This is the playit.gg tunnel agent, a production-grade client-side daemon that exposes local servers (e.g., Minecraft, game servers, web services) to the internet through the playit.gg tunnel network. The system is organized as a Rust multi-package workspace comprising five main crates: `agent_core` (tunnel state machine, TCP/UDP proxying, control connection), `playitd` (background daemon with IPC server, stats, log rotation), `playit-cli` (CLI and TUI frontend using ratatui), `playit-ipc` (local IPC protocol with version negotiation), and `playitd-tray` (Windows system tray controller). It supports Linux, Windows, macOS, and FreeBSD, with platform-specific path handling (Unix sockets, named pipes, Windows service management). The architecture centers on a UDP control connection to playit.gg servers: the agent authenticates via HMAC-SHA256, receives tunnel assignments, then proxies TCP and UDP traffic between tunnel ingress points and local origin servers. The daemon runs as a background service (systemd, OpenRC, Windows service) and exposes a local IPC endpoint for the CLI/TUI to monitor logs, stats, and lifecycle status. Key entry points include `packages/playitd/src/bin/playitd.rs` (daemon binary), `packages/playitd/src/bin/playitd-service.rs` (Windows service host), `packages/playit-cli/src/main.rs` (CLI with attach/start/stop/claim commands), and `packages/playitd-tray/src/main.rs` (Windows tray application). External dependencies include tokio (async runtime), ratatui (TUI), crossterm (terminal), serde (serialization), reqwest (REST client), and ring (HMAC). The codebase demonstrates strong craftsmanship in low-level networking (zero-copy UDP packet pools, PROXY protocol, statically-sized control messages) and state machine design (connection recovery, MTU probing, address selection). However, it suffers from some production debt: panics in critical paths (UDP channel shutdown, flow invariants), duplicated code between `playitd-tray` and `playitd-windows-setup` startup shortcuts, and hardcoded configuration values (control port, protocol version). The build and release infrastructure is extensive (nfpm, WiX, Docker, Arch PKGBUILD, code signing) but shows signs of fragility (stale binary name in mac-deploy.sh, sed-based version overrides).