pinggy 0.4.9 → 0.5.1

package/dist/chunk-Y65A4BL2.js

@@ -0,0 +1,3407 @@
+import {
+  ErrorCode,
+  TunnelClient,
+  TunnelOperations,
+  buildRemoteManagementWsUrl,
+  getDaemonInfo,
+  initiateRemoteManagement,
+  isDaemonRunning,
+  isErrorResponse,
+  startDaemon,
+  startRemoteManagement,
+  stopDaemon
+} from "./chunk-VJ4VSZGX.js";
+import {
+  readDaemonConfig
+} from "./chunk-MT44NAXX.js";
+import {
+  Route,
+  SessionMode
+} from "./chunk-BFARGPGP.js";
+import {
+  ConfigVerb,
+  SUBCOMMANDS,
+  Subcommand,
+  deleteConfig,
+  findConfig,
+  getAutoStartConfigs,
+  listSavedConfigs,
+  printConfigDetail,
+  printConfigList,
+  saveConfig,
+  updateConfigAutoStart,
+  updateTunnelConfig,
+  validateName
+} from "./chunk-HUP6YWH6.js";
+import {
+  TunnelManager,
+  detachAllTunnelLoggers,
+  errorMessage,
+  getLocalAddress,
+  getRandomId,
+  getVersion,
+  isTunnelLoggingEnabled,
+  isValidPort,
+  printer_default,
+  setTunnelLoggingEnabled
+} from "./chunk-DLNUDW6G.js";
+import {
+  configureLogger,
+  enablePackageLogging,
+  getLogLevel,
+  logger,
+  setLogLevel
+} from "./chunk-7G6SJEEA.js";
+import {
+  ensurePinggyConfigDir,
+  ensurePinggyLogDir,
+  getDaemonInfoPath,
+  getDaemonLogPath,
+  getPinggyConfigDir,
+  getTunnelLogDir,
+  getTunnelLogPath
+} from "./chunk-GBYF2H4H.js";
+
+// src/cli/options.ts
+var cliOptions = {
+  // SSH-like options
+  R: { type: "string", multiple: true, description: "Local port. Eg. -R0:localhost:3000 will forward tunnel connections to local port 3000." },
+  L: { type: "string", multiple: true, description: "Web Debugger address. Eg. -L4300:localhost:4300 will start web debugger on port 4300." },
+  o: { type: "string", multiple: true, description: "Options", hidden: true },
+  "server-port": { type: "string", short: "p", description: "Pinggy server port. Default: 443" },
+  v4: { type: "boolean", short: "4", description: "IPv4 only", hidden: true },
+  v6: { type: "boolean", short: "6", description: "IPv6 only", hidden: true },
+  // These options appear in the ssh command, but we ignore it in CLI
+  t: { type: "boolean", description: "hidden", hidden: true },
+  T: { type: "boolean", description: "hidden", hidden: true },
+  n: { type: "boolean", description: "hidden", hidden: true },
+  N: { type: "boolean", description: "hidden", hidden: true },
+  // Better options
+  type: { type: "string", description: "Type of the connection. Eg. --type tcp" },
+  localport: { type: "string", short: "l", description: "Takes input as [protocol:][host:]port. Eg. --localport https://localhost:8000 OR -l 3000" },
+  debugger: { type: "string", short: "d", description: "Port for web debugger. Eg. --debugger 4300 OR -d 4300" },
+  token: { type: "string", description: "Token for authentication. Eg. --token TOKEN_VALUE" },
+  force: { type: "boolean", short: "f", description: "Forcefully close existing tunnels and establish a new tunnel" },
+  follow: { type: "boolean", description: "Follow log output (stream new lines as they appear)" },
+  // Logging options (CLI overrides env)
+  loglevel: { type: "string", description: "Logging level: ERROR, INFO, DEBUG. Overrides PINGGY_LOG_LEVEL environment variable" },
+  logfile: { type: "string", description: "Path to log file. Overrides PINGGY_LOG_FILE environment variable" },
+  v: { type: "boolean", description: "Print logs to stdout for Cli. Overrides PINGGY_LOG_STDOUT environment variable" },
+  vv: { type: "boolean", description: "Enable detailed logging for the Node.js SDK and Libpinggy, including both info and debug level logs." },
+  vvv: { type: "boolean", description: "Enable all logs from Cli, SDK and internal components." },
+  "no-autoreconnect": { type: "boolean", short: "a", description: "Disable auto reconnection on failure (enabled by default)." },
+  // Save and load config (legacy file-based)
+  saveconf: { type: "string", description: "Create the configuration file based on the options provided here" },
+  conf: { type: "string", description: "Use the configuration file as base. Other options will be used to override this file" },
+  // Used by `pinggy config save` and `buildAndStartTunnel` save flow
+  save: { type: "boolean", short: "s", description: "Save the tunnel config (use with config save or -l)", hidden: true },
+  name: { type: "string", description: "Name for the tunnel config", hidden: true },
+  auto: { type: "boolean", description: "Mark tunnel config for auto-start", hidden: true },
+  // File server
+  serve: { type: "string", description: "Start a webserver to serve files from the specified path. Eg --serve /path/to/files" },
+  // Remote Control
+  "remote-management": { type: "string", description: "Enable remote management of tunnels with token. Eg. --remote-management API_KEY" },
+  manage: { type: "string", description: "Provide a server address to manage tunnels. Eg --manage dashboard.pinggy.io" },
+  noTui: { type: "boolean", description: "Disable TUI in remote management mode" },
+  notui: { type: "boolean", description: "hidden", hidden: true },
+  // Background mode (run tunnel in background via daemon)
+  b: { type: "boolean", description: "Run tunnel in background via daemon. CLI exits after tunnel starts." },
+  all: { type: "boolean", description: "Start all auto-start tunnels" },
+  // Internal daemon child marker
+  "_daemon-child": { type: "boolean", description: "Internal: daemon child process marker", hidden: true },
+  // Misc
+  version: { type: "boolean", description: "Print version" },
+  // Help
+  help: { type: "boolean", short: "h", description: "Show this help message" }
+};
+
+// src/cli/help.ts
+function printHelpMessage() {
+  console.log("\nPinggy CLI Tool - Create secure tunnels to your localhost.");
+  console.log("\nUsage:");
+  console.log("   pinggy [options] -l <port>\n");
+  console.log("Options:");
+  for (const [key, rawValue] of Object.entries(cliOptions)) {
+    const value = rawValue;
+    if (value.hidden) continue;
+    const short = value.short ? `-${value.short}, ` : "    ";
+    const optType = value.type === "boolean" ? "" : "<value>";
+    console.log(`  ${short}--${key.padEnd(17)} ${optType.padEnd(8)} ${value.description}`);
+  }
+  console.log("\nExtended options :");
+  console.log("  x:https                 Enforce HTTPS only (redirect HTTP to HTTPS)");
+  console.log("  x:noreverseproxy        Disable built-in reverse-proxy header injection");
+  console.log("  x:localservertls:host   Connect to local HTTPS server with SNI");
+  console.log("  x:passpreflight         Pass CORS preflight requests unchanged");
+  console.log("  a:Key:Val               Add header");
+  console.log("  u:Key:Val               Update header");
+  console.log("  r:Key                   Remove header");
+  console.log("  b:user:pass             Basic auth");
+  console.log("  k:BEARER                Bearer token");
+  console.log("  w:192.168.1.0/24        IP whitelist (CIDR)");
+  console.log("\nExamples (User-friendly):");
+  console.log("  pinggy -l 3000                           # HTTP(S) tunnel to localhost port 3000");
+  console.log("  pinggy --type tcp -l 22                  # TCP tunnel for SSH (port 22)");
+  console.log("  pinggy -l 8080 -d 4300                   # HTTP tunnel to port 8080 with debugger running at localhost:4300");
+  console.log("  pinggy --token mytoken -l 3000           # Authenticated tunnel");
+  console.log("  pinggy x:https x:xff -l https://localhost:8443  # HTTPS-only + XFF");
+  console.log("  pinggy w:192.168.1.0/24 -l 8080          # IP whitelist restriction");
+  console.log("\nExamples (SSH-style):");
+  console.log("  pinggy -R0:localhost:3000                        # Basic HTTP tunnel");
+  console.log("  pinggy --type tcp -R0:localhost:22               # TCP tunnel for SSH");
+  console.log("  pinggy -R0:localhost:8080 -L4300:localhost:4300  # HTTP tunnel with debugger");
+  console.log("  pinggy tcp@ap.example.com -R0:localhost:22       # TCP tunnel to region");
+  console.log("\nConfig Management:");
+  console.log("  pinggy config list                                           # List saved configs");
+  console.log("  pinggy config show my-tunnel                                 # Show config details");
+  console.log("  pinggy config save my-tunnel -l 3000 token@pro.pinggy.io     # Save config");
+  console.log("  pinggy config save my-tunnel --auto -l 3000                  # Save with auto-start");
+  console.log("  pinggy config update my-tunnel -l 4000                       # Update saved config");
+  console.log("  pinggy config delete my-tunnel                               # Delete saved config");
+  console.log("  pinggy config auto my-tunnel                                 # Enable auto-start");
+  console.log("  pinggy config noauto my-tunnel                               # Disable auto-start");
+  console.log("\nStart Saved Tunnels:");
+  console.log("  pinggy start my-tunnel                                       # Start saved tunnel");
+  console.log("  pinggy start my-tunnel -l 4000                               # Start with runtime overrides");
+  console.log("  pinggy start tunnela tunnelb                                 # Start multiple tunnels");
+  console.log("  pinggy start --all                                           # Start all auto-start tunnels\n");
+  console.log("\nTunnel Management:");
+  console.log("  pinggy ps                                                    # List running tunnels");
+  console.log("  pinggy stop <name|id>                                        # Stop a running tunnel");
+  console.log("  pinggy attach <name|id>                                      # Re-attach TUI to a running tunnel");
+  console.log("  pinggy restart <name|id>                                     # Restart a running tunnel (picks up latest log level)");
+  console.log("  pinggy logs [-f] [<name|id>]                                 # Show (or follow) tunnel or daemon logs");
+  console.log("  pinggy log level [debug|info|error]                          # Get or set the log level");
+  console.log("  pinggy log path [<name|id>]                                  # Print log file path");
+  console.log("\nBackground Mode:");
+  console.log("  pinggy -l 3000 --b                                           # Start tunnel in background");
+  console.log("  pinggy start my-tunnel --b                                   # Start saved tunnel in background");
+  console.log("\nDaemon Lifecycle (also: pinggy d <command>):");
+  console.log("  pinggy daemon start                                          # Start the background daemon");
+  console.log("  pinggy daemon stop                                           # Stop the daemon (stops all tunnels)");
+  console.log("  pinggy daemon status                                         # Show daemon PID and uptime");
+}
+
+// src/utils/parseArgs.ts
+import { parseArgs } from "util";
+import * as os from "os";
+function isAttachedReverseOrLocalFlag(arg) {
+  return /^-[RL].+/.test(arg);
+}
+function shouldMergeReverseOrLocalFragment(current, next) {
+  if (next.startsWith("-")) {
+    return false;
+  }
+  if (next.startsWith(".")) {
+    return true;
+  }
+  const body = current.slice(2);
+  if (body.endsWith(":")) {
+    return true;
+  }
+  if (body.includes("//") && !body.includes(":")) {
+    return true;
+  }
+  return false;
+}
+function preprocessWindowsArgs(args) {
+  if (os.platform() !== "win32") {
+    return args;
+  }
+  ;
+  const out = [];
+  let i = 0;
+  while (i < args.length) {
+    const arg = args[i];
+    if (isAttachedReverseOrLocalFlag(arg)) {
+      let merged = arg;
+      while (i + 1 < args.length && shouldMergeReverseOrLocalFragment(merged, args[i + 1])) {
+        merged += args[i + 1];
+        i++;
+      }
+      out.push(merged);
+      i++;
+      continue;
+    }
+    out.push(arg);
+    i++;
+  }
+  return out;
+}
+function parseCliArgs(options, overrideArgs) {
+  const rawArgs = overrideArgs ?? process.argv.slice(2);
+  const processedArgs = preprocessWindowsArgs(rawArgs);
+  const parsed = parseArgs({
+    args: processedArgs,
+    options,
+    allowPositionals: true
+  });
+  const hasAnyArgs = parsed.positionals.length > 0 || Object.values(parsed.values).some((v) => v !== void 0 && v !== false);
+  return {
+    ...parsed,
+    hasAnyArgs
+  };
+}
+
+// src/main.ts
+import { fileURLToPath } from "url";
+import { argv } from "process";
+import { realpathSync } from "fs";
+
+// src/cli/defaults.ts
+var defaultOptions = {
+  version: "1.0",
+  token: void 0,
+  // No default token
+  serverAddress: "a.pinggy.io",
+  forwarding: "localhost:8000",
+  webDebugger: "",
+  ipWhitelist: [],
+  basicAuth: [],
+  bearerTokenAuth: [],
+  headerModification: [],
+  force: false,
+  xForwardedFor: false,
+  httpsOnly: false,
+  originalRequestUrl: false,
+  allowPreflight: false,
+  reverseProxy: true,
+  autoReconnect: true
+};
+
+// src/cli/extendedOptions.ts
+import { isIP } from "net";
+function parseExtendedOptions(options, config, localServerTls) {
+  if (!options) return localServerTls;
+  for (const opt of options) {
+    const [key, value] = opt.replace(/^"|"$/g, "").split(/:(.*)/).filter(Boolean);
+    switch (key) {
+      case "x":
+        switch (value) {
+          case "https":
+          case "httpsonly":
+            config.httpsOnly = true;
+            break;
+          case "passpreflight":
+          case "allowpreflight":
+            config.allowPreflight = true;
+            break;
+          case "noreverseproxy":
+            config.reverseProxy = false;
+            break;
+          case "xff":
+            config.xForwardedFor = true;
+            break;
+          case "fullurl":
+          case "fullrequesturl":
+            config.originalRequestUrl = true;
+            break;
+          default: {
+            if (value && (value.startsWith("localServerTls") || value.startsWith("localservertls"))) {
+              const parts = value.split(/:(.+)/);
+              localServerTls = parts[1] ? parts[1] : "";
+            } else {
+              printer_default.warn(`Unknown extended option "${value}"`);
+              logger.warn(`Warning: Unknown extended option "${value}"`);
+            }
+            break;
+          }
+        }
+        break;
+      case "w":
+        if (value) {
+          const ips = value.split(",").map((ip) => ip.trim()).filter(Boolean);
+          const invalidIps = ips.filter((ip) => !(isValidIpV4Cidr(ip) || isValidIpV6Cidr(ip)));
+          if (invalidIps.length > 0) {
+            printer_default.warn(`Invalid IP/CIDR(s) in whitelist: ${invalidIps.join(", ")}`);
+            logger.warn(`Warning: Invalid IP/CIDR(s) in whitelist: ${invalidIps.join(", ")}`);
+          }
+          if (!(invalidIps.length > 0)) {
+            config.ipWhitelist = ips;
+          }
+        } else {
+          printer_default.warn(`Extended option "${opt}" for 'w' requires IP(s)`);
+          logger.warn(`Warning: Extended option "${opt}" for 'w' requires IP(s)`);
+        }
+        break;
+      case "k":
+        if (!config.bearerTokenAuth) config.bearerTokenAuth = [];
+        if (value) {
+          config.bearerTokenAuth.push(value);
+        } else {
+          printer_default.warn(`Extended option "${opt}" for 'k' requires a value`);
+          logger.warn(`Warning: Extended option "${opt}" for 'k' requires a value`);
+        }
+        break;
+      case "b":
+        if (value && value.includes(":")) {
+          const [username, password] = value.split(/:(.*)/);
+          if (!config.basicAuth) config.basicAuth = [];
+          config.basicAuth.push({ username, password });
+        } else {
+          printer_default.warn(`Extended option "${opt}" for 'b' requires value in format username:password`);
+          logger.warn(`Warning: Extended option "${opt}" for 'b' requires value in format username:password`);
+        }
+        break;
+      case "a":
+        if (value && value.includes(":")) {
+          const [key2, val] = value.split(/:(.*)/);
+          if (!config.headerModification) config.headerModification = [];
+          config.headerModification.push({ type: "add", key: key2, value: [val] });
+        } else {
+          printer_default.warn(`Extended option "${opt}" for 'a' requires key:value`);
+          logger.warn(`Warning: Extended option "${opt}" for 'a' requires key:value`);
+        }
+        break;
+      case "u":
+        if (value && value.includes(":")) {
+          const [key2, val] = value.split(/:(.*)/);
+          if (!config.headerModification) config.headerModification = [];
+          config.headerModification.push({ type: "update", key: key2, value: [val] });
+        } else {
+          printer_default.warn(`Extended option "${opt}" for 'u' requires key:value`);
+          logger.warn(`Warning: Extended option "${opt}" for 'u' requires key:value`);
+        }
+        break;
+      case "r":
+        if (value) {
+          if (!config.headerModification) config.headerModification = [];
+          config.headerModification.push({ type: "remove", key: value, value: [] });
+        } else {
+          printer_default.warn(`Extended option "${opt}" for 'r' requires a key`);
+        }
+        break;
+      default:
+        printer_default.warn(`Unknown extended option "${key}"`);
+        break;
+    }
+  }
+  return localServerTls;
+}
+function isValidIpV4Cidr(input) {
+  if (input.includes("/")) {
+    const [ip, mask] = input.split("/");
+    if (!ip || !mask) return false;
+    const isIp4 = isIP(ip) === 4;
+    const maskNum = parseInt(mask, 10);
+    const isMaskValid = !isNaN(maskNum) && maskNum >= 0 && maskNum <= 32;
+    return isIp4 && isMaskValid;
+  }
+  return false;
+}
+function isValidIpV6Cidr(input) {
+  if (input.includes("/")) {
+    const [rawIp, mask] = input.split("/");
+    if (!rawIp || !mask) return false;
+    const ip = rawIp.split("%")[0].replace(/^\[|\]$/g, "");
+    const isIp6 = isIP(ip) === 6;
+    const maskNum = parseInt(mask, 10);
+    const isMaskValid = !isNaN(maskNum) && maskNum >= 0 && maskNum <= 128;
+    return isIp6 && isMaskValid;
+  }
+  return false;
+}
+
+// src/cli/buildConfig.ts
+import { TunnelType } from "@pinggy/pinggy";
+import fs from "fs";
+import path from "path";
+import { isIP as isIP2 } from "net";
+var domainRegex = /^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/;
+function removeIPv6Brackets(ip) {
+  if (ip.startsWith("[") && ip.endsWith("]")) {
+    return ip.slice(1, -1);
+  }
+  return ip;
+}
+function isValidServerAddress(host) {
+  const normalized = removeIPv6Brackets(host.trim());
+  if (!normalized) {
+    return false;
+  }
+  return domainRegex.test(normalized) || isIP2(normalized) !== 0;
+}
+var KEYWORDS = /* @__PURE__ */ new Set([
+  TunnelType.Http,
+  TunnelType.Tcp,
+  TunnelType.Tls,
+  TunnelType.Udp,
+  TunnelType.TlsTcp,
+  "force",
+  "qr"
+]);
+function isKeyword(str) {
+  return KEYWORDS.has(str.toLowerCase());
+}
+function parseUserAndDomain(str) {
+  let token;
+  let type;
+  let server;
+  let qrCode;
+  let forceFlag;
+  if (!str) {
+    return { token, type, server, qrCode, forceFlag };
+  }
+  if (str.includes("@")) {
+    const [user, domain] = str.split("@", 2);
+    if (isValidServerAddress(domain)) {
+      let processKeyword2 = function(keyword) {
+        if ([TunnelType.Http, TunnelType.Tcp, TunnelType.Tls, TunnelType.Udp, TunnelType.TlsTcp].includes(keyword)) {
+          type = keyword;
+        } else if (keyword === "force") {
+          forceFlag = true;
+        } else if (keyword === "qr") {
+          qrCode = true;
+        }
+      };
+      var processKeyword = processKeyword2;
+      server = domain;
+      const parts = user.split("+");
+      if (parts.length === 0) {
+        return { token, type, server, qrCode, forceFlag };
+      }
+      const firstPart = parts[0];
+      if (!isKeyword(firstPart)) {
+        token = firstPart;
+        for (let i = 1; i < parts.length; i++) {
+          const part = parts[i].toLowerCase();
+          if (!isKeyword(part)) {
+            throw new Error(`Invalid user format: unexpected token '${part}' when keywords are expected.`);
+          }
+          processKeyword2(part);
+        }
+      } else {
+        for (const part of parts) {
+          const lowerPart = part.toLowerCase();
+          if (!isKeyword(lowerPart)) {
+            throw new Error(`Invalid user format: unexpected token '${lowerPart}' when keywords are expected.`);
+          }
+          processKeyword2(lowerPart);
+        }
+      }
+    }
+  } else if (isValidServerAddress(str)) {
+    server = str;
+  }
+  return { token, type, server, qrCode, forceFlag };
+}
+function parseUsers(positionalArgs, explicitToken) {
+  let token;
+  let server;
+  let type;
+  let forceFlag = false;
+  let qrCode = false;
+  let remaining = [...positionalArgs];
+  if (typeof explicitToken === "string") {
+    const parsed = parseUserAndDomain(explicitToken);
+    if (parsed.server) {
+      server = parsed.server;
+    }
+    if (parsed.type) {
+      type = parsed.type;
+    }
+    if (parsed.token) {
+      token = parsed.token;
+    }
+    if (parsed.forceFlag) {
+      forceFlag = true;
+    }
+    if (parsed.qrCode) {
+      qrCode = true;
+    }
+  }
+  if (remaining.length > 0) {
+    const first = remaining[0];
+    const parsed = parseUserAndDomain(first);
+    if (parsed.server) {
+      server = parsed.server;
+      if (parsed.type) {
+        type = parsed.type;
+      }
+      if (parsed.token) {
+        token = parsed.token;
+      }
+      if (parsed.forceFlag) {
+        forceFlag = true;
+      }
+      if (parsed.qrCode) {
+        qrCode = true;
+      }
+      remaining = remaining.slice(1);
+    }
+  }
+  return { token, server, type, forceFlag, qrCode, remaining };
+}
+function parseType(finalConfig, values, inferredType) {
+  const t = inferredType || values.type;
+  if (t === TunnelType.Http || t === TunnelType.Tcp || t === TunnelType.Tls || t === TunnelType.Udp || t === TunnelType.TlsTcp) {
+    return t;
+  }
+}
+function parseLocalPort(finalConfig, values) {
+  if (typeof values.localport !== "string") {
+    return null;
+  }
+  let lp = values.localport.trim();
+  let isHttps = false;
+  if (lp.startsWith("https://")) {
+    isHttps = true;
+    lp = lp.replace(/^https:\/\//, "");
+  } else if (lp.startsWith("http://")) {
+    lp = lp.replace(/^http:\/\//, "");
+  }
+  const parts = lp.split(":");
+  if (parts.length === 1) {
+    const port = parseInt(parts[0], 10);
+    if (!Number.isNaN(port) && isValidPort(port)) {
+      finalConfig.forwarding = `localhost:${port}`;
+    } else {
+      return new Error("Invalid local port");
+    }
+  } else if (parts.length === 2) {
+    const host = parts[0] || "localhost";
+    const port = parseInt(parts[1], 10);
+    if (!Number.isNaN(port) && isValidPort(port)) {
+      finalConfig.forwarding = `${host}:${port}`;
+    } else {
+      return new Error("Invalid local port. Please use -h option for help.");
+    }
+  } else {
+    return new Error("Invalid --localport format. Please use -h option for help.");
+  }
+  return null;
+}
+function isValidHostAddress(host) {
+  const normalized = removeIPv6Brackets(host.trim());
+  if (normalized.length === 0) {
+    return false;
+  }
+  return normalized === "localhost" || isIP2(normalized) !== 0;
+}
+function ipv6SafeSplitColon(s) {
+  const result = [];
+  let buf = "";
+  const stack = [];
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (c === "[") {
+      stack.push(c);
+    } else if (c === "]" && stack.length > 0) {
+      stack.pop();
+    }
+    if (c === ":" && stack.length === 0) {
+      result.push(buf);
+      buf = "";
+    } else {
+      buf += c;
+    }
+  }
+  result.push(buf);
+  return result;
+}
+var VALID_PROTOCOLS = [TunnelType.Http, TunnelType.Tcp, TunnelType.Udp, TunnelType.Tls, TunnelType.TlsTcp];
+function parseDefaultForwarding(forwarding) {
+  const parts = ipv6SafeSplitColon(forwarding);
+  if (parts.length === 3) {
+    const remotePort = parseInt(parts[0], 10);
+    const localDomain = removeIPv6Brackets(parts[1] || "localhost");
+    const localPort = parseInt(parts[2], 10);
+    return { remotePort, localDomain, localPort };
+  }
+  if (parts.length === 4) {
+    const remoteDomain = removeIPv6Brackets(parts[0]);
+    const remotePort = parseInt(parts[1], 10);
+    const localDomain = removeIPv6Brackets(parts[2] || "localhost");
+    const localPort = parseInt(parts[3], 10);
+    return { remoteDomain, remotePort, localDomain, localPort };
+  }
+  return new Error("forwarding address incorrect");
+}
+function parseAdditionalForwarding(forwarding) {
+  const toPort = (v) => {
+    if (!v) {
+      return null;
+    }
+    const n = parseInt(v, 10);
+    return Number.isNaN(n) ? null : n;
+  };
+  const parsed = ipv6SafeSplitColon(forwarding);
+  if (parsed.length !== 4) {
+    return new Error(
+      "forwarding must be in format: [schema//]hostname[/port][@forwardingId]:<placeholder>:<forwardingAddress>:<forwardingPort>"
+    );
+  }
+  const firstPart = parsed[0];
+  const [hostPart] = firstPart.split("@");
+  let protocol = TunnelType.Http;
+  let remoteDomainRaw;
+  let remotePort = 0;
+  if (hostPart.includes("//")) {
+    const [schema, rest] = hostPart.split("//");
+    if (!schema || !VALID_PROTOCOLS.includes(schema)) {
+      return new Error(`invalid protocol: ${schema}`);
+    }
+    protocol = schema;
+    const domainAndPort = rest.split("/");
+    if (domainAndPort.length > 2) {
+      return new Error("invalid forwarding address format");
+    }
+    remoteDomainRaw = domainAndPort[0];
+    if (!remoteDomainRaw || !isValidServerAddress(remoteDomainRaw)) {
+      return new Error("invalid remote domain");
+    }
+    const parsedRemotePort = toPort(domainAndPort[1]);
+    if (protocol === "http") {
+      remotePort = 0;
+    } else {
+      if (parsedRemotePort === null || !isValidPort(parsedRemotePort)) {
+        return new Error(
+          `${protocol} forwarding requires port in format ${protocol}//domain/remotePort`
+        );
+      }
+      remotePort = parsedRemotePort;
+    }
+  } else {
+    remoteDomainRaw = hostPart;
+    if (!isValidServerAddress(remoteDomainRaw)) {
+      return new Error("invalid remote domain");
+    }
+    protocol = TunnelType.Http;
+    remotePort = 0;
+  }
+  const localDomain = removeIPv6Brackets(parsed[2] || "localhost");
+  const localPort = toPort(parsed[3]);
+  if (localPort === null || !isValidPort(localPort)) {
+    return new Error("forwarding address incorrect: invalid local port");
+  }
+  return {
+    type: protocol,
+    listenAddress: `${remoteDomainRaw}:${remotePort}`,
+    address: `${localDomain}:${localPort}`
+  };
+}
+function parseReverseTunnelAddr(finalConfig, values, primaryType) {
+  const reverseTunnel = values.R;
+  let forwardingData = [];
+  if ((!Array.isArray(reverseTunnel) || reverseTunnel.length === 0) && !values.localport && !finalConfig.forwarding) {
+    return new Error("local port not specified. Please use '-h' option for help.");
+  }
+  if (!Array.isArray(reverseTunnel) || reverseTunnel.length === 0) {
+    return null;
+  }
+  for (const forwarding of reverseTunnel) {
+    const slicedForwarding = ipv6SafeSplitColon(forwarding);
+    if (slicedForwarding.length === 3) {
+      const parsed = parseDefaultForwarding(forwarding);
+      if (parsed instanceof Error) return parsed;
+      forwardingData.push({
+        address: `${parsed.localDomain}:${parsed.localPort}`,
+        type: primaryType || TunnelType.Http
+      });
+    } else if (slicedForwarding.length === 4) {
+      const parsed = parseAdditionalForwarding(forwarding);
+      if (parsed instanceof Error) {
+        return parsed;
+      }
+      forwardingData.push(parsed);
+    } else {
+      return new Error(
+        "Incorrect command line arguments: reverse tunnel address incorrect. Please use '-h' option for help."
+      );
+    }
+  }
+  finalConfig.forwarding = forwardingData;
+  return null;
+}
+function parseLocalTunnelAddr(finalConfig, values) {
+  if (!Array.isArray(values.L) || values.L.length === 0) {
+    return null;
+  }
+  const firstL = values.L[0];
+  const parts = ipv6SafeSplitColon(firstL);
+  let debuggerHost = "localhost";
+  let lp;
+  if (parts.length === 3) {
+    lp = parseInt(parts[0], 10);
+  } else if (parts.length === 4) {
+    debuggerHost = removeIPv6Brackets(parts[0]);
+    lp = parseInt(parts[1], 10);
+  } else {
+    return new Error("Incorrect command line arguments: web debugger address incorrect. Please use '-h' option for help.");
+  }
+  if (!isValidHostAddress(debuggerHost)) {
+    return new Error(`Invalid debugger host ${debuggerHost}. Please use localhost, IPv4, or IPv6 address.`);
+  }
+  if (!Number.isNaN(lp) && isValidPort(lp)) {
+    finalConfig.webDebugger = `${debuggerHost}:${lp}`;
+  } else {
+    return new Error(`Invalid debugger port ${lp}`);
+  }
+}
+function parseDebugger(finalConfig, values) {
+  let dbg = values.debugger;
+  if (typeof dbg !== "string") {
+    return;
+  }
+  dbg = dbg.startsWith(":") ? dbg.slice(1) : dbg;
+  const d = parseInt(dbg, 10);
+  if (!Number.isNaN(d) && isValidPort(d)) {
+    finalConfig.webDebugger = `localhost:${d}`;
+  } else {
+    logger.error("Invalid debugger port:", dbg);
+    return new Error(`Invalid debugger port ${dbg}. Please use '-h' option for help.`);
+  }
+}
+function parseToken(finalConfig, explicitToken) {
+  if (typeof explicitToken === "string" && explicitToken) {
+    finalConfig.token = explicitToken;
+  }
+}
+function parseArgs2(finalConfig, remainingPositionals) {
+  let localserverTls = "";
+  localserverTls = parseExtendedOptions(remainingPositionals, finalConfig, localserverTls);
+  if (localserverTls.length > 0 && finalConfig.forwarding) {
+    if (typeof finalConfig.forwarding[0] === "object" && "address" in finalConfig.forwarding[0]) {
+      finalConfig.forwarding[0].address = `https://${finalConfig.forwarding[0].address}`;
+    }
+  }
+}
+function storeJson(config, saveconf) {
+  if (saveconf) {
+    const path5 = saveconf;
+    try {
+      fs.writeFileSync(path5, JSON.stringify(config, null, 2), { encoding: "utf-8", flag: "w" });
+      logger.info(`Configuration saved to ${path5}`);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      logger.error("Error loading configuration:", msg);
+    }
+  }
+}
+function loadJsonConfig(config) {
+  const configpath = config["conf"];
+  if (typeof configpath === "string" && configpath.trim().length > 0) {
+    const filepath = path.resolve(configpath);
+    try {
+      const data = fs.readFileSync(filepath, { encoding: "utf-8" });
+      const json = JSON.parse(data);
+      return json;
+    } catch (err) {
+      logger.error("Error loading configuration:", err);
+    }
+  }
+  return null;
+}
+function isSaveConfOption(values) {
+  const saveconf = values["saveconf"];
+  if (typeof saveconf === "string" && saveconf.trim().length > 0) {
+    return saveconf;
+  }
+  return null;
+}
+function parseServe(finalConfig, values) {
+  const sv = values.serve;
+  if (typeof sv !== "string" || sv.trim().length === 0) {
+    return null;
+  }
+  finalConfig.optional.serve = sv;
+  return null;
+}
+function parseAutoReconnect(finalConfig, values) {
+  if (values["no-autoreconnect"]) {
+    finalConfig.autoReconnect = false;
+  }
+  return null;
+}
+function hasRemoteManagement(values) {
+  const token = values["remote-management"];
+  return typeof token === "string" && token.trim().length > 0;
+}
+function buildFinalConfig(values, positionals, baseConfig) {
+  let token;
+  let server;
+  let type;
+  let forceFlag = false;
+  let qrCode = false;
+  let finalConfig = new Object();
+  let saveconf = isSaveConfOption(values);
+  const configFromFile = baseConfig || loadJsonConfig(values);
+  const userParse = parseUsers(positionals, values.token);
+  token = userParse.token;
+  server = userParse.server;
+  type = userParse.type;
+  forceFlag = userParse.forceFlag;
+  qrCode = userParse.qrCode;
+  const remainingPositionals = userParse.remaining;
+  const initialTunnel = type || values.type;
+  finalConfig = {
+    ...defaultOptions,
+    ...configFromFile || {},
+    // Apply loaded config on top of defaults
+    configId: configFromFile?.configId || getRandomId(),
+    token: token || (configFromFile?.token || (typeof values.token === "string" ? values.token : "")),
+    serverAddress: server ? removeIPv6Brackets(server) : configFromFile?.serverAddress || defaultOptions.serverAddress,
+    isQRCode: qrCode || (configFromFile?.isQRCode || false),
+    autoReconnect: configFromFile?.autoReconnect ? configFromFile.autoReconnect : defaultOptions.autoReconnect,
+    optional: {
+      serve: configFromFile?.optional?.serve || void 0,
+      noTui: values.noTui || values.notui || hasRemoteManagement(values) || (configFromFile?.optional?.noTui || false)
+    }
+  };
+  type = parseType(finalConfig, values, type);
+  parseToken(finalConfig, token || values.token);
+  const dbgErr = parseDebugger(finalConfig, values);
+  if (dbgErr instanceof Error) {
+    throw dbgErr;
+  }
+  const lpErr = parseLocalPort(finalConfig, values);
+  if (lpErr instanceof Error) {
+    throw lpErr;
+  }
+  const rErr = parseReverseTunnelAddr(finalConfig, values, type);
+  if (rErr instanceof Error) {
+    throw rErr;
+  }
+  const lErr = parseLocalTunnelAddr(finalConfig, values);
+  if (lErr instanceof Error) {
+    throw lErr;
+  }
+  const serveErr = parseServe(finalConfig, values);
+  if (serveErr instanceof Error) {
+    throw serveErr;
+  }
+  const autoReconnectErr = parseAutoReconnect(finalConfig, values);
+  if (autoReconnectErr instanceof Error) {
+    throw autoReconnectErr;
+  }
+  if (forceFlag || values.force) {
+    finalConfig.force = true;
+  }
+  parseArgs2(finalConfig, remainingPositionals);
+  storeJson(finalConfig, saveconf);
+  return finalConfig;
+}
+
+// src/utils/getFreePort.ts
+import net from "net";
+function getFreePort(webDebugger) {
+  return new Promise((resolve, reject) => {
+    const tryPort = (portToTry) => {
+      const server = net.createServer();
+      server.unref();
+      server.on("error", (err) => {
+        if (portToTry !== 0) {
+          tryPort(0);
+        } else {
+          reject(err);
+        }
+      });
+      server.listen(portToTry, () => {
+        const address = server.address();
+        const port = address ? address.port : 0;
+        server.close(() => resolve(port));
+      });
+    };
+    let providedPort = 0;
+    if (webDebugger && webDebugger.includes(":")) {
+      const portPart = webDebugger.split(":")[1];
+      const parsed = parseInt(portPart, 10);
+      if (!isNaN(parsed) && parsed > 0 && parsed < 65536) {
+        providedPort = parsed;
+      }
+    }
+    tryPort(providedPort);
+  });
+}
+
+// src/cli/startCli.ts
+import pico from "picocolors";
+
+// src/utils/daemonLostMessage.ts
+function daemonLostMessage(reason, detail) {
+  switch (reason) {
+    case "dead":
+      return "Daemon process is no longer running. Tunnel stopped.";
+    case "respawned":
+      return `Daemon was restarted${detail ? ` (${detail})` : ""}. The previous session is gone.`;
+    case "hung":
+      return "Daemon stopped responding after retries. Tunnel stopped.";
+    case "heartbeat":
+      return "Daemon stopped responding to health checks. Tunnel stopped.";
+  }
+}
+
+// src/cli/startCli.ts
+var EXIT_DAEMON_LOST = 3;
+function wireDaemonLost(client, handlers) {
+  client.onDaemonReconnecting(handlers.onReconnecting);
+  client.onDaemonReconnected(handlers.onReconnected);
+  client.onDaemonLost((reason, detail) => {
+    handlers.onLost(reason, detail);
+    printer_default.error(daemonLostMessage(reason, detail));
+    setImmediate(() => process.exit(EXIT_DAEMON_LOST));
+  });
+}
+function installShutdownHandlers(handler) {
+  let fired = false;
+  const wrapped = () => {
+    if (fired) return;
+    fired = true;
+    void handler();
+  };
+  process.on("SIGINT", wrapped);
+  process.on("SIGTERM", wrapped);
+  process.on("SIGHUP", wrapped);
+}
+async function initTunnelClient() {
+  const client = new TunnelClient();
+  printer_default.startSpinner("Initializing...");
+  try {
+    await client.ensureDaemon();
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    printer_default.stopSpinnerFail(`Failed to start daemon: ${msg}`);
+    process.exit(1);
+  }
+  printer_default.stopSpinnerSuccess("Initialized");
+  return client;
+}
+function printRemoteUrls(urls) {
+  for (const url of urls || []) {
+    printer_default.print("  " + pico.magentaBright(url));
+  }
+}
+async function printAlreadyRunning(client, configId, label) {
+  const prefix = label ? `"${label}" ` : "";
+  const list = await client.handleListV2();
+  if (isErrorResponse(list)) {
+    printer_default.warn(`${prefix}is already running, but could not fetch its state: ${list.message}`);
+    return null;
+  }
+  const tunnel = configId ? list.find((t) => t.tunnelconfig?.configId === configId) : void 0;
+  if (!tunnel) {
+    printer_default.warn(`${prefix}is already running, but it is no longer in the tunnel list.`);
+    return null;
+  }
+  const shortId = tunnel.tunnelid.slice(0, 8);
+  const name = tunnel.tunnelconfig?.name || label || shortId;
+  printer_default.info(pico.cyanBright(`Tunnel "${name}" is already running.`));
+  printer_default.print(pico.gray("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  printer_default.print(`  ID:     ${pico.bold(shortId)}`);
+  printer_default.print(`  Status: ${tunnel.status?.state || "unknown"}`);
+  if (tunnel.remoteurls?.length) {
+    printer_default.print("  URLs:");
+    printRemoteUrls(tunnel.remoteurls);
+  }
+  printer_default.print(pico.gray("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  printer_default.print(pico.gray(`Use 'pinggy attach ${name}' to view live output, or 'pinggy stop ${name}' to stop it.`));
+  return tunnel;
+}
+async function startTunnel(client, config, opts) {
+  const result = await client.handleStartV2(config, false, opts.mode);
+  const prefix = opts.label ? `[${opts.label}] ` : "";
+  const fail = (reason) => {
+    const msg = `${prefix}Failed to start tunnel: ${reason}`;
+    if (opts.onError === "fatal") {
+      printer_default.error(msg);
+      client.close();
+      process.exit(1);
+    }
+    printer_default.error(msg);
+    return null;
+  };
+  if (isErrorResponse(result)) {
+    if (result.code === ErrorCode.TunnelAlreadyRunningError) {
+      await printAlreadyRunning(client, config.configId, opts.label);
+      return null;
+    }
+    return fail(result.message);
+  }
+  const lastError = result.status?.lastError;
+  if (lastError?.isFatal) {
+    return fail(lastError.message);
+  }
+  return result;
+}
+async function waitForShutdownAndStopAll(client, ids) {
+  client.onDisconnect((id, error) => {
+    printer_default.warn(`[${id.slice(0, 8)}] Disconnected: ${error}`);
+  });
+  client.onReconnected((id, newUrls) => {
+    printer_default.success(`[${id.slice(0, 8)}] Reconnected: ${newUrls.join(", ")}`);
+  });
+  client.onReconnecting((id, retryCnt) => {
+    printer_default.print(pico.gray(`[${id.slice(0, 8)}] Reconnecting (attempt #${retryCnt})...`));
+  });
+  client.onReconnectionFailed((id, retryCnt) => {
+    printer_default.error(`[${id.slice(0, 8)}] Reconnection failed after ${retryCnt} attempts`);
+  });
+  wireDaemonLost(client, {
+    onReconnecting: (attempt, max) => printer_default.warn(`Daemon connection dropped \u2014 reconnecting (${attempt}/${max})...`),
+    onReconnected: () => printer_default.success("Daemon reconnected."),
+    onLost: () => {
+    }
+  });
+  await new Promise((resolve) => {
+    installShutdownHandlers(async () => {
+      printer_default.print("\nStopping all tunnels...");
+      if (!client.isDaemonLost()) {
+        for (const id of ids) {
+          try {
+            await client.handleStop(id);
+          } catch {
+          }
+        }
+      }
+      client.close();
+      resolve();
+    });
+  });
+}
+function findTunnel(tunnels, nameOrId) {
+  let byShortId;
+  let byName;
+  let byConfigId;
+  for (const t of tunnels) {
+    if (t.tunnelid === nameOrId) return t;
+    if (!byShortId && t.tunnelid.startsWith(nameOrId)) byShortId = t;
+    if (!byName && t.tunnelconfig?.name === nameOrId) byName = t;
+    if (!byConfigId && t.tunnelconfig?.configId === nameOrId) byConfigId = t;
+  }
+  return byShortId ?? byName ?? byConfigId ?? null;
+}
+async function connectTui(opts) {
+  const { client, tunnelId, urls, greet, tunnelConfig, onExit, noTui } = opts;
+  const exitMessage = opts.exitMessage || "Stopping tunnel...";
+  if (!noTui && process.stdin.isTTY) {
+    try {
+      const { TunnelTui } = await import("./TunnelTui-QZEWWH2H.js");
+      const tui = new TunnelTui({
+        urls,
+        greet,
+        tunnelConfig,
+        // Skip the user-provided onStop if the daemon is already gone:
+        onStop: async () => {
+          if (client.isDaemonLost()) return;
+          await onExit();
+        }
+      });
+      client.onStats((id, stats) => {
+        if (id === tunnelId) tui.updateStats(stats);
+      });
+      client.onDisconnect((id, error, messages) => {
+        if (id === tunnelId) tui.showDisconnectModal(error, messages);
+      });
+      client.onReconnecting((id, retryCnt) => {
+        if (id === tunnelId) tui.updateReconnectingInfo(retryCnt);
+      });
+      client.onReconnected((id, newUrls) => {
+        if (id === tunnelId) {
+          tui.closeReconnectingInfo();
+          tui.updateUrls(newUrls);
+        }
+      });
+      client.onReconnectionFailed((id, retryCnt) => {
+        if (id === tunnelId) tui.updateReconnectionFailed(retryCnt);
+      });
+      client.onStopped((id) => {
+        if (id === tunnelId) tui.stop();
+      });
+      wireDaemonLost(client, {
+        onReconnecting: (attempt, max) => tui.updateReconnectingInfo(attempt, `Daemon disconnected \u2014 reconnecting (${attempt}/${max})...`),
+        onReconnected: () => tui.closeReconnectingInfo(),
+        onLost: () => tui.stop()
+      });
+      tui.start();
+      await tui.waitUntilExit();
+    } catch {
+    }
+  } else {
+    client.onStats((id, stats) => {
+      if (id === tunnelId) {
+        process.stdout.write(`\r${pico.gray(`Connections: ${stats.numTotalConnections} | Bytes: ${stats.numTotalTxBytes}`)}`);
+      }
+    });
+    client.onDisconnect((id, error) => {
+      if (id === tunnelId) printer_default.warn(`Disconnected: ${error}`);
+    });
+    client.onReconnected((id, newUrls) => {
+      if (id === tunnelId) printer_default.success(`Reconnected: ${newUrls.join(", ")}`);
+    });
+    client.onStopped((id) => {
+      if (id === tunnelId) {
+        printer_default.print("\nTunnel stopped.");
+        process.exit(0);
+      }
+    });
+    wireDaemonLost(client, {
+      onReconnecting: (attempt, max) => printer_default.warn(`
+Daemon connection dropped \u2014 reconnecting (${attempt}/${max})...`),
+      onReconnected: () => printer_default.success("Daemon reconnected."),
+      onLost: () => {
+      }
+    });
+    await new Promise((resolve) => {
+      installShutdownHandlers(async () => {
+        printer_default.print(`
+${exitMessage}`);
+        if (!client.isDaemonLost()) {
+          try {
+            await onExit();
+          } catch {
+          }
+        }
+        client.close();
+        resolve();
+      });
+    });
+  }
+}
+async function startForegroundViaDaemon(finalConfig) {
+  if (!finalConfig.optional?.noTui && finalConfig.webDebugger === "") {
+    const freePort = await getFreePort(finalConfig.webDebugger || "");
+    finalConfig.webDebugger = `localhost:${freePort}`;
+  }
+  const client = await initTunnelClient();
+  printer_default.startSpinner("Submitting tunnel to daemon...");
+  const pending = await client.handleStartV2(finalConfig, true, SessionMode.Foreground);
+  if (isErrorResponse(pending)) {
+    if (pending.code === ErrorCode.TunnelAlreadyRunningError) {
+      printer_default.stopSpinnerSuccess("Already running");
+      await printAlreadyRunning(client, finalConfig.configId, finalConfig.name);
+      client.close();
+      process.exit(0);
+    }
+    printer_default.stopSpinnerFail("Failed to start");
+    printer_default.error(`Failed to start tunnel: ${pending.message}`);
+    client.close();
+    process.exit(1);
+  }
+  const tunnelId = pending.tunnelid;
+  printer_default.startSpinner(`Tunnel ${tunnelId.slice(0, 8)} created \u2014 ${pending.status?.state || "starting"}...`);
+  await client.attach(tunnelId, "foreground");
+  printer_default.startSpinner(`Tunnel ${tunnelId.slice(0, 8)} \u2014 waiting for connection...`);
+  const outcome = await waitForTunnelLive(client, tunnelId);
+  if ("error" in outcome) {
+    printer_default.stopSpinnerFail("Failed to connect");
+    printer_default.error(`Failed to start tunnel: ${outcome.error}`);
+    client.close();
+    process.exit(1);
+  }
+  printer_default.stopSpinnerSuccess(" Connected to Pinggy");
+  const tunnel = await fetchTunnelV2(client, tunnelId);
+  const urls = outcome.urls.length ? outcome.urls : tunnel?.remoteurls || [];
+  const greetmsg = tunnel?.greetmsg || "";
+  printer_default.success(pico.bold("Tunnel established!"));
+  printer_default.print(pico.gray("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  printer_default.info(pico.cyanBright("Remote URLs:"));
+  printRemoteUrls(urls);
+  printer_default.print(pico.gray("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  if (greetmsg.includes("not authenticated")) {
+    printer_default.warn(pico.yellowBright(greetmsg));
+  } else if (greetmsg.includes("authenticated as")) {
+    const emailMatch = /authenticated as (.+)/.exec(greetmsg);
+    if (emailMatch) {
+      printer_default.info(pico.cyanBright("Authenticated as: " + emailMatch[1]));
+    }
+  }
+  printer_default.print(pico.gray("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  printer_default.print(pico.gray("\nPress Ctrl+C to stop the tunnel.\n"));
+  await connectTui({
+    client,
+    tunnelId,
+    urls,
+    greet: greetmsg,
+    tunnelConfig: finalConfig,
+    noTui: !!finalConfig.optional?.noTui,
+    onExit: async () => {
+      await client.handleStop(tunnelId);
+    }
+  });
+  client.close();
+}
+async function waitForTunnelLive(client, tunnelId) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (val) => {
+      if (settled) return;
+      settled = true;
+      resolve(val);
+    };
+    client.onUrlReady((id, urls) => {
+      if (id === tunnelId) done({ urls });
+    });
+    client.onError((id, message, isFatal) => {
+      if (id === tunnelId && isFatal) done({ error: message });
+    });
+    client.onDisconnect((id, error) => {
+      if (id === tunnelId) done({ error });
+    });
+    client.handleListV2().then((res) => {
+      if (settled || isErrorResponse(res)) return;
+      const t = res.find((x) => x.tunnelid === tunnelId);
+      if (t?.remoteurls?.length) done({ urls: t.remoteurls });
+      if (t?.status?.lastError?.isFatal) done({ error: t.status.lastError.message });
+    }).catch(() => {
+    });
+  });
+}
+async function fetchTunnelV2(client, tunnelId) {
+  const res = await client.handleListV2();
+  if (isErrorResponse(res)) return null;
+  return res.find((t) => t.tunnelid === tunnelId) || null;
+}
+async function startBackgroundViaDaemon(finalConfig) {
+  const client = await initTunnelClient();
+  printer_default.info("Starting tunnel...");
+  const result = await startTunnel(client, finalConfig, { onError: "fatal", mode: SessionMode.Detached });
+  const tunnelId = result.tunnelid;
+  printer_default.success(`Tunnel started (ID: ${tunnelId})`);
+  printRemoteUrls(result.remoteurls);
+  printer_default.print(pico.gray("\nTunnel running in background. Use 'pinggy ps' to list, 'pinggy stop " + tunnelId.slice(0, 8) + "' to stop."));
+  client.close();
+}
+async function startMultipleForegroundViaDaemon(configs, values, positionals) {
+  const client = await initTunnelClient();
+  const startedIds = [];
+  printer_default.print(pico.cyanBright(`Starting ${configs.length} tunnel(s)...`));
+  for (const saved of configs) {
+    const config = { ...saved.tunnelConfig, configId: saved.configId, name: saved.name };
+    const result = await startTunnel(client, config, { label: saved.name, onError: "continue", mode: SessionMode.Foreground });
+    if (!result) continue;
+    startedIds.push(result.tunnelid);
+    printer_default.success(`"${saved.name}" started`);
+    printRemoteUrls(result.remoteurls);
+  }
+  if (startedIds.length === 0) {
+    printer_default.error("No tunnels started.");
+    client.close();
+    return;
+  }
+  for (const id of startedIds) {
+    await client.attach(id, "foreground");
+  }
+  printer_default.print(pico.gray("\nAll tunnels launched. Press Ctrl+C to stop.\n"));
+  await waitForShutdownAndStopAll(client, startedIds);
+}
+async function startBackgroundTunnels(configs, values, positionals) {
+  const client = await initTunnelClient();
+  const buildConfig = configs.length === 1 ? (saved) => buildFinalConfig(values, positionals, saved.tunnelConfig) : (saved) => ({ ...saved.tunnelConfig, configId: saved.configId, name: saved.name });
+  for (const saved of configs) {
+    const finalConfig = buildConfig(saved);
+    const result = await startTunnel(client, finalConfig, { label: saved.name, onError: "continue", mode: SessionMode.Detached });
+    if (!result) continue;
+    printer_default.success(`"${saved.name}" started (ID: ${result.tunnelid})`);
+    printRemoteUrls(result.remoteurls);
+  }
+  printer_default.print(pico.gray("\nTunnel(s) running in background. Use 'pinggy ps' to list, 'pinggy stop <name|id>' to stop."));
+  client.close();
+}
+async function startAutoStartTunnels() {
+  const { getAutoStartConfigs: getAutoStartConfigs2 } = await import("./configStore-TSGRNOE3.js");
+  const configs = getAutoStartConfigs2();
+  if (configs.length === 0) {
+    printer_default.warn("No configs marked for auto-start. Use: pinggy config auto <name>");
+    return;
+  }
+  const client = await initTunnelClient();
+  const startedIds = [];
+  printer_default.print(pico.cyanBright(`Starting ${configs.length} auto-start tunnel(s)...`));
+  for (const saved of configs) {
+    const config = { ...saved.tunnelConfig, configId: saved.configId, name: saved.name };
+    const result = await startTunnel(client, config, { label: saved.name, onError: "continue", mode: SessionMode.Foreground });
+    if (!result) continue;
+    startedIds.push(result.tunnelid);
+    printer_default.success(`"${saved.name}" started`);
+    printRemoteUrls(result.remoteurls);
+  }
+  if (startedIds.length === 0) {
+    printer_default.error("No tunnels started.");
+    client.close();
+    return;
+  }
+  for (const id of startedIds) {
+    await client.attach(id, "foreground");
+  }
+  printer_default.print(pico.gray("\nAll auto-start tunnels launched. Press Ctrl+C to stop.\n"));
+  await waitForShutdownAndStopAll(client, startedIds);
+}
+
+// src/cli/buildAndStartTunnel.ts
+function analyzeIntent(values, positionals) {
+  const hasTunnelFlag = !!(Array.isArray(values.R) && values.R.length > 0 || Array.isArray(values.L) && values.L.length > 0 || values.localport || values.type || values.conf || values.serve);
+  const parsed = parseUsers(positionals, values.token);
+  const hasServerFromArgs = !!parsed.server;
+  if (hasTunnelFlag || hasServerFromArgs) return { kind: "tunnel" };
+  if (positionals.length > 0) {
+    return {
+      kind: "invalid",
+      message: `Unrecognized argument(s): ${positionals.join(" ")}
+Usage: pinggy -l 3000  
+Try:   pinggy --help`
+    };
+  }
+  const rmToken = values["remote-management"];
+  if (typeof rmToken === "string" && rmToken.trim().length > 0) {
+    return { kind: "remote-only" };
+  }
+  return {
+    kind: "invalid",
+    message: "No tunnel specified.\nUsage: pinggy -l 3000   or   pinggy <token>@<server>\nTry:   pinggy --help"
+  };
+}
+async function buildAndStartTunnel(values, positionals) {
+  const intent = analyzeIntent(values, positionals);
+  if (intent.kind === "invalid") {
+    printer_default.error(intent.message);
+    process.exit(1);
+  }
+  if (intent.kind === "remote-only") {
+    printer_default.print("Remote management mode. Press Ctrl+C to stop.");
+    await initRemoteManagement(
+      values,
+      /* blocking */
+      true
+    );
+    return;
+  }
+  await initRemoteManagement(
+    values,
+    /* blocking */
+    false
+  );
+  logger.debug("Building final config from CLI values and positionals", { values, positionals });
+  const finalConfig = buildFinalConfig(values, positionals);
+  logger.debug("Final configuration built", finalConfig);
+  if (values.save) {
+    const name = values.name;
+    if (!name) {
+      printer_default.error("--save requires --name to specify a name for the tunnel config.");
+      process.exit(1);
+    }
+    const nameErr = validateName(name);
+    if (nameErr) {
+      printer_default.error(nameErr.message);
+      process.exit(1);
+    }
+    const autoStart = !!values.auto;
+    saveConfig(name, finalConfig.configId, finalConfig, autoStart);
+    printer_default.success(`Config "${name}" saved.`);
+  }
+  if (values.b) {
+    await startBackgroundViaDaemon(finalConfig);
+    return;
+  }
+  await startForegroundViaDaemon(finalConfig);
+}
+async function initRemoteManagement(values, blocking) {
+  const rmToken = values["remote-management"];
+  if (typeof rmToken !== "string" || rmToken.trim().length === 0) return;
+  const handler = await TunnelClient.forRemoteManagement();
+  handler.onDaemonLost((reason, detail) => {
+    printer_default.error(daemonLostMessage(reason, detail));
+    setImmediate(() => process.exit(3));
+  });
+  const config = {
+    apiKey: rmToken,
+    serverUrl: buildRemoteManagementWsUrl(values["manage"])
+  };
+  try {
+    if (blocking) {
+      await initiateRemoteManagement(config, handler);
+    } else {
+      await startRemoteManagement(config, handler);
+    }
+  } catch (e) {
+    logger.error("Failed to initiate remote management:", e);
+    printer_default.fatal(e);
+  }
+}
+
+// src/cli/subcommand/handlers/daemonCommandsHandler.ts
+import pico2 from "picocolors";
+
+// src/daemon/lifecycle/serviceInstaller.ts
+import os2 from "os";
+import fs2 from "fs";
+import path2 from "path";
+import { execSync, execFileSync } from "child_process";
+var SERVICE_LABEL = "io.pinggy.agent";
+var SYSTEMD_SERVICE_NAME = "pinggy";
+function resolveBinary() {
+  const isPkg = "pkg" in process;
+  if (isPkg) return { program: process.execPath, args: [] };
+  try {
+    const bin = execSync(os2.platform() === "win32" ? "where pinggy" : "which pinggy", {
+      encoding: "utf-8"
+    }).trim().split(/\r?\n/)[0];
+    return { program: bin, args: [] };
+  } catch {
+    return { program: process.execPath, args: [process.argv[1]] };
+  }
+}
+function getSystemdServicePath() {
+  const dir = path2.join(os2.homedir(), ".config", "systemd", "user");
+  return path2.join(dir, `${SYSTEMD_SERVICE_NAME}.service`);
+}
+function generateSystemdUnit(bin) {
+  const execStart = [bin.program, ...bin.args, "--_daemon-child"].join(" ");
+  return `[Unit]
+Description=Pinggy Tunnel Daemon
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${execStart}
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=default.target
+`;
+}
+function installSystemd() {
+  const bin = resolveBinary();
+  const servicePath = getSystemdServicePath();
+  const dir = path2.dirname(servicePath);
+  fs2.mkdirSync(dir, { recursive: true });
+  fs2.writeFileSync(servicePath, generateSystemdUnit(bin), "utf-8");
+  execSync("systemctl --user daemon-reload");
+  execSync(`systemctl --user enable ${SYSTEMD_SERVICE_NAME}`);
+  execSync(`systemctl --user start ${SYSTEMD_SERVICE_NAME}`);
+  logger.info("systemd user service installed and started", { servicePath });
+  console.log(`Service installed: ${servicePath}`);
+  console.log(`Enable at boot: loginctl enable-linger ${os2.userInfo().username}`);
+}
+function uninstallSystemd() {
+  const servicePath = getSystemdServicePath();
+  try {
+    execSync(`systemctl --user stop ${SYSTEMD_SERVICE_NAME} 2>/dev/null || true`);
+    execSync(`systemctl --user disable ${SYSTEMD_SERVICE_NAME} 2>/dev/null || true`);
+  } catch {
+  }
+  if (fs2.existsSync(servicePath)) {
+    fs2.unlinkSync(servicePath);
+    execSync("systemctl --user daemon-reload");
+    console.log(`Service removed: ${servicePath}`);
+  } else {
+    console.log("No systemd service found to remove.");
+  }
+}
+function getLaunchdPlistPath() {
+  return path2.join(os2.homedir(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`);
+}
+function generateLaunchdPlist(bin) {
+  const allArgs = [bin.program, ...bin.args, "--_daemon-child"];
+  const programArgs = allArgs.map((p) => `      <string>${p}</string>`).join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
+  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>${SERVICE_LABEL}</string>
+    <key>ProgramArguments</key>
+    <array>
+${programArgs}
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <false/>
+</dict>
+</plist>
+`;
+}
+function installLaunchd() {
+  const bin = resolveBinary();
+  const plistPath = getLaunchdPlistPath();
+  const dir = path2.dirname(plistPath);
+  fs2.mkdirSync(dir, { recursive: true });
+  fs2.writeFileSync(plistPath, generateLaunchdPlist(bin), "utf-8");
+  const uid = process.getuid?.() ?? 501;
+  try {
+    execSync(`launchctl bootout gui/${uid}/${SERVICE_LABEL} 2>/dev/null || true`);
+  } catch {
+  }
+  try {
+    execSync(`launchctl bootstrap gui/${uid} ${plistPath}`);
+  } catch {
+    try {
+      execSync(`launchctl load -w ${plistPath}`);
+    } catch {
+    }
+  }
+  logger.info("launchd agent installed and started", { plistPath });
+  console.log(`Service installed and started: ${plistPath}`);
+}
+function uninstallLaunchd() {
+  const plistPath = getLaunchdPlistPath();
+  const uid = process.getuid?.() ?? 501;
+  try {
+    execSync(`launchctl bootout gui/${uid}/${SERVICE_LABEL} 2>/dev/null || true`);
+  } catch {
+    try {
+      execSync(`launchctl unload ${plistPath} 2>/dev/null || true`);
+    } catch {
+    }
+  }
+  if (fs2.existsSync(plistPath)) {
+    fs2.unlinkSync(plistPath);
+    console.log(`Service removed: ${plistPath}`);
+  } else {
+    console.log("No launchd agent found to remove.");
+  }
+}
+var WINDOWS_TASK_NAME = "PinggyDaemon";
+function generateTaskXml(bin) {
+  const command = bin.program;
+  const args = [...bin.args, "--_daemon-child"].join(" ");
+  return `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <Triggers>
+    <LogonTrigger>
+      <Enabled>true</Enabled>
+    </LogonTrigger>
+  </Triggers>
+  <Principals>
+    <Principal id="Author">
+      <LogonType>InteractiveToken</LogonType>
+      <RunLevel>LeastPrivilege</RunLevel>
+    </Principal>
+  </Principals>
+  <Settings>
+    <Hidden>true</Hidden>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
+    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
+    <RestartOnFailure>
+      <Interval>PT1M</Interval>
+      <Count>3</Count>
+    </RestartOnFailure>
+  </Settings>
+  <Actions>
+    <Exec>
+      <Command>${command}</Command>${args ? `
+      <Arguments>${args}</Arguments>` : ""}
+    </Exec>
+  </Actions>
+</Task>`;
+}
+function installWindows() {
+  const bin = resolveBinary();
+  const xml = generateTaskXml(bin);
+  const tmpPath = path2.join(os2.tmpdir(), `${WINDOWS_TASK_NAME}.xml`);
+  fs2.writeFileSync(tmpPath, "\uFEFF" + xml, "utf16le");
+  try {
+    execFileSync("schtasks", [
+      "/Create",
+      "/TN",
+      WINDOWS_TASK_NAME,
+      "/XML",
+      tmpPath,
+      "/F"
+    ], { stdio: "inherit" });
+  } finally {
+    try {
+      fs2.unlinkSync(tmpPath);
+    } catch {
+    }
+  }
+  execFileSync("schtasks", ["/Run", "/TN", WINDOWS_TASK_NAME], { stdio: "inherit" });
+  console.log(`Scheduled task "${WINDOWS_TASK_NAME}" created and started (runs at login, hidden).`);
+}
+function uninstallWindows() {
+  try {
+    execFileSync("schtasks", ["/End", "/TN", WINDOWS_TASK_NAME], { stdio: "ignore" });
+  } catch {
+  }
+  try {
+    execFileSync("schtasks", ["/Delete", "/TN", WINDOWS_TASK_NAME, "/F"], { stdio: "inherit" });
+    console.log(`Scheduled task "${WINDOWS_TASK_NAME}" removed.`);
+  } catch {
+    console.log("No scheduled task found to remove.");
+  }
+}
+function installService() {
+  const platform2 = os2.platform();
+  const bin = resolveBinary();
+  if (!("pkg" in process) && bin.program !== process.execPath) {
+    console.warn(
+      "Warning: Using npm-installed binary. The path may change if Node.js is updated.\nConsider using a standalone binary (pkg) for system services."
+    );
+  }
+  switch (platform2) {
+    case "linux":
+      installSystemd();
+      break;
+    case "darwin":
+      installLaunchd();
+      break;
+    case "win32":
+      installWindows();
+      break;
+    default:
+      console.error(`Unsupported platform: ${platform2}`);
+      process.exit(1);
+  }
+}
+function uninstallService() {
+  const platform2 = os2.platform();
+  switch (platform2) {
+    case "linux":
+      uninstallSystemd();
+      break;
+    case "darwin":
+      uninstallLaunchd();
+      break;
+    case "win32":
+      uninstallWindows();
+      break;
+    default:
+      console.error(`Unsupported platform: ${platform2}`);
+      process.exit(1);
+  }
+}
+
+// src/utils/helpMessages.ts
+function printDaemonHelp() {
+  console.log("\nUsage: pinggy daemon <command>");
+  console.log("       pinggy d <command>\n");
+  console.log("Commands:");
+  console.log("  start                    Start the daemon process");
+  console.log("  stop                     Stop the daemon (stops all tunnels)");
+  console.log("  status                   Show daemon PID and uptime");
+  console.log("Tunnel operations:");
+  console.log("  pinggy ps                List running tunnels");
+  console.log("  pinggy stop <name|id>    Stop a specific tunnel");
+  console.log("  pinggy attach <name|id>  Re-attach TUI to a tunnel\n");
+}
+function printLogHelp() {
+  console.log("\nUsage: pinggy log <verb> [options]\n");
+  console.log("Commands:");
+  console.log("  level                    Print current log level");
+  console.log("  level debug|info|error   Set log level");
+  console.log("  path                     Print daemon log path");
+  console.log("  path <name|id>           Print tunnel log path\n");
+}
+function printConfigHelp() {
+  console.log("\nUsage: pinggy config <command> [name] [options]\n");
+  console.log("Commands:");
+  console.log("  list                           List all saved configs");
+  console.log("  show <name>                    Show config details");
+  console.log("  save <name> [tunnel flags]     Save a tunnel config");
+  console.log("  update <name> [tunnel flags]   Update a saved config");
+  console.log("  delete <name>                  Delete a saved config");
+  console.log("  auto <name>                    Enable auto-start");
+  console.log("  noauto <name>                  Disable auto-start\n");
+}
+function printStartHelp() {
+  console.log("\nUsage: pinggy start <name> [options]\n");
+  console.log("Examples:");
+  console.log("  pinggy start my-tunnel                Start a saved tunnel");
+  console.log("  pinggy start my-tunnel -l 4000        Start with override");
+  console.log("  pinggy start tunnela tunnelb           Start multiple tunnels");
+  console.log("  pinggy start --all                     Start all auto-start tunnels\n");
+}
+
+// src/cli/subcommand/handlers/daemonCommandsHandler.ts
+async function handleDaemon(args) {
+  if (args.length === 0) {
+    printDaemonHelp();
+    return;
+  }
+  const verb = args[0];
+  switch (verb) {
+    case "start":
+      await handleDaemonStart();
+      return;
+    case "stop":
+      await handleDaemonStop();
+      return;
+    case "status":
+      handleDaemonStatus();
+      return;
+    case "service-install":
+      installService();
+      return;
+    case "service-uninstall":
+      uninstallService();
+      return;
+    default:
+      printer_default.error(`Unknown daemon command: "${verb}"`);
+      printDaemonHelp();
+      return;
+  }
+}
+async function handleDaemonStart() {
+  if (isDaemonRunning()) {
+    const info = getDaemonInfo();
+    printer_default.print(pico2.yellow(`Daemon already running (PID ${info?.pid}, port ${info?.port}). Use: pinggy daemon status for details.`));
+    return;
+  }
+  const autoConfigs = getAutoStartConfigs();
+  if (autoConfigs.length > 0) {
+    printer_default.print(pico2.cyanBright(`Starting daemon with ${autoConfigs.length} auto-start tunnel(s):`));
+    for (const c of autoConfigs) {
+      printer_default.print(`  ${pico2.bold(c.name)} (${c.configId.slice(0, 8)})`);
+    }
+  } else {
+    printer_default.print(pico2.cyanBright("Starting daemon..."));
+  }
+  try {
+    const info = await startDaemon();
+    printer_default.success(`Daemon started PID ${info.pid}.`);
+  } catch (err) {
+    printer_default.error(`Failed to start daemon: ${errorMessage(err)}`);
+    process.exit(1);
+  }
+}
+async function handleDaemonStop() {
+  if (!isDaemonRunning()) {
+    printer_default.print(pico2.yellow("No daemon is running."));
+    return;
+  }
+  const result = await stopDaemon();
+  if (result.ok) {
+    printer_default.success("Daemon stopped.");
+  } else {
+    printer_default.error(result.error);
+  }
+}
+function handleDaemonStatus() {
+  const info = getDaemonInfo();
+  if (!info) {
+    printer_default.print(pico2.yellow("No daemon is running. Start with: pinggy daemon start"));
+    return;
+  }
+  const uptimeSec = Math.floor((Date.now() - new Date(info.startedAt).getTime()) / 1e3);
+  const h = Math.floor(uptimeSec / 3600);
+  const m = Math.floor(uptimeSec % 3600 / 60);
+  const s = uptimeSec % 60;
+  const uptimeStr = h > 0 ? `${h}h ${m}m ${s}s` : m > 0 ? `${m}m ${s}s` : `${s}s`;
+  printer_default.print(pico2.cyanBright("Daemon Status"));
+  printer_default.print(`  PID:       ${info.pid}`);
+  printer_default.print(`  Port:      ${info.port}`);
+  printer_default.print(`  Started:   ${info.startedAt}`);
+  printer_default.print(`  Uptime:    ${uptimeStr}`);
+}
+
+// src/cli/subcommand/handlers/psCommand.ts
+import pico3 from "picocolors";
+async function handlePs() {
+  const client = new TunnelClient();
+  try {
+    await client.ensureDaemon();
+  } catch (err) {
+    printer_default.error(`Cannot connect to daemon: ${errorMessage(err)}`);
+    return;
+  }
+  try {
+    const tunnels = await client.handleListV2();
+    if (isErrorResponse(tunnels)) {
+      printer_default.error(`Failed to list tunnels: ${tunnels.message}`);
+      return;
+    }
+    if (tunnels.length === 0) {
+      printer_default.print("No tunnels running.");
+      return;
+    }
+    const header = `${pad("ID", 14)} ${pad("NAME", 16)} ${pad("STATUS", 10)} ${pad("LOCAL", 20)} URL`;
+    printer_default.print(pico3.gray(header));
+    printer_default.print(pico3.gray("\u2500".repeat(90)));
+    for (const t of tunnels) {
+      const id = t.tunnelid.slice(0, 12);
+      const name = t.tunnelconfig?.name || "-";
+      const status = t.status.state;
+      const local = getLocalAddress(t.tunnelconfig);
+      const url = t.remoteurls?.[0] || "-";
+      const statusColor = status === "running" ? pico3.green : status === "starting" ? pico3.yellow : pico3.red;
+      printer_default.print(
+        `${pico3.cyan(pad(id, 14))} ${pad(name, 16)} ${statusColor(pad(status, 10))} ${pad(local, 20)} ${pico3.magentaBright(url)}`
+      );
+    }
+  } catch (err) {
+    printer_default.error(`Failed to list tunnels: ${errorMessage(err)}`);
+  } finally {
+    client.close();
+  }
+}
+function pad(str, len) {
+  return str.length >= len ? str.slice(0, len) : str + " ".repeat(len - str.length);
+}
+
+// src/cli/subcommand/handlers/stopCommand.ts
+async function handleStop(args) {
+  if (args.length === 0) {
+    printer_default.error("Usage: pinggy stop <name|id> [<name|id> ...]");
+    return;
+  }
+  const client = new TunnelClient();
+  try {
+    await client.ensureDaemon();
+  } catch (err) {
+    printer_default.error(`Cannot connect to daemon: ${errorMessage(err)}`);
+    return;
+  }
+  try {
+    const tunnels = await client.handleListV2();
+    if (isErrorResponse(tunnels)) {
+      printer_default.error(`Failed to list tunnels: ${tunnels.message}`);
+      return;
+    }
+    const targets = resolveTargets(tunnels, args);
+    if (targets.matched.length === 0) {
+      printer_default.error(`No tunnel found matching: ${args.join(", ")}. Use: pinggy ps`);
+      return;
+    }
+    for (const { input, tunnel } of targets.matched) {
+      const result = await client.handleStop(tunnel.tunnelid);
+      if (isErrorResponse(result)) {
+        printer_default.error(`Failed to stop "${input}": ${result.message}`);
+        continue;
+      }
+      const name = tunnel.tunnelconfig.name || tunnel.tunnelid.slice(0, 12);
+      printer_default.success(`Tunnel "${name}" stopped.`);
+    }
+    for (const m of targets.missing) {
+      printer_default.warn(`No tunnel found matching "${m}".`);
+    }
+  } catch (err) {
+    printer_default.error(`Failed to stop tunnel: ${errorMessage(err)}`);
+  } finally {
+    client.close();
+  }
+}
+function resolveTargets(tunnels, args) {
+  if (args.length > 1) {
+    const input = args.join(" ");
+    const tunnel = findTunnel(tunnels, input);
+    if (tunnel) return { matched: [{ input, tunnel }], missing: [] };
+  }
+  const matched = [];
+  const missing = [];
+  for (const input of args) {
+    const tunnel = findTunnel(tunnels, input);
+    if (tunnel) matched.push({ input, tunnel });
+    else missing.push(input);
+  }
+  return { matched, missing };
+}
+
+// src/cli/subcommand/handlers/attachCommand.ts
+import pico4 from "picocolors";
+async function handleAttach(args) {
+  if (args.length === 0) {
+    printer_default.error("Usage: pinggy attach <name|id>");
+    return;
+  }
+  const nameOrId = args[0];
+  const client = new TunnelClient();
+  try {
+    await client.ensureDaemon();
+  } catch (err) {
+    printer_default.error(`Cannot connect to daemon: ${errorMessage(err)}`);
+    return;
+  }
+  try {
+    const tunnels = await client.handleListV2();
+    if (isErrorResponse(tunnels)) {
+      printer_default.error(`Failed to list tunnels: ${tunnels.message}`);
+      return;
+    }
+    const match = findTunnel(tunnels, nameOrId);
+    if (!match) {
+      printer_default.error(`No running tunnel found matching "${nameOrId}". Use: pinggy ps`);
+      client.close();
+      return;
+    }
+    const tunnelId = match.tunnelid;
+    const name = match.tunnelconfig?.name || tunnelId.slice(0, 12);
+    printer_default.print(pico4.cyanBright(`Attaching to tunnel "${name}"...`));
+    const attachMode = match.mode ?? "detached";
+    await client.attach(tunnelId, attachMode);
+    const urls = match.remoteurls || [];
+    if (urls.length > 0) {
+      printer_default.print("");
+      for (const url of urls) {
+        printer_default.print("  " + pico4.magentaBright(url));
+      }
+      printer_default.print("");
+    }
+    await connectTui({
+      client,
+      tunnelId,
+      urls,
+      greet: match.greetmsg || "",
+      tunnelConfig: match.tunnelconfig || {},
+      exitMessage: "Detaching...",
+      onExit: () => Promise.resolve(client.detach(tunnelId))
+    });
+  } catch (err) {
+    printer_default.error(`Failed to attach: ${errorMessage(err)}`);
+  } finally {
+    client.close();
+  }
+}
+
+// src/cli/subcommand/handlers/logsCommand.ts
+import fs3 from "fs";
+async function handleLogs(args, follow) {
+  const arg = args.find((a) => !a.startsWith("-"));
+  const client = new TunnelClient();
+  try {
+    await client.ensureDaemon();
+  } catch (err) {
+    printer_default.error(`Cannot connect to daemon: ${errorMessage(err)}`);
+    return;
+  }
+  let filePath;
+  try {
+    if (arg) {
+      const result = await client.resolveLogPath(arg);
+      if (result.status === "config-only") {
+        printer_default.error(`Tunnel "${arg}" is saved but has not been started yet. No logs available.`);
+        client.close();
+        process.exit(1);
+      }
+      if (result.status === "not-found") {
+        printer_default.error(`No tunnel or log file matching "${arg}".`);
+        client.close();
+        process.exit(1);
+      }
+      if (!result.path) {
+        printer_default.error(`No log path returned for "${arg}".`);
+        client.close();
+        process.exit(1);
+      }
+      filePath = result.path;
+    } else {
+      const paths = await client.getLogPaths();
+      filePath = paths.daemon;
+    }
+  } catch (err) {
+    printer_default.error(`Failed to resolve log path: ${errorMessage(err)}`);
+    client.close();
+    return;
+  }
+  client.close();
+  if (!filePath || !fs3.existsSync(filePath)) {
+    printer_default.error(`Log file not found: ${filePath}`);
+    process.exit(1);
+  }
+  if (follow) {
+    await followFile(filePath);
+  } else {
+    printTail(filePath, 100);
+  }
+}
+function printTail(filePath, lines) {
+  const content = fs3.readFileSync(filePath, "utf-8");
+  const allLines = content.split("\n");
+  const tail = allLines.slice(-lines).join("\n");
+  process.stdout.write(tail);
+  if (!tail.endsWith("\n")) process.stdout.write("\n");
+}
+async function followFile(filePath) {
+  if (fs3.existsSync(filePath)) printTail(filePath, 20);
+  let fileSize = fs3.existsSync(filePath) ? fs3.statSync(filePath).size : 0;
+  let watcher = null;
+  const openStream = () => {
+    const stream = fs3.createReadStream(filePath, { start: fileSize, encoding: "utf-8" });
+    stream.on("data", (chunk) => {
+      process.stdout.write(chunk);
+      fileSize += Buffer.byteLength(chunk, "utf-8");
+    });
+    stream.on("error", () => {
+    });
+  };
+  watcher = fs3.watch(filePath, { persistent: true }, (event) => {
+    if (event === "change") {
+      const stat = fs3.existsSync(filePath) ? fs3.statSync(filePath) : null;
+      if (!stat || stat.size < fileSize) {
+        fileSize = 0;
+      }
+      openStream();
+    }
+  });
+  await new Promise((resolve) => {
+    process.on("SIGINT", () => {
+      watcher?.close();
+      resolve();
+    });
+  });
+}
+
+// src/cli/subcommand/handlers/logCommand.ts
+var VALID_LEVELS = ["debug", "info", "error"];
+async function handleLog(args) {
+  if (args.length === 0) {
+    printLogHelp();
+    return;
+  }
+  const verb = args[0];
+  const rest = args.slice(1);
+  switch (verb) {
+    case "level":
+      await handleLogLevel(rest);
+      break;
+    case "path":
+      await handleLogPath(rest);
+      break;
+    default:
+      printer_default.error(`Unknown log subcommand: ${verb}`);
+      printLogHelp();
+  }
+}
+async function handleLogLevel(args) {
+  const client = new TunnelClient();
+  try {
+    await client.ensureDaemon();
+  } catch (err) {
+    printer_default.error(`Cannot connect to daemon: ${errorMessage(err)}`);
+    return;
+  }
+  try {
+    if (args.length === 0) {
+      const level2 = await client.getLogLevel();
+      printer_default.print(`Log level: ${level2}`);
+      return;
+    }
+    const level = args[0].toLowerCase();
+    if (!VALID_LEVELS.includes(level)) {
+      printer_default.error(`Invalid log level: "${level}". Must be one of: ${VALID_LEVELS.join(", ")}`);
+      client.close();
+      process.exit(1);
+    }
+    await client.setLogLevel(level);
+    printer_default.success(`Log level set to "${level}". Affects daemon JS logs and new tunnels. Run \`pinggy restart <name>\` to apply to a running tunnel.`);
+  } catch (err) {
+    printer_default.error(`Failed to update log level: ${errorMessage(err)}`);
+  } finally {
+    client.close();
+  }
+}
+async function handleLogPath(args) {
+  const client = new TunnelClient();
+  try {
+    await client.ensureDaemon();
+  } catch (err) {
+    printer_default.error(`Cannot connect to daemon: ${errorMessage(err)}`);
+    return;
+  }
+  try {
+    if (args.length === 0) {
+      const paths = await client.getLogPaths();
+      printer_default.print(paths.daemon);
+      return;
+    }
+    const arg = args[0];
+    const result = await client.resolveLogPath(arg);
+    switch (result.status) {
+      case "running":
+      case "historical":
+        printer_default.print(result.path);
+        break;
+      case "config-only":
+        printer_default.error(`Tunnel "${arg}" is saved but has not been started yet. No logs available.`);
+        client.close();
+        process.exit(1);
+        break;
+      case "not-found":
+        printer_default.error(`No tunnel or log file matching "${arg}".`);
+        client.close();
+        process.exit(1);
+        break;
+    }
+  } catch (err) {
+    printer_default.error(`Failed to resolve log path: ${errorMessage(err)}`);
+  } finally {
+    client.close();
+  }
+}
+
+// src/cli/subcommand/handlers/restartCommand.ts
+async function handleRestart(args) {
+  if (args.length === 0 || args[0].startsWith("-")) {
+    printer_default.error("Tunnel name or ID is required. Usage: pinggy restart <name|id>");
+    process.exit(1);
+  }
+  const nameOrId = args[0];
+  const client = new TunnelClient();
+  try {
+    await client.ensureDaemon();
+  } catch (err) {
+    printer_default.error(`Cannot connect to daemon: ${errorMessage(err)}`);
+    return;
+  }
+  try {
+    const tunnels = await client.handleListV2();
+    if (isErrorResponse(tunnels)) {
+      printer_default.error(`Failed to list tunnels: ${tunnels.message}`);
+      return;
+    }
+    const match = findTunnel(tunnels, nameOrId);
+    if (!match) {
+      printer_default.error(`No running tunnel matching "${nameOrId}". Use: pinggy ps`);
+      process.exit(1);
+    }
+    const result = await client.handleRestart(match.tunnelid);
+    if (isErrorResponse(result)) {
+      printer_default.error(`Failed to restart tunnel: ${result.message}`);
+      return;
+    }
+    const name = match.tunnelconfig.name || match.tunnelid.slice(0, 12);
+    printer_default.success(`Tunnel "${name}" is restarting.`);
+  } catch (err) {
+    printer_default.error(`Failed to restart tunnel: ${errorMessage(err)}`);
+  } finally {
+    client.close();
+  }
+}
+
+// src/cli/subcommand/subcommands.ts
+var SUBCOMMAND_SET = new Set(SUBCOMMANDS);
+function isSubcommand(rawArgs) {
+  return rawArgs.length > 0 && SUBCOMMAND_SET.has(rawArgs[0]);
+}
+async function handleSubcommand(rawArgs) {
+  const sub = rawArgs[0];
+  const rest = rawArgs.slice(1);
+  switch (sub) {
+    case Subcommand.Config:
+      handleConfig(rest);
+      return;
+    case Subcommand.Start:
+      await handleStart(rest);
+      return;
+    case Subcommand.Stop:
+      await handleStop(rest);
+      return;
+    case Subcommand.Ps:
+      await handlePs();
+      return;
+    case Subcommand.Attach:
+      await handleAttach(rest);
+      return;
+    case Subcommand.Daemon:
+    case Subcommand.DaemonAlias:
+      await handleDaemon(rest);
+      return;
+    case Subcommand.Logs: {
+      const follow = rest.includes("-f");
+      const nonFlagArgs = rest.filter((a) => a !== "-f");
+      await handleLogs(nonFlagArgs, follow);
+      return;
+    }
+    case Subcommand.Log:
+      await handleLog(rest);
+      return;
+    case Subcommand.Restart:
+      await handleRestart(rest);
+      return;
+  }
+}
+function handleConfig(args) {
+  if (args.length === 0) {
+    printConfigHelp();
+    return;
+  }
+  const verb = args[0];
+  const rest = args.slice(1);
+  switch (verb) {
+    case ConfigVerb.List:
+    case ConfigVerb.Ls:
+      printConfigList();
+      return;
+    case ConfigVerb.Show: {
+      const names = requireNames(rest, "config show");
+      for (const name of names) {
+        const saved2 = resolveConfig(name);
+        if (saved2) printConfigDetail(saved2);
+      }
+      return;
+    }
+    case ConfigVerb.Save: {
+      const name = requireName(rest, "config save");
+      handleConfigSave(name, rest.slice(1));
+      return;
+    }
+    case ConfigVerb.Delete: {
+      const names = requireNames(rest, "config delete");
+      for (const name of names) {
+        const deletedName = deleteConfig(name);
+        if (deletedName) {
+          printer_default.success(`Config "${deletedName}" deleted.`);
+        } else {
+          printer_default.error(`No config found matching "${name}". Use: pinggy config list`);
+        }
+      }
+      return;
+    }
+    case ConfigVerb.Update: {
+      const name = requireName(rest, "config update");
+      handleConfigUpdate(name, rest.slice(1));
+      return;
+    }
+    case ConfigVerb.Auto: {
+      const names = requireNames(rest, "config auto");
+      for (const name of names) {
+        const updated = updateConfigAutoStart(name, true);
+        if (updated) {
+          printer_default.success(`Config "${updated.name}" auto-start set to on.`);
+        } else {
+          printer_default.error(`No config found matching "${name}". Use: pinggy config list`);
+        }
+      }
+      return;
+    }
+    case ConfigVerb.Noauto: {
+      const names = requireNames(rest, "config noauto");
+      for (const name of names) {
+        const updated = updateConfigAutoStart(name, false);
+        if (updated) {
+          printer_default.success(`Config "${updated.name}" auto-start set to off.`);
+        } else {
+          printer_default.error(`No config found matching "${name}". Use: pinggy config list`);
+        }
+      }
+      return;
+    }
+    default:
+      const saved = resolveConfig(verb);
+      if (saved) printConfigDetail(saved);
+      return;
+  }
+}
+function handleConfigSave(name, remainingArgs) {
+  const nameErr = validateName(name);
+  if (nameErr) {
+    printer_default.error(nameErr.message);
+    process.exit(1);
+  }
+  const { values, positionals } = parseCliArgs(cliOptions, remainingArgs);
+  const autoStart = !!values.auto;
+  logger.debug("Building config for save", { name, values, positionals });
+  const finalConfig = buildFinalConfig(values, positionals);
+  finalConfig.name = name;
+  saveConfig(name, finalConfig.configId, finalConfig, autoStart);
+  printer_default.success(`Config "${name}" saved.`);
+}
+function handleConfigUpdate(nameOrId, remainingArgs) {
+  const saved = resolveConfig(nameOrId);
+  if (!saved) return;
+  const { values, positionals } = parseCliArgs(cliOptions, remainingArgs);
+  logger.debug("Building updated config", { nameOrId, values, positionals });
+  const updatedConfig = buildFinalConfig(values, positionals, saved.tunnelConfig);
+  updatedConfig.name = saved.name;
+  const result = updateTunnelConfig(nameOrId, updatedConfig);
+  if (result) {
+    printer_default.success(`Config "${result.name}" updated.`);
+    printConfigDetail(result);
+  } else {
+    printer_default.error(`Failed to update config "${nameOrId}".`);
+  }
+}
+async function handleStart(args) {
+  const names = [];
+  let i = 0;
+  while (i < args.length && !args[i].startsWith("-")) {
+    names.push(args[i]);
+    i++;
+  }
+  const flagArgs = args.slice(i);
+  const { values, positionals } = parseCliArgs(cliOptions, flagArgs);
+  configureLogger(values);
+  if (values.all) {
+    await initRemoteManagementBackground(values);
+    await startAutoStartTunnels();
+    return;
+  }
+  if (names.length === 0) {
+    printStartHelp();
+    return;
+  }
+  const resolved = [];
+  for (const name of names) {
+    const saved = resolveConfig(name);
+    if (!saved) return;
+    resolved.push(saved);
+  }
+  if (resolved.length > 1 && flagArgs.length > 0) {
+    printer_default.error("Runtime overrides (-l, --type, etc.) can only be used when starting a single tunnel.");
+    printer_default.print("  Start one tunnel:  pinggy start my-tunnel -l 4000");
+    printer_default.print("  Or update first:   pinggy config update my-tunnel -l 4000");
+    return;
+  }
+  await initRemoteManagementBackground(values);
+  if (values.b) {
+    await startBackgroundTunnels(resolved, values, positionals);
+    return;
+  }
+  if (resolved.length === 1) {
+    const saved = resolved[0];
+    logger.debug("Building config with overrides", { name: saved.name });
+    const finalConfig = buildFinalConfig(values, positionals, saved.tunnelConfig);
+    await startForegroundViaDaemon(finalConfig);
+  } else {
+    await startMultipleForegroundViaDaemon(resolved, values, positionals);
+  }
+}
+function resolveConfig(nameOrId) {
+  const saved = findConfig(nameOrId);
+  if (!saved) {
+    printer_default.error(`No config found matching "${nameOrId}". Use: pinggy config list`);
+    return null;
+  }
+  return saved;
+}
+function requireName(args, command) {
+  if (args.length === 0 || args[0].startsWith("-")) {
+    printer_default.error(`Tunnel name is required. Usage: pinggy ${command} <name>`);
+    process.exit(1);
+  }
+  return args[0];
+}
+function requireNames(args, command) {
+  const names = [];
+  for (const arg of args) {
+    if (arg.startsWith("-")) break;
+    names.push(arg);
+  }
+  if (names.length === 0) {
+    printer_default.error(`At least one tunnel name is required. Usage: pinggy ${command} <name> [name2 ...]`);
+    process.exit(1);
+  }
+  return names;
+}
+async function initRemoteManagementBackground(values) {
+  const rmToken = values["remote-management"];
+  if (typeof rmToken === "string" && rmToken.trim().length > 0) {
+    const manageHost = values["manage"];
+    try {
+      const handler = await TunnelClient.forRemoteManagement();
+      handler.onDaemonLost((reason, detail) => {
+        printer_default.error(daemonLostMessage(reason, detail));
+        setImmediate(() => process.exit(3));
+      });
+      await startRemoteManagement({
+        apiKey: rmToken,
+        serverUrl: buildRemoteManagementWsUrl(manageHost)
+      }, handler);
+    } catch (e) {
+      logger.error("Failed to initiate remote management:", e);
+      printer_default.fatal(e);
+    }
+  }
+}
+
+// src/daemon/lifecycle/daemonChild.ts
+import fs6 from "fs";
+
+// src/daemon/ipc/ipcServer.ts
+import http from "http";
+import fs5 from "fs";
+import path4 from "path";
+import { WebSocketServer, WebSocket } from "ws";
+
+// src/daemon/ws/wsProtocol.ts
+function createTunnelEvent(tunnelId, event, payload) {
+  return { type: "tunnel_event", tunnelId, event, payload };
+}
+function parseClientMessage(raw) {
+  try {
+    const msg = JSON.parse(raw);
+    if (msg.type === "subscribe" && msg.tunnelId) {
+      return {
+        type: "subscribe",
+        tunnelId: msg.tunnelId,
+        mode: msg.mode === SessionMode.Detached ? SessionMode.Detached : SessionMode.Foreground
+      };
+    }
+    if (msg.type === "unsubscribe" && msg.tunnelId) {
+      return { type: "unsubscribe", tunnelId: msg.tunnelId };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+// src/daemon/lifecycle/stateStore.ts
+import fs4 from "fs";
+import path3 from "path";
+var STATE_FILENAME = "daemon-state.json";
+function getStatePath() {
+  return path3.join(getPinggyConfigDir(), STATE_FILENAME);
+}
+function loadDaemonState() {
+  const statePath = getStatePath();
+  try {
+    if (!fs4.existsSync(statePath)) return null;
+    const raw = fs4.readFileSync(statePath, "utf-8");
+    const state = JSON.parse(raw);
+    if (!Array.isArray(state.tunnels)) return null;
+    return state;
+  } catch {
+    return null;
+  }
+}
+function persistDaemonState(state) {
+  ensurePinggyConfigDir();
+  const statePath = getStatePath();
+  const tmpPath = statePath + ".tmp";
+  try {
+    state.lastUpdated = (/* @__PURE__ */ new Date()).toISOString();
+    fs4.writeFileSync(tmpPath, JSON.stringify(state, null, 2), "utf-8");
+    fs4.renameSync(tmpPath, statePath);
+  } catch (err) {
+    logger.error("Failed to persist daemon state", { error: errorMessage(err) });
+  }
+}
+function clearDaemonState() {
+  const statePath = getStatePath();
+  try {
+    if (fs4.existsSync(statePath)) {
+      fs4.unlinkSync(statePath);
+    }
+  } catch {
+  }
+}
+function addTunnelToState(state, tunnel) {
+  state.tunnels = state.tunnels.filter((t) => t.tunnelId !== tunnel.tunnelId);
+  state.tunnels.push(tunnel);
+}
+function removeTunnelFromState(state, tunnelId) {
+  state.tunnels = state.tunnels.filter((t) => t.tunnelId !== tunnelId);
+}
+
+// src/daemon/ipc/ipcServer.ts
+var VALID_ORIGINS = ["app", "cli", "remote"];
+function parseOrigin(req) {
+  const raw = req.headers["x-pinggy-origin"];
+  const v = Array.isArray(raw) ? raw[0] : raw;
+  return v && VALID_ORIGINS.includes(v) ? v : "cli";
+}
+function parseBody(method, body) {
+  if (method === "GET") return void 0;
+  if (!body) return {};
+  return JSON.parse(body);
+}
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function parseTunnelLogFilename(filename) {
+  const base = filename.replace(/\.log$/, "");
+  const parts = base.split("__");
+  if (parts.length < 2) return null;
+  const origin = parts[0];
+  if (!VALID_ORIGINS.includes(origin)) return null;
+  if (parts.length === 2) {
+    const second = parts[1];
+    if (UUID_RE.test(second)) return { origin, tunnelId: second };
+    return { origin, name: second };
+  }
+  const tunnelId = parts[parts.length - 1];
+  const name = parts.slice(1, -1).join("__");
+  return { origin, name, tunnelId };
+}
+var IPCServer = class {
+  constructor() {
+    this.sessions = /* @__PURE__ */ new Map();
+    this.sessionCounter = 0;
+    this.onSessionDisconnect = null;
+    this.sessionTracker = null;
+    this.ops = new TunnelOperations();
+    this.startedAt = Date.now();
+    this.server = http.createServer(this.handleRequest.bind(this));
+    this.wss = new WebSocketServer({ noServer: true });
+    this.routes = this.buildRoutes();
+    this.setupWebSocket();
+  }
+  /**
+   * Set callback for when a WS session disconnects.
+   * Used by SessionTracker for orphan cleanup.
+   */
+  setOnSessionDisconnect(cb) {
+    this.onSessionDisconnect = cb;
+  }
+  setSessionTracker(st) {
+    this.sessionTracker = st;
+  }
+  /**
+   * Get all active sessions (for SessionTracker inspection).
+   */
+  getSessions() {
+    return this.sessions;
+  }
+  buildRoutes() {
+    return {
+      [Route.Ping]: () => ({
+        status: "ok",
+        pid: process.pid,
+        uptime: Math.floor((Date.now() - this.startedAt) / 1e3)
+      }),
+      [Route.ListTunnels]: async () => {
+        const res = await this.ops.handleListV2();
+        if (isErrorResponse(res)) return res;
+        return res.map((t) => ({
+          ...t,
+          mode: this.sessionTracker?.getOwnership(t.tunnelid)?.mode
+        }));
+      },
+      [Route.ListTunnelsV1]: async () => {
+        return await this.ops.handleList();
+      },
+      [Route.StartTunnel]: async (req, ctx) => {
+        if (!req.name) throw new Error("Missing 'name' field");
+        const saved = findConfig(req.name);
+        if (!saved) throw new Error(`No config found matching "${req.name}"`);
+        const config = {
+          ...saved.tunnelConfig,
+          configId: saved.configId,
+          name: saved.name
+        };
+        const result = await this.ops.handleStartV2(config, false, ctx.origin);
+        if (!isErrorResponse(result)) {
+          trackIPCTunnelStart(result.tunnelid, ctx.origin, req.mode);
+        }
+        return result;
+      },
+      [Route.StartTunnelConfig]: async (req, ctx) => {
+        if (!req?.config) throw new Error("Missing 'config' field");
+        const result = await this.ops.handleStartV2(req.config, req.noWait, ctx.origin);
+        if (!isErrorResponse(result)) {
+          trackIPCTunnelStart(result.tunnelid, ctx.origin, req.mode);
+        }
+        return result;
+      },
+      [Route.StartTunnelV1]: async (req, ctx) => {
+        if (!req.config) throw new Error("Missing 'config' field");
+        const result = await this.ops.handleStart(req.config, req.noWait, ctx.origin);
+        if (!isErrorResponse(result)) {
+          trackIPCTunnelStart(result.tunnelid, ctx.origin, req.mode);
+        }
+        return result;
+      },
+      [Route.StopTunnel]: async (req) => {
+        if (!req.tunnelid) throw new Error("Missing 'tunnelid' field");
+        const result = await this.ops.handleStop(req.tunnelid);
+        this.sessionTracker?.removeTunnel(req.tunnelid);
+        if (!isErrorResponse(result)) {
+          trackTunnelStop(req.tunnelid);
+        }
+        return result;
+      },
+      [Route.RestartTunnel]: async (req) => {
+        if (!req.tunnelid) throw new Error("Missing 'tunnelid' field");
+        return await this.ops.handleRestart(req.tunnelid);
+      },
+      [Route.UpdateConfig]: async (req) => {
+        if (!req.config) throw new Error("Missing 'config' field");
+        return await this.ops.handleUpdateConfig(req.config, req.noWait);
+      },
+      [Route.UpdateConfigV2]: async (req) => {
+        if (!req.config) throw new Error("Missing 'config' field");
+        return await this.ops.handleUpdateConfigV2(req.config, req.noWait);
+      },
+      [Route.RemoveStopped]: (req) => {
+        if (req.tunnelid) return { result: this.ops.handleRemoveStoppedTunnelByTunnelId(req.tunnelid) };
+        if (req.configId) return { result: this.ops.handleRemoveStoppedTunnelByConfigId(req.configId) };
+        throw new Error("Missing 'tunnelid' or 'configId' field");
+      },
+      [Route.GetLogLevel]: () => {
+        return { level: getLogLevel() };
+      },
+      [Route.SetLogLevel]: (req) => {
+        if (!["debug", "info", "error"].includes(req.level)) {
+          throw new Error(`Invalid log level: ${req.level}. Must be debug, info, or error`);
+        }
+        setLogLevel(req.level);
+        return { level: req.level, appliedTo: "daemon-js+active-workers-js+future-workers" };
+      },
+      [Route.GetTunnelLogging]: () => {
+        return { enabled: isTunnelLoggingEnabled() };
+      },
+      [Route.SetTunnelLogging]: (req) => {
+        if (typeof req.enabled !== "boolean") throw new Error("Missing 'enabled' boolean");
+        setTunnelLoggingEnabled(req.enabled);
+        return { enabled: isTunnelLoggingEnabled() };
+      },
+      [Route.GetLogPaths]: async () => {
+        const logDir = getTunnelLogDir();
+        const daemonPath = getDaemonLogPath();
+        const tunnels = [];
+        if (fs5.existsSync(logDir)) {
+          const files = fs5.readdirSync(logDir).filter((f) => f.endsWith(".log") && !/\.log\.\d+$/.test(f));
+          const manager = TunnelManager.getInstance();
+          const activeIds = manager.getActiveTunnelIds();
+          const activeNames = /* @__PURE__ */ new Set();
+          for (const t of await manager.getAllTunnels()) {
+            if (!activeIds.has(t.tunnelid)) continue;
+            const n = t.tunnelName ?? t.tunnelConfig?.name;
+            if (n) activeNames.add(n);
+          }
+          for (const file of files) {
+            const filePath = path4.join(logDir, file);
+            const stat = fs5.statSync(filePath);
+            const parsed = parseTunnelLogFilename(file);
+            if (!parsed) continue;
+            const running = parsed.tunnelId ? activeIds.has(parsed.tunnelId) : parsed.name ? activeNames.has(parsed.name) : false;
+            tunnels.push({
+              tunnelId: parsed.tunnelId,
+              name: parsed.name,
+              origin: parsed.origin,
+              path: filePath,
+              mtime: stat.mtimeMs,
+              running
+            });
+          }
+        }
+        return { daemon: daemonPath, tunnels };
+      },
+      [Route.Shutdown]: () => {
+        logger.info("Daemon shutdown requested via IPC");
+        const errors = [];
+        const step = (label, fn) => {
+          try {
+            fn();
+          } catch (e) {
+            const msg = errorMessage(e);
+            errors.push(`${label}: ${msg}`);
+            logger.error(`Shutdown step "${label}" failed`, { error: msg });
+          }
+        };
+        step("removeDaemonInfo", removeDaemonInfo);
+        step("clearDaemonState", clearDaemonState);
+        step("stopAllTunnels", () => TunnelManager.getInstance().stopAllTunnels());
+        setTimeout(() => process.exit(0), 200);
+        return { status: "shutting_down", errors };
+      }
+    };
+  }
+  async handleRequest(req, res) {
+    const method = req.method ?? "GET";
+    const url = req.url ?? "/";
+    const ctx = { origin: parseOrigin(req) };
+    const pathOnly = url.split("?")[0];
+    const routeKey = `${method} ${pathOnly}`;
+    const handler = this.routes[routeKey];
+    if (handler) {
+      try {
+        const body = await this.readBody(req);
+        const parsed = parseBody(method, body);
+        const result = await handler(parsed, ctx);
+        this.sendJson(res, 200, result);
+      } catch (err) {
+        const msg = errorMessage(err);
+        logger.error("IPC handler error", { routeKey, error: msg });
+        this.sendJson(res, 500, { error: msg });
+      }
+      return;
+    }
+    const paramMatch = this.matchParameterizedRoute(method, url);
+    if (paramMatch) {
+      try {
+        await this.readBody(req);
+        const response = await paramMatch.invoke();
+        this.sendJson(res, 200, response);
+      } catch (err) {
+        const msg = errorMessage(err);
+        logger.error("IPC handler error", { route: `${method} ${url}`, error: msg });
+        this.sendJson(res, 500, { error: msg });
+      }
+      return;
+    }
+    this.sendJson(res, 404, { error: "Not found", path: url });
+  }
+  matchParameterizedRoute(method, url) {
+    if (method === "GET") {
+      const statsMatch = url.match(/^\/tunnels\/([^/?]+)\/stats(?:\?.*)?$/);
+      if (statsMatch) {
+        const tunnelId = statsMatch[1];
+        const handler = async ({ tunnelId: id }) => this.ops.handleGetTunnelStats(id);
+        return { invoke: () => handler({ tunnelId }) };
+      }
+      const match = url.match(/^\/tunnels\/([^/?]+)(?:\?.*)?$/);
+      if (match) {
+        const tunnelId = match[1];
+        const handler = async ({ tunnelId: id }) => this.ops.handleGet(id);
+        return { invoke: () => handler({ tunnelId }) };
+      }
+    }
+    if (method === "GET" && url.startsWith("/logs/resolve")) {
+      const urlObj = new URL(url, "http://localhost");
+      const q = urlObj.searchParams.get("q") || "";
+      const handler = async ({ q: query }) => this.resolveLogPath(query);
+      return { invoke: () => handler({ q }) };
+    }
+    return null;
+  }
+  async resolveLogPath(q) {
+    if (!q) return { status: "not-found" };
+    const logDir = getTunnelLogDir();
+    const manager = TunnelManager.getInstance();
+    const activeIds = manager.getActiveTunnelIds();
+    for (const t of await manager.getAllTunnels()) {
+      if (!activeIds.has(t.tunnelid)) continue;
+      const name = t.tunnelName ?? t.tunnelConfig?.name;
+      if (name === q || t.tunnelid === q || t.tunnelid.startsWith(q)) {
+        const origin = "cli";
+        const logPath = getTunnelLogPath(t.tunnelid, origin, name);
+        return { status: "running", path: logPath, tunnelId: t.tunnelid, name, origin, running: true };
+      }
+    }
+    if (fs5.existsSync(logDir)) {
+      const files = fs5.readdirSync(logDir).filter((f) => f.endsWith(".log") && !/\.log\.\d+$/.test(f));
+      const matches = [];
+      for (const file of files) {
+        const parsed = parseTunnelLogFilename(file);
+        if (!parsed) continue;
+        const nameMatch = parsed.name !== void 0 && parsed.name === q;
+        const idMatch = parsed.tunnelId !== void 0 && (parsed.tunnelId === q || parsed.tunnelId.startsWith(q));
+        if (nameMatch || idMatch) {
+          const filePath = path4.join(logDir, file);
+          const stat = fs5.statSync(filePath);
+          matches.push({ path: filePath, mtime: stat.mtimeMs, tunnelId: parsed.tunnelId, name: parsed.name, origin: parsed.origin });
+        }
+      }
+      if (matches.length > 0) {
+        matches.sort((a, b) => b.mtime - a.mtime);
+        const best = matches[0];
+        return { status: "historical", path: best.path, tunnelId: best.tunnelId, name: best.name, origin: best.origin, running: false };
+      }
+    }
+    const saved = listSavedConfigs();
+    const matchedConfig = saved.find((c) => c.name === q || c.configId === q || c.configId.startsWith(q));
+    if (matchedConfig) {
+      return { status: "config-only", name: matchedConfig.name, configId: matchedConfig.configId };
+    }
+    return { status: "not-found" };
+  }
+  setupWebSocket() {
+    this.server.on("upgrade", (req, socket, head) => {
+      if (req.url === "/ws") {
+        this.wss.handleUpgrade(req, socket, head, (ws) => {
+          this.wss.emit("connection", ws, req);
+        });
+      } else {
+        socket.destroy();
+      }
+    });
+    this.wss.on("connection", (ws) => {
+      const session = this.createSession(ws);
+      logger.info(`WS session connected: ${session.id}`);
+      ws.on("message", (data) => {
+        const raw = data.toString();
+        const msg = parseClientMessage(raw);
+        if (msg) {
+          this.handleClientMessage(session, msg);
+        }
+      });
+      ws.on("close", () => {
+        logger.info(`WS session disconnected: ${session.id}`);
+        this.cleanupSession(session);
+        if (this.onSessionDisconnect) {
+          this.onSessionDisconnect(session);
+        }
+      });
+      ws.on("error", (err) => {
+        logger.error(`WS session error: ${session.id}`, { error: err.message });
+      });
+    });
+  }
+  createSession(ws) {
+    const id = `ws_${++this.sessionCounter}_${Date.now()}`;
+    const session = {
+      id,
+      ws,
+      subscriptions: /* @__PURE__ */ new Map(),
+      listenerIds: /* @__PURE__ */ new Map()
+    };
+    this.sessions.set(id, session);
+    return session;
+  }
+  handleClientMessage(session, msg) {
+    switch (msg.type) {
+      case "subscribe":
+        this.handleSubscribe(session, msg.tunnelId, msg.mode).catch((err) => {
+          logger.error("handleSubscribe failed", { sessionId: session.id, tunnelId: msg.tunnelId, error: err.message });
+        });
+        break;
+      case "unsubscribe":
+        this.handleUnsubscribe(session, msg.tunnelId);
+        break;
+    }
+  }
+  async handleSubscribe(session, tunnelId, mode) {
+    if (session.subscriptions.has(tunnelId)) {
+      return;
+    }
+    const listenerIds = [];
+    const manager = TunnelManager.getInstance();
+    try {
+      const [statsListenerId] = await manager.registerStatsListener(tunnelId, (_id, stats) => {
+        this.sendEvent(session, tunnelId, "stats", { stats });
+      });
+      listenerIds.push(`stats:${statsListenerId}`);
+      const disconnectId = await manager.registerDisconnectListener(tunnelId, (_id, error, messages) => {
+        this.sendEvent(session, tunnelId, "disconnect", { error, messages });
+      });
+      listenerIds.push(`disconnect:${disconnectId}`);
+      const stoppedId = await manager.registerStoppedListener(tunnelId, () => {
+        this.sendEvent(session, tunnelId, "stopped", {});
+      });
+      listenerIds.push(`stopped:${stoppedId}`);
+      const reconnectingId = await manager.registerReconnectingListener(tunnelId, (_id, retryCnt) => {
+        this.sendEvent(session, tunnelId, "reconnecting", { retryCnt });
+      });
+      listenerIds.push(`reconnecting:${reconnectingId}`);
+      const reconnectedId = await manager.registerReconnectionCompletedListener(tunnelId, (_id, urls) => {
+        this.sendEvent(session, tunnelId, "reconnected", { urls });
+      });
+      listenerIds.push(`reconnected:${reconnectedId}`);
+      const failedId = await manager.registerReconnectionFailedListener(tunnelId, (_id, retryCnt) => {
+        this.sendEvent(session, tunnelId, "reconnection_failed", { retryCnt });
+      });
+      listenerIds.push(`failed:${failedId}`);
+      const willReconnectId = await manager.registerWillReconnectListener(tunnelId, (_id, error, messages) => {
+        this.sendEvent(session, tunnelId, "will_reconnect", { error, messages });
+      });
+      listenerIds.push(`will_reconnect:${willReconnectId}`);
+      const workerErrorId = await manager.registerWorkerErrorListner(tunnelId, (_id, error) => {
+        this.sendEvent(session, tunnelId, "worker_error", { message: error.message });
+      });
+      listenerIds.push(`worker_error:${workerErrorId}`);
+      const startId = await manager.registerStartListener(tunnelId, (_id, urls) => {
+        this.sendEvent(session, tunnelId, "url_ready", { urls });
+      });
+      listenerIds.push(`start:${startId}`);
+      session.subscriptions.set(tunnelId, { tunnelId, mode });
+      this.sessionTracker?.attach(tunnelId, session.id, mode);
+      session.listenerIds.set(tunnelId, listenerIds);
+      this.sendEvent(session, tunnelId, "subscribed", { tunnelId });
+    } catch (err) {
+      session.listenerIds.set(tunnelId, listenerIds);
+      this.deregisterListeners(session, tunnelId);
+      this.sendEvent(session, tunnelId, "error_response", { message: errorMessage(err) });
+    }
+  }
+  handleUnsubscribe(session, tunnelId) {
+    this.deregisterListeners(session, tunnelId);
+    session.subscriptions.delete(tunnelId);
+  }
+  deregisterListeners(session, tunnelId) {
+    const ids = session.listenerIds.get(tunnelId);
+    if (!ids) return;
+    const manager = TunnelManager.getInstance();
+    for (const entry of ids) {
+      const [type, listenerId] = entry.split(":");
+      try {
+        switch (type) {
+          case "stats":
+            manager.deregisterStatsListener(tunnelId, listenerId);
+            break;
+          case "disconnect":
+            manager.deregisterDisconnectListener(tunnelId, listenerId);
+            break;
+          case "stopped":
+            manager.deregisterStoppedListener(tunnelId, listenerId);
+            break;
+          case "reconnecting":
+            manager.deregisterReconnectingListener(tunnelId, listenerId);
+            break;
+          case "reconnected":
+            manager.deregisterReconnectionCompletedListener(tunnelId, listenerId);
+            break;
+          case "failed":
+            manager.deregisterReconnectionFailedListener(tunnelId, listenerId);
+            break;
+          case "will_reconnect":
+            manager.deregisterWillReconnectListener(tunnelId, listenerId);
+            break;
+          case "worker_error":
+            manager.deregisterWorkerErrorListener(tunnelId, listenerId);
+            break;
+          case "start":
+            break;
+        }
+      } catch {
+      }
+    }
+    session.listenerIds.delete(tunnelId);
+  }
+  cleanupSession(session) {
+    for (const tunnelId of session.subscriptions.keys()) {
+      this.deregisterListeners(session, tunnelId);
+    }
+    session.subscriptions.clear();
+    this.sessions.delete(session.id);
+  }
+  sendEvent(session, tunnelId, event, payload) {
+    if (session.ws.readyState === WebSocket.OPEN) {
+      const msg = createTunnelEvent(tunnelId, event, payload);
+      session.ws.send(JSON.stringify(msg));
+    }
+  }
+  readBody(req) {
+    return new Promise((resolve, reject) => {
+      const chunks = [];
+      let size = 0;
+      const MAX_BODY = 1024 * 64;
+      req.on("data", (chunk) => {
+        size += chunk.length;
+        if (size > MAX_BODY) {
+          req.destroy();
+          reject(new Error("Request body too large"));
+          return;
+        }
+        chunks.push(chunk);
+      });
+      req.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
+      req.on("error", reject);
+    });
+  }
+  sendJson(res, statusCode, data) {
+    const body = JSON.stringify(data);
+    res.writeHead(statusCode, {
+      "Content-Type": "application/json",
+      "Content-Length": Buffer.byteLength(body)
+    });
+    res.end(body);
+  }
+  /**
+   * Start listening on 127.0.0.1 with OS-assigned port.
+   * Returns the assigned port.
+   */
+  listen() {
+    return new Promise((resolve, reject) => {
+      this.server.on("error", reject);
+      this.server.listen(0, "127.0.0.1", () => {
+        const addr = this.server.address();
+        logger.info(`IPC server listening on 127.0.0.1:${addr.port}`);
+        resolve(addr.port);
+      });
+    });
+  }
+  close() {
+    return new Promise((resolve) => {
+      for (const session of this.sessions.values()) {
+        session.ws.close(1001, "Daemon shutting down");
+      }
+      this.wss.close();
+      this.server.close(() => resolve());
+    });
+  }
+};
+
+// src/daemon/lifecycle/sessionTracker.ts
+var GRACE_PERIOD_MS = 5e3;
+var SessionTracker = class {
+  constructor() {
+    this.ownership = /* @__PURE__ */ new Map();
+    // tunnelId → ownership
+    this.graceTimers = /* @__PURE__ */ new Map();
+  }
+  // tunnelId → timer
+  /**
+   * Register a tunnel as owned by a session in a specific mode.
+   */
+  attach(tunnelId, sessionId, mode) {
+    this.cancelGraceTimer(tunnelId);
+    this.ownership.set(tunnelId, { tunnelId, sessionId, mode });
+    logger.info(`Tunnel ${tunnelId} attached to session ${sessionId} (${mode})`);
+  }
+  /**
+   * Mark a tunnel as detached (persists without session).
+   */
+  markDetached(tunnelId) {
+    const existing = this.ownership.get(tunnelId);
+    if (existing) {
+      existing.mode = SessionMode.Detached;
+      existing.sessionId = "";
+      logger.info(`Tunnel ${tunnelId} marked as detached`);
+    }
+  }
+  /**
+   * Get the ownership info for a tunnel.
+   */
+  getOwnership(tunnelId) {
+    return this.ownership.get(tunnelId);
+  }
+  /**
+   * Get all tunnels owned by a session.
+   */
+  getTunnelsForSession(sessionId) {
+    return Array.from(this.ownership.values()).filter((o) => o.sessionId === sessionId);
+  }
+  /**
+   * Called when a WS session disconnects.
+   * Starts grace timers for all foreground tunnels owned by that session.
+   */
+  onSessionDisconnect(session) {
+    const sessionId = session.id;
+    const tunnels = this.getTunnelsForSession(sessionId);
+    for (const ownership of tunnels) {
+      if (ownership.mode === SessionMode.Foreground) {
+        logger.info(`Session ${sessionId} disconnected. Starting ${GRACE_PERIOD_MS}ms grace for tunnel ${ownership.tunnelId}`);
+        this.startGraceTimer(ownership.tunnelId);
+      }
+    }
+  }
+  /**
+   * Called when a session re-attaches to a tunnel (e.g. CLI reconnects WS).
+   * Cancels any pending grace timer.
+   */
+  onSessionReconnect(tunnelId, sessionId) {
+    this.cancelGraceTimer(tunnelId);
+    const existing = this.ownership.get(tunnelId);
+    if (existing) {
+      existing.sessionId = sessionId;
+      logger.info(`Tunnel ${tunnelId} re-attached to session ${sessionId}`);
+    }
+  }
+  /**
+   * Remove ownership tracking for a tunnel (called when tunnel stops).
+   */
+  removeTunnel(tunnelId) {
+    this.cancelGraceTimer(tunnelId);
+    this.ownership.delete(tunnelId);
+  }
+  /**
+   * Check if a tunnel is in foreground mode.
+   */
+  isForeground(tunnelId) {
+    const o = this.ownership.get(tunnelId);
+    return o?.mode === SessionMode.Foreground;
+  }
+  startGraceTimer(tunnelId) {
+    this.cancelGraceTimer(tunnelId);
+    const timer = setTimeout(() => {
+      this.graceTimers.delete(tunnelId);
+      this.killOrphanedTunnel(tunnelId);
+    }, GRACE_PERIOD_MS);
+    this.graceTimers.set(tunnelId, timer);
+  }
+  cancelGraceTimer(tunnelId) {
+    const timer = this.graceTimers.get(tunnelId);
+    if (timer) {
+      clearTimeout(timer);
+      this.graceTimers.delete(tunnelId);
+    }
+  }
+  killOrphanedTunnel(tunnelId) {
+    const ownership = this.ownership.get(tunnelId);
+    if (!ownership || ownership.mode !== SessionMode.Foreground) {
+      return;
+    }
+    logger.info(`Grace period expired for tunnel ${tunnelId}. Stopping orphaned foreground tunnel.`);
+    try {
+      const manager = TunnelManager.getInstance();
+      manager.stopTunnel(tunnelId);
+    } catch (err) {
+      logger.error(`Failed to stop orphaned tunnel ${tunnelId}`, { error: errorMessage(err) });
+    }
+    trackTunnelStop(tunnelId);
+    this.ownership.delete(tunnelId);
+  }
+  /**
+   * Cleanup all timers (for daemon shutdown).
+   */
+  destroy() {
+    for (const timer of this.graceTimers.values()) {
+      clearTimeout(timer);
+    }
+    this.graceTimers.clear();
+    this.ownership.clear();
+  }
+};
+
+// src/daemon/lifecycle/daemonChild.ts
+var daemonState = { tunnels: [], lastUpdated: "" };
+var sessionTrackerRef = null;
+function setDaemonSessionTracker(st) {
+  sessionTrackerRef = st;
+}
+function writeDaemonInfo(info) {
+  ensurePinggyConfigDir();
+  const infoPath = getDaemonInfoPath();
+  const tmpPath = infoPath + ".tmp";
+  fs6.writeFileSync(tmpPath, JSON.stringify(info, null, 2), "utf-8");
+  fs6.renameSync(tmpPath, infoPath);
+}
+function removeDaemonInfo() {
+  try {
+    const infoPath = getDaemonInfoPath();
+    if (fs6.existsSync(infoPath)) fs6.unlinkSync(infoPath);
+  } catch {
+  }
+}
+function trackTunnelStart(tunnelId, configId, name, origin, config, mode) {
+  const entry = {
+    tunnelId,
+    configId,
+    name,
+    origin,
+    config,
+    mode,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  addTunnelToState(daemonState, entry);
+  persistDaemonState(daemonState);
+  if (mode === SessionMode.Detached) {
+    sessionTrackerRef?.attach(tunnelId, "", SessionMode.Detached);
+  }
+}
+function trackTunnelStop(tunnelId) {
+  removeTunnelFromState(daemonState, tunnelId);
+  persistDaemonState(daemonState);
+  sessionTrackerRef?.removeTunnel(tunnelId);
+}
+function trackIPCTunnelStart(tunnelId, origin, mode = SessionMode.Detached) {
+  if (mode === SessionMode.Foreground) return;
+  const manager = TunnelManager.getInstance();
+  const managed = manager.getManagedTunnel("", tunnelId);
+  if (!managed?.tunnelConfig) return;
+  trackTunnelStart(
+    tunnelId,
+    managed.configId,
+    managed.tunnelName ?? "",
+    origin,
+    managed.tunnelConfig,
+    SessionMode.Detached
+  );
+}
+async function startSavedTunnel(saved, manager) {
+  const config = {
+    ...saved.tunnelConfig,
+    configId: saved.configId,
+    name: saved.name,
+    optional: {
+      ...saved.tunnelConfig.optional,
+      noTui: true
+    }
+  };
+  const tunnel = await manager.createTunnel(config, "cli");
+  await manager.startTunnel(tunnel.tunnelid);
+  const urls = await manager.getTunnelUrls(tunnel.tunnelid);
+  logger.info(`Tunnel "${saved.name}" started`, { tunnelId: tunnel.tunnelid, urls });
+  trackTunnelStart(tunnel.tunnelid, saved.configId, saved.name, "cli", saved.tunnelConfig, SessionMode.Detached);
+  await manager.registerWorkerErrorListner(tunnel.tunnelid, (_id, error) => {
+    logger.error(`[${saved.name}] Fatal error: ${error.message}`);
+  });
+  await manager.registerReconnectingListener(tunnel.tunnelid, (_id, retryCnt) => {
+    logger.info(`[${saved.name}] Reconnecting (attempt #${retryCnt})`);
+  });
+  await manager.registerReconnectionCompletedListener(tunnel.tunnelid, (_id, newUrls) => {
+    logger.info(`[${saved.name}] Reconnected`, { urls: newUrls });
+  });
+  await manager.registerReconnectionFailedListener(tunnel.tunnelid, (_id, retryCnt) => {
+    logger.error(`[${saved.name}] Reconnection failed after ${retryCnt} attempts`);
+  });
+}
+async function restoreCrashedTunnels(manager) {
+  const savedState = loadDaemonState();
+  if (!savedState || savedState.tunnels.length === 0) return;
+  const detachedTunnels = savedState.tunnels.filter((t) => t.mode === "detached");
+  if (detachedTunnels.length === 0) {
+    logger.info("Crash recovery: no detached tunnels to restore");
+    clearDaemonState();
+    return;
+  }
+  logger.info(`Crash recovery: restoring ${detachedTunnels.length} detached tunnel(s)`);
+  for (const entry of detachedTunnels) {
+    try {
+      const config = {
+        ...entry.config,
+        configId: entry.configId,
+        name: entry.name,
+        tunnelid: entry.tunnelId,
+        // reuse stable ID for log file continuity
+        optional: {
+          ...entry.config.optional,
+          noTui: true
+        }
+      };
+      const tunnel = await manager.createTunnel(config, entry.origin);
+      await manager.startTunnel(tunnel.tunnelid);
+      const urls = await manager.getTunnelUrls(tunnel.tunnelid);
+      logger.info(`Restored tunnel "${entry.name}"`, { tunnelId: tunnel.tunnelid, urls });
+      trackTunnelStart(tunnel.tunnelid, entry.configId, entry.name, entry.origin, entry.config, SessionMode.Detached);
+      await manager.registerWorkerErrorListner(tunnel.tunnelid, (_id, error) => {
+        logger.error(`[${entry.name}] Fatal error: ${error.message}`);
+      });
+      await manager.registerReconnectingListener(tunnel.tunnelid, (_id, retryCnt) => {
+        logger.info(`[${entry.name}] Reconnecting (attempt #${retryCnt})`);
+      });
+      await manager.registerReconnectionCompletedListener(tunnel.tunnelid, (_id, newUrls) => {
+        logger.info(`[${entry.name}] Reconnected`, { urls: newUrls });
+      });
+      await manager.registerReconnectionFailedListener(tunnel.tunnelid, (_id, retryCnt) => {
+        logger.error(`[${entry.name}] Reconnection failed after ${retryCnt} attempts`);
+      });
+    } catch (err) {
+      logger.error(`Failed to restore tunnel "${entry.name}"`, { error: errorMessage(err) });
+    }
+  }
+}
+async function runDaemonChild(opts = {}) {
+  const installSignalHandlers = opts.installSignalHandlers ?? true;
+  const exitOnFailure = opts.exitOnFailure ?? true;
+  ensurePinggyConfigDir();
+  const persistedLevel = readDaemonConfig()?.logLevel;
+  const envLevel = process.env.PINGGY_LOG_LEVEL;
+  const initialLevel = persistedLevel ?? envLevel ?? "info";
+  setLogLevel(initialLevel);
+  ensurePinggyLogDir();
+  const logPath = getDaemonLogPath();
+  enablePackageLogging({
+    level: initialLevel,
+    filePath: logPath,
+    stdout: false,
+    enableSdkLog: true
+  });
+  logger.info("Daemon starting", { pid: process.pid, inProcess: !installSignalHandlers });
+  const manager = TunnelManager.getInstance();
+  const ipcServer = new IPCServer();
+  const sessionTracker = new SessionTracker();
+  ipcServer.setOnSessionDisconnect((session) => {
+    sessionTracker.onSessionDisconnect(session);
+  });
+  ipcServer.setSessionTracker(sessionTracker);
+  setDaemonSessionTracker(sessionTracker);
+  let cleanedUp = false;
+  const cleanup = () => {
+    if (cleanedUp) return;
+    cleanedUp = true;
+    logger.info("Daemon shutting down");
+    try {
+      removeDaemonInfo();
+    } catch {
+    }
+    try {
+      clearDaemonState();
+    } catch {
+    }
+    try {
+      sessionTracker.destroy();
+    } catch {
+    }
+    setDaemonSessionTracker(null);
+    try {
+      detachAllTunnelLoggers();
+    } catch {
+    }
+    try {
+      manager.stopAllTunnels();
+    } catch {
+    }
+    try {
+      void ipcServer.close();
+    } catch {
+    }
+  };
+  if (installSignalHandlers) {
+    process.on("SIGTERM", () => {
+      cleanup();
+      process.exit(0);
+    });
+    process.on("SIGINT", () => {
+      cleanup();
+      process.exit(0);
+    });
+    process.on("exit", cleanup);
+    process.on("uncaughtException", (err) => {
+      logger.error("Daemon uncaught exception", { error: err.message, stack: err.stack });
+    });
+    process.on("unhandledRejection", (reason) => {
+      logger.error("Daemon unhandled rejection", { reason: String(reason) });
+    });
+  }
+  try {
+    const port = await ipcServer.listen();
+    const info = {
+      pid: process.pid,
+      port,
+      startedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    writeDaemonInfo(info);
+    logger.info("Daemon info written", info);
+    await restoreCrashedTunnels(manager);
+    const configs = getAutoStartConfigs();
+    if (configs.length > 0) {
+      logger.info(`Starting ${configs.length} auto-start tunnel(s)`);
+      for (const saved of configs) {
+        try {
+          await startSavedTunnel(saved, manager);
+        } catch (err) {
+          logger.error(`Failed to start tunnel "${saved.name}"`, { error: errorMessage(err) });
+        }
+      }
+    } else {
+      logger.info("No auto-start tunnels configured");
+    }
+    logger.info("Daemon ready", { pid: process.pid, port });
+    return {
+      pid: process.pid,
+      port,
+      shutdown: cleanup
+    };
+  } catch (err) {
+    logger.error("Daemon failed to start", { error: errorMessage(err) });
+    removeDaemonInfo();
+    if (exitOnFailure) {
+      process.exit(1);
+    }
+    throw err;
+  }
+}
+
+// src/main.ts
+async function main() {
+  try {
+    const rawArgs = process.argv.slice(2);
+    const { values, positionals, hasAnyArgs } = parseCliArgs(cliOptions);
+    configureLogger(values);
+    if (values["_daemon-child"]) {
+      const { runDaemonChild: runDaemonChild2 } = await import("./daemonChild-KXERF36J.js");
+      await runDaemonChild2();
+      return;
+    }
+    if (isSubcommand(rawArgs)) {
+      await handleSubcommand(rawArgs);
+      return;
+    }
+    if (!hasAnyArgs || values.help) {
+      printHelpMessage();
+      return;
+    }
+    if (values.version) {
+      printer_default.print(`Pinggy CLI version: ${getVersion()}`);
+      return;
+    }
+    await buildAndStartTunnel(values, positionals);
+  } catch (error) {
+    logger.error("Unhandled error in CLI:", error);
+    printer_default.fatal(error);
+  }
+}
+var currentFile = fileURLToPath(import.meta.url);
+var entryFile = null;
+try {
+  entryFile = argv[1] ? realpathSync(argv[1]) : null;
+} catch (e) {
+  entryFile = null;
+}
+if (entryFile && entryFile === currentFile) {
+  void main();
+}
+
+export {
+  setDaemonSessionTracker,
+  removeDaemonInfo,
+  trackTunnelStart,
+  trackTunnelStop,
+  trackIPCTunnelStart,
+  runDaemonChild
+};