localdeck 1.4.0 → 1.6.1

package/dist/{index-316fp4p2.js → index-2zg5ahh5.js}

@@ -2936,50 +2936,6 @@ var import_websocket = __toESM(require_websocket(), 1);
 var import_websocket_server = __toESM(require_websocket_server(), 1);
 var wrapper_default = import_websocket.default;
 
-// ../daemon/src/forward.ts
-import net from "node:net";
-function startForwarder(options = {}) {
-  const listenPort = options.listenPort ?? 80;
-  const targetPort = options.targetPort ?? 7777;
-  if (!Number.isInteger(listenPort) || listenPort < 0 || listenPort > 65535 || !Number.isInteger(targetPort) || targetPort < 1 || targetPort > 65535)
-    return Promise.reject(new Error("forward ports must be integers between 1 and 65535"));
-  if (listenPort !== 0 && listenPort === targetPort)
-    return Promise.reject(new Error("forward listen port and target port must be different"));
-  const sockets = new Set;
-  const server = net.createServer((client) => {
-    sockets.add(client);
-    client.once("close", () => sockets.delete(client));
-    const upstream = net.connect(targetPort, "127.0.0.1");
-    sockets.add(upstream);
-    upstream.once("close", () => sockets.delete(upstream));
-    client.pipe(upstream);
-    upstream.pipe(client);
-    const destroy = () => {
-      client.destroy();
-      upstream.destroy();
-    };
-    client.once("error", destroy);
-    upstream.once("error", destroy);
-    client.once("close", destroy);
-    upstream.once("close", destroy);
-  });
-  return new Promise((resolve, reject) => {
-    const onError = (error) => {
-      server.removeAllListeners();
-      reject(new Error(error.code === "EADDRINUSE" ? `forwarder could not listen on 127.0.0.1:${listenPort}: address already in use` : error.code === "EACCES" || error.code === "EPERM" ? `forwarder cannot listen on port ${listenPort}: permission denied (choose another port; do not run LocalDeck as root)` : `forwarder failed: ${error.message}`));
-    };
-    server.once("error", onError);
-    server.listen(listenPort, "127.0.0.1", () => {
-      server.off("error", onError);
-      resolve({ port: server.address().port, close: () => new Promise((done) => {
-        for (const socket of sockets)
-          socket.destroy();
-        server.close(() => done());
-      }) });
-    });
-  });
-}
-
 // ../daemon/src/paths.ts
 import os from "node:os";
 import path from "node:path";
@@ -3021,6 +2977,7 @@ function writePrivateJson(file, value) {
 }
 
 // ../daemon/src/project-config.ts
+import { createHash } from "node:crypto";
 import fs2 from "node:fs";
 import path2 from "node:path";
 var DEFAULT_READY_TIMEOUT_MS = 60000;
@@ -3047,7 +3004,7 @@ function loadProject(from = process.cwd()) {
 function loadProjectFile(file) {
   const raw = readProjectJson(file);
   const commands = normalize(raw, file);
-  const profiles = parseProfiles(raw, commands, file);
+  const { profiles, legacyProfiles } = parseProfiles(raw, commands, file);
   let nickname;
   if (raw && typeof raw === "object" && !Array.isArray(raw) && (Array.isArray(raw.commands) || Array.isArray(raw.services))) {
     const value = raw.nickname;
@@ -3057,7 +3014,7 @@ function loadProjectFile(file) {
       nickname = value.toLowerCase();
     }
   }
-  return { file, dir: path2.dirname(file), commands, ...profiles ? { profiles } : {}, ...nickname ? { nickname } : {} };
+  return { file, dir: path2.dirname(file), commands, ...profiles ? { profiles } : {}, ...legacyProfiles ? { legacyProfiles } : {}, ...nickname ? { nickname } : {} };
 }
 function updateProjectNickname(file, nickname) {
   const raw = readProjectJson(file);
@@ -3218,35 +3175,8 @@ function normalize(raw, file) {
     if (serviceType && serviceType !== "http" && (entry.upstream == null || entry.port != null)) {
       throw new Error(`${path2.basename(file)}: database services need an explicit upstream (published port) and must not set an HTTP proxy port`);
     }
-    let env;
-    if (entry.env !== undefined) {
-      if (!entry.env || typeof entry.env !== "object" || Array.isArray(entry.env))
-        throw new Error(`${path2.basename(file)}: env must be an object of strings`);
-      env = {};
-      for (const [key, value2] of Object.entries(entry.env)) {
-        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key) || typeof value2 !== "string" || value2.includes("\x00"))
-          throw new Error(`${path2.basename(file)}: env must contain valid variable names and string values`);
-        if (key === "PORT" || key.startsWith("LOCALDECK_"))
-          throw new Error(`${path2.basename(file)}: ${key} is reserved by LocalDeck`);
-        Object.defineProperty(env, key, { value: value2, enumerable: true, writable: true, configurable: true });
-      }
-    }
-    let secrets;
-    if (entry.secrets !== undefined) {
-      if (!Array.isArray(entry.secrets) || !entry.secrets.every((value2) => typeof value2 === "string" && /^[A-Za-z_][A-Za-z0-9_]*$/.test(value2))) {
-        throw new Error(`${path2.basename(file)}: secrets must contain valid environment names`);
-      }
-      secrets = [];
-      for (const secret of entry.secrets) {
-        if (secret === "PORT" || secret.startsWith("LOCALDECK_"))
-          throw new Error(`${path2.basename(file)}: ${secret} is reserved by LocalDeck`);
-        if (env && Object.prototype.hasOwnProperty.call(env, secret))
-          throw new Error(`${path2.basename(file)}: ${secret} cannot be both a secret and env setting`);
-        if (secrets.includes(secret))
-          throw new Error(`${path2.basename(file)}: duplicate secret ${secret}`);
-        secrets.push(secret);
-      }
-    }
+    const env = entry.env === undefined ? undefined : parseEnv(entry.env, file);
+    const secrets = entry.secrets === undefined ? undefined : parseSecrets(entry.secrets, env, file);
     out.push({
       name,
       run,
@@ -3264,6 +3194,35 @@ function normalize(raw, file) {
   validateDependencies(out, file);
   return out;
 }
+function parseEnv(value, file) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`${path2.basename(file)}: env must be an object of strings`);
+  const env = {};
+  for (const [key, setting] of Object.entries(value)) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key) || typeof setting !== "string" || setting.includes("\x00"))
+      throw new Error(`${path2.basename(file)}: env must contain valid variable names and string values`);
+    if (key === "PORT" || key.startsWith("LOCALDECK_"))
+      throw new Error(`${path2.basename(file)}: ${key} is reserved by LocalDeck`);
+    Object.defineProperty(env, key, { value: setting, enumerable: true, writable: true, configurable: true });
+  }
+  return env;
+}
+function parseSecrets(value, env, file) {
+  if (!Array.isArray(value) || !value.every((name) => typeof name === "string" && /^[A-Za-z_][A-Za-z0-9_]*$/.test(name))) {
+    throw new Error(`${path2.basename(file)}: secrets must contain valid environment names`);
+  }
+  const secrets = [];
+  for (const secret of value) {
+    if (secret === "PORT" || secret.startsWith("LOCALDECK_"))
+      throw new Error(`${path2.basename(file)}: ${secret} is reserved by LocalDeck`);
+    if (env && Object.prototype.hasOwnProperty.call(env, secret))
+      throw new Error(`${path2.basename(file)}: ${secret} cannot be both a secret and env setting`);
+    if (secrets.includes(secret))
+      throw new Error(`${path2.basename(file)}: duplicate secret ${secret}`);
+    secrets.push(secret);
+  }
+  return secrets;
+}
 function parseReadiness(value, file, index) {
   if (value === "postgres" || value === "redis") {
     return { type: "command", run: value === "postgres" ? "pg_isready -h 127.0.0.1 -p {upstream}" : "redis-cli -h 127.0.0.1 -p {upstream} ping", ...value === "redis" ? { expectedOutput: "PONG" } : {}, timeoutMs: DEFAULT_READY_TIMEOUT_MS, intervalMs: DEFAULT_READY_INTERVAL_MS };
@@ -3308,22 +3267,159 @@ function parseReadiness(value, file, index) {
     throw new Error(`${path2.basename(file)}: expectedOutput must be a string of at most 4000 characters`);
   return { type, run: ready.run, ...ready.expectedOutput === undefined ? {} : { expectedOutput: ready.expectedOutput }, timeoutMs, intervalMs };
 }
+var OVERRIDE_FIELDS = ["run", "cwd", "env", "secrets"];
 function parseProfiles(raw, commands, file) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw) || !Array.isArray(raw.services) && !Array.isArray(raw.commands))
-    return;
+    return {};
   const value = raw.profiles;
   if (value === undefined)
-    return;
+    return {};
+  const base = path2.basename(file);
   if (!value || typeof value !== "object" || Array.isArray(value))
-    throw new Error(`${path2.basename(file)}: profiles must map names to arrays of service names`);
-  const profiles = Object.create(null);
-  for (const [name, services] of Object.entries(value)) {
-    if (!/^[a-z0-9][a-z0-9_-]{0,40}$/.test(name) || !Array.isArray(services) || !services.length || !services.every((service) => typeof service === "string" && commands.some((command) => command.name === service.toLowerCase()))) {
-      throw new Error(`${path2.basename(file)}: profile ${name} must contain existing service names`);
+    throw new Error(`${base}: profiles must map names to profile objects`);
+  const entries = Object.entries(value);
+  if (!entries.length)
+    return {};
+  for (const [name] of entries)
+    if (!/^[a-z0-9][a-z0-9_-]{0,40}$/.test(name))
+      throw new Error(`${base}: invalid profile name "${name}"`);
+  const lists = entries.filter(([, profile]) => Array.isArray(profile));
+  if (lists.length && lists.length !== entries.length)
+    throw new Error(`${base}: profiles cannot mix service lists and profile objects; move service lists to tags`);
+  const byName = new Map(commands.map((command) => [command.name, command]));
+  if (lists.length) {
+    const legacyProfiles = Object.create(null);
+    for (const [name, services] of lists) {
+      if (!services.length || !services.every((service) => typeof service === "string" && byName.has(service.toLowerCase()))) {
+        throw new Error(`${base}: profile ${name} must contain existing service names`);
+      }
+      legacyProfiles[name] = [...new Set(services.map((service) => service.toLowerCase()))];
+      for (const service of legacyProfiles[name]) {
+        const command = byName.get(service);
+        if (!command.tags.includes(name))
+          command.tags.push(name);
+      }
+    }
+    return { legacyProfiles };
+  }
+  const profiles = [];
+  for (const [name, entry] of entries) {
+    if (!entry || typeof entry !== "object")
+      throw new Error(`${base}: profile ${name} must be an object`);
+    const record = entry;
+    const unknownKey = Object.keys(record).find((key) => key !== "description" && key !== "services");
+    if (unknownKey)
+      throw new Error(`${base}: profile ${name} has unknown field "${unknownKey}"; use "description" and "services"`);
+    if (record.description !== undefined && (typeof record.description !== "string" || record.description.length > 200))
+      throw new Error(`${base}: profile ${name} description must be a string of at most 200 characters`);
+    const services = record.services ?? {};
+    if (!services || typeof services !== "object" || Array.isArray(services))
+      throw new Error(`${base}: profile ${name} services must map service names to overrides`);
+    const overrides = Object.create(null);
+    for (const [rawService, rawOverride] of Object.entries(services)) {
+      const service = rawService.toLowerCase();
+      const command = byName.get(service);
+      if (!command)
+        throw new Error(`${base}: profile ${name} changes unknown service "${rawService}"`);
+      if (!rawOverride || typeof rawOverride !== "object" || Array.isArray(rawOverride))
+        throw new Error(`${base}: profile ${name} override for ${service} must be an object`);
+      const override = rawOverride;
+      const field = Object.keys(override).find((key) => !OVERRIDE_FIELDS.includes(key));
+      if (field)
+        throw new Error(`${base}: profile ${name} cannot change ${service}.${field}; profiles can change run, cwd, env and secrets`);
+      if (override.run !== undefined && (typeof override.run !== "string" || !override.run.trim()))
+        throw new Error(`${base}: profile ${name} ${service}.run must be a non-empty string`);
+      if (override.cwd !== undefined && typeof override.cwd !== "string")
+        throw new Error(`${base}: profile ${name} ${service}.cwd must be a string`);
+      const env = override.env === undefined ? undefined : parseEnv(override.env, file);
+      const secrets = override.secrets === undefined ? undefined : parseSecrets(override.secrets, env, file);
+      const parsed = {
+        ...override.run === undefined ? {} : { run: override.run },
+        ...override.cwd === undefined ? {} : { cwd: override.cwd },
+        ...env ? { env } : {},
+        ...secrets ? { secrets } : {}
+      };
+      checkEnvSecretOverlap(mergeOverride(command, parsed).command, `profile ${name}`, file);
+      overrides[service] = parsed;
+    }
+    profiles.push({ name, ...record.description ? { description: record.description } : {}, services: overrides });
+  }
+  return { profiles };
+}
+function mergeOverride(command, override) {
+  const env = override.env ? { ...command.env, ...override.env } : command.env;
+  const secrets = override.secrets ? [...new Set([...command.secrets ?? [], ...override.secrets])] : command.secrets;
+  return {
+    command: {
+      ...command,
+      ...override.run === undefined ? {} : { run: override.run },
+      ...override.cwd === undefined ? {} : { cwd: override.cwd },
+      ...env ? { env } : {},
+      ...secrets ? { secrets } : {}
     }
-    profiles[name] = [...new Set(services.map((service) => service.toLowerCase()))];
+  };
+}
+function checkEnvSecretOverlap(command, source, file) {
+  const overlap = command.secrets?.find((secret) => command.env && Object.prototype.hasOwnProperty.call(command.env, secret));
+  if (overlap)
+    throw new Error(`${path2.basename(file)}: ${source} makes ${overlap} both a secret and env setting for ${command.name}`);
+}
+function applyProfiles(project, active = []) {
+  const wanted = new Set(active);
+  const applied = (project.profiles ?? []).filter((profile) => wanted.has(profile.name));
+  const provenance = Object.create(null);
+  const setters = new Map;
+  const commands = project.commands.map((base) => {
+    const origin = {
+      run: "base",
+      cwd: "base",
+      env: Object.fromEntries(Object.keys(base.env ?? {}).map((key) => [key, "base"])),
+      secrets: Object.fromEntries((base.secrets ?? []).map((secret) => [secret, "base"]))
+    };
+    let command = base;
+    for (const profile of applied) {
+      const override = profile.services[base.name];
+      if (!override)
+        continue;
+      const note = (field) => {
+        const key = `${base.name}\x00${field}`;
+        setters.set(key, [...setters.get(key) ?? [], profile.name]);
+      };
+      if (override.run !== undefined) {
+        origin.run = profile.name;
+        note("run");
+      }
+      if (override.cwd !== undefined) {
+        origin.cwd = profile.name;
+        note("cwd");
+      }
+      for (const key of Object.keys(override.env ?? {})) {
+        origin.env[key] = profile.name;
+        note(`env.${key}`);
+      }
+      for (const secret of override.secrets ?? [])
+        if (!(secret in origin.secrets))
+          origin.secrets[secret] = profile.name;
+      command = mergeOverride(command, override).command;
+    }
+    if (command !== base)
+      checkEnvSecretOverlap(command, `active profiles ${applied.map((profile) => profile.name).join(" + ")}`, project.file);
+    provenance[base.name] = origin;
+    return command;
+  });
+  const clashes = [];
+  for (const [key, profiles] of setters) {
+    if (profiles.length < 2)
+      continue;
+    const [service, field] = key.split("\x00");
+    clashes.push({ service, field, profiles, winner: profiles[profiles.length - 1] });
   }
-  return profiles;
+  return { commands, active: applied.map((profile) => profile.name), provenance, clashes };
+}
+function commandFingerprint(command) {
+  const env = Object.entries(command.env ?? {}).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  const secrets = [...command.secrets ?? []].sort();
+  return createHash("sha256").update(JSON.stringify([command.run, command.cwd ?? "", env, secrets])).digest("hex").slice(0, 16);
 }
 function parseBoundedInteger(value, fallback, min, max, label, file, index) {
   if (value === undefined)
@@ -3378,6 +3474,50 @@ function shellCommand(command, platform = process.platform, comspec = process.en
   return [process.env.SHELL || "/bin/sh", "-c", command];
 }
 
+// ../daemon/src/forward.ts
+import net from "node:net";
+function startForwarder(options = {}) {
+  const listenPort = options.listenPort ?? 80;
+  const targetPort = options.targetPort ?? 7777;
+  if (!Number.isInteger(listenPort) || listenPort < 0 || listenPort > 65535 || !Number.isInteger(targetPort) || targetPort < 1 || targetPort > 65535)
+    return Promise.reject(new Error("forward ports must be integers between 1 and 65535"));
+  if (listenPort !== 0 && listenPort === targetPort)
+    return Promise.reject(new Error("forward listen port and target port must be different"));
+  const sockets = new Set;
+  const server = net.createServer((client) => {
+    sockets.add(client);
+    client.once("close", () => sockets.delete(client));
+    const upstream = net.connect(targetPort, "127.0.0.1");
+    sockets.add(upstream);
+    upstream.once("close", () => sockets.delete(upstream));
+    client.pipe(upstream);
+    upstream.pipe(client);
+    const destroy = () => {
+      client.destroy();
+      upstream.destroy();
+    };
+    client.once("error", destroy);
+    upstream.once("error", destroy);
+    client.once("close", destroy);
+    upstream.once("close", destroy);
+  });
+  return new Promise((resolve, reject) => {
+    const onError = (error) => {
+      server.removeAllListeners();
+      reject(new Error(error.code === "EADDRINUSE" ? `forwarder could not listen on 127.0.0.1:${listenPort}: address already in use` : error.code === "EACCES" || error.code === "EPERM" ? `forwarder cannot listen on port ${listenPort}: permission denied (choose another port; do not run LocalDeck as root)` : `forwarder failed: ${error.message}`));
+    };
+    server.once("error", onError);
+    server.listen(listenPort, "127.0.0.1", () => {
+      server.off("error", onError);
+      resolve({ port: server.address().port, close: () => new Promise((done) => {
+        for (const socket of sockets)
+          socket.destroy();
+        server.close(() => done());
+      }) });
+    });
+  });
+}
+
 // ../daemon/src/dependencies.ts
 function startupLayers(commands, selectedNames) {
   const byName = new Map(commands.map((command) => [command.name, command]));
@@ -3414,902 +3554,1633 @@ function stopOrder(commands) {
 }
 
 // ../daemon/src/index.ts
-import fs11 from "node:fs";
+import fs14 from "node:fs";
 import crypto2 from "node:crypto";
-import path11 from "node:path";
+import path15 from "node:path";
 
-// ../daemon/src/api.ts
-import http5 from "node:http";
-import { timingSafeEqual, randomBytes, randomUUID } from "node:crypto";
+// ../daemon/src/debugging-api.ts
+import path8 from "node:path";
 
-// ../daemon/src/clean-urls.ts
+// ../daemon/src/worktrees.ts
+import fs4 from "node:fs";
+import path4 from "node:path";
+import { createHash as createHash3 } from "node:crypto";
+
+// ../daemon/src/projects.ts
+import { createHash as createHash2 } from "node:crypto";
 import fs3 from "node:fs";
-import http from "node:http";
+import { execFileSync } from "node:child_process";
 import path3 from "node:path";
 
-// ../daemon/src/windows-forwarder.ts
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-var execute = promisify(execFile);
-function windowsForwarderScript(port, remove = false) {
-  if (!Number.isInteger(port) || port < 1 || port > 65535 || port === 80)
-    throw new Error("Invalid forwarding target port.");
-  return String.raw`$ErrorActionPreference = 'Stop'
-$ownerPath = 'HKLM:\SOFTWARE\LocalDeck\Port80'
-$rulePath = 'HKLM:\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4\tcp'
-$ruleName = '127.0.0.1/80'
-$marker = 'LocalDeck loopback portproxy v1'
-$netsh = Join-Path $env:SystemRoot 'System32\netsh.exe'
-$owner = Get-ItemProperty -LiteralPath $ownerPath -ErrorAction SilentlyContinue
-$rule = if (Test-Path -LiteralPath $rulePath) { (Get-Item -LiteralPath $rulePath).GetValue($ruleName) } else { $null }
-$owned = $owner -and $owner.Marker -eq $marker -and $owner.TargetPort -match '^\d+$' -and [int]$owner.TargetPort -ge 1 -and [int]$owner.TargetPort -le 65535 -and [int]$owner.TargetPort -ne 80
-if ($owner -and !$owned) { throw 'Refusing to change an unrecognized LocalDeck ownership record.' }
-if ($rule -and (!$owned -or $rule -ne ('127.0.0.1/' + $owner.TargetPort))) { throw 'Port 80 has an unmanaged forwarding rule. It was left unchanged.' }
-${remove ? String.raw`if ($rule) {
-  & $netsh interface portproxy delete v4tov4 listenaddress=127.0.0.1 listenport=80 protocol=tcp | Out-Null
-  if ($LASTEXITCODE -ne 0) { throw 'Could not remove the LocalDeck forwarding rule.' }
-}
-if ($owned) { Remove-Item -LiteralPath $ownerPath }
-` : String.raw`if (!$rule) {
-  $listeners = @(Get-NetTCPConnection -ErrorAction Stop | Where-Object { $_.State -eq 'Listen' -and $_.LocalPort -eq 80 -and $_.LocalAddress -in @('127.0.0.1','0.0.0.0','::','::1') })
-  if ($listeners.Count) { throw 'Port 80 is already in use. The existing listener was left unchanged.' }
+// ../daemon/src/ports.ts
+import net2 from "node:net";
+function canBind(port, host, required) {
+  return new Promise((resolve) => {
+    const srv = net2.createServer();
+    srv.once("error", (error) => resolve(!required && error.code !== "EADDRINUSE" && error.code !== "EACCES" ? undefined : false));
+    srv.listen({ port, host, exclusive: true }, () => srv.close(() => resolve(true)));
+  });
 }
-$helper = Get-Service iphlpsvc
-if ($helper.StartType -eq 'Disabled') { throw 'Windows IP Helper is disabled. Enable it through your system administrator to use port forwarding.' }
-if ($helper.Status -ne 'Running') { Start-Service iphlpsvc }
-$oldRule = $rule
-$oldPort = if ($owned) { $owner.TargetPort } else { $null }
-try {
-  New-Item -Path $ownerPath -Force | Out-Null
-  New-ItemProperty -LiteralPath $ownerPath -Name Marker -Value $marker -PropertyType String -Force | Out-Null
-  New-ItemProperty -LiteralPath $ownerPath -Name TargetPort -Value '${port}' -PropertyType String -Force | Out-Null
-  & $netsh interface portproxy add v4tov4 listenaddress=127.0.0.1 listenport=80 connectaddress=127.0.0.1 connectport=${port} protocol=tcp | Out-Null
-  if ($LASTEXITCODE -ne 0) { throw 'Windows could not install the forwarding rule.' }
-  $installed = (Get-Item -LiteralPath $rulePath).GetValue($ruleName)
-  if ($installed -ne '127.0.0.1/${port}') { throw 'The installed forwarding rule did not match the requested destination.' }
-} catch {
-  if ($oldRule) {
-    & $netsh interface portproxy add v4tov4 listenaddress=127.0.0.1 listenport=80 connectaddress=127.0.0.1 "connectport=$oldPort" protocol=tcp | Out-Null
-    if ($LASTEXITCODE -eq 0) { Set-ItemProperty -LiteralPath $ownerPath -Name TargetPort -Value $oldPort }
-  } else {
-    & $netsh interface portproxy delete v4tov4 listenaddress=127.0.0.1 listenport=80 protocol=tcp | Out-Null
-    if ($LASTEXITCODE -eq 0) { Remove-Item -LiteralPath $ownerPath }
+async function isPortFree(port, host) {
+  for (const candidate of host ? [host] : ["127.0.0.1", "::1", "0.0.0.0", "::"]) {
+    if (await canBind(port, candidate, candidate === (host ?? "127.0.0.1")) === false)
+      return false;
   }
-  throw
+  return true;
 }
-`}`;
+function getFreePort(host = "127.0.0.1") {
+  return new Promise((resolve, reject) => {
+    const srv = net2.createServer();
+    srv.once("error", reject);
+    srv.listen(0, host, () => {
+      const { port } = srv.address();
+      srv.close(() => resolve(port));
+    });
+  });
 }
-function windowsElevationCommand(port, remove = false) {
-  const script = `try {
-${windowsForwarderScript(port, remove)}
-exit 0
-} catch { Write-Error $_ -ErrorAction Continue; exit 1 }`;
-  const encoded = Buffer.from(script, "utf16le").toString("base64");
-  return `$ErrorActionPreference = 'Stop'; $exe = Join-Path $env:SystemRoot 'System32\\WindowsPowerShell\\v1.0\\powershell.exe'; $child = Start-Process -FilePath $exe -Verb RunAs -ArgumentList '-NoLogo -NoProfile -NonInteractive -EncodedCommand ${encoded}' -PassThru -Wait; if ($child.ExitCode -ne 0) { throw 'Windows administrator setup failed.' }`;
+function serviceName(key) {
+  const separator = key.lastIndexOf(":");
+  return separator === -1 ? key : key.slice(separator + 1);
 }
-async function configureWindowsForwarder(port, remove = false) {
-  const script = windowsElevationCommand(port, remove);
-  try {
-    await execute("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], { windowsHide: true, timeout: 120000, maxBuffer: 8192 });
-  } catch {
-    throw new Error("Windows administrator setup was cancelled or failed. Port 80 may be occupied or reserved, or IP Helper may be disabled. Existing port-number links still work; retry from Settings.");
+function rememberedPortFromFile(key, file) {
+  const map = readJson(file, {});
+  if (map[key] !== undefined)
+    return map[key];
+  const name = serviceName(key);
+  const hasOtherQualifiedKey = Object.keys(map).some((candidate) => candidate !== key && candidate.includes(":") && candidate.endsWith(`:${name}`));
+  return hasOtherQualifiedKey ? undefined : map[name];
+}
+function rememberPort(name, port, file = PORTS_FILE) {
+  const map = readJson(file, {});
+  map[name] = port;
+  writeJson(file, map);
+}
+function forgetProjectPorts(projectId, file = PORTS_FILE) {
+  const map = readJson(file, {});
+  const kept = Object.fromEntries(Object.entries(map).filter(([key]) => !key.startsWith(`${projectId}:`)));
+  if (Object.keys(kept).length !== Object.keys(map).length)
+    writeJson(file, kept);
+}
+async function pickStablePort(name, taken, start = 4000, end = 4999, file = PORTS_FILE) {
+  const map = readJson(file, {});
+  const remembered = rememberedPortFromFile(name, file);
+  if (remembered) {
+    if (taken.has(remembered) || !await isPortFree(remembered)) {
+      throw new Error(`remembered stable port ${remembered} for "${name}" is already in use; stop the conflicting listener or explicitly choose a different port`);
+    }
+    return remembered;
   }
+  const bareName = serviceName(name);
+  const usingLegacy = map[name] === undefined && remembered === map[bareName];
+  const reserved = new Set(Object.entries(map).filter(([n]) => n !== name && !(usingLegacy && n === bareName)).map(([, p]) => p));
+  for (let p = start;p <= end; p++) {
+    if (taken.has(p) || reserved.has(p))
+      continue;
+    if (await isPortFree(p))
+      return p;
+  }
+  throw new Error(`no free port between ${start} and ${end}`);
 }
 
-// ../daemon/src/system-forwarder.ts
-import { execFile as execFile2 } from "node:child_process";
-import os2 from "node:os";
-import { promisify as promisify2 } from "node:util";
-var execute2 = promisify2(execFile2);
-var label = "dev.localdeck.port80";
-var SYSTEM_FORWARDER_PLIST = `/Library/LaunchDaemons/${label}.plist`;
-var destination = SYSTEM_FORWARDER_PLIST;
-var marker = "LocalDeck managed loopback relay v1";
-function forwarderPlist(user, port) {
-  if (!/^[a-zA-Z_][a-zA-Z0-9_.-]*$/.test(user) || user === "root")
-    throw new Error("Forwarding must run as a regular macOS user.");
-  if (!Number.isInteger(port) || port < 1 || port > 65535 || port === 80)
-    throw new Error("Invalid forwarding target port.");
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<!-- ${marker} -->
-<plist version="1.0"><dict>
-<key>Label</key><string>${label}</string>
-<key>UserName</key><string>${user}</string>
-<key>ProgramArguments</key><array><string>/usr/bin/nc</string><string>127.0.0.1</string><string>${port}</string></array>
-<key>inetdCompatibility</key><dict><key>Wait</key><false/></dict>
-<key>Sockets</key><dict><key>Listeners</key><dict>
-<key>SockNodeName</key><string>127.0.0.1</string>
-<key>SockServiceName</key><string>80</string>
-<key>SockFamily</key><string>IPv4</string>
-<key>SockType</key><string>stream</string>
-<key>SockProtocol</key><string>TCP</string>
-</dict></dict>
-</dict></plist>`;
-}
-function systemForwarderCommand(user, port, remove = false) {
-  const plist = forwarderPlist(user, port);
-  const guard = `set -eu
-if [ -L '${destination}' ]; then exit 1; fi
-if [ -e '${destination}' ] && ! /usr/bin/grep -q '${marker}' '${destination}'; then
-  echo 'Refusing to replace an unmanaged forwarding service.' >&2; exit 1
-fi`;
-  if (remove)
-    return `${guard}
-/bin/launchctl bootout system/${label} 2>/dev/null || true
-/bin/rm -f '${destination}'`;
-  return `${guard}
-relay_file=$(/usr/bin/mktemp /Library/LaunchDaemons/.localdeck-port80.XXXXXX)
-trap '/bin/rm -f "$relay_file" "$relay_file.backup"' EXIT
-/bin/cat > "$relay_file" <<'LOCALDECK_PLIST'
-${plist}
-LOCALDECK_PLIST
-/usr/bin/plutil -lint "$relay_file" >/dev/null
-/usr/sbin/chown root:wheel "$relay_file"
-/bin/chmod 644 "$relay_file"
-if [ -f '${destination}' ]; then /bin/cp -p '${destination}' "$relay_file.backup"; fi
-/bin/launchctl bootout system/${label} 2>/dev/null || true
-/bin/mv "$relay_file" '${destination}'
-if ! /bin/launchctl bootstrap system '${destination}'; then
-  /bin/rm -f '${destination}'
-  if [ -f "$relay_file.backup" ]; then
-    /bin/mv "$relay_file.backup" '${destination}'
-    /bin/launchctl bootstrap system '${destination}' || true
-  fi
-  exit 1
-fi`;
-}
-async function configureSystemForwarder(port, remove = false) {
-  if (process.platform === "win32")
-    return configureWindowsForwarder(port, remove);
-  if (process.platform !== "darwin")
-    throw new Error("Automatic administrator setup is available on macOS and Windows.");
-  const command = systemForwarderCommand(os2.userInfo().username, port, remove);
-  try {
-    await execute2("/usr/bin/osascript", ["-e", `on run argv
- do shell script (item 1 of argv) with administrator privileges
-end run`, command], { timeout: 120000, maxBuffer: 8192 });
-  } catch {
-    throw new Error("Administrator setup was cancelled or failed. Continuing with working port-number links; retry in Settings whenever you like.");
+// ../daemon/src/projects.ts
+class ProjectError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
   }
 }
 
-// ../daemon/src/clean-urls.ts
-class CleanUrls {
-  targetPort;
-  identity;
-  port;
-  platform;
-  preferenceFile;
-  configureSystem;
-  systemRelayInstalled;
-  bridge;
-  enabling;
-  closed = false;
-  constructor(targetPort, identity, port = 80, platform = process.platform, preferenceFile = path3.join(HOME_DIR, "forwarder.json"), configureSystem = configureSystemForwarder, systemRelayInstalled = () => fs3.existsSync(SYSTEM_FORWARDER_PLIST)) {
-    this.targetPort = targetPort;
-    this.identity = identity;
-    this.port = port;
-    this.platform = platform;
-    this.preferenceFile = preferenceFile;
-    this.configureSystem = configureSystem;
-    this.systemRelayInstalled = systemRelayInstalled;
+class ProjectRegistry {
+  catalogFile;
+  portsFile;
+  now;
+  projects;
+  constructor({ catalogFile = PROJECTS_FILE, portsFile = PORTS_FILE, now = Date.now } = {}) {
+    this.catalogFile = catalogFile;
+    this.portsFile = portsFile;
+    this.now = now;
+    this.projects = this.readCatalog();
   }
-  async status() {
-    const ready = await new Promise((resolve) => {
-      const request = http.get({ hostname: "127.0.0.1", port: this.port, path: "/api/forwarder/probe", agent: false }, (response) => {
-        let body = "";
-        response.on("data", (chunk) => {
-          body += chunk;
-          if (body.length > 256)
-            request.destroy();
-        });
-        response.on("end", () => resolve(response.statusCode === 200 && body === this.identity));
-        response.on("error", () => resolve(false));
+  remember(file, now = this.now()) {
+    const realFile = fs3.realpathSync(file);
+    const config = loadProjectFile(realFile);
+    const id = projectId(realFile);
+    const name = path3.basename(path3.dirname(realFile));
+    const directory = path3.dirname(realFile);
+    const existing = this.projects.find((entry) => entry.id === id);
+    const alias = config.nickname ? this.configAlias(id, realFile, config.nickname) : undefined;
+    if (existing) {
+      existing.name = name;
+      existing.file = realFile;
+      existing.directory = directory;
+      existing.lastUsedAt = now;
+      existing.configNickname = config.nickname;
+      if (alias) {
+        existing.sharedConfigNickname = true;
+        if (!existing.nickname)
+          existing.nickname = alias;
+      }
+    } else {
+      this.projects.push({
+        id,
+        name,
+        slug: this.assignSlug(name, id),
+        file: realFile,
+        directory,
+        lastUsedAt: now,
+        ...config.nickname ? { configNickname: config.nickname } : {},
+        ...alias ? { nickname: alias, sharedConfigNickname: true } : {}
       });
-      const timer = setTimeout(() => {
-        request.destroy();
-        resolve(false);
-      }, 1500);
-      request.on("close", () => clearTimeout(timer));
-      request.on("error", () => resolve(false));
-    });
-    return { ready: ready && !this.closed };
+    }
+    this.persist();
+    return this.toSummary(this.byId(id));
   }
-  enable(options = {}) {
-    if (this.enabling)
-      return this.enabling;
-    this.enabling = this.start(options).finally(() => {
-      this.enabling = undefined;
-    });
-    return this.enabling;
+  list() {
+    return this.sorted().map((project) => this.toSummary(project));
   }
-  async start(options) {
-    if (this.closed)
-      return { ready: false, error: "LocalDeck is shutting down." };
-    const preference = this.preferenceFile;
-    const saved = readJson(preference, {});
-    if (saved.removed) {
-      if (options.automatic)
-        return { ready: false, error: "Clean URLs are turned off; enable them in the dashboard to use them again." };
-      writeJson(preference, { declined: saved.declined });
-    }
-    if (this.platform === "win32" && options.install && this.port === 80 && !(options.automatic && readJson(preference, {}).declined)) {
-      if (!this.bridge && (await this.status()).ready)
-        return { ready: true };
-      if (this.bridge) {
-        await this.bridge.close();
-        this.bridge = undefined;
-      }
-      try {
-        writeJson(preference, { declined: true });
-        await this.configureSystem(this.targetPort());
-        let ready = false;
-        for (let attempt = 0;attempt < 20 && !this.closed; attempt++) {
-          if ((await this.status()).ready) {
-            ready = true;
-            break;
-          }
-          await new Promise((resolve) => setTimeout(resolve, 250));
-        }
-        if (!ready)
-          throw new Error("Windows setup completed but forwarding could not be verified. Port-number links remain available; retry in Settings.");
-        writeJson(preference, { declined: false });
-        return { ready: true };
-      } catch (error) {
-        return { ready: false, error: error instanceof Error ? error.message : "Windows setup failed." };
-      }
-    }
-    if ((await this.status()).ready)
-      return { ready: true };
+  details(projectId, profiles) {
+    const project = this.require(projectId);
+    let loaded;
     try {
-      if (this.closed)
-        return { ready: false, error: "LocalDeck is shutting down." };
-      this.bridge ??= await startForwarder({ listenPort: this.port, targetPort: this.targetPort() });
-      if (this.closed) {
-        await this.bridge.close();
-        this.bridge = undefined;
-        return { ready: false, error: "LocalDeck is shutting down." };
-      }
-      if ((await this.status()).ready)
-        return { ready: true };
-      return { ready: false, error: "Port 80 does not reach this LocalDeck instance. Your existing links are unchanged." };
+      loaded = this.load(project);
     } catch (error) {
-      const message = error instanceof Error ? error.message : "Could not start port-80 forwarding.";
-      const preference2 = this.preferenceFile;
-      if (options.install && this.port === 80 && this.platform === "darwin" && message.includes("permission denied") && !(options.automatic && readJson(preference2, {}).declined)) {
-        try {
-          writeJson(preference2, { declined: true });
-          await this.configureSystem(this.targetPort());
-          const result = await this.status();
-          if (!result.ready)
-            throw new Error("Setup completed but forwarding could not be verified. Your original links are unchanged.");
-          writeJson(preference2, { declined: false });
-          return result;
-        } catch (setupError) {
-          return { ready: false, error: setupError instanceof Error ? setupError.message : "Administrator setup failed." };
-        }
-      }
-      return { ready: false, error: message };
+      return { ...project, available: false, error: errorMessage(error), commands: [] };
     }
-  }
-  async uninstall() {
-    if (this.enabling)
-      return { ready: false, error: "Wait for the current setup to finish." };
+    const wanted = profiles ?? project.activeProfiles ?? [];
+    const { activeProfiles: _stored, ...remembered } = project;
+    const base = { ...remembered, nickname: this.nickname(projectId), available: true, ...loaded.legacyProfiles ? { legacyProfiles: loaded.legacyProfiles } : {} };
+    const summaries = (active) => loaded.profiles?.length ? { profiles: loaded.profiles.map((profile) => ({ name: profile.name, ...profile.description ? { description: profile.description } : {}, services: Object.keys(profile.services), active: active.includes(profile.name) })) } : {};
     try {
-      const hadBridge = Boolean(this.bridge);
-      if (this.bridge) {
-        await this.bridge.close();
-        this.bridge = undefined;
-      }
-      if (this.platform === "darwin" ? this.systemRelayInstalled() : this.platform === "win32" && this.port === 80 && !hadBridge)
-        await this.configureSystem(this.targetPort(), true);
-      writeJson(this.preferenceFile, { declined: true, removed: true });
-      return { ready: false, removed: true };
+      const resolved = applyProfiles(loaded, wanted);
+      return {
+        ...base,
+        ...resolved.active.length ? { activeProfiles: resolved.active } : {},
+        commands: resolved.commands,
+        ...summaries(resolved.active),
+        ...resolved.clashes.length ? { profileClashes: resolved.clashes } : {},
+        provenance: resolved.provenance,
+        fingerprints: Object.fromEntries(resolved.commands.map((command) => [command.name, commandFingerprint(command)]))
+      };
     } catch (error) {
-      return { ready: false, error: error instanceof Error ? error.message : "Removal failed." };
+      const active = (loaded.profiles ?? []).map((profile) => profile.name).filter((name) => wanted.includes(name));
+      return { ...base, ...active.length ? { activeProfiles: active } : {}, commands: loaded.commands, ...summaries(active), profileError: errorMessage(error) };
     }
   }
-  async close() {
-    this.closed = true;
-    await this.enabling;
-    if (this.bridge) {
-      await this.bridge.close();
-      this.bridge = undefined;
+  resolve(projectId, serviceName2, profiles) {
+    const details = this.details(projectId, profiles);
+    if (!details.available)
+      throw new ProjectError("invalid", details.error);
+    if (details.profileError)
+      throw new ProjectError("invalid", details.profileError);
+    const command = details.commands.find((candidate) => candidate.name === serviceName2.toLowerCase());
+    if (!command)
+      throw new ProjectError("not_found", `Project ${projectId} has no service named ${serviceName2}`);
+    return command;
+  }
+  forget(projectId, activeKeys) {
+    this.require(projectId);
+    if ([...activeKeys].some((key) => key.startsWith(`${projectId}:`))) {
+      throw new ProjectError("active", "stop its services before forgetting it");
     }
+    this.projects = this.projects.filter((project) => project.id !== projectId);
+    this.persist();
+    forgetProjectPorts(projectId, this.portsFile);
   }
-}
-
-// ../daemon/src/api.ts
-import fs7 from "node:fs";
-import path7 from "node:path";
-
-// ../daemon/src/request-body.ts
-import { brotliDecompressSync, gunzipSync, inflateSync } from "node:zlib";
-var MAX_BODY_CAPTURE_BYTES = 16384;
-
-class BodyCapture {
-  limit;
-  chunks = [];
-  retained = 0;
-  bytes = 0;
-  tailUsed = 0;
-  constructor(limit = MAX_BODY_CAPTURE_BYTES) {
-    this.limit = limit;
+  refresh(projectId) {
+    return this.details(projectId);
   }
-  append(chunk) {
-    this.bytes += chunk.length;
-    const count = Math.min(chunk.length, this.limit - this.retained);
-    let offset = 0;
-    while (offset < count) {
-      let tail = this.chunks.at(-1);
-      if (!tail || this.tailUsed === tail.length) {
-        if (tail && tail.length < 4096) {
-          const grown = Buffer.allocUnsafe(Math.min(4096, this.limit - this.retained + this.tailUsed, Math.max(tail.length * 2, count - offset)));
-          tail.copy(grown, 0, 0, this.tailUsed);
-          this.chunks[this.chunks.length - 1] = tail = grown;
-        } else {
-          tail = Buffer.allocUnsafe(Math.min(4096, this.limit - this.retained, Math.max(64, count - offset)));
-          this.chunks.push(tail);
-          this.tailUsed = 0;
-        }
-      }
-      const size = Math.min(count - offset, tail.length - this.tailUsed);
-      chunk.copy(tail, this.tailUsed, offset, offset + size);
-      this.tailUsed += size;
-      this.retained += size;
-      offset += size;
+  nickname(projectId) {
+    const project = this.byId(projectId);
+    return project?.nickname ?? project?.configNickname;
+  }
+  updateNickname(projectId, value) {
+    const project = this.require(projectId);
+    const nickname = value.trim().toLowerCase();
+    if (nickname && (!validNickname(nickname) || nickname === "standalone")) {
+      throw new ProjectError("invalid", "Use 1–63 letters, numbers or hyphens, with no leading or trailing hyphen. 'standalone' is reserved.");
+    }
+    if (nickname)
+      this.assertNicknameAvailable(projectId, nickname);
+    const previous = project.nickname;
+    if (nickname)
+      project.nickname = nickname;
+    else
+      delete project.nickname;
+    try {
+      this.persist();
+    } catch (error) {
+      if (previous === undefined)
+        delete project.nickname;
+      else
+        project.nickname = previous;
+      throw error;
     }
+    return this.details(projectId);
   }
-  snapshot(complete, contentEncoding) {
-    let buffer = Buffer.concat(this.chunks.map((chunk, index) => index === this.chunks.length - 1 ? chunk.subarray(0, this.tailUsed) : chunk), this.retained);
-    let encoded = Boolean(contentEncoding && contentEncoding !== "identity");
-    const truncated = this.bytes > this.retained;
-    if (encoded && complete && !truncated && buffer.length) {
-      const decode = { gzip: gunzipSync, deflate: inflateSync, br: brotliDecompressSync }[contentEncoding];
-      try {
-        if (decode) {
-          buffer = decode(buffer, { maxOutputLength: this.limit });
-          encoded = false;
-        }
-      } catch {}
+  saveConfigNickname(projectId, value) {
+    const project = this.require(projectId);
+    const nickname = value.trim().toLowerCase();
+    if (nickname && (!validNickname(nickname) || nickname === "standalone"))
+      throw new ProjectError("invalid", "Use 1–63 letters, numbers or interior hyphens; standalone is reserved.");
+    if (nickname)
+      this.assertNicknameAvailable(projectId, nickname);
+    try {
+      updateProjectNickname(project.file, nickname);
+    } catch (error) {
+      throw new ProjectError("invalid", errorMessage(error));
     }
-    let data;
-    let encoding = "utf8";
+    project.configNickname = nickname || undefined;
+    return this.updateNickname(projectId, "");
+  }
+  setActiveProfiles(projectId, names) {
+    const project = this.require(projectId);
+    if (!Array.isArray(names) || !names.every((name) => typeof name === "string"))
+      throw new ProjectError("invalid", "profiles must be an array of profile names");
+    let defined;
     try {
-      if (encoded || buffer.includes(0))
-        throw new Error("binary body");
-      data = new TextDecoder("utf-8", { fatal: true }).decode(buffer);
+      defined = (this.load(project).profiles ?? []).map((profile) => profile.name);
+    } catch (error) {
+      throw new ProjectError("invalid", errorMessage(error));
+    }
+    const requested = names.map((name) => name.toLowerCase());
+    const unknown = requested.filter((name) => !defined.includes(name));
+    if (unknown.length)
+      throw new ProjectError("invalid", `Unknown profile${unknown.length > 1 ? "s" : ""} ${unknown.join(", ")}. Available profiles: ${defined.join(", ") || "(none)"}`);
+    const previous = project.activeProfiles;
+    const active = defined.filter((name) => requested.includes(name));
+    if (active.length)
+      project.activeProfiles = active;
+    else
+      delete project.activeProfiles;
+    try {
+      this.persist();
+    } catch (error) {
+      if (previous === undefined)
+        delete project.activeProfiles;
+      else
+        project.activeProfiles = previous;
+      throw error;
+    }
+    return this.details(projectId);
+  }
+  updateDependencies(projectId, serviceName2, after) {
+    const project = this.require(projectId);
+    try {
+      updateProjectDependencies(project.file, serviceName2, after);
+      return this.details(projectId);
+    } catch (error) {
+      throw new ProjectError("invalid", errorMessage(error));
+    }
+  }
+  updateServiceConfig(projectId, serviceName2, settings) {
+    const project = this.require(projectId);
+    try {
+      updateProjectServiceConfig(project.file, serviceName2, settings);
+      return this.details(projectId);
+    } catch (error) {
+      throw new ProjectError("invalid", errorMessage(error));
+    }
+  }
+  readCatalog() {
+    if (!fs3.existsSync(this.catalogFile))
+      return [];
+    try {
+      const parsed = JSON.parse(fs3.readFileSync(this.catalogFile, "utf8"));
+      if (!isCatalog(parsed))
+        throw new Error("invalid project catalog");
+      return parsed.projects;
     } catch {
-      data = buffer.toString("base64");
-      encoding = "base64";
+      fs3.renameSync(this.catalogFile, this.nextCorruptFile());
+      return [];
     }
-    return { data, encoding, bytes: this.bytes, truncated, complete, ...encoded ? { contentEncoding } : {} };
+  }
+  assertNicknameAvailable(projectId, nickname) {
+    if (this.projects.some((other) => other.id !== projectId && (other.slug === nickname || (other.nickname ?? other.configNickname) === nickname || !other.sharedConfigNickname && other.configNickname === nickname))) {
+      throw new ProjectError("invalid", "That project nickname is already taken. Choose another.");
+    }
+  }
+  configAlias(id, file, nickname) {
+    const collisions = this.projects.filter((other) => other.id !== id && (other.slug === nickname || (other.nickname ?? other.configNickname) === nickname || !other.sharedConfigNickname && other.configNickname === nickname));
+    if (!collisions.length)
+      return;
+    const location = repositoryLocation(file);
+    if (!location || collisions.some((other) => {
+      const candidate = repositoryLocation(other.file);
+      return !candidate || candidate.repository !== location.repository || candidate.relativeFile !== location.relativeFile;
+    }))
+      this.assertNicknameAvailable(id, nickname);
+    const existing = this.byId(id)?.nickname;
+    if (existing)
+      return existing;
+    const base = `${nickname.slice(0, 46)}-${id.slice(0, 8)}`;
+    let alias = base;
+    let suffix = 2;
+    while (this.projects.some((other) => other.id !== id && (other.slug === alias || (other.nickname ?? other.configNickname) === alias || !other.sharedConfigNickname && other.configNickname === alias)))
+      alias = `${base}-${suffix++}`;
+    return alias;
+  }
+  nextCorruptFile() {
+    const base = `${this.catalogFile}.corrupt-${this.now()}`;
+    let candidate = base;
+    let suffix = 2;
+    while (fs3.existsSync(candidate))
+      candidate = `${base}-${suffix++}`;
+    return candidate;
+  }
+  persist() {
+    writeJson(this.catalogFile, { version: 1, projects: this.sortedEntries() });
+  }
+  sorted() {
+    return this.sortedEntries().map((project) => ({ ...project }));
+  }
+  sortedEntries() {
+    return [...this.projects].sort((a, b) => b.lastUsedAt - a.lastUsedAt);
+  }
+  toSummary(project) {
+    try {
+      this.load(project);
+      return { ...project, nickname: this.nickname(project.id), available: true };
+    } catch (error) {
+      return { ...project, available: false, error: errorMessage(error) };
+    }
+  }
+  load(project) {
+    if (!fs3.existsSync(project.file))
+      throw new Error(`${project.file} does not exist`);
+    const loaded = loadProjectFile(project.file);
+    if (loaded.nickname) {
+      const alias = this.configAlias(project.id, project.file, loaded.nickname);
+      if (alias) {
+        project.sharedConfigNickname = true;
+        if (!project.nickname)
+          project.nickname = alias;
+      }
+    }
+    project.configNickname = loaded.nickname;
+    return loaded;
+  }
+  require(projectId) {
+    const project = this.byId(projectId);
+    if (!project)
+      throw new ProjectError("not_found", `Project ${projectId} was not found`);
+    return project;
+  }
+  byId(projectId) {
+    return this.projects.find((project) => project.id === projectId);
+  }
+  assignSlug(name, id) {
+    const base = slugify(name) || "project";
+    if (!this.projects.some((project) => project.slug === base || project.nickname === base || project.configNickname === base))
+      return base;
+    const suffix = id.slice(0, 6);
+    let slug = `${base}-${suffix}`;
+    let collision = 2;
+    while (this.projects.some((project) => project.slug === slug || project.nickname === slug || project.configNickname === slug))
+      slug = `${base}-${suffix}-${collision++}`;
+    return slug;
   }
 }
-
-// ../daemon/src/request-headers.ts
-var MAX_HEADER_BYTES = 16384;
-var MAX_HEADER_COUNT = 100;
-function captureHeaders(raw) {
-  const entries = [];
-  let bytes = 0;
-  for (let i = 0;i + 1 < raw.length; i += 2) {
-    const name = raw[i];
-    const value = raw[i + 1];
-    bytes += Buffer.byteLength(name) + Buffer.byteLength(value);
-    if (bytes > MAX_HEADER_BYTES || entries.length >= MAX_HEADER_COUNT)
-      return { entries, truncated: true };
-    entries.push([name, value]);
+function projectId(realFile) {
+  return createHash2("sha256").update(realFile).digest("hex").slice(0, 16);
+}
+function slugify(value) {
+  return value.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function isCatalog(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const catalog = value;
+  return catalog.version === 1 && Array.isArray(catalog.projects) && catalog.projects.every(isRememberedProject);
+}
+function isRememberedProject(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const project = value;
+  if (!["id", "name", "slug", "file", "directory"].every((key) => typeof project[key] === "string"))
+    return false;
+  const { id, slug, file, directory } = project;
+  return path3.isAbsolute(file) && path3.normalize(file) === file && directory === path3.dirname(file) && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(slug) && /^[a-f0-9]{16}$/.test(id) && (project.nickname === undefined || typeof project.nickname === "string" && validNickname(project.nickname)) && (project.configNickname === undefined || typeof project.configNickname === "string" && validNickname(project.configNickname)) && (project.sharedConfigNickname === undefined || typeof project.sharedConfigNickname === "boolean") && (project.activeProfiles === undefined || Array.isArray(project.activeProfiles) && project.activeProfiles.every((name) => typeof name === "string" && /^[a-z0-9][a-z0-9_-]{0,40}$/.test(name))) && id === projectId(file) && typeof project.lastUsedAt === "number" && Number.isFinite(project.lastUsedAt);
+}
+function validNickname(value) {
+  return value.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function gitMetadata(directory, args) {
+  return execFileSync("git", ["-C", directory, ...args], { encoding: "utf8", timeout: 2000, maxBuffer: 1024 * 1024, stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_OPTIONAL_LOCKS: "0" } });
+}
+function repositoryLocation(file) {
+  try {
+    const directory = path3.dirname(file);
+    const root = fs3.realpathSync(gitMetadata(directory, ["rev-parse", "--show-toplevel"]).replace(/\r?\n$/, ""));
+    const common = gitMetadata(directory, ["rev-parse", "--git-common-dir"]).replace(/\r?\n$/, "");
+    const repository = fs3.realpathSync(path3.resolve(directory, common));
+    const relativeFile = path3.relative(root, file);
+    if (relativeFile.startsWith("../") || path3.isAbsolute(relativeFile))
+      return;
+    return { root, repository, relativeFile };
+  } catch {
+    return;
   }
-  return { entries, truncated: false };
 }
 
-// ../daemon/src/proxy.ts
-import http2 from "node:http";
-import net2 from "node:net";
-var HOP_BY_HOP = new Set(["connection", "keep-alive", "proxy-authenticate", "proxy-authorization", "te", "trailer", "transfer-encoding", "upgrade"]);
-function forwardHeaders(req, target) {
-  const out = {};
-  for (const [k, v] of Object.entries(req.headers)) {
-    if (HOP_BY_HOP.has(k) || v === undefined)
+// ../daemon/src/worktrees.ts
+var sharedResourceNotice = "Worktrees have separate processes and automatic ports. Databases, Docker resources, secrets, and external services may still be shared by configuration.";
+function discoverWorktrees(projects, projectId2) {
+  const project = projects.details(projectId2);
+  const location = repositoryLocation(project.file);
+  if (!location)
+    return { environments: [], error: "Git repository metadata is unavailable for this project.", sharedResourceNotice };
+  let output;
+  try {
+    output = gitMetadata(location.root, ["worktree", "list", "--porcelain", "-z"]);
+  } catch {
+    return { environments: [], error: "Unable to list Git worktrees.", sharedResourceNotice };
+  }
+  const registered = new Map(projects.list().map((p) => [p.file, p]));
+  const environments = [];
+  for (const record of output.split("\x00\x00")) {
+    const fields = record.split("\x00");
+    const directoryField = fields.find((field) => field.startsWith("worktree "));
+    if (!directoryField)
       continue;
-    out[k] = v;
-  }
-  if (target.via === "share") {
-    const host = net2.isIP(target.upstreamHost) === 6 ? `[${target.upstreamHost}]` : target.upstreamHost;
-    out.host = `${host}:${target.upstreamPort}`;
+    let directory = path4.resolve(directoryField.slice(9));
+    try {
+      directory = fs4.realpathSync(directory);
+    } catch {}
+    const candidateFile = path4.join(directory, location.relativeFile);
+    let configFile = candidateFile;
+    let error;
+    try {
+      const realFile = fs4.realpathSync(candidateFile);
+      const candidate = repositoryLocation(realFile);
+      if (!candidate || candidate.repository !== location.repository || candidate.relativeFile !== location.relativeFile || candidate.root !== directory)
+        throw new Error("Configuration resolves outside this worktree.");
+      configFile = realFile;
+      loadProjectFile(configFile);
+    } catch (cause) {
+      error = cause instanceof Error ? cause.message : String(cause);
+    }
+    const known = registered.get(configFile);
+    const branch = fields.find((field) => field.startsWith("branch "))?.slice(7).replace(/^refs\/heads\//, "");
+    environments.push({
+      id: createHash3("sha256").update(configFile).digest("hex").slice(0, 16),
+      ...known ? { projectId: known.id } : {},
+      directory,
+      configFile,
+      ...branch ? { branch } : {},
+      head: fields.find((field) => field.startsWith("HEAD "))?.slice(5),
+      detached: fields.includes("detached"),
+      available: !error,
+      registered: !!known,
+      current: configFile === project.file,
+      ...error ? { error } : {}
+    });
   }
-  const remote = req.socket.remoteAddress ?? "";
-  out["x-forwarded-for"] = req.headers["x-forwarded-for"] ? `${req.headers["x-forwarded-for"]}, ${remote}` : remote;
-  out["x-forwarded-proto"] = target.via === "share" ? "https" : "http";
-  out["x-forwarded-host"] = req.headers.host ?? "";
-  out["x-localdeck-service"] = target.service;
-  return out;
+  return { environments, repository: location.repository, relativeConfig: location.relativeFile, sharedResourceNotice };
 }
-function waitingPage(target) {
-  return `<!doctype html><meta charset="utf-8"><meta http-equiv="refresh" content="2">
-<title>LocalDeck — waiting for ${target.service}</title>
-<style>body{font:15px/1.5 system-ui;margin:0;display:grid;place-items:center;height:100vh;background:#0f1115;color:#e6e8ef}
-.c{max-width:420px;text-align:center}code{background:#1c1f27;padding:2px 6px;border-radius:4px}</style>
-<div class="c"><h1 style="font-weight:600">Waiting for <code>${target.service}</code></h1>
-<p>LocalDeck is holding this port. Nothing is listening on the upstream port <code>${target.upstreamPort}</code> yet.
-This page reloads every 2 seconds.</p></div>`;
+function registerWorktree(projects, projectId2, environmentId) {
+  const discovered = discoverWorktrees(projects, projectId2);
+  const environment = discovered.environments.find((candidate) => candidate.id === environmentId);
+  if (!environment)
+    throw new ProjectError("not_found", "This environment is not a discovered worktree of the selected project.");
+  if (!environment.available)
+    throw new ProjectError("invalid", environment.error ?? "This environment is unavailable.");
+  return projects.remember(environment.configFile);
 }
-function proxyRequest(req, res, target, hooks) {
-  const started = Date.now();
-  const requestHeaders = captureHeaders(req.rawHeaders);
-  const requestBody = new BodyCapture;
-  const responseBody = new BodyCapture;
-  const fullResponse = hooks.responseBodies?.start(target.service);
-  const captureResponse = (chunk) => {
-    responseBody.append(chunk);
-    fullResponse?.append(chunk);
-  };
-  let responseComplete = false;
-  let responseEncoding;
-  let responseHeaders;
-  let bytes = 0;
-  let recorded = false;
-  const record = (status, error) => {
-    if (recorded)
-      return;
-    recorded = true;
-    fullResponse?.finish(responseComplete, responseEncoding);
-    hooks.onRequest({
-      ts: started,
-      service: target.service,
-      method: req.method ?? "GET",
-      path: req.url ?? "/",
-      status,
-      durationMs: Date.now() - started,
-      bytes,
-      via: target.via,
-      error,
-      requestHeaders,
-      responseHeaders,
-      requestBody: requestBody.snapshot(req.readableEnded, req.headers["content-encoding"]),
-      responseBody: responseBody.snapshot(responseComplete, responseEncoding),
-      responseBodyId: fullResponse?.id
-    });
-  };
-  if (!target.upstreamReady) {
-    responseHeaders = captureHeaders(["content-type", "text/html; charset=utf-8", "retry-after", "2"]);
-    res.writeHead(503, { "content-type": "text/html; charset=utf-8", "retry-after": "2" });
-    const body = waitingPage(target);
-    captureResponse(Buffer.from(body));
-    responseComplete = true;
-    res.end(body);
-    record(503, "upstream not ready");
-    return;
-  }
-  let responseStatus = 502;
-  let response;
-  const upstream = http2.request({ host: target.upstreamHost, port: target.upstreamPort, method: req.method, path: req.url, headers: forwardHeaders(req, target) }, (up) => {
-    if (res.destroyed) {
-      up.destroy();
-      return;
-    }
-    response = up;
-    responseHeaders = captureHeaders(up.rawHeaders);
-    responseEncoding = up.headers["content-encoding"];
-    up.on("end", () => {
-      responseComplete = true;
-    });
-    responseStatus = up.statusCode ?? 502;
-    up.on("error", (error) => {
-      record(502, `upstream response error: ${error.message}`);
-      res.destroy();
-    });
-    up.on("aborted", () => {
-      record(502, "upstream response aborted");
-      res.destroy();
+
+// ../daemon/src/reproductions.ts
+import path5 from "node:path";
+import fs5 from "node:fs";
+import { randomUUID } from "node:crypto";
+
+// ../daemon/src/replay.ts
+import http from "node:http";
+function replayRequest(service, record, options = {}) {
+  if (record.service !== service.key || !["GET", "HEAD"].includes(record.method))
+    throw new Error("Only recorded GET and HEAD requests for this service can be replayed");
+  if (service.status !== "running" || !service.upstreamReady || service.serviceType && service.serviceType !== "http")
+    throw new Error("The HTTP service must be running before replay");
+  if (!["127.0.0.1", "::1"].includes(service.upstreamHost) || !record.path.startsWith("/") || record.path.startsWith("//") || /[\r\n\\\x00-\x20\x7f]/.test(record.path))
+    throw new Error("Request path must be a local HTTP path");
+  const timeoutMs = options.timeoutMs ?? 5000;
+  const maxBytes = options.maxBytes ?? 65536;
+  if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 5000 || !Number.isInteger(maxBytes) || maxBytes < 1 || maxBytes > 65536)
+    throw new Error("Replay limits must be positive integers within 5000 ms and 65536 bytes");
+  return new Promise((resolve, reject) => {
+    const started = Date.now();
+    let settled = false;
+    let bytes = 0;
+    const chunks = [];
+    const request = http.request({ host: service.upstreamHost, port: service.upstreamPort, path: record.path, method: record.method, headers: { "x-localdeck-replay": "1" } });
+    const timer = setTimeout(() => {
+      if (!settled) {
+        settled = true;
+        reject(new Error("Replay timed out"));
+      }
+      request.destroy();
+    }, timeoutMs);
+    const finish = (status, truncated) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({ status, truncated, body: Buffer.concat(chunks).toString("utf8"), durationMs: Date.now() - started });
+    };
+    request.on("response", (response) => {
+      response.on("data", (chunk) => {
+        const remaining = Math.max(0, maxBytes - bytes);
+        chunks.push(chunk.subarray(0, remaining));
+        bytes += chunk.length;
+        if (bytes > maxBytes) {
+          finish(response.statusCode ?? 502, true);
+          response.destroy();
+          request.destroy();
+        }
+      });
+      response.on("end", () => finish(response.statusCode ?? 502, false));
+      response.on("error", (error) => request.destroy(error));
+      response.on("aborted", () => request.destroy(new Error("Replay response was interrupted")));
     });
-    const headers = { ...up.headers };
-    res.writeHead(up.statusCode ?? 502, up.statusMessage, headers);
-    up.on("data", (chunk) => {
-      bytes += chunk.length;
-      captureResponse(chunk);
+    request.on("error", (error) => {
+      clearTimeout(timer);
+      if (!settled) {
+        settled = true;
+        reject(error);
+      }
     });
-    up.pipe(res);
+    request.end();
   });
-  upstream.on("error", (err) => {
-    if (!res.headersSent)
-      responseHeaders = captureHeaders(["content-type", "text/plain; charset=utf-8"]);
-    if (!res.headersSent && !res.destroyed) {
-      res.writeHead(502, { "content-type": "text/plain; charset=utf-8" });
-      const body = `LocalDeck: upstream ${target.service} (${target.upstreamHost}:${target.upstreamPort}) error: ${err.code ?? err.message}`;
-      captureResponse(Buffer.from(body));
-      responseComplete = true;
-      res.end(body);
+}
+
+// ../daemon/src/reproductions.ts
+var sensitive = /authorization|cookie|token|secret|password|passwd|api[-_]?key|credential|session|signature/i;
+var quote = (value) => "'" + value.replace(/'/g, "'\\''") + "'";
+function validPath(value) {
+  return typeof value === "string" && value.length <= 8192 && value.startsWith("/") && !value.startsWith("//") && !/[\r\n\\\x00-\x20\x7f#]/.test(value);
+}
+function redact(value, secrets) {
+  for (const secret of secrets.filter(Boolean))
+    value = value.split(secret).join("[REDACTED]");
+  return value;
+}
+function sanitizeRequest(record, baseUrl, secrets = []) {
+  if (!validPath(record.path) || !/^[A-Z]+$/.test(record.method))
+    throw new Error("Request must have a valid local HTTP path and method");
+  const base = new URL(baseUrl);
+  if (!["http:", "https:"].includes(base.protocol) || base.username || base.password)
+    throw new Error("Export requires an HTTP base URL without credentials");
+  const omitted = [];
+  const [pathname, query] = record.path.split(/\?(.*)/s);
+  let safePath = redact(pathname, secrets.flatMap((secret) => [secret, encodeURIComponent(secret)]));
+  if (safePath === pathname && secrets.some((secret) => secret && decodeURIComponentSafe(pathname).includes(secret)))
+    safePath = "/[REDACTED]";
+  if (query !== undefined) {
+    let changed = false;
+    const params = new URLSearchParams(query);
+    const sanitized = new URLSearchParams;
+    for (const [key, value] of [...params]) {
+      const safe = sensitive.test(key) ? "[REDACTED]" : redact(value, secrets);
+      const safeKey = redact(key, secrets);
+      sanitized.append(safeKey, safe);
+      if (safe !== value || safeKey !== key) {
+        changed = true;
+        omitted.push("Sensitive query values redacted");
+      }
+    }
+    safePath += "?" + (changed ? sanitized.toString() : query);
+  }
+  if (safePath.split("?")[0] !== pathname)
+    omitted.push("Secret in path redacted");
+  const headers = [];
+  for (const [key, value] of record.requestHeaders?.entries ?? []) {
+    if (!["accept", "content-type"].includes(key.toLowerCase()) || sensitive.test(value) || redact(value, secrets) !== value || /[\r\n]/.test(value)) {
+      omitted.push(`Header ${sensitive.test(key) ? "credential" : "non-representation"} omitted`);
+      continue;
+    }
+    headers.push([key, value]);
+  }
+  if (record.requestHeaders?.truncated)
+    omitted.push("Header capture incomplete");
+  let body;
+  const captured = record.requestBody;
+  const hasBody = !!captured && (captured.bytes > 0 || captured.data.length > 0 || !captured.complete || captured.truncated);
+  if (captured && hasBody) {
+    const contentType = headers.find(([key]) => key.toLowerCase() === "content-type")?.[1] ?? "";
+    if (!captured.complete || captured.truncated || captured.encoding !== "utf8" || captured.contentEncoding && captured.contentEncoding !== "identity")
+      omitted.push("Incomplete, binary or encoded body omitted");
+    else if (/application\/json/i.test(contentType)) {
+      try {
+        body = JSON.stringify(JSON.parse(captured.data), (key, value) => sensitive.test(key) ? "[REDACTED]" : typeof value === "string" ? redact(value, secrets) : value);
+      } catch {
+        omitted.push("Invalid JSON body omitted");
+      }
+    } else if (/application\/x-www-form-urlencoded/i.test(contentType)) {
+      const params = new URLSearchParams(captured.data);
+      for (const [key, value] of [...params])
+        params.set(key, sensitive.test(key) ? "[REDACTED]" : redact(value, secrets));
+      body = params.toString();
     } else
-      res.destroy();
-    record(502, err.code ?? err.message);
-  });
-  const clientDisconnected = () => {
-    record(499, "client disconnected before response completed");
-    response?.destroy();
-    upstream.destroy();
-  };
-  req.on("aborted", clientDisconnected);
-  res.on("finish", () => record(responseStatus));
-  res.on("close", () => {
-    if (!res.writableFinished)
-      clientDisconnected();
-  });
-  req.on("data", (chunk) => requestBody.append(chunk));
-  req.pipe(upstream);
+      omitted.push("Unsupported body format omitted");
+    if (body !== undefined && body !== captured.data)
+      omitted.push("Body sanitized");
+  }
+  const request = { method: record.method, url: base.origin + safePath, headers, ...body === undefined ? {} : { body } };
+  const curl = ["curl", "--globoff", "--path-as-is", "--request", quote(request.method), "--url", quote(request.url), ...headers.flatMap(([key, value]) => ["--header", quote(`${key}: ${value}`)]), ...body === undefined ? [] : ["--data-raw", quote(body)]].join(" ");
+  const executable = ["GET", "HEAD"].includes(record.method) && !hasBody && !omitted.some((item) => item.includes("query") || item.includes("path"));
+  return { request, curl, omitted: [...new Set(omitted)], executable };
 }
-function proxyUpgrade(req, socket, head, target, hooks) {
-  const started = Date.now();
-  socket.on("error", () => socket.destroy());
-  if (!target.upstreamReady) {
-    socket.end(`HTTP/1.1 503 Service Unavailable\r
-Connection: close\r
-\r
-`);
-    return;
+function decodeURIComponentSafe(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
   }
-  const up = net2.connect(target.upstreamPort, target.upstreamHost, () => {
-    const headers = forwardHeaders(req, target);
-    headers["connection"] = "Upgrade";
-    headers["upgrade"] = req.headers["upgrade"];
-    const lines = [`${req.method} ${req.url} HTTP/1.1`];
-    for (const [k, v] of Object.entries(headers)) {
-      if (v === undefined)
-        continue;
-      for (const val of Array.isArray(v) ? v : [String(v)])
-        lines.push(`${k}: ${val}`);
+}
+function loadChecks(file) {
+  try {
+    if (fs5.statSync(file).size > 2000000)
+      return [];
+    const raw = JSON.parse(fs5.readFileSync(file, "utf8"));
+    if (!Array.isArray(raw))
+      return [];
+    const seen = new Set;
+    return raw.slice(-200).filter((item) => item && typeof item.id === "string" && item.id.length <= 100 && typeof item.projectId === "string" && item.projectId.length <= 200 && typeof item.serviceKey === "string" && item.serviceKey.startsWith(item.projectId + ":") && item.serviceKey.length <= 400 && typeof item.name === "string" && item.name.length <= 120 && validPath(item.path) && ["GET", "HEAD"].includes(item.method) && Number.isInteger(item.expectedStatus) && item.expectedStatus >= 100 && item.expectedStatus <= 599 && Number.isFinite(item.createdAt) && Array.isArray(item.runs)).filter((item) => {
+      if (seen.has(item.id))
+        return false;
+      seen.add(item.id);
+      return true;
+    }).map((item) => ({
+      id: item.id,
+      projectId: item.projectId,
+      serviceKey: item.serviceKey,
+      name: item.name,
+      method: item.method,
+      path: item.path,
+      expectedStatus: item.expectedStatus,
+      createdAt: item.createdAt,
+      runs: item.runs.slice(-20).filter((run, index, runs) => run && runs.findIndex((candidate) => candidate?.id === run.id) === index).filter((run) => run && typeof run.id === "string" && run.id.length <= 100 && run.projectId === item.projectId && run.serviceKey === item.serviceKey && Number.isFinite(run.ts) && Number.isFinite(run.durationMs) && run.durationMs >= 0 && run.expectedStatus === item.expectedStatus && ["passed", "status-mismatch", "transport-error"].includes(run.result) && (run.actualStatus === undefined || Number.isInteger(run.actualStatus) && run.actualStatus >= 100 && run.actualStatus <= 599) && (run.error === undefined || typeof run.error === "string" && run.error.length <= 500)).map((run) => ({ id: run.id, projectId: run.projectId, serviceKey: run.serviceKey, ts: run.ts, expectedStatus: run.expectedStatus, actualStatus: run.actualStatus, durationMs: run.durationMs, result: run.result, error: run.error }))
+    }));
+  } catch {
+    return [];
+  }
+}
+
+class Reproductions {
+  file;
+  items;
+  active = new Set;
+  constructor(options = {}) {
+    this.file = options.file ?? path5.join(HOME_DIR, "reproductions.json");
+    this.items = loadChecks(this.file);
+  }
+  list(projectId2) {
+    return structuredClone(this.items.filter((item) => item.projectId === projectId2));
+  }
+  persist() {
+    const retained = [...this.items];
+    while (retained.length > 1 && Buffer.byteLength(JSON.stringify(retained, null, 2)) > 2000000)
+      retained.shift();
+    writePrivateJson(this.file, retained);
+    this.items = retained;
+  }
+  save(projectId2, record, input, secrets = []) {
+    if (!projectId2 || projectId2.length > 200 || record.service.length > 400 || !record.service.startsWith(projectId2 + ":"))
+      throw new Error("Request belongs to another project");
+    if (typeof input.name !== "string" || !input.name.trim() || input.name.length > 120)
+      throw new Error("Check name must contain 1–120 characters");
+    if (!Number.isInteger(input.expectedStatus) || input.expectedStatus < 100 || input.expectedStatus > 599)
+      throw new Error("Choose an expected HTTP status from 100 to 599");
+    if (!sanitizeRequest(record, "http://localhost", secrets).executable || secrets.some((secret) => secret && decodeURIComponentSafe(record.path).includes(secret)))
+      throw new Error("Checks require an unchanged GET/HEAD path without secret query values or a request body");
+    const item = { id: randomUUID(), projectId: projectId2, serviceKey: record.service, name: redact(input.name.trim(), secrets).slice(0, 120), method: record.method, path: record.path, expectedStatus: input.expectedStatus, createdAt: Date.now(), runs: [] };
+    const before = this.items;
+    this.items = [...this.items, item].slice(-200);
+    try {
+      this.persist();
+    } catch (error) {
+      this.items = before;
+      throw error;
     }
-    up.write(lines.join(`\r
-`) + `\r
-\r
-`);
-    if (head.length)
-      up.write(head);
-    up.pipe(socket).pipe(up);
-    hooks.onRequest({
-      ts: started,
-      service: target.service,
-      method: req.method ?? "GET",
-      path: req.url ?? "/",
-      status: 101,
-      durationMs: Date.now() - started,
-      bytes: 0,
-      requestHeaders: captureHeaders(req.rawHeaders),
-      via: target.via
-    });
-  });
-  const kill = () => {
-    up.destroy();
-    socket.destroy();
+    return structuredClone(item);
+  }
+  async run(projectId2, id, service) {
+    const item = this.items.find((item2) => item2.id === id && item2.projectId === projectId2);
+    if (!item || service.projectId !== projectId2 || service.key !== item.serviceKey)
+      throw new Error("Check not found in the selected service and environment");
+    if (!sanitizeRequest({ id: item.id, ts: 0, service: item.serviceKey, method: item.method, path: item.path, status: 0, bytes: 0, durationMs: 0, via: "local" }, "http://localhost").executable)
+      throw new Error("Saved check is invalid");
+    if (this.active.has(id))
+      throw new Error("This check is already running");
+    this.active.add(id);
+    try {
+      const ts = Date.now();
+      const result = { id: randomUUID(), projectId: projectId2, serviceKey: service.key, ts, expectedStatus: item.expectedStatus, durationMs: 0, result: "transport-error" };
+      try {
+        const response = await replayRequest(service, { id: item.id, ts, service: item.serviceKey, method: item.method, path: item.path, status: 0, bytes: 0, durationMs: 0, via: "local" });
+        result.actualStatus = response.status;
+        result.durationMs = response.durationMs;
+        result.result = response.status === item.expectedStatus ? "passed" : "status-mismatch";
+      } catch {
+        result.durationMs = Date.now() - ts;
+        result.error = "Could not complete the request. Check that the local HTTP service is running and ready.";
+      }
+      const previous = item.runs;
+      item.runs = [...item.runs, result].slice(-20);
+      try {
+        this.persist();
+      } catch (error) {
+        item.runs = previous;
+        throw error;
+      }
+      return structuredClone(result);
+    } finally {
+      this.active.delete(id);
+    }
+  }
+  delete(projectId2, id) {
+    if (this.active.has(id))
+      throw new Error("Wait for the check to finish before deleting it");
+    const previous = this.items;
+    this.items = this.items.filter((item) => !(item.id === id && item.projectId === projectId2));
+    if (previous.length === this.items.length)
+      return false;
+    try {
+      this.persist();
+    } catch (error) {
+      this.items = previous;
+      throw error;
+    }
+    return true;
+  }
+}
+
+// ../daemon/src/diagnostics.ts
+import fs6 from "node:fs";
+import os2 from "node:os";
+import path6 from "node:path";
+function redactDiagnostic(text, secrets = []) {
+  let output = text.replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/g, "[REDACTED PRIVATE KEY]").replace(/(authorization["']?\s*[:=]\s*["']?)(?:Bearer|Basic)\s+[^\s,"'}]+/gi, "$1[REDACTED]").replace(/((?:set-cookie|cookie)["']?\s*[:=]\s*)[^\r\n]+/gi, "$1[REDACTED]").replace(/(?<![a-z0-9+.-])([a-z][a-z0-9+.-]*:\/\/)([^\s/@]+)@/gi, (match, scheme, credentials) => credentials.includes(":") ? `${scheme}[REDACTED]@` : match).replace(/(?<![\w-])(?=[\w-]*(?:password|passwd|secret|token|api[_-]?key|credential))([\w-]+["']?\s*[:=]\s*)(?:"[^"\n]*"|'[^'\n]*'|[^\s,;&}\n]+)/gi, "$1[REDACTED]").replace(/((?:--)(?:password|token|secret|api-key)\s+)(?:"[^"]*"|'[^']*'|\S+)/gi, "$1[REDACTED]");
+  for (const secret of [...new Set(secrets)].filter(Boolean).sort((a, b) => b.length - a.length))
+    output = output.replaceAll(secret, "[REDACTED]");
+  const home = os2.homedir();
+  if (home.length > 1)
+    output = output.replaceAll(home, "<home>");
+  return output;
+}
+function privateEnvironmentValue(name, value) {
+  if (name === "NODE_ENV" && /^(development|production|test)$/.test(value))
+    return false;
+  if (/^(?:PORT|[A-Z_]+_PORT)$/.test(name) && /^\d{1,5}$/.test(value) && Number(value) > 0 && Number(value) <= 65535)
+    return false;
+  return true;
+}
+function environmentValues(directory) {
+  const values = [];
+  for (const name of [".env", ".env.local", ".env.development", ".env.development.local"]) {
+    const file = path6.join(directory, name);
+    try {
+      const stat = fs6.lstatSync(file);
+      if (!stat.isFile() || stat.size > 65536)
+        continue;
+      const text = fs6.readFileSync(file, "utf8");
+      for (const line of text.split(/\r?\n/)) {
+        const match = line.match(/^\s*(?:export\s+)?([A-Za-z_][\w]*)\s*=\s*(.*)$/);
+        if (match) {
+          const value = match[2].trim().replace(/^(['"])(.*)\1$/, "$2");
+          if (privateEnvironmentValue(match[1], value))
+            values.push(value);
+        }
+      }
+    } catch {}
+  }
+  return values;
+}
+function diagnosticReport(project, services, logs, version, privateValues = []) {
+  const inheritedSecrets = Object.entries(process.env).filter(([name]) => /password|passwd|secret|token|api[_-]?key|credential/i.test(name)).flatMap(([, value]) => value ? [value] : []);
+  const directories = new Set([project.directory, ...project.commands.map((command) => path6.resolve(project.directory, command.cwd ?? "."))]);
+  const secrets = [...privateValues, ...inheritedSecrets, ...[...directories].flatMap(environmentValues), ...project.commands.flatMap((command) => Object.entries(command.env ?? {}).filter(([name, value]) => privateEnvironmentValue(name, value)).map(([, value]) => value))];
+  const report = {
+    notice: "Review before sharing. Known secrets are redacted, but application logs may contain other private data.",
+    version,
+    project: { name: project.name, available: project.available, error: project.error },
+    configuration: project.commands.map(({ env, ...command }) => ({ ...command, environmentVariables: Object.keys(env ?? {}) })),
+    services: services.map((service) => ({ name: service.name, status: service.status, readiness: service.readinessStatus, message: service.readinessMessage, lastError: service.lastError, serviceType: service.serviceType ?? "http", port: service.stablePort })),
+    logs: logs.slice(-100).map(({ stream, line, ts, service }) => ({ service, ts, stream, line: line.slice(0, 2000) }))
   };
-  up.on("error", kill);
-  socket.on("error", kill);
-  socket.on("close", () => up.destroy());
-  up.on("close", () => socket.destroy());
+  const sanitize = (value) => typeof value === "string" ? redactDiagnostic(value, secrets) : Array.isArray(value) ? value.map(sanitize) : value && typeof value === "object" ? Object.fromEntries(Object.entries(value).map(([key, item]) => [key, sanitize(item)])) : value;
+  return JSON.stringify(sanitize(report), null, 2);
 }
 
-// ../daemon/src/projects.ts
-import { createHash } from "node:crypto";
-import fs4 from "node:fs";
-import path4 from "node:path";
+// ../daemon/src/project-secrets.ts
+import fs7 from "node:fs";
+import path7 from "node:path";
+var ID = /^[a-f0-9]{16}$/;
+var NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 
-// ../daemon/src/ports.ts
-import net3 from "node:net";
-function canBind(port, host, required) {
-  return new Promise((resolve) => {
-    const srv = net3.createServer();
-    srv.once("error", (error) => resolve(!required && error.code !== "EADDRINUSE" && error.code !== "EACCES" ? undefined : false));
-    srv.listen({ port, host, exclusive: true }, () => srv.close(() => resolve(true)));
-  });
+class ProjectSecretError extends Error {
 }
-async function isPortFree(port, host) {
-  for (const candidate of host ? [host] : ["127.0.0.1", "::1", "0.0.0.0", "::"]) {
-    if (await canBind(port, candidate, candidate === (host ?? "127.0.0.1")) === false)
-      return false;
+function validateName(name) {
+  if (!NAME.test(name) || name === "PORT" || name.startsWith("LOCALDECK_")) {
+    throw new ProjectSecretError("invalid secret name");
+  }
+}
+function createProjectSecretStore(home = HOME_DIR) {
+  const directory = path7.join(home, "secrets");
+  function secretPath(projectId2) {
+    if (!ID.test(projectId2))
+      throw new ProjectSecretError("invalid project ID");
+    return path7.join(directory, `${projectId2}.json`);
+  }
+  function read(projectId2) {
+    const file = secretPath(projectId2);
+    let text;
+    try {
+      text = fs7.readFileSync(file, "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return Object.create(null);
+      throw new ProjectSecretError("Could not read stored secrets");
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      throw new ProjectSecretError("stored secrets are corrupt");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new ProjectSecretError("stored secrets are corrupt");
+    }
+    const values = Object.create(null);
+    for (const [name, value] of Object.entries(parsed)) {
+      validateName(name);
+      if (typeof value !== "string" || !value || value.includes("\x00")) {
+        throw new ProjectSecretError("stored secrets are corrupt");
+      }
+      values[name] = value;
+    }
+    return values;
+  }
+  function write(projectId2, values) {
+    const file = secretPath(projectId2);
+    fs7.mkdirSync(directory, { recursive: true, mode: 448 });
+    if (process.platform !== "win32")
+      fs7.chmodSync(directory, 448);
+    writePrivateJson(file, values);
+  }
+  function listProjectSecrets(projectId2) {
+    return Object.keys(read(projectId2)).sort();
+  }
+  function setProjectSecret(projectId2, name, value) {
+    validateName(name);
+    if (typeof value !== "string" || !value || value.includes("\x00")) {
+      throw new ProjectSecretError("secret value must be a nonempty string without NUL");
+    }
+    const values = read(projectId2);
+    values[name] = value;
+    write(projectId2, values);
+  }
+  function deleteProjectSecret(projectId2, name) {
+    validateName(name);
+    const values = read(projectId2);
+    delete values[name];
+    write(projectId2, values);
+  }
+  function resolveProjectSecrets(projectId2, names) {
+    const output = Object.create(null);
+    if (!names.length)
+      return output;
+    const values = read(projectId2);
+    for (const name of names) {
+      validateName(name);
+      if (!Object.prototype.hasOwnProperty.call(values, name)) {
+        throw new ProjectSecretError(`Add ${name} in Project → Secrets.`);
+      }
+      output[name] = values[name];
+    }
+    return output;
+  }
+  return { listProjectSecrets, setProjectSecret, deleteProjectSecret, resolveProjectSecrets };
+}
+var { listProjectSecrets, setProjectSecret, deleteProjectSecret, resolveProjectSecrets } = createProjectSecretStore();
+
+// ../daemon/src/debugging-api.ts
+var checksByDeps = new WeakMap;
+function checks(deps) {
+  let value = deps.reproductions ?? checksByDeps.get(deps);
+  if (!value) {
+    value = new Reproductions;
+    checksByDeps.set(deps, value);
   }
-  return true;
+  return value;
 }
-function getFreePort(host = "127.0.0.1") {
-  return new Promise((resolve, reject) => {
-    const srv = net3.createServer();
-    srv.once("error", reject);
-    srv.listen(0, host, () => {
-      const { port } = srv.address();
-      srv.close(() => resolve(port));
-    });
-  });
+function secrets(deps, projectId2) {
+  const p = deps.projects.details(projectId2);
+  const names = (deps.listProjectSecrets ?? listProjectSecrets)(projectId2);
+  return [deps.controlToken, ...Object.values((deps.resolveProjectSecrets ?? resolveProjectSecrets)(projectId2, names)), ...Object.entries(process.env).flatMap(([key, value]) => /secret|token|password|credential|api[_-]?key/i.test(key) && value ? [value] : []), ...environmentValues(p.directory), ...p.commands.flatMap((c) => [...Object.values(c.env ?? {}), ...environmentValues(path8.resolve(p.directory, c.cwd ?? "."))])];
 }
-function serviceName(key) {
-  const separator = key.lastIndexOf(":");
-  return separator === -1 ? key : key.slice(separator + 1);
+async function body(req, allowed) {
+  const value = await readBody(req);
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((k) => !allowed.includes(k)))
+    throw new HttpError(400, "Unexpected request fields");
+  return value;
 }
-function rememberedPortFromFile(key, file) {
-  const map = readJson(file, {});
-  if (map[key] !== undefined)
-    return map[key];
-  const name = serviceName(key);
-  const hasOtherQualifiedKey = Object.keys(map).some((candidate) => candidate !== key && candidate.includes(":") && candidate.endsWith(`:${name}`));
-  return hasOtherQualifiedKey ? undefined : map[name];
+async function handleDebuggingApi(req, res, url, parts, deps) {
+  const method = req.method ?? "GET";
+  const projectRoute = parts[0] === "projects" && parts.length >= 3 && ["activity", "baselines", "checks", "environments"].includes(parts[2]);
+  const exportRoute = parts[0] === "services" && parts.length === 3 && parts[2] === "reproduction";
+  if (!projectRoute && !exportRoute)
+    return false;
+  const send = (status, value) => {
+    res.setHeader("cache-control", "no-store");
+    json(res, status, value);
+    return true;
+  };
+  try {
+    if (method !== "GET")
+      requireMutationAllowed(deps);
+    if (exportRoute && method === "GET") {
+      const key = parts[1], projectId3 = key.split(":")[0];
+      const project2 = deps.projects.details(projectId3);
+      if (!project2.commands.some((c) => `${projectId3}:${c.name}` === key) && !deps.registry.get(key))
+        throw new HttpError(404, "Unknown service");
+      const record = deps.store.requests(key, 5000).find((r) => r.id === url.searchParams.get("requestId"));
+      if (!record)
+        throw new HttpError(404, "Recorded request is no longer available");
+      const service = deps.registry.get(key);
+      if (!service)
+        throw new HttpError(422, "Start this service before exporting so its current local address is available");
+      const base = `http://localhost:${service.stablePort}`;
+      return send(200, sanitizeRequest(record, base, secrets(deps, projectId3)));
+    }
+    if (!projectRoute)
+      return send(405, { error: "Method not allowed" });
+    const projectId2 = parts[1], feature = parts[2], project = deps.projects.details(projectId2);
+    const allowed = [...new Set([...project.commands.map((c) => `${projectId2}:${c.name}`), ...deps.registry.list(projectId2).filter((s) => s.projectId === projectId2).map((s) => s.key)])];
+    const selectServices = (value) => {
+      const values = value === undefined ? allowed : value;
+      if (!Array.isArray(values) || !values.length || values.length > 100 || values.some((v) => typeof v !== "string" || !allowed.includes(v)))
+        throw new HttpError(422, "Select 1–100 configured or registered services in this project");
+      return [...new Set(values)];
+    };
+    if (feature === "activity" && parts.length === 3 && method === "GET") {
+      const raw = url.searchParams.get("services");
+      if (!allowed.length && !raw)
+        return send(200, { items: [], coverage: { partial: false, reasons: [] } });
+      const options = { limit: url.searchParams.has("limit") ? Number(url.searchParams.get("limit")) : 100, filter: url.searchParams.get("filter") ?? "all", query: url.searchParams.get("query") ?? undefined, cursor: url.searchParams.get("cursor") ?? undefined, eventId: url.searchParams.get("eventId") ?? undefined };
+      return send(200, deps.store.activity.timeline(projectId2, selectServices(raw === null ? undefined : raw.split(",")), options));
+    }
+    if (feature === "activity" && parts.length === 5 && parts[4] === "evidence" && method === "GET") {
+      const event = deps.store.activity.timeline(projectId2, selectServices(undefined), { eventId: parts[3], limit: 1 }).items[0];
+      if (!event)
+        throw new HttpError(404, "This event has expired or was cleared");
+      const request = event.kind === "request" ? deps.store.requests(event.service, 5000).find((r) => r.id === event.id) : undefined;
+      const log = event.kind === "log" ? deps.store.logs(event.service, 2000).find((r) => r.id === event.id) : undefined;
+      return send(200, { event, request, log, service: deps.registry.get(event.service) });
+    }
+    if (feature === "baselines") {
+      if (parts.length === 3 && method === "GET")
+        return send(200, { items: deps.store.activity.markers(projectId2) });
+      if (parts.length === 3 && method === "POST") {
+        const input = await body(req, ["services", "label"]);
+        requireMutationAllowed(deps);
+        if (input.label !== undefined && typeof input.label !== "string")
+          throw new HttpError(422, "Baseline label must be text");
+        let git;
+        try {
+          git = { head: gitMetadata(project.directory, ["rev-parse", "HEAD"]).trim() };
+          try {
+            git.branch = gitMetadata(project.directory, ["symbolic-ref", "--short", "HEAD"]).trim();
+          } catch {}
+        } catch {}
+        return send(201, deps.store.activity.mark(projectId2, selectServices(input.services), { label: input.label, git, secrets: secrets(deps, projectId2) }));
+      }
+      if (parts.length === 4 && method === "GET")
+        return send(200, deps.store.activity.compare(projectId2, parts[3], Date.now(), secrets(deps, projectId2)));
+    }
+    if (feature === "environments") {
+      if (parts.length === 3 && method === "GET") {
+        const discovery = discoverWorktrees(deps.projects, projectId2);
+        return send(200, { ...discovery, environments: discovery.environments.map((e) => ({ ...e, runningCount: e.projectId ? deps.registry.list(e.projectId).filter((s) => s.projectId === e.projectId && s.status !== "stopped").length : 0 })) });
+      }
+      if (parts.length === 5 && parts[4] === "register" && method === "POST") {
+        await body(req, []);
+        requireMutationAllowed(deps);
+        return send(201, registerWorktree(deps.projects, projectId2, parts[3]));
+      }
+    }
+    if (feature === "checks") {
+      const repository = checks(deps);
+      if (parts.length === 3 && method === "GET")
+        return send(200, { items: repository.list(projectId2) });
+      if (parts.length === 3 && method === "POST") {
+        const input = await body(req, ["requestId", "serviceKey", "name", "expectedStatus"]);
+        requireMutationAllowed(deps);
+        const [key] = selectServices([input.serviceKey]);
+        if (typeof input.requestId !== "string")
+          throw new HttpError(422, "A recorded request ID is required");
+        const record = deps.store.requests(key, 5000).find((r) => r.id === input.requestId);
+        if (!record)
+          throw new HttpError(404, "Recorded request is no longer available");
+        return send(201, repository.save(projectId2, record, { name: input.name, expectedStatus: input.expectedStatus }, secrets(deps, projectId2)));
+      }
+      const check = repository.list(projectId2).find((c) => c.id === parts[3]);
+      if (!check)
+        throw new HttpError(404, "Check not found in this project");
+      if (parts.length === 4 && method === "DELETE")
+        return send(200, { ok: repository.delete(projectId2, check.id) });
+      if (parts.length === 5 && parts[4] === "run" && method === "POST") {
+        await body(req, []);
+        requireMutationAllowed(deps);
+        const service = deps.registry.get(check.serviceKey);
+        if (!service || service.status !== "running" || !service.upstreamReady)
+          throw new HttpError(422, "Start the check’s HTTP service and wait for readiness before running it");
+        return send(200, await repository.run(projectId2, check.id, service));
+      }
+    }
+    return send(404, { error: "Unknown debugging endpoint" });
+  } catch (error) {
+    if (error instanceof HttpError)
+      throw error;
+    return send(422, { error: error instanceof Error ? error.message : "Debugging operation failed" });
+  }
 }
-function rememberPort(name, port, file = PORTS_FILE) {
-  const map = readJson(file, {});
-  map[name] = port;
-  writeJson(file, map);
+
+// ../daemon/src/api.ts
+import http5 from "node:http";
+import { timingSafeEqual, randomBytes, randomUUID as randomUUID2 } from "node:crypto";
+
+// ../daemon/src/clean-urls.ts
+import fs8 from "node:fs";
+import http2 from "node:http";
+import path9 from "node:path";
+
+// ../daemon/src/windows-forwarder.ts
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+var execute = promisify(execFile);
+function windowsForwarderScript(port, remove = false) {
+  if (!Number.isInteger(port) || port < 1 || port > 65535 || port === 80)
+    throw new Error("Invalid forwarding target port.");
+  return String.raw`$ErrorActionPreference = 'Stop'
+$ownerPath = 'HKLM:\SOFTWARE\LocalDeck\Port80'
+$rulePath = 'HKLM:\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4\tcp'
+$ruleName = '127.0.0.1/80'
+$marker = 'LocalDeck loopback portproxy v1'
+$netsh = Join-Path $env:SystemRoot 'System32\netsh.exe'
+$owner = Get-ItemProperty -LiteralPath $ownerPath -ErrorAction SilentlyContinue
+$rule = if (Test-Path -LiteralPath $rulePath) { (Get-Item -LiteralPath $rulePath).GetValue($ruleName) } else { $null }
+$owned = $owner -and $owner.Marker -eq $marker -and $owner.TargetPort -match '^\d+$' -and [int]$owner.TargetPort -ge 1 -and [int]$owner.TargetPort -le 65535 -and [int]$owner.TargetPort -ne 80
+if ($owner -and !$owned) { throw 'Refusing to change an unrecognized LocalDeck ownership record.' }
+if ($rule -and (!$owned -or $rule -ne ('127.0.0.1/' + $owner.TargetPort))) { throw 'Port 80 has an unmanaged forwarding rule. It was left unchanged.' }
+${remove ? String.raw`if ($rule) {
+  & $netsh interface portproxy delete v4tov4 listenaddress=127.0.0.1 listenport=80 protocol=tcp | Out-Null
+  if ($LASTEXITCODE -ne 0) { throw 'Could not remove the LocalDeck forwarding rule.' }
 }
-function forgetProjectPorts(projectId, file = PORTS_FILE) {
-  const map = readJson(file, {});
-  const kept = Object.fromEntries(Object.entries(map).filter(([key]) => !key.startsWith(`${projectId}:`)));
-  if (Object.keys(kept).length !== Object.keys(map).length)
-    writeJson(file, kept);
+if ($owned) { Remove-Item -LiteralPath $ownerPath }
+` : String.raw`if (!$rule) {
+  $listeners = @(Get-NetTCPConnection -ErrorAction Stop | Where-Object { $_.State -eq 'Listen' -and $_.LocalPort -eq 80 -and $_.LocalAddress -in @('127.0.0.1','0.0.0.0','::','::1') })
+  if ($listeners.Count) { throw 'Port 80 is already in use. The existing listener was left unchanged.' }
 }
-async function pickStablePort(name, taken, start = 4000, end = 4999, file = PORTS_FILE) {
-  const map = readJson(file, {});
-  const remembered = rememberedPortFromFile(name, file);
-  if (remembered) {
-    if (taken.has(remembered) || !await isPortFree(remembered)) {
-      throw new Error(`remembered stable port ${remembered} for "${name}" is already in use; stop the conflicting listener or explicitly choose a different port`);
-    }
-    return remembered;
-  }
-  const bareName = serviceName(name);
-  const usingLegacy = map[name] === undefined && remembered === map[bareName];
-  const reserved = new Set(Object.entries(map).filter(([n]) => n !== name && !(usingLegacy && n === bareName)).map(([, p]) => p));
-  for (let p = start;p <= end; p++) {
-    if (taken.has(p) || reserved.has(p))
-      continue;
-    if (await isPortFree(p))
-      return p;
+$helper = Get-Service iphlpsvc
+if ($helper.StartType -eq 'Disabled') { throw 'Windows IP Helper is disabled. Enable it through your system administrator to use port forwarding.' }
+if ($helper.Status -ne 'Running') { Start-Service iphlpsvc }
+$oldRule = $rule
+$oldPort = if ($owned) { $owner.TargetPort } else { $null }
+try {
+  New-Item -Path $ownerPath -Force | Out-Null
+  New-ItemProperty -LiteralPath $ownerPath -Name Marker -Value $marker -PropertyType String -Force | Out-Null
+  New-ItemProperty -LiteralPath $ownerPath -Name TargetPort -Value '${port}' -PropertyType String -Force | Out-Null
+  & $netsh interface portproxy add v4tov4 listenaddress=127.0.0.1 listenport=80 connectaddress=127.0.0.1 connectport=${port} protocol=tcp | Out-Null
+  if ($LASTEXITCODE -ne 0) { throw 'Windows could not install the forwarding rule.' }
+  $installed = (Get-Item -LiteralPath $rulePath).GetValue($ruleName)
+  if ($installed -ne '127.0.0.1/${port}') { throw 'The installed forwarding rule did not match the requested destination.' }
+} catch {
+  if ($oldRule) {
+    & $netsh interface portproxy add v4tov4 listenaddress=127.0.0.1 listenport=80 connectaddress=127.0.0.1 "connectport=$oldPort" protocol=tcp | Out-Null
+    if ($LASTEXITCODE -eq 0) { Set-ItemProperty -LiteralPath $ownerPath -Name TargetPort -Value $oldPort }
+  } else {
+    & $netsh interface portproxy delete v4tov4 listenaddress=127.0.0.1 listenport=80 protocol=tcp | Out-Null
+    if ($LASTEXITCODE -eq 0) { Remove-Item -LiteralPath $ownerPath }
   }
-  throw new Error(`no free port between ${start} and ${end}`);
+  throw
 }
-
-// ../daemon/src/projects.ts
-class ProjectError extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.code = code;
+`}`;
+}
+function windowsElevationCommand(port, remove = false) {
+  const script = `try {
+${windowsForwarderScript(port, remove)}
+exit 0
+} catch { Write-Error $_ -ErrorAction Continue; exit 1 }`;
+  const encoded = Buffer.from(script, "utf16le").toString("base64");
+  return `$ErrorActionPreference = 'Stop'; $exe = Join-Path $env:SystemRoot 'System32\\WindowsPowerShell\\v1.0\\powershell.exe'; $child = Start-Process -FilePath $exe -Verb RunAs -ArgumentList '-NoLogo -NoProfile -NonInteractive -EncodedCommand ${encoded}' -PassThru -Wait; if ($child.ExitCode -ne 0) { throw 'Windows administrator setup failed.' }`;
+}
+async function configureWindowsForwarder(port, remove = false) {
+  const script = windowsElevationCommand(port, remove);
+  try {
+    await execute("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], { windowsHide: true, timeout: 120000, maxBuffer: 8192 });
+  } catch {
+    throw new Error("Windows administrator setup was cancelled or failed. Port 80 may be occupied or reserved, or IP Helper may be disabled. Existing port-number links still work; retry from Settings.");
   }
 }
 
-class ProjectRegistry {
-  catalogFile;
-  portsFile;
-  now;
-  projects;
-  constructor({ catalogFile = PROJECTS_FILE, portsFile = PORTS_FILE, now = Date.now } = {}) {
-    this.catalogFile = catalogFile;
-    this.portsFile = portsFile;
-    this.now = now;
-    this.projects = this.readCatalog();
-  }
-  remember(file, now = this.now()) {
-    const realFile = fs4.realpathSync(file);
-    const config = loadProjectFile(realFile);
-    const id = projectId(realFile);
-    const name = path4.basename(path4.dirname(realFile));
-    const directory = path4.dirname(realFile);
-    const existing = this.projects.find((entry) => entry.id === id);
-    if (config.nickname)
-      this.assertNicknameAvailable(id, config.nickname);
-    if (existing) {
-      existing.name = name;
-      existing.file = realFile;
-      existing.directory = directory;
-      existing.lastUsedAt = now;
-      existing.configNickname = config.nickname;
-    } else {
-      this.projects.push({
-        id,
-        name,
-        slug: this.assignSlug(name, id),
-        file: realFile,
-        directory,
-        lastUsedAt: now,
-        ...config.nickname ? { configNickname: config.nickname } : {}
-      });
-    }
-    this.persist();
-    return this.toSummary(this.byId(id));
-  }
-  list() {
-    return this.sorted().map((project) => this.toSummary(project));
-  }
-  details(projectId) {
-    const project = this.require(projectId);
-    try {
-      const loaded = this.load(project);
-      return { ...project, nickname: this.nickname(projectId), available: true, commands: loaded.commands, ...loaded.profiles ? { profiles: loaded.profiles } : {} };
-    } catch (error) {
-      return { ...project, available: false, error: errorMessage(error), commands: [] };
-    }
-  }
-  resolve(projectId, serviceName2) {
-    const details = this.details(projectId);
-    if (!details.available)
-      throw new ProjectError("invalid", details.error);
-    const command = details.commands.find((candidate) => candidate.name === serviceName2.toLowerCase());
-    if (!command)
-      throw new ProjectError("not_found", `Project ${projectId} has no service named ${serviceName2}`);
-    return command;
+// ../daemon/src/system-forwarder.ts
+import { execFile as execFile2 } from "node:child_process";
+import os3 from "node:os";
+import { promisify as promisify2 } from "node:util";
+var execute2 = promisify2(execFile2);
+var label = "dev.localdeck.port80";
+var SYSTEM_FORWARDER_PLIST = `/Library/LaunchDaemons/${label}.plist`;
+var destination = SYSTEM_FORWARDER_PLIST;
+var marker = "LocalDeck managed loopback relay v1";
+function forwarderPlist(user, port) {
+  if (!/^[a-zA-Z_][a-zA-Z0-9_.-]*$/.test(user) || user === "root")
+    throw new Error("Forwarding must run as a regular macOS user.");
+  if (!Number.isInteger(port) || port < 1 || port > 65535 || port === 80)
+    throw new Error("Invalid forwarding target port.");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!-- ${marker} -->
+<plist version="1.0"><dict>
+<key>Label</key><string>${label}</string>
+<key>UserName</key><string>${user}</string>
+<key>ProgramArguments</key><array><string>/usr/bin/nc</string><string>127.0.0.1</string><string>${port}</string></array>
+<key>inetdCompatibility</key><dict><key>Wait</key><false/></dict>
+<key>Sockets</key><dict><key>Listeners</key><dict>
+<key>SockNodeName</key><string>127.0.0.1</string>
+<key>SockServiceName</key><string>80</string>
+<key>SockFamily</key><string>IPv4</string>
+<key>SockType</key><string>stream</string>
+<key>SockProtocol</key><string>TCP</string>
+</dict></dict>
+</dict></plist>`;
+}
+function systemForwarderCommand(user, port, remove = false) {
+  const plist = forwarderPlist(user, port);
+  const guard = `set -eu
+if [ -L '${destination}' ]; then exit 1; fi
+if [ -e '${destination}' ] && ! /usr/bin/grep -q '${marker}' '${destination}'; then
+  echo 'Refusing to replace an unmanaged forwarding service.' >&2; exit 1
+fi`;
+  if (remove)
+    return `${guard}
+/bin/launchctl bootout system/${label} 2>/dev/null || true
+/bin/rm -f '${destination}'`;
+  return `${guard}
+relay_file=$(/usr/bin/mktemp /Library/LaunchDaemons/.localdeck-port80.XXXXXX)
+trap '/bin/rm -f "$relay_file" "$relay_file.backup"' EXIT
+/bin/cat > "$relay_file" <<'LOCALDECK_PLIST'
+${plist}
+LOCALDECK_PLIST
+/usr/bin/plutil -lint "$relay_file" >/dev/null
+/usr/sbin/chown root:wheel "$relay_file"
+/bin/chmod 644 "$relay_file"
+if [ -f '${destination}' ]; then /bin/cp -p '${destination}' "$relay_file.backup"; fi
+/bin/launchctl bootout system/${label} 2>/dev/null || true
+/bin/mv "$relay_file" '${destination}'
+if ! /bin/launchctl bootstrap system '${destination}'; then
+  /bin/rm -f '${destination}'
+  if [ -f "$relay_file.backup" ]; then
+    /bin/mv "$relay_file.backup" '${destination}'
+    /bin/launchctl bootstrap system '${destination}' || true
+  fi
+  exit 1
+fi`;
+}
+async function configureSystemForwarder(port, remove = false) {
+  if (process.platform === "win32")
+    return configureWindowsForwarder(port, remove);
+  if (process.platform !== "darwin")
+    throw new Error("Automatic administrator setup is available on macOS and Windows.");
+  const command = systemForwarderCommand(os3.userInfo().username, port, remove);
+  try {
+    await execute2("/usr/bin/osascript", ["-e", `on run argv
+ do shell script (item 1 of argv) with administrator privileges
+end run`, command], { timeout: 120000, maxBuffer: 8192 });
+  } catch {
+    throw new Error("Administrator setup was cancelled or failed. Continuing with working port-number links; retry in Settings whenever you like.");
   }
-  forget(projectId, activeKeys) {
-    this.require(projectId);
-    if ([...activeKeys].some((key) => key.startsWith(`${projectId}:`))) {
-      throw new ProjectError("active", "stop its services before forgetting it");
-    }
-    this.projects = this.projects.filter((project) => project.id !== projectId);
-    this.persist();
-    forgetProjectPorts(projectId, this.portsFile);
+}
+
+// ../daemon/src/clean-urls.ts
+class CleanUrls {
+  targetPort;
+  identity;
+  port;
+  platform;
+  preferenceFile;
+  configureSystem;
+  systemRelayInstalled;
+  bridge;
+  enabling;
+  closed = false;
+  constructor(targetPort, identity, port = 80, platform = process.platform, preferenceFile = path9.join(HOME_DIR, "forwarder.json"), configureSystem = configureSystemForwarder, systemRelayInstalled = () => fs8.existsSync(SYSTEM_FORWARDER_PLIST)) {
+    this.targetPort = targetPort;
+    this.identity = identity;
+    this.port = port;
+    this.platform = platform;
+    this.preferenceFile = preferenceFile;
+    this.configureSystem = configureSystem;
+    this.systemRelayInstalled = systemRelayInstalled;
   }
-  refresh(projectId) {
-    return this.details(projectId);
+  async status() {
+    const ready = await new Promise((resolve) => {
+      const request = http2.get({ hostname: "127.0.0.1", port: this.port, path: "/api/forwarder/probe", agent: false }, (response) => {
+        let body2 = "";
+        response.on("data", (chunk) => {
+          body2 += chunk;
+          if (body2.length > 256)
+            request.destroy();
+        });
+        response.on("end", () => resolve(response.statusCode === 200 && body2 === this.identity));
+        response.on("error", () => resolve(false));
+      });
+      const timer = setTimeout(() => {
+        request.destroy();
+        resolve(false);
+      }, 1500);
+      request.on("close", () => clearTimeout(timer));
+      request.on("error", () => resolve(false));
+    });
+    return { ready: ready && !this.closed };
   }
-  nickname(projectId) {
-    const project = this.byId(projectId);
-    return project?.nickname ?? project?.configNickname;
+  enable(options = {}) {
+    if (this.enabling)
+      return this.enabling;
+    this.enabling = this.start(options).finally(() => {
+      this.enabling = undefined;
+    });
+    return this.enabling;
   }
-  updateNickname(projectId, value) {
-    const project = this.require(projectId);
-    const nickname = value.trim().toLowerCase();
-    if (nickname && (!validNickname(nickname) || nickname === "standalone")) {
-      throw new ProjectError("invalid", "Use 1–63 letters, numbers or hyphens, with no leading or trailing hyphen. 'standalone' is reserved.");
+  async start(options) {
+    if (this.closed)
+      return { ready: false, error: "LocalDeck is shutting down." };
+    const preference = this.preferenceFile;
+    const saved = readJson(preference, {});
+    if (saved.removed) {
+      if (options.automatic)
+        return { ready: false, error: "Clean URLs are turned off; enable them in the dashboard to use them again." };
+      writeJson(preference, { declined: saved.declined });
     }
-    if (nickname)
-      this.assertNicknameAvailable(projectId, nickname);
-    const previous = project.nickname;
-    if (nickname)
-      project.nickname = nickname;
-    else
-      delete project.nickname;
-    try {
-      this.persist();
-    } catch (error) {
-      if (previous === undefined)
-        delete project.nickname;
-      else
-        project.nickname = previous;
-      throw error;
+    if (this.platform === "win32" && options.install && this.port === 80 && !(options.automatic && readJson(preference, {}).declined)) {
+      if (!this.bridge && (await this.status()).ready)
+        return { ready: true };
+      if (this.bridge) {
+        await this.bridge.close();
+        this.bridge = undefined;
+      }
+      try {
+        writeJson(preference, { declined: true });
+        await this.configureSystem(this.targetPort());
+        let ready = false;
+        for (let attempt = 0;attempt < 20 && !this.closed; attempt++) {
+          if ((await this.status()).ready) {
+            ready = true;
+            break;
+          }
+          await new Promise((resolve) => setTimeout(resolve, 250));
+        }
+        if (!ready)
+          throw new Error("Windows setup completed but forwarding could not be verified. Port-number links remain available; retry in Settings.");
+        writeJson(preference, { declined: false });
+        return { ready: true };
+      } catch (error) {
+        return { ready: false, error: error instanceof Error ? error.message : "Windows setup failed." };
+      }
     }
-    return this.details(projectId);
-  }
-  saveConfigNickname(projectId, value) {
-    const project = this.require(projectId);
-    const nickname = value.trim().toLowerCase();
-    if (nickname && (!validNickname(nickname) || nickname === "standalone"))
-      throw new ProjectError("invalid", "Use 1–63 letters, numbers or interior hyphens; standalone is reserved.");
-    if (nickname)
-      this.assertNicknameAvailable(projectId, nickname);
+    if ((await this.status()).ready)
+      return { ready: true };
     try {
-      updateProjectNickname(project.file, nickname);
+      if (this.closed)
+        return { ready: false, error: "LocalDeck is shutting down." };
+      this.bridge ??= await startForwarder({ listenPort: this.port, targetPort: this.targetPort() });
+      if (this.closed) {
+        await this.bridge.close();
+        this.bridge = undefined;
+        return { ready: false, error: "LocalDeck is shutting down." };
+      }
+      if ((await this.status()).ready)
+        return { ready: true };
+      return { ready: false, error: "Port 80 does not reach this LocalDeck instance. Your existing links are unchanged." };
     } catch (error) {
-      throw new ProjectError("invalid", errorMessage(error));
+      const message = error instanceof Error ? error.message : "Could not start port-80 forwarding.";
+      const preference2 = this.preferenceFile;
+      if (options.install && this.port === 80 && this.platform === "darwin" && message.includes("permission denied") && !(options.automatic && readJson(preference2, {}).declined)) {
+        try {
+          writeJson(preference2, { declined: true });
+          await this.configureSystem(this.targetPort());
+          const result = await this.status();
+          if (!result.ready)
+            throw new Error("Setup completed but forwarding could not be verified. Your original links are unchanged.");
+          writeJson(preference2, { declined: false });
+          return result;
+        } catch (setupError) {
+          return { ready: false, error: setupError instanceof Error ? setupError.message : "Administrator setup failed." };
+        }
+      }
+      return { ready: false, error: message };
     }
-    project.configNickname = nickname || undefined;
-    return this.updateNickname(projectId, "");
   }
-  updateDependencies(projectId, serviceName2, after) {
-    const project = this.require(projectId);
+  async uninstall() {
+    if (this.enabling)
+      return { ready: false, error: "Wait for the current setup to finish." };
     try {
-      updateProjectDependencies(project.file, serviceName2, after);
-      return this.details(projectId);
+      const hadBridge = Boolean(this.bridge);
+      if (this.bridge) {
+        await this.bridge.close();
+        this.bridge = undefined;
+      }
+      if (this.platform === "darwin" ? this.systemRelayInstalled() : this.platform === "win32" && this.port === 80 && !hadBridge)
+        await this.configureSystem(this.targetPort(), true);
+      writeJson(this.preferenceFile, { declined: true, removed: true });
+      return { ready: false, removed: true };
     } catch (error) {
-      throw new ProjectError("invalid", errorMessage(error));
+      return { ready: false, error: error instanceof Error ? error.message : "Removal failed." };
     }
   }
-  updateServiceConfig(projectId, serviceName2, settings) {
-    const project = this.require(projectId);
-    try {
-      updateProjectServiceConfig(project.file, serviceName2, settings);
-      return this.details(projectId);
-    } catch (error) {
-      throw new ProjectError("invalid", errorMessage(error));
+  async close() {
+    this.closed = true;
+    await this.enabling;
+    if (this.bridge) {
+      await this.bridge.close();
+      this.bridge = undefined;
     }
   }
-  readCatalog() {
-    if (!fs4.existsSync(this.catalogFile))
-      return [];
-    try {
-      const parsed = JSON.parse(fs4.readFileSync(this.catalogFile, "utf8"));
-      if (!isCatalog(parsed))
-        throw new Error("invalid project catalog");
-      return parsed.projects;
-    } catch {
-      fs4.renameSync(this.catalogFile, this.nextCorruptFile());
-      return [];
-    }
+}
+
+// ../daemon/src/api.ts
+import fs9 from "node:fs";
+import path10 from "node:path";
+
+// ../daemon/src/request-body.ts
+import { brotliDecompressSync, gunzipSync, inflateSync } from "node:zlib";
+var MAX_BODY_CAPTURE_BYTES = 16384;
+
+class BodyCapture {
+  limit;
+  chunks = [];
+  retained = 0;
+  bytes = 0;
+  tailUsed = 0;
+  constructor(limit = MAX_BODY_CAPTURE_BYTES) {
+    this.limit = limit;
   }
-  assertNicknameAvailable(projectId, nickname) {
-    if (this.projects.some((other) => other.id !== projectId && (other.slug === nickname || other.nickname === nickname || other.configNickname === nickname))) {
-      throw new ProjectError("invalid", "That project nickname is already taken. Choose another.");
+  append(chunk) {
+    this.bytes += chunk.length;
+    const count = Math.min(chunk.length, this.limit - this.retained);
+    let offset = 0;
+    while (offset < count) {
+      let tail = this.chunks.at(-1);
+      if (!tail || this.tailUsed === tail.length) {
+        if (tail && tail.length < 4096) {
+          const grown = Buffer.allocUnsafe(Math.min(4096, this.limit - this.retained + this.tailUsed, Math.max(tail.length * 2, count - offset)));
+          tail.copy(grown, 0, 0, this.tailUsed);
+          this.chunks[this.chunks.length - 1] = tail = grown;
+        } else {
+          tail = Buffer.allocUnsafe(Math.min(4096, this.limit - this.retained, Math.max(64, count - offset)));
+          this.chunks.push(tail);
+          this.tailUsed = 0;
+        }
+      }
+      const size = Math.min(count - offset, tail.length - this.tailUsed);
+      chunk.copy(tail, this.tailUsed, offset, offset + size);
+      this.tailUsed += size;
+      this.retained += size;
+      offset += size;
     }
   }
-  nextCorruptFile() {
-    const base = `${this.catalogFile}.corrupt-${this.now()}`;
-    let candidate = base;
-    let suffix = 2;
-    while (fs4.existsSync(candidate))
-      candidate = `${base}-${suffix++}`;
-    return candidate;
-  }
-  persist() {
-    writeJson(this.catalogFile, { version: 1, projects: this.sortedEntries() });
-  }
-  sorted() {
-    return this.sortedEntries().map((project) => ({ ...project }));
-  }
-  sortedEntries() {
-    return [...this.projects].sort((a, b) => b.lastUsedAt - a.lastUsedAt);
-  }
-  toSummary(project) {
+  snapshot(complete, contentEncoding) {
+    let buffer = Buffer.concat(this.chunks.map((chunk, index) => index === this.chunks.length - 1 ? chunk.subarray(0, this.tailUsed) : chunk), this.retained);
+    let encoded = Boolean(contentEncoding && contentEncoding !== "identity");
+    const truncated = this.bytes > this.retained;
+    if (encoded && complete && !truncated && buffer.length) {
+      const decode = { gzip: gunzipSync, deflate: inflateSync, br: brotliDecompressSync }[contentEncoding];
+      try {
+        if (decode) {
+          buffer = decode(buffer, { maxOutputLength: this.limit });
+          encoded = false;
+        }
+      } catch {}
+    }
+    let data;
+    let encoding = "utf8";
     try {
-      this.load(project);
-      return { ...project, nickname: this.nickname(project.id), available: true };
-    } catch (error) {
-      return { ...project, available: false, error: errorMessage(error) };
+      if (encoded || buffer.includes(0))
+        throw new Error("binary body");
+      data = new TextDecoder("utf-8", { fatal: true }).decode(buffer);
+    } catch {
+      data = buffer.toString("base64");
+      encoding = "base64";
     }
+    return { data, encoding, bytes: this.bytes, truncated, complete, ...encoded ? { contentEncoding } : {} };
   }
-  load(project) {
-    if (!fs4.existsSync(project.file))
-      throw new Error(`${project.file} does not exist`);
-    const loaded = loadProjectFile(project.file);
-    if (loaded.nickname)
-      this.assertNicknameAvailable(project.id, loaded.nickname);
-    project.configNickname = loaded.nickname;
-    return loaded;
-  }
-  require(projectId) {
-    const project = this.byId(projectId);
-    if (!project)
-      throw new ProjectError("not_found", `Project ${projectId} was not found`);
-    return project;
+}
+
+// ../daemon/src/request-headers.ts
+var MAX_HEADER_BYTES = 16384;
+var MAX_HEADER_COUNT = 100;
+function captureHeaders(raw) {
+  const entries = [];
+  let bytes = 0;
+  for (let i = 0;i + 1 < raw.length; i += 2) {
+    const name = raw[i];
+    const value = raw[i + 1];
+    bytes += Buffer.byteLength(name) + Buffer.byteLength(value);
+    if (bytes > MAX_HEADER_BYTES || entries.length >= MAX_HEADER_COUNT)
+      return { entries, truncated: true };
+    entries.push([name, value]);
   }
-  byId(projectId) {
-    return this.projects.find((project) => project.id === projectId);
+  return { entries, truncated: false };
+}
+
+// ../daemon/src/proxy.ts
+import http3 from "node:http";
+import net3 from "node:net";
+var HOP_BY_HOP = new Set(["connection", "keep-alive", "proxy-authenticate", "proxy-authorization", "te", "trailer", "transfer-encoding", "upgrade"]);
+function forwardHeaders(req, target) {
+  const out = {};
+  for (const [k, v] of Object.entries(req.headers)) {
+    if (HOP_BY_HOP.has(k) || v === undefined)
+      continue;
+    out[k] = v;
   }
-  assignSlug(name, id) {
-    const base = slugify(name) || "project";
-    if (!this.projects.some((project) => project.slug === base || project.nickname === base || project.configNickname === base))
-      return base;
-    const suffix = id.slice(0, 6);
-    let slug = `${base}-${suffix}`;
-    let collision = 2;
-    while (this.projects.some((project) => project.slug === slug || project.nickname === slug || project.configNickname === slug))
-      slug = `${base}-${suffix}-${collision++}`;
-    return slug;
+  if (target.via === "share") {
+    const host = net3.isIP(target.upstreamHost) === 6 ? `[${target.upstreamHost}]` : target.upstreamHost;
+    out.host = `${host}:${target.upstreamPort}`;
   }
+  const remote = req.socket.remoteAddress ?? "";
+  out["x-forwarded-for"] = req.headers["x-forwarded-for"] ? `${req.headers["x-forwarded-for"]}, ${remote}` : remote;
+  out["x-forwarded-proto"] = target.via === "share" ? "https" : "http";
+  out["x-forwarded-host"] = req.headers.host ?? "";
+  out["x-localdeck-service"] = target.service;
+  return out;
 }
-function projectId(realFile) {
-  return createHash("sha256").update(realFile).digest("hex").slice(0, 16);
-}
-function slugify(value) {
-  return value.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
-}
-function isCatalog(value) {
-  if (!value || typeof value !== "object")
-    return false;
-  const catalog = value;
-  return catalog.version === 1 && Array.isArray(catalog.projects) && catalog.projects.every(isRememberedProject);
-}
-function isRememberedProject(value) {
-  if (!value || typeof value !== "object")
-    return false;
-  const project = value;
-  if (!["id", "name", "slug", "file", "directory"].every((key) => typeof project[key] === "string"))
-    return false;
-  const { id, slug, file, directory } = project;
-  return path4.isAbsolute(file) && path4.normalize(file) === file && directory === path4.dirname(file) && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(slug) && /^[a-f0-9]{16}$/.test(id) && (project.nickname === undefined || typeof project.nickname === "string" && validNickname(project.nickname)) && (project.configNickname === undefined || typeof project.configNickname === "string" && validNickname(project.configNickname)) && id === projectId(file) && typeof project.lastUsedAt === "number" && Number.isFinite(project.lastUsedAt);
+function waitingPage(target) {
+  return `<!doctype html><meta charset="utf-8"><meta http-equiv="refresh" content="2">
+<title>LocalDeck — waiting for ${target.service}</title>
+<style>body{font:15px/1.5 system-ui;margin:0;display:grid;place-items:center;height:100vh;background:#0f1115;color:#e6e8ef}
+.c{max-width:420px;text-align:center}code{background:#1c1f27;padding:2px 6px;border-radius:4px}</style>
+<div class="c"><h1 style="font-weight:600">Waiting for <code>${target.service}</code></h1>
+<p>LocalDeck is holding this port. Nothing is listening on the upstream port <code>${target.upstreamPort}</code> yet.
+This page reloads every 2 seconds.</p></div>`;
 }
-function validNickname(value) {
-  return value.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+function proxyRequest(req, res, target, hooks) {
+  const started = Date.now();
+  const requestHeaders = captureHeaders(req.rawHeaders);
+  const requestBody = new BodyCapture;
+  const responseBody = new BodyCapture;
+  const fullResponse = hooks.responseBodies?.start(target.service);
+  const captureResponse = (chunk) => {
+    responseBody.append(chunk);
+    fullResponse?.append(chunk);
+  };
+  let responseComplete = false;
+  let responseEncoding;
+  let responseHeaders;
+  let bytes = 0;
+  let recorded = false;
+  const record = (status, error) => {
+    if (recorded)
+      return;
+    recorded = true;
+    fullResponse?.finish(responseComplete, responseEncoding);
+    hooks.onRequest({
+      ts: started,
+      service: target.service,
+      method: req.method ?? "GET",
+      path: req.url ?? "/",
+      status,
+      durationMs: Date.now() - started,
+      bytes,
+      via: target.via,
+      error,
+      requestHeaders,
+      responseHeaders,
+      requestBody: requestBody.snapshot(req.readableEnded, req.headers["content-encoding"]),
+      responseBody: responseBody.snapshot(responseComplete, responseEncoding),
+      responseBodyId: fullResponse?.id
+    });
+  };
+  if (!target.upstreamReady) {
+    responseHeaders = captureHeaders(["content-type", "text/html; charset=utf-8", "retry-after", "2"]);
+    res.writeHead(503, { "content-type": "text/html; charset=utf-8", "retry-after": "2" });
+    const body2 = waitingPage(target);
+    captureResponse(Buffer.from(body2));
+    responseComplete = true;
+    res.end(body2);
+    record(503, "upstream not ready");
+    return;
+  }
+  let responseStatus = 502;
+  let response;
+  const upstream = http3.request({ host: target.upstreamHost, port: target.upstreamPort, method: req.method, path: req.url, headers: forwardHeaders(req, target) }, (up) => {
+    if (res.destroyed) {
+      up.destroy();
+      return;
+    }
+    response = up;
+    responseHeaders = captureHeaders(up.rawHeaders);
+    responseEncoding = up.headers["content-encoding"];
+    up.on("end", () => {
+      responseComplete = true;
+    });
+    responseStatus = up.statusCode ?? 502;
+    up.on("error", (error) => {
+      record(502, `upstream response error: ${error.message}`);
+      res.destroy();
+    });
+    up.on("aborted", () => {
+      record(502, "upstream response aborted");
+      res.destroy();
+    });
+    const headers = { ...up.headers };
+    res.writeHead(up.statusCode ?? 502, up.statusMessage, headers);
+    up.on("data", (chunk) => {
+      bytes += chunk.length;
+      captureResponse(chunk);
+    });
+    up.pipe(res);
+  });
+  upstream.on("error", (err) => {
+    if (!res.headersSent)
+      responseHeaders = captureHeaders(["content-type", "text/plain; charset=utf-8"]);
+    if (!res.headersSent && !res.destroyed) {
+      res.writeHead(502, { "content-type": "text/plain; charset=utf-8" });
+      const body2 = `LocalDeck: upstream ${target.service} (${target.upstreamHost}:${target.upstreamPort}) error: ${err.code ?? err.message}`;
+      captureResponse(Buffer.from(body2));
+      responseComplete = true;
+      res.end(body2);
+    } else
+      res.destroy();
+    record(502, err.code ?? err.message);
+  });
+  const clientDisconnected = () => {
+    record(499, "client disconnected before response completed");
+    response?.destroy();
+    upstream.destroy();
+  };
+  req.on("aborted", clientDisconnected);
+  res.on("finish", () => record(responseStatus));
+  res.on("close", () => {
+    if (!res.writableFinished)
+      clientDisconnected();
+  });
+  req.on("data", (chunk) => requestBody.append(chunk));
+  req.pipe(upstream);
 }
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
+function proxyUpgrade(req, socket, head, target, hooks) {
+  const started = Date.now();
+  socket.on("error", () => socket.destroy());
+  if (!target.upstreamReady) {
+    socket.end(`HTTP/1.1 503 Service Unavailable\r
+Connection: close\r
+\r
+`);
+    return;
+  }
+  const up = net3.connect(target.upstreamPort, target.upstreamHost, () => {
+    const headers = forwardHeaders(req, target);
+    headers["connection"] = "Upgrade";
+    headers["upgrade"] = req.headers["upgrade"];
+    const lines = [`${req.method} ${req.url} HTTP/1.1`];
+    for (const [k, v] of Object.entries(headers)) {
+      if (v === undefined)
+        continue;
+      for (const val of Array.isArray(v) ? v : [String(v)])
+        lines.push(`${k}: ${val}`);
+    }
+    up.write(lines.join(`\r
+`) + `\r
+\r
+`);
+    if (head.length)
+      up.write(head);
+    up.pipe(socket).pipe(up);
+    hooks.onRequest({
+      ts: started,
+      service: target.service,
+      method: req.method ?? "GET",
+      path: req.url ?? "/",
+      status: 101,
+      durationMs: Date.now() - started,
+      bytes: 0,
+      requestHeaders: captureHeaders(req.rawHeaders),
+      via: target.via
+    });
+  });
+  const kill = () => {
+    up.destroy();
+    socket.destroy();
+  };
+  up.on("error", kill);
+  socket.on("error", kill);
+  socket.on("close", () => up.destroy());
+  up.on("close", () => socket.destroy());
 }
 
 // ../daemon/src/share.ts
-import http3 from "node:http";
+import http4 from "node:http";
 
 // ../daemon/src/share-readiness.ts
 import { setTimeout as delay } from "node:timers/promises";
@@ -4518,7 +5389,7 @@ class ShareManager {
     const publicRequest = new Promise((resolve) => {
       confirmPublicRequest = resolve;
     });
-    const gate = http3.createServer((req, res) => {
+    const gate = http4.createServer((req, res) => {
       if (publicHost && req.headers.host?.toLowerCase() === publicHost)
         confirmPublicRequest();
       if (req.method === "GET" && req.url === `/__localdeck/ready/${probe}`) {
@@ -4538,7 +5409,7 @@ class ShareManager {
           req.resume();
           return;
         }
-        let body = "";
+        let body2 = "";
         let bytes = 0;
         let tooLarge = false;
         req.on("data", (c) => {
@@ -4547,16 +5418,16 @@ class ShareManager {
           bytes += c.length;
           if (bytes > MAX_LOGIN_BYTES) {
             tooLarge = true;
-            body = "";
+            body2 = "";
           } else
-            body += c;
+            body2 += c;
         });
         req.on("end", () => {
           if (tooLarge) {
             res.writeHead(413, { "content-type": "text/plain; charset=utf-8" }).end("LocalDeck: login request is too large");
             return;
           }
-          const given = new URLSearchParams(body).get("password") ?? "";
+          const given = new URLSearchParams(body2).get("password") ?? "";
           const ok = passwordsMatch(given, password);
           if (ok) {
             const s = this.shares.get(key);
@@ -4931,339 +5802,131 @@ async function viaSs(pids) {
     const match = columns[3].match(/^(.*):(\d+)$/);
     if (!match)
       continue;
-    for (const pidMatch of line.matchAll(/pid=(\d+)/g)) {
-      const pid2 = Number(pidMatch[1]);
-      if (wanted.has(pid2))
-        out.push({ pid: pid2, host: normalizeHost(match[1]), port: Number(match[2]) });
-    }
-  }
-  return out;
-}
-function normalizeHost(host) {
-  const normalized = host.replace(/^\[|\]$/g, "");
-  return normalized === "*" || normalized === "0.0.0.0" || normalized === "::" || normalized === "" ? "*" : normalized;
-}
-function reachable(listener) {
-  return listener.host === "*" || listener.host === "127.0.0.1" || listener.host === "::1";
-}
-function chooseUpstream(listeners, assignedPort) {
-  let lowest;
-  for (const listener of listeners) {
-    if (IGNORED_PORTS.has(listener.port) || !reachable(listener))
-      continue;
-    if (listener.port === assignedPort)
-      return listener;
-    if (!lowest || listener.port < lowest.port)
-      lowest = listener;
-  }
-  return lowest;
-}
-function unreachableListenerMessage(listeners) {
-  const candidates = listeners.filter((listener2) => !IGNORED_PORTS.has(listener2.port));
-  if (candidates.some(reachable))
-    return;
-  const listener = candidates[0];
-  if (!listener)
-    return;
-  const address = listener.host.includes(":") ? `[${listener.host}]:${listener.port}` : `${listener.host}:${listener.port}`;
-  return `the process is listening only on ${address}, which LocalDeck cannot reach. Bind it to localhost (127.0.0.1) or all interfaces (0.0.0.0) instead.`;
-}
-function connectHost(listener) {
-  return listener.host === "*" ? "127.0.0.1" : listener.host;
-}
-function streamLines(stream, onLine) {
-  const decoder = new StringDecoder("utf8");
-  let buffered = "";
-  let partialLineEmitted = false;
-  const emitBounded = (line, force = false) => {
-    if (!force && !line.trim())
-      return;
-    const remaining = emitUtf8Prefixes(line, onLine);
-    if (remaining)
-      onLine(remaining);
-  };
-  const consume = (text) => {
-    buffered += text;
-    const lines = buffered.split(/\r?\n/);
-    buffered = lines.pop() ?? "";
-    for (const line of lines) {
-      emitBounded(line, partialLineEmitted);
-      partialLineEmitted = false;
-    }
-    buffered = emitUtf8Prefixes(buffered, (line) => {
-      onLine(line);
-      partialLineEmitted = true;
-    });
-  };
-  stream.on("data", (chunk) => consume(typeof chunk === "string" ? chunk : decoder.write(chunk)));
-  stream.on("end", () => {
-    consume(decoder.end());
-    emitBounded(buffered, partialLineEmitted);
-    buffered = "";
-    partialLineEmitted = false;
-  });
-}
-function emitUtf8Prefixes(value, onPrefix) {
-  if (Buffer.byteLength(value) <= MAX_STREAM_LINE_BYTES)
-    return value;
-  let bytes = 0;
-  let start = 0;
-  for (let index = 0;index < value.length; ) {
-    const codePoint = value.codePointAt(index);
-    const width = codePoint <= 127 ? 1 : codePoint <= 2047 ? 2 : codePoint <= 65535 ? 3 : 4;
-    if (bytes + width > MAX_STREAM_LINE_BYTES) {
-      onPrefix(value.slice(start, index));
-      start = index;
-      bytes = 0;
-    }
-    bytes += width;
-    index += codePoint > 65535 ? 2 : 1;
-  }
-  return value.slice(start);
-}
-async function defaultTaskkillRunner(file, args, options) {
-  await exec2(file, args, options);
-}
-async function killProcessTree(child, signal, platform = process.platform, runTaskkill = defaultTaskkillRunner) {
-  if (!child.pid)
-    return false;
-  if (platform === "win32") {
-    const args = ["/pid", String(child.pid), "/t"];
-    if (signal === "SIGKILL")
-      args.push("/f");
-    try {
-      await runTaskkill("taskkill.exe", args, { timeout: 5000, killSignal: "SIGKILL" });
-      return true;
-    } catch {
-      try {
-        return child.kill(signal);
-      } catch {
-        return false;
-      }
-    }
-  }
-  try {
-    return process.kill(-child.pid, signal);
-  } catch {
-    try {
-      return child.kill(signal);
-    } catch {
-      return false;
-    }
-  }
-}
-var ANSI_RE = /[\u001B\u009B][[\]()#;?]*(?:(?:(?:[a-zA-Z\d]*(?:;[-a-zA-Z\d\/#&.:=?%@~_]*)*)?\u0007)|(?:(?:\d{1,4}(?:;\d{0,4})*)?[\dA-PR-TZcf-ntqry=><~]))/g;
-function stripAnsi(value) {
-  return value.replace(ANSI_RE, "");
-}
-
-// ../daemon/src/diagnostics.ts
-import fs5 from "node:fs";
-import os3 from "node:os";
-import path5 from "node:path";
-function redactDiagnostic(text, secrets = []) {
-  let output = text.replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/g, "[REDACTED PRIVATE KEY]").replace(/(authorization["']?\s*[:=]\s*["']?)(?:Bearer|Basic)\s+[^\s,"'}]+/gi, "$1[REDACTED]").replace(/((?:set-cookie|cookie)["']?\s*[:=]\s*)[^\r\n]+/gi, "$1[REDACTED]").replace(/(?<![a-z0-9+.-])([a-z][a-z0-9+.-]*:\/\/)([^\s/@]+)@/gi, (match, scheme, credentials) => credentials.includes(":") ? `${scheme}[REDACTED]@` : match).replace(/(?<![\w-])(?=[\w-]*(?:password|passwd|secret|token|api[_-]?key|credential))([\w-]+["']?\s*[:=]\s*)(?:"[^"\n]*"|'[^'\n]*'|[^\s,;&}\n]+)/gi, "$1[REDACTED]").replace(/((?:--)(?:password|token|secret|api-key)\s+)(?:"[^"]*"|'[^']*'|\S+)/gi, "$1[REDACTED]");
-  for (const secret of [...new Set(secrets)].filter(Boolean).sort((a, b) => b.length - a.length))
-    output = output.replaceAll(secret, "[REDACTED]");
-  const home = os3.homedir();
-  if (home.length > 1)
-    output = output.replaceAll(home, "<home>");
-  return output;
-}
-function privateEnvironmentValue(name, value) {
-  if (name === "NODE_ENV" && /^(development|production|test)$/.test(value))
-    return false;
-  if (/^(?:PORT|[A-Z_]+_PORT)$/.test(name) && /^\d{1,5}$/.test(value) && Number(value) > 0 && Number(value) <= 65535)
-    return false;
-  return true;
-}
-function environmentValues(directory) {
-  const values = [];
-  for (const name of [".env", ".env.local", ".env.development", ".env.development.local"]) {
-    const file = path5.join(directory, name);
-    try {
-      const stat = fs5.lstatSync(file);
-      if (!stat.isFile() || stat.size > 65536)
-        continue;
-      const text = fs5.readFileSync(file, "utf8");
-      for (const line of text.split(/\r?\n/)) {
-        const match = line.match(/^\s*(?:export\s+)?([A-Za-z_][\w]*)\s*=\s*(.*)$/);
-        if (match) {
-          const value = match[2].trim().replace(/^(['"])(.*)\1$/, "$2");
-          if (privateEnvironmentValue(match[1], value))
-            values.push(value);
-        }
-      }
-    } catch {}
-  }
-  return values;
-}
-function diagnosticReport(project, services, logs, version, privateValues = []) {
-  const inheritedSecrets = Object.entries(process.env).filter(([name]) => /password|passwd|secret|token|api[_-]?key|credential/i.test(name)).flatMap(([, value]) => value ? [value] : []);
-  const directories = new Set([project.directory, ...project.commands.map((command) => path5.resolve(project.directory, command.cwd ?? "."))]);
-  const secrets = [...privateValues, ...inheritedSecrets, ...[...directories].flatMap(environmentValues), ...project.commands.flatMap((command) => Object.entries(command.env ?? {}).filter(([name, value]) => privateEnvironmentValue(name, value)).map(([, value]) => value))];
-  const report = {
-    notice: "Review before sharing. Known secrets are redacted, but application logs may contain other private data.",
-    version,
-    project: { name: project.name, available: project.available, error: project.error },
-    configuration: project.commands.map(({ env, ...command }) => ({ ...command, environmentVariables: Object.keys(env ?? {}) })),
-    services: services.map((service) => ({ name: service.name, status: service.status, readiness: service.readinessStatus, message: service.readinessMessage, lastError: service.lastError, serviceType: service.serviceType ?? "http", port: service.stablePort })),
-    logs: logs.slice(-100).map(({ stream, line, ts, service }) => ({ service, ts, stream, line: line.slice(0, 2000) }))
-  };
-  const sanitize = (value) => typeof value === "string" ? redactDiagnostic(value, secrets) : Array.isArray(value) ? value.map(sanitize) : value && typeof value === "object" ? Object.fromEntries(Object.entries(value).map(([key, item]) => [key, sanitize(item)])) : value;
-  return JSON.stringify(sanitize(report), null, 2);
-}
-
-// ../daemon/src/replay.ts
-import http4 from "node:http";
-function replayRequest(service, record, options = {}) {
-  if (record.service !== service.key || !["GET", "HEAD"].includes(record.method))
-    throw new Error("Only recorded GET and HEAD requests for this service can be replayed");
-  if (service.status !== "running" || !service.upstreamReady || service.serviceType && service.serviceType !== "http")
-    throw new Error("The HTTP service must be running before replay");
-  if (!["127.0.0.1", "::1"].includes(service.upstreamHost) || !record.path.startsWith("/") || record.path.startsWith("//") || /[\r\n\\\x00-\x20\x7f]/.test(record.path))
-    throw new Error("Request path must be a local HTTP path");
-  const timeoutMs = options.timeoutMs ?? 5000;
-  const maxBytes = options.maxBytes ?? 65536;
-  if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 5000 || !Number.isInteger(maxBytes) || maxBytes < 1 || maxBytes > 65536)
-    throw new Error("Replay limits must be positive integers within 5000 ms and 65536 bytes");
-  return new Promise((resolve, reject) => {
-    const started = Date.now();
-    let settled = false;
-    let bytes = 0;
-    const chunks = [];
-    const request = http4.request({ host: service.upstreamHost, port: service.upstreamPort, path: record.path, method: record.method, headers: { "x-localdeck-replay": "1" } });
-    const timer = setTimeout(() => {
-      if (!settled) {
-        settled = true;
-        reject(new Error("Replay timed out"));
-      }
-      request.destroy();
-    }, timeoutMs);
-    const finish = (status, truncated) => {
-      if (settled)
-        return;
-      settled = true;
-      clearTimeout(timer);
-      resolve({ status, truncated, body: Buffer.concat(chunks).toString("utf8"), durationMs: Date.now() - started });
-    };
-    request.on("response", (response) => {
-      response.on("data", (chunk) => {
-        const remaining = Math.max(0, maxBytes - bytes);
-        chunks.push(chunk.subarray(0, remaining));
-        bytes += chunk.length;
-        if (bytes > maxBytes) {
-          finish(response.statusCode ?? 502, true);
-          response.destroy();
-          request.destroy();
-        }
-      });
-      response.on("end", () => finish(response.statusCode ?? 502, false));
-      response.on("error", (error) => request.destroy(error));
-      response.on("aborted", () => request.destroy(new Error("Replay response was interrupted")));
-    });
-    request.on("error", (error) => {
-      clearTimeout(timer);
-      if (!settled) {
-        settled = true;
-        reject(error);
-      }
-    });
-    request.end();
-  });
+    for (const pidMatch of line.matchAll(/pid=(\d+)/g)) {
+      const pid2 = Number(pidMatch[1]);
+      if (wanted.has(pid2))
+        out.push({ pid: pid2, host: normalizeHost(match[1]), port: Number(match[2]) });
+    }
+  }
+  return out;
 }
-
-// ../daemon/src/project-secrets.ts
-import fs6 from "node:fs";
-import path6 from "node:path";
-var ID = /^[a-f0-9]{16}$/;
-var NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-
-class ProjectSecretError extends Error {
+function normalizeHost(host) {
+  const normalized = host.replace(/^\[|\]$/g, "");
+  return normalized === "*" || normalized === "0.0.0.0" || normalized === "::" || normalized === "" ? "*" : normalized;
 }
-function validateName(name) {
-  if (!NAME.test(name) || name === "PORT" || name.startsWith("LOCALDECK_")) {
-    throw new ProjectSecretError("invalid secret name");
-  }
+function reachable(listener) {
+  return listener.host === "*" || listener.host === "127.0.0.1" || listener.host === "::1";
 }
-function createProjectSecretStore(home = HOME_DIR) {
-  const directory = path6.join(home, "secrets");
-  function secretPath(projectId2) {
-    if (!ID.test(projectId2))
-      throw new ProjectSecretError("invalid project ID");
-    return path6.join(directory, `${projectId2}.json`);
+function chooseUpstream(listeners, assignedPort) {
+  let lowest;
+  for (const listener of listeners) {
+    if (IGNORED_PORTS.has(listener.port) || !reachable(listener))
+      continue;
+    if (listener.port === assignedPort)
+      return listener;
+    if (!lowest || listener.port < lowest.port)
+      lowest = listener;
   }
-  function read(projectId2) {
-    const file = secretPath(projectId2);
-    let text;
-    try {
-      text = fs6.readFileSync(file, "utf8");
-    } catch (error) {
-      if (error.code === "ENOENT")
-        return Object.create(null);
-      throw new ProjectSecretError("Could not read stored secrets");
+  return lowest;
+}
+function unreachableListenerMessage(listeners) {
+  const candidates = listeners.filter((listener2) => !IGNORED_PORTS.has(listener2.port));
+  if (candidates.some(reachable))
+    return;
+  const listener = candidates[0];
+  if (!listener)
+    return;
+  const address = listener.host.includes(":") ? `[${listener.host}]:${listener.port}` : `${listener.host}:${listener.port}`;
+  return `the process is listening only on ${address}, which LocalDeck cannot reach. Bind it to localhost (127.0.0.1) or all interfaces (0.0.0.0) instead.`;
+}
+function connectHost(listener) {
+  return listener.host === "*" ? "127.0.0.1" : listener.host;
+}
+function streamLines(stream, onLine) {
+  const decoder = new StringDecoder("utf8");
+  let buffered = "";
+  let partialLineEmitted = false;
+  const emitBounded = (line, force = false) => {
+    if (!force && !line.trim())
+      return;
+    const remaining = emitUtf8Prefixes(line, onLine);
+    if (remaining)
+      onLine(remaining);
+  };
+  const consume = (text) => {
+    buffered += text;
+    const lines = buffered.split(/\r?\n/);
+    buffered = lines.pop() ?? "";
+    for (const line of lines) {
+      emitBounded(line, partialLineEmitted);
+      partialLineEmitted = false;
     }
-    let parsed;
+    buffered = emitUtf8Prefixes(buffered, (line) => {
+      onLine(line);
+      partialLineEmitted = true;
+    });
+  };
+  stream.on("data", (chunk) => consume(typeof chunk === "string" ? chunk : decoder.write(chunk)));
+  stream.on("end", () => {
+    consume(decoder.end());
+    emitBounded(buffered, partialLineEmitted);
+    buffered = "";
+    partialLineEmitted = false;
+  });
+}
+function emitUtf8Prefixes(value, onPrefix) {
+  if (Buffer.byteLength(value) <= MAX_STREAM_LINE_BYTES)
+    return value;
+  let bytes = 0;
+  let start = 0;
+  for (let index = 0;index < value.length; ) {
+    const codePoint = value.codePointAt(index);
+    const width = codePoint <= 127 ? 1 : codePoint <= 2047 ? 2 : codePoint <= 65535 ? 3 : 4;
+    if (bytes + width > MAX_STREAM_LINE_BYTES) {
+      onPrefix(value.slice(start, index));
+      start = index;
+      bytes = 0;
+    }
+    bytes += width;
+    index += codePoint > 65535 ? 2 : 1;
+  }
+  return value.slice(start);
+}
+async function defaultTaskkillRunner(file, args, options) {
+  await exec2(file, args, options);
+}
+async function killProcessTree(child, signal, platform = process.platform, runTaskkill = defaultTaskkillRunner) {
+  if (!child.pid)
+    return false;
+  if (platform === "win32") {
+    const args = ["/pid", String(child.pid), "/t"];
+    if (signal === "SIGKILL")
+      args.push("/f");
     try {
-      parsed = JSON.parse(text);
+      await runTaskkill("taskkill.exe", args, { timeout: 5000, killSignal: "SIGKILL" });
+      return true;
     } catch {
-      throw new ProjectSecretError("stored secrets are corrupt");
-    }
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new ProjectSecretError("stored secrets are corrupt");
-    }
-    const values = Object.create(null);
-    for (const [name, value] of Object.entries(parsed)) {
-      validateName(name);
-      if (typeof value !== "string" || !value || value.includes("\x00")) {
-        throw new ProjectSecretError("stored secrets are corrupt");
+      try {
+        return child.kill(signal);
+      } catch {
+        return false;
       }
-      values[name] = value;
-    }
-    return values;
-  }
-  function write(projectId2, values) {
-    const file = secretPath(projectId2);
-    fs6.mkdirSync(directory, { recursive: true, mode: 448 });
-    if (process.platform !== "win32")
-      fs6.chmodSync(directory, 448);
-    writePrivateJson(file, values);
-  }
-  function listProjectSecrets(projectId2) {
-    return Object.keys(read(projectId2)).sort();
-  }
-  function setProjectSecret(projectId2, name, value) {
-    validateName(name);
-    if (typeof value !== "string" || !value || value.includes("\x00")) {
-      throw new ProjectSecretError("secret value must be a nonempty string without NUL");
     }
-    const values = read(projectId2);
-    values[name] = value;
-    write(projectId2, values);
-  }
-  function deleteProjectSecret(projectId2, name) {
-    validateName(name);
-    const values = read(projectId2);
-    delete values[name];
-    write(projectId2, values);
   }
-  function resolveProjectSecrets(projectId2, names) {
-    const output = Object.create(null);
-    if (!names.length)
-      return output;
-    const values = read(projectId2);
-    for (const name of names) {
-      validateName(name);
-      if (!Object.prototype.hasOwnProperty.call(values, name)) {
-        throw new ProjectSecretError(`Add ${name} in Project → Secrets.`);
-      }
-      output[name] = values[name];
+  try {
+    return process.kill(-child.pid, signal);
+  } catch {
+    try {
+      return child.kill(signal);
+    } catch {
+      return false;
     }
-    return output;
   }
-  return { listProjectSecrets, setProjectSecret, deleteProjectSecret, resolveProjectSecrets };
 }
-var { listProjectSecrets, setProjectSecret, deleteProjectSecret, resolveProjectSecrets } = createProjectSecretStore();
+var ANSI_RE = /[\u001B\u009B][[\]()#;?]*(?:(?:(?:[a-zA-Z\d]*(?:;[-a-zA-Z\d\/#&.:=?%@~_]*)*)?\u0007)|(?:(?:\d{1,4}(?:;\d{0,4})*)?[\dA-PR-TZcf-ntqry=><~]))/g;
+function stripAnsi(value) {
+  return value.replace(ANSI_RE, "");
+}
 
 // ../daemon/src/api.ts
 var MIME = { ".html": "text/html; charset=utf-8", ".js": "text/javascript", ".css": "text/css", ".svg": "image/svg+xml", ".json": "application/json", ".png": "image/png", ".ico": "image/x-icon", ".woff": "font/woff", ".woff2": "font/woff2" };
@@ -5272,9 +5935,9 @@ var MAX_ATTACH_BYTES = 65536;
 var MAX_ATTACH_CWD_CHARS = 4096;
 var MAX_ATTACH_COMMAND_CHARS = 16384;
 var MAX_ATTACH_LOG_CHARS = 16384;
-function json(res, status, body) {
+function json(res, status, body2) {
   res.writeHead(status, { "content-type": "application/json" });
-  res.end(JSON.stringify(body));
+  res.end(JSON.stringify(body2));
 }
 
 class HttpError extends Error {
@@ -5423,7 +6086,7 @@ function createApiServer(deps) {
   const { registry, store, shares } = deps;
   const allowedBrowserOrigins = validatedBrowserOrigins(deps.allowedBrowserOrigins);
   const hooks = { responseBodies: store.responseBodies, onRequest: (r) => store.request(r) };
-  const forwarderIdentity = randomUUID();
+  const forwarderIdentity = randomUUID2();
   const forwarder = new CleanUrls(() => {
     const address = server.address();
     if (!address || typeof address === "string")
@@ -5463,10 +6126,10 @@ function createApiServer(deps) {
         if (req.method === "DELETE")
           return json(res, 200, await forwarder.uninstall());
         if (req.method === "POST") {
-          const body = await readBody(req);
-          if (!body || typeof body !== "object" || Array.isArray(body) || Object.keys(body).some((key) => !["install", "automatic"].includes(key)) || body.install !== undefined && typeof body.install !== "boolean" || body.automatic !== undefined && typeof body.automatic !== "boolean")
+          const body2 = await readBody(req);
+          if (!body2 || typeof body2 !== "object" || Array.isArray(body2) || Object.keys(body2).some((key) => !["install", "automatic"].includes(key)) || body2.install !== undefined && typeof body2.install !== "boolean" || body2.automatic !== undefined && typeof body2.automatic !== "boolean")
             throw new HttpError(400, "invalid forwarding options");
-          return json(res, 200, await forwarder.enable(body));
+          return json(res, 200, await forwarder.enable(body2));
         }
         return json(res, 200, await forwarder.status());
       }
@@ -5593,6 +6256,8 @@ async function handleApi(req, res, url, parts, deps) {
     stopping.catch(() => {});
     return;
   }
+  if (await handleDebuggingApi(req, res, url, parts, deps))
+    return;
   if (parts[0] === "projects") {
     if (parts.length === 1 && method === "GET")
       return json(res, 200, projects.list());
@@ -5600,11 +6265,11 @@ async function handleApi(req, res, url, parts, deps) {
       requireMutationAllowed(deps);
       if (!hasControlToken(req, deps.controlToken))
         throw new HttpError(403, "forbidden");
-      const body = await readBody(req);
+      const body2 = await readBody(req);
       requireMutationAllowed(deps);
-      if (!body || typeof body !== "object" || Array.isArray(body))
+      if (!body2 || typeof body2 !== "object" || Array.isArray(body2))
         throw new HttpError(400, "request body must be a JSON object");
-      const file = body.file;
+      const file = body2.file;
       if (typeof file !== "string")
         throw new HttpError(400, "file must be a string");
       try {
@@ -5634,22 +6299,22 @@ async function handleApi(req, res, url, parts, deps) {
           throw new ProjectError("invalid", project.error ?? "project configuration is invalid");
         const name = parts[3];
         if (method === "PUT") {
-          const body = await readBody(req);
-          if (!body || typeof body !== "object" || Array.isArray(body) || Object.keys(body).length !== 1 || typeof body.value !== "string")
+          const body2 = await readBody(req);
+          if (!body2 || typeof body2 !== "object" || Array.isArray(body2) || Object.keys(body2).length !== 1 || typeof body2.value !== "string")
             throw new HttpError(400, 'request body must contain only a string "value"');
-          (deps.setProjectSecret ?? setProjectSecret)(projectId2, name, body.value);
+          (deps.setProjectSecret ?? setProjectSecret)(projectId2, name, body2.value);
         } else
           (deps.deleteProjectSecret ?? deleteProjectSecret)(projectId2, name);
         return json(res, 200, { ok: true });
       }
       if (parts.length === 3 && parts[2] === "nickname" && method === "PATCH") {
         requireMutationAllowed(deps);
-        const body = await readBody(req);
+        const body2 = await readBody(req);
         requireMutationAllowed(deps);
-        if (!body || typeof body !== "object" || Array.isArray(body) || Object.keys(body).length !== 1 || typeof body.nickname !== "string") {
+        if (!body2 || typeof body2 !== "object" || Array.isArray(body2) || Object.keys(body2).length !== 1 || typeof body2.nickname !== "string") {
           throw new HttpError(400, 'request body must contain only a string "nickname"');
         }
-        const details = projects.saveConfigNickname(projectId2, body.nickname);
+        const details = projects.saveConfigNickname(projectId2, body2.nickname);
         registry.refreshProjectUrls(projectId2);
         return json(res, 200, { ...details, services: registry.list(projectId2) });
       }
@@ -5661,16 +6326,20 @@ async function handleApi(req, res, url, parts, deps) {
         const secretValues = Object.values((deps.resolveProjectSecrets ?? resolveProjectSecrets)(projectId2, names));
         return json(res, 200, { report: diagnosticReport(project, services, logs, deps.version, [deps.controlToken, ...secretValues]) });
       }
-      if (parts.length === 4 && parts[2] === "profiles" && method === "POST") {
+      if (parts.length === 3 && parts[2] === "profiles" && method === "GET") {
+        const details = requireRememberedProject(projects, projectId2);
+        if (!details.available)
+          throw new ProjectError("invalid", details.error ?? "project configuration is invalid");
+        return json(res, 200, profilesResponse(details));
+      }
+      if (parts.length === 4 && parts[2] === "profiles" && parts[3] === "active" && method === "PUT") {
         requireMutationAllowed(deps);
-        await readBody(req);
+        const body2 = await readBody(req);
         requireMutationAllowed(deps);
-        const project = projects.details(projectId2);
-        const names = project.profiles?.[parts[3]];
-        if (!project.available || !names)
-          throw new HttpError(422, "Unknown or unavailable startup profile");
-        const results = await Promise.all(names.map((name) => supervisor.start(projectId2, name)));
-        return json(res, 200, { ok: results.every((result) => result.ok), results });
+        if (!body2 || typeof body2 !== "object" || Array.isArray(body2) || Object.keys(body2).some((key) => key !== "profiles"))
+          throw new HttpError(400, 'request body must be { "profiles": [...] }');
+        const details = projects.setActiveProfiles(projectId2, body2.profiles);
+        return json(res, 200, profilesResponse(details));
       }
       if (parts.length === 2 && method === "GET") {
         const details = projects.details(projectId2);
@@ -5703,14 +6372,14 @@ async function handleApi(req, res, url, parts, deps) {
       }
       if (parts.length === 5 && parts[2] === "services" && parts[4] === "dependencies" && method === "PATCH") {
         requireMutationAllowed(deps);
-        const body = await readBody(req);
+        const body2 = await readBody(req);
         requireMutationAllowed(deps);
-        if (!body || typeof body !== "object" || Array.isArray(body))
+        if (!body2 || typeof body2 !== "object" || Array.isArray(body2))
           throw new HttpError(400, "request body must be a JSON object");
-        const fields = Object.keys(body);
+        const fields = Object.keys(body2);
         if (fields.length !== 1 || fields[0] !== "after")
           throw new HttpError(400, 'request body may contain only "after"');
-        const after = body.after;
+        const after = body2.after;
         if (!Array.isArray(after) || !after.every((dependency) => typeof dependency === "string")) {
           throw new HttpError(400, "after must be an array of service names");
         }
@@ -5768,11 +6437,11 @@ async function handleApi(req, res, url, parts, deps) {
     }
     if (sub === "replay" && method === "POST") {
       requireMutationAllowed(deps);
-      const body = await readBody(req);
+      const body2 = await readBody(req);
       requireMutationAllowed(deps);
-      if (!body || typeof body !== "object" || Array.isArray(body) || Object.keys(body).length !== 1 || typeof body.requestId !== "string")
+      if (!body2 || typeof body2 !== "object" || Array.isArray(body2) || Object.keys(body2).length !== 1 || typeof body2.requestId !== "string")
         throw new HttpError(400, "Provide only a recorded requestId");
-      const record = store.requests(key, 5000).find((request) => request.id === body.requestId);
+      const record = store.requests(key, 5000).find((request) => request.id === body2.requestId);
       if (!record)
         throw new HttpError(404, "Recorded request is no longer available");
       try {
@@ -5814,11 +6483,11 @@ async function handleApi(req, res, url, parts, deps) {
         requireMutationAllowed(deps);
         if (svc.serviceType && svc.serviceType !== "http")
           throw new HttpError(422, "Database endpoints cannot be shared over HTTP");
-        const body = await readBody(req);
+        const body2 = await readBody(req);
         requireMutationAllowed(deps);
-        if (!body || typeof body !== "object" || Array.isArray(body))
+        if (!body2 || typeof body2 !== "object" || Array.isArray(body2))
           throw new HttpError(400, "request body must be a JSON object");
-        const { password, public: isPublic } = body;
+        const { password, public: isPublic } = body2;
         if (password !== undefined && typeof password !== "string")
           throw new HttpError(400, "password must be a string");
         if (isPublic !== undefined && typeof isPublic !== "boolean")
@@ -5851,20 +6520,20 @@ function serveStatic(pathname, res, dir) {
     res.end("<h1>LocalDeck daemon</h1><p>Dashboard not built. Run <code>bun run build</code> in the repo. API is at <a href=/api/services>/api/services</a>.</p>");
     return;
   }
-  let file = path7.join(dir, path7.normalize(pathname).replace(/^(\.\.[/\\])+/, ""));
+  let file = path10.join(dir, path10.normalize(pathname).replace(/^(\.\.[/\\])+/, ""));
   if (!file.startsWith(dir))
-    file = path7.join(dir, "index.html");
-  if (!fs7.existsSync(file) || fs7.statSync(file).isDirectory())
-    file = path7.join(dir, "index.html");
-  const hashedAsset = path7.dirname(file) === path7.join(dir, "assets") && /-[A-Za-z0-9_-]{8,}\.[a-z0-9]+$/i.test(path7.basename(file));
+    file = path10.join(dir, "index.html");
+  if (!fs9.existsSync(file) || fs9.statSync(file).isDirectory())
+    file = path10.join(dir, "index.html");
+  const hashedAsset = path10.dirname(file) === path10.join(dir, "assets") && /-[A-Za-z0-9_-]{8,}\.[a-z0-9]+$/i.test(path10.basename(file));
   res.writeHead(200, {
-    "content-type": MIME[path7.extname(file)] ?? "application/octet-stream",
+    "content-type": MIME[path10.extname(file)] ?? "application/octet-stream",
     "cache-control": hashedAsset ? "public, max-age=31536000, immutable" : "no-cache",
     "x-frame-options": "DENY",
     "content-security-policy": "frame-ancestors 'none'",
     "x-content-type-options": "nosniff"
   });
-  fs7.createReadStream(file).pipe(res);
+  fs9.createReadStream(file).pipe(res);
 }
 function handleAttach(ws, deps) {
   const { registry, store } = deps;
@@ -5986,6 +6655,8 @@ function parseAttachMessage(raw) {
     if (input.upstreamSource !== undefined && input.upstreamSource !== "assigned" && input.upstreamSource !== "manual")
       throw new Error("upstreamSource must be assigned or manual");
     optionalPid(input.pid);
+    if (input.profiles !== undefined && (!Array.isArray(input.profiles) || input.profiles.length > 64 || !input.profiles.every((name) => typeof name === "string" && /^[a-z0-9][a-z0-9_-]{0,40}$/.test(name))))
+      throw new Error("profiles must be an array of profile names");
     return input;
   }
   if (input.type === "log") {
@@ -6068,14 +6739,14 @@ function buildRegistration(message, deps) {
       pid: message.pid
     };
   }
-  const project = deps.projects.details(requestedProject);
+  const project = deps.projects.details(requestedProject, message.profiles);
   if (!project.available)
     throw new ProjectError("invalid", project.error ?? "project configuration is invalid");
-  const command = deps.projects.resolve(requestedProject, canonicalName);
+  const command = deps.projects.resolve(requestedProject, canonicalName, message.profiles);
   if (command.serviceType && command.serviceType !== "http" && (message.upstreamPort !== command.upstream || message.stablePort !== undefined)) {
     throw new Error("database registration must use its configured published upstream port");
   }
-  const cwd = command.cwd ? path7.resolve(project.directory, command.cwd) : project.directory;
+  const cwd = command.cwd ? path10.resolve(project.directory, command.cwd) : project.directory;
   requireDirectory(cwd);
   return {
     key: serviceKey(project.id, command.name),
@@ -6090,12 +6761,23 @@ function buildRegistration(message, deps) {
     upstreamSource: message.upstreamSource ?? (command.upstream === undefined ? "assigned" : "manual"),
     cwd,
     command: command.run,
-    pid: message.pid
+    pid: message.pid,
+    ...project.activeProfiles?.length ? { profiles: project.activeProfiles } : {},
+    configFingerprint: commandFingerprint(command)
+  };
+}
+function profilesResponse(details) {
+  return {
+    profiles: details.profiles ?? [],
+    active: details.activeProfiles ?? [],
+    clashes: details.profileClashes ?? [],
+    ...details.profileError ? { error: details.profileError } : {},
+    ...details.legacyProfiles ? { legacyProfiles: details.legacyProfiles } : {}
   };
 }
 function requireDirectory(cwd) {
   try {
-    if (!fs7.statSync(cwd).isDirectory())
+    if (!fs9.statSync(cwd).isDirectory())
       throw new Error("not a directory");
   } catch {
     throw new Error(`working directory does not exist or is not a directory: ${cwd}`);
@@ -6330,6 +7012,8 @@ class Registry {
       pid: opts.pid,
       cwd: opts.cwd,
       command: opts.command,
+      ...opts.profiles?.length ? { profiles: [...opts.profiles] } : {},
+      ...opts.configFingerprint ? { configFingerprint: opts.configFingerprint } : {},
       startedAt: Date.now(),
       upstreamReady: false,
       urls: [
@@ -6564,7 +7248,12 @@ class Registry {
 }
 
 // ../daemon/src/store.ts
-import fs8 from "node:fs";
+import fs11 from "node:fs";
+
+// ../daemon/src/activity.ts
+import fs10 from "node:fs";
+import path11 from "node:path";
+import { randomUUID as randomUUID3, createHash as createHash4 } from "node:crypto";
 
 // ../daemon/src/history.ts
 function isAfterHistoryBoundary(id, boundary) {
@@ -6575,8 +7264,231 @@ function isAfterHistoryBoundary(id, boundary) {
   return started > boundaryStarted || started === boundaryStarted && sequence > boundarySequence;
 }
 
+// ../daemon/src/activity.ts
+var ERROR = /\b(error|exception|unhandled|fatal|EADDRINUSE|ECONNREFUSED)\b/i;
+var MAX_EVENTS = 2000;
+var MAX_MARKERS = 50;
+function compare(a, b) {
+  if (a.ts !== b.ts)
+    return a.ts - b.ts;
+  if (a.id === b.id)
+    return 0;
+  return isAfterHistoryBoundary(a.id, b.id) ? 1 : isAfterHistoryBoundary(b.id, a.id) ? -1 : a.id.localeCompare(b.id);
+}
+function sanitizeSignature(value, secrets2) {
+  const querySafe = value.replace(/([?&])([^=&#\s]+)=([^&#\s]*)/g, (original, separator, key, raw) => {
+    const decoded = new URLSearchParams(`${key}=${raw}`);
+    const pair = [...decoded][0];
+    if (pair && /password|passwd|secret|token|api[_-]?key|credential|session|signature|authorization|cookie/i.test(pair[0]))
+      return `${separator}${key}=[REDACTED]`;
+    if (pair && secrets2.some((secret) => secret && pair[1].includes(secret)))
+      return `${separator}${key}=[REDACTED]`;
+    return original;
+  });
+  return redactDiagnostic(querySafe, secrets2.flatMap((secret) => [secret, encodeURIComponent(secret)]));
+}
+function boundedSignature(value) {
+  return value.length <= 300 ? value : `${value.slice(0, 230)}… [${createHash4("sha256").update(value).digest("hex")}]`;
+}
+function validEvent(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const e = value;
+  return typeof e.id === "string" && Number.isFinite(e.ts) && typeof e.service === "string" && e.service.includes(":") && ["lifecycle", "clear"].includes(e.kind) && ["info", "error"].includes(e.severity) && typeof e.title === "string" && e.title.length <= 2000 && (e.kind !== "lifecycle" || !!e.transition && typeof e.transition.status === "string");
+}
+function validMarker(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const m = value, b = m.before, c = m.coverage;
+  return typeof m.id === "string" && typeof m.projectId === "string" && Array.isArray(m.services) && m.services.length > 0 && m.services.length <= 100 && m.services.every((s) => typeof s === "string" && s.startsWith(`${m.projectId}:`)) && typeof m.label === "string" && m.label.length <= 100 && Number.isFinite(m.ts) && typeof m.boundary === "string" && !!b && [b.from, b.to, b.requests, b.requestErrors, b.errorLines, b.restarts].every(Number.isFinite) && (b.errorRate === null || Number.isFinite(b.errorRate)) && typeof b.truncated === "boolean" && Array.isArray(b.signatures) && b.signatures.length <= 100 && b.signatures.every((s) => typeof s === "string" && s.length <= 300) && Array.isArray(b.routes) && b.routes.length <= 100 && b.routes.every((r) => r && typeof r.route === "string" && r.route.length <= 300 && [r.count, r.errors, r.avgLatencyMs].every(Number.isFinite)) && !!c && typeof c.partial === "boolean" && Array.isArray(c.reasons) && c.reasons.every((r) => typeof r === "string");
+}
+function summary(events, from, to, secrets2 = []) {
+  const signatures = new Set, routes = new Map;
+  let requests = 0, requestErrors = 0, errorLines = 0, restarts = 0, truncated = false;
+  for (const event of events) {
+    if (event.kind === "request" && event.request) {
+      requests++;
+      if (event.severity === "error")
+        requestErrors++;
+      const text = sanitizeSignature(`${event.request.method} ${event.request.path}`, secrets2);
+      const key = boundedSignature(text);
+      if (text.length > 300)
+        truncated = true;
+      if (event.severity === "error") {
+        if (signatures.size < 100)
+          signatures.add(key);
+        else
+          truncated = true;
+      }
+      if (!routes.has(key) && routes.size < 100)
+        routes.set(key, { route: key, count: 0, errors: 0, total: 0 });
+      const row = routes.get(key);
+      if (row) {
+        row.count++;
+        row.errors += Number(event.severity === "error");
+        row.total += event.request.durationMs;
+      } else
+        truncated = true;
+    } else if (event.kind === "log" && event.severity === "error") {
+      errorLines++;
+      const text = sanitizeSignature(event.title, secrets2), signature = boundedSignature(text);
+      if (text.length > 300)
+        truncated = true;
+      if (signatures.size < 100)
+        signatures.add(signature);
+      else
+        truncated = true;
+    } else if (event.kind === "lifecycle" && event.title === "Service restarted")
+      restarts++;
+  }
+  return { from, to, requests, requestErrors, errorRate: requests ? requestErrors / requests : null, errorLines, restarts, signatures: [...signatures], routes: [...routes.values()].map(({ total, ...row }) => ({ ...row, avgLatencyMs: Math.round(total / row.count) })), truncated };
+}
+
+class Activity {
+  store;
+  data;
+  persistenceFailed = false;
+  file;
+  constructor(store, dir) {
+    this.store = store;
+    this.file = path11.join(dir, "activity.json");
+    this.data = { version: 1, events: [], markers: [], startedAt: Date.now() };
+    try {
+      if (fs10.statSync(this.file).size > 16 * 1024 * 1024)
+        throw new Error("Activity history too large");
+      const saved = JSON.parse(fs10.readFileSync(this.file, "utf8"));
+      if (saved.version !== 1 || !Array.isArray(saved.events) || !Array.isArray(saved.markers) || !Number.isFinite(saved.startedAt))
+        throw new Error("Invalid activity history");
+      const events = saved.events.filter(validEvent), markers = saved.markers.filter(validMarker);
+      if (events.length !== saved.events.length || markers.length !== saved.markers.length)
+        this.persistenceFailed = true;
+      this.data = { ...saved, events: events.slice(-MAX_EVENTS), markers: markers.slice(-MAX_MARKERS) };
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        this.persistenceFailed = true;
+    }
+  }
+  persist(strict = false) {
+    try {
+      writePrivateJson(this.file, this.data);
+    } catch (error) {
+      this.persistenceFailed = true;
+      if (strict)
+        throw new Error("Could not save baseline history");
+    }
+  }
+  capture(event) {
+    let row;
+    if (event.type === "service") {
+      const s = event.service;
+      const transition = { status: s.status, readiness: s.readinessStatus, ready: s.upstreamReady, startedAt: s.startedAt };
+      const last = [...this.data.events].reverse().find((e) => e.service === s.key && e.kind === "lifecycle");
+      if (last && JSON.stringify(last.transition) === JSON.stringify(transition))
+        return;
+      const restarted = !!last?.transition?.startedAt && last.transition.startedAt !== s.startedAt && (s.status === "starting" || s.status === "running");
+      row = { id: event.eventId, ts: Date.now(), service: s.key, kind: "lifecycle", severity: s.readinessStatus === "failed" ? "error" : "info", title: restarted ? "Service restarted" : s.readinessStatus === "failed" ? "Readiness failed" : s.status === "running" && s.upstreamReady ? "Service ready" : `Service ${s.status}`, transition };
+    } else if (event.type === "service:removed")
+      row = { id: event.eventId, ts: Date.now(), service: event.name, kind: "lifecycle", severity: "info", title: "Service removed", transition: { status: "removed" } };
+    else if (event.type === "history:cleared")
+      row = { id: event.eventId, ts: Date.now(), service: event.service, kind: "clear", severity: "info", title: `${event.kind === "logs" ? "Logs" : "Requests"} cleared` };
+    if (!row)
+      return;
+    this.data.events.push(row);
+    if (this.data.events.length > MAX_EVENTS)
+      this.data.droppedBefore = this.data.events.shift().ts;
+    this.persist();
+  }
+  scope(projectId2, services) {
+    if (!projectId2 || !services.length || services.length > 100 || services.some((s) => !s.startsWith(`${projectId2}:`)))
+      throw new Error("Select 1–100 services belonging to this project");
+  }
+  records(projectId2, services) {
+    this.scope(projectId2, services);
+    const keys = new Set(services);
+    const events = this.data.events.filter((e) => keys.has(e.service));
+    for (const service of keys) {
+      for (const log of this.store.logs(service, 2000))
+        events.push({ id: log.id, ts: log.ts, service, kind: "log", severity: log.stream === "stderr" || ERROR.test(log.line) ? "error" : "info", title: log.line.slice(0, 2000) });
+      for (const r of this.store.requests(service, 5000))
+        events.push({ id: r.id, ts: r.ts, service, kind: "request", severity: r.error || r.status >= 400 || r.status === 0 ? "error" : "info", title: `${r.method} ${r.path}`.slice(0, 2000), request: { method: r.method, path: r.path, status: r.status, durationMs: r.durationMs, via: r.via } });
+    }
+    return events.sort(compare);
+  }
+  coverage(services, events, from) {
+    const reasons = new Set;
+    if (this.persistenceFailed)
+      reasons.add("Lifecycle history persistence was unavailable.");
+    if (this.data.droppedBefore !== undefined && (from === undefined || from <= this.data.droppedBefore))
+      reasons.add("Older lifecycle events have expired.");
+    if (from !== undefined && from < this.data.startedAt)
+      reasons.add("The observation window begins before lifecycle recording started.");
+    for (const key of services) {
+      const c = this.store.activityCoverage(key);
+      c.reasons.forEach((reason) => reasons.add(reason));
+    }
+    return { partial: reasons.size > 0, reasons: [...reasons], ...events[0] ? { retainedFrom: events[0].ts } : {} };
+  }
+  timeline(projectId2, services, options = {}) {
+    const limit = options.limit ?? 100;
+    if (!Number.isInteger(limit) || limit < 1 || limit > 200)
+      throw new Error("limit must be between 1 and 200");
+    if (options.filter && !["all", "incidents"].includes(options.filter))
+      throw new Error("Unknown activity filter");
+    if (options.query && options.query.length > 200)
+      throw new Error("Search must be at most 200 characters");
+    const all = this.records(projectId2, services), coverage = this.coverage(services, all);
+    let cursor;
+    const scope = createHash4("sha256").update([...new Set(services)].sort().join(",")).digest("hex");
+    if (options.cursor) {
+      try {
+        if (options.cursor.length > 4096)
+          throw 0;
+        cursor = JSON.parse(Buffer.from(options.cursor, "base64url").toString());
+        if (!cursor || !Number.isFinite(cursor.ts) || typeof cursor.id !== "string" || cursor.projectId !== projectId2 || cursor.scope !== scope)
+          throw 0;
+      } catch {
+        throw new Error("Invalid activity cursor for this project and service selection");
+      }
+    }
+    const query2 = options.query?.toLowerCase();
+    const matching = all.filter((e) => (!cursor || compare(e, cursor) < 0) && (!options.eventId || e.id === options.eventId) && (options.filter !== "incidents" || e.severity === "error" || e.kind === "lifecycle" || e.kind === "clear") && (!query2 || `${e.title} ${e.service}`.toLowerCase().includes(query2))).reverse();
+    const items = matching.slice(0, limit), last = items.at(-1);
+    return { items, coverage, ...last && matching.length > limit ? { nextCursor: Buffer.from(JSON.stringify({ ts: last.ts, id: last.id, projectId: projectId2, scope })).toString("base64url") } : {} };
+  }
+  markers(projectId2) {
+    return this.data.markers.filter((m) => m.projectId === projectId2).slice().reverse();
+  }
+  mark(projectId2, services, options = {}) {
+    const ts = options.now ?? Date.now(), all = this.records(projectId2, services);
+    if (options.label !== undefined && (typeof options.label !== "string" || options.label.length > 100))
+      throw new Error("Baseline label must be at most 100 characters");
+    const before = all.filter((e) => e.ts >= ts - 300000 && e.ts <= ts);
+    const marker2 = { id: randomUUID3(), projectId: projectId2, services: [...new Set(services)], label: options.label?.trim() || "Before my change", ts, boundary: this.store.activityBoundary(), before: summary(before, ts - 300000, ts, options.secrets), coverage: this.coverage(services, all, ts - 300000), ...options.git ? { git: options.git } : {} };
+    const previous = this.data.markers;
+    this.data.markers = [...previous, marker2].slice(-MAX_MARKERS);
+    try {
+      this.persist(true);
+    } catch (error) {
+      this.data.markers = previous;
+      throw error;
+    }
+    return marker2;
+  }
+  compare(projectId2, id, now = Date.now(), secrets2 = []) {
+    const marker2 = this.data.markers.find((m) => m.id === id && m.projectId === projectId2);
+    if (!marker2)
+      throw new Error("Baseline not found or expired");
+    const all = this.records(projectId2, marker2.services);
+    const after = summary(all.filter((e) => isAfterHistoryBoundary(e.id, marker2.boundary) && e.ts <= now), marker2.ts, now, secrets2);
+    const coverage = this.coverage(marker2.services, all, marker2.ts);
+    coverage.partial ||= marker2.coverage.partial;
+    coverage.reasons = [...new Set([...marker2.coverage.reasons, ...coverage.reasons])];
+    return { marker: marker2, before: marker2.before, after, newlyObserved: after.signatures.filter((s) => !marker2.before.signatures.includes(s)), notObservedAgain: marker2.before.signatures.filter((s) => !after.signatures.includes(s)), insufficientEvidence: after.requests < 5 || marker2.before.requests < 5, coverage };
+  }
+}
+
 // ../daemon/src/response-bodies.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 var RESPONSE_CACHE_BYTES = 64 * 1024 * 1024;
 var MAX_CAPTURES = 5000;
 
@@ -6588,7 +7500,7 @@ class ResponseBodies {
     this.capacity = capacity;
   }
   start(service) {
-    const id = randomUUID2();
+    const id = randomUUID4();
     while (this.entries.size >= MAX_CAPTURES)
       this.remove(this.entries.keys().next().value);
     this.entries.set(id, { service, body: new BodyCapture(this.capacity), bytes: 0, finished: false, complete: false });
@@ -6643,8 +7555,8 @@ class ResponseBodies {
 }
 
 // ../daemon/src/store.ts
-import path8 from "node:path";
-import { createHash as createHash2 } from "node:crypto";
+import path12 from "node:path";
+import { createHash as createHash5 } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { finished } from "node:stream/promises";
 import { Writable } from "node:stream";
@@ -6706,6 +7618,7 @@ function emptyStats() {
 
 class Store extends EventEmitter {
   responseBodies = new ResponseBodies;
+  activity;
   buckets = new Map;
   logsDir;
   daemonStartedAt;
@@ -6721,38 +7634,39 @@ class Store extends EventEmitter {
     this.logsDir = options.logsDir ?? LOGS_DIR;
     this.daemonStartedAt = options.daemonStartedAt ?? Date.now();
     this.closeAfterMs = options.closeAfterMs ?? DEFAULT_CLOSE_AFTER_MS;
-    this.streamFactory = options.streamFactory ?? ((file, streamOptions) => fs8.createWriteStream(file, streamOptions));
+    this.streamFactory = options.streamFactory ?? ((file, streamOptions) => fs11.createWriteStream(file, streamOptions));
     this.maxFileBytes = Math.max(1, options.maxFileBytes ?? 5 * 1024 * 1024);
     this.maxHistoryBytes = Math.max(1, options.maxHistoryBytes ?? 8 * 1024 * 1024);
     if (options.logsDir === undefined)
       ensureDirs();
     else
-      fs8.mkdirSync(this.logsDir, { recursive: true });
+      fs11.mkdirSync(this.logsDir, { recursive: true });
+    this.activity = new Activity(this, this.logsDir);
   }
   nextId() {
     return `${this.daemonStartedAt.toString(36)}-${(++this.sequence).toString(36)}`;
   }
   compatibilityId(type, service, offset, serialized) {
-    const hash = createHash2("sha256").update(`${type}\x00${service}\x00${offset}\x00${serialized}`).digest("hex");
+    const hash = createHash5("sha256").update(`${type}\x00${service}\x00${offset}\x00${serialized}`).digest("hex");
     return `legacy-${hash}`;
   }
   historyFile(service, type) {
     const suffix = type === "log" ? "log.jsonl" : "requests.jsonl";
-    return path8.join(this.logsDir, `${encodeURIComponent(service)}.${suffix}`);
+    return path12.join(this.logsDir, `${encodeURIComponent(service)}.${suffix}`);
   }
   legacyHistoryFile(service, type) {
     const safe = service.replace(/[^a-z0-9_-]/gi, "_");
     const suffix = type === "log" ? "log.jsonl" : "requests.jsonl";
-    return path8.join(this.logsDir, `${safe}.${suffix}`);
+    return path12.join(this.logsDir, `${safe}.${suffix}`);
   }
   loadHistory(file, type, service, ring, legacyService, budget = this.maxFileBytes) {
     const marker2 = `${this.historyFile(service, type)}.cleared`;
-    const boundary = fs8.existsSync(marker2) ? fs8.readFileSync(marker2, "utf8") : undefined;
+    const boundary = fs11.existsSync(marker2) ? fs11.readFileSync(marker2, "utf8") : undefined;
     let fd;
     let size;
     try {
-      fd = fs8.openSync(file, "r");
-      size = fs8.fstatSync(fd).size;
+      fd = fs11.openSync(file, "r");
+      size = fs11.fstatSync(fd).size;
     } catch (error) {
       if (error.code === "ENOENT")
         return 0;
@@ -6763,9 +7677,9 @@ class Store extends EventEmitter {
     const bytes = Buffer.alloc(count);
     try {
       if (count)
-        fs8.readSync(fd, bytes, 0, count, start);
+        fs11.readSync(fd, bytes, 0, count, start);
     } finally {
-      fs8.closeSync(fd);
+      fs11.closeSync(fd);
     }
     let lines = bytes.toString("binary").split(`
 `);
@@ -6828,14 +7742,14 @@ class Store extends EventEmitter {
       const rotatedReq = `${reqFile}.1`;
       const logCurrentSize = (() => {
         try {
-          return fs8.statSync(logFile).size;
+          return fs11.statSync(logFile).size;
         } catch {
           return 0;
         }
       })();
       const reqCurrentSize = (() => {
         try {
-          return fs8.statSync(reqFile).size;
+          return fs11.statSync(reqFile).size;
         } catch {
           return 0;
         }
@@ -6906,7 +7820,7 @@ class Store extends EventEmitter {
   }
   historyBoundary(service, kind) {
     const marker2 = `${this.historyFile(service, kind === "logs" ? "log" : "request")}.cleared`;
-    return fs8.existsSync(marker2) ? fs8.readFileSync(marker2, "utf8") : undefined;
+    return fs11.existsSync(marker2) ? fs11.readFileSync(marker2, "utf8") : undefined;
   }
   async clearHistory(service, kind) {
     if (this.closing)
@@ -6915,15 +7829,15 @@ class Store extends EventEmitter {
     const state = kind === "logs" ? bucket.logFile : bucket.reqFile;
     const beforeId = this.nextId();
     const marker2 = `${state.file}.cleared`;
-    fs8.writeFileSync(`${marker2}.tmp`, beforeId, { mode: 384 });
-    fs8.renameSync(`${marker2}.tmp`, marker2);
+    fs11.writeFileSync(`${marker2}.tmp`, beforeId, { mode: 384 });
+    fs11.renameSync(`${marker2}.tmp`, marker2);
     bucket[kind].clear();
     if (kind === "requests")
       this.responseBodies.clear(service);
     const operation = state.queue.then(async () => {
       await this.closeStream(state.stream);
-      fs8.writeFileSync(state.file, "", { mode: 384 });
-      fs8.rmSync(`${state.file}.1`, { force: true });
+      fs11.writeFileSync(state.file, "", { mode: 384 });
+      fs11.rmSync(`${state.file}.1`, { force: true });
       state.bytes = 0;
       state.stream = this.streamFactory(state.file, { flags: "a", mode: 384, highWaterMark: 65536 });
       state.disabled = false;
@@ -6942,9 +7856,24 @@ class Store extends EventEmitter {
   }
   emitEvent(ev) {
     const event = { ...ev, eventId: this.nextId() };
+    this.activity.capture(event);
     this.emit("event", event);
     return event;
   }
+  activityBoundary() {
+    return this.nextId();
+  }
+  activityCoverage(service) {
+    const b = this.bucket(service);
+    const reasons = [];
+    if (this.historyBoundary(service, "logs") || this.historyBoundary(service, "requests"))
+      reasons.push("Some history was explicitly cleared.");
+    if (b.logs.last(LOG_RING).length === LOG_RING || b.requests.last(REQ_RING).length === REQ_RING || fs11.existsSync(`${b.logFile.file}.1`) || fs11.existsSync(`${b.reqFile.file}.1`))
+      reasons.push("Older logs or requests may have expired from bounded history.");
+    if (b.persistenceDiagnosticEmitted)
+      reasons.push("Some log or request history could not be persisted.");
+    return { reasons };
+  }
   close() {
     if (!this.closePromise) {
       this.closing = true;
@@ -7010,12 +7939,12 @@ class Store extends EventEmitter {
       } });
     }
     try {
-      if (fs8.existsSync(file))
-        fs8.chmodSync(file, 384);
+      if (fs11.existsSync(file))
+        fs11.chmodSync(file, 384);
     } catch {}
     const state = { stream, file, bytes: (() => {
       try {
-        return fs8.statSync(file).size;
+        return fs11.statSync(file).size;
       } catch {
         return 0;
       }
@@ -7089,8 +8018,8 @@ class Store extends EventEmitter {
     }
     const rotated = `${state.file}.1`;
     try {
-      fs8.rmSync(rotated, { force: true });
-      fs8.renameSync(state.file, rotated);
+      fs11.rmSync(rotated, { force: true });
+      fs11.renameSync(state.file, rotated);
     } catch {
       state.disabled = true;
       this.reportPersistenceFailure(service, bucket, "history rotation");
@@ -7098,7 +8027,7 @@ class Store extends EventEmitter {
     }
     state.stream = this.streamFactory(state.file, { flags: "a", mode: 384, highWaterMark: 65536 });
     try {
-      fs8.chmodSync(state.file, 384);
+      fs11.chmodSync(state.file, 384);
     } catch {}
     state.bytes = 0;
     state.stream.on("error", () => {
@@ -7144,8 +8073,8 @@ function settlesWithin2(promise, timeoutMs) {
 
 // ../daemon/src/supervisor.ts
 import { spawn as spawn3 } from "node:child_process";
-import path10 from "node:path";
-import fs10 from "node:fs";
+import path14 from "node:path";
+import fs13 from "node:fs";
 
 // ../daemon/src/startup-guidance.ts
 function startupGuidance(message) {
@@ -7170,8 +8099,8 @@ function startupGuidance(message) {
 }
 
 // ../daemon/src/port-environment.ts
-import fs9 from "node:fs";
-import path9 from "node:path";
+import fs12 from "node:fs";
+import path13 from "node:path";
 function inferPortEnvironment(command, cwd, port) {
   const visited = new Set;
   const inspect = (input, directory) => {
@@ -7180,7 +8109,7 @@ function inferPortEnvironment(command, cwd, port) {
     const words = typeof input === "string" ? shellWords(input) : input;
     if (!words?.length)
       return;
-    const executable = path9.basename(words[0]).replace(/\.cmd$/, "");
+    const executable = path13.basename(words[0]).replace(/\.cmd$/, "");
     if (words[0].includes("=") || ["echo", "printf"].includes(executable))
       return;
     if (["npm", "pnpm", "yarn", "bun"].includes(executable)) {
@@ -7203,7 +8132,7 @@ function inferPortEnvironment(command, cwd, port) {
               return;
             workspace = value;
           } else
-            target = path9.resolve(directory, value);
+            target = path13.resolve(directory, value);
         } else if (word.startsWith("-") || script)
           return;
         else
@@ -7233,26 +8162,26 @@ function inferPortEnvironment(command, cwd, port) {
     if (name2 && name2 !== "PORT" && !name2.startsWith("LOCALDECK_"))
       return name2;
   };
-  const name = inspect(command, path9.resolve(cwd));
+  const name = inspect(command, path13.resolve(cwd));
   return name ? { [name]: String(port) } : {};
 }
 function shellWords(command) {
   const words = [];
   let word = "";
-  let quote = "";
+  let quote2 = "";
   let started = false;
   for (let i = 0;i < command.length; i++) {
     const char = command[i];
     if (char === "`" || char === "\\" || char === `
 ` || command.slice(i, i + 2) === "$(")
       return;
-    if (quote) {
-      if (char === quote)
-        quote = "";
+    if (quote2) {
+      if (char === quote2)
+        quote2 = "";
       else
-        word += quote === "'" && char === "$" ? "\x00" : char;
+        word += quote2 === "'" && char === "$" ? "\x00" : char;
     } else if (char === '"' || char === "'") {
-      quote = char;
+      quote2 = char;
       started = true;
     } else if (/\s/.test(char)) {
       if (started)
@@ -7266,7 +8195,7 @@ function shellWords(command) {
       started = true;
     }
   }
-  if (quote)
+  if (quote2)
     return;
   if (started)
     words.push(word);
@@ -7274,7 +8203,7 @@ function shellWords(command) {
 }
 function manifest(directory) {
   try {
-    const value = JSON.parse(fs9.readFileSync(path9.join(directory, "package.json"), "utf8"));
+    const value = JSON.parse(fs12.readFileSync(path13.join(directory, "package.json"), "utf8"));
     return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
   } catch {
     return;
@@ -7287,7 +8216,7 @@ function workspaceDirectory(root, selector) {
     return;
   const directories = new Set;
   for (const pattern of patterns.slice(0, 100)) {
-    if (typeof pattern !== "string" || path9.isAbsolute(pattern))
+    if (typeof pattern !== "string" || path13.isAbsolute(pattern))
       continue;
     const parts = pattern.replace(/^\.\//, "").replace(/\/$/, "").split("/");
     if (parts.some((part) => !part || part === ".." || /[^\w@.*-]/.test(part) || part.includes("**")))
@@ -7298,9 +8227,9 @@ function workspaceDirectory(root, selector) {
       const next = [];
       for (const candidate of candidates) {
         try {
-          for (const entry of fs9.readdirSync(candidate, { withFileTypes: true })) {
+          for (const entry of fs12.readdirSync(candidate, { withFileTypes: true })) {
             if (entry.isDirectory() && !["node_modules", ".git"].includes(entry.name) && matcher.test(entry.name))
-              next.push(path9.join(candidate, entry.name));
+              next.push(path13.join(candidate, entry.name));
             if (next.length > 100)
               return;
           }
@@ -7310,7 +8239,7 @@ function workspaceDirectory(root, selector) {
     }
     for (const candidate of candidates) {
       const pkg = manifest(candidate);
-      if (pkg && (candidate === path9.resolve(root, selector) || pkg.name === selector))
+      if (pkg && (candidate === path13.resolve(root, selector) || pkg.name === selector))
         directories.add(candidate);
     }
   }
@@ -7347,7 +8276,7 @@ async function waitForReadiness(command, getService, options = {}) {
     await delay2(Math.min(command.ready.intervalMs, afterProbe), command.name, options.signal);
   }
 }
-function probeHttp(service, path10, expectedStatus, remainingMs, signal) {
+function probeHttp(service, path14, expectedStatus, remainingMs, signal) {
   return new Promise((resolve, reject) => {
     if (signal?.aborted)
       return reject(new Error(`${service.name} readiness cancelled`));
@@ -7365,7 +8294,7 @@ function probeHttp(service, path10, expectedStatus, remainingMs, signal) {
     const request = http7.request({
       host: service.upstreamHost,
       port: service.upstreamPort,
-      path: path10,
+      path: path14,
       method: "GET",
       timeout: Math.max(1, Math.min(remainingMs, 2000))
     }, (response) => {
@@ -7509,8 +8438,8 @@ function secretOutput(values) {
     return result;
   }
   function consume(final) {
-    const secrets = [...values].map(stripVTControlCharacters).filter(Boolean).sort((a, b) => b.length - a.length);
-    if (!secrets.length) {
+    const secrets2 = [...values].map(stripVTControlCharacters).filter(Boolean).sort((a, b) => b.length - a.length);
+    if (!secrets2.length) {
       const output2 = pending;
       pending = "";
       return output2;
@@ -7519,9 +8448,9 @@ function secretOutput(values) {
     let index = 0;
     while (index < pending.length) {
       const remaining = pending.slice(index);
-      if (!final && secrets.some((value) => value.length > remaining.length && value.startsWith(remaining)))
+      if (!final && secrets2.some((value) => value.length > remaining.length && value.startsWith(remaining)))
         break;
-      const match = secrets.find((value) => pending.startsWith(value, index));
+      const match = secrets2.find((value) => pending.startsWith(value, index));
       if (match) {
         output += "[REDACTED]";
         index += match.length;
@@ -7640,11 +8569,11 @@ class ProcessSupervisor {
           return started;
         const hasDependents = project.commands.some((candidate) => candidate.after.includes(command.name));
         if (command.ready.type === "tcp" && !hasDependents) {
-          const cwd2 = command.cwd ? path10.resolve(project.directory, command.cwd) : project.directory;
+          const cwd2 = command.cwd ? path14.resolve(project.directory, command.cwd) : project.directory;
           this.verifyReadiness(command, key, cwd2);
           return started;
         }
-        const cwd = command.cwd ? path10.resolve(project.directory, command.cwd) : project.directory;
+        const cwd = command.cwd ? path14.resolve(project.directory, command.cwd) : project.directory;
         return this.verifyReadiness(command, key, cwd, started);
       })();
       attempts.set(command.name, attempt);
@@ -7790,9 +8719,9 @@ class ProcessSupervisor {
     const project = this.projects.details(projectId2);
     if (!project.available)
       throw new ProjectError("invalid", project.error);
-    const cwd = command.cwd ? path10.resolve(project.directory, command.cwd) : project.directory;
+    const cwd = command.cwd ? path14.resolve(project.directory, command.cwd) : project.directory;
     try {
-      if (!fs10.statSync(cwd).isDirectory())
+      if (!fs13.statSync(cwd).isDirectory())
         throw new Error("not a directory");
     } catch {
       throw new ProjectError("invalid", `configured working directory does not exist or is not a directory: ${cwd}`);
@@ -7833,7 +8762,9 @@ class ProcessSupervisor {
         upstreamSource: command.upstream === undefined ? "assigned" : "manual",
         cwd,
         command: command.run,
-        serviceType: command.serviceType
+        serviceType: command.serviceType,
+        ...project.activeProfiles?.length ? { profiles: project.activeProfiles } : {},
+        configFingerprint: commandFingerprint(command)
       }, () => void this.stop(key, "stop requested"));
     } catch (error) {
       this.releaseAutomaticUpstream(reservedUpstreamPort);
@@ -8025,7 +8956,7 @@ class ProcessSupervisor {
           else {
             const command = this.projects.resolve(projectId2, name);
             const project = this.projects.details(projectId2);
-            const cwd = command.cwd ? path10.resolve(project.directory, command.cwd) : project.directory;
+            const cwd = command.cwd ? path14.resolve(project.directory, command.cwd) : project.directory;
             this.verifyReadiness(command, key, cwd);
           }
           return result;
@@ -8310,7 +9241,7 @@ async function waitForProcessGroupExit(groupId, timeoutMs) {
   return true;
 }
 // ../daemon/package.json
-var version = "1.4.0";
+var version = "1.6.1";
 
 // ../daemon/src/index.ts
 var VERSION = version;
@@ -8327,8 +9258,8 @@ async function startDaemon(opts = {}) {
     writePrivateState: writePrivateJson,
     ...opts.dependencies
   };
-  const stateFile = opts.homeDir ? path11.join(opts.homeDir, "daemon.json") : STATE_FILE;
-  const projectsFile = opts.homeDir ? path11.join(opts.homeDir, "projects.json") : PROJECTS_FILE;
+  const stateFile = opts.homeDir ? path15.join(opts.homeDir, "daemon.json") : STATE_FILE;
+  const projectsFile = opts.homeDir ? path15.join(opts.homeDir, "projects.json") : PROJECTS_FILE;
   const apiPort = opts.apiPort ?? DEFAULT_API_PORT;
   const store = dependencies.createStore();
   const registry = dependencies.createRegistry(store, apiPort);
@@ -8388,16 +9319,16 @@ async function startDaemon(opts = {}) {
         if (stateCleanup === "failed-write") {
           if (!stateWriteAttempted)
             return;
-          fs11.rmSync(`${stateFile}.${process.pid}.tmp`, { force: true });
+          fs14.rmSync(`${stateFile}.${process.pid}.tmp`, { force: true });
           if (priorState)
             restorePrivateState(stateFile, priorState.contents, priorState.mode);
           else
-            fs11.rmSync(stateFile, { force: true });
+            fs14.rmSync(stateFile, { force: true });
           return;
         }
         const state = readJson(stateFile, null);
         if (state?.pid === process.pid)
-          fs11.unlinkSync(stateFile);
+          fs14.unlinkSync(stateFile);
       }));
       return errors;
     })();
@@ -8423,9 +9354,9 @@ async function startDaemon(opts = {}) {
       });
     });
     server.on("error", (error) => console.error(`LocalDeck: API server error: ${error.message}`));
-    if (fs11.existsSync(stateFile)) {
-      const stat = fs11.statSync(stateFile);
-      priorState = { contents: fs11.readFileSync(stateFile), mode: stat.mode & 511 };
+    if (fs14.existsSync(stateFile)) {
+      const stat = fs14.statSync(stateFile);
+      priorState = { contents: fs14.readFileSync(stateFile), mode: stat.mode & 511 };
     }
     stateWriteAttempted = true;
     dependencies.writePrivateState(stateFile, {
@@ -8446,9 +9377,9 @@ async function startDaemon(opts = {}) {
 }
 function restorePrivateState(file, contents, mode) {
   const temporary = `${file}.${process.pid}.restore.tmp`;
-  fs11.writeFileSync(temporary, contents, { mode });
-  fs11.chmodSync(temporary, mode);
-  fs11.renameSync(temporary, file);
+  fs14.writeFileSync(temporary, contents, { mode });
+  fs14.chmodSync(temporary, mode);
+  fs14.renameSync(temporary, file);
 }
 function toError3(error) {
   return error instanceof Error ? error : new Error(String(error));
@@ -8469,7 +9400,7 @@ function createOperationTracker() {
 async function findDaemon(stateFile = STATE_FILE) {
   let state;
   try {
-    state = JSON.parse(fs11.readFileSync(stateFile, "utf8"));
+    state = JSON.parse(fs14.readFileSync(stateFile, "utf8"));
   } catch (error) {
     const code = error.code;
     if (code === "EACCES" || code === "EPERM") {
@@ -8485,8 +9416,8 @@ async function findDaemon(stateFile = STATE_FILE) {
     const res = await fetch(`http://127.0.0.1:${state.apiPort}/api/status`, { signal: AbortSignal.timeout(1000) });
     if (!res.ok)
       return null;
-    const body = await res.json();
-    return body.pid === state.pid ? state : null;
+    const body2 = await res.json();
+    return body2.pid === state.pid ? state : null;
   } catch {
     return null;
   }
@@ -8494,24 +9425,24 @@ async function findDaemon(stateFile = STATE_FILE) {
 
 // src/client.ts
 import { spawn as spawn4, spawnSync } from "node:child_process";
-import fs12 from "node:fs";
-import path12 from "node:path";
+import fs15 from "node:fs";
+import path16 from "node:path";
 import { fileURLToPath } from "node:url";
 function dashboardDir() {
-  const here = path12.dirname(fileURLToPath(import.meta.url));
+  const here = path16.dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    path12.resolve(here, "../dashboard"),
-    path12.resolve(here, "../../dashboard/dist")
+    path16.resolve(here, "../dashboard"),
+    path16.resolve(here, "../../dashboard/dist")
   ];
-  return candidates.find((d) => fs12.existsSync(path12.join(d, "index.html")));
+  return candidates.find((d) => fs15.existsSync(path16.join(d, "index.html")));
 }
 function daemonCommand() {
   const entry = process.argv[1];
   const runningUnderBun = Boolean(process.versions.bun);
   if (runningUnderBun) {
-    const dist = path12.resolve(path12.dirname(fileURLToPath(import.meta.url)), "../dist/index.js");
+    const dist = path16.resolve(path16.dirname(fileURLToPath(import.meta.url)), "../dist/index.js");
     const hasNode = spawnSync("node", ["--version"], { stdio: "ignore" }).status === 0;
-    if (fs12.existsSync(dist) && hasNode)
+    if (fs15.existsSync(dist) && hasNode)
       return ["node", [dist, "daemon", "run"]];
     console.warn("LocalDeck: starting daemon under Bun — WebSocket proxying (HMR) will not work. Run `bun run build` and make sure `node` is on PATH.");
   }
@@ -8524,8 +9455,8 @@ async function ensureDaemon() {
   const running = await findDaemon();
   if (running)
     return running;
-  fs12.mkdirSync(path12.dirname(DAEMON_LOG), { recursive: true });
-  const out = fs12.openSync(DAEMON_LOG, "a");
+  fs15.mkdirSync(path16.dirname(DAEMON_LOG), { recursive: true });
+  const out = fs15.openSync(DAEMON_LOG, "a");
   const [cmd, args] = daemonCommand();
   const child = spawn4(cmd, args, { detached: true, stdio: ["ignore", out, out], env: process.env });
   child.unref();
@@ -8551,12 +9482,12 @@ class Api {
   get base() {
     return `http://127.0.0.1:${this.port}`;
   }
-  async call(method, p, body, headers) {
+  async call(method, p, body2, headers) {
     const res = await this.fetch(this.base + p, {
       method,
       ...this.timeoutMs ? { signal: AbortSignal.timeout(this.timeoutMs) } : {},
-      headers: { ...body ? { "content-type": "application/json" } : {}, ...headers },
-      body: body ? JSON.stringify(body) : undefined
+      headers: { ...body2 ? { "content-type": "application/json" } : {}, ...headers },
+      body: body2 ? JSON.stringify(body2) : undefined
     });
     const data = await res.json().catch(() => ({}));
     if (!res.ok) {
@@ -8567,10 +9498,31 @@ class Api {
   }
   projects = () => this.call("GET", "/api/projects");
   project = (id) => this.call("GET", `/api/projects/${encodeURIComponent(id)}`);
+  timeline = (projectId2, options = {}) => {
+    const params = new URLSearchParams;
+    if (options.services)
+      params.set("services", options.services.join(","));
+    for (const field of ["filter", "query", "cursor", "limit"]) {
+      if (options[field] !== undefined)
+        params.set(field, String(options[field]));
+    }
+    return this.call("GET", `/api/projects/${encodeURIComponent(projectId2)}/activity?${params}`);
+  };
+  markBaseline = (projectId2, body2) => this.call("POST", `/api/projects/${encodeURIComponent(projectId2)}/baselines`, body2);
+  baselines = (projectId2) => this.call("GET", `/api/projects/${encodeURIComponent(projectId2)}/baselines`);
+  compareBaseline = (projectId2, baselineId) => this.call("GET", `/api/projects/${encodeURIComponent(projectId2)}/baselines/${encodeURIComponent(baselineId)}`);
+  environments = (projectId2) => this.call("GET", `/api/projects/${encodeURIComponent(projectId2)}/environments`);
+  registerEnvironment = (projectId2, environmentId) => this.call("POST", `/api/projects/${encodeURIComponent(projectId2)}/environments/${encodeURIComponent(environmentId)}/register`, {});
+  exportRequest = (serviceKey2, requestId) => this.call("GET", `/api/services/${encodeURIComponent(serviceKey2)}/reproduction?requestId=${encodeURIComponent(requestId)}`);
+  saveCheck = (projectId2, body2) => this.call("POST", `/api/projects/${encodeURIComponent(projectId2)}/checks`, body2);
+  checks = (projectId2) => this.call("GET", `/api/projects/${encodeURIComponent(projectId2)}/checks`);
+  runCheck = (projectId2, checkId) => this.call("POST", `/api/projects/${encodeURIComponent(projectId2)}/checks/${encodeURIComponent(checkId)}/run`, {});
   serviceAction = (projectId2, name, action) => this.call("POST", `/api/projects/${encodeURIComponent(projectId2)}/services/${encodeURIComponent(name)}/${action}`, {});
   shareInfo = (key) => this.call("GET", `/api/services/${encodeURIComponent(key)}/share`);
   replay = (key, requestId) => this.call("POST", `/api/services/${encodeURIComponent(key)}/replay`, { requestId });
   services = () => this.call("GET", "/api/services");
+  profiles = (projectId2) => this.call("GET", `/api/projects/${encodeURIComponent(projectId2)}/profiles`);
+  setActiveProfiles = (projectId2, profiles) => this.call("PUT", `/api/projects/${encodeURIComponent(projectId2)}/profiles/active`, { profiles });
   rememberProject = (file, token) => this.call("POST", "/api/projects/remember", { file }, { authorization: `Bearer ${token}` });
   async servicePath(reference) {
     const separator = reference.lastIndexOf("/");
@@ -8595,4 +9547,4 @@ class Api {
   shutdown = () => this.call("POST", "/api/shutdown");
 }
 
-export { __toESM, __commonJS, __export, __require, wrapper_default, startForwarder, HOME_DIR, STATE_FILE, DEFAULT_API_PORT, assertUserRuntime, isPortFree, getFreePort, findProjectFile, loadProject, loadProjectFile, shellCommand, serviceKey, processTree, listeningPorts, chooseUpstream, unreachableListenerMessage, connectHost, streamLines, killProcessTree, stripAnsi, redactDiagnostic, environmentValues, listProjectSecrets, resolveProjectSecrets, startupGuidance, inferPortEnvironment, startupLayers, waitForReadiness, secretOutput, VERSION, startDaemon, findDaemon, dashboardDir, ensureDaemon, Api };
+export { __toESM, __commonJS, __export, __require, wrapper_default, HOME_DIR, STATE_FILE, DEFAULT_API_PORT, assertUserRuntime, isPortFree, getFreePort, findProjectFile, loadProject, loadProjectFile, applyProfiles, shellCommand, redactDiagnostic, environmentValues, listProjectSecrets, resolveProjectSecrets, startForwarder, serviceKey, processTree, listeningPorts, chooseUpstream, unreachableListenerMessage, connectHost, streamLines, killProcessTree, stripAnsi, startupGuidance, inferPortEnvironment, startupLayers, waitForReadiness, secretOutput, VERSION, startDaemon, findDaemon, dashboardDir, ensureDaemon, Api };