episoda 0.2.36 → 0.2.38

package/dist/daemon/daemon-process.js

@@ -2721,7 +2721,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "episoda",
-      version: "0.2.35",
+      version: "0.2.38",
       description: "CLI tool for Episoda local development workflow orchestration",
       main: "dist/index.js",
       types: "dist/index.d.ts",
@@ -5452,6 +5452,11 @@ async function startDevServer(projectPath, port = 3e3, moduleUid = "default", op
       });
       injectedEnvVars = result.envVars;
       console.log(`[DevServer] EP998: Loaded ${Object.keys(injectedEnvVars).length} env vars (from ${result.fromCache ? "cache" : "server"})`);
+      const envFilePath = path12.join(projectPath, ".env");
+      if (!fs11.existsSync(envFilePath) && Object.keys(injectedEnvVars).length > 0) {
+        console.log(`[DevServer] EP1004: .env file missing, writing ${Object.keys(injectedEnvVars).length} vars to ${envFilePath}`);
+        writeEnvFile(projectPath, injectedEnvVars);
+      }
     } else {
       console.log(`[DevServer] EP998: No auth config, skipping env var injection`);
     }
@@ -6266,39 +6271,7 @@ async function getWorktreeInfoForModule(moduleUid) {
 }
 
 // src/utils/port-allocator.ts
-var PORT_RANGE_START = 3100;
-var PORT_RANGE_END = 3199;
-var PORT_WARNING_THRESHOLD = 80;
 var portAssignments = /* @__PURE__ */ new Map();
-function allocatePort(moduleUid) {
-  const existing = portAssignments.get(moduleUid);
-  if (existing) {
-    return existing;
-  }
-  const usedPorts = new Set(portAssignments.values());
-  if (usedPorts.size >= PORT_WARNING_THRESHOLD) {
-    console.warn(
-      `[PortAllocator] Warning: ${usedPorts.size}/${PORT_RANGE_END - PORT_RANGE_START + 1} ports allocated`
-    );
-  }
-  for (let port = PORT_RANGE_START; port <= PORT_RANGE_END; port++) {
-    if (!usedPorts.has(port)) {
-      portAssignments.set(moduleUid, port);
-      console.log(`[PortAllocator] Assigned port ${port} to ${moduleUid}`);
-      return port;
-    }
-  }
-  throw new Error(
-    `No available ports in range ${PORT_RANGE_START}-${PORT_RANGE_END}. ${portAssignments.size} modules are using all available ports.`
-  );
-}
-function releasePort(moduleUid) {
-  const port = portAssignments.get(moduleUid);
-  if (port) {
-    portAssignments.delete(moduleUid);
-    console.log(`[PortAllocator] Released port ${port} from ${moduleUid}`);
-  }
-}
 function clearAllPorts() {
   const count = portAssignments.size;
   portAssignments.clear();
@@ -6531,7 +6504,7 @@ var Daemon = class _Daemon {
     // EP837: Prevent concurrent commit syncs (backpressure guard)
     this.commitSyncInProgress = false;
     // EP843: Per-module mutex for tunnel operations
-    // Prevents race conditions between autoStartTunnels and module_state_changed handler
+    // EP1003: Prevents race conditions between server-orchestrated tunnel commands
     this.tunnelOperationLocks = /* @__PURE__ */ new Map();
     // moduleUid -> operation promise
     // EP929: Health check polling interval (restored from EP843 removal)
@@ -6816,7 +6789,7 @@ var Daemon = class _Daemon {
    * EP843: Acquire a per-module lock for tunnel operations
    *
    * Prevents race conditions between:
-   * - autoStartTunnelsForProject() on auth_success
+   * - Server-orchestrated tunnel_start commands (EP1003)
    * - module_state_changed event handler
    * - Multiple rapid state transitions
    *
@@ -7358,9 +7331,6 @@ var Daemon = class _Daemon {
       this.syncMachineProjectPath(projectId, projectPath).catch((err) => {
         console.warn("[Daemon] EP995: Project path sync failed:", err.message);
       });
-      this.autoStartTunnelsForProject(projectPath, projectId).catch((error) => {
-        console.error(`[Daemon] EP819: Failed to auto-start tunnels:`, error);
-      });
       cleanupStaleCommits(projectPath).then((cleanupResult) => {
         if (cleanupResult.deleted_count > 0) {
           console.log(`[Daemon] EP950: Cleaned up ${cleanupResult.deleted_count} stale commit(s) on connect`);
@@ -7368,8 +7338,8 @@ var Daemon = class _Daemon {
       }).catch((err) => {
         console.warn("[Daemon] EP950: Cleanup on connect failed:", err.message);
       });
-      this.reconcileWorktrees(projectId, projectPath).catch((err) => {
-        console.warn("[Daemon] EP995: Reconciliation failed:", err.message);
+      this.reconcileWorktrees(projectId, projectPath, client).catch((err) => {
+        console.warn("[Daemon] EP1003: Reconciliation report failed:", err.message);
       });
     });
     client.on("module_state_changed", async (message) => {
@@ -7377,106 +7347,18 @@ var Daemon = class _Daemon {
         const { moduleUid, state, previousState, branchName, devMode, checkoutMachineId } = message;
         console.log(`[Daemon] EP843: Module ${moduleUid} state changed: ${previousState} \u2192 ${state}`);
         if (devMode !== "local") {
-          console.log(`[Daemon] EP843: Skipping tunnel action for ${moduleUid} (mode: ${devMode || "unknown"})`);
+          console.log(`[Daemon] EP1003: State change for non-local module ${moduleUid} (mode: ${devMode || "unknown"})`);
           return;
         }
         if (checkoutMachineId && checkoutMachineId !== this.deviceId) {
-          console.log(`[Daemon] EP956: Skipping ${moduleUid} (checked out on different machine: ${checkoutMachineId})`);
+          console.log(`[Daemon] EP1003: State change for ${moduleUid} handled by different machine: ${checkoutMachineId}`);
           return;
         }
-        const tunnelManager = getTunnelManager();
-        await tunnelManager.initialize();
-        await this.withTunnelLock(moduleUid, async () => {
-          const isInActiveZone = state === "ready" || state === "doing" || state === "review";
-          const wasInActiveZone = previousState === "ready" || previousState === "doing" || previousState === "review";
-          const startingWork = previousState === "ready" && state === "doing";
-          const tunnelNotRunning = !tunnelManager.hasTunnel(moduleUid);
-          const needsCrashRecovery = isInActiveZone && tunnelNotRunning;
-          if (startingWork || needsCrashRecovery) {
-            if (tunnelManager.hasTunnel(moduleUid)) {
-              console.log(`[Daemon] EP843: Tunnel already running for ${moduleUid}, skipping start`);
-              return;
-            }
-            console.log(`[Daemon] EP956: Starting tunnel for ${moduleUid} (${previousState} \u2192 ${state})`);
-            try {
-              let worktree = await getWorktreeInfoForModule(moduleUid);
-              if (!worktree) {
-                console.error(`[Daemon] EP956: Cannot resolve worktree path for ${moduleUid} (missing config slugs)`);
-                return;
-              }
-              if (!worktree.exists) {
-                console.log(`[Daemon] EP956: No worktree for ${moduleUid} at ${worktree.path}, skipping tunnel`);
-                return;
-              }
-              await this.updateModuleWorktreeStatus(moduleUid, "ready", worktree.path);
-              const port = allocatePort(moduleUid);
-              console.log(`[Daemon] EP956: Using worktree ${worktree.path} on port ${port}`);
-              const devConfig = await (0, import_core10.loadConfig)();
-              const devServerScript = devConfig?.project_settings?.worktree_dev_server_script;
-              const devServerResult = await ensureDevServer(worktree.path, port, moduleUid, devServerScript);
-              if (!devServerResult.success) {
-                console.error(`[Daemon] EP956: Dev server failed for ${moduleUid}: ${devServerResult.error}`);
-                releasePort(moduleUid);
-                return;
-              }
-              const config2 = devConfig;
-              const apiUrl = config2?.api_url || "https://episoda.dev";
-              const startResult = await tunnelManager.startTunnel({
-                moduleUid,
-                port,
-                onUrl: async (url) => {
-                  console.log(`[Daemon] EP956: Tunnel URL for ${moduleUid}: ${url}`);
-                  try {
-                    await fetchWithAuth(`${apiUrl}/api/modules/${moduleUid}/tunnel`, {
-                      method: "POST",
-                      body: JSON.stringify({ tunnel_url: url })
-                    });
-                  } catch (err) {
-                    console.warn(`[Daemon] EP956: Failed to report tunnel URL:`, err instanceof Error ? err.message : err);
-                  }
-                },
-                onStatusChange: (status, error) => {
-                  if (status === "error") {
-                    console.error(`[Daemon] EP956: Tunnel error for ${moduleUid}: ${error}`);
-                  }
-                }
-              });
-              if (startResult.success) {
-                console.log(`[Daemon] EP956: Tunnel started for ${moduleUid}`);
-              } else {
-                console.error(`[Daemon] EP956: Tunnel failed for ${moduleUid}: ${startResult.error}`);
-                releasePort(moduleUid);
-              }
-            } catch (error) {
-              console.error(`[Daemon] EP956: Error starting tunnel for ${moduleUid}:`, error);
-              releasePort(moduleUid);
-            }
-          }
-          if (state === "done" && wasInActiveZone) {
-            console.log(`[Daemon] EP956: Stopping tunnel for ${moduleUid} (${previousState} \u2192 done)`);
-            try {
-              await tunnelManager.stopTunnel(moduleUid);
-              releasePort(moduleUid);
-              console.log(`[Daemon] EP956: Tunnel stopped and port released for ${moduleUid}`);
-              const config2 = await (0, import_core10.loadConfig)();
-              const apiUrl = config2?.api_url || "https://episoda.dev";
-              try {
-                await fetchWithAuth(`${apiUrl}/api/modules/${moduleUid}/tunnel`, {
-                  method: "POST",
-                  body: JSON.stringify({ tunnel_url: null })
-                });
-              } catch (err) {
-                console.warn(`[Daemon] EP956: Failed to clear tunnel URL:`, err instanceof Error ? err.message : err);
-              }
-              this.cleanupModuleWorktree(moduleUid).catch((err) => {
-                console.warn(`[Daemon] EP956: Async cleanup failed for ${moduleUid}:`, err instanceof Error ? err.message : err);
-              });
-            } catch (error) {
-              console.error(`[Daemon] EP956: Error stopping tunnel for ${moduleUid}:`, error);
-              releasePort(moduleUid);
-            }
-          }
-        });
+        if (previousState === "ready" && state === "doing") {
+          console.log(`[Daemon] EP1003: Module ${moduleUid} entering doing - server will send tunnel_start`);
+        } else if (state === "done") {
+          console.log(`[Daemon] EP1003: Module ${moduleUid} entering done - server will send tunnel_stop`);
+        }
       }
     });
     client.on("error", (message) => {
@@ -7809,98 +7691,87 @@ var Daemon = class _Daemon {
    * This self-healing mechanism catches modules that transitioned
    * while the daemon was disconnected.
    */
-  async reconcileWorktrees(projectId, projectPath) {
-    console.log(`[Daemon] EP995: Starting worktree reconciliation for project ${projectId}`);
+  /**
+   * EP1003: Report-only reconciliation
+   * Daemon reports local state to server, server decides what commands to send.
+   * This replaces autonomous worktree creation and tunnel starting.
+   */
+  async reconcileWorktrees(projectId, projectPath, client) {
+    console.log(`[Daemon] EP1003: Starting reconciliation report for project ${projectId}`);
     try {
       if (!this.deviceId) {
-        console.log("[Daemon] EP995: Cannot reconcile - deviceId not available yet");
+        console.log("[Daemon] EP1003: Cannot reconcile - deviceId not available yet");
         return;
       }
       const config = await (0, import_core10.loadConfig)();
       if (!config) return;
       const apiUrl = config.api_url || "https://episoda.dev";
-      const modulesResponse = await fetchWithAuth(
-        `${apiUrl}/api/modules?state=doing,review&dev_mode=local&checkout_machine_id=${this.deviceId}&project_id=${projectId}`
-      );
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), 1e4);
+      let modulesResponse;
+      try {
+        modulesResponse = await fetchWithAuth(
+          `${apiUrl}/api/modules?state=doing,review&dev_mode=local&checkout_machine_id=${this.deviceId}&project_id=${projectId}`,
+          { signal: controller.signal }
+        );
+      } finally {
+        clearTimeout(timeoutId);
+      }
       if (!modulesResponse.ok) {
-        console.warn(`[Daemon] EP995: Failed to fetch modules for reconciliation: ${modulesResponse.status}`);
+        console.warn(`[Daemon] EP1003: Failed to fetch modules for reconciliation: ${modulesResponse.status}`);
         return;
       }
       const modulesData = await modulesResponse.json();
       const modules = modulesData.modules || [];
-      if (modules.length === 0) {
-        console.log("[Daemon] EP995: No modules need reconciliation");
-        return;
-      }
-      console.log(`[Daemon] EP995: Found ${modules.length} module(s) to check`);
-      const worktreeManager = new WorktreeManager(projectPath);
-      const initialized = await worktreeManager.initialize();
-      if (!initialized) {
-        console.error(`[Daemon] EP995: Failed to initialize WorktreeManager`);
-        return;
-      }
+      console.log(`[Daemon] EP1003: Building reconciliation report for ${modules.length} module(s)`);
+      const tunnelManager = getTunnelManager();
+      await tunnelManager.initialize();
+      const moduleStatuses = [];
+      const expectedModuleUids = new Set(modules.map((m) => m.uid));
       for (const module2 of modules) {
         const moduleUid = module2.uid;
-        const branchName = module2.branch_name;
         const worktree = await getWorktreeInfoForModule(moduleUid);
-        if (!worktree?.exists) {
-          console.log(`[Daemon] EP995: Module ${moduleUid} missing local worktree - creating...`);
-          const moduleBranchName = branchName || moduleUid;
-          const createResult = await worktreeManager.createWorktree(moduleUid, moduleBranchName, true);
-          if (!createResult.success) {
-            console.error(`[Daemon] EP995: Failed to create worktree for ${moduleUid}: ${createResult.error}`);
-            continue;
-          }
-          console.log(`[Daemon] EP995: Created worktree for ${moduleUid} at ${createResult.worktreePath}`);
-          if (this.deviceId) {
-            try {
-              await fetchWithAuth(`${apiUrl}/api/modules/${moduleUid}`, {
-                method: "PATCH",
-                body: JSON.stringify({ checkout_machine_id: this.deviceId })
-              });
-              console.log(`[Daemon] EP995: Claimed ownership of ${moduleUid}`);
-            } catch (ownershipError) {
-              console.warn(`[Daemon] EP995: Failed to claim ownership of ${moduleUid}`);
-            }
-          }
-          const newWorktree = await getWorktreeInfoForModule(moduleUid);
-          if (!newWorktree?.exists) {
-            console.error(`[Daemon] EP995: Worktree still not found after creation`);
-            continue;
-          }
-          const setupConfig = config.project_settings;
-          const envVars = await fetchEnvVars2();
-          console.log(`[Daemon] EP995: Starting setup for reconciled module ${moduleUid}`);
-          await worktreeManager.updateWorktreeStatus(moduleUid, "pending");
-          await this.updateModuleWorktreeStatus(moduleUid, "pending", newWorktree.path);
-          this.runWorktreeSetupAsync(
-            moduleUid,
-            worktreeManager,
-            setupConfig?.worktree_copy_files || [],
-            setupConfig?.worktree_setup_script,
-            newWorktree.path,
-            envVars
-          ).then(() => {
-            console.log(`[Daemon] EP995: Setup complete for reconciled ${moduleUid}`);
-            this.startTunnelForModule(moduleUid, newWorktree.path);
-          }).catch((err) => {
-            console.error(`[Daemon] EP995: Setup failed for reconciled ${moduleUid}:`, err);
+        const tunnelRunning = tunnelManager.hasTunnel(moduleUid);
+        const tunnelInfo = tunnelManager.getTunnel(moduleUid);
+        const status = {
+          moduleUid,
+          moduleState: module2.state,
+          worktreeExists: worktree?.exists || false,
+          worktreePath: worktree?.path,
+          tunnelRunning,
+          tunnelPort: tunnelInfo?.port
+        };
+        moduleStatuses.push(status);
+        console.log(`[Daemon] EP1003: Module ${moduleUid}: worktree=${status.worktreeExists}, tunnel=${status.tunnelRunning}`);
+      }
+      const allTunnels = tunnelManager.getAllTunnels();
+      const orphanTunnels = [];
+      for (const tunnel of allTunnels) {
+        if (!expectedModuleUids.has(tunnel.moduleUid)) {
+          console.log(`[Daemon] EP1003: Detected orphan tunnel for ${tunnel.moduleUid} (port ${tunnel.port})`);
+          orphanTunnels.push({
+            moduleUid: tunnel.moduleUid,
+            port: tunnel.port
           });
-        } else {
-          await this.updateModuleWorktreeStatus(moduleUid, "ready", worktree.path);
-          const tunnelManager = getTunnelManager();
-          await tunnelManager.initialize();
-          if (!tunnelManager.hasTunnel(moduleUid)) {
-            console.log(`[Daemon] EP995: Module ${moduleUid} has worktree but no tunnel - starting...`);
-            await this.startTunnelForModule(moduleUid, worktree.path);
-          } else {
-            console.log(`[Daemon] EP995: Module ${moduleUid} OK - worktree and tunnel exist`);
-          }
         }
       }
-      console.log("[Daemon] EP995: Reconciliation complete");
+      if (orphanTunnels.length > 0) {
+        console.log(`[Daemon] EP1003: Reporting ${orphanTunnels.length} orphan tunnel(s) for server cleanup`);
+      }
+      const report = {
+        projectId,
+        machineId: this.deviceId,
+        modules: moduleStatuses,
+        orphanTunnels: orphanTunnels.length > 0 ? orphanTunnels : void 0
+      };
+      console.log(`[Daemon] EP1003: Sending reconciliation report with ${moduleStatuses.length} module(s)`);
+      await client.send({
+        type: "reconciliation_report",
+        report
+      });
+      console.log("[Daemon] EP1003: Reconciliation report sent - awaiting server commands");
     } catch (error) {
-      console.error("[Daemon] EP995: Reconciliation error:", error instanceof Error ? error.message : error);
+      console.error("[Daemon] EP1003: Reconciliation error:", error instanceof Error ? error.message : error);
       throw error;
     }
   }
@@ -8112,222 +7983,10 @@ var Daemon = class _Daemon {
       throw error;
     }
   }
-  /**
-   * EP959-11: Start tunnel for a module after setup completes
-   */
-  async startTunnelForModule(moduleUid, worktreePath) {
-    const tunnelManager = getTunnelManager();
-    await tunnelManager.initialize();
-    if (tunnelManager.hasTunnel(moduleUid)) {
-      console.log(`[Daemon] EP959: Tunnel already running for ${moduleUid}`);
-      return;
-    }
-    try {
-      const config = await (0, import_core10.loadConfig)();
-      const apiUrl = config?.api_url || "https://episoda.dev";
-      const devServerScript = config?.project_settings?.worktree_dev_server_script;
-      const port = allocatePort(moduleUid);
-      console.log(`[Daemon] EP959: Post-setup tunnel start for ${moduleUid} on port ${port}`);
-      const devServerResult = await ensureDevServer(worktreePath, port, moduleUid, devServerScript);
-      if (!devServerResult.success) {
-        console.error(`[Daemon] EP959: Dev server failed for ${moduleUid}: ${devServerResult.error}`);
-        releasePort(moduleUid);
-        return;
-      }
-      const startResult = await tunnelManager.startTunnel({
-        moduleUid,
-        port,
-        onUrl: async (url) => {
-          console.log(`[Daemon] EP959: Tunnel URL for ${moduleUid}: ${url}`);
-          try {
-            await fetchWithAuth(`${apiUrl}/api/modules/${moduleUid}/tunnel`, {
-              method: "POST",
-              body: JSON.stringify({ tunnel_url: url })
-            });
-          } catch (err) {
-            console.warn(`[Daemon] EP959: Failed to report tunnel URL:`, err instanceof Error ? err.message : err);
-          }
-        },
-        onStatusChange: (status, error) => {
-          if (status === "error") {
-            console.error(`[Daemon] EP959: Tunnel error for ${moduleUid}: ${error}`);
-          }
-        }
-      });
-      if (startResult.success) {
-        console.log(`[Daemon] EP959: Tunnel started for ${moduleUid}`);
-      } else {
-        console.error(`[Daemon] EP959: Tunnel failed for ${moduleUid}: ${startResult.error}`);
-        releasePort(moduleUid);
-      }
-    } catch (error) {
-      console.error(`[Daemon] EP959: Error starting tunnel for ${moduleUid}:`, error);
-      releasePort(moduleUid);
-    }
-  }
-  /**
-   * EP819: Auto-start tunnels for active local modules on daemon connect/reconnect
-   *
-   * Queries for modules in doing/review state with dev_mode=local that don't have
-   * an active tunnel_url, and starts tunnels for each.
-   */
-  async autoStartTunnelsForProject(projectPath, projectUid) {
-    console.log(`[Daemon] EP819: Checking for active local modules to auto-start tunnels...`);
-    try {
-      const config = await (0, import_core10.loadConfig)();
-      if (!config?.access_token) {
-        console.warn(`[Daemon] EP819: No access token, skipping tunnel auto-start`);
-        return;
-      }
-      const apiUrl = config.api_url || "https://episoda.dev";
-      const response = await fetchWithAuth(
-        `${apiUrl}/api/modules?state=doing,review&fields=id,uid,dev_mode,tunnel_url,checkout_machine_id`
-      );
-      if (!response.ok) {
-        console.warn(`[Daemon] EP819: Failed to fetch modules: ${response.status}`);
-        return;
-      }
-      const data = await response.json();
-      const modules = data.modules || [];
-      const tunnelManager = getTunnelManager();
-      await tunnelManager.initialize();
-      const activeTunnelUids = tunnelManager.getActiveModuleUids();
-      const validModuleUids = new Set(
-        modules.filter(
-          (m) => m.dev_mode === "local" && (!m.checkout_machine_id || m.checkout_machine_id === this.deviceId)
-        ).map((m) => m.uid)
-      );
-      const orphanedTunnels = activeTunnelUids.filter((uid) => !validModuleUids.has(uid));
-      if (orphanedTunnels.length > 0) {
-        console.log(`[Daemon] EP956: Found ${orphanedTunnels.length} orphaned tunnels to stop: ${orphanedTunnels.join(", ")}`);
-        for (const orphanUid of orphanedTunnels) {
-          try {
-            await tunnelManager.stopTunnel(orphanUid);
-            releasePort(orphanUid);
-            console.log(`[Daemon] EP956: Stopped orphaned tunnel and released port for ${orphanUid}`);
-            try {
-              await fetchWithAuth(`${apiUrl}/api/modules/${orphanUid}/tunnel`, {
-                method: "POST",
-                body: JSON.stringify({ tunnel_url: null })
-              });
-            } catch (err) {
-              console.warn(`[Daemon] EP956: Failed to clear tunnel URL for ${orphanUid}:`, err instanceof Error ? err.message : err);
-            }
-          } catch (err) {
-            console.error(`[Daemon] EP956: Failed to stop orphaned tunnel ${orphanUid}:`, err instanceof Error ? err.message : err);
-          }
-        }
-      }
-      const localModulesNeedingTunnel = modules.filter(
-        (m) => m.dev_mode === "local" && (!m.checkout_machine_id || m.checkout_machine_id === this.deviceId) && !tunnelManager.hasTunnel(m.uid)
-      );
-      if (localModulesNeedingTunnel.length === 0) {
-        console.log(`[Daemon] EP819: No local modules need tunnel auto-start`);
-        return;
-      }
-      console.log(`[Daemon] EP956: Found ${localModulesNeedingTunnel.length} local modules needing tunnels`);
-      for (const module2 of localModulesNeedingTunnel) {
-        const moduleUid = module2.uid;
-        const worktree = await getWorktreeInfoForModule(moduleUid);
-        if (!worktree) {
-          console.warn(`[Daemon] EP956: Cannot resolve worktree for ${moduleUid} (missing config slugs)`);
-          continue;
-        }
-        if (!worktree.exists) {
-          console.log(`[Daemon] EP956: No worktree for ${moduleUid} at ${worktree.path}, skipping`);
-          continue;
-        }
-        const port = allocatePort(moduleUid);
-        console.log(`[Daemon] EP956: Auto-starting tunnel for ${moduleUid} at ${worktree.path} on port ${port}`);
-        const reportTunnelStatus = async (statusData) => {
-          try {
-            const statusResponse = await fetchWithAuth(`${apiUrl}/api/modules/${moduleUid}/tunnel`, {
-              method: "POST",
-              body: JSON.stringify(statusData)
-            });
-            if (statusResponse.ok) {
-              console.log(`[Daemon] EP819: Tunnel status reported for ${moduleUid}`);
-            } else {
-              console.warn(`[Daemon] EP819: Failed to report tunnel status: ${statusResponse.statusText}`);
-            }
-          } catch (reportError) {
-            console.warn(`[Daemon] EP819: Error reporting tunnel status:`, reportError);
-          }
-        };
-        (async () => {
-          await this.withTunnelLock(moduleUid, async () => {
-            if (tunnelManager.hasTunnel(moduleUid)) {
-              console.log(`[Daemon] EP956: Tunnel already running for ${moduleUid}, skipping auto-start`);
-              return;
-            }
-            const MAX_RETRIES = 3;
-            const RETRY_DELAY_MS = 3e3;
-            await reportTunnelStatus({
-              tunnel_started_at: (/* @__PURE__ */ new Date()).toISOString(),
-              tunnel_error: null
-            });
-            try {
-              const devServerScript = config.project_settings?.worktree_dev_server_script;
-              console.log(`[Daemon] EP956: Ensuring dev server is running for ${moduleUid} at ${worktree.path}...`);
-              const devServerResult = await ensureDevServer(worktree.path, port, moduleUid, devServerScript);
-              if (!devServerResult.success) {
-                const errorMsg2 = `Dev server failed to start: ${devServerResult.error}`;
-                console.error(`[Daemon] EP956: ${errorMsg2}`);
-                await reportTunnelStatus({ tunnel_error: errorMsg2 });
-                releasePort(moduleUid);
-                return;
-              }
-              console.log(`[Daemon] EP956: Dev server ready on port ${port}`);
-              let lastError;
-              for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
-                console.log(`[Daemon] EP819: Starting tunnel for ${moduleUid} (attempt ${attempt}/${MAX_RETRIES})...`);
-                const startResult = await tunnelManager.startTunnel({
-                  moduleUid,
-                  port,
-                  onUrl: async (url) => {
-                    console.log(`[Daemon] EP819: Tunnel URL for ${moduleUid}: ${url}`);
-                    await reportTunnelStatus({
-                      tunnel_url: url,
-                      tunnel_error: null
-                    });
-                  },
-                  onStatusChange: (status, error) => {
-                    if (status === "error") {
-                      console.error(`[Daemon] EP819: Tunnel error for ${moduleUid}: ${error}`);
-                      reportTunnelStatus({ tunnel_error: error || "Tunnel connection error" });
-                    } else if (status === "reconnecting") {
-                      console.log(`[Daemon] EP819: Tunnel reconnecting for ${moduleUid}...`);
-                    }
-                  }
-                });
-                if (startResult.success) {
-                  console.log(`[Daemon] EP819: Tunnel started successfully for ${moduleUid}`);
-                  return;
-                }
-                lastError = startResult.error;
-                console.warn(`[Daemon] EP819: Tunnel start attempt ${attempt} failed: ${lastError}`);
-                if (attempt < MAX_RETRIES) {
-                  console.log(`[Daemon] EP819: Retrying in ${RETRY_DELAY_MS}ms...`);
-                  await new Promise((resolve3) => setTimeout(resolve3, RETRY_DELAY_MS));
-                }
-              }
-              const errorMsg = `Tunnel failed after ${MAX_RETRIES} attempts: ${lastError}`;
-              console.error(`[Daemon] EP956: ${errorMsg}`);
-              await reportTunnelStatus({ tunnel_error: errorMsg });
-              releasePort(moduleUid);
-            } catch (error) {
-              const errorMsg = error instanceof Error ? error.message : String(error);
-              console.error(`[Daemon] EP956: Async tunnel startup error:`, error);
-              await reportTunnelStatus({ tunnel_error: errorMsg });
-              releasePort(moduleUid);
-            }
-          });
-        })();
-      }
-    } catch (error) {
-      console.error(`[Daemon] EP819: Error auto-starting tunnels:`, error);
-    }
-  }
+  // EP1003: startTunnelForModule removed - server now orchestrates via tunnel_start commands
+  // EP1003: autoStartTunnelsForProject removed - server now orchestrates via reconciliation
+  // Recovery flow: daemon sends reconciliation_report → server processes and sends commands
+  // Orphan tunnel cleanup is now also handled server-side via reconciliation report
   // EP843: startTunnelPolling() removed - replaced by push-based state sync
   // See module_state_changed handler for the new implementation
   /**
@@ -8646,7 +8305,9 @@ var Daemon = class _Daemon {
               method: "POST",
               body: JSON.stringify({
                 tunnel_url: url,
-                tunnel_error: null
+                tunnel_error: null,
+                restart_reason: "health_check_failure"
+                // EP1003: Server can track restart causes
               })
             });
           } catch (e) {