happy-stacks 0.3.0 → 0.5.0

package/scripts/daemon.mjs

@@ -1,14 +1,16 @@
 import { spawnProc, run, runCapture } from './utils/proc/proc.mjs';
-import { resolveAuthSeedFromEnv } from './utils/stack/startup.mjs';
+import { resolveAuthSeedFromEnv, resolveAutoCopyFromMainEnabled } from './utils/stack/startup.mjs';
 import { getStacksStorageRoot } from './utils/paths/paths.mjs';
 import { isSandboxed, sandboxAllowsGlobalSideEffects } from './utils/env/sandbox.mjs';
 import { runCaptureIfCommandExists } from './utils/proc/commands.mjs';
 import { readLastLines } from './utils/fs/tail.mjs';
+import { ensureCliBuilt } from './utils/proc/pm.mjs';
 import { existsSync, readdirSync, readFileSync, unlinkSync } from 'node:fs';
 import { chmod, copyFile, mkdir } from 'node:fs/promises';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 import { setTimeout as delay } from 'node:timers/promises';
 import { homedir } from 'node:os';
+import { getRootDir } from './utils/paths/paths.mjs';
 
 /**
  * Daemon lifecycle helpers for happy-stacks.
@@ -175,6 +177,46 @@ function getLatestDaemonLogPath(homeDir) {
   }
 }
 
+function resolveHappyCliDistEntrypoint(cliBin) {
+  const bin = String(cliBin ?? '').trim();
+  if (!bin) return null;
+  // In component checkouts/worktrees we launch via <cliDir>/bin/happy.mjs, which expects dist output.
+  // Use this to protect restarts from bricking the running daemon if dist disappears mid-build.
+  try {
+    const binDir = dirname(bin);
+    return join(binDir, '..', 'dist', 'index.mjs');
+  } catch {
+    return null;
+  }
+}
+
+async function ensureHappyCliDistExists({ cliBin }) {
+  const distEntrypoint = resolveHappyCliDistEntrypoint(cliBin);
+  if (!distEntrypoint) return { ok: false, distEntrypoint: null, built: false, reason: 'unknown_cli_bin' };
+  if (existsSync(distEntrypoint)) return { ok: true, distEntrypoint, built: false, reason: 'exists' };
+
+  // Try to recover automatically: missing dist is a common first-run worktree issue.
+  // We build in-place using the cliDir that owns this cliBin (../ from bin/).
+  const cliDir = join(dirname(cliBin), '..');
+  const buildCli =
+    (process.env.HAPPY_STACKS_CLI_BUILD ?? process.env.HAPPY_LOCAL_CLI_BUILD ?? '1').toString().trim() !== '0';
+  if (!buildCli) {
+    return { ok: false, distEntrypoint, built: false, reason: 'build_disabled' };
+  }
+
+  try {
+    // eslint-disable-next-line no-console
+    console.warn(`[local] happy-cli build output missing; rebuilding (${cliDir})...`);
+    await ensureCliBuilt(cliDir, { buildCli: true });
+  } catch (e) {
+    return { ok: false, distEntrypoint, built: false, reason: String(e?.message ?? e) };
+  }
+
+  return existsSync(distEntrypoint)
+    ? { ok: true, distEntrypoint, built: true, reason: 'rebuilt' }
+    : { ok: false, distEntrypoint, built: true, reason: 'rebuilt_but_missing' };
+}
+
 function excerptIndicatesMissingAuth(excerpt) {
   if (!excerpt) return false;
   return (
@@ -183,6 +225,24 @@ function excerptIndicatesMissingAuth(excerpt) {
   );
 }
 
+function excerptIndicatesInvalidAuth(excerpt) {
+  if (!excerpt) return false;
+  return (
+    excerpt.includes('Auth failed - invalid token') ||
+    excerpt.includes('Request failed with status code 401') ||
+    excerpt.includes('"status":401') ||
+    excerpt.includes('[DAEMON RUN][FATAL]') && excerpt.includes('status code 401')
+  );
+}
+
+function allowDaemonWaitForAuthWithoutTty() {
+  const raw = (process.env.HAPPY_STACKS_DAEMON_WAIT_FOR_AUTH ?? process.env.HAPPY_LOCAL_DAEMON_WAIT_FOR_AUTH ?? '')
+    .toString()
+    .trim()
+    .toLowerCase();
+  return raw === '1' || raw === 'true' || raw === 'yes' || raw === 'y';
+}
+
 function authLoginHint() {
   const stackName = (process.env.HAPPY_STACKS_STACK ?? process.env.HAPPY_LOCAL_STACK ?? '').trim() || 'main';
   return stackName === 'main' ? 'happys auth login' : `happys stack auth ${stackName} login`;
@@ -195,6 +255,27 @@ function authCopyFromSeedHint() {
   return `happys stack auth ${stackName} copy-from ${seed}`;
 }
 
+async function maybeAutoReseedInvalidAuth({ stackName, quiet = false }) {
+  if (stackName === 'main') return { ok: false, skipped: true, reason: 'main' };
+  const env = process.env;
+  const isInteractive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  const enabled = resolveAutoCopyFromMainEnabled({ env, stackName, isInteractive });
+  if (!enabled) return { ok: false, skipped: true, reason: 'disabled' };
+
+  const seed = resolveAuthSeedFromEnv(env);
+  if (!quiet) {
+    console.log(`[local] auth: invalid token detected; re-seeding ${stackName} from ${seed}...`);
+  }
+  const rootDir = getRootDir(import.meta.url);
+
+  // Use stack-scoped auth copy so env/database resolution is correct for the target stack.
+  await run(process.execPath, [join(rootDir, 'scripts', 'stack.mjs'), 'auth', stackName, '--', 'copy-from', seed], {
+    cwd: rootDir,
+    env,
+  });
+  return { ok: true, skipped: false, seed };
+}
+
 async function seedCredentialsIfMissing({ cliHomeDir }) {
   const stacksRoot = getStacksStorageRoot();
   const allowGlobal = sandboxAllowsGlobalSideEffects();
@@ -373,11 +454,27 @@ export async function startLocalDaemonWithAuth({
   publicServerUrl,
   isShuttingDown,
   forceRestart = false,
+  env = process.env,
+  stackName = null,
 }) {
-  const stackName = (process.env.HAPPY_STACKS_STACK ?? process.env.HAPPY_LOCAL_STACK ?? '').trim() || 'main';
-  const baseEnv = { ...process.env };
+  const resolvedStackName =
+    (stackName ?? '').toString().trim() ||
+    (env.HAPPY_STACKS_STACK ?? env.HAPPY_LOCAL_STACK ?? '').toString().trim() ||
+    'main';
+  const baseEnv = { ...env };
   const daemonEnv = getDaemonEnv({ baseEnv, cliHomeDir, internalServerUrl, publicServerUrl });
 
+  const distEntrypoint = resolveHappyCliDistEntrypoint(cliBin);
+  const distCheck = await ensureHappyCliDistExists({ cliBin });
+  if (!distCheck.ok) {
+    throw new Error(
+      `[local] happy-cli dist entrypoint is missing (${distEntrypoint}).\n` +
+        `[local] Refusing to start/restart daemon because it would crash with MODULE_NOT_FOUND.\n` +
+        `[local] Fix: rebuild happy-cli in the active checkout/worktree.\n` +
+        (distCheck.reason ? `[local] Detail: ${distCheck.reason}\n` : '')
+    );
+  }
+
   // If this is a migrated/new stack home dir, seed credentials from the user's existing login (best-effort)
   // to avoid requiring an interactive auth flow under launchd.
   const migrateCreds = (baseEnv.HAPPY_STACKS_MIGRATE_CREDENTIALS ?? baseEnv.HAPPY_LOCAL_MIGRATE_CREDENTIALS ?? '1').trim() !== '0';
@@ -386,6 +483,20 @@ export async function startLocalDaemonWithAuth({
   }
 
   const existing = checkDaemonState(cliHomeDir);
+  // If the daemon is already running and we're restarting it, refuse to stop it unless the
+  // happy-cli dist entrypoint exists. Otherwise a rebuild (rm -rf dist) can brick the stack.
+  if (
+    distEntrypoint &&
+    !existsSync(distEntrypoint) &&
+    (existing.status === 'running' || existing.status === 'starting')
+  ) {
+    console.warn(
+      `[local] happy-cli dist entrypoint is missing (${distEntrypoint}).\n` +
+        `[local] Refusing to restart daemon to avoid downtime. Rebuild happy-cli first.`
+    );
+    return;
+  }
+
   if (!forceRestart && (existing.status === 'running' || existing.status === 'starting')) {
     const pid = existing.pid;
     const matches = await daemonEnvMatches({ pid, cliHomeDir, internalServerUrl, publicServerUrl });
@@ -419,7 +530,7 @@ export async function startLocalDaemonWithAuth({
   }
 
   // Best-effort: for the main stack, also stop the legacy global daemon home (~/.happy) to prevent legacy overlap.
-  if (stackName === 'main' && (!isSandboxed() || sandboxAllowsGlobalSideEffects())) {
+  if (resolvedStackName === 'main' && (!isSandboxed() || sandboxAllowsGlobalSideEffects())) {
     const legacyEnv = { ...daemonEnv, HAPPY_HOME_DIR: join(homedir(), '.happy') };
     try {
       await new Promise((resolve) => {
@@ -452,6 +563,16 @@ export async function startLocalDaemonWithAuth({
       return { ok: true, exitCode, excerpt: null, logPath: null };
     }
 
+    // Some daemon versions (or transient races) can return non-zero even if the daemon
+    // is already running / starting for this stack home dir (e.g. "lock already held").
+    // In those cases, fail-open and keep the stack running; callers can still surface
+    // daemon status separately.
+    await delay(500);
+    const stateAfter = checkDaemonState(cliHomeDir);
+    if (stateAfter.status === 'running' || stateAfter.status === 'starting') {
+      return { ok: true, exitCode, excerpt: null, logPath: null };
+    }
+
     const logPath =
       getLatestDaemonLogPath(cliHomeDir) ||
       ((!isSandboxed() || sandboxAllowsGlobalSideEffects()) ? getLatestDaemonLogPath(join(homedir(), '.happy')) : null);
@@ -468,21 +589,32 @@ export async function startLocalDaemonWithAuth({
     }
 
     if (excerptIndicatesMissingAuth(first.excerpt)) {
+      const isInteractive = Boolean(process.stdin.isTTY && process.stdout.isTTY) || allowDaemonWaitForAuthWithoutTty();
       const copyHint = authCopyFromSeedHint();
-      console.error(
+      const hint =
         `[local] daemon is not authenticated yet (expected on first run).\n` +
-        `[local] Keeping the server running so you can login.\n` +
         `[local] In another terminal, run:\n` +
         `${authLoginHint()}\n` +
-        (copyHint ? `[local] Or (recommended if main is already logged in):\n${copyHint}\n` : '') +
-        `[local] Waiting for credentials at ${credentialsPath}...`
-      );
+        (copyHint ? `[local] Or (recommended if main is already logged in):\n${copyHint}\n` : '');
+      if (!isInteractive) {
+        throw new Error(`${hint}[local] Non-interactive mode: refusing to wait for credentials.`);
+      }
+
+      console.error(`${hint}[local] Keeping the server running so you can login.\n[local] Waiting for credentials at ${credentialsPath}...`);
 
       const ok = await waitForCredentialsFile({ path: credentialsPath, timeoutMs: 10 * 60_000, isShuttingDown });
       if (!ok) {
         throw new Error('Timed out waiting for daemon credentials (auth login not completed)');
       }
 
+      // If a daemon start attempt was already in-flight (or a previous daemon is already running),
+      // avoid a second concurrent start and treat it as success.
+      await delay(500);
+      const stateAfterCreds = checkDaemonState(cliHomeDir);
+      if (stateAfterCreds.status === 'running' || stateAfterCreds.status === 'starting') {
+        return;
+      }
+
       console.log('[local] credentials detected, retrying daemon start...');
       const second = await startOnce();
       if (!second.ok) {
@@ -491,6 +623,30 @@ export async function startLocalDaemonWithAuth({
         }
         throw new Error('Failed to start daemon (after credentials were created)');
       }
+    } else if (excerptIndicatesInvalidAuth(first.excerpt)) {
+      // Credentials exist but are rejected by this server (common when a stack's env/DB was reset,
+      // or credentials were copied from a different stack identity).
+      try {
+        await maybeAutoReseedInvalidAuth({ stackName });
+      } catch (e) {
+        const copyHint = authCopyFromSeedHint();
+        console.error(
+          `[local] daemon credentials were rejected by the server (401).\n` +
+            `[local] Fix:\n` +
+            (copyHint ? `- ${copyHint}\n` : '') +
+            `- ${authLoginHint()}`
+        );
+        throw e;
+      }
+
+      console.log('[local] auth re-seeded, retrying daemon start...');
+      const second = await startOnce();
+      if (!second.ok) {
+        if (second.excerpt) {
+          console.error(`[local] daemon still failed to start; last daemon log (${second.logPath}):\n${second.excerpt}`);
+        }
+        throw new Error('Failed to start daemon (after auth re-seed)');
+      }
     } else {
       const copyHint = authCopyFromSeedHint();
       console.error(

package/scripts/dev.mjs

@@ -1,7 +1,7 @@
 import './utils/env/env.mjs';
 import { parseArgs } from './utils/cli/args.mjs';
 import { killProcessTree } from './utils/proc/proc.mjs';
-import { getComponentDir, getDefaultAutostartPaths, getRootDir } from './utils/paths/paths.mjs';
+import { componentDirEnvKey, getComponentDir, getDefaultAutostartPaths, getRootDir } from './utils/paths/paths.mjs';
 import { killPortListeners } from './utils/net/ports.mjs';
 import { getServerComponentName, isHappyServerRunning } from './utils/server/server.mjs';
 import { requireDir } from './utils/proc/pm.mjs';
@@ -17,11 +17,15 @@ import { resolveStackContext } from './utils/stack/context.mjs';
 import { resolveServerPortFromEnv, resolveServerUrls } from './utils/server/urls.mjs';
 import { ensureDevCliReady, prepareDaemonAuthSeed, startDevDaemon, watchHappyCliAndRestartDaemon } from './utils/dev/daemon.mjs';
 import { startDevServer, watchDevServerAndRestart } from './utils/dev/server.mjs';
-import { startDevExpoWebUi } from './utils/dev/expo_web.mjs';
-import { resolveLocalhostHost } from './utils/paths/localhost_host.mjs';
+import { ensureDevExpoServer, resolveExpoTailscaleEnabled } from './utils/dev/expo_dev.mjs';
+import { preferStackLocalhostUrl } from './utils/paths/localhost_host.mjs';
 import { openUrlInBrowser } from './utils/ui/browser.mjs';
 import { waitForHttpOk } from './utils/server/server.mjs';
 import { sanitizeDnsLabel } from './utils/net/dns.mjs';
+import { getAccountCountForServerComponent, resolveAutoCopyFromMainEnabled } from './utils/stack/startup.mjs';
+import { maybeRunInteractiveStackAuthSetup } from './utils/auth/interactive_stack_auth.mjs';
+import { getInvokedCwd, inferComponentFromCwd } from './utils/cli/cwd_scope.mjs';
+import { daemonStartGate, formatDaemonAuthRequiredError } from './utils/auth/daemon_gate.mjs';
 
 /**
  * Dev mode stack:
@@ -37,20 +41,42 @@ async function main() {
   if (wantsHelp(argv, { flags })) {
     printResult({
       json,
-      data: { flags: ['--server=happy-server|happy-server-light', '--no-ui', '--no-daemon', '--restart', '--watch', '--no-watch', '--no-browser'], json: true },
+      data: { flags: ['--server=happy-server|happy-server-light', '--no-ui', '--no-daemon', '--restart', '--watch', '--no-watch', '--no-browser', '--mobile', '--expo-tailscale'], json: true },
       text: [
         '[dev] usage:',
         '  happys dev [--server=happy-server|happy-server-light] [--restart] [--json]',
-        '  happys dev --watch      # rebuild/restart happy-cli daemon on file changes (TTY default)',
-        '  happys dev --no-watch   # disable watch mode (always disabled in non-interactive mode)',
-        '  happys dev --no-browser # do not open the UI in your browser automatically',
+        '  happys dev --watch         # rebuild/restart happy-cli daemon on file changes (TTY default)',
+        '  happys dev --no-watch      # disable watch mode (always disabled in non-interactive mode)',
+        '  happys dev --no-browser    # do not open the UI in your browser automatically',
+        '  happys dev --mobile        # also start Expo dev-client Metro for mobile',
+        '  happys dev --expo-tailscale # forward Expo to Tailscale interface for remote access',
         '  note: --json prints the resolved config (dry-run) and exits.',
+        '',
+        'note:',
+        '  If run from inside a component checkout/worktree, that checkout is used for this run (without requiring `happys wt use`).',
+        '',
+        'env:',
+        '  HAPPY_STACKS_EXPO_TAILSCALE=1   # enable Expo Tailscale forwarding via env var',
       ].join('\n'),
     });
     return;
   }
   const rootDir = getRootDir(import.meta.url);
 
+  const inferred = inferComponentFromCwd({
+    rootDir,
+    invokedCwd: getInvokedCwd(process.env),
+    components: ['happy', 'happy-cli', 'happy-server-light', 'happy-server'],
+  });
+  if (inferred) {
+    const stacksKey = componentDirEnvKey(inferred.component);
+    const legacyKey = stacksKey.replace(/^HAPPY_STACKS_/, 'HAPPY_LOCAL_');
+    // Stack env should win. Only infer from CWD when the component dir isn't already configured.
+    if (!(process.env[stacksKey] ?? '').toString().trim() && !(process.env[legacyKey] ?? '').toString().trim()) {
+      process.env[stacksKey] = inferred.repoDir;
+    }
+  }
+
   const serverComponentName = getServerComponentName({ kv });
   if (serverComponentName === 'both') {
     throw new Error(`[local] --server=both is not supported for dev (pick one: happy-server-light or happy-server)`);
@@ -58,7 +84,9 @@ async function main() {
 
   const startUi = !flags.has('--no-ui') && (process.env.HAPPY_LOCAL_UI ?? '1') !== '0';
   const startDaemon = !flags.has('--no-daemon') && (process.env.HAPPY_LOCAL_DAEMON ?? '1') !== '0';
+  const startMobile = flags.has('--mobile') || flags.has('--with-mobile');
   const noBrowser = flags.has('--no-browser') || (process.env.HAPPY_STACKS_NO_BROWSER ?? process.env.HAPPY_LOCAL_NO_BROWSER ?? '').toString().trim() === '1';
+  const expoTailscale = flags.has('--expo-tailscale') || resolveExpoTailscaleEnabled({ env: process.env });
 
   const serverDir = getComponentDir(rootDir, serverComponentName);
   const uiDir = getComponentDir(rootDir, 'happy');
@@ -82,7 +110,10 @@ async function main() {
   // - Only the main stack should ever auto-enable (or prefer) Tailscale Serve by default.
   // - Non-main stacks should default to localhost URLs unless the user explicitly configured a public URL
   //   OR Tailscale Serve is already configured for this stack's internal URL (status matches).
-  const allowEnableTailscale = !stackMode || stackName === 'main';
+  const allowEnableTailscale =
+    !stackMode ||
+    stackName === 'main' ||
+    (baseEnv.HAPPY_STACKS_TAILSCALE_SERVE ?? baseEnv.HAPPY_LOCAL_TAILSCALE_SERVE ?? '0').toString().trim() === '1';
   const resolvedUrls = await resolveServerUrls({ env: baseEnv, serverPort, allowEnable: allowEnableTailscale });
   const internalServerUrl = resolvedUrls.internalServerUrl;
   let publicServerUrl = resolvedUrls.publicServerUrl;
@@ -93,6 +124,8 @@ async function main() {
       publicServerUrl = resolvedUrls.defaultPublicUrl;
     }
   }
+  // Expo app config: this is what both web + native app use to reach the Happy server.
+  // LAN rewrite (for dev-client) is centralized in ensureDevExpoServer.
   const uiApiUrl = resolvedUrls.defaultPublicUrl;
   const restart = flags.has('--restart');
   const cliHomeDir = process.env.HAPPY_LOCAL_CLI_HOME_DIR?.trim()
@@ -112,6 +145,7 @@ async function main() {
         internalServerUrl,
         publicServerUrl,
         startUi,
+        startMobile,
         startDaemon,
         cliHomeDir,
       },
@@ -135,13 +169,25 @@ async function main() {
   const serverAlreadyRunning = await isHappyServerRunning(internalServerUrl);
   const daemonAlreadyRunning = startDaemon ? isDaemonRunning(cliHomeDir) : false;
 
-  // UI dev server state (worktree-scoped)
-  const uiPaths = getExpoStatePaths({ baseDir: autostart.baseDir, kind: 'ui-dev', projectDir: uiDir, stateFileName: 'ui.state.json' });
-  const uiRunning = startUi ? await isStateProcessRunning(uiPaths.statePath) : { running: false, state: null };
-  let uiAlreadyRunning = Boolean(uiRunning.running);
-
-  if (!restart && serverAlreadyRunning && (!startDaemon || daemonAlreadyRunning) && (!startUi || uiAlreadyRunning)) {
-    console.log(`[local] dev: stack already running (server=${internalServerUrl}${startDaemon ? ` daemon=${daemonAlreadyRunning ? 'running' : 'stopped'}` : ''}${startUi ? ` ui=${uiAlreadyRunning ? 'running' : 'stopped'}` : ''})`);
+  // Expo dev server state (worktree-scoped): single Expo process per stack/worktree.
+  const startExpo = startUi || startMobile;
+  const expoPaths = getExpoStatePaths({
+    baseDir: autostart.baseDir,
+    kind: 'expo-dev',
+    projectDir: uiDir,
+    stateFileName: 'expo.state.json',
+  });
+  const expoRunning = startExpo ? await isStateProcessRunning(expoPaths.statePath) : { running: false, state: null };
+  let expoAlreadyRunning = Boolean(expoRunning.running);
+
+  if (!restart && serverAlreadyRunning && (!startDaemon || daemonAlreadyRunning) && (!startExpo || expoAlreadyRunning)) {
+    console.log(
+      `[local] dev: stack already running (server=${internalServerUrl}` +
+        `${startDaemon ? ` daemon=${daemonAlreadyRunning ? 'running' : 'stopped'}` : ''}` +
+        `${startUi ? ` ui=${expoAlreadyRunning ? 'running' : 'stopped'}` : ''}` +
+        `${startMobile ? ` mobile=${expoAlreadyRunning ? 'running' : 'stopped'}` : ''}` +
+        `)`
+    );
     return;
   }
 
@@ -190,9 +236,80 @@ async function main() {
   );
 
   // Reliability before daemon start:
-  // - Ensure schema exists (server-light: db push; happy-server: migrate deploy if tables missing)
+  // - Ensure schema exists (server-light: prisma migrate deploy; happy-server: migrate deploy if tables missing)
   // - Auto-seed from main only when needed (non-main + non-interactive default, and only if missing creds or 0 accounts)
   const isInteractive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  const accountProbe = await getAccountCountForServerComponent({
+    serverComponentName,
+    serverDir,
+    env: serverEnv,
+    bestEffort: true,
+  });
+  const accountCount = typeof accountProbe.accountCount === 'number' ? accountProbe.accountCount : null;
+  const autoSeedEnabled = resolveAutoCopyFromMainEnabled({ env: baseEnv, stackName, isInteractive });
+
+  let expoResEarly = null;
+  const wantsAuthFlow =
+    (baseEnv.HAPPY_STACKS_AUTH_FLOW ?? baseEnv.HAPPY_LOCAL_AUTH_FLOW ?? '').toString().trim() === '1' ||
+    (baseEnv.HAPPY_STACKS_DAEMON_WAIT_FOR_AUTH ?? baseEnv.HAPPY_LOCAL_DAEMON_WAIT_FOR_AUTH ?? '').toString().trim() === '1';
+
+  // CRITICAL (review-pr / setup-pr guided login):
+  // In background/non-interactive runs, the daemon may block on auth. If we wait to start Expo web
+  // until after the daemon is authenticated, guided login will have no UI origin and will fall back
+  // to the server port (wrong). Start Expo web UI early when running an auth flow.
+  if (wantsAuthFlow && startUi && !expoResEarly) {
+    expoResEarly = await ensureDevExpoServer({
+      startUi,
+      startMobile,
+      uiDir,
+      autostart,
+      baseEnv,
+      apiServerUrl: uiApiUrl,
+      restart,
+      stackMode,
+      runtimeStatePath,
+      stackName,
+      envPath,
+      children,
+      spawnOptions: { stdio: ['ignore', 'ignore', 'ignore'] },
+      expoTailscale,
+    });
+  }
+  await maybeRunInteractiveStackAuthSetup({
+    rootDir,
+    // In dev mode, guided login must target the Expo web UI origin (not the server port).
+    // Mark this as an auth-flow so URL resolution fails closed if Expo isn't ready.
+    env: startUi ? { ...baseEnv, HAPPY_STACKS_AUTH_FLOW: '1', HAPPY_LOCAL_AUTH_FLOW: '1' } : baseEnv,
+    stackName,
+    cliHomeDir,
+    accountCount,
+    isInteractive,
+    autoSeedEnabled,
+    beforeLogin: async () => {
+      if (!startUi) {
+        throw new Error(
+          `[local] auth: interactive login requires the web UI.\n` +
+            `Re-run without --no-ui, or set HAPPY_WEBAPP_URL to a reachable Happy UI for this stack.`
+        );
+      }
+      if (expoResEarly) return;
+      expoResEarly = await ensureDevExpoServer({
+        startUi,
+        startMobile,
+        uiDir,
+        autostart,
+        baseEnv,
+        apiServerUrl: uiApiUrl,
+        restart,
+        stackMode,
+        runtimeStatePath,
+        stackName,
+        envPath,
+        children,
+        expoTailscale,
+      });
+    },
+  });
   await prepareDaemonAuthSeed({
     rootDir,
     env: baseEnv,
@@ -206,19 +323,35 @@ async function main() {
     quiet: false,
   });
 
-  await startDevDaemon({
-    startDaemon,
-    cliBin,
-    cliHomeDir,
-    internalServerUrl,
-    publicServerUrl,
-    restart,
-    isShuttingDown: () => shuttingDown,
-  });
+  if (startDaemon) {
+    const gate = daemonStartGate({ env: baseEnv, cliHomeDir });
+    if (!gate.ok) {
+      // In orchestrated auth flows (setup-pr/review-pr), we intentionally keep server/UI up
+      // for guided login and start daemon post-auth from the orchestrator.
+      if (gate.reason === 'auth_flow_missing_credentials') {
+        console.log('[local] auth flow: skipping daemon start until credentials exist');
+      } else {
+        const isInteractive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+        if (!isInteractive) {
+          throw new Error(formatDaemonAuthRequiredError({ stackName, cliHomeDir }));
+        }
+      }
+    } else {
+      await startDevDaemon({
+        startDaemon,
+        cliBin,
+        cliHomeDir,
+        internalServerUrl,
+        publicServerUrl,
+        restart,
+        isShuttingDown: () => shuttingDown,
+      });
+    }
+  }
 
   const cliWatcher = watchHappyCliAndRestartDaemon({
     enabled: watchEnabled,
-    startDaemon,
+    startDaemon: startDaemon && daemonStartGate({ env: baseEnv, cliHomeDir }).ok,
     buildCli,
     cliDir,
     cliBin,
@@ -263,43 +396,58 @@ async function main() {
     );
   }
 
-  const uiRes = await startDevExpoWebUi({
-    startUi,
-    uiDir,
-    autostart,
-    baseEnv,
-    apiServerUrl: uiApiUrl,
-    restart,
-    stackMode,
-    runtimeStatePath,
-    stackName,
-    envPath,
-    children,
-  });
+  const expoRes =
+    expoResEarly ??
+    (await ensureDevExpoServer({
+      startUi,
+      startMobile,
+      uiDir,
+      autostart,
+      baseEnv,
+      apiServerUrl: uiApiUrl,
+      restart,
+      stackMode,
+      runtimeStatePath,
+      stackName,
+      envPath,
+      children,
+      expoTailscale,
+    }));
   if (startUi) {
-    const host = resolveLocalhostHost({ stackMode, stackName });
-    if (uiRes?.reason === 'already_running' && uiRes.port) {
-      console.log(`[local] ui already running (pid=${uiRes.pid}, port=${uiRes.port})`);
-      console.log(`[local] ui: open http://${host}:${uiRes.port}`);
-    } else if (uiRes?.skipped === false && uiRes.port) {
-      console.log(`[local] ui: open http://${host}:${uiRes.port}`);
-    } else if (uiRes?.skipped && uiRes?.reason === 'already_running') {
+    const uiPort = expoRes?.port;
+    const uiUrlRaw = uiPort ? `http://localhost:${uiPort}` : '';
+    const uiUrl = uiUrlRaw ? await preferStackLocalhostUrl(uiUrlRaw, { stackName }) : '';
+    if (expoRes?.reason === 'already_running' && expoRes.port) {
+      console.log(`[local] ui already running (pid=${expoRes.pid}, port=${expoRes.port})`);
+      if (uiUrl) console.log(`[local] ui: open ${uiUrl}`);
+    } else if (expoRes?.skipped === false && expoRes.port) {
+      if (uiUrl) console.log(`[local] ui: open ${uiUrl}`);
+    } else if (expoRes?.skipped && expoRes?.reason === 'already_running') {
       console.log('[local] ui already running (skipping Expo start)');
     }
 
     const isInteractive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
-    const shouldOpen = isInteractive && !noBrowser && Boolean(uiRes?.port);
+    const shouldOpen = isInteractive && !noBrowser && Boolean(expoRes?.port);
     if (shouldOpen) {
-      const url = `http://${host}:${uiRes.port}`;
       // Prefer localhost for readiness checks (faster/more reliable), but open the stack-scoped hostname.
-      await waitForHttpOk(`http://localhost:${uiRes.port}`, { timeoutMs: 30_000 }).catch(() => {});
-      const res = await openUrlInBrowser(url);
+      await waitForHttpOk(`http://localhost:${expoRes.port}`, { timeoutMs: 30_000 }).catch(() => {});
+      const res = await openUrlInBrowser(uiUrl);
       if (!res.ok) {
         console.warn(`[local] ui: failed to open browser automatically (${res.error}).`);
       }
     }
   }
 
+  if (startMobile && expoRes?.port) {
+    const metroUrl = await preferStackLocalhostUrl(`http://localhost:${expoRes.port}`, { stackName });
+    console.log(`[local] mobile: metro ${metroUrl}`);
+  }
+
+  // Show Tailscale URL if forwarder is running
+  if (expoRes?.tailscale?.ok && expoRes.tailscale.tailscaleIp && expoRes.port) {
+    console.log(`[local] expo tailscale: http://${expoRes.tailscale.tailscaleIp}:${expoRes.port}`);
+  }
+
   const shutdown = async () => {
     if (shuttingDown) {
       return;

package/scripts/doctor.mjs

@@ -202,10 +202,6 @@ async function main() {
 
   // UI build dir check
   if (serveUi) {
-    if (serverComponentName !== 'happy-server-light') {
-      report.checks.uiServing = { ok: false, reason: `requires happy-server-light (current: ${serverComponentName})` };
-      if (!json) console.log(`ℹ️ ui serving requires happy-server-light (current: ${serverComponentName})`);
-    }
     if (await pathExists(uiBuildDir)) {
       report.checks.uiBuildDir = { ok: true, path: uiBuildDir };
       if (!json) console.log('✅ ui build dir present');

package/scripts/edison.mjs

@@ -8,12 +8,13 @@ import { readTextOrEmpty } from './utils/fs/ops.mjs';
 import { readJsonIfExists } from './utils/fs/json.mjs';
 import { isPidAlive } from './utils/proc/pids.mjs';
 import { run, runCapture } from './utils/proc/proc.mjs';
-import { resolveLocalhostHost } from './utils/paths/localhost_host.mjs';
+import { preferStackLocalhostHost, resolveLocalhostHost } from './utils/paths/localhost_host.mjs';
 import { sanitizeStackName } from './utils/stack/names.mjs';
 import { join } from 'node:path';
 import { spawn } from 'node:child_process';
 import { mkdir, lstat, rename, symlink, writeFile, readdir, chmod } from 'node:fs/promises';
 import os from 'node:os';
+import { normalizeGitRoots } from './utils/edison/git_roots.mjs';
 
 const COMPONENTS = ['happy', 'happy-cli', 'happy-server-light', 'happy-server'];
 
@@ -1343,7 +1344,7 @@ async function resolveFingerprintGitRoots({ rootDir, stackEnv, edisonArgs }) {
     const d = resolveComponentDirFromStackEnv({ rootDir, stackEnv, component: c });
     if (d) dirs.push(d);
   }
-  return dirs.length ? dirs : fallback;
+  return normalizeGitRoots(dirs.length ? dirs : fallback);
 }
 
 async function cmdTrackCoherence({ rootDir, argv, json }) {
@@ -1781,7 +1782,9 @@ async function main() {
   env.HAPPY_STACKS_EDISON_WRAPPER = '1';
   // Provide a stack-scoped localhost hostname for validators and browser flows.
   // This ensures origin isolation even if ports are reused later (common with ephemeral ports).
-  const localhostHost = resolveLocalhostHost({ stackMode: Boolean(stackName), stackName: stackName || 'main' });
+  const localhostHost = Boolean(stackName)
+    ? await preferStackLocalhostHost({ stackName })
+    : resolveLocalhostHost({ stackMode: false, stackName: 'main' });
   env.HAPPY_STACKS_LOCALHOST_HOST = localhostHost;
   env.HAPPY_LOCAL_LOCALHOST_HOST = localhostHost;
 
@@ -1850,4 +1853,3 @@ main().catch((err) => {
   console.error('[edison] failed:', err);
   process.exit(1);
 });
-