episoda 0.2.35 → 0.2.37

package/dist/daemon/daemon-process.js

@@ -397,6 +397,9 @@ var require_git_executor = __commonJS({
               return await this.executeWorktreeList(cwd, options);
             case "worktree_prune":
               return await this.executeWorktreePrune(cwd, options);
+            // EP1002: Worktree setup command for unified orchestration
+            case "worktree_setup":
+              return await this.executeWorktreeSetup(command, cwd, options);
             case "clone_bare":
               return await this.executeCloneBare(command, options);
             case "project_info":
@@ -1710,6 +1713,10 @@ var require_git_executor = __commonJS({
           args.push(command.path);
           const result = await this.runGitCommand(args, cwd, options);
           if (result.success) {
+            try {
+              await fs17.rm(command.path, { recursive: true, force: true });
+            } catch {
+            }
             return {
               success: true,
               output: `Removed worktree at ${command.path}`,
@@ -1823,6 +1830,18 @@ var require_git_executor = __commonJS({
           };
         }
       }
+      /**
+       * EP1002: Worktree setup command stub
+       * The actual implementation is in the daemon which intercepts this command.
+       * This stub exists for type checking and as a fallback.
+       */
+      async executeWorktreeSetup(command, cwd, options) {
+        return {
+          success: false,
+          error: "NOT_IMPLEMENTED",
+          output: "worktree_setup must be handled by the daemon, not GitExecutor"
+        };
+      }
       /**
        * EP944: Clone a repository as a bare repository
        * Used for worktree-based development setup
@@ -2593,6 +2612,9 @@ var require_errors = __commonJS({
         "WORKTREE_NOT_FOUND": "Worktree not found at this path",
         "WORKTREE_LOCKED": "Worktree is locked",
         "BRANCH_IN_USE": "Branch is already checked out in another worktree",
+        // EP1002: Worktree setup error messages
+        "NOT_IMPLEMENTED": "Command not implemented in this context",
+        "SETUP_FAILED": "Worktree setup failed",
         "UNKNOWN_ERROR": "Unknown error occurred"
       };
       let message = messages[code] || `Error: ${code}`;
@@ -2699,7 +2721,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "episoda",
-      version: "0.2.34",
+      version: "0.2.36",
       description: "CLI tool for Episoda local development workflow orchestration",
       main: "dist/index.js",
       types: "dist/index.d.ts",
@@ -6242,52 +6264,9 @@ async function getWorktreeInfoForModule(moduleUid) {
   }
   return getWorktreeInfo(moduleUid, config.workspace_slug, config.project_slug);
 }
-async function getProjectRootPath() {
-  const config = await (0, import_core9.loadConfig)();
-  if (!config?.workspace_slug || !config?.project_slug) {
-    return null;
-  }
-  return path15.join(
-    getEpisodaRoot2(),
-    config.workspace_slug,
-    config.project_slug
-  );
-}
 
 // src/utils/port-allocator.ts
-var PORT_RANGE_START = 3100;
-var PORT_RANGE_END = 3199;
-var PORT_WARNING_THRESHOLD = 80;
 var portAssignments = /* @__PURE__ */ new Map();
-function allocatePort(moduleUid) {
-  const existing = portAssignments.get(moduleUid);
-  if (existing) {
-    return existing;
-  }
-  const usedPorts = new Set(portAssignments.values());
-  if (usedPorts.size >= PORT_WARNING_THRESHOLD) {
-    console.warn(
-      `[PortAllocator] Warning: ${usedPorts.size}/${PORT_RANGE_END - PORT_RANGE_START + 1} ports allocated`
-    );
-  }
-  for (let port = PORT_RANGE_START; port <= PORT_RANGE_END; port++) {
-    if (!usedPorts.has(port)) {
-      portAssignments.set(moduleUid, port);
-      console.log(`[PortAllocator] Assigned port ${port} to ${moduleUid}`);
-      return port;
-    }
-  }
-  throw new Error(
-    `No available ports in range ${PORT_RANGE_START}-${PORT_RANGE_END}. ${portAssignments.size} modules are using all available ports.`
-  );
-}
-function releasePort(moduleUid) {
-  const port = portAssignments.get(moduleUid);
-  if (port) {
-    portAssignments.delete(moduleUid);
-    console.log(`[PortAllocator] Released port ${port} from ${moduleUid}`);
-  }
-}
 function clearAllPorts() {
   const count = portAssignments.size;
   portAssignments.clear();
@@ -6520,7 +6499,7 @@ var Daemon = class _Daemon {
     // EP837: Prevent concurrent commit syncs (backpressure guard)
     this.commitSyncInProgress = false;
     // EP843: Per-module mutex for tunnel operations
-    // Prevents race conditions between autoStartTunnels and module_state_changed handler
+    // EP1003: Prevents race conditions between server-orchestrated tunnel commands
     this.tunnelOperationLocks = /* @__PURE__ */ new Map();
     // moduleUid -> operation promise
     // EP929: Health check polling interval (restored from EP843 removal)
@@ -6805,7 +6784,7 @@ var Daemon = class _Daemon {
    * EP843: Acquire a per-module lock for tunnel operations
    *
    * Prevents race conditions between:
-   * - autoStartTunnelsForProject() on auth_success
+   * - Server-orchestrated tunnel_start commands (EP1003)
    * - module_state_changed event handler
    * - Multiple rapid state transitions
    *
@@ -6898,6 +6877,32 @@ var Daemon = class _Daemon {
           } else {
             console.log(`[Daemon] Running git command in bare repo: ${bareRepoPath}`);
           }
+          if (gitCmd.action === "worktree_setup") {
+            const wtManager = new WorktreeManager(projectPath);
+            await wtManager.initialize();
+            const SETUP_TIMEOUT_MS = 15 * 60 * 1e3;
+            const setupPromise = this.handleWorktreeSetup(gitCmd, projectPath, wtManager);
+            const timeoutPromise = new Promise(
+              (_, reject) => setTimeout(() => reject(new Error("Worktree setup timed out after 15 minutes")), SETUP_TIMEOUT_MS)
+            );
+            let setupResult;
+            try {
+              setupResult = await Promise.race([setupPromise, timeoutPromise]);
+            } catch (timeoutError) {
+              setupResult = {
+                success: false,
+                error: "COMMAND_TIMEOUT",
+                output: timeoutError instanceof Error ? timeoutError.message : "Setup timed out"
+              };
+            }
+            await client.send({
+              type: "result",
+              commandId: message.id,
+              result: setupResult
+            });
+            console.log(`[Daemon] EP1002: Worktree setup completed for ${gitCmd.moduleUid}:`, setupResult.success ? "success" : "failed");
+            return;
+          }
           const result = await gitExecutor.execute(gitCmd, {
             cwd
           });
@@ -7321,9 +7326,6 @@ var Daemon = class _Daemon {
       this.syncMachineProjectPath(projectId, projectPath).catch((err) => {
         console.warn("[Daemon] EP995: Project path sync failed:", err.message);
       });
-      this.autoStartTunnelsForProject(projectPath, projectId).catch((error) => {
-        console.error(`[Daemon] EP819: Failed to auto-start tunnels:`, error);
-      });
       cleanupStaleCommits(projectPath).then((cleanupResult) => {
         if (cleanupResult.deleted_count > 0) {
           console.log(`[Daemon] EP950: Cleaned up ${cleanupResult.deleted_count} stale commit(s) on connect`);
@@ -7331,8 +7333,8 @@ var Daemon = class _Daemon {
       }).catch((err) => {
         console.warn("[Daemon] EP950: Cleanup on connect failed:", err.message);
       });
-      this.reconcileWorktrees(projectId, projectPath).catch((err) => {
-        console.warn("[Daemon] EP995: Reconciliation failed:", err.message);
+      this.reconcileWorktrees(projectId, projectPath, client).catch((err) => {
+        console.warn("[Daemon] EP1003: Reconciliation report failed:", err.message);
       });
     });
     client.on("module_state_changed", async (message) => {
@@ -7340,174 +7342,18 @@ var Daemon = class _Daemon {
         const { moduleUid, state, previousState, branchName, devMode, checkoutMachineId } = message;
         console.log(`[Daemon] EP843: Module ${moduleUid} state changed: ${previousState} \u2192 ${state}`);
         if (devMode !== "local") {
-          console.log(`[Daemon] EP843: Skipping tunnel action for ${moduleUid} (mode: ${devMode || "unknown"})`);
+          console.log(`[Daemon] EP1003: State change for non-local module ${moduleUid} (mode: ${devMode || "unknown"})`);
           return;
         }
         if (checkoutMachineId && checkoutMachineId !== this.deviceId) {
-          console.log(`[Daemon] EP956: Skipping ${moduleUid} (checked out on different machine: ${checkoutMachineId})`);
+          console.log(`[Daemon] EP1003: State change for ${moduleUid} handled by different machine: ${checkoutMachineId}`);
           return;
         }
-        const tunnelManager = getTunnelManager();
-        await tunnelManager.initialize();
-        await this.withTunnelLock(moduleUid, async () => {
-          const isInActiveZone = state === "ready" || state === "doing" || state === "review";
-          const wasInActiveZone = previousState === "ready" || previousState === "doing" || previousState === "review";
-          const startingWork = previousState === "ready" && state === "doing";
-          const tunnelNotRunning = !tunnelManager.hasTunnel(moduleUid);
-          const needsCrashRecovery = isInActiveZone && tunnelNotRunning;
-          if (startingWork || needsCrashRecovery) {
-            if (tunnelManager.hasTunnel(moduleUid)) {
-              console.log(`[Daemon] EP843: Tunnel already running for ${moduleUid}, skipping start`);
-              return;
-            }
-            console.log(`[Daemon] EP956: Starting tunnel for ${moduleUid} (${previousState} \u2192 ${state})`);
-            try {
-              let worktree = await getWorktreeInfoForModule(moduleUid);
-              if (!worktree) {
-                console.error(`[Daemon] EP956: Cannot resolve worktree path for ${moduleUid} (missing config slugs)`);
-                return;
-              }
-              if (!worktree.exists && startingWork) {
-                console.log(`[Daemon] EP959: Creating worktree for ${moduleUid} at ${worktree.path}`);
-                const projectRoot = await getProjectRootPath();
-                if (!projectRoot) {
-                  console.error(`[Daemon] EP959: Cannot determine project root for worktree creation`);
-                  return;
-                }
-                const worktreeManager = new WorktreeManager(projectRoot);
-                const initialized = await worktreeManager.initialize();
-                if (!initialized) {
-                  console.error(`[Daemon] EP959: Failed to initialize WorktreeManager at ${projectRoot}`);
-                  return;
-                }
-                const moduleBranchName = branchName || moduleUid;
-                const createResult = await worktreeManager.createWorktree(moduleUid, moduleBranchName, true);
-                if (!createResult.success) {
-                  console.error(`[Daemon] EP959: Failed to create worktree for ${moduleUid}: ${createResult.error}`);
-                  return;
-                }
-                console.log(`[Daemon] EP959: Worktree created for ${moduleUid} at ${createResult.worktreePath}`);
-                if (this.deviceId) {
-                  try {
-                    const ownershipConfig = await (0, import_core10.loadConfig)();
-                    const ownershipApiUrl = ownershipConfig?.api_url || "https://episoda.dev";
-                    const ownershipResponse = await fetchWithAuth(`${ownershipApiUrl}/api/modules/${moduleUid}`, {
-                      method: "PATCH",
-                      body: JSON.stringify({ checkout_machine_id: this.deviceId })
-                    });
-                    if (ownershipResponse.ok) {
-                      console.log(`[Daemon] EP990: Claimed ownership of ${moduleUid} for device ${this.deviceId}`);
-                    } else {
-                      console.warn(`[Daemon] EP990: Failed to claim ownership of ${moduleUid}: ${ownershipResponse.status}`);
-                    }
-                  } catch (ownershipError) {
-                    console.warn(`[Daemon] EP990: Error claiming ownership of ${moduleUid}:`, ownershipError);
-                  }
-                }
-                worktree = await getWorktreeInfoForModule(moduleUid);
-                if (!worktree || !worktree.exists) {
-                  console.error(`[Daemon] EP959: Worktree still not found after creation for ${moduleUid}`);
-                  return;
-                }
-                const worktreeConfig = await (0, import_core10.loadConfig)();
-                const setupConfig = worktreeConfig?.project_settings;
-                const envVars = await fetchEnvVars2();
-                const hasEnvVars = Object.keys(envVars).length > 0;
-                const hasSetupConfig = setupConfig?.worktree_copy_files?.length || setupConfig?.worktree_setup_script || hasEnvVars;
-                {
-                  console.log(`[Daemon] EP986: Starting async worktree setup for ${moduleUid}${hasSetupConfig ? " (with config)" : " (for dependency installation)"}`);
-                  await worktreeManager.updateWorktreeStatus(moduleUid, "pending");
-                  await this.updateModuleWorktreeStatus(moduleUid, "pending", worktree.path);
-                  this.runWorktreeSetupAsync(
-                    moduleUid,
-                    worktreeManager,
-                    setupConfig?.worktree_copy_files || [],
-                    setupConfig?.worktree_setup_script,
-                    worktree.path,
-                    envVars
-                    // EP973: Use server-fetched env vars
-                  ).then(() => {
-                    console.log(`[Daemon] EP959: Setup complete for ${moduleUid}, starting tunnel`);
-                    this.startTunnelForModule(moduleUid, worktree.path);
-                  }).catch((err) => {
-                    console.error(`[Daemon] EP959: Setup failed for ${moduleUid}:`, err);
-                  });
-                  return;
-                }
-              }
-              if (!worktree.exists) {
-                console.log(`[Daemon] EP956: No worktree for ${moduleUid} at ${worktree.path}, skipping tunnel`);
-                return;
-              }
-              await this.updateModuleWorktreeStatus(moduleUid, "ready", worktree.path);
-              const port = allocatePort(moduleUid);
-              console.log(`[Daemon] EP956: Using worktree ${worktree.path} on port ${port}`);
-              const devConfig = await (0, import_core10.loadConfig)();
-              const devServerScript = devConfig?.project_settings?.worktree_dev_server_script;
-              const devServerResult = await ensureDevServer(worktree.path, port, moduleUid, devServerScript);
-              if (!devServerResult.success) {
-                console.error(`[Daemon] EP956: Dev server failed for ${moduleUid}: ${devServerResult.error}`);
-                releasePort(moduleUid);
-                return;
-              }
-              const config2 = devConfig;
-              const apiUrl = config2?.api_url || "https://episoda.dev";
-              const startResult = await tunnelManager.startTunnel({
-                moduleUid,
-                port,
-                onUrl: async (url) => {
-                  console.log(`[Daemon] EP956: Tunnel URL for ${moduleUid}: ${url}`);
-                  try {
-                    await fetchWithAuth(`${apiUrl}/api/modules/${moduleUid}/tunnel`, {
-                      method: "POST",
-                      body: JSON.stringify({ tunnel_url: url })
-                    });
-                  } catch (err) {
-                    console.warn(`[Daemon] EP956: Failed to report tunnel URL:`, err instanceof Error ? err.message : err);
-                  }
-                },
-                onStatusChange: (status, error) => {
-                  if (status === "error") {
-                    console.error(`[Daemon] EP956: Tunnel error for ${moduleUid}: ${error}`);
-                  }
-                }
-              });
-              if (startResult.success) {
-                console.log(`[Daemon] EP956: Tunnel started for ${moduleUid}`);
-              } else {
-                console.error(`[Daemon] EP956: Tunnel failed for ${moduleUid}: ${startResult.error}`);
-                releasePort(moduleUid);
-              }
-            } catch (error) {
-              console.error(`[Daemon] EP956: Error starting tunnel for ${moduleUid}:`, error);
-              releasePort(moduleUid);
-            }
-          }
-          if (state === "done" && wasInActiveZone) {
-            console.log(`[Daemon] EP956: Stopping tunnel for ${moduleUid} (${previousState} \u2192 done)`);
-            try {
-              await tunnelManager.stopTunnel(moduleUid);
-              releasePort(moduleUid);
-              console.log(`[Daemon] EP956: Tunnel stopped and port released for ${moduleUid}`);
-              const config2 = await (0, import_core10.loadConfig)();
-              const apiUrl = config2?.api_url || "https://episoda.dev";
-              try {
-                await fetchWithAuth(`${apiUrl}/api/modules/${moduleUid}/tunnel`, {
-                  method: "POST",
-                  body: JSON.stringify({ tunnel_url: null })
-                });
-              } catch (err) {
-                console.warn(`[Daemon] EP956: Failed to clear tunnel URL:`, err instanceof Error ? err.message : err);
-              }
-              this.cleanupModuleWorktree(moduleUid).catch((err) => {
-                console.warn(`[Daemon] EP956: Async cleanup failed for ${moduleUid}:`, err instanceof Error ? err.message : err);
-              });
-            } catch (error) {
-              console.error(`[Daemon] EP956: Error stopping tunnel for ${moduleUid}:`, error);
-              releasePort(moduleUid);
-            }
-          }
-        });
+        if (previousState === "ready" && state === "doing") {
+          console.log(`[Daemon] EP1003: Module ${moduleUid} entering doing - server will send tunnel_start`);
+        } else if (state === "done") {
+          console.log(`[Daemon] EP1003: Module ${moduleUid} entering done - server will send tunnel_stop`);
+        }
       }
     });
     client.on("error", (message) => {
@@ -7840,98 +7686,87 @@ var Daemon = class _Daemon {
    * This self-healing mechanism catches modules that transitioned
    * while the daemon was disconnected.
    */
-  async reconcileWorktrees(projectId, projectPath) {
-    console.log(`[Daemon] EP995: Starting worktree reconciliation for project ${projectId}`);
+  /**
+   * EP1003: Report-only reconciliation
+   * Daemon reports local state to server, server decides what commands to send.
+   * This replaces autonomous worktree creation and tunnel starting.
+   */
+  async reconcileWorktrees(projectId, projectPath, client) {
+    console.log(`[Daemon] EP1003: Starting reconciliation report for project ${projectId}`);
     try {
       if (!this.deviceId) {
-        console.log("[Daemon] EP995: Cannot reconcile - deviceId not available yet");
+        console.log("[Daemon] EP1003: Cannot reconcile - deviceId not available yet");
         return;
       }
       const config = await (0, import_core10.loadConfig)();
       if (!config) return;
       const apiUrl = config.api_url || "https://episoda.dev";
-      const modulesResponse = await fetchWithAuth(
-        `${apiUrl}/api/modules?state=doing,review&dev_mode=local&checkout_machine_id=${this.deviceId}&project_id=${projectId}`
-      );
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), 1e4);
+      let modulesResponse;
+      try {
+        modulesResponse = await fetchWithAuth(
+          `${apiUrl}/api/modules?state=doing,review&dev_mode=local&checkout_machine_id=${this.deviceId}&project_id=${projectId}`,
+          { signal: controller.signal }
+        );
+      } finally {
+        clearTimeout(timeoutId);
+      }
       if (!modulesResponse.ok) {
-        console.warn(`[Daemon] EP995: Failed to fetch modules for reconciliation: ${modulesResponse.status}`);
+        console.warn(`[Daemon] EP1003: Failed to fetch modules for reconciliation: ${modulesResponse.status}`);
         return;
       }
       const modulesData = await modulesResponse.json();
       const modules = modulesData.modules || [];
-      if (modules.length === 0) {
-        console.log("[Daemon] EP995: No modules need reconciliation");
-        return;
-      }
-      console.log(`[Daemon] EP995: Found ${modules.length} module(s) to check`);
-      const worktreeManager = new WorktreeManager(projectPath);
-      const initialized = await worktreeManager.initialize();
-      if (!initialized) {
-        console.error(`[Daemon] EP995: Failed to initialize WorktreeManager`);
-        return;
-      }
+      console.log(`[Daemon] EP1003: Building reconciliation report for ${modules.length} module(s)`);
+      const tunnelManager = getTunnelManager();
+      await tunnelManager.initialize();
+      const moduleStatuses = [];
+      const expectedModuleUids = new Set(modules.map((m) => m.uid));
       for (const module2 of modules) {
         const moduleUid = module2.uid;
-        const branchName = module2.branch_name;
         const worktree = await getWorktreeInfoForModule(moduleUid);
-        if (!worktree?.exists) {
-          console.log(`[Daemon] EP995: Module ${moduleUid} missing local worktree - creating...`);
-          const moduleBranchName = branchName || moduleUid;
-          const createResult = await worktreeManager.createWorktree(moduleUid, moduleBranchName, true);
-          if (!createResult.success) {
-            console.error(`[Daemon] EP995: Failed to create worktree for ${moduleUid}: ${createResult.error}`);
-            continue;
-          }
-          console.log(`[Daemon] EP995: Created worktree for ${moduleUid} at ${createResult.worktreePath}`);
-          if (this.deviceId) {
-            try {
-              await fetchWithAuth(`${apiUrl}/api/modules/${moduleUid}`, {
-                method: "PATCH",
-                body: JSON.stringify({ checkout_machine_id: this.deviceId })
-              });
-              console.log(`[Daemon] EP995: Claimed ownership of ${moduleUid}`);
-            } catch (ownershipError) {
-              console.warn(`[Daemon] EP995: Failed to claim ownership of ${moduleUid}`);
-            }
-          }
-          const newWorktree = await getWorktreeInfoForModule(moduleUid);
-          if (!newWorktree?.exists) {
-            console.error(`[Daemon] EP995: Worktree still not found after creation`);
-            continue;
-          }
-          const setupConfig = config.project_settings;
-          const envVars = await fetchEnvVars2();
-          console.log(`[Daemon] EP995: Starting setup for reconciled module ${moduleUid}`);
-          await worktreeManager.updateWorktreeStatus(moduleUid, "pending");
-          await this.updateModuleWorktreeStatus(moduleUid, "pending", newWorktree.path);
-          this.runWorktreeSetupAsync(
-            moduleUid,
-            worktreeManager,
-            setupConfig?.worktree_copy_files || [],
-            setupConfig?.worktree_setup_script,
-            newWorktree.path,
-            envVars
-          ).then(() => {
-            console.log(`[Daemon] EP995: Setup complete for reconciled ${moduleUid}`);
-            this.startTunnelForModule(moduleUid, newWorktree.path);
-          }).catch((err) => {
-            console.error(`[Daemon] EP995: Setup failed for reconciled ${moduleUid}:`, err);
+        const tunnelRunning = tunnelManager.hasTunnel(moduleUid);
+        const tunnelInfo = tunnelManager.getTunnel(moduleUid);
+        const status = {
+          moduleUid,
+          moduleState: module2.state,
+          worktreeExists: worktree?.exists || false,
+          worktreePath: worktree?.path,
+          tunnelRunning,
+          tunnelPort: tunnelInfo?.port
+        };
+        moduleStatuses.push(status);
+        console.log(`[Daemon] EP1003: Module ${moduleUid}: worktree=${status.worktreeExists}, tunnel=${status.tunnelRunning}`);
+      }
+      const allTunnels = tunnelManager.getAllTunnels();
+      const orphanTunnels = [];
+      for (const tunnel of allTunnels) {
+        if (!expectedModuleUids.has(tunnel.moduleUid)) {
+          console.log(`[Daemon] EP1003: Detected orphan tunnel for ${tunnel.moduleUid} (port ${tunnel.port})`);
+          orphanTunnels.push({
+            moduleUid: tunnel.moduleUid,
+            port: tunnel.port
           });
-        } else {
-          await this.updateModuleWorktreeStatus(moduleUid, "ready", worktree.path);
-          const tunnelManager = getTunnelManager();
-          await tunnelManager.initialize();
-          if (!tunnelManager.hasTunnel(moduleUid)) {
-            console.log(`[Daemon] EP995: Module ${moduleUid} has worktree but no tunnel - starting...`);
-            await this.startTunnelForModule(moduleUid, worktree.path);
-          } else {
-            console.log(`[Daemon] EP995: Module ${moduleUid} OK - worktree and tunnel exist`);
-          }
         }
       }
-      console.log("[Daemon] EP995: Reconciliation complete");
+      if (orphanTunnels.length > 0) {
+        console.log(`[Daemon] EP1003: Reporting ${orphanTunnels.length} orphan tunnel(s) for server cleanup`);
+      }
+      const report = {
+        projectId,
+        machineId: this.deviceId,
+        modules: moduleStatuses,
+        orphanTunnels: orphanTunnels.length > 0 ? orphanTunnels : void 0
+      };
+      console.log(`[Daemon] EP1003: Sending reconciliation report with ${moduleStatuses.length} module(s)`);
+      await client.send({
+        type: "reconciliation_report",
+        report
+      });
+      console.log("[Daemon] EP1003: Reconciliation report sent - awaiting server commands");
     } catch (error) {
-      console.error("[Daemon] EP995: Reconciliation error:", error instanceof Error ? error.message : error);
+      console.error("[Daemon] EP1003: Reconciliation error:", error instanceof Error ? error.message : error);
       throw error;
     }
   }
@@ -7996,6 +7831,90 @@ var Daemon = class _Daemon {
       throw error;
     }
   }
+  /**
+   * EP1002: Handle worktree_setup command from server
+   * This provides a unified setup flow for both local and cloud environments.
+   * Server orchestrates, daemon executes.
+   */
+  async handleWorktreeSetup(command, projectPath, worktreeManager) {
+    const { path: worktreePath, moduleUid } = command;
+    console.log(`[Daemon] EP1002: Handling worktree_setup for ${moduleUid} at ${worktreePath}`);
+    try {
+      const envVars = await fetchEnvVars2();
+      console.log(`[Daemon] EP1002: Fetched ${Object.keys(envVars).length} env vars for ${moduleUid}`);
+      const config = await (0, import_core10.loadConfig)();
+      const setupConfig = config?.project_settings;
+      await this.runWorktreeSetupSync(
+        moduleUid,
+        worktreeManager,
+        setupConfig?.worktree_copy_files || [],
+        setupConfig?.worktree_setup_script,
+        worktreePath,
+        envVars
+      );
+      return {
+        success: true,
+        output: `Worktree setup completed for ${moduleUid}`,
+        details: {
+          moduleUid,
+          worktreePath,
+          envVarsCount: Object.keys(envVars).length
+        }
+      };
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      console.error(`[Daemon] EP1002: Worktree setup failed for ${moduleUid}:`, errorMessage);
+      return {
+        success: false,
+        error: "SETUP_FAILED",
+        output: errorMessage
+      };
+    }
+  }
+  /**
+   * EP1002: Synchronous worktree setup for command-driven flow
+   * Similar to runWorktreeSetupAsync but runs synchronously for server orchestration
+   */
+  async runWorktreeSetupSync(moduleUid, worktreeManager, copyFiles, setupScript, worktreePath, envVars = {}) {
+    console.log(`[Daemon] EP1002: Running worktree setup for ${moduleUid}`);
+    await worktreeManager.updateWorktreeStatus(moduleUid, "running");
+    await this.updateModuleWorktreeStatus(moduleUid, "setup", worktreePath);
+    if (Object.keys(envVars).length > 0) {
+      console.log(`[Daemon] EP1002: Writing .env with ${Object.keys(envVars).length} variables`);
+      writeEnvFile(worktreePath, envVars);
+    }
+    const installCmd = getInstallCommand(worktreePath);
+    if (installCmd) {
+      console.log(`[Daemon] EP1002: ${installCmd.description} (detected from ${installCmd.detectedFrom})`);
+      console.log(`[Daemon] EP1002: Running: ${installCmd.command.join(" ")}`);
+      try {
+        const { execSync: execSync7 } = await import("child_process");
+        execSync7(installCmd.command.join(" "), {
+          cwd: worktreePath,
+          stdio: "inherit",
+          timeout: 10 * 60 * 1e3,
+          // 10 minute timeout
+          env: { ...process.env, CI: "true" }
+        });
+        console.log(`[Daemon] EP1002: Dependencies installed successfully`);
+      } catch (installError) {
+        const errorMsg = installError instanceof Error ? installError.message : String(installError);
+        console.warn(`[Daemon] EP1002: Dependency installation failed (non-fatal): ${errorMsg}`);
+      }
+    } else {
+      console.log(`[Daemon] EP1002: No package manager detected, skipping dependency installation`);
+    }
+    if (setupScript) {
+      console.log(`[Daemon] EP1002: Running setup script`);
+      const scriptResult = await worktreeManager.runSetupScript(moduleUid, setupScript);
+      if (!scriptResult.success) {
+        throw new Error(`Setup script failed: ${scriptResult.error}`);
+      }
+    }
+    await worktreeManager.updateWorktreeStatus(moduleUid, "ready");
+    await this.updateModuleWorktreeStatus(moduleUid, "ready", worktreePath);
+    console.log(`[Daemon] EP1002: Worktree setup complete for ${moduleUid}`);
+  }
   /**
    * EP959-11: Run worktree setup asynchronously
    * EP964: Added envVars parameter to inject .env file
@@ -8059,222 +7978,10 @@ var Daemon = class _Daemon {
       throw error;
     }
   }
-  /**
-   * EP959-11: Start tunnel for a module after setup completes
-   */
-  async startTunnelForModule(moduleUid, worktreePath) {
-    const tunnelManager = getTunnelManager();
-    await tunnelManager.initialize();
-    if (tunnelManager.hasTunnel(moduleUid)) {
-      console.log(`[Daemon] EP959: Tunnel already running for ${moduleUid}`);
-      return;
-    }
-    try {
-      const config = await (0, import_core10.loadConfig)();
-      const apiUrl = config?.api_url || "https://episoda.dev";
-      const devServerScript = config?.project_settings?.worktree_dev_server_script;
-      const port = allocatePort(moduleUid);
-      console.log(`[Daemon] EP959: Post-setup tunnel start for ${moduleUid} on port ${port}`);
-      const devServerResult = await ensureDevServer(worktreePath, port, moduleUid, devServerScript);
-      if (!devServerResult.success) {
-        console.error(`[Daemon] EP959: Dev server failed for ${moduleUid}: ${devServerResult.error}`);
-        releasePort(moduleUid);
-        return;
-      }
-      const startResult = await tunnelManager.startTunnel({
-        moduleUid,
-        port,
-        onUrl: async (url) => {
-          console.log(`[Daemon] EP959: Tunnel URL for ${moduleUid}: ${url}`);
-          try {
-            await fetchWithAuth(`${apiUrl}/api/modules/${moduleUid}/tunnel`, {
-              method: "POST",
-              body: JSON.stringify({ tunnel_url: url })
-            });
-          } catch (err) {
-            console.warn(`[Daemon] EP959: Failed to report tunnel URL:`, err instanceof Error ? err.message : err);
-          }
-        },
-        onStatusChange: (status, error) => {
-          if (status === "error") {
-            console.error(`[Daemon] EP959: Tunnel error for ${moduleUid}: ${error}`);
-          }
-        }
-      });
-      if (startResult.success) {
-        console.log(`[Daemon] EP959: Tunnel started for ${moduleUid}`);
-      } else {
-        console.error(`[Daemon] EP959: Tunnel failed for ${moduleUid}: ${startResult.error}`);
-        releasePort(moduleUid);
-      }
-    } catch (error) {
-      console.error(`[Daemon] EP959: Error starting tunnel for ${moduleUid}:`, error);
-      releasePort(moduleUid);
-    }
-  }
-  /**
-   * EP819: Auto-start tunnels for active local modules on daemon connect/reconnect
-   *
-   * Queries for modules in doing/review state with dev_mode=local that don't have
-   * an active tunnel_url, and starts tunnels for each.
-   */
-  async autoStartTunnelsForProject(projectPath, projectUid) {
-    console.log(`[Daemon] EP819: Checking for active local modules to auto-start tunnels...`);
-    try {
-      const config = await (0, import_core10.loadConfig)();
-      if (!config?.access_token) {
-        console.warn(`[Daemon] EP819: No access token, skipping tunnel auto-start`);
-        return;
-      }
-      const apiUrl = config.api_url || "https://episoda.dev";
-      const response = await fetchWithAuth(
-        `${apiUrl}/api/modules?state=doing,review&fields=id,uid,dev_mode,tunnel_url,checkout_machine_id`
-      );
-      if (!response.ok) {
-        console.warn(`[Daemon] EP819: Failed to fetch modules: ${response.status}`);
-        return;
-      }
-      const data = await response.json();
-      const modules = data.modules || [];
-      const tunnelManager = getTunnelManager();
-      await tunnelManager.initialize();
-      const activeTunnelUids = tunnelManager.getActiveModuleUids();
-      const validModuleUids = new Set(
-        modules.filter(
-          (m) => m.dev_mode === "local" && (!m.checkout_machine_id || m.checkout_machine_id === this.deviceId)
-        ).map((m) => m.uid)
-      );
-      const orphanedTunnels = activeTunnelUids.filter((uid) => !validModuleUids.has(uid));
-      if (orphanedTunnels.length > 0) {
-        console.log(`[Daemon] EP956: Found ${orphanedTunnels.length} orphaned tunnels to stop: ${orphanedTunnels.join(", ")}`);
-        for (const orphanUid of orphanedTunnels) {
-          try {
-            await tunnelManager.stopTunnel(orphanUid);
-            releasePort(orphanUid);
-            console.log(`[Daemon] EP956: Stopped orphaned tunnel and released port for ${orphanUid}`);
-            try {
-              await fetchWithAuth(`${apiUrl}/api/modules/${orphanUid}/tunnel`, {
-                method: "POST",
-                body: JSON.stringify({ tunnel_url: null })
-              });
-            } catch (err) {
-              console.warn(`[Daemon] EP956: Failed to clear tunnel URL for ${orphanUid}:`, err instanceof Error ? err.message : err);
-            }
-          } catch (err) {
-            console.error(`[Daemon] EP956: Failed to stop orphaned tunnel ${orphanUid}:`, err instanceof Error ? err.message : err);
-          }
-        }
-      }
-      const localModulesNeedingTunnel = modules.filter(
-        (m) => m.dev_mode === "local" && (!m.checkout_machine_id || m.checkout_machine_id === this.deviceId) && !tunnelManager.hasTunnel(m.uid)
-      );
-      if (localModulesNeedingTunnel.length === 0) {
-        console.log(`[Daemon] EP819: No local modules need tunnel auto-start`);
-        return;
-      }
-      console.log(`[Daemon] EP956: Found ${localModulesNeedingTunnel.length} local modules needing tunnels`);
-      for (const module2 of localModulesNeedingTunnel) {
-        const moduleUid = module2.uid;
-        const worktree = await getWorktreeInfoForModule(moduleUid);
-        if (!worktree) {
-          console.warn(`[Daemon] EP956: Cannot resolve worktree for ${moduleUid} (missing config slugs)`);
-          continue;
-        }
-        if (!worktree.exists) {
-          console.log(`[Daemon] EP956: No worktree for ${moduleUid} at ${worktree.path}, skipping`);
-          continue;
-        }
-        const port = allocatePort(moduleUid);
-        console.log(`[Daemon] EP956: Auto-starting tunnel for ${moduleUid} at ${worktree.path} on port ${port}`);
-        const reportTunnelStatus = async (statusData) => {
-          try {
-            const statusResponse = await fetchWithAuth(`${apiUrl}/api/modules/${moduleUid}/tunnel`, {
-              method: "POST",
-              body: JSON.stringify(statusData)
-            });
-            if (statusResponse.ok) {
-              console.log(`[Daemon] EP819: Tunnel status reported for ${moduleUid}`);
-            } else {
-              console.warn(`[Daemon] EP819: Failed to report tunnel status: ${statusResponse.statusText}`);
-            }
-          } catch (reportError) {
-            console.warn(`[Daemon] EP819: Error reporting tunnel status:`, reportError);
-          }
-        };
-        (async () => {
-          await this.withTunnelLock(moduleUid, async () => {
-            if (tunnelManager.hasTunnel(moduleUid)) {
-              console.log(`[Daemon] EP956: Tunnel already running for ${moduleUid}, skipping auto-start`);
-              return;
-            }
-            const MAX_RETRIES = 3;
-            const RETRY_DELAY_MS = 3e3;
-            await reportTunnelStatus({
-              tunnel_started_at: (/* @__PURE__ */ new Date()).toISOString(),
-              tunnel_error: null
-            });
-            try {
-              const devServerScript = config.project_settings?.worktree_dev_server_script;
-              console.log(`[Daemon] EP956: Ensuring dev server is running for ${moduleUid} at ${worktree.path}...`);
-              const devServerResult = await ensureDevServer(worktree.path, port, moduleUid, devServerScript);
-              if (!devServerResult.success) {
-                const errorMsg2 = `Dev server failed to start: ${devServerResult.error}`;
-                console.error(`[Daemon] EP956: ${errorMsg2}`);
-                await reportTunnelStatus({ tunnel_error: errorMsg2 });
-                releasePort(moduleUid);
-                return;
-              }
-              console.log(`[Daemon] EP956: Dev server ready on port ${port}`);
-              let lastError;
-              for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
-                console.log(`[Daemon] EP819: Starting tunnel for ${moduleUid} (attempt ${attempt}/${MAX_RETRIES})...`);
-                const startResult = await tunnelManager.startTunnel({
-                  moduleUid,
-                  port,
-                  onUrl: async (url) => {
-                    console.log(`[Daemon] EP819: Tunnel URL for ${moduleUid}: ${url}`);
-                    await reportTunnelStatus({
-                      tunnel_url: url,
-                      tunnel_error: null
-                    });
-                  },
-                  onStatusChange: (status, error) => {
-                    if (status === "error") {
-                      console.error(`[Daemon] EP819: Tunnel error for ${moduleUid}: ${error}`);
-                      reportTunnelStatus({ tunnel_error: error || "Tunnel connection error" });
-                    } else if (status === "reconnecting") {
-                      console.log(`[Daemon] EP819: Tunnel reconnecting for ${moduleUid}...`);
-                    }
-                  }
-                });
-                if (startResult.success) {
-                  console.log(`[Daemon] EP819: Tunnel started successfully for ${moduleUid}`);
-                  return;
-                }
-                lastError = startResult.error;
-                console.warn(`[Daemon] EP819: Tunnel start attempt ${attempt} failed: ${lastError}`);
-                if (attempt < MAX_RETRIES) {
-                  console.log(`[Daemon] EP819: Retrying in ${RETRY_DELAY_MS}ms...`);
-                  await new Promise((resolve3) => setTimeout(resolve3, RETRY_DELAY_MS));
-                }
-              }
-              const errorMsg = `Tunnel failed after ${MAX_RETRIES} attempts: ${lastError}`;
-              console.error(`[Daemon] EP956: ${errorMsg}`);
-              await reportTunnelStatus({ tunnel_error: errorMsg });
-              releasePort(moduleUid);
-            } catch (error) {
-              const errorMsg = error instanceof Error ? error.message : String(error);
-              console.error(`[Daemon] EP956: Async tunnel startup error:`, error);
-              await reportTunnelStatus({ tunnel_error: errorMsg });
-              releasePort(moduleUid);
-            }
-          });
-        })();
-      }
-    } catch (error) {
-      console.error(`[Daemon] EP819: Error auto-starting tunnels:`, error);
-    }
-  }
+  // EP1003: startTunnelForModule removed - server now orchestrates via tunnel_start commands
+  // EP1003: autoStartTunnelsForProject removed - server now orchestrates via reconciliation
+  // Recovery flow: daemon sends reconciliation_report → server processes and sends commands
+  // Orphan tunnel cleanup is now also handled server-side via reconciliation report
   // EP843: startTunnelPolling() removed - replaced by push-based state sync
   // See module_state_changed handler for the new implementation
   /**
@@ -8593,7 +8300,9 @@ var Daemon = class _Daemon {
               method: "POST",
               body: JSON.stringify({
                 tunnel_url: url,
-                tunnel_error: null
+                tunnel_error: null,
+                restart_reason: "health_check_failure"
+                // EP1003: Server can track restart causes
               })
             });
           } catch (e) {