supbuddy 3.1.3 → 3.1.5

package/dist/bin.js

@@ -9255,11 +9255,11 @@ var require_mime_types = __commonJS({
       }
       return exts[0];
     }
-    function lookup(path37) {
-      if (!path37 || typeof path37 !== "string") {
+    function lookup(path38) {
+      if (!path38 || typeof path38 !== "string") {
         return false;
       }
-      var extension2 = extname("x." + path37).toLowerCase().substr(1);
+      var extension2 = extname("x." + path38).toLowerCase().substr(1);
       if (!extension2) {
         return false;
       }
@@ -9375,7 +9375,7 @@ var require_accepts = __commonJS({
 var require_base64id = __commonJS({
   "../../node_modules/.pnpm/base64id@2.0.0/node_modules/base64id/lib/base64id.js"(exports, module) {
     "use strict";
-    var crypto6 = __require("crypto");
+    var crypto7 = __require("crypto");
     var Base64Id = function() {
     };
     Base64Id.prototype.getRandomBytes = function(bytes) {
@@ -9383,12 +9383,12 @@ var require_base64id = __commonJS({
       var self = this;
       bytes = bytes || 12;
       if (bytes > BUFFER_SIZE) {
-        return crypto6.randomBytes(bytes);
+        return crypto7.randomBytes(bytes);
       }
       var bytesInBuffer = parseInt(BUFFER_SIZE / bytes);
       var threshold = parseInt(bytesInBuffer * 0.85);
       if (!threshold) {
-        return crypto6.randomBytes(bytes);
+        return crypto7.randomBytes(bytes);
       }
       if (this.bytesBufferIndex == null) {
         this.bytesBufferIndex = -1;
@@ -9400,14 +9400,14 @@ var require_base64id = __commonJS({
       if (this.bytesBufferIndex == -1 || this.bytesBufferIndex > threshold) {
         if (!this.isGeneratingBytes) {
           this.isGeneratingBytes = true;
-          crypto6.randomBytes(BUFFER_SIZE, function(err, bytes2) {
+          crypto7.randomBytes(BUFFER_SIZE, function(err, bytes2) {
             self.bytesBuffer = bytes2;
             self.bytesBufferIndex = 0;
             self.isGeneratingBytes = false;
           });
         }
         if (this.bytesBufferIndex == -1) {
-          return crypto6.randomBytes(bytes);
+          return crypto7.randomBytes(bytes);
         }
       }
       var result = this.bytesBuffer.slice(bytes * this.bytesBufferIndex, bytes * (this.bytesBufferIndex + 1));
@@ -9421,7 +9421,7 @@ var require_base64id = __commonJS({
       }
       this.sequenceNumber = this.sequenceNumber + 1 | 0;
       rand.writeInt32BE(this.sequenceNumber, 11);
-      if (crypto6.randomBytes) {
+      if (crypto7.randomBytes) {
         this.getRandomBytes(12).copy(rand);
       } else {
         [0, 4, 8].forEach(function(i) {
@@ -12660,11 +12660,11 @@ var require_server = __commonJS({
        * @protected
        */
       _computePath(options) {
-        let path37 = (options.path || "/engine.io").replace(/\/$/, "");
+        let path38 = (options.path || "/engine.io").replace(/\/$/, "");
         if (options.addTrailingSlash !== false) {
-          path37 += "/";
+          path38 += "/";
         }
-        return path37;
+        return path38;
       }
       /**
        * Returns a list of available transports for upgrade given a certain transport.
@@ -13180,10 +13180,10 @@ var require_server = __commonJS({
        * @param {Object} options
        */
       attach(server, options = {}) {
-        const path37 = this._computePath(options);
+        const path38 = this._computePath(options);
         const destroyUpgradeTimeout = options.destroyUpgradeTimeout || 1e3;
         function check(req) {
-          return path37 === req.url.slice(0, path37.length);
+          return path38 === req.url.slice(0, path38.length);
         }
         const listeners = server.listeners("request").slice(0);
         server.removeAllListeners("request");
@@ -13191,7 +13191,7 @@ var require_server = __commonJS({
         server.on("listening", this.init.bind(this));
         server.on("request", (req, res) => {
           if (check(req)) {
-            debug('intercepting request for path "%s"', path37);
+            debug('intercepting request for path "%s"', path38);
             this.handleRequest(req, res);
           } else {
             let i = 0;
@@ -14031,8 +14031,8 @@ var require_userver = __commonJS({
        * @param options
        */
       attach(app, options = {}) {
-        const path37 = this._computePath(options);
-        app.any(path37, this.handleRequest.bind(this)).ws(path37, {
+        const path38 = this._computePath(options);
+        app.any(path38, this.handleRequest.bind(this)).ws(path38, {
           compression: options.compression,
           idleTimeout: options.idleTimeout,
           maxBackpressure: options.maxBackpressure,
@@ -18461,7 +18461,7 @@ var require_dist2 = __commonJS({
     var zlib_1 = __require("zlib");
     var accepts = require_accepts();
     var stream_1 = __require("stream");
-    var path37 = __require("path");
+    var path38 = __require("path");
     var engine_io_1 = require_engine_io();
     var client_1 = require_client();
     var events_1 = __require("events");
@@ -18656,7 +18656,7 @@ var require_dist2 = __commonJS({
             res.writeHeader("cache-control", "public, max-age=0");
             res.writeHeader("content-type", "application/" + (isMap ? "json" : "javascript") + "; charset=utf-8");
             res.writeHeader("etag", expectedEtag);
-            const filepath = path37.join(__dirname, "../client-dist/", filename);
+            const filepath = path38.join(__dirname, "../client-dist/", filename);
             (0, uws_1.serveFile)(res, filepath);
           });
         }
@@ -18738,7 +18738,7 @@ var require_dist2 = __commonJS({
        * @private
        */
       static sendFile(filename, req, res) {
-        const readStream = (0, fs_1.createReadStream)(path37.join(__dirname, "../client-dist/", filename));
+        const readStream = (0, fs_1.createReadStream)(path38.join(__dirname, "../client-dist/", filename));
         const encoding = accepts(req).encodings(["br", "gzip", "deflate"]);
         const onError = (err) => {
           if (err) {
@@ -20536,8 +20536,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path37, errorMaps, issueData } = params;
-      const fullPath = [...path37, ...issueData.path || []];
+      const { data, path: path38, errorMaps, issueData } = params;
+      const fullPath = [...path38, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -20848,11 +20848,11 @@ var init_types2 = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path37, key) {
+      constructor(parent, value, path38, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path37;
+        this._path = path38;
         this._key = key;
       }
       get path() {
@@ -31687,6 +31687,43 @@ var init_compose_scanner = __esm({
 
 // ../../packages/core/caddy-ca-manager.ts
 import fs9 from "fs/promises";
+import path11 from "path";
+import os7 from "os";
+async function getCaddyDataDir() {
+  const platform = process.platform;
+  let userDataPath;
+  if (platform === "darwin") {
+    userDataPath = path11.join(os7.homedir(), "Library", "Application Support", "Supbuddy");
+  } else if (platform === "win32") {
+    userDataPath = path11.join(
+      process.env.APPDATA || path11.join(os7.homedir(), "AppData", "Roaming"),
+      "Supbuddy"
+    );
+  } else {
+    userDataPath = path11.join(
+      process.env.XDG_CONFIG_HOME || path11.join(os7.homedir(), ".config"),
+      "Supbuddy"
+    );
+  }
+  const dataDir = path11.join(userDataPath, "caddy-data");
+  await fs9.mkdir(dataDir, { recursive: true });
+  return dataDir;
+}
+async function getCaddyCAPath() {
+  try {
+    const dataDir = await getCaddyDataDir();
+    const caPath = path11.join(dataDir, "caddy", "pki", "authorities", "local", "root.crt");
+    try {
+      await fs9.access(caPath);
+      return caPath;
+    } catch {
+      return null;
+    }
+  } catch (error) {
+    console.error("[Caddy CA] Error getting CA path:", error);
+    return null;
+  }
+}
 async function readSystemKeychainCaddyFingerprints() {
   const { execSync: execSync3 } = await import("child_process");
   try {
@@ -31783,38 +31820,211 @@ var init_caddy_ca_manager = __esm({
 // ../../packages/core/bundled-runtime-trust.ts
 import fs10 from "fs/promises";
 import fsSync from "fs";
-import path11 from "path";
-import os7 from "os";
+import path12 from "path";
+import os8 from "os";
+import crypto2 from "crypto";
 import { execFile as execFile4, execFileSync as execFileSync2 } from "child_process";
 import { promisify as promisify5 } from "util";
 function getSupbuddyDataDir() {
   const platform = process.platform;
   if (platform === "darwin") {
-    return path11.join(os7.homedir(), "Library", "Application Support", "Supbuddy");
+    return path12.join(os8.homedir(), "Library", "Application Support", "Supbuddy");
   }
   if (platform === "win32") {
-    return path11.join(
-      process.env.APPDATA || path11.join(os7.homedir(), "AppData", "Roaming"),
+    return path12.join(
+      process.env.APPDATA || path12.join(os8.homedir(), "AppData", "Roaming"),
       "Supbuddy"
     );
   }
-  return path11.join(
-    process.env.XDG_CONFIG_HOME || path11.join(os7.homedir(), ".config"),
+  return path12.join(
+    process.env.XDG_CONFIG_HOME || path12.join(os8.homedir(), ".config"),
     "Supbuddy"
   );
 }
 function getBundleDir() {
-  return path11.join(getSupbuddyDataDir(), "ca-bundle");
+  return path12.join(getSupbuddyDataDir(), "ca-bundle");
 }
 function getBundlePath() {
-  return path11.join(getBundleDir(), "current.crt");
+  return path12.join(getBundleDir(), "current.crt");
+}
+function isSupbuddyOwnedCaPath(p) {
+  if (!p) return false;
+  const resolved = path12.resolve(p);
+  const root = path12.resolve(getSupbuddyDataDir());
+  if (resolved === root || resolved.startsWith(root + path12.sep)) return true;
+  return /[/\\]supbuddy[/\\].*(ca-bundle|caddy[/\\].*pki|authorities[/\\]local|current(-merged)?\.crt)/i.test(
+    resolved
+  );
+}
+function samePath(a, b, caseInsensitive) {
+  const na = path12.resolve(a);
+  const nb = path12.resolve(b);
+  return caseInsensitive ? na.toLowerCase() === nb.toLowerCase() : na === nb;
+}
+function looksAbsolutePath(v) {
+  return v.startsWith("/") || /^[A-Za-z]:[\\/]/.test(v);
+}
+function parseProcessEnvScan(psOutput, varName) {
+  const valueRe = new RegExp(`(?:^|\\s)${varName}=(.*?)(?=\\s[A-Za-z_][A-Za-z0-9_]*=|$)`);
+  const out = [];
+  for (const line of psOutput.split("\n")) {
+    const head = line.match(/^\s*(\d+)\s+(\d+)\s+(.*)$/);
+    if (!head) continue;
+    const rest = head[3];
+    const m = rest.match(valueRe);
+    if (!m) continue;
+    const value = m[1].trim();
+    if (value === "" || !looksAbsolutePath(value)) continue;
+    const envStart = rest.search(ENV_TOKEN_RE);
+    const command = (envStart === -1 ? rest : rest.slice(0, envStart)).trim();
+    out.push({ pid: parseInt(head[1], 10), ppid: parseInt(head[2], 10), command, value });
+  }
+  return out;
+}
+function friendlyProcessName(command) {
+  const app = command.match(/^(.*?)\.app\//);
+  if (app) return path12.basename(app[1]);
+  const exe = command.split(/\s+/)[0] ?? command;
+  return path12.basename(exe) || command;
+}
+function pickRepresentativeHolder(holders) {
+  if (holders.length === 0) return void 0;
+  const pids = new Set(holders.map((h) => h.pid));
+  const topmost = holders.filter((h) => h.ppid == null || !pids.has(h.ppid));
+  const pool = topmost.length > 0 ? topmost : holders;
+  const score = (h) => /\.app\//.test(h.command) ? 0 : 1;
+  return [...pool].sort((a, b) => score(a) - score(b) || a.pid - b.pid)[0];
+}
+function classifyNodeExtraCaCerts(observations, canonicalPath, opts = {}) {
+  const ci = opts.caseInsensitive ?? process.platform !== "linux";
+  const byValue = /* @__PURE__ */ new Map();
+  for (const o of observations) {
+    if (!o.value) continue;
+    const key = ci ? path12.resolve(o.value).toLowerCase() : path12.resolve(o.value);
+    const prev = byValue.get(key);
+    if (prev) {
+      prev.holderCount = (prev.holderCount ?? 1) + (o.holderCount ?? 1);
+      continue;
+    }
+    byValue.set(key, { ...o, holderCount: o.holderCount ?? 1 });
+  }
+  const divergent = [];
+  const foreign = [];
+  for (const o of byValue.values()) {
+    if (samePath(o.value, canonicalPath, ci)) continue;
+    if (isSupbuddyOwnedCaPath(o.value)) divergent.push(o);
+    else foreign.push(o);
+  }
+  return { divergent, foreign, conflicting: foreign[0]?.value ?? divergent[0]?.value ?? null };
+}
+async function scanProcessesForNodeExtra() {
+  const rows = [];
+  try {
+    if (process.platform === "darwin") {
+      const uid = process.getuid?.() ?? 0;
+      const { stdout } = await execFileP(
+        "/bin/ps",
+        ["-Eww", "-o", "pid=,ppid=,command=", "-U", String(uid)],
+        { encoding: "utf-8", maxBuffer: 64 * 1024 * 1024, timeout: 1e4 }
+      );
+      rows.push(...parseProcessEnvScan(stdout, "NODE_EXTRA_CA_CERTS"));
+    } else if (process.platform === "linux") {
+      const uid = process.getuid?.() ?? 0;
+      for (const name of await fs10.readdir("/proc")) {
+        if (!/^\d+$/.test(name)) continue;
+        try {
+          const st = await fs10.stat(`/proc/${name}`);
+          if (st.uid !== uid) continue;
+          const envRaw = await fs10.readFile(`/proc/${name}/environ`, "utf-8");
+          const hit = envRaw.split("\0").find((e) => e.startsWith("NODE_EXTRA_CA_CERTS="));
+          if (!hit) continue;
+          const value = hit.slice("NODE_EXTRA_CA_CERTS=".length).trim();
+          if (!value || !looksAbsolutePath(value)) continue;
+          const cmd = (await fs10.readFile(`/proc/${name}/cmdline`, "utf-8")).split("\0").join(" ").trim();
+          let ppid;
+          try {
+            const stat2 = await fs10.readFile(`/proc/${name}/stat`, "utf-8");
+            ppid = parseInt(stat2.slice(stat2.lastIndexOf(")") + 2).split(" ")[1], 10);
+          } catch {
+            ppid = void 0;
+          }
+          rows.push({ pid: parseInt(name, 10), ppid, command: cmd, value });
+        } catch {
+        }
+      }
+    }
+  } catch {
+    return [];
+  }
+  const byValue = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    const list = byValue.get(r.value);
+    if (list) list.push(r);
+    else byValue.set(r.value, [r]);
+  }
+  return [...byValue.entries()].map(([value, holders]) => {
+    const rep = pickRepresentativeHolder(holders);
+    return {
+      origin: "process",
+      value,
+      detail: rep ? `${friendlyProcessName(rep.command)} (pid ${rep.pid})` : void 0,
+      holderCount: holders.length,
+      // A path that no longer exists is silently ignored by Node — the local
+      // CA just vanishes, which presents as UNABLE_TO_GET_ISSUER_CERT_LOCALLY
+      // with nothing in the status to explain it.
+      exists: fsSync.existsSync(value)
+    };
+  }).sort((a, b) => b.holderCount - a.holderCount || a.value.localeCompare(b.value));
+}
+async function probeLoginShellNodeExtra() {
+  if (process.platform === "win32") return null;
+  const shell = process.env.SHELL || "/bin/sh";
+  if (!PROBEABLE_SHELLS.has(path12.basename(shell))) return null;
+  try {
+    const { stdout } = await execFileP(
+      shell,
+      ["-l", "-c", 'printf %s "$NODE_EXTRA_CA_CERTS"'],
+      {
+        // A clean slate — HOME/USER only, so the profile chain is the ONLY source.
+        env: {
+          HOME: os8.homedir(),
+          USER: process.env.USER ?? "",
+          LOGNAME: process.env.LOGNAME ?? process.env.USER ?? "",
+          PATH: "/usr/bin:/bin:/usr/sbin:/sbin",
+          TERM: "dumb"
+        },
+        encoding: "utf-8",
+        timeout: 8e3,
+        maxBuffer: 1024 * 1024
+      }
+    );
+    const v = stdout.trim();
+    return v === "" ? null : v;
+  } catch {
+    return null;
+  }
+}
+async function getEffectiveEnvObservations(force = false) {
+  const now = Date.now();
+  if (!force && effectiveEnvCache && now - effectiveEnvCache.at < EFFECTIVE_ENV_TTL_MS) {
+    return { loginShell: effectiveEnvCache.loginShell, processes: effectiveEnvCache.processes };
+  }
+  const [loginShell, processes] = await Promise.all([
+    probeLoginShellNodeExtra(),
+    scanProcessesForNodeExtra()
+  ]);
+  effectiveEnvCache = { at: now, loginShell, processes };
+  return { loginShell, processes };
+}
+function invalidateEffectiveEnvCache() {
+  effectiveEnvCache = null;
 }
 function getPlistPath() {
-  return path11.join(os7.homedir(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
+  return path12.join(os8.homedir(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
 }
 function getEnvironmentDPath() {
-  return path11.join(
-    process.env.XDG_CONFIG_HOME || path11.join(os7.homedir(), ".config"),
+  return path12.join(
+    process.env.XDG_CONFIG_HOME || path12.join(os8.homedir(), ".config"),
     "environment.d",
     "supbuddy-ca.conf"
   );
@@ -31829,6 +32039,10 @@ function parsePemBlocks(pem) {
   const re = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
   return pem.match(re) ?? [];
 }
+function hashPemBlock(block) {
+  const normalized = block.replace(/\s+/g, "");
+  return crypto2.createHash("sha256").update(normalized).digest("hex").slice(0, 16);
+}
 async function countPemRoots() {
   try {
     const pem = await fs10.readFile(getBundlePath(), "utf-8");
@@ -31858,7 +32072,7 @@ async function scanLegacyTrustAgents() {
   if (process.platform !== "darwin") return [];
   const managed = getPlistPath();
   const dirs = [
-    path11.join(os7.homedir(), "Library", "LaunchAgents"),
+    path12.join(os8.homedir(), "Library", "LaunchAgents"),
     "/Library/LaunchAgents",
     "/Library/LaunchDaemons"
   ];
@@ -31872,7 +32086,7 @@ async function scanLegacyTrustAgents() {
     }
     for (const name of names) {
       if (!name.endsWith(".plist")) continue;
-      const full = path11.join(dir, name);
+      const full = path12.join(dir, name);
       if (full === managed) continue;
       let content;
       try {
@@ -31893,7 +32107,7 @@ async function cleanupLegacyTrustAgents() {
     try {
       await fs10.copyFile(plistPath, `${plistPath}.supbuddy-backup`).catch(() => {
       });
-      const label = path11.basename(plistPath, ".plist");
+      const label = path12.basename(plistPath, ".plist");
       const uid = process.getuid?.() ?? 501;
       await execFileP("/bin/launchctl", ["bootout", `gui/${uid}/${label}`]).catch(() => {
       });
@@ -31988,13 +32202,37 @@ function getArtifactPath() {
   if (process.platform === "win32") return "HKCU\\Environment";
   return null;
 }
-async function getStatus(lastRefreshedAt) {
+async function bundleHasActiveCaddyRoot() {
+  try {
+    const caddyCaPath = await getCaddyCAPath();
+    if (!caddyCaPath) return true;
+    const caddyBlocks = parsePemBlocks(await fs10.readFile(caddyCaPath, "utf-8"));
+    if (caddyBlocks.length === 0) return true;
+    const bundleHashes = new Set(
+      parsePemBlocks(await fs10.readFile(getBundlePath(), "utf-8")).map(hashPemBlock)
+    );
+    return caddyBlocks.every((b) => bundleHashes.has(hashPemBlock(b)));
+  } catch {
+    return true;
+  }
+}
+async function getStatus(lastRefreshedAt, opts = {}) {
   const installed = await isInstalled();
   const env3 = await readCurrentEnv();
   const bundlePath = getBundlePath();
   const rootCount = await countPemRoots();
-  const node = env3.NODE_EXTRA_CA_CERTS;
-  const conflict = node != null && node !== "" && node !== bundlePath ? node : null;
+  const hasActiveRoot = await bundleHasActiveCaddyRoot();
+  const probe3 = opts.probeEffectiveEnv ?? true;
+  const effective = probe3 ? await getEffectiveEnvObservations(opts.force) : { loginShell: null, processes: [] };
+  const observations = [];
+  if (env3.NODE_EXTRA_CA_CERTS) {
+    observations.push({ origin: "managed", value: env3.NODE_EXTRA_CA_CERTS, detail: getMethod() });
+  }
+  if (effective.loginShell) {
+    observations.push({ origin: "login-shell", value: effective.loginShell, detail: process.env.SHELL ?? "login shell" });
+  }
+  observations.push(...effective.processes);
+  const classified = classifyNodeExtraCaCerts(observations, bundlePath);
   return {
     installed,
     method: getMethod(),
@@ -32002,7 +32240,13 @@ async function getStatus(lastRefreshedAt) {
     bundleRootCount: rootCount,
     lastRefreshedAt,
     currentEnv: env3,
-    conflictingNodeExtraCaCerts: conflict,
+    // What a NEW terminal resolves. Falls back to the managed value only when we
+    // couldn't probe (Windows / exotic shell), never silently.
+    effectiveNodeExtraCaCerts: probe3 ? effective.loginShell : null,
+    nodeExtraCaCertsObservations: observations,
+    divergentNodeExtraCaCerts: classified.divergent,
+    conflictingNodeExtraCaCerts: classified.conflicting,
+    bundleContainsActiveCaddyRoot: hasActiveRoot,
     artifactPath: installed ? getArtifactPath() : null
   };
 }
@@ -32027,6 +32271,7 @@ async function remove(lastRefreshedAt) {
     }
     await fs10.rm(getBundleDir(), { recursive: true, force: true }).catch(() => {
     });
+    invalidateEffectiveEnvCache();
   } catch (e) {
     return { success: false, error: `Remove failed: ${e.message ?? String(e)}` };
   }
@@ -32035,7 +32280,7 @@ async function remove(lastRefreshedAt) {
     status: await getStatus(lastRefreshedAt)
   };
 }
-var execFileP, PLIST_LABEL, MANAGED_ENV_VARS, LEGACY_REPLACE_VARS, ALL_ENV_VARS;
+var execFileP, PLIST_LABEL, MANAGED_ENV_VARS, LEGACY_REPLACE_VARS, ALL_ENV_VARS, ENV_TOKEN_RE, PROBEABLE_SHELLS, EFFECTIVE_ENV_TTL_MS, effectiveEnvCache;
 var init_bundled_runtime_trust2 = __esm({
   "../../packages/core/bundled-runtime-trust.ts"() {
     "use strict";
@@ -32045,6 +32290,10 @@ var init_bundled_runtime_trust2 = __esm({
     MANAGED_ENV_VARS = ["NODE_EXTRA_CA_CERTS"];
     LEGACY_REPLACE_VARS = ["SSL_CERT_FILE", "REQUESTS_CA_BUNDLE"];
     ALL_ENV_VARS = [...MANAGED_ENV_VARS, ...LEGACY_REPLACE_VARS];
+    ENV_TOKEN_RE = /\s[A-Za-z_][A-Za-z0-9_]*=/;
+    PROBEABLE_SHELLS = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "ksh", "dash", "fish"]);
+    EFFECTIVE_ENV_TTL_MS = 3e4;
+    effectiveEnvCache = null;
   }
 });
 
@@ -32089,11 +32338,11 @@ var init_docker_watcher = __esm({
 import { exec as exec3 } from "child_process";
 import { promisify as promisify6 } from "util";
 import fs11 from "fs/promises";
-import path12 from "path";
+import path13 from "path";
 async function tailscaleKeyPath() {
-  const dir = path12.join(await getAppSupportDir(), "secrets");
+  const dir = path13.join(await getAppSupportDir(), "secrets");
   await fs11.mkdir(dir, { recursive: true, mode: 448 });
-  return path12.join(dir, "tailscale-api-key.secret");
+  return path13.join(dir, "tailscale-api-key.secret");
 }
 async function persistTailscaleKey(key) {
   try {
@@ -34327,7 +34576,7 @@ var require_multicast_dns = __commonJS({
     var dgram = __require("dgram");
     var thunky = require_thunky();
     var events = __require("events");
-    var os13 = __require("os");
+    var os14 = __require("os");
     var noop = function() {
     };
     module.exports = function(opts) {
@@ -34457,14 +34706,14 @@ var require_multicast_dns = __commonJS({
       return that;
     };
     function defaultInterface() {
-      var networks = os13.networkInterfaces();
+      var networks = os14.networkInterfaces();
       var names = Object.keys(networks);
       for (var i = 0; i < names.length; i++) {
         var net2 = networks[names[i]];
         for (var j = 0; j < net2.length; j++) {
           var iface = net2[j];
           if (isIPv4(iface.family) && !iface.internal) {
-            if (os13.platform() === "darwin" && names[i] === "en0") return iface.address;
+            if (os14.platform() === "darwin" && names[i] === "en0") return iface.address;
             return "0.0.0.0";
           }
         }
@@ -34472,7 +34721,7 @@ var require_multicast_dns = __commonJS({
       return "127.0.0.1";
     }
     function allInterfaces() {
-      var networks = os13.networkInterfaces();
+      var networks = os14.networkInterfaces();
       var names = Object.keys(networks);
       var res = [];
       for (var i = 0; i < names.length; i++) {
@@ -34526,7 +34775,7 @@ var init_mapping_scope = __esm({
 
 // ../../packages/core/dns-platform.ts
 import fs12 from "fs/promises";
-import path13 from "path";
+import path14 from "path";
 function getManagedDomainSuffixes() {
   const store = useStore2.getState();
   const suffixes = /* @__PURE__ */ new Set();
@@ -34545,7 +34794,7 @@ async function buildMacOsCleanupCommand() {
     const files = await fs12.readdir(resolverDir);
     const toRemove = [];
     for (const file of files) {
-      const filePath = path13.join(resolverDir, file);
+      const filePath = path14.join(resolverDir, file);
       try {
         const content = await fs12.readFile(filePath, "utf-8");
         if (content.includes(SUPBUDDY_MARKER)) {
@@ -34619,7 +34868,7 @@ async function auditMacOsResolver(expected) {
   const present = [];
   for (const file of entries) {
     try {
-      const content = await fs12.readFile(path13.join(resolverDir, file), "utf-8");
+      const content = await fs12.readFile(path14.join(resolverDir, file), "utf-8");
       if (content.includes(SUPBUDDY_MARKER)) present.push(file);
     } catch {
     }
@@ -36595,7 +36844,7 @@ var require_udp2 = __commonJS({
     "use strict";
     var udp = __require("dgram");
     var net2 = __require("net");
-    var crypto6 = __require("crypto");
+    var crypto7 = __require("crypto");
     var Packet3 = require_packet();
     var { debuglog } = __require("util");
     var debug = debuglog("dns2");
@@ -36609,7 +36858,7 @@ var require_udp2 = __commonJS({
       return (name, type2 = "A", cls = Packet3.CLASS.IN, options = {}) => {
         const { clientIp, recursive = true } = options;
         const query = new Packet3();
-        query.header.id = crypto6.randomInt(65536);
+        query.header.id = crypto7.randomInt(65536);
         if (recursive) {
           query.header.rd = 1;
         }
@@ -36881,21 +37130,21 @@ var init_dns_server = __esm({
 
 // ../../packages/core/caddyfile-generator.ts
 import fs13 from "fs/promises";
-import path14 from "path";
-import os8 from "os";
+import path15 from "path";
+import os9 from "os";
 async function getCaddyfileDir() {
   const platform = process.platform;
   let userDataPath;
   if (platform === "darwin") {
-    userDataPath = path14.join(os8.homedir(), "Library", "Application Support", "Supbuddy");
+    userDataPath = path15.join(os9.homedir(), "Library", "Application Support", "Supbuddy");
   } else if (platform === "win32") {
-    userDataPath = path14.join(
-      process.env.APPDATA || path14.join(os8.homedir(), "AppData", "Roaming"),
+    userDataPath = path15.join(
+      process.env.APPDATA || path15.join(os9.homedir(), "AppData", "Roaming"),
       "Supbuddy"
     );
   } else {
-    userDataPath = path14.join(
-      process.env.XDG_CONFIG_HOME || path14.join(os8.homedir(), ".config"),
+    userDataPath = path15.join(
+      process.env.XDG_CONFIG_HOME || path15.join(os9.homedir(), ".config"),
       "Supbuddy"
     );
   }
@@ -36915,7 +37164,7 @@ async function writeFileAtomic(filePath, content) {
 }
 async function generateCaddyfile(mappings, settings, options = {}, validate) {
   const caddyfileDir = await getCaddyfileDir();
-  const caddyfilePath = path14.join(caddyfileDir, "Caddyfile");
+  const caddyfilePath = path15.join(caddyfileDir, "Caddyfile");
   const caddyfileContent = buildCaddyfileContent(mappings, settings, options);
   if (validate) {
     const res = await validate(caddyfileContent);
@@ -37048,7 +37297,7 @@ function buildCaddyfileContent(mappings, settings, options = {}) {
 }
 async function getCaddyDataDir2() {
   const caddyfileDir = await getCaddyfileDir();
-  const dataDir = path14.join(caddyfileDir, "caddy-data");
+  const dataDir = path15.join(caddyfileDir, "caddy-data");
   await fs13.mkdir(dataDir, { recursive: true });
   return dataDir;
 }
@@ -37105,9 +37354,9 @@ var init_env_utils = __esm({
 });
 
 // ../../packages/core/project-env.ts
-import path15 from "path";
+import path16 from "path";
 async function resolveProjectEnv(projectPath) {
-  const all = await readEnvFileAsDict(path15.join(projectPath, ".env.local"));
+  const all = await readEnvFileAsDict(path16.join(projectPath, ".env.local"));
   const out = {};
   for (const [k, v] of Object.entries(all)) {
     if (k.startsWith("SUPABASE_")) out[k] = v;
@@ -37377,8 +37626,8 @@ async function isSupabaseInitialized(projectPath) {
     const { promisify: promisify15 } = await import("util");
     const execAsync9 = promisify15(exec9);
     const fs33 = await import("fs/promises");
-    const path37 = await import("path");
-    const supabasePath = path37.join(projectPath, "supabase");
+    const path38 = await import("path");
+    const supabasePath = path38.join(projectPath, "supabase");
     await fs33.access(supabasePath);
     return true;
   } catch {
@@ -37402,8 +37651,8 @@ function parseFieldFromBlock(block, field, fallback) {
 async function parseConfigPort(projectPath, section, fallback, field = "port") {
   try {
     const fs33 = await import("fs/promises");
-    const path37 = await import("path");
-    const content = await fs33.readFile(path37.join(projectPath, "supabase", "config.toml"), "utf-8");
+    const path38 = await import("path");
+    const content = await fs33.readFile(path38.join(projectPath, "supabase", "config.toml"), "utf-8");
     const block = extractSectionBlock(content, section);
     if (!block) return fallback;
     return parseFieldFromBlock(block, field, fallback);
@@ -37413,10 +37662,10 @@ async function parseConfigPort(projectPath, section, fallback, field = "port") {
 }
 async function readSupabasePorts(projectPath) {
   const fs33 = await import("fs/promises");
-  const path37 = await import("path");
+  const path38 = await import("path");
   let content = "";
   try {
-    content = await fs33.readFile(path37.join(projectPath, "supabase", "config.toml"), "utf-8");
+    content = await fs33.readFile(path38.join(projectPath, "supabase", "config.toml"), "utf-8");
   } catch {
     return { db: 54322, api: 54321, studio: 54323, inbucket: 54324, shadow: 54320, pooler: 54329, smtp: 54325, pop3: 54326, analytics: 54327 };
   }
@@ -37758,10 +38007,10 @@ function takenSupabaseProjectIds(projects, excludeId) {
 }
 async function resolveSupaDir(project) {
   if (!project.path) return null;
-  const path37 = await import("path");
+  const path38 = await import("path");
   const fs33 = await import("fs/promises");
-  const supaDir = project.supabasePath ? path37.join(project.path, project.supabasePath) : project.path;
-  const configPath = path37.join(supaDir, "supabase", "config.toml");
+  const supaDir = project.supabasePath ? path38.join(project.path, project.supabasePath) : project.path;
+  const configPath = path38.join(supaDir, "supabase", "config.toml");
   try {
     await fs33.access(configPath);
   } catch {
@@ -37928,14 +38177,14 @@ function buildL4AppConfig() {
   }
   return { servers };
 }
-function adminRequest(method, path37, body) {
+function adminRequest(method, path38, body) {
   return new Promise((resolve, reject) => {
     const payload = body === void 0 ? void 0 : JSON.stringify(body);
     const req = http.request(
       {
         host: ADMIN_HOST,
         port: ADMIN_PORT,
-        path: path37,
+        path: path38,
         method,
         headers: payload ? { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(payload) } : {},
         timeout: 5e3
@@ -38144,7 +38393,7 @@ var init_caddy_supervisor = __esm({
 import { spawn as spawn6, execFile as execFile5 } from "child_process";
 import { promisify as promisify8 } from "util";
 import { randomUUID } from "crypto";
-import path16 from "path";
+import path17 from "path";
 import fs15 from "fs/promises";
 import nodeProcess2 from "process";
 function getCaddyBinaryPath() {
@@ -38160,18 +38409,18 @@ function getCaddyBinaryPath() {
   }
   const bundledBinDir = nodeProcess2.env.SUPBUDDY_BIN_DIR;
   if (bundledBinDir) {
-    return path16.join(bundledBinDir, binaryName);
+    return path17.join(bundledBinDir, binaryName);
   }
   const isDev = process.env.NODE_ENV !== "production";
   if (isDev) {
-    return path16.join(process.cwd(), "resources", "bin", binaryName);
+    return path17.join(process.cwd(), "resources", "bin", binaryName);
   } else {
-    return path16.join(process.resourcesPath, "bin", binaryName);
+    return path17.join(process.resourcesPath, "bin", binaryName);
   }
 }
 async function reapStaleCaddyProcesses() {
   if (process.platform === "win32") return;
-  const binaryName = path16.basename(getCaddyBinaryPath());
+  const binaryName = path17.basename(getCaddyBinaryPath());
   let survivors = await listCaddyPids(binaryName);
   for (const pid of survivors) {
     sendSignalIgnoringMissing(pid, "SIGTERM");
@@ -38264,7 +38513,7 @@ async function doStartCaddyServer() {
       ...process.env,
       HOME: homeDir,
       XDG_DATA_HOME: dataDir,
-      XDG_CONFIG_HOME: path16.dirname(caddyfilePath)
+      XDG_CONFIG_HOME: path17.dirname(caddyfilePath)
     };
     caddyProcess = spawn6(binaryPath, ["run", "--config", caddyfilePath, "--adapter", "caddyfile"], {
       env: caddyEnv,
@@ -38354,6 +38603,7 @@ async function stopCaddyServer() {
   await caddySupervisor.quiesce();
   caddySupervisor.reset();
   if (!caddyProcess) {
+    await reapStaleCaddyProcesses();
     return;
   }
   store.setProxyStatus("stopping");
@@ -38379,6 +38629,7 @@ async function stopCaddyServer() {
       }
     });
     caddyProcess = null;
+    await reapStaleCaddyProcesses();
     store.setProxyStatus("idle");
     console.log("[Caddy] Server stopped");
   } catch (error) {
@@ -38438,7 +38689,7 @@ function isCaddyErrorLine(line) {
 async function validateCaddyfileContent(content) {
   const binaryPath = getCaddyBinaryPath();
   const dir = await getCaddyfileDir();
-  const tmpPath = path16.join(dir, `Caddyfile.validate.${process.pid}.${caddyValidateCounter++}.tmp`);
+  const tmpPath = path17.join(dir, `Caddyfile.validate.${process.pid}.${caddyValidateCounter++}.tmp`);
   const execFileAsync6 = promisify8(execFile5);
   try {
     await fs15.writeFile(tmpPath, content, "utf-8");
@@ -38531,13 +38782,7 @@ async function stopAllServices(deps = realDeps()) {
     });
   });
   await step("stopDnsServer", () => deps.stopDnsServer());
-  let caddyRunning = false;
-  await step("isCaddyRunning", () => {
-    caddyRunning = deps.isCaddyRunning();
-  });
-  if (caddyRunning) {
-    await step("stopCaddyServer", () => deps.stopCaddyServer());
-  }
+  await step("stopCaddyServer", () => deps.stopCaddyServer());
 }
 var realDeps;
 var init_stop_all_services = __esm({
@@ -39020,7 +39265,7 @@ var init_ca_and_trust = __esm({
 });
 
 // ../../packages/core/system-doctor/checks/orphan-mcp-secrets.ts
-import path17 from "path";
+import path18 from "path";
 function secretKey(clientId) {
   return clientId.replace(/[^a-zA-Z0-9._-]/g, "_");
 }
@@ -39032,8 +39277,8 @@ function liveSecretKeys() {
   return new Set(clients.filter((c) => !c.revoked).map((c) => secretKey(c.id)));
 }
 function isRemovableSecret(p, dir, live) {
-  if (path17.dirname(p) !== dir) return false;
-  const m = SECRET_RE.exec(path17.basename(p));
+  if (path18.dirname(p) !== dir) return false;
+  const m = SECRET_RE.exec(path18.basename(p));
   return m !== null && !live.has(m[1]);
 }
 var SECRET_RE;
@@ -39047,7 +39292,7 @@ var init_orphan_mcp_secrets = __esm({
 
 // ../../packages/core/system-doctor/wipe/steps/revoked-mcp-secrets.ts
 import fs19 from "fs/promises";
-import path18 from "path";
+import path19 from "path";
 var revokedMcpSecrets;
 var init_revoked_mcp_secrets = __esm({
   "../../packages/core/system-doctor/wipe/steps/revoked-mcp-secrets.ts"() {
@@ -39058,7 +39303,7 @@ var init_revoked_mcp_secrets = __esm({
       tiers: ["deep", "full"],
       destroysUserData: false,
       async build(ctx) {
-        const dir = path18.join(ctx.appSupportDir, "secrets");
+        const dir = path19.join(ctx.appSupportDir, "secrets");
         let live;
         try {
           live = liveSecretKeys();
@@ -39071,11 +39316,11 @@ var init_revoked_mcp_secrets = __esm({
         } catch {
           return [];
         }
-        const targets = entries.filter((e) => e.isFile()).map((e) => path18.join(dir, e.name)).filter((p) => isRemovableSecret(p, dir, live));
+        const targets = entries.filter((e) => e.isFile()).map((e) => path19.join(dir, e.name)).filter((p) => isRemovableSecret(p, dir, live));
         if (targets.length === 0) return [];
         return [
           {
-            label: `Delete ${targets.length} dead MCP token secret(s) from ${dir}: ${targets.map((p) => path18.basename(p)).join(", ")}`,
+            label: `Delete ${targets.length} dead MCP token secret(s) from ${dir}: ${targets.map((p) => path19.basename(p)).join(", ")}`,
             destructive: true,
             run: async () => {
               const failures = [];
@@ -39209,7 +39454,7 @@ var init_orphan_dind = __esm({
 });
 
 // ../../packages/core/system-doctor/wipe/steps/tier3-targets.ts
-import path19 from "path";
+import path20 from "path";
 function projectSnapshot() {
   return [...useStore2.getState().projects];
 }
@@ -39281,7 +39526,7 @@ async function dindTargets(ctx) {
   return targets;
 }
 async function requireArchive(ctx, vol) {
-  const archive = path19.join(backupDirFor(ctx.appSupportDir, ctx.stamp), `${vol}.tar.gz`);
+  const archive = path20.join(backupDirFor(ctx.appSupportDir, ctx.stamp), `${vol}.tar.gz`);
   let size = -1;
   try {
     size = (await ctx.fs.stat(archive)).size;
@@ -39310,9 +39555,9 @@ var init_tier3_targets = __esm({
 
 // ../../packages/core/system-doctor/wipe/steps/backup-project-data.ts
 import fs20 from "fs/promises";
-import path20 from "path";
+import path21 from "path";
 function dumpAction(p, container, dir, ctx) {
-  const dest = path20.join(dir, `supabase-${p.id}.pgc`);
+  const dest = path21.join(dir, `supabase-${p.id}.pgc`);
   return {
     label: `Back up the Supabase database of "${p.name ?? p.id}" (pg_dump of ${container}) to ${dest}`,
     destructive: false,
@@ -39328,7 +39573,7 @@ function dumpAction(p, container, dir, ctx) {
             `Backup of "${p.name ?? p.id}" is truncated: copied ${size} of ${dump2.bytes} bytes to ${dest}`
           );
         }
-        await ctx.fs.writeFile(`${dest}.sha256`, `${dump2.sha256}  ${path20.basename(dest)}
+        await ctx.fs.writeFile(`${dest}.sha256`, `${dump2.sha256}  ${path21.basename(dest)}
 `);
       } finally {
         await fs20.rm(dump2.dir, { recursive: true, force: true }).catch(() => {
@@ -39369,7 +39614,7 @@ var init_backup_project_data = __esm({
         }
         for (const vol of [...new Set(volumes)]) {
           actions.push({
-            label: `Archive docker volume '${vol}' to ${path20.join(dir, `${vol}.tar.gz`)} (may take several minutes)`,
+            label: `Archive docker volume '${vol}' to ${path21.join(dir, `${vol}.tar.gz`)} (may take several minutes)`,
             destructive: false,
             // Never hand-rolled: backupDockerVolume prechecks the volume, archives on
             // the long-timeout THROWING seam and proves the result with `gzip -t`.
@@ -39386,7 +39631,7 @@ var init_backup_project_data = __esm({
 
 // ../../packages/core/project-context/detect.ts
 import fs21 from "fs/promises";
-import path21 from "path";
+import path22 from "path";
 async function isDir(p) {
   try {
     const st = await fs21.stat(p);
@@ -39399,12 +39644,12 @@ async function detectTargets(projectPath) {
   return {
     agents_md: true,
     claude_md: true,
-    cursor: await isDir(path21.join(projectPath, ".cursor")),
-    claude_skills: await isDir(path21.join(projectPath, ".claude")),
-    windsurf: await isDir(path21.join(projectPath, ".codeium", "windsurf")),
-    continue: await isDir(path21.join(projectPath, ".continue")),
-    copilot: await isDir(path21.join(projectPath, ".github")),
-    jetbrains: await isDir(path21.join(projectPath, ".idea"))
+    cursor: await isDir(path22.join(projectPath, ".cursor")),
+    claude_skills: await isDir(path22.join(projectPath, ".claude")),
+    windsurf: await isDir(path22.join(projectPath, ".codeium", "windsurf")),
+    continue: await isDir(path22.join(projectPath, ".continue")),
+    copilot: await isDir(path22.join(projectPath, ".github")),
+    jetbrains: await isDir(path22.join(projectPath, ".idea"))
   };
 }
 var init_detect = __esm({
@@ -39418,7 +39663,7 @@ var DOCS_MARKDOWN;
 var init_docs_generated = __esm({
   "../../packages/core/project-context/docs.generated.ts"() {
     "use strict";
-    DOCS_MARKDOWN = "# Supbuddy docs\n\n> Run multiple Supabase projects at once on one Mac, each with its own custom local domain.\n\n## Getting started\n\nThere are two ways to run Supbuddy. Use the **macOS desktop app** (steps below), or the **command-line interface**, which runs on macOS and Linux. For the CLI, install it with `npx supbuddy@latest` and jump to [Command-line interface](#command-line-interface-cli). The app and the CLI share the same state, so you can use either or both.\n\n### 1. Install\n\nDownload the latest `.dmg` from the [download page](/api/download). Drag **Supbuddy.app** into `/Applications` and launch it. Supbuddy is signed and notarized; macOS will not show a Gatekeeper warning. Requires an Apple Silicon Mac (M1/M2/M3/M4, arm64). The desktop app is macOS-only in v2, but the headless CLI runs on Linux too. See [Command-line interface](#command-line-interface-cli).\n\n### 2. Trust the local Certificate Authority\n\nCaddy mints its local CA the first time it actually serves a site, so the cert only exists once you have **at least one enabled mapping and the proxy running** \u2014 an empty proxy never generates it. With that in place, open the app and click **Install** (the first-launch prompt, or **Settings \u2192 Network** later). Supbuddy adds the CA (Caddy's internal PKI at `~/Library/Application Support/Supbuddy/caddy-data/caddy/pki/authorities/local/root.crt`) to your **System keychain** via `sudo security add-trusted-cert`; macOS asks for your password once. Caddy does **not** self-install trust (the generated Caddyfile sets `skip_install_trust`), so this button is what makes the padlock green \u2014 fully quit and reopen your browser afterward to pick it up. Every Supbuddy domain then gets HTTPS with no per-domain prompts or warnings. (On Windows the install is manual: Supbuddy shows the PowerShell `Import-Certificate \u2026 -CertStoreLocation Cert:\\LocalMachine\\Root` command to run as Administrator.)\n\nCaddy names its root by year, so each yearly rotation (or a data wipe) leaves a same-name root behind with a different key. On every Install, Supbuddy first removes any stale `Caddy Local Authority` roots whose fingerprint doesn't match the current one, then adds the current root \u2014 leftover mismatched roots otherwise make Firefox-family browsers fail with `SEC_ERROR_BAD_SIGNATURE`.\n\n**Firefox, Zen, and Brave keep their own certificate store** that Supbuddy can't reach (they don't consult the System keychain). After a CA change, either delete any stale `Caddy Local Authority` entries from the browser's own certificate manager and re-import the new root, or \u2014 on Firefox/Zen \u2014 set `security.enterprise_roots.enabled` to `true` in `about:config` so the browser reads the System keychain.\n\nIf Supbuddy detects an AI tool that ships its own JavaScript runtime (Claude Code, Cursor, Windsurf, Continue, Codex CLI, OpenCode, etc.) it will also offer to enable **Bundled-runtime trust** in the same first-run prompt. Those tools don't read the system Keychain (they carry their own Mozilla CA bundle), so without this setup the first OAuth/MCP connection to a `*.test` URL fails with `unable to get local issuer certificate`. Enable it once and Supbuddy keeps it in sync (including across yearly Caddy CA rotation). See the **Bundled-runtime trust** section under Settings \u2192 General for details.\n\nIf you skip the prompt, you can re-trigger it any time from the **Settings \u2192 Network** tab.\n\n### 3. Add your first project\n\nClick **Add project** in the Configure tab and pick a project root folder (the one with `package.json` and/or `supabase/config.toml`). Supbuddy scans it and creates auto-mapped subdomains based on what it finds:\n\n- Supabase Kong \u2192 `api.<project>.test`\n- Supabase Studio \u2192 `studio.<project>.test`\n- Supabase Inbucket / Mailpit \u2192 `mail.<project>.test`\n- Each detected app (Next.js, Vite, etc.) \u2192 `<app-name>.<project>.test`\n\nThe default TLD is `.test`. You can change it project-wide in **Settings \u2192 General \u2192 Default TLD**.\n\n### 4. Start the proxy\n\nToggle the project on. Supbuddy starts Caddy on port 8443 (HTTPS) and starts its built-in DNS server on port 5353. If you want real ports 80/443 instead of 8080/8443, enable **port forwarding** in **Settings \u2192 Network**. Supbuddy inserts a `pfctl` redirect rule into `/etc/pf.conf` (asks for sudo once) and reports whether the redirect is actually being enforced via a live 443 probe \u2014 not merely that the rule is on disk. If port forwarding is on but 443 won't connect, see [Port forwarding is on but 443 won't connect](#port-forwarding-is-on-but-443-wont-connect).\n\n> If the one-time sudo prompt is cancelled or fails, Supbuddy no longer aborts the start: Caddy still comes up and HTTPS keeps working on the high port (8443), and the proxy shows a degraded **error** state with a **Retry** so you can re-run the privileged setup. The CA is still generated in this state.\n\n## Core concepts\n\nFour things to understand:\n\n- **Project**: a folder you registered. Holds detected *apps* (Next.js, Vite, etc.), detected *services* (Supabase stack, Docker Compose services), and a list of *mappings*.\n- **Mapping**: a domain \u2192 port pair (e.g. `api.acme.test \u2192 54321`). Auto-generated mappings are tied to a detected service or app; you can also create manual ones.\n- **Isolation mode**: per-project. One of:\n  - `thin` (lightweight, **the default for newly registered projects**): still your host Docker (no nested containers, no DinD), but Supbuddy gives each project its own **port block** and a unique Compose `project_id`, written into that project's `supabase/config.toml`. That's what lets several Supabase projects run **at once on the shared daemon**, each reached by name (`api.<project>.test`, `studio.<project>.test`). Apps bind a **per-project loopback IP** (127.0.0.2, 127.0.0.3, \u2026) so every project's dev servers keep their canonical ports \u2014 each project gets its *own* `:3000`. Start dev servers with `supbuddy run -- <dev command>` so they bind that IP. Supbuddy owns those config.toml keys while the project is `thin` and restores them the moment you switch back to `host`.\n  - `host`: everything shares `127.0.0.1` and the stock ports. Dev-server ports collide across projects, and only one host-mode Supabase project can run at a time (the standard `supabase start` constraint). Use `host` **only when the project's Supabase stack is already running on the host independently of Supbuddy** (you run `supabase start` yourself and don't want Supbuddy re-porting `config.toml`). MCP registration (`register_project`) detects that case and keeps such projects on `host` automatically; in the app's Add-project dialog, pick **Host** in the Environment section yourself.\n- **Active vs inactive**: any project can be \"active\" (proxied + reachable) or inactive. Inactive projects keep their state, so flipping them on is a few seconds. Run as many active projects as you want.\n\n## Project cards (Configure tab)\n\nEach registered project appears as a card in the Configure tab. Cards have a single-row header that's always visible and a tab-based body that expands on click.\n\n### Header\n\nReading left to right:\n\n- **Expand chevron** + **project name**: click to expand/collapse the card.\n- **Status indicator**: a single colored dot next to the project name aggregating the realtime state of every subsystem (Supabase services, Compose, scripts, AI sync, port conflicts, next.config warnings). Red = error, amber = warning, green = at least one service running, muted gray = idle, animated cyan spinner = transitioning. Hover for a tooltip that lists each subsystem's state.\n- **Tech badges**: e.g. `TurboRepo`, `Supabase` (shown when detected).\n\n**Supabase connection warning.** When a project's app `.env` is missing the\nSupabase connection vars, or they've gone stale relative to the live target\n(e.g. after switching isolation, which republishes ports), the card shows a\n`supabase env: not connected` / `supabase env: out of date` pill. Click it to\nopen Connect and push fresh values, or choose **Ignore for this project**.\n- **Env mode chip**: read-only `Host` or `Thin` label (matching the project's isolation mode). To switch modes, open the **Supabase** tab and use the **Environment** section at the top.\n- **Issues counter**: red for errors, amber for warnings. Click to open the **issues popover** (see below). Hidden when there are no issues.\n- **Warnings chip**: all project-level warnings (isolation drift, missing env vars, config issues, etc.) are consolidated into a single amber chip next to the enable toggle. Click it to see each warning item-by-item; it shows a spinner while Supbuddy re-checks the project.\n- **Enable toggle** (right edge): turn the project's proxy on/off without deleting it.\n- **\u22EF actions menu** (right edge): every project-level action: **Edit project**, **Rescan**, **Re-check configs** (re-runs the connection/env drift check for this project), **Select folder**, **Export bundle**, and **Delete project**.\n\n### Issues popover\n\nClicking the issues counter opens a popover listing all current errors and warnings. Each issue shows a severity icon, title, optional detail, and a **\u2192 open {tab}** link. Clicking the link jumps to the relevant tab and closes the popover.\n\n### Body tabs (when expanded)\n\nThe body renders a flat tab strip with 6 conditional tabs. Below ~480 px, the strip collapses to a dropdown selector. (Project-level actions, like edit, rescan, re-check configs, select folder, export, and delete, are in the header's **\u22EF menu**, not a tab.)\n\n#### Apps (default tab)\n\nPer-app rows are domain-first: `domain \u2192 :port` (with hover-revealed copy/open URL buttons), then app name + tech badge, then a flex spacer pushes hover-revealed **edit** / **delete** / **access** (LAN / Tailscale state) actions and the per-mapping **toggle** to the right edge. A **Map** CTA appears on hover for unmapped apps. Manual mappings scoped to this project (not auto-generated) are listed below under their own subheader.\n\n#### Supabase (shown when Supabase is detected)\n\n**Environment section (top):** host/thin switcher. A legacy project still on the old Isolated (VM) mode shows the migration wizard here instead (see [Migrating a legacy Isolated (VM) project to Thin](#migrating-a-legacy-isolated-vm-project-to-thin)).\n\n**Action bar:** Start, Stop, Restart buttons; a first-class **Connect** button (cyan, opens the connection panel for `.env` generation / merge); and a **More** menu with **Config editor** and **Details**.\n\n**Config editor: secret extraction.** When you save a `supabase/config.toml` that contains a secret-bearing value inline (e.g. an SMTP password under `[auth.email.smtp]`, an OAuth `secret`, or any `*_key`/`auth_token`), Supbuddy prompts before writing: it lists the detected secrets and lets you pick which gitignored env file to move them to (defaulting to the project-root `.env.local`). The value is written there and replaced in `config.toml` with an `env(SUPABASE_\u2026)` reference, so secrets never land in git. Supbuddy injects those `SUPABASE_`-prefixed values back into the `supabase start` environment so the references resolve. (Saving a config with no inline secrets writes directly, with no prompt.)\n\n**Service rows** (read-only): status dot, service name, URL. No inline actions; lifecycle is driven by the action bar.\n\n#### Compose (shown when Compose services are detected)\n\n**Action bar:** Start, Stop, Restart. **Service rows** are read-only (status dot, name, URL). Add-on services declared in `supbuddy.addons.yml` (see **Add-on Compose services**) appear here alongside the base stack and in `get_compose_status` over MCP.\n\n#### Other (shown when non-Supabase, non-Compose services are detected)\n\nRead-only service rows: status dot, name, URL.\n\n#### Scripts (shown when scripts are detected)\n\nBookmarked scripts appear in a **Quick Access** group at the top; remaining scripts appear under **Other Scripts**. Per-script row: status dot, name, uptime, bookmark star, Start/Stop/Restart buttons. A search input appears when there are more than 5 scripts.\n\n#### AI Tools\n\nWraps the project-context-sync panel: sync mode selector (Auto / Manual / Off), detected targets list with per-target **scope** (global / local), advanced options, and recent activity. See [Per-project AI context sync](#per-project-ai-context-sync) for what global vs. local means.\n\n> Project-level actions (**Edit**, **Rescan**, **Re-check configs**, **Select folder**, **Export bundle**, **Delete**) are no longer a tab. They live in the header's **\u22EF actions menu**.\n\n---\n\n## Multiple Supabase projects (the main use case)\n\nThe reason Supbuddy exists. Stock Supabase CLI binds to fixed ports (54321 Kong, 54322 Postgres, 54323 Studio, 54324 Inbucket). Two projects on the same machine collide; you must `supabase stop` one before `supabase start`-ing the other.\n\nTwo ways to break that constraint, picked per project in the **Supabase** tab \u2192 **Environment** section:\n\n### Thin (lightweight, recommended)\n\nSwitch a project to **Thin**. Supbuddy assigns it a free port block (in the `55000+` range), writes those ports plus a unique Compose `project_id` into its `supabase/config.toml`, and runs `supabase start` on your **normal host Docker**, with no nested containers and nothing to pull. Several projects boot side by side this way; each is reached by name (`api.acme.test`, `studio.acme.test`, `mail.acme.test`). Switch back to **Host** and Supbuddy restores the original `config.toml` and stops just that project's stack.\n\nThis is the lightest, fastest option and the right default for most setups \u2014 which is why **newly registered projects default to Thin**. One caveat: if your `config.toml` omits a port key (e.g. `[inbucket] smtp_port`), Supbuddy can't relocate a port that isn't declared, so that one service falls back to its stock port. That is fine for a single project, but spell those keys out if two Thin projects need the same service.\n\n### Dev servers on Thin: every project keeps its own `:3000`\n\nA Thin project also gets its own **loopback IP** (127.0.0.2, 127.0.0.3, \u2026, persisted per project). Its app dev servers bind that IP instead of `127.0.0.1`, so canonical ports never collide across projects \u2014 five Next.js apps in five projects can all run on `:3000` at once, and Supbuddy's proxy routes each `web.<project>.test` to its project's IP.\n\nStart dev servers through the launcher:\n\n```bash\nsupbuddy run -- next dev          # binds -H <project loopback IP>, stays on :3000\nsupbuddy run -- vite              # injects --host <ip> --strictPort\nsupbuddy run --print -- next dev  # show what would run, without running it\n```\n\n`supbuddy run` reads the project's IP from the nearest `.supbuddy/meta.json` (`loopbackIp`, written when Thin is enabled), ensures the loopback alias exists, injects the right bind flag for the detected framework, and execs your command. It prints one concise line with the project's Caddy-proxied URL (e.g. `[supbuddy] \u2192 https://web.<project>.test`) \u2014 the address you should actually open. For **Next and Vite** it also hides the dev server's own `- Local:/- Network:` banner (which only echoes the raw loopback IP `127.0.0.N:<port>`, bypassing Supbuddy's HTTPS proxy): those two lines are filtered out of the piped output, every other line passes through untouched, and colours are preserved via `FORCE_COLOR` (stdin stays interactive). Other frameworks pass through with no filtering. When a project has several app mappings, it matches the one whose port equals the dev server's port (from `--port`/`-p` or the framework default), else lists them all. Make it the project's `dev` script (`\"dev\": \"supbuddy run -- next dev\"`) so nobody \u2014 humans or agents \u2014 has to remember it. **Never move an app to a nonstandard port because `127.0.0.1:3000` is busy**; that port belongs to another project's IP space.\n\n### When to stay on Host\n\nKeep a project on **Host** only when its Supabase stack runs on the host *independently of Supbuddy* \u2014 you run `supabase start` yourself on the stock ports and don't want Supbuddy rewriting `config.toml`. MCP registration (`register_project`) detects a stack like that (running containers for the project's `config.toml` `project_id`) and keeps the project on Host automatically; in the app's Add-project dialog, pick **Host** in the Environment section for such projects. Stop the stack (`supabase stop`) and switch to Thin whenever you're ready.\n\n### Running them all at once\n\nRegister as many projects as you want, and all of them can be \"active\" (proxied) at the same time. There's no limit. A Thin project's stack restarts in seconds; a Host project needs the standard `supabase start` cycle.\n\n### Migrating a legacy Isolated (VM) project to Thin\n\nIf you created a project in an older version of Supbuddy that used the now-retired **Isolated (VM)** mode, Supbuddy detects it on launch and offers a one-way, guided migration to **Thin**. The migration wizard appears in the **Supabase** tab's Environment section for any project still flagged as VM.\n\nThe migration is data-safe: Supbuddy dumps your Postgres data, starts a fresh Thin stack, restores the dump into it, and row-count-verifies the restore before tearing down the old VM container. No data loss. After migrating, the VM is gone and there's no way to switch back (but your data is intact in the Thin stack).\n\nOver MCP, three tools handle the migration bridge:\n\n- `list_pending_vm_migrations` (read): lists all projects still on the legacy VM mode awaiting migration.\n- `migrate_vm_to_thin` ( `{ project_id }` ) (write): starts the guided data-safe migration (dump, restore, verify).\n- `finish_vm_migration` ( `{ project_id }` ) (write): tears down the old VM container after migration is verified. Returns an error if called before verification passes.\n\n## Custom domains & TLDs\n\nEvery mapping resolves through Supbuddy's built-in DNS server on port 5353. By default the TLD is `.test` (an IETF-reserved TLD safe for local use). You can change the default in **Settings \u2192 General \u2192 Default TLD** to `local`, `dev`, or anything else; existing mappings are migrated to the new TLD on save.\n\nFor host resolution, Supbuddy *does not* use `/etc/hosts` for wildcards; it runs a DNS resolver. macOS's default resolver only queries port 53; Supbuddy installs a per-project resolver file under `/etc/resolver/<project-domain>` (e.g. `/etc/resolver/myapp.local`) pointing at `127.0.0.1:5353`. macOS picks the longest-suffix-matching file, so per-project entries route reliably without colliding with reserved namespaces like `.local` (which Bonjour/mDNS owns). You'll be prompted for sudo the first time this changes.\n\nResolver files exist only for domains the proxy actually serves \u2014 the same set that gets a Caddy site block: enabled mappings that are either standalone or under an **enabled** project. Disable or delete a project and its resolver file is removed with its routes (one sudo prompt, and only when something really changed), so its domains go back to failing as \"server not found\" instead of resolving into a TLS handshake error from a proxy that has nothing to serve. Enabling it again writes the file back; so does restarting the proxy.\n\n### Per-project TLD\n\nBy default every project's domain uses the global TLD (Settings \u2192 Default TLD, e.g. `.test`). A single project can opt into its **own** TLD \u2014 set the suffix in the project dialog, pass `tld` to the `register_project` / `update_project` MCP tools, or use the CLI: `supbuddy project add <path> --tld=portal` when registering, or `supbuddy project set <project> --tld=portal` on an existing one (`--tld=` with an empty value clears the override). That project's base domain and all its subdomains then live on the override TLD (e.g. `cueplusplus.portal`, `web.cueplusplus.portal`) while every other project stays on the global default. The override is durable across restarts and is unaffected when you change the global TLD. Prefer `.test` or a vanity label like `.portal`; avoid `.local` (it collides with macOS mDNS/Bonjour).\n\n### LAN sharing\n\nWhen LAN sharing is enabled (Settings \u2192 Network), Supbuddy binds Caddy to `0.0.0.0` instead of `127.0.0.1` and runs an mDNS responder so other machines on your local network can reach your dev servers via `<hostname>.local`. Useful for testing on your phone or another laptop without setting up Tailscale.\n\n**`.local` TLD + LAN sharing:** macOS reserves the `.local` namespace for Bonjour/mDNS (RFC 6762), and macOS's TCP stack short-circuits self-connections to your own LAN IP via the loopback path *without consulting `pf`*, so the obvious \"redirect lo0 \u2192 my LAN IP\" trick can't fix it. Supbuddy's mDNS responder works around this by **ignoring queries that originate from this machine**, letting the OS resolver fall through to `/etc/resolver/<project-domain>` (which routes to `127.0.0.1` where Caddy listens). Other LAN devices still get answered with the LAN IP and reach you normally. The net result: `.local` works correctly both on this machine and on other LAN devices, with no manual configuration. If you previously worked around this by switching to `.test`, you can switch back.\n\nIf `studio.<project>.local` (or similar) doesn't load: open the Configure tab. A red banner will tell you whether it's a DNS, port-forwarding, or mDNS-race issue, with the specific recovery action.\n\n### Tailscale\n\nIf you have Tailscale installed and a Tailscale API key configured in Settings, Supbuddy can push split-DNS routes to your tailnet so any device on your tailnet resolves your Supbuddy domains. Optional, off by default.\n\n## Monorepo support\n\nSupbuddy auto-detects these monorepo layouts when scanning a project root:\n\n- Turborepo (presence of `turbo.json`)\n- pnpm workspaces (`pnpm-workspace.yaml`)\n- npm/yarn workspaces (`workspaces` field in root `package.json`)\n- Common folder layouts: `apps/*`, `packages/*`, `services/*`, `sites/*`\n\nEach detected app gets its own subdomain. Supabase is searched for in the project root and these subdirectories: `apps/*`, `packages/*`, `services/*`, `sites/*`, `db/`, `db/*`, `database/`, `database/*`, `packages/backend`, `packages/db`, `packages/database`.\n\n### Detected app frameworks\n\nPort detection looks for the framework dependency in `package.json` and combines that with: explicit `-p`/`--port` in the dev script, `PORT=` env in the dev script, or a config file read. If none of those resolve, the framework default is used:\n\n| Framework dependency | Default port |\n| --- | --- |\n| `next` | 3000 |\n| `vite` | 5173 |\n| `@remix-run/dev`, `@remix-run/serve` | 3000 |\n| `astro` | 4321 |\n| `nuxt`, `nuxt3` | 3000 |\n| `@sveltejs/kit` | 5173 |\n| `@angular/core` | 4200 |\n| `@nestjs/core` | 3000 |\n| `express`, `fastify`, `koa`, `hono`, `@hono/node-server`, `elysia`, `polka`, `tinyhttp` | none (must be explicit in dev script) |\n\n### Server Actions allowedOrigins audit\n\nFor Next.js apps, Supbuddy reads your `next.config.{ts,mts,js,mjs,cjs}` and extracts the hosts in `experimental.serverActions.allowedOrigins`. If a mapped subdomain is missing from that list, the project's **warnings chip** flags `next.config: N origins missing`; Server Action POSTs through Supbuddy mappings would 403 otherwise. Open the **Apps** tab (the chip's \"open apps\" jump) where the affected app shows the warning with a **Fix** button.\n\nThe Fix button opens a dialog with a paste-ready snippet and an **Apply\u2026** button: click it to see a unified diff of the change Supbuddy will make to your `next.config`, then **Confirm & write** to apply it. Supbuddy handles the four common config shapes (existing `allowedOrigins` array, existing `serverActions` block without it, existing `experimental` block without `serverActions`, or no `experimental` at all). The edit is strictly additive: existing array entries are kept verbatim, including spreads (`...devHosts`), identifiers and comments, and only the missing origins are appended.\n\nIf `allowedOrigins` (or `serverActions`, or `experimental`) is set to something other than a plain array/object literal \u2014 an identifier, a function call, a ternary, `[...] as string[]` \u2014 Supbuddy **refuses to patch** rather than guess, and the dialog says so along with the exact origins to add. This is deliberate: a wrong rewrite would produce a duplicate key (TypeScript `TS1117`) that breaks your build long after the fact, so the fallback is the copyable snippet. Use it and edit by hand.\n\nAfter write, Supbuddy rescans the project so the warning disappears immediately. Restart your dev server for the change to take effect; Next.js does not hot-reload `next.config`. Over MCP the same audit is exposed as `preview_next_origins` / `apply_next_origins`; both return `ok: false` with an explanation in the refusal case, and `apply_next_origins` never writes a file it cannot verify.\n\n### Next.js cross-origin dev requests (allowedDevOrigins)\n\nSupbuddy proxies your dev server but **passes the browser's real `Origin` header through** (it no longer rewrites `Origin` to the upstream address). That's required so Server Actions and other origin checks see the actual page origin \u2014 but it means **Next.js 15.3+ and 16** dev servers, which validate cross-origin dev requests against `allowedDevOrigins` (defaulting to `localhost`), now treat a request arriving on a Supbuddy domain (or a Thin project's `127.0.0.N` loopback IP) as cross-origin and can reject it. Add your Supbuddy domain to `allowedDevOrigins` in `next.config`:\n\n```js\n// next.config.js\nmodule.exports = {\n  allowedDevOrigins: ['web.myproject.test'],\n}\n```\n\nRestart the dev server afterward; Next.js does not hot-reload `next.config`. This is separate from `experimental.serverActions.allowedOrigins` (the Server Actions CSRF list above) \u2014 15.3+/16 may need both.\n\n### Vite allowedHosts audit\n\nFor Vite apps, Supbuddy reads your `vite.config.{ts,mts,cts,js,mjs,cjs}` and extracts `server.allowedHosts`. If a mapped host isn't covered, the **warnings chip** flags `vite: N hosts blocked`; Vite's dev server otherwise rejects proxied requests for unknown hosts with `Blocked request. This host (\"\u2026\") is not allowed.` (403). A `.your-project.local` entry counts as covering every subdomain, so an existing wildcard suffix doesn't trigger a false warning.\n\nLike the Next.js audit, the affected app's **Fix** button on the **Apps** tab opens a dialog with a paste-ready snippet and an **Apply\u2026** button that previews a unified diff and writes `server.allowedHosts` into your `vite.config` (handling an existing `allowedHosts` array, an existing `server` block without it, or no `server` block at all; `allowedHosts: true` is left untouched). The edit is strictly additive \u2014 existing entries, spreads and comments are kept verbatim and only missing hosts are appended \u2014 and, exactly as with the Next.js audit, Supbuddy **refuses to patch** when `allowedHosts` or `server` is set to anything other than a plain array/object literal, pointing you at the snippet instead of risking a duplicate-key build break. After write, Supbuddy rescans so the warning clears. Restart your dev server for the change to take effect; Vite does not hot-reload `vite.config`.\n\n## MCP setup (AI agents)\n\nSupbuddy ships a built-in MCP server on `http://127.0.0.1:9877/mcp` with static Bearer-token auth. Five clients have one-click install; any other MCP-compatible tool can be configured manually with the same URL + token.\n\nOpen **Settings \u2192 MCP \u2192 Add client**, pick the client kind, and Supbuddy generates a token, edits the client's config file, and backs up the original (`<file>.supbuddy-backup` next to it). If the install can't complete it surfaces an error toast rather than stalling. The same client-management surface (**Settings \u2192 MCP \u2192 Clients**: install, edit scopes, set-primary, rotate token, revoke) drives each client from the app.\n\n### Auto-install paths\n\n| Client | Config file | Transport |\n| --- | --- | --- |\n| Claude Code | `~/.claude.json` (user) or `<project>/.mcp.json` (project) | HTTP |\n| Claude Desktop | `~/Library/Application Support/Claude/claude_desktop_config.json` | stdio shim via `npx -y @supbuddy/mcp@latest` |\n| Cursor | `~/.cursor/mcp.json` (user) or `<project>/.cursor/mcp.json` (project) | HTTP |\n| Codex CLI | `~/.codex/config.toml` (adds an `[mcp_servers.supbuddy]` block) | HTTP |\n| Windsurf | `~/.codeium/windsurf/mcp_config.json` | HTTP |\n\n### MCP tool surface\n\nThe MCP server has full read and write access:\n\n- Read tools (`list_mappings`, `list_projects`, `get_health`, `get_compose_status`, `list_pending_vm_migrations`, etc.), with env values and request bodies included.\n- `get_client_capabilities` and `request_scope_elevation` (scope discovery + user-approved grant).\n- `read_env_file`, `tail_request_logs`, `watch_audit_log`.\n- Write tools: `create_mapping`, `delete_mapping` (soft-delete), `register_project`, `update_project`, `set_supabase_config_path`, `start_proxy`, `start_supabase`, `stop_supabase`, `restart_supabase`, `switch_isolation`, `migrate_vm_to_thin`, `finish_vm_migration`, `start_compose`, `stop_compose`, `restart_compose`, `scaffold_addons`, `seed_addons`, `write_env_file`, `copy_env_var`, `write_supabase_config`.\n- Scripts tools (`list_scripts`, `start_script`, `stop_script`, `restart_script`, `bookmark_script`, `tail_script_logs`); see *Scripts MCP tools* below.\n- Extended Supabase tools: `init_supabase`, `validate_supabase_config`, `list_supabase_backups`, `restore_supabase_backup`, `cancel_supabase_start`, `force_recreate_supabase`, `restart_supabase_container`, `get_supabase_analytics`, `set_supabase_analytics`.\n- Bundle (export/import a project's full config): `export_bundle`, `import_bundle`, `validate_bundle`.\n- Supbuddy Cloud (opt-in, per-project): `cloud_sign_in`, `push_to_cloud`, `get_cloud_status`, `cloud_teardown` \u2014 push a project (with its Supabase schema + data) to a hosted cloud stack and control it. The `cloud` link (`{ projectId, stackId, pushedAt, url }`) also appears on `get_project` / `list_projects`, so any client sees which projects are in the cloud.\n- Connection / env-target workflow: `preview_connection`, `get_env_targets`, `diff_env`, `apply_env`, `write_connection`, `test_connection`, `dismiss_connection_drift`.\n- Host & network tools: bundled-runtime trust (`get_trust_status`, `install_trust`, `remove_trust`, `detect_trust_tools`, `test_trust`), Tailscale (`get_tailscale_status`, `set_tailscale_key`, `remove_tailscale_key`, `test_tailscale`), DNS (`get_dns_status`), CA (`uninstall_ca`), and port-forwarding (`get_port_forwarding_status`, `set_port_forwarding`, `reload_port_forwarding`).\n- `tail_service_logs`: streams a Compose/add-on service's container logs over SSE (like `tail_request_logs` but for container stdout/stderr).\n- `watch_supabase`: streams a project's live Supabase start/stop/restart progress over SSE: operation status, image-pull/service snapshots, and (for VM projects) raw log lines. Backs `supbuddy supabase start --follow`.\n- System doctor: `doctor` (scope `read`) runs the read-only health & drift scan and returns a report of findings (each with a `checkId`, severity, evidence, and whether it's `fixable`) \u2014 it mutates nothing. `doctor_fix` ( `{ check_ids: [...] }` ) applies the opt-in repairs for those checks; it's **system-scoped and confirm-gated** (a modal, exactly like `uninstall_ca`), so a read-scoped client can't trigger a fix and an agent can't silently run a destructive repair. Backs `supbuddy doctor` / `doctor --fix` (see *System doctor*).\n- System reset: `system_wipe` ( `{ tier: \"soft\" | \"deep\" }` , scope `system`) runs the tiered reset described under *System reset*. It is gated **twice**: it always returns a plan first \u2014 even for `auto_apply` clients \u2014 whose `side_effects` are the literal manifest the wipe will execute, and the subsequent `apply` still blocks on a user confirmation modal. `tier: \"full\"` is **rejected**: it deletes the credentials the caller is authenticating with, and its final steps (uninstalling the service, removing the app-data directory) can't run inside the daemon \u2014 run `supbuddy reset --tier=full` in a terminal instead.\n- Multiple MCP clients can connect simultaneously. The same MCP-HTTP surface backs the headless **CLI** (see *Command-line interface* below).\n\n### Scopes: discovery & self-service elevation\n\nEach MCP client holds a set of **scopes** (`read`, `log_tail`, `mappings`, `projects`, `services`, `config`, `system`, `apply`) chosen when it's added. A tool call that needs a scope the client lacks fails with `scope_denied`, whose payload now carries a `user_message` and `details.remediation` pointing at the fix.\n\n- `get_client_capabilities` ( `{ tool? }` ) returns the calling client's `granted_scopes` and `available_scopes`. Pass a `tool` name to get `{ required_scope, required_feature, can_call, reason? }` so an agent can pre-flight a call instead of probing by hitting `scope_denied`.\n- `request_scope_elevation` ( `{ scopes: [...] }` ) asks the **user** to grant the named scopes. Supbuddy shows a blocking approval dialog; on approval the scopes are added to the client. Already-granted scopes short-circuit without a prompt.\n\nYou can also review and edit any client's scopes from the GUI: **Settings \u2192 MCP \u2192 Clients** lists each client's granted scopes inline and exposes a **Scopes** button that opens the same scope editor used when adding a client.\n\n### Registering a project via MCP\n\n`register_project` takes a `root_path` (required), an optional `label`, `auto_scan` (default `true`), and an optional `isolation` (`'thin'` or `'host'`). It registers the project the same way the GUI's \"Add project\" flow does:\n\n- Derives a base domain as `<slug>.<defaultTld>` from the label (or the folder name), e.g. `staffhub.test`.\n- Records both the project `path` and `rootPath` so the project is visible to the proxy, scans, and file tools alike.\n- Scans the folder (unless `auto_scan: false`) for apps, services, scripts, and package manager.\n- Creates per-app subdomain mappings from the discovered apps (e.g. `site.staffhub.test \u2192 :3400`), derives the host service subdomains (`api.`, `studio.`, \u2026), and reloads Caddy.\n- **Defaults to `thin` isolation**: the project gets its own loopback IP so its dev servers keep canonical ports (`:3000`) with no cross-project collisions \u2014 run them with `supbuddy run -- <dev command>`. The one exception: if the project's Supabase stack is **already running on the host outside Supbuddy**, registration keeps it on `host` (switching would rewrite its `config.toml` ports and orphan the running stack). Pass `isolation: 'host'` to opt out explicitly, or `isolation: 'thin'` to skip the detection and force thin.\n\nThe response includes an `isolation_note` explaining which mode was chosen and why \u2014 agents should read it instead of assuming.\n\n### Switching isolation over MCP\n\n`switch_isolation` ( `{ project_id, target_mode: 'host' | 'thin', auto_start? }` ) moves an existing project between **host** and **thin** mode. To-thin writes the per-project port block and `project_id` into `supabase/config.toml` and (unless `auto_start: false`) starts Supabase; to-host restores the original `config.toml` and stops that project's stack. It runs in the background and returns `{ started: true }`; poll `get_project` (`isolation`) for the current mode.\n\nA project can also be patched with `update_project`: its `patch` accepts `name`, `enabled`, `domain`, and `isolation` (it intentionally does **not** accept `path`/`rootPath`). Note that patching `isolation` only flips the flag; use `switch_isolation` to actually provision/tear down the port assignment.\n\n### Legacy VM migration over MCP\n\nFor projects still on the retired Isolated (VM) mode, three tools handle the one-way migration to Thin:\n\n- `list_pending_vm_migrations` (read): lists all projects still on the legacy VM mode, with their current `vmState` and migration readiness.\n- `migrate_vm_to_thin` ( `{ project_id }` ) (write): starts the guided data-safe migration. It dumps Postgres data from the VM, starts a fresh Thin stack, restores the dump, and row-count-verifies before signalling completion. Returns `{ started: true }`; poll `get_project` (`migrationState`) for progress.\n- `finish_vm_migration` ( `{ project_id }` ) (write): tears down the old VM container after verification passes. Errors if called before the verify step completes.\n\n### Repointing a project's Supabase config\n\n`set_supabase_config_path` ( `{ project_id, supabase_path }` ) switches which `supabase/config.toml` a project uses, for monorepos that carry more than one (e.g. a repo-root config and an app-level one). `supabase_path` is the project-relative directory **containing** the `supabase/` folder (`\".\"` for the repo root, e.g. `\"apps/getnightowls\"`). It persists the path, re-derives `supabaseProjectId` from the new config, and re-scans services. The previous stack's Docker volume is **left intact** (not deleted), so the switch is reversible; the response reports it under `orphaned_previous_stack`.\n\n### Moving a secret between env files\n\n`copy_env_var` ( `{ source_path, source_key, target_path, target_key? }` ) relocates a single variable from one env file to another (e.g. a value put in an app's `.env.local` that the stack actually injects from the repo-root `.env.local`). The value is read and written entirely inside the worker (it **never crosses the MCP boundary** and never appears in the audit log), so an agent can move a secret without it being printed. `target_key` defaults to `source_key`.\n\n### Plan / apply for destructive tools\n\nTools that delete or mutate state (`delete_mapping`, `delete_project`, `write_env_file`, etc.) return a *plan* with a preview. The MCP client (or you, in the Activity panel) explicitly calls `apply` with the `plan_id` to execute. Plans expire after 5 minutes if not applied. Soft-deletes go to the Trash and are recoverable for 7 days.\n\n## Add-on Compose services\n\nA project can declare **extra** Docker Compose services that Supbuddy discovers, merges, runs, health-checks, and tails alongside the managed stack: a Redis cache, a worker queue, a search engine, etc. Add-on services run on the host's shared Docker daemon in both `host` and `thin` isolation, with no extra setup needed.\n\n### Declaration files & merge precedence\n\nSupbuddy looks for up to three Compose fragments in the project and merges them, later wins:\n\n1. `docker-compose.yml`: your base Compose file.\n2. `docker-compose.override.yml`: your own override, honored if present (standard Compose convention).\n3. `supbuddy.addons.yml`: Supbuddy-owned add-on fragment.\n\nAll present fragments are passed explicitly, e.g. `docker compose -f docker-compose.yml -f docker-compose.override.yml -f supbuddy.addons.yml --project-name <pinned> \u2026`. The project name is pinned so the same set of containers is addressed every time. Add-on services join the Compose project's default network automatically; no extra network setup is needed for them to reach (or be reached by) the rest of the stack.\n\n### `supbuddy.addons.yml` format\n\nA valid Compose fragment (a standard `services:` map) plus an optional Supbuddy-only `x-supbuddy:` extension block. A plain `docker compose up` ignores `x-supbuddy:`, so the file stays usable without Supbuddy. Today `x-supbuddy` supports a one-shot **seed** step:\n\n```yaml\nservices:\n  redis:\n    image: redis:7-alpine\n    ports: [\"6379:6379\"]\nx-supbuddy:\n  seed:\n    service: redis\n    command: [\"redis-cli\", \"ping\"]   # explicit argv, runs once after services are healthy\n    runOnce: true\n```\n\nThe seed step runs **once** after the add-on services are up and healthy. It's idempotent, keyed by a signature of the seed spec, so it only re-runs if the spec changes (or you force it). It fires automatically on project start, and on demand via the `seed_addons` MCP tool.\n\n### MCP tools\n\n- `scaffold_addons` ( `{ project_id }` ): scope `config`. Creates a starter `supbuddy.addons.yml` if the project doesn't have one. Never clobbers an existing file.\n- `seed_addons` ( `{ project_id, force? }` ): scope `services`. Runs the declared `x-supbuddy.seed` step. Idempotent unless `force: true`.\n- `tail_service_logs` ( `{ project_id, service }` ): scope `log_tail`. Streams a Compose/add-on service's container logs over SSE (like `tail_request_logs`, but for container stdout/stderr).\n- `watch_supabase` ( `{ project_id }` ): scope `log_tail`. Streams a project's live Supabase start/stop/restart progress over SSE: `operation` (status + message), `progress` (image-pull/service snapshots), and `log` (raw lines, VM projects). The stream ends on a terminal status. Backs `supbuddy supabase start --follow`.\n\n### Scripts MCP tools\n\nScripts detected in a project (e.g. `dev`, `build`, `test`) are controllable over MCP:\n\n- `list_scripts` ( `{ project_id }` ): scope `read`. Returns all detected scripts with their current status and bookmark state.\n- `start_script` ( `{ project_id, script }` ): scope `services`. Starts the named script process.\n- `stop_script` ( `{ project_id, script }` ): scope `services`. Stops the named script process.\n- `restart_script` ( `{ project_id, script }` ): scope `services`. Stops then starts the named script process.\n- `bookmark_script` ( `{ project_id, script, bookmarked }` ): scope `services`. Pins (`bookmarked: true`) or unpins a script in the Quick Access group.\n- `tail_script_logs` ( `{ project_id, script }` ): scope `log_tail`. Streams the named script's stdout/stderr over SSE.\n\n### `get_compose_status` shape\n\n`get_compose_status` ( `{ project_id }` ) returns live per-service status, not just whether Compose is installed:\n\n```json\n{\n  \"project_id\": \"\u2026\",\n  \"compose_installed\": true,\n  \"running\": true,\n  \"services\": [\n    { \"name\": \"redis\", \"status\": \"running\", \"health\": \"healthy\", \"ports\": [\"6379:6379\"], \"image\": \"redis:7-alpine\", \"container_id\": \"\u2026\", \"source\": \"addons\" }\n  ]\n}\n```\n\nEach service's `source` is one of `base` | `override` | `addons`, telling you which fragment declared it.\n\n## Per-project AI context sync\n\nEach project has a **Context sync: AI tools** panel, accessible via the **AI Tools** tab in the project card, that writes a project-scoped briefing to disk so AI agents working in that repo see your live mappings, services, and isolation state without having to ask. Files written:\n\n- `.supbuddy/`: `README.md`, `mappings.md`, `services.md`, `project.md`, `mcp.md`, `do-not.md`, `docs.md`. The full live snapshot, regenerated on each sync.\n- `AGENTS.md` and `CLAUDE.md`: a small managed block prepended (or updated in place) telling the agent which project this is and pointing it at `.supbuddy/`.\n- Editor skill files when detected: `.cursor/rules/supbuddy.mdc`, `.claude/skills/supbuddy/SKILL.md`, `.codeium/windsurf/rules/supbuddy.md`, `.continue/rules/supbuddy.md`, `.github/copilot-instructions.md`, `.idea/supbuddy.md`.\n- `.gitignore` managed block, ignoring: `.supbuddy/meta.json` (volatile sync state), `*.supbuddy-backup-*` (rollback snapshots), and the per-editor skill files that are written **locally** (see scope below). The rest of `.supbuddy/` is intended to be committed; `AGENTS.md`, `CLAUDE.md`, and `.github/copilot-instructions.md` are also kept committable since you may have hand-written content there alongside Supbuddy's managed block.\n\n### Global vs. local scope\n\nThe per-editor skill files are generic Supbuddy-owned pointers (\"this is a Supbuddy project: read `.supbuddy/`, prefer the MCP tools\"). For editors that expose a **Supbuddy-owned global location**, Supbuddy writes that pointer **once, machine-wide** instead of copying it into every project, so it isn't duplicated across all your repos. Project-specific data always stays local in `.supbuddy/`.\n\n- **Claude Code** \u2192 one global skill at `~/.claude/skills/supbuddy/SKILL.md`. **Cursor** \u2192 `~/.cursor/skills/supbuddy/SKILL.md`. The global skill self-scopes: it only acts when the working directory has a `.supbuddy/` folder, and resolves the active project from that folder's `meta.json`.\n- All other targets (`windsurf`, `continue`, the `AGENTS.md`/`CLAUDE.md`/Copilot managed blocks, JetBrains) stay **local**: their \"global\" files are shared user files, so Supbuddy won't overwrite them.\n- Each target has a **scope** setting: `auto` (default: global for the Claude/Cursor skills, local for everything else), `global`, `local` (force per-project, useful if you commit the file for teammates), or `off`. A machine-global file is reference-counted across projects and removed automatically once no project uses it (on disabling sync, deleting a project, or switching that target back to local). Note: uninstalling Supbuddy (e.g. dragging it to the Trash on macOS) does **not** auto-remove these global files; delete them manually from `~/.claude/skills/supbuddy/` and `~/.cursor/skills/supbuddy/` if needed.\n- The always-loaded `CLAUDE.md`/`AGENTS.md` managed block stays local as a safety net so agents stay aware even if the on-demand global skill doesn't auto-activate.\n\nSync modes per project:\n\n- **Auto**: Supbuddy regenerates the files whenever mappings, services, or project state change.\n- **Manual only**: files are only written when you click **Sync now** (or use the tray's *Sync AI context for all projects*).\n- **Off**: nothing is written.\n\nThe collapsed header shows an at-a-glance status pill: mode (`auto` / `manual` / `off`), a colored dot for the last sync result, and a relative timestamp. Disabled targets (e.g. an editor whose folder isn't present) appear greyed out in the **Detected targets** list inside the panel.\n\n## Supbuddy Cloud\n\nPush a project \u2014 its Supabase schema **and data** \u2014 to a hosted cloud dev-stack (its own full self-hosted Supabase \u2014 Postgres, Auth, REST, Storage, Realtime, Studio behind a gateway \u2014 as an isolated graph of machines on a per-tenant private network) and control it from the app, the CLI, or MCP. **Opt-in and per-project:** nothing cloud-related appears in a project until you've signed in.\n\n- **Get started** \u2014 the top bar shows a **Get started with Supbuddy Cloud** strip; sign in (email/password) there. Once signed in it becomes **Open cloud** (opens [cloud.supbuddy.app](https://cloud.supbuddy.app) in your browser). Sign-in state + the Claude connection also live under **Settings \u2192 Cloud**.\n- **Push a project** \u2014 after signing in, each project's \u22EF menu gains **Push to cloud\u2026**. The push ships the project's stack descriptor + a `pg_dump` of its Supabase data (fail-closed: uploaded to a private bucket via a single-use key, sha-verified, restored *inside* the stack's private network, then deleted). Your **local project stays intact** \u2014 a **\u2601** badge appears on its row; click it (or \u22EF \u2192 **Open in cloud**) to open the stack in the web app.\n- **CLI / MCP** \u2014 the same flow headless: `supbuddy cloud login|push|status|teardown` (password via arg or `SUPBUDDY_CLOUD_PASSWORD`), or the `push_to_cloud` / `get_cloud_status` / `cloud_teardown` / `cloud_sign_in` MCP tools. `project ls` marks pushed projects with \u2601, and `get_project` / `list_projects` carry the `cloud` link. `cloud_teardown` (and the \u22EF teardown) destroy the remote stack and unlink it locally \u2014 routed through the same plan/apply gate as other destructive tools.\n- **Service breadth** \u2014 a self-hosted push provisions the **full** Supabase stack by default. Pass `push_to_cloud`'s `supabase_services: \"minimal\"` (MCP) to opt down to a lean db/auth/REST stack instead.\n- **Idle auto-stop** \u2014 a running cloud stack that reports no activity for ~30 minutes is automatically **stopped** to save cost (its data + config persist; start it again from the web app). A background reaper also reconciles any stack whose machines went missing.\n- **Web console** \u2014 [cloud.supbuddy.app](https://cloud.supbuddy.app) lists your org's stacks; open one for its per-service health, live status, and **start / stop / restart / tear down** controls, plus a **Recent activity** feed of control-plane events. **Push to cloud** in the console provisions a stack from a GitHub `owner/repo` (self-hosted or bring-your-own Supabase; full or minimal service set) \u2014 the code-only path; pushing a local project *with its data* still goes through the desktop app / CLI.\n\n## Command-line interface (CLI)\n\nEverything the desktop app can do is also driveable headlessly from a terminal, with no GUI window. The CLI runs a **daemon** (the same worker process the GUI uses: Caddy proxy, DNS, Supabase/Compose lifecycle, MCP-HTTP) and a set of commands that attach to it over the local MCP-HTTP port. This is for SSH sessions, CI, `tmux`/server boxes, and scripting.\n\nThe binary is `supbuddy`, with a short alias `sup`. Run `supbuddy help` for the full usage list.\n\nYou can install the CLI on its own, without the desktop app:\n\n```bash\nnpx supbuddy@latest        # asks to install the CLI globally (supbuddy + sup)\n```\n\nThat command does nothing on its own except offer to put `supbuddy` and `sup` on your PATH. The CLI runs independently of the desktop app, so you can add the app later (or never). On a Mac the app installs the same two commands for you.\n\n### The daemon\n\n```bash\nsupbuddy daemon --detach        # start the worker in the background\nsupbuddy status                 # daemon + proxy health, plus which worker the daemon is running\nsupbuddy stop                   # graceful shutdown\n```\n\n`--detach` backgrounds the daemon and prints its pid + ports. Foreground `supbuddy daemon` runs it attached (Ctrl-C shuts it down cleanly). On start the daemon writes a discovery file, `daemon.json` (mode `0600`), into the shared state dir holding its pid, the Socket.IO port, the MCP-HTTP port, and a control token; every other command reads it to find and authenticate to the daemon, so you never pass ports or tokens by hand. Only one daemon may run per state dir; a second `daemon` start is refused.\n\nThe CLI and the desktop app **share one state dir** (`~/Library/Application Support/Supbuddy/`), so they manage the same projects, mappings, and settings. They must not run two workers against it at once: if you launch the desktop app while a CLI daemon is running, the app detects it and offers to **stop the daemon and continue** or **quit**. It never forks a competing worker (which would corrupt `state.json`).\n\n### Run on login (service)\n\n```bash\nsupbuddy service install        # start-on-login (launchd on macOS, systemd-user on Linux)\nsupbuddy service status\nsupbuddy service uninstall\n```\n\n### Commands\n\nAll app surfaces have a command. Names follow `supbuddy <module> <action> [args] [--flags]`. The main groups:\n\n| Group | Examples |\n| --- | --- |\n| Dev launcher | `run [--print] -- <dev command>` \u2014 on a Thin project, binds the dev server to the project's loopback IP (from `.supbuddy/meta.json`) so it keeps its canonical port (e.g. `supbuddy run -- next dev` stays on `:3000`) |\n| Health / proxy | `status`, `doctor [--fix]` (health & drift scan \u2014 see *System doctor*), `reset [--tier=soft\\|deep\\|full]` (tiered system reset \u2014 see *System reset*), `proxy status\\|start\\|stop\\|restart` |\n| Mappings | `map ls\\|add\\|get\\|set\\|enable\\|disable\\|rm\\|restore` |\n| Projects | `project ls\\|add\\|get\\|scan\\|set\\|enable\\|disable\\|rm\\|restore\\|env\\|refresh-context` |\n| Supabase | `supabase start\\|stop\\|restart\\|status <proj>` (add `--follow` to stream live progress), `supabase config apply <proj> <file>` |\n| Cloud | `cloud login <email> [<pw>]` (or `SUPBUDDY_CLOUD_PASSWORD`), `cloud push <proj> [--repo=owner/repo] [--force]`, `cloud status [<proj>]`, `cloud teardown <proj>` \u2014 push a project (with its Supabase data) to a hosted cloud stack; `project ls` marks pushed projects with \u2601 |\n| Compose | `compose up\\|down\\|restart\\|status\\|logs <proj> [svcs]` |\n| Scripts | `scripts ls\\|start\\|stop\\|restart\\|logs\\|bookmark <proj> [script]` |\n| Isolation | `isolation switch <proj> <host\\|thin>`, `isolation pending-migrations`, `migrate start\\|finish <uuid>` |\n| Certificates | `ca status\\|install\\|uninstall` |\n| Env files | `env copy <src> <key> <target>`, `env write <path> <K=V>\u2026` |\n| Settings | `settings get`, `settings set --json <patch>` |\n| MCP | `mcp add [<agent>]` (register Supbuddy into a coding agent: interactive, or `--write`/`--print`/`--prompt`), `mcp ls`, `mcp revoke <id>`, `mcp approvals apply\\|cancel <id>` |\n| Host / network | `connect`, `trust`, `tailscale`, `dns`, `pf` (port-forwarding) |\n| Logs | `logs requests [-f]`, `logs audit [-f]`, `logs get <id>` |\n| Account | `account`, `caps`, `addons scaffold\\|seed <proj>` |\n| Dashboard | `tui` (alias `dash`) |\n\nGlobal flags: `--json` (machine-readable output), `--yes` (skip confirmations), `--quiet`, `--url`/`--token` (attach to a specific/remote daemon instead of auto-discovery), `--state-dir` (override the shared dir), `--timeout`, and `-f`/`--follow` for streaming log commands and live `supabase start|stop|restart` progress.\n\nDestructive operations go through the same **plan \u2192 apply** gate as MCP (see *Plan / apply for destructive tools*); the CLI's control token is granted auto-apply, so they execute directly.\n\n### Live dashboard (TUI)\n\n```bash\nsupbuddy tui                    # or: sup dash\n```\n\n`supbuddy tui` opens a full-screen terminal dashboard that attaches to the running daemon and shows live connection/proxy status, the project list (with each project's isolation, Supabase, and Compose state), the mapping count, and a tail of recent requests. Press `r` to refresh, `q` to quit. It needs a running daemon (`supbuddy daemon --detach`); if none is found it tells you so.\n\n### System doctor\n\n```bash\nsupbuddy doctor                              # read-only scan; prints findings by severity\nsupbuddy doctor --fix                        # scan, show the repair manifest, confirm (y/N), then apply\nsupbuddy doctor --fix --only=ca-not-trusted  # restrict repairs to specific check ids (comma-separated)\nsupbuddy doctor --fix --yes                  # skip the interactive confirm (scripting / CI)\n```\n\n`supbuddy doctor` runs a **read-only** health and drift scan and prints its findings grouped by severity \u2014 **critical**, **warning**, **info** \u2014 each with a title, a one-line detail, and concrete evidence (paths, container names, certificate fingerprints). The scan mutates nothing and exits non-zero when any finding is **critical**, so you can gate a script or CI on it.\n\n`--fix` re-scans, prints a **manifest** \u2014 one line per fixable finding, taken from the scan you just saw \u2014 and, unless you pass `--yes`, asks `Apply these fixes? [y/N]` (default **No**) before touching anything. (The desktop app's doctor panel shows the finer-grained repair *actions* themselves; the CLI lists the findings those actions belong to.) `--only=<comma,ids>` restricts the repair to specific check ids; `--yes` skips the prompt for non-interactive use. This is the **confirm-before-harm** contract: the scan is read-only, and every repair is opt-in and gated. Fixes that need elevated access prompt for your password when they run.\n\nA repair that ends up doing nothing is reported as such, never as success: if a requested check's finding is already gone, is advisory, can't be re-checked, or names an unknown id, it's listed under **NOT APPLIED** and the command exits non-zero.\n\nThe doctor ships **18 checks**. Rows marked **Advisory** have **no auto-fix at all**: `--fix` will never touch them, and the finding's detail tells you what to do by hand. Checks marked *macOS* return nothing on other platforms.\n\n| Check id | Severity | What it flags | Auto-fix |\n| --- | --- | --- | --- |\n| `state-corrupt` | critical | `state.json` can't be parsed (or isn't an object), so the daemon boots with **empty** state \u2014 no projects, mappings, settings or MCP clients | Copies the file aside as `state.json.corrupt-<timestamp>` so you can hand-recover it. Nothing is deleted or rewritten |\n| `caddy-stuck` | critical | Caddy is alive but its admin API is wedged, so config reloads can't land | Restarts Caddy (stop \u2192 start) |\n| `caddy-ipv4-unreachable` | critical | Caddy's loaded config declares an HTTPS listener but `127.0.0.1:<port>` **refuses** connections \u2014 every IPv4 client is cut off (browsers, curl, and the pf 443\u21928443 redirect) while the process is up and its admin API answers | **Advisory \u2014 no auto-fix.** Run `supbuddy proxy restart` to rebind. Only a connection **refused** counts: a *timeout* on a pf redirect target is normal (the reply is reverse-NAT'd back to :443 and never matches your socket), so it is never reported as a fault |\n| `ca-not-trusted` | warning | The local CA exists but the **current** root isn't trusted in the System keychain (the padlock stays broken). Detection is by fingerprint, so a stale same-name root from an earlier CA no longer counts as installed | Installs it into the System keychain (`security add-trusted-cert`; asks for your password). Where trust **cannot be read at all** (Windows) this drops to **advisory, info, no auto-fix** \u2014 it reports what to import by hand rather than offering a repair that can't run |\n| `pf-not-enforcing` | warning | Port forwarding is configured but 443 isn't redirecting | **Advisory \u2014 no auto-fix.** Run `supbuddy proxy restart`: only that path re-runs the privileged pf setup, so the doctor won't claim a success it can't deliver |\n| `duplicate-caddy-ca` | warning | *macOS.* Stale same-name `Caddy Local Authority` roots with a different key \u2014 the cause of Firefox-family `SEC_ERROR_BAD_SIGNATURE` | Deletes the stale roots **and installs the current one** in a single elevated batch (asks for your password). Delete-only could leave a machine with no trusted Caddy root at all when the current one wasn't in the keychain yet |\n| `orphan-caddy-container` | warning | A leftover pre-binary-era `supbuddy-caddy` Docker container | Removes the container, its `supbuddy-net` network and its data/config volumes (the `caddy:latest` image is kept) |\n| `orphan-lo0-aliases` | warning | *macOS.* `127.0.0.N` aliases on `lo0` owned by no Thin project \u2014 deleting a Thin project never tore its alias down | Removes only those aliases (asks for your password); `127.0.0.1` and any non-Supbuddy alias are left alone |\n| `orphan-dind` | warning | Docker-in-Docker containers from the retired Isolated (VM) mode belonging to no registered project \u2014 each one confirmed to actually be a DinD first | Force-removes those containers and their `<name>-docker` data volumes. **This is project data**: if you deleted a project and chose to keep its data, this is that data. The Caddy container and non-Supbuddy containers are never touched |\n| `orphan-supabase-volumes` | warning | Docker volumes of Supbuddy-managed (`sb-`-prefixed) Supabase stacks owned by no registered project | Removes those volumes. **This is database data.** Host-mode stacks, stacks you started yourself, and projects still in the MCP trash (restorable for 7 days) are never touched |\n| `orphan-launchagents` | warning | *macOS.* Legacy CA-trust LaunchAgents from older builds that re-export `SSL_CERT_FILE` / `REQUESTS_CA_BUNDLE` / `NODE_EXTRA_CA_CERTS` at every login and break **public** TLS | Boots each agent out and removes it, leaving a `.supbuddy-backup` copy alongside. Root-owned agents under `/Library` may resist; the fix reports those as a failure instead of claiming success |\n| `orphan-electron-token-files` | warning | Leftover `~/.config/Supbuddy/mcp/<clientId>.bin` token files from the retired Electron app, for clients that no longer exist | Deletes those files (no elevation). They can't be decrypted any more anyway; clients that are merely revoked keep their record and are left alone |\n| `orphan-mcp-secrets` | warning | `secrets/mcp-<clientId>.secret` files whose token can no longer authenticate (client revoked, or no record at all) | Deletes those files (no elevation) \u2014 it can't log a working agent out. Secrets for current clients, and the non-MCP secrets stored alongside them (license, cloud session, Tailscale key), are left untouched |\n| `unmanaged-supabase` | info | A Supabase stack on the host daemon that maps to no registered project (e.g. a plain `supabase start`) | **Advisory \u2014 no auto-fix.** Supbuddy never tears down a stack you started yourself; run `supabase stop` in its project if you don't need it |\n| `stale-resolver-files` | info | *macOS.* Supbuddy-marked `/etc/resolver/<suffix>` files for suffixes no **enabled** project or mapping claims any more (deleted projects, a disabled one, an older per-project TLD) | Removes only those files (asks for your password); suffixes still in use are left alone. Reversible \u2014 enabling the project or restarting the proxy writes the file back |\n| `pf-conf-backups` | info | *macOS.* `/etc/pf.conf.backup.<timestamp>` copies piled up in `/etc` by older versions (which wrote a new one on every port-forwarding disable) | Removes the redundant copies, **keeping the newest one** and the stable `/etc/pf.conf.supbuddy-backup` (asks for your password) |\n| `stale-mcp-config-tokens` | info | An agent config (`~/.claude.json`, Claude Desktop, Cursor, Codex, Windsurf, or a registered project's `.mcp.json` / `.cursor/mcp.json`) holds a `mcpServers.supbuddy` token Supbuddy no longer accepts \u2014 the 401 \"Token not recognized\" state | **Advisory \u2014 no auto-fix.** Supbuddy won't rewrite config files you own and edit. Delete the `mcpServers.supbuddy` entry from the file named in the finding, or run `supbuddy mcp add <agent>` to mint a fresh token. The finding names the file, never the token |\n| `stale-browser-nss-roots` | info | *macOS.* A Firefox / Zen / LibreWolf / Waterfox profile whose own NSS store (`cert9.db`) holds a `Caddy Local Authority` root Supbuddy can't reach | **Advisory \u2014 no auto-fix.** Nothing is wrong unless that browser shows certificate errors. Fix it there: Settings \u2192 Privacy & Security \u2192 Certificates \u2192 View Certificates\u2026 \u2192 Authorities, delete every `Caddy Local Authority` entry, then re-import Supbuddy's CA |\n\nThe same scan and repairs are available over MCP as the `doctor` and `doctor_fix` tools (see *MCP tool surface*), and in the app under **Settings \u2192 General \u2192 System health \u2192 Scan** \u2014 the panel scans on open, groups the findings by severity, and gates every repair behind the same manifest + confirm step (see *Settings reference \u2192 General*). The panel has no reset button: a wipe stays a CLI operation.\n\n### System reset\n\n```bash\nsupbuddy reset                        # soft (the default): app state + caches\nsupbuddy reset --tier=deep            # + services, Caddy containers, system integrations, CA trust\nsupbuddy reset --tier=full            # + project data, repo artifacts, secrets, service, app data\nsupbuddy reset --tier=deep --yes      # skip the y/N confirm (scripting / CI)\nsupbuddy reset --tier=full --yes --i-understand   # the ONLY scripted path for a full reset\n```\n\n`supbuddy reset` removes Supbuddy's footprint from your machine in **tiers**, and each tier is a superset of the one before it:\n\n| Tier | What it removes |\n| --- | --- |\n| `soft` (default) | App state \u2014 projects, mappings, settings, MCP clients, project-context sync and user-skill records \u2014 plus the Docker image cache (`<app-data>/image-cache`, images are re-pulled on demand) and the buffered request log. It touches **no** Docker container or volume, **nothing** under `/etc`, and **no** file in your repos, so it never asks for your password |\n| `deep` | \u2026plus: stops every service; removes the leftover Caddy container/network/volumes, the `/etc/hosts` entries, the `/etc/resolver` files, the pf `:80`/`:443` redirect, the `127.0.0.N` loopback aliases, the bundled-runtime CA trust and the `Caddy Local Authority` roots in your keychain, and the token files of already-revoked MCP clients. **Your data is preserved**: no Supabase volume, no DinD container, no repo file and no *live* MCP token is touched \u2014 `deep` unwinds what Supbuddy installed on the machine, it is not a data wipe |\n| `full` | \u2026plus **your project data, backed up first**: every Supbuddy-**managed** (`sb-`-prefixed) Supabase stack's data volumes and every DinD container with its data volume, the `.supbuddy/` directories, managed blocks and `.env.supbuddy` files in your registered repos, and **every** credential (license, live MCP tokens, cloud session, Tailscale key) \u2014 then it uninstalls the start-on-login service and empties the app-data directory. A **host-mode** project's Supabase stack is only *stopped*: those containers and volumes are yours, and they are kept |\n\nMost steps enumerate what's actually on your machine first, so anything that isn't there drops out of the manifest instead of being advertised and skipped. `soft` needs no elevated access at all. `deep` batches the pf redirect, the resolver configuration and the loopback aliases into **one** password prompt; the legacy `/etc/hosts` block and the keychain CA removal ask separately, so expect up to three. `full` may prompt more than once as it tears projects down.\n\n**Reset is a CLI operation, on purpose \u2014 there is no reset button in the app.** The gates that make a wipe safe don't survive the trip into a GUI: a typed `RESET`, a refusal on non-interactive input, and a daemon confirmation the app itself would be answering. On top of that, `--tier=full` refuses outright while the desktop app is running (its watchdog respawns the daemon ~20s after it stops), so a button for it would be a trap. The app's **Settings \u2192 General \u2192 System health** panel points here instead.\n\n**Backup before harm.** Anything you can't regenerate \u2014 `state.json`, every managed Supabase database that is running (`pg_dump`, custom format, with a `.sha256` alongside), every managed data volume (`tar.gz`, verified with `gzip -t`) \u2014 is written to `<app-data>/backups/reset-<timestamp>/` **before** a single destructive step runs, and if any backup fails the whole reset **aborts before destroying anything**. The directory is printed prominently before you confirm, and again when the reset finishes; `manifest.json` inside it records exactly what was planned and what ran. On top of that coarse guarantee, each volume is gated individually: **no archive, no removal** \u2014 a volume with no non-empty `.tar.gz` next to it is left alone and the run records why.\n\n**A backup that can't be written stops the reset \u2014 safely.** Archiving a volume is given ten minutes; a genuinely large one (tens of GB of Postgres data plus a DinD image cache) can exceed that, and when it does the reset **aborts with nothing destroyed**. Stop the stack and prune what you don't need (`docker system prune`, drop old branches/schemas), or archive that volume yourself, then run the reset again. The same applies to any other backup failure: a full disk, an unreadable volume, a Docker daemon that stops answering.\n\n**The backups survive a full reset.** They live inside the app-data directory, so the last step of `--tier=full` empties that directory *content-wise and skips `backups/`* rather than deleting it wholesale. Move that directory somewhere safe afterwards \u2014 it's the only copy.\n\n**Confirmation.** Every tier prints the **manifest** first \u2014 the literal list of actions that will run, derived from the same actions the engine executes. `soft` and `deep` then ask `Apply this \"<tier>\" reset? [y/N]` (default **No**); `--yes` skips that prompt. `--tier=full` requires you to **type the word `RESET`** \u2014 `--yes` alone does **not** bypass it. The one scripted path for a full reset is `--yes --i-understand`, both flags together. Every prompt refuses on a non-interactive (piped) stdin rather than proceeding.\n\n**The daemon confirms too.** `soft` and `deep` run inside the daemon, which asks for its own approval before it starts \u2014 the same gate as `doctor --fix` and `ca uninstall`. With the Supbuddy app open you get a native **Allow / Deny** dialog. A daemon with neither a dialog nor a terminal \u2014 the start-on-login service, or an app-spawned daemon while the app is closed \u2014 has nobody to ask and **denies**; run a foreground `supbuddy daemon` in one terminal and the reset from a second, and it will prompt there. Don't reach for `supbuddy daemon --yes` to get past it: that auto-approves *every* confirmation for that daemon's whole lifetime.\n\n**Quit the app before a full reset.** The desktop app supervises the daemon and restarts it about 20 seconds after it stops, which would put a live daemon back into the directory the last step clears. `--tier=full` refuses up front while the app is running \u2014 before it asks you to type `RESET`, and before it changes anything. Quit the app (menu bar icon \u2192 Quit) and run it again; the quit dialog's default **Leave running** is fine, since the reset stops the daemon itself. The check looks for the *app* process only, so nothing else has to change. `--tier=full` also runs with no daemon at all, so if you quit with **Stop service** you can go straight ahead.\n\n**The order of a full reset**, once you've confirmed: the start-on-login service is uninstalled, the daemon is stopped and waited for (the reset refuses to run against a live daemon, which would rewrite `state.json` underneath it), the backup and teardown steps above run, and only then is the app-data directory emptied \u2014 keeping `backups/`. If the reset aborted, or if a daemon came back while it was running, the app-data directory is left in place and the CLI tells you so rather than clearing it under a live process.\n\n`soft` and `deep` are also available over MCP as the plan-gated `system_wipe` tool (see *MCP tool surface*). `--tier=full` is **CLI-only**: it deletes the credentials any agent would be calling with, and a daemon cannot uninstall the service it runs under or delete the directory it runs from.\n\n**What a full reset does not remove.** It only ever touches paths of **registered** projects \u2014 there is no disk scan for stray `.supbuddy` directories \u2014 and it won't delete or rewrite files whose ownership is ambiguous. So after `--tier=full` these are still on disk, and you can remove them by hand:\n\n- Per-editor rule files Supbuddy wrote in your repos: `.cursor/rules/supbuddy.mdc`, `.claude/skills/supbuddy/SKILL.md`, `.codeium/windsurf/rules/supbuddy.md`, `.continue/rules/supbuddy.md`, `.idea/supbuddy.md`. Shared files (`CLAUDE.md`, `AGENTS.md`, `.gitignore`, \u2026) keep their content and only lose Supbuddy's sentinel-delimited block.\n- Values `apply_env` merged into your **own** `.env*` files. The fully-owned `.env.supbuddy` files *are* deleted.\n- The bare `.env.supbuddy` line in `.gitignore` \u2014 it sits outside the managed block.\n- `vite.config.*` `allowedHosts` and `next.config.*` dev-origin patches.\n- `supabase/config.toml` port / `project_id` patches, when restoring the original file failed during the Thin teardown.\n- MCP client config entries written by `mcp add` / `install_mcp_config` (`~/.claude.json`, Claude Desktop, Cursor, Codex, Windsurf, a project `.mcp.json` / `.cursor/mcp.json`). The token they hold is dead the moment the secrets are deleted; `supbuddy doctor`'s `stale-mcp-config-tokens` check will name each file.\n- The `caddy:latest` Docker image (shared and re-pullable) and anything a host-mode project owns.\n- The Supbuddy app itself \u2014 drag `Supbuddy.app` to the Trash \u2014 and the backups directory, which is the whole point of keeping it.\n\n## Settings reference\n\nOpen Settings via the gear icon top-right or by clicking the tray icon \u2192 Open Dashboard \u2192 gear. Five tabs.\n\n### General\n\n- **Theme**: dark or light.\n- **Auto-start at login**: registers Supbuddy as a macOS login item. Default: on.\n- **Default TLD**: applied to new auto-generated mappings. Existing mappings are renamed to the new TLD on save. Default: `test`.\n- **Default isolation**: `host` or `thin` for newly added projects. Default: `thin` (per-project loopback IP; apps keep canonical ports like `:3000`). MCP registration additionally keeps a project on `host` when its Supabase stack is already running on the host outside Supbuddy.\n- **Auto-subdomain mapping**: when on, services and apps detected during a project scan get mappings created automatically. Default: on.\n- **Bundled-runtime trust**: installs Supbuddy's local root CA into a place that apps with bundled JavaScript runtimes (Claude Code, Cursor, Windsurf, Continue, Codex CLI, OpenCode, \u2026) actually read. These apps don't consult the system Keychain (they ship their own Mozilla bundle), so without this they fail OAuth/MCP/HTTPS calls to `*.test` with `unable to get local issuer certificate`. Default: prompted on first launch when one of those tools is detected.\n  - **macOS**: writes `~/Library/LaunchAgents/com.cueplusplus.supbuddy.bundled-runtime-ca-trust.plist` and calls `launchctl setenv NODE_EXTRA_CA_CERTS / SSL_CERT_FILE / REQUESTS_CA_BUNDLE` so GUI-launched apps inherit the right vars at process-start time.\n  - **Linux**: writes `~/.config/environment.d/supbuddy-ca.conf` (read by systemd-aware user sessions on GNOME/KDE/Sway/etc.).\n  - **Windows**: per-user `setx NODE_EXTRA_CA_CERTS / SSL_CERT_FILE / REQUESTS_CA_BUNDLE` to `HKCU\\Environment`.\n  - All three env vars point at `~/Library/Application Support/Supbuddy/ca-bundle/current.crt` (or the platform-equivalent), a *cumulative* concatenated PEM Supbuddy maintains. When Caddy rotates its root (yearly today, sometimes more), Supbuddy appends the new root automatically; long-running TLS contexts holding the old root keep working until the process restarts.\n  - **Test trust**: runs an in-process HTTPS request against the first available `*.test` mapping with the same env vars set, to verify end-to-end without relaunching anything. It probes the **real access path** (port 443 when port forwarding is on, otherwise the high port), matching what real clients hit, so it doesn't false-negative against a port nothing is forwarding.\n  - **Conflict refusal**: if `NODE_EXTRA_CA_CERTS` is already set to something else (corporate proxy, Zscaler), Supbuddy refuses to overwrite and surfaces the conflicting path. You can override with the explicit prompt that pops up on Install.\n  - **Quit and relaunch your AI tools** after install: the env var only takes effect for *newly-launched* processes.\n- **System health** (**Scan**): opens the **System Doctor** panel \u2014 the same read-only, 17-check health & drift scan as `supbuddy doctor` (see *System doctor*), in the app. Opening the panel only scans; it changes nothing.\n  - Findings are grouped **critical \u2192 warning \u2192 info**, each with its title, one-line detail, concrete evidence (paths, container names, fingerprints), check id and category. **Rescan** re-runs the scan; the header shows the counts. A scan that times out says so and points at `supbuddy doctor` \u2014 the daemon is installed and updated separately from the app, and one older than this panel doesn't answer its channels.\n  - **Fix\u2026** on a fixable finding \u2014 or **Fix all (n)** in the header \u2014 never repairs anything by itself. It opens the **manifest**: the literal list of actions that would run, each marked *destructive* or *safe*, built from the same actions the engine executes. **Apply** stays disabled until that manifest has loaded and contains at least one action, so an empty or failed plan can't be rubber-stamped. Same confirm-before-harm contract as `doctor --fix`.\n  - Repairs that need elevated access ask for your password when they run. One that outlives the app's 15-second reply window (a password prompt sitting open) is reported as *may still be running \u2014 rescan in a moment*, not as a failure.\n  - Findings with no auto-fix show **advisory** instead of a Fix button; the detail says what to do by hand. Checks that couldn't run at all are listed at the bottom as *Checks that could not run*, rather than being silently dropped.\n  - **There is no reset button here, on purpose** \u2014 the footer points at `supbuddy reset` instead. See *System reset*.\n\n### Network\n\n- **HTTP port**: default 8080.\n- **HTTPS port**: default 8443.\n- **DNS port**: default 5353.\n- **Port forwarding**: when on, inserts a `pfctl` rule mapping 80\u2192HTTP port and 443\u2192HTTPS port into `/etc/pf.conf` (correct translation-section placement; self-heals a file corrupted by older versions). Asks for sudo once. Status reflects a live 443 enforcement probe, not just file presence.\n- **LAN sharing**: binds Caddy to `0.0.0.0` + starts mDNS responder.\n- **Tailscale**: paste a tailnet API key to enable split-DNS push.\n- **Install / Uninstall CA**: **Install** adds Caddy's root cert to your System keychain (removing any stale same-name roots first); **Uninstall** removes every `Caddy Local Authority` root it added. macOS asks for your password each time.\n\n### Storage\n\nTrash retention (per-kind), volume sizes, image-cache controls.\n\n### MCP\n\n- **Clients**: list of connected clients. Each row has a **\u22EF** actions menu: install, edit scopes, set-primary, rotate token, revoke.\n- **Activity**: audit log with Apply/Cancel/Undo on plan rows.\n- **Trash**: soft-deleted mappings and projects, restorable for 7 days.\n- Settings: server `enabled`, `port` (default 9877), `audit_cap` (default 5000), `trash_ttl_days` (default 7).\n\n### AI Skills\n\nInstall Supbuddy's agent **skill at the user level** (machine-wide) so the agent sees Supbuddy in every repo without per-project setup. Each global-capable agent has a **master on/off** plus an **autosync** toggle (keeps the installed skill refreshed when Supbuddy updates it) and shows its install path + version.\n\n- **Who can install at user level**: only agents whose global file Supbuddy fully **owns** and that **self-scope** (act only when the working directory has a `.supbuddy/`): **Claude Code** (`~/.claude/skills/supbuddy/SKILL.md`) and **Cursor** (`~/.cursor/skills/supbuddy/SKILL.md`). The install is reference-counted under a synthetic `__user__` ref so it persists independent of any project and is never pruned by the boot reconcile.\n- **Master \u2194 project**: the AI Skills tab is the **master** (user-level). To commit a skill into a specific repo, use that project's **AI Tools** tab and set the target to **Project** (the old `local` scope, which writes into the repo for teammates); **User** there means the master install covers it.\n- Agents whose global file holds *your own* content (Claude `CLAUDE.md`, Codex `AGENTS.md`, Copilot, Windsurf, Continue, JetBrains) are **project-level only**: a machine-wide write there could clobber your config, so they're injected per-project instead.\n\n## Tray menu\n\nThe macOS menu bar tray icon opens a menu with:\n\n- **Status: \u2026**: current proxy state (running / idle).\n- **DNS Active (:5353)**: shown when proxy is running.\n- **LAN Sharing (\\<ip\\>)**: shown when LAN sharing is on.\n- **Tailscale (\\<ip\\>)**: shown when Tailscale is connected.\n- **Start Proxy / Stop Proxy**: opens the dashboard.\n- **Projects**: each project opens a submenu with **Apps** (click to open the mapped URL), **Supabase** services (status dot + open), and **Scripts** (your bookmarked scripts as a one-click **Start <name>** / **Stop <name>** toggle), plus **Restart Supabase**/**Restart services** and **Show in Supbuddy**.\n- **Open Dashboard**.\n- **Sync AI context for all projects**: runs the project-context sync engine for every registered project (writes `.supbuddy/`, `CLAUDE.md`, `AGENTS.md`, etc.).\n- **Show Logs**: reveals `main.log` in Finder.\n- **Check for Updates...**: manual update check (only enabled in packaged builds).\n- **Quit**.\n\n## File locations\n\nAll under `~/Library/Application Support/Supbuddy/` on macOS:\n\n- `main.log` + `main.log.1`: app logs (rotates at 2 MB).\n- `state.json`: persistent state (projects, mappings, settings, MCP clients, license).\n- `caddy-data/`: Caddy's data dir (PKI, autosaves, certs).\n- `caddy-data/caddy/pki/authorities/local/root.crt`: the local CA cert installed in your Keychain.\n- `ca-bundle/current.crt`: cumulative PEM containing every Caddy root that has ever been emitted. Used by **Bundled-runtime trust** as the target for `NODE_EXTRA_CA_CERTS` / `SSL_CERT_FILE` / `REQUESTS_CA_BUNDLE`. Real file (not a symlink) so Bun-bundled CLIs read it correctly.\n- `ca-bundle/versioned/<sha>.crt`: per-root snapshots for forensics.\n- `Caddyfile`: generated reverse-proxy config.\n- `daemon.json`: written while a headless CLI daemon is running (pid, Socket.IO + MCP-HTTP ports, control token); `0600`, removed on shutdown. Used by `supbuddy` CLI commands to discover and authenticate to the daemon, and by the desktop app to detect a running CLI daemon at launch.\n- `certs/`: legacy CA from the pre-Caddy era (unused in current builds).\n\nMCP-specific:\n\n- MCP client tokens (file-backed secret, mode `0600`): `~/Library/Application Support/Supbuddy/secrets/mcp-<client-id>.secret`\n- MCP audit log: under `~/Library/Application Support/Supbuddy/`, capped at `audit_cap` entries (default 5000).\n\n## Troubleshooting\n\n### Run a health & drift scan first (`supbuddy doctor`)\n\nWhen something's off, `supbuddy doctor` is the quickest triage. It runs a **read-only** scan of 18 checks and prints findings by severity, and many of the issues below have a matching check \u2014 an unreadable `state.json`, an untrusted CA, a wedged Caddy, port 443 not redirecting, stale duplicate CA roots, legacy CA-trust LaunchAgents poisoning public TLS, an agent config still holding a revoked MCP token, a Firefox profile pinning an old Caddy root, and leftovers from deleted projects (Docker containers/volumes, `127.0.0.N` loopback aliases, `/etc/resolver` files, MCP token files). Add `--fix` to apply the opt-in repairs after a confirmation prompt \u2014 some checks are advisory and have no auto-fix. See [System doctor](#system-doctor) for the full check list and flags.\n\n### Browser shows \"Not secure\" or certificate warning\n\nThe Caddy CA is not trusted. Open **Settings \u2192 Network \u2192 Install Certificate**. macOS will prompt for your password. After install, fully restart your browser (Cmd+Q, not just close window). Verify: *Keychain Access* \u2192 System keychain \u2192 search for \"Caddy Local Authority\".\n\n### \"unable to get local issuer certificate\" / \"self signed certificate in certificate chain\" from Claude Code, Cursor, MCP servers, or other AI tools\n\nThese tools ship their own bundled JavaScript runtime (Bun, Electron, pkg-bundled Node) and ignore the system Keychain. Open **Settings \u2192 General \u2192 Bundled-runtime trust** and click **Install**. Then *fully quit and relaunch* the AI tool; the env vars only take effect for newly-launched processes. Verify with `launchctl getenv NODE_EXTRA_CA_CERTS` (macOS); it should print `~/Library/Application Support/Supbuddy/ca-bundle/current.crt`. If install is refused with a conflict warning, you already have `NODE_EXTRA_CA_CERTS` set (often a corporate proxy / Zscaler), so Supbuddy won't silently overwrite; use the override prompt or manually concatenate the two PEMs.\n\n### \"Docker is not running. Please start Docker Desktop.\"\n\nCompose and Supabase features need Docker. Open Docker Desktop and wait until the whale icon stops animating.\n\n### \"Docker Compose is not installed\"\n\nCompose v2 ships inside Docker Desktop. If you removed Docker Desktop and are using a standalone Docker daemon (e.g. Colima, Rancher), install compose: `brew install docker-compose`.\n\n### \"Leftover host containers\" / \"isolation drift\" warning on a project\n\nSupbuddy flags **isolation drift** when a project's running containers don't match its configured isolation mode, for example a **Host** project with a stale `thin`-mode stack still running, or a **Thin** project with leftover host-mode containers. Switching isolation modes doesn't tear down the old layer, so those containers linger, waste resources, and can shadow the project's real stack. The warning appears in the **warnings chip** next to the enable toggle (click it to see each item; it shows a spinner while Supbuddy re-checks), as an entry in the issues counter, and as a notice on the **Supabase** tab listing the exact containers and any data volumes.\n\n**Guided cleanup.** Open the Supabase tab \u2192 **Clean up leftovers\u2026** to stop and remove the leftover containers. Data volumes are kept by default; deleting them is opt-in, and when the leftover copy looks newer than the active one, it requires an explicit choice and a backup (tarred to `\u2026/Supbuddy/backups/<project>-<timestamp>/`). If you recently migrated a VM project, any leftover VM container from before migration can also be cleaned up from this flow.\n\nIf the leftover copy's data looks **newer** than the active one, the warning turns red; don't delete its volumes without first deciding which copy to keep. The Configure tab also shows a dismissible note when Supabase stacks are running on your host that Supbuddy doesn't manage at all (e.g. a plain `supabase start`).\n\n### MCP client says \"Invalid OAuth error\" or \"JSON Parse error: Unexpected EOF\"\n\nThe MCP client is trying OAuth discovery and getting an empty 404. Either the token was lost (regenerate it in **Settings \u2192 MCP \u2192 the client's \u22EF menu \u2192 Rotate token**) or you're on a build older than the OAuth-probe fix. Update to the latest version; the server now answers OAuth discovery paths with a structured 404 instead of an empty body, and 401 responses include `WWW-Authenticate: Bearer` so the client doesn't fall back to OAuth.\n\n### MCP token disappeared after app restart\n\nFixed in recent builds. If you're on an older version, regenerate the token. Root cause was that `addMcpClient` didn't trigger state persistence; the client was held in memory only.\n\n### Server Actions return 403 in a Next.js app behind Supbuddy\n\nNext.js's CSRF guard rejects POSTs whose Origin isn't in `experimental.serverActions.allowedOrigins`. Supbuddy detects this and flags it in the warnings chip: open the **Apps** tab and hit **Fix** on the affected app for a paste-ready snippet, or **Apply\u2026** to preview a unified diff and write the change to `next.config` directly. After applying, restart your dev server.\n\nOn **Next.js 15.3+/16**, a proxied dev request can also be blocked (e.g. a \"Cross origin request detected\" warning) because Supbuddy now passes the real browser `Origin` through rather than rewriting it, and Next validates it against `allowedDevOrigins` (which defaults to `localhost`). Add your Supbuddy domain to `allowedDevOrigins` in `next.config` \u2014 see [Next.js cross-origin dev requests](#nextjs-cross-origin-dev-requests-alloweddevorigins). This is a separate key from the Server Actions list; 15.3+/16 may need both.\n\n### Vite dev server returns \"Blocked request. This host is not allowed.\" (403)\n\nVite (v5+) rejects requests whose `Host` header isn't in `server.allowedHosts`, so a Vite app reached through a Supbuddy domain 403s until the host is allowed. Supbuddy detects this and flags `vite: N hosts blocked` in the warnings chip: open the **Apps** tab and hit **Fix** on the affected app for a paste-ready snippet, or **Apply\u2026** to preview a diff and write `server.allowedHosts` into your `vite.config` directly. **Restart the Vite dev server afterward**; Vite does not hot-reload its config. A single `.your-project.local` entry covers every subdomain.\n\n### Supabase Realtime: channel reaches `SUBSCRIBED` but no `postgres_changes` events arrive\n\nIf a channel subscribes fine (and writes succeed) but change events never fire, this is almost always **realtime warmup timing right after the stack starts** \u2014 not the Supbuddy proxy. Local Realtime can accept a channel join and report `SUBSCRIBED` before its logical-replication binding for the tenant is ready, so `INSERT`/`UPDATE`s in that brief window are silently missed. Give the stack a few seconds after the Supabase tab goes green, then re-subscribe (or reconnect the channel). This is **unrelated to the `.local` domain**: Kong routes `/realtime/v1/*` by path and rewrites the upstream `Host` to its internal realtime tenant, so reaching realtime through `https://api.<project>.local` behaves identically to the raw `localhost:54321` port \u2014 forwarding the `.local` host upstream does not change tenant resolution. The new `sb_publishable_*` / `sb_secret_*` API keys also work for local realtime (Kong maps them to the legacy JWT), so you don't need to switch key formats.\n\n### Project shows a red \"PROXY ERROR\" banner: domain resolves but won't load\n\nAfter the proxy starts, Supbuddy runs an end-to-end reachability check: it resolves a project domain through the OS resolver and tries to connect to Caddy on the HTTPS port. If the name resolves but the connection fails, the project shows a red **PROXY ERROR** banner naming the likely cause (DNS, port-forwarding, or mDNS race) plus a recovery action.\n\nThe most common case: the domain resolves to `127.0.0.1` but port 443 won't connect because the elevated `pfctl` 443\u21928443 redirect drifted away (typically after a restart, so Caddy is up on 8443 with nothing forwarding 443). Click **Retry**; as of v2.3.6 it re-applies the port-forwarding rule (approve the sudo prompt). On older builds, toggle the proxy off\u2192on instead. If LAN sharing is **off**, disregard any \"LAN sharing / Bonjour\" wording in the banner; the cause is the missing forward, not mDNS.\n\n### Port forwarding is on but 443 won't connect\n\nSupbuddy reports port forwarding as **active** only when a live probe confirms 443 actually reaches Caddy \u2014 the rule being on disk isn't enough. If the rule is present but not being enforced (typically right after a reboot, or when an older Supbuddy version left `/etc/pf.conf` in a broken state), the status carries a `pf_not_enforcing` diagnostic instead of a false \"enabled\", and the banner tells you to **restart the proxy** to re-apply the redirect.\n\nOlder versions appended their `rdr-anchor` to the **end** of `/etc/pf.conf`, after Apple's filter anchor \u2014 which pf rejects, because translation rules must come before filtering rules. That silently invalidated the whole ruleset, so every later `pfctl -f` failed and 443 was dead. Current builds insert the anchor in the correct translation section and **self-heal** a file corrupted by the old version on the next proxy start. Supbuddy keeps a single stable backup at `/etc/pf.conf.supbuddy-backup` (older builds accumulated unbounded timestamped backups). If a restart doesn't fix it, inspect `/etc/pf.conf` and confirm the `rdr-anchor \"virtual.localhost\"` line sits before `anchor \"com.apple/*\"`.\n\n### Proxy came up but shows a degraded \"error\" state\n\nIf the one-time sudo prompt for port forwarding / DNS is cancelled or fails, Supbuddy no longer aborts the whole start. Caddy still starts and HTTPS keeps working on the high port (8443), and the CA is still generated; the proxy just shows an actionable **error** (degraded) state with a **Retry**. Click **Retry** and approve the sudo prompt to restore real-port (80/443) access and DNS. Until then, reach your apps on `https://<domain>:8443`.\n\n### Port already in use (8080, 8443, 5353, 9877)\n\nDefault ports: HTTP 8080, HTTPS 8443, DNS 5353, MCP 9877. Change them in **Settings \u2192 Network** / **Settings \u2192 MCP**. Find what's holding a port: `lsof -i :<port>`.\n\n### Wipe everything and start over\n\nUse `supbuddy reset` (see *System reset*) \u2014 it backs up anything you can't regenerate first, and it removes the things a plain `rm -rf` leaves behind (the pf redirect, the resolver files, the loopback aliases, the trusted CA):\n\n```bash\nsupbuddy reset --tier=soft   # just the app state and caches\nsupbuddy reset --tier=deep   # + services, Caddy leftovers, /etc integrations, CA trust\nsupbuddy reset --tier=full   # + project data, repo artifacts, secrets, service, app data\n```\n\nThe manual equivalent, if the CLI isn't available \u2014 quit Supbuddy first, and note that this deletes `secrets/` and any backups under it with no copy anywhere:\n\n```bash\n# Wipe app data (state, certs, Caddyfile, logs, MCP tokens under secrets/)\nrm -rf ~/Library/Application\\ Support/Supbuddy\n\n# Optional: remove the trusted CA\nsudo security delete-certificate -c \"Caddy Local Authority\" /Library/Keychains/System.keychain\n```\n\n## FAQ\n\n### Is Supbuddy free?\n\nYes. Supbuddy is free. Register as many projects and mappings as you want, with full HTTPS, full DNS, full Supabase isolation, and full read and write MCP access. There are no caps and no tiers.\n\n### Does Supbuddy send my data anywhere?\n\nNo. Caddy, the DNS server, and the MCP server all run locally on your Mac. The only outbound traffic is: Tailscale split-DNS push (only if you enabled it), auto-update checks (GitHub Releases), and Google Analytics on the marketing site (not the desktop app). The desktop app does not send telemetry.\n\n### Can I work offline?\n\nYes. The app works fully offline once the CA is trusted and projects are registered.\n\n### Linux / Windows support?\n\nThe desktop app is macOS-only in v2. The headless CLI and daemon also run on Linux, where `supbuddy service install` registers a `systemd-user` start-on-login unit (macOS uses `launchd`). Windows is not supported. A few desktop code paths (certutil, update-ca-certificates) anticipate other platforms but are not tested there.\n\n### Can I use my own TLD?\n\nYes. Set any TLD in **Settings \u2192 General \u2192 Default TLD**. Supbuddy installs `/etc/resolver/<project-domain>` files that tell macOS to query our DNS server for that project's domain. Avoid TLDs that actually resolve on the public internet (.com, .net, etc.); your browser will hit the real site for cached entries.\n\n### What happens if I delete a project?\n\nThe project moves to the Trash (visible in **Settings \u2192 MCP \u2192 Trash**) for 7 days, then is permanently deleted by the sweep timer. Restoring brings back the project record and all its mappings.\n\n### How do I uninstall Supbuddy?\n\n1. Quit the app (the full reset refuses to run while it's open, because its watchdog restarts the daemon).\n2. Run `supbuddy reset --tier=full` and type `RESET` when it asks. This backs up your project data, then removes the containers, volumes, `/etc` integrations, CA trust, repo artifacts, credentials, the start-on-login service and the app-data directory \u2014 keeping `<app-data>/backups/reset-<timestamp>/`. See *System reset*, including the short list of things it deliberately leaves behind.\n3. Drag **Supbuddy.app** from `/Applications` to the Trash, and move the backups directory somewhere safe (or delete it).\n4. If you'd rather not use the CLI: see \"Wipe everything and start over\" above for the manual equivalent, plus `sudo security delete-certificate -c \"Caddy Local Authority\" /Library/Keychains/System.keychain` to remove the trusted CA.\n\n### Where do I report a bug?\n\nEmail support with your version (visible at the bottom of the Settings popover) and the relevant lines from `~/Library/Application Support/Supbuddy/main.log`.\n";
+    DOCS_MARKDOWN = "# Supbuddy docs\n\n> Run multiple Supabase projects at once on one Mac, each with its own custom local domain.\n\n## Getting started\n\nThere are two ways to run Supbuddy. Use the **macOS desktop app** (steps below), or the **command-line interface**, which runs on macOS and Linux. For the CLI, install it with `npx supbuddy@latest` and jump to [Command-line interface](#command-line-interface-cli). The app and the CLI share the same state, so you can use either or both.\n\n### 1. Install\n\nDownload the latest `.dmg` from the [download page](/api/download). Drag **Supbuddy.app** into `/Applications` and launch it. Supbuddy is signed and notarized; macOS will not show a Gatekeeper warning. Requires an Apple Silicon Mac (M1/M2/M3/M4, arm64). The desktop app is macOS-only in v2, but the headless CLI runs on Linux too. See [Command-line interface](#command-line-interface-cli).\n\n### 2. Trust the local Certificate Authority\n\nCaddy mints its local CA the first time it actually serves a site, so the cert only exists once you have **at least one enabled mapping and the proxy running** \u2014 an empty proxy never generates it. With that in place, open the app and click **Install** (the first-launch prompt, or **Settings \u2192 Network** later). Supbuddy adds the CA (Caddy's internal PKI at `~/Library/Application Support/Supbuddy/caddy-data/caddy/pki/authorities/local/root.crt`) to your **System keychain** via `sudo security add-trusted-cert`; macOS asks for your password once. Caddy does **not** self-install trust (the generated Caddyfile sets `skip_install_trust`), so this button is what makes the padlock green \u2014 fully quit and reopen your browser afterward to pick it up. Every Supbuddy domain then gets HTTPS with no per-domain prompts or warnings. (On Windows the install is manual: Supbuddy shows the PowerShell `Import-Certificate \u2026 -CertStoreLocation Cert:\\LocalMachine\\Root` command to run as Administrator.)\n\nCaddy names its root by year, so each yearly rotation (or a data wipe) leaves a same-name root behind with a different key. On every Install, Supbuddy first removes any stale `Caddy Local Authority` roots whose fingerprint doesn't match the current one, then adds the current root \u2014 leftover mismatched roots otherwise make Firefox-family browsers fail with `SEC_ERROR_BAD_SIGNATURE`.\n\n**Firefox, Zen, and Brave keep their own certificate store** that Supbuddy can't reach (they don't consult the System keychain). After a CA change, either delete any stale `Caddy Local Authority` entries from the browser's own certificate manager and re-import the new root, or \u2014 on Firefox/Zen \u2014 set `security.enterprise_roots.enabled` to `true` in `about:config` so the browser reads the System keychain.\n\nIf Supbuddy detects an AI tool that ships its own JavaScript runtime (Claude Code, Cursor, Windsurf, Continue, Codex CLI, OpenCode, etc.) it will also offer to enable **Bundled-runtime trust** in the same first-run prompt. Those tools don't read the system Keychain (they carry their own Mozilla CA bundle), so without this setup the first OAuth/MCP connection to a `*.test` URL fails with `unable to get local issuer certificate`. Enable it once and Supbuddy keeps it in sync (including across yearly Caddy CA rotation). See the **Bundled-runtime trust** section under Settings \u2192 General for details.\n\nIf you skip the prompt, you can re-trigger it any time from the **Settings \u2192 Network** tab.\n\n### 3. Add your first project\n\nClick **Add project** in the Configure tab and pick a project root folder (the one with `package.json` and/or `supabase/config.toml`). Supbuddy scans it and creates auto-mapped subdomains based on what it finds:\n\n- Supabase Kong \u2192 `api.<project>.test`\n- Supabase Studio \u2192 `studio.<project>.test`\n- Supabase Inbucket / Mailpit \u2192 `mail.<project>.test`\n- Each detected app (Next.js, Vite, etc.) \u2192 `<app-name>.<project>.test`\n\nThe default TLD is `.test`. You can change it project-wide in **Settings \u2192 General \u2192 Default TLD**.\n\n### 4. Start the proxy\n\nToggle the project on. Supbuddy starts Caddy on port 8443 (HTTPS) and starts its built-in DNS server on port 5353. If you want real ports 80/443 instead of 8080/8443, enable **port forwarding** in **Settings \u2192 Network**. Supbuddy inserts a `pfctl` redirect rule into `/etc/pf.conf` (asks for sudo once) and reports whether the redirect is actually being enforced via a live 443 probe \u2014 not merely that the rule is on disk. If port forwarding is on but 443 won't connect, see [Port forwarding is on but 443 won't connect](#port-forwarding-is-on-but-443-wont-connect).\n\n> If the one-time sudo prompt is cancelled or fails, Supbuddy no longer aborts the start: Caddy still comes up and HTTPS keeps working on the high port (8443), and the proxy shows a degraded **error** state with a **Retry** so you can re-run the privileged setup. The CA is still generated in this state.\n\n## Core concepts\n\nFour things to understand:\n\n- **Project**: a folder you registered. Holds detected *apps* (Next.js, Vite, etc.), detected *services* (Supabase stack, Docker Compose services), and a list of *mappings*.\n- **Mapping**: a domain \u2192 port pair (e.g. `api.acme.test \u2192 54321`). Auto-generated mappings are tied to a detected service or app; you can also create manual ones.\n- **Isolation mode**: per-project. One of:\n  - `thin` (lightweight, **the default for newly registered projects**): still your host Docker (no nested containers, no DinD), but Supbuddy gives each project its own **port block** and a unique Compose `project_id`, written into that project's `supabase/config.toml`. That's what lets several Supabase projects run **at once on the shared daemon**, each reached by name (`api.<project>.test`, `studio.<project>.test`). Apps bind a **per-project loopback IP** (127.0.0.2, 127.0.0.3, \u2026) so every project's dev servers keep their canonical ports \u2014 each project gets its *own* `:3000`. Start dev servers with `supbuddy run -- <dev command>` so they bind that IP. Supbuddy owns those config.toml keys while the project is `thin` and restores them the moment you switch back to `host`.\n  - `host`: everything shares `127.0.0.1` and the stock ports. Dev-server ports collide across projects, and only one host-mode Supabase project can run at a time (the standard `supabase start` constraint). Use `host` **only when the project's Supabase stack is already running on the host independently of Supbuddy** (you run `supabase start` yourself and don't want Supbuddy re-porting `config.toml`). MCP registration (`register_project`) detects that case and keeps such projects on `host` automatically; in the app's Add-project dialog, pick **Host** in the Environment section yourself.\n- **Active vs inactive**: any project can be \"active\" (proxied + reachable) or inactive. Inactive projects keep their state, so flipping them on is a few seconds. Run as many active projects as you want.\n\n## Project cards (Configure tab)\n\nEach registered project appears as a card in the Configure tab. Cards have a single-row header that's always visible and a tab-based body that expands on click.\n\n### Header\n\nReading left to right:\n\n- **Expand chevron** + **project name**: click to expand/collapse the card.\n- **Status indicator**: a single colored dot next to the project name aggregating the realtime state of every subsystem (Supabase services, Compose, scripts, AI sync, port conflicts, next.config warnings). Red = error, amber = warning, green = at least one service running, muted gray = idle, animated cyan spinner = transitioning. Hover for a tooltip that lists each subsystem's state.\n- **Tech badges**: e.g. `TurboRepo`, `Supabase` (shown when detected).\n\n**Supabase connection warning.** When a project's app `.env` is missing the\nSupabase connection vars, or they've gone stale relative to the live target\n(e.g. after switching isolation, which republishes ports), the card shows a\n`supabase env: not connected` / `supabase env: out of date` pill. Click it to\nopen Connect and push fresh values, or choose **Ignore for this project**.\n- **Env mode chip**: read-only `Host` or `Thin` label (matching the project's isolation mode). To switch modes, open the **Supabase** tab and use the **Environment** section at the top.\n- **Issues counter**: red for errors, amber for warnings. Click to open the **issues popover** (see below). Hidden when there are no issues.\n- **Warnings chip**: all project-level warnings (isolation drift, missing env vars, config issues, etc.) are consolidated into a single amber chip next to the enable toggle. Click it to see each warning item-by-item; it shows a spinner while Supbuddy re-checks the project.\n- **Enable toggle** (right edge): turn the project's proxy on/off without deleting it.\n- **\u22EF actions menu** (right edge): every project-level action: **Edit project**, **Rescan**, **Re-check configs** (re-runs the connection/env drift check for this project), **Select folder**, **Export bundle**, and **Delete project**.\n\n### Issues popover\n\nClicking the issues counter opens a popover listing all current errors and warnings. Each issue shows a severity icon, title, optional detail, and a **\u2192 open {tab}** link. Clicking the link jumps to the relevant tab and closes the popover.\n\n### Body tabs (when expanded)\n\nThe body renders a flat tab strip with 6 conditional tabs. Below ~480 px, the strip collapses to a dropdown selector. (Project-level actions, like edit, rescan, re-check configs, select folder, export, and delete, are in the header's **\u22EF menu**, not a tab.)\n\n#### Apps (default tab)\n\nPer-app rows are domain-first: `domain \u2192 :port` (with hover-revealed copy/open URL buttons), then app name + tech badge, then a flex spacer pushes hover-revealed **edit** / **delete** / **access** (LAN / Tailscale state) actions and the per-mapping **toggle** to the right edge. A **Map** CTA appears on hover for unmapped apps. Manual mappings scoped to this project (not auto-generated) are listed below under their own subheader.\n\n#### Supabase (shown when Supabase is detected)\n\n**Environment section (top):** host/thin switcher. A legacy project still on the old Isolated (VM) mode shows the migration wizard here instead (see [Migrating a legacy Isolated (VM) project to Thin](#migrating-a-legacy-isolated-vm-project-to-thin)).\n\n**Action bar:** Start, Stop, Restart buttons; a first-class **Connect** button (cyan, opens the connection panel for `.env` generation / merge); and a **More** menu with **Config editor** and **Details**.\n\n**Config editor: secret extraction.** When you save a `supabase/config.toml` that contains a secret-bearing value inline (e.g. an SMTP password under `[auth.email.smtp]`, an OAuth `secret`, or any `*_key`/`auth_token`), Supbuddy prompts before writing: it lists the detected secrets and lets you pick which gitignored env file to move them to (defaulting to the project-root `.env.local`). The value is written there and replaced in `config.toml` with an `env(SUPABASE_\u2026)` reference, so secrets never land in git. Supbuddy injects those `SUPABASE_`-prefixed values back into the `supabase start` environment so the references resolve. (Saving a config with no inline secrets writes directly, with no prompt.)\n\n**Service rows** (read-only): status dot, service name, URL. No inline actions; lifecycle is driven by the action bar.\n\n#### Compose (shown when Compose services are detected)\n\n**Action bar:** Start, Stop, Restart. **Service rows** are read-only (status dot, name, URL). Add-on services declared in `supbuddy.addons.yml` (see **Add-on Compose services**) appear here alongside the base stack and in `get_compose_status` over MCP.\n\n#### Other (shown when non-Supabase, non-Compose services are detected)\n\nRead-only service rows: status dot, name, URL.\n\n#### Scripts (shown when scripts are detected)\n\nBookmarked scripts appear in a **Quick Access** group at the top; remaining scripts appear under **Other Scripts**. Per-script row: status dot, name, uptime, bookmark star, Start/Stop/Restart buttons. A search input appears when there are more than 5 scripts.\n\n#### AI Tools\n\nWraps the project-context-sync panel: sync mode selector (Auto / Manual / Off), detected targets list with per-target **scope** (global / local), advanced options, and recent activity. See [Per-project AI context sync](#per-project-ai-context-sync) for what global vs. local means.\n\n> Project-level actions (**Edit**, **Rescan**, **Re-check configs**, **Select folder**, **Export bundle**, **Delete**) are no longer a tab. They live in the header's **\u22EF actions menu**.\n\n---\n\n## Multiple Supabase projects (the main use case)\n\nThe reason Supbuddy exists. Stock Supabase CLI binds to fixed ports (54321 Kong, 54322 Postgres, 54323 Studio, 54324 Inbucket). Two projects on the same machine collide; you must `supabase stop` one before `supabase start`-ing the other.\n\nTwo ways to break that constraint, picked per project in the **Supabase** tab \u2192 **Environment** section:\n\n### Thin (lightweight, recommended)\n\nSwitch a project to **Thin**. Supbuddy assigns it a free port block (in the `55000+` range), writes those ports plus a unique Compose `project_id` into its `supabase/config.toml`, and runs `supabase start` on your **normal host Docker**, with no nested containers and nothing to pull. Several projects boot side by side this way; each is reached by name (`api.acme.test`, `studio.acme.test`, `mail.acme.test`). Switch back to **Host** and Supbuddy restores the original `config.toml` and stops just that project's stack.\n\nThis is the lightest, fastest option and the right default for most setups \u2014 which is why **newly registered projects default to Thin**. One caveat: if your `config.toml` omits a port key (e.g. `[inbucket] smtp_port`), Supbuddy can't relocate a port that isn't declared, so that one service falls back to its stock port. That is fine for a single project, but spell those keys out if two Thin projects need the same service.\n\n### Dev servers on Thin: every project keeps its own `:3000`\n\nA Thin project also gets its own **loopback IP** (127.0.0.2, 127.0.0.3, \u2026, persisted per project). Its app dev servers bind that IP instead of `127.0.0.1`, so canonical ports never collide across projects \u2014 five Next.js apps in five projects can all run on `:3000` at once, and Supbuddy's proxy routes each `web.<project>.test` to its project's IP.\n\nStart dev servers through the launcher:\n\n```bash\nsupbuddy run -- next dev          # binds -H <project loopback IP>, stays on :3000\nsupbuddy run -- vite              # injects --host <ip> --strictPort\nsupbuddy run --print -- next dev  # show what would run, without running it\n```\n\n`supbuddy run` reads the project's IP from the nearest `.supbuddy/meta.json` (`loopbackIp`, written when Thin is enabled), ensures the loopback alias exists, injects the right bind flag for the detected framework, and execs your command. It prints one concise line with the project's Caddy-proxied URL (e.g. `[supbuddy] \u2192 https://web.<project>.test`) \u2014 the address you should actually open. For **Next and Vite** it also hides the dev server's own `- Local:/- Network:` banner (which only echoes the raw loopback IP `127.0.0.N:<port>`, bypassing Supbuddy's HTTPS proxy): those two lines are filtered out of the piped output, every other line passes through untouched, and colours are preserved via `FORCE_COLOR` (stdin stays interactive). Other frameworks pass through with no filtering. When a project has several app mappings, it matches the one whose port equals the dev server's port (from `--port`/`-p` or the framework default), else lists them all. Make it the project's `dev` script (`\"dev\": \"supbuddy run -- next dev\"`) so nobody \u2014 humans or agents \u2014 has to remember it. **Never move an app to a nonstandard port because `127.0.0.1:3000` is busy**; that port belongs to another project's IP space.\n\n### When to stay on Host\n\nKeep a project on **Host** only when its Supabase stack runs on the host *independently of Supbuddy* \u2014 you run `supabase start` yourself on the stock ports and don't want Supbuddy rewriting `config.toml`. MCP registration (`register_project`) detects a stack like that (running containers for the project's `config.toml` `project_id`) and keeps the project on Host automatically; in the app's Add-project dialog, pick **Host** in the Environment section for such projects. Stop the stack (`supabase stop`) and switch to Thin whenever you're ready.\n\n### Running them all at once\n\nRegister as many projects as you want, and all of them can be \"active\" (proxied) at the same time. There's no limit. A Thin project's stack restarts in seconds; a Host project needs the standard `supabase start` cycle.\n\n### Migrating a legacy Isolated (VM) project to Thin\n\nIf you created a project in an older version of Supbuddy that used the now-retired **Isolated (VM)** mode, Supbuddy detects it on launch and offers a one-way, guided migration to **Thin**. The migration wizard appears in the **Supabase** tab's Environment section for any project still flagged as VM.\n\nThe migration is data-safe: Supbuddy dumps your Postgres data, starts a fresh Thin stack, restores the dump into it, and row-count-verifies the restore before tearing down the old VM container. No data loss. After migrating, the VM is gone and there's no way to switch back (but your data is intact in the Thin stack).\n\nOver MCP, three tools handle the migration bridge:\n\n- `list_pending_vm_migrations` (read): lists all projects still on the legacy VM mode awaiting migration.\n- `migrate_vm_to_thin` ( `{ project_id }` ) (write): starts the guided data-safe migration (dump, restore, verify).\n- `finish_vm_migration` ( `{ project_id }` ) (write): tears down the old VM container after migration is verified. Returns an error if called before verification passes.\n\n## Custom domains & TLDs\n\nEvery mapping resolves through Supbuddy's built-in DNS server on port 5353. By default the TLD is `.test` (an IETF-reserved TLD safe for local use). You can change the default in **Settings \u2192 General \u2192 Default TLD** to `local`, `dev`, or anything else; existing mappings are migrated to the new TLD on save.\n\nFor host resolution, Supbuddy *does not* use `/etc/hosts` for wildcards; it runs a DNS resolver. macOS's default resolver only queries port 53; Supbuddy installs a per-project resolver file under `/etc/resolver/<project-domain>` (e.g. `/etc/resolver/myapp.local`) pointing at `127.0.0.1:5353`. macOS picks the longest-suffix-matching file, so per-project entries route reliably without colliding with reserved namespaces like `.local` (which Bonjour/mDNS owns). You'll be prompted for sudo the first time this changes.\n\nResolver files exist only for domains the proxy actually serves \u2014 the same set that gets a Caddy site block: enabled mappings that are either standalone or under an **enabled** project. Disable or delete a project and its resolver file is removed with its routes (one sudo prompt, and only when something really changed), so its domains go back to failing as \"server not found\" instead of resolving into a TLS handshake error from a proxy that has nothing to serve. Enabling it again writes the file back; so does restarting the proxy.\n\n### Per-project TLD\n\nBy default every project's domain uses the global TLD (Settings \u2192 Default TLD, e.g. `.test`). A single project can opt into its **own** TLD \u2014 set the suffix in the project dialog, pass `tld` to the `register_project` / `update_project` MCP tools, or use the CLI: `supbuddy project add <path> --tld=portal` when registering, or `supbuddy project set <project> --tld=portal` on an existing one (`--tld=` with an empty value clears the override). That project's base domain and all its subdomains then live on the override TLD (e.g. `cueplusplus.portal`, `web.cueplusplus.portal`) while every other project stays on the global default. The override is durable across restarts and is unaffected when you change the global TLD. Prefer `.test` or a vanity label like `.portal`; avoid `.local` (it collides with macOS mDNS/Bonjour).\n\n### LAN sharing\n\nWhen LAN sharing is enabled (Settings \u2192 Network), Supbuddy binds Caddy to `0.0.0.0` instead of `127.0.0.1` and runs an mDNS responder so other machines on your local network can reach your dev servers via `<hostname>.local`. Useful for testing on your phone or another laptop without setting up Tailscale.\n\n**`.local` TLD + LAN sharing:** macOS reserves the `.local` namespace for Bonjour/mDNS (RFC 6762), and macOS's TCP stack short-circuits self-connections to your own LAN IP via the loopback path *without consulting `pf`*, so the obvious \"redirect lo0 \u2192 my LAN IP\" trick can't fix it. Supbuddy's mDNS responder works around this by **ignoring queries that originate from this machine**, letting the OS resolver fall through to `/etc/resolver/<project-domain>` (which routes to `127.0.0.1` where Caddy listens). Other LAN devices still get answered with the LAN IP and reach you normally. The net result: `.local` works correctly both on this machine and on other LAN devices, with no manual configuration. If you previously worked around this by switching to `.test`, you can switch back.\n\nIf `studio.<project>.local` (or similar) doesn't load: open the Configure tab. A red banner will tell you whether it's a DNS, port-forwarding, or mDNS-race issue, with the specific recovery action.\n\n### Tailscale\n\nIf you have Tailscale installed and a Tailscale API key configured in Settings, Supbuddy can push split-DNS routes to your tailnet so any device on your tailnet resolves your Supbuddy domains. Optional, off by default.\n\n## Monorepo support\n\nSupbuddy auto-detects these monorepo layouts when scanning a project root:\n\n- Turborepo (presence of `turbo.json`)\n- pnpm workspaces (`pnpm-workspace.yaml`)\n- npm/yarn workspaces (`workspaces` field in root `package.json`)\n- Common folder layouts: `apps/*`, `packages/*`, `services/*`, `sites/*`\n\nEach detected app gets its own subdomain. Supabase is searched for in the project root and these subdirectories: `apps/*`, `packages/*`, `services/*`, `sites/*`, `db/`, `db/*`, `database/`, `database/*`, `packages/backend`, `packages/db`, `packages/database`.\n\n### Detected app frameworks\n\nPort detection looks for the framework dependency in `package.json` and combines that with: explicit `-p`/`--port` in the dev script, `PORT=` env in the dev script, or a config file read. If none of those resolve, the framework default is used:\n\n| Framework dependency | Default port |\n| --- | --- |\n| `next` | 3000 |\n| `vite` | 5173 |\n| `@remix-run/dev`, `@remix-run/serve` | 3000 |\n| `astro` | 4321 |\n| `nuxt`, `nuxt3` | 3000 |\n| `@sveltejs/kit` | 5173 |\n| `@angular/core` | 4200 |\n| `@nestjs/core` | 3000 |\n| `express`, `fastify`, `koa`, `hono`, `@hono/node-server`, `elysia`, `polka`, `tinyhttp` | none (must be explicit in dev script) |\n\n### Server Actions allowedOrigins audit\n\nFor Next.js apps, Supbuddy reads your `next.config.{ts,mts,js,mjs,cjs}` and extracts the hosts in `experimental.serverActions.allowedOrigins`. If a mapped subdomain is missing from that list, the project's **warnings chip** flags `next.config: N origins missing`; Server Action POSTs through Supbuddy mappings would 403 otherwise. Open the **Apps** tab (the chip's \"open apps\" jump) where the affected app shows the warning with a **Fix** button.\n\nThe Fix button opens a dialog with a paste-ready snippet and an **Apply\u2026** button: click it to see a unified diff of the change Supbuddy will make to your `next.config`, then **Confirm & write** to apply it. Supbuddy handles the four common config shapes (existing `allowedOrigins` array, existing `serverActions` block without it, existing `experimental` block without `serverActions`, or no `experimental` at all). The edit is strictly additive: existing array entries are kept verbatim, including spreads (`...devHosts`), identifiers and comments, and only the missing origins are appended.\n\nIf `allowedOrigins` (or `serverActions`, or `experimental`) is set to something other than a plain array/object literal \u2014 an identifier, a function call, a ternary, `[...] as string[]` \u2014 Supbuddy **refuses to patch** rather than guess, and the dialog says so along with the exact origins to add. This is deliberate: a wrong rewrite would produce a duplicate key (TypeScript `TS1117`) that breaks your build long after the fact, so the fallback is the copyable snippet. Use it and edit by hand.\n\nAfter write, Supbuddy rescans the project so the warning disappears immediately. Restart your dev server for the change to take effect; Next.js does not hot-reload `next.config`. Over MCP the same audit is exposed as `preview_next_origins` / `apply_next_origins`; both return `ok: false` with an explanation in the refusal case, and `apply_next_origins` never writes a file it cannot verify.\n\n### Next.js cross-origin dev requests (allowedDevOrigins)\n\nSupbuddy proxies your dev server but **passes the browser's real `Origin` header through** (it no longer rewrites `Origin` to the upstream address). That's required so Server Actions and other origin checks see the actual page origin \u2014 but it means **Next.js 15.3+ and 16** dev servers, which validate cross-origin dev requests against `allowedDevOrigins` (defaulting to `localhost`), now treat a request arriving on a Supbuddy domain (or a Thin project's `127.0.0.N` loopback IP) as cross-origin and can reject it. Add your Supbuddy domain to `allowedDevOrigins` in `next.config`:\n\n```js\n// next.config.js\nmodule.exports = {\n  allowedDevOrigins: ['web.myproject.test'],\n}\n```\n\nRestart the dev server afterward; Next.js does not hot-reload `next.config`. This is separate from `experimental.serverActions.allowedOrigins` (the Server Actions CSRF list above) \u2014 15.3+/16 may need both.\n\n### Vite allowedHosts audit\n\nFor Vite apps, Supbuddy reads your `vite.config.{ts,mts,cts,js,mjs,cjs}` and extracts `server.allowedHosts`. If a mapped host isn't covered, the **warnings chip** flags `vite: N hosts blocked`; Vite's dev server otherwise rejects proxied requests for unknown hosts with `Blocked request. This host (\"\u2026\") is not allowed.` (403). A `.your-project.local` entry counts as covering every subdomain, so an existing wildcard suffix doesn't trigger a false warning.\n\nLike the Next.js audit, the affected app's **Fix** button on the **Apps** tab opens a dialog with a paste-ready snippet and an **Apply\u2026** button that previews a unified diff and writes `server.allowedHosts` into your `vite.config` (handling an existing `allowedHosts` array, an existing `server` block without it, or no `server` block at all; `allowedHosts: true` is left untouched). The edit is strictly additive \u2014 existing entries, spreads and comments are kept verbatim and only missing hosts are appended \u2014 and, exactly as with the Next.js audit, Supbuddy **refuses to patch** when `allowedHosts` or `server` is set to anything other than a plain array/object literal, pointing you at the snippet instead of risking a duplicate-key build break. After write, Supbuddy rescans so the warning clears. Restart your dev server for the change to take effect; Vite does not hot-reload `vite.config`.\n\n## MCP setup (AI agents)\n\nSupbuddy ships a built-in MCP server on `http://127.0.0.1:9877/mcp` with static Bearer-token auth. Five clients have one-click install; any other MCP-compatible tool can be configured manually with the same URL + token.\n\nOpen **Settings \u2192 MCP \u2192 Add client**, pick the client kind, and Supbuddy generates a token, edits the client's config file, and backs up the original (`<file>.supbuddy-backup` next to it). If the install can't complete it surfaces an error toast rather than stalling. The same client-management surface (**Settings \u2192 MCP \u2192 Clients**: install, edit scopes, set-primary, rotate token, revoke) drives each client from the app.\n\n### Auto-install paths\n\n| Client | Config file | Transport |\n| --- | --- | --- |\n| Claude Code | `~/.claude.json` (user) or `<project>/.mcp.json` (project) | HTTP |\n| Claude Desktop | `~/Library/Application Support/Claude/claude_desktop_config.json` | stdio shim via `npx -y @supbuddy/mcp@latest` |\n| Cursor | `~/.cursor/mcp.json` (user) or `<project>/.cursor/mcp.json` (project) | HTTP |\n| Codex CLI | `~/.codex/config.toml` (adds an `[mcp_servers.supbuddy]` block) | HTTP |\n| Windsurf | `~/.codeium/windsurf/mcp_config.json` | HTTP |\n\n### MCP tool surface\n\nThe MCP server has full read and write access:\n\n- Read tools (`list_mappings`, `list_projects`, `get_health`, `get_compose_status`, `list_pending_vm_migrations`, etc.), with env values and request bodies included.\n- `get_client_capabilities` and `request_scope_elevation` (scope discovery + user-approved grant).\n- `read_env_file`, `tail_request_logs`, `watch_audit_log`.\n- Write tools: `create_mapping`, `delete_mapping` (soft-delete), `register_project`, `update_project`, `set_supabase_config_path`, `start_proxy`, `start_supabase`, `stop_supabase`, `restart_supabase`, `switch_isolation`, `migrate_vm_to_thin`, `finish_vm_migration`, `start_compose`, `stop_compose`, `restart_compose`, `scaffold_addons`, `seed_addons`, `write_env_file`, `copy_env_var`, `write_supabase_config`.\n- Scripts tools (`list_scripts`, `start_script`, `stop_script`, `restart_script`, `bookmark_script`, `tail_script_logs`); see *Scripts MCP tools* below.\n- Extended Supabase tools: `init_supabase`, `validate_supabase_config`, `list_supabase_backups`, `restore_supabase_backup`, `cancel_supabase_start`, `force_recreate_supabase`, `restart_supabase_container`, `get_supabase_analytics`, `set_supabase_analytics`.\n- Bundle (export/import a project's full config): `export_bundle`, `import_bundle`, `validate_bundle`.\n- Supbuddy Cloud (opt-in, per-project): `cloud_sign_in`, `push_to_cloud`, `get_cloud_status`, `cloud_teardown` \u2014 push a project (with its Supabase schema + data) to a hosted cloud stack and control it. The `cloud` link (`{ projectId, stackId, pushedAt, url }`) also appears on `get_project` / `list_projects`, so any client sees which projects are in the cloud.\n- Connection / env-target workflow: `preview_connection`, `get_env_targets`, `diff_env`, `apply_env`, `write_connection`, `test_connection`, `dismiss_connection_drift`.\n- Host & network tools: bundled-runtime trust (`get_trust_status`, `install_trust`, `remove_trust`, `detect_trust_tools`, `test_trust`), Tailscale (`get_tailscale_status`, `set_tailscale_key`, `remove_tailscale_key`, `test_tailscale`), DNS (`get_dns_status`), CA (`uninstall_ca`), and port-forwarding (`get_port_forwarding_status`, `set_port_forwarding`, `reload_port_forwarding`).\n- `tail_service_logs`: streams a Compose/add-on service's container logs over SSE (like `tail_request_logs` but for container stdout/stderr).\n- `watch_supabase`: streams a project's live Supabase start/stop/restart progress over SSE: operation status, image-pull/service snapshots, and (for VM projects) raw log lines. Backs `supbuddy supabase start --follow`.\n- System doctor: `doctor` (scope `read`) runs the read-only health & drift scan and returns a report of findings (each with a `checkId`, severity, evidence, and whether it's `fixable`) \u2014 it mutates nothing. `doctor_fix` ( `{ check_ids: [...] }` ) applies the opt-in repairs for those checks; it's **system-scoped and confirm-gated** (a modal, exactly like `uninstall_ca`), so a read-scoped client can't trigger a fix and an agent can't silently run a destructive repair. Backs `supbuddy doctor` / `doctor --fix` (see *System doctor*).\n- System reset: `system_wipe` ( `{ tier: \"soft\" | \"deep\" }` , scope `system`) runs the tiered reset described under *System reset*. It is gated **twice**: it always returns a plan first \u2014 even for `auto_apply` clients \u2014 whose `side_effects` are the literal manifest the wipe will execute, and the subsequent `apply` still blocks on a user confirmation modal. `tier: \"full\"` is **rejected**: it deletes the credentials the caller is authenticating with, and its final steps (uninstalling the service, removing the app-data directory) can't run inside the daemon \u2014 run `supbuddy reset --tier=full` in a terminal instead.\n- Multiple MCP clients can connect simultaneously. The same MCP-HTTP surface backs the headless **CLI** (see *Command-line interface* below).\n\n### Scopes: discovery & self-service elevation\n\nEach MCP client holds a set of **scopes** (`read`, `log_tail`, `mappings`, `projects`, `services`, `config`, `system`, `apply`) chosen when it's added. A tool call that needs a scope the client lacks fails with `scope_denied`, whose payload now carries a `user_message` and `details.remediation` pointing at the fix.\n\n- `get_client_capabilities` ( `{ tool? }` ) returns the calling client's `granted_scopes` and `available_scopes`. Pass a `tool` name to get `{ required_scope, required_feature, can_call, reason? }` so an agent can pre-flight a call instead of probing by hitting `scope_denied`.\n- `request_scope_elevation` ( `{ scopes: [...] }` ) asks the **user** to grant the named scopes. Supbuddy shows a blocking approval dialog; on approval the scopes are added to the client. Already-granted scopes short-circuit without a prompt.\n\nYou can also review and edit any client's scopes from the GUI: **Settings \u2192 MCP \u2192 Clients** lists each client's granted scopes inline and exposes a **Scopes** button that opens the same scope editor used when adding a client.\n\n### Registering a project via MCP\n\n`register_project` takes a `root_path` (required), an optional `label`, `auto_scan` (default `true`), and an optional `isolation` (`'thin'` or `'host'`). It registers the project the same way the GUI's \"Add project\" flow does:\n\n- Derives a base domain as `<slug>.<defaultTld>` from the label (or the folder name), e.g. `staffhub.test`.\n- Records both the project `path` and `rootPath` so the project is visible to the proxy, scans, and file tools alike.\n- Scans the folder (unless `auto_scan: false`) for apps, services, scripts, and package manager.\n- Creates per-app subdomain mappings from the discovered apps (e.g. `site.staffhub.test \u2192 :3400`), derives the host service subdomains (`api.`, `studio.`, \u2026), and reloads Caddy.\n- **Defaults to `thin` isolation**: the project gets its own loopback IP so its dev servers keep canonical ports (`:3000`) with no cross-project collisions \u2014 run them with `supbuddy run -- <dev command>`. The one exception: if the project's Supabase stack is **already running on the host outside Supbuddy**, registration keeps it on `host` (switching would rewrite its `config.toml` ports and orphan the running stack). Pass `isolation: 'host'` to opt out explicitly, or `isolation: 'thin'` to skip the detection and force thin.\n\nThe response includes an `isolation_note` explaining which mode was chosen and why \u2014 agents should read it instead of assuming.\n\n### Switching isolation over MCP\n\n`switch_isolation` ( `{ project_id, target_mode: 'host' | 'thin', auto_start? }` ) moves an existing project between **host** and **thin** mode. To-thin writes the per-project port block and `project_id` into `supabase/config.toml` and (unless `auto_start: false`) starts Supabase; to-host restores the original `config.toml` and stops that project's stack. It runs in the background and returns `{ started: true }`; poll `get_project` (`isolation`) for the current mode.\n\nA project can also be patched with `update_project`: its `patch` accepts `name`, `enabled`, `domain`, and `isolation` (it intentionally does **not** accept `path`/`rootPath`). Note that patching `isolation` only flips the flag; use `switch_isolation` to actually provision/tear down the port assignment.\n\n### Legacy VM migration over MCP\n\nFor projects still on the retired Isolated (VM) mode, three tools handle the one-way migration to Thin:\n\n- `list_pending_vm_migrations` (read): lists all projects still on the legacy VM mode, with their current `vmState` and migration readiness.\n- `migrate_vm_to_thin` ( `{ project_id }` ) (write): starts the guided data-safe migration. It dumps Postgres data from the VM, starts a fresh Thin stack, restores the dump, and row-count-verifies before signalling completion. Returns `{ started: true }`; poll `get_project` (`migrationState`) for progress.\n- `finish_vm_migration` ( `{ project_id }` ) (write): tears down the old VM container after verification passes. Errors if called before the verify step completes.\n\n### Repointing a project's Supabase config\n\n`set_supabase_config_path` ( `{ project_id, supabase_path }` ) switches which `supabase/config.toml` a project uses, for monorepos that carry more than one (e.g. a repo-root config and an app-level one). `supabase_path` is the project-relative directory **containing** the `supabase/` folder (`\".\"` for the repo root, e.g. `\"apps/getnightowls\"`). It persists the path, re-derives `supabaseProjectId` from the new config, and re-scans services. The previous stack's Docker volume is **left intact** (not deleted), so the switch is reversible; the response reports it under `orphaned_previous_stack`.\n\n### Moving a secret between env files\n\n`copy_env_var` ( `{ source_path, source_key, target_path, target_key? }` ) relocates a single variable from one env file to another (e.g. a value put in an app's `.env.local` that the stack actually injects from the repo-root `.env.local`). The value is read and written entirely inside the worker (it **never crosses the MCP boundary** and never appears in the audit log), so an agent can move a secret without it being printed. `target_key` defaults to `source_key`.\n\n### Plan / apply for destructive tools\n\nTools that delete or mutate state (`delete_mapping`, `delete_project`, `write_env_file`, etc.) return a *plan* with a preview. The MCP client (or you, in the Activity panel) explicitly calls `apply` with the `plan_id` to execute. Plans expire after 5 minutes if not applied. Soft-deletes go to the Trash and are recoverable for 7 days.\n\n## Add-on Compose services\n\nA project can declare **extra** Docker Compose services that Supbuddy discovers, merges, runs, health-checks, and tails alongside the managed stack: a Redis cache, a worker queue, a search engine, etc. Add-on services run on the host's shared Docker daemon in both `host` and `thin` isolation, with no extra setup needed.\n\n### Declaration files & merge precedence\n\nSupbuddy looks for up to three Compose fragments in the project and merges them, later wins:\n\n1. `docker-compose.yml`: your base Compose file.\n2. `docker-compose.override.yml`: your own override, honored if present (standard Compose convention).\n3. `supbuddy.addons.yml`: Supbuddy-owned add-on fragment.\n\nAll present fragments are passed explicitly, e.g. `docker compose -f docker-compose.yml -f docker-compose.override.yml -f supbuddy.addons.yml --project-name <pinned> \u2026`. The project name is pinned so the same set of containers is addressed every time. Add-on services join the Compose project's default network automatically; no extra network setup is needed for them to reach (or be reached by) the rest of the stack.\n\n### `supbuddy.addons.yml` format\n\nA valid Compose fragment (a standard `services:` map) plus an optional Supbuddy-only `x-supbuddy:` extension block. A plain `docker compose up` ignores `x-supbuddy:`, so the file stays usable without Supbuddy. Today `x-supbuddy` supports a one-shot **seed** step:\n\n```yaml\nservices:\n  redis:\n    image: redis:7-alpine\n    ports: [\"6379:6379\"]\nx-supbuddy:\n  seed:\n    service: redis\n    command: [\"redis-cli\", \"ping\"]   # explicit argv, runs once after services are healthy\n    runOnce: true\n```\n\nThe seed step runs **once** after the add-on services are up and healthy. It's idempotent, keyed by a signature of the seed spec, so it only re-runs if the spec changes (or you force it). It fires automatically on project start, and on demand via the `seed_addons` MCP tool.\n\n### MCP tools\n\n- `scaffold_addons` ( `{ project_id }` ): scope `config`. Creates a starter `supbuddy.addons.yml` if the project doesn't have one. Never clobbers an existing file.\n- `seed_addons` ( `{ project_id, force? }` ): scope `services`. Runs the declared `x-supbuddy.seed` step. Idempotent unless `force: true`.\n- `tail_service_logs` ( `{ project_id, service }` ): scope `log_tail`. Streams a Compose/add-on service's container logs over SSE (like `tail_request_logs`, but for container stdout/stderr).\n- `watch_supabase` ( `{ project_id }` ): scope `log_tail`. Streams a project's live Supabase start/stop/restart progress over SSE: `operation` (status + message), `progress` (image-pull/service snapshots), and `log` (raw lines, VM projects). The stream ends on a terminal status. Backs `supbuddy supabase start --follow`.\n\n### Scripts MCP tools\n\nScripts detected in a project (e.g. `dev`, `build`, `test`) are controllable over MCP:\n\n- `list_scripts` ( `{ project_id }` ): scope `read`. Returns all detected scripts with their current status and bookmark state.\n- `start_script` ( `{ project_id, script }` ): scope `services`. Starts the named script process.\n- `stop_script` ( `{ project_id, script }` ): scope `services`. Stops the named script process.\n- `restart_script` ( `{ project_id, script }` ): scope `services`. Stops then starts the named script process.\n- `bookmark_script` ( `{ project_id, script, bookmarked }` ): scope `services`. Pins (`bookmarked: true`) or unpins a script in the Quick Access group.\n- `tail_script_logs` ( `{ project_id, script }` ): scope `log_tail`. Streams the named script's stdout/stderr over SSE.\n\n### `get_compose_status` shape\n\n`get_compose_status` ( `{ project_id }` ) returns live per-service status, not just whether Compose is installed:\n\n```json\n{\n  \"project_id\": \"\u2026\",\n  \"compose_installed\": true,\n  \"running\": true,\n  \"services\": [\n    { \"name\": \"redis\", \"status\": \"running\", \"health\": \"healthy\", \"ports\": [\"6379:6379\"], \"image\": \"redis:7-alpine\", \"container_id\": \"\u2026\", \"source\": \"addons\" }\n  ]\n}\n```\n\nEach service's `source` is one of `base` | `override` | `addons`, telling you which fragment declared it.\n\n## Per-project AI context sync\n\nEach project has a **Context sync: AI tools** panel, accessible via the **AI Tools** tab in the project card, that writes a project-scoped briefing to disk so AI agents working in that repo see your live mappings, services, and isolation state without having to ask. Files written:\n\n- `.supbuddy/`: `README.md`, `mappings.md`, `services.md`, `project.md`, `mcp.md`, `do-not.md`, `docs.md`. The full live snapshot, regenerated on each sync.\n- `AGENTS.md` and `CLAUDE.md`: a small managed block prepended (or updated in place) telling the agent which project this is and pointing it at `.supbuddy/`.\n- Editor skill files when detected: `.cursor/rules/supbuddy.mdc`, `.claude/skills/supbuddy/SKILL.md`, `.codeium/windsurf/rules/supbuddy.md`, `.continue/rules/supbuddy.md`, `.github/copilot-instructions.md`, `.idea/supbuddy.md`.\n- `.gitignore` managed block, ignoring: `.supbuddy/meta.json` (volatile sync state), `*.supbuddy-backup-*` (rollback snapshots), and the per-editor skill files that are written **locally** (see scope below). The rest of `.supbuddy/` is intended to be committed; `AGENTS.md`, `CLAUDE.md`, and `.github/copilot-instructions.md` are also kept committable since you may have hand-written content there alongside Supbuddy's managed block.\n\n### Global vs. local scope\n\nThe per-editor skill files are generic Supbuddy-owned pointers (\"this is a Supbuddy project: read `.supbuddy/`, prefer the MCP tools\"). For editors that expose a **Supbuddy-owned global location**, Supbuddy writes that pointer **once, machine-wide** instead of copying it into every project, so it isn't duplicated across all your repos. Project-specific data always stays local in `.supbuddy/`.\n\n- **Claude Code** \u2192 one global skill at `~/.claude/skills/supbuddy/SKILL.md`. **Cursor** \u2192 `~/.cursor/skills/supbuddy/SKILL.md`. The global skill self-scopes: it only acts when the working directory has a `.supbuddy/` folder, and resolves the active project from that folder's `meta.json`.\n- All other targets (`windsurf`, `continue`, the `AGENTS.md`/`CLAUDE.md`/Copilot managed blocks, JetBrains) stay **local**: their \"global\" files are shared user files, so Supbuddy won't overwrite them.\n- Each target has a **scope** setting: `auto` (default: global for the Claude/Cursor skills, local for everything else), `global`, `local` (force per-project, useful if you commit the file for teammates), or `off`. A machine-global file is reference-counted across projects and removed automatically once no project uses it (on disabling sync, deleting a project, or switching that target back to local). Note: uninstalling Supbuddy (e.g. dragging it to the Trash on macOS) does **not** auto-remove these global files; delete them manually from `~/.claude/skills/supbuddy/` and `~/.cursor/skills/supbuddy/` if needed.\n- The always-loaded `CLAUDE.md`/`AGENTS.md` managed block stays local as a safety net so agents stay aware even if the on-demand global skill doesn't auto-activate.\n\nSync modes per project:\n\n- **Auto**: Supbuddy regenerates the files whenever mappings, services, or project state change.\n- **Manual only**: files are only written when you click **Sync now** (or use the tray's *Sync AI context for all projects*).\n- **Off**: nothing is written.\n\nThe collapsed header shows an at-a-glance status pill: mode (`auto` / `manual` / `off`), a colored dot for the last sync result, and a relative timestamp. Disabled targets (e.g. an editor whose folder isn't present) appear greyed out in the **Detected targets** list inside the panel.\n\n## Supbuddy Cloud\n\nPush a project \u2014 its Supabase schema **and data** \u2014 to a hosted cloud dev-stack (its own full self-hosted Supabase \u2014 Postgres, Auth, REST, Storage, Realtime, Studio behind a gateway \u2014 as an isolated graph of machines on a per-tenant private network) and control it from the app, the CLI, or MCP. **Opt-in and per-project:** nothing cloud-related appears in a project until you've signed in.\n\n- **Get started** \u2014 the top bar shows a **Get started with Supbuddy Cloud** strip; sign in (email/password) there. Once signed in it becomes **Open cloud** (opens [cloud.supbuddy.app](https://cloud.supbuddy.app) in your browser). Sign-in state + the Claude connection also live under **Settings \u2192 Cloud**.\n- **Push a project** \u2014 after signing in, each project's \u22EF menu gains **Push to cloud\u2026**. The push ships the project's stack descriptor + a `pg_dump` of its Supabase data (fail-closed: uploaded to a private bucket via a single-use key, sha-verified, restored *inside* the stack's private network, then deleted). Your **local project stays intact** \u2014 a **\u2601** badge appears on its row; click it (or \u22EF \u2192 **Open in cloud**) to open the stack in the web app.\n- **CLI / MCP** \u2014 the same flow headless: `supbuddy cloud login|push|status|teardown` (password via arg or `SUPBUDDY_CLOUD_PASSWORD`), or the `push_to_cloud` / `get_cloud_status` / `cloud_teardown` / `cloud_sign_in` MCP tools. `project ls` marks pushed projects with \u2601, and `get_project` / `list_projects` carry the `cloud` link. `cloud_teardown` (and the \u22EF teardown) destroy the remote stack and unlink it locally \u2014 routed through the same plan/apply gate as other destructive tools.\n- **Service breadth** \u2014 a self-hosted push provisions the **full** Supabase stack by default. Pass `push_to_cloud`'s `supabase_services: \"minimal\"` (MCP) to opt down to a lean db/auth/REST stack instead.\n- **Idle auto-stop** \u2014 a running cloud stack that reports no activity for ~30 minutes is automatically **stopped** to save cost (its data + config persist; start it again from the web app). A background reaper also reconciles any stack whose machines went missing.\n- **Web console** \u2014 [cloud.supbuddy.app](https://cloud.supbuddy.app) lists your org's stacks; open one for its per-service health, live status, and **start / stop / restart / tear down** controls, plus a **Recent activity** feed of control-plane events. **Push to cloud** in the console provisions a stack from a GitHub `owner/repo` (self-hosted or bring-your-own Supabase; full or minimal service set) \u2014 the code-only path; pushing a local project *with its data* still goes through the desktop app / CLI.\n\n## Command-line interface (CLI)\n\nEverything the desktop app can do is also driveable headlessly from a terminal, with no GUI window. The CLI runs a **daemon** (the same worker process the GUI uses: Caddy proxy, DNS, Supabase/Compose lifecycle, MCP-HTTP) and a set of commands that attach to it over the local MCP-HTTP port. This is for SSH sessions, CI, `tmux`/server boxes, and scripting.\n\nThe binary is `supbuddy`, with a short alias `sup`. Run `supbuddy help` for the full usage list.\n\nYou can install the CLI on its own, without the desktop app:\n\n```bash\nnpx supbuddy@latest        # asks to install the CLI globally (supbuddy + sup)\n```\n\nThat command does nothing on its own except offer to put `supbuddy` and `sup` on your PATH. The CLI runs independently of the desktop app, so you can add the app later (or never). On a Mac the app installs the same two commands for you.\n\n### The daemon\n\n```bash\nsupbuddy daemon --detach        # start the worker in the background\nsupbuddy status                 # daemon + proxy health, plus which worker the daemon is running\nsupbuddy stop                   # graceful shutdown\n```\n\n`--detach` backgrounds the daemon and prints its pid + ports. Foreground `supbuddy daemon` runs it attached (Ctrl-C shuts it down cleanly). On start the daemon writes a discovery file, `daemon.json` (mode `0600`), into the shared state dir holding its pid, the Socket.IO port, the MCP-HTTP port, and a control token; every other command reads it to find and authenticate to the daemon, so you never pass ports or tokens by hand. Only one daemon may run per state dir; a second `daemon` start is refused.\n\nThe CLI and the desktop app **share one state dir** (`~/Library/Application Support/Supbuddy/`), so they manage the same projects, mappings, and settings. They must not run two workers against it at once: if you launch the desktop app while a CLI daemon is running, the app detects it and offers to **stop the daemon and continue** or **quit**. It never forks a competing worker (which would corrupt `state.json`).\n\n### Run on login (service)\n\n```bash\nsupbuddy service install        # start-on-login (launchd on macOS, systemd-user on Linux)\nsupbuddy service status\nsupbuddy service uninstall\n```\n\n### Commands\n\nAll app surfaces have a command. Names follow `supbuddy <module> <action> [args] [--flags]`. The main groups:\n\n| Group | Examples |\n| --- | --- |\n| Dev launcher | `run [--print] -- <dev command>` \u2014 on a Thin project, binds the dev server to the project's loopback IP (from `.supbuddy/meta.json`) so it keeps its canonical port (e.g. `supbuddy run -- next dev` stays on `:3000`) |\n| Health / proxy | `status`, `doctor [--fix]` (health & drift scan \u2014 see *System doctor*), `reset [--tier=soft\\|deep\\|full]` (tiered system reset \u2014 see *System reset*), `proxy status\\|start\\|stop\\|restart` |\n| Mappings | `map ls\\|add\\|get\\|set\\|enable\\|disable\\|rm\\|restore` |\n| Projects | `project ls\\|add\\|get\\|scan\\|set\\|enable\\|disable\\|rm\\|restore\\|env\\|refresh-context` |\n| Supabase | `supabase start\\|stop\\|restart\\|status <proj>` (add `--follow` to stream live progress), `supabase config apply <proj> <file>` |\n| Cloud | `cloud login <email> [<pw>]` (or `SUPBUDDY_CLOUD_PASSWORD`), `cloud push <proj> [--repo=owner/repo] [--force]`, `cloud status [<proj>]`, `cloud teardown <proj>` \u2014 push a project (with its Supabase data) to a hosted cloud stack; `project ls` marks pushed projects with \u2601 |\n| Compose | `compose up\\|down\\|restart\\|status\\|logs <proj> [svcs]` |\n| Scripts | `scripts ls\\|start\\|stop\\|restart\\|logs\\|bookmark <proj> [script]` |\n| Isolation | `isolation switch <proj> <host\\|thin>`, `isolation pending-migrations`, `migrate start\\|finish <uuid>` |\n| Certificates | `ca status\\|install\\|uninstall` |\n| Env files | `env copy <src> <key> <target>`, `env write <path> <K=V>\u2026` |\n| Settings | `settings get`, `settings set --json <patch>` |\n| MCP | `mcp add [<agent>]` (register Supbuddy into a coding agent: interactive, or `--write`/`--print`/`--prompt`), `mcp ls`, `mcp revoke <id>`, `mcp approvals apply\\|cancel <id>` |\n| Host / network | `connect`, `trust`, `tailscale`, `dns`, `pf` (port-forwarding) |\n| Logs | `logs requests [-f]`, `logs audit [-f]`, `logs get <id>` |\n| Account | `account`, `caps`, `addons scaffold\\|seed <proj>` |\n| Dashboard | `tui` (alias `dash`) |\n\nGlobal flags: `--json` (machine-readable output), `--yes` (skip confirmations), `--quiet`, `--url`/`--token` (attach to a specific/remote daemon instead of auto-discovery), `--state-dir` (override the shared dir), `--timeout`, and `-f`/`--follow` for streaming log commands and live `supabase start|stop|restart` progress.\n\nDestructive operations go through the same **plan \u2192 apply** gate as MCP (see *Plan / apply for destructive tools*); the CLI's control token is granted auto-apply, so they execute directly.\n\n### Live dashboard (TUI)\n\n```bash\nsupbuddy tui                    # or: sup dash\n```\n\n`supbuddy tui` opens a full-screen terminal dashboard that attaches to the running daemon and shows live connection/proxy status, the project list (with each project's isolation, Supabase, and Compose state), the mapping count, and a tail of recent requests. Press `r` to refresh, `q` to quit. It needs a running daemon (`supbuddy daemon --detach`); if none is found it tells you so.\n\n### System doctor\n\n```bash\nsupbuddy doctor                              # read-only scan; prints findings by severity\nsupbuddy doctor --fix                        # scan, show the repair manifest, confirm (y/N), then apply\nsupbuddy doctor --fix --only=ca-not-trusted  # restrict repairs to specific check ids (comma-separated)\nsupbuddy doctor --fix --yes                  # skip the interactive confirm (scripting / CI)\n```\n\n`supbuddy doctor` runs a **read-only** health and drift scan and prints its findings grouped by severity \u2014 **critical**, **warning**, **info** \u2014 each with a title, a one-line detail, and concrete evidence (paths, container names, certificate fingerprints). The scan mutates nothing and exits non-zero when any finding is **critical**, so you can gate a script or CI on it.\n\n`--fix` re-scans, prints a **manifest** \u2014 one line per fixable finding, taken from the scan you just saw \u2014 and, unless you pass `--yes`, asks `Apply these fixes? [y/N]` (default **No**) before touching anything. (The desktop app's doctor panel shows the finer-grained repair *actions* themselves; the CLI lists the findings those actions belong to.) `--only=<comma,ids>` restricts the repair to specific check ids; `--yes` skips the prompt for non-interactive use. This is the **confirm-before-harm** contract: the scan is read-only, and every repair is opt-in and gated. Fixes that need elevated access prompt for your password when they run.\n\nA repair that ends up doing nothing is reported as such, never as success: if a requested check's finding is already gone, is advisory, can't be re-checked, or names an unknown id, it's listed under **NOT APPLIED** and the command exits non-zero.\n\nThe doctor ships **18 checks**. Rows marked **Advisory** have **no auto-fix at all**: `--fix` will never touch them, and the finding's detail tells you what to do by hand. Checks marked *macOS* return nothing on other platforms.\n\n| Check id | Severity | What it flags | Auto-fix |\n| --- | --- | --- | --- |\n| `state-corrupt` | critical | `state.json` can't be parsed (or isn't an object), so the daemon boots with **empty** state \u2014 no projects, mappings, settings or MCP clients | Copies the file aside as `state.json.corrupt-<timestamp>` so you can hand-recover it. Nothing is deleted or rewritten |\n| `caddy-stuck` | critical | Caddy is alive but its admin API is wedged, so config reloads can't land | Restarts Caddy (stop \u2192 start) |\n| `caddy-ipv4-unreachable` | critical | Caddy's loaded config declares an HTTPS listener but `127.0.0.1:<port>` **refuses** connections \u2014 every IPv4 client is cut off (browsers, curl, and the pf 443\u21928443 redirect) while the process is up and its admin API answers | **Advisory \u2014 no auto-fix.** Run `supbuddy proxy restart` to rebind. Only a connection **refused** counts: a *timeout* on a pf redirect target is normal (the reply is reverse-NAT'd back to :443 and never matches your socket), so it is never reported as a fault |\n| `ca-not-trusted` | warning | The local CA exists but the **current** root isn't trusted in the System keychain (the padlock stays broken). Detection is by fingerprint, so a stale same-name root from an earlier CA no longer counts as installed | Installs it into the System keychain (`security add-trusted-cert`; asks for your password). Where trust **cannot be read at all** (Windows) this drops to **advisory, info, no auto-fix** \u2014 it reports what to import by hand rather than offering a repair that can't run |\n| `pf-not-enforcing` | warning | Port forwarding is configured but 443 isn't redirecting | **Advisory \u2014 no auto-fix.** Run `supbuddy proxy restart`: only that path re-runs the privileged pf setup, so the doctor won't claim a success it can't deliver |\n| `duplicate-caddy-ca` | warning | *macOS.* Stale same-name `Caddy Local Authority` roots with a different key \u2014 the cause of Firefox-family `SEC_ERROR_BAD_SIGNATURE` | Deletes the stale roots **and installs the current one** in a single elevated batch (asks for your password). Delete-only could leave a machine with no trusted Caddy root at all when the current one wasn't in the keychain yet |\n| `orphan-caddy-container` | warning | A leftover pre-binary-era `supbuddy-caddy` Docker container | Removes the container, its `supbuddy-net` network and its data/config volumes (the `caddy:latest` image is kept) |\n| `orphan-lo0-aliases` | warning | *macOS.* `127.0.0.N` aliases on `lo0` owned by no Thin project \u2014 deleting a Thin project never tore its alias down | Removes only those aliases (asks for your password); `127.0.0.1` and any non-Supbuddy alias are left alone |\n| `orphan-dind` | warning | Docker-in-Docker containers from the retired Isolated (VM) mode belonging to no registered project \u2014 each one confirmed to actually be a DinD first | Force-removes those containers and their `<name>-docker` data volumes. **This is project data**: if you deleted a project and chose to keep its data, this is that data. The Caddy container and non-Supbuddy containers are never touched |\n| `orphan-supabase-volumes` | warning | Docker volumes of Supbuddy-managed (`sb-`-prefixed) Supabase stacks owned by no registered project | Removes those volumes. **This is database data.** Host-mode stacks, stacks you started yourself, and projects still in the MCP trash (restorable for 7 days) are never touched |\n| `orphan-launchagents` | warning | *macOS.* Legacy CA-trust LaunchAgents from older builds that re-export `SSL_CERT_FILE` / `REQUESTS_CA_BUNDLE` / `NODE_EXTRA_CA_CERTS` at every login and break **public** TLS | Boots each agent out and removes it, leaving a `.supbuddy-backup` copy alongside. Root-owned agents under `/Library` may resist; the fix reports those as a failure instead of claiming success |\n| `orphan-electron-token-files` | warning | Leftover `~/.config/Supbuddy/mcp/<clientId>.bin` token files from the retired Electron app, for clients that no longer exist | Deletes those files (no elevation). They can't be decrypted any more anyway; clients that are merely revoked keep their record and are left alone |\n| `orphan-mcp-secrets` | warning | `secrets/mcp-<clientId>.secret` files whose token can no longer authenticate (client revoked, or no record at all) | Deletes those files (no elevation) \u2014 it can't log a working agent out. Secrets for current clients, and the non-MCP secrets stored alongside them (license, cloud session, Tailscale key), are left untouched |\n| `unmanaged-supabase` | info | A Supabase stack on the host daemon that maps to no registered project (e.g. a plain `supabase start`) | **Advisory \u2014 no auto-fix.** Supbuddy never tears down a stack you started yourself; run `supabase stop` in its project if you don't need it |\n| `stale-resolver-files` | info | *macOS.* Supbuddy-marked `/etc/resolver/<suffix>` files for suffixes no **enabled** project or mapping claims any more (deleted projects, a disabled one, an older per-project TLD) | Removes only those files (asks for your password); suffixes still in use are left alone. Reversible \u2014 enabling the project or restarting the proxy writes the file back |\n| `pf-conf-backups` | info | *macOS.* `/etc/pf.conf.backup.<timestamp>` copies piled up in `/etc` by older versions (which wrote a new one on every port-forwarding disable) | Removes the redundant copies, **keeping the newest one** and the stable `/etc/pf.conf.supbuddy-backup` (asks for your password) |\n| `stale-mcp-config-tokens` | info | An agent config (`~/.claude.json`, Claude Desktop, Cursor, Codex, Windsurf, or a registered project's `.mcp.json` / `.cursor/mcp.json`) holds a `mcpServers.supbuddy` token Supbuddy no longer accepts \u2014 the 401 \"Token not recognized\" state | **Advisory \u2014 no auto-fix.** Supbuddy won't rewrite config files you own and edit. Delete the `mcpServers.supbuddy` entry from the file named in the finding, or run `supbuddy mcp add <agent>` to mint a fresh token. The finding names the file, never the token |\n| `stale-browser-nss-roots` | info | *macOS.* A Firefox / Zen / LibreWolf / Waterfox profile whose own NSS store (`cert9.db`) holds a `Caddy Local Authority` root Supbuddy can't reach | **Advisory \u2014 no auto-fix.** Nothing is wrong unless that browser shows certificate errors. Fix it there: Settings \u2192 Privacy & Security \u2192 Certificates \u2192 View Certificates\u2026 \u2192 Authorities, delete every `Caddy Local Authority` entry, then re-import Supbuddy's CA |\n\nThe same scan and repairs are available over MCP as the `doctor` and `doctor_fix` tools (see *MCP tool surface*), and in the app under **Settings \u2192 General \u2192 System health \u2192 Scan** \u2014 the panel scans on open, groups the findings by severity, and gates every repair behind the same manifest + confirm step (see *Settings reference \u2192 General*). The panel has no reset button: a wipe stays a CLI operation.\n\n### System reset\n\n```bash\nsupbuddy reset                        # soft (the default): app state + caches\nsupbuddy reset --tier=deep            # + services, Caddy containers, system integrations, CA trust\nsupbuddy reset --tier=full            # + project data, repo artifacts, secrets, service, app data\nsupbuddy reset --tier=deep --yes      # skip the y/N confirm (scripting / CI)\nsupbuddy reset --tier=full --yes --i-understand   # the ONLY scripted path for a full reset\n```\n\n`supbuddy reset` removes Supbuddy's footprint from your machine in **tiers**, and each tier is a superset of the one before it:\n\n| Tier | What it removes |\n| --- | --- |\n| `soft` (default) | App state \u2014 projects, mappings, settings, MCP clients, project-context sync and user-skill records \u2014 plus the Docker image cache (`<app-data>/image-cache`, images are re-pulled on demand) and the buffered request log. It touches **no** Docker container or volume, **nothing** under `/etc`, and **no** file in your repos, so it never asks for your password |\n| `deep` | \u2026plus: stops every service; removes the leftover Caddy container/network/volumes, the `/etc/hosts` entries, the `/etc/resolver` files, the pf `:80`/`:443` redirect, the `127.0.0.N` loopback aliases, the bundled-runtime CA trust and the `Caddy Local Authority` roots in your keychain, and the token files of already-revoked MCP clients. **Your data is preserved**: no Supabase volume, no DinD container, no repo file and no *live* MCP token is touched \u2014 `deep` unwinds what Supbuddy installed on the machine, it is not a data wipe |\n| `full` | \u2026plus **your project data, backed up first**: every Supbuddy-**managed** (`sb-`-prefixed) Supabase stack's data volumes and every DinD container with its data volume, the `.supbuddy/` directories, managed blocks and `.env.supbuddy` files in your registered repos, and **every** credential (license, live MCP tokens, cloud session, Tailscale key) \u2014 then it uninstalls the start-on-login service and empties the app-data directory. A **host-mode** project's Supabase stack is only *stopped*: those containers and volumes are yours, and they are kept |\n\nMost steps enumerate what's actually on your machine first, so anything that isn't there drops out of the manifest instead of being advertised and skipped. `soft` needs no elevated access at all. `deep` batches the pf redirect, the resolver configuration and the loopback aliases into **one** password prompt; the legacy `/etc/hosts` block and the keychain CA removal ask separately, so expect up to three. `full` may prompt more than once as it tears projects down.\n\n**Reset is a CLI operation, on purpose \u2014 there is no reset button in the app.** The gates that make a wipe safe don't survive the trip into a GUI: a typed `RESET`, a refusal on non-interactive input, and a daemon confirmation the app itself would be answering. On top of that, `--tier=full` refuses outright while the desktop app is running (its watchdog respawns the daemon ~20s after it stops), so a button for it would be a trap. The app's **Settings \u2192 General \u2192 System health** panel points here instead.\n\n**Backup before harm.** Anything you can't regenerate \u2014 `state.json`, every managed Supabase database that is running (`pg_dump`, custom format, with a `.sha256` alongside), every managed data volume (`tar.gz`, verified with `gzip -t`) \u2014 is written to `<app-data>/backups/reset-<timestamp>/` **before** a single destructive step runs, and if any backup fails the whole reset **aborts before destroying anything**. The directory is printed prominently before you confirm, and again when the reset finishes; `manifest.json` inside it records exactly what was planned and what ran. On top of that coarse guarantee, each volume is gated individually: **no archive, no removal** \u2014 a volume with no non-empty `.tar.gz` next to it is left alone and the run records why.\n\n**A backup that can't be written stops the reset \u2014 safely.** Archiving a volume is given ten minutes; a genuinely large one (tens of GB of Postgres data plus a DinD image cache) can exceed that, and when it does the reset **aborts with nothing destroyed**. Stop the stack and prune what you don't need (`docker system prune`, drop old branches/schemas), or archive that volume yourself, then run the reset again. The same applies to any other backup failure: a full disk, an unreadable volume, a Docker daemon that stops answering.\n\n**The backups survive a full reset.** They live inside the app-data directory, so the last step of `--tier=full` empties that directory *content-wise and skips `backups/`* rather than deleting it wholesale. Move that directory somewhere safe afterwards \u2014 it's the only copy.\n\n**Confirmation.** Every tier prints the **manifest** first \u2014 the literal list of actions that will run, derived from the same actions the engine executes. `soft` and `deep` then ask `Apply this \"<tier>\" reset? [y/N]` (default **No**); `--yes` skips that prompt. `--tier=full` requires you to **type the word `RESET`** \u2014 `--yes` alone does **not** bypass it. The one scripted path for a full reset is `--yes --i-understand`, both flags together. Every prompt refuses on a non-interactive (piped) stdin rather than proceeding.\n\n**The daemon confirms too.** `soft` and `deep` run inside the daemon, which asks for its own approval before it starts \u2014 the same gate as `doctor --fix` and `ca uninstall`. With the Supbuddy app open you get a native **Allow / Deny** dialog. A daemon with neither a dialog nor a terminal \u2014 the start-on-login service, or an app-spawned daemon while the app is closed \u2014 has nobody to ask and **denies**; run a foreground `supbuddy daemon` in one terminal and the reset from a second, and it will prompt there. Don't reach for `supbuddy daemon --yes` to get past it: that auto-approves *every* confirmation for that daemon's whole lifetime.\n\n**Quit the app before a full reset.** The desktop app supervises the daemon and restarts it about 20 seconds after it stops, which would put a live daemon back into the directory the last step clears. `--tier=full` refuses up front while the app is running \u2014 before it asks you to type `RESET`, and before it changes anything. Quit the app (menu bar icon \u2192 Quit) and run it again; the quit dialog's default **Leave running** is fine, since the reset stops the daemon itself. The check looks for the *app* process only, so nothing else has to change. `--tier=full` also runs with no daemon at all, so if you quit with **Stop service** you can go straight ahead.\n\n**The order of a full reset**, once you've confirmed: the start-on-login service is uninstalled, the daemon is stopped and waited for (the reset refuses to run against a live daemon, which would rewrite `state.json` underneath it), the backup and teardown steps above run, and only then is the app-data directory emptied \u2014 keeping `backups/`. If the reset aborted, or if a daemon came back while it was running, the app-data directory is left in place and the CLI tells you so rather than clearing it under a live process.\n\n`soft` and `deep` are also available over MCP as the plan-gated `system_wipe` tool (see *MCP tool surface*). `--tier=full` is **CLI-only**: it deletes the credentials any agent would be calling with, and a daemon cannot uninstall the service it runs under or delete the directory it runs from.\n\n**What a full reset does not remove.** It only ever touches paths of **registered** projects \u2014 there is no disk scan for stray `.supbuddy` directories \u2014 and it won't delete or rewrite files whose ownership is ambiguous. So after `--tier=full` these are still on disk, and you can remove them by hand:\n\n- Per-editor rule files Supbuddy wrote in your repos: `.cursor/rules/supbuddy.mdc`, `.claude/skills/supbuddy/SKILL.md`, `.codeium/windsurf/rules/supbuddy.md`, `.continue/rules/supbuddy.md`, `.idea/supbuddy.md`. Shared files (`CLAUDE.md`, `AGENTS.md`, `.gitignore`, \u2026) keep their content and only lose Supbuddy's sentinel-delimited block.\n- Values `apply_env` merged into your **own** `.env*` files. The fully-owned `.env.supbuddy` files *are* deleted.\n- The bare `.env.supbuddy` line in `.gitignore` \u2014 it sits outside the managed block.\n- `vite.config.*` `allowedHosts` and `next.config.*` dev-origin patches.\n- `supabase/config.toml` port / `project_id` patches, when restoring the original file failed during the Thin teardown.\n- MCP client config entries written by `mcp add` / `install_mcp_config` (`~/.claude.json`, Claude Desktop, Cursor, Codex, Windsurf, a project `.mcp.json` / `.cursor/mcp.json`). The token they hold is dead the moment the secrets are deleted; `supbuddy doctor`'s `stale-mcp-config-tokens` check will name each file.\n- The `caddy:latest` Docker image (shared and re-pullable) and anything a host-mode project owns.\n- The Supbuddy app itself \u2014 drag `Supbuddy.app` to the Trash \u2014 and the backups directory, which is the whole point of keeping it.\n\n## Settings reference\n\nOpen Settings via the gear icon top-right or by clicking the tray icon \u2192 Open Dashboard \u2192 gear. Five tabs.\n\n### General\n\n- **Theme**: dark or light.\n- **Auto-start at login**: registers Supbuddy as a macOS login item. Default: on.\n- **Default TLD**: applied to new auto-generated mappings. Existing mappings are renamed to the new TLD on save. Default: `test`.\n- **Default isolation**: `host` or `thin` for newly added projects. Default: `thin` (per-project loopback IP; apps keep canonical ports like `:3000`). MCP registration additionally keeps a project on `host` when its Supabase stack is already running on the host outside Supbuddy.\n- **Auto-subdomain mapping**: when on, services and apps detected during a project scan get mappings created automatically. Default: on.\n- **Bundled-runtime trust**: installs Supbuddy's local root CA into a place that apps with bundled JavaScript runtimes (Claude Code, Cursor, Windsurf, Continue, Codex CLI, OpenCode, \u2026) actually read. These apps don't consult the system Keychain (they ship their own Mozilla bundle), so without this they fail OAuth/MCP/HTTPS calls to `*.test` with `unable to get local issuer certificate`. Default: prompted on first launch when one of those tools is detected.\n  - **macOS**: writes `~/Library/LaunchAgents/com.cueplusplus.supbuddy.bundled-runtime-ca-trust.plist` and calls `launchctl setenv NODE_EXTRA_CA_CERTS` so GUI-launched apps inherit it at process-start time.\n  - **Linux**: writes `~/.config/environment.d/supbuddy-ca.conf` (read by systemd-aware user sessions on GNOME/KDE/Sway/etc.).\n  - **Windows**: per-user `setx NODE_EXTRA_CA_CERTS` to `HKCU\\Environment`.\n  - **Only `NODE_EXTRA_CA_CERTS` is set session-globally**, because it is *additive* \u2014 Node appends the file to its built-in public roots, so a stale or wrong value can never strip public trust. `SSL_CERT_FILE` / `REQUESTS_CA_BUNDLE` are deliberately **not** set globally: they *replace* the entire trust store, and pointing them at a local-only bundle breaks every public TLS handshake in the login session. Older builds did set them; install and every boot reconcile now actively unset them. OpenSSL/Python tools that need local trust get it per-project, from the merged public+local bundle.\n  - It points at `~/Library/Application Support/Supbuddy/ca-bundle/current.crt` (or the platform equivalent), a *cumulative* concatenated PEM Supbuddy maintains \u2014 **not** Caddy's own `caddy-data/\u2026/pki/authorities/local/root.crt`, which rotates independently. When Caddy rotates its root (yearly today, sometimes more), Supbuddy appends the new root automatically; long-running TLS contexts holding the old root keep working until the process restarts. Reading trust status also verifies Caddy's *active* root is actually in the bundle and re-appends it if not, so a rotation can't be missed just because the file watcher wasn't running.\n  - **Test trust**: runs an in-process HTTPS request against the first available `*.test` mapping with the same env vars set, to verify end-to-end without relaunching anything. It probes the **real access path** (port 443 when port forwarding is on, otherwise the high port), matching what real clients hit, so it doesn't false-negative against a port nothing is forwarding.\n  - **Effective-value detection**: status reports the value *in effect*, not just the one Supbuddy set. `launchctl setenv` cannot retro-patch an already-running process, so an app launched before an install keeps whatever it captured and hands that to every shell and dev server it spawns \u2014 a terminal can be using a completely different CA path from the one `launchctl getenv` prints. Supbuddy samples three places: what it set, what a fresh login shell resolves, and what live processes actually hold. Divergent values are listed with the app to relaunch (and flagged when the file no longer exists \u2014 Node ignores a missing `NODE_EXTRA_CA_CERTS` silently, which presents as `unable to get local issuer certificate` with nothing to explain it).\n  - **Conflict refusal**: if `NODE_EXTRA_CA_CERTS` is already set to a bundle Supbuddy doesn't own (corporate proxy, Zscaler, another vendor's CA), install refuses and surfaces the conflicting path. You can override with the explicit prompt that pops up on Install. A path Supbuddy *does* own but that isn't the current bundle \u2014 an older build's value, or Caddy's `root.crt` from a hand-rolled setup \u2014 is not a conflict: install corrects it.\n  - **Quit and relaunch your AI tools** after install: the env var only takes effect for *newly-launched* processes. Install names any app still holding an older path.\n- **System health** (**Scan**): opens the **System Doctor** panel \u2014 the same read-only, 17-check health & drift scan as `supbuddy doctor` (see *System doctor*), in the app. Opening the panel only scans; it changes nothing.\n  - Findings are grouped **critical \u2192 warning \u2192 info**, each with its title, one-line detail, concrete evidence (paths, container names, fingerprints), check id and category. **Rescan** re-runs the scan; the header shows the counts. A scan that times out says so and points at `supbuddy doctor` \u2014 the daemon is installed and updated separately from the app, and one older than this panel doesn't answer its channels.\n  - **Fix\u2026** on a fixable finding \u2014 or **Fix all (n)** in the header \u2014 never repairs anything by itself. It opens the **manifest**: the literal list of actions that would run, each marked *destructive* or *safe*, built from the same actions the engine executes. **Apply** stays disabled until that manifest has loaded and contains at least one action, so an empty or failed plan can't be rubber-stamped. Same confirm-before-harm contract as `doctor --fix`.\n  - Repairs that need elevated access ask for your password when they run. One that outlives the app's 15-second reply window (a password prompt sitting open) is reported as *may still be running \u2014 rescan in a moment*, not as a failure.\n  - Findings with no auto-fix show **advisory** instead of a Fix button; the detail says what to do by hand. Checks that couldn't run at all are listed at the bottom as *Checks that could not run*, rather than being silently dropped.\n  - **There is no reset button here, on purpose** \u2014 the footer points at `supbuddy reset` instead. See *System reset*.\n\n### Network\n\n- **HTTP port**: default 8080.\n- **HTTPS port**: default 8443.\n- **DNS port**: default 5353.\n- **Port forwarding**: when on, inserts a `pfctl` rule mapping 80\u2192HTTP port and 443\u2192HTTPS port into `/etc/pf.conf` (correct translation-section placement; self-heals a file corrupted by older versions). Asks for sudo once. Status reflects a live 443 enforcement probe, not just file presence.\n- **LAN sharing**: binds Caddy to `0.0.0.0` + starts mDNS responder.\n- **Tailscale**: paste a tailnet API key to enable split-DNS push.\n- **Install / Uninstall CA**: **Install** adds Caddy's root cert to your System keychain (removing any stale same-name roots first); **Uninstall** removes every `Caddy Local Authority` root it added. macOS asks for your password each time.\n\n### Storage\n\nTrash retention (per-kind), volume sizes, image-cache controls.\n\n### MCP\n\n- **Clients**: list of connected clients. Each row has a **\u22EF** actions menu: install, edit scopes, set-primary, rotate token, revoke.\n- **Activity**: audit log with Apply/Cancel/Undo on plan rows.\n- **Trash**: soft-deleted mappings and projects, restorable for 7 days.\n- Settings: server `enabled`, `port` (default 9877), `audit_cap` (default 5000), `trash_ttl_days` (default 7).\n\n### AI Skills\n\nInstall Supbuddy's agent **skill at the user level** (machine-wide) so the agent sees Supbuddy in every repo without per-project setup. Each global-capable agent has a **master on/off** plus an **autosync** toggle (keeps the installed skill refreshed when Supbuddy updates it) and shows its install path + version.\n\n- **Who can install at user level**: only agents whose global file Supbuddy fully **owns** and that **self-scope** (act only when the working directory has a `.supbuddy/`): **Claude Code** (`~/.claude/skills/supbuddy/SKILL.md`) and **Cursor** (`~/.cursor/skills/supbuddy/SKILL.md`). The install is reference-counted under a synthetic `__user__` ref so it persists independent of any project and is never pruned by the boot reconcile.\n- **Master \u2194 project**: the AI Skills tab is the **master** (user-level). To commit a skill into a specific repo, use that project's **AI Tools** tab and set the target to **Project** (the old `local` scope, which writes into the repo for teammates); **User** there means the master install covers it.\n- Agents whose global file holds *your own* content (Claude `CLAUDE.md`, Codex `AGENTS.md`, Copilot, Windsurf, Continue, JetBrains) are **project-level only**: a machine-wide write there could clobber your config, so they're injected per-project instead.\n\n## Tray menu\n\nThe macOS menu bar tray icon opens a menu with:\n\n- **Status: \u2026**: current proxy state (running / idle).\n- **DNS Active (:5353)**: shown when proxy is running.\n- **LAN Sharing (\\<ip\\>)**: shown when LAN sharing is on.\n- **Tailscale (\\<ip\\>)**: shown when Tailscale is connected.\n- **Start Proxy / Stop Proxy**: opens the dashboard.\n- **Projects**: each project opens a submenu with **Apps** (click to open the mapped URL), **Supabase** services (status dot + open), and **Scripts** (your bookmarked scripts as a one-click **Start <name>** / **Stop <name>** toggle), plus **Restart Supabase**/**Restart services** and **Show in Supbuddy**.\n- **Open Dashboard**.\n- **Sync AI context for all projects**: runs the project-context sync engine for every registered project (writes `.supbuddy/`, `CLAUDE.md`, `AGENTS.md`, etc.).\n- **Show Logs**: reveals `main.log` in Finder.\n- **Check for Updates...**: manual update check (only enabled in packaged builds).\n- **Quit**.\n\n## File locations\n\nAll under `~/Library/Application Support/Supbuddy/` on macOS:\n\n- `main.log` + `main.log.1`: app logs (rotates at 2 MB).\n- `state.json`: persistent state (projects, mappings, settings, MCP clients, license).\n- `caddy-data/`: Caddy's data dir (PKI, autosaves, certs).\n- `caddy-data/caddy/pki/authorities/local/root.crt`: the local CA cert installed in your Keychain.\n- `ca-bundle/current.crt`: cumulative PEM containing every Caddy root that has ever been emitted. Used by **Bundled-runtime trust** as the target for `NODE_EXTRA_CA_CERTS` / `SSL_CERT_FILE` / `REQUESTS_CA_BUNDLE`. Real file (not a symlink) so Bun-bundled CLIs read it correctly.\n- `ca-bundle/versioned/<sha>.crt`: per-root snapshots for forensics.\n- `Caddyfile`: generated reverse-proxy config.\n- `daemon.json`: written while a headless CLI daemon is running (pid, Socket.IO + MCP-HTTP ports, control token); `0600`, removed on shutdown. Used by `supbuddy` CLI commands to discover and authenticate to the daemon, and by the desktop app to detect a running CLI daemon at launch.\n- `certs/`: legacy CA from the pre-Caddy era (unused in current builds).\n\nMCP-specific:\n\n- MCP client tokens (file-backed secret, mode `0600`): `~/Library/Application Support/Supbuddy/secrets/mcp-<client-id>.secret`\n- MCP audit log: under `~/Library/Application Support/Supbuddy/`, capped at `audit_cap` entries (default 5000).\n\n## Troubleshooting\n\n### Run a health & drift scan first (`supbuddy doctor`)\n\nWhen something's off, `supbuddy doctor` is the quickest triage. It runs a **read-only** scan of 18 checks and prints findings by severity, and many of the issues below have a matching check \u2014 an unreadable `state.json`, an untrusted CA, a wedged Caddy, port 443 not redirecting, stale duplicate CA roots, legacy CA-trust LaunchAgents poisoning public TLS, an agent config still holding a revoked MCP token, a Firefox profile pinning an old Caddy root, and leftovers from deleted projects (Docker containers/volumes, `127.0.0.N` loopback aliases, `/etc/resolver` files, MCP token files). Add `--fix` to apply the opt-in repairs after a confirmation prompt \u2014 some checks are advisory and have no auto-fix. See [System doctor](#system-doctor) for the full check list and flags.\n\n### Browser shows \"Not secure\" or certificate warning\n\nThe Caddy CA is not trusted. Open **Settings \u2192 Network \u2192 Install Certificate**. macOS will prompt for your password. After install, fully restart your browser (Cmd+Q, not just close window). Verify: *Keychain Access* \u2192 System keychain \u2192 search for \"Caddy Local Authority\".\n\n### \"unable to get local issuer certificate\" / \"self signed certificate in certificate chain\" from Claude Code, Cursor, MCP servers, or other AI tools\n\nThese tools ship their own bundled JavaScript runtime (Bun, Electron, pkg-bundled Node) and ignore the system Keychain. Open **Settings \u2192 General \u2192 Bundled-runtime trust** and click **Install**. Then *fully quit and relaunch* the AI tool; the env var only takes effect for newly-launched processes. Verify with `launchctl getenv NODE_EXTRA_CA_CERTS` (macOS); it should print `~/Library/Application Support/Supbuddy/ca-bundle/current.crt`. If install is refused with a conflict warning, you already have `NODE_EXTRA_CA_CERTS` pointing at a bundle Supbuddy doesn't own (often a corporate proxy / Zscaler), so Supbuddy won't silently overwrite; use the override prompt or manually concatenate the two PEMs.\n\nIf it *still* fails after a relaunch, the process is probably not using the value `launchctl getenv` prints. Compare them:\n\n```bash\nlaunchctl getenv NODE_EXTRA_CA_CERTS                     # what Supbuddy set\nnode -e \"console.log(process.env.NODE_EXTRA_CA_CERTS)\"   # what your shell actually has\n```\n\nIf they differ, an app launched *before* the install captured the old value and is handing it to every shell and dev server it spawns \u2014 `launchctl setenv` cannot change an already-running process. The trust panel lists the divergent value and names the app to relaunch; quitting and reopening that app (not just the terminal tab) fixes it. A value pointing at Caddy's own `caddy-data/\u2026/pki/authorities/local/root.crt` is the classic case: that file rotates independently of Supbuddy's bundle, so the two agree until they suddenly don't.\n\n### \"Docker is not running. Please start Docker Desktop.\"\n\nCompose and Supabase features need Docker. Open Docker Desktop and wait until the whale icon stops animating.\n\n### \"Docker Compose is not installed\"\n\nCompose v2 ships inside Docker Desktop. If you removed Docker Desktop and are using a standalone Docker daemon (e.g. Colima, Rancher), install compose: `brew install docker-compose`.\n\n### \"Leftover host containers\" / \"isolation drift\" warning on a project\n\nSupbuddy flags **isolation drift** when a project's running containers don't match its configured isolation mode, for example a **Host** project with a stale `thin`-mode stack still running, or a **Thin** project with leftover host-mode containers. Switching isolation modes doesn't tear down the old layer, so those containers linger, waste resources, and can shadow the project's real stack. The warning appears in the **warnings chip** next to the enable toggle (click it to see each item; it shows a spinner while Supbuddy re-checks), as an entry in the issues counter, and as a notice on the **Supabase** tab listing the exact containers and any data volumes.\n\n**Guided cleanup.** Open the Supabase tab \u2192 **Clean up leftovers\u2026** to stop and remove the leftover containers. Data volumes are kept by default; deleting them is opt-in, and when the leftover copy looks newer than the active one, it requires an explicit choice and a backup (tarred to `\u2026/Supbuddy/backups/<project>-<timestamp>/`). If you recently migrated a VM project, any leftover VM container from before migration can also be cleaned up from this flow.\n\nIf the leftover copy's data looks **newer** than the active one, the warning turns red; don't delete its volumes without first deciding which copy to keep. The Configure tab also shows a dismissible note when Supabase stacks are running on your host that Supbuddy doesn't manage at all (e.g. a plain `supabase start`).\n\n### MCP client says \"Invalid OAuth error\" or \"JSON Parse error: Unexpected EOF\"\n\nThe MCP client is trying OAuth discovery and getting an empty 404. Either the token was lost (regenerate it in **Settings \u2192 MCP \u2192 the client's \u22EF menu \u2192 Rotate token**) or you're on a build older than the OAuth-probe fix. Update to the latest version; the server now answers OAuth discovery paths with a structured 404 instead of an empty body, and 401 responses include `WWW-Authenticate: Bearer` so the client doesn't fall back to OAuth.\n\n### MCP token disappeared after app restart\n\nFixed in recent builds. If you're on an older version, regenerate the token. Root cause was that `addMcpClient` didn't trigger state persistence; the client was held in memory only.\n\n### Server Actions return 403 in a Next.js app behind Supbuddy\n\nNext.js's CSRF guard rejects POSTs whose Origin isn't in `experimental.serverActions.allowedOrigins`. Supbuddy detects this and flags it in the warnings chip: open the **Apps** tab and hit **Fix** on the affected app for a paste-ready snippet, or **Apply\u2026** to preview a unified diff and write the change to `next.config` directly. After applying, restart your dev server.\n\nOn **Next.js 15.3+/16**, a proxied dev request can also be blocked (e.g. a \"Cross origin request detected\" warning) because Supbuddy now passes the real browser `Origin` through rather than rewriting it, and Next validates it against `allowedDevOrigins` (which defaults to `localhost`). Add your Supbuddy domain to `allowedDevOrigins` in `next.config` \u2014 see [Next.js cross-origin dev requests](#nextjs-cross-origin-dev-requests-alloweddevorigins). This is a separate key from the Server Actions list; 15.3+/16 may need both.\n\n### Vite dev server returns \"Blocked request. This host is not allowed.\" (403)\n\nVite (v5+) rejects requests whose `Host` header isn't in `server.allowedHosts`, so a Vite app reached through a Supbuddy domain 403s until the host is allowed. Supbuddy detects this and flags `vite: N hosts blocked` in the warnings chip: open the **Apps** tab and hit **Fix** on the affected app for a paste-ready snippet, or **Apply\u2026** to preview a diff and write `server.allowedHosts` into your `vite.config` directly. **Restart the Vite dev server afterward**; Vite does not hot-reload its config. A single `.your-project.local` entry covers every subdomain.\n\n### Supabase Realtime: channel reaches `SUBSCRIBED` but no `postgres_changes` events arrive\n\nIf a channel subscribes fine (and writes succeed) but change events never fire, this is almost always **realtime warmup timing right after the stack starts** \u2014 not the Supbuddy proxy. Local Realtime can accept a channel join and report `SUBSCRIBED` before its logical-replication binding for the tenant is ready, so `INSERT`/`UPDATE`s in that brief window are silently missed. Give the stack a few seconds after the Supabase tab goes green, then re-subscribe (or reconnect the channel). This is **unrelated to the `.local` domain**: Kong routes `/realtime/v1/*` by path and rewrites the upstream `Host` to its internal realtime tenant, so reaching realtime through `https://api.<project>.local` behaves identically to the raw `localhost:54321` port \u2014 forwarding the `.local` host upstream does not change tenant resolution. The new `sb_publishable_*` / `sb_secret_*` API keys also work for local realtime (Kong maps them to the legacy JWT), so you don't need to switch key formats.\n\n### Project shows a red \"PROXY ERROR\" banner: domain resolves but won't load\n\nAfter the proxy starts, Supbuddy runs an end-to-end reachability check: it resolves a project domain through the OS resolver and tries to connect to Caddy on the HTTPS port. If the name resolves but the connection fails, the project shows a red **PROXY ERROR** banner naming the likely cause (DNS, port-forwarding, or mDNS race) plus a recovery action.\n\nThe most common case: the domain resolves to `127.0.0.1` but port 443 won't connect because the elevated `pfctl` 443\u21928443 redirect drifted away (typically after a restart, so Caddy is up on 8443 with nothing forwarding 443). Click **Retry**; as of v2.3.6 it re-applies the port-forwarding rule (approve the sudo prompt). On older builds, toggle the proxy off\u2192on instead. If LAN sharing is **off**, disregard any \"LAN sharing / Bonjour\" wording in the banner; the cause is the missing forward, not mDNS.\n\n### Port forwarding is on but 443 won't connect\n\nSupbuddy reports port forwarding as **active** only when a live probe confirms 443 actually reaches Caddy \u2014 the rule being on disk isn't enough. If the rule is present but not being enforced (typically right after a reboot, or when an older Supbuddy version left `/etc/pf.conf` in a broken state), the status carries a `pf_not_enforcing` diagnostic instead of a false \"enabled\", and the banner tells you to **restart the proxy** to re-apply the redirect.\n\nOlder versions appended their `rdr-anchor` to the **end** of `/etc/pf.conf`, after Apple's filter anchor \u2014 which pf rejects, because translation rules must come before filtering rules. That silently invalidated the whole ruleset, so every later `pfctl -f` failed and 443 was dead. Current builds insert the anchor in the correct translation section and **self-heal** a file corrupted by the old version on the next proxy start. Supbuddy keeps a single stable backup at `/etc/pf.conf.supbuddy-backup` (older builds accumulated unbounded timestamped backups). If a restart doesn't fix it, inspect `/etc/pf.conf` and confirm the `rdr-anchor \"virtual.localhost\"` line sits before `anchor \"com.apple/*\"`.\n\n### Proxy came up but shows a degraded \"error\" state\n\nIf the one-time sudo prompt for port forwarding / DNS is cancelled or fails, Supbuddy no longer aborts the whole start. Caddy still starts and HTTPS keeps working on the high port (8443), and the CA is still generated; the proxy just shows an actionable **error** (degraded) state with a **Retry**. Click **Retry** and approve the sudo prompt to restore real-port (80/443) access and DNS. Until then, reach your apps on `https://<domain>:8443`.\n\n### Port already in use (8080, 8443, 5353, 9877)\n\nDefault ports: HTTP 8080, HTTPS 8443, DNS 5353, MCP 9877. Change them in **Settings \u2192 Network** / **Settings \u2192 MCP**. Find what's holding a port: `lsof -i :<port>`.\n\n### Wipe everything and start over\n\nUse `supbuddy reset` (see *System reset*) \u2014 it backs up anything you can't regenerate first, and it removes the things a plain `rm -rf` leaves behind (the pf redirect, the resolver files, the loopback aliases, the trusted CA):\n\n```bash\nsupbuddy reset --tier=soft   # just the app state and caches\nsupbuddy reset --tier=deep   # + services, Caddy leftovers, /etc integrations, CA trust\nsupbuddy reset --tier=full   # + project data, repo artifacts, secrets, service, app data\n```\n\nThe manual equivalent, if the CLI isn't available \u2014 quit Supbuddy first, and note that this deletes `secrets/` and any backups under it with no copy anywhere:\n\n```bash\n# Wipe app data (state, certs, Caddyfile, logs, MCP tokens under secrets/)\nrm -rf ~/Library/Application\\ Support/Supbuddy\n\n# Optional: remove the trusted CA\nsudo security delete-certificate -c \"Caddy Local Authority\" /Library/Keychains/System.keychain\n```\n\n## FAQ\n\n### Is Supbuddy free?\n\nYes. Supbuddy is free. Register as many projects and mappings as you want, with full HTTPS, full DNS, full Supabase isolation, and full read and write MCP access. There are no caps and no tiers.\n\n### Does Supbuddy send my data anywhere?\n\nNo. Caddy, the DNS server, and the MCP server all run locally on your Mac. The only outbound traffic is: Tailscale split-DNS push (only if you enabled it), auto-update checks (GitHub Releases), and Google Analytics on the marketing site (not the desktop app). The desktop app does not send telemetry.\n\n### Can I work offline?\n\nYes. The app works fully offline once the CA is trusted and projects are registered.\n\n### Linux / Windows support?\n\nThe desktop app is macOS-only in v2. The headless CLI and daemon also run on Linux, where `supbuddy service install` registers a `systemd-user` start-on-login unit (macOS uses `launchd`). Windows is not supported. A few desktop code paths (certutil, update-ca-certificates) anticipate other platforms but are not tested there.\n\n### Can I use my own TLD?\n\nYes. Set any TLD in **Settings \u2192 General \u2192 Default TLD**. Supbuddy installs `/etc/resolver/<project-domain>` files that tell macOS to query our DNS server for that project's domain. Avoid TLDs that actually resolve on the public internet (.com, .net, etc.); your browser will hit the real site for cached entries.\n\n### What happens if I delete a project?\n\nThe project moves to the Trash (visible in **Settings \u2192 MCP \u2192 Trash**) for 7 days, then is permanently deleted by the sweep timer. Restoring brings back the project record and all its mappings.\n\n### How do I uninstall Supbuddy?\n\n1. Quit the app (the full reset refuses to run while it's open, because its watchdog restarts the daemon).\n2. Run `supbuddy reset --tier=full` and type `RESET` when it asks. This backs up your project data, then removes the containers, volumes, `/etc` integrations, CA trust, repo artifacts, credentials, the start-on-login service and the app-data directory \u2014 keeping `<app-data>/backups/reset-<timestamp>/`. See *System reset*, including the short list of things it deliberately leaves behind.\n3. Drag **Supbuddy.app** from `/Applications` to the Trash, and move the backups directory somewhere safe (or delete it).\n4. If you'd rather not use the CLI: see \"Wipe everything and start over\" above for the manual equivalent, plus `sudo security delete-certificate -c \"Caddy Local Authority\" /Library/Keychains/System.keychain` to remove the trusted CA.\n\n### Where do I report a bug?\n\nEmail support with your version (visible at the bottom of the Settings popover) and the relevant lines from `~/Library/Application Support/Supbuddy/main.log`.\n";
   }
 });
 
@@ -39808,9 +40053,9 @@ When a \`.supbuddy/\` directory IS present (use the NEAREST one at or above the
 });
 
 // ../../packages/core/project-context/managed-block.ts
-import crypto2 from "crypto";
+import crypto3 from "crypto";
 function blockChecksum(body) {
-  return crypto2.createHash("sha256").update(body, "utf-8").digest("hex");
+  return crypto3.createHash("sha256").update(body, "utf-8").digest("hex");
 }
 function extractBlock(text) {
   const beginMatch = BEGIN_RE.exec(text);
@@ -39854,11 +40099,11 @@ var init_managed_block = __esm({
 
 // ../../packages/core/project-context/write-engine.ts
 import fs22 from "fs/promises";
-import path22 from "path";
-import crypto3 from "crypto";
+import path23 from "path";
+import crypto4 from "crypto";
 async function atomicWrite(absolutePath, content) {
-  await fs22.mkdir(path22.dirname(absolutePath), { recursive: true });
-  const tmp = absolutePath + ".tmp." + process.pid + "." + Date.now() + "." + crypto3.randomBytes(3).toString("hex");
+  await fs22.mkdir(path23.dirname(absolutePath), { recursive: true });
+  const tmp = absolutePath + ".tmp." + process.pid + "." + Date.now() + "." + crypto4.randomBytes(3).toString("hex");
   await fs22.writeFile(tmp, content, "utf-8");
   await fs22.rename(tmp, absolutePath);
 }
@@ -39927,13 +40172,13 @@ var init_write_engine = __esm({
 
 // ../../packages/core/project-context/gitignore.ts
 import fs23 from "fs/promises";
-import path23 from "path";
+import path24 from "path";
 function buildGitignoreBody(localOwnedRels = []) {
   const editorEntries = [...new Set(localOwnedRels)].sort();
   return ["# Supbuddy-managed (do not commit)", ...ALWAYS_IGNORED, ...editorEntries].join("\n");
 }
 async function ensureGitignoreEntries(projectPath, localOwnedRels = []) {
-  const p = path23.join(projectPath, ".gitignore");
+  const p = path24.join(projectPath, ".gitignore");
   let existing = "";
   try {
     existing = await fs23.readFile(p, "utf-8");
@@ -39945,7 +40190,7 @@ async function ensureGitignoreEntries(projectPath, localOwnedRels = []) {
   await fs23.writeFile(p, updated, "utf-8");
 }
 async function removeGitignoreEntries(projectPath) {
-  const p = path23.join(projectPath, ".gitignore");
+  const p = path24.join(projectPath, ".gitignore");
   let existing = "";
   try {
     existing = await fs23.readFile(p, "utf-8");
@@ -39968,10 +40213,10 @@ var init_gitignore = __esm({
 });
 
 // ../../packages/core/project-context/capabilities.ts
-import path24 from "path";
-import os9 from "os";
+import path25 from "path";
+import os10 from "os";
 function globalHomeDir() {
-  return process.env.SUPBUDDY_HOME_DIR || os9.homedir();
+  return process.env.SUPBUDDY_HOME_DIR || os10.homedir();
 }
 function resolveTargetScope(scope, cap) {
   const s = scope ?? "auto";
@@ -39983,7 +40228,7 @@ function resolveTargetScope(scope, cap) {
 }
 function resolveGlobalPath(cap, homeDir) {
   if (!cap.globalPathParts) return null;
-  return path24.join(homeDir, ...cap.globalPathParts);
+  return path25.join(homeDir, ...cap.globalPathParts);
 }
 var TARGET_CAPABILITIES;
 var init_capabilities = __esm({
@@ -40008,10 +40253,10 @@ var init_capabilities = __esm({
 
 // ../../packages/core/project-context/global-registry.ts
 import fs24 from "fs/promises";
-import path25 from "path";
-import crypto4 from "crypto";
+import path26 from "path";
+import crypto5 from "crypto";
 async function registryPath() {
-  return path25.join(await getAppSupportDir(), "global-context.json");
+  return path26.join(await getAppSupportDir(), "global-context.json");
 }
 async function loadRegistry() {
   const p = await registryPath();
@@ -40027,7 +40272,7 @@ async function saveRegistry(reg) {
 }
 async function rmdirLeaf(filePath) {
   try {
-    await fs24.rmdir(path25.dirname(filePath));
+    await fs24.rmdir(path26.dirname(filePath));
   } catch {
   }
 }
@@ -40087,7 +40332,7 @@ var init_global_registry = __esm({
     init_store();
     init_write_engine();
     init_capabilities();
-    sha = (s) => crypto4.createHash("sha256").update(s).digest("hex");
+    sha = (s) => crypto5.createHash("sha256").update(s).digest("hex");
     registryLock = Promise.resolve();
   }
 });
@@ -40103,7 +40348,7 @@ __export(sync_manager_exports, {
   stopContextSync: () => stopContextSync,
   syncProjectNow: () => syncProjectNow
 });
-import path26 from "path";
+import path27 from "path";
 import fs25 from "fs/promises";
 import { createRequire as createRequire2 } from "module";
 function effectiveScope(slot, settings) {
@@ -40236,7 +40481,7 @@ async function syncProjectNow(projectId, opts = {}) {
         try {
           const r = await ensureGlobalFile(gp, content, SUPBUDDY_VERSION, projectId);
           files.push({ path: gp, rel_path: gp, target: t.slot, status: r.status });
-          await fs25.rm(path26.join(project.path, t.rel), { force: true }).catch(() => {
+          await fs25.rm(path27.join(project.path, t.rel), { force: true }).catch(() => {
           });
           delete checksums[t.rel];
         } catch (err) {
@@ -40251,7 +40496,7 @@ async function syncProjectNow(projectId, opts = {}) {
         continue;
       }
     }
-    const abs = path26.join(project.path, t.rel);
+    const abs = path27.join(project.path, t.rel);
     try {
       let res;
       if (t.ownership === "managed-block") {
@@ -40307,7 +40552,7 @@ async function syncProjectNow(projectId, opts = {}) {
     }
   }
   if (settings.manage_gitignore) {
-    const gitignorePath = path26.join(project.path, ".gitignore");
+    const gitignorePath = path27.join(project.path, ".gitignore");
     try {
       let before = null;
       try {
@@ -40334,7 +40579,7 @@ async function syncProjectNow(projectId, opts = {}) {
       });
     }
   }
-  const metaAbs = path26.join(project.path, ".supbuddy", "meta.json");
+  const metaAbs = path27.join(project.path, ".supbuddy", "meta.json");
   const metaRel = ".supbuddy/meta.json";
   try {
     const checksumsForMeta = { ...checksums };
@@ -40720,18 +40965,18 @@ var init_dind = __esm({
 
 // ../../packages/core/system-doctor/wipe/steps/repo-artifacts.ts
 import fs26 from "fs/promises";
-import path27 from "path";
+import path28 from "path";
 async function ownedEnvFiles(p, repo) {
-  const root = path27.resolve(repo);
+  const root = path28.resolve(repo);
   const dirs = /* @__PURE__ */ new Set([root]);
   for (const app of p.apps ?? []) {
-    if (!app?.path || !path27.isAbsolute(app.path)) continue;
-    const abs = path27.resolve(app.path);
-    if (abs === root || abs.startsWith(`${root}${path27.sep}`)) dirs.add(abs);
+    if (!app?.path || !path28.isAbsolute(app.path)) continue;
+    const abs = path28.resolve(app.path);
+    if (abs === root || abs.startsWith(`${root}${path28.sep}`)) dirs.add(abs);
   }
   const files = [];
   for (const d of dirs) {
-    const f = path27.join(d, ".env.supbuddy");
+    const f = path28.join(d, ".env.supbuddy");
     try {
       if ((await fs26.lstat(f)).isFile()) files.push(f);
     } catch {
@@ -40740,9 +40985,9 @@ async function ownedEnvFiles(p, repo) {
   return files;
 }
 function isSafeProjectPath(p) {
-  if (!path27.isAbsolute(p)) return false;
-  const resolved = path27.resolve(p);
-  return resolved !== path27.parse(resolved).root;
+  if (!path28.isAbsolute(p)) return false;
+  const resolved = path28.resolve(p);
+  return resolved !== path28.parse(resolved).root;
 }
 async function isRealDirectory(p) {
   try {
@@ -40762,7 +41007,7 @@ async function pathExists(p) {
 async function recordedBlockFiles(repo, dir) {
   let checksums;
   try {
-    const raw = JSON.parse(await fs26.readFile(path27.join(dir, "meta.json"), "utf-8"));
+    const raw = JSON.parse(await fs26.readFile(path28.join(dir, "meta.json"), "utf-8"));
     checksums = raw?.checksums ?? {};
   } catch {
     return [];
@@ -40770,8 +41015,8 @@ async function recordedBlockFiles(repo, dir) {
   const files = [];
   for (const rel of Object.keys(checksums)) {
     if (typeof rel !== "string" || rel.startsWith(".supbuddy/")) continue;
-    const abs = path27.resolve(repo, rel);
-    if (!abs.startsWith(`${path27.resolve(repo)}${path27.sep}`)) continue;
+    const abs = path28.resolve(repo, rel);
+    if (!abs.startsWith(`${path28.resolve(repo)}${path28.sep}`)) continue;
     try {
       if (extractBlock(await fs26.readFile(abs, "utf-8"))) files.push(abs);
     } catch {
@@ -40817,16 +41062,16 @@ var init_repo_artifacts = __esm({
         for (const p of projectSnapshot()) {
           const repo = p.path;
           if (!repo || !isSafeProjectPath(repo)) continue;
-          const dir = path27.join(repo, ".supbuddy");
+          const dir = path28.join(repo, ".supbuddy");
           const hasDir = await isRealDirectory(dir);
           const blocks = hasDir ? await recordedBlockFiles(repo, dir) : [];
           const envFiles = await ownedEnvFiles(p, repo);
           if (!hasDir && blocks.length === 0 && envFiles.length === 0) continue;
           const bits = [
             hasDir && `remove ${dir}/`,
-            envFiles.length > 0 && `delete ${envFiles.map((f) => path27.relative(repo, f)).join(", ")}`,
+            envFiles.length > 0 && `delete ${envFiles.map((f) => path28.relative(repo, f)).join(", ")}`,
             "release the machine-global skill refs and the .gitignore block",
-            blocks.length > 0 && `strip the managed Supbuddy block from ${blocks.map((b) => path27.relative(repo, b)).join(", ")}`
+            blocks.length > 0 && `strip the managed Supbuddy block from ${blocks.map((b) => path28.relative(repo, b)).join(", ")}`
           ].filter(Boolean);
           actions.push({
             label: `Clean Supbuddy artifacts from "${p.name ?? p.id}" (${repo}): ${bits.join(", ")}`,
@@ -40868,13 +41113,13 @@ var init_bundle_exporter = __esm({
 
 // ../../packages/core/cloud.ts
 import fs27 from "fs/promises";
-import path28 from "path";
+import path29 from "path";
 import { execFile as execFile8 } from "child_process";
 import { promisify as promisify13 } from "util";
 async function sessionPath(dir) {
-  const d = dir ?? path28.join(await getAppSupportDir(), "secrets");
+  const d = dir ?? path29.join(await getAppSupportDir(), "secrets");
   await fs27.mkdir(d, { recursive: true, mode: 448 });
-  return path28.join(d, "cloud-session.secret");
+  return path29.join(d, "cloud-session.secret");
 }
 async function clearCloudSession(dir) {
   await fs27.rm(await sessionPath(dir), { force: true }).catch(() => {
@@ -40894,7 +41139,7 @@ var init_cloud = __esm({
 
 // ../../packages/core/system-doctor/wipe/steps/all-secrets.ts
 import fs28 from "fs/promises";
-import path29 from "path";
+import path30 from "path";
 var allSecrets;
 var init_all_secrets = __esm({
   "../../packages/core/system-doctor/wipe/steps/all-secrets.ts"() {
@@ -40906,7 +41151,7 @@ var init_all_secrets = __esm({
       tiers: ["full"],
       destroysUserData: false,
       async build(ctx) {
-        const dir = path29.join(ctx.appSupportDir, "secrets");
+        const dir = path30.join(ctx.appSupportDir, "secrets");
         let count;
         try {
           count = (await fs28.readdir(dir)).length;
@@ -41253,8 +41498,8 @@ __export(service_exports, {
   uninstallService: () => uninstallService
 });
 import fs29 from "fs/promises";
-import os10 from "os";
-import path30 from "path";
+import os11 from "os";
+import path31 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { spawnSync } from "child_process";
 function launchdPlist(o) {
@@ -41277,9 +41522,9 @@ function launchdPlist(o) {
   <key>KeepAlive</key>
   <true/>
   <key>StandardOutPath</key>
-  <string>${path30.join(o.logDir, "daemon.log")}</string>
+  <string>${path31.join(o.logDir, "daemon.log")}</string>
   <key>StandardErrorPath</key>
-  <string>${path30.join(o.logDir, "daemon-error.log")}</string>
+  <string>${path31.join(o.logDir, "daemon-error.log")}</string>
 </dict>
 </plist>
 `;
@@ -41299,16 +41544,16 @@ WantedBy=default.target
 `;
 }
 function launchdPlistPath() {
-  return path30.join(os10.homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+  return path31.join(os11.homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
 }
 function systemdUnitPath() {
-  const configHome = process.env.XDG_CONFIG_HOME ?? path30.join(os10.homedir(), ".config");
-  return path30.join(configHome, "systemd", "user", SYSTEMD_SERVICE);
+  const configHome = process.env.XDG_CONFIG_HOME ?? path31.join(os11.homedir(), ".config");
+  return path31.join(configHome, "systemd", "user", SYSTEMD_SERVICE);
 }
 function resolveBinPath() {
-  const __dirname3 = path30.dirname(fileURLToPath2(import.meta.url));
-  const repoRoot = path30.resolve(__dirname3, "..", "..", "..");
-  return path30.join(repoRoot, "apps", "cli", "dist", "bin.js");
+  const __dirname3 = path31.dirname(fileURLToPath2(import.meta.url));
+  const repoRoot = path31.resolve(__dirname3, "..", "..", "..");
+  return path31.join(repoRoot, "apps", "cli", "dist", "bin.js");
 }
 async function installService(opts = {}, run = defaultRunner2) {
   const platform = process.platform;
@@ -41328,11 +41573,11 @@ Run \`yarn workspace supbuddy build\` first.`
     return 1;
   }
   const stateDir = opts.stateDir ?? defaultStateDir();
-  const logDir = path30.join(stateDir, "logs");
+  const logDir = path31.join(stateDir, "logs");
   await fs29.mkdir(logDir, { recursive: true });
   if (platform === "darwin") {
     const plistPath = launchdPlistPath();
-    await fs29.mkdir(path30.dirname(plistPath), { recursive: true });
+    await fs29.mkdir(path31.dirname(plistPath), { recursive: true });
     const content2 = launchdPlist({ label: LAUNCHD_LABEL, nodePath, binPath, stateDir, logDir });
     await fs29.writeFile(plistPath, content2, { encoding: "utf8", mode: 420 });
     run("launchctl", ["unload", plistPath]);
@@ -41345,7 +41590,7 @@ Run \`yarn workspace supbuddy build\` first.`
     return 0;
   }
   const unitPath = systemdUnitPath();
-  await fs29.mkdir(path30.dirname(unitPath), { recursive: true });
+  await fs29.mkdir(path31.dirname(unitPath), { recursive: true });
   const content = systemdUnit({ label: LAUNCHD_LABEL, nodePath, binPath, stateDir, logDir });
   await fs29.writeFile(unitPath, content, { encoding: "utf8", mode: 420 });
   const reload = run("systemctl", ["--user", "daemon-reload"]);
@@ -41465,10 +41710,10 @@ __export(reset_full_exports, {
   removeAppDataPreservingBackups: () => removeAppDataPreservingBackups
 });
 import fsp from "fs/promises";
-import path31 from "path";
+import path32 from "path";
 import { spawnSync as spawnSync2 } from "child_process";
 async function removeAppDataPreservingBackups(appSupportDir, io2 = defaultRemoveIo) {
-  if (!appSupportDir || !path31.isAbsolute(appSupportDir)) {
+  if (!appSupportDir || !path32.isAbsolute(appSupportDir)) {
     throw new Error(`refusing to empty "${appSupportDir}": not an absolute app-data directory path`);
   }
   const entries = await io2.readdir(appSupportDir);
@@ -41484,7 +41729,7 @@ async function removeAppDataPreservingBackups(appSupportDir, io2 = defaultRemove
       preserved.push(name);
       continue;
     }
-    await io2.rm(path31.join(appSupportDir, name), { recursive: true, force: true });
+    await io2.rm(path32.join(appSupportDir, name), { recursive: true, force: true });
     removed.push(name);
   }
   const left = (await io2.readdir(appSupportDir)).filter((n) => n !== BACKUPS_DIRNAME);
@@ -41495,7 +41740,7 @@ async function removeAppDataPreservingBackups(appSupportDir, io2 = defaultRemove
   }
   return {
     appSupportDir,
-    backupsDir: path31.join(appSupportDir, BACKUPS_DIRNAME),
+    backupsDir: path32.join(appSupportDir, BACKUPS_DIRNAME),
     removed,
     preserved
   };
@@ -41513,7 +41758,7 @@ function defaultProcessProbe(cmd, args) {
   }
 }
 async function hydrateStoreFromDisk(appSupportDir, useStore3) {
-  const raw = await fsp.readFile(path31.join(appSupportDir, "state.json"), "utf8").catch(() => null);
+  const raw = await fsp.readFile(path32.join(appSupportDir, "state.json"), "utf8").catch(() => null);
   if (!raw) return null;
   let data;
   try {
@@ -42552,10 +42797,10 @@ __export(install_exports, {
 });
 import { spawnSync as spawnSync3 } from "child_process";
 import readline2 from "readline";
-import path32 from "path";
+import path33 from "path";
 function isEphemeralNpx() {
   const argv1 = process.argv[1] || "";
-  if (argv1.includes(`${path32.sep}_npx${path32.sep}`) || argv1.includes("/_npx/")) return true;
+  if (argv1.includes(`${path33.sep}_npx${path33.sep}`) || argv1.includes("/_npx/")) return true;
   if (process.env.npm_command === "exec") return true;
   return false;
 }
@@ -42629,8 +42874,8 @@ var selftest_exports = {};
 import net from "net";
 import http2 from "http";
 import fs30 from "fs/promises";
-import os11 from "os";
-import path33 from "path";
+import os12 from "os";
+import path34 from "path";
 function getFreePort() {
   return new Promise((resolve, reject) => {
     const srv = net.createServer();
@@ -42714,7 +42959,7 @@ async function main() {
   const workerPort = await getFreePort();
   let mcpPort = await getFreePort();
   if (mcpPort === workerPort) mcpPort = await getFreePort();
-  const stateDir = await fs30.mkdtemp(path33.join(os11.tmpdir(), "supbuddy-selftest-"));
+  const stateDir = await fs30.mkdtemp(path34.join(os12.tmpdir(), "supbuddy-selftest-"));
   const seed = {
     projects: [],
     mappings: [],
@@ -42724,7 +42969,7 @@ async function main() {
       mcp: { enabled: true, port: mcpPort, audit_cap: 5e3, trash_ttl_days: 7 }
     }
   };
-  await fs30.writeFile(path33.join(stateDir, "state.json"), JSON.stringify(seed, null, 2));
+  await fs30.writeFile(path34.join(stateDir, "state.json"), JSON.stringify(seed, null, 2));
   console.log(`isolated state dir: ${stateDir}`);
   console.log(`worker (Socket.IO) port: ${workerPort}   MCP port: ${mcpPort}
 `);
@@ -42775,9 +43020,9 @@ __export(update_exports, {
 import https from "https";
 import fs31 from "fs/promises";
 import { createWriteStream as createWriteStream2 } from "fs";
-import os12 from "os";
-import path34 from "path";
-import crypto5 from "crypto";
+import os13 from "os";
+import path35 from "path";
+import crypto6 from "crypto";
 import readline3 from "readline";
 import { execFile as execFile9, execFileSync as execFileSync3, spawn as spawn8 } from "child_process";
 function semver(tag) {
@@ -42879,7 +43124,7 @@ function installedVersion() {
 }
 async function sha256(file) {
   const buf = await fs31.readFile(file);
-  return crypto5.createHash("sha256").update(buf).digest("hex");
+  return crypto6.createHash("sha256").update(buf).digest("hex");
 }
 function promptYesNo3(question) {
   return new Promise((resolve) => {
@@ -42902,7 +43147,7 @@ function sq(p) {
   return `'${p.replace(/'/g, "'\\''")}'`;
 }
 async function swapApp(newApp) {
-  const dir = path34.dirname(INSTALLED_APP);
+  const dir = path35.dirname(INSTALLED_APP);
   if (await canWrite(dir)) {
     const bak = `${INSTALLED_APP}.bak-${process.pid}`;
     if (await fs31.stat(INSTALLED_APP).then(() => true).catch(() => false)) {
@@ -42977,10 +43222,10 @@ supbuddy update: could not reach the release server \u2014 ${e.message}`);
       return 0;
     }
   }
-  const tmp = await fs31.mkdtemp(path34.join(os12.tmpdir(), "supbuddy-update-"));
-  const tar = path34.join(tmp, TAR_ASSET);
-  const shaFile = path34.join(tmp, SHA_ASSET);
-  const extractDir = path34.join(tmp, "extracted");
+  const tmp = await fs31.mkdtemp(path35.join(os13.tmpdir(), "supbuddy-update-"));
+  const tar = path35.join(tmp, TAR_ASSET);
+  const shaFile = path35.join(tmp, SHA_ASSET);
+  const extractDir = path35.join(tmp, "extracted");
   try {
     console.log("Downloading\u2026");
     await downloadAsset(pick.tarUrl, tar);
@@ -42994,7 +43239,7 @@ supbuddy update: could not reach the release server \u2014 ${e.message}`);
     }
     await fs31.mkdir(extractDir, { recursive: true });
     execFileSync3("tar", ["-xzf", tar, "-C", extractDir]);
-    const newApp = path34.join(extractDir, "Supbuddy.app");
+    const newApp = path35.join(extractDir, "Supbuddy.app");
     if (!await fs31.stat(newApp).then(() => true).catch(() => false)) {
       console.error("supbuddy update: the archive did not contain Supbuddy.app.");
       return 1;
@@ -43097,11 +43342,11 @@ __export(run_exports, {
 });
 import { spawn as spawn9, execSync as execSync2 } from "child_process";
 import fs32 from "fs";
-import path35 from "path";
+import path36 from "path";
 function readMeta(startDir) {
   let dir = startDir;
   for (; ; ) {
-    const metaPath = path35.join(dir, ".supbuddy", "meta.json");
+    const metaPath = path36.join(dir, ".supbuddy", "meta.json");
     if (fs32.existsSync(metaPath)) {
       try {
         return JSON.parse(fs32.readFileSync(metaPath, "utf-8"));
@@ -43109,7 +43354,7 @@ function readMeta(startDir) {
         return {};
       }
     }
-    const parent = path35.dirname(dir);
+    const parent = path36.dirname(dir);
     if (parent === dir) return {};
     dir = parent;
   }
@@ -43243,7 +43488,7 @@ init_state_dir();
 import { realpathSync } from "fs";
 import { spawnSync as spawnSync4 } from "child_process";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import path36 from "path";
+import path37 from "path";
 
 // src/commands.ts
 init_client();
@@ -44326,12 +44571,12 @@ async function runCommand(argv, flags, clientFactory) {
         return 0;
       }
       if (sub === "env-read") {
-        const path37 = rest[0];
-        if (!path37) {
+        const path38 = rest[0];
+        if (!path38) {
           console.error("usage: supbuddy project env-read <path> [--key K]");
           return 1;
         }
-        const args = { path: path37 };
+        const args = { path: path38 };
         if (typeof flags.key === "string") args.key = flags.key;
         print(await client.call("read_env_file", args), flags);
         return 0;
@@ -44612,8 +44857,8 @@ async function runCommand(argv, flags, clientFactory) {
         return 0;
       }
       if (sub === "write") {
-        const [path37, ...pairs2] = rest;
-        if (!path37 || pairs2.length === 0) {
+        const [path38, ...pairs2] = rest;
+        if (!path38 || pairs2.length === 0) {
           console.error("usage: supbuddy env write <path> <key=val>...");
           return 1;
         }
@@ -44628,7 +44873,7 @@ async function runCommand(argv, flags, clientFactory) {
           const v = pair.slice(eqIdx + 1);
           patch[k] = v === "" ? null : v;
         }
-        print(await client.call("write_env_file", { path: path37, patch }), flags);
+        print(await client.call("write_env_file", { path: path38, patch }), flags);
         return 0;
       }
       console.error("usage: supbuddy env copy|write ...");
@@ -44991,6 +45236,18 @@ var SHORT_FLAG_MAP = {
   y: "yes",
   q: "quiet"
 };
+function resolveStopOutcome(pid, alive) {
+  if (alive) {
+    return {
+      exitCode: 1,
+      removeDaemonInfo: false,
+      message: `supbuddy: daemon (pid ${pid}) did not exit within 8s \u2014 still running.
+  daemon.json was left in place so the app can still find it.
+  Force it if you must: kill -9 ${pid}`
+    };
+  }
+  return { exitCode: 0, removeDaemonInfo: true, message: `supbuddy: stopped (pid ${pid})` };
+}
 function parseFlags(argv) {
   const flags = {};
   const positionals = [];
@@ -45150,12 +45407,12 @@ Global flags:
 
 See docs/MULTIMODE_DELIVERY_ASSESSMENT.md for the full roadmap.`;
 async function runShell(opts, stateDir, module) {
-  const os13 = await import("os");
+  const os14 = await import("os");
   const fs33 = await import("fs");
   const shellEntry = fileURLToPath3(new URL("../../tui/src/shell/bin.tsx", import.meta.url));
-  const REPO_ROOT2 = path36.resolve(fileURLToPath3(import.meta.url), "..", "..", "..", "..");
-  const tsxBin = path36.join(REPO_ROOT2, "node_modules", ".bin", "tsx");
-  const resultFile = path36.join(os13.tmpdir(), `supbuddy-shell-${process.pid}-${Date.now()}.json`);
+  const REPO_ROOT2 = path37.resolve(fileURLToPath3(import.meta.url), "..", "..", "..", "..");
+  const tsxBin = path37.join(REPO_ROOT2, "node_modules", ".bin", "tsx");
+  const resultFile = path37.join(os14.tmpdir(), `supbuddy-shell-${process.pid}-${Date.now()}.json`);
   const env3 = { ...process.env, SUPBUDDY_SHELL_RESULT: resultFile };
   if (stateDir) env3.SUPBUDDY_STATE_DIR = stateDir;
   if (module) env3.SUPBUDDY_SHELL_MODULE = module;
@@ -45252,8 +45509,8 @@ async function dispatch(argv, opts) {
     case "tui":
     case "dash": {
       const tuiEntry = fileURLToPath3(new URL("../../tui/src/bin.tsx", import.meta.url));
-      const REPO_ROOT2 = path36.resolve(fileURLToPath3(import.meta.url), "..", "..", "..", "..");
-      const tsxBin = path36.join(REPO_ROOT2, "node_modules", ".bin", "tsx");
+      const REPO_ROOT2 = path37.resolve(fileURLToPath3(import.meta.url), "..", "..", "..", "..");
+      const tsxBin = path37.join(REPO_ROOT2, "node_modules", ".bin", "tsx");
       const env3 = { ...process.env };
       if (typeof flags["state-dir"] === "string") env3.SUPBUDDY_STATE_DIR = flags["state-dir"];
       if (typeof flags["url"] === "string") env3.SUPBUDDY_DAEMON_URL = flags["url"];
@@ -45308,9 +45565,11 @@ async function dispatch(argv, opts) {
         const still = await readDaemonInfo(dir);
         if (!still || !isPidAlive(still.pid)) break;
       }
-      await removeDaemonInfo(dir);
-      console.log(`supbuddy: stopped (pid ${pid})`);
-      return 0;
+      const outcome = resolveStopOutcome(pid, isPidAlive(pid));
+      if (outcome.removeDaemonInfo) await removeDaemonInfo(dir);
+      if (outcome.exitCode === 0) console.log(outcome.message);
+      else console.error(outcome.message);
+      return outcome.exitCode;
     }
     case void 0:
     case "": {
@@ -45386,7 +45645,8 @@ if (isMain) {
 export {
   dispatch,
   flushStream,
-  parseFlags
+  parseFlags,
+  resolveStopOutcome
 };
 /*! Bundled license information: