bloby-bot 0.17.2

package/supervisor/index.ts

@@ -0,0 +1,1537 @@
+import http from 'http';
+import net from 'net';
+import fs from 'fs';
+import path from 'path';
+import { WebSocketServer, WebSocket } from 'ws';
+import { loadConfig, saveConfig } from '../shared/config.js';
+import { createProvider, type AiProvider, type ChatMessage } from '../shared/ai.js';
+import { paths } from '../shared/paths.js';
+import { PKG_DIR, DATA_DIR, WORKSPACE_DIR } from '../shared/paths.js';
+import { log } from '../shared/logger.js';
+import { startTunnel, stopTunnel, isTunnelAlive, restartTunnel, startNamedTunnel, restartNamedTunnel } from './tunnel.js';
+import { createWorkerApp } from '../worker/index.js';
+import { closeDb, getSession, getSetting } from '../worker/db.js';
+import { spawnBackend, stopBackend, getBackendPort, isBackendAlive, isBackendStopping, resetBackendRestarts } from './backend.js';
+import { updateTunnelUrl, startHeartbeat, stopHeartbeat, disconnect } from '../shared/relay.js';
+import { startBlobyAgentQuery, stopBlobyAgentQuery, type RecentMessage } from './bloby-agent.js';
+import { ensureFileDirs, saveAttachment, type SavedFile } from './file-saver.js';
+import { startViteDevServers, stopViteDevServers } from './vite-dev.js';
+import { startScheduler, stopScheduler } from './scheduler.js';
+import { execSync, spawn as cpSpawn } from 'child_process';
+import crypto from 'crypto';
+import { ChannelManager } from './channels/manager.js';
+
+const DIST_BLOBY = path.join(PKG_DIR, 'dist-bloby');
+
+// Ensure dist-bloby exists (postinstall may have failed silently)
+if (!fs.existsSync(DIST_BLOBY)) {
+  log.info('Building bloby chat UI (first run)...');
+  try {
+    execSync('npx vite build --config vite.bloby.config.ts', {
+      cwd: PKG_DIR,
+      stdio: 'ignore',
+    });
+    log.ok('Bloby chat UI built');
+  } catch (err) {
+    log.warn(`Failed to build bloby chat UI: ${err instanceof Error ? err.message : err}`);
+  }
+}
+
+const MIME_TYPES: Record<string, string> = {
+  '.html': 'text/html',
+  '.js': 'application/javascript',
+  '.css': 'text/css',
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.svg': 'image/svg+xml',
+  '.webm': 'video/webm',
+  '.mov': 'video/mp4',
+  '.mp4': 'video/mp4',
+  '.woff2': 'font/woff2',
+  '.json': 'application/json',
+};
+
+// Service worker content — embedded here so it ships with supervisor/ (always updated)
+// Keep in sync with workspace/client/public/sw.js (prod builds)
+const SW_JS = `// Service worker — app-shell caching + push notifications
+// Caching strategy:
+//   Hashed assets (/assets/*-AbCd12.js) → cache-first (immutable)
+//   Navigation (HTML)                   → stale-while-revalidate (precached on install)
+//   Static assets (img/video/fonts)     → stale-while-revalidate
+//   JS/CSS modules                      → stale-while-revalidate
+//   API, WebSocket, Vite internals      → network-only (no cache)
+
+var CACHE = 'bloby-v5';
+var HASHED_RE = new RegExp('/assets/.+-[a-zA-Z0-9]{6,}[.](js|css)$');
+
+// Precache the HTML shell on install so the cache is never empty.
+// Without this, the first navigation isn't intercepted (SW wasn't
+// controlling yet), so refresh would find an empty cache → white screen.
+self.addEventListener('install', function(e) {
+  console.log('[SW] installing, cache:', CACHE);
+  e.waitUntil(
+    caches.open(CACHE)
+      .then(function(c) { return c.add('/'); })
+      .then(function() { console.log('[SW] precached / — calling skipWaiting'); return self.skipWaiting(); })
+      .catch(function(err) { console.error('[SW] install failed:', err); throw err; })
+  );
+});
+
+self.addEventListener('activate', function(e) {
+  console.log('[SW] activating, cache:', CACHE);
+  e.waitUntil(
+    caches.keys()
+      .then(function(keys) {
+        var old = keys.filter(function(k) { return k !== CACHE; });
+        if (old.length) console.log('[SW] deleting old caches:', old);
+        return Promise.all(old.map(function(k) { return caches.delete(k); }));
+      })
+      .then(function() { console.log('[SW] claiming clients'); return self.clients.claim(); })
+  );
+});
+
+self.addEventListener('message', function(e) {
+  if (e.data && e.data.type === 'SKIP_WAITING') self.skipWaiting();
+});
+
+self.addEventListener('fetch', function(event) {
+  var request = event.request;
+  var url = new URL(request.url);
+
+  // Network-only: never cache these
+  if (
+    request.method !== 'GET' ||
+    url.pathname.indexOf('/api/') === 0 ||
+    url.pathname.indexOf('/app/api/') === 0 ||
+    url.pathname.slice(-3) === '/ws' ||
+    url.pathname === '/sw.js' ||
+    url.pathname === '/bloby/sw.js' ||
+    url.pathname.indexOf('/@') === 0 ||
+    url.pathname.indexOf('/__') === 0
+  ) return;
+
+  // Hashed assets (immutable, content-addressed) → cache-first
+  if (HASHED_RE.test(url.pathname)) {
+    event.respondWith(caches.open(CACHE).then(function(c) {
+      return c.match(request).then(function(hit) {
+        return hit || fetch(request).then(function(r) { if (r.ok) c.put(request, r.clone()); return r; });
+      });
+    }));
+    return;
+  }
+
+  // Navigation: only stale-while-revalidate the dashboard root (/).
+  // /bloby/* is a separate app — let it go to network to avoid
+  // caching the wrong HTML under the / key.
+  if (request.mode === 'navigate') {
+    console.log('[SW] navigate →', url.pathname);
+    if (url.pathname === '/' || url.pathname === '/index.html') {
+      event.respondWith(caches.open(CACHE).then(function(c) {
+        return c.match('/').then(function(hit) {
+          console.log('[SW] cache hit for /:', !!hit);
+          var net = fetch(request)
+            .then(function(r) {
+              console.log('[SW] network response for /:', r.status);
+              if (r.ok) c.put('/', r.clone());
+              return r;
+            })
+            .catch(function(err) { console.warn('[SW] network failed, using cache:', err.message); return hit; });
+          return hit || net;
+        });
+      }));
+      return;
+    }
+    // Other navigations (/bloby/*, etc.) — network only
+    console.log('[SW] navigate (network-only) →', url.pathname);
+    return;
+  }
+
+  // Everything else → stale-while-revalidate
+  event.respondWith(caches.open(CACHE).then(function(c) {
+    return c.match(request).then(function(hit) {
+      var net = fetch(request)
+        .then(function(r) { if (r.ok) c.put(request, r.clone()); return r; })
+        .catch(function() { return hit; });
+      return hit || net;
+    });
+  }));
+});
+
+// Push notifications
+self.addEventListener('push', function(event) {
+  var data = { title: 'Bloby', body: 'New message' };
+  try { data = event.data.json(); } catch(e) {}
+  event.waitUntil(
+    self.registration.showNotification(data.title || 'Bloby', {
+      body: data.body || '',
+      icon: '/bloby-icon-192.png',
+      badge: '/bloby-badge.png',
+      vibrate: [100, 50, 100],
+      tag: data.tag || 'bloby-default',
+      data: { url: data.url || '/' },
+    })
+  );
+});
+
+// Notification click — focus or open app
+self.addEventListener('notificationclick', function(event) {
+  event.notification.close();
+  var url = (event.notification.data && event.notification.data.url) || '/';
+  event.waitUntil(
+    self.clients.matchAll({ type: 'window', includeUncontrolled: true }).then(function(clients) {
+      for (var i = 0; i < clients.length; i++) {
+        if (clients[i].url.indexOf('/bloby') !== -1 && 'focus' in clients[i]) return clients[i].focus();
+      }
+      return self.clients.openWindow(url);
+    })
+  );
+});
+`;
+
+const RECOVERING_HTML = `<!DOCTYPE html><html style="background:#222122"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Bloby</title>
+<style>@keyframes _fs{to{transform:rotate(360deg)}}body{background:#222122;margin:0}</style></head>
+<body><div style="background:#222122;color:#fff;display:flex;flex-direction:column;align-items:center;justify-content:center;height:100dvh;width:100vw;font-family:system-ui,-apple-system,sans-serif">
+<img src="/bloby-icon-192.png" width="56" height="56" style="border-radius:14px;margin-bottom:20px" alt="" />
+<div style="width:18px;height:18px;border:2px solid rgba(255,255,255,0.12);border-top-color:rgba(255,255,255,0.7);border-radius:50%;animation:_fs .6s linear infinite"></div>
+</div><script>setTimeout(function(){location.reload()},3000)</script>
+<script src="/bloby/widget.js"></script></body></html>`;
+
+export async function startSupervisor() {
+  const config = loadConfig();
+  const backendPort = getBackendPort(config.port);
+  const internalSecret = crypto.randomBytes(16).toString('hex');
+
+  // Create HTTP server first (Vite needs it for HMR WebSocket)
+  // The request handler is set up later via server.on('request')
+  const server = http.createServer();
+
+  // Start Vite dev server — pass supervisor server so Vite attaches HMR WebSocket directly
+  console.log('[supervisor] Starting Vite dev server...');
+  const vitePorts = await startViteDevServers(config.port, server);
+  console.log(`[supervisor] Vite ready — dashboard :${vitePorts.dashboard}`);
+  console.log(`[supervisor] Upgrade listeners on server: ${server.listenerCount('upgrade')}`);
+
+  // Ensure file storage dirs exist
+  ensureFileDirs();
+
+  // Initialize worker routes in-process (no separate child process)
+  const workerApp = createWorkerApp();
+
+  // Bloby's AI brain
+  let ai: AiProvider | null = null;
+  if (config.ai.provider && (config.ai.apiKey || config.ai.provider === 'ollama')) {
+    ai = createProvider(config.ai.provider, config.ai.apiKey, config.ai.baseUrl);
+  }
+
+  // Bloby chat conversations (in-memory for now)
+  const conversations = new Map<WebSocket, ChatMessage[]>();
+
+  // Track active DB conversation per WS client
+  const clientConvs = new Map<WebSocket, string>();
+
+  // Track current stream state so reconnecting clients get caught up
+  let currentStreamConvId: string | null = null;
+  let currentStreamBuffer = '';
+
+  /** Call worker API endpoints (in-process via supervisor's own HTTP server) */
+  async function workerApi(apiPath: string, method = 'GET', body?: any) {
+    const opts: RequestInit = { method, headers: { 'Content-Type': 'application/json', 'x-internal': internalSecret } };
+    if (body) opts.body = JSON.stringify(body);
+    const res = await fetch(`http://127.0.0.1:${config.port}${apiPath}`, opts);
+    return res.json();
+  }
+
+  /** Broadcast to all bloby WS clients EXCEPT sender */
+  function broadcastBlobyExcept(sender: WebSocket, type: string, data: any) {
+    const msg = JSON.stringify({ type, data });
+    for (const client of blobyWss.clients) {
+      if (client !== sender && client.readyState === WebSocket.OPEN) client.send(msg);
+    }
+  }
+
+  // ── Auth middleware ──
+  const tokenCache = new Map<string, number>(); // token → expiry timestamp
+  const TOKEN_CACHE_TTL = 60_000; // 60s
+
+  async function validateToken(token: string): Promise<boolean> {
+    const cached = tokenCache.get(token);
+    if (cached && cached > Date.now()) return true;
+
+    try {
+      const session = getSession(token);
+      if (session) {
+        tokenCache.set(token, Date.now() + TOKEN_CACHE_TTL);
+        return true;
+      }
+      tokenCache.delete(token);
+      return false;
+    } catch {
+      return false;
+    }
+  }
+
+  let authRequiredCache: { value: boolean; expires: number } | null = null;
+
+  async function isAuthRequired(): Promise<boolean> {
+    if (authRequiredCache && authRequiredCache.expires > Date.now()) return authRequiredCache.value;
+    try {
+      const required = !!getSetting('portal_pass');
+      authRequiredCache = { value: required, expires: Date.now() + 30_000 };
+      return required;
+    } catch {
+      return false;
+    }
+  }
+
+  const AUTH_EXEMPT_ROUTES = [
+    'POST /api/portal/login',
+    'GET /api/portal/login',
+    'POST /api/portal/validate-token',
+    'GET /api/portal/validate-token',
+    'GET /api/onboard/status',
+    'GET /api/health',
+    'POST /api/onboard',
+    'GET /api/push/vapid-public-key',
+    'GET /api/push/status',
+    'POST /api/auth/claude/start',
+    'POST /api/auth/claude/exchange',
+    'GET /api/auth/claude/status',
+    'POST /api/auth/codex/start',
+    'POST /api/auth/codex/cancel',
+    'GET /api/auth/codex/status',
+    'POST /api/portal/totp/setup',
+    'POST /api/portal/totp/verify-setup',
+    'POST /api/portal/totp/disable',
+    'GET /api/portal/totp/status',
+    'GET /api/portal/login/totp',
+    'POST /api/portal/devices/revoke',
+    'GET /api/channels/status',
+    'GET /api/channels/whatsapp/qr',
+    'GET /api/channels/whatsapp/qr-page',
+    'POST /api/channels/whatsapp/connect',
+    'POST /api/channels/whatsapp/disconnect',
+    'POST /api/channels/whatsapp/logout',
+    'POST /api/channels/whatsapp/configure',
+    'POST /api/channels/send',
+  ];
+
+  function isExemptRoute(method: string, url: string): boolean {
+    const path = url.split('?')[0];
+    return AUTH_EXEMPT_ROUTES.some((r) => {
+      const [m, p] = r.split(' ');
+      return method === m && path === p;
+    });
+  }
+
+  // HTTP request handler — proxies to Vite dev servers + worker API
+  server.on('request', async (req, res) => {
+    // Bloby widget — served directly (not part of Vite build)
+    if (req.url === '/bloby/widget.js') {
+      console.log('[supervisor] Serving /bloby/widget.js directly');
+      res.writeHead(200, { 'Content-Type': 'application/javascript', 'Cache-Control': 'no-cache' });
+      res.end(fs.readFileSync(paths.widgetJs));
+      return;
+    }
+
+    // App WS client — served directly (proxies /app/api calls through WebSocket)
+    if (req.url === '/bloby/app-ws.js') {
+      console.log('[supervisor] Serving /bloby/app-ws.js directly');
+      res.writeHead(200, { 'Content-Type': 'application/javascript', 'Cache-Control': 'no-cache' });
+      res.end(fs.readFileSync(path.join(PKG_DIR, 'supervisor', 'app-ws.js')));
+      return;
+    }
+
+    // Service worker — served from embedded constant (supervisor/ is always updated)
+    if (req.url === '/sw.js' || req.url === '/bloby/sw.js') {
+      res.writeHead(200, { 'Content-Type': 'application/javascript', 'Cache-Control': 'no-cache' });
+      res.end(SW_JS);
+      return;
+    }
+
+    // App API routes → proxy to user's backend server
+    if (req.url?.startsWith('/app/api')) {
+      const backendPath = req.url.replace(/^\/app/, '');
+      console.log(`[supervisor] → backend :${backendPort} | ${req.method} ${backendPath}`);
+      if (!isBackendAlive()) {
+        console.log('[supervisor] Backend down — returning 503');
+        res.writeHead(503, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Backend is starting...' }));
+        return;
+      }
+
+      const proxy = http.request(
+        { host: '127.0.0.1', port: backendPort, path: backendPath, method: req.method, headers: req.headers },
+        (proxyRes) => {
+          res.writeHead(proxyRes.statusCode!, proxyRes.headers);
+          proxyRes.pipe(res);
+        },
+      );
+      proxy.on('error', (e) => {
+        console.error(`[supervisor] Backend proxy error: ${req.url}`, e.message);
+        res.writeHead(503, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Backend unavailable' }));
+      });
+      req.pipe(proxy);
+      return;
+    }
+
+    // ── Channel API routes (handled by supervisor, not worker) ──
+    if (req.url?.startsWith('/api/channels')) {
+      const channelPath = req.url.split('?')[0];
+      res.setHeader('Content-Type', 'application/json');
+      res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate');
+
+      // GET /api/channels/status — all channel statuses
+      if (req.method === 'GET' && channelPath === '/api/channels/status') {
+        res.writeHead(200);
+        res.end(JSON.stringify(channelManager.getStatuses()));
+        return;
+      }
+
+      // GET /api/channels/whatsapp/qr — raw QR SVG data
+      if (req.method === 'GET' && channelPath === '/api/channels/whatsapp/qr') {
+        const qr = channelManager.getQrCode('whatsapp');
+        res.writeHead(200);
+        res.end(JSON.stringify({ qr }));
+        return;
+      }
+
+      // GET /api/channels/whatsapp/qr-page — standalone QR scanning page
+      if (req.method === 'GET' && channelPath === '/api/channels/whatsapp/qr-page') {
+        res.setHeader('Content-Type', 'text/html');
+        const qr = channelManager.getQrCode('whatsapp');
+        const status = channelManager.getStatus('whatsapp');
+        const connected = status?.connected || false;
+        res.writeHead(200);
+        const confettiHTML = Array.from({ length: 30 }, (_, i) => {
+          const colors = ['#04D1FE', '#AF27E3', '#FB4072', '#4ade80', '#facc15', '#818cf8'];
+          const color = colors[Math.floor(Math.random() * colors.length)];
+          const left = Math.random() * 100;
+          const delay = i * 0.04;
+          const drift = (Math.random() - 0.5) * 120;
+          const duration = 1.8 + Math.random() * 0.8;
+          return `<div class="confetti-dot" style="left:${left}%;background:${color};animation-delay:${delay}s;animation-duration:${duration}s;--drift:${drift}px"></div>`;
+        }).join('');
+
+        res.end(`<!DOCTYPE html><html><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>WhatsApp QR</title>
+<link rel="preconnect" href="https://fonts.googleapis.com">
+<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&family=Space+Grotesk:wght@600;700&display=swap" rel="stylesheet">
+<style>
+  *{margin:0;padding:0;box-sizing:border-box}
+  body{background:#212121;color:#f5f5f5;font-family:'Inter',system-ui,-apple-system,sans-serif;display:flex;flex-direction:column;align-items:center;justify-content:center;height:100dvh;margin:0;overflow:hidden}
+  .container{display:flex;flex-direction:column;align-items:center;max-width:360px;width:100%;padding:0 20px}
+
+  .qr-card{background:#2a2a2a;border:1px solid rgba(255,255,255,0.08);border-radius:20px;padding:28px;width:100%;box-shadow:0 0 0 1px rgba(175,39,227,0.1),0 0 20px -5px rgba(175,39,227,0.15);animation:fade-up .5s ease-out both}
+  .qr-inner{background:#fff;border-radius:12px;padding:16px}
+  .qr-inner svg{width:100%;height:auto;display:block}
+
+  .scan-hint{margin-top:20px;font-size:13px;color:#666;text-align:center;animation:fade-up .5s ease-out .2s both}
+
+  .confetti-wrap{position:fixed;top:0;left:0;width:100%;height:100%;pointer-events:none;overflow:hidden}
+  .confetti-dot{position:absolute;width:8px;height:8px;border-radius:50%;top:-10px;animation:confetti-fall 2s ease-out forwards}
+  @keyframes confetti-fall{0%{opacity:1;transform:translateY(0) translateX(0) rotate(0) scale(1)}100%{opacity:0;transform:translateY(100vh) translateX(var(--drift)) rotate(360deg) scale(.5)}}
+
+  .video-wrap{margin-bottom:8px;animation:pop-in .5s cubic-bezier(.34,1.56,.64,1) forwards}
+  .video-wrap video{width:200px;object-fit:contain}
+  @keyframes pop-in{0%{transform:scale(0);opacity:0}100%{transform:scale(1);opacity:1}}
+
+  .text-wrap{text-align:center;animation:fade-up .5s ease-out .3s both}
+  .title{font-family:'Space Grotesk',sans-serif;font-size:22px;font-weight:700;background:linear-gradient(135deg,#04D1FE,#AF27E3,#FB4072);-webkit-background-clip:text;-webkit-text-fill-color:transparent;background-clip:text;margin-bottom:8px}
+  .subtitle{font-size:14px;color:#999;line-height:1.5}
+
+  .loading{font-size:14px;color:#999;animation:pulse 2s ease-in-out infinite}
+  @keyframes pulse{0%,100%{opacity:.5}50%{opacity:1}}
+  @keyframes fade-up{0%{opacity:0;transform:translateY(10px)}100%{opacity:1;transform:translateY(0)}}
+</style></head><body>
+<div class="container">
+${connected
+  ? `<div class="confetti-wrap">${confettiHTML}</div>
+<div class="video-wrap"><video autoplay muted playsinline><source src="/bloby_happy_reappearing.mov" type='video/mp4; codecs="hvc1"'><source src="/bloby_happy_reappearing.webm" type="video/webm"></video></div>
+<div class="text-wrap"><div class="title">Connected!</div><p class="subtitle">WhatsApp is linked. You can close this page.</p>
+<button onclick="relink()" style="margin-top:20px;padding:10px 24px;background:#2a2a2a;border:1px solid rgba(255,255,255,0.15);border-radius:10px;color:#999;font-size:13px;cursor:pointer;font-family:inherit;transition:all .2s" onmouseover="this.style.borderColor='#AF27E3';this.style.color='#f5f5f5'" onmouseout="this.style.borderColor='rgba(255,255,255,0.15)';this.style.color='#999'">Relink to a different number</button>
+</div>
+<script>async function relink(){await fetch('/api/channels/whatsapp/logout',{method:'POST'});await fetch('/api/channels/whatsapp/connect',{method:'POST'});setTimeout(()=>location.reload(),2000)}</script>`
+  : qr
+    ? `<div class="qr-card"><div class="qr-inner">${qr}</div></div><p class="scan-hint">Scan with WhatsApp to link</p>`
+    : '<p class="loading">Starting WhatsApp... Refresh in a moment.</p>'}
+</div>
+${!connected ? '<script>setTimeout(()=>location.reload(),4000)</script>' : ''}
+</body></html>`);
+        return;
+      }
+
+      // POST /api/channels/whatsapp/connect — start WhatsApp connection (triggers QR)
+      if (req.method === 'POST' && channelPath === '/api/channels/whatsapp/connect') {
+        (async () => {
+          try {
+            // Enable WhatsApp in config
+            const cfg = loadConfig();
+            if (!cfg.channels) cfg.channels = {};
+            if (!cfg.channels.whatsapp) cfg.channels.whatsapp = { enabled: true, mode: 'channel' };
+            cfg.channels.whatsapp.enabled = true;
+            saveConfig(cfg);
+
+            await channelManager.connectWhatsApp();
+            res.writeHead(200);
+            res.end(JSON.stringify({ ok: true }));
+          } catch (err: any) {
+            res.writeHead(500);
+            res.end(JSON.stringify({ error: err.message }));
+          }
+        })();
+        return;
+      }
+
+      // POST /api/channels/whatsapp/disconnect — disconnect WhatsApp
+      if (req.method === 'POST' && channelPath === '/api/channels/whatsapp/disconnect') {
+        (async () => {
+          try {
+            await channelManager.disconnectChannel('whatsapp');
+            const cfg = loadConfig();
+            if (cfg.channels?.whatsapp) cfg.channels.whatsapp.enabled = false;
+            saveConfig(cfg);
+            res.writeHead(200);
+            res.end(JSON.stringify({ ok: true }));
+          } catch (err: any) {
+            res.writeHead(500);
+            res.end(JSON.stringify({ error: err.message }));
+          }
+        })();
+        return;
+      }
+
+      // POST /api/channels/whatsapp/logout — disconnect + delete credentials
+      if (req.method === 'POST' && channelPath === '/api/channels/whatsapp/logout') {
+        (async () => {
+          try {
+            await channelManager.logoutWhatsApp();
+            const cfg = loadConfig();
+            if (cfg.channels?.whatsapp) cfg.channels.whatsapp.enabled = false;
+            saveConfig(cfg);
+            res.writeHead(200);
+            res.end(JSON.stringify({ ok: true }));
+          } catch (err: any) {
+            res.writeHead(500);
+            res.end(JSON.stringify({ error: err.message }));
+          }
+        })();
+        return;
+      }
+
+      // POST /api/channels/whatsapp/configure — set mode + admins
+      if (req.method === 'POST' && channelPath === '/api/channels/whatsapp/configure') {
+        let body = '';
+        req.on('data', (chunk: Buffer) => { body += chunk.toString(); });
+        req.on('end', () => {
+          try {
+            const data = JSON.parse(body);
+            const cfg = loadConfig();
+            if (!cfg.channels) cfg.channels = {};
+            if (!cfg.channels.whatsapp) cfg.channels.whatsapp = { enabled: true, mode: 'channel' };
+            if (data.mode) cfg.channels.whatsapp.mode = data.mode;
+            if (data.admins !== undefined) cfg.channels.whatsapp.admins = data.admins;
+            if (data.skill !== undefined) cfg.channels.whatsapp.skill = data.skill;
+            saveConfig(cfg);
+            res.writeHead(200);
+            res.end(JSON.stringify({ ok: true, config: cfg.channels.whatsapp }));
+          } catch (err: any) {
+            res.writeHead(400);
+            res.end(JSON.stringify({ error: err.message }));
+          }
+        });
+        return;
+      }
+
+      // POST /api/channels/send — send a message via any channel
+      if (req.method === 'POST' && channelPath === '/api/channels/send') {
+        let body = '';
+        req.on('data', (chunk: Buffer) => { body += chunk.toString(); });
+        req.on('end', async () => {
+          try {
+            const { channel, to, text } = JSON.parse(body);
+            if (!channel || !to || !text) {
+              res.writeHead(400);
+              res.end(JSON.stringify({ error: 'Missing channel, to, or text' }));
+              return;
+            }
+            await channelManager.sendMessage(channel, to, text);
+            res.writeHead(200);
+            res.end(JSON.stringify({ ok: true }));
+          } catch (err: any) {
+            res.writeHead(500);
+            res.end(JSON.stringify({ error: err.message }));
+          }
+        });
+        return;
+      }
+
+      // Fallback for unknown channel routes
+      res.writeHead(404);
+      res.end(JSON.stringify({ error: 'Not found' }));
+      return;
+    }
+
+    // API routes → handled in-process by worker Express app
+    if (req.url?.startsWith('/api')) {
+      // Internal supervisor calls (workerApi) bypass auth — they carry a per-process secret
+      const isInternal = req.headers['x-internal'] === internalSecret;
+
+      if (!isInternal) {
+        // Auth check for mutation routes (POST/PUT/DELETE) — GET/HEAD are read-only, skip auth
+        const method = req.method || 'GET';
+        if (method !== 'GET' && method !== 'HEAD' && !isExemptRoute(method, req.url || '')) {
+          const needsAuth = await isAuthRequired();
+          if (needsAuth) {
+            const authHeader = req.headers['authorization'];
+            const token = authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : null;
+            if (!token || !(await validateToken(token))) {
+              res.writeHead(401, { 'Content-Type': 'application/json' });
+              res.end(JSON.stringify({ error: 'Unauthorized' }));
+              return;
+            }
+          }
+        }
+      }
+
+      workerApp(req, res);
+      return;
+    }
+
+    // Bloby routes → serve pre-built static files from dist-bloby/
+    // Note: must check '/bloby/' (with slash) to avoid matching '/bloby_tilts.webm' etc.
+    if (req.url === '/bloby' || req.url?.startsWith('/bloby/')) {
+      // Strip /bloby prefix and resolve file path
+      let filePath = req.url!.replace(/^\/bloby\/?/, '') || 'bloby.html';
+      // Strip query strings (e.g. ?v=xxx)
+      filePath = filePath.split('?')[0];
+      const fullPath = path.join(DIST_BLOBY, filePath);
+
+      // Security: prevent directory traversal
+      if (!fullPath.startsWith(DIST_BLOBY)) {
+        res.writeHead(403);
+        res.end('Forbidden');
+        return;
+      }
+
+      try {
+        const stat = fs.statSync(fullPath);
+        if (stat.isFile()) {
+          const ext = path.extname(fullPath);
+          const mime = MIME_TYPES[ext] || 'application/octet-stream';
+          // HTML files: no-cache so rebuilds are picked up immediately
+          // Hashed assets (.js, .css): immutable caching
+          const cacheControl = ext === '.html' ? 'no-cache' : 'public, max-age=31536000, immutable';
+          res.writeHead(200, { 'Content-Type': mime, 'Cache-Control': cacheControl });
+          fs.createReadStream(fullPath).pipe(res);
+        } else {
+          res.writeHead(404);
+          res.end('Not found');
+        }
+      } catch {
+        res.writeHead(404);
+        res.end('Not found');
+      }
+      return;
+    }
+
+    // Everything else → proxy to dashboard Vite dev server
+    console.log(`[supervisor] → dashboard Vite :${vitePorts.dashboard} | ${req.method} ${req.url}`);
+    const proxy = http.request(
+      { host: '127.0.0.1', port: vitePorts.dashboard, path: req.url, method: req.method, headers: req.headers },
+      (proxyRes) => {
+        res.writeHead(proxyRes.statusCode!, proxyRes.headers);
+        proxyRes.pipe(res);
+      },
+    );
+    proxy.on('error', (e) => {
+      console.error(`[supervisor] Dashboard Vite proxy error: ${req.url}`, e.message);
+      res.writeHead(503, { 'Content-Type': 'text/html' });
+      res.end(RECOVERING_HTML);
+    });
+    req.pipe(proxy);
+  });
+
+  // WebSocket: Bloby chat + proxy worker WS
+  const blobyWss = new WebSocketServer({ noServer: true });
+
+  // WebSocket: App API proxy (routes /app/api calls through WS to avoid tunnel POST issues)
+  const appWss = new WebSocketServer({ noServer: true });
+
+  appWss.on('connection', (ws) => {
+    console.log('[supervisor] App API WS client connected');
+
+    ws.on('message', (raw) => {
+      const rawStr = raw.toString();
+
+      if (rawStr === 'ping') {
+        if (ws.readyState === WebSocket.OPEN) ws.send('pong');
+        return;
+      }
+
+      let msg: any;
+      try {
+        msg = JSON.parse(rawStr);
+      } catch {
+        return;
+      }
+
+      if (msg.type !== 'app:api' || !msg.data) return;
+
+      const { id, method, path: reqPath, headers: reqHeaders, body } = msg.data;
+      const backendPath = (reqPath || '').replace(/^\/app/, '');
+
+      console.log(`[supervisor] App WS → backend :${backendPort} | ${method} ${backendPath} (${id})`);
+
+      if (!isBackendAlive()) {
+        console.log('[supervisor] App WS: Backend down — returning 503');
+        if (ws.readyState === WebSocket.OPEN) {
+          ws.send(JSON.stringify({
+            type: 'app:api:response',
+            data: { id, status: 503, headers: { 'content-type': 'application/json' }, body: JSON.stringify({ error: 'Backend is starting...' }) },
+          }));
+        }
+        return;
+      }
+
+      const proxyHeaders: Record<string, string> = { ...(reqHeaders || {}) };
+      if (body && !proxyHeaders['content-type']) {
+        proxyHeaders['content-type'] = 'application/json';
+      }
+
+      const proxyReq = http.request(
+        { host: '127.0.0.1', port: backendPort, path: backendPath, method, headers: proxyHeaders },
+        (proxyRes) => {
+          const chunks: Buffer[] = [];
+          proxyRes.on('data', (chunk: Buffer) => chunks.push(chunk));
+          proxyRes.on('end', () => {
+            const responseBody = Buffer.concat(chunks).toString('utf-8');
+            const resHeaders: Record<string, string> = {};
+            for (const [k, v] of Object.entries(proxyRes.headers)) {
+              if (typeof v === 'string') resHeaders[k] = v;
+              else if (Array.isArray(v)) resHeaders[k] = v.join(', ');
+            }
+
+            console.log(`[supervisor] App WS ← backend: ${proxyRes.statusCode} (${id})`);
+
+            if (ws.readyState === WebSocket.OPEN) {
+              ws.send(JSON.stringify({
+                type: 'app:api:response',
+                data: { id, status: proxyRes.statusCode, headers: resHeaders, body: responseBody },
+              }));
+            }
+          });
+        },
+      );
+
+      proxyReq.on('error', (e) => {
+        console.error(`[supervisor] App WS backend error: ${backendPath}`, e.message);
+        if (ws.readyState === WebSocket.OPEN) {
+          ws.send(JSON.stringify({
+            type: 'app:api:response',
+            data: { id, status: 503, headers: { 'content-type': 'application/json' }, body: JSON.stringify({ error: 'Backend unavailable' }) },
+          }));
+        }
+      });
+
+      if (body) proxyReq.write(body);
+      proxyReq.end();
+    });
+
+    ws.on('close', () => {
+      console.log('[supervisor] App API WS client disconnected');
+    });
+  });
+
+  /** Send a message to all connected bloby WS clients */
+  function broadcastBloby(type: string, data: any = {}) {
+    const msg = JSON.stringify({ type, data });
+    for (const client of blobyWss.clients) {
+      if (client.readyState === WebSocket.OPEN) client.send(msg);
+    }
+  }
+
+  blobyWss.on('connection', (ws) => {
+    log.info('Bloby chat connected');
+    let convId = Math.random().toString(36).slice(2) + Date.now().toString(36);
+    conversations.set(ws, []);
+
+    // Send current streaming state so reconnecting clients can catch up
+    if (agentQueryActive && currentStreamConvId) {
+      ws.send(JSON.stringify({
+        type: 'chat:state',
+        data: {
+          streaming: true,
+          conversationId: currentStreamConvId,
+          buffer: currentStreamBuffer,
+        },
+      }));
+    }
+
+    ws.on('message', (raw) => {
+      const rawStr = raw.toString();
+
+      // Heartbeat
+      if (rawStr === 'ping') {
+        if (ws.readyState === WebSocket.OPEN) ws.send('pong');
+        return;
+      }
+
+      const msg = JSON.parse(rawStr);
+
+      // Whisper transcription via WebSocket (bypasses relay POST issues)
+      if (msg.type === 'whisper:transcribe') {
+        (async () => {
+          try {
+            const result = await workerApi('/api/whisper/transcribe', 'POST', { audio: msg.data.audio });
+            if (ws.readyState === WebSocket.OPEN) {
+              ws.send(JSON.stringify({ type: 'whisper:result', data: result }));
+            }
+          } catch (err: any) {
+            if (ws.readyState === WebSocket.OPEN) {
+              ws.send(JSON.stringify({ type: 'whisper:result', data: { error: err.message } }));
+            }
+          }
+        })();
+        return;
+      }
+
+      // Push subscribe via WebSocket (bypasses relay POST issues)
+      if (msg.type === 'push:subscribe') {
+        (async () => {
+          try {
+            const result = await workerApi('/api/push/subscribe', 'POST', msg.data);
+            if (ws.readyState === WebSocket.OPEN) {
+              ws.send(JSON.stringify({ type: 'push:subscribed', data: result }));
+            }
+          } catch (err: any) {
+            if (ws.readyState === WebSocket.OPEN) {
+              ws.send(JSON.stringify({ type: 'push:subscribe-error', data: { error: err.message } }));
+            }
+          }
+        })();
+        return;
+      }
+
+      // Push unsubscribe via WebSocket (bypasses relay POST issues)
+      if (msg.type === 'push:unsubscribe') {
+        (async () => {
+          try {
+            const result = await workerApi('/api/push/unsubscribe', 'DELETE', msg.data);
+            if (ws.readyState === WebSocket.OPEN) {
+              ws.send(JSON.stringify({ type: 'push:unsubscribed', data: result }));
+            }
+          } catch (err: any) {
+            if (ws.readyState === WebSocket.OPEN) {
+              ws.send(JSON.stringify({ type: 'push:unsubscribe-error', data: { error: err.message } }));
+            }
+          }
+        })();
+        return;
+      }
+
+      // Save settings via WebSocket (bypasses relay POST issues)
+      if (msg.type === 'settings:save') {
+        (async () => {
+          try {
+            const result = await workerApi('/api/onboard', 'POST', msg.data);
+            if (ws.readyState === WebSocket.OPEN) {
+              ws.send(JSON.stringify({ type: 'settings:saved', data: result }));
+            }
+          } catch (err: any) {
+            log.error(`[bloby] settings:save failed: ${err.message}`);
+            if (ws.readyState === WebSocket.OPEN) {
+              ws.send(JSON.stringify({ type: 'settings:save-error', data: { error: err.message } }));
+            }
+          }
+        })();
+        return;
+      }
+
+      // Switch tunnel mode at runtime (off ↔ quick)
+      if (msg.type === 'tunnel:switch') {
+        (async () => {
+          try {
+            const newMode = msg.data?.mode as 'off' | 'quick';
+            const cfg = loadConfig();
+
+            if (newMode === 'off') {
+              // Stop tunnel, heartbeat, relay, watchdog
+              stopHeartbeat();
+              if (cfg.relay?.token) {
+                try { await disconnect(cfg.relay.token); } catch {}
+              }
+              stopTunnel();
+              if (watchdogInterval) { clearInterval(watchdogInterval); watchdogInterval = null; }
+              tunnelUrl = null;
+              cfg.tunnel.mode = 'off';
+              delete cfg.tunnelUrl;
+              saveConfig(cfg);
+              log.ok('[tunnel:switch] Switched to off — tunnel stopped');
+              if (ws.readyState === WebSocket.OPEN) {
+                ws.send(JSON.stringify({ type: 'tunnel:switched', data: { mode: 'off' } }));
+              }
+            } else if (newMode === 'quick') {
+              // Start tunnel
+              const newUrl = await startTunnel(cfg.port);
+              tunnelUrl = newUrl;
+              cfg.tunnel.mode = 'quick';
+              cfg.tunnelUrl = newUrl;
+              saveConfig(cfg);
+              log.ok(`[tunnel:switch] Tunnel started: ${newUrl}`);
+
+              // Wait for local server readiness
+              for (let i = 0; i < 15; i++) {
+                try {
+                  const res = await fetch(`http://127.0.0.1:${cfg.port}/api/health?_cb=${Date.now()}`, {
+                    signal: AbortSignal.timeout(3000),
+                  });
+                  if (res.ok) break;
+                } catch {}
+                await new Promise(r => setTimeout(r, 1000));
+              }
+
+              // Reconnect relay if handle exists
+              if (cfg.relay?.token) {
+                try {
+                  await updateTunnelUrl(cfg.relay.token, newUrl);
+                  startHeartbeat(cfg.relay.token, newUrl);
+                  log.ok('[tunnel:switch] Relay reconnected');
+                } catch (err) {
+                  log.warn(`[tunnel:switch] Relay reconnect: ${err instanceof Error ? err.message : err}`);
+                }
+              }
+
+              // Re-create watchdog
+              if (watchdogInterval) clearInterval(watchdogInterval);
+              let lastTick = Date.now();
+              let healthCounter = 0;
+              watchdogInterval = setInterval(async () => {
+                const now = Date.now();
+                const wakeGap = now - lastTick > 60_000;
+                const periodicCheck = ++healthCounter % 10 === 0;
+                lastTick = now;
+                if (wakeGap || periodicCheck) {
+                  const alive = await isTunnelAlive(tunnelUrl!, cfg.port);
+                  if (!alive) {
+                    log.warn('Tunnel dead, restarting...');
+                    try {
+                      const restartedUrl = await restartTunnel(cfg.port);
+                      await new Promise(r => setTimeout(r, 3000));
+                      tunnelUrl = restartedUrl;
+                      const latestCfg = loadConfig();
+                      latestCfg.tunnelUrl = restartedUrl;
+                      saveConfig(latestCfg);
+                      if (latestCfg.relay?.token) {
+                        stopHeartbeat();
+                        startHeartbeat(latestCfg.relay.token, restartedUrl);
+                        await updateTunnelUrl(latestCfg.relay.token, restartedUrl);
+                      }
+                      log.ok(`Tunnel restored: ${restartedUrl}`);
+                    } catch (err) {
+                      log.error(`Tunnel restart failed: ${err instanceof Error ? err.message : err}`);
+                    }
+                  }
+                }
+              }, 30_000);
+
+              if (ws.readyState === WebSocket.OPEN) {
+                ws.send(JSON.stringify({ type: 'tunnel:switched', data: { mode: 'quick', tunnelUrl: newUrl } }));
+              }
+            }
+          } catch (err: any) {
+            log.error(`[tunnel:switch] Error: ${err.message}`);
+            if (ws.readyState === WebSocket.OPEN) {
+              ws.send(JSON.stringify({ type: 'tunnel:switch-error', data: { error: err.message } }));
+            }
+          }
+        })();
+        return;
+      }
+
+      // New protocol: { type: 'user:message', data: { content, conversationId? } }
+      if (msg.type === 'user:message') {
+        const data = msg.data || {};
+        const content = data.content;
+        if (!content) return;
+        if (data.conversationId) convId = data.conversationId;
+
+        // Re-read config on each message so post-onboard changes are picked up
+        const freshConfig = loadConfig();
+        const freshAi = (freshConfig.ai.provider && (freshConfig.ai.apiKey || freshConfig.ai.provider === 'ollama'))
+          ? createProvider(freshConfig.ai.provider, freshConfig.ai.apiKey, freshConfig.ai.baseUrl)
+          : null;
+
+        log.info(`[bloby] provider=${freshConfig.ai.provider}, model=${freshConfig.ai.model}`);
+
+        // Route Anthropic through Agent SDK (uses OAuth token, not API key)
+        if (freshConfig.ai.provider === 'anthropic') {
+          // Server-side persistence: create or reuse DB conversation, save user message
+          (async () => {
+            // Save attachments to disk (before try so it's accessible in startBlobyAgentQuery below)
+            let savedFiles: SavedFile[] = [];
+            if (data.attachments?.length) {
+              for (const att of data.attachments) {
+                try {
+                  savedFiles.push(saveAttachment(att));
+                } catch (err: any) {
+                  log.warn(`[bloby] File save error: ${err.message}`);
+                }
+              }
+            }
+
+            try {
+              // Check if we have an existing conversation for this client
+              let dbConvId = clientConvs.get(ws);
+              if (!dbConvId) {
+                // Check if there's a current conversation set in settings
+                const ctx = await workerApi('/api/context/current');
+                if (ctx.conversationId) {
+                  dbConvId = ctx.conversationId;
+                } else {
+                  // Create a new conversation
+                  const conv = await workerApi('/api/conversations', 'POST', { title: content.slice(0, 80), model: freshConfig.ai.model });
+                  dbConvId = conv.id;
+                  await workerApi('/api/context/set', 'POST', { conversationId: dbConvId });
+                }
+                clientConvs.set(ws, dbConvId!);
+                // Notify client of the conversation ID
+                if (ws.readyState === WebSocket.OPEN) {
+                  ws.send(JSON.stringify({ type: 'chat:conversation-created', data: { conversationId: dbConvId } }));
+                }
+              }
+              convId = dbConvId!;
+
+              // Save user message to DB (include attachment metadata as JSON string)
+              const meta: any = { model: freshConfig.ai.model };
+              if (savedFiles.length) {
+                meta.attachments = JSON.stringify(savedFiles.map((f) => ({
+                  type: f.type, name: f.name, mediaType: f.mediaType, filePath: f.relPath,
+                })));
+              }
+              await workerApi(`/api/conversations/${convId}/messages`, 'POST', {
+                role: 'user', content, meta,
+              });
+
+              // Broadcast user message to other clients
+              broadcastBlobyExcept(ws, 'chat:sync', {
+                conversationId: convId,
+                message: { role: 'user', content, timestamp: new Date().toISOString() },
+              });
+            } catch (err: any) {
+              log.warn(`[bloby] DB persist error: ${err.message}`);
+            }
+
+            // Fetch agent/user names and recent messages in parallel
+            let botName = 'Bloby', humanName = 'Human';
+            let recentMessages: RecentMessage[] = [];
+            try {
+              const [status, recentRaw] = await Promise.all([
+                workerApi('/api/onboard/status') as Promise<any>,
+                workerApi(`/api/conversations/${convId}/messages/recent?limit=20`) as Promise<any[]>,
+              ]);
+              botName = status.agentName || 'Bloby';
+              humanName = status.userName || 'Human';
+
+              // Filter to user/assistant only, exclude the last entry (current message already sent as SDK prompt)
+              if (Array.isArray(recentRaw)) {
+                const filtered = recentRaw
+                  .filter((m: any) => m.role === 'user' || m.role === 'assistant');
+                // Slice off the last entry — it's the current user message
+                if (filtered.length > 0) {
+                  recentMessages = filtered.slice(0, -1).map((m: any) => ({
+                    role: m.role as 'user' | 'assistant',
+                    content: m.content,
+                  }));
+                }
+              }
+            } catch {}
+
+            // Mirror chat responses to WhatsApp self-chat (if connected)
+            const waStatus = channelManager.getStatus('whatsapp');
+            const waMirrorJid = waStatus?.connected ? waStatus.info?.phoneNumber : null;
+            let waChunkBuf = '';
+
+            // Start agent query
+            agentQueryActive = true;
+            currentStreamConvId = convId;
+            currentStreamBuffer = '';
+            startBlobyAgentQuery(convId, content, freshConfig.ai.model, (type, eventData) => {
+              // Track stream buffer for reconnecting clients
+              if (type === 'bot:token' && eventData.token) {
+                currentStreamBuffer += eventData.token;
+                if (waMirrorJid) waChunkBuf += eventData.token;
+              }
+
+              // WhatsApp mirror: send intermediate chunk when agent pauses for tool use
+              if (type === 'bot:tool' && waMirrorJid && waChunkBuf.trim()) {
+                channelManager.sendMessage('whatsapp', `${waMirrorJid}@s.whatsapp.net`, waChunkBuf.trim()).catch(() => {});
+                waChunkBuf = '';
+              }
+
+              // Intercept bot:done — Vite HMR handles file changes automatically
+              if (type === 'bot:done') {
+                agentQueryActive = false;
+                currentStreamConvId = null;
+                currentStreamBuffer = '';
+                // Restart if agent used file tools OR file watcher detected changes during the turn
+                if (eventData.usedFileTools || pendingBackendRestart) {
+                  console.log('[supervisor] Agent turn ended — restarting backend');
+                  pendingBackendRestart = false;
+                  if (backendRestartTimer) { clearTimeout(backendRestartTimer); backendRestartTimer = null; }
+                  resetBackendRestarts();
+                  stopBackend().then(() => spawnBackend(backendPort));
+                }
+                // Run deferred update if agent requested one
+                if (pendingUpdate) {
+                  pendingUpdate = false;
+                  runDeferredUpdate();
+                }
+                return; // don't forward bot:done to client
+              }
+
+              // Save assistant response to DB + clear stream state
+              if (type === 'bot:response') {
+                currentStreamBuffer = '';
+
+                // WhatsApp mirror: send remaining chunk
+                if (waMirrorJid && waChunkBuf.trim()) {
+                  channelManager.sendMessage('whatsapp', `${waMirrorJid}@s.whatsapp.net`, waChunkBuf.trim()).catch(() => {});
+                  waChunkBuf = '';
+                }
+
+                (async () => {
+                  try {
+                    await workerApi(`/api/conversations/${convId}/messages`, 'POST', {
+                      role: 'assistant', content: eventData.content, meta: { model: freshConfig.ai.model },
+                    });
+                  } catch (err: any) {
+                    log.warn(`[bloby] DB persist bot response error: ${err.message}`);
+                  }
+                })();
+              }
+
+              // Stream all events to every connected client
+              broadcastBloby(type, eventData);
+            }, data.attachments, savedFiles, { botName, humanName }, recentMessages);
+          })();
+          return;
+        }
+
+        // Other providers: use ai.chat() with conversation history
+        const history = conversations.get(ws) || [];
+        history.push({ role: 'user', content });
+
+        if (!freshAi) {
+          if (ws.readyState === WebSocket.OPEN) {
+            ws.send(JSON.stringify({ type: 'bot:error', data: { error: 'AI not configured. Set up your provider first.' } }));
+          }
+          return;
+        }
+
+        if (ws.readyState === WebSocket.OPEN) {
+          ws.send(JSON.stringify({ type: 'bot:typing', data: { conversationId: convId } }));
+        }
+
+        freshAi.chat(
+          [{ role: 'system', content: 'You are Bloby, a helpful AI assistant. You help users manage and customize their self-hosted bot.' }, ...history],
+          freshConfig.ai.model,
+          (token) => { if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ type: 'bot:token', data: { token, conversationId: convId } })); },
+          (full) => {
+            history.push({ role: 'assistant', content: full });
+            if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ type: 'bot:response', data: { conversationId: convId, content: full } }));
+          },
+          (err) => { if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ type: 'bot:error', data: { error: err.message } })); },
+        );
+        return;
+      }
+
+      if (msg.type === 'user:stop') {
+        stopBlobyAgentQuery(convId);
+        return;
+      }
+
+      if (msg.type === 'user:clear-context') {
+        (async () => {
+          try {
+            clientConvs.delete(ws);
+            await workerApi('/api/context/clear', 'POST');
+          } catch (err: any) {
+            log.warn(`[bloby] Clear context error: ${err.message}`);
+          }
+          // Broadcast clear to ALL clients
+          broadcastBloby('chat:cleared');
+        })();
+        return;
+      }
+    });
+
+    ws.on('close', () => {
+      conversations.delete(ws);
+      clientConvs.delete(ws);
+    });
+  });
+
+  // Bloby chat WebSocket — Vite HMR is handled automatically (hmr.server = this server)
+  server.on('upgrade', async (req, socket: net.Socket, head) => {
+    console.log(`[supervisor] WebSocket upgrade: ${req.url} | protocol=${req.headers['sec-websocket-protocol'] || 'none'}`);
+
+    // App API WebSocket — no auth (backend handles its own auth)
+    if (req.url?.startsWith('/app/ws')) {
+      console.log('[supervisor] → App API WebSocket');
+      appWss.handleUpgrade(req, socket, head, (ws) => appWss.emit('connection', ws, req));
+      return;
+    }
+
+    if (!req.url?.startsWith('/bloby/ws')) {
+      console.log('[supervisor] → Letting Vite handle this upgrade');
+      return;
+    }
+
+    // Auth check for WebSocket
+    const needsAuth = await isAuthRequired();
+    if (needsAuth) {
+      const urlObj = new URL(req.url, `http://${req.headers.host}`);
+      const token = urlObj.searchParams.get('token');
+      if (!token || !(await validateToken(token))) {
+        console.log('[supervisor] WS auth failed — rejecting');
+        socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
+        socket.destroy();
+        return;
+      }
+    }
+
+    console.log('[supervisor] → Bloby chat WebSocket');
+    blobyWss.handleUpgrade(req, socket, head, (ws) => blobyWss.emit('connection', ws, req));
+  });
+
+  // Start
+  server.on('error', (err: NodeJS.ErrnoException) => {
+    if (err.code === 'EADDRINUSE') {
+      log.error(`Port ${config.port} is already in use. Stop the other process or change the port in ${paths.config}`);
+    } else {
+      log.error(`Server error: ${err.message}`);
+    }
+    process.exit(1);
+  });
+
+  server.listen(config.port, () => {
+    log.ok(`Supervisor on http://localhost:${config.port}`);
+    log.ok(`Bloby chat at http://localhost:${config.port}/bloby`);
+    if (config.tunnel.mode === 'off') {
+      console.log('__READY__');
+    }
+  });
+
+  // Track whether an agent query is active — file watcher defers to bot:done during turns
+  let agentQueryActive = false;
+  let pendingBackendRestart = false; // Set when file watcher fires during agent turn
+  let pendingUpdate = false; // Set when .update file is created during agent turn
+
+  // Run bloby update as a child process.
+  // BLOBY_SELF_UPDATE=1 tells bin/cli.js to skip daemon stop/restart —
+  // the supervisor exits after the update finishes, and systemd (Restart=on-failure)
+  // or launchd (KeepAlive.SuccessfulExit=false) restarts us with the new code.
+  function runDeferredUpdate() {
+    const cliPath = path.join(PKG_DIR, 'bin', 'cli.js');
+    const updateLog = path.join(DATA_DIR, 'update.log');
+    log.info('Deferred update triggered — running bloby update...');
+    try {
+      const logFd = fs.openSync(updateLog, 'w');
+      const child = cpSpawn(process.execPath, [cliPath, 'update'], {
+        stdio: ['ignore', logFd, logFd],
+        env: { ...process.env, BLOBY_SELF_UPDATE: '1' },
+      });
+      child.on('exit', (code) => {
+        try { fs.closeSync(logFd); } catch {}
+        if (code === 0) {
+          log.ok('Update completed — restarting with new version...');
+          process.exit(1); // non-zero triggers daemon manager to restart us
+        } else {
+          log.error(`Update process exited with code ${code} — see ${updateLog}`);
+        }
+      });
+    } catch (err) {
+      log.error(`Deferred update failed: ${err instanceof Error ? err.message : err}`);
+    }
+  }
+
+  // Spawn backend (worker runs in-process)
+  spawnBackend(backendPort);
+
+  // Start pulse/cron scheduler
+  startScheduler({
+    broadcastBloby,
+    workerApi,
+    restartBackend: async () => {
+      resetBackendRestarts();
+      await stopBackend();
+      spawnBackend(backendPort);
+    },
+    getModel: () => loadConfig().ai.model,
+  });
+
+  // Initialize channel manager (WhatsApp, Telegram, etc.)
+  const channelManager = new ChannelManager({
+    broadcastBloby,
+    workerApi,
+    restartBackend: async () => {
+      resetBackendRestarts();
+      await stopBackend();
+      spawnBackend(backendPort);
+    },
+    getModel: () => loadConfig().ai.model,
+  });
+
+  // Broadcast channel status changes to all connected chat clients
+  channelManager.onStatusChange((status) => {
+    broadcastBloby('channel:status', status);
+    // Also broadcast QR code updates
+    if (status.info?.hasQr) {
+      const qr = channelManager.getQrCode(status.channel);
+      if (qr) broadcastBloby('channel:qr', { channel: status.channel, qr });
+    }
+  });
+
+  // Auto-init channels (will connect WhatsApp if previously configured)
+  channelManager.init().catch((err) => {
+    log.warn(`[channels] Init failed: ${err.message}`);
+  });
+
+  // Watch workspace files for changes — auto-restart backend
+  // Catches edits from VS Code, CLI, or any external tool.
+  // During agent turns, defers to bot:done (avoids mid-turn restarts).
+  const workspaceDir = WORKSPACE_DIR;
+  const backendDir = path.join(workspaceDir, 'backend');
+  let backendRestartTimer: ReturnType<typeof setTimeout> | null = null;
+
+  function scheduleBackendRestart(reason: string) {
+    if (agentQueryActive) {
+      // Agent is working — don't restart now, flag it for bot:done
+      pendingBackendRestart = true;
+      return;
+    }
+    // Skip if a stop/restart is already in progress (bot:done handler owns the restart)
+    if (isBackendStopping()) return;
+    if (backendRestartTimer) clearTimeout(backendRestartTimer);
+    backendRestartTimer = setTimeout(async () => {
+      if (isBackendStopping()) return; // re-check after delay
+      log.info(`[watcher] ${reason} — restarting backend...`);
+      resetBackendRestarts();
+      await stopBackend();
+      spawnBackend(backendPort);
+    }, 1000);
+  }
+
+  // Watch backend/ for code changes
+  const backendWatcher = fs.watch(backendDir, { recursive: true }, (_event, filename) => {
+    if (!filename || !filename.match(/\.(ts|js|json)$/)) return;
+    scheduleBackendRestart(`Backend file changed: ${filename}`);
+  });
+
+  // Watch workspace root for .env changes and .restart trigger
+  const workspaceWatcher = fs.watch(workspaceDir, (_event, filename) => {
+    if (!filename) return;
+    if (filename === '.env') {
+      scheduleBackendRestart('.env changed');
+    }
+    if (filename === '.restart') {
+      // Consume the trigger file
+      try { fs.unlinkSync(path.join(workspaceDir, '.restart')); } catch {}
+      scheduleBackendRestart('.restart trigger');
+    }
+    if (filename === '.update') {
+      // Consume the trigger file
+      try { fs.unlinkSync(path.join(workspaceDir, '.update')); } catch {}
+      if (agentQueryActive) {
+        pendingUpdate = true;
+        log.info('Update requested — deferring until agent turn ends');
+      } else {
+        runDeferredUpdate();
+      }
+    }
+  });
+
+  // Tunnel
+  let tunnelUrl: string | null = null;
+
+  if (config.tunnel.mode === 'quick') {
+    try {
+      tunnelUrl = await startTunnel(config.port);
+      log.ok(`Tunnel: ${tunnelUrl}`);
+      console.log(`__TUNNEL_URL__=${tunnelUrl}`);
+
+      // Persist tunnel URL so the worker can read it after handle registration
+      config.tunnelUrl = tunnelUrl;
+      saveConfig(config);
+
+      // Wait for local server to be reachable before telling the relay.
+      // Probes localhost directly — avoids macOS issue where server can't
+      // reach itself through the Cloudflare tunnel URL.
+      let tunnelReady = false;
+      log.info('Readiness probe: waiting for local server...');
+      for (let i = 0; i < 30; i++) {
+        try {
+          const res = await fetch(`http://127.0.0.1:${config.port}/api/health?_cb=${Date.now()}`, {
+            signal: AbortSignal.timeout(3000),
+          });
+          log.info(`Readiness probe #${i + 1}: ${res.status}`);
+          if (res.ok) {
+            tunnelReady = true;
+            break;
+          }
+        } catch (err) {
+          log.info(`Readiness probe #${i + 1}: ${err instanceof Error ? err.message : 'error'}`);
+        }
+        await new Promise(r => setTimeout(r, 1000));
+      }
+      if (!tunnelReady) {
+        log.warn('Local server readiness probe timed out — updating relay anyway');
+      }
+
+      // Now register tunnel URL with relay and start heartbeats
+      if (config.relay?.token) {
+        try {
+          await updateTunnelUrl(config.relay.token, tunnelUrl);
+          startHeartbeat(config.relay.token, tunnelUrl);
+          if (config.relay.url) {
+            log.ok(`Relay: ${config.relay.url}`);
+            console.log(`__RELAY_URL__=${config.relay.url}`);
+          }
+        } catch (err) {
+          log.warn(`Relay: ${err instanceof Error ? err.message : err}`);
+        }
+      }
+      console.log('__READY__');
+    } catch (err) {
+      log.warn(`Tunnel: ${err instanceof Error ? err.message : err}`);
+      console.log('__TUNNEL_FAILED__');
+    }
+  }
+
+  if (config.tunnel.mode === 'named') {
+    try {
+      await startNamedTunnel(config.tunnel.configPath!, config.tunnel.name!);
+      tunnelUrl = `https://${config.tunnel.domain}`;
+      log.ok(`Named tunnel: ${tunnelUrl}`);
+      console.log(`__TUNNEL_URL__=${tunnelUrl}`);
+
+      config.tunnelUrl = tunnelUrl;
+      saveConfig(config);
+
+      // Readiness probe — check local server (not tunnel URL, avoids macOS self-reach issue)
+      let tunnelReady = false;
+      log.info('Readiness probe: waiting for local server...');
+      for (let i = 0; i < 30; i++) {
+        try {
+          const res = await fetch(`http://127.0.0.1:${config.port}/api/health?_cb=${Date.now()}`, {
+            signal: AbortSignal.timeout(3000),
+          });
+          log.info(`Readiness probe #${i + 1}: ${res.status}`);
+          if (res.ok) {
+            tunnelReady = true;
+            break;
+          }
+        } catch (err) {
+          log.info(`Readiness probe #${i + 1}: ${err instanceof Error ? err.message : 'error'}`);
+        }
+        await new Promise(r => setTimeout(r, 1000));
+      }
+      if (!tunnelReady) {
+        log.warn('Local server readiness probe timed out');
+      }
+
+      console.log('__READY__');
+    } catch (err) {
+      log.warn(`Named tunnel: ${err instanceof Error ? err.message : err}`);
+      console.log('__TUNNEL_FAILED__');
+    }
+  }
+
+  // Tunnel watchdog — detects sleep/wake + periodic health checks
+  let watchdogInterval: ReturnType<typeof setInterval> | null = null;
+  if (tunnelUrl) {
+    let lastTick = Date.now();
+    let healthCounter = 0;
+
+    watchdogInterval = setInterval(async () => {
+      const now = Date.now();
+      const wakeGap = now - lastTick > 60_000;
+      const periodicCheck = ++healthCounter % 10 === 0;
+      lastTick = now; // Update immediately so concurrent ticks don't see a stale gap
+
+      if (wakeGap || periodicCheck) {
+        const alive = await isTunnelAlive(tunnelUrl!, config.port);
+        if (!alive) {
+          log.warn('Tunnel dead, restarting...');
+          try {
+            if (config.tunnel.mode === 'named') {
+              // Named tunnel: restart process, URL doesn't change
+              await restartNamedTunnel(config.tunnel.configPath!, config.tunnel.name!);
+              log.ok(`Named tunnel restored: ${tunnelUrl}`);
+            } else {
+              // Quick tunnel: restart and get new URL
+              const newUrl = await restartTunnel(config.port);
+
+              // Brief pause to let cloudflared establish the tunnel
+              await new Promise(r => setTimeout(r, 3000));
+
+              tunnelUrl = newUrl;
+
+              // Re-read config from disk — relay token may have been added during onboarding
+              const latestCfg = loadConfig();
+              latestCfg.tunnelUrl = newUrl;
+              saveConfig(latestCfg);
+
+              if (latestCfg.relay?.token) {
+                stopHeartbeat();
+                startHeartbeat(latestCfg.relay.token, newUrl);
+                await updateTunnelUrl(latestCfg.relay.token, newUrl);
+                log.ok(`Relay updated with new tunnel URL`);
+              }
+              log.ok(`Tunnel restored: ${newUrl}`);
+            }
+          } catch (err) {
+            log.error(`Tunnel restart failed: ${err instanceof Error ? err.message : err}`);
+          }
+        }
+      }
+    }, 30_000);
+  }
+
+  // Shutdown
+  const shutdown = async () => {
+    log.info('Shutting down...');
+    await channelManager.disconnectAll();
+    stopScheduler();
+    backendWatcher.close();
+    workspaceWatcher.close();
+    if (backendRestartTimer) clearTimeout(backendRestartTimer);
+    if (watchdogInterval) clearInterval(watchdogInterval);
+    stopHeartbeat();
+    const latestConfig = loadConfig();
+    if (latestConfig.relay?.token) {
+      await disconnect(latestConfig.relay.token);
+    }
+    // Clear persisted tunnel URL so stale values aren't reused
+    delete latestConfig.tunnelUrl;
+    saveConfig(latestConfig);
+    closeDb();
+    await stopBackend();
+    stopTunnel();
+    console.log('[supervisor] Stopping Vite dev servers...');
+    await stopViteDevServers();
+    server.close();
+    process.exit(0);
+  };
+  process.on('SIGINT', () => shutdown());
+  process.on('SIGTERM', () => shutdown());
+
+  return tunnelUrl;
+}
+
+startSupervisor().catch((err) => {
+  log.error('Fatal', err);
+  process.exit(1);
+});