@ai-development-environment/control-agent 0.0.96 → 0.0.98

package/dist/control-agent.js

@@ -3225,7 +3225,7 @@ var require_stream = __commonJS({
       };
       duplex._final = function(callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open5() {
+          ws.once("open", function open6() {
             duplex._final(callback);
           });
           return;
@@ -3246,7 +3246,7 @@ var require_stream = __commonJS({
       };
       duplex._write = function(chunk, encoding, callback) {
         if (ws.readyState === ws.CONNECTING) {
-          ws.once("open", function open5() {
+          ws.once("open", function open6() {
             duplex._write(chunk, encoding, callback);
           });
           return;
@@ -4280,7 +4280,7 @@ async function saveConfig(config, path = configPath()) {
 
 // src/graphql-client.ts
 import { createReadStream } from "node:fs";
-import { rm, stat } from "node:fs/promises";
+import { open, rm, stat } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import { Readable } from "node:stream";
 
@@ -4988,6 +4988,39 @@ var import_websocket_server = __toESM(require_websocket_server(), 1);
 var wrapper_default = import_websocket.default;
 
 // src/graphql-client.ts
+async function writeArtifactTransferBytes(writer, bytes, position) {
+  let written = 0;
+  while (written < bytes.byteLength) {
+    const remaining = bytes.byteLength - written;
+    const { bytesWritten } = await writer.write(
+      bytes,
+      written,
+      remaining,
+      position + written
+    );
+    if (!Number.isSafeInteger(bytesWritten) || bytesWritten <= 0 || bytesWritten > remaining) {
+      throw new Error("Artifact transfer file write made no progress");
+    }
+    written += bytesWritten;
+  }
+}
+async function artifactTransferRetryDelay(attempt, signal) {
+  await new Promise((resolve12, reject) => {
+    const timeout = setTimeout(
+      () => {
+        signal.removeEventListener("abort", abort);
+        resolve12();
+      },
+      Math.min(4e3, 250 * 2 ** attempt)
+    );
+    const abort = () => {
+      clearTimeout(timeout);
+      reject(signal.reason ?? new Error("Artifact transfer was cancelled"));
+    };
+    if (signal.aborted) abort();
+    else signal.addEventListener("abort", abort, { once: true });
+  });
+}
 var RUN_COMMAND_FIELDS = `
   id runId agentId sequence type payload status error
   run {
@@ -5257,6 +5290,205 @@ var AgentGraphQLClient = class {
       );
     }
   }
+  artifactTransferHeaders(values = {}) {
+    return mergeHeaders(this.headers, {
+      ...this.credential ? { authorization: `Bearer ${this.credential}` } : {},
+      ...values
+    });
+  }
+  async uploadBuildArtifactTransfer(input) {
+    const information = await stat(input.path);
+    const base = `${this.server}/api/agent/build-artifact-transfers/${encodeURIComponent(input.transferId)}`;
+    const metadata = await fetch(base, {
+      method: "POST",
+      headers: this.artifactTransferHeaders({
+        "content-type": "application/json"
+      }),
+      body: JSON.stringify({
+        uploadLength: information.size,
+        checksum: input.checksum,
+        filename: input.filename,
+        contentType: input.contentType
+      }),
+      signal: input.signal
+    });
+    if (!metadata.ok) {
+      throw new Error(
+        `Artifact transfer initialization failed: HTTP ${metadata.status} ${await metadata.text()}`
+      );
+    }
+    const confirmedOffset = async () => {
+      const response = await fetch(`${base}/upload`, {
+        method: "HEAD",
+        headers: this.artifactTransferHeaders(),
+        signal: input.signal
+      });
+      if (!response.ok) {
+        throw new Error(
+          `Could not inspect artifact upload offset: HTTP ${response.status}`
+        );
+      }
+      const offset = Number(response.headers.get("upload-offset"));
+      if (!Number.isSafeInteger(offset) || offset < 0 || offset > information.size) {
+        throw new Error("Artifact relay returned an invalid upload offset");
+      }
+      return offset;
+    };
+    const handle = await open(input.path, "r");
+    try {
+      let offset = await confirmedOffset();
+      const buffer = Buffer.allocUnsafe(16 * 1024 * 1024);
+      while (offset < information.size) {
+        if (input.signal.aborted) throw input.signal.reason;
+        const length = Math.min(buffer.length, information.size - offset);
+        const { bytesRead } = await handle.read(buffer, 0, length, offset);
+        if (bytesRead !== length)
+          throw new Error("Artifact changed while uploading");
+        let attempt = 0;
+        while (true) {
+          let failure;
+          try {
+            const response = await fetch(`${base}/upload`, {
+              method: "PATCH",
+              headers: this.artifactTransferHeaders({
+                "content-length": String(bytesRead),
+                "content-type": "application/offset+octet-stream",
+                "upload-offset": String(offset)
+              }),
+              body: buffer.subarray(0, bytesRead),
+              signal: input.signal
+            });
+            if (response.ok) {
+              const nextOffset = Number(response.headers.get("upload-offset"));
+              if (Number.isSafeInteger(nextOffset) && nextOffset > offset && nextOffset <= information.size) {
+                offset = nextOffset;
+                break;
+              }
+              failure = new Error(
+                "Artifact relay returned an invalid upload offset"
+              );
+            } else {
+              failure = new Error(
+                `Artifact chunk upload failed: HTTP ${response.status} ${await response.text()}`
+              );
+            }
+          } catch (error) {
+            if (input.signal.aborted) throw error;
+            failure = error instanceof Error ? error : new Error(String(error));
+          }
+          if (++attempt >= 5) throw failure;
+          await artifactTransferRetryDelay(attempt, input.signal);
+          const resumedOffset = await confirmedOffset();
+          if (resumedOffset !== offset) {
+            offset = resumedOffset;
+            break;
+          }
+        }
+      }
+    } finally {
+      await handle.close();
+    }
+    const completion = await fetch(`${base}/complete`, {
+      method: "POST",
+      headers: this.artifactTransferHeaders(),
+      signal: input.signal
+    });
+    if (!completion.ok) {
+      throw new Error(
+        `Artifact transfer completion failed: HTTP ${completion.status} ${await completion.text()}`
+      );
+    }
+  }
+  async downloadBuildArtifactTransfer(input) {
+    const base = `${this.server}/api/agent/build-artifact-transfers/${encodeURIComponent(input.transferId)}`;
+    let metadata;
+    while (true) {
+      const response = await fetch(base, {
+        headers: this.artifactTransferHeaders(),
+        signal: input.signal
+      });
+      if (!response.ok) {
+        throw new Error(
+          `Could not inspect artifact transfer: HTTP ${response.status} ${await response.text()}`
+        );
+      }
+      metadata = await response.json();
+      if (["READY", "DOWNLOADING", "SUCCEEDED"].includes(metadata.status))
+        break;
+      if (["FAILED", "CANCELLED", "EXPIRED"].includes(metadata.status)) {
+        throw new Error(
+          metadata.error || `Artifact transfer ${metadata.status.toLowerCase()}`
+        );
+      }
+      await new Promise((resolve12) => setTimeout(resolve12, 1e3));
+    }
+    if (!Number.isSafeInteger(metadata.uploadLength) || !metadata.uploadLength || !metadata.checksum || !metadata.filename) {
+      throw new Error("Artifact transfer metadata is incomplete");
+    }
+    let offset = 0;
+    try {
+      offset = (await stat(input.path)).size;
+    } catch {
+    }
+    if (offset > metadata.uploadLength) {
+      await rm(input.path, { force: true });
+      offset = 0;
+    }
+    const handle = await open(input.path, offset === 0 ? "w" : "r+");
+    try {
+      while (offset < metadata.uploadLength) {
+        const end = Math.min(
+          metadata.uploadLength - 1,
+          offset + 16 * 1024 * 1024 - 1
+        );
+        let bytes = null;
+        let attempt = 0;
+        while (!bytes) {
+          let failure = new Error("Artifact range download failed");
+          try {
+            const response = await fetch(`${base}/download`, {
+              headers: this.artifactTransferHeaders({
+                range: `bytes=${offset}-${end}`
+              }),
+              signal: input.signal
+            });
+            if (response.status !== 206) {
+              failure = new Error(
+                `Artifact range download failed: HTTP ${response.status} ${await response.text()}`
+              );
+            } else {
+              const received = Buffer.from(await response.arrayBuffer());
+              if (received.length === end - offset + 1) bytes = received;
+              else failure = new Error("Artifact range length did not match");
+            }
+          } catch (error) {
+            if (input.signal.aborted) throw error;
+            failure = error instanceof Error ? error : new Error(String(error));
+          }
+          if (bytes) break;
+          if (++attempt >= 5) throw failure;
+          await artifactTransferRetryDelay(attempt, input.signal);
+        }
+        await writeArtifactTransferBytes(handle, bytes, offset);
+        offset += bytes.length;
+      }
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    const digest = createHash("sha256");
+    for await (const chunk of createReadStream(input.path))
+      digest.update(chunk);
+    if (digest.digest("hex") !== metadata.checksum) {
+      await rm(input.path, { force: true });
+      throw new Error("Downloaded artifact checksum did not match");
+    }
+    return {
+      filename: metadata.filename,
+      contentType: metadata.contentType ?? "application/octet-stream",
+      checksum: metadata.checksum
+    };
+  }
   completeJob(jobId, status2, result, error) {
     return this.request(
       `mutation CompleteJob($jobId: ID!, $status: AgentJobStatus!, $result: JSON, $error: String) {
@@ -7423,6 +7655,9 @@ var IOS_BUILD_JOB_KIND = "ios.build.run";
 var IOS_BUILD_DELETE_JOB_KIND = "ios.build.delete";
 var IOS_ARTIFACT_DOWNLOAD_JOB_KIND = "ios.artifact.download";
 var IOS_DEPLOY_JOB_KIND = "ios.build.deploy";
+var IOS_AGENT_RUN_DESTINATIONS_JOB_KIND = "ios.agentRunDestinations.inspect";
+var IOS_ARTIFACT_TRANSFER_UPLOAD_JOB_KIND = "ios.artifact.transfer.upload";
+var IOS_REMOTE_DEPLOY_JOB_KIND = "ios.build.remoteDeploy";
 var IOS_EXPORT_JOB_KIND = "ios.archive.export";
 var IOS_TEST_RESULTS_JOB_KIND = "ios.test-results.parse";
 var IOS_COVERAGE_REPORT_JOB_KIND = "ios.coverage.generate";
@@ -7436,6 +7671,9 @@ var IOS_BUILD_JOB_KINDS = [
   IOS_BUILD_DELETE_JOB_KIND,
   IOS_ARTIFACT_DOWNLOAD_JOB_KIND,
   IOS_DEPLOY_JOB_KIND,
+  IOS_AGENT_RUN_DESTINATIONS_JOB_KIND,
+  IOS_ARTIFACT_TRANSFER_UPLOAD_JOB_KIND,
+  IOS_REMOTE_DEPLOY_JOB_KIND,
   IOS_EXPORT_JOB_KIND,
   IOS_TEST_RESULTS_JOB_KIND,
   IOS_COVERAGE_REPORT_JOB_KIND,
@@ -7476,6 +7714,31 @@ var APPROVED_BUILD_SETTING_OVERRIDES = [
   "MARKETING_VERSION",
   "CURRENT_PROJECT_VERSION"
 ];
+function genericBuildDestinations(action) {
+  if (!GENERIC_BUILD_DESTINATION_ACTIONS.includes(action)) return [];
+  const physical = {
+    type: "PHYSICAL_DEVICE",
+    id: "generic-ios",
+    name: "Any Physical iOS Device",
+    platform: "iOS",
+    osVersion: null,
+    state: null,
+    generic: true
+  };
+  if (action === "ARCHIVE") return [physical];
+  return [
+    {
+      type: "SIMULATOR",
+      id: "generic-ios-simulator",
+      name: "Any iOS Simulator",
+      platform: "iOS Simulator",
+      osVersion: null,
+      state: null,
+      generic: true
+    },
+    physical
+  ];
+}
 var DEFAULT_BUILD_ADVANCED_SETTINGS = {
   packageResolution: "DEFAULT",
   disablePackageRepositoryCache: false,
@@ -7592,6 +7855,12 @@ function parseBuildDestination(value) {
         destination.generic,
         "build destination.generic"
       )
+    },
+    ...destination.available === void 0 ? {} : {
+      available: booleanValue2(
+        destination.available,
+        "build destination.available"
+      )
     }
   };
 }
@@ -7925,13 +8194,50 @@ function parseBuildArtifactDownloadPayload(value) {
     )
   };
 }
-function parseBuildDeploymentPayload(value) {
-  const input = objectValue7(value, "build deployment payload");
+function parseBuildArtifactTransferUploadPayload(value) {
+  const input = objectValue7(value, "build artifact transfer upload payload");
+  const buildId = stringValue7(
+    input.buildId,
+    "build artifact transfer upload payload.buildId"
+  );
+  const artifactDirectory = safeAbsolutePath(
+    input.artifactDirectory,
+    "build artifact transfer upload payload.artifactDirectory"
+  );
+  if (artifactDirectory.split("/").at(-1) !== buildId) {
+    throw new Error(
+      "Build artifact transfer folder must end with the build ID"
+    );
+  }
+  return {
+    transferId: stringValue7(
+      input.transferId,
+      "build artifact transfer upload payload.transferId"
+    ),
+    buildId,
+    artifactDirectory,
+    artifactRelativePath: safeRelativePath2(
+      input.artifactRelativePath,
+      "build artifact transfer upload payload.artifactRelativePath"
+    )
+  };
+}
+function parseBuildAgentRunDestinationsPayload(value) {
+  const input = objectValue7(value, "agent run destinations payload");
+  return {
+    destinationType: enumValue3(
+      input.destinationType,
+      BUILD_DESTINATION_TYPES,
+      "agent run destinations payload.destinationType"
+    )
+  };
+}
+function parseDeployments(input) {
   if (!Array.isArray(input.deployments) || !input.deployments.length) {
     throw new Error("build deployment payload.deployments must not be empty");
   }
-  const deployments = input.deployments.map((value2, index) => {
-    const deployment = objectValue7(value2, `deployments[${index}]`);
+  const deployments = input.deployments.map((value, index) => {
+    const deployment = objectValue7(value, `deployments[${index}]`);
     return {
       id: stringValue7(deployment.id, `deployments[${index}].id`),
       destination: parseBuildDestination(deployment.destination)
@@ -7950,6 +8256,11 @@ function parseBuildDeploymentPayload(value) {
   if (new Set(deployments.map(({ destination }) => destination.type)).size > 1) {
     throw new Error("deployment destinations must use one destination type");
   }
+  return deployments;
+}
+function parseBuildDeploymentPayload(value) {
+  const input = objectValue7(value, "build deployment payload");
+  const deployments = parseDeployments(input);
   return {
     ...worktreeIdentity(input),
     buildId: stringValue7(input.buildId, "build deployment payload.buildId"),
@@ -7968,6 +8279,24 @@ function parseBuildDeploymentPayload(value) {
     deployments
   };
 }
+function parseBuildRemoteDeploymentPayload(value) {
+  const input = objectValue7(value, "remote build deployment payload");
+  return {
+    transferId: stringValue7(
+      input.transferId,
+      "remote build deployment payload.transferId"
+    ),
+    buildId: stringValue7(
+      input.buildId,
+      "remote build deployment payload.buildId"
+    ),
+    bundleIdentifier: stringValue7(
+      input.bundleIdentifier,
+      "remote build deployment payload.bundleIdentifier"
+    ),
+    deployments: parseDeployments(input)
+  };
+}
 function parseBuildExportSettings(value) {
   const input = objectValue7(value, "export settings");
   const profiles = objectValue7(
@@ -8576,6 +8905,215 @@ function parseCliHealthJobPayload(value) {
   return { checks };
 }
 
+// ../agent-contract/src/tailscale.ts
+var TAILSCALE_SERVE_INSPECT_JOB_KIND = "tailscale.serve.inspect.v1";
+var TAILSCALE_SERVE_UPSERT_JOB_KIND = "tailscale.serve.upsert.v1";
+var TAILSCALE_SERVE_REMOVE_JOB_KIND = "tailscale.serve.remove.v1";
+var TAILSCALE_SERVE_JOB_KINDS = [
+  TAILSCALE_SERVE_INSPECT_JOB_KIND,
+  TAILSCALE_SERVE_UPSERT_JOB_KIND,
+  TAILSCALE_SERVE_REMOVE_JOB_KIND
+];
+var TAILSCALE_SERVE_PROTOCOLS = [
+  "HTTP",
+  "HTTPS",
+  "TCP",
+  "TLS_TERMINATED_TCP"
+];
+var TAILSCALE_DESTINATION_PROTOCOLS = [
+  "HTTP",
+  "HTTPS",
+  "HTTPS_INSECURE",
+  "TCP"
+];
+var TAILSCALE_PROXY_PROTOCOLS = ["NONE", "V1", "V2"];
+function objectValue13(value, name) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${name} must be an object`);
+  }
+  return value;
+}
+function exactKeys3(value, keys, name) {
+  const unexpected = Object.keys(value).find((key) => !keys.includes(key));
+  if (unexpected) throw new Error(`Unexpected ${name} field: ${unexpected}`);
+}
+function requiredString(value, name) {
+  if (typeof value !== "string" || value.trim().length === 0 || value.includes("\0")) {
+    throw new Error(`${name} must be a non-empty string`);
+  }
+  return value.trim();
+}
+function integerPort(value, name) {
+  if (!Number.isInteger(value) || value < 1 || value > 65535) {
+    throw new Error(`${name} must be an integer from 1 through 65535`);
+  }
+  return value;
+}
+function enumValue4(value, values, name) {
+  if (typeof value !== "string" || !values.includes(value)) {
+    throw new Error(`${name} is invalid`);
+  }
+  return value;
+}
+function normalizeTailscaleMountPath(value) {
+  if (typeof value !== "string" || value.includes("\0") || value.includes("?")) {
+    throw new Error("Tailscale mount path is invalid");
+  }
+  const path = value.trim() || "/";
+  const prefixed = path.startsWith("/") ? path : `/${path}`;
+  return prefixed === "/" ? prefixed : prefixed.replace(/\/+$/, "");
+}
+function normalizeDestinationPath(value) {
+  if (typeof value !== "string" || value.includes("\0")) {
+    throw new Error("Tailscale destination path is invalid");
+  }
+  const path = value.trim();
+  if (!path) return "";
+  return path.startsWith("/") ? path : `/${path}`;
+}
+function appCapabilities(value) {
+  if (!Array.isArray(value) || value.length > 100) {
+    throw new Error("Tailscale app capabilities must be an array");
+  }
+  const pattern = /^(?:[\p{L}\p{N}-]+\.)+[\p{L}\p{N}-]+\/[\p{L}\p{N}-]+(?:\/[\p{L}\p{N}-]+)*$/u;
+  return [
+    ...new Set(
+      value.map((item, index) => {
+        const capability = requiredString(
+          item,
+          `Tailscale app capabilities[${index}]`
+        );
+        if (!pattern.test(capability)) {
+          throw new Error(
+            `Tailscale app capabilities[${index}] must use domain/name format`
+          );
+        }
+        return capability;
+      })
+    )
+  ].sort();
+}
+function parseTailscaleServeRoute(value) {
+  const route = objectValue13(value, "Tailscale Serve route");
+  exactKeys3(
+    route,
+    [
+      "protocol",
+      "listenPort",
+      "mountPath",
+      "destination",
+      "funnel",
+      "appCapabilities",
+      "proxyProtocol"
+    ],
+    "Tailscale Serve route"
+  );
+  const protocol = enumValue4(
+    route.protocol,
+    TAILSCALE_SERVE_PROTOCOLS,
+    "Tailscale Serve protocol"
+  );
+  const listenPort = integerPort(route.listenPort, "Tailscale listen port");
+  const destination = objectValue13(
+    route.destination,
+    "Tailscale Serve destination"
+  );
+  exactKeys3(
+    destination,
+    ["protocol", "port", "path"],
+    "Tailscale Serve destination"
+  );
+  const destinationProtocol = enumValue4(
+    destination.protocol,
+    TAILSCALE_DESTINATION_PROTOCOLS,
+    "Tailscale destination protocol"
+  );
+  const funnel = route.funnel;
+  if (typeof funnel !== "boolean")
+    throw new Error("Tailscale Funnel must be a boolean");
+  const proxyProtocol = enumValue4(
+    route.proxyProtocol,
+    TAILSCALE_PROXY_PROTOCOLS,
+    "Tailscale PROXY protocol"
+  );
+  const capabilities = appCapabilities(route.appCapabilities);
+  const isWeb = protocol === "HTTP" || protocol === "HTTPS";
+  if (isWeb && destinationProtocol === "TCP") {
+    throw new Error("Web listeners require an HTTP(S) destination");
+  }
+  if (!isWeb && destinationProtocol !== "TCP") {
+    throw new Error("TCP listeners require a TCP destination");
+  }
+  if (!isWeb && normalizeTailscaleMountPath(route.mountPath) !== "/") {
+    throw new Error("TCP listeners do not support mount paths");
+  }
+  if (funnel && (protocol === "HTTP" || ![443, 8443, 1e4].includes(listenPort))) {
+    throw new Error(
+      "Funnel requires HTTPS or TLS TCP on port 443, 8443, or 10000"
+    );
+  }
+  if (capabilities.length && (!isWeb || funnel)) {
+    throw new Error(
+      "App capabilities are supported only by private HTTP(S) listeners"
+    );
+  }
+  if (proxyProtocol !== "NONE" && protocol !== "TCP") {
+    throw new Error("PROXY protocol is supported only by TCP listeners");
+  }
+  return {
+    protocol,
+    listenPort,
+    mountPath: isWeb ? normalizeTailscaleMountPath(route.mountPath) : "/",
+    destination: {
+      protocol: destinationProtocol,
+      port: integerPort(destination.port, "Tailscale destination port"),
+      path: isWeb ? normalizeDestinationPath(destination.path) : ""
+    },
+    funnel,
+    appCapabilities: capabilities,
+    proxyProtocol
+  };
+}
+function tailscaleServeInspectPayload(value) {
+  const payload = objectValue13(value, "Tailscale Serve inspect payload");
+  exactKeys3(payload, ["operationId"], "Tailscale Serve inspect payload");
+  return { operationId: requiredString(payload.operationId, "operationId") };
+}
+function mutationPayload(value, allowPrevious) {
+  const payload = objectValue13(value, "Tailscale Serve mutation payload");
+  exactKeys3(
+    payload,
+    [
+      "operationId",
+      "templateId",
+      "revision",
+      "route",
+      ...allowPrevious ? ["previousRoute"] : []
+    ],
+    "Tailscale Serve mutation payload"
+  );
+  if (!Number.isInteger(payload.revision) || payload.revision < 1) {
+    throw new Error("Tailscale template revision must be a positive integer");
+  }
+  return {
+    operationId: requiredString(payload.operationId, "operationId"),
+    templateId: requiredString(payload.templateId, "templateId"),
+    revision: payload.revision,
+    route: parseTailscaleServeRoute(payload.route)
+  };
+}
+function tailscaleServeUpsertPayload(value) {
+  const base = mutationPayload(value, true);
+  const payload = value;
+  return {
+    ...base,
+    previousRoute: payload.previousRoute === null ? null : parseTailscaleServeRoute(payload.previousRoute)
+  };
+}
+function tailscaleServeRemovePayload(value) {
+  return mutationPayload(value, false);
+}
+
 // src/inventory.ts
 var AGENT_VERSION = process.env.CONTROL_AGENT_VERSION ?? "0.1.0";
 var PORTABLE_AGENT_CAPABILITIES = [
@@ -8599,9 +9137,11 @@ var MACOS_AGENT_CAPABILITIES = [
   ...IOS_BUILD_JOB_KINDS,
   ...SIGNING_ASSET_JOB_KINDS
 ];
+var UNIX_AGENT_CAPABILITIES = [...TAILSCALE_SERVE_JOB_KINDS];
 function capabilitiesForPlatform(targetPlatform) {
   return [
     ...PORTABLE_AGENT_CAPABILITIES,
+    ...targetPlatform === "darwin" || targetPlatform === "linux" ? UNIX_AGENT_CAPABILITIES : [],
     ...targetPlatform === "darwin" ? MACOS_AGENT_CAPABILITIES : []
   ];
 }
@@ -9031,7 +9571,7 @@ import {
   cp,
   mkdir as mkdir2,
   mkdtemp as mkdtemp2,
-  open,
+  open as open2,
   readdir,
   readFile as readFile2,
   realpath as realpath2,
@@ -9426,7 +9966,7 @@ function command(executable, args, timeoutMs, signal, cwd, env = process.env) {
   });
 }
 async function commandToFile(executable, args, timeoutMs, signal, cwd, env, destination) {
-  const output = await open(destination, "wx", 384);
+  const output = await open2(destination, "wx", 384);
   try {
     return await captureCommand({
       command: executable,
@@ -9936,7 +10476,7 @@ var parseBuildSourceMetadata = async (payload, timeoutMs, signal) => {
     headSha: input.headSha
   };
 };
-function simulatorDestinations(value) {
+function simulatorDestinations(value, includeUnavailable = false) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return [];
   const devices = value.devices;
   if (!devices || typeof devices !== "object" || Array.isArray(devices))
@@ -9949,7 +10489,8 @@ function simulatorDestinations(value) {
     for (const raw of entries) {
       if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
       const device = raw;
-      if (device.isAvailable !== true || typeof device.udid !== "string")
+      const available = device.isAvailable === true;
+      if (!available && !includeUnavailable || typeof device.udid !== "string")
         continue;
       result.push({
         type: "SIMULATOR",
@@ -9957,7 +10498,8 @@ function simulatorDestinations(value) {
         name: typeof device.name === "string" ? device.name : device.udid,
         platform: "iOS Simulator",
         osVersion,
-        state: typeof device.state === "string" ? device.state : null
+        state: typeof device.state === "string" ? device.state : available ? null : "Unavailable",
+        available
       });
     }
   }
@@ -9977,7 +10519,7 @@ function nestedString(value, paths) {
   }
   return null;
 }
-function physicalDestinations(value) {
+function physicalDestinations(value, includeUnavailable = false) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return [];
   const result = value.result;
   const devices = result && typeof result === "object" && !Array.isArray(result) ? result.devices : null;
@@ -9998,7 +10540,8 @@ function physicalDestinations(value) {
       ["connectionProperties", "tunnelState"],
       ["deviceProperties", "connectionState"]
     ]);
-    if (state && /(disconnected|unavailable|not.?connected)/i.test(state)) {
+    const available = !(state && /(disconnected|unavailable|not.?connected|offline)/i.test(state));
+    if (!available && !includeUnavailable) {
       return [];
     }
     return [
@@ -10011,37 +10554,13 @@ function physicalDestinations(value) {
           ["deviceProperties", "osVersionNumber"],
           ["deviceProperties", "osVersion"]
         ]),
-        state
+        state,
+        available
       }
     ];
   });
 }
-function genericBuildDestinations(action) {
-  if (!GENERIC_BUILD_DESTINATION_ACTIONS.includes(action)) return [];
-  const physical = {
-    type: "PHYSICAL_DEVICE",
-    id: "generic-ios",
-    name: "Any Physical iOS Device",
-    platform: "iOS",
-    osVersion: null,
-    state: null,
-    generic: true
-  };
-  if (action === "ARCHIVE") return [physical];
-  return [
-    {
-      type: "SIMULATOR",
-      id: "generic-ios-simulator",
-      name: "Any iOS Simulator",
-      platform: "iOS Simulator",
-      osVersion: null,
-      state: null,
-      generic: true
-    },
-    physical
-  ];
-}
-async function listPhysicalDevices(timeoutMs, signal) {
+async function listPhysicalDevices(timeoutMs, signal, includeUnavailable = false) {
   const directory = await mkdtemp2(join3(tmpdir2(), "ade-devices-"));
   const output = join3(directory, "devices.json");
   try {
@@ -10061,7 +10580,10 @@ async function listPhysicalDevices(timeoutMs, signal) {
       signal
     );
     if (result.exitCode !== 0) return [];
-    return physicalDestinations(JSON.parse(await readFile2(output, "utf8")));
+    return physicalDestinations(
+      JSON.parse(await readFile2(output, "utf8")),
+      includeUnavailable
+    );
   } finally {
     await rm3(directory, { recursive: true, force: true });
   }
@@ -10069,24 +10591,7 @@ async function listPhysicalDevices(timeoutMs, signal) {
 var inspectBuildDestinations = async (payload, timeoutMs, signal) => {
   const input = parseBuildDestinationsPayload(payload);
   const folder = await validateWorktree(input, timeoutMs, signal);
-  const absolutePath = await validateSource(folder, input.source);
-  const preflight = await command(
-    "xcrun",
-    [
-      "xcodebuild",
-      ...sourceArguments(input.source, absolutePath),
-      "-scheme",
-      input.scheme,
-      "-configuration",
-      input.configuration,
-      "-showBuildSettings",
-      "-json"
-    ],
-    Math.min(timeoutMs, 6e4),
-    signal,
-    folder
-  );
-  requireSuccess(preflight, "The saved scheme or configuration is unavailable");
+  await validateSource(folder, input.source);
   const [simulators, physical] = await Promise.all([
     command(
       "xcrun",
@@ -10112,7 +10617,7 @@ var inspectBuildRunDestinations = async (payload, timeoutMs, signal) => {
   if (input.destinationType === "SIMULATOR") {
     const simulators = await command(
       "xcrun",
-      ["simctl", "list", "devices", "available", "-j"],
+      ["simctl", "list", "devices", "-j"],
       Math.min(timeoutMs, 3e4),
       signal,
       folder
@@ -10120,12 +10625,33 @@ var inspectBuildRunDestinations = async (payload, timeoutMs, signal) => {
     requireSuccess(simulators, "Could not inspect available simulators");
     return {
       ...successfulProcess,
-      destinations: simulatorDestinations(JSON.parse(simulators.stdout))
+      destinations: simulatorDestinations(JSON.parse(simulators.stdout), true)
     };
   }
   return {
     ...successfulProcess,
-    destinations: await listPhysicalDevices(timeoutMs, signal)
+    destinations: await listPhysicalDevices(timeoutMs, signal, true)
+  };
+};
+var inspectAgentBuildRunDestinations = async (payload, timeoutMs, signal) => {
+  const input = parseBuildAgentRunDestinationsPayload(payload);
+  if (input.destinationType === "SIMULATOR") {
+    const simulators = await command(
+      "xcrun",
+      ["simctl", "list", "devices", "-j"],
+      Math.min(timeoutMs, 3e4),
+      signal,
+      process.cwd()
+    );
+    requireSuccess(simulators, "Could not inspect available simulators");
+    return {
+      ...successfulProcess,
+      destinations: simulatorDestinations(JSON.parse(simulators.stdout), true)
+    };
+  }
+  return {
+    ...successfulProcess,
+    destinations: await listPhysicalDevices(timeoutMs, signal, true)
   };
 };
 function sensitiveValues(env) {
@@ -10897,8 +11423,8 @@ async function writeJsonReport(input, kind, timeoutMs, signal) {
       ),
       `Could not generate ${filename}`
     );
-    const serialized = await readFile2(temporary, "utf8");
-    const parsed = JSON.parse(serialized);
+    const serialized2 = await readFile2(temporary, "utf8");
+    const parsed = JSON.parse(serialized2);
     const normalized = kind === "TEST_RESULTS" ? normalizeTestResults(parsed) : normalizeCoverage(parsed);
     await rename2(temporary, destination);
     return {
@@ -11246,7 +11772,10 @@ async function captureArtifacts(input, folder, signal, includeProducts = true) {
         await artifact(input.artifactDirectory, "RUNNABLE_APP", destination, {
           bundleIdentifier: settings.PRODUCT_BUNDLE_IDENTIFIER ?? null,
           target: apps[0].target,
-          destinationType: input.destination.type
+          destinationType: input.destination.type,
+          architectures: (settings.ARCHS ?? settings.VALID_ARCHS ?? "").split(/\s+/).filter(Boolean),
+          minimumOSVersion: settings.IPHONEOS_DEPLOYMENT_TARGET ?? null,
+          sdkName: settings.SDK_NAME ?? null
         })
       );
     }
@@ -11325,6 +11854,7 @@ var runIosBuild = async (payload, timeoutMs, signal, onLog, context) => {
       telemetry: input.telemetry ?? null
     };
     let buildResult = null;
+    let preflightResult = null;
     let coverageChanges = [];
     let errorCode = null;
     let error = null;
@@ -11350,29 +11880,50 @@ var runIosBuild = async (payload, timeoutMs, signal, onLog, context) => {
       } catch (progressError) {
         logger.emit("PREPARING", "SYSTEM", cleanError(progressError));
       }
-      for (const script of [...input.scripts].sort(
-        (a, b) => a.position - b.position
-      )) {
-        if (!script.preBuildScript) continue;
-        const execution = await runHook({
-          input,
-          folder,
-          script,
-          phase: "PRE_BUILD",
-          source: script.preBuildScript,
-          contextPath,
-          hookContext: baseHookContext,
+      if (!signal.aborted) {
+        preflightResult = await runLoggedCommand({
+          command: "xcrun",
+          args: xcodeBuildSettingsArguments(input, folder),
+          cwd: folder,
+          env: xcodeEnvironment(),
+          timeoutMs: Math.min(timeoutMs, 6e4),
+          signal,
           logger,
-          signal
+          phase: "PREFLIGHT"
         });
-        scriptExecutions.push(execution);
-        if (execution.causedBuildFailure) {
+        if (preflightResult.exitCode !== 0 && !preflightResult.cancelled) {
           failBuild = true;
-          errorCode = "SCRIPT_FAILED";
-          error = execution.error;
-          break;
+          errorCode = preflightResult.timedOut ? "TIMEOUT" : classifyFailure(preflightResult.output);
+          error = cleanError(
+            preflightResult.output || "The saved scheme, configuration, or destination is unavailable"
+          );
+        }
+      }
+      if (!failBuild && !signal.aborted) {
+        for (const script of [...input.scripts].sort(
+          (a, b) => a.position - b.position
+        )) {
+          if (!script.preBuildScript) continue;
+          const execution = await runHook({
+            input,
+            folder,
+            script,
+            phase: "PRE_BUILD",
+            source: script.preBuildScript,
+            contextPath,
+            hookContext: baseHookContext,
+            logger,
+            signal
+          });
+          scriptExecutions.push(execution);
+          if (execution.causedBuildFailure) {
+            failBuild = true;
+            errorCode = "SCRIPT_FAILED";
+            error = execution.error;
+            break;
+          }
+          if (signal.aborted) break;
         }
-        if (signal.aborted) break;
       }
       if (!failBuild && !signal.aborted) {
         try {
@@ -11430,7 +11981,7 @@ var runIosBuild = async (payload, timeoutMs, signal, onLog, context) => {
               ...baseHookContext,
               buildFolder: input.artifactDirectory,
               failed: failBuild || !signal.aborted && buildResult !== null && buildResult.exitCode !== 0,
-              cancelled: signal.aborted || buildResult?.cancelled === true,
+              cancelled: signal.aborted || preflightResult?.cancelled === true || buildResult?.cancelled === true,
               errorCode,
               error
             },
@@ -11466,7 +12017,7 @@ var runIosBuild = async (payload, timeoutMs, signal, onLog, context) => {
     }
     const reports = [];
     const testAction = ["TEST", "TEST_WITHOUT_BUILDING"].includes(input.action);
-    const canGenerateReports = () => !signal.aborted && buildResult?.cancelled !== true && buildResult?.timedOut !== true;
+    const canGenerateReports = () => !signal.aborted && buildResult !== null && !buildResult.cancelled && !buildResult.timedOut;
     if (canGenerateReports() && testAction && input.advancedSettings.parseTestResults) {
       const report = await writeJsonReport(
         input,
@@ -11510,8 +12061,8 @@ var runIosBuild = async (payload, timeoutMs, signal, onLog, context) => {
         await artifact(input.artifactDirectory, "RAW_LOG", rawLog)
       );
     }
-    const cancelled = signal.aborted || buildResult?.cancelled === true;
-    const timedOut = buildResult?.timedOut === true;
+    const cancelled = signal.aborted || preflightResult?.cancelled === true || buildResult?.cancelled === true;
+    const timedOut = preflightResult?.timedOut === true || buildResult?.timedOut === true;
     const exitCode = cancelled ? null : failBuild || !buildResult ? 1 : buildResult.exitCode;
     const args = xcodeBuildArguments(input);
     const finalStateHash = await worktreeCodeStateHash(
@@ -11522,7 +12073,7 @@ var runIosBuild = async (payload, timeoutMs, signal, onLog, context) => {
     const codeStateObservedAt = (/* @__PURE__ */ new Date()).toISOString();
     return {
       exitCode,
-      signal: buildResult?.signal ?? null,
+      signal: buildResult?.signal ?? preflightResult?.signal ?? null,
       timedOut,
       cancelled,
       errorCode,
@@ -11633,6 +12184,67 @@ var downloadIosBuildArtifact = async (payload, timeoutMs, signal, onLog, context
     }
   }
 };
+var uploadTransferredIosBuildArtifact = async (payload, timeoutMs, signal, onLog, context) => {
+  const input = parseBuildArtifactTransferUploadPayload(payload);
+  if (!context?.uploadBuildArtifactTransfer) {
+    throw new Error("This agent cannot upload transferred build artifacts");
+  }
+  const root = await realpath2(input.artifactDirectory);
+  const target2 = await realpath2(
+    containedPath2(root, input.artifactRelativePath)
+  );
+  const difference = relative3(root, target2);
+  if (!difference || difference === ".." || difference.startsWith(`..${sep3}`) || isAbsolute3(difference)) {
+    throw new Error("Build artifact resolves outside the build folder");
+  }
+  const information = await stat2(target2);
+  let uploadPath = target2;
+  let filename = basename2(target2);
+  let contentType = "application/octet-stream";
+  let temporaryArchive = null;
+  try {
+    if (information.isDirectory()) {
+      temporaryArchive = join3(
+        tmpdir2(),
+        `ade-build-transfer-${input.transferId}-${randomUUID()}.tar.gz`
+      );
+      requireSuccess(
+        await command(
+          "tar",
+          ["-czf", temporaryArchive, "-C", dirname2(target2), basename2(target2)],
+          timeoutMs,
+          signal
+        ),
+        "Could not package the runnable app"
+      );
+      uploadPath = temporaryArchive;
+      filename = `${filename}.tar.gz`;
+      contentType = "application/gzip";
+    } else if (!information.isFile()) {
+      throw new Error("Build artifact is not transferable");
+    }
+    const checksum = await fileChecksum(uploadPath);
+    if (!checksum)
+      throw new Error("Could not checksum the runnable app archive");
+    await onLog({
+      sequence: 0,
+      stream: "SYSTEM",
+      message: `Uploading ${filename} in resumable 16 MiB chunks`,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    await context.uploadBuildArtifactTransfer({
+      transferId: input.transferId,
+      path: uploadPath,
+      filename,
+      contentType,
+      checksum,
+      signal
+    });
+    return successfulProcess;
+  } finally {
+    if (temporaryArchive) await rm3(temporaryArchive, { force: true });
+  }
+};
 async function runSimpleLogged(logger, options) {
   return runLoggedCommand({
     command: "xcrun",
@@ -11651,17 +12263,7 @@ async function runSimpleLogged(logger, options) {
 function simulatorAppArguments(destinationId) {
   return ["-a", "Simulator", "--args", "-CurrentDeviceUDID", destinationId];
 }
-var deployIosBuild = async (payload, timeoutMs, signal, _onLog, context) => {
-  const input = parseBuildDeploymentPayload(payload);
-  const folder = await validateWorktree(
-    input,
-    Math.min(timeoutMs, 6e4),
-    signal
-  );
-  const appPath = containedPath2(
-    input.artifactDirectory,
-    input.artifactRelativePath
-  );
+async function deployPreparedIosBuild(input, folder, appPath, timeoutMs, signal, context) {
   if (!await pathExists(appPath) || !appPath.endsWith(".app")) {
     throw new Error("Runnable app artifact is missing");
   }
@@ -11851,6 +12453,99 @@ var deployIosBuild = async (payload, timeoutMs, signal, _onLog, context) => {
   } finally {
     await logger.close();
   }
+}
+var deployIosBuild = async (payload, timeoutMs, signal, _onLog, context) => {
+  const input = parseBuildDeploymentPayload(payload);
+  const folder = await validateWorktree(
+    input,
+    Math.min(timeoutMs, 6e4),
+    signal
+  );
+  const appPath = containedPath2(
+    input.artifactDirectory,
+    input.artifactRelativePath
+  );
+  return deployPreparedIosBuild(
+    input,
+    folder,
+    appPath,
+    timeoutMs,
+    signal,
+    context
+  );
+};
+async function createRemoteBuildStagingDirectory(buildId) {
+  return realpath2(
+    await mkdtemp2(join3(tmpdir2(), `ade-remote-build-${buildId}-`))
+  );
+}
+var deployTransferredIosBuild = async (payload, timeoutMs, signal, onLog, context) => {
+  const input = parseBuildRemoteDeploymentPayload(payload);
+  if (!context?.downloadBuildArtifactTransfer) {
+    throw new Error("This agent cannot download transferred build artifacts");
+  }
+  const staging = await createRemoteBuildStagingDirectory(input.buildId);
+  const archive = join3(staging, "artifact.tar.gz");
+  try {
+    await onLog({
+      sequence: 0,
+      stream: "SYSTEM",
+      message: "Waiting for the relayed build artifact",
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    await context.downloadBuildArtifactTransfer({
+      transferId: input.transferId,
+      path: archive,
+      signal
+    });
+    const listing = await command(
+      "tar",
+      ["-tzf", archive],
+      Math.min(timeoutMs, 12e4),
+      signal,
+      staging
+    );
+    requireSuccess(listing, "Transferred build archive is malformed");
+    const entries = listing.stdout.split("\n").map((entry) => entry.trim().replace(/^\.\//, "")).filter(Boolean);
+    if (!entries.length || entries.some(
+      (entry) => entry.startsWith("/") || entry.split("/").some((component) => component === "..")
+    )) {
+      throw new Error("Transferred build archive contains an unsafe path");
+    }
+    const roots = new Set(entries.map((entry) => entry.split("/")[0]));
+    const root = [...roots][0];
+    if (roots.size !== 1 || !root?.endsWith(".app")) {
+      throw new Error("Transferred build archive must contain one app bundle");
+    }
+    requireSuccess(
+      await command(
+        "tar",
+        ["-xzf", archive, "-C", staging],
+        Math.min(timeoutMs, 12e4),
+        signal,
+        staging
+      ),
+      "Could not extract the transferred app"
+    );
+    const appPath = await realpath2(join3(staging, root));
+    const pathDifference = relative3(staging, appPath);
+    if (pathDifference === ".." || pathDifference.startsWith(`..${sep3}`) || isAbsolute3(pathDifference)) {
+      throw new Error("Transferred app resolves outside its staging directory");
+    }
+    return await deployPreparedIosBuild(
+      {
+        ...input,
+        artifactDirectory: staging
+      },
+      staging,
+      appPath,
+      timeoutMs,
+      signal,
+      context
+    );
+  } finally {
+    await rm3(staging, { recursive: true, force: true });
+  }
 };
 function exportPlist(settings) {
   const method = {
@@ -15174,7 +15869,7 @@ var runWorkflowGitCheckpoint = async (payloadValue, _timeoutMs, signal) => {
 
 // src/handlers/worktrees.ts
 import { createWriteStream as createWriteStream2, watch } from "node:fs";
-import { mkdtemp as mkdtemp6, open as open2, readFile as readFile9, realpath as realpath9, rm as rm10, stat as stat10 } from "node:fs/promises";
+import { mkdtemp as mkdtemp6, open as open3, readFile as readFile9, realpath as realpath9, rm as rm10, stat as stat10 } from "node:fs/promises";
 import { tmpdir as tmpdir6 } from "node:os";
 import { basename as basename5, dirname as dirname8, isAbsolute as isAbsolute7, join as join14, relative as relative8 } from "node:path";
 import { spawn as spawn7 } from "node:child_process";
@@ -16438,7 +17133,7 @@ function requestedDiffPaths(input) {
   return [input.path];
 }
 async function readBoundedFile(path, limit) {
-  const file = await open2(path, "r");
+  const file = await open3(path, "r");
   try {
     const metadata = await file.stat();
     if (!metadata.isFile()) throw new Error("Changed path is not a file");
@@ -18385,6 +19080,280 @@ var autoSyncWorktree = async (payload, timeoutMs, signal) => {
   };
 };
 
+// src/handlers/tailscale.ts
+import { accessSync as accessSync2, constants as constants2 } from "node:fs";
+var MAX_OUTPUT_BYTES2 = 2 * 1024 * 1024;
+var mutationQueues = /* @__PURE__ */ new Map();
+function objectValue14(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function resolveTailscaleExecutable(platform2 = process.platform, resolve12 = findExecutable, isExecutable2 = (path) => {
+  accessSync2(path, constants2.X_OK);
+  return true;
+}) {
+  const resolved = resolve12("tailscale", {
+    overrideVariable: "CONTROL_AGENT_TAILSCALE_EXECUTABLE"
+  });
+  if (resolved) return resolved;
+  if (platform2 === "darwin") {
+    for (const path of [
+      "/Applications/Tailscale.app/Contents/MacOS/Tailscale",
+      "/Applications/Tailscale.app/Contents/MacOS/tailscale"
+    ]) {
+      try {
+        if (isExecutable2(path)) return path;
+      } catch {
+      }
+    }
+  }
+  throw new Error(
+    "Tailscale CLI was not found. Install Tailscale or set CONTROL_AGENT_TAILSCALE_EXECUTABLE."
+  );
+}
+function parseTailscaleJson(value, label) {
+  try {
+    const parsed = JSON.parse(value);
+    const object = objectValue14(parsed);
+    if (!object) throw new Error("expected an object");
+    return object;
+  } catch (error) {
+    throw new Error(
+      `${label} returned malformed JSON: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+function tailscaleCommandFailure(command3, result) {
+  const reason = result.timedOut ? "timed out" : result.cancelled ? "was cancelled" : result.stderr.trim() || `exited with status ${result.exitCode}`;
+  return new Error(`${command3} failed: ${reason}`);
+}
+async function captureTailscale(executable, args, timeoutMs, signal) {
+  const result = await captureCommand({
+    command: executable,
+    args,
+    timeoutMs,
+    signal,
+    maxOutputBytes: MAX_OUTPUT_BYTES2
+  });
+  if (result.outputTruncated) {
+    throw new Error(`tailscale ${args.join(" ")} exceeded the output limit`);
+  }
+  if (result.exitCode !== 0) {
+    throw tailscaleCommandFailure(`tailscale ${args.join(" ")}`, result);
+  }
+  return result;
+}
+function backendIdentity(status2) {
+  const self2 = objectValue14(status2.Self);
+  const rawAddresses = Array.isArray(self2?.TailscaleIPs) ? self2.TailscaleIPs : status2.TailscaleIPs;
+  const addresses = Array.isArray(rawAddresses) ? rawAddresses.filter((value) => typeof value === "string") : [];
+  const dnsName = typeof self2?.DNSName === "string" ? self2.DNSName : null;
+  return {
+    dnsHostname: dnsName?.replace(/\.$/, "") ?? null,
+    ipv4: addresses.filter((value) => value.includes(".")),
+    ipv6: addresses.filter((value) => value.includes(":")),
+    backendState: typeof status2.BackendState === "string" ? status2.BackendState : "Unknown"
+  };
+}
+function destinationFromProxy(proxy) {
+  const parsed = new URL(proxy);
+  if (parsed.hostname !== "127.0.0.1") {
+    throw new Error("Only 127.0.0.1 Tailscale Serve targets are managed");
+  }
+  const rawProtocol = parsed.protocol.replace(/:$/, "");
+  const protocol = rawProtocol === "https+insecure" ? "HTTPS_INSECURE" : rawProtocol === "https" ? "HTTPS" : rawProtocol === "tcp" ? "TCP" : "HTTP";
+  return {
+    protocol,
+    port: Number(parsed.port),
+    path: protocol === "TCP" ? "" : parsed.pathname === "/" ? "" : parsed.pathname
+  };
+}
+function portFromListener(value) {
+  const match = value.match(/:(\d+)$/) ?? value.match(/^(\d+)$/);
+  return match ? Number(match[1]) : null;
+}
+function normalizeTailscaleServeSnapshot(status2, serve, inspectedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+  const routes = [];
+  const tcp = objectValue14(serve.TCP) ?? {};
+  const web = objectValue14(serve.Web) ?? {};
+  const funnel = objectValue14(serve.AllowFunnel) ?? {};
+  for (const [listener, rawWeb] of Object.entries(web)) {
+    const listenPort = portFromListener(listener);
+    const webConfig = objectValue14(rawWeb);
+    const handlers2 = objectValue14(webConfig?.Handlers);
+    if (!listenPort || !handlers2) continue;
+    const tcpConfig = objectValue14(tcp[String(listenPort)]);
+    const protocol = tcpConfig?.HTTPS === true ? "HTTPS" : "HTTP";
+    const isFunnel = Object.entries(funnel).some(
+      ([key, enabled]) => enabled === true && portFromListener(key) === listenPort
+    );
+    for (const [mountPath, rawHandler] of Object.entries(handlers2)) {
+      const handler = objectValue14(rawHandler);
+      if (!handler || typeof handler.Proxy !== "string") continue;
+      const capabilities = Array.isArray(handler.AcceptAppCaps) ? handler.AcceptAppCaps.filter(
+        (value) => typeof value === "string"
+      ) : [];
+      try {
+        routes.push(
+          parseTailscaleServeRoute({
+            protocol,
+            listenPort,
+            mountPath,
+            destination: destinationFromProxy(handler.Proxy),
+            funnel: isFunnel,
+            appCapabilities: capabilities,
+            proxyProtocol: "NONE"
+          })
+        );
+      } catch {
+      }
+    }
+  }
+  for (const [listener, rawTcp] of Object.entries(tcp)) {
+    const listenPort = portFromListener(listener);
+    const config = objectValue14(rawTcp);
+    if (!listenPort || !config || typeof config.TCPForward !== "string")
+      continue;
+    const destination = config.TCPForward.startsWith("tcp://") ? config.TCPForward : `tcp://${config.TCPForward}`;
+    const proxy = config.ProxyProtocol;
+    try {
+      routes.push(
+        parseTailscaleServeRoute({
+          protocol: config.TerminateTLS ? "TLS_TERMINATED_TCP" : "TCP",
+          listenPort,
+          mountPath: "/",
+          destination: destinationFromProxy(destination),
+          funnel: Object.entries(funnel).some(
+            ([key, enabled]) => enabled === true && portFromListener(key) === listenPort
+          ),
+          appCapabilities: [],
+          proxyProtocol: proxy === 1 || proxy === "1" || proxy === "V1" ? "V1" : proxy === 2 || proxy === "2" || proxy === "V2" ? "V2" : "NONE"
+        })
+      );
+    } catch {
+    }
+  }
+  return {
+    identity: backendIdentity(status2),
+    routes: routes.sort(
+      (first, second) => `${first.listenPort}:${first.mountPath}`.localeCompare(
+        `${second.listenPort}:${second.mountPath}`
+      )
+    ),
+    inspectedAt
+  };
+}
+async function inspect(executable, timeoutMs, signal) {
+  const status2 = await captureTailscale(
+    executable,
+    ["status", "--json"],
+    timeoutMs,
+    signal
+  );
+  const serve = await captureTailscale(
+    executable,
+    ["serve", "status", "--json"],
+    timeoutMs,
+    signal
+  );
+  return normalizeTailscaleServeSnapshot(
+    parseTailscaleJson(status2.stdout, "tailscale status --json"),
+    parseTailscaleJson(serve.stdout, "tailscale serve status --json")
+  );
+}
+function listenerArguments(route) {
+  const flag = route.protocol === "TLS_TERMINATED_TCP" ? "tls-terminated-tcp" : route.protocol.toLowerCase();
+  return [
+    `--${flag}=${route.listenPort}`,
+    ...route.protocol === "HTTP" || route.protocol === "HTTPS" ? [`--set-path=${route.mountPath}`] : []
+  ];
+}
+function routeTarget(route) {
+  const scheme = route.destination.protocol === "HTTPS_INSECURE" ? "https+insecure" : route.destination.protocol.toLowerCase();
+  return `${scheme}://127.0.0.1:${route.destination.port}${route.destination.path}`;
+}
+function tailscaleUpsertArguments(route) {
+  const normalized = parseTailscaleServeRoute(route);
+  return [
+    normalized.funnel ? "funnel" : "serve",
+    "--bg",
+    "--yes",
+    ...listenerArguments(normalized),
+    ...normalized.appCapabilities.length ? [`--accept-app-caps=${normalized.appCapabilities.join(",")}`] : [],
+    ...normalized.proxyProtocol === "NONE" ? [] : [`--proxy-protocol=${normalized.proxyProtocol === "V1" ? "1" : "2"}`],
+    routeTarget(normalized)
+  ];
+}
+function tailscaleRemoveArguments(route) {
+  const normalized = parseTailscaleServeRoute(route);
+  return [
+    normalized.funnel ? "funnel" : "serve",
+    ...listenerArguments(normalized),
+    "off"
+  ];
+}
+function tailscaleUpsertCommandSequence(route, previousRoute) {
+  return [
+    ...previousRoute && JSON.stringify(previousRoute) !== JSON.stringify(route) ? [tailscaleRemoveArguments(previousRoute)] : [],
+    tailscaleUpsertArguments(route)
+  ];
+}
+async function serialized(agentId, work) {
+  const previous = mutationQueues.get(agentId) ?? Promise.resolve();
+  let release2;
+  const current = new Promise((resolve12) => {
+    release2 = resolve12;
+  });
+  const tail = previous.then(() => current);
+  mutationQueues.set(agentId, tail);
+  await previous;
+  try {
+    return await work();
+  } finally {
+    release2();
+    if (mutationQueues.get(agentId) === tail) mutationQueues.delete(agentId);
+  }
+}
+function success2(snapshot) {
+  return {
+    exitCode: 0,
+    signal: null,
+    timedOut: false,
+    cancelled: false,
+    snapshot
+  };
+}
+var inspectTailscaleServe = async (rawPayload, timeoutMs, signal) => {
+  tailscaleServeInspectPayload(rawPayload);
+  const executable = resolveTailscaleExecutable();
+  return success2(await inspect(executable, timeoutMs, signal));
+};
+var upsertTailscaleServe = async (rawPayload, timeoutMs, signal, _onLog, context) => {
+  const payload = tailscaleServeUpsertPayload(rawPayload);
+  const executable = resolveTailscaleExecutable();
+  return serialized(context?.agentId ?? "default", async () => {
+    for (const args of tailscaleUpsertCommandSequence(
+      payload.route,
+      payload.previousRoute
+    )) {
+      await captureTailscale(executable, args, timeoutMs, signal);
+    }
+    return success2(await inspect(executable, timeoutMs, signal));
+  });
+};
+var removeTailscaleServe = async (rawPayload, timeoutMs, signal, _onLog, context) => {
+  const payload = tailscaleServeRemovePayload(rawPayload);
+  const executable = resolveTailscaleExecutable();
+  return serialized(context?.agentId ?? "default", async () => {
+    await captureTailscale(
+      executable,
+      tailscaleRemoveArguments(payload.route),
+      timeoutMs,
+      signal
+    );
+    return success2(await inspect(executable, timeoutMs, signal));
+  });
+};
+
 // src/handlers/index.ts
 var handlers = {
   [CLI_HEALTH_JOB_KIND]: runCliHealth,
@@ -18423,10 +19392,13 @@ var handlers = {
   [IOS_SOURCE_PARSE_JOB_KIND]: parseBuildSourceMetadata,
   [IOS_DESTINATIONS_JOB_KIND]: inspectBuildDestinations,
   [IOS_RUN_DESTINATIONS_JOB_KIND]: inspectBuildRunDestinations,
+  [IOS_AGENT_RUN_DESTINATIONS_JOB_KIND]: inspectAgentBuildRunDestinations,
   [IOS_BUILD_JOB_KIND]: runIosBuild,
   [IOS_BUILD_DELETE_JOB_KIND]: deleteIosBuild,
   [IOS_ARTIFACT_DOWNLOAD_JOB_KIND]: downloadIosBuildArtifact,
+  [IOS_ARTIFACT_TRANSFER_UPLOAD_JOB_KIND]: uploadTransferredIosBuildArtifact,
   [IOS_DEPLOY_JOB_KIND]: deployIosBuild,
+  [IOS_REMOTE_DEPLOY_JOB_KIND]: deployTransferredIosBuild,
   [IOS_EXPORT_JOB_KIND]: exportIosArchive,
   [IOS_TEST_RESULTS_JOB_KIND]: generateIosBuildReport,
   [IOS_COVERAGE_REPORT_JOB_KIND]: generateIosBuildReport,
@@ -18437,7 +19409,10 @@ var handlers = {
   [SIGNING_PROFILE_INSTALL_JOB_KIND]: installSigningProfile,
   [SIGNING_PROFILE_DELETE_JOB_KIND]: deleteSigningProfile,
   [SIGNING_IDENTITY_IMPORT_JOB_KIND]: importSigningIdentity,
-  [SIGNING_IDENTITY_DELETE_JOB_KIND]: deleteSigningIdentity
+  [SIGNING_IDENTITY_DELETE_JOB_KIND]: deleteSigningIdentity,
+  [TAILSCALE_SERVE_INSPECT_JOB_KIND]: inspectTailscaleServe,
+  [TAILSCALE_SERVE_UPSERT_JOB_KIND]: upsertTailscaleServe,
+  [TAILSCALE_SERVE_REMOVE_JOB_KIND]: removeTailscaleServe
 };
 
 // src/repository-coordinator.ts
@@ -18520,6 +19495,8 @@ var JobExecutor = class {
           reportBuildProgress: (input) => this.client.reportBuildProgress(input),
           appendBuildLogChunks: (buildId, chunks) => this.client.appendBuildLogChunks(buildId, chunks),
           uploadBuildArtifact: (input) => this.client.uploadBuildArtifact(input),
+          uploadBuildArtifactTransfer: (input) => this.client.uploadBuildArtifactTransfer(input),
+          downloadBuildArtifactTransfer: (input) => this.client.downloadBuildArtifactTransfer(input),
           claimSigningSecretTransfer: (transferId) => this.client.claimSigningSecretTransfer(transferId),
           claimWorkflowJobSecrets: () => this.client.claimWorkflowJobSecrets(claimed.id),
           appendCommandOutput: (attemptId, chunks) => this.client.appendCommandOutput(claimed.id, attemptId, chunks)
@@ -52441,8 +53418,8 @@ var ClaudeAdapter = class {
               dir: worktree.folder,
               limit: 500
             });
-            const serialized = JSON.stringify(history);
-            if (serialized.includes('"permissionMode":"plan"')) kind = "PLAN";
+            const serialized2 = JSON.stringify(history);
+            if (serialized2.includes('"permissionMode":"plan"')) kind = "PLAN";
             finalOutput = firstString([...history].reverse());
             this.hydrationCache.set(session.sessionId, {
               lastModified: lastModifiedKey,
@@ -53008,8 +53985,8 @@ var CodexAdapter = class {
                   })
                 );
                 const hydrated = asRecord(detail.thread);
-                const serialized = JSON.stringify(hydrated.turns ?? []);
-                if (serialized.includes('"type":"plan"')) kind = "PLAN";
+                const serialized2 = JSON.stringify(hydrated.turns ?? []);
+                if (serialized2.includes('"type":"plan"')) kind = "PLAN";
                 finalOutput = firstString(
                   Array.isArray(hydrated.turns) ? [...hydrated.turns].reverse() : []
                 );
@@ -60376,15 +61353,6 @@ var defaultDependencies = {
     signal.addEventListener("abort", onAbort, { once: true });
   })
 };
-function assertLoopbackServer(server) {
-  const hostname2 = new URL(server).hostname.toLowerCase();
-  const isIpv4Loopback = /^127(?:\.\d{1,3}){3}$/.test(hostname2);
-  if (hostname2 !== "localhost" && hostname2 !== "[::1]" && !isIpv4Loopback) {
-    throw new Error(
-      `Development auto-enrollment is restricted to loopback servers; received ${hostname2}`
-    );
-  }
-}
 async function waitForServer(client2, timeoutMs, signal, dependencies) {
   const deadline = Date.now() + timeoutMs;
   let lastError;
@@ -60398,17 +61366,18 @@ async function waitForServer(client2, timeoutMs, signal, dependencies) {
     }
   }
   const detail = lastError instanceof Error ? `: ${lastError.message}` : "";
-  throw new Error(`Timed out waiting for the local control plane${detail}`);
+  throw new Error(
+    `Timed out waiting for the development control plane${detail}`
+  );
 }
 async function prepareDevelopmentAgent(options, signal, dependencies = defaultDependencies) {
   const server = normalizeServer(options.server);
-  assertLoopbackServer(server);
   const websocketServer = options.websocketServer ?? defaultWebSocketServer(server);
   const configFile = options.configFile ?? developmentConfigPath();
   const inventory = dependencies.inventory();
   const name = options.name ?? `${inventory.hostname}-dev`;
   const anonymousClient = dependencies.createClient(server);
-  console.log(`Waiting for local control plane at ${server} ...`);
+  console.log(`Waiting for development control plane at ${server} ...`);
   await waitForServer(
     anonymousClient,
     options.waitTimeoutMs ?? DEFAULT_SERVER_WAIT_MS,