pubblue 0.4.10 → 0.4.12

package/dist/index.js

@@ -11,18 +11,51 @@ import {
   CHANNELS,
   CONTROL_CHANNEL,
   generateMessageId
-} from "./chunk-MW35LBNH.js";
+} from "./chunk-4YTJ2WKF.js";
 
-// src/index.ts
-import * as fs3 from "fs";
-import * as path3 from "path";
-import { createInterface } from "readline/promises";
+// src/lib/cli-error.ts
+import { CommanderError } from "commander";
+var CliError = class extends Error {
+  exitCode;
+  constructor(message, exitCode = 1) {
+    super(message);
+    this.name = "CliError";
+    this.exitCode = exitCode;
+  }
+};
+function failCli(message, exitCode = 1) {
+  throw new CliError(message, exitCode);
+}
+function toCliFailure(error) {
+  if (error instanceof CommanderError) {
+    return {
+      exitCode: error.exitCode,
+      message: ""
+    };
+  }
+  if (error instanceof CliError) {
+    return {
+      exitCode: error.exitCode,
+      message: error.message
+    };
+  }
+  if (error instanceof Error) {
+    return {
+      exitCode: 1,
+      message: error.message
+    };
+  }
+  return {
+    exitCode: 1,
+    message: String(error)
+  };
+}
+
+// src/program.ts
 import { Command } from "commander";
 
-// src/commands/tunnel.ts
-import { fork } from "child_process";
-import * as fs2 from "fs";
-import * as path2 from "path";
+// src/commands/configure.ts
+import { createInterface } from "readline/promises";
 
 // src/lib/config.ts
 import * as fs from "fs";
@@ -78,827 +111,794 @@ function getConfig(homeDir) {
     bridge: saved.bridge
   };
 }
-
-// src/commands/tunnel.ts
-var TEXT_FILE_EXTENSIONS = /* @__PURE__ */ new Set([
-  ".txt",
-  ".md",
-  ".markdown",
-  ".json",
-  ".csv",
-  ".xml",
-  ".yaml",
-  ".yml",
-  ".js",
-  ".mjs",
-  ".cjs",
-  ".ts",
-  ".tsx",
-  ".jsx",
-  ".css",
-  ".scss",
-  ".sass",
-  ".less",
-  ".log"
-]);
-function getMimeType(filePath) {
-  const ext = path2.extname(filePath).toLowerCase();
-  const mimeByExt = {
-    ".html": "text/html; charset=utf-8",
-    ".htm": "text/html; charset=utf-8",
-    ".txt": "text/plain; charset=utf-8",
-    ".md": "text/markdown; charset=utf-8",
-    ".markdown": "text/markdown; charset=utf-8",
-    ".json": "application/json",
-    ".csv": "text/csv; charset=utf-8",
-    ".xml": "application/xml",
-    ".yaml": "application/x-yaml",
-    ".yml": "application/x-yaml",
-    ".png": "image/png",
-    ".jpg": "image/jpeg",
-    ".jpeg": "image/jpeg",
-    ".gif": "image/gif",
-    ".webp": "image/webp",
-    ".svg": "image/svg+xml",
-    ".pdf": "application/pdf",
-    ".zip": "application/zip",
-    ".mp3": "audio/mpeg",
-    ".wav": "audio/wav",
-    ".mp4": "video/mp4"
-  };
-  return mimeByExt[ext] || "application/octet-stream";
+function getTelegramMiniAppUrl(type, id) {
+  const saved = loadConfig();
+  if (!saved?.telegram?.botUsername) return null;
+  return `https://t.me/${saved.telegram.botUsername}?startapp=${type === "pub" ? "p" : "t"}_${id}`;
 }
-function tunnelInfoDir() {
-  const dir = path2.join(
-    process.env.HOME || process.env.USERPROFILE || "/tmp",
-    ".config",
-    "pubblue",
-    "tunnels"
-  );
-  if (!fs2.existsSync(dir)) fs2.mkdirSync(dir, { recursive: true });
-  return dir;
+
+// src/commands/shared.ts
+import * as fs2 from "fs";
+import * as path2 from "path";
+
+// src/lib/api.ts
+var PubApiClient = class {
+  constructor(baseUrl, apiKey) {
+    this.baseUrl = baseUrl;
+    this.apiKey = apiKey;
+  }
+  async request(path6, options = {}) {
+    const url = new URL(path6, this.baseUrl);
+    const res = await fetch(url, {
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${this.apiKey}`,
+        ...options.headers
+      }
+    });
+    const data = await res.json();
+    if (!res.ok) {
+      throw new Error(data.error || `Request failed with status ${res.status}`);
+    }
+    return data;
+  }
+  async create(opts) {
+    return this.request("/api/v1/publications", {
+      method: "POST",
+      body: JSON.stringify(opts)
+    });
+  }
+  async get(slug) {
+    const data = await this.request(`/api/v1/publications/${encodeURIComponent(slug)}`);
+    return data.publication;
+  }
+  async listPage(cursor, limit) {
+    const params = new URLSearchParams();
+    if (cursor) params.set("cursor", cursor);
+    if (limit) params.set("limit", String(limit));
+    const qs = params.toString();
+    return this.request(`/api/v1/publications${qs ? `?${qs}` : ""}`);
+  }
+  async list() {
+    const all = [];
+    let cursor;
+    do {
+      const result = await this.listPage(cursor, 100);
+      all.push(...result.publications);
+      cursor = result.hasMore ? result.cursor : void 0;
+    } while (cursor);
+    return all;
+  }
+  async update(opts) {
+    const { slug, newSlug, ...rest } = opts;
+    const body = { ...rest };
+    if (newSlug) body.slug = newSlug;
+    return this.request(`/api/v1/publications/${encodeURIComponent(slug)}`, {
+      method: "PATCH",
+      body: JSON.stringify(body)
+    });
+  }
+  async remove(slug) {
+    await this.request(`/api/v1/publications/${encodeURIComponent(slug)}`, {
+      method: "DELETE"
+    });
+  }
+};
+
+// src/commands/shared.ts
+function createClient() {
+  const config = getConfig();
+  return new PubApiClient(config.baseUrl, config.apiKey);
 }
-function tunnelInfoPath(tunnelId) {
-  return path2.join(tunnelInfoDir(), `${tunnelId}.json`);
+async function readFromStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks).toString("utf-8").trim();
 }
-function tunnelLogPath(tunnelId) {
-  return path2.join(tunnelInfoDir(), `${tunnelId}.log`);
+function formatVisibility(isPublic) {
+  return isPublic ? "public" : "private";
 }
-function bridgeInfoPath(tunnelId) {
-  return path2.join(tunnelInfoDir(), `${tunnelId}.bridge.json`);
+function resolveVisibilityFlags(opts) {
+  if (opts.public && opts.private) {
+    throw new Error(`Use only one of --public or --private for ${opts.commandName}.`);
+  }
+  if (opts.public) return true;
+  if (opts.private) return false;
+  return void 0;
 }
-function bridgeLogPath(tunnelId) {
-  return path2.join(tunnelInfoDir(), `${tunnelId}.bridge.log`);
+function readFile(filePath) {
+  const resolved = path2.resolve(filePath);
+  if (!fs2.existsSync(resolved)) {
+    failCli(`File not found: ${resolved}`);
+  }
+  return {
+    content: fs2.readFileSync(resolved, "utf-8"),
+    basename: path2.basename(resolved)
+  };
 }
-function createApiClient(configOverride) {
-  const config = configOverride || getConfig();
-  return new TunnelApiClient(config.baseUrl, config.apiKey);
+
+// src/commands/configure.ts
+function readApiKeyFromPrompt() {
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  return rl.question("Enter API key: ").then((answer) => answer.trim()).finally(() => {
+    rl.close();
+  });
 }
-function buildBridgeProcessEnv(bridgeConfig) {
-  const env = { ...process.env };
-  if (!bridgeConfig) return env;
-  const setIfMissing = (key, value) => {
-    if (value === void 0 || value === null) return;
-    const current = env[key];
-    if (typeof current === "string" && current.length > 0) return;
-    env[key] = String(value);
-  };
-  setIfMissing("OPENCLAW_PATH", bridgeConfig.openclawPath);
-  setIfMissing("OPENCLAW_SESSION_ID", bridgeConfig.sessionId);
-  setIfMissing("OPENCLAW_THREAD_ID", bridgeConfig.threadId);
-  if (bridgeConfig.deliver !== void 0) {
-    setIfMissing("OPENCLAW_DELIVER", bridgeConfig.deliver ? "1" : "0");
+async function resolveConfigureApiKey(opts) {
+  if (opts.apiKey && opts.apiKeyStdin) {
+    throw new Error("Use only one of --api-key or --api-key-stdin.");
   }
-  setIfMissing("OPENCLAW_DELIVER_CHANNEL", bridgeConfig.deliverChannel);
-  setIfMissing("OPENCLAW_REPLY_TO", bridgeConfig.replyTo);
-  if (bridgeConfig.deliverTimeoutMs !== void 0) {
-    setIfMissing("OPENCLAW_DELIVER_TIMEOUT_MS", bridgeConfig.deliverTimeoutMs);
+  if (opts.apiKey) {
+    return opts.apiKey.trim();
   }
-  return env;
+  if (opts.apiKeyStdin) {
+    return readFromStdin();
+  }
+  const envKey = process.env.PUBBLUE_API_KEY?.trim();
+  if (envKey) return envKey;
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    throw new Error(
+      "No TTY available. Provide --api-key, --api-key-stdin, or PUBBLUE_API_KEY for configure."
+    );
+  }
+  return readApiKeyFromPrompt();
 }
-async function ensureNodeDatachannelAvailable() {
-  try {
-    await import("node-datachannel");
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    console.error("node-datachannel native module is not available.");
-    console.error("Run `pnpm rebuild node-datachannel` in the cli package and retry.");
-    console.error(`Details: ${message}`);
-    process.exit(1);
+function collectValues(value, previous) {
+  previous.push(value);
+  return previous;
+}
+function parseSetInput(raw) {
+  const sepIndex = raw.indexOf("=");
+  if (sepIndex <= 0 || sepIndex === raw.length - 1) {
+    throw new Error(`Invalid --set entry "${raw}". Use key=value.`);
   }
+  return {
+    key: raw.slice(0, sepIndex).trim(),
+    value: raw.slice(sepIndex + 1).trim()
+  };
 }
-function isDaemonRunning(tunnelId) {
-  const infoPath = tunnelInfoPath(tunnelId);
-  if (!fs2.existsSync(infoPath)) return false;
-  try {
-    const info = JSON.parse(fs2.readFileSync(infoPath, "utf-8"));
-    process.kill(info.pid, 0);
+function parseBooleanValue(raw, key) {
+  const normalized = raw.trim().toLowerCase();
+  if (normalized === "1" || normalized === "true" || normalized === "yes" || normalized === "on")
     return true;
-  } catch {
-    try {
-      fs2.unlinkSync(infoPath);
-    } catch {
-    }
+  if (normalized === "0" || normalized === "false" || normalized === "no" || normalized === "off")
     return false;
-  }
+  throw new Error(`Invalid boolean value for ${key}: ${raw}`);
 }
-function readBridgeProcessInfo(tunnelId) {
-  const infoPath = bridgeInfoPath(tunnelId);
-  if (!fs2.existsSync(infoPath)) return null;
-  try {
-    return JSON.parse(fs2.readFileSync(infoPath, "utf-8"));
-  } catch {
-    return null;
-  }
+function parseBridgeModeValue(raw) {
+  const normalized = raw.trim().toLowerCase();
+  if (normalized === "openclaw" || normalized === "none") return normalized;
+  throw new Error(`Invalid bridge mode: ${raw}. Use openclaw or none.`);
 }
-function isBridgeRunning(tunnelId) {
-  const infoPath = bridgeInfoPath(tunnelId);
-  if (!fs2.existsSync(infoPath)) return false;
-  try {
-    const info = JSON.parse(fs2.readFileSync(infoPath, "utf-8"));
-    process.kill(info.pid, 0);
-    return true;
-  } catch {
-    try {
-      fs2.unlinkSync(infoPath);
-    } catch {
-    }
-    return false;
-  }
-}
-function stopBridgeProcess(tunnelId) {
-  const info = readBridgeProcessInfo(tunnelId);
-  if (!info || !Number.isFinite(info.pid)) return;
-  try {
-    process.kill(info.pid, "SIGTERM");
-  } catch {
-  }
-}
-function buildBridgeForkStdio(logFd) {
-  return ["ignore", logFd, logFd, "ipc"];
-}
-function getFollowReadDelayMs(disconnected, consecutiveFailures) {
-  if (!disconnected) return 1e3;
-  return Math.min(5e3, 1e3 * 2 ** Math.min(consecutiveFailures, 3));
-}
-function resolveTunnelIdSelection(tunnelIdArg, tunnelOpt) {
-  return tunnelOpt || tunnelIdArg;
-}
-function buildDaemonForkStdio(logFd) {
-  return ["ignore", logFd, logFd, "ipc"];
-}
-function parsePositiveIntegerOption(raw, optionName) {
+function parsePositiveInteger(raw, key) {
   const parsed = Number.parseInt(raw, 10);
   if (!Number.isFinite(parsed) || parsed <= 0) {
-    throw new Error(`${optionName} must be a positive integer. Received: ${raw}`);
+    throw new Error(`${key} must be a positive integer. Received: ${raw}`);
   }
   return parsed;
 }
-function parseBridgeMode(raw) {
-  const normalized = raw.trim().toLowerCase();
-  if (normalized === "openclaw" || normalized === "none") {
-    return normalized;
+var SUPPORTED_KEYS = [
+  "bridge.mode",
+  "openclaw.path",
+  "openclaw.sessionId",
+  "openclaw.threadId",
+  "openclaw.canvasReminderEvery",
+  "openclaw.deliver",
+  "openclaw.deliverChannel",
+  "openclaw.replyTo",
+  "openclaw.deliverTimeoutMs",
+  "openclaw.attachmentDir",
+  "openclaw.attachmentMaxBytes",
+  "telegram.botToken"
+];
+function applyConfigSet(bridge, telegram, key, value) {
+  switch (key) {
+    case "bridge.mode":
+      bridge.mode = parseBridgeModeValue(value);
+      return;
+    case "openclaw.path":
+      bridge.openclawPath = value;
+      return;
+    case "openclaw.sessionId":
+      bridge.sessionId = value;
+      return;
+    case "openclaw.threadId":
+      bridge.threadId = value;
+      return;
+    case "openclaw.canvasReminderEvery":
+      bridge.canvasReminderEvery = parsePositiveInteger(value, key);
+      return;
+    case "openclaw.deliver":
+      bridge.deliver = parseBooleanValue(value, key);
+      return;
+    case "openclaw.deliverChannel":
+      bridge.deliverChannel = value;
+      return;
+    case "openclaw.replyTo":
+      bridge.replyTo = value;
+      return;
+    case "openclaw.deliverTimeoutMs":
+      bridge.deliverTimeoutMs = parsePositiveInteger(value, key);
+      return;
+    case "openclaw.attachmentDir":
+      bridge.attachmentDir = value;
+      return;
+    case "openclaw.attachmentMaxBytes":
+      bridge.attachmentMaxBytes = parsePositiveInteger(value, key);
+      return;
+    case "telegram.botToken":
+      telegram.botToken = value;
+      return;
+    default:
+      throw new Error(
+        [
+          `Unknown config key: ${key}`,
+          "Supported keys:",
+          ...SUPPORTED_KEYS.map((k) => `  ${k}`)
+        ].join("\n")
+      );
   }
-  throw new Error(`--bridge must be one of: openclaw, none. Received: ${raw}`);
 }
-function messageContainsPong(payload) {
-  if (!payload || typeof payload !== "object") return false;
-  const message = payload.msg;
-  if (!message || typeof message !== "object") return false;
-  const type = message.type;
-  const data = message.data;
-  return type === "text" && typeof data === "string" && data.trim().toLowerCase() === "pong";
+function applyConfigUnset(bridge, telegram, key) {
+  switch (key) {
+    case "bridge.mode":
+      delete bridge.mode;
+      return;
+    case "openclaw.path":
+      delete bridge.openclawPath;
+      return;
+    case "openclaw.sessionId":
+      delete bridge.sessionId;
+      return;
+    case "openclaw.threadId":
+      delete bridge.threadId;
+      return;
+    case "openclaw.canvasReminderEvery":
+      delete bridge.canvasReminderEvery;
+      return;
+    case "openclaw.deliver":
+      delete bridge.deliver;
+      return;
+    case "openclaw.deliverChannel":
+      delete bridge.deliverChannel;
+      return;
+    case "openclaw.replyTo":
+      delete bridge.replyTo;
+      return;
+    case "openclaw.deliverTimeoutMs":
+      delete bridge.deliverTimeoutMs;
+      return;
+    case "openclaw.attachmentDir":
+      delete bridge.attachmentDir;
+      return;
+    case "openclaw.attachmentMaxBytes":
+      delete bridge.attachmentMaxBytes;
+      return;
+    case "telegram.botToken":
+      delete telegram.botToken;
+      delete telegram.botUsername;
+      delete telegram.hasMainWebApp;
+      return;
+    default:
+      throw new Error(`Unknown config key for --unset: ${key}`);
+  }
 }
-function getPublicTunnelUrl(tunnelId) {
-  const base = process.env.PUBBLUE_PUBLIC_URL || "https://pub.blue";
-  return `${base.replace(/\/$/, "")}/t/${tunnelId}`;
+function hasValues(obj) {
+  return Object.values(obj).some((value) => value !== void 0);
 }
-function pickReusableTunnel(tunnels, nowMs = Date.now()) {
-  const active = tunnels.filter((t) => t.status === "active" && t.expiresAt > nowMs).sort((a, b) => b.createdAt - a.createdAt);
-  return active[0] ?? null;
+function maskSecret(value) {
+  if (value.length <= 8) return "********";
+  return `${value.slice(0, 4)}...${value.slice(-4)}`;
 }
-function readLogTail(logPath, maxChars = 4e3) {
-  if (!fs2.existsSync(logPath)) return null;
-  try {
-    const content = fs2.readFileSync(logPath, "utf-8");
-    if (content.length <= maxChars) return content;
-    return content.slice(-maxChars);
-  } catch {
-    return null;
+async function telegramGetMe(token) {
+  const resp = await fetch(`https://api.telegram.org/bot${token}/getMe`);
+  const data = await resp.json();
+  if (!data.ok || !data.result?.username) {
+    throw new Error(data.description ?? "Invalid bot token");
   }
+  return {
+    username: data.result.username,
+    hasMainWebApp: data.result.has_main_web_app === true
+  };
 }
-function formatApiError(error) {
-  if (error instanceof TunnelApiError) {
-    if (error.status === 429 && error.retryAfterSeconds !== void 0) {
-      return `Rate limit exceeded. Retry after ${error.retryAfterSeconds}s.`;
-    }
-    return `${error.message} (HTTP ${error.status})`;
+async function telegramSetMenuButton(token, url) {
+  const resp = await fetch(`https://api.telegram.org/bot${token}/setChatMenuButton`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      menu_button: { type: "web_app", text: "Open", web_app: { url } }
+    })
+  });
+  const data = await resp.json();
+  if (!data.ok) {
+    throw new Error(data.description ?? "setChatMenuButton failed");
   }
-  return error instanceof Error ? error.message : String(error);
 }
-async function cleanupCreatedTunnelOnStartFailure(apiClient, target) {
-  if (!target.createdNew) return;
-  try {
-    await apiClient.close(target.tunnelId);
-  } catch (closeError) {
-    console.error(
-      `Failed to clean up newly created tunnel ${target.tunnelId}: ${formatApiError(closeError)}`
-    );
+function printConfigSummary(saved) {
+  if (!saved) {
+    console.log("Saved config: none");
+    return;
+  }
+  console.log("Saved config:");
+  console.log(`  apiKey: ${maskSecret(saved.apiKey)}`);
+  if (saved.bridge && hasValues(saved.bridge)) {
+    console.log(`  bridge.mode: ${saved.bridge.mode ?? "(unset)"}`);
+    if (saved.bridge.openclawPath) console.log(`  openclaw.path: ${saved.bridge.openclawPath}`);
+    if (saved.bridge.sessionId) console.log(`  openclaw.sessionId: ${saved.bridge.sessionId}`);
+    if (saved.bridge.threadId) console.log(`  openclaw.threadId: ${saved.bridge.threadId}`);
+    if (saved.bridge.canvasReminderEvery !== void 0)
+      console.log(`  openclaw.canvasReminderEvery: ${saved.bridge.canvasReminderEvery}`);
+    if (saved.bridge.deliver !== void 0)
+      console.log(`  openclaw.deliver: ${saved.bridge.deliver ? "true" : "false"}`);
+    if (saved.bridge.deliverChannel)
+      console.log(`  openclaw.deliverChannel: ${saved.bridge.deliverChannel}`);
+    if (saved.bridge.replyTo) console.log(`  openclaw.replyTo: ${saved.bridge.replyTo}`);
+    if (saved.bridge.deliverTimeoutMs !== void 0)
+      console.log(`  openclaw.deliverTimeoutMs: ${saved.bridge.deliverTimeoutMs}`);
+    if (saved.bridge.attachmentDir)
+      console.log(`  openclaw.attachmentDir: ${saved.bridge.attachmentDir}`);
+    if (saved.bridge.attachmentMaxBytes !== void 0)
+      console.log(`  openclaw.attachmentMaxBytes: ${saved.bridge.attachmentMaxBytes}`);
+  } else {
+    console.log("  bridge: none");
+  }
+  if (saved.telegram?.botToken && saved.telegram.botUsername) {
+    console.log(`  telegram.botToken: ${maskSecret(saved.telegram.botToken)}`);
+    console.log(`  telegram.botUsername: @${saved.telegram.botUsername}`);
+    if (!saved.telegram.hasMainWebApp) {
+      console.log("    INFO: Register Mini App in @BotFather for deep links to open in Telegram");
+    }
+  } else if (saved.telegram?.botToken) {
+    console.log(`  telegram.botToken: ${maskSecret(saved.telegram.botToken)}`);
+    console.log("  telegram.botUsername: (not resolved)");
+  } else {
+    console.log("  telegram: not configured");
+    console.log("    INFO: Set telegram.botToken to enable Telegram Mini App links");
+    console.log("    Example: pubblue configure --set telegram.botToken=<BOT_TOKEN>");
   }
 }
-function registerTunnelCommands(program2) {
-  const tunnel = program2.command("tunnel").description("P2P encrypted tunnel to browser");
-  tunnel.command("start").description("Start a tunnel daemon (reuses existing tunnel when possible)").option("--expires <duration>", "Auto-close after duration (e.g. 4h, 1d)", "24h").option("-t, --tunnel <tunnelId>", "Attach/start daemon for an existing tunnel").option("--new", "Always create a new tunnel (skip single-tunnel reuse)").option("--bridge <mode>", "Bridge mode: openclaw|none").option("--foreground", "Run in foreground (don't fork, no managed bridge)").action(
+function registerConfigureCommand(program2) {
+  program2.command("configure").description("Configure the CLI with your API key").option("--api-key <key>", "Your API key (less secure: appears in shell history)").option("--api-key-stdin", "Read API key from stdin").option(
+    "--set <key=value>",
+    "Set config key (repeatable). Example: --set telegram.botToken=<token>",
+    collectValues,
+    []
+  ).option("--unset <key>", "Unset config key (repeatable)", collectValues, []).option("--show", "Show saved configuration").action(
     async (opts) => {
-      await ensureNodeDatachannelAvailable();
-      const runtimeConfig = getConfig();
-      const apiClient = createApiClient(runtimeConfig);
-      let target = null;
-      let bridgeMode;
-      try {
-        bridgeMode = parseBridgeMode(opts.bridge || runtimeConfig.bridge?.mode || "openclaw");
-      } catch (error) {
-        console.error(error instanceof Error ? error.message : String(error));
-        process.exit(1);
+      const saved = loadConfig();
+      const hasApiUpdate = Boolean(opts.apiKey || opts.apiKeyStdin);
+      const hasSet = opts.set.length > 0;
+      const hasUnset = opts.unset.length > 0;
+      const hasMutation = hasApiUpdate || hasSet || hasUnset;
+      if (!hasMutation && opts.show) {
+        printConfigSummary(saved);
+        return;
       }
-      const bridgeProcessEnv = buildBridgeProcessEnv(runtimeConfig.bridge);
-      if (opts.tunnel) {
-        try {
-          const existing = await apiClient.get(opts.tunnel);
-          if (existing.status === "closed" || existing.expiresAt <= Date.now()) {
-            console.error(`Tunnel ${opts.tunnel} is closed or expired.`);
-            process.exit(1);
-          }
-          target = {
-            createdNew: false,
-            expiresAt: existing.expiresAt,
-            mode: "existing",
-            tunnelId: existing.tunnelId,
-            url: getPublicTunnelUrl(existing.tunnelId)
-          };
-        } catch (error) {
-          console.error(`Failed to use tunnel ${opts.tunnel}: ${formatApiError(error)}`);
-          process.exit(1);
-        }
-      } else if (!opts.new) {
-        try {
-          const listed = await apiClient.list();
-          const active = listed.filter((t) => t.status === "active" && t.expiresAt > Date.now()).sort((a, b) => b.createdAt - a.createdAt);
-          const reusable = pickReusableTunnel(listed);
-          if (reusable) {
-            target = {
-              createdNew: false,
-              expiresAt: reusable.expiresAt,
-              mode: "existing",
-              tunnelId: reusable.tunnelId,
-              url: getPublicTunnelUrl(reusable.tunnelId)
-            };
-            if (active.length > 1) {
-              console.error(
-                [
-                  `Multiple active tunnels found: ${active.map((t) => t.tunnelId).join(", ")}`,
-                  `Reusing most recent active tunnel ${reusable.tunnelId}.`,
-                  "Use --tunnel <id> to choose explicitly or --new to force creation."
-                ].join("\n")
-              );
-            } else {
-              console.error(
-                `Reusing existing active tunnel ${reusable.tunnelId}. Use --new to force creation.`
-              );
-            }
-          }
-        } catch (error) {
-          console.error(`Failed to list tunnels for reuse check: ${formatApiError(error)}`);
-          process.exit(1);
-        }
+      let apiKey = saved?.apiKey;
+      if (hasApiUpdate || !hasMutation) {
+        apiKey = await resolveConfigureApiKey(opts);
       }
-      if (!target) {
-        try {
-          const created = await apiClient.create({
-            expiresIn: opts.expires
-          });
-          target = {
-            createdNew: true,
-            expiresAt: created.expiresAt,
-            mode: "created",
-            tunnelId: created.tunnelId,
-            url: created.url
-          };
-        } catch (error) {
-          console.error(`Failed to create tunnel: ${formatApiError(error)}`);
-          process.exit(1);
+      if (!apiKey) {
+        const envKey = process.env.PUBBLUE_API_KEY?.trim();
+        if (envKey) {
+          apiKey = envKey;
+        } else {
+          throw new Error(
+            "No API key available. Provide --api-key/--api-key-stdin (or run plain `pubblue configure` first)."
+          );
         }
       }
-      if (!target) {
-        console.error("Failed to resolve tunnel target.");
-        process.exit(1);
+      const nextBridge = { ...saved?.bridge ?? {} };
+      const nextTelegram = { ...saved?.telegram ?? {} };
+      let telegramTokenChanged = false;
+      for (const entry of opts.set) {
+        const { key, value } = parseSetInput(entry);
+        applyConfigSet(nextBridge, nextTelegram, key, value);
+        if (key === "telegram.botToken") telegramTokenChanged = true;
       }
-      const socketPath = getSocketPath(target.tunnelId);
-      const infoPath = tunnelInfoPath(target.tunnelId);
-      const logPath = tunnelLogPath(target.tunnelId);
-      if (opts.foreground) {
-        if (bridgeMode !== "none") {
-          console.error(
-            "Foreground mode disables managed bridge process. Use background mode for --bridge openclaw."
-          );
-        }
-        const { startDaemon } = await import("./tunnel-daemon-4LV6HLYN.js");
-        console.log(`Tunnel started: ${target.url}`);
-        console.log(`Tunnel ID: ${target.tunnelId}`);
-        console.log(`Expires: ${new Date(target.expiresAt).toISOString()}`);
-        if (target.mode === "existing") console.log("Mode: attached existing tunnel");
-        console.log("Running in foreground. Press Ctrl+C to stop.");
-        try {
-          await startDaemon({
-            tunnelId: target.tunnelId,
-            apiClient,
-            socketPath,
-            infoPath
-          });
-        } catch (error) {
-          const message = error instanceof Error ? error.message : String(error);
-          console.error(`Daemon failed: ${message}`);
-          process.exit(1);
-        }
-      } else {
-        if (isDaemonRunning(target.tunnelId)) {
-          try {
-            const status = await ipcCall(socketPath, { method: "status", params: {} });
-            if (!status.ok) throw new Error(String(status.error || "status check failed"));
-          } catch (error) {
-            console.error(
-              `Daemon process exists but is not responding: ${error instanceof Error ? error.message : String(error)}`
-            );
-            console.error("Run `pubblue tunnel close <id>` and start again.");
-            process.exit(1);
-          }
-          if (bridgeMode !== "none") {
-            const bridgeReady = await ensureBridgeReady({
-              bridgeMode,
-              tunnelId: target.tunnelId,
-              socketPath,
-              bridgeProcessEnv,
-              timeoutMs: 8e3
-            });
-            if (!bridgeReady.ok) {
-              console.error(
-                `Bridge failed to start for running tunnel: ${bridgeReady.reason ?? "unknown reason"}`
-              );
-              const existingBridgeLog = bridgeLogPath(target.tunnelId);
-              if (fs2.existsSync(existingBridgeLog)) {
-                console.error(`Bridge log: ${existingBridgeLog}`);
-                const bridgeTail = readLogTail(existingBridgeLog);
-                if (bridgeTail) {
-                  console.error("---- bridge log tail ----");
-                  console.error(bridgeTail.trimEnd());
-                  console.error("---- end bridge log tail ----");
-                }
-              }
-              process.exit(1);
-            }
-          }
-          console.log(`Tunnel started: ${target.url}`);
-          console.log(`Tunnel ID: ${target.tunnelId}`);
-          console.log(`Expires: ${new Date(target.expiresAt).toISOString()}`);
-          console.log("Daemon already running for this tunnel.");
-          console.log(`Daemon log: ${logPath}`);
-          if (bridgeMode !== "none") {
-            console.log("Bridge mode: openclaw");
-            console.log(`Bridge log: ${bridgeLogPath(target.tunnelId)}`);
-          }
-          return;
-        }
-        const daemonScript = path2.join(import.meta.dirname, "tunnel-daemon-entry.js");
-        const config = getConfig();
-        const daemonLogFd = fs2.openSync(logPath, "a");
-        const child = fork(daemonScript, [], {
-          detached: true,
-          stdio: buildDaemonForkStdio(daemonLogFd),
-          env: {
-            ...process.env,
-            PUBBLUE_DAEMON_TUNNEL_ID: target.tunnelId,
-            PUBBLUE_DAEMON_BASE_URL: config.baseUrl,
-            PUBBLUE_DAEMON_API_KEY: config.apiKey,
-            PUBBLUE_DAEMON_SOCKET: socketPath,
-            PUBBLUE_DAEMON_INFO: infoPath
-          }
-        });
-        fs2.closeSync(daemonLogFd);
-        if (child.connected) {
-          child.disconnect();
-        }
-        child.unref();
-        console.log(`Starting daemon for tunnel ${target.tunnelId}...`);
-        const ready = await waitForDaemonReady({
-          child,
-          infoPath,
-          socketPath,
-          timeoutMs: 8e3
-        });
-        if (!ready.ok) {
-          console.error(`Daemon failed to start: ${ready.reason ?? "unknown reason"}`);
-          console.error(`Daemon log: ${logPath}`);
-          const tail = readLogTail(logPath);
-          if (tail) {
-            console.error("---- daemon log tail ----");
-            console.error(tail.trimEnd());
-            console.error("---- end daemon log tail ----");
-          }
-          await cleanupCreatedTunnelOnStartFailure(apiClient, target);
-          process.exit(1);
-        }
-        const offerReady = await waitForAgentOffer({
-          apiClient,
-          tunnelId: target.tunnelId,
-          timeoutMs: 5e3
-        });
-        if (!offerReady.ok) {
-          console.error(`Daemon started but signaling is not ready: ${offerReady.reason}`);
-          console.error(`Daemon log: ${logPath}`);
-          const tail = readLogTail(logPath);
-          if (tail) {
-            console.error("---- daemon log tail ----");
-            console.error(tail.trimEnd());
-            console.error("---- end daemon log tail ----");
-          }
-          await cleanupCreatedTunnelOnStartFailure(apiClient, target);
-          process.exit(1);
-        }
-        if (bridgeMode !== "none") {
-          const bridgeReady = await ensureBridgeReady({
-            bridgeMode,
-            tunnelId: target.tunnelId,
-            socketPath,
-            bridgeProcessEnv,
-            timeoutMs: 8e3
-          });
-          if (!bridgeReady.ok) {
-            console.error(`Bridge failed to start: ${bridgeReady.reason ?? "unknown reason"}`);
-            const bridgeLog = bridgeLogPath(target.tunnelId);
-            if (fs2.existsSync(bridgeLog)) {
-              console.error(`Bridge log: ${bridgeLog}`);
-              const bridgeTail = readLogTail(bridgeLog);
-              if (bridgeTail) {
-                console.error("---- bridge log tail ----");
-                console.error(bridgeTail.trimEnd());
-                console.error("---- end bridge log tail ----");
-              }
-            }
-            try {
-              await ipcCall(socketPath, { method: "close", params: {} });
-            } catch {
-            }
-            await cleanupCreatedTunnelOnStartFailure(apiClient, target);
-            process.exit(1);
-          }
-        }
-        console.log(`Tunnel started: ${target.url}`);
-        console.log(`Tunnel ID: ${target.tunnelId}`);
-        console.log(`Expires: ${new Date(target.expiresAt).toISOString()}`);
-        if (target.mode === "existing") console.log("Mode: attached existing tunnel");
-        console.log("Daemon health: OK");
-        console.log(`Daemon log: ${logPath}`);
-        if (bridgeMode !== "none") {
-          console.log("Bridge mode: openclaw");
-          console.log(`Bridge log: ${bridgeLogPath(target.tunnelId)}`);
+      for (const key of opts.unset) {
+        applyConfigUnset(nextBridge, nextTelegram, key.trim());
+      }
+      if (telegramTokenChanged && nextTelegram.botToken) {
+        console.log("Verifying Telegram bot token...");
+        const bot = await telegramGetMe(nextTelegram.botToken);
+        nextTelegram.botUsername = bot.username;
+        nextTelegram.hasMainWebApp = bot.hasMainWebApp;
+        console.log(`  Bot: @${bot.username}`);
+        await telegramSetMenuButton(nextTelegram.botToken, "https://pub.blue");
+        console.log("  Menu button set to https://pub.blue");
+        if (!bot.hasMainWebApp) {
+          console.log("");
+          console.log("  INFO: For deep links to open inside Telegram, register the Mini App:");
+          console.log("    @BotFather \u2192 /mybots \u2192 your bot \u2192 Bot Settings \u2192 Configure Mini App");
+          console.log("    Set Web App URL to: https://pub.blue");
         }
       }
+      const nextConfig = {
+        apiKey,
+        bridge: hasValues(nextBridge) ? nextBridge : void 0,
+        telegram: hasValues(nextTelegram) ? nextTelegram : void 0
+      };
+      saveConfig(nextConfig);
+      console.log("Configuration saved.");
+      if (opts.show || hasSet || hasUnset) {
+        printConfigSummary(nextConfig);
+      }
     }
   );
-  tunnel.command("write").description("Write data to a channel").argument("[message]", "Text message (or use --file)").option("-t, --tunnel <tunnelId>", "Tunnel ID (auto-detected if one active)").option("-c, --channel <channel>", "Channel name", "chat").option("-f, --file <file>", "Read content from file").action(
-    async (messageArg, opts) => {
-      let msg;
-      let binaryBase64;
-      if (opts.file) {
-        const filePath = path2.resolve(opts.file);
-        const ext = path2.extname(filePath).toLowerCase();
-        const bytes = fs2.readFileSync(filePath);
-        const filename = path2.basename(filePath);
-        if (ext === ".html" || ext === ".htm") {
-          msg = {
-            id: generateMessageId(),
-            type: "html",
-            data: bytes.toString("utf-8"),
-            meta: { title: filename, filename, mime: getMimeType(filePath), size: bytes.length }
-          };
-        } else if (TEXT_FILE_EXTENSIONS.has(ext)) {
-          msg = {
-            id: generateMessageId(),
-            type: "text",
-            data: bytes.toString("utf-8"),
-            meta: { filename, mime: getMimeType(filePath), size: bytes.length }
-          };
-        } else {
-          msg = {
-            id: generateMessageId(),
-            type: "binary",
-            meta: { filename, mime: getMimeType(filePath), size: bytes.length }
-          };
-          binaryBase64 = bytes.toString("base64");
-        }
-      } else if (messageArg) {
-        msg = {
-          id: generateMessageId(),
-          type: "text",
-          data: messageArg
-        };
+}
+
+// src/commands/publications.ts
+function registerPublicationCommands(program2) {
+  program2.command("create").description("Create a new publication").argument("[file]", "Path to the file (reads stdin if omitted)").option("--slug <slug>", "Custom slug for the URL").option("--title <title>", "Title for the publication").option("--public", "Make the publication public").option("--private", "Make the publication private (default)").option("--expires <duration>", "Auto-delete after duration (e.g. 1h, 24h, 7d)").action(
+    async (fileArg, opts) => {
+      const client = createClient();
+      let content;
+      let filename;
+      if (fileArg) {
+        const file = readFile(fileArg);
+        content = file.content;
+        filename = file.basename;
       } else {
-        const chunks = [];
-        for await (const chunk of process.stdin) chunks.push(chunk);
-        msg = {
-          id: generateMessageId(),
-          type: "text",
-          data: Buffer.concat(chunks).toString("utf-8").trim()
-        };
+        content = await readFromStdin();
       }
-      const tunnelId = opts.tunnel || await resolveActiveTunnel();
-      const socketPath = getSocketPath(tunnelId);
-      const response = await ipcCall(socketPath, {
-        method: "write",
-        params: { channel: opts.channel, msg, binaryBase64 }
+      const resolvedVisibility = resolveVisibilityFlags({
+        public: opts.public,
+        private: opts.private,
+        commandName: "create"
       });
-      if (!response.ok) {
-        console.error(`Failed: ${response.error}`);
-        process.exit(1);
-      }
-    }
-  );
-  tunnel.command("read").description("Read buffered messages from channels").argument("[tunnelId]", "Tunnel ID (auto-detected if one active)").option("-t, --tunnel <tunnelId>", "Tunnel ID (alternative to positional arg)").option("-c, --channel <channel>", "Filter by channel").option("--follow", "Stream messages continuously").option("--all", "With --follow, include all channels instead of chat-only default").action(
-    async (tunnelIdArg, opts) => {
-      const tunnelId = resolveTunnelIdSelection(tunnelIdArg, opts.tunnel) || await resolveActiveTunnel();
-      const socketPath = getSocketPath(tunnelId);
-      const readChannel = opts.channel || (opts.follow && !opts.all ? CHANNELS.CHAT : void 0);
-      if (opts.follow) {
-        if (!opts.channel && !opts.all) {
-          console.error(
-            "Following chat channel by default. Use `--all` to include binary/file channels."
-          );
-        }
-        let consecutiveFailures = 0;
-        let warnedDisconnected = false;
-        while (true) {
-          try {
-            const response = await ipcCall(socketPath, {
-              method: "read",
-              params: { channel: readChannel }
-            });
-            if (warnedDisconnected) {
-              console.error("Daemon reconnected.");
-              warnedDisconnected = false;
-            }
-            consecutiveFailures = 0;
-            if (response.messages && response.messages.length > 0) {
-              for (const m of response.messages) {
-                console.log(JSON.stringify(m));
-              }
-            }
-          } catch (error) {
-            consecutiveFailures += 1;
-            if (!warnedDisconnected) {
-              const detail = error instanceof Error ? ` ${error.message}` : "";
-              console.error(`Daemon disconnected. Waiting for recovery...${detail}`);
-              warnedDisconnected = true;
-            }
-          }
-          const delayMs = getFollowReadDelayMs(warnedDisconnected, consecutiveFailures);
-          await new Promise((r) => setTimeout(r, delayMs));
-        }
-      } else {
-        const response = await ipcCall(socketPath, {
-          method: "read",
-          params: { channel: readChannel }
-        });
-        if (!response.ok) {
-          console.error(`Failed: ${response.error}`);
-          process.exit(1);
-        }
-        console.log(JSON.stringify(response.messages || [], null, 2));
+      const result = await client.create({
+        content,
+        filename,
+        title: opts.title,
+        slug: opts.slug,
+        isPublic: resolvedVisibility ?? false,
+        expiresIn: opts.expires
+      });
+      console.log(`Created: ${result.url}`);
+      const tmaUrl = getTelegramMiniAppUrl("pub", result.slug);
+      if (tmaUrl) console.log(`Telegram: ${tmaUrl}`);
+      if (result.expiresAt) {
+        console.log(`  Expires: ${new Date(result.expiresAt).toISOString()}`);
       }
     }
   );
-  tunnel.command("channels").description("List active channels").argument("[tunnelId]", "Tunnel ID").option("-t, --tunnel <tunnelId>", "Tunnel ID (alternative to positional arg)").action(async (tunnelIdArg, opts) => {
-    const tunnelId = resolveTunnelIdSelection(tunnelIdArg, opts.tunnel) || await resolveActiveTunnel();
-    const socketPath = getSocketPath(tunnelId);
-    const response = await ipcCall(socketPath, { method: "channels", params: {} });
-    if (response.channels) {
-      for (const ch of response.channels) {
-        console.log(`  ${ch.name}  [${ch.direction}]`);
-      }
+  program2.command("get").description("Get details of a publication").argument("<slug>", "Slug of the publication").option("--content", "Output raw content to stdout (no metadata, pipeable)").action(async (slug, opts) => {
+    const client = createClient();
+    const pub = await client.get(slug);
+    if (opts.content) {
+      process.stdout.write(pub.content);
+      return;
     }
+    console.log(`  Slug:    ${pub.slug}`);
+    console.log(`  Type:    ${pub.contentType}`);
+    if (pub.title) console.log(`  Title:   ${pub.title}`);
+    console.log(`  Status:  ${formatVisibility(pub.isPublic)}`);
+    if (pub.expiresAt) console.log(`  Expires: ${new Date(pub.expiresAt).toISOString()}`);
+    console.log(`  Created: ${new Date(pub.createdAt).toLocaleDateString()}`);
+    console.log(`  Updated: ${new Date(pub.updatedAt).toLocaleDateString()}`);
+    console.log(`  Size:    ${pub.content.length} bytes`);
   });
-  tunnel.command("status").description("Check tunnel connection status").argument("[tunnelId]", "Tunnel ID").option("-t, --tunnel <tunnelId>", "Tunnel ID (alternative to positional arg)").action(async (tunnelIdArg, opts) => {
-    const tunnelId = resolveTunnelIdSelection(tunnelIdArg, opts.tunnel) || await resolveActiveTunnel();
-    const socketPath = getSocketPath(tunnelId);
-    const response = await ipcCall(socketPath, { method: "status", params: {} });
-    console.log(`  Status: ${response.connected ? "connected" : "waiting"}`);
-    console.log(`  Uptime: ${response.uptime}s`);
-    const chNames = Array.isArray(response.channels) ? response.channels.map((c) => typeof c === "string" ? c : String(c)) : [];
-    console.log(`  Channels: ${chNames.join(", ")}`);
-    console.log(`  Buffered: ${response.bufferedMessages ?? 0} messages`);
-    if (typeof response.lastError === "string" && response.lastError.length > 0) {
-      console.log(`  Last error: ${response.lastError}`);
-    }
-    const logPath = tunnelLogPath(tunnelId);
-    if (fs2.existsSync(logPath)) {
-      console.log(`  Log: ${logPath}`);
-    }
-    const bridgeInfo = readBridgeProcessInfo(tunnelId);
-    if (bridgeInfo) {
-      const bridgeRunning = isBridgeRunning(tunnelId);
-      const bridgeState = bridgeInfo.status || (bridgeRunning ? "running" : "stopped");
-      console.log(`  Bridge: ${bridgeInfo.mode} (${bridgeState})`);
-      if (bridgeInfo.sessionId) {
-        console.log(`  Bridge session: ${bridgeInfo.sessionId}`);
-      }
-      if (!bridgeRunning && bridgeInfo.lastError) {
-        console.log(`  Bridge error: ${bridgeInfo.lastError}`);
+  program2.command("update").description("Update a publication's content and/or metadata").argument("<slug>", "Slug of the publication to update").option("--file <file>", "New content from file").option("--title <title>", "New title").option("--public", "Make the publication public").option("--private", "Make the publication private").option("--slug <newSlug>", "Rename the slug").action(
+    async (slug, opts) => {
+      const client = createClient();
+      let content;
+      let filename;
+      if (opts.file) {
+        const file = readFile(opts.file);
+        content = file.content;
+        filename = file.basename;
       }
+      const isPublic = resolveVisibilityFlags({
+        public: opts.public,
+        private: opts.private,
+        commandName: "update"
+      });
+      const result = await client.update({
+        slug,
+        content,
+        filename,
+        title: opts.title,
+        isPublic,
+        newSlug: opts.slug
+      });
+      console.log(`Updated: ${result.slug}`);
+      if (result.title) console.log(`  Title:  ${result.title}`);
+      console.log(`  Status: ${formatVisibility(result.isPublic)}`);
     }
-    const bridgeLog = bridgeLogPath(tunnelId);
-    if (fs2.existsSync(bridgeLog)) {
-      console.log(`  Bridge log: ${bridgeLog}`);
+  );
+  program2.command("list").description("List your publications").action(async () => {
+    const client = createClient();
+    const pubs = await client.list();
+    if (pubs.length === 0) {
+      console.log("No publications.");
+      return;
+    }
+    for (const pub of pubs) {
+      const date = new Date(pub.createdAt).toLocaleDateString();
+      const expires = pub.expiresAt ? ` expires:${new Date(pub.expiresAt).toISOString()}` : "";
+      console.log(
+        `  ${pub.slug}  [${pub.contentType}]  ${formatVisibility(pub.isPublic)}  ${date}${expires}`
+      );
     }
   });
-  tunnel.command("doctor").description("Run strict end-to-end tunnel checks (daemon, channels, chat/canvas ping)").option("-t, --tunnel <tunnelId>", "Tunnel ID (auto-detected if one active)").option("--timeout <seconds>", "Timeout for pong wait and repeated reads", "30").option("--wait-pong", "Wait for user to reply with exact text 'pong' on chat channel").option("--skip-chat", "Skip chat ping check").option("--skip-canvas", "Skip canvas ping check").action(
-    async (opts) => {
-      const timeoutSeconds = parsePositiveIntegerOption(opts.timeout, "--timeout");
-      const timeoutMs = timeoutSeconds * 1e3;
-      const tunnelId = opts.tunnel || await resolveActiveTunnel();
-      const socketPath = getSocketPath(tunnelId);
-      const apiClient = createApiClient();
-      const fail = (message) => {
-        console.error(`Doctor failed: ${message}`);
-        process.exit(1);
-      };
-      console.log(`Doctor tunnel: ${tunnelId}`);
-      let statusResponse = null;
-      try {
-        statusResponse = await ipcCall(socketPath, {
-          method: "status",
-          params: {}
-        });
-      } catch (error) {
-        fail(
-          `daemon is unreachable (${error instanceof Error ? error.message : String(error)}).`
-        );
-      }
-      if (!statusResponse) {
-        fail("daemon status returned no response.");
-      }
-      const daemonStatus = statusResponse;
-      if (!daemonStatus.ok) {
-        fail(`daemon returned non-ok status: ${String(daemonStatus.error || "unknown error")}`);
-      }
-      if (!daemonStatus.connected) {
-        fail("daemon is running but browser is not connected.");
-      }
-      const channelNames = Array.isArray(daemonStatus.channels) ? daemonStatus.channels.map((entry) => String(entry)) : [];
-      for (const required of [CONTROL_CHANNEL, CHANNELS.CHAT, CHANNELS.CANVAS]) {
-        if (!channelNames.includes(required)) {
-          fail(`required channel is missing: ${required}`);
-        }
-      }
-      console.log("Daemon/channel check: OK");
-      let tunnelInfo = null;
-      try {
-        tunnelInfo = await apiClient.get(tunnelId);
-      } catch (error) {
-        fail(`failed to fetch tunnel info from API: ${formatApiError(error)}`);
-      }
-      if (!tunnelInfo) {
-        fail("API returned no tunnel payload.");
-      }
-      const apiTunnel = tunnelInfo;
-      if (apiTunnel.status !== "active") {
-        fail(`API reports tunnel is not active (status: ${apiTunnel.status})`);
-      }
-      if (apiTunnel.expiresAt <= Date.now()) {
-        fail("API reports tunnel is expired.");
-      }
-      if (!apiTunnel.hasConnection) {
-        fail("API reports no browser connection.");
-      }
-      if (typeof apiTunnel.agentOffer !== "string" || apiTunnel.agentOffer.length === 0) {
-        fail("agent offer was not published.");
-      }
-      console.log("API/signaling check: OK");
-      if (!opts.skipChat) {
-        const pingText = "This is a ping test. Reply with 'pong'.";
-        const pingMsg = {
-          id: generateMessageId(),
-          type: "text",
-          data: pingText
-        };
-        const writeResponse = await ipcCall(socketPath, {
-          method: "write",
-          params: { channel: CHANNELS.CHAT, msg: pingMsg }
-        });
-        if (!writeResponse.ok) {
-          fail(`chat ping failed: ${String(writeResponse.error || "unknown write error")}`);
-        }
-        console.log("Chat ping write ACK: OK");
-        if (opts.waitPong) {
-          const startedAt = Date.now();
-          let receivedPong = false;
-          while (Date.now() - startedAt < timeoutMs) {
-            const readResponse = await ipcCall(socketPath, {
-              method: "read",
-              params: { channel: CHANNELS.CHAT }
-            });
-            if (!readResponse.ok) {
-              fail(
-                `chat read failed while waiting for pong: ${String(readResponse.error || "unknown read error")}`
-              );
-            }
-            const messages = Array.isArray(readResponse.messages) ? readResponse.messages : [];
-            if (messages.some((entry) => messageContainsPong(entry))) {
-              receivedPong = true;
-              break;
-            }
-            await new Promise((resolve3) => setTimeout(resolve3, 1e3));
-          }
-          if (!receivedPong) {
-            fail(
-              `timed out after ${timeoutSeconds}s waiting for exact 'pong' reply on chat channel.`
-            );
-          }
-          console.log("Chat pong roundtrip: OK");
-        }
-      }
-      if (!opts.skipCanvas) {
-        const stamp = (/* @__PURE__ */ new Date()).toISOString();
-        const canvasMsg = {
-          id: generateMessageId(),
-          type: "html",
-          data: `<!doctype html><html><body style="margin:0;padding:24px;font-family:system-ui;background:#111;color:#f5f5f5">Canvas ping OK<br><small>${stamp}</small></body></html>`
-        };
-        const canvasResponse = await ipcCall(socketPath, {
-          method: "write",
-          params: { channel: CHANNELS.CANVAS, msg: canvasMsg }
-        });
-        if (!canvasResponse.ok) {
-          fail(`canvas ping failed: ${String(canvasResponse.error || "unknown write error")}`);
-        }
-        console.log("Canvas ping write ACK: OK");
-      }
-      console.log("Tunnel doctor: PASS");
-    }
-  );
-  tunnel.command("list").description("List active tunnels").action(async () => {
-    const apiClient = createApiClient();
-    const tunnels = await apiClient.list();
-    if (tunnels.length === 0) {
-      console.log("No active tunnels.");
-      return;
-    }
-    for (const t of tunnels) {
-      const age = Math.floor((Date.now() - t.createdAt) / 6e4);
-      const running = isDaemonRunning(t.tunnelId) ? "running" : "no daemon";
-      const bridgeInfo = readBridgeProcessInfo(t.tunnelId);
-      const bridge = bridgeInfo ? isBridgeRunning(t.tunnelId) ? `${bridgeInfo.mode}:running` : `${bridgeInfo.mode}:stopped` : "none";
-      const conn = t.hasConnection ? "connected" : "waiting";
-      console.log(`  ${t.tunnelId}  ${conn}  ${running}  bridge=${bridge}  ${age}m ago`);
-    }
+  program2.command("delete").description("Delete a publication").argument("<slug>", "Slug of the publication to delete").action(async (slug) => {
+    const client = createClient();
+    await client.remove(slug);
+    console.log(`Deleted: ${slug}`);
   });
-  tunnel.command("close").description("Close a tunnel and stop its daemon").argument("<tunnelId>", "Tunnel ID").action(async (tunnelId) => {
-    stopBridgeProcess(tunnelId);
+}
+
+// src/commands/tunnel/management-commands.ts
+import * as fs4 from "fs";
+
+// src/commands/tunnel-helpers.ts
+import { fork } from "child_process";
+import * as fs3 from "fs";
+import * as path3 from "path";
+var TEXT_FILE_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".txt",
+  ".md",
+  ".markdown",
+  ".json",
+  ".csv",
+  ".xml",
+  ".yaml",
+  ".yml",
+  ".js",
+  ".mjs",
+  ".cjs",
+  ".ts",
+  ".tsx",
+  ".jsx",
+  ".css",
+  ".scss",
+  ".sass",
+  ".less",
+  ".log"
+]);
+function getMimeType(filePath) {
+  const ext = path3.extname(filePath).toLowerCase();
+  const mimeByExt = {
+    ".html": "text/html; charset=utf-8",
+    ".htm": "text/html; charset=utf-8",
+    ".txt": "text/plain; charset=utf-8",
+    ".md": "text/markdown; charset=utf-8",
+    ".markdown": "text/markdown; charset=utf-8",
+    ".json": "application/json",
+    ".csv": "text/csv; charset=utf-8",
+    ".xml": "application/xml",
+    ".yaml": "application/x-yaml",
+    ".yml": "application/x-yaml",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+    ".svg": "image/svg+xml",
+    ".pdf": "application/pdf",
+    ".zip": "application/zip",
+    ".mp3": "audio/mpeg",
+    ".wav": "audio/wav",
+    ".mp4": "video/mp4"
+  };
+  return mimeByExt[ext] || "application/octet-stream";
+}
+function tunnelInfoDir() {
+  const dir = path3.join(
+    process.env.HOME || process.env.USERPROFILE || "/tmp",
+    ".config",
+    "pubblue",
+    "tunnels"
+  );
+  if (!fs3.existsSync(dir)) fs3.mkdirSync(dir, { recursive: true });
+  return dir;
+}
+function tunnelInfoPath(tunnelId) {
+  return path3.join(tunnelInfoDir(), `${tunnelId}.json`);
+}
+function tunnelLogPath(tunnelId) {
+  return path3.join(tunnelInfoDir(), `${tunnelId}.log`);
+}
+function bridgeInfoPath(tunnelId) {
+  return path3.join(tunnelInfoDir(), `${tunnelId}.bridge.json`);
+}
+function bridgeLogPath(tunnelId) {
+  return path3.join(tunnelInfoDir(), `${tunnelId}.bridge.log`);
+}
+function createApiClient(configOverride) {
+  const config = configOverride || getConfig();
+  return new TunnelApiClient(config.baseUrl, config.apiKey);
+}
+function buildBridgeProcessEnv(bridgeConfig) {
+  const env = { ...process.env };
+  if (!bridgeConfig) return env;
+  const setIfMissing = (key, value) => {
+    if (value === void 0 || value === null) return;
+    const current = env[key];
+    if (typeof current === "string" && current.length > 0) return;
+    env[key] = String(value);
+  };
+  setIfMissing("OPENCLAW_PATH", bridgeConfig.openclawPath);
+  setIfMissing("OPENCLAW_SESSION_ID", bridgeConfig.sessionId);
+  setIfMissing("OPENCLAW_THREAD_ID", bridgeConfig.threadId);
+  if (bridgeConfig.canvasReminderEvery !== void 0) {
+    setIfMissing("OPENCLAW_CANVAS_REMINDER_EVERY", bridgeConfig.canvasReminderEvery);
+  }
+  if (bridgeConfig.deliver !== void 0) {
+    setIfMissing("OPENCLAW_DELIVER", bridgeConfig.deliver ? "1" : "0");
+  }
+  setIfMissing("OPENCLAW_DELIVER_CHANNEL", bridgeConfig.deliverChannel);
+  setIfMissing("OPENCLAW_REPLY_TO", bridgeConfig.replyTo);
+  if (bridgeConfig.deliverTimeoutMs !== void 0) {
+    setIfMissing("OPENCLAW_DELIVER_TIMEOUT_MS", bridgeConfig.deliverTimeoutMs);
+  }
+  setIfMissing("OPENCLAW_ATTACHMENT_DIR", bridgeConfig.attachmentDir);
+  if (bridgeConfig.attachmentMaxBytes !== void 0) {
+    setIfMissing("OPENCLAW_ATTACHMENT_MAX_BYTES", bridgeConfig.attachmentMaxBytes);
+  }
+  return env;
+}
+async function ensureNodeDatachannelAvailable() {
+  try {
+    await import("node-datachannel");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    failCli(
+      [
+        "node-datachannel native module is not available.",
+        "Run `pnpm rebuild node-datachannel` in the cli package and retry.",
+        `Details: ${message}`
+      ].join("\n")
+    );
+  }
+}
+function isDaemonRunning(tunnelId) {
+  return readDaemonProcessInfo(tunnelId) !== null;
+}
+function readDaemonProcessInfo(tunnelId) {
+  const infoPath = tunnelInfoPath(tunnelId);
+  if (!fs3.existsSync(infoPath)) return null;
+  try {
+    const info = JSON.parse(fs3.readFileSync(infoPath, "utf-8"));
+    if (!Number.isFinite(info.pid)) throw new Error("invalid daemon pid");
+    process.kill(info.pid, 0);
+    return info;
+  } catch {
     try {
-      fs2.unlinkSync(bridgeInfoPath(tunnelId));
+      fs3.unlinkSync(infoPath);
     } catch {
     }
-    const socketPath = getSocketPath(tunnelId);
+    return null;
+  }
+}
+function readBridgeProcessInfo(tunnelId) {
+  const infoPath = bridgeInfoPath(tunnelId);
+  if (!fs3.existsSync(infoPath)) return null;
+  try {
+    return JSON.parse(fs3.readFileSync(infoPath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function isBridgeRunning(tunnelId) {
+  const infoPath = bridgeInfoPath(tunnelId);
+  if (!fs3.existsSync(infoPath)) return false;
+  try {
+    const info = JSON.parse(fs3.readFileSync(infoPath, "utf-8"));
+    process.kill(info.pid, 0);
+    return true;
+  } catch {
     try {
-      await ipcCall(socketPath, { method: "close", params: {} });
+      fs3.unlinkSync(infoPath);
     } catch {
     }
-    const apiClient = createApiClient();
-    try {
-      await apiClient.close(tunnelId);
-    } catch (error) {
-      const message = formatApiError(error);
-      if (!/Tunnel not found/i.test(message)) {
-        console.error(`Failed to close tunnel ${tunnelId}: ${message}`);
-        process.exit(1);
-      }
-    }
-    console.log(`Closed: ${tunnelId}`);
-  });
-}
-async function resolveActiveTunnel() {
-  const dir = tunnelInfoDir();
-  const files = fs2.readdirSync(dir).filter((f) => f.endsWith(".json") && !f.endsWith(".bridge.json"));
-  const active = [];
-  for (const f of files) {
-    const tunnelId = f.replace(".json", "");
-    if (isDaemonRunning(tunnelId)) active.push(tunnelId);
+    return false;
+  }
+}
+function stopBridgeProcess(tunnelId) {
+  const info = readBridgeProcessInfo(tunnelId);
+  if (!info || !Number.isFinite(info.pid)) return;
+  try {
+    process.kill(info.pid, "SIGTERM");
+  } catch {
+  }
+}
+function buildBridgeForkStdio(logFd) {
+  return ["ignore", logFd, logFd, "ipc"];
+}
+function getFollowReadDelayMs(disconnected, consecutiveFailures) {
+  if (!disconnected) return 1e3;
+  return Math.min(5e3, 1e3 * 2 ** Math.min(consecutiveFailures, 3));
+}
+function resolveTunnelIdSelection(tunnelIdArg, tunnelOpt) {
+  return tunnelOpt || tunnelIdArg;
+}
+function buildDaemonForkStdio(logFd) {
+  return ["ignore", logFd, logFd, "ipc"];
+}
+function parsePositiveIntegerOption(raw, optionName) {
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    throw new Error(`${optionName} must be a positive integer. Received: ${raw}`);
+  }
+  return parsed;
+}
+function parseBridgeMode(raw) {
+  const normalized = raw.trim().toLowerCase();
+  if (normalized === "openclaw" || normalized === "none") {
+    return normalized;
+  }
+  throw new Error(`--bridge must be one of: openclaw, none. Received: ${raw}`);
+}
+function shouldRestartDaemonForCliUpgrade(daemonCliVersion, currentCliVersion) {
+  if (!daemonCliVersion || daemonCliVersion.trim().length === 0) return true;
+  return daemonCliVersion.trim() !== currentCliVersion;
+}
+function messageContainsPong(payload) {
+  if (!payload || typeof payload !== "object") return false;
+  const message = payload.msg;
+  if (!message || typeof message !== "object") return false;
+  const type = message.type;
+  const data = message.data;
+  return type === "text" && typeof data === "string" && data.trim().toLowerCase() === "pong";
+}
+function getPublicTunnelUrl(tunnelId) {
+  const base = process.env.PUBBLUE_PUBLIC_URL || "https://pub.blue";
+  return `${base.replace(/\/$/, "")}/t/${tunnelId}`;
+}
+function pickReusableTunnel(tunnels, nowMs = Date.now()) {
+  const active = tunnels.filter((t) => t.status === "active" && t.expiresAt > nowMs).sort((a, b) => b.createdAt - a.createdAt);
+  return active[0] ?? null;
+}
+function readLogTail(logPath, maxChars = 4e3) {
+  if (!fs3.existsSync(logPath)) return null;
+  try {
+    const content = fs3.readFileSync(logPath, "utf-8");
+    if (content.length <= maxChars) return content;
+    return content.slice(-maxChars);
+  } catch {
+    return null;
+  }
+}
+function formatApiError(error) {
+  if (error instanceof TunnelApiError) {
+    if (error.status === 429 && error.retryAfterSeconds !== void 0) {
+      return `Rate limit exceeded. Retry after ${error.retryAfterSeconds}s.`;
+    }
+    return `${error.message} (HTTP ${error.status})`;
+  }
+  return error instanceof Error ? error.message : String(error);
+}
+async function cleanupCreatedTunnelOnStartFailure(apiClient, target) {
+  if (!target.createdNew) return;
+  try {
+    await apiClient.close(target.tunnelId);
+  } catch (closeError) {
+    console.error(
+      `Failed to clean up newly created tunnel ${target.tunnelId}: ${formatApiError(closeError)}`
+    );
+  }
+}
+async function resolveActiveTunnel() {
+  const dir = tunnelInfoDir();
+  const files = fs3.readdirSync(dir).filter((f) => f.endsWith(".json") && !f.endsWith(".bridge.json"));
+  const active = [];
+  for (const f of files) {
+    const tunnelId = f.replace(".json", "");
+    if (isDaemonRunning(tunnelId)) active.push(tunnelId);
   }
   if (active.length === 0) {
-    console.error("No active tunnels. Run `pubblue tunnel start` first.");
-    process.exit(1);
+    failCli("No active tunnels. Run `pubblue tunnel start` first.");
   }
   if (active.length === 1) return active[0];
-  console.error(`Multiple active tunnels: ${active.join(", ")}. Specify one.`);
-  process.exit(1);
+  failCli(`Multiple active tunnels: ${active.join(", ")}. Specify one.`);
 }
 function waitForDaemonReady({
   child,
@@ -924,7 +924,7 @@ function waitForDaemonReady({
     };
     child.on("exit", onExit);
     const poll = setInterval(() => {
-      if (pollInFlight || !fs2.existsSync(infoPath)) return;
+      if (pollInFlight || !fs3.existsSync(infoPath)) return;
       pollInFlight = true;
       void ipcCall(socketPath, { method: "status", params: {} }).then((status) => {
         if (status.ok) done({ ok: true });
@@ -971,9 +971,9 @@ async function ensureBridgeReady(params) {
       timeoutMs: params.timeoutMs
     });
   }
-  const bridgeScript = path2.join(import.meta.dirname, "tunnel-bridge-entry.js");
+  const bridgeScript = path3.join(import.meta.dirname, "tunnel-bridge-entry.js");
   const logPath = bridgeLogPath(params.tunnelId);
-  const logFd = fs2.openSync(logPath, "a");
+  const logFd = fs3.openSync(logPath, "a");
   const child = fork(bridgeScript, [], {
     detached: true,
     stdio: buildBridgeForkStdio(logFd),
@@ -985,7 +985,7 @@ async function ensureBridgeReady(params) {
       PUBBLUE_BRIDGE_INFO: infoPath
     }
   });
-  fs2.closeSync(logFd);
+  fs3.closeSync(logFd);
   if (child.connected) {
     child.disconnect();
   }
@@ -1025,7 +1025,7 @@ function waitForBridgeReady({
       child.on("exit", onExit);
     }
     const poll = setInterval(() => {
-      if (!fs2.existsSync(infoPath)) return;
+      if (!fs3.existsSync(infoPath)) return;
       const info = readBridgeProcessInfo(tunnelId);
       if (!info) return;
       lastState = info.status;
@@ -1048,424 +1048,720 @@ function waitForBridgeReady({
   });
 }
 
-// src/lib/api.ts
-var PubApiClient = class {
-  constructor(baseUrl, apiKey) {
-    this.baseUrl = baseUrl;
-    this.apiKey = apiKey;
-  }
-  async request(path4, options = {}) {
-    const url = new URL(path4, this.baseUrl);
-    const res = await fetch(url, {
-      ...options,
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${this.apiKey}`,
-        ...options.headers
+// src/commands/tunnel/management-commands.ts
+function registerTunnelManagementCommands(tunnel) {
+  tunnel.command("channels").description("List active channels").argument("[tunnelId]", "Tunnel ID").option("-t, --tunnel <tunnelId>", "Tunnel ID (alternative to positional arg)").action(async (tunnelIdArg, opts) => {
+    const tunnelId = resolveTunnelIdSelection(tunnelIdArg, opts.tunnel) || await resolveActiveTunnel();
+    const socketPath = getSocketPath(tunnelId);
+    const response = await ipcCall(socketPath, { method: "channels", params: {} });
+    if (response.channels) {
+      for (const ch of response.channels) {
+        console.log(`  ${ch.name}  [${ch.direction}]`);
       }
-    });
-    const data = await res.json();
-    if (!res.ok) {
-      throw new Error(data.error || `Request failed with status ${res.status}`);
     }
-    return data;
-  }
-  async create(opts) {
-    return this.request("/api/v1/publications", {
-      method: "POST",
-      body: JSON.stringify(opts)
-    });
-  }
-  async get(slug) {
-    const data = await this.request(`/api/v1/publications/${encodeURIComponent(slug)}`);
-    return data.publication;
-  }
-  async listPage(cursor, limit) {
-    const params = new URLSearchParams();
-    if (cursor) params.set("cursor", cursor);
-    if (limit) params.set("limit", String(limit));
-    const qs = params.toString();
-    return this.request(`/api/v1/publications${qs ? `?${qs}` : ""}`);
-  }
-  async list() {
-    const all = [];
-    let cursor;
-    do {
-      const result = await this.listPage(cursor, 100);
-      all.push(...result.publications);
-      cursor = result.hasMore ? result.cursor : void 0;
-    } while (cursor);
-    return all;
-  }
-  async update(opts) {
-    const { slug, newSlug, ...rest } = opts;
-    const body = { ...rest };
-    if (newSlug) body.slug = newSlug;
-    return this.request(`/api/v1/publications/${encodeURIComponent(slug)}`, {
-      method: "PATCH",
-      body: JSON.stringify(body)
-    });
-  }
-  async remove(slug) {
-    await this.request(`/api/v1/publications/${encodeURIComponent(slug)}`, {
-      method: "DELETE"
-    });
-  }
-};
-
-// src/index.ts
-var program = new Command();
-function createClient() {
-  const config = getConfig();
-  return new PubApiClient(config.baseUrl, config.apiKey);
-}
-async function readFromStdin() {
-  const chunks = [];
-  for await (const chunk of process.stdin) {
-    chunks.push(chunk);
-  }
-  return Buffer.concat(chunks).toString("utf-8").trim();
-}
-function formatVisibility(isPublic) {
-  return isPublic ? "public" : "private";
-}
-async function readApiKeyFromPrompt() {
-  const rl = createInterface({
-    input: process.stdin,
-    output: process.stdout
   });
-  try {
-    const answer = await rl.question("Enter API key: ");
-    return answer.trim();
-  } finally {
-    rl.close();
-  }
-}
-async function resolveConfigureApiKey(opts) {
-  if (opts.apiKey && opts.apiKeyStdin) {
-    throw new Error("Use only one of --api-key or --api-key-stdin.");
-  }
-  if (opts.apiKey) {
-    return opts.apiKey.trim();
-  }
-  if (opts.apiKeyStdin) {
-    return readFromStdin();
-  }
-  const envKey = process.env.PUBBLUE_API_KEY?.trim();
-  if (envKey) return envKey;
-  if (!process.stdin.isTTY || !process.stdout.isTTY) {
-    throw new Error(
-      "No TTY available. Provide --api-key, --api-key-stdin, or PUBBLUE_API_KEY for configure."
-    );
-  }
-  return readApiKeyFromPrompt();
-}
-function collectValues(value, previous) {
-  previous.push(value);
-  return previous;
-}
-function parseSetInput(raw) {
-  const sepIndex = raw.indexOf("=");
-  if (sepIndex <= 0 || sepIndex === raw.length - 1) {
-    throw new Error(`Invalid --set entry "${raw}". Use key=value.`);
-  }
-  return {
-    key: raw.slice(0, sepIndex).trim(),
-    value: raw.slice(sepIndex + 1).trim()
-  };
-}
-function parseBooleanValue(raw, key) {
-  const normalized = raw.trim().toLowerCase();
-  if (normalized === "1" || normalized === "true" || normalized === "yes" || normalized === "on")
-    return true;
-  if (normalized === "0" || normalized === "false" || normalized === "no" || normalized === "off")
-    return false;
-  throw new Error(`Invalid boolean value for ${key}: ${raw}`);
-}
-function parseBridgeModeValue(raw) {
-  const normalized = raw.trim().toLowerCase();
-  if (normalized === "openclaw" || normalized === "none") return normalized;
-  throw new Error(`Invalid bridge mode: ${raw}. Use openclaw or none.`);
-}
-function parsePositiveInteger(raw, key) {
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isFinite(parsed) || parsed <= 0) {
-    throw new Error(`${key} must be a positive integer. Received: ${raw}`);
-  }
-  return parsed;
-}
-function applyBridgeSet(bridge, key, value) {
-  switch (key) {
-    case "bridge.mode":
-      bridge.mode = parseBridgeModeValue(value);
-      return;
-    case "openclaw.path":
-      bridge.openclawPath = value;
-      return;
-    case "openclaw.sessionId":
-      bridge.sessionId = value;
-      return;
-    case "openclaw.threadId":
-      bridge.threadId = value;
-      return;
-    case "openclaw.deliver":
-      bridge.deliver = parseBooleanValue(value, key);
-      return;
-    case "openclaw.deliverChannel":
-      bridge.deliverChannel = value;
-      return;
-    case "openclaw.replyTo":
-      bridge.replyTo = value;
-      return;
-    case "openclaw.deliverTimeoutMs":
-      bridge.deliverTimeoutMs = parsePositiveInteger(value, key);
-      return;
-    default:
-      throw new Error(
-        [
-          `Unknown config key: ${key}`,
-          "Supported keys:",
-          "  bridge.mode",
-          "  openclaw.path",
-          "  openclaw.sessionId",
-          "  openclaw.threadId",
-          "  openclaw.deliver",
-          "  openclaw.deliverChannel",
-          "  openclaw.replyTo",
-          "  openclaw.deliverTimeoutMs"
-        ].join("\n")
-      );
-  }
-}
-function applyBridgeUnset(bridge, key) {
-  switch (key) {
-    case "bridge.mode":
-      delete bridge.mode;
-      return;
-    case "openclaw.path":
-      delete bridge.openclawPath;
-      return;
-    case "openclaw.sessionId":
-      delete bridge.sessionId;
-      return;
-    case "openclaw.threadId":
-      delete bridge.threadId;
-      return;
-    case "openclaw.deliver":
-      delete bridge.deliver;
-      return;
-    case "openclaw.deliverChannel":
-      delete bridge.deliverChannel;
-      return;
-    case "openclaw.replyTo":
-      delete bridge.replyTo;
-      return;
-    case "openclaw.deliverTimeoutMs":
-      delete bridge.deliverTimeoutMs;
+  tunnel.command("status").description("Check tunnel connection status").argument("[tunnelId]", "Tunnel ID").option("-t, --tunnel <tunnelId>", "Tunnel ID (alternative to positional arg)").action(async (tunnelIdArg, opts) => {
+    const tunnelId = resolveTunnelIdSelection(tunnelIdArg, opts.tunnel) || await resolveActiveTunnel();
+    const socketPath = getSocketPath(tunnelId);
+    const response = await ipcCall(socketPath, { method: "status", params: {} });
+    console.log(`  Status: ${response.connected ? "connected" : "waiting"}`);
+    console.log(`  Uptime: ${response.uptime}s`);
+    const chNames = Array.isArray(response.channels) ? response.channels.map((c) => typeof c === "string" ? c : String(c)) : [];
+    console.log(`  Channels: ${chNames.join(", ")}`);
+    console.log(`  Buffered: ${response.bufferedMessages ?? 0} messages`);
+    if (typeof response.lastError === "string" && response.lastError.length > 0) {
+      console.log(`  Last error: ${response.lastError}`);
+    }
+    const logPath = tunnelLogPath(tunnelId);
+    if (fs4.existsSync(logPath)) {
+      console.log(`  Log: ${logPath}`);
+    }
+    const bridgeInfo = readBridgeProcessInfo(tunnelId);
+    if (bridgeInfo) {
+      const bridgeRunning = isBridgeRunning(tunnelId);
+      const bridgeState = bridgeInfo.status || (bridgeRunning ? "running" : "stopped");
+      console.log(`  Bridge: ${bridgeInfo.mode} (${bridgeState})`);
+      if (bridgeInfo.sessionId) {
+        console.log(`  Bridge session: ${bridgeInfo.sessionId}`);
+      }
+      if (bridgeInfo.sessionSource) {
+        console.log(`  Bridge session source: ${bridgeInfo.sessionSource}`);
+      }
+      if (bridgeInfo.sessionKey) {
+        console.log(`  Bridge session key: ${bridgeInfo.sessionKey}`);
+      }
+      if (bridgeInfo.lastError) {
+        console.log(`  Bridge last error: ${bridgeInfo.lastError}`);
+      }
+    }
+    const bridgeLog = bridgeLogPath(tunnelId);
+    if (fs4.existsSync(bridgeLog)) {
+      console.log(`  Bridge log: ${bridgeLog}`);
+    }
+  });
+  tunnel.command("doctor").description("Run strict end-to-end tunnel checks (daemon, channels, chat/canvas ping)").option("-t, --tunnel <tunnelId>", "Tunnel ID (auto-detected if one active)").option("--timeout <seconds>", "Timeout for pong wait and repeated reads", "30").option("--wait-pong", "Wait for user to reply with exact text 'pong' on chat channel").option("--skip-chat", "Skip chat ping check").option("--skip-canvas", "Skip canvas ping check").action(
+    async (opts) => {
+      const timeoutSeconds = parsePositiveIntegerOption(opts.timeout, "--timeout");
+      const timeoutMs = timeoutSeconds * 1e3;
+      const tunnelId = opts.tunnel || await resolveActiveTunnel();
+      const socketPath = getSocketPath(tunnelId);
+      const apiClient = createApiClient();
+      const fail = (message) => failCli(`Doctor failed: ${message}`);
+      console.log(`Doctor tunnel: ${tunnelId}`);
+      let statusResponse = null;
+      try {
+        statusResponse = await ipcCall(socketPath, {
+          method: "status",
+          params: {}
+        });
+      } catch (error) {
+        fail(
+          `daemon is unreachable (${error instanceof Error ? error.message : String(error)}).`
+        );
+      }
+      if (!statusResponse) {
+        fail("daemon status returned no response.");
+      }
+      const daemonStatus = statusResponse;
+      if (!daemonStatus.ok) {
+        fail(`daemon returned non-ok status: ${String(daemonStatus.error || "unknown error")}`);
+      }
+      if (!daemonStatus.connected) {
+        fail("daemon is running but browser is not connected.");
+      }
+      const channelNames = Array.isArray(daemonStatus.channels) ? daemonStatus.channels.map((entry) => String(entry)) : [];
+      for (const required of [CONTROL_CHANNEL, CHANNELS.CHAT, CHANNELS.CANVAS]) {
+        if (!channelNames.includes(required)) {
+          fail(`required channel is missing: ${required}`);
+        }
+      }
+      console.log("Daemon/channel check: OK");
+      let apiTunnel;
+      try {
+        apiTunnel = await apiClient.get(tunnelId);
+      } catch (error) {
+        fail(`failed to fetch tunnel info from API: ${formatApiError(error)}`);
+      }
+      if (apiTunnel.status !== "active") {
+        fail(`API reports tunnel is not active (status: ${apiTunnel.status})`);
+      }
+      if (apiTunnel.expiresAt <= Date.now()) {
+        fail("API reports tunnel is expired.");
+      }
+      if (!apiTunnel.hasConnection) {
+        fail("API reports no browser connection.");
+      }
+      if (typeof apiTunnel.agentOffer !== "string" || apiTunnel.agentOffer.length === 0) {
+        fail("agent offer was not published.");
+      }
+      console.log("API/signaling check: OK");
+      if (!opts.skipChat) {
+        const pingText = "This is a ping test. Reply with 'pong'.";
+        const pingMsg = {
+          id: generateMessageId(),
+          type: "text",
+          data: pingText
+        };
+        const writeResponse = await ipcCall(socketPath, {
+          method: "write",
+          params: { channel: CHANNELS.CHAT, msg: pingMsg }
+        });
+        if (!writeResponse.ok) {
+          fail(`chat ping failed: ${String(writeResponse.error || "unknown write error")}`);
+        }
+        console.log("Chat ping write ACK: OK");
+        if (opts.waitPong) {
+          const startedAt = Date.now();
+          let receivedPong = false;
+          while (Date.now() - startedAt < timeoutMs) {
+            const readResponse = await ipcCall(socketPath, {
+              method: "read",
+              params: { channel: CHANNELS.CHAT }
+            });
+            if (!readResponse.ok) {
+              fail(
+                `chat read failed while waiting for pong: ${String(readResponse.error || "unknown read error")}`
+              );
+            }
+            const messages = Array.isArray(readResponse.messages) ? readResponse.messages : [];
+            if (messages.some((entry) => messageContainsPong(entry))) {
+              receivedPong = true;
+              break;
+            }
+            await new Promise((resolve3) => setTimeout(resolve3, 1e3));
+          }
+          if (!receivedPong) {
+            fail(
+              `timed out after ${timeoutSeconds}s waiting for exact 'pong' reply on chat channel.`
+            );
+          }
+          console.log("Chat pong roundtrip: OK");
+        }
+      }
+      if (!opts.skipCanvas) {
+        const stamp = (/* @__PURE__ */ new Date()).toISOString();
+        const canvasMsg = {
+          id: generateMessageId(),
+          type: "html",
+          data: `<!doctype html><html><body style="margin:0;padding:24px;font-family:system-ui;background:#111;color:#f5f5f5">Canvas ping OK<br><small>${stamp}</small></body></html>`
+        };
+        const canvasResponse = await ipcCall(socketPath, {
+          method: "write",
+          params: { channel: CHANNELS.CANVAS, msg: canvasMsg }
+        });
+        if (!canvasResponse.ok) {
+          fail(`canvas ping failed: ${String(canvasResponse.error || "unknown write error")}`);
+        }
+        console.log("Canvas ping write ACK: OK");
+      }
+      console.log("Tunnel doctor: PASS");
+    }
+  );
+  tunnel.command("list").description("List active tunnels").action(async () => {
+    const apiClient = createApiClient();
+    const tunnels = await apiClient.list();
+    if (tunnels.length === 0) {
+      console.log("No active tunnels.");
       return;
-    default:
-      throw new Error(`Unknown config key for --unset: ${key}`);
-  }
-}
-function hasBridgeValues(bridge) {
-  return Object.values(bridge).some((value) => value !== void 0);
-}
-function maskApiKey(apiKey) {
-  if (apiKey.length <= 8) return "********";
-  return `${apiKey.slice(0, 4)}...${apiKey.slice(-4)}`;
+    }
+    for (const t of tunnels) {
+      const age = Math.floor((Date.now() - t.createdAt) / 6e4);
+      const running = isDaemonRunning(t.tunnelId) ? "running" : "no daemon";
+      const bridgeInfo = readBridgeProcessInfo(t.tunnelId);
+      const bridge = bridgeInfo ? isBridgeRunning(t.tunnelId) ? `${bridgeInfo.mode}:running` : `${bridgeInfo.mode}:stopped` : "none";
+      const conn = t.hasConnection ? "connected" : "waiting";
+      console.log(`  ${t.tunnelId}  ${conn}  ${running}  bridge=${bridge}  ${age}m ago`);
+    }
+  });
+  tunnel.command("close").description("Close a tunnel and stop its daemon").argument("<tunnelId>", "Tunnel ID").action(async (tunnelId) => {
+    stopBridgeProcess(tunnelId);
+    try {
+      fs4.unlinkSync(bridgeInfoPath(tunnelId));
+    } catch {
+    }
+    const socketPath = getSocketPath(tunnelId);
+    try {
+      await ipcCall(socketPath, { method: "close", params: {} });
+    } catch {
+    }
+    const apiClient = createApiClient();
+    try {
+      await apiClient.close(tunnelId);
+    } catch (error) {
+      const message = formatApiError(error);
+      if (!/Tunnel not found/i.test(message)) {
+        failCli(`Failed to close tunnel ${tunnelId}: ${message}`);
+      }
+    }
+    console.log(`Closed: ${tunnelId}`);
+  });
 }
-function printConfigSummary(saved) {
-  if (!saved) {
-    console.log("Saved config: none");
-    return;
-  }
-  console.log("Saved config:");
-  console.log(`  apiKey: ${maskApiKey(saved.apiKey)}`);
-  if (!saved.bridge || !hasBridgeValues(saved.bridge)) {
-    console.log("  bridge: none");
-    return;
-  }
-  console.log(`  bridge.mode: ${saved.bridge.mode ?? "(unset)"}`);
-  if (saved.bridge.openclawPath) console.log(`  openclaw.path: ${saved.bridge.openclawPath}`);
-  if (saved.bridge.sessionId) console.log(`  openclaw.sessionId: ${saved.bridge.sessionId}`);
-  if (saved.bridge.threadId) console.log(`  openclaw.threadId: ${saved.bridge.threadId}`);
-  if (saved.bridge.deliver !== void 0)
-    console.log(`  openclaw.deliver: ${saved.bridge.deliver ? "true" : "false"}`);
-  if (saved.bridge.deliverChannel)
-    console.log(`  openclaw.deliverChannel: ${saved.bridge.deliverChannel}`);
-  if (saved.bridge.replyTo) console.log(`  openclaw.replyTo: ${saved.bridge.replyTo}`);
-  if (saved.bridge.deliverTimeoutMs !== void 0)
-    console.log(`  openclaw.deliverTimeoutMs: ${saved.bridge.deliverTimeoutMs}`);
+
+// src/commands/tunnel/message-commands.ts
+import * as fs5 from "fs";
+import * as path4 from "path";
+function registerTunnelMessageCommands(tunnel) {
+  tunnel.command("write").description("Write data to a channel").argument("[message]", "Text message (or use --file)").option("-t, --tunnel <tunnelId>", "Tunnel ID (auto-detected if one active)").option("-c, --channel <channel>", "Channel name", "chat").option("-f, --file <file>", "Read content from file").action(
+    async (messageArg, opts) => {
+      let msg;
+      let binaryBase64;
+      if (opts.file) {
+        const filePath = path4.resolve(opts.file);
+        const ext = path4.extname(filePath).toLowerCase();
+        const bytes = fs5.readFileSync(filePath);
+        const filename = path4.basename(filePath);
+        if (ext === ".html" || ext === ".htm") {
+          msg = {
+            id: generateMessageId(),
+            type: "html",
+            data: bytes.toString("utf-8"),
+            meta: { title: filename, filename, mime: getMimeType(filePath), size: bytes.length }
+          };
+        } else if (TEXT_FILE_EXTENSIONS.has(ext)) {
+          msg = {
+            id: generateMessageId(),
+            type: "text",
+            data: bytes.toString("utf-8"),
+            meta: { filename, mime: getMimeType(filePath), size: bytes.length }
+          };
+        } else {
+          msg = {
+            id: generateMessageId(),
+            type: "binary",
+            meta: { filename, mime: getMimeType(filePath), size: bytes.length }
+          };
+          binaryBase64 = bytes.toString("base64");
+        }
+      } else if (messageArg) {
+        msg = {
+          id: generateMessageId(),
+          type: "text",
+          data: messageArg
+        };
+      } else {
+        const chunks = [];
+        for await (const chunk of process.stdin) chunks.push(chunk);
+        msg = {
+          id: generateMessageId(),
+          type: "text",
+          data: Buffer.concat(chunks).toString("utf-8").trim()
+        };
+      }
+      const tunnelId = opts.tunnel || await resolveActiveTunnel();
+      const socketPath = getSocketPath(tunnelId);
+      const response = await ipcCall(socketPath, {
+        method: "write",
+        params: { channel: opts.channel, msg, binaryBase64 }
+      });
+      if (!response.ok) {
+        failCli(`Failed: ${response.error}`);
+      }
+    }
+  );
+  tunnel.command("read").description("Read buffered messages from channels").argument("[tunnelId]", "Tunnel ID (auto-detected if one active)").option("-t, --tunnel <tunnelId>", "Tunnel ID (alternative to positional arg)").option("-c, --channel <channel>", "Filter by channel").option("--follow", "Stream messages continuously").option("--all", "With --follow, include all channels instead of chat-only default").action(
+    async (tunnelIdArg, opts) => {
+      const tunnelId = resolveTunnelIdSelection(tunnelIdArg, opts.tunnel) || await resolveActiveTunnel();
+      const socketPath = getSocketPath(tunnelId);
+      const readChannel = opts.channel || (opts.follow && !opts.all ? CHANNELS.CHAT : void 0);
+      if (opts.follow) {
+        if (!opts.channel && !opts.all) {
+          console.error(
+            "Following chat channel by default. Use `--all` to include binary/file channels."
+          );
+        }
+        let consecutiveFailures = 0;
+        let warnedDisconnected = false;
+        while (true) {
+          try {
+            const response = await ipcCall(socketPath, {
+              method: "read",
+              params: { channel: readChannel }
+            });
+            if (warnedDisconnected) {
+              console.error("Daemon reconnected.");
+              warnedDisconnected = false;
+            }
+            consecutiveFailures = 0;
+            if (response.messages && response.messages.length > 0) {
+              for (const m of response.messages) {
+                console.log(JSON.stringify(m));
+              }
+            }
+          } catch (error) {
+            consecutiveFailures += 1;
+            if (!warnedDisconnected) {
+              const detail = error instanceof Error ? ` ${error.message}` : "";
+              console.error(`Daemon disconnected. Waiting for recovery...${detail}`);
+              warnedDisconnected = true;
+            }
+          }
+          const delayMs = getFollowReadDelayMs(warnedDisconnected, consecutiveFailures);
+          await new Promise((resolve3) => setTimeout(resolve3, delayMs));
+        }
+      } else {
+        const response = await ipcCall(socketPath, {
+          method: "read",
+          params: { channel: readChannel }
+        });
+        if (!response.ok) {
+          failCli(`Failed: ${response.error}`);
+        }
+        console.log(JSON.stringify(response.messages || [], null, 2));
+      }
+    }
+  );
 }
-function resolveVisibilityFlags(opts) {
-  if (opts.public && opts.private) {
-    throw new Error(`Use only one of --public or --private for ${opts.commandName}.`);
+
+// src/commands/tunnel/start-command.ts
+import { fork as fork2 } from "child_process";
+import * as fs6 from "fs";
+import * as path5 from "path";
+
+// package.json
+var package_default = {
+  name: "pubblue",
+  version: "0.4.12",
+  description: "CLI tool for publishing static content via pub.blue",
+  type: "module",
+  bin: {
+    pubblue: "./dist/index.js"
+  },
+  scripts: {
+    build: "tsup src/index.ts src/tunnel-daemon-entry.ts src/tunnel-bridge-entry.ts --format esm --dts --clean",
+    dev: "tsup src/index.ts src/tunnel-daemon-entry.ts src/tunnel-bridge-entry.ts --format esm --watch",
+    test: "vitest run",
+    "test:watch": "vitest",
+    lint: "tsc --noEmit"
+  },
+  dependencies: {
+    commander: "^13.0.0",
+    "node-datachannel": "^0.32.0"
+  },
+  devDependencies: {
+    "@types/node": "22.10.2",
+    tsup: "^8.3.6",
+    typescript: "^5.7.2",
+    vitest: "^3.0.0"
+  },
+  files: [
+    "dist"
+  ],
+  repository: {
+    type: "git",
+    url: "git+https://github.com/xmanatee/pub.git",
+    directory: "cli"
+  },
+  publishConfig: {
+    access: "public"
+  },
+  pnpm: {
+    onlyBuiltDependencies: [
+      "esbuild",
+      "node-datachannel"
+    ]
   }
-  if (opts.public) return true;
-  if (opts.private) return false;
-  return void 0;
+};
+
+// src/lib/version.ts
+var version = package_default.version;
+if (typeof version !== "string" || version.length === 0) {
+  throw new Error("Invalid CLI version in package.json");
 }
-function readFile(filePath) {
-  const resolved = path3.resolve(filePath);
-  if (!fs3.existsSync(resolved)) {
-    console.error(`File not found: ${resolved}`);
-    process.exit(1);
+var CLI_VERSION = version;
+
+// src/commands/tunnel/start-command.ts
+async function waitForStopped(isRunning, timeoutMs, pollMs = 120) {
+  const started = Date.now();
+  while (Date.now() - started < timeoutMs) {
+    if (!isRunning()) return true;
+    await new Promise((resolve3) => setTimeout(resolve3, pollMs));
   }
-  return {
-    content: fs3.readFileSync(resolved, "utf-8"),
-    basename: path3.basename(resolved)
-  };
+  return !isRunning();
 }
-program.name("pubblue").description("Publish static content and get shareable URLs").version("0.4.10");
-program.command("configure").description("Configure the CLI with your API key").option("--api-key <key>", "Your API key (less secure: appears in shell history)").option("--api-key-stdin", "Read API key from stdin").option(
-  "--set <key=value>",
-  "Set advanced config (repeatable). Example: --set openclaw.sessionId=<id>",
-  collectValues,
-  []
-).option("--unset <key>", "Unset advanced config key (repeatable)", collectValues, []).option("--show", "Show saved configuration").action(
-  async (opts) => {
-    try {
-      const saved = loadConfig();
-      const hasApiUpdate = Boolean(opts.apiKey || opts.apiKeyStdin);
-      const hasSet = opts.set.length > 0;
-      const hasUnset = opts.unset.length > 0;
-      const hasMutation = hasApiUpdate || hasSet || hasUnset;
-      if (!hasMutation && opts.show) {
-        printConfigSummary(saved);
-        return;
+function registerTunnelStartCommand(tunnel) {
+  tunnel.command("start").description("Start a tunnel daemon (reuses existing tunnel when possible)").option("--expires <duration>", "Auto-close after duration (e.g. 4h, 1d)", "24h").option("-t, --tunnel <tunnelId>", "Attach/start daemon for an existing tunnel").option("--new", "Always create a new tunnel (skip single-tunnel reuse)").option("--bridge <mode>", "Bridge mode: openclaw|none").option("--foreground", "Run in foreground (don't fork, no managed bridge)").action(
+    async (opts) => {
+      await ensureNodeDatachannelAvailable();
+      const runtimeConfig = getConfig();
+      const apiClient = createApiClient(runtimeConfig);
+      let target = null;
+      const bridgeMode = parseBridgeMode(opts.bridge || runtimeConfig.bridge?.mode || "openclaw");
+      const bridgeProcessEnv = buildBridgeProcessEnv(runtimeConfig.bridge);
+      if (opts.tunnel) {
+        try {
+          const existing = await apiClient.get(opts.tunnel);
+          if (existing.status === "closed" || existing.expiresAt <= Date.now()) {
+            failCli(`Tunnel ${opts.tunnel} is closed or expired.`);
+          }
+          target = {
+            createdNew: false,
+            expiresAt: existing.expiresAt,
+            mode: "existing",
+            tunnelId: existing.tunnelId,
+            url: getPublicTunnelUrl(existing.tunnelId)
+          };
+        } catch (error) {
+          failCli(`Failed to use tunnel ${opts.tunnel}: ${formatApiError(error)}`);
+        }
+      } else if (!opts.new) {
+        try {
+          const listed = await apiClient.list();
+          const active = listed.filter((t) => t.status === "active" && t.expiresAt > Date.now()).sort((a, b) => b.createdAt - a.createdAt);
+          const reusable = pickReusableTunnel(listed);
+          if (reusable) {
+            target = {
+              createdNew: false,
+              expiresAt: reusable.expiresAt,
+              mode: "existing",
+              tunnelId: reusable.tunnelId,
+              url: getPublicTunnelUrl(reusable.tunnelId)
+            };
+            if (active.length > 1) {
+              console.error(
+                [
+                  `Multiple active tunnels found: ${active.map((t) => t.tunnelId).join(", ")}`,
+                  `Reusing most recent active tunnel ${reusable.tunnelId}.`,
+                  "Use --tunnel <id> to choose explicitly or --new to force creation."
+                ].join("\n")
+              );
+            } else {
+              console.error(
+                `Reusing existing active tunnel ${reusable.tunnelId}. Use --new to force creation.`
+              );
+            }
+          }
+        } catch (error) {
+          failCli(`Failed to list tunnels for reuse check: ${formatApiError(error)}`);
+        }
       }
-      let apiKey = saved?.apiKey;
-      if (hasApiUpdate || !hasMutation) {
-        apiKey = await resolveConfigureApiKey(opts);
+      if (!target) {
+        try {
+          const created = await apiClient.create({
+            expiresIn: opts.expires
+          });
+          target = {
+            createdNew: true,
+            expiresAt: created.expiresAt,
+            mode: "created",
+            tunnelId: created.tunnelId,
+            url: created.url
+          };
+        } catch (error) {
+          failCli(`Failed to create tunnel: ${formatApiError(error)}`);
+        }
       }
-      if (!apiKey) {
-        const envKey = process.env.PUBBLUE_API_KEY?.trim();
-        if (envKey) {
-          apiKey = envKey;
-        } else {
+      if (!target) {
+        failCli("Failed to resolve tunnel target.");
+      }
+      const socketPath = getSocketPath(target.tunnelId);
+      const infoPath = tunnelInfoPath(target.tunnelId);
+      const logPath = tunnelLogPath(target.tunnelId);
+      if (opts.foreground) {
+        if (bridgeMode !== "none") {
           throw new Error(
-            "No API key available. Provide --api-key/--api-key-stdin (or run plain `pubblue configure` first)."
+            "Foreground mode disables managed bridge process. Use background mode for --bridge openclaw."
           );
         }
+        const { startDaemon } = await import("./tunnel-daemon-RKWEA5BV.js");
+        console.log(`Tunnel started: ${target.url}`);
+        const fgTma = getTelegramMiniAppUrl("tunnel", target.tunnelId);
+        if (fgTma) console.log(`Telegram: ${fgTma}`);
+        console.log(`Tunnel ID: ${target.tunnelId}`);
+        console.log(`Expires: ${new Date(target.expiresAt).toISOString()}`);
+        if (target.mode === "existing") console.log("Mode: attached existing tunnel");
+        console.log("Running in foreground. Press Ctrl+C to stop.");
+        try {
+          await startDaemon({
+            cliVersion: CLI_VERSION,
+            tunnelId: target.tunnelId,
+            apiClient,
+            socketPath,
+            infoPath
+          });
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          failCli(`Daemon failed: ${message}`);
+        }
+        return;
       }
-      const nextBridge = { ...saved?.bridge ?? {} };
-      for (const entry of opts.set) {
-        const { key, value } = parseSetInput(entry);
-        applyBridgeSet(nextBridge, key, value);
+      const runningDaemonInfo = readDaemonProcessInfo(target.tunnelId);
+      if (runningDaemonInfo) {
+        const daemonVersion = runningDaemonInfo.cliVersion;
+        const shouldRestartForUpgrade = shouldRestartDaemonForCliUpgrade(
+          daemonVersion,
+          CLI_VERSION
+        );
+        if (shouldRestartForUpgrade) {
+          console.error(
+            `Restarting daemon for CLI version ${CLI_VERSION} (running: ${daemonVersion || "unknown"}).`
+          );
+          if (isBridgeRunning(target.tunnelId)) {
+            stopBridgeProcess(target.tunnelId);
+            const bridgeStopped = await waitForStopped(
+              () => isBridgeRunning(target.tunnelId),
+              5e3
+            );
+            if (!bridgeStopped) {
+              failCli("Bridge process did not stop during daemon upgrade restart.");
+            }
+          }
+          try {
+            await ipcCall(socketPath, { method: "close", params: {} });
+          } catch (error) {
+            failCli(
+              [
+                `Failed to stop running daemon for upgrade: ${error instanceof Error ? error.message : String(error)}`,
+                "Run `pubblue tunnel close <id>` and retry."
+              ].join("\n")
+            );
+          }
+          const daemonStopped = await waitForStopped(
+            () => isDaemonRunning(target.tunnelId),
+            6e3
+          );
+          if (!daemonStopped) {
+            failCli("Daemon did not stop in time during upgrade restart.");
+          }
+        } else {
+          try {
+            const status = await ipcCall(socketPath, { method: "status", params: {} });
+            if (!status.ok) throw new Error(String(status.error || "status check failed"));
+          } catch (error) {
+            failCli(
+              [
+                `Daemon process exists but is not responding: ${error instanceof Error ? error.message : String(error)}`,
+                "Run `pubblue tunnel close <id>` and start again."
+              ].join("\n")
+            );
+          }
+          if (bridgeMode !== "none") {
+            const bridgeReady = await ensureBridgeReady({
+              bridgeMode,
+              tunnelId: target.tunnelId,
+              socketPath,
+              bridgeProcessEnv,
+              timeoutMs: 8e3
+            });
+            if (!bridgeReady.ok) {
+              const lines = [
+                `Bridge failed to start for running tunnel: ${bridgeReady.reason ?? "unknown reason"}`
+              ];
+              const existingBridgeLog = bridgeLogPath(target.tunnelId);
+              if (fs6.existsSync(existingBridgeLog)) {
+                lines.push(`Bridge log: ${existingBridgeLog}`);
+                const bridgeTail = readLogTail(existingBridgeLog);
+                if (bridgeTail) {
+                  lines.push("---- bridge log tail ----");
+                  lines.push(bridgeTail.trimEnd());
+                  lines.push("---- end bridge log tail ----");
+                }
+              }
+              failCli(lines.join("\n"));
+            }
+          }
+          console.log(`Tunnel started: ${target.url}`);
+          const runTma = getTelegramMiniAppUrl("tunnel", target.tunnelId);
+          if (runTma) console.log(`Telegram: ${runTma}`);
+          console.log(`Tunnel ID: ${target.tunnelId}`);
+          console.log(`Expires: ${new Date(target.expiresAt).toISOString()}`);
+          console.log("Daemon already running for this tunnel.");
+          console.log(`Daemon log: ${logPath}`);
+          if (bridgeMode !== "none") {
+            console.log("Bridge mode: openclaw");
+            console.log(`Bridge log: ${bridgeLogPath(target.tunnelId)}`);
+          }
+          return;
+        }
       }
-      for (const key of opts.unset) {
-        applyBridgeUnset(nextBridge, key.trim());
+      const daemonScript = path5.join(import.meta.dirname, "tunnel-daemon-entry.js");
+      const daemonLogFd = fs6.openSync(logPath, "a");
+      const child = fork2(daemonScript, [], {
+        detached: true,
+        stdio: buildDaemonForkStdio(daemonLogFd),
+        env: {
+          ...process.env,
+          PUBBLUE_DAEMON_TUNNEL_ID: target.tunnelId,
+          PUBBLUE_DAEMON_BASE_URL: runtimeConfig.baseUrl,
+          PUBBLUE_DAEMON_API_KEY: runtimeConfig.apiKey,
+          PUBBLUE_DAEMON_SOCKET: socketPath,
+          PUBBLUE_DAEMON_INFO: infoPath,
+          PUBBLUE_CLI_VERSION: CLI_VERSION
+        }
+      });
+      fs6.closeSync(daemonLogFd);
+      if (child.connected) {
+        child.disconnect();
       }
-      const nextConfig = {
-        apiKey,
-        bridge: hasBridgeValues(nextBridge) ? nextBridge : void 0
-      };
-      saveConfig(nextConfig);
-      console.log("Configuration saved.");
-      if (opts.show || hasSet || hasUnset) {
-        printConfigSummary(nextConfig);
+      child.unref();
+      console.log(`Starting daemon for tunnel ${target.tunnelId}...`);
+      const ready = await waitForDaemonReady({
+        child,
+        infoPath,
+        socketPath,
+        timeoutMs: 8e3
+      });
+      if (!ready.ok) {
+        const lines = [
+          `Daemon failed to start: ${ready.reason ?? "unknown reason"}`,
+          `Daemon log: ${logPath}`
+        ];
+        const tail = readLogTail(logPath);
+        if (tail) {
+          lines.push("---- daemon log tail ----");
+          lines.push(tail.trimEnd());
+          lines.push("---- end daemon log tail ----");
+        }
+        await cleanupCreatedTunnelOnStartFailure(apiClient, target);
+        failCli(lines.join("\n"));
+      }
+      const offerReady = await waitForAgentOffer({
+        apiClient,
+        tunnelId: target.tunnelId,
+        timeoutMs: 5e3
+      });
+      if (!offerReady.ok) {
+        const lines = [
+          `Daemon started but signaling is not ready: ${offerReady.reason}`,
+          `Daemon log: ${logPath}`
+        ];
+        const tail = readLogTail(logPath);
+        if (tail) {
+          lines.push("---- daemon log tail ----");
+          lines.push(tail.trimEnd());
+          lines.push("---- end daemon log tail ----");
+        }
+        await cleanupCreatedTunnelOnStartFailure(apiClient, target);
+        failCli(lines.join("\n"));
+      }
+      if (bridgeMode !== "none") {
+        const bridgeReady = await ensureBridgeReady({
+          bridgeMode,
+          tunnelId: target.tunnelId,
+          socketPath,
+          bridgeProcessEnv,
+          timeoutMs: 8e3
+        });
+        if (!bridgeReady.ok) {
+          const lines = [`Bridge failed to start: ${bridgeReady.reason ?? "unknown reason"}`];
+          const bridgeLog = bridgeLogPath(target.tunnelId);
+          if (fs6.existsSync(bridgeLog)) {
+            lines.push(`Bridge log: ${bridgeLog}`);
+            const bridgeTail = readLogTail(bridgeLog);
+            if (bridgeTail) {
+              lines.push("---- bridge log tail ----");
+              lines.push(bridgeTail.trimEnd());
+              lines.push("---- end bridge log tail ----");
+            }
+          }
+          try {
+            await ipcCall(socketPath, { method: "close", params: {} });
+          } catch {
+          }
+          await cleanupCreatedTunnelOnStartFailure(apiClient, target);
+          failCli(lines.join("\n"));
+        }
+      }
+      console.log(`Tunnel started: ${target.url}`);
+      const tma = getTelegramMiniAppUrl("tunnel", target.tunnelId);
+      if (tma) console.log(`Telegram: ${tma}`);
+      console.log(`Tunnel ID: ${target.tunnelId}`);
+      console.log(`Expires: ${new Date(target.expiresAt).toISOString()}`);
+      if (target.mode === "existing") console.log("Mode: attached existing tunnel");
+      console.log("Daemon health: OK");
+      console.log(`Daemon log: ${logPath}`);
+      if (bridgeMode !== "none") {
+        console.log("Bridge mode: openclaw");
+        console.log(`Bridge log: ${bridgeLogPath(target.tunnelId)}`);
       }
-    } catch (error) {
-      const message = error instanceof Error ? error.message : "Failed to configure CLI.";
-      console.error(message);
-      process.exit(1);
-    }
-  }
-);
-program.command("create").description("Create a new publication").argument("[file]", "Path to the file (reads stdin if omitted)").option("--slug <slug>", "Custom slug for the URL").option("--title <title>", "Title for the publication").option("--public", "Make the publication public").option("--private", "Make the publication private (default)").option("--expires <duration>", "Auto-delete after duration (e.g. 1h, 24h, 7d)").action(
-  async (fileArg, opts) => {
-    const client = createClient();
-    let content;
-    let filename;
-    if (fileArg) {
-      const file = readFile(fileArg);
-      content = file.content;
-      filename = file.basename;
-    } else {
-      content = await readFromStdin();
-    }
-    const resolvedVisibility = resolveVisibilityFlags({
-      public: opts.public,
-      private: opts.private,
-      commandName: "create"
-    });
-    const result = await client.create({
-      content,
-      filename,
-      title: opts.title,
-      slug: opts.slug,
-      isPublic: resolvedVisibility ?? false,
-      expiresIn: opts.expires
-    });
-    console.log(`Created: ${result.url}`);
-    if (result.expiresAt) {
-      console.log(`  Expires: ${new Date(result.expiresAt).toISOString()}`);
-    }
-  }
-);
-program.command("get").description("Get details of a publication").argument("<slug>", "Slug of the publication").option("--content", "Output raw content to stdout (no metadata, pipeable)").action(async (slug, opts) => {
-  const client = createClient();
-  const pub = await client.get(slug);
-  if (opts.content) {
-    process.stdout.write(pub.content);
-    return;
-  }
-  console.log(`  Slug:    ${pub.slug}`);
-  console.log(`  Type:    ${pub.contentType}`);
-  if (pub.title) console.log(`  Title:   ${pub.title}`);
-  console.log(`  Status:  ${formatVisibility(pub.isPublic)}`);
-  if (pub.expiresAt) console.log(`  Expires: ${new Date(pub.expiresAt).toISOString()}`);
-  console.log(`  Created: ${new Date(pub.createdAt).toLocaleDateString()}`);
-  console.log(`  Updated: ${new Date(pub.updatedAt).toLocaleDateString()}`);
-  console.log(`  Size:    ${pub.content.length} bytes`);
-});
-program.command("update").description("Update a publication's content and/or metadata").argument("<slug>", "Slug of the publication to update").option("--file <file>", "New content from file").option("--title <title>", "New title").option("--public", "Make the publication public").option("--private", "Make the publication private").option("--slug <newSlug>", "Rename the slug").action(
-  async (slug, opts) => {
-    const client = createClient();
-    let content;
-    let filename;
-    if (opts.file) {
-      const file = readFile(opts.file);
-      content = file.content;
-      filename = file.basename;
     }
-    const isPublic = resolveVisibilityFlags({
-      public: opts.public,
-      private: opts.private,
-      commandName: "update"
-    });
-    const result = await client.update({
-      slug,
-      content,
-      filename,
-      title: opts.title,
-      isPublic,
-      newSlug: opts.slug
-    });
-    console.log(`Updated: ${result.slug}`);
-    if (result.title) console.log(`  Title:  ${result.title}`);
-    console.log(`  Status: ${formatVisibility(result.isPublic)}`);
-  }
-);
-program.command("list").description("List your publications").action(async () => {
-  const client = createClient();
-  const pubs = await client.list();
-  if (pubs.length === 0) {
-    console.log("No publications.");
-    return;
-  }
-  for (const pub of pubs) {
-    const date = new Date(pub.createdAt).toLocaleDateString();
-    const expires = pub.expiresAt ? ` expires:${new Date(pub.expiresAt).toISOString()}` : "";
-    console.log(
-      `  ${pub.slug}  [${pub.contentType}]  ${formatVisibility(pub.isPublic)}  ${date}${expires}`
-    );
+  );
+}
+
+// src/commands/tunnel.ts
+function registerTunnelCommands(program2) {
+  const tunnel = program2.command("tunnel").description("P2P encrypted tunnel to browser");
+  registerTunnelStartCommand(tunnel);
+  registerTunnelMessageCommands(tunnel);
+  registerTunnelManagementCommands(tunnel);
+}
+
+// src/program.ts
+function buildProgram() {
+  const program2 = new Command();
+  program2.exitOverride();
+  program2.name("pubblue").description("Publish static content and get shareable URLs").version(CLI_VERSION);
+  registerConfigureCommand(program2);
+  registerPublicationCommands(program2);
+  registerTunnelCommands(program2);
+  return program2;
+}
+
+// src/index.ts
+var program = buildProgram();
+await program.parseAsync(process.argv).catch((error) => {
+  const failure = toCliFailure(error);
+  if (failure.message) {
+    console.error(failure.message);
   }
+  process.exit(failure.exitCode);
 });
-program.command("delete").description("Delete a publication").argument("<slug>", "Slug of the publication to delete").action(async (slug) => {
-  const client = createClient();
-  await client.remove(slug);
-  console.log(`Deleted: ${slug}`);
-});
-registerTunnelCommands(program);
-program.parse();