hop2 0.8.0

package/hop

@@ -0,0 +1,3717 @@
+#!/usr/bin/env node
+
+const { spawn, execSync, execFileSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const http = require('http');
+const httpProxy = require('http-proxy');
+const { authenticator } = require('otplib');
+const qrcode = require('qrcode-terminal');
+const cookie = require('cookie');
+const EventEmitter = require('events');
+const url = require('url');
+const { pathToFileURL } = require('url');
+const net = require('net');
+const WebSocket = require('ws');
+
+const os = require('os');
+const DAEMON_FLAG = process.argv.includes('--daemon');
+
+// Hay integration for terminal sharing (built from ./hay)
+const HAY_ROOT = path.join(__dirname, 'hay');
+let didBuildHay = false;
+let hay = null;
+let hayRooms = null;
+
+function ensureHayBuilt() {
+    if (didBuildHay) return;
+    if (!fs.existsSync(HAY_ROOT)) return;
+    const webDistDir = path.join(HAY_ROOT, 'apps/web/dist');
+    const serverDistFile = path.join(HAY_ROOT, 'apps/server/dist/lib.js');
+    const cliDistFile = path.join(HAY_ROOT, 'apps/cli/dist/index.js');
+    const sharedDep = path.join(HAY_ROOT, 'node_modules/hay-shared/package.json');
+    const needsInstall = !fs.existsSync(sharedDep);
+    const needsBuild = !fs.existsSync(webDistDir) || !fs.existsSync(cliDistFile) || !fs.existsSync(serverDistFile);
+    if (!needsInstall && !needsBuild) return;
+    try {
+        console.log(`[Dev] Building Hay from: ${HAY_ROOT}`);
+        if (needsInstall) {
+            execFileSync('npm', ['--prefix', HAY_ROOT, 'install'], { stdio: 'inherit' });
+        }
+        if (needsBuild) {
+            execFileSync('npm', ['--prefix', HAY_ROOT, 'run', 'build'], { stdio: 'inherit' });
+        }
+        didBuildHay = true;
+    } catch (e) {
+        console.error(`[Dev] Failed to build Hay from: ${HAY_ROOT}`);
+    }
+}
+
+async function ensureHayLoaded() {
+    if (hay && hayRooms) return;
+    ensureHayBuilt();
+    const libPath = path.join(HAY_ROOT, 'apps/server/dist/lib.js');
+    if (!fs.existsSync(libPath)) {
+        throw new Error('Hay server build missing. Run `npm --prefix hay run build`.');
+    }
+    hay = await import(pathToFileURL(libPath));
+    hayRooms = new hay.RoomManager(hay.createPty, process.cwd());
+}
+
+function resolveHayWebDir() {
+    // Environment variable override for development
+    if (process.env.HAY_DEV_DIR && fs.existsSync(process.env.HAY_DEV_DIR)) {
+        return process.env.HAY_DEV_DIR;
+    }
+    // If local hay source exists, ensure it is built
+    ensureHayBuilt();
+    // Check for hay dev build nearby
+    const devPaths = [
+        path.join(__dirname, 'hay/apps/web/dist'),
+        path.join(__dirname, '../hay/apps/web/dist'),
+        path.join(__dirname, '../../hay/apps/web/dist'),
+        path.resolve(__dirname, '../hay/apps/web/dist'),
+    ];
+    for (const p of devPaths) {
+        if (fs.existsSync(p)) {
+            console.log(`[Dev] Serving Hay from: ${p}`);
+            return p;
+        }
+    }
+    // Fallback to bundled
+    return path.join(__dirname, 'hay-web');
+}
+const HAY_WEB_DIR = resolveHayWebDir();
+
+// Resolve hay CLI path for local terminal
+function resolveHayCliPath() {
+    // Check for hay CLI nearby
+    const cliPaths = [
+        path.join(__dirname, 'hay/apps/cli/dist/index.js'),
+        path.join(__dirname, '../hay/apps/cli/dist/index.js'),
+        path.join(__dirname, '../../hay/apps/cli/dist/index.js'),
+        path.resolve(__dirname, '../hay/apps/cli/dist/index.js'),
+    ];
+    for (const p of cliPaths) {
+        if (fs.existsSync(p)) {
+            return p;
+        }
+    }
+    // Fallback to bundled (if we ever bundle it)
+    const bundled = path.join(__dirname, 'hay-cli.js');
+    if (fs.existsSync(bundled)) {
+        return bundled;
+    }
+    throw new Error('Hay CLI not found. Build hay/apps/cli first.');
+}
+
+// Configure TOTP to accept codes ±1 time step (handles clock drift)
+authenticator.options = { window: 1 };
+
+// --- Configuration ---
+// Use HOP_HOME env var or default to .hop2 (separate from original hop)
+const HOME_DIR = process.env.HOP_HOME || path.join(os.homedir(), '.hop2');
+const PRIVATE_DIR_MODE = 0o700;
+const PRIVATE_FILE_MODE = 0o600;
+
+function ensurePrivateDir(dirPath) {
+    try {
+        if (!fs.existsSync(dirPath)) {
+            fs.mkdirSync(dirPath, { recursive: true, mode: PRIVATE_DIR_MODE });
+        } else {
+            fs.chmodSync(dirPath, PRIVATE_DIR_MODE);
+        }
+    } catch (e) { }
+}
+
+function ensurePrivateFile(filePath, mode = PRIVATE_FILE_MODE) {
+    try {
+        if (fs.existsSync(filePath)) {
+            fs.chmodSync(filePath, mode);
+        }
+    } catch (e) { }
+}
+
+function writePrivateFile(filePath, data, mode = PRIVATE_FILE_MODE) {
+    fs.writeFileSync(filePath, data, { mode });
+    ensurePrivateFile(filePath, mode);
+}
+
+ensurePrivateDir(HOME_DIR);
+
+const STATE_FILE = path.join(HOME_DIR, '.tunnel-state');
+const DEFAULT_SECRET_FILE = path.join(HOME_DIR, '.auth_secret');
+const DOMAIN_CONFIG_FILE = path.join(HOME_DIR, '.domain-config.json');
+const DEFAULT_PASSWORD_FILE = path.join(HOME_DIR, '.password_hash');
+const SESSION_COOKIE_NAME = 'tunnel_session';
+const LOG_DIR = path.join(HOME_DIR, 'logs');
+const SESSION_NAME_RE = /^[a-zA-Z0-9_-]+$/;
+let SECRET_FILE_PATH = DEFAULT_SECRET_FILE;
+let PASSWORD_FILE_PATH = DEFAULT_PASSWORD_FILE;
+const SESSIONS_FILE = path.join(HOME_DIR, '.sessions.json');
+
+// Password hashing using scrypt (built-in, no external deps)
+function hashPassword(password) {
+    const salt = crypto.randomBytes(16).toString('hex');
+    const hash = crypto.scryptSync(password, salt, 64).toString('hex');
+    return `${salt}:${hash}`;
+}
+
+function verifyPassword(password, stored) {
+    if (!stored) return false;
+    const [salt, hash] = stored.split(':');
+    if (!salt || !hash) return false;
+    const testHash = crypto.scryptSync(password, salt, 64).toString('hex');
+    return crypto.timingSafeEqual(Buffer.from(hash, 'hex'), Buffer.from(testHash, 'hex'));
+}
+
+function getStoredPassword() {
+    if (fs.existsSync(PASSWORD_FILE_PATH)) {
+        ensurePrivateFile(PASSWORD_FILE_PATH);
+        return fs.readFileSync(PASSWORD_FILE_PATH, 'utf8').trim();
+    }
+    return null;
+}
+
+function setPassword(password) {
+    const hashed = hashPassword(password);
+    writePrivateFile(PASSWORD_FILE_PATH, hashed);
+}
+
+function clearPassword() {
+    if (fs.existsSync(PASSWORD_FILE_PATH)) {
+        fs.unlinkSync(PASSWORD_FILE_PATH);
+    }
+}
+
+function isPasswordEnabled() {
+    return fs.existsSync(PASSWORD_FILE_PATH);
+}
+const HOP_SESSION_PREFIX = 'hop2-';  // Prefix for hop2 sessions (separate from hop which uses 'hop-')
+
+ensurePrivateDir(LOG_DIR);
+
+function toInternalSessionName(displayName) {
+    if (!displayName || typeof displayName !== 'string') return null;
+    if (!SESSION_NAME_RE.test(displayName)) return null;
+    return HOP_SESSION_PREFIX + displayName;
+}
+
+function toDisplaySessionName(internalName) {
+    if (!internalName || typeof internalName !== 'string') return '';
+    return internalName.slice(HOP_SESSION_PREFIX.length);
+}
+
+function loadSessionConfigs() {
+    if (fs.existsSync(SESSIONS_FILE)) {
+        try {
+            ensurePrivateFile(SESSIONS_FILE);
+            const data = JSON.parse(fs.readFileSync(SESSIONS_FILE, 'utf8'));
+            return data && typeof data === 'object' ? data : {};
+        } catch (e) {
+            return {};
+        }
+    }
+    return {};
+}
+
+function saveSessionConfigs() {
+    writePrivateFile(SESSIONS_FILE, JSON.stringify(sessionConfigs, null, 2));
+}
+
+let sessionConfigs = loadSessionConfigs();
+
+function getSessionConfig(name) {
+    return sessionConfigs[name] || null;
+}
+
+function setSessionConfig(name, config) {
+    sessionConfigs[name] = config;
+    saveSessionConfigs();
+}
+
+function deleteSessionConfig(name) {
+    delete sessionConfigs[name];
+    saveSessionConfigs();
+}
+
+function ensureTerminalSessionConfig(name, cwd) {
+    const existing = getSessionConfig(name);
+    if (!existing) {
+        setSessionConfig(name, {
+            type: 'terminal',
+            createdAt: new Date().toISOString(),
+            updatedAt: new Date().toISOString(),
+            cwd: cwd || undefined
+        });
+        return;
+    }
+    if (cwd && existing.cwd !== cwd) {
+        setSessionConfig(name, {
+            ...existing,
+            cwd,
+            updatedAt: new Date().toISOString()
+        });
+    }
+}
+
+function setPortSessionConfig(name, port) {
+    const existing = getSessionConfig(name);
+    setSessionConfig(name, {
+        type: 'port',
+        port,
+        createdAt: existing?.createdAt || new Date().toISOString(),
+        updatedAt: new Date().toISOString()
+    });
+}
+
+// Load domain config if exists
+function getDomainConfig() {
+    if (fs.existsSync(DOMAIN_CONFIG_FILE)) {
+        try {
+            return JSON.parse(fs.readFileSync(DOMAIN_CONFIG_FILE, 'utf8'));
+        } catch (e) {
+            return null;
+        }
+    }
+    return null;
+}
+
+function saveDomainConfig(config) {
+    fs.writeFileSync(DOMAIN_CONFIG_FILE, JSON.stringify(config, null, 2));
+}
+
+// Check if cloudflared is logged in
+function isCloudflaredLoggedIn() {
+    const certPath = path.join(os.homedir(), '.cloudflared', 'cert.pem');
+    return fs.existsSync(certPath);
+}
+
+// Get existing tunnels
+function listCloudflaredTunnels() {
+    try {
+        const output = execSync('cloudflared tunnel list -o json', { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+        return JSON.parse(output);
+    } catch (e) {
+        return [];
+    }
+}
+
+// Setup custom domain
+async function setupDomain(hostname) {
+    const tunnelName = 'hop';
+    let tunnelCreatedByUs = false;  // Track if we created it (for cleanup)
+
+    log(`\n${BOLD}Setting up custom domain: ${hostname}${RESET}\n`, CYAN);
+
+    // Step 1: Check cloudflared login
+    log(`[1/4] Checking Cloudflare authentication...`, BOLD);
+    if (!isCloudflaredLoggedIn()) {
+        log(`  Opening browser for Cloudflare login...`, YELLOW);
+        log(`  Please authorize in your browser.\n`, RESET);
+        try {
+            execSync('cloudflared tunnel login', { stdio: 'inherit' });
+        } catch (e) {
+            log(`Failed to authenticate with Cloudflare.`, RED);
+            process.exit(1);
+        }
+    }
+    log(`  Authenticated with Cloudflare.`, GREEN);
+
+    // Step 2: Check if tunnel exists, create if not
+    log(`[2/4] Setting up tunnel...`, BOLD);
+    const tunnels = listCloudflaredTunnels();
+    let tunnel = tunnels.find(t => t.name === tunnelName);
+
+    if (tunnel) {
+        log(`  Using existing tunnel: ${tunnelName} (${tunnel.id})`, GREEN);
+    } else {
+        log(`  Creating new tunnel: ${tunnelName}...`, YELLOW);
+        try {
+            execSync(`cloudflared tunnel create ${tunnelName}`, { encoding: 'utf8' });
+            log(`  Tunnel created.`, GREEN);
+            tunnelCreatedByUs = true;
+            // Re-fetch to get the ID
+            const newTunnels = listCloudflaredTunnels();
+            tunnel = newTunnels.find(t => t.name === tunnelName);
+        } catch (e) {
+            log(`Failed to create tunnel: ${e.message}`, RED);
+            process.exit(1);
+        }
+    }
+
+    // Step 3: Setup DNS route - this validates domain ownership
+    log(`[3/4] Configuring DNS...`, BOLD);
+    let dnsSuccess = false;
+    try {
+        // Capture both stdout and stderr to check for errors
+        const result = execSync(`cloudflared tunnel route dns ${tunnelName} ${hostname} 2>&1`, {
+            encoding: 'utf8'
+        });
+
+        // Check for failure FIRST (before checking for "already exists" which can appear in error messages)
+        if (result.includes('Failed to add route') || result.includes('Failed to create record')) {
+            // This is an error, even if it contains "already exists"
+            log(`\n${RED}ERROR: DNS configuration failed.${RESET}`, RED);
+            log(`Details: ${result.trim()}`, YELLOW);
+            dnsSuccess = false;
+        } else if (result.includes('Added CNAME')) {
+            dnsSuccess = true;
+            log(`  DNS configured: ${hostname} → tunnel`, GREEN);
+        } else if (result.includes('already exists') && !result.includes('Failed')) {
+            // Only treat as success if it's not part of a failure message
+            dnsSuccess = true;
+            log(`  DNS already configured.`, GREEN);
+        } else {
+            // Unexpected output - treat as potential failure
+            log(`  Unexpected response: ${result.trim()}`, YELLOW);
+            dnsSuccess = false;
+        }
+    } catch (e) {
+        const errorOutput = e.stdout || e.stderr || e.message || '';
+
+        // Check for failure indicators FIRST
+        if (errorOutput.includes('Failed to add route') || errorOutput.includes('Failed to create record')) {
+            log(`\n${RED}ERROR: DNS configuration failed.${RESET}`, RED);
+            log(`Details: ${errorOutput.trim()}`, YELLOW);
+            dnsSuccess = false;
+        } else if (errorOutput.includes('zone') || errorOutput.includes('not found') || errorOutput.includes('does not exist')) {
+            log(`\n${RED}ERROR: Domain "${hostname}" is not in your Cloudflare account.${RESET}`, RED);
+            log(`\nMake sure:`, YELLOW);
+            log(`  1. You own this domain`, RESET);
+            log(`  2. The domain is added to your Cloudflare account`, RESET);
+            log(`  3. You're using the correct Cloudflare account`, RESET);
+            dnsSuccess = false;
+        } else if (errorOutput.includes('authentication') || errorOutput.includes('unauthorized')) {
+            log(`\n${RED}ERROR: Authentication failed.${RESET}`, RED);
+            log(`Try: cloudflared tunnel login`, YELLOW);
+            dnsSuccess = false;
+        } else if (errorOutput.includes('already exists') && !errorOutput.includes('Failed')) {
+            // Only treat as success if it's a clean "already exists" not part of error
+            dnsSuccess = true;
+            log(`  DNS already configured.`, GREEN);
+        } else {
+            log(`\n${RED}ERROR: DNS configuration failed.${RESET}`, RED);
+            log(`Details: ${errorOutput.trim()}`, YELLOW);
+            dnsSuccess = false;
+        }
+    }
+
+    // If DNS failed, clean up the tunnel we created
+    if (!dnsSuccess) {
+        if (tunnelCreatedByUs) {
+            log(`\nCleaning up...`, YELLOW);
+            try {
+                execSync(`cloudflared tunnel delete ${tunnelName}`, { stdio: 'ignore' });
+                log(`  Deleted tunnel: ${tunnelName}`, RESET);
+            } catch (e) {
+                log(`  Note: You may need to manually delete tunnel: cloudflared tunnel delete ${tunnelName}`, YELLOW);
+            }
+        }
+        log(`\nSetup failed. Please fix the issue and try again.`, RED);
+        process.exit(1);
+    }
+
+    // Step 4: Save config
+    log(`[4/4] Saving configuration...`, BOLD);
+    saveDomainConfig({
+        tunnelName,
+        tunnelId: tunnel ? tunnel.id : null,
+        hostname,
+        createdAt: new Date().toISOString()
+    });
+    log(`  Configuration saved.`, GREEN);
+
+    log(`\n${BOLD}${GREEN}✓ Custom domain setup complete!${RESET}`, GREEN);
+    log(`\nYour hop URL: https://${hostname}`, BOLD);
+
+    // Require password for fixed domains
+    if (!isPasswordEnabled()) {
+        log(`\n${YELLOW}⚠ Password required for fixed domains.${RESET}`, YELLOW);
+        log(`A fixed URL is publicly known - password adds essential protection.\n`, RESET);
+
+        const readline = require('readline');
+        const stream = require('stream');
+
+        const askPassword = (prompt) => new Promise((resolve) => {
+            const rl = readline.createInterface({
+                input: process.stdin,
+                output: new stream.Writable({
+                    write: (chunk, encoding, callback) => callback()
+                }),
+                terminal: true
+            });
+
+            process.stdout.write(prompt);
+            rl.question('', (answer) => {
+                rl.close();
+                process.stdout.write('\n');
+                resolve(answer);
+            });
+        });
+
+        const password = await askPassword('Set a password: ');
+        if (password.length < 4) {
+            log(`Password too short. Run ${CYAN}hop password set${RESET} to set later.`, RED);
+        } else {
+            const confirm = await askPassword('Confirm password: ');
+            if (password !== confirm) {
+                log(`Passwords don't match. Run ${CYAN}hop password set${RESET} to set later.`, RED);
+            } else {
+                setPassword(password);
+                log(`${GREEN}✓ Password set.${RESET}`, GREEN);
+            }
+        }
+    }
+
+    log(`\nRun ${CYAN}hop${RESET} to start with your custom domain.`, RESET);
+}
+
+// --- Multi-user management ---
+const USERS_FILE = path.join(HOME_DIR, '.users.json');
+
+function getUsers() {
+    if (fs.existsSync(USERS_FILE)) {
+        try {
+            return JSON.parse(fs.readFileSync(USERS_FILE, 'utf8'));
+        } catch (e) {
+            return {};
+        }
+    }
+    return {};
+}
+
+function saveUsers(users) {
+    fs.writeFileSync(USERS_FILE, JSON.stringify(users, null, 2));
+}
+
+// Get base domain from existing config (e.g., hop.example.com -> example.com)
+function getBaseDomain() {
+    const config = getDomainConfig();
+    if (!config || !config.hostname) return null;
+    // Extract base domain: hop.example.com -> example.com
+    const parts = config.hostname.split('.');
+    if (parts.length >= 2) {
+        return parts.slice(-2).join('.');
+    }
+    return config.hostname;
+}
+
+// Get subdomain prefix (e.g., hop.example.com -> hop)
+function getSubdomainPrefix() {
+    const config = getDomainConfig();
+    if (!config || !config.hostname) return 'hop';
+    const parts = config.hostname.split('.');
+    if (parts.length >= 3) {
+        return parts[0];
+    }
+    return 'hop';
+}
+
+async function addUser(username) {
+    // Validate username
+    if (!/^[a-zA-Z0-9_-]+$/.test(username)) {
+        log(`Invalid username. Use only letters, numbers, underscore, hyphen.`, RED);
+        process.exit(1);
+    }
+
+    const baseDomain = getBaseDomain();
+    const prefix = getSubdomainPrefix();
+
+    if (!baseDomain) {
+        log(`You must set up your own domain first.`, RED);
+        log(`Run: hop domain <your-subdomain.yourdomain.com>`, RESET);
+        process.exit(1);
+    }
+
+    if (!isCloudflaredLoggedIn()) {
+        log(`You must be logged in to Cloudflare.`, RED);
+        log(`Run: hop domain <hostname> to set up.`, RESET);
+        process.exit(1);
+    }
+
+    const users = getUsers();
+    if (users[username]) {
+        log(`User "${username}" already exists.`, YELLOW);
+        log(`Hostname: ${users[username].hostname}`, RESET);
+        process.exit(0);
+    }
+
+    const tunnelName = `hop-${username}`;
+    const hostname = `${username}.${prefix}.${baseDomain}`;
+    let tunnelCreatedByUs = false;
+
+    log(`\n${BOLD}Adding user: ${username}${RESET}\n`, CYAN);
+
+    // Step 1: Create tunnel
+    log(`[1/3] Creating tunnel...`, BOLD);
+    const tunnels = listCloudflaredTunnels();
+    let tunnel = tunnels.find(t => t.name === tunnelName);
+
+    if (tunnel) {
+        log(`  Tunnel already exists: ${tunnelName}`, GREEN);
+    } else {
+        try {
+            execSync(`cloudflared tunnel create ${tunnelName}`, { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+            log(`  Tunnel created: ${tunnelName}`, GREEN);
+            tunnelCreatedByUs = true;
+            // Re-fetch to get the ID
+            const newTunnels = listCloudflaredTunnels();
+            tunnel = newTunnels.find(t => t.name === tunnelName);
+        } catch (e) {
+            log(`Failed to create tunnel: ${e.message}`, RED);
+            process.exit(1);
+        }
+    }
+
+    // Step 2: Setup DNS
+    log(`[2/3] Configuring DNS...`, BOLD);
+    let dnsSuccess = false;
+    try {
+        const result = execSync(`cloudflared tunnel route dns ${tunnelName} ${hostname} 2>&1`, {
+            encoding: 'utf8'
+        });
+        // Check for failure FIRST
+        if (result.includes('Failed to add route') || result.includes('Failed to create record')) {
+            log(`\n${RED}ERROR: DNS failed: ${result.trim()}${RESET}`, RED);
+            dnsSuccess = false;
+        } else if (result.includes('Added CNAME')) {
+            dnsSuccess = true;
+            log(`  DNS configured: ${hostname}`, GREEN);
+        } else if (result.includes('already exists') && !result.includes('Failed')) {
+            dnsSuccess = true;
+            log(`  DNS already configured.`, GREEN);
+        } else {
+            log(`  Unexpected response: ${result.trim()}`, YELLOW);
+        }
+    } catch (e) {
+        const errorOutput = e.stdout || e.stderr || e.message || '';
+        // Check for failure FIRST
+        if (errorOutput.includes('Failed to add route') || errorOutput.includes('Failed to create record')) {
+            log(`\n${RED}ERROR: DNS failed: ${errorOutput.trim()}${RESET}`, RED);
+        } else if (errorOutput.includes('already exists') && !errorOutput.includes('Failed')) {
+            dnsSuccess = true;
+            log(`  DNS already configured.`, GREEN);
+        } else if (errorOutput.includes('zone') || errorOutput.includes('not found')) {
+            log(`\n${RED}ERROR: Domain not in your Cloudflare account.${RESET}`, RED);
+        } else {
+            log(`\n${RED}ERROR: DNS failed: ${errorOutput.trim()}${RESET}`, RED);
+        }
+    }
+
+    // If DNS failed, clean up
+    if (!dnsSuccess) {
+        if (tunnelCreatedByUs) {
+            log(`\nCleaning up...`, YELLOW);
+            try {
+                execSync(`cloudflared tunnel delete ${tunnelName}`, { stdio: 'ignore' });
+                log(`  Deleted tunnel: ${tunnelName}`, RESET);
+            } catch (e) { }
+        }
+        process.exit(1);
+    }
+
+    // Step 3: Save user info
+    log(`[3/3] Saving user...`, BOLD);
+
+    // Find the credentials file
+    const cloudflaredDir = path.join(os.homedir(), '.cloudflared');
+    let credentialsFile = null;
+    if (tunnel && tunnel.id) {
+        credentialsFile = path.join(cloudflaredDir, `${tunnel.id}.json`);
+    }
+
+    users[username] = {
+        tunnelName,
+        tunnelId: tunnel ? tunnel.id : null,
+        hostname,
+        credentialsFile,
+        createdAt: new Date().toISOString()
+    };
+    saveUsers(users);
+    log(`  User saved.`, GREEN);
+
+    log(`\n${BOLD}${GREEN}✓ User "${username}" added!${RESET}`, GREEN);
+    log(`\nTheir URL: https://${hostname}`, BOLD);
+    log(`\nTo export credentials for them:`, RESET);
+    log(`  ${CYAN}hop user export ${username}${RESET}`, RESET);
+}
+
+async function removeUser(username) {
+    const users = getUsers();
+
+    if (!users[username]) {
+        log(`User "${username}" not found.`, RED);
+        process.exit(1);
+    }
+
+    const user = users[username];
+
+    log(`\n${BOLD}Removing user: ${username}${RESET}\n`, YELLOW);
+
+    // Delete tunnel
+    log(`[1/2] Deleting tunnel...`, BOLD);
+    try {
+        execSync(`cloudflared tunnel delete ${user.tunnelName}`, {
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe']
+        });
+        log(`  Tunnel deleted: ${user.tunnelName}`, GREEN);
+    } catch (e) {
+        log(`  Warning: Could not delete tunnel (may already be gone).`, YELLOW);
+    }
+
+    // Note: DNS record may remain, Cloudflare doesn't auto-delete it
+    log(`[2/2] Removing user record...`, BOLD);
+    delete users[username];
+    saveUsers(users);
+    log(`  User removed.`, GREEN);
+
+    log(`\n${BOLD}${GREEN}✓ User "${username}" removed.${RESET}`, GREEN);
+    log(`\nNote: DNS record for ${user.hostname} may need manual removal in Cloudflare dashboard.`, YELLOW);
+}
+
+function listUsersCommand() {
+    const users = getUsers();
+    const userList = Object.entries(users);
+
+    if (userList.length === 0) {
+        log(`\nNo users configured.`, YELLOW);
+        log(`\nAdd a user: hop user add <username>`, RESET);
+        return;
+    }
+
+    log(`\n${BOLD}Configured users:${RESET}\n`, CYAN);
+
+    for (const [username, info] of userList) {
+        log(`  ${BOLD}${username}${RESET}`, GREEN);
+        log(`    URL:     https://${info.hostname}`, RESET);
+        log(`    Tunnel:  ${info.tunnelName}`, RESET);
+        log(`    Created: ${info.createdAt}`, RESET);
+        log('');
+    }
+}
+
+async function exportUserCredentials(username) {
+    const users = getUsers();
+
+    if (!users[username]) {
+        log(`User "${username}" not found.`, RED);
+        process.exit(1);
+    }
+
+    const user = users[username];
+    const cloudflaredDir = path.join(os.homedir(), '.cloudflared');
+    const certFile = path.join(cloudflaredDir, 'cert.pem');
+
+    // Find credentials file
+    let credentialsFile = user.credentialsFile;
+    if (!credentialsFile || !fs.existsSync(credentialsFile)) {
+        // Try to find by tunnel ID
+        if (user.tunnelId) {
+            credentialsFile = path.join(cloudflaredDir, `${user.tunnelId}.json`);
+        }
+    }
+
+    if (!credentialsFile || !fs.existsSync(credentialsFile)) {
+        log(`Credentials file not found for user "${username}".`, RED);
+        log(`The tunnel may need to be recreated.`, YELLOW);
+        process.exit(1);
+    }
+
+    // Create export directory
+    const exportDir = path.join(HOME_DIR, 'exports', username);
+    if (!fs.existsSync(exportDir)) {
+        fs.mkdirSync(exportDir, { recursive: true });
+    }
+
+    // Copy credentials
+    const exportCredentials = path.join(exportDir, 'credentials.json');
+    fs.copyFileSync(credentialsFile, exportCredentials);
+
+    // Create config.yml with hostname for client convenience
+    const exportConfig = `hostname: ${user.hostname}
+tunnel: ${user.tunnelId || ''}
+`;
+    const exportConfigPath = path.join(exportDir, 'config.yml');
+    writePrivateFile(exportConfigPath, exportConfig);
+
+    // Create README with hop client instructions
+    const readme = `# Hop Terminal for ${username}
+
+Your hop URL: https://${user.hostname}
+
+## Quick Start
+
+1. Install hop globally:
+   npm install -g hop-shell
+
+2. Start hop with credentials:
+   hop client ./credentials.json
+
+3. On first run, you'll be prompted to:
+   - Set a password (required)
+   - Scan a QR code for 2FA (TOTP)
+
+4. Open your URL and log in:
+   https://${user.hostname}
+
+## Security
+
+- credentials.json contains your tunnel secret - keep it safe!
+- On first run, you MUST set up password + TOTP authentication
+- Anyone accessing your URL will need YOUR password and TOTP code
+- Your credentials are stored in ~/.hop-shell/clients/<tunnel-id>/
+
+## Troubleshooting
+
+If you need to reset your password/TOTP:
+   rm -rf ~/.hop-shell/clients/
+
+Then run hop client again to set up fresh credentials.
+`;
+    const exportReadme = path.join(exportDir, 'README.md');
+    fs.writeFileSync(exportReadme, readme);
+
+    log(`\n${BOLD}${GREEN}✓ Credentials exported for "${username}"${RESET}`, GREEN);
+    log(`\nExport location: ${exportDir}`, BOLD);
+    log(`\nFiles created:`, RESET);
+    log(`  - credentials.json  (tunnel credentials - keep secret!)`, RESET);
+    log(`  - config.yml        (hostname config)`, RESET);
+    log(`  - README.md         (setup instructions)`, RESET);
+    log(`\n${YELLOW}Send this folder to ${username}.${RESET}`, YELLOW);
+    log(`\nThey should:`, RESET);
+    log(`  1. Install hop:  ${CYAN}npm install -g hop-shell${RESET}`, RESET);
+    log(`  2. Run:          ${CYAN}hop client ./credentials.json${RESET}`, RESET);
+    log(`  3. Set up their password + TOTP on first run`, RESET);
+    log(`\nTheir URL will be: https://${user.hostname}`, CYAN);
+}
+
+// Check if tunnel is already running
+function isServerRunning() {
+    if (!fs.existsSync(STATE_FILE)) return null;
+    ensurePrivateFile(STATE_FILE);
+    try {
+        const state = JSON.parse(fs.readFileSync(STATE_FILE, 'utf8'));
+        // Check if the process is still alive
+        try {
+            process.kill(state.pid, 0);
+            return state;
+        } catch (e) {
+            // Process is dead, clean up
+            fs.unlinkSync(STATE_FILE);
+            return null;
+        }
+    } catch (e) {
+        return null;
+    }
+}
+
+// Generate or load session secret
+let SESSION_SECRET;
+const existingState = isServerRunning();
+if (existingState) {
+    SESSION_SECRET = existingState.sessionSecret;
+} else {
+    SESSION_SECRET = crypto.randomBytes(32).toString('hex');
+}
+
+// Persistence for Stable QR Code
+let AUTH_SECRET;
+function loadAuthSecret() {
+    if (fs.existsSync(SECRET_FILE_PATH)) {
+        AUTH_SECRET = fs.readFileSync(SECRET_FILE_PATH, 'utf8').trim();
+        ensurePrivateFile(SECRET_FILE_PATH);
+    } else {
+        AUTH_SECRET = authenticator.generateSecret();
+        writePrivateFile(SECRET_FILE_PATH, AUTH_SECRET);
+    }
+}
+
+// Port configuration
+const BASE_PORT = existingState ? existingState.port : Math.floor(Math.random() * (50000 - 10000 + 1) + 10000);
+const PROXY_PORT = BASE_PORT;
+
+// Session Management (using hay server - no tmux/ttyd)
+const activeSessions = {}; // { sessionName: { room: HayRoom } }
+const startingSessions = new Set(); // session names being initialized
+const sessionRenames = {};  // { oldName: newName } - track renames for styling updates
+let nextPort = BASE_PORT + 1;
+
+// --- Login Rate Limiting (Exponential Backoff) ---
+const failedAttempts = new Map(); // ip -> { count: number, lastAttempt: number }
+const FAILED_ATTEMPT_TTL_MS = 6 * 60 * 60 * 1000; // 6 hours
+const FAILED_ATTEMPT_MAX = 1000;
+
+function pruneFailedAttempts(now = Date.now()) {
+    for (const [ip, record] of failedAttempts.entries()) {
+        if (now - record.lastAttempt > FAILED_ATTEMPT_TTL_MS) {
+            failedAttempts.delete(ip);
+        }
+    }
+    if (failedAttempts.size > FAILED_ATTEMPT_MAX) {
+        const entries = Array.from(failedAttempts.entries())
+            .sort((a, b) => a[1].lastAttempt - b[1].lastAttempt);
+        const overflow = failedAttempts.size - FAILED_ATTEMPT_MAX;
+        for (let i = 0; i < overflow; i++) {
+            failedAttempts.delete(entries[i][0]);
+        }
+    }
+}
+
+function checkRateLimit(ip) {
+    pruneFailedAttempts();
+    const record = failedAttempts.get(ip);
+    if (!record || record.count < 5) return { allowed: true };
+
+    const now = Date.now();
+    // 5 failures = 30s, 6 = 60s, 7 = 120s... (30 * 2^(n-5))
+    const waitSeconds = 30 * Math.pow(2, record.count - 5);
+    const lockedUntil = record.lastAttempt + (waitSeconds * 1000);
+
+    if (now < lockedUntil) {
+        return { allowed: false, remaining: Math.ceil((lockedUntil - now) / 1000) };
+    }
+    return { allowed: true };
+}
+
+function recordFailure(ip) {
+    const now = Date.now();
+    pruneFailedAttempts(now);
+    const record = failedAttempts.get(ip) || { count: 0, lastAttempt: 0 };
+    record.count++;
+    record.lastAttempt = now;
+    failedAttempts.set(ip, record);
+}
+
+function resetFailure(ip) {
+    failedAttempts.delete(ip);
+}
+
+// Colors
+const RESET = "\x1b[0m";
+const GREEN = "\x1b[32m";
+const YELLOW = "\x1b[33m";
+const CYAN = "\x1b[36m";
+const RED = "\x1b[31m";
+const BOLD = "\x1b[1m";
+const MAGENTA = "\x1b[35m";
+
+function log(msg, color = RESET) {
+    console.log(`${color}${msg}${RESET}`);
+}
+
+async function runCommand(command, args, opts = {}) {
+    return new Promise((resolve, reject) => {
+        const proc = spawn(command, args, { stdio: 'inherit', ...opts });
+        proc.on('close', (code) => {
+            if (code === 0) resolve();
+            else reject(new Error(`Command ${command} exited with code ${code}`));
+        });
+        proc.on('error', (err) => reject(err));
+    });
+}
+
+async function checkAndInstallDependencies() {
+    log(`[1/4] Checking dependencies...`, BOLD);
+    try {
+        await runCommand('brew', ['--version'], { stdio: 'ignore' });
+    } catch (e) {
+        log(`  - Homebrew not found.`, YELLOW);
+
+        const readline = require('readline');
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+
+        const answer = await new Promise(resolve => {
+            rl.question(`  Install Homebrew now? (y/n) `, resolve);
+        });
+        rl.close();
+
+        if (answer.toLowerCase() !== 'y') {
+            log(`Error: Homebrew required. Install from https://brew.sh`, RED);
+            process.exit(1);
+        }
+
+        log(`  - Installing Homebrew...`, YELLOW);
+        try {
+            await runCommand('/bin/bash', ['-c',
+                'curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh | bash'
+            ], { stdio: 'inherit' });
+
+            // Add brew to PATH for Apple Silicon
+            const brewPaths = ['/opt/homebrew/bin', '/usr/local/bin'];
+            for (const p of brewPaths) {
+                if (fs.existsSync(path.join(p, 'brew'))) {
+                    process.env.PATH = `${p}:${process.env.PATH}`;
+                    break;
+                }
+            }
+            log(`  - Homebrew installed.`, GREEN);
+        } catch (err) {
+            log(`Error: Failed to install Homebrew.`, RED);
+            process.exit(1);
+        }
+    }
+
+    const deps = ['cloudflared']; // tmux/ttyd not needed - using node-pty via hay
+    for (const dep of deps) {
+        try {
+            await runCommand('which', [dep], { stdio: 'ignore' });
+            log(`  - ${dep} found.`, GREEN);
+        } catch (e) {
+            log(`  - ${dep} NOT found. Installing...`, YELLOW);
+            try {
+                await runCommand('brew', ['install', dep]);
+                log(`  - ${dep} installed.`, GREEN);
+            } catch (err) {
+                log(`  - Failed to install ${dep}. Check Xcode license?`, RED);
+                process.exit(1);
+            }
+        }
+    }
+}
+
+// List active hay rooms as sessions
+function listActiveSessions() {
+    const sessions = [];
+    for (const [name, room] of hayRooms.rooms) {
+        sessions.push({
+            name,
+            windows: 1,
+            attached: room.clients.size > 0
+        });
+    }
+    return sessions;
+}
+
+function hopSessionExists(name) {
+    if (!name) return false;
+    return hayRooms.hasRoom(name) || activeSessions[name];
+}
+
+function listAllSessionEntries() {
+    const haySessions = listActiveSessions().filter(s => s.name.startsWith(HOP_SESSION_PREFIX));
+    const sessionMap = new Map();
+
+    for (const s of haySessions) {
+        const config = getSessionConfig(s.name);
+        const type = config?.type || 'terminal';
+        sessionMap.set(s.name, {
+            ...s,
+            type,
+            port: config?.port,
+            displayName: toDisplaySessionName(s.name)
+        });
+    }
+
+    for (const [name, config] of Object.entries(sessionConfigs)) {
+        if (!name.startsWith(HOP_SESSION_PREFIX)) continue;
+        if (!sessionMap.has(name)) {
+            sessionMap.set(name, {
+                name,
+                windows: null,
+                attached: false,
+                type: config.type || 'terminal',
+                port: config.port,
+                displayName: toDisplaySessionName(name)
+            });
+        } else if (config?.type === 'port') {
+            const entry = sessionMap.get(name);
+            entry.type = 'port';
+            entry.port = config.port;
+        }
+    }
+
+    return Array.from(sessionMap.values()).sort((a, b) => a.displayName.localeCompare(b.displayName));
+}
+
+// Light theme for hay terminal
+function getTheme() {
+    return JSON.stringify({
+        'background': '#ffffff',
+        'foreground': '#18181b',
+        'cursor': '#7c3aed',
+        'selectionBackground': '#ddd6fe',
+        'black': '#18181b',
+        'red': '#dc2626',
+        'green': '#16a34a',
+        'yellow': '#ca8a04',
+        'blue': '#2563eb',
+        'magenta': '#9333ea',
+        'cyan': '#0891b2',
+        'white': '#f4f4f5'
+    });
+}
+
+// Start or get existing session (uses hay for terminal sharing)
+function getOrCreateSession(sessionName, cwd) {
+    if (!sessionName || typeof sessionName !== 'string' || !SESSION_NAME_RE.test(sessionName)) {
+        throw new Error('Invalid session name');
+    }
+    const existingConfig = getSessionConfig(sessionName);
+    if (existingConfig && existingConfig.type === 'port') {
+        throw new Error('Session is configured as a port proxy');
+    }
+    ensureTerminalSessionConfig(sessionName, cwd);
+    if (activeSessions[sessionName]) {
+        return activeSessions[sessionName];
+    }
+
+    const config = getSessionConfig(sessionName);
+    const effectiveCwd = cwd || config?.cwd;
+
+    // Create hay room for this session (with optional cwd override)
+    const room = hayRooms.getRoom(sessionName, { cols: 80, rows: 24 }, effectiveCwd);
+
+    room.on('empty', () => {
+        delete activeSessions[sessionName];
+        const config = getSessionConfig(sessionName);
+        if (config && config.type !== 'port') {
+            deleteSessionConfig(sessionName);
+        }
+        log(`Session ${toDisplaySessionName(sessionName)} closed.`, YELLOW);
+    });
+
+    room.on('exit', () => {
+        delete activeSessions[sessionName];
+        log(`Session ${toDisplaySessionName(sessionName)} exited.`, YELLOW);
+    });
+
+    activeSessions[sessionName] = { room };
+    log(`  Started session "${toDisplaySessionName(sessionName)}" (hay)`, GREEN);
+
+    return activeSessions[sessionName];
+}
+
+// Resolve current session name (follows rename chain)
+function resolveSessionName(name) {
+    let current = name;
+    while (sessionRenames[current]) {
+        current = sessionRenames[current];
+    }
+    return current;
+}
+
+function getSessionSwitcherOverlay() {
+    return `
+<style id="hop-session-switcher-style">
+#hop-session-fab {
+  position: fixed;
+  left: 0;
+  top: 0;
+  z-index: 2147483647;
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+  user-select: none;
+}
+#hop-session-fab-btn {
+  width: 44px;
+  height: 44px;
+  border-radius: 999px;
+  background: rgba(24, 24, 27, 0.9);
+  color: #fff;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  border: 1px solid rgba(255,255,255,0.08);
+  box-shadow: 0 6px 18px rgba(0,0,0,0.2);
+  cursor: pointer;
+  padding: 0;
+}
+#hop-session-fab-btn:active { transform: scale(0.97); }
+#hop-session-fab-btn svg { width: 20px; height: 20px; }
+#hop-session-fab-menu {
+  position: absolute;
+  right: 0;
+  bottom: 52px;
+  min-width: 200px;
+  max-width: min(82vw, 320px);
+  background: #fff;
+  color: #18181b;
+  border: 1px solid #e4e4e7;
+  border-radius: 12px;
+  box-shadow: 0 12px 28px rgba(0,0,0,0.16);
+  padding: 8px;
+  display: none;
+}
+#hop-session-fab.open #hop-session-fab-menu { display: block; }
+#hop-session-fab-menu .hop-title {
+  font-size: 12px;
+  font-weight: 600;
+  color: #71717a;
+  padding: 6px 8px;
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+}
+#hop-session-fab-menu .hop-item,
+#hop-session-fab-menu .hop-link {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  width: 100%;
+  border: none;
+  background: transparent;
+  padding: 8px 10px;
+  border-radius: 8px;
+  font-size: 14px;
+  color: #18181b;
+  text-decoration: none;
+  cursor: pointer;
+}
+#hop-session-fab-menu .hop-item:hover,
+#hop-session-fab-menu .hop-link:hover { background: #f4f4f5; }
+#hop-session-fab-menu .hop-item.current { font-weight: 600; }
+#hop-session-fab-menu .hop-dot {
+  width: 7px;
+  height: 7px;
+  border-radius: 999px;
+  background: #22c55e;
+}
+#hop-session-fab-menu .hop-subtle { color: #71717a; font-size: 12px; }
+</style>
+<div id="hop-session-fab" role="button" aria-label="Sessions">
+  <button id="hop-session-fab-btn" aria-label="Sessions">
+    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round">
+      <rect x="3" y="4" width="18" height="13" rx="2"></rect>
+      <path d="M8 21h8"></path>
+      <path d="M12 17v4"></path>
+    </svg>
+  </button>
+  <div id="hop-session-fab-menu" aria-hidden="true">
+    <div class="hop-title">Sessions</div>
+    <div id="hop-session-fab-list"></div>
+    <a class="hop-link" href="/sessions">Session Picker</a>
+  </div>
+</div>
+<script>
+(function() {
+  var fab = document.getElementById('hop-session-fab');
+  var btn = document.getElementById('hop-session-fab-btn');
+  var menu = document.getElementById('hop-session-fab-menu');
+  var list = document.getElementById('hop-session-fab-list');
+  if (!fab || !btn || !menu || !list) return;
+
+  function clamp(v, min, max) { return Math.min(Math.max(v, min), max); }
+  function getCurrentSession() {
+    var path = window.location.pathname || '';
+    if (path.indexOf('/s/') === 0) {
+      var rest = path.slice(3);
+      var parts = rest.split('/');
+      try { return decodeURIComponent(parts[0] || ''); } catch (e) { return ''; }
+    }
+    return '';
+  }
+
+  var stored = null;
+  try { stored = JSON.parse(localStorage.getItem('hop-fab-pos') || 'null'); } catch (e) { stored = null; }
+  function setPos(x, y) {
+    fab.style.left = x + 'px';
+    fab.style.top = y + 'px';
+  }
+  function initPos() {
+    var pad = 12;
+    var x = (stored && typeof stored.x === 'number') ? stored.x : (window.innerWidth - 56);
+    var y = (stored && typeof stored.y === 'number') ? stored.y : (window.innerHeight - 120);
+    x = clamp(x, pad, window.innerWidth - 56);
+    y = clamp(y, pad, window.innerHeight - 56);
+    setPos(x, y);
+  }
+  initPos();
+
+  var dragging = false;
+  var moved = false;
+  var startX = 0, startY = 0, origX = 0, origY = 0;
+
+  function onDown(e) {
+    dragging = true;
+    moved = false;
+    var touch = e.touches ? e.touches[0] : e;
+    startX = touch.clientX;
+    startY = touch.clientY;
+    var rect = fab.getBoundingClientRect();
+    origX = rect.left;
+    origY = rect.top;
+    e.preventDefault();
+  }
+  function onMove(e) {
+    if (!dragging) return;
+    var touch = e.touches ? e.touches[0] : e;
+    var dx = touch.clientX - startX;
+    var dy = touch.clientY - startY;
+    if (Math.abs(dx) > 4 || Math.abs(dy) > 4) moved = true;
+    var x = clamp(origX + dx, 8, window.innerWidth - 56);
+    var y = clamp(origY + dy, 8, window.innerHeight - 56);
+    setPos(x, y);
+  }
+  function onUp() {
+    if (!dragging) return;
+    dragging = false;
+    var rect = fab.getBoundingClientRect();
+    try { localStorage.setItem('hop-fab-pos', JSON.stringify({ x: rect.left, y: rect.top })); } catch (e) { }
+  }
+
+  btn.addEventListener('touchstart', onDown, { passive: false });
+  btn.addEventListener('touchmove', onMove, { passive: false });
+  btn.addEventListener('touchend', onUp);
+  btn.addEventListener('mousedown', onDown);
+  window.addEventListener('mousemove', onMove);
+  window.addEventListener('mouseup', onUp);
+
+  function closeMenu() {
+    fab.classList.remove('open');
+    menu.setAttribute('aria-hidden', 'true');
+  }
+  function toggleMenu() {
+    if (fab.classList.contains('open')) {
+      closeMenu();
+      return;
+    }
+    fab.classList.add('open');
+    menu.setAttribute('aria-hidden', 'false');
+    fetchSessions();
+  }
+
+  btn.addEventListener('click', function(e) {
+    if (moved) return;
+    e.preventDefault();
+    toggleMenu();
+  });
+
+  document.addEventListener('click', function(e) {
+    if (!fab.contains(e.target)) closeMenu();
+  });
+
+  function fetchSessions() {
+    fetch('/api/sessions')
+      .then(function(r) { return r.json(); })
+      .then(function(data) {
+        list.innerHTML = '';
+        var sessions = data.sessions || [];
+        var active = data.active || [];
+        if (!sessions.length) {
+          var empty = document.createElement('div');
+          empty.className = 'hop-item';
+          empty.textContent = 'No sessions';
+          list.appendChild(empty);
+          return;
+        }
+        var current = getCurrentSession();
+        sessions.forEach(function(s) {
+          var item = document.createElement('button');
+          item.className = 'hop-item';
+          if (s.name === current) item.classList.add('current');
+          if (active.indexOf(s.name) !== -1) {
+            var dot = document.createElement('span');
+            dot.className = 'hop-dot';
+            item.appendChild(dot);
+          }
+          var label = document.createElement('span');
+          var suffix = s.type === 'port' ? (s.port ? ' (PORT ' + s.port + ')' : ' (PORT)') : '';
+          label.textContent = (s.displayName || s.name) + suffix;
+          item.appendChild(label);
+          item.addEventListener('click', function(ev) {
+            ev.stopPropagation();
+            window.location.href = '/s/' + encodeURIComponent(s.name) + '/';
+          });
+          list.appendChild(item);
+        });
+      })
+      .catch(function() {
+        list.innerHTML = '<div class="hop-item hop-subtle">Failed to load</div>';
+      });
+  }
+})();
+</script>
+`;
+}
+
+function shouldInjectSessionSwitcher(req) {
+    if (!req || req.method !== 'GET') return false;
+    const accept = String(req.headers?.accept || '').toLowerCase();
+    if (!accept.includes('text/html')) return false;
+    const dest = String(req.headers?.['sec-fetch-dest'] || '');
+    if (dest && dest !== 'document') return false;
+    return true;
+}
+
+function buildSessionPath(displayName) {
+    return `/s/${encodeURIComponent(displayName)}/`;
+}
+
+function stripSessionParam(search) {
+    if (!search) return '';
+    const params = new URLSearchParams(search);
+    params.delete('session');
+    const qs = params.toString();
+    return qs ? `?${qs}` : '';
+}
+
+function parseSessionFromRequest(req, parsedUrl) {
+    const pathname = parsedUrl.pathname || '';
+    if (pathname.startsWith('/s/')) {
+        const rest = pathname.slice(3);
+        const parts = rest.split('/');
+        const rawName = parts.shift() || '';
+        let displayName = '';
+        try {
+            displayName = decodeURIComponent(rawName);
+        } catch (e) {
+            return null;
+        }
+        if (!SESSION_NAME_RE.test(displayName)) return null;
+        const internalName = toInternalSessionName(displayName);
+        const needsSlash = pathname === `/s/${rawName}`;
+        const strippedPathname = '/' + parts.join('/');
+        const normalizedPathname = strippedPathname === '/' ? '/' : strippedPathname;
+        const strippedUrl = normalizedPathname + (parsedUrl.search || '');
+        return {
+            displayName,
+            internalName,
+            strippedPathname: normalizedPathname,
+            strippedUrl,
+            source: 'path',
+            needsSlash
+        };
+    }
+
+    const sessionParam = parsedUrl.query.session;
+    if (sessionParam && SESSION_NAME_RE.test(sessionParam)) {
+        const displayName = sessionParam;
+        const internalName = toInternalSessionName(displayName);
+        const strippedPathname = parsedUrl.pathname || '/';
+        const strippedUrl = strippedPathname + stripSessionParam(parsedUrl.search || '');
+        return {
+            displayName,
+            internalName,
+            strippedPathname,
+            strippedUrl,
+            source: 'query'
+        };
+    }
+
+    return null;
+}
+
+function shouldRedirectToSessionPath(req) {
+    if (!req || req.method !== 'GET') return false;
+    const accept = String(req.headers?.accept || '').toLowerCase();
+    return accept.includes('text/html');
+}
+
+// Helper to get client IP (handles proxies)
+function getClientIp(req) {
+    return req.headers['cf-connecting-ip'] ||
+        req.headers['x-forwarded-for'] ||
+        req.socket.remoteAddress ||
+        'unknown';
+}
+
+function waitForPort(port, host = '127.0.0.1', timeoutMs = 4000, intervalMs = 120) {
+    const start = Date.now();
+    return new Promise((resolve) => {
+        const tryConnect = () => {
+            const socket = net.connect({ port, host });
+            socket.once('connect', () => {
+                socket.end();
+                resolve(true);
+            });
+            socket.once('error', () => {
+                socket.destroy();
+                if (Date.now() - start >= timeoutMs) {
+                    resolve(false);
+                    return;
+                }
+                setTimeout(tryConnect, intervalMs);
+            });
+        };
+        tryConnect();
+    });
+}
+
+function sendStartingPage(res, displayName) {
+    setNoCache(res);
+    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+    res.end(`<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta http-equiv="refresh" content="1">
+    <title>Starting Session</title>
+    <style>
+      body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; background: #fafafa; color: #18181b; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; }
+      .box { text-align: center; padding: 2rem; max-width: 420px; }
+      .spinner { width: 28px; height: 28px; border: 3px solid #e4e4e7; border-top-color: #7c3aed; border-radius: 50%; animation: spin 1s linear infinite; margin: 0 auto 1rem; }
+      @keyframes spin { to { transform: rotate(360deg); } }
+      a { color: #7c3aed; text-decoration: none; }
+    </style>
+  </head>
+  <body>
+    <div class="box">
+      <div class="spinner"></div>
+      <h2>Starting session…</h2>
+      <p>This can take a few seconds. Refreshing automatically.</p>
+      <p><a href="${buildSessionPath(displayName)}">Click to retry</a></p>
+    </div>
+  </body>
+</html>`);
+}
+
+function setNoCache(res) {
+    res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+    res.setHeader('Pragma', 'no-cache');
+    res.setHeader('Expires', '0');
+}
+
+function appendSetCookie(res, cookies) {
+    const existing = res.getHeader('Set-Cookie');
+    if (!existing) {
+        res.setHeader('Set-Cookie', cookies);
+        return;
+    }
+    const merged = Array.isArray(existing) ? existing.concat(cookies) : [existing].concat(cookies);
+    res.setHeader('Set-Cookie', merged);
+}
+
+function clearAuthCookies(res) {
+    const expires = new Date(0);
+    appendSetCookie(res, [
+        cookie.serialize(SESSION_COOKIE_NAME, '', {
+            httpOnly: true,
+            secure: true,
+            sameSite: 'lax',
+            path: '/',
+            expires,
+            maxAge: 0
+        }),
+        cookie.serialize(SESSION_COOKIE_NAME, '', {
+            httpOnly: true,
+            secure: true,
+            sameSite: 'lax',
+            path: '/api',
+            expires,
+            maxAge: 0
+        })
+    ]);
+}
+
+function escapeHtml(value) {
+    return String(value)
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/\"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+
+let lastAuthAt = 0;
+function recordAuth(authEmitter) {
+    lastAuthAt = Date.now();
+    if (authEmitter) authEmitter.emit('authenticated');
+}
+
+function startAuthProxy(authEmitter) {
+    log(`[2/4] Starting Session Manager on port ${PROXY_PORT}...`, BOLD);
+
+    const server = http.createServer((req, res) => {
+        const parsedUrl = url.parse(req.url, true);
+        const cookies = cookie.parse(req.headers.cookie || '');
+        const ip = getClientIp(req);
+        const sessionInfo = parseSessionFromRequest(req, parsedUrl);
+
+        // Check auth via cookie OR Authorization header (internal hop-to-hop only)
+        // Bearer token is read from state file by other hop processes on same machine
+        const authHeader = req.headers.authorization;
+        const tokenFromHeader = authHeader && authHeader.startsWith('Bearer ')
+            ? authHeader.substring(7)
+            : null;
+        const isAuthenticated = cookies[SESSION_COOKIE_NAME] === SESSION_SECRET
+            || tokenFromHeader === SESSION_SECRET;
+
+        // API: Auth status (used by local CLI to wait for remote login)
+        if (parsedUrl.pathname === '/api/auth' && req.method === 'GET') {
+            if (!isAuthenticated) {
+                res.writeHead(401, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Unauthorized' }));
+                return;
+            }
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ lastAuthAt }));
+            return;
+        }
+
+        // --- LOGIN PAGE ---
+        if (!isAuthenticated) {
+            const passwordRequired = isPasswordEnabled();
+            const storedPasswordHash = getStoredPassword();
+
+            // API Login endpoint - authenticates via password (if enabled) + TOTP
+            if (req.method === 'POST' && parsedUrl.pathname === '/api/login') {
+                const limit = checkRateLimit(ip);
+                if (!limit.allowed) {
+                    res.writeHead(429, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ success: false, error: `Too many attempts. Try again in ${limit.remaining}s.` }));
+                    return;
+                }
+
+                let body = '';
+                req.on('data', chunk => body += chunk);
+                req.on('end', () => {
+                    try {
+                        const { totp, password } = JSON.parse(body);
+
+                        // Check password if enabled
+                        if (passwordRequired && !verifyPassword(password || '', storedPasswordHash)) {
+                            recordFailure(ip);
+                            res.writeHead(401, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ success: false, error: 'Invalid password' }));
+                            return;
+                        }
+
+                        // Check TOTP
+                        if (authenticator.check(totp, AUTH_SECRET)) {
+                            resetFailure(ip);
+                            appendSetCookie(res, [
+                                cookie.serialize(SESSION_COOKIE_NAME, SESSION_SECRET, {
+                                    httpOnly: true,
+                                    secure: true,
+                                    sameSite: 'lax',
+                                    path: '/',
+                                    maxAge: 60 * 60 * 24 * 7
+                                })
+                            ]);
+                            res.writeHead(200, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ success: true }));
+                            recordAuth(authEmitter);
+                        } else {
+                            recordFailure(ip);
+                            res.writeHead(401, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ success: false, error: 'Invalid code' }));
+                        }
+                    } catch (e) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ success: false, error: 'Invalid request' }));
+                    }
+                });
+                return;
+            }
+
+            // Web form login (support / and /s/<name>/)
+            if (req.method === 'POST' && (parsedUrl.pathname === '/' || parsedUrl.pathname.startsWith('/s/'))) {
+                const limit = checkRateLimit(ip);
+                if (!limit.allowed) {
+                    res.writeHead(429, { 'Content-Type': 'text/html; charset=utf-8' });
+                    res.end(`Too many attempts. Try again in ${limit.remaining}s. <a href="/">Back</a>`);
+                    return;
+                }
+
+                let body = '';
+                req.on('data', chunk => body += chunk);
+                req.on('end', () => {
+                    const params = new URLSearchParams(body);
+                    const token = params.get('token');
+                    const password = params.get('password');
+                    const requestedDisplayName = params.get('session') || sessionInfo?.displayName;
+                    const requestedInternalName = requestedDisplayName
+                        ? toInternalSessionName(requestedDisplayName)
+                        : null;
+
+                    try {
+                        // Check password if enabled
+                        if (passwordRequired && !verifyPassword(password || '', storedPasswordHash)) {
+                            recordFailure(ip);
+                            res.writeHead(401, { 'Content-Type': 'text/html; charset=utf-8' });
+                            res.end('Invalid password. <a href="/">Try Again</a>');
+                            return;
+                        }
+
+                        // Check TOTP
+                        if (authenticator.check(token, AUTH_SECRET)) {
+                            resetFailure(ip);
+                            appendSetCookie(res, [
+                                cookie.serialize(SESSION_COOKIE_NAME, SESSION_SECRET, {
+                                    httpOnly: true,
+                                    secure: true,
+                                    sameSite: 'lax',
+                                    path: '/',
+                                    maxAge: 60 * 60 * 24 * 7
+                                })
+                            ]);
+                            const redirectTarget = requestedInternalName
+                                ? buildSessionPath(requestedDisplayName)
+                                : '/sessions';
+                            res.writeHead(302, { 'Location': redirectTarget });
+                            res.end();
+                            recordAuth(authEmitter);
+                        } else {
+                            recordFailure(ip);
+                            res.writeHead(401, { 'Content-Type': 'text/html; charset=utf-8' });
+                            res.end('Invalid Code. <a href="/">Try Again</a>');
+                        }
+                    } catch (e) {
+                        res.writeHead(401);
+                        res.end('Error verifying code');
+                    }
+                });
+                return;
+            }
+
+            // Show login page - with password field if enabled
+            const passwordFieldHtml = passwordRequired ? `
+                <div style="margin-bottom: 1.5rem;">
+                    <input type="password" name="password" id="passwordField" placeholder="Password"
+                        style="width: 100%; padding: 0.8rem 1rem; font-size: 1rem; border: 1px solid #e4e4e7; border-radius: 8px; background: #fff; color: #18181b; box-sizing: border-box;"
+                        required>
+                </div>
+                <p style="color: #71717a; margin-bottom: 1rem; font-size: 0.9rem;">Then enter your authenticator code:</p>
+            ` : '';
+
+            const passwordCheckJs = passwordRequired ? `
+                const passwordField = document.getElementById('passwordField');
+                if (!passwordField.value) {
+                    passwordField.focus();
+                    return;
+                }
+            ` : '';
+
+            const requestedDisplayName = sessionInfo?.displayName;
+            const requestedInternalName = requestedDisplayName
+                ? toInternalSessionName(requestedDisplayName)
+                : null;
+            const sessionFieldHtml = requestedInternalName
+                ? `<input type="hidden" name="session" value="${escapeHtml(requestedDisplayName)}">`
+                : '';
+
+            clearAuthCookies(res);
+            setNoCache(res);
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            res.end(`
+                <html>
+                    <head>
+                        <meta charset="UTF-8">
+                        <meta name="viewport" content="width=device-width, initial-scale=1">
+                        <title>Verify Identity</title>
+                        <style>
+                            body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; background: #fafafa; color: #18181b; display: flex; justify-content: center; align-items: center; height: 100vh; margin:0; }
+                            .box { text-align: center; max-width: 400px; padding: 2rem; }
+                            h2 { margin-bottom: 1.5rem; font-weight: 600; font-size: 1.5rem; }
+                            .code-inputs { display: flex; gap: 8px; justify-content: center; margin-bottom: 2rem; }
+                            .code-inputs input {
+                                width: 44px; height: 56px;
+                                font-size: 24px; text-align: center;
+                                border: 1px solid #e4e4e7; border-radius: 8px;
+                                background: #fff; color: #18181b;
+                                -moz-appearance: textfield;
+                            }
+                            .code-inputs input:focus { outline: none; border-color: #7c3aed; box-shadow: 0 0 0 2px rgba(124, 58, 237, 0.1); }
+                            .code-inputs input::-webkit-outer-spin-button,
+                            .code-inputs input::-webkit-inner-spin-button { -webkit-appearance: none; margin: 0; }
+                            input[type="password"]:focus { outline: none; border-color: #7c3aed; box-shadow: 0 0 0 2px rgba(124, 58, 237, 0.1); }
+
+                            button { font-size: 1rem; padding: 0.8rem 2.5rem; background: #18181b; color: #fff; border: none; border-radius: 8px; cursor: pointer; font-weight: 500; width: 100%; transition: opacity 0.2s; }
+                            button:hover { opacity: 0.9; }
+                            .hidden-submit { position: absolute; left: -9999px; }
+                        </style>
+                    </head>
+                    <body>
+                        <div class="box">
+                            <h2>Security Check</h2>
+                            ${passwordRequired ? '<p style="color: #71717a; margin-bottom: 1rem; font-size: 0.9rem;">Enter your password:</p>' : '<p style="color: #71717a; margin-bottom: 2rem; font-size: 0.9rem;">Please enter the verification code from your authenticator app to continue.</p>'}
+                            <form method="POST" id="authForm">
+                                ${passwordFieldHtml}
+                                ${sessionFieldHtml}
+                                <div class="code-inputs" id="inputs">
+                                    <input type="text" maxlength="1" inputmode="numeric" pattern="[0-9]*" required>
+                                    <input type="text" maxlength="1" inputmode="numeric" pattern="[0-9]*" required>
+                                    <input type="text" maxlength="1" inputmode="numeric" pattern="[0-9]*" required>
+                                    <input type="text" maxlength="1" inputmode="numeric" pattern="[0-9]*" required>
+                                    <input type="text" maxlength="1" inputmode="numeric" pattern="[0-9]*" required>
+                                    <input type="text" maxlength="1" inputmode="numeric" pattern="[0-9]*" required>
+                                </div>
+                                <input type="hidden" name="token" id="fullToken">
+                                <button type="submit">Verify</button>
+                            </form>
+                        </div>
+                        <script>
+                            const inputs = document.querySelectorAll('.code-inputs input');
+                            const form = document.getElementById('authForm');
+                            const hidden = document.getElementById('fullToken');
+
+                            inputs.forEach((input, i) => {
+                                input.addEventListener('input', e => {
+                                    if (e.target.value.length === 1) {
+                                        if (i < inputs.length - 1) inputs[i + 1].focus();
+                                        else submit();
+                                    }
+                                });
+                                input.addEventListener('keydown', e => {
+                                    if (e.key === 'Backspace' && !e.target.value && i > 0) {
+                                        inputs[i - 1].focus();
+                                    }
+                                });
+                                input.addEventListener('paste', e => {
+                                    e.preventDefault();
+                                    const text = (e.clipboardData || window.clipboardData).getData('text');
+                                    const digits = text.replace(/[^0-9]/g, '').slice(0, 6);
+                                    if (digits.length === 0) return;
+                                    digits.split('').forEach((char, index) => {
+                                        if (inputs[index]) inputs[index].value = char;
+                                    });
+                                    if (digits.length === 6) submit();
+                                    else inputs[Math.min(digits.length, 5)].focus();
+                                });
+                            });
+
+                            function submit() {
+                                ${passwordCheckJs}
+                                const code = Array.from(inputs).map(i => i.value).join('');
+                                if (code.length === 6) {
+                                    hidden.value = code;
+                                    form.submit();
+                                }
+                            }
+
+                            form.addEventListener('submit', e => {
+                                const code = Array.from(inputs).map(i => i.value).join('');
+                                hidden.value = code;
+                            });
+                        </script>
+                    </body>
+                </html>
+            `);
+            return;
+        }
+
+        // --- AUTHENTICATED ROUTES ---
+        const sessionInfoAuth = parseSessionFromRequest(req, parsedUrl);
+        const sessionName = sessionInfoAuth ? sessionInfoAuth.internalName : null;
+        const displayName = sessionInfoAuth ? sessionInfoAuth.displayName : null;
+        const strippedUrl = sessionInfoAuth ? sessionInfoAuth.strippedUrl : req.url;
+        const strippedPathname = sessionInfoAuth ? sessionInfoAuth.strippedPathname : (parsedUrl.pathname || '/');
+
+        if (sessionInfoAuth && sessionInfoAuth.source === 'query' && shouldRedirectToSessionPath(req)) {
+            res.writeHead(302, { 'Location': buildSessionPath(displayName) });
+            res.end();
+            return;
+        }
+        if (sessionInfoAuth && sessionInfoAuth.source === 'path' && sessionInfoAuth.needsSlash && shouldRedirectToSessionPath(req)) {
+            const target = buildSessionPath(displayName) + (parsedUrl.search || '');
+            res.writeHead(302, { 'Location': target });
+            res.end();
+            return;
+        }
+
+        // API: Ping (triggers auth event for mobile login)
+        if (parsedUrl.pathname === '/api/ping' && req.method === 'POST') {
+            recordAuth(authEmitter);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ok: true, message: 'Mobile login' }));
+            return;
+        }
+
+        // API: List sessions
+        if (parsedUrl.pathname === '/api/sessions' && req.method === 'GET') {
+            const sessions = listAllSessionEntries().map(s => ({
+                name: s.displayName,
+                displayName: s.displayName,
+                windows: s.windows,
+                attached: s.attached,
+                type: s.type,
+                port: s.port
+            }));
+            const activeSessionNames = Object.keys(activeSessions).map(toDisplaySessionName);
+            const startingSessionNames = Array.from(startingSessions).map(toDisplaySessionName);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ sessions, active: activeSessionNames, starting: startingSessionNames }));
+            return;
+        }
+
+        // API: Create session
+        if (parsedUrl.pathname === '/api/sessions' && req.method === 'POST') {
+            let body = '';
+            req.on('data', chunk => body += chunk);
+            req.on('end', () => {
+                try {
+                    let { name, type, port, cwd } = JSON.parse(body);
+                    const displayName = name;
+                    const internalName = toInternalSessionName(displayName);
+                    if (!internalName) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'Invalid session name' }));
+                        return;
+                    }
+                    type = (type || 'terminal').toLowerCase();
+                    if (type !== 'terminal' && type !== 'port') {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'Invalid session type' }));
+                        return;
+                    }
+                    if (type === 'port') {
+                        const parsedPort = parseInt(port, 10);
+                        if (!Number.isInteger(parsedPort) || parsedPort < 1 || parsedPort > 65535) {
+                            res.writeHead(400, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'Invalid port' }));
+                            return;
+                        }
+                        if (hopSessionExists(internalName)) {
+                            res.writeHead(409, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'Terminal session already exists with this name' }));
+                            return;
+                        }
+                        const existingConfig = getSessionConfig(internalName);
+                        if (existingConfig && existingConfig.type === 'terminal') {
+                            res.writeHead(409, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'Terminal session already exists with this name' }));
+                            return;
+                        }
+                        setPortSessionConfig(internalName, parsedPort);
+                    } else {
+                        const existingConfig = getSessionConfig(internalName);
+                        if (existingConfig && existingConfig.type === 'port') {
+                            res.writeHead(409, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'Port session already exists with this name' }));
+                            return;
+                        }
+                        getOrCreateSession(internalName, cwd);
+                    }
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ ok: true, name: displayName, type }));
+                } catch (e) {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Invalid request body' }));
+                }
+            });
+            return;
+        }
+
+        // API: Rename session
+        if (parsedUrl.pathname === '/api/sessions/rename' && req.method === 'POST') {
+            let body = '';
+            req.on('data', chunk => body += chunk);
+            req.on('end', () => {
+                let { oldName, newName } = JSON.parse(body);
+                const oldDisplayName = oldName;
+                const newDisplayName = newName;
+                oldName = toInternalSessionName(oldDisplayName);
+                newName = toInternalSessionName(newDisplayName);
+                // Validate BOTH names to prevent command injection
+                if (!oldName) {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Invalid old name' }));
+                    return;
+                }
+                if (!newName) {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Invalid new name' }));
+                    return;
+                }
+                if (getSessionConfig(newName) || hopSessionExists(newName)) {
+                    res.writeHead(409, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Session name already in use' }));
+                    return;
+                }
+
+                // Update config for rename
+                try {
+                    const config = getSessionConfig(oldName);
+                    if (config && config.type === 'port') {
+                        deleteSessionConfig(oldName);
+                        setSessionConfig(newName, { ...config, updatedAt: new Date().toISOString() });
+                    } else {
+                        if (!hopSessionExists(oldName)) {
+                            res.writeHead(404, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: 'Session not found' }));
+                            return;
+                        }
+                        // Note: hay rooms can't be renamed - just update config tracking
+                        if (config) {
+                            deleteSessionConfig(oldName);
+                            setSessionConfig(newName, { ...config, type: 'terminal', updatedAt: new Date().toISOString() });
+                        } else {
+                            deleteSessionConfig(oldName);
+                            ensureTerminalSessionConfig(newName);
+                        }
+                    }
+
+                    // Update internal map if it's managed by us
+                    if (activeSessions[oldName]) {
+                        activeSessions[newName] = activeSessions[oldName];
+                        delete activeSessions[oldName];
+                    }
+
+                    // Track rename so styling intervals can follow
+                    sessionRenames[oldName] = newName;
+
+                    // Rename log/exit files if they exist (optional cleanup)
+
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ ok: true }));
+                } catch (e) {
+                    res.writeHead(500, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Rename failed' }));
+                }
+            });
+            return;
+        }
+
+        // API: Delete session
+        if (parsedUrl.pathname === '/api/sessions/delete' && req.method === 'POST') {
+            let body = '';
+            req.on('data', chunk => body += chunk);
+            req.on('end', () => {
+                let { name } = JSON.parse(body);
+                name = toInternalSessionName(name);
+                // Validate name to prevent command injection
+                if (!name) {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Invalid session name' }));
+                    return;
+                }
+
+                try {
+                    const config = getSessionConfig(name);
+                    if (config && config.type === 'port') {
+                        deleteSessionConfig(name);
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ ok: true }));
+                        return;
+                    }
+
+                    const exists = hopSessionExists(name);
+                    if (!exists && !config) {
+                        res.writeHead(404, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'Session not found' }));
+                        return;
+                    }
+
+                    // Close the hay room if it exists
+                    if (hayRooms.hasRoom(name)) {
+                        hayRooms.closeRoom(name);
+                    }
+
+                    // Clean up internal tracking
+                    if (activeSessions[name]) {
+                        delete activeSessions[name];
+                    }
+
+                    // Always remove session config if present
+                    if (config) {
+                        deleteSessionConfig(name);
+                    }
+
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ ok: true }));
+                } catch (e) {
+                    res.writeHead(500, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Delete failed' }));
+                }
+            });
+            return;
+        }
+
+        // If no session selected, show session picker
+        if (parsedUrl.pathname === '/sessions') {
+            const sessionsFile = path.join(__dirname, 'sessions.html');
+            let sessionsHtml = '<!-- sessions.html not found -->';
+            try {
+                sessionsHtml = fs.readFileSync(sessionsFile, 'utf8');
+            } catch (e) {
+                log(`Warning: sessions.html not found`, YELLOW);
+            }
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            res.end(sessionsHtml);
+            return;
+        }
+        if (!sessionName) {
+            const sessionsFile = path.join(__dirname, 'sessions.html');
+            let sessionsHtml = '<!-- sessions.html not found -->';
+            try {
+                sessionsHtml = fs.readFileSync(sessionsFile, 'utf8');
+            } catch (e) {
+                log(`Warning: sessions.html not found`, YELLOW);
+            }
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            res.end(sessionsHtml);
+            return;
+        }
+        // --- CHECK FOR iOS - Intercept and inject virtual keyboard ---
+        const userAgent = req.headers['user-agent'] || '';
+        const isIOS = /iPad|iPhone|iPod/.test(userAgent);
+        const isMobile = isIOS || /Android/i.test(userAgent);
+        const sessionConfig = getSessionConfig(sessionName);
+        if (sessionConfig && sessionConfig.type === 'port') {
+            const targetPort = sessionConfig.port;
+            if (!targetPort) {
+                res.writeHead(500);
+                res.end('Port session missing target port.');
+                return;
+            }
+            const shouldInject = isMobile && shouldInjectSessionSwitcher(req);
+            if (shouldInject) {
+                waitForPort(targetPort).then((ready) => {
+                    if (!ready) {
+                        sendStartingPage(res, displayName);
+                        return;
+                    }
+                    const headers = { ...req.headers };
+                    delete headers['accept-encoding'];
+                    const proxyReq = http.request({
+                        hostname: '127.0.0.1',
+                        port: targetPort,
+                        method: req.method,
+                        path: strippedUrl,
+                        headers
+                    }, (proxyRes) => {
+                        const contentType = String(proxyRes.headers['content-type'] || '').toLowerCase();
+                        const contentEncoding = String(proxyRes.headers['content-encoding'] || '').toLowerCase();
+                        const isHtml = contentType.includes('text/html');
+                        const isPlain = contentType.includes('text/plain');
+                        const canModify = (isHtml || isPlain) && (!contentEncoding || contentEncoding === 'identity');
+                        if (!canModify) {
+                            res.writeHead(proxyRes.statusCode || 200, proxyRes.headers);
+                            proxyRes.pipe(res);
+                            return;
+                        }
+                        let chunks = [];
+                        proxyRes.on('data', chunk => chunks.push(chunk));
+                        proxyRes.on('end', () => {
+                            let html = Buffer.concat(chunks).toString('utf8');
+                            const overlay = getSessionSwitcherOverlay();
+                            if (isPlain && !html.includes('<html')) {
+                                const body = `<pre style="white-space:pre-wrap;font:14px/1.4 ui-monospace,Menlo,Monaco,Consolas,monospace;margin:24px;color:#18181b;">${escapeHtml(html)}</pre>`;
+                                html = `<!DOCTYPE html><html><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"></head><body>${body}${overlay}</body></html>`;
+                            } else if (html.includes('</body>')) {
+                                html = html.split('</body>').join(overlay + '</body>');
+                            } else {
+                                html += overlay;
+                            }
+                            const outHeaders = { ...proxyRes.headers };
+                            delete outHeaders['content-length'];
+                            delete outHeaders['content-encoding'];
+                            if (isPlain) {
+                                outHeaders['content-type'] = 'text/html; charset=utf-8';
+                            }
+                            res.writeHead(proxyRes.statusCode || 200, outHeaders);
+                            res.end(html);
+                        });
+                    });
+                    proxyReq.on('error', () => {
+                        sendStartingPage(res, displayName);
+                    });
+                    req.pipe(proxyReq);
+                });
+                return;
+            }
+
+            waitForPort(targetPort).then((ready) => {
+                if (!ready) {
+                    sendStartingPage(res, displayName);
+                    return;
+                }
+                const proxy = httpProxy.createProxyServer({ target: `http://127.0.0.1:${targetPort}`, ws: false });
+                const originalUrl = req.url;
+                req.url = strippedUrl;
+                proxy.web(req, res, {}, () => {
+                    sendStartingPage(res, displayName);
+                });
+                req.url = originalUrl;
+            });
+            return;
+        }
+
+        // Ensure session exists (creates hay room if needed)
+        try {
+            getOrCreateSession(sessionName);
+        } catch (e) {
+            res.writeHead(500);
+            res.end('Failed to create session');
+            return;
+        }
+
+        // Serve hay web client (has built-in mobile keyboard)
+        const reqPath = strippedPathname || '/';
+
+        // Map request path to file
+        let filePath;
+        if (reqPath === '/' || reqPath === '') {
+            filePath = path.join(HAY_WEB_DIR, 'index.html');
+        } else if (reqPath.startsWith('/assets/')) {
+            filePath = path.join(HAY_WEB_DIR, reqPath);
+        } else {
+            // Fallback to index.html for SPA routing
+            filePath = path.join(HAY_WEB_DIR, 'index.html');
+        }
+
+        // Check if file exists
+        if (!fs.existsSync(filePath)) {
+            res.writeHead(404);
+            res.end('Not Found');
+            return;
+        }
+
+        // Determine content type
+        const ext = path.extname(filePath).toLowerCase();
+        const contentTypes = {
+            '.html': 'text/html; charset=utf-8',
+            '.js': 'application/javascript',
+            '.css': 'text/css',
+            '.json': 'application/json',
+            '.png': 'image/png',
+            '.jpg': 'image/jpeg',
+            '.svg': 'image/svg+xml',
+            '.ico': 'image/x-icon'
+        };
+        const contentType = contentTypes[ext] || 'application/octet-stream';
+
+        // Read and serve the file
+        let content = fs.readFileSync(filePath);
+
+        // For HTML files, inject config and fix asset paths
+        if (ext === '.html') {
+            let html = content.toString('utf8');
+            const sessionBasePath = `/s/${displayName}/`;
+
+            // Inject hop session configuration
+            const injectScript = `<script>
+                // Hop session configuration - use /ws endpoint with room as query param
+                window.__HOP_SESSION__ = ${JSON.stringify({
+                    room: displayName,
+                    name: 'Guest',
+                    wsUrl: '/ws'
+                })};
+            </script>`;
+            html = html.replace('<head>', '<head>' + injectScript);
+
+            // Convert absolute asset paths to relative (remove leading /)
+            html = html.replace(/src="\/assets\//g, 'src="assets/');
+            html = html.replace(/href="\/assets\//g, 'href="assets/');
+
+            content = Buffer.from(html, 'utf8');
+        }
+
+        // No caching in dev mode (when serving from hay)
+        const isDevMode = !HAY_WEB_DIR.includes('hay-web');
+        const headers = {
+            'Content-Type': contentType,
+            'Content-Length': content.length
+        };
+        if (isDevMode) {
+            headers['Cache-Control'] = 'no-cache, no-store, must-revalidate';
+            headers['Pragma'] = 'no-cache';
+            headers['Expires'] = '0';
+        }
+        res.writeHead(200, headers);
+        res.end(content);
+    });
+
+    // WebSocket upgrade for terminal
+    server.on('upgrade', (req, socket, head) => {
+        const parsedUrl = url.parse(req.url, true);
+        const cookies = cookie.parse(req.headers.cookie || '');
+
+        // Auth via cookie, Bearer token, or query param (for local CLI connections)
+        const authHeader = req.headers.authorization || '';
+        const bearerToken = authHeader.startsWith('Bearer ') ? authHeader.slice(7) : null;
+        const tokenFromQuery = parsedUrl.query.token;
+        const isAuthenticated = cookies[SESSION_COOKIE_NAME] === SESSION_SECRET ||
+                               bearerToken === SESSION_SECRET ||
+                               tokenFromQuery === SESSION_SECRET;
+
+        if (!isAuthenticated) {
+            socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
+            socket.destroy();
+            return;
+        }
+
+        // Support both /ws?room=X (hay CLI format) and /s/{session}/ws (legacy)
+        let sessionName = null;
+        let sessionInfo = null;
+
+        if (parsedUrl.pathname === '/ws') {
+            // Hay CLI format: /ws?room=X
+            const roomParam = parsedUrl.query.room;
+            if (roomParam && typeof roomParam === 'string') {
+                sessionName = toInternalSessionName(roomParam);
+            }
+        } else {
+            // Legacy format: /s/{session}/ws
+            sessionInfo = parseSessionFromRequest(req, parsedUrl);
+            sessionName = sessionInfo ? sessionInfo.internalName : null;
+        }
+
+        if (!sessionName) {
+            socket.write('HTTP/1.1 404 Session Not Found\r\n\r\n');
+            socket.destroy();
+            return;
+        }
+
+        const sessionConfig = getSessionConfig(sessionName);
+        if (sessionConfig && sessionConfig.type === 'port') {
+            const targetPort = sessionConfig.port;
+            if (!targetPort) {
+                socket.write('HTTP/1.1 502 Bad Gateway\r\n\r\n');
+                socket.destroy();
+                return;
+            }
+            const proxy = httpProxy.createProxyServer({ target: `http://127.0.0.1:${targetPort}`, ws: true });
+            const originalUrl = req.url;
+            req.url = sessionInfo ? sessionInfo.strippedUrl : req.url;
+            proxy.ws(req, socket, head);
+            req.url = originalUrl;
+            return;
+        }
+
+        // Get or create hay session
+        let session = activeSessions[sessionName];
+        if (!session) {
+            try {
+                session = getOrCreateSession(sessionName);
+            } catch (e) {
+                socket.write('HTTP/1.1 500 Server Error\r\n\r\n');
+                socket.destroy();
+                return;
+            }
+        }
+
+        // Create WebSocket server for this upgrade
+        const wss = new WebSocket.Server({ noServer: true });
+        wss.handleUpgrade(req, socket, head, (ws) => {
+            // Parse query params for client info
+            const wsUrl = new URL(req.url, 'http://localhost');
+            const clientName = hay.sanitizeName(wsUrl.searchParams.get('name') || 'Anonymous');
+            const cols = parseInt(wsUrl.searchParams.get('cols') || '80', 10);
+            const rows = parseInt(wsUrl.searchParams.get('rows') || '24', 10);
+
+            const clientId = hay.generateClientId();
+            const colorIndex = Math.floor(Math.random() * 1000);
+
+            // Attach client to hay room
+            session.room.attachClient(
+                { id: clientId, name: clientName, colorIndex, cols, rows },
+                hay.createSocketAdapter(ws)
+            );
+        });
+    });
+
+    server.listen(PROXY_PORT, '127.0.0.1');
+    return server;
+}
+
+// Tunnel manager - handles auto-restart and URL updates
+let currentTunnelProc = null;
+let currentPublicUrl = null;
+let shuttingDown = false;  // Prevent restart during cleanup
+const tunnelEmitter = new EventEmitter();
+let CLIENT_TUNNEL_CONFIG = null; // { tunnelId, credentialsPath, hostname, configDir }
+
+function startTunnel(isRestart = false) {
+    const domainConfig = getDomainConfig();
+    const useNamedTunnel = domainConfig && domainConfig.tunnelName && domainConfig.hostname;
+
+    if (!isRestart) {
+        if (useNamedTunnel) {
+            log(`[3/4] Opening Cloudflare Tunnel (${domainConfig.hostname})...`, BOLD);
+        } else {
+            log(`[3/4] Opening Cloudflare Tunnel...`, BOLD);
+        }
+    } else {
+        log(`[Tunnel] Reconnecting...`, YELLOW);
+    }
+
+    // Use named tunnel if configured, otherwise quick tunnel
+    let tunnel;
+    let publicUrl;
+
+    const localTunnelHost = '127.0.0.1';
+
+    if (useNamedTunnel) {
+        // Named tunnel with custom domain - URL is fixed
+        publicUrl = `https://${domainConfig.hostname}`;
+
+        // Create config file for the tunnel
+        const tunnelConfigPath = path.join(HOME_DIR, '.tunnel-config.yml');
+        const tunnelConfig = `
+url: http://${localTunnelHost}:${PROXY_PORT}
+tunnel: ${domainConfig.tunnelName}
+`;
+        fs.writeFileSync(tunnelConfigPath, tunnelConfig);
+
+        tunnel = spawn('cloudflared', [
+            'tunnel',
+            '--config', tunnelConfigPath,
+            'run', domainConfig.tunnelName
+        ]);
+    } else {
+        // Quick tunnel - URL is random
+        tunnel = spawn('cloudflared', ['tunnel', '--url', `http://${localTunnelHost}:${PROXY_PORT}`]);
+    }
+
+    tunnel.on('close', (code) => {
+        if (shuttingDown) return;  // Don't restart during cleanup
+        if (code !== null) {
+            log(`[Tunnel] Disconnected (code ${code}). Restarting in 3s...`, YELLOW);
+            setTimeout(() => {
+                if (!shuttingDown) startTunnelWithRestart();
+            }, 3000);
+        }
+    });
+
+    tunnel.on('error', (err) => {
+        if (shuttingDown) return;  // Don't restart during cleanup
+        log(`[Tunnel] Error: ${err.message}. Restarting in 3s...`, RED);
+        setTimeout(() => {
+            if (!shuttingDown) startTunnelWithRestart();
+        }, 3000);
+    });
+
+    // For named tunnels, resolve immediately with the known URL
+    if (useNamedTunnel) {
+        currentTunnelProc = tunnel;
+        currentPublicUrl = publicUrl;
+
+        // Wait a moment for tunnel to establish, then resolve
+        return new Promise((resolve) => {
+            let resolved = false;
+
+            // Listen for successful connection or error
+            tunnel.stderr.on('data', (data) => {
+                const output = data.toString();
+                // Look for connection established message
+                if (!resolved && (output.includes('Registered tunnel connection') || output.includes('Connection'))) {
+                    resolved = true;
+                    if (isRestart) {
+                        tunnelEmitter.emit('urlChanged', publicUrl);
+                        log(`[Tunnel] Reconnected: ${publicUrl}`, GREEN);
+                    }
+                    resolve({ tunnel, publicUrl });
+                }
+            });
+
+            // Timeout fallback - assume connected after 5 seconds
+            setTimeout(() => {
+                if (!resolved) {
+                    resolved = true;
+                    if (isRestart) {
+                        tunnelEmitter.emit('urlChanged', publicUrl);
+                    }
+                    resolve({ tunnel, publicUrl });
+                }
+            }, 5000);
+        });
+    }
+
+    // For quick tunnels, parse URL from output
+    let urlFound = false;
+    return new Promise((resolve) => {
+        tunnel.stderr.on('data', (data) => {
+            if (urlFound) return;
+            const output = data.toString();
+            const match = output.match(/https:\/\/[a-zA-Z0-9-]+\.trycloudflare\.com/);
+
+            if (match) {
+                const parsedUrl = match[0];
+                if (parsedUrl.includes('api.trycloudflare.com')) return;
+
+                urlFound = true;
+                currentTunnelProc = tunnel;
+                currentPublicUrl = parsedUrl;
+
+                // Emit URL change event for restarts
+                if (isRestart) {
+                    tunnelEmitter.emit('urlChanged', parsedUrl);
+                    log(`[Tunnel] New URL: ${parsedUrl}`, GREEN);
+                }
+
+                resolve({ tunnel, publicUrl: parsedUrl });
+            }
+        });
+    });
+}
+
+function startClientTunnel(isRestart = false) {
+    if (!CLIENT_TUNNEL_CONFIG) {
+        throw new Error('Client tunnel config missing');
+    }
+
+    const { tunnelId, credentialsPath, hostname, configDir } = CLIENT_TUNNEL_CONFIG;
+    const publicUrl = hostname ? `https://${hostname}` : null;
+
+    if (!isRestart) {
+        log(`[3/4] Opening Cloudflare Tunnel${hostname ? ` (${hostname})` : ''}...`, BOLD);
+    } else {
+        log(`[Tunnel] Reconnecting...`, YELLOW);
+    }
+
+    const tunnelConfigPath = path.join(configDir, 'tunnel-config.yml');
+    const tunnelConfig = `
+url: http://127.0.0.1:${PROXY_PORT}
+tunnel: ${tunnelId}
+credentials-file: ${path.resolve(credentialsPath)}
+`;
+    writePrivateFile(tunnelConfigPath, tunnelConfig);
+
+    const tunnel = spawn('cloudflared', ['tunnel', '--config', tunnelConfigPath, 'run'], {
+        stdio: ['ignore', 'pipe', 'pipe']
+    });
+
+    tunnel.on('close', (code) => {
+        if (shuttingDown) return;  // Don't restart during cleanup
+        if (code !== null) {
+            log(`[Tunnel] Disconnected (code ${code}). Restarting in 3s...`, YELLOW);
+            setTimeout(() => {
+                if (!shuttingDown) startTunnelWithRestart();
+            }, 3000);
+        }
+    });
+
+    tunnel.on('error', (err) => {
+        if (shuttingDown) return;  // Don't restart during cleanup
+        log(`[Tunnel] Error: ${err.message}. Restarting in 3s...`, RED);
+        setTimeout(() => {
+            if (!shuttingDown) startTunnelWithRestart();
+        }, 3000);
+    });
+
+    currentTunnelProc = tunnel;
+    currentPublicUrl = publicUrl;
+
+    return new Promise((resolve) => {
+        let resolved = false;
+
+        tunnel.stderr.on('data', (data) => {
+            const output = data.toString();
+            if (!resolved && (output.includes('Registered tunnel connection') || output.includes('Connection'))) {
+                resolved = true;
+                if (isRestart) {
+                    if (publicUrl) {
+                        tunnelEmitter.emit('urlChanged', publicUrl);
+                        log(`[Tunnel] Reconnected: ${publicUrl}`, GREEN);
+                    } else {
+                        log(`[Tunnel] Reconnected.`, GREEN);
+                    }
+                }
+                resolve({ tunnel, publicUrl });
+            }
+        });
+
+        // Timeout fallback - assume connected after 5 seconds
+        setTimeout(() => {
+            if (!resolved) {
+                resolved = true;
+                if (isRestart && publicUrl) {
+                    tunnelEmitter.emit('urlChanged', publicUrl);
+                }
+                resolve({ tunnel, publicUrl });
+            }
+        }, 5000);
+    });
+}
+
+async function startTunnelWithRestart() {
+    try {
+        const { tunnel, publicUrl } = CLIENT_TUNNEL_CONFIG
+            ? await startClientTunnel(true)
+            : await startTunnel(true);
+
+        // Update state file
+        if (fs.existsSync(STATE_FILE)) {
+            try {
+                const state = JSON.parse(fs.readFileSync(STATE_FILE, 'utf8'));
+                state.url = publicUrl;
+                writePrivateFile(STATE_FILE, JSON.stringify(state));
+            } catch (e) { }
+        }
+
+        // Sessions are managed by hay, no tmux styling needed
+    } catch (e) {
+        log(`[Tunnel] Failed to restart: ${e.message}. Retrying in 5s...`, RED);
+        setTimeout(startTunnelWithRestart, 5000);
+    }
+}
+
+function waitForStart(authEmitter, publicUrl, label) {
+    return new Promise((resolve) => {
+        console.clear();
+        log(`\n==================================================`, MAGENTA);
+        log(`            >>>  HOP - TUNNEL SHELL  <<<`, BOLD + MAGENTA);
+        log(`==================================================\n`, MAGENTA);
+
+        log(`TUNNEL URL:`, BOLD + GREEN);
+        log(`  ${publicUrl}`, GREEN);
+        log(`  Scan to open on mobile:`, RESET);
+
+        // Simple URL QR code - scan with any camera app
+        qrcode.generate(publicUrl, { small: true });
+
+        log(`\n--------------------------------------------------`, RESET);
+
+        // Standardized TOTP QR Code using the helper function
+        showQrCode(label || 'Hop');
+
+        log(`\n--------------------------------------------------`, RESET);
+
+        const readline = require('readline');
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+
+        log(`\n[READY]`, GREEN + BOLD);
+        log(`Press ENTER to launch local session, or login remotely...`, RESET);
+
+        let resolved = false;
+
+        const finish = (reason) => {
+            if (resolved) return;
+            resolved = true;
+            rl.close();
+            log(`\n${reason}. Launching local session...`, GREEN);
+            setTimeout(resolve, 800);
+        };
+
+        rl.question('', () => finish('Manual Start'));
+        authEmitter.once('authenticated', () => finish('Remote Login'));
+    });
+}
+
+function printStartupInfo(publicUrl, label) {
+    console.clear();
+    log(`\n==================================================`, MAGENTA);
+    log(`            >>>  HOP - TUNNEL SHELL  <<<`, BOLD + MAGENTA);
+    log(`==================================================\n`, MAGENTA);
+
+    log(`TUNNEL URL:`, BOLD + GREEN);
+    log(`  ${publicUrl}`, GREEN);
+    log(`  Scan to open on mobile:`, RESET);
+
+    qrcode.generate(publicUrl, { small: true });
+
+    log(`\n--------------------------------------------------`, RESET);
+    showQrCode(label || 'Hop');
+    log(`\n--------------------------------------------------`, RESET);
+    log(`\n[READY]`, GREEN + BOLD);
+    log(`Daemon started. Run ${CYAN}hop${RESET} to attach a local session.`, RESET);
+}
+
+function waitForStartPolling(state, label) {
+    return new Promise((resolve) => {
+        console.clear();
+        log(`\n==================================================`, MAGENTA);
+        log(`            >>>  HOP - TUNNEL SHELL  <<<`, BOLD + MAGENTA);
+        log(`==================================================\n`, MAGENTA);
+
+        log(`TUNNEL URL:`, BOLD + GREEN);
+        log(`  ${state.url}`, GREEN);
+        log(`  Scan to open on mobile:`, RESET);
+        qrcode.generate(state.url, { small: true });
+
+        log(`\n--------------------------------------------------`, RESET);
+        showQrCode(label || 'Hop');
+        log(`\n--------------------------------------------------`, RESET);
+
+        const readline = require('readline');
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+
+        log(`\n[READY]`, GREEN + BOLD);
+        log(`Press ENTER to launch local session, or login remotely...`, RESET);
+
+        let resolved = false;
+        const startedAt = Date.now();
+        let pollTimer = null;
+
+        const finish = (reason) => {
+            if (resolved) return;
+            resolved = true;
+            if (pollTimer) clearInterval(pollTimer);
+            rl.close();
+            log(`\n${reason}. Launching local session...`, GREEN);
+            setTimeout(resolve, 800);
+        };
+
+        rl.question('', () => finish('Manual Start'));
+
+        const poll = () => {
+            if (resolved) return;
+            const opts = {
+                hostname: '127.0.0.1',
+                port: state.port,
+                path: '/api/auth',
+                method: 'GET',
+                headers: { 'Authorization': `Bearer ${state.sessionSecret}` }
+            };
+            const req = http.request(opts, res => {
+                let data = '';
+                res.on('data', c => data += c);
+                res.on('end', () => {
+                    if (res.statusCode !== 200) return;
+                    try {
+                        const payload = JSON.parse(data);
+                        if (payload.lastAuthAt && payload.lastAuthAt >= startedAt) {
+                            finish('Remote Login');
+                        }
+                    } catch (e) { }
+                });
+            });
+            req.on('error', () => { });
+            req.end();
+        };
+
+        pollTimer = setInterval(poll, 1000);
+        poll();
+    });
+}
+
+// Generate QR code and prompt for verification
+function showQrCode(label = 'Hop') {
+    log(`[3/4] Setup Authenticator...`, BOLD);
+
+    // Manually construct URL for minimalist "Hop" label without username
+    const otpauth = `otpauth://totp/${encodeURIComponent(label)}?secret=${AUTH_SECRET}&issuer=${encodeURIComponent(label)}`;
+
+    qrcode.generate(otpauth, { small: true });
+
+    log(`Scan this QR code with your Authenticator app.`, CYAN);
+}
+
+function startDaemon() {
+    const node = process.execPath;
+    const script = __filename;
+    const child = spawn(node, [script, '--daemon'], {
+        detached: true,
+        stdio: 'ignore',
+        env: process.env
+    });
+    child.unref();
+}
+
+function waitForDaemonReady(timeoutMs = 20000) {
+    return new Promise((resolve, reject) => {
+        const start = Date.now();
+        const check = () => {
+            const state = isServerRunning();
+            if (state) return resolve(state);
+            if (Date.now() - start > timeoutMs) {
+                return reject(new Error('Timed out waiting for hop daemon'));
+            }
+            setTimeout(check, 250);
+        };
+        check();
+    });
+}
+
+async function startLocalSession(proxyServer, tunnelProc, publicUrl) {
+    log(`[4/4] Attaching to session...`, BOLD);
+
+    // Check if there's already an active session (from remote login)
+    const existingSessions = listActiveSessions();
+    let displayName;
+    let defaultSessionName;
+
+    let sessionCwd;
+    if (existingSessions.length > 0) {
+        // Connect to the first existing session (remote user already created it)
+        defaultSessionName = existingSessions[0].name;
+        displayName = toDisplaySessionName(defaultSessionName);
+        log(`Connecting to existing session: ${displayName}`, RESET);
+    } else {
+        // Create new session - find next available name
+        const cwdName = path.basename(process.cwd()).replace(/[^a-zA-Z0-9_-]/g, '-');
+        const existingNames = new Set(existingSessions.map(s => s.name));
+        let counter = 1;
+        displayName = `${cwdName}-${counter}`;
+        defaultSessionName = toInternalSessionName(displayName);
+        while (existingNames.has(defaultSessionName)) {
+            counter++;
+            displayName = `${cwdName}-${counter}`;
+            defaultSessionName = toInternalSessionName(displayName);
+        }
+        log(`Starting session: ${displayName}`, RESET);
+        sessionCwd = process.cwd();
+        getOrCreateSession(defaultSessionName, sessionCwd);
+    }
+
+    const cleanup = () => {
+        if (shuttingDown) return;
+        shuttingDown = true;  // Prevent tunnel auto-restart
+        log(`Cleaning up...`, YELLOW);
+
+        // Remove state file
+        if (fs.existsSync(STATE_FILE)) {
+            try { fs.unlinkSync(STATE_FILE); } catch (e) { }
+        }
+
+        // Remove session config for this local session
+        try {
+            const config = getSessionConfig(defaultSessionName);
+            if (config && config.type !== 'port') {
+                deleteSessionConfig(defaultSessionName);
+            }
+        } catch (e) { }
+
+        // Close all hay rooms
+        hayRooms.closeAll();
+
+        // Kill cloudflared tunnel (use currentTunnelProc in case it was restarted)
+        try { (currentTunnelProc || tunnelProc).kill('SIGTERM'); } catch (e) { }
+
+        // Close proxy server
+        try { proxyServer.close(); } catch (e) { }
+
+        log(`Goodbye!`, GREEN);
+        process.exit(0);
+    };
+
+    const runLocalSessionLoop = () => {
+        return new Promise((resolve) => {
+            // Ensure session exists on server
+            getOrCreateSession(defaultSessionName, sessionCwd);
+
+            // Spawn hay CLI to connect to the session
+            const hayCli = resolveHayCliPath();
+            const wsUrl = `ws://127.0.0.1:${BASE_PORT}/ws?token=${SESSION_SECRET}`;
+
+            const cliProc = spawn('node', [hayCli, '-s', wsUrl, '-r', displayName, '-n', 'Local'], {
+                stdio: 'inherit',
+                env: { ...process.env, FORCE_COLOR: '1', HAY_SHARE_URL: publicUrl || '' }
+            });
+
+            cliProc.on('close', (code) => {
+                resolve(code);
+            });
+
+            cliProc.on('error', (err) => {
+                log(`Failed to start hay CLI: ${err.message}`, RED);
+                resolve(1);
+            });
+        });
+    };
+
+    runLocalSessionLoop().then((code) => {
+        // Ctrl+D (detach) exits hay CLI with code 10; keep tunnel alive.
+        if (code === 10) {
+            log(`\nDetached from local session. Tunnel is still running.`, YELLOW);
+            log(`Press Ctrl+C to shut down.`, RESET);
+            return;
+        }
+        log(`\nLocal session ended. Shutting down tunnel...`, YELLOW);
+        cleanup();
+    });
+
+    process.on('SIGINT', cleanup);
+    process.on('SIGTERM', cleanup);
+    process.on('exit', cleanup);
+}
+
+async function attachToExistingTunnel(existingTunnel) {
+    log(`Hop tunnel is already running!`, GREEN);
+    log(`URL: ${existingTunnel.url}`, BOLD);
+
+    // Generate smart session name: dir-N
+    const cwdName = path.basename(process.cwd()).replace(/[^a-zA-Z0-9_-]/g, '-');
+    let displayName = `${cwdName}-1`;
+    let sessionName = toInternalSessionName(displayName);
+
+    log(`\nFinding next available session...`, RESET);
+
+    try {
+        // Get existing sessions first
+        const sessionsRes = await new Promise((resolve, reject) => {
+            const opts = {
+                hostname: '127.0.0.1',
+                port: existingTunnel.port,
+                path: '/api/sessions',
+                method: 'GET',
+                headers: { 'Authorization': `Bearer ${existingTunnel.sessionSecret}` }
+            };
+            http.get(opts, res => {
+                let data = '';
+                res.on('data', c => data += c);
+                res.on('end', () => resolve(JSON.parse(data)));
+            }).on('error', reject);
+        });
+
+        // Find next available number
+        if (sessionsRes && sessionsRes.sessions && sessionsRes.active) {
+            const allNames = new Set([...sessionsRes.active, ...sessionsRes.sessions.map(s => s.name)]);
+            let counter = 1;
+            while (allNames.has(`${cwdName}-${counter}`)) {
+                counter++;
+            }
+            displayName = `${cwdName}-${counter}`;
+            sessionName = toInternalSessionName(displayName);
+        }
+
+        log(`Creating new session: ${displayName}...`, RESET);
+
+        // Register session with local server
+        const res = await new Promise((resolve, reject) => {
+            const opts = {
+                hostname: '127.0.0.1',
+                port: existingTunnel.port,
+                path: '/api/sessions',
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Authorization': `Bearer ${existingTunnel.sessionSecret}`
+                }
+            };
+
+            const req = http.request(opts, (response) => {
+                let data = '';
+                response.on('data', c => data += c);
+                response.on('end', () => {
+                    try {
+                        resolve(JSON.parse(data));
+                    } catch (e) {
+                        // Server returned non-JSON (likely HTML login page)
+                        reject(new Error(`Server returned non-JSON (status ${response.statusCode})`));
+                    }
+                });
+            });
+
+            req.on('error', reject);
+            req.write(JSON.stringify({ name: displayName, cwd: process.cwd() }));
+            req.end();
+        });
+
+        if (!res.ok && !res.success) throw new Error(res.error || 'Failed to create session');
+
+    } catch (e) {
+        log(`Note: Could not register session with server: ${e.message}`, YELLOW);
+        log(`Session will still work locally.`, RESET);
+    }
+
+    log(`Attaching to ${displayName}...`, RESET);
+
+    // Spawn hay CLI to connect to session
+    const hayCli = resolveHayCliPath();
+    const wsUrl = `ws://127.0.0.1:${existingTunnel.port}/ws?token=${existingTunnel.sessionSecret}`;
+
+    const cliProc = spawn('node', [hayCli, '-s', wsUrl, '-r', displayName, '-n', 'Local'], {
+        stdio: 'inherit',
+        env: { ...process.env, FORCE_COLOR: '1', HAY_SHARE_URL: existingTunnel.url || '' }
+    });
+
+    cliProc.on('close', (code) => {
+        if (code === 10) {
+            log(`\nDetached from local session.`, YELLOW);
+            process.exit(0);
+        }
+        log(`\nSession disconnected.`, YELLOW);
+        process.exit(code || 0);
+    });
+
+    cliProc.on('error', (err) => {
+        log(`\nConnection error: ${err.message}`, RED);
+        process.exit(1);
+    });
+
+    // Wait indefinitely (process will exit when CLI closes)
+    await new Promise(() => {});
+}
+
+async function fetchSessionList(existingTunnel) {
+    const sessionsRes = await new Promise((resolve, reject) => {
+        const opts = {
+            hostname: '127.0.0.1',
+            port: existingTunnel.port,
+            path: '/api/sessions',
+            method: 'GET',
+            headers: { 'Authorization': `Bearer ${existingTunnel.sessionSecret}` }
+        };
+        http.get(opts, res => {
+            let data = '';
+            res.on('data', c => data += c);
+            res.on('end', () => {
+                try {
+                    resolve(JSON.parse(data));
+                } catch (e) {
+                    reject(new Error('Failed to parse sessions response'));
+                }
+            });
+        }).on('error', reject);
+    });
+    return sessionsRes || {};
+}
+
+function pickSessionForDir(sessions, cwdName) {
+    const prefix = `${cwdName}-`;
+    const matches = sessions
+        .filter(s => s.type !== 'port')
+        .filter(s => s.displayName === cwdName || s.displayName.startsWith(prefix));
+    if (matches.length === 0) return null;
+    const scored = matches.map(s => {
+        let score = Number.MAX_SAFE_INTEGER;
+        if (s.displayName === cwdName) {
+            score = 0;
+        } else if (s.displayName.startsWith(prefix)) {
+            const suffix = s.displayName.slice(prefix.length);
+            const num = parseInt(suffix, 10);
+            if (Number.isFinite(num)) score = num;
+        }
+        return { session: s, score };
+    });
+    scored.sort((a, b) => a.score - b.score || a.session.displayName.localeCompare(b.session.displayName));
+    return scored[0].session;
+}
+
+async function attachToNamedSession(existingTunnel, displayName) {
+    const sessionsRes = await fetchSessionList(existingTunnel);
+    const sessions = sessionsRes.sessions || [];
+    const target = sessions.find(s => s.type !== 'port' && s.displayName === displayName);
+    if (!target) {
+        throw new Error(`Session not found: ${displayName}`);
+    }
+    log(`Attaching to ${displayName}...`, RESET);
+
+    const hayCli = resolveHayCliPath();
+    const wsUrl = `ws://127.0.0.1:${existingTunnel.port}/ws?token=${existingTunnel.sessionSecret}`;
+
+    const cliProc = spawn('node', [hayCli, '-s', wsUrl, '-r', displayName, '-n', 'Local'], {
+        stdio: 'inherit',
+        env: { ...process.env, FORCE_COLOR: '1', HAY_SHARE_URL: existingTunnel.url || '' }
+    });
+
+    cliProc.on('close', (code) => {
+        if (code === 10) {
+            log(`\nDetached from local session.`, YELLOW);
+            process.exit(0);
+        }
+        log(`\nSession disconnected.`, YELLOW);
+        process.exit(code || 0);
+    });
+
+    cliProc.on('error', (err) => {
+        log(`\nConnection error: ${err.message}`, RED);
+        process.exit(1);
+    });
+
+    await new Promise(() => {});
+}
+
+async function attachToSessionForDir(existingTunnel) {
+    const sessionsRes = await fetchSessionList(existingTunnel);
+    const sessions = sessionsRes.sessions || [];
+    const cwdName = path.basename(process.cwd()).replace(/[^a-zA-Z0-9_-]/g, '-');
+    const target = pickSessionForDir(sessions, cwdName);
+    if (!target) {
+        throw new Error(`No existing session for ${cwdName}`);
+    }
+    return attachToNamedSession(existingTunnel, target.displayName);
+}
+
+async function main() {
+    // Handle `hop client` - run as a user with exported credentials
+    if (process.argv[2] === 'client') {
+        const credentialsArg = process.argv[3];
+        const hostnameArgIndex = process.argv.indexOf('--hostname');
+        const hostnameOverride = hostnameArgIndex !== -1 ? process.argv[hostnameArgIndex + 1] : null;
+
+        if (!credentialsArg || credentialsArg === '--help' || credentialsArg === '-h') {
+            log(`\n${BOLD}Hop Client Mode${RESET}\n`, CYAN);
+            log(`Run hop with credentials from your admin.\n`, RESET);
+            log(`${BOLD}Usage:${RESET}`, RESET);
+            log(`  hop client <credentials.json>              Start tunnel with credentials`, RESET);
+            log(`  hop client <folder>                        Start tunnel (folder contains credentials.json)`, RESET);
+            log('');
+            log(`${BOLD}Options:${RESET}`, RESET);
+            log(`  --hostname <name>  Override hostname if config.yml is missing`, RESET);
+            log('');
+            log(`${BOLD}First run:${RESET}`, RESET);
+            log(`  You'll be prompted to set a password and scan a QR code`, RESET);
+            log(`  for your authenticator app.`, RESET);
+            log('');
+            log(`${BOLD}Example:${RESET}`, RESET);
+            log(`  hop client ./my-credentials.json`, RESET);
+            log('');
+            process.exit(0);
+        }
+
+        // Find credentials file
+        let credentialsPath = credentialsArg;
+        if (fs.existsSync(credentialsArg) && fs.statSync(credentialsArg).isDirectory()) {
+            credentialsPath = path.join(credentialsArg, 'credentials.json');
+        }
+
+        if (!fs.existsSync(credentialsPath)) {
+            log(`Credentials file not found: ${credentialsPath}`, RED);
+            process.exit(1);
+        }
+
+        // Load credentials
+        let credentials;
+        try {
+            credentials = JSON.parse(fs.readFileSync(credentialsPath, 'utf8'));
+        } catch (e) {
+            log(`Invalid credentials file: ${e.message}`, RED);
+            process.exit(1);
+        }
+
+        // Client config is stored per-tunnel (based on tunnel ID)
+        const tunnelId = credentials.TunnelID || credentials.tunnelId || path.basename(credentialsPath, '.json');
+        const clientConfigDir = path.join(HOME_DIR, 'clients', tunnelId);
+        ensurePrivateDir(clientConfigDir);
+
+        PASSWORD_FILE_PATH = path.join(clientConfigDir, '.password_hash');
+        SECRET_FILE_PATH = path.join(clientConfigDir, '.auth_secret');
+        const clientConfigFile = path.join(clientConfigDir, '.config.json');
+
+        // Load or create client config
+        let clientConfig = {};
+        if (fs.existsSync(clientConfigFile)) {
+            try {
+                clientConfig = JSON.parse(fs.readFileSync(clientConfigFile, 'utf8'));
+            } catch (e) { }
+        }
+
+        let hostname = clientConfig.hostname || null;
+        if (hostnameOverride) {
+            hostname = hostnameOverride;
+        }
+
+        // Try to find hostname in config.yml in the export folder
+        const configYmlPath = path.join(path.dirname(credentialsPath), 'config.yml');
+        if (!hostname && fs.existsSync(configYmlPath)) {
+            const configYml = fs.readFileSync(configYmlPath, 'utf8');
+            const hostnameMatch = configYml.match(/hostname:\s*(\S+)/);
+            if (hostnameMatch) hostname = hostnameMatch[1];
+        }
+
+        if (!hostname) {
+            log(`Hostname not found.`, RED);
+            log(`Ask your admin to export a fresh bundle or pass --hostname.`, YELLOW);
+            process.exit(1);
+        }
+
+        if (clientConfig.hostname !== hostname) {
+            clientConfig.hostname = hostname;
+            writePrivateFile(clientConfigFile, JSON.stringify(clientConfig, null, 2));
+        }
+
+        // First time setup - require password and TOTP
+        const clientPasswordExists = isPasswordEnabled();
+        const clientSecretExists = fs.existsSync(SECRET_FILE_PATH);
+
+        if (!clientPasswordExists || !clientSecretExists) {
+            log(`\n${BOLD}${YELLOW}⚠ First time setup required${RESET}\n`, YELLOW);
+            log(`Your tunnel URL will be publicly accessible.`, RESET);
+            log(`Password + authenticator code protects your hop login.\n`, RESET);
+
+            const readline = require('readline');
+            const stream = require('stream');
+
+            const askPassword = (prompt) => new Promise((resolve) => {
+                const rl = readline.createInterface({
+                    input: process.stdin,
+                    output: new stream.Writable({
+                        write: (chunk, encoding, callback) => callback()
+                    }),
+                    terminal: true
+                });
+                process.stdout.write(prompt);
+                rl.question('', (answer) => {
+                    rl.close();
+                    process.stdout.write('\n');
+                    resolve(answer);
+                });
+            });
+
+            // Set password
+            if (!clientPasswordExists) {
+                const password = await askPassword('Set a password: ');
+                if (password.length < 4) {
+                    log(`Password too short (min 4 characters).`, RED);
+                    process.exit(1);
+                }
+                const confirm = await askPassword('Confirm password: ');
+                if (password !== confirm) {
+                    log(`Passwords do not match.`, RED);
+                    process.exit(1);
+                }
+                setPassword(password);
+                log(`${GREEN}✓ Password set.${RESET}`, GREEN);
+            }
+
+            // Set up TOTP
+            if (!clientSecretExists) {
+                loadAuthSecret();
+                log(`\n${BOLD}Scan this QR code with your authenticator app:${RESET}\n`, CYAN);
+                const label = hostname ? `Hop-${hostname}` : `Hop-${tunnelId.slice(0, 8)}`;
+                showQrCode(label);
+            }
+
+            log(`\n${GREEN}✓ Setup complete!${RESET}\n`, GREEN);
+        }
+
+        loadAuthSecret();
+
+        await checkAndInstallDependencies();
+        await ensureHayLoaded();
+        const authEmitter = new EventEmitter();
+
+        const proxyServer = startAuthProxy(authEmitter);
+        CLIENT_TUNNEL_CONFIG = {
+            tunnelId,
+            credentialsPath,
+            hostname,
+            configDir: clientConfigDir
+        };
+        const { tunnel: tunnelProc, publicUrl } = await startClientTunnel();
+
+        // Save state for other terminals to find
+        writePrivateFile(STATE_FILE, JSON.stringify({
+            pid: process.pid,
+            port: BASE_PORT,
+            url: publicUrl,
+            sessionSecret: SESSION_SECRET,
+            startTime: Date.now()
+        }));
+
+        await waitForStart(authEmitter, publicUrl, `Hop-${hostname}`);
+
+        await startLocalSession(proxyServer, tunnelProc, publicUrl);
+        return;
+    }
+
+    // Handle `hop start` command - start daemon and print QR codes
+    if (process.argv[2] === 'start') {
+        const existing = isServerRunning();
+        if (!existing) {
+            loadAuthSecret();
+            await checkAndInstallDependencies();
+            startDaemon();
+        }
+        const state = existing || await waitForDaemonReady();
+        const domainConfig = getDomainConfig();
+        const label = domainConfig?.hostname ? `Hop-${domainConfig.hostname}` : 'Hop';
+        loadAuthSecret();
+        printStartupInfo(state.url, label);
+        process.exit(0);
+    }
+
+    // Handle `hop attach` command - attach to existing session
+    if (process.argv[2] === 'attach') {
+        const existing = isServerRunning();
+        if (!existing) {
+            log(`Hop is not running.`, RED);
+            process.exit(1);
+        }
+        const nameArg = process.argv[3];
+        const displayName = nameArg && nameArg.startsWith(HOP_SESSION_PREFIX)
+            ? toDisplaySessionName(nameArg)
+            : nameArg;
+        if (displayName) {
+            await attachToNamedSession(existing, displayName);
+        } else {
+            await attachToSessionForDir(existing);
+        }
+        return;
+    }
+
+    // Handle `hop stop` command - stop daemon
+    if (process.argv[2] === 'stop') {
+        const state = isServerRunning();
+        if (!state) {
+            log(`Hop is not running.`, RED);
+            process.exit(1);
+        }
+        try {
+            process.kill(state.pid, 'SIGTERM');
+            log(`Hop stopped.`, GREEN);
+        } catch (e) {
+            log(`Failed to stop hop: ${e.message}`, RED);
+            process.exit(1);
+        }
+        process.exit(0);
+    }
+
+    // Handle `hop --help` or `hop help`
+    if (process.argv[2] === '--help' || process.argv[2] === '-h' || process.argv[2] === 'help') {
+        log(`\n${BOLD}Hop - Remote Terminal Access${RESET}\n`, CYAN);
+        log(`${BOLD}Usage:${RESET}`, RESET);
+        log(`  hop                       Start tunnel (or attach to existing)`, RESET);
+        log(`  hop start                 Start hop daemon and print QR codes`, RESET);
+        log(`  hop attach [session]       Attach to an existing session`, RESET);
+        log(`  hop stop                  Stop hop daemon`, RESET);
+        log(`  hop --help                Show this help message`, RESET);
+        log('');
+        log(`${BOLD}URL & QR:${RESET}`, RESET);
+        log(`  hop url                   Print current tunnel URL`, RESET);
+        log(`  hop qr                    Show URL as QR code`, RESET);
+        log('');
+        log(`${BOLD}Custom Domain:${RESET}`, RESET);
+        log(`  hop domain                Show current domain config`, RESET);
+        log(`  hop domain <hostname>     Setup custom domain (e.g., hop.example.com)`, RESET);
+        log(`  hop domain-clear          Remove custom domain, use random URLs`, RESET);
+        log('');
+        log(`${BOLD}Security:${RESET}`, RESET);
+        log(`  hop password              Show password status`, RESET);
+        log(`  hop password set          Set or change password`, RESET);
+        log(`  hop password clear        Remove password protection`, RESET);
+        log('');
+        log(`${BOLD}Multi-user (admin):${RESET}`, RESET);
+        log(`  hop user list             List all users`, RESET);
+        log(`  hop user add <name>       Add a user (creates tunnel + DNS)`, RESET);
+        log(`  hop user remove <name>    Remove a user`, RESET);
+        log(`  hop user export <name>    Export credentials for a user`, RESET);
+        log('');
+        log(`${BOLD}Sessions:${RESET}`, RESET);
+        log(`  hop session list                 List sessions`, RESET);
+        log(`  hop session add <name>           Add terminal session`, RESET);
+        log(`  hop session add <name> --port N  Add port session (proxy)`, RESET);
+        log(`  hop session remove <name>        Remove a session`, RESET);
+        log('');
+        log(`${BOLD}Client mode (for users):${RESET}`, RESET);
+        log(`  hop client <credentials>  Run tunnel with exported credentials`, RESET);
+        log('');
+        log(`${BOLD}Maintenance:${RESET}`, RESET);
+        log(`  hop wipe                  Kill all hop sessions`, RESET);
+        log('');
+        process.exit(0);
+    }
+
+    // Handle `hop url` command - prints current tunnel URL (easy to copy)
+    if (process.argv[2] === 'url') {
+        const state = isServerRunning();
+        if (!state) {
+            log(`Hop is not running.`, RED);
+            process.exit(1);
+        }
+        // Print just the URL for easy copying/piping
+        console.log(state.url);
+        process.exit(0);
+    }
+
+    // Handle `hop qr` command - shows QR code for current URL
+    if (process.argv[2] === 'qr') {
+        const state = isServerRunning();
+        if (!state) {
+            log(`Hop is not running.`, RED);
+            process.exit(1);
+        }
+        log(`\nCurrent tunnel URL:`, BOLD);
+        log(`${state.url}\n`, GREEN);
+        qrcode.generate(state.url, { small: true });
+        process.exit(0);
+    }
+
+    // Handle `hop domain <hostname>` command - setup custom domain
+    if (process.argv[2] === 'domain') {
+        const hostname = process.argv[3];
+        if (!hostname) {
+            // Show current domain config
+            const config = getDomainConfig();
+            if (config) {
+                log(`\nCurrent custom domain configuration:`, BOLD);
+                log(`  Hostname: ${config.hostname}`, GREEN);
+                log(`  Tunnel:   ${config.tunnelName}`, RESET);
+                log(`\nTo change: hop domain <new-hostname>`, RESET);
+                log(`To remove: hop domain-clear`, RESET);
+            } else {
+                log(`\nNo custom domain configured.`, YELLOW);
+                log(`\nUsage: hop domain <hostname>`, RESET);
+                log(`Example: hop domain hop.yourdomain.com`, RESET);
+            }
+            process.exit(0);
+        }
+        // Validate hostname format
+        if (!/^[a-zA-Z0-9]([a-zA-Z0-9-]*\.)+[a-zA-Z]{2,}$/.test(hostname)) {
+            log(`Invalid hostname format: ${hostname}`, RED);
+            log(`Example: hop.yourdomain.com`, RESET);
+            process.exit(1);
+        }
+        await setupDomain(hostname);
+        process.exit(0);
+    }
+
+    // Handle `hop domain-clear` command - remove custom domain config
+    if (process.argv[2] === 'domain-clear') {
+        if (fs.existsSync(DOMAIN_CONFIG_FILE)) {
+            fs.unlinkSync(DOMAIN_CONFIG_FILE);
+            log(`Custom domain configuration removed.`, GREEN);
+            log(`Hop will use random Cloudflare URLs again.`, RESET);
+        } else {
+            log(`No custom domain configured.`, YELLOW);
+        }
+        process.exit(0);
+    }
+
+    // Handle `hop password` commands
+    if (process.argv[2] === 'password') {
+        const subcommand = process.argv[3];
+        const readline = require('readline');
+
+        if (!subcommand || subcommand === 'status') {
+            if (isPasswordEnabled()) {
+                log(`Password protection: ${GREEN}ENABLED${RESET}`, BOLD);
+                log(`\nTo change: hop password set`, RESET);
+                log(`To remove: hop password clear`, RESET);
+            } else {
+                log(`Password protection: ${YELLOW}DISABLED${RESET}`, BOLD);
+                log(`\nTo enable: hop password set`, RESET);
+            }
+            process.exit(0);
+        }
+
+        if (subcommand === 'set') {
+            // Use muted readline for password input
+            const askPassword = (prompt) => new Promise((resolve) => {
+                const rl = readline.createInterface({
+                    input: process.stdin,
+                    output: new (require('stream').Writable)({
+                        write: (chunk, encoding, callback) => callback()
+                    }),
+                    terminal: true
+                });
+
+                process.stdout.write(prompt);
+                rl.question('', (answer) => {
+                    rl.close();
+                    process.stdout.write('\n');
+                    resolve(answer);
+                });
+            });
+
+            const password = await askPassword('Enter new password: ');
+            if (password.length < 4) {
+                log(`Password too short (min 4 characters).`, RED);
+                process.exit(1);
+            }
+
+            const confirm = await askPassword('Confirm password: ');
+            if (password !== confirm) {
+                log(`Passwords do not match.`, RED);
+                process.exit(1);
+            }
+
+            setPassword(password);
+            log(`\n${GREEN}✓ Password set successfully.${RESET}`, GREEN);
+            log(`\nLogin will now require password + TOTP code.`, RESET);
+            process.exit(0);
+        }
+
+        if (subcommand === 'clear') {
+            if (!isPasswordEnabled()) {
+                log(`Password is not set.`, YELLOW);
+                process.exit(0);
+            }
+            clearPassword();
+            log(`${GREEN}✓ Password protection removed.${RESET}`, GREEN);
+            log(`\nLogin will only require TOTP code.`, RESET);
+            process.exit(0);
+        }
+
+        // Unknown subcommand
+        log(`\n${BOLD}Password commands:${RESET}\n`, CYAN);
+        log(`  hop password           Show password status`, RESET);
+        log(`  hop password set       Set or change password`, RESET);
+        log(`  hop password clear     Remove password protection`, RESET);
+        process.exit(0);
+    }
+
+    // Handle `hop user` commands - multi-user management
+    if (process.argv[2] === 'user') {
+        const subcommand = process.argv[3];
+        const username = process.argv[4];
+
+        if (!subcommand || subcommand === 'list') {
+            listUsersCommand();
+            process.exit(0);
+        }
+
+        if (subcommand === 'add') {
+            if (!username) {
+                log(`Usage: hop user add <username>`, RED);
+                process.exit(1);
+            }
+            await addUser(username);
+            process.exit(0);
+        }
+
+        if (subcommand === 'remove' || subcommand === 'rm' || subcommand === 'delete') {
+            if (!username) {
+                log(`Usage: hop user remove <username>`, RED);
+                process.exit(1);
+            }
+            await removeUser(username);
+            process.exit(0);
+        }
+
+        if (subcommand === 'export') {
+            if (!username) {
+                log(`Usage: hop user export <username>`, RED);
+                process.exit(1);
+            }
+            await exportUserCredentials(username);
+            process.exit(0);
+        }
+
+        // Unknown subcommand - show help
+        log(`\n${BOLD}User management commands:${RESET}\n`, CYAN);
+        log(`  hop user list              List all users`, RESET);
+        log(`  hop user add <username>    Add a new user`, RESET);
+        log(`  hop user remove <username> Remove a user`, RESET);
+        log(`  hop user export <username> Export credentials for a user`, RESET);
+        process.exit(0);
+    }
+
+    // Handle `hop session` commands
+    if (process.argv[2] === 'session') {
+        await ensureHayLoaded();
+        const subcommand = process.argv[3];
+        const nameArg = process.argv[4];
+
+        if (!subcommand || subcommand === 'list') {
+            const sessions = listAllSessionEntries();
+            if (sessions.length === 0) {
+                log(`No sessions configured.`, YELLOW);
+                process.exit(0);
+            }
+            log(`\n${BOLD}Sessions:${RESET}\n`, CYAN);
+            sessions.forEach(s => {
+                if (s.type === 'port') {
+                    log(`  ${BOLD}${s.displayName}${RESET}  ${YELLOW}[PORT ${s.port}]${RESET}`, RESET);
+                } else {
+                    log(`  ${BOLD}${s.displayName}${RESET}  ${GREEN}[TERMINAL]${RESET}`, RESET);
+                }
+            });
+            process.exit(0);
+        }
+
+        if (subcommand === 'add') {
+            if (!nameArg) {
+                log(`Usage: hop session add <name> [--port <number>]`, RED);
+                process.exit(1);
+            }
+            const displayName = nameArg;
+            const name = toInternalSessionName(displayName);
+            if (!name) {
+                log(`Invalid session name.`, RED);
+                process.exit(1);
+            }
+            const portArgIndex = process.argv.indexOf('--port');
+            if (portArgIndex !== -1) {
+                const portArg = parseInt(process.argv[portArgIndex + 1], 10);
+                if (!Number.isInteger(portArg) || portArg < 1 || portArg > 65535) {
+                    log(`Invalid port. Use 1-65535.`, RED);
+                    process.exit(1);
+                }
+                if (hopSessionExists(name)) {
+                    log(`Terminal session already exists with this name.`, RED);
+                    process.exit(1);
+                }
+                setPortSessionConfig(name, portArg);
+                log(`Added port session "${displayName}" → localhost:${portArg}`, GREEN);
+                process.exit(0);
+            }
+
+            const existingConfig = getSessionConfig(name);
+            if (existingConfig && existingConfig.type === 'port') {
+                log(`Port session already exists with this name.`, RED);
+                process.exit(1);
+            }
+            ensureTerminalSessionConfig(name);
+            log(`Added terminal session "${displayName}".`, GREEN);
+            process.exit(0);
+        }
+
+        if (subcommand === 'remove' || subcommand === 'rm' || subcommand === 'delete') {
+            if (!nameArg) {
+                log(`Usage: hop session remove <name>`, RED);
+                process.exit(1);
+            }
+            const displayName = nameArg;
+            const name = toInternalSessionName(displayName);
+            if (!name) {
+                log(`Invalid session name.`, RED);
+                process.exit(1);
+            }
+            const config = getSessionConfig(name);
+            if (config && config.type === 'port') {
+                deleteSessionConfig(name);
+                log(`Removed port session "${displayName}".`, GREEN);
+                process.exit(0);
+            }
+            // Close hay room if it exists
+            if (hayRooms.hasRoom(name)) {
+                hayRooms.closeRoom(name);
+            }
+            if (activeSessions[name]) {
+                delete activeSessions[name];
+            }
+            deleteSessionConfig(name);
+            log(`Removed terminal session "${displayName}".`, GREEN);
+            process.exit(0);
+        }
+
+        log(`\n${BOLD}Session commands:${RESET}\n`, CYAN);
+        log(`  hop session list                 List sessions`, RESET);
+        log(`  hop session add <name>           Add terminal session`, RESET);
+        log(`  hop session add <name> --port N  Add port session`, RESET);
+        log(`  hop session remove <name>        Remove a session`, RESET);
+        process.exit(0);
+    }
+
+    // Handle `hop wipe` command - kills all hop sessions
+    if (process.argv[2] === 'wipe') {
+        const existingTunnel = isServerRunning();
+
+        if (existingTunnel) {
+            // Server is running - call API to delete sessions
+            const http = require('http');
+
+            // First get list of sessions
+            const sessionsRes = await new Promise((resolve, reject) => {
+                const opts = {
+                    hostname: '127.0.0.1',
+                    port: existingTunnel.port,
+                    path: '/api/sessions',
+                    method: 'GET',
+                    headers: { 'Authorization': `Bearer ${existingTunnel.sessionSecret}` }
+                };
+                const req = http.request(opts, res => {
+                    let data = '';
+                    res.on('data', chunk => data += chunk);
+                    res.on('end', () => resolve({ status: res.statusCode, data }));
+                });
+                req.on('error', reject);
+                req.end();
+            });
+
+            const sessionsData = JSON.parse(sessionsRes.data);
+            const sessions = sessionsData.sessions || [];
+
+            if (sessions.length === 0) {
+                log(`No hop sessions to clean up.`, GREEN);
+                process.exit(0);
+            }
+
+            log(`Killing ${sessions.length} hop session(s)...`, YELLOW);
+
+            for (const s of sessions) {
+                try {
+                    await new Promise((resolve, reject) => {
+                        const opts = {
+                            hostname: '127.0.0.1',
+                            port: existingTunnel.port,
+                            path: '/api/sessions/delete',
+                            method: 'POST',
+                            headers: {
+                                'Content-Type': 'application/json',
+                                'Authorization': `Bearer ${existingTunnel.sessionSecret}`
+                            }
+                        };
+                        const req = http.request(opts, res => {
+                            let data = '';
+                            res.on('data', chunk => data += chunk);
+                            res.on('end', () => resolve({ status: res.statusCode, data }));
+                        });
+                        req.on('error', reject);
+                        req.write(JSON.stringify({ name: s.name }));
+                        req.end();
+                    });
+                    log(`  - ${s.displayName || s.name}`, RESET);
+                } catch (e) {
+                    log(`  - ${s.displayName || s.name} (failed)`, YELLOW);
+                }
+            }
+            log(`Done.`, GREEN);
+        } else {
+            // Server not running - just clean up config files
+            const sessions = Object.keys(sessionConfigs).filter(s => s.startsWith(HOP_SESSION_PREFIX));
+            if (sessions.length === 0) {
+                log(`No hop sessions to clean up.`, GREEN);
+                process.exit(0);
+            }
+            log(`Cleaning up ${sessions.length} session config(s)...`, YELLOW);
+            for (const name of sessions) {
+                deleteSessionConfig(name);
+                log(`  - ${toDisplaySessionName(name)}`, RESET);
+            }
+            log(`Done.`, GREEN);
+        }
+        process.exit(0);
+    }
+
+    process.stdout.write('\x1Bc'); // Clear screen
+
+    // Only one instance allowed
+    if (!DAEMON_FLAG) {
+        const existingTunnel = isServerRunning();
+        if (existingTunnel) {
+            await attachToExistingTunnel(existingTunnel);
+            return;
+        }
+
+        // No server yet: start daemon and wait for it to come up
+        loadAuthSecret();
+        await checkAndInstallDependencies();
+        startDaemon();
+        const state = await waitForDaemonReady();
+        const domainConfig = getDomainConfig();
+        const label = domainConfig?.hostname ? `Hop-${domainConfig.hostname}` : 'Hop';
+        loadAuthSecret();
+        await waitForStartPolling(state, label);
+        await attachToExistingTunnel(state);
+        return;
+    }
+
+    // SERVER MODE: Start new tunnel
+
+    // Require password for custom domains
+    const domainConfig = getDomainConfig();
+    if (domainConfig && domainConfig.hostname && !isPasswordEnabled()) {
+        log(`\n${RED}ERROR: Password required for custom domain.${RESET}`, RED);
+        log(`\nYour fixed URL (${domainConfig.hostname}) is publicly known.`, YELLOW);
+        log(`Password protection is required for security.\n`, RESET);
+        log(`Run: ${CYAN}hop password set${RESET}`, RESET);
+        process.exit(1);
+    }
+
+    loadAuthSecret();
+    await checkAndInstallDependencies();
+    await ensureHayLoaded();
+    const authEmitter = new EventEmitter();
+
+    const proxyServer = startAuthProxy(authEmitter);
+    const { tunnel: tunnelProc, publicUrl } = await startTunnel();
+
+    // Save state for other terminals to find
+    writePrivateFile(STATE_FILE, JSON.stringify({
+        pid: process.pid,
+        port: BASE_PORT,
+        url: publicUrl,
+        sessionSecret: SESSION_SECRET,
+        startTime: Date.now()
+    }));
+
+    if (DAEMON_FLAG) {
+        const cleanup = () => {
+            if (shuttingDown) return;
+            shuttingDown = true;
+            log(`Cleaning up...`, YELLOW);
+
+            if (fs.existsSync(STATE_FILE)) {
+                try { fs.unlinkSync(STATE_FILE); } catch (e) { }
+            }
+
+            hayRooms.closeAll();
+
+            try { (currentTunnelProc || tunnelProc).kill('SIGTERM'); } catch (e) { }
+            try { proxyServer.close(); } catch (e) { }
+
+            process.exit(0);
+        };
+
+        process.on('SIGINT', cleanup);
+        process.on('SIGTERM', cleanup);
+        process.on('exit', cleanup);
+        await new Promise(() => {});
+    }
+
+    await waitForStart(authEmitter, publicUrl);
+
+    await startLocalSession(proxyServer, tunnelProc, publicUrl);
+}
+
+main().catch(err => {
+    log(`Fatal: ${err.message}`, RED);
+    process.exit(1);
+});