pinggy 0.5.2 → 0.5.5

package/dist/index.cjs

@@ -51,7 +51,7 @@ function startSpinner(name = "dots", text = "Loading") {
   }
   currentTimer = setInterval(() => {
     const frame = spinner.frames[i = ++i % spinner.frames.length];
-    process.stdout.write(`\r${import_picocolors.default.cyan(frame)} ${text}`);
+    process.stdout.write(`\r${import_picocolors.default.cyan(frame)} ${text}\x1B[K`);
   }, spinner.interval);
   return () => stopSpinner();
 }
@@ -67,7 +67,7 @@ function stopSpinnerSuccess(message) {
     clearInterval(currentTimer);
     currentTimer = null;
     const finalMessage = message || currentText;
-    process.stdout.write(`\r${import_picocolors.default.green("\u2714")} ${finalMessage}
+    process.stdout.write(`\r${import_picocolors.default.green("\u2714")} ${finalMessage}\x1B[K
 `);
   }
 }
@@ -76,7 +76,7 @@ function stopSpinnerFail(message) {
     clearInterval(currentTimer);
     currentTimer = null;
     const finalMessage = message || currentText;
-    process.stdout.write(`\r${import_picocolors.default.red("\u2716")} ${finalMessage}
+    process.stdout.write(`\r${import_picocolors.default.red("\u2716")} ${finalMessage}\x1B[K
 `);
   }
 }
@@ -1063,6 +1063,29 @@ var init_TunnelManager = __esm({
         }
         return Promise.reject(new Error(`Either configId or tunnelId must be provided`));
       }
+      /**
+       * Stop a tunnel instance and wait for the stop to settle, capped by a
+       * timeout. Failure is logged, not thrown: the caller replaces the
+       * instance either way and a hung stop must not block that forever.
+       */
+      async stopInstanceGuarded(managed, timeoutMs = 5e3) {
+        let timer;
+        try {
+          await Promise.race([
+            managed.instance.stop(),
+            new Promise((_, reject) => {
+              timer = setTimeout(() => reject(new Error(`Stop timed out after ${timeoutMs}ms`)), timeoutMs);
+            })
+          ]);
+        } catch (e) {
+          logger.warn("Failed to stop tunnel instance before replacement", {
+            tunnelId: managed.tunnelid,
+            error: errorMessage(e)
+          });
+        } finally {
+          if (timer) clearTimeout(timer);
+        }
+      }
       /**
        * Restarts a tunnel with its current configuration.
        * This function will stop the tunnel if it's running and start it again.
@@ -1084,6 +1107,9 @@ var init_TunnelManager = __esm({
           const currentServe = existingTunnel.serve;
           const autoReconnect = existingTunnel.autoReconnect || false;
           const currentOrigin = existingTunnel.origin;
+          if (!existingTunnel.isStopped) {
+            await this.stopInstanceGuarded(existingTunnel);
+          }
           this.tunnelsByTunnelId.delete(tunnelid);
           this.tunnelsByConfigId.delete(existingTunnel.configId);
           this.tunnelStats.delete(tunnelid);
@@ -1118,9 +1144,26 @@ var init_TunnelManager = __esm({
           throw new Error(`Failed to restart tunnel: ${error instanceof Error ? error.message : "Unknown error"}`);
         }
       }
+      /**
+       * Carry lifecycle state from a replaced tunnel over to its replacement:
+       * keep createdAt, start the replacement if the old tunnel was running,
+       * otherwise keep it stopped with the original timestamps.
+       */
+      async applyPreservedLifecycle(tunnel, prior) {
+        if (prior.createdAt) {
+          tunnel.createdAt = prior.createdAt;
+        }
+        if (!prior.isStopped) {
+          await this.startTunnel(tunnel.tunnelid);
+          return;
+        }
+        tunnel.isStopped = true;
+        tunnel.startedAt = prior.startedAt;
+        tunnel.stoppedAt = prior.stoppedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+      }
       /**
        * Updates the configuration of an existing tunnel.
-       * 
+       *
        * This method handles the process of updating a tunnel's configuration while preserving
        * its state. If the tunnel is running, it will be stopped, updated, and restarted.
        * In case of failure, it attempts to restore the original configuration.
@@ -1147,10 +1190,13 @@ var init_TunnelManager = __esm({
         const currentServe = existingTunnel.serve;
         const currentAutoReconnect = existingTunnel.autoReconnect || false;
         const currentOrigin = existingTunnel.origin;
+        const currentCreatedAt = existingTunnel.createdAt;
+        const currentStartedAt = existingTunnel.startedAt;
+        const currentStoppedAt = existingTunnel.stoppedAt;
         const requestedServe = this.resolveServePath(newConfig);
         try {
           if (!isStopped) {
-            void existingTunnel.instance.stop();
+            await this.stopInstanceGuarded(existingTunnel);
           }
           this.tunnelsByTunnelId.delete(currentTunnelId);
           this.tunnelsByConfigId.delete(currentTunnelConfigId);
@@ -1162,7 +1208,6 @@ var init_TunnelManager = __esm({
           };
           const effectiveServe = requestedServe !== void 0 ? requestedServe : currentServe;
           const effectiveTunnelName = newTunnelName !== void 0 ? newTunnelName : currentTunnelName;
-          let configWithForwarding;
           const newTunnel = await this._createTunnelWithProcessedConfig({
             configId,
             tunnelid: currentTunnelId,
@@ -1172,9 +1217,12 @@ var init_TunnelManager = __esm({
             serve: effectiveServe,
             autoReconnect: currentAutoReconnect
           });
-          if (!isStopped) {
-            await this.startTunnel(newTunnel.tunnelid);
-          }
+          await this.applyPreservedLifecycle(newTunnel, {
+            isStopped,
+            createdAt: currentCreatedAt,
+            startedAt: currentStartedAt,
+            stoppedAt: currentStoppedAt
+          });
           logger.info("Tunnel configuration updated", {
             tunnelId: newTunnel.tunnelid,
             configId: newTunnel.configId,
@@ -1196,9 +1244,12 @@ var init_TunnelManager = __esm({
               serve: currentServe,
               autoReconnect: currentAutoReconnect
             });
-            if (!isStopped) {
-              await this.startTunnel(originalTunnel.tunnelid);
-            }
+            await this.applyPreservedLifecycle(originalTunnel, {
+              isStopped,
+              createdAt: currentCreatedAt,
+              startedAt: currentStartedAt,
+              stoppedAt: currentStoppedAt
+            });
             logger.warn("Restored original tunnel configuration after update failure", {
               currentTunnelId,
               error: errorMessage(error)
@@ -1815,6 +1866,9 @@ var init_TunnelManager = __esm({
             try {
               logger.info("Tunnel reconnection completed", { tunnelId, urls });
               const managedTunnel = this.tunnelsByTunnelId.get(tunnelId);
+              if (managedTunnel?.isStopping || managedTunnel?.isStopped) {
+                return;
+              }
               if (managedTunnel) {
                 managedTunnel.isStopped = false;
                 managedTunnel.startedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -2152,6 +2206,7 @@ function pinggyOptionsToTunnelConfigV1(opts, configStoredInCli) {
     httpsOnly: opts.httpsOnly ?? false,
     originalRequestUrl: opts.originalRequestUrl ?? false,
     allowPreflight: opts.allowPreflight ?? false,
+    haProxy: opts.haProxy,
     optional: opts.optional || {}
   };
 }
@@ -2341,7 +2396,7 @@ var init_remote_schema = __esm({
     ForwardingEntryV2Schema = import_zod.z.object({
       listenAddress: import_zod.z.string().optional(),
       address: import_zod.z.string(),
-      type: import_zod.z.enum([import_pinggy3.TunnelType.Http, import_pinggy3.TunnelType.Tcp, import_pinggy3.TunnelType.Udp, import_pinggy3.TunnelType.Tls, import_pinggy3.TunnelType.TlsTcp])
+      type: import_zod.z.enum([import_pinggy3.TunnelType.Http, import_pinggy3.TunnelType.Tcp, import_pinggy3.TunnelType.Udp, import_pinggy3.TunnelType.Tls, import_pinggy3.TunnelType.TlsTcp]).default(import_pinggy3.TunnelType.Http)
     });
     OptionalSchema = import_zod.z.object({
       sniServerName: import_zod.z.string().optional(),
@@ -2385,7 +2440,9 @@ var init_remote_schema = __esm({
       httpsOnly: import_zod.z.boolean().optional(),
       originalRequestUrl: import_zod.z.boolean().optional(),
       allowPreflight: import_zod.z.boolean().optional(),
-      optional: OptionalSchema.optional()
+      haProxy: import_zod.z.enum([import_pinggy3.HaProxyVersion.V1, import_pinggy3.HaProxyVersion.V2]).optional(),
+      serve: import_zod.z.string().optional(),
+      optional: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).optional()
     });
     TUNNEL_CONFIG_V1_KEYS = Object.keys(
       TunnelConfigV1Schema.shape
@@ -2525,11 +2582,11 @@ var init_handler = __esm({
             startPromise.catch((err) => {
               logger.error("No-wait startTunnel failed", { tunnelid, err: String(err) });
             });
-            return this.buildPendingTunnelResponseV2(tunnelid, tunnelConfig, config, config.configId, config.name, config.optional?.serve);
+            return this.buildPendingTunnelResponseV2(tunnelid, tunnelConfig, config, config.configId, config.name, config.serve);
           }
           await startPromise;
           const tunnelPconfig = await this.tunnelManager.getTunnelConfig("", tunnelid);
-          return this.buildTunnelResponseV2(tunnelid, tunnelPconfig, config, config.configId, config.name, config.optional?.serve);
+          return this.buildTunnelResponseV2(tunnelid, tunnelPconfig, config, config.configId, config.name, config.serve);
         } catch (err) {
           if (err instanceof TunnelAlreadyRunningError) {
             return this.error(ErrorCode.TunnelAlreadyRunningError, err, err.message);
@@ -2551,10 +2608,12 @@ var init_handler = __esm({
           if (noWait) {
             const existing = this.tunnelManager.getManagedTunnel(config.configid);
             if (!existing.tunnelConfig) throw new Error("Invalid tunnel state before configuration update");
-            this.tunnelManager.updateConfig(updateOpts).catch((err) => {
-              logger.error("No-wait updateConfig failed", { configid: config.configid, err: String(err) });
-            });
-            return this.buildPendingTunnelResponse(existing.tunnelid, existing.tunnelConfig, config.configid, existing.tunnelName, existing.serve);
+            if (!existing.isStopped) {
+              this.tunnelManager.updateConfig(updateOpts).catch((err) => {
+                logger.error("No-wait updateConfig failed", { configid: config.configid, err: String(err) });
+              });
+              return this.buildPendingTunnelResponse(existing.tunnelid, existing.tunnelConfig, config.configid, existing.tunnelName, existing.serve);
+            }
           }
           const tunnel = await this.tunnelManager.updateConfig(updateOpts);
           if (!tunnel.instance || !tunnel.tunnelConfig)
@@ -2569,10 +2628,12 @@ var init_handler = __esm({
           if (noWait) {
             const existing = this.tunnelManager.getManagedTunnel(config.configId);
             if (!existing.tunnelConfig) throw new Error("Invalid tunnel state before configuration update");
-            this.tunnelManager.updateConfig(config).catch((err) => {
-              logger.error("No-wait updateConfigV2 failed", { configId: config.configId, err: String(err) });
-            });
-            return this.buildPendingTunnelResponseV2(existing.tunnelid, existing.tunnelConfig, config, config.configId, existing.tunnelName, existing.serve);
+            if (!existing.isStopped) {
+              this.tunnelManager.updateConfig(config).catch((err) => {
+                logger.error("No-wait updateConfigV2 failed", { configId: config.configId, err: String(err) });
+              });
+              return this.buildPendingTunnelResponseV2(existing.tunnelid, existing.tunnelConfig, config, config.configId, existing.tunnelName, existing.serve);
+            }
           }
           const tunnel = await this.tunnelManager.updateConfig(config);
           if (!tunnel.instance || !tunnel.tunnelConfig)
@@ -2717,7 +2778,7 @@ var init_handler = __esm({
 });
 
 // src/daemon/ipc/ipcRoutes.ts
-var Route, SessionMode;
+var Route, DaemonHost, ShutdownStatus, SessionMode;
 var init_ipcRoutes = __esm({
   "src/daemon/ipc/ipcRoutes.ts"() {
     "use strict";
@@ -2741,6 +2802,14 @@ var init_ipcRoutes = __esm({
       SetTunnelLogging: "POST /config/tunnel-logging",
       GetLogPaths: "GET /logs/paths"
     };
+    DaemonHost = {
+      CLI: "cli",
+      APP: "app"
+    };
+    ShutdownStatus = {
+      ShuttingDown: "shutting_down",
+      RefusedInApp: "refused_in_app"
+    };
     SessionMode = {
       Foreground: "foreground",
       Detached: "detached"
@@ -2787,8 +2856,8 @@ var init_ipcClient = __esm({
       async stopTunnel(tunnelid) {
         return this.call(Route.StopTunnel, { tunnelid });
       }
-      async restartTunnel(tunnelid) {
-        return this.call(Route.RestartTunnel, { tunnelid });
+      async restartTunnel(tunnelid, noWait) {
+        return this.call(Route.RestartTunnel, { tunnelid, noWait });
       }
       // v1 operations (used by remote management via daemon)
       async startTunnelV1(config, mode, noWait) {
@@ -2970,6 +3039,7 @@ function printHelpMessage() {
   console.log("  x:noreverseproxy        Disable built-in reverse-proxy header injection");
   console.log("  x:localservertls:host   Connect to local HTTPS server with SNI");
   console.log("  x:passpreflight         Pass CORS preflight requests unchanged");
+  console.log("  x:haproxy[:v1|:v2]      Enable HAProxy PROXY protocol (default v1)");
   console.log("  a:Key:Val               Add header");
   console.log("  u:Key:Val               Update header");
   console.log("  r:Key                   Remove header");
@@ -3095,7 +3165,7 @@ var init_parseArgs = __esm({
 });
 
 // src/remote_management/websocket_printer.ts
-var import_picocolors3, PENDING_START_TIMEOUT_MS, RemoteManagementWebSocketPrinter, remoteManagementWebSocketPrinter;
+var import_picocolors3, PENDING_TIMEOUT_MS, PendingTracker, RemoteManagementWebSocketPrinter, remoteManagementWebSocketPrinter;
 var init_websocket_printer = __esm({
   "src/remote_management/websocket_printer.ts"() {
     "use strict";
@@ -3104,13 +3174,71 @@ var init_websocket_printer = __esm({
     init_types();
     init_printer();
     import_picocolors3 = __toESM(require("picocolors"), 1);
-    PENDING_START_TIMEOUT_MS = 5 * 60 * 1e3;
-    RemoteManagementWebSocketPrinter = class {
+    PENDING_TIMEOUT_MS = 5 * 60 * 1e3;
+    PendingTracker = class {
       constructor() {
-        this.pendingStarts = /* @__PURE__ */ new Map();
+        this.entries = /* @__PURE__ */ new Map();
       }
-      setTunnelHandler(tunnelHandler) {
-        this.tunnelHandler = tunnelHandler;
+      queue(entry) {
+        this.latestConfigId = entry.configId;
+        this.entries.set(entry.configId, entry);
+      }
+      /** Store an entry without claiming the latest cursor. */
+      upsert(entry) {
+        this.entries.set(entry.configId, entry);
+      }
+      get(configId) {
+        return this.entries.get(configId);
+      }
+      find(configId, tunnelId) {
+        const byConfigId = this.entries.get(configId);
+        if (byConfigId) {
+          return byConfigId;
+        }
+        if (!tunnelId) {
+          return void 0;
+        }
+        for (const entry of this.entries.values()) {
+          if (entry.tunnelId === tunnelId) {
+            return entry;
+          }
+        }
+        return void 0;
+      }
+      delete(configId) {
+        this.entries.delete(configId);
+        if (this.latestConfigId === configId) {
+          this.latestConfigId = void 0;
+        }
+      }
+      get latest() {
+        return this.latestConfigId;
+      }
+      get hasLatest() {
+        return this.entries.size > 0 && this.latestConfigId !== void 0;
+      }
+      isLatest(configId) {
+        return configId === this.latestConfigId;
+      }
+      cleanupExpired(onTimeout) {
+        const now = Date.now();
+        for (const [configId, entry] of this.entries) {
+          if (now - entry.queuedAt <= PENDING_TIMEOUT_MS) {
+            continue;
+          }
+          const wasLatest = this.isLatest(configId);
+          this.delete(configId);
+          onTimeout(entry, wasLatest);
+        }
+      }
+    };
+    RemoteManagementWebSocketPrinter = class {
+      constructor() {
+        this.pendingStarts = new PendingTracker();
+        this.pendingActions = new PendingTracker();
+        // tunnelId -> details, fed by monitorList. Stop/restart requests only carry
+        // a tunnelId; without this the spinner shows the raw id.
+        this.tunnelDetailsCache = /* @__PURE__ */ new Map();
       }
       queueStart(config) {
         this.cleanupExpiredPendingStarts();
@@ -3119,24 +3247,23 @@ var init_websocket_printer = __esm({
           configName: this.getConfigNameFromRequest(config),
           queuedAt: Date.now()
         };
-        this.latestPendingConfigId = entry.configId;
-        this.pendingStarts.set(entry.configId, entry);
+        this.pendingStarts.queue(entry);
         printer_default.startSpinner("Starting tunnel with config name: " + entry.configName);
       }
       failQueuedStart(config, reason) {
         const configId = this.getConfigIdFromRequest(config);
         const pending = this.pendingStarts.get(configId);
         const configName = pending?.configName || this.getConfigNameFromRequest(config);
+        const wasLatest = this.pendingStarts.isLatest(configId);
         this.pendingStarts.delete(configId);
-        if (this.latestPendingConfigId === configId) {
-          this.latestPendingConfigId = void 0;
+        if (wasLatest) {
           printer_default.stopSpinnerFail(`Failed to start tunnel with config name: ${configName}. ${reason}`);
         }
       }
       handleStartResult(config, result) {
         this.cleanupExpiredPendingStarts();
         const requestedConfigId = this.getConfigIdFromRequest(config);
-        if (this.latestPendingConfigId && requestedConfigId !== this.latestPendingConfigId) {
+        if (this.pendingStarts.latest && !this.pendingStarts.isLatest(requestedConfigId)) {
           this.pendingStarts.delete(requestedConfigId);
           return;
         }
@@ -3144,20 +3271,20 @@ var init_websocket_printer = __esm({
           this.failQueuedStart(config, result.message);
           return;
         }
-        const configId = this.getConfigIdFromTunnel(result);
         const pending = this.pendingStarts.get(requestedConfigId) || {
           configId: requestedConfigId,
           configName: this.getConfigNameFromRequest(config),
           queuedAt: Date.now()
         };
         pending.tunnelId = result.tunnelid;
-        this.pendingStarts.set(requestedConfigId, pending);
+        this.pendingStarts.upsert(pending);
         if (result.remoteurls.length > 0) {
           this.completePendingStart(pending, result.remoteurls);
         }
       }
       printStopRequested(tunnelId) {
         const details = this.resolveTunnelDetails(tunnelId);
+        this.clearPendingAction(details.configId, tunnelId);
         printer_default.startSpinner("Stopping tunnel with config name: " + details.configName);
       }
       handleStopResult(tunnelId, result) {
@@ -3171,6 +3298,7 @@ var init_websocket_printer = __esm({
       }
       printRestartRequested(tunnelId) {
         const details = this.resolveTunnelDetails(tunnelId);
+        this.clearPendingAction(details.configId, tunnelId);
         printer_default.startSpinner("Restarting tunnel with config name: " + details.configName);
       }
       handleRestartResult(tunnelId, result) {
@@ -3180,48 +3308,101 @@ var init_websocket_printer = __esm({
           printer_default.stopSpinnerFail("Failed to restart tunnel with config name: " + details.configName);
           return;
         }
-        printer_default.stopSpinnerSuccess("Restarted tunnel with config name: " + details.configName);
-        if (result.remoteurls?.length > 0) {
-          printer_default.info(import_picocolors3.default.cyanBright("Remote URLs:"));
-          (result.remoteurls ?? []).forEach(
-            (url) => printer_default.print("  " + import_picocolors3.default.magentaBright(url))
-          );
+        this.queuePendingAction("restart", details.configId, details.configName, result.tunnelid);
+      }
+      printUpdateConfigRequested(config) {
+        const configName = this.getConfigNameFromRequest(config);
+        this.clearPendingAction(this.getConfigIdFromRequest(config));
+        printer_default.startSpinner("Updating tunnel configuration for: " + configName);
+      }
+      handleUpdateConfigResult(config, result) {
+        const configId = this.getConfigIdFromRequest(config);
+        const configName = this.getConfigNameFromRequest(config);
+        if (isErrorResponse(result)) {
+          printer_default.stopSpinnerFail(`Failed to update tunnel configuration for: ${configName}. ${result.message}`);
+          return;
+        }
+        if (result.status.state === "exited" /* Exited */) {
+          printer_default.stopSpinnerSuccess(`Tunnel configuration updated: ${configName}.`);
+          return;
+        }
+        this.queuePendingAction("update", configId, configName, result.tunnelid);
+      }
+      clearPendingAction(configId, tunnelId) {
+        const entry = this.pendingActions.find(configId, tunnelId);
+        if (!entry) {
+          return;
         }
+        this.pendingActions.delete(entry.configId);
+      }
+      queuePendingAction(action, configId, configName, tunnelId) {
+        this.cleanupExpiredPendingActions();
+        this.pendingActions.queue({ action, configId, configName, queuedAt: Date.now(), tunnelId });
+      }
+      printActionComplete(action, configName, urls) {
+        const message = action === "restart" ? `Restarted tunnel with config name: ${configName}` : `Tunnel configuration updated and restarted: ${configName}`;
+        printer_default.stopSpinnerSuccess(message);
+        printer_default.info(import_picocolors3.default.cyanBright("Remote URLs:"));
+        urls.forEach((url) => printer_default.print("  " + import_picocolors3.default.magentaBright(url)));
       }
       monitorList(result) {
         this.cleanupExpiredPendingStarts();
-        if (!Array.isArray(result) || this.pendingStarts.size === 0 || !this.latestPendingConfigId) {
+        this.cleanupExpiredPendingActions();
+        if (!Array.isArray(result)) {
           return;
         }
         for (const tunnel of result) {
-          const pending = this.findPendingStart(tunnel);
-          if (!pending) {
-            continue;
+          this.tunnelDetailsCache.set(tunnel.tunnelid, {
+            configId: this.getConfigIdFromTunnel(tunnel),
+            configName: this.getConfigNameFromTunnel(tunnel)
+          });
+        }
+        this.resolvePendingFromList(
+          result,
+          this.pendingStarts,
+          (entry, urls) => this.completePendingStart(entry, urls),
+          (entry, reason) => printer_default.stopSpinnerFail(`Tunnel start did not complete for config name: ${entry.configName}. ${reason}`)
+        );
+        this.resolvePendingFromList(
+          result,
+          this.pendingActions,
+          (entry, urls) => {
+            this.pendingActions.delete(entry.configId);
+            this.printActionComplete(entry.action, entry.configName, urls);
+          },
+          (entry, reason) => {
+            const verb = entry.action === "restart" ? "Restart" : "Configuration update";
+            printer_default.stopSpinnerFail(`${verb} did not complete for config name: ${entry.configName}. ${reason}`);
           }
-          if (pending.configId !== this.latestPendingConfigId) {
+        );
+      }
+      resolvePendingFromList(tunnels, tracker, onComplete, onExited) {
+        if (!tracker.hasLatest) {
+          return;
+        }
+        for (const tunnel of tunnels) {
+          const entry = tracker.find(this.getConfigIdFromTunnel(tunnel), tunnel.tunnelid);
+          if (!entry || !tracker.isLatest(entry.configId)) {
             continue;
           }
-          pending.tunnelId = tunnel.tunnelid;
-          this.pendingStarts.set(pending.configId, pending);
+          entry.tunnelId = tunnel.tunnelid;
+          tracker.upsert(entry);
           if (tunnel.remoteurls.length > 0) {
-            this.completePendingStart(pending, tunnel.remoteurls);
+            onComplete(entry, tunnel.remoteurls);
             continue;
           }
           if (tunnel.status.state === "exited" /* Exited */) {
-            const reason = tunnel.status.errormsg || "Tunnel exited before a public URL was assigned";
-            this.pendingStarts.delete(pending.configId);
-            this.latestPendingConfigId = void 0;
-            printer_default.stopSpinnerFail(`Tunnel start did not complete for config name: ${pending.configName}. ${reason}`);
+            tracker.delete(entry.configId);
+            onExited(entry, tunnel.status.errormsg || "Tunnel exited before a public URL was assigned");
           }
         }
       }
       completePendingStart(entry, urls) {
-        if (this.latestPendingConfigId && entry.configId !== this.latestPendingConfigId) {
+        if (this.pendingStarts.latest && !this.pendingStarts.isLatest(entry.configId)) {
           this.pendingStarts.delete(entry.configId);
           return;
         }
         this.pendingStarts.delete(entry.configId);
-        this.latestPendingConfigId = void 0;
         printer_default.stopSpinnerSuccess(`Tunnel started with config name: ${entry.configName}.`);
         printer_default.info(import_picocolors3.default.cyanBright("Remote URLs:"));
         (urls ?? []).forEach(
@@ -3229,28 +3410,27 @@ var init_websocket_printer = __esm({
         );
       }
       cleanupExpiredPendingStarts() {
-        const now = Date.now();
-        for (const [configId, entry] of this.pendingStarts.entries()) {
-          if (now - entry.queuedAt <= PENDING_START_TIMEOUT_MS) {
-            continue;
+        this.pendingStarts.cleanupExpired((entry, wasLatest) => {
+          const message = `Timed out while waiting for tunnel URL for config name: ${entry.configName}`;
+          if (wasLatest) {
+            printer_default.stopSpinnerFail(message);
+          } else {
+            printer_default.warn(message);
           }
-          this.pendingStarts.delete(configId);
-          printer_default.warn(`Timed out while waiting for tunnel URL for config name: ${entry.configName}`);
-          logger.warn("Pending websocket start entry expired", { configId, tunnelId: entry.tunnelId });
-        }
+          logger.warn("Pending websocket start entry expired", { configId: entry.configId, tunnelId: entry.tunnelId });
+        });
       }
-      findPendingStart(tunnel) {
-        const configId = this.getConfigIdFromTunnel(tunnel);
-        const byConfigId = this.pendingStarts.get(configId);
-        if (byConfigId) {
-          return byConfigId;
-        }
-        for (const entry of this.pendingStarts.values()) {
-          if (entry.tunnelId === tunnel.tunnelid) {
-            return entry;
+      cleanupExpiredPendingActions() {
+        this.pendingActions.cleanupExpired((entry, wasLatest) => {
+          const verb = entry.action === "restart" ? "restart" : "configuration update";
+          const message = `Timed out while waiting for tunnel URL after ${verb} for config name: ${entry.configName}`;
+          if (wasLatest) {
+            printer_default.stopSpinnerFail(message);
+          } else {
+            printer_default.warn(message);
           }
-        }
-        return void 0;
+          logger.warn("Pending websocket action entry expired", { configId: entry.configId, tunnelId: entry.tunnelId, action: entry.action });
+        });
       }
       resolveTunnelDetails(tunnelId, result) {
         if (result && !isErrorResponse(result)) {
@@ -3259,7 +3439,7 @@ var init_websocket_printer = __esm({
             configName: this.getConfigNameFromTunnel(result)
           };
         }
-        return {
+        return this.tunnelDetailsCache.get(tunnelId) ?? {
           configId: tunnelId,
           configName: tunnelId
         };
@@ -3338,7 +3518,6 @@ var init_websocket_handlers = __esm({
     WebSocketCommandHandler = class {
       constructor(handler) {
         this.tunnelHandler = handler ?? new TunnelOperations();
-        remoteManagementWebSocketPrinter.setTunnelHandler(this.tunnelHandler);
       }
       safeParse(text) {
         if (!text) return void 0;
@@ -3405,8 +3584,10 @@ var init_websocket_handlers = __esm({
         }
       }
       async handleStopReq(req, raw) {
+        let tunnelID;
         try {
           const dc = StopSchema.parse(raw);
+          tunnelID = dc.tunnelID;
           remoteManagementWebSocketPrinter.printStopRequested(dc.tunnelID);
           const result = await this.tunnelHandler.handleStop(dc.tunnelID);
           remoteManagementWebSocketPrinter.handleStopResult(dc.tunnelID, result);
@@ -3416,6 +3597,9 @@ var init_websocket_handlers = __esm({
             printer_default.warn("Validation failed for stop request");
             return NewErrorResponseObject({ code: ErrorCode.InvalidBodyFormatError, message: "Validation failed" });
           }
+          if (tunnelID) {
+            remoteManagementWebSocketPrinter.handleStopResult(tunnelID, newErrorResponse({ code: ErrorCode.InternalServerError, message: errorMessage(e) }));
+          }
           printer_default.warn(`Error in handleStopReq error: ${String(e)}`);
           return NewErrorResponseObject({ code: ErrorCode.InternalServerError, message: String(e) });
         }
@@ -3435,8 +3619,10 @@ var init_websocket_handlers = __esm({
         }
       }
       async handleRestartReq(req, raw) {
+        let tunnelID;
         try {
           const dc = RestartSchema.parse(raw);
+          tunnelID = dc.tunnelID;
           remoteManagementWebSocketPrinter.printRestartRequested(dc.tunnelID);
           const result = await this.tunnelHandler.handleRestart(dc.tunnelID, true);
           remoteManagementWebSocketPrinter.handleRestartResult(dc.tunnelID, result);
@@ -3446,34 +3632,51 @@ var init_websocket_handlers = __esm({
             printer_default.warn("Validation failed for restart request");
             return NewErrorResponseObject({ code: ErrorCode.InvalidBodyFormatError, message: "Validation failed" });
           }
+          if (tunnelID) {
+            remoteManagementWebSocketPrinter.handleRestartResult(tunnelID, newErrorResponse({ code: ErrorCode.InternalServerError, message: errorMessage(e) }));
+          }
           printer_default.warn(`Error in handleRestartReq error: ${String(e)}`);
           return NewErrorResponseObject({ code: ErrorCode.InternalServerError, message: String(e) });
         }
       }
       async handleUpdateConfigReq(req, raw) {
+        let parsedConfig;
         try {
           const dc = UpdateConfigSchema.parse(raw);
+          parsedConfig = dc.tunnelConfig;
+          remoteManagementWebSocketPrinter.printUpdateConfigRequested(dc.tunnelConfig);
           const result = await this.tunnelHandler.handleUpdateConfig(dc.tunnelConfig, true);
+          remoteManagementWebSocketPrinter.handleUpdateConfigResult(dc.tunnelConfig, result);
           return this.wrapResponse(result, req);
         } catch (e) {
           if (e instanceof import_zod2.default.ZodError) {
             printer_default.warn("Validation failed for updateconfig request");
             return NewErrorResponseObject({ code: ErrorCode.InvalidBodyFormatError, message: "Validation failed" });
           }
+          if (parsedConfig) {
+            remoteManagementWebSocketPrinter.handleUpdateConfigResult(parsedConfig, newErrorResponse({ code: ErrorCode.InternalServerError, message: errorMessage(e) }));
+          }
           printer_default.warn(`Error in handleUpdateConfigReq error: ${String(e)}`);
           return NewErrorResponseObject({ code: ErrorCode.InternalServerError, message: String(e) });
         }
       }
       async handleUpdateConfigV2Req(req, raw) {
+        let parsedConfig;
         try {
           const dc = UpdateConfigV2Schema.parse(raw);
+          parsedConfig = dc.tunnelConfig;
+          remoteManagementWebSocketPrinter.printUpdateConfigRequested(dc.tunnelConfig);
           const result = await this.tunnelHandler.handleUpdateConfigV2(dc.tunnelConfig, true);
+          remoteManagementWebSocketPrinter.handleUpdateConfigResult(dc.tunnelConfig, result);
           return this.wrapResponse(result, req);
         } catch (e) {
           if (e instanceof import_zod2.default.ZodError) {
             printer_default.warn("Validation failed for update-config-v2 request");
             return NewErrorResponseObject({ code: ErrorCode.InvalidBodyFormatError, message: "Validation failed" });
           }
+          if (parsedConfig) {
+            remoteManagementWebSocketPrinter.handleUpdateConfigResult(parsedConfig, newErrorResponse({ code: ErrorCode.InternalServerError, message: errorMessage(e) }));
+          }
           printer_default.warn(`Error in handleUpdateConfigV2Req error: ${String(e)}`);
           return NewErrorResponseObject({ code: ErrorCode.InternalServerError, message: String(e) });
         }
@@ -3908,10 +4111,20 @@ function parseExtendedOptions(options, config, localServerTls) {
           case "fullrequesturl":
             config.originalRequestUrl = true;
             break;
+          case "haproxy":
+          case "haproxy:v1":
+            config.haProxy = import_pinggy4.HaProxyVersion.V1;
+            break;
+          case "haproxy:v2":
+            config.haProxy = import_pinggy4.HaProxyVersion.V2;
+            break;
           default: {
             if (value && (value.startsWith("localServerTls") || value.startsWith("localservertls"))) {
               const parts = value.split(/:(.+)/);
               localServerTls = parts[1] ? parts[1] : "";
+            } else if (value && value.startsWith("haproxy:")) {
+              printer_default.warn(`Invalid HAProxy version in "${opt}". Use x:haproxy, x:haproxy:v1 or x:haproxy:v2`);
+              logger.warn(`Warning: Invalid HAProxy version in "${opt}". Use x:haproxy, x:haproxy:v1 or x:haproxy:v2`);
             } else {
               printer_default.warn(`Unknown extended option "${value}"`);
               logger.warn(`Warning: Unknown extended option "${value}"`);
@@ -4013,11 +4226,12 @@ function isValidIpV6Cidr(input) {
   }
   return false;
 }
-var import_net;
+var import_pinggy4, import_net;
 var init_extendedOptions = __esm({
   "src/cli/extendedOptions.ts"() {
     "use strict";
     init_cjs_shims();
+    import_pinggy4 = require("@pinggy/pinggy");
     import_net = require("net");
     init_logger();
     init_printer();
@@ -4054,7 +4268,7 @@ function parseUserAndDomain(str) {
     const [user, domain] = str.split("@", 2);
     if (isValidServerAddress(domain)) {
       let processKeyword2 = function(keyword) {
-        if ([import_pinggy4.TunnelType.Http, import_pinggy4.TunnelType.Tcp, import_pinggy4.TunnelType.Tls, import_pinggy4.TunnelType.Udp, import_pinggy4.TunnelType.TlsTcp].includes(keyword)) {
+        if ([import_pinggy5.TunnelType.Http, import_pinggy5.TunnelType.Tcp, import_pinggy5.TunnelType.Tls, import_pinggy5.TunnelType.Udp, import_pinggy5.TunnelType.TlsTcp].includes(keyword)) {
           type = keyword;
         } else if (keyword === "force") {
           forceFlag = true;
@@ -4142,7 +4356,7 @@ function parseUsers(positionalArgs, explicitToken) {
 }
 function parseType(finalConfig, values, inferredType) {
   const t = inferredType || values.type;
-  if (t === import_pinggy4.TunnelType.Http || t === import_pinggy4.TunnelType.Tcp || t === import_pinggy4.TunnelType.Tls || t === import_pinggy4.TunnelType.Udp || t === import_pinggy4.TunnelType.TlsTcp) {
+  if (t === import_pinggy5.TunnelType.Http || t === import_pinggy5.TunnelType.Tcp || t === import_pinggy5.TunnelType.Tls || t === import_pinggy5.TunnelType.Udp || t === import_pinggy5.TunnelType.TlsTcp) {
     return t;
   }
 }
@@ -4240,7 +4454,7 @@ function parseAdditionalForwarding(forwarding) {
   }
   const firstPart = parsed[0];
   const [hostPart] = firstPart.split("@");
-  let protocol = import_pinggy4.TunnelType.Http;
+  let protocol = import_pinggy5.TunnelType.Http;
   let remoteDomainRaw;
   let remotePort = 0;
   if (hostPart.includes("//")) {
@@ -4273,7 +4487,7 @@ function parseAdditionalForwarding(forwarding) {
     if (!isValidServerAddress(remoteDomainRaw)) {
       return new Error("invalid remote domain");
     }
-    protocol = import_pinggy4.TunnelType.Http;
+    protocol = import_pinggy5.TunnelType.Http;
     remotePort = 0;
   }
   const localDomain = removeIPv6Brackets(parsed[2] || "localhost");
@@ -4303,7 +4517,7 @@ function parseReverseTunnelAddr(finalConfig, values, primaryType) {
       if (parsed instanceof Error) return parsed;
       forwardingData.push({
         address: `${parsed.localDomain}:${parsed.localPort}`,
-        type: primaryType || import_pinggy4.TunnelType.Http
+        type: primaryType || import_pinggy5.TunnelType.Http
       });
     } else if (slicedForwarding.length === 4) {
       const parsed = parseAdditionalForwarding(forwarding);
@@ -4369,7 +4583,7 @@ function normalizeForwardingToArray(finalConfig, type) {
   if (typeof fwd !== "string") {
     return;
   }
-  finalConfig.forwarding = fwd.trim() === "" ? [] : [{ type: type || import_pinggy4.TunnelType.Http, address: fwd.trim() }];
+  finalConfig.forwarding = fwd.trim() === "" ? [] : [{ type: type || import_pinggy5.TunnelType.Http, address: fwd.trim() }];
 }
 function parseArgs2(finalConfig, remainingPositionals) {
   let localserverTls = "";
@@ -4496,7 +4710,7 @@ function buildFinalConfig(values, positionals, baseConfig) {
   storeJson(finalConfig, saveconf);
   return finalConfig;
 }
-var import_pinggy4, import_fs6, import_path6, import_net2, domainRegex, KEYWORDS, VALID_PROTOCOLS;
+var import_pinggy5, import_fs6, import_path6, import_net2, domainRegex, KEYWORDS, VALID_PROTOCOLS;
 var init_buildConfig = __esm({
   "src/cli/buildConfig.ts"() {
     "use strict";
@@ -4505,21 +4719,21 @@ var init_buildConfig = __esm({
     init_extendedOptions();
     init_logger();
     init_util();
-    import_pinggy4 = require("@pinggy/pinggy");
+    import_pinggy5 = require("@pinggy/pinggy");
     import_fs6 = __toESM(require("fs"), 1);
     import_path6 = __toESM(require("path"), 1);
     import_net2 = require("net");
     domainRegex = /^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/;
     KEYWORDS = /* @__PURE__ */ new Set([
-      import_pinggy4.TunnelType.Http,
-      import_pinggy4.TunnelType.Tcp,
-      import_pinggy4.TunnelType.Tls,
-      import_pinggy4.TunnelType.Udp,
-      import_pinggy4.TunnelType.TlsTcp,
+      import_pinggy5.TunnelType.Http,
+      import_pinggy5.TunnelType.Tcp,
+      import_pinggy5.TunnelType.Tls,
+      import_pinggy5.TunnelType.Udp,
+      import_pinggy5.TunnelType.TlsTcp,
       "force",
       "qr"
     ]);
-    VALID_PROTOCOLS = [import_pinggy4.TunnelType.Http, import_pinggy4.TunnelType.Tcp, import_pinggy4.TunnelType.Udp, import_pinggy4.TunnelType.Tls, import_pinggy4.TunnelType.TlsTcp];
+    VALID_PROTOCOLS = [import_pinggy5.TunnelType.Http, import_pinggy5.TunnelType.Tcp, import_pinggy5.TunnelType.Udp, import_pinggy5.TunnelType.Tls, import_pinggy5.TunnelType.TlsTcp];
   }
 });
 
@@ -5103,7 +5317,7 @@ var init_webDebuggerConnection = __esm({
 });
 
 // src/tui/ink/asciArt.ts
-var asciiArtPinggyLogo;
+var asciiArtPinggyLogo, asciiArtPinggyLogoCompact, asciiArtPinggyLogoMedium;
 var init_asciArt = __esm({
   "src/tui/ink/asciArt.ts"() {
     "use strict";
@@ -5115,6 +5329,13 @@ var init_asciArt = __esm({
 \u2588\u2588\u2554\u2550\u2550\u2550\u255D \u2588\u2588\u2551\u2588\u2588\u2551\u255A\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551 \u255A\u2588\u2588\u2554\u255D  
 \u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D  \u2588\u2588\u2551   
 \u255A\u2550\u255D     \u255A\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D  \u255A\u2550\u2550\u2550\u2550\u2550\u255D   \u255A\u2550\u255D   `;
+    asciiArtPinggyLogoCompact = "P I N G G Y";
+    asciiArtPinggyLogoMedium = [
+      " ___ ___ _  _  ___  _____   __",
+      "| _ \\_ _| \\| |/ __|/ __\\ \\ / /",
+      "|  _/| || .` | (_ | (_ |\\ V /",
+      "|_| |___|_|\\_|\\___|\\___| |_|"
+    ].join("\n");
   }
 });
 
@@ -5127,6 +5348,54 @@ function colorizeGradient(text) {
     return `{${color}-fg}${line}{/${color}-fg}`;
   }).join("\n");
 }
+function colorizeGradientHorizontal(text) {
+  const colors = ["red", "yellow", "green", "cyan", "blue", "magenta"];
+  let colorIndex = 0;
+  return [...text].map((char) => {
+    if (char === " ") return char;
+    const color = colors[colorIndex % colors.length];
+    colorIndex++;
+    return `{${color}-fg}${char}{/${color}-fg}`;
+  }).join("");
+}
+function selectLogo(width, height) {
+  const widthTier = width >= FULL_LOGO_THRESHOLD ? 2 : width >= MEDIUM_LOGO_THRESHOLD ? 1 : 0;
+  const heightTier = height >= FULL_LOGO_HEIGHT_THRESHOLD ? 2 : height >= MEDIUM_LOGO_HEIGHT_THRESHOLD ? 1 : 0;
+  const tier = Math.min(widthTier, heightTier);
+  if (tier === 2) {
+    return { content: colorizeGradient(asciiArtPinggyLogo), boxHeight: 7 };
+  }
+  if (tier === 1) {
+    return { content: colorizeGradient(asciiArtPinggyLogoMedium), boxHeight: 5 };
+  }
+  return {
+    content: `{bold}${colorizeGradientHorizontal(asciiArtPinggyLogoCompact)}{/bold}`,
+    boxHeight: 1
+  };
+}
+function wrapText(text, width) {
+  const lines = [];
+  let current = "";
+  for (const word of text.split(/\s+/).filter(Boolean)) {
+    const candidate = current ? `${current} ${word}` : word;
+    if (candidate.length <= width) {
+      current = candidate;
+      continue;
+    }
+    if (current) {
+      lines.push(current);
+      current = "";
+    }
+    let rest = word;
+    while (rest.length > width) {
+      lines.push(rest.slice(0, width));
+      rest = rest.slice(width);
+    }
+    current = rest;
+  }
+  if (current) lines.push(current);
+  return lines.length ? lines : [""];
+}
 function createWarningUI(screen) {
   return import_blessed.default.box({
     parent: screen,
@@ -5153,21 +5422,26 @@ function createFullUI(screen, urls, greet, tunnelConfig) {
     height: "100%",
     padding: 1
   });
+  const { content: logoContent, boxHeight: logoHeight } = selectLogo(
+    screen.width,
+    screen.height
+  );
   const logoBox = import_blessed.default.box({
     parent: mainContainer,
     top: 0,
     left: 0,
     width: "100%",
-    height: 7,
-    content: colorizeGradient(asciiArtPinggyLogo),
+    height: logoHeight,
+    content: logoContent,
     tags: true
   });
+  const contentTop = logoHeight + 1;
   const contentBox = import_blessed.default.box({
     parent: mainContainer,
-    top: 8,
+    top: contentTop,
     left: 0,
     width: "100%-2",
-    height: "100%-10",
+    height: `100%-${contentTop + 2}`,
     padding: 0,
     border: {
       type: "line"
@@ -5180,20 +5454,24 @@ function createFullUI(screen, urls, greet, tunnelConfig) {
   });
   let greetHeight = 0;
   if (greet) {
-    const greetBox = import_blessed.default.box({
+    const contentInnerWidth = screen.width - 6;
+    const greetWidth = Math.max(20, Math.floor(contentInnerWidth * 0.6));
+    const greetLines = wrapText(greet, greetWidth);
+    const greetBoxHeight = greetLines.length + 1;
+    import_blessed.default.box({
       parent: contentBox,
       top: 0,
       left: "center",
-      width: "60%",
-      height: 4,
-      content: `{bold}${greet}{/bold}`,
+      width: greetWidth,
+      height: greetBoxHeight,
+      content: greetLines.map((line) => `{bold}${line}{/bold}`).join("\n"),
       tags: true,
       align: "center",
       style: {
         fg: "green"
       }
     });
-    greetHeight = 4;
+    greetHeight = greetBoxHeight;
   }
   const upperSectionTop = greetHeight > 0 ? greetHeight : 0;
   const upperSection = import_blessed.default.box({
@@ -5287,21 +5565,22 @@ function createSimpleUI(screen, urls, greet) {
   });
   let currentTop = 0;
   if (greet) {
+    const greetWidth = Math.max(20, Math.floor((screen.width - 2) * 0.9));
+    const greetLines = wrapText(greet, greetWidth);
     import_blessed.default.box({
       parent: mainContainer,
       top: currentTop,
       left: "center",
-      width: "90%",
-      height: "shrink",
-      content: `{bold}${greet}{/bold}`,
+      width: greetWidth,
+      height: greetLines.length,
+      content: greetLines.map((line) => `{bold}${line}{/bold}`).join("\n"),
       tags: true,
       align: "center",
       style: {
         fg: "green"
       }
     });
-    const lines = Math.ceil(greet.length / (screen.width * 0.9));
-    currentTop += Math.max(lines, 1) + 1;
+    currentTop += greetLines.length + 1;
   }
   const urlsBox = import_blessed.default.box({
     parent: mainContainer,
@@ -5340,7 +5619,7 @@ function createSimpleUI(screen, urls, greet) {
     footerBox
   };
 }
-var import_blessed, MIN_WIDTH_WARNING, SIMPLE_LAYOUT_THRESHOLD;
+var import_blessed, MIN_WIDTH_WARNING, SIMPLE_LAYOUT_THRESHOLD, MEDIUM_LOGO_THRESHOLD, FULL_LOGO_THRESHOLD, MEDIUM_LOGO_HEIGHT_THRESHOLD, FULL_LOGO_HEIGHT_THRESHOLD;
 var init_UIComponents = __esm({
   "src/tui/blessed/components/UIComponents.ts"() {
     "use strict";
@@ -5349,6 +5628,10 @@ var init_UIComponents = __esm({
     init_asciArt();
     MIN_WIDTH_WARNING = 60;
     SIMPLE_LAYOUT_THRESHOLD = 80;
+    MEDIUM_LOGO_THRESHOLD = 100;
+    FULL_LOGO_THRESHOLD = 120;
+    MEDIUM_LOGO_HEIGHT_THRESHOLD = 26;
+    FULL_LOGO_HEIGHT_THRESHOLD = 34;
   }
 });
 
@@ -7243,6 +7526,8 @@ async function handleDaemonStop() {
   const result = await stopDaemon();
   if (result.ok) {
     printer_default.success("Daemon stopped.");
+  } else if (result.reason === DaemonHost.APP) {
+    printer_default.print(import_picocolors6.default.yellow("The Pinggy daemon is running inside the Pinggy desktop app. Please quit the Pinggy app to stop it."));
   } else {
     printer_default.error(result.error);
   }
@@ -7263,6 +7548,7 @@ function handleDaemonStatus() {
   printer_default.print(`  Port:      ${info.port}`);
   printer_default.print(`  Started:   ${info.startedAt}`);
   printer_default.print(`  Uptime:    ${uptimeStr}`);
+  printer_default.print(`  Host:      ${info.host === DaemonHost.APP ? "Pinggy app (in-process)" : "standalone (CLI)"}`);
 }
 var import_picocolors6;
 var init_daemonCommandsHandler = __esm({
@@ -7273,6 +7559,7 @@ var init_daemonCommandsHandler = __esm({
     import_picocolors6 = __toESM(require("picocolors"), 1);
     init_configStore();
     init_daemonManager();
+    init_ipcRoutes();
     init_serviceInstaller();
     init_helpMessages();
     init_util();
@@ -8007,6 +8294,7 @@ var init_subcommands = __esm({
 // src/main.ts
 var main_exports = {};
 __export(main_exports, {
+  DaemonHost: () => DaemonHost,
   RemoteManagementUnauthorizedError: () => RemoteManagementUnauthorizedError,
   TunnelManager: () => TunnelManager,
   TunnelOperations: () => TunnelOperations,
@@ -8069,6 +8357,7 @@ var init_main = __esm({
     init_buildAndStartTunnel();
     init_subcommands();
     init_daemonChild();
+    init_ipcRoutes();
     init_daemonManager();
     currentFile = (0, import_url2.fileURLToPath)(importMetaUrl);
     entryFile = null;
@@ -8308,7 +8597,7 @@ var init_ipcServer = __esm({
           },
           [Route.RestartTunnel]: async (req) => {
             if (!req.tunnelid) throw new Error("Missing 'tunnelid' field");
-            return await this.ops.handleRestart(req.tunnelid);
+            return await this.ops.handleRestart(req.tunnelid, req.noWait);
           },
           [Route.UpdateConfig]: async (req) => {
             if (!req.config) throw new Error("Missing 'config' field");
@@ -8375,6 +8664,10 @@ var init_ipcServer = __esm({
           },
           [Route.Shutdown]: () => {
             logger.info("Daemon shutdown requested via IPC");
+            if (getDaemonHost() === DaemonHost.APP) {
+              logger.info("Shutdown refused: daemon is hosted in-process by the Pinggy app");
+              return { status: ShutdownStatus.RefusedInApp, errors: [] };
+            }
             const errors = [];
             const step = (label, fn) => {
               try {
@@ -8389,7 +8682,7 @@ var init_ipcServer = __esm({
             step("clearDaemonState", clearDaemonState);
             step("stopAllTunnels", () => TunnelManager.getInstance().stopAllTunnels());
             setTimeout(() => process.exit(0), 200);
-            return { status: "shutting_down", errors };
+            return { status: ShutdownStatus.ShuttingDown, errors };
           }
         };
       }
@@ -8847,6 +9140,8 @@ var init_sessionTracker = __esm({
 // src/daemon/lifecycle/daemonChild.ts
 var daemonChild_exports = {};
 __export(daemonChild_exports, {
+  DaemonHost: () => DaemonHost,
+  getDaemonHost: () => getDaemonHost,
   removeDaemonInfo: () => removeDaemonInfo,
   runDaemonChild: () => runDaemonChild,
   setDaemonSessionTracker: () => setDaemonSessionTracker,
@@ -8854,6 +9149,9 @@ __export(daemonChild_exports, {
   trackTunnelStart: () => trackTunnelStart,
   trackTunnelStop: () => trackTunnelStop
 });
+function getDaemonHost() {
+  return daemonHost;
+}
 function setDaemonSessionTracker(st) {
   sessionTrackerRef = st;
 }
@@ -8982,6 +9280,7 @@ async function restoreCrashedTunnels(manager) {
 async function runDaemonChild(opts = {}) {
   const installSignalHandlers = opts.installSignalHandlers ?? true;
   const exitOnFailure = opts.exitOnFailure ?? true;
+  daemonHost = opts.host ?? DaemonHost.CLI;
   ensurePinggyConfigDir();
   const persistedLevel = readDaemonConfig()?.logLevel;
   const envLevel = process.env.PINGGY_LOG_LEVEL;
@@ -9057,7 +9356,8 @@ async function runDaemonChild(opts = {}) {
     const info = {
       pid: process.pid,
       port,
-      startedAt: (/* @__PURE__ */ new Date()).toISOString()
+      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      host: daemonHost
     };
     writeDaemonInfo(info);
     logger.info("Daemon info written", info);
@@ -9090,7 +9390,7 @@ async function runDaemonChild(opts = {}) {
     throw err;
   }
 }
-var import_node_fs7, daemonState, sessionTrackerRef;
+var import_node_fs7, daemonState, daemonHost, sessionTrackerRef;
 var init_daemonChild = __esm({
   "src/daemon/lifecycle/daemonChild.ts"() {
     "use strict";
@@ -9108,6 +9408,7 @@ var init_daemonChild = __esm({
     init_util();
     init_ipcRoutes();
     daemonState = { tunnels: [], lastUpdated: "" };
+    daemonHost = DaemonHost.CLI;
     sessionTrackerRef = null;
   }
 });
@@ -9194,13 +9495,15 @@ async function ensureDaemonRunning() {
     const { runDaemonChild: runDaemonChild2 } = await Promise.resolve().then(() => (init_daemonChild(), daemonChild_exports));
     const handle = await runDaemonChild2({
       installSignalHandlers: false,
-      exitOnFailure: false
+      exitOnFailure: false,
+      host: DaemonHost.APP
     });
     inProcessHandle = handle;
     return getDaemonInfo() ?? {
       pid: handle.pid,
       port: handle.port,
-      startedAt: (/* @__PURE__ */ new Date()).toISOString()
+      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      host: DaemonHost.APP
     };
   }
   return startDaemon();
@@ -9262,6 +9565,13 @@ async function stopDaemon() {
     const client = new IPCClient2(info.port);
     const result = await client.shutdown();
     logger.debug("Sent shutdown command to daemon", { result });
+    if (result?.status === ShutdownStatus.RefusedInApp) {
+      return {
+        ok: false,
+        reason: DaemonHost.APP,
+        error: "The daemon is running inside the Pinggy app."
+      };
+    }
     if (Array.isArray(result?.errors)) daemonErrors = result.errors;
   } catch (e) {
     return { ok: false, error: `Failed to reach daemon: ${errorMessage(e)}` };
@@ -9293,6 +9603,7 @@ var init_daemonManager = __esm({
     import_node_fs8 = __toESM(require("fs"), 1);
     import_node_child_process2 = require("child_process");
     init_configDir();
+    init_ipcRoutes();
     init_logger();
     init_types();
     init_util();
@@ -9583,6 +9894,13 @@ var init_daemonHealth = __esm({
       bindPid(pid) {
         this.originalPid = pid;
       }
+      /**
+       * Forget a previous loss verdict. Called when the client re-binds to a
+       * live daemon via ensureDaemon():
+       */
+      reset() {
+        this.lost = false;
+      }
       isLost() {
         return this.lost;
       }
@@ -9709,6 +10027,7 @@ var init_tunnelClient = __esm({
         const info = await ensureDaemonRunning();
         this.ipc = new IPCClient(info.port, this.origin);
         this.health.bindPid(info.pid);
+        this.health.reset();
       }
       static async forRemoteManagement() {
         const client = new _TunnelClient({ origin: "remote" });
@@ -9773,15 +10092,30 @@ var init_tunnelClient = __esm({
         this.assertClient();
         return this.ipc.getTunnel(tunnelId);
       }
-      async handleRestart(tunnelId) {
+      async handleRestart(tunnelId, noWait) {
         this.assertClient();
-        return this.ipc.restartTunnel(tunnelId);
+        return this.ipc.restartTunnel(tunnelId, noWait);
       }
       async shutdown() {
         this.assertClient();
         await this.ipc.shutdown();
         this.close();
       }
+      /**
+       * Tear down the daemon hosted in THIS process, if any. Stops all tunnels
+       * and removes daemon.json + daemon-state.json so the next CLI run doesn't
+       * "crash-recover" tunnels that died with the host application. 
+       */
+      shutdownInProcessDaemon() {
+        const handle = getInProcessDaemonHandle();
+        if (!handle) return false;
+        try {
+          this.close();
+        } catch {
+        }
+        handle.shutdown();
+        return true;
+      }
       async getLogLevel() {
         this.assertClient();
         const res = await this.ipc.getLogLevel();
@@ -9914,11 +10248,13 @@ __export(index_exports, {
   findConfig: () => findConfig,
   findConfigByName: () => findConfigByName,
   getAutoStartConfigs: () => getAutoStartConfigs,
+  getDaemonInfo: () => getDaemonInfo,
   getDaemonInfoPath: () => getDaemonInfoPath,
   getPinggyConfigDir: () => getPinggyConfigDir,
   getRemoteManagementState: () => getRemoteManagementState,
   getTunnelConfigDir: () => getTunnelConfigDir,
   initiateRemoteManagement: () => initiateRemoteManagement,
+  isDaemonRunning: () => isDaemonRunning,
   listSavedConfigs: () => listSavedConfigs,
   loadConfigByName: () => loadConfigByName,
   sanitizeName: () => sanitizeName,
@@ -10019,6 +10355,7 @@ init_printer();
 init_TunnelManager();
 init_handler();
 init_tunnelClient();
+init_daemonManager();
 init_logger();
 init_remoteManagement();
 init_types();
@@ -10061,11 +10398,13 @@ verifyAndLoad().catch((err) => {
   findConfig,
   findConfigByName,
   getAutoStartConfigs,
+  getDaemonInfo,
   getDaemonInfoPath,
   getPinggyConfigDir,
   getRemoteManagementState,
   getTunnelConfigDir,
   initiateRemoteManagement,
+  isDaemonRunning,
   listSavedConfigs,
   loadConfigByName,
   sanitizeName,