@agentrific/server 0.5.2 → 0.7.0

package/index.js

@@ -306,7 +306,7 @@ function registerPushRoutes(app2, push2, security2) {
 // src/index.ts
 import Fastify from "fastify";
 import pretty from "pino-pretty";
-import { styleText } from "node:util";
+import { styleText as styleText2 } from "node:util";
 import cors from "@fastify/cors";
 import multipart from "@fastify/multipart";
 
@@ -885,11 +885,11 @@ var Attachments = class extends Context.Service()(
 
 // src/index.ts
 import { randomUUID as randomUUID9 } from "node:crypto";
-import { execFile as execFile3 } from "node:child_process";
-import { promisify as promisify3 } from "node:util";
+import { execFile as execFile4 } from "node:child_process";
+import { promisify as promisify4 } from "node:util";
 import { realpath as realpath2 } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import path9 from "node:path";
+import { homedir as homedir4 } from "node:os";
+import path11 from "node:path";
 import { WebSocket } from "ws";
 
 // src/event-server.ts
@@ -983,6 +983,7 @@ function controlSocketPath(directory, uid = process.getuid?.()) {
 }
 
 // src/control.ts
+var ProviderSchema = z4.enum(["opentunnel", "tailscale", "cloudflared"]);
 var MaintenanceSchema = z4.object({
   active: z4.boolean(),
   drained: z4.boolean(),
@@ -991,6 +992,8 @@ var MaintenanceSchema = z4.object({
 var ControlStatusSchema = z4.object({
   serverId: z4.string().uuid(),
   publicUrl: z4.string().optional(),
+  phoneProvider: ProviderSchema.nullable().optional(),
+  phoneProgress: z4.string().nullable().optional(),
   localUrl: z4.string().optional(),
   serverVersion: z4.string().optional(),
   connectedDevices: z4.number().optional(),
@@ -1000,6 +1003,12 @@ var ControlStatusSchema = z4.object({
   maintenance: MaintenanceSchema.optional()
 });
 var ControlResultSchema = z4.union([
+  z4.object({
+    provider: ProviderSchema.nullable(),
+    publicUrl: z4.string().url().nullable(),
+    progress: z4.string().nullable().optional()
+  }),
+  z4.array(z4.object({ provider: ProviderSchema, available: z4.boolean(), reason: z4.string() })),
   z4.object({
     pairingId: z4.string(),
     pin: z4.string(),
@@ -1013,6 +1022,9 @@ var ControlResultSchema = z4.union([
   MaintenanceSchema
 ]);
 var ControlRequest = z4.discriminatedUnion("command", [
+  z4.object({ command: z4.literal("phone-options") }),
+  z4.object({ command: z4.literal("phone-start"), provider: ProviderSchema }),
+  z4.object({ command: z4.literal("phone-stop") }),
   z4.object({ command: z4.literal("pair") }),
   z4.object({ command: z4.literal("devices") }),
   z4.object({ command: z4.literal("status") }),
@@ -1065,7 +1077,7 @@ async function acquireServerLock(directory) {
       await unlink(filename);
   };
 }
-async function startControl(directory, security2, status, maintenance2, shutdown) {
+async function startControl(directory, security2, status, maintenance2, shutdown, phone2) {
   const filename = controlSocketPath(directory);
   const socketDirectory = path3.dirname(filename);
   await mkdir2(socketDirectory, { recursive: true, mode: 448 });
@@ -1092,6 +1104,29 @@ async function startControl(directory, security2, status, maintenance2, shutdown
           const request = ControlRequest.parse(JSON.parse(buffer.split("\n")[0]));
           let result;
           switch (request.command) {
+            case "phone-options":
+              if (!phone2) throw new Error("Phone connections are managed by the desktop app.");
+              socket.setTimeout(18e4);
+              result = await phone2.options();
+              break;
+            case "phone-start": {
+              if (!phone2) throw new Error("Phone connections are managed by the desktop app.");
+              maintenance2?.assertReady();
+              socket.setTimeout(18e4);
+              const abort = new AbortController();
+              const disconnected = () => abort.abort();
+              socket.once("close", disconnected);
+              try {
+                result = await phone2.start(request.provider, abort.signal);
+              } finally {
+                socket.removeListener("close", disconnected);
+              }
+              break;
+            }
+            case "phone-stop":
+              if (!phone2) throw new Error("Phone connections are managed by the desktop app.");
+              result = await phone2.close();
+              break;
             case "shutdown":
               if (!shutdown || !maintenance2?.status().drained)
                 throw new Error("Drain the server before shutdown");
@@ -1137,10 +1172,13 @@ async function startControl(directory, security2, status, maintenance2, shutdown
   };
 }
 
+// src/cli-output.ts
+import { styleText } from "node:util";
+
 // package.json
 var package_default = {
   name: "@agentrific/server",
-  version: "0.5.2",
+  version: "0.7.0",
   description: "Self-hosted control plane for long-running coding agents",
   keywords: [
     "agentrific",
@@ -1166,20 +1204,28 @@ var package_default = {
     registry: "https://registry.npmjs.org"
   },
   scripts: {
-    dev: "tsx watch src/index.ts",
+    dev: "node scripts/build-claude-bridge.mjs && tsx watch src/index.ts",
     start: "node dist/index.js",
     typecheck: "tsc --noEmit",
     build: "node scripts/build.mjs",
-    cli: "AGENTRIFIC_DATA_DIR=./data tsx src/cli.ts"
+    cli: "node scripts/build-claude-bridge.mjs && AGENTRIFIC_DATA_DIR=./data tsx src/cli.ts",
+    "build:claude": "node scripts/build-claude-bridge.mjs"
   },
   dependencies: {
+    "@anthropic-ai/claude-agent-sdk": "0.3.296",
+    "@anthropic-ai/sdk": "^0.124.0",
+    "@earendil-works/pi-ai": "1.0.0",
     "@earendil-works/pi-coding-agent": "1.0.0",
     "@fastify/cors": "^11.3.0",
     "@fastify/multipart": "^10.1.2",
     "@inquirer/select": "^5.2.5",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "cc-session-io": "^0.4.0",
+    "change-case": "^5.4.4",
     diff: "^9.0.0",
     effect: "4.0.0-rc.117",
     fastify: "^5.6.2",
+    "pi-claude-agent-sdk": "0.9.2",
     "pino-pretty": "^13.1.3",
     "qrcode-terminal": "^0.12.0",
     semver: "^7.8.5",
@@ -1190,6 +1236,7 @@ var package_default = {
   },
   devDependencies: {
     "@agentrific/contracts": "workspace:*",
+    "@agentrific/opentunnel-runtime": "workspace:*",
     "@jest/globals": "30.5.2",
     "@types/node": "^22.19.1",
     "@types/qrcode-terminal": "^0.12.2",
@@ -1204,6 +1251,13 @@ var package_default = {
 // src/version.ts
 var serverVersion = package_default.version;
 
+// src/cli-output.ts
+function printError(message) {
+  console.error(`
+  ${styleText(["bold", "red"], "Error")} ${message}
+`);
+}
+
 // src/pairing.ts
 function pairingOrigin(url) {
   const endpoint = new URL(url);
@@ -1278,17 +1332,17 @@ var ServerSecurity = class {
     if (!/^[a-f0-9]{64}$/.test(token)) return void 0;
     return Effect4.runSync(this.store.deviceForToken(digest(token)));
   }
-  ticket(token, path10) {
+  ticket(token, path12) {
     this.prune();
     if (!this.authenticate(token) || this.tickets.size >= 1e4) return void 0;
     const value = secret();
-    this.tickets.set(value, { tokenHash: digest(token), expiresAt: Date.now() + 6e4, path: path10 });
+    this.tickets.set(value, { tokenHash: digest(token), expiresAt: Date.now() + 6e4, path: path12 });
     return value;
   }
-  redeemTicket(value, path10, consume = true) {
+  redeemTicket(value, path12, consume = true) {
     this.prune();
     const ticket = this.tickets.get(value);
-    if (!ticket || ticket.path !== path10) return void 0;
+    if (!ticket || ticket.path !== path12) return void 0;
     if (consume) this.tickets.delete(value);
     return Effect4.runSync(this.store.deviceForToken(ticket.tokenHash));
   }
@@ -1301,19 +1355,19 @@ var ServerSecurity = class {
 };
 async function registerSecurity(app2, security2, version, allowedOrigins2) {
   app2.addHook("onRequest", async (request, reply) => {
-    const path10 = new URL(request.url, "http://localhost");
+    const path12 = new URL(request.url, "http://localhost");
     reply.header("Cache-Control", "no-store");
     if (request.method === "OPTIONS") return;
     if (request.headers.origin && !allowedOrigins2.includes(request.headers.origin))
       return reply.code(403).send({ error: "Browser origin is not allowed." });
-    if (path10.pathname === "/health" || path10.pathname === "/api/auth/pair" && request.method === "POST")
+    if (path12.pathname === "/health" || path12.pathname === "/api/auth/pair" && request.method === "POST")
       return;
     const authorization = request.headers.authorization ?? "";
     const token = authorization.startsWith("Bearer ") ? authorization.slice(7) : "";
-    const asset = request.method === "GET" && /^\/api\/projects\/[^/]+\/attachments\/[^/]+\/content$/.test(path10.pathname);
-    const ticket = path10.searchParams.get("ticket");
-    path10.searchParams.delete("ticket");
-    if (!security2.authenticate(token) && !(asset && ticket && security2.redeemTicket(ticket, path10.pathname + path10.search, false)))
+    const asset = request.method === "GET" && /^\/api\/projects\/[^/]+\/attachments\/[^/]+\/content$/.test(path12.pathname);
+    const ticket = path12.searchParams.get("ticket");
+    path12.searchParams.delete("ticket");
+    if (!security2.authenticate(token) && !(asset && ticket && security2.redeemTicket(ticket, path12.pathname + path12.search, false)))
       return reply.code(401).send({ error: "Pair this device with your server.", code: "UNAUTHORIZED" });
     if (!asset && request.headers["x-agentrific-protocol"] !== String(PROTOCOL_VERSION))
       return reply.code(409).send({
@@ -1378,6 +1432,478 @@ async function registerSecurity(app2, security2, version, allowedOrigins2) {
   });
 }
 
+// src/tunnels.ts
+import { spawn } from "node:child_process";
+import { access, stat as stat2 } from "node:fs/promises";
+import { constants } from "node:fs";
+import { homedir } from "node:os";
+import path4 from "node:path";
+import { z as z7 } from "zod";
+function signalChild(child, signal) {
+  if (!child.pid) return;
+  if (process.platform === "win32") {
+    child.kill(signal);
+    return;
+  }
+  try {
+    process.kill(-child.pid, signal);
+  } catch (error) {
+    if (!z7.object({ code: z7.literal("ESRCH") }).safeParse(error).success) child.kill(signal);
+  }
+}
+function execute(file, args, timeoutMs, env = process.env) {
+  return new Promise((resolve2, reject) => {
+    const child = spawn(file, args, {
+      env,
+      detached: process.platform !== "win32",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    const timeout = setTimeout(() => {
+      signalChild(child, "SIGKILL");
+      reject(new Error("Command probe timed out."));
+    }, timeoutMs);
+    child.stdout?.on("data", (data) => {
+      stdout += data.toString();
+      checkOutput();
+    });
+    child.stderr?.on("data", (data) => {
+      stderr += data.toString();
+      checkOutput();
+    });
+    child.once("error", (error) => {
+      clearTimeout(timeout);
+      reject(error);
+    });
+    child.once("exit", () => signalChild(child, "SIGKILL"));
+    child.once("close", (code) => {
+      clearTimeout(timeout);
+      if (code !== 0) reject(new Error("Command probe failed."));
+      else resolve2({ stdout, stderr });
+    });
+    function checkOutput() {
+      if (stdout.length + stderr.length <= 1048576) return;
+      signalChild(child, "SIGKILL");
+      reject(new Error("Command probe output exceeded its limit."));
+    }
+  });
+}
+async function findExecutable(name) {
+  const candidates = (process.env.PATH ?? "").split(path4.delimiter).map((directory) => path4.resolve(directory, name));
+  if (process.platform === "darwin") {
+    candidates.push(`/opt/homebrew/bin/${name}`, `/usr/local/bin/${name}`);
+    if (name === "tailscale")
+      candidates.push("/Applications/Tailscale.app/Contents/MacOS/Tailscale");
+  }
+  for (const candidate of candidates) {
+    try {
+      await access(candidate, constants.X_OK);
+      if ((await stat2(candidate)).isFile()) return candidate;
+    } catch {
+      continue;
+    }
+  }
+  return void 0;
+}
+var TcpConfig = z7.object({ TCP: z7.record(z7.string(), z7.unknown()).optional() });
+var ServeConfig = TcpConfig.extend({
+  Foreground: z7.record(z7.string(), TcpConfig).optional()
+});
+async function probeTailscale() {
+  const option = { provider: "tailscale", available: false, reason: "Not installed" };
+  const executable = await findExecutable("tailscale");
+  if (!executable) return option;
+  option.executable = executable;
+  const env = { ...process.env, TAILSCALE_BE_CLI: "1" };
+  try {
+    const response = await execute(executable, ["status", "--json"], 3e3, env);
+    const status = z7.object({
+      BackendState: z7.string(),
+      CertDomains: z7.array(z7.string()).optional(),
+      Self: z7.object({ DNSName: z7.string() }).nullable().optional()
+    }).parse(JSON.parse(response.stdout));
+    if (status.BackendState !== "Running")
+      return { ...option, reason: "Installed \xB7 connect Tailscale first" };
+    const dns = status.Self?.DNSName.replace(/\.$/, "");
+    if (!dns || !status.CertDomains?.includes(dns))
+      return { ...option, reason: "Enable HTTPS certificates in your tailnet first" };
+    const help = await execute(executable, ["serve", "--help"], 2e3, env);
+    if (!`${help.stdout}${help.stderr}`.includes("--https"))
+      return { ...option, reason: "Update Tailscale to use foreground HTTPS Serve" };
+    const responseConfig = await execute(executable, ["serve", "status", "--json"], 3e3, env);
+    const config = ServeConfig.parse(JSON.parse(responseConfig.stdout) ?? {});
+    const occupied = new Set(Object.keys(config.TCP ?? {}));
+    for (const foreground of Object.values(config.Foreground ?? {}))
+      for (const port3 of Object.keys(foreground.TCP ?? {})) occupied.add(port3);
+    const port2 = [443, ...Array.from({ length: 10 }, (_, index) => 8443 + index)].find(
+      (candidate) => !occupied.has(String(candidate))
+    );
+    if (!port2) return { ...option, reason: "HTTPS Serve ports are in use \xB7 paste an existing URL" };
+    return {
+      ...option,
+      available: true,
+      reason: "Private to your tailnet \xB7 Tailscale required on your phone",
+      publicUrl: new URL(`https://${dns}${port2 === 443 ? "" : `:${port2}`}`).origin,
+      httpsPort: port2
+    };
+  } catch {
+    return { ...option, reason: "Installed \xB7 could not verify daemon or Serve access" };
+  }
+}
+async function probeCloudflared(home) {
+  const option = {
+    provider: "cloudflared",
+    available: false,
+    reason: "Not installed"
+  };
+  const executable = await findExecutable("cloudflared");
+  if (!executable) return option;
+  option.executable = executable;
+  try {
+    await execute(executable, ["--version"], 2e3);
+    const help = await execute(executable, ["tunnel", "--help"], 2e3);
+    if (!`${help.stdout}${help.stderr}`.includes("--url"))
+      return { ...option, reason: "Installed \xB7 this version does not support Quick Tunnels" };
+  } catch {
+    return { ...option, reason: "Installed \xB7 command probe failed or timed out" };
+  }
+  const directories = [
+    path4.join(home, ".cloudflared"),
+    path4.join(home, ".cloudflare-warp"),
+    path4.join(home, "cloudflare-warp"),
+    "/etc/cloudflared",
+    "/usr/local/etc/cloudflared"
+  ];
+  const configurations = await Promise.all(
+    directories.flatMap(
+      (directory) => ["config.yml", "config.yaml"].map(
+        async (name) => access(path4.join(directory, name), constants.F_OK).then(
+          () => true,
+          () => false
+        )
+      )
+    )
+  );
+  if (configurations.some(Boolean))
+    return { ...option, reason: "Existing tunnel configuration \xB7 paste its HTTPS URL" };
+  return { ...option, available: true, reason: "Temporary public HTTPS URL \xB7 changes each start" };
+}
+async function detectTunnels(home = homedir()) {
+  return Promise.all([probeTailscale(), probeCloudflared(home)]);
+}
+var ManagedTunnel = class {
+  constructor(option, disconnected = () => {
+  }) {
+    this.option = option;
+    this.disconnected = disconnected;
+  }
+  option;
+  disconnected;
+  child;
+  stopping = false;
+  connected = false;
+  closing;
+  running() {
+    return this.connected && !this.stopping;
+  }
+  stopOnSignal = () => {
+    void this.close();
+  };
+  stopOnExit = () => {
+    if (this.child) signalChild(this.child, "SIGKILL");
+  };
+  async start(origin, signal) {
+    signal?.throwIfAborted();
+    if (!this.option.available) throw new Error(this.option.reason);
+    const tailscale = this.option.provider === "tailscale";
+    const child = spawn(
+      this.option.executable ?? this.option.provider,
+      tailscale ? ["serve", "--bg=false", `--https=${this.option.httpsPort}`, origin] : ["tunnel", "--no-autoupdate", "--url", origin],
+      {
+        stdio: ["ignore", "pipe", "pipe"],
+        detached: process.platform !== "win32",
+        env: tailscale ? { ...process.env, TAILSCALE_BE_CLI: "1" } : process.env
+      }
+    );
+    this.child = child;
+    process.once("SIGINT", this.stopOnSignal);
+    process.once("SIGTERM", this.stopOnSignal);
+    process.once("exit", this.stopOnExit);
+    return new Promise((resolve2, reject) => {
+      let output = "";
+      let address;
+      let settled = false;
+      const abort = () => fail("Tunnel startup canceled.");
+      const timeout = setTimeout(
+        () => fail("Tunnel startup timed out. Check your connection or paste an existing HTTPS URL."),
+        45e3
+      );
+      const fail = (message) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timeout);
+        signal?.removeEventListener("abort", abort);
+        void this.close();
+        reject(new Error(message));
+      };
+      const read = (data) => {
+        output = `${output}${data.toString()}`.slice(-65536);
+        address = tailscale ? this.option.publicUrl : output.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com\b/)?.[0];
+        const ready = tailscale ? Boolean(
+          address && output.includes(address) && output.includes("Available within your tailnet")
+        ) : output.includes("Registered tunnel connection");
+        if (settled || !address || !ready) return;
+        settled = true;
+        this.connected = true;
+        clearTimeout(timeout);
+        signal?.removeEventListener("abort", abort);
+        resolve2(address);
+      };
+      child.stdout?.on("data", read);
+      child.stderr?.on("data", read);
+      signal?.addEventListener("abort", abort, { once: true });
+      child.once(
+        "error",
+        () => fail(`${this.option.provider} could not start. Check the installation and permissions.`)
+      );
+      child.once("exit", () => signalChild(child, "SIGTERM"));
+      child.once("close", (code) => {
+        const unexpected = this.connected && !this.stopping;
+        this.connected = false;
+        process.removeListener("SIGINT", this.stopOnSignal);
+        process.removeListener("SIGTERM", this.stopOnSignal);
+        process.removeListener("exit", this.stopOnExit);
+        fail(
+          `${this.option.provider} exited (${code ?? "signal"}). Check tunnel access or paste an existing HTTPS URL.`
+        );
+        if (unexpected) {
+          this.disconnected();
+          printError(
+            "The managed tunnel stopped. Restart the server to reconnect your phone; local work can continue."
+          );
+        }
+      });
+    });
+  }
+  close() {
+    this.stopping = true;
+    const child = this.child;
+    if (!child?.pid || child.exitCode !== null || child.signalCode !== null)
+      return Promise.resolve();
+    this.closing ??= new Promise((resolve2) => {
+      const timeout = setTimeout(() => signalChild(child, "SIGKILL"), 2e3);
+      child.once("close", () => {
+        clearTimeout(timeout);
+        resolve2();
+      });
+      signalChild(child, "SIGTERM");
+    });
+    return this.closing;
+  }
+};
+
+// src/opentunnel.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { chmod as chmod2, mkdir as mkdir3, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
+import path5 from "node:path";
+import { z as z8 } from "zod";
+import {
+  create,
+  OpenTunnelStorage
+} from "./opentunnel-sdk.js";
+var OpenTunnel = class {
+  constructor(directory, disconnected = () => {
+  }, makeClient = create) {
+    this.directory = directory;
+    this.disconnected = disconnected;
+    this.makeClient = makeClient;
+  }
+  directory;
+  disconnected;
+  makeClient;
+  client;
+  connection;
+  stopping = false;
+  stage = "reading-identity";
+  progress() {
+    return this.connection?.status().state ?? this.stage;
+  }
+  running() {
+    return this.connection?.status().state === "connected" && !this.stopping;
+  }
+  async start(origin, signal) {
+    const endpoint = new URL(origin);
+    if (!["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname))
+      throw new Error("OpenTunnel must forward to the local loopback server.");
+    await mkdir3(this.directory, { recursive: true, mode: 448 });
+    await chmod2(this.directory, 448);
+    const routeFile = path5.join(this.directory, "route.json");
+    let route;
+    try {
+      route = z8.string().regex(/^[a-f0-9]{16}$/).parse(JSON.parse(await readFile3(routeFile, "utf8")));
+    } catch (error) {
+      if (!z8.object({ code: z8.literal("ENOENT") }).safeParse(error).success) throw error;
+      route = randomBytes2(8).toString("hex");
+      await writeFile2(routeFile, JSON.stringify(route), { flag: "wx", mode: 384 });
+    }
+    this.stopping = false;
+    this.client = this.makeClient({
+      store: OpenTunnelStorage.xdg({ env: { XDG_DATA_HOME: this.directory } })
+    });
+    const abort = AbortSignal.any([
+      signal ?? new AbortController().signal,
+      AbortSignal.timeout(12e4)
+    ]);
+    let canceled = () => {
+    };
+    try {
+      const client = this.client;
+      this.stage = "reading-identity";
+      const connecting = (async () => {
+        const options = {
+          profile: "agentrific",
+          onProgress: (stage) => {
+            this.stage = stage;
+          }
+        };
+        const identity2 = await client.tunnel.get(options);
+        abort.throwIfAborted();
+        if (!identity2) {
+          const resumed = await client.tunnel.resume(options);
+          abort.throwIfAborted();
+          if (!resumed) await client.tunnel.create(options);
+        }
+        abort.throwIfAborted();
+        this.stage = "connecting";
+        return client.tunnel.connect({
+          profile: "agentrific",
+          routes: {
+            [route]: `${endpoint.hostname === "[::1]" ? "[::1]" : "127.0.0.1"}:${endpoint.port || "80"}`
+          },
+          signal
+        });
+      })();
+      const cancellation = new Promise((_resolve, reject) => {
+        canceled = () => reject(new Error("OpenTunnel connection canceled or timed out."));
+        abort.addEventListener("abort", canceled, { once: true });
+        if (abort.aborted) canceled();
+      });
+      const connection = await Promise.race([connecting, cancellation]);
+      this.connection = connection;
+      void connection.closed.then(() => {
+        if (!this.stopping) this.disconnected();
+      }).catch(() => {
+        if (!this.stopping) this.disconnected();
+      });
+      return `https://${route}.${connection.tunnel.hostname}`;
+    } catch (error) {
+      await this.close();
+      throw error;
+    } finally {
+      abort.removeEventListener("abort", canceled);
+    }
+  }
+  async close() {
+    this.stopping = true;
+    await this.connection?.close();
+    await this.client?.dispose();
+    this.connection = void 0;
+    this.client = void 0;
+  }
+};
+
+// src/desktop-phone.ts
+var DesktopPhoneConnection = class {
+  constructor(origin, changed, directory, detect = async () => [
+    { provider: "opentunnel", available: true, reason: "Built in \xB7 stable public HTTPS address" },
+    ...await detectTunnels()
+  ], create2 = (option, disconnected) => option.provider === "opentunnel" ? new OpenTunnel(directory, disconnected) : new ManagedTunnel({ ...option, provider: option.provider }, disconnected)) {
+    this.origin = origin;
+    this.changed = changed;
+    this.directory = directory;
+    this.detect = detect;
+    this.create = create2;
+  }
+  origin;
+  changed;
+  directory;
+  detect;
+  create;
+  tunnel;
+  provider = null;
+  publicUrl = null;
+  pending = Promise.resolve();
+  snapshot() {
+    return {
+      provider: this.provider,
+      publicUrl: this.publicUrl,
+      progress: this.tunnel?.progress?.() ?? null
+    };
+  }
+  async options() {
+    return (await this.detect()).map(({ provider, available, reason }) => ({
+      provider,
+      available,
+      reason
+    }));
+  }
+  serialize(operation) {
+    const result = this.pending.then(operation);
+    this.pending = result.then(
+      () => {
+      },
+      () => {
+      }
+    );
+    return result;
+  }
+  start(provider, signal) {
+    return this.serialize(async () => {
+      signal?.throwIfAborted();
+      if (this.tunnel && this.publicUrl && this.provider === provider) return this.snapshot();
+      if (this.tunnel)
+        throw new Error("Disconnect the current phone connection before changing providers.");
+      const option = (await this.detect()).find((candidate) => candidate.provider === provider);
+      if (!option?.available) throw new Error(option?.reason || "Tunnel provider unavailable.");
+      let tunnel;
+      tunnel = this.create(option, () => {
+        if (this.tunnel !== tunnel) return;
+        void tunnel.close().catch(() => {
+        });
+        this.tunnel = void 0;
+        this.provider = null;
+        this.publicUrl = null;
+        this.changed(null);
+      });
+      this.tunnel = tunnel;
+      try {
+        const url = await tunnel.start(this.origin(), signal);
+        signal?.throwIfAborted();
+        this.provider = provider;
+        this.publicUrl = url;
+        this.changed(url);
+        return this.snapshot();
+      } catch (error) {
+        await tunnel.close();
+        this.tunnel = void 0;
+        this.changed(null);
+        throw error;
+      }
+    });
+  }
+  close() {
+    return this.serialize(async () => {
+      await this.tunnel?.close();
+      this.tunnel = void 0;
+      this.provider = null;
+      this.publicUrl = null;
+      this.changed(null);
+      return this.snapshot();
+    });
+  }
+};
+
 // src/maintenance.ts
 var MaintenanceError = class extends Error {
   statusCode = 503;
@@ -1419,9 +1945,9 @@ var Maintenance = class {
   }
   attach(app2) {
     app2.addHook("onRequest", async (request, reply) => {
-      const path10 = request.url.split("?")[0];
+      const path12 = request.url.split("?")[0];
       if (["GET", "HEAD", "OPTIONS"].includes(request.method)) return;
-      const allowed = path10.startsWith("/api/auth/") || /^\/api\/sessions\/[^/]+\/stop$/.test(path10);
+      const allowed = path12.startsWith("/api/auth/") || /^\/api\/sessions\/[^/]+\/stop$/.test(path12);
       if (this.paused && !allowed)
         return reply.code(503).send({ code: "MAINTENANCE", error: new MaintenanceError().message });
       this.requests.add(request.id);
@@ -1434,10 +1960,10 @@ var Maintenance = class {
 
 // src/updates.ts
 import semver from "semver";
-import { z as z7 } from "zod";
+import { z as z9 } from "zod";
 import { Effect as Effect5 } from "effect";
-var RegistryRelease = z7.object({
-  version: z7.string().refine((value) => semver.valid(value) !== null)
+var RegistryRelease = z9.object({
+  version: z9.string().refine((value) => semver.valid(value) !== null)
 });
 async function checkForUpdates() {
   const response = await fetch("https://registry.npmjs.org/@agentrific%2Fserver/latest", {
@@ -1527,7 +2053,7 @@ var UpdateDiscovery = class {
 
 // src/index.ts
 import { Effect as Effect17, ManagedRuntime } from "effect";
-import { z as z17 } from "zod";
+import { z as z20 } from "zod";
 
 // src/automation.ts
 import { Effect as Effect7 } from "effect";
@@ -1762,7 +2288,7 @@ var AutomationCoordinator = class {
 };
 
 // src/runtime.ts
-import path4 from "node:path";
+import path6 from "node:path";
 import { randomUUID as randomUUID4 } from "node:crypto";
 
 // src/git-flow.ts
@@ -1827,8 +2353,8 @@ var AgentController = class {
       const agent = yield* Effect8.tryPromise({
         try: () => this.factory.open(
           session.id,
-          session.workspacePath ?? path4.join(this.worktreesRoot, session.id),
-          path4.join(this.sessionsRoot, session.id),
+          session.workspacePath ?? path6.join(this.worktreesRoot, session.id),
+          path6.join(this.sessionsRoot, session.id),
           session.model,
           session
         ),
@@ -2063,7 +2589,7 @@ var AgentSessions = class extends Context2.Service()(
 
 // src/delivery.ts
 import { Effect as Effect9 } from "effect";
-import { z as z9 } from "zod";
+import { z as z11 } from "zod";
 
 // src/workflow-command.ts
 import { execFile } from "node:child_process";
@@ -2111,12 +2637,12 @@ function workflowError(error) {
 }
 
 // src/workflow-schema.ts
-import { z as z8 } from "zod";
-var DeliveryJobSchema = z8.object({
-  kind: z8.literal("delivery"),
-  sessionId: z8.string(),
+import { z as z10 } from "zod";
+var DeliveryJobSchema = z10.object({
+  kind: z10.literal("delivery"),
+  sessionId: z10.string(),
   request: DeliveryRequestSchema,
-  phase: z8.enum([
+  phase: z10.enum([
     "validating",
     "drafting",
     "committing",
@@ -2126,25 +2652,25 @@ var DeliveryJobSchema = z8.object({
     "opening_pr",
     "delivered"
   ]),
-  attempt: z8.number().int().positive(),
-  commitSha: z8.string().optional(),
-  title: z8.string(),
-  body: z8.string(),
-  logs: z8.string().default(""),
-  failed: z8.boolean().default(false),
-  result: z8.enum(["merged", "pr_opened", "no_changes"]).optional(),
-  url: z8.string().optional(),
-  message: z8.string().optional()
+  attempt: z10.number().int().positive(),
+  commitSha: z10.string().optional(),
+  title: z10.string(),
+  body: z10.string(),
+  logs: z10.string().default(""),
+  failed: z10.boolean().default(false),
+  result: z10.enum(["merged", "pr_opened", "no_changes"]).optional(),
+  url: z10.string().optional(),
+  message: z10.string().optional()
 });
-var PreparationJobSchema = z8.object({
-  kind: z8.literal("preparation"),
-  sessionId: z8.string(),
-  projectPath: z8.string(),
+var PreparationJobSchema = z10.object({
+  kind: z10.literal("preparation"),
+  sessionId: z10.string(),
+  projectPath: z10.string(),
   input: CreateSessionSchema,
-  stage: z8.enum(["creating", "installing", "ready", "failed"]),
-  logs: z8.string().default("")
+  stage: z10.enum(["creating", "installing", "ready", "failed"]),
+  logs: z10.string().default("")
 });
-var WorkflowJobSchema = z8.discriminatedUnion("kind", [
+var WorkflowJobSchema = z10.discriminatedUnion("kind", [
   DeliveryJobSchema,
   PreparationJobSchema
 ]);
@@ -2440,11 +2966,11 @@ ${workflowError(error instanceof Error ? error : String(error))}`
             "--json",
             "url,state,headRefOid"
           ]);
-          const prs = z9.array(
-            z9.object({
-              url: z9.string().url(),
-              state: z9.string(),
-              headRefOid: z9.string().optional()
+          const prs = z11.array(
+            z11.object({
+              url: z11.string().url(),
+              state: z11.string(),
+              headRefOid: z11.string().optional()
             })
           ).parse(JSON.parse(existing));
           const open = prs.find(
@@ -2485,10 +3011,10 @@ ${workflowError(error instanceof Error ? error : String(error))}`
 };
 
 // src/preparation.ts
-import { mkdir as mkdir3, readFile as readFile3 } from "node:fs/promises";
-import path5 from "node:path";
+import { mkdir as mkdir4, readFile as readFile4 } from "node:fs/promises";
+import path7 from "node:path";
 import { Effect as Effect10 } from "effect";
-import { z as z10 } from "zod";
+import { z as z12 } from "zod";
 var PreparationCoordinator = class {
   constructor(store2, options) {
     this.store = store2;
@@ -2582,7 +3108,7 @@ ${logs}` : ""}`);
     const workspace = session.workspacePath;
     if (branchAtWorkspace !== void 0)
       throw new Error("The run workspace already exists on a different branch.");
-    await mkdir3(path5.dirname(workspace), { recursive: true });
+    await mkdir4(path7.dirname(workspace), { recursive: true });
     try {
       await command(
         projectPath,
@@ -2602,12 +3128,12 @@ ${logs}` : ""}`);
     }
   }
   async install(workspace, command) {
-    const packageFile = await readFile3(path5.join(workspace, "package.json"), "utf8").catch(
+    const packageFile = await readFile4(path7.join(workspace, "package.json"), "utf8").catch(
       () => void 0
     );
     if (!packageFile) return;
-    const metadata = z10.object({ packageManager: z10.string().optional() }).parse(JSON.parse(packageFile));
-    const has = async (name) => readFile3(path5.join(workspace, name)).then(
+    const metadata = z12.object({ packageManager: z12.string().optional() }).parse(JSON.parse(packageFile));
+    const has = async (name) => readFile4(path7.join(workspace, name)).then(
       () => true,
       () => false
     );
@@ -2688,19 +3214,22 @@ ${logs}` : ""}`);
 
 // src/delivery-writer.ts
 import { createAgentSession, SessionManager } from "@earendil-works/pi-coding-agent";
-import { z as z11 } from "zod";
-var DraftSchema = z11.object({ title: z11.string().trim().min(1).max(120), body: z11.string().trim().min(1).max(1e4) }).strict();
+import { z as z13 } from "zod";
+var DraftSchema = z13.object({ title: z13.string().trim().min(1).max(120), body: z13.string().trim().min(1).max(1e4) }).strict();
 function deliveryWriter(models2, createSession = createAgentSession) {
   return async (run, input, diff, signal) => {
     signal?.throwIfAborted();
+    const selected = run.model ?? await models2.defaultReference();
+    const sessionOptions = await models2.sessionOptions(run.workspacePath);
     const { session } = await createSession({
       cwd: run.workspacePath,
-      model: await models2.resolve(run.model ?? await models2.defaultReference()),
-      modelRuntime: models2.runtime,
+      model: await models2.resolve(selected),
+      ...sessionOptions,
       sessionManager: SessionManager.inMemory(),
       tools: [],
       noTools: "all"
     });
+    if (sessionOptions.resourceLoader) await session.bindExtensions({});
     const timer = setTimeout(() => {
       void session.abort();
     }, 6e4);
@@ -2730,6 +3259,103 @@ ${diff}`
 // src/index.ts
 import { ModelRuntime } from "@earendil-works/pi-coding-agent";
 
+// src/claude-code.ts
+import { execFile as execFile2 } from "node:child_process";
+import { homedir as homedir2 } from "node:os";
+import { join as join2 } from "node:path";
+import { promisify as promisify2 } from "node:util";
+import { z as z14 } from "zod";
+import {
+  createAgentSessionServices
+} from "@earendil-works/pi-coding-agent";
+var claudePlatform = "claude-bridge";
+var execute2 = promisify2(execFile2);
+var AuthStatusSchema = z14.object({ loggedIn: z14.boolean() });
+async function discoverClaudeCode() {
+  if (process.env.AGENTRIFIC_CLAUDE_CODE === "off") return;
+  const candidates = [
+    "claude",
+    join2(homedir2(), ".local/bin/claude"),
+    join2(homedir2(), ".claude/local/claude")
+  ];
+  for (const executable of candidates) {
+    try {
+      await execute2(executable, ["--version"], { timeout: 5e3, maxBuffer: 64 * 1024 });
+    } catch {
+      continue;
+    }
+    try {
+      const { stdout } = await execute2(executable, ["auth", "status", "--json"], {
+        timeout: 5e3,
+        maxBuffer: 64 * 1024
+      });
+      const status = AuthStatusSchema.parse(JSON.parse(stdout));
+      return { executable, ready: status.loggedIn };
+    } catch {
+      return { executable, ready: false };
+    }
+  }
+}
+var ClaudeCode = class {
+  constructor(probe = discoverClaudeCode, query) {
+    this.probe = probe;
+    this.query = query;
+  }
+  probe;
+  query;
+  installation;
+  registered = false;
+  get ready() {
+    return this.installation?.ready === true;
+  }
+  get warning() {
+    return this.installation && !this.ready ? "Claude Code is installed but its login could not be verified. Run claude auth login as the server user, then refresh the model list." : null;
+  }
+  async refresh(runtime2) {
+    this.installation = await this.probe();
+    if (this.installation && !this.registered) {
+      await this.services(process.cwd(), runtime2);
+      this.registered = true;
+    }
+  }
+  async services(cwd, modelRuntime2) {
+    const module = await import(new URL("./claude-bridge.js", import.meta.url).href);
+    const extension = module.createClaudeExtension(this.query);
+    const services = await createAgentSessionServices({
+      cwd,
+      modelRuntime: modelRuntime2,
+      resourceLoaderOptions: {
+        // Match Pipeline: do not execute unrelated global Pi extensions.
+        noExtensions: true,
+        extensionFactories: [
+          {
+            name: "agentrific-claude-code",
+            factory: (pi) => extension({
+              ...pi,
+              // SAFETY: The pinned bridge uses only the name/config registration overload.
+              registerProvider: ((id, config) => pi.registerProvider(id, {
+                ...config,
+                // Bind the working directory to this provider,
+                // without changing the process cwd or global Claude configuration.
+                streamSimple: config.streamSimple && ((model, context, options) => {
+                  const request = { ...options, cwd };
+                  return config.streamSimple(model, context, request);
+                })
+              }))
+            })
+          }
+        ]
+      }
+    });
+    const errors = [
+      ...services.diagnostics.filter((item) => item.type === "error").map((item) => item.message),
+      ...services.resourceLoader.getExtensions().errors.map((item) => item.error)
+    ];
+    if (errors.length) throw new Error(errors.join("\n"));
+    return services;
+  }
+};
+
 // src/models.ts
 import { Effect as Effect11 } from "effect";
 var legacyModel = { platformId: "openai-codex", modelId: "gpt-6-luna" };
@@ -2748,12 +3374,14 @@ var makers = [
   { id: "amazon", name: "Amazon", pattern: /amazon\.nova|nova-/i }
 ];
 var ServerModels = class {
-  constructor(runtime2, store2) {
+  constructor(runtime2, store2, claude) {
     this.runtime = runtime2;
     this.store = store2;
+    this.claude = claude;
   }
   runtime;
   store;
+  claude;
   refreshing;
   refreshedAt = (/* @__PURE__ */ new Date()).toISOString();
   warning = null;
@@ -2775,18 +3403,20 @@ var ServerModels = class {
       platformId,
       modelId,
       name: model?.name ?? modelId,
-      platformName: this.runtime.getProvider(platformId)?.name ?? platformId,
+      platformName: platformId === claudePlatform ? "Claude Code" : this.runtime.getProvider(platformId)?.name ?? platformId,
       providerId: namespace === "openrouter" ? "unspecified" : maker?.id ?? namespace ?? "unspecified",
       providerName: namespace === "openrouter" ? "Other / custom" : maker?.name ?? publisherName ?? "Other / custom"
     };
   }
   async refresh(network) {
     if (!this.refreshing) {
-      this.refreshing = this.runtime.refresh({
-        allowNetwork: network,
-        force: network,
-        signal: AbortSignal.timeout(15e3)
-      }).then((result) => {
+      this.refreshing = Promise.resolve(this.claude?.refresh(this.runtime)).then(
+        () => this.runtime.refresh({
+          allowNetwork: network,
+          force: network,
+          signal: AbortSignal.timeout(15e3)
+        })
+      ).then((result) => {
         this.refreshedAt = (/* @__PURE__ */ new Date()).toISOString();
         this.warning = result.aborted || result.errors.size || this.runtime.getError() ? "Some providers could not refresh. Showing the catalogue currently available on this server." : null;
       }).finally(() => {
@@ -2796,7 +3426,10 @@ var ServerModels = class {
     await this.refreshing;
   }
   async defaultReference() {
-    return await Effect11.runPromise(this.store.defaultModel()) ?? legacyModel;
+    const saved = await Effect11.runPromise(this.store.defaultModel());
+    if (saved) return saved;
+    const preferred = this.claude?.ready ? this.runtime.getModels().find((model) => model.provider === claudePlatform && /sonnet/i.test(model.id)) : void 0;
+    return preferred ? { platformId: preferred.provider, modelId: preferred.id } : legacyModel;
   }
   async defaultIdentity() {
     const selected = await this.defaultReference();
@@ -2809,17 +3442,24 @@ var ServerModels = class {
     return {
       models: this.runtime.getModels().map((model) => ({
         ...this.identity(model.provider, model.id),
-        available: available.has(`${model.provider}\0${model.id}`),
+        available: available.has(`${model.provider}\0${model.id}`) && (model.provider !== claudePlatform || this.claude?.ready === true),
         reasoning: model.reasoning,
         input: model.input,
         contextWindow: model.contextWindow
       })),
       defaultModel: await this.defaultIdentity(),
       refreshedAt: this.refreshedAt,
-      warning: this.warning
+      warning: this.claude?.warning ?? this.warning
     };
   }
   async resolve(reference) {
+    if (reference.platformId === claudePlatform && this.claude) {
+      await this.claude.refresh(this.runtime);
+      if (!this.claude.ready)
+        throw new Error(
+          this.claude.warning ?? "Claude Code is unavailable on this server. Install it and run claude auth login as the server user."
+        );
+    }
     const available = await this.runtime.getAvailable(reference.platformId, {
       signal: AbortSignal.timeout(1e4)
     });
@@ -2830,6 +3470,17 @@ var ServerModels = class {
       );
     return model;
   }
+  async sessionOptions(cwd = process.cwd()) {
+    if (this.claude && this.runtime.getProvider(claudePlatform)) {
+      const services = await this.claude.services(cwd);
+      return {
+        modelRuntime: services.modelRuntime,
+        resourceLoader: services.resourceLoader,
+        settingsManager: services.settingsManager
+      };
+    }
+    return { modelRuntime: this.runtime };
+  }
   async setDefault(reference) {
     await this.resolve(reference);
     await Effect11.runPromise(this.store.setDefaultModel(reference));
@@ -2844,7 +3495,7 @@ import {
   createAgentSession as createAgentSession2,
   SessionManager as SessionManager2
 } from "@earendil-works/pi-coding-agent";
-import { z as z13 } from "zod";
+import { z as z16 } from "zod";
 
 // src/delivery-tool.ts
 import { defineTool } from "@earendil-works/pi-coding-agent";
@@ -2881,23 +3532,23 @@ function deliveryTool(sessionId, delivery2) {
 // src/file-change.ts
 import { createWriteToolDefinition, defineTool as defineTool2 } from "@earendil-works/pi-coding-agent";
 import { createTwoFilesPatch } from "diff";
-import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile2 } from "node:fs/promises";
-import { z as z12 } from "zod";
+import { mkdir as mkdir5, readFile as readFile5, writeFile as writeFile3 } from "node:fs/promises";
+import { z as z15 } from "zod";
 var previewLimit = 256e3;
 function boundFileChange(change) {
   if ((change.patch?.length ?? 0) + (change.content?.length ?? 0) > previewLimit)
     return { path: change.path, omitted: true };
   return change;
 }
-var EditResultSchema = z12.object({
-  details: z12.object({ patch: z12.string().optional(), fileChange: FileChangeSchema.optional() }).optional()
+var EditResultSchema = z15.object({
+  details: z15.object({ patch: z15.string().optional(), fileChange: FileChangeSchema.optional() }).optional()
 });
-function completedFileChange(result, path10) {
+function completedFileChange(result, path12) {
   const parsed = EditResultSchema.safeParse(result);
   if (!parsed.success) return;
   const details = parsed.data.details;
   if (details?.fileChange) return boundFileChange(details.fileChange);
-  if (path10 && details?.patch) return boundFileChange({ path: path10, patch: details.patch });
+  if (path12 && details?.patch) return boundFileChange({ path: path12, patch: details.patch });
 }
 function fileWriteTool(cwd) {
   const base = createWriteToolDefinition(cwd);
@@ -2914,16 +3565,16 @@ function fileWriteTool(cwd) {
       const tool = createWriteToolDefinition(cwd, {
         operations: {
           mkdir: async (dir) => {
-            await mkdir4(dir, { recursive: true });
+            await mkdir5(dir, { recursive: true });
           },
           // Pi invokes this inside its per-file mutation queue, so the snapshot
           // and write cannot race another built-in edit/write on the same file.
-          writeFile: async (path10, content) => {
-            const previous = await readFile4(path10, "utf8").catch((error) => {
+          writeFile: async (path12, content) => {
+            const previous = await readFile5(path12, "utf8").catch((error) => {
               if (error.code === "ENOENT") return void 0;
               throw error;
             });
-            await writeFile2(path10, content, "utf8");
+            await writeFile3(path12, content, "utf8");
             fileChange = boundFileChange(
               previous === void 0 ? { path: args.path, content } : {
                 path: args.path,
@@ -2940,8 +3591,8 @@ function fileWriteTool(cwd) {
 }
 
 // src/pi.ts
-var ToolResultSchema = z13.object({
-  content: z13.array(z13.object({ type: z13.string(), text: z13.string().optional() })).optional()
+var ToolResultSchema = z16.object({
+  content: z16.array(z16.object({ type: z16.string(), text: z16.string().optional() })).optional()
 }).passthrough();
 var boundedJson = (value, limit) => {
   let text;
@@ -2961,16 +3612,18 @@ function createPiFactory(files, models2, delivery2, createSession = createAgentS
   return {
     async open(sessionId, cwd, sessionDirectory, selected = legacyModel, run) {
       const model = await models2.resolve(selected);
+      const sessionOptions = await models2.sessionOptions(cwd);
       const { session } = await createSession({
         cwd,
         model,
-        modelRuntime: models2.runtime,
+        ...sessionOptions,
         sessionManager: SessionManager2.continueRecent(cwd, sessionDirectory),
         customTools: [
           fileWriteTool(cwd),
           ...run?.gitFlow && delivery2 ? [deliveryTool(sessionId, delivery2)] : []
         ]
       });
+      if (sessionOptions.resourceLoader) await session.bindExtensions({});
       return {
         get model() {
           const current = session.model;
@@ -3065,7 +3718,7 @@ function createPiFactory(files, models2, delivery2, createSession = createAgentS
             return false;
           }
           const filePaths = /* @__PURE__ */ new Map();
-          const FileArgsSchema = z13.object({ path: z13.string() });
+          const FileArgsSchema = z16.object({ path: z16.string() });
           function handleTool(event) {
             if (event.type === "tool_execution_start") {
               flushText();
@@ -3125,24 +3778,24 @@ function createPiFactory(files, models2, delivery2, createSession = createAgentS
 }
 
 // src/projects.ts
-import { access, readdir as readdir2, realpath, stat as stat2, readFile as readFile5, writeFile as writeFile3 } from "node:fs/promises";
+import { access as access2, readdir as readdir2, realpath, stat as stat3, readFile as readFile6, writeFile as writeFile4 } from "node:fs/promises";
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { z as z14 } from "zod";
-import { constants } from "node:fs";
-import { homedir } from "node:os";
-import path6 from "node:path";
+import { z as z17 } from "zod";
+import { constants as constants2 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import path8 from "node:path";
 import { Effect as Effect13, Semaphore as Semaphore3 } from "effect";
 function resolveProjectsRoot(input) {
   return Effect13.tryPromise({
     try: async () => {
       const trimmed = input.trim();
-      const expanded = trimmed === "~" ? homedir() : trimmed.startsWith("~/") ? path6.join(homedir(), trimmed.slice(2)) : trimmed;
-      if (!path6.isAbsolute(expanded))
+      const expanded = trimmed === "~" ? homedir3() : trimmed.startsWith("~/") ? path8.join(homedir3(), trimmed.slice(2)) : trimmed;
+      if (!path8.isAbsolute(expanded))
         throw new Error("Use an absolute server path or a path beginning with ~/.");
       const resolved = await realpath(expanded);
-      if (!(await stat2(resolved)).isDirectory())
+      if (!(await stat3(resolved)).isDirectory())
         throw new Error("The projects folder must be a directory.");
-      await access(resolved, constants.R_OK | constants.X_OK);
+      await access2(resolved, constants2.R_OK | constants2.X_OK);
       return resolved;
     },
     catch: () => new Error(
@@ -3159,36 +3812,36 @@ function projectLock(store2) {
   }
   return lock;
 }
-var ProjectId = z14.string().trim().min(1).max(255);
+var ProjectId = z17.string().trim().min(1).max(255);
 async function gitDirectory(directory) {
-  const location = path6.join(directory, ".git");
-  const info = await stat2(location);
+  const location = path8.join(directory, ".git");
+  const info = await stat3(location);
   if (info.isDirectory()) return location;
-  const contents = await readFile5(location, "utf8");
+  const contents = await readFile6(location, "utf8");
   const match = /^gitdir: (.+)\s*$/m.exec(contents);
   if (!match) throw new Error("Invalid Git worktree metadata.");
-  const resolved = await realpath(path6.resolve(directory, match[1].trim()));
-  if (!(await stat2(resolved)).isDirectory()) throw new Error("Git directory is missing.");
+  const resolved = await realpath(path8.resolve(directory, match[1].trim()));
+  if (!(await stat3(resolved)).isDirectory()) throw new Error("Git directory is missing.");
   return resolved;
 }
 async function identity(directory, preferred) {
-  const filename = path6.join(await gitDirectory(directory), "agentrific-project-id");
+  const filename = path8.join(await gitDirectory(directory), "agentrific-project-id");
   try {
-    return ProjectId.parse(await readFile5(filename, "utf8"));
+    return ProjectId.parse(await readFile6(filename, "utf8"));
   } catch (error) {
-    if (!z14.object({ code: z14.literal("ENOENT") }).safeParse(error).success) throw error;
-    const legacyFilename = path6.join(await gitDirectory(directory), "chatplans-project-id");
-    const legacy = await readFile5(legacyFilename, "utf8").catch((cause) => {
-      if (!z14.object({ code: z14.literal("ENOENT") }).safeParse(cause).success) throw cause;
+    if (!z17.object({ code: z17.literal("ENOENT") }).safeParse(error).success) throw error;
+    const legacyFilename = path8.join(await gitDirectory(directory), "chatplans-project-id");
+    const legacy = await readFile6(legacyFilename, "utf8").catch((cause) => {
+      if (!z17.object({ code: z17.literal("ENOENT") }).safeParse(cause).success) throw cause;
       return null;
     });
     const id = legacy === null ? preferred ?? randomUUID6() : ProjectId.parse(legacy);
     try {
-      await writeFile3(filename, id + "\n", { flag: "wx" });
+      await writeFile4(filename, id + "\n", { flag: "wx" });
       return id;
     } catch (writeError) {
-      if (!z14.object({ code: z14.literal("EEXIST") }).safeParse(writeError).success) throw writeError;
-      return ProjectId.parse(await readFile5(filename, "utf8"));
+      if (!z17.object({ code: z17.literal("EEXIST") }).safeParse(writeError).success) throw writeError;
+      return ProjectId.parse(await readFile6(filename, "utf8"));
     }
   }
 }
@@ -3201,15 +3854,15 @@ function scanProjects(root, store2) {
       const entries = await readdir2(root, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
-        const directory = path6.join(root, entry.name);
-        if (!await stat2(path6.join(directory, ".git")).catch(() => null)) continue;
+        const directory = path8.join(root, entry.name);
+        if (!await stat3(path8.join(directory, ".git")).catch(() => null)) continue;
         const previous = registered.find((project2) => project2.path === directory);
         let id = await identity(directory, previous?.available ? void 0 : previous?.id);
         let existing = registered.find((project2) => project2.id === id);
-        if (found.some((project2) => project2.id === id) || existing && existing.path !== directory && await stat2(path6.join(existing.path, ".git")).catch(() => null)) {
+        if (found.some((project2) => project2.id === id) || existing && existing.path !== directory && await stat3(path8.join(existing.path, ".git")).catch(() => null)) {
           id = randomUUID6();
-          await writeFile3(
-            path6.join(await gitDirectory(directory), "agentrific-project-id"),
+          await writeFile4(
+            path8.join(await gitDirectory(directory), "agentrific-project-id"),
             id + "\n"
           );
           existing = void 0;
@@ -3242,16 +3895,16 @@ function reconnectProject(root, id, input, store2) {
       ))
         throw new Error("Stop this project's running sessions before reconnecting its folder.");
       const directory = await Effect13.runPromise(resolveProjectsRoot(input));
-      if (path6.dirname(directory) !== await realpath(root))
+      if (path8.dirname(directory) !== await realpath(root))
         throw new Error("Choose a Git repository directly inside the configured projects folder.");
-      const filename = path6.join(await gitDirectory(directory), "agentrific-project-id");
+      const filename = path8.join(await gitDirectory(directory), "agentrific-project-id");
       const replacedId = await identity(directory);
-      const project = { id, name: path6.basename(directory), path: directory, available: true };
-      await writeFile3(filename, id + "\n");
+      const project = { id, name: path8.basename(directory), path: directory, available: true };
+      await writeFile4(filename, id + "\n");
       try {
         await Effect13.runPromise(store2.relocateProject(project, previous.path, replacedId));
       } catch (error) {
-        await writeFile3(filename, replacedId + "\n");
+        await writeFile4(filename, replacedId + "\n");
         throw error;
       }
       return project;
@@ -3261,9 +3914,9 @@ function reconnectProject(root, id, input, store2) {
 }
 
 // src/project-git.ts
-import { execFile as execFile2 } from "node:child_process";
-import { promisify as promisify2 } from "node:util";
-var execute = promisify2(execFile2);
+import { execFile as execFile3 } from "node:child_process";
+import { promisify as promisify3 } from "node:util";
+var execute3 = promisify3(execFile3);
 function repositoryIdentity(remote) {
   const input = remote.trim();
   if (!input || input.startsWith("/") || input.startsWith(".")) return null;
@@ -3277,14 +3930,14 @@ function repositoryIdentity(remote) {
   if (!["https:", "http:", "ssh:", "git:"].includes(url.protocol)) return null;
   if (url.search || url.hash || url.port) return null;
   const host2 = url.hostname.toLowerCase();
-  let path10 = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/, "");
-  if (!host2 || !path10 || path10.includes("%") || path10.includes("//")) return null;
-  if (["github.com", "bitbucket.org"].includes(host2)) path10 = path10.toLowerCase();
-  const key = `${host2}/${path10}`;
+  let path12 = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/, "");
+  if (!host2 || !path12 || path12.includes("%") || path12.includes("//")) return null;
+  if (["github.com", "bitbucket.org"].includes(host2)) path12 = path12.toLowerCase();
+  const key = `${host2}/${path12}`;
   return { key, display: key };
 }
 async function git(directory, args) {
-  const { stdout } = await execute("git", ["-C", directory, ...args], {
+  const { stdout } = await execute3("git", ["-C", directory, ...args], {
     timeout: 3e3,
     maxBuffer: 1024 * 1024,
     env: { ...workflowEnvironment(), GIT_OPTIONAL_LOCKS: "0", GIT_TERMINAL_PROMPT: "0" }
@@ -3310,7 +3963,7 @@ async function inspect(directory) {
       git(directory, ["symbolic-ref", "--quiet", "--short", "HEAD"]).catch(() => null),
       // NUL-separated records avoid ambiguous filenames/newlines. --no-renames
       // keeps each entry one record, so we only need its two status characters.
-      execute(
+      execute3(
         "git",
         [
           "-C",
@@ -3362,35 +4015,35 @@ function projectGitStatus(directory) {
 
 // src/store.ts
 import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "node:fs";
-import path7 from "node:path";
+import path9 from "node:path";
 
 // src/push-schema.ts
-import { z as z15 } from "zod";
-var PushBindingSchema = z15.object({
-  bindingId: z15.string().uuid(),
-  installationId: z15.string().uuid(),
-  deviceId: z15.string().uuid()
+import { z as z18 } from "zod";
+var PushBindingSchema = z18.object({
+  bindingId: z18.string().uuid(),
+  installationId: z18.string().uuid(),
+  deviceId: z18.string().uuid()
 });
-var PushStateSchema = z15.object({
-  bindings: z15.array(PushBindingSchema).max(10),
-  error: z15.string().nullable()
+var PushStateSchema = z18.object({
+  bindings: z18.array(PushBindingSchema).max(10),
+  error: z18.string().nullable()
 });
 var PendingPushSchema = PushEventSchema.extend({
-  remaining: z15.array(PushBindingSchema),
-  createdAt: z15.number(),
-  attempts: z15.number().int().nonnegative(),
-  nextAt: z15.number()
+  remaining: z18.array(PushBindingSchema),
+  createdAt: z18.number(),
+  attempts: z18.number().int().nonnegative(),
+  nextAt: z18.number()
 });
 
 // src/store.ts
 import { DatabaseSync } from "node:sqlite";
 import { Context as Context3, Data as Data3, Effect as Effect14, Layer as Layer3 } from "effect";
-import { z as z16 } from "zod";
+import { z as z19 } from "zod";
 import { randomUUID as randomUUID7 } from "node:crypto";
 var StorageError = class extends Data3.TaggedError("StorageError") {
 };
-var PayloadRow = z16.object({ payload: z16.string() });
-var EventRow = z16.object({ sequence: z16.number(), recorded_at: z16.string(), payload: z16.string() });
+var PayloadRow = z19.object({ payload: z19.string() });
+var EventRow = z19.object({ sequence: z19.number(), recorded_at: z19.string(), payload: z19.string() });
 var SqliteSessionStore = class {
   constructor(db) {
     this.db = db;
@@ -3441,7 +4094,7 @@ var SqliteSessionStore = class {
       const row = PayloadRow.parse(
         this.db.prepare("SELECT payload FROM settings WHERE id = 'server-id'").get()
       );
-      return z16.string().uuid().parse(JSON.parse(row.payload));
+      return z19.string().uuid().parse(JSON.parse(row.payload));
     });
   }
   saveDevice(device, tokenHash) {
@@ -3529,10 +4182,10 @@ var SqliteSessionStore = class {
       `).all();
       const insert = this.db.prepare("INSERT OR IGNORE INTO projects(id, payload) VALUES (?, ?)");
       for (const row of legacy) {
-        const id = z16.object({ id: z16.string() }).parse(row).id;
+        const id = z19.object({ id: z19.string() }).parse(row).id;
         insert.run(
           id,
-          JSON.stringify({ id, name: id, path: path7.join(root, id), available: false })
+          JSON.stringify({ id, name: id, path: path9.join(root, id), available: false })
         );
       }
       return this.db.prepare("SELECT payload FROM projects").all().map((row) => ProjectSchema.parse(JSON.parse(PayloadRow.parse(row).payload)));
@@ -3569,7 +4222,7 @@ var SqliteSessionStore = class {
     this.db.prepare(
       "UPDATE workflows SET payload = json_set(payload, '$.projectPath', ?) WHERE json_extract(payload, '$.kind') = 'preparation' AND json_extract(payload, '$.projectPath') = ?"
     ).run(project.path, previousPath);
-    const relocate = (workspace) => workspace === previousPath || workspace.startsWith(`${previousPath}${path7.sep}`) ? project.path + workspace.slice(previousPath.length) : workspace;
+    const relocate = (workspace) => workspace === previousPath || workspace.startsWith(`${previousPath}${path9.sep}`) ? project.path + workspace.slice(previousPath.length) : workspace;
     for (const row of this.db.prepare("SELECT id, payload FROM sessions WHERE json_extract(payload, '$.projectId') = ?").all(project.id)) {
       const session = SessionSchema.parse(JSON.parse(PayloadRow.parse(row).payload));
       if (session.workspacePath) {
@@ -3739,7 +4392,7 @@ var SqliteSessionStore = class {
         if (event.type === "message.user") this.claimAttachments(event.attachments ?? []);
         const result = this.db.prepare("INSERT INTO events(session_id, recorded_at, payload) VALUES (?, ?, ?)").run(sessionId, recordedAt, JSON.stringify(event));
         if (notification) {
-          const count = z16.object({ total: z16.number() }).parse(this.db.prepare("SELECT COUNT(*) AS total FROM push_outbox").get());
+          const count = z19.object({ total: z19.number() }).parse(this.db.prepare("SELECT COUNT(*) AS total FROM push_outbox").get());
           if (count.total >= 1e3)
             this.db.prepare(
               "DELETE FROM push_outbox WHERE rowid IN (SELECT rowid FROM push_outbox ORDER BY rowid LIMIT 1)"
@@ -3785,13 +4438,13 @@ var SessionStore = class extends Context3.Service()(
       Effect14.acquireRelease(
         Effect14.try({
           try: () => {
-            mkdirSync2(path7.dirname(filename), { recursive: true });
+            mkdirSync2(path9.dirname(filename), { recursive: true });
             const db = new DatabaseSync(filename);
             chmodSync(filename, 384);
             for (const suffix of ["-wal", "-shm"])
               if (existsSync2(filename + suffix)) chmodSync(filename + suffix, 384);
             try {
-              const schema = z16.object({ user_version: z16.number() }).parse(db.prepare("PRAGMA user_version").get());
+              const schema = z19.object({ user_version: z19.number() }).parse(db.prepare("PRAGMA user_version").get());
               if (schema.user_version > 1)
                 throw new Error("This database requires a newer Agentrific server.");
               db.exec(`
@@ -3826,7 +4479,7 @@ var SessionStore = class extends Context3.Service()(
 
 // src/worktree-cleanup.ts
 import { lstat as lstat2, rm as rm2 } from "node:fs/promises";
-import path8 from "node:path";
+import path10 from "node:path";
 import { Effect as Effect15 } from "effect";
 var WorktreeCleanup = class {
   constructor(store2, root, projectsRoot) {
@@ -3839,12 +4492,12 @@ var WorktreeCleanup = class {
   projectsRoot;
   async remove(session, discardChanges = true) {
     if (session.gitFlow?.workspace !== "worktree" || !session.workspacePath) return;
-    const workspace = path8.resolve(session.workspacePath);
+    const workspace = path10.resolve(session.workspacePath);
     const info = await lstat2(workspace).catch((error) => {
       if (error.code === "ENOENT") return void 0;
       throw error;
     });
-    if (workspace !== path8.join(this.root, session.id) || path8.basename(session.id) !== session.id) {
+    if (workspace !== path10.join(this.root, session.id) || path10.basename(session.id) !== session.id) {
       if (!info) return;
       throw new Error("Refusing to remove a worktree outside the managed workspaces directory.");
     }
@@ -3882,9 +4535,9 @@ var WorktreeCleanup = class {
   }
 };
 async function removeRunFiles(dataRoot2, sessionId) {
-  if (path8.basename(sessionId) !== sessionId || sessionId === "." || sessionId === "..")
+  if (path10.basename(sessionId) !== sessionId || sessionId === "." || sessionId === "..")
     throw new Error("Invalid session directory.");
-  await rm2(path8.join(dataRoot2, "pi", sessionId), { recursive: true, force: true });
+  await rm2(path10.join(dataRoot2, "pi", sessionId), { recursive: true, force: true });
 }
 
 // src/repo-chat.ts
@@ -3922,17 +4575,17 @@ function openRepoChat(store2, projectId, workspacePath, defaultModel, reset = fa
 // src/index.ts
 var host = process.env.AGENTRIFIC_HOST ?? "127.0.0.1";
 var port = Number(process.env.AGENTRIFIC_PORT ?? 4318);
-var defaultProjectsRoot = path9.resolve(process.env.AGENTRIFIC_PROJECTS_DIR ?? "./projects");
-var worktreesRoot = path9.resolve(
-  process.env.AGENTRIFIC_WORKTREES_DIR ?? path9.join(homedir2(), ".agentrific", "workspaces")
+var defaultProjectsRoot = path11.resolve(process.env.AGENTRIFIC_PROJECTS_DIR ?? "./projects");
+var worktreesRoot = path11.resolve(
+  process.env.AGENTRIFIC_WORKTREES_DIR ?? path11.join(homedir4(), ".agentrific", "workspaces")
 );
-var execFileAsync = promisify3(execFile3);
+var execFileAsync = promisify4(execFile4);
 if (host !== "127.0.0.1" && host !== "::1")
   throw new Error("Bind Agentrific to loopback and expose it with Tailscale Serve or cloudflared.");
 var app = Fastify({
   logger: {
     stream: process.env.AGENTRIFIC_INTERACTIVE === "1" && process.stdout.isTTY ? pretty({
-      colorize: styleText("green", "ready") !== "ready",
+      colorize: styleText2("green", "ready") !== "ready",
       translateTime: "SYS:HH:MM:ss",
       ignore: "pid,hostname,reqId",
       singleLine: true,
@@ -3947,9 +4600,9 @@ var app = Fastify({
     }
   }
 });
-var dataRoot = path9.resolve(process.env.AGENTRIFIC_DATA_DIR ?? "./data");
+var dataRoot = path11.resolve(process.env.AGENTRIFIC_DATA_DIR ?? "./data");
 var releaseLock = await acquireServerLock(dataRoot);
-var effects = ManagedRuntime.make(SessionStore.layer(path9.join(dataRoot, "sessions.sqlite")));
+var effects = ManagedRuntime.make(SessionStore.layer(path11.join(dataRoot, "sessions.sqlite")));
 var store = await effects.runPromise(SessionStore);
 var security = new ServerSecurity(store, await Effect17.runPromise(store.serverIdentity()));
 var sandboxPushUrl = process.env.AGENTRIFIC_PUSH_SANDBOX === "1" ? PUSH_SANDBOX_API_URL : void 0;
@@ -3981,7 +4634,7 @@ await app.register(cors, {
 await registerSecurity(app, security, serverVersion, allowedOrigins);
 registerPushRoutes(app, push, security);
 var attachmentEffects = ManagedRuntime.make(
-  Attachments.layer(path9.join(dataRoot, "attachments"), store)
+  Attachments.layer(path11.join(dataRoot, "attachments"), store)
 );
 var attachments = await attachmentEffects.runPromise(Attachments);
 await Effect17.runPromise(attachments.cleanup());
@@ -4046,7 +4699,10 @@ function publish(event, workflowUpdate = false) {
     else client.send(message);
   }
 }
-var models = new ServerModels(await ModelRuntime.create(), store);
+var claudeCode = new ClaudeCode();
+var modelRuntime = await ModelRuntime.create();
+await claudeCode.refresh(modelRuntime);
+var models = new ServerModels(modelRuntime, store, claudeCode);
 var delivery = new DeliveryCoordinator(store, {
   publish: (event) => publish(event, true),
   draft: deliveryWriter(models),
@@ -4065,7 +4721,7 @@ var agentEffects = ManagedRuntime.make(
     createPiFactory(attachments, models, delivery),
     publish,
     worktreesRoot,
-    path9.join(dataRoot, "pi"),
+    path11.join(dataRoot, "pi"),
     (sessionId, messageId) => Effect17.runSync(store.hasMessage(sessionId, messageId)),
     (session) => delivery.settled(session.id)
   )
@@ -4240,7 +4896,7 @@ app.get("/api/projects/:id", async (request, reply) => {
   return project ?? reply.code(404).send({ error: "Project not found on this server." });
 });
 app.post("/api/projects/:id/reconnect", async (request, reply) => {
-  const parsed = z17.object({ path: z17.string().trim().min(1).max(4096) }).safeParse(request.body);
+  const parsed = z20.object({ path: z20.string().trim().min(1).max(4096) }).safeParse(request.body);
   if (!parsed.success)
     return reply.code(400).send({ error: "Enter the project's new folder path." });
   const root = await Effect17.runPromise(store.projectsRoot(defaultProjectsRoot));
@@ -4326,7 +4982,7 @@ app.patch("/api/tasks/:id", async (request, reply) => {
   }
 });
 app.post("/api/tasks/:id/discard-unrun", async (request, reply) => {
-  const parsed = z17.object({ updatedAt: z17.string().datetime() }).safeParse(request.body);
+  const parsed = z20.object({ updatedAt: z20.string().datetime() }).safeParse(request.body);
   if (!parsed.success) return reply.code(400).send({ error: "The task revision is required." });
   try {
     await deleteTask(store, request.params.id, void 0, parsed.data.updatedAt);
@@ -4396,9 +5052,9 @@ app.post(
     }
   })
 );
-var HistoryQuery = z17.object({
-  after: z17.coerce.number().int().nonnegative().default(0),
-  limit: z17.coerce.number().int().min(1).max(1e3).default(500)
+var HistoryQuery = z20.object({
+  after: z20.coerce.number().int().nonnegative().default(0),
+  limit: z20.coerce.number().int().min(1).max(1e3).default(500)
 });
 app.get("/api/sessions/:id/events", async (request, reply) => {
   const query = HistoryQuery.safeParse(request.query);
@@ -4433,18 +5089,18 @@ async function resolveSessionProject(projectId) {
     return { error: "Project folder is missing. Reconnect it before starting a run.", status: 404 };
   const projectPath = await realpath2(project.path);
   const resolvedRoot = await realpath2(projectsRoot);
-  if (path9.dirname(projectPath) !== resolvedRoot)
+  if (path11.dirname(projectPath) !== resolvedRoot)
     return { error: "Project path is outside projects root.", status: 400 };
   return { projectPath };
 }
 async function resolveSessionWorkspace(id, gitFlow, projectPath) {
-  const worktreePath = path9.join(worktreesRoot, id);
+  const worktreePath = path11.join(worktreesRoot, id);
   const branch = gitFlow ? `agentrific/${id.slice(0, 8)}` : null;
   const useProjectCheckout = gitFlow?.workspace === "checkout";
   const workspacePath = !gitFlow || useProjectCheckout ? projectPath : worktreePath;
   if (useProjectCheckout) {
     const serverPath = await realpath2(process.cwd());
-    if (serverPath === projectPath || serverPath.startsWith(`${projectPath}${path9.sep}`))
+    if (serverPath === projectPath || serverPath.startsWith(`${projectPath}${path11.sep}`))
       return {
         error: "The server runs from this project. Choose a worktree for this task.",
         status: 409
@@ -4536,7 +5192,7 @@ app.post("/api/projects/:id/chat", async (request, reply) => {
   const location = await resolveSessionProject(request.params.id);
   if (location.error !== void 0)
     return reply.code(location.status).send({ error: location.error });
-  const parsed = z17.object({ reset: z17.boolean().optional() }).safeParse(request.body ?? {});
+  const parsed = z20.object({ reset: z20.boolean().optional() }).safeParse(request.body ?? {});
   if (!parsed.success) return reply.code(400).send({ error: parsed.error.flatten() });
   try {
     return await openRepoChat(
@@ -4560,7 +5216,7 @@ app.post("/api/sessions", async (request, reply) => {
   if (!result.session) return reply.code(result.status).send({ error: result.error });
   return reply.code(201).send(result.session);
 });
-var StartTaskBody = z17.object({ prompt: z17.string().trim().max(2e4).optional() }).default({});
+var StartTaskBody = z20.object({ prompt: z20.string().trim().max(2e4).optional() }).default({});
 function startTask(id, instructionsOverride, automated = false) {
   return withTaskLock(
     "agent-dispatch",
@@ -4638,7 +5294,7 @@ app.patch("/api/automation", async (request, reply) => {
   return automation.configure(parsed.data);
 });
 app.patch("/api/automation/queue", async (request, reply) => {
-  const parsed = z17.object({ taskId: z17.string().min(1), beforeId: z17.string().min(1).nullable() }).safeParse(request.body);
+  const parsed = z20.object({ taskId: z20.string().min(1), beforeId: z20.string().min(1).nullable() }).safeParse(request.body);
   if (!parsed.success)
     return reply.code(400).send({ error: "Choose a task and a queue position." });
   try {
@@ -4701,15 +5357,35 @@ attachEventServer(app, security, allowedOrigins, () => ({
   sessions: Effect17.runSync(store.list())
 }));
 function localServerUrl() {
-  const address = z17.object({ port: z17.number() }).safeParse(app.server.address());
+  const address = z20.object({ port: z20.number() }).safeParse(app.server.address());
   return address.success ? `http://${host}:${address.data.port}` : void 0;
 }
+var phoneOrigin;
+var phone = process.env.AGENTRIFIC_DESKTOP_SERVER === "1" ? new DesktopPhoneConnection(
+  () => {
+    const origin = localServerUrl();
+    if (!origin) throw new Error("Start the local server before connecting your phone.");
+    return origin;
+  },
+  (url) => {
+    if (phoneOrigin) {
+      const index = allowedOrigins.indexOf(phoneOrigin);
+      if (index >= 0) allowedOrigins.splice(index, 1);
+    }
+    phoneOrigin = url || void 0;
+    process.env.AGENTRIFIC_PUBLIC_URL = url || "";
+    if (url && !allowedOrigins.includes(url)) allowedOrigins.push(url);
+  },
+  path11.join(dataRoot, "phone-connection")
+) : void 0;
 var closeControl = await startControl(
   dataRoot,
   security,
   () => ({
     serverId: security.serverId,
     publicUrl: process.env.AGENTRIFIC_PUBLIC_URL,
+    phoneProvider: phone?.snapshot().provider,
+    phoneProgress: phone?.snapshot().progress,
     localUrl: localServerUrl(),
     serverVersion,
     connectedDevices: new Set(security.sockets.values()).size,
@@ -4722,10 +5398,12 @@ var closeControl = await startControl(
   async () => {
     await app.close();
     process.exit(0);
-  }
+  },
+  phone
 );
 push.start();
 app.addHook("onClose", async () => {
+  await phone?.close();
   await push.close();
   maintenance.enter();
   stopUpdateDiscovery();