath}`,
+    `BLOBY_REAL_HOME=${realHome}`,
+    nodePath, ...args,
+  ], { stdio: 'inherit' });
+  process.exit(result.status ?? 1);
+}
+
+function getRealUser() {
+  return process.env.SUDO_USER || os.userInfo().username;
+}
+
+function getRealHome() {
+  if (process.env.BLOBY_REAL_HOME) return process.env.BLOBY_REAL_HOME;
+  try {
+    return execSync(`getent passwd ${getRealUser()}`, { encoding: 'utf-8' }).split(':')[5];
+  } catch {
+    return os.homedir();
+  }
+}
+
+function isServiceInstalled() {
+  return fs.existsSync(SERVICE_PATH);
+}
+
+function isServiceActive() {
+  try {
+    execSync(`systemctl is-active ${SERVICE_NAME}`, { stdio: 'ignore' });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function generateUnitFile({ user, home, nodePath, dataDir }) {
+  const nodeBinDir = path.dirname(nodePath);
+  return `[Unit]
+Description=Bloby Bot
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=${user}
+WorkingDirectory=${dataDir}
+ExecStart=${nodePath} --import tsx/esm ${dataDir}/supervisor/index.ts
+Restart=on-failure
+RestartSec=5
+Environment=HOME=${home}
+Environment=NODE_ENV=development
+Environment=NODE_PATH=${dataDir}/node_modules
+Environment=PATH=${nodeBinDir}:${dataDir}/node_modules/.bin:/usr/local/bin:/usr/bin:/bin
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=bloby
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+
+// --- launchd (macOS) ---
+const LAUNCHD_LABEL = 'com.bloby.bot';
+const LAUNCHD_PLIST_PATH = path.join(os.homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`);
+const LAUNCHD_LOG_DIR = path.join(os.homedir(), 'Library', 'Logs', 'bloby');
+
+function isLaunchdInstalled() {
+  return fs.existsSync(LAUNCHD_PLIST_PATH);
+}
+
+function isLaunchdActive() {
+  try {
+    const out = execSync(`launchctl list ${LAUNCHD_LABEL} 2>/dev/null`, { encoding: 'utf-8' });
+    // launchctl list <label> succeeds if the job is loaded; check PID field
+    const pidLine = out.split('\n').find(l => l.includes('PID'));
+    if (pidLine) {
+      const pid = pidLine.split('=')[1]?.trim();
+      return pid && pid !== '0' && pid !== '-';
+    }
+    // Fallback: if the command succeeded, it's loaded. Check if the process is running.
+    const lines = out.trim().split('\n');
+    // First line of `launchctl list <label>` output: "PID\tStatus\tLabel" header or direct values
+    // The format is: { "PID" = <pid>; "Status" = <code>; ... }
+    return !out.includes('"PID" = 0;');
+  } catch {
+    return false;
+  }
+}
+
+function generateLaunchdPlist({ nodePath, dataDir }) {
+  const nodeBinDir = path.dirname(nodePath);
+  fs.mkdirSync(LAUNCHD_LOG_DIR, { recursive: true });
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${LAUNCHD_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${nodePath}</string>
+    <string>--import</string>
+    <string>tsx/esm</string>
+    <string>${dataDir}/supervisor/index.ts</string>
+  </array>
+  <key>WorkingDirectory</key>
+  <string>${dataDir}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>HOME</key>
+    <string>${os.homedir()}</string>
+    <key>NODE_ENV</key>
+    <string>development</string>
+    <key>NODE_PATH</key>
+    <string>${dataDir}/node_modules</string>
+    <key>PATH</key>
+    <string>${nodeBinDir}:${dataDir}/node_modules/.bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <dict>
+    <key>SuccessfulExit</key>
+    <false/>
+  </dict>
+  <key>ThrottleInterval</key>
+  <integer>5</integer>
+  <key>StandardOutPath</key>
+  <string>${LAUNCHD_LOG_DIR}/bloby.log</string>
+  <key>StandardErrorPath</key>
+  <string>${LAUNCHD_LOG_DIR}/bloby.log</string>
+  <key>ProcessType</key>
+  <string>Standard</string>
+</dict>
+</plist>
+`;
+}
+
+// --- Platform-agnostic daemon helpers ---
+
+function hasDaemonSupport() {
+  if (PLATFORM === 'darwin') return true; // launchd is always available on macOS
+  if (PLATFORM === 'linux') {
+    try { execSync('systemctl --version', { stdio: 'ignore' }); return true; } catch { return false; }
+  }
+  return false;
+}
+
+function isDaemonInstalled() {
+  if (PLATFORM === 'darwin') return isLaunchdInstalled();
+  if (PLATFORM === 'linux') return isServiceInstalled();
+  return false;
+}
+
+function isDaemonActive() {
+  if (PLATFORM === 'darwin') return isLaunchdActive();
+  if (PLATFORM === 'linux') return isServiceActive();
+  return false;
+}
+
+function killAndWait(child, timeout = 10_000) {
+  return new Promise((resolve) => {
+    child.removeAllListeners('exit');
+    child.on('exit', () => resolve());
+    child.kill('SIGTERM');
+    // Force kill after timeout if SIGTERM doesn't work
+    setTimeout(() => {
+      try { child.kill('SIGKILL'); } catch {}
+      setTimeout(resolve, 500);
+    }, timeout);
+  });
+}
+
+// ── UI helpers ──
+
+const c = {
+  reset: '\x1b[0m',
+  dim: '\x1b[2m',
+  bold: '\x1b[1m',
+  green: '\x1b[32m',
+  cyan: '\x1b[36m',
+  yellow: '\x1b[33m',
+  red: '\x1b[31m',
+  white: '\x1b[97m',
+  blue: '\x1b[38;2;50;165;247m',
+  pink: '\x1b[38;2;219;54;163m',
+};
+
+const SPINNER = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+const BAR_WIDTH = 30;
+
+function gradientChar(i, total) {
+  const t = total > 1 ? i / (total - 1) : 0;
+  const r = Math.round(50 + t * (219 - 50));
+  const g = Math.round(165 + t * (54 - 165));
+  const b = Math.round(247 + t * (163 - 247));
+  return `\x1b[38;2;${r};${g};${b}m`;
+}
+
+function progressBar(ratio, width = BAR_WIDTH) {
+  const filled = Math.round(ratio * width);
+  const empty = width - filled;
+  let bar = '';
+  for (let i = 0; i < filled; i++) bar += `${gradientChar(i, width)}█`;
+  bar += `${c.dim}${'░'.repeat(empty)}${c.reset}`;
+  return bar;
+}
+
+function link(url) {
+  return `\x1b]8;;${url}\x07${url}\x1b]8;;\x07`;
+}
+
+function chooseTunnelMode() {
+  return new Promise((resolve) => {
+    const options = [
+      {
+        label: 'Quick Tunnel',
+        mode: 'quick',
+        tag: 'Easy and Fast',
+        tagColor: c.green,
+        desc: [
+          'Random CloudFlare tunnel URL on every start/update',
+          `Optional: Use Bloby Relay Server and access your bot at ${c.reset}${c.pink}my.bloby.bot/YOURBOT${c.reset}${c.dim} (Free)`,
+          `Or use a premium handle like ${c.reset}${c.pink}bloby.bot/YOURBOT${c.reset}${c.dim} ($5 one-time fee)`,
+        ],
+      },
+      {
+        label: 'Named Tunnel',
+        mode: 'named',
+        tag: 'Advanced',
+        tagColor: c.yellow,
+        desc: [
+          'Persistent URL with your own domain',
+          'Requires a CloudFlare account + domain',
+          `Use a subdomain like ${c.reset}${c.white}bot.YOURDOMAIN.COM${c.reset}${c.dim} or the root domain`,
+        ],
+      },
+      {
+        label: 'Private Network',
+        mode: 'off',
+        tag: 'Secure',
+        tagColor: c.cyan,
+        desc: [
+          'No public URL — access via local network or VPN only',
+          `Use with ${c.reset}${c.white}Tailscale${c.reset}${c.dim}, WireGuard, or any private network`,
+          `Your bot stays invisible to the internet`,
+        ],
+      },
+    ];
+
+    let selected = 0;
+    let lineCount = 0;
+
+    function writeLine(text = '') {
+      process.stdout.write(`\x1b[2K${text}\n`);
+      lineCount++;
+    }
+
+    function render() {
+      // Move cursor up to overwrite previous render
+      if (lineCount > 0) {
+        process.stdout.write(`\x1b[${lineCount}A`);
+      }
+      lineCount = 0;
+
+      writeLine(`  ${c.bold}${c.white}How do you want to connect your bot?${c.reset}`);
+      writeLine();
+
+      for (let i = 0; i < options.length; i++) {
+        const opt = options[i];
+        const isSelected = i === selected;
+        const bullet = isSelected ? `${c.pink}❯` : `${c.dim} `;
+        const label = isSelected ? `${c.bold}${c.white}${opt.label}` : `${c.dim}${opt.label}`;
+        const tag = `${opt.tagColor}[${opt.tag}]${c.reset}`;
+
+        writeLine(`  ${bullet} ${label}${c.reset}  ${tag}`);
+        for (const line of opt.desc) {
+          writeLine(`      ${c.dim}${line}${c.reset}`);
+        }
+        if (i < options.length - 1) writeLine();
+      }
+    }
+
+    render();
+
+    // Enable raw mode for arrow key input
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.setEncoding('utf-8');
+
+    const onKey = (key) => {
+      if (key === '\x1b[A' || key === 'k') { // Up
+        selected = (selected - 1 + options.length) % options.length;
+        render();
+      } else if (key === '\x1b[B' || key === 'j') { // Down
+        selected = (selected + 1) % options.length;
+        render();
+      } else if (key === '\r' || key === '\n') { // Enter
+        process.stdin.setRawMode(false);
+        process.stdin.pause();
+        process.stdin.removeListener('data', onKey);
+        resolve(options[selected].mode);
+      } else if (key === '\x03') { // Ctrl+C
+        process.stdout.write('\n');
+        process.exit(0);
+      }
+    };
+
+    process.stdin.on('data', onKey);
+  });
+}
+
+async function runNamedTunnelSetup() {
+  // Ensure cloudflared is installed
+  console.log(`\n  ${c.blue}⠋${c.reset}  Checking cloudflared...`);
+  await installCloudflared();
+  console.log(`  ${c.blue}✔${c.reset}  cloudflared ready\n`);
+
+  // Login to Cloudflare
+  console.log(`  ${c.bold}${c.white}Step 1:${c.reset} Log in to Cloudflare\n`);
+  console.log(`  ${c.dim}This will open a browser window. Authorize the domain you want to use.${c.reset}\n`);
+  try {
+    spawnSync('cloudflared', ['tunnel', 'login'], { stdio: 'inherit' });
+  } catch {
+    if (fs.existsSync(CF_PATH)) {
+      spawnSync(CF_PATH, ['tunnel', 'login'], { stdio: 'inherit' });
+    } else {
+      console.log(`\n  ${c.red}✗${c.reset}  cloudflared login failed.\n`);
+      process.exit(1);
+    }
+  }
+  console.log('');
+
+  // Ask for tunnel name
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const askQ = (q) => new Promise((r) => rl.question(q, (a) => r(a.trim())));
+
+  const tunnelName = (await askQ(`  ${c.bold}Tunnel name${c.reset} ${c.dim}(default: bloby)${c.reset}: `)) || 'bloby';
+
+  // Create tunnel
+  console.log(`\n  ${c.blue}⠋${c.reset}  Creating tunnel "${tunnelName}"...`);
+  let createOutput;
+  try {
+    createOutput = execSync(`cloudflared tunnel create ${tunnelName}`, { encoding: 'utf-8' });
+  } catch {
+    try {
+      createOutput = execSync(`${CF_PATH} tunnel create ${tunnelName}`, { encoding: 'utf-8' });
+    } catch {
+      console.log(`\n  ${c.red}✗${c.reset}  Failed to create tunnel. It may already exist.`);
+      console.log(`  ${c.dim}Try: cloudflared tunnel list${c.reset}\n`);
+      process.exit(1);
+    }
+  }
+
+  const uuidMatch = createOutput.match(/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/i);
+  if (!uuidMatch) {
+    console.log(`\n  ${c.red}✗${c.reset}  Could not parse tunnel UUID from output.`);
+    console.log(`  ${c.dim}${createOutput}${c.reset}\n`);
+    process.exit(1);
+  }
+  const tunnelUuid = uuidMatch[1];
+  console.log(`  ${c.blue}✔${c.reset}  Tunnel created: ${c.dim}${tunnelUuid}${c.reset}\n`);
+
+  // Ask for domain
+  const domain = await askQ(`  ${c.bold}Your domain${c.reset} ${c.dim}(e.g. bot.mydomain.com)${c.reset}: `);
+  rl.close();
+
+  if (!domain) {
+    console.log(`\n  ${c.red}✗${c.reset}  Domain is required for named tunnels.\n`);
+    process.exit(1);
+  }
+
+  // Generate cloudflared config
+  const config = fs.existsSync(CONFIG_PATH) ? JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')) : {};
+  const port = config.port || 3000;
+  const cfHome = path.join(os.homedir(), '.cloudflared');
+  const cfConfigPath = path.join(DATA_DIR, 'cloudflared-config.yml');
+
+  const yamlContent = `tunnel: ${tunnelUuid}
+credentials-file: ${path.join(cfHome, `${tunnelUuid}.json`)}
+ingress:
+  - service: http://localhost:${port}
+`;
+  fs.mkdirSync(DATA_DIR, { recursive: true });
+  fs.writeFileSync(cfConfigPath, yamlContent);
+  console.log(`\n  ${c.blue}✔${c.reset}  Config written to ${c.dim}${cfConfigPath}${c.reset}`);
+
+  // Print DNS instructions
+  console.log(`\n  ${c.dim}─────────────────────────────────${c.reset}\n`);
+  console.log(`  ${c.bold}${c.white}Tunnel created!${c.reset}`);
+  console.log(`  ${c.white}Add a CNAME record pointing to:${c.reset}\n`);
+  console.log(`  ${c.pink}${c.bold}${tunnelUuid}.cfargotunnel.com${c.reset}\n`);
+  console.log(`  ${c.dim}Or run: cloudflared tunnel route dns ${tunnelName} ${domain}${c.reset}\n`);
+
+  return { tunnelName, domain, cfConfigPath };
+}
+
+class Stepper {
+  constructor(steps) {
+    this.steps = steps;
+    this.current = 0;
+    this.frame = 0;
+    this.interval = null;
+    this.done = false;
+    this.infoLines = [];   // extra lines shown below the progress bar
+    this._totalLines = 0;  // total lines rendered last frame (for cursor rewind)
+  }
+
+  start() {
+    console.log('');
+    this.interval = setInterval(() => {
+      this.frame = (this.frame + 1) % SPINNER.length;
+      this.render();
+    }, 80);
+    this.render();
+  }
+
+  setInfo(lines) {
+    this.infoLines = lines || [];
+    this.render();
+  }
+
+  render() {
+    if (this.done) return;
+
+    if (this._totalLines > 0) {
+      process.stdout.write(`\x1b[${this._totalLines}A`);
+    }
+
+    const ratio = this.current / this.steps.length;
+
+    for (let i = 0; i < this.steps.length; i++) {
+      if (i < this.current) {
+        console.log(`  ${c.blue}✔${c.reset}  ${this.steps[i]}`);
+      } else if (i === this.current) {
+        console.log(`  ${c.pink}${SPINNER[this.frame]}${c.reset}  ${this.steps[i]}${c.dim}...${c.reset}`);
+      } else {
+        console.log(`  ${c.dim}○  ${this.steps[i]}${c.reset}`);
+      }
+    }
+
+    console.log(`\n  ${progressBar(ratio)}  ${c.dim}${Math.round(ratio * 100)}%${c.reset}`);
+
+    // steps + blank + progress = steps.length + 2, plus info lines
+    let lineCount = this.steps.length + 2;
+
+    if (this.infoLines.length) {
+      console.log('');
+      for (const line of this.infoLines) {
+        console.log(line);
+      }
+      lineCount += 1 + this.infoLines.length;
+    }
+
+    this._totalLines = lineCount;
+  }
+
+  advance() {
+    this.current++;
+    this.render();
+  }
+
+  finish() {
+    this.done = true;
+    if (this.interval) clearInterval(this.interval);
+
+    if (this._totalLines > 0) {
+      process.stdout.write(`\x1b[${this._totalLines}A`);
+    }
+    // Clear all previously rendered lines
+    for (let i = 0; i < this._totalLines; i++) {
+      process.stdout.write('\x1b[2K\n');
+    }
+    process.stdout.write(`\x1b[${this._totalLines}A`);
+
+    for (const step of this.steps) {
+      console.log(`  ${c.blue}✔${c.reset}  ${step}`);
+    }
+    console.log(`\n  ${progressBar(1)}  ${c.pink}Done${c.reset}`);
+  }
+}
+
+function banner() {
+  console.log(`
+  ${c.blue}${c.bold}    _______ _                    ${c.reset}
+  ${c.blue}${c.bold}   (_______) |                   ${c.reset}
+  ${c.blue}${c.bold}    _____  | |_   _ _   _ _   _  ${c.reset}
+  ${c.blue}${c.bold}   |  ___) | | | | ( \\ / ) | | | ${c.reset}
+  ${c.pink}${c.bold}   | |     | | |_| |) X (| |_| | ${c.reset}
+  ${c.pink}${c.bold}   |_|     |_|\\____(_/ \\_)\\__  | ${c.reset}
+  ${c.pink}${c.bold}                         (____/   ${c.reset}
+  ${c.dim}v${pkg.version} · Self-hosted AI agent${c.reset}`);
+}
+
+function getNetworkUrls(port) {
+  const urls = [];
+  const nets = os.networkInterfaces();
+  for (const [name, addrs] of Object.entries(nets)) {
+    for (const addr of addrs) {
+      if (addr.family !== 'IPv4' || addr.internal) continue;
+      const ip = addr.address;
+      // Tailscale uses 100.64.0.0/10 (CGNAT range)
+      if (ip.startsWith('100.')) {
+        urls.push({ type: 'tailscale', url: `http://${ip}:${port}`, ip });
+      } else if (ip.startsWith('192.168.') || ip.startsWith('10.') || ip.match(/^172\.(1[6-9]|2\d|3[01])\./)) {
+        urls.push({ type: 'lan', url: `http://${ip}:${port}`, ip });
+      }
+    }
+  }
+  return urls;
+}
+
+function privateNetworkMessage(port) {
+  const urls = getNetworkUrls(port);
+  const tailscale = urls.find(u => u.type === 'tailscale');
+  const lan = urls.find(u => u.type === 'lan');
+
+  console.log(`
+  ${c.dim}─────────────────────────────────${c.reset}
+
+  ${c.bold}${c.white}Open your dashboard to finish setup:${c.reset}
+`);
+
+  if (tailscale) {
+    console.log(`  ${c.cyan}${c.bold}${link(tailscale.url)}${c.reset}  ${c.dim}(Tailscale)${c.reset}`);
+  }
+  if (lan) {
+    console.log(`  ${c.blue}${c.bold}${link(lan.url)}${c.reset}  ${c.dim}(Local network)${c.reset}`);
+  }
+  console.log(`  ${c.dim}${link(`http://localhost:${port}`)}${c.reset}  ${c.dim}(This machine)${c.reset}`);
+
+  if (!tailscale && !lan) {
+    console.log(`
+  ${c.dim}Tip: Install Tailscale to access from other devices:${c.reset}
+  ${c.dim}https://tailscale.com/download${c.reset}`);
+  }
+
+  if (hasDaemonSupport()) {
+    console.log(`
+  ${c.dim}─────────────────────────────────${c.reset}
+
+  ${c.bold}${c.white}Commands:${c.reset}
+  ${c.dim}Status${c.reset}    ${c.pink}bloby status${c.reset}
+  ${c.dim}Logs${c.reset}      ${c.pink}bloby logs${c.reset}
+  ${c.dim}Stop${c.reset}      ${c.pink}bloby stop${c.reset}
+  ${c.dim}Restart${c.reset}   ${c.pink}bloby daemon restart${c.reset}
+  ${c.dim}Update${c.reset}    ${c.pink}bloby update${c.reset}
+  `);
+  } else {
+    console.log(`
+  ${c.dim}─────────────────────────────────${c.reset}
+
+  ${c.bold}${c.white}Commands:${c.reset}
+  ${c.dim}Status${c.reset}    ${c.pink}bloby status${c.reset}
+  ${c.dim}Update${c.reset}    ${c.pink}bloby update${c.reset}
+
+  ${c.dim}Press Ctrl+C to stop${c.reset}
+  `);
+  }
+}
+
+function tunnelFailedMessage(localUrl) {
+  console.log(`
+  ${c.dim}─────────────────────────────────${c.reset}
+
+  ${c.yellow}⚠${c.reset}  ${c.bold}${c.white}Tunnel failed to connect${c.reset}
+
+  ${c.dim}CloudFlare quick tunnels are rate-limited.${c.reset}
+  ${c.dim}This usually resolves itself after a few minutes.${c.reset}
+
+  ${c.bold}${c.white}Your dashboard is available locally:${c.reset}
+
+  ${c.blue}${c.bold}${link(localUrl)}${c.reset}
+  ${c.dim}(cmd+click or ctrl+click to open)${c.reset}
+
+  ${c.bold}${c.white}To retry the tunnel:${c.reset}
+  ${c.pink}bloby start${c.reset}
+
+  ${c.bold}${c.white}For a persistent tunnel, use a named tunnel:${c.reset}
+  ${c.pink}bloby tunnel setup${c.reset}
+`);
+}
+
+function finalMessage(tunnelUrl, relayUrl) {
+  console.log(`
+  ${c.dim}─────────────────────────────────${c.reset}
+
+  ${c.bold}${c.white}Open your dashboard to finish setup:${c.reset}
+
+  ${c.blue}${c.bold}${link(tunnelUrl)}${c.reset}
+  ${c.dim}(cmd+click or ctrl+click to open)${c.reset}`);
+
+  if (relayUrl && relayUrl !== tunnelUrl) {
+    console.log(`
+  ${c.bold}${c.white}Your permanent URL:${c.reset}
+
+  ${c.pink}${c.bold}${link(relayUrl)}${c.reset}`);
+  }
+
+  if (hasDaemonSupport()) {
+    console.log(`
+  ${c.dim}─────────────────────────────────${c.reset}
+
+  ${c.bold}${c.white}Commands:${c.reset}
+  ${c.dim}Status${c.reset}    ${c.pink}bloby status${c.reset}
+  ${c.dim}Logs${c.reset}      ${c.pink}bloby logs${c.reset}
+  ${c.dim}Stop${c.reset}      ${c.pink}bloby stop${c.reset}
+  ${c.dim}Restart${c.reset}   ${c.pink}bloby daemon restart${c.reset}
+  ${c.dim}Update${c.reset}    ${c.pink}bloby update${c.reset}
+  `);
+  } else {
+    console.log(`
+  ${c.dim}─────────────────────────────────${c.reset}
+
+  ${c.bold}${c.white}Commands:${c.reset}
+  ${c.dim}Status${c.reset}    ${c.pink}bloby status${c.reset}
+  ${c.dim}Update${c.reset}    ${c.pink}bloby update${c.reset}
+
+  ${c.dim}Press Ctrl+C to stop${c.reset}
+  `);
+  }
+}
+
+function writeVersionFile(version) {
+  try { fs.writeFileSync(path.join(DATA_DIR, 'VERSION'), version); } catch {}
+}
+
+// ── Steps ──
+
+function createConfig() {
+  fs.mkdirSync(DATA_DIR, { recursive: true });
+  if (!fs.existsSync(CONFIG_PATH)) {
+    const config = {
+      port: 3000,
+      username: '',
+      ai: { provider: '', model: '', apiKey: '' },
+      tunnel: { mode: 'quick' },
+      relay: { token: '', tier: '', url: '' },
+    };
+    fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2));
+  }
+}
+
+const MIN_CF_SIZE = 10 * 1024 * 1024; // 10 MB — valid cloudflared is ~30-50 MB
+
+function hasCloudflared() {
+  // Check system-wide install
+  const which = process.platform === 'win32' ? 'where cloudflared' : 'which cloudflared';
+  try { execSync(which, { stdio: 'ignore' }); return true; } catch {}
+
+  // Check local install (validate by file size, never execute — avoids Windows popup)
+  const cfExe = process.platform === 'win32' ? CF_PATH + '.exe' : CF_PATH;
+  if (!fs.existsSync(cfExe)) return false;
+  const size = fs.statSync(cfExe).size;
+  if (size < MIN_CF_SIZE) {
+    fs.unlinkSync(cfExe);
+    return false;
+  }
+  return true;
+}
+
+async function installCloudflared() {
+  if (hasCloudflared()) return;
+
+  fs.mkdirSync(BIN_DIR, { recursive: true });
+
+  const platform = os.platform();
+  // os.arch() returns Node's arch, not the OS. Use PROCESSOR_ARCHITECTURE on Windows for real OS arch.
+  const arch = platform === 'win32'
+    ? (process.env.PROCESSOR_ARCHITECTURE || os.arch()).toLowerCase()
+    : os.arch();
+  let url;
+
+  if (platform === 'win32') {
+    url = arch.includes('arm')
+      ? 'https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-arm64.exe'
+      : 'https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.exe';
+  } else if (platform === 'darwin') {
+    url = arch === 'arm64'
+      ? 'https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-darwin-arm64.tgz'
+      : 'https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-darwin-amd64.tgz';
+  } else if (platform === 'linux') {
+    if (arch === 'arm64' || arch === 'aarch64') {
+      url = 'https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm64';
+    } else if (arch === 'arm' || arch === 'armv7l') {
+      url = 'https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm';
+    } else {
+      url = 'https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64';
+    }
+  } else {
+    throw new Error(`Unsupported platform: ${platform}/${arch}`);
+  }
+
+  if (platform === 'win32') {
+    const dest = CF_PATH + '.exe';
+    execSync(`curl.exe -fsSL -o "${dest}" "${url}"`, { stdio: 'ignore' });
+  } else if (url.endsWith('.tgz')) {
+    execSync(`curl -fsSL "${url}" | tar xz -C "${BIN_DIR}"`, { stdio: 'ignore' });
+  } else {
+    execSync(`curl -fsSL -o "${CF_PATH}" "${url}"`, { stdio: 'ignore' });
+    fs.chmodSync(CF_PATH, 0o755);
+  }
+}
+
+// ── Boot server ──
+
+function bootServer({ onTunnelUp, onReady } = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(
+      process.execPath,
+      ['--import', 'tsx/esm', path.join(ROOT, 'supervisor/index.ts')],
+      { cwd: ROOT, stdio: ['ignore', 'pipe', 'pipe'], env: { ...process.env } },
+    );
+
+    let tunnelUrl = null;
+    let relayUrl = null;
+    let resolved = false;
+    let stderrBuf = '';
+    let tunnelFired = false;
+    let tunnelFailed = false;
+
+    // Vite warmup tracking
+    let viteWarmResolve;
+    const viteWarm = new Promise((r) => { viteWarmResolve = r; });
+
+    const doResolve = () => {
+      if (resolved) return;
+      resolved = true;
+      if (!tunnelFired && onTunnelUp) onTunnelUp();
+      if (onReady) onReady();
+      const config = JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8'));
+      resolve({
+        child,
+        tunnelUrl: tunnelUrl || `http://localhost:${config.port}`,
+        relayUrl: relayUrl || config.relay?.url || null,
+        tunnelFailed,
+        viteWarm,
+      });
+    };
+
+    const handleData = (data) => {
+      const text = data.toString();
+
+      const tunnelMatch = text.match(/__TUNNEL_URL__=(\S+)/);
+      if (tunnelMatch) {
+        tunnelUrl = tunnelMatch[1];
+        if (!tunnelFired && onTunnelUp) { tunnelFired = true; onTunnelUp(tunnelUrl); }
+      }
+
+      const relayMatch = text.match(/__RELAY_URL__=(\S+)/);
+      if (relayMatch) relayUrl = relayMatch[1];
+
+      if (text.includes('__VITE_WARM__')) {
+        viteWarmResolve();
+      }
+
+      if (text.includes('__READY__')) {
+        doResolve();
+        return;
+      }
+
+      if (text.includes('__TUNNEL_FAILED__')) {
+        tunnelFailed = true;
+        doResolve();
+      }
+    };
+
+    // Safety-net timeout: resolve after 45s even if __READY__ never arrives
+    setTimeout(doResolve, 45_000);
+
+    child.stdout.on('data', handleData);
+    child.stderr.on('data', (data) => {
+      stderrBuf += data.toString();
+      handleData(data);
+    });
+
+    process.on('SIGINT', () => child.kill('SIGINT'));
+    process.on('SIGTERM', () => child.kill('SIGTERM'));
+
+    child.on('exit', (code) => {
+      if (!resolved) {
+        reject(new Error(stderrBuf.trim() || `Server exited with code ${code}`));
+      } else {
+        process.exit(code ?? 1);
+      }
+    });
+  });
+}
+
+// ── Main flows ──
+
+async function init() {
+  if (!HOSTED) banner();
+
+  createConfig();
+  writeVersionFile(pkg.version);
+
+  // --hosted: non-interactive, quick tunnel, no prompts
+  const tunnelMode = HOSTED ? 'quick' : await (async () => {
+    console.log('');
+    const mode = await chooseTunnelMode();
+    console.log('');
+    return mode;
+  })();
+
+  // Update config with chosen mode + generate wallet if needed
+  const config = JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8'));
+
+  // Generate USDC wallet (skip if one already exists)
+  if (!config.wallet?.privateKey) {
+    const { generatePrivateKey, privateKeyToAccount } = await import('viem/accounts');
+    const privateKey = generatePrivateKey();
+    const account = privateKeyToAccount(privateKey);
+    config.wallet = { privateKey, address: account.address };
+  }
+
+  // Handle named tunnel setup before starting
+  if (tunnelMode === 'named') {
+    const setup = await runNamedTunnelSetup();
+    config.tunnel = {
+      mode: 'named',
+      name: setup.tunnelName,
+      domain: setup.domain,
+      configPath: setup.cfConfigPath,
+    };
+  } else {
+    config.tunnel = { mode: tunnelMode };
+  }
+  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2));
+
+  const canDaemon = hasDaemonSupport();
+  const hasTunnelInit = tunnelMode !== 'off';
+
+  // Hosted mode: simple log lines instead of animated stepper
+  const log = HOSTED
+    ? (msg) => console.log(`[bloby] ${msg}`)
+    : null;
+
+  const steps = [
+    'Creating config',
+    ...(hasTunnelInit ? ['Installing cloudflared'] : []),
+    'Starting server',
+    ...(hasTunnelInit ? ['Connecting tunnel', 'Verifying connection'] : []),
+    'Preparing dashboard',
+    ...(canDaemon ? ['Setting up auto-start daemon'] : []),
+  ];
+
+  const stepper = HOSTED ? null : new Stepper(steps);
+  if (stepper) stepper.start();
+
+  // Config already created
+  if (log) log('Config created');
+  if (stepper) stepper.advance();
+
+  // Cloudflared (skip for named — already installed during setup, skip for off — no tunnel)
+  if (hasTunnelInit && tunnelMode !== 'named') {
+    if (log) log('Installing cloudflared...');
+    await installCloudflared();
+    if (log) log('Cloudflared ready');
+  }
+  if (hasTunnelInit && stepper) stepper.advance();
+
+  // Server + Tunnel
+  if (log) log('Starting server...');
+  if (stepper) stepper.advance();
+  let result;
+  try {
+    result = await bootServer({
+      onTunnelUp: hasTunnelInit ? (url) => {
+        if (log) log(`Tunnel up: ${url}`);
+        if (stepper) {
+          stepper.advance();  // Connecting tunnel done
+          if (config.relay?.url) {
+            stepper.setInfo([
+              `  ${c.dim}Waiting for ${c.reset}${c.white}${config.relay.url.replace('https://', '')}${c.reset}${c.dim} to become reachable (can take up to 2 min)${c.reset}`,
+              `  ${c.dim}In the meanwhile you can access:${c.reset} ${c.blue}${link(url)}${c.reset}`,
+            ]);
+          }
+        }
+      } : undefined,
+      onReady: hasTunnelInit ? () => {
+        if (log) log('Connection verified');
+        if (stepper) {
+          stepper.setInfo([]);
+          stepper.advance();  // Verifying connection done
+        }
+      } : undefined,
+    });
+  } catch (err) {
+    if (stepper) stepper.finish();
+    if (HOSTED) {
+      console.error(JSON.stringify({ error: err.message }));
+      process.exit(1);
+    }
+    console.error(`\n  ${c.red}Server failed to start:${c.reset}`);
+    console.error(`  ${c.dim}${err.message}${c.reset}\n`);
+    process.exit(1);
+  }
+  let { child, tunnelUrl, relayUrl, tunnelFailed, viteWarm } = result;
+
+  // Wait for Vite to finish pre-transforming all modules (with timeout)
+  if (log) log('Preparing dashboard...');
+  await Promise.race([viteWarm, new Promise(r => setTimeout(r, 30_000))]);
+  if (stepper) stepper.advance();
+
+  // Install daemon (systemd on Linux, launchd on macOS)
+  if (canDaemon) {
+    if (log) log('Installing daemon...');
+    await killAndWait(child);
+    const nodePath = process.execPath;
+    const realHome = os.homedir();
+    const res = spawnSync(process.execPath, [process.argv[1], 'daemon', 'install'], {
+      stdio: 'pipe',  // Suppress subprocess output — stepper handles UI
+      env: { ...process.env, BLOBY_NODE_PATH: nodePath, BLOBY_REAL_HOME: realHome },
+    });
+
+    // Wait for the daemon's supervisor to get a new tunnel URL
+    // (the old one died with the temp server we just killed)
+    if (res.status === 0 && hasTunnelInit) {
+      if (log) log('Waiting for daemon tunnel URL...');
+      let daemonTunnelUrl = null;
+      for (let i = 0; i < 30; i++) {
+        await new Promise((r) => setTimeout(r, 1000));
+        try {
+          const cfg = JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8'));
+          if (cfg.tunnelUrl && cfg.tunnelUrl !== tunnelUrl) {
+            daemonTunnelUrl = cfg.tunnelUrl;
+            break;
+          }
+        } catch {}
+      }
+      if (daemonTunnelUrl) tunnelUrl = daemonTunnelUrl;
+      // Also pick up relay URL that may have been saved earlier
+      try {
+        const cfg = JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8'));
+        if (cfg.relay?.url) relayUrl = cfg.relay.url;
+      } catch {}
+    }
+
+    if (stepper) {
+      stepper.advance();
+      stepper.finish();
+    }
+
+    if (HOSTED) {
+      // Machine-readable output for the provisioning script
+      const result = { tunnelUrl, status: tunnelFailed ? 'tunnel_failed' : 'ok' };
+      if (res.status === 0) result.daemon = true;
+      console.log(`__HOSTED_READY__=${JSON.stringify(result)}`);
+      process.exit(res.status ?? 0);
+    }
+
+    if (!hasTunnelInit) {
+      privateNetworkMessage(config.port);
+    } else if (tunnelFailed) {
+      tunnelFailedMessage(tunnelUrl);
+    } else {
+      finalMessage(tunnelUrl, relayUrl);
+    }
+    if (res.status === 0) {
+      console.log(`  ${c.blue}✔${c.reset}  Daemon installed — Bloby will auto-start on ${PLATFORM === 'darwin' ? 'login' : 'boot'}.`);
+    } else {
+      console.log(`  ${c.yellow}⚠${c.reset}  Daemon install failed. Run ${c.pink}bloby daemon install${c.reset} manually.`);
+    }
+    console.log('');
+    process.exit(res.status ?? 0);
+  }
+
+  if (stepper) stepper.finish();
+  if (HOSTED) {
+    const result = { tunnelUrl, status: tunnelFailed ? 'tunnel_failed' : 'ok' };
+    console.log(`__HOSTED_READY__=${JSON.stringify(result)}`);
+  } else if (!hasTunnelInit) {
+    privateNetworkMessage(config.port);
+  } else if (tunnelFailed) {
+    tunnelFailedMessage(tunnelUrl);
+  } else {
+    finalMessage(tunnelUrl, relayUrl);
+  }
+
+  child.stdout.on('data', (d) => {
+    process.stdout.write(`  ${c.dim}${d.toString().trim()}${c.reset}\n`);
+  });
+  child.stderr.on('data', (d) => {
+    const line = d.toString().trim();
+    if (!line || line.includes('AssignProcessToJobObject')) return;
+    process.stderr.write(`  ${c.dim}${line}${c.reset}\n`);
+  });
+}
+
+async function start() {
+  if (!fs.existsSync(CONFIG_PATH)) {
+    return init();
+  }
+
+  // If daemon is already running, don't start a second instance
+  if (isDaemonInstalled() && isDaemonActive()) {
+    banner();
+    const config = JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8'));
+    console.log(`\n  ${c.blue}●${c.reset} Bloby is already running as a daemon.\n`);
+    if (config.relay?.url) {
+      console.log(`  ${c.dim}URL:${c.reset}       ${c.pink}${link(config.relay.url)}${c.reset}`);
+    }
+    console.log(`  ${c.dim}Status:${c.reset}    ${c.pink}bloby daemon status${c.reset}`);
+    console.log(`  ${c.dim}Logs:${c.reset}      ${c.pink}bloby daemon logs${c.reset}`);
+    console.log(`  ${c.dim}Restart:${c.reset}   ${c.pink}bloby daemon restart${c.reset}`);
+    console.log(`  ${c.dim}Stop:${c.reset}      ${c.pink}bloby daemon stop${c.reset}\n`);
+    return;
+  }
+
+  const canDaemon = hasDaemonSupport();
+  const needsDaemon = canDaemon && !isDaemonInstalled();
+
+  banner();
+
+  const config = JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8'));
+  const tunnelMode = config.tunnel?.mode ?? (config.tunnel?.enabled === false ? 'off' : 'quick');
+  const hasTunnel = tunnelMode !== 'off';
+
+  const steps = [
+    'Loading config',
+    'Starting server',
+    ...(hasTunnel ? ['Connecting tunnel', 'Verifying connection'] : []),
+    'Preparing dashboard',
+    ...(needsDaemon ? ['Setting up auto-start daemon'] : []),
+  ];
+  const stepper = new Stepper(steps);
+  stepper.start();
+
+  stepper.advance(); // config exists
+  stepper.advance(); // starting
+
+  let result;
+  try {
+    result = await bootServer({
+      onTunnelUp: (url) => {
+        if (!hasTunnel) return;
+        stepper.advance();  // Connecting tunnel done
+        if (config.relay?.url) {
+          stepper.setInfo([
+            `  ${c.dim}Waiting for ${c.reset}${c.white}${config.relay.url.replace('https://', '')}${c.reset}${c.dim} to become reachable (can take up to 2 min)${c.reset}`,
+            `  ${c.dim}In the meanwhile you can access:${c.reset} ${c.blue}${link(url)}${c.reset}`,
+          ]);
+        }
+      },
+      onReady: () => {
+        if (!hasTunnel) return;
+        stepper.setInfo([]);
+        stepper.advance();  // Verifying connection done
+      },
+    });
+  } catch (err) {
+    stepper.finish();
+    console.error(`\n  ${c.red}Server failed to start:${c.reset}`);
+    console.error(`  ${c.dim}${err.message}${c.reset}\n`);
+    process.exit(1);
+  }
+  let { child, tunnelUrl, relayUrl, tunnelFailed, viteWarm } = result;
+
+  // Wait for Vite to finish pre-transforming all modules (with timeout)
+  await Promise.race([viteWarm, new Promise(r => setTimeout(r, 30_000))]);
+  stepper.advance();
+
+  // Install daemon (systemd on Linux, launchd on macOS) if not already installed
+  if (needsDaemon) {
+    await killAndWait(child);
+    const nodePath = process.execPath;
+    const realHome = os.homedir();
+    const res = spawnSync(process.execPath, [process.argv[1], 'daemon', 'install'], {
+      stdio: 'pipe',  // Suppress subprocess output — stepper handles UI
+      env: { ...process.env, BLOBY_NODE_PATH: nodePath, BLOBY_REAL_HOME: realHome },
+    });
+
+    // Wait for the daemon's supervisor to get a new tunnel URL
+    if (res.status === 0 && hasTunnel) {
+      let daemonTunnelUrl = null;
+      for (let i = 0; i < 30; i++) {
+        await new Promise((r) => setTimeout(r, 1000));
+        try {
+          const cfg = JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8'));
+          if (cfg.tunnelUrl && cfg.tunnelUrl !== tunnelUrl) {
+            daemonTunnelUrl = cfg.tunnelUrl;
+            break;
+          }
+        } catch {}
+      }
+      if (daemonTunnelUrl) tunnelUrl = daemonTunnelUrl;
+      try {
+        const cfg = JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8'));
+        if (cfg.relay?.url) relayUrl = cfg.relay.url;
+      } catch {}
+    }
+
+    stepper.advance();
+    stepper.finish();
+    if (!hasTunnel) {
+      privateNetworkMessage(config.port);
+    } else if (tunnelFailed) {
+      tunnelFailedMessage(tunnelUrl);
+    } else {
+      finalMessage(tunnelUrl, relayUrl);
+    }
+    if (res.status === 0) {
+      console.log(`  ${c.blue}✔${c.reset}  Daemon installed — Bloby will auto-start on ${PLATFORM === 'darwin' ? 'login' : 'boot'}.`);
+    } else {
+      console.log(`  ${c.yellow}⚠${c.reset}  Daemon install failed. Run ${c.pink}bloby daemon install${c.reset} manually.`);
+    }
+    console.log('');
+    process.exit(res.status ?? 0);
+  }
+
+  stepper.finish();
+  if (!hasTunnel) {
+    privateNetworkMessage(config.port);
+  } else if (tunnelFailed) {
+    tunnelFailedMessage(tunnelUrl);
+  } else {
+    finalMessage(tunnelUrl, relayUrl);
+  }
+
+  child.stdout.on('data', (d) => {
+    process.stdout.write(`  ${c.dim}${d.toString().trim()}${c.reset}\n`);
+  });
+  child.stderr.on('data', (d) => {
+    const line = d.toString().trim();
+    if (!line || line.includes('AssignProcessToJobObject')) return;
+    process.stderr.write(`  ${c.dim}${line}${c.reset}\n`);
+  });
+}
+
+async function status() {
+  const config = fs.existsSync(CONFIG_PATH) ? JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')) : null;
+  const daemonRunning = isDaemonInstalled() && isDaemonActive();
+
+  // Try health endpoint
+  let healthOk = false;
+  let uptime = null;
+  if (config) {
+    try {
+      const res = await fetch(`http://localhost:${config.port}/api/health`);
+      const data = await res.json();
+      healthOk = true;
+      uptime = data.uptime;
+    } catch {}
+  }
+
+  if (healthOk) {
+    console.log(`\n  ${c.blue}●${c.reset} Bloby is running${daemonRunning ? ` ${c.dim}(daemon)${c.reset}` : ''}`);
+    if (uptime != null) console.log(`  ${c.dim}Uptime: ${uptime}s${c.reset}`);
+    if (config?.tunnelUrl) {
+      console.log(`  ${c.dim}Tunnel: ${c.reset}${c.blue}${link(config.tunnelUrl)}${c.reset}`);
+    }
+    if (config?.relay?.url) {
+      console.log(`  ${c.dim}Relay: ${c.reset}${c.pink}${link(config.relay.url)}${c.reset}`);
+    }
+    console.log(`  ${c.dim}Config: ${CONFIG_PATH}${c.reset}\n`);
+  } else if (daemonRunning) {
+    console.log(`\n  ${c.yellow}●${c.reset} Bloby daemon is running but not responding yet.`);
+    console.log(`  ${c.dim}It may still be starting up. Check logs:${c.reset}`);
+    console.log(`  ${c.pink}bloby daemon logs${c.reset}\n`);
+  } else {
+    console.log(`\n  ${c.dim}●${c.reset} Bloby is not running.\n`);
+  }
+}
+
+async function update() {
+  banner();
+
+  // Refuse to run the update as root — file ownership would get poisoned
+  if (os.platform() !== 'win32' && process.getuid?.() === 0) {
+    console.log(`\n  ${c.red}✗${c.reset}  Do not run ${c.bold}bloby update${c.reset} with sudo.`);
+    console.log(`    The update manages sudo internally for daemon commands.\n`);
+    process.exit(1);
+  }
+
+  const currentVersion = pkg.version;
+  console.log(`\n  ${c.dim}Current version: v${currentVersion}${c.reset}`);
+  console.log(`  ${c.blue}⠋${c.reset}  Checking for updates...\n`);
+
+  // Fetch latest package info from npm registry
+  let latest;
+  try {
+    const res = await fetch('https://registry.npmjs.org/bloby/latest');
+    if (!res.ok) throw new Error();
+    latest = await res.json();
+  } catch {
+    console.log(`  ${c.red}✗${c.reset}  Failed to check for updates\n`);
+    process.exit(1);
+  }
+
+  if (currentVersion === latest.version) {
+    console.log(`  ${c.blue}✔${c.reset}  Already up to date (v${currentVersion})\n`);
+    return;
+  }
+
+  console.log(`  ${c.dim}v${currentVersion} → v${latest.version}${c.reset}\n`);
+
+  // When triggered by the supervisor (BLOBY_SELF_UPDATE=1), skip daemon stop/restart —
+  // the supervisor will exit after we finish, and the daemon manager restarts it.
+  const selfUpdate = !!process.env.BLOBY_SELF_UPDATE;
+  const daemonWasRunning = !selfUpdate && isDaemonInstalled() && isDaemonActive();
+
+  const steps = [
+    'Downloading update',
+    ...(daemonWasRunning ? ['Stopping daemon'] : []),
+    'Updating files',
+    'Installing dependencies',
+    'Building interface',
+    ...(daemonWasRunning ? ['Restarting daemon'] : []),
+  ];
+
+  const stepper = new Stepper(steps);
+  stepper.start();
+
+  // Download tarball FIRST — before stopping daemon, so failure doesn't leave bot offline
+  const tarballUrl = latest.dist.tarball;
+  const tmpDir = path.join(os.tmpdir(), `bloby-update-${Date.now()}`);
+  fs.mkdirSync(tmpDir, { recursive: true });
+  const tarball = path.join(tmpDir, 'bloby.tgz');
+
+  try {
+    const res = await fetch(tarballUrl);
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    const buf = Buffer.from(await res.arrayBuffer());
+    fs.writeFileSync(tarball, buf);
+    execSync(`tar xzf "${tarball}" -C "${tmpDir}"`, { stdio: 'ignore' });
+  } catch (e) {
+    stepper.finish();
+    console.log(`\n  ${c.red}✗${c.reset}  Download failed: ${e.message}\n`);
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+    process.exit(1);
+  }
+  stepper.advance();
+
+  // Stop daemon AFTER download succeeds — minimizes downtime
+  // Skipped during self-update (supervisor handles restart via process exit)
+  if (daemonWasRunning) {
+    try {
+      if (PLATFORM === 'darwin') {
+        execSync(`launchctl unload "${LAUNCHD_PLIST_PATH}"`, { stdio: 'ignore' });
+      } else {
+        const cmd = needsSudo() ? `sudo systemctl stop ${SERVICE_NAME}` : `systemctl stop ${SERVICE_NAME}`;
+        execSync(cmd, { stdio: 'ignore' });
+      }
+    } catch (e) {
+      console.log(`  ${c.yellow}⚠${c.reset}  Could not stop daemon: ${e.message}`);
+    }
+    stepper.advance();
+  }
+
+  const extracted = path.join(tmpDir, 'package');
+
+  // Update code directories (preserve workspace/ user data)
+  try {
+    for (const dir of ['bin', 'supervisor', 'worker', 'shared', 'scripts']) {
+      const src = path.join(extracted, dir);
+      if (fs.existsSync(src)) {
+        fs.cpSync(src, path.join(DATA_DIR, dir), { recursive: true, force: true });
+      }
+    }
+
+    // Copy workspace template only if it doesn't exist yet
+    if (!fs.existsSync(path.join(DATA_DIR, 'workspace'))) {
+      const wsSrc = path.join(extracted, 'workspace');
+      if (fs.existsSync(wsSrc)) {
+        fs.cpSync(wsSrc, path.join(DATA_DIR, 'workspace'), { recursive: true });
+      }
+    }
+
+    // Update code files (never touches config.json, memory.db, etc.)
+    for (const file of ['package.json', 'vite.config.ts', 'vite.bloby.config.ts', 'tsconfig.json', 'postcss.config.js', 'components.json']) {
+      const src = path.join(extracted, file);
+      if (fs.existsSync(src)) {
+        fs.copyFileSync(src, path.join(DATA_DIR, file));
+      }
+    }
+
+    // Update pre-built UI from tarball
+    const distSrc = path.join(extracted, 'dist-bloby');
+    if (fs.existsSync(distSrc)) {
+      const dst = path.join(DATA_DIR, 'dist-bloby');
+      if (fs.existsSync(dst)) fs.rmSync(dst, { recursive: true });
+      fs.cpSync(distSrc, dst, { recursive: true });
+    }
+  } catch (e) {
+    console.log(`  ${c.red}✗${c.reset}  File copy failed: ${e.message}`);
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+    process.exit(1);
+  }
+
+  stepper.advance();
+
+  const distDst = path.join(DATA_DIR, 'dist-bloby');
+
+  // Install dependencies (5 min timeout to prevent hanging forever)
+  try {
+    execSync('npm install --omit=dev', { cwd: DATA_DIR, stdio: 'ignore', timeout: 300_000 });
+  } catch (e) {
+    console.log(`  ${c.yellow}⚠${c.reset}  npm install issue: ${e.message}`);
+  }
+  stepper.advance();
+
+  // Rebuild UI if not in tarball
+  if (!fs.existsSync(path.join(distDst, 'onboard.html'))) {
+    try {
+      if (fs.existsSync(distDst)) fs.rmSync(distDst, { recursive: true });
+      execSync('npm run build:bloby', { cwd: DATA_DIR, stdio: 'ignore', timeout: 300_000 });
+    } catch {}
+  }
+  stepper.advance();
+
+  // Read release notes and write version before cleanup
+  let releaseNotes = '';
+  try {
+    const newPkg = JSON.parse(fs.readFileSync(path.join(extracted, 'package.json'), 'utf-8'));
+    releaseNotes = newPkg.releaseNotes || '';
+  } catch {}
+  writeVersionFile(latest.version);
+
+  // Clean up
+  fs.rmSync(tmpDir, { recursive: true, force: true });
+
+  // Restart daemon if it was running (skipped during self-update)
+  if (daemonWasRunning) {
+    try {
+      if (PLATFORM === 'darwin') {
+        execSync(`launchctl load "${LAUNCHD_PLIST_PATH}"`, { stdio: 'ignore' });
+      } else {
+        const cmd = needsSudo() ? `sudo systemctl start ${SERVICE_NAME}` : `systemctl start ${SERVICE_NAME}`;
+        execSync(cmd, { stdio: 'ignore' });
+      }
+    } catch {}
+    stepper.advance();
+  }
+
+  stepper.finish();
+
+  console.log(`\n  ${c.blue}${c.bold}✔  Updated to v${latest.version}${c.reset}\n`);
+
+  if (releaseNotes) {
+    console.log(`  ${c.bold}${c.white}What's new:${c.reset}`);
+    const notes = Array.isArray(releaseNotes) ? releaseNotes : [releaseNotes];
+    notes.forEach((note, i) => {
+      console.log(`  ${c.dim}${i + 1}.${c.reset} ${note}`);
+    });
+    console.log('');
+  }
+
+  // During self-update, supervisor handles restart — just exit cleanly
+  if (selfUpdate) {
+    console.log(`  Files updated — supervisor will restart with new version.\n`);
+    return;
+  }
+
+  if (daemonWasRunning) {
+    if (isDaemonActive()) {
+      console.log(`  ${c.blue}✔${c.reset}  Daemon restarted with new version.\n`);
+    } else {
+      console.log(`  ${c.yellow}⚠${c.reset}  Daemon may still be starting. Check ${c.pink}bloby daemon status${c.reset}\n`);
+    }
+  } else if (isDaemonInstalled()) {
+    try {
+      if (PLATFORM === 'darwin') {
+        execSync(`launchctl unload "${LAUNCHD_PLIST_PATH}" 2>/dev/null; launchctl load "${LAUNCHD_PLIST_PATH}"`, { stdio: 'ignore' });
+      } else {
+        const cmd = needsSudo() ? `sudo systemctl start ${SERVICE_NAME}` : `systemctl start ${SERVICE_NAME}`;
+        execSync(cmd, { stdio: 'ignore' });
+      }
+      console.log(`  ${c.blue}✔${c.reset}  Daemon started with new version.\n`);
+    } catch {
+      console.log(`  ${c.dim}Run ${c.reset}${c.pink}bloby daemon start${c.reset}${c.dim} to launch.${c.reset}\n`);
+    }
+  } else {
+    console.log(`  ${c.dim}Run ${c.reset}${c.pink}bloby start${c.reset}${c.dim} to launch.${c.reset}\n`);
+  }
+}
+
+// ── Daemon ──
+
+async function daemon(sub) {
+  // Platform guard
+  if (!hasDaemonSupport()) {
+    const hint = PLATFORM === 'win32'
+      ? 'Use Task Scheduler to keep Bloby running in the background.'
+      : 'No supported daemon system found.';
+    console.log(`\n  ${c.yellow}⚠${c.reset}  Daemon mode is not supported on this platform.`);
+    console.log(`  ${c.dim}${hint}${c.reset}\n`);
+    process.exit(1);
+  }
+
+  const action = sub || 'install';
+
+  // ── macOS (launchd) ──
+  if (PLATFORM === 'darwin') {
+    switch (action) {
+      case 'install': {
+        const dataDir = ROOT; // Uses REPO_ROOT in dev, DATA_DIR (~/.bloby) in production
+        if (!fs.existsSync(path.join(dataDir, 'supervisor', 'index.ts'))) {
+          console.log(`\n  ${c.red}✗${c.reset}  Run ${c.pink}bloby init${c.reset} first.\n`);
+          process.exit(1);
+        }
+
+        // Unload existing plist if loaded
+        if (isLaunchdInstalled()) {
+          try { execSync(`launchctl unload "${LAUNCHD_PLIST_PATH}" 2>/dev/null`, { stdio: 'ignore' }); } catch {}
+        }
+
+        const nodePath = process.env.BLOBY_NODE_PATH || process.execPath;
+        const plist = generateLaunchdPlist({ nodePath, dataDir });
+
+        // Ensure LaunchAgents directory exists
+        fs.mkdirSync(path.dirname(LAUNCHD_PLIST_PATH), { recursive: true });
+        fs.writeFileSync(LAUNCHD_PLIST_PATH, plist);
+        execSync(`launchctl load "${LAUNCHD_PLIST_PATH}"`, { stdio: 'ignore' });
+
+        // Verify it started
+        await new Promise((r) => setTimeout(r, 2000));
+        if (isLaunchdActive()) {
+          console.log(`\n  ${c.blue}✔${c.reset}  Bloby daemon installed and running.`);
+          console.log(`  ${c.dim}It will auto-start on login.${c.reset}`);
+          console.log(`\n  ${c.dim}View logs:${c.reset}  ${c.pink}bloby daemon logs${c.reset}`);
+          console.log(`  ${c.dim}Stop:${c.reset}       ${c.pink}bloby daemon stop${c.reset}`);
+          console.log(`  ${c.dim}Uninstall:${c.reset}  ${c.pink}bloby daemon uninstall${c.reset}\n`);
+        } else {
+          console.log(`\n  ${c.yellow}⚠${c.reset}  Plist installed but process may not be running.`);
+          console.log(`  ${c.dim}Check with: ${c.reset}${c.pink}bloby daemon status${c.reset}\n`);
+        }
+        break;
+      }
+
+      case 'stop': {
+        if (!isLaunchdInstalled()) {
+          console.log(`\n  ${c.yellow}⚠${c.reset}  Daemon not installed. Run ${c.pink}bloby daemon install${c.reset} first.\n`);
+          process.exit(1);
+        }
+        execSync(`launchctl unload "${LAUNCHD_PLIST_PATH}"`, { stdio: 'ignore' });
+        console.log(`\n  ${c.blue}✔${c.reset}  Bloby daemon stopped.\n`);
+        break;
+      }
+
+      case 'start': {
+        if (!isLaunchdInstalled()) {
+          console.log(`\n  ${c.yellow}⚠${c.reset}  Daemon not installed. Run ${c.pink}bloby daemon install${c.reset} first.\n`);
+          process.exit(1);
+        }
+        // Reload: unload first in case it's already loaded, then load
+        try { execSync(`launchctl unload "${LAUNCHD_PLIST_PATH}" 2>/dev/null`, { stdio: 'ignore' }); } catch {}
+        execSync(`launchctl load "${LAUNCHD_PLIST_PATH}"`, { stdio: 'ignore' });
+        console.log(`\n  ${c.blue}✔${c.reset}  Bloby daemon started.\n`);
+        break;
+      }
+
+      case 'restart': {
+        if (!isLaunchdInstalled()) {
+          console.log(`\n  ${c.yellow}⚠${c.reset}  Daemon not installed. Run ${c.pink}bloby daemon install${c.reset} first.\n`);
+          process.exit(1);
+        }
+        try { execSync(`launchctl unload "${LAUNCHD_PLIST_PATH}" 2>/dev/null`, { stdio: 'ignore' }); } catch {}
+        execSync(`launchctl load "${LAUNCHD_PLIST_PATH}"`, { stdio: 'ignore' });
+        console.log(`\n  ${c.blue}✔${c.reset}  Bloby daemon restarted.\n`);
+        break;
+      }
+
+      case 'status': {
+        if (!isLaunchdInstalled()) {
+          console.log(`\n  ${c.dim}●${c.reset} Daemon not installed.\n`);
+          break;
+        }
+        const active = isLaunchdActive();
+        if (active) {
+          console.log(`\n  ${c.blue}●${c.reset} Bloby daemon is running.`);
+        } else {
+          console.log(`\n  ${c.dim}●${c.reset} Bloby daemon is stopped.`);
+        }
+        console.log(`  ${c.dim}Plist:${c.reset} ${LAUNCHD_PLIST_PATH}`);
+        console.log(`  ${c.dim}Logs:${c.reset}  ${LAUNCHD_LOG_DIR}/bloby.log\n`);
+        break;
+      }
+
+      case 'logs': {
+        const logFile = path.join(LAUNCHD_LOG_DIR, 'bloby.log');
+        if (!fs.existsSync(logFile)) {
+          console.log(`\n  ${c.dim}No logs found at ${logFile}${c.reset}\n`);
+          break;
+        }
+        spawnSync('tail', ['-f', '-n', '50', logFile], { stdio: 'inherit' });
+        break;
+      }
+
+      case 'uninstall': {
+        try { execSync(`launchctl unload "${LAUNCHD_PLIST_PATH}" 2>/dev/null`, { stdio: 'ignore' }); } catch {}
+        if (fs.existsSync(LAUNCHD_PLIST_PATH)) fs.unlinkSync(LAUNCHD_PLIST_PATH);
+        console.log(`\n  ${c.blue}✔${c.reset}  Bloby daemon uninstalled.\n`);
+        break;
+      }
+
+      default:
+        console.log(`\n  ${c.red}✗${c.reset}  Unknown daemon command: ${action}`);
+        console.log(`  ${c.dim}Available: install, start, stop, restart, status, logs, uninstall${c.reset}\n`);
+        process.exit(1);
+    }
+    return;
+  }
+
+  // ── Linux (systemd) ──
+
+  // Check systemd is available
+  try {
+    execSync('systemctl --version', { stdio: 'ignore' });
+  } catch {
+    console.log(`\n  ${c.red}✗${c.reset}  systemd not found. Daemon mode requires systemd.\n`);
+    process.exit(1);
+  }
+
+  switch (action) {
+    case 'install': {
+      if (!fs.existsSync(path.join(getRealHome(), '.bloby', 'supervisor', 'index.ts'))) {
+        console.log(`\n  ${c.red}✗${c.reset}  Run ${c.pink}bloby init${c.reset} first.\n`);
+        process.exit(1);
+      }
+
+      // Re-exec with sudo if needed
+      if (needsSudo()) sudoReExec();
+
+      const user = getRealUser();
+      const home = getRealHome();
+      const nodePath = process.env.BLOBY_NODE_PATH || process.execPath;
+      const dataDir = path.join(home, '.bloby');
+
+      const unit = generateUnitFile({ user, home, nodePath, dataDir });
+      fs.writeFileSync(SERVICE_PATH, unit);
+
+      execSync('systemctl daemon-reload', { stdio: 'ignore' });
+      execSync(`systemctl enable ${SERVICE_NAME}`, { stdio: 'ignore' });
+      execSync(`systemctl start ${SERVICE_NAME}`, { stdio: 'ignore' });
+
+      // Verify it started
+      await new Promise((r) => setTimeout(r, 2000));
+      if (isServiceActive()) {
+        console.log(`\n  ${c.blue}✔${c.reset}  Bloby daemon installed and running.`);
+        console.log(`  ${c.dim}It will auto-start on boot.${c.reset}`);
+        console.log(`\n  ${c.dim}View logs:${c.reset}  ${c.pink}bloby daemon logs${c.reset}`);
+        console.log(`  ${c.dim}Stop:${c.reset}       ${c.pink}bloby daemon stop${c.reset}`);
+        console.log(`  ${c.dim}Uninstall:${c.reset}  ${c.pink}bloby daemon uninstall${c.reset}\n`);
+      } else {
+        console.log(`\n  ${c.yellow}⚠${c.reset}  Service installed but may not be running.`);
+        console.log(`  ${c.dim}Check with: ${c.reset}${c.pink}bloby daemon status${c.reset}\n`);
+      }
+      break;
+    }
+
+    case 'stop': {
+      if (needsSudo()) sudoReExec();
+      execSync(`systemctl stop ${SERVICE_NAME}`, { stdio: 'inherit' });
+      console.log(`\n  ${c.blue}✔${c.reset}  Bloby daemon stopped.\n`);
+      break;
+    }
+
+    case 'start': {
+      if (needsSudo()) sudoReExec();
+      execSync(`systemctl start ${SERVICE_NAME}`, { stdio: 'inherit' });
+      console.log(`\n  ${c.blue}✔${c.reset}  Bloby daemon started.\n`);
+      break;
+    }
+
+    case 'restart': {
+      if (needsSudo()) sudoReExec();
+      execSync(`systemctl restart ${SERVICE_NAME}`, { stdio: 'inherit' });
+      console.log(`\n  ${c.blue}✔${c.reset}  Bloby daemon restarted.\n`);
+      break;
+    }
+
+    case 'status': {
+      spawnSync('systemctl', ['status', SERVICE_NAME], { stdio: 'inherit' });
+      break;
+    }
+
+    case 'logs': {
+      spawnSync('journalctl', ['-u', SERVICE_NAME, '-f', '-n', '50'], { stdio: 'inherit' });
+      break;
+    }
+
+    case 'uninstall': {
+      if (needsSudo()) sudoReExec();
+      try { execSync(`systemctl stop ${SERVICE_NAME}`, { stdio: 'ignore' }); } catch {}
+      try { execSync(`systemctl disable ${SERVICE_NAME}`, { stdio: 'ignore' }); } catch {}
+      if (fs.existsSync(SERVICE_PATH)) fs.unlinkSync(SERVICE_PATH);
+      execSync('systemctl daemon-reload', { stdio: 'ignore' });
+      console.log(`\n  ${c.blue}✔${c.reset}  Bloby daemon uninstalled.\n`);
+      break;
+    }
+
+    default:
+      console.log(`\n  ${c.red}✗${c.reset}  Unknown daemon command: ${action}`);
+      console.log(`  ${c.dim}Available: install, start, stop, restart, status, logs, uninstall${c.reset}\n`);
+      process.exit(1);
+  }
+}
+
+// ── Tunnel management ──
+
+function ask(question) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => rl.question(question, (answer) => { rl.close(); resolve(answer.trim()); }));
+}
+
+async function tunnel(sub) {
+  const action = sub || 'status';
+
+  switch (action) {
+    case 'setup': {
+      banner();
+      console.log(`\n  ${c.bold}${c.white}Named Tunnel Setup${c.reset}`);
+
+      const setup = await runNamedTunnelSetup();
+
+      // Update bloby config
+      const config = fs.existsSync(CONFIG_PATH) ? JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8')) : {};
+      config.tunnel = {
+        mode: 'named',
+        name: setup.tunnelName,
+        domain: setup.domain,
+        configPath: setup.cfConfigPath,
+      };
+      fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2));
+      console.log(`  ${c.blue}✔${c.reset}  Bloby config updated\n`);
+
+      // Offer restart if daemon is running
+      if (isDaemonInstalled() && isDaemonActive()) {
+        const restart = await ask(`  ${c.bold}Restart daemon now?${c.reset} ${c.dim}(Y/n)${c.reset}: `);
+        if (!restart || restart.toLowerCase() === 'y') {
+          try {
+            if (PLATFORM === 'darwin') {
+              execSync(`launchctl unload "${LAUNCHD_PLIST_PATH}" 2>/dev/null; launchctl load "${LAUNCHD_PLIST_PATH}"`, { stdio: 'ignore' });
+            } else {
+              const cmd = needsSudo() ? `sudo systemctl restart ${SERVICE_NAME}` : `systemctl restart ${SERVICE_NAME}`;
+              execSync(cmd, { stdio: 'ignore' });
+            }
+            console.log(`\n  ${c.blue}✔${c.reset}  Daemon restarted.\n`);
+          } catch {
+            console.log(`\n  ${c.yellow}⚠${c.reset}  Restart failed. Try ${c.pink}bloby daemon restart${c.reset}\n`);
+          }
+        }
+      } else {
+        console.log(`  ${c.dim}Run ${c.reset}${c.pink}bloby start${c.reset}${c.dim} to launch with the named tunnel.${c.reset}\n`);
+      }
+      break;
+    }
+
+    case 'status': {
+      if (!fs.existsSync(CONFIG_PATH)) {
+        console.log(`\n  ${c.dim}No config found. Run ${c.reset}${c.pink}bloby init${c.reset}${c.dim} first.${c.reset}\n`);
+        return;
+      }
+      const config = JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8'));
+      const mode = config.tunnel?.mode ?? (config.tunnel?.enabled === false ? 'off' : 'quick');
+
+      console.log(`\n  ${c.bold}${c.white}Tunnel Configuration${c.reset}\n`);
+      console.log(`  ${c.dim}Mode:${c.reset}    ${c.bold}${mode}${c.reset}`);
+      if (mode === 'named') {
+        if (config.tunnel?.name) console.log(`  ${c.dim}Name:${c.reset}    ${config.tunnel.name}`);
+        if (config.tunnel?.domain) console.log(`  ${c.dim}Domain:${c.reset}  ${c.pink}${config.tunnel.domain}${c.reset}`);
+        if (config.tunnel?.configPath) console.log(`  ${c.dim}Config:${c.reset}  ${config.tunnel.configPath}`);
+      }
+      if (config.tunnelUrl) {
+        console.log(`  ${c.dim}URL:${c.reset}     ${c.blue}${link(config.tunnelUrl)}${c.reset}`);
+      }
+      console.log('');
+      break;
+    }
+
+    case 'reset': {
+      if (!fs.existsSync(CONFIG_PATH)) {
+        console.log(`\n  ${c.dim}No config found. Run ${c.reset}${c.pink}bloby init${c.reset}${c.dim} first.${c.reset}\n`);
+        return;
+      }
+      const config = JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8'));
+      config.tunnel = { mode: 'quick' };
+      delete config.tunnelUrl;
+      fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2));
+      console.log(`\n  ${c.blue}✔${c.reset}  Tunnel mode reset to ${c.bold}quick${c.reset} (random trycloudflare.com URL).\n`);
+
+      if (isDaemonInstalled() && isDaemonActive()) {
+        console.log(`  ${c.dim}Restart the daemon to apply: ${c.reset}${c.pink}bloby daemon restart${c.reset}\n`);
+      }
+      break;
+    }
+
+    default:
+      console.log(`\n  ${c.red}✗${c.reset}  Unknown tunnel command: ${action}`);
+      console.log(`  ${c.dim}Available: setup, status, reset${c.reset}\n`);
+      process.exit(1);
+  }
+}
+
+// ── Password Reset ──
+
+async function passwordReset() {
+  const DB_PATH = path.join(DATA_DIR, 'memory.db');
+
+  if (!fs.existsSync(DB_PATH)) {
+    console.log(`\n  ${c.red}✗${c.reset}  No database found. Run ${c.pink}bloby init${c.reset} and complete setup first.\n`);
+    process.exit(1);
+  }
+
+  const Database = (await import('better-sqlite3')).default;
+  const db = new Database(DB_PATH);
+
+  // Clear password and TOTP credentials
+  db.prepare("DELETE FROM settings WHERE key IN ('portal_pass', 'totp_enabled', 'totp_secret', 'totp_recovery_codes')").run();
+
+  // Reset onboard flag so the wizard appears on next visit
+  db.prepare("INSERT INTO settings (key, value) VALUES ('onboard_complete', 'false') ON CONFLICT(key) DO UPDATE SET value = 'false', updated_at = CURRENT_TIMESTAMP").run();
+
+  // Invalidate all active sessions and trusted devices
+  db.prepare('DELETE FROM sessions').run();
+  db.prepare('DELETE FROM trusted_devices').run();
+
+  db.close();
+
+  console.log(`\n  ${c.blue}✔${c.reset}  Password reset successful.\n`);
+  console.log(`  ${c.dim}The onboard wizard will appear on your next visit`);
+  console.log(`  so you can create a new password.${c.reset}\n`);
+
+  // Auto-restart daemon if it's running
+  if (isDaemonInstalled() && isDaemonActive()) {
+    console.log(`  ${c.dim}Restarting Bloby daemon...${c.reset}`);
+    daemon('restart');
+  }
+}
+
+// ── Route ──
+
+switch (command) {
+  case 'init':    init(); break;
+  case 'start':   start(); break;
+  case 'stop':    daemon('stop'); break;
+  case 'logs':    daemon('logs'); break;
+  case 'status':  status(); break;
+  case 'update':  update(); break;
+  case 'daemon':  daemon(subcommand); break;
+  case 'tunnel':  tunnel(subcommand); break;
+  case 'password-reset': passwordReset(); break;
+  default:
+    fs.existsSync(CONFIG_PATH) ? start() : init();
+}