@agentrific/server 0.5.2 → 0.7.0

package/cli.js

@@ -30,7 +30,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@agentrific/server",
-      version: "0.5.2",
+      version: "0.7.0",
       description: "Self-hosted control plane for long-running coding agents",
       keywords: [
         "agentrific",
@@ -56,20 +56,28 @@ var init_package = __esm({
         registry: "https://registry.npmjs.org"
       },
       scripts: {
-        dev: "tsx watch src/index.ts",
+        dev: "node scripts/build-claude-bridge.mjs && tsx watch src/index.ts",
         start: "node dist/index.js",
         typecheck: "tsc --noEmit",
         build: "node scripts/build.mjs",
-        cli: "AGENTRIFIC_DATA_DIR=./data tsx src/cli.ts"
+        cli: "node scripts/build-claude-bridge.mjs && AGENTRIFIC_DATA_DIR=./data tsx src/cli.ts",
+        "build:claude": "node scripts/build-claude-bridge.mjs"
       },
       dependencies: {
+        "@anthropic-ai/claude-agent-sdk": "0.3.296",
+        "@anthropic-ai/sdk": "^0.124.0",
+        "@earendil-works/pi-ai": "1.0.0",
         "@earendil-works/pi-coding-agent": "1.0.0",
         "@fastify/cors": "^11.3.0",
         "@fastify/multipart": "^10.1.2",
         "@inquirer/select": "^5.2.5",
+        "@modelcontextprotocol/sdk": "^1.29.0",
+        "cc-session-io": "^0.4.0",
+        "change-case": "^5.4.4",
         diff: "^9.0.0",
         effect: "4.0.0-rc.117",
         fastify: "^5.6.2",
+        "pi-claude-agent-sdk": "0.9.2",
         "pino-pretty": "^13.1.3",
         "qrcode-terminal": "^0.12.0",
         semver: "^7.8.5",
@@ -80,6 +88,7 @@ var init_package = __esm({
       },
       devDependencies: {
         "@agentrific/contracts": "workspace:*",
+        "@agentrific/opentunnel-runtime": "workspace:*",
         "@jest/globals": "30.5.2",
         "@types/node": "^22.19.1",
         "@types/qrcode-terminal": "^0.12.2",
@@ -650,7 +659,7 @@ async function acquireServerLock(directory) {
       await unlink2(filename);
   };
 }
-async function startControl(directory, security2, status, maintenance2, shutdown) {
+async function startControl(directory, security2, status, maintenance2, shutdown, phone2) {
   const filename = controlSocketPath(directory);
   const socketDirectory = path2.dirname(filename);
   await mkdir2(socketDirectory, { recursive: true, mode: 448 });
@@ -677,6 +686,29 @@ async function startControl(directory, security2, status, maintenance2, shutdown
           const request = ControlRequest.parse(JSON.parse(buffer.split("\n")[0]));
           let result;
           switch (request.command) {
+            case "phone-options":
+              if (!phone2) throw new Error("Phone connections are managed by the desktop app.");
+              socket.setTimeout(18e4);
+              result = await phone2.options();
+              break;
+            case "phone-start": {
+              if (!phone2) throw new Error("Phone connections are managed by the desktop app.");
+              maintenance2?.assertReady();
+              socket.setTimeout(18e4);
+              const abort = new AbortController();
+              const disconnected = () => abort.abort();
+              socket.once("close", disconnected);
+              try {
+                result = await phone2.start(request.provider, abort.signal);
+              } finally {
+                socket.removeListener("close", disconnected);
+              }
+              break;
+            }
+            case "phone-stop":
+              if (!phone2) throw new Error("Phone connections are managed by the desktop app.");
+              result = await phone2.close();
+              break;
             case "shutdown":
               if (!shutdown || !maintenance2?.status().drained)
                 throw new Error("Drain the server before shutdown");
@@ -746,12 +778,13 @@ function controlRequest(directory, command) {
     });
   });
 }
-var MaintenanceSchema, ControlStatusSchema, ControlResultSchema, ControlRequest;
+var ProviderSchema, MaintenanceSchema, ControlStatusSchema, ControlResultSchema, ControlRequest;
 var init_control = __esm({
   "src/control.ts"() {
     "use strict";
     init_control_socket();
     init_src();
+    ProviderSchema = z3.enum(["opentunnel", "tailscale", "cloudflared"]);
     MaintenanceSchema = z3.object({
       active: z3.boolean(),
       drained: z3.boolean(),
@@ -760,6 +793,8 @@ var init_control = __esm({
     ControlStatusSchema = z3.object({
       serverId: z3.string().uuid(),
       publicUrl: z3.string().optional(),
+      phoneProvider: ProviderSchema.nullable().optional(),
+      phoneProgress: z3.string().nullable().optional(),
       localUrl: z3.string().optional(),
       serverVersion: z3.string().optional(),
       connectedDevices: z3.number().optional(),
@@ -769,6 +804,12 @@ var init_control = __esm({
       maintenance: MaintenanceSchema.optional()
     });
     ControlResultSchema = z3.union([
+      z3.object({
+        provider: ProviderSchema.nullable(),
+        publicUrl: z3.string().url().nullable(),
+        progress: z3.string().nullable().optional()
+      }),
+      z3.array(z3.object({ provider: ProviderSchema, available: z3.boolean(), reason: z3.string() })),
       z3.object({
         pairingId: z3.string(),
         pin: z3.string(),
@@ -782,6 +823,9 @@ var init_control = __esm({
       MaintenanceSchema
     ]);
     ControlRequest = z3.discriminatedUnion("command", [
+      z3.object({ command: z3.literal("phone-options") }),
+      z3.object({ command: z3.literal("phone-start"), provider: ProviderSchema }),
+      z3.object({ command: z3.literal("phone-stop") }),
       z3.object({ command: z3.literal("pair") }),
       z3.object({ command: z3.literal("devices") }),
       z3.object({ command: z3.literal("status") }),
@@ -855,6 +899,7 @@ function printHelp() {
   for (const [option, description] of [
     ["--data-dir <path>", "Use a specific server data directory"],
     ["--public-url <https-url>", "Use your tunnel URL without prompting"],
+    ["--connection <method>", "opentunnel (default), tailscale, cloudflared, existing, or local"],
     ["--no-interactive", "Disable prompts and keyboard shortcuts"],
     ["--show-payload", "Print manual JSON with the pairing QR code"],
     ["--timeout-ms <0-60000>", "Set the maintenance drain timeout"],
@@ -862,7 +907,9 @@ function printHelp() {
     ["--help", "Show this help"]
   ])
     console.log(`  ${styleText("cyan", option.padEnd(34))}${description}`);
-  console.log("\n  Connect using Tailscale Serve, cloudflared, or another HTTPS tunnel.\n");
+  console.log(
+    "\n  OpenTunnel is built in. Tailscale, cloudflared and existing HTTPS tunnels are also supported.\n"
+  );
 }
 var init_cli_output = __esm({
   "src/cli-output.ts"() {
@@ -992,8 +1039,402 @@ var init_pairing = __esm({
   }
 });
 
-// ../../packages/contracts/src/push.ts
+// src/tunnels.ts
+import { spawn } from "node:child_process";
+import { access, stat } from "node:fs/promises";
+import { constants } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import path3 from "node:path";
+import { z as z5 } from "zod";
+function signalChild(child, signal) {
+  if (!child.pid) return;
+  if (process.platform === "win32") {
+    child.kill(signal);
+    return;
+  }
+  try {
+    process.kill(-child.pid, signal);
+  } catch (error) {
+    if (!z5.object({ code: z5.literal("ESRCH") }).safeParse(error).success) child.kill(signal);
+  }
+}
+function execute2(file, args, timeoutMs, env = process.env) {
+  return new Promise((resolve2, reject) => {
+    const child = spawn(file, args, {
+      env,
+      detached: process.platform !== "win32",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    const timeout = setTimeout(() => {
+      signalChild(child, "SIGKILL");
+      reject(new Error("Command probe timed out."));
+    }, timeoutMs);
+    child.stdout?.on("data", (data) => {
+      stdout += data.toString();
+      checkOutput();
+    });
+    child.stderr?.on("data", (data) => {
+      stderr += data.toString();
+      checkOutput();
+    });
+    child.once("error", (error) => {
+      clearTimeout(timeout);
+      reject(error);
+    });
+    child.once("exit", () => signalChild(child, "SIGKILL"));
+    child.once("close", (code) => {
+      clearTimeout(timeout);
+      if (code !== 0) reject(new Error("Command probe failed."));
+      else resolve2({ stdout, stderr });
+    });
+    function checkOutput() {
+      if (stdout.length + stderr.length <= 1048576) return;
+      signalChild(child, "SIGKILL");
+      reject(new Error("Command probe output exceeded its limit."));
+    }
+  });
+}
+async function findExecutable(name) {
+  const candidates = (process.env.PATH ?? "").split(path3.delimiter).map((directory) => path3.resolve(directory, name));
+  if (process.platform === "darwin") {
+    candidates.push(`/opt/homebrew/bin/${name}`, `/usr/local/bin/${name}`);
+    if (name === "tailscale")
+      candidates.push("/Applications/Tailscale.app/Contents/MacOS/Tailscale");
+  }
+  for (const candidate of candidates) {
+    try {
+      await access(candidate, constants.X_OK);
+      if ((await stat(candidate)).isFile()) return candidate;
+    } catch {
+      continue;
+    }
+  }
+  return void 0;
+}
+async function probeTailscale() {
+  const option = { provider: "tailscale", available: false, reason: "Not installed" };
+  const executable = await findExecutable("tailscale");
+  if (!executable) return option;
+  option.executable = executable;
+  const env = { ...process.env, TAILSCALE_BE_CLI: "1" };
+  try {
+    const response = await execute2(executable, ["status", "--json"], 3e3, env);
+    const status = z5.object({
+      BackendState: z5.string(),
+      CertDomains: z5.array(z5.string()).optional(),
+      Self: z5.object({ DNSName: z5.string() }).nullable().optional()
+    }).parse(JSON.parse(response.stdout));
+    if (status.BackendState !== "Running")
+      return { ...option, reason: "Installed \xB7 connect Tailscale first" };
+    const dns = status.Self?.DNSName.replace(/\.$/, "");
+    if (!dns || !status.CertDomains?.includes(dns))
+      return { ...option, reason: "Enable HTTPS certificates in your tailnet first" };
+    const help = await execute2(executable, ["serve", "--help"], 2e3, env);
+    if (!`${help.stdout}${help.stderr}`.includes("--https"))
+      return { ...option, reason: "Update Tailscale to use foreground HTTPS Serve" };
+    const responseConfig = await execute2(executable, ["serve", "status", "--json"], 3e3, env);
+    const config = ServeConfig.parse(JSON.parse(responseConfig.stdout) ?? {});
+    const occupied = new Set(Object.keys(config.TCP ?? {}));
+    for (const foreground of Object.values(config.Foreground ?? {}))
+      for (const port3 of Object.keys(foreground.TCP ?? {})) occupied.add(port3);
+    const port2 = [443, ...Array.from({ length: 10 }, (_, index) => 8443 + index)].find(
+      (candidate) => !occupied.has(String(candidate))
+    );
+    if (!port2) return { ...option, reason: "HTTPS Serve ports are in use \xB7 paste an existing URL" };
+    return {
+      ...option,
+      available: true,
+      reason: "Private to your tailnet \xB7 Tailscale required on your phone",
+      publicUrl: new URL(`https://${dns}${port2 === 443 ? "" : `:${port2}`}`).origin,
+      httpsPort: port2
+    };
+  } catch {
+    return { ...option, reason: "Installed \xB7 could not verify daemon or Serve access" };
+  }
+}
+async function probeCloudflared(home) {
+  const option = {
+    provider: "cloudflared",
+    available: false,
+    reason: "Not installed"
+  };
+  const executable = await findExecutable("cloudflared");
+  if (!executable) return option;
+  option.executable = executable;
+  try {
+    await execute2(executable, ["--version"], 2e3);
+    const help = await execute2(executable, ["tunnel", "--help"], 2e3);
+    if (!`${help.stdout}${help.stderr}`.includes("--url"))
+      return { ...option, reason: "Installed \xB7 this version does not support Quick Tunnels" };
+  } catch {
+    return { ...option, reason: "Installed \xB7 command probe failed or timed out" };
+  }
+  const directories = [
+    path3.join(home, ".cloudflared"),
+    path3.join(home, ".cloudflare-warp"),
+    path3.join(home, "cloudflare-warp"),
+    "/etc/cloudflared",
+    "/usr/local/etc/cloudflared"
+  ];
+  const configurations = await Promise.all(
+    directories.flatMap(
+      (directory) => ["config.yml", "config.yaml"].map(
+        async (name) => access(path3.join(directory, name), constants.F_OK).then(
+          () => true,
+          () => false
+        )
+      )
+    )
+  );
+  if (configurations.some(Boolean))
+    return { ...option, reason: "Existing tunnel configuration \xB7 paste its HTTPS URL" };
+  return { ...option, available: true, reason: "Temporary public HTTPS URL \xB7 changes each start" };
+}
+async function detectTunnels(home = homedir2()) {
+  return Promise.all([probeTailscale(), probeCloudflared(home)]);
+}
+var TcpConfig, ServeConfig, ManagedTunnel;
+var init_tunnels = __esm({
+  "src/tunnels.ts"() {
+    "use strict";
+    init_cli_output();
+    TcpConfig = z5.object({ TCP: z5.record(z5.string(), z5.unknown()).optional() });
+    ServeConfig = TcpConfig.extend({
+      Foreground: z5.record(z5.string(), TcpConfig).optional()
+    });
+    ManagedTunnel = class {
+      constructor(option, disconnected = () => {
+      }) {
+        this.option = option;
+        this.disconnected = disconnected;
+      }
+      option;
+      disconnected;
+      child;
+      stopping = false;
+      connected = false;
+      closing;
+      running() {
+        return this.connected && !this.stopping;
+      }
+      stopOnSignal = () => {
+        void this.close();
+      };
+      stopOnExit = () => {
+        if (this.child) signalChild(this.child, "SIGKILL");
+      };
+      async start(origin, signal) {
+        signal?.throwIfAborted();
+        if (!this.option.available) throw new Error(this.option.reason);
+        const tailscale = this.option.provider === "tailscale";
+        const child = spawn(
+          this.option.executable ?? this.option.provider,
+          tailscale ? ["serve", "--bg=false", `--https=${this.option.httpsPort}`, origin] : ["tunnel", "--no-autoupdate", "--url", origin],
+          {
+            stdio: ["ignore", "pipe", "pipe"],
+            detached: process.platform !== "win32",
+            env: tailscale ? { ...process.env, TAILSCALE_BE_CLI: "1" } : process.env
+          }
+        );
+        this.child = child;
+        process.once("SIGINT", this.stopOnSignal);
+        process.once("SIGTERM", this.stopOnSignal);
+        process.once("exit", this.stopOnExit);
+        return new Promise((resolve2, reject) => {
+          let output = "";
+          let address;
+          let settled = false;
+          const abort = () => fail("Tunnel startup canceled.");
+          const timeout = setTimeout(
+            () => fail("Tunnel startup timed out. Check your connection or paste an existing HTTPS URL."),
+            45e3
+          );
+          const fail = (message) => {
+            if (settled) return;
+            settled = true;
+            clearTimeout(timeout);
+            signal?.removeEventListener("abort", abort);
+            void this.close();
+            reject(new Error(message));
+          };
+          const read = (data) => {
+            output = `${output}${data.toString()}`.slice(-65536);
+            address = tailscale ? this.option.publicUrl : output.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com\b/)?.[0];
+            const ready = tailscale ? Boolean(
+              address && output.includes(address) && output.includes("Available within your tailnet")
+            ) : output.includes("Registered tunnel connection");
+            if (settled || !address || !ready) return;
+            settled = true;
+            this.connected = true;
+            clearTimeout(timeout);
+            signal?.removeEventListener("abort", abort);
+            resolve2(address);
+          };
+          child.stdout?.on("data", read);
+          child.stderr?.on("data", read);
+          signal?.addEventListener("abort", abort, { once: true });
+          child.once(
+            "error",
+            () => fail(`${this.option.provider} could not start. Check the installation and permissions.`)
+          );
+          child.once("exit", () => signalChild(child, "SIGTERM"));
+          child.once("close", (code) => {
+            const unexpected = this.connected && !this.stopping;
+            this.connected = false;
+            process.removeListener("SIGINT", this.stopOnSignal);
+            process.removeListener("SIGTERM", this.stopOnSignal);
+            process.removeListener("exit", this.stopOnExit);
+            fail(
+              `${this.option.provider} exited (${code ?? "signal"}). Check tunnel access or paste an existing HTTPS URL.`
+            );
+            if (unexpected) {
+              this.disconnected();
+              printError(
+                "The managed tunnel stopped. Restart the server to reconnect your phone; local work can continue."
+              );
+            }
+          });
+        });
+      }
+      close() {
+        this.stopping = true;
+        const child = this.child;
+        if (!child?.pid || child.exitCode !== null || child.signalCode !== null)
+          return Promise.resolve();
+        this.closing ??= new Promise((resolve2) => {
+          const timeout = setTimeout(() => signalChild(child, "SIGKILL"), 2e3);
+          child.once("close", () => {
+            clearTimeout(timeout);
+            resolve2();
+          });
+          signalChild(child, "SIGTERM");
+        });
+        return this.closing;
+      }
+    };
+  }
+});
+
+// src/opentunnel.ts
+import { randomBytes } from "node:crypto";
+import { chmod as chmod2, mkdir as mkdir3, readFile as readFile2, writeFile as writeFile3 } from "node:fs/promises";
+import path4 from "node:path";
 import { z as z6 } from "zod";
+import {
+  create,
+  OpenTunnelStorage
+} from "./opentunnel-sdk.js";
+var OpenTunnel;
+var init_opentunnel = __esm({
+  "src/opentunnel.ts"() {
+    "use strict";
+    OpenTunnel = class {
+      constructor(directory, disconnected = () => {
+      }, makeClient = create) {
+        this.directory = directory;
+        this.disconnected = disconnected;
+        this.makeClient = makeClient;
+      }
+      directory;
+      disconnected;
+      makeClient;
+      client;
+      connection;
+      stopping = false;
+      stage = "reading-identity";
+      progress() {
+        return this.connection?.status().state ?? this.stage;
+      }
+      running() {
+        return this.connection?.status().state === "connected" && !this.stopping;
+      }
+      async start(origin, signal) {
+        const endpoint = new URL(origin);
+        if (!["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname))
+          throw new Error("OpenTunnel must forward to the local loopback server.");
+        await mkdir3(this.directory, { recursive: true, mode: 448 });
+        await chmod2(this.directory, 448);
+        const routeFile = path4.join(this.directory, "route.json");
+        let route;
+        try {
+          route = z6.string().regex(/^[a-f0-9]{16}$/).parse(JSON.parse(await readFile2(routeFile, "utf8")));
+        } catch (error) {
+          if (!z6.object({ code: z6.literal("ENOENT") }).safeParse(error).success) throw error;
+          route = randomBytes(8).toString("hex");
+          await writeFile3(routeFile, JSON.stringify(route), { flag: "wx", mode: 384 });
+        }
+        this.stopping = false;
+        this.client = this.makeClient({
+          store: OpenTunnelStorage.xdg({ env: { XDG_DATA_HOME: this.directory } })
+        });
+        const abort = AbortSignal.any([
+          signal ?? new AbortController().signal,
+          AbortSignal.timeout(12e4)
+        ]);
+        let canceled = () => {
+        };
+        try {
+          const client = this.client;
+          this.stage = "reading-identity";
+          const connecting = (async () => {
+            const options = {
+              profile: "agentrific",
+              onProgress: (stage) => {
+                this.stage = stage;
+              }
+            };
+            const identity2 = await client.tunnel.get(options);
+            abort.throwIfAborted();
+            if (!identity2) {
+              const resumed = await client.tunnel.resume(options);
+              abort.throwIfAborted();
+              if (!resumed) await client.tunnel.create(options);
+            }
+            abort.throwIfAborted();
+            this.stage = "connecting";
+            return client.tunnel.connect({
+              profile: "agentrific",
+              routes: {
+                [route]: `${endpoint.hostname === "[::1]" ? "[::1]" : "127.0.0.1"}:${endpoint.port || "80"}`
+              },
+              signal
+            });
+          })();
+          const cancellation = new Promise((_resolve, reject) => {
+            canceled = () => reject(new Error("OpenTunnel connection canceled or timed out."));
+            abort.addEventListener("abort", canceled, { once: true });
+            if (abort.aborted) canceled();
+          });
+          const connection = await Promise.race([connecting, cancellation]);
+          this.connection = connection;
+          void connection.closed.then(() => {
+            if (!this.stopping) this.disconnected();
+          }).catch(() => {
+            if (!this.stopping) this.disconnected();
+          });
+          return `https://${route}.${connection.tunnel.hostname}`;
+        } catch (error) {
+          await this.close();
+          throw error;
+        } finally {
+          abort.removeEventListener("abort", canceled);
+        }
+      }
+      async close() {
+        this.stopping = true;
+        await this.connection?.close();
+        await this.client?.dispose();
+        this.connection = void 0;
+        this.client = void 0;
+      }
+    };
+  }
+});
+
+// ../../packages/contracts/src/push.ts
+import { z as z7 } from "zod";
 function pushSigningText(installationId, operation, request) {
   return [
     "agentrific-push-v1",
@@ -1011,7 +1452,7 @@ var init_push = __esm({
     "use strict";
     PUSH_API_URL = "https://api.agentrific.com";
     PUSH_SANDBOX_API_URL = "https://sandbox-api.agentrific.com";
-    PushKindSchema = z6.enum([
+    PushKindSchema = z7.enum([
       "started",
       "completed",
       "needs_input",
@@ -1020,47 +1461,47 @@ var init_push = __esm({
       "pr_created",
       "failed"
     ]);
-    PushPreferencesSchema = z6.array(PushKindSchema).max(7);
-    PushPublicKeySchema = z6.string().regex(/^[a-f0-9]{64}$/);
-    PushInstallationSchema = z6.object({ installationId: z6.string().uuid(), token: z6.string().regex(/^[a-f0-9]{64}$/) }).strict();
-    PushRegistrationSchema = z6.object({
-      expoToken: z6.string().regex(/^(Expo|Exponent)PushToken\[[A-Za-z0-9_-]+\]$/),
+    PushPreferencesSchema = z7.array(PushKindSchema).max(7);
+    PushPublicKeySchema = z7.string().regex(/^[a-f0-9]{64}$/);
+    PushInstallationSchema = z7.object({ installationId: z7.string().uuid(), token: z7.string().regex(/^[a-f0-9]{64}$/) }).strict();
+    PushRegistrationSchema = z7.object({
+      expoToken: z7.string().regex(/^(Expo|Exponent)PushToken\[[A-Za-z0-9_-]+\]$/),
       preferences: PushPreferencesSchema
     }).strict();
-    PushEnrollmentSchema = z6.object({ serverId: z6.string().uuid(), publicKey: PushPublicKeySchema }).strict();
+    PushEnrollmentSchema = z7.object({ serverId: z7.string().uuid(), publicKey: PushPublicKeySchema }).strict();
     PushGrantSchema = PushEnrollmentSchema.extend({
-      installationId: z6.string().uuid(),
-      bindingId: z6.string().uuid(),
-      grant: z6.string().regex(/^[a-f0-9]{64}$/),
-      expiresAt: z6.number()
+      installationId: z7.string().uuid(),
+      bindingId: z7.string().uuid(),
+      grant: z7.string().regex(/^[a-f0-9]{64}$/),
+      expiresAt: z7.number()
     }).strict();
-    PushPullRequestUrlSchema = z6.string().max(512).regex(/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/);
-    PushEventSchema = z6.object({
-      eventId: z6.string().uuid(),
-      sessionId: z6.string().uuid(),
+    PushPullRequestUrlSchema = z7.string().max(512).regex(/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/);
+    PushEventSchema = z7.object({
+      eventId: z7.string().uuid(),
+      sessionId: z7.string().uuid(),
       kind: PushKindSchema,
-      taskTitle: z6.string().trim().min(1).max(160).optional(),
+      taskTitle: z7.string().trim().min(1).max(160).optional(),
       prUrl: PushPullRequestUrlSchema.optional()
     }).strict();
-    PushSignedRequestSchema = z6.object({
-      bindingId: z6.string().uuid(),
-      timestamp: z6.number().int(),
-      nonce: z6.string().uuid(),
-      payload: z6.string().max(2048),
-      signature: z6.string().regex(/^[a-f0-9]{128}$/)
+    PushSignedRequestSchema = z7.object({
+      bindingId: z7.string().uuid(),
+      timestamp: z7.number().int(),
+      nonce: z7.string().uuid(),
+      payload: z7.string().max(2048),
+      signature: z7.string().regex(/^[a-f0-9]{128}$/)
     }).strict();
-    PushEntitlementSchema = z6.object({ active: z6.boolean(), expiresAt: z6.number().nullable() }).strict();
-    PushServerStatusSchema = z6.object({
+    PushEntitlementSchema = z7.object({ active: z7.boolean(), expiresAt: z7.number().nullable() }).strict();
+    PushServerStatusSchema = z7.object({
       publicKey: PushPublicKeySchema,
-      bindings: z6.array(
-        z6.object({
-          bindingId: z6.string().uuid(),
-          installationId: z6.string().uuid(),
-          deviceId: z6.string().uuid()
+      bindings: z7.array(
+        z7.object({
+          bindingId: z7.string().uuid(),
+          installationId: z7.string().uuid(),
+          deviceId: z7.string().uuid()
         })
       ),
-      pending: z6.number().int().nonnegative(),
-      error: z6.string().nullable()
+      pending: z7.number().int().nonnegative(),
+      error: z7.string().nullable()
     });
   }
 });
@@ -1074,7 +1515,7 @@ import {
   randomUUID
 } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import path4 from "node:path";
+import path6 from "node:path";
 import { Effect as Effect3 } from "effect";
 function pushKind(session, previous) {
   if (session.gitDelivery?.status === "pr_opened" && previous?.gitDelivery?.status !== "pr_opened")
@@ -1134,7 +1575,7 @@ var init_push2 = __esm({
         this.transport = transport;
         this.apiUrl = apiUrl;
         mkdirSync(directory, { recursive: true, mode: 448 });
-        const filename = path4.join(directory, "push-signing-key.pem");
+        const filename = path6.join(directory, "push-signing-key.pem");
         if (!existsSync(filename))
           writeFileSync(
             filename,
@@ -1304,12 +1745,12 @@ var init_push2 = __esm({
 // src/attachments.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { createReadStream, createWriteStream } from "node:fs";
-import { mkdir as mkdir3, readFile as readFile2, rm, stat as stat2, readdir } from "node:fs/promises";
-import path5 from "node:path";
+import { mkdir as mkdir4, readFile as readFile3, rm, stat as stat2, readdir } from "node:fs/promises";
+import path7 from "node:path";
 import { pipeline } from "node:stream/promises";
 import sharp from "sharp";
 import { Context, Data, Effect as Effect4, Layer } from "effect";
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var AttachmentError, textExtensions, imageMimes, AttachmentFiles, Attachments;
 var init_attachments = __esm({
   "src/attachments.ts"() {
@@ -1364,7 +1805,7 @@ var init_attachments = __esm({
       root;
       store;
       directory(id) {
-        return path5.join(this.root, z7.string().uuid().parse(id));
+        return path7.join(this.root, z8.string().uuid().parse(id));
       }
       io(operation) {
         return Effect4.tryPromise({
@@ -1378,11 +1819,11 @@ var init_attachments = __esm({
         return this.io(async () => {
           const id = randomUUID2();
           const directory = this.directory(id);
-          const source = path5.join(directory, "source");
-          const nameField = z7.object({ type: z7.literal("field"), value: z7.string() }).safeParse(part.fields.name);
+          const source = path7.join(directory, "source");
+          const nameField = z8.object({ type: z8.literal("field"), value: z8.string() }).safeParse(part.fields.name);
           const originalName = nameField.success ? nameField.data.value : part.filename;
-          const name = path5.basename(originalName.replaceAll("\\", "/")).replace(new RegExp("\\p{Cc}", "gu"), "").slice(0, 180) || "attachment";
-          await mkdir3(directory, { recursive: true });
+          const name = path7.basename(originalName.replaceAll("\\", "/")).replace(new RegExp("\\p{Cc}", "gu"), "").slice(0, 180) || "attachment";
+          await mkdir4(directory, { recursive: true });
           try {
             await pipeline(part.file, createWriteStream(source, { flags: "wx" }));
             if (part.file.truncated) throw new Error("Files must be 20 MB or smaller.");
@@ -1409,14 +1850,14 @@ var init_attachments = __esm({
         const metadata = await sharp(source, { limitInputPixels: 4e7 }).metadata().catch(() => null);
         const mimeType = metadata?.format && imageMimes.get(metadata.format);
         if (mimeType) {
-          await sharp(source, { limitInputPixels: 4e7 }).rotate().resize({ width: 2048, height: 2048, fit: "inside", withoutEnlargement: true }).png().toFile(path5.join(path5.dirname(source), "preview.png"));
+          await sharp(source, { limitInputPixels: 4e7 }).rotate().resize({ width: 2048, height: 2048, fit: "inside", withoutEnlargement: true }).png().toFile(path7.join(path7.dirname(source), "preview.png"));
           return { kind: "image", mimeType };
         }
-        if (!textExtensions.has(path5.extname(name).toLowerCase()))
+        if (!textExtensions.has(path7.extname(name).toLowerCase()))
           throw new Error(
             "Choose a PNG, JPEG, WebP, GIF, or text/code file. PDF and Office documents aren't supported yet."
           );
-        const bytes = await readFile2(source);
+        const bytes = await readFile3(source);
         const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
         if (new RegExp("\\p{Cc}", "u").test(text.replaceAll("\n", "").replaceAll("\r", "").replaceAll("	", "")))
           throw new Error("This file isn't readable UTF-8 text.");
@@ -1433,7 +1874,7 @@ var init_attachments = __esm({
               throw new Error(
                 "An attachment is unavailable for this project. Remove it and upload it again."
               );
-            await stat2(path5.join(this.directory(id), "source"));
+            await stat2(path7.join(this.directory(id), "source"));
             attachments2.push(attachment);
           }
           return attachments2;
@@ -1441,7 +1882,7 @@ var init_attachments = __esm({
       }
       content(attachment, preview) {
         return createReadStream(
-          path5.join(
+          path7.join(
             this.directory(attachment.id),
             preview && attachment.kind === "image" ? "preview.png" : "source"
           )
@@ -1452,13 +1893,13 @@ var init_attachments = __esm({
           const images = [];
           const sections = [];
           for (const attachment of attachments2) {
-            const source = path5.join(this.directory(attachment.id), "source");
+            const source = path7.join(this.directory(attachment.id), "source");
             if (attachment.kind === "image") {
-              const bytes = await readFile2(path5.join(this.directory(attachment.id), "preview.png"));
+              const bytes = await readFile3(path7.join(this.directory(attachment.id), "preview.png"));
               images.push({ type: "image", data: bytes.toString("base64"), mimeType: "image/png" });
               sections.push(`Image attachment: ${JSON.stringify(attachment.name)}`);
             } else {
-              const text = await readFile2(source, "utf8");
+              const text = await readFile3(source, "utf8");
               sections.push(
                 `File attachment: ${JSON.stringify(attachment.name)}
 Full file available to the read tool at: ${JSON.stringify(source)}
@@ -1484,9 +1925,9 @@ ${text.slice(0, 12e3)}${text.length > 12e3 ? "\n[Preview truncated; use the read
             if (await Effect4.runPromise(this.store.deleteAttachment(attachment.id)))
               await rm(this.directory(attachment.id), { recursive: true, force: true });
           }
-          await mkdir3(this.root, { recursive: true });
+          await mkdir4(this.root, { recursive: true });
           for (const entry of await readdir(this.root, { withFileTypes: true })) {
-            if (!entry.isDirectory() || !z7.string().uuid().safeParse(entry.name).success) continue;
+            if (!entry.isDirectory() || !z8.string().uuid().safeParse(entry.name).success) continue;
             const directory = this.directory(entry.name);
             if ((await stat2(directory)).mtimeMs < cutoff && !await Effect4.runPromise(this.store.getAttachment(entry.name)))
               await rm(directory, { recursive: true, force: true });
@@ -1574,24 +2015,24 @@ var init_event_server = __esm({
 });
 
 // src/security.ts
-import { createHash as createHash2, randomBytes, randomInt, randomUUID as randomUUID3, timingSafeEqual } from "node:crypto";
+import { createHash as createHash2, randomBytes as randomBytes2, randomInt, randomUUID as randomUUID3, timingSafeEqual } from "node:crypto";
 import { Effect as Effect5 } from "effect";
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 async function registerSecurity(app2, security2, version, allowedOrigins2) {
   app2.addHook("onRequest", async (request, reply) => {
-    const path13 = new URL(request.url, "http://localhost");
+    const path15 = new URL(request.url, "http://localhost");
     reply.header("Cache-Control", "no-store");
     if (request.method === "OPTIONS") return;
     if (request.headers.origin && !allowedOrigins2.includes(request.headers.origin))
       return reply.code(403).send({ error: "Browser origin is not allowed." });
-    if (path13.pathname === "/health" || path13.pathname === "/api/auth/pair" && request.method === "POST")
+    if (path15.pathname === "/health" || path15.pathname === "/api/auth/pair" && request.method === "POST")
       return;
     const authorization = request.headers.authorization ?? "";
     const token = authorization.startsWith("Bearer ") ? authorization.slice(7) : "";
-    const asset = request.method === "GET" && /^\/api\/projects\/[^/]+\/attachments\/[^/]+\/content$/.test(path13.pathname);
-    const ticket = path13.searchParams.get("ticket");
-    path13.searchParams.delete("ticket");
-    if (!security2.authenticate(token) && !(asset && ticket && security2.redeemTicket(ticket, path13.pathname + path13.search, false)))
+    const asset = request.method === "GET" && /^\/api\/projects\/[^/]+\/attachments\/[^/]+\/content$/.test(path15.pathname);
+    const ticket = path15.searchParams.get("ticket");
+    path15.searchParams.delete("ticket");
+    if (!security2.authenticate(token) && !(asset && ticket && security2.redeemTicket(ticket, path15.pathname + path15.search, false)))
       return reply.code(401).send({ error: "Pair this device with your server.", code: "UNAUTHORIZED" });
     if (!asset && request.headers["x-agentrific-protocol"] !== String(PROTOCOL_VERSION))
       return reply.code(409).send({
@@ -1646,8 +2087,8 @@ async function registerSecurity(app2, security2, version, allowedOrigins2) {
     ticket: security2.ticket((request.headers.authorization ?? "").slice(7), "/api/events")
   }));
   app2.post("/api/auth/asset-ticket", (request, reply) => {
-    const input = z8.object({
-      path: z8.string().regex(/^\/api\/projects\/[^/?]+\/attachments\/[^/?]+\/content(?:\?preview=1)?$/)
+    const input = z9.object({
+      path: z9.string().regex(/^\/api\/projects\/[^/?]+\/attachments\/[^/?]+\/content(?:\?preview=1)?$/)
     }).safeParse(request.body);
     if (!input.success) return reply.code(400).send({ error: "Choose a valid attachment." });
     return {
@@ -1661,7 +2102,7 @@ var init_security = __esm({
     "use strict";
     init_src();
     init_pairing();
-    secret = () => randomBytes(32).toString("hex");
+    secret = () => randomBytes2(32).toString("hex");
     digest = (value) => createHash2("sha256").update(value).digest("hex");
     ServerSecurity = class {
       constructor(store2, serverId) {
@@ -1724,17 +2165,17 @@ var init_security = __esm({
         if (!/^[a-f0-9]{64}$/.test(token)) return void 0;
         return Effect5.runSync(this.store.deviceForToken(digest(token)));
       }
-      ticket(token, path13) {
+      ticket(token, path15) {
         this.prune();
         if (!this.authenticate(token) || this.tickets.size >= 1e4) return void 0;
         const value = secret();
-        this.tickets.set(value, { tokenHash: digest(token), expiresAt: Date.now() + 6e4, path: path13 });
+        this.tickets.set(value, { tokenHash: digest(token), expiresAt: Date.now() + 6e4, path: path15 });
         return value;
       }
-      redeemTicket(value, path13, consume = true) {
+      redeemTicket(value, path15, consume = true) {
         this.prune();
         const ticket = this.tickets.get(value);
-        if (!ticket || ticket.path !== path13) return void 0;
+        if (!ticket || ticket.path !== path15) return void 0;
         if (consume) this.tickets.delete(value);
         return Effect5.runSync(this.store.deviceForToken(ticket.tokenHash));
       }
@@ -1748,6 +2189,105 @@ var init_security = __esm({
   }
 });
 
+// src/desktop-phone.ts
+var DesktopPhoneConnection;
+var init_desktop_phone = __esm({
+  "src/desktop-phone.ts"() {
+    "use strict";
+    init_tunnels();
+    init_opentunnel();
+    DesktopPhoneConnection = class {
+      constructor(origin, changed, directory, detect = async () => [
+        { provider: "opentunnel", available: true, reason: "Built in \xB7 stable public HTTPS address" },
+        ...await detectTunnels()
+      ], create2 = (option, disconnected) => option.provider === "opentunnel" ? new OpenTunnel(directory, disconnected) : new ManagedTunnel({ ...option, provider: option.provider }, disconnected)) {
+        this.origin = origin;
+        this.changed = changed;
+        this.directory = directory;
+        this.detect = detect;
+        this.create = create2;
+      }
+      origin;
+      changed;
+      directory;
+      detect;
+      create;
+      tunnel;
+      provider = null;
+      publicUrl = null;
+      pending = Promise.resolve();
+      snapshot() {
+        return {
+          provider: this.provider,
+          publicUrl: this.publicUrl,
+          progress: this.tunnel?.progress?.() ?? null
+        };
+      }
+      async options() {
+        return (await this.detect()).map(({ provider, available, reason }) => ({
+          provider,
+          available,
+          reason
+        }));
+      }
+      serialize(operation) {
+        const result = this.pending.then(operation);
+        this.pending = result.then(
+          () => {
+          },
+          () => {
+          }
+        );
+        return result;
+      }
+      start(provider, signal) {
+        return this.serialize(async () => {
+          signal?.throwIfAborted();
+          if (this.tunnel && this.publicUrl && this.provider === provider) return this.snapshot();
+          if (this.tunnel)
+            throw new Error("Disconnect the current phone connection before changing providers.");
+          const option = (await this.detect()).find((candidate) => candidate.provider === provider);
+          if (!option?.available) throw new Error(option?.reason || "Tunnel provider unavailable.");
+          let tunnel;
+          tunnel = this.create(option, () => {
+            if (this.tunnel !== tunnel) return;
+            void tunnel.close().catch(() => {
+            });
+            this.tunnel = void 0;
+            this.provider = null;
+            this.publicUrl = null;
+            this.changed(null);
+          });
+          this.tunnel = tunnel;
+          try {
+            const url = await tunnel.start(this.origin(), signal);
+            signal?.throwIfAborted();
+            this.provider = provider;
+            this.publicUrl = url;
+            this.changed(url);
+            return this.snapshot();
+          } catch (error) {
+            await tunnel.close();
+            this.tunnel = void 0;
+            this.changed(null);
+            throw error;
+          }
+        });
+      }
+      close() {
+        return this.serialize(async () => {
+          await this.tunnel?.close();
+          this.tunnel = void 0;
+          this.provider = null;
+          this.publicUrl = null;
+          this.changed(null);
+          return this.snapshot();
+        });
+      }
+    };
+  }
+});
+
 // src/maintenance.ts
 var MaintenanceError, Maintenance;
 var init_maintenance = __esm({
@@ -1793,9 +2333,9 @@ var init_maintenance = __esm({
       }
       attach(app2) {
         app2.addHook("onRequest", async (request, reply) => {
-          const path13 = request.url.split("?")[0];
+          const path15 = request.url.split("?")[0];
           if (["GET", "HEAD", "OPTIONS"].includes(request.method)) return;
-          const allowed = path13.startsWith("/api/auth/") || /^\/api\/sessions\/[^/]+\/stop$/.test(path13);
+          const allowed = path15.startsWith("/api/auth/") || /^\/api\/sessions\/[^/]+\/stop$/.test(path15);
           if (this.paused && !allowed)
             return reply.code(503).send({ code: "MAINTENANCE", error: new MaintenanceError().message });
           this.requests.add(request.id);
@@ -2069,7 +2609,7 @@ var init_git_flow = __esm({
 });
 
 // src/runtime.ts
-import path6 from "node:path";
+import path8 from "node:path";
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { Context as Context2, Data as Data2, Effect as Effect8, Fiber, Layer as Layer2, Semaphore as Semaphore2 } from "effect";
 var AgentError, AgentController, AgentSessions;
@@ -2128,8 +2668,8 @@ var init_runtime = __esm({
           const agent = yield* Effect8.tryPromise({
             try: () => this.factory.open(
               session.id,
-              session.workspacePath ?? path6.join(this.worktreesRoot, session.id),
-              path6.join(this.sessionsRoot, session.id),
+              session.workspacePath ?? path8.join(this.worktreesRoot, session.id),
+              path8.join(this.sessionsRoot, session.id),
               session.model,
               session
             ),
@@ -2416,17 +2956,17 @@ var init_workflow_command = __esm({
 });
 
 // src/workflow-schema.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 var DeliveryJobSchema, PreparationJobSchema, WorkflowJobSchema;
 var init_workflow_schema = __esm({
   "src/workflow-schema.ts"() {
     "use strict";
     init_src();
-    DeliveryJobSchema = z9.object({
-      kind: z9.literal("delivery"),
-      sessionId: z9.string(),
+    DeliveryJobSchema = z10.object({
+      kind: z10.literal("delivery"),
+      sessionId: z10.string(),
       request: DeliveryRequestSchema,
-      phase: z9.enum([
+      phase: z10.enum([
         "validating",
         "drafting",
         "committing",
@@ -2436,25 +2976,25 @@ var init_workflow_schema = __esm({
         "opening_pr",
         "delivered"
       ]),
-      attempt: z9.number().int().positive(),
-      commitSha: z9.string().optional(),
-      title: z9.string(),
-      body: z9.string(),
-      logs: z9.string().default(""),
-      failed: z9.boolean().default(false),
-      result: z9.enum(["merged", "pr_opened", "no_changes"]).optional(),
-      url: z9.string().optional(),
-      message: z9.string().optional()
+      attempt: z10.number().int().positive(),
+      commitSha: z10.string().optional(),
+      title: z10.string(),
+      body: z10.string(),
+      logs: z10.string().default(""),
+      failed: z10.boolean().default(false),
+      result: z10.enum(["merged", "pr_opened", "no_changes"]).optional(),
+      url: z10.string().optional(),
+      message: z10.string().optional()
     });
-    PreparationJobSchema = z9.object({
-      kind: z9.literal("preparation"),
-      sessionId: z9.string(),
-      projectPath: z9.string(),
+    PreparationJobSchema = z10.object({
+      kind: z10.literal("preparation"),
+      sessionId: z10.string(),
+      projectPath: z10.string(),
       input: CreateSessionSchema,
-      stage: z9.enum(["creating", "installing", "ready", "failed"]),
-      logs: z9.string().default("")
+      stage: z10.enum(["creating", "installing", "ready", "failed"]),
+      logs: z10.string().default("")
     });
-    WorkflowJobSchema = z9.discriminatedUnion("kind", [
+    WorkflowJobSchema = z10.discriminatedUnion("kind", [
       DeliveryJobSchema,
       PreparationJobSchema
     ]);
@@ -2463,7 +3003,7 @@ var init_workflow_schema = __esm({
 
 // src/delivery.ts
 import { Effect as Effect9 } from "effect";
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var DeliveryCoordinator;
 var init_delivery = __esm({
   "src/delivery.ts"() {
@@ -2762,11 +3302,11 @@ ${workflowError(error instanceof Error ? error : String(error))}`
                 "--json",
                 "url,state,headRefOid"
               ]);
-              const prs = z10.array(
-                z10.object({
-                  url: z10.string().url(),
-                  state: z10.string(),
-                  headRefOid: z10.string().optional()
+              const prs = z11.array(
+                z11.object({
+                  url: z11.string().url(),
+                  state: z11.string(),
+                  headRefOid: z11.string().optional()
                 })
               ).parse(JSON.parse(existing));
               const open = prs.find(
@@ -2809,10 +3349,10 @@ ${workflowError(error instanceof Error ? error : String(error))}`
 });
 
 // src/preparation.ts
-import { mkdir as mkdir4, readFile as readFile3 } from "node:fs/promises";
-import path7 from "node:path";
+import { mkdir as mkdir5, readFile as readFile4 } from "node:fs/promises";
+import path9 from "node:path";
 import { Effect as Effect10 } from "effect";
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var PreparationCoordinator;
 var init_preparation = __esm({
   "src/preparation.ts"() {
@@ -2913,7 +3453,7 @@ ${logs}` : ""}`);
         const workspace = session.workspacePath;
         if (branchAtWorkspace !== void 0)
           throw new Error("The run workspace already exists on a different branch.");
-        await mkdir4(path7.dirname(workspace), { recursive: true });
+        await mkdir5(path9.dirname(workspace), { recursive: true });
         try {
           await command(
             projectPath,
@@ -2933,12 +3473,12 @@ ${logs}` : ""}`);
         }
       }
       async install(workspace, command) {
-        const packageFile = await readFile3(path7.join(workspace, "package.json"), "utf8").catch(
+        const packageFile = await readFile4(path9.join(workspace, "package.json"), "utf8").catch(
           () => void 0
         );
         if (!packageFile) return;
-        const metadata = z11.object({ packageManager: z11.string().optional() }).parse(JSON.parse(packageFile));
-        const has = async (name) => readFile3(path7.join(workspace, name)).then(
+        const metadata = z12.object({ packageManager: z12.string().optional() }).parse(JSON.parse(packageFile));
+        const has = async (name) => readFile4(path9.join(workspace, name)).then(
           () => true,
           () => false
         );
@@ -3021,18 +3561,21 @@ ${logs}` : ""}`);
 
 // src/delivery-writer.ts
 import { createAgentSession, SessionManager } from "@earendil-works/pi-coding-agent";
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 function deliveryWriter(models2, createSession = createAgentSession) {
   return async (run, input, diff, signal) => {
     signal?.throwIfAborted();
+    const selected = run.model ?? await models2.defaultReference();
+    const sessionOptions = await models2.sessionOptions(run.workspacePath);
     const { session } = await createSession({
       cwd: run.workspacePath,
-      model: await models2.resolve(run.model ?? await models2.defaultReference()),
-      modelRuntime: models2.runtime,
+      model: await models2.resolve(selected),
+      ...sessionOptions,
       sessionManager: SessionManager.inMemory(),
       tools: [],
       noTools: "all"
     });
+    if (sessionOptions.resourceLoader) await session.bindExtensions({});
     const timer = setTimeout(() => {
       void session.abort();
     }, 6e4);
@@ -3056,13 +3599,116 @@ ${diff}`
       signal?.removeEventListener("abort", abort);
       session.dispose();
     }
-  };
+  };
+}
+var DraftSchema;
+var init_delivery_writer = __esm({
+  "src/delivery-writer.ts"() {
+    "use strict";
+    DraftSchema = z13.object({ title: z13.string().trim().min(1).max(120), body: z13.string().trim().min(1).max(1e4) }).strict();
+  }
+});
+
+// src/claude-code.ts
+import { execFile as execFile3 } from "node:child_process";
+import { homedir as homedir3 } from "node:os";
+import { join as join2 } from "node:path";
+import { promisify as promisify3 } from "node:util";
+import { z as z14 } from "zod";
+import {
+  createAgentSessionServices
+} from "@earendil-works/pi-coding-agent";
+async function discoverClaudeCode() {
+  if (process.env.AGENTRIFIC_CLAUDE_CODE === "off") return;
+  const candidates = [
+    "claude",
+    join2(homedir3(), ".local/bin/claude"),
+    join2(homedir3(), ".claude/local/claude")
+  ];
+  for (const executable of candidates) {
+    try {
+      await execute3(executable, ["--version"], { timeout: 5e3, maxBuffer: 64 * 1024 });
+    } catch {
+      continue;
+    }
+    try {
+      const { stdout } = await execute3(executable, ["auth", "status", "--json"], {
+        timeout: 5e3,
+        maxBuffer: 64 * 1024
+      });
+      const status = AuthStatusSchema.parse(JSON.parse(stdout));
+      return { executable, ready: status.loggedIn };
+    } catch {
+      return { executable, ready: false };
+    }
+  }
 }
-var DraftSchema;
-var init_delivery_writer = __esm({
-  "src/delivery-writer.ts"() {
+var claudePlatform, execute3, AuthStatusSchema, ClaudeCode;
+var init_claude_code = __esm({
+  "src/claude-code.ts"() {
     "use strict";
-    DraftSchema = z12.object({ title: z12.string().trim().min(1).max(120), body: z12.string().trim().min(1).max(1e4) }).strict();
+    claudePlatform = "claude-bridge";
+    execute3 = promisify3(execFile3);
+    AuthStatusSchema = z14.object({ loggedIn: z14.boolean() });
+    ClaudeCode = class {
+      constructor(probe = discoverClaudeCode, query) {
+        this.probe = probe;
+        this.query = query;
+      }
+      probe;
+      query;
+      installation;
+      registered = false;
+      get ready() {
+        return this.installation?.ready === true;
+      }
+      get warning() {
+        return this.installation && !this.ready ? "Claude Code is installed but its login could not be verified. Run claude auth login as the server user, then refresh the model list." : null;
+      }
+      async refresh(runtime2) {
+        this.installation = await this.probe();
+        if (this.installation && !this.registered) {
+          await this.services(process.cwd(), runtime2);
+          this.registered = true;
+        }
+      }
+      async services(cwd, modelRuntime2) {
+        const module = await import(new URL("./claude-bridge.js", import.meta.url).href);
+        const extension = module.createClaudeExtension(this.query);
+        const services = await createAgentSessionServices({
+          cwd,
+          modelRuntime: modelRuntime2,
+          resourceLoaderOptions: {
+            // Match Pipeline: do not execute unrelated global Pi extensions.
+            noExtensions: true,
+            extensionFactories: [
+              {
+                name: "agentrific-claude-code",
+                factory: (pi) => extension({
+                  ...pi,
+                  // SAFETY: The pinned bridge uses only the name/config registration overload.
+                  registerProvider: ((id, config) => pi.registerProvider(id, {
+                    ...config,
+                    // Bind the working directory to this provider,
+                    // without changing the process cwd or global Claude configuration.
+                    streamSimple: config.streamSimple && ((model, context, options) => {
+                      const request = { ...options, cwd };
+                      return config.streamSimple(model, context, request);
+                    })
+                  }))
+                })
+              }
+            ]
+          }
+        });
+        const errors = [
+          ...services.diagnostics.filter((item) => item.type === "error").map((item) => item.message),
+          ...services.resourceLoader.getExtensions().errors.map((item) => item.error)
+        ];
+        if (errors.length) throw new Error(errors.join("\n"));
+        return services;
+      }
+    };
   }
 });
 
@@ -3072,6 +3718,7 @@ var legacyModel, makers, ServerModels;
 var init_models = __esm({
   "src/models.ts"() {
     "use strict";
+    init_claude_code();
     legacyModel = { platformId: "openai-codex", modelId: "gpt-6-luna" };
     makers = [
       { id: "openai", name: "OpenAI", pattern: /(?:^|[/.:\s-])(?:gpt-|o[134](?:-|$))/i },
@@ -3088,12 +3735,14 @@ var init_models = __esm({
       { id: "amazon", name: "Amazon", pattern: /amazon\.nova|nova-/i }
     ];
     ServerModels = class {
-      constructor(runtime2, store2) {
+      constructor(runtime2, store2, claude) {
         this.runtime = runtime2;
         this.store = store2;
+        this.claude = claude;
       }
       runtime;
       store;
+      claude;
       refreshing;
       refreshedAt = (/* @__PURE__ */ new Date()).toISOString();
       warning = null;
@@ -3115,18 +3764,20 @@ var init_models = __esm({
           platformId,
           modelId,
           name: model?.name ?? modelId,
-          platformName: this.runtime.getProvider(platformId)?.name ?? platformId,
+          platformName: platformId === claudePlatform ? "Claude Code" : this.runtime.getProvider(platformId)?.name ?? platformId,
           providerId: namespace === "openrouter" ? "unspecified" : maker?.id ?? namespace ?? "unspecified",
           providerName: namespace === "openrouter" ? "Other / custom" : maker?.name ?? publisherName ?? "Other / custom"
         };
       }
       async refresh(network) {
         if (!this.refreshing) {
-          this.refreshing = this.runtime.refresh({
-            allowNetwork: network,
-            force: network,
-            signal: AbortSignal.timeout(15e3)
-          }).then((result) => {
+          this.refreshing = Promise.resolve(this.claude?.refresh(this.runtime)).then(
+            () => this.runtime.refresh({
+              allowNetwork: network,
+              force: network,
+              signal: AbortSignal.timeout(15e3)
+            })
+          ).then((result) => {
             this.refreshedAt = (/* @__PURE__ */ new Date()).toISOString();
             this.warning = result.aborted || result.errors.size || this.runtime.getError() ? "Some providers could not refresh. Showing the catalogue currently available on this server." : null;
           }).finally(() => {
@@ -3136,7 +3787,10 @@ var init_models = __esm({
         await this.refreshing;
       }
       async defaultReference() {
-        return await Effect11.runPromise(this.store.defaultModel()) ?? legacyModel;
+        const saved = await Effect11.runPromise(this.store.defaultModel());
+        if (saved) return saved;
+        const preferred = this.claude?.ready ? this.runtime.getModels().find((model) => model.provider === claudePlatform && /sonnet/i.test(model.id)) : void 0;
+        return preferred ? { platformId: preferred.provider, modelId: preferred.id } : legacyModel;
       }
       async defaultIdentity() {
         const selected = await this.defaultReference();
@@ -3149,17 +3803,24 @@ var init_models = __esm({
         return {
           models: this.runtime.getModels().map((model) => ({
             ...this.identity(model.provider, model.id),
-            available: available.has(`${model.provider}\0${model.id}`),
+            available: available.has(`${model.provider}\0${model.id}`) && (model.provider !== claudePlatform || this.claude?.ready === true),
             reasoning: model.reasoning,
             input: model.input,
             contextWindow: model.contextWindow
           })),
           defaultModel: await this.defaultIdentity(),
           refreshedAt: this.refreshedAt,
-          warning: this.warning
+          warning: this.claude?.warning ?? this.warning
         };
       }
       async resolve(reference) {
+        if (reference.platformId === claudePlatform && this.claude) {
+          await this.claude.refresh(this.runtime);
+          if (!this.claude.ready)
+            throw new Error(
+              this.claude.warning ?? "Claude Code is unavailable on this server. Install it and run claude auth login as the server user."
+            );
+        }
         const available = await this.runtime.getAvailable(reference.platformId, {
           signal: AbortSignal.timeout(1e4)
         });
@@ -3170,6 +3831,17 @@ var init_models = __esm({
           );
         return model;
       }
+      async sessionOptions(cwd = process.cwd()) {
+        if (this.claude && this.runtime.getProvider(claudePlatform)) {
+          const services = await this.claude.services(cwd);
+          return {
+            modelRuntime: services.modelRuntime,
+            resourceLoader: services.resourceLoader,
+            settingsManager: services.settingsManager
+          };
+        }
+        return { modelRuntime: this.runtime };
+      }
       async setDefault(reference) {
         await this.resolve(reference);
         await Effect11.runPromise(this.store.setDefaultModel(reference));
@@ -3219,19 +3891,19 @@ var init_delivery_tool = __esm({
 // src/file-change.ts
 import { createWriteToolDefinition, defineTool as defineTool2 } from "@earendil-works/pi-coding-agent";
 import { createTwoFilesPatch } from "diff";
-import { mkdir as mkdir5, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
-import { z as z13 } from "zod";
+import { mkdir as mkdir6, readFile as readFile5, writeFile as writeFile4 } from "node:fs/promises";
+import { z as z15 } from "zod";
 function boundFileChange(change) {
   if ((change.patch?.length ?? 0) + (change.content?.length ?? 0) > previewLimit)
     return { path: change.path, omitted: true };
   return change;
 }
-function completedFileChange(result, path13) {
+function completedFileChange(result, path15) {
   const parsed = EditResultSchema.safeParse(result);
   if (!parsed.success) return;
   const details = parsed.data.details;
   if (details?.fileChange) return boundFileChange(details.fileChange);
-  if (path13 && details?.patch) return boundFileChange({ path: path13, patch: details.patch });
+  if (path15 && details?.patch) return boundFileChange({ path: path15, patch: details.patch });
 }
 function fileWriteTool(cwd) {
   const base = createWriteToolDefinition(cwd);
@@ -3248,16 +3920,16 @@ function fileWriteTool(cwd) {
       const tool = createWriteToolDefinition(cwd, {
         operations: {
           mkdir: async (dir) => {
-            await mkdir5(dir, { recursive: true });
+            await mkdir6(dir, { recursive: true });
           },
           // Pi invokes this inside its per-file mutation queue, so the snapshot
           // and write cannot race another built-in edit/write on the same file.
-          writeFile: async (path13, content) => {
-            const previous = await readFile4(path13, "utf8").catch((error) => {
+          writeFile: async (path15, content) => {
+            const previous = await readFile5(path15, "utf8").catch((error) => {
               if (error.code === "ENOENT") return void 0;
               throw error;
             });
-            await writeFile3(path13, content, "utf8");
+            await writeFile4(path15, content, "utf8");
             fileChange = boundFileChange(
               previous === void 0 ? { path: args.path, content } : {
                 path: args.path,
@@ -3278,8 +3950,8 @@ var init_file_change = __esm({
     "use strict";
     init_src();
     previewLimit = 256e3;
-    EditResultSchema = z13.object({
-      details: z13.object({ patch: z13.string().optional(), fileChange: FileChangeSchema.optional() }).optional()
+    EditResultSchema = z15.object({
+      details: z15.object({ patch: z15.string().optional(), fileChange: FileChangeSchema.optional() }).optional()
     });
   }
 });
@@ -3291,7 +3963,7 @@ import {
   createAgentSession as createAgentSession2,
   SessionManager as SessionManager2
 } from "@earendil-works/pi-coding-agent";
-import { z as z14 } from "zod";
+import { z as z16 } from "zod";
 function toolOutput(value) {
   const parsed = ToolResultSchema.safeParse(value);
   const text = parsed.success ? parsed.data.content?.filter((part) => part.type === "text").map((part) => part.text || "").join("\n") || "Completed without text output." : boundedJson(value, 4e3);
@@ -3301,16 +3973,18 @@ function createPiFactory(files, models2, delivery2, createSession = createAgentS
   return {
     async open(sessionId, cwd, sessionDirectory, selected = legacyModel, run) {
       const model = await models2.resolve(selected);
+      const sessionOptions = await models2.sessionOptions(cwd);
       const { session } = await createSession({
         cwd,
         model,
-        modelRuntime: models2.runtime,
+        ...sessionOptions,
         sessionManager: SessionManager2.continueRecent(cwd, sessionDirectory),
         customTools: [
           fileWriteTool(cwd),
           ...run?.gitFlow && delivery2 ? [deliveryTool(sessionId, delivery2)] : []
         ]
       });
+      if (sessionOptions.resourceLoader) await session.bindExtensions({});
       return {
         get model() {
           const current = session.model;
@@ -3405,7 +4079,7 @@ function createPiFactory(files, models2, delivery2, createSession = createAgentS
             return false;
           }
           const filePaths = /* @__PURE__ */ new Map();
-          const FileArgsSchema = z14.object({ path: z14.string() });
+          const FileArgsSchema = z16.object({ path: z16.string() });
           function handleTool(event) {
             if (event.type === "tool_execution_start") {
               flushText();
@@ -3470,8 +4144,8 @@ var init_pi = __esm({
     init_models();
     init_delivery_tool();
     init_file_change();
-    ToolResultSchema = z14.object({
-      content: z14.array(z14.object({ type: z14.string(), text: z14.string().optional() })).optional()
+    ToolResultSchema = z16.object({
+      content: z16.array(z16.object({ type: z16.string(), text: z16.string().optional() })).optional()
     }).passthrough();
     boundedJson = (value, limit) => {
       let text;
@@ -3486,19 +4160,19 @@ var init_pi = __esm({
 });
 
 // src/projects.ts
-import { access as access2, readdir as readdir2, realpath, stat as stat3, readFile as readFile5, writeFile as writeFile4 } from "node:fs/promises";
+import { access as access2, readdir as readdir2, realpath, stat as stat3, readFile as readFile6, writeFile as writeFile5 } from "node:fs/promises";
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { z as z15 } from "zod";
+import { z as z17 } from "zod";
 import { constants as constants2 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import path8 from "node:path";
+import { homedir as homedir4 } from "node:os";
+import path10 from "node:path";
 import { Effect as Effect13, Semaphore as Semaphore3 } from "effect";
 function resolveProjectsRoot(input) {
   return Effect13.tryPromise({
     try: async () => {
       const trimmed = input.trim();
-      const expanded = trimmed === "~" ? homedir3() : trimmed.startsWith("~/") ? path8.join(homedir3(), trimmed.slice(2)) : trimmed;
-      if (!path8.isAbsolute(expanded))
+      const expanded = trimmed === "~" ? homedir4() : trimmed.startsWith("~/") ? path10.join(homedir4(), trimmed.slice(2)) : trimmed;
+      if (!path10.isAbsolute(expanded))
         throw new Error("Use an absolute server path or a path beginning with ~/.");
       const resolved = await realpath(expanded);
       if (!(await stat3(resolved)).isDirectory())
@@ -3520,34 +4194,34 @@ function projectLock(store2) {
   return lock;
 }
 async function gitDirectory(directory) {
-  const location = path8.join(directory, ".git");
+  const location = path10.join(directory, ".git");
   const info = await stat3(location);
   if (info.isDirectory()) return location;
-  const contents = await readFile5(location, "utf8");
+  const contents = await readFile6(location, "utf8");
   const match = /^gitdir: (.+)\s*$/m.exec(contents);
   if (!match) throw new Error("Invalid Git worktree metadata.");
-  const resolved = await realpath(path8.resolve(directory, match[1].trim()));
+  const resolved = await realpath(path10.resolve(directory, match[1].trim()));
   if (!(await stat3(resolved)).isDirectory()) throw new Error("Git directory is missing.");
   return resolved;
 }
 async function identity(directory, preferred) {
-  const filename = path8.join(await gitDirectory(directory), "agentrific-project-id");
+  const filename = path10.join(await gitDirectory(directory), "agentrific-project-id");
   try {
-    return ProjectId.parse(await readFile5(filename, "utf8"));
+    return ProjectId.parse(await readFile6(filename, "utf8"));
   } catch (error) {
-    if (!z15.object({ code: z15.literal("ENOENT") }).safeParse(error).success) throw error;
-    const legacyFilename = path8.join(await gitDirectory(directory), "chatplans-project-id");
-    const legacy = await readFile5(legacyFilename, "utf8").catch((cause) => {
-      if (!z15.object({ code: z15.literal("ENOENT") }).safeParse(cause).success) throw cause;
+    if (!z17.object({ code: z17.literal("ENOENT") }).safeParse(error).success) throw error;
+    const legacyFilename = path10.join(await gitDirectory(directory), "chatplans-project-id");
+    const legacy = await readFile6(legacyFilename, "utf8").catch((cause) => {
+      if (!z17.object({ code: z17.literal("ENOENT") }).safeParse(cause).success) throw cause;
       return null;
     });
     const id = legacy === null ? preferred ?? randomUUID6() : ProjectId.parse(legacy);
     try {
-      await writeFile4(filename, id + "\n", { flag: "wx" });
+      await writeFile5(filename, id + "\n", { flag: "wx" });
       return id;
     } catch (writeError) {
-      if (!z15.object({ code: z15.literal("EEXIST") }).safeParse(writeError).success) throw writeError;
-      return ProjectId.parse(await readFile5(filename, "utf8"));
+      if (!z17.object({ code: z17.literal("EEXIST") }).safeParse(writeError).success) throw writeError;
+      return ProjectId.parse(await readFile6(filename, "utf8"));
     }
   }
 }
@@ -3560,15 +4234,15 @@ function scanProjects(root, store2) {
       const entries = await readdir2(root, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
-        const directory = path8.join(root, entry.name);
-        if (!await stat3(path8.join(directory, ".git")).catch(() => null)) continue;
+        const directory = path10.join(root, entry.name);
+        if (!await stat3(path10.join(directory, ".git")).catch(() => null)) continue;
         const previous = registered.find((project2) => project2.path === directory);
         let id = await identity(directory, previous?.available ? void 0 : previous?.id);
         let existing = registered.find((project2) => project2.id === id);
-        if (found.some((project2) => project2.id === id) || existing && existing.path !== directory && await stat3(path8.join(existing.path, ".git")).catch(() => null)) {
+        if (found.some((project2) => project2.id === id) || existing && existing.path !== directory && await stat3(path10.join(existing.path, ".git")).catch(() => null)) {
           id = randomUUID6();
-          await writeFile4(
-            path8.join(await gitDirectory(directory), "agentrific-project-id"),
+          await writeFile5(
+            path10.join(await gitDirectory(directory), "agentrific-project-id"),
             id + "\n"
           );
           existing = void 0;
@@ -3601,16 +4275,16 @@ function reconnectProject(root, id, input, store2) {
       ))
         throw new Error("Stop this project's running sessions before reconnecting its folder.");
       const directory = await Effect13.runPromise(resolveProjectsRoot(input));
-      if (path8.dirname(directory) !== await realpath(root))
+      if (path10.dirname(directory) !== await realpath(root))
         throw new Error("Choose a Git repository directly inside the configured projects folder.");
-      const filename = path8.join(await gitDirectory(directory), "agentrific-project-id");
+      const filename = path10.join(await gitDirectory(directory), "agentrific-project-id");
       const replacedId = await identity(directory);
-      const project = { id, name: path8.basename(directory), path: directory, available: true };
-      await writeFile4(filename, id + "\n");
+      const project = { id, name: path10.basename(directory), path: directory, available: true };
+      await writeFile5(filename, id + "\n");
       try {
         await Effect13.runPromise(store2.relocateProject(project, previous.path, replacedId));
       } catch (error) {
-        await writeFile4(filename, replacedId + "\n");
+        await writeFile5(filename, replacedId + "\n");
         throw error;
       }
       return project;
@@ -3623,13 +4297,13 @@ var init_projects = __esm({
   "src/projects.ts"() {
     "use strict";
     locks2 = /* @__PURE__ */ new WeakMap();
-    ProjectId = z15.string().trim().min(1).max(255);
+    ProjectId = z17.string().trim().min(1).max(255);
   }
 });
 
 // src/project-git.ts
-import { execFile as execFile3 } from "node:child_process";
-import { promisify as promisify3 } from "node:util";
+import { execFile as execFile4 } from "node:child_process";
+import { promisify as promisify4 } from "node:util";
 function repositoryIdentity(remote) {
   const input = remote.trim();
   if (!input || input.startsWith("/") || input.startsWith(".")) return null;
@@ -3643,14 +4317,14 @@ function repositoryIdentity(remote) {
   if (!["https:", "http:", "ssh:", "git:"].includes(url.protocol)) return null;
   if (url.search || url.hash || url.port) return null;
   const host2 = url.hostname.toLowerCase();
-  let path13 = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/, "");
-  if (!host2 || !path13 || path13.includes("%") || path13.includes("//")) return null;
-  if (["github.com", "bitbucket.org"].includes(host2)) path13 = path13.toLowerCase();
-  const key = `${host2}/${path13}`;
+  let path15 = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/, "");
+  if (!host2 || !path15 || path15.includes("%") || path15.includes("//")) return null;
+  if (["github.com", "bitbucket.org"].includes(host2)) path15 = path15.toLowerCase();
+  const key = `${host2}/${path15}`;
   return { key, display: key };
 }
 async function git(directory, args) {
-  const { stdout } = await execute3("git", ["-C", directory, ...args], {
+  const { stdout } = await execute4("git", ["-C", directory, ...args], {
     timeout: 3e3,
     maxBuffer: 1024 * 1024,
     env: { ...workflowEnvironment(), GIT_OPTIONAL_LOCKS: "0", GIT_TERMINAL_PROMPT: "0" }
@@ -3676,7 +4350,7 @@ async function inspect(directory) {
       git(directory, ["symbolic-ref", "--quiet", "--short", "HEAD"]).catch(() => null),
       // NUL-separated records avoid ambiguous filenames/newlines. --no-renames
       // keeps each entry one record, so we only need its two status characters.
-      execute3(
+      execute4(
         "git",
         [
           "-C",
@@ -3724,47 +4398,47 @@ function projectGitStatus(directory) {
   observations.set(directory, { expires: Date.now() + 15e3, value });
   return value;
 }
-var execute3, observations;
+var execute4, observations;
 var init_project_git = __esm({
   "src/project-git.ts"() {
     "use strict";
     init_workflow_command();
-    execute3 = promisify3(execFile3);
+    execute4 = promisify4(execFile4);
     observations = /* @__PURE__ */ new Map();
   }
 });
 
 // src/push-schema.ts
-import { z as z16 } from "zod";
+import { z as z18 } from "zod";
 var PushBindingSchema, PushStateSchema, PendingPushSchema;
 var init_push_schema = __esm({
   "src/push-schema.ts"() {
     "use strict";
     init_push();
-    PushBindingSchema = z16.object({
-      bindingId: z16.string().uuid(),
-      installationId: z16.string().uuid(),
-      deviceId: z16.string().uuid()
+    PushBindingSchema = z18.object({
+      bindingId: z18.string().uuid(),
+      installationId: z18.string().uuid(),
+      deviceId: z18.string().uuid()
     });
-    PushStateSchema = z16.object({
-      bindings: z16.array(PushBindingSchema).max(10),
-      error: z16.string().nullable()
+    PushStateSchema = z18.object({
+      bindings: z18.array(PushBindingSchema).max(10),
+      error: z18.string().nullable()
     });
     PendingPushSchema = PushEventSchema.extend({
-      remaining: z16.array(PushBindingSchema),
-      createdAt: z16.number(),
-      attempts: z16.number().int().nonnegative(),
-      nextAt: z16.number()
+      remaining: z18.array(PushBindingSchema),
+      createdAt: z18.number(),
+      attempts: z18.number().int().nonnegative(),
+      nextAt: z18.number()
     });
   }
 });
 
 // src/store.ts
 import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "node:fs";
-import path9 from "node:path";
+import path11 from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { Context as Context3, Data as Data3, Effect as Effect14, Layer as Layer3 } from "effect";
-import { z as z17 } from "zod";
+import { z as z19 } from "zod";
 import { randomUUID as randomUUID7 } from "node:crypto";
 var StorageError, PayloadRow, EventRow, SqliteSessionStore, SessionStore;
 var init_store = __esm({
@@ -3777,8 +4451,8 @@ var init_store = __esm({
     init_src();
     StorageError = class extends Data3.TaggedError("StorageError") {
     };
-    PayloadRow = z17.object({ payload: z17.string() });
-    EventRow = z17.object({ sequence: z17.number(), recorded_at: z17.string(), payload: z17.string() });
+    PayloadRow = z19.object({ payload: z19.string() });
+    EventRow = z19.object({ sequence: z19.number(), recorded_at: z19.string(), payload: z19.string() });
     SqliteSessionStore = class {
       constructor(db) {
         this.db = db;
@@ -3829,7 +4503,7 @@ var init_store = __esm({
           const row = PayloadRow.parse(
             this.db.prepare("SELECT payload FROM settings WHERE id = 'server-id'").get()
           );
-          return z17.string().uuid().parse(JSON.parse(row.payload));
+          return z19.string().uuid().parse(JSON.parse(row.payload));
         });
       }
       saveDevice(device, tokenHash) {
@@ -3917,10 +4591,10 @@ var init_store = __esm({
       `).all();
           const insert = this.db.prepare("INSERT OR IGNORE INTO projects(id, payload) VALUES (?, ?)");
           for (const row of legacy) {
-            const id = z17.object({ id: z17.string() }).parse(row).id;
+            const id = z19.object({ id: z19.string() }).parse(row).id;
             insert.run(
               id,
-              JSON.stringify({ id, name: id, path: path9.join(root, id), available: false })
+              JSON.stringify({ id, name: id, path: path11.join(root, id), available: false })
             );
           }
           return this.db.prepare("SELECT payload FROM projects").all().map((row) => ProjectSchema.parse(JSON.parse(PayloadRow.parse(row).payload)));
@@ -3957,7 +4631,7 @@ var init_store = __esm({
         this.db.prepare(
           "UPDATE workflows SET payload = json_set(payload, '$.projectPath', ?) WHERE json_extract(payload, '$.kind') = 'preparation' AND json_extract(payload, '$.projectPath') = ?"
         ).run(project.path, previousPath);
-        const relocate = (workspace) => workspace === previousPath || workspace.startsWith(`${previousPath}${path9.sep}`) ? project.path + workspace.slice(previousPath.length) : workspace;
+        const relocate = (workspace) => workspace === previousPath || workspace.startsWith(`${previousPath}${path11.sep}`) ? project.path + workspace.slice(previousPath.length) : workspace;
         for (const row of this.db.prepare("SELECT id, payload FROM sessions WHERE json_extract(payload, '$.projectId') = ?").all(project.id)) {
           const session = SessionSchema.parse(JSON.parse(PayloadRow.parse(row).payload));
           if (session.workspacePath) {
@@ -4127,7 +4801,7 @@ var init_store = __esm({
             if (event.type === "message.user") this.claimAttachments(event.attachments ?? []);
             const result = this.db.prepare("INSERT INTO events(session_id, recorded_at, payload) VALUES (?, ?, ?)").run(sessionId, recordedAt, JSON.stringify(event));
             if (notification) {
-              const count = z17.object({ total: z17.number() }).parse(this.db.prepare("SELECT COUNT(*) AS total FROM push_outbox").get());
+              const count = z19.object({ total: z19.number() }).parse(this.db.prepare("SELECT COUNT(*) AS total FROM push_outbox").get());
               if (count.total >= 1e3)
                 this.db.prepare(
                   "DELETE FROM push_outbox WHERE rowid IN (SELECT rowid FROM push_outbox ORDER BY rowid LIMIT 1)"
@@ -4173,13 +4847,13 @@ var init_store = __esm({
           Effect14.acquireRelease(
             Effect14.try({
               try: () => {
-                mkdirSync2(path9.dirname(filename), { recursive: true });
+                mkdirSync2(path11.dirname(filename), { recursive: true });
                 const db = new DatabaseSync(filename);
                 chmodSync(filename, 384);
                 for (const suffix of ["-wal", "-shm"])
                   if (existsSync2(filename + suffix)) chmodSync(filename + suffix, 384);
                 try {
-                  const schema = z17.object({ user_version: z17.number() }).parse(db.prepare("PRAGMA user_version").get());
+                  const schema = z19.object({ user_version: z19.number() }).parse(db.prepare("PRAGMA user_version").get());
                   if (schema.user_version > 1)
                     throw new Error("This database requires a newer Agentrific server.");
                   db.exec(`
@@ -4216,12 +4890,12 @@ var init_store = __esm({
 
 // src/worktree-cleanup.ts
 import { lstat as lstat2, rm as rm2 } from "node:fs/promises";
-import path10 from "node:path";
+import path12 from "node:path";
 import { Effect as Effect15 } from "effect";
 async function removeRunFiles(dataRoot2, sessionId) {
-  if (path10.basename(sessionId) !== sessionId || sessionId === "." || sessionId === "..")
+  if (path12.basename(sessionId) !== sessionId || sessionId === "." || sessionId === "..")
     throw new Error("Invalid session directory.");
-  await rm2(path10.join(dataRoot2, "pi", sessionId), { recursive: true, force: true });
+  await rm2(path12.join(dataRoot2, "pi", sessionId), { recursive: true, force: true });
 }
 var WorktreeCleanup;
 var init_worktree_cleanup = __esm({
@@ -4240,12 +4914,12 @@ var init_worktree_cleanup = __esm({
       projectsRoot;
       async remove(session, discardChanges = true) {
         if (session.gitFlow?.workspace !== "worktree" || !session.workspacePath) return;
-        const workspace = path10.resolve(session.workspacePath);
+        const workspace = path12.resolve(session.workspacePath);
         const info = await lstat2(workspace).catch((error) => {
           if (error.code === "ENOENT") return void 0;
           throw error;
         });
-        if (workspace !== path10.join(this.root, session.id) || path10.basename(session.id) !== session.id) {
+        if (workspace !== path12.join(this.root, session.id) || path12.basename(session.id) !== session.id) {
           if (!info) return;
           throw new Error("Refusing to remove a worktree outside the managed workspaces directory.");
         }
@@ -4331,14 +5005,14 @@ import { styleText as styleText4 } from "node:util";
 import cors from "@fastify/cors";
 import multipart from "@fastify/multipart";
 import { randomUUID as randomUUID9 } from "node:crypto";
-import { execFile as execFile4 } from "node:child_process";
-import { promisify as promisify4 } from "node:util";
+import { execFile as execFile5 } from "node:child_process";
+import { promisify as promisify5 } from "node:util";
 import { realpath as realpath2 } from "node:fs/promises";
-import { homedir as homedir4 } from "node:os";
-import path11 from "node:path";
+import { homedir as homedir5 } from "node:os";
+import path13 from "node:path";
 import { WebSocket } from "ws";
 import { Effect as Effect17, ManagedRuntime } from "effect";
-import { z as z18 } from "zod";
+import { z as z20 } from "zod";
 import { ModelRuntime } from "@earendil-works/pi-coding-agent";
 function publish(event, workflowUpdate = false) {
   const previous = event.type === "session.updated" ? Effect17.runSync(store.get(event.session.id)) : void 0;
@@ -4399,18 +5073,18 @@ async function resolveSessionProject(projectId) {
     return { error: "Project folder is missing. Reconnect it before starting a run.", status: 404 };
   const projectPath = await realpath2(project.path);
   const resolvedRoot = await realpath2(projectsRoot);
-  if (path11.dirname(projectPath) !== resolvedRoot)
+  if (path13.dirname(projectPath) !== resolvedRoot)
     return { error: "Project path is outside projects root.", status: 400 };
   return { projectPath };
 }
 async function resolveSessionWorkspace(id, gitFlow, projectPath) {
-  const worktreePath = path11.join(worktreesRoot, id);
+  const worktreePath = path13.join(worktreesRoot, id);
   const branch = gitFlow ? `agentrific/${id.slice(0, 8)}` : null;
   const useProjectCheckout = gitFlow?.workspace === "checkout";
   const workspacePath = !gitFlow || useProjectCheckout ? projectPath : worktreePath;
   if (useProjectCheckout) {
     const serverPath = await realpath2(process.cwd());
-    if (serverPath === projectPath || serverPath.startsWith(`${projectPath}${path11.sep}`))
+    if (serverPath === projectPath || serverPath.startsWith(`${projectPath}${path13.sep}`))
       return {
         error: "The server runs from this project. Choose a worktree for this task.",
         status: 409
@@ -4546,10 +5220,10 @@ async function withSessionTaskLock(id, operation) {
   return withTaskLock(lockId, operation);
 }
 function localServerUrl() {
-  const address = z18.object({ port: z18.number() }).safeParse(app.server.address());
+  const address = z20.object({ port: z20.number() }).safeParse(app.server.address());
   return address.success ? `http://${host}:${address.data.port}` : void 0;
 }
-var host, port, defaultProjectsRoot, worktreesRoot, execFileAsync, app, dataRoot, releaseLock, effects, store, security, sandboxPushUrl, testPushUrl, push, allowedOrigins, attachmentEffects, attachments, attachmentCleanup, models, delivery, preparation, agentEffects, runtime, worktreeCleanup, maxWorktreeAgeDays, pruneWorktrees, worktreeCleanupTimer, updates, maintenance, stopUpdateDiscovery, HistoryQuery, StartTaskBody, automation, automationTimer, closeControl;
+var host, port, defaultProjectsRoot, worktreesRoot, execFileAsync, app, dataRoot, releaseLock, effects, store, security, sandboxPushUrl, testPushUrl, push, allowedOrigins, attachmentEffects, attachments, attachmentCleanup, claudeCode, modelRuntime, models, delivery, preparation, agentEffects, runtime, worktreeCleanup, maxWorktreeAgeDays, pruneWorktrees, worktreeCleanupTimer, updates, maintenance, stopUpdateDiscovery, HistoryQuery, StartTaskBody, automation, automationTimer, phoneOrigin, phone, closeControl;
 var init_index = __esm({
   async "src/index.ts"() {
     "use strict";
@@ -4560,6 +5234,7 @@ var init_index = __esm({
     init_event_server();
     init_security();
     init_control();
+    init_desktop_phone();
     init_version();
     init_maintenance();
     init_updates();
@@ -4569,6 +5244,7 @@ var init_index = __esm({
     init_delivery();
     init_preparation();
     init_delivery_writer();
+    init_claude_code();
     init_models();
     init_pi();
     init_projects();
@@ -4579,11 +5255,11 @@ var init_index = __esm({
     init_repo_chat();
     host = process.env.AGENTRIFIC_HOST ?? "127.0.0.1";
     port = Number(process.env.AGENTRIFIC_PORT ?? 4318);
-    defaultProjectsRoot = path11.resolve(process.env.AGENTRIFIC_PROJECTS_DIR ?? "./projects");
-    worktreesRoot = path11.resolve(
-      process.env.AGENTRIFIC_WORKTREES_DIR ?? path11.join(homedir4(), ".agentrific", "workspaces")
+    defaultProjectsRoot = path13.resolve(process.env.AGENTRIFIC_PROJECTS_DIR ?? "./projects");
+    worktreesRoot = path13.resolve(
+      process.env.AGENTRIFIC_WORKTREES_DIR ?? path13.join(homedir5(), ".agentrific", "workspaces")
     );
-    execFileAsync = promisify4(execFile4);
+    execFileAsync = promisify5(execFile5);
     if (host !== "127.0.0.1" && host !== "::1")
       throw new Error("Bind Agentrific to loopback and expose it with Tailscale Serve or cloudflared.");
     app = Fastify({
@@ -4604,9 +5280,9 @@ var init_index = __esm({
         }
       }
     });
-    dataRoot = path11.resolve(process.env.AGENTRIFIC_DATA_DIR ?? "./data");
+    dataRoot = path13.resolve(process.env.AGENTRIFIC_DATA_DIR ?? "./data");
     releaseLock = await acquireServerLock(dataRoot);
-    effects = ManagedRuntime.make(SessionStore.layer(path11.join(dataRoot, "sessions.sqlite")));
+    effects = ManagedRuntime.make(SessionStore.layer(path13.join(dataRoot, "sessions.sqlite")));
     store = await effects.runPromise(SessionStore);
     security = new ServerSecurity(store, await Effect17.runPromise(store.serverIdentity()));
     sandboxPushUrl = process.env.AGENTRIFIC_PUSH_SANDBOX === "1" ? PUSH_SANDBOX_API_URL : void 0;
@@ -4638,7 +5314,7 @@ var init_index = __esm({
     await registerSecurity(app, security, serverVersion, allowedOrigins);
     registerPushRoutes(app, push, security);
     attachmentEffects = ManagedRuntime.make(
-      Attachments.layer(path11.join(dataRoot, "attachments"), store)
+      Attachments.layer(path13.join(dataRoot, "attachments"), store)
     );
     attachments = await attachmentEffects.runPromise(Attachments);
     await Effect17.runPromise(attachments.cleanup());
@@ -4684,7 +5360,10 @@ var init_index = __esm({
         return reply.type(preview ? "image/png" : attachment.mimeType).send(attachments.content(attachment, preview));
       }
     );
-    models = new ServerModels(await ModelRuntime.create(), store);
+    claudeCode = new ClaudeCode();
+    modelRuntime = await ModelRuntime.create();
+    await claudeCode.refresh(modelRuntime);
+    models = new ServerModels(modelRuntime, store, claudeCode);
     delivery = new DeliveryCoordinator(store, {
       publish: (event) => publish(event, true),
       draft: deliveryWriter(models),
@@ -4703,7 +5382,7 @@ var init_index = __esm({
         createPiFactory(attachments, models, delivery),
         publish,
         worktreesRoot,
-        path11.join(dataRoot, "pi"),
+        path13.join(dataRoot, "pi"),
         (sessionId, messageId) => Effect17.runSync(store.hasMessage(sessionId, messageId)),
         (session) => delivery.settled(session.id)
       )
@@ -4864,7 +5543,7 @@ var init_index = __esm({
       return project ?? reply.code(404).send({ error: "Project not found on this server." });
     });
     app.post("/api/projects/:id/reconnect", async (request, reply) => {
-      const parsed = z18.object({ path: z18.string().trim().min(1).max(4096) }).safeParse(request.body);
+      const parsed = z20.object({ path: z20.string().trim().min(1).max(4096) }).safeParse(request.body);
       if (!parsed.success)
         return reply.code(400).send({ error: "Enter the project's new folder path." });
       const root = await Effect17.runPromise(store.projectsRoot(defaultProjectsRoot));
@@ -4950,7 +5629,7 @@ var init_index = __esm({
       }
     });
     app.post("/api/tasks/:id/discard-unrun", async (request, reply) => {
-      const parsed = z18.object({ updatedAt: z18.string().datetime() }).safeParse(request.body);
+      const parsed = z20.object({ updatedAt: z20.string().datetime() }).safeParse(request.body);
       if (!parsed.success) return reply.code(400).send({ error: "The task revision is required." });
       try {
         await deleteTask(store, request.params.id, void 0, parsed.data.updatedAt);
@@ -5020,9 +5699,9 @@ var init_index = __esm({
         }
       })
     );
-    HistoryQuery = z18.object({
-      after: z18.coerce.number().int().nonnegative().default(0),
-      limit: z18.coerce.number().int().min(1).max(1e3).default(500)
+    HistoryQuery = z20.object({
+      after: z20.coerce.number().int().nonnegative().default(0),
+      limit: z20.coerce.number().int().min(1).max(1e3).default(500)
     });
     app.get("/api/sessions/:id/events", async (request, reply) => {
       const query = HistoryQuery.safeParse(request.query);
@@ -5036,7 +5715,7 @@ var init_index = __esm({
       const location = await resolveSessionProject(request.params.id);
       if (location.error !== void 0)
         return reply.code(location.status).send({ error: location.error });
-      const parsed = z18.object({ reset: z18.boolean().optional() }).safeParse(request.body ?? {});
+      const parsed = z20.object({ reset: z20.boolean().optional() }).safeParse(request.body ?? {});
       if (!parsed.success) return reply.code(400).send({ error: parsed.error.flatten() });
       try {
         return await openRepoChat(
@@ -5060,7 +5739,7 @@ var init_index = __esm({
       if (!result.session) return reply.code(result.status).send({ error: result.error });
       return reply.code(201).send(result.session);
     });
-    StartTaskBody = z18.object({ prompt: z18.string().trim().max(2e4).optional() }).default({});
+    StartTaskBody = z20.object({ prompt: z20.string().trim().max(2e4).optional() }).default({});
     app.post("/api/tasks/:id/start", async (request, reply) => {
       const body = StartTaskBody.safeParse(request.body ?? {});
       if (!body.success) return reply.code(400).send({ error: "The task prompt is too long." });
@@ -5095,7 +5774,7 @@ var init_index = __esm({
       return automation.configure(parsed.data);
     });
     app.patch("/api/automation/queue", async (request, reply) => {
-      const parsed = z18.object({ taskId: z18.string().min(1), beforeId: z18.string().min(1).nullable() }).safeParse(request.body);
+      const parsed = z20.object({ taskId: z20.string().min(1), beforeId: z20.string().min(1).nullable() }).safeParse(request.body);
       if (!parsed.success)
         return reply.code(400).send({ error: "Choose a task and a queue position." });
       try {
@@ -5152,12 +5831,31 @@ var init_index = __esm({
       type: "snapshot",
       sessions: Effect17.runSync(store.list())
     }));
+    phone = process.env.AGENTRIFIC_DESKTOP_SERVER === "1" ? new DesktopPhoneConnection(
+      () => {
+        const origin = localServerUrl();
+        if (!origin) throw new Error("Start the local server before connecting your phone.");
+        return origin;
+      },
+      (url) => {
+        if (phoneOrigin) {
+          const index = allowedOrigins.indexOf(phoneOrigin);
+          if (index >= 0) allowedOrigins.splice(index, 1);
+        }
+        phoneOrigin = url || void 0;
+        process.env.AGENTRIFIC_PUBLIC_URL = url || "";
+        if (url && !allowedOrigins.includes(url)) allowedOrigins.push(url);
+      },
+      path13.join(dataRoot, "phone-connection")
+    ) : void 0;
     closeControl = await startControl(
       dataRoot,
       security,
       () => ({
         serverId: security.serverId,
         publicUrl: process.env.AGENTRIFIC_PUBLIC_URL,
+        phoneProvider: phone?.snapshot().provider,
+        phoneProgress: phone?.snapshot().progress,
         localUrl: localServerUrl(),
         serverVersion,
         connectedDevices: new Set(security.sockets.values()).size,
@@ -5170,10 +5868,12 @@ var init_index = __esm({
       async () => {
         await app.close();
         process.exit(0);
-      }
+      },
+      phone
     );
     push.start();
     app.addHook("onClose", async () => {
+      await phone?.close();
       await push.close();
       maintenance.enter();
       stopUpdateDiscovery();
@@ -5206,9 +5906,9 @@ var init_index = __esm({
 
 // src/cli.ts
 init_warnings();
-import { mkdir as mkdir6, readFile as readFile6, writeFile as writeFile5 } from "node:fs/promises";
-import { homedir as homedir5 } from "node:os";
-import path12 from "node:path";
+import { mkdir as mkdir7, readFile as readFile7, writeFile as writeFile6 } from "node:fs/promises";
+import { homedir as homedir6 } from "node:os";
+import path14 from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/service.ts
@@ -5307,284 +6007,18 @@ init_version();
 init_pairing();
 import { spawn as spawn2 } from "node:child_process";
 import { parseArgs } from "node:util";
-import { z as z19 } from "zod";
+import { z as z21 } from "zod";
 
 // src/terminal.ts
 init_pairing();
 init_cli_output();
+init_tunnels();
+init_opentunnel();
 import { createInterface } from "node:readline/promises";
 import select from "@inquirer/select";
 import { emitKeypressEvents as emitKeypressEvents2 } from "node:readline";
 import { styleText as styleText3 } from "node:util";
-
-// src/tunnels.ts
-init_cli_output();
-import { spawn } from "node:child_process";
-import { access, stat } from "node:fs/promises";
-import { constants } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import path3 from "node:path";
-import { z as z5 } from "zod";
-function signalChild(child, signal) {
-  if (!child.pid) return;
-  if (process.platform === "win32") {
-    child.kill(signal);
-    return;
-  }
-  try {
-    process.kill(-child.pid, signal);
-  } catch (error) {
-    if (!z5.object({ code: z5.literal("ESRCH") }).safeParse(error).success) child.kill(signal);
-  }
-}
-function execute2(file, args, timeoutMs, env = process.env) {
-  return new Promise((resolve2, reject) => {
-    const child = spawn(file, args, {
-      env,
-      detached: process.platform !== "win32",
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    let stdout = "";
-    let stderr = "";
-    const timeout = setTimeout(() => {
-      signalChild(child, "SIGKILL");
-      reject(new Error("Command probe timed out."));
-    }, timeoutMs);
-    child.stdout?.on("data", (data) => {
-      stdout += data.toString();
-      checkOutput();
-    });
-    child.stderr?.on("data", (data) => {
-      stderr += data.toString();
-      checkOutput();
-    });
-    child.once("error", (error) => {
-      clearTimeout(timeout);
-      reject(error);
-    });
-    child.once("exit", () => signalChild(child, "SIGKILL"));
-    child.once("close", (code) => {
-      clearTimeout(timeout);
-      if (code !== 0) reject(new Error("Command probe failed."));
-      else resolve2({ stdout, stderr });
-    });
-    function checkOutput() {
-      if (stdout.length + stderr.length <= 1048576) return;
-      signalChild(child, "SIGKILL");
-      reject(new Error("Command probe output exceeded its limit."));
-    }
-  });
-}
-async function findExecutable(name) {
-  const candidates = (process.env.PATH ?? "").split(path3.delimiter).map((directory) => path3.resolve(directory, name));
-  if (process.platform === "darwin") {
-    candidates.push(`/opt/homebrew/bin/${name}`, `/usr/local/bin/${name}`);
-    if (name === "tailscale")
-      candidates.push("/Applications/Tailscale.app/Contents/MacOS/Tailscale");
-  }
-  for (const candidate of candidates) {
-    try {
-      await access(candidate, constants.X_OK);
-      if ((await stat(candidate)).isFile()) return candidate;
-    } catch {
-      continue;
-    }
-  }
-  return void 0;
-}
-var TcpConfig = z5.object({ TCP: z5.record(z5.string(), z5.unknown()).optional() });
-var ServeConfig = TcpConfig.extend({
-  Foreground: z5.record(z5.string(), TcpConfig).optional()
-});
-async function probeTailscale() {
-  const option = { provider: "tailscale", available: false, reason: "Not installed" };
-  const executable = await findExecutable("tailscale");
-  if (!executable) return option;
-  option.executable = executable;
-  const env = { ...process.env, TAILSCALE_BE_CLI: "1" };
-  try {
-    const response = await execute2(executable, ["status", "--json"], 3e3, env);
-    const status = z5.object({
-      BackendState: z5.string(),
-      CertDomains: z5.array(z5.string()).optional(),
-      Self: z5.object({ DNSName: z5.string() }).nullable().optional()
-    }).parse(JSON.parse(response.stdout));
-    if (status.BackendState !== "Running")
-      return { ...option, reason: "Installed \xB7 connect Tailscale first" };
-    const dns = status.Self?.DNSName.replace(/\.$/, "");
-    if (!dns || !status.CertDomains?.includes(dns))
-      return { ...option, reason: "Enable HTTPS certificates in your tailnet first" };
-    const help = await execute2(executable, ["serve", "--help"], 2e3, env);
-    if (!`${help.stdout}${help.stderr}`.includes("--https"))
-      return { ...option, reason: "Update Tailscale to use foreground HTTPS Serve" };
-    const responseConfig = await execute2(executable, ["serve", "status", "--json"], 3e3, env);
-    const config = ServeConfig.parse(JSON.parse(responseConfig.stdout) ?? {});
-    const occupied = new Set(Object.keys(config.TCP ?? {}));
-    for (const foreground of Object.values(config.Foreground ?? {}))
-      for (const port3 of Object.keys(foreground.TCP ?? {})) occupied.add(port3);
-    const port2 = [443, ...Array.from({ length: 10 }, (_, index) => 8443 + index)].find(
-      (candidate) => !occupied.has(String(candidate))
-    );
-    if (!port2) return { ...option, reason: "HTTPS Serve ports are in use \xB7 paste an existing URL" };
-    return {
-      ...option,
-      available: true,
-      reason: "Private to your tailnet \xB7 Tailscale required on your phone",
-      publicUrl: new URL(`https://${dns}${port2 === 443 ? "" : `:${port2}`}`).origin,
-      httpsPort: port2
-    };
-  } catch {
-    return { ...option, reason: "Installed \xB7 could not verify daemon or Serve access" };
-  }
-}
-async function probeCloudflared(home) {
-  const option = {
-    provider: "cloudflared",
-    available: false,
-    reason: "Not installed"
-  };
-  const executable = await findExecutable("cloudflared");
-  if (!executable) return option;
-  option.executable = executable;
-  try {
-    await execute2(executable, ["--version"], 2e3);
-    const help = await execute2(executable, ["tunnel", "--help"], 2e3);
-    if (!`${help.stdout}${help.stderr}`.includes("--url"))
-      return { ...option, reason: "Installed \xB7 this version does not support Quick Tunnels" };
-  } catch {
-    return { ...option, reason: "Installed \xB7 command probe failed or timed out" };
-  }
-  const directories = [
-    path3.join(home, ".cloudflared"),
-    path3.join(home, ".cloudflare-warp"),
-    path3.join(home, "cloudflare-warp"),
-    "/etc/cloudflared",
-    "/usr/local/etc/cloudflared"
-  ];
-  const configurations = await Promise.all(
-    directories.flatMap(
-      (directory) => ["config.yml", "config.yaml"].map(
-        async (name) => access(path3.join(directory, name), constants.F_OK).then(
-          () => true,
-          () => false
-        )
-      )
-    )
-  );
-  if (configurations.some(Boolean))
-    return { ...option, reason: "Existing tunnel configuration \xB7 paste its HTTPS URL" };
-  return { ...option, available: true, reason: "Temporary public HTTPS URL \xB7 changes each start" };
-}
-async function detectTunnels(home = homedir2()) {
-  return Promise.all([probeTailscale(), probeCloudflared(home)]);
-}
-var ManagedTunnel = class {
-  constructor(option) {
-    this.option = option;
-  }
-  option;
-  child;
-  stopping = false;
-  connected = false;
-  closing;
-  running() {
-    return this.connected && !this.stopping;
-  }
-  stopOnSignal = () => {
-    void this.close();
-  };
-  stopOnExit = () => {
-    if (this.child) signalChild(this.child, "SIGKILL");
-  };
-  async start(origin, signal) {
-    signal?.throwIfAborted();
-    if (!this.option.available) throw new Error(this.option.reason);
-    const tailscale = this.option.provider === "tailscale";
-    const child = spawn(
-      this.option.executable ?? this.option.provider,
-      tailscale ? ["serve", "--bg=false", `--https=${this.option.httpsPort}`, origin] : ["tunnel", "--no-autoupdate", "--url", origin],
-      {
-        stdio: ["ignore", "pipe", "pipe"],
-        detached: process.platform !== "win32",
-        env: tailscale ? { ...process.env, TAILSCALE_BE_CLI: "1" } : process.env
-      }
-    );
-    this.child = child;
-    process.once("SIGINT", this.stopOnSignal);
-    process.once("SIGTERM", this.stopOnSignal);
-    process.once("exit", this.stopOnExit);
-    return new Promise((resolve2, reject) => {
-      let output = "";
-      let address;
-      let settled = false;
-      const abort = () => fail("Tunnel startup canceled.");
-      const timeout = setTimeout(
-        () => fail("Tunnel startup timed out. Check your connection or paste an existing HTTPS URL."),
-        45e3
-      );
-      const fail = (message) => {
-        if (settled) return;
-        settled = true;
-        clearTimeout(timeout);
-        signal?.removeEventListener("abort", abort);
-        void this.close();
-        reject(new Error(message));
-      };
-      const read = (data) => {
-        output = `${output}${data.toString()}`.slice(-65536);
-        address = tailscale ? this.option.publicUrl : output.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com\b/)?.[0];
-        const ready = tailscale ? Boolean(
-          address && output.includes(address) && output.includes("Available within your tailnet")
-        ) : output.includes("Registered tunnel connection");
-        if (settled || !address || !ready) return;
-        settled = true;
-        this.connected = true;
-        clearTimeout(timeout);
-        signal?.removeEventListener("abort", abort);
-        resolve2(address);
-      };
-      child.stdout?.on("data", read);
-      child.stderr?.on("data", read);
-      signal?.addEventListener("abort", abort, { once: true });
-      child.once(
-        "error",
-        () => fail(`${this.option.provider} could not start. Check the installation and permissions.`)
-      );
-      child.once("exit", () => signalChild(child, "SIGTERM"));
-      child.once("close", (code) => {
-        const unexpected = this.connected && !this.stopping;
-        this.connected = false;
-        process.removeListener("SIGINT", this.stopOnSignal);
-        process.removeListener("SIGTERM", this.stopOnSignal);
-        process.removeListener("exit", this.stopOnExit);
-        fail(
-          `${this.option.provider} exited (${code ?? "signal"}). Check tunnel access or paste an existing HTTPS URL.`
-        );
-        if (unexpected)
-          printError(
-            "The managed tunnel stopped. Restart the server to reconnect your phone; local work can continue."
-          );
-      });
-    });
-  }
-  close() {
-    this.stopping = true;
-    const child = this.child;
-    if (!child?.pid || child.exitCode !== null || child.signalCode !== null)
-      return Promise.resolve();
-    this.closing ??= new Promise((resolve2) => {
-      const timeout = setTimeout(() => signalChild(child, "SIGKILL"), 2e3);
-      child.once("close", () => {
-        clearTimeout(timeout);
-        resolve2();
-      });
-      signalChild(child, "SIGTERM");
-    });
-    return this.closing;
-  }
-};
-
-// src/terminal.ts
+import path5 from "node:path";
 async function promptPublicUrl(signal, saved) {
   const prompt = createInterface({ input: process.stdin, output: process.stdout });
   const cancel = () => controller.abort();
@@ -5628,9 +6062,14 @@ async function selectConnectionMethod(options, signal, saved) {
   return select(
     {
       message: "Connection method",
-      default: saved ? "existing" : void 0,
+      default: saved ? "existing" : "opentunnel",
       loop: false,
       choices: [
+        {
+          value: "opentunnel",
+          name: "OpenTunnel (default)",
+          description: "Built-in HTTPS connection with a persistent address. No separate CLI needed."
+        },
         ...options.filter((option) => option.available).map((option) => ({
           value: option.provider,
           name: option.provider === "tailscale" ? "Tailscale" : "Cloudflared",
@@ -5661,13 +6100,14 @@ async function selectConnectionMethod(options, signal, saved) {
     { signal }
   );
 }
-async function startSelectedTunnel(options, choice, origin, signal) {
+async function startSelectedTunnel(options, choice, origin, signal, dataDir) {
   const option = options.find((candidate) => candidate.provider === choice);
-  if (!option?.available) throw new Error("The selected tunnel is unavailable.");
-  const tunnel = new ManagedTunnel(option);
+  if (choice !== "opentunnel" && !option?.available)
+    throw new Error("The selected tunnel is unavailable.");
+  const tunnel = choice === "opentunnel" ? new OpenTunnel(path5.join(dataDir, "phone-connection")) : new ManagedTunnel(option);
   try {
     console.log(styleText3("dim", `
-  Starting ${option.provider}\u2026
+  Starting ${choice}\u2026
 `));
     const url = await tunnel.start(origin, signal);
     return { url, tunnel, remember: false };
@@ -5678,7 +6118,7 @@ async function startSelectedTunnel(options, choice, origin, signal) {
     return void 0;
   }
 }
-async function selectPublicConnection(origin, saved) {
+async function selectPublicConnection(origin, saved, dataDir = process.env.AGENTRIFIC_DATA_DIR || ".agentrific") {
   const controller = new AbortController();
   const cancel = () => controller.abort();
   process.once("SIGINT", cancel);
@@ -5699,7 +6139,13 @@ async function selectPublicConnection(origin, saved) {
         console.log();
         return { url: await promptPublicUrl(controller.signal, saved), remember: true };
       }
-      const connection = await startSelectedTunnel(options, choice, origin, controller.signal);
+      const connection = await startSelectedTunnel(
+        options,
+        choice,
+        origin,
+        controller.signal,
+        dataDir
+      );
       if (connection) return connection;
     }
   } finally {
@@ -5787,11 +6233,14 @@ function startTerminal(dataDir, publicUrl, tunnel) {
 }
 
 // src/cli.ts
+init_opentunnel();
+init_tunnels();
 init_cli_output();
-var ConfigSchema = z19.object({
-  dataDir: z19.string(),
-  projectsDir: z19.string(),
-  publicUrl: z19.string().url().optional()
+var ConfigSchema = z21.object({
+  dataDir: z21.string(),
+  projectsDir: z21.string(),
+  publicUrl: z21.string().url().optional(),
+  connection: z21.enum(["opentunnel", "tailscale", "cloudflared", "existing", "local"]).optional()
 });
 function parseCommandArgs() {
   return parseArgs({
@@ -5799,6 +6248,7 @@ function parseCommandArgs() {
     options: {
       "data-dir": { type: "string" },
       "public-url": { type: "string" },
+      connection: { type: "string" },
       version: { type: "boolean" },
       help: { type: "boolean" },
       check: { type: "boolean" },
@@ -5819,15 +6269,15 @@ async function main() {
     printHelp();
     return;
   }
-  const dataDir = path12.resolve(
-    values["data-dir"] ?? process.env.AGENTRIFIC_DATA_DIR ?? path12.join(homedir5(), ".agentrific")
+  const dataDir = path14.resolve(
+    values["data-dir"] ?? process.env.AGENTRIFIC_DATA_DIR ?? path14.join(homedir6(), ".agentrific")
   );
-  const filename = path12.join(dataDir, "config.json");
+  const filename = path14.join(dataDir, "config.json");
   const config = ConfigSchema.parse(
     JSON.parse(
-      await readFile6(filename, "utf8").catch((error) => {
-        if (!z19.object({ code: z19.literal("ENOENT") }).safeParse(error).success) throw error;
-        return JSON.stringify({ dataDir, projectsDir: path12.join(homedir5(), "projects") });
+      await readFile7(filename, "utf8").catch((error) => {
+        if (!z21.object({ code: z21.literal("ENOENT") }).safeParse(error).success) throw error;
+        return JSON.stringify({ dataDir, projectsDir: path14.join(homedir6(), "projects") });
       })
     )
   );
@@ -5844,11 +6294,12 @@ async function main() {
   throw new Error("Unknown command. Run agentrific --help.");
 }
 async function initCommand({ values, dataDir, filename, config }) {
-  await mkdir6(dataDir, { recursive: true, mode: 448 });
+  await mkdir7(dataDir, { recursive: true, mode: 448 });
   const publicUrl = values["public-url"] ?? config.publicUrl;
+  const connection = values.connection ? ConfigSchema.shape.connection.unwrap().parse(values.connection) : config.connection;
   if (publicUrl && new URL(publicUrl).protocol !== "https:")
     throw new Error("Configure an HTTPS URL from Tailscale Serve or Cloudflare Tunnel.");
-  await writeFile5(filename, JSON.stringify({ ...config, publicUrl }, null, 2) + "\n", {
+  await writeFile6(filename, JSON.stringify({ ...config, publicUrl, connection }, null, 2) + "\n", {
     mode: 384
   });
   console.log(`Configuration saved to ${filename}. Start with agentrific start.`);
@@ -5861,28 +6312,48 @@ async function startCommand({ values, dataDir, filename, config }) {
     process.stdin.isTTY && process.stdout.isTTY && !values["no-interactive"]
   );
   const explicitUrl = values["public-url"] ?? process.env.AGENTRIFIC_PUBLIC_URL;
+  const method = values.connection ? z21.enum(["opentunnel", "tailscale", "cloudflared", "existing", "local"]).parse(values.connection) : explicitUrl ? "existing" : config.connection;
+  const origin = `http://${process.env.AGENTRIFIC_HOST ?? "127.0.0.1"}:${process.env.AGENTRIFIC_PORT ?? "4318"}`;
   if (interactive) {
     process.env.AGENTRIFIC_INTERACTIVE = "1";
     printHeading("server");
   }
-  const connection = interactive && !explicitUrl ? await selectPublicConnection(
-    `http://${process.env.AGENTRIFIC_HOST ?? "127.0.0.1"}:${process.env.AGENTRIFIC_PORT ?? "4318"}`,
-    config.publicUrl
-  ) : {
-    url: explicitUrl ? pairingOrigin(explicitUrl) : config.publicUrl,
+  let connection = interactive && !explicitUrl && !method ? await selectPublicConnection(origin, config.publicUrl, dataDir) : {
+    url: method === "local" ? void 0 : explicitUrl ? pairingOrigin(explicitUrl) : config.publicUrl,
     remember: false,
     tunnel: void 0
   };
+  const provider = method || (!interactive && !connection.url ? "opentunnel" : void 0);
+  if (provider && !["existing", "local"].includes(provider)) {
+    const option = provider === "opentunnel" ? void 0 : (await detectTunnels()).find((candidate) => candidate.provider === provider);
+    if (provider !== "opentunnel" && !option?.available)
+      throw new Error(option?.reason || "The selected tunnel is unavailable.");
+    const tunnel = provider === "opentunnel" ? new OpenTunnel(path14.join(dataDir, "phone-connection")) : new ManagedTunnel(option);
+    try {
+      connection = { url: await tunnel.start(origin), remember: false, tunnel };
+    } catch (error) {
+      await tunnel.close();
+      throw error;
+    }
+  }
+  if (method === "existing" && !connection.url)
+    throw new Error("Pass --public-url with the HTTPS address from your existing tunnel.");
   const publicUrl = connection.url;
   try {
     if (connection.remember && publicUrl) {
-      await mkdir6(dataDir, { recursive: true, mode: 448 });
-      await writeFile5(filename, JSON.stringify({ ...config, publicUrl }, null, 2) + "\n", {
+      await mkdir7(dataDir, { recursive: true, mode: 448 });
+      await writeFile6(filename, JSON.stringify({ ...config, publicUrl }, null, 2) + "\n", {
         mode: 384
       });
     }
     if (publicUrl) process.env.AGENTRIFIC_PUBLIC_URL = pairingOrigin(publicUrl);
+    else delete process.env.AGENTRIFIC_PUBLIC_URL;
     await init_index().then(() => index_exports);
+    if (connection.tunnel) {
+      const close = () => void connection.tunnel?.close();
+      process.once("SIGINT", close);
+      process.once("SIGTERM", close);
+    }
     if (interactive) startTerminal(dataDir, publicUrl, connection.tunnel);
   } catch (error) {
     await connection.tunnel?.close();
@@ -5899,7 +6370,7 @@ async function serviceCommand({ positionals, dataDir }) {
   return;
 }
 async function logsCommand({ dataDir }) {
-  const child = process.platform === "linux" ? spawn2("journalctl", ["--user", "-u", "agentrific.service", "-f"], { stdio: "inherit" }) : spawn2("tail", ["-F", path12.join(dataDir, "logs", "server.log")], { stdio: "inherit" });
+  const child = process.platform === "linux" ? spawn2("journalctl", ["--user", "-u", "agentrific.service", "-f"], { stdio: "inherit" }) : spawn2("tail", ["-F", path14.join(dataDir, "logs", "server.log")], { stdio: "inherit" });
   child.on("error", (error) => {
     console.error(error.message);
     process.exitCode = 1;
@@ -5933,11 +6404,11 @@ async function pairCommand({ values, dataDir, config }) {
   return;
 }
 async function maintenanceCommand({ values, positionals, dataDir }) {
-  const action = z19.enum(["enter", "resume", "drain"]).parse(positionals[1]);
+  const action = z21.enum(["enter", "resume", "drain"]).parse(positionals[1]);
   const result = await controlRequest(dataDir, {
     command: "maintenance",
     action,
-    timeoutMs: z19.coerce.number().int().min(0).max(6e4).parse(values["timeout-ms"] ?? 3e4)
+    timeoutMs: z21.coerce.number().int().min(0).max(6e4).parse(values["timeout-ms"] ?? 3e4)
   });
   console.log(JSON.stringify(result, null, 2));
   if (action === "drain" && "drained" in result && !result.drained) process.exitCode = 1;
@@ -5946,7 +6417,7 @@ async function maintenanceCommand({ values, positionals, dataDir }) {
 async function devicesCommand({ dataDir, command }) {
   console.log(
     JSON.stringify(
-      await controlRequest(dataDir, { command: z19.enum(["devices", "status"]).parse(command) }),
+      await controlRequest(dataDir, { command: z21.enum(["devices", "status"]).parse(command) }),
       null,
       2
     )
@@ -5954,7 +6425,7 @@ async function devicesCommand({ dataDir, command }) {
   return;
 }
 async function revokeCommand({ positionals, dataDir }) {
-  const id = z19.string().uuid().parse(positionals[1]);
+  const id = z21.string().uuid().parse(positionals[1]);
   console.log(JSON.stringify(await controlRequest(dataDir, { command: "revoke", id })));
   return;
 }