pinggy 0.6.0 → 0.6.3

package/dist/index.cjs

@@ -236,6 +236,9 @@ function getTunnelLogPath(tunnelId, origin, name) {
 function getDaemonLogPath() {
   return import_path2.default.join(getPinggyLogDir(), "daemon.log");
 }
+function getDeviceConfigPath() {
+  return import_path2.default.join(getPinggyConfigDir(), "device.json");
+}
 function ensurePinggyConfigDir() {
   const dir = getPinggyConfigDir();
   import_fs2.default.mkdirSync(dir, { recursive: true });
@@ -521,6 +524,121 @@ var init_rotateLog = __esm({
   }
 });
 
+// src/types.ts
+function isErrorResponse(obj) {
+  return typeof obj === "object" && obj !== null && "code" in obj && "message" in obj && typeof obj.message === "string" && Object.values(ErrorCode).includes(obj.code);
+}
+function newErrorResponse(codeOrError, message) {
+  if (typeof codeOrError === "object") {
+    return codeOrError;
+  }
+  return {
+    code: codeOrError,
+    message
+  };
+}
+function NewResponseObject(data) {
+  const encoder = new TextEncoder();
+  const bytes = encoder.encode(JSON.stringify(data));
+  return {
+    response: bytes,
+    requestid: "",
+    command: "",
+    error: false,
+    errorresponse: {}
+  };
+}
+function NewErrorResponseObject(errorResponse) {
+  return {
+    response: new Uint8Array(),
+    requestid: "",
+    command: "",
+    error: true,
+    errorresponse: errorResponse
+  };
+}
+function newStatus(tunnelState, errorCode, errorMsg) {
+  let assignedState = tunnelState;
+  if (tunnelState === "live" /* Live */) {
+    assignedState = "running" /* Running */;
+  } else if (tunnelState === "idle" /* New */) {
+    assignedState = "idle" /* New */;
+  } else if (tunnelState === "closed" /* Closed */) {
+    assignedState = "exited" /* Exited */;
+  }
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  return {
+    state: assignedState,
+    errorcode: errorCode,
+    errormsg: errorMsg,
+    createdtimestamp: now,
+    starttimestamp: now,
+    endtimestamp: now,
+    warnings: []
+  };
+}
+function newStats() {
+  return {
+    numLiveConnections: 0,
+    numTotalConnections: 0,
+    numTotalReqBytes: 0,
+    numTotalResBytes: 0,
+    numTotalTxBytes: 0,
+    elapsedTime: 0
+  };
+}
+var TunnelStateType, TunnelErrorCodeType, TunnelWarningCode, ErrorCode, RemoteManagementStatus;
+var init_types = __esm({
+  "src/types.ts"() {
+    "use strict";
+    init_cjs_shims();
+    TunnelStateType = /* @__PURE__ */ ((TunnelStateType2) => {
+      TunnelStateType2["New"] = "idle";
+      TunnelStateType2["Starting"] = "starting";
+      TunnelStateType2["Running"] = "running";
+      TunnelStateType2["Live"] = "live";
+      TunnelStateType2["Closed"] = "closed";
+      TunnelStateType2["Exited"] = "exited";
+      return TunnelStateType2;
+    })(TunnelStateType || {});
+    TunnelErrorCodeType = /* @__PURE__ */ ((TunnelErrorCodeType2) => {
+      TunnelErrorCodeType2["NonResponsive"] = "non_responsive";
+      TunnelErrorCodeType2["FailedToConnect"] = "failed_to_connect";
+      TunnelErrorCodeType2["ErrorInAdditionalForwarding"] = "additional_forwarding_error";
+      TunnelErrorCodeType2["WebdebuggerError"] = "webdebugger_error";
+      TunnelErrorCodeType2["NoError"] = "";
+      return TunnelErrorCodeType2;
+    })(TunnelErrorCodeType || {});
+    TunnelWarningCode = /* @__PURE__ */ ((TunnelWarningCode3) => {
+      TunnelWarningCode3["InvalidTunnelServePath"] = "INVALID_TUNNEL_SERVE_PATH";
+      TunnelWarningCode3["UnknownWarning"] = "UNKNOWN_WARNING";
+      return TunnelWarningCode3;
+    })(TunnelWarningCode || {});
+    ErrorCode = {
+      InvalidRequestMethodError: "INVALID_REQUEST_METHOD",
+      InvalidRequestBodyError: "COULD_NOT_READ_BODY",
+      InternalServerError: "INTERNAL_SERVER_ERROR",
+      InvalidBodyFormatError: "INVALID_DATA_FORMAT",
+      ErrorStartingTunnel: "ERROR_STARTING_TUNNEL",
+      TunnelNotFound: "TUNNEL_WITH_ID_OR_CONFIG_ID_NOT_FOUND",
+      TunnelAlreadyRunningError: "TUNNEL_WITH_ID_OR_CONFIG_ID_ALREADY_RUNNING",
+      WebsocketUpgradeFailError: "WEBSOCKET_UPGRADE_FAILED",
+      RemoteManagementAlreadyRunning: "REMOTE_MANAGEMENT_ALREADY_RUNNING",
+      RemoteManagementNotRunning: "REMOTE_MANAGEMENT_NOT_RUNNING",
+      RemoteManagementDeserializationFailed: "REMOTE_MANAGEMENT_DESERIALIZATION_FAILED",
+      DeviceNotEnrolled: "DEVICE_NOT_ENROLLED"
+    };
+    RemoteManagementStatus = {
+      Connecting: "CONNECTING",
+      Disconnecting: "DISCONNECTING",
+      Reconnecting: "RECONNECTING",
+      Running: "RUNNING",
+      NotRunning: "NOT_RUNNING",
+      Error: "ERROR"
+    };
+  }
+});
+
 // src/utils/util.ts
 function getRandomId() {
   return (0, import_crypto.randomUUID)();
@@ -587,14 +705,15 @@ var init_fileServerMessages = __esm({
 var TunnelManager_exports = {};
 __export(TunnelManager_exports, {
   TunnelAlreadyRunningError: () => TunnelAlreadyRunningError,
-  TunnelManager: () => TunnelManager
+  TunnelManager: () => TunnelManager,
+  TunnelRebuildInProgressError: () => TunnelRebuildInProgressError
 });
 function mapToSdkLogLevel(level) {
   if (level === "debug") return import_pinggy2.LogLevel.DEBUG;
   if (level === "error") return import_pinggy2.LogLevel.ERROR;
   return import_pinggy2.LogLevel.INFO;
 }
-var import_pinggy2, import_node_path, import_node_worker_threads, import_node_url, __filename3, __dirname2, STATS_HISTORY_LIMIT, TunnelAlreadyRunningError, TunnelManager;
+var import_pinggy2, import_node_path, import_node_worker_threads, import_node_url, __filename3, __dirname2, START_FAILED_MESSAGE, STATS_HISTORY_LIMIT, TunnelAlreadyRunningError, TunnelRebuildInProgressError, TunnelManager;
 var init_TunnelManager = __esm({
   "src/tunnel_manager/TunnelManager.ts"() {
     "use strict";
@@ -603,6 +722,7 @@ var init_TunnelManager = __esm({
     init_logger();
     init_tunnelLogger();
     init_rotateLog();
+    init_types();
     import_node_path = __toESM(require("path"), 1);
     import_node_worker_threads = require("worker_threads");
     import_node_url = require("url");
@@ -612,6 +732,7 @@ var init_TunnelManager = __esm({
     init_fileServerMessages();
     __filename3 = (0, import_node_url.fileURLToPath)(importMetaUrl);
     __dirname2 = import_node_path.default.dirname(__filename3);
+    START_FAILED_MESSAGE = "Failed to start tunnel";
     STATS_HISTORY_LIMIT = 100;
     TunnelAlreadyRunningError = class extends Error {
       constructor(configId, existingTunnelId) {
@@ -621,6 +742,13 @@ var init_TunnelManager = __esm({
         this.name = "TunnelAlreadyRunningError";
       }
     };
+    TunnelRebuildInProgressError = class extends Error {
+      constructor(tunnelId) {
+        super(`Tunnel "${tunnelId}" is already restarting`);
+        this.tunnelId = tunnelId;
+        this.name = "TunnelRebuildInProgressError";
+      }
+    };
     TunnelManager = class _TunnelManager {
       constructor() {
         this.tunnelsByTunnelId = /* @__PURE__ */ new Map();
@@ -665,7 +793,7 @@ var init_TunnelManager = __esm({
           throw new Error("configId is required and must be a non-empty string");
         }
         const existing = this.tunnelsByConfigId.get(configId);
-        if (existing && !existing.isStopped) {
+        if (existing && (!existing.isStopped || existing.rebuild)) {
           throw new TunnelAlreadyRunningError(configId, existing.tunnelid);
         }
         return this._createTunnelWithProcessedConfig({
@@ -687,14 +815,15 @@ var init_TunnelManager = __esm({
        * @private
        */
       async _createTunnelWithProcessedConfig(params) {
-        const tunnelLogName = params.tunnelName || params.originalConfig?.name;
+        const tunnelConfig = { ...params.originalConfig, maxReconnectAttempts: 0 };
+        const tunnelLogName = params.tunnelName || tunnelConfig?.name;
         const tunnelLogPath = getTunnelLogPath(params.tunnelid, params.origin, tunnelLogName);
         maybeRotate(tunnelLogPath);
         attachTunnelLogger(params.tunnelid, params.origin, tunnelLogName);
         let instance;
         try {
-          logger.debug("Creating tunnel instance with processed config", params.originalConfig);
-          instance = await import_pinggy2.TunnelInstance.create(params.originalConfig, {
+          logger.debug("Creating tunnel instance with processed config", tunnelConfig);
+          instance = await import_pinggy2.TunnelInstance.create(tunnelConfig, {
             enabled: true,
             logLevel: mapToSdkLogLevel(getLogLevel()),
             logFilePath: tunnelLogPath,
@@ -712,7 +841,7 @@ var init_TunnelManager = __esm({
           tunnelName: params.tunnelName,
           origin: params.origin,
           instance,
-          tunnelConfig: params.originalConfig,
+          tunnelConfig,
           serve: params.serve,
           warnings: [],
           isStopped: false,
@@ -752,11 +881,12 @@ var init_TunnelManager = __esm({
         try {
           urls = await managed.instance.start();
         } catch (error) {
-          logger.warn("Failed to start tunnel", { tunnelId, error });
+          const reason = errorMessage(error) || START_FAILED_MESSAGE;
+          logger.warn("Failed to start tunnel", { tunnelId, error: reason });
           managed.isStopped = true;
           managed.stoppedAt = (/* @__PURE__ */ new Date()).toISOString();
           managed.lastError = {
-            message: "Failed to start tunnel",
+            message: reason,
             timestamp: (/* @__PURE__ */ new Date()).toISOString(),
             isFatal: true
           };
@@ -927,6 +1057,9 @@ var init_TunnelManager = __esm({
           logger.error(`Tunnel "${tunnelId}" not found when fetching status`);
           throw new Error(`Tunnel "${tunnelId}" not found`);
         }
+        if (managed.rebuild?.startsAfter) {
+          return "starting" /* Starting */;
+        }
         if (managed.isStopped) {
           return "exited";
         }
@@ -977,6 +1110,10 @@ var init_TunnelManager = __esm({
           logger.warn("Attempted to remove tunnel that is not stopped", { tunnelId });
           return false;
         }
+        if (managed.rebuild) {
+          logger.warn("Attempted to remove tunnel that is restarting", { tunnelId });
+          return false;
+        }
         this._cleanupTunnelRecords(managed);
         logger.info("Removed stopped tunnel records", { tunnelId, configId: managed.configId });
         return true;
@@ -1056,17 +1193,27 @@ var init_TunnelManager = __esm({
           if (!managed) {
             return Promise.reject(new Error(`Tunnel with configId "${configId}" not found`));
           }
-          return Promise.resolve(managed.instance.getConfig());
+          return this.currentConfig(managed);
         }
         if (tunnelId) {
           const managed = this.tunnelsByTunnelId.get(tunnelId);
           if (!managed) {
             return Promise.reject(new Error(`Tunnel with tunnelId "${tunnelId}" not found`));
           }
-          return Promise.resolve(managed.instance.getConfig());
+          return this.currentConfig(managed);
         }
         return Promise.reject(new Error(`Either configId or tunnelId must be provided`));
       }
+      /**
+       * The instance's config, asked of its worker. A stopped instance has let its worker go, so a stopped
+       * tunnel, including one a restart is replacing, answers with the config it was built from.
+       */
+      currentConfig(managed) {
+        if (managed.isStopped) {
+          return Promise.resolve(managed.tunnelConfig);
+        }
+        return Promise.resolve(managed.instance.getConfig());
+      }
       /**
        * Stop a tunnel instance and wait for the stop to settle, capped by a
        * timeout. Failure is logged, not thrown: the caller replaces the
@@ -1090,6 +1237,46 @@ var init_TunnelManager = __esm({
           if (timer) clearTimeout(timer);
         }
       }
+      /**
+       * Marks the entry a restart or config update replaces. It stays in both maps until
+       * `_createTunnelWithProcessedConfig` sets the new entry under the same ids. When the new entry
+       * starts, the entry reports `starting`, and an error from an earlier run no longer describes it.
+       */
+      beginRebuild(managed, startsAfter) {
+        if (managed.rebuild) {
+          throw new TunnelRebuildInProgressError(managed.tunnelid);
+        }
+        managed.rebuild = { startsAfter };
+        if (startsAfter) {
+          managed.lastError = {};
+        }
+      }
+      /** Stops the instance being replaced, and marks it stopped so no reader calls it again. */
+      async stopForRebuild(managed) {
+        if (managed.isStopped) {
+          return;
+        }
+        await this.stopInstanceGuarded(managed);
+        managed.isStopped = true;
+        managed.stoppedAt = (/* @__PURE__ */ new Date()).toISOString();
+      }
+      /**
+       * Ends a failed rebuild. When the old entry is still in the maps, it stays listed as stopped with
+       * the reason. A new entry that failed to start already holds its own error.
+       */
+      failRebuild(managed, error) {
+        managed.rebuild = void 0;
+        if (this.tunnelsByTunnelId.get(managed.tunnelid) !== managed) {
+          return;
+        }
+        managed.isStopped = true;
+        managed.stoppedAt = managed.stoppedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+        managed.lastError = {
+          message: errorMessage(error) || START_FAILED_MESSAGE,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          isFatal: true
+        };
+      }
       /**
        * Restarts a tunnel with its current configuration.
        * This function will stop the tunnel if it's running and start it again.
@@ -1100,6 +1287,7 @@ var init_TunnelManager = __esm({
         if (!existingTunnel) {
           throw new Error(`Tunnel "${tunnelid}" not found`);
         }
+        this.beginRebuild(existingTunnel, true);
         logger.info("Initiating tunnel restart", {
           tunnelId: tunnelid,
           configId: existingTunnel.configId
@@ -1111,11 +1299,7 @@ var init_TunnelManager = __esm({
           const currentServe = existingTunnel.serve;
           const autoReconnect = existingTunnel.autoReconnect || false;
           const currentOrigin = existingTunnel.origin;
-          if (!existingTunnel.isStopped) {
-            await this.stopInstanceGuarded(existingTunnel);
-          }
-          this.tunnelsByTunnelId.delete(tunnelid);
-          this.tunnelsByConfigId.delete(existingTunnel.configId);
+          await this.stopForRebuild(existingTunnel);
           this.tunnelStats.delete(tunnelid);
           this.tunnelStatsListeners.delete(tunnelid);
           this.tunnelErrorListeners.delete(tunnelid);
@@ -1141,6 +1325,7 @@ var init_TunnelManager = __esm({
           }
           await this.startTunnel(newTunnel.tunnelid);
         } catch (error) {
+          this.failRebuild(existingTunnel, error);
           logger.error("Failed to restart tunnel", {
             tunnelid,
             error: error instanceof Error ? error.message : "Unknown error"
@@ -1198,12 +1383,9 @@ var init_TunnelManager = __esm({
         const currentStartedAt = existingTunnel.startedAt;
         const currentStoppedAt = existingTunnel.stoppedAt;
         const requestedServe = this.resolveServePath(newConfig);
+        this.beginRebuild(existingTunnel, !isStopped);
         try {
-          if (!isStopped) {
-            await this.stopInstanceGuarded(existingTunnel);
-          }
-          this.tunnelsByTunnelId.delete(currentTunnelId);
-          this.tunnelsByConfigId.delete(currentTunnelConfigId);
+          await this.stopForRebuild(existingTunnel);
           const mergedBaseConfig = {
             ...newConfig,
             configId,
@@ -1264,6 +1446,7 @@ var init_TunnelManager = __esm({
               error: errorMessage(restoreError)
             });
           }
+          this.failRebuild(existingTunnel, error);
           throw error;
         }
       }
@@ -2074,120 +2257,6 @@ var init_TunnelManager = __esm({
   }
 });
 
-// src/types.ts
-function isErrorResponse(obj) {
-  return typeof obj === "object" && obj !== null && "code" in obj && "message" in obj && typeof obj.message === "string" && Object.values(ErrorCode).includes(obj.code);
-}
-function newErrorResponse(codeOrError, message) {
-  if (typeof codeOrError === "object") {
-    return codeOrError;
-  }
-  return {
-    code: codeOrError,
-    message
-  };
-}
-function NewResponseObject(data) {
-  const encoder = new TextEncoder();
-  const bytes = encoder.encode(JSON.stringify(data));
-  return {
-    response: bytes,
-    requestid: "",
-    command: "",
-    error: false,
-    errorresponse: {}
-  };
-}
-function NewErrorResponseObject(errorResponse) {
-  return {
-    response: new Uint8Array(),
-    requestid: "",
-    command: "",
-    error: true,
-    errorresponse: errorResponse
-  };
-}
-function newStatus(tunnelState, errorCode, errorMsg) {
-  let assignedState = tunnelState;
-  if (tunnelState === "live" /* Live */) {
-    assignedState = "running" /* Running */;
-  } else if (tunnelState === "idle" /* New */) {
-    assignedState = "idle" /* New */;
-  } else if (tunnelState === "closed" /* Closed */) {
-    assignedState = "exited" /* Exited */;
-  }
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  return {
-    state: assignedState,
-    errorcode: errorCode,
-    errormsg: errorMsg,
-    createdtimestamp: now,
-    starttimestamp: now,
-    endtimestamp: now,
-    warnings: []
-  };
-}
-function newStats() {
-  return {
-    numLiveConnections: 0,
-    numTotalConnections: 0,
-    numTotalReqBytes: 0,
-    numTotalResBytes: 0,
-    numTotalTxBytes: 0,
-    elapsedTime: 0
-  };
-}
-var TunnelStateType, TunnelErrorCodeType, TunnelWarningCode, ErrorCode, RemoteManagementStatus;
-var init_types = __esm({
-  "src/types.ts"() {
-    "use strict";
-    init_cjs_shims();
-    TunnelStateType = /* @__PURE__ */ ((TunnelStateType2) => {
-      TunnelStateType2["New"] = "idle";
-      TunnelStateType2["Starting"] = "starting";
-      TunnelStateType2["Running"] = "running";
-      TunnelStateType2["Live"] = "live";
-      TunnelStateType2["Closed"] = "closed";
-      TunnelStateType2["Exited"] = "exited";
-      return TunnelStateType2;
-    })(TunnelStateType || {});
-    TunnelErrorCodeType = /* @__PURE__ */ ((TunnelErrorCodeType2) => {
-      TunnelErrorCodeType2["NonResponsive"] = "non_responsive";
-      TunnelErrorCodeType2["FailedToConnect"] = "failed_to_connect";
-      TunnelErrorCodeType2["ErrorInAdditionalForwarding"] = "additional_forwarding_error";
-      TunnelErrorCodeType2["WebdebuggerError"] = "webdebugger_error";
-      TunnelErrorCodeType2["NoError"] = "";
-      return TunnelErrorCodeType2;
-    })(TunnelErrorCodeType || {});
-    TunnelWarningCode = /* @__PURE__ */ ((TunnelWarningCode2) => {
-      TunnelWarningCode2["InvalidTunnelServePath"] = "INVALID_TUNNEL_SERVE_PATH";
-      TunnelWarningCode2["UnknownWarning"] = "UNKNOWN_WARNING";
-      return TunnelWarningCode2;
-    })(TunnelWarningCode || {});
-    ErrorCode = {
-      InvalidRequestMethodError: "INVALID_REQUEST_METHOD",
-      InvalidRequestBodyError: "COULD_NOT_READ_BODY",
-      InternalServerError: "INTERNAL_SERVER_ERROR",
-      InvalidBodyFormatError: "INVALID_DATA_FORMAT",
-      ErrorStartingTunnel: "ERROR_STARTING_TUNNEL",
-      TunnelNotFound: "TUNNEL_WITH_ID_OR_CONFIG_ID_NOT_FOUND",
-      TunnelAlreadyRunningError: "TUNNEL_WITH_ID_OR_CONFIG_ID_ALREADY_RUNNING",
-      WebsocketUpgradeFailError: "WEBSOCKET_UPGRADE_FAILED",
-      RemoteManagementAlreadyRunning: "REMOTE_MANAGEMENT_ALREADY_RUNNING",
-      RemoteManagementNotRunning: "REMOTE_MANAGEMENT_NOT_RUNNING",
-      RemoteManagementDeserializationFailed: "REMOTE_MANAGEMENT_DESERIALIZATION_FAILED"
-    };
-    RemoteManagementStatus = {
-      Connecting: "CONNECTING",
-      Disconnecting: "DISCONNECTING",
-      Reconnecting: "RECONNECTING",
-      Running: "RUNNING",
-      NotRunning: "NOT_RUNNING",
-      Error: "ERROR"
-    };
-  }
-});
-
 // src/remote_management/remote_schema.ts
 function pinggyOptionsToTunnelConfigV1(opts, configStoredInCli) {
   const parsedTokens = opts.bearerTokenAuth ? Array.isArray(opts.bearerTokenAuth) ? opts.bearerTokenAuth : JSON.parse(opts.bearerTokenAuth) : [];
@@ -2504,6 +2573,9 @@ var init_handler = __esm({
           }
           if (managed?.lastError) {
             status.lastError = managed.lastError;
+            if (managed.lastError.isFatal) {
+              status.errormsg = managed.lastError.message;
+            }
           }
         } catch (e) {
         }
@@ -2568,6 +2640,14 @@ var init_handler = __esm({
           message: err instanceof Error ? err.message : fallback
         });
       }
+      /**
+       * A restart or update of a tunnel another one is still rebuilding. A no-wait call checks this before
+       * it answers, because a throw from the call it does not await is only logged.
+       */
+      rebuildInProgress(tunnelid) {
+        const err = new TunnelRebuildInProgressError(tunnelid);
+        return this.error(ErrorCode.TunnelAlreadyRunningError, err, err.message);
+      }
       // --- Operations ---
       async handleStart(config, noWait = false, origin = "cli") {
         try {
@@ -2630,6 +2710,7 @@ var init_handler = __esm({
           if (noWait) {
             const existing = this.tunnelManager.getManagedTunnel(config.configid);
             if (!existing.tunnelConfig) throw new Error("Invalid tunnel state before configuration update");
+            if (existing.rebuild) return this.rebuildInProgress(existing.tunnelid);
             if (!existing.isStopped) {
               this.tunnelManager.updateConfig(updateOpts).catch((err) => {
                 logger.error("No-wait updateConfig failed", { configid: config.configid, err: String(err) });
@@ -2650,6 +2731,7 @@ var init_handler = __esm({
           if (noWait) {
             const existing = this.tunnelManager.getManagedTunnel(config.configId);
             if (!existing.tunnelConfig) throw new Error("Invalid tunnel state before configuration update");
+            if (existing.rebuild) return this.rebuildInProgress(existing.tunnelid);
             if (!existing.isStopped) {
               this.tunnelManager.updateConfig(config).catch((err) => {
                 logger.error("No-wait updateConfigV2 failed", { configId: config.configId, err: String(err) });
@@ -2748,6 +2830,7 @@ var init_handler = __esm({
           if (noWait) {
             const managed2 = this.tunnelManager.getManagedTunnel("", tunnelid);
             if (!managed2?.tunnelConfig) throw new Error(`Tunnel config for ID "${tunnelid}" not found`);
+            if (managed2.rebuild) return this.rebuildInProgress(tunnelid);
             this.tunnelManager.restartTunnel(tunnelid).catch((err) => {
               logger.error("No-wait restartTunnel failed", { tunnelid, err: String(err) });
             });
@@ -2758,6 +2841,9 @@ var init_handler = __esm({
           if (!managed?.tunnelConfig) throw new Error(`Tunnel config for ID "${tunnelid}" not found`);
           return this.buildTunnelResponse(tunnelid, managed.tunnelConfig, managed.configId, managed.tunnelName, managed.serve);
         } catch (err) {
+          if (err instanceof TunnelRebuildInProgressError) {
+            return this.rebuildInProgress(tunnelid);
+          }
           return this.error(ErrorCode.TunnelNotFound, err, "Failed to restart tunnel");
         }
       }
@@ -2800,7 +2886,7 @@ var init_handler = __esm({
 });
 
 // src/daemon/ipc/ipcRoutes.ts
-var IPC_VERSION, Route, DaemonHost, ShutdownStatus, SessionMode;
+var IPC_VERSION, Route, DaemonHost, ShutdownStatus, DeviceAgentState, SessionMode;
 var init_ipcRoutes = __esm({
   "src/daemon/ipc/ipcRoutes.ts"() {
     "use strict";
@@ -2823,7 +2909,10 @@ var init_ipcRoutes = __esm({
       SetLogLevel: "POST /loglevel",
       GetTunnelLogging: "GET /config/tunnel-logging",
       SetTunnelLogging: "POST /config/tunnel-logging",
-      GetLogPaths: "GET /logs/paths"
+      GetLogPaths: "GET /logs/paths",
+      GetDeviceAgent: "GET /device",
+      StartDeviceAgent: "POST /device/start",
+      StopDeviceAgent: "POST /device/stop"
     };
     DaemonHost = {
       CLI: "cli",
@@ -2833,6 +2922,12 @@ var init_ipcRoutes = __esm({
       ShuttingDown: "shutting_down",
       RefusedInApp: "refused_in_app"
     };
+    DeviceAgentState = {
+      Stopped: "stopped",
+      Connecting: "connecting",
+      Connected: "connected",
+      Reconnecting: "reconnecting"
+    };
     SessionMode = {
       Foreground: "foreground",
       Detached: "detached"
@@ -2843,9 +2938,11 @@ var init_ipcRoutes = __esm({
 // src/daemon/ipc/ipcClient.ts
 var ipcClient_exports = {};
 __export(ipcClient_exports, {
-  IPCClient: () => IPCClient
+  HTTP_NOT_FOUND: () => HTTP_NOT_FOUND,
+  IPCClient: () => IPCClient,
+  IPCHttpError: () => IPCHttpError
 });
-var import_node_http, REQUEST_TIMEOUT_MS, IPCClient;
+var import_node_http, REQUEST_TIMEOUT_MS, IPCHttpError, HTTP_NOT_FOUND, IPCClient;
 var init_ipcClient = __esm({
   "src/daemon/ipc/ipcClient.ts"() {
     "use strict";
@@ -2853,6 +2950,14 @@ var init_ipcClient = __esm({
     import_node_http = __toESM(require("http"), 1);
     init_ipcRoutes();
     REQUEST_TIMEOUT_MS = 1e4;
+    IPCHttpError = class extends Error {
+      constructor(statusCode, message) {
+        super(message);
+        this.statusCode = statusCode;
+        this.name = "IPCHttpError";
+      }
+    };
+    HTTP_NOT_FOUND = 404;
     IPCClient = class {
       constructor(port, origin = "cli") {
         this.port = port;
@@ -2919,6 +3024,15 @@ var init_ipcClient = __esm({
       async resolveLogPath(q) {
         return this.request("GET", `/logs/resolve?q=${encodeURIComponent(q)}`);
       }
+      async getDeviceAgentStatus(timeoutMs) {
+        return this.call(Route.GetDeviceAgent, void 0, timeoutMs);
+      }
+      async startDeviceAgent() {
+        return this.call(Route.StartDeviceAgent, {});
+      }
+      async stopDeviceAgent() {
+        return this.call(Route.StopDeviceAgent, {});
+      }
       /**
        * Get the WebSocket URL for event streaming.
        */
@@ -2931,11 +3045,11 @@ var init_ipcClient = __esm({
       call(key, body, timeoutMs) {
         const spaceIdx = key.indexOf(" ");
         const method = key.slice(0, spaceIdx);
-        const path11 = key.slice(spaceIdx + 1);
+        const path12 = key.slice(spaceIdx + 1);
         const payload = method === "GET" ? void 0 : JSON.stringify(body ?? {});
-        return this.request(method, path11, payload, timeoutMs);
+        return this.request(method, path12, payload, timeoutMs);
       }
-      request(method, path11, body, timeoutMs) {
+      request(method, path12, body, timeoutMs) {
         return new Promise((resolve, reject) => {
           const headers = {
             "X-Pinggy-Origin": this.origin
@@ -2948,7 +3062,7 @@ var init_ipcClient = __esm({
             {
               hostname: "127.0.0.1",
               port: this.port,
-              path: path11,
+              path: path12,
               method,
               headers,
               timeout: timeoutMs ?? REQUEST_TIMEOUT_MS
@@ -2960,7 +3074,10 @@ var init_ipcClient = __esm({
                 const text = Buffer.concat(chunks).toString("utf-8");
                 const statusCode = res.statusCode ?? 0;
                 if (statusCode < 200 || statusCode >= 300) {
-                  reject(new Error(`Daemon returned HTTP ${statusCode}: ${text.slice(0, 200)}`));
+                  reject(new IPCHttpError(
+                    statusCode,
+                    `Daemon returned HTTP ${statusCode}: ${text.slice(0, 200)}`
+                  ));
                   return;
                 }
                 try {
@@ -3767,42 +3884,42 @@ var init_websocket_handlers = __esm({
         const cmd = (req.command || "").toLowerCase();
         const raw = this.safeParse(req.data);
         try {
-          let response;
+          let response2;
           switch (cmd) {
             case WsCommand.Start: {
-              response = await this.handleStartReq(req, raw);
+              response2 = await this.handleStartReq(req, raw);
               break;
             }
             case WsCommand.StartV2: {
-              response = await this.handleStartV2Req(req, raw);
+              response2 = await this.handleStartV2Req(req, raw);
               break;
             }
             case WsCommand.Stop: {
-              response = await this.handleStopReq(req, raw);
+              response2 = await this.handleStopReq(req, raw);
               break;
             }
             case WsCommand.Get: {
-              response = await this.handleGetReq(req, raw);
+              response2 = await this.handleGetReq(req, raw);
               break;
             }
             case WsCommand.Restart: {
-              response = await this.handleRestartReq(req, raw);
+              response2 = await this.handleRestartReq(req, raw);
               break;
             }
             case WsCommand.UpdateConfig: {
-              response = await this.handleUpdateConfigReq(req, raw);
+              response2 = await this.handleUpdateConfigReq(req, raw);
               break;
             }
             case WsCommand.UpdateConfigV2: {
-              response = await this.handleUpdateConfigV2Req(req, raw);
+              response2 = await this.handleUpdateConfigV2Req(req, raw);
               break;
             }
             case WsCommand.List: {
-              response = await this.handleListReq(req);
+              response2 = await this.handleListReq(req);
               break;
             }
             case WsCommand.ListV2: {
-              response = await this.handleListV2Req(req);
+              response2 = await this.handleListV2Req(req);
               break;
             }
             case WsCommand.GetVersion: {
@@ -3815,8 +3932,8 @@ var init_websocket_handlers = __esm({
               }
               return this.sendError(ws, req, "Invalid command");
           }
-          logger.debug("Sending response", { command: response.command, requestid: response.requestid });
-          this.sendResponse(ws, response);
+          logger.debug("Sending response", { command: response2.command, requestid: response2.requestid });
+          this.sendResponse(ws, response2);
         } catch (e) {
           if (e instanceof import_zod2.default.ZodError) {
             logger.warn("Validation failed", { cmd, issues: e.issues });
@@ -4013,7 +4130,7 @@ function startRemoteManagement(remoteManagementConfig, tunnelHandler) {
         resolve(getRemoteManagementState());
       }
     };
-    const runLoop = async () => {
+    const runLoop2 = async () => {
       const sigintHandler = () => {
         _stopRequested = true;
       };
@@ -4041,7 +4158,7 @@ function startRemoteManagement(remoteManagementConfig, tunnelHandler) {
       process.removeListener("SIGINT", sigintHandler);
       logger.info("Remote management stopped.");
     };
-    runLoop().catch((err) => settleOnce(err instanceof Error ? err : new Error(String(err))));
+    runLoop2().catch((err) => settleOnce(err instanceof Error ? err : new Error(String(err))));
   });
 }
 function getRemoteManagementState() {
@@ -4622,10 +4739,10 @@ function parseArgs2(finalConfig, remainingPositionals) {
 }
 function storeJson(config, saveconf) {
   if (saveconf) {
-    const path11 = saveconf;
+    const path12 = saveconf;
     try {
-      import_fs6.default.writeFileSync(path11, JSON.stringify(config, null, 2), { encoding: "utf-8", flag: "w" });
-      logger.info(`Configuration saved to ${path11}`);
+      import_fs6.default.writeFileSync(path12, JSON.stringify(config, null, 2), { encoding: "utf-8", flag: "w" });
+      logger.info(`Configuration saved to ${path12}`);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       logger.error("Error loading configuration:", msg);
@@ -5134,7 +5251,11 @@ var init_configStore = __esm({
       DaemonAlias: "d",
       Logs: "logs",
       Log: "log",
-      Restart: "restart"
+      Restart: "restart",
+      Device: "device",
+      // The old spelling, refused with a hint. As a subcommand it never reaches tunnel mode, where `--token` is the
+      // tunnel token and a device token would go to the tunnel server.
+      Devices: "devices"
     };
     ConfigVerb = {
       List: "list",
@@ -6764,7 +6885,7 @@ async function printAlreadyRunning(client, configId, label) {
 async function startTunnel(client, config, opts) {
   const result = await client.handleStartV2(config, false, opts.mode);
   const prefix = opts.label ? `[${opts.label}] ` : "";
-  const fail = (reason) => {
+  const fail2 = (reason) => {
     const msg = `${prefix}Failed to start tunnel: ${reason}`;
     if (opts.onError === "fatal") {
       printer_default.error(msg);
@@ -6779,11 +6900,11 @@ async function startTunnel(client, config, opts) {
       await printAlreadyRunning(client, config.configId, opts.label);
       return null;
     }
-    return fail(result.message);
+    return fail2(result.message);
   }
   const lastError = result.status?.lastError;
   if (lastError?.isFatal) {
-    return fail(lastError.message);
+    return fail2(lastError.message);
   }
   return result;
 }
@@ -7409,106 +7530,3177 @@ function uninstallWindows() {
     console.log("No scheduled task found to remove.");
   }
 }
-function installService() {
-  const platform2 = import_node_os.default.platform();
-  const bin = resolveBinary();
-  if (!("pkg" in process) && bin.program !== process.execPath) {
-    console.warn(
-      "Warning: Using npm-installed binary. The path may change if Node.js is updated.\nConsider using a standalone binary (pkg) for system services."
-    );
+function installService() {
+  const platform2 = import_node_os.default.platform();
+  const bin = resolveBinary();
+  if (!("pkg" in process) && bin.program !== process.execPath) {
+    console.warn(
+      "Warning: Using npm-installed binary. The path may change if Node.js is updated.\nConsider using a standalone binary (pkg) for system services."
+    );
+  }
+  switch (platform2) {
+    case "linux":
+      installSystemd();
+      break;
+    case "darwin":
+      installLaunchd();
+      break;
+    case "win32":
+      installWindows();
+      break;
+    default:
+      console.error(`Unsupported platform: ${platform2}`);
+      process.exit(1);
+  }
+}
+function uninstallService() {
+  const platform2 = import_node_os.default.platform();
+  switch (platform2) {
+    case "linux":
+      uninstallSystemd();
+      break;
+    case "darwin":
+      uninstallLaunchd();
+      break;
+    case "win32":
+      uninstallWindows();
+      break;
+    default:
+      console.error(`Unsupported platform: ${platform2}`);
+      process.exit(1);
+  }
+}
+var import_node_os, import_node_fs3, import_node_path2, import_node_child_process, SERVICE_LABEL, SYSTEMD_SERVICE_NAME, WINDOWS_TASK_NAME;
+var init_serviceInstaller = __esm({
+  "src/daemon/lifecycle/serviceInstaller.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_os = __toESM(require("os"), 1);
+    import_node_fs3 = __toESM(require("fs"), 1);
+    import_node_path2 = __toESM(require("path"), 1);
+    import_node_child_process = require("child_process");
+    init_logger();
+    SERVICE_LABEL = "io.pinggy.agent";
+    SYSTEMD_SERVICE_NAME = "pinggy";
+    WINDOWS_TASK_NAME = "PinggyDaemon";
+  }
+});
+
+// src/utils/helpMessages.ts
+function printDaemonHelp() {
+  console.log("\nUsage: pinggy daemon <command>");
+  console.log("       pinggy d <command>\n");
+  console.log("Commands:");
+  console.log("  start                    Start the daemon process");
+  console.log("  stop                     Stop the daemon (stops all tunnels)");
+  console.log("  status                   Show daemon PID and uptime");
+  console.log("Tunnel operations:");
+  console.log("  pinggy ps                List running tunnels");
+  console.log("  pinggy stop <name|id>    Stop a specific tunnel");
+  console.log("  pinggy attach <name|id>  Re-attach TUI to a tunnel\n");
+}
+function printLogHelp() {
+  console.log("\nUsage: pinggy log <verb> [options]\n");
+  console.log("Commands:");
+  console.log("  level                    Print current log level");
+  console.log("  level debug|info|error   Set log level");
+  console.log("  path                     Print daemon log path");
+  console.log("  path <name|id>           Print tunnel log path\n");
+}
+function printConfigHelp() {
+  console.log("\nUsage: pinggy config <command> [name] [options]\n");
+  console.log("Commands:");
+  console.log("  list                           List all saved configs");
+  console.log("  show <name>                    Show config details");
+  console.log("  save <name> [tunnel flags]     Save a tunnel config");
+  console.log("  update <name> [tunnel flags]   Update a saved config");
+  console.log("  delete <name>                  Delete a saved config");
+  console.log("  auto <name>                    Enable auto-start");
+  console.log("  noauto <name>                  Disable auto-start\n");
+}
+function printStartHelp() {
+  console.log("\nUsage: pinggy start <name> [options]\n");
+  console.log("Examples:");
+  console.log("  pinggy start my-tunnel                Start a saved tunnel");
+  console.log("  pinggy start my-tunnel -l 4000        Start with override");
+  console.log("  pinggy start tunnela tunnelb           Start multiple tunnels");
+  console.log("  pinggy start --all                     Start all auto-start tunnels\n");
+}
+function printDeviceHelp() {
+  console.log("\nUsage: pinggy device <command> [options]\n");
+  console.log("Run this machine as a Pinggy device.\n");
+  console.log("Commands:");
+  console.log("  login                    Sign this machine in with your email, then stay connected");
+  console.log("  connect --token <TOKEN>  Enrol, then stay connected until interrupted");
+  console.log("  stop                     Stop the agent running in the background");
+  console.log("  status                   Show the enrolment, and the agent running in the background");
+  console.log("  remove                   Forget the local credential (does not delete the device)\n");
+  console.log("Options:");
+  console.log("  -b                       login and connect: run the agent in the background, in the daemon.");
+  console.log("                           It stays connected after this terminal closes");
+  console.log("  --token <TOKEN>          Device token from the dashboard");
+  console.log("  --manage <HOST>          Dashboard address. Default: dashboard.pinggy.io");
+  console.log("  --name <NAME>            login only: the device's name. Default: this machine's hostname\n");
+  console.log("Environment:");
+  console.log("  DEVICE_AGENT_TOKEN       connect only: the device token, when --token is not given. With no");
+  console.log("                           --manage, it dials dashboard.pinggy.io. Removed once read\n");
+}
+var init_helpMessages = __esm({
+  "src/utils/helpMessages.ts"() {
+    "use strict";
+    init_cjs_shims();
+  }
+});
+
+// src/devices/deviceIdentity.ts
+function readDeviceIdentity() {
+  const filePath = getDeviceConfigPath();
+  if (!import_fs8.default.existsSync(filePath)) {
+    return null;
+  }
+  try {
+    return JSON.parse(import_fs8.default.readFileSync(filePath, "utf-8"));
+  } catch (e) {
+    logger.warn("Could not read device identity file", { error: String(e) });
+    return null;
+  }
+}
+function writeDeviceIdentity(identity) {
+  ensurePinggyConfigDir();
+  const filePath = getDeviceConfigPath();
+  import_fs8.default.writeFileSync(filePath, JSON.stringify(identity, null, 2), {
+    encoding: "utf-8",
+    mode: SECRET_FILE_MODE
+  });
+  import_fs8.default.chmodSync(filePath, SECRET_FILE_MODE);
+}
+function clearDeviceIdentity() {
+  const filePath = getDeviceConfigPath();
+  if (!import_fs8.default.existsSync(filePath)) {
+    return false;
+  }
+  import_fs8.default.unlinkSync(filePath);
+  return true;
+}
+function maskToken(token) {
+  return token.length <= 8 ? "***" : `${token.slice(0, 8)}...${token.slice(-4)}`;
+}
+var import_fs8, SECRET_FILE_MODE;
+var init_deviceIdentity = __esm({
+  "src/devices/deviceIdentity.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_fs8 = __toESM(require("fs"), 1);
+    init_configDir();
+    init_logger();
+    SECRET_FILE_MODE = 384;
+  }
+});
+
+// src/devices/envelope.ts
+function nowSeconds() {
+  return Math.floor(Date.now() / 1e3);
+}
+function request(ch, op, payload) {
+  return { v: PROTOCOL_VERSION, kind: "req", ch, op, id: (0, import_crypto2.randomUUID)(), seq: 0, ts: nowSeconds(), payload };
+}
+function response(to, op, payload) {
+  return { v: PROTOCOL_VERSION, kind: "res", ch: to.ch, op, id: to.id, seq: 0, ts: nowSeconds(), payload };
+}
+function event(ch, op, payload) {
+  return { v: PROTOCOL_VERSION, kind: "event", ch, op, id: "", seq: 0, ts: nowSeconds(), payload };
+}
+function parseEnvelope(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null) return null;
+    if (typeof parsed.ch !== "string" || typeof parsed.op !== "string") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+var import_crypto2, PROTOCOL_VERSION, CHANNEL_SYSTEM, CHANNEL_DEVICE, OP_HELLO, OP_WELCOME, OP_HEARTBEAT, OP_DISCONNECT, OP_INFO, OP_METRICS, OP_TUNNELS, CHANNEL_TUNNEL, OP_START, OP_STOP, OP_RESTART, OP_UPDATE;
+var init_envelope = __esm({
+  "src/devices/envelope.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_crypto2 = require("crypto");
+    PROTOCOL_VERSION = 1;
+    CHANNEL_SYSTEM = "system";
+    CHANNEL_DEVICE = "device";
+    OP_HELLO = "hello";
+    OP_WELCOME = "welcome";
+    OP_HEARTBEAT = "heartbeat";
+    OP_DISCONNECT = "disconnect";
+    OP_INFO = "info";
+    OP_METRICS = "metrics";
+    OP_TUNNELS = "tunnels";
+    CHANNEL_TUNNEL = "tunnel";
+    OP_START = "start";
+    OP_STOP = "stop";
+    OP_RESTART = "restart";
+    OP_UPDATE = "update";
+  }
+});
+
+// src/devices/device_schema.ts
+var import_zod3, WelcomeSchema, ErrorPayloadSchema, DisconnectSchema, TunnelActionSchema;
+var init_device_schema = __esm({
+  "src/devices/device_schema.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_zod3 = require("zod");
+    WelcomeSchema = import_zod3.z.object({
+      device_agent_id: import_zod3.z.string(),
+      accepted_proto: import_zod3.z.number(),
+      heartbeat_interval_seconds: import_zod3.z.number(),
+      stats_interval_seconds: import_zod3.z.number(),
+      server_time: import_zod3.z.number(),
+      max_frame_bytes: import_zod3.z.number(),
+      // Optional: a dashboard that predates terminals sends none of these.
+      terminal_enabled: import_zod3.z.boolean().optional(),
+      max_terminals_per_device: import_zod3.z.number().optional(),
+      // No default on the agent. Without it, terminals stay unavailable rather than unbraked.
+      terminal_window_bytes: import_zod3.z.number().optional(),
+      // No default either. Without them the agent runs no expiry timers, and the dashboard's sweep
+      // still ends an expired shell, only later.
+      terminal_idle_timeout_seconds: import_zod3.z.number().optional(),
+      terminal_max_session_seconds: import_zod3.z.number().optional(),
+      // Optional: a dashboard older than these sends neither, and the agent prints only the device id.
+      email: import_zod3.z.string().optional(),
+      device_url: import_zod3.z.string().optional()
+    });
+    ErrorPayloadSchema = import_zod3.z.object({
+      error: import_zod3.z.object({
+        code: import_zod3.z.string(),
+        message: import_zod3.z.string()
+      })
+    });
+    DisconnectSchema = import_zod3.z.object({
+      reason: import_zod3.z.string()
+    });
+    TunnelActionSchema = import_zod3.z.object({
+      tunnel_id: import_zod3.z.string().min(1).max(128).optional(),
+      source: import_zod3.z.enum(["device", "dashboard"]).optional(),
+      config_id: import_zod3.z.string().min(1).max(128).optional(),
+      config: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()).optional()
+    });
+  }
+});
+
+// src/devices/deviceAgentReporter.ts
+function printConnected(welcome) {
+  printer_default.success(`Connected as device ${welcome.device_agent_id}`);
+  if (welcome.email) {
+    printer_default.print(`Signed in as ${welcome.email}`);
+  }
+  if (welcome.device_url) {
+    printer_default.print("Open the device in a browser:");
+    printer_default.print(`  ${welcome.device_url}`);
+  }
+}
+function formatSeconds(millis) {
+  return (millis / 1e3).toFixed(1);
+}
+var printingReporter;
+var init_deviceAgentReporter = __esm({
+  "src/devices/deviceAgentReporter.ts"() {
+    "use strict";
+    init_cjs_shims();
+    init_printer();
+    printingReporter = {
+      connecting: (server) => printer_default.print(`Connecting to ${server}`),
+      connected: printConnected,
+      reconnecting: (delayMillis, attempt) => printer_default.warn(
+        `Disconnected. Reconnecting in ${formatSeconds(delayMillis)} seconds (attempt ${attempt}).`
+      ),
+      warn: (message) => printer_default.warn(message),
+      failed: (error) => printer_default.error(error.message),
+      replacingDevice: (oldDeviceAgentId) => printer_default.print(`This machine was device ${oldDeviceAgentId}. Connecting it with the token from the command.`)
+    };
+  }
+});
+
+// src/devices/collectors/systemInfo.ts
+function collectSystemInfo() {
+  const cpus = import_os3.default.cpus();
+  return {
+    hostname: import_os3.default.hostname(),
+    os: import_os3.default.platform(),
+    os_version: import_os3.default.release(),
+    // os.machine() reports what uname does (x86_64, arm64, aarch64). os.arch() reports the Node
+    // build target (x64), which is not what an operator reads on the machine itself.
+    arch: import_os3.default.machine(),
+    kernel: import_os3.default.type(),
+    // os.cpus() is empty on some Android and container builds.
+    cpu_model: cpus[0]?.model?.trim() || UNKNOWN_CPU_MODEL,
+    cpu_cores: cpus.length,
+    total_memory_bytes: import_os3.default.totalmem()
+  };
+}
+var import_os3, UNKNOWN_CPU_MODEL;
+var init_systemInfo = __esm({
+  "src/devices/collectors/systemInfo.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_os3 = __toESM(require("os"), 1);
+    UNKNOWN_CPU_MODEL = "unknown";
+  }
+});
+
+// src/devices/collectors/metrics.ts
+function sumCpuTicks(cpus) {
+  let idleTicks = 0;
+  let totalTicks = 0;
+  for (const cpu of cpus) {
+    const { user, nice, sys, idle, irq } = cpu.times;
+    idleTicks += idle;
+    totalTicks += user + nice + sys + idle + irq;
+  }
+  return { idleTicks, totalTicks };
+}
+function cpuPercentBetween(earlier, later) {
+  const totalDelta = later.totalTicks - earlier.totalTicks;
+  if (totalDelta <= 0) {
+    return 0;
+  }
+  const busyDelta = totalDelta - (later.idleTicks - earlier.idleTicks);
+  const percent = Math.min(100, Math.max(0, 100 * busyDelta / totalDelta));
+  return Math.round(percent * 10) / 10;
+}
+function buildMetrics(readings) {
+  const [oneMinute = 0, fiveMinutes = 0, fifteenMinutes = 0] = readings.loadAverages;
+  return {
+    cpu_percent: readings.cpuPercent,
+    load_avg_1m: oneMinute,
+    load_avg_5m: fiveMinutes,
+    load_avg_15m: fifteenMinutes,
+    memory_used_bytes: readings.totalMemoryBytes - readings.freeMemoryBytes,
+    memory_total_bytes: readings.totalMemoryBytes,
+    uptime_seconds: Math.floor(readings.uptimeSeconds),
+    collected_at: readings.collectedAtEpochSeconds
+  };
+}
+async function collectMetrics() {
+  const earlier = sumCpuTicks(import_os4.default.cpus());
+  await new Promise((resolve) => setTimeout(resolve, CPU_SAMPLE_WINDOW_MS));
+  const later = sumCpuTicks(import_os4.default.cpus());
+  return buildMetrics({
+    cpuPercent: cpuPercentBetween(earlier, later),
+    loadAverages: import_os4.default.loadavg(),
+    totalMemoryBytes: import_os4.default.totalmem(),
+    freeMemoryBytes: import_os4.default.freemem(),
+    uptimeSeconds: import_os4.default.uptime(),
+    collectedAtEpochSeconds: Math.floor(Date.now() / 1e3)
+  });
+}
+var import_os4, CPU_SAMPLE_WINDOW_MS;
+var init_metrics = __esm({
+  "src/devices/collectors/metrics.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_os4 = __toESM(require("os"), 1);
+    CPU_SAMPLE_WINDOW_MS = 200;
+  }
+});
+
+// src/devices/tunnels/tunnelList.ts
+async function readDaemonOnPort(port) {
+  try {
+    const answer = await new IPCClient(port, "cli").listTunnels();
+    return { running: true, tunnels: Array.isArray(answer) ? answer : [] };
+  } catch (err) {
+    logger.debug("Device agent could not list the daemon's tunnels", { error: String(err) });
+    return { running: false, reason: REASON_DAEMON_UNREACHABLE };
+  }
+}
+function selfTunnelListSource(port) {
+  return {
+    readDaemon: () => readDaemonOnPort(port),
+    readSavedConfigs: listSavedConfigs
+  };
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringOrNull(value) {
+  return typeof value === "string" && value !== "" ? value : null;
+}
+function toEpochSeconds(value) {
+  if (typeof value !== "string" || value === "") return null;
+  const millis = Date.parse(value);
+  return Number.isNaN(millis) ? null : Math.floor(millis / 1e3);
+}
+function sanitizeErrorMessage(value) {
+  if (typeof value !== "string") return null;
+  const printable = value.replace(/[\u0000-\u001f\u007f-\u009f]/g, "").trim();
+  return printable === "" ? null : printable.slice(0, ERROR_MESSAGE_MAX_LENGTH);
+}
+function forwardingType(value) {
+  return typeof value === "string" && FORWARDING_TYPES.has(value) ? value : DEFAULT_FORWARDING_TYPE;
+}
+function toForwarding(forwarding) {
+  if (typeof forwarding === "string") {
+    if (forwarding.trim() === "") return [];
+    const schemeMatch = /^([a-z]+):\/\/(.+)$/i.exec(forwarding.trim());
+    if (!schemeMatch) {
+      return [{ type: DEFAULT_FORWARDING_TYPE, local_address: forwarding.trim() }];
+    }
+    const scheme = schemeMatch[1].toLowerCase();
+    return [{
+      type: scheme === "https" ? DEFAULT_FORWARDING_TYPE : forwardingType(scheme),
+      local_address: schemeMatch[2]
+    }];
+  }
+  if (!Array.isArray(forwarding)) return [];
+  return forwarding.filter(isObject).filter((entry) => typeof entry.address === "string").map((entry) => ({ type: forwardingType(entry.type), local_address: entry.address }));
+}
+function toFullConfig(rawConfig) {
+  const parsed = TunnelConfigV1Schema.safeParse(rawConfig);
+  return parsed.success ? parsed.data : null;
+}
+function toTunnelRow(daemonTunnel) {
+  if (!isObject(daemonTunnel) || typeof daemonTunnel.tunnelid !== "string") return null;
+  const config = isObject(daemonTunnel.tunnelconfig) ? daemonTunnel.tunnelconfig : {};
+  const status = isObject(daemonTunnel.status) ? daemonTunnel.status : {};
+  const remoteUrls = Array.isArray(daemonTunnel.remoteurls) ? daemonTunnel.remoteurls.filter((url) => typeof url === "string") : [];
+  return {
+    tunnel_id: daemonTunnel.tunnelid,
+    config_id: stringOrNull(config.configId),
+    name: stringOrNull(config.name),
+    state: typeof status.state === "string" && STATES.has(status.state) ? status.state : "idle" /* New */,
+    error_message: sanitizeErrorMessage(status.errormsg),
+    remote_urls: remoteUrls,
+    forwarding: toForwarding(config.forwarding),
+    mode: typeof daemonTunnel.mode === "string" && MODES.has(daemonTunnel.mode) ? daemonTunnel.mode : null,
+    created_at: toEpochSeconds(status.createdtimestamp),
+    started_at: toEpochSeconds(status.starttimestamp),
+    tunnel_config: toFullConfig(daemonTunnel.tunnelconfig)
+  };
+}
+function newestFirst(rows, timeOf) {
+  return [...rows].sort((a, b) => (timeOf(b) ?? 0) - (timeOf(a) ?? 0));
+}
+function buildTunnelList(reading, savedConfigs, collectedAtEpochSeconds) {
+  const allTunnels = reading.running ? newestFirst(
+    reading.tunnels.map(toTunnelRow).filter((row) => row !== null),
+    (row) => row.created_at
+  ) : [];
+  const runningConfigIds = new Set(allTunnels.filter((row) => row.config_id !== null && !STOPPED_STATES.has(row.state)).map((row) => row.config_id));
+  const allSaved = newestFirst(savedConfigs, (config) => toEpochSeconds(config.createdAt)).map((config) => ({
+    config_id: config.configId,
+    name: config.name,
+    running: runningConfigIds.has(config.configId),
+    // The same shape tunnelActions.ts sends the daemon to start this exact config.
+    tunnel_config: { ...config.tunnelConfig, configId: config.configId, name: config.name }
+  }));
+  return {
+    daemon_running: reading.running,
+    daemon_unavailable_reason: reading.running ? null : reading.reason,
+    tunnels: allTunnels.slice(0, MAX_TUNNELS),
+    saved_configs: allSaved.slice(0, MAX_SAVED_CONFIGS),
+    truncated: allTunnels.length > MAX_TUNNELS || allSaved.length > MAX_SAVED_CONFIGS,
+    collected_at: collectedAtEpochSeconds
+  };
+}
+async function collectTunnelList(source = machineTunnelListSource) {
+  const reading = await source.readDaemon();
+  let savedConfigs = [];
+  try {
+    savedConfigs = source.readSavedConfigs();
+  } catch (err) {
+    logger.debug("Device agent could not read saved tunnel configs", { error: String(err) });
+  }
+  return buildTunnelList(reading, savedConfigs, Math.floor(Date.now() / 1e3));
+}
+function changeKey(list) {
+  const { collected_at: _collectedAt, ...comparable } = list;
+  return JSON.stringify(comparable);
+}
+function startTunnelReporting(collect, send, intervalMillis = TUNNEL_POLL_INTERVAL_MILLIS) {
+  let stopped = false;
+  let inFlight = false;
+  let pollAgain = false;
+  let lastSentKey = null;
+  const poll = () => {
+    if (stopped) return;
+    if (inFlight) {
+      pollAgain = true;
+      return;
+    }
+    inFlight = true;
+    collect().then((list) => {
+      if (stopped) return;
+      const key = changeKey(list);
+      if (key === lastSentKey) return;
+      lastSentKey = key;
+      send(list);
+    }).catch((err) => logger.warn("Device tunnel list collection failed", { error: String(err) })).finally(() => {
+      inFlight = false;
+      if (pollAgain) {
+        pollAgain = false;
+        poll();
+      }
+    });
+  };
+  poll();
+  const timer = setInterval(poll, intervalMillis);
+  const stop = () => {
+    stopped = true;
+    clearInterval(timer);
+  };
+  return Object.assign(stop, { pollNow: poll });
+}
+var TUNNEL_POLL_INTERVAL_MILLIS, MAX_TUNNELS, MAX_SAVED_CONFIGS, ERROR_MESSAGE_MAX_LENGTH, REASON_IPC_VERSION_MISMATCH, REASON_DAEMON_UNREACHABLE, FORWARDING_TYPES, DEFAULT_FORWARDING_TYPE, MODES, STATES, STOPPED_STATES, machineTunnelListSource;
+var init_tunnelList = __esm({
+  "src/devices/tunnels/tunnelList.ts"() {
+    "use strict";
+    init_cjs_shims();
+    init_logger();
+    init_configStore();
+    init_daemonManager();
+    init_ipcClient();
+    init_remote_schema();
+    init_types();
+    TUNNEL_POLL_INTERVAL_MILLIS = 5e3;
+    MAX_TUNNELS = 50;
+    MAX_SAVED_CONFIGS = 100;
+    ERROR_MESSAGE_MAX_LENGTH = 256;
+    REASON_IPC_VERSION_MISMATCH = "ipc_version_mismatch";
+    REASON_DAEMON_UNREACHABLE = "daemon_unreachable";
+    FORWARDING_TYPES = /* @__PURE__ */ new Set(["http", "tcp", "udp", "tls", "tlstcp"]);
+    DEFAULT_FORWARDING_TYPE = "http";
+    MODES = /* @__PURE__ */ new Set(["foreground", "detached"]);
+    STATES = new Set(Object.values(TunnelStateType));
+    STOPPED_STATES = /* @__PURE__ */ new Set(["closed" /* Closed */, "exited" /* Exited */]);
+    machineTunnelListSource = {
+      async readDaemon() {
+        const info = getDaemonInfo();
+        if (!info) {
+          return { running: false, reason: null };
+        }
+        if (!isIpcCompatible(info)) {
+          return { running: false, reason: REASON_IPC_VERSION_MISMATCH };
+        }
+        return readDaemonOnPort(info.port);
+      },
+      readSavedConfigs: listSavedConfigs
+    };
+  }
+});
+
+// src/devices/tunnels/tunnelActions.ts
+function selfTunnelActionDependencies(port) {
+  return {
+    daemon: () => Promise.resolve(new IPCClient(port, "device")),
+    readSavedConfigs: machineTunnelActionDependencies.readSavedConfigs,
+    writeSavedConfig: machineTunnelActionDependencies.writeSavedConfig
+  };
+}
+function failure(code, message) {
+  return { error: { code, message } };
+}
+function actionFailed(message) {
+  return failure(ERROR_TUNNEL_ACTION_FAILED, sanitizeErrorMessage(message) ?? "The tunnel action failed.");
+}
+function toResult(daemonAnswer, fallbackTunnelId) {
+  if (isErrorResponse(daemonAnswer)) {
+    if (daemonAnswer.code === ErrorCode.TunnelNotFound) {
+      return failure(ERROR_TUNNEL_NOT_FOUND, sanitizeErrorMessage(daemonAnswer.message) ?? "No such tunnel.");
+    }
+    return actionFailed(daemonAnswer.message);
+  }
+  const answer = typeof daemonAnswer === "object" && daemonAnswer !== null ? daemonAnswer : {};
+  const tunnelId = typeof answer.tunnelid === "string" && answer.tunnelid !== "" ? answer.tunnelid : fallbackTunnelId;
+  if (!tunnelId) {
+    return actionFailed("The daemon did not name the tunnel.");
+  }
+  const state = typeof answer.status?.state === "string" ? answer.status.state : STATE_STARTING;
+  return { tunnel_id: tunnelId, state };
+}
+function withoutNulls(config) {
+  return Object.fromEntries(Object.entries(config).filter(([, value]) => value !== null));
+}
+function targetOf(op, action) {
+  const namesTunnel = action.tunnel_id !== void 0;
+  if (op === OP_UPDATE) {
+    if (namesTunnel || action.config === void 0) {
+      return null;
+    }
+    if (action.source === "dashboard" && action.config_id === void 0) {
+      return { kind: "dashboard", config: action.config };
+    }
+    if (action.source === "device" && action.config_id !== void 0) {
+      return { kind: "savedEdit", configId: action.config_id, config: action.config };
+    }
+    return null;
+  }
+  if (op !== OP_START) {
+    return namesTunnel ? { kind: "tunnel", tunnelId: action.tunnel_id } : null;
+  }
+  if (namesTunnel) {
+    return action.source === void 0 && action.config_id === void 0 && action.config === void 0 ? { kind: "tunnel", tunnelId: action.tunnel_id } : null;
+  }
+  if (action.source === "device" && action.config_id !== void 0 && action.config === void 0) {
+    return { kind: "saved", configId: action.config_id };
+  }
+  if (action.source === "dashboard" && action.config !== void 0 && action.config_id === void 0) {
+    return { kind: "dashboard", config: action.config };
+  }
+  return null;
+}
+async function perform(op, action, dependencies) {
+  const target = targetOf(op, action);
+  if (!target) {
+    return failure(ERROR_INVALID_PAYLOAD, "The tunnel request names no tunnel or config.");
+  }
+  if (target.kind === "tunnel") {
+    const client2 = await dependencies.daemon(false);
+    if (!client2) {
+      return NO_DAEMON;
+    }
+    const answer = op === OP_STOP ? await client2.stopTunnel(target.tunnelId) : await client2.restartTunnel(target.tunnelId, true);
+    return toResult(answer, target.tunnelId);
+  }
+  if (target.kind === "savedEdit") {
+    return rewriteSavedConfig(target.configId, target.config, dependencies);
+  }
+  let config;
+  if (target.kind === "saved") {
+    const saved = dependencies.readSavedConfigs().find((candidate) => candidate.configId === target.configId);
+    if (!saved) {
+      return failure(ERROR_SAVED_CONFIG_NOT_FOUND, "No config with that id is saved on this machine.");
+    }
+    config = { ...saved.tunnelConfig, configId: saved.configId, name: saved.name };
+  } else {
+    const parsed = TunnelConfigV1Schema.safeParse(withoutNulls(target.config));
+    if (!parsed.success) {
+      return failure(ERROR_INVALID_PAYLOAD, "The dashboard config could not be read.");
+    }
+    config = parsed.data;
+  }
+  if (op === OP_UPDATE) {
+    return updateTunnel(config, dependencies);
+  }
+  const client = await dependencies.daemon(true);
+  if (!client) {
+    return actionFailed("The tunnel daemon could not be started.");
+  }
+  return toResult(await client.startTunnelWithConfig(config, SessionMode.Detached, true), null);
+}
+function rewriteSavedConfig(configId, rawConfig, dependencies) {
+  const parsed = TunnelConfigV1Schema.safeParse(withoutNulls(rawConfig));
+  if (!parsed.success) {
+    return failure(ERROR_INVALID_PAYLOAD, "The config could not be read.");
+  }
+  const savedConfigs = dependencies.readSavedConfigs();
+  const saved = savedConfigs.find((candidate) => candidate.configId === configId);
+  if (!saved) {
+    return failure(ERROR_SAVED_CONFIG_NOT_FOUND, "No config with that id is saved on this machine.");
+  }
+  const name = parsed.data.name || saved.name;
+  if (name !== saved.name) {
+    const nameError = validateNameStrict(name);
+    if (nameError) {
+      return failure(ERROR_INVALID_PAYLOAD, nameError.message);
+    }
+    if (savedConfigs.some((candidate) => candidate.name === name)) {
+      return failure(ERROR_SAVED_CONFIG_NAME_TAKEN, `A config named "${name}" is already saved on this machine.`);
+    }
+  }
+  dependencies.writeSavedConfig({
+    ...saved,
+    name,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    tunnelConfig: { ...parsed.data, configId, name }
+  });
+  return { config_id: configId };
+}
+async function updateTunnel(config, dependencies) {
+  const client = await dependencies.daemon(false);
+  if (!client) {
+    return NO_DAEMON;
+  }
+  const listed = await client.listTunnels();
+  if (!Array.isArray(listed)) {
+    return actionFailed(isErrorResponse(listed) ? listed.message : "The daemon did not list its tunnels.");
+  }
+  const running = listed.find((candidate) => candidate.tunnelconfig?.configId === config.configId);
+  if (!running) {
+    return failure(ERROR_TUNNEL_NOT_FOUND, "No tunnel on this machine runs that config.");
+  }
+  return toResult(await client.updateConfigV2(config, true), running.tunnelid);
+}
+async function handleTunnelAction(envelope, send, dependencies = machineTunnelActionDependencies) {
+  if (envelope.kind !== "req") {
+    return;
+  }
+  const op = envelope.op;
+  if (op !== OP_START && op !== OP_STOP && op !== OP_RESTART && op !== OP_UPDATE) {
+    send(response(envelope, op, failure(ERROR_UNSUPPORTED_OP, `Unsupported operation: tunnel/${op}`)));
+    return;
+  }
+  const parsed = TunnelActionSchema.safeParse(envelope.payload);
+  if (!parsed.success) {
+    send(response(envelope, op, failure(ERROR_INVALID_PAYLOAD, "The tunnel request could not be read.")));
+    return;
+  }
+  let result;
+  try {
+    result = await perform(op, parsed.data, dependencies);
+  } catch (err) {
+    result = actionFailed(err instanceof Error ? err.message : String(err));
+  }
+  logger.info("Device agent tunnel action", {
+    op,
+    tunnelId: parsed.data.tunnel_id ?? null,
+    configId: parsed.data.config_id ?? null,
+    source: parsed.data.source ?? null,
+    outcome: "error" in result ? result.error.code : "accepted"
+  });
+  send(response(envelope, op, result));
+}
+var ERROR_INVALID_PAYLOAD, ERROR_UNSUPPORTED_OP, ERROR_TUNNEL_NOT_FOUND, ERROR_SAVED_CONFIG_NOT_FOUND, ERROR_SAVED_CONFIG_NAME_TAKEN, ERROR_TUNNEL_ACTION_FAILED, STATE_STARTING, DaemonUnusableError, machineTunnelActionDependencies, NO_DAEMON;
+var init_tunnelActions = __esm({
+  "src/devices/tunnels/tunnelActions.ts"() {
+    "use strict";
+    init_cjs_shims();
+    init_logger();
+    init_configStore();
+    init_daemonManager();
+    init_ipcClient();
+    init_ipcRoutes();
+    init_remote_schema();
+    init_types();
+    init_envelope();
+    init_device_schema();
+    init_tunnelList();
+    ERROR_INVALID_PAYLOAD = "invalid_payload";
+    ERROR_UNSUPPORTED_OP = "unsupported_op";
+    ERROR_TUNNEL_NOT_FOUND = "tunnel_not_found";
+    ERROR_SAVED_CONFIG_NOT_FOUND = "saved_config_not_found";
+    ERROR_SAVED_CONFIG_NAME_TAKEN = "saved_config_name_taken";
+    ERROR_TUNNEL_ACTION_FAILED = "tunnel_action_failed";
+    STATE_STARTING = "starting";
+    DaemonUnusableError = class extends Error {
+    };
+    machineTunnelActionDependencies = {
+      async daemon(startIfMissing) {
+        const info = getDaemonInfo();
+        if (info) {
+          if (!isIpcCompatible(info)) {
+            throw new DaemonUnusableError(ipcMismatchMessage(info));
+          }
+          return new IPCClient(info.port, "device");
+        }
+        if (!startIfMissing) {
+          return null;
+        }
+        const started = await ensureDaemonRunning();
+        return new IPCClient(started.port, "device");
+      },
+      readSavedConfigs: listSavedConfigs,
+      writeSavedConfig: (saved) => {
+        upsertConfig(saved);
+      }
+    };
+    NO_DAEMON = failure(ERROR_TUNNEL_NOT_FOUND, "No tunnel daemon is running on this machine.");
+  }
+});
+
+// src/devices/reconnect.ts
+function backoffCeilingMillis(attempt) {
+  const uncapped = INITIAL_DELAY_MILLIS * 2 ** Math.max(0, attempt);
+  return Math.min(uncapped, MAX_DELAY_MILLIS);
+}
+function fullJitterMillis(ceilingMillis, random) {
+  return Math.floor(random() * ceilingMillis);
+}
+var INITIAL_DELAY_MILLIS, MAX_DELAY_MILLIS, STABLE_CONNECTION_MILLIS, MAX_ATTEMPT, ReconnectPolicy;
+var init_reconnect = __esm({
+  "src/devices/reconnect.ts"() {
+    "use strict";
+    init_cjs_shims();
+    INITIAL_DELAY_MILLIS = 1e3;
+    MAX_DELAY_MILLIS = 6e4;
+    STABLE_CONNECTION_MILLIS = 6e4;
+    MAX_ATTEMPT = Math.ceil(Math.log2(MAX_DELAY_MILLIS / INITIAL_DELAY_MILLIS));
+    ReconnectPolicy = class {
+      constructor(options = {}) {
+        this.attemptCount = 0;
+        this.connectedAtMillis = null;
+        this.now = options.now ?? Date.now;
+        this.random = options.random ?? Math.random;
+      }
+      /** Attempts taken since the last reset. Exposed for logging and for tests. */
+      get attempt() {
+        return this.attemptCount;
+      }
+      /** The ceiling the next delay will be drawn from, before jitter. */
+      get nextCeilingMillis() {
+        return backoffCeilingMillis(this.attemptCount);
+      }
+      markConnected() {
+        this.connectedAtMillis = this.now();
+      }
+      /**
+       * Ends the current connection. Returns true when it had held long enough to reset the
+       * schedule, which the caller logs.
+       */
+      markDisconnected() {
+        const heldMillis = this.connectedAtMillis === null ? 0 : this.now() - this.connectedAtMillis;
+        this.connectedAtMillis = null;
+        const wasStable = heldMillis >= STABLE_CONNECTION_MILLIS;
+        if (wasStable) {
+          this.attemptCount = 0;
+        }
+        return wasStable;
+      }
+      /** The delay before the next dial, and advances the schedule. */
+      nextDelayMillis() {
+        const delay = fullJitterMillis(this.nextCeilingMillis, this.random);
+        this.attemptCount = Math.min(this.attemptCount + 1, MAX_ATTEMPT);
+        return delay;
+      }
+    };
+  }
+});
+
+// src/devices/terminal/terminal_schema.ts
+function clampGrid(requested, fallback) {
+  if (requested === void 0 || !Number.isFinite(requested)) return fallback;
+  return Math.max(MIN_GRID, Math.min(MAX_GRID, Math.trunc(requested)));
+}
+var import_zod4, CHANNEL_TERMINAL, OP_OPEN, OP_OPENED, OP_CLOSE, OP_DATA, OP_ACK, OP_EXIT, OP_RESIZE, OP_SIGNAL, OP_CONTEXT, OP_SNAPSHOT, TERMINAL_SIGNALS, MIN_GRID, MAX_GRID, CLOSE_REASON_USER_CLOSED, CLOSE_REASON_IDLE_TIMEOUT, CLOSE_REASON_MAX_SESSION, ERROR_INVALID_PAYLOAD2, ERROR_TERMINAL_LIMIT_REACHED, ERROR_TERMINAL_DISABLED, ERROR_SHELL_NOT_ALLOWED, ERROR_SPAWN_FAILED, TerminalOpenSchema, TerminalCloseSchema, TerminalResizeSchema, TerminalInputSchema, TerminalSignalSchema, TerminalAckSchema, TerminalSnapshotRequestSchema;
+var init_terminal_schema = __esm({
+  "src/devices/terminal/terminal_schema.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_zod4 = require("zod");
+    CHANNEL_TERMINAL = "terminal";
+    OP_OPEN = "open";
+    OP_OPENED = "opened";
+    OP_CLOSE = "close";
+    OP_DATA = "data";
+    OP_ACK = "ack";
+    OP_EXIT = "exit";
+    OP_RESIZE = "resize";
+    OP_SIGNAL = "signal";
+    OP_CONTEXT = "context";
+    OP_SNAPSHOT = "snapshot";
+    TERMINAL_SIGNALS = ["INT", "TERM", "QUIT", "HUP"];
+    MIN_GRID = 1;
+    MAX_GRID = 1e3;
+    CLOSE_REASON_USER_CLOSED = "user_closed";
+    CLOSE_REASON_IDLE_TIMEOUT = "idle_timeout";
+    CLOSE_REASON_MAX_SESSION = "max_session";
+    ERROR_INVALID_PAYLOAD2 = "invalid_payload";
+    ERROR_TERMINAL_LIMIT_REACHED = "terminal_limit_reached";
+    ERROR_TERMINAL_DISABLED = "terminal_disabled";
+    ERROR_SHELL_NOT_ALLOWED = "shell_not_allowed";
+    ERROR_SPAWN_FAILED = "spawn_failed";
+    TerminalOpenSchema = import_zod4.z.object({
+      terminal_id: import_zod4.z.string().min(1),
+      cols: import_zod4.z.number().int().optional(),
+      rows: import_zod4.z.number().int().optional(),
+      shell: import_zod4.z.string().nullable().optional(),
+      cwd: import_zod4.z.string().nullable().optional()
+    });
+    TerminalCloseSchema = import_zod4.z.object({
+      terminal_id: import_zod4.z.string().min(1),
+      reason: import_zod4.z.string().optional()
+    });
+    TerminalResizeSchema = import_zod4.z.object({
+      terminal_id: import_zod4.z.string().min(1),
+      cols: import_zod4.z.number().int(),
+      rows: import_zod4.z.number().int()
+    });
+    TerminalInputSchema = import_zod4.z.object({
+      terminal_id: import_zod4.z.string().min(1),
+      data: import_zod4.z.string()
+    });
+    TerminalSignalSchema = import_zod4.z.object({
+      terminal_id: import_zod4.z.string().min(1),
+      signal: import_zod4.z.enum(TERMINAL_SIGNALS)
+    });
+    TerminalAckSchema = import_zod4.z.object({
+      terminal_id: import_zod4.z.string().min(1),
+      ack_seq: import_zod4.z.number().optional(),
+      ack_bytes: import_zod4.z.number()
+    });
+    TerminalSnapshotRequestSchema = import_zod4.z.object({
+      terminal_id: import_zod4.z.string().min(1),
+      snapshot_id: import_zod4.z.string().min(1)
+    });
+  }
+});
+
+// src/devices/terminal/flowWindow.ts
+var FlowWindow;
+var init_flowWindow = __esm({
+  "src/devices/terminal/flowWindow.ts"() {
+    "use strict";
+    init_cjs_shims();
+    FlowWindow = class {
+      constructor(windowBytes) {
+        this.sentBytes = 0;
+        this.ackedBytes = 0;
+        if (!Number.isFinite(windowBytes) || windowBytes <= 0) {
+          throw new Error("A terminal flow window needs a positive size from welcome");
+        }
+        this.windowBytes = Math.trunc(windowBytes);
+      }
+      /** How many more raw bytes may go out before the browser has to catch up. */
+      remaining() {
+        return Math.max(0, this.windowBytes - (this.sentBytes - this.ackedBytes));
+      }
+      /** False means stop reading the pty. Nothing else is an acceptable response. */
+      isOpen() {
+        return this.remaining() > 0;
+      }
+      recordSent(byteCount) {
+        if (!Number.isFinite(byteCount) || byteCount <= 0) return;
+        this.sentBytes += Math.trunc(byteCount);
+      }
+      /**
+       * Cumulative totals, never increments, so a dropped ack self-heals on the next one.
+       *
+       * A browser is not a trusted input. An ack beyond what was sent is clamped rather than believed,
+       * and one that arrives out of order never moves the counter backwards.
+       */
+      recordAck(ackBytes) {
+        if (!Number.isFinite(ackBytes)) return;
+        const clamped = Math.min(Math.max(Math.trunc(ackBytes), 0), this.sentBytes);
+        if (clamped > this.ackedBytes) {
+          this.ackedBytes = clamped;
+        }
+      }
+      get sent() {
+        return this.sentBytes;
+      }
+      get acked() {
+        return this.ackedBytes;
+      }
+      get size() {
+        return this.windowBytes;
+      }
+    };
+  }
+});
+
+// src/devices/terminal/frameSplitter.ts
+function rawBundleBytes(maxFrameBytes) {
+  const available = maxFrameBytes - ENVELOPE_OVERHEAD_BYTES;
+  if (available <= 0) {
+    throw new Error("max_frame_bytes leaves no room for a terminal payload");
+  }
+  return Math.floor(available * BASE64_NUMERATOR / BASE64_DENOMINATOR);
+}
+var ENVELOPE_OVERHEAD_BYTES, BASE64_NUMERATOR, BASE64_DENOMINATOR, BUNDLE_MILLIS, FrameSplitter;
+var init_frameSplitter = __esm({
+  "src/devices/terminal/frameSplitter.ts"() {
+    "use strict";
+    init_cjs_shims();
+    ENVELOPE_OVERHEAD_BYTES = 512;
+    BASE64_NUMERATOR = 3;
+    BASE64_DENOMINATOR = 4;
+    BUNDLE_MILLIS = 8;
+    FrameSplitter = class {
+      constructor(emit, bundleBytes, bundleMillis = BUNDLE_MILLIS) {
+        this.emit = emit;
+        this.bundleBytes = bundleBytes;
+        this.bundleMillis = bundleMillis;
+        this.pending = [];
+        this.pendingBytes = 0;
+        if (!Number.isFinite(bundleBytes) || bundleBytes <= 0) {
+          throw new Error("A frame splitter needs a positive bundle size");
+        }
+      }
+      /** A chunk over the cap is split across frames, never truncated. */
+      push(chunk) {
+        if (chunk.length === 0) return;
+        this.pending.push(chunk);
+        this.pendingBytes += chunk.length;
+        while (this.pendingBytes >= this.bundleBytes) {
+          this.emitBytes(this.bundleBytes);
+        }
+        if (this.pendingBytes > 0) {
+          this.arm();
+        } else {
+          this.disarm();
+        }
+      }
+      /** Sends whatever is held, if anything. Used when the terminal closes and by the timer. */
+      flush() {
+        this.disarm();
+        if (this.pendingBytes > 0) {
+          this.emitBytes(this.pendingBytes);
+        }
+      }
+      dispose() {
+        this.disarm();
+        this.pending = [];
+        this.pendingBytes = 0;
+      }
+      get buffered() {
+        return this.pendingBytes;
+      }
+      emitBytes(byteCount) {
+        const joined = Buffer.concat(this.pending, this.pendingBytes);
+        const frame = joined.subarray(0, byteCount);
+        const rest = joined.subarray(byteCount);
+        this.pending = rest.length > 0 ? [rest] : [];
+        this.pendingBytes = rest.length;
+        this.emit(frame);
+      }
+      arm() {
+        if (this.timer !== void 0) return;
+        this.timer = setTimeout(() => {
+          this.timer = void 0;
+          this.flush();
+        }, this.bundleMillis);
+        this.timer.unref?.();
+      }
+      disarm() {
+        if (this.timer === void 0) return;
+        clearTimeout(this.timer);
+        this.timer = void 0;
+      }
+    };
+  }
+});
+
+// src/devices/terminal/shellContext.ts
+function processTableReader(platform2 = process.platform) {
+  if (platform2 === "linux") return readFromProc;
+  if (platform2 === "darwin") return readFromPsAndLsof;
+  return null;
+}
+function programName(rawName) {
+  const text = cleanText(rawName, Number.MAX_SAFE_INTEGER);
+  if (text === null) return null;
+  const firstWord = text.split(/\s+/, 1)[0];
+  const baseName = firstWord.slice(firstWord.lastIndexOf("/") + 1).replace(/:+$/, "");
+  return baseName === "" ? null : truncate(baseName, MAX_COMMAND_CHARACTERS);
+}
+function displayCwd(rawCwd, resolvedHome) {
+  const cwd = cleanText(rawCwd, Number.MAX_SAFE_INTEGER);
+  if (cwd === null) return null;
+  let shown = cwd;
+  if (resolvedHome && cwd === resolvedHome) {
+    shown = HOME_PREFIX;
+  } else if (resolvedHome && cwd.startsWith(resolvedHome + "/")) {
+    shown = HOME_PREFIX + cwd.slice(resolvedHome.length);
+  }
+  return truncate(shown, MAX_CWD_CHARACTERS);
+}
+function resolvedHomeDirectory() {
+  try {
+    return import_fs9.default.realpathSync(import_os5.default.homedir());
+  } catch {
+    return null;
+  }
+}
+function cleanText(raw, maxCharacters) {
+  if (raw === null || raw === void 0) return null;
+  const text = raw.replace(/[\u0000-\u001f\u007f-\u009f]/g, "").trim();
+  return text === "" ? null : truncate(text, maxCharacters);
+}
+function truncate(text, maxCharacters) {
+  const codePoints = Array.from(text);
+  return codePoints.length <= maxCharacters ? text : codePoints.slice(0, maxCharacters).join("");
+}
+async function readFromProc(shellPids) {
+  const contexts = /* @__PURE__ */ new Map();
+  await Promise.all(shellPids.map(async (shellPid) => {
+    const groups = await readProcGroups(shellPid);
+    if (!groups) return;
+    const cwd = await readOrNull(() => import_fs9.default.promises.readlink(`/proc/${shellPid}/cwd`));
+    const foregroundName = groups.foregroundGroupId === groups.shellGroupId ? null : await readOrNull(() => import_fs9.default.promises.readFile(`/proc/${groups.foregroundGroupId}/comm`, "utf8"));
+    contexts.set(shellPid, { cwd, foregroundName });
+  }));
+  return contexts;
+}
+async function readProcGroups(shellPid) {
+  const stat = await readOrNull(() => import_fs9.default.promises.readFile(`/proc/${shellPid}/stat`, "utf8"));
+  if (stat === null) return null;
+  const afterName = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+  const shellGroupId = Number.parseInt(afterName[2], 10);
+  const foregroundGroupId = Number.parseInt(afterName[5], 10);
+  if (!(shellGroupId > 0) || !(foregroundGroupId > 0)) return null;
+  return { shellGroupId, foregroundGroupId };
+}
+async function readFromPsAndLsof(shellPids) {
+  const contexts = /* @__PURE__ */ new Map();
+  if (shellPids.length === 0) return contexts;
+  const groups = parseColumns(await run("ps", ["-o", "pid=,pgid=,tpgid=", "-p", shellPids.join(",")]));
+  const foregroundGroupIds = [...groups.values()].filter(([shellGroupId, foregroundGroupId]) => foregroundGroupId > 0 && foregroundGroupId !== shellGroupId).map(([, foregroundGroupId]) => foregroundGroupId);
+  const [names, cwds] = await Promise.all([
+    foregroundGroupIds.length === 0 ? Promise.resolve(/* @__PURE__ */ new Map()) : run("ps", ["-o", "pid=,comm=", "-p", foregroundGroupIds.join(",")]).then(parseNames),
+    run("lsof", ["-a", "-d", "cwd", "-Fpn", "-p", shellPids.join(",")]).then(parseLsofCwds)
+  ]);
+  for (const shellPid of shellPids) {
+    const group = groups.get(shellPid);
+    if (!group) continue;
+    const [shellGroupId, foregroundGroupId] = group;
+    contexts.set(shellPid, {
+      cwd: cwds.get(shellPid) ?? null,
+      foregroundName: foregroundGroupId === shellGroupId ? null : names.get(foregroundGroupId) ?? null
+    });
+  }
+  return contexts;
+}
+function parseColumns(stdout) {
+  const columns = /* @__PURE__ */ new Map();
+  for (const line of (stdout ?? "").split("\n")) {
+    const [pid, groupId, foregroundGroupId] = line.trim().split(/\s+/).map((field) => Number.parseInt(field, 10));
+    if (pid > 0 && groupId > 0) columns.set(pid, [groupId, foregroundGroupId]);
+  }
+  return columns;
+}
+function parseNames(stdout) {
+  const names = /* @__PURE__ */ new Map();
+  for (const line of (stdout ?? "").split("\n")) {
+    const match = /^\s*(\d+)\s+(.*)$/.exec(line);
+    if (match) names.set(Number.parseInt(match[1], 10), match[2]);
+  }
+  return names;
+}
+function parseLsofCwds(stdout) {
+  const cwds = /* @__PURE__ */ new Map();
+  let pid = 0;
+  for (const line of (stdout ?? "").split("\n")) {
+    if (line.startsWith("p")) pid = Number.parseInt(line.slice(1), 10);
+    else if (line.startsWith("n") && pid > 0) cwds.set(pid, line.slice(1));
+  }
+  return cwds;
+}
+function run(program, args) {
+  return new Promise((resolve) => {
+    (0, import_child_process2.execFile)(program, args, { timeout: PROCESS_READ_TIMEOUT_MILLIS }, (err, stdout) => {
+      const output = String(stdout ?? "");
+      resolve(err && output === "" ? null : output);
+    });
+  });
+}
+async function readOrNull(read) {
+  try {
+    return await read();
+  } catch {
+    return null;
+  }
+}
+var import_child_process2, import_fs9, import_os5, SHELL_CONTEXT_POLL_MILLIS, MAX_CWD_CHARACTERS, MAX_COMMAND_CHARACTERS, PROCESS_READ_TIMEOUT_MILLIS, HOME_PREFIX, ShellContextTracker;
+var init_shellContext = __esm({
+  "src/devices/terminal/shellContext.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_child_process2 = require("child_process");
+    import_fs9 = __toESM(require("fs"), 1);
+    import_os5 = __toESM(require("os"), 1);
+    SHELL_CONTEXT_POLL_MILLIS = 5e3;
+    MAX_CWD_CHARACTERS = 1024;
+    MAX_COMMAND_CHARACTERS = 64;
+    PROCESS_READ_TIMEOUT_MILLIS = 2e3;
+    HOME_PREFIX = "~";
+    ShellContextTracker = class {
+      constructor() {
+        this.known = /* @__PURE__ */ new Map();
+      }
+      /** The event to send, or null when nothing changed since the last one. */
+      observe(terminalId, raw, resolvedHome) {
+        const previous = this.known.get(terminalId);
+        const command = programName(raw.foregroundName);
+        const previousCommand = previous?.command ?? null;
+        const lastCommand = previousCommand !== null && previousCommand !== command ? previousCommand : previous?.last_command ?? null;
+        const next = {
+          terminal_id: terminalId,
+          cwd: displayCwd(raw.cwd, resolvedHome),
+          command,
+          last_command: lastCommand
+        };
+        if (previous && previous.cwd === next.cwd && previous.command === next.command && previous.last_command === next.last_command) {
+          return null;
+        }
+        this.known.set(terminalId, next);
+        return next;
+      }
+      /** What was last sent for every shell, to send again after a reconnect. */
+      current() {
+        return [...this.known.values()];
+      }
+      forget(terminalId) {
+        this.known.delete(terminalId);
+      }
+      clear() {
+        this.known.clear();
+      }
+    };
+  }
+});
+
+// src/devices/terminal/screenMirror.ts
+function loadModules() {
+  if (loadedModules !== void 0) return loadedModules;
+  try {
+    const headless = require2("@xterm/headless");
+    const serialize = require2("@xterm/addon-serialize");
+    loadedModules = { Terminal: headless.Terminal, SerializeAddon: serialize.SerializeAddon };
+  } catch (err) {
+    logger.warn("Screen restore unavailable: the headless terminal did not load", { error: errorName(err) });
+    loadedModules = null;
+  }
+  return loadedModules;
+}
+function isScreenMirrorSupported() {
+  return loadModules() !== null;
+}
+function errorName(err) {
+  return err instanceof Error ? err.name : typeof err;
+}
+var import_module, SCROLLBACK_LINES, MAX_SNAPSHOT_BYTES, SCROLLBACK_LINES_TO_TRY, require2, loadedModules, ScreenMirror;
+var init_screenMirror = __esm({
+  "src/devices/terminal/screenMirror.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_module = require("module");
+    init_logger();
+    SCROLLBACK_LINES = 1e3;
+    MAX_SNAPSHOT_BYTES = 1024 * 1024;
+    SCROLLBACK_LINES_TO_TRY = [SCROLLBACK_LINES, 200, 0];
+    require2 = (0, import_module.createRequire)(importMetaUrl);
+    ScreenMirror = class _ScreenMirror {
+      constructor(terminal, serializer) {
+        this.terminal = terminal;
+        this.serializer = serializer;
+        this.disposed = false;
+      }
+      /** Null when the headless terminal cannot load. The shell then works as before, without restore. */
+      static create(cols, rows) {
+        const modules = loadModules();
+        if (!modules) return null;
+        const terminal = new modules.Terminal({ cols, rows, scrollback: SCROLLBACK_LINES, allowProposedApi: true });
+        const serializer = new modules.SerializeAddon();
+        terminal.loadAddon(serializer);
+        return new _ScreenMirror(terminal, serializer);
+      }
+      /** Bytes exactly as they were sent. xterm parses them later, in order, and joins split characters. */
+      feed(bytes) {
+        if (!this.disposed) this.terminal.write(bytes);
+      }
+      resize(cols, rows) {
+        if (!this.disposed) this.terminal.resize(cols, rows);
+      }
+      /**
+       * The screen after everything fed before this call, and nothing fed after it. Null when the
+       * mirror was disposed first.
+       *
+       * xterm parses writes in batches, on a timer. An empty write queued now has its callback run
+       * after every earlier chunk is parsed and before the next one is, so serialising inside it sees
+       * exactly what was fed before this call.
+       */
+      snapshot() {
+        return new Promise((resolve) => {
+          if (this.disposed) {
+            resolve(null);
+            return;
+          }
+          this.terminal.write("", () => resolve(this.disposed ? null : this.serialise()));
+        });
+      }
+      dispose() {
+        if (this.disposed) return;
+        this.disposed = true;
+        this.terminal.dispose();
+      }
+      /** Null when even the screen alone is over the cap. The tab then waits out its fallback. */
+      serialise() {
+        for (const scrollback of SCROLLBACK_LINES_TO_TRY) {
+          const text = this.serializer.serialize({ scrollback });
+          if (Buffer.byteLength(text, "utf-8") <= MAX_SNAPSHOT_BYTES) {
+            return { text, cols: this.terminal.cols, rows: this.terminal.rows };
+          }
+        }
+        return null;
+      }
+    };
+  }
+});
+
+// src/devices/terminal/terminalHandler.ts
+function positiveMillis(seconds) {
+  return seconds !== void 0 && Number.isFinite(seconds) && seconds > 0 ? seconds * MILLIS_PER_SECOND : void 0;
+}
+function splitIntoParts(bytes, partBytes) {
+  const parts = [];
+  for (let offset = 0; offset < bytes.length; offset += partBytes) {
+    parts.push(bytes.subarray(offset, offset + partBytes));
+  }
+  return parts.length > 0 ? parts : [Buffer.alloc(0)];
+}
+function errorName2(err) {
+  return err instanceof Error ? err.name : typeof err;
+}
+function signalName(signal) {
+  for (const [name, number] of Object.entries(import_os6.default.constants.signals)) {
+    if (number === signal) return name.replace(/^SIG/, "");
+  }
+  return String(signal);
+}
+var import_os6, DEFAULT_COLS, DEFAULT_ROWS, EXPIRY_CHECK_MILLIS, MILLIS_PER_SECOND, TerminalHandler;
+var init_terminalHandler = __esm({
+  "src/devices/terminal/terminalHandler.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_os6 = __toESM(require("os"), 1);
+    init_logger();
+    init_envelope();
+    init_terminal_schema();
+    init_flowWindow();
+    init_frameSplitter();
+    init_shellContext();
+    init_screenMirror();
+    DEFAULT_COLS = 80;
+    DEFAULT_ROWS = 24;
+    EXPIRY_CHECK_MILLIS = 5e3;
+    MILLIS_PER_SECOND = 1e3;
+    TerminalHandler = class {
+      constructor(dependencies) {
+        this.dependencies = dependencies;
+        this.enabled = true;
+        this.suspended = false;
+        this.expiryTimer = null;
+        this.contextTimer = null;
+        this.contextPollInFlight = false;
+        this.contextTracker = new ShellContextTracker();
+        this.streams = /* @__PURE__ */ new Map();
+      }
+      /**
+       * From welcome. An older dashboard sends no terminal fields, and `terminal_enabled` and the
+       * per-device ceiling keep their defaults.
+       *
+       * The window has no default. A compiled-in one keeps working after the dashboard stops sending
+       * the field, and nobody notices until a node falls over, so an agent without one refuses to open
+       * a terminal at all.
+       */
+      configure(terminalEnabled, maxTerminalsPerDevice, terminalWindowBytes, maxFrameBytes, idleTimeoutSeconds, maxSessionSeconds) {
+        if (terminalEnabled !== void 0) this.enabled = terminalEnabled;
+        if (maxTerminalsPerDevice !== void 0) this.dependencies.registry.setMaxTerminals(maxTerminalsPerDevice);
+        this.windowBytes = terminalWindowBytes;
+        this.bundleBytes = rawBundleBytes(maxFrameBytes);
+        if (terminalWindowBytes === void 0) {
+          logger.info("Terminals unavailable: welcome carried no terminal_window_bytes");
+        }
+        this.idleTimeoutMillis = positiveMillis(idleTimeoutSeconds);
+        this.maxSessionMillis = positiveMillis(maxSessionSeconds);
+        this.startExpiryTimer();
+      }
+      /**
+       * Ends every shell past its idle timeout or its max-session cap. Runs on a timer; public so a test
+       * decides when. The cap goes first: a shell both idle and too old is closed for the rule typing
+       * cannot reset.
+       */
+      expireShells() {
+        if (this.suspended) return;
+        const nowMillis = this.nowMillis();
+        for (const [terminalId, stream] of [...this.streams.entries()]) {
+          if (this.maxSessionMillis !== void 0 && nowMillis - stream.openedAtMillis >= this.maxSessionMillis) {
+            this.expire(terminalId, CLOSE_REASON_MAX_SESSION);
+          } else if (this.idleTimeoutMillis !== void 0 && nowMillis - stream.lastActivityMillis >= this.idleTimeoutMillis) {
+            this.expire(terminalId, CLOSE_REASON_IDLE_TIMEOUT);
+          }
+        }
+      }
+      handle(envelope) {
+        if (envelope.op === OP_OPEN) {
+          this.open(envelope);
+        } else if (envelope.op === OP_CLOSE) {
+          this.closeFromDashboard(envelope);
+        } else if (envelope.op === OP_ACK) {
+          this.acknowledge(envelope);
+        } else if (envelope.op === OP_RESIZE) {
+          this.resize(envelope);
+        } else if (envelope.op === OP_DATA) {
+          this.input(envelope);
+        } else if (envelope.op === OP_SIGNAL) {
+          this.signal(envelope);
+        } else if (envelope.op === OP_SNAPSHOT) {
+          void this.snapshot(envelope);
+        } else {
+          logger.debug("Ignoring unhandled terminal op", { op: envelope.op });
+        }
+      }
+      /**
+       * The agent is stopping: interrupted, revoked, or refused for good. Every shell dies with it.
+       * A dropped socket is not this; it is `suspend`.
+       */
+      closeAll() {
+        this.stopExpiryTimer();
+        this.stopContextTimer();
+        this.contextTracker.clear();
+        this.suspended = false;
+        for (const stream of this.streams.values()) {
+          stream.splitter.dispose();
+          stream.mirror?.dispose();
+        }
+        this.streams.clear();
+        this.dependencies.registry.killAll();
+      }
+      /**
+       * The socket dropped and the agent will redial. Every shell stops being read and keeps running.
+       * Whatever it prints waits in the kernel, and the shell blocks once that buffer is full.
+       */
+      suspend() {
+        if (this.suspended) return;
+        this.suspended = true;
+        for (const [terminalId, session] of this.dependencies.registry.entries()) {
+          try {
+            session.pause();
+          } catch (err) {
+            logger.warn("Terminal pause failed", { terminal_id: terminalId, error: errorName2(err) });
+          }
+        }
+        logger.info("Terminals suspended until the dashboard is back", { count: this.dependencies.registry.size() });
+      }
+      /**
+       * `welcome` arrived. Every shell the dashboard did not close is read again, except one whose
+       * window is still full. That one resumes on the `ack` that reopens it.
+       */
+      resumeAll() {
+        if (!this.suspended) return;
+        this.suspended = false;
+        for (const [terminalId, session] of this.dependencies.registry.entries()) {
+          const stream = this.streams.get(terminalId);
+          if (stream) {
+            for (const chunk of stream.heldBundles.splice(0)) {
+              this.sendData(terminalId, chunk);
+            }
+          }
+          if (stream?.paused) continue;
+          try {
+            session.resume();
+          } catch (err) {
+            logger.warn("Terminal resume failed", { terminal_id: terminalId, error: errorName2(err) });
+          }
+        }
+        for (const context of this.contextTracker.current()) {
+          if (this.streams.has(context.terminal_id)) {
+            this.dependencies.send(event(CHANNEL_TERMINAL, OP_CONTEXT, context));
+          }
+        }
+      }
+      /**
+       * Reads every open shell's directory and foreground program, and sends `context` for each that
+       * changed. Runs on a timer while any shell is open; public so a test decides when. Never throws,
+       * and never moves a shell's idle clock.
+       */
+      async pollShellContexts() {
+        const read = this.dependencies.readShellContexts;
+        if (!read || this.suspended || this.contextPollInFlight || this.streams.size === 0) return;
+        this.contextPollInFlight = true;
+        try {
+          const terminalIdsByPid = /* @__PURE__ */ new Map();
+          for (const [terminalId, stream] of this.streams) {
+            terminalIdsByPid.set(stream.session.pid, terminalId);
+          }
+          const contexts = await read([...terminalIdsByPid.keys()]);
+          if (this.suspended) return;
+          for (const [shellPid, raw] of contexts) {
+            const terminalId = terminalIdsByPid.get(shellPid);
+            if (!terminalId || !this.streams.has(terminalId)) continue;
+            const changed = this.contextTracker.observe(terminalId, raw, this.dependencies.resolvedHome ?? null);
+            if (changed) this.dependencies.send(event(CHANNEL_TERMINAL, OP_CONTEXT, changed));
+          }
+        } catch (err) {
+          logger.debug("Shell context poll failed", { error: errorName2(err) });
+        } finally {
+          this.contextPollInFlight = false;
+        }
+      }
+      /** What `hello` lists: every shell still held, so the dashboard can keep it. */
+      held() {
+        return this.dependencies.registry.entries().map(([terminalId, session]) => ({
+          terminal_id: terminalId,
+          pid: session.pid,
+          shell: session.shell,
+          cols: session.cols,
+          rows: session.rows
+        }));
+      }
+      open(envelope) {
+        const parsed = TerminalOpenSchema.safeParse(envelope.payload);
+        if (!parsed.success) {
+          this.refuse(envelope, null, ERROR_INVALID_PAYLOAD2, "open payload could not be read.");
+          return;
+        }
+        const request2 = parsed.data;
+        const { registry } = this.dependencies;
+        if (!this.enabled || this.windowBytes === void 0 || this.bundleBytes === void 0) {
+          this.refuse(envelope, request2.terminal_id, ERROR_TERMINAL_DISABLED, "Terminals are disabled.");
+          return;
+        }
+        if (registry.has(request2.terminal_id) || registry.isFull()) {
+          this.refuse(
+            envelope,
+            request2.terminal_id,
+            ERROR_TERMINAL_LIMIT_REACHED,
+            "Too many terminals are already open on this machine."
+          );
+          return;
+        }
+        const resolution = this.dependencies.resolveShell(request2.shell);
+        if ("error" in resolution) {
+          this.refuse(envelope, request2.terminal_id, ERROR_SHELL_NOT_ALLOWED, resolution.error);
+          return;
+        }
+        const cols = clampGrid(request2.cols, DEFAULT_COLS);
+        const rows = clampGrid(request2.rows, DEFAULT_ROWS);
+        let session;
+        try {
+          session = this.dependencies.spawn({ shell: resolution.shell, cwd: request2.cwd, cols, rows });
+        } catch (err) {
+          logger.warn("Terminal spawn failed", { terminal_id: request2.terminal_id, error: errorName2(err) });
+          this.refuse(envelope, request2.terminal_id, ERROR_SPAWN_FAILED, "The shell could not be started.");
+          return;
+        }
+        if (!registry.add(request2.terminal_id, session)) {
+          session.kill();
+          this.refuse(
+            envelope,
+            request2.terminal_id,
+            ERROR_TERMINAL_LIMIT_REACHED,
+            "Too many terminals are already open on this machine."
+          );
+          return;
+        }
+        this.startStream(request2.terminal_id, session, this.windowBytes, this.bundleBytes);
+        logger.info("Terminal opened", { terminal_id: request2.terminal_id, pid: session.pid });
+        const opened = {
+          terminal_id: request2.terminal_id,
+          pid: session.pid,
+          shell: session.shell,
+          cols,
+          rows
+        };
+        this.dependencies.send(response(envelope, OP_OPENED, opened));
+      }
+      startStream(terminalId, session, windowBytes, bundleBytes) {
+        const openedAtMillis = this.nowMillis();
+        const stream = {
+          session,
+          window: new FlowWindow(windowBytes),
+          splitter: new FrameSplitter((chunk) => this.sendData(terminalId, chunk), bundleBytes),
+          mirror: ScreenMirror.create(session.cols, session.rows),
+          paused: false,
+          sentSeq: 0,
+          heldBundles: [],
+          openedAtMillis,
+          lastActivityMillis: openedAtMillis
+        };
+        this.streams.set(terminalId, stream);
+        this.startContextTimer();
+        session.onData((chunk) => {
+          stream.lastActivityMillis = this.nowMillis();
+          stream.splitter.push(chunk);
+        });
+        session.onExit((exitCode, signal) => {
+          if (this.dependencies.registry.remove(terminalId) === void 0) return;
+          stream.splitter.flush();
+          stream.splitter.dispose();
+          this.forgetStream(terminalId);
+          logger.info("Terminal shell exited", { terminal_id: terminalId, exit_code: exitCode, signal });
+          const exit = signal ? { terminal_id: terminalId, exit_code: null, signal: signalName(signal) } : { terminal_id: terminalId, exit_code: exitCode, signal: null };
+          this.dependencies.send(event(CHANNEL_TERMINAL, OP_EXIT, exit));
+          this.dependencies.send(event(
+            CHANNEL_TERMINAL,
+            OP_CLOSE,
+            { terminal_id: terminalId, reason: CLOSE_REASON_USER_CLOSED }
+          ));
+        });
+      }
+      /**
+       * 1 bundle leaves, and the window narrows by what it carried.
+       *
+       * The pause happens after the send rather than before. These bytes are already out of the pty,
+       * and holding them is the buffering this whole mechanism exists to avoid.
+       *
+       * While the socket is down the bundle is held instead, and neither counts against the window nor
+       * takes a seq. Sent into no socket, it would be a seq the dashboard never sees and bytes nobody
+       * can ack, and the window would never reopen.
+       *
+       * The mirror is fed here, in the same tick as the seq, and nowhere else. A snapshot then holds
+       * exactly the bundles up to its `after_seq`. Fed when the pty is read, a bundle still being cut
+       * would be in the screen and drawn a second time when it is sent.
+       */
+      sendData(terminalId, chunk) {
+        const stream = this.streams.get(terminalId);
+        if (!stream) return;
+        if (this.suspended) {
+          stream.heldBundles.push(chunk);
+          return;
+        }
+        stream.sentSeq += 1;
+        stream.mirror?.feed(chunk);
+        const data = { terminal_id: terminalId, data: chunk.toString("base64") };
+        this.dependencies.send({ ...event(CHANNEL_TERMINAL, OP_DATA, data), seq: stream.sentSeq });
+        stream.window.recordSent(chunk.length);
+        if (!stream.window.isOpen() && !stream.paused) {
+          stream.paused = true;
+          stream.session.pause();
+          logger.debug("Terminal window full, reads paused", { terminal_id: terminalId });
+        }
+      }
+      acknowledge(envelope) {
+        const parsed = TerminalAckSchema.safeParse(envelope.payload);
+        if (!parsed.success) return;
+        const stream = this.streams.get(parsed.data.terminal_id);
+        if (!stream) return;
+        stream.window.recordAck(parsed.data.ack_bytes);
+        if (stream.paused && stream.window.isOpen()) {
+          stream.paused = false;
+          if (this.suspended) return;
+          stream.session.resume();
+          logger.debug("Terminal window reopened, reads resumed", { terminal_id: parsed.data.terminal_id });
+        }
+      }
+      closeFromDashboard(envelope) {
+        const parsed = TerminalCloseSchema.safeParse(envelope.payload);
+        if (!parsed.success) return;
+        const session = this.dependencies.registry.remove(parsed.data.terminal_id);
+        if (!session) return;
+        const stream = this.streams.get(parsed.data.terminal_id);
+        this.forgetStream(parsed.data.terminal_id);
+        stream?.splitter.dispose();
+        logger.info("Terminal closed by the dashboard", { terminal_id: parsed.data.terminal_id, pid: session.pid });
+        try {
+          session.kill();
+        } catch {
+        }
+      }
+      /**
+       * The tabs watching this shell changed size. Clamped like `open`, and a gone shell is ignored.
+       * The pty is resized only on an actual change: every call is a `TIOCSWINSZ` and a SIGWINCH, and
+       * a full-screen program redraws on each one.
+       */
+      resize(envelope) {
+        const parsed = TerminalResizeSchema.safeParse(envelope.payload);
+        if (!parsed.success) return;
+        const session = this.dependencies.registry.get(parsed.data.terminal_id);
+        if (!session) return;
+        this.markActive(parsed.data.terminal_id);
+        const cols = clampGrid(parsed.data.cols, session.cols);
+        const rows = clampGrid(parsed.data.rows, session.rows);
+        if (cols === session.cols && rows === session.rows) return;
+        try {
+          session.resize(cols, rows);
+          this.streams.get(parsed.data.terminal_id)?.mirror?.resize(cols, rows);
+        } catch (err) {
+          logger.debug("Terminal resize failed", { terminal_id: parsed.data.terminal_id, error: errorName2(err) });
+        }
+      }
+      /** Keystrokes, written as raw bytes. A gone shell is ignored. Never logged: this is what a person typed. */
+      input(envelope) {
+        const parsed = TerminalInputSchema.safeParse(envelope.payload);
+        if (!parsed.success) return;
+        const session = this.dependencies.registry.get(parsed.data.terminal_id);
+        if (!session) return;
+        this.markActive(parsed.data.terminal_id);
+        try {
+          session.write(Buffer.from(parsed.data.data, "base64"));
+        } catch (err) {
+          logger.debug("Terminal write failed", { terminal_id: parsed.data.terminal_id, error: errorName2(err) });
+        }
+      }
+      /** 1 allowlisted signal to the foreground process group. Anything else fails to parse and is dropped. */
+      signal(envelope) {
+        const parsed = TerminalSignalSchema.safeParse(envelope.payload);
+        if (!parsed.success) {
+          logger.debug("Ignoring a terminal signal outside the allowlist");
+          return;
+        }
+        const session = this.dependencies.registry.get(parsed.data.terminal_id);
+        if (!session) return;
+        this.markActive(parsed.data.terminal_id);
+        session.signalForeground(parsed.data.signal);
+      }
+      markActive(terminalId) {
+        const stream = this.streams.get(terminalId);
+        if (stream) stream.lastActivityMillis = this.nowMillis();
+      }
+      /**
+       * Removed from the registry before the kill, so its exit callback finds nothing and sends no
+       * `user_closed`. The output already read goes out first, then `close` with the reason.
+       */
+      expire(terminalId, reason) {
+        const session = this.dependencies.registry.remove(terminalId);
+        const stream = this.streams.get(terminalId);
+        this.forgetStream(terminalId);
+        stream?.splitter.flush();
+        stream?.splitter.dispose();
+        if (!session) return;
+        logger.info("Terminal expired", { terminal_id: terminalId, pid: session.pid, reason });
+        try {
+          session.kill();
+        } catch {
+        }
+        this.dependencies.send(event(CHANNEL_TERMINAL, OP_CLOSE, { terminal_id: terminalId, reason }));
+      }
+      /**
+       * A tab attached and asked for the screen it missed (slice T6). Answered in parts, each 1 frame,
+       * which the dashboard routes to that tab alone.
+       *
+       * `after_seq` and `after_bytes` are read in the same tick as the request, before the mirror is
+       * asked, so they name exactly the bundles the screen holds. The parts go out even with the window
+       * closed: they are not pty output, so they take no seq and the window never counts them. A request
+       * for a shell that is gone, or a screen too big to send, is not answered; the tab falls back.
+       */
+      async snapshot(envelope) {
+        const parsed = TerminalSnapshotRequestSchema.safeParse(envelope.payload);
+        if (!parsed.success || this.bundleBytes === void 0) return;
+        const { terminal_id: terminalId, snapshot_id: snapshotId } = parsed.data;
+        const stream = this.streams.get(terminalId);
+        if (!stream?.mirror) return;
+        const afterSeq = stream.sentSeq;
+        const afterBytes = stream.window.sent;
+        const screen = await stream.mirror.snapshot();
+        if (!screen || this.suspended || this.streams.get(terminalId) !== stream) return;
+        const parts = splitIntoParts(Buffer.from(screen.text, "utf-8"), this.bundleBytes);
+        parts.forEach((part, index) => {
+          const payload = {
+            terminal_id: terminalId,
+            snapshot_id: snapshotId,
+            part: index,
+            last: index === parts.length - 1,
+            after_seq: afterSeq,
+            after_bytes: afterBytes,
+            cols: screen.cols,
+            rows: screen.rows,
+            data: part.toString("base64")
+          };
+          this.dependencies.send(event(CHANNEL_TERMINAL, OP_SNAPSHOT, payload));
+        });
+        logger.debug("Terminal screen sent", { terminal_id: terminalId, parts: parts.length, after_seq: afterSeq });
+      }
+      /** A shell is gone. The context poll stops with the last one, so an idle agent spawns nothing. */
+      forgetStream(terminalId) {
+        this.streams.get(terminalId)?.mirror?.dispose();
+        this.streams.delete(terminalId);
+        this.contextTracker.forget(terminalId);
+        if (this.streams.size === 0) this.stopContextTimer();
+      }
+      startContextTimer() {
+        if (this.contextTimer || !this.dependencies.readShellContexts) return;
+        this.contextTimer = setInterval(() => void this.pollShellContexts(), SHELL_CONTEXT_POLL_MILLIS);
+        this.contextTimer.unref();
+      }
+      stopContextTimer() {
+        if (this.contextTimer) {
+          clearInterval(this.contextTimer);
+          this.contextTimer = null;
+        }
+      }
+      startExpiryTimer() {
+        if (this.expiryTimer || this.idleTimeoutMillis === void 0 && this.maxSessionMillis === void 0) {
+          return;
+        }
+        this.expiryTimer = setInterval(() => this.expireShells(), EXPIRY_CHECK_MILLIS);
+        this.expiryTimer.unref();
+      }
+      stopExpiryTimer() {
+        if (this.expiryTimer) {
+          clearInterval(this.expiryTimer);
+          this.expiryTimer = null;
+        }
+      }
+      nowMillis() {
+        return this.dependencies.now ? this.dependencies.now() : Date.now();
+      }
+      refuse(envelope, terminalId, code, message) {
+        logger.info("Terminal open refused", { terminal_id: terminalId, code });
+        const refused = { terminal_id: terminalId, error: { code, message } };
+        this.dependencies.send(response(envelope, OP_OPENED, refused));
+      }
+    };
+  }
+});
+
+// src/devices/terminal/terminalRegistry.ts
+var DEFAULT_MAX_TERMINALS, TerminalRegistry;
+var init_terminalRegistry = __esm({
+  "src/devices/terminal/terminalRegistry.ts"() {
+    "use strict";
+    init_cjs_shims();
+    DEFAULT_MAX_TERMINALS = 3;
+    TerminalRegistry = class {
+      constructor() {
+        this.handlesById = /* @__PURE__ */ new Map();
+        this.maxTerminals = DEFAULT_MAX_TERMINALS;
+      }
+      setMaxTerminals(maxTerminals) {
+        if (Number.isInteger(maxTerminals) && maxTerminals > 0) {
+          this.maxTerminals = maxTerminals;
+        }
+      }
+      has(terminalId) {
+        return this.handlesById.has(terminalId);
+      }
+      isFull() {
+        return this.handlesById.size >= this.maxTerminals;
+      }
+      /** False when the id is already taken or the ceiling is reached. The caller then kills the handle. */
+      add(terminalId, handle) {
+        if (this.handlesById.has(terminalId) || this.isFull()) return false;
+        this.handlesById.set(terminalId, handle);
+        return true;
+      }
+      get(terminalId) {
+        return this.handlesById.get(terminalId);
+      }
+      /** Removes and returns the handle. Undefined the second time, so a close runs at most once. */
+      remove(terminalId) {
+        const handle = this.handlesById.get(terminalId);
+        this.handlesById.delete(terminalId);
+        return handle;
+      }
+      /** Every held shell with its id, in the order it was added. */
+      entries() {
+        return [...this.handlesById.entries()];
+      }
+      size() {
+        return this.handlesById.size;
+      }
+      /** Removes every handle before killing any, so no exit callback finds itself still registered. */
+      killAll() {
+        const handles = [...this.handlesById.values()];
+        this.handlesById.clear();
+        for (const handle of handles) {
+          try {
+            handle.kill();
+          } catch {
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/devices/terminal/nodePtyRuntime.ts
+function isPackagedBinary() {
+  return Boolean(process.pkg);
+}
+function isInsideAsarArchive(packageRoot) {
+  if (!process.versions.electron) return false;
+  return packageRoot.split(import_path8.default.sep).some((segment) => segment.endsWith(ASAR_ARCHIVE_SUFFIX));
+}
+function resolveNodePtyRoot() {
+  const resolvedRoot = import_path8.default.dirname(require3.resolve(`${PACKAGE_NAME}/package.json`));
+  if (!isPackagedBinary() && !isInsideAsarArchive(resolvedRoot)) return resolvedRoot;
+  return unpackNodePty(resolvedRoot);
+}
+function requireNodePty(packageRoot) {
+  return require3(packageRoot);
+}
+function spawnHelperPaths(packageRoot) {
+  if (process.platform === "win32") return [];
+  return NATIVE_DIRECTORIES.map((directory) => import_path8.default.join(packageRoot, directory, SPAWN_HELPER_FILE));
+}
+function hasExecutableSpawnHelper(packageRoot) {
+  const helpers = spawnHelperPaths(packageRoot);
+  if (helpers.length === 0) return true;
+  return helpers.some((helper) => {
+    try {
+      const stat = import_fs10.default.statSync(helper);
+      return stat.isFile() && (stat.mode & EXECUTE_BITS) !== 0;
+    } catch {
+      return false;
+    }
+  });
+}
+function makeSpawnHelperExecutable(packageRoot) {
+  for (const helper of spawnHelperPaths(packageRoot)) {
+    try {
+      const stat = import_fs10.default.statSync(helper);
+      if ((stat.mode & EXECUTE_BITS) === 0) {
+        import_fs10.default.chmodSync(helper, EXECUTABLE_MODE);
+      }
+    } catch {
+    }
+  }
+}
+function unpackNodePty(snapshotRoot) {
+  const unpackedRoot = unpackedRootPath(snapshotRoot);
+  if (isLoadable(unpackedRoot)) return unpackedRoot;
+  const stagingRoot = `${unpackedRoot}.${process.pid}`;
+  import_fs10.default.rmSync(stagingRoot, { recursive: true, force: true });
+  try {
+    copyRuntimeFiles(snapshotRoot, stagingRoot);
+    makeSpawnHelperExecutable(stagingRoot);
+    import_fs10.default.renameSync(stagingRoot, unpackedRoot);
+  } catch (error) {
+    import_fs10.default.rmSync(stagingRoot, { recursive: true, force: true });
+    if (!isLoadable(unpackedRoot)) throw error;
+  }
+  return unpackedRoot;
+}
+function unpackedRootPath(snapshotRoot) {
+  const version = readPackageVersion(snapshotRoot);
+  const directoryName = `${PACKAGE_NAME}-${version}-${process.platform}-${process.arch}`;
+  return import_path8.default.join(getPinggyConfigDir(), RUNTIME_DIR_NAME, directoryName);
+}
+function readPackageVersion(packageRoot) {
+  const manifest = JSON.parse(import_fs10.default.readFileSync(import_path8.default.join(packageRoot, "package.json"), "utf8"));
+  return String(manifest.version);
+}
+function isLoadable(packageRoot) {
+  if (!import_fs10.default.existsSync(import_path8.default.join(packageRoot, "package.json"))) return false;
+  return NATIVE_DIRECTORIES.some((directory) => import_fs10.default.existsSync(import_path8.default.join(packageRoot, directory, NATIVE_FILE)));
+}
+function copyRuntimeFiles(sourceRoot, targetRoot) {
+  import_fs10.default.mkdirSync(targetRoot, { recursive: true });
+  copyFile(import_path8.default.join(sourceRoot, "package.json"), import_path8.default.join(targetRoot, "package.json"));
+  copyDirectory(import_path8.default.join(sourceRoot, "lib"), import_path8.default.join(targetRoot, "lib"));
+  for (const directory of NATIVE_DIRECTORIES) {
+    const source = import_path8.default.join(sourceRoot, directory);
+    if (import_fs10.default.existsSync(source)) {
+      copyDirectory(source, import_path8.default.join(targetRoot, directory));
+    }
+  }
+}
+function copyDirectory(sourceDirectory, targetDirectory) {
+  import_fs10.default.mkdirSync(targetDirectory, { recursive: true });
+  for (const entry of import_fs10.default.readdirSync(sourceDirectory, { withFileTypes: true })) {
+    const source = import_path8.default.join(sourceDirectory, entry.name);
+    const target = import_path8.default.join(targetDirectory, entry.name);
+    if (entry.isDirectory()) {
+      copyDirectory(source, target);
+      continue;
+    }
+    copyFile(source, target);
+  }
+}
+function copyFile(source, target) {
+  import_fs10.default.writeFileSync(target, import_fs10.default.readFileSync(source));
+}
+var import_fs10, import_path8, import_module2, require3, PACKAGE_NAME, NATIVE_FILE, SPAWN_HELPER_FILE, EXECUTABLE_MODE, EXECUTE_BITS, RUNTIME_DIR_NAME, ASAR_ARCHIVE_SUFFIX, NATIVE_DIRECTORIES;
+var init_nodePtyRuntime = __esm({
+  "src/devices/terminal/nodePtyRuntime.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_fs10 = __toESM(require("fs"), 1);
+    import_path8 = __toESM(require("path"), 1);
+    import_module2 = require("module");
+    init_configDir();
+    require3 = (0, import_module2.createRequire)(importMetaUrl);
+    PACKAGE_NAME = "node-pty";
+    NATIVE_FILE = "pty.node";
+    SPAWN_HELPER_FILE = "spawn-helper";
+    EXECUTABLE_MODE = 493;
+    EXECUTE_BITS = 73;
+    RUNTIME_DIR_NAME = "runtime";
+    ASAR_ARCHIVE_SUFFIX = ".asar";
+    NATIVE_DIRECTORIES = [
+      import_path8.default.join("build", "Release"),
+      import_path8.default.join("prebuilds", `${process.platform}-${process.arch}`)
+    ];
+  }
+});
+
+// src/devices/terminal/ptySession.ts
+function foregroundProcessGroup(shellPid) {
+  return new Promise((resolve) => {
+    (0, import_child_process3.execFile)("ps", ["-o", "tpgid=", "-p", String(shellPid)], (err, stdout) => {
+      const processGroupId = err ? NaN : Number.parseInt(String(stdout).trim(), 10);
+      resolve(Number.isInteger(processGroupId) && processGroupId > 0 ? processGroupId : null);
+    });
+  });
+}
+async function signalForegroundGroup(shellPid, signal) {
+  if (process.platform === "win32") {
+    logger.debug("Terminal signal ignored on Windows", { pid: shellPid, signal });
+    return;
+  }
+  const processGroupId = await foregroundProcessGroup(shellPid) ?? shellPid;
+  try {
+    process.kill(-processGroupId, `SIG${signal}`);
+  } catch (err) {
+    logger.debug("Terminal signal not delivered", {
+      pid: shellPid,
+      signal,
+      error: err instanceof Error ? err.name : typeof err
+    });
+  }
+}
+function loadNodePty() {
+  if (loadedPty !== void 0) return loadedPty;
+  try {
+    const packageRoot = resolveNodePtyRoot();
+    const pty = requireNodePty(packageRoot);
+    ensureSpawnHelperExecutable(packageRoot);
+    loadedPty = hasExecutableSpawnHelper(packageRoot) ? pty : null;
+  } catch {
+    loadedPty = null;
+  }
+  return loadedPty;
+}
+function isTerminalSupported() {
+  return loadNodePty() !== null;
+}
+function ensureSpawnHelperExecutable(packageRoot) {
+  makeSpawnHelperExecutable(packageRoot ?? resolveNodePtyRoot());
+}
+function resolveCwd(requested) {
+  if (requested) {
+    try {
+      if (import_fs11.default.statSync(requested).isDirectory()) return requested;
+    } catch {
+    }
+  }
+  return import_os7.default.homedir();
+}
+function spawnPty(request2) {
+  const pty = loadNodePty();
+  if (!pty) {
+    throw new Error("node-pty is not available on this machine");
+  }
+  const process_ = pty.spawn(request2.shell, [], {
+    name: TERM_NAME,
+    cols: request2.cols,
+    rows: request2.rows,
+    cwd: resolveCwd(request2.cwd),
+    env: { ...process.env, TERM: TERM_NAME },
+    // Buffers rather than strings. node-pty decodes per read otherwise, and a read that ends
+    // mid-character yields a replacement character the browser can never recover.
+    encoding: null
+  });
+  return {
+    pid: process_.pid,
+    shell: request2.shell,
+    get cols() {
+      return process_.cols;
+    },
+    get rows() {
+      return process_.rows;
+    },
+    kill: () => process_.kill(),
+    onExit: (listener) => {
+      process_.onExit(({ exitCode, signal }) => listener(exitCode, signal));
+    },
+    onData: (listener) => {
+      process_.onData((chunk) => {
+        listener(typeof chunk === "string" ? Buffer.from(chunk, "utf8") : chunk);
+      });
+    },
+    pause: () => process_.pause(),
+    resume: () => process_.resume(),
+    resize: (cols, rows) => process_.resize(cols, rows),
+    write: (bytes) => process_.write(bytes),
+    signalForeground: (signal) => {
+      void signalForegroundGroup(process_.pid, signal);
+    }
+  };
+}
+var import_child_process3, import_fs11, import_os7, loadedPty, TERM_NAME;
+var init_ptySession = __esm({
+  "src/devices/terminal/ptySession.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_child_process3 = require("child_process");
+    import_fs11 = __toESM(require("fs"), 1);
+    import_os7 = __toESM(require("os"), 1);
+    init_logger();
+    init_nodePtyRuntime();
+    TERM_NAME = "xterm-256color";
+  }
+});
+
+// src/devices/terminal/shellAllowlist.ts
+function readShellEnvironment() {
+  let etcShells = null;
+  try {
+    etcShells = import_fs12.default.readFileSync(ETC_SHELLS_PATH, "utf8");
+  } catch {
+    etcShells = null;
+  }
+  return {
+    platform: process.platform,
+    loginShell: process.env.SHELL,
+    etcShells,
+    exists: (path12) => {
+      try {
+        return import_fs12.default.statSync(path12).isFile();
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+function parseEtcShells(contents) {
+  return contents.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.startsWith("/"));
+}
+function allowedShells(environment) {
+  if (environment.platform === "win32") return WINDOWS_SHELLS;
+  const listed = environment.etcShells === null ? [] : parseEtcShells(environment.etcShells);
+  return listed.length > 0 ? listed : FALLBACK_UNIX_SHELLS;
+}
+function resolveShell(requested, environment) {
+  const allowed = allowedShells(environment);
+  const usable = (shell) => environment.platform === "win32" || environment.exists(shell);
+  if (requested !== null && requested !== void 0) {
+    if (allowed.includes(requested) && usable(requested)) {
+      return { shell: requested };
+    }
+    return { error: "That shell is not allowed on this machine." };
+  }
+  const loginShell = environment.loginShell;
+  if (loginShell && allowed.includes(loginShell) && usable(loginShell)) {
+    return { shell: loginShell };
+  }
+  const firstUsable = allowed.find(usable);
+  return firstUsable ? { shell: firstUsable } : { error: "No allowed shell exists on this machine." };
+}
+var import_fs12, FALLBACK_UNIX_SHELLS, WINDOWS_SHELLS, ETC_SHELLS_PATH;
+var init_shellAllowlist = __esm({
+  "src/devices/terminal/shellAllowlist.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_fs12 = __toESM(require("fs"), 1);
+    FALLBACK_UNIX_SHELLS = ["/bin/bash", "/bin/zsh", "/bin/sh", "/usr/bin/bash", "/usr/bin/zsh"];
+    WINDOWS_SHELLS = ["powershell.exe", "cmd.exe"];
+    ETC_SHELLS_PATH = "/etc/shells";
+  }
+});
+
+// src/devices/deviceAgent.ts
+function buildCapabilities(terminalSupported, screenRestoreSupported = false) {
+  if (!terminalSupported) return BASE_CAPABILITIES;
+  return screenRestoreSupported ? [...BASE_CAPABILITIES, CAPABILITY_TERMINAL, CAPABILITY_TERMINAL_SNAPSHOT] : [...BASE_CAPABILITIES, CAPABILITY_TERMINAL];
+}
+function buildDeviceAgentWsUrl(manage) {
+  let baseUrl = (manage || DEFAULT_SERVER).trim();
+  if (!(baseUrl.startsWith("ws://") || baseUrl.startsWith("wss://"))) {
+    baseUrl = "wss://" + baseUrl;
+  }
+  return `${baseUrl.replace(/\/$/, "")}/backend/api/v1/device-agent/ws/connect`;
+}
+function sleep2(millis, state) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => {
+      state.cancelPendingSleep = null;
+      resolve();
+    }, millis);
+    state.cancelPendingSleep = () => {
+      clearTimeout(timer);
+      state.cancelPendingSleep = null;
+      resolve();
+    };
+  });
+}
+function buildHello(terminalHandler) {
+  return {
+    agent_version: getVersion(),
+    os: import_os8.default.platform(),
+    hostname: import_os8.default.hostname(),
+    capabilities: buildCapabilities(isTerminalSupported(), isScreenMirrorSupported()),
+    terminals: terminalHandler.held()
+  };
+}
+function startMetricsReporting(intervalSeconds, collect, send) {
+  let stopped = false;
+  const report = () => {
+    collect().then((metrics) => {
+      if (!stopped) send(metrics);
+    }).catch((err) => logger.warn("Device metrics collection failed", { error: String(err) }));
+  };
+  report();
+  const timer = setInterval(report, intervalSeconds * 1e3);
+  return () => {
+    stopped = true;
+    clearInterval(timer);
+  };
+}
+function identityForRun(token, server, stored) {
+  if (stored?.token === token) {
+    return { ...stored, server };
+  }
+  return { device_agent_id: null, token, server, enrolled_at: null };
+}
+function startDeviceAgent(token, manage, options = {}) {
+  const server = manage || DEFAULT_SERVER;
+  const reporter = options.reporter ?? printingReporter;
+  const stored = readDeviceIdentity();
+  if (stored?.device_agent_id && stored.token !== token) {
+    reporter.replacingDevice(stored.device_agent_id);
+  }
+  const connection = { send: null, close: null };
+  const context = {
+    wsUrl: buildDeviceAgentWsUrl(manage),
+    server,
+    identity: identityForRun(token, server, stored),
+    reconnectPolicy: options.reconnectPolicy ?? new ReconnectPolicy(),
+    handshakeTimeoutMillis: options.handshakeTimeoutMillis ?? HANDSHAKE_TIMEOUT_MILLIS,
+    terminalHandler: new TerminalHandler({
+      send: (frame) => connection.send?.(frame),
+      spawn: spawnPty,
+      resolveShell: (requested) => resolveShell(requested, readShellEnvironment()),
+      registry: new TerminalRegistry(),
+      readShellContexts: processTableReader(),
+      resolvedHome: resolvedHomeDirectory()
+    }),
+    connection,
+    reporter,
+    writeIdentity: options.writeIdentity ?? writeDeviceIdentity,
+    options,
+    state: { stopRequested: false, cancelPendingSleep: null, error: null, welcomed: false }
+  };
+  const done = runLoop(context);
+  return {
+    done,
+    stop: () => {
+      context.state.stopRequested = true;
+      context.state.cancelPendingSleep?.();
+      connection.close?.();
+      return done;
+    }
+  };
+}
+async function runDeviceAgent(token, manage, options = {}) {
+  const run2 = startDeviceAgent(token, manage, options);
+  const sigintHandler = () => {
+    void run2.stop();
+  };
+  process.once("SIGINT", sigintHandler);
+  try {
+    await run2.done;
+  } finally {
+    process.removeListener("SIGINT", sigintHandler);
+  }
+}
+async function runLoop(context) {
+  const { state, reporter, reconnectPolicy } = context;
+  while (!state.stopRequested) {
+    reporter.connecting(context.server);
+    const outcome = await connectOnce(context);
+    if (outcome === "terminal" || state.stopRequested) {
+      break;
+    }
+    if (context.options.verifyOnly) {
+      state.error = {
+        code: AGENT_ERROR_NOT_CONNECTED,
+        message: `Could not connect to ${context.server}. Check the address and the network, then try again.`
+      };
+      break;
+    }
+    const delayMillis = reconnectPolicy.nextDelayMillis();
+    reporter.reconnecting(delayMillis, reconnectPolicy.attempt);
+    await sleep2(delayMillis, state);
+  }
+  context.terminalHandler.closeAll();
+  return { error: state.error, welcomed: state.welcomed };
+}
+function fail(context, error) {
+  context.state.error = error;
+  context.reporter.failed(error);
+  return "terminal";
+}
+function connectOnce(context) {
+  const { identity, reconnectPolicy, terminalHandler, connection, reporter, state, options } = context;
+  return new Promise((resolve) => {
+    const ws = new import_ws3.default(context.wsUrl, { headers: { [TOKEN_HEADER]: identity.token } });
+    let heartbeat = null;
+    let stopMetrics = null;
+    let stopTunnels = null;
+    let pingTimer = null;
+    let pongDeadline = null;
+    let handshakeDeadline = null;
+    let closeDeadline = null;
+    let settled = false;
+    const stopTimers = () => {
+      if (heartbeat) clearInterval(heartbeat);
+      heartbeat = null;
+      stopMetrics?.();
+      stopMetrics = null;
+      stopTunnels?.();
+      stopTunnels = null;
+      if (pingTimer) clearInterval(pingTimer);
+      pingTimer = null;
+      if (pongDeadline) clearTimeout(pongDeadline);
+      pongDeadline = null;
+      if (handshakeDeadline) clearTimeout(handshakeDeadline);
+      handshakeDeadline = null;
+    };
+    const finish = (outcome) => {
+      if (settled) return;
+      settled = true;
+      stopTimers();
+      if (closeDeadline) clearTimeout(closeDeadline);
+      closeDeadline = null;
+      if (reconnectPolicy.markDisconnected()) {
+        logger.info("Connection held long enough to reset the reconnect schedule");
+      }
+      connection.send = null;
+      connection.close = null;
+      terminalHandler.suspend();
+      resolve(outcome);
+    };
+    const sendFrame = (frame) => {
+      if (ws.readyState === import_ws3.default.OPEN) {
+        ws.send(JSON.stringify(frame));
+      }
+    };
+    const dropDeadSocket = (message) => {
+      logger.warn(message);
+      reporter.warn(message);
+      ws.terminate();
+    };
+    connection.close = () => {
+      if (ws.readyState === import_ws3.default.CONNECTING) {
+        ws.terminate();
+        return;
+      }
+      ws.close(CLOSE_CODE_NORMAL);
+      closeDeadline = setTimeout(() => ws.terminate(), CLOSE_TIMEOUT_MILLIS);
+    };
+    ws.once("open", () => {
+      logger.info("Device agent socket open, sending hello");
+      connection.send = sendFrame;
+      sendFrame(request(CHANNEL_SYSTEM, OP_HELLO, buildHello(terminalHandler)));
+      handshakeDeadline = setTimeout(() => {
+        dropDeadSocket("No welcome from the dashboard. Reconnecting.");
+      }, context.handshakeTimeoutMillis);
+    });
+    const startPongWatchdog = (intervalSeconds) => {
+      const intervalMillis = intervalSeconds * 1e3;
+      const graceMillis = intervalMillis * PONG_GRACE_INTERVALS;
+      const armDeadline = () => {
+        if (pongDeadline) clearTimeout(pongDeadline);
+        pongDeadline = setTimeout(() => {
+          dropDeadSocket("Connection stopped answering. Reconnecting.");
+        }, graceMillis);
+      };
+      ws.on("pong", armDeadline);
+      pingTimer = setInterval(() => {
+        if (ws.readyState === import_ws3.default.OPEN) {
+          ws.ping();
+        }
+      }, intervalMillis);
+      armDeadline();
+    };
+    const startHeartbeat = (intervalSeconds) => {
+      heartbeat = setInterval(
+        () => sendFrame(
+          event(CHANNEL_SYSTEM, OP_HEARTBEAT, { uptime_seconds: Math.floor(import_os8.default.uptime()) })
+        ),
+        intervalSeconds * 1e3
+      );
+    };
+    const onWelcome = (welcome) => {
+      stopTimers();
+      if (options.verifyOnly) {
+        state.stopRequested = true;
+        connection.close?.();
+        return;
+      }
+      reconnectPolicy.markConnected();
+      terminalHandler.configure(
+        welcome.terminal_enabled,
+        welcome.max_terminals_per_device,
+        welcome.terminal_window_bytes,
+        welcome.max_frame_bytes,
+        welcome.terminal_idle_timeout_seconds,
+        welcome.terminal_max_session_seconds
+      );
+      terminalHandler.resumeAll();
+      startHeartbeat(welcome.heartbeat_interval_seconds);
+      startPongWatchdog(welcome.heartbeat_interval_seconds);
+      sendFrame(event(CHANNEL_DEVICE, OP_INFO, collectSystemInfo()));
+      stopMetrics = startMetricsReporting(
+        welcome.stats_interval_seconds,
+        collectMetrics,
+        (metrics) => sendFrame(event(CHANNEL_DEVICE, OP_METRICS, metrics))
+      );
+      stopTunnels = startTunnelReporting(
+        () => collectTunnelList(options.tunnelListSource),
+        (tunnels) => sendFrame(event(CHANNEL_DEVICE, OP_TUNNELS, tunnels))
+      );
+    };
+    ws.on("message", (data) => {
+      const envelope = parseEnvelope(data.toString("utf8"));
+      if (!envelope) {
+        logger.debug("Ignoring unparseable frame");
+        return;
+      }
+      if (envelope.ch === CHANNEL_TERMINAL) {
+        terminalHandler.handle(envelope);
+        return;
+      }
+      if (envelope.ch === CHANNEL_TUNNEL) {
+        void handleTunnelAction(envelope, (frame) => connection.send?.(frame), options.tunnelActions).then(() => stopTunnels?.pollNow());
+        return;
+      }
+      const outcome = handleFrame(envelope, context, onWelcome);
+      if (outcome === "terminal") {
+        finish("terminal");
+        ws.close();
+      }
+    });
+    ws.on("unexpected-response", (_req, res) => {
+      if (res.statusCode === 401) {
+        finish(fail(context, {
+          code: AGENT_ERROR_UNAUTHORIZED,
+          message: "Unauthorized. This device token is not valid. Re-enrol this machine with: pinggy device login"
+        }));
+      } else {
+        reporter.warn(`Unexpected HTTP ${res.statusCode}.`);
+        finish("retry");
+      }
+      ws.close();
+    });
+    ws.on("close", (code, reason) => {
+      logger.info("Device agent socket closed", { code, reason: reason.toString() });
+      finish(code === CLOSE_CODE_REVOKED ? "terminal" : "retry");
+    });
+    ws.on("error", (err) => {
+      logger.warn("Device agent socket error", { error: err.message });
+      if (!state.stopRequested) {
+        reporter.warn(err.message);
+      }
+      finish("retry");
+    });
+  });
+}
+function handleFrame(envelope, context, onWelcome) {
+  const { identity, reporter } = context;
+  if (envelope.ch !== CHANNEL_SYSTEM) {
+    logger.debug("Ignoring frame on unknown channel", { channel: envelope.ch });
+    return "retry";
+  }
+  if (envelope.op === OP_WELCOME) {
+    const error = ErrorPayloadSchema.safeParse(envelope.payload);
+    if (error.success) {
+      if (error.data.error.code === ERROR_ALREADY_CONNECTED) {
+        reporter.warn("This device is connected elsewhere. Retrying.");
+        return "retry";
+      }
+      return fail(context, {
+        code: AGENT_ERROR_HANDSHAKE_REFUSED,
+        message: `Handshake refused: ${error.data.error.message}`
+      });
+    }
+    const welcome = WelcomeSchema.safeParse(envelope.payload);
+    if (!welcome.success) {
+      logger.warn("Welcome payload could not be read");
+      return "retry";
+    }
+    identity.device_agent_id = welcome.data.device_agent_id;
+    identity.enrolled_at = identity.enrolled_at ?? (/* @__PURE__ */ new Date()).toISOString();
+    context.writeIdentity(identity);
+    context.state.welcomed = true;
+    reporter.connected(welcome.data);
+    onWelcome(welcome.data);
+    return "retry";
+  }
+  if (envelope.op === OP_DISCONNECT) {
+    const disconnect = DisconnectSchema.safeParse(envelope.payload);
+    const reason = disconnect.success ? disconnect.data.reason : "unknown";
+    const { outcome, message } = describeDisconnect(reason);
+    if (outcome === "retry") {
+      reporter.warn(message);
+      return "retry";
+    }
+    return fail(context, { code: disconnectErrorCode(reason), message });
+  }
+  logger.debug("Ignoring unhandled system op", { op: envelope.op });
+  return "retry";
+}
+function disconnectErrorCode(reason) {
+  return reason in DISCONNECT_MESSAGES ? reason : AGENT_ERROR_DISCONNECTED;
+}
+function describeDisconnect(reason) {
+  if (reason === DISCONNECT_REASON_SHUTDOWN) {
+    return { outcome: "retry", message: "Server is shutting down. Reconnecting." };
+  }
+  return {
+    outcome: "terminal",
+    message: DISCONNECT_MESSAGES[reason] ?? `Disconnected by the dashboard: ${reason}. Re-enrol this device to continue.`
+  };
+}
+var import_ws3, import_os8, CLOSE_CODE_REVOKED, CLOSE_CODE_NORMAL, CLOSE_TIMEOUT_MILLIS, TOKEN_HEADER, DEFAULT_SERVER, ERROR_ALREADY_CONNECTED, AGENT_ERROR_UNAUTHORIZED, AGENT_ERROR_HANDSHAKE_REFUSED, AGENT_ERROR_DISCONNECTED, AGENT_ERROR_NOT_CONNECTED, HANDSHAKE_TIMEOUT_MILLIS, PONG_GRACE_INTERVALS, BASE_CAPABILITIES, CAPABILITY_TERMINAL, CAPABILITY_TERMINAL_SNAPSHOT, DISCONNECT_REASON_SHUTDOWN, DISCONNECT_MESSAGES;
+var init_deviceAgent = __esm({
+  "src/devices/deviceAgent.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_ws3 = __toESM(require("ws"), 1);
+    import_os8 = __toESM(require("os"), 1);
+    init_logger();
+    init_util();
+    init_envelope();
+    init_device_schema();
+    init_deviceIdentity();
+    init_deviceAgentReporter();
+    init_systemInfo();
+    init_metrics();
+    init_tunnelList();
+    init_tunnelActions();
+    init_reconnect();
+    init_terminal_schema();
+    init_terminalHandler();
+    init_screenMirror();
+    init_terminalRegistry();
+    init_ptySession();
+    init_shellAllowlist();
+    init_shellContext();
+    init_deviceAgentReporter();
+    CLOSE_CODE_REVOKED = 4001;
+    CLOSE_CODE_NORMAL = 1e3;
+    CLOSE_TIMEOUT_MILLIS = 3e3;
+    TOKEN_HEADER = "X-Pinggy-Device-Token";
+    DEFAULT_SERVER = "dashboard.pinggy.io";
+    ERROR_ALREADY_CONNECTED = "already_connected";
+    AGENT_ERROR_UNAUTHORIZED = "unauthorized";
+    AGENT_ERROR_HANDSHAKE_REFUSED = "handshake_refused";
+    AGENT_ERROR_DISCONNECTED = "disconnected";
+    AGENT_ERROR_NOT_CONNECTED = "not_connected";
+    HANDSHAKE_TIMEOUT_MILLIS = 3e4;
+    PONG_GRACE_INTERVALS = 2;
+    BASE_CAPABILITIES = ["tunnel", "stats", "tunnel_control", "tunnel_update", "saved_config_update"];
+    CAPABILITY_TERMINAL = "terminal";
+    CAPABILITY_TERMINAL_SNAPSHOT = "terminal_snapshot";
+    DISCONNECT_REASON_SHUTDOWN = "shutdown";
+    DISCONNECT_MESSAGES = {
+      revoked: "Credential revoked. Copy the new install command from the dashboard and run it to reconnect.",
+      deleted: "Device deleted from the dashboard. Add it again to reconnect this machine.",
+      replaced: "This device connected again from another session. Stopping this one."
+    };
+  }
+});
+
+// src/devices/login/login_schema.ts
+var import_zod5, LoginStartedSchema, LoginStatus, LoginAnswerSchema, LoginErrorSchema, LoginErrorType;
+var init_login_schema = __esm({
+  "src/devices/login/login_schema.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_zod5 = require("zod");
+    LoginStartedSchema = import_zod5.z.object({
+      device_code: import_zod5.z.string().min(1),
+      match_code: import_zod5.z.string().min(1).optional(),
+      expires_in_seconds: import_zod5.z.number().int().positive(),
+      poll_interval_seconds: import_zod5.z.number().int().positive()
+    });
+    LoginStatus = {
+      Pending: "pending",
+      MfaRequired: "mfa_required",
+      Approved: "approved"
+    };
+    LoginAnswerSchema = import_zod5.z.object({
+      status: import_zod5.z.enum([LoginStatus.Pending, LoginStatus.MfaRequired, LoginStatus.Approved]),
+      token: import_zod5.z.string().min(1).optional(),
+      device_agent_id: import_zod5.z.string().min(1).optional(),
+      device_name: import_zod5.z.string().optional(),
+      open_url: import_zod5.z.string().optional(),
+      device_url: import_zod5.z.string().optional()
+    });
+    LoginErrorSchema = import_zod5.z.object({
+      error_type: import_zod5.z.string(),
+      errors: import_zod5.z.array(import_zod5.z.string()).default([])
+    });
+    LoginErrorType = {
+      /** A wrong code or authenticator code, with attempts left. Asked again. */
+      InvalidCode: "device_login_invalid_code",
+      /** Expired, ended after too many wrong codes, or already used. */
+      Expired: "device_login_expired",
+      RateLimited: "device_login_rate_limited",
+      InvalidClient: "device_login_invalid_client"
+    };
+  }
+});
+
+// src/devices/login/loginApi.ts
+function buildDashboardHttpUrl(manage) {
+  const address = (manage || DEFAULT_DASHBOARD).trim().replace(/\/+$/, "");
+  const match = SCHEME_PATTERN.exec(address);
+  const host = match ? address.slice(match[0].length) : address;
+  const scheme = match && PLAIN_SCHEMES.has(match[1].toLowerCase()) ? "http" : "https";
+  return `${scheme}://${host}${LOGIN_PATH}`;
+}
+function createDeviceLoginApi(manage, fetchImpl = fetch) {
+  const baseUrl = buildDashboardHttpUrl(manage);
+  async function post(path12, body, schema) {
+    const response2 = await fetchImpl(`${baseUrl}/${path12}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Accept: "application/json" },
+      body: JSON.stringify(body)
+    });
+    const json = await readJson(response2);
+    if (!response2.ok) {
+      const refusal = LoginErrorSchema.safeParse(json);
+      if (refusal.success && refusal.data.errors.length > 0) {
+        throw new DeviceLoginApiError(response2.status, refusal.data.error_type, refusal.data.errors[0]);
+      }
+      throw new DeviceLoginApiError(
+        response2.status,
+        `http_${response2.status}`,
+        `The dashboard answered HTTP ${response2.status}.`
+      );
+    }
+    const answer = schema.safeParse(json);
+    if (!answer.success) {
+      throw new DeviceLoginApiError(
+        response2.status,
+        UNREADABLE_ANSWER,
+        "The dashboard sent an answer this pinggy cannot read. Update pinggy and try again."
+      );
+    }
+    return answer.data;
+  }
+  return {
+    start: (request2) => post("start", request2, LoginStartedSchema),
+    verifyCode: (deviceCode, code) => post("verify-code", { device_code: deviceCode, code }, LoginAnswerSchema),
+    verifyMfa: (deviceCode, totp) => post("verify-mfa", { device_code: deviceCode, totp }, LoginAnswerSchema),
+    poll: (deviceCode) => post("poll", { device_code: deviceCode }, LoginAnswerSchema)
+  };
+}
+async function readJson(response2) {
+  const text = await response2.text();
+  if (!text) {
+    return void 0;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+var DEVICE_LOGIN_CLIENT_TOKEN, DEFAULT_DASHBOARD, LOGIN_PATH, SCHEME_PATTERN, PLAIN_SCHEMES, DeviceLoginApiError, UNREADABLE_ANSWER;
+var init_loginApi = __esm({
+  "src/devices/login/loginApi.ts"() {
+    "use strict";
+    init_cjs_shims();
+    init_login_schema();
+    DEVICE_LOGIN_CLIENT_TOKEN = "pinggy-cli-1";
+    DEFAULT_DASHBOARD = "dashboard.pinggy.io";
+    LOGIN_PATH = "/backend/api/v1/device-agent/login";
+    SCHEME_PATTERN = /^(wss?|https?):\/\//i;
+    PLAIN_SCHEMES = /* @__PURE__ */ new Set(["ws", "http"]);
+    DeviceLoginApiError = class extends Error {
+      constructor(status, errorType, message) {
+        super(message);
+        this.status = status;
+        this.errorType = errorType;
+        this.name = "DeviceLoginApiError";
+      }
+    };
+    UNREADABLE_ANSWER = "invalid_answer";
+  }
+});
+
+// src/devices/login/prompts.ts
+function createTerminalPrompter(input, output) {
+  return {
+    async ask(question, signal) {
+      const readline = (0, import_promises.createInterface)({ input, output, terminal: true });
+      try {
+        return await readline.question(question, signal ? { signal } : {});
+      } finally {
+        readline.close();
+      }
+    },
+    async askHidden(question, signal) {
+      output.write(question);
+      const readline = (0, import_promises.createInterface)({ input, output: discardingOutput(), terminal: true });
+      try {
+        const answer = await readline.question("", signal ? { signal } : {});
+        output.write("\n");
+        return answer;
+      } finally {
+        readline.close();
+      }
+    }
+  };
+}
+function isInteractiveTerminal() {
+  return process.stdin.isTTY === true;
+}
+function discardingOutput() {
+  return new import_stream.Writable({
+    write(_chunk, _encoding, callback) {
+      callback();
+    }
+  });
+}
+var import_promises, import_stream, terminalPrompter;
+var init_prompts = __esm({
+  "src/devices/login/prompts.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_promises = require("readline/promises");
+    import_stream = require("stream");
+    terminalPrompter = createTerminalPrompter(process.stdin, process.stdout);
+  }
+});
+
+// src/devices/login/deviceLogin.ts
+function machineDeviceLoginDependencies() {
+  return {
+    createApi: (manage) => createDeviceLoginApi(manage),
+    prompter: terminalPrompter,
+    isInteractive: isInteractiveTerminal,
+    readIdentity: readDeviceIdentity,
+    writeIdentity: writeDeviceIdentity,
+    runAgent: (token, manage) => runDeviceAgent(token, manage),
+    renderQr: async (url) => (await createQrCodes([url]))[0],
+    machine: () => ({
+      hostname: import_os9.default.hostname(),
+      os: import_os9.default.platform(),
+      arch: import_os9.default.arch(),
+      agent_version: getVersion()
+    }),
+    print: (message) => printer_default.print(message),
+    printError: (message) => printer_default.error(message),
+    sleep: sleepUnlessAborted
+  };
+}
+async function runDeviceLogin(options, dependencies = machineDeviceLoginDependencies()) {
+  if (!dependencies.isInteractive()) {
+    dependencies.printError(NO_TERMINAL_MESSAGE);
+    return EXIT_FAILED;
+  }
+  const stored = dependencies.readIdentity();
+  const manage = options.manage ?? stored?.server;
+  if (stored) {
+    const answer = await dependencies.prompter.ask(
+      `This machine is already enrolled as ${stored.device_agent_id ?? "a device"} on ${stored.server}. Add it again as a new device? [y/N] `
+    );
+    if (!YES_ANSWER.test(answer.trim())) {
+      return await dependencies.runAgent(stored.token, manage) ?? EXIT_OK;
+    }
+  }
+  const email = (await dependencies.prompter.ask("Email: ")).trim();
+  if (!email) {
+    dependencies.printError("An email is required.");
+    return EXIT_FAILED;
+  }
+  const api = dependencies.createApi(manage);
+  let approved;
+  let linkMinutes;
+  try {
+    const started = await api.start({
+      email,
+      client_token: DEVICE_LOGIN_CLIENT_TOKEN,
+      ...dependencies.machine(),
+      ...options.name ? { name: options.name } : {}
+    });
+    linkMinutes = Math.round(started.expires_in_seconds / SECONDS_PER_MINUTE);
+    dependencies.print(`We sent a 6-digit code to ${email}. It works for ${linkMinutes} minutes.`);
+    if (started.match_code) {
+      dependencies.print("Type it below, or click Approve sign-in in the email.");
+      dependencies.print(`If you use the email: approve only if the page shows ${started.match_code}. A different code is someone else's sign-in.`);
+    }
+    approved = await waitForApproval(api, started.device_code, started.poll_interval_seconds, dependencies);
+  } catch (err) {
+    dependencies.printError(messageOf(err, manage));
+    return EXIT_FAILED;
+  }
+  if (!approved.token || !approved.device_agent_id) {
+    dependencies.printError("The dashboard approved the sign-in without a device token. Update pinggy and try again.");
+    return EXIT_FAILED;
+  }
+  dependencies.writeIdentity({
+    device_agent_id: approved.device_agent_id,
+    token: approved.token,
+    server: manage || DEFAULT_SERVER2,
+    enrolled_at: null
+  });
+  dependencies.print(`Signed in as ${email}. Added device ${approved.device_name ?? approved.device_agent_id}.`);
+  await printDeviceLink(approved, linkMinutes, dependencies);
+  return await dependencies.runAgent(approved.token, manage) ?? EXIT_OK;
+}
+async function waitForApproval(api, deviceCode, pollIntervalSeconds, dependencies) {
+  const controller = new AbortController();
+  const prompt = { showing: false };
+  const typed = typeTheCode(api, deviceCode, controller.signal, prompt, dependencies);
+  const polled = pollUntilApproved(
+    api,
+    deviceCode,
+    pollIntervalSeconds * MILLIS_PER_SECOND2,
+    controller.signal,
+    dependencies
+  );
+  typed.catch(() => void 0);
+  polled.catch(() => void 0);
+  try {
+    return await Promise.race([typed, polled]);
+  } finally {
+    controller.abort();
+    if (prompt.showing) {
+      dependencies.print("");
+    }
+  }
+}
+async function typeTheCode(api, deviceCode, signal, prompt, dependencies) {
+  const ask = async (question, hidden = false) => {
+    prompt.showing = true;
+    try {
+      const answer2 = hidden ? dependencies.prompter.askHidden(question, signal) : dependencies.prompter.ask(question, signal);
+      return (await answer2).trim();
+    } finally {
+      prompt.showing = false;
+    }
+  };
+  let answer = null;
+  while (answer === null) {
+    const code = await ask("Code from the email: ");
+    if (code) {
+      answer = await askAgainOnWrongAnswer(() => api.verifyCode(deviceCode, code), dependencies);
+    }
+  }
+  while (answer.status === LoginStatus.MfaRequired) {
+    const totp = await ask("Authenticator code: ", true);
+    if (totp) {
+      answer = await askAgainOnWrongAnswer(() => api.verifyMfa(deviceCode, totp), dependencies) ?? answer;
+    }
+  }
+  if (answer.status === LoginStatus.Pending) {
+    dependencies.print("Approved from the email link. Waiting for the dashboard to finish.");
+    return waitUntilAborted(signal);
+  }
+  if (answer.status !== LoginStatus.Approved) {
+    throw new DeviceLoginApiError(
+      0,
+      "invalid_answer",
+      "The dashboard answered the code with something this pinggy cannot use. Update pinggy and try again."
+    );
+  }
+  return answer;
+}
+async function askAgainOnWrongAnswer(verify, dependencies) {
+  try {
+    return await verify();
+  } catch (err) {
+    if (err instanceof DeviceLoginApiError && err.errorType === LoginErrorType.InvalidCode) {
+      dependencies.printError(err.message);
+      return null;
+    }
+    throw err;
+  }
+}
+async function pollUntilApproved(api, deviceCode, intervalMillis, signal, dependencies) {
+  while (!signal.aborted) {
+    await dependencies.sleep(intervalMillis, signal);
+    if (signal.aborted) {
+      break;
+    }
+    try {
+      const answer = await api.poll(deviceCode);
+      if (answer.status === LoginStatus.Approved) {
+        return answer;
+      }
+    } catch (err) {
+      if (err instanceof DeviceLoginApiError && err.status > 0 && err.status < FIRST_SERVER_ERROR_STATUS) {
+        throw err;
+      }
+    }
+  }
+  throw signal.reason ?? new Error("The poll was stopped.");
+}
+async function printDeviceLink(approved, linkMinutes, dependencies) {
+  let link;
+  if (approved.open_url) {
+    link = approved.open_url;
+    dependencies.print(`Open the device in a browser. This link signs you in once, within ${linkMinutes} minutes:`);
+  } else if (approved.device_url) {
+    link = approved.device_url;
+    dependencies.print("Open the device in a browser:");
+  } else {
+    return;
+  }
+  dependencies.print(`  ${link}`);
+  try {
+    dependencies.print(await dependencies.renderQr(link));
+  } catch {
+  }
+}
+function messageOf(err, manage) {
+  if (err instanceof DeviceLoginApiError) {
+    return err.message;
+  }
+  const cause = err?.cause;
+  const causeText = cause instanceof Error ? `: ${cause.message}` : "";
+  const detail = err instanceof Error ? `${err.message}${causeText}` : String(err);
+  return `Could not reach the dashboard at ${buildDashboardHttpUrl(manage)} (${detail}).`;
+}
+function waitUntilAborted(signal) {
+  return new Promise((_resolve, reject) => {
+    const stop = () => reject(signal.reason ?? new Error("The wait was stopped."));
+    if (signal.aborted) {
+      stop();
+      return;
+    }
+    signal.addEventListener("abort", stop, { once: true });
+  });
+}
+function sleepUnlessAborted(millis, signal) {
+  return new Promise((resolve) => {
+    if (signal.aborted) {
+      resolve();
+      return;
+    }
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve();
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve();
+    }, millis);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+var import_os9, EXIT_OK, EXIT_FAILED, DEFAULT_SERVER2, YES_ANSWER, SECONDS_PER_MINUTE, MILLIS_PER_SECOND2, FIRST_SERVER_ERROR_STATUS, NO_TERMINAL_MESSAGE;
+var init_deviceLogin = __esm({
+  "src/devices/login/deviceLogin.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_os9 = __toESM(require("os"), 1);
+    init_printer();
+    init_util();
+    init_qrCodeGenerator();
+    init_deviceAgent();
+    init_deviceIdentity();
+    init_loginApi();
+    init_login_schema();
+    init_prompts();
+    EXIT_OK = 0;
+    EXIT_FAILED = 1;
+    DEFAULT_SERVER2 = "dashboard.pinggy.io";
+    YES_ANSWER = /^y(es)?$/i;
+    SECONDS_PER_MINUTE = 60;
+    MILLIS_PER_SECOND2 = 1e3;
+    FIRST_SERVER_ERROR_STATUS = 500;
+    NO_TERMINAL_MESSAGE = "pinggy device login needs a terminal to type the email and the code. On a machine without one, add the device in the dashboard and run: pinggy device connect --token <TOKEN>";
+  }
+});
+
+// src/devices/backgroundAgent.ts
+function machineBackgroundAgentDependencies() {
+  return {
+    readIdentity: readDeviceIdentity,
+    findDaemon: getDaemonInfo,
+    ensureDaemon: ensureDaemonRunning,
+    client: (port) => new IPCClient(port, "cli"),
+    verify: (token, manage) => startDeviceAgent(token, manage, {
+      verifyOnly: true,
+      reporter: verifyingReporter
+    }).done,
+    sleep: (millis) => new Promise((resolve) => setTimeout(resolve, millis)),
+    now: () => Date.now(),
+    print: (message) => printer_default.print(message),
+    printSuccess: (message) => printer_default.success(message),
+    printWarning: (message) => printer_default.warn(message),
+    printError: (message) => printer_default.error(message),
+    daemonLogPath: getDaemonLogPath
+  };
+}
+function isAgentRunning(status) {
+  return status.state !== DeviceAgentState.Stopped;
+}
+function differsFromStored(target, stored) {
+  if (!stored?.token) return true;
+  return stored.token !== target.token || stored.server !== (target.manage || DEFAULT_SERVER);
+}
+function olderDaemonMessage(daemon) {
+  if (daemon.host === DaemonHost.APP) {
+    return "The Pinggy app runs an older daemon. Update the Pinggy app, or quit it and run this again.";
+  }
+  return "The running daemon predates background devices. Run pinggy daemon stop, then retry. This stops all running tunnels.";
+}
+async function readBackgroundAgent(dependencies) {
+  const daemon = dependencies.findDaemon();
+  if (!daemon || !isIpcCompatible(daemon)) {
+    return null;
+  }
+  try {
+    return { daemon, status: await dependencies.client(daemon.port).getDeviceAgentStatus() };
+  } catch (err) {
+    logger.debug("No background device agent to read", { error: errorMessage(err) });
+    return null;
+  }
+}
+async function startAgentInBackground(target, dependencies) {
+  if (differsFromStored(target, dependencies.readIdentity())) {
+    const verified = await dependencies.verify(target.token, target.manage);
+    if (verified.error || !verified.welcomed) {
+      dependencies.printError(verified.error?.message ?? "The device did not connect. Nothing changed.");
+      return EXIT_FAILED;
+    }
+  }
+  dependencies.print("Starting the device agent in the background.");
+  let daemon;
+  try {
+    daemon = await dependencies.ensureDaemon();
+  } catch (err) {
+    dependencies.printError(errorMessage(err));
+    return EXIT_FAILED;
+  }
+  const client = dependencies.client(daemon.port);
+  try {
+    const started = await client.startDeviceAgent();
+    if (isErrorResponse(started)) {
+      dependencies.printError(started.message);
+      return EXIT_FAILED;
+    }
+  } catch (err) {
+    dependencies.printError(daemonFailureMessage(err, daemon));
+    return EXIT_FAILED;
+  }
+  return waitUntilConnected(client, daemon, dependencies);
+}
+async function stopAgentInBackground(dependencies) {
+  const reading = await readBackgroundAgent(dependencies);
+  if (!reading || !isAgentRunning(reading.status)) {
+    dependencies.print("No device agent is running in the background.");
+    return EXIT_OK;
+  }
+  if (!await stopReadAgent(reading, dependencies)) {
+    return EXIT_FAILED;
+  }
+  dependencies.printSuccess("Stopped. The device shows offline in the dashboard.");
+  return EXIT_OK;
+}
+async function stopAgentBeforeRemove(dependencies) {
+  const reading = await readBackgroundAgent(dependencies);
+  if (!reading || !isAgentRunning(reading.status)) {
+    return true;
+  }
+  return stopReadAgent(reading, dependencies);
+}
+async function foregroundRefusal(dependencies) {
+  const reading = await readBackgroundAgent(dependencies);
+  if (!reading || !isAgentRunning(reading.status)) {
+    return null;
   }
-  switch (platform2) {
-    case "linux":
-      installSystemd();
-      break;
-    case "darwin":
-      installLaunchd();
-      break;
-    case "win32":
-      installWindows();
-      break;
-    default:
-      console.error(`Unsupported platform: ${platform2}`);
-      process.exit(1);
+  const device = reading.status.deviceAgentId ? `device ${reading.status.deviceAgentId}` : "a device";
+  return `This machine already runs as ${device} in the background. Stop it first: pinggy device stop`;
+}
+async function printBackgroundStatus(dependencies) {
+  const reading = await readBackgroundAgent(dependencies);
+  if (!reading) {
+    return;
+  }
+  dependencies.print(`  Background ${describeAgent(reading)}`);
+  if (reading.status.lastError) {
+    dependencies.print(`  Last error ${reading.status.lastError.message}`);
   }
 }
-function uninstallService() {
-  const platform2 = import_node_os.default.platform();
-  switch (platform2) {
-    case "linux":
-      uninstallSystemd();
-      break;
-    case "darwin":
-      uninstallLaunchd();
-      break;
-    case "win32":
-      uninstallWindows();
-      break;
+function describeAgentForDaemonStatus(status) {
+  switch (status.state) {
+    case DeviceAgentState.Connected:
+      return `connected as ${status.deviceAgentId}`;
+    case DeviceAgentState.Connecting:
+      return "connecting";
+    case DeviceAgentState.Reconnecting:
+      return "reconnecting";
     default:
-      console.error(`Unsupported platform: ${platform2}`);
-      process.exit(1);
+      return "not running";
+  }
+}
+function describeAgent({ daemon, status }) {
+  const host = daemon.host === DaemonHost.APP ? "inside the Pinggy app" : `in the daemon, PID ${daemon.pid}`;
+  switch (status.state) {
+    case DeviceAgentState.Connected:
+      return `connected since ${status.connectedAt}, ${host}`;
+    case DeviceAgentState.Connecting:
+      return `connecting, ${host}`;
+    case DeviceAgentState.Reconnecting:
+      return `reconnecting, ${host}`;
+    default:
+      return "not running";
   }
 }
-var import_node_os, import_node_fs3, import_node_path2, import_node_child_process, SERVICE_LABEL, SYSTEMD_SERVICE_NAME, WINDOWS_TASK_NAME;
-var init_serviceInstaller = __esm({
-  "src/daemon/lifecycle/serviceInstaller.ts"() {
-    "use strict";
-    init_cjs_shims();
-    import_node_os = __toESM(require("os"), 1);
-    import_node_fs3 = __toESM(require("fs"), 1);
-    import_node_path2 = __toESM(require("path"), 1);
-    import_node_child_process = require("child_process");
-    init_logger();
-    SERVICE_LABEL = "io.pinggy.agent";
-    SYSTEMD_SERVICE_NAME = "pinggy";
-    WINDOWS_TASK_NAME = "PinggyDaemon";
+async function stopReadAgent(reading, dependencies) {
+  try {
+    await dependencies.client(reading.daemon.port).stopDeviceAgent();
+    return true;
+  } catch (err) {
+    dependencies.printError(`Could not stop the background device agent: ${errorMessage(err)}`);
+    return false;
   }
-});
-
-// src/utils/helpMessages.ts
-function printDaemonHelp() {
-  console.log("\nUsage: pinggy daemon <command>");
-  console.log("       pinggy d <command>\n");
-  console.log("Commands:");
-  console.log("  start                    Start the daemon process");
-  console.log("  stop                     Stop the daemon (stops all tunnels)");
-  console.log("  status                   Show daemon PID and uptime");
-  console.log("Tunnel operations:");
-  console.log("  pinggy ps                List running tunnels");
-  console.log("  pinggy stop <name|id>    Stop a specific tunnel");
-  console.log("  pinggy attach <name|id>  Re-attach TUI to a tunnel\n");
 }
-function printLogHelp() {
-  console.log("\nUsage: pinggy log <verb> [options]\n");
-  console.log("Commands:");
-  console.log("  level                    Print current log level");
-  console.log("  level debug|info|error   Set log level");
-  console.log("  path                     Print daemon log path");
-  console.log("  path <name|id>           Print tunnel log path\n");
+function daemonFailureMessage(err, daemon) {
+  if (err instanceof IPCHttpError && err.statusCode === HTTP_NOT_FOUND) {
+    return olderDaemonMessage(daemon);
+  }
+  return `Could not reach the daemon: ${errorMessage(err)}`;
 }
-function printConfigHelp() {
-  console.log("\nUsage: pinggy config <command> [name] [options]\n");
-  console.log("Commands:");
-  console.log("  list                           List all saved configs");
-  console.log("  show <name>                    Show config details");
-  console.log("  save <name> [tunnel flags]     Save a tunnel config");
-  console.log("  update <name> [tunnel flags]   Update a saved config");
-  console.log("  delete <name>                  Delete a saved config");
-  console.log("  auto <name>                    Enable auto-start");
-  console.log("  noauto <name>                  Disable auto-start\n");
+async function waitUntilConnected(client, daemon, dependencies) {
+  const deadline = dependencies.now() + CONNECT_WAIT_MILLIS;
+  for (; ; ) {
+    let status;
+    try {
+      status = await client.getDeviceAgentStatus();
+    } catch (err) {
+      dependencies.printError(daemonFailureMessage(err, daemon));
+      return EXIT_FAILED;
+    }
+    if (status.state === DeviceAgentState.Connected) {
+      printRunning(status, daemon, dependencies);
+      return EXIT_OK;
+    }
+    if (status.state === DeviceAgentState.Stopped) {
+      dependencies.printError(status.lastError?.message ?? "The device agent stopped before it connected.");
+      return EXIT_FAILED;
+    }
+    if (dependencies.now() >= deadline) {
+      dependencies.printWarning("Still connecting in the background. Check with: pinggy device status");
+      return EXIT_OK;
+    }
+    await dependencies.sleep(POLL_INTERVAL_MILLIS);
+  }
 }
-function printStartHelp() {
-  console.log("\nUsage: pinggy start <name> [options]\n");
-  console.log("Examples:");
-  console.log("  pinggy start my-tunnel                Start a saved tunnel");
-  console.log("  pinggy start my-tunnel -l 4000        Start with override");
-  console.log("  pinggy start tunnela tunnelb           Start multiple tunnels");
-  console.log("  pinggy start --all                     Start all auto-start tunnels\n");
+function printRunning(status, daemon, dependencies) {
+  dependencies.printSuccess(`Running in the background as device ${status.deviceAgentId}`);
+  if (status.email) {
+    dependencies.print(`Signed in as ${status.email}`);
+  }
+  if (status.deviceUrl) {
+    dependencies.print("Open the device in a browser:");
+    dependencies.print(`  ${status.deviceUrl}`);
+  }
+  if (daemon.host === DaemonHost.APP) {
+    dependencies.print("It runs inside the Pinggy app, and stops when the app quits.");
+  }
+  dependencies.print(`Logs: ${dependencies.daemonLogPath()}`);
+  dependencies.print("Stop it with: pinggy device stop");
 }
-var init_helpMessages = __esm({
-  "src/utils/helpMessages.ts"() {
+var POLL_INTERVAL_MILLIS, CONNECT_WAIT_MILLIS, verifyingReporter;
+var init_backgroundAgent = __esm({
+  "src/devices/backgroundAgent.ts"() {
     "use strict";
     init_cjs_shims();
+    init_logger();
+    init_printer();
+    init_configDir();
+    init_util();
+    init_types();
+    init_daemonManager();
+    init_ipcClient();
+    init_ipcRoutes();
+    init_deviceIdentity();
+    init_deviceAgent();
+    init_deviceAgentReporter();
+    init_deviceLogin();
+    POLL_INTERVAL_MILLIS = 500;
+    CONNECT_WAIT_MILLIS = 15e3;
+    verifyingReporter = {
+      connecting: () => void 0,
+      connected: () => void 0,
+      reconnecting: () => void 0,
+      warn: (message) => printer_default.warn(message),
+      // The caller prints the error the run ends with.
+      failed: () => void 0,
+      replacingDevice: printingReporter.replacingDevice
+    };
   }
 });
 
@@ -7527,7 +10719,7 @@ async function handleDaemon(args) {
       await handleDaemonStop();
       return;
     case "status":
-      handleDaemonStatus();
+      await handleDaemonStatus();
       return;
     case "service-install":
       installService();
@@ -7573,16 +10765,20 @@ async function handleDaemonStop() {
     printer_default.print(import_picocolors6.default.yellow("No daemon is running."));
     return;
   }
+  const agent = await readBackgroundAgent(machineBackgroundAgentDependencies());
   const result = await stopDaemon();
   if (result.ok) {
     printer_default.success("Daemon stopped.");
+    if (agent && isAgentRunning(agent.status)) {
+      printer_default.print("The background device agent stopped too. The device shows offline in the dashboard.");
+    }
   } else if (result.reason === DaemonHost.APP) {
     printer_default.print(import_picocolors6.default.yellow("The Pinggy daemon is running inside the Pinggy desktop app. Please quit the Pinggy app to stop it."));
   } else {
     printer_default.error(result.error);
   }
 }
-function handleDaemonStatus() {
+async function handleDaemonStatus() {
   const info = getDaemonInfo();
   if (!info) {
     printer_default.print(import_picocolors6.default.yellow("No daemon is running. Start with: pinggy daemon start"));
@@ -7603,6 +10799,10 @@ function handleDaemonStatus() {
   if (!isIpcCompatible(info)) {
     printer_default.print(import_picocolors6.default.yellow(`  Warning:   ${ipcMismatchMessage(info)}`));
   }
+  const agent = await readBackgroundAgent(machineBackgroundAgentDependencies());
+  if (agent) {
+    printer_default.print(`  Device:    ${describeAgentForDaemonStatus(agent.status)}`);
+  }
 }
 var import_picocolors6;
 var init_daemonCommandsHandler = __esm({
@@ -7617,6 +10817,7 @@ var init_daemonCommandsHandler = __esm({
     init_serviceInstaller();
     init_helpMessages();
     init_util();
+    init_backgroundAgent();
   }
 });
 
@@ -7882,8 +11083,8 @@ async function followFile(filePath) {
     stream.on("error", () => {
     });
   };
-  watcher = import_node_fs4.default.watch(filePath, { persistent: true }, (event) => {
-    if (event === "change") {
+  watcher = import_node_fs4.default.watch(filePath, { persistent: true }, (event2) => {
+    if (event2 === "change") {
       const stat = import_node_fs4.default.existsSync(filePath) ? import_node_fs4.default.statSync(filePath) : null;
       if (!stat || stat.size < fileSize) {
         fileSize = 0;
@@ -8059,6 +11260,161 @@ var init_restartCommand = __esm({
   }
 });
 
+// src/cli/subcommand/handlers/deviceCommand.ts
+function takeEnvironmentToken() {
+  const value = process.env[DEVICE_AGENT_TOKEN_VARIABLE]?.trim();
+  delete process.env[DEVICE_AGENT_TOKEN_VARIABLE];
+  return value || void 0;
+}
+function resolveConnectTarget(flagToken, environmentToken, manage, stored) {
+  if (flagToken) {
+    return { token: flagToken, manage: manage ?? stored?.server };
+  }
+  if (environmentToken) {
+    return { token: environmentToken, manage };
+  }
+  if (stored?.token) {
+    return { token: stored.token, manage: manage ?? stored.server };
+  }
+  return null;
+}
+async function handleDevice(args, background = machineBackgroundAgentDependencies()) {
+  const environmentToken = takeEnvironmentToken();
+  if (args.length === 0) {
+    printDeviceHelp();
+    return;
+  }
+  const verb = args[0];
+  const flagArgs = args.slice(1);
+  const { values } = parseCliArgs(cliOptions, flagArgs);
+  configureLogger(values);
+  const inBackground = Boolean(values.b);
+  switch (verb) {
+    case DeviceVerb.Login:
+      exitUnlessOk(await handleDeviceLogin(values.manage, values.name, inBackground, background));
+      return;
+    case DeviceVerb.Connect:
+      exitUnlessOk(await handleDeviceConnect(
+        values.token,
+        environmentToken,
+        values.manage,
+        inBackground,
+        background
+      ));
+      return;
+    case DeviceVerb.Stop:
+      exitUnlessOk(await stopAgentInBackground(background));
+      return;
+    case DeviceVerb.Status:
+      await handleDeviceStatus(background);
+      return;
+    case DeviceVerb.Remove:
+      exitUnlessOk(await handleDeviceRemove(background));
+      return;
+    default:
+      if (verb === "help" || verb === "--help" || verb === "-h") {
+        printDeviceHelp();
+        return;
+      }
+      printer_default.error(`Unknown command "${verb}". Valid commands: login, connect, stop, status, remove.`);
+      process.exit(1);
+  }
+}
+function exitUnlessOk(exitCode) {
+  if (exitCode !== EXIT_OK) {
+    process.exit(exitCode);
+  }
+}
+function refuseDevicesSpelling(args) {
+  printer_default.error(devicesSpellingMessage(args));
+  process.exit(1);
+}
+function devicesSpellingMessage(args) {
+  const verbs = Object.values(DeviceVerb);
+  const suggestion = verbs.includes(args[0]) ? args[0] : "--help";
+  return `"pinggy devices" is now "pinggy device". Run: pinggy device ${suggestion}`;
+}
+async function mayRunInForeground(background) {
+  const refusal = await foregroundRefusal(background);
+  if (refusal) {
+    printer_default.error(refusal);
+    return false;
+  }
+  return true;
+}
+async function handleDeviceLogin(manage, name, inBackground, background) {
+  if (!inBackground) {
+    if (!await mayRunInForeground(background)) return EXIT_FAILED;
+    return runDeviceLogin({ manage, name });
+  }
+  return runDeviceLogin({ manage, name }, {
+    ...machineDeviceLoginDependencies(),
+    runAgent: (token, agentManage) => startAgentInBackground({ token, manage: agentManage }, background)
+  });
+}
+async function handleDeviceConnect(flagToken, environmentToken, manage, inBackground, background) {
+  const target = resolveConnectTarget(flagToken, environmentToken, manage, background.readIdentity());
+  if (!target) {
+    printer_default.error("This machine is not enrolled. Sign it in with your email:\n  pinggy device login\nOr add a device in the dashboard, then run:\n  pinggy device connect --token <TOKEN>");
+    return EXIT_FAILED;
+  }
+  if (inBackground) {
+    return startAgentInBackground(target, background);
+  }
+  if (!await mayRunInForeground(background)) return EXIT_FAILED;
+  await runDeviceAgent(target.token, target.manage);
+  return EXIT_OK;
+}
+async function handleDeviceStatus(background) {
+  const identity = background.readIdentity();
+  if (!identity) {
+    printer_default.print("This machine is not enrolled. Run: pinggy device login");
+    return;
+  }
+  printer_default.print(`  Device id  ${identity.device_agent_id ?? import_picocolors9.default.gray("not yet assigned")}`);
+  printer_default.print(`  Server     ${identity.server}`);
+  printer_default.print(`  Token      ${maskToken(identity.token)}`);
+  printer_default.print(`  Enrolled   ${identity.enrolled_at ?? import_picocolors9.default.gray("never")}`);
+  await printBackgroundStatus(background);
+}
+async function handleDeviceRemove(background) {
+  if (!await stopAgentBeforeRemove(background)) {
+    return EXIT_FAILED;
+  }
+  if (clearDeviceIdentity()) {
+    printer_default.success("Local device credential removed.");
+    printer_default.print(import_picocolors9.default.gray("The device still exists in the dashboard. Delete it there to revoke it."));
+  } else {
+    printer_default.print("This machine is not enrolled.");
+  }
+  return EXIT_OK;
+}
+var import_picocolors9, DeviceVerb, DEVICE_AGENT_TOKEN_VARIABLE;
+var init_deviceCommand = __esm({
+  "src/cli/subcommand/handlers/deviceCommand.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_picocolors9 = __toESM(require("picocolors"), 1);
+    init_options();
+    init_parseArgs();
+    init_logger();
+    init_printer();
+    init_helpMessages();
+    init_deviceAgent();
+    init_deviceIdentity();
+    init_deviceLogin();
+    init_backgroundAgent();
+    DeviceVerb = {
+      Login: "login",
+      Connect: "connect",
+      Stop: "stop",
+      Status: "status",
+      Remove: "remove"
+    };
+    DEVICE_AGENT_TOKEN_VARIABLE = "DEVICE_AGENT_TOKEN";
+  }
+});
+
 // src/cli/subcommand/subcommands.ts
 function isSubcommand(rawArgs) {
   return rawArgs.length > 0 && SUBCOMMAND_SET.has(rawArgs[0]);
@@ -8098,6 +11454,12 @@ async function handleSubcommand(rawArgs) {
     case Subcommand.Restart:
       await handleRestart(rest);
       return;
+    case Subcommand.Device:
+      await handleDevice(rest);
+      return;
+    case Subcommand.Devices:
+      refuseDevicesSpelling(rest);
+      return;
   }
 }
 function handleConfig(args) {
@@ -8338,6 +11700,7 @@ var init_subcommands = __esm({
     init_logsCommand();
     init_logCommand();
     init_restartCommand();
+    init_deviceCommand();
     init_tunnelClient();
     init_startCli();
     init_helpMessages();
@@ -8391,7 +11754,7 @@ async function main() {
     printer_default.fatal(error);
   }
 }
-var import_url2, import_process, import_fs8, currentFile, entryFile;
+var import_url2, import_process, import_fs13, currentFile, entryFile;
 var init_main = __esm({
   "src/main.ts"() {
     "use strict";
@@ -8406,7 +11769,7 @@ var init_main = __esm({
     init_handler();
     import_url2 = require("url");
     import_process = require("process");
-    import_fs8 = require("fs");
+    import_fs13 = require("fs");
     init_remoteManagement();
     init_buildAndStartTunnel();
     init_subcommands();
@@ -8416,7 +11779,7 @@ var init_main = __esm({
     currentFile = (0, import_url2.fileURLToPath)(importMetaUrl);
     entryFile = null;
     try {
-      entryFile = import_process.argv[1] ? (0, import_fs8.realpathSync)(import_process.argv[1]) : null;
+      entryFile = import_process.argv[1] ? (0, import_fs13.realpathSync)(import_process.argv[1]) : null;
     } catch (e) {
       entryFile = null;
     }
@@ -8427,8 +11790,8 @@ var init_main = __esm({
 });
 
 // src/daemon/ws/wsProtocol.ts
-function createTunnelEvent(tunnelId, event, payload) {
-  return { type: "tunnel_event", tunnelId, event, payload };
+function createTunnelEvent(tunnelId, event2, payload) {
+  return { type: "tunnel_event", tunnelId, event: event2, payload };
 }
 function parseClientMessage(raw) {
   try {
@@ -8540,7 +11903,7 @@ function parseTunnelLogFilename(filename) {
   const name = parts.slice(1, -1).join("__");
   return { origin, name, tunnelId };
 }
-var import_node_http2, import_node_fs6, import_node_path4, import_ws3, VALID_ORIGINS, UUID_RE, IPCServer;
+var import_node_http2, import_node_fs6, import_node_path4, import_ws4, VALID_ORIGINS, UUID_RE, IPCServer;
 var init_ipcServer = __esm({
   "src/daemon/ipc/ipcServer.ts"() {
     "use strict";
@@ -8548,7 +11911,7 @@ var init_ipcServer = __esm({
     import_node_http2 = __toESM(require("http"), 1);
     import_node_fs6 = __toESM(require("fs"), 1);
     import_node_path4 = __toESM(require("path"), 1);
-    import_ws3 = require("ws");
+    import_ws4 = require("ws");
     init_main();
     init_logger();
     init_tunnelLogger();
@@ -8560,7 +11923,7 @@ var init_ipcServer = __esm({
     init_types();
     init_daemonChild();
     init_stateStore();
-    VALID_ORIGINS = ["app", "cli", "remote"];
+    VALID_ORIGINS = ["app", "cli", "remote", "device"];
     UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
     IPCServer = class {
       constructor() {
@@ -8568,10 +11931,11 @@ var init_ipcServer = __esm({
         this.sessionCounter = 0;
         this.onSessionDisconnect = null;
         this.sessionTracker = null;
+        this.deviceAgentHost = null;
         this.ops = new TunnelOperations();
         this.startedAt = Date.now();
         this.server = import_node_http2.default.createServer(this.handleRequest.bind(this));
-        this.wss = new import_ws3.WebSocketServer({ noServer: true });
+        this.wss = new import_ws4.WebSocketServer({ noServer: true });
         this.routes = this.buildRoutes();
         this.setupWebSocket();
       }
@@ -8585,6 +11949,13 @@ var init_ipcServer = __esm({
       setSessionTracker(st) {
         this.sessionTracker = st;
       }
+      setDeviceAgentHost(host) {
+        this.deviceAgentHost = host;
+      }
+      requireDeviceAgentHost() {
+        if (!this.deviceAgentHost) throw new Error("The device agent is not available in this daemon yet");
+        return this.deviceAgentHost;
+      }
       /**
        * Get all active sessions (for SessionTracker inspection).
        */
@@ -8717,6 +12088,10 @@ var init_ipcServer = __esm({
             }
             return { daemon: daemonPath, tunnels };
           },
+          // The request body is never read: a token or a server in it must not reach the agent.
+          [Route.GetDeviceAgent]: () => this.requireDeviceAgentHost().status(),
+          [Route.StartDeviceAgent]: (_req, ctx) => this.requireDeviceAgentHost().start(ctx.origin),
+          [Route.StopDeviceAgent]: () => this.requireDeviceAgentHost().stop(),
           [Route.Shutdown]: () => {
             logger.info("Daemon shutdown requested via IPC");
             if (getDaemonHost() === DaemonHost.APP) {
@@ -8733,6 +12108,9 @@ var init_ipcServer = __esm({
                 logger.error(`Shutdown step "${label}" failed`, { error: msg });
               }
             };
+            step("stopDeviceAgent", () => {
+              void this.deviceAgentHost?.close();
+            });
             step("removeDaemonInfo", removeDaemonInfo);
             step("clearDaemonState", clearDaemonState);
             step("stopAllTunnels", () => TunnelManager.getInstance().stopAllTunnels());
@@ -8765,8 +12143,8 @@ var init_ipcServer = __esm({
         if (paramMatch) {
           try {
             await this.readBody(req);
-            const response = await paramMatch.invoke();
-            this.sendJson(res, 200, response);
+            const response2 = await paramMatch.invoke();
+            this.sendJson(res, 200, response2);
           } catch (err) {
             const msg = errorMessage(err);
             logger.error("IPC handler error", { route: `${method} ${url}`, error: msg });
@@ -8999,9 +12377,9 @@ var init_ipcServer = __esm({
         session.subscriptions.clear();
         this.sessions.delete(session.id);
       }
-      sendEvent(session, tunnelId, event, payload) {
-        if (session.ws.readyState === import_ws3.WebSocket.OPEN) {
-          const msg = createTunnelEvent(tunnelId, event, payload);
+      sendEvent(session, tunnelId, event2, payload) {
+        if (session.ws.readyState === import_ws4.WebSocket.OPEN) {
+          const msg = createTunnelEvent(tunnelId, event2, payload);
           session.ws.send(JSON.stringify(msg));
         }
       }
@@ -9192,6 +12570,210 @@ var init_sessionTracker = __esm({
   }
 });
 
+// src/daemon/deviceAgentHost.ts
+function stoppedStatus() {
+  return {
+    state: DeviceAgentState.Stopped,
+    deviceAgentId: null,
+    server: null,
+    email: null,
+    deviceUrl: null,
+    startedAt: null,
+    connectedAt: null,
+    startedBy: null,
+    lastError: null
+  };
+}
+function writeIdentityWhileOwned(identity) {
+  const stored = readDeviceIdentity();
+  if (stored && stored.token !== identity.token) {
+    logger.info("Device agent left a newer device.json in place");
+    return;
+  }
+  writeDeviceIdentity(identity);
+}
+function machineDeviceAgentHostDependencies(port, record) {
+  return {
+    readIdentity: readDeviceIdentity,
+    startRun: (identity, reporter) => startDeviceAgent(identity.token, identity.server, {
+      reporter,
+      tunnelListSource: selfTunnelListSource(port),
+      tunnelActions: selfTunnelActionDependencies(port),
+      writeIdentity: writeIdentityWhileOwned
+    }),
+    recordRunning: record.recordRunning,
+    recordStopped: record.recordStopped,
+    now: () => /* @__PURE__ */ new Date()
+  };
+}
+var NOT_ENROLLED_MESSAGE, DeviceAgentHost;
+var init_deviceAgentHost = __esm({
+  "src/daemon/deviceAgentHost.ts"() {
+    "use strict";
+    init_cjs_shims();
+    init_logger();
+    init_deviceIdentity();
+    init_deviceAgent();
+    init_tunnelList();
+    init_tunnelActions();
+    init_types();
+    init_ipcRoutes();
+    NOT_ENROLLED_MESSAGE = "This machine is not enrolled. Sign it in first: pinggy device login";
+    DeviceAgentHost = class {
+      constructor(dependencies) {
+        this.dependencies = dependencies;
+        this.current = null;
+        this.statusValue = stoppedStatus();
+        /** Bumped on every start and stop. A run's reporter whose number is old belongs to a run that ended. */
+        this.generation = 0;
+        /** Set once the daemon shuts down. Nothing starts and nothing more reaches daemon-state.json. */
+        this.closed = false;
+        /** Start and stop chain on this, so 1 finishes before the next begins. */
+        this.queue = Promise.resolve();
+      }
+      status() {
+        return { ...this.statusValue };
+      }
+      /**
+       * Starts the agent on what device.json holds now. A run on the same token and server is left alone.
+       * A run on another is stopped first.
+       */
+      start(startedBy) {
+        return this.exclusive(async () => {
+          if (this.closed) {
+            return this.status();
+          }
+          const identity = this.dependencies.readIdentity();
+          if (!identity?.token) {
+            return newErrorResponse(ErrorCode.DeviceNotEnrolled, NOT_ENROLLED_MESSAGE);
+          }
+          const current = this.current;
+          if (current && current.token === identity.token && current.server === identity.server) {
+            return this.status();
+          }
+          await this.stopCurrent();
+          this.launch(identity, startedBy);
+          return this.status();
+        });
+      }
+      /** Stops the run: the socket closes with 1000 and every shell ends. */
+      stop() {
+        return this.exclusive(async () => {
+          await this.stopCurrent();
+          return this.status();
+        });
+      }
+      /**
+       * The daemon is shutting down. Stops the run at once, outside the queue, and writes nothing to
+       * daemon-state.json: the shutdown deletes that file, and a write after it would bring the file back.
+       */
+      close() {
+        this.closed = true;
+        const current = this.current;
+        this.current = null;
+        this.generation += 1;
+        this.statusValue = { ...this.statusValue, state: DeviceAgentState.Stopped, connectedAt: null };
+        return current ? current.run.stop().then(() => void 0) : Promise.resolve();
+      }
+      exclusive(operation) {
+        const result = this.queue.then(operation);
+        this.queue = result.catch(() => void 0);
+        return result;
+      }
+      launch(identity, startedBy) {
+        this.generation += 1;
+        const generation = this.generation;
+        this.statusValue = {
+          state: DeviceAgentState.Connecting,
+          deviceAgentId: identity.device_agent_id,
+          server: identity.server,
+          email: null,
+          deviceUrl: null,
+          startedAt: this.dependencies.now().toISOString(),
+          connectedAt: null,
+          startedBy,
+          lastError: null
+        };
+        const run2 = this.dependencies.startRun(identity, this.reporterFor(generation));
+        this.current = { run: run2, token: identity.token, server: identity.server };
+        this.dependencies.recordRunning(startedBy);
+        logger.info("Device agent started in the daemon", { startedBy });
+        void run2.done.then((end) => this.onRunEnded(generation, end));
+      }
+      async stopCurrent() {
+        const current = this.current;
+        if (!current) {
+          return;
+        }
+        this.current = null;
+        this.generation += 1;
+        this.statusValue = { ...this.statusValue, state: DeviceAgentState.Stopped, connectedAt: null };
+        if (!this.closed) {
+          this.dependencies.recordStopped();
+        }
+        await current.run.stop();
+        logger.info("Device agent stopped in the daemon");
+      }
+      /** The run ended on its own: the dashboard refused the credential or ended the device. */
+      onRunEnded(generation, end) {
+        if (generation !== this.generation) {
+          return;
+        }
+        this.current = null;
+        this.statusValue = {
+          ...this.statusValue,
+          state: DeviceAgentState.Stopped,
+          connectedAt: null,
+          lastError: end.error
+        };
+        if (!this.closed) {
+          this.dependencies.recordStopped();
+        }
+      }
+      /** Logs every event, and keeps the latest for `GET /device`. Never logs the email or a payload. */
+      reporterFor(generation) {
+        const isCurrent = () => generation === this.generation;
+        let welcomedOnce = false;
+        const notConnected = () => welcomedOnce ? DeviceAgentState.Reconnecting : DeviceAgentState.Connecting;
+        return {
+          connecting: (server) => {
+            if (!isCurrent()) return;
+            this.statusValue = { ...this.statusValue, state: notConnected(), connectedAt: null };
+            logger.info("Device agent connecting", { server });
+          },
+          connected: (welcome) => {
+            if (!isCurrent()) return;
+            welcomedOnce = true;
+            this.statusValue = {
+              ...this.statusValue,
+              state: DeviceAgentState.Connected,
+              deviceAgentId: welcome.device_agent_id,
+              email: welcome.email ?? null,
+              deviceUrl: welcome.device_url ?? null,
+              connectedAt: this.dependencies.now().toISOString()
+            };
+            logger.info("Device agent connected", { deviceAgentId: welcome.device_agent_id });
+          },
+          reconnecting: (delayMillis, attempt) => {
+            if (!isCurrent()) return;
+            this.statusValue = { ...this.statusValue, state: notConnected(), connectedAt: null };
+            logger.warn("Device agent disconnected", { delayMillis, attempt });
+          },
+          warn: (message) => {
+            logger.warn("Device agent warning", { message });
+          },
+          failed: (error) => {
+            logger.error("Device agent ended", { code: error.code });
+          },
+          replacingDevice: (oldDeviceAgentId) => {
+            logger.info("Device agent connects a new device in place of a stored one", { oldDeviceAgentId });
+          }
+        };
+      }
+    };
+  }
+});
+
 // src/daemon/lifecycle/daemonChild.ts
 var daemonChild_exports = {};
 __export(daemonChild_exports, {
@@ -9200,6 +12782,8 @@ __export(daemonChild_exports, {
   removeDaemonInfo: () => removeDaemonInfo,
   runDaemonChild: () => runDaemonChild,
   setDaemonSessionTracker: () => setDaemonSessionTracker,
+  trackDeviceAgentStart: () => trackDeviceAgentStart,
+  trackDeviceAgentStop: () => trackDeviceAgentStop,
   trackIPCTunnelStart: () => trackIPCTunnelStart,
   trackTunnelStart: () => trackTunnelStart,
   trackTunnelStop: () => trackTunnelStop
@@ -9245,6 +12829,29 @@ function trackTunnelStop(tunnelId) {
   persistDaemonState(daemonState);
   sessionTrackerRef?.removeTunnel(tunnelId);
 }
+function trackDeviceAgentStart(startedBy) {
+  daemonState.deviceAgent = { startedAt: (/* @__PURE__ */ new Date()).toISOString(), startedBy };
+  persistDaemonState(daemonState);
+}
+function trackDeviceAgentStop() {
+  if (!daemonState.deviceAgent) return;
+  delete daemonState.deviceAgent;
+  persistDaemonState(daemonState);
+}
+async function restoreCrashedDeviceAgent(host, saved) {
+  try {
+    const result = await host.start(saved.startedBy);
+    if (isErrorResponse(result)) {
+      logger.warn("Crash recovery: device agent not restored", { reason: result.message });
+      trackDeviceAgentStop();
+      return;
+    }
+    logger.info("Crash recovery: device agent restored");
+  } catch (err) {
+    logger.error("Crash recovery: device agent failed to start", { error: errorMessage(err) });
+    trackDeviceAgentStop();
+  }
+}
 function trackIPCTunnelStart(tunnelId, origin, mode = SessionMode.Detached) {
   if (mode === SessionMode.Foreground) return;
   const manager = TunnelManager.getInstance();
@@ -9358,11 +12965,16 @@ async function runDaemonChild(opts = {}) {
   });
   ipcServer.setSessionTracker(sessionTracker);
   setDaemonSessionTracker(sessionTracker);
+  let deviceAgentHost = null;
   let cleanedUp = false;
   const cleanup = () => {
     if (cleanedUp) return;
     cleanedUp = true;
     logger.info("Daemon shutting down");
+    try {
+      void deviceAgentHost?.close();
+    } catch {
+    }
     try {
       removeDaemonInfo();
     } catch {
@@ -9408,6 +13020,15 @@ async function runDaemonChild(opts = {}) {
   }
   try {
     const port = await ipcServer.listen();
+    deviceAgentHost = new DeviceAgentHost(machineDeviceAgentHostDependencies(port, {
+      recordRunning: trackDeviceAgentStart,
+      recordStopped: trackDeviceAgentStop
+    }));
+    ipcServer.setDeviceAgentHost(deviceAgentHost);
+    const crashedDeviceAgent = loadDaemonState()?.deviceAgent;
+    if (crashedDeviceAgent) {
+      daemonState.deviceAgent = crashedDeviceAgent;
+    }
     const info = {
       pid: process.pid,
       port,
@@ -9431,6 +13052,9 @@ async function runDaemonChild(opts = {}) {
     } else {
       logger.info("No auto-start tunnels configured");
     }
+    if (crashedDeviceAgent) {
+      await restoreCrashedDeviceAgent(deviceAgentHost, crashedDeviceAgent);
+    }
     logger.info("Daemon ready", { pid: process.pid, port });
     return {
       pid: process.pid,
@@ -9455,12 +13079,14 @@ var init_daemonChild = __esm({
     init_ipcServer();
     init_sessionTracker();
     init_stateStore();
+    init_deviceAgentHost();
     init_TunnelManager();
     init_logger();
     init_configDir();
     init_tunnelLogger();
     init_configStore();
     init_daemonConfig();
+    init_types();
     init_util();
     init_ipcRoutes();
     daemonState = { tunnels: [], lastUpdated: "" };
@@ -9687,12 +13313,12 @@ var init_daemonManager = __esm({
 });
 
 // src/daemon/ws/wsStream.ts
-var import_ws4, WS_NORMAL_CLOSE, WsStream;
+var import_ws5, WS_NORMAL_CLOSE, WsStream;
 var init_wsStream = __esm({
   "src/daemon/ws/wsStream.ts"() {
     "use strict";
     init_cjs_shims();
-    import_ws4 = require("ws");
+    import_ws5 = require("ws");
     init_logger();
     init_util();
     init_ipcRoutes();
@@ -9721,11 +13347,11 @@ var init_wsStream = __esm({
       }
       // Lifecycle
       async ensureOpen() {
-        if (this.ws && this.ws.readyState === import_ws4.WebSocket.OPEN) return;
+        if (this.ws && this.ws.readyState === import_ws5.WebSocket.OPEN) return;
         this.wsReady = new Promise((resolve) => {
           this.wsResolve = resolve;
         });
-        this.ws = new import_ws4.WebSocket(this.getWsUrl());
+        this.ws = new import_ws5.WebSocket(this.getWsUrl());
         this.ws.on("open", () => {
           if (this.wsResolve) {
             this.wsResolve();
@@ -9782,7 +13408,7 @@ var init_wsStream = __esm({
         this.subscribedTunnels.clear();
       }
       isOpen() {
-        return !!this.ws && this.ws.readyState === import_ws4.WebSocket.OPEN;
+        return !!this.ws && this.ws.readyState === import_ws5.WebSocket.OPEN;
       }
       // Subscriptions
       async subscribe(tunnelId, mode = SessionMode.Foreground) {
@@ -9800,7 +13426,7 @@ var init_wsStream = __esm({
       unsubscribe(tunnelId) {
         const wasSubscribed = this.subscribedTunnels.delete(tunnelId);
         if (!wasSubscribed) return false;
-        if (this.ws && this.ws.readyState === import_ws4.WebSocket.OPEN) {
+        if (this.ws && this.ws.readyState === import_ws5.WebSocket.OPEN) {
           try {
             const msg = { type: "unsubscribe", tunnelId };
             this.ws.send(JSON.stringify(msg));
@@ -9894,8 +13520,8 @@ var init_wsStream = __esm({
           return;
         }
         if (msg.type !== "tunnel_event") return;
-        const { tunnelId, event, payload } = msg;
-        switch (event) {
+        const { tunnelId, event: event2, payload } = msg;
+        switch (event2) {
           case "stats":
             for (const cb of this.callbacks.stats) cb(tunnelId, payload.stats);
             break;
@@ -9939,7 +13565,7 @@ var init_wsStream = __esm({
 });
 
 // src/daemon/daemonHealth.ts
-var RECONNECT_ATTEMPTS, RECONNECT_INTERVAL_MS, HEARTBEAT_INTERVAL_MS, HEARTBEAT_TIMEOUT_MS, HEARTBEAT_FAILURE_THRESHOLD, sleep2, DaemonHealth;
+var RECONNECT_ATTEMPTS, RECONNECT_INTERVAL_MS, HEARTBEAT_INTERVAL_MS, HEARTBEAT_TIMEOUT_MS, HEARTBEAT_FAILURE_THRESHOLD, sleep3, DaemonHealth;
 var init_daemonHealth = __esm({
   "src/daemon/daemonHealth.ts"() {
     "use strict";
@@ -9953,7 +13579,7 @@ var init_daemonHealth = __esm({
     HEARTBEAT_INTERVAL_MS = 5e3;
     HEARTBEAT_TIMEOUT_MS = 2e3;
     HEARTBEAT_FAILURE_THRESHOLD = 2;
-    sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+    sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
     DaemonHealth = class {
       constructor(getIpc, stream) {
         this.getIpc = getIpc;
@@ -10032,7 +13658,7 @@ var init_daemonHealth = __esm({
             } catch {
             }
           }
-          await sleep2(RECONNECT_INTERVAL_MS);
+          await sleep3(RECONNECT_INTERVAL_MS);
           if (this.lost) return;
           const info = getDaemonInfo();
           if (!info) {
@@ -10240,6 +13866,20 @@ var init_tunnelClient = __esm({
         this.assertClient();
         await this.ipc.restartTunnel(tunnelId);
       }
+      // Device agent (`pinggy device connect -b`). The daemon reads the token and the server from
+      // device.json, so none of these takes either.
+      async getDeviceAgentStatus() {
+        this.assertClient();
+        return this.ipc.getDeviceAgentStatus();
+      }
+      async startDeviceAgent() {
+        this.assertClient();
+        return this.ipc.startDeviceAgent();
+      }
+      async stopDeviceAgent() {
+        this.assertClient();
+        return this.ipc.stopDeviceAgent();
+      }
       // Streaming — delegate to WsStream, guarded by daemon-lost
       async attach(tunnelId, mode = SessionMode.Foreground) {
         if (this.health.isLost()) return;
@@ -10379,6 +14019,7 @@ var init_tunnelClient = __esm({
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  DeviceAgentState: () => DeviceAgentState,
   RemoteManagementUnauthorizedError: () => RemoteManagementUnauthorizedError,
   TUNNEL_CONFIG_V1_KEYS: () => TUNNEL_CONFIG_V1_KEYS,
   TunnelClient: () => TunnelClient,
@@ -10505,6 +14146,7 @@ init_TunnelManager();
 init_handler();
 init_tunnelClient();
 init_daemonManager();
+init_ipcRoutes();
 init_logger();
 init_remoteManagement();
 init_types();
@@ -10529,6 +14171,7 @@ verifyAndLoad().catch((err) => {
 });
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  DeviceAgentState,
   RemoteManagementUnauthorizedError,
   TUNNEL_CONFIG_V1_KEYS,
   TunnelClient,