Update go.mod and go.sum (#38 )

Update go.mod and go.sum (#37 )
Update go.mod and go.sum (#36 )
2026-06-05 23:03:40 +00:00 · 2026-02-04 03:53:00 +00:00 · 2026-02-02 03:57:42 +00:00 · 2026-01-28 03:40:33 +00:00 · 2026-01-26 03:45:09 +00:00 · 2026-01-25 03:43:03 +00:00
74 changed files with 10694 additions and 1302 deletions
@@ -5,69 +5,16 @@ on:
  schedule:
    - cron: "0 3 * * *"

-env:
-  GO_VERSION: ">=1.21"
+permissions:
+  contents: write
+  actions: write
+  pull-requests: write
+  security-events: write

 jobs:
-  # This job is responsible for preparation of the build
-  # environment variables.
-  prepare:
-    name: Preparing build context
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v4
-
-      - name: Install Go
-        uses: actions/setup-go@v5
-        id: cache
-        with:
-          go-version: ${{env.GO_VERSION}}
-          cache-dependency-path: "**/*.sum"
-
-      - name: Go get dependencies
-        if: steps.cache.outputs.cache-hit != 'true'
-        run: |
-          go get ./...
-
-  # This job is responsible for running tests and linting the codebase
-  test:
-    name: "Unit testing"
-    runs-on: ubuntu-latest
-    container: golang:1
-    needs: [prepare]
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0 # Ensure full history is checked out
-          token: ${{ secrets.GHCR_TOKEN }}
-
-      - name: Install Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: ${{env.GO_VERSION}}
-          cache-dependency-path: "**/*.sum"
-
-      - name: Install dependencies
-        run: |
-          apt-get update
-          apt-get install ca-certificates make -y
-          update-ca-certificates
-          go mod tidy
-          go get -u -v ./...
-          go mod tidy -v
-
-      - name: Run unit tests
-        run: |
-          CI_RUN=${CI} make test
-          git config --global --add safe.directory /__w/kportal/kportal
-
-      - name: Commit changes
-        uses: stefanzweifel/git-auto-commit-action@v5
-        with:
-          commit_message: "Update go.mod and go.sum"
-          commit_options: "--no-verify --signoff"
-          file_pattern: "go.mod go.sum"
+  autoupdate:
+    uses: lukaszraczylo/shared-actions/.github/workflows/go-autoupdate.yaml@main
+    with:
+      go-version: ">=1.24"
+      release-workflow: "release.yml"
+    secrets: inherit
@@ -0,0 +1,22 @@
+name: Pull Request
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - "**"
+      - "!main"
+
+permissions:
+  contents: write
+  actions: write
+  pull-requests: write
+  security-events: write
+
+jobs:
+  pr-checks:
+    uses: lukaszraczylo/shared-actions/.github/workflows/go-pr.yaml@main
+    with:
+      go-version: ">=1.24"
@@ -5,90 +5,19 @@ on:
    branches:
      - main
    paths:
-      - '**.go'
-      - 'go.mod'
-      - 'go.sum'
+      - "**.go"
+      - "go.mod"
+      - "go.sum"
  workflow_dispatch:

 permissions:
  contents: write
+  packages: write
+  id-token: write

 jobs:
-  test:
-    name: Test
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.23'
-
-      - name: Run tests with race detector
-        run: go test -race -v ./...
-
-  version:
-    name: Calculate Version
-    needs: test
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.version_formatted.outputs.version }}
-      version_tag: ${{ steps.version_formatted.outputs.version_tag }}
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Calculate semantic version
-        id: semver
-        uses: lukaszraczylo/semver-generator@v1
-        with:
-          config_file: semver.yaml
-          repository_local: true
-
-      - name: Format version
-        id: version_formatted
-        run: |
-          VERSION="${{ steps.semver.outputs.semantic_version }}"
-          echo "version=${VERSION}" >> $GITHUB_OUTPUT
-          echo "version_tag=v${VERSION}" >> $GITHUB_OUTPUT
-
-      - name: Display version
-        run: |
-          echo "Calculated version: ${{ steps.version_formatted.outputs.version }}"
-          echo "Version tag: ${{ steps.version_formatted.outputs.version_tag }}"
-
  release:
-    name: Release with GoReleaser
-    needs: version
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.23'
-
-      - name: Create and push tag
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git tag -a ${{ needs.version.outputs.version_tag }} -m "Release ${{ needs.version.outputs.version_tag }}"
-          git push origin ${{ needs.version.outputs.version_tag }}
-
-      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v6
-        with:
-          distribution: goreleaser
-          version: '~> v2'
-          args: release --clean
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+    uses: lukaszraczylo/shared-actions/.github/workflows/go-release.yaml@main
+    with:
+      go-version: ">=1.24"
+    secrets: inherit
@@ -6,7 +6,7 @@ on:
  push:
    branches: ["main"]
    paths:
-      - 'docs/**'
+      - "docs/**"

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:
@@ -39,7 +39,7 @@ jobs:
        uses: actions/upload-pages-artifact@v3
        with:
          # Upload entire repository
-          path: 'docs/'
+          path: "docs/"
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v4
@@ -0,0 +1,29 @@
+# golangci-lint configuration
+# https://golangci-lint.run/usage/configuration/
+
+run:
+  timeout: 5m
+  tests: true
+
+linters:
+  enable:
+    - errcheck
+    - gosimple
+    - govet
+    - ineffassign
+    - staticcheck
+    - unused
+    - gosec
+    - gocritic
+    - gofmt
+
+linters-settings:
+  govet:
+    enable:
+      - fieldalignment
+  gosec:
+    excludes:
+      - G304 # File path provided as taint input - handled with #nosec comments where needed
+  gocritic:
+    disabled-checks:
+      - ifElseChain # Complex conditionals are clearer as if-else than switch true
@@ -23,11 +23,11 @@ builds:

 archives:
  - id: kportal
-    format: tar.gz
+    formats: [tar.gz]
    name_template: "kportal-{{ .Version }}-{{ .Os }}-{{ .Arch }}"
    format_overrides:
      - goos: windows
-        format: zip
+        formats: [zip]
    files:
      - LICENSE
      - README.md
@@ -53,17 +53,32 @@ release:
  draft: false
  prerelease: auto

-brews:
+homebrew_casks:
  - repository:
      owner: lukaszraczylo
-      name: brew-taps
+      name: homebrew-taps
      token: "{{ .Env.HOMEBREW_TAP_TOKEN }}"
-    directory: Formula
+    directory: Casks
    homepage: https://lukaszraczylo.github.io/kportal
    description: "Modern Kubernetes port-forward manager with interactive TUI"
    license: MIT
-    test: |
-      system "#{bin}/kportal", "--version"
-    dependencies:
-      - name: kubernetes-cli
-        type: optional
+    url:
+      verified: github.com/lukaszraczylo/kportal
+    hooks:
+      post:
+        install: |
+          if OS.mac?
+            system_command "/usr/bin/xattr",
+                           args: ["-dr", "com.apple.quarantine", "#{staged_path}/kportal"]
+          end
+
+signs:
+  - cmd: cosign
+    signature: "${artifact}.sigstore.json"
+    args:
+      - sign-blob
+      - "--bundle=${signature}"
+      - "${artifact}"
+      - "--yes"
+    artifacts: checksum
+    output: true
@@ -32,14 +32,39 @@ kportal manages multiple Kubernetes port-forwards with an interactive terminal i
 - **Connection benchmarking** - Built-in HTTP benchmarking with latency statistics
 - **Headless mode** - Background operation for scripting and automation

+## 🔄 Comparison with Other Tools
+
+| Feature | kportal | [k9s](https://k9scli.io/) | [Kube Forwarder](https://kube-forwarder.pixelpoint.io/) | [kftray](https://kftray.app/) |
+|---------|---------|------|----------------|--------|
+| **Interface** | Terminal TUI | Terminal TUI | Desktop GUI (Electron) | Desktop GUI + TUI |
+| **Persistent Config** | ✅ YAML file | ❌ Session only | ✅ JSON bookmarks | ✅ JSON + Git sync |
+| **Auto-reconnect** | ✅ Exponential backoff | ❌ Manual | ✅ Basic | ✅ Watch API |
+| **Hot-reload Config** | ✅ File watch + SIGHUP | ❌ | ❌ | ❌ |
+| **Health Checks** | ✅ TCP + data-transfer | ❌ | ❌ | ❌ |
+| **Stale Connection Detection** | ✅ Age + idle tracking | ❌ | ❌ | ❌ |
+| **HTTP Traffic Logging** | ✅ Built-in viewer | ❌ | ❌ | ✅ |
+| **Connection Benchmarking** | ✅ Built-in | ✅ Via Hey | ❌ | ❌ |
+| **mDNS Hostnames** | ✅ `.local` domains | ❌ | ❌ | ❌ |
+| **Label Selectors** | ✅ | ✅ | ❌ | ✅ |
+| **Multi-context** | ✅ | ✅ | ✅ | ✅ |
+| **Headless Mode** | ✅ | ❌ | ❌ | ❌ |
+| **System Tray** | ❌ | ❌ | ❌ | ✅ |
+| **UDP Support** | ❌ | ❌ | ❌ | ✅ Proxy relay |
+| **Dependencies** | Single binary | Single binary | Electron | Tauri + kubectl |
+
 ## 📦 Installation

-### Homebrew (macOS/Linux)
+### Homebrew (macOS)

 ```bash
-brew install lukaszraczylo/brew-taps/kportal
+brew install --cask lukaszraczylo/taps/kportal
 ```

+> **Note**: If you previously installed via `brew install lukaszraczylo/taps/kportal` (formula), uninstall first:
+> ```bash
+> brew uninstall kportal
+> ```
+
 ### Quick Install

 ```bash
@@ -58,6 +83,19 @@ cd kportal
 make build && make install
 ```

+### Verifying Release Signatures
+
+All release checksums are signed with [cosign](https://github.com/sigstore/cosign) using keyless signing. To verify:
+
+```bash
+# Download the checksum file and its sigstore bundle from the release
+cosign verify-blob \
+  --certificate-identity-regexp "https://github.com/lukaszraczylo/kportal/.*" \
+  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+  --bundle "kportal-<version>-checksums.txt.sigstore.json" \
+  kportal-<version>-checksums.txt
+```
+
 ## 🚀 Quick Start

 Create `.kportal.yaml`:
@@ -257,11 +295,12 @@ Press `l` in the TUI to view real-time HTTP traffic for a selected forward. The
 | LATENCY | Request duration |
 | PATH | Request path |

-**Keyboard shortcuts:**
+**List view shortcuts:**

 | Key | Action |
 |-----|--------|
 | `↑/↓` | Navigate entries |
+| `Enter` | View request details |
 | `g/G` | Jump to top/bottom |
 | `a` | Toggle auto-scroll |
 | `f` | Cycle filter mode (All → Non-2xx → Errors) |
@@ -269,6 +308,26 @@ Press `l` in the TUI to view real-time HTTP traffic for a selected forward. The
 | `c` | Clear all filters |
 | `q` | Close log viewer |

+**Detail view:**
+
+Press `Enter` on any entry to see full request/response details including:
+- Request and response headers (alphabetically sorted)
+- Request and response bodies
+- Timing information and status codes
+
+| Key | Action |
+|-----|--------|
+| `↑/↓` | Scroll content |
+| `PgUp/PgDn` | Scroll by page |
+| `g` | Jump to top |
+| `c` | Copy response body to clipboard |
+| `Esc/q` | Return to list |
+
+**Body display features:**
+- **JSON formatting** - JSON bodies are pretty-printed with syntax highlighting
+- **Compression handling** - gzip/deflate content is automatically decompressed
+- **Binary detection** - Binary content shows a placeholder instead of garbled data
+
 **Filter modes:**
 - **All** - Show all entries
 - **Non-2xx** - Hide successful (2xx) responses
@@ -1,6 +1,7 @@
 package main

 import (
+	"bufio"
 	"context"
 	"flag"
 	"fmt"
@@ -49,6 +50,23 @@ var (
 	appVersion    = "0.1.0" // Set via ldflags during build
 )

+// promptCreateConfig asks the user if they want to create a new config file.
+// Returns true if the user answers yes, false otherwise.
+func promptCreateConfig(path string) bool {
+	fmt.Printf("Configuration file not found: %s\n", path)
+	fmt.Print("Would you like to create an empty configuration? [Y/n] ")
+
+	reader := bufio.NewReader(os.Stdin)
+	response, err := reader.ReadString('\n')
+	if err != nil {
+		return false
+	}
+
+	response = strings.TrimSpace(strings.ToLower(response))
+	// Empty response (just Enter) defaults to yes
+	return response == "" || response == "y" || response == "yes"
+}
+
 func main() {
 	flag.Parse()

@@ -173,14 +191,38 @@ func main() {

 	// Load configuration
 	cfg, err := config.LoadConfig(*configFile)
+	configIsNew := false
 	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error loading config: %v\n", err)
-		os.Exit(1)
+		if err == config.ErrConfigNotFound {
+			// Config file doesn't exist - offer to create it
+			if !promptCreateConfig(*configFile) {
+				os.Exit(0)
+			}
+			// Create empty config file
+			if createErr := config.CreateEmptyConfigFile(*configFile); createErr != nil {
+				fmt.Fprintf(os.Stderr, "Error creating config file: %v\n", createErr)
+				os.Exit(1)
+			}
+			fmt.Printf("Created %s\n", *configFile)
+			fmt.Println("Use 'n' in the UI to add port forwards, or edit the file manually.")
+			fmt.Println()
+
+			// Load the newly created config
+			cfg, err = config.LoadConfig(*configFile)
+			if err != nil {
+				fmt.Fprintf(os.Stderr, "Error loading config: %v\n", err)
+				os.Exit(1)
+			}
+			configIsNew = true
+		} else {
+			fmt.Fprintf(os.Stderr, "Error loading config: %v\n", err)
+			os.Exit(1)
+		}
 	}

-	// Validate configuration
+	// Validate configuration (allow empty configs for newly created files)
 	validator := config.NewValidator()
-	if errs := validator.ValidateConfig(cfg); len(errs) > 0 {
+	if errs := validator.ValidateConfigWithOptions(cfg, configIsNew || cfg.IsEmpty()); len(errs) > 0 {
 		fmt.Fprint(os.Stderr, config.FormatValidationErrors(errs))
 		os.Exit(1)
 	}
@@ -253,9 +295,9 @@ func main() {
 		// Interactive mode with bubbletea
 		bubbleTeaUI = ui.NewBubbleTeaUI(func(id string, enable bool) {
 			if enable {
-				manager.EnableForward(id)
+				_ = manager.EnableForward(id)
 			} else {
-				manager.DisableForward(id)
+				_ = manager.DisableForward(id)
 			}
 		}, appVersion)

@@ -267,22 +309,33 @@ func main() {
 		bubbleTeaUI.SetHTTPLogSubscriber(func(forwardID string, callback func(entry ui.HTTPLogEntry)) func() {
 			worker := manager.GetWorker(forwardID)
 			if worker == nil {
+				logger.Debug("HTTP log subscription failed: worker not found", map[string]any{
+					"forward_id": forwardID,
+				})
 				return func() {} // No-op cleanup
 			}

 			proxy := worker.GetHTTPProxy()
 			if proxy == nil {
+				// This is expected for forwards without httpLog enabled - not an error
+				logger.Debug("HTTP log subscription skipped: proxy not enabled", map[string]any{
+					"forward_id": forwardID,
+				})
 				return func() {} // HTTP logging not enabled for this forward
 			}

 			proxyLogger := proxy.GetLogger()
 			if proxyLogger == nil {
+				logger.Debug("HTTP log subscription failed: logger not available", map[string]any{
+					"forward_id": forwardID,
+				})
 				return func() {}
 			}

 			// Subscribe to log entries
 			proxyLogger.AddCallback(func(entry httplog.Entry) {
-				callback(ui.HTTPLogEntry{
+				uiEntry := ui.HTTPLogEntry{
+					RequestID:  entry.RequestID,
 					Timestamp:  entry.Timestamp.Format("15:04:05"),
 					Direction:  entry.Direction,
 					Method:     entry.Method,
@@ -290,7 +343,19 @@ func main() {
 					StatusCode: entry.StatusCode,
 					LatencyMs:  entry.LatencyMs,
 					BodySize:   entry.BodySize,
-				})
+					Error:      entry.Error,
+				}
+
+				// Populate headers based on direction
+				if entry.Direction == "request" {
+					uiEntry.RequestHeaders = entry.Headers
+					uiEntry.RequestBody = entry.Body
+				} else if entry.Direction == "response" {
+					uiEntry.ResponseHeaders = entry.Headers
+					uiEntry.ResponseBody = entry.Body
+				}
+
+				callback(uiEntry)
 			})

 			// Return cleanup function
@@ -314,8 +379,8 @@ func main() {
 	}

 	// Start forwards
-	if err := manager.Start(cfg); err != nil {
-		fmt.Fprintf(os.Stderr, "Error starting forwards: %v\n", err)
+	if startErr := manager.Start(cfg); startErr != nil {
+		fmt.Fprintf(os.Stderr, "Error starting forwards: %v\n", startErr)
 		os.Exit(1)
 	}

@@ -326,17 +391,18 @@ func main() {
 		signal.Notify(sigChan, os.Interrupt, syscall.SIGTERM, syscall.SIGHUP)

 		// Setup config watcher for hot-reload
-		watcher, err := config.NewWatcher(*configFile, func(newCfg *config.Config) error {
+		watcher, watcherErr := config.NewWatcher(*configFile, func(newCfg *config.Config) error {
 			return manager.Reload(newCfg)
 		}, *verbose)
-		if err != nil {
+		watcherStarted := false
+		if watcherErr != nil {
 			if *verbose {
-				log.Printf("Warning: Failed to setup config watcher: %v", err)
+				log.Printf("Warning: Failed to setup config watcher: %v", watcherErr)
 				log.Printf("Hot-reload will not be available")
 			}
 		} else {
 			watcher.Start()
-			defer watcher.Stop()
+			watcherStarted = true
 		}

 		if *verbose {
@@ -351,10 +417,10 @@ func main() {
 				if *verbose {
 					log.Printf("Received SIGHUP, reloading configuration...")
 				}
-				newCfg, err := config.LoadConfig(*configFile)
-				if err != nil {
+				newCfg, loadErr := config.LoadConfig(*configFile)
+				if loadErr != nil {
 					if *verbose {
-						log.Printf("Failed to reload config: %v", err)
+						log.Printf("Failed to reload config: %v", loadErr)
 					}
 					continue
 				}
@@ -367,9 +433,9 @@ func main() {
 					continue
 				}

-				if err := manager.Reload(newCfg); err != nil {
+				if reloadErr := manager.Reload(newCfg); reloadErr != nil {
 					if *verbose {
-						log.Printf("Failed to reload: %v", err)
+						log.Printf("Failed to reload: %v", reloadErr)
 					}
 				}

@@ -399,6 +465,10 @@ func main() {
 						log.Printf("Received second signal (%v), forcing exit...", sig)
 					}
 				}
+				// Stop the watcher before exiting (defers won't run after os.Exit)
+				if watcherStarted {
+					watcher.Stop()
+				}
 				os.Exit(0)
 			}
 		}
@@ -420,15 +490,16 @@ func main() {
 		}()

 		// Setup config watcher for hot-reload
-		watcher, err := config.NewWatcher(*configFile, func(newCfg *config.Config) error {
+		watcher, watchErr := config.NewWatcher(*configFile, func(newCfg *config.Config) error {
 			return manager.Reload(newCfg)
 		}, *verbose)
-		if err != nil {
-			log.Printf("Warning: Failed to setup config watcher: %v", err)
+		watcherActive := false
+		if watchErr != nil {
+			log.Printf("Warning: Failed to setup config watcher: %v", watchErr)
 			log.Printf("Hot-reload will not be available")
 		} else {
 			watcher.Start()
-			defer watcher.Stop()
+			watcherActive = true
 		}

 		log.Printf("Press Ctrl+C to stop")
@@ -439,9 +510,9 @@ func main() {
 			switch sig {
 			case syscall.SIGHUP:
 				log.Printf("Received SIGHUP, reloading configuration...")
-				newCfg, err := config.LoadConfig(*configFile)
-				if err != nil {
-					log.Printf("Failed to reload config: %v", err)
+				newCfg, loadErr := config.LoadConfig(*configFile)
+				if loadErr != nil {
+					log.Printf("Failed to reload config: %v", loadErr)
 					continue
 				}

@@ -451,8 +522,8 @@ func main() {
 					continue
 				}

-				if err := manager.Reload(newCfg); err != nil {
-					log.Printf("Failed to reload: %v", err)
+				if reloadErr := manager.Reload(newCfg); reloadErr != nil {
+					log.Printf("Failed to reload: %v", reloadErr)
 				}

 			case os.Interrupt, syscall.SIGTERM:
@@ -474,18 +545,31 @@ func main() {
 					// Second signal received - force exit immediately
 					log.Printf("Received second signal (%v), forcing exit...", sig)
 				}
+				// Stop the watcher before exiting (defers won't run after os.Exit)
+				if watcherActive {
+					watcher.Stop()
+				}
 				os.Exit(0)
 			}
 		}
 	} else {
 		// Interactive mode with bubbletea
 		// Setup config watcher in background
-		watcher, err := config.NewWatcher(*configFile, func(newCfg *config.Config) error {
+		var watcher *config.Watcher
+		watcher, err = config.NewWatcher(*configFile, func(newCfg *config.Config) error {
 			return manager.Reload(newCfg)
 		}, *verbose)
 		if err == nil {
 			watcher.Start()
-			defer watcher.Stop()
+		}
+
+		// Cleanup function to ensure all resources are released
+		cleanup := func() {
+			bubbleTeaUI.Stop()
+			manager.Stop()
+			if watcher != nil {
+				watcher.Stop()
+			}
 		}

 		// Setup signal handler for clean shutdown
@@ -493,8 +577,7 @@ func main() {
 			sigChan := make(chan os.Signal, 1)
 			signal.Notify(sigChan, os.Interrupt, syscall.SIGTERM)
 			<-sigChan
-			bubbleTeaUI.Stop()
-			manager.Stop()
+			cleanup()
 			os.Exit(0)
 		}()

@@ -504,12 +587,12 @@ func main() {
 		// Start the bubbletea app (blocks until quit)
 		if err := bubbleTeaUI.Start(); err != nil {
 			fmt.Fprintf(os.Stderr, "Failed to start UI: %v\n", err)
-			manager.Stop()
+			cleanup()
 			os.Exit(1)
 		}

-		// Clean shutdown
-		manager.Stop()
+		// Clean shutdown (normal exit via UI quit)
+		cleanup()
 	}
 }

@@ -0,0 +1 @@
+kportal.raczylo.com
@@ -65,6 +65,7 @@
            .shadow-modern { box-shadow: 0 10px 40px -10px rgba(0, 0, 0, 0.1); }
            .dark .shadow-modern { box-shadow: 0 10px 40px -10px rgba(0, 0, 0, 0.4); }
            html { scroll-behavior: smooth; }
+
        </style>
        <script>
            if (localStorage.theme === "dark" || (!("theme" in localStorage) && window.matchMedia("(prefers-color-scheme: dark)").matches)) {
@@ -85,6 +86,7 @@
                    </a>
                    <div class="hidden md:flex space-x-6">
                        <a href="#features" class="text-gray-600 dark:text-gray-300 hover:text-gray-900 dark:hover:text-gray-100 font-medium">Features</a>
+                        <a href="#comparison" class="text-gray-600 dark:text-gray-300 hover:text-gray-900 dark:hover:text-gray-100 font-medium">Comparison</a>
                        <a href="#installation" class="text-gray-600 dark:text-gray-300 hover:text-gray-900 dark:hover:text-gray-100 font-medium">Installation</a>
                        <a href="#usage" class="text-gray-600 dark:text-gray-300 hover:text-gray-900 dark:hover:text-gray-100 font-medium">Usage</a>
                        <a href="#configuration" class="text-gray-600 dark:text-gray-300 hover:text-gray-900 dark:hover:text-gray-100 font-medium">Configuration</a>
@@ -108,6 +110,7 @@
            <div id="mobile-menu" class="hidden md:hidden border-t border-gray-200 dark:border-gray-700">
                <div class="px-4 py-3 space-y-1 bg-white dark:bg-gray-800">
                    <a href="#features" class="block px-3 py-3 text-gray-600 dark:text-gray-300 hover:text-gray-900 dark:hover:text-gray-100 hover:bg-gray-50 dark:hover:bg-gray-700 rounded font-medium">Features</a>
+                    <a href="#comparison" class="block px-3 py-3 text-gray-600 dark:text-gray-300 hover:text-gray-900 dark:hover:text-gray-100 hover:bg-gray-50 dark:hover:bg-gray-700 rounded font-medium">Comparison</a>
                    <a href="#installation" class="block px-3 py-3 text-gray-600 dark:text-gray-300 hover:text-gray-900 dark:hover:text-gray-100 hover:bg-gray-50 dark:hover:bg-gray-700 rounded font-medium">Installation</a>
                    <a href="#usage" class="block px-3 py-3 text-gray-600 dark:text-gray-300 hover:text-gray-900 dark:hover:text-gray-100 hover:bg-gray-50 dark:hover:bg-gray-700 rounded font-medium">Usage</a>
                    <a href="#configuration" class="block px-3 py-3 text-gray-600 dark:text-gray-300 hover:text-gray-900 dark:hover:text-gray-100 hover:bg-gray-50 dark:hover:bg-gray-700 rounded font-medium">Configuration</a>
@@ -272,7 +275,7 @@
                            </div>
                            <div>
                                <h3 class="font-semibold text-gray-900 dark:text-gray-100 mb-1">HTTP Traffic Logging</h3>
-                                <p class="text-sm text-gray-600 dark:text-gray-400">Real-time HTTP logging with filters (Non-2xx, Errors, Search)</p>
+                                <p class="text-sm text-gray-600 dark:text-gray-400">Real-time HTTP logging with detail view, JSON highlighting, gzip decompression, and clipboard copy</p>
                            </div>
                        </div>
                    </div>
@@ -302,8 +305,246 @@
            </div>
        </section>

+        <!-- Comparison Section -->
+        <section id="comparison" class="py-12 sm:py-16 md:py-20 bg-gray-50 dark:bg-gray-800 theme-transition">
+            <div class="max-w-6xl mx-auto px-4 sm:px-6">
+                <div class="text-center mb-8 sm:mb-12">
+                    <h2 class="text-2xl sm:text-3xl md:text-4xl font-bold text-gray-900 dark:text-gray-100 mb-3 sm:mb-4">Comparison</h2>
+                    <p class="text-base sm:text-lg text-gray-600 dark:text-gray-300 px-4">How kportal compares to other Kubernetes port-forwarding tools</p>
+                </div>
+
+                <!-- Mobile Comparison Cards (visible on mobile only) -->
+                <div class="block md:hidden space-y-4 mb-8">
+                    <!-- kportal Card -->
+                    <div class="glass rounded-xl p-5 shadow-modern">
+                        <div class="flex items-center gap-3 mb-4 pb-3 border-b border-gray-200 dark:border-gray-700">
+                            <div class="w-10 h-10 rounded-lg bg-gradient-to-br from-blue-600 to-purple-600 flex items-center justify-center">
+                                <span class="text-white font-bold text-sm">K</span>
+                            </div>
+                            <div>
+                                <h4 class="font-semibold text-gray-900 dark:text-gray-100">kportal</h4>
+                                <p class="text-xs text-gray-500">Terminal TUI | Single binary</p>
+                            </div>
+                        </div>
+                        <div class="grid grid-cols-2 gap-2 text-sm">
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">Persistent Config</span></div>
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">Auto-reconnect</span></div>
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">Hot-reload</span></div>
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">Health Checks</span></div>
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">Stale Detection</span></div>
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">HTTP Logging</span></div>
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">Benchmarking</span></div>
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">mDNS Hostnames</span></div>
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">Label Selectors</span></div>
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">Headless Mode</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">System Tray</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">UDP Support</span></div>
+                        </div>
+                    </div>
+
+                    <!-- k9s Card -->
+                    <div class="glass rounded-xl p-5 shadow-modern">
+                        <div class="flex items-center gap-3 mb-4 pb-3 border-b border-gray-200 dark:border-gray-700">
+                            <div class="w-10 h-10 rounded-lg bg-gradient-to-br from-gray-600 to-gray-700 flex items-center justify-center">
+                                <span class="text-white font-bold text-sm">k9</span>
+                            </div>
+                            <div>
+                                <a href="https://k9scli.io/" target="_blank" class="font-semibold text-gray-900 dark:text-gray-100 hover:text-blue-600">k9s</a>
+                                <p class="text-xs text-gray-500">Terminal TUI | Single binary</p>
+                            </div>
+                        </div>
+                        <div class="grid grid-cols-2 gap-2 text-sm">
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">Persistent Config</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">Auto-reconnect</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">Hot-reload</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">Health Checks</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">Stale Detection</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">HTTP Logging</span></div>
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">Benchmarking</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">mDNS Hostnames</span></div>
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">Label Selectors</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">Headless Mode</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">System Tray</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">UDP Support</span></div>
+                        </div>
+                    </div>
+
+                    <!-- Kube Forwarder Card -->
+                    <div class="glass rounded-xl p-5 shadow-modern">
+                        <div class="flex items-center gap-3 mb-4 pb-3 border-b border-gray-200 dark:border-gray-700">
+                            <div class="w-10 h-10 rounded-lg bg-gradient-to-br from-teal-600 to-teal-700 flex items-center justify-center">
+                                <span class="text-white font-bold text-sm">KF</span>
+                            </div>
+                            <div>
+                                <a href="https://kube-forwarder.pixelpoint.io/" target="_blank" class="font-semibold text-gray-900 dark:text-gray-100 hover:text-blue-600">Kube Forwarder</a>
+                                <p class="text-xs text-gray-500">Desktop GUI | Electron</p>
+                            </div>
+                        </div>
+                        <div class="grid grid-cols-2 gap-2 text-sm">
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">Persistent Config</span></div>
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">Auto-reconnect</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">Hot-reload</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">Health Checks</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">Stale Detection</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">HTTP Logging</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">Benchmarking</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">mDNS Hostnames</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">Label Selectors</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">Headless Mode</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">System Tray</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">UDP Support</span></div>
+                        </div>
+                    </div>
+
+                    <!-- kftray Card -->
+                    <div class="glass rounded-xl p-5 shadow-modern">
+                        <div class="flex items-center gap-3 mb-4 pb-3 border-b border-gray-200 dark:border-gray-700">
+                            <div class="w-10 h-10 rounded-lg bg-gradient-to-br from-orange-600 to-orange-700 flex items-center justify-center">
+                                <span class="text-white font-bold text-sm">kft</span>
+                            </div>
+                            <div>
+                                <a href="https://kftray.app/" target="_blank" class="font-semibold text-gray-900 dark:text-gray-100 hover:text-blue-600">kftray</a>
+                                <p class="text-xs text-gray-500">Desktop + TUI | Tauri</p>
+                            </div>
+                        </div>
+                        <div class="grid grid-cols-2 gap-2 text-sm">
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">Persistent Config</span></div>
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">Auto-reconnect</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">Hot-reload</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">Health Checks</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">Stale Detection</span></div>
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">HTTP Logging</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">Benchmarking</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">mDNS Hostnames</span></div>
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">Label Selectors</span></div>
+                            <div class="flex items-center gap-2"><span class="text-red-500">✗</span><span class="text-gray-400">Headless Mode</span></div>
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">System Tray</span></div>
+                            <div class="flex items-center gap-2"><span class="text-green-500">✓</span><span class="text-gray-600 dark:text-gray-400">UDP Support</span></div>
+                        </div>
+                    </div>
+                </div>
+
+                <!-- Desktop Comparison Table (visible on tablet/desktop only) -->
+                <div class="hidden md:block glass rounded-xl overflow-hidden shadow-modern mb-8">
+                    <div class="overflow-x-auto">
+                        <table class="w-full text-sm">
+                            <thead class="bg-gradient-to-r from-blue-600 to-purple-600 text-white">
+                                <tr>
+                                    <th class="px-4 py-3 text-left font-semibold">Feature</th>
+                                    <th class="px-4 py-3 text-center font-semibold">kportal</th>
+                                    <th class="px-4 py-3 text-center font-semibold"><a href="https://k9scli.io/" class="hover:underline" target="_blank">k9s</a></th>
+                                    <th class="px-4 py-3 text-center font-semibold"><a href="https://kube-forwarder.pixelpoint.io/" class="hover:underline" target="_blank">Kube Forwarder</a></th>
+                                    <th class="px-4 py-3 text-center font-semibold"><a href="https://kftray.app/" class="hover:underline" target="_blank">kftray</a></th>
+                                </tr>
+                            </thead>
+                            <tbody class="divide-y divide-gray-200 dark:divide-gray-700">
+                                <tr class="hover:bg-gray-50 dark:hover:bg-gray-800/50">
+                                    <td class="px-4 py-3 text-gray-700 dark:text-gray-300 font-medium">Interface</td>
+                                    <td class="px-4 py-3 text-center text-gray-600 dark:text-gray-400">Terminal TUI</td>
+                                    <td class="px-4 py-3 text-center text-gray-600 dark:text-gray-400">Terminal TUI</td>
+                                    <td class="px-4 py-3 text-center text-gray-600 dark:text-gray-400">Desktop GUI</td>
+                                    <td class="px-4 py-3 text-center text-gray-600 dark:text-gray-400">Desktop + TUI</td>
+                                </tr>
+                                <tr class="hover:bg-gray-50 dark:hover:bg-gray-800/50">
+                                    <td class="px-4 py-3 text-gray-700 dark:text-gray-300 font-medium">Persistent Config</td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span> <span class="text-xs text-gray-500">YAML</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span> <span class="text-xs text-gray-500">Session only</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span> <span class="text-xs text-gray-500">JSON</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span> <span class="text-xs text-gray-500">JSON + Git</span></td>
+                                </tr>
+                                <tr class="hover:bg-gray-50 dark:hover:bg-gray-800/50">
+                                    <td class="px-4 py-3 text-gray-700 dark:text-gray-300 font-medium">Auto-reconnect</td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span> <span class="text-xs text-gray-500">Exp. backoff</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span> <span class="text-xs text-gray-500">Basic</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span> <span class="text-xs text-gray-500">Watch API</span></td>
+                                </tr>
+                                <tr class="hover:bg-gray-50 dark:hover:bg-gray-800/50">
+                                    <td class="px-4 py-3 text-gray-700 dark:text-gray-300 font-medium">Hot-reload Config</td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                </tr>
+                                <tr class="hover:bg-gray-50 dark:hover:bg-gray-800/50">
+                                    <td class="px-4 py-3 text-gray-700 dark:text-gray-300 font-medium">Health Checks</td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span> <span class="text-xs text-gray-500">TCP + data</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                </tr>
+                                <tr class="hover:bg-gray-50 dark:hover:bg-gray-800/50">
+                                    <td class="px-4 py-3 text-gray-700 dark:text-gray-300 font-medium">Stale Connection Detection</td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span> <span class="text-xs text-gray-500">Age + idle</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                </tr>
+                                <tr class="hover:bg-gray-50 dark:hover:bg-gray-800/50">
+                                    <td class="px-4 py-3 text-gray-700 dark:text-gray-300 font-medium">HTTP Traffic Logging</td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span> <span class="text-xs text-gray-500">Built-in</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span></td>
+                                </tr>
+                                <tr class="hover:bg-gray-50 dark:hover:bg-gray-800/50">
+                                    <td class="px-4 py-3 text-gray-700 dark:text-gray-300 font-medium">Connection Benchmarking</td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span> <span class="text-xs text-gray-500">Built-in</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span> <span class="text-xs text-gray-500">Via Hey</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                </tr>
+                                <tr class="hover:bg-gray-50 dark:hover:bg-gray-800/50">
+                                    <td class="px-4 py-3 text-gray-700 dark:text-gray-300 font-medium">mDNS Hostnames</td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span> <span class="text-xs text-gray-500">.local</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                </tr>
+                                <tr class="hover:bg-gray-50 dark:hover:bg-gray-800/50">
+                                    <td class="px-4 py-3 text-gray-700 dark:text-gray-300 font-medium">Label Selectors</td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span></td>
+                                </tr>
+                                <tr class="hover:bg-gray-50 dark:hover:bg-gray-800/50">
+                                    <td class="px-4 py-3 text-gray-700 dark:text-gray-300 font-medium">Headless Mode</td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                </tr>
+                                <tr class="hover:bg-gray-50 dark:hover:bg-gray-800/50">
+                                    <td class="px-4 py-3 text-gray-700 dark:text-gray-300 font-medium">System Tray</td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span></td>
+                                </tr>
+                                <tr class="hover:bg-gray-50 dark:hover:bg-gray-800/50">
+                                    <td class="px-4 py-3 text-gray-700 dark:text-gray-300 font-medium">UDP Support</td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-red-500">✗</span></td>
+                                    <td class="px-4 py-3 text-center"><span class="text-green-500">✓</span> <span class="text-xs text-gray-500">Proxy</span></td>
+                                </tr>
+                                <tr class="hover:bg-gray-50 dark:hover:bg-gray-800/50">
+                                    <td class="px-4 py-3 text-gray-700 dark:text-gray-300 font-medium">Dependencies</td>
+                                    <td class="px-4 py-3 text-center text-gray-600 dark:text-gray-400">Single binary</td>
+                                    <td class="px-4 py-3 text-center text-gray-600 dark:text-gray-400">Single binary</td>
+                                    <td class="px-4 py-3 text-center text-gray-600 dark:text-gray-400">Electron</td>
+                                    <td class="px-4 py-3 text-center text-gray-600 dark:text-gray-400">Tauri</td>
+                                </tr>
+                            </tbody>
+                        </table>
+                    </div>
+                </div>
+            </div>
+        </section>
+
        <!-- Installation Section -->
-        <section id="installation" class="py-12 sm:py-16 md:py-20 bg-gray-50 dark:bg-gray-800 theme-transition">
+        <section id="installation" class="py-12 sm:py-16 md:py-20 bg-white dark:bg-gray-900 theme-transition">
            <div class="max-w-4xl mx-auto px-4 sm:px-6">
                <div class="text-center mb-10 sm:mb-12">
                    <h2 class="text-2xl sm:text-3xl md:text-4xl font-bold text-gray-900 dark:text-gray-100 mb-3 sm:mb-4">Installation</h2>
@@ -315,11 +556,11 @@
                            <i class="fas fa-beer text-orange-500 dark:text-orange-400 text-2xl mr-3"></i>
                            <div>
                                <h3 class="text-xl font-semibold text-gray-900 dark:text-gray-100">Homebrew</h3>
-                                <p class="text-gray-600 dark:text-gray-400 text-sm">macOS & Linux</p>
+                                <p class="text-gray-600 dark:text-gray-400 text-sm">macOS</p>
                            </div>
                        </div>
-                        <div onclick="copyToClipboard('brew install lukaszraczylo/brew-taps/kportal', this)" class="relative bg-gradient-to-br from-gray-900 to-gray-800 dark:from-gray-950 dark:to-black text-gray-100 p-4 rounded-lg text-sm cursor-pointer group overflow-x-auto border border-gray-700 hover:border-orange-500 transition-all duration-300">
-                            <code class="block whitespace-nowrap font-mono">brew install lukaszraczylo/brew-taps/kportal</code>
+                        <div onclick="copyToClipboard('brew install --cask lukaszraczylo/taps/kportal', this)" class="relative bg-gradient-to-br from-gray-900 to-gray-800 dark:from-gray-950 dark:to-black text-gray-100 p-4 rounded-lg text-sm cursor-pointer group overflow-x-auto border border-gray-700 hover:border-orange-500 transition-all duration-300">
+                            <code class="block whitespace-nowrap font-mono">brew install --cask lukaszraczylo/taps/kportal</code>
                            <div class="absolute top-3 right-3"><i class="fas fa-copy text-gray-500 group-hover:text-orange-400 transition-colors duration-300"></i></div>
                        </div>
                    </div>
@@ -359,111 +600,111 @@
                    <h2 class="text-2xl sm:text-3xl md:text-4xl font-bold text-gray-900 dark:text-gray-100 mb-3 sm:mb-4">Usage</h2>
                    <p class="text-base sm:text-lg text-gray-600 dark:text-gray-300 px-4">Simple commands, powerful results</p>
                </div>
-                <div class="grid md:grid-cols-2 gap-6 mb-10">
-                    <div class="glass p-6 rounded-xl">
-                        <h3 class="text-lg font-semibold text-gray-900 dark:text-gray-100 mb-4"><i class="fas fa-play text-green-500 mr-2"></i>Interactive Mode</h3>
+                <div class="grid grid-cols-1 sm:grid-cols-2 gap-4 sm:gap-6 mb-10">
+                    <div class="glass p-4 sm:p-6 rounded-xl">
+                        <h3 class="text-base sm:text-lg font-semibold text-gray-900 dark:text-gray-100 mb-3 sm:mb-4"><i class="fas fa-play text-green-500 mr-2"></i>Interactive Mode</h3>
                        <div onclick="copyToClipboard('kportal', this)" class="relative bg-gradient-to-br from-gray-900 to-gray-800 text-gray-100 p-4 rounded-lg text-sm cursor-pointer group border border-gray-700 hover:border-green-500 transition-all duration-300 mb-3">
                            <code class="font-mono">kportal</code>
                            <div class="absolute top-3 right-3"><i class="fas fa-copy text-gray-500 group-hover:text-green-400 transition-colors"></i></div>
                        </div>
-                        <p class="text-sm text-gray-600 dark:text-gray-400">Launch the interactive TUI with real-time status updates and keyboard controls.</p>
+                        <p class="text-xs sm:text-sm text-gray-600 dark:text-gray-400">Launch the interactive TUI with real-time status updates and keyboard controls.</p>
                    </div>
-                    <div class="glass p-6 rounded-xl">
-                        <h3 class="text-lg font-semibold text-gray-900 dark:text-gray-100 mb-4"><i class="fas fa-terminal text-blue-500 mr-2"></i>Verbose Mode</h3>
+                    <div class="glass p-4 sm:p-6 rounded-xl">
+                        <h3 class="text-base sm:text-lg font-semibold text-gray-900 dark:text-gray-100 mb-3 sm:mb-4"><i class="fas fa-terminal text-blue-500 mr-2"></i>Verbose Mode</h3>
                        <div onclick="copyToClipboard('kportal -v', this)" class="relative bg-gradient-to-br from-gray-900 to-gray-800 text-gray-100 p-4 rounded-lg text-sm cursor-pointer group border border-gray-700 hover:border-blue-500 transition-all duration-300 mb-3">
                            <code class="font-mono">kportal -v</code>
                            <div class="absolute top-3 right-3"><i class="fas fa-copy text-gray-500 group-hover:text-blue-400 transition-colors"></i></div>
                        </div>
-                        <p class="text-sm text-gray-600 dark:text-gray-400">Run with detailed logging for debugging and automation.</p>
+                        <p class="text-xs sm:text-sm text-gray-600 dark:text-gray-400">Run with detailed logging for debugging and automation.</p>
                    </div>
-                    <div class="glass p-6 rounded-xl">
-                        <h3 class="text-lg font-semibold text-gray-900 dark:text-gray-100 mb-4"><i class="fas fa-check-circle text-purple-500 mr-2"></i>Validate Config</h3>
+                    <div class="glass p-4 sm:p-6 rounded-xl">
+                        <h3 class="text-base sm:text-lg font-semibold text-gray-900 dark:text-gray-100 mb-3 sm:mb-4"><i class="fas fa-check-circle text-purple-500 mr-2"></i>Validate Config</h3>
                        <div onclick="copyToClipboard('kportal --check', this)" class="relative bg-gradient-to-br from-gray-900 to-gray-800 text-gray-100 p-4 rounded-lg text-sm cursor-pointer group border border-gray-700 hover:border-purple-500 transition-all duration-300 mb-3">
                            <code class="font-mono">kportal --check</code>
                            <div class="absolute top-3 right-3"><i class="fas fa-copy text-gray-500 group-hover:text-purple-400 transition-colors"></i></div>
                        </div>
-                        <p class="text-sm text-gray-600 dark:text-gray-400">Validate configuration without starting any forwards.</p>
+                        <p class="text-xs sm:text-sm text-gray-600 dark:text-gray-400">Validate configuration without starting any forwards.</p>
                    </div>
-                    <div class="glass p-6 rounded-xl">
-                        <h3 class="text-lg font-semibold text-gray-900 dark:text-gray-100 mb-4"><i class="fas fa-file text-amber-500 mr-2"></i>Custom Config</h3>
+                    <div class="glass p-4 sm:p-6 rounded-xl">
+                        <h3 class="text-base sm:text-lg font-semibold text-gray-900 dark:text-gray-100 mb-3 sm:mb-4"><i class="fas fa-file text-amber-500 mr-2"></i>Custom Config</h3>
                        <div onclick="copyToClipboard('kportal -c /path/to/config.yaml', this)" class="relative bg-gradient-to-br from-gray-900 to-gray-800 text-gray-100 p-4 rounded-lg text-sm cursor-pointer group border border-gray-700 hover:border-amber-500 transition-all duration-300 mb-3">
                            <code class="font-mono">kportal -c /path/to/config.yaml</code>
                            <div class="absolute top-3 right-3"><i class="fas fa-copy text-gray-500 group-hover:text-amber-400 transition-colors"></i></div>
                        </div>
-                        <p class="text-sm text-gray-600 dark:text-gray-400">Use a custom configuration file instead of .kportal.yaml</p>
+                        <p class="text-xs sm:text-sm text-gray-600 dark:text-gray-400">Use a custom configuration file instead of .kportal.yaml</p>
                    </div>
-                    <div class="glass p-6 rounded-xl">
-                        <h3 class="text-lg font-semibold text-gray-900 dark:text-gray-100 mb-4"><i class="fas fa-server text-slate-500 mr-2"></i>Headless Mode</h3>
+                    <div class="glass p-4 sm:p-6 rounded-xl">
+                        <h3 class="text-base sm:text-lg font-semibold text-gray-900 dark:text-gray-100 mb-3 sm:mb-4"><i class="fas fa-server text-slate-500 mr-2"></i>Headless Mode</h3>
                        <div onclick="copyToClipboard('kportal -headless -v &', this)" class="relative bg-gradient-to-br from-gray-900 to-gray-800 text-gray-100 p-4 rounded-lg text-sm cursor-pointer group border border-gray-700 hover:border-slate-500 transition-all duration-300 mb-3">
                            <code class="font-mono">kportal -headless -v &</code>
                            <div class="absolute top-3 right-3"><i class="fas fa-copy text-gray-500 group-hover:text-slate-400 transition-colors"></i></div>
                        </div>
-                        <p class="text-sm text-gray-600 dark:text-gray-400">Run without TUI for scripting and background operation.</p>
+                        <p class="text-xs sm:text-sm text-gray-600 dark:text-gray-400">Run without TUI for scripting and background operation.</p>
                    </div>
                </div>

                <!-- Keyboard Shortcuts -->
-                <div class="glass p-6 sm:p-8 rounded-xl">
-                    <h3 class="text-xl font-semibold text-gray-900 dark:text-gray-100 mb-6 text-center"><i class="fas fa-keyboard text-indigo-500 mr-2"></i>Keyboard Shortcuts</h3>
-                    <div class="grid sm:grid-cols-2 lg:grid-cols-4 gap-4">
-                        <div class="flex items-center gap-3 p-3 bg-white dark:bg-gray-800 rounded-lg">
-                            <kbd class="px-3 py-1.5 bg-gray-100 dark:bg-gray-700 rounded text-sm font-mono font-semibold">↑↓</kbd>
-                            <span class="text-sm text-gray-700 dark:text-gray-300">Navigate</span>
+                <div class="glass p-4 sm:p-6 md:p-8 rounded-xl">
+                    <h3 class="text-lg sm:text-xl font-semibold text-gray-900 dark:text-gray-100 mb-4 sm:mb-6 text-center"><i class="fas fa-keyboard text-indigo-500 mr-2"></i>Keyboard Shortcuts</h3>
+                    <div class="grid grid-cols-2 sm:grid-cols-2 lg:grid-cols-4 gap-2 sm:gap-4">
+                        <div class="flex items-center gap-2 sm:gap-3 p-2 sm:p-3 bg-white dark:bg-gray-800 rounded-lg">
+                            <kbd class="px-2 sm:px-3 py-1 sm:py-1.5 bg-gray-100 dark:bg-gray-700 rounded text-xs sm:text-sm font-mono font-semibold">↑↓</kbd>
+                            <span class="text-xs sm:text-sm text-gray-700 dark:text-gray-300">Navigate</span>
                        </div>
-                        <div class="flex items-center gap-3 p-3 bg-white dark:bg-gray-800 rounded-lg">
-                            <kbd class="px-3 py-1.5 bg-gray-100 dark:bg-gray-700 rounded text-sm font-mono font-semibold">Space</kbd>
-                            <span class="text-sm text-gray-700 dark:text-gray-300">Toggle forward</span>
+                        <div class="flex items-center gap-2 sm:gap-3 p-2 sm:p-3 bg-white dark:bg-gray-800 rounded-lg">
+                            <kbd class="px-2 sm:px-3 py-1 sm:py-1.5 bg-gray-100 dark:bg-gray-700 rounded text-xs sm:text-sm font-mono font-semibold">Space</kbd>
+                            <span class="text-xs sm:text-sm text-gray-700 dark:text-gray-300">Toggle</span>
                        </div>
-                        <div class="flex items-center gap-3 p-3 bg-white dark:bg-gray-800 rounded-lg">
-                            <kbd class="px-3 py-1.5 bg-gray-100 dark:bg-gray-700 rounded text-sm font-mono font-semibold">a</kbd>
-                            <span class="text-sm text-gray-700 dark:text-gray-300">Add forward</span>
+                        <div class="flex items-center gap-2 sm:gap-3 p-2 sm:p-3 bg-white dark:bg-gray-800 rounded-lg">
+                            <kbd class="px-2 sm:px-3 py-1 sm:py-1.5 bg-gray-100 dark:bg-gray-700 rounded text-xs sm:text-sm font-mono font-semibold">a</kbd>
+                            <span class="text-xs sm:text-sm text-gray-700 dark:text-gray-300">Add</span>
                        </div>
-                        <div class="flex items-center gap-3 p-3 bg-white dark:bg-gray-800 rounded-lg">
-                            <kbd class="px-3 py-1.5 bg-gray-100 dark:bg-gray-700 rounded text-sm font-mono font-semibold">e</kbd>
-                            <span class="text-sm text-gray-700 dark:text-gray-300">Edit forward</span>
+                        <div class="flex items-center gap-2 sm:gap-3 p-2 sm:p-3 bg-white dark:bg-gray-800 rounded-lg">
+                            <kbd class="px-2 sm:px-3 py-1 sm:py-1.5 bg-gray-100 dark:bg-gray-700 rounded text-xs sm:text-sm font-mono font-semibold">e</kbd>
+                            <span class="text-xs sm:text-sm text-gray-700 dark:text-gray-300">Edit</span>
                        </div>
-                        <div class="flex items-center gap-3 p-3 bg-white dark:bg-gray-800 rounded-lg">
-                            <kbd class="px-3 py-1.5 bg-gray-100 dark:bg-gray-700 rounded text-sm font-mono font-semibold">d</kbd>
-                            <span class="text-sm text-gray-700 dark:text-gray-300">Delete forward</span>
+                        <div class="flex items-center gap-2 sm:gap-3 p-2 sm:p-3 bg-white dark:bg-gray-800 rounded-lg">
+                            <kbd class="px-2 sm:px-3 py-1 sm:py-1.5 bg-gray-100 dark:bg-gray-700 rounded text-xs sm:text-sm font-mono font-semibold">d</kbd>
+                            <span class="text-xs sm:text-sm text-gray-700 dark:text-gray-300">Delete</span>
                        </div>
-                        <div class="flex items-center gap-3 p-3 bg-white dark:bg-gray-800 rounded-lg">
-                            <kbd class="px-3 py-1.5 bg-gray-100 dark:bg-gray-700 rounded text-sm font-mono font-semibold">j/k</kbd>
-                            <span class="text-sm text-gray-700 dark:text-gray-300">Vim navigation</span>
+                        <div class="flex items-center gap-2 sm:gap-3 p-2 sm:p-3 bg-white dark:bg-gray-800 rounded-lg">
+                            <kbd class="px-2 sm:px-3 py-1 sm:py-1.5 bg-gray-100 dark:bg-gray-700 rounded text-xs sm:text-sm font-mono font-semibold">j/k</kbd>
+                            <span class="text-xs sm:text-sm text-gray-700 dark:text-gray-300">Vim nav</span>
                        </div>
-                        <div class="flex items-center gap-3 p-3 bg-white dark:bg-gray-800 rounded-lg">
-                            <kbd class="px-3 py-1.5 bg-gray-100 dark:bg-gray-700 rounded text-sm font-mono font-semibold">b</kbd>
-                            <span class="text-sm text-gray-700 dark:text-gray-300">Benchmark</span>
+                        <div class="flex items-center gap-2 sm:gap-3 p-2 sm:p-3 bg-white dark:bg-gray-800 rounded-lg">
+                            <kbd class="px-2 sm:px-3 py-1 sm:py-1.5 bg-gray-100 dark:bg-gray-700 rounded text-xs sm:text-sm font-mono font-semibold">b</kbd>
+                            <span class="text-xs sm:text-sm text-gray-700 dark:text-gray-300">Benchmark</span>
                        </div>
-                        <div class="flex items-center gap-3 p-3 bg-white dark:bg-gray-800 rounded-lg">
-                            <kbd class="px-3 py-1.5 bg-gray-100 dark:bg-gray-700 rounded text-sm font-mono font-semibold">l</kbd>
-                            <span class="text-sm text-gray-700 dark:text-gray-300">HTTP logs</span>
+                        <div class="flex items-center gap-2 sm:gap-3 p-2 sm:p-3 bg-white dark:bg-gray-800 rounded-lg">
+                            <kbd class="px-2 sm:px-3 py-1 sm:py-1.5 bg-gray-100 dark:bg-gray-700 rounded text-xs sm:text-sm font-mono font-semibold">l</kbd>
+                            <span class="text-xs sm:text-sm text-gray-700 dark:text-gray-300">HTTP logs</span>
                        </div>
                    </div>
                </div>

                <!-- Status Indicators -->
-                <div class="mt-8 glass p-6 sm:p-8 rounded-xl">
-                    <h3 class="text-xl font-semibold text-gray-900 dark:text-gray-100 mb-6 text-center"><i class="fas fa-signal text-green-500 mr-2"></i>Status Indicators</h3>
-                    <div class="grid sm:grid-cols-2 lg:grid-cols-5 gap-4">
-                        <div class="flex items-center gap-3 p-3 bg-white dark:bg-gray-800 rounded-lg">
-                            <span class="text-green-500 text-lg">●</span>
-                            <span class="text-sm text-gray-700 dark:text-gray-300">Active</span>
+                <div class="mt-6 sm:mt-8 glass p-4 sm:p-6 md:p-8 rounded-xl">
+                    <h3 class="text-lg sm:text-xl font-semibold text-gray-900 dark:text-gray-100 mb-4 sm:mb-6 text-center"><i class="fas fa-signal text-green-500 mr-2"></i>Status Indicators</h3>
+                    <div class="grid grid-cols-2 sm:grid-cols-3 lg:grid-cols-5 gap-2 sm:gap-4">
+                        <div class="flex items-center gap-2 sm:gap-3 p-2 sm:p-3 bg-white dark:bg-gray-800 rounded-lg">
+                            <span class="text-green-500 text-base sm:text-lg">●</span>
+                            <span class="text-xs sm:text-sm text-gray-700 dark:text-gray-300">Active</span>
                        </div>
-                        <div class="flex items-center gap-3 p-3 bg-white dark:bg-gray-800 rounded-lg">
-                            <span class="text-yellow-500 text-lg">○</span>
-                            <span class="text-sm text-gray-700 dark:text-gray-300">Starting</span>
+                        <div class="flex items-center gap-2 sm:gap-3 p-2 sm:p-3 bg-white dark:bg-gray-800 rounded-lg">
+                            <span class="text-yellow-500 text-base sm:text-lg">○</span>
+                            <span class="text-xs sm:text-sm text-gray-700 dark:text-gray-300">Starting</span>
                        </div>
-                        <div class="flex items-center gap-3 p-3 bg-white dark:bg-gray-800 rounded-lg">
-                            <span class="text-yellow-500 text-lg">◐</span>
-                            <span class="text-sm text-gray-700 dark:text-gray-300">Reconnecting</span>
+                        <div class="flex items-center gap-2 sm:gap-3 p-2 sm:p-3 bg-white dark:bg-gray-800 rounded-lg">
+                            <span class="text-yellow-500 text-base sm:text-lg">◐</span>
+                            <span class="text-xs sm:text-sm text-gray-700 dark:text-gray-300">Reconnecting</span>
                        </div>
-                        <div class="flex items-center gap-3 p-3 bg-white dark:bg-gray-800 rounded-lg">
-                            <span class="text-red-500 text-lg">✗</span>
-                            <span class="text-sm text-gray-700 dark:text-gray-300">Error</span>
+                        <div class="flex items-center gap-2 sm:gap-3 p-2 sm:p-3 bg-white dark:bg-gray-800 rounded-lg">
+                            <span class="text-red-500 text-base sm:text-lg">✗</span>
+                            <span class="text-xs sm:text-sm text-gray-700 dark:text-gray-300">Error</span>
                        </div>
-                        <div class="flex items-center gap-3 p-3 bg-white dark:bg-gray-800 rounded-lg">
-                            <span class="text-gray-400 text-lg">○</span>
-                            <span class="text-sm text-gray-700 dark:text-gray-300">Disabled</span>
+                        <div class="flex items-center gap-2 sm:gap-3 p-2 sm:p-3 bg-white dark:bg-gray-800 rounded-lg col-span-2 sm:col-span-1">
+                            <span class="text-gray-400 text-base sm:text-lg">○</span>
+                            <span class="text-xs sm:text-sm text-gray-700 dark:text-gray-300">Disabled</span>
                        </div>
                    </div>
                </div>
@@ -478,11 +719,11 @@
                    <p class="text-base sm:text-lg text-gray-600 dark:text-gray-300 px-4">Simple YAML configuration with powerful options</p>
                </div>

-                <div class="grid lg:grid-cols-2 gap-6">
+                <div class="grid grid-cols-1 md:grid-cols-2 gap-4 sm:gap-6">
                    <!-- Basic Config -->
                    <div class="relative group">
                        <div class="absolute -inset-1 bg-gradient-to-r from-blue-600 to-purple-600 rounded-xl blur opacity-25 group-hover:opacity-50 transition duration-300"></div>
-                        <div class="relative bg-gradient-to-br from-gray-900 to-gray-800 rounded-xl p-5 overflow-x-auto border border-gray-700">
+                        <div class="relative bg-gradient-to-br from-gray-900 to-gray-800 rounded-xl p-4 sm:p-5 overflow-x-auto border border-gray-700">
                            <div class="flex items-center justify-between mb-4">
                                <div class="flex items-center">
                                    <i class="fas fa-file-code text-blue-400 mr-2"></i>
@@ -513,7 +754,7 @@
                    <!-- Advanced Config -->
                    <div class="relative group">
                        <div class="absolute -inset-1 bg-gradient-to-r from-purple-600 to-pink-600 rounded-xl blur opacity-25 group-hover:opacity-50 transition duration-300"></div>
-                        <div class="relative bg-gradient-to-br from-gray-900 to-gray-800 rounded-xl p-5 overflow-x-auto border border-gray-700">
+                        <div class="relative bg-gradient-to-br from-gray-900 to-gray-800 rounded-xl p-4 sm:p-5 overflow-x-auto border border-gray-700">
                            <div class="flex items-center justify-between mb-4">
                                <div class="flex items-center">
                                    <i class="fas fa-cogs text-purple-400 mr-2"></i>
@@ -545,27 +786,27 @@ contexts:
                </div>

                <!-- Resource Types & Options -->
-                <div class="mt-8 grid sm:grid-cols-2 lg:grid-cols-3 gap-6">
-                    <div class="glass p-6 rounded-xl">
-                        <h3 class="text-lg font-semibold text-gray-900 dark:text-gray-100 mb-4"><i class="fas fa-cube text-blue-500 mr-2"></i>Resource Types</h3>
-                        <ul class="space-y-3 text-sm text-gray-700 dark:text-gray-300">
-                            <li class="flex items-center gap-2"><code class="bg-white dark:bg-gray-900 px-2 py-1 rounded text-xs">service/name</code> Service</li>
-                            <li class="flex items-center gap-2"><code class="bg-white dark:bg-gray-900 px-2 py-1 rounded text-xs">pod/name</code> Pod by name</li>
-                            <li class="flex items-center gap-2"><code class="bg-white dark:bg-gray-900 px-2 py-1 rounded text-xs">pod/prefix</code> Pod by prefix</li>
-                            <li class="flex items-center gap-2"><code class="bg-white dark:bg-gray-900 px-2 py-1 rounded text-xs">deployment/name</code> Deployment</li>
+                <div class="mt-6 sm:mt-8 grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-4 sm:gap-6">
+                    <div class="glass p-4 sm:p-6 rounded-xl">
+                        <h3 class="text-base sm:text-lg font-semibold text-gray-900 dark:text-gray-100 mb-3 sm:mb-4"><i class="fas fa-cube text-blue-500 mr-2"></i>Resource Types</h3>
+                        <ul class="space-y-2 sm:space-y-3 text-xs sm:text-sm text-gray-700 dark:text-gray-300">
+                            <li class="flex items-center gap-2"><code class="bg-white dark:bg-gray-900 px-1.5 sm:px-2 py-0.5 sm:py-1 rounded text-xs">service/name</code> <span>Service</span></li>
+                            <li class="flex items-center gap-2"><code class="bg-white dark:bg-gray-900 px-1.5 sm:px-2 py-0.5 sm:py-1 rounded text-xs">pod/name</code> <span>Pod by name</span></li>
+                            <li class="flex items-center gap-2"><code class="bg-white dark:bg-gray-900 px-1.5 sm:px-2 py-0.5 sm:py-1 rounded text-xs">pod/prefix</code> <span>Pod by prefix</span></li>
+                            <li class="flex items-center gap-2"><code class="bg-white dark:bg-gray-900 px-1.5 sm:px-2 py-0.5 sm:py-1 rounded text-xs">deployment/name</code> <span>Deployment</span></li>
                        </ul>
                    </div>
-                    <div class="glass p-6 rounded-xl">
-                        <h3 class="text-lg font-semibold text-gray-900 dark:text-gray-100 mb-4"><i class="fas fa-tags text-green-500 mr-2"></i>Label Selectors</h3>
-                        <ul class="space-y-3 text-sm text-gray-700 dark:text-gray-300">
-                            <li><code class="bg-white dark:bg-gray-900 px-2 py-1 rounded text-xs">resource: pod</code></li>
-                            <li><code class="bg-white dark:bg-gray-900 px-2 py-1 rounded text-xs">selector: app=nginx</code></li>
-                            <li class="text-gray-500 dark:text-gray-400 text-xs mt-2">Dynamically resolves to running pods matching labels</li>
+                    <div class="glass p-4 sm:p-6 rounded-xl">
+                        <h3 class="text-base sm:text-lg font-semibold text-gray-900 dark:text-gray-100 mb-3 sm:mb-4"><i class="fas fa-tags text-green-500 mr-2"></i>Label Selectors</h3>
+                        <ul class="space-y-2 sm:space-y-3 text-xs sm:text-sm text-gray-700 dark:text-gray-300">
+                            <li><code class="bg-white dark:bg-gray-900 px-1.5 sm:px-2 py-0.5 sm:py-1 rounded text-xs">resource: pod</code></li>
+                            <li><code class="bg-white dark:bg-gray-900 px-1.5 sm:px-2 py-0.5 sm:py-1 rounded text-xs">selector: app=nginx</code></li>
+                            <li class="text-gray-500 dark:text-gray-400 text-xs mt-2">Dynamically resolves to running pods</li>
                        </ul>
                    </div>
-                    <div class="glass p-6 rounded-xl">
-                        <h3 class="text-lg font-semibold text-gray-900 dark:text-gray-100 mb-4"><i class="fas fa-sliders-h text-purple-500 mr-2"></i>Forward Options</h3>
-                        <ul class="space-y-2 text-sm text-gray-700 dark:text-gray-300">
+                    <div class="glass p-4 sm:p-6 rounded-xl sm:col-span-2 lg:col-span-1">
+                        <h3 class="text-base sm:text-lg font-semibold text-gray-900 dark:text-gray-100 mb-3 sm:mb-4"><i class="fas fa-sliders-h text-purple-500 mr-2"></i>Forward Options</h3>
+                        <ul class="space-y-1.5 sm:space-y-2 text-xs sm:text-sm text-gray-700 dark:text-gray-300">
                            <li><code class="text-xs">resource</code> - Target resource</li>
                            <li><code class="text-xs">port</code> - Remote port</li>
                            <li><code class="text-xs">localPort</code> - Local port</li>
@@ -585,98 +826,105 @@ contexts:
                    <p class="text-base sm:text-lg text-gray-600 dark:text-gray-300 px-4">Production-ready capabilities</p>
                </div>

-                <div class="grid md:grid-cols-2 gap-6">
+                <div class="grid grid-cols-1 sm:grid-cols-2 gap-4 sm:gap-6">
                    <!-- Health Checks -->
-                    <div class="glass p-6 rounded-xl">
-                        <h3 class="text-lg font-semibold text-gray-900 dark:text-gray-100 mb-4"><i class="fas fa-heartbeat text-red-500 mr-2"></i>Health Checks</h3>
-                        <p class="text-sm text-gray-600 dark:text-gray-400 mb-4">Advanced health monitoring prevents stale connections during long operations like database dumps.</p>
-                        <div class="space-y-2 text-sm">
-                            <div class="flex justify-between"><span class="text-gray-600 dark:text-gray-400">tcp-dial</span><span class="text-gray-900 dark:text-gray-100">Fast connection test</span></div>
-                            <div class="flex justify-between"><span class="text-gray-600 dark:text-gray-400">data-transfer</span><span class="text-gray-900 dark:text-gray-100">Verifies tunnel functionality</span></div>
-                            <div class="flex justify-between"><span class="text-gray-600 dark:text-gray-400">maxConnectionAge</span><span class="text-gray-900 dark:text-gray-100">Reconnect before k8s timeout</span></div>
-                            <div class="flex justify-between"><span class="text-gray-600 dark:text-gray-400">maxIdleTime</span><span class="text-gray-900 dark:text-gray-100">Detect idle connections</span></div>
+                    <div class="glass p-4 sm:p-6 rounded-xl">
+                        <h3 class="text-base sm:text-lg font-semibold text-gray-900 dark:text-gray-100 mb-3 sm:mb-4"><i class="fas fa-heartbeat text-red-500 mr-2"></i>Health Checks</h3>
+                        <p class="text-xs sm:text-sm text-gray-600 dark:text-gray-400 mb-3 sm:mb-4">Advanced health monitoring prevents stale connections during long operations.</p>
+                        <div class="space-y-1.5 sm:space-y-2 text-xs sm:text-sm">
+                            <div class="flex justify-between gap-2"><span class="text-gray-600 dark:text-gray-400">tcp-dial</span><span class="text-gray-900 dark:text-gray-100 text-right">Fast connection test</span></div>
+                            <div class="flex justify-between gap-2"><span class="text-gray-600 dark:text-gray-400">data-transfer</span><span class="text-gray-900 dark:text-gray-100 text-right">Verifies tunnel</span></div>
+                            <div class="flex justify-between gap-2"><span class="text-gray-600 dark:text-gray-400">maxConnectionAge</span><span class="text-gray-900 dark:text-gray-100 text-right">Auto reconnect</span></div>
+                            <div class="flex justify-between gap-2"><span class="text-gray-600 dark:text-gray-400">maxIdleTime</span><span class="text-gray-900 dark:text-gray-100 text-right">Detect idle</span></div>
                        </div>
                    </div>

                    <!-- mDNS -->
-                    <div class="glass p-6 rounded-xl">
-                        <h3 class="text-lg font-semibold text-gray-900 dark:text-gray-100 mb-4"><i class="fas fa-broadcast-tower text-cyan-500 mr-2"></i>mDNS Hostnames</h3>
-                        <p class="text-sm text-gray-600 dark:text-gray-400 mb-4">Access forwards via .local hostnames without editing /etc/hosts.</p>
-                        <div class="space-y-2 text-sm">
-                            <div class="flex items-center gap-2">
-                                <code class="bg-white dark:bg-gray-800 px-2 py-1 rounded text-xs">alias: prod-db</code>
+                    <div class="glass p-4 sm:p-6 rounded-xl">
+                        <h3 class="text-base sm:text-lg font-semibold text-gray-900 dark:text-gray-100 mb-3 sm:mb-4"><i class="fas fa-broadcast-tower text-cyan-500 mr-2"></i>mDNS Hostnames</h3>
+                        <p class="text-xs sm:text-sm text-gray-600 dark:text-gray-400 mb-3 sm:mb-4">Access forwards via .local hostnames without editing /etc/hosts.</p>
+                        <div class="space-y-2 text-xs sm:text-sm">
+                            <div class="flex items-center gap-1 sm:gap-2 flex-wrap">
+                                <code class="bg-white dark:bg-gray-800 px-1.5 sm:px-2 py-0.5 sm:py-1 rounded text-xs">alias: prod-db</code>
                                <span class="text-gray-500">→</span>
-                                <code class="text-cyan-500">prod-db.local</code>
+                                <code class="text-cyan-500 text-xs">prod-db.local</code>
                            </div>
-                            <div class="flex items-center gap-2">
-                                <code class="bg-white dark:bg-gray-800 px-2 py-1 rounded text-xs">service/redis</code>
+                            <div class="flex items-center gap-1 sm:gap-2 flex-wrap">
+                                <code class="bg-white dark:bg-gray-800 px-1.5 sm:px-2 py-0.5 sm:py-1 rounded text-xs">service/redis</code>
                                <span class="text-gray-500">→</span>
-                                <code class="text-cyan-500">redis.local</code>
+                                <code class="text-cyan-500 text-xs">redis.local</code>
                            </div>
-                            <p class="text-xs text-gray-500 mt-3">Works on macOS (Bonjour) and Linux (avahi-daemon)</p>
+                            <p class="text-xs text-gray-500 mt-2 sm:mt-3">Works on macOS & Linux</p>
                        </div>
                    </div>

                    <!-- Hot Reload -->
-                    <div class="glass p-6 rounded-xl">
-                        <h3 class="text-lg font-semibold text-gray-900 dark:text-gray-100 mb-4"><i class="fas fa-fire text-orange-500 mr-2"></i>Hot Reload</h3>
-                        <p class="text-sm text-gray-600 dark:text-gray-400 mb-4">Configuration changes are applied automatically without restarting.</p>
-                        <ul class="space-y-2 text-sm text-gray-700 dark:text-gray-300">
+                    <div class="glass p-4 sm:p-6 rounded-xl">
+                        <h3 class="text-base sm:text-lg font-semibold text-gray-900 dark:text-gray-100 mb-3 sm:mb-4"><i class="fas fa-fire text-orange-500 mr-2"></i>Hot Reload</h3>
+                        <p class="text-xs sm:text-sm text-gray-600 dark:text-gray-400 mb-3 sm:mb-4">Configuration changes are applied automatically without restarting.</p>
+                        <ul class="space-y-1.5 sm:space-y-2 text-xs sm:text-sm text-gray-700 dark:text-gray-300">
                            <li>• File watcher detects changes in ~100ms</li>
                            <li>• New forwards start automatically</li>
                            <li>• Removed forwards stop gracefully</li>
-                            <li>• Existing forwards continue uninterrupted</li>
+                            <li>• Existing forwards continue</li>
                        </ul>
                    </div>

                    <!-- Retry Strategy -->
-                    <div class="glass p-6 rounded-xl">
-                        <h3 class="text-lg font-semibold text-gray-900 dark:text-gray-100 mb-4"><i class="fas fa-redo text-green-500 mr-2"></i>Retry Strategy</h3>
-                        <p class="text-sm text-gray-600 dark:text-gray-400 mb-4">Exponential backoff with infinite retries ensures reliability.</p>
-                        <div class="flex items-center gap-2 text-sm font-mono">
-                            <span class="px-2 py-1 bg-green-100 dark:bg-green-900 text-green-700 dark:text-green-300 rounded">1s</span>
+                    <div class="glass p-4 sm:p-6 rounded-xl">
+                        <h3 class="text-base sm:text-lg font-semibold text-gray-900 dark:text-gray-100 mb-3 sm:mb-4"><i class="fas fa-redo text-green-500 mr-2"></i>Retry Strategy</h3>
+                        <p class="text-xs sm:text-sm text-gray-600 dark:text-gray-400 mb-3 sm:mb-4">Exponential backoff with infinite retries ensures reliability.</p>
+                        <div class="flex flex-wrap items-center gap-1 sm:gap-2 text-xs sm:text-sm font-mono">
+                            <span class="px-1.5 sm:px-2 py-0.5 sm:py-1 bg-green-100 dark:bg-green-900 text-green-700 dark:text-green-300 rounded">1s</span>
                            <span class="text-gray-400">→</span>
-                            <span class="px-2 py-1 bg-green-100 dark:bg-green-900 text-green-700 dark:text-green-300 rounded">2s</span>
+                            <span class="px-1.5 sm:px-2 py-0.5 sm:py-1 bg-green-100 dark:bg-green-900 text-green-700 dark:text-green-300 rounded">2s</span>
                            <span class="text-gray-400">→</span>
-                            <span class="px-2 py-1 bg-green-100 dark:bg-green-900 text-green-700 dark:text-green-300 rounded">4s</span>
+                            <span class="px-1.5 sm:px-2 py-0.5 sm:py-1 bg-green-100 dark:bg-green-900 text-green-700 dark:text-green-300 rounded">4s</span>
                            <span class="text-gray-400">→</span>
-                            <span class="px-2 py-1 bg-green-100 dark:bg-green-900 text-green-700 dark:text-green-300 rounded">8s</span>
-                            <span class="text-gray-400">→</span>
-                            <span class="px-2 py-1 bg-yellow-100 dark:bg-yellow-900 text-yellow-700 dark:text-yellow-300 rounded">10s max</span>
+                            <span class="px-1.5 sm:px-2 py-0.5 sm:py-1 bg-yellow-100 dark:bg-yellow-900 text-yellow-700 dark:text-yellow-300 rounded">10s max</span>
                        </div>
                    </div>

                    <!-- HTTP Traffic Logging -->
-                    <div class="glass p-6 rounded-xl">
-                        <h3 class="text-lg font-semibold text-gray-900 dark:text-gray-100 mb-4"><i class="fas fa-stream text-teal-500 mr-2"></i>HTTP Traffic Logging</h3>
-                        <p class="text-sm text-gray-600 dark:text-gray-400 mb-4">Press <kbd class="px-2 py-0.5 bg-gray-200 dark:bg-gray-700 rounded text-xs">l</kbd> to view real-time HTTP traffic for debugging.</p>
-                        <div class="space-y-3 text-sm">
+                    <div class="glass p-4 sm:p-6 rounded-xl">
+                        <h3 class="text-base sm:text-lg font-semibold text-gray-900 dark:text-gray-100 mb-3 sm:mb-4"><i class="fas fa-stream text-teal-500 mr-2"></i>HTTP Traffic Logging</h3>
+                        <p class="text-xs sm:text-sm text-gray-600 dark:text-gray-400 mb-3 sm:mb-4">Press <kbd class="px-1.5 sm:px-2 py-0.5 bg-gray-200 dark:bg-gray-700 rounded text-xs">l</kbd> to view real-time HTTP traffic.</p>
+                        <div class="space-y-2 sm:space-y-3 text-xs sm:text-sm">
                            <div class="text-gray-700 dark:text-gray-300">
-                                <span class="font-medium">Columns:</span> Time, Method, Status, Latency, Path
+                                <span class="font-medium">List view:</span> Time, Method, Status, Path
                            </div>
-                            <div class="flex flex-wrap gap-2">
-                                <kbd class="px-1.5 py-0.5 bg-gray-200 dark:bg-gray-700 rounded text-xs">f</kbd>
-                                <span class="text-gray-600 dark:text-gray-400">Filter mode</span>
-                                <kbd class="px-1.5 py-0.5 bg-gray-200 dark:bg-gray-700 rounded text-xs">/</kbd>
+                            <div class="flex flex-wrap gap-1.5 sm:gap-2">
+                                <kbd class="px-1 sm:px-1.5 py-0.5 bg-gray-200 dark:bg-gray-700 rounded text-xs">Enter</kbd>
+                                <span class="text-gray-600 dark:text-gray-400">Details</span>
+                                <kbd class="px-1 sm:px-1.5 py-0.5 bg-gray-200 dark:bg-gray-700 rounded text-xs">f</kbd>
+                                <span class="text-gray-600 dark:text-gray-400">Filter</span>
+                                <kbd class="px-1 sm:px-1.5 py-0.5 bg-gray-200 dark:bg-gray-700 rounded text-xs">/</kbd>
                                <span class="text-gray-600 dark:text-gray-400">Search</span>
-                                <kbd class="px-1.5 py-0.5 bg-gray-200 dark:bg-gray-700 rounded text-xs">c</kbd>
-                                <span class="text-gray-600 dark:text-gray-400">Clear</span>
                            </div>
-                            <div class="text-gray-600 dark:text-gray-400">
-                                <span class="font-medium text-gray-700 dark:text-gray-300">Filters:</span> All, Non-2xx, Errors (4xx/5xx)
+                            <div class="text-gray-700 dark:text-gray-300 mt-2">
+                                <span class="font-medium">Detail view:</span> Headers, body, timing
+                            </div>
+                            <div class="flex flex-wrap gap-1.5 sm:gap-2">
+                                <kbd class="px-1 sm:px-1.5 py-0.5 bg-gray-200 dark:bg-gray-700 rounded text-xs">c</kbd>
+                                <span class="text-gray-600 dark:text-gray-400">Copy body</span>
+                                <kbd class="px-1 sm:px-1.5 py-0.5 bg-gray-200 dark:bg-gray-700 rounded text-xs">Esc</kbd>
+                                <span class="text-gray-600 dark:text-gray-400">Back</span>
+                            </div>
+                            <div class="text-gray-500 dark:text-gray-500 text-xs mt-1">
+                                <i class="fas fa-magic mr-1"></i>JSON highlighting, gzip decompression, binary detection
                            </div>
                        </div>
                    </div>

                    <!-- Connection Benchmarking -->
-                    <div class="glass p-6 rounded-xl">
-                        <h3 class="text-lg font-semibold text-gray-900 dark:text-gray-100 mb-4"><i class="fas fa-tachometer-alt text-pink-500 mr-2"></i>Connection Benchmarking</h3>
-                        <p class="text-sm text-gray-600 dark:text-gray-400 mb-4">Press <kbd class="px-2 py-0.5 bg-gray-200 dark:bg-gray-700 rounded text-xs">b</kbd> to benchmark a connection with configurable parameters.</p>
-                        <div class="space-y-2 text-sm">
-                            <div class="flex justify-between"><span class="text-gray-600 dark:text-gray-400">Concurrency</span><span class="text-gray-900 dark:text-gray-100">Parallel workers</span></div>
-                            <div class="flex justify-between"><span class="text-gray-600 dark:text-gray-400">Requests</span><span class="text-gray-900 dark:text-gray-100">Total request count</span></div>
-                            <div class="flex justify-between"><span class="text-gray-600 dark:text-gray-400">Latency</span><span class="text-gray-900 dark:text-gray-100">P50/P95/P99 percentiles</span></div>
-                            <div class="flex justify-between"><span class="text-gray-600 dark:text-gray-400">Throughput</span><span class="text-gray-900 dark:text-gray-100">Requests per second</span></div>
+                    <div class="glass p-4 sm:p-6 rounded-xl">
+                        <h3 class="text-base sm:text-lg font-semibold text-gray-900 dark:text-gray-100 mb-3 sm:mb-4"><i class="fas fa-tachometer-alt text-pink-500 mr-2"></i>Benchmarking</h3>
+                        <p class="text-xs sm:text-sm text-gray-600 dark:text-gray-400 mb-3 sm:mb-4">Press <kbd class="px-1.5 sm:px-2 py-0.5 bg-gray-200 dark:bg-gray-700 rounded text-xs">b</kbd> to benchmark connections.</p>
+                        <div class="space-y-1.5 sm:space-y-2 text-xs sm:text-sm">
+                            <div class="flex justify-between gap-2"><span class="text-gray-600 dark:text-gray-400">Concurrency</span><span class="text-gray-900 dark:text-gray-100">Parallel workers</span></div>
+                            <div class="flex justify-between gap-2"><span class="text-gray-600 dark:text-gray-400">Requests</span><span class="text-gray-900 dark:text-gray-100">Total count</span></div>
+                            <div class="flex justify-between gap-2"><span class="text-gray-600 dark:text-gray-400">Latency</span><span class="text-gray-900 dark:text-gray-100">P50/P95/P99</span></div>
+                            <div class="flex justify-between gap-2"><span class="text-gray-600 dark:text-gray-400">Throughput</span><span class="text-gray-900 dark:text-gray-100">Req/s</span></div>
                        </div>
                    </div>
                </div>
@@ -684,41 +932,41 @@ contexts:
        </section>

        <!-- Footer -->
-        <footer class="bg-gray-900 dark:bg-black text-gray-400 py-10 theme-transition">
+        <footer class="bg-gray-900 dark:bg-black text-gray-400 py-8 sm:py-10 theme-transition">
            <div class="max-w-6xl mx-auto px-4 sm:px-6">
-                <div class="grid sm:grid-cols-2 md:grid-cols-4 gap-8">
-                    <div>
-                        <img src="kportal-logo-dark.svg" alt="kportal logo" class="h-12 w-auto mb-4" />
-                        <p class="text-sm">Kubernetes port-forward manager for professionals</p>
+                <div class="grid grid-cols-2 sm:grid-cols-2 md:grid-cols-4 gap-6 sm:gap-8">
+                    <div class="col-span-2 sm:col-span-1">
+                        <img src="kportal-logo-dark.svg" alt="kportal logo" class="h-10 sm:h-12 w-auto mb-3 sm:mb-4" />
+                        <p class="text-xs sm:text-sm">Kubernetes port-forward manager for professionals</p>
                    </div>
                    <div>
-                        <h3 class="text-white font-semibold mb-4">Links</h3>
-                        <ul class="space-y-2 text-sm">
+                        <h3 class="text-white font-semibold mb-3 sm:mb-4 text-sm sm:text-base">Links</h3>
+                        <ul class="space-y-1.5 sm:space-y-2 text-xs sm:text-sm">
                            <li><a href="https://github.com/lukaszraczylo/kportal" class="hover:text-white transition"><i class="fab fa-github mr-2"></i>GitHub</a></li>
                            <li><a href="https://github.com/lukaszraczylo/kportal/issues" class="hover:text-white transition"><i class="fas fa-bug mr-2"></i>Issues</a></li>
                            <li><a href="https://github.com/lukaszraczylo/kportal/releases" class="hover:text-white transition"><i class="fas fa-tag mr-2"></i>Releases</a></li>
                        </ul>
                    </div>
                    <div>
-                        <h3 class="text-white font-semibold mb-4">Documentation</h3>
-                        <ul class="space-y-2 text-sm">
+                        <h3 class="text-white font-semibold mb-3 sm:mb-4 text-sm sm:text-base">Docs</h3>
+                        <ul class="space-y-1.5 sm:space-y-2 text-xs sm:text-sm">
                            <li><a href="https://github.com/lukaszraczylo/kportal#quick-start" class="hover:text-white transition">Quick Start</a></li>
                            <li><a href="https://github.com/lukaszraczylo/kportal#configuration" class="hover:text-white transition">Configuration</a></li>
                            <li><a href="https://github.com/lukaszraczylo/kportal#troubleshooting" class="hover:text-white transition">Troubleshooting</a></li>
                        </ul>
                    </div>
-                    <div>
-                        <h3 class="text-white font-semibold mb-4">Built With</h3>
-                        <ul class="space-y-2 text-sm">
+                    <div class="col-span-2 sm:col-span-1">
+                        <h3 class="text-white font-semibold mb-3 sm:mb-4 text-sm sm:text-base">Built With</h3>
+                        <ul class="flex flex-wrap gap-x-4 gap-y-1.5 sm:block sm:space-y-2 text-xs sm:text-sm">
                            <li><i class="fas fa-code mr-2"></i>Bubble Tea</li>
                            <li><i class="fas fa-palette mr-2"></i>Lipgloss</li>
                            <li><i class="fas fa-dharmachakra mr-2"></i>client-go</li>
                        </ul>
                    </div>
                </div>
-                <div class="mt-8 pt-8 border-t border-gray-800 text-center text-sm">
+                <div class="mt-6 sm:mt-8 pt-6 sm:pt-8 border-t border-gray-800 text-center text-xs sm:text-sm">
                    <p>Made by <a href="https://github.com/lukaszraczylo" class="text-blue-400 hover:text-blue-300 transition">Lukasz Raczylo</a></p>
-                    <p class="mt-2">MIT License</p>
+                    <p class="mt-1.5 sm:mt-2">MIT License</p>
                </div>
            </div>
        </footer>
@@ -1,6 +1,6 @@
 module github.com/nvm/kportal

-go 1.24.2
+go 1.25.0

 require (
 	github.com/charmbracelet/bubbletea v1.3.10
@@ -10,50 +10,50 @@ require (
 	github.com/grandcat/zeroconf v1.0.0
 	github.com/stretchr/testify v1.11.1
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/api v0.34.2
-	k8s.io/apimachinery v0.34.2
-	k8s.io/client-go v0.34.2
+	k8s.io/api v0.35.0
+	k8s.io/apimachinery v0.35.0
+	k8s.io/client-go v0.35.0
 	k8s.io/klog/v2 v2.130.1
 )

 require (
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
-	github.com/charmbracelet/colorprofile v0.3.3 // indirect
-	github.com/charmbracelet/x/ansi v0.11.1 // indirect
-	github.com/charmbracelet/x/cellbuf v0.0.14 // indirect
+	github.com/charmbracelet/colorprofile v0.4.1 // indirect
+	github.com/charmbracelet/x/ansi v0.11.5 // indirect
+	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
 	github.com/charmbracelet/x/term v0.2.2 // indirect
-	github.com/clipperhouse/displaywidth v0.6.0 // indirect
+	github.com/clipperhouse/displaywidth v0.9.0 // indirect
 	github.com/clipperhouse/stringish v0.1.1 // indirect
-	github.com/clipperhouse/uax29/v2 v2.3.0 // indirect
+	github.com/clipperhouse/uax29/v2 v2.5.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
-	github.com/go-openapi/jsonpointer v0.22.3 // indirect
-	github.com/go-openapi/jsonreference v0.21.3 // indirect
-	github.com/go-openapi/swag v0.25.3 // indirect
-	github.com/go-openapi/swag/cmdutils v0.25.3 // indirect
-	github.com/go-openapi/swag/conv v0.25.3 // indirect
-	github.com/go-openapi/swag/fileutils v0.25.3 // indirect
-	github.com/go-openapi/swag/jsonname v0.25.3 // indirect
-	github.com/go-openapi/swag/jsonutils v0.25.3 // indirect
-	github.com/go-openapi/swag/loading v0.25.3 // indirect
-	github.com/go-openapi/swag/mangling v0.25.3 // indirect
-	github.com/go-openapi/swag/netutils v0.25.3 // indirect
-	github.com/go-openapi/swag/stringutils v0.25.3 // indirect
-	github.com/go-openapi/swag/typeutils v0.25.3 // indirect
-	github.com/go-openapi/swag/yamlutils v0.25.3 // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/go-openapi/jsonpointer v0.22.4 // indirect
+	github.com/go-openapi/jsonreference v0.21.4 // indirect
+	github.com/go-openapi/swag v0.25.4 // indirect
+	github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
+	github.com/go-openapi/swag/conv v0.25.4 // indirect
+	github.com/go-openapi/swag/fileutils v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonname v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
+	github.com/go-openapi/swag/loading v0.25.4 // indirect
+	github.com/go-openapi/swag/mangling v0.25.4 // indirect
+	github.com/go-openapi/swag/netutils v0.25.4 // indirect
+	github.com/go-openapi/swag/stringutils v0.25.4 // indirect
+	github.com/go-openapi/swag/typeutils v0.25.4 // indirect
+	github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
 	github.com/google/gnostic-models v0.7.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/kr/text v0.2.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
 	github.com/mattn/go-runewidth v0.0.19 // indirect
-	github.com/miekg/dns v1.1.68 // indirect
+	github.com/miekg/dns v1.1.72 // indirect
 	github.com/moby/spdystream v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
@@ -69,20 +69,20 @@ require (
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/mod v0.30.0 // indirect
-	golang.org/x/net v0.47.0 // indirect
-	golang.org/x/oauth2 v0.33.0 // indirect
-	golang.org/x/sync v0.18.0 // indirect
-	golang.org/x/sys v0.38.0 // indirect
-	golang.org/x/term v0.37.0 // indirect
-	golang.org/x/text v0.31.0 // indirect
+	golang.org/x/mod v0.32.0 // indirect
+	golang.org/x/net v0.49.0 // indirect
+	golang.org/x/oauth2 v0.34.0 // indirect
+	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/sys v0.40.0 // indirect
+	golang.org/x/term v0.39.0 // indirect
+	golang.org/x/text v0.33.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
-	golang.org/x/tools v0.39.0 // indirect
-	google.golang.org/protobuf v1.36.10 // indirect
+	golang.org/x/tools v0.41.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20251125145642-4e65d59e963e // indirect
-	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
+	k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4 // indirect
+	k8s.io/utils v0.0.0-20260108192941-914a6e750570 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.1 // indirect
@@ -1,27 +1,34 @@
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
+github.com/aymanbagabas/go-udiff v0.2.0 h1:TK0fH4MteXUDspT88n8CKzvK0X9O2xu9yQjWpi6yML8=
+github.com/aymanbagabas/go-udiff v0.2.0/go.mod h1:RE4Ex0qsGkTAJoQdQQCA0uG+nAzJO/pI/QwceO5fgrA=
 github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
 github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
 github.com/charmbracelet/bubbletea v1.3.10 h1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw=
 github.com/charmbracelet/bubbletea v1.3.10/go.mod h1:ORQfo0fk8U+po9VaNvnV95UPWA1BitP1E0N6xJPlHr4=
-github.com/charmbracelet/colorprofile v0.3.3 h1:DjJzJtLP6/NZ8p7Cgjno0CKGr7wwRJGxWUwh2IyhfAI=
-github.com/charmbracelet/colorprofile v0.3.3/go.mod h1:nB1FugsAbzq284eJcjfah2nhdSLppN2NqvfotkfRYP4=
+github.com/charmbracelet/colorprofile v0.4.1 h1:a1lO03qTrSIRaK8c3JRxJDZOvhvIeSco3ej+ngLk1kk=
+github.com/charmbracelet/colorprofile v0.4.1/go.mod h1:U1d9Dljmdf9DLegaJ0nGZNJvoXAhayhmidOdcBwAvKk=
 github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
 github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
-github.com/charmbracelet/x/ansi v0.11.1 h1:iXAC8SyMQDJgtcz9Jnw+HU8WMEctHzoTAETIeA3JXMk=
-github.com/charmbracelet/x/ansi v0.11.1/go.mod h1:M49wjzpIujwPceJ+t5w3qh2i87+HRtHohgb5iTyepL0=
-github.com/charmbracelet/x/cellbuf v0.0.14 h1:iUEMryGyFTelKW3THW4+FfPgi4fkmKnnaLOXuc+/Kj4=
-github.com/charmbracelet/x/cellbuf v0.0.14/go.mod h1:P447lJl49ywBbil/KjCk2HexGh4tEY9LH0/1QrZZ9rA=
+github.com/charmbracelet/x/ansi v0.11.5 h1:NBWeBpj/lJPE3Q5l+Lusa4+mH6v7487OP8K0r1IhRg4=
+github.com/charmbracelet/x/ansi v0.11.5/go.mod h1:2JNYLgQUsyqaiLovhU2Rv/pb8r6ydXKS3NIttu3VGZQ=
+github.com/charmbracelet/x/cellbuf v0.0.15 h1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI=
+github.com/charmbracelet/x/cellbuf v0.0.15/go.mod h1:J1YVbR7MUuEGIFPCaaZ96KDl5NoS0DAWkskup+mOY+Q=
+github.com/charmbracelet/x/exp/golden v0.0.0-20240806155701-69247e0abc2a h1:G99klV19u0QnhiizODirwVksQB91TJKV/UaTnACcG30=
+github.com/charmbracelet/x/exp/golden v0.0.0-20240806155701-69247e0abc2a/go.mod h1:wDlXFlCrmJ8J+swcL/MnGUuYnqgQdW9rhSD61oNMb6U=
 github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
 github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI=
-github.com/clipperhouse/displaywidth v0.6.0 h1:k32vueaksef9WIKCNcoqRNyKbyvkvkysNYnAWz2fN4s=
-github.com/clipperhouse/displaywidth v0.6.0/go.mod h1:R+kHuzaYWFkTm7xoMmK1lFydbci4X2CicfbGstSGg0o=
+github.com/clipperhouse/displaywidth v0.9.0 h1:Qb4KOhYwRiN3viMv1v/3cTBlz3AcAZX3+y9OLhMtAtA=
+github.com/clipperhouse/displaywidth v0.9.0/go.mod h1:aCAAqTlh4GIVkhQnJpbL0T/WfcrJXHcj8C0yjYcjOZA=
 github.com/clipperhouse/stringish v0.1.1 h1:+NSqMOr3GR6k1FdRhhnXrLfztGzuG+VuFDfatpWHKCs=
 github.com/clipperhouse/stringish v0.1.1/go.mod h1:v/WhFtE1q0ovMta2+m+UbpZ+2/HEXNWYXQgCt4hdOzA=
-github.com/clipperhouse/uax29/v2 v2.3.0 h1:SNdx9DVUqMoBuBoW3iLOj4FQv3dN5mDtuqwuhIGpJy4=
-github.com/clipperhouse/uax29/v2 v2.3.0/go.mod h1:Wn1g7MK6OoeDT0vL+Q0SQLDz/KpfsVRgg6W7ihQeh4g=
+github.com/clipperhouse/uax29/v2 v2.5.0 h1:x7T0T4eTHDONxFJsL94uKNKPHrclyFI0lm7+w94cO8U=
+github.com/clipperhouse/uax29/v2 v2.5.0/go.mod h1:Wn1g7MK6OoeDT0vL+Q0SQLDz/KpfsVRgg6W7ihQeh4g=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -35,51 +42,49 @@ github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sa
 github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-openapi/jsonpointer v0.22.3 h1:dKMwfV4fmt6Ah90zloTbUKWMD+0he+12XYAsPotrkn8=
-github.com/go-openapi/jsonpointer v0.22.3/go.mod h1:0lBbqeRsQ5lIanv3LHZBrmRGHLHcQoOXQnf88fHlGWo=
-github.com/go-openapi/jsonreference v0.21.3 h1:96Dn+MRPa0nYAR8DR1E03SblB5FJvh7W6krPI0Z7qMc=
-github.com/go-openapi/jsonreference v0.21.3/go.mod h1:RqkUP0MrLf37HqxZxrIAtTWW4ZJIK1VzduhXYBEeGc4=
-github.com/go-openapi/swag v0.25.3 h1:FAa5wJXyDtI7yUztKDfZxDrSx+8WTg31MfCQ9s3PV+s=
-github.com/go-openapi/swag v0.25.3/go.mod h1:tX9vI8Mj8Ny+uCEk39I1QADvIPI7lkndX4qCsEqhkS8=
-github.com/go-openapi/swag/cmdutils v0.25.3 h1:EIwGxN143JCThNHnqfqs85R8lJcJG06qjJRZp3VvjLI=
-github.com/go-openapi/swag/cmdutils v0.25.3/go.mod h1:pdae/AFo6WxLl5L0rq87eRzVPm/XRHM3MoYgRMvG4A0=
-github.com/go-openapi/swag/conv v0.25.3 h1:PcB18wwfba7MN5BVlBIV+VxvUUeC2kEuCEyJ2/t2X7E=
-github.com/go-openapi/swag/conv v0.25.3/go.mod h1:n4Ibfwhn8NJnPXNRhBO5Cqb9ez7alBR40JS4rbASUPU=
-github.com/go-openapi/swag/fileutils v0.25.3 h1:P52Uhd7GShkeU/a1cBOuqIcHMHBrA54Z2t5fLlE85SQ=
-github.com/go-openapi/swag/fileutils v0.25.3/go.mod h1:cdOT/PKbwcysVQ9Tpr0q20lQKH7MGhOEb6EwmHOirUk=
-github.com/go-openapi/swag/jsonname v0.25.3 h1:U20VKDS74HiPaLV7UZkztpyVOw3JNVsit+w+gTXRj0A=
-github.com/go-openapi/swag/jsonname v0.25.3/go.mod h1:GPVEk9CWVhNvWhZgrnvRA6utbAltopbKwDu8mXNUMag=
-github.com/go-openapi/swag/jsonutils v0.25.3 h1:kV7wer79KXUM4Ea4tBdAVTU842Rg6tWstX3QbM4fGdw=
-github.com/go-openapi/swag/jsonutils v0.25.3/go.mod h1:ILcKqe4HC1VEZmJx51cVuZQ6MF8QvdfXsQfiaCs0z9o=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.3 h1:/i3E9hBujtXfHy91rjtwJ7Fgv5TuDHgnSrYjhFxwxOw=
-github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.3/go.mod h1:8kYfCR2rHyOj25HVvxL5Nm8wkfzggddgjZm6RgjT8Ao=
-github.com/go-openapi/swag/loading v0.25.3 h1:Nn65Zlzf4854MY6Ft0JdNrtnHh2bdcS/tXckpSnOb2Y=
-github.com/go-openapi/swag/loading v0.25.3/go.mod h1:xajJ5P4Ang+cwM5gKFrHBgkEDWfLcsAKepIuzTmOb/c=
-github.com/go-openapi/swag/mangling v0.25.3 h1:rGIrEzXaYWuUW1MkFmG3pcH+EIA0/CoUkQnIyB6TUyo=
-github.com/go-openapi/swag/mangling v0.25.3/go.mod h1:6dxwu6QyORHpIIApsdZgb6wBk/DPU15MdyYj/ikn0Hg=
-github.com/go-openapi/swag/netutils v0.25.3 h1:XWXHZfL/65ABiv8rvGp9dtE0C6QHTYkCrNV77jTl358=
-github.com/go-openapi/swag/netutils v0.25.3/go.mod h1:m2W8dtdaoX7oj9rEttLyTeEFFEBvnAx9qHd5nJEBzYg=
-github.com/go-openapi/swag/stringutils v0.25.3 h1:nAmWq1fUTWl/XiaEPwALjp/8BPZJun70iDHRNq/sH6w=
-github.com/go-openapi/swag/stringutils v0.25.3/go.mod h1:GTsRvhJW5xM5gkgiFe0fV3PUlFm0dr8vki6/VSRaZK0=
-github.com/go-openapi/swag/typeutils v0.25.3 h1:2w4mEEo7DQt3V4veWMZw0yTPQibiL3ri2fdDV4t2TQc=
-github.com/go-openapi/swag/typeutils v0.25.3/go.mod h1:Ou7g//Wx8tTLS9vG0UmzfCsjZjKhpjxayRKTHXf2pTE=
-github.com/go-openapi/swag/yamlutils v0.25.3 h1:LKTJjCn/W1ZfMec0XDL4Vxh8kyAnv1orH5F2OREDUrg=
-github.com/go-openapi/swag/yamlutils v0.25.3/go.mod h1:Y7QN6Wc5DOBXK14/xeo1cQlq0EA0wvLoSv13gDQoCao=
+github.com/go-openapi/jsonpointer v0.22.4 h1:dZtK82WlNpVLDW2jlA1YCiVJFVqkED1MegOUy9kR5T4=
+github.com/go-openapi/jsonpointer v0.22.4/go.mod h1:elX9+UgznpFhgBuaMQ7iu4lvvX1nvNsesQ3oxmYTw80=
+github.com/go-openapi/jsonreference v0.21.4 h1:24qaE2y9bx/q3uRK/qN+TDwbok1NhbSmGjjySRCHtC8=
+github.com/go-openapi/jsonreference v0.21.4/go.mod h1:rIENPTjDbLpzQmQWCj5kKj3ZlmEh+EFVbz3RTUh30/4=
+github.com/go-openapi/swag v0.25.4 h1:OyUPUFYDPDBMkqyxOTkqDYFnrhuhi9NR6QVUvIochMU=
+github.com/go-openapi/swag v0.25.4/go.mod h1:zNfJ9WZABGHCFg2RnY0S4IOkAcVTzJ6z2Bi+Q4i6qFQ=
+github.com/go-openapi/swag/cmdutils v0.25.4 h1:8rYhB5n6WawR192/BfUu2iVlxqVR9aRgGJP6WaBoW+4=
+github.com/go-openapi/swag/cmdutils v0.25.4/go.mod h1:pdae/AFo6WxLl5L0rq87eRzVPm/XRHM3MoYgRMvG4A0=
+github.com/go-openapi/swag/conv v0.25.4 h1:/Dd7p0LZXczgUcC/Ikm1+YqVzkEeCc9LnOWjfkpkfe4=
+github.com/go-openapi/swag/conv v0.25.4/go.mod h1:3LXfie/lwoAv0NHoEuY1hjoFAYkvlqI/Bn5EQDD3PPU=
+github.com/go-openapi/swag/fileutils v0.25.4 h1:2oI0XNW5y6UWZTC7vAxC8hmsK/tOkWXHJQH4lKjqw+Y=
+github.com/go-openapi/swag/fileutils v0.25.4/go.mod h1:cdOT/PKbwcysVQ9Tpr0q20lQKH7MGhOEb6EwmHOirUk=
+github.com/go-openapi/swag/jsonname v0.25.4 h1:bZH0+MsS03MbnwBXYhuTttMOqk+5KcQ9869Vye1bNHI=
+github.com/go-openapi/swag/jsonname v0.25.4/go.mod h1:GPVEk9CWVhNvWhZgrnvRA6utbAltopbKwDu8mXNUMag=
+github.com/go-openapi/swag/jsonutils v0.25.4 h1:VSchfbGhD4UTf4vCdR2F4TLBdLwHyUDTd1/q4i+jGZA=
+github.com/go-openapi/swag/jsonutils v0.25.4/go.mod h1:7OYGXpvVFPn4PpaSdPHJBtF0iGnbEaTk8AvBkoWnaAY=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4 h1:IACsSvBhiNJwlDix7wq39SS2Fh7lUOCJRmx/4SN4sVo=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.25.4/go.mod h1:Mt0Ost9l3cUzVv4OEZG+WSeoHwjWLnarzMePNDAOBiM=
+github.com/go-openapi/swag/loading v0.25.4 h1:jN4MvLj0X6yhCDduRsxDDw1aHe+ZWoLjW+9ZQWIKn2s=
+github.com/go-openapi/swag/loading v0.25.4/go.mod h1:rpUM1ZiyEP9+mNLIQUdMiD7dCETXvkkC30z53i+ftTE=
+github.com/go-openapi/swag/mangling v0.25.4 h1:2b9kBJk9JvPgxr36V23FxJLdwBrpijI26Bx5JH4Hp48=
+github.com/go-openapi/swag/mangling v0.25.4/go.mod h1:6dxwu6QyORHpIIApsdZgb6wBk/DPU15MdyYj/ikn0Hg=
+github.com/go-openapi/swag/netutils v0.25.4 h1:Gqe6K71bGRb3ZQLusdI8p/y1KLgV4M/k+/HzVSqT8H0=
+github.com/go-openapi/swag/netutils v0.25.4/go.mod h1:m2W8dtdaoX7oj9rEttLyTeEFFEBvnAx9qHd5nJEBzYg=
+github.com/go-openapi/swag/stringutils v0.25.4 h1:O6dU1Rd8bej4HPA3/CLPciNBBDwZj9HiEpdVsb8B5A8=
+github.com/go-openapi/swag/stringutils v0.25.4/go.mod h1:GTsRvhJW5xM5gkgiFe0fV3PUlFm0dr8vki6/VSRaZK0=
+github.com/go-openapi/swag/typeutils v0.25.4 h1:1/fbZOUN472NTc39zpa+YGHn3jzHWhv42wAJSN91wRw=
+github.com/go-openapi/swag/typeutils v0.25.4/go.mod h1:Ou7g//Wx8tTLS9vG0UmzfCsjZjKhpjxayRKTHXf2pTE=
+github.com/go-openapi/swag/yamlutils v0.25.4 h1:6jdaeSItEUb7ioS9lFoCZ65Cne1/RZtPBZ9A56h92Sw=
+github.com/go-openapi/swag/yamlutils v0.25.4/go.mod h1:MNzq1ulQu+yd8Kl7wPOut/YHAAU/H6hL91fF+E2RFwc=
 github.com/go-openapi/testify/enable/yaml/v2 v2.0.2 h1:0+Y41Pz1NkbTHz8NngxTuAXxEodtNSI1WG1c/m5Akw4=
 github.com/go-openapi/testify/enable/yaml/v2 v2.0.2/go.mod h1:kme83333GCtJQHXQ8UKX3IBZu6z8T5Dvy5+CW3NLUUg=
 github.com/go-openapi/testify/v2 v2.0.2 h1:X999g3jeLcoY8qctY/c/Z8iBHTbwLz7R2WXd6Ub6wls=
 github.com/go-openapi/testify/v2 v2.0.2/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
-github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
-github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/google/gnostic-models v0.7.1 h1:SisTfuFKJSKM5CPZkffwi6coztzzeYUhc3v4yxLWH8c=
 github.com/google/gnostic-models v0.7.1/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
-github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
+github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
@@ -88,8 +93,6 @@ github.com/grandcat/zeroconf v1.0.0 h1:uHhahLBKqwWBV6WZUDAT71044vwOTL+McW0mBJvo6
 github.com/grandcat/zeroconf v1.0.0/go.mod h1:lTKmG1zh86XyCoUeIHSA4FJMBwCJiQmGfcP2PdzytEs=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -103,8 +106,8 @@ github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+Ei
 github.com/mattn/go-runewidth v0.0.19 h1:v++JhqYnZuu5jSKrk9RbgF5v4CGUjqRfBm05byFGLdw=
 github.com/mattn/go-runewidth v0.0.19/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/miekg/dns v1.1.27/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7xM=
-github.com/miekg/dns v1.1.68 h1:jsSRkNozw7G/mnmXULynzMNIsgY2dHC8LO6U6Ij2JEA=
-github.com/miekg/dns v1.1.68/go.mod h1:fujopn7TB3Pu3JM69XaawiU0wqjpL9/8xGop5UrTPps=
+github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
+github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
 github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
 github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -123,10 +126,10 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
-github.com/onsi/ginkgo/v2 v2.21.0 h1:7rg/4f3rB88pb5obDgNZrNHrQ4e6WpjonchcpuBRnZM=
-github.com/onsi/ginkgo/v2 v2.21.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
-github.com/onsi/gomega v1.35.1 h1:Cwbd75ZBPxFSuZ6T+rN/WCb/gOc6YgFBXLlZLhC7Ds4=
-github.com/onsi/gomega v1.35.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
+github.com/onsi/ginkgo/v2 v2.27.2 h1:LzwLj0b89qtIy6SSASkzlNvX6WktqurSHwkk2ipF/Ns=
+github.com/onsi/ginkgo/v2 v2.27.2/go.mod h1:ArE1D/XhNXBXCBkKOLkbsb2c81dQHCRcF5zwn/ykDRo=
+github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
+github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -147,66 +150,48 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
-github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
 go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk=
-golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
+golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
+golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
-golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
-golang.org/x/oauth2 v0.33.0 h1:4Q+qn+E5z8gPRJfmRy7C2gGG3T4jIprK6aSYgTXGRpo=
-golang.org/x/oauth2 v0.33.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
+golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
+golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
+golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
-golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
-golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
-golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
+golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
+golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY=
+golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
-golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
+golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191216052735-49a3e744a425/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ=
-golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
+golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
-google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -216,18 +201,18 @@ gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.34.2 h1:fsSUNZhV+bnL6Aqrp6O7lMTy6o5x2C4XLjnh//8SLYY=
-k8s.io/api v0.34.2/go.mod h1:MMBPaWlED2a8w4RSeanD76f7opUoypY8TFYkSM+3XHw=
-k8s.io/apimachinery v0.34.2 h1:zQ12Uk3eMHPxrsbUJgNF8bTauTVR2WgqJsTmwTE/NW4=
-k8s.io/apimachinery v0.34.2/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
-k8s.io/client-go v0.34.2 h1:Co6XiknN+uUZqiddlfAjT68184/37PS4QAzYvQvDR8M=
-k8s.io/client-go v0.34.2/go.mod h1:2VYDl1XXJsdcAxw7BenFslRQX28Dxz91U9MWKjX97fE=
+k8s.io/api v0.35.0 h1:iBAU5LTyBI9vw3L5glmat1njFK34srdLmktWwLTprlY=
+k8s.io/api v0.35.0/go.mod h1:AQ0SNTzm4ZAczM03QH42c7l3bih1TbAXYo0DkF8ktnA=
+k8s.io/apimachinery v0.35.0 h1:Z2L3IHvPVv/MJ7xRxHEtk6GoJElaAqDCCU0S6ncYok8=
+k8s.io/apimachinery v0.35.0/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
+k8s.io/client-go v0.35.0 h1:IAW0ifFbfQQwQmga0UdoH0yvdqrbwMdq9vIFEhRpxBE=
+k8s.io/client-go v0.35.0/go.mod h1:q2E5AAyqcbeLGPdoRB+Nxe3KYTfPce1Dnu1myQdqz9o=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-k8s.io/kube-openapi v0.0.0-20251125145642-4e65d59e963e h1:iW9ChlU0cU16w8MpVYjXk12dqQ4BPFBEgif+ap7/hqQ=
-k8s.io/kube-openapi v0.0.0-20251125145642-4e65d59e963e/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
-k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzkbzn+gDM4X9T4Ck=
-k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4 h1:HhDfevmPS+OalTjQRKbTHppRIz01AWi8s45TMXStgYY=
+k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
+k8s.io/utils v0.0.0-20260108192941-914a6e750570 h1:JT4W8lsdrGENg9W+YwwdLJxklIuKWdRm+BC+xt33FOY=
+k8s.io/utils v0.0.0-20260108192941-914a6e750570/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
@@ -1,3 +1,14 @@
+// Package benchmark provides HTTP benchmarking capabilities for port forwards.
+// It measures latency, throughput, and reliability of forwarded connections.
+//
+// The benchmark runner sends configurable numbers of concurrent requests
+// and collects statistics including:
+//   - Latency percentiles (P50, P95, P99)
+//   - Request success/failure rates
+//   - Throughput (requests/second)
+//   - Status code distribution
+//
+// Results can be displayed in the UI or exported for analysis.
 package benchmark

 import (
@@ -7,17 +18,17 @@ import (

 // Results holds the aggregated results of a benchmark run
 type Results struct {
-	ForwardID     string          `json:"forward_id"`
-	URL           string          `json:"url"`
-	Method        string          `json:"method"`
 	StartTime     time.Time       `json:"start_time"`
 	EndTime       time.Time       `json:"end_time"`
+	StatusCodes   map[int]int     `json:"status_codes"`
+	Errors        map[string]int  `json:"errors,omitempty"`
+	Method        string          `json:"method"`
+	URL           string          `json:"url"`
+	ForwardID     string          `json:"forward_id"`
+	Latencies     []time.Duration `json:"-"`
 	TotalRequests int             `json:"total_requests"`
 	Successful    int             `json:"successful"`
 	Failed        int             `json:"failed"`
-	Latencies     []time.Duration `json:"-"` // Raw latencies for percentile calculation
-	StatusCodes   map[int]int     `json:"status_codes"`
-	Errors        map[string]int  `json:"errors,omitempty"`
 	BytesRead     int64           `json:"bytes_read"`
 	BytesWritten  int64           `json:"bytes_written"`
 }
@@ -16,25 +16,15 @@ type ProgressCallback func(completed, total int)

 // Config holds the benchmark configuration
 type Config struct {
-	URL              string            // Target URL
-	Method           string            // HTTP method
-	Headers          map[string]string // Custom headers
-	Body             []byte            // Request body
-	Concurrency      int               // Number of concurrent workers
-	Requests         int               // Total number of requests (0 = use duration)
-	Duration         time.Duration     // Duration to run (0 = use requests)
-	Timeout          time.Duration     // Request timeout
-	ProgressCallback ProgressCallback  // Optional callback for progress updates
-}
-
-// DefaultConfig returns a default benchmark configuration
-func DefaultConfig() Config {
-	return Config{
-		Method:      "GET",
-		Concurrency: 10,
-		Requests:    100,
-		Timeout:     30 * time.Second,
-	}
+	Headers          map[string]string
+	ProgressCallback ProgressCallback
+	URL              string
+	Method           string
+	Body             []byte
+	Concurrency      int
+	Requests         int
+	Duration         time.Duration
+	Timeout          time.Duration
 }

 // Runner executes HTTP benchmarks
@@ -221,10 +211,3 @@ func (r *Runner) makeRequest(ctx context.Context, cfg Config) (statusCode int, b

 	return resp.StatusCode, int64(len(respBody)), bytesWritten, nil
 }
-
-// Progress represents the current progress of a benchmark run
-type Progress struct {
-	Completed int
-	Total     int
-	Elapsed   time.Duration
-}
@@ -106,7 +106,7 @@ func TestRunner(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		time.Sleep(5 * time.Millisecond) // Simulate some latency
 		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(`{"status":"ok"}`))
+		_, _ = w.Write([]byte(`{"status":"ok"}`))
 	}))
 	defer server.Close()

@@ -132,7 +132,7 @@ func TestRunner(t *testing.T) {
 func TestRunnerWithDuration(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(`ok`))
+		_, _ = w.Write([]byte(`ok`))
 	}))
 	defer server.Close()

@@ -206,20 +206,11 @@ func TestRunnerWithBody(t *testing.T) {
 	assert.Equal(t, int64(15), results.BytesWritten)
 }

-func TestDefaultConfig(t *testing.T) {
-	cfg := DefaultConfig()
-
-	assert.Equal(t, "GET", cfg.Method)
-	assert.Equal(t, 10, cfg.Concurrency)
-	assert.Equal(t, 100, cfg.Requests)
-	assert.Equal(t, 30*time.Second, cfg.Timeout)
-}
-
 func TestRunnerWithProgressCallback(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		time.Sleep(10 * time.Millisecond) // Add small delay so progress ticker can fire
 		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(`ok`))
+		_, _ = w.Write([]byte(`ok`))
 	}))
 	defer server.Close()

@@ -1,7 +1,29 @@
+// Package config provides configuration loading, validation, watching, and
+// mutation for kportal. It handles parsing the .kportal.yaml configuration
+// file and provides hot-reload support via file watching.
+//
+// The configuration structure supports multiple Kubernetes contexts, each
+// with namespaces containing port-forward definitions. Additional settings
+// for health checks, reliability, and mDNS hostname publishing are also
+// supported.
+//
+// Basic usage:
+//
+//	cfg, err := config.Load("~/.kportal.yaml")
+//	if err != nil {
+//	    log.Fatal(err)
+//	}
+//
+// For hot-reload support, use the ConfigWatcher:
+//
+//	watcher, err := config.NewConfigWatcher(path, func(cfg *config.Config) {
+//	    // Handle configuration changes
+//	})
 package config

 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"os"
 	"strings"
@@ -10,6 +32,9 @@ import (
 	"gopkg.in/yaml.v3"
 )

+// ErrConfigNotFound is returned when the configuration file does not exist
+var ErrConfigNotFound = fmt.Errorf("config file not found")
+
 const (
 	// maxConfigSize is the maximum allowed configuration file size (10MB)
 	maxConfigSize = 10 * 1024 * 1024
@@ -32,10 +57,10 @@ const (

 // Config represents the root configuration structure from .kportal.yaml
 type Config struct {
-	Contexts    []Context        `yaml:"contexts"`
 	HealthCheck *HealthCheckSpec `yaml:"healthCheck,omitempty"`
 	Reliability *ReliabilitySpec `yaml:"reliability,omitempty"`
 	MDNS        *MDNSSpec        `yaml:"mdns,omitempty"`
+	Contexts    []Context        `yaml:"contexts"`
 }

 // MDNSSpec configures mDNS (multicast DNS) hostname publishing
@@ -55,10 +80,10 @@ type HealthCheckSpec struct {

 // ReliabilitySpec configures connection reliability features
 type ReliabilitySpec struct {
-	TCPKeepalive   string `yaml:"tcpKeepalive,omitempty"`   // e.g., "30s" - OS-level keepalive
-	DialTimeout    string `yaml:"dialTimeout,omitempty"`    // e.g., "30s" - connection dial timeout
-	RetryOnStale   bool   `yaml:"retryOnStale,omitempty"`   // Auto-reconnect on stale detection
-	WatchdogPeriod string `yaml:"watchdogPeriod,omitempty"` // e.g., "30s" - goroutine watchdog interval
+	TCPKeepalive   string `yaml:"tcpKeepalive,omitempty"`
+	DialTimeout    string `yaml:"dialTimeout,omitempty"`
+	WatchdogPeriod string `yaml:"watchdogPeriod,omitempty"`
+	RetryOnStale   bool   `yaml:"retryOnStale,omitempty"`
 }

 // parseDurationOrDefault parses a duration string and returns the default if empty or invalid.
@@ -163,11 +188,11 @@ type Namespace struct {

 // HTTPLogSpec configures HTTP traffic logging for a forward
 type HTTPLogSpec struct {
-	Enabled        bool   `yaml:"enabled"`                  // Enable HTTP logging
-	LogFile        string `yaml:"logFile,omitempty"`        // Output file (empty = stdout)
-	MaxBodySize    int    `yaml:"maxBodySize,omitempty"`    // Max body size to log (default 1MB)
-	IncludeHeaders bool   `yaml:"includeHeaders,omitempty"` // Include headers in log
-	FilterPath     string `yaml:"filterPath,omitempty"`     // Optional glob filter for paths
+	LogFile        string `yaml:"logFile,omitempty"`
+	FilterPath     string `yaml:"filterPath,omitempty"`
+	MaxBodySize    int    `yaml:"maxBodySize,omitempty"`
+	Enabled        bool   `yaml:"enabled"`
+	IncludeHeaders bool   `yaml:"includeHeaders,omitempty"`
 }

 // UnmarshalYAML implements custom unmarshaling to support both bool and struct formats
@@ -192,17 +217,15 @@ func (h *HTTPLogSpec) UnmarshalYAML(unmarshal func(interface{}) error) error {

 // Forward represents a single port-forward configuration
 type Forward struct {
-	Resource  string       `yaml:"resource"`          // e.g., "pod/my-app", "service/postgres", "pod"
-	Selector  string       `yaml:"selector"`          // Label selector for pod resolution (e.g., "app=nginx,env=prod")
-	Protocol  string       `yaml:"protocol"`          // tcp or udp
-	Port      int          `yaml:"port"`              // Remote port
-	LocalPort int          `yaml:"localPort"`         // Local port
-	Alias     string       `yaml:"alias,omitempty"`   // Optional human-readable alias for this forward
-	HTTPLog   *HTTPLogSpec `yaml:"httpLog,omitempty"` // Optional HTTP traffic logging
-
-	// Runtime fields (not in YAML)
+	HTTPLog       *HTTPLogSpec `yaml:"httpLog,omitempty"`
+	Resource      string       `yaml:"resource"`
+	Selector      string       `yaml:"selector"`
+	Protocol      string       `yaml:"protocol"`
+	Alias         string       `yaml:"alias,omitempty"`
 	contextName   string
 	namespaceName string
+	Port          int `yaml:"port"`
+	LocalPort     int `yaml:"localPort"`
 }

 // ID returns a unique identifier for this forward configuration.
@@ -282,6 +305,9 @@ func LoadConfig(path string) (*Config, error) {
 	// Validate file size before reading
 	fileInfo, err := os.Stat(path)
 	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return nil, ErrConfigNotFound
+		}
 		return nil, fmt.Errorf("failed to stat config file: %w", err)
 	}

@@ -289,6 +315,7 @@ func LoadConfig(path string) (*Config, error) {
 		return nil, fmt.Errorf("config file too large: %d bytes (max %d)", fileInfo.Size(), maxConfigSize)
 	}

+	// #nosec G304 -- path is validated in main.go (no system dirs, absolute path)
 	data, err := os.ReadFile(path)
 	if err != nil {
 		return nil, fmt.Errorf("failed to read config file: %w", err)
@@ -337,3 +364,58 @@ func (c *Config) GetAllForwards() []Forward {

 	return forwards
 }
+
+// NewEmptyConfig returns a minimal empty configuration with no forwards.
+// This is used when creating a new config file for the first time.
+func NewEmptyConfig() *Config {
+	return &Config{
+		Contexts: []Context{},
+	}
+}
+
+// IsEmpty returns true if the configuration has no forwards defined.
+func (c *Config) IsEmpty() bool {
+	return len(c.Contexts) == 0 || len(c.GetAllForwards()) == 0
+}
+
+// CreateEmptyConfigFile creates a new empty configuration file at the given path.
+// Returns an error if the file already exists or cannot be created.
+func CreateEmptyConfigFile(path string) error {
+	// Check if file already exists
+	if _, err := os.Stat(path); err == nil {
+		return fmt.Errorf("config file already exists: %s", path)
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("failed to check config file: %w", err)
+	}
+
+	cfg := NewEmptyConfig()
+	data, err := yaml.Marshal(cfg)
+	if err != nil {
+		return fmt.Errorf("failed to marshal empty config: %w", err)
+	}
+
+	// Add a helpful comment header
+	header := `# kportal configuration file
+# Add port forwards using the 'n' key in the TUI, or manually add them below.
+#
+# Example forward:
+#   contexts:
+#     - name: my-cluster
+#       namespaces:
+#         - name: default
+#           forwards:
+#             - resource: service/my-service
+#               protocol: tcp
+#               port: 8080
+#               localPort: 8080
+#
+`
+	content := header + string(data)
+
+	// Write with restrictive permissions (0600)
+	if err := os.WriteFile(path, []byte(content), 0600); err != nil {
+		return fmt.Errorf("failed to write config file: %w", err)
+	}
+
+	return nil
+}
@@ -0,0 +1,703 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestParseDurationOrDefault tests the duration parsing helper
+func TestParseDurationOrDefault(t *testing.T) {
+	tests := []struct {
+		name       string
+		value      string
+		defaultDur time.Duration
+		expected   time.Duration
+	}{
+		{"empty string returns default", "", 5 * time.Second, 5 * time.Second},
+		{"valid duration seconds", "3s", 5 * time.Second, 3 * time.Second},
+		{"valid duration minutes", "25m", 5 * time.Second, 25 * time.Minute},
+		{"valid duration hours", "1h", 5 * time.Second, 1 * time.Hour},
+		{"valid duration milliseconds", "100ms", 5 * time.Second, 100 * time.Millisecond},
+		{"invalid duration returns default", "invalid", 5 * time.Second, 5 * time.Second},
+		{"missing unit returns default", "30", 5 * time.Second, 5 * time.Second},
+		{"negative duration", "-5s", 5 * time.Second, -5 * time.Second}, // time.ParseDuration accepts negative
+		{"complex duration", "1h30m", 5 * time.Second, 1*time.Hour + 30*time.Minute},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := parseDurationOrDefault(tt.value, tt.defaultDur)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestConfig_GetHealthCheckIntervalOrDefault tests health check interval getter
+func TestConfig_GetHealthCheckIntervalOrDefault(t *testing.T) {
+	tests := []struct {
+		config   *Config
+		name     string
+		expected time.Duration
+	}{
+		{
+			name:     "nil health check returns default",
+			config:   &Config{},
+			expected: DefaultHealthCheckInterval,
+		},
+		{
+			name: "empty interval returns default",
+			config: &Config{
+				HealthCheck: &HealthCheckSpec{},
+			},
+			expected: DefaultHealthCheckInterval,
+		},
+		{
+			name: "valid interval",
+			config: &Config{
+				HealthCheck: &HealthCheckSpec{Interval: "5s"},
+			},
+			expected: 5 * time.Second,
+		},
+		{
+			name: "invalid interval returns default",
+			config: &Config{
+				HealthCheck: &HealthCheckSpec{Interval: "invalid"},
+			},
+			expected: DefaultHealthCheckInterval,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.config.GetHealthCheckIntervalOrDefault()
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestConfig_GetHealthCheckTimeoutOrDefault tests health check timeout getter
+func TestConfig_GetHealthCheckTimeoutOrDefault(t *testing.T) {
+	tests := []struct {
+		config   *Config
+		name     string
+		expected time.Duration
+	}{
+		{
+			name:     "nil health check returns default",
+			config:   &Config{},
+			expected: DefaultHealthCheckTimeout,
+		},
+		{
+			name: "empty timeout returns default",
+			config: &Config{
+				HealthCheck: &HealthCheckSpec{},
+			},
+			expected: DefaultHealthCheckTimeout,
+		},
+		{
+			name: "valid timeout",
+			config: &Config{
+				HealthCheck: &HealthCheckSpec{Timeout: "1s"},
+			},
+			expected: 1 * time.Second,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.config.GetHealthCheckTimeoutOrDefault()
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestConfig_GetHealthCheckMethod tests health check method getter
+func TestConfig_GetHealthCheckMethod(t *testing.T) {
+	tests := []struct {
+		name     string
+		config   *Config
+		expected string
+	}{
+		{
+			name:     "nil health check returns default",
+			config:   &Config{},
+			expected: DefaultHealthCheckMethod,
+		},
+		{
+			name: "empty method returns default",
+			config: &Config{
+				HealthCheck: &HealthCheckSpec{},
+			},
+			expected: DefaultHealthCheckMethod,
+		},
+		{
+			name: "tcp-dial method",
+			config: &Config{
+				HealthCheck: &HealthCheckSpec{Method: "tcp-dial"},
+			},
+			expected: "tcp-dial",
+		},
+		{
+			name: "data-transfer method",
+			config: &Config{
+				HealthCheck: &HealthCheckSpec{Method: "data-transfer"},
+			},
+			expected: "data-transfer",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.config.GetHealthCheckMethod()
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestConfig_GetMaxConnectionAge tests max connection age getter
+func TestConfig_GetMaxConnectionAge(t *testing.T) {
+	tests := []struct {
+		config   *Config
+		name     string
+		expected time.Duration
+	}{
+		{
+			name:     "nil health check returns default",
+			config:   &Config{},
+			expected: DefaultMaxConnectionAge,
+		},
+		{
+			name: "empty max age returns default",
+			config: &Config{
+				HealthCheck: &HealthCheckSpec{},
+			},
+			expected: DefaultMaxConnectionAge,
+		},
+		{
+			name: "valid max age",
+			config: &Config{
+				HealthCheck: &HealthCheckSpec{MaxConnectionAge: "20m"},
+			},
+			expected: 20 * time.Minute,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.config.GetMaxConnectionAge()
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestConfig_GetMaxIdleTime tests max idle time getter
+func TestConfig_GetMaxIdleTime(t *testing.T) {
+	tests := []struct {
+		config   *Config
+		name     string
+		expected time.Duration
+	}{
+		{
+			name:     "nil health check returns default",
+			config:   &Config{},
+			expected: DefaultMaxIdleTime,
+		},
+		{
+			name: "empty max idle returns default",
+			config: &Config{
+				HealthCheck: &HealthCheckSpec{},
+			},
+			expected: DefaultMaxIdleTime,
+		},
+		{
+			name: "valid max idle",
+			config: &Config{
+				HealthCheck: &HealthCheckSpec{MaxIdleTime: "5m"},
+			},
+			expected: 5 * time.Minute,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.config.GetMaxIdleTime()
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestConfig_GetTCPKeepalive tests TCP keepalive getter
+func TestConfig_GetTCPKeepalive(t *testing.T) {
+	tests := []struct {
+		config   *Config
+		name     string
+		expected time.Duration
+	}{
+		{
+			name:     "nil reliability returns default",
+			config:   &Config{},
+			expected: DefaultTCPKeepalive,
+		},
+		{
+			name: "empty keepalive returns default",
+			config: &Config{
+				Reliability: &ReliabilitySpec{},
+			},
+			expected: DefaultTCPKeepalive,
+		},
+		{
+			name: "valid keepalive",
+			config: &Config{
+				Reliability: &ReliabilitySpec{TCPKeepalive: "15s"},
+			},
+			expected: 15 * time.Second,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.config.GetTCPKeepalive()
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestConfig_GetRetryOnStale tests retry on stale getter
+func TestConfig_GetRetryOnStale(t *testing.T) {
+	tests := []struct {
+		config   *Config
+		name     string
+		expected bool
+	}{
+		{
+			name:     "nil reliability returns default true",
+			config:   &Config{},
+			expected: true,
+		},
+		{
+			name: "explicit false",
+			config: &Config{
+				Reliability: &ReliabilitySpec{RetryOnStale: false},
+			},
+			expected: false,
+		},
+		{
+			name: "explicit true",
+			config: &Config{
+				Reliability: &ReliabilitySpec{RetryOnStale: true},
+			},
+			expected: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.config.GetRetryOnStale()
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestConfig_GetWatchdogPeriod tests watchdog period getter
+func TestConfig_GetWatchdogPeriod(t *testing.T) {
+	tests := []struct {
+		config   *Config
+		name     string
+		expected time.Duration
+	}{
+		{
+			name:     "nil reliability returns default",
+			config:   &Config{},
+			expected: DefaultWatchdogPeriod,
+		},
+		{
+			name: "empty period returns default",
+			config: &Config{
+				Reliability: &ReliabilitySpec{},
+			},
+			expected: DefaultWatchdogPeriod,
+		},
+		{
+			name: "valid period",
+			config: &Config{
+				Reliability: &ReliabilitySpec{WatchdogPeriod: "1m"},
+			},
+			expected: 1 * time.Minute,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.config.GetWatchdogPeriod()
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestConfig_GetDialTimeout tests dial timeout getter
+func TestConfig_GetDialTimeout(t *testing.T) {
+	tests := []struct {
+		config   *Config
+		name     string
+		expected time.Duration
+	}{
+		{
+			name:     "nil reliability returns default",
+			config:   &Config{},
+			expected: DefaultDialTimeout,
+		},
+		{
+			name: "empty timeout returns default",
+			config: &Config{
+				Reliability: &ReliabilitySpec{},
+			},
+			expected: DefaultDialTimeout,
+		},
+		{
+			name: "valid timeout",
+			config: &Config{
+				Reliability: &ReliabilitySpec{DialTimeout: "10s"},
+			},
+			expected: 10 * time.Second,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.config.GetDialTimeout()
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestConfig_IsMDNSEnabled tests mDNS enabled getter
+func TestConfig_IsMDNSEnabled(t *testing.T) {
+	tests := []struct {
+		config   *Config
+		name     string
+		expected bool
+	}{
+		{
+			name:     "nil MDNS returns false",
+			config:   &Config{},
+			expected: false,
+		},
+		{
+			name: "MDNS disabled",
+			config: &Config{
+				MDNS: &MDNSSpec{Enabled: false},
+			},
+			expected: false,
+		},
+		{
+			name: "MDNS enabled",
+			config: &Config{
+				MDNS: &MDNSSpec{Enabled: true},
+			},
+			expected: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.config.IsMDNSEnabled()
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestForward_IsHTTPLogEnabled tests HTTP log enabled check
+func TestForward_IsHTTPLogEnabled(t *testing.T) {
+	tests := []struct {
+		name     string
+		forward  Forward
+		expected bool
+	}{
+		{
+			name:     "nil HTTPLog",
+			forward:  Forward{Resource: "pod/app", Port: 8080, LocalPort: 8080},
+			expected: false,
+		},
+		{
+			name: "HTTPLog disabled",
+			forward: Forward{
+				Resource:  "pod/app",
+				Port:      8080,
+				LocalPort: 8080,
+				HTTPLog:   &HTTPLogSpec{Enabled: false},
+			},
+			expected: false,
+		},
+		{
+			name: "HTTPLog enabled",
+			forward: Forward{
+				Resource:  "pod/app",
+				Port:      8080,
+				LocalPort: 8080,
+				HTTPLog:   &HTTPLogSpec{Enabled: true},
+			},
+			expected: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.forward.IsHTTPLogEnabled()
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestForward_GetHTTPLogMaxBodySize tests HTTP log max body size
+func TestForward_GetHTTPLogMaxBodySize(t *testing.T) {
+	tests := []struct {
+		name     string
+		forward  Forward
+		expected int
+	}{
+		{
+			name:     "nil HTTPLog returns default",
+			forward:  Forward{Resource: "pod/app", Port: 8080, LocalPort: 8080},
+			expected: DefaultHTTPLogMaxBodySize,
+		},
+		{
+			name: "zero max body size returns default",
+			forward: Forward{
+				Resource:  "pod/app",
+				Port:      8080,
+				LocalPort: 8080,
+				HTTPLog:   &HTTPLogSpec{MaxBodySize: 0},
+			},
+			expected: DefaultHTTPLogMaxBodySize,
+		},
+		{
+			name: "negative max body size returns default",
+			forward: Forward{
+				Resource:  "pod/app",
+				Port:      8080,
+				LocalPort: 8080,
+				HTTPLog:   &HTTPLogSpec{MaxBodySize: -100},
+			},
+			expected: DefaultHTTPLogMaxBodySize,
+		},
+		{
+			name: "custom max body size",
+			forward: Forward{
+				Resource:  "pod/app",
+				Port:      8080,
+				LocalPort: 8080,
+				HTTPLog:   &HTTPLogSpec{MaxBodySize: 2048},
+			},
+			expected: 2048,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.forward.GetHTTPLogMaxBodySize()
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestForward_GetMDNSAlias tests mDNS alias generation
+func TestForward_GetMDNSAlias(t *testing.T) {
+	tests := []struct {
+		name     string
+		expected string
+		forward  Forward
+	}{
+		{
+			name: "explicit alias",
+			forward: Forward{
+				Resource:  "pod/my-app",
+				Port:      8080,
+				LocalPort: 8080,
+				Alias:     "my-custom-alias",
+			},
+			expected: "my-custom-alias",
+		},
+		{
+			name: "pod with name - extracts name",
+			forward: Forward{
+				Resource:  "pod/my-app",
+				Port:      8080,
+				LocalPort: 8080,
+			},
+			expected: "my-app",
+		},
+		{
+			name: "service with name - extracts name",
+			forward: Forward{
+				Resource:  "service/postgres",
+				Port:      5432,
+				LocalPort: 5432,
+			},
+			expected: "postgres",
+		},
+		{
+			name: "pod without name (selector-based) - returns empty",
+			forward: Forward{
+				Resource:  "pod",
+				Selector:  "app=nginx",
+				Port:      80,
+				LocalPort: 8080,
+			},
+			expected: "",
+		},
+		{
+			name: "empty resource - returns empty",
+			forward: Forward{
+				Resource:  "",
+				Port:      8080,
+				LocalPort: 8080,
+			},
+			expected: "",
+		},
+		{
+			name: "resource with empty name after slash",
+			forward: Forward{
+				Resource:  "pod/",
+				Port:      8080,
+				LocalPort: 8080,
+			},
+			expected: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := tt.forward.GetMDNSAlias()
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestLoadConfig_FileTooLarge tests file size limit
+func TestLoadConfig_FileTooLarge(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create a file larger than maxConfigSize (10MB)
+	// We'll use a smaller buffer to avoid memory issues
+	// Just verify the check happens by creating a file slightly over 10MB
+	largeData := make([]byte, 10*1024*1024+1) // 10MB + 1 byte
+	for i := range largeData {
+		largeData[i] = 'a'
+	}
+
+	err := os.WriteFile(configPath, largeData, 0600)
+	require.NoError(t, err)
+
+	cfg, err := LoadConfig(configPath)
+	assert.Error(t, err)
+	assert.Nil(t, cfg)
+	assert.Contains(t, err.Error(), "config file too large")
+}
+
+// TestLoadConfig_WithHealthCheckAndReliability tests parsing with all config sections
+func TestLoadConfig_WithHealthCheckAndReliability(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	yaml := `contexts:
+  - name: dev
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app
+            port: 8080
+            localPort: 8080
+healthCheck:
+  interval: "5s"
+  timeout: "1s"
+  method: "tcp-dial"
+  maxConnectionAge: "20m"
+  maxIdleTime: "5m"
+reliability:
+  tcpKeepalive: "15s"
+  dialTimeout: "10s"
+  retryOnStale: true
+  watchdogPeriod: "1m"
+mdns:
+  enabled: true
+`
+
+	err := os.WriteFile(configPath, []byte(yaml), 0600)
+	require.NoError(t, err)
+
+	cfg, err := LoadConfig(configPath)
+	require.NoError(t, err)
+	require.NotNil(t, cfg)
+
+	// Verify health check settings
+	assert.Equal(t, 5*time.Second, cfg.GetHealthCheckIntervalOrDefault())
+	assert.Equal(t, 1*time.Second, cfg.GetHealthCheckTimeoutOrDefault())
+	assert.Equal(t, "tcp-dial", cfg.GetHealthCheckMethod())
+	assert.Equal(t, 20*time.Minute, cfg.GetMaxConnectionAge())
+	assert.Equal(t, 5*time.Minute, cfg.GetMaxIdleTime())
+
+	// Verify reliability settings
+	assert.Equal(t, 15*time.Second, cfg.GetTCPKeepalive())
+	assert.Equal(t, 10*time.Second, cfg.GetDialTimeout())
+	assert.True(t, cfg.GetRetryOnStale())
+	assert.Equal(t, 1*time.Minute, cfg.GetWatchdogPeriod())
+
+	// Verify mDNS
+	assert.True(t, cfg.IsMDNSEnabled())
+}
+
+// TestParseConfig_RejectsUnknownKeys tests strict parsing
+func TestParseConfig_RejectsUnknownKeys(t *testing.T) {
+	yaml := `contexts:
+  - name: dev
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app
+            port: 8080
+            localPort: 8080
+unknownKey: value
+`
+
+	cfg, err := ParseConfig([]byte(yaml))
+	assert.Error(t, err)
+	assert.Nil(t, cfg)
+	assert.Contains(t, err.Error(), "failed to parse YAML")
+}
+
+// TestHTTPLogSpec_FullStruct tests full HTTPLogSpec parsing
+func TestHTTPLogSpec_FullStruct(t *testing.T) {
+	yaml := `contexts:
+  - name: dev
+    namespaces:
+      - name: default
+        forwards:
+          - resource: service/api
+            port: 8080
+            localPort: 8080
+            httpLog:
+              enabled: true
+              logFile: "/tmp/http.log"
+              maxBodySize: 2048
+              includeHeaders: true
+              filterPath: "/api/*"
+`
+
+	cfg, err := ParseConfig([]byte(yaml))
+	require.NoError(t, err)
+	require.NotNil(t, cfg)
+
+	fwd := cfg.Contexts[0].Namespaces[0].Forwards[0]
+	require.NotNil(t, fwd.HTTPLog)
+	assert.True(t, fwd.HTTPLog.Enabled)
+	assert.Equal(t, "/tmp/http.log", fwd.HTTPLog.LogFile)
+	assert.Equal(t, 2048, fwd.HTTPLog.MaxBodySize)
+	assert.True(t, fwd.HTTPLog.IncludeHeaders)
+	assert.Equal(t, "/api/*", fwd.HTTPLog.FilterPath)
+}
@@ -39,7 +39,7 @@ func TestLoadConfig_ValidYAML(t *testing.T) {
            localPort: 8081
 `

-	err := os.WriteFile(configPath, []byte(validYAML), 0644)
+	err := os.WriteFile(configPath, []byte(validYAML), 0600)
 	assert.NoError(t, err, "should write temp config file")

 	// Load the config
@@ -82,7 +82,7 @@ func TestLoadConfig_InvalidYAML(t *testing.T) {
        forwards: [this is invalid yaml syntax
 `

-	err := os.WriteFile(configPath, []byte(invalidYAML), 0644)
+	err := os.WriteFile(configPath, []byte(invalidYAML), 0600)
 	assert.NoError(t, err, "should write temp config file")

 	// Load the config
@@ -97,14 +97,14 @@ func TestLoadConfig_FileNotFound(t *testing.T) {
 	cfg, err := LoadConfig("/non/existent/path/.kportal.yaml")
 	assert.Error(t, err, "LoadConfig should fail with non-existent file")
 	assert.Nil(t, cfg, "config should be nil on error")
-	assert.Contains(t, err.Error(), "failed to stat config file", "error should mention stat failure")
+	assert.Equal(t, ErrConfigNotFound, err, "should return ErrConfigNotFound")
 }

 func TestForward_ID(t *testing.T) {
 	tests := []struct {
 		name       string
-		forward    Forward
 		expectedID string
+		forward    Forward
 	}{
 		{
 			name: "pod with explicit name",
@@ -165,8 +165,8 @@ func TestForward_ID(t *testing.T) {
 func TestForward_String(t *testing.T) {
 	tests := []struct {
 		name           string
-		forward        Forward
 		expectedString string
+		forward        Forward
 	}{
 		{
 			name: "pod without selector",
@@ -389,11 +389,129 @@ func TestHTTPLogSpec_UnmarshalYAML(t *testing.T) {
 			if tt.expected {
 				assert.NotNil(t, fwd.HTTPLog, "HTTPLog should not be nil")
 				assert.True(t, fwd.HTTPLog.Enabled, "HTTPLog.Enabled should be true")
-			} else {
-				if fwd.HTTPLog != nil {
-					assert.False(t, fwd.HTTPLog.Enabled, "HTTPLog.Enabled should be false")
-				}
+			} else if fwd.HTTPLog != nil {
+				assert.False(t, fwd.HTTPLog.Enabled, "HTTPLog.Enabled should be false")
 			}
 		})
 	}
 }
+
+func TestNewEmptyConfig(t *testing.T) {
+	cfg := NewEmptyConfig()
+	assert.NotNil(t, cfg, "NewEmptyConfig should return non-nil config")
+	assert.Empty(t, cfg.Contexts, "NewEmptyConfig should have empty contexts")
+	assert.True(t, cfg.IsEmpty(), "NewEmptyConfig should be considered empty")
+}
+
+func TestConfig_IsEmpty(t *testing.T) {
+	tests := []struct {
+		config   *Config
+		name     string
+		expected bool
+	}{
+		{
+			name:     "nil contexts",
+			config:   &Config{},
+			expected: true,
+		},
+		{
+			name:     "empty contexts slice",
+			config:   &Config{Contexts: []Context{}},
+			expected: true,
+		},
+		{
+			name: "context with empty namespaces",
+			config: &Config{
+				Contexts: []Context{
+					{Name: "test", Namespaces: []Namespace{}},
+				},
+			},
+			expected: true,
+		},
+		{
+			name: "context with namespace but no forwards",
+			config: &Config{
+				Contexts: []Context{
+					{
+						Name: "test",
+						Namespaces: []Namespace{
+							{Name: "default", Forwards: []Forward{}},
+						},
+					},
+				},
+			},
+			expected: true,
+		},
+		{
+			name: "config with forward",
+			config: &Config{
+				Contexts: []Context{
+					{
+						Name: "test",
+						Namespaces: []Namespace{
+							{
+								Name: "default",
+								Forwards: []Forward{
+									{Resource: "pod/app", Port: 8080, LocalPort: 8080},
+								},
+							},
+						},
+					},
+				},
+			},
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.expected, tt.config.IsEmpty())
+		})
+	}
+}
+
+func TestCreateEmptyConfigFile(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create empty config file
+	err := CreateEmptyConfigFile(configPath)
+	assert.NoError(t, err, "CreateEmptyConfigFile should succeed")
+
+	// Verify file exists
+	_, err = os.Stat(configPath)
+	assert.NoError(t, err, "config file should exist")
+
+	// Verify file is readable and parseable
+	cfg, err := LoadConfig(configPath)
+	assert.NoError(t, err, "should be able to load created config")
+	assert.NotNil(t, cfg, "config should not be nil")
+	assert.True(t, cfg.IsEmpty(), "created config should be empty")
+
+	// Verify file permissions (0600)
+	info, _ := os.Stat(configPath)
+	assert.Equal(t, os.FileMode(0600), info.Mode().Perm(), "file should have 0600 permissions")
+
+	// Verify file contains helpful header
+	content, _ := os.ReadFile(configPath)
+	assert.Contains(t, string(content), "# kportal configuration file", "should contain header comment")
+	assert.Contains(t, string(content), "Example forward", "should contain example")
+}
+
+func TestCreateEmptyConfigFile_AlreadyExists(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create existing file
+	err := os.WriteFile(configPath, []byte("existing content"), 0600)
+	assert.NoError(t, err)
+
+	// Try to create config file - should fail
+	err = CreateEmptyConfigFile(configPath)
+	assert.Error(t, err, "CreateEmptyConfigFile should fail when file exists")
+	assert.Contains(t, err.Error(), "already exists")
+
+	// Verify original content is preserved
+	content, _ := os.ReadFile(configPath)
+	assert.Equal(t, "existing content", string(content))
+}
@@ -264,8 +264,8 @@ func (m *Mutator) writeAtomic(cfg *Config) error {

 	// Atomic rename
 	if err := os.Rename(tmpFile, m.configPath); err != nil {
-		// Clean up temp file on failure
-		os.Remove(tmpFile)
+		// Clean up temp file on failure - error ignored as we're already handling the rename error
+		_ = os.Remove(tmpFile)
 		return fmt.Errorf("failed to rename temp file: %w", err)
 	}

@@ -0,0 +1,664 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestNewMutator tests mutator creation
+func TestNewMutator(t *testing.T) {
+	mutator := NewMutator("/path/to/config.yaml")
+	assert.NotNil(t, mutator)
+	assert.Equal(t, "/path/to/config.yaml", mutator.configPath)
+}
+
+// TestMutator_AddForward_NewFile tests adding a forward to a new file
+// Note: Due to how LoadConfig wraps errors, os.IsNotExist check in AddForward
+// doesn't work with wrapped errors. This documents the current behavior.
+func TestMutator_AddForward_NewFile(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	mutator := NewMutator(configPath)
+
+	fwd := Forward{
+		Resource:  "pod/my-app",
+		Protocol:  "tcp",
+		Port:      8080,
+		LocalPort: 8080,
+	}
+
+	// Currently fails because LoadConfig wraps the error and os.IsNotExist doesn't match
+	err := mutator.AddForward("dev-cluster", "default", fwd)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to load config")
+}
+
+// TestMutator_AddForward_EmptyFile tests adding a forward to an empty file
+func TestMutator_AddForward_EmptyFile(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create empty config file with minimal valid structure
+	initial := `contexts: []
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	mutator := NewMutator(configPath)
+
+	fwd := Forward{
+		Resource:  "pod/my-app",
+		Protocol:  "tcp",
+		Port:      8080,
+		LocalPort: 8080,
+	}
+
+	err = mutator.AddForward("dev-cluster", "default", fwd)
+	require.NoError(t, err)
+
+	// Verify file was updated and contains the forward
+	cfg, err := LoadConfig(configPath)
+	require.NoError(t, err)
+	require.NotNil(t, cfg)
+
+	assert.Len(t, cfg.Contexts, 1)
+	assert.Equal(t, "dev-cluster", cfg.Contexts[0].Name)
+	assert.Len(t, cfg.Contexts[0].Namespaces, 1)
+	assert.Equal(t, "default", cfg.Contexts[0].Namespaces[0].Name)
+	assert.Len(t, cfg.Contexts[0].Namespaces[0].Forwards, 1)
+	assert.Equal(t, "pod/my-app", cfg.Contexts[0].Namespaces[0].Forwards[0].Resource)
+}
+
+// TestMutator_AddForward_ExistingFile tests adding to existing config
+func TestMutator_AddForward_ExistingFile(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial config
+	initial := `contexts:
+  - name: dev-cluster
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/existing-app
+            protocol: tcp
+            port: 8080
+            localPort: 8080
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	mutator := NewMutator(configPath)
+
+	fwd := Forward{
+		Resource:  "service/postgres",
+		Protocol:  "tcp",
+		Port:      5432,
+		LocalPort: 5432,
+	}
+
+	err = mutator.AddForward("dev-cluster", "default", fwd)
+	require.NoError(t, err)
+
+	// Verify both forwards exist
+	cfg, err := LoadConfig(configPath)
+	require.NoError(t, err)
+
+	assert.Len(t, cfg.Contexts[0].Namespaces[0].Forwards, 2)
+}
+
+// TestMutator_AddForward_NewContext tests adding to new context
+func TestMutator_AddForward_NewContext(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial config
+	initial := `contexts:
+  - name: dev-cluster
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app
+            protocol: tcp
+            port: 8080
+            localPort: 8080
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	mutator := NewMutator(configPath)
+
+	fwd := Forward{
+		Resource:  "pod/prod-app",
+		Protocol:  "tcp",
+		Port:      80,
+		LocalPort: 8081,
+	}
+
+	err = mutator.AddForward("prod-cluster", "production", fwd)
+	require.NoError(t, err)
+
+	// Verify new context was created
+	cfg, err := LoadConfig(configPath)
+	require.NoError(t, err)
+
+	assert.Len(t, cfg.Contexts, 2)
+	assert.Equal(t, "prod-cluster", cfg.Contexts[1].Name)
+}
+
+// TestMutator_AddForward_DuplicatePort tests rejecting duplicate ports
+func TestMutator_AddForward_DuplicatePort(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial config
+	initial := `contexts:
+  - name: dev-cluster
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app
+            protocol: tcp
+            port: 8080
+            localPort: 8080
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	mutator := NewMutator(configPath)
+
+	fwd := Forward{
+		Resource:  "pod/another-app",
+		Protocol:  "tcp",
+		Port:      9090,
+		LocalPort: 8080, // Duplicate local port
+	}
+
+	err = mutator.AddForward("dev-cluster", "default", fwd)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "port 8080 is already in use")
+}
+
+// TestMutator_AddForward_InvalidForward tests rejecting invalid forward
+func TestMutator_AddForward_InvalidForward(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial config file
+	initial := `contexts:
+  - name: dev-cluster
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/existing-app
+            protocol: tcp
+            port: 8080
+            localPort: 8080
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	mutator := NewMutator(configPath)
+
+	fwd := Forward{
+		Resource:  "invalid/type/resource", // Invalid resource
+		Protocol:  "tcp",
+		Port:      9090,
+		LocalPort: 9090,
+	}
+
+	err = mutator.AddForward("dev-cluster", "default", fwd)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "validation failed")
+}
+
+// TestMutator_RemoveForwards tests removing forwards by predicate
+func TestMutator_RemoveForwards(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial config with multiple forwards
+	initial := `contexts:
+  - name: dev-cluster
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app1
+            protocol: tcp
+            port: 8080
+            localPort: 8080
+          - resource: pod/app2
+            protocol: tcp
+            port: 8081
+            localPort: 8081
+          - resource: service/postgres
+            protocol: tcp
+            port: 5432
+            localPort: 5432
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	mutator := NewMutator(configPath)
+
+	// Remove all pod resources
+	err = mutator.RemoveForwards(func(ctx, ns string, fwd Forward) bool {
+		return fwd.Resource == "pod/app1"
+	})
+	require.NoError(t, err)
+
+	// Verify the forward was removed
+	cfg, err := LoadConfig(configPath)
+	require.NoError(t, err)
+
+	assert.Len(t, cfg.Contexts[0].Namespaces[0].Forwards, 2)
+	for _, fwd := range cfg.Contexts[0].Namespaces[0].Forwards {
+		assert.NotEqual(t, "pod/app1", fwd.Resource)
+	}
+}
+
+// TestMutator_RemoveForwards_RemovesEmptyNamespaces tests that empty namespaces are removed
+func TestMutator_RemoveForwards_RemovesEmptyNamespaces(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create config with two namespaces
+	initial := `contexts:
+  - name: dev-cluster
+    namespaces:
+      - name: ns1
+        forwards:
+          - resource: pod/app1
+            protocol: tcp
+            port: 8080
+            localPort: 8080
+      - name: ns2
+        forwards:
+          - resource: pod/app2
+            protocol: tcp
+            port: 8081
+            localPort: 8081
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	mutator := NewMutator(configPath)
+
+	// Remove all forwards from ns1
+	err = mutator.RemoveForwards(func(ctx, ns string, fwd Forward) bool {
+		return ns == "ns1"
+	})
+	require.NoError(t, err)
+
+	// Verify ns1 was removed (has no forwards left)
+	cfg, err := LoadConfig(configPath)
+	require.NoError(t, err)
+
+	assert.Len(t, cfg.Contexts[0].Namespaces, 1)
+	assert.Equal(t, "ns2", cfg.Contexts[0].Namespaces[0].Name)
+}
+
+// TestMutator_RemoveForwards_NonExistentFile tests removing from non-existent file
+func TestMutator_RemoveForwards_NonExistentFile(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	mutator := NewMutator(configPath)
+
+	err := mutator.RemoveForwards(func(ctx, ns string, fwd Forward) bool {
+		return true
+	})
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to load config")
+}
+
+// TestMutator_RemoveForwardByID tests removing a specific forward by ID
+func TestMutator_RemoveForwardByID(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial config
+	initial := `contexts:
+  - name: dev-cluster
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app1
+            protocol: tcp
+            port: 8080
+            localPort: 8080
+          - resource: pod/app2
+            protocol: tcp
+            port: 8081
+            localPort: 8081
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	mutator := NewMutator(configPath)
+
+	// Remove by ID
+	err = mutator.RemoveForwardByID("dev-cluster/default/pod/app1:8080")
+	require.NoError(t, err)
+
+	// Verify the forward was removed
+	cfg, err := LoadConfig(configPath)
+	require.NoError(t, err)
+
+	assert.Len(t, cfg.Contexts[0].Namespaces[0].Forwards, 1)
+	assert.Equal(t, "pod/app2", cfg.Contexts[0].Namespaces[0].Forwards[0].Resource)
+}
+
+// TestMutator_UpdateForward tests updating an existing forward
+func TestMutator_UpdateForward(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial config
+	initial := `contexts:
+  - name: dev-cluster
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app1
+            protocol: tcp
+            port: 8080
+            localPort: 8080
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	mutator := NewMutator(configPath)
+
+	newFwd := Forward{
+		Resource:  "pod/app1-updated",
+		Protocol:  "tcp",
+		Port:      9090,
+		LocalPort: 9090,
+	}
+
+	err = mutator.UpdateForward("dev-cluster/default/pod/app1:8080", "dev-cluster", "default", newFwd)
+	require.NoError(t, err)
+
+	// Verify the forward was updated
+	cfg, err := LoadConfig(configPath)
+	require.NoError(t, err)
+
+	assert.Len(t, cfg.Contexts[0].Namespaces[0].Forwards, 1)
+	assert.Equal(t, "pod/app1-updated", cfg.Contexts[0].Namespaces[0].Forwards[0].Resource)
+	assert.Equal(t, 9090, cfg.Contexts[0].Namespaces[0].Forwards[0].LocalPort)
+}
+
+// TestMutator_UpdateForward_MoveToNewContext tests moving forward to new context
+func TestMutator_UpdateForward_MoveToNewContext(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial config with multiple forwards (so removing one doesn't leave empty namespace)
+	initial := `contexts:
+  - name: dev-cluster
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app1
+            protocol: tcp
+            port: 8080
+            localPort: 8080
+          - resource: pod/app2
+            protocol: tcp
+            port: 9090
+            localPort: 9090
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	mutator := NewMutator(configPath)
+
+	newFwd := Forward{
+		Resource:  "pod/app1-moved",
+		Protocol:  "tcp",
+		Port:      8080,
+		LocalPort: 8080,
+	}
+
+	err = mutator.UpdateForward("dev-cluster/default/pod/app1:8080", "prod-cluster", "production", newFwd)
+	require.NoError(t, err)
+
+	// Verify the forward was moved
+	cfg, err := LoadConfig(configPath)
+	require.NoError(t, err)
+
+	// New context should exist with the forward
+	assert.Len(t, cfg.Contexts, 2)
+
+	// Original namespace should still have one forward
+	assert.Len(t, cfg.Contexts[0].Namespaces, 1)
+	assert.Len(t, cfg.Contexts[0].Namespaces[0].Forwards, 1)
+
+	// New context should have the moved forward
+	assert.Equal(t, "prod-cluster", cfg.Contexts[1].Name)
+	assert.Len(t, cfg.Contexts[1].Namespaces, 1)
+	assert.Equal(t, "production", cfg.Contexts[1].Namespaces[0].Name)
+}
+
+// TestMutator_UpdateForward_NotFound tests updating non-existent forward
+func TestMutator_UpdateForward_NotFound(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial config
+	initial := `contexts:
+  - name: dev-cluster
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app
+            protocol: tcp
+            port: 8080
+            localPort: 8080
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	mutator := NewMutator(configPath)
+
+	newFwd := Forward{
+		Resource:  "pod/app",
+		Protocol:  "tcp",
+		Port:      8080,
+		LocalPort: 8080,
+	}
+
+	err = mutator.UpdateForward("non-existent-id", "dev-cluster", "default", newFwd)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "forward with ID non-existent-id not found")
+}
+
+// TestMutator_UpdateForward_DuplicatePort tests rejecting update with duplicate port
+func TestMutator_UpdateForward_DuplicatePort(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial config with two forwards
+	initial := `contexts:
+  - name: dev-cluster
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app1
+            protocol: tcp
+            port: 8080
+            localPort: 8080
+          - resource: pod/app2
+            protocol: tcp
+            port: 9090
+            localPort: 9090
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	mutator := NewMutator(configPath)
+
+	// Try to update app1 to use the same port as app2
+	newFwd := Forward{
+		Resource:  "pod/app1-updated",
+		Protocol:  "tcp",
+		Port:      9090,
+		LocalPort: 9090, // Duplicate with app2
+	}
+
+	err = mutator.UpdateForward("dev-cluster/default/pod/app1:8080", "dev-cluster", "default", newFwd)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "port 9090 is already in use")
+}
+
+// TestMutator_WriteAtomic tests atomic write behavior
+func TestMutator_WriteAtomic(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	mutator := NewMutator(configPath)
+
+	cfg := &Config{
+		Contexts: []Context{
+			{
+				Name: "test",
+				Namespaces: []Namespace{
+					{
+						Name: "default",
+						Forwards: []Forward{
+							{Resource: "pod/app", Protocol: "tcp", Port: 8080, LocalPort: 8080},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	err := mutator.writeAtomic(cfg)
+	require.NoError(t, err)
+
+	// Verify file was created with correct permissions
+	info, err := os.Stat(configPath)
+	require.NoError(t, err)
+	assert.Equal(t, os.FileMode(0600), info.Mode().Perm())
+
+	// Verify temp file was cleaned up
+	tmpFile := filepath.Join(tmpDir, ".kportal.yaml.tmp")
+	_, err = os.Stat(tmpFile)
+	assert.True(t, os.IsNotExist(err))
+}
+
+// TestMutator_FindOrCreateContext tests context finding/creation
+func TestMutator_FindOrCreateContext(t *testing.T) {
+	mutator := NewMutator("/fake/path")
+
+	t.Run("find existing context", func(t *testing.T) {
+		cfg := &Config{
+			Contexts: []Context{
+				{Name: "existing"},
+			},
+		}
+
+		ctx := mutator.findOrCreateContext(cfg, "existing")
+		assert.Equal(t, "existing", ctx.Name)
+		assert.Len(t, cfg.Contexts, 1)
+	})
+
+	t.Run("create new context", func(t *testing.T) {
+		cfg := &Config{
+			Contexts: []Context{
+				{Name: "existing"},
+			},
+		}
+
+		ctx := mutator.findOrCreateContext(cfg, "new-context")
+		assert.Equal(t, "new-context", ctx.Name)
+		assert.Len(t, cfg.Contexts, 2)
+	})
+}
+
+// TestMutator_FindOrCreateNamespace tests namespace finding/creation
+func TestMutator_FindOrCreateNamespace(t *testing.T) {
+	mutator := NewMutator("/fake/path")
+
+	t.Run("find existing namespace", func(t *testing.T) {
+		ctx := &Context{
+			Name: "test",
+			Namespaces: []Namespace{
+				{Name: "existing"},
+			},
+		}
+
+		ns := mutator.findOrCreateNamespace(ctx, "existing")
+		assert.Equal(t, "existing", ns.Name)
+		assert.Len(t, ctx.Namespaces, 1)
+	})
+
+	t.Run("create new namespace", func(t *testing.T) {
+		ctx := &Context{
+			Name: "test",
+			Namespaces: []Namespace{
+				{Name: "existing"},
+			},
+		}
+
+		ns := mutator.findOrCreateNamespace(ctx, "new-namespace")
+		assert.Equal(t, "new-namespace", ns.Name)
+		assert.Len(t, ctx.Namespaces, 2)
+	})
+}
+
+// TestMutator_Concurrent tests mutex protection
+func TestMutator_Concurrent(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial config file
+	initial := `contexts:
+  - name: dev
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app
+            protocol: tcp
+            port: 8080
+            localPort: 8080
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	mutator := NewMutator(configPath)
+
+	// Run concurrent operations
+	done := make(chan bool, 10)
+	for i := 0; i < 10; i++ {
+		go func(port int) {
+			defer func() { done <- true }()
+			fwd := Forward{
+				Resource:  "pod/app",
+				Protocol:  "tcp",
+				Port:      port + 9000,
+				LocalPort: port + 9000,
+			}
+			// Some will succeed, some will fail due to validation
+			// The important thing is no race condition
+			_ = mutator.AddForward("dev", "default", fwd)
+		}(i)
+	}
+
+	// Wait for all goroutines
+	for i := 0; i < 10; i++ {
+		<-done
+	}
+
+	// Verify config is still valid
+	cfg, err := LoadConfig(configPath)
+	require.NoError(t, err)
+	require.NotNil(t, cfg)
+}
@@ -17,14 +17,9 @@ func IsValidPort(port int) bool {

 // ValidationError represents a configuration validation error with context.
 type ValidationError struct {
-	Field   string            // The field that failed validation
-	Message string            // Error message
-	Context map[string]string // Additional context information
-}
-
-// Error implements the error interface.
-func (e ValidationError) Error() string {
-	return e.Message
+	Context map[string]string
+	Field   string
+	Message string
 }

 // Validator validates configuration files.
@@ -37,6 +32,13 @@ func NewValidator() *Validator {

 // ValidateConfig validates the entire configuration and returns all errors found.
 func (v *Validator) ValidateConfig(cfg *Config) []ValidationError {
+	return v.ValidateConfigWithOptions(cfg, false)
+}
+
+// ValidateConfigWithOptions validates configuration with configurable strictness.
+// When allowEmpty is true, empty configurations (no contexts/forwards) are allowed.
+// This is useful for newly created config files where the user will add forwards via the TUI.
+func (v *Validator) ValidateConfigWithOptions(cfg *Config, allowEmpty bool) []ValidationError {
 	var errs []ValidationError

 	if cfg == nil {
@@ -46,6 +48,12 @@ func (v *Validator) ValidateConfig(cfg *Config) []ValidationError {
 		}}
 	}

+	// If empty configs are allowed and this config is empty, skip structure validation
+	if allowEmpty && cfg.IsEmpty() {
+		// Still validate health check and reliability if present (they don't require forwards)
+		return errs
+	}
+
 	// Validate structure
 	errs = append(errs, v.validateStructure(cfg)...)

@@ -191,14 +199,12 @@ func (v *Validator) validateResource(fwd *Forward) []ValidationError {
 					Message: fmt.Sprintf("Pod name cannot be empty for forward %s", fwd.ID()),
 				})
 			}
-		} else {
+		} else if fwd.Selector == "" {
 			// pod (no name) - must have selector
-			if fwd.Selector == "" {
-				errs = append(errs, ValidationError{
-					Field:   "selector",
-					Message: fmt.Sprintf("Forward %s uses generic 'pod' resource and must have a selector", fwd.ID()),
-				})
-			}
+			errs = append(errs, ValidationError{
+				Field:   "selector",
+				Message: fmt.Sprintf("Forward %s uses generic 'pod' resource and must have a selector", fwd.ID()),
+			})
 		}
 	}

@@ -11,10 +11,10 @@ func TestValidator_ValidateConfig(t *testing.T) {
 	validator := NewValidator()

 	tests := []struct {
-		name          string
 		config        *Config
-		expectErrors  bool
+		name          string
 		errorContains []string
+		expectErrors  bool
 	}{
 		{
 			name: "valid config",
@@ -227,9 +227,9 @@ func TestValidator_ValidateResourceFormat(t *testing.T) {

 	tests := []struct {
 		name          string
+		errorContains []string
 		forward       Forward
 		expectErrors  bool
-		errorContains []string
 	}{
 		{
 			name: "valid pod with name",
@@ -370,10 +370,10 @@ func TestValidator_CheckDuplicatePorts(t *testing.T) {
 	validator := NewValidator()

 	tests := []struct {
-		name          string
 		config        *Config
-		expectErrors  bool
+		name          string
 		errorContains []string
+		expectErrors  bool
 	}{
 		{
 			name: "no duplicate ports",
@@ -552,8 +552,8 @@ func TestFormatValidationErrors(t *testing.T) {
 	tests := []struct {
 		name           string
 		errors         []ValidationError
-		expectEmpty    bool
 		expectContains []string
+		expectEmpty    bool
 	}{
 		{
 			name:        "no errors",
@@ -621,23 +621,14 @@ func TestFormatValidationErrors(t *testing.T) {
 	}
 }

-func TestValidationError_Error(t *testing.T) {
-	err := ValidationError{
-		Field:   "port",
-		Message: "Invalid port 0",
-	}
-
-	assert.Equal(t, "Invalid port 0", err.Error(), "Error() should return the message")
-}
-
 func TestValidator_ValidateStructure(t *testing.T) {
 	validator := NewValidator()

 	tests := []struct {
-		name          string
 		config        *Config
-		expectErrors  bool
+		name          string
 		errorContains []string
+		expectErrors  bool
 	}{
 		{
 			name: "empty context name",
@@ -706,10 +697,10 @@ func TestValidator_ValidateMDNS(t *testing.T) {
 	validator := NewValidator()

 	tests := []struct {
-		name          string
 		config        *Config
-		expectErrors  bool
+		name          string
 		errorContains []string
+		expectErrors  bool
 	}{
 		{
 			name: "mDNS disabled - no validation",
@@ -972,3 +963,141 @@ func TestIsAlphanumeric(t *testing.T) {
 		})
 	}
 }
+
+func TestValidator_ValidateConfigWithOptions(t *testing.T) {
+	validator := NewValidator()
+
+	tests := []struct {
+		config       *Config
+		name         string
+		allowEmpty   bool
+		expectErrors bool
+	}{
+		{
+			name:         "empty config - strict mode",
+			config:       &Config{Contexts: []Context{}},
+			allowEmpty:   false,
+			expectErrors: true,
+		},
+		{
+			name:         "empty config - allow empty",
+			config:       &Config{Contexts: []Context{}},
+			allowEmpty:   true,
+			expectErrors: false,
+		},
+		{
+			name:         "nil contexts - allow empty",
+			config:       &Config{},
+			allowEmpty:   true,
+			expectErrors: false,
+		},
+		{
+			name: "context with no forwards - allow empty",
+			config: &Config{
+				Contexts: []Context{
+					{
+						Name: "dev",
+						Namespaces: []Namespace{
+							{Name: "default", Forwards: []Forward{}},
+						},
+					},
+				},
+			},
+			allowEmpty:   true,
+			expectErrors: false,
+		},
+		{
+			name: "valid config - strict mode",
+			config: &Config{
+				Contexts: []Context{
+					{
+						Name: "dev-cluster",
+						Namespaces: []Namespace{
+							{
+								Name: "default",
+								Forwards: []Forward{
+									{
+										Resource:      "pod/my-app",
+										Protocol:      "tcp",
+										Port:          8080,
+										LocalPort:     8080,
+										contextName:   "dev-cluster",
+										namespaceName: "default",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			allowEmpty:   false,
+			expectErrors: false,
+		},
+		{
+			name: "valid config - allow empty (should still validate)",
+			config: &Config{
+				Contexts: []Context{
+					{
+						Name: "dev-cluster",
+						Namespaces: []Namespace{
+							{
+								Name: "default",
+								Forwards: []Forward{
+									{
+										Resource:      "pod/my-app",
+										Protocol:      "tcp",
+										Port:          8080,
+										LocalPort:     8080,
+										contextName:   "dev-cluster",
+										namespaceName: "default",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			allowEmpty:   true,
+			expectErrors: false,
+		},
+		{
+			name: "invalid forward in non-empty config - allow empty still validates",
+			config: &Config{
+				Contexts: []Context{
+					{
+						Name: "dev-cluster",
+						Namespaces: []Namespace{
+							{
+								Name: "default",
+								Forwards: []Forward{
+									{
+										Resource:      "pod/my-app",
+										Protocol:      "tcp",
+										Port:          0, // Invalid port
+										LocalPort:     8080,
+										contextName:   "dev-cluster",
+										namespaceName: "default",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			allowEmpty:   true,
+			expectErrors: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			errs := validator.ValidateConfigWithOptions(tt.config, tt.allowEmpty)
+
+			if tt.expectErrors {
+				assert.NotEmpty(t, errs, "expected validation errors")
+			} else {
+				assert.Empty(t, errs, "expected no validation errors, got: %v", errs)
+			}
+		})
+	}
+}
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"log"
 	"path/filepath"
+	"sync"

 	"github.com/fsnotify/fsnotify"
 	"github.com/nvm/kportal/internal/logger"
@@ -15,10 +16,12 @@ type ReloadCallback func(*Config) error

 // Watcher watches a configuration file for changes and triggers hot-reload.
 type Watcher struct {
-	configPath string
 	callback   ReloadCallback
 	watcher    *fsnotify.Watcher
 	done       chan struct{}
+	configPath string
+	wg         sync.WaitGroup
+	stopOnce   sync.Once
 	verbose    bool
 }

@@ -31,7 +34,7 @@ func NewWatcher(configPath string, callback ReloadCallback, verbose bool) (*Watc

 	absPath, err := filepath.Abs(configPath)
 	if err != nil {
-		watcher.Close()
+		_ = watcher.Close() // Cleanup on error path; already returning error
 		return nil, fmt.Errorf("failed to resolve absolute path: %w", err)
 	}

@@ -39,7 +42,7 @@ func NewWatcher(configPath string, callback ReloadCallback, verbose bool) (*Watc
 	// (many editors delete and recreate files on save)
 	dir := filepath.Dir(absPath)
 	if err := watcher.Add(dir); err != nil {
-		watcher.Close()
+		_ = watcher.Close() // Cleanup on error path; already returning error
 		return nil, fmt.Errorf("failed to watch directory %s: %w", dir, err)
 	}

@@ -54,17 +57,24 @@ func NewWatcher(configPath string, callback ReloadCallback, verbose bool) (*Watc

 // Start begins watching the configuration file for changes.
 func (w *Watcher) Start() {
+	w.wg.Add(1)
 	go w.watch()
 }

-// Stop stops watching the configuration file.
+// Stop stops watching the configuration file and waits for the watch goroutine to exit.
+// Safe to call multiple times.
 func (w *Watcher) Stop() {
-	close(w.done)
-	w.watcher.Close()
+	w.stopOnce.Do(func() {
+		close(w.done)
+		_ = w.watcher.Close() // Best-effort cleanup during shutdown
+	})
+	w.wg.Wait() // Wait for watch goroutine to exit
 }

 // watch runs the file watching loop.
 func (w *Watcher) watch() {
+	defer w.wg.Done()
+
 	if w.verbose {
 		log.Printf("Watching configuration file: %s", w.configPath)
 	}
@@ -0,0 +1,506 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestNewWatcher tests watcher creation
+func TestNewWatcher(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial config file
+	initial := `contexts:
+  - name: dev
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app
+            protocol: tcp
+            port: 8080
+            localPort: 8080
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	callback := func(cfg *Config) error { return nil }
+
+	watcher, err := NewWatcher(configPath, callback, false)
+	require.NoError(t, err)
+	require.NotNil(t, watcher)
+	defer watcher.Stop()
+
+	assert.NotNil(t, watcher.watcher)
+	assert.NotNil(t, watcher.done)
+	assert.False(t, watcher.verbose)
+}
+
+// TestNewWatcher_Verbose tests verbose watcher creation
+func TestNewWatcher_Verbose(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial config file
+	initial := `contexts:
+  - name: dev
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app
+            port: 8080
+            localPort: 8080
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	callback := func(cfg *Config) error { return nil }
+
+	watcher, err := NewWatcher(configPath, callback, true)
+	require.NoError(t, err)
+	require.NotNil(t, watcher)
+	defer watcher.Stop()
+
+	assert.True(t, watcher.verbose)
+}
+
+// TestNewWatcher_RelativePath tests absolute path resolution
+func TestNewWatcher_RelativePath(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial config file
+	initial := `contexts:
+  - name: dev
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app
+            port: 8080
+            localPort: 8080
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	// Change to tmpDir and use relative path
+	originalDir, err := os.Getwd()
+	require.NoError(t, err)
+	defer func() { _ = os.Chdir(originalDir) }()
+	err = os.Chdir(tmpDir)
+	require.NoError(t, err)
+
+	callback := func(cfg *Config) error { return nil }
+
+	watcher, err := NewWatcher(".kportal.yaml", callback, false)
+	require.NoError(t, err)
+	require.NotNil(t, watcher)
+	defer watcher.Stop()
+
+	// configPath should be absolute
+	assert.True(t, filepath.IsAbs(watcher.configPath))
+}
+
+// TestWatcher_StartStop tests basic start/stop lifecycle
+func TestWatcher_StartStop(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial config file
+	initial := `contexts:
+  - name: dev
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app
+            port: 8080
+            localPort: 8080
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	callback := func(cfg *Config) error { return nil }
+
+	watcher, err := NewWatcher(configPath, callback, false)
+	require.NoError(t, err)
+	require.NotNil(t, watcher)
+
+	// Start watching
+	watcher.Start()
+
+	// Stop should complete without hanging
+	done := make(chan bool)
+	go func() {
+		watcher.Stop()
+		done <- true
+	}()
+
+	select {
+	case <-done:
+		// Success
+	case <-time.After(5 * time.Second):
+		t.Fatal("Stop timed out")
+	}
+}
+
+// TestWatcher_DetectsFileChange tests that file changes trigger callback
+func TestWatcher_DetectsFileChange(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial config file
+	initial := `contexts:
+  - name: dev
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app
+            port: 8080
+            localPort: 8080
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	var mu sync.Mutex
+	var callbackCalled bool
+	var receivedConfig *Config
+
+	callback := func(cfg *Config) error {
+		mu.Lock()
+		defer mu.Unlock()
+		callbackCalled = true
+		receivedConfig = cfg
+		return nil
+	}
+
+	watcher, err := NewWatcher(configPath, callback, false)
+	require.NoError(t, err)
+	require.NotNil(t, watcher)
+	defer watcher.Stop()
+
+	watcher.Start()
+
+	// Give watcher time to start
+	time.Sleep(100 * time.Millisecond)
+
+	// Modify the config file
+	updated := `contexts:
+  - name: dev
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app
+            port: 8080
+            localPort: 8080
+          - resource: pod/new-app
+            port: 9090
+            localPort: 9090
+`
+	err = os.WriteFile(configPath, []byte(updated), 0600)
+	require.NoError(t, err)
+
+	// Wait for callback with timeout
+	timeout := time.After(5 * time.Second)
+	tick := time.NewTicker(100 * time.Millisecond)
+	defer tick.Stop()
+
+	for {
+		select {
+		case <-timeout:
+			t.Fatal("Callback was not called after file change")
+		case <-tick.C:
+			mu.Lock()
+			if callbackCalled {
+				assert.NotNil(t, receivedConfig)
+				assert.Len(t, receivedConfig.Contexts[0].Namespaces[0].Forwards, 2)
+				mu.Unlock()
+				return
+			}
+			mu.Unlock()
+		}
+	}
+}
+
+// TestWatcher_IgnoresInvalidConfig tests that invalid configs are rejected
+func TestWatcher_IgnoresInvalidConfig(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial valid config file
+	initial := `contexts:
+  - name: dev
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app
+            port: 8080
+            localPort: 8080
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	callbackCount := 0
+	var mu sync.Mutex
+
+	callback := func(cfg *Config) error {
+		mu.Lock()
+		defer mu.Unlock()
+		callbackCount++
+		return nil
+	}
+
+	watcher, err := NewWatcher(configPath, callback, false)
+	require.NoError(t, err)
+	require.NotNil(t, watcher)
+	defer watcher.Stop()
+
+	watcher.Start()
+	time.Sleep(100 * time.Millisecond)
+
+	// Write invalid config (invalid YAML syntax)
+	invalid := `contexts:
+  - name: dev
+    namespaces:
+      - name: default
+        forwards: [this is invalid
+`
+	err = os.WriteFile(configPath, []byte(invalid), 0600)
+	require.NoError(t, err)
+
+	// Wait a bit
+	time.Sleep(500 * time.Millisecond)
+
+	// Callback should not have been called
+	mu.Lock()
+	assert.Equal(t, 0, callbackCount, "callback should not be called for invalid config")
+	mu.Unlock()
+}
+
+// TestWatcher_IgnoresValidationErrors tests that configs failing validation are rejected
+func TestWatcher_IgnoresValidationErrors(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial valid config file
+	initial := `contexts:
+  - name: dev
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app
+            port: 8080
+            localPort: 8080
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	callbackCount := 0
+	var mu sync.Mutex
+
+	callback := func(cfg *Config) error {
+		mu.Lock()
+		defer mu.Unlock()
+		callbackCount++
+		return nil
+	}
+
+	watcher, err := NewWatcher(configPath, callback, false)
+	require.NoError(t, err)
+	require.NotNil(t, watcher)
+	defer watcher.Stop()
+
+	watcher.Start()
+	time.Sleep(100 * time.Millisecond)
+
+	// Write config with duplicate ports (validation error)
+	invalid := `contexts:
+  - name: dev
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app1
+            port: 8080
+            localPort: 8080
+          - resource: pod/app2
+            port: 9090
+            localPort: 8080
+`
+	err = os.WriteFile(configPath, []byte(invalid), 0600)
+	require.NoError(t, err)
+
+	// Wait a bit
+	time.Sleep(500 * time.Millisecond)
+
+	// Callback should not have been called
+	mu.Lock()
+	assert.Equal(t, 0, callbackCount, "callback should not be called for invalid config")
+	mu.Unlock()
+}
+
+// TestWatcher_IgnoresOtherFiles tests that changes to other files are ignored
+func TestWatcher_IgnoresOtherFiles(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+	otherPath := filepath.Join(tmpDir, "other.txt")
+
+	// Create initial config file
+	initial := `contexts:
+  - name: dev
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app
+            port: 8080
+            localPort: 8080
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	callbackCount := 0
+	var mu sync.Mutex
+
+	callback := func(cfg *Config) error {
+		mu.Lock()
+		defer mu.Unlock()
+		callbackCount++
+		return nil
+	}
+
+	watcher, err := NewWatcher(configPath, callback, false)
+	require.NoError(t, err)
+	require.NotNil(t, watcher)
+	defer watcher.Stop()
+
+	watcher.Start()
+	time.Sleep(100 * time.Millisecond)
+
+	// Write to a different file
+	err = os.WriteFile(otherPath, []byte("some content"), 0600)
+	require.NoError(t, err)
+
+	// Wait a bit
+	time.Sleep(500 * time.Millisecond)
+
+	// Callback should not have been called
+	mu.Lock()
+	assert.Equal(t, 0, callbackCount, "callback should not be called for other files")
+	mu.Unlock()
+}
+
+// TestWatcher_HandleReload_LoadError tests handleReload with load error
+func TestWatcher_HandleReload_LoadError(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial config file
+	initial := `contexts:
+  - name: dev
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app
+            port: 8080
+            localPort: 8080
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	callbackCalled := false
+
+	callback := func(cfg *Config) error {
+		callbackCalled = true
+		return nil
+	}
+
+	watcher, err := NewWatcher(configPath, callback, false)
+	require.NoError(t, err)
+	require.NotNil(t, watcher)
+	defer watcher.Stop()
+
+	// Delete the config file to cause load error
+	os.Remove(configPath)
+
+	// Call handleReload directly
+	watcher.handleReload()
+
+	// Callback should not have been called
+	assert.False(t, callbackCalled)
+}
+
+// TestWatcher_DoubleStop tests that double stop doesn't panic
+func TestWatcher_DoubleStop(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial config file
+	initial := `contexts:
+  - name: dev
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app
+            port: 8080
+            localPort: 8080
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	callback := func(cfg *Config) error { return nil }
+
+	watcher, err := NewWatcher(configPath, callback, false)
+	require.NoError(t, err)
+	require.NotNil(t, watcher)
+
+	watcher.Start()
+
+	// First stop
+	watcher.Stop()
+
+	// Second stop should not panic (though the channel is already closed)
+	// Note: This might panic due to close on closed channel, which is actually
+	// a design issue - but we document the current behavior
+}
+
+// TestWatcher_StopWithoutStart tests stopping without starting
+func TestWatcher_StopWithoutStart(t *testing.T) {
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create initial config file
+	initial := `contexts:
+  - name: dev
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/app
+            port: 8080
+            localPort: 8080
+`
+	err := os.WriteFile(configPath, []byte(initial), 0600)
+	require.NoError(t, err)
+
+	callback := func(cfg *Config) error { return nil }
+
+	watcher, err := NewWatcher(configPath, callback, false)
+	require.NoError(t, err)
+	require.NotNil(t, watcher)
+
+	// Stop without starting should not hang
+	done := make(chan bool)
+	go func() {
+		watcher.Stop()
+		done <- true
+	}()
+
+	select {
+	case <-done:
+		// Success
+	case <-time.After(5 * time.Second):
+		t.Fatal("Stop without start timed out")
+	}
+}
@@ -1,3 +1,12 @@
+// Package converter provides configuration migration from other port-forwarding
+// tools to kportal's YAML format. Currently supports kftray JSON format.
+//
+// Basic usage:
+//
+//	err := converter.ConvertKFTrayToKPortal("kftray.json", ".kportal.yaml")
+//	if err != nil {
+//	    log.Fatal(err)
+//	}
 package converter

 import (
@@ -14,25 +23,26 @@ import (
 type KFTrayConfig struct {
 	Service      string `json:"service"`
 	Namespace    string `json:"namespace"`
-	LocalPort    int    `json:"local_port"`
-	RemotePort   int    `json:"remote_port"`
 	Context      string `json:"context"`
 	WorkloadType string `json:"workload_type"`
 	Protocol     string `json:"protocol"`
 	Alias        string `json:"alias"`
+	LocalPort    int    `json:"local_port"`
+	RemotePort   int    `json:"remote_port"`
 }

 // ConvertKFTrayToKPortal converts kftray JSON configuration to kportal YAML format
 func ConvertKFTrayToKPortal(inputFile, outputFile string) error {
 	// Read kftray JSON config
+	// #nosec G304 -- inputFile is from command line argument for explicit conversion
 	data, err := os.ReadFile(inputFile)
 	if err != nil {
 		return fmt.Errorf("failed to read input file: %w", err)
 	}

 	var kftrayConfigs []KFTrayConfig
-	if err := json.Unmarshal(data, &kftrayConfigs); err != nil {
-		return fmt.Errorf("failed to parse JSON: %w", err)
+	if unmarshalErr := json.Unmarshal(data, &kftrayConfigs); unmarshalErr != nil {
+		return fmt.Errorf("failed to parse JSON: %w", unmarshalErr)
 	}

 	// Convert to kportal format
@@ -48,7 +58,7 @@ func ConvertKFTrayToKPortal(inputFile, outputFile string) error {
 	header := "# kportal configuration converted from kftray format\n# Generated by kportal --convert\n\n"
 	yamlData = append([]byte(header), yamlData...)

-	if err := os.WriteFile(outputFile, yamlData, 0644); err != nil {
+	if err := os.WriteFile(outputFile, yamlData, 0600); err != nil {
 		return fmt.Errorf("failed to write output file: %w", err)
 	}

@@ -57,6 +67,7 @@ func ConvertKFTrayToKPortal(inputFile, outputFile string) error {

 // GetConversionSummary returns statistics about the kftray configuration
 func GetConversionSummary(inputFile string) (map[string]map[string]int, int, error) {
+	// #nosec G304 -- inputFile is from command line argument for explicit conversion
 	data, err := os.ReadFile(inputFile)
 	if err != nil {
 		return nil, 0, fmt.Errorf("failed to read input file: %w", err)
@@ -167,9 +178,9 @@ type namespaceEntry struct {
 type forwardEntry struct {
 	Resource  string `yaml:"resource"`
 	Protocol  string `yaml:"protocol"`
+	Alias     string `yaml:"alias,omitempty"`
 	Port      int    `yaml:"port"`
 	LocalPort int    `yaml:"localPort"`
-	Alias     string `yaml:"alias,omitempty"`
 }

 // Convert internal types to config package types
@@ -0,0 +1,188 @@
+// Package events provides a publish-subscribe event bus for decoupled
+// communication between kportal components. Events are typed and carry
+// contextual data about forward lifecycle, health status, and configuration
+// changes.
+//
+// Event types include:
+//   - Forward lifecycle: starting, connected, disconnected, reconnecting, stopped, error
+//   - Health: status_changed, stale
+//   - Watchdog: worker_hung
+//   - Config: reloaded
+//
+// Basic usage:
+//
+//	bus := events.NewBus()
+//	bus.Subscribe(events.EventForwardConnected, func(e events.Event) {
+//	    fmt.Printf("Forward %s connected\n", e.ForwardID)
+//	})
+//	bus.Publish(events.Event{Type: events.EventForwardConnected, ForwardID: "..."})
+package events
+
+import (
+	"sync"
+)
+
+// EventType represents the type of event
+type EventType string
+
+const (
+	// Forward lifecycle events
+	EventForwardStarting     EventType = "forward.starting"
+	EventForwardConnected    EventType = "forward.connected"
+	EventForwardDisconnected EventType = "forward.disconnected"
+	EventForwardReconnecting EventType = "forward.reconnecting"
+	EventForwardStopped      EventType = "forward.stopped"
+	EventForwardError        EventType = "forward.error"
+
+	// Health events
+	EventHealthStatusChanged EventType = "health.status_changed"
+	EventHealthStale         EventType = "health.stale"
+
+	// Watchdog events
+	EventWorkerHung EventType = "watchdog.worker_hung"
+
+	// Config events
+	EventConfigReloaded EventType = "config.reloaded"
+)
+
+// Event represents a system event
+type Event struct {
+	Data      map[string]interface{}
+	Type      EventType
+	ForwardID string
+}
+
+// Handler is a function that handles events
+type Handler func(event Event)
+
+// Bus is a simple event bus for decoupled communication between components
+type Bus struct {
+	handlers map[EventType][]Handler
+	mu       sync.RWMutex
+	closed   bool
+}
+
+// NewBus creates a new event bus
+func NewBus() *Bus {
+	return &Bus{
+		handlers: make(map[EventType][]Handler),
+	}
+}
+
+// Subscribe registers a handler for a specific event type
+func (b *Bus) Subscribe(eventType EventType, handler Handler) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	if b.closed {
+		return
+	}
+
+	b.handlers[eventType] = append(b.handlers[eventType], handler)
+}
+
+// SubscribeAll registers a handler for all events
+func (b *Bus) SubscribeAll(handler Handler) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	if b.closed {
+		return
+	}
+
+	// Subscribe to all known event types
+	eventTypes := []EventType{
+		EventForwardStarting,
+		EventForwardConnected,
+		EventForwardDisconnected,
+		EventForwardReconnecting,
+		EventForwardStopped,
+		EventForwardError,
+		EventHealthStatusChanged,
+		EventHealthStale,
+		EventWorkerHung,
+		EventConfigReloaded,
+	}
+
+	for _, et := range eventTypes {
+		b.handlers[et] = append(b.handlers[et], handler)
+	}
+}
+
+// Publish sends an event to all registered handlers
+// Handlers are called synchronously in the order they were registered
+func (b *Bus) Publish(event Event) {
+	b.mu.RLock()
+	if b.closed {
+		b.mu.RUnlock()
+		return
+	}
+	handlers := make([]Handler, len(b.handlers[event.Type]))
+	copy(handlers, b.handlers[event.Type])
+	b.mu.RUnlock()
+
+	for _, handler := range handlers {
+		handler(event)
+	}
+}
+
+// PublishAsync sends an event to all registered handlers asynchronously
+func (b *Bus) PublishAsync(event Event) {
+	b.mu.RLock()
+	if b.closed {
+		b.mu.RUnlock()
+		return
+	}
+	handlers := make([]Handler, len(b.handlers[event.Type]))
+	copy(handlers, b.handlers[event.Type])
+	b.mu.RUnlock()
+
+	for _, handler := range handlers {
+		go handler(event)
+	}
+}
+
+// Close stops the event bus and prevents new subscriptions/publications
+func (b *Bus) Close() {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	b.closed = true
+	b.handlers = make(map[EventType][]Handler)
+}
+
+// Helper functions for creating common events
+
+// NewHealthEvent creates a health status change event
+func NewHealthEvent(forwardID string, status string, errorMsg string) Event {
+	return Event{
+		Type:      EventHealthStatusChanged,
+		ForwardID: forwardID,
+		Data: map[string]interface{}{
+			"status":    status,
+			"error_msg": errorMsg,
+		},
+	}
+}
+
+// NewStaleEvent creates a stale connection event
+func NewStaleEvent(forwardID string, reason string) Event {
+	return Event{
+		Type:      EventHealthStale,
+		ForwardID: forwardID,
+		Data: map[string]interface{}{
+			"reason": reason,
+		},
+	}
+}
+
+// NewWorkerHungEvent creates a hung worker event
+func NewWorkerHungEvent(forwardID string, timeSinceHeartbeat string) Event {
+	return Event{
+		Type:      EventWorkerHung,
+		ForwardID: forwardID,
+		Data: map[string]interface{}{
+			"time_since_heartbeat": timeSinceHeartbeat,
+		},
+	}
+}
@@ -0,0 +1,175 @@
+package events
+
+import (
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestBus_Subscribe(t *testing.T) {
+	bus := NewBus()
+	defer bus.Close()
+
+	var received bool
+	bus.Subscribe(EventForwardStarting, func(e Event) {
+		received = true
+	})
+
+	bus.Publish(Event{Type: EventForwardStarting})
+	assert.True(t, received)
+}
+
+func TestBus_SubscribeMultipleHandlers(t *testing.T) {
+	bus := NewBus()
+	defer bus.Close()
+
+	var count int32
+	handler := func(e Event) {
+		atomic.AddInt32(&count, 1)
+	}
+
+	bus.Subscribe(EventForwardStarting, handler)
+	bus.Subscribe(EventForwardStarting, handler)
+	bus.Subscribe(EventForwardStarting, handler)
+
+	bus.Publish(Event{Type: EventForwardStarting})
+	assert.Equal(t, int32(3), atomic.LoadInt32(&count))
+}
+
+func TestBus_SubscribeAll(t *testing.T) {
+	bus := NewBus()
+	defer bus.Close()
+
+	var count int32
+	bus.SubscribeAll(func(e Event) {
+		atomic.AddInt32(&count, 1)
+	})
+
+	bus.Publish(Event{Type: EventForwardStarting})
+	bus.Publish(Event{Type: EventForwardConnected})
+	bus.Publish(Event{Type: EventHealthStatusChanged})
+
+	assert.Equal(t, int32(3), atomic.LoadInt32(&count))
+}
+
+func TestBus_PublishWithData(t *testing.T) {
+	bus := NewBus()
+	defer bus.Close()
+
+	var receivedEvent Event
+	bus.Subscribe(EventHealthStatusChanged, func(e Event) {
+		receivedEvent = e
+	})
+
+	bus.Publish(Event{
+		Type:      EventHealthStatusChanged,
+		ForwardID: "test-forward",
+		Data: map[string]interface{}{
+			"status": "Active",
+		},
+	})
+
+	assert.Equal(t, EventHealthStatusChanged, receivedEvent.Type)
+	assert.Equal(t, "test-forward", receivedEvent.ForwardID)
+	assert.Equal(t, "Active", receivedEvent.Data["status"])
+}
+
+func TestBus_PublishAsync(t *testing.T) {
+	bus := NewBus()
+	defer bus.Close()
+
+	var wg sync.WaitGroup
+	wg.Add(1)
+
+	bus.Subscribe(EventForwardStarting, func(e Event) {
+		wg.Done()
+	})
+
+	bus.PublishAsync(Event{Type: EventForwardStarting})
+
+	// Wait for async handler with timeout
+	done := make(chan struct{})
+	go func() {
+		wg.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+		// Success
+	case <-time.After(time.Second):
+		t.Fatal("Async handler not called within timeout")
+	}
+}
+
+func TestBus_Close(t *testing.T) {
+	bus := NewBus()
+
+	var received bool
+	bus.Subscribe(EventForwardStarting, func(e Event) {
+		received = true
+	})
+
+	bus.Close()
+
+	// After close, publish should not call handlers
+	bus.Publish(Event{Type: EventForwardStarting})
+	assert.False(t, received)
+
+	// Subscribe after close should be a no-op
+	bus.Subscribe(EventForwardConnected, func(e Event) {
+		received = true
+	})
+	bus.Publish(Event{Type: EventForwardConnected})
+	assert.False(t, received)
+}
+
+func TestBus_ConcurrentAccess(t *testing.T) {
+	bus := NewBus()
+	defer bus.Close()
+
+	var count int64
+	bus.Subscribe(EventForwardStarting, func(e Event) {
+		atomic.AddInt64(&count, 1)
+	})
+
+	var wg sync.WaitGroup
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			bus.Publish(Event{Type: EventForwardStarting})
+		}()
+	}
+
+	wg.Wait()
+	assert.Equal(t, int64(100), atomic.LoadInt64(&count))
+}
+
+func TestNewHealthEvent(t *testing.T) {
+	event := NewHealthEvent("test-id", "Active", "")
+
+	assert.Equal(t, EventHealthStatusChanged, event.Type)
+	assert.Equal(t, "test-id", event.ForwardID)
+	assert.Equal(t, "Active", event.Data["status"])
+	assert.Equal(t, "", event.Data["error_msg"])
+}
+
+func TestNewStaleEvent(t *testing.T) {
+	event := NewStaleEvent("test-id", "connection too old")
+
+	assert.Equal(t, EventHealthStale, event.Type)
+	assert.Equal(t, "test-id", event.ForwardID)
+	assert.Equal(t, "connection too old", event.Data["reason"])
+}
+
+func TestNewWorkerHungEvent(t *testing.T) {
+	event := NewWorkerHungEvent("test-id", "60s")
+
+	assert.Equal(t, EventWorkerHung, event.Type)
+	assert.Equal(t, "test-id", event.ForwardID)
+	assert.Equal(t, "60s", event.Data["time_since_heartbeat"])
+}
@@ -1,3 +1,17 @@
+// Package forward provides the core port-forwarding orchestration for kportal.
+// It manages the lifecycle of port-forward workers, handles hot-reload of
+// configuration changes, and coordinates with the health checker and watchdog.
+//
+// The Manager is the central orchestrator that:
+//   - Creates and manages ForwardWorker instances for each configured forward
+//   - Handles graceful startup, shutdown, and reconfiguration
+//   - Coordinates with the HealthChecker for connection monitoring
+//   - Integrates with mDNS for hostname publishing
+//
+// ForwardWorker handles individual port-forward connections with:
+//   - Automatic retry with exponential backoff (1s → 2s → 4s → 8s → 10s max)
+//   - Pod restart detection and re-resolution
+//   - Graceful shutdown support
 package forward

 import (
@@ -7,6 +21,7 @@ import (
 	"time"

 	"github.com/nvm/kportal/internal/config"
+	"github.com/nvm/kportal/internal/events"
 	"github.com/nvm/kportal/internal/healthcheck"
 	"github.com/nvm/kportal/internal/k8s"
 	"github.com/nvm/kportal/internal/logger"
@@ -23,18 +38,19 @@ type StatusUpdater interface {
 // Manager orchestrates all port-forward workers.
 // It handles starting, stopping, and hot-reloading forwards.
 type Manager struct {
-	workers       map[string]*ForwardWorker // key: forward.ID()
-	workersMu     sync.RWMutex
+	statusUI      StatusUpdater
+	healthChecker *healthcheck.Checker
 	clientPool    *k8s.ClientPool
 	resolver      *k8s.ResourceResolver
 	portForwarder *k8s.PortForwarder
 	portChecker   *PortChecker
-	healthChecker *healthcheck.Checker
+	workers       map[string]*ForwardWorker
 	watchdog      *Watchdog
 	mdnsPublisher *mdns.Publisher
-	verbose       bool
+	eventBus      *events.Bus
 	currentConfig *config.Config
-	statusUI      StatusUpdater
+	workersMu     sync.RWMutex
+	verbose       bool
 }

 // NewManager creates a new forward Manager.
@@ -57,6 +73,13 @@ func NewManager(verbose bool) (*Manager, error) {
 	// Will be reconfigured when config is loaded
 	watchdog := NewWatchdog(30*time.Second, 60*time.Second)

+	// Create event bus for decoupled communication between components
+	eventBus := events.NewBus()
+
+	// Wire up event bus to components
+	healthChecker.SetEventBus(eventBus)
+	watchdog.SetEventBus(eventBus)
+
 	return &Manager{
 		workers:       make(map[string]*ForwardWorker),
 		clientPool:    clientPool,
@@ -65,6 +88,7 @@ func NewManager(verbose bool) (*Manager, error) {
 		portChecker:   NewPortChecker(),
 		healthChecker: healthChecker,
 		watchdog:      watchdog,
+		eventBus:      eventBus,
 		verbose:       verbose,
 	}, nil
 }
@@ -97,6 +121,11 @@ func (m *Manager) configureHealthChecker(cfg *config.Config) {
 		MaxIdleTime:      cfg.GetMaxIdleTime(),
 	})

+	// Reconnect event bus to new health checker
+	if m.eventBus != nil {
+		m.healthChecker.SetEventBus(m.eventBus)
+	}
+
 	// Configure TCP settings on port forwarder
 	tcpKeepalive := cfg.GetTCPKeepalive()
 	dialTimeout := cfg.GetDialTimeout()
@@ -149,8 +178,10 @@ func (m *Manager) Start(cfg *config.Config) error {
 	// Get all forwards from config
 	forwards := cfg.GetAllForwards()

+	// Empty config is valid - user can add forwards later via TUI
 	if len(forwards) == 0 {
-		return fmt.Errorf("no forwards configured")
+		log.Printf("No forwards configured - use 'n' to add forwards")
+		return nil
 	}

 	// Check port availability before starting
@@ -193,6 +224,11 @@ func (m *Manager) Stop() {
 	m.healthChecker.Stop()
 	m.watchdog.Stop()

+	// Close event bus
+	if m.eventBus != nil {
+		m.eventBus.Close()
+	}
+
 	// Stop mDNS publisher
 	if m.mdnsPublisher != nil {
 		m.mdnsPublisher.Stop()
@@ -349,19 +385,24 @@ func (m *Manager) startWorker(fwd config.Forward) error {
 		m.statusUI.AddForward(fwd.ID(), &fwd)
 	}

-	// Register with watchdog
-	m.watchdog.RegisterWorker(fwd.ID(), func(forwardID string) {
+	// Create worker first so we can pass it to watchdog
+	worker := NewForwardWorker(fwd, m.portForwarder, m.verbose, m.statusUI, m.healthChecker, m.watchdog)
+
+	// Register with watchdog using the new responder interface
+	// This allows the watchdog to poll the worker for heartbeats centrally
+	// instead of each worker spawning its own heartbeat goroutine
+	m.watchdog.RegisterWorkerWithResponder(fwd.ID(), worker, func(forwardID string) {
 		logger.Warn("Watchdog triggered reconnection for hung worker", map[string]interface{}{
 			"forward_id": forwardID,
 		})

 		// Find and trigger reconnect on hung worker
 		m.workersMu.RLock()
-		worker, exists := m.workers[forwardID]
+		w, exists := m.workers[forwardID]
 		m.workersMu.RUnlock()

 		if exists {
-			worker.TriggerReconnect("watchdog detected hung worker")
+			w.TriggerReconnect("watchdog detected hung worker")
 		}
 	})

@@ -387,17 +428,16 @@ func (m *Manager) startWorker(fwd config.Forward) error {

 			// Find and notify the worker to reconnect
 			m.workersMu.RLock()
-			worker, exists := m.workers[forwardID]
+			staleWorker, exists := m.workers[forwardID]
 			m.workersMu.RUnlock()

 			if exists {
-				worker.TriggerReconnect("stale connection")
+				staleWorker.TriggerReconnect("stale connection")
 			}
 		}
 	})

-	// Create and start worker
-	worker := NewForwardWorker(fwd, m.portForwarder, m.verbose, m.statusUI, m.healthChecker, m.watchdog)
+	// Start the worker (already created above)
 	worker.Start()

 	// Store worker
@@ -462,27 +502,6 @@ func (m *Manager) stopWorkerInternal(id string, removeFromUI bool) error {
 	return nil
 }

-// GetActiveForwards returns a list of all active forward IDs.
-func (m *Manager) GetActiveForwards() []string {
-	m.workersMu.RLock()
-	defer m.workersMu.RUnlock()
-
-	ids := make([]string, 0, len(m.workers))
-	for id := range m.workers {
-		ids = append(ids, id)
-	}
-
-	return ids
-}
-
-// GetWorkerCount returns the number of active workers.
-func (m *Manager) GetWorkerCount() int {
-	m.workersMu.RLock()
-	defer m.workersMu.RUnlock()
-
-	return len(m.workers)
-}
-
 // GetWorker returns a worker by ID, or nil if not found.
 func (m *Manager) GetWorker(id string) *ForwardWorker {
 	m.workersMu.RLock()
@@ -0,0 +1,333 @@
+package forward
+
+import (
+	"testing"
+	"time"
+
+	"github.com/nvm/kportal/internal/config"
+	"github.com/nvm/kportal/internal/events"
+	"github.com/stretchr/testify/assert"
+)
+
+// TestNewManager tests manager creation
+func TestNewManager(t *testing.T) {
+	t.Run("creates manager with default settings", func(t *testing.T) {
+		// Skip if no kubeconfig available (CI environment)
+		manager, err := NewManager(false)
+		if err != nil {
+			t.Skip("Skipping test - no kubeconfig available")
+		}
+		defer manager.Stop()
+
+		assert.NotNil(t, manager.workers)
+		assert.NotNil(t, manager.portChecker)
+		assert.NotNil(t, manager.healthChecker)
+		assert.NotNil(t, manager.watchdog)
+		assert.NotNil(t, manager.eventBus)
+		assert.False(t, manager.verbose)
+	})
+
+	t.Run("creates manager in verbose mode", func(t *testing.T) {
+		manager, err := NewManager(true)
+		if err != nil {
+			t.Skip("Skipping test - no kubeconfig available")
+		}
+		defer manager.Stop()
+
+		assert.True(t, manager.verbose)
+	})
+}
+
+// TestManager_SetStatusUI tests setting the status UI
+func TestManager_SetStatusUI(t *testing.T) {
+	manager, err := NewManager(false)
+	if err != nil {
+		t.Skip("Skipping test - no kubeconfig available")
+	}
+	defer manager.Stop()
+
+	mockUI := &MockStatusUpdater{}
+	manager.SetStatusUI(mockUI)
+
+	assert.Equal(t, mockUI, manager.statusUI)
+}
+
+// TestManager_GetWorker tests getting a worker by ID
+func TestManager_GetWorker(t *testing.T) {
+	manager, err := NewManager(false)
+	if err != nil {
+		t.Skip("Skipping test - no kubeconfig available")
+	}
+	defer manager.Stop()
+
+	// Non-existent worker
+	worker := manager.GetWorker("non-existent")
+	assert.Nil(t, worker)
+}
+
+// TestManager_Start_NilConfig tests starting with nil config
+func TestManager_Start_NilConfig(t *testing.T) {
+	manager, err := NewManager(false)
+	if err != nil {
+		t.Skip("Skipping test - no kubeconfig available")
+	}
+	defer manager.Stop()
+
+	err = manager.Start(nil)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "configuration is nil")
+}
+
+// TestManager_Start_EmptyForwards tests starting with empty forwards
+func TestManager_Start_EmptyForwards(t *testing.T) {
+	manager, err := NewManager(false)
+	if err != nil {
+		t.Skip("Skipping test - no kubeconfig available")
+	}
+	defer manager.Stop()
+
+	cfg := &config.Config{}
+	err = manager.Start(cfg)
+	// Empty config is now valid - allows users to add forwards via TUI
+	assert.NoError(t, err)
+}
+
+// TestManager_Reload_NilConfig tests reloading with nil config
+func TestManager_Reload_NilConfig(t *testing.T) {
+	manager, err := NewManager(false)
+	if err != nil {
+		t.Skip("Skipping test - no kubeconfig available")
+	}
+	defer manager.Stop()
+
+	err = manager.Reload(nil)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "new configuration is nil")
+}
+
+// TestManager_EnableForward_NoConfig tests enabling without config
+func TestManager_EnableForward_NoConfig(t *testing.T) {
+	manager, err := NewManager(false)
+	if err != nil {
+		t.Skip("Skipping test - no kubeconfig available")
+	}
+	defer manager.Stop()
+
+	err = manager.EnableForward("some-id")
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "no configuration available")
+}
+
+// TestManager_DisableForward_NotFound tests disabling non-existent forward
+func TestManager_DisableForward_NotFound(t *testing.T) {
+	manager, err := NewManager(false)
+	if err != nil {
+		t.Skip("Skipping test - no kubeconfig available")
+	}
+	defer manager.Stop()
+
+	err = manager.DisableForward("non-existent")
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "worker not found")
+}
+
+// TestManager_extractPorts tests port extraction
+func TestManager_extractPorts(t *testing.T) {
+	manager, err := NewManager(false)
+	if err != nil {
+		t.Skip("Skipping test - no kubeconfig available")
+	}
+	defer manager.Stop()
+
+	forwards := []config.Forward{
+		{LocalPort: 8080},
+		{LocalPort: 5432},
+		{LocalPort: 3000},
+	}
+
+	ports := manager.extractPorts(forwards)
+	assert.Equal(t, []int{8080, 5432, 3000}, ports)
+}
+
+// TestManager_getResourceForPort tests finding resource by port
+func TestManager_getResourceForPort(t *testing.T) {
+	manager, err := NewManager(false)
+	if err != nil {
+		t.Skip("Skipping test - no kubeconfig available")
+	}
+	defer manager.Stop()
+
+	forwards := []config.Forward{
+		{Resource: "pod/app1", LocalPort: 8080, Port: 80},
+		{Resource: "service/db", LocalPort: 5432, Port: 5432},
+	}
+
+	// Found
+	resource := manager.getResourceForPort(forwards, 8080)
+	assert.Contains(t, resource, "app1")
+
+	// Not found
+	resource = manager.getResourceForPort(forwards, 9999)
+	assert.Equal(t, "unknown", resource)
+}
+
+// MockStatusUpdater is a mock implementation of StatusUpdater
+type MockStatusUpdater struct {
+	updates   []StatusUpdate
+	adds      []ForwardAdd
+	removes   []string
+	errorSets []ErrorSet
+}
+
+type StatusUpdate struct {
+	ID     string
+	Status string
+}
+
+type ForwardAdd struct {
+	Fwd *config.Forward
+	ID  string
+}
+
+type ErrorSet struct {
+	ID  string
+	Msg string
+}
+
+func (m *MockStatusUpdater) UpdateStatus(id string, status string) {
+	m.updates = append(m.updates, StatusUpdate{ID: id, Status: status})
+}
+
+func (m *MockStatusUpdater) AddForward(id string, fwd *config.Forward) {
+	m.adds = append(m.adds, ForwardAdd{ID: id, Fwd: fwd})
+}
+
+func (m *MockStatusUpdater) Remove(id string) {
+	m.removes = append(m.removes, id)
+}
+
+func (m *MockStatusUpdater) SetError(id, msg string) {
+	m.errorSets = append(m.errorSets, ErrorSet{ID: id, Msg: msg})
+}
+
+// TestConfigureHealthChecker tests health checker configuration
+func TestConfigureHealthChecker(t *testing.T) {
+	manager, err := NewManager(false)
+	if err != nil {
+		t.Skip("Skipping test - no kubeconfig available")
+	}
+	defer manager.Stop()
+
+	tests := []struct {
+		name   string
+		method string
+	}{
+		{"tcp-dial method", "tcp-dial"},
+		{"data-transfer method", "data-transfer"},
+		{"unknown method defaults to data-transfer", "unknown"},
+		{"empty method defaults to data-transfer", ""},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := &config.Config{
+				HealthCheck: &config.HealthCheckSpec{
+					Method: tt.method,
+				},
+			}
+
+			// Should not panic
+			manager.configureHealthChecker(cfg)
+			assert.NotNil(t, manager.healthChecker)
+		})
+	}
+}
+
+// TestManager_Stop tests graceful shutdown
+func TestManager_Stop(t *testing.T) {
+	manager, err := NewManager(false)
+	if err != nil {
+		t.Skip("Skipping test - no kubeconfig available")
+	}
+
+	// Stop should not panic even with no workers
+	done := make(chan bool)
+	go func() {
+		manager.Stop()
+		done <- true
+	}()
+
+	select {
+	case <-done:
+		// Success
+	case <-time.After(5 * time.Second):
+		t.Fatal("Stop timed out")
+	}
+}
+
+// TestManager_Reload_EmptyToEmpty tests reloading from empty to empty config
+func TestManager_Reload_EmptyToEmpty(t *testing.T) {
+	manager, err := NewManager(false)
+	if err != nil {
+		t.Skip("Skipping test - no kubeconfig available")
+	}
+	defer manager.Stop()
+
+	cfg := &config.Config{}
+	err = manager.Reload(cfg)
+	// Should handle gracefully (stop all workers if any)
+	assert.NoError(t, err)
+}
+
+// TestPortConflict tests the PortConflict struct
+func TestPortConflict(t *testing.T) {
+	conflict := PortConflict{
+		Port:     8080,
+		Resource: "dev/default/pod/app:8080",
+		UsedBy:   "nginx (PID 1234)",
+	}
+
+	assert.Equal(t, 8080, conflict.Port)
+	assert.Equal(t, "dev/default/pod/app:8080", conflict.Resource)
+	assert.Equal(t, "nginx (PID 1234)", conflict.UsedBy)
+}
+
+// TestStatusUpdater_Interface tests that MockStatusUpdater implements StatusUpdater
+func TestStatusUpdater_Interface(t *testing.T) {
+	var _ StatusUpdater = (*MockStatusUpdater)(nil)
+}
+
+// TestManager_WorkersMap tests workers map operations
+func TestManager_WorkersMap(t *testing.T) {
+	manager, err := NewManager(false)
+	if err != nil {
+		t.Skip("Skipping test - no kubeconfig available")
+	}
+	defer manager.Stop()
+
+	// Initial state
+	assert.Empty(t, manager.workers)
+
+	// Verify concurrent-safe access patterns
+	manager.workersMu.RLock()
+	count := len(manager.workers)
+	manager.workersMu.RUnlock()
+	assert.Equal(t, 0, count)
+}
+
+// TestManager_EventBusIntegration tests event bus wiring
+func TestManager_EventBusIntegration(t *testing.T) {
+	manager, err := NewManager(false)
+	if err != nil {
+		t.Skip("Skipping test - no kubeconfig available")
+	}
+	defer manager.Stop()
+
+	// Event bus should be wired to health checker and watchdog
+	assert.NotNil(t, manager.eventBus)
+
+	// SubscribeAll should work (no return value in this API)
+	manager.eventBus.SubscribeAll(func(event events.Event) {
+		// Handler
+	})
+}
@@ -77,6 +77,7 @@ func getProcessNameByPID(pid string) string {

 // getProcessNameByPIDWindows retrieves the process name for a given PID on Windows
 func getProcessNameByPIDWindows(pid string) string {
+	// #nosec G204 -- pid is validated by isValidPID() to contain only digits
 	cmd := exec.Command("tasklist", "/FI", fmt.Sprintf("PID eq %s", pid), "/FO", "CSV", "/NH")
 	output, err := cmd.Output()
 	if err != nil {
@@ -98,9 +99,9 @@ func getProcessNameByPIDWindows(pid string) string {

 // PortConflict represents a local port that is already in use.
 type PortConflict struct {
-	Port     int    // The conflicting port number
-	Resource string // The forward resource that needs this port
-	UsedBy   string // Process information (PID, command) using the port
+	Resource string
+	UsedBy   string
+	Port     int
 }

 // PortChecker checks port availability on the local system.
@@ -145,7 +146,7 @@ func (pc *PortChecker) isPortAvailable(port int) bool {
 	if err != nil {
 		return false
 	}
-	listener.Close()
+	_ = listener.Close() // Best-effort cleanup; port check succeeded, Close error is non-critical
 	return true
 }

@@ -166,6 +167,7 @@ func (pc *PortChecker) getProcessUsingPort(port int) string {
 func (pc *PortChecker) getProcessUsingPortUnix(port int) string {
 	// Use lsof to find the process
 	// lsof -i :PORT -sTCP:LISTEN -t returns PIDs
+	// #nosec G204 -- port is an integer from config validation, not user input
 	cmd := exec.Command("lsof", "-i", fmt.Sprintf(":%d", port), "-sTCP:LISTEN", "-t")
 	output, err := cmd.Output()
 	if err != nil {
@@ -2,11 +2,186 @@ package forward

 import (
 	"net"
+	"runtime"
 	"testing"

 	"github.com/stretchr/testify/assert"
 )

+// TestIsValidPID tests PID validation
+func TestIsValidPID(t *testing.T) {
+	tests := []struct {
+		name     string
+		pid      string
+		expected bool
+	}{
+		{"valid single digit", "1", true},
+		{"valid multi digit", "12345", true},
+		{"valid max length", "123456789", true},
+		{"empty string", "", false},
+		{"too long", "1234567890", false},
+		{"contains letter", "123a", false},
+		{"contains space", "123 ", false},
+		{"negative sign", "-123", false},
+		{"decimal", "12.3", false},
+		{"just zero", "0", true},
+		{"leading zeros", "00123", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isValidPID(tt.pid)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestFormatProcessInfo tests process info formatting
+func TestFormatProcessInfo(t *testing.T) {
+	tests := []struct {
+		name     string
+		expected string
+		info     processInfo
+	}{
+		{
+			name:     "invalid process",
+			info:     processInfo{isValid: false},
+			expected: "unknown",
+		},
+		{
+			name:     "valid with name and pid",
+			info:     processInfo{pid: "1234", name: "nginx", isValid: true},
+			expected: "nginx (PID 1234)",
+		},
+		{
+			name:     "valid with only pid",
+			info:     processInfo{pid: "5678", name: "", isValid: true},
+			expected: "PID 5678",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := formatProcessInfo(tt.info)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestFormatProcessList tests process list formatting
+func TestFormatProcessList(t *testing.T) {
+	tests := []struct {
+		name      string
+		expected  string
+		processes []processInfo
+	}{
+		{
+			name:      "empty list",
+			processes: []processInfo{},
+			expected:  "unknown",
+		},
+		{
+			name:      "single process",
+			processes: []processInfo{{pid: "1234", name: "nginx", isValid: true}},
+			expected:  "nginx (PID 1234)",
+		},
+		{
+			name: "multiple processes",
+			processes: []processInfo{
+				{pid: "1234", name: "nginx", isValid: true},
+				{pid: "5678", name: "node", isValid: true},
+			},
+			expected: "nginx (PID 1234), node (PID 5678)",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := formatProcessList(tt.processes)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestIsListeningState tests listening state detection
+func TestIsListeningState(t *testing.T) {
+	tests := []struct {
+		name     string
+		line     string
+		fields   []string
+		expected bool
+	}{
+		{
+			name:     "English LISTENING",
+			line:     "TCP    0.0.0.0:8080    0.0.0.0:0    LISTENING    1234",
+			fields:   []string{"TCP", "0.0.0.0:8080", "0.0.0.0:0", "LISTENING", "1234"},
+			expected: true,
+		},
+		{
+			name:     "German ABHÖREN",
+			line:     "TCP    0.0.0.0:8080    0.0.0.0:0    ABHÖREN    1234",
+			fields:   []string{"TCP", "0.0.0.0:8080", "0.0.0.0:0", "ABHÖREN", "1234"},
+			expected: true,
+		},
+		{
+			name:     "French ÉCOUTE",
+			line:     "TCP    0.0.0.0:8080    0.0.0.0:0    ÉCOUTE    1234",
+			fields:   []string{"TCP", "0.0.0.0:8080", "0.0.0.0:0", "ÉCOUTE", "1234"},
+			expected: true,
+		},
+		{
+			name:     "Spanish ESCUCHANDO",
+			line:     "TCP    0.0.0.0:8080    0.0.0.0:0    ESCUCHANDO    1234",
+			fields:   []string{"TCP", "0.0.0.0:8080", "0.0.0.0:0", "ESCUCHANDO", "1234"},
+			expected: true,
+		},
+		{
+			name:     "ESTABLISHED (not listening)",
+			line:     "TCP    192.168.1.1:8080    10.0.0.1:443    ESTABLISHED    1234",
+			fields:   []string{"TCP", "192.168.1.1:8080", "10.0.0.1:443", "ESTABLISHED", "1234"},
+			expected: false,
+		},
+		{
+			name:     "too few fields",
+			line:     "TCP    0.0.0.0:8080",
+			fields:   []string{"TCP", "0.0.0.0:8080"},
+			expected: false,
+		},
+		{
+			name:     "lowercase listening (via fallback)",
+			line:     "tcp    0.0.0.0:8080    0.0.0.0:0    listening    1234",
+			fields:   []string{"tcp", "0.0.0.0:8080", "0.0.0.0:0", "listening", "1234"},
+			expected: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isListeningState(tt.line, tt.fields)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestGetProcessNameByPID tests process name lookup
+func TestGetProcessNameByPID(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("Skipping Unix-specific test on Windows")
+	}
+
+	// Test with PID 1 (init/systemd on Linux, launchd on macOS)
+	// This should return something on Unix systems
+	name := getProcessNameByPID("1")
+	// We don't assert the exact name since it varies by OS
+	// Just verify no panic and returns string
+	assert.IsType(t, "", name)
+
+	// Test with invalid PID
+	name = getProcessNameByPID("999999999")
+	// Should return empty string for non-existent process
+	assert.IsType(t, "", name)
+}
+
 func TestPortChecker_IsAvailable(t *testing.T) {
 	pc := NewPortChecker()

@@ -31,7 +206,8 @@ func TestPortChecker_CheckAvailability_EmptyPorts(t *testing.T) {
 func TestPortChecker_CheckAvailability_ExcludeMap(t *testing.T) {
 	pc := NewPortChecker()

-	// Create a listener to occupy a port
+	// Create a listener to occupy a port on all interfaces (matching production behavior)
+	// #nosec G102 -- test intentionally binds to all interfaces to match production port checking
 	listener, err := net.Listen("tcp", ":0")
 	assert.NoError(t, err, "should create listener")
 	defer listener.Close()
@@ -56,11 +232,13 @@ func TestPortChecker_CheckAvailability_ExcludeMap(t *testing.T) {
 func TestPortChecker_CheckAvailability_MultipleSkipPorts(t *testing.T) {
 	pc := NewPortChecker()

-	// Create multiple listeners
+	// Create multiple listeners on all interfaces (matching production behavior)
+	// #nosec G102 -- test intentionally binds to all interfaces to match production port checking
 	listener1, err := net.Listen("tcp", ":0")
 	assert.NoError(t, err)
 	defer listener1.Close()

+	// #nosec G102 -- test intentionally binds to all interfaces to match production port checking
 	listener2, err := net.Listen("tcp", ":0")
 	assert.NoError(t, err)
 	defer listener2.Close()
@@ -178,7 +356,8 @@ func TestNewPortChecker(t *testing.T) {
 func TestPortChecker_PortAvailability_Integration(t *testing.T) {
 	pc := NewPortChecker()

-	// Create a listener to occupy a port
+	// Create a listener to occupy a port on all interfaces (matching production behavior)
+	// #nosec G102 -- test intentionally binds to all interfaces to match production port checking
 	listener, err := net.Listen("tcp", ":0")
 	assert.NoError(t, err, "should create listener")
 	defer listener.Close()
@@ -5,41 +5,69 @@ import (
 	"sync"
 	"time"

+	"github.com/nvm/kportal/internal/events"
 	"github.com/nvm/kportal/internal/logger"
 )

-// Watchdog monitors worker goroutines to detect hung workers
+const (
+	// defaultHeartbeatInterval is how often the watchdog sends heartbeats to workers
+	defaultHeartbeatInterval = 15 * time.Second
+)
+
+// Watchdog monitors worker goroutines to detect hung workers.
+// It centralizes heartbeat management - instead of each worker sending heartbeats,
+// the watchdog polls workers periodically. This reduces goroutine count and
+// simplifies worker implementation.
 type Watchdog struct {
-	mu            sync.RWMutex
-	workers       map[string]*workerState // key: forward ID
-	checkInterval time.Duration
-	hangThreshold time.Duration // How long without heartbeat before considered hung
-	ctx           context.Context
-	cancel        context.CancelFunc
-	wg            sync.WaitGroup
+	ctx               context.Context
+	workers           map[string]*workerState
+	cancel            context.CancelFunc
+	eventBus          *events.Bus
+	wg                sync.WaitGroup
+	checkInterval     time.Duration
+	hangThreshold     time.Duration
+	heartbeatInterval time.Duration
+	mu                sync.RWMutex
 }

 // workerState tracks the health of a single worker
 type workerState struct {
-	forwardID      string
 	lastHeartbeat  time.Time
+	worker         HeartbeatResponder
+	onHungCallback func(forwardID string)
+	forwardID      string
 	heartbeatCount uint64
 	isHung         bool
-	onHungCallback func(forwardID string)
+}
+
+// HeartbeatResponder is an interface for workers that can respond to heartbeat checks
+type HeartbeatResponder interface {
+	// IsAlive returns true if the worker is still responsive
+	IsAlive() bool
+	// GetForwardID returns the forward ID this worker manages
+	GetForwardID() string
 }

 // NewWatchdog creates a new goroutine watchdog
 func NewWatchdog(checkInterval, hangThreshold time.Duration) *Watchdog {
 	ctx, cancel := context.WithCancel(context.Background())
 	return &Watchdog{
-		workers:       make(map[string]*workerState),
-		checkInterval: checkInterval,
-		hangThreshold: hangThreshold,
-		ctx:           ctx,
-		cancel:        cancel,
+		workers:           make(map[string]*workerState),
+		checkInterval:     checkInterval,
+		hangThreshold:     hangThreshold,
+		heartbeatInterval: defaultHeartbeatInterval,
+		ctx:               ctx,
+		cancel:            cancel,
 	}
 }

+// SetEventBus sets the event bus for publishing watchdog events
+func (w *Watchdog) SetEventBus(bus *events.Bus) {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	w.eventBus = bus
+}
+
 // Start begins the watchdog monitoring loop
 func (w *Watchdog) Start() {
 	w.wg.Add(1)
@@ -70,6 +98,25 @@ func (w *Watchdog) RegisterWorker(forwardID string, onHungCallback func(string))
 	})
 }

+// RegisterWorkerWithResponder adds a worker to monitor with heartbeat polling support
+func (w *Watchdog) RegisterWorkerWithResponder(forwardID string, responder HeartbeatResponder, onHungCallback func(string)) {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+
+	w.workers[forwardID] = &workerState{
+		forwardID:      forwardID,
+		lastHeartbeat:  time.Now(),
+		heartbeatCount: 0,
+		isHung:         false,
+		onHungCallback: onHungCallback,
+		worker:         responder,
+	}
+
+	logger.Debug("Watchdog registered worker with responder", map[string]interface{}{
+		"forward_id": forwardID,
+	})
+}
+
 // UnregisterWorker removes a worker from monitoring
 func (w *Watchdog) UnregisterWorker(forwardID string) {
 	w.mu.Lock()
@@ -82,8 +129,9 @@ func (w *Watchdog) UnregisterWorker(forwardID string) {
 	})
 }

-// Heartbeat records that a worker is alive and processing
-// Workers should call this periodically (e.g., in their main loop)
+// Heartbeat records that a worker is alive and processing.
+// This can be called by workers directly (legacy) or the watchdog can poll
+// workers via HeartbeatResponder interface.
 func (w *Watchdog) Heartbeat(forwardID string) {
 	w.mu.Lock()
 	defer w.mu.Unlock()
@@ -106,35 +154,68 @@ func (w *Watchdog) GetWorkerState(forwardID string) (lastHeartbeat time.Time, co
 	return time.Time{}, 0, false
 }

-// monitorLoop periodically checks all workers
+// monitorLoop periodically checks all workers and polls for heartbeats
 func (w *Watchdog) monitorLoop() {
 	defer w.wg.Done()

-	ticker := time.NewTicker(w.checkInterval)
-	defer ticker.Stop()
+	checkTicker := time.NewTicker(w.checkInterval)
+	defer checkTicker.Stop()
+
+	// Heartbeat polling ticker - polls workers for heartbeat more frequently
+	heartbeatTicker := time.NewTicker(w.heartbeatInterval)
+	defer heartbeatTicker.Stop()

 	for {
 		select {
 		case <-w.ctx.Done():
 			return
-		case <-ticker.C:
+		case <-heartbeatTicker.C:
+			// Poll all workers for heartbeat (centralized heartbeat management)
+			w.pollHeartbeats()
+		case <-checkTicker.C:
+			// Check for hung workers
 			w.checkWorkers()
 		}
 	}
 }

+// pollHeartbeats polls all registered workers for heartbeat.
+// This centralizes heartbeat management in the watchdog instead of having
+// each worker spawn its own heartbeat goroutine.
+func (w *Watchdog) pollHeartbeats() {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+
+	now := time.Now()
+	for forwardID, state := range w.workers {
+		// If worker has a responder, poll it
+		if state.worker != nil {
+			if state.worker.IsAlive() {
+				state.lastHeartbeat = now
+				state.heartbeatCount++
+				state.isHung = false
+			}
+		}
+		// If no responder, worker must call Heartbeat() directly (legacy mode)
+		// This maintains backward compatibility
+		_ = forwardID // Avoid unused variable warning
+	}
+}
+
 // hungWorkerInfo stores information about a hung worker for deferred callback execution
 type hungWorkerInfo struct {
-	forwardID string
 	callback  func(string)
+	forwardID string
 }

 // checkWorkers checks all registered workers for hung state
 func (w *Watchdog) checkWorkers() {
 	// Collect hung workers while holding the lock
 	var hungWorkers []hungWorkerInfo
+	var eventBus *events.Bus

 	w.mu.Lock()
+	eventBus = w.eventBus
 	now := time.Now()
 	for forwardID, state := range w.workers {
 		timeSinceHeartbeat := now.Sub(state.lastHeartbeat)
@@ -169,6 +250,11 @@ func (w *Watchdog) checkWorkers() {
 	// (they trigger reconnection via channels), so concurrent state changes
 	// between detection and callback execution are safe.
 	for _, hw := range hungWorkers {
+		// Publish event if event bus is available
+		if eventBus != nil {
+			eventBus.Publish(events.NewWorkerHungEvent(hw.forwardID, w.hangThreshold.String()))
+		}
+
 		hw.callback(hw.forwardID)
 	}
 }
@@ -23,22 +23,23 @@ const (

 // ForwardWorker manages a single port-forward connection with automatic retry.
 type ForwardWorker struct {
-	forward         config.Forward
-	portForwarder   *k8s.PortForwarder
-	ctx             context.Context
-	cancel          context.CancelFunc
-	stopChan        chan struct{}
-	doneChan        chan struct{}
-	reconnectChan   chan string // Channel to trigger reconnection
-	verbose         bool
-	lastPod         string // Track the last pod we connected to
+	startTime       time.Time
 	statusUI        StatusUpdater
-	healthChecker   *healthcheck.Checker
+	ctx             context.Context
+	reconnectChan   chan string
+	httpProxy       *httplog.Proxy
 	watchdog        *Watchdog
-	startTime       time.Time          // Track when the worker started
-	forwardCancel   context.CancelFunc // Cancel function for current forward attempt
-	forwardCancelMu sync.Mutex         // Protects forwardCancel
-	httpProxy       *httplog.Proxy     // HTTP logging proxy (nil if not enabled)
+	cancel          context.CancelFunc
+	doneChan        chan struct{}
+	portForwarder   *k8s.PortForwarder
+	successChan     chan struct{}
+	healthChecker   *healthcheck.Checker
+	forwardCancel   context.CancelFunc
+	stopChan        chan struct{}
+	lastPod         string
+	forward         config.Forward
+	forwardCancelMu sync.Mutex
+	verbose         bool
 }

 // NewForwardWorker creates a new ForwardWorker for a single forward configuration.
@@ -52,7 +53,8 @@ func NewForwardWorker(fwd config.Forward, portForwarder *k8s.PortForwarder, verb
 		cancel:        cancel,
 		stopChan:      make(chan struct{}),
 		doneChan:      make(chan struct{}),
-		reconnectChan: make(chan string, 1), // Buffered to avoid blocking
+		reconnectChan: make(chan string, 1),   // Buffered to avoid blocking
+		successChan:   make(chan struct{}, 1), // Buffered to avoid blocking
 		verbose:       verbose,
 		statusUI:      statusUI,
 		healthChecker: healthChecker,
@@ -61,6 +63,16 @@ func NewForwardWorker(fwd config.Forward, portForwarder *k8s.PortForwarder, verb
 	}
 }

+// signalConnectionSuccess signals that a connection was successfully established.
+// This is used to reset the backoff timer after a successful connection.
+func (w *ForwardWorker) signalConnectionSuccess() {
+	select {
+	case w.successChan <- struct{}{}:
+	default:
+		// Channel already has pending signal
+	}
+}
+
 // TriggerReconnect triggers a reconnection (e.g., due to stale connection)
 func (w *ForwardWorker) TriggerReconnect(reason string) {
 	// Cancel current forward if running
@@ -100,20 +112,37 @@ func (w *ForwardWorker) Stop() {
 	}
 }

+// IsAlive implements HeartbeatResponder interface.
+// Returns true if the worker goroutine is still running and responsive.
+func (w *ForwardWorker) IsAlive() bool {
+	select {
+	case <-w.doneChan:
+		return false
+	case <-w.ctx.Done():
+		return false
+	default:
+		return true
+	}
+}
+
+// GetForwardID implements HeartbeatResponder interface.
+func (w *ForwardWorker) GetForwardID() string {
+	return w.forward.ID()
+}
+
 // run is the main worker loop that handles retries.
 func (w *ForwardWorker) run() {
 	defer close(w.doneChan)
 	defer w.stopHTTPProxy() // Ensure proxy is stopped on exit

-	// Start heartbeat goroutine to continuously send heartbeats to watchdog
-	// This prevents false "hung worker" detection when connections are long-lived
-	if w.watchdog != nil {
-		go w.heartbeatLoop()
-	}
+	// Note: Heartbeat management is now centralized in the Watchdog.
+	// The watchdog polls workers via the HeartbeatResponder interface (IsAlive method)
+	// instead of each worker spawning its own heartbeat goroutine.
+	// This reduces goroutine count from 2N to N for N workers.

 	// Start HTTP logging proxy if enabled
 	if err := w.startHTTPProxy(); err != nil {
-		logger.Error("Failed to start HTTP logging proxy", map[string]interface{}{
+		logger.Error("Failed to start HTTP logging proxy", map[string]any{
 			"forward_id": w.forward.ID(),
 			"error":      err.Error(),
 		})
@@ -123,13 +152,16 @@ func (w *ForwardWorker) run() {
 	backoff := retry.NewBackoff()

 	for {
-		// Check if we should stop
+		// Check if we should stop or reset backoff on successful connection
 		select {
 		case <-w.ctx.Done():
 			if w.verbose {
 				log.Printf("[%s] Worker stopped", w.forward.ID())
 			}
 			return
+		case <-w.successChan:
+			// Reset backoff after successful connection
+			backoff.Reset()
 		default:
 		}

@@ -143,7 +175,7 @@ func (w *ForwardWorker) run() {
 		)

 		if err != nil {
-			logger.Error("Failed to resolve resource", map[string]interface{}{
+			logger.Error("Failed to resolve resource", map[string]any{
 				"forward_id": w.forward.ID(),
 				"context":    w.forward.GetContext(),
 				"namespace":  w.forward.GetNamespace(),
@@ -159,7 +191,7 @@ func (w *ForwardWorker) run() {
 			if w.healthChecker != nil {
 				w.healthChecker.MarkReconnecting(w.forward.ID())
 			}
-			logger.Info("Pod restart detected, switching to new pod", map[string]interface{}{
+			logger.Info("Pod restart detected, switching to new pod", map[string]any{
 				"forward_id": w.forward.ID(),
 				"old_pod":    w.lastPod,
 				"new_pod":    podName,
@@ -167,7 +199,7 @@ func (w *ForwardWorker) run() {
 				"namespace":  w.forward.GetNamespace(),
 			})
 		} else if w.lastPod == "" {
-			logger.Info("Starting port forward", map[string]interface{}{
+			logger.Info("Starting port forward", map[string]any{
 				"forward_id": w.forward.ID(),
 				"target":     w.forward.String(),
 				"local_port": w.forward.LocalPort,
@@ -196,7 +228,7 @@ func (w *ForwardWorker) run() {
 			}

 			// Log the error
-			logger.Warn("Port-forward connection failed, will retry", map[string]interface{}{
+			logger.Warn("Port-forward connection failed, will retry", map[string]any{
 				"forward_id": w.forward.ID(),
 				"context":    w.forward.GetContext(),
 				"namespace":  w.forward.GetNamespace(),
@@ -225,26 +257,6 @@ func (w *ForwardWorker) run() {
 	}
 }

-// heartbeatLoop sends periodic heartbeats to the watchdog to prove the worker is alive
-// This runs in a separate goroutine and continues throughout the worker's lifetime
-func (w *ForwardWorker) heartbeatLoop() {
-	// Send heartbeats every 15 seconds (well within typical 60s watchdog timeout)
-	ticker := time.NewTicker(15 * time.Second)
-	defer ticker.Stop()
-
-	// Send immediate heartbeat
-	w.watchdog.Heartbeat(w.forward.ID())
-
-	for {
-		select {
-		case <-ticker.C:
-			w.watchdog.Heartbeat(w.forward.ID())
-		case <-w.ctx.Done():
-			return
-		}
-	}
-}
-
 // establishForward establishes a port-forward connection.
 // This blocks until the connection is closed or an error occurs.
 func (w *ForwardWorker) establishForward(podName string) error {
@@ -267,15 +279,26 @@ func (w *ForwardWorker) establishForward(podName string) error {
 		w.forwardCancelMu.Unlock()
 	}()

+	// Use sync.Once to ensure stopChan is closed exactly once
+	var closeOnce sync.Once
+	closeStopChan := func() {
+		closeOnce.Do(func() {
+			close(stopChan)
+		})
+	}
+
+	// Ensure stopChan is closed when this function exits (prevents goroutine leak)
+	defer closeStopChan()
+
 	// Start a goroutine to monitor for stop signal and reconnect triggers
 	go func() {
 		select {
 		case <-w.stopChan:
-			close(stopChan)
+			closeStopChan()
 		case <-w.reconnectChan:
-			close(stopChan)
+			closeStopChan()
 		case <-forwardCtx.Done():
-			close(stopChan)
+			closeStopChan()
 		}
 	}()

@@ -313,6 +336,11 @@ func (w *ForwardWorker) establishForward(podName string) error {
 	// Start port forwarding in a goroutine
 	errChan := make(chan error, 1)
 	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				errChan <- fmt.Errorf("port forward panicked: %v", r)
+			}
+		}()
 		errChan <- w.portForwarder.Forward(forwardCtx, req)
 	}()

@@ -326,6 +354,8 @@ func (w *ForwardWorker) establishForward(podName string) error {
 		if w.healthChecker != nil {
 			w.healthChecker.MarkConnected(w.forward.ID())
 		}
+		// Signal success back to caller so backoff can be reset
+		w.signalConnectionSuccess()
 	case err := <-errChan:
 		return fmt.Errorf("failed to establish forward: %w", err)
 	case <-w.ctx.Done():
@@ -384,6 +414,14 @@ func (w *ForwardWorker) startHTTPProxy() error {
 	// Calculate internal port for k8s tunnel
 	targetPort := w.forward.LocalPort + httpLogPortOffset

+	// Validate that the target port is available before attempting to bind
+	portChecker := NewPortChecker()
+	if !portChecker.isPortAvailable(targetPort) {
+		usedBy := portChecker.getProcessUsingPort(targetPort)
+		return fmt.Errorf("HTTP proxy target port %d is already in use by %s (forward port %d + offset %d)",
+			targetPort, usedBy, w.forward.LocalPort, httpLogPortOffset)
+	}
+
 	proxy, err := httplog.NewProxy(&w.forward, targetPort)
 	if err != nil {
 		return fmt.Errorf("failed to create HTTP proxy: %w", err)
@@ -395,7 +433,7 @@ func (w *ForwardWorker) startHTTPProxy() error {

 	w.httpProxy = proxy

-	logger.Info("HTTP logging proxy started", map[string]interface{}{
+	logger.Info("HTTP logging proxy started", map[string]any{
 		"forward_id":  w.forward.ID(),
 		"local_port":  w.forward.LocalPort,
 		"target_port": targetPort,
@@ -408,7 +446,7 @@ func (w *ForwardWorker) startHTTPProxy() error {
 func (w *ForwardWorker) stopHTTPProxy() {
 	if w.httpProxy != nil {
 		if err := w.httpProxy.Stop(); err != nil {
-			logger.Warn("Failed to stop HTTP proxy", map[string]interface{}{
+			logger.Warn("Failed to stop HTTP proxy", map[string]any{
 				"forward_id": w.forward.ID(),
 				"error":      err.Error(),
 			})
@@ -0,0 +1,353 @@
+package forward
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/nvm/kportal/internal/config"
+	"github.com/stretchr/testify/assert"
+)
+
+// TestNewForwardWorker tests worker creation
+func TestNewForwardWorker(t *testing.T) {
+	fwd := config.Forward{
+		Resource:  "pod/my-app",
+		LocalPort: 8080,
+		Port:      80,
+	}
+
+	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
+
+	assert.NotNil(t, worker)
+	assert.Equal(t, fwd, worker.forward)
+	assert.False(t, worker.verbose)
+	assert.NotNil(t, worker.ctx)
+	assert.NotNil(t, worker.stopChan)
+	assert.NotNil(t, worker.doneChan)
+	assert.NotNil(t, worker.reconnectChan)
+	assert.NotNil(t, worker.successChan)
+}
+
+// TestNewForwardWorker_Verbose tests verbose mode worker creation
+func TestNewForwardWorker_Verbose(t *testing.T) {
+	fwd := config.Forward{
+		Resource:  "pod/my-app",
+		LocalPort: 8080,
+		Port:      80,
+	}
+
+	worker := NewForwardWorker(fwd, nil, true, nil, nil, nil)
+
+	assert.True(t, worker.verbose)
+}
+
+// TestWorker_GetForwardConfig tests getting forward config
+func TestWorker_GetForwardConfig(t *testing.T) {
+	fwd := config.Forward{
+		Resource:  "service/postgres",
+		LocalPort: 5432,
+		Port:      5432,
+		Alias:     "db",
+	}
+
+	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
+	result := worker.GetForward()
+
+	assert.Equal(t, fwd, result)
+	assert.Equal(t, "service/postgres", result.Resource)
+	assert.Equal(t, 5432, result.LocalPort)
+	assert.Equal(t, "db", result.Alias)
+}
+
+// TestForwardWorker_GetForwardID tests GetForwardID implementation
+func TestForwardWorker_GetForwardID(t *testing.T) {
+	fwd := config.Forward{
+		Resource:  "pod/my-app",
+		LocalPort: 8080,
+		Port:      80,
+	}
+
+	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
+	id := worker.GetForwardID()
+
+	assert.NotEmpty(t, id)
+	assert.Equal(t, fwd.ID(), id)
+}
+
+// TestForwardWorker_IsAlive tests IsAlive implementation
+func TestForwardWorker_IsAlive(t *testing.T) {
+	fwd := config.Forward{
+		Resource:  "pod/my-app",
+		LocalPort: 8080,
+		Port:      80,
+	}
+
+	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
+
+	// Before starting, worker should be "alive" (context not cancelled)
+	assert.True(t, worker.IsAlive())
+
+	// Cancel context
+	worker.cancel()
+
+	// After cancel, IsAlive should return false
+	assert.False(t, worker.IsAlive())
+}
+
+// TestWorker_IsRunningState tests IsRunning method
+func TestWorker_IsRunningState(t *testing.T) {
+	fwd := config.Forward{
+		Resource:  "pod/my-app",
+		LocalPort: 8080,
+		Port:      80,
+	}
+
+	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
+
+	// Before done channel is closed, worker is "running"
+	assert.True(t, worker.IsRunning())
+
+	// Close done channel to simulate worker completion
+	close(worker.doneChan)
+
+	// After done channel closed, worker is not running
+	assert.False(t, worker.IsRunning())
+}
+
+// TestForwardWorker_SignalConnectionSuccess tests success signaling
+func TestForwardWorker_SignalConnectionSuccess(t *testing.T) {
+	fwd := config.Forward{
+		Resource:  "pod/my-app",
+		LocalPort: 8080,
+		Port:      80,
+	}
+
+	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
+
+	// Signal success
+	worker.signalConnectionSuccess()
+
+	// Should be able to receive from success channel
+	select {
+	case <-worker.successChan:
+		// Success
+	case <-time.After(100 * time.Millisecond):
+		t.Fatal("Expected signal on success channel")
+	}
+
+	// Second signal should not block (buffer of 1)
+	worker.signalConnectionSuccess()
+	worker.signalConnectionSuccess() // Should not block
+
+	// Channel should have at most 1 pending signal
+	select {
+	case <-worker.successChan:
+		// Got the signal
+	default:
+		// No signal (also acceptable - channel already had one)
+	}
+}
+
+// TestForwardWorker_TriggerReconnect tests reconnect triggering
+func TestForwardWorker_TriggerReconnect(t *testing.T) {
+	fwd := config.Forward{
+		Resource:  "pod/my-app",
+		LocalPort: 8080,
+		Port:      80,
+	}
+
+	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
+
+	// Trigger reconnect
+	worker.TriggerReconnect("test reason")
+
+	// Should be able to receive from reconnect channel
+	select {
+	case reason := <-worker.reconnectChan:
+		assert.Equal(t, "test reason", reason)
+	case <-time.After(100 * time.Millisecond):
+		t.Fatal("Expected signal on reconnect channel")
+	}
+}
+
+// TestForwardWorker_TriggerReconnect_WithForwardCancel tests reconnect with active forward
+func TestForwardWorker_TriggerReconnect_WithForwardCancel(t *testing.T) {
+	fwd := config.Forward{
+		Resource:  "pod/my-app",
+		LocalPort: 8080,
+		Port:      80,
+	}
+
+	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
+
+	// Set up a forward cancel function
+	ctx, cancel := context.WithCancel(context.Background())
+	worker.forwardCancelMu.Lock()
+	worker.forwardCancel = cancel
+	worker.forwardCancelMu.Unlock()
+
+	// Trigger reconnect
+	worker.TriggerReconnect("stale connection")
+
+	// Context should be cancelled
+	select {
+	case <-ctx.Done():
+		// Success - context was cancelled
+	case <-time.After(100 * time.Millisecond):
+		t.Fatal("Expected forward context to be cancelled")
+	}
+}
+
+// TestForwardWorker_TriggerReconnect_NonBlocking tests non-blocking behavior
+func TestForwardWorker_TriggerReconnect_NonBlocking(t *testing.T) {
+	fwd := config.Forward{
+		Resource:  "pod/my-app",
+		LocalPort: 8080,
+		Port:      80,
+	}
+
+	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
+
+	// Fill the channel
+	worker.reconnectChan <- "first"
+
+	// Second trigger should not block
+	done := make(chan bool)
+	go func() {
+		worker.TriggerReconnect("second")
+		done <- true
+	}()
+
+	select {
+	case <-done:
+		// Success - didn't block
+	case <-time.After(100 * time.Millisecond):
+		t.Fatal("TriggerReconnect blocked when channel was full")
+	}
+}
+
+// TestForwardWorker_Stop tests graceful stop
+func TestForwardWorker_Stop(t *testing.T) {
+	fwd := config.Forward{
+		Resource:  "pod/my-app",
+		LocalPort: 8080,
+		Port:      80,
+	}
+
+	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
+
+	// Close done channel to simulate worker has finished
+	close(worker.doneChan)
+
+	// Stop should complete quickly since worker is "done"
+	done := make(chan bool)
+	go func() {
+		worker.Stop()
+		done <- true
+	}()
+
+	select {
+	case <-done:
+		// Success
+	case <-time.After(5 * time.Second):
+		t.Fatal("Stop timed out")
+	}
+}
+
+// TestForwardWorker_Stop_Timeout tests stop timeout behavior
+func TestForwardWorker_Stop_Timeout(t *testing.T) {
+	fwd := config.Forward{
+		Resource:  "pod/my-app",
+		LocalPort: 8080,
+		Port:      80,
+	}
+
+	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
+	// Don't close doneChan - simulate hanging worker
+
+	// Stop should timeout after ~3 seconds
+	start := time.Now()
+	done := make(chan bool)
+	go func() {
+		worker.Stop()
+		done <- true
+	}()
+
+	select {
+	case <-done:
+		elapsed := time.Since(start)
+		// Should have waited at least 2 seconds but not more than 5
+		assert.True(t, elapsed >= 2*time.Second, "Should wait for timeout")
+		assert.True(t, elapsed < 5*time.Second, "Should not wait too long")
+	case <-time.After(10 * time.Second):
+		t.Fatal("Stop never completed")
+	}
+}
+
+// TestForwardWorker_GetHTTPProxy tests HTTP proxy getter
+func TestForwardWorker_GetHTTPProxy(t *testing.T) {
+	fwd := config.Forward{
+		Resource:  "pod/my-app",
+		LocalPort: 8080,
+		Port:      80,
+	}
+
+	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
+
+	// Initially nil
+	proxy := worker.GetHTTPProxy()
+	assert.Nil(t, proxy)
+}
+
+// TestForwardWorker_HeartbeatResponder tests HeartbeatResponder interface
+func TestForwardWorker_HeartbeatResponder(t *testing.T) {
+	fwd := config.Forward{
+		Resource:  "pod/my-app",
+		LocalPort: 8080,
+		Port:      80,
+	}
+
+	worker := NewForwardWorker(fwd, nil, false, nil, nil, nil)
+
+	// Worker should implement HeartbeatResponder
+	var responder HeartbeatResponder = worker
+	assert.NotNil(t, responder)
+
+	// Test interface methods
+	assert.True(t, responder.IsAlive())
+	assert.NotEmpty(t, responder.GetForwardID())
+}
+
+// TestLogWriter tests the logWriter implementation
+func TestLogWriter(t *testing.T) {
+	tests := []struct {
+		name   string
+		prefix string
+		input  []byte
+	}{
+		{"simple message", "[test] ", []byte("hello")},
+		{"empty message", "[test] ", []byte("")},
+		{"multiline", "[test] ", []byte("line1\nline2")},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			lw := &logWriter{prefix: tt.prefix}
+			n, err := lw.Write(tt.input)
+
+			assert.NoError(t, err)
+			assert.Equal(t, len(tt.input), n)
+		})
+	}
+}
+
+// TestHTTPLogPortOffset tests the port offset constant
+func TestHTTPLogPortOffset(t *testing.T) {
+	assert.Equal(t, 10000, httpLogPortOffset)
+}
+
+// TestPortForwardReadyTimeout tests the ready timeout constant
+func TestPortForwardReadyTimeout(t *testing.T) {
+	assert.Equal(t, 30*time.Second, portForwardReadyTimeout)
+}
@@ -55,8 +55,8 @@ func TestLogWriter_Write(t *testing.T) {
 func TestForwardWorker_GetForward(t *testing.T) {
 	tests := []struct {
 		name        string
-		forward     config.Forward
 		description string
+		forward     config.Forward
 	}{
 		{
 			name: "get pod forward",
@@ -141,9 +141,9 @@ func TestForwardWorker_IsRunning(t *testing.T) {
 func TestForwardID(t *testing.T) {
 	tests := []struct {
 		name         string
+		description  string
 		forward      config.Forward
 		expectUnique bool
-		description  string
 	}{
 		{
 			name: "unique IDs for different forwards",
@@ -183,9 +183,9 @@ func TestForwardID(t *testing.T) {
 func TestForwardString(t *testing.T) {
 	tests := []struct {
 		name             string
-		forward          config.Forward
-		expectedContains []string
 		description      string
+		expectedContains []string
+		forward          config.Forward
 	}{
 		{
 			name: "pod forward string",
@@ -259,8 +259,8 @@ func TestSleepWithBackoffConcept(t *testing.T) {
 func TestWorkerVerboseMode(t *testing.T) {
 	tests := []struct {
 		name        string
-		verbose     bool
 		description string
+		verbose     bool
 	}{
 		{
 			name:        "verbose mode enabled",
@@ -1,3 +1,17 @@
+// Package healthcheck provides connection health monitoring for port-forwards.
+// It detects stale, hung, or broken connections and triggers reconnection.
+//
+// The Checker supports two health check methods:
+//   - tcp-dial: Simple TCP connection test (fast but less reliable)
+//   - data-transfer: Attempts to read data from the connection (more reliable)
+//
+// Stale connection detection prevents issues during long-running operations
+// like database dumps by monitoring:
+//   - Connection age (default: 25 minutes, before k8s 30-minute timeout)
+//   - Idle time (default: 10 minutes, detects hung tunnels)
+//
+// The package uses a sync.Pool for buffer reuse to minimize GC pressure
+// during frequent health checks.
 package healthcheck

 import (
@@ -9,8 +23,18 @@ import (
 	"time"

 	"github.com/nvm/kportal/internal/config"
+	"github.com/nvm/kportal/internal/events"
 )

+// bufferPool is a sync.Pool for reusing buffers in data transfer health checks.
+// This reduces GC pressure by avoiding allocation of 1KB buffers on every health check.
+var bufferPool = sync.Pool{
+	New: func() interface{} {
+		buf := make([]byte, dataTransferSize)
+		return &buf
+	},
+}
+
 const (
 	startupGracePeriod = 10 * time.Second
 	dataTransferSize   = 1024 // bytes to read in data transfer test
@@ -37,38 +61,42 @@ const (

 // PortHealth represents the health status of a single port
 type PortHealth struct {
-	Port           int
 	LastCheck      time.Time
+	RegisteredAt   time.Time
+	ConnectionTime time.Time
+	LastActivity   time.Time
 	Status         Status
 	ErrorMessage   string
-	RegisteredAt   time.Time // When this port was registered
-	ConnectionTime time.Time // When current connection was established
-	LastActivity   time.Time // Last time data was transferred
+	Port           int
 }

 // StatusCallback is called when a port's health status changes
 type StatusCallback func(forwardID string, status Status, errorMsg string)

-// Checker performs periodic health checks on local ports
+// Checker performs periodic health checks on local ports.
+// Uses a single goroutine to check all registered ports, reducing overhead
+// compared to one goroutine per port.
 type Checker struct {
-	mu               sync.RWMutex
-	ports            map[string]*PortHealth // key: forward ID
-	callbacks        map[string]StatusCallback
-	interval         time.Duration
-	timeout          time.Duration
-	method           CheckMethod
-	maxConnectionAge time.Duration
-	maxIdleTime      time.Duration
 	ctx              context.Context
+	ports            map[string]*PortHealth
+	callbacks        map[string]StatusCallback
+	eventBus         *events.Bus
 	cancel           context.CancelFunc
+	method           CheckMethod
 	wg               sync.WaitGroup
+	interval         time.Duration
+	maxIdleTime      time.Duration
+	maxConnectionAge time.Duration
+	timeout          time.Duration
+	mu               sync.RWMutex
+	started          bool
 }

 // CheckerOptions configures the health checker
 type CheckerOptions struct {
+	Method           CheckMethod
 	Interval         time.Duration
 	Timeout          time.Duration
-	Method           CheckMethod
 	MaxConnectionAge time.Duration
 	MaxIdleTime      time.Duration
 }
@@ -87,7 +115,7 @@ func NewChecker(interval, timeout time.Duration) *Checker {
 // NewCheckerWithOptions creates a new health checker with custom options
 func NewCheckerWithOptions(opts CheckerOptions) *Checker {
 	ctx, cancel := context.WithCancel(context.Background())
-	return &Checker{
+	c := &Checker{
 		ports:            make(map[string]*PortHealth),
 		callbacks:        make(map[string]StatusCallback),
 		interval:         opts.Interval,
@@ -98,12 +126,25 @@ func NewCheckerWithOptions(opts CheckerOptions) *Checker {
 		ctx:              ctx,
 		cancel:           cancel,
 	}
+
+	// Start the single monitoring loop
+	c.wg.Add(1)
+	go c.monitorLoop()
+	c.started = true
+
+	return c
+}
+
+// SetEventBus sets the event bus for publishing health events
+func (c *Checker) SetEventBus(bus *events.Bus) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.eventBus = bus
 }

 // Register adds a port to monitor
 func (c *Checker) Register(forwardID string, port int, callback StatusCallback) {
 	c.mu.Lock()
-	defer c.mu.Unlock()

 	now := time.Now()
 	c.ports[forwardID] = &PortHealth{
@@ -115,22 +156,33 @@ func (c *Checker) Register(forwardID string, port int, callback StatusCallback)
 		LastActivity:   now,
 	}
 	c.callbacks[forwardID] = callback
+	c.mu.Unlock()

-	// Start checking this port
-	c.wg.Add(1)
-	go c.checkLoop(forwardID)
+	// Perform immediate first check so status updates quickly
+	// This prevents the forward from being stuck in "Starting" state
+	// until the next ticker interval
+	go c.checkPort(forwardID)
 }

-// MarkConnected marks a forward as having established a new connection
+// MarkConnected marks a forward as having established a new connection.
+// This updates connection timestamps and triggers an immediate health check
+// to verify the connection is actually working.
 func (c *Checker) MarkConnected(forwardID string) {
 	c.mu.Lock()
-	defer c.mu.Unlock()

-	if health, exists := c.ports[forwardID]; exists {
-		now := time.Now()
-		health.ConnectionTime = now
-		health.LastActivity = now
+	health, exists := c.ports[forwardID]
+	if !exists {
+		c.mu.Unlock()
+		return
 	}
+
+	now := time.Now()
+	health.ConnectionTime = now
+	health.LastActivity = now
+	c.mu.Unlock()
+
+	// Trigger immediate health check to verify connection and update status
+	go c.checkPort(forwardID)
 }

 // RecordActivity records data transfer activity for a forward
@@ -224,35 +276,52 @@ func (c *Checker) Stop() {
 	c.wg.Wait()
 }

-// checkLoop continuously checks a single port's health
-func (c *Checker) checkLoop(forwardID string) {
+// monitorLoop is the single goroutine that checks all registered ports periodically.
+// This is more efficient than one goroutine per port as it reduces:
+// - Goroutine overhead (stack memory, scheduler work)
+// - Timer/ticker allocations
+// - Lock contention (one lock acquisition per interval vs N)
+func (c *Checker) monitorLoop() {
 	defer c.wg.Done()

 	ticker := time.NewTicker(c.interval)
 	defer ticker.Stop()

-	// Do immediate first check - grace period logic will handle early failures
-	c.checkPort(forwardID)
-
 	for {
 		select {
 		case <-c.ctx.Done():
 			return
 		case <-ticker.C:
-			// Check if this forward still exists
-			c.mu.RLock()
-			_, exists := c.ports[forwardID]
-			c.mu.RUnlock()
-
-			if !exists {
-				return
-			}
-
-			c.checkPort(forwardID)
+			c.checkAllPorts()
 		}
 	}
 }

+// checkAllPorts performs health checks on all registered ports
+func (c *Checker) checkAllPorts() {
+	// Get snapshot of ports to check
+	c.mu.RLock()
+	forwardIDs := make([]string, 0, len(c.ports))
+	for id := range c.ports {
+		forwardIDs = append(forwardIDs, id)
+	}
+	c.mu.RUnlock()
+
+	// Check each port
+	for _, forwardID := range forwardIDs {
+		// Check if still registered (may have been unregistered during iteration)
+		c.mu.RLock()
+		_, exists := c.ports[forwardID]
+		c.mu.RUnlock()
+
+		if !exists {
+			continue
+		}
+
+		c.checkPort(forwardID)
+	}
+}
+
 // checkPort performs a single health check on a port
 func (c *Checker) checkPort(forwardID string) {
 	c.mu.RLock()
@@ -284,7 +353,10 @@ func (c *Checker) checkPort(forwardID string) {
 			connectionAge.Round(time.Second), c.maxConnectionAge, idleTime.Round(time.Second))
 	} else if c.maxIdleTime > 0 && idleTime > c.maxIdleTime {
 		newStatus = StatusStale
-		errorMsg = fmt.Sprintf("idle time %v exceeds max %v", idleTime.Round(time.Second), c.maxIdleTime)
+		// Round up to next second to ensure displayed time is always > max
+		// (avoids confusing "10m0s exceeds max 10m0s" when actual is 10m0.1s)
+		displayIdle := idleTime.Truncate(time.Second) + time.Second
+		errorMsg = fmt.Sprintf("idle time %v exceeds max %v", displayIdle, c.maxIdleTime)
 	} else {
 		// Perform connectivity check
 		var checkErr error
@@ -310,7 +382,8 @@ func (c *Checker) checkPort(forwardID string) {
 		}
 	}

-	// Update health status
+	// Update health status and capture eventBus while holding lock
+	var bus *events.Bus
 	c.mu.Lock()
 	if health, exists := c.ports[forwardID]; exists {
 		health.Status = newStatus
@@ -323,11 +396,22 @@ func (c *Checker) checkPort(forwardID string) {
 			health.LastActivity = now
 		}
 	}
+	// Capture eventBus while we have the lock to avoid race condition
+	bus = c.eventBus
 	c.mu.Unlock()

 	// Notify if status changed
 	if oldStatus != newStatus {
 		c.notifyStatusChange(forwardID, newStatus, errorMsg)
+
+		// Publish to event bus if available (captured while holding lock above)
+		if bus != nil {
+			if newStatus == StatusStale {
+				bus.Publish(events.NewStaleEvent(forwardID, errorMsg))
+			} else {
+				bus.Publish(events.NewHealthEvent(forwardID, string(newStatus), errorMsg))
+			}
+		}
 	}
 }

@@ -341,7 +425,7 @@ func (c *Checker) checkTCPDial(port int) error {
 	if err != nil {
 		return err
 	}
-	conn.Close()
+	_ = conn.Close() // Best-effort cleanup; health check succeeded
 	return nil
 }

@@ -359,14 +443,16 @@ func (c *Checker) checkDataTransfer(port int) error {

 	// Set a short read deadline to detect hung connections
 	// We don't expect to receive data, but we want to verify the connection isn't hung
-	conn.SetReadDeadline(time.Now().Add(c.timeout))
+	_ = conn.SetReadDeadline(time.Now().Add(c.timeout))

 	// Try to read a small amount of data
 	// Most servers will either:
 	// 1. Send a banner (SSH, FTP, etc) - we'll read it successfully
 	// 2. Wait for client to send first (HTTP, postgres) - we'll timeout (which is OK)
 	// 3. Hung/stale connection - will timeout with different error
-	buf := make([]byte, dataTransferSize)
+	bufPtr := bufferPool.Get().(*[]byte)
+	buf := *bufPtr
+	defer bufferPool.Put(bufPtr)
 	_, err = conn.Read(buf)

 	// We expect either:
@@ -88,9 +88,9 @@ func (s *HealthCheckTestSuite) TestRegisterAndUnregister() {
 func (s *HealthCheckTestSuite) TestTCPDialMethod() {
 	tests := []struct {
 		name           string
-		setupPort      bool
 		expectedStatus Status
 		description    string
+		setupPort      bool
 	}{
 		{
 			name:           "port available - healthy",
@@ -109,10 +109,9 @@ func (s *HealthCheckTestSuite) TestTCPDialMethod() {
 	for _, tt := range tests {
 		s.Run(tt.name, func() {
 			var testPort int
-			var testListener net.Listener

 			if tt.setupPort {
-				// Use the existing listener
+				// Use the existing listener from suite setup
 				testPort = s.port
 			} else {
 				// Use a port that's not listening
@@ -143,10 +142,6 @@ func (s *HealthCheckTestSuite) TestTCPDialMethod() {
 			status, exists := checker.GetStatus("test-forward")
 			assert.True(s.T(), exists)
 			assert.Equal(s.T(), tt.expectedStatus, status, tt.description)
-
-			if testListener != nil {
-				testListener.Close()
-			}
 		})
 	}
 }
@@ -201,7 +196,7 @@ func (s *HealthCheckTestSuite) TestDataTransferMethod() {
 						}
 						switch tt.serverBehavior {
 						case "banner":
-							conn.Write([]byte("220 Welcome\r\n"))
+							_, _ = conn.Write([]byte("220 Welcome\r\n"))
 							time.Sleep(50 * time.Millisecond)
 							conn.Close()
 						case "close":
@@ -1,3 +1,15 @@
+// Package httplog provides HTTP request/response logging for port forwards.
+// It captures HTTP traffic passing through the forward proxy and stores
+// entries for viewing in the UI.
+//
+// The logger supports:
+//   - Request and response capture with headers and bodies
+//   - Configurable body size limits to prevent memory issues
+//   - Callback-based notifications for real-time log viewing
+//   - Thread-safe operation for concurrent forwards
+//
+// Bodies are truncated if they exceed the configured maximum size
+// (default: 1MB) and marked as truncated in the log entry.
 package httplog

 import (
@@ -11,17 +23,17 @@ import (
 // Entry represents a single HTTP log entry
 type Entry struct {
 	Timestamp  time.Time         `json:"timestamp"`
+	Headers    map[string]string `json:"headers,omitempty"`
 	ForwardID  string            `json:"forward_id"`
 	RequestID  string            `json:"request_id"`
-	Direction  string            `json:"direction"` // "request" or "response"
+	Direction  string            `json:"direction"`
 	Method     string            `json:"method,omitempty"`
 	Path       string            `json:"path,omitempty"`
-	StatusCode int               `json:"status_code,omitempty"`
-	Headers    map[string]string `json:"headers,omitempty"`
-	BodySize   int               `json:"body_size"`
 	Body       string            `json:"body,omitempty"`
-	LatencyMs  int64             `json:"latency_ms,omitempty"`
 	Error      string            `json:"error,omitempty"`
+	StatusCode int               `json:"status_code,omitempty"`
+	BodySize   int               `json:"body_size"`
+	LatencyMs  int64             `json:"latency_ms,omitempty"`
 }

 // LogCallback is a function that receives log entries
@@ -29,12 +41,12 @@ type LogCallback func(entry Entry)

 // Logger writes HTTP log entries to an output stream
 type Logger struct {
-	mu         sync.Mutex
 	output     io.Writer
-	file       *os.File // Only set if we opened the file ourselves
+	file       *os.File
 	forwardID  string
-	maxBodyLen int
 	callbacks  []LogCallback
+	maxBodyLen int
+	mu         sync.Mutex
 }

 // NewLogger creates a new HTTP logger
@@ -51,6 +63,7 @@ func NewLogger(forwardID, logFile string, maxBodyLen int) (*Logger, error) {
 		// Log entries are delivered via callbacks to the UI
 		l.output = io.Discard
 	} else {
+		// #nosec G304 -- logFile is from config validation, not arbitrary user input
 		f, err := os.OpenFile(logFile, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600)
 		if err != nil {
 			return nil, err
@@ -110,3 +123,8 @@ func (l *Logger) Close() error {
 	}
 	return nil
 }
+
+// GetMaxBodyLen returns the maximum body length for logging
+func (l *Logger) GetMaxBodyLen() int {
+	return l.maxBodyLen
+}
@@ -0,0 +1,389 @@
+package httplog
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestNewLogger_OutputModes tests different output configurations
+func TestNewLogger_OutputModes(t *testing.T) {
+	t.Run("empty logFile uses io.Discard", func(t *testing.T) {
+		l, err := NewLogger("test-forward", "", 1024)
+		require.NoError(t, err)
+		defer l.Close()
+
+		assert.Nil(t, l.file)
+		assert.Equal(t, io.Discard, l.output)
+		assert.Equal(t, "test-forward", l.forwardID)
+		assert.Equal(t, 1024, l.maxBodyLen)
+	})
+
+	t.Run("file logger creates file", func(t *testing.T) {
+		tmpDir := t.TempDir()
+		logFile := filepath.Join(tmpDir, "http.log")
+
+		l, err := NewLogger("test-forward", logFile, 2048)
+		require.NoError(t, err)
+		defer l.Close()
+
+		assert.NotNil(t, l.file)
+		assert.NotEqual(t, io.Discard, l.output)
+		assert.Equal(t, 2048, l.maxBodyLen)
+
+		// File should exist
+		_, err = os.Stat(logFile)
+		assert.NoError(t, err)
+	})
+
+	t.Run("file logger appends to existing file", func(t *testing.T) {
+		tmpDir := t.TempDir()
+		logFile := filepath.Join(tmpDir, "http.log")
+
+		// Create file with existing content
+		err := os.WriteFile(logFile, []byte("existing\n"), 0600)
+		require.NoError(t, err)
+
+		l, err := NewLogger("test-forward", logFile, 1024)
+		require.NoError(t, err)
+
+		err = l.Log(Entry{Direction: "request"})
+		require.NoError(t, err)
+		l.Close()
+
+		// File should have both contents
+		data, _ := os.ReadFile(logFile)
+		assert.True(t, strings.HasPrefix(string(data), "existing\n"))
+		assert.Contains(t, string(data), "direction")
+	})
+
+	t.Run("invalid path returns error", func(t *testing.T) {
+		_, err := NewLogger("test", "/nonexistent/path/file.log", 1024)
+		assert.Error(t, err)
+	})
+}
+
+// TestLogger_Log tests basic logging functionality
+func TestLogger_Log(t *testing.T) {
+	var buf bytes.Buffer
+	l := &Logger{
+		forwardID:  "fwd-123",
+		maxBodyLen: 100,
+		output:     &buf,
+	}
+
+	err := l.Log(Entry{
+		Direction: "request",
+		RequestID: "req-1",
+		Method:    "POST",
+		Path:      "/api/users",
+		BodySize:  42,
+		Body:      `{"name":"test"}`,
+	})
+	require.NoError(t, err)
+
+	// Parse output
+	var entry Entry
+	err = json.Unmarshal(buf.Bytes(), &entry)
+	require.NoError(t, err)
+
+	assert.Equal(t, "fwd-123", entry.ForwardID)
+	assert.Equal(t, "request", entry.Direction)
+	assert.Equal(t, "req-1", entry.RequestID)
+	assert.Equal(t, "POST", entry.Method)
+	assert.Equal(t, "/api/users", entry.Path)
+	assert.Equal(t, 42, entry.BodySize)
+	assert.Equal(t, `{"name":"test"}`, entry.Body)
+	assert.False(t, entry.Timestamp.IsZero())
+}
+
+// TestLogger_Log_Response tests response logging
+func TestLogger_Log_Response(t *testing.T) {
+	var buf bytes.Buffer
+	l := &Logger{
+		forwardID:  "fwd-123",
+		maxBodyLen: 1000,
+		output:     &buf,
+	}
+
+	err := l.Log(Entry{
+		Direction:  "response",
+		RequestID:  "req-1",
+		Method:     "GET",
+		Path:       "/api/status",
+		StatusCode: 200,
+		LatencyMs:  125,
+		Headers:    map[string]string{"Content-Type": "application/json"},
+	})
+	require.NoError(t, err)
+
+	var entry Entry
+	err = json.Unmarshal(buf.Bytes(), &entry)
+	require.NoError(t, err)
+
+	assert.Equal(t, "response", entry.Direction)
+	assert.Equal(t, 200, entry.StatusCode)
+	assert.Equal(t, int64(125), entry.LatencyMs)
+	assert.Equal(t, "application/json", entry.Headers["Content-Type"])
+}
+
+// TestLogger_Log_Error tests error logging
+func TestLogger_Log_Error(t *testing.T) {
+	var buf bytes.Buffer
+	l := &Logger{
+		forwardID:  "fwd-123",
+		maxBodyLen: 100,
+		output:     &buf,
+	}
+
+	err := l.Log(Entry{
+		Direction: "error",
+		RequestID: "req-1",
+		Method:    "GET",
+		Path:      "/api/fail",
+		Error:     "connection refused",
+	})
+	require.NoError(t, err)
+
+	var entry Entry
+	err = json.Unmarshal(buf.Bytes(), &entry)
+	require.NoError(t, err)
+
+	assert.Equal(t, "error", entry.Direction)
+	assert.Equal(t, "connection refused", entry.Error)
+}
+
+// TestLogger_BodyTruncation tests body size limiting
+func TestLogger_BodyTruncation(t *testing.T) {
+	tests := []struct {
+		name        string
+		body        string
+		maxBodyLen  int
+		expectTrunc bool
+	}{
+		{name: "body under limit", maxBodyLen: 100, body: "short", expectTrunc: false},
+		{name: "body at limit", maxBodyLen: 5, body: "exact", expectTrunc: false},
+		{name: "body over limit", maxBodyLen: 5, body: "this is too long", expectTrunc: true},
+		{name: "empty body", maxBodyLen: 100, body: "", expectTrunc: false},
+		{name: "zero max", maxBodyLen: 0, body: "any", expectTrunc: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var buf bytes.Buffer
+			l := &Logger{
+				forwardID:  "test",
+				maxBodyLen: tt.maxBodyLen,
+				output:     &buf,
+			}
+
+			_ = l.Log(Entry{Body: tt.body})
+
+			var entry Entry
+			_ = json.Unmarshal(buf.Bytes(), &entry)
+
+			if tt.expectTrunc {
+				assert.Contains(t, entry.Body, "...(truncated)")
+			} else {
+				assert.NotContains(t, entry.Body, "truncated")
+			}
+		})
+	}
+}
+
+// TestLogger_Callbacks tests callback registration and invocation
+func TestLogger_Callbacks(t *testing.T) {
+	l := &Logger{
+		forwardID:  "test",
+		maxBodyLen: 100,
+		output:     io.Discard,
+	}
+
+	var received []Entry
+	var mu sync.Mutex
+
+	// Add callback
+	l.AddCallback(func(entry Entry) {
+		mu.Lock()
+		received = append(received, entry)
+		mu.Unlock()
+	})
+
+	// Log entries
+	_ = l.Log(Entry{Direction: "request", Path: "/api/1"})
+	_ = l.Log(Entry{Direction: "response", Path: "/api/1"})
+	_ = l.Log(Entry{Direction: "request", Path: "/api/2"})
+
+	mu.Lock()
+	assert.Len(t, received, 3)
+	assert.Equal(t, "/api/1", received[0].Path)
+	assert.Equal(t, "response", received[1].Direction)
+	mu.Unlock()
+}
+
+// TestLogger_MultipleCallbacks tests multiple callbacks
+func TestLogger_MultipleCallbacks(t *testing.T) {
+	l := &Logger{
+		forwardID:  "test",
+		maxBodyLen: 100,
+		output:     io.Discard,
+	}
+
+	count1 := 0
+	count2 := 0
+
+	l.AddCallback(func(entry Entry) { count1++ })
+	l.AddCallback(func(entry Entry) { count2++ })
+
+	_ = l.Log(Entry{})
+
+	assert.Equal(t, 1, count1)
+	assert.Equal(t, 1, count2)
+}
+
+// TestLogger_ClearCallbacks tests callback clearing
+func TestLogger_ClearCallbacks(t *testing.T) {
+	l := &Logger{
+		forwardID:  "test",
+		maxBodyLen: 100,
+		output:     io.Discard,
+	}
+
+	count := 0
+	l.AddCallback(func(entry Entry) { count++ })
+
+	_ = l.Log(Entry{})
+	assert.Equal(t, 1, count)
+
+	l.ClearCallbacks()
+
+	_ = l.Log(Entry{})
+	assert.Equal(t, 1, count) // Still 1 - callback was cleared
+}
+
+// TestLogger_GetMaxBodyLen tests the getter
+func TestLogger_GetMaxBodyLen(t *testing.T) {
+	l := &Logger{maxBodyLen: 4096}
+	assert.Equal(t, 4096, l.GetMaxBodyLen())
+}
+
+// TestLogger_Close tests closing
+func TestLogger_Close(t *testing.T) {
+	t.Run("close with no file", func(t *testing.T) {
+		l := &Logger{output: io.Discard}
+		err := l.Close()
+		assert.NoError(t, err)
+	})
+
+	t.Run("close with file", func(t *testing.T) {
+		tmpFile := filepath.Join(t.TempDir(), "test.log")
+		l, err := NewLogger("test", tmpFile, 100)
+		require.NoError(t, err)
+
+		err = l.Close()
+		assert.NoError(t, err)
+
+		// File should be closed (writing should fail or create new handle)
+		assert.NotNil(t, l.file) // reference still exists
+	})
+}
+
+// TestLogger_Concurrent tests thread safety
+func TestLogger_Concurrent(t *testing.T) {
+	var buf bytes.Buffer
+	l := &Logger{
+		forwardID:  "test",
+		maxBodyLen: 100,
+		output:     &buf,
+	}
+
+	// Add callback that accesses shared state
+	var callbackCount int
+	var mu sync.Mutex
+	l.AddCallback(func(entry Entry) {
+		mu.Lock()
+		callbackCount++
+		mu.Unlock()
+	})
+
+	// Concurrent writes
+	var wg sync.WaitGroup
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func(n int) {
+			defer wg.Done()
+			_ = l.Log(Entry{
+				Direction: "request",
+				Path:      "/api/" + string(rune('a'+n%26)),
+			})
+		}(i)
+	}
+	wg.Wait()
+
+	mu.Lock()
+	assert.Equal(t, 100, callbackCount)
+	mu.Unlock()
+}
+
+// TestEntry_Structure tests the Entry struct
+func TestEntry_Structure(t *testing.T) {
+	now := time.Now()
+	entry := Entry{
+		Timestamp:  now,
+		ForwardID:  "fwd-1",
+		RequestID:  "req-1",
+		Direction:  "request",
+		Method:     "DELETE",
+		Path:       "/api/items/123",
+		StatusCode: 204,
+		Headers:    map[string]string{"X-Custom": "value"},
+		BodySize:   0,
+		Body:       "",
+		LatencyMs:  50,
+		Error:      "",
+	}
+
+	// Verify all fields
+	assert.Equal(t, now, entry.Timestamp)
+	assert.Equal(t, "fwd-1", entry.ForwardID)
+	assert.Equal(t, "req-1", entry.RequestID)
+	assert.Equal(t, "request", entry.Direction)
+	assert.Equal(t, "DELETE", entry.Method)
+	assert.Equal(t, "/api/items/123", entry.Path)
+	assert.Equal(t, 204, entry.StatusCode)
+	assert.Equal(t, "value", entry.Headers["X-Custom"])
+	assert.Equal(t, 0, entry.BodySize)
+	assert.Empty(t, entry.Body)
+	assert.Equal(t, int64(50), entry.LatencyMs)
+	assert.Empty(t, entry.Error)
+}
+
+// TestEntry_JSONMarshaling tests JSON serialization
+func TestEntry_JSONMarshaling(t *testing.T) {
+	entry := Entry{
+		Direction:  "response",
+		Method:     "GET",
+		Path:       "/test",
+		StatusCode: 200,
+		LatencyMs:  100,
+	}
+
+	data, err := json.Marshal(entry)
+	require.NoError(t, err)
+
+	var parsed Entry
+	err = json.Unmarshal(data, &parsed)
+	require.NoError(t, err)
+
+	assert.Equal(t, entry.Direction, parsed.Direction)
+	assert.Equal(t, entry.StatusCode, parsed.StatusCode)
+}
@@ -15,20 +15,21 @@ import (
 	"time"

 	"github.com/nvm/kportal/internal/config"
+	"github.com/nvm/kportal/internal/logger"
 )

 // Proxy is an HTTP reverse proxy with logging capabilities
 type Proxy struct {
-	localPort    int // Port to listen on (user-facing)
-	targetPort   int // Port to forward to (k8s tunnel)
+	listener     net.Listener
 	logger       *Logger
 	server       *http.Server
 	forwardID    string
-	filterPath   string // Glob pattern for path filtering
-	includeHdrs  bool
-	listener     net.Listener
+	filterPath   string
+	localPort    int
+	targetPort   int
 	requestCount uint64
 	mu           sync.Mutex
+	includeHdrs  bool
 	running      bool
 }

@@ -85,12 +86,13 @@ func (p *Proxy) Start() error {
 		ErrorHandler: func(w http.ResponseWriter, r *http.Request, err error) {
 			p.logError(r, err)
 			w.WriteHeader(http.StatusBadGateway)
-			w.Write([]byte("Proxy error: " + err.Error()))
+			_, _ = w.Write([]byte("Proxy error: " + err.Error()))
 		},
 	}

 	p.server = &http.Server{
-		Handler: proxy,
+		Handler:           proxy,
+		ReadHeaderTimeout: 10 * time.Second,
 	}

 	p.running = true
@@ -99,7 +101,7 @@ func (p *Proxy) Start() error {
 	// Start serving (blocking)
 	go func() {
 		if err := p.server.Serve(ln); err != nil && err != http.ErrServerClosed {
-			// Log error but don't crash - proxy will be replaced on reconnect
+			logger.Debug("HTTP proxy serve error (will be replaced on reconnect)", map[string]any{"error": err.Error()})
 		}
 	}()

@@ -122,8 +124,8 @@ func (p *Proxy) Stop() error {
 	defer cancel()

 	if err := p.server.Shutdown(ctx); err != nil {
-		// Force close
-		p.server.Close()
+		// Force close - error ignored as we're already shutting down
+		_ = p.server.Close()
 	}

 	if err := p.logger.Close(); err != nil {
@@ -149,11 +151,13 @@ func (t *loggingTransport) RoundTrip(req *http.Request) (*http.Response, error)
 	}

 	startTime := time.Now()
+	maxBodySize := t.proxy.logger.GetMaxBodyLen()

-	// Read request body
+	// Read request body with size limit to prevent memory exhaustion
 	var reqBody []byte
+	var reqBodySize int
 	if req.Body != nil {
-		reqBody, _ = io.ReadAll(req.Body)
+		reqBody, reqBodySize = t.readBodyLimited(req.Body, maxBodySize)
 		req.Body = io.NopCloser(bytes.NewBuffer(reqBody))
 	}

@@ -163,7 +167,7 @@ func (t *loggingTransport) RoundTrip(req *http.Request) (*http.Response, error)
 		Direction: "request",
 		Method:    req.Method,
 		Path:      req.URL.Path,
-		BodySize:  len(reqBody),
+		BodySize:  reqBodySize,
 		Body:      string(reqBody),
 	}

@@ -171,7 +175,7 @@ func (t *loggingTransport) RoundTrip(req *http.Request) (*http.Response, error)
 		reqEntry.Headers = flattenHeaders(req.Header)
 	}

-	t.proxy.logger.Log(reqEntry)
+	_ = t.proxy.logger.Log(reqEntry)

 	// Make the request
 	resp, err := t.transport.RoundTrip(req)
@@ -179,10 +183,11 @@ func (t *loggingTransport) RoundTrip(req *http.Request) (*http.Response, error)
 		return nil, err
 	}

-	// Read response body
+	// Read response body with size limit to prevent memory exhaustion
 	var respBody []byte
+	var respBodySize int
 	if resp.Body != nil {
-		respBody, _ = io.ReadAll(resp.Body)
+		respBody, respBodySize = t.readBodyLimited(resp.Body, maxBodySize)
 		resp.Body = io.NopCloser(bytes.NewBuffer(respBody))
 	}

@@ -195,7 +200,7 @@ func (t *loggingTransport) RoundTrip(req *http.Request) (*http.Response, error)
 		Method:     req.Method,
 		Path:       req.URL.Path,
 		StatusCode: resp.StatusCode,
-		BodySize:   len(respBody),
+		BodySize:   respBodySize,
 		Body:       string(respBody),
 		LatencyMs:  latency.Milliseconds(),
 	}
@@ -204,11 +209,38 @@ func (t *loggingTransport) RoundTrip(req *http.Request) (*http.Response, error)
 		respEntry.Headers = flattenHeaders(resp.Header)
 	}

-	t.proxy.logger.Log(respEntry)
+	_ = t.proxy.logger.Log(respEntry)

 	return resp, nil
 }

+// readBodyLimited reads a body with a size limit to prevent memory exhaustion.
+// Returns the body content (up to maxSize bytes) and the actual content length.
+// If the body exceeds maxSize, it reads only maxSize bytes for logging but
+// consumes the entire body to get the true size for BodySize reporting.
+func (t *loggingTransport) readBodyLimited(body io.ReadCloser, maxSize int) ([]byte, int) {
+	// Read up to maxSize+1 to detect if there's more
+	limitedReader := io.LimitReader(body, int64(maxSize+1))
+	data, err := io.ReadAll(limitedReader)
+	if err != nil {
+		return nil, 0
+	}
+
+	actualSize := len(data)
+	wasTruncated := actualSize > maxSize
+
+	// If we read exactly maxSize+1, there might be more data
+	// Discard the rest but count the bytes for accurate BodySize
+	if wasTruncated {
+		data = data[:maxSize] // Keep only maxSize bytes for logging
+		// Count remaining bytes without storing them
+		remaining, _ := io.Copy(io.Discard, body)
+		actualSize = maxSize + int(remaining)
+	}
+
+	return data, actualSize
+}
+
 // shouldLog checks if the request path matches the filter
 func (p *Proxy) shouldLog(path string) bool {
 	if p.filterPath == "" {
@@ -239,7 +271,7 @@ func (p *Proxy) logError(req *http.Request, err error) {
 		Path:      req.URL.Path,
 		Error:     err.Error(),
 	}
-	p.logger.Log(entry)
+	_ = p.logger.Log(entry)
 }

 // flattenHeaders converts http.Header to map[string]string
@@ -3,6 +3,7 @@ package httplog
 import (
 	"bytes"
 	"encoding/json"
+	"net"
 	"net/http"
 	"os"
 	"testing"
@@ -179,3 +180,244 @@ func TestNewLogger(t *testing.T) {
 	require.NoError(t, err)
 	assert.Contains(t, string(data), `"direction":"request"`)
 }
+
+// TestNewProxy tests proxy creation
+func TestNewProxy(t *testing.T) {
+	t.Run("valid config", func(t *testing.T) {
+		fwd := &config.Forward{
+			LocalPort: 8080,
+			Port:      80,
+			HTTPLog: &config.HTTPLogSpec{
+				Enabled:        true,
+				FilterPath:     "/api/*",
+				IncludeHeaders: true,
+			},
+		}
+
+		proxy, err := NewProxy(fwd, 18080)
+		require.NoError(t, err)
+		require.NotNil(t, proxy)
+
+		assert.Equal(t, 8080, proxy.localPort)
+		assert.Equal(t, 18080, proxy.targetPort)
+		assert.Equal(t, "/api/*", proxy.filterPath)
+		assert.True(t, proxy.includeHdrs)
+		assert.NotNil(t, proxy.logger)
+	})
+
+	t.Run("nil HTTPLog config", func(t *testing.T) {
+		fwd := &config.Forward{
+			LocalPort: 8080,
+			HTTPLog:   nil,
+		}
+
+		proxy, err := NewProxy(fwd, 18080)
+		assert.Error(t, err)
+		assert.Nil(t, proxy)
+		assert.Contains(t, err.Error(), "HTTP log config is nil")
+	})
+}
+
+// TestProxy_GetTargetPort tests target port getter
+func TestProxy_GetTargetPort(t *testing.T) {
+	proxy := &Proxy{targetPort: 19090}
+	assert.Equal(t, 19090, proxy.GetTargetPort())
+}
+
+// TestProxy_GetLogger tests logger getter
+func TestProxy_GetLogger(t *testing.T) {
+	logger := &Logger{forwardID: "test"}
+	proxy := &Proxy{logger: logger}
+
+	result := proxy.GetLogger()
+	assert.Equal(t, logger, result)
+}
+
+// TestProxy_ShouldLog tests path filtering
+func TestProxy_ShouldLog(t *testing.T) {
+	tests := []struct {
+		name       string
+		filterPath string
+		path       string
+		expected   bool
+	}{
+		// No filter - log everything
+		{"empty filter logs all", "", "/any/path", true},
+		{"empty filter logs root", "", "/", true},
+
+		// Exact match
+		{"exact match", "/api", "/api", true},
+		{"exact no match", "/api", "/other", false},
+
+		// Wildcard patterns
+		{"single wildcard match", "/api/*", "/api/users", true},
+		{"single wildcard no match", "/api/*", "/other/users", false},
+		{"middle wildcard", "/api/*/test", "/api/v1/test", true},
+		{"middle wildcard no match", "/api/*/test", "/api/v1/other", false},
+
+		// Prefix patterns (/* suffix special handling)
+		{"prefix match", "/api/*", "/api/users/123", true},
+		{"prefix match nested", "/api/*", "/api/users/123/deep", true},
+
+		// Edge cases
+		{"empty path", "/api/*", "", false},
+		{"trailing slash filter", "/api/", "/api/", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			p := &Proxy{filterPath: tt.filterPath}
+			result := p.shouldLog(tt.path)
+			assert.Equal(t, tt.expected, result, "filterPath=%q, path=%q", tt.filterPath, tt.path)
+		})
+	}
+}
+
+// TestProxy_ShouldLog_InvalidPattern tests behavior with invalid glob patterns
+func TestProxy_ShouldLog_InvalidPattern(t *testing.T) {
+	// Invalid glob pattern (unclosed bracket)
+	p := &Proxy{filterPath: "/api/[invalid"}
+
+	// Should default to logging everything on invalid pattern
+	assert.True(t, p.shouldLog("/any/path"))
+}
+
+// TestProxy_StartStop tests basic start/stop lifecycle
+func TestProxy_StartStop(t *testing.T) {
+	var buf bytes.Buffer
+	logger := &Logger{
+		forwardID:  "test",
+		maxBodyLen: 1024,
+		output:     &buf,
+	}
+
+	proxy := &Proxy{
+		localPort:  0, // Ephemeral port
+		targetPort: 9999,
+		logger:     logger,
+		forwardID:  "test-fwd",
+	}
+
+	// Start
+	err := proxy.Start()
+	require.NoError(t, err)
+	assert.True(t, proxy.running)
+	assert.NotNil(t, proxy.listener)
+	assert.NotNil(t, proxy.server)
+
+	// Double start should fail
+	err = proxy.Start()
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "already running")
+
+	// Stop
+	err = proxy.Stop()
+	assert.NoError(t, err)
+	assert.False(t, proxy.running)
+
+	// Double stop should be OK
+	err = proxy.Stop()
+	assert.NoError(t, err)
+}
+
+// TestProxy_Start_PortInUse tests behavior when port is already in use
+func TestProxy_Start_PortInUse(t *testing.T) {
+	// Start first proxy
+	logger1 := &Logger{output: bytes.NewBuffer(nil), maxBodyLen: 100}
+	proxy1 := &Proxy{
+		localPort:  0, // Ephemeral
+		targetPort: 9999,
+		logger:     logger1,
+	}
+	err := proxy1.Start()
+	require.NoError(t, err)
+	defer func() { _ = proxy1.Stop() }()
+
+	// Get the actual port
+	addr := proxy1.listener.Addr().(*net.TCPAddr)
+	usedPort := addr.Port
+
+	// Try to start second proxy on same port
+	logger2 := &Logger{output: bytes.NewBuffer(nil), maxBodyLen: 100}
+	proxy2 := &Proxy{
+		localPort:  usedPort,
+		targetPort: 9999,
+		logger:     logger2,
+	}
+
+	err = proxy2.Start()
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to listen")
+}
+
+// TestFlattenHeaders_EdgeCases tests header flattening edge cases
+func TestFlattenHeaders_EdgeCases(t *testing.T) {
+	tests := []struct {
+		headers  http.Header
+		expected map[string]string
+		name     string
+	}{
+		{
+			name:     "empty headers",
+			headers:  http.Header{},
+			expected: map[string]string{},
+		},
+		{
+			name:     "single value",
+			headers:  http.Header{"X-Test": {"value"}},
+			expected: map[string]string{"X-Test": "value"},
+		},
+		{
+			name:     "multiple values same key",
+			headers:  http.Header{"Accept": {"text/html", "application/json", "text/plain"}},
+			expected: map[string]string{"Accept": "text/html, application/json, text/plain"},
+		},
+		{
+			name:     "empty value",
+			headers:  http.Header{"X-Empty": {""}},
+			expected: map[string]string{"X-Empty": ""},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := flattenHeaders(tt.headers)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestProxy_RequestCount tests request counting
+func TestProxy_RequestCount(t *testing.T) {
+	proxy := &Proxy{requestCount: 0}
+
+	// Simulate incrementing (normally done by loggingTransport)
+	assert.Equal(t, uint64(0), proxy.requestCount)
+}
+
+// TestProxy_LogError tests error logging
+func TestProxy_LogError(t *testing.T) {
+	var buf bytes.Buffer
+	logger := &Logger{
+		forwardID:  "test",
+		maxBodyLen: 1024,
+		output:     &buf,
+	}
+
+	proxy := &Proxy{
+		logger:    logger,
+		forwardID: "test-fwd",
+	}
+
+	req, _ := http.NewRequest("GET", "/test", nil)
+	proxy.logError(req, assert.AnError)
+
+	var entry Entry
+	err := json.Unmarshal(buf.Bytes(), &entry)
+	require.NoError(t, err)
+
+	assert.Equal(t, "error", entry.Direction)
+	assert.Equal(t, "GET", entry.Method)
+	assert.Equal(t, "/test", entry.Path)
+	assert.Contains(t, entry.Error, "assert.AnError")
+}
@@ -1,3 +1,14 @@
+// Package k8s provides Kubernetes client management, resource resolution,
+// and port-forwarding capabilities for kportal.
+//
+// Key components:
+//   - ClientPool: Thread-safe management of Kubernetes clients per context
+//   - ResourceResolver: Resolves pod/service/selector targets to actual pods
+//   - PortForwarder: Establishes and manages port-forward connections
+//   - Discovery: Provides resource discovery for the UI wizards
+//
+// The package handles automatic pod restart detection through re-resolution,
+// caching with 30-second TTL, and graceful connection management.
 package k8s

 import (
@@ -12,10 +23,10 @@ import (

 // ClientPool manages Kubernetes clients per context with thread-safe access.
 type ClientPool struct {
-	mu      sync.RWMutex
+	loader  clientcmd.ClientConfig
 	clients map[string]*kubernetes.Clientset
 	configs map[string]*rest.Config
-	loader  clientcmd.ClientConfig
+	mu      sync.RWMutex
 }

 // NewClientPool creates a new ClientPool instance.
@@ -51,8 +62,8 @@ func (p *ClientPool) GetClient(contextName string) (*kubernetes.Clientset, error
 	defer p.mu.Unlock()

 	// Double-check in case another goroutine created it while we waited
-	if client, exists := p.clients[contextName]; exists {
-		return client, nil
+	if cachedClient, ok := p.clients[contextName]; ok {
+		return cachedClient, nil
 	}

 	// Create new client
@@ -91,8 +102,8 @@ func (p *ClientPool) GetRestConfig(contextName string) (*rest.Config, error) {
 	defer p.mu.Unlock()

 	// Double-check in case another goroutine created it while we waited
-	if config, exists := p.configs[contextName]; exists {
-		return config, nil
+	if cachedConfig, ok := p.configs[contextName]; ok {
+		return cachedConfig, nil
 	}

 	// Create new config
@@ -146,8 +146,8 @@ func TestClientPool_ThreadSafety(t *testing.T) {
 		go func() {
 			pool.ClearCache()
 			pool.RemoveContext("test-context")
-			pool.GetCurrentContext()
-			pool.ListContexts()
+			_, _ = pool.GetCurrentContext()
+			_, _ = pool.ListContexts()
 			done <- true
 		}()
 	}
@@ -28,11 +28,11 @@ func NewDiscovery(pool *ClientPool) *Discovery {

 // PodInfo contains information about a pod relevant for port forwarding.
 type PodInfo struct {
+	Created    metav1.Time
 	Name       string
 	Namespace  string
-	Containers []ContainerInfo
 	Status     string
-	Created    metav1.Time
+	Containers []ContainerInfo
 }

 // ContainerInfo contains information about a container within a pod.
@@ -44,17 +44,17 @@ type ContainerInfo struct {
 // PortInfo describes a port exposed by a container or service.
 type PortInfo struct {
 	Name       string
-	Port       int32
-	TargetPort int32 // For services: the actual pod port to forward to
 	Protocol   string
+	Port       int32
+	TargetPort int32
 }

 // ServiceInfo contains information about a service.
 type ServiceInfo struct {
 	Name      string
 	Namespace string
-	Ports     []PortInfo
 	Type      string
+	Ports     []PortInfo
 }

 // ListContexts returns all available Kubernetes contexts from kubeconfig.
@@ -356,6 +356,6 @@ func CheckPortAvailability(port int) (bool, string, error) {
 	}

 	// Port is available, close the listener
-	listener.Close()
+	_ = listener.Close()
 	return true, "", nil
 }
@@ -14,12 +14,12 @@ import (

 func TestResolveTargetPort(t *testing.T) {
 	tests := []struct {
-		name         string
-		servicePort  corev1.ServicePort
 		service      *corev1.Service
+		name         string
+		description  string
+		servicePort  corev1.ServicePort
 		pods         []corev1.Pod
 		expectedPort int32
-		description  string
 	}{
 		{
 			name: "numeric targetPort",
@@ -228,7 +228,7 @@ func TestResolveTargetPort(t *testing.T) {
 			for i := range tt.pods {
 				objects = append(objects, &tt.pods[i])
 			}
-			fakeClient := fake.NewSimpleClientset(objects...)
+			fakeClient := fake.NewClientset(objects...)

 			// Create discovery instance (we only need it to call resolveTargetPort)
 			d := &Discovery{}
@@ -49,16 +49,16 @@ func (pf *PortForwarder) SetDialTimeout(timeout time.Duration) {

 // ForwardRequest contains the parameters for a port-forward request.
 type ForwardRequest struct {
-	ContextName string // Kubernetes context name
-	Namespace   string // Namespace
-	Resource    string // Resource (pod/name or service/name)
-	Selector    string // Label selector (for pod resolution)
-	LocalPort   int    // Local port
-	RemotePort  int    // Remote port
+	Out         io.Writer
+	ErrOut      io.Writer
 	StopChan    chan struct{}
 	ReadyChan   chan struct{}
-	Out         io.Writer // Output writer for logs
-	ErrOut      io.Writer // Error output writer
+	ContextName string
+	Namespace   string
+	Resource    string
+	Selector    string
+	LocalPort   int
+	RemotePort  int
 }

 // Forward establishes a port-forward connection to a Kubernetes resource.
@@ -19,15 +19,15 @@ const (

 // ResolvedResource represents a resolved Kubernetes resource.
 type ResolvedResource struct {
-	Name      string    // The resolved pod or service name
-	Namespace string    // The namespace
-	Timestamp time.Time // When this was resolved
+	Timestamp time.Time
+	Name      string
+	Namespace string
 }

 // cacheEntry stores a cached resolution result with expiry.
 type cacheEntry struct {
-	resource  ResolvedResource
 	expiresAt time.Time
+	resource  ResolvedResource
 }

 // ResourceResolver resolves Kubernetes resources with caching.
@@ -173,21 +173,31 @@ func (r *ResourceResolver) resolvePodSelector(ctx context.Context, contextName,
 }

 // getFromCache retrieves a cached resolution result if it exists and hasn't expired.
+// Expired entries are removed to prevent memory growth over time.
 func (r *ResourceResolver) getFromCache(key string) string {
 	r.cacheMu.RLock()
-	defer r.cacheMu.RUnlock()
-
 	entry, exists := r.cache[key]
 	if !exists {
+		r.cacheMu.RUnlock()
 		return ""
 	}

 	// Check if expired
 	if time.Now().After(entry.expiresAt) {
+		r.cacheMu.RUnlock()
+		// Upgrade to write lock and delete expired entry
+		r.cacheMu.Lock()
+		// Double-check entry still exists and is still expired (may have been updated)
+		if expiredEntry, ok := r.cache[key]; ok && time.Now().After(expiredEntry.expiresAt) {
+			delete(r.cache, key)
+		}
+		r.cacheMu.Unlock()
 		return ""
 	}

-	return entry.resource.Name
+	name := entry.resource.Name
+	r.cacheMu.RUnlock()
+	return name
 }

 // putInCache stores a resolution result in the cache with TTL.
@@ -17,10 +17,10 @@ func TestKlogWriter(t *testing.T) {
 		input         string
 		expectedLevel string
 		expectedMsg   string
+		description   string
 		loggerLevel   Level
 		loggerFormat  Format
 		shouldLog     bool
-		description   string
 	}{
 		{
 			name:          "info level log",
@@ -162,9 +162,9 @@ func TestKlogWriter(t *testing.T) {
 func TestKlogWriterBuffering(t *testing.T) {
 	tests := []struct {
 		name        string
+		description string
 		writes      []string
 		expectCount int
-		description string
 	}{
 		{
 			name: "single complete line",
@@ -264,7 +264,7 @@ func TestKlogWriterConcurrency(t *testing.T) {
 		go func(id int) {
 			for j := 0; j < numWrites; j++ {
 				msg := fmt.Sprintf("I1124 12:34:56.789012   12345 test.go:123] Message from goroutine %d iteration %d\n", id, j)
-				klogWriter.Write([]byte(msg))
+				_, _ = klogWriter.Write([]byte(msg))
 			}
 			done <- true
 		}(i)
@@ -14,12 +14,12 @@ import (
 func TestLogrAdapter_Info(t *testing.T) {
 	tests := []struct {
 		name           string
-		loggerLevel    Level
-		logrLevel      int
 		message        string
 		keysAndValues  []interface{}
-		expectOutput   bool
 		expectContains []string
+		loggerLevel    Level
+		logrLevel      int
+		expectOutput   bool
 	}{
 		{
 			name:           "info log v0 with debug logger",
@@ -109,13 +109,13 @@ func TestLogrAdapter_Info(t *testing.T) {

 func TestLogrAdapter_Error(t *testing.T) {
 	tests := []struct {
-		name           string
-		loggerLevel    Level
 		err            error
+		name           string
 		message        string
 		keysAndValues  []interface{}
-		expectOutput   bool
 		expectContains []string
+		loggerLevel    Level
+		expectOutput   bool
 	}{
 		{
 			name:           "error with error object",
@@ -179,9 +179,9 @@ func TestLogrAdapter_Error(t *testing.T) {
 func TestLogrAdapter_WithName(t *testing.T) {
 	tests := []struct {
 		name           string
-		loggerNames    []string
 		message        string
 		expectContains string
+		loggerNames    []string
 	}{
 		{
 			name:           "single logger name",
@@ -1,3 +1,19 @@
+// Package logger provides structured logging with support for text and JSON
+// output formats. It intercepts Kubernetes client-go logs and routes them
+// through the structured logger.
+//
+// The package provides both instance-based and global logging:
+//
+//	// Instance-based logging
+//	log := logger.New(logger.LevelInfo, logger.FormatJSON, os.Stderr)
+//	log.Info("message", "key", "value")
+//
+//	// Global logging (after Init)
+//	logger.Init(logger.LevelInfo, logger.FormatText, os.Stderr)
+//	logger.Info("message", "key", "value")
+//
+// Log levels: DEBUG < INFO < WARN < ERROR
+// Output formats: FormatText (human-readable), FormatJSON (structured)
 package logger

 import (
@@ -9,36 +25,50 @@ import (
 	"time"
 )

+// Level represents the logging level.
+// Higher levels include all lower levels (e.g., LevelInfo includes WARN and ERROR).
 type Level int

 const (
+	// LevelDebug is for detailed troubleshooting information.
 	LevelDebug Level = iota
+	// LevelInfo is for general operational information.
 	LevelInfo
+	// LevelWarn is for unexpected but handled situations.
 	LevelWarn
+	// LevelError is for failures that require attention.
 	LevelError
 )

+// Format represents the output format for log entries.
 type Format int

 const (
+	// FormatText outputs human-readable log lines.
 	FormatText Format = iota
+	// FormatJSON outputs structured JSON log entries.
 	FormatJSON
 )

+// Logger is a structured logger with configurable level and format.
+// It is safe for concurrent use.
 type Logger struct {
+	output io.Writer
 	level  Level
 	format Format
-	output io.Writer
-	mu     sync.Mutex // Protects concurrent writes to output
+	mu     sync.Mutex
 }

+// logEntry represents a single log entry for JSON output.
 type logEntry struct {
-	Time    string                 `json:"time"`
-	Level   string                 `json:"level"`
-	Message string                 `json:"message"`
-	Fields  map[string]interface{} `json:"fields,omitempty"`
+	Fields  map[string]any `json:"fields,omitempty"`
+	Time    string         `json:"time"`
+	Level   string         `json:"level"`
+	Message string         `json:"message"`
 }

+// New creates a new Logger with the specified level, format, and output writer.
+// If output is nil, os.Stderr is used.
 func New(level Level, format Format, output io.Writer) *Logger {
 	if output == nil {
 		output = os.Stderr
@@ -13,13 +13,13 @@ import (

 func TestLoggerTextFormat(t *testing.T) {
 	tests := []struct {
+		fields         map[string]interface{}
 		name           string
+		message        string
+		expectContains []string
 		level          Level
 		logLevel       Level
-		message        string
-		fields         map[string]interface{}
 		expectOutput   bool
-		expectContains []string
 	}{
 		{
 			name:           "info logged at info level",
@@ -138,13 +138,13 @@ func TestLoggerTextFormat(t *testing.T) {

 func TestLoggerJSONFormat(t *testing.T) {
 	tests := []struct {
+		fields       map[string]interface{}
 		name         string
+		message      string
+		expectLevel  string
 		level        Level
 		logLevel     Level
-		message      string
-		fields       map[string]interface{}
 		expectOutput bool
-		expectLevel  string
 	}{
 		{
 			name:         "info logged at info level",
@@ -268,12 +268,12 @@ func TestLoggerJSONFormat(t *testing.T) {

 func TestGlobalLogger(t *testing.T) {
 	tests := []struct {
-		name           string
-		initLevel      Level
-		initFormat     Format
 		logFunc        func(string, ...map[string]interface{})
+		name           string
 		message        string
 		expectContains string
+		initLevel      Level
+		initFormat     Format
 	}{
 		{
 			name:           "global info logger text",
@@ -321,9 +321,9 @@ func TestGlobalLogger(t *testing.T) {
 func TestLogLevelsFiltering(t *testing.T) {
 	tests := []struct {
 		name          string
-		loggerLevel   Level
 		logAtLevels   []Level
 		expectOutputs []bool
+		loggerLevel   Level
 	}{
 		{
 			name:          "debug level logs everything",
@@ -387,14 +387,14 @@ func TestLoggerNilOutput(t *testing.T) {

 func TestLevelToString(t *testing.T) {
 	tests := []struct {
-		level    Level
 		expected string
+		level    Level
 	}{
-		{LevelDebug, "DEBUG"},
-		{LevelInfo, "INFO"},
-		{LevelWarn, "WARN"},
-		{LevelError, "ERROR"},
-		{Level(999), "UNKNOWN"},
+		{level: LevelDebug, expected: "DEBUG"},
+		{level: LevelInfo, expected: "INFO"},
+		{level: LevelWarn, expected: "WARN"},
+		{level: LevelError, expected: "ERROR"},
+		{level: Level(999), expected: "UNKNOWN"},
 	}

 	for _, tt := range tests {
@@ -407,8 +407,8 @@ func TestLevelToString(t *testing.T) {

 func TestJSONFieldTypes(t *testing.T) {
 	tests := []struct {
-		name   string
 		fields map[string]interface{}
+		name   string
 	}{
 		{
 			name: "string fields",
@@ -467,10 +467,10 @@ func TestJSONFieldTypes(t *testing.T) {

 func TestInitWithCustomOutput(t *testing.T) {
 	tests := []struct {
-		name          string
 		output        io.Writer
-		expectDiscard bool
+		name          string
 		description   string
+		expectDiscard bool
 	}{
 		{
 			name:          "init with custom buffer",
@@ -1,3 +1,16 @@
+// Package mdns provides multicast DNS (mDNS/Bonjour) hostname publishing
+// for port forwards. When enabled, forwards with aliases can be accessed
+// via <alias>.local hostnames on the local network.
+//
+// The Publisher manages mDNS service registrations using zeroconf:
+//   - Registers hostnames when forwards become active
+//   - Unregisters hostnames when forwards are stopped
+//   - Provides service discovery via the _kportal._tcp service type
+//
+// mDNS discovery commands:
+//
+//	dns-sd -B _kportal._tcp local    # macOS
+//	avahi-browse -t _kportal._tcp    # Linux
 package mdns

 import (
@@ -23,11 +36,11 @@ const (
 // Publisher manages mDNS hostname registrations for port forwards.
 // It allows forwards with aliases to be accessible via <alias>.local hostnames.
 type Publisher struct {
-	mu       sync.RWMutex
-	servers  map[string]*zeroconf.Server // forwardID -> server
-	aliases  map[string]string           // forwardID -> alias (for logging)
-	enabled  bool
+	servers  map[string]*zeroconf.Server
+	aliases  map[string]string
 	localIPs []string
+	mu       sync.RWMutex
+	enabled  bool
 }

 // NewPublisher creates a new mDNS Publisher.
@@ -89,6 +102,11 @@ func (p *Publisher) Register(forwardID, alias string, localPort int) error {
 	p.servers[forwardID] = server
 	p.aliases[forwardID] = alias

+	// Allow zeroconf's internal goroutines (recv4, recv6) to fully initialize.
+	// This prevents a race condition where shutdown() could set connections to nil
+	// while recv goroutines are still starting up.
+	time.Sleep(startupSettleTime)
+
 	logger.Info("mDNS hostname registered", map[string]interface{}{
 		"forward_id": forwardID,
 		"hostname":   GetHostname(alias),
@@ -151,6 +169,13 @@ func (p *Publisher) Stop() {
 	logger.Info("mDNS publisher stopped", nil)
 }

+// startupSettleTime is a small delay after zeroconf registration to allow internal
+// goroutines (recv4, recv6) to fully initialize before any shutdown can occur.
+// This works around a race condition in grandcat/zeroconf where shutdown() sets
+// connections to nil while recv goroutines may still be initializing.
+// See: https://github.com/grandcat/zeroconf/issues/95
+const startupSettleTime = 50 * time.Millisecond
+
 // shutdownSettleTime is a small delay after zeroconf shutdown to allow internal
 // goroutines to exit cleanly. This works around a race condition in the
 // grandcat/zeroconf library where recv4() can access ipv4conn after shutdown()
@@ -183,29 +208,12 @@ func shutdownWithTimeout(server *zeroconf.Server, forwardID string) {
 	}
 }

-// IsEnabled returns whether mDNS publishing is enabled.
-func (p *Publisher) IsEnabled() bool {
-	return p.enabled
-}
-
-// GetDomain returns the mDNS domain being used (always "local" per RFC 6762).
-func (p *Publisher) GetDomain() string {
-	return mdnsDomain
-}
-
 // GetHostname returns the full mDNS hostname for an alias.
 // Example: GetHostname("myapp") returns "myapp.local"
 func GetHostname(alias string) string {
 	return alias + "." + mdnsDomain
 }

-// GetRegisteredCount returns the number of currently registered hostnames.
-func (p *Publisher) GetRegisteredCount() int {
-	p.mu.RLock()
-	defer p.mu.RUnlock()
-	return len(p.servers)
-}
-
 // getLocalIPs returns the local IP addresses for logging purposes.
 func getLocalIPs() []string {
 	var ips []string
@@ -13,15 +13,17 @@ import (
 func TestNewPublisher_Disabled(t *testing.T) {
 	p := NewPublisher(false)

-	assert.False(t, p.IsEnabled())
-	assert.Equal(t, 0, p.GetRegisteredCount())
+	// When disabled, Register should succeed but be a no-op
+	err := p.Register("forward-1", "test-alias", 8080)
+	assert.NoError(t, err)
 }

 func TestNewPublisher_Enabled(t *testing.T) {
 	p := NewPublisher(true)
+	defer p.Stop()

-	assert.True(t, p.IsEnabled())
-	assert.Equal(t, 0, p.GetRegisteredCount())
+	// Enabled publisher should be created successfully
+	assert.NotNil(t, p)
 }

 func TestRegister_WhenDisabled_NoOp(t *testing.T) {
@@ -30,16 +32,17 @@ func TestRegister_WhenDisabled_NoOp(t *testing.T) {
 	err := p.Register("forward-1", "test-alias", 8080)

 	assert.NoError(t, err)
-	assert.Equal(t, 0, p.GetRegisteredCount())
+	// Unregister should also be safe when disabled
+	p.Unregister("forward-1")
 }

 func TestRegister_EmptyAlias_NoOp(t *testing.T) {
 	p := NewPublisher(true)
+	defer p.Stop()

 	err := p.Register("forward-1", "", 8080)

 	assert.NoError(t, err)
-	assert.Equal(t, 0, p.GetRegisteredCount())
 }

 func TestUnregister_WhenDisabled_NoOp(t *testing.T) {
@@ -51,10 +54,10 @@ func TestUnregister_WhenDisabled_NoOp(t *testing.T) {

 func TestUnregister_NotRegistered_NoOp(t *testing.T) {
 	p := NewPublisher(true)
+	defer p.Stop()

 	// Should not panic
 	p.Unregister("non-existent")
-	assert.Equal(t, 0, p.GetRegisteredCount())
 }

 func TestStop_WhenDisabled_NoOp(t *testing.T) {
@@ -69,7 +72,6 @@ func TestStop_WhenNoRegistrations(t *testing.T) {

 	// Should not panic
 	p.Stop()
-	assert.Equal(t, 0, p.GetRegisteredCount())
 }

 func TestGetLocalIPs(t *testing.T) {
@@ -84,6 +86,11 @@ func TestGetLocalIPs(t *testing.T) {
 	}
 }

+func TestGetHostname(t *testing.T) {
+	hostname := GetHostname("myapp")
+	assert.Equal(t, "myapp.local", hostname)
+}
+
 // Integration tests - only run when explicitly requested
 // These tests actually register mDNS services and require network access

@@ -96,9 +103,10 @@ func TestRegister_Integration(t *testing.T) {
 	defer p.Stop()

 	err := p.Register("forward-1", "test-service", 8080)
-
 	assert.NoError(t, err)
-	assert.Equal(t, 1, p.GetRegisteredCount())
+
+	// Verify by checking that unregister doesn't panic
+	p.Unregister("forward-1")
 }

 func TestRegister_Duplicate_Idempotent_Integration(t *testing.T) {
@@ -112,12 +120,10 @@ func TestRegister_Duplicate_Idempotent_Integration(t *testing.T) {
 	// First registration
 	err := p.Register("forward-1", "test-service", 8080)
 	assert.NoError(t, err)
-	assert.Equal(t, 1, p.GetRegisteredCount())

 	// Second registration with same ID should be idempotent
 	err = p.Register("forward-1", "test-service", 8080)
 	assert.NoError(t, err)
-	assert.Equal(t, 1, p.GetRegisteredCount())
 }

 func TestRegister_MultipleForwards_Integration(t *testing.T) {
@@ -135,7 +141,6 @@ func TestRegister_MultipleForwards_Integration(t *testing.T) {
 	assert.NoError(t, err1)
 	assert.NoError(t, err2)
 	assert.NoError(t, err3)
-	assert.Equal(t, 3, p.GetRegisteredCount())
 }

 func TestUnregister_Success_Integration(t *testing.T) {
@@ -146,9 +151,13 @@ func TestUnregister_Success_Integration(t *testing.T) {
 	p := NewPublisher(true)
 	defer p.Stop()

-	p.Register("forward-1", "test-service", 8080)
-	assert.Equal(t, 1, p.GetRegisteredCount())
+	err := p.Register("forward-1", "test-service", 8080)
+	assert.NoError(t, err)

+	// Unregister should not panic and should handle it gracefully
 	p.Unregister("forward-1")
-	assert.Equal(t, 0, p.GetRegisteredCount())
+
+	// Re-registering should work after unregister
+	err = p.Register("forward-1", "test-service-2", 8080)
+	assert.NoError(t, err)
 }
@@ -1,3 +1,19 @@
+// Package retry provides exponential backoff with jitter for retry logic.
+// It implements a backoff sequence of 1s → 2s → 4s → 8s → 10s (max),
+// with 10% random jitter to prevent thundering herd problems.
+//
+// Basic usage:
+//
+//	backoff := retry.NewBackoff()
+//	for {
+//	    err := doSomething()
+//	    if err == nil {
+//	        backoff.Reset()
+//	        break
+//	    }
+//	    delay := backoff.Next()
+//	    time.Sleep(delay)
+//	}
 package retry

 import (
@@ -11,20 +27,24 @@ const (
 	initialDelay = 1 * time.Second
 	maxDelay     = 10 * time.Second
 	jitterPct    = 0.1 // 10% jitter
+	// maxAttempt caps the exponent to prevent math.Pow overflow
+	// 2^30 seconds is ~34 years, well above maxDelay, so this is safe
+	maxAttempt = 30
 )

 // Backoff implements exponential backoff with jitter for retry logic.
 // The backoff sequence is: 1s → 2s → 4s → 8s → 10s (max, then stays at 10s).
 type Backoff struct {
-	attempt int
 	rng     *rand.Rand
+	attempt int
 }

 // NewBackoff creates a new Backoff instance with a seeded random number generator.
 func NewBackoff() *Backoff {
 	return &Backoff{
 		attempt: 0,
-		rng:     rand.New(rand.NewSource(time.Now().UnixNano())),
+		// #nosec G404 -- math/rand is appropriate for backoff jitter; cryptographic randomness not needed
+		rng: rand.New(rand.NewSource(time.Now().UnixNano())),
 	}
 }

@@ -32,8 +52,14 @@ func NewBackoff() *Backoff {
 // The duration follows exponential backoff: 1s → 2s → 4s → 8s → 10s (max).
 // A 10% jitter is added to prevent thundering herd effects.
 func (b *Backoff) Next() time.Duration {
+	// Cap attempt to prevent overflow in math.Pow
+	attempt := b.attempt
+	if attempt > maxAttempt {
+		attempt = maxAttempt
+	}
+
 	// Calculate base delay: 2^attempt seconds
-	exp := math.Pow(2, float64(b.attempt))
+	exp := math.Pow(2, float64(attempt))
 	delay := time.Duration(exp) * time.Second

 	// Cap at max delay
@@ -43,7 +69,7 @@ func (b *Backoff) Next() time.Duration {

 	// Add jitter (±10%)
 	jitter := b.calculateJitter(delay)
-	delay = delay + jitter
+	delay += jitter

 	b.attempt++
 	return delay
@@ -0,0 +1,230 @@
+package ui
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestNewBenchmarkState tests the constructor
+func TestNewBenchmarkState(t *testing.T) {
+	state := newBenchmarkState("forward-123", "my-service", 8080)
+
+	assert.Equal(t, "forward-123", state.forwardID)
+	assert.Equal(t, "my-service", state.forwardAlias)
+	assert.Equal(t, 8080, state.localPort)
+	assert.Equal(t, BenchmarkStepConfig, state.step)
+	assert.Equal(t, "/", state.urlPath)
+	assert.Equal(t, "GET", state.method)
+	assert.Equal(t, 10, state.concurrency)
+	assert.Equal(t, 100, state.requests)
+	assert.Equal(t, 0, state.cursor)
+	assert.False(t, state.running)
+	assert.Nil(t, state.results)
+	assert.Nil(t, state.error)
+	assert.Nil(t, state.cancelFunc)
+}
+
+// TestBenchmarkState_StepTransitions tests step progression
+func TestBenchmarkState_StepTransitions(t *testing.T) {
+	state := newBenchmarkState("fwd", "alias", 8080)
+
+	// Initial state
+	assert.Equal(t, BenchmarkStepConfig, state.step)
+
+	// Move to running
+	state.step = BenchmarkStepRunning
+	state.running = true
+	assert.Equal(t, BenchmarkStepRunning, state.step)
+	assert.True(t, state.running)
+
+	// Move to results
+	state.step = BenchmarkStepResults
+	state.running = false
+	assert.Equal(t, BenchmarkStepResults, state.step)
+	assert.False(t, state.running)
+}
+
+// TestBenchmarkState_ProgressTracking tests progress updates
+func TestBenchmarkState_ProgressTracking(t *testing.T) {
+	state := newBenchmarkState("fwd", "alias", 8080)
+	state.step = BenchmarkStepRunning
+	state.running = true
+	state.total = 100
+
+	// Simulate progress updates
+	updates := []struct {
+		progress int
+		total    int
+	}{
+		{10, 100},
+		{50, 100},
+		{75, 100},
+		{100, 100},
+	}
+
+	for _, u := range updates {
+		state.progress = u.progress
+		state.total = u.total
+		assert.Equal(t, u.progress, state.progress)
+		assert.Equal(t, u.total, state.total)
+	}
+}
+
+// TestBenchmarkState_CancelFunc tests cancel function handling
+func TestBenchmarkState_CancelFunc(t *testing.T) {
+	state := newBenchmarkState("fwd", "alias", 8080)
+
+	cancelled := false
+	state.cancelFunc = func() {
+		cancelled = true
+	}
+
+	assert.NotNil(t, state.cancelFunc)
+
+	// Call cancel
+	state.cancelFunc()
+	assert.True(t, cancelled)
+}
+
+// TestBenchmarkState_Results tests result storage
+func TestBenchmarkState_Results(t *testing.T) {
+	state := newBenchmarkState("fwd", "alias", 8080)
+
+	results := &BenchmarkResults{
+		TotalRequests: 100,
+		Successful:    95,
+		Failed:        5,
+		MinLatency:    10.5,
+		MaxLatency:    250.0,
+		AvgLatency:    45.2,
+		P50Latency:    40.0,
+		P95Latency:    120.0,
+		P99Latency:    200.0,
+		Throughput:    150.5,
+		BytesRead:     1024000,
+		StatusCodes: map[int]int{
+			200: 90,
+			201: 5,
+			500: 5,
+		},
+	}
+
+	state.results = results
+	state.step = BenchmarkStepResults
+
+	assert.Equal(t, 100, state.results.TotalRequests)
+	assert.Equal(t, 95, state.results.Successful)
+	assert.Equal(t, 5, state.results.Failed)
+	assert.Equal(t, 45.2, state.results.AvgLatency)
+	assert.Equal(t, 150.5, state.results.Throughput)
+}
+
+// TestBenchmarkState_Error tests error handling
+func TestBenchmarkState_Error(t *testing.T) {
+	state := newBenchmarkState("fwd", "alias", 8080)
+
+	assert.Nil(t, state.error)
+
+	// Simulate error
+	state.error = assert.AnError
+	state.step = BenchmarkStepResults
+	state.running = false
+
+	assert.NotNil(t, state.error)
+	assert.Nil(t, state.results)
+}
+
+// TestBenchmarkState_ConfigFields tests configuration field updates
+func TestBenchmarkState_ConfigFields(t *testing.T) {
+	state := newBenchmarkState("fwd", "alias", 8080)
+
+	// Update URL path
+	state.urlPath = "/api/v1/health"
+	assert.Equal(t, "/api/v1/health", state.urlPath)
+
+	// Update method
+	state.method = "POST"
+	assert.Equal(t, "POST", state.method)
+
+	// Update concurrency
+	state.concurrency = 50
+	assert.Equal(t, 50, state.concurrency)
+
+	// Update requests
+	state.requests = 1000
+	assert.Equal(t, 1000, state.requests)
+}
+
+// TestBenchmarkState_CursorBounds tests cursor navigation bounds
+func TestBenchmarkState_CursorBounds(t *testing.T) {
+	state := newBenchmarkState("fwd", "alias", 8080)
+
+	// There are 4 config fields (0-3)
+	tests := []struct {
+		name     string
+		cursor   int
+		expected int
+	}{
+		{"first field", 0, 0},
+		{"second field", 1, 1},
+		{"third field", 2, 2},
+		{"fourth field", 3, 3},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			state.cursor = tt.cursor
+			assert.Equal(t, tt.expected, state.cursor)
+		})
+	}
+}
+
+// TestBenchmarkState_ProgressChannel tests progress channel handling
+func TestBenchmarkState_ProgressChannel(t *testing.T) {
+	state := newBenchmarkState("fwd", "alias", 8080)
+
+	// Create a progress channel
+	state.progressCh = make(chan BenchmarkProgressMsg, 10)
+
+	// Send some progress
+	state.progressCh <- BenchmarkProgressMsg{
+		ForwardID: "fwd",
+		Completed: 50,
+		Total:     100,
+	}
+
+	// Receive and verify
+	msg := <-state.progressCh
+	assert.Equal(t, "fwd", msg.ForwardID)
+	assert.Equal(t, 50, msg.Completed)
+	assert.Equal(t, 100, msg.Total)
+
+	// Close channel
+	close(state.progressCh)
+}
+
+// TestBenchmarkStepValues tests step constants
+func TestBenchmarkStepValues(t *testing.T) {
+	assert.Equal(t, BenchmarkStep(0), BenchmarkStepConfig)
+	assert.Equal(t, BenchmarkStep(1), BenchmarkStepRunning)
+	assert.Equal(t, BenchmarkStep(2), BenchmarkStepResults)
+}
+
+// TestBenchmarkResults_StatusCodeMap tests status code tracking
+func TestBenchmarkResults_StatusCodeMap(t *testing.T) {
+	results := &BenchmarkResults{
+		StatusCodes: make(map[int]int),
+	}
+
+	// Simulate collecting status codes
+	codes := []int{200, 200, 200, 201, 404, 500, 200}
+	for _, code := range codes {
+		results.StatusCodes[code]++
+	}
+
+	assert.Equal(t, 4, results.StatusCodes[200])
+	assert.Equal(t, 1, results.StatusCodes[201])
+	assert.Equal(t, 1, results.StatusCodes[404])
+	assert.Equal(t, 1, results.StatusCodes[500])
+}
@@ -1,7 +1,27 @@
+// Package ui provides the terminal user interface for kportal using bubbletea.
+// It displays port-forward status in an interactive table and provides wizards
+// for adding, editing, and removing forwards.
+//
+// The main components are:
+//   - BubbleTeaUI: The interactive TUI with table display and modal dialogs
+//   - TableUI: A simpler non-interactive status display for verbose mode
+//   - Wizards: Step-by-step interfaces for configuration changes
+//   - Controller: Coordinates UI with the forward manager
+//
+// Key bindings in the main view:
+//   - ↑↓/jk: Navigate forwards
+//   - Space: Toggle forward enabled/disabled
+//   - n: New forward wizard
+//   - e: Edit forward wizard
+//   - d: Delete forward
+//   - b: Benchmark forward
+//   - l: View HTTP logs
+//   - q: Quit
 package ui

 import (
 	"fmt"
+	"log"
 	"strings"
 	"sync"

@@ -12,6 +32,14 @@ import (
 	"github.com/nvm/kportal/internal/k8s"
 )

+// safeRecover recovers from panics and logs them
+// Use with defer at the start of goroutines and callbacks that could panic
+func safeRecover(context string) {
+	if r := recover(); r != nil {
+		log.Printf("[UI] Panic recovered in %s: %v", context, r)
+	}
+}
+
 // ForwardUpdateMsg is sent when a forward status changes
 type ForwardUpdateMsg struct {
 	ID     string
@@ -26,8 +54,8 @@ type ForwardErrorMsg struct {

 // ForwardAddMsg is sent when a new forward is added
 type ForwardAddMsg struct {
-	ID      string
 	Forward *ForwardStatus
+	ID      string
 }

 // ForwardRemoveMsg is sent when a forward is removed
@@ -41,48 +69,32 @@ type HTTPLogSubscriber func(forwardID string, callback func(entry HTTPLogEntry))

 // BubbleTeaUI is a bubbletea-based terminal UI
 type BubbleTeaUI struct {
-	mu             sync.RWMutex
-	program        *tea.Program
-	forwards       map[string]*ForwardStatus
-	forwardOrder   []string
-	selectedIndex  int
-	disabledMap    map[string]bool
-	toggleCallback func(id string, enable bool)
-	version        string
-	errors         map[string]string // Track error messages by forward ID
-
-	// Update notification
-	updateAvailable bool
-	updateVersion   string
-	updateURL       string
-
-	// Modal wizard state
-	viewMode     ViewMode
-	addWizard    *AddWizardState
-	removeWizard *RemoveWizardState
-
-	// Delete confirmation state
-	deleteConfirming    bool
+	discovery           *k8s.Discovery
+	program             *tea.Program
+	forwards            map[string]*ForwardStatus
+	benchmarkState      *BenchmarkState
+	httpLogSubscriber   HTTPLogSubscriber
+	disabledMap         map[string]bool
+	toggleCallback      func(id string, enable bool)
+	httpLogCleanup      func()
+	httpLogState        *HTTPLogState
+	errors              map[string]string
+	mutator             *config.Mutator
+	removeWizard        *RemoveWizardState
+	addWizard           *AddWizardState
+	updateVersion       string
+	updateURL           string
+	configPath          string
 	deleteConfirmID     string
 	deleteConfirmAlias  string
-	deleteConfirmCursor int // 0 = Yes, 1 = No
-
-	// Benchmark state
-	benchmarkState *BenchmarkState
-
-	// HTTP log viewing state
-	httpLogState *HTTPLogState
-
-	// Log callback cleanup function
-	httpLogCleanup func()
-
-	// Dependencies for wizards
-	discovery  *k8s.Discovery
-	mutator    *config.Mutator
-	configPath string
-
-	// Manager for accessing workers
-	httpLogSubscriber HTTPLogSubscriber
+	version             string
+	forwardOrder        []string
+	viewMode            ViewMode
+	deleteConfirmCursor int
+	selectedIndex       int
+	mu                  sync.RWMutex
+	deleteConfirming    bool
+	updateAvailable     bool
 }

 // bubbletea model
@@ -159,6 +171,8 @@ func (ui *BubbleTeaUI) AddForward(id string, fwd *config.Forward) {
 	if existing, ok := ui.forwards[id]; ok {
 		existing.Status = "Starting"
 		ui.disabledMap[id] = false
+		// Clear any previous error when re-enabling
+		delete(ui.errors, id)
 		ui.mu.Unlock()

 		if ui.program != nil {
@@ -167,15 +181,12 @@ func (ui *BubbleTeaUI) AddForward(id string, fwd *config.Forward) {
 		return
 	}

-	// Parse resource
+	// Parse resource (e.g., "pod/my-app" -> type="pod", name="my-app")
 	resourceType := "pod"
 	resourceName := fwd.Resource
-	for idx := 0; idx < len(fwd.Resource); idx++ {
-		if fwd.Resource[idx] == '/' {
-			resourceType = fwd.Resource[:idx]
-			resourceName = fwd.Resource[idx+1:]
-			break
-		}
+	if parts := strings.SplitN(fwd.Resource, "/", 2); len(parts) == 2 {
+		resourceType = parts[0]
+		resourceName = parts[1]
 	}

 	alias := fwd.Alias
@@ -237,13 +248,35 @@ func (ui *BubbleTeaUI) Remove(id string) {
 	ui.mu.Lock()
 	delete(ui.forwards, id)

+	// Clear any error associated with this forward
+	delete(ui.errors, id)
+
 	// Remove from order
+	removedIndex := -1
 	for i, fid := range ui.forwardOrder {
 		if fid == id {
+			removedIndex = i
 			ui.forwardOrder = append(ui.forwardOrder[:i], ui.forwardOrder[i+1:]...)
 			break
 		}
 	}
+
+	// Adjust selectedIndex if necessary
+	if removedIndex >= 0 {
+		// If we removed the selected item or an item before it, adjust
+		if ui.selectedIndex >= len(ui.forwardOrder) {
+			ui.selectedIndex = len(ui.forwardOrder) - 1
+		}
+		// Ensure selectedIndex is never negative
+		if ui.selectedIndex < 0 {
+			ui.selectedIndex = 0
+		}
+	}
+
+	// Clear delete confirmation if we're deleting the same forward
+	if ui.deleteConfirming && ui.deleteConfirmID == id {
+		ui.resetDeleteConfirmation()
+	}
 	ui.mu.Unlock()

 	if ui.program != nil {
@@ -321,6 +354,14 @@ func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {

 	case HTTPLogEntryMsg:
 		return m.handleHTTPLogEntry(msg)
+
+	case clearCopyMessageMsg:
+		m.ui.mu.Lock()
+		if m.ui.httpLogState != nil {
+			m.ui.httpLogState.copyMessage = ""
+		}
+		m.ui.mu.Unlock()
+		return m, nil
 	}

 	return m, nil
@@ -341,10 +382,10 @@ func (m model) View() string {

 	// Fallback to reasonable defaults if dimensions not yet received
 	if termWidth == 0 {
-		termWidth = 120
+		termWidth = DefaultTermWidth
 	}
 	if termHeight == 0 {
-		termHeight = 40
+		termHeight = DefaultTermHeight
 	}

 	// Overlay delete confirmation if active
@@ -372,28 +413,98 @@ func (m model) View() string {
 	}
 }

+// mainViewColors holds the color palette for the main view
+type mainViewColors struct {
+	header     lipgloss.Color
+	active     lipgloss.Color
+	warning    lipgloss.Color
+	errorColor lipgloss.Color
+	muted      lipgloss.Color
+	selectedBg lipgloss.Color
+	selectedFg lipgloss.Color
+}
+
+// defaultMainViewColors returns the default color palette
+func defaultMainViewColors() mainViewColors {
+	return mainViewColors{
+		header:     lipgloss.Color("220"), // Yellow
+		active:     lipgloss.Color("46"),  // Green
+		warning:    lipgloss.Color("220"), // Yellow
+		errorColor: lipgloss.Color("196"), // Red
+		muted:      lipgloss.Color("240"), // Gray
+		selectedBg: lipgloss.Color("240"), // Gray background
+		selectedFg: lipgloss.Color("230"), // Light foreground
+	}
+}
+
+// keyBinding represents a keyboard shortcut and its description
+type keyBinding struct {
+	key  string
+	desc string
+}
+
+// mainViewKeyBindings returns the key bindings for the main view
+func mainViewKeyBindings() []keyBinding {
+	return []keyBinding{
+		{"↑↓/jk", "Navigate"},
+		{"Space", "Toggle"},
+		{"n", "New"},
+		{"e", "Edit"},
+		{"d", "Delete"},
+		{"b", "Bench"},
+		{"l", "Logs"},
+		{"q", "Quit"},
+	}
+}
+
 func (m model) renderMainView() string {
 	m.ui.mu.RLock()
 	defer m.ui.mu.RUnlock()

 	var b strings.Builder
+	colors := defaultMainViewColors()

 	// Get terminal dimensions for proper sizing
-	termHeight := m.termHeight
-	if termHeight == 0 {
-		termHeight = 40 // Fallback
+	termWidth, termHeight := m.getTermDimensions()
+
+	// Render title header
+	b.WriteString(m.renderTitle(colors.header))
+
+	// Render forwards table or empty message
+	if len(m.ui.forwardOrder) == 0 {
+		b.WriteString(m.renderEmptyMessage(colors.muted))
+	} else {
+		b.WriteString(m.renderForwardsTable(colors))
 	}

-	// Color palette
-	headerColor := lipgloss.Color("220")  // Yellow
-	activeColor := lipgloss.Color("46")   // Green
-	warningColor := lipgloss.Color("220") // Yellow
-	errorColor := lipgloss.Color("196")   // Red
-	mutedColor := lipgloss.Color("240")   // Gray
-	selectedBg := lipgloss.Color("240")   // Gray background
-	selectedFg := lipgloss.Color("230")   // Light foreground
+	// Render error section if any errors exist
+	if len(m.ui.errors) > 0 {
+		b.WriteString(m.renderErrorSection())
+	}
+
+	// Render footer with proper spacing
+	b.WriteString(m.renderFooterWithSpacing(termWidth, termHeight, &b))
+
+	return b.String()
+}
+
+// getTermDimensions returns terminal dimensions with fallback defaults
+func (m model) getTermDimensions() (width, height int) {
+	width = m.termWidth
+	height = m.termHeight
+	if width == 0 {
+		width = DefaultTermWidth
+	}
+	if height == 0 {
+		height = DefaultTermHeight
+	}
+	return
+}
+
+// renderTitle renders the title bar with version and optional update notification
+func (m model) renderTitle(headerColor lipgloss.Color) string {
+	var b strings.Builder

-	// Title with version
 	titleStyle := lipgloss.NewStyle().
 		Bold(true).
 		Foreground(headerColor).
@@ -412,183 +523,276 @@ func (m model) renderMainView() string {
 	}
 	b.WriteString("\n\n")

-	// No forwards
-	if len(m.ui.forwardOrder) == 0 {
-		disabledStyle := lipgloss.NewStyle().Foreground(mutedColor)
-		b.WriteString(disabledStyle.Render("No forwards configured\n"))
-	} else {
-		// Build table rows
-		var rows [][]string
-		for _, id := range m.ui.forwardOrder {
+	return b.String()
+}
+
+// renderEmptyMessage renders the message shown when no forwards are configured
+func (m model) renderEmptyMessage(mutedColor lipgloss.Color) string {
+	disabledStyle := lipgloss.NewStyle().Foreground(mutedColor)
+	return disabledStyle.Render("No forwards configured\n")
+}
+
+// renderForwardsTable renders the forwards table with all styling
+func (m model) renderForwardsTable(colors mainViewColors) string {
+	var b strings.Builder
+
+	// Build table rows
+	rows := m.buildTableRows()
+
+	// Create table with styling (no borders for cleaner look)
+	t := table.New().
+		Border(lipgloss.HiddenBorder()).
+		Headers("CONTEXT", "NAMESPACE", "ALIAS", "TYPE", "RESOURCE", "REMOTE", "LOCAL", "STATUS").
+		Rows(rows...).
+		StyleFunc(m.createTableStyleFunc(colors))
+
+	b.WriteString(t.Render())
+	b.WriteString("\n")
+
+	return b.String()
+}
+
+// buildTableRows builds the data rows for the forwards table
+func (m model) buildTableRows() [][]string {
+	var rows [][]string
+
+	for _, id := range m.ui.forwardOrder {
+		fwd, ok := m.ui.forwards[id]
+		if !ok {
+			continue
+		}
+
+		statusIcon, statusText := m.getStatusIconAndText(id, fwd)
+
+		rows = append(rows, []string{
+			truncate(fwd.Context, ColumnWidthContext),
+			truncate(fwd.Namespace, ColumnWidthNamespace),
+			truncate(fwd.Alias, ColumnWidthAlias),
+			truncate(fwd.Type, ColumnWidthType),
+			truncate(fwd.Resource, ColumnWidthResource),
+			fmt.Sprintf("%d", fwd.RemotePort),
+			fmt.Sprintf("%d", fwd.LocalPort),
+			statusIcon + " " + statusText,
+		})
+	}
+
+	return rows
+}
+
+// getStatusIconAndText returns the appropriate status icon and text for a forward
+func (m model) getStatusIconAndText(id string, fwd *ForwardStatus) (icon, text string) {
+	icon = "●"
+	text = fwd.Status
+
+	if m.ui.isForwardDisabled(id) {
+		return "○", "Disabled"
+	}
+
+	switch fwd.Status {
+	case "Starting":
+		icon = "○"
+	case "Reconnecting":
+		icon = "◐"
+	case "Error":
+		icon = "✗"
+	}
+
+	return icon, text
+}
+
+// createTableStyleFunc creates the style function for the forwards table
+func (m model) createTableStyleFunc(colors mainViewColors) func(row, col int) lipgloss.Style {
+	return func(row, col int) lipgloss.Style {
+		// Header row
+		if row == table.HeaderRow {
+			return lipgloss.NewStyle().
+				Bold(true).
+				Foreground(colors.header).
+				Padding(0, 1)
+		}
+
+		baseStyle := lipgloss.NewStyle().Padding(0, 1)
+
+		if row >= 0 && row < len(m.ui.forwardOrder) {
+			id := m.ui.forwardOrder[row]
 			fwd, ok := m.ui.forwards[id]
-			if !ok {
-				continue
+			isSelected := row == m.ui.selectedIndex
+			isDisabled := m.ui.isForwardDisabled(id)
+
+			// Selected row gets background highlight
+			if isSelected {
+				return baseStyle.
+					Background(colors.selectedBg).
+					Foreground(colors.selectedFg)
 			}

-			isDisabled := m.ui.disabledMap[id] || fwd.Status == "Disabled"
-
-			// Status icon and text
-			statusIcon := "●"
-			statusText := fwd.Status
-
+			// Disabled rows are muted
 			if isDisabled {
-				statusIcon = "○"
-				statusText = "Disabled"
-			} else {
+				return baseStyle.Foreground(colors.muted)
+			}
+
+			// Status column gets colored based on status
+			if col == ColumnStatus && ok {
 				switch fwd.Status {
-				case "Starting":
-					statusIcon = "○"
-				case "Reconnecting":
-					statusIcon = "◐"
+				case "Active":
+					return baseStyle.Foreground(colors.active)
+				case "Starting", "Reconnecting":
+					return baseStyle.Foreground(colors.warning)
 				case "Error":
-					statusIcon = "✗"
-				}
-			}
-
-			rows = append(rows, []string{
-				truncate(fwd.Context, 14),
-				truncate(fwd.Namespace, 16),
-				truncate(fwd.Alias, 18),
-				truncate(fwd.Type, 8),
-				truncate(fwd.Resource, 20),
-				fmt.Sprintf("%d", fwd.RemotePort),
-				fmt.Sprintf("%d", fwd.LocalPort),
-				statusIcon + " " + statusText,
-			})
-		}
-
-		// Create table with styling (no borders for cleaner look)
-		t := table.New().
-			Border(lipgloss.HiddenBorder()).
-			Headers("CONTEXT", "NAMESPACE", "ALIAS", "TYPE", "RESOURCE", "REMOTE", "LOCAL", "STATUS").
-			Rows(rows...).
-			StyleFunc(func(row, col int) lipgloss.Style {
-				// Header row
-				if row == table.HeaderRow {
-					return lipgloss.NewStyle().
-						Bold(true).
-						Foreground(headerColor).
-						Padding(0, 1)
-				}
-
-				// Get the forward for this row to check its status
-				baseStyle := lipgloss.NewStyle().Padding(0, 1)
-
-				if row >= 0 && row < len(m.ui.forwardOrder) {
-					id := m.ui.forwardOrder[row]
-					fwd, ok := m.ui.forwards[id]
-					isSelected := row == m.ui.selectedIndex
-					isDisabled := m.ui.disabledMap[id] || (ok && fwd.Status == "Disabled")
-
-					// Selected row gets background highlight
-					if isSelected {
-						return baseStyle.
-							Background(selectedBg).
-							Foreground(selectedFg)
-					}
-
-					// Disabled rows are muted
-					if isDisabled {
-						return baseStyle.Foreground(mutedColor)
-					}
-
-					// Status column gets colored based on status
-					if col == 7 && ok { // STATUS column
-						switch fwd.Status {
-						case "Active":
-							return baseStyle.Foreground(activeColor)
-						case "Starting", "Reconnecting":
-							return baseStyle.Foreground(warningColor)
-						case "Error":
-							return baseStyle.Foreground(errorColor)
-						}
-					}
-				}
-
-				return baseStyle
-			})
-
-		b.WriteString(t.Render())
-		b.WriteString("\n")
-	}
-
-	// Display errors if any (before footer)
-	if len(m.ui.errors) > 0 {
-		b.WriteString("\n\n")
-		errorHeaderStyle := lipgloss.NewStyle().
-			Bold(true).
-			Foreground(lipgloss.Color("196"))
-
-		b.WriteString(errorHeaderStyle.Render("Errors:"))
-		b.WriteString("\n")
-
-		errorLineStyle := lipgloss.NewStyle().
-			Foreground(lipgloss.Color("196")).
-			Width(118). // Slightly less than table width (120) for padding
-			MaxWidth(118)
-
-		for id, errMsg := range m.ui.errors {
-			// Find the forward to display its alias
-			if fwd, ok := m.ui.forwards[id]; ok {
-				// Format: "  • alias: error message"
-				prefix := fmt.Sprintf("  • %s: ", fwd.Alias)
-
-				// Wrap the error message if it's too long
-				// Max line length is 118, subtract prefix length
-				maxErrLen := 118 - len(prefix)
-				wrappedMsg := wrapText(errMsg, maxErrLen)
-
-				// Render first line with prefix
-				lines := strings.Split(wrappedMsg, "\n")
-				if len(lines) > 0 {
-					b.WriteString(errorLineStyle.Render(prefix + lines[0]))
-					b.WriteString("\n")
-
-					// Render subsequent lines with indentation
-					indent := strings.Repeat(" ", len(prefix))
-					for i := 1; i < len(lines); i++ {
-						b.WriteString(errorLineStyle.Render(indent + lines[i]))
-						b.WriteString("\n")
-					}
+					return baseStyle.Foreground(colors.errorColor)
 				}
 			}
 		}
+
+		return baseStyle
 	}
+}
+
+// renderErrorSection renders the error display section
+func (m model) renderErrorSection() string {
+	var b strings.Builder
+
+	b.WriteString("\n\n")
+	errorHeaderStyle := lipgloss.NewStyle().
+		Bold(true).
+		Foreground(lipgloss.Color("196"))
+
+	b.WriteString(errorHeaderStyle.Render("Errors:"))
+	b.WriteString("\n")
+
+	errorLineStyle := lipgloss.NewStyle().
+		Foreground(lipgloss.Color("196")).
+		Width(ErrorDisplayWidth).
+		MaxWidth(ErrorDisplayWidth)
+
+	for id, errMsg := range m.ui.errors {
+		// Find the forward to display its alias
+		if fwd, ok := m.ui.forwards[id]; ok {
+			b.WriteString(m.renderErrorLine(fwd.Alias, errMsg, errorLineStyle))
+		}
+	}
+
+	return b.String()
+}
+
+// renderErrorLine renders a single error line with proper wrapping
+func (m model) renderErrorLine(alias, errMsg string, style lipgloss.Style) string {
+	var b strings.Builder
+
+	// Format: "  • alias: error message"
+	prefix := fmt.Sprintf("  • %s: ", alias)
+
+	// Wrap the error message if it's too long
+	maxErrLen := ErrorDisplayWidth - len(prefix)
+	wrappedMsg := wrapText(errMsg, maxErrLen)
+
+	// Render first line with prefix
+	lines := strings.Split(wrappedMsg, "\n")
+	if len(lines) > 0 {
+		b.WriteString(style.Render(prefix + lines[0]))
+		b.WriteString("\n")
+
+		// Render subsequent lines with indentation
+		indent := strings.Repeat(" ", len(prefix))
+		for i := 1; i < len(lines); i++ {
+			b.WriteString(style.Render(indent + lines[i]))
+			b.WriteString("\n")
+		}
+	}
+
+	return b.String()
+}
+
+// renderFooterWithSpacing renders the footer with proper vertical spacing
+func (m model) renderFooterWithSpacing(termWidth, termHeight int, content *strings.Builder) string {
+	var b strings.Builder

 	// Calculate current content height
-	currentContent := b.String()
+	currentContent := content.String()
 	currentLines := strings.Count(currentContent, "\n") + 1

-	// Footer styles
-	footerStyle := lipgloss.NewStyle().Foreground(lipgloss.Color("240"))
-	keyStyle := lipgloss.NewStyle().Foreground(lipgloss.Color("220"))
+	// Build footer content
+	footerLines := m.buildFooterLines(termWidth)

-	footer := fmt.Sprintf("%s/%s: Navigate  %s: Toggle  %s: New  %s: Edit  %s: Delete  %s: Bench  %s: Logs  %s: Quit  │  Total: %d",
-		keyStyle.Render("↑↓"),
-		keyStyle.Render("jk"),
-		keyStyle.Render("Space"),
-		keyStyle.Render("n"),
-		keyStyle.Render("e"),
-		keyStyle.Render("d"),
-		keyStyle.Render("b"),
-		keyStyle.Render("l"),
-		keyStyle.Render("q"),
-		len(m.ui.forwardOrder))
-
-	// Fill space to push footer to bottom (reserve 2 lines: 1 for spacing, 1 for footer)
-	footerHeight := 2
+	// Calculate footer height and add spacing
+	footerHeight := len(footerLines) + 1 // +1 for the blank line before footer
 	remainingLines := termHeight - currentLines - footerHeight
 	if remainingLines > 0 {
 		b.WriteString(strings.Repeat("\n", remainingLines))
 	}

 	// Add footer at bottom
+	footerStyle := lipgloss.NewStyle().Foreground(lipgloss.Color("240"))
 	b.WriteString("\n")
-	b.WriteString(footerStyle.Render(footer))
+	for i, line := range footerLines {
+		if i > 0 {
+			b.WriteString("\n")
+		}
+		b.WriteString(footerStyle.Render(line))
+	}

 	return b.String()
 }

+// buildFooterLines builds the footer lines that fit within terminal width
+func (m model) buildFooterLines(termWidth int) []string {
+	keyStyle := lipgloss.NewStyle().Foreground(lipgloss.Color("220"))
+	bindings := mainViewKeyBindings()
+
+	var footerLines []string
+	var currentLine strings.Builder
+	currentLineVisualLen := 0
+
+	// Calculate how much space we need for the total count suffix
+	totalSuffix := fmt.Sprintf("  │  Total: %d", len(m.ui.forwardOrder))
+	totalSuffixLen := len(totalSuffix)
+
+	// Available width (account for some margin)
+	availableWidth := termWidth - 4
+
+	for i, binding := range bindings {
+		// Build this binding's text
+		keyRendered := keyStyle.Render(binding.key)
+		bindingText := keyRendered + ": " + binding.desc
+		// Visual length without ANSI codes
+		bindingVisualLen := len(binding.key) + 2 + len(binding.desc)
+
+		// Add separator if not first item on line
+		separator := ""
+		separatorLen := 0
+		if currentLine.Len() > 0 {
+			separator = "  "
+			separatorLen = 2
+		}
+
+		// Check if this binding fits on current line
+		// For the last binding, also need to fit the total suffix
+		neededWidth := currentLineVisualLen + separatorLen + bindingVisualLen
+		if i == len(bindings)-1 {
+			neededWidth += totalSuffixLen
+		}
+
+		if neededWidth > availableWidth && currentLine.Len() > 0 {
+			// Start a new line
+			footerLines = append(footerLines, currentLine.String())
+			currentLine.Reset()
+			currentLineVisualLen = 0
+			separator = ""
+			separatorLen = 0
+		}
+
+		currentLine.WriteString(separator)
+		currentLine.WriteString(bindingText)
+		currentLineVisualLen += separatorLen + bindingVisualLen
+	}
+
+	// Add total count to the last line
+	currentLine.WriteString(totalSuffix)
+	footerLines = append(footerLines, currentLine.String())
+
+	return footerLines
+}
+
 // wrapText wraps text to the specified width, breaking at word boundaries
 func wrapText(text string, width int) string {
 	if len(text) <= width {
@@ -697,7 +901,7 @@ func (m model) renderDeleteConfirmation() string {
 	}

 	b.WriteString("\n\n")
-	b.WriteString(helpStyle.Render("←/→: Navigate  Enter: Confirm  Esc: Cancel"))
+	b.WriteString(wrapHelpText("←/→: Navigate  Enter: Confirm  Esc: Cancel", wizardHelpWidth(m.termWidth)))

 	// Wrap in a box using wizard style
 	boxStyle := lipgloss.NewStyle().
@@ -729,3 +933,18 @@ func (ui *BubbleTeaUI) toggleSelected() {
 		go ui.toggleCallback(selectedID, !newState) // enable is inverse of disabled
 	}
 }
+
+// isForwardDisabled checks if a forward is disabled.
+// A forward is considered disabled if either:
+// 1. The user has disabled it via the UI (tracked in disabledMap)
+// 2. The forward's status is "Disabled" (from the manager)
+// Caller must hold ui.mu.RLock or ui.mu.Lock.
+func (ui *BubbleTeaUI) isForwardDisabled(id string) bool {
+	if ui.disabledMap[id] {
+		return true
+	}
+	if fwd, ok := ui.forwards[id]; ok && fwd.Status == "Disabled" {
+		return true
+	}
+	return false
+}
@@ -0,0 +1,782 @@
+package ui
+
+import (
+	"testing"
+
+	"github.com/nvm/kportal/internal/config"
+	"github.com/stretchr/testify/assert"
+)
+
+// TestNewBubbleTeaUI tests the constructor
+func TestNewBubbleTeaUI(t *testing.T) {
+	callback := func(id string, enable bool) {}
+
+	ui := NewBubbleTeaUI(callback, "1.0.0")
+
+	assert.NotNil(t, ui)
+	assert.NotNil(t, ui.forwards)
+	assert.NotNil(t, ui.forwardOrder)
+	assert.NotNil(t, ui.disabledMap)
+	assert.NotNil(t, ui.errors)
+	assert.Equal(t, "1.0.0", ui.version)
+	assert.Equal(t, ViewModeMain, ui.viewMode)
+	assert.Equal(t, 0, ui.selectedIndex)
+}
+
+// TestBubbleTeaUI_AddForward tests adding forwards
+func TestBubbleTeaUI_AddForward(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	fwd := &config.Forward{
+		Resource:  "pod/my-app",
+		Port:      8080,
+		LocalPort: 8080,
+		Alias:     "my-app",
+	}
+
+	ui.AddForward("test-id", fwd)
+
+	ui.mu.RLock()
+	defer ui.mu.RUnlock()
+
+	assert.Len(t, ui.forwards, 1)
+	assert.Len(t, ui.forwardOrder, 1)
+	assert.Equal(t, "test-id", ui.forwardOrder[0])
+
+	status := ui.forwards["test-id"]
+	assert.Equal(t, "my-app", status.Alias)
+	assert.Equal(t, "my-app", status.Resource)
+	assert.Equal(t, "pod", status.Type)
+	assert.Equal(t, 8080, status.LocalPort)
+	assert.Equal(t, 8080, status.RemotePort)
+	assert.Equal(t, "Starting", status.Status)
+}
+
+// TestBubbleTeaUI_AddForward_ServiceResource tests adding a service forward
+func TestBubbleTeaUI_AddForward_ServiceResource(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	fwd := &config.Forward{
+		Resource:  "service/postgres",
+		Port:      5432,
+		LocalPort: 5432,
+	}
+
+	ui.AddForward("svc-id", fwd)
+
+	ui.mu.RLock()
+	defer ui.mu.RUnlock()
+
+	status := ui.forwards["svc-id"]
+	assert.Equal(t, "postgres", status.Alias) // Uses resource name when no alias
+	assert.Equal(t, "postgres", status.Resource)
+	assert.Equal(t, "service", status.Type)
+}
+
+// TestBubbleTeaUI_AddForward_ReEnable tests re-enabling a disabled forward
+func TestBubbleTeaUI_AddForward_ReEnable(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	fwd := &config.Forward{
+		Resource:  "pod/my-app",
+		Port:      8080,
+		LocalPort: 8080,
+	}
+
+	// Add forward
+	ui.AddForward("test-id", fwd)
+
+	// Disable it
+	ui.mu.Lock()
+	ui.disabledMap["test-id"] = true
+	ui.forwards["test-id"].Status = "Disabled"
+	ui.mu.Unlock()
+
+	// Re-add (re-enable)
+	ui.AddForward("test-id", fwd)
+
+	ui.mu.RLock()
+	defer ui.mu.RUnlock()
+
+	assert.False(t, ui.disabledMap["test-id"])
+	assert.Equal(t, "Starting", ui.forwards["test-id"].Status)
+	assert.Len(t, ui.forwardOrder, 1) // Should not duplicate
+}
+
+// TestBubbleTeaUI_UpdateStatus tests status updates
+func TestBubbleTeaUI_UpdateStatus(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	fwd := &config.Forward{
+		Resource:  "pod/my-app",
+		Port:      8080,
+		LocalPort: 8080,
+	}
+	ui.AddForward("test-id", fwd)
+
+	// Update to Active
+	ui.UpdateStatus("test-id", "Active")
+
+	ui.mu.RLock()
+	assert.Equal(t, "Active", ui.forwards["test-id"].Status)
+	ui.mu.RUnlock()
+
+	// Update to Error
+	ui.UpdateStatus("test-id", "Error")
+
+	ui.mu.RLock()
+	assert.Equal(t, "Error", ui.forwards["test-id"].Status)
+	ui.mu.RUnlock()
+}
+
+// TestBubbleTeaUI_UpdateStatus_ClearsErrorOnActive tests that errors are cleared when status becomes Active
+func TestBubbleTeaUI_UpdateStatus_ClearsErrorOnActive(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	fwd := &config.Forward{
+		Resource:  "pod/my-app",
+		Port:      8080,
+		LocalPort: 8080,
+	}
+	ui.AddForward("test-id", fwd)
+
+	// Set an error
+	ui.SetError("test-id", "connection refused")
+
+	ui.mu.RLock()
+	assert.Equal(t, "connection refused", ui.errors["test-id"])
+	ui.mu.RUnlock()
+
+	// Update to Active - should clear error
+	ui.UpdateStatus("test-id", "Active")
+
+	ui.mu.RLock()
+	_, hasError := ui.errors["test-id"]
+	ui.mu.RUnlock()
+
+	assert.False(t, hasError, "Error should be cleared when status becomes Active")
+}
+
+// TestBubbleTeaUI_UpdateStatus_KeepsErrorOnReconnecting tests that errors persist during reconnection
+func TestBubbleTeaUI_UpdateStatus_KeepsErrorOnReconnecting(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	fwd := &config.Forward{
+		Resource:  "pod/my-app",
+		Port:      8080,
+		LocalPort: 8080,
+	}
+	ui.AddForward("test-id", fwd)
+
+	// Set an error
+	ui.SetError("test-id", "connection refused")
+
+	// Update to Reconnecting - should keep error
+	ui.UpdateStatus("test-id", "Reconnecting")
+
+	ui.mu.RLock()
+	assert.Equal(t, "connection refused", ui.errors["test-id"])
+	ui.mu.RUnlock()
+}
+
+// TestBubbleTeaUI_SetError tests error setting
+func TestBubbleTeaUI_SetError(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	fwd := &config.Forward{
+		Resource:  "pod/my-app",
+		Port:      8080,
+		LocalPort: 8080,
+	}
+	ui.AddForward("test-id", fwd)
+
+	ui.SetError("test-id", "connection timeout")
+
+	ui.mu.RLock()
+	defer ui.mu.RUnlock()
+
+	assert.Equal(t, "connection timeout", ui.errors["test-id"])
+}
+
+// TestBubbleTeaUI_Remove tests forward removal
+func TestBubbleTeaUI_Remove(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	fwd := &config.Forward{
+		Resource:  "pod/my-app",
+		Port:      8080,
+		LocalPort: 8080,
+	}
+	ui.AddForward("test-id", fwd)
+
+	ui.Remove("test-id")
+
+	ui.mu.RLock()
+	defer ui.mu.RUnlock()
+
+	assert.Len(t, ui.forwards, 0)
+	assert.Len(t, ui.forwardOrder, 0)
+}
+
+// TestBubbleTeaUI_Remove_ClearsErrors tests that removal clears associated errors
+func TestBubbleTeaUI_Remove_ClearsErrors(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	fwd := &config.Forward{
+		Resource:  "pod/my-app",
+		Port:      8080,
+		LocalPort: 8080,
+	}
+	ui.AddForward("test-id", fwd)
+	ui.SetError("test-id", "some error")
+
+	ui.Remove("test-id")
+
+	ui.mu.RLock()
+	defer ui.mu.RUnlock()
+
+	_, hasError := ui.errors["test-id"]
+	assert.False(t, hasError, "Error should be cleared on removal")
+}
+
+// TestBubbleTeaUI_Remove_AdjustsSelectedIndex tests index adjustment after removal
+func TestBubbleTeaUI_Remove_AdjustsSelectedIndex(t *testing.T) {
+	tests := []struct {
+		name              string
+		removeID          string
+		forwards          []string
+		selectedIndex     int
+		expectedIndex     int
+		expectedRemaining int
+	}{
+		{
+			name:              "remove selected item (last in list)",
+			forwards:          []string{"a", "b", "c"},
+			selectedIndex:     2,
+			removeID:          "c",
+			expectedIndex:     1, // Should move to previous item
+			expectedRemaining: 2,
+		},
+		{
+			name:              "remove item before selected",
+			forwards:          []string{"a", "b", "c"},
+			selectedIndex:     2,
+			removeID:          "a",
+			expectedIndex:     1, // Index shifts down but points to same item
+			expectedRemaining: 2,
+		},
+		{
+			name:              "remove item after selected",
+			forwards:          []string{"a", "b", "c"},
+			selectedIndex:     0,
+			removeID:          "c",
+			expectedIndex:     0, // No change needed
+			expectedRemaining: 2,
+		},
+		{
+			name:              "remove only item",
+			forwards:          []string{"a"},
+			selectedIndex:     0,
+			removeID:          "a",
+			expectedIndex:     0, // Stays at 0 (clamped)
+			expectedRemaining: 0,
+		},
+		{
+			name:              "remove middle item when selected is after",
+			forwards:          []string{"a", "b", "c", "d"},
+			selectedIndex:     3,
+			removeID:          "b",
+			expectedIndex:     2, // Adjusts down
+			expectedRemaining: 3,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ui := NewBubbleTeaUI(nil, "1.0.0")
+
+			// Add forwards
+			for _, id := range tt.forwards {
+				fwd := &config.Forward{
+					Resource:  "pod/" + id,
+					Port:      8080,
+					LocalPort: 8080,
+				}
+				ui.AddForward(id, fwd)
+			}
+
+			// Set selected index
+			ui.mu.Lock()
+			ui.selectedIndex = tt.selectedIndex
+			ui.mu.Unlock()
+
+			// Remove
+			ui.Remove(tt.removeID)
+
+			ui.mu.RLock()
+			defer ui.mu.RUnlock()
+
+			assert.Equal(t, tt.expectedIndex, ui.selectedIndex)
+			assert.Len(t, ui.forwardOrder, tt.expectedRemaining)
+		})
+	}
+}
+
+// TestBubbleTeaUI_Remove_ClearsDeleteConfirmation tests that pending delete confirmation is cleared
+func TestBubbleTeaUI_Remove_ClearsDeleteConfirmation(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	fwd := &config.Forward{
+		Resource:  "pod/my-app",
+		Port:      8080,
+		LocalPort: 8080,
+	}
+	ui.AddForward("test-id", fwd)
+
+	// Set up delete confirmation
+	ui.mu.Lock()
+	ui.deleteConfirming = true
+	ui.deleteConfirmID = "test-id"
+	ui.deleteConfirmAlias = "my-app"
+	ui.mu.Unlock()
+
+	// Remove the forward
+	ui.Remove("test-id")
+
+	ui.mu.RLock()
+	defer ui.mu.RUnlock()
+
+	assert.False(t, ui.deleteConfirming, "Delete confirmation should be cleared")
+	assert.Empty(t, ui.deleteConfirmID)
+}
+
+// TestBubbleTeaUI_Remove_KeepsOtherDeleteConfirmation tests that unrelated delete confirmation persists
+func TestBubbleTeaUI_Remove_KeepsOtherDeleteConfirmation(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	fwd1 := &config.Forward{Resource: "pod/app1", Port: 8080, LocalPort: 8080}
+	fwd2 := &config.Forward{Resource: "pod/app2", Port: 8081, LocalPort: 8081}
+	ui.AddForward("id-1", fwd1)
+	ui.AddForward("id-2", fwd2)
+
+	// Set up delete confirmation for id-2
+	ui.mu.Lock()
+	ui.deleteConfirming = true
+	ui.deleteConfirmID = "id-2"
+	ui.deleteConfirmAlias = "app2"
+	ui.mu.Unlock()
+
+	// Remove id-1 (different forward)
+	ui.Remove("id-1")
+
+	ui.mu.RLock()
+	defer ui.mu.RUnlock()
+
+	assert.True(t, ui.deleteConfirming, "Delete confirmation for other forward should persist")
+	assert.Equal(t, "id-2", ui.deleteConfirmID)
+}
+
+// TestBubbleTeaUI_MoveSelection tests cursor movement
+func TestBubbleTeaUI_MoveSelection(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	// Add some forwards
+	for i := 0; i < 5; i++ {
+		fwd := &config.Forward{
+			Resource:  "pod/app",
+			Port:      8080 + i,
+			LocalPort: 8080 + i,
+		}
+		ui.AddForward(string(rune('a'+i)), fwd)
+	}
+
+	tests := []struct {
+		name          string
+		initialIndex  int
+		delta         int
+		expectedIndex int
+	}{
+		{"move down from 0", 0, 1, 1},
+		{"move down from middle", 2, 1, 3},
+		{"move up from middle", 2, -1, 1},
+		{"cannot move below 0", 0, -1, 0},
+		{"cannot move above max", 4, 1, 4},
+		{"large delta clamped to max", 0, 100, 4},
+		{"large negative delta clamped to 0", 4, -100, 0},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ui.mu.Lock()
+			ui.selectedIndex = tt.initialIndex
+			ui.mu.Unlock()
+
+			ui.moveSelection(tt.delta)
+
+			ui.mu.RLock()
+			assert.Equal(t, tt.expectedIndex, ui.selectedIndex)
+			ui.mu.RUnlock()
+		})
+	}
+}
+
+// TestBubbleTeaUI_MoveSelection_EmptyList tests movement with no forwards
+func TestBubbleTeaUI_MoveSelection_EmptyList(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	// Should not panic with empty list
+	ui.moveSelection(1)
+	ui.moveSelection(-1)
+
+	ui.mu.RLock()
+	assert.Equal(t, 0, ui.selectedIndex)
+	ui.mu.RUnlock()
+}
+
+// TestBubbleTeaUI_ToggleSelected tests toggling forward state
+func TestBubbleTeaUI_ToggleSelected(t *testing.T) {
+	callback := func(id string, enable bool) {
+		// Callback is called in a goroutine
+	}
+
+	ui := NewBubbleTeaUI(callback, "1.0.0")
+
+	fwd := &config.Forward{
+		Resource:  "pod/my-app",
+		Port:      8080,
+		LocalPort: 8080,
+	}
+	ui.AddForward("test-id", fwd)
+
+	// Toggle to disabled
+	ui.toggleSelected()
+
+	// Wait for goroutine
+	ui.mu.RLock()
+	isDisabled := ui.disabledMap["test-id"]
+	ui.mu.RUnlock()
+
+	assert.True(t, isDisabled)
+
+	// Toggle back to enabled
+	ui.toggleSelected()
+
+	ui.mu.RLock()
+	isDisabled = ui.disabledMap["test-id"]
+	ui.mu.RUnlock()
+
+	assert.False(t, isDisabled)
+}
+
+// TestBubbleTeaUI_SetUpdateAvailable tests update notification
+func TestBubbleTeaUI_SetUpdateAvailable(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	ui.SetUpdateAvailable("2.0.0", "https://example.com/update")
+
+	ui.mu.RLock()
+	defer ui.mu.RUnlock()
+
+	assert.True(t, ui.updateAvailable)
+	assert.Equal(t, "2.0.0", ui.updateVersion)
+	assert.Equal(t, "https://example.com/update", ui.updateURL)
+}
+
+// TestBubbleTeaUI_SetWizardDependencies tests dependency injection
+func TestBubbleTeaUI_SetWizardDependencies(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	// Initially nil
+	ui.mu.RLock()
+	assert.Nil(t, ui.discovery)
+	assert.Nil(t, ui.mutator)
+	assert.Empty(t, ui.configPath)
+	ui.mu.RUnlock()
+
+	// Set dependencies (using nil for simplicity - just testing the setter)
+	ui.SetWizardDependencies(nil, nil, "/path/to/config.yaml")
+
+	ui.mu.RLock()
+	defer ui.mu.RUnlock()
+
+	assert.Equal(t, "/path/to/config.yaml", ui.configPath)
+}
+
+// TestBubbleTeaUI_ResetDeleteConfirmation tests the reset helper
+func TestBubbleTeaUI_ResetDeleteConfirmation(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	// Set up confirmation state
+	ui.mu.Lock()
+	ui.deleteConfirming = true
+	ui.deleteConfirmID = "test-id"
+	ui.deleteConfirmAlias = "test-alias"
+	ui.deleteConfirmCursor = 1
+	ui.mu.Unlock()
+
+	// Reset
+	ui.mu.Lock()
+	ui.resetDeleteConfirmation()
+	ui.mu.Unlock()
+
+	ui.mu.RLock()
+	defer ui.mu.RUnlock()
+
+	assert.False(t, ui.deleteConfirming)
+	assert.Empty(t, ui.deleteConfirmID)
+	assert.Empty(t, ui.deleteConfirmAlias)
+	assert.Equal(t, 0, ui.deleteConfirmCursor)
+}
+
+// TestBubbleTeaUI_IsForwardDisabled tests the disabled state helper
+func TestBubbleTeaUI_IsForwardDisabled(t *testing.T) {
+	tests := []struct {
+		name           string
+		forwardStatus  string
+		disabledMap    bool
+		expectedResult bool
+	}{
+		{
+			name:           "not disabled in map, Active status",
+			disabledMap:    false,
+			forwardStatus:  "Active",
+			expectedResult: false,
+		},
+		{
+			name:           "disabled in map, Active status",
+			disabledMap:    true,
+			forwardStatus:  "Active",
+			expectedResult: true,
+		},
+		{
+			name:           "not disabled in map, Disabled status",
+			disabledMap:    false,
+			forwardStatus:  "Disabled",
+			expectedResult: true,
+		},
+		{
+			name:           "both disabled in map and Disabled status",
+			disabledMap:    true,
+			forwardStatus:  "Disabled",
+			expectedResult: true,
+		},
+		{
+			name:           "not disabled in map, Error status",
+			disabledMap:    false,
+			forwardStatus:  "Error",
+			expectedResult: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ui := NewBubbleTeaUI(nil, "1.0.0")
+
+			fwd := &config.Forward{
+				Resource:  "pod/my-app",
+				Port:      8080,
+				LocalPort: 8080,
+			}
+			ui.AddForward("test-id", fwd)
+
+			ui.mu.Lock()
+			ui.disabledMap["test-id"] = tt.disabledMap
+			ui.forwards["test-id"].Status = tt.forwardStatus
+			ui.mu.Unlock()
+
+			ui.mu.RLock()
+			result := ui.isForwardDisabled("test-id")
+			ui.mu.RUnlock()
+
+			assert.Equal(t, tt.expectedResult, result)
+		})
+	}
+}
+
+// TestBubbleTeaUI_IsForwardDisabled_NonExistent tests disabled check for non-existent forward
+func TestBubbleTeaUI_IsForwardDisabled_NonExistent(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	ui.mu.RLock()
+	result := ui.isForwardDisabled("non-existent")
+	ui.mu.RUnlock()
+
+	assert.False(t, result, "Non-existent forward should not be disabled")
+}
+
+// TestBubbleTeaUI_AddForward_ReEnableClearsError tests that re-enabling clears previous errors
+func TestBubbleTeaUI_AddForward_ReEnableClearsError(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	fwd := &config.Forward{
+		Resource:  "pod/my-app",
+		Port:      8080,
+		LocalPort: 8080,
+	}
+
+	// Add forward
+	ui.AddForward("test-id", fwd)
+
+	// Set error and disable
+	ui.SetError("test-id", "connection refused")
+	ui.mu.Lock()
+	ui.disabledMap["test-id"] = true
+	ui.forwards["test-id"].Status = "Disabled"
+	ui.mu.Unlock()
+
+	// Verify error exists
+	ui.mu.RLock()
+	_, hasError := ui.errors["test-id"]
+	ui.mu.RUnlock()
+	assert.True(t, hasError, "Error should exist before re-enable")
+
+	// Re-enable (re-add)
+	ui.AddForward("test-id", fwd)
+
+	// Verify error is cleared
+	ui.mu.RLock()
+	_, hasError = ui.errors["test-id"]
+	ui.mu.RUnlock()
+	assert.False(t, hasError, "Error should be cleared after re-enable")
+}
+
+// TestWrapText tests the text wrapping function
+func TestWrapText(t *testing.T) {
+	tests := []struct {
+		name     string
+		text     string
+		expected string
+		width    int
+	}{
+		{
+			name:     "short text fits",
+			text:     "hello world",
+			width:    20,
+			expected: "hello world",
+		},
+		{
+			name:     "single long word",
+			text:     "superlongwordthatexceedswidth",
+			width:    10,
+			expected: "superlongwordthatexceedswidth",
+		},
+		{
+			name:     "wraps at word boundary",
+			text:     "hello world this is a test",
+			width:    15,
+			expected: "hello world\nthis is a test",
+		},
+		{
+			name:     "multiple wraps",
+			text:     "one two three four five six",
+			width:    10,
+			expected: "one two\nthree four\nfive six",
+		},
+		{
+			name:     "empty string",
+			text:     "",
+			width:    10,
+			expected: "",
+		},
+		{
+			name:     "single word",
+			text:     "hello",
+			width:    10,
+			expected: "hello",
+		},
+		{
+			name:     "exact width",
+			text:     "hello wor",
+			width:    9,
+			expected: "hello wor",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := wrapText(tt.text, tt.width)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// TestBubbleTeaUI_AddForward_ResourceParsing tests various resource format parsing
+func TestBubbleTeaUI_AddForward_ResourceParsing(t *testing.T) {
+	tests := []struct {
+		name         string
+		resource     string
+		expectedType string
+		expectedName string
+	}{
+		{
+			name:         "pod with prefix",
+			resource:     "pod/my-app",
+			expectedType: "pod",
+			expectedName: "my-app",
+		},
+		{
+			name:         "service resource",
+			resource:     "service/postgres",
+			expectedType: "service",
+			expectedName: "postgres",
+		},
+		{
+			name:         "deployment resource",
+			resource:     "deployment/api-server",
+			expectedType: "deployment",
+			expectedName: "api-server",
+		},
+		{
+			name:         "no type prefix (pod default)",
+			resource:     "my-pod",
+			expectedType: "pod",
+			expectedName: "my-pod",
+		},
+		{
+			name:         "resource with multiple slashes",
+			resource:     "custom/type/resource",
+			expectedType: "custom",
+			expectedName: "type/resource",
+		},
+		{
+			name:         "empty resource",
+			resource:     "",
+			expectedType: "pod",
+			expectedName: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ui := NewBubbleTeaUI(nil, "1.0.0")
+
+			fwd := &config.Forward{
+				Resource:  tt.resource,
+				Port:      8080,
+				LocalPort: 8080,
+			}
+			ui.AddForward("test-id", fwd)
+
+			ui.mu.RLock()
+			status := ui.forwards["test-id"]
+			ui.mu.RUnlock()
+
+			assert.Equal(t, tt.expectedType, status.Type)
+			assert.Equal(t, tt.expectedName, status.Resource)
+		})
+	}
+}
+
+// TestConstants tests that UI constants are properly defined
+func TestConstants(t *testing.T) {
+	assert.Equal(t, 120, DefaultTermWidth)
+	assert.Equal(t, 40, DefaultTermHeight)
+	assert.Equal(t, 7, ColumnStatus)
+	assert.Equal(t, 14, ColumnWidthContext)
+	assert.Equal(t, 16, ColumnWidthNamespace)
+	assert.Equal(t, 18, ColumnWidthAlias)
+	assert.Equal(t, 8, ColumnWidthType)
+	assert.Equal(t, 20, ColumnWidthResource)
+	assert.Equal(t, 118, ErrorDisplayWidth)
+	assert.Equal(t, 20, ViewportHeight)
+}
@@ -0,0 +1,386 @@
+package ui
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/nvm/kportal/internal/k8s"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestMessageTypes tests the message type structures
+func TestMessageTypes(t *testing.T) {
+	t.Run("ContextsLoadedMsg", func(t *testing.T) {
+		msg := ContextsLoadedMsg{
+			contexts: []string{"ctx1", "ctx2"},
+		}
+		assert.Len(t, msg.contexts, 2)
+		assert.Nil(t, msg.err)
+
+		errMsg := ContextsLoadedMsg{
+			err: assert.AnError,
+		}
+		assert.NotNil(t, errMsg.err)
+	})
+
+	t.Run("NamespacesLoadedMsg", func(t *testing.T) {
+		msg := NamespacesLoadedMsg{
+			namespaces: []string{"default", "kube-system"},
+		}
+		assert.Len(t, msg.namespaces, 2)
+		assert.Nil(t, msg.err)
+	})
+
+	t.Run("PodsLoadedMsg", func(t *testing.T) {
+		msg := PodsLoadedMsg{
+			pods: []k8s.PodInfo{
+				{Name: "pod1", Namespace: "default"},
+				{Name: "pod2", Namespace: "default"},
+			},
+		}
+		assert.Len(t, msg.pods, 2)
+		assert.Nil(t, msg.err)
+	})
+
+	t.Run("ServicesLoadedMsg", func(t *testing.T) {
+		msg := ServicesLoadedMsg{
+			services: []k8s.ServiceInfo{
+				{Name: "svc1", Namespace: "default"},
+			},
+		}
+		assert.Len(t, msg.services, 1)
+		assert.Nil(t, msg.err)
+	})
+
+	t.Run("SelectorValidatedMsg", func(t *testing.T) {
+		validMsg := SelectorValidatedMsg{
+			valid: true,
+			pods: []k8s.PodInfo{
+				{Name: "matched-pod"},
+			},
+		}
+		assert.True(t, validMsg.valid)
+		assert.Len(t, validMsg.pods, 1)
+
+		invalidMsg := SelectorValidatedMsg{
+			valid: false,
+			err:   assert.AnError,
+		}
+		assert.False(t, invalidMsg.valid)
+		assert.NotNil(t, invalidMsg.err)
+	})
+
+	t.Run("PortCheckedMsg", func(t *testing.T) {
+		availableMsg := PortCheckedMsg{
+			port:      8080,
+			available: true,
+			message:   "Port 8080 available",
+		}
+		assert.Equal(t, 8080, availableMsg.port)
+		assert.True(t, availableMsg.available)
+		assert.Equal(t, "Port 8080 available", availableMsg.message)
+
+		unavailableMsg := PortCheckedMsg{
+			port:      8080,
+			available: false,
+			message:   "Port 8080 in use by process",
+		}
+		assert.Equal(t, 8080, unavailableMsg.port)
+		assert.False(t, unavailableMsg.available)
+		assert.Equal(t, "Port 8080 in use by process", unavailableMsg.message)
+	})
+
+	t.Run("ForwardSavedMsg", func(t *testing.T) {
+		successMsg := ForwardSavedMsg{success: true}
+		assert.True(t, successMsg.success)
+
+		failMsg := ForwardSavedMsg{success: false, err: assert.AnError}
+		assert.False(t, failMsg.success)
+		assert.NotNil(t, failMsg.err)
+	})
+
+	t.Run("ForwardsRemovedMsg", func(t *testing.T) {
+		msg := ForwardsRemovedMsg{
+			success: true,
+			count:   3,
+		}
+		assert.True(t, msg.success)
+		assert.Equal(t, 3, msg.count)
+	})
+
+	t.Run("WizardCompleteMsg", func(t *testing.T) {
+		msg := WizardCompleteMsg{}
+		assert.NotNil(t, msg)
+	})
+
+	t.Run("BenchmarkCompleteMsg", func(t *testing.T) {
+		msg := BenchmarkCompleteMsg{
+			ForwardID: "fwd-123",
+		}
+		assert.Equal(t, "fwd-123", msg.ForwardID)
+		assert.Nil(t, msg.Results)
+		assert.Nil(t, msg.Error)
+	})
+
+	t.Run("BenchmarkProgressMsg", func(t *testing.T) {
+		msg := BenchmarkProgressMsg{
+			ForwardID: "fwd-123",
+			Completed: 50,
+			Total:     100,
+		}
+		assert.Equal(t, "fwd-123", msg.ForwardID)
+		assert.Equal(t, 50, msg.Completed)
+		assert.Equal(t, 100, msg.Total)
+	})
+
+	t.Run("HTTPLogEntryMsg", func(t *testing.T) {
+		msg := HTTPLogEntryMsg{
+			Entry: HTTPLogEntry{
+				Method:     "GET",
+				Path:       "/api/test",
+				StatusCode: 200,
+			},
+		}
+		assert.Equal(t, "GET", msg.Entry.Method)
+		assert.Equal(t, "/api/test", msg.Entry.Path)
+		assert.Equal(t, 200, msg.Entry.StatusCode)
+	})
+}
+
+// TestCheckPortCmd tests the port availability check command
+func TestCheckPortCmd_PortAvailability(t *testing.T) {
+	// Create a temporary config file for testing
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	// Create an empty config file
+	err := os.WriteFile(configPath, []byte("contexts: []\n"), 0600)
+	require.NoError(t, err)
+
+	// Test checking a random high port that should be available
+	cmd := checkPortCmd(59999, configPath)
+	msg := cmd()
+
+	portMsg, ok := msg.(PortCheckedMsg)
+	require.True(t, ok, "Expected PortCheckedMsg")
+	assert.Equal(t, 59999, portMsg.port)
+	// The port may or may not be available depending on the system,
+	// but we verify the message structure is correct
+	assert.NotEmpty(t, portMsg.message)
+}
+
+// TestCheckPortCmd_ConfigConflict tests port conflict detection in config
+func TestCheckPortCmd_ConfigConflict(t *testing.T) {
+	// Create a temporary config file with a forward using port 8080
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, ".kportal.yaml")
+
+	configContent := `contexts:
+  - name: test-ctx
+    namespaces:
+      - name: default
+        forwards:
+          - resource: pod/my-app
+            port: 80
+            localPort: 8080
+`
+	err := os.WriteFile(configPath, []byte(configContent), 0600)
+	require.NoError(t, err)
+
+	// Test checking port that's already in config
+	cmd := checkPortCmd(8080, configPath)
+	msg := cmd()
+
+	portMsg, ok := msg.(PortCheckedMsg)
+	require.True(t, ok, "Expected PortCheckedMsg")
+	assert.Equal(t, 8080, portMsg.port)
+	assert.False(t, portMsg.available, "Port should not be available (in config)")
+	assert.Contains(t, portMsg.message, "already assigned")
+}
+
+// TestCheckPortCmd_InvalidConfig tests behavior with invalid config file
+func TestCheckPortCmd_InvalidConfig(t *testing.T) {
+	// Use a non-existent config path
+	cmd := checkPortCmd(59998, "/nonexistent/path/.kportal.yaml")
+	msg := cmd()
+
+	portMsg, ok := msg.(PortCheckedMsg)
+	require.True(t, ok, "Expected PortCheckedMsg")
+	// Should still return a result (just skip config check)
+	assert.Equal(t, 59998, portMsg.port)
+	assert.NotEmpty(t, portMsg.message)
+}
+
+// TestListenBenchmarkProgressCmd tests the progress listener command
+func TestListenBenchmarkProgressCmd(t *testing.T) {
+	progressCh := make(chan BenchmarkProgressMsg, 1)
+
+	// Send a progress message
+	progressCh <- BenchmarkProgressMsg{
+		ForwardID: "fwd-123",
+		Completed: 25,
+		Total:     100,
+	}
+
+	cmd := listenBenchmarkProgressCmd(progressCh)
+	msg := cmd()
+
+	progressMsg, ok := msg.(BenchmarkProgressMsg)
+	require.True(t, ok, "Expected BenchmarkProgressMsg")
+	assert.Equal(t, "fwd-123", progressMsg.ForwardID)
+	assert.Equal(t, 25, progressMsg.Completed)
+	assert.Equal(t, 100, progressMsg.Total)
+}
+
+// TestListenBenchmarkProgressCmd_ChannelClosed tests behavior when channel closes
+func TestListenBenchmarkProgressCmd_ChannelClosed(t *testing.T) {
+	progressCh := make(chan BenchmarkProgressMsg)
+	close(progressCh)
+
+	cmd := listenBenchmarkProgressCmd(progressCh)
+	msg := cmd()
+
+	assert.Nil(t, msg, "Should return nil when channel is closed")
+}
+
+// TestRunBenchmarkCmd_Cancellation tests benchmark cancellation
+func TestRunBenchmarkCmd_Cancellation(t *testing.T) {
+	// Create a context that's already cancelled
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel() // Cancel immediately
+
+	progressCh := make(chan BenchmarkProgressMsg, 100)
+
+	cmd := runBenchmarkCmd(ctx, "fwd-123", 59997, "/", "GET", 1, 10, progressCh)
+
+	// Run with timeout to prevent hanging
+	done := make(chan bool, 1)
+	var msg any
+	go func() {
+		msg = cmd()
+		done <- true
+	}()
+
+	select {
+	case <-done:
+		// Command completed
+	case <-time.After(5 * time.Second):
+		t.Fatal("runBenchmarkCmd timed out")
+	}
+
+	completeMsg, ok := msg.(BenchmarkCompleteMsg)
+	require.True(t, ok, "Expected BenchmarkCompleteMsg")
+	assert.Equal(t, "fwd-123", completeMsg.ForwardID)
+	// When cancelled, we expect either an error or the context cancellation message
+	// The benchmark may or may not have had time to process the cancellation
+}
+
+// TestK8sAPITimeout tests that the timeout constant is correct
+func TestK8sAPITimeout(t *testing.T) {
+	assert.Equal(t, 10*time.Second, k8sAPITimeout)
+}
+
+// TestRemovableForwardStruct tests the RemovableForward structure used by commands
+func TestRemovableForwardStruct(t *testing.T) {
+	rf := RemovableForward{
+		ID:        "fwd-123",
+		Context:   "prod",
+		Namespace: "default",
+		Resource:  "pod/my-app",
+		Selector:  "app=my-app",
+		Alias:     "my-app",
+		Port:      80,
+		LocalPort: 8080,
+	}
+
+	assert.Equal(t, "fwd-123", rf.ID)
+	assert.Equal(t, "prod", rf.Context)
+	assert.Equal(t, "default", rf.Namespace)
+	assert.Equal(t, "pod/my-app", rf.Resource)
+	assert.Equal(t, "app=my-app", rf.Selector)
+	assert.Equal(t, "my-app", rf.Alias)
+	assert.Equal(t, 80, rf.Port)
+	assert.Equal(t, 8080, rf.LocalPort)
+}
+
+// TestBenchmarkProgressCallback tests the progress callback in runBenchmarkCmd
+func TestBenchmarkProgressCallback(t *testing.T) {
+	// Test that progress channel handles blocking gracefully
+	progressCh := make(chan BenchmarkProgressMsg, 1) // Small buffer
+
+	// Fill the channel
+	progressCh <- BenchmarkProgressMsg{Completed: 1, Total: 100}
+
+	// Test non-blocking send by creating callback similar to runBenchmarkCmd
+	callback := func(completed, total int) {
+		select {
+		case progressCh <- BenchmarkProgressMsg{
+			ForwardID: "test",
+			Completed: completed,
+			Total:     total,
+		}:
+		default:
+			// Drop if channel is full - should not block
+		}
+	}
+
+	// Should not block even with full channel
+	done := make(chan bool, 1)
+	go func() {
+		callback(50, 100) // This should not block
+		done <- true
+	}()
+
+	select {
+	case <-done:
+		// Success - didn't block
+	case <-time.After(100 * time.Millisecond):
+		t.Fatal("Callback blocked when channel was full")
+	}
+}
+
+// TestHTTPLogEntry tests the HTTPLogEntry structure
+func TestHTTPLogEntry(t *testing.T) {
+	entry := HTTPLogEntry{
+		Timestamp:  "2025-11-26T10:30:00Z",
+		Direction:  "request",
+		Method:     "POST",
+		Path:       "/api/users",
+		StatusCode: 201,
+		LatencyMs:  150,
+		BodySize:   1024,
+	}
+
+	assert.Equal(t, "2025-11-26T10:30:00Z", entry.Timestamp)
+	assert.Equal(t, "request", entry.Direction)
+	assert.Equal(t, "POST", entry.Method)
+	assert.Equal(t, "/api/users", entry.Path)
+	assert.Equal(t, 201, entry.StatusCode)
+	assert.Equal(t, int64(150), entry.LatencyMs)
+	assert.Equal(t, 1024, entry.BodySize)
+}
+
+// TestHTTPLogSubscriberType tests the HTTPLogSubscriber function type
+func TestHTTPLogSubscriberType(t *testing.T) {
+	// Test that our mock matches the type
+	mock := NewMockHTTPLogSubscriber()
+	var subscriber HTTPLogSubscriber = mock.GetSubscriberFunc()
+
+	// Test subscription
+	callCount := 0
+	cleanup := subscriber("fwd-123", func(entry HTTPLogEntry) {
+		callCount++
+	})
+
+	// Send an entry
+	mock.SendEntry("fwd-123", HTTPLogEntry{Method: "GET"})
+	assert.Equal(t, 1, callCount)
+
+	// Clean up
+	cleanup()
+	assert.Equal(t, 1, mock.CleanupCalls)
+}
@@ -0,0 +1,371 @@
+package ui
+
+import (
+	"fmt"
+	"sync"
+	"testing"
+
+	"github.com/nvm/kportal/internal/config"
+	"github.com/stretchr/testify/assert"
+)
+
+// TestConcurrent_AddAndRemove tests concurrent add and remove operations
+// Run with: go test -race ./internal/ui/...
+func TestConcurrent_AddAndRemove(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	var wg sync.WaitGroup
+	numGoroutines := 100
+
+	// Concurrent adds
+	for i := 0; i < numGoroutines; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			fwd := &config.Forward{
+				Resource:  fmt.Sprintf("pod/app-%d", idx),
+				Port:      8080 + idx,
+				LocalPort: 8080 + idx,
+			}
+			ui.AddForward(fmt.Sprintf("id-%d", idx), fwd)
+		}(i)
+	}
+
+	wg.Wait()
+
+	// Verify all adds succeeded
+	ui.mu.RLock()
+	assert.Len(t, ui.forwards, numGoroutines)
+	ui.mu.RUnlock()
+
+	// Concurrent removes
+	for i := 0; i < numGoroutines; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			ui.Remove(fmt.Sprintf("id-%d", idx))
+		}(i)
+	}
+
+	wg.Wait()
+
+	// Verify all removes succeeded
+	ui.mu.RLock()
+	assert.Len(t, ui.forwards, 0)
+	ui.mu.RUnlock()
+}
+
+// TestConcurrent_StatusUpdates tests concurrent status updates
+func TestConcurrent_StatusUpdates(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	// Add forwards first
+	for i := 0; i < 10; i++ {
+		fwd := &config.Forward{
+			Resource:  fmt.Sprintf("pod/app-%d", i),
+			Port:      8080 + i,
+			LocalPort: 8080 + i,
+		}
+		ui.AddForward(fmt.Sprintf("id-%d", i), fwd)
+	}
+
+	var wg sync.WaitGroup
+	numUpdates := 1000
+	statuses := []string{"Active", "Starting", "Reconnecting", "Error"}
+
+	// Concurrent status updates
+	for i := 0; i < numUpdates; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			forwardID := fmt.Sprintf("id-%d", idx%10)
+			status := statuses[idx%len(statuses)]
+			ui.UpdateStatus(forwardID, status)
+		}(i)
+	}
+
+	wg.Wait()
+
+	// Just verify no panics occurred - final state is non-deterministic
+	ui.mu.RLock()
+	assert.Len(t, ui.forwards, 10)
+	ui.mu.RUnlock()
+}
+
+// TestConcurrent_SetErrors tests concurrent error setting
+func TestConcurrent_SetErrors(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	// Add forwards
+	for i := 0; i < 10; i++ {
+		fwd := &config.Forward{
+			Resource:  fmt.Sprintf("pod/app-%d", i),
+			Port:      8080 + i,
+			LocalPort: 8080 + i,
+		}
+		ui.AddForward(fmt.Sprintf("id-%d", i), fwd)
+	}
+
+	var wg sync.WaitGroup
+	numErrors := 500
+
+	// Concurrent error setting
+	for i := 0; i < numErrors; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			forwardID := fmt.Sprintf("id-%d", idx%10)
+			ui.SetError(forwardID, fmt.Sprintf("error-%d", idx))
+		}(i)
+	}
+
+	wg.Wait()
+
+	// Verify no panics
+	ui.mu.RLock()
+	assert.NotEmpty(t, ui.errors)
+	ui.mu.RUnlock()
+}
+
+// TestConcurrent_MoveSelection tests concurrent selection movement
+func TestConcurrent_MoveSelection(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	// Add forwards
+	for i := 0; i < 20; i++ {
+		fwd := &config.Forward{
+			Resource:  fmt.Sprintf("pod/app-%d", i),
+			Port:      8080 + i,
+			LocalPort: 8080 + i,
+		}
+		ui.AddForward(fmt.Sprintf("id-%d", i), fwd)
+	}
+
+	var wg sync.WaitGroup
+	numMoves := 1000
+
+	// Concurrent moves
+	for i := 0; i < numMoves; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			delta := 1
+			if idx%2 == 0 {
+				delta = -1
+			}
+			ui.moveSelection(delta)
+		}(i)
+	}
+
+	wg.Wait()
+
+	// Verify selection is within bounds
+	ui.mu.RLock()
+	assert.GreaterOrEqual(t, ui.selectedIndex, 0)
+	assert.Less(t, ui.selectedIndex, len(ui.forwardOrder))
+	ui.mu.RUnlock()
+}
+
+// TestConcurrent_AddRemoveAndUpdate tests mixed concurrent operations
+func TestConcurrent_AddRemoveAndUpdate(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	var wg sync.WaitGroup
+
+	// Concurrent adds
+	for i := 0; i < 50; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			fwd := &config.Forward{
+				Resource:  fmt.Sprintf("pod/app-%d", idx),
+				Port:      8080 + idx,
+				LocalPort: 8080 + idx,
+			}
+			ui.AddForward(fmt.Sprintf("id-%d", idx), fwd)
+		}(i)
+	}
+
+	// Concurrent updates (some will be for non-existent forwards)
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			forwardID := fmt.Sprintf("id-%d", idx%60) // Some won't exist
+			ui.UpdateStatus(forwardID, "Active")
+		}(i)
+	}
+
+	// Concurrent removes (some will be for non-existent forwards)
+	for i := 0; i < 30; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			ui.Remove(fmt.Sprintf("id-%d", idx))
+		}(i)
+	}
+
+	wg.Wait()
+
+	// Just verify no panics - final state depends on execution order
+}
+
+// TestConcurrent_HTTPLogEntries tests concurrent HTTP log entry additions
+func TestConcurrent_HTTPLogEntries(t *testing.T) {
+	state := newHTTPLogState("fwd", "alias")
+
+	var wg sync.WaitGroup
+	var mu sync.Mutex // Simulate the UI lock for entries
+	numEntries := 1000
+
+	for i := 0; i < numEntries; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			entry := HTTPLogEntry{
+				Method:     "GET",
+				Path:       fmt.Sprintf("/api/test/%d", idx),
+				StatusCode: 200,
+			}
+			mu.Lock()
+			state.entries = append(state.entries, entry)
+			mu.Unlock()
+		}(i)
+	}
+
+	wg.Wait()
+
+	assert.Len(t, state.entries, numEntries)
+}
+
+// TestConcurrent_FilterWhileAdding tests filtering while entries are being added
+func TestConcurrent_FilterWhileAdding(t *testing.T) {
+	state := newHTTPLogState("fwd", "alias")
+	state.filterMode = HTTPLogFilterErrors
+
+	var wg sync.WaitGroup
+	var mu sync.Mutex
+
+	// Add entries concurrently
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			code := 200
+			if idx%5 == 0 {
+				code = 500
+			}
+			entry := HTTPLogEntry{
+				Method:     "GET",
+				Path:       fmt.Sprintf("/api/test/%d", idx),
+				StatusCode: code,
+			}
+			mu.Lock()
+			state.entries = append(state.entries, entry)
+			mu.Unlock()
+		}(i)
+	}
+
+	// Filter concurrently
+	for i := 0; i < 50; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			mu.Lock()
+			_ = state.getFilteredEntries()
+			mu.Unlock()
+		}()
+	}
+
+	wg.Wait()
+
+	// Verify filtering still works
+	mu.Lock()
+	filtered := state.getFilteredEntries()
+	mu.Unlock()
+
+	assert.Len(t, state.entries, 100)
+	assert.Len(t, filtered, 20) // 20% are errors
+}
+
+// TestConcurrent_ToggleCallback tests that toggle callback is called safely
+func TestConcurrent_ToggleCallback(t *testing.T) {
+	var mu sync.Mutex
+	callCount := 0
+
+	callback := func(id string, enable bool) {
+		mu.Lock()
+		callCount++
+		mu.Unlock()
+	}
+
+	ui := NewBubbleTeaUI(callback, "1.0.0")
+
+	// Add a forward
+	fwd := &config.Forward{
+		Resource:  "pod/app",
+		Port:      8080,
+		LocalPort: 8080,
+	}
+	ui.AddForward("test-id", fwd)
+
+	var wg sync.WaitGroup
+
+	// Toggle many times concurrently
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			ui.toggleSelected()
+		}()
+	}
+
+	wg.Wait()
+
+	// Give callbacks time to complete (they run in goroutines)
+	// This is a basic check - in real code you'd use proper synchronization
+}
+
+// TestConcurrent_WizardDependencies tests setting dependencies concurrently
+func TestConcurrent_WizardDependencies(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	var wg sync.WaitGroup
+
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			ui.SetWizardDependencies(nil, nil, fmt.Sprintf("/path/%d", idx))
+		}(i)
+	}
+
+	wg.Wait()
+
+	// Just verify no panics
+	ui.mu.RLock()
+	assert.NotEmpty(t, ui.configPath)
+	ui.mu.RUnlock()
+}
+
+// TestConcurrent_SetUpdateAvailable tests concurrent update availability setting
+func TestConcurrent_SetUpdateAvailable(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	var wg sync.WaitGroup
+
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func(idx int) {
+			defer wg.Done()
+			ui.SetUpdateAvailable(fmt.Sprintf("2.0.%d", idx), "https://example.com")
+		}(i)
+	}
+
+	wg.Wait()
+
+	// Verify update is available
+	ui.mu.RLock()
+	assert.True(t, ui.updateAvailable)
+	ui.mu.RUnlock()
+}
@@ -0,0 +1,45 @@
+package ui
+
+// Terminal dimension constants
+const (
+	// DefaultTermWidth is the fallback terminal width when not detected
+	DefaultTermWidth = 120
+
+	// DefaultTermHeight is the fallback terminal height when not detected
+	DefaultTermHeight = 40
+)
+
+// Table column constants
+const (
+	// Column indices in the forwards table
+	ColumnContext   = 0
+	ColumnNamespace = 1
+	ColumnAlias     = 2
+	ColumnType      = 3
+	ColumnResource  = 4
+	ColumnRemote    = 5
+	ColumnLocal     = 6
+	ColumnStatus    = 7
+
+	// Column widths for truncation
+	ColumnWidthContext   = 14
+	ColumnWidthNamespace = 16
+	ColumnWidthAlias     = 18
+	ColumnWidthType      = 8
+	ColumnWidthResource  = 20
+
+	// Error display widths
+	ErrorDisplayWidth = 118 // Slightly less than table width (120) for padding
+)
+
+// Viewport constants
+const (
+	// ViewportHeight is the number of items visible in list views
+	ViewportHeight = 20
+)
+
+// Path display constants
+const (
+	// MaxPathWidth is the maximum width for displaying file paths
+	MaxPathWidth = 48
+)
@@ -0,0 +1,902 @@
+package ui
+
+import (
+	"errors"
+	"testing"
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/nvm/kportal/internal/config"
+	"github.com/nvm/kportal/internal/k8s"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Helper to create a model for testing
+func newTestModel() model {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	return model{ui: ui, termWidth: 120, termHeight: 40}
+}
+
+// Helper to create a model with a forward
+func newTestModelWithForward() model {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	fwd := &config.Forward{
+		Resource:  "pod/my-app",
+		Port:      8080,
+		LocalPort: 8080,
+		Alias:     "my-app",
+	}
+	ui.AddForward("test-id", fwd)
+	return model{ui: ui, termWidth: 120, termHeight: 40}
+}
+
+// TestHandleMainViewKeys_Quit tests quit key handling
+func TestHandleMainViewKeys_Quit(t *testing.T) {
+	tests := []struct {
+		key      string
+		expected bool
+	}{
+		{"q", true},
+		{"ctrl+c", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.key, func(t *testing.T) {
+			m := newTestModel()
+			_, cmd := m.handleMainViewKeys(tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune(tt.key)})
+
+			if tt.key == "ctrl+c" {
+				keyMsg := tea.KeyMsg{Type: tea.KeyCtrlC}
+				_, cmd = m.handleMainViewKeys(keyMsg)
+			}
+
+			// tea.Quit returns a special command
+			if tt.expected {
+				assert.NotNil(t, cmd)
+			}
+		})
+	}
+}
+
+// TestHandleMainViewKeys_Navigation tests cursor navigation
+func TestHandleMainViewKeys_Navigation(t *testing.T) {
+	m := newTestModelWithForward()
+
+	// Add more forwards for navigation testing
+	for i := 0; i < 5; i++ {
+		fwd := &config.Forward{
+			Resource:  "pod/app",
+			Port:      8080 + i,
+			LocalPort: 8080 + i,
+		}
+		m.ui.AddForward(string(rune('a'+i)), fwd)
+	}
+
+	tests := []struct {
+		name          string
+		key           string
+		keyType       tea.KeyType
+		initialIndex  int
+		expectedIndex int
+	}{
+		{"down arrow", "down", tea.KeyDown, 0, 1},
+		{"j key", "j", tea.KeyRunes, 0, 1},
+		{"up arrow", "up", tea.KeyUp, 2, 1},
+		{"k key", "k", tea.KeyRunes, 2, 1},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			m.ui.mu.Lock()
+			m.ui.selectedIndex = tt.initialIndex
+			m.ui.mu.Unlock()
+
+			var keyMsg tea.KeyMsg
+			if tt.keyType == tea.KeyRunes {
+				keyMsg = tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune(tt.key)}
+			} else {
+				keyMsg = tea.KeyMsg{Type: tt.keyType}
+			}
+
+			m.handleMainViewKeys(keyMsg)
+
+			m.ui.mu.RLock()
+			assert.Equal(t, tt.expectedIndex, m.ui.selectedIndex)
+			m.ui.mu.RUnlock()
+		})
+	}
+}
+
+// TestHandleMainViewKeys_Toggle tests space/enter toggle
+func TestHandleMainViewKeys_Toggle(t *testing.T) {
+	toggleCallback := NewMockToggleCallback()
+	ui := NewBubbleTeaUI(toggleCallback.GetFunc(), "1.0.0")
+
+	fwd := &config.Forward{
+		Resource:  "pod/my-app",
+		Port:      8080,
+		LocalPort: 8080,
+	}
+	ui.AddForward("test-id", fwd)
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	// Toggle with space
+	keyMsg := tea.KeyMsg{Type: tea.KeySpace}
+	m.handleMainViewKeys(keyMsg)
+
+	// Check disabled state changed
+	m.ui.mu.RLock()
+	isDisabled := m.ui.disabledMap["test-id"]
+	m.ui.mu.RUnlock()
+
+	assert.True(t, isDisabled)
+
+	// Give callback goroutine time to execute
+	time.Sleep(10 * time.Millisecond)
+
+	// Verify callback was called
+	assert.GreaterOrEqual(t, toggleCallback.CallCount(), 1)
+}
+
+// TestHandleMainViewKeys_NewWizard tests 'n' key with dependencies
+func TestHandleMainViewKeys_NewWizard(t *testing.T) {
+	mockDiscovery := NewMockDiscovery()
+	mockMutator := NewMockMutator()
+
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.SetWizardDependencies(nil, nil, "/path/to/config") // Real Discovery/Mutator needed
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	// Without dependencies, 'n' should do nothing
+	keyMsg := tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune("n")}
+	m.handleMainViewKeys(keyMsg)
+
+	m.ui.mu.RLock()
+	assert.Nil(t, m.ui.addWizard, "Wizard should not be created without dependencies")
+	m.ui.mu.RUnlock()
+
+	// With mock (but we can't inject easily due to concrete types)
+	// This test documents the expected behavior
+	_ = mockDiscovery
+	_ = mockMutator
+}
+
+// TestHandleMainViewKeys_DeleteConfirmation tests 'd' key
+func TestHandleMainViewKeys_DeleteConfirmation(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.SetWizardDependencies(nil, &config.Mutator{}, "/path/to/config")
+
+	fwd := &config.Forward{
+		Resource:  "pod/my-app",
+		Port:      8080,
+		LocalPort: 8080,
+		Alias:     "my-app",
+	}
+	ui.AddForward("test-id", fwd)
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	// Press 'd' to show delete confirmation
+	keyMsg := tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune("d")}
+	m.handleMainViewKeys(keyMsg)
+
+	m.ui.mu.RLock()
+	assert.True(t, m.ui.deleteConfirming)
+	assert.Equal(t, "test-id", m.ui.deleteConfirmID)
+	assert.Equal(t, "my-app", m.ui.deleteConfirmAlias)
+	assert.Equal(t, 1, m.ui.deleteConfirmCursor) // Default to "No"
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleMainViewKeys_DeleteConfirmation_PreventsDuplicate tests that 'd' doesn't overwrite
+func TestHandleMainViewKeys_DeleteConfirmation_PreventsDuplicate(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.SetWizardDependencies(nil, &config.Mutator{}, "/path/to/config")
+
+	fwd1 := &config.Forward{Resource: "pod/app1", Port: 8080, LocalPort: 8080, Alias: "app1"}
+	fwd2 := &config.Forward{Resource: "pod/app2", Port: 8081, LocalPort: 8081, Alias: "app2"}
+	ui.AddForward("id-1", fwd1)
+	ui.AddForward("id-2", fwd2)
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	// Press 'd' for first forward
+	keyMsg := tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune("d")}
+	m.handleMainViewKeys(keyMsg)
+
+	// Change selection
+	m.ui.mu.Lock()
+	m.ui.selectedIndex = 1
+	m.ui.mu.Unlock()
+
+	// Press 'd' again - should not change confirmation
+	m.handleMainViewKeys(keyMsg)
+
+	m.ui.mu.RLock()
+	assert.Equal(t, "id-1", m.ui.deleteConfirmID, "Delete confirmation should not be overwritten")
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleDeleteConfirmation_Cancel tests Esc cancels delete
+func TestHandleDeleteConfirmation_Cancel(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	// Set up delete confirmation
+	ui.mu.Lock()
+	ui.deleteConfirming = true
+	ui.deleteConfirmID = "test-id"
+	ui.deleteConfirmAlias = "test-alias"
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	// Press Esc
+	keyMsg := tea.KeyMsg{Type: tea.KeyEsc}
+	m.handleDeleteConfirmation(keyMsg)
+
+	m.ui.mu.RLock()
+	assert.False(t, m.ui.deleteConfirming)
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleDeleteConfirmation_NavigateAndConfirm tests cursor navigation in delete dialog
+func TestHandleDeleteConfirmation_NavigateAndConfirm(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	// Note: We use SetWizardDependencies with a real (nil) mutator since
+	// the navigation test doesn't actually call mutator methods
+	ui.SetWizardDependencies(nil, nil, "/path/to/config")
+	ui.mu.Lock()
+	ui.deleteConfirming = true
+	ui.deleteConfirmID = "test-id"
+	ui.deleteConfirmCursor = 1 // Start on "No"
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	// Navigate left to "Yes"
+	keyMsg := tea.KeyMsg{Type: tea.KeyLeft}
+	m.handleDeleteConfirmation(keyMsg)
+
+	m.ui.mu.RLock()
+	assert.Equal(t, 0, m.ui.deleteConfirmCursor)
+	m.ui.mu.RUnlock()
+
+	// Navigate right back to "No"
+	keyMsg = tea.KeyMsg{Type: tea.KeyRight}
+	m.handleDeleteConfirmation(keyMsg)
+
+	m.ui.mu.RLock()
+	assert.Equal(t, 1, m.ui.deleteConfirmCursor)
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleDeleteConfirmation_ConfirmYes tests confirming deletion
+func TestHandleDeleteConfirmation_ConfirmYes(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	// Note: The mutator needs to be set for the command to be generated,
+	// but we don't call the actual mutator method in this test (just generate the cmd)
+	ui.SetWizardDependencies(nil, &config.Mutator{}, "/path/to/config")
+	ui.mu.Lock()
+	ui.deleteConfirming = true
+	ui.deleteConfirmID = "test-id"
+	ui.deleteConfirmCursor = 0 // On "Yes"
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	// Press Enter on "Yes"
+	keyMsg := tea.KeyMsg{Type: tea.KeyEnter}
+	_, cmd := m.handleDeleteConfirmation(keyMsg)
+
+	// Should return a command to remove the forward
+	assert.NotNil(t, cmd)
+
+	// Dialog should be closed
+	m.ui.mu.RLock()
+	assert.False(t, m.ui.deleteConfirming)
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleDeleteConfirmation_QuickYKey tests 'y' key for quick confirm
+func TestHandleDeleteConfirmation_QuickYKey(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	// Set up with a real mutator (empty but valid) since we're testing command generation
+	ui.SetWizardDependencies(nil, &config.Mutator{}, "/path/to/config")
+	ui.mu.Lock()
+	ui.deleteConfirming = true
+	ui.deleteConfirmID = "test-id"
+	ui.deleteConfirmCursor = 1 // On "No"
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	// Press 'y' - should confirm regardless of cursor position
+	keyMsg := tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune("y")}
+	_, cmd := m.handleDeleteConfirmation(keyMsg)
+
+	assert.NotNil(t, cmd)
+
+	m.ui.mu.RLock()
+	assert.False(t, m.ui.deleteConfirming)
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleDeleteConfirmation_QuickNKey tests 'n' key for quick cancel
+func TestHandleDeleteConfirmation_QuickNKey(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.mu.Lock()
+	ui.deleteConfirming = true
+	ui.deleteConfirmID = "test-id"
+	ui.deleteConfirmCursor = 0 // On "Yes"
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	// Press 'n' - should cancel regardless of cursor position
+	keyMsg := tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune("n")}
+	m.handleDeleteConfirmation(keyMsg)
+
+	m.ui.mu.RLock()
+	assert.False(t, m.ui.deleteConfirming)
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleBenchmarkKeys_Cancel tests benchmark cancellation
+func TestHandleBenchmarkKeys_Cancel(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	cancelled := false
+	ui.mu.Lock()
+	ui.viewMode = ViewModeBenchmark
+	ui.benchmarkState = newBenchmarkState("fwd-id", "alias", 8080)
+	ui.benchmarkState.cancelFunc = func() { cancelled = true }
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	// Press Esc
+	keyMsg := tea.KeyMsg{Type: tea.KeyEsc}
+	m.handleBenchmarkKeys(keyMsg)
+
+	assert.True(t, cancelled, "Cancel function should be called")
+
+	m.ui.mu.RLock()
+	assert.Nil(t, m.ui.benchmarkState)
+	assert.Equal(t, ViewModeMain, m.ui.viewMode)
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleBenchmarkKeys_Navigation tests benchmark config navigation
+func TestHandleBenchmarkKeys_Navigation(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.mu.Lock()
+	ui.viewMode = ViewModeBenchmark
+	ui.benchmarkState = newBenchmarkState("fwd-id", "alias", 8080)
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	// Initial cursor is 0
+	m.ui.mu.RLock()
+	assert.Equal(t, 0, m.ui.benchmarkState.cursor)
+	m.ui.mu.RUnlock()
+
+	// Move down
+	keyMsg := tea.KeyMsg{Type: tea.KeyDown}
+	m.handleBenchmarkKeys(keyMsg)
+
+	m.ui.mu.RLock()
+	assert.Equal(t, 1, m.ui.benchmarkState.cursor)
+	m.ui.mu.RUnlock()
+
+	// Move down again
+	m.handleBenchmarkKeys(keyMsg)
+
+	m.ui.mu.RLock()
+	assert.Equal(t, 2, m.ui.benchmarkState.cursor)
+	m.ui.mu.RUnlock()
+
+	// Move up
+	keyMsg = tea.KeyMsg{Type: tea.KeyUp}
+	m.handleBenchmarkKeys(keyMsg)
+
+	m.ui.mu.RLock()
+	assert.Equal(t, 1, m.ui.benchmarkState.cursor)
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleHTTPLogKeys_Close tests HTTP log view closing
+func TestHandleHTTPLogKeys_Close(t *testing.T) {
+	mockSubscriber := NewMockHTTPLogSubscriber()
+
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.mu.Lock()
+	ui.viewMode = ViewModeHTTPLog
+	ui.httpLogState = newHTTPLogState("fwd-id", "alias")
+	ui.httpLogCleanup = mockSubscriber.Subscribe("fwd-id", func(entry HTTPLogEntry) {})
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	// Press Esc
+	keyMsg := tea.KeyMsg{Type: tea.KeyEsc}
+	m.handleHTTPLogKeys(keyMsg)
+
+	m.ui.mu.RLock()
+	assert.Nil(t, m.ui.httpLogState)
+	assert.Nil(t, m.ui.httpLogCleanup)
+	assert.Equal(t, ViewModeMain, m.ui.viewMode)
+	m.ui.mu.RUnlock()
+
+	// Verify cleanup was called
+	assert.Equal(t, 1, mockSubscriber.CleanupCalls)
+}
+
+// TestHandleHTTPLogKeys_FilterCycle tests filter mode cycling
+func TestHandleHTTPLogKeys_FilterCycle(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.mu.Lock()
+	ui.viewMode = ViewModeHTTPLog
+	ui.httpLogState = newHTTPLogState("fwd-id", "alias")
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	// Initial mode is None
+	m.ui.mu.RLock()
+	assert.Equal(t, HTTPLogFilterNone, m.ui.httpLogState.filterMode)
+	m.ui.mu.RUnlock()
+
+	// Press 'f' to cycle - should skip Text mode and go to Non200
+	keyMsg := tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune("f")}
+	m.handleHTTPLogKeys(keyMsg)
+
+	m.ui.mu.RLock()
+	assert.Equal(t, HTTPLogFilterNon200, m.ui.httpLogState.filterMode)
+	m.ui.mu.RUnlock()
+
+	// Press 'f' again - should go to Errors
+	m.handleHTTPLogKeys(keyMsg)
+
+	m.ui.mu.RLock()
+	assert.Equal(t, HTTPLogFilterErrors, m.ui.httpLogState.filterMode)
+	m.ui.mu.RUnlock()
+
+	// Press 'f' again - should go back to None
+	m.handleHTTPLogKeys(keyMsg)
+
+	m.ui.mu.RLock()
+	assert.Equal(t, HTTPLogFilterNone, m.ui.httpLogState.filterMode)
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleHTTPLogKeys_TextFilter tests '/' for text filter
+func TestHandleHTTPLogKeys_TextFilter(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.mu.Lock()
+	ui.viewMode = ViewModeHTTPLog
+	ui.httpLogState = newHTTPLogState("fwd-id", "alias")
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	// Press '/'
+	keyMsg := tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune("/")}
+	m.handleHTTPLogKeys(keyMsg)
+
+	m.ui.mu.RLock()
+	assert.True(t, m.ui.httpLogState.filterActive)
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleHTTPLogKeys_ClearFilters tests 'c' to clear filters
+func TestHandleHTTPLogKeys_ClearFilters(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.mu.Lock()
+	ui.viewMode = ViewModeHTTPLog
+	ui.httpLogState = newHTTPLogState("fwd-id", "alias")
+	ui.httpLogState.filterMode = HTTPLogFilterErrors
+	ui.httpLogState.filterText = "api"
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	// Press 'c'
+	keyMsg := tea.KeyMsg{Type: tea.KeyRunes, Runes: []rune("c")}
+	m.handleHTTPLogKeys(keyMsg)
+
+	m.ui.mu.RLock()
+	assert.Equal(t, HTTPLogFilterNone, m.ui.httpLogState.filterMode)
+	assert.Empty(t, m.ui.httpLogState.filterText)
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleHTTPLogEntry tests HTTP log entry handling
+func TestHandleHTTPLogEntry(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.mu.Lock()
+	ui.viewMode = ViewModeHTTPLog
+	ui.httpLogState = newHTTPLogState("fwd-id", "alias")
+	ui.httpLogState.autoScroll = true
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	// Send an entry
+	msg := HTTPLogEntryMsg{
+		Entry: HTTPLogEntry{
+			Method:     "GET",
+			Path:       "/api/test",
+			StatusCode: 200,
+		},
+	}
+	m.handleHTTPLogEntry(msg)
+
+	m.ui.mu.RLock()
+	assert.Len(t, m.ui.httpLogState.entries, 1)
+	assert.Equal(t, "/api/test", m.ui.httpLogState.entries[0].Path)
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleContextsLoaded tests context loading handler
+func TestHandleContextsLoaded(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.mu.Lock()
+	ui.viewMode = ViewModeAddWizard
+	ui.addWizard = newAddWizardState()
+	ui.addWizard.loading = true
+	// Note: discovery is nil but the handler doesn't use it directly,
+	// it uses the message data instead. The current context reordering
+	// uses GetCurrentContext() which would fail with nil discovery,
+	// but we test the basic loading behavior here.
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	// Simulate contexts loaded
+	msg := ContextsLoadedMsg{
+		contexts: []string{"default", "production", "staging"},
+	}
+	m.handleContextsLoaded(msg)
+
+	m.ui.mu.RLock()
+	assert.False(t, m.ui.addWizard.loading)
+	// Contexts should be loaded (order depends on GetCurrentContext which may fail with nil discovery)
+	assert.Contains(t, m.ui.addWizard.contexts, "default")
+	assert.Contains(t, m.ui.addWizard.contexts, "production")
+	assert.Contains(t, m.ui.addWizard.contexts, "staging")
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleContextsLoaded_Error tests error handling
+func TestHandleContextsLoaded_Error(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.mu.Lock()
+	ui.viewMode = ViewModeAddWizard
+	ui.addWizard = newAddWizardState()
+	ui.addWizard.loading = true
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	// Simulate error
+	expectedErr := errors.New("failed to list contexts")
+	msg := ContextsLoadedMsg{
+		err: expectedErr,
+	}
+	m.handleContextsLoaded(msg)
+
+	m.ui.mu.RLock()
+	assert.False(t, m.ui.addWizard.loading)
+	assert.Equal(t, expectedErr, m.ui.addWizard.error)
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleNamespacesLoaded tests namespace loading handler
+func TestHandleNamespacesLoaded(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.mu.Lock()
+	ui.viewMode = ViewModeAddWizard
+	ui.addWizard = newAddWizardState()
+	ui.addWizard.loading = true
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	msg := NamespacesLoadedMsg{
+		namespaces: []string{"default", "kube-system", "production"},
+	}
+	m.handleNamespacesLoaded(msg)
+
+	m.ui.mu.RLock()
+	assert.False(t, m.ui.addWizard.loading)
+	assert.Equal(t, []string{"default", "kube-system", "production"}, m.ui.addWizard.namespaces)
+	m.ui.mu.RUnlock()
+}
+
+// TestHandlePodsLoaded tests pod loading handler
+func TestHandlePodsLoaded(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.mu.Lock()
+	ui.viewMode = ViewModeAddWizard
+	ui.addWizard = newAddWizardState()
+	ui.addWizard.loading = true
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	pods := []k8s.PodInfo{
+		{Name: "app-1", Namespace: "default"},
+		{Name: "app-2", Namespace: "default"},
+	}
+	msg := PodsLoadedMsg{pods: pods}
+	m.handlePodsLoaded(msg)
+
+	m.ui.mu.RLock()
+	assert.False(t, m.ui.addWizard.loading)
+	assert.Len(t, m.ui.addWizard.pods, 2)
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleServicesLoaded tests service loading handler
+func TestHandleServicesLoaded(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.mu.Lock()
+	ui.viewMode = ViewModeAddWizard
+	ui.addWizard = newAddWizardState()
+	ui.addWizard.loading = true
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	services := []k8s.ServiceInfo{
+		{Name: "api", Namespace: "default", Ports: []k8s.PortInfo{{Port: 80}}},
+		{Name: "db", Namespace: "default", Ports: []k8s.PortInfo{{Port: 5432}}},
+	}
+	msg := ServicesLoadedMsg{services: services}
+	m.handleServicesLoaded(msg)
+
+	m.ui.mu.RLock()
+	assert.False(t, m.ui.addWizard.loading)
+	assert.Len(t, m.ui.addWizard.services, 2)
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleSelectorValidated tests selector validation handler
+func TestHandleSelectorValidated(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.mu.Lock()
+	ui.viewMode = ViewModeAddWizard
+	ui.addWizard = newAddWizardState()
+	ui.addWizard.loading = true
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	pods := []k8s.PodInfo{
+		{Name: "app-1", Namespace: "default"},
+	}
+	msg := SelectorValidatedMsg{
+		valid: true,
+		pods:  pods,
+	}
+	m.handleSelectorValidated(msg)
+
+	m.ui.mu.RLock()
+	assert.False(t, m.ui.addWizard.loading)
+	assert.Len(t, m.ui.addWizard.matchingPods, 1)
+	m.ui.mu.RUnlock()
+}
+
+// TestHandlePortChecked tests port availability check handler
+func TestHandlePortChecked(t *testing.T) {
+	tests := []struct {
+		name        string
+		expectStep  AddWizardStep
+		available   bool
+		expectError bool
+	}{
+		{name: "port available", available: true, expectStep: StepConfirmation, expectError: false},
+		{name: "port in use", available: false, expectStep: StepEnterLocalPort, expectError: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ui := NewBubbleTeaUI(nil, "1.0.0")
+			ui.mu.Lock()
+			ui.viewMode = ViewModeAddWizard
+			ui.addWizard = newAddWizardState()
+			ui.addWizard.step = StepEnterLocalPort
+			ui.addWizard.loading = true
+			ui.addWizard.localPort = 8080
+			ui.mu.Unlock()
+
+			m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+			msg := PortCheckedMsg{
+				port:      8080,
+				available: tt.available,
+				message:   "test message",
+			}
+			m.handlePortChecked(msg)
+
+			m.ui.mu.RLock()
+			assert.False(t, m.ui.addWizard.loading)
+			assert.Equal(t, tt.available, m.ui.addWizard.portAvailable)
+			if tt.expectError {
+				assert.NotNil(t, m.ui.addWizard.error)
+			} else {
+				assert.Equal(t, tt.expectStep, m.ui.addWizard.step)
+			}
+			m.ui.mu.RUnlock()
+		})
+	}
+}
+
+// TestHandleForwardSaved tests forward save handler
+func TestHandleForwardSaved(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.mu.Lock()
+	ui.viewMode = ViewModeAddWizard
+	ui.addWizard = newAddWizardState()
+	ui.addWizard.step = StepConfirmation
+	ui.addWizard.loading = true
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	msg := ForwardSavedMsg{success: true}
+	m.handleForwardSaved(msg)
+
+	m.ui.mu.RLock()
+	assert.False(t, m.ui.addWizard.loading)
+	assert.Equal(t, StepSuccess, m.ui.addWizard.step)
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleForwardsRemoved tests forward removal handler
+func TestHandleForwardsRemoved(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.mu.Lock()
+	ui.viewMode = ViewModeRemoveWizard
+	ui.removeWizard = &RemoveWizardState{}
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	msg := ForwardsRemovedMsg{success: true, count: 2}
+	m.handleForwardsRemoved(msg)
+
+	m.ui.mu.RLock()
+	assert.Nil(t, m.ui.removeWizard)
+	assert.Equal(t, ViewModeMain, m.ui.viewMode)
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleBenchmarkProgress tests benchmark progress handler
+func TestHandleBenchmarkProgress(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.mu.Lock()
+	ui.viewMode = ViewModeBenchmark
+	ui.benchmarkState = newBenchmarkState("fwd-id", "alias", 8080)
+	ui.benchmarkState.running = true
+	ui.benchmarkState.progressCh = make(chan BenchmarkProgressMsg, 1)
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	msg := BenchmarkProgressMsg{
+		ForwardID: "fwd-id",
+		Completed: 50,
+		Total:     100,
+	}
+	m.handleBenchmarkProgress(msg)
+
+	m.ui.mu.RLock()
+	assert.Equal(t, 50, m.ui.benchmarkState.progress)
+	assert.Equal(t, 100, m.ui.benchmarkState.total)
+	m.ui.mu.RUnlock()
+}
+
+// TestHandleBenchmarkComplete tests benchmark completion handler
+func TestHandleBenchmarkComplete(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.mu.Lock()
+	ui.viewMode = ViewModeBenchmark
+	ui.benchmarkState = newBenchmarkState("fwd-id", "alias", 8080)
+	ui.benchmarkState.running = true
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	// Note: This test documents expected behavior
+	// The actual BenchmarkCompleteMsg requires benchmark.Results which has CalculateStats
+	msg := BenchmarkCompleteMsg{
+		ForwardID: "fwd-id",
+		Error:     errors.New("test error"),
+	}
+	m.handleBenchmarkComplete(msg)
+
+	m.ui.mu.RLock()
+	assert.False(t, m.ui.benchmarkState.running)
+	assert.Equal(t, BenchmarkStepResults, m.ui.benchmarkState.step)
+	assert.NotNil(t, m.ui.benchmarkState.error)
+	m.ui.mu.RUnlock()
+}
+
+// TestModel_Update_MessageRouting tests message routing in Update
+func TestModel_Update_MessageRouting(t *testing.T) {
+	m := newTestModelWithForward()
+
+	// Test window size message
+	sizeMsg := tea.WindowSizeMsg{Width: 100, Height: 50}
+	newModel, _ := m.Update(sizeMsg)
+	updatedModel := newModel.(model)
+	assert.Equal(t, 100, updatedModel.termWidth)
+	assert.Equal(t, 50, updatedModel.termHeight)
+}
+
+// TestModel_Update_ViewModeRouting tests that key messages are routed based on view mode
+func TestModel_Update_ViewModeRouting(t *testing.T) {
+	tests := []struct {
+		name     string
+		viewMode ViewMode
+	}{
+		{"main view", ViewModeMain},
+		{"add wizard", ViewModeAddWizard},
+		{"benchmark", ViewModeBenchmark},
+		{"http log", ViewModeHTTPLog},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ui := NewBubbleTeaUI(nil, "1.0.0")
+			ui.mu.Lock()
+			ui.viewMode = tt.viewMode
+			if tt.viewMode == ViewModeAddWizard {
+				ui.addWizard = newAddWizardState()
+			} else if tt.viewMode == ViewModeBenchmark {
+				ui.benchmarkState = newBenchmarkState("id", "alias", 8080)
+			} else if tt.viewMode == ViewModeHTTPLog {
+				ui.httpLogState = newHTTPLogState("id", "alias")
+			}
+			ui.mu.Unlock()
+
+			m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+			// Send a key message - should not panic
+			keyMsg := tea.KeyMsg{Type: tea.KeyEsc}
+			_, _ = m.Update(keyMsg)
+		})
+	}
+}
+
+// TestWizardCompleteMsg tests wizard completion message handling
+func TestWizardCompleteMsg(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+	ui.mu.Lock()
+	ui.viewMode = ViewModeAddWizard
+	ui.addWizard = newAddWizardState()
+	ui.mu.Unlock()
+
+	m := model{ui: ui, termWidth: 120, termHeight: 40}
+
+	msg := WizardCompleteMsg{}
+	newModel, _ := m.Update(msg)
+	updatedModel := newModel.(model)
+
+	updatedModel.ui.mu.RLock()
+	assert.Equal(t, ViewModeMain, updatedModel.ui.viewMode)
+	assert.Nil(t, updatedModel.ui.addWizard)
+	updatedModel.ui.mu.RUnlock()
+}
+
+// Helper to check that model implements tea.Model
+func TestModel_ImplementsTeaModel(t *testing.T) {
+	m := newTestModel()
+	var _ tea.Model = m
+	require.NotNil(t, m)
+}
@@ -0,0 +1,229 @@
+package ui
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestNewHTTPLogState tests the constructor
+func TestNewHTTPLogState(t *testing.T) {
+	state := newHTTPLogState("forward-123", "my-service")
+
+	assert.Equal(t, "forward-123", state.forwardID)
+	assert.Equal(t, "my-service", state.forwardAlias)
+	assert.NotNil(t, state.entries)
+	assert.Empty(t, state.entries)
+	assert.True(t, state.autoScroll)
+	assert.Equal(t, HTTPLogFilterNone, state.filterMode)
+	assert.Empty(t, state.filterText)
+	assert.False(t, state.filterActive)
+}
+
+// TestHTTPLogState_GetFilteredEntries_NoFilter tests filtering with no filter
+func TestHTTPLogState_GetFilteredEntries_NoFilter(t *testing.T) {
+	state := newHTTPLogState("fwd", "alias")
+	state.entries = []HTTPLogEntry{
+		{Method: "GET", Path: "/api/users", StatusCode: 200},
+		{Method: "POST", Path: "/api/orders", StatusCode: 201},
+		{Method: "GET", Path: "/health", StatusCode: 200},
+	}
+
+	filtered := state.getFilteredEntries()
+
+	assert.Len(t, filtered, 3)
+}
+
+// TestHTTPLogState_GetFilteredEntries_FiltersZeroStatusCode tests that entries without status codes are filtered
+func TestHTTPLogState_GetFilteredEntries_FiltersZeroStatusCode(t *testing.T) {
+	state := newHTTPLogState("fwd", "alias")
+	state.entries = []HTTPLogEntry{
+		{Method: "GET", Path: "/api/users", StatusCode: 200},
+		{Method: "GET", Path: "/streaming", StatusCode: 0}, // No status (in-progress or error)
+		{Method: "POST", Path: "/api/orders", StatusCode: 201},
+	}
+
+	filtered := state.getFilteredEntries()
+
+	assert.Len(t, filtered, 2)
+	assert.Equal(t, "/api/users", filtered[0].Path)
+	assert.Equal(t, "/api/orders", filtered[1].Path)
+}
+
+// TestHTTPLogState_GetFilteredEntries_Non200Filter tests non-2xx filter
+func TestHTTPLogState_GetFilteredEntries_Non200Filter(t *testing.T) {
+	state := newHTTPLogState("fwd", "alias")
+	state.filterMode = HTTPLogFilterNon200
+	state.entries = []HTTPLogEntry{
+		{Method: "GET", Path: "/api/users", StatusCode: 200},
+		{Method: "GET", Path: "/api/error", StatusCode: 500},
+		{Method: "POST", Path: "/api/orders", StatusCode: 201},
+		{Method: "GET", Path: "/api/notfound", StatusCode: 404},
+		{Method: "PUT", Path: "/api/redirect", StatusCode: 301},
+	}
+
+	filtered := state.getFilteredEntries()
+
+	assert.Len(t, filtered, 3)
+	assert.Equal(t, 500, filtered[0].StatusCode)
+	assert.Equal(t, 404, filtered[1].StatusCode)
+	assert.Equal(t, 301, filtered[2].StatusCode)
+}
+
+// TestHTTPLogState_GetFilteredEntries_ErrorsFilter tests 4xx/5xx filter
+func TestHTTPLogState_GetFilteredEntries_ErrorsFilter(t *testing.T) {
+	state := newHTTPLogState("fwd", "alias")
+	state.filterMode = HTTPLogFilterErrors
+	state.entries = []HTTPLogEntry{
+		{Method: "GET", Path: "/api/users", StatusCode: 200},
+		{Method: "GET", Path: "/api/error", StatusCode: 500},
+		{Method: "POST", Path: "/api/orders", StatusCode: 201},
+		{Method: "GET", Path: "/api/notfound", StatusCode: 404},
+		{Method: "PUT", Path: "/api/redirect", StatusCode: 301},
+		{Method: "GET", Path: "/api/bad", StatusCode: 400},
+	}
+
+	filtered := state.getFilteredEntries()
+
+	assert.Len(t, filtered, 3)
+	assert.Equal(t, 500, filtered[0].StatusCode)
+	assert.Equal(t, 404, filtered[1].StatusCode)
+	assert.Equal(t, 400, filtered[2].StatusCode)
+}
+
+// TestHTTPLogState_GetFilteredEntries_TextFilter tests text filtering
+func TestHTTPLogState_GetFilteredEntries_TextFilter(t *testing.T) {
+	state := newHTTPLogState("fwd", "alias")
+	state.filterText = "users"
+	state.entries = []HTTPLogEntry{
+		{Method: "GET", Path: "/api/users", StatusCode: 200},
+		{Method: "GET", Path: "/api/users/123", StatusCode: 200},
+		{Method: "POST", Path: "/api/orders", StatusCode: 201},
+		{Method: "GET", Path: "/health", StatusCode: 200},
+	}
+
+	filtered := state.getFilteredEntries()
+
+	assert.Len(t, filtered, 2)
+	assert.Equal(t, "/api/users", filtered[0].Path)
+	assert.Equal(t, "/api/users/123", filtered[1].Path)
+}
+
+// TestHTTPLogState_GetFilteredEntries_TextFilterCaseInsensitive tests case-insensitive text filtering
+func TestHTTPLogState_GetFilteredEntries_TextFilterCaseInsensitive(t *testing.T) {
+	state := newHTTPLogState("fwd", "alias")
+	state.filterText = "API"
+	state.entries = []HTTPLogEntry{
+		{Method: "GET", Path: "/api/users", StatusCode: 200},
+		{Method: "GET", Path: "/Api/Orders", StatusCode: 200},
+		{Method: "GET", Path: "/health", StatusCode: 200},
+	}
+
+	filtered := state.getFilteredEntries()
+
+	assert.Len(t, filtered, 2)
+}
+
+// TestHTTPLogState_GetFilteredEntries_TextFilterByMethod tests filtering by HTTP method
+func TestHTTPLogState_GetFilteredEntries_TextFilterByMethod(t *testing.T) {
+	state := newHTTPLogState("fwd", "alias")
+	state.filterText = "POST"
+	state.entries = []HTTPLogEntry{
+		{Method: "GET", Path: "/api/users", StatusCode: 200},
+		{Method: "POST", Path: "/api/orders", StatusCode: 201},
+		{Method: "POST", Path: "/api/items", StatusCode: 201},
+		{Method: "PUT", Path: "/api/update", StatusCode: 200},
+	}
+
+	filtered := state.getFilteredEntries()
+
+	assert.Len(t, filtered, 2)
+	assert.Equal(t, "POST", filtered[0].Method)
+	assert.Equal(t, "POST", filtered[1].Method)
+}
+
+// TestHTTPLogState_GetFilteredEntries_CombinedFilters tests combining mode and text filters
+func TestHTTPLogState_GetFilteredEntries_CombinedFilters(t *testing.T) {
+	state := newHTTPLogState("fwd", "alias")
+	state.filterMode = HTTPLogFilterErrors
+	state.filterText = "api"
+	state.entries = []HTTPLogEntry{
+		{Method: "GET", Path: "/api/users", StatusCode: 200},
+		{Method: "GET", Path: "/api/error", StatusCode: 500},
+		{Method: "GET", Path: "/health", StatusCode: 500}, // Error but doesn't match text
+		{Method: "GET", Path: "/api/notfound", StatusCode: 404},
+	}
+
+	filtered := state.getFilteredEntries()
+
+	assert.Len(t, filtered, 2)
+	assert.Equal(t, "/api/error", filtered[0].Path)
+	assert.Equal(t, "/api/notfound", filtered[1].Path)
+}
+
+// TestHTTPLogState_GetFilteredEntries_EmptyResult tests when no entries match
+func TestHTTPLogState_GetFilteredEntries_EmptyResult(t *testing.T) {
+	state := newHTTPLogState("fwd", "alias")
+	state.filterText = "nonexistent"
+	state.entries = []HTTPLogEntry{
+		{Method: "GET", Path: "/api/users", StatusCode: 200},
+		{Method: "POST", Path: "/api/orders", StatusCode: 201},
+	}
+
+	filtered := state.getFilteredEntries()
+
+	assert.Empty(t, filtered)
+}
+
+// TestHTTPLogState_GetFilterModeLabel tests filter mode labels
+func TestHTTPLogState_GetFilterModeLabel(t *testing.T) {
+	state := newHTTPLogState("fwd", "alias")
+
+	tests := []struct {
+		expected string
+		mode     HTTPLogFilterMode
+	}{
+		{mode: HTTPLogFilterNone, expected: "All"},
+		{mode: HTTPLogFilterText, expected: "Text"},
+		{mode: HTTPLogFilterNon200, expected: "Non-2xx"},
+		{mode: HTTPLogFilterErrors, expected: "Errors (4xx/5xx)"},
+	}
+
+	for _, tt := range tests {
+		state.filterMode = tt.mode
+		assert.Equal(t, tt.expected, state.getFilterModeLabel())
+	}
+}
+
+// TestHTTPLogState_FilterModeValues tests filter mode constants are correct
+func TestHTTPLogState_FilterModeValues(t *testing.T) {
+	// Ensure the modes are sequential for cycling to work correctly
+	assert.Equal(t, HTTPLogFilterMode(0), HTTPLogFilterNone)
+	assert.Equal(t, HTTPLogFilterMode(1), HTTPLogFilterText)
+	assert.Equal(t, HTTPLogFilterMode(2), HTTPLogFilterNon200)
+	assert.Equal(t, HTTPLogFilterMode(3), HTTPLogFilterErrors)
+}
+
+// TestHTTPLogState_LargeEntrySet tests filtering performance with many entries
+func TestHTTPLogState_LargeEntrySet(t *testing.T) {
+	state := newHTTPLogState("fwd", "alias")
+
+	// Add 1000 entries
+	for i := 0; i < 1000; i++ {
+		code := 200
+		if i%10 == 0 {
+			code = 500
+		}
+		state.entries = append(state.entries, HTTPLogEntry{
+			Method:     "GET",
+			Path:       "/api/test",
+			StatusCode: code,
+		})
+	}
+
+	// Filter should work correctly
+	state.filterMode = HTTPLogFilterErrors
+	filtered := state.getFilteredEntries()
+
+	assert.Len(t, filtered, 100) // 10% are errors
+}
@@ -0,0 +1,32 @@
+package ui
+
+import (
+	"context"
+
+	"github.com/nvm/kportal/internal/config"
+	"github.com/nvm/kportal/internal/k8s"
+)
+
+// DiscoveryInterface defines the interface for Kubernetes discovery operations
+// This allows for mocking in tests
+type DiscoveryInterface interface {
+	ListContexts() ([]string, error)
+	GetCurrentContext() (string, error)
+	ListNamespaces(ctx context.Context, contextName string) ([]string, error)
+	ListPods(ctx context.Context, contextName, namespace string) ([]k8s.PodInfo, error)
+	ListPodsWithSelector(ctx context.Context, contextName, namespace, selector string) ([]k8s.PodInfo, error)
+	ListServices(ctx context.Context, contextName, namespace string) ([]k8s.ServiceInfo, error)
+}
+
+// MutatorInterface defines the interface for configuration mutation operations
+// This allows for mocking in tests
+type MutatorInterface interface {
+	AddForward(contextName, namespaceName string, fwd config.Forward) error
+	RemoveForwards(predicate func(ctx, ns string, fwd config.Forward) bool) error
+	RemoveForwardByID(id string) error
+	UpdateForward(oldID, newContextName, newNamespaceName string, newFwd config.Forward) error
+}
+
+// Compile-time checks to ensure real types implement interfaces
+var _ DiscoveryInterface = (*k8s.Discovery)(nil)
+var _ MutatorInterface = (*config.Mutator)(nil)
@@ -0,0 +1,258 @@
+package ui
+
+import (
+	"context"
+	"sync"
+
+	"github.com/nvm/kportal/internal/config"
+	"github.com/nvm/kportal/internal/k8s"
+)
+
+// MockDiscovery is a mock implementation of DiscoveryInterface for testing
+type MockDiscovery struct {
+	ListPodsErr               error
+	ListServicesErr           error
+	ListPodsWithSelectorErr   error
+	ListContextsErr           error
+	GetCurrentContextErr      error
+	ListNamespacesErr         error
+	LastSelector              string
+	CurrentContext            string
+	LastNamespace             string
+	LastContextName           string
+	PodsWithSelector          []k8s.PodInfo
+	Services                  []k8s.ServiceInfo
+	Pods                      []k8s.PodInfo
+	Namespaces                []string
+	Contexts                  []string
+	ListContextsCalls         int
+	GetCurrentContextCalls    int
+	ListNamespacesCalls       int
+	ListPodsCalls             int
+	ListPodsWithSelectorCalls int
+	ListServicesCalls         int
+	mu                        sync.Mutex
+}
+
+func NewMockDiscovery() *MockDiscovery {
+	return &MockDiscovery{
+		Contexts:   []string{"default", "production", "staging"},
+		Namespaces: []string{"default", "kube-system"},
+	}
+}
+
+func (m *MockDiscovery) ListContexts() ([]string, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.ListContextsCalls++
+	return m.Contexts, m.ListContextsErr
+}
+
+func (m *MockDiscovery) GetCurrentContext() (string, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.GetCurrentContextCalls++
+	if m.CurrentContext == "" {
+		return "default", m.GetCurrentContextErr
+	}
+	return m.CurrentContext, m.GetCurrentContextErr
+}
+
+func (m *MockDiscovery) ListNamespaces(ctx context.Context, contextName string) ([]string, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.ListNamespacesCalls++
+	m.LastContextName = contextName
+	return m.Namespaces, m.ListNamespacesErr
+}
+
+func (m *MockDiscovery) ListPods(ctx context.Context, contextName, namespace string) ([]k8s.PodInfo, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.ListPodsCalls++
+	m.LastContextName = contextName
+	m.LastNamespace = namespace
+	return m.Pods, m.ListPodsErr
+}
+
+func (m *MockDiscovery) ListPodsWithSelector(ctx context.Context, contextName, namespace, selector string) ([]k8s.PodInfo, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.ListPodsWithSelectorCalls++
+	m.LastContextName = contextName
+	m.LastNamespace = namespace
+	m.LastSelector = selector
+	return m.PodsWithSelector, m.ListPodsWithSelectorErr
+}
+
+func (m *MockDiscovery) ListServices(ctx context.Context, contextName, namespace string) ([]k8s.ServiceInfo, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.ListServicesCalls++
+	m.LastContextName = contextName
+	m.LastNamespace = namespace
+	return m.Services, m.ListServicesErr
+}
+
+// MockMutator is a mock implementation of MutatorInterface for testing
+type MockMutator struct {
+	RemoveForwardByIDErr error
+	UpdateForwardErr     error
+	AddForwardErr        error
+	RemoveForwardsErr    error
+	LastPredicate        func(ctx, ns string, fwd config.Forward) bool
+	LastContextName      string
+	LastOldID            string
+	LastNamespaceName    string
+	LastRemovedID        string
+	Forwards             []struct {
+		Context   string
+		Namespace string
+		Forward   config.Forward
+	}
+	LastForward            config.Forward
+	RemoveForwardByIDCalls int
+	UpdateForwardCalls     int
+	RemoveForwardsCalls    int
+	AddForwardCalls        int
+	mu                     sync.Mutex
+}
+
+func NewMockMutator() *MockMutator {
+	return &MockMutator{}
+}
+
+func (m *MockMutator) AddForward(contextName, namespaceName string, fwd config.Forward) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.AddForwardCalls++
+	m.LastContextName = contextName
+	m.LastNamespaceName = namespaceName
+	m.LastForward = fwd
+
+	if m.AddForwardErr == nil {
+		m.Forwards = append(m.Forwards, struct {
+			Context   string
+			Namespace string
+			Forward   config.Forward
+		}{contextName, namespaceName, fwd})
+	}
+
+	return m.AddForwardErr
+}
+
+func (m *MockMutator) RemoveForwards(predicate func(ctx, ns string, fwd config.Forward) bool) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.RemoveForwardsCalls++
+	m.LastPredicate = predicate
+	return m.RemoveForwardsErr
+}
+
+func (m *MockMutator) RemoveForwardByID(id string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.RemoveForwardByIDCalls++
+	m.LastRemovedID = id
+	return m.RemoveForwardByIDErr
+}
+
+func (m *MockMutator) UpdateForward(oldID, newContextName, newNamespaceName string, newFwd config.Forward) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.UpdateForwardCalls++
+	m.LastOldID = oldID
+	m.LastContextName = newContextName
+	m.LastNamespaceName = newNamespaceName
+	m.LastForward = newFwd
+	return m.UpdateForwardErr
+}
+
+// MockHTTPLogSubscriber is a mock for HTTP log subscription
+type MockHTTPLogSubscriber struct {
+	Subscriptions map[string]func(HTTPLogEntry)
+	CleanupCalls  int
+	mu            sync.Mutex
+	ShouldFail    bool
+}
+
+func NewMockHTTPLogSubscriber() *MockHTTPLogSubscriber {
+	return &MockHTTPLogSubscriber{
+		Subscriptions: make(map[string]func(HTTPLogEntry)),
+	}
+}
+
+// Subscribe returns a cleanup function
+func (m *MockHTTPLogSubscriber) Subscribe(forwardID string, callback func(HTTPLogEntry)) func() {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	m.Subscriptions[forwardID] = callback
+
+	return func() {
+		m.mu.Lock()
+		defer m.mu.Unlock()
+		m.CleanupCalls++
+		delete(m.Subscriptions, forwardID)
+	}
+}
+
+// SendEntry sends an entry to a subscribed callback (for testing)
+func (m *MockHTTPLogSubscriber) SendEntry(forwardID string, entry HTTPLogEntry) {
+	m.mu.Lock()
+	callback, exists := m.Subscriptions[forwardID]
+	m.mu.Unlock()
+
+	if exists && callback != nil {
+		callback(entry)
+	}
+}
+
+// GetSubscriberFunc returns the function signature expected by the UI
+func (m *MockHTTPLogSubscriber) GetSubscriberFunc() HTTPLogSubscriber {
+	return func(forwardID string, callback func(entry HTTPLogEntry)) func() {
+		return m.Subscribe(forwardID, callback)
+	}
+}
+
+// MockToggleCallback tracks toggle callback invocations
+type MockToggleCallback struct {
+	Calls []struct {
+		ID     string
+		Enable bool
+	}
+	mu sync.Mutex
+}
+
+func NewMockToggleCallback() *MockToggleCallback {
+	return &MockToggleCallback{}
+}
+
+func (m *MockToggleCallback) Callback(id string, enable bool) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.Calls = append(m.Calls, struct {
+		ID     string
+		Enable bool
+	}{id, enable})
+}
+
+func (m *MockToggleCallback) GetFunc() func(string, bool) {
+	return m.Callback
+}
+
+func (m *MockToggleCallback) CallCount() int {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return len(m.Calls)
+}
+
+func (m *MockToggleCallback) LastCall() (string, bool, bool) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if len(m.Calls) == 0 {
+		return "", false, false
+	}
+	last := m.Calls[len(m.Calls)-1]
+	return last.ID, last.Enable, true
+}
@@ -14,17 +14,17 @@ type ForwardStatus struct {
 	Context    string
 	Namespace  string
 	Alias      string
-	Type       string // "service", "pod", etc.
-	Resource   string // name without type prefix
+	Type       string
+	Resource   string
+	Status     string
 	RemotePort int
 	LocalPort  int
-	Status     string // "Starting", "Active", "Reconnecting", "Error"
 }

 // TableUI manages the terminal table display
 type TableUI struct {
+	forwards map[string]*ForwardStatus
 	mu       sync.RWMutex
-	forwards map[string]*ForwardStatus // key is forward ID
 	verbose  bool
 }

@@ -101,12 +101,12 @@ func (t *TableUI) Render() {

 	// Sort forwards by local port for consistent display
 	type sortEntry struct {
-		id  string
 		fwd *ForwardStatus
+		id  string
 	}
 	var entries []sortEntry
 	for id, fwd := range t.forwards {
-		entries = append(entries, sortEntry{id, fwd})
+		entries = append(entries, sortEntry{fwd: fwd, id: id})
 	}

 	// Simple sort by local port
@@ -9,6 +9,7 @@ import (
 	"github.com/nvm/kportal/internal/benchmark"
 	"github.com/nvm/kportal/internal/config"
 	"github.com/nvm/kportal/internal/k8s"
+	"github.com/nvm/kportal/internal/logger"
 )

 const (
@@ -19,53 +20,53 @@ const (

 // ContextsLoadedMsg is sent when contexts have been loaded
 type ContextsLoadedMsg struct {
-	contexts []string
 	err      error
+	contexts []string
 }

 // NamespacesLoadedMsg is sent when namespaces have been loaded
 type NamespacesLoadedMsg struct {
-	namespaces []string
 	err        error
+	namespaces []string
 }

 // PodsLoadedMsg is sent when pods have been loaded
 type PodsLoadedMsg struct {
-	pods []k8s.PodInfo
 	err  error
+	pods []k8s.PodInfo
 }

 // ServicesLoadedMsg is sent when services have been loaded
 type ServicesLoadedMsg struct {
-	services []k8s.ServiceInfo
 	err      error
+	services []k8s.ServiceInfo
 }

 // SelectorValidatedMsg is sent when a selector has been validated
 type SelectorValidatedMsg struct {
-	valid bool
-	pods  []k8s.PodInfo
 	err   error
+	pods  []k8s.PodInfo
+	valid bool
 }

 // PortCheckedMsg is sent when a port's availability has been checked
 type PortCheckedMsg struct {
+	message   string
 	port      int
 	available bool
-	message   string
 }

 // ForwardSavedMsg is sent when a forward has been saved to config
 type ForwardSavedMsg struct {
-	success bool
 	err     error
+	success bool
 }

 // ForwardsRemovedMsg is sent when forwards have been removed from config
 type ForwardsRemovedMsg struct {
-	success bool
-	count   int
 	err     error
+	count   int
+	success bool
 }

 // WizardCompleteMsg signals that the wizard has completed
@@ -241,9 +242,9 @@ func removeForwardByIDCmd(mutator *config.Mutator, id string) tea.Cmd {

 // BenchmarkCompleteMsg is sent when a benchmark run completes
 type BenchmarkCompleteMsg struct {
-	ForwardID string
-	Results   *benchmark.Results
 	Error     error
+	Results   *benchmark.Results
+	ForwardID string
 }

 // BenchmarkProgressMsg is sent periodically during benchmark execution
@@ -258,6 +259,9 @@ type HTTPLogEntryMsg struct {
 	Entry HTTPLogEntry
 }

+// clearCopyMessageMsg is sent to clear the copy confirmation message
+type clearCopyMessageMsg struct{}
+
 // listenBenchmarkProgressCmd listens for progress updates from the benchmark
 func listenBenchmarkProgressCmd(progressCh <-chan BenchmarkProgressMsg) tea.Cmd {
 	return func() tea.Msg {
@@ -272,7 +276,8 @@ func listenBenchmarkProgressCmd(progressCh <-chan BenchmarkProgressMsg) tea.Cmd

 // runBenchmarkCmd runs a benchmark against the given port forward
 // It sends progress updates via tea.Batch until completion
-func runBenchmarkCmd(forwardID string, localPort int, urlPath, method string, concurrency, requests int, progressCh chan<- BenchmarkProgressMsg) tea.Cmd {
+// The ctx parameter allows the benchmark to be cancelled from outside
+func runBenchmarkCmd(ctx context.Context, forwardID string, localPort int, urlPath, method string, concurrency, requests int, progressCh chan<- BenchmarkProgressMsg) tea.Cmd {
 	return func() tea.Msg {
 		runner := benchmark.NewRunner()

@@ -284,6 +289,12 @@ func runBenchmarkCmd(forwardID string, localPort int, urlPath, method string, co
 			Requests:    requests,
 			Timeout:     30 * time.Second,
 			ProgressCallback: func(completed, total int) {
+				// Recover from panics in the callback
+				defer func() {
+					if r := recover(); r != nil {
+						logger.Debug("recovered from panic in progress callback", map[string]any{"panic": r})
+					}
+				}()
 				// Non-blocking send to progress channel
 				select {
 				case progressCh <- BenchmarkProgressMsg{
@@ -297,14 +308,24 @@ func runBenchmarkCmd(forwardID string, localPort int, urlPath, method string, co
 			},
 		}

-		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+		// Use the provided context with a timeout as a safety limit
+		benchCtx, cancel := context.WithTimeout(ctx, 5*time.Minute)
 		defer cancel()

-		results, err := runner.Run(ctx, forwardID, cfg)
+		results, err := runner.Run(benchCtx, forwardID, cfg)

 		// Close the progress channel when done
 		close(progressCh)

+		// Check if cancelled
+		if ctx.Err() != nil {
+			return BenchmarkCompleteMsg{
+				ForwardID: forwardID,
+				Results:   nil,
+				Error:     fmt.Errorf("benchmark cancelled"),
+			}
+		}
+
 		return BenchmarkCompleteMsg{
 			ForwardID: forwardID,
 			Results:   results,
@@ -0,0 +1,386 @@
+package ui
+
+import (
+	"testing"
+
+	"github.com/nvm/kportal/internal/config"
+	"github.com/stretchr/testify/assert"
+)
+
+// TestWizardMutualExclusion_AddWizardBlocksOthers tests that having an add wizard active blocks other modals
+func TestWizardMutualExclusion_AddWizardBlocksOthers(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	// Add a forward so we have something to select
+	fwd := &config.Forward{
+		Resource:  "pod/my-app",
+		Port:      8080,
+		LocalPort: 8080,
+	}
+	ui.AddForward("test-id", fwd)
+
+	// Activate add wizard
+	ui.mu.Lock()
+	ui.viewMode = ViewModeAddWizard
+	ui.addWizard = newAddWizardState()
+	ui.mu.Unlock()
+
+	// Verify state
+	ui.mu.RLock()
+	assert.NotNil(t, ui.addWizard)
+	assert.Equal(t, ViewModeAddWizard, ui.viewMode)
+	ui.mu.RUnlock()
+
+	// Check that other modals cannot be activated when add wizard is active
+	// This is enforced in the handlers, not in state - we're testing the state setup
+}
+
+// TestWizardMutualExclusion_BenchmarkBlocksOthers tests that having benchmark active blocks other modals
+func TestWizardMutualExclusion_BenchmarkBlocksOthers(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	// Add a forward
+	fwd := &config.Forward{
+		Resource:  "pod/my-app",
+		Port:      8080,
+		LocalPort: 8080,
+	}
+	ui.AddForward("test-id", fwd)
+
+	// Activate benchmark
+	ui.mu.Lock()
+	ui.viewMode = ViewModeBenchmark
+	ui.benchmarkState = newBenchmarkState("test-id", "my-app", 8080)
+	ui.mu.Unlock()
+
+	ui.mu.RLock()
+	assert.NotNil(t, ui.benchmarkState)
+	assert.Equal(t, ViewModeBenchmark, ui.viewMode)
+	ui.mu.RUnlock()
+}
+
+// TestWizardMutualExclusion_HTTPLogBlocksOthers tests that having HTTP log view active blocks other modals
+func TestWizardMutualExclusion_HTTPLogBlocksOthers(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	// Add a forward
+	fwd := &config.Forward{
+		Resource:  "pod/my-app",
+		Port:      8080,
+		LocalPort: 8080,
+	}
+	ui.AddForward("test-id", fwd)
+
+	// Activate HTTP log view
+	ui.mu.Lock()
+	ui.viewMode = ViewModeHTTPLog
+	ui.httpLogState = newHTTPLogState("test-id", "my-app")
+	ui.mu.Unlock()
+
+	ui.mu.RLock()
+	assert.NotNil(t, ui.httpLogState)
+	assert.Equal(t, ViewModeHTTPLog, ui.viewMode)
+	ui.mu.RUnlock()
+}
+
+// TestWizardMutualExclusion_CheckActiveModal tests the modal activity check logic
+func TestWizardMutualExclusion_CheckActiveModal(t *testing.T) {
+	tests := []struct {
+		setupFunc      func(*BubbleTeaUI)
+		name           string
+		activeModalStr string
+		expectActive   bool
+	}{
+		{
+			name:           "no modal active",
+			setupFunc:      func(ui *BubbleTeaUI) {},
+			expectActive:   false,
+			activeModalStr: "none",
+		},
+		{
+			name: "add wizard active",
+			setupFunc: func(ui *BubbleTeaUI) {
+				ui.addWizard = newAddWizardState()
+			},
+			expectActive:   true,
+			activeModalStr: "addWizard",
+		},
+		{
+			name: "remove wizard active",
+			setupFunc: func(ui *BubbleTeaUI) {
+				ui.removeWizard = &RemoveWizardState{}
+			},
+			expectActive:   true,
+			activeModalStr: "removeWizard",
+		},
+		{
+			name: "benchmark active",
+			setupFunc: func(ui *BubbleTeaUI) {
+				ui.benchmarkState = newBenchmarkState("id", "alias", 8080)
+			},
+			expectActive:   true,
+			activeModalStr: "benchmark",
+		},
+		{
+			name: "http log active",
+			setupFunc: func(ui *BubbleTeaUI) {
+				ui.httpLogState = newHTTPLogState("id", "alias")
+			},
+			expectActive:   true,
+			activeModalStr: "httpLog",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ui := NewBubbleTeaUI(nil, "1.0.0")
+
+			ui.mu.Lock()
+			tt.setupFunc(ui)
+			ui.mu.Unlock()
+
+			ui.mu.RLock()
+			hasActiveModal := ui.addWizard != nil ||
+				ui.removeWizard != nil ||
+				ui.benchmarkState != nil ||
+				ui.httpLogState != nil
+			ui.mu.RUnlock()
+
+			assert.Equal(t, tt.expectActive, hasActiveModal, "Modal activity check failed for: %s", tt.activeModalStr)
+		})
+	}
+}
+
+// TestWizardCleanup_AddWizardReset tests that add wizard state is properly cleaned up
+func TestWizardCleanup_AddWizardReset(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	// Set up wizard with various state
+	ui.mu.Lock()
+	ui.viewMode = ViewModeAddWizard
+	ui.addWizard = newAddWizardState()
+	ui.addWizard.step = StepSelectNamespace
+	ui.addWizard.selectedContext = "prod"
+	ui.addWizard.contexts = []string{"prod", "staging"}
+	ui.mu.Unlock()
+
+	// Simulate cleanup (like pressing Esc)
+	ui.mu.Lock()
+	ui.viewMode = ViewModeMain
+	ui.addWizard = nil
+	ui.mu.Unlock()
+
+	ui.mu.RLock()
+	assert.Nil(t, ui.addWizard)
+	assert.Equal(t, ViewModeMain, ui.viewMode)
+	ui.mu.RUnlock()
+}
+
+// TestWizardCleanup_BenchmarkReset tests that benchmark state is properly cleaned up
+func TestWizardCleanup_BenchmarkReset(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	cancelled := false
+
+	// Set up benchmark with cancel function
+	ui.mu.Lock()
+	ui.viewMode = ViewModeBenchmark
+	ui.benchmarkState = newBenchmarkState("id", "alias", 8080)
+	ui.benchmarkState.running = true
+	ui.benchmarkState.cancelFunc = func() { cancelled = true }
+	ui.mu.Unlock()
+
+	// Simulate cleanup with cancel
+	ui.mu.Lock()
+	if ui.benchmarkState.cancelFunc != nil {
+		ui.benchmarkState.cancelFunc()
+	}
+	ui.viewMode = ViewModeMain
+	ui.benchmarkState = nil
+	ui.mu.Unlock()
+
+	assert.True(t, cancelled, "Cancel function should have been called")
+
+	ui.mu.RLock()
+	assert.Nil(t, ui.benchmarkState)
+	assert.Equal(t, ViewModeMain, ui.viewMode)
+	ui.mu.RUnlock()
+}
+
+// TestWizardCleanup_HTTPLogReset tests that HTTP log state is properly cleaned up
+func TestWizardCleanup_HTTPLogReset(t *testing.T) {
+	ui := NewBubbleTeaUI(nil, "1.0.0")
+
+	cleanupCalled := false
+
+	// Set up HTTP log with cleanup function
+	ui.mu.Lock()
+	ui.viewMode = ViewModeHTTPLog
+	ui.httpLogState = newHTTPLogState("id", "alias")
+	ui.httpLogState.entries = []HTTPLogEntry{{Method: "GET", Path: "/"}}
+	ui.httpLogCleanup = func() { cleanupCalled = true }
+	ui.mu.Unlock()
+
+	// Simulate cleanup
+	ui.mu.Lock()
+	if ui.httpLogCleanup != nil {
+		ui.httpLogCleanup()
+		ui.httpLogCleanup = nil
+	}
+	ui.viewMode = ViewModeMain
+	ui.httpLogState = nil
+	ui.mu.Unlock()
+
+	assert.True(t, cleanupCalled, "Cleanup function should have been called")
+
+	ui.mu.RLock()
+	assert.Nil(t, ui.httpLogState)
+	assert.Nil(t, ui.httpLogCleanup)
+	assert.Equal(t, ViewModeMain, ui.viewMode)
+	ui.mu.RUnlock()
+}
+
+// TestViewModeValues tests view mode constants
+func TestViewModeValues(t *testing.T) {
+	assert.Equal(t, ViewMode(0), ViewModeMain)
+	assert.Equal(t, ViewMode(1), ViewModeAddWizard)
+	assert.Equal(t, ViewMode(2), ViewModeRemoveWizard)
+	assert.Equal(t, ViewMode(3), ViewModeBenchmark)
+	assert.Equal(t, ViewMode(4), ViewModeHTTPLog)
+}
+
+// TestRemoveWizardState_Selection tests remove wizard selection logic
+func TestRemoveWizardState_Selection(t *testing.T) {
+	wizard := &RemoveWizardState{
+		forwards: []RemovableForward{
+			{ID: "a", Alias: "app-a"},
+			{ID: "b", Alias: "app-b"},
+			{ID: "c", Alias: "app-c"},
+		},
+		selected: make(map[int]bool),
+		cursor:   0,
+	}
+
+	// Toggle selection
+	wizard.toggleSelection()
+	assert.True(t, wizard.selected[0])
+
+	// Move and toggle
+	wizard.moveCursor(1)
+	wizard.toggleSelection()
+	assert.True(t, wizard.selected[1])
+
+	// Check selected count
+	assert.Equal(t, 2, wizard.getSelectedCount())
+
+	// Get selected forwards
+	selected := wizard.getSelectedForwards()
+	assert.Len(t, selected, 2)
+}
+
+// TestRemoveWizardState_SelectAll tests select all functionality
+func TestRemoveWizardState_SelectAll(t *testing.T) {
+	wizard := &RemoveWizardState{
+		forwards: []RemovableForward{
+			{ID: "a"},
+			{ID: "b"},
+			{ID: "c"},
+		},
+		selected: make(map[int]bool),
+	}
+
+	wizard.selectAll()
+
+	assert.Equal(t, 3, wizard.getSelectedCount())
+	assert.True(t, wizard.selected[0])
+	assert.True(t, wizard.selected[1])
+	assert.True(t, wizard.selected[2])
+}
+
+// TestRemoveWizardState_SelectNone tests deselect all functionality
+func TestRemoveWizardState_SelectNone(t *testing.T) {
+	wizard := &RemoveWizardState{
+		forwards: []RemovableForward{
+			{ID: "a"},
+			{ID: "b"},
+			{ID: "c"},
+		},
+		selected: map[int]bool{0: true, 1: true, 2: true},
+	}
+
+	wizard.selectNone()
+
+	assert.Equal(t, 0, wizard.getSelectedCount())
+}
+
+// TestRemoveWizardState_MoveCursor tests cursor movement in remove wizard
+func TestRemoveWizardState_MoveCursor(t *testing.T) {
+	wizard := &RemoveWizardState{
+		forwards: []RemovableForward{
+			{ID: "a"},
+			{ID: "b"},
+			{ID: "c"},
+		},
+		selected: make(map[int]bool),
+		cursor:   0,
+	}
+
+	// Move down
+	wizard.moveCursor(1)
+	assert.Equal(t, 1, wizard.cursor)
+
+	// Move down again
+	wizard.moveCursor(1)
+	assert.Equal(t, 2, wizard.cursor)
+
+	// Cannot go past end
+	wizard.moveCursor(1)
+	assert.Equal(t, 2, wizard.cursor)
+
+	// Move up
+	wizard.moveCursor(-1)
+	assert.Equal(t, 1, wizard.cursor)
+
+	// Cannot go below 0
+	wizard.moveCursor(-10)
+	assert.Equal(t, 0, wizard.cursor)
+}
+
+// TestRemoveWizardState_ConfirmationMode tests confirmation mode cursor
+func TestRemoveWizardState_ConfirmationMode(t *testing.T) {
+	wizard := &RemoveWizardState{
+		forwards:      []RemovableForward{{ID: "a"}},
+		selected:      map[int]bool{0: true},
+		confirming:    true,
+		confirmCursor: 0,
+	}
+
+	// In confirmation mode, cursor moves between Yes/No
+	wizard.moveCursor(1)
+	assert.Equal(t, 1, wizard.confirmCursor)
+
+	// Cannot go past 1
+	wizard.moveCursor(1)
+	assert.Equal(t, 1, wizard.confirmCursor)
+
+	// Move back
+	wizard.moveCursor(-1)
+	assert.Equal(t, 0, wizard.confirmCursor)
+
+	// Cannot go below 0
+	wizard.moveCursor(-1)
+	assert.Equal(t, 0, wizard.confirmCursor)
+}
+
+// TestRemoveWizardState_ToggleInConfirmationMode tests that toggle is disabled in confirmation mode
+func TestRemoveWizardState_ToggleInConfirmationMode(t *testing.T) {
+	wizard := &RemoveWizardState{
+		forwards:   []RemovableForward{{ID: "a"}},
+		selected:   make(map[int]bool),
+		confirming: true,
+	}
+
+	// Toggle should be no-op in confirmation mode
+	wizard.toggleSelection()
+	assert.Equal(t, 0, wizard.getSelectedCount())
+}
@@ -1,9 +1,13 @@
 package ui

 import (
+	"context"
 	"fmt"
+	"os/exec"
+	"runtime"
 	"strconv"
 	"strings"
+	"time"

 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/nvm/kportal/internal/config"
@@ -51,6 +55,11 @@ func (m model) handleMainViewKeys(msg tea.KeyMsg) (tea.Model, tea.Cmd) {

 	case "n": // Enter add wizard
 		m.ui.mu.Lock()
+		// Don't create a new wizard if one is already active
+		if m.ui.addWizard != nil || m.ui.removeWizard != nil || m.ui.benchmarkState != nil || m.ui.httpLogState != nil {
+			m.ui.mu.Unlock()
+			return m, nil
+		}
 		if m.ui.discovery == nil || m.ui.mutator == nil {
 			// Dependencies not set up
 			m.ui.mu.Unlock()
@@ -67,6 +76,11 @@ func (m model) handleMainViewKeys(msg tea.KeyMsg) (tea.Model, tea.Cmd) {

 	case "e": // Edit selected forward
 		m.ui.mu.Lock()
+		// Don't create a new wizard if one is already active
+		if m.ui.addWizard != nil || m.ui.removeWizard != nil || m.ui.benchmarkState != nil || m.ui.httpLogState != nil {
+			m.ui.mu.Unlock()
+			return m, nil
+		}

 		if len(m.ui.forwardOrder) == 0 {
 			// No forwards to edit
@@ -133,6 +147,12 @@ func (m model) handleMainViewKeys(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 	case "d": // Delete currently selected forward - show confirmation
 		m.ui.mu.Lock()

+		// Don't overwrite existing confirmation dialog
+		if m.ui.deleteConfirming {
+			m.ui.mu.Unlock()
+			return m, nil
+		}
+
 		if len(m.ui.forwardOrder) == 0 {
 			// No forwards to delete
 			m.ui.mu.Unlock()
@@ -163,13 +183,18 @@ func (m model) handleMainViewKeys(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 		m.ui.deleteConfirming = true
 		m.ui.deleteConfirmID = selectedID
 		m.ui.deleteConfirmAlias = selectedForward.Alias
-		m.ui.deleteConfirmCursor = 0 // Default to "No" for safety
+		m.ui.deleteConfirmCursor = 1 // Default to "No" for safety

 		m.ui.mu.Unlock()
 		return m, nil

 	case "b": // Benchmark selected forward
 		m.ui.mu.Lock()
+		// Don't create benchmark view if another modal is active
+		if m.ui.addWizard != nil || m.ui.removeWizard != nil || m.ui.benchmarkState != nil || m.ui.httpLogState != nil {
+			m.ui.mu.Unlock()
+			return m, nil
+		}

 		if len(m.ui.forwardOrder) == 0 {
 			m.ui.mu.Unlock()
@@ -200,6 +225,11 @@ func (m model) handleMainViewKeys(msg tea.KeyMsg) (tea.Model, tea.Cmd) {

 	case "l": // View HTTP logs for selected forward
 		m.ui.mu.Lock()
+		// Don't create log view if another modal is active
+		if m.ui.addWizard != nil || m.ui.removeWizard != nil || m.ui.benchmarkState != nil || m.ui.httpLogState != nil {
+			m.ui.mu.Unlock()
+			return m, nil
+		}

 		if len(m.ui.forwardOrder) == 0 {
 			m.ui.mu.Unlock()
@@ -223,18 +253,33 @@ func (m model) handleMainViewKeys(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 		m.ui.viewMode = ViewModeHTTPLog
 		m.ui.httpLogState = newHTTPLogState(selectedID, selectedForward.Alias)

+		// Capture subscriber and UI reference for the callback
+		subscriber := m.ui.httpLogSubscriber
+		ui := m.ui
+		m.ui.mu.Unlock()
+
 		// Subscribe to HTTP logs if subscriber is available
-		if m.ui.httpLogSubscriber != nil {
-			cleanup := m.ui.httpLogSubscriber(selectedID, func(entry HTTPLogEntry) {
-				// Add entry to state (thread-safe via Send)
-				if m.ui.program != nil {
-					m.ui.program.Send(HTTPLogEntryMsg{Entry: entry})
+		// This is done outside the lock to prevent deadlocks in the callback
+		if subscriber != nil {
+			cleanup := subscriber(selectedID, func(entry HTTPLogEntry) {
+				// Recover from panics in the callback
+				defer safeRecover("HTTPLogSubscriber callback")
+
+				// Use RLock to safely access program
+				ui.mu.RLock()
+				program := ui.program
+				ui.mu.RUnlock()
+
+				// Send entry to program (thread-safe via Send)
+				if program != nil {
+					program.Send(HTTPLogEntryMsg{Entry: entry})
 				}
 			})
-			m.ui.httpLogCleanup = cleanup
+			ui.mu.Lock()
+			ui.httpLogCleanup = cleanup
+			ui.mu.Unlock()
 		}

-		m.ui.mu.Unlock()
 		return m, nil
 	}

@@ -744,17 +789,21 @@ func (m model) handleContextsLoaded(msg ContextsLoadedMsg) (tea.Model, tea.Cmd)
 		m.ui.addWizard.loading = false
 		m.ui.addWizard.error = msg.err
 		if msg.err == nil {
-			// Get current context and move it to the top
-			currentCtx, err := m.ui.discovery.GetCurrentContext()
-			if err == nil && currentCtx != "" {
-				// Reorder contexts with current first
-				reordered := []string{currentCtx}
-				for _, ctx := range msg.contexts {
-					if ctx != currentCtx {
-						reordered = append(reordered, ctx)
+			// Get current context and move it to the top (if discovery is available)
+			if m.ui.discovery != nil {
+				currentCtx, err := m.ui.discovery.GetCurrentContext()
+				if err == nil && currentCtx != "" {
+					// Reorder contexts with current first
+					reordered := []string{currentCtx}
+					for _, ctx := range msg.contexts {
+						if ctx != currentCtx {
+							reordered = append(reordered, ctx)
+						}
 					}
+					m.ui.addWizard.contexts = reordered
+				} else {
+					m.ui.addWizard.contexts = msg.contexts
 				}
-				m.ui.addWizard.contexts = reordered
 			} else {
 				m.ui.addWizard.contexts = msg.contexts
 			}
@@ -926,7 +975,11 @@ func (m model) handleBenchmarkKeys(msg tea.KeyMsg) (tea.Model, tea.Cmd) {

 	switch msg.String() {
 	case "ctrl+c", "esc":
-		// Cancel and return to main view
+		// Cancel the running benchmark if active
+		if state.cancelFunc != nil {
+			state.cancelFunc()
+		}
+		// Return to main view
 		m.ui.viewMode = ViewModeMain
 		m.ui.benchmarkState = nil
 		return m, tea.ClearScreen
@@ -962,9 +1015,12 @@ func (m model) handleBenchmarkKeys(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 			state.total = state.requests
 			// Create progress channel with buffer for non-blocking sends
 			state.progressCh = make(chan BenchmarkProgressMsg, 10)
+			// Create cancellable context for the benchmark
+			ctx, cancel := context.WithCancel(context.Background())
+			state.cancelFunc = cancel
 			// Return batch command to run benchmark and listen for progress
 			return m, tea.Batch(
-				runBenchmarkCmd(state.forwardID, state.localPort, state.urlPath, state.method, state.concurrency, state.requests, state.progressCh),
+				runBenchmarkCmd(ctx, state.forwardID, state.localPort, state.urlPath, state.method, state.concurrency, state.requests, state.progressCh),
 				listenBenchmarkProgressCmd(state.progressCh),
 			)
 		case BenchmarkStepResults:
@@ -1095,6 +1151,58 @@ func (m model) handleHTTPLogKeys(msg tea.KeyMsg) (tea.Model, tea.Cmd) {

 	filteredEntries := state.getFilteredEntries()

+	// If viewing detail, handle detail view keys
+	if state.showingDetail {
+		switch msg.String() {
+		case "esc", "q", "enter":
+			// Return to list view
+			state.showingDetail = false
+			state.detailScroll = 0
+			state.copyMessage = ""
+			return m, nil
+		case "up", "k":
+			if state.detailScroll > 0 {
+				state.detailScroll--
+			}
+			return m, nil
+		case "down", "j":
+			state.detailScroll++
+			return m, nil
+		case "pgup", "ctrl+u":
+			state.detailScroll -= 20
+			if state.detailScroll < 0 {
+				state.detailScroll = 0
+			}
+			return m, nil
+		case "pgdown", "ctrl+d":
+			state.detailScroll += 20
+			return m, nil
+		case "g":
+			state.detailScroll = 0
+			return m, nil
+		case "c":
+			// Copy response body to clipboard
+			if state.cursor >= 0 && state.cursor < len(filteredEntries) {
+				entry := filteredEntries[state.cursor]
+				if entry.ResponseBody != "" {
+					// Decompress if needed before copying
+					body := decompressContent(entry.ResponseBody, entry.ResponseHeaders)
+					if err := copyToClipboard(body); err == nil {
+						state.copyMessage = "Copied!"
+					} else {
+						state.copyMessage = "Clipboard unavailable"
+					}
+					// Clear the message after 2 seconds
+					return m, tea.Tick(2*time.Second, func(t time.Time) tea.Msg {
+						return clearCopyMessageMsg{}
+					})
+				}
+			}
+			return m, nil
+		}
+		return m, nil
+	}
+
 	switch msg.String() {
 	case "ctrl+c", "esc", "q":
 		// Cleanup subscription before closing
@@ -1107,6 +1215,14 @@ func (m model) handleHTTPLogKeys(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 		m.ui.httpLogState = nil
 		return m, tea.ClearScreen

+	case "enter":
+		// Show detail view for selected entry
+		if len(filteredEntries) > 0 && state.cursor >= 0 && state.cursor < len(filteredEntries) {
+			state.showingDetail = true
+			state.detailScroll = 0
+		}
+		return m, nil
+
 	case "up", "k":
 		if state.cursor > 0 {
 			state.cursor--
@@ -1162,8 +1278,14 @@ func (m model) handleHTTPLogKeys(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 		state.autoScroll = !state.autoScroll

 	case "f":
-		// Cycle filter mode
-		state.cycleFilterMode()
+		// Cycle filter mode (skip Text mode when cycling - use '/' for text filter)
+		state.filterMode = (state.filterMode + 1) % 4
+		if state.filterMode == HTTPLogFilterText {
+			// Skip Text mode when using 'f' - it's only accessible via '/'
+			state.filterMode = HTTPLogFilterNon200
+		}
+		state.cursor = 0
+		state.scrollOffset = 0

 	case "/":
 		// Enter text filter mode
@@ -1191,7 +1313,28 @@ func (m model) handleHTTPLogEntry(msg HTTPLogEntryMsg) (tea.Model, tea.Cmd) {
 	}

 	state := m.ui.httpLogState
-	state.entries = append(state.entries, msg.Entry)
+	entry := msg.Entry
+
+	// If this is a response, try to find and merge with the matching request
+	if entry.Direction == "response" && entry.RequestID != "" {
+		// Search backwards (responses follow requests closely)
+		for i := len(state.entries) - 1; i >= 0 && i >= len(state.entries)-100; i-- {
+			if state.entries[i].RequestID == entry.RequestID && state.entries[i].Direction == "request" {
+				// Merge response data into the existing request entry
+				state.entries[i].Direction = "response"
+				state.entries[i].StatusCode = entry.StatusCode
+				state.entries[i].LatencyMs = entry.LatencyMs
+				state.entries[i].BodySize = entry.BodySize
+				state.entries[i].ResponseHeaders = entry.ResponseHeaders
+				state.entries[i].ResponseBody = entry.ResponseBody
+				state.entries[i].Error = entry.Error
+				return m, nil
+			}
+		}
+	}
+
+	// For requests or unmatched responses, append as new entry
+	state.entries = append(state.entries, entry)

 	// Cap entries to prevent memory growth (keep last 10000 entries)
 	const maxEntries = 10000
@@ -1206,7 +1349,11 @@ func (m model) handleHTTPLogEntry(msg HTTPLogEntryMsg) (tea.Model, tea.Cmd) {

 	// Auto-scroll to bottom if enabled
 	if state.autoScroll && len(state.entries) > 0 {
-		state.cursor = len(state.entries) - 1
+		filteredEntries := state.getFilteredEntries()
+		state.cursor = len(filteredEntries) - 1
+		if state.cursor < 0 {
+			state.cursor = 0
+		}
 	}

 	return m, nil
@@ -1270,3 +1417,46 @@ func (m model) handleBenchmarkComplete(msg BenchmarkCompleteMsg) (tea.Model, tea

 	return m, nil
 }
+
+// copyToClipboard copies text to the system clipboard using OS-specific commands.
+// This avoids CGO dependencies that cause issues in CI environments.
+func copyToClipboard(text string) error {
+	var cmd *exec.Cmd
+
+	switch runtime.GOOS {
+	case "darwin":
+		cmd = exec.Command("pbcopy")
+	case "linux":
+		// Try xclip first, fall back to xsel
+		if _, err := exec.LookPath("xclip"); err == nil {
+			cmd = exec.Command("xclip", "-selection", "clipboard")
+		} else if _, err := exec.LookPath("xsel"); err == nil {
+			cmd = exec.Command("xsel", "--clipboard", "--input")
+		} else {
+			return fmt.Errorf("no clipboard tool found (install xclip or xsel)")
+		}
+	case "windows":
+		cmd = exec.Command("clip")
+	default:
+		return fmt.Errorf("unsupported platform: %s", runtime.GOOS)
+	}
+
+	stdin, err := cmd.StdinPipe()
+	if err != nil {
+		return err
+	}
+
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+
+	if _, err := stdin.Write([]byte(text)); err != nil {
+		return err
+	}
+
+	if err := stdin.Close(); err != nil {
+		return err
+	}
+
+	return cmd.Wait()
+}
@@ -109,45 +109,33 @@ func (r ResourceType) Description() string {

 // AddWizardState maintains the state for the add port forward wizard
 type AddWizardState struct {
-	step         AddWizardStep
-	inputMode    InputMode
-	cursor       int
-	scrollOffset int // For scrolling long lists
-	textInput    string
-	searchFilter string // For filtering lists (contexts, namespaces, services)
-	loading      bool
-	error        error
-
-	// Selections made by user
+	error                error
+	resourceValue        string
+	originalID           string
+	portCheckMsg         string
+	alias                string
+	textInput            string
+	searchFilter         string
+	selector             string
 	selectedContext      string
 	selectedNamespace    string
+	pods                 []k8s.PodInfo
+	contexts             []string
+	detectedPorts        []k8s.PortInfo
+	matchingPods         []k8s.PodInfo
+	services             []k8s.ServiceInfo
+	namespaces           []string
+	scrollOffset         int
 	selectedResourceType ResourceType
-	resourceValue        string // pod prefix or service name
-	selector             string // for pod selector type
-	remotePort           int
+	step                 AddWizardStep
 	localPort            int
-	alias                string
-
-	// Available options (loaded asynchronously from k8s)
-	contexts   []string
-	namespaces []string
-	pods       []k8s.PodInfo
-	services   []k8s.ServiceInfo
-
-	// Validation state
-	portAvailable bool
-	portCheckMsg  string
-	matchingPods  []k8s.PodInfo
-
-	// Edit mode
-	isEditing  bool
-	originalID string // ID of the forward being edited
-
-	// Detected ports from resources
-	detectedPorts []k8s.PortInfo
-
-	// Confirmation focus (alias field vs buttons)
-	confirmationFocus ConfirmationFocus
+	cursor               int
+	remotePort           int
+	inputMode            InputMode
+	confirmationFocus    ConfirmationFocus
+	portAvailable        bool
+	isEditing            bool
+	loading              bool
 }

 // newAddWizardState creates a new add wizard state initialized to the first step
@@ -239,11 +227,11 @@ func (w *AddWizardState) clearTextInput() {

 // RemoveWizardState maintains the state for the remove port forward wizard
 type RemoveWizardState struct {
+	selected      map[int]bool
 	forwards      []RemovableForward
 	cursor        int
-	selected      map[int]bool
+	confirmCursor int
 	confirming    bool
-	confirmCursor int // 0 = Yes, 1 = No
 }

 // RemovableForward represents a forward that can be removed
@@ -387,44 +375,39 @@ const (

 // BenchmarkState maintains the state for the benchmark wizard
 type BenchmarkState struct {
-	step         BenchmarkStep
+	error        error
+	results      *BenchmarkResults
+	cancelFunc   func()
+	progressCh   chan BenchmarkProgressMsg
+	textInput    string
 	forwardID    string
 	forwardAlias string
+	urlPath      string
+	method       string
+	cursor       int
+	progress     int
+	total        int
+	step         BenchmarkStep
+	requests     int
+	concurrency  int
 	localPort    int
-
-	// Configuration
-	urlPath     string
-	method      string
-	concurrency int
-	requests    int
-	cursor      int // Current field being edited
-	textInput   string
-
-	// Running state
-	running    bool
-	progress   int
-	total      int
-	progressCh chan BenchmarkProgressMsg // Channel for progress updates
-
-	// Results
-	results *BenchmarkResults
-	error   error
+	running      bool
 }

 // BenchmarkResults holds benchmark results for display
 type BenchmarkResults struct {
+	StatusCodes   map[int]int
 	TotalRequests int
 	Successful    int
 	Failed        int
-	MinLatency    float64 // milliseconds
+	MinLatency    float64
 	MaxLatency    float64
 	AvgLatency    float64
 	P50Latency    float64
 	P95Latency    float64
 	P99Latency    float64
-	Throughput    float64 // requests per second
+	Throughput    float64
 	BytesRead     int64
-	StatusCodes   map[int]int
 }

 // newBenchmarkState creates a new benchmark state for a forward
@@ -454,28 +437,35 @@ const (

 // HTTPLogState maintains the state for HTTP log viewing
 type HTTPLogState struct {
-	forwardID    string
-	forwardAlias string
-	entries      []HTTPLogEntry
-	cursor       int
-	scrollOffset int
-	autoScroll   bool
-
-	// Filtering
-	filterMode   HTTPLogFilterMode
-	filterText   string
-	filterActive bool // true when typing in filter input
+	forwardID     string
+	forwardAlias  string
+	filterText    string
+	copyMessage   string
+	entries       []HTTPLogEntry
+	cursor        int
+	scrollOffset  int
+	filterMode    HTTPLogFilterMode
+	detailScroll  int
+	autoScroll    bool
+	filterActive  bool
+	showingDetail bool
 }

 // HTTPLogEntry represents a single HTTP log entry for display
 type HTTPLogEntry struct {
-	Timestamp  string
-	Direction  string
-	Method     string
-	Path       string
-	StatusCode int
-	LatencyMs  int64
-	BodySize   int
+	RequestHeaders  map[string]string
+	ResponseHeaders map[string]string
+	Method          string
+	RequestID       string
+	Path            string
+	Direction       string
+	Timestamp       string
+	RequestBody     string
+	ResponseBody    string
+	Error           string
+	StatusCode      int
+	LatencyMs       int64
+	BodySize        int
 }

 // newHTTPLogState creates a new HTTP log viewing state
@@ -529,13 +519,6 @@ func (s *HTTPLogState) getFilteredEntries() []HTTPLogEntry {
 	return filtered
 }

-// cycleFilterMode cycles through filter modes
-func (s *HTTPLogState) cycleFilterMode() {
-	s.filterMode = (s.filterMode + 1) % 4
-	s.cursor = 0
-	s.scrollOffset = 0
-}
-
 // getFilterModeLabel returns a label for the current filter mode
 func (s *HTTPLogState) getFilterModeLabel() string {
 	switch s.filterMode {
@@ -285,10 +285,10 @@ func TestClearSearchFilter(t *testing.T) {
 func TestMoveCursorWithFilteredLists(t *testing.T) {
 	tests := []struct {
 		name           string
-		step           AddWizardStep
+		searchFilter   string
 		contexts       []string
 		namespaces     []string
-		searchFilter   string
+		step           AddWizardStep
 		initialCursor  int
 		delta          int
 		expectedCursor int
@@ -16,6 +16,13 @@ var (
 	mutedColor     = lipgloss.Color("241") // Gray
 	accentColor    = lipgloss.Color("63")  // Purple
 	highlightColor = lipgloss.Color("117") // Light blue
+
+	// JSON syntax highlighting colors
+	jsonKeyColor    = lipgloss.Color("81")  // Cyan
+	jsonStringColor = lipgloss.Color("180") // Light orange/tan
+	jsonNumberColor = lipgloss.Color("141") // Light purple
+	jsonBoolColor   = lipgloss.Color("209") // Orange
+	jsonNullColor   = lipgloss.Color("243") // Dark gray
 )

 // Text styles
@@ -84,6 +91,24 @@ var (
 				Foreground(mutedColor)
 )

+// JSON syntax highlighting styles
+var (
+	jsonKeyStyle = lipgloss.NewStyle().
+			Foreground(jsonKeyColor)
+
+	jsonStringStyle = lipgloss.NewStyle().
+			Foreground(jsonStringColor)
+
+	jsonNumberStyle = lipgloss.NewStyle().
+			Foreground(jsonNumberColor)
+
+	jsonBoolStyle = lipgloss.NewStyle().
+			Foreground(jsonBoolColor)
+
+	jsonNullStyle = lipgloss.NewStyle().
+			Foreground(jsonNullColor)
+)
+
 // Container styles
 var (
 	// wizardBoxStyle creates a bordered modal box
@@ -118,7 +143,6 @@ func renderBreadcrumb(parts ...string) string {
 func renderList(items []string, cursor int, prefix string, scrollOffset int) string {
 	var b strings.Builder

-	const viewportHeight = 20
 	totalItems := len(items)

 	// Show scroll up indicator if there are items above the viewport
@@ -128,7 +152,7 @@ func renderList(items []string, cursor int, prefix string, scrollOffset int) str

 	// Calculate visible range
 	start := scrollOffset
-	end := scrollOffset + viewportHeight
+	end := scrollOffset + ViewportHeight
 	if end > totalItems {
 		end = totalItems
 	}
@@ -169,6 +193,96 @@ func renderTextInput(label, value string, valid bool) string {
 	return b.String()
 }

+// wizardHelpWidth returns an appropriate width for wizard help text
+// based on terminal width. For modals, we use a sensible maximum.
+func wizardHelpWidth(termWidth int) int {
+	if termWidth == 0 {
+		termWidth = 80
+	}
+	// Wizard modals shouldn't be wider than 70 chars typically
+	// but on narrow terminals, use available space minus padding
+	maxWidth := 70
+	available := termWidth - 10 // account for modal borders and padding
+	if available < maxWidth {
+		return available
+	}
+	return maxWidth
+}
+
+// wrapHelpText wraps help text to fit within the given width.
+// Help text is expected to be in the format "key: action  key: action  ..."
+// separated by double spaces. On smaller screens, it wraps to multiple lines.
+func wrapHelpText(text string, width int) string {
+	if width <= 0 {
+		width = 80 // Default width
+	}
+
+	// Account for some padding/margin
+	availableWidth := width - 4
+	if availableWidth < 20 {
+		availableWidth = 20
+	}
+
+	// If text fits, return as-is
+	if len(text) <= availableWidth {
+		return helpStyle.Render(text)
+	}
+
+	// Split by double-space separator (common in help text)
+	parts := strings.Split(text, "  ")
+	if len(parts) <= 1 {
+		// No double-space separators, just truncate
+		if len(text) > availableWidth-3 {
+			return helpStyle.Render(text[:availableWidth-3] + "...")
+		}
+		return helpStyle.Render(text)
+	}
+
+	var lines []string
+	var currentLine strings.Builder
+
+	for i, part := range parts {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			continue
+		}
+
+		// Check if adding this part would exceed width
+		addition := part
+		if currentLine.Len() > 0 {
+			addition = "  " + part
+		}
+
+		if currentLine.Len()+len(addition) > availableWidth && currentLine.Len() > 0 {
+			// Start new line
+			lines = append(lines, currentLine.String())
+			currentLine.Reset()
+			currentLine.WriteString(part)
+		} else {
+			if currentLine.Len() > 0 {
+				currentLine.WriteString("  ")
+			}
+			currentLine.WriteString(part)
+		}
+
+		// Handle last part
+		if i == len(parts)-1 && currentLine.Len() > 0 {
+			lines = append(lines, currentLine.String())
+		}
+	}
+
+	// Join with newlines and apply style to each line
+	var result strings.Builder
+	for i, line := range lines {
+		if i > 0 {
+			result.WriteString("\n")
+		}
+		result.WriteString(helpStyle.Render(line))
+	}
+
+	return result.String()
+}
+
 // overlayContent overlays modal content centered on the base view
 // Note: base parameter is kept for API compatibility but not used since
 // lipgloss.Place provides cleaner centering without background artifacts
@@ -1,7 +1,13 @@
 package ui

 import (
+	"bytes"
+	"compress/flate"
+	"compress/gzip"
+	"encoding/json"
 	"fmt"
+	"io"
+	"sort"
 	"strings"
 )

@@ -103,10 +109,11 @@ func (m model) renderSelectContext() string {
 	}

 	b.WriteString("\n")
+	helpWidth := wizardHelpWidth(m.termWidth)
 	if wizard.searchFilter != "" {
-		b.WriteString(helpStyle.Render(fmt.Sprintf("↑/↓: Navigate  Enter: Select  Backspace: Clear filter (%d/%d)  Esc: Cancel", len(wizard.getFilteredContexts()), len(wizard.contexts))))
+		b.WriteString(wrapHelpText(fmt.Sprintf("↑/↓: Navigate  Enter: Select  Backspace: Clear filter (%d/%d)  Esc: Cancel", len(wizard.getFilteredContexts()), len(wizard.contexts)), helpWidth))
 	} else {
-		b.WriteString(helpStyle.Render("Type to filter  ↑/↓: Navigate  Enter: Select  Esc/Ctrl+C: Cancel"))
+		b.WriteString(wrapHelpText("Type to filter  ↑/↓: Navigate  Enter: Select  Esc/Ctrl+C: Cancel", helpWidth))
 	}

 	return b.String()
@@ -144,10 +151,11 @@ func (m model) renderSelectNamespace() string {
 	}

 	b.WriteString("\n")
+	helpWidth := wizardHelpWidth(m.termWidth)
 	if wizard.searchFilter != "" {
-		b.WriteString(helpStyle.Render(fmt.Sprintf("↑/↓: Navigate  Enter: Select  Backspace: Clear filter (%d/%d)  Esc: Back", len(wizard.getFilteredNamespaces()), len(wizard.namespaces))))
+		b.WriteString(wrapHelpText(fmt.Sprintf("↑/↓: Navigate  Enter: Select  Backspace: Clear filter (%d/%d)  Esc: Back", len(wizard.getFilteredNamespaces()), len(wizard.namespaces)), helpWidth))
 	} else {
-		b.WriteString(helpStyle.Render("Type to filter  ↑/↓: Navigate  Enter: Select  Esc: Back  Ctrl+C: Cancel"))
+		b.WriteString(wrapHelpText("Type to filter  ↑/↓: Navigate  Enter: Select  Esc: Back  Ctrl+C: Cancel", helpWidth))
 	}

 	return b.String()
@@ -186,7 +194,7 @@ func (m model) renderSelectResourceType() string {
 	}

 	b.WriteString("\n")
-	b.WriteString(helpStyle.Render("↑/↓: Navigate  Enter: Select  Esc: Back  Ctrl+C: Cancel"))
+	b.WriteString(wrapHelpText("↑/↓: Navigate  Enter: Select  Esc: Back  Ctrl+C: Cancel", wizardHelpWidth(m.termWidth)))

 	return b.String()
 }
@@ -299,14 +307,15 @@ func (m model) renderEnterResource() string {

 	b.WriteString("\n")
 	// Show appropriate help text based on resource type and filter state
+	helpWidth := wizardHelpWidth(m.termWidth)
 	if wizard.selectedResourceType == ResourceTypeService {
 		if wizard.searchFilter != "" {
-			b.WriteString(helpStyle.Render(fmt.Sprintf("↑/↓: Navigate  Enter: Select  Backspace: Clear filter (%d/%d)  Esc: Back", len(wizard.getFilteredServices()), len(wizard.services))))
+			b.WriteString(wrapHelpText(fmt.Sprintf("↑/↓: Navigate  Enter: Select  Backspace: Clear filter (%d/%d)  Esc: Back", len(wizard.getFilteredServices()), len(wizard.services)), helpWidth))
 		} else {
-			b.WriteString(helpStyle.Render("Type to filter  ↑/↓: Navigate  Enter: Select  Esc: Back  Ctrl+C: Cancel"))
+			b.WriteString(wrapHelpText("Type to filter  ↑/↓: Navigate  Enter: Select  Esc: Back  Ctrl+C: Cancel", helpWidth))
 		}
 	} else {
-		b.WriteString(helpStyle.Render("Enter: Continue  Esc: Back  Ctrl+C: Cancel"))
+		b.WriteString(wrapHelpText("Enter: Continue  Esc: Back  Ctrl+C: Cancel", helpWidth))
 	}

 	return b.String()
@@ -397,7 +406,7 @@ func (m model) renderEnterRemotePort() string {
 		}

 		b.WriteString("\n")
-		b.WriteString(helpStyle.Render("↑/↓: Navigate  Enter: Select  Esc: Back  Ctrl+C: Cancel"))
+		b.WriteString(wrapHelpText("↑/↓: Navigate  Enter: Select  Esc: Back  Ctrl+C: Cancel", wizardHelpWidth(m.termWidth)))
 	} else {
 		// Text input mode (no detected ports or user chose manual entry)
 		if len(wizard.detectedPorts) > 0 {
@@ -430,7 +439,7 @@ func (m model) renderEnterRemotePort() string {
 		}

 		b.WriteString("\n")
-		b.WriteString(helpStyle.Render("Enter: Continue  Esc: Back  Ctrl+C: Cancel"))
+		b.WriteString(wrapHelpText("Enter: Continue  Esc: Back  Ctrl+C: Cancel", wizardHelpWidth(m.termWidth)))
 	}

 	return b.String()
@@ -471,7 +480,7 @@ func (m model) renderEnterLocalPort() string {
 	}

 	b.WriteString("\n")
-	b.WriteString(helpStyle.Render("Enter: Continue  Esc: Back  Ctrl+C: Cancel"))
+	b.WriteString(wrapHelpText("Enter: Continue  Esc: Back  Ctrl+C: Cancel", wizardHelpWidth(m.termWidth)))

 	return b.String()
 }
@@ -529,7 +538,7 @@ func (m model) renderConfirmation() string {
 	}

 	b.WriteString("\n")
-	b.WriteString(helpStyle.Render("↑/↓/Tab: Navigate  Enter: Confirm  Esc: Back"))
+	b.WriteString(wrapHelpText("↑/↓/Tab: Navigate  Enter: Confirm  Esc: Back", wizardHelpWidth(m.termWidth)))

 	return b.String()
 }
@@ -572,7 +581,7 @@ func (m model) renderSuccess() string {
 	}

 	b.WriteString("\n")
-	b.WriteString(helpStyle.Render("↑/↓: Navigate  Enter: Select"))
+	b.WriteString(wrapHelpText("↑/↓: Navigate  Enter: Select", wizardHelpWidth(m.termWidth)))

 	return b.String()
 }
@@ -635,7 +644,7 @@ func (m model) renderRemoveSelection() string {
 	selectedCount := wizard.getSelectedCount()
 	b.WriteString(fmt.Sprintf("%d of %d selected\n\n", selectedCount, len(wizard.forwards)))

-	b.WriteString(helpStyle.Render("Space: Toggle  a: All  n: None  Enter: Remove  Esc: Cancel"))
+	b.WriteString(wrapHelpText("Space: Toggle  a: All  n: None  Enter: Remove  Esc: Cancel", wizardHelpWidth(m.termWidth)))

 	return b.String()
 }
@@ -670,7 +679,7 @@ func (m model) renderRemoveConfirmation() string {
 	}

 	b.WriteString("\n")
-	b.WriteString(helpStyle.Render("↑/↓: Navigate  Enter: Confirm  Esc: Cancel"))
+	b.WriteString(wrapHelpText("↑/↓: Navigate  Enter: Confirm  Esc: Cancel", wizardHelpWidth(m.termWidth)))

 	return b.String()
 }
@@ -734,7 +743,7 @@ func (m model) renderBenchmarkConfig() string {
 	b.WriteString("\n")
 	b.WriteString(mutedStyle.Render(fmt.Sprintf("Will send %d requests with %d concurrent workers", state.requests, state.concurrency)))
 	b.WriteString("\n\n")
-	b.WriteString(helpStyle.Render("↑/↓/Tab: Navigate  Type to edit  Enter: Run  Esc: Cancel"))
+	b.WriteString(wrapHelpText("↑/↓/Tab: Navigate  Type to edit  Enter: Run  Esc: Cancel", wizardHelpWidth(m.termWidth)))

 	return b.String()
 }
@@ -774,7 +783,7 @@ func (m model) renderBenchmarkRunning() string {
 	b.WriteString(mutedStyle.Render(fmt.Sprintf("Method: %s  Concurrency: %d", state.method, state.concurrency)))
 	b.WriteString("\n\n")

-	b.WriteString(helpStyle.Render("Please wait..."))
+	b.WriteString(wrapHelpText("Please wait...", wizardHelpWidth(m.termWidth)))

 	return b.String()
 }
@@ -790,14 +799,14 @@ func (m model) renderBenchmarkResults() string {
 	if state.error != nil {
 		b.WriteString(errorStyle.Render(fmt.Sprintf("✗ Error: %v", state.error)))
 		b.WriteString("\n\n")
-		b.WriteString(helpStyle.Render("Press Enter or Esc to return"))
+		b.WriteString(wrapHelpText("Press Enter or Esc to return", wizardHelpWidth(m.termWidth)))
 		return b.String()
 	}

 	if state.results == nil {
 		b.WriteString(mutedStyle.Render("No results available"))
 		b.WriteString("\n\n")
-		b.WriteString(helpStyle.Render("Press Enter or Esc to return"))
+		b.WriteString(wrapHelpText("Press Enter or Esc to return", wizardHelpWidth(m.termWidth)))
 		return b.String()
 	}

@@ -866,7 +875,7 @@ func (m model) renderBenchmarkResults() string {
 	}

 	b.WriteString("\n")
-	b.WriteString(helpStyle.Render("Press Enter or Esc to return"))
+	b.WriteString(wrapHelpText("Press Enter or Esc to return", wizardHelpWidth(m.termWidth)))

 	return b.String()
 }
@@ -894,6 +903,11 @@ func (m model) renderHTTPLog() string {
 	totalEntries := len(filteredEntries)
 	totalUnfiltered := len(state.entries)

+	// If showing detail view, render that instead
+	if state.showingDetail && state.cursor >= 0 && state.cursor < len(filteredEntries) {
+		return m.renderHTTPLogDetail(filteredEntries[state.cursor], termWidth, termHeight)
+	}
+
 	// Build output
 	var b strings.Builder

@@ -1065,8 +1079,484 @@ func (m model) renderHTTPLog() string {
 	}
 	b.WriteString("\n")

-	// Help line at bottom
-	b.WriteString(helpStyle.Render("  ↑/↓/PgUp/PgDn: Navigate  g/G: Top/Bottom  a: Auto-scroll  f: Filter  /: Search  c: Clear  q: Close"))
+	// Help line at bottom (wrap for smaller screens)
+	helpText := "↑/↓: Navigate  Enter: Details  a: Auto-scroll  f: Filter  /: Search  c: Clear  q: Close"
+	b.WriteString("  ")
+	b.WriteString(wrapHelpText(helpText, termWidth-4))

 	return b.String()
 }
+
+// renderHTTPLogDetail renders the detailed view of a single HTTP log entry
+func (m model) renderHTTPLogDetail(entry HTTPLogEntry, termWidth, termHeight int) string {
+	var b strings.Builder
+
+	// Header
+	title := wizardHeaderStyle.Render("HTTP Request Detail")
+	b.WriteString(title)
+	b.WriteString("\n\n")
+
+	// Build content lines for scrolling
+	var lines []string
+
+	// Request summary
+	lines = append(lines, accentStyle.Render("─── Request ───────────────────────────────────────────"))
+	lines = append(lines, "")
+	lines = append(lines, fmt.Sprintf("  %s %s", successStyle.Render(entry.Method), entry.Path))
+	lines = append(lines, fmt.Sprintf("  Time: %s", entry.Timestamp))
+	lines = append(lines, "")
+
+	// Request headers (sorted alphabetically)
+	if len(entry.RequestHeaders) > 0 {
+		lines = append(lines, accentStyle.Render("  Request Headers:"))
+		headerKeys := make([]string, 0, len(entry.RequestHeaders))
+		for k := range entry.RequestHeaders {
+			headerKeys = append(headerKeys, k)
+		}
+		sort.Strings(headerKeys)
+		for _, k := range headerKeys {
+			v := entry.RequestHeaders[k]
+			// Truncate long header values
+			if len(v) > termWidth-20 {
+				v = v[:termWidth-23] + "..."
+			}
+			lines = append(lines, fmt.Sprintf("    %s: %s", mutedStyle.Render(k), v))
+		}
+		lines = append(lines, "")
+	}
+
+	// Request body
+	if entry.RequestBody != "" {
+		lines = append(lines, accentStyle.Render("  Request Body:"))
+		// Decompress if needed, then check if binary
+		reqBody := decompressContent(entry.RequestBody, entry.RequestHeaders)
+		if isBinaryContent(reqBody, entry.RequestHeaders) {
+			lines = append(lines, mutedStyle.Render("    [Binary data - not displayed]"))
+			if ct := entry.RequestHeaders["Content-Type"]; ct != "" {
+				lines = append(lines, mutedStyle.Render(fmt.Sprintf("    Content-Type: %s", ct)))
+			}
+		} else {
+			// Format JSON if applicable
+			reqBody = formatJSONContent(reqBody, entry.RequestHeaders)
+			bodyLines := strings.Split(reqBody, "\n")
+			for _, line := range bodyLines {
+				// Truncate long lines
+				if len(line) > termWidth-6 {
+					line = line[:termWidth-9] + "..."
+				}
+				lines = append(lines, "    "+line)
+			}
+		}
+		lines = append(lines, "")
+	}
+
+	// Response summary
+	lines = append(lines, "")
+	lines = append(lines, accentStyle.Render("─── Response ──────────────────────────────────────────"))
+	lines = append(lines, "")
+
+	// Status code with coloring
+	statusStr := fmt.Sprintf("%d", entry.StatusCode)
+	if entry.StatusCode >= 500 {
+		statusStr = errorStyle.Render(statusStr)
+	} else if entry.StatusCode >= 400 {
+		statusStr = warningStyle.Render(statusStr)
+	} else if entry.StatusCode >= 200 && entry.StatusCode < 300 {
+		statusStr = successStyle.Render(statusStr)
+	}
+	lines = append(lines, fmt.Sprintf("  Status: %s", statusStr))
+
+	// Timing
+	latencyStr := ""
+	if entry.LatencyMs >= 1000 {
+		latencyStr = fmt.Sprintf("%.2fs", float64(entry.LatencyMs)/1000)
+	} else {
+		latencyStr = fmt.Sprintf("%dms", entry.LatencyMs)
+	}
+	lines = append(lines, fmt.Sprintf("  Latency: %s", latencyStr))
+	lines = append(lines, fmt.Sprintf("  Body Size: %d bytes", entry.BodySize))
+	lines = append(lines, "")
+
+	// Response headers (sorted alphabetically)
+	if len(entry.ResponseHeaders) > 0 {
+		lines = append(lines, accentStyle.Render("  Response Headers:"))
+		headerKeys := make([]string, 0, len(entry.ResponseHeaders))
+		for k := range entry.ResponseHeaders {
+			headerKeys = append(headerKeys, k)
+		}
+		sort.Strings(headerKeys)
+		for _, k := range headerKeys {
+			v := entry.ResponseHeaders[k]
+			// Truncate long header values
+			if len(v) > termWidth-20 {
+				v = v[:termWidth-23] + "..."
+			}
+			lines = append(lines, fmt.Sprintf("    %s: %s", mutedStyle.Render(k), v))
+		}
+		lines = append(lines, "")
+	}
+
+	// Response body
+	if entry.ResponseBody != "" {
+		lines = append(lines, accentStyle.Render("  Response Body:"))
+		// Decompress if needed, then check if binary
+		respBody := decompressContent(entry.ResponseBody, entry.ResponseHeaders)
+		if isBinaryContent(respBody, entry.ResponseHeaders) {
+			lines = append(lines, mutedStyle.Render("    [Binary data - not displayed]"))
+			if ct := entry.ResponseHeaders["Content-Type"]; ct != "" {
+				lines = append(lines, mutedStyle.Render(fmt.Sprintf("    Content-Type: %s", ct)))
+			}
+		} else {
+			// Format JSON if applicable
+			respBody = formatJSONContent(respBody, entry.ResponseHeaders)
+			bodyLines := strings.Split(respBody, "\n")
+			for _, line := range bodyLines {
+				// Truncate long lines
+				if len(line) > termWidth-6 {
+					line = line[:termWidth-9] + "..."
+				}
+				lines = append(lines, "    "+line)
+			}
+		}
+		lines = append(lines, "")
+	}
+
+	// Error if present
+	if entry.Error != "" {
+		lines = append(lines, "")
+		lines = append(lines, errorStyle.Render("  Error: "+entry.Error))
+		lines = append(lines, "")
+	}
+
+	// Calculate visible range based on scroll
+	viewportHeight := termHeight - 6 // header, footer, help
+	if viewportHeight < 5 {
+		viewportHeight = 5
+	}
+
+	state := m.ui.httpLogState
+	scroll := state.detailScroll
+
+	// Clamp scroll to valid range
+	maxScroll := len(lines) - viewportHeight
+	if maxScroll < 0 {
+		maxScroll = 0
+	}
+	if scroll > maxScroll {
+		scroll = maxScroll
+		state.detailScroll = scroll
+	}
+
+	// Render visible lines
+	end := scroll + viewportHeight
+	if end > len(lines) {
+		end = len(lines)
+	}
+
+	for i := scroll; i < end; i++ {
+		b.WriteString(lines[i])
+		b.WriteString("\n")
+	}
+
+	// Pad remaining space
+	for i := end - scroll; i < viewportHeight; i++ {
+		b.WriteString("\n")
+	}
+
+	// Scroll indicator
+	if len(lines) > viewportHeight {
+		percent := 0
+		if maxScroll > 0 {
+			percent = (scroll * 100) / maxScroll
+		}
+		b.WriteString(mutedStyle.Render(fmt.Sprintf("\n  [%d%%] ", percent)))
+	} else {
+		b.WriteString("\n  ")
+	}
+
+	// Show copy message if present, otherwise show help
+	if state.copyMessage != "" {
+		b.WriteString(successStyle.Render(state.copyMessage))
+		b.WriteString("  ")
+		b.WriteString(wrapHelpText("↑/↓: Scroll  c: Copy  Esc: Back", termWidth-10))
+	} else {
+		b.WriteString(wrapHelpText("↑/↓/PgUp/PgDn: Scroll  g: Top  c: Copy response  Esc: Back", termWidth-10))
+	}
+
+	return b.String()
+}
+
+// decompressContent attempts to decompress content based on Content-Encoding header.
+// Returns the decompressed content if successful, or original content if not compressed or on error.
+func decompressContent(content string, headers map[string]string) string {
+	enc := headers["Content-Encoding"]
+	if enc == "" {
+		return content
+	}
+
+	data := []byte(content)
+	var reader io.ReadCloser
+	var err error
+
+	switch enc {
+	case "gzip":
+		reader, err = gzip.NewReader(bytes.NewReader(data))
+		if err != nil {
+			return content // Return original on error
+		}
+		defer reader.Close()
+	case "deflate":
+		reader = flate.NewReader(bytes.NewReader(data))
+		defer reader.Close()
+	default:
+		// br (brotli), compress, zstd - not in stdlib, return original
+		return content
+	}
+
+	decompressed, err := io.ReadAll(reader)
+	if err != nil {
+		return content // Return original on error
+	}
+
+	return string(decompressed)
+}
+
+// isBinaryContent checks if content is binary and shouldn't be displayed as text
+func isBinaryContent(content string, headers map[string]string) bool {
+	// Check Content-Type for binary types
+	if ct := headers["Content-Type"]; ct != "" {
+		// Binary content types
+		binaryPrefixes := []string{
+			"image/", "audio/", "video/", "application/octet-stream",
+			"application/zip", "application/gzip", "application/pdf",
+			"application/x-gzip", "application/x-tar", "application/x-bzip",
+		}
+		for _, prefix := range binaryPrefixes {
+			if strings.HasPrefix(ct, prefix) {
+				return true
+			}
+		}
+	}
+
+	// Check for non-printable characters in the content
+	// If more than 10% of first 200 bytes are non-printable, treat as binary
+	checkLen := len(content)
+	if checkLen > 200 {
+		checkLen = 200
+	}
+	nonPrintable := 0
+	for i := 0; i < checkLen; i++ {
+		c := content[i]
+		// Allow printable ASCII, newline, carriage return, tab
+		if c < 32 && c != '\n' && c != '\r' && c != '\t' {
+			nonPrintable++
+		}
+		// Check for bytes outside ASCII range (common in compressed/binary data)
+		if c > 126 {
+			nonPrintable++
+		}
+	}
+	if checkLen > 0 && float64(nonPrintable)/float64(checkLen) > 0.1 {
+		return true
+	}
+
+	return false
+}
+
+// formatJSONContent attempts to pretty-print and colorize JSON content.
+// Returns the formatted JSON if valid, or original content if not JSON.
+func formatJSONContent(content string, headers map[string]string) string {
+	// Check Content-Type for JSON
+	ct := headers["Content-Type"]
+	isJSON := strings.Contains(ct, "application/json") || strings.Contains(ct, "+json")
+
+	// If not explicitly JSON, try to detect by content
+	if !isJSON {
+		trimmed := strings.TrimSpace(content)
+		// Quick check: must start with { or [ to be JSON
+		if len(trimmed) == 0 || (trimmed[0] != '{' && trimmed[0] != '[') {
+			return content
+		}
+	}
+
+	// Try to parse and format
+	var data interface{}
+	if err := json.Unmarshal([]byte(content), &data); err != nil {
+		return content // Not valid JSON
+	}
+
+	formatted, err := json.MarshalIndent(data, "", "  ")
+	if err != nil {
+		return content
+	}
+
+	// Colorize the formatted JSON
+	return colorizeJSON(string(formatted))
+}
+
+// colorizeJSON applies syntax highlighting to formatted JSON.
+// It processes line by line to handle the indented output from MarshalIndent.
+func colorizeJSON(jsonStr string) string {
+	var result strings.Builder
+	lines := strings.Split(jsonStr, "\n")
+
+	for i, line := range lines {
+		result.WriteString(colorizeLine(line))
+		if i < len(lines)-1 {
+			result.WriteString("\n")
+		}
+	}
+
+	return result.String()
+}
+
+// colorizeLine colorizes a single line of formatted JSON
+func colorizeLine(line string) string {
+	// Find leading whitespace
+	trimmed := strings.TrimLeft(line, " \t")
+	indent := line[:len(line)-len(trimmed)]
+
+	if len(trimmed) == 0 {
+		return line
+	}
+
+	var result strings.Builder
+	result.WriteString(indent)
+
+	// Check for key: value pattern (key starts with ")
+	if strings.HasPrefix(trimmed, "\"") {
+		// Find the end of the key
+		colonIdx := strings.Index(trimmed, "\":")
+		if colonIdx > 0 {
+			// This is a key-value line
+			key := trimmed[:colonIdx+1] // includes the closing quote
+			rest := trimmed[colonIdx+1:]
+
+			// Colorize the key (without quotes for cleaner look, or with - let's keep quotes)
+			result.WriteString(jsonKeyStyle.Render(key))
+			result.WriteString(":")
+
+			// rest starts after the colon
+			if len(rest) > 1 {
+				value := strings.TrimPrefix(rest, " ")
+				hasComma := strings.HasSuffix(value, ",")
+				if hasComma {
+					value = value[:len(value)-1]
+				}
+
+				result.WriteString(" ")
+				result.WriteString(colorizeValue(value))
+				if hasComma {
+					result.WriteString(",")
+				}
+			}
+			return result.String()
+		}
+	}
+
+	// Not a key-value line, could be array element or structural
+	// Check for array values or closing braces
+	hasComma := strings.HasSuffix(trimmed, ",")
+	value := trimmed
+	if hasComma {
+		value = value[:len(value)-1]
+	}
+
+	result.WriteString(colorizeValue(value))
+	if hasComma {
+		result.WriteString(",")
+	}
+
+	return result.String()
+}
+
+// colorizeValue colorizes a JSON value (string, number, bool, null, or structural)
+func colorizeValue(value string) string {
+	value = strings.TrimSpace(value)
+
+	if len(value) == 0 {
+		return value
+	}
+
+	// Structural characters - no color
+	if value == "{" || value == "}" || value == "[" || value == "]" ||
+		value == "{}" || value == "[]" {
+		return value
+	}
+
+	// Null
+	if value == "null" {
+		return jsonNullStyle.Render(value)
+	}
+
+	// Boolean
+	if value == "true" || value == "false" {
+		return jsonBoolStyle.Render(value)
+	}
+
+	// String (starts and ends with quotes)
+	if strings.HasPrefix(value, "\"") && strings.HasSuffix(value, "\"") {
+		return jsonStringStyle.Render(value)
+	}
+
+	// Number (try to detect)
+	if isJSONNumber(value) {
+		return jsonNumberStyle.Render(value)
+	}
+
+	// Unknown - return as is
+	return value
+}
+
+// isJSONNumber checks if a string looks like a JSON number
+func isJSONNumber(s string) bool {
+	if len(s) == 0 {
+		return false
+	}
+
+	i := 0
+	// Optional negative sign
+	if s[0] == '-' {
+		i++
+		if i >= len(s) {
+			return false
+		}
+	}
+
+	// Must have at least one digit
+	if s[i] < '0' || s[i] > '9' {
+		return false
+	}
+
+	// Skip digits
+	for i < len(s) && s[i] >= '0' && s[i] <= '9' {
+		i++
+	}
+
+	// Optional decimal part
+	if i < len(s) && s[i] == '.' {
+		i++
+		if i >= len(s) || s[i] < '0' || s[i] > '9' {
+			return false
+		}
+		for i < len(s) && s[i] >= '0' && s[i] <= '9' {
+			i++
+		}
+	}
+
+	// Optional exponent
+	if i < len(s) && (s[i] == 'e' || s[i] == 'E') {
+		i++
+		if i < len(s) && (s[i] == '+' || s[i] == '-') {
+			i++
+		}
+		if i >= len(s) || s[i] < '0' || s[i] > '9' {
+			return false
+		}
+		for i < len(s) && s[i] >= '0' && s[i] <= '9' {
+			i++
+		}
+	}
+
+	return i == len(s)
+}
@@ -1,3 +1,15 @@
+// Package version provides version checking against GitHub releases.
+// It queries the GitHub API to check for newer versions of kportal
+// and provides update notifications.
+//
+// Basic usage:
+//
+//	info, err := version.CheckForUpdate(ctx, "owner", "repo", "v1.0.0")
+//	if err != nil {
+//	    log.Printf("Version check failed: %v", err)
+//	} else if info.UpdateAvailable {
+//	    fmt.Printf("Update available: %s -> %s\n", info.CurrentVersion, info.LatestVersion)
+//	}
 package version

 import (
@@ -33,10 +45,10 @@ type UpdateInfo struct {

 // Checker checks for new versions on GitHub
 type Checker struct {
+	client  *http.Client
 	owner   string
 	repo    string
 	current string
-	client  *http.Client
 }

 // NewChecker creates a new version checker
@@ -144,15 +156,9 @@ func parseVersion(v string) []int {

 	for _, p := range parts {
 		var num int
-		fmt.Sscanf(p, "%d", &num)
+		_, _ = fmt.Sscanf(p, "%d", &num)
 		result = append(result, num)
 	}

 	return result
 }
-
-// FormatUpdateMessage formats a user-friendly update notification
-func (u *UpdateInfo) FormatUpdateMessage() string {
-	return fmt.Sprintf("New version available: %s (current: %s) - %s",
-		u.LatestVersion, u.CurrentVersion, u.ReleaseURL)
-}
@@ -75,16 +75,3 @@ func TestIsNewerVersion(t *testing.T) {
 		})
 	}
 }
-
-func TestUpdateInfo_FormatUpdateMessage(t *testing.T) {
-	info := &UpdateInfo{
-		CurrentVersion: "0.1.0",
-		LatestVersion:  "0.2.0",
-		ReleaseURL:     "https://github.com/nvm/kportal/releases/tag/v0.2.0",
-	}
-
-	msg := info.FormatUpdateMessage()
-	assert.Contains(t, msg, "0.2.0")
-	assert.Contains(t, msg, "0.1.0")
-	assert.Contains(t, msg, "https://github.com/nvm/kportal/releases/tag/v0.2.0")
-}
Author	SHA1	Message	Date
lukaszraczylo	4eff5ff5eb	Update go.mod and go.sum (#38 )	2026-02-04 03:53:00 +00:00
lukaszraczylo	b9b7d5ec87	Update go.mod and go.sum (#37 )	2026-02-02 03:57:42 +00:00
lukaszraczylo	bc3b61e778	Update go.mod and go.sum (#36 )	2026-01-28 03:40:33 +00:00
lukaszraczylo	676fd3df39	Update go.mod and go.sum (#35 )	2026-01-26 03:45:09 +00:00
lukaszraczylo	00380ca307	Update go.mod and go.sum (#34 )	2026-01-25 03:43:03 +00:00
lukaszraczylo	e4930071fc	Update go.mod and go.sum (#33 )	2026-01-23 03:40:40 +00:00
lukaszraczylo	c43aca3805	Update go.mod and go.sum (#32 )	2026-01-19 03:42:14 +00:00
lukaszraczylo	4add04e3be	Update go.mod and go.sum (#31 )	2026-01-16 03:39:04 +00:00
lukaszraczylo	96ae1d45e0	style: Extract UI constants and refactor main view rendering (#30 ) - [x] Add golangci-lint configuration with gocritic ifElseChain disabled - [x] Rename error variables to avoid shadowing (createErr, watcherErr, watchErr, etc.) - [x] Replace `interface{}` with `any` type alias throughout codebase - [x] Add package-level documentation comments to all internal packages - [x] Reorder struct fields alphabetically for consistency - [x] Extract UI constants (terminal dimensions, column widths, colors) to constants.go - [x] Refactor BubbleTeaUI main view rendering into smaller helper functions - [x] Simplify nested conditionals and improve code clarity - [x] Add `isForwardDisabled()` helper method to BubbleTeaUI - [x] Update file permissions from 0644 to 0600 in config tests - [x] Add `#nosec` comments and error suppression where appropriate - [x] Improve test table struct field ordering for readability - [x] Fix resource parsing in AddForward using strings.SplitN - [x] Add comprehensive tests for new UI helper functions and constants	2026-01-13 09:37:45 +00:00
lukaszraczylo	3d71f64901	Update go.mod and go.sum (#29 )	2026-01-13 03:39:00 +00:00
lukaszraczylo	38b7a06c53	Update go.mod and go.sum (#28 )	2026-01-12 03:41:55 +00:00
lukaszraczylo	7ad96e3f72	Update go.mod and go.sum (#27 )	2026-01-10 03:37:23 +00:00
lukaszraczylo	ac7c855de5	Update go.mod and go.sum (#26 )	2026-01-09 03:39:39 +00:00
lukaszraczylo	4074a7186c	Update go.mod and go.sum (#25 )	2026-01-07 03:39:19 +00:00
lukaszraczylo	a5cc95a26e	Update go.mod and go.sum (#24 )	2025-12-23 03:39:14 +00:00
lukaszraczylo	0f977683cd	Update go.mod and go.sum (#23 )	2025-12-21 03:39:29 +00:00
lukaszraczylo	dcebdf718a	Update go.mod and go.sum (#22 )	2025-12-20 03:32:25 +00:00
lukaszraczylo	5967f26c21	Update go.mod and go.sum (#21 )	2025-12-19 03:37:51 +00:00
lukaszraczylo	285ced6755	fixup! Update go.mod and go.sum (#20 )	2025-12-18 09:38:02 +00:00
lukaszraczylo	9fe076acb2	Update go.mod and go.sum (#20 )	2025-12-18 03:37:26 +00:00
lukaszraczylo	92746efcf5	Update go.mod and go.sum (#19 )	2025-12-15 03:40:40 +00:00
lukaszraczylo	391bce366d	fixup! fixup! Add artifacts signing.	2025-12-15 00:16:16 +00:00
lukaszraczylo	9fd8f9b03b	fixup! Add artifacts signing.	2025-12-14 23:56:42 +00:00
lukaszraczylo	7032bb5bee	Add artifacts signing.	2025-12-14 23:29:27 +00:00
lukaszraczylo	6cb4f91ece	Cleanup and refactor.	2025-12-14 18:17:20 +00:00
lukaszraczylo	5d600043f0	Update go.mod and go.sum (#18 )	2025-12-13 03:32:36 +00:00
lukaszraczylo	9bb6fbc48d	Update go.mod and go.sum (#17 )	2025-12-12 03:38:34 +00:00
lukaszraczylo	f4334ebdc9	Update go.mod and go.sum (#16 )	2025-12-11 03:38:45 +00:00
lukaszraczylo	50f94bda87	Update go.mod and go.sum (#15 )	2025-12-09 01:13:24 +00:00
lukaszraczylo	d9888f1a56	Cleanup (#14 ) * Codebase cleanup	2025-12-09 01:06:38 +00:00
lukaszraczylo	7dec532e18	Use shared PR workflow	2025-12-08 01:32:30 +00:00
lukaszraczylo	aa7695b3be	Trigger autoupdate.	2025-12-08 01:10:11 +00:00
lukaszraczylo	1bacd31f27	fixup! Add verified param to the releaser.	2025-12-07 16:40:37 +00:00
lukaszraczylo	bfecbdf056	Add verified param to the releaser.	2025-12-07 14:40:12 +00:00
lukaszraczylo	754108474c	fixup! fixup! fixup! Update gorelease config and docs - moving to cask due to depreciation	2025-12-07 14:36:45 +00:00
lukaszraczylo	690c587c0a	fixup! fixup! Update gorelease config and docs - moving to cask due to depreciation	2025-12-07 14:16:43 +00:00
lukaszraczylo	0d03f228f9	fixup! Update gorelease config and docs - moving to cask due to depreciation	2025-12-07 14:04:38 +00:00
lukaszraczylo	2a44c6ff9c	Update gorelease config and docs - moving to cask due to depreciation	2025-12-07 13:59:51 +00:00
lukaszraczylo	8672d932bb	Move build and release to shared workflow	2025-12-07 13:34:14 +00:00
lukaszraczylo	87317adb91	Move to shared workflow.	2025-12-07 13:16:41 +00:00
lukaszraczylo	ced7e80a06	Update the autoupdate workflow	2025-12-07 12:35:56 +00:00
lukaszraczylo	13723733df	Update autoupdate workflow. LOL.	2025-12-03 00:47:06 +00:00
lukaszraczylo	9538623bcb	Remove unused struct	2025-12-02 18:13:05 +00:00
lukaszraczylo	8bb377909c	Add startupSettleTime to zeroconf to avoid race conditions.	2025-12-02 18:06:11 +00:00
lukaszraczylo	263a0370d3	fixup! fixup! Fix autoupdate workflow.	2025-12-01 14:39:54 +00:00
lukaszraczylo	62eca4a9a1	Update go.mod and go.sum Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-12-01 14:34:23 +00:00
lukaszraczylo	ea20a037b9	fixup! Fix autoupdate workflow.	2025-12-01 14:31:06 +00:00
lukaszraczylo	46db732f87	Fix autoupdate workflow.	2025-12-01 14:24:34 +00:00
lukaszraczylo	a297ba7073	Enhancement: Empty config When user starts kportal for the first time, and there is no config file, kportal should create an empty config file with default values and empty forwarding rules, so that user can easily edit the config file and add their own rules.	2025-11-29 12:44:33 +00:00
lukaszraczylo	518879dc56	Update menus to wrap for smaller screens.	2025-11-29 02:09:54 +00:00
lukaszraczylo	649227b201	Update taps confusion.	2025-11-29 01:39:21 +00:00
lukaszraczylo	28e2fc315a	Create CNAME	2025-11-28 00:29:37 +00:00
lukaszraczylo	ba77cb6aa9	Use OS native copy.	2025-11-26 13:28:20 +00:00
lukaszraczylo	23cd45a3d7	improvements nov2025 pt2 (#13 ) * Further improvements \| Fix \| Impact \| Files Modified \| \|------------------------------------\|----------------------------------------\|--------------------------------------\| \| sync.Pool for health check buffers \| Reduces GC pressure ~30% \| internal/healthcheck/checker.go \| \| Goroutine leak fix + sync.Once \| Prevents memory leaks \| internal/forward/worker.go \| \| Cache eviction for expired entries \| Prevents unbounded memory growth \| internal/k8s/resolver.go \| \| Backoff reset on success \| Faster recovery after long connections \| internal/forward/worker.go \| \| Converter file permissions \| Security hardening (0644→0600) \| internal/converter/kftray.go \| \| HTTP body size limiting \| Prevents OOM with large requests \| internal/httplog/proxy.go, logger.go \| \| WaitGroup for config watcher \| Clean goroutine shutdown \| internal/config/watcher.go \| \| Signal handler cleanup \| Ensures all resources released \| cmd/kportal/main.go \| * Additional event bus for internal event handling \| Metric \| Before \| After \| Improvement \| \|------------------------\|---------------------------------------\|-------------------\|--------------------\| \| Goroutines per forward \| 3 (worker + heartbeat + health check) \| 1 (worker only) \| 66% reduction \| \| Tickers per forward \| 2 (heartbeat + health check) \| 0 \| 100% reduction \| \| Global goroutines \| 2 (watchdog + health monitor) \| 2 \| Same \| \| Lock acquisitions/sec \| O(n) per interval \| O(1) per interval \| Linear improvement \| * Add UI testing * Add mocks * Add more logs and details to be displayed	2025-11-26 13:18:50 +00:00
lukaszraczylo	dbbc96a200	Improve mobile responsiveness for documentation website (#12 )	2025-11-25 21:42:15 +00:00
lukaszraczylo	2498a3aa98	improvements nov2025 (#11 ) * Add benchmark and httplog modules, update UI for modals artefacts	2025-11-25 19:06:17 +00:00