ragent-cli 1.1.0

package/dist/index.js

@@ -0,0 +1,2206 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// package.json
+var require_package = __commonJS({
+  "package.json"(exports2, module2) {
+    module2.exports = {
+      name: "ragent-cli",
+      version: "1.1.0",
+      description: "CLI agent for rAgent Live \u2014 browser-first terminal control plane for AI coding agents",
+      main: "dist/index.js",
+      bin: {
+        ragent: "./dist/index.js"
+      },
+      scripts: {
+        build: "tsup",
+        dev: "tsup --watch",
+        test: "vitest run",
+        typecheck: "tsc --noEmit"
+      },
+      keywords: [
+        "terminal",
+        "remote",
+        "agent",
+        "cli",
+        "tmux",
+        "devops",
+        "ssh",
+        "control-plane"
+      ],
+      author: "Intellimetrics <support@intellimetrics.net>",
+      license: "MIT",
+      homepage: "https://ragent.live",
+      repository: {
+        type: "git",
+        url: "git+https://github.com/chadlindell/ragent-live.git",
+        directory: "cli"
+      },
+      bugs: {
+        url: "https://github.com/chadlindell/ragent-live/issues"
+      },
+      engines: {
+        node: ">=20"
+      },
+      os: [
+        "linux"
+      ],
+      files: [
+        "dist"
+      ],
+      dependencies: {
+        "@azure/web-pubsub-client": "^1.0.2",
+        commander: "^14.0.3",
+        figlet: "^1.9.3",
+        "node-pty": "^1.1.0",
+        ws: "^8.19.0"
+      },
+      devDependencies: {
+        "@types/figlet": "^1.7.0",
+        "@types/node": "^20.17.0",
+        "@types/ws": "^8.5.13",
+        tsup: "^8.4.0",
+        typescript: "^5.7.0",
+        vitest: "^3.0.0"
+      }
+    };
+  }
+});
+
+// src/index.ts
+var fs5 = __toESM(require("fs"));
+var import_commander = require("commander");
+
+// src/constants.ts
+var os = __toESM(require("os"));
+var path = __toESM(require("path"));
+var packageInfo = require_package();
+var DEFAULT_PORTAL = process.env.RAGENT_PORTAL || "http://localhost:3000";
+var CONFIG_DIR = path.join(os.homedir(), ".config", "ragent");
+var CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
+var SERVICE_NAME = "ragent.service";
+var SERVICE_DIR = path.join(os.homedir(), ".config", "systemd", "user");
+var SERVICE_FILE = path.join(SERVICE_DIR, SERVICE_NAME);
+var FALLBACK_PID_FILE = path.join(CONFIG_DIR, "ragent.pid");
+var FALLBACK_LOG_FILE = path.join(CONFIG_DIR, "ragent.log");
+var WS_HEARTBEAT_MS = 15e3;
+var HTTP_HEARTBEAT_MS = 5 * 60 * 1e3;
+var PACKAGE_NAME = packageInfo.name || "ragent-cli";
+var CURRENT_VERSION = packageInfo.version || "0.0.0";
+var SHOW_ART = process.stdout.isTTY && process.env.RAGENT_NO_ART !== "true";
+var DEFAULT_RECONNECT_DELAY_MS = 2500;
+var MAX_RECONNECT_DELAY_MS = 3e4;
+var OUTPUT_BUFFER_MAX_BYTES = 100 * 1024;
+
+// src/config.ts
+var fs = __toESM(require("fs"));
+var os2 = __toESM(require("os"));
+function ensureConfigDir() {
+  fs.mkdirSync(CONFIG_DIR, { recursive: true });
+}
+function loadConfig() {
+  try {
+    const stat = fs.statSync(CONFIG_FILE);
+    const mode = stat.mode & 511;
+    if (mode & 63) {
+      console.warn(
+        `[rAgent] WARNING: Config file ${CONFIG_FILE} has overly permissive permissions (${mode.toString(8)}). Fixing to 0600.`
+      );
+      fs.chmodSync(CONFIG_FILE, 384);
+    }
+    return JSON.parse(fs.readFileSync(CONFIG_FILE, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function saveConfig(config) {
+  ensureConfigDir();
+  fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), { encoding: "utf8", mode: 384 });
+}
+function saveConfigPatch(patch) {
+  const existing = loadConfig();
+  saveConfig({
+    ...existing,
+    ...patch,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+function sanitizeHostId(value) {
+  return String(value || "").toLowerCase().replace(/[^a-z0-9_-]/g, "-").replace(/^-+/, "").slice(0, 64);
+}
+function inferHostId() {
+  return sanitizeHostId(os2.hostname().split(".")[0] || "linux-host");
+}
+
+// src/version.ts
+function parseSemver(version) {
+  const match = String(version || "").trim().match(/^(\d+)\.(\d+)\.(\d+)/);
+  if (!match) return null;
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function isVersionNewer(latest, current) {
+  const latestParts = parseSemver(latest);
+  const currentParts = parseSemver(current);
+  if (!latestParts || !currentParts) return false;
+  for (let i = 0; i < 3; i += 1) {
+    if (latestParts[i] > currentParts[i]) return true;
+    if (latestParts[i] < currentParts[i]) return false;
+  }
+  return false;
+}
+async function fetchLatestVersion(timeoutMs = 1800) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(`https://registry.npmjs.org/${PACKAGE_NAME}/latest`, {
+      signal: controller.signal
+    });
+    if (!response.ok) return null;
+    const data = await response.json();
+    return typeof data.version === "string" ? data.version : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function checkForUpdate(opts = {}) {
+  const force = Boolean(opts.force);
+  const config = loadConfig();
+  const lastChecked = config.updateCheckedAt ? new Date(config.updateCheckedAt).getTime() : 0;
+  const intervalMs = 12 * 60 * 60 * 1e3;
+  const now = Date.now();
+  let latestVersion = null;
+  if (!force && lastChecked > 0 && now - lastChecked < intervalMs) {
+    latestVersion = config.latestKnownVersion || null;
+  } else {
+    latestVersion = await fetchLatestVersion();
+    if (latestVersion) {
+      saveConfigPatch({
+        updateCheckedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        latestKnownVersion: latestVersion
+      });
+    }
+  }
+  if (!latestVersion) return null;
+  return isVersionNewer(latestVersion, CURRENT_VERSION) ? latestVersion : null;
+}
+async function maybeWarnUpdate() {
+  if (process.env.RAGENT_DISABLE_UPDATE_CHECK === "true") return;
+  const latestVersion = await checkForUpdate({ force: false });
+  if (!latestVersion) return;
+  console.log(
+    `[rAgent] Update available: ${CURRENT_VERSION} -> ${latestVersion}. Run: ragent update`
+  );
+}
+
+// src/commands/connect.ts
+var os6 = __toESM(require("os"));
+
+// src/agent.ts
+var fs3 = __toESM(require("fs"));
+var os5 = __toESM(require("os"));
+var path2 = __toESM(require("path"));
+var import_ws2 = __toESM(require("ws"));
+
+// src/auth.ts
+var os3 = __toESM(require("os"));
+
+// src/system.ts
+var import_node_child_process = require("child_process");
+var readline = __toESM(require("readline/promises"));
+function wait(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function execAsync(command, options = {}) {
+  const timeout = options.timeout ?? 5e3;
+  const maxBuffer = options.maxBuffer ?? 1024 * 1024;
+  return new Promise((resolve, reject) => {
+    (0, import_node_child_process.exec)(command, { timeout, maxBuffer }, (error, stdout, stderr) => {
+      if (error) {
+        reject(new Error((stderr || error.message || "").trim()));
+        return;
+      }
+      resolve(stdout);
+    });
+  });
+}
+function shellQuote(value) {
+  return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+async function commandExists(command) {
+  try {
+    await execAsync(`command -v ${command}`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function detectTmuxInstallRecipe() {
+  return [
+    { manager: "apt-get", command: "sudo apt-get update && sudo apt-get install -y tmux" },
+    { manager: "dnf", command: "sudo dnf install -y tmux" },
+    { manager: "yum", command: "sudo yum install -y tmux" },
+    { manager: "pacman", command: "sudo pacman -Sy --noconfirm tmux" },
+    { manager: "zypper", command: "sudo zypper --non-interactive install tmux" }
+  ];
+}
+async function chooseTmuxInstallCommand() {
+  const recipes = detectTmuxInstallRecipe();
+  for (const recipe of recipes) {
+    if (await commandExists(recipe.manager)) {
+      return recipe;
+    }
+  }
+  return null;
+}
+async function askYesNo(question, defaultYes = true) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const hint = defaultYes ? "[Y/n]" : "[y/N]";
+  try {
+    const answer = (await rl.question(`${question} ${hint} `)).trim().toLowerCase();
+    if (!answer) return defaultYes;
+    return answer === "y" || answer === "yes";
+  } finally {
+    rl.close();
+  }
+}
+async function installTmuxInteractively() {
+  const recipe = await chooseTmuxInstallCommand();
+  if (!recipe) {
+    console.log("[rAgent] No supported package manager was detected for tmux auto-install.");
+    console.log("[rAgent] Install tmux manually, then rerun: ragent doctor --fix");
+    return false;
+  }
+  const approved = await askYesNo(
+    `[rAgent] tmux is missing. Install it now using ${recipe.manager}?`,
+    true
+  );
+  if (!approved) return false;
+  await new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process.spawn)("bash", ["-lc", recipe.command], { stdio: "inherit" });
+    child.on("exit", (code) => {
+      if (code === 0) resolve();
+      else reject(new Error(`tmux install command exited with code ${code}`));
+    });
+    child.on("error", reject);
+  });
+  return commandExists("tmux");
+}
+
+// src/sessions.ts
+async function collectTmuxSessions() {
+  try {
+    await execAsync("tmux -V");
+  } catch {
+    return [];
+  }
+  try {
+    const raw = await execAsync(
+      "tmux list-panes -a -F '#{session_name}|#{window_index}|#{pane_index}|#{pane_current_command}|#{pane_active}|#{pane_last}|#{pane_pid}'"
+    );
+    const rows = raw.split("\n").map((line) => line.trim()).filter(Boolean);
+    return rows.map((row) => {
+      const [sessionName, windowIndex, paneIndex, command, activeFlag, lastEpoch, panePid] = row.split("|");
+      const id = `tmux:${sessionName}:${windowIndex}.${paneIndex}`;
+      const lastActivityAt = Number(lastEpoch) > 0 ? new Date(Number(lastEpoch) * 1e3).toISOString() : (/* @__PURE__ */ new Date()).toISOString();
+      const pids = [];
+      const pid = Number(panePid);
+      if (pid > 0) pids.push(pid);
+      return {
+        id,
+        type: "tmux",
+        name: `${sessionName}:${windowIndex}.${paneIndex}`,
+        status: activeFlag === "1" ? "active" : "detached",
+        command,
+        agentType: detectAgentType(command),
+        lastActivityAt,
+        pids
+      };
+    });
+  } catch {
+    return [];
+  }
+}
+async function collectScreenSessions() {
+  try {
+    await execAsync("screen -v");
+  } catch {
+    return [];
+  }
+  try {
+    let raw;
+    try {
+      raw = await execAsync("screen -ls");
+    } catch (e) {
+      raw = e instanceof Error ? e.message : "";
+    }
+    const sessionPattern = /^\s*(\d+)\.(\S+)\s+\((Detached|Attached)\)/;
+    const sessions = [];
+    for (const line of raw.split("\n")) {
+      const match = line.match(sessionPattern);
+      if (!match) continue;
+      const [, screenPid, sessionName, state] = match;
+      const pid = Number(screenPid);
+      const childInfo = await getChildAgentInfo(pid);
+      if (!childInfo) continue;
+      const id = `screen:${sessionName}:${screenPid}`;
+      sessions.push({
+        id,
+        type: "screen",
+        name: `${sessionName}`,
+        status: state === "Attached" ? "active" : "detached",
+        command: childInfo.command,
+        agentType: childInfo.agentType,
+        lastActivityAt: (/* @__PURE__ */ new Date()).toISOString(),
+        pids: [pid, ...childInfo.childPids]
+      });
+    }
+    return sessions;
+  } catch {
+    return [];
+  }
+}
+async function collectZellijSessions() {
+  try {
+    await execAsync("zellij --version");
+  } catch {
+    return [];
+  }
+  try {
+    const raw = await execAsync("zellij list-sessions");
+    const sessions = [];
+    for (const line of raw.split("\n")) {
+      const sessionName = line.trim();
+      if (!sessionName) continue;
+      let serverPids;
+      try {
+        const psOut = await execAsync(
+          `ps axo pid,args --no-headers | grep 'zellij.*--session ${sessionName}' | grep -v grep`
+        );
+        serverPids = psOut.split("\n").map((l) => Number(l.trim().split(/\s+/)[0])).filter((p) => p > 0);
+      } catch {
+        serverPids = [];
+      }
+      const allChildPids = [];
+      let foundAgent = null;
+      for (const spid of serverPids) {
+        const childInfo = await getChildAgentInfo(spid);
+        if (childInfo) {
+          foundAgent = childInfo;
+          allChildPids.push(...childInfo.childPids);
+        }
+      }
+      if (!foundAgent) continue;
+      const id = `zellij:${sessionName}`;
+      sessions.push({
+        id,
+        type: "zellij",
+        name: sessionName,
+        status: "active",
+        command: foundAgent.command,
+        agentType: foundAgent.agentType,
+        lastActivityAt: (/* @__PURE__ */ new Date()).toISOString(),
+        pids: [...serverPids, ...allChildPids]
+      });
+    }
+    return sessions;
+  } catch {
+    return [];
+  }
+}
+async function collectBareAgentProcesses(excludePids) {
+  try {
+    const raw = await execAsync("ps axo pid,ppid,comm,args --no-headers");
+    const sessions = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const line of raw.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      const parts = trimmed.split(/\s+/);
+      if (parts.length < 4) continue;
+      const pid = Number(parts[0]);
+      const args = parts.slice(3).join(" ");
+      const agentType = detectAgentType(args);
+      if (!agentType) continue;
+      if (excludePids?.has(pid)) continue;
+      if (seen.has(pid)) continue;
+      seen.add(pid);
+      const id = `process:${pid}`;
+      sessions.push({
+        id,
+        type: "process",
+        name: `${agentType} (pid ${pid})`,
+        status: "active",
+        command: args,
+        agentType,
+        lastActivityAt: (/* @__PURE__ */ new Date()).toISOString(),
+        pids: [pid]
+      });
+    }
+    return sessions;
+  } catch {
+    return [];
+  }
+}
+async function collectSessionInventory(hostId, command) {
+  const [tmux, screen, zellij] = await Promise.all([
+    collectTmuxSessions(),
+    collectScreenSessions(),
+    collectZellijSessions()
+  ]);
+  const multiplexerPids = /* @__PURE__ */ new Set();
+  for (const s of [...tmux, ...screen, ...zellij]) {
+    if (s.pids) s.pids.forEach((p) => multiplexerPids.add(p));
+  }
+  const bare = await collectBareAgentProcesses(multiplexerPids);
+  const ptySession = {
+    id: `pty:${hostId}`,
+    type: "pty",
+    name: command,
+    status: "active",
+    command,
+    agentType: detectAgentType(command),
+    lastActivityAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  return [...tmux, ...screen, ...zellij, ...bare, ptySession];
+}
+function detectAgentType(command) {
+  if (!command) return void 0;
+  const cmd = command.toLowerCase();
+  if (cmd.includes("claude")) return "Claude Code";
+  if (cmd.includes("codex")) return "Codex CLI";
+  if (cmd.includes("aider")) return "aider";
+  if (cmd.includes("cursor")) return "Cursor";
+  if (cmd.includes("windsurf")) return "Windsurf";
+  if (cmd.includes("gemini")) return "Gemini CLI";
+  if (cmd.includes("amazon-q") || cmd.includes("amazon_q")) return "Amazon Q";
+  if (cmd.includes("copilot")) return "Copilot CLI";
+  return void 0;
+}
+function sessionInventoryFingerprint(sessions) {
+  const sorted = [...sessions].sort((a, b) => a.id.localeCompare(b.id));
+  return sorted.map((s) => `${s.id}|${s.type}|${s.name}|${s.status}|${s.command || ""}`).join("\n");
+}
+async function getChildAgentInfo(parentPid) {
+  try {
+    const raw = await execAsync(`ps --ppid ${parentPid} -o pid,args --no-headers`);
+    const childPids = [];
+    for (const line of raw.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      const spaceIdx = trimmed.indexOf(" ");
+      if (spaceIdx < 0) continue;
+      const pid = Number(trimmed.slice(0, spaceIdx));
+      const args = trimmed.slice(spaceIdx + 1).trim();
+      if (pid > 0) childPids.push(pid);
+      const agentType = detectAgentType(args);
+      if (agentType) {
+        return { command: args, agentType, childPids };
+      }
+      const deeper = await getChildAgentInfo(pid);
+      if (deeper) {
+        return { ...deeper, childPids: [...childPids, ...deeper.childPids] };
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+// src/auth.ts
+var AuthError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthError";
+  }
+};
+function decodeJwtExp(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    return typeof payload.exp === "number" ? payload.exp : null;
+  } catch {
+    return null;
+  }
+}
+async function refreshTokenIfNeeded(params) {
+  const config = loadConfig();
+  const refreshToken = config.refreshToken;
+  const exp = decodeJwtExp(params.agentToken);
+  if (!exp) return params.agentToken;
+  const remainingSeconds = exp - Math.floor(Date.now() / 1e3);
+  const threshold = remainingSeconds < 3600 ? 120 : 3600;
+  if (remainingSeconds > threshold) return params.agentToken;
+  console.log(
+    `[rAgent] Token expires in ${Math.round(remainingSeconds / 60)}m \u2014 refreshing...`
+  );
+  try {
+    const headers = { "Content-Type": "application/json" };
+    let body = {};
+    if (refreshToken) {
+      body = { refreshToken };
+    } else {
+      headers["Authorization"] = `Bearer ${params.agentToken}`;
+    }
+    const response = await fetch(`${params.portal}/api/agent/refresh`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const data2 = await response.json().catch(() => ({}));
+      console.warn(
+        `[rAgent] Token refresh failed: ${data2.error || response.status}`
+      );
+      return params.agentToken;
+    }
+    const data = await response.json();
+    if (!data.agentToken) return params.agentToken;
+    const patch = {
+      agentToken: data.agentToken,
+      tokenExpiresAt: data.expiresAt || ""
+    };
+    if (data.refreshToken) {
+      patch.refreshToken = data.refreshToken;
+      patch.refreshExpiresAt = data.refreshExpiresAt || "";
+    }
+    saveConfigPatch(patch);
+    console.log("[rAgent] Token refreshed successfully.");
+    return data.agentToken;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.warn(`[rAgent] Token refresh error: ${message}`);
+    return params.agentToken;
+  }
+}
+async function claimHost(params) {
+  const sessions = await collectSessionInventory(params.hostId, params.command);
+  const response = await fetch(`${params.portal}/api/agent/claim`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      connectionToken: params.connectionToken,
+      hostId: params.hostId,
+      hostName: params.hostName,
+      environment: os3.platform(),
+      sessions,
+      agentVersion: CURRENT_VERSION
+    })
+  });
+  const data = await response.json();
+  if (!response.ok) {
+    throw new Error(data.error || "Failed to connect machine");
+  }
+  if (!data.agentToken) {
+    throw new Error("Missing connector token in claim response");
+  }
+  return data;
+}
+async function negotiateAgent(params) {
+  const response = await fetch(`${params.portal}/api/agent/negotiate`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${params.agentToken}`
+    },
+    body: JSON.stringify({})
+  });
+  const data = await response.json();
+  if (response.status === 401 || response.status === 403) {
+    throw new AuthError(
+      data.error || "Connector token rejected (401/403). Re-connect this machine."
+    );
+  }
+  if (!response.ok) {
+    throw new Error(data.error || "Failed to negotiate websocket access");
+  }
+  if (!data.url || !data.groups?.privateGroup || !data.groups?.registryGroup) {
+    throw new Error("Negotiate response missing websocket URL or group info");
+  }
+  return data;
+}
+async function deregisterHost(params) {
+  const response = await fetch(`${params.portal}/api/agent/deregister`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${params.agentToken}`
+    },
+    body: JSON.stringify({})
+  });
+  if (response.status === 401 || response.status === 403) {
+    console.warn("[rAgent] Token expired \u2014 could not deregister from server. Host may remain visible in dashboard until manually removed.");
+    return false;
+  }
+  return response.ok;
+}
+async function postHeartbeat(params) {
+  const sessions = await collectSessionInventory(params.hostId, params.command);
+  try {
+    const response = await fetch(`${params.portal}/api/agent/heartbeat`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${params.agentToken}`
+      },
+      body: JSON.stringify({
+        environment: os3.platform(),
+        hostName: params.hostName,
+        sessions,
+        agentVersion: CURRENT_VERSION
+      })
+    });
+    if (response.status === 401 || response.status === 403) {
+      throw new AuthError(
+        "Heartbeat rejected (401/403). Token may be expired or revoked."
+      );
+    }
+  } catch (error) {
+    if (error instanceof AuthError) throw error;
+  }
+  return sessions;
+}
+
+// src/output-buffer.ts
+var OutputBuffer = class {
+  maxBytes;
+  chunks;
+  totalBytes;
+  constructor(maxBytes = OUTPUT_BUFFER_MAX_BYTES) {
+    this.maxBytes = maxBytes;
+    this.chunks = [];
+    this.totalBytes = 0;
+  }
+  push(chunk) {
+    const size = Buffer.byteLength(chunk, "utf8");
+    if (size > this.maxBytes) {
+      this.chunks = [chunk.slice(-this.maxBytes)];
+      this.totalBytes = Buffer.byteLength(this.chunks[0], "utf8");
+      return;
+    }
+    this.chunks.push(chunk);
+    this.totalBytes += size;
+    while (this.totalBytes > this.maxBytes && this.chunks.length > 1) {
+      const dropped = this.chunks.shift();
+      this.totalBytes -= Buffer.byteLength(dropped, "utf8");
+    }
+  }
+  drain() {
+    const result = this.chunks;
+    this.chunks = [];
+    this.totalBytes = 0;
+    return result;
+  }
+  get length() {
+    return this.chunks.length;
+  }
+  get byteLength() {
+    return this.totalBytes;
+  }
+};
+
+// src/pty.ts
+var pty = __toESM(require("node-pty"));
+function isInteractiveShell(command) {
+  const trimmed = String(command).trim();
+  return ["bash", "sh", "zsh", "fish"].includes(trimmed);
+}
+function spawnConnectorShell(command, onData, onExit) {
+  const shell = "bash";
+  const args = isInteractiveShell(command) ? [] : ["-lc", command];
+  const processName = isInteractiveShell(command) ? command : shell;
+  const ptyProcess = pty.spawn(processName, args, {
+    name: "xterm-color",
+    cols: 80,
+    rows: 30,
+    cwd: process.cwd(),
+    env: process.env
+  });
+  ptyProcess.onData(onData);
+  ptyProcess.onExit(onExit);
+  return ptyProcess;
+}
+async function stopTmuxPaneBySessionId(sessionId) {
+  if (!sessionId.startsWith("tmux:")) return false;
+  const paneTarget = sessionId.slice("tmux:".length).trim();
+  if (!paneTarget) return false;
+  await execAsync(`tmux kill-pane -t ${shellQuote(paneTarget)}`, { timeout: 5e3 });
+  return true;
+}
+async function stopAllDetachedTmuxSessions() {
+  try {
+    const raw = await execAsync(
+      "tmux list-sessions -F '#{session_name}|#{session_attached}'",
+      { timeout: 5e3 }
+    );
+    const lines = raw.split("\n").map((l) => l.trim()).filter(Boolean);
+    let killed = 0;
+    for (const line of lines) {
+      const [name, attached] = line.split("|");
+      if (attached === "0" && name) {
+        try {
+          await execAsync(`tmux kill-session -t ${shellQuote(name)}`, { timeout: 5e3 });
+          killed++;
+        } catch {
+        }
+      }
+    }
+    return killed;
+  } catch {
+    return 0;
+  }
+}
+
+// src/service.ts
+var import_child_process = require("child_process");
+var fs2 = __toESM(require("fs"));
+var os4 = __toESM(require("os"));
+function assertConfiguredAgentToken() {
+  const config = loadConfig();
+  if (!config.agentToken) {
+    throw new Error("No saved connector token. Run `ragent connect --token <token>` first.");
+  }
+}
+function getConfiguredServiceBackend() {
+  const config = loadConfig();
+  if (config.serviceBackend === "systemd" || config.serviceBackend === "pidfile") {
+    return config.serviceBackend;
+  }
+  if (fs2.existsSync(SERVICE_FILE)) return "systemd";
+  if (fs2.existsSync(FALLBACK_PID_FILE)) return "pidfile";
+  return null;
+}
+async function canUseSystemdUser() {
+  if (os4.platform() !== "linux") return false;
+  try {
+    await execAsync("systemctl --user --version", { timeout: 4e3 });
+    await execAsync("systemctl --user show-environment", { timeout: 4e3 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function runSystemctlUser(args, options = {}) {
+  const command = `systemctl --user ${args.map(shellQuote).join(" ")}`;
+  return execAsync(command, { timeout: options.timeout ?? 1e4 });
+}
+function buildSystemdUnit() {
+  return `[Unit]
+Description=rAgent Live connector
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${process.execPath} ${__filename} run
+Restart=always
+RestartSec=3
+Environment=NODE_ENV=production
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=read-only
+ReadWritePaths=%h/.config/ragent
+
+[Install]
+WantedBy=default.target
+`;
+}
+async function installSystemdService(opts = {}) {
+  assertConfiguredAgentToken();
+  fs2.mkdirSync(SERVICE_DIR, { recursive: true });
+  fs2.writeFileSync(SERVICE_FILE, buildSystemdUnit(), "utf8");
+  await runSystemctlUser(["daemon-reload"]);
+  if (opts.enable !== false) {
+    await runSystemctlUser(["enable", SERVICE_NAME]);
+  }
+  if (opts.start) {
+    await runSystemctlUser(["restart", SERVICE_NAME]);
+  }
+  saveConfigPatch({ serviceBackend: "systemd" });
+  console.log(`[rAgent] Installed systemd user service at ${SERVICE_FILE}`);
+}
+function readFallbackPid() {
+  try {
+    const raw = fs2.readFileSync(FALLBACK_PID_FILE, "utf8").trim();
+    const pid = Number.parseInt(raw, 10);
+    return Number.isInteger(pid) ? pid : null;
+  } catch {
+    return null;
+  }
+}
+function isProcessRunning(pid) {
+  if (!pid || !Number.isInteger(pid)) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function startPidfileService() {
+  assertConfiguredAgentToken();
+  const existingPid = readFallbackPid();
+  if (existingPid && isProcessRunning(existingPid)) {
+    console.log(`[rAgent] Service already running (pid ${existingPid})`);
+    return;
+  }
+  ensureConfigDir();
+  const logFd = fs2.openSync(FALLBACK_LOG_FILE, "a");
+  const child = (0, import_child_process.spawn)(process.execPath, [__filename, "run"], {
+    detached: true,
+    stdio: ["ignore", logFd, logFd],
+    cwd: os4.homedir(),
+    env: process.env
+  });
+  child.unref();
+  fs2.closeSync(logFd);
+  fs2.writeFileSync(FALLBACK_PID_FILE, `${child.pid}
+`, "utf8");
+  saveConfigPatch({ serviceBackend: "pidfile" });
+  console.log(`[rAgent] Started fallback background service (pid ${child.pid})`);
+  console.log(`[rAgent] Logs: ${FALLBACK_LOG_FILE}`);
+}
+async function stopPidfileService() {
+  const pid = readFallbackPid();
+  if (!pid || !isProcessRunning(pid)) {
+    try {
+      fs2.unlinkSync(FALLBACK_PID_FILE);
+    } catch {
+    }
+    console.log("[rAgent] Service is not running.");
+    return;
+  }
+  process.kill(pid, "SIGTERM");
+  for (let i = 0; i < 20; i += 1) {
+    if (!isProcessRunning(pid)) break;
+    await wait(150);
+  }
+  if (isProcessRunning(pid)) {
+    process.kill(pid, "SIGKILL");
+  }
+  try {
+    fs2.unlinkSync(FALLBACK_PID_FILE);
+  } catch {
+  }
+  console.log(`[rAgent] Stopped fallback background service (pid ${pid})`);
+}
+async function ensureServiceInstalled(opts = {}) {
+  const wantsSystemd = await canUseSystemdUser();
+  if (wantsSystemd) {
+    await installSystemdService(opts);
+    return "systemd";
+  }
+  saveConfigPatch({ serviceBackend: "pidfile" });
+  if (opts.start) {
+    await startPidfileService();
+  } else {
+    console.log(
+      "[rAgent] systemd user manager unavailable; using fallback pidfile backend."
+    );
+  }
+  return "pidfile";
+}
+async function startService() {
+  const backend = getConfiguredServiceBackend();
+  if (backend === "systemd") {
+    await runSystemctlUser(["start", SERVICE_NAME]);
+    console.log("[rAgent] Started service via systemd.");
+    return;
+  }
+  if (backend === "pidfile") {
+    await startPidfileService();
+    return;
+  }
+  await ensureServiceInstalled({ start: true, enable: true });
+}
+async function stopService() {
+  const backend = getConfiguredServiceBackend();
+  if (backend === "systemd") {
+    await runSystemctlUser(["stop", SERVICE_NAME]);
+    console.log("[rAgent] Stopped service via systemd.");
+    return;
+  }
+  await stopPidfileService();
+}
+async function restartService() {
+  const backend = getConfiguredServiceBackend();
+  if (backend === "systemd") {
+    await runSystemctlUser(["restart", SERVICE_NAME]);
+    console.log("[rAgent] Restarted service via systemd.");
+    return;
+  }
+  await stopPidfileService();
+  await startPidfileService();
+}
+async function printServiceStatus() {
+  const backend = getConfiguredServiceBackend();
+  if (backend === "systemd") {
+    const status = await execAsync(
+      `systemctl --user status ${shellQuote(SERVICE_NAME)} --no-pager --lines=20`,
+      { timeout: 1e4 }
+    ).catch((error) => {
+      console.log(error.message);
+      return "";
+    });
+    if (status) {
+      process.stdout.write(status);
+    }
+    return;
+  }
+  const pid = readFallbackPid();
+  if (pid && isProcessRunning(pid)) {
+    console.log(`[rAgent] fallback service running (pid ${pid})`);
+    console.log(`[rAgent] logs: ${FALLBACK_LOG_FILE}`);
+    return;
+  }
+  console.log("[rAgent] service is not running.");
+}
+async function printServiceLogs(opts) {
+  const lines = Number.parseInt(String(opts.lines || 100), 10) || 100;
+  const follow = Boolean(opts.follow);
+  const backend = getConfiguredServiceBackend();
+  if (backend === "systemd") {
+    if (follow) {
+      await new Promise((resolve) => {
+        const child = (0, import_child_process.spawn)(
+          "journalctl",
+          ["--user", "-u", SERVICE_NAME, "-f", "-n", String(lines)],
+          { stdio: "inherit" }
+        );
+        child.on("exit", () => resolve());
+      });
+      return;
+    }
+    const output = await execAsync(
+      `journalctl --user -u ${shellQuote(SERVICE_NAME)} -n ${lines} --no-pager`,
+      { timeout: 12e3 }
+    );
+    process.stdout.write(output);
+    return;
+  }
+  if (!fs2.existsSync(FALLBACK_LOG_FILE)) {
+    console.log(`[rAgent] No log file found at ${FALLBACK_LOG_FILE}`);
+    return;
+  }
+  if (follow) {
+    await new Promise((resolve) => {
+      const child = (0, import_child_process.spawn)("tail", ["-n", String(lines), "-f", FALLBACK_LOG_FILE], {
+        stdio: "inherit"
+      });
+      child.on("exit", () => resolve());
+    });
+    return;
+  }
+  const content = fs2.readFileSync(FALLBACK_LOG_FILE, "utf8");
+  const tail = content.split("\n").slice(-lines).join("\n");
+  process.stdout.write(`${tail}${tail.endsWith("\n") ? "" : "\n"}`);
+}
+async function uninstallService() {
+  const backend = getConfiguredServiceBackend();
+  if (backend === "systemd") {
+    await runSystemctlUser(["stop", SERVICE_NAME]).catch(() => void 0);
+    await runSystemctlUser(["disable", SERVICE_NAME]).catch(() => void 0);
+    try {
+      fs2.unlinkSync(SERVICE_FILE);
+    } catch {
+    }
+    await runSystemctlUser(["daemon-reload"]).catch(() => void 0);
+  } else {
+    await stopPidfileService();
+  }
+  const config = loadConfig();
+  delete config.serviceBackend;
+  saveConfig(config);
+  console.log("[rAgent] Service uninstalled.");
+}
+function requestStopSelfService() {
+  const backend = getConfiguredServiceBackend();
+  if (backend === "systemd") {
+    const child = (0, import_child_process.spawn)("systemctl", ["--user", "stop", SERVICE_NAME], {
+      detached: true,
+      stdio: "ignore"
+    });
+    child.unref();
+    return;
+  }
+  if (backend === "pidfile") {
+    try {
+      fs2.unlinkSync(FALLBACK_PID_FILE);
+    } catch {
+    }
+  }
+}
+
+// src/websocket.ts
+var import_ws = __toESM(require("ws"));
+function sendToGroup(ws, group, data) {
+  if (!group || ws.readyState !== import_ws.default.OPEN) return;
+  ws.send(
+    JSON.stringify({
+      type: "sendToGroup",
+      group,
+      dataType: "json",
+      data,
+      noEcho: true
+    })
+  );
+}
+
+// src/provisioner.ts
+var import_child_process2 = require("child_process");
+var DANGEROUS_PATTERN = /rm\s+-r[fe]*\s+\/|mkfs|dd\s+if=|:()\s*\{|>\s*\/dev\/sd/i;
+function shellQuote2(s) {
+  return `'${s.replace(/'/g, "'\\''")}'`;
+}
+var SESSION_NAME_RE = /^[a-zA-Z0-9_-]+$/;
+var MAX_SESSION_NAME = 128;
+function runCommand(cmd, timeout = 12e4) {
+  return (0, import_child_process2.execSync)(cmd, {
+    encoding: "utf8",
+    timeout,
+    maxBuffer: 10 * 1024 * 1024,
+    // 10 MB
+    stdio: ["pipe", "pipe", "pipe"]
+  }).trim();
+}
+function commandExists2(cmd) {
+  if (!/^[a-zA-Z0-9._+-]+$/.test(cmd)) return false;
+  try {
+    (0, import_child_process2.execFileSync)("sh", ["-c", `command -v -- ${cmd} >/dev/null 2>&1`], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function getVersion(cmd) {
+  try {
+    const output = runCommand(`${cmd} --version`, 1e4);
+    const match = output.match(/(\d+(?:\.\d+)*)/);
+    return match ? match[1] : null;
+  } catch {
+    return null;
+  }
+}
+function majorVersion(version) {
+  return parseInt(version.split(".")[0], 10);
+}
+function checkPrerequisites(manifest, onProgress) {
+  onProgress({
+    type: "provision-progress",
+    provisionId: "",
+    step: "checking-prereqs",
+    message: `Checking prerequisites for ${manifest.name}...`
+  });
+  if (!manifest.prerequisites || manifest.prerequisites.runtime === "none") {
+    return true;
+  }
+  const { runtime, minVersion } = manifest.prerequisites;
+  const runtimeCmd = runtime === "node" ? "node" : "python3";
+  if (!commandExists2(runtimeCmd)) {
+    onProgress({
+      type: "provision-progress",
+      provisionId: "",
+      step: "error",
+      message: `${runtimeCmd} is not installed. Please install ${runtime === "node" ? "Node.js" : "Python"} first.`
+    });
+    return false;
+  }
+  if (minVersion) {
+    const currentVersion = getVersion(runtimeCmd);
+    if (!currentVersion) {
+      onProgress({
+        type: "provision-progress",
+        provisionId: "",
+        step: "error",
+        message: `Could not determine ${runtimeCmd} version.`
+      });
+      return false;
+    }
+    if (majorVersion(currentVersion) < majorVersion(minVersion)) {
+      onProgress({
+        type: "provision-progress",
+        provisionId: "",
+        step: "error",
+        message: `${runtimeCmd} version ${currentVersion} is too old. Minimum required: ${minVersion}.`
+      });
+      return false;
+    }
+  }
+  onProgress({
+    type: "provision-progress",
+    provisionId: "",
+    step: "checking-prereqs",
+    message: `Prerequisites satisfied.`
+  });
+  return true;
+}
+function checkInstalled(manifest, onProgress) {
+  if (!manifest.checkCommand) return false;
+  try {
+    runCommand(manifest.checkCommand, 1e4);
+    onProgress({
+      type: "provision-progress",
+      provisionId: "",
+      step: "checking-prereqs",
+      message: `${manifest.name} is already installed.`
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function installAgent(manifest, onProgress) {
+  if (!manifest.installCommand || manifest.installMethod === "custom") {
+    return true;
+  }
+  onProgress({
+    type: "provision-progress",
+    provisionId: "",
+    step: "installing",
+    message: `Installing ${manifest.name}: ${manifest.installCommand}`
+  });
+  try {
+    runCommand(manifest.installCommand, 3e5);
+    onProgress({
+      type: "provision-progress",
+      provisionId: "",
+      step: "installing",
+      message: `${manifest.name} installed successfully.`
+    });
+    return true;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    onProgress({
+      type: "provision-progress",
+      provisionId: "",
+      step: "error",
+      message: `Failed to install ${manifest.name}: ${message}`
+    });
+    return false;
+  }
+}
+function startAgent(request, onProgress) {
+  if (!request.sessionName || request.sessionName.length > MAX_SESSION_NAME || !SESSION_NAME_RE.test(request.sessionName)) {
+    onProgress({
+      type: "provision-progress",
+      provisionId: request.provisionId,
+      step: "error",
+      message: "Invalid session name. Must be alphanumeric with hyphens/underscores, max 128 chars."
+    });
+    return false;
+  }
+  if (DANGEROUS_PATTERN.test(request.command)) {
+    onProgress({
+      type: "provision-progress",
+      provisionId: request.provisionId,
+      step: "error",
+      message: "Rejected: command matches dangerous pattern."
+    });
+    return false;
+  }
+  onProgress({
+    type: "provision-progress",
+    provisionId: request.provisionId,
+    step: "starting",
+    message: `Starting ${request.manifest.name} in tmux session "${request.sessionName}"...`
+  });
+  const tmuxArgs = ["new-session", "-d", "-s", request.sessionName];
+  if (request.workingDir) {
+    tmuxArgs.push("-c", request.workingDir);
+  }
+  const envEntries = request.envVars ? Object.entries(request.envVars).filter(([k, v]) => /^[A-Z_][A-Z0-9_]*$/i.test(k) && typeof v === "string") : [];
+  let fullCmd = request.command;
+  if (envEntries.length > 0) {
+    const envPrefix = envEntries.map(([k, v]) => `${k}=${shellQuote2(v)}`).join(" ");
+    fullCmd = `${envPrefix} ${request.command}`;
+  }
+  tmuxArgs.push(fullCmd);
+  try {
+    (0, import_child_process2.execFileSync)("tmux", tmuxArgs, { stdio: "ignore" });
+    onProgress({
+      type: "provision-progress",
+      provisionId: request.provisionId,
+      step: "complete",
+      message: `${request.manifest.name} is running in session "${request.sessionName}".`
+    });
+    return true;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    onProgress({
+      type: "provision-progress",
+      provisionId: request.provisionId,
+      step: "error",
+      message: `Failed to start tmux session: ${message}`
+    });
+    return false;
+  }
+}
+async function executeProvision(request, onProgress) {
+  const emit = (progress) => {
+    onProgress({ ...progress, provisionId: request.provisionId });
+  };
+  if (!checkPrerequisites(request.manifest, emit)) {
+    return false;
+  }
+  const alreadyInstalled = checkInstalled(request.manifest, emit);
+  if (!alreadyInstalled) {
+    if (!installAgent(request.manifest, emit)) {
+      return false;
+    }
+  }
+  return startAgent(request, emit);
+}
+
+// src/agent.ts
+function pidFilePath(hostId) {
+  return path2.join(CONFIG_DIR, `agent-${hostId}.pid`);
+}
+function readPidFile(filePath) {
+  try {
+    const raw = fs3.readFileSync(filePath, "utf8").trim();
+    const pid = Number.parseInt(raw, 10);
+    return Number.isInteger(pid) && pid > 0 ? pid : null;
+  } catch {
+    return null;
+  }
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function acquirePidLock(hostId) {
+  ensureConfigDir();
+  const lockPath = pidFilePath(hostId);
+  const existingPid = readPidFile(lockPath);
+  if (existingPid && existingPid !== process.pid && isProcessAlive(existingPid)) {
+    throw new Error(
+      `Another agent for host "${hostId}" is already running (pid ${existingPid}).
+Stop it first with: kill ${existingPid}  \u2014 or: ragent service stop`
+    );
+  }
+  fs3.writeFileSync(lockPath, `${process.pid}
+`, "utf8");
+  return lockPath;
+}
+function releasePidLock(lockPath) {
+  try {
+    const currentPid = readPidFile(lockPath);
+    if (currentPid === process.pid) {
+      fs3.unlinkSync(lockPath);
+    }
+  } catch {
+  }
+}
+function resolveRunOptions(commandOptions) {
+  const config = loadConfig();
+  const portal = commandOptions.portal || config.portal || DEFAULT_PORTAL;
+  const hostId = sanitizeHostId(commandOptions.id || config.hostId || inferHostId());
+  const hostName = commandOptions.name || config.hostName || os5.hostname();
+  const command = commandOptions.command || config.command || "bash";
+  const agentToken = commandOptions.agentToken || config.agentToken || "";
+  return { portal, hostId, hostName, command, agentToken };
+}
+async function runAgent(rawOptions) {
+  const options = resolveRunOptions(rawOptions);
+  if (!options.agentToken) {
+    throw new Error("No agent token found. Run `ragent connect` first.");
+  }
+  const lockPath = acquirePidLock(options.hostId);
+  console.log(`[rAgent] Connector started for ${options.hostName} (${options.hostId})`);
+  console.log(`[rAgent] Portal: ${options.portal}`);
+  try {
+    const existingSessions = await collectSessionInventory(options.hostId, options.command);
+    const tmuxCount = existingSessions.filter((s) => s.type === "tmux").length;
+    if (tmuxCount > 0) {
+      console.log(`[rAgent] Found ${tmuxCount} existing tmux session(s) on this machine.`);
+    }
+  } catch {
+  }
+  let shouldRun = true;
+  let reconnectRequested = false;
+  let reconnectDelay = DEFAULT_RECONNECT_DELAY_MS;
+  let activeSocket = null;
+  let activeGroups = { privateGroup: "", registryGroup: "" };
+  let wsHeartbeatTimer = null;
+  let httpHeartbeatTimer = null;
+  let suppressNextShellRespawn = false;
+  let lastSentFingerprint = "";
+  let lastHttpHeartbeatAt = 0;
+  const outputBuffer = new OutputBuffer();
+  let ptyProcess = null;
+  const sendOutput = (chunk) => {
+    const ws = activeSocket;
+    if (!ws || ws.readyState !== import_ws2.default.OPEN || !activeGroups.privateGroup) {
+      outputBuffer.push(chunk);
+      return;
+    }
+    sendToGroup(ws, activeGroups.privateGroup, { type: "output", data: chunk });
+  };
+  const killCurrentShell = () => {
+    if (!ptyProcess) return;
+    suppressNextShellRespawn = true;
+    try {
+      ptyProcess.kill();
+    } catch {
+    }
+    ptyProcess = null;
+  };
+  const spawnOrRespawnShell = () => {
+    ptyProcess = spawnConnectorShell(options.command, sendOutput, () => {
+      if (suppressNextShellRespawn) {
+        suppressNextShellRespawn = false;
+        return;
+      }
+      if (!shouldRun) return;
+      console.warn("[rAgent] Shell exited. Restarting shell process.");
+      setTimeout(() => {
+        if (shouldRun) spawnOrRespawnShell();
+      }, 200);
+    });
+  };
+  const restartLocalShell = () => {
+    killCurrentShell();
+    spawnOrRespawnShell();
+  };
+  spawnOrRespawnShell();
+  const cleanupSocket = () => {
+    if (wsHeartbeatTimer) {
+      clearInterval(wsHeartbeatTimer);
+      wsHeartbeatTimer = null;
+    }
+    if (httpHeartbeatTimer) {
+      clearInterval(httpHeartbeatTimer);
+      httpHeartbeatTimer = null;
+    }
+    if (activeSocket) {
+      activeSocket.removeAllListeners();
+      try {
+        activeSocket.close();
+      } catch {
+      }
+      activeSocket = null;
+    }
+    activeGroups = { privateGroup: "", registryGroup: "" };
+  };
+  const collectVitals = () => {
+    const cpus2 = os5.cpus();
+    let totalIdle = 0;
+    let totalTick = 0;
+    for (const cpu of cpus2) {
+      for (const type of Object.keys(cpu.times)) {
+        totalTick += cpu.times[type];
+      }
+      totalIdle += cpu.times.idle;
+    }
+    const cpuUsage = totalTick > 0 ? Math.round((totalTick - totalIdle) / totalTick * 100) : 0;
+    const totalMem = os5.totalmem();
+    const freeMem = os5.freemem();
+    const memUsedPct = totalMem > 0 ? Math.round((totalMem - freeMem) / totalMem * 100) : 0;
+    let diskUsedPct = 0;
+    try {
+      const { execSync: execSync2 } = require("child_process");
+      const dfOutput = execSync2("df -P / | tail -1", { encoding: "utf8", timeout: 5e3 });
+      const parts = dfOutput.trim().split(/\s+/);
+      if (parts.length >= 5) {
+        diskUsedPct = parseInt(parts[4].replace("%", ""), 10) || 0;
+      }
+    } catch {
+    }
+    return { cpu: cpuUsage, memUsedPct, diskUsedPct };
+  };
+  const announceToRegistry = async (type = "heartbeat") => {
+    const ws = activeSocket;
+    if (!ws || ws.readyState !== import_ws2.default.OPEN || !activeGroups.registryGroup) return;
+    const sessions = await collectSessionInventory(options.hostId, options.command);
+    const vitals = collectVitals();
+    sendToGroup(ws, activeGroups.registryGroup, {
+      type,
+      hostId: options.hostId,
+      hostName: options.hostName,
+      environment: os5.hostname(),
+      sessions,
+      vitals,
+      agentVersion: CURRENT_VERSION,
+      lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  };
+  const syncInventory = async (force = false) => {
+    const sessions = await collectSessionInventory(options.hostId, options.command);
+    const fingerprint = sessionInventoryFingerprint(sessions);
+    const changed = fingerprint !== lastSentFingerprint;
+    const checkpointDue = Date.now() - lastHttpHeartbeatAt > HTTP_HEARTBEAT_MS;
+    if (changed || force) {
+      await announceToRegistry("inventory");
+      lastSentFingerprint = fingerprint;
+    }
+    if (changed || checkpointDue || force) {
+      await postHeartbeat({
+        portal: options.portal,
+        agentToken: options.agentToken,
+        hostId: options.hostId,
+        hostName: options.hostName,
+        command: options.command
+      });
+      lastHttpHeartbeatAt = Date.now();
+    }
+  };
+  const handleControlAction = async (payload) => {
+    const action = typeof payload?.action === "string" ? payload.action : "";
+    const sessionId = typeof payload?.sessionId === "string" && payload.sessionId.trim().length > 0 ? payload.sessionId.trim() : null;
+    switch (action) {
+      case "restart-shell":
+        restartLocalShell();
+        await syncInventory();
+        return;
+      case "restart-agent":
+      case "disconnect":
+        reconnectRequested = true;
+        if (activeSocket && activeSocket.readyState === import_ws2.default.OPEN) {
+          activeSocket.close();
+        }
+        return;
+      case "stop-agent":
+        shouldRun = false;
+        requestStopSelfService();
+        if (activeSocket && activeSocket.readyState === import_ws2.default.OPEN) {
+          activeSocket.close();
+        }
+        return;
+      case "stop-session":
+        if (!sessionId) return;
+        if (sessionId.startsWith("pty:")) {
+          restartLocalShell();
+          await syncInventory();
+          return;
+        }
+        if (sessionId.startsWith("tmux:")) {
+          try {
+            await stopTmuxPaneBySessionId(sessionId);
+            console.log(`[rAgent] Closed remote session ${sessionId}.`);
+          } catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            console.warn(
+              `[rAgent] Failed to close ${sessionId}: ${message}`
+            );
+          }
+          await syncInventory();
+        }
+        return;
+      case "stop-detached": {
+        const killed = await stopAllDetachedTmuxSessions();
+        console.log(`[rAgent] Killed ${killed} detached tmux session(s).`);
+        await syncInventory();
+        return;
+      }
+      case "start-agent": {
+        const sessionName = typeof payload?.sessionName === "string" && payload.sessionName.trim().length > 0 ? payload.sessionName.trim() : `agent-${Date.now().toString(36)}`;
+        const cmd = typeof payload?.command === "string" && payload.command.trim().length > 0 ? payload.command.trim() : null;
+        if (!cmd) {
+          console.warn("[rAgent] start-agent: no command provided, ignoring.");
+          return;
+        }
+        if (sessionName.length > 128 || !/^[a-zA-Z0-9_-]+$/.test(sessionName)) {
+          console.warn("[rAgent] start-agent: invalid session name, ignoring.");
+          return;
+        }
+        const dangerous = /rm\s+-r[fe]*\s+\/|mkfs|dd\s+if=|:()\s*\{|>\s*\/dev\/sd/i;
+        if (dangerous.test(cmd)) {
+          console.warn(`[rAgent] start-agent: rejected dangerous command: ${cmd}`);
+          return;
+        }
+        const workingDir = typeof payload?.workingDir === "string" && payload.workingDir.trim().length > 0 ? payload.workingDir.trim() : void 0;
+        const envVars = payload?.envVars && typeof payload.envVars === "object" ? payload.envVars : void 0;
+        const tmuxArgs = ["new-session", "-d", "-s", sessionName];
+        if (workingDir) {
+          tmuxArgs.push("-c", workingDir);
+        }
+        let fullCmd = cmd;
+        if (envVars) {
+          const entries = Object.entries(envVars).filter(([k, v]) => /^[A-Z_][A-Z0-9_]*$/i.test(k) && typeof v === "string").map(([k, v]) => `${k}='${v.replace(/'/g, "'\\''")}'`).join(" ");
+          if (entries) fullCmd = `${entries} ${cmd}`;
+        }
+        tmuxArgs.push(fullCmd);
+        try {
+          const { execFileSync: execFileSync2 } = await import("child_process");
+          execFileSync2("tmux", tmuxArgs, { stdio: "ignore" });
+          console.log(`[rAgent] Started agent session "${sessionName}": ${cmd}`);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          console.error(`[rAgent] Failed to start agent session "${sessionName}": ${message}`);
+        }
+        await syncInventory(true);
+        return;
+      }
+      default:
+    }
+  };
+  const onSignal = () => {
+    shouldRun = false;
+    cleanupSocket();
+    killCurrentShell();
+    releasePidLock(lockPath);
+  };
+  process.once("SIGTERM", onSignal);
+  process.once("SIGINT", onSignal);
+  try {
+    while (shouldRun) {
+      reconnectRequested = false;
+      try {
+        options.agentToken = await refreshTokenIfNeeded({
+          portal: options.portal,
+          agentToken: options.agentToken
+        });
+        const negotiated = await negotiateAgent({
+          portal: options.portal,
+          agentToken: options.agentToken
+        });
+        activeGroups = {
+          privateGroup: negotiated.groups.privateGroup,
+          registryGroup: negotiated.groups.registryGroup
+        };
+        await new Promise((resolve) => {
+          const ws = new import_ws2.default(
+            negotiated.url,
+            "json.webpubsub.azure.v1"
+          );
+          activeSocket = ws;
+          ws.on("open", async () => {
+            console.log("[rAgent] Connector connected to relay.");
+            reconnectDelay = DEFAULT_RECONNECT_DELAY_MS;
+            ws.send(
+              JSON.stringify({
+                type: "joinGroup",
+                group: activeGroups.privateGroup
+              })
+            );
+            ws.send(
+              JSON.stringify({
+                type: "joinGroup",
+                group: activeGroups.registryGroup
+              })
+            );
+            sendToGroup(ws, activeGroups.privateGroup, {
+              type: "register",
+              hostName: options.hostName,
+              environment: os5.platform()
+            });
+            const buffered = outputBuffer.drain();
+            if (buffered.length > 0) {
+              console.log(
+                `[rAgent] Replaying ${buffered.length} buffered output chunks (${buffered.reduce((sum, c) => sum + Buffer.byteLength(c, "utf8"), 0)} bytes)`
+              );
+              for (const chunk of buffered) {
+                sendToGroup(ws, activeGroups.privateGroup, {
+                  type: "output",
+                  data: chunk
+                });
+              }
+            }
+            await syncInventory(true);
+            wsHeartbeatTimer = setInterval(async () => {
+              if (!activeSocket || activeSocket.readyState !== import_ws2.default.OPEN)
+                return;
+              await announceToRegistry("heartbeat");
+            }, WS_HEARTBEAT_MS);
+            httpHeartbeatTimer = setInterval(async () => {
+              if (!activeSocket || activeSocket.readyState !== import_ws2.default.OPEN)
+                return;
+              await syncInventory();
+            }, HTTP_HEARTBEAT_MS);
+          });
+          ws.on("message", async (data) => {
+            let msg;
+            try {
+              msg = JSON.parse(data.toString());
+            } catch {
+              return;
+            }
+            if (msg.type === "message" && msg.group === activeGroups.privateGroup) {
+              const payload = msg.data || {};
+              if (payload.type === "input" && typeof payload.data === "string") {
+                if (ptyProcess) ptyProcess.write(payload.data);
+              } else if (payload.type === "resize" && Number.isInteger(payload.cols) && Number.isInteger(payload.rows)) {
+                try {
+                  if (ptyProcess)
+                    ptyProcess.resize(
+                      payload.cols,
+                      payload.rows
+                    );
+                } catch (error) {
+                  const message = error instanceof Error ? error.message : String(error);
+                  if (!message.includes("EBADF")) {
+                    console.warn(`[rAgent] Resize failed: ${message}`);
+                  }
+                }
+              } else if (payload.type === "control" && typeof payload.action === "string") {
+                await handleControlAction(payload);
+              } else if (payload.type === "start-agent") {
+                await handleControlAction({ ...payload, action: "start-agent" });
+              } else if (payload.type === "provision") {
+                const provReq = payload;
+                if (provReq.provisionId && provReq.manifest) {
+                  console.log(`[rAgent] Provision request: ${provReq.manifest.name} (${provReq.provisionId})`);
+                  const sendProgress = (progress) => {
+                    const currentWs = activeSocket;
+                    if (currentWs && currentWs.readyState === import_ws2.default.OPEN && activeGroups.registryGroup) {
+                      sendToGroup(currentWs, activeGroups.registryGroup, {
+                        ...progress,
+                        hostId: options.hostId
+                      });
+                    }
+                  };
+                  try {
+                    await executeProvision(provReq, sendProgress);
+                    await syncInventory(true);
+                  } catch (error) {
+                    const errMsg = error instanceof Error ? error.message : String(error);
+                    sendProgress({
+                      type: "provision-progress",
+                      provisionId: provReq.provisionId,
+                      step: "error",
+                      message: `Provision failed: ${errMsg}`
+                    });
+                  }
+                }
+              }
+            }
+            if (msg.type === "message" && msg.group === activeGroups.registryGroup) {
+              const payload = msg.data || {};
+              if (payload.type === "ping") {
+                await announceToRegistry("announce");
+              }
+            }
+          });
+          ws.on("error", (error) => {
+            console.error("[rAgent] WebSocket error:", error.message);
+          });
+          ws.on("close", () => {
+            console.log(
+              "[rAgent] Relay disconnected. Output will be buffered until reconnect."
+            );
+            cleanupSocket();
+            resolve();
+          });
+        });
+      } catch (error) {
+        if (error instanceof AuthError) {
+          console.error(`[rAgent] ${error.message}`);
+          console.error(
+            "[rAgent] Connector token is invalid or revoked. Stopping. Re-connect with: ragent connect --token <token>"
+          );
+          shouldRun = false;
+          break;
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        console.error(`[rAgent] Relay connect failed: ${message}`);
+      }
+      if (!shouldRun) break;
+      if (reconnectRequested) {
+        console.log("[rAgent] Reconnecting to relay...");
+        await wait(300);
+        continue;
+      }
+      console.log(
+        `[rAgent] Disconnected. Reconnecting in ${Math.round(reconnectDelay / 1e3)}s...`
+      );
+      await wait(reconnectDelay);
+      reconnectDelay = Math.min(reconnectDelay * 1.5, MAX_RECONNECT_DELAY_MS);
+    }
+  } finally {
+    cleanupSocket();
+    killCurrentShell();
+    releasePidLock(lockPath);
+    process.removeListener("SIGTERM", onSignal);
+    process.removeListener("SIGINT", onSignal);
+  }
+}
+
+// src/brand.ts
+var figlet = null;
+try {
+  figlet = require("figlet");
+} catch {
+  figlet = null;
+}
+var ANSI = {
+  reset: "\x1B[0m",
+  dim: "\x1B[2m",
+  bold: "\x1B[1m"
+};
+function supportsColor() {
+  return Boolean(process.stdout.isTTY) && process.env.NO_COLOR !== "1";
+}
+function color(text, ansiCode = "") {
+  if (!supportsColor()) return text;
+  return `${ansiCode}${text}${ANSI.reset}`;
+}
+function rgb(r, g, b) {
+  return `\x1B[38;2;${r};${g};${b}m`;
+}
+function gradientCharColor(position, total) {
+  const safeTotal = Math.max(total - 1, 1);
+  const t = position / safeTotal;
+  const start = { r: 35, g: 198, b: 255 };
+  const end = { r: 78, g: 129, b: 255 };
+  const r = Math.round(start.r + (end.r - start.r) * t);
+  const g = Math.round(start.g + (end.g - start.g) * t);
+  const b = Math.round(start.b + (end.b - start.b) * t);
+  return rgb(r, g, b);
+}
+function colorizeGradientLine(line) {
+  if (!supportsColor()) return line;
+  const chars = [...line];
+  return chars.map((char, i) => `${gradientCharColor(i, chars.length)}${char}`).join("").concat(ANSI.reset);
+}
+function generateBrandArt() {
+  const fallback = ["rAgent Live", "remote agent terminal control"];
+  if (!figlet) return fallback;
+  const cols = process.stdout.columns || 120;
+  const tryRender = (text, font) => {
+    try {
+      const rendered = figlet.textSync(text, {
+        font,
+        horizontalLayout: "default",
+        verticalLayout: "default"
+      });
+      const lines = rendered.split("\n");
+      const width = Math.max(...lines.map((line) => line.length), 0);
+      if (width > cols && text.includes(" ")) return null;
+      return lines;
+    } catch {
+      return null;
+    }
+  };
+  const coderMini = tryRender("rAgent Live", "Coder Mini");
+  if (coderMini) return coderMini;
+  const variants = [
+    ["rAgent Live", "ANSI Shadow"],
+    ["rAgent Live", "Small"],
+    ["rAgent Live", "Standard"],
+    ["rAgent Live", "Slant"],
+    ["rAgent Live", "Mini"],
+    ["rAgent", "Standard"]
+  ];
+  for (const [text, font] of variants) {
+    const rendered = tryRender(text, font);
+    if (rendered) return rendered;
+  }
+  return fallback;
+}
+function printCommandArt(title, subtitle = "remote agent control") {
+  if (!SHOW_ART) return;
+  const art = generateBrandArt();
+  art.forEach((line) => {
+    console.log(colorizeGradientLine(line));
+  });
+  console.log(color("  rAgent Live", ANSI.bold));
+  console.log(color(`  > ${title}`, ANSI.bold));
+  console.log(color(`  > ${subtitle}`, ANSI.dim));
+  console.log("");
+}
+
+// src/commands/connect.ts
+async function connectMachine(opts) {
+  const portal = opts.portal || DEFAULT_PORTAL;
+  const hostId = sanitizeHostId(opts.id || inferHostId());
+  const hostName = opts.name || os6.hostname();
+  const command = opts.command || "bash";
+  if (!opts.token) {
+    throw new Error("Connection token is required.");
+  }
+  const claimed = await claimHost({
+    portal,
+    connectionToken: opts.token,
+    hostId,
+    hostName,
+    command
+  });
+  const config = loadConfig();
+  const nextConfig = {
+    ...config,
+    portal,
+    hostId,
+    hostName,
+    command,
+    agentToken: claimed.agentToken,
+    tokenExpiresAt: claimed.expiresAt,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  if (claimed.refreshToken) {
+    nextConfig.refreshToken = claimed.refreshToken;
+    nextConfig.refreshExpiresAt = claimed.refreshExpiresAt;
+  }
+  saveConfig(nextConfig);
+  console.log(`[rAgent] Machine connected: ${hostName} (${hostId})`);
+  console.log(`[rAgent] Machine name: ${hostName} (override with --name <friendly-name>)`);
+  console.log(`[rAgent] Config saved to ${CONFIG_FILE}`);
+  if (opts.asService) {
+    await ensureServiceInstalled({ enable: true, start: true });
+    console.log("[rAgent] Service mode enabled.");
+    return;
+  }
+  if (opts.run !== false) {
+    await runAgent({
+      portal,
+      id: hostId,
+      name: hostName,
+      command,
+      agentToken: claimed.agentToken
+    });
+  }
+}
+function registerConnectCommand(program2) {
+  program2.command("connect").description("Connect a machine to rAgent Live using a short-lived token").requiredOption("--token <token>", "Connection token from portal").option("--portal <url>", "Portal base URL", DEFAULT_PORTAL).option("-i, --id <id>", "Machine ID").option("-n, --name <name>", "Machine name").option("-c, --command <command>", "CLI command to run", "bash").option("--as-service", "Install/start background service after connecting").option("--no-run", "Connect only; do not immediately run connector").action(async (opts) => {
+    try {
+      printCommandArt("Connect Machine", "connecting machine + saving connector credentials");
+      await connectMachine(opts);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[rAgent] Connect failed: ${message}`);
+      process.exit(1);
+    }
+  });
+}
+
+// src/commands/run.ts
+function registerRunCommand(program2) {
+  program2.command("run").description("Run connector for a connected machine").option("--portal <url>", "Portal base URL").option("--agent-token <token>", "Connector token").option("-i, --id <id>", "Machine ID").option("-n, --name <name>", "Machine name").option("-c, --command <command>", "CLI command to run").action(async (opts) => {
+    try {
+      printCommandArt("Run Connector", "streaming terminal session to portal");
+      await runAgent(opts);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[rAgent] Run failed: ${message}`);
+      process.exit(1);
+    }
+  });
+}
+
+// src/commands/doctor.ts
+var os7 = __toESM(require("os"));
+async function runDoctor(opts) {
+  const options = resolveRunOptions(opts);
+  const checks = [];
+  const platformOk = os7.platform() === "linux";
+  checks.push({ name: "platform", ok: platformOk, detail: os7.platform() });
+  checks.push({
+    name: "node",
+    ok: Number(process.versions.node.split(".")[0]) >= 20,
+    detail: process.versions.node
+  });
+  checks.push({ name: "portal", ok: Boolean(options.portal), detail: options.portal });
+  let tmuxOk = false;
+  try {
+    await execAsync("tmux -V");
+    tmuxOk = true;
+    checks.push({ name: "tmux", ok: true, detail: "installed" });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    checks.push({ name: "tmux", ok: false, detail: message });
+  }
+  try {
+    const response = await fetch(`${options.portal}/api/bootstrap/linux.sh`);
+    checks.push({
+      name: "portal-reachability",
+      ok: response.ok,
+      detail: String(response.status)
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    checks.push({ name: "portal-reachability", ok: false, detail: message });
+  }
+  checks.forEach((check) => {
+    console.log(`${check.ok ? "PASS" : "FAIL"}  ${check.name}: ${check.detail}`);
+  });
+  if (!platformOk) {
+    console.log("[rAgent] Linux is required for the connector.");
+  }
+  if (!tmuxOk) {
+    const recipe = await chooseTmuxInstallCommand();
+    if (recipe) {
+      console.log(`[rAgent] tmux install suggestion: ${recipe.command}`);
+    }
+    if (opts.fix) {
+      try {
+        const installed = await installTmuxInteractively();
+        if (installed) {
+          console.log("[rAgent] tmux installation complete.");
+        } else {
+          console.log("[rAgent] tmux installation skipped or incomplete.");
+        }
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.error(`[rAgent] Failed to install tmux: ${message}`);
+      }
+    } else {
+      console.log(
+        "[rAgent] Run `ragent doctor --fix` to install missing dependencies interactively."
+      );
+    }
+  }
+}
+function registerDoctorCommand(program2) {
+  program2.command("doctor").description("Run Linux environment and connectivity checks").option("--portal <url>", "Portal base URL").option("--fix", "Attempt interactive fixes for missing dependencies").action(async (opts) => {
+    printCommandArt("Doctor", "checking local runtime + portal connectivity");
+    await runDoctor(opts);
+  });
+}
+
+// src/commands/update.ts
+function registerUpdateCommand(program2) {
+  program2.command("update").description("Update ragent CLI from npm").option("--check", "Check for updates only; do not install").action(async (opts) => {
+    printCommandArt("Update", "checking npm registry for newer ragent-cli versions");
+    const latestVersion = await checkForUpdate({ force: true });
+    if (!latestVersion) {
+      console.log(`[rAgent] You are up to date (${CURRENT_VERSION}).`);
+      return;
+    }
+    console.log(`[rAgent] Update available: ${CURRENT_VERSION} -> ${latestVersion}`);
+    if (opts.check) return;
+    await execAsync(`npm install -g ${shellQuote(PACKAGE_NAME)}`, {
+      timeout: 5 * 60 * 1e3,
+      maxBuffer: 10 * 1024 * 1024
+    });
+    console.log(
+      "[rAgent] Update command completed. Restart any running ragent service."
+    );
+  });
+}
+
+// src/commands/sessions.ts
+async function listSessions() {
+  const sessions = await collectTmuxSessions();
+  if (sessions.length === 0) {
+    console.log("No tmux sessions discovered.");
+    return;
+  }
+  sessions.forEach((session) => {
+    console.log(`${session.id}	${session.status}	${session.command || ""}`);
+  });
+}
+function registerSessionsCommand(program2) {
+  const sessions = program2.command("sessions").description("Session tooling");
+  sessions.command("list").description("List tmux sessions/windows/panes on this host").action(async () => {
+    await listSessions();
+  });
+}
+
+// src/commands/service.ts
+function registerServiceCommand(program2) {
+  const service = program2.command("service").description("Manage background connector service");
+  service.command("install").description("Install service (systemd user unit when available)").option("--start", "Start service immediately").option("--no-enable", "Do not enable autostart in systemd").action(async (opts) => {
+    try {
+      await ensureServiceInstalled({
+        enable: opts.enable,
+        start: Boolean(opts.start)
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[rAgent] Service install failed: ${message}`);
+      process.exit(1);
+    }
+  });
+  service.command("start").description("Start installed service").action(async () => {
+    try {
+      await startService();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[rAgent] Service start failed: ${message}`);
+      process.exit(1);
+    }
+  });
+  service.command("stop").description("Stop installed service").action(async () => {
+    try {
+      await stopService();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[rAgent] Service stop failed: ${message}`);
+      process.exit(1);
+    }
+  });
+  service.command("restart").description("Restart installed service").action(async () => {
+    try {
+      await restartService();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[rAgent] Service restart failed: ${message}`);
+      process.exit(1);
+    }
+  });
+  service.command("status").description("Show service status").action(async () => {
+    try {
+      await printServiceStatus();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[rAgent] Service status failed: ${message}`);
+      process.exit(1);
+    }
+  });
+  service.command("logs").description("Show service logs").option("-n, --lines <lines>", "Number of log lines", "100").option("-f, --follow", "Follow logs").action(async (opts) => {
+    try {
+      await printServiceLogs(opts);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[rAgent] Service logs failed: ${message}`);
+      process.exit(1);
+    }
+  });
+  service.command("uninstall").description("Remove installed service").action(async () => {
+    try {
+      await uninstallService();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[rAgent] Service uninstall failed: ${message}`);
+      process.exit(1);
+    }
+  });
+}
+
+// src/commands/uninstall.ts
+var fs4 = __toESM(require("fs"));
+async function uninstallAgent(opts) {
+  const config = loadConfig();
+  const hostName = config.hostName || config.hostId || "this machine";
+  if (!opts.yes) {
+    const confirmed = await askYesNo(
+      `[rAgent] This will deregister "${hostName}" from the server, stop the service, remove config, and unlink the CLI. Continue?`,
+      false
+    );
+    if (!confirmed) {
+      console.log("[rAgent] Uninstall cancelled.");
+      return;
+    }
+  }
+  if (config.portal && config.agentToken) {
+    console.log("[rAgent] Deregistering from server...");
+    try {
+      const token = await refreshTokenIfNeeded({
+        portal: config.portal,
+        agentToken: config.agentToken
+      });
+      const ok = await deregisterHost({ portal: config.portal, agentToken: token });
+      if (ok) {
+        console.log("[rAgent] Host removed from server.");
+      }
+    } catch {
+      console.warn("[rAgent] Could not reach server \u2014 host may need manual removal from dashboard.");
+    }
+  }
+  console.log("[rAgent] Stopping and removing service...");
+  await uninstallService().catch(() => void 0);
+  if (fs4.existsSync(CONFIG_DIR)) {
+    fs4.rmSync(CONFIG_DIR, { recursive: true, force: true });
+    console.log(`[rAgent] Removed config directory: ${CONFIG_DIR}`);
+  }
+  try {
+    await execAsync(`npm unlink -g ${PACKAGE_NAME}`, { timeout: 15e3 });
+    console.log(`[rAgent] Unlinked global package: ${PACKAGE_NAME}`);
+  } catch {
+  }
+  console.log("[rAgent] Uninstall complete. rAgent has been removed from this machine.");
+}
+function registerUninstallCommand(parent) {
+  parent.command("uninstall").description("Remove rAgent from this machine (stops service, deletes config, unlinks CLI)").option("-y, --yes", "Skip confirmation prompt").action(async (opts) => {
+    try {
+      printCommandArt("Uninstall", "removing rAgent from this machine");
+      await uninstallAgent(opts);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.error(`[rAgent] Uninstall failed: ${message}`);
+      process.exit(1);
+    }
+  });
+}
+
+// src/index.ts
+import_commander.program.name("ragent").description("Connect machines to rAgent Live").version(CURRENT_VERSION);
+registerConnectCommand(import_commander.program);
+registerRunCommand(import_commander.program);
+registerDoctorCommand(import_commander.program);
+registerUpdateCommand(import_commander.program);
+registerSessionsCommand(import_commander.program);
+registerServiceCommand(import_commander.program);
+registerUninstallCommand(import_commander.program);
+import_commander.program.hook("preAction", async (_thisCommand, actionCommand) => {
+  if (actionCommand.name() === "update") return;
+  await maybeWarnUpdate();
+});
+import_commander.program.action(() => {
+  showStatus();
+});
+import_commander.program.parseAsync(process.argv);
+function showStatus() {
+  console.log(`
+  ragent v${CURRENT_VERSION}
+`);
+  try {
+    const raw = fs5.readFileSync(CONFIG_FILE, "utf8");
+    const config = JSON.parse(raw);
+    if (config.portal && config.agentToken) {
+      console.log(`  Status:   Connected`);
+      console.log(`  Machine:  ${config.hostName ?? config.hostId ?? "unknown"}`);
+      console.log(`  Portal:   ${config.portal}`);
+      console.log(`  Config:   ${CONFIG_FILE}`);
+      if (config.updatedAt) {
+        console.log(`  Last:     ${config.updatedAt}`);
+      }
+      console.log("");
+      console.log("  Commands:");
+      console.log("    ragent service status    \u2014 Check if connector is running");
+      console.log("    ragent service logs -f   \u2014 Follow live logs");
+      console.log("    ragent service restart   \u2014 Restart the connector");
+      console.log("    ragent sessions          \u2014 List tmux sessions");
+      console.log("    ragent doctor            \u2014 Run diagnostics");
+      console.log("    ragent --help            \u2014 All available commands");
+      console.log("");
+    } else {
+      showNotConnected();
+    }
+  } catch {
+    showNotConnected();
+  }
+}
+function showNotConnected() {
+  console.log("  Status:   Not connected\n");
+  console.log("  To connect this machine:");
+  console.log("    1. Open the rAgent dashboard in your browser");
+  console.log("    2. Click '+ connect' to generate a connection token");
+  console.log("    3. Run: ragent connect --portal <url> --token <token>");
+  console.log("");
+  console.log("  Run `ragent --help` for all available commands.");
+  console.log("");
+}