@agentrific/server 0.5.1 → 0.6.0

package/cli.js

@@ -30,7 +30,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@agentrific/server",
-      version: "0.5.1",
+      version: "0.6.0",
       description: "Self-hosted control plane for long-running coding agents",
       keywords: [
         "agentrific",
@@ -80,6 +80,7 @@ var init_package = __esm({
       },
       devDependencies: {
         "@agentrific/contracts": "workspace:*",
+        "@agentrific/opentunnel-runtime": "workspace:*",
         "@jest/globals": "30.5.2",
         "@types/node": "^22.19.1",
         "@types/qrcode-terminal": "^0.12.2",
@@ -203,6 +204,21 @@ var init_updates = __esm({
   }
 });
 
+// ../../packages/contracts/src/control-socket.ts
+import { createHash } from "node:crypto";
+import { join, resolve } from "node:path";
+function controlSocketPath(directory, uid = process.getuid?.()) {
+  const direct = join(resolve(directory), "control.sock");
+  if (Buffer.byteLength(direct) < 100) return direct;
+  if (uid === void 0) throw new Error("Local control sockets require macOS or Linux.");
+  const digest2 = createHash("sha256").update(resolve(directory)).digest("hex").slice(0, 32);
+  return join("/tmp", `agentrific-${uid}`, `${digest2}.sock`);
+}
+var init_control_socket = __esm({
+  "../../packages/contracts/src/control-socket.ts"() {
+  }
+});
+
 // ../../packages/contracts/src/index.ts
 import { z as z2 } from "zod";
 function cronRange(base, min, max, stepped) {
@@ -590,7 +606,7 @@ var init_src = __esm({
 
 // src/control.ts
 import { createServer, createConnection } from "node:net";
-import { chmod, mkdir as mkdir2, readFile, unlink as unlink2, writeFile as writeFile2 } from "node:fs/promises";
+import { chmod, mkdir as mkdir2, lstat, readFile, unlink as unlink2, writeFile as writeFile2 } from "node:fs/promises";
 import path2 from "node:path";
 import { Effect as Effect2 } from "effect";
 import { z as z3 } from "zod";
@@ -635,8 +651,14 @@ async function acquireServerLock(directory) {
       await unlink2(filename);
   };
 }
-async function startControl(directory, security2, status, maintenance2) {
-  const filename = path2.join(directory, "control.sock");
+async function startControl(directory, security2, status, maintenance2, shutdown, phone2) {
+  const filename = controlSocketPath(directory);
+  const socketDirectory = path2.dirname(filename);
+  await mkdir2(socketDirectory, { recursive: true, mode: 448 });
+  const metadata = await lstat(socketDirectory);
+  if (!metadata.isDirectory() || metadata.uid !== process.getuid?.())
+    throw new Error("Local control directory must be private and owned by this user.");
+  await chmod(socketDirectory, 448);
   await unlink2(filename).catch((error) => {
     if (!z3.object({ code: z3.literal("ENOENT") }).safeParse(error).success) throw error;
   });
@@ -656,6 +678,36 @@ async function startControl(directory, security2, status, maintenance2) {
           const request = ControlRequest.parse(JSON.parse(buffer.split("\n")[0]));
           let result;
           switch (request.command) {
+            case "phone-options":
+              if (!phone2) throw new Error("Phone connections are managed by the desktop app.");
+              socket.setTimeout(18e4);
+              result = await phone2.options();
+              break;
+            case "phone-start": {
+              if (!phone2) throw new Error("Phone connections are managed by the desktop app.");
+              maintenance2?.assertReady();
+              socket.setTimeout(18e4);
+              const abort = new AbortController();
+              const disconnected = () => abort.abort();
+              socket.once("close", disconnected);
+              try {
+                result = await phone2.start(request.provider, abort.signal);
+              } finally {
+                socket.removeListener("close", disconnected);
+              }
+              break;
+            }
+            case "phone-stop":
+              if (!phone2) throw new Error("Phone connections are managed by the desktop app.");
+              result = await phone2.close();
+              break;
+            case "shutdown":
+              if (!shutdown || !maintenance2?.status().drained)
+                throw new Error("Drain the server before shutdown");
+              socket.end(JSON.stringify({ result: { shutdown: true } }) + "\n", () => {
+                setImmediate(() => void shutdown());
+              });
+              return;
             case "pair":
               result = security2.createPairing();
               break;
@@ -682,20 +734,20 @@ async function startControl(directory, security2, status, maintenance2) {
     });
     socket.on("error", () => socket.destroy());
   });
-  await new Promise((resolve, reject) => {
+  await new Promise((resolve2, reject) => {
     server.once("error", reject);
-    server.listen(filename, resolve);
+    server.listen(filename, resolve2);
   });
   await chmod(filename, 384);
   return async () => {
     await new Promise(
-      (resolve, reject) => server.close((error) => error ? reject(error) : resolve())
+      (resolve2, reject) => server.close((error) => error ? reject(error) : resolve2())
     );
   };
 }
 function controlRequest(directory, command) {
-  return new Promise((resolve, reject) => {
-    const socket = createConnection(path2.join(directory, "control.sock"));
+  return new Promise((resolve2, reject) => {
+    const socket = createConnection(controlSocketPath(directory));
     socket.setTimeout(command.command === "maintenance" ? 65e3 : 5e3, () => {
       socket.destroy();
       reject(new Error("Server did not respond."));
@@ -711,18 +763,20 @@ function controlRequest(directory, command) {
         const result = z3.object({ result: ControlResultSchema.optional(), error: z3.string().optional() }).parse(JSON.parse(response));
         if (result.error) throw new Error(result.error);
         if (!result.result) throw new Error("Server returned an empty response.");
-        resolve(result.result);
+        resolve2(result.result);
       } catch (error) {
         reject(error);
       }
     });
   });
 }
-var MaintenanceSchema, ControlStatusSchema, ControlResultSchema, ControlRequest;
+var ProviderSchema, MaintenanceSchema, ControlStatusSchema, ControlResultSchema, ControlRequest;
 var init_control = __esm({
   "src/control.ts"() {
     "use strict";
+    init_control_socket();
     init_src();
+    ProviderSchema = z3.enum(["opentunnel", "tailscale", "cloudflared"]);
     MaintenanceSchema = z3.object({
       active: z3.boolean(),
       drained: z3.boolean(),
@@ -731,6 +785,8 @@ var init_control = __esm({
     ControlStatusSchema = z3.object({
       serverId: z3.string().uuid(),
       publicUrl: z3.string().optional(),
+      phoneProvider: ProviderSchema.nullable().optional(),
+      localUrl: z3.string().optional(),
       serverVersion: z3.string().optional(),
       connectedDevices: z3.number().optional(),
       connectedSockets: z3.number().optional(),
@@ -739,6 +795,8 @@ var init_control = __esm({
       maintenance: MaintenanceSchema.optional()
     });
     ControlResultSchema = z3.union([
+      z3.object({ provider: ProviderSchema.nullable(), publicUrl: z3.string().url().nullable() }),
+      z3.array(z3.object({ provider: ProviderSchema, available: z3.boolean(), reason: z3.string() })),
       z3.object({
         pairingId: z3.string(),
         pin: z3.string(),
@@ -748,12 +806,17 @@ var init_control = __esm({
       DeviceSchema.array(),
       ControlStatusSchema,
       z3.object({ revoked: z3.boolean() }),
+      z3.object({ shutdown: z3.literal(true) }),
       MaintenanceSchema
     ]);
     ControlRequest = z3.discriminatedUnion("command", [
+      z3.object({ command: z3.literal("phone-options") }),
+      z3.object({ command: z3.literal("phone-start"), provider: ProviderSchema }),
+      z3.object({ command: z3.literal("phone-stop") }),
       z3.object({ command: z3.literal("pair") }),
       z3.object({ command: z3.literal("devices") }),
       z3.object({ command: z3.literal("status") }),
+      z3.object({ command: z3.literal("shutdown") }),
       z3.object({ command: z3.literal("revoke"), id: z3.string().uuid() }),
       z3.object({
         command: z3.literal("maintenance"),
@@ -823,6 +886,7 @@ function printHelp() {
   for (const [option, description] of [
     ["--data-dir <path>", "Use a specific server data directory"],
     ["--public-url <https-url>", "Use your tunnel URL without prompting"],
+    ["--connection <method>", "opentunnel (default), tailscale, cloudflared, existing, or local"],
     ["--no-interactive", "Disable prompts and keyboard shortcuts"],
     ["--show-payload", "Print manual JSON with the pairing QR code"],
     ["--timeout-ms <0-60000>", "Set the maintenance drain timeout"],
@@ -830,7 +894,9 @@ function printHelp() {
     ["--help", "Show this help"]
   ])
     console.log(`  ${styleText("cyan", option.padEnd(34))}${description}`);
-  console.log("\n  Connect using Tailscale Serve, cloudflared, or another HTTPS tunnel.\n");
+  console.log(
+    "\n  OpenTunnel is built in. Tailscale, cloudflared and existing HTTPS tunnels are also supported.\n"
+  );
 }
 var init_cli_output = __esm({
   "src/cli-output.ts"() {
@@ -855,7 +921,7 @@ function printManualPairing(invitation) {
 }
 function waitForManualPairing(invitation) {
   console.log(styleText2("dim", "  Press j to show manual entry \xB7 Enter or q to finish.\n"));
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const input = process.stdin;
     const previousRaw = input.isRaw;
     const timeout = setTimeout(
@@ -875,7 +941,7 @@ function waitForManualPairing(invitation) {
       process.removeListener("SIGTERM", terminated);
       input.setRawMode(previousRaw);
       input.pause();
-      resolve();
+      resolve2();
     }
     function interrupted() {
       process.exitCode = 130;
@@ -960,8 +1026,379 @@ var init_pairing = __esm({
   }
 });
 
-// ../../packages/contracts/src/push.ts
+// src/tunnels.ts
+import { spawn } from "node:child_process";
+import { access, stat } from "node:fs/promises";
+import { constants } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import path3 from "node:path";
+import { z as z5 } from "zod";
+function signalChild(child, signal) {
+  if (!child.pid) return;
+  if (process.platform === "win32") {
+    child.kill(signal);
+    return;
+  }
+  try {
+    process.kill(-child.pid, signal);
+  } catch (error) {
+    if (!z5.object({ code: z5.literal("ESRCH") }).safeParse(error).success) child.kill(signal);
+  }
+}
+function execute2(file, args, timeoutMs, env = process.env) {
+  return new Promise((resolve2, reject) => {
+    const child = spawn(file, args, {
+      env,
+      detached: process.platform !== "win32",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    const timeout = setTimeout(() => {
+      signalChild(child, "SIGKILL");
+      reject(new Error("Command probe timed out."));
+    }, timeoutMs);
+    child.stdout?.on("data", (data) => {
+      stdout += data.toString();
+      checkOutput();
+    });
+    child.stderr?.on("data", (data) => {
+      stderr += data.toString();
+      checkOutput();
+    });
+    child.once("error", (error) => {
+      clearTimeout(timeout);
+      reject(error);
+    });
+    child.once("exit", () => signalChild(child, "SIGKILL"));
+    child.once("close", (code) => {
+      clearTimeout(timeout);
+      if (code !== 0) reject(new Error("Command probe failed."));
+      else resolve2({ stdout, stderr });
+    });
+    function checkOutput() {
+      if (stdout.length + stderr.length <= 1048576) return;
+      signalChild(child, "SIGKILL");
+      reject(new Error("Command probe output exceeded its limit."));
+    }
+  });
+}
+async function findExecutable(name) {
+  const candidates = (process.env.PATH ?? "").split(path3.delimiter).map((directory) => path3.resolve(directory, name));
+  if (process.platform === "darwin") {
+    candidates.push(`/opt/homebrew/bin/${name}`, `/usr/local/bin/${name}`);
+    if (name === "tailscale")
+      candidates.push("/Applications/Tailscale.app/Contents/MacOS/Tailscale");
+  }
+  for (const candidate of candidates) {
+    try {
+      await access(candidate, constants.X_OK);
+      if ((await stat(candidate)).isFile()) return candidate;
+    } catch {
+      continue;
+    }
+  }
+  return void 0;
+}
+async function probeTailscale() {
+  const option = { provider: "tailscale", available: false, reason: "Not installed" };
+  const executable = await findExecutable("tailscale");
+  if (!executable) return option;
+  option.executable = executable;
+  const env = { ...process.env, TAILSCALE_BE_CLI: "1" };
+  try {
+    const response = await execute2(executable, ["status", "--json"], 3e3, env);
+    const status = z5.object({
+      BackendState: z5.string(),
+      CertDomains: z5.array(z5.string()).optional(),
+      Self: z5.object({ DNSName: z5.string() }).nullable().optional()
+    }).parse(JSON.parse(response.stdout));
+    if (status.BackendState !== "Running")
+      return { ...option, reason: "Installed \xB7 connect Tailscale first" };
+    const dns = status.Self?.DNSName.replace(/\.$/, "");
+    if (!dns || !status.CertDomains?.includes(dns))
+      return { ...option, reason: "Enable HTTPS certificates in your tailnet first" };
+    const help = await execute2(executable, ["serve", "--help"], 2e3, env);
+    if (!`${help.stdout}${help.stderr}`.includes("--https"))
+      return { ...option, reason: "Update Tailscale to use foreground HTTPS Serve" };
+    const responseConfig = await execute2(executable, ["serve", "status", "--json"], 3e3, env);
+    const config = ServeConfig.parse(JSON.parse(responseConfig.stdout) ?? {});
+    const occupied = new Set(Object.keys(config.TCP ?? {}));
+    for (const foreground of Object.values(config.Foreground ?? {}))
+      for (const port3 of Object.keys(foreground.TCP ?? {})) occupied.add(port3);
+    const port2 = [443, ...Array.from({ length: 10 }, (_, index) => 8443 + index)].find(
+      (candidate) => !occupied.has(String(candidate))
+    );
+    if (!port2) return { ...option, reason: "HTTPS Serve ports are in use \xB7 paste an existing URL" };
+    return {
+      ...option,
+      available: true,
+      reason: "Private to your tailnet \xB7 Tailscale required on your phone",
+      publicUrl: new URL(`https://${dns}${port2 === 443 ? "" : `:${port2}`}`).origin,
+      httpsPort: port2
+    };
+  } catch {
+    return { ...option, reason: "Installed \xB7 could not verify daemon or Serve access" };
+  }
+}
+async function probeCloudflared(home) {
+  const option = {
+    provider: "cloudflared",
+    available: false,
+    reason: "Not installed"
+  };
+  const executable = await findExecutable("cloudflared");
+  if (!executable) return option;
+  option.executable = executable;
+  try {
+    await execute2(executable, ["--version"], 2e3);
+    const help = await execute2(executable, ["tunnel", "--help"], 2e3);
+    if (!`${help.stdout}${help.stderr}`.includes("--url"))
+      return { ...option, reason: "Installed \xB7 this version does not support Quick Tunnels" };
+  } catch {
+    return { ...option, reason: "Installed \xB7 command probe failed or timed out" };
+  }
+  const directories = [
+    path3.join(home, ".cloudflared"),
+    path3.join(home, ".cloudflare-warp"),
+    path3.join(home, "cloudflare-warp"),
+    "/etc/cloudflared",
+    "/usr/local/etc/cloudflared"
+  ];
+  const configurations = await Promise.all(
+    directories.flatMap(
+      (directory) => ["config.yml", "config.yaml"].map(
+        async (name) => access(path3.join(directory, name), constants.F_OK).then(
+          () => true,
+          () => false
+        )
+      )
+    )
+  );
+  if (configurations.some(Boolean))
+    return { ...option, reason: "Existing tunnel configuration \xB7 paste its HTTPS URL" };
+  return { ...option, available: true, reason: "Temporary public HTTPS URL \xB7 changes each start" };
+}
+async function detectTunnels(home = homedir2()) {
+  return Promise.all([probeTailscale(), probeCloudflared(home)]);
+}
+var TcpConfig, ServeConfig, ManagedTunnel;
+var init_tunnels = __esm({
+  "src/tunnels.ts"() {
+    "use strict";
+    init_cli_output();
+    TcpConfig = z5.object({ TCP: z5.record(z5.string(), z5.unknown()).optional() });
+    ServeConfig = TcpConfig.extend({
+      Foreground: z5.record(z5.string(), TcpConfig).optional()
+    });
+    ManagedTunnel = class {
+      constructor(option, disconnected = () => {
+      }) {
+        this.option = option;
+        this.disconnected = disconnected;
+      }
+      option;
+      disconnected;
+      child;
+      stopping = false;
+      connected = false;
+      closing;
+      running() {
+        return this.connected && !this.stopping;
+      }
+      stopOnSignal = () => {
+        void this.close();
+      };
+      stopOnExit = () => {
+        if (this.child) signalChild(this.child, "SIGKILL");
+      };
+      async start(origin, signal) {
+        signal?.throwIfAborted();
+        if (!this.option.available) throw new Error(this.option.reason);
+        const tailscale = this.option.provider === "tailscale";
+        const child = spawn(
+          this.option.executable ?? this.option.provider,
+          tailscale ? ["serve", "--bg=false", `--https=${this.option.httpsPort}`, origin] : ["tunnel", "--no-autoupdate", "--url", origin],
+          {
+            stdio: ["ignore", "pipe", "pipe"],
+            detached: process.platform !== "win32",
+            env: tailscale ? { ...process.env, TAILSCALE_BE_CLI: "1" } : process.env
+          }
+        );
+        this.child = child;
+        process.once("SIGINT", this.stopOnSignal);
+        process.once("SIGTERM", this.stopOnSignal);
+        process.once("exit", this.stopOnExit);
+        return new Promise((resolve2, reject) => {
+          let output = "";
+          let address;
+          let settled = false;
+          const abort = () => fail("Tunnel startup canceled.");
+          const timeout = setTimeout(
+            () => fail("Tunnel startup timed out. Check your connection or paste an existing HTTPS URL."),
+            45e3
+          );
+          const fail = (message) => {
+            if (settled) return;
+            settled = true;
+            clearTimeout(timeout);
+            signal?.removeEventListener("abort", abort);
+            void this.close();
+            reject(new Error(message));
+          };
+          const read = (data) => {
+            output = `${output}${data.toString()}`.slice(-65536);
+            address = tailscale ? this.option.publicUrl : output.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com\b/)?.[0];
+            const ready = tailscale ? Boolean(
+              address && output.includes(address) && output.includes("Available within your tailnet")
+            ) : output.includes("Registered tunnel connection");
+            if (settled || !address || !ready) return;
+            settled = true;
+            this.connected = true;
+            clearTimeout(timeout);
+            signal?.removeEventListener("abort", abort);
+            resolve2(address);
+          };
+          child.stdout?.on("data", read);
+          child.stderr?.on("data", read);
+          signal?.addEventListener("abort", abort, { once: true });
+          child.once(
+            "error",
+            () => fail(`${this.option.provider} could not start. Check the installation and permissions.`)
+          );
+          child.once("exit", () => signalChild(child, "SIGTERM"));
+          child.once("close", (code) => {
+            const unexpected = this.connected && !this.stopping;
+            this.connected = false;
+            process.removeListener("SIGINT", this.stopOnSignal);
+            process.removeListener("SIGTERM", this.stopOnSignal);
+            process.removeListener("exit", this.stopOnExit);
+            fail(
+              `${this.option.provider} exited (${code ?? "signal"}). Check tunnel access or paste an existing HTTPS URL.`
+            );
+            if (unexpected) {
+              this.disconnected();
+              printError(
+                "The managed tunnel stopped. Restart the server to reconnect your phone; local work can continue."
+              );
+            }
+          });
+        });
+      }
+      close() {
+        this.stopping = true;
+        const child = this.child;
+        if (!child?.pid || child.exitCode !== null || child.signalCode !== null)
+          return Promise.resolve();
+        this.closing ??= new Promise((resolve2) => {
+          const timeout = setTimeout(() => signalChild(child, "SIGKILL"), 2e3);
+          child.once("close", () => {
+            clearTimeout(timeout);
+            resolve2();
+          });
+          signalChild(child, "SIGTERM");
+        });
+        return this.closing;
+      }
+    };
+  }
+});
+
+// src/opentunnel.ts
+import { randomBytes } from "node:crypto";
+import { chmod as chmod2, mkdir as mkdir3, readFile as readFile2, writeFile as writeFile3 } from "node:fs/promises";
+import path4 from "node:path";
 import { z as z6 } from "zod";
+import {
+  create,
+  OpenTunnelStorage
+} from "./opentunnel-sdk.js";
+var OpenTunnel;
+var init_opentunnel = __esm({
+  "src/opentunnel.ts"() {
+    "use strict";
+    OpenTunnel = class {
+      constructor(directory, disconnected = () => {
+      }, makeClient = create) {
+        this.directory = directory;
+        this.disconnected = disconnected;
+        this.makeClient = makeClient;
+      }
+      directory;
+      disconnected;
+      makeClient;
+      client;
+      connection;
+      stopping = false;
+      running() {
+        return this.connection?.status().state === "connected" && !this.stopping;
+      }
+      async start(origin, signal) {
+        const endpoint = new URL(origin);
+        if (!["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname))
+          throw new Error("OpenTunnel must forward to the local loopback server.");
+        await mkdir3(this.directory, { recursive: true, mode: 448 });
+        await chmod2(this.directory, 448);
+        const routeFile = path4.join(this.directory, "route.json");
+        let route;
+        try {
+          route = z6.string().regex(/^[a-f0-9]{16}$/).parse(JSON.parse(await readFile2(routeFile, "utf8")));
+        } catch (error) {
+          if (!z6.object({ code: z6.literal("ENOENT") }).safeParse(error).success) throw error;
+          route = randomBytes(8).toString("hex");
+          await writeFile3(routeFile, JSON.stringify(route), { flag: "wx", mode: 384 });
+        }
+        this.stopping = false;
+        this.client = this.makeClient({
+          store: OpenTunnelStorage.xdg({ env: { XDG_DATA_HOME: this.directory } })
+        });
+        const abort = AbortSignal.any([
+          signal ?? new AbortController().signal,
+          AbortSignal.timeout(12e4)
+        ]);
+        let canceled = () => {
+        };
+        try {
+          const connecting = this.client.tunnel.connect({
+            profile: "agentrific",
+            routes: {
+              [route]: `${endpoint.hostname === "[::1]" ? "[::1]" : "127.0.0.1"}:${endpoint.port || "80"}`
+            },
+            signal
+          });
+          const cancellation = new Promise((_resolve, reject) => {
+            canceled = () => reject(new Error("OpenTunnel connection canceled or timed out."));
+            abort.addEventListener("abort", canceled, { once: true });
+            if (abort.aborted) canceled();
+          });
+          const connection = await Promise.race([connecting, cancellation]);
+          this.connection = connection;
+          void connection.closed.then(() => {
+            if (!this.stopping) this.disconnected();
+          }).catch(() => {
+            if (!this.stopping) this.disconnected();
+          });
+          return `https://${route}.${connection.tunnel.hostname}`;
+        } catch (error) {
+          await this.close();
+          throw error;
+        } finally {
+          abort.removeEventListener("abort", canceled);
+        }
+      }
+      async close() {
+        this.stopping = true;
+        await this.connection?.close();
+        await this.client?.dispose();
+        this.connection = void 0;
+        this.client = void 0;
+      }
+    };
+  }
+});
+
+// ../../packages/contracts/src/push.ts
+import { z as z7 } from "zod";
 function pushSigningText(installationId, operation, request) {
   return [
     "agentrific-push-v1",
@@ -979,7 +1416,7 @@ var init_push = __esm({
     "use strict";
     PUSH_API_URL = "https://api.agentrific.com";
     PUSH_SANDBOX_API_URL = "https://sandbox-api.agentrific.com";
-    PushKindSchema = z6.enum([
+    PushKindSchema = z7.enum([
       "started",
       "completed",
       "needs_input",
@@ -988,47 +1425,47 @@ var init_push = __esm({
       "pr_created",
       "failed"
     ]);
-    PushPreferencesSchema = z6.array(PushKindSchema).max(7);
-    PushPublicKeySchema = z6.string().regex(/^[a-f0-9]{64}$/);
-    PushInstallationSchema = z6.object({ installationId: z6.string().uuid(), token: z6.string().regex(/^[a-f0-9]{64}$/) }).strict();
-    PushRegistrationSchema = z6.object({
-      expoToken: z6.string().regex(/^(Expo|Exponent)PushToken\[[A-Za-z0-9_-]+\]$/),
+    PushPreferencesSchema = z7.array(PushKindSchema).max(7);
+    PushPublicKeySchema = z7.string().regex(/^[a-f0-9]{64}$/);
+    PushInstallationSchema = z7.object({ installationId: z7.string().uuid(), token: z7.string().regex(/^[a-f0-9]{64}$/) }).strict();
+    PushRegistrationSchema = z7.object({
+      expoToken: z7.string().regex(/^(Expo|Exponent)PushToken\[[A-Za-z0-9_-]+\]$/),
       preferences: PushPreferencesSchema
     }).strict();
-    PushEnrollmentSchema = z6.object({ serverId: z6.string().uuid(), publicKey: PushPublicKeySchema }).strict();
+    PushEnrollmentSchema = z7.object({ serverId: z7.string().uuid(), publicKey: PushPublicKeySchema }).strict();
     PushGrantSchema = PushEnrollmentSchema.extend({
-      installationId: z6.string().uuid(),
-      bindingId: z6.string().uuid(),
-      grant: z6.string().regex(/^[a-f0-9]{64}$/),
-      expiresAt: z6.number()
+      installationId: z7.string().uuid(),
+      bindingId: z7.string().uuid(),
+      grant: z7.string().regex(/^[a-f0-9]{64}$/),
+      expiresAt: z7.number()
     }).strict();
-    PushPullRequestUrlSchema = z6.string().max(512).regex(/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/);
-    PushEventSchema = z6.object({
-      eventId: z6.string().uuid(),
-      sessionId: z6.string().uuid(),
+    PushPullRequestUrlSchema = z7.string().max(512).regex(/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/);
+    PushEventSchema = z7.object({
+      eventId: z7.string().uuid(),
+      sessionId: z7.string().uuid(),
       kind: PushKindSchema,
-      taskTitle: z6.string().trim().min(1).max(160).optional(),
+      taskTitle: z7.string().trim().min(1).max(160).optional(),
       prUrl: PushPullRequestUrlSchema.optional()
     }).strict();
-    PushSignedRequestSchema = z6.object({
-      bindingId: z6.string().uuid(),
-      timestamp: z6.number().int(),
-      nonce: z6.string().uuid(),
-      payload: z6.string().max(2048),
-      signature: z6.string().regex(/^[a-f0-9]{128}$/)
+    PushSignedRequestSchema = z7.object({
+      bindingId: z7.string().uuid(),
+      timestamp: z7.number().int(),
+      nonce: z7.string().uuid(),
+      payload: z7.string().max(2048),
+      signature: z7.string().regex(/^[a-f0-9]{128}$/)
     }).strict();
-    PushEntitlementSchema = z6.object({ active: z6.boolean(), expiresAt: z6.number().nullable() }).strict();
-    PushServerStatusSchema = z6.object({
+    PushEntitlementSchema = z7.object({ active: z7.boolean(), expiresAt: z7.number().nullable() }).strict();
+    PushServerStatusSchema = z7.object({
       publicKey: PushPublicKeySchema,
-      bindings: z6.array(
-        z6.object({
-          bindingId: z6.string().uuid(),
-          installationId: z6.string().uuid(),
-          deviceId: z6.string().uuid()
+      bindings: z7.array(
+        z7.object({
+          bindingId: z7.string().uuid(),
+          installationId: z7.string().uuid(),
+          deviceId: z7.string().uuid()
         })
       ),
-      pending: z6.number().int().nonnegative(),
-      error: z6.string().nullable()
+      pending: z7.number().int().nonnegative(),
+      error: z7.string().nullable()
     });
   }
 });
@@ -1042,7 +1479,7 @@ import {
   randomUUID
 } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import path4 from "node:path";
+import path6 from "node:path";
 import { Effect as Effect3 } from "effect";
 function pushKind(session, previous) {
   if (session.gitDelivery?.status === "pr_opened" && previous?.gitDelivery?.status !== "pr_opened")
@@ -1102,7 +1539,7 @@ var init_push2 = __esm({
         this.transport = transport;
         this.apiUrl = apiUrl;
         mkdirSync(directory, { recursive: true, mode: 448 });
-        const filename = path4.join(directory, "push-signing-key.pem");
+        const filename = path6.join(directory, "push-signing-key.pem");
         if (!existsSync(filename))
           writeFileSync(
             filename,
@@ -1272,12 +1709,12 @@ var init_push2 = __esm({
 // src/attachments.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { createReadStream, createWriteStream } from "node:fs";
-import { mkdir as mkdir3, readFile as readFile2, rm, stat as stat2, readdir } from "node:fs/promises";
-import path5 from "node:path";
+import { mkdir as mkdir4, readFile as readFile3, rm, stat as stat2, readdir } from "node:fs/promises";
+import path7 from "node:path";
 import { pipeline } from "node:stream/promises";
 import sharp from "sharp";
 import { Context, Data, Effect as Effect4, Layer } from "effect";
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var AttachmentError, textExtensions, imageMimes, AttachmentFiles, Attachments;
 var init_attachments = __esm({
   "src/attachments.ts"() {
@@ -1332,7 +1769,7 @@ var init_attachments = __esm({
       root;
       store;
       directory(id) {
-        return path5.join(this.root, z7.string().uuid().parse(id));
+        return path7.join(this.root, z8.string().uuid().parse(id));
       }
       io(operation) {
         return Effect4.tryPromise({
@@ -1346,11 +1783,11 @@ var init_attachments = __esm({
         return this.io(async () => {
           const id = randomUUID2();
           const directory = this.directory(id);
-          const source = path5.join(directory, "source");
-          const nameField = z7.object({ type: z7.literal("field"), value: z7.string() }).safeParse(part.fields.name);
+          const source = path7.join(directory, "source");
+          const nameField = z8.object({ type: z8.literal("field"), value: z8.string() }).safeParse(part.fields.name);
           const originalName = nameField.success ? nameField.data.value : part.filename;
-          const name = path5.basename(originalName.replaceAll("\\", "/")).replace(new RegExp("\\p{Cc}", "gu"), "").slice(0, 180) || "attachment";
-          await mkdir3(directory, { recursive: true });
+          const name = path7.basename(originalName.replaceAll("\\", "/")).replace(new RegExp("\\p{Cc}", "gu"), "").slice(0, 180) || "attachment";
+          await mkdir4(directory, { recursive: true });
           try {
             await pipeline(part.file, createWriteStream(source, { flags: "wx" }));
             if (part.file.truncated) throw new Error("Files must be 20 MB or smaller.");
@@ -1377,14 +1814,14 @@ var init_attachments = __esm({
         const metadata = await sharp(source, { limitInputPixels: 4e7 }).metadata().catch(() => null);
         const mimeType = metadata?.format && imageMimes.get(metadata.format);
         if (mimeType) {
-          await sharp(source, { limitInputPixels: 4e7 }).rotate().resize({ width: 2048, height: 2048, fit: "inside", withoutEnlargement: true }).png().toFile(path5.join(path5.dirname(source), "preview.png"));
+          await sharp(source, { limitInputPixels: 4e7 }).rotate().resize({ width: 2048, height: 2048, fit: "inside", withoutEnlargement: true }).png().toFile(path7.join(path7.dirname(source), "preview.png"));
           return { kind: "image", mimeType };
         }
-        if (!textExtensions.has(path5.extname(name).toLowerCase()))
+        if (!textExtensions.has(path7.extname(name).toLowerCase()))
           throw new Error(
             "Choose a PNG, JPEG, WebP, GIF, or text/code file. PDF and Office documents aren't supported yet."
           );
-        const bytes = await readFile2(source);
+        const bytes = await readFile3(source);
         const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
         if (new RegExp("\\p{Cc}", "u").test(text.replaceAll("\n", "").replaceAll("\r", "").replaceAll("	", "")))
           throw new Error("This file isn't readable UTF-8 text.");
@@ -1401,7 +1838,7 @@ var init_attachments = __esm({
               throw new Error(
                 "An attachment is unavailable for this project. Remove it and upload it again."
               );
-            await stat2(path5.join(this.directory(id), "source"));
+            await stat2(path7.join(this.directory(id), "source"));
             attachments2.push(attachment);
           }
           return attachments2;
@@ -1409,7 +1846,7 @@ var init_attachments = __esm({
       }
       content(attachment, preview) {
         return createReadStream(
-          path5.join(
+          path7.join(
             this.directory(attachment.id),
             preview && attachment.kind === "image" ? "preview.png" : "source"
           )
@@ -1420,13 +1857,13 @@ var init_attachments = __esm({
           const images = [];
           const sections = [];
           for (const attachment of attachments2) {
-            const source = path5.join(this.directory(attachment.id), "source");
+            const source = path7.join(this.directory(attachment.id), "source");
             if (attachment.kind === "image") {
-              const bytes = await readFile2(path5.join(this.directory(attachment.id), "preview.png"));
+              const bytes = await readFile3(path7.join(this.directory(attachment.id), "preview.png"));
               images.push({ type: "image", data: bytes.toString("base64"), mimeType: "image/png" });
               sections.push(`Image attachment: ${JSON.stringify(attachment.name)}`);
             } else {
-              const text = await readFile2(source, "utf8");
+              const text = await readFile3(source, "utf8");
               sections.push(
                 `File attachment: ${JSON.stringify(attachment.name)}
 Full file available to the read tool at: ${JSON.stringify(source)}
@@ -1452,9 +1889,9 @@ ${text.slice(0, 12e3)}${text.length > 12e3 ? "\n[Preview truncated; use the read
             if (await Effect4.runPromise(this.store.deleteAttachment(attachment.id)))
               await rm(this.directory(attachment.id), { recursive: true, force: true });
           }
-          await mkdir3(this.root, { recursive: true });
+          await mkdir4(this.root, { recursive: true });
           for (const entry of await readdir(this.root, { withFileTypes: true })) {
-            if (!entry.isDirectory() || !z7.string().uuid().safeParse(entry.name).success) continue;
+            if (!entry.isDirectory() || !z8.string().uuid().safeParse(entry.name).success) continue;
             const directory = this.directory(entry.name);
             if ((await stat2(directory)).mtimeMs < cutoff && !await Effect4.runPromise(this.store.getAttachment(entry.name)))
               await rm(directory, { recursive: true, force: true });
@@ -1542,24 +1979,24 @@ var init_event_server = __esm({
 });
 
 // src/security.ts
-import { createHash, randomBytes, randomInt, randomUUID as randomUUID3, timingSafeEqual } from "node:crypto";
+import { createHash as createHash2, randomBytes as randomBytes2, randomInt, randomUUID as randomUUID3, timingSafeEqual } from "node:crypto";
 import { Effect as Effect5 } from "effect";
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 async function registerSecurity(app2, security2, version, allowedOrigins2) {
   app2.addHook("onRequest", async (request, reply) => {
-    const path13 = new URL(request.url, "http://localhost");
+    const path15 = new URL(request.url, "http://localhost");
     reply.header("Cache-Control", "no-store");
     if (request.method === "OPTIONS") return;
     if (request.headers.origin && !allowedOrigins2.includes(request.headers.origin))
       return reply.code(403).send({ error: "Browser origin is not allowed." });
-    if (path13.pathname === "/health" || path13.pathname === "/api/auth/pair" && request.method === "POST")
+    if (path15.pathname === "/health" || path15.pathname === "/api/auth/pair" && request.method === "POST")
       return;
     const authorization = request.headers.authorization ?? "";
     const token = authorization.startsWith("Bearer ") ? authorization.slice(7) : "";
-    const asset = request.method === "GET" && /^\/api\/projects\/[^/]+\/attachments\/[^/]+\/content$/.test(path13.pathname);
-    const ticket = path13.searchParams.get("ticket");
-    path13.searchParams.delete("ticket");
-    if (!security2.authenticate(token) && !(asset && ticket && security2.redeemTicket(ticket, path13.pathname + path13.search, false)))
+    const asset = request.method === "GET" && /^\/api\/projects\/[^/]+\/attachments\/[^/]+\/content$/.test(path15.pathname);
+    const ticket = path15.searchParams.get("ticket");
+    path15.searchParams.delete("ticket");
+    if (!security2.authenticate(token) && !(asset && ticket && security2.redeemTicket(ticket, path15.pathname + path15.search, false)))
       return reply.code(401).send({ error: "Pair this device with your server.", code: "UNAUTHORIZED" });
     if (!asset && request.headers["x-agentrific-protocol"] !== String(PROTOCOL_VERSION))
       return reply.code(409).send({
@@ -1614,8 +2051,8 @@ async function registerSecurity(app2, security2, version, allowedOrigins2) {
     ticket: security2.ticket((request.headers.authorization ?? "").slice(7), "/api/events")
   }));
   app2.post("/api/auth/asset-ticket", (request, reply) => {
-    const input = z8.object({
-      path: z8.string().regex(/^\/api\/projects\/[^/?]+\/attachments\/[^/?]+\/content(?:\?preview=1)?$/)
+    const input = z9.object({
+      path: z9.string().regex(/^\/api\/projects\/[^/?]+\/attachments\/[^/?]+\/content(?:\?preview=1)?$/)
     }).safeParse(request.body);
     if (!input.success) return reply.code(400).send({ error: "Choose a valid attachment." });
     return {
@@ -1629,8 +2066,8 @@ var init_security = __esm({
     "use strict";
     init_src();
     init_pairing();
-    secret = () => randomBytes(32).toString("hex");
-    digest = (value) => createHash("sha256").update(value).digest("hex");
+    secret = () => randomBytes2(32).toString("hex");
+    digest = (value) => createHash2("sha256").update(value).digest("hex");
     ServerSecurity = class {
       constructor(store2, serverId) {
         this.store = store2;
@@ -1692,17 +2129,17 @@ var init_security = __esm({
         if (!/^[a-f0-9]{64}$/.test(token)) return void 0;
         return Effect5.runSync(this.store.deviceForToken(digest(token)));
       }
-      ticket(token, path13) {
+      ticket(token, path15) {
         this.prune();
         if (!this.authenticate(token) || this.tickets.size >= 1e4) return void 0;
         const value = secret();
-        this.tickets.set(value, { tokenHash: digest(token), expiresAt: Date.now() + 6e4, path: path13 });
+        this.tickets.set(value, { tokenHash: digest(token), expiresAt: Date.now() + 6e4, path: path15 });
         return value;
       }
-      redeemTicket(value, path13, consume = true) {
+      redeemTicket(value, path15, consume = true) {
         this.prune();
         const ticket = this.tickets.get(value);
-        if (!ticket || ticket.path !== path13) return void 0;
+        if (!ticket || ticket.path !== path15) return void 0;
         if (consume) this.tickets.delete(value);
         return Effect5.runSync(this.store.deviceForToken(ticket.tokenHash));
       }
@@ -1716,6 +2153,101 @@ var init_security = __esm({
   }
 });
 
+// src/desktop-phone.ts
+var DesktopPhoneConnection;
+var init_desktop_phone = __esm({
+  "src/desktop-phone.ts"() {
+    "use strict";
+    init_tunnels();
+    init_opentunnel();
+    DesktopPhoneConnection = class {
+      constructor(origin, changed, directory, detect = async () => [
+        { provider: "opentunnel", available: true, reason: "Built in \xB7 stable public HTTPS address" },
+        ...await detectTunnels()
+      ], create2 = (option, disconnected) => option.provider === "opentunnel" ? new OpenTunnel(directory, disconnected) : new ManagedTunnel({ ...option, provider: option.provider }, disconnected)) {
+        this.origin = origin;
+        this.changed = changed;
+        this.directory = directory;
+        this.detect = detect;
+        this.create = create2;
+      }
+      origin;
+      changed;
+      directory;
+      detect;
+      create;
+      tunnel;
+      provider = null;
+      publicUrl = null;
+      pending = Promise.resolve();
+      snapshot() {
+        return { provider: this.provider, publicUrl: this.publicUrl };
+      }
+      async options() {
+        return (await this.detect()).map(({ provider, available, reason }) => ({
+          provider,
+          available,
+          reason
+        }));
+      }
+      serialize(operation) {
+        const result = this.pending.then(operation);
+        this.pending = result.then(
+          () => {
+          },
+          () => {
+          }
+        );
+        return result;
+      }
+      start(provider, signal) {
+        return this.serialize(async () => {
+          signal?.throwIfAborted();
+          if (this.tunnel && this.publicUrl && this.provider === provider) return this.snapshot();
+          if (this.tunnel)
+            throw new Error("Disconnect the current phone connection before changing providers.");
+          const option = (await this.detect()).find((candidate) => candidate.provider === provider);
+          if (!option?.available) throw new Error(option?.reason || "Tunnel provider unavailable.");
+          let tunnel;
+          tunnel = this.create(option, () => {
+            if (this.tunnel !== tunnel) return;
+            void tunnel.close().catch(() => {
+            });
+            this.tunnel = void 0;
+            this.provider = null;
+            this.publicUrl = null;
+            this.changed(null);
+          });
+          this.tunnel = tunnel;
+          try {
+            const url = await tunnel.start(this.origin(), signal);
+            signal?.throwIfAborted();
+            this.provider = provider;
+            this.publicUrl = url;
+            this.changed(url);
+            return this.snapshot();
+          } catch (error) {
+            await tunnel.close();
+            this.tunnel = void 0;
+            this.changed(null);
+            throw error;
+          }
+        });
+      }
+      close() {
+        return this.serialize(async () => {
+          await this.tunnel?.close();
+          this.tunnel = void 0;
+          this.provider = null;
+          this.publicUrl = null;
+          this.changed(null);
+          return this.snapshot();
+        });
+      }
+    };
+  }
+});
+
 // src/maintenance.ts
 var MaintenanceError, Maintenance;
 var init_maintenance = __esm({
@@ -1756,14 +2288,14 @@ var init_maintenance = __esm({
         this.enter();
         const deadline = Date.now() + timeoutMs;
         while (!this.status().drained && Date.now() < deadline)
-          await new Promise((resolve) => setTimeout(resolve, 50));
+          await new Promise((resolve2) => setTimeout(resolve2, 50));
         return this.status();
       }
       attach(app2) {
         app2.addHook("onRequest", async (request, reply) => {
-          const path13 = request.url.split("?")[0];
+          const path15 = request.url.split("?")[0];
           if (["GET", "HEAD", "OPTIONS"].includes(request.method)) return;
-          const allowed = path13.startsWith("/api/auth/") || /^\/api\/sessions\/[^/]+\/stop$/.test(path13);
+          const allowed = path15.startsWith("/api/auth/") || /^\/api\/sessions\/[^/]+\/stop$/.test(path15);
           if (this.paused && !allowed)
             return reply.code(503).send({ code: "MAINTENANCE", error: new MaintenanceError().message });
           this.requests.add(request.id);
@@ -2037,7 +2569,7 @@ var init_git_flow = __esm({
 });
 
 // src/runtime.ts
-import path6 from "node:path";
+import path8 from "node:path";
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { Context as Context2, Data as Data2, Effect as Effect8, Fiber, Layer as Layer2, Semaphore as Semaphore2 } from "effect";
 var AgentError, AgentController, AgentSessions;
@@ -2096,8 +2628,8 @@ var init_runtime = __esm({
           const agent = yield* Effect8.tryPromise({
             try: () => this.factory.open(
               session.id,
-              session.workspacePath ?? path6.join(this.worktreesRoot, session.id),
-              path6.join(this.sessionsRoot, session.id),
+              session.workspacePath ?? path8.join(this.worktreesRoot, session.id),
+              path8.join(this.sessionsRoot, session.id),
               session.model,
               session
             ),
@@ -2384,17 +2916,17 @@ var init_workflow_command = __esm({
 });
 
 // src/workflow-schema.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 var DeliveryJobSchema, PreparationJobSchema, WorkflowJobSchema;
 var init_workflow_schema = __esm({
   "src/workflow-schema.ts"() {
     "use strict";
     init_src();
-    DeliveryJobSchema = z9.object({
-      kind: z9.literal("delivery"),
-      sessionId: z9.string(),
+    DeliveryJobSchema = z10.object({
+      kind: z10.literal("delivery"),
+      sessionId: z10.string(),
       request: DeliveryRequestSchema,
-      phase: z9.enum([
+      phase: z10.enum([
         "validating",
         "drafting",
         "committing",
@@ -2404,25 +2936,25 @@ var init_workflow_schema = __esm({
         "opening_pr",
         "delivered"
       ]),
-      attempt: z9.number().int().positive(),
-      commitSha: z9.string().optional(),
-      title: z9.string(),
-      body: z9.string(),
-      logs: z9.string().default(""),
-      failed: z9.boolean().default(false),
-      result: z9.enum(["merged", "pr_opened", "no_changes"]).optional(),
-      url: z9.string().optional(),
-      message: z9.string().optional()
+      attempt: z10.number().int().positive(),
+      commitSha: z10.string().optional(),
+      title: z10.string(),
+      body: z10.string(),
+      logs: z10.string().default(""),
+      failed: z10.boolean().default(false),
+      result: z10.enum(["merged", "pr_opened", "no_changes"]).optional(),
+      url: z10.string().optional(),
+      message: z10.string().optional()
     });
-    PreparationJobSchema = z9.object({
-      kind: z9.literal("preparation"),
-      sessionId: z9.string(),
-      projectPath: z9.string(),
+    PreparationJobSchema = z10.object({
+      kind: z10.literal("preparation"),
+      sessionId: z10.string(),
+      projectPath: z10.string(),
       input: CreateSessionSchema,
-      stage: z9.enum(["creating", "installing", "ready", "failed"]),
-      logs: z9.string().default("")
+      stage: z10.enum(["creating", "installing", "ready", "failed"]),
+      logs: z10.string().default("")
     });
-    WorkflowJobSchema = z9.discriminatedUnion("kind", [
+    WorkflowJobSchema = z10.discriminatedUnion("kind", [
       DeliveryJobSchema,
       PreparationJobSchema
     ]);
@@ -2431,7 +2963,7 @@ var init_workflow_schema = __esm({
 
 // src/delivery.ts
 import { Effect as Effect9 } from "effect";
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var DeliveryCoordinator;
 var init_delivery = __esm({
   "src/delivery.ts"() {
@@ -2730,11 +3262,11 @@ ${workflowError(error instanceof Error ? error : String(error))}`
                 "--json",
                 "url,state,headRefOid"
               ]);
-              const prs = z10.array(
-                z10.object({
-                  url: z10.string().url(),
-                  state: z10.string(),
-                  headRefOid: z10.string().optional()
+              const prs = z11.array(
+                z11.object({
+                  url: z11.string().url(),
+                  state: z11.string(),
+                  headRefOid: z11.string().optional()
                 })
               ).parse(JSON.parse(existing));
               const open = prs.find(
@@ -2777,10 +3309,10 @@ ${workflowError(error instanceof Error ? error : String(error))}`
 });
 
 // src/preparation.ts
-import { mkdir as mkdir4, readFile as readFile3 } from "node:fs/promises";
-import path7 from "node:path";
+import { mkdir as mkdir5, readFile as readFile4 } from "node:fs/promises";
+import path9 from "node:path";
 import { Effect as Effect10 } from "effect";
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var PreparationCoordinator;
 var init_preparation = __esm({
   "src/preparation.ts"() {
@@ -2881,7 +3413,7 @@ ${logs}` : ""}`);
         const workspace = session.workspacePath;
         if (branchAtWorkspace !== void 0)
           throw new Error("The run workspace already exists on a different branch.");
-        await mkdir4(path7.dirname(workspace), { recursive: true });
+        await mkdir5(path9.dirname(workspace), { recursive: true });
         try {
           await command(
             projectPath,
@@ -2901,12 +3433,12 @@ ${logs}` : ""}`);
         }
       }
       async install(workspace, command) {
-        const packageFile = await readFile3(path7.join(workspace, "package.json"), "utf8").catch(
+        const packageFile = await readFile4(path9.join(workspace, "package.json"), "utf8").catch(
           () => void 0
         );
         if (!packageFile) return;
-        const metadata = z11.object({ packageManager: z11.string().optional() }).parse(JSON.parse(packageFile));
-        const has = async (name) => readFile3(path7.join(workspace, name)).then(
+        const metadata = z12.object({ packageManager: z12.string().optional() }).parse(JSON.parse(packageFile));
+        const has = async (name) => readFile4(path9.join(workspace, name)).then(
           () => true,
           () => false
         );
@@ -2989,7 +3521,7 @@ ${logs}` : ""}`);
 
 // src/delivery-writer.ts
 import { createAgentSession, SessionManager } from "@earendil-works/pi-coding-agent";
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 function deliveryWriter(models2, createSession = createAgentSession) {
   return async (run, input, diff, signal) => {
     signal?.throwIfAborted();
@@ -3030,7 +3562,7 @@ var DraftSchema;
 var init_delivery_writer = __esm({
   "src/delivery-writer.ts"() {
     "use strict";
-    DraftSchema = z12.object({ title: z12.string().trim().min(1).max(120), body: z12.string().trim().min(1).max(1e4) }).strict();
+    DraftSchema = z13.object({ title: z13.string().trim().min(1).max(120), body: z13.string().trim().min(1).max(1e4) }).strict();
   }
 });
 
@@ -3187,19 +3719,19 @@ var init_delivery_tool = __esm({
 // src/file-change.ts
 import { createWriteToolDefinition, defineTool as defineTool2 } from "@earendil-works/pi-coding-agent";
 import { createTwoFilesPatch } from "diff";
-import { mkdir as mkdir5, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
-import { z as z13 } from "zod";
+import { mkdir as mkdir6, readFile as readFile5, writeFile as writeFile4 } from "node:fs/promises";
+import { z as z14 } from "zod";
 function boundFileChange(change) {
   if ((change.patch?.length ?? 0) + (change.content?.length ?? 0) > previewLimit)
     return { path: change.path, omitted: true };
   return change;
 }
-function completedFileChange(result, path13) {
+function completedFileChange(result, path15) {
   const parsed = EditResultSchema.safeParse(result);
   if (!parsed.success) return;
   const details = parsed.data.details;
   if (details?.fileChange) return boundFileChange(details.fileChange);
-  if (path13 && details?.patch) return boundFileChange({ path: path13, patch: details.patch });
+  if (path15 && details?.patch) return boundFileChange({ path: path15, patch: details.patch });
 }
 function fileWriteTool(cwd) {
   const base = createWriteToolDefinition(cwd);
@@ -3216,16 +3748,16 @@ function fileWriteTool(cwd) {
       const tool = createWriteToolDefinition(cwd, {
         operations: {
           mkdir: async (dir) => {
-            await mkdir5(dir, { recursive: true });
+            await mkdir6(dir, { recursive: true });
           },
           // Pi invokes this inside its per-file mutation queue, so the snapshot
           // and write cannot race another built-in edit/write on the same file.
-          writeFile: async (path13, content) => {
-            const previous = await readFile4(path13, "utf8").catch((error) => {
+          writeFile: async (path15, content) => {
+            const previous = await readFile5(path15, "utf8").catch((error) => {
               if (error.code === "ENOENT") return void 0;
               throw error;
             });
-            await writeFile3(path13, content, "utf8");
+            await writeFile4(path15, content, "utf8");
             fileChange = boundFileChange(
               previous === void 0 ? { path: args.path, content } : {
                 path: args.path,
@@ -3246,8 +3778,8 @@ var init_file_change = __esm({
     "use strict";
     init_src();
     previewLimit = 256e3;
-    EditResultSchema = z13.object({
-      details: z13.object({ patch: z13.string().optional(), fileChange: FileChangeSchema.optional() }).optional()
+    EditResultSchema = z14.object({
+      details: z14.object({ patch: z14.string().optional(), fileChange: FileChangeSchema.optional() }).optional()
     });
   }
 });
@@ -3259,7 +3791,7 @@ import {
   createAgentSession as createAgentSession2,
   SessionManager as SessionManager2
 } from "@earendil-works/pi-coding-agent";
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 function toolOutput(value) {
   const parsed = ToolResultSchema.safeParse(value);
   const text = parsed.success ? parsed.data.content?.filter((part) => part.type === "text").map((part) => part.text || "").join("\n") || "Completed without text output." : boundedJson(value, 4e3);
@@ -3373,7 +3905,7 @@ function createPiFactory(files, models2, delivery2, createSession = createAgentS
             return false;
           }
           const filePaths = /* @__PURE__ */ new Map();
-          const FileArgsSchema = z14.object({ path: z14.string() });
+          const FileArgsSchema = z15.object({ path: z15.string() });
           function handleTool(event) {
             if (event.type === "tool_execution_start") {
               flushText();
@@ -3438,8 +3970,8 @@ var init_pi = __esm({
     init_models();
     init_delivery_tool();
     init_file_change();
-    ToolResultSchema = z14.object({
-      content: z14.array(z14.object({ type: z14.string(), text: z14.string().optional() })).optional()
+    ToolResultSchema = z15.object({
+      content: z15.array(z15.object({ type: z15.string(), text: z15.string().optional() })).optional()
     }).passthrough();
     boundedJson = (value, limit) => {
       let text;
@@ -3454,19 +3986,19 @@ var init_pi = __esm({
 });
 
 // src/projects.ts
-import { access as access2, readdir as readdir2, realpath, stat as stat3, readFile as readFile5, writeFile as writeFile4 } from "node:fs/promises";
+import { access as access2, readdir as readdir2, realpath, stat as stat3, readFile as readFile6, writeFile as writeFile5 } from "node:fs/promises";
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 import { constants as constants2 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import path8 from "node:path";
+import path10 from "node:path";
 import { Effect as Effect13, Semaphore as Semaphore3 } from "effect";
 function resolveProjectsRoot(input) {
   return Effect13.tryPromise({
     try: async () => {
       const trimmed = input.trim();
-      const expanded = trimmed === "~" ? homedir3() : trimmed.startsWith("~/") ? path8.join(homedir3(), trimmed.slice(2)) : trimmed;
-      if (!path8.isAbsolute(expanded))
+      const expanded = trimmed === "~" ? homedir3() : trimmed.startsWith("~/") ? path10.join(homedir3(), trimmed.slice(2)) : trimmed;
+      if (!path10.isAbsolute(expanded))
         throw new Error("Use an absolute server path or a path beginning with ~/.");
       const resolved = await realpath(expanded);
       if (!(await stat3(resolved)).isDirectory())
@@ -3488,34 +4020,34 @@ function projectLock(store2) {
   return lock;
 }
 async function gitDirectory(directory) {
-  const location = path8.join(directory, ".git");
+  const location = path10.join(directory, ".git");
   const info = await stat3(location);
   if (info.isDirectory()) return location;
-  const contents = await readFile5(location, "utf8");
+  const contents = await readFile6(location, "utf8");
   const match = /^gitdir: (.+)\s*$/m.exec(contents);
   if (!match) throw new Error("Invalid Git worktree metadata.");
-  const resolved = await realpath(path8.resolve(directory, match[1].trim()));
+  const resolved = await realpath(path10.resolve(directory, match[1].trim()));
   if (!(await stat3(resolved)).isDirectory()) throw new Error("Git directory is missing.");
   return resolved;
 }
 async function identity(directory, preferred) {
-  const filename = path8.join(await gitDirectory(directory), "agentrific-project-id");
+  const filename = path10.join(await gitDirectory(directory), "agentrific-project-id");
   try {
-    return ProjectId.parse(await readFile5(filename, "utf8"));
+    return ProjectId.parse(await readFile6(filename, "utf8"));
   } catch (error) {
-    if (!z15.object({ code: z15.literal("ENOENT") }).safeParse(error).success) throw error;
-    const legacyFilename = path8.join(await gitDirectory(directory), "chatplans-project-id");
-    const legacy = await readFile5(legacyFilename, "utf8").catch((cause) => {
-      if (!z15.object({ code: z15.literal("ENOENT") }).safeParse(cause).success) throw cause;
+    if (!z16.object({ code: z16.literal("ENOENT") }).safeParse(error).success) throw error;
+    const legacyFilename = path10.join(await gitDirectory(directory), "chatplans-project-id");
+    const legacy = await readFile6(legacyFilename, "utf8").catch((cause) => {
+      if (!z16.object({ code: z16.literal("ENOENT") }).safeParse(cause).success) throw cause;
       return null;
     });
     const id = legacy === null ? preferred ?? randomUUID6() : ProjectId.parse(legacy);
     try {
-      await writeFile4(filename, id + "\n", { flag: "wx" });
+      await writeFile5(filename, id + "\n", { flag: "wx" });
       return id;
     } catch (writeError) {
-      if (!z15.object({ code: z15.literal("EEXIST") }).safeParse(writeError).success) throw writeError;
-      return ProjectId.parse(await readFile5(filename, "utf8"));
+      if (!z16.object({ code: z16.literal("EEXIST") }).safeParse(writeError).success) throw writeError;
+      return ProjectId.parse(await readFile6(filename, "utf8"));
     }
   }
 }
@@ -3528,15 +4060,15 @@ function scanProjects(root, store2) {
       const entries = await readdir2(root, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
-        const directory = path8.join(root, entry.name);
-        if (!await stat3(path8.join(directory, ".git")).catch(() => null)) continue;
+        const directory = path10.join(root, entry.name);
+        if (!await stat3(path10.join(directory, ".git")).catch(() => null)) continue;
         const previous = registered.find((project2) => project2.path === directory);
         let id = await identity(directory, previous?.available ? void 0 : previous?.id);
         let existing = registered.find((project2) => project2.id === id);
-        if (found.some((project2) => project2.id === id) || existing && existing.path !== directory && await stat3(path8.join(existing.path, ".git")).catch(() => null)) {
+        if (found.some((project2) => project2.id === id) || existing && existing.path !== directory && await stat3(path10.join(existing.path, ".git")).catch(() => null)) {
           id = randomUUID6();
-          await writeFile4(
-            path8.join(await gitDirectory(directory), "agentrific-project-id"),
+          await writeFile5(
+            path10.join(await gitDirectory(directory), "agentrific-project-id"),
             id + "\n"
           );
           existing = void 0;
@@ -3569,16 +4101,16 @@ function reconnectProject(root, id, input, store2) {
       ))
         throw new Error("Stop this project's running sessions before reconnecting its folder.");
       const directory = await Effect13.runPromise(resolveProjectsRoot(input));
-      if (path8.dirname(directory) !== await realpath(root))
+      if (path10.dirname(directory) !== await realpath(root))
         throw new Error("Choose a Git repository directly inside the configured projects folder.");
-      const filename = path8.join(await gitDirectory(directory), "agentrific-project-id");
+      const filename = path10.join(await gitDirectory(directory), "agentrific-project-id");
       const replacedId = await identity(directory);
-      const project = { id, name: path8.basename(directory), path: directory, available: true };
-      await writeFile4(filename, id + "\n");
+      const project = { id, name: path10.basename(directory), path: directory, available: true };
+      await writeFile5(filename, id + "\n");
       try {
         await Effect13.runPromise(store2.relocateProject(project, previous.path, replacedId));
       } catch (error) {
-        await writeFile4(filename, replacedId + "\n");
+        await writeFile5(filename, replacedId + "\n");
         throw error;
       }
       return project;
@@ -3591,7 +4123,7 @@ var init_projects = __esm({
   "src/projects.ts"() {
     "use strict";
     locks2 = /* @__PURE__ */ new WeakMap();
-    ProjectId = z15.string().trim().min(1).max(255);
+    ProjectId = z16.string().trim().min(1).max(255);
   }
 });
 
@@ -3611,10 +4143,10 @@ function repositoryIdentity(remote) {
   if (!["https:", "http:", "ssh:", "git:"].includes(url.protocol)) return null;
   if (url.search || url.hash || url.port) return null;
   const host2 = url.hostname.toLowerCase();
-  let path13 = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/, "");
-  if (!host2 || !path13 || path13.includes("%") || path13.includes("//")) return null;
-  if (["github.com", "bitbucket.org"].includes(host2)) path13 = path13.toLowerCase();
-  const key = `${host2}/${path13}`;
+  let path15 = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/, "");
+  if (!host2 || !path15 || path15.includes("%") || path15.includes("//")) return null;
+  if (["github.com", "bitbucket.org"].includes(host2)) path15 = path15.toLowerCase();
+  const key = `${host2}/${path15}`;
   return { key, display: key };
 }
 async function git(directory, args) {
@@ -3703,36 +4235,36 @@ var init_project_git = __esm({
 });
 
 // src/push-schema.ts
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 var PushBindingSchema, PushStateSchema, PendingPushSchema;
 var init_push_schema = __esm({
   "src/push-schema.ts"() {
     "use strict";
     init_push();
-    PushBindingSchema = z16.object({
-      bindingId: z16.string().uuid(),
-      installationId: z16.string().uuid(),
-      deviceId: z16.string().uuid()
+    PushBindingSchema = z17.object({
+      bindingId: z17.string().uuid(),
+      installationId: z17.string().uuid(),
+      deviceId: z17.string().uuid()
     });
-    PushStateSchema = z16.object({
-      bindings: z16.array(PushBindingSchema).max(10),
-      error: z16.string().nullable()
+    PushStateSchema = z17.object({
+      bindings: z17.array(PushBindingSchema).max(10),
+      error: z17.string().nullable()
     });
     PendingPushSchema = PushEventSchema.extend({
-      remaining: z16.array(PushBindingSchema),
-      createdAt: z16.number(),
-      attempts: z16.number().int().nonnegative(),
-      nextAt: z16.number()
+      remaining: z17.array(PushBindingSchema),
+      createdAt: z17.number(),
+      attempts: z17.number().int().nonnegative(),
+      nextAt: z17.number()
     });
   }
 });
 
 // src/store.ts
 import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "node:fs";
-import path9 from "node:path";
+import path11 from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { Context as Context3, Data as Data3, Effect as Effect14, Layer as Layer3 } from "effect";
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 import { randomUUID as randomUUID7 } from "node:crypto";
 var StorageError, PayloadRow, EventRow, SqliteSessionStore, SessionStore;
 var init_store = __esm({
@@ -3745,8 +4277,8 @@ var init_store = __esm({
     init_src();
     StorageError = class extends Data3.TaggedError("StorageError") {
     };
-    PayloadRow = z17.object({ payload: z17.string() });
-    EventRow = z17.object({ sequence: z17.number(), recorded_at: z17.string(), payload: z17.string() });
+    PayloadRow = z18.object({ payload: z18.string() });
+    EventRow = z18.object({ sequence: z18.number(), recorded_at: z18.string(), payload: z18.string() });
     SqliteSessionStore = class {
       constructor(db) {
         this.db = db;
@@ -3797,7 +4329,7 @@ var init_store = __esm({
           const row = PayloadRow.parse(
             this.db.prepare("SELECT payload FROM settings WHERE id = 'server-id'").get()
           );
-          return z17.string().uuid().parse(JSON.parse(row.payload));
+          return z18.string().uuid().parse(JSON.parse(row.payload));
         });
       }
       saveDevice(device, tokenHash) {
@@ -3885,10 +4417,10 @@ var init_store = __esm({
       `).all();
           const insert = this.db.prepare("INSERT OR IGNORE INTO projects(id, payload) VALUES (?, ?)");
           for (const row of legacy) {
-            const id = z17.object({ id: z17.string() }).parse(row).id;
+            const id = z18.object({ id: z18.string() }).parse(row).id;
             insert.run(
               id,
-              JSON.stringify({ id, name: id, path: path9.join(root, id), available: false })
+              JSON.stringify({ id, name: id, path: path11.join(root, id), available: false })
             );
           }
           return this.db.prepare("SELECT payload FROM projects").all().map((row) => ProjectSchema.parse(JSON.parse(PayloadRow.parse(row).payload)));
@@ -3925,7 +4457,7 @@ var init_store = __esm({
         this.db.prepare(
           "UPDATE workflows SET payload = json_set(payload, '$.projectPath', ?) WHERE json_extract(payload, '$.kind') = 'preparation' AND json_extract(payload, '$.projectPath') = ?"
         ).run(project.path, previousPath);
-        const relocate = (workspace) => workspace === previousPath || workspace.startsWith(`${previousPath}${path9.sep}`) ? project.path + workspace.slice(previousPath.length) : workspace;
+        const relocate = (workspace) => workspace === previousPath || workspace.startsWith(`${previousPath}${path11.sep}`) ? project.path + workspace.slice(previousPath.length) : workspace;
         for (const row of this.db.prepare("SELECT id, payload FROM sessions WHERE json_extract(payload, '$.projectId') = ?").all(project.id)) {
           const session = SessionSchema.parse(JSON.parse(PayloadRow.parse(row).payload));
           if (session.workspacePath) {
@@ -4095,7 +4627,7 @@ var init_store = __esm({
             if (event.type === "message.user") this.claimAttachments(event.attachments ?? []);
             const result = this.db.prepare("INSERT INTO events(session_id, recorded_at, payload) VALUES (?, ?, ?)").run(sessionId, recordedAt, JSON.stringify(event));
             if (notification) {
-              const count = z17.object({ total: z17.number() }).parse(this.db.prepare("SELECT COUNT(*) AS total FROM push_outbox").get());
+              const count = z18.object({ total: z18.number() }).parse(this.db.prepare("SELECT COUNT(*) AS total FROM push_outbox").get());
               if (count.total >= 1e3)
                 this.db.prepare(
                   "DELETE FROM push_outbox WHERE rowid IN (SELECT rowid FROM push_outbox ORDER BY rowid LIMIT 1)"
@@ -4141,13 +4673,13 @@ var init_store = __esm({
           Effect14.acquireRelease(
             Effect14.try({
               try: () => {
-                mkdirSync2(path9.dirname(filename), { recursive: true });
+                mkdirSync2(path11.dirname(filename), { recursive: true });
                 const db = new DatabaseSync(filename);
                 chmodSync(filename, 384);
                 for (const suffix of ["-wal", "-shm"])
                   if (existsSync2(filename + suffix)) chmodSync(filename + suffix, 384);
                 try {
-                  const schema = z17.object({ user_version: z17.number() }).parse(db.prepare("PRAGMA user_version").get());
+                  const schema = z18.object({ user_version: z18.number() }).parse(db.prepare("PRAGMA user_version").get());
                   if (schema.user_version > 1)
                     throw new Error("This database requires a newer Agentrific server.");
                   db.exec(`
@@ -4183,13 +4715,13 @@ var init_store = __esm({
 });
 
 // src/worktree-cleanup.ts
-import { lstat, rm as rm2 } from "node:fs/promises";
-import path10 from "node:path";
+import { lstat as lstat2, rm as rm2 } from "node:fs/promises";
+import path12 from "node:path";
 import { Effect as Effect15 } from "effect";
 async function removeRunFiles(dataRoot2, sessionId) {
-  if (path10.basename(sessionId) !== sessionId || sessionId === "." || sessionId === "..")
+  if (path12.basename(sessionId) !== sessionId || sessionId === "." || sessionId === "..")
     throw new Error("Invalid session directory.");
-  await rm2(path10.join(dataRoot2, "pi", sessionId), { recursive: true, force: true });
+  await rm2(path12.join(dataRoot2, "pi", sessionId), { recursive: true, force: true });
 }
 var WorktreeCleanup;
 var init_worktree_cleanup = __esm({
@@ -4208,12 +4740,12 @@ var init_worktree_cleanup = __esm({
       projectsRoot;
       async remove(session, discardChanges = true) {
         if (session.gitFlow?.workspace !== "worktree" || !session.workspacePath) return;
-        const workspace = path10.resolve(session.workspacePath);
-        const info = await lstat(workspace).catch((error) => {
+        const workspace = path12.resolve(session.workspacePath);
+        const info = await lstat2(workspace).catch((error) => {
           if (error.code === "ENOENT") return void 0;
           throw error;
         });
-        if (workspace !== path10.join(this.root, session.id) || path10.basename(session.id) !== session.id) {
+        if (workspace !== path12.join(this.root, session.id) || path12.basename(session.id) !== session.id) {
           if (!info) return;
           throw new Error("Refusing to remove a worktree outside the managed workspaces directory.");
         }
@@ -4303,10 +4835,10 @@ import { execFile as execFile4 } from "node:child_process";
 import { promisify as promisify4 } from "node:util";
 import { realpath as realpath2 } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
-import path11 from "node:path";
+import path13 from "node:path";
 import { WebSocket } from "ws";
 import { Effect as Effect17, ManagedRuntime } from "effect";
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 import { ModelRuntime } from "@earendil-works/pi-coding-agent";
 function publish(event, workflowUpdate = false) {
   const previous = event.type === "session.updated" ? Effect17.runSync(store.get(event.session.id)) : void 0;
@@ -4367,18 +4899,18 @@ async function resolveSessionProject(projectId) {
     return { error: "Project folder is missing. Reconnect it before starting a run.", status: 404 };
   const projectPath = await realpath2(project.path);
   const resolvedRoot = await realpath2(projectsRoot);
-  if (path11.dirname(projectPath) !== resolvedRoot)
+  if (path13.dirname(projectPath) !== resolvedRoot)
     return { error: "Project path is outside projects root.", status: 400 };
   return { projectPath };
 }
 async function resolveSessionWorkspace(id, gitFlow, projectPath) {
-  const worktreePath = path11.join(worktreesRoot, id);
+  const worktreePath = path13.join(worktreesRoot, id);
   const branch = gitFlow ? `agentrific/${id.slice(0, 8)}` : null;
   const useProjectCheckout = gitFlow?.workspace === "checkout";
   const workspacePath = !gitFlow || useProjectCheckout ? projectPath : worktreePath;
   if (useProjectCheckout) {
     const serverPath = await realpath2(process.cwd());
-    if (serverPath === projectPath || serverPath.startsWith(`${projectPath}${path11.sep}`))
+    if (serverPath === projectPath || serverPath.startsWith(`${projectPath}${path13.sep}`))
       return {
         error: "The server runs from this project. Choose a worktree for this task.",
         status: 409
@@ -4513,7 +5045,11 @@ async function withSessionTaskLock(id, operation) {
   const lockId = session ? await sessionTaskLockId(store, session) : `session-${id}`;
   return withTaskLock(lockId, operation);
 }
-var host, port, defaultProjectsRoot, worktreesRoot, execFileAsync, app, dataRoot, releaseLock, effects, store, security, sandboxPushUrl, testPushUrl, push, allowedOrigins, attachmentEffects, attachments, attachmentCleanup, models, delivery, preparation, agentEffects, runtime, worktreeCleanup, maxWorktreeAgeDays, pruneWorktrees, worktreeCleanupTimer, updates, maintenance, stopUpdateDiscovery, HistoryQuery, StartTaskBody, automation, automationTimer, closeControl;
+function localServerUrl() {
+  const address = z19.object({ port: z19.number() }).safeParse(app.server.address());
+  return address.success ? `http://${host}:${address.data.port}` : void 0;
+}
+var host, port, defaultProjectsRoot, worktreesRoot, execFileAsync, app, dataRoot, releaseLock, effects, store, security, sandboxPushUrl, testPushUrl, push, allowedOrigins, attachmentEffects, attachments, attachmentCleanup, models, delivery, preparation, agentEffects, runtime, worktreeCleanup, maxWorktreeAgeDays, pruneWorktrees, worktreeCleanupTimer, updates, maintenance, stopUpdateDiscovery, HistoryQuery, StartTaskBody, automation, automationTimer, phoneOrigin, phone, closeControl;
 var init_index = __esm({
   async "src/index.ts"() {
     "use strict";
@@ -4524,6 +5060,7 @@ var init_index = __esm({
     init_event_server();
     init_security();
     init_control();
+    init_desktop_phone();
     init_version();
     init_maintenance();
     init_updates();
@@ -4543,9 +5080,9 @@ var init_index = __esm({
     init_repo_chat();
     host = process.env.AGENTRIFIC_HOST ?? "127.0.0.1";
     port = Number(process.env.AGENTRIFIC_PORT ?? 4318);
-    defaultProjectsRoot = path11.resolve(process.env.AGENTRIFIC_PROJECTS_DIR ?? "./projects");
-    worktreesRoot = path11.resolve(
-      process.env.AGENTRIFIC_WORKTREES_DIR ?? path11.join(homedir4(), ".agentrific", "workspaces")
+    defaultProjectsRoot = path13.resolve(process.env.AGENTRIFIC_PROJECTS_DIR ?? "./projects");
+    worktreesRoot = path13.resolve(
+      process.env.AGENTRIFIC_WORKTREES_DIR ?? path13.join(homedir4(), ".agentrific", "workspaces")
     );
     execFileAsync = promisify4(execFile4);
     if (host !== "127.0.0.1" && host !== "::1")
@@ -4568,9 +5105,9 @@ var init_index = __esm({
         }
       }
     });
-    dataRoot = path11.resolve(process.env.AGENTRIFIC_DATA_DIR ?? "./data");
+    dataRoot = path13.resolve(process.env.AGENTRIFIC_DATA_DIR ?? "./data");
     releaseLock = await acquireServerLock(dataRoot);
-    effects = ManagedRuntime.make(SessionStore.layer(path11.join(dataRoot, "sessions.sqlite")));
+    effects = ManagedRuntime.make(SessionStore.layer(path13.join(dataRoot, "sessions.sqlite")));
     store = await effects.runPromise(SessionStore);
     security = new ServerSecurity(store, await Effect17.runPromise(store.serverIdentity()));
     sandboxPushUrl = process.env.AGENTRIFIC_PUSH_SANDBOX === "1" ? PUSH_SANDBOX_API_URL : void 0;
@@ -4589,6 +5126,7 @@ var init_index = __esm({
     allowedOrigins = [
       .../* @__PURE__ */ new Set([
         "agentrific-desktop://app",
+        "https://app.agentrific.com",
         ...(process.env.AGENTRIFIC_ALLOWED_ORIGINS ?? "http://localhost:8081,http://127.0.0.1:8081").split(","),
         `http://${host === "::1" ? "[::1]" : host}:${port}`,
         ...process.env.AGENTRIFIC_PUBLIC_URL ? [new URL(process.env.AGENTRIFIC_PUBLIC_URL).origin] : []
@@ -4601,7 +5139,7 @@ var init_index = __esm({
     await registerSecurity(app, security, serverVersion, allowedOrigins);
     registerPushRoutes(app, push, security);
     attachmentEffects = ManagedRuntime.make(
-      Attachments.layer(path11.join(dataRoot, "attachments"), store)
+      Attachments.layer(path13.join(dataRoot, "attachments"), store)
     );
     attachments = await attachmentEffects.runPromise(Attachments);
     await Effect17.runPromise(attachments.cleanup());
@@ -4666,7 +5204,7 @@ var init_index = __esm({
         createPiFactory(attachments, models, delivery),
         publish,
         worktreesRoot,
-        path11.join(dataRoot, "pi"),
+        path13.join(dataRoot, "pi"),
         (sessionId, messageId) => Effect17.runSync(store.hasMessage(sessionId, messageId)),
         (session) => delivery.settled(session.id)
       )
@@ -4827,7 +5365,7 @@ var init_index = __esm({
       return project ?? reply.code(404).send({ error: "Project not found on this server." });
     });
     app.post("/api/projects/:id/reconnect", async (request, reply) => {
-      const parsed = z18.object({ path: z18.string().trim().min(1).max(4096) }).safeParse(request.body);
+      const parsed = z19.object({ path: z19.string().trim().min(1).max(4096) }).safeParse(request.body);
       if (!parsed.success)
         return reply.code(400).send({ error: "Enter the project's new folder path." });
       const root = await Effect17.runPromise(store.projectsRoot(defaultProjectsRoot));
@@ -4913,7 +5451,7 @@ var init_index = __esm({
       }
     });
     app.post("/api/tasks/:id/discard-unrun", async (request, reply) => {
-      const parsed = z18.object({ updatedAt: z18.string().datetime() }).safeParse(request.body);
+      const parsed = z19.object({ updatedAt: z19.string().datetime() }).safeParse(request.body);
       if (!parsed.success) return reply.code(400).send({ error: "The task revision is required." });
       try {
         await deleteTask(store, request.params.id, void 0, parsed.data.updatedAt);
@@ -4983,9 +5521,9 @@ var init_index = __esm({
         }
       })
     );
-    HistoryQuery = z18.object({
-      after: z18.coerce.number().int().nonnegative().default(0),
-      limit: z18.coerce.number().int().min(1).max(1e3).default(500)
+    HistoryQuery = z19.object({
+      after: z19.coerce.number().int().nonnegative().default(0),
+      limit: z19.coerce.number().int().min(1).max(1e3).default(500)
     });
     app.get("/api/sessions/:id/events", async (request, reply) => {
       const query = HistoryQuery.safeParse(request.query);
@@ -4999,7 +5537,7 @@ var init_index = __esm({
       const location = await resolveSessionProject(request.params.id);
       if (location.error !== void 0)
         return reply.code(location.status).send({ error: location.error });
-      const parsed = z18.object({ reset: z18.boolean().optional() }).safeParse(request.body ?? {});
+      const parsed = z19.object({ reset: z19.boolean().optional() }).safeParse(request.body ?? {});
       if (!parsed.success) return reply.code(400).send({ error: parsed.error.flatten() });
       try {
         return await openRepoChat(
@@ -5023,7 +5561,7 @@ var init_index = __esm({
       if (!result.session) return reply.code(result.status).send({ error: result.error });
       return reply.code(201).send(result.session);
     });
-    StartTaskBody = z18.object({ prompt: z18.string().trim().max(2e4).optional() }).default({});
+    StartTaskBody = z19.object({ prompt: z19.string().trim().max(2e4).optional() }).default({});
     app.post("/api/tasks/:id/start", async (request, reply) => {
       const body = StartTaskBody.safeParse(request.body ?? {});
       if (!body.success) return reply.code(400).send({ error: "The task prompt is too long." });
@@ -5058,7 +5596,7 @@ var init_index = __esm({
       return automation.configure(parsed.data);
     });
     app.patch("/api/automation/queue", async (request, reply) => {
-      const parsed = z18.object({ taskId: z18.string().min(1), beforeId: z18.string().min(1).nullable() }).safeParse(request.body);
+      const parsed = z19.object({ taskId: z19.string().min(1), beforeId: z19.string().min(1).nullable() }).safeParse(request.body);
       if (!parsed.success)
         return reply.code(400).send({ error: "Choose a task and a queue position." });
       try {
@@ -5115,12 +5653,31 @@ var init_index = __esm({
       type: "snapshot",
       sessions: Effect17.runSync(store.list())
     }));
+    phone = process.env.AGENTRIFIC_DESKTOP_SERVER === "1" ? new DesktopPhoneConnection(
+      () => {
+        const origin = localServerUrl();
+        if (!origin) throw new Error("Start the local server before connecting your phone.");
+        return origin;
+      },
+      (url) => {
+        if (phoneOrigin) {
+          const index = allowedOrigins.indexOf(phoneOrigin);
+          if (index >= 0) allowedOrigins.splice(index, 1);
+        }
+        phoneOrigin = url || void 0;
+        process.env.AGENTRIFIC_PUBLIC_URL = url || "";
+        if (url && !allowedOrigins.includes(url)) allowedOrigins.push(url);
+      },
+      path13.join(dataRoot, "phone-connection")
+    ) : void 0;
     closeControl = await startControl(
       dataRoot,
       security,
       () => ({
         serverId: security.serverId,
         publicUrl: process.env.AGENTRIFIC_PUBLIC_URL,
+        phoneProvider: phone?.snapshot().provider,
+        localUrl: localServerUrl(),
         serverVersion,
         connectedDevices: new Set(security.sockets.values()).size,
         connectedSockets: security.sockets.size,
@@ -5128,10 +5685,16 @@ var init_index = __esm({
         activeRuns: activeAgents(Effect17.runSync(store.list())),
         maintenance: maintenance.status()
       }),
-      maintenance
+      maintenance,
+      async () => {
+        await app.close();
+        process.exit(0);
+      },
+      phone
     );
     push.start();
     app.addHook("onClose", async () => {
+      await phone?.close();
       await push.close();
       maintenance.enter();
       stopUpdateDiscovery();
@@ -5164,9 +5727,9 @@ var init_index = __esm({
 
 // src/cli.ts
 init_warnings();
-import { mkdir as mkdir6, readFile as readFile6, writeFile as writeFile5 } from "node:fs/promises";
+import { mkdir as mkdir7, readFile as readFile7, writeFile as writeFile6 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
-import path12 from "node:path";
+import path14 from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/service.ts
@@ -5265,284 +5828,18 @@ init_version();
 init_pairing();
 import { spawn as spawn2 } from "node:child_process";
 import { parseArgs } from "node:util";
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 
 // src/terminal.ts
 init_pairing();
 init_cli_output();
+init_tunnels();
+init_opentunnel();
 import { createInterface } from "node:readline/promises";
 import select from "@inquirer/select";
 import { emitKeypressEvents as emitKeypressEvents2 } from "node:readline";
 import { styleText as styleText3 } from "node:util";
-
-// src/tunnels.ts
-init_cli_output();
-import { spawn } from "node:child_process";
-import { access, stat } from "node:fs/promises";
-import { constants } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import path3 from "node:path";
-import { z as z5 } from "zod";
-function signalChild(child, signal) {
-  if (!child.pid) return;
-  if (process.platform === "win32") {
-    child.kill(signal);
-    return;
-  }
-  try {
-    process.kill(-child.pid, signal);
-  } catch (error) {
-    if (!z5.object({ code: z5.literal("ESRCH") }).safeParse(error).success) child.kill(signal);
-  }
-}
-function execute2(file, args, timeoutMs, env = process.env) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(file, args, {
-      env,
-      detached: process.platform !== "win32",
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    let stdout = "";
-    let stderr = "";
-    const timeout = setTimeout(() => {
-      signalChild(child, "SIGKILL");
-      reject(new Error("Command probe timed out."));
-    }, timeoutMs);
-    child.stdout?.on("data", (data) => {
-      stdout += data.toString();
-      checkOutput();
-    });
-    child.stderr?.on("data", (data) => {
-      stderr += data.toString();
-      checkOutput();
-    });
-    child.once("error", (error) => {
-      clearTimeout(timeout);
-      reject(error);
-    });
-    child.once("exit", () => signalChild(child, "SIGKILL"));
-    child.once("close", (code) => {
-      clearTimeout(timeout);
-      if (code !== 0) reject(new Error("Command probe failed."));
-      else resolve({ stdout, stderr });
-    });
-    function checkOutput() {
-      if (stdout.length + stderr.length <= 1048576) return;
-      signalChild(child, "SIGKILL");
-      reject(new Error("Command probe output exceeded its limit."));
-    }
-  });
-}
-async function findExecutable(name) {
-  const candidates = (process.env.PATH ?? "").split(path3.delimiter).map((directory) => path3.resolve(directory, name));
-  if (process.platform === "darwin") {
-    candidates.push(`/opt/homebrew/bin/${name}`, `/usr/local/bin/${name}`);
-    if (name === "tailscale")
-      candidates.push("/Applications/Tailscale.app/Contents/MacOS/Tailscale");
-  }
-  for (const candidate of candidates) {
-    try {
-      await access(candidate, constants.X_OK);
-      if ((await stat(candidate)).isFile()) return candidate;
-    } catch {
-      continue;
-    }
-  }
-  return void 0;
-}
-var TcpConfig = z5.object({ TCP: z5.record(z5.string(), z5.unknown()).optional() });
-var ServeConfig = TcpConfig.extend({
-  Foreground: z5.record(z5.string(), TcpConfig).optional()
-});
-async function probeTailscale() {
-  const option = { provider: "tailscale", available: false, reason: "Not installed" };
-  const executable = await findExecutable("tailscale");
-  if (!executable) return option;
-  option.executable = executable;
-  const env = { ...process.env, TAILSCALE_BE_CLI: "1" };
-  try {
-    const response = await execute2(executable, ["status", "--json"], 3e3, env);
-    const status = z5.object({
-      BackendState: z5.string(),
-      CertDomains: z5.array(z5.string()).optional(),
-      Self: z5.object({ DNSName: z5.string() }).nullable().optional()
-    }).parse(JSON.parse(response.stdout));
-    if (status.BackendState !== "Running")
-      return { ...option, reason: "Installed \xB7 connect Tailscale first" };
-    const dns = status.Self?.DNSName.replace(/\.$/, "");
-    if (!dns || !status.CertDomains?.includes(dns))
-      return { ...option, reason: "Enable HTTPS certificates in your tailnet first" };
-    const help = await execute2(executable, ["serve", "--help"], 2e3, env);
-    if (!`${help.stdout}${help.stderr}`.includes("--https"))
-      return { ...option, reason: "Update Tailscale to use foreground HTTPS Serve" };
-    const responseConfig = await execute2(executable, ["serve", "status", "--json"], 3e3, env);
-    const config = ServeConfig.parse(JSON.parse(responseConfig.stdout) ?? {});
-    const occupied = new Set(Object.keys(config.TCP ?? {}));
-    for (const foreground of Object.values(config.Foreground ?? {}))
-      for (const port3 of Object.keys(foreground.TCP ?? {})) occupied.add(port3);
-    const port2 = [443, ...Array.from({ length: 10 }, (_, index) => 8443 + index)].find(
-      (candidate) => !occupied.has(String(candidate))
-    );
-    if (!port2) return { ...option, reason: "HTTPS Serve ports are in use \xB7 paste an existing URL" };
-    return {
-      ...option,
-      available: true,
-      reason: "Private to your tailnet \xB7 Tailscale required on your phone",
-      publicUrl: new URL(`https://${dns}${port2 === 443 ? "" : `:${port2}`}`).origin,
-      httpsPort: port2
-    };
-  } catch {
-    return { ...option, reason: "Installed \xB7 could not verify daemon or Serve access" };
-  }
-}
-async function probeCloudflared(home) {
-  const option = {
-    provider: "cloudflared",
-    available: false,
-    reason: "Not installed"
-  };
-  const executable = await findExecutable("cloudflared");
-  if (!executable) return option;
-  option.executable = executable;
-  try {
-    await execute2(executable, ["--version"], 2e3);
-    const help = await execute2(executable, ["tunnel", "--help"], 2e3);
-    if (!`${help.stdout}${help.stderr}`.includes("--url"))
-      return { ...option, reason: "Installed \xB7 this version does not support Quick Tunnels" };
-  } catch {
-    return { ...option, reason: "Installed \xB7 command probe failed or timed out" };
-  }
-  const directories = [
-    path3.join(home, ".cloudflared"),
-    path3.join(home, ".cloudflare-warp"),
-    path3.join(home, "cloudflare-warp"),
-    "/etc/cloudflared",
-    "/usr/local/etc/cloudflared"
-  ];
-  const configurations = await Promise.all(
-    directories.flatMap(
-      (directory) => ["config.yml", "config.yaml"].map(
-        async (name) => access(path3.join(directory, name), constants.F_OK).then(
-          () => true,
-          () => false
-        )
-      )
-    )
-  );
-  if (configurations.some(Boolean))
-    return { ...option, reason: "Existing tunnel configuration \xB7 paste its HTTPS URL" };
-  return { ...option, available: true, reason: "Temporary public HTTPS URL \xB7 changes each start" };
-}
-async function detectTunnels(home = homedir2()) {
-  return Promise.all([probeTailscale(), probeCloudflared(home)]);
-}
-var ManagedTunnel = class {
-  constructor(option) {
-    this.option = option;
-  }
-  option;
-  child;
-  stopping = false;
-  connected = false;
-  closing;
-  running() {
-    return this.connected && !this.stopping;
-  }
-  stopOnSignal = () => {
-    void this.close();
-  };
-  stopOnExit = () => {
-    if (this.child) signalChild(this.child, "SIGKILL");
-  };
-  async start(origin, signal) {
-    signal?.throwIfAborted();
-    if (!this.option.available) throw new Error(this.option.reason);
-    const tailscale = this.option.provider === "tailscale";
-    const child = spawn(
-      this.option.executable ?? this.option.provider,
-      tailscale ? ["serve", "--bg=false", `--https=${this.option.httpsPort}`, origin] : ["tunnel", "--no-autoupdate", "--url", origin],
-      {
-        stdio: ["ignore", "pipe", "pipe"],
-        detached: process.platform !== "win32",
-        env: tailscale ? { ...process.env, TAILSCALE_BE_CLI: "1" } : process.env
-      }
-    );
-    this.child = child;
-    process.once("SIGINT", this.stopOnSignal);
-    process.once("SIGTERM", this.stopOnSignal);
-    process.once("exit", this.stopOnExit);
-    return new Promise((resolve, reject) => {
-      let output = "";
-      let address;
-      let settled = false;
-      const abort = () => fail("Tunnel startup canceled.");
-      const timeout = setTimeout(
-        () => fail("Tunnel startup timed out. Check your connection or paste an existing HTTPS URL."),
-        45e3
-      );
-      const fail = (message) => {
-        if (settled) return;
-        settled = true;
-        clearTimeout(timeout);
-        signal?.removeEventListener("abort", abort);
-        void this.close();
-        reject(new Error(message));
-      };
-      const read = (data) => {
-        output = `${output}${data.toString()}`.slice(-65536);
-        address = tailscale ? this.option.publicUrl : output.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com\b/)?.[0];
-        const ready = tailscale ? Boolean(
-          address && output.includes(address) && output.includes("Available within your tailnet")
-        ) : output.includes("Registered tunnel connection");
-        if (settled || !address || !ready) return;
-        settled = true;
-        this.connected = true;
-        clearTimeout(timeout);
-        signal?.removeEventListener("abort", abort);
-        resolve(address);
-      };
-      child.stdout?.on("data", read);
-      child.stderr?.on("data", read);
-      signal?.addEventListener("abort", abort, { once: true });
-      child.once(
-        "error",
-        () => fail(`${this.option.provider} could not start. Check the installation and permissions.`)
-      );
-      child.once("exit", () => signalChild(child, "SIGTERM"));
-      child.once("close", (code) => {
-        const unexpected = this.connected && !this.stopping;
-        this.connected = false;
-        process.removeListener("SIGINT", this.stopOnSignal);
-        process.removeListener("SIGTERM", this.stopOnSignal);
-        process.removeListener("exit", this.stopOnExit);
-        fail(
-          `${this.option.provider} exited (${code ?? "signal"}). Check tunnel access or paste an existing HTTPS URL.`
-        );
-        if (unexpected)
-          printError(
-            "The managed tunnel stopped. Restart the server to reconnect your phone; local work can continue."
-          );
-      });
-    });
-  }
-  close() {
-    this.stopping = true;
-    const child = this.child;
-    if (!child?.pid || child.exitCode !== null || child.signalCode !== null)
-      return Promise.resolve();
-    this.closing ??= new Promise((resolve) => {
-      const timeout = setTimeout(() => signalChild(child, "SIGKILL"), 2e3);
-      child.once("close", () => {
-        clearTimeout(timeout);
-        resolve();
-      });
-      signalChild(child, "SIGTERM");
-    });
-    return this.closing;
-  }
-};
-
-// src/terminal.ts
+import path5 from "node:path";
 async function promptPublicUrl(signal, saved) {
   const prompt = createInterface({ input: process.stdin, output: process.stdout });
   const cancel = () => controller.abort();
@@ -5586,9 +5883,14 @@ async function selectConnectionMethod(options, signal, saved) {
   return select(
     {
       message: "Connection method",
-      default: saved ? "existing" : void 0,
+      default: saved ? "existing" : "opentunnel",
       loop: false,
       choices: [
+        {
+          value: "opentunnel",
+          name: "OpenTunnel (default)",
+          description: "Built-in HTTPS connection with a persistent address. No separate CLI needed."
+        },
         ...options.filter((option) => option.available).map((option) => ({
           value: option.provider,
           name: option.provider === "tailscale" ? "Tailscale" : "Cloudflared",
@@ -5619,13 +5921,14 @@ async function selectConnectionMethod(options, signal, saved) {
     { signal }
   );
 }
-async function startSelectedTunnel(options, choice, origin, signal) {
+async function startSelectedTunnel(options, choice, origin, signal, dataDir) {
   const option = options.find((candidate) => candidate.provider === choice);
-  if (!option?.available) throw new Error("The selected tunnel is unavailable.");
-  const tunnel = new ManagedTunnel(option);
+  if (choice !== "opentunnel" && !option?.available)
+    throw new Error("The selected tunnel is unavailable.");
+  const tunnel = choice === "opentunnel" ? new OpenTunnel(path5.join(dataDir, "phone-connection")) : new ManagedTunnel(option);
   try {
     console.log(styleText3("dim", `
-  Starting ${option.provider}\u2026
+  Starting ${choice}\u2026
 `));
     const url = await tunnel.start(origin, signal);
     return { url, tunnel, remember: false };
@@ -5636,7 +5939,7 @@ async function startSelectedTunnel(options, choice, origin, signal) {
     return void 0;
   }
 }
-async function selectPublicConnection(origin, saved) {
+async function selectPublicConnection(origin, saved, dataDir = process.env.AGENTRIFIC_DATA_DIR || ".agentrific") {
   const controller = new AbortController();
   const cancel = () => controller.abort();
   process.once("SIGINT", cancel);
@@ -5657,7 +5960,13 @@ async function selectPublicConnection(origin, saved) {
         console.log();
         return { url: await promptPublicUrl(controller.signal, saved), remember: true };
       }
-      const connection = await startSelectedTunnel(options, choice, origin, controller.signal);
+      const connection = await startSelectedTunnel(
+        options,
+        choice,
+        origin,
+        controller.signal,
+        dataDir
+      );
       if (connection) return connection;
     }
   } finally {
@@ -5745,11 +6054,14 @@ function startTerminal(dataDir, publicUrl, tunnel) {
 }
 
 // src/cli.ts
+init_opentunnel();
+init_tunnels();
 init_cli_output();
-var ConfigSchema = z19.object({
-  dataDir: z19.string(),
-  projectsDir: z19.string(),
-  publicUrl: z19.string().url().optional()
+var ConfigSchema = z20.object({
+  dataDir: z20.string(),
+  projectsDir: z20.string(),
+  publicUrl: z20.string().url().optional(),
+  connection: z20.enum(["opentunnel", "tailscale", "cloudflared", "existing", "local"]).optional()
 });
 function parseCommandArgs() {
   return parseArgs({
@@ -5757,6 +6069,7 @@ function parseCommandArgs() {
     options: {
       "data-dir": { type: "string" },
       "public-url": { type: "string" },
+      connection: { type: "string" },
       version: { type: "boolean" },
       help: { type: "boolean" },
       check: { type: "boolean" },
@@ -5777,15 +6090,15 @@ async function main() {
     printHelp();
     return;
   }
-  const dataDir = path12.resolve(
-    values["data-dir"] ?? process.env.AGENTRIFIC_DATA_DIR ?? path12.join(homedir5(), ".agentrific")
+  const dataDir = path14.resolve(
+    values["data-dir"] ?? process.env.AGENTRIFIC_DATA_DIR ?? path14.join(homedir5(), ".agentrific")
   );
-  const filename = path12.join(dataDir, "config.json");
+  const filename = path14.join(dataDir, "config.json");
   const config = ConfigSchema.parse(
     JSON.parse(
-      await readFile6(filename, "utf8").catch((error) => {
-        if (!z19.object({ code: z19.literal("ENOENT") }).safeParse(error).success) throw error;
-        return JSON.stringify({ dataDir, projectsDir: path12.join(homedir5(), "projects") });
+      await readFile7(filename, "utf8").catch((error) => {
+        if (!z20.object({ code: z20.literal("ENOENT") }).safeParse(error).success) throw error;
+        return JSON.stringify({ dataDir, projectsDir: path14.join(homedir5(), "projects") });
       })
     )
   );
@@ -5802,11 +6115,12 @@ async function main() {
   throw new Error("Unknown command. Run agentrific --help.");
 }
 async function initCommand({ values, dataDir, filename, config }) {
-  await mkdir6(dataDir, { recursive: true, mode: 448 });
+  await mkdir7(dataDir, { recursive: true, mode: 448 });
   const publicUrl = values["public-url"] ?? config.publicUrl;
+  const connection = values.connection ? ConfigSchema.shape.connection.unwrap().parse(values.connection) : config.connection;
   if (publicUrl && new URL(publicUrl).protocol !== "https:")
     throw new Error("Configure an HTTPS URL from Tailscale Serve or Cloudflare Tunnel.");
-  await writeFile5(filename, JSON.stringify({ ...config, publicUrl }, null, 2) + "\n", {
+  await writeFile6(filename, JSON.stringify({ ...config, publicUrl, connection }, null, 2) + "\n", {
     mode: 384
   });
   console.log(`Configuration saved to ${filename}. Start with agentrific start.`);
@@ -5819,28 +6133,48 @@ async function startCommand({ values, dataDir, filename, config }) {
     process.stdin.isTTY && process.stdout.isTTY && !values["no-interactive"]
   );
   const explicitUrl = values["public-url"] ?? process.env.AGENTRIFIC_PUBLIC_URL;
+  const method = values.connection ? z20.enum(["opentunnel", "tailscale", "cloudflared", "existing", "local"]).parse(values.connection) : explicitUrl ? "existing" : config.connection;
+  const origin = `http://${process.env.AGENTRIFIC_HOST ?? "127.0.0.1"}:${process.env.AGENTRIFIC_PORT ?? "4318"}`;
   if (interactive) {
     process.env.AGENTRIFIC_INTERACTIVE = "1";
     printHeading("server");
   }
-  const connection = interactive && !explicitUrl ? await selectPublicConnection(
-    `http://${process.env.AGENTRIFIC_HOST ?? "127.0.0.1"}:${process.env.AGENTRIFIC_PORT ?? "4318"}`,
-    config.publicUrl
-  ) : {
-    url: explicitUrl ? pairingOrigin(explicitUrl) : config.publicUrl,
+  let connection = interactive && !explicitUrl && !method ? await selectPublicConnection(origin, config.publicUrl, dataDir) : {
+    url: method === "local" ? void 0 : explicitUrl ? pairingOrigin(explicitUrl) : config.publicUrl,
     remember: false,
     tunnel: void 0
   };
+  const provider = method || (!interactive && !connection.url ? "opentunnel" : void 0);
+  if (provider && !["existing", "local"].includes(provider)) {
+    const option = provider === "opentunnel" ? void 0 : (await detectTunnels()).find((candidate) => candidate.provider === provider);
+    if (provider !== "opentunnel" && !option?.available)
+      throw new Error(option?.reason || "The selected tunnel is unavailable.");
+    const tunnel = provider === "opentunnel" ? new OpenTunnel(path14.join(dataDir, "phone-connection")) : new ManagedTunnel(option);
+    try {
+      connection = { url: await tunnel.start(origin), remember: false, tunnel };
+    } catch (error) {
+      await tunnel.close();
+      throw error;
+    }
+  }
+  if (method === "existing" && !connection.url)
+    throw new Error("Pass --public-url with the HTTPS address from your existing tunnel.");
   const publicUrl = connection.url;
   try {
     if (connection.remember && publicUrl) {
-      await mkdir6(dataDir, { recursive: true, mode: 448 });
-      await writeFile5(filename, JSON.stringify({ ...config, publicUrl }, null, 2) + "\n", {
+      await mkdir7(dataDir, { recursive: true, mode: 448 });
+      await writeFile6(filename, JSON.stringify({ ...config, publicUrl }, null, 2) + "\n", {
         mode: 384
       });
     }
     if (publicUrl) process.env.AGENTRIFIC_PUBLIC_URL = pairingOrigin(publicUrl);
+    else delete process.env.AGENTRIFIC_PUBLIC_URL;
     await init_index().then(() => index_exports);
+    if (connection.tunnel) {
+      const close = () => void connection.tunnel?.close();
+      process.once("SIGINT", close);
+      process.once("SIGTERM", close);
+    }
     if (interactive) startTerminal(dataDir, publicUrl, connection.tunnel);
   } catch (error) {
     await connection.tunnel?.close();
@@ -5857,7 +6191,7 @@ async function serviceCommand({ positionals, dataDir }) {
   return;
 }
 async function logsCommand({ dataDir }) {
-  const child = process.platform === "linux" ? spawn2("journalctl", ["--user", "-u", "agentrific.service", "-f"], { stdio: "inherit" }) : spawn2("tail", ["-F", path12.join(dataDir, "logs", "server.log")], { stdio: "inherit" });
+  const child = process.platform === "linux" ? spawn2("journalctl", ["--user", "-u", "agentrific.service", "-f"], { stdio: "inherit" }) : spawn2("tail", ["-F", path14.join(dataDir, "logs", "server.log")], { stdio: "inherit" });
   child.on("error", (error) => {
     console.error(error.message);
     process.exitCode = 1;
@@ -5891,11 +6225,11 @@ async function pairCommand({ values, dataDir, config }) {
   return;
 }
 async function maintenanceCommand({ values, positionals, dataDir }) {
-  const action = z19.enum(["enter", "resume", "drain"]).parse(positionals[1]);
+  const action = z20.enum(["enter", "resume", "drain"]).parse(positionals[1]);
   const result = await controlRequest(dataDir, {
     command: "maintenance",
     action,
-    timeoutMs: z19.coerce.number().int().min(0).max(6e4).parse(values["timeout-ms"] ?? 3e4)
+    timeoutMs: z20.coerce.number().int().min(0).max(6e4).parse(values["timeout-ms"] ?? 3e4)
   });
   console.log(JSON.stringify(result, null, 2));
   if (action === "drain" && "drained" in result && !result.drained) process.exitCode = 1;
@@ -5904,7 +6238,7 @@ async function maintenanceCommand({ values, positionals, dataDir }) {
 async function devicesCommand({ dataDir, command }) {
   console.log(
     JSON.stringify(
-      await controlRequest(dataDir, { command: z19.enum(["devices", "status"]).parse(command) }),
+      await controlRequest(dataDir, { command: z20.enum(["devices", "status"]).parse(command) }),
       null,
       2
     )
@@ -5912,7 +6246,7 @@ async function devicesCommand({ dataDir, command }) {
   return;
 }
 async function revokeCommand({ positionals, dataDir }) {
-  const id = z19.string().uuid().parse(positionals[1]);
+  const id = z20.string().uuid().parse(positionals[1]);
   console.log(JSON.stringify(await controlRequest(dataDir, { command: "revoke", id })));
   return;
 }