tmex-cli 0.10.0 → 0.12.0

package/dist/runtime/server.js

@@ -22549,8 +22549,8 @@ function applyRepoEnv(name, env, options, log) {
 loadEnv();
 
 // src/runtime/server.ts
-import { existsSync as existsSync5 } from "fs";
-import { extname as extname2, join as join6, normalize, resolve as resolve4, sep } from "path";
+import { existsSync as existsSync8 } from "fs";
+import { extname as extname2, join as join8, normalize, resolve as resolve6, sep } from "path";
 
 // ../../apps/gateway/src/crypto/errors.ts
 function contextLabel(context) {
@@ -22659,6 +22659,8 @@ var I18N_RESOURCES = {
         authKey: "Private Key",
         authAgent: "SSH Agent",
         authConfigRef: "SSH Config",
+        sshConfigRefPlaceholder: "Host alias, e.g. my-server",
+        sshConfigRefHint: "A Host alias from your ssh config, resolved via `ssh -G`. Not the path to the config file.",
         password: "Password",
         privateKey: "Private Key",
         privateKeyPlaceholder: "-----BEGIN OPENSSH PRIVATE KEY-----",
@@ -22740,11 +22742,22 @@ var I18N_RESOURCES = {
         language_en_US: "English",
         language_zh_CN: "\u7B80\u4F53\u4E2D\u6587",
         language_ja_JP: "\u65E5\u672C\u8A9E",
-        theme: "Theme",
+        theme: "Dark Mode",
         themeLight: "Light",
         themeDark: "Dark",
         siteTab: "Site",
         notificationsTab: "Notifications",
+        tabGroup: {
+          general: "General",
+          devicesAndFiles: "Devices & Files",
+          notifications: "Notifications",
+          ai: "AI"
+        },
+        deviceManagement: {
+          title: "Device Management",
+          description: "Add, edit, and connect to your local and SSH devices.",
+          openButton: "Open Device Management"
+        },
         refreshToApply: "Refresh to apply language change",
         saveSettings: "Save Settings",
         settingsSaved: "Settings saved",
@@ -22798,6 +22811,7 @@ var I18N_RESOURCES = {
         search: {
           title: "Search",
           provider: "Search Provider",
+          responsesApiHint: "If your LLM provider uses the OpenAI Responses API protocol, it can use that API's built-in hosted search tool; the third-party search below is an optional supplement.",
           providerNone: "Disabled",
           tavilyApiKey: "Tavily API Key",
           braveApiKey: "Brave API Key",
@@ -22830,6 +22844,35 @@ var I18N_RESOURCES = {
           toggleFailed: "Failed to update directory",
           deleteTitle: "Remove directory?",
           deleteDesc: 'Remove "{{path}}" from the whitelist? Files under it will no longer be accessible.'
+        },
+        version: {
+          title: "Version & Updates",
+          currentVersion: "Current version",
+          installMethod: "Install method",
+          installMethodCli: "Installed via CLI",
+          installMethodNonCli: "Not installed via CLI",
+          deployment: "Deployment",
+          deploymentLaunchd: "launchd (macOS)",
+          deploymentSystemd: "systemd (Linux)",
+          deploymentNone: "None",
+          checkUpdate: "Check for updates",
+          checking: "Checking\u2026",
+          upToDate: "You are on the latest version.",
+          updateAvailable: "Update available: {{version}}",
+          changelog: "Changelog",
+          changelogUnavailable: "No changelog available for this version.",
+          publishedAt: "Published {{date}}",
+          upgrade: "Upgrade now",
+          upgradeDisabledDev: "In-app update is disabled outside the production environment.",
+          upgradeDisabledNonCli: "In-app update is only available for CLI installations.",
+          upgradeWarningTitle: "Confirm upgrade",
+          upgradeWarningBody: "Upgrading restarts the service and will interrupt your current session. It may also affect the survival of tmux processes managed by the service. Continue?",
+          upgradeStarted: "Upgrade started",
+          stateDownloading: "Downloading the new version\u2026",
+          stateExecuting: "Applying the upgrade, the service is restarting\u2026",
+          interruptNotice: "The connection will drop while the service restarts; it will recover shortly.",
+          checkFailed: "Failed to check for updates",
+          terminalHint: "Or upgrade from a terminal: npx tmex-cli@<version> upgrade"
         }
       },
       telegram: {
@@ -22839,6 +22882,7 @@ var I18N_RESOURCES = {
         botToken: "Bot Token",
         botTokenPlaceholder: "123456:AA...",
         addBot: "Add Bot",
+        editBot: "Edit Bot",
         enableBot: "Enable Bot",
         allowAuthRequests: "Allow Authorization Requests",
         pendingChats: "Pending Authorization",
@@ -23015,7 +23059,11 @@ Time: {{time}}`,
         fileTooLarge: "File is too large",
         fileBinary: "Binary files are not supported",
         fileRootDeviceInvalid: "Invalid or unknown device",
-        fileRootDuplicate: "This directory is already added for the device"
+        fileRootDuplicate: "This directory is already added for the device",
+        upgradeNotAllowed: "In-app update is not available for this installation.",
+        upgradeInProgress: "An upgrade is already in progress.",
+        upgradeVersionRequired: "Target version is required.",
+        updateCheckFailed: "Failed to query the npm registry."
       },
       notification: {
         clickToJump: "Click to jump to corresponding pane",
@@ -23304,7 +23352,10 @@ Time: {{time}}`,
       },
       validation: {
         deviceNameRequired: "Device name is required",
-        hostRequired: "Host is required for SSH devices"
+        hostRequired: "Host is required for SSH devices",
+        portRequired: "A valid port is required for SSH devices",
+        usernameRequired: "Username is required for SSH devices",
+        sshConfigRequired: "SSH config path is required for SSH devices"
       },
       files: {
         title: "Files",
@@ -23333,12 +23384,45 @@ Time: {{time}}`,
           unknown: "Failed to load"
         },
         retry: "Retry (collapse then expand)",
+        menu: {
+          copyAbsolute: "Copy absolute path",
+          copyRelative: "Copy relative path",
+          sendToAgent: "Send to Agent",
+          expand: "Expand",
+          collapse: "Collapse",
+          upload: "Upload files here",
+          open: "Open"
+        },
+        copied: "Copied to clipboard",
+        copyFailed: "Copy failed",
+        sendToAgent: {
+          prompt: "Please work with this path: `{{path}}`"
+        },
+        upload: {
+          uploading: "Uploading {{name}}\u2026",
+          success: "Uploaded {{name}}",
+          fail: "Failed to upload {{name}}"
+        },
+        transfer: {
+          legUserToTmex: "Browser \u2192 tmex",
+          legTmexToServer: "tmex \u2192 Server",
+          legServerToTmex: "Server \u2192 tmex",
+          legTmexToUser: "tmex \u2192 Browser",
+          cancel: "Cancel",
+          canceled: "Canceled {{name}}",
+          downloaded: "Downloaded {{name}}",
+          downloadFailed: "Failed to download {{name}}",
+          dragDownloadStarted: "Started downloading {{name}} (handled by browser)",
+          tooLarge: "{{name}} exceeds the size limit ({{max}})"
+        },
+        agentLaunch: {
+          connectFailed: "Failed to connect to the device",
+          windowFailed: "Failed to create a window"
+        },
         install: {
           button: "Install rsync",
           scopeLocal: "server",
           scopeRemote: "remote",
-          connectFailed: "Failed to connect to the device",
-          windowFailed: "Failed to create a window",
           prompt: "rsync is not installed on {{device}} ({{scope}}). Please install rsync using the appropriate command for this system (e.g. `brew install rsync`, `sudo apt-get install -y rsync`, or `sudo yum install -y rsync`), then reply once it is done."
         }
       },
@@ -23438,6 +23522,8 @@ Time: {{time}}`,
         authKey: "\u79C1\u94A5",
         authAgent: "SSH Agent",
         authConfigRef: "SSH Config",
+        sshConfigRefPlaceholder: "Host \u522B\u540D\uFF0C\u5982 my-server",
+        sshConfigRefHint: "\u586B ssh config \u91CC\u7684 Host \u522B\u540D\uFF0C\u7ECF `ssh -G` \u89E3\u6790\uFF1B\u4E0D\u662F config \u6587\u4EF6\u8DEF\u5F84\u3002",
         password: "\u5BC6\u7801",
         privateKey: "\u79C1\u94A5",
         privateKeyPlaceholder: "-----BEGIN OPENSSH PRIVATE KEY-----",
@@ -23519,11 +23605,22 @@ Time: {{time}}`,
         language_en_US: "English",
         language_zh_CN: "\u7B80\u4F53\u4E2D\u6587",
         language_ja_JP: "\u65E5\u672C\u8A9E",
-        theme: "\u4E3B\u9898",
+        theme: "\u6DF1\u8272\u6A21\u5F0F",
         themeLight: "\u6D45\u8272",
         themeDark: "\u6DF1\u8272",
         siteTab: "\u7AD9\u70B9",
         notificationsTab: "\u901A\u77E5",
+        tabGroup: {
+          general: "\u901A\u7528\u8BBE\u7F6E",
+          devicesAndFiles: "\u8BBE\u5907\u4E0E\u6587\u4EF6",
+          notifications: "\u901A\u77E5\u8BBE\u7F6E",
+          ai: "AI \u8BBE\u7F6E"
+        },
+        deviceManagement: {
+          title: "\u8BBE\u5907\u7BA1\u7406",
+          description: "\u6DFB\u52A0\u3001\u7F16\u8F91\u5E76\u8FDE\u63A5\u4F60\u7684\u672C\u5730\u4E0E SSH \u8BBE\u5907\u3002",
+          openButton: "\u6253\u5F00\u8BBE\u5907\u7BA1\u7406"
+        },
         refreshToApply: "\u5237\u65B0\u540E\u751F\u6548",
         saveSettings: "\u4FDD\u5B58\u8BBE\u7F6E",
         settingsSaved: "\u7AD9\u70B9\u8BBE\u7F6E\u5DF2\u4FDD\u5B58",
@@ -23577,6 +23674,7 @@ Time: {{time}}`,
         search: {
           title: "\u641C\u7D22",
           provider: "\u641C\u7D22\u63D0\u4F9B\u5546",
+          responsesApiHint: "\u82E5 LLM Provider \u4F7F\u7528 OpenAI Responses API \u534F\u8BAE\uFF0C\u53EF\u76F4\u63A5\u4F7F\u7528\u5176\u5185\u7F6E\u7684 hosted \u641C\u7D22\u5DE5\u5177\uFF1B\u4E0B\u65B9\u7B2C\u4E09\u65B9\u641C\u7D22\u4E3A\u53EF\u9009\u8865\u5145\u3002",
           providerNone: "\u4E0D\u542F\u7528",
           tavilyApiKey: "Tavily API Key",
           braveApiKey: "Brave API Key",
@@ -23609,6 +23707,35 @@ Time: {{time}}`,
           toggleFailed: "\u66F4\u65B0\u76EE\u5F55\u5931\u8D25",
           deleteTitle: "\u79FB\u9664\u76EE\u5F55\uFF1F",
           deleteDesc: "\u5C06\u300C{{path}}\u300D\u79FB\u51FA\u767D\u540D\u5355\uFF1F\u8BE5\u76EE\u5F55\u4E0B\u7684\u6587\u4EF6\u5C06\u4E0D\u518D\u53EF\u8BBF\u95EE\u3002"
+        },
+        version: {
+          title: "\u7248\u672C\u4E0E\u66F4\u65B0",
+          currentVersion: "\u5F53\u524D\u7248\u672C",
+          installMethod: "\u5B89\u88C5\u65B9\u5F0F",
+          installMethodCli: "\u901A\u8FC7 CLI \u5B89\u88C5",
+          installMethodNonCli: "\u975E CLI \u5B89\u88C5",
+          deployment: "\u90E8\u7F72\u65B9\u5F0F",
+          deploymentLaunchd: "launchd\uFF08macOS\uFF09",
+          deploymentSystemd: "systemd\uFF08Linux\uFF09",
+          deploymentNone: "\u65E0",
+          checkUpdate: "\u68C0\u67E5\u66F4\u65B0",
+          checking: "\u68C0\u67E5\u4E2D\u2026",
+          upToDate: "\u5DF2\u662F\u6700\u65B0\u7248\u672C\u3002",
+          updateAvailable: "\u6709\u53EF\u7528\u66F4\u65B0\uFF1A{{version}}",
+          changelog: "\u66F4\u65B0\u65E5\u5FD7",
+          changelogUnavailable: "\u8BE5\u7248\u672C\u6682\u65E0\u66F4\u65B0\u65E5\u5FD7\u3002",
+          publishedAt: "\u53D1\u5E03\u4E8E {{date}}",
+          upgrade: "\u7ACB\u5373\u5347\u7EA7",
+          upgradeDisabledDev: "\u975E production \u73AF\u5883\u5DF2\u7981\u7528\u7A0B\u5E8F\u5185\u66F4\u65B0\u3002",
+          upgradeDisabledNonCli: "\u7A0B\u5E8F\u5185\u66F4\u65B0\u4EC5\u5728\u901A\u8FC7 CLI \u5B89\u88C5\u65F6\u53EF\u7528\u3002",
+          upgradeWarningTitle: "\u786E\u8BA4\u5347\u7EA7",
+          upgradeWarningBody: "\u5347\u7EA7\u4F1A\u91CD\u542F\u670D\u52A1\u5E76\u4E2D\u65AD\u5F53\u524D\u8BBF\u95EE\uFF0C\u8FD8\u53EF\u80FD\u5F71\u54CD\u8BE5\u670D\u52A1\u6258\u7BA1\u7684 tmux \u8FDB\u7A0B\u7684\u5B58\u6D3B\u3002\u662F\u5426\u7EE7\u7EED\uFF1F",
+          upgradeStarted: "\u5347\u7EA7\u5DF2\u5F00\u59CB",
+          stateDownloading: "\u6B63\u5728\u4E0B\u8F7D\u65B0\u7248\u672C\u2026",
+          stateExecuting: "\u6B63\u5728\u6267\u884C\u5347\u7EA7\uFF0C\u670D\u52A1\u5373\u5C06\u91CD\u542F\u2026",
+          interruptNotice: "\u670D\u52A1\u91CD\u542F\u671F\u95F4\u8FDE\u63A5\u4F1A\u65AD\u5F00\uFF0C\u7A0D\u5019\u5373\u53EF\u6062\u590D\u3002",
+          checkFailed: "\u68C0\u67E5\u66F4\u65B0\u5931\u8D25",
+          terminalHint: "\u6216\u901A\u8FC7\u7EC8\u7AEF\u5347\u7EA7\uFF1Anpx tmex-cli@<version> upgrade"
         }
       },
       telegram: {
@@ -23618,6 +23745,7 @@ Time: {{time}}`,
         botToken: "Bot Token",
         botTokenPlaceholder: "123456:AA...",
         addBot: "\u65B0\u589E Bot",
+        editBot: "\u7F16\u8F91 Bot",
         enableBot: "\u542F\u7528 Bot",
         allowAuthRequests: "\u5141\u8BB8\u7533\u8BF7\u6388\u6743",
         pendingChats: "\u5F85\u6388\u6743",
@@ -23794,7 +23922,11 @@ Bot\uFF1A{{botName}}
         fileTooLarge: "\u6587\u4EF6\u8FC7\u5927",
         fileBinary: "\u4E0D\u652F\u6301\u4E8C\u8FDB\u5236\u6587\u4EF6",
         fileRootDeviceInvalid: "\u65E0\u6548\u6216\u672A\u77E5\u7684\u8BBE\u5907",
-        fileRootDuplicate: "\u8BE5\u8BBE\u5907\u4E0B\u5DF2\u6DFB\u52A0\u8FC7\u6B64\u76EE\u5F55"
+        fileRootDuplicate: "\u8BE5\u8BBE\u5907\u4E0B\u5DF2\u6DFB\u52A0\u8FC7\u6B64\u76EE\u5F55",
+        upgradeNotAllowed: "\u5F53\u524D\u5B89\u88C5\u65B9\u5F0F\u4E0D\u652F\u6301\u7A0B\u5E8F\u5185\u66F4\u65B0\u3002",
+        upgradeInProgress: "\u5DF2\u6709\u5347\u7EA7\u4EFB\u52A1\u6B63\u5728\u8FDB\u884C\u3002",
+        upgradeVersionRequired: "\u7F3A\u5C11\u76EE\u6807\u7248\u672C\u53F7\u3002",
+        updateCheckFailed: "\u67E5\u8BE2 npm registry \u5931\u8D25\u3002"
       },
       notification: {
         clickToJump: "\u70B9\u51FB\u8DF3\u8F6C\u5230\u5BF9\u5E94 Pane",
@@ -24083,7 +24215,10 @@ Bot\uFF1A{{botName}}
       },
       validation: {
         deviceNameRequired: "\u8BBE\u5907\u540D\u79F0\u4E3A\u5FC5\u586B\u9879",
-        hostRequired: "SSH \u8BBE\u5907\u9700\u8981\u586B\u5199\u4E3B\u673A\u5730\u5740"
+        hostRequired: "SSH \u8BBE\u5907\u9700\u8981\u586B\u5199\u4E3B\u673A\u5730\u5740",
+        portRequired: "SSH \u8BBE\u5907\u9700\u8981\u586B\u5199\u6709\u6548\u7AEF\u53E3",
+        usernameRequired: "SSH \u8BBE\u5907\u9700\u8981\u586B\u5199\u7528\u6237\u540D",
+        sshConfigRequired: "SSH \u8BBE\u5907\u9700\u8981\u586B\u5199 ssh config \u8DEF\u5F84"
       },
       files: {
         title: "\u6587\u4EF6",
@@ -24112,12 +24247,45 @@ Bot\uFF1A{{botName}}
           unknown: "\u52A0\u8F7D\u5931\u8D25"
         },
         retry: "\u91CD\u8BD5\uFF08\u6536\u8D77\u540E\u518D\u5C55\u5F00\uFF09",
+        menu: {
+          copyAbsolute: "\u590D\u5236\u7EDD\u5BF9\u4F4D\u7F6E",
+          copyRelative: "\u590D\u5236\u76F8\u5BF9\u4F4D\u7F6E",
+          sendToAgent: "\u53D1\u9001\u5230 Agent",
+          expand: "\u5C55\u5F00",
+          collapse: "\u6536\u8D77",
+          upload: "\u4E0A\u4F20\u6587\u4EF6\u5230\u8FD9\u4E2A\u6587\u4EF6\u5939",
+          open: "\u6253\u5F00"
+        },
+        copied: "\u5DF2\u590D\u5236\u5230\u526A\u8D34\u677F",
+        copyFailed: "\u590D\u5236\u5931\u8D25",
+        sendToAgent: {
+          prompt: "\u8BF7\u5904\u7406\u8FD9\u4E2A\u8DEF\u5F84\uFF1A`{{path}}`"
+        },
+        upload: {
+          uploading: "\u6B63\u5728\u4E0A\u4F20 {{name}}\u2026",
+          success: "\u5DF2\u4E0A\u4F20 {{name}}",
+          fail: "\u4E0A\u4F20 {{name}} \u5931\u8D25"
+        },
+        transfer: {
+          legUserToTmex: "\u7528\u6237 \u2192 tmex",
+          legTmexToServer: "tmex \u2192 \u670D\u52A1\u5668",
+          legServerToTmex: "\u670D\u52A1\u5668 \u2192 tmex",
+          legTmexToUser: "tmex \u2192 \u7528\u6237",
+          cancel: "\u53D6\u6D88",
+          canceled: "\u5DF2\u53D6\u6D88 {{name}}",
+          downloaded: "\u5DF2\u4E0B\u8F7D {{name}}",
+          downloadFailed: "\u4E0B\u8F7D {{name}} \u5931\u8D25",
+          dragDownloadStarted: "\u5DF2\u5F00\u59CB\u4E0B\u8F7D {{name}}\uFF08\u7531\u6D4F\u89C8\u5668\u63A5\u7BA1\uFF09",
+          tooLarge: "{{name}} \u8D85\u8FC7\u5927\u5C0F\u4E0A\u9650\uFF08{{max}}\uFF09"
+        },
+        agentLaunch: {
+          connectFailed: "\u8FDE\u63A5\u8BBE\u5907\u5931\u8D25",
+          windowFailed: "\u521B\u5EFA\u7A97\u53E3\u5931\u8D25"
+        },
         install: {
           button: "\u5B89\u88C5 rsync",
           scopeLocal: "\u670D\u52A1\u5668",
           scopeRemote: "\u8FDC\u7A0B",
-          connectFailed: "\u8FDE\u63A5\u8BBE\u5907\u5931\u8D25",
-          windowFailed: "\u521B\u5EFA\u7A97\u53E3\u5931\u8D25",
           prompt: "\u8BBE\u5907 {{device}}\uFF08{{scope}}\uFF09\u4E0A\u672A\u68C0\u6D4B\u5230 rsync\u3002\u8BF7\u6839\u636E\u7CFB\u7EDF\u9009\u62E9\u5408\u9002\u7684\u547D\u4EE4\u5B89\u88C5 rsync\uFF08\u4F8B\u5982 `brew install rsync`\u3001`sudo apt-get install -y rsync` \u6216 `sudo yum install -y rsync`\uFF09\uFF0C\u5B89\u88C5\u5B8C\u6210\u540E\u56DE\u590D\u6211\u3002"
         }
       },
@@ -24217,6 +24385,8 @@ Bot\uFF1A{{botName}}
         authKey: "\u79D8\u5BC6\u9375",
         authAgent: "SSH Agent",
         authConfigRef: "SSH Config",
+        sshConfigRefPlaceholder: "Host \u30A8\u30A4\u30EA\u30A2\u30B9\uFF08\u4F8B: my-server\uFF09",
+        sshConfigRefHint: "ssh config \u306E Host \u30A8\u30A4\u30EA\u30A2\u30B9\u3092\u5165\u529B\u3057\u307E\u3059\u3002`ssh -G` \u3067\u89E3\u6C7A\u3055\u308C\u307E\u3059\u3002config \u30D5\u30A1\u30A4\u30EB\u306E\u30D1\u30B9\u3067\u306F\u3042\u308A\u307E\u305B\u3093\u3002",
         password: "\u30D1\u30B9\u30EF\u30FC\u30C9",
         privateKey: "\u79D8\u5BC6\u9375",
         privateKeyPlaceholder: "-----BEGIN OPENSSH PRIVATE KEY-----",
@@ -24298,11 +24468,22 @@ Bot\uFF1A{{botName}}
         language_en_US: "English",
         language_zh_CN: "\u7B80\u4F53\u4E2D\u6587",
         language_ja_JP: "\u65E5\u672C\u8A9E",
-        theme: "\u30C6\u30FC\u30DE",
+        theme: "\u30C0\u30FC\u30AF\u30E2\u30FC\u30C9",
         themeLight: "\u30E9\u30A4\u30C8",
         themeDark: "\u30C0\u30FC\u30AF",
         siteTab: "\u30B5\u30A4\u30C8",
         notificationsTab: "\u901A\u77E5",
+        tabGroup: {
+          general: "\u4E00\u822C\u8A2D\u5B9A",
+          devicesAndFiles: "\u30C7\u30D0\u30A4\u30B9\u3068\u30D5\u30A1\u30A4\u30EB",
+          notifications: "\u901A\u77E5\u8A2D\u5B9A",
+          ai: "AI \u8A2D\u5B9A"
+        },
+        deviceManagement: {
+          title: "\u30C7\u30D0\u30A4\u30B9\u7BA1\u7406",
+          description: "\u30ED\u30FC\u30AB\u30EB\u304A\u3088\u3073 SSH \u30C7\u30D0\u30A4\u30B9\u306E\u8FFD\u52A0\u30FB\u7DE8\u96C6\u30FB\u63A5\u7D9A\u3092\u884C\u3044\u307E\u3059\u3002",
+          openButton: "\u30C7\u30D0\u30A4\u30B9\u7BA1\u7406\u3092\u958B\u304F"
+        },
         refreshToApply: "\u8A00\u8A9E\u5909\u66F4\u3092\u9069\u7528\u3059\u308B\u306B\u306F\u66F4\u65B0\u3057\u3066\u304F\u3060\u3055\u3044",
         saveSettings: "\u8A2D\u5B9A\u3092\u4FDD\u5B58",
         settingsSaved: "\u8A2D\u5B9A\u3092\u4FDD\u5B58\u3057\u307E\u3057\u305F",
@@ -24356,6 +24537,7 @@ Bot\uFF1A{{botName}}
         search: {
           title: "\u691C\u7D22",
           provider: "\u691C\u7D22\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC",
+          responsesApiHint: "LLM \u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u304C OpenAI Responses API \u30D7\u30ED\u30C8\u30B3\u30EB\u3092\u4F7F\u7528\u3057\u3066\u3044\u308B\u5834\u5408\u3001\u305D\u306E\u5185\u8535 hosted \u691C\u7D22\u30C4\u30FC\u30EB\u3092\u5229\u7528\u3067\u304D\u307E\u3059\u3002\u4E0B\u8A18\u306E\u30B5\u30FC\u30C9\u30D1\u30FC\u30C6\u30A3\u691C\u7D22\u306F\u4EFB\u610F\u306E\u88DC\u5B8C\u3067\u3059\u3002",
           providerNone: "\u7121\u52B9",
           tavilyApiKey: "Tavily API \u30AD\u30FC",
           braveApiKey: "Brave API \u30AD\u30FC",
@@ -24388,6 +24570,35 @@ Bot\uFF1A{{botName}}
           toggleFailed: "\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u306E\u66F4\u65B0\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
           deleteTitle: "\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u3092\u524A\u9664\u3057\u307E\u3059\u304B\uFF1F",
           deleteDesc: "\u300C{{path}}\u300D\u3092\u30DB\u30EF\u30A4\u30C8\u30EA\u30B9\u30C8\u304B\u3089\u524A\u9664\u3057\u307E\u3059\u304B\uFF1F\u914D\u4E0B\u306E\u30D5\u30A1\u30A4\u30EB\u306B\u30A2\u30AF\u30BB\u30B9\u3067\u304D\u306A\u304F\u306A\u308A\u307E\u3059\u3002"
+        },
+        version: {
+          title: "\u30D0\u30FC\u30B8\u30E7\u30F3\u3068\u66F4\u65B0",
+          currentVersion: "\u73FE\u5728\u306E\u30D0\u30FC\u30B8\u30E7\u30F3",
+          installMethod: "\u30A4\u30F3\u30B9\u30C8\u30FC\u30EB\u65B9\u6CD5",
+          installMethodCli: "CLI \u3067\u30A4\u30F3\u30B9\u30C8\u30FC\u30EB",
+          installMethodNonCli: "CLI \u4EE5\u5916\u3067\u30A4\u30F3\u30B9\u30C8\u30FC\u30EB",
+          deployment: "\u30C7\u30D7\u30ED\u30A4\u65B9\u5F0F",
+          deploymentLaunchd: "launchd\uFF08macOS\uFF09",
+          deploymentSystemd: "systemd\uFF08Linux\uFF09",
+          deploymentNone: "\u306A\u3057",
+          checkUpdate: "\u66F4\u65B0\u3092\u78BA\u8A8D",
+          checking: "\u78BA\u8A8D\u4E2D\u2026",
+          upToDate: "\u6700\u65B0\u30D0\u30FC\u30B8\u30E7\u30F3\u3067\u3059\u3002",
+          updateAvailable: "\u66F4\u65B0\u304C\u3042\u308A\u307E\u3059\uFF1A{{version}}",
+          changelog: "\u5909\u66F4\u5C65\u6B74",
+          changelogUnavailable: "\u3053\u306E\u30D0\u30FC\u30B8\u30E7\u30F3\u306E\u5909\u66F4\u5C65\u6B74\u306F\u3042\u308A\u307E\u305B\u3093\u3002",
+          publishedAt: "\u516C\u958B\u65E5 {{date}}",
+          upgrade: "\u4ECA\u3059\u3050\u66F4\u65B0",
+          upgradeDisabledDev: "production \u4EE5\u5916\u306E\u74B0\u5883\u3067\u306F\u30A2\u30D7\u30EA\u5185\u66F4\u65B0\u306F\u7121\u52B9\u3067\u3059\u3002",
+          upgradeDisabledNonCli: "\u30A2\u30D7\u30EA\u5185\u66F4\u65B0\u306F CLI \u30A4\u30F3\u30B9\u30C8\u30FC\u30EB\u6642\u306E\u307F\u5229\u7528\u3067\u304D\u307E\u3059\u3002",
+          upgradeWarningTitle: "\u66F4\u65B0\u306E\u78BA\u8A8D",
+          upgradeWarningBody: "\u66F4\u65B0\u3059\u308B\u3068\u30B5\u30FC\u30D3\u30B9\u304C\u518D\u8D77\u52D5\u3057\u3001\u73FE\u5728\u306E\u30BB\u30C3\u30B7\u30E7\u30F3\u304C\u4E2D\u65AD\u3055\u308C\u307E\u3059\u3002\u30B5\u30FC\u30D3\u30B9\u304C\u7BA1\u7406\u3059\u308B tmux \u30D7\u30ED\u30BB\u30B9\u306E\u5B58\u7D9A\u306B\u3082\u5F71\u97FF\u3059\u308B\u53EF\u80FD\u6027\u304C\u3042\u308A\u307E\u3059\u3002\u7D9A\u884C\u3057\u307E\u3059\u304B\uFF1F",
+          upgradeStarted: "\u66F4\u65B0\u3092\u958B\u59CB\u3057\u307E\u3057\u305F",
+          stateDownloading: "\u65B0\u3057\u3044\u30D0\u30FC\u30B8\u30E7\u30F3\u3092\u30C0\u30A6\u30F3\u30ED\u30FC\u30C9\u4E2D\u2026",
+          stateExecuting: "\u66F4\u65B0\u3092\u9069\u7528\u4E2D\u3001\u30B5\u30FC\u30D3\u30B9\u3092\u518D\u8D77\u52D5\u3057\u3066\u3044\u307E\u3059\u2026",
+          interruptNotice: "\u30B5\u30FC\u30D3\u30B9\u518D\u8D77\u52D5\u4E2D\u306F\u63A5\u7D9A\u304C\u5207\u65AD\u3055\u308C\u307E\u3059\u304C\u3001\u307E\u3082\u306A\u304F\u5FA9\u65E7\u3057\u307E\u3059\u3002",
+          checkFailed: "\u66F4\u65B0\u306E\u78BA\u8A8D\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+          terminalHint: "\u307E\u305F\u306F\u30BF\u30FC\u30DF\u30CA\u30EB\u304B\u3089\u66F4\u65B0\uFF1Anpx tmex-cli@<version> upgrade"
         }
       },
       telegram: {
@@ -24397,6 +24608,7 @@ Bot\uFF1A{{botName}}
         botToken: "Bot Token",
         botTokenPlaceholder: "123456:AA...",
         addBot: "Bot \u3092\u8FFD\u52A0",
+        editBot: "Bot \u3092\u7DE8\u96C6",
         enableBot: "Bot \u3092\u6709\u52B9\u306B\u3059\u308B",
         allowAuthRequests: "\u8A8D\u8A3C\u30EA\u30AF\u30A8\u30B9\u30C8\u3092\u8A31\u53EF",
         pendingChats: "\u627F\u8A8D\u5F85\u3061",
@@ -24573,7 +24785,11 @@ Bot\uFF1A{{botName}}
         fileTooLarge: "\u30D5\u30A1\u30A4\u30EB\u304C\u5927\u304D\u3059\u304E\u307E\u3059",
         fileBinary: "\u30D0\u30A4\u30CA\u30EA\u30D5\u30A1\u30A4\u30EB\u306F\u30B5\u30DD\u30FC\u30C8\u3055\u308C\u3066\u3044\u307E\u305B\u3093",
         fileRootDeviceInvalid: "\u7121\u52B9\u307E\u305F\u306F\u4E0D\u660E\u306A\u30C7\u30D0\u30A4\u30B9",
-        fileRootDuplicate: "\u3053\u306E\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u306F\u3053\u306E\u30C7\u30D0\u30A4\u30B9\u306B\u65E2\u306B\u8FFD\u52A0\u3055\u308C\u3066\u3044\u307E\u3059"
+        fileRootDuplicate: "\u3053\u306E\u30C7\u30A3\u30EC\u30AF\u30C8\u30EA\u306F\u3053\u306E\u30C7\u30D0\u30A4\u30B9\u306B\u65E2\u306B\u8FFD\u52A0\u3055\u308C\u3066\u3044\u307E\u3059",
+        upgradeNotAllowed: "\u3053\u306E\u30A4\u30F3\u30B9\u30C8\u30FC\u30EB\u3067\u306F\u30A2\u30D7\u30EA\u5185\u66F4\u65B0\u3092\u5229\u7528\u3067\u304D\u307E\u305B\u3093\u3002",
+        upgradeInProgress: "\u3059\u3067\u306B\u66F4\u65B0\u304C\u9032\u884C\u4E2D\u3067\u3059\u3002",
+        upgradeVersionRequired: "\u5BFE\u8C61\u30D0\u30FC\u30B8\u30E7\u30F3\u304C\u5FC5\u8981\u3067\u3059\u3002",
+        updateCheckFailed: "npm registry \u306E\u7167\u4F1A\u306B\u5931\u6557\u3057\u307E\u3057\u305F\u3002"
       },
       notification: {
         clickToJump: "\u5BFE\u5FDC\u3059\u308B\u30DA\u30A4\u30F3\u306B\u30B8\u30E3\u30F3\u30D7",
@@ -24862,7 +25078,10 @@ Bot\uFF1A{{botName}}
       },
       validation: {
         deviceNameRequired: "\u30C7\u30D0\u30A4\u30B9\u540D\u306F\u5FC5\u9808\u3067\u3059",
-        hostRequired: "SSH \u30C7\u30D0\u30A4\u30B9\u306B\u306F\u30DB\u30B9\u30C8\u30A2\u30C9\u30EC\u30B9\u304C\u5FC5\u8981\u3067\u3059"
+        hostRequired: "SSH \u30C7\u30D0\u30A4\u30B9\u306B\u306F\u30DB\u30B9\u30C8\u30A2\u30C9\u30EC\u30B9\u304C\u5FC5\u8981\u3067\u3059",
+        portRequired: "SSH \u30C7\u30D0\u30A4\u30B9\u306B\u306F\u6709\u52B9\u306A\u30DD\u30FC\u30C8\u304C\u5FC5\u8981\u3067\u3059",
+        usernameRequired: "SSH \u30C7\u30D0\u30A4\u30B9\u306B\u306F\u30E6\u30FC\u30B6\u30FC\u540D\u304C\u5FC5\u8981\u3067\u3059",
+        sshConfigRequired: "SSH \u30C7\u30D0\u30A4\u30B9\u306B\u306F ssh config \u306E\u30D1\u30B9\u304C\u5FC5\u8981\u3067\u3059"
       },
       files: {
         title: "\u30D5\u30A1\u30A4\u30EB",
@@ -24891,12 +25110,45 @@ Bot\uFF1A{{botName}}
           unknown: "\u8AAD\u307F\u8FBC\u307F\u306B\u5931\u6557\u3057\u307E\u3057\u305F"
         },
         retry: "\u518D\u8A66\u884C\uFF08\u6298\u308A\u305F\u305F\u3093\u3067\u518D\u5C55\u958B\uFF09",
+        menu: {
+          copyAbsolute: "\u7D76\u5BFE\u30D1\u30B9\u3092\u30B3\u30D4\u30FC",
+          copyRelative: "\u76F8\u5BFE\u30D1\u30B9\u3092\u30B3\u30D4\u30FC",
+          sendToAgent: "Agent \u306B\u9001\u308B",
+          expand: "\u5C55\u958B",
+          collapse: "\u6298\u308A\u305F\u305F\u3080",
+          upload: "\u3053\u306E\u30D5\u30A9\u30EB\u30C0\u306B\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9",
+          open: "\u958B\u304F"
+        },
+        copied: "\u30AF\u30EA\u30C3\u30D7\u30DC\u30FC\u30C9\u306B\u30B3\u30D4\u30FC\u3057\u307E\u3057\u305F",
+        copyFailed: "\u30B3\u30D4\u30FC\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+        sendToAgent: {
+          prompt: "\u3053\u306E\u30D1\u30B9\u3092\u51E6\u7406\u3057\u3066\u304F\u3060\u3055\u3044\uFF1A`{{path}}`"
+        },
+        upload: {
+          uploading: "{{name}} \u3092\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u4E2D\u2026",
+          success: "{{name}} \u3092\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u3057\u307E\u3057\u305F",
+          fail: "{{name}} \u306E\u30A2\u30C3\u30D7\u30ED\u30FC\u30C9\u306B\u5931\u6557\u3057\u307E\u3057\u305F"
+        },
+        transfer: {
+          legUserToTmex: "\u30D6\u30E9\u30A6\u30B6 \u2192 tmex",
+          legTmexToServer: "tmex \u2192 \u30B5\u30FC\u30D0\u30FC",
+          legServerToTmex: "\u30B5\u30FC\u30D0\u30FC \u2192 tmex",
+          legTmexToUser: "tmex \u2192 \u30D6\u30E9\u30A6\u30B6",
+          cancel: "\u30AD\u30E3\u30F3\u30BB\u30EB",
+          canceled: "{{name}} \u3092\u30AD\u30E3\u30F3\u30BB\u30EB\u3057\u307E\u3057\u305F",
+          downloaded: "{{name}} \u3092\u30C0\u30A6\u30F3\u30ED\u30FC\u30C9\u3057\u307E\u3057\u305F",
+          downloadFailed: "{{name}} \u306E\u30C0\u30A6\u30F3\u30ED\u30FC\u30C9\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+          dragDownloadStarted: "{{name}} \u306E\u30C0\u30A6\u30F3\u30ED\u30FC\u30C9\u3092\u958B\u59CB\uFF08\u30D6\u30E9\u30A6\u30B6\u304C\u51E6\u7406\uFF09",
+          tooLarge: "{{name}} \u306F\u30B5\u30A4\u30BA\u4E0A\u9650\uFF08{{max}}\uFF09\u3092\u8D85\u3048\u3066\u3044\u307E\u3059"
+        },
+        agentLaunch: {
+          connectFailed: "\u30C7\u30D0\u30A4\u30B9\u3078\u306E\u63A5\u7D9A\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
+          windowFailed: "\u30A6\u30A3\u30F3\u30C9\u30A6\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F"
+        },
         install: {
           button: "rsync \u3092\u30A4\u30F3\u30B9\u30C8\u30FC\u30EB",
           scopeLocal: "\u30B5\u30FC\u30D0\u30FC",
           scopeRemote: "\u30EA\u30E2\u30FC\u30C8",
-          connectFailed: "\u30C7\u30D0\u30A4\u30B9\u3078\u306E\u63A5\u7D9A\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
-          windowFailed: "\u30A6\u30A3\u30F3\u30C9\u30A6\u306E\u4F5C\u6210\u306B\u5931\u6557\u3057\u307E\u3057\u305F",
           prompt: "{{device}}\uFF08{{scope}}\uFF09\u306B rsync \u304C\u898B\u3064\u304B\u308A\u307E\u305B\u3093\u3002\u30B7\u30B9\u30C6\u30E0\u306B\u5408\u308F\u305B\u305F\u65B9\u6CD5\u3067 rsync \u3092\u30A4\u30F3\u30B9\u30C8\u30FC\u30EB\u3057\uFF08\u4F8B: `brew install rsync`\u3001`sudo apt-get install -y rsync`\u3001`sudo yum install -y rsync`\uFF09\u3001\u5B8C\u4E86\u3057\u305F\u3089\u8FD4\u4FE1\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
         }
       },
@@ -24920,6 +25172,11 @@ function toBCP47(locale) {
   return locale.replace("_", "-");
 }
 var AVAILABLE_LOCALES = ["en_US", "zh_CN", "ja_JP"];
+// ../shared/src/version.ts
+function formatDisplayVersion(baseVersion, isProd) {
+  const base = baseVersion?.trim() || "unknown";
+  return isProd ? base : `${base}_dev`;
+}
 // ../shared/src/ws-borsh/index.ts
 var exports_ws_borsh = {};
 __export(exports_ws_borsh, {
@@ -27431,11 +27688,13 @@ var config = {
   baseUrl: getEnv("TMEX_BASE_URL", "http://127.0.0.1:8085"),
   siteNameDefault: getEnv("TMEX_SITE_NAME", "tmex"),
   databaseUrl: getEnv("DATABASE_URL", "./tmex.db"),
+  transferMaxBytes: Number.parseInt(getEnv("TMEX_TRANSFER_MAX_BYTES", "2147483648"), 10),
   bellThrottleSecondsDefault: Number.parseInt(getEnv("TMEX_BELL_THROTTLE_SECONDS", "6"), 10),
   notificationThrottleSecondsDefault: Number.parseInt(getEnv("TMEX_NOTIFICATION_THROTTLE_SECONDS", "3"), 10),
   tmuxAllowPassthrough: getBooleanEnv("TMEX_TMUX_ALLOW_PASSTHROUGH", false),
   tmuxTermProgram: getEnv("TMEX_TMUX_TERM_PROGRAM", "ghostty"),
   tmuxWindowStyle: getEnv("TMEX_TMUX_WINDOW_STYLE", "fg=#d0d0d0,bg=#262626"),
+  tmuxSocket: getEnv("TMEX_TMUX_SOCKET", ""),
   sshReconnectMaxRetriesDefault: Number.parseInt(getEnv("TMEX_SSH_RECONNECT_MAX_RETRIES", "2"), 10),
   sshReconnectDelaySecondsDefault: Number.parseInt(getEnv("TMEX_SSH_RECONNECT_DELAY_SECONDS", "10"), 10),
   languageDefault: getEnv("TMEX_DEFAULT_LANGUAGE", "en_US"),
@@ -86600,9 +86859,6 @@ function normalizeHttpUrl(input) {
     return null;
   }
 }
-function encodePercentForTelegramUrl(url2) {
-  return url2.replace(/%/g, "%25");
-}
 
 class EventNotifier {
   webhooks = [];
@@ -86746,8 +87002,7 @@ class EventNotifier {
     lines.push(...this.buildPaneMetaLines(event));
     const paneUrl = normalizeHttpUrl(buildPaneUrl(event));
     if (paneUrl) {
-      const tgSafePaneUrl = encodePercentForTelegramUrl(paneUrl);
-      lines.push("", `<a href="${escapeTelegramHtmlAttribute(tgSafePaneUrl)}">${escapeTelegramHtmlText(t2("notification.telegramBell.viewLink"))}</a>`);
+      lines.push("", `<a href="${escapeTelegramHtmlAttribute(paneUrl)}">${escapeTelegramHtmlText(t2("notification.telegramBell.viewLink"))}</a>`);
     }
     return lines.join(`
 `);
@@ -86767,8 +87022,7 @@ class EventNotifier {
     const topbarLabel = this.buildTerminalTopbarLabel(event);
     const footer = `from ${event.site.name}: ${topbarLabel}`;
     if (paneUrl) {
-      const tgSafePaneUrl = encodePercentForTelegramUrl(paneUrl);
-      lines.push("", `<a href="${escapeTelegramHtmlAttribute(tgSafePaneUrl)}">${escapeTelegramHtmlText(footer)}</a>`);
+      lines.push("", `<a href="${escapeTelegramHtmlAttribute(paneUrl)}">${escapeTelegramHtmlText(footer)}</a>`);
     } else {
       lines.push("", escapeTelegramHtmlText(footer));
     }
@@ -86808,8 +87062,7 @@ class EventNotifier {
     }
     const paneUrl = normalizeHttpUrl(buildPaneUrl(event));
     if (paneUrl) {
-      const tgSafePaneUrl = encodePercentForTelegramUrl(paneUrl);
-      lines.push("", `<a href="${escapeTelegramHtmlAttribute(tgSafePaneUrl)}">${esc2(t2("notification.directLink"))}</a>`);
+      lines.push("", `<a href="${escapeTelegramHtmlAttribute(paneUrl)}">${esc2(t2("notification.directLink"))}</a>`);
     }
     return lines.join(`
 `);
@@ -95730,10 +95983,12 @@ class ConnectionAlertNotifier {
     const classified = classifySshError(errObj);
     const friendlyMessage = t2(classified.messageKey, { ...classified.messageParams });
     const rawMessage = errObj.message;
+    const persistedMessage = rawMessage && !friendlyMessage.includes(rawMessage) ? `${friendlyMessage}
+${rawMessage}` : friendlyMessage;
     console.error(`[conn-alert] device ${device.id} (${device.name}) source=${source} type=${classified.type}: ${rawMessage}`);
     if (persist) {
       try {
-        this.persister(device.id, friendlyMessage, classified.type);
+        this.persister(device.id, persistedMessage, classified.type);
       } catch (dbErr) {
         console.error("[conn-alert] failed to persist runtime status:", dbErr);
       }
@@ -97013,6 +97268,19 @@ function shouldIgnoreReaderAbortError(error51) {
   const maybeError = error51;
   return maybeError.name === "AbortError" && maybeError.code === "ERR_STREAM_RELEASE_LOCK" && typeof maybeError.message === "string" && maybeError.message.includes("releaseLock");
 }
+var TRANSIENT_SPAWN_ERROR_CODES = new Set(["EAGAIN", "EMFILE", "ENFILE", "ENOMEM"]);
+var TMUX_SPAWN_UNAVAILABLE_EXIT = -2;
+function isTransientSpawnError(error51) {
+  if (!error51 || typeof error51 !== "object") {
+    return false;
+  }
+  const code2 = error51.code;
+  if (typeof code2 === "string" && TRANSIENT_SPAWN_ERROR_CODES.has(code2)) {
+    return true;
+  }
+  const message = error51.message;
+  return typeof message === "string" && (message.includes("EAGAIN") || message.includes("posix_spawn") || message.includes("resource temporarily unavailable") || message.includes("Too many open files"));
+}
 function defaultRun(argv) {
   return new Promise((resolve3, reject) => {
     const subprocess = Bun.spawn(argv, {
@@ -97072,6 +97340,7 @@ class LocalExternalTmuxConnection {
   controlStartedAt = 0;
   controlRestartCount = 0;
   controlStderrTail = "";
+  spawnUnavailableNotified = false;
   constructor(options, inputDeps = {}) {
     this.deviceId = options.deviceId;
     this.callbacks = options;
@@ -97123,7 +97392,13 @@ class LocalExternalTmuxConnection {
     this.stopControlClient();
   }
   requestSnapshot() {
-    this.requestSnapshotInternal();
+    this.requestSnapshotInternal().catch((error51) => {
+      if (isTransientSpawnError(error51)) {
+        this.handleSpawnUnavailable(error51 instanceof Error ? error51.message : String(error51));
+        return;
+      }
+      this.callbacks.onError(error51 instanceof Error ? error51 : new Error(String(error51)));
+    });
   }
   sendInput(paneId, data) {
     if (!this.connected) {
@@ -97423,6 +97698,7 @@ class LocalExternalTmuxConnection {
     });
     const proc = this.deps.spawnControlClient([
       "tmux",
+      ...config.tmuxSocket ? ["-L", config.tmuxSocket] : [],
       "-C",
       "attach-session",
       "-t",
@@ -97511,6 +97787,16 @@ class LocalExternalTmuxConnection {
       return;
     }
     const probe = await this.runTmuxAllowFailure(["has-session", "-t", this.sessionName]);
+    if (probe.exitCode === TMUX_SPAWN_UNAVAILABLE_EXIT) {
+      this.handleSpawnUnavailable(probe.stderr);
+      this.controlRestartCount = Math.max(0, this.controlRestartCount - 1);
+      if (this.connected && !this.manualDisconnect) {
+        setTimeout(() => {
+          this.reconnectControlClient(exitCode);
+        }, CONTROL_RESTART_DELAY_MS * 4);
+      }
+      return;
+    }
     if (probe.exitCode !== 0) {
       const message = probe.stderr.trim() || probe.stdout.trim() || "tmux session gone";
       console.warn(`[local] tmux session gone on ${this.deviceId}: ${message}`);
@@ -97622,6 +97908,11 @@ class LocalExternalTmuxConnection {
         ].join(SNAPSHOT_FIELD_SEPARATOR)
       ])
     ]);
+    const transientResult = [sessionRes, windowsRes, panesRes].find((res) => res.exitCode === TMUX_SPAWN_UNAVAILABLE_EXIT);
+    if (transientResult) {
+      this.handleSpawnUnavailable(transientResult.stderr);
+      return;
+    }
     if (sessionRes.exitCode !== 0 || windowsRes.exitCode !== 0 || panesRes.exitCode !== 0) {
       const stderrBlob = `${sessionRes.stderr}
 ${windowsRes.stderr}
@@ -97645,6 +97936,7 @@ ${panesRes.stderr}`;
     this.parseSnapshotPanes(panesRes.stdout.split(/\r?\n/));
     this.discardInvalidSnapshot();
     this.controlSubscription?.prunePanes(new Set(this.getExpectedPaneIds()));
+    this.markSpawnRecovered();
     this.emitSnapshot();
   }
   parseSnapshotSession(lines) {
@@ -97830,8 +98122,29 @@ ${panesRes.stderr}`;
       silentTelegram: true
     });
   }
+  handleSpawnUnavailable(message) {
+    if (this.spawnUnavailableNotified) {
+      return;
+    }
+    this.spawnUnavailableNotified = true;
+    const detail = (message || "tmux spawn unavailable (process table exhausted)").trim();
+    console.warn(`[local] tmux spawn unavailable on ${this.deviceId} (process pressure), degrading without shutdown: ${detail}`);
+    this.notifyRuntimeError(detail);
+  }
+  markSpawnRecovered() {
+    this.spawnUnavailableNotified = false;
+  }
   async runTmuxAllowFailure(argv) {
-    return this.deps.run(["tmux", ...argv]);
+    const socketArgs = config.tmuxSocket ? ["-L", config.tmuxSocket] : [];
+    try {
+      return await this.deps.run(["tmux", ...socketArgs, ...argv]);
+    } catch (error51) {
+      if (isTransientSpawnError(error51)) {
+        const message = error51 instanceof Error ? error51.message : String(error51);
+        return { exitCode: TMUX_SPAWN_UNAVAILABLE_EXIT, stdout: "", stderr: message };
+      }
+      throw error51;
+    }
   }
   isTmuxServerGoneMessage(message) {
     const normalized = message.toLowerCase();
@@ -98040,7 +98353,7 @@ function resolveSshConfigRef(device, deps) {
   return parseSshConfigOutput(result.stdout, deps.env);
 }
 function resolveImplicitIdentityFilesForAgentAuth(device, host, port, username, deps) {
-  if (device.authMode !== "agent" || device.sshConfigRef?.trim()) {
+  if (device.authMode !== "agent") {
     return [];
   }
   const target = username ? `${username}@${host}` : host;
@@ -98062,7 +98375,7 @@ async function resolveSshConnectConfig(device, decrypt2, inputDeps = {}) {
     readTextFile: inputDeps.readTextFile ?? ((path) => readFileSync2(path, "utf8"))
   };
   const sshEnv = toSshAuthEnv(deps.env);
-  const resolvedConfig = resolveSshConfigRef(device, deps);
+  const resolvedConfig = device.authMode === "configRef" ? resolveSshConfigRef(device, deps) : null;
   const host = resolvedConfig?.host ?? device.host;
   const port = resolvedConfig?.port ?? device.port ?? 22;
   const username = resolvedConfig?.username ?? resolveSshUsername(device.username, device.authMode, sshEnv);
@@ -102660,7 +102973,7 @@ function deleteFileRoot(id) {
 }
 
 // ../../apps/gateway/src/files/device-storage.ts
-import { mkdtempSync as mkdtempSync2, readFileSync as readFileSync3, realpathSync, rmSync as rmSync2 } from "fs";
+import { mkdtempSync as mkdtempSync2, readFileSync as readFileSync3, realpathSync, rmSync as rmSync2, statSync } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 import { join as join5 } from "path";
 
@@ -102895,6 +103208,18 @@ function enqueueDeviceJob(deviceId, job) {
 }
 
 // ../../apps/gateway/src/files/rsync.ts
+var PROGRESS_RE = /^\s*([\d,]+)\s+(\d+)%\s+([\d.]+[KMGT]?B\/s)/;
+function parseRsyncProgress(line) {
+  const m = PROGRESS_RE.exec(line);
+  if (!m)
+    return null;
+  const transferred = Number.parseInt(m[1].replace(/,/g, ""), 10);
+  const pct = Number.parseInt(m[2], 10);
+  if (Number.isNaN(transferred) || Number.isNaN(pct))
+    return null;
+  return { transferred, pct, rate: m[3] };
+}
+
 class RsyncMissingLocalError extends Error {
   constructor(message) {
     super(message);
@@ -102916,8 +103241,36 @@ function baseSubprocessEnv() {
   out.LC_ALL = "C";
   return out;
 }
+async function readStdoutWithProgress(stream, onProgress, resetIdle) {
+  const reader = stream.getReader();
+  const decoder4 = new TextDecoder;
+  let full = "";
+  let buf = "";
+  for (;; ) {
+    const { done, value } = await reader.read();
+    if (done)
+      break;
+    resetIdle();
+    const text3 = decoder4.decode(value, { stream: true });
+    full += text3;
+    buf += text3;
+    const parts = buf.split(/[\r\n]/);
+    buf = parts.pop() ?? "";
+    for (const line of parts) {
+      const p = parseRsyncProgress(line);
+      if (p)
+        onProgress(p);
+    }
+  }
+  const tail = parseRsyncProgress(buf);
+  if (tail)
+    onProgress(tail);
+  return full;
+}
 async function runRsync(argv, opts = {}) {
+  const streaming = typeof opts.onProgress === "function";
   const timeoutMs = opts.timeoutMs ?? 20000;
+  const idleTimeoutMs = opts.idleTimeoutMs ?? 120000;
   let proc;
   try {
     proc = Bun.spawn(["rsync", ...argv], {
@@ -102930,21 +103283,36 @@ async function runRsync(argv, opts = {}) {
     throw new RsyncMissingLocalError(error51 instanceof Error ? error51.message : String(error51));
   }
   let timedOut = false;
-  const killTimer = setTimeout(() => {
-    timedOut = true;
-    try {
-      proc.kill();
-    } catch {}
-  }, timeoutMs);
-  const onAbort = () => {
+  const killProc = () => {
     try {
       proc.kill();
     } catch {}
   };
+  let killTimer;
+  const armFixed = () => {
+    killTimer = setTimeout(() => {
+      timedOut = true;
+      killProc();
+    }, timeoutMs);
+  };
+  const resetIdle = () => {
+    if (killTimer)
+      clearTimeout(killTimer);
+    killTimer = setTimeout(() => {
+      timedOut = true;
+      killProc();
+    }, idleTimeoutMs);
+  };
+  if (streaming)
+    resetIdle();
+  else
+    armFixed();
+  const onAbort = () => killProc();
   opts.signal?.addEventListener("abort", onAbort, { once: true });
   try {
+    const stdoutPromise = streaming ? readStdoutWithProgress(proc.stdout, opts.onProgress, resetIdle) : new Response(proc.stdout).text();
     const [stdout, stderr, exitCode] = await Promise.all([
-      new Response(proc.stdout).text(),
+      stdoutPromise,
       new Response(proc.stderr).text(),
       proc.exited
     ]);
@@ -102954,7 +103322,8 @@ async function runRsync(argv, opts = {}) {
     }
     return { stdout, stderr, exitCode };
   } finally {
-    clearTimeout(killTimer);
+    if (killTimer)
+      clearTimeout(killTimer);
     opts.signal?.removeEventListener("abort", onAbort);
   }
 }
@@ -103136,17 +103505,25 @@ function rsyncListArgs(spec, remotePath) {
   return args;
 }
 function rsyncCopyArgs(spec, remotePath, dest) {
-  const args = ["-L"];
+  const args = ["-L", "--progress"];
   if (spec.rsh)
     args.push("-e", spec.rsh);
   args.push(rsyncTargetArg(spec, remotePath), dest);
   return args;
 }
+function rsyncUploadArgs(spec, localSource, remoteDest) {
+  const args = ["--progress"];
+  if (spec.rsh)
+    args.push("-e", spec.rsh);
+  args.push(localSource, rsyncTargetArg(spec, remoteDest));
+  return args;
+}
 
 // ../../apps/gateway/src/files/device-storage.ts
 var RAW_MAX_BYTES = 50 * 1024 * 1024;
 var LIST_TIMEOUT_MS = 20000;
 var COPY_TIMEOUT_MS = 60000;
+var TRANSFER_IDLE_TIMEOUT_MS = 120000;
 function ok(data) {
   return { ok: true, data };
 }
@@ -103456,8 +103833,241 @@ async function readRawFile(rootId, inputPath) {
     }
   });
 }
+function sanitizeUploadName(raw) {
+  const base = raw.split("/").pop() ?? "";
+  if (base === "" || base === "." || base === "..")
+    return null;
+  if (base.includes("/") || base.includes("\\") || base.includes("\x00"))
+    return null;
+  return base;
+}
+async function pushFileToDevice(rootId, destDir, srcPath, name24, opts = {}) {
+  const safeName = sanitizeUploadName(name24);
+  if (!safeName)
+    return fail("invalid");
+  const r = resolveContext(rootId);
+  if (!r.ok)
+    return fail(r.code);
+  const { root, device } = r.ctx;
+  const norm = checkAndNormalize(device, root.path, destDir);
+  if (!norm.ok)
+    return fail(norm.code);
+  return enqueueDeviceJob(device.id, async () => {
+    let spec;
+    try {
+      spec = await buildRsyncDeviceSpec(device);
+    } catch (error51) {
+      if (error51 instanceof RsyncAuthError)
+        return fail(error51.code, error51.message);
+      throw error51;
+    }
+    try {
+      const destStat = await statViaRsync(spec, norm.path);
+      if (!destStat.ok)
+        return destStat;
+      if (destStat.data.type !== "dir")
+        return fail("not_a_directory");
+      const remoteDest = posixJoin(norm.path, safeName);
+      let res;
+      try {
+        res = await runRsync(rsyncUploadArgs(spec, srcPath, remoteDest), {
+          env: spec.env,
+          onProgress: opts.onProgress,
+          idleTimeoutMs: TRANSFER_IDLE_TIMEOUT_MS,
+          signal: opts.signal
+        });
+      } catch (error51) {
+        if (error51 instanceof RsyncMissingLocalError)
+          return fail("rsync_missing_local");
+        throw error51;
+      }
+      if (res.exitCode !== 0)
+        return fail(classifyRsyncFailure(res.exitCode, res.stderr), res.stderr);
+      return ok({ uploaded: safeName });
+    } finally {
+      spec.cleanup();
+    }
+  });
+}
+async function pullFileFromDevice(rootId, inputPath, opts = {}) {
+  const r = resolveContext(rootId);
+  if (!r.ok)
+    return fail(r.code);
+  const { root, device } = r.ctx;
+  const norm = checkAndNormalize(device, root.path, inputPath);
+  if (!norm.ok)
+    return fail(norm.code);
+  return enqueueDeviceJob(device.id, async () => {
+    let spec;
+    try {
+      spec = await buildRsyncDeviceSpec(device);
+    } catch (error51) {
+      if (error51 instanceof RsyncAuthError)
+        return fail(error51.code, error51.message);
+      throw error51;
+    }
+    try {
+      const st = await statViaRsync(spec, norm.path);
+      if (!st.ok)
+        return st;
+      if (st.data.type === "dir")
+        return fail("is_directory");
+      if (st.data.size != null && st.data.size > config.transferMaxBytes)
+        return fail("too_large");
+      const dir2 = mkdtempSync2(join5(tmpdir2(), "tmex-dl-"));
+      const dest = join5(dir2, "f");
+      const cleanup = () => {
+        try {
+          rmSync2(dir2, { recursive: true, force: true });
+        } catch {}
+      };
+      let res;
+      try {
+        res = await runRsync(rsyncCopyArgs(spec, norm.path, dest), {
+          env: spec.env,
+          onProgress: opts.onProgress,
+          idleTimeoutMs: TRANSFER_IDLE_TIMEOUT_MS,
+          signal: opts.signal
+        });
+      } catch (error51) {
+        cleanup();
+        if (error51 instanceof RsyncMissingLocalError)
+          return fail("rsync_missing_local");
+        throw error51;
+      }
+      if (res.exitCode !== 0) {
+        cleanup();
+        return fail(classifyRsyncFailure(res.exitCode, res.stderr), res.stderr);
+      }
+      const name24 = posixBasename(norm.path);
+      let size = st.data.size ?? 0;
+      try {
+        size = statSync(dest).size;
+      } catch {}
+      if (size > config.transferMaxBytes) {
+        cleanup();
+        return fail("too_large");
+      }
+      return ok({ tmpPath: dest, size, name: name24, mime: mimeOf(name24), cleanup });
+    } finally {
+      spec.cleanup();
+    }
+  });
+}
+
+// ../../apps/gateway/src/files/transfer-session.ts
+import { appendFileSync, mkdtempSync as mkdtempSync3, readdirSync, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync2 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { join as join6 } from "path";
+var sessions = new Map;
+var SESSION_TTL_MS = 30 * 60000;
+var downloads = new Map;
+function sweepStale(now2) {
+  for (const [id, s] of sessions) {
+    if (!s.committing && now2 - s.createdAt > SESSION_TTL_MS) {
+      removeUploadSession(id);
+    }
+  }
+  for (const [id, d] of downloads) {
+    if (now2 - d.createdAt > SESSION_TTL_MS) {
+      removeDownloadSession(id);
+    }
+  }
+}
+function createDownloadSession(data) {
+  sweepStale(Date.now());
+  const session = { id: crypto.randomUUID(), createdAt: Date.now(), ...data };
+  downloads.set(session.id, session);
+  return session;
+}
+function getDownloadSession(id) {
+  return downloads.get(id);
+}
+function removeDownloadSession(id) {
+  const d = downloads.get(id);
+  if (!d)
+    return;
+  downloads.delete(id);
+  try {
+    d.cleanup();
+  } catch {}
+}
+function createUploadSession(args) {
+  const now2 = Date.now();
+  sweepStale(now2);
+  const tmpDir = mkdtempSync3(join6(tmpdir3(), "tmex-up-"));
+  const tmpPath = join6(tmpDir, "f");
+  writeFileSync2(tmpPath, new Uint8Array(0));
+  const session = {
+    id: crypto.randomUUID(),
+    rootId: args.rootId,
+    destDir: args.destDir,
+    name: args.name,
+    size: args.size,
+    received: 0,
+    tmpDir,
+    tmpPath,
+    abort: new AbortController,
+    createdAt: now2,
+    committing: false
+  };
+  sessions.set(session.id, session);
+  return session;
+}
+function getUploadSession(id) {
+  return sessions.get(id);
+}
+function appendUploadChunk(id, offset, bytes) {
+  const s = sessions.get(id);
+  if (!s)
+    return { ok: false, reason: "not_found" };
+  if (offset !== s.received)
+    return { ok: false, reason: "bad_offset" };
+  if (s.received + bytes.byteLength > s.size)
+    return { ok: false, reason: "too_large" };
+  appendFileSync(s.tmpPath, bytes);
+  s.received += bytes.byteLength;
+  return { ok: true, received: s.received };
+}
+function removeUploadSession(id) {
+  const s = sessions.get(id);
+  if (!s)
+    return;
+  sessions.delete(id);
+  try {
+    s.abort.abort();
+  } catch {}
+  try {
+    rmSync3(s.tmpDir, { recursive: true, force: true });
+  } catch {}
+}
+var transferGcTimer = setInterval(() => sweepStale(Date.now()), 5 * 60000);
+transferGcTimer.unref?.();
+var ORPHAN_PREFIXES = ["tmex-up-", "tmex-dl-"];
+var ORPHAN_MAX_AGE_MS = 60 * 60000;
+function sweepOrphanTransferTemps() {
+  const base = tmpdir3();
+  let entries;
+  try {
+    entries = readdirSync(base);
+  } catch {
+    return;
+  }
+  const now2 = Date.now();
+  for (const name24 of entries) {
+    if (!ORPHAN_PREFIXES.some((p) => name24.startsWith(p)))
+      continue;
+    const full = join6(base, name24);
+    try {
+      if (now2 - statSync2(full).mtimeMs > ORPHAN_MAX_AGE_MS) {
+        rmSync3(full, { recursive: true, force: true });
+      }
+    } catch {}
+  }
+}
 
 // ../../apps/gateway/src/api/files.ts
+var UPLOAD_CHUNK_SIZE = 8 * 1024 * 1024;
 function json4(data, status = 200, headers = {}) {
   return new Response(JSON.stringify(data), {
     status,
@@ -103621,6 +104231,223 @@ async function handleRaw(url2) {
   }
   return new Response(result.data.data, { status: 200, headers });
 }
+async function handleUploadInit(req) {
+  let body;
+  try {
+    body = await req.json();
+  } catch {
+    return json4({ error: t2("apiError.invalidRequest") }, 400);
+  }
+  const rootId = typeof body.rootId === "string" ? body.rootId : "";
+  const destDir = typeof body.path === "string" ? body.path : "";
+  const rawName = typeof body.name === "string" ? body.name : "";
+  const size = typeof body.size === "number" && Number.isFinite(body.size) ? body.size : -1;
+  if (!rootId || !destDir || !rawName || size < 0) {
+    return json4({ error: t2("apiError.invalidRequest") }, 400);
+  }
+  const name24 = sanitizeUploadName(rawName);
+  if (!name24)
+    return codeError("invalid");
+  if (size > config.transferMaxBytes)
+    return codeError("too_large");
+  const stat = await statFile(rootId, destDir);
+  if (!stat.ok)
+    return codeError(stat.code, stat.detail);
+  if (stat.data.type !== "dir")
+    return codeError("not_a_directory");
+  const session = createUploadSession({ rootId, destDir, name: name24, size });
+  return json4({ uploadId: session.id, chunkSize: UPLOAD_CHUNK_SIZE });
+}
+async function handleUploadChunk(req, id, url2) {
+  const offset = Number.parseInt(url2.searchParams.get("offset") ?? "", 10);
+  if (Number.isNaN(offset) || offset < 0)
+    return json4({ error: t2("apiError.invalidRequest") }, 400);
+  const bytes = new Uint8Array(await req.arrayBuffer());
+  const res = appendUploadChunk(id, offset, bytes);
+  if (!res.ok) {
+    if (res.reason === "not_found")
+      return codeError("not_found");
+    if (res.reason === "too_large")
+      return codeError("too_large");
+    return json4({ error: t2("apiError.invalidRequest") }, 409);
+  }
+  return json4({ received: res.received });
+}
+function handleUploadCommit(id) {
+  const session = getUploadSession(id);
+  if (!session)
+    return codeError("not_found");
+  if (session.received !== session.size)
+    return codeError("invalid", "incomplete upload");
+  session.committing = true;
+  const encoder3 = new TextEncoder;
+  const stream = new ReadableStream({
+    start(controller) {
+      const emit = (obj) => {
+        try {
+          controller.enqueue(encoder3.encode(`${JSON.stringify(obj)}
+`));
+        } catch {}
+      };
+      pushFileToDevice(session.rootId, session.destDir, session.tmpPath, session.name, {
+        signal: session.abort.signal,
+        onProgress: (p) => emit({ type: "progress", ...p })
+      }).then((res) => {
+        if (res.ok)
+          emit({ type: "done", uploaded: res.data.uploaded });
+        else
+          emit({ type: "error", code: res.code, detail: res.detail });
+      }).catch((e) => emit({ type: "error", code: "unknown", detail: String(e) })).finally(() => {
+        try {
+          controller.close();
+        } catch {}
+        removeUploadSession(id);
+      });
+    },
+    cancel() {
+      removeUploadSession(id);
+    }
+  });
+  return new Response(stream, {
+    status: 200,
+    headers: { "Content-Type": "application/x-ndjson; charset=utf-8", "Cache-Control": "no-store" }
+  });
+}
+function handleUploadCancel(id) {
+  removeUploadSession(id);
+  return json4({ success: true });
+}
+function attachmentHeaders(name24, mime, size) {
+  const encoded = encodeURIComponent(name24);
+  const ascii = name24.replace(/["\\\r\n]/g, "_");
+  return {
+    "Content-Type": mime ?? "application/octet-stream",
+    "Content-Length": String(size),
+    "Content-Disposition": `attachment; filename="${ascii}"; filename*=UTF-8''${encoded}`,
+    "Cache-Control": "no-store"
+  };
+}
+function streamTempFile(tmpPath, cleanupAfter) {
+  let reader;
+  try {
+    reader = Bun.file(tmpPath).stream().getReader();
+  } catch {
+    cleanupAfter();
+    return null;
+  }
+  return new ReadableStream({
+    async pull(controller) {
+      try {
+        const { done, value } = await reader.read();
+        if (done) {
+          controller.close();
+          cleanupAfter();
+          return;
+        }
+        controller.enqueue(value);
+      } catch (e) {
+        controller.error(e);
+        cleanupAfter();
+      }
+    },
+    cancel() {
+      reader.cancel();
+      cleanupAfter();
+    }
+  });
+}
+function handleDownloadPrepare(req) {
+  let abort = null;
+  const encoder3 = new TextEncoder;
+  const stream = new ReadableStream({
+    async start(controller) {
+      const emit = (obj) => {
+        try {
+          controller.enqueue(encoder3.encode(`${JSON.stringify(obj)}
+`));
+        } catch {}
+      };
+      const close = () => {
+        try {
+          controller.close();
+        } catch {}
+      };
+      let body;
+      try {
+        body = await req.json();
+      } catch {
+        emit({ type: "error", code: "invalid" });
+        close();
+        return;
+      }
+      const rootId = typeof body.rootId === "string" ? body.rootId : "";
+      const path = typeof body.path === "string" ? body.path : "";
+      if (!rootId || !path) {
+        emit({ type: "error", code: "invalid" });
+        close();
+        return;
+      }
+      abort = new AbortController;
+      const result = await pullFileFromDevice(rootId, path, {
+        signal: abort.signal,
+        onProgress: (p) => emit({ type: "progress", ...p })
+      });
+      if (result.ok) {
+        const s = createDownloadSession({
+          tmpPath: result.data.tmpPath,
+          size: result.data.size,
+          name: result.data.name,
+          mime: result.data.mime,
+          cleanup: result.data.cleanup
+        });
+        emit({ type: "done", downloadId: s.id, size: s.size, name: s.name });
+      } else {
+        emit({ type: "error", code: result.code, detail: result.detail });
+      }
+      close();
+    },
+    cancel() {
+      abort?.abort();
+    }
+  });
+  return new Response(stream, {
+    status: 200,
+    headers: { "Content-Type": "application/x-ndjson; charset=utf-8", "Cache-Control": "no-store" }
+  });
+}
+function handleDownloadContent(id) {
+  const session = getDownloadSession(id);
+  if (!session)
+    return codeError("not_found");
+  const body = streamTempFile(session.tmpPath, () => removeDownloadSession(id));
+  if (!body)
+    return codeError("unknown");
+  return new Response(body, {
+    status: 200,
+    headers: attachmentHeaders(session.name, session.mime, session.size)
+  });
+}
+function handleDownloadCancel(id) {
+  removeDownloadSession(id);
+  return json4({ success: true });
+}
+async function handleDownload(req, url2) {
+  const rootId = url2.searchParams.get("rootId");
+  const path = url2.searchParams.get("path");
+  if (!rootId || !path)
+    return json4({ error: t2("apiError.invalidRequest") }, 400);
+  const result = await pullFileFromDevice(rootId, path, {
+    signal: req.signal,
+    onProgress: () => {}
+  });
+  if (!result.ok)
+    return codeError(result.code, result.detail);
+  const { tmpPath, size, name: name24, mime, cleanup } = result.data;
+  const body = streamTempFile(tmpPath, cleanup);
+  if (!body)
+    return codeError("unknown");
+  return new Response(body, { status: 200, headers: attachmentHeaders(name24, mime, size) });
+}
 function handleFilesApiRequest(req, path) {
   const url2 = new URL(req.url);
   if (path === "/api/files/roots" && req.method === "GET")
@@ -103641,6 +104468,32 @@ function handleFilesApiRequest(req, path) {
     return handleStat(url2);
   if (path === "/api/files/raw" && req.method === "GET")
     return handleRaw(url2);
+  if (path === "/api/files/download" && req.method === "GET")
+    return handleDownload(req, url2);
+  if (path === "/api/files/download/prepare" && req.method === "POST") {
+    return handleDownloadPrepare(req);
+  }
+  const dlContentMatch = path.match(/^\/api\/files\/download\/([^/]+)\/content$/);
+  if (dlContentMatch && req.method === "GET") {
+    return handleDownloadContent(decodeURIComponent(dlContentMatch[1]));
+  }
+  const dlCancelMatch = path.match(/^\/api\/files\/download\/([^/]+)$/);
+  if (dlCancelMatch && req.method === "DELETE") {
+    return handleDownloadCancel(decodeURIComponent(dlCancelMatch[1]));
+  }
+  if (path === "/api/files/upload/init" && req.method === "POST")
+    return handleUploadInit(req);
+  const commitMatch = path.match(/^\/api\/files\/upload\/([^/]+)\/commit$/);
+  if (commitMatch && req.method === "POST") {
+    return handleUploadCommit(decodeURIComponent(commitMatch[1]));
+  }
+  const uploadMatch = path.match(/^\/api\/files\/upload\/([^/]+)$/);
+  if (uploadMatch && req.method === "PUT") {
+    return handleUploadChunk(req, decodeURIComponent(uploadMatch[1]), url2);
+  }
+  if (uploadMatch && req.method === "DELETE") {
+    return handleUploadCancel(decodeURIComponent(uploadMatch[1]));
+  }
   return;
 }
 
@@ -103919,6 +104772,345 @@ function json5(data, status = 200) {
   });
 }
 
+// ../../apps/gateway/src/system/install-info.ts
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { resolve as resolve3 } from "path";
+function resolveInstallDir() {
+  const feDist = process.env.TMEX_FE_DIST_DIR;
+  if (feDist) {
+    return resolve3(feDist, "..", "..");
+  }
+  return process.cwd();
+}
+function readInstallMeta() {
+  const metaPath = resolve3(resolveInstallDir(), "install-meta.json");
+  try {
+    if (!existsSync4(metaPath))
+      return null;
+    return JSON.parse(readFileSync4(metaPath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function deploymentFromPlatform(platform) {
+  if (platform === "darwin")
+    return "launchd";
+  if (platform === "linux")
+    return "systemd";
+  return "none";
+}
+function getInstallInfo() {
+  if (!config.isProd) {
+    return {
+      installedViaCli: false,
+      deployment: "none",
+      installDir: null,
+      serviceName: null,
+      cliVersion: null
+    };
+  }
+  const meta3 = readInstallMeta();
+  if (!meta3) {
+    return {
+      installedViaCli: false,
+      deployment: "none",
+      installDir: resolveInstallDir(),
+      serviceName: null,
+      cliVersion: null
+    };
+  }
+  return {
+    installedViaCli: true,
+    deployment: deploymentFromPlatform(meta3.platform ?? process.platform),
+    installDir: meta3.installDir ?? resolveInstallDir(),
+    serviceName: meta3.serviceName ?? null,
+    cliVersion: meta3.cliVersion ?? null
+  };
+}
+
+// ../../apps/gateway/src/system/version.ts
+import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
+import { resolve as resolve4 } from "path";
+var cachedBase;
+function readRepoPackageVersion() {
+  const dir2 = import.meta.dir;
+  if (!dir2)
+    return null;
+  const path = resolve4(dir2, "../../../../packages/app/package.json");
+  try {
+    if (!existsSync5(path))
+      return null;
+    const pkg = JSON.parse(readFileSync5(path, "utf8"));
+    return pkg.version ?? null;
+  } catch {
+    return null;
+  }
+}
+function getBaseVersion() {
+  if (cachedBase !== undefined)
+    return cachedBase;
+  let base = null;
+  if ("0.12.0") {
+    base = "0.12.0";
+  }
+  if (!base && config.isProd) {
+    base = readInstallMeta()?.cliVersion ?? null;
+  }
+  if (!base) {
+    base = readRepoPackageVersion();
+  }
+  cachedBase = base ?? "unknown";
+  return cachedBase;
+}
+function getDisplayVersion() {
+  return formatDisplayVersion(getBaseVersion(), config.isProd);
+}
+// ../../apps/gateway/src/system/semver.ts
+function parse5(input) {
+  const match = input.trim().match(/^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/);
+  if (!match)
+    return null;
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    prerelease: match[4] ?? null
+  };
+}
+function compareVersions(a, b3) {
+  const pa = parse5(a);
+  const pb = parse5(b3);
+  if (!pa || !pb)
+    return 0;
+  if (pa.major !== pb.major)
+    return pa.major > pb.major ? 1 : -1;
+  if (pa.minor !== pb.minor)
+    return pa.minor > pb.minor ? 1 : -1;
+  if (pa.patch !== pb.patch)
+    return pa.patch > pb.patch ? 1 : -1;
+  if (pa.prerelease === pb.prerelease)
+    return 0;
+  if (pa.prerelease === null)
+    return 1;
+  if (pb.prerelease === null)
+    return -1;
+  return pa.prerelease > pb.prerelease ? 1 : pa.prerelease < pb.prerelease ? -1 : 0;
+}
+
+// ../../apps/gateway/src/system/update-check.ts
+var REGISTRY_URL = "https://registry.npmjs.org/tmex-cli";
+var changelogCdnUrl = (version3) => `https://cdn.jsdelivr.net/npm/tmex-cli@${version3}/CHANGELOG.md`;
+var FETCH_TIMEOUT_MS = 1e4;
+async function checkForUpdate() {
+  const current = getBaseVersion();
+  const res = await fetch(REGISTRY_URL, {
+    cache: "no-store",
+    headers: { accept: "application/json", "cache-control": "no-cache" },
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+  });
+  if (!res.ok) {
+    throw new Error(`npm registry HTTP ${res.status}`);
+  }
+  const packument = await res.json();
+  const latest = packument["dist-tags"]?.latest ?? null;
+  const publishedAt = latest ? packument.time?.[latest] ?? null : null;
+  const hasUpdate = latest !== null && current !== "unknown" && compareVersions(latest, current) > 0;
+  const changelog = latest ? await fetchChangelog(latest) : null;
+  return {
+    currentVersion: current,
+    latestVersion: latest,
+    hasUpdate,
+    changelog,
+    publishedAt
+  };
+}
+async function fetchChangelog(version3) {
+  try {
+    const res = await fetch(changelogCdnUrl(version3), {
+      cache: "no-store",
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+    });
+    if (!res.ok)
+      return null;
+    const text3 = await res.text();
+    return text3.trim() ? text3 : null;
+  } catch {
+    return null;
+  }
+}
+// ../../apps/gateway/src/system/upgrade.ts
+import { spawn } from "child_process";
+import { closeSync, existsSync as existsSync6, openSync } from "fs";
+import { mkdtemp, rm, writeFile } from "fs/promises";
+import { tmpdir as tmpdir4 } from "os";
+import { join as join7 } from "path";
+class UpgradeController {
+  state = "idle";
+  targetVersion = null;
+  error = null;
+  startedAt = null;
+  status() {
+    return {
+      state: this.state,
+      targetVersion: this.targetVersion,
+      error: this.error,
+      startedAt: this.startedAt
+    };
+  }
+  isBusy() {
+    return this.state !== "idle";
+  }
+  start(version3) {
+    if (this.isBusy())
+      return false;
+    this.state = "downloading";
+    this.targetVersion = version3;
+    this.error = null;
+    this.startedAt = new Date().toISOString();
+    this.run(version3);
+    return true;
+  }
+  async run(version3) {
+    const install = getInstallInfo();
+    const installDir = install.installDir;
+    let stageDir = null;
+    let cacheDir = null;
+    try {
+      if (!installDir) {
+        throw new Error("install directory could not be resolved");
+      }
+      stageDir = await mkdtemp(join7(tmpdir4(), "tmex-upg-"));
+      cacheDir = await mkdtemp(join7(tmpdir4(), "tmex-upg-cache-"));
+      await writeFile(join7(stageDir, "package.json"), `${JSON.stringify({ name: "tmex-upgrade-stage", private: true })}
+`);
+      await this.runBunAdd(stageDir, cacheDir, version3);
+      const binPath = join7(stageDir, "node_modules", "tmex-cli", "bin", "tmex.js");
+      if (!existsSync6(binPath)) {
+        throw new Error(`downloaded tmex-cli binary not found at ${binPath}`);
+      }
+      this.state = "executing";
+      this.spawnUpgrade(binPath, installDir, version3);
+    } catch (err) {
+      this.error = err instanceof Error ? err.message : String(err);
+      this.state = "idle";
+      this.targetVersion = null;
+      if (stageDir)
+        await rm(stageDir, { recursive: true, force: true }).catch(() => {});
+      if (cacheDir)
+        await rm(cacheDir, { recursive: true, force: true }).catch(() => {});
+    }
+  }
+  runBunAdd(stageDir, cacheDir, version3) {
+    return new Promise((resolve5, reject) => {
+      const child = spawn(process.execPath, ["add", `tmex-cli@${version3}`], {
+        cwd: stageDir,
+        env: { ...process.env, BUN_INSTALL_CACHE_DIR: cacheDir },
+        stdio: "ignore"
+      });
+      child.on("error", reject);
+      child.on("close", (code2) => {
+        if (code2 === 0)
+          resolve5();
+        else
+          reject(new Error(`bun add tmex-cli@${version3} exited with code ${code2 ?? "null"}`));
+      });
+    });
+  }
+  spawnUpgrade(binPath, installDir, version3) {
+    let logFd = null;
+    try {
+      logFd = openSync(join7(installDir, "upgrade.log"), "a");
+    } catch {
+      logFd = null;
+    }
+    const child = spawn(process.execPath, [
+      binPath,
+      "upgrade",
+      "--apply-current-package",
+      "--install-dir",
+      installDir,
+      "--version",
+      version3
+    ], {
+      cwd: installDir,
+      env: process.env,
+      detached: true,
+      stdio: logFd !== null ? ["ignore", logFd, logFd] : "ignore"
+    });
+    child.unref();
+    if (logFd !== null)
+      closeSync(logFd);
+  }
+}
+var upgradeController = new UpgradeController;
+
+// ../../apps/gateway/src/system/index.ts
+function getSystemInfo() {
+  const install = getInstallInfo();
+  const canSelfUpdate = config.isProd && install.installedViaCli && install.deployment !== "none";
+  return {
+    version: getDisplayVersion(),
+    baseVersion: getBaseVersion(),
+    isProd: config.isProd,
+    installedViaCli: install.installedViaCli,
+    deployment: install.deployment,
+    canSelfUpdate,
+    serviceName: install.serviceName,
+    transferMaxBytes: config.transferMaxBytes
+  };
+}
+
+// ../../apps/gateway/src/api/system.ts
+function json6(data, status = 200) {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function handleSystemApiRequest(req, path) {
+  if (path === "/api/system/info" && req.method === "GET") {
+    return json6(getSystemInfo());
+  }
+  if (path === "/api/system/update-check" && req.method === "GET") {
+    return handleUpdateCheck();
+  }
+  if (path === "/api/system/upgrade" && req.method === "GET") {
+    return json6(upgradeController.status());
+  }
+  if (path === "/api/system/upgrade" && req.method === "POST") {
+    return handleStartUpgrade(req);
+  }
+  return;
+}
+async function handleUpdateCheck() {
+  try {
+    return json6(await checkForUpdate());
+  } catch {
+    return json6({ error: t2("apiError.updateCheckFailed") }, 502);
+  }
+}
+async function handleStartUpgrade(req) {
+  const info = getSystemInfo();
+  if (!info.canSelfUpdate) {
+    return json6({ error: t2("apiError.upgradeNotAllowed") }, 403);
+  }
+  let version3 = "";
+  try {
+    const body = await req.json();
+    version3 = (body?.version ?? "").trim();
+  } catch {
+    version3 = "";
+  }
+  if (!version3) {
+    return json6({ error: t2("apiError.upgradeVersionRequired") }, 400);
+  }
+  const started = upgradeController.start(version3);
+  if (!started) {
+    return json6({ ...upgradeController.status(), error: t2("apiError.upgradeInProgress") }, 409);
+  }
+  return json6(upgradeController.status());
+}
+
 // ../../apps/gateway/src/api/test-connection.ts
 function inferFailurePhase(errorType) {
   if (errorType === "tmux_unavailable") {
@@ -103926,7 +105118,7 @@ function inferFailurePhase(errorType) {
   }
   return "connect";
 }
-function json6(data, status = 200) {
+function json7(data, status = 200) {
   return new Response(JSON.stringify(data), {
     status,
     headers: {
@@ -103945,7 +105137,7 @@ async function handleDeviceTestConnection(deviceId, inputDeps = {}) {
   };
   const device = deps.getDevice(deviceId);
   if (!device) {
-    return json6({ error: deps.translate("apiError.deviceNotFound") }, 404);
+    return json7({ error: deps.translate("apiError.deviceNotFound") }, 404);
   }
   const classifyErrorResponse = (error51) => {
     const rawMessage = error51 instanceof Error ? error51.message : String(error51);
@@ -103958,7 +105150,7 @@ async function handleDeviceTestConnection(deviceId, inputDeps = {}) {
       message: deps.translate(classified.messageKey, classified.messageParams),
       rawMessage
     };
-    return json6(payload);
+    return json7(payload);
   };
   let runtime = null;
   try {
@@ -103971,7 +105163,7 @@ async function handleDeviceTestConnection(deviceId, inputDeps = {}) {
       phase: "ready",
       message: deps.translate("common.success")
     };
-    return json6(payload);
+    return json7(payload);
   } catch (error51) {
     return classifyErrorResponse(error51);
   } finally {
@@ -105078,35 +106270,35 @@ async function handleListRules(req) {
   if (paneId) {
     rules = rules.filter((rule) => rule.paneId === paneId);
   }
-  return json7({ rules: rules.map(toRuleDto) });
+  return json8({ rules: rules.map(toRuleDto) });
 }
 async function handleCreateRule(req, deps) {
   const raw = await readJsonObjectBody3(req);
   if (!raw) {
-    return json7({ error: t2("apiError.invalidRequest") }, 400);
+    return json8({ error: t2("apiError.invalidRequest") }, 400);
   }
   const body = raw;
   const name24 = typeof body.name === "string" ? body.name.trim() : "";
   if (!name24) {
-    return json7({ error: t2("apiError.watchNameRequired") }, 400);
+    return json8({ error: t2("apiError.watchNameRequired") }, 400);
   }
   const deviceId = typeof body.deviceId === "string" ? body.deviceId.trim() : "";
   if (!deviceId) {
-    return json7({ error: t2("apiError.agentDeviceRequired") }, 400);
+    return json8({ error: t2("apiError.agentDeviceRequired") }, 400);
   }
   if (!getDeviceById(deviceId)) {
-    return json7({ error: t2("apiError.deviceNotFound") }, 404);
+    return json8({ error: t2("apiError.deviceNotFound") }, 404);
   }
   const paneId = typeof body.paneId === "string" ? body.paneId.trim() : "";
   if (!paneId) {
-    return json7({ error: t2("apiError.agentPaneRequired") }, 400);
+    return json8({ error: t2("apiError.agentPaneRequired") }, 400);
   }
   if (!TRIGGER_TYPES.includes(body.triggerType)) {
-    return json7({ error: t2("apiError.watchTriggerTypeInvalid") }, 400);
+    return json8({ error: t2("apiError.watchTriggerTypeInvalid") }, 400);
   }
   const parsed = parseRuleFields(raw);
   if (!parsed.ok) {
-    return json7({ error: parsed.error }, 400);
+    return json8({ error: parsed.error }, 400);
   }
   const fields = parsed.fields;
   const effective = {
@@ -105119,7 +106311,7 @@ async function handleCreateRule(req, deps) {
   };
   const semanticError = validateRuleSemantics(effective);
   if (semanticError) {
-    return json7({ error: semanticError }, 400);
+    return json8({ error: semanticError }, 400);
   }
   const rule = createWatchRule({
     name: name24,
@@ -105142,50 +106334,50 @@ async function handleCreateRule(req, deps) {
     cooldownSeconds: fields.cooldownSeconds
   });
   await deps.service.refreshRule(rule.id);
-  return json7({ rule: toRuleDto(rule), state: null }, 201);
+  return json8({ rule: toRuleDto(rule), state: null }, 201);
 }
 async function handleGetRule(id) {
   const rule = getWatchRuleById(id);
   if (!rule) {
-    return json7({ error: t2("apiError.watchRuleNotFound") }, 404);
+    return json8({ error: t2("apiError.watchRuleNotFound") }, 404);
   }
   const state = getWatchRuleState(id);
-  return json7({ rule: toRuleDto(rule), state: state ? toStateDto(state) : null });
+  return json8({ rule: toRuleDto(rule), state: state ? toStateDto(state) : null });
 }
 async function handleUpdateRule(req, id, deps) {
   const existing = getWatchRuleById(id);
   if (!existing) {
-    return json7({ error: t2("apiError.watchRuleNotFound") }, 404);
+    return json8({ error: t2("apiError.watchRuleNotFound") }, 404);
   }
   const raw = await readJsonObjectBody3(req);
   if (!raw) {
-    return json7({ error: t2("apiError.invalidRequest") }, 400);
+    return json8({ error: t2("apiError.invalidRequest") }, 400);
   }
   const body = raw;
   const updates = {};
   if (body.name !== undefined) {
     const name24 = typeof body.name === "string" ? body.name.trim() : "";
     if (!name24) {
-      return json7({ error: t2("apiError.watchNameRequired") }, 400);
+      return json8({ error: t2("apiError.watchNameRequired") }, 400);
     }
     updates.name = name24;
   }
   if (body.paneId !== undefined) {
     const paneId = typeof body.paneId === "string" ? body.paneId.trim() : "";
     if (!paneId) {
-      return json7({ error: t2("apiError.agentPaneRequired") }, 400);
+      return json8({ error: t2("apiError.agentPaneRequired") }, 400);
     }
     updates.paneId = paneId;
   }
   if (body.triggerType !== undefined) {
     if (!TRIGGER_TYPES.includes(body.triggerType)) {
-      return json7({ error: t2("apiError.watchTriggerTypeInvalid") }, 400);
+      return json8({ error: t2("apiError.watchTriggerTypeInvalid") }, 400);
     }
     updates.triggerType = body.triggerType;
   }
   const parsed = parseRuleFields(raw);
   if (!parsed.ok) {
-    return json7({ error: parsed.error }, 400);
+    return json8({ error: parsed.error }, 400);
   }
   const fields = parsed.fields;
   Object.assign(updates, fields);
@@ -105199,32 +106391,32 @@ async function handleUpdateRule(req, id, deps) {
   };
   const semanticError = validateRuleSemantics(effective);
   if (semanticError) {
-    return json7({ error: semanticError }, 400);
+    return json8({ error: semanticError }, 400);
   }
   const rule = updateWatchRule(id, updates);
   if (!rule) {
-    return json7({ error: t2("apiError.watchRuleNotFound") }, 404);
+    return json8({ error: t2("apiError.watchRuleNotFound") }, 404);
   }
   await deps.service.refreshRule(id);
   const state = getWatchRuleState(id);
-  return json7({ rule: toRuleDto(rule), state: state ? toStateDto(state) : null });
+  return json8({ rule: toRuleDto(rule), state: state ? toStateDto(state) : null });
 }
 async function handleDeleteRule(id, deps) {
   const existing = getWatchRuleById(id);
   if (!existing) {
-    return json7({ error: t2("apiError.watchRuleNotFound") }, 404);
+    return json8({ error: t2("apiError.watchRuleNotFound") }, 404);
   }
   deleteWatchRule(id);
   await deps.service.removeRule(id);
-  return json7({ success: true });
+  return json8({ success: true });
 }
 async function handleGetRuleState(id, deps) {
   const rule = getWatchRuleById(id);
   if (!rule) {
-    return json7({ error: t2("apiError.watchRuleNotFound") }, 404);
+    return json8({ error: t2("apiError.watchRuleNotFound") }, 404);
   }
   const state = getWatchRuleState(id);
-  return json7({
+  return json8({
     state: state ? toStateDto(state) : null,
     samples: deps.service.getSamples(id)
   });
@@ -105248,17 +106440,17 @@ function buildAssistPrompt(description, screen) {
 async function handleAssistRegex(req, deps) {
   const raw = await readJsonObjectBody3(req);
   if (!raw) {
-    return json7({ error: t2("apiError.invalidRequest") }, 400);
+    return json8({ error: t2("apiError.invalidRequest") }, 400);
   }
   const body = raw;
   const description = typeof body.description === "string" ? body.description.trim() : "";
   if (!description) {
-    return json7({ error: t2("apiError.watchAssistDescriptionRequired") }, 400);
+    return json8({ error: t2("apiError.watchAssistDescriptionRequired") }, 400);
   }
   let providerId = null;
   if (body.providerId !== undefined && body.providerId !== null) {
     if (typeof body.providerId !== "string" || !getLlmProviderById(body.providerId)) {
-      return json7({ error: t2("apiError.llmProviderNotFound") }, 400);
+      return json8({ error: t2("apiError.llmProviderNotFound") }, 400);
     }
     providerId = body.providerId;
   }
@@ -105268,7 +106460,7 @@ async function handleAssistRegex(req, deps) {
   const paneId = typeof body.paneId === "string" ? body.paneId.trim() : "";
   if (deviceId && paneId) {
     if (!getDeviceById(deviceId)) {
-      return json7({ error: t2("apiError.deviceNotFound") }, 404);
+      return json8({ error: t2("apiError.deviceNotFound") }, 404);
     }
     try {
       screen = await deps.captureScreen(deviceId, paneId);
@@ -105289,14 +106481,14 @@ async function handleAssistRegex(req, deps) {
     object3 = result.object;
   } catch (error51) {
     const detail = error51 instanceof Error ? error51.message : String(error51);
-    return json7({ error: t2("apiError.watchAssistModelUnavailable", { detail }) }, 502);
+    return json8({ error: t2("apiError.watchAssistModelUnavailable", { detail }) }, 502);
   }
   let regex;
   try {
     regex = compileWatchPattern(object3.pattern, object3.flags);
   } catch (error51) {
     const detail = error51 instanceof Error ? error51.message : String(error51);
-    return json7({ error: t2("apiError.watchPatternInvalid", { detail }) }, 502);
+    return json8({ error: t2("apiError.watchPatternInvalid", { detail }) }, 502);
   }
   const preview = [];
   if (screen) {
@@ -105310,7 +106502,7 @@ async function handleAssistRegex(req, deps) {
       match = regex.exec(screen);
     }
   }
-  return json7({
+  return json8({
     pattern: object3.pattern,
     flags: object3.flags,
     extractGroup: object3.extractGroup >= 0 ? object3.extractGroup : 0,
@@ -105318,7 +106510,7 @@ async function handleAssistRegex(req, deps) {
     preview
   });
 }
-function json7(data, status = 200) {
+function json8(data, status = 200) {
   return new Response(JSON.stringify(data), {
     status,
     headers: {
@@ -105508,6 +106700,12 @@ function handleApiRequest(req, _server) {
       return filesResponse;
     }
   }
+  if (path.startsWith("/api/system/")) {
+    const systemResponse = handleSystemApiRequest(req, path);
+    if (systemResponse) {
+      return systemResponse;
+    }
+  }
   if (path === "/api/webhooks" && req.method === "GET") {
     return handleGetWebhooks();
   }
@@ -105521,9 +106719,13 @@ function handleApiRequest(req, _server) {
     return handleGetManifest(req.method);
   }
   if (path === "/healthz" && req.method === "GET") {
-    return json8({ status: "ok", restarting: runtimeController.isRestarting() });
+    return json9({
+      status: "ok",
+      restarting: runtimeController.isRestarting(),
+      env: "development"
+    });
   }
-  return json8({ error: t2("apiError.notFound") }, 404);
+  return json9({ error: t2("apiError.notFound") }, 404);
 }
 function enrichDeviceWithRuntime(device) {
   const status = getDeviceRuntimeStatus(device.id);
@@ -105537,22 +106739,22 @@ function enrichDeviceWithRuntime(device) {
 }
 async function handleGetDevices() {
   const devices2 = getAllDevices().map(enrichDeviceWithRuntime);
-  return json8({ devices: devices2 });
+  return json9({ devices: devices2 });
 }
 async function handleGetDevice(id) {
   const device = getDeviceById(id);
   if (!device) {
-    return json8({ error: t2("apiError.deviceNotFound") }, 404);
+    return json9({ error: t2("apiError.deviceNotFound") }, 404);
   }
-  return json8({ device: enrichDeviceWithRuntime(device) });
+  return json9({ device: enrichDeviceWithRuntime(device) });
 }
 async function handleCreateDevice(req) {
   const body = await req.json();
   if (!body.name || !body.type || !body.authMode) {
-    return json8({ error: t2("apiError.missingFields") }, 400);
+    return json9({ error: t2("apiError.missingFields") }, 400);
   }
   if (body.type === "ssh" && !body.host && !body.sshConfigRef) {
-    return json8({ error: t2("apiError.sshRequiresHost") }, 400);
+    return json9({ error: t2("apiError.sshRequiresHost") }, 400);
   }
   const now2 = new Date().toISOString();
   const device = {
@@ -105574,12 +106776,12 @@ async function handleCreateDevice(req) {
   };
   createDevice(device);
   await pushSupervisor.upsert(device.id);
-  return json8({ device: getDeviceById(device.id) ?? device }, 201);
+  return json9({ device: getDeviceById(device.id) ?? device }, 201);
 }
 async function handleUpdateDevice(req, id) {
   const existing = getDeviceById(id);
   if (!existing) {
-    return json8({ error: t2("apiError.deviceNotFound") }, 404);
+    return json9({ error: t2("apiError.deviceNotFound") }, 404);
   }
   const body = await req.json();
   const updates = {};
@@ -105609,61 +106811,61 @@ async function handleUpdateDevice(req, id) {
     await pushSupervisor.reconnect(id);
   }
   const device = getDeviceById(id);
-  return json8({ device });
+  return json9({ device });
 }
 async function handleReorderDevices(req) {
   const body = await req.json();
   if (!Array.isArray(body.deviceIds) || body.deviceIds.some((id) => typeof id !== "string")) {
-    return json8({ error: t2("apiError.invalidRequest") }, 400);
+    return json9({ error: t2("apiError.invalidRequest") }, 400);
   }
   reorderDevices(body.deviceIds);
-  return json8({ devices: getAllDevices().map(enrichDeviceWithRuntime) });
+  return json9({ devices: getAllDevices().map(enrichDeviceWithRuntime) });
 }
 async function handleDeleteDevice(id) {
   const existing = getDeviceById(id);
   if (!existing) {
-    return json8({ error: t2("apiError.deviceNotFound") }, 404);
+    return json9({ error: t2("apiError.deviceNotFound") }, 404);
   }
   deleteDevice(id);
   pushSupervisor.remove(id);
-  return json8({ success: true });
+  return json9({ success: true });
 }
 async function handleTestConnection(id) {
   return handleDeviceTestConnection(id);
 }
 async function handleGetSiteSettings() {
-  return json8({ settings: getSiteSettings() });
+  return json9({ settings: getSiteSettings() });
 }
 async function handleUpdateSiteSettings(req) {
   try {
     const body = await req.json();
     const updates = normalizeSiteSettingsInput(body);
     const settings = updateSiteSettings(updates);
-    return json8({ settings });
+    return json9({ settings });
   } catch (err) {
-    return json8({ error: err instanceof Error ? err.message : t2("apiError.invalidRequest") }, 400);
+    return json9({ error: err instanceof Error ? err.message : t2("apiError.invalidRequest") }, 400);
   }
 }
 async function handleRestartGateway() {
   setTimeout(() => {
     runtimeController.requestRestart();
   }, 50);
-  return json8({
+  return json9({
     success: true,
     message: t2("settings.restartScheduled")
   });
 }
 async function handleGetTelegramBots() {
   const bots = getTelegramBotsWithStats();
-  return json8({ bots });
+  return json9({ bots });
 }
 async function handleCreateTelegramBot(req) {
   const body = await req.json();
   if (!body.name?.trim()) {
-    return json8({ error: t2("apiError.botNameRequired") }, 400);
+    return json9({ error: t2("apiError.botNameRequired") }, 400);
   }
   if (!body.token?.trim()) {
-    return json8({ error: t2("apiError.botTokenRequired") }, 400);
+    return json9({ error: t2("apiError.botTokenRequired") }, 400);
   }
   const now2 = new Date().toISOString();
   createTelegramBot({
@@ -105677,26 +106879,26 @@ async function handleCreateTelegramBot(req) {
     updatedAt: now2
   });
   await telegramService.refresh();
-  return json8({ success: true }, 201);
+  return json9({ success: true }, 201);
 }
 async function handleUpdateTelegramBot(req, botId) {
   const existing = getTelegramBotById(botId);
   if (!existing) {
-    return json8({ error: t2("apiError.botNotFound") }, 404);
+    return json9({ error: t2("apiError.botNotFound") }, 404);
   }
   const body = await req.json();
   const updates = {};
   if (body.name !== undefined) {
     const value = body.name.trim();
     if (!value) {
-      return json8({ error: t2("apiError.botNameRequired") }, 400);
+      return json9({ error: t2("apiError.botNameRequired") }, 400);
     }
     updates.name = value;
   }
   if (body.token !== undefined) {
     const token = body.token.trim();
     if (!token) {
-      return json8({ error: t2("apiError.botTokenRequired") }, 400);
+      return json9({ error: t2("apiError.botTokenRequired") }, 400);
     }
     updates.tokenEnc = await encrypt(token);
   }
@@ -105708,69 +106910,69 @@ async function handleUpdateTelegramBot(req, botId) {
   }
   updateTelegramBot(botId, updates);
   await telegramService.refresh();
-  return json8({ success: true });
+  return json9({ success: true });
 }
 async function handleDeleteTelegramBot(botId) {
   const existing = getTelegramBotById(botId);
   if (!existing) {
-    return json8({ error: t2("apiError.botNotFound") }, 404);
+    return json9({ error: t2("apiError.botNotFound") }, 404);
   }
   deleteTelegramBot(botId);
   await telegramService.refresh();
-  return json8({ success: true });
+  return json9({ success: true });
 }
 async function handleListTelegramChats(botId) {
   const existing = getTelegramBotById(botId);
   if (!existing) {
-    return json8({ error: t2("apiError.botNotFound") }, 404);
+    return json9({ error: t2("apiError.botNotFound") }, 404);
   }
   const chats = listTelegramChatsByBot(botId);
-  return json8({ chats });
+  return json9({ chats });
 }
 async function handleApproveTelegramChat(botId, chatId) {
   const existing = getTelegramBotById(botId);
   if (!existing) {
-    return json8({ error: t2("apiError.botNotFound") }, 404);
+    return json9({ error: t2("apiError.botNotFound") }, 404);
   }
   const chat = approveTelegramChat(botId, chatId);
   if (!chat) {
-    return json8({ error: t2("apiError.chatNotFound") }, 404);
+    return json9({ error: t2("apiError.chatNotFound") }, 404);
   }
   const settings = getSiteSettings();
   await telegramService.sendTestMessage(botId, chatId, t2("telegram.approveMessageTemplate", {
     botName: existing.name,
     time: new Date().toLocaleString(toBCP47(settings.language))
   }));
-  return json8({ chat });
+  return json9({ chat });
 }
 async function handleDeleteTelegramChat(botId, chatId) {
   const existing = getTelegramBotById(botId);
   if (!existing) {
-    return json8({ error: t2("apiError.botNotFound") }, 404);
+    return json9({ error: t2("apiError.botNotFound") }, 404);
   }
   deleteTelegramChat(botId, chatId);
-  return json8({ success: true });
+  return json9({ success: true });
 }
 async function handleTestTelegramChat(botId, chatId) {
   const bot = getTelegramBotById(botId);
   if (!bot) {
-    return json8({ error: t2("apiError.botNotFound") }, 404);
+    return json9({ error: t2("apiError.botNotFound") }, 404);
   }
   const settings = getSiteSettings();
   await telegramService.sendTestMessage(botId, chatId, t2("telegram.testMessageTemplate", {
     siteName: settings.siteName,
     time: new Date().toLocaleString(toBCP47(settings.language))
   }));
-  return json8({ success: true });
+  return json9({ success: true });
 }
 async function handleGetWebhooks() {
   const webhooks = getAllWebhookEndpoints();
-  return json8({ webhooks });
+  return json9({ webhooks });
 }
 async function handleCreateWebhook(req) {
   const body = await req.json();
   if (!body.url || !body.secret) {
-    return json8({ error: t2("apiError.urlAndSecretRequired") }, 400);
+    return json9({ error: t2("apiError.urlAndSecretRequired") }, 400);
   }
   const now2 = new Date().toISOString();
   const endpoint = {
@@ -105783,11 +106985,11 @@ async function handleCreateWebhook(req) {
     updatedAt: now2
   };
   createWebhookEndpoint(endpoint);
-  return json8({ webhook: endpoint }, 201);
+  return json9({ webhook: endpoint }, 201);
 }
 async function handleDeleteWebhook(id) {
   deleteWebhookEndpoint(id);
-  return json8({ success: true });
+  return json9({ success: true });
 }
 async function handleGetManifest(method) {
   const settings = getSiteSettings();
@@ -105808,7 +107010,7 @@ async function handleGetManifest(method) {
         purpose: "any"
       },
       {
-        src: "/tmex.png",
+        src: "/tmex-maskable.png",
         sizes: "1024x1024",
         type: "image/png",
         purpose: "maskable"
@@ -105826,7 +107028,7 @@ function manifestJson(data, method) {
     }
   });
 }
-function json8(data, status = 200, headers = {}) {
+function json9(data, status = 200, headers = {}) {
   return new Response(JSON.stringify(data), {
     status,
     headers: {
@@ -105837,8 +107039,8 @@ function json8(data, status = 200, headers = {}) {
 }
 
 // ../../apps/gateway/src/db/migrate.ts
-import { existsSync as existsSync4 } from "fs";
-import { resolve as resolve3 } from "path";
+import { existsSync as existsSync7 } from "fs";
+import { resolve as resolve5 } from "path";
 
 // ../../node_modules/.bun/drizzle-orm@0.45.1+d3720f6f296df04b/node_modules/drizzle-orm/migrator.js
 import crypto2 from "crypto";
@@ -105883,10 +107085,10 @@ function resolveMigrationsFolder() {
   const fromEnv = process.env.TMEX_MIGRATIONS_DIR;
   if (fromEnv)
     return fromEnv;
-  const byCwd = resolve3(process.cwd(), "drizzle");
-  if (existsSync4(byCwd))
+  const byCwd = resolve5(process.cwd(), "drizzle");
+  if (existsSync7(byCwd))
     return byCwd;
-  return resolve3(import.meta.dir, "../../drizzle");
+  return resolve5(import.meta.dir, "../../drizzle");
 }
 var migrationsFolder = resolveMigrationsFolder();
 function runMigrations() {
@@ -107390,6 +108592,7 @@ async function createGatewayRuntime(options = {}) {
   }
   runtimeController.reset();
   primeLocalShellPath();
+  sweepOrphanTransferTemps();
   const wsServer = new WebSocketServer;
   connectionAlertNotifier.setBroadcaster((deviceId, payload) => {
     wsServer.broadcastDeviceError(deviceId, payload);
@@ -107688,16 +108891,16 @@ function contentTypeByPath(path) {
 }
 function resolveStaticRoot() {
   if (process.env.TMEX_FE_DIST_DIR) {
-    return resolve4(process.env.TMEX_FE_DIST_DIR);
+    return resolve6(process.env.TMEX_FE_DIST_DIR);
   }
-  return resolve4(import.meta.dir, "../../resources/fe-dist");
+  return resolve6(import.meta.dir, "../../resources/fe-dist");
 }
 function resolveRequestedFile(staticRoot, pathname) {
-  const root = resolve4(staticRoot);
+  const root = resolve6(staticRoot);
   const decoded = decodeURIComponent(pathname);
   const normalized = normalize(decoded).replace(/^\.\.(\/|\\|$)/, "");
   const requested = normalized === "/" ? "/index.html" : normalized;
-  const absolutePath = resolve4(root, `.${requested}`);
+  const absolutePath = resolve6(root, `.${requested}`);
   if (absolutePath !== root && !absolutePath.startsWith(`${root}${sep}`)) {
     return null;
   }
@@ -107712,12 +108915,12 @@ async function serveFrontend(req, staticRoot) {
   if (!requestedPath) {
     return new Response(t3("runtime.forbidden"), { status: 403 });
   }
-  if (!existsSync5(requestedPath) && extname2(url2.pathname) !== "") {
+  if (!existsSync8(requestedPath) && extname2(url2.pathname) !== "") {
     return new Response(t3("runtime.notFound"), { status: 404 });
   }
-  const indexPath = join6(staticRoot, "index.html");
-  const targetPath = existsSync5(requestedPath) ? requestedPath : indexPath;
-  if (!existsSync5(targetPath)) {
+  const indexPath = join8(staticRoot, "index.html");
+  const targetPath = existsSync8(requestedPath) ? requestedPath : indexPath;
+  if (!existsSync8(targetPath)) {
     return new Response(t3("runtime.frontendMissing"), { status: 500 });
   }
   const headers = new Headers;
@@ -107728,6 +108931,7 @@ async function serveFrontend(req, staticRoot) {
   return new Response(Bun.file(targetPath), { headers });
 }
 async function main() {
+  console.log(`[tmex] version ${getDisplayVersion()}`);
   const host = process.env.TMEX_BIND_HOST || "127.0.0.1";
   const port = Number(process.env.GATEWAY_PORT || "9883");
   const staticRoot = resolveStaticRoot();