toyon 0.0.0 → 0.2.0

package/dist/cli.js

@@ -0,0 +1,1466 @@
+#!/usr/bin/env bun
+// @bun
+
+// src/cli.ts
+import { existsSync as existsSync10 } from "fs";
+import { join as join7, resolve } from "path";
+// package.json
+var package_default = {
+  name: "toyon",
+  version: "0.2.0",
+  description: "Checking an agent's work means running it. Toyon gives every chat its own copy of your web app, with a live preview.",
+  license: "MIT",
+  type: "module",
+  homepage: "https://toyon.dev",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/toyon-dev/toyon.git"
+  },
+  bugs: "https://github.com/toyon-dev/toyon/issues",
+  keywords: [
+    "ai",
+    "agents",
+    "claude-code",
+    "codex",
+    "opencode",
+    "git",
+    "worktree",
+    "preview",
+    "dev-server"
+  ],
+  bin: {
+    toyon: "bin/toyon.js"
+  },
+  files: [
+    "bin",
+    "dist",
+    "cloud"
+  ],
+  engines: {
+    node: ">=18"
+  },
+  os: [
+    "darwin",
+    "linux"
+  ],
+  scripts: {
+    prepublishOnly: "bun ../../scripts/pack.ts"
+  },
+  dependencies: {
+    bun: "1.4.2",
+    "bun-pty": "0.4.10"
+  },
+  devDependencies: {
+    "@toyon/shared": "workspace:*"
+  }
+};
+
+// src/app.ts
+import { spawn as spawn2, spawnSync } from "child_process";
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
+
+// src/daemon.ts
+import { spawn } from "child_process";
+import { existsSync as existsSync2, mkdirSync, openSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { join as join2 } from "path";
+
+// ../shared/src/daemon.ts
+var DAEMON_FILES = {
+  token: "token",
+  pid: "daemon.pid",
+  state: "state.json",
+  log: "daemon.log",
+  remote: "remote.json"
+};
+var PREVIEW_PORTS = { from: 10001, to: 10008 };
+var DNS_NAME = /^(?=.{1,253}$)[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/;
+function isRemoteHost(name) {
+  return DNS_NAME.test(name) && !/\.\d+$/.test(name) && name !== "localhost" && !name.endsWith(".localhost");
+}
+var hostPreviews = (host) => `https://w{id}.${host}`;
+var portPreviews = (host) => `https://${host}:{port}`;
+var addressedByPort = (previews) => previews.includes("{port}");
+var PLACEHOLDER = /\{(id|port)\}/g;
+function checkPreviews(previews, host) {
+  const found = [...previews.matchAll(PLACEHOLDER)];
+  if (found.length !== 1)
+    return `${previews} needs exactly one of {id} or {port}`;
+  if (!/^https:\/\/[^/?#@]+$/.test(previews))
+    return `${previews} must be an https origin, with nothing after the name`;
+  if (previews.includes(":{id}"))
+    return `${previews} puts {id} where the port goes`;
+  let hostname;
+  try {
+    hostname = new URL(previewOrigin(previews, "0", 1)).hostname;
+  } catch {
+    return `${previews} is not an origin`;
+  }
+  if (hostname !== host && !hostname.endsWith(`.${host}`)) {
+    return `previews at ${hostname} are not ${host} or under it, so the preview cookie cannot reach them`;
+  }
+  return null;
+}
+function previewOrigin(previews, worktreeId, port) {
+  return previews.replace("{id}", worktreeId).replace("{port}", String(port));
+}
+var matchers = new Map;
+function parseRemote(text) {
+  try {
+    const v = JSON.parse(text);
+    if (typeof v?.host !== "string" || !isRemoteHost(v.host))
+      return null;
+    const previews = v.previews ?? hostPreviews(v.host);
+    if (typeof previews !== "string" || checkPreviews(previews, v.host) !== null)
+      return null;
+    return { host: v.host, previews };
+  } catch {
+    return null;
+  }
+}
+var WS_CLOSE_UNAUTHORIZED = 4401;
+
+// ../shared/src/launcher.ts
+var LAUNCHER_ORIGIN = "https://toyon.cloud";
+var launcherAddLink = (machineOrigin) => `${LAUNCHER_ORIGIN}/#add=${encodeURIComponent(machineOrigin)}`;
+
+// ../shared/src/ports.ts
+var DAEMON_DEFAULT_PORT = 4141;
+
+// ../shared/src/sandbox.ts
+var BWRAP_APPARMOR_PROFILE = `abi <abi/4.0>,
+include <tunables/global>
+profile bwrap /usr/bin/bwrap flags=(unconfined) {
+  userns,
+  include if exists <local/bwrap>
+}
+`;
+var BWRAP_PROBE_ARGS = ["--ro-bind", "/", "/", "true"];
+function bwrapBlockedAdvice(error, restricted) {
+  if (!restricted)
+    return `bubblewrap is installed but cannot start a sandbox: ${error}`;
+  return [
+    `bubblewrap cannot start a sandbox: ${error}`,
+    "This system restricts unprivileged user namespaces. Allow them for bubblewrap alone:",
+    "  sudo tee /etc/apparmor.d/bwrap >/dev/null <<'EOF'",
+    ...BWRAP_APPARMOR_PROFILE.trimEnd().split(`
+`).map((l) => `  ${l}`),
+    "  EOF",
+    "  sudo apparmor_parser -r /etc/apparmor.d/bwrap"
+  ].join(`
+`);
+}
+
+// src/layout.ts
+import { existsSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+var here = dirname(fileURLToPath(import.meta.url));
+var packaged = existsSync(join(here, "daemon.js"));
+var daemonEntry = packaged ? join(here, "daemon.js") : join(here, "../../daemon/src/index.ts");
+var iconSvg = packaged ? join(here, "shell", "icon.svg") : join(here, "../../shell/public/icon.svg");
+
+// src/daemon.ts
+var port = Number(process.env.TOYON_PORT ?? DAEMON_DEFAULT_PORT);
+var base = `http://127.0.0.1:${port}`;
+var home = process.env.TOYON_HOME ?? join2(homedir(), ".toyon");
+var tokenFile = join2(home, DAEMON_FILES.token);
+var pidFile = join2(home, DAEMON_FILES.pid);
+var logFile = join2(home, DAEMON_FILES.log);
+var remoteFile = join2(home, DAEMON_FILES.remote);
+async function health() {
+  try {
+    const r = await fetch(`${base}/health`, { signal: AbortSignal.timeout(1000) });
+    if (!r.ok)
+      return null;
+    return await r.json();
+  } catch {
+    return null;
+  }
+}
+function readToken() {
+  if (!existsSync2(tokenFile))
+    return null;
+  const t = readFileSync(tokenFile, "utf8").trim();
+  return t === "" ? null : t;
+}
+function readPid() {
+  if (!existsSync2(pidFile))
+    return null;
+  const n = Number(readFileSync(pidFile, "utf8").trim());
+  return Number.isInteger(n) && n > 0 ? n : null;
+}
+function alive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function startDaemon() {
+  mkdirSync(home, { recursive: true });
+  const logFd = openSync(logFile, "a");
+  const child = spawn(process.execPath, ["run", daemonEntry], {
+    detached: true,
+    stdio: ["ignore", logFd, logFd],
+    env: { ...process.env }
+  });
+  child.on("error", (e) => console.error(`could not start bun: ${e.message}`));
+  child.unref();
+  for (let i = 0;i < 40; i++) {
+    if (await health())
+      return true;
+    await Bun.sleep(250);
+  }
+  return await health() !== null;
+}
+function shellUrl(token, branded) {
+  return branded ? `http://toyon.localhost/#token=${token}` : `http://toyon.localhost:${port}/#token=${token}`;
+}
+
+// src/app.ts
+var CHROMIUMS = ["Google Chrome", "Arc", "Brave Browser", "Microsoft Edge", "Chromium"];
+var DATA_DIRS = {
+  "Google Chrome": "Google/Chrome",
+  Arc: "Arc/User Data",
+  "Brave Browser": "BraveSoftware/Brave-Browser",
+  "Microsoft Edge": "Microsoft Edge",
+  Chromium: "Chromium"
+};
+var pwaCacheDir = join3(home, "pwa");
+function profilesOf(browser) {
+  const root = join3(homedir2(), "Library", "Application Support", DATA_DIRS[browser] ?? browser);
+  if (!existsSync3(root))
+    return [];
+  return readdirSync(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => join3(root, d.name));
+}
+function pwaStillInstalled(browser, id) {
+  return profilesOf(browser).some((p) => existsSync3(join3(p, "Web Applications", "Manifest Resources", id)));
+}
+function findPwaId(browser, manifestId) {
+  const cache = join3(pwaCacheDir, `${browser.replace(/\W+/g, "-")}.id`);
+  if (existsSync3(cache)) {
+    const id = readFileSync2(cache, "utf8").trim();
+    if (/^[a-p]{32}$/.test(id) && pwaStillInstalled(browser, id))
+      return id;
+  }
+  const re = new RegExp(`web_apps-dt-([a-p]{32})[\\s\\S]{0,16}?${manifestId.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&")}`);
+  for (const p of profilesOf(browser)) {
+    const dir = join3(p, "Sync Data", "LevelDB");
+    if (!existsSync3(dir))
+      continue;
+    for (const f of readdirSync(dir)) {
+      if (!/\.(log|ldb)$/.test(f))
+        continue;
+      const m = re.exec(readFileSync2(join3(dir, f), "latin1"));
+      if (m && pwaStillInstalled(browser, m[1])) {
+        mkdirSync2(pwaCacheDir, { recursive: true });
+        writeFileSync(cache, m[1]);
+        return m[1];
+      }
+    }
+  }
+  return null;
+}
+function openAppWindow(appUrl) {
+  const manifestId = new URL("/", appUrl).href;
+  for (const app of CHROMIUMS) {
+    if (spawnSync("open", ["-Ra", app]).status === 0) {
+      const id = findPwaId(app, manifestId);
+      const flag = id ? `--app-id=${id}` : `--app=${appUrl}`;
+      spawn2("open", ["-na", app, "--args", flag], { stdio: "ignore" }).unref();
+      if (!id) {
+        console.log(`tip: install Toyon as an app (browser menu, then Install, or the install button in the top bar when opened in a tab)`);
+        console.log(`     once installed, it gets a native-style title bar; \`toyon --app\` then launches the installed app`);
+      }
+      return true;
+    }
+  }
+  return false;
+}
+function installApp(appUrl) {
+  const manifestId = new URL("/", appUrl).href;
+  const appDir = join3(homedir2(), "Applications", "Toyon.app");
+  const macos = join3(appDir, "Contents", "MacOS");
+  const resources = join3(appDir, "Contents", "Resources");
+  rmSync(appDir, { recursive: true, force: true });
+  mkdirSync2(macos, { recursive: true });
+  mkdirSync2(resources, { recursive: true });
+  writeFileSync(join3(appDir, "Contents", "Info.plist"), `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>CFBundleName</key><string>Toyon</string>
+  <key>CFBundleDisplayName</key><string>Toyon</string>
+  <key>CFBundleIdentifier</key><string>dev.toyon.app</string>
+  <key>CFBundleVersion</key><string>0.0.1</string>
+  <key>CFBundlePackageType</key><string>APPL</string>
+  <key>CFBundleExecutable</key><string>Toyon</string>
+  <key>CFBundleIconFile</key><string>AppIcon</string>
+</dict></plist>
+`);
+  const launcher = join3(resources, "launch.sh");
+  writeFileSync(launcher, `#!/bin/bash
+# Finder launches get a minimal PATH; find bun ourselves
+BUN=""
+for CAND in "$HOME/.bun/bin/bun" /opt/homebrew/bin/bun /usr/local/bin/bun; do
+  [ -x "$CAND" ] && BUN="$CAND" && break
+done
+
+# start the daemon if it isn't running
+if ! curl -s --max-time 1 http://127.0.0.1:${port}/health >/dev/null 2>&1; then
+  if [ -n "$BUN" ] && [ -f "${daemonEntry}" ]; then
+    nohup "$BUN" run "${daemonEntry}" >> "$HOME/.toyon/daemon.log" 2>&1 &
+    for _ in $(seq 1 40); do
+      curl -s --max-time 1 http://127.0.0.1:${port}/health >/dev/null 2>&1 && break
+      sleep 0.25
+    done
+  fi
+fi
+
+TOKEN=$(cat "$HOME/.toyon/token" 2>/dev/null)
+URL="http://toyon.localhost:${port}/#token=$TOKEN"
+MANIFEST_ID="${manifestId}"
+CACHE_DIR="$HOME/.toyon/pwa"
+# installed PWA (native-style title bar) if any profile has it, else a plain app window.
+# The app id lives in the browser's sync DB right before the manifest id; cache it once found.
+find_pwa_id() { # $1 = data dir, $2 = cache file
+  local root="$HOME/Library/Application Support/$1" id p f
+  if [ -f "$2" ]; then
+    id=$(tr -d '[:space:]' < "$2")
+    for p in "$root"/*/; do [ -d "$p/Web Applications/Manifest Resources/$id" ] && { echo "$id"; return; }; done
+  fi
+  for p in "$root"/*/; do
+    for f in "$p/Sync Data/LevelDB/"*.log "$p/Sync Data/LevelDB/"*.ldb; do
+      [ -f "$f" ] || continue
+      # the record straddles newline bytes, so flatten before the line-based grep
+      id=$(LC_ALL=C tr '\\n\\0' '  ' < "$f" | LC_ALL=C grep -aoE "web_apps-dt-[a-p]{32}.{0,16}$MANIFEST_ID" 2>/dev/null | head -1 | LC_ALL=C sed -E 's/^web_apps-dt-([a-p]{32}).*/\\1/')
+      if [ -n "$id" ] && [ -d "$p/Web Applications/Manifest Resources/$id" ]; then
+        mkdir -p "$CACHE_DIR" && printf '%s' "$id" > "$2"; echo "$id"; return
+      fi
+    done
+  done
+}
+launch() { # $1 = browser name, $2 = data dir
+  local id; id=$(find_pwa_id "$2" "$CACHE_DIR/$(echo "$1" | tr -c 'A-Za-z0-9
+' '-').id")
+  if [ -n "$id" ]; then exec open -na "$1" --args --app-id="$id"; fi
+  exec open -na "$1" --args --app="$URL"
+}
+${CHROMIUMS.map((a) => `if open -Ra "${a}" 2>/dev/null; then launch "${a}" "${DATA_DIRS[a]}"; fi`).join(`
+`)}
+exec open "$URL"
+`);
+  chmodSync(launcher, 493);
+  const stub = join3(macos, "Toyon");
+  const cSrc = join3(home, "launcher.c");
+  writeFileSync(cSrc, `#include <mach-o/dyld.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <libgen.h>
+int main(int argc, char **argv) {
+  char self[4096]; uint32_t n = sizeof(self);
+  if (_NSGetExecutablePath(self, &n) != 0) return 1;
+  char script[4600];
+  snprintf(script, sizeof(script), "%s/../Resources/launch.sh", dirname(self));
+  execl("/bin/bash", "bash", script, (char *)0);
+  return 1;
+}
+`);
+  const cc = spawnSync("clang", ["-O2", "-o", stub, cSrc], { stdio: "ignore" });
+  if (cc.status !== 0) {
+    writeFileSync(stub, `#!/bin/bash
+exec /bin/bash "$(dirname "$0")/../Resources/launch.sh"
+`);
+    chmodSync(stub, 493);
+  }
+  try {
+    const svg = iconSvg;
+    const tmp = join3(home, "iconset.tmp");
+    const iconset = join3(tmp, "AppIcon.iconset");
+    mkdirSync2(iconset, { recursive: true });
+    spawnSync("qlmanage", ["-t", "-s", "1024", "-o", tmp, svg], { stdio: "ignore" });
+    const big = join3(tmp, "icon.svg.png");
+    if (existsSync3(big)) {
+      for (const size of [16, 32, 64, 128, 256, 512, 1024]) {
+        spawnSync("sips", ["-z", String(size), String(size), big, "--out", join3(iconset, `icon_${size}x${size}.png`)], {
+          stdio: "ignore"
+        });
+      }
+      spawnSync("iconutil", ["-c", "icns", iconset, "-o", join3(resources, "AppIcon.icns")], { stdio: "ignore" });
+    }
+  } catch {}
+  spawnSync("xattr", ["-cr", appDir], { stdio: "ignore" });
+  const signed = spawnSync("codesign", ["--force", "--deep", "-s", "-", appDir], { stdio: "ignore" }).status === 0;
+  if (!signed)
+    console.warn("warning: could not codesign the app bundle; macOS may refuse to open it");
+  console.log(`installed ${appDir}; launch "Toyon" from Spotlight or drag it to the Dock`);
+  spawn2("open", ["-a", appDir], { stdio: "ignore" }).unref();
+}
+
+// src/args.ts
+var VERBS = new Set(["stop", "restart", "doctor", "logs", "version", "uninstall", "remote", "deploy", "help"]);
+var DEFAULT_LOG_LINES = 100;
+function parseArgs(argv) {
+  if (argv.includes("--help") || argv.includes("-h"))
+    return { kind: "help" };
+  if (argv.includes("--version") || argv.includes("-v"))
+    return { kind: "version" };
+  const [first, ...rest] = argv;
+  if (first !== undefined && VERBS.has(first)) {
+    switch (first) {
+      case "stop":
+      case "restart":
+      case "doctor":
+      case "version":
+      case "help":
+        if (rest.length > 0)
+          return { kind: "error", message: `toyon ${first} takes no arguments` };
+        return { kind: first };
+      case "logs":
+        return parseLogs(rest);
+      case "uninstall": {
+        const extra = rest.filter((a) => a !== "--yes" && a !== "-y");
+        if (extra.length > 0)
+          return { kind: "error", message: `unknown option ${extra[0]}` };
+        return { kind: "uninstall", yes: rest.length > 0 };
+      }
+      case "remote": {
+        const ports = rest.includes("--ports");
+        const tailscale = rest.includes("--tailscale");
+        const names = rest.filter((a) => a !== "--ports" && a !== "--tailscale");
+        const option = names.find((a) => a.startsWith("-"));
+        if (option)
+          return { kind: "error", message: `unknown option ${option}` };
+        if (names.length > 1)
+          return { kind: "error", message: "toyon remote takes one name, or off" };
+        const to = names[0] ?? null;
+        if (tailscale) {
+          if (to !== null || ports) {
+            return { kind: "error", message: "--tailscale goes alone: the name comes from Tailscale" };
+          }
+          return { kind: "remote", to, ports, tailscale };
+        }
+        if (ports && (to === null || to === "off")) {
+          return { kind: "error", message: "--ports goes with a name: toyon remote <name> --ports" };
+        }
+        if (to !== null && to !== "off" && !isRemoteHost(to)) {
+          return {
+            kind: "error",
+            message: `${to} is not a host name; give the name your TLS front answers for, like toyon.example.com`
+          };
+        }
+        return { kind: "remote", to, ports, tailscale };
+      }
+      case "deploy":
+        return parseDeploy(rest);
+    }
+  }
+  let path = null;
+  let app = false;
+  let installApp = false;
+  for (const a of argv) {
+    if (a === "--app" || a === "--pwa")
+      app = true;
+    else if (a === "--install-app")
+      installApp = true;
+    else if (a.startsWith("-"))
+      return { kind: "error", message: `unknown option ${a}` };
+    else if (path !== null)
+      return { kind: "error", message: "Toyon opens one path at a time" };
+    else
+      path = a;
+  }
+  return { kind: "open", path, app, installApp };
+}
+function parseLogs(rest) {
+  let follow = false;
+  let lines = DEFAULT_LOG_LINES;
+  for (let i = 0;i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "-f" || a === "--follow")
+      follow = true;
+    else if (a === "-n" || a === "--lines") {
+      const n = Number(rest[++i]);
+      if (!Number.isInteger(n) || n < 0)
+        return { kind: "error", message: `${a} needs a whole number` };
+      lines = n;
+    } else
+      return { kind: "error", message: `unknown option ${a}` };
+  }
+  return { kind: "logs", follow, lines };
+}
+var FLY_APP = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/;
+function parseDeploy(rest) {
+  const error = (message) => ({ kind: "error", message });
+  const [provider, action, ...more] = rest;
+  if (provider !== "fly")
+    return error("toyon deploy knows one host so far: toyon deploy fly up <name>");
+  if (action !== "up" && action !== "url" && action !== "destroy") {
+    return error("toyon deploy fly takes up, url or destroy, then an app name");
+  }
+  let name = null;
+  let region = null;
+  let repo = null;
+  let yes = false;
+  for (let i = 0;i < more.length; i++) {
+    const a = more[i];
+    if ((a === "--region" || a === "--repo") && action === "up") {
+      const value = more[++i];
+      if (!value)
+        return error(`${a} needs a value`);
+      if (a === "--region") {
+        if (!/^[a-z]{3}$/.test(value))
+          return error(`${value} is not a Fly region code, like fra or iad`);
+        region = value;
+      } else {
+        if (!/^https:\/\/\S+$/.test(value))
+          return error("--repo takes an https clone URL, like https://github.com/you/app.git");
+        repo = value;
+      }
+    } else if ((a === "--yes" || a === "-y") && action === "destroy")
+      yes = true;
+    else if (a.startsWith("-"))
+      return error(`unknown option ${a} for toyon deploy fly ${action}`);
+    else if (name !== null)
+      return error("toyon deploy takes one app name");
+    else
+      name = a;
+  }
+  if (name === null)
+    return error(`toyon deploy fly ${action} needs an app name`);
+  if (!FLY_APP.test(name))
+    return error(`${name} is not a Fly app name: lowercase letters, digits and dashes`);
+  return { kind: "deploy", provider, action, name, region, repo, yes };
+}
+var HELP = `toyon: one chat per git worktree, every worktree running live
+
+usage
+  toyon [path]            start the daemon if it is not running, register the repo at path
+                          (default: the current directory) and open the shell
+  toyon stop              stop the daemon and every dev server and agent it runs
+  toyon restart           stop the daemon and start it again, for a Toyon you have just rebuilt;
+                          every shell reconnects on its own
+  toyon doctor            check the daemon, the token, the shell build and the tools Toyon needs
+  toyon logs [-f] [-n N]  print the daemon log; -f keeps following it, -n sets how many lines
+  toyon version           print the CLI version, and the daemon's if one is running
+  toyon uninstall [--yes] stop the daemon and remove everything Toyon put on this machine;
+                          your repos and the branches Toyon made stay
+  toyon remote [name|off] open the shell from another device at https://name, through a TLS
+                          front on this machine; with no name, print the setting; off also
+                          removes the tailscale serve entries Toyon set
+    --ports               put each preview on its own port of the name, for a front that cannot
+                          hold a wildcard certificate
+  toyon remote --tailscale
+                          open the shell from your tailnet at this machine's Tailscale name:
+                          sets up tailscale serve for Toyon and ports 10001-10008
+  toyon deploy fly up <name> [--region code] [--repo url]
+                          run Toyon on your own Fly account at https://name.fly.dev with your own
+                          keys; --repo clones that repository onto it the first time
+  toyon deploy fly url <name>
+                          print the link to that machine again
+  toyon deploy fly destroy <name> [--yes]
+                          delete that app and its volume
+
+options for toyon [path]
+  --app                   open a Chromium app window (the installed Toyon app when there is one)
+  --install-app           write ~/Applications/Toyon.app and open it
+
+environment
+  TOYON_HOME              where state lives (default ~/.toyon)
+  TOYON_PORT              the daemon's port (default 4141)
+`;
+
+// src/deploy/fly.ts
+import { randomBytes } from "crypto";
+import { Resolver } from "dns/promises";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, mkdtempSync, readFileSync as readFileSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { tmpdir } from "os";
+import { join as join5 } from "path";
+
+// src/openUrl.ts
+import { spawn as spawn3 } from "child_process";
+function openUrl(url) {
+  const child = spawn3(process.platform === "darwin" ? "open" : "xdg-open", [url], { stdio: "ignore" });
+  child.on("error", () => {});
+  child.unref();
+}
+
+// src/deploy/context.ts
+import { cpSync, existsSync as existsSync4, mkdirSync as mkdirSync3, writeFileSync as writeFileSync2 } from "fs";
+import { join as join4 } from "path";
+var bunVersion = package_default.dependencies.bun;
+function machineSources() {
+  const dist = packaged ? here : join4(here, "..", "dist");
+  return existsSync4(join4(dist, "daemon.js")) ? { dist, cloud: join4(dist, "..", "cloud") } : null;
+}
+function machinePackageJson() {
+  const manifest = {
+    name: "toyon-machine",
+    private: true,
+    version: package_default.version,
+    dependencies: { "bun-pty": package_default.dependencies["bun-pty"] }
+  };
+  return `${JSON.stringify(manifest, null, 2)}
+`;
+}
+function writeMachineContext(src, out) {
+  mkdirSync3(out, { recursive: true });
+  cpSync(src.dist, join4(out, "dist"), { recursive: true });
+  cpSync(join4(src.cloud, "Dockerfile"), join4(out, "Dockerfile"));
+  cpSync(join4(src.cloud, "entrypoint.sh"), join4(out, "entrypoint.sh"));
+  writeFileSync2(join4(out, "package.json"), machinePackageJson());
+}
+
+// src/deploy/fly.ts
+var DAEMON_PORT = 4141;
+var VOLUME = "toyon_data";
+var VOLUME_GB = 5;
+var cloudDir = join5(home, "cloud");
+var tokenFile2 = (app) => join5(cloudDir, `${app}.token`);
+
+class DeployError extends Error {
+}
+function flyToml(app, region) {
+  const host = `${app}.fly.dev`;
+  const lines = [
+    "# written by toyon deploy fly for one deploy",
+    `app = "${app}"`,
+    `primary_region = "${region}"`,
+    "",
+    "[env]",
+    `  TOYON_PUBLIC_HOST = "${host}"`,
+    `  TOYON_PREVIEWS = "${portPreviews(host)}"`,
+    "",
+    "[mounts]",
+    `  source = "${VOLUME}"`,
+    '  destination = "/data"',
+    "",
+    "[[vm]]",
+    '  size = "shared-cpu-2x"',
+    '  memory = "2048mb"',
+    "",
+    "# the shell and the daemon's websocket",
+    "[[services]]",
+    `  internal_port = ${DAEMON_PORT}`,
+    '  protocol = "tcp"',
+    '  auto_stop_machines = "stop"',
+    "  auto_start_machines = true",
+    "  min_machines_running = 0",
+    "  [[services.ports]]",
+    "    port = 80",
+    '    handlers = ["http"]',
+    "    force_https = true",
+    "  [[services.ports]]",
+    "    port = 443",
+    '    handlers = ["tls", "http"]',
+    "  [[services.http_checks]]",
+    '    interval = "15s"',
+    '    timeout = "5s"',
+    '    grace_period = "60s"',
+    '    method = "get"',
+    '    path = "/health"'
+  ];
+  for (let p = PREVIEW_PORTS.from;p <= PREVIEW_PORTS.to; p++) {
+    lines.push("", "[[services]]", `  internal_port = ${p}`, '  protocol = "tcp"', '  auto_stop_machines = "stop"', "  auto_start_machines = true", "  min_machines_running = 0", "  [[services.ports]]", `    port = ${p}`, '    handlers = ["tls", "http"]');
+  }
+  return `${lines.join(`
+`)}
+`;
+}
+function regionFromRequestId(id) {
+  return id?.match(/-([a-z]{3})$/)?.[1] ?? null;
+}
+function secretsInput(secrets) {
+  const lines = [];
+  for (const [name, value] of Object.entries(secrets)) {
+    if (value === null)
+      continue;
+    if (/[\r\n]/.test(value))
+      throw new DeployError(`${name} holds a line break; a key is one line`);
+    lines.push(`${name}=${value}`);
+  }
+  return `${lines.join(`
+`)}
+`;
+}
+async function nearestRegion() {
+  try {
+    const res = await fetch("https://api.fly.io/", { method: "HEAD", signal: AbortSignal.timeout(5000) });
+    return regionFromRequestId(res.headers.get("fly-request-id"));
+  } catch {
+    return null;
+  }
+}
+function secret(env, file) {
+  const fromEnv = process.env[env]?.trim();
+  if (fromEnv)
+    return fromEnv;
+  const path = join5(cloudDir, file);
+  return existsSync5(path) ? readFileSync3(path, "utf8").trim() || null : null;
+}
+async function capture(bin, args, input) {
+  const p = Bun.spawn([bin, ...args], {
+    stdin: input === undefined ? "ignore" : new Blob([input]),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [out, err] = await Promise.all([new Response(p.stdout).text(), new Response(p.stderr).text()]);
+  return { ok: await p.exited === 0, out, err };
+}
+async function show(bin, args) {
+  const p = Bun.spawn([bin, ...args], { stdin: "inherit", stdout: "inherit", stderr: "inherit" });
+  return await p.exited === 0;
+}
+function must(r, what) {
+  if (!r.ok)
+    throw new DeployError(`${what}: ${r.err.trim().split(`
+`).at(-1) ?? "flyctl failed"}`);
+}
+function namesApp(json, app) {
+  try {
+    const apps = JSON.parse(json);
+    return apps.some((a) => (a.Name ?? a.name) === app);
+  } catch {
+    return false;
+  }
+}
+async function published(host) {
+  const r = new Resolver({ timeout: 3000, tries: 1 });
+  r.setServers(["1.1.1.1", "8.8.8.8"]);
+  for (let i = 0;i < 60; i++) {
+    try {
+      if ((await r.resolve4(host)).length)
+        return true;
+    } catch (e) {
+      const code = e.code;
+      if (code !== "ENOTFOUND" && code !== "ENODATA")
+        return true;
+    }
+    await Bun.sleep(2000);
+  }
+  return false;
+}
+async function answers(url) {
+  try {
+    return (await fetch(url, { signal: AbortSignal.timeout(5000) })).ok;
+  } catch {
+    return false;
+  }
+}
+async function up(cmd, bin) {
+  const src = machineSources();
+  if (!src)
+    throw new DeployError("there is no packed build to deploy here; in a source checkout run `bun scripts/pack.ts` first");
+  if (!(await capture(bin, ["auth", "whoami"])).ok)
+    throw new DeployError("flyctl is not logged in; run `fly auth login`");
+  const anthropic = secret("ANTHROPIC_API_KEY", "anthropic.key");
+  if (!anthropic)
+    console.log("no Anthropic key: sign in with your Claude plan from the first chat");
+  const region = cmd.region ?? await nearestRegion();
+  if (!region)
+    throw new DeployError("could not tell which Fly region is closest; pass --region (`fly platform regions` lists them)");
+  console.log(cmd.region ? `region ${region}` : `region ${region}, the closest to you; --region picks another`);
+  mkdirSync4(cloudDir, { recursive: true, mode: 448 });
+  if (!existsSync5(tokenFile2(cmd.name)))
+    writeFileSync3(tokenFile2(cmd.name), randomBytes(32).toString("hex"), { mode: 384 });
+  const token = readFileSync3(tokenFile2(cmd.name), "utf8").trim();
+  const app = ["-a", cmd.name];
+  if (!namesApp((await capture(bin, ["apps", "list", "--json"])).out, cmd.name)) {
+    console.log(`creating the app ${cmd.name}`);
+    must(await capture(bin, ["apps", "create", cmd.name]), "could not create the app");
+  }
+  if (!(await capture(bin, ["volumes", "list", ...app, "--json"])).out.includes(`"${VOLUME}"`)) {
+    console.log(`creating a ${VOLUME_GB} GB volume in ${region}`);
+    must(await capture(bin, [
+      "volumes",
+      "create",
+      VOLUME,
+      ...app,
+      "--region",
+      region,
+      "--size",
+      String(VOLUME_GB),
+      "--yes"
+    ]), "could not create the volume");
+  }
+  console.log("setting secrets");
+  const secrets = secretsInput({
+    TOYON_TOKEN: token,
+    ANTHROPIC_API_KEY: anthropic,
+    OPENAI_API_KEY: secret("OPENAI_API_KEY", "openai.key"),
+    GITHUB_TOKEN: secret("GITHUB_TOKEN", "github.token"),
+    TOYON_REPO_URL: cmd.repo
+  });
+  must(await capture(bin, ["secrets", "import", ...app, "--stage"], secrets), "could not set the secrets");
+  const ips = (await capture(bin, ["ips", "list", ...app, "--json"])).out;
+  if (!/"Type":\s*"(shared_)?v4"/.test(ips))
+    must(await capture(bin, ["ips", "allocate-v4", "--shared", ...app]), "could not add an IPv4 address");
+  if (!/"Type":\s*"v6"/.test(ips))
+    must(await capture(bin, ["ips", "allocate-v6", ...app]), "could not add an IPv6 address");
+  const ctx = mkdtempSync(join5(tmpdir(), "toyon-machine-"));
+  try {
+    writeMachineContext(src, ctx);
+    writeFileSync3(join5(ctx, "fly.toml"), flyToml(cmd.name, region));
+    console.log("building the machine in your Fly builder and deploying it");
+    const deployArgs = ["deploy", ctx, "--config", join5(ctx, "fly.toml"), "--remote-only", "--ha=false", "--yes"];
+    if (!await show(bin, [...deployArgs, "--build-arg", `BUN_VERSION=${bunVersion}`])) {
+      throw new DeployError("the deploy failed; flyctl's output above says why");
+    }
+  } finally {
+    rmSync2(ctx, { recursive: true, force: true });
+  }
+  console.log("waiting for the machine to answer");
+  let up = false;
+  if (!await published(`${cmd.name}.fly.dev`))
+    console.log(`${cmd.name}.fly.dev is not in public DNS yet`);
+  for (let i = 0;i < 60 && !up; i++) {
+    up = await answers(`https://${cmd.name}.fly.dev/health`);
+    if (!up)
+      await Bun.sleep(2000);
+  }
+  if (!up)
+    console.log(`it has not answered yet; \`fly logs -a ${cmd.name}\` shows what it is doing`);
+  printLinks(cmd.name, token);
+  console.log("the volume holds the only copy of anything not pushed to a remote");
+  openUrl(launcherAddLink(`https://${cmd.name}.fly.dev`));
+}
+function printLinks(app, token) {
+  console.log(`
+toyon: https://${app}.fly.dev/#token=${token}`);
+  console.log("the link grants a shell on that machine; keep it to yourself");
+  console.log(`add it to your list at toyon.cloud: ${launcherAddLink(`https://${app}.fly.dev`)}`);
+}
+async function destroy(cmd, bin) {
+  if (!cmd.yes) {
+    if (!process.stdin.isTTY)
+      throw new DeployError("destroy deletes the app and its volume; pass --yes to confirm it");
+    process.stdout.write(`this deletes ${cmd.name} and its volume, the only copy of anything not pushed. Type its name to confirm: `);
+    let typed = "";
+    for await (const line of console) {
+      typed = line;
+      break;
+    }
+    if (typed.trim() !== cmd.name) {
+      console.log("nothing deleted");
+      return 0;
+    }
+  }
+  must(await capture(bin, ["apps", "destroy", cmd.name, "--yes"]), "could not delete the app");
+  rmSync2(tokenFile2(cmd.name), { force: true });
+  console.log(`deleted ${cmd.name}`);
+  return 0;
+}
+async function deploy(cmd) {
+  const bin = Bun.which("fly") ?? Bun.which("flyctl");
+  if (!bin) {
+    console.error("toyon: flyctl is not installed; https://fly.io/docs/flyctl/install/ has it");
+    return 1;
+  }
+  try {
+    if (cmd.action === "up")
+      await up(cmd, bin);
+    else if (cmd.action === "destroy")
+      return await destroy(cmd, bin);
+    else if (existsSync5(tokenFile2(cmd.name))) {
+      printLinks(cmd.name, readFileSync3(tokenFile2(cmd.name), "utf8").trim());
+    } else {
+      throw new DeployError(`${cmd.name} was not deployed from this machine; its token is not in ${cloudDir}`);
+    }
+    return 0;
+  } catch (e) {
+    if (!(e instanceof DeployError))
+      throw e;
+    console.error(`toyon: ${e.message}`);
+    return 1;
+  }
+}
+
+// src/doctor.ts
+import { existsSync as existsSync6, statSync } from "fs";
+
+// src/sandboxDeps.ts
+import { readFileSync as readFileSync4 } from "fs";
+var LINUX_SANDBOX_TOOLS = [
+  { exe: "bwrap", apt: "bubblewrap" },
+  { exe: "socat", apt: "socat" }
+];
+function missingSandboxTools(path = process.env.PATH ?? "", platform = process.platform) {
+  if (platform !== "linux")
+    return [];
+  return LINUX_SANDBOX_TOOLS.filter((t) => !Bun.which(t.exe, { PATH: path })).map((t) => t.exe);
+}
+function sandboxAdvice(missing) {
+  const apt = LINUX_SANDBOX_TOOLS.map((t) => t.apt).join(" ");
+  return `Claude Code's sandbox on Linux needs ${missing.join(" and ")}; install with: sudo apt install ${apt}`;
+}
+function bwrapStartError(bwrap = Bun.which("bwrap")) {
+  if (!bwrap)
+    return null;
+  try {
+    const r = Bun.spawnSync([bwrap, ...BWRAP_PROBE_ARGS], { stdout: "ignore", stderr: "pipe" });
+    return r.exitCode === 0 ? null : r.stderr.toString().trim() || `bwrap exited ${r.exitCode}`;
+  } catch (e) {
+    return e.message;
+  }
+}
+function userNamespacesRestricted(read = () => readFileSync4("/proc/sys/kernel/apparmor_restrict_unprivileged_userns", "utf8")) {
+  try {
+    return read().trim() === "1";
+  } catch {
+    return false;
+  }
+}
+
+// src/doctor.ts
+function line(ok, label, detail) {
+  return { ok, label, detail };
+}
+async function toolVersion(cmd, args) {
+  try {
+    const p = Bun.spawn([cmd, ...args], { stdout: "pipe", stderr: "pipe" });
+    const out = await new Response(p.stdout).text();
+    await p.exited;
+    return p.exitCode === 0 ? out.trim().split(`
+`)[0] : null;
+  } catch {
+    return null;
+  }
+}
+function handshake(token) {
+  return new Promise((resolve) => {
+    const ws = new WebSocket(`ws://127.0.0.1:${port}/ws?token=${token}`);
+    const timer = setTimeout(() => {
+      ws.close();
+      resolve("blocked");
+    }, 3000);
+    ws.onmessage = () => {
+      clearTimeout(timer);
+      ws.close();
+      resolve("ok");
+    };
+    ws.onclose = (ev) => {
+      clearTimeout(timer);
+      resolve(ev.code === WS_CLOSE_UNAUTHORIZED ? "unauthorized" : "blocked");
+    };
+  });
+}
+async function doctor() {
+  const lines = [];
+  lines.push(line(true, "cli", `toyon ${package_default.version}, bun ${Bun.version}, ${process.platform} ${process.arch}`));
+  lines.push(line(true, "home", home));
+  const git = await toolVersion("git", ["--version"]);
+  lines.push(git ? line(true, "git", git) : line(false, "git", "not found on PATH; Toyon needs git 2.x"));
+  if (process.platform === "linux") {
+    const missing = missingSandboxTools();
+    const blocked = missing.length === 0 ? bwrapStartError() : null;
+    lines.push(missing.length > 0 ? line(false, "sandbox", sandboxAdvice(missing)) : blocked ? line(false, "sandbox", bwrapBlockedAdvice(blocked, userNamespacesRestricted())) : line(true, "sandbox", "bubblewrap and socat found, and bubblewrap starts a sandbox"));
+  }
+  const h = await health();
+  if (!h) {
+    const pid = readPid();
+    const stale = pid !== null && !alive(pid);
+    lines.push(line(false, "daemon", stale ? `not running at ${base}; ${pid} in daemon.pid is dead, so it did not exit cleanly. \`toyon logs\` has its last words` : pid !== null ? `pid ${pid} is alive but nothing answers at ${base}; it may still be booting, or another program holds the port` : `not running at ${base}; \`toyon\` starts it`));
+  } else {
+    const version = h.version ?? "?";
+    lines.push(line(true, "daemon", `${version} at ${base}, pid ${h.pid ?? "?"}${h.branded ? ", also http://toyon.localhost" : ""}` + (h.lag ? `, event loop worst ${h.lag.max}ms${h.lag.maxCause ? ` (${h.lag.maxCause})` : ""}` : "")));
+    if (h.remote) {
+      lines.push(line(true, "remote", `https://${h.remote.host}/ through a TLS front on 127.0.0.1:${port}, previews at ${h.remote.previews}`));
+    }
+    if (h.worktrees) {
+      const { total, running } = h.worktrees;
+      lines.push(line(true, "running", `${running} of ${total} worktrees started; the rest start when opened`));
+    }
+    if (version !== package_default.version) {
+      lines.push(line(false, "version", `cli is ${package_default.version} and the daemon is ${version}; \`toyon stop\` then \`toyon\` restarts it`));
+    }
+  }
+  const token = readToken();
+  if (!token) {
+    lines.push(line(false, "token", `${tokenFile} is missing; the daemon writes it on first start`));
+  } else if (h) {
+    const r = await handshake(token);
+    lines.push(r === "ok" ? line(true, "websocket", "handshake accepted with the token on disk") : r === "unauthorized" ? line(false, "websocket", "the daemon refused the token on disk; it was started with another TOYON_HOME") : line(false, "websocket", "the daemon answers HTTP but the websocket never opened; a proxy or VPN in the way?"));
+  } else {
+    lines.push(line(true, "token", "present"));
+  }
+  if (h) {
+    try {
+      const r = await fetch(`${base}/`, { signal: AbortSignal.timeout(1000) });
+      const body = await r.text();
+      const built = r.ok && !body.startsWith("Toyon daemon running; shell not built");
+      lines.push(built ? line(true, "shell", "served") : line(false, "shell", "not built: run `bun run build` in the Toyon checkout"));
+    } catch (e) {
+      lines.push(line(false, "shell", `could not fetch: ${e.message}`));
+    }
+  }
+  if (existsSync6(logFile)) {
+    const kb = Math.round(statSync(logFile).size / 1024);
+    lines.push(line(true, "log", `${logFile} (${kb} KB)`));
+  }
+  const width = Math.max(...lines.map((l) => l.label.length));
+  for (const l of lines) {
+    console.log(`${l.ok ? "ok  " : "FAIL"} ${l.label.padEnd(width)}  ${l.detail}`);
+  }
+  return lines.every((l) => l.ok) ? 0 : 1;
+}
+
+// src/logs.ts
+import { existsSync as existsSync7, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
+async function logs(opts) {
+  if (!existsSync7(logFile)) {
+    console.log(`no log yet at ${logFile}; it appears once \`toyon\` has started the daemon`);
+    return opts.follow ? 0 : 1;
+  }
+  const text = readFileSync5(logFile, "utf8");
+  const all = text.split(`
+`);
+  if (all.at(-1) === "")
+    all.pop();
+  const tail = opts.lines === 0 ? [] : all.slice(-opts.lines);
+  if (tail.length > 0)
+    process.stdout.write(`${tail.join(`
+`)}
+`);
+  if (!opts.follow)
+    return 0;
+  let offset = statSync2(logFile).size;
+  for (;; ) {
+    await Bun.sleep(300);
+    if (!existsSync7(logFile))
+      continue;
+    const size = statSync2(logFile).size;
+    if (size < offset)
+      offset = 0;
+    if (size === offset)
+      continue;
+    const chunk = readFileSync5(logFile, { encoding: "utf8", flag: "r" }).slice(offset);
+    offset = size;
+    process.stdout.write(chunk);
+  }
+}
+
+// src/remote.ts
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync6, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
+
+// src/tailscale.ts
+class TailscaleError extends Error {
+}
+function tailscaleCli(bin = Bun.which("tailscale")) {
+  return async (args) => {
+    if (bin === null) {
+      throw new TailscaleError("Tailscale is not installed here (no tailscale on PATH); https://tailscale.com/download");
+    }
+    const p = Bun.spawn([bin, ...args], { stdin: "ignore", stdout: "pipe", stderr: "pipe" });
+    const [out, err] = await Promise.all([new Response(p.stdout).text(), new Response(p.stderr).text()]);
+    return { ok: await p.exited === 0, out, err };
+  };
+}
+function entries(daemonPort) {
+  const list = [{ port: 443, target: `http://127.0.0.1:${daemonPort}` }];
+  for (let p = PREVIEW_PORTS.from;p <= PREVIEW_PORTS.to; p++)
+    list.push({ port: p, target: `http://127.0.0.1:${p}` });
+  return list;
+}
+var serveOn = (e) => ["serve", "--bg", `--https=${e.port}`, e.target];
+var serveOff = (e) => ["serve", `--https=${e.port}`, "off"];
+var lastLine = (r) => (r.err.trim() || r.out.trim()).split(`
+`).at(-1) ?? "tailscale failed";
+var notRunning = (text) => /failed to connect|is Tailscale running/i.test(text);
+var NOT_RUNNING = "Tailscale is not running here; start the Tailscale app or the tailscaled service, then run `tailscale up`";
+function tailnetName(json) {
+  let st;
+  try {
+    st = JSON.parse(json);
+  } catch {
+    throw new TailscaleError(notRunning(json) ? NOT_RUNNING : "tailscale status --json printed nothing Toyon can read");
+  }
+  switch (st.BackendState) {
+    case "Running":
+      break;
+    case "NeedsLogin":
+      throw new TailscaleError("Tailscale is signed out; run `tailscale up`, then this again");
+    case "NeedsMachineAuth":
+      throw new TailscaleError("this machine is waiting to be approved in the Tailscale admin console");
+    case "Stopped":
+      throw new TailscaleError("Tailscale is disconnected; run `tailscale up`, then this again");
+    default:
+      throw new TailscaleError(`Tailscale is not connected yet (${st.BackendState ?? "no state"}); try again shortly`);
+  }
+  const name = (st.Self?.DNSName ?? "").replace(/\.$/, "").toLowerCase();
+  if (!name || st.CurrentTailnet?.MagicDNSEnabled === false) {
+    throw new TailscaleError("MagicDNS is off for this tailnet; turn it on under DNS in the Tailscale admin console");
+  }
+  if (!(st.CertDomains ?? []).some((d) => d.toLowerCase() === name)) {
+    throw new TailscaleError("HTTPS certificates are off for this tailnet; turn them on under DNS in the Tailscale admin console");
+  }
+  return name;
+}
+function parseServeConfig(json) {
+  const text = json.trim();
+  if (text === "" || text === "null")
+    return {};
+  try {
+    return JSON.parse(text) ?? {};
+  } catch {
+    throw new TailscaleError(notRunning(text) ? NOT_RUNNING : "tailscale serve status --json printed nothing Toyon can read");
+  }
+}
+var bare = (url) => url.replace(/\/+$/, "");
+function holder(config, name, e) {
+  const tcp = config.TCP?.[String(e.port)];
+  if (!tcp)
+    return { kind: "free" };
+  if (tcp.TCPForward)
+    return { kind: "other", what: `TCP forwarding to ${tcp.TCPForward}` };
+  const webs = Object.entries(config.Web ?? {}).filter(([hp]) => name === null ? hp.endsWith(`:${e.port}`) : hp === `${name}:${e.port}`);
+  const handlers = webs.flatMap(([, w]) => Object.entries(w?.Handlers ?? {}));
+  if (handlers.length === 0)
+    return { kind: "other", what: "a serve entry on another name" };
+  const [mount, h] = handlers[0];
+  if (handlers.length === 1 && mount === "/" && h?.Proxy && bare(h.Proxy) === e.target)
+    return { kind: "toyon" };
+  return { kind: "other", what: h?.Proxy ? `a proxy to ${h.Proxy}` : "files or text" };
+}
+async function readConfig(ts) {
+  const r = await ts(["serve", "status", "--json"]);
+  if (!r.ok)
+    throw new TailscaleError(notRunning(r.err + r.out) ? NOT_RUNNING : `tailscale serve status: ${lastLine(r)}`);
+  return parseServeConfig(r.out);
+}
+async function serveTailnet(ts, daemonPort) {
+  const st = await ts(["status", "--json"]);
+  if (!st.ok && notRunning(st.err + st.out))
+    throw new TailscaleError(NOT_RUNNING);
+  const name = tailnetName(st.out || st.err);
+  const config = await readConfig(ts);
+  const want = entries(daemonPort).map((e) => ({ e, h: holder(config, name, e) }));
+  const taken = want.flatMap(({ e, h }) => h.kind === "other" ? [`https ${e.port} (${h.what})`] : []);
+  if (taken.length > 0) {
+    throw new TailscaleError(`tailscale serve already uses ${taken.join(", ")}; Toyon changed nothing. Free those with \`tailscale serve --https=<port> off\`, or use \`toyon remote ${name} --ports\` with a front of your own`);
+  }
+  for (const { e, h } of want) {
+    if (h.kind === "toyon")
+      continue;
+    const r = await ts(serveOn(e));
+    if (!r.ok) {
+      throw new TailscaleError(`tailscale serve --https=${e.port}: ${lastLine(r)}. \`toyon remote off\` removes the entries set so far`);
+    }
+  }
+  return name;
+}
+async function unserveTailnet(ts, daemonPort) {
+  const config = await readConfig(ts);
+  let removed = 0;
+  for (const e of entries(daemonPort)) {
+    if (holder(config, null, e).kind !== "toyon")
+      continue;
+    const r = await ts(serveOff(e));
+    if (!r.ok)
+      throw new TailscaleError(`tailscale serve --https=${e.port} off: ${lastLine(r)}`);
+    removed++;
+  }
+  return removed;
+}
+
+// src/remote.ts
+function saved() {
+  if (!existsSync8(remoteFile))
+    return null;
+  return parseRemote(readFileSync6(remoteFile, "utf8"));
+}
+var same = (a, b) => (a?.host ?? null) === (b?.host ?? null) && (a?.previews ?? null) === (b?.previews ?? null);
+var ports = `${PREVIEW_PORTS.from}-${PREVIEW_PORTS.to}`;
+function describe(r) {
+  const at = addressedByPort(r.previews) ? `${r.previews}, ports ${ports}` : r.previews;
+  return `remote access: https://${r.host}/, previews at ${at}`;
+}
+function save(r) {
+  mkdirSync5(home, { recursive: true });
+  writeFileSync4(remoteFile, `${JSON.stringify(r, null, 2)}
+`);
+  console.log(describe(r));
+}
+async function remote(cmd) {
+  const h = await health();
+  if (cmd.to === null && !cmd.tailscale) {
+    const r = saved();
+    console.log(r ? describe(r) : "remote access is off; `toyon remote <name>` turns it on");
+    if (h && !same(h.remote, r))
+      console.log("the running daemon started before this; `toyon stop` then `toyon` applies it");
+    return 0;
+  }
+  let r = null;
+  if (cmd.tailscale) {
+    let name;
+    try {
+      name = await serveTailnet(tailscaleCli(), port);
+    } catch (e) {
+      if (!(e instanceof TailscaleError))
+        throw e;
+      console.error(`toyon: ${e.message}`);
+      return 1;
+    }
+    r = { host: name, previews: portPreviews(name) };
+    save(r);
+    console.log(`tailscale serve sends https://${name}/ to 127.0.0.1:${port}, and each of ports ${ports} to the`);
+    console.log("same port on 127.0.0.1; only devices on your tailnet reach them");
+  } else if (cmd.to === "off") {
+    const was = saved();
+    rmSync3(remoteFile, { force: true });
+    console.log("remote access is off");
+    try {
+      const removed = await unserveTailnet(tailscaleCli(), port);
+      if (removed > 0)
+        console.log(`removed Toyon's ${removed} tailscale serve entries`);
+    } catch (e) {
+      if (!(e instanceof TailscaleError))
+        throw e;
+      if (was?.host.endsWith(".ts.net"))
+        console.error(`toyon: could not remove tailscale serve entries: ${e.message}`);
+    }
+  } else if (cmd.to !== null) {
+    r = { host: cmd.to, previews: cmd.ports ? portPreviews(cmd.to) : hostPreviews(cmd.to) };
+    save(r);
+    if (addressedByPort(r.previews)) {
+      console.log(`point a TLS front for ${r.host} at 127.0.0.1:${port} on 443, and each of ports ${ports} at`);
+      console.log("the same port on 127.0.0.1");
+    } else {
+      console.log(`point a TLS front for ${r.host} and *.${r.host} at 127.0.0.1:${port}. With Caddy:
+`);
+      console.log(`  ${r.host}, *.${r.host} {
+    reverse_proxy 127.0.0.1:${port}
+  }
+`);
+      console.log("the wildcard certificate needs Caddy's DNS challenge, through your DNS provider's module");
+    }
+    console.log("Toyon refuses the name over plain http: the token in the link grants a shell on this machine");
+  }
+  if (r) {
+    const add = launcherAddLink(`https://${r.host}`);
+    console.log(`add it to your list at toyon.cloud: ${add}`);
+    openUrl(add);
+  }
+  if (h && !same(h.remote, r))
+    console.log("the daemon reads this at start; `toyon stop` then `toyon` applies it");
+  return 0;
+}
+
+// src/stop.ts
+import { rmSync as rmSync4 } from "fs";
+var WAIT_MS = 1e4;
+async function stop() {
+  const h = await health();
+  let pid = h?.pid ?? readPid();
+  if (pid !== null && !alive(pid)) {
+    rmSync4(pidFile, { force: true });
+    pid = null;
+  }
+  if (pid === null) {
+    console.log("Toyon is not running");
+    return 0;
+  }
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch (e) {
+    console.error(`could not signal pid ${pid}: ${e.message}`);
+    return 1;
+  }
+  const deadline = Date.now() + WAIT_MS;
+  while (alive(pid) && Date.now() < deadline)
+    await Bun.sleep(100);
+  if (alive(pid)) {
+    process.kill(pid, "SIGKILL");
+    console.error(`daemon (pid ${pid}) did not exit in ${WAIT_MS / 1000}s; killed. Dev servers it ran may still be up.`);
+    rmSync4(pidFile, { force: true });
+    return 1;
+  }
+  console.log(`stopped Toyon (pid ${pid})`);
+  return 0;
+}
+
+// src/restart.ts
+async function restart() {
+  const before = await health();
+  if (before) {
+    const code = await stop();
+    if (code !== 0)
+      return code;
+  } else {
+    console.log("Toyon was not running");
+  }
+  if (!await startDaemon()) {
+    console.error(`daemon failed to start; \`toyon logs\` shows why (${logFile})`);
+    return 1;
+  }
+  const after = await health();
+  console.log(`started Toyon${after?.pid !== undefined ? ` (pid ${after.pid})` : ""}`);
+  return 0;
+}
+
+// src/uninstall.ts
+import { existsSync as existsSync9, readFileSync as readFileSync7, rmSync as rmSync5 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join6 } from "path";
+function readState() {
+  const file = join6(home, DAEMON_FILES.state);
+  if (!existsSync9(file))
+    return {};
+  try {
+    return JSON.parse(readFileSync7(file, "utf8"));
+  } catch {
+    return {};
+  }
+}
+async function git(cwd, ...args) {
+  try {
+    const p = Bun.spawn(["git", ...args], { cwd, stdout: "ignore", stderr: "pipe" });
+    await p.exited;
+    return p.exitCode === 0;
+  } catch {
+    return false;
+  }
+}
+function confirm(question) {
+  process.stdout.write(`${question} [y/N] `);
+  return new Promise((resolve) => {
+    process.stdin.once("data", (chunk) => resolve(String(chunk).trim().toLowerCase().startsWith("y")));
+    process.stdin.once("end", () => resolve(false));
+  });
+}
+async function uninstall(opts) {
+  const state = readState();
+  const repos = state.repos ?? [];
+  const worktrees = (state.worktrees ?? []).filter((w) => w.kind !== "main");
+  const app = join6(homedir3(), "Applications", "Toyon.app");
+  const branches = worktrees.map((w) => w.branch).filter((b) => !!b && b.startsWith("toyon/"));
+  console.log("toyon uninstall removes:");
+  console.log(`  ${home}  (state, transcripts, agent adapters, ${worktrees.length} worktree director${worktrees.length === 1 ? "y" : "ies"})`);
+  for (const w of worktrees) {
+    const repo = repos.find((r) => r.id === w.repoId);
+    console.log(`    ${w.path}  (worktree of ${repo?.path ?? "?"})`);
+  }
+  if (existsSync9(app))
+    console.log(`  ${app}`);
+  console.log("and stops the daemon if it is running.");
+  console.log("it keeps: your repos, every branch Toyon made" + (branches.length ? ` (${branches.length} under toyon/)` : "") + ", and Toyon's settings in each repo (.toyon/ or toyon.json).");
+  if (!opts.yes && !await confirm("continue?")) {
+    console.log("nothing removed");
+    return 1;
+  }
+  if (await health() || readPid() !== null && alive(readPid()))
+    await stop();
+  for (const w of worktrees) {
+    const repo = repos.find((r) => r.id === w.repoId);
+    if (repo && existsSync9(repo.path)) {
+      const ok = await git(repo.path, "worktree", "remove", "--force", w.path);
+      if (!ok && existsSync9(w.path))
+        rmSync5(w.path, { recursive: true, force: true });
+      await git(repo.path, "worktree", "prune");
+    } else if (existsSync9(w.path)) {
+      rmSync5(w.path, { recursive: true, force: true });
+    }
+  }
+  rmSync5(home, { recursive: true, force: true });
+  if (existsSync9(app))
+    rmSync5(app, { recursive: true, force: true });
+  console.log("removed. `npm uninstall -g toyon` removes the command itself.");
+  return 0;
+}
+
+// src/cli.ts
+async function open(cmd) {
+  const explicit = cmd.path !== null;
+  const target = resolve(cmd.path ?? process.cwd());
+  const register = explicit || existsSync10(join7(target, ".git"));
+  if (process.platform === "linux") {
+    const missing = missingSandboxTools();
+    const blocked = missing.length === 0 ? bwrapStartError() : null;
+    if (missing.length > 0)
+      console.log(sandboxAdvice(missing));
+    else if (blocked)
+      console.log(bwrapBlockedAdvice(blocked, userNamespacesRestricted()));
+  }
+  if (!await health()) {
+    console.log("starting Toyon daemon\u2026");
+    if (!await startDaemon()) {
+      console.error(`daemon failed to start; \`toyon logs\` shows why (${logFile})`);
+      return 1;
+    }
+  }
+  const token = readToken();
+  if (!token) {
+    console.error("daemon token missing; `toyon doctor` says where it looked");
+    return 1;
+  }
+  if (register) {
+    const res = await fetch(`${base}/register`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+      body: JSON.stringify({ path: target })
+    });
+    if (!res.ok) {
+      console.error(`could not open ${target}: ${await res.text()}`);
+      if (explicit || !cmd.app && !cmd.installApp)
+        return 1;
+    }
+  }
+  const branded = (await health())?.branded === true;
+  const url = shellUrl(token, branded);
+  const appUrl = `http://toyon.localhost:${port}/#token=${token}`;
+  if (cmd.installApp) {
+    installApp(appUrl);
+  } else if (cmd.app) {
+    console.log(`toyon: app window (${appUrl.split("#")[0]})`);
+    if (!openAppWindow(appUrl)) {
+      console.log("no Chromium browser found; opening in default browser");
+      openUrl(url);
+    }
+  } else {
+    console.log(`toyon: ${url}`);
+    openUrl(url);
+  }
+  const remote = (await health())?.remote;
+  if (remote)
+    console.log(`toyon: remote at https://${remote.host}/#token=${token}`);
+  return 0;
+}
+async function run(cmd) {
+  switch (cmd.kind) {
+    case "help":
+      process.stdout.write(HELP);
+      return 0;
+    case "error":
+      console.error(`toyon: ${cmd.message}
+`);
+      process.stderr.write(HELP);
+      return 2;
+    case "version": {
+      const h = await health();
+      console.log(h ? `toyon ${package_default.version} (daemon ${h.version ?? "?"} running)` : `toyon ${package_default.version}`);
+      return 0;
+    }
+    case "stop":
+      return stop();
+    case "restart":
+      return restart();
+    case "doctor":
+      return doctor();
+    case "logs":
+      return logs(cmd);
+    case "uninstall":
+      return uninstall(cmd);
+    case "remote":
+      return remote(cmd);
+    case "deploy":
+      return deploy(cmd);
+    case "open":
+      return open(cmd);
+  }
+}
+process.exitCode = await run(parseArgs(process.argv.slice(2)));