termify-agent 1.0.41 → 1.0.42

package/dist/agent.js

@@ -12,16 +12,21 @@ import { WireGuardManager } from './network/wireguard-manager.js';
 import { NatTraversal } from './network/nat-traversal.js';
 import { KeyRotation } from './network/key-rotation.js';
 import { getDaemonClient } from './daemon-client.js';
-import { getConfig, isConfigured } from './config.js';
+import { getConfig, getServers, isConfigured } from './config.js';
 import { logger } from './utils/logger.js';
 /**
- * Main agent class that coordinates WebSocket connection and PTY/SSH management
+ * Main agent class that coordinates WebSocket connections and PTY/SSH management.
+ * Supports multiple simultaneous server connections.
  */
 export class Agent extends EventEmitter {
-    wsClient;
+    /** Map of serverUrl -> WSClient for multi-server support */
+    wsClients = new Map();
+    /** Map of serverUrl -> TunnelManager (tunnels are per-server) */
+    tunnelManagers = new Map();
+    /** Map of terminalId -> serverUrl (routes terminal I/O to the server that created it) */
+    terminalServerMap = new Map();
     ptyManager;
     sshManager;
-    tunnelManager;
     statsManager;
     portScanner;
     daemonClient;
@@ -31,26 +36,28 @@ export class Agent extends EventEmitter {
     isRunning = false;
     agentId = null;
     agentName = null;
+    /** Track which servers have connected (for events) */
+    connectedServers = new Set();
+    primaryServerUrl = null;
     constructor() {
         super();
-        this.wsClient = new WSClient();
         this.ptyManager = new PTYManager();
         this.sshManager = new SSHManager();
-        this.tunnelManager = new TunnelManager(this.wsClient);
-        this.statsManager = new StatsManager(5); // Collect stats every 5 seconds
+        this.statsManager = new StatsManager(5);
         this.portScanner = new PortScanner();
         this.daemonClient = getDaemonClient();
         this.wgManager = new WireGuardManager();
         this.natTraversal = new NatTraversal();
         this.keyRotation = new KeyRotation();
-        // Key rotation: timer fires -> rotate key -> propose to server
+        // Key rotation: timer fires -> rotate key -> propose to primary server
         this.keyRotation.on('rotate-needed', async () => {
             if (!this.wgManager.getStatus().available)
                 return;
             try {
                 const result = await this.wgManager.rotateKey();
                 const version = this.keyRotation.proposeRotation();
-                this.wsClient.sendWgRotatePropose(result.publicKey, version);
+                const primaryWs = this.getPrimaryWsClient();
+                primaryWs?.sendWgRotatePropose(result.publicKey, version);
                 logger.info(`Key rotation proposed: v${version}`);
             }
             catch (err) {
@@ -61,39 +68,152 @@ export class Agent extends EventEmitter {
         this.wgManager.on('ready', () => {
             logger.info('WireGuard interface ready');
             this.reportWgStatus();
-            // Start periodic key rotation once the interface is up
             this.keyRotation.start();
         });
         this.wgManager.on('error', (err) => {
             logger.error('WireGuard error:', err.message);
             this.reportWgStatus();
         });
-        // Pass wsClient to PTYManager for git updates
-        this.ptyManager.setWSClient(this.wsClient);
+        // Pass WSClient shim to PTYManager for per-terminal git/MCP routing
+        this.ptyManager.setWSClient(this.createPtyWsShim());
         // Pass daemon client to PTYManager for process monitoring
         this.ptyManager.setDaemonClient(this.daemonClient);
-        // Start periodic cleanup of ephemeral terminals (chat-prewarm-*, chat-exec-*)
+        // Start periodic cleanup of ephemeral terminals
         this.ptyManager.startEphemeralCleanup();
-        this.setupHandlers();
+        this.setupSharedHandlers();
     }
     /**
-     * Setup event handlers between WebSocket client and PTY/SSH managers
+     * Create a WSClient-like shim that routes per-terminal calls to the correct server
      */
-    setupHandlers() {
-        // WebSocket -> PTY: Handle local terminal requests
-        this.wsClient.on('terminalCreate', (terminalId, cols, rows, options) => {
-            // If terminal already exists (e.g. from reconnect), just report RUNNING
+    createPtyWsShim() {
+        const self = this;
+        return {
+            sendGitBranch(terminalId, branch, isGitRepo) {
+                self.getWsClientForTerminal(terminalId)?.sendGitBranch(terminalId, branch, isGitRepo);
+            },
+            sendGitBranches(terminalId, branches) {
+                self.getWsClientForTerminal(terminalId)?.sendGitBranches(terminalId, branches);
+            },
+            sendGitLog(terminalId, commits) {
+                self.getWsClientForTerminal(terminalId)?.sendGitLog(terminalId, commits);
+            },
+            sendGitStatus(terminalId, status) {
+                self.getWsClientForTerminal(terminalId)?.sendGitStatus(terminalId, status);
+            },
+            sendGitOperationResult(terminalId, operation, success, error) {
+                self.getWsClientForTerminal(terminalId)?.sendGitOperationResult(terminalId, operation, success, error);
+            },
+            sendTerminalMcpStatus(terminalId, state, message, needsInputPrompt) {
+                self.getWsClientForTerminal(terminalId)?.sendTerminalMcpStatus(terminalId, state, message, needsInputPrompt);
+            },
+            sendTerminalCwd(terminalId, cwd) {
+                self.getWsClientForTerminal(terminalId)?.sendTerminalCwd(terminalId, cwd);
+            },
+            get connected() {
+                // Return true if any server is connected (PTYManager uses this to gate operations)
+                return self.connectedServers.size > 0;
+            },
+        };
+    }
+    /**
+     * Get the WSClient responsible for a given terminal
+     */
+    getWsClientForTerminal(terminalId) {
+        const serverUrl = this.terminalServerMap.get(terminalId);
+        if (serverUrl)
+            return this.wsClients.get(serverUrl);
+        // Fallback to primary
+        return this.getPrimaryWsClient() || undefined;
+    }
+    /**
+     * Get the primary server's WSClient
+     */
+    getPrimaryWsClient() {
+        if (this.primaryServerUrl) {
+            return this.wsClients.get(this.primaryServerUrl) || null;
+        }
+        // Fallback: first client
+        const first = this.wsClients.values().next();
+        return first.done ? null : first.value;
+    }
+    /**
+     * Broadcast to ALL connected WSClients
+     */
+    broadcastAll(fn) {
+        for (const ws of this.wsClients.values()) {
+            if (ws.connected)
+                fn(ws);
+        }
+    }
+    /**
+     * Setup shared PTY/SSH data handlers (these route output to the correct server)
+     */
+    setupSharedHandlers() {
+        // PTY -> WebSocket: Forward output to the server that owns the terminal
+        this.ptyManager.setDataHandler((terminalId, data) => {
+            this.getWsClientForTerminal(terminalId)?.sendTerminalOutput(terminalId, data);
+        });
+        this.ptyManager.setExitHandler((terminalId, exitCode) => {
+            const ws = this.getWsClientForTerminal(terminalId);
+            ws?.sendTerminalExit(terminalId, exitCode);
+            ws?.sendTerminalStatus(terminalId, 'STOPPED');
+            this.terminalServerMap.delete(terminalId);
+            this.emit('terminalsChanged');
+        });
+        this.ptyManager.setWorkingHandler((terminalId, isWorking, activeProcess) => {
+            this.getWsClientForTerminal(terminalId)?.sendTerminalWorking(terminalId, isWorking, activeProcess);
+            this.emit('terminalsChanged');
+        });
+        // SSH -> WebSocket: Forward output to the server that owns the terminal
+        this.sshManager.setDataHandler((terminalId, data) => {
+            this.getWsClientForTerminal(terminalId)?.sendTerminalOutput(terminalId, data);
+        });
+        this.sshManager.setExitHandler((terminalId, exitCode) => {
+            const ws = this.getWsClientForTerminal(terminalId);
+            ws?.sendTerminalExit(terminalId, exitCode);
+            ws?.sendTerminalStatus(terminalId, 'STOPPED');
+            this.terminalServerMap.delete(terminalId);
+            this.emit('terminalsChanged');
+        });
+        this.sshManager.setErrorHandler((terminalId, error) => {
+            logger.error(`SSH error for ${terminalId}: ${error}`);
+            this.getWsClientForTerminal(terminalId)?.sendTerminalStatus(terminalId, 'CRASHED', error);
+        });
+        // Port scanning — broadcast to ALL servers
+        this.portScanner.on('ports', (ports) => {
+            this.broadcastAll(ws => ws.sendPorts(ports));
+        });
+    }
+    /**
+     * Add a server connection with all event wiring
+     */
+    addServerConnection(entry) {
+        if (this.wsClients.has(entry.serverUrl)) {
+            logger.warn(`Already connected to ${entry.serverUrl}`);
+            return;
+        }
+        const wsClient = new WSClient(entry);
+        const tunnelManager = new TunnelManager(wsClient);
+        const serverUrl = entry.serverUrl;
+        this.wsClients.set(serverUrl, wsClient);
+        this.tunnelManagers.set(serverUrl, tunnelManager);
+        if (entry.isPrimary) {
+            this.primaryServerUrl = serverUrl;
+        }
+        // === Terminal creation: register terminalServerMap ===
+        wsClient.on('terminalCreate', (terminalId, cols, rows, options) => {
             if (this.ptyManager.has(terminalId)) {
                 logger.info(`Terminal ${terminalId} already exists, reporting RUNNING`);
-                this.wsClient.sendTerminalStatus(terminalId, 'RUNNING');
+                wsClient.sendTerminalStatus(terminalId, 'RUNNING');
                 return;
             }
-            logger.info(`Creating local terminal ${terminalId}`);
+            this.terminalServerMap.set(terminalId, serverUrl);
+            logger.info(`Creating local terminal ${terminalId} (server: ${entry.name})`);
             const config = getConfig();
-            const serverUrl = (config.serverUrl || '').replace(/\/$/, '');
-            const termifyStatusUrl = serverUrl ? `${serverUrl}/api/mcp/status` : undefined;
-            const termifySessionId = config.agentId || config.machineId || terminalId;
-            const termifyApiUrl = serverUrl ? `${serverUrl}/api` : undefined;
+            const srvUrl = (entry.serverUrl || '').replace(/\/$/, '');
+            const termifyStatusUrl = srvUrl ? `${srvUrl}/api/mcp/status` : undefined;
+            const termifySessionId = entry.agentId || config.machineId || terminalId;
+            const termifyApiUrl = srvUrl ? `${srvUrl}/api` : undefined;
             const env = {
                 ...(options.env || {}),
             };
@@ -103,8 +223,8 @@ export class Agent extends EventEmitter {
                 env.TERMIFY_TERMINAL_ID = terminalId;
             if (!env.TERMIFY_SESSION_ID)
                 env.TERMIFY_SESSION_ID = termifySessionId;
-            if (!env.TERMIFY_TOKEN && config.accessToken)
-                env.TERMIFY_TOKEN = config.accessToken;
+            if (!env.TERMIFY_TOKEN && entry.accessToken)
+                env.TERMIFY_TOKEN = entry.accessToken;
             if (!env.TERMIFY_API_URL && termifyApiUrl)
                 env.TERMIFY_API_URL = termifyApiUrl;
             const created = this.ptyManager.create(terminalId, {
@@ -115,45 +235,51 @@ export class Agent extends EventEmitter {
                 env,
             });
             if (created) {
-                this.wsClient.sendTerminalStatus(terminalId, 'RUNNING');
+                wsClient.sendTerminalStatus(terminalId, 'RUNNING');
                 this.emit('terminalsChanged');
             }
             else {
-                this.wsClient.sendTerminalStatus(terminalId, 'CRASHED', 'Failed to create terminal');
+                wsClient.sendTerminalStatus(terminalId, 'CRASHED', 'Failed to create terminal');
+                this.terminalServerMap.delete(terminalId);
             }
         });
-        // WebSocket -> SSH: Handle SSH terminal requests (bastion pattern)
-        this.wsClient.on('terminalCreateSSH', async (terminalId, cols, rows, sshConfig) => {
-            logger.info(`Creating SSH terminal ${terminalId} -> ${sshConfig.host}:${sshConfig.port}`);
+        // SSH terminal creation
+        wsClient.on('terminalCreateSSH', async (terminalId, cols, rows, sshConfig) => {
+            this.terminalServerMap.set(terminalId, serverUrl);
+            logger.info(`Creating SSH terminal ${terminalId} -> ${sshConfig.host}:${sshConfig.port} (server: ${entry.name})`);
             const connected = await this.sshManager.connect(terminalId, cols, rows, sshConfig);
             if (connected) {
-                this.wsClient.sendTerminalStatus(terminalId, 'RUNNING');
+                wsClient.sendTerminalStatus(terminalId, 'RUNNING');
                 this.emit('terminalsChanged');
             }
             else {
-                this.wsClient.sendTerminalStatus(terminalId, 'CRASHED', `Failed to connect to ${sshConfig.host}`);
+                wsClient.sendTerminalStatus(terminalId, 'CRASHED', `Failed to connect to ${sshConfig.host}`);
+                this.terminalServerMap.delete(terminalId);
             }
         });
-        // SSH over tunnel - create SSH session using tunnel Duplex stream
-        this.wsClient.on('terminalSSHTunnel', async (terminalId, tunnelId, cols, rows, sshConfig) => {
-            logger.info(`Creating SSH tunnel terminal ${terminalId} via tunnel ${tunnelId}`);
-            if (!this.tunnelManager.has(tunnelId)) {
+        // SSH over tunnel
+        wsClient.on('terminalSSHTunnel', async (terminalId, tunnelId, cols, rows, sshConfig) => {
+            this.terminalServerMap.set(terminalId, serverUrl);
+            logger.info(`Creating SSH tunnel terminal ${terminalId} via tunnel ${tunnelId} (server: ${entry.name})`);
+            if (!tunnelManager.has(tunnelId)) {
                 logger.error(`Tunnel ${tunnelId} not found for SSH terminal ${terminalId}`);
-                this.wsClient.sendTerminalStatus(terminalId, 'CRASHED', `Tunnel ${tunnelId} not found`);
+                wsClient.sendTerminalStatus(terminalId, 'CRASHED', `Tunnel ${tunnelId} not found`);
+                this.terminalServerMap.delete(terminalId);
                 return;
             }
-            const tunnelStream = this.tunnelManager.createTunnelStream(tunnelId);
+            const tunnelStream = tunnelManager.createTunnelStream(tunnelId);
             const connected = await this.sshManager.connectOverTunnel(terminalId, cols, rows, sshConfig, tunnelStream);
             if (connected) {
-                this.wsClient.sendTerminalStatus(terminalId, 'RUNNING');
+                wsClient.sendTerminalStatus(terminalId, 'RUNNING');
                 this.emit('terminalsChanged');
             }
             else {
-                this.wsClient.sendTerminalStatus(terminalId, 'CRASHED', `Failed to SSH over tunnel to ${sshConfig.host}`);
+                wsClient.sendTerminalStatus(terminalId, 'CRASHED', `Failed to SSH over tunnel to ${sshConfig.host}`);
+                this.terminalServerMap.delete(terminalId);
             }
         });
-        // Terminal input - route to appropriate manager
-        this.wsClient.on('terminalInput', (terminalId, data) => {
+        // Terminal input - route to appropriate manager (terminals are shared)
+        wsClient.on('terminalInput', (terminalId, data) => {
             if (this.sshManager.has(terminalId)) {
                 this.sshManager.write(terminalId, data);
             }
@@ -161,8 +287,8 @@ export class Agent extends EventEmitter {
                 this.ptyManager.write(terminalId, data);
             }
         });
-        // Terminal paste files - write to disk locally and paste @paths into the terminal.
-        this.wsClient.on('terminalPasteFiles', async (terminalId, files) => {
+        // Terminal paste files
+        wsClient.on('terminalPasteFiles', async (terminalId, files) => {
             try {
                 if (!Array.isArray(files) || files.length === 0)
                     return;
@@ -189,8 +315,6 @@ export class Agent extends EventEmitter {
                     await fs.writeFile(outPath, buf);
                     writtenPaths.push(outPath);
                 }
-                // Paste paths into whichever terminal type is active.
-                // NOTE: For SSH terminals, these files exist locally on the agent, not on the remote host.
                 for (const p of writtenPaths) {
                     const text = `@${p}\r`;
                     if (this.sshManager.has(terminalId)) {
@@ -205,8 +329,8 @@ export class Agent extends EventEmitter {
                 logger.warn(`[PasteFiles] Failed for terminal ${terminalId}: ${err instanceof Error ? err.message : String(err)}`);
             }
         });
-        // Terminal resize - route to appropriate manager
-        this.wsClient.on('terminalResize', (terminalId, cols, rows) => {
+        // Terminal resize
+        wsClient.on('terminalResize', (terminalId, cols, rows) => {
             if (this.sshManager.has(terminalId)) {
                 this.sshManager.resize(terminalId, cols, rows);
             }
@@ -214,8 +338,8 @@ export class Agent extends EventEmitter {
                 this.ptyManager.resize(terminalId, cols, rows);
             }
         });
-        // Terminal stop - route to appropriate manager
-        this.wsClient.on('terminalStop', (terminalId) => {
+        // Terminal stop
+        wsClient.on('terminalStop', (terminalId) => {
             if (this.sshManager.has(terminalId)) {
                 this.sshManager.kill(terminalId);
             }
@@ -223,109 +347,78 @@ export class Agent extends EventEmitter {
                 this.ptyManager.kill(terminalId);
             }
         });
-        // PTY -> WebSocket: Forward output to server
-        this.ptyManager.setDataHandler((terminalId, data) => {
-            this.wsClient.sendTerminalOutput(terminalId, data);
-        });
-        this.ptyManager.setExitHandler((terminalId, exitCode) => {
-            this.wsClient.sendTerminalExit(terminalId, exitCode);
-            this.wsClient.sendTerminalStatus(terminalId, 'STOPPED');
-            this.emit('terminalsChanged');
-        });
-        // PTY -> WebSocket: Forward working state changes with active process name
-        this.ptyManager.setWorkingHandler((terminalId, isWorking, activeProcess) => {
-            this.wsClient.sendTerminalWorking(terminalId, isWorking, activeProcess);
-            this.emit('terminalsChanged');
-        });
-        // SSH -> WebSocket: Forward output to server
-        this.sshManager.setDataHandler((terminalId, data) => {
-            this.wsClient.sendTerminalOutput(terminalId, data);
-        });
-        this.sshManager.setExitHandler((terminalId, exitCode) => {
-            this.wsClient.sendTerminalExit(terminalId, exitCode);
-            this.wsClient.sendTerminalStatus(terminalId, 'STOPPED');
-            this.emit('terminalsChanged');
-        });
-        this.sshManager.setErrorHandler((terminalId, error) => {
-            logger.error(`SSH error for ${terminalId}: ${error}`);
-            this.wsClient.sendTerminalStatus(terminalId, 'CRASHED', error);
-        });
-        // Tunnel operations: WSClient -> TunnelManager
-        this.wsClient.on('tunnelCreate', (tunnelId, sourceAgentId, targetAgentId, role, targetHost, targetPort, protocol, idleTimeoutMs) => {
-            this.tunnelManager.handleCreate(tunnelId, sourceAgentId, targetAgentId, role, targetHost, targetPort, protocol, idleTimeoutMs);
+        // Tunnel operations
+        wsClient.on('tunnelCreate', (tunnelId, sourceAgentId, targetAgentId, role, targetHost, targetPort, protocol, idleTimeoutMs) => {
+            tunnelManager.handleCreate(tunnelId, sourceAgentId, targetAgentId, role, targetHost, targetPort, protocol, idleTimeoutMs);
         });
-        this.wsClient.on('tunnelClose', (tunnelId, reason) => {
-            this.tunnelManager.handleClose(tunnelId, reason);
+        wsClient.on('tunnelClose', (tunnelId, reason) => {
+            tunnelManager.handleClose(tunnelId, reason);
         });
-        this.wsClient.on('tunnelFlow', (tunnelId, action) => {
-            this.tunnelManager.handleFlow(tunnelId, action);
+        wsClient.on('tunnelFlow', (tunnelId, action) => {
+            tunnelManager.handleFlow(tunnelId, action);
         });
-        this.wsClient.on('tunnelBinaryData', (data) => {
-            this.tunnelManager.handleBinaryFrame(data);
+        wsClient.on('tunnelBinaryData', (data) => {
+            tunnelManager.handleBinaryFrame(data);
         });
-        // Git operations: WSClient -> PTYManager
-        this.wsClient.on('gitCheckout', async (terminalId, branch) => {
+        // Git operations → PTYManager (response goes back to the same server via shim)
+        wsClient.on('gitCheckout', async (terminalId, branch) => {
             const result = await this.ptyManager.gitCheckout(terminalId, branch);
             if (result.success) {
                 const branchInfo = await this.ptyManager.getGitBranches(terminalId);
-                this.wsClient.sendGitBranches(terminalId, branchInfo);
+                wsClient.sendGitBranches(terminalId, branchInfo);
                 const status = await this.ptyManager.getGitStatus(terminalId);
-                this.wsClient.sendGitStatus(terminalId, status);
+                wsClient.sendGitStatus(terminalId, status);
             }
         });
-        this.wsClient.on('gitCreateBranch', async (terminalId, name) => {
+        wsClient.on('gitCreateBranch', async (terminalId, name) => {
             const result = await this.ptyManager.gitCreateBranch(terminalId, name);
             if (result.success) {
                 const branchInfo = await this.ptyManager.getGitBranches(terminalId);
-                this.wsClient.sendGitBranches(terminalId, branchInfo);
+                wsClient.sendGitBranches(terminalId, branchInfo);
                 const status = await this.ptyManager.getGitStatus(terminalId);
-                this.wsClient.sendGitStatus(terminalId, status);
+                wsClient.sendGitStatus(terminalId, status);
             }
         });
-        this.wsClient.on('gitRefresh', async (terminalId) => {
+        wsClient.on('gitRefresh', async (terminalId) => {
             const branchInfo = await this.ptyManager.getGitBranches(terminalId);
-            this.wsClient.sendGitBranches(terminalId, branchInfo);
+            wsClient.sendGitBranches(terminalId, branchInfo);
             const commits = await this.ptyManager.getGitLog(terminalId);
-            this.wsClient.sendGitLog(terminalId, commits);
+            wsClient.sendGitLog(terminalId, commits);
             const status = await this.ptyManager.getGitStatus(terminalId);
-            this.wsClient.sendGitStatus(terminalId, status);
+            wsClient.sendGitStatus(terminalId, status);
         });
-        this.wsClient.on('gitFetch', async (terminalId) => {
+        wsClient.on('gitFetch', async (terminalId) => {
             const result = await this.ptyManager.gitFetch(terminalId);
-            this.wsClient.sendGitOperationResult(terminalId, 'fetch', result.success, result.error);
+            wsClient.sendGitOperationResult(terminalId, 'fetch', result.success, result.error);
             if (result.success) {
                 const status = await this.ptyManager.getGitStatus(terminalId);
-                this.wsClient.sendGitStatus(terminalId, status);
+                wsClient.sendGitStatus(terminalId, status);
             }
         });
-        this.wsClient.on('gitPush', async (terminalId) => {
+        wsClient.on('gitPush', async (terminalId) => {
             const result = await this.ptyManager.gitPush(terminalId);
-            this.wsClient.sendGitOperationResult(terminalId, 'push', result.success, result.error);
+            wsClient.sendGitOperationResult(terminalId, 'push', result.success, result.error);
             if (result.success) {
                 const status = await this.ptyManager.getGitStatus(terminalId);
-                this.wsClient.sendGitStatus(terminalId, status);
+                wsClient.sendGitStatus(terminalId, status);
             }
         });
-        this.wsClient.on('gitPull', async (terminalId) => {
+        wsClient.on('gitPull', async (terminalId) => {
             const result = await this.ptyManager.gitPull(terminalId);
-            this.wsClient.sendGitOperationResult(terminalId, 'pull', result.success, result.error);
+            wsClient.sendGitOperationResult(terminalId, 'pull', result.success, result.error);
             if (result.success) {
                 const branchInfo = await this.ptyManager.getGitBranches(terminalId);
-                this.wsClient.sendGitBranches(terminalId, branchInfo);
+                wsClient.sendGitBranches(terminalId, branchInfo);
                 const status = await this.ptyManager.getGitStatus(terminalId);
-                this.wsClient.sendGitStatus(terminalId, status);
+                wsClient.sendGitStatus(terminalId, status);
             }
         });
-        this.wsClient.on('gitStatus', async (terminalId) => {
+        wsClient.on('gitStatus', async (terminalId) => {
             const status = await this.ptyManager.getGitStatus(terminalId);
-            this.wsClient.sendGitStatus(terminalId, status);
-        });
-        // Port scanning
-        this.portScanner.on('ports', (ports) => {
-            this.wsClient.sendPorts(ports);
+            wsClient.sendGitStatus(terminalId, status);
         });
         // Preview proxy requests
-        this.wsClient.on('previewRequest', async (requestId, port, reqPath, method, headers, body) => {
+        wsClient.on('previewRequest', async (requestId, port, reqPath, method, headers, body) => {
             try {
                 const url = `http://localhost:${port}${reqPath}`;
                 const fetchOpts = { method, headers };
@@ -341,155 +434,159 @@ export class Agent extends EventEmitter {
                 });
                 if (isText) {
                     const text = await response.text();
-                    this.wsClient.sendPreviewResponse(requestId, response.status, responseHeaders, text, false);
+                    wsClient.sendPreviewResponse(requestId, response.status, responseHeaders, text, false);
                 }
                 else {
                     const buf = Buffer.from(await response.arrayBuffer());
-                    this.wsClient.sendPreviewResponse(requestId, response.status, responseHeaders, buf.toString('base64'), true);
+                    wsClient.sendPreviewResponse(requestId, response.status, responseHeaders, buf.toString('base64'), true);
                 }
             }
             catch (err) {
-                this.wsClient.sendPreviewResponse(requestId, 502, {}, `Agent could not reach localhost:${port} - ${err.message}`, false);
+                wsClient.sendPreviewResponse(requestId, 502, {}, `Agent could not reach localhost:${port} - ${err.message}`, false);
             }
         });
-        // WireGuard feature toggle from server
-        this.wsClient.on('wgFeature', (enabled, version) => {
-            logger.info(`WireGuard feature: enabled=${enabled} version=${version}`);
-        });
-        // WG peer signaling
-        this.wsClient.on('wgPeersFull', async (selfVirtualIp, peers) => {
-            if (!this.wgManager.getStatus().available)
-                return;
-            try {
-                // Ensure interface is up with our virtual IP
-                await this.wgManager.ensureInterface(selfVirtualIp);
-                // Apply all peers
-                const wgPeers = peers.map((p) => ({
-                    agentId: p.agentId,
-                    publicKey: p.publicKey,
-                    allowedIps: `${p.virtualIp}/32`,
-                    endpoint: p.endpointHint,
-                    persistentKeepalive: 25,
-                }));
-                await this.wgManager.setPeers(wgPeers);
-                // Report ready
-                const status = this.wgManager.getStatus();
-                if (status.publicKey && status.listenPort) {
-                    this.wsClient.sendWgReady(status.interfaceName || 'termify0', status.publicKey, status.listenPort);
+        // WireGuard: only wire to primary server
+        if (entry.isPrimary) {
+            wsClient.on('wgFeature', (enabled, version) => {
+                logger.info(`WireGuard feature: enabled=${enabled} version=${version}`);
+            });
+            wsClient.on('wgPeersFull', async (selfVirtualIp, peers) => {
+                if (!this.wgManager.getStatus().available)
+                    return;
+                try {
+                    await this.wgManager.ensureInterface(selfVirtualIp);
+                    const wgPeers = peers.map((p) => ({
+                        agentId: p.agentId,
+                        publicKey: p.publicKey,
+                        allowedIps: `${p.virtualIp}/32`,
+                        endpoint: p.endpointHint,
+                        persistentKeepalive: 25,
+                    }));
+                    await this.wgManager.setPeers(wgPeers);
+                    const status = this.wgManager.getStatus();
+                    if (status.publicKey && status.listenPort) {
+                        wsClient.sendWgReady(status.interfaceName || 'termify0', status.publicKey, status.listenPort);
+                    }
+                    logger.info(`WG peers configured: ${peers.length} peers, virtualIp=${selfVirtualIp}`);
                 }
-                logger.info(`WG peers configured: ${peers.length} peers, virtualIp=${selfVirtualIp}`);
-            }
-            catch (err) {
-                logger.error('Failed to configure WG peers:', err);
-            }
-        });
-        this.wsClient.on('wgPeerAdd', async (peer) => {
-            if (!this.wgManager.getStatus().available)
-                return;
-            try {
-                await this.wgManager.addPeer({
-                    agentId: peer.agentId,
-                    publicKey: peer.publicKey,
-                    allowedIps: `${peer.virtualIp}/32`,
-                    endpoint: peer.endpointHint,
-                    persistentKeepalive: 25,
-                });
-                logger.info(`WG peer added: ${peer.agentId}`);
-            }
-            catch (err) {
-                logger.error(`Failed to add WG peer ${peer.agentId}:`, err);
-            }
-        });
-        this.wsClient.on('wgPeerRemove', async (_agentId, publicKey) => {
-            if (!this.wgManager.getStatus().available)
-                return;
-            try {
-                await this.wgManager.removePeer(publicKey);
-                logger.info(`WG peer removed: ${_agentId}`);
-            }
-            catch (err) {
-                logger.error(`Failed to remove WG peer:`, err);
-            }
-        });
-        // NAT traversal
-        this.wsClient.on('wgNatProbe', async (token, servers) => {
-            if (!this.wgManager.getStatus().available)
-                return;
-            try {
-                await this.natTraversal.probe({ token, servers });
-                logger.info('NAT probe sent to ' + servers.length + ' discovery servers');
-            }
-            catch (err) {
-                logger.error('NAT probe failed:', err);
-            }
-        });
-        this.wsClient.on('wgEndpointCandidates', async (peerAgentId, peerPublicKey, candidates) => {
-            if (!this.wgManager.getStatus().available)
-                return;
-            try {
-                if (candidates.length > 0) {
-                    const best = candidates[0];
-                    const endpoint = `${best.ip}:${best.port}`;
-                    await this.wgManager.updatePeerEndpoint(peerPublicKey, endpoint);
-                    logger.info(`Updated endpoint for peer ${peerAgentId}: ${endpoint}`);
+                catch (err) {
+                    logger.error('Failed to configure WG peers:', err);
+                }
+            });
+            wsClient.on('wgPeerAdd', async (peer) => {
+                if (!this.wgManager.getStatus().available)
+                    return;
+                try {
+                    await this.wgManager.addPeer({
+                        agentId: peer.agentId,
+                        publicKey: peer.publicKey,
+                        allowedIps: `${peer.virtualIp}/32`,
+                        endpoint: peer.endpointHint,
+                        persistentKeepalive: 25,
+                    });
+                    logger.info(`WG peer added: ${peer.agentId}`);
+                }
+                catch (err) {
+                    logger.error(`Failed to add WG peer ${peer.agentId}:`, err);
+                }
+            });
+            wsClient.on('wgPeerRemove', async (_agentId, publicKey) => {
+                if (!this.wgManager.getStatus().available)
+                    return;
+                try {
+                    await this.wgManager.removePeer(publicKey);
+                    logger.info(`WG peer removed: ${_agentId}`);
+                }
+                catch (err) {
+                    logger.error(`Failed to remove WG peer:`, err);
+                }
+            });
+            wsClient.on('wgNatProbe', async (token, servers) => {
+                if (!this.wgManager.getStatus().available)
+                    return;
+                try {
+                    await this.natTraversal.probe({ token, servers });
+                    logger.info('NAT probe sent to ' + servers.length + ' discovery servers');
+                }
+                catch (err) {
+                    logger.error('NAT probe failed:', err);
+                }
+            });
+            wsClient.on('wgEndpointCandidates', async (peerAgentId, peerPublicKey, candidates) => {
+                if (!this.wgManager.getStatus().available)
+                    return;
+                try {
+                    if (candidates.length > 0) {
+                        const best = candidates[0];
+                        const endpoint = `${best.ip}:${best.port}`;
+                        await this.wgManager.updatePeerEndpoint(peerPublicKey, endpoint);
+                        logger.info(`Updated endpoint for peer ${peerAgentId}: ${endpoint}`);
+                    }
+                }
+                catch (err) {
+                    logger.error(`Failed to update endpoint for peer ${peerAgentId}:`, err);
+                }
+            });
+            wsClient.on('wgPeerUpdate', async (agentId, oldPublicKey, newPublicKey, keyVersion) => {
+                if (!this.wgManager.getStatus().available)
+                    return;
+                try {
+                    const health = await this.wgManager.getHealth();
+                    const existingPeer = health?.peers.find(p => p.publicKey === oldPublicKey);
+                    const allowedIps = existingPeer?.allowedIps || '';
+                    const endpoint = existingPeer?.endpoint;
+                    await this.wgManager.updatePeerKey(oldPublicKey, newPublicKey, allowedIps, endpoint);
+                    wsClient.sendWgRotateApplied(keyVersion);
+                    logger.info(`Peer ${agentId} key updated to v${keyVersion}`);
+                }
+                catch (err) {
+                    logger.error(`Failed to update peer ${agentId} key:`, err);
+                }
+            });
+            wsClient.on('wgRotateCommit', (keyVersion) => {
+                this.keyRotation.confirmRotation(keyVersion);
+                this.reportWgStatus();
+            });
+        }
+        // Connection events
+        wsClient.on('connected', (agentId, agentName) => {
+            this.connectedServers.add(serverUrl);
+            // Use primary server's agentId/name for dashboard
+            if (entry.isPrimary) {
+                this.agentId = agentId;
+                this.agentName = agentName;
+            }
+            this.emit('connected', agentId, agentName, serverUrl);
+            // Start stats/ports only once (on first server connection)
+            if (this.connectedServers.size === 1) {
+                this.startStatsCollection();
+                this.portScanner.start();
+                if (entry.isPrimary) {
+                    this.initWireGuard().catch(err => {
+                        logger.warn('WireGuard initialization failed:', err);
+                    });
                 }
-            }
-            catch (err) {
-                logger.error(`Failed to update endpoint for peer ${peerAgentId}:`, err);
             }
         });
-        // Key rotation: another peer rotated their key
-        this.wsClient.on('wgPeerUpdate', async (agentId, oldPublicKey, newPublicKey, keyVersion) => {
-            if (!this.wgManager.getStatus().available)
-                return;
-            try {
-                // Find peer's allowedIps from current WG config
-                const health = await this.wgManager.getHealth();
-                const existingPeer = health?.peers.find(p => p.publicKey === oldPublicKey);
-                const allowedIps = existingPeer?.allowedIps || '';
-                const endpoint = existingPeer?.endpoint;
-                await this.wgManager.updatePeerKey(oldPublicKey, newPublicKey, allowedIps, endpoint);
-                // ACK the update
-                this.wsClient.sendWgRotateApplied(keyVersion);
-                logger.info(`Peer ${agentId} key updated to v${keyVersion}`);
-            }
-            catch (err) {
-                logger.error(`Failed to update peer ${agentId} key:`, err);
+        wsClient.on('disconnected', (reason) => {
+            this.connectedServers.delete(serverUrl);
+            this.emit('disconnected', reason, serverUrl);
+            // Stop stats/ports only when ALL servers are disconnected
+            if (this.connectedServers.size === 0) {
+                this.statsManager.stop();
+                this.portScanner.stop();
             }
         });
-        // Key rotation: server confirms all peers accepted our new key
-        this.wsClient.on('wgRotateCommit', (keyVersion) => {
-            this.keyRotation.confirmRotation(keyVersion);
-            // Report updated status
-            this.reportWgStatus();
-        });
-        // Connection events
-        this.wsClient.on('connected', (agentId, agentName) => {
-            this.agentId = agentId;
-            this.agentName = agentName;
-            this.emit('connected', agentId, agentName);
-            // Start stats collection and port scanning when connected
-            this.startStatsCollection();
-            this.portScanner.start();
-            // Initialize WireGuard (non-blocking, don't delay connection)
-            this.initWireGuard().catch(err => {
-                logger.warn('WireGuard initialization failed:', err);
-            });
-        });
-        this.wsClient.on('disconnected', (reason) => {
-            // Stop stats and port scanning when disconnected
-            this.statsManager.stop();
-            this.portScanner.stop();
-            this.emit('disconnected', reason);
-        });
-        this.wsClient.on('authFailed', (error) => {
-            logger.error(`Authentication failed: ${error}`);
-            this.emit('authFailed', error);
-            this.stop();
+        wsClient.on('authFailed', (error) => {
+            logger.error(`Authentication failed for ${entry.name}: ${error}`);
+            if (entry.isPrimary) {
+                this.emit('authFailed', error);
+                this.stop();
+            }
         });
     }
     /**
-     * Start the agent
+     * Start the agent — connects to all configured servers
      */
     async start(options = {}) {
         if (!isConfigured()) {
@@ -513,78 +610,99 @@ export class Agent extends EventEmitter {
         else {
             logger.warn('termify-daemon not available, falling back to stats-agent and pgrep');
         }
-        // Connect to server
-        this.wsClient.connect();
+        // Connect to all configured servers
+        const servers = getServers();
+        if (servers.length === 0) {
+            // Backward compat: no servers array, use legacy config
+            const cfg = getConfig();
+            const legacy = {
+                name: 'primary',
+                serverUrl: cfg.serverUrl,
+                wsUrl: cfg.wsUrl,
+                accessToken: cfg.accessToken,
+                agentId: cfg.agentId,
+                lastConnected: cfg.lastConnected,
+                isPrimary: true,
+            };
+            this.addServerConnection(legacy);
+            this.wsClients.get(legacy.serverUrl)?.connect();
+        }
+        else {
+            for (const entry of servers) {
+                if (!entry.accessToken)
+                    continue; // Skip unconfigured servers
+                this.addServerConnection(entry);
+                this.wsClients.get(entry.serverUrl)?.connect();
+            }
+        }
         return true;
     }
     /**
-     * Stop the agent
+     * Stop the agent — disconnects from ALL servers
      */
     stop() {
-        if (!this.isRunning) {
+        if (!this.isRunning)
             return;
-        }
         logger.info('Stopping agent...');
         this.isRunning = false;
-        // Stop stats collection and port scanning
         this.statsManager.stop();
         this.portScanner.stop();
         this.daemonClient.stopStatsCollection();
         this.daemonClient.disconnect();
-        // Shut down NAT traversal, key rotation, and WireGuard interface
         this.keyRotation.stop();
         this.natTraversal.shutdown();
         this.wgManager.shutdown().catch(err => {
             logger.warn('WireGuard shutdown error:', err);
         });
         // Close all tunnels
-        this.tunnelManager.closeAll();
-        // Kill all terminals (both local and SSH)
+        for (const tm of this.tunnelManagers.values()) {
+            tm.closeAll();
+        }
         this.ptyManager.killAll();
         this.sshManager.killAll();
-        // Disconnect from server
-        this.wsClient.disconnect();
+        // Disconnect ALL servers
+        for (const ws of this.wsClients.values()) {
+            ws.disconnect();
+        }
+        this.connectedServers.clear();
+        this.terminalServerMap.clear();
         this.emit('stopped');
     }
     /**
-     * Hibernate the agent - kills PTYs silently so server marks them HIBERNATED.
-     * Used during graceful shutdown (Cmd+Q, SIGTERM) to preserve terminal state.
+     * Hibernate the agent — kills PTYs silently, disconnects ALL servers
      */
     hibernate() {
-        if (!this.isRunning) {
+        if (!this.isRunning)
             return;
-        }
         logger.info('Hibernating agent...');
         this.isRunning = false;
-        // Stop stats collection and port scanning
         this.statsManager.stop();
         this.portScanner.stop();
         this.daemonClient.stopStatsCollection();
         this.daemonClient.disconnect();
-        // Shut down NAT traversal, key rotation, and WireGuard interface
         this.keyRotation.stop();
         this.natTraversal.shutdown();
         this.wgManager.shutdown().catch(err => {
             logger.warn('WireGuard shutdown error:', err);
         });
-        // Close all tunnels
-        this.tunnelManager.closeAll();
-        // Hibernate local terminals (silent kill - no exit events sent to server)
+        for (const tm of this.tunnelManagers.values()) {
+            tm.closeAll();
+        }
         this.ptyManager.hibernateAll();
-        // SSH can't hibernate - just kill them
         this.sshManager.killAll();
-        // Disconnect from server (this triggers server-side HIBERNATED marking)
-        this.wsClient.disconnect();
+        for (const ws of this.wsClients.values()) {
+            ws.disconnect();
+        }
+        this.connectedServers.clear();
+        this.terminalServerMap.clear();
         this.emit('stopped');
     }
     /**
-     * Start collecting and sending system stats
+     * Start collecting and sending system stats — broadcast to ALL servers
      */
     startStatsCollection() {
-        // Always use stats-agent for complete system metrics
-        // (daemon only provides basic CPU/RAM, missing disks, network, per-core CPU, swap)
         this.statsManager.setStatsCallback((stats) => {
-            this.wsClient.sendStats(stats);
+            this.broadcastAll(ws => ws.sendStats(stats));
             this.emit('stats', stats);
         });
         const started = this.statsManager.start();
@@ -596,12 +714,10 @@ export class Agent extends EventEmitter {
         }
     }
     /**
-     * Initialize WireGuard detection and report status.
-     * Non-blocking — called with .catch() so it never delays the connection.
+     * Initialize WireGuard (primary server only)
      */
     async initWireGuard() {
         const installResult = await this.wgManager.ensureInstalled();
-        // Report initial status regardless of availability
         this.reportWgStatus();
         if (installResult.available) {
             const status = this.wgManager.getStatus();
@@ -613,15 +729,15 @@ export class Agent extends EventEmitter {
             logger.info(`WireGuard not available: ${installResult.availability}`);
             return;
         }
-        // Interface setup will happen when we receive our virtual IP from signaling (Phase 2)
         logger.info(`WireGuard detected: backend=${installResult.backend}, version=${installResult.version}`);
     }
     /**
-     * Report WireGuard status to server using real data from the WireGuardManager.
+     * Report WireGuard status to primary server
      */
     reportWgStatus() {
         const status = this.wgManager.getStatus();
-        this.wsClient.sendWgStatus({
+        const primaryWs = this.getPrimaryWsClient();
+        primaryWs?.sendWgStatus({
             type: 'agent.wg.status',
             available: status.available,
             availability: status.availability,
@@ -629,7 +745,7 @@ export class Agent extends EventEmitter {
             version: status.version,
             publicKey: status.publicKey,
             listenPort: status.listenPort,
-            natType: 'unknown', // Phase 3 will detect this
+            natType: 'unknown',
             connectedPeers: status.connectedPeers,
         });
     }
@@ -639,50 +755,38 @@ export class Agent extends EventEmitter {
     handleShutdown(signal) {
         logger.info(`Received ${signal}, hibernating...`);
         this.hibernate();
-        // Small delay to let WS disconnect message flush before exiting
         setTimeout(() => process.exit(0), 200);
     }
-    /**
-     * Check if agent is running
-     */
     get running() {
         return this.isRunning;
     }
-    /**
-     * Check if connected to server
-     */
     get connected() {
-        return this.wsClient.connected;
+        return this.connectedServers.size > 0;
     }
-    /**
-     * Get current agent ID
-     */
     get id() {
         return this.agentId;
     }
-    /**
-     * Get current agent name
-     */
     get name() {
         return this.agentName;
     }
-    /**
-     * Get number of active terminals (local + SSH)
-     */
     get terminalCount() {
         return this.ptyManager.count + this.sshManager.count;
     }
     /**
-     * Get status information
+     * Get number of connected servers
      */
+    get serverCount() {
+        return this.connectedServers.size;
+    }
     getStatus() {
         const config = getConfig();
         return {
             running: this.isRunning,
-            connected: this.wsClient.connected,
+            connected: this.connectedServers.size > 0,
             agentId: this.agentId,
             agentName: this.agentName,
             terminalCount: this.ptyManager.count,
+            serverCount: this.connectedServers.size,
             config: {
                 serverUrl: config.serverUrl,
                 machineId: config.machineId,
@@ -690,9 +794,6 @@ export class Agent extends EventEmitter {
             },
         };
     }
-    /**
-     * Get combined list of all terminals for dashboard display
-     */
     getTerminals() {
         const locals = this.ptyManager.listTerminals().map(t => ({
             id: t.id,
@@ -710,9 +811,6 @@ export class Agent extends EventEmitter {
         }));
         return [...locals, ...sshs];
     }
-    /**
-     * Get WireGuard info for dashboard display
-     */
     getWireGuardInfo() {
         const status = this.wgManager.getStatus();
         return {