@jmanuelcorral/openteam 0.1.24 → 0.1.26

package/dist/cli.js

@@ -1,11 +1,307 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { execFile } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import { access, mkdir as mkdir2, readdir, readFile, writeFile as writeFile2 } from "node:fs/promises";
 import { dirname as dirname2, join as join2 } from "node:path";
 import { promisify } from "node:util";
 
+// src/cli/consoleServe.ts
+import { randomBytes } from "node:crypto";
+
+// src/console/protocol.ts
+import { z } from "zod";
+var MAX_INPUT_CHARS = 1e5;
+var SessionInputSchema = z.object({
+  text: z.string().min(1).max(MAX_INPUT_CHARS)
+});
+function parseSessionInput(raw) {
+  const result = SessionInputSchema.safeParse(raw);
+  return result.success ? result.data : undefined;
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null ? value : undefined;
+}
+function str(value) {
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function eventSessionID(event) {
+  const props = asRecord(event.properties);
+  if (props === undefined) {
+    return;
+  }
+  return str(props.sessionID) ?? str(asRecord(props.part)?.sessionID) ?? str(asRecord(props.info)?.sessionID);
+}
+function eventToSessionFrame(event, sessionID) {
+  if (eventSessionID(event) !== sessionID) {
+    return;
+  }
+  const props = asRecord(event.properties) ?? {};
+  switch (event.type) {
+    case "message.part.updated": {
+      const part = asRecord(props.part);
+      if (part === undefined) {
+        return;
+      }
+      if (part.type === "text") {
+        const text = str(part.text);
+        return text === undefined ? undefined : { kind: "text", text };
+      }
+      if (part.type === "tool") {
+        const tool = str(part.tool) ?? "tool";
+        const status = str(asRecord(part.state)?.status) ?? "run";
+        return { kind: "tool", text: `⚙ ${tool} · ${status}` };
+      }
+      return;
+    }
+    case "session.idle":
+      return { kind: "status", text: "● sesión lista" };
+    case "session.error": {
+      const message = str(asRecord(props.error)?.message) ?? "error de sesión";
+      return { kind: "error", text: `✖ ${message}` };
+    }
+    case "permission.updated": {
+      const title = str(props.title) ?? "permiso solicitado";
+      const id = str(props.id);
+      const frame = { kind: "permission", text: `⚠ ${title}` };
+      if (id !== undefined) {
+        frame.permissionID = id;
+      }
+      return frame;
+    }
+    default:
+      return;
+  }
+}
+function frameToSse(frame) {
+  return `event: frame
+data: ${JSON.stringify(frame)}
+
+`;
+}
+
+// src/console/sse.ts
+function pushSse(buffer, chunk) {
+  const combined = (buffer + chunk).replace(/\r\n/g, `
+`);
+  const parts = combined.split(`
+
+`);
+  const rest = parts.pop() ?? "";
+  const messages = [];
+  for (const block of parts) {
+    if (block.length === 0) {
+      continue;
+    }
+    let event;
+    const dataLines = [];
+    for (const line of block.split(`
+`)) {
+      if (line.startsWith(":") || line.length === 0) {
+        continue;
+      }
+      if (line.startsWith("event:")) {
+        event = line.slice("event:".length).trimStart();
+      } else if (line.startsWith("data:")) {
+        dataLines.push(line.slice("data:".length).replace(/^ /, ""));
+      }
+    }
+    if (dataLines.length === 0 && event === undefined) {
+      continue;
+    }
+    const message = { data: dataLines.join(`
+`) };
+    if (event !== undefined) {
+      message.event = event;
+    }
+    messages.push(message);
+  }
+  return { messages, rest };
+}
+function parseEventData(data) {
+  if (data.length === 0) {
+    return;
+  }
+  try {
+    return JSON.parse(data);
+  } catch {
+    return;
+  }
+}
+
+// src/console/opencodeClient.ts
+function unwrapEvent(value) {
+  if (typeof value !== "object" || value === null) {
+    return;
+  }
+  const record = value;
+  const payload = typeof record.payload === "object" && record.payload !== null ? record.payload : record;
+  return typeof payload.type === "string" ? payload : undefined;
+}
+function messageToFrame(message, sessionID) {
+  const event = unwrapEvent(parseEventData(message.data));
+  return event === undefined ? undefined : eventToSessionFrame(event, sessionID);
+}
+function createConsoleClient(deps) {
+  const doFetch = deps.fetch ?? fetch;
+  const base = deps.endpoint.replace(/\/$/, "");
+  const authHeaders = deps.password !== undefined && deps.password.length > 0 ? { authorization: `Bearer ${deps.password}` } : {};
+  const post = async (path, body) => {
+    await doFetch(`${base}${path}`, {
+      method: "POST",
+      headers: { "content-type": "application/json", ...authHeaders },
+      body: JSON.stringify(body)
+    });
+  };
+  return {
+    async sendPrompt(sessionID, text) {
+      await post(`/session/${encodeURIComponent(sessionID)}/prompt_async`, {
+        parts: [{ type: "text", text }]
+      });
+    },
+    async respondPermission(sessionID, permissionID, response) {
+      await post(`/session/${encodeURIComponent(sessionID)}/permissions/${encodeURIComponent(permissionID)}`, { response });
+    },
+    async streamFrames(sessionID, onFrame, signal) {
+      const res = await doFetch(`${base}/global/event`, {
+        headers: { accept: "text/event-stream", ...authHeaders },
+        signal
+      });
+      const body = res.body;
+      if (body === null) {
+        return;
+      }
+      const reader = body.getReader();
+      const decoder = new TextDecoder;
+      let buffer = "";
+      try {
+        while (!signal.aborted) {
+          const { value, done } = await reader.read();
+          if (done) {
+            break;
+          }
+          const parsed = pushSse(buffer, decoder.decode(value, { stream: true }));
+          buffer = parsed.rest;
+          for (const message of parsed.messages) {
+            const frame = messageToFrame(message, sessionID);
+            if (frame !== undefined) {
+              onFrame(frame);
+            }
+          }
+        }
+      } finally {
+        reader.cancel().catch(() => {});
+      }
+    }
+  };
+}
+
+// src/console/pty.ts
+function asRecord2(value) {
+  return typeof value === "object" && value !== null ? value : undefined;
+}
+function str2(value) {
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function parsePtyInfo(raw) {
+  const record = asRecord2(raw);
+  const id = str2(record?.id);
+  if (record === undefined || id === undefined) {
+    return;
+  }
+  const info = { id };
+  const title = str2(record.title);
+  if (title !== undefined) {
+    info.title = title;
+  }
+  const status = str2(record.status);
+  if (status !== undefined) {
+    info.status = status;
+  }
+  return info;
+}
+function parseConnectToken(raw) {
+  const record = asRecord2(raw);
+  const ticket = str2(record?.ticket);
+  if (record === undefined || ticket === undefined) {
+    return;
+  }
+  const token = { ticket };
+  const expires = record.expires_in ?? record.expiresIn;
+  if (typeof expires === "number" && Number.isFinite(expires)) {
+    token.expiresIn = expires;
+  }
+  return token;
+}
+function buildPtyWsUrl(endpoint, ptyID, ticket) {
+  const base = endpoint.replace(/\/$/, "").replace(/^http/, "ws");
+  const id = encodeURIComponent(ptyID);
+  const t = encodeURIComponent(ticket);
+  return `${base}/pty/${id}/connect?ticket=${t}`;
+}
+function createPtyClient(deps) {
+  const doFetch = deps.fetch ?? fetch;
+  const base = deps.endpoint.replace(/\/$/, "");
+  const authHeaders = deps.password !== undefined && deps.password.length > 0 ? { authorization: `Bearer ${deps.password}` } : {};
+  const json = async (path, body) => {
+    const res = await doFetch(`${base}${path}`, {
+      method: "POST",
+      headers: { "content-type": "application/json", ...authHeaders },
+      ...body !== undefined ? { body: JSON.stringify(body) } : {}
+    });
+    if (!res.ok) {
+      return;
+    }
+    try {
+      return await res.json();
+    } catch {
+      return;
+    }
+  };
+  return {
+    async createPty(input) {
+      return parsePtyInfo(await json("/pty", input));
+    },
+    async connectToken(ptyID) {
+      return parseConnectToken(await json(`/pty/${encodeURIComponent(ptyID)}/connect-token`));
+    },
+    async closePty(ptyID) {
+      await doFetch(`${base}/pty/${encodeURIComponent(ptyID)}`, {
+        method: "DELETE",
+        headers: authHeaders
+      });
+    },
+    wsUrl(ptyID, ticket) {
+      return buildPtyWsUrl(deps.endpoint, ptyID, ticket);
+    }
+  };
+}
+
+// src/console/token.ts
+var HEX = "0123456789abcdef";
+function encodeToken(bytes) {
+  let out = "";
+  for (const byte of bytes) {
+    out += HEX[byte >> 4 & 15];
+    out += HEX[byte & 15];
+  }
+  return out;
+}
+function safeEqualToken(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let diff = 0;
+  for (let i = 0;i < a.length; i += 1) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
+function tokenFromQuery(query) {
+  const value = query?.get("token");
+  return value === null || value === undefined || value.length === 0 ? undefined : value;
+}
+
 // src/web/start.ts
 import { watch as fsWatch } from "node:fs";
 
@@ -18,7 +314,7 @@ import {
   createServer as createHttpServer
 } from "node:http";
 
-// src/dashboard/render.ts
+// src/console/render.ts
 var TIERS = [
   "trivial",
   "simple",
@@ -255,6 +551,84 @@ function meetingsPanel(meetings) {
     "</section>"
   ].join("");
 }
+var STATUS_LABELS = {
+  running: "activa",
+  idle: "en reposo",
+  "waiting-input": "esperando input",
+  ended: "finalizada"
+};
+function statusBadge(status) {
+  return `<span class="badge status-${status}">${STATUS_LABELS[status]}</span>`;
+}
+function tabBar(sessions) {
+  const allTab = '<button type="button" class="tab" data-tab="all">Todas</button>';
+  const tabs = sessions.map((tab) => {
+    const id = escapeHtml(tab.sessionID);
+    const short = escapeHtml(shortSessionID(tab.sessionID));
+    return `<button type="button" class="tab" data-tab="${id}"><span class="dot status-${tab.status}"></span>${short}</button>`;
+  }).join("");
+  return `<nav class="tabs" id="tabbar">${allTab}${tabs}</nav>`;
+}
+function shortSessionID(sessionID) {
+  return sessionID.length <= 12 ? sessionID : `${sessionID.slice(0, 12)}…`;
+}
+function sessionHeaderPanel(tab) {
+  const endpoint = tab.endpoint === undefined ? '<span class="muted">endpoint no anunciado</span>' : `<code>${escapeHtml(tab.endpoint.url)}</code>`;
+  const dir = tab.endpoint?.directory === undefined ? "" : `<div class="stat"><span class="k">Directorio</span><span class="v mono">${escapeHtml(tab.endpoint.directory)}</span></div>`;
+  const title = tab.endpoint?.title === undefined ? "" : `<div class="stat"><span class="k">Título</span><span class="v">${escapeHtml(tab.endpoint.title)}</span></div>`;
+  const s = tab.summary;
+  return [
+    '<section class="panel">',
+    `<h2>Sesión ${escapeHtml(shortSessionID(tab.sessionID))} ${statusBadge(tab.status)}</h2>`,
+    '<div class="grid">',
+    `<div class="stat"><span class="k">Endpoint</span><span class="v">${endpoint}</span></div>`,
+    dir,
+    title,
+    `<div class="stat"><span class="k">Coste real</span><span class="v">${usd(s.realCostUSD)}</span></div>`,
+    `<div class="stat"><span class="k">Tokens in/out</span><span class="v">${s.tokensIn}/${s.tokensOut}</span></div>`,
+    `<div class="stat"><span class="k">Local/Frontier</span><span class="v"><span class="local">${s.localCount}</span>/<span class="frontier">${s.frontierCount}</span></span></div>`,
+    `<div class="stat"><span class="k">Toolcalls</span><span class="v">${s.toolcalls.count} (${avgMs(s.toolcalls)})</span></div>`,
+    "</div>",
+    "</section>"
+  ].join("");
+}
+function terminalPanel(tab) {
+  return [
+    '<section class="panel term">',
+    "<h2>Terminal (sesión)</h2>",
+    '<pre class="termlog" aria-live="polite"></pre>',
+    '<form class="terminput" autocomplete="off">',
+    `<input type="text" name="text" placeholder="Enviar prompt a ${escapeHtml(shortSessionID(tab.sessionID))}…" aria-label="Prompt a la sesión">`,
+    '<button type="submit">Enviar</button>',
+    "</form>",
+    "</section>"
+  ].join("");
+}
+function ptyPanel(tab) {
+  return [
+    `<section class="panel pty" data-pty-session="${escapeHtml(tab.sessionID)}">`,
+    "<h2>Terminal (PTY)</h2>",
+    '<pre class="ptylog" aria-live="polite"></pre>',
+    '<form class="ptyinput" autocomplete="off" hidden>',
+    '<input type="text" name="cmd" placeholder="Comando…" aria-label="Comando de la terminal">',
+    '<button type="submit">Ejecutar</button>',
+    "</form>",
+    '<button type="button" class="pty-start">Abrir shell</button>',
+    "</section>"
+  ].join("");
+}
+function sessionView(tab, terminalEnabled, ptyEnabled) {
+  const body = [
+    sessionHeaderPanel(tab),
+    terminalEnabled ? terminalPanel(tab) : "",
+    terminalEnabled && ptyEnabled ? ptyPanel(tab) : "",
+    routesPanel(tab.recentRoutes),
+    decisionsPanel(tab.decisions),
+    meetingsPanel(tab.meetings),
+    activityPanel(tab.activity)
+  ].join("");
+  return `<div class="view" data-view="${escapeHtml(tab.sessionID)}" hidden>${body}</div>`;
+}
 var STYLE = `
 :root{color-scheme:dark;--bg:#0f1115;--panel:#171a21;--fg:#e6e8eb;--muted:#8b929c;--good:#3fb950;--local:#58a6ff;--frontier:#d29922;--line:#262b34}
 *{box-sizing:border-box}
@@ -287,6 +661,35 @@ ul.items .box{font-family:monospace}
 .tag{color:var(--frontier);font-size:12px}
 .kind{display:inline-block;min-width:66px;color:var(--muted);font-size:12px}
 code{font-family:ui-monospace,Consolas,monospace;background:#0b0d11;padding:1px 5px;border-radius:4px}
+.mono{font-family:ui-monospace,Consolas,monospace;font-size:12px}
+.tabs{display:flex;gap:6px;padding:12px 24px 0;flex-wrap:wrap;border-bottom:1px solid var(--line)}
+.tabs .tab{background:var(--panel);color:var(--fg);border:1px solid var(--line);border-bottom:none;border-radius:8px 8px 0 0;padding:8px 14px;cursor:pointer;font:inherit;display:flex;align-items:center;gap:6px}
+.tabs .tab.active{background:var(--bg);border-color:var(--local);color:var(--fg)}
+.dot{width:8px;height:8px;border-radius:50%;display:inline-block;background:var(--muted)}
+.badge{font-size:11px;padding:1px 8px;border-radius:10px;border:1px solid var(--line);color:var(--muted);vertical-align:middle}
+.status-running{background:var(--good)}
+.badge.status-running{color:var(--good);border-color:var(--good)}
+.status-idle{background:var(--muted)}
+.badge.status-idle{color:var(--muted)}
+.status-waiting-input{background:var(--frontier)}
+.badge.status-waiting-input{color:var(--frontier);border-color:var(--frontier)}
+.status-ended{background:#6e7681}
+.badge.status-ended{color:#6e7681}
+.term .termlog{background:#0b0d11;border:1px solid var(--line);border-radius:8px;padding:10px;max-height:340px;overflow:auto;font-family:ui-monospace,Consolas,monospace;font-size:12px;white-space:pre-wrap}
+.term .tl{padding:1px 0}
+.term .tl.input{color:var(--local)}
+.term .tl.tool{color:var(--frontier)}
+.term .tl.status{color:var(--muted)}
+.term .tl.error{color:#f85149}
+.term .tl.permission{color:var(--frontier);font-weight:600}
+.term form.terminput{display:flex;gap:8px;margin-top:10px}
+.term form.terminput input{flex:1;background:#0b0d11;color:var(--fg);border:1px solid var(--line);border-radius:8px;padding:8px 10px;font:inherit}
+.term form.terminput button{background:var(--local);color:#04122b;border:none;border-radius:8px;padding:8px 16px;cursor:pointer;font:inherit;font-weight:600}
+.pty .ptylog{background:#05070a;border:1px solid var(--line);border-radius:8px;padding:10px;max-height:340px;overflow:auto;font-family:ui-monospace,Consolas,monospace;font-size:12px;white-space:pre-wrap;color:#c8d1dc}
+.pty form.ptyinput{display:flex;gap:8px;margin-top:10px}
+.pty form.ptyinput input{flex:1;background:#05070a;color:var(--fg);border:1px solid var(--line);border-radius:8px;padding:8px 10px;font:inherit}
+.pty form.ptyinput button,.pty .pty-start{background:var(--frontier);color:#1a1200;border:none;border-radius:8px;padding:8px 16px;cursor:pointer;font:inherit;font-weight:600;margin-top:8px}
+.pty .pty-start:disabled{opacity:.5;cursor:default}
 `;
 var CLIENT_JS = `
 (function(){
@@ -305,11 +708,127 @@ var CLIENT_JS = `
   }
   var ms=parseInt(document.documentElement.getAttribute('data-refresh')||'2000',10);
   setInterval(function(){reloadIfChanged(current)},isNaN(ms)?2000:Math.max(250,ms));
+
+  function selectTab(name){
+    var tabs=document.querySelectorAll('#tabbar .tab');
+    for(var i=0;i<tabs.length;i++){tabs[i].classList.toggle('active',tabs[i].getAttribute('data-tab')===name)}
+    var views=document.querySelectorAll('main .view');
+    var matched=false;
+    for(var j=0;j<views.length;j++){
+      var show=views[j].getAttribute('data-view')===name;
+      views[j].hidden=!show;
+      if(show){matched=true;if(name!=='all'){connectTerminal(views[j],name)}}
+    }
+    if(!matched){return false}
+    try{sessionStorage.setItem('openteam.tab',name)}catch(e){}
+    return true;
+  }
+  function connectTerminal(view,id){
+    if(view.__wired){return}
+    var root=document.documentElement;
+    var token=root.getAttribute('data-token');
+    if(root.getAttribute('data-terminal')!=='1'||!token){return}
+    var log=view.querySelector('.termlog');
+    if(!log){return}
+    view.__wired=true;
+    function append(cls,text){
+      var line=document.createElement('div');
+      line.className='tl '+cls;line.textContent=text;
+      log.appendChild(line);log.scrollTop=log.scrollHeight;
+    }
+    var q='/console/session/'+encodeURIComponent(id);
+    var tk='token='+encodeURIComponent(token);
+    if('EventSource' in window){
+      try{
+        var es=new EventSource(q+'/stream?'+tk);
+        es.addEventListener('frame',function(e){try{var f=JSON.parse(e.data);append(f.kind,f.text)}catch(_){}}); 
+        es.onerror=function(){/* reconecta solo */};
+      }catch(_){/* ignore */}
+    }
+    var form=view.querySelector('form.terminput');
+    if(form){
+      form.addEventListener('submit',function(e){
+        e.preventDefault();
+        var inp=form.querySelector('input[name=text]');
+        var text=inp.value;
+        if(!text){return}
+        inp.value='';append('input','› '+text);
+        fetch(q+'/input?'+tk,{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({text:text})})
+          .then(function(r){if(!r.ok){append('error','✖ envío rechazado ('+r.status+')')}})
+          .catch(function(){append('error','✖ no se pudo enviar')});
+      });
+    }
+    connectPty(view,id,q,tk);
+  }
+  function connectPty(view,id,q,tk){
+    var root=document.documentElement;
+    if(root.getAttribute('data-pty')!=='1'){return}
+    var pane=view.querySelector('.pty');
+    if(!pane){return}
+    var log=pane.querySelector('.ptylog');
+    var startBtn=pane.querySelector('.pty-start');
+    var input=pane.querySelector('form.ptyinput');
+    function plog(text){
+      var d=document.createElement('span');d.textContent=text;
+      log.appendChild(d);log.scrollTop=log.scrollHeight;
+    }
+    if(!startBtn){return}
+    startBtn.addEventListener('click',function(){
+      startBtn.disabled=true;plog('Abriendo shell…
+');
+      fetch(q+'/pty?'+tk,{method:'POST',headers:{'content-type':'application/json'},body:'{}'})
+        .then(function(r){return r.ok?r.json():Promise.reject(r.status)})
+        .then(function(info){openPtyWs(info.wsUrl)})
+        .catch(function(s){plog('✖ no se pudo abrir PTY ('+s+')
+');startBtn.disabled=false});
+    });
+    function openPtyWs(url){
+      try{
+        var ws=new WebSocket(url);
+        ws.binaryType='arraybuffer';
+        ws.onmessage=function(e){
+          var data=e.data;
+          if(data instanceof ArrayBuffer){data=new TextDecoder().decode(new Uint8Array(data))}
+          plog(data);
+        };
+        ws.onclose=function(){plog('
+[shell cerrada]
+');startBtn.disabled=false};
+        ws.onerror=function(){plog('
+✖ error de WebSocket
+')};
+        if(input){
+          input.hidden=false;
+          input.addEventListener('submit',function(e){
+            e.preventDefault();
+            var c=input.querySelector('input[name=cmd]');
+            if(!c.value){return}
+            ws.send(c.value+'\r');c.value='';
+          });
+        }
+      }catch(_){plog('
+✖ WebSocket no disponible
+');startBtn.disabled=false}
+    }
+  }
+  var bar=document.getElementById('tabbar');
+  if(bar){
+    bar.addEventListener('click',function(e){
+      var t=e.target;
+      while(t&&t!==bar&&!t.getAttribute('data-tab')){t=t.parentNode}
+      if(t&&t.getAttribute('data-tab')){selectTab(t.getAttribute('data-tab'))}
+    });
+  }
+  var saved='all';
+  try{saved=sessionStorage.getItem('openteam.tab')||'all'}catch(e){}
+  if(!selectTab(saved)){selectTab('all')}
 })();
 `;
-function renderDashboardHtml(state, options = {}) {
+function renderConsoleHtml(state, options = {}) {
   const refreshMs = options.refreshMs ?? 2000;
-  const body = [
+  const terminalEnabled = options.terminalEnabled === true;
+  const ptyEnabled = options.ptyEnabled === true;
+  const allBody = [
     summaryPanel(state.cost),
     totalsPanel(state.totals),
     sessionsPanel(state.sessions),
@@ -321,21 +840,26 @@ function renderDashboardHtml(state, options = {}) {
     meetingsPanel(state.meetings),
     activityPanel(state.activity)
   ].join("");
+  const allView = `<div class="view" data-view="all">${allBody}</div>`;
+  const sessionViews = state.sessionsDetail.map((tab) => sessionView(tab, terminalEnabled, ptyEnabled)).join("");
+  const body = allView + sessionViews;
   const session = state.session.id === undefined ? "" : ` · sesión ${escapeHtml(state.session.id)}`;
+  const tokenAttr = terminalEnabled && options.consoleToken !== undefined ? ` data-token="${escapeHtml(options.consoleToken)}" data-terminal="1"${ptyEnabled ? ' data-pty="1"' : ""}` : "";
   return [
     "<!doctype html>",
-    `<html lang="es" data-generated="${escapeHtml(state.generatedAt)}" data-refresh="${refreshMs}">`,
+    `<html lang="es" data-generated="${escapeHtml(state.generatedAt)}" data-refresh="${refreshMs}"${tokenAttr}>`,
     "<head>",
     '<meta charset="utf-8">',
     '<meta name="viewport" content="width=device-width,initial-scale=1">',
-    "<title>openteam dashboard</title>",
+    "<title>openteam console</title>",
     `<style>${STYLE}</style>`,
     "</head>",
     "<body>",
     "<header>",
-    "<h1>openteam dashboard</h1>",
+    "<h1>openteam console</h1>",
     `<span class="meta">actualizado ${escapeHtml(state.generatedAt)}${session}</span>`,
     "</header>",
+    tabBar(state.sessionsDetail),
     `<main>${body}</main>`,
     `<script>${CLIENT_JS}</script>`,
     "</body>",
@@ -490,6 +1014,25 @@ function applyToolcall(session, event) {
   session.toolcalls.byTool[event.tool] = byTool;
   pushUnique(session.agents, event.agent);
 }
+function applyEndpoint(session, event) {
+  if (session.endpoint !== undefined && session.endpoint.lastSeenTs >= event.ts) {
+    return;
+  }
+  const endpoint = {
+    url: event.url,
+    lastSeenTs: event.ts
+  };
+  if (event.directory !== undefined) {
+    endpoint.directory = event.directory;
+  }
+  if (event.worktree !== undefined) {
+    endpoint.worktree = event.worktree;
+  }
+  if (event.title !== undefined) {
+    endpoint.title = event.title;
+  }
+  session.endpoint = endpoint;
+}
 function mergeTool(target, source) {
   target.count += source.count;
   target.ok += source.ok;
@@ -593,6 +1136,9 @@ function aggregateEvents(events) {
       case "toolcall":
         applyToolcall(sessionFor(event.sessionID, event.ts), event);
         break;
+      case "session-endpoint":
+        applyEndpoint(sessionFor(event.sessionID, event.ts), event);
+        break;
       case "decision":
         decisions.push(toDecision(event));
         break;
@@ -636,71 +1182,76 @@ function aggregateEvents(events) {
 }
 
 // src/telemetry/events.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 
 // src/capabilities/types.ts
-import { z } from "zod";
-var CapabilityTierSchema = z.union([
-  z.literal(0),
-  z.literal(1),
-  z.literal(2),
-  z.literal(3),
-  z.literal(4),
-  z.literal(5)
+import { z as z2 } from "zod";
+var CapabilityTierSchema = z2.union([
+  z2.literal(0),
+  z2.literal(1),
+  z2.literal(2),
+  z2.literal(3),
+  z2.literal(4),
+  z2.literal(5)
 ]);
-var ComplexityTierSchema = z.enum([
+var ComplexityTierSchema = z2.enum([
   "trivial",
   "simple",
   "moderate",
   "hard"
 ]);
-var ModelCapabilityProfileSchema = z.object({
-  ref: z.object({
-    providerID: z.string().min(1),
-    modelID: z.string().min(1)
+var ModelCapabilityProfileSchema = z2.object({
+  ref: z2.object({
+    providerID: z2.string().min(1),
+    modelID: z2.string().min(1)
   }),
-  kind: z.enum(["local", "frontier", "router"]),
-  contextWindow: z.number().int().positive(),
-  maxOutputTokens: z.number().int().positive(),
-  supportsToolCalling: z.boolean(),
-  supportsVision: z.boolean(),
+  kind: z2.enum(["local", "frontier", "router"]),
+  contextWindow: z2.number().int().positive(),
+  maxOutputTokens: z2.number().int().positive(),
+  supportsToolCalling: z2.boolean(),
+  supportsVision: z2.boolean(),
   reasoningTier: CapabilityTierSchema,
   codeQualityTier: CapabilityTierSchema,
-  costPer1M: z.object({
-    inputUSD: z.number().min(0),
-    outputUSD: z.number().min(0)
+  costPer1M: z2.object({
+    inputUSD: z2.number().min(0),
+    outputUSD: z2.number().min(0)
   }),
-  availability: z.enum(["available", "degraded", "unavailable"])
+  availability: z2.enum(["available", "degraded", "unavailable"])
 });
 
 // src/config/schema.ts
-import { z as z2 } from "zod";
-var ModelRefSchema = z2.object({
-  providerID: z2.string().min(1),
-  modelID: z2.string().min(1)
+import { z as z3 } from "zod";
+var ModelRefSchema = z3.object({
+  providerID: z3.string().min(1),
+  modelID: z3.string().min(1)
 });
-var RouterModeSchema = z2.enum(["economy", "balanced", "quality"]);
-var PrivacyModeSchema = z2.enum([
+var RouterModeSchema = z3.enum(["economy", "balanced", "quality"]);
+var PrivacyModeSchema = z3.enum([
   "forceLocalOnSensitive",
   "consentBeforeFrontier",
   "off"
 ]);
-var BaselineModeSchema = z2.enum(["auto", "pinned"]);
-var DashboardHostSchema = z2.enum(["127.0.0.1", "localhost"]);
-var DashboardConfigSchema = z2.object({
-  host: DashboardHostSchema.default("127.0.0.1"),
-  port: z2.number().int().min(1024).max(65535).default(4599),
-  autoPortFallback: z2.boolean().default(true),
-  refreshMs: z2.number().int().min(250).default(2000),
-  recentRoutes: z2.number().int().positive().default(50),
-  openBrowser: z2.boolean().default(false)
+var BaselineModeSchema = z3.enum(["auto", "pinned"]);
+var ConsoleHostSchema = z3.enum(["127.0.0.1", "localhost"]);
+var ConsoleConfigSchema = z3.object({
+  host: ConsoleHostSchema.default("127.0.0.1"),
+  port: z3.number().int().min(1024).max(65535).default(4599),
+  autoPortFallback: z3.boolean().default(true),
+  refreshMs: z3.number().int().min(250).default(2000),
+  recentRoutes: z3.number().int().positive().default(50),
+  openBrowser: z3.boolean().default(false),
+  terminal: z3.object({
+    enabled: z3.boolean().default(true),
+    pty: z3.boolean().optional()
+  }).default({ enabled: true })
 }).default({
   host: "127.0.0.1",
   port: 4599,
   autoPortFallback: true,
   refreshMs: 2000,
   recentRoutes: 50,
-  openBrowser: false
+  openBrowser: false,
+  terminal: { enabled: true }
 });
 var defaultLocalModel = {
   providerID: "ollama",
@@ -710,15 +1261,15 @@ var defaultFrontierModel = {
   providerID: "anthropic",
   modelID: "claude-sonnet-4-5"
 };
-var LocalRuntimeSchema = z2.object({
-  id: z2.enum(["ollama", "lmstudio", "foundry-local"]),
-  enabled: z2.boolean().default(true),
-  baseURL: z2.string().url().optional(),
-  discovery: z2.enum(["cli", "sdk", "manual"]).optional(),
+var LocalRuntimeSchema = z3.object({
+  id: z3.enum(["ollama", "lmstudio", "foundry-local"]),
+  enabled: z3.boolean().default(true),
+  baseURL: z3.string().url().optional(),
+  discovery: z3.enum(["cli", "sdk", "manual"]).optional(),
   defaultModel: ModelRefSchema
 });
-var OpenTeamConfigSchema = z2.object({
-  baseline: z2.object({
+var OpenTeamConfigObjectSchema = z3.object({
+  baseline: z3.object({
     mode: BaselineModeSchema.default("auto"),
     pinnedModel: ModelRefSchema.nullable().default(null),
     hardDefault: ModelRefSchema.default(defaultFrontierModel)
@@ -727,19 +1278,19 @@ var OpenTeamConfigSchema = z2.object({
     pinnedModel: null,
     hardDefault: defaultFrontierModel
   }),
-  router: z2.object({
+  router: z3.object({
     mode: RouterModeSchema.default("balanced"),
     localDefault: ModelRefSchema.default(defaultLocalModel),
-    trivialPromptMaxChars: z2.number().int().positive().default(280),
-    frontierPromptMinChars: z2.number().int().positive().default(2000)
+    trivialPromptMaxChars: z3.number().int().positive().default(280),
+    frontierPromptMinChars: z3.number().int().positive().default(2000)
   }).default({
     mode: "balanced",
     localDefault: defaultLocalModel,
     trivialPromptMaxChars: 280,
     frontierPromptMinChars: 2000
   }),
-  local: z2.object({
-    runtimes: z2.array(LocalRuntimeSchema).min(1).default([
+  local: z3.object({
+    runtimes: z3.array(LocalRuntimeSchema).min(1).default([
       {
         id: "ollama",
         enabled: true,
@@ -757,113 +1308,122 @@ var OpenTeamConfigSchema = z2.object({
       }
     ]
   }),
-  budgets: z2.object({
-    sessionUSD: z2.number().positive().optional(),
-    monthlyUSD: z2.number().positive().optional(),
-    frontierTokensPerSession: z2.number().int().positive().optional(),
-    hardStopOnBudgetExhaustion: z2.boolean().default(false)
+  budgets: z3.object({
+    sessionUSD: z3.number().positive().optional(),
+    monthlyUSD: z3.number().positive().optional(),
+    frontierTokensPerSession: z3.number().int().positive().optional(),
+    hardStopOnBudgetExhaustion: z3.boolean().default(false)
   }).default({ hardStopOnBudgetExhaustion: false }),
   privacyMode: PrivacyModeSchema.default("forceLocalOnSensitive"),
-  dashboard: DashboardConfigSchema
+  console: ConsoleConfigSchema
 });
+var OpenTeamConfigSchema = OpenTeamConfigObjectSchema;
 
 // src/telemetry/events.ts
 var EVENT_SCHEMA_VERSION = 1;
-var EventBaseSchema = z3.object({
-  v: z3.literal(EVENT_SCHEMA_VERSION),
-  ts: z3.number().finite(),
-  sessionID: z3.string().min(1)
+var EventBaseSchema = z4.object({
+  v: z4.literal(EVENT_SCHEMA_VERSION),
+  ts: z4.number().finite(),
+  sessionID: z4.string().min(1)
 });
 var RouteEventSchema = EventBaseSchema.extend({
-  type: z3.literal("route"),
-  promptHash: z3.string().min(1),
-  promptChars: z3.number().int().min(0),
+  type: z4.literal("route"),
+  promptHash: z4.string().min(1),
+  promptChars: z4.number().int().min(0),
   tier: ComplexityTierSchema,
-  routeKind: z3.enum(["local", "frontier"]),
+  routeKind: z4.enum(["local", "frontier"]),
   selected: ModelRefSchema,
-  rationale: z3.string(),
-  estimatedCostUSD: z3.number().finite().min(0),
-  baselineCostUSD: z3.number().finite().min(0),
-  estimatedSavingsUSD: z3.number().finite(),
-  budgetAction: z3.string().min(1),
-  tokensIn: z3.number().int().min(0).optional(),
-  tokensOut: z3.number().int().min(0).optional(),
-  decisionID: z3.string().min(1).optional(),
-  agent: z3.string().min(1).optional(),
-  success: z3.boolean().optional(),
-  batchID: z3.string().min(1).optional(),
-  failureReason: z3.string().min(1).optional(),
-  failureStage: z3.string().min(1).optional()
+  rationale: z4.string(),
+  estimatedCostUSD: z4.number().finite().min(0),
+  baselineCostUSD: z4.number().finite().min(0),
+  estimatedSavingsUSD: z4.number().finite(),
+  budgetAction: z4.string().min(1),
+  tokensIn: z4.number().int().min(0).optional(),
+  tokensOut: z4.number().int().min(0).optional(),
+  decisionID: z4.string().min(1).optional(),
+  agent: z4.string().min(1).optional(),
+  success: z4.boolean().optional(),
+  batchID: z4.string().min(1).optional(),
+  failureReason: z4.string().min(1).optional(),
+  failureStage: z4.string().min(1).optional()
 });
 var MessageEventSchema = EventBaseSchema.extend({
-  type: z3.literal("message"),
-  providerID: z3.string().min(1),
-  modelID: z3.string().min(1),
-  agent: z3.string().min(1).optional(),
-  mode: z3.string().min(1).optional(),
-  messageID: z3.string().min(1).optional(),
-  costUSD: z3.number().finite().min(0),
-  tokensIn: z3.number().int().min(0),
-  tokensOut: z3.number().int().min(0),
-  tokensReasoning: z3.number().int().min(0),
-  tokensCacheRead: z3.number().int().min(0),
-  tokensCacheWrite: z3.number().int().min(0),
-  durationMs: z3.number().int().min(0)
+  type: z4.literal("message"),
+  providerID: z4.string().min(1),
+  modelID: z4.string().min(1),
+  agent: z4.string().min(1).optional(),
+  mode: z4.string().min(1).optional(),
+  messageID: z4.string().min(1).optional(),
+  costUSD: z4.number().finite().min(0),
+  tokensIn: z4.number().int().min(0),
+  tokensOut: z4.number().int().min(0),
+  tokensReasoning: z4.number().int().min(0),
+  tokensCacheRead: z4.number().int().min(0),
+  tokensCacheWrite: z4.number().int().min(0),
+  durationMs: z4.number().int().min(0)
 });
 var ToolcallEventSchema = EventBaseSchema.extend({
-  type: z3.literal("toolcall"),
-  tool: z3.string().min(1),
-  callID: z3.string().min(1),
-  agent: z3.string().min(1).optional(),
-  durationMs: z3.number().int().min(0),
-  ok: z3.boolean(),
-  title: z3.string().optional()
+  type: z4.literal("toolcall"),
+  tool: z4.string().min(1),
+  callID: z4.string().min(1),
+  agent: z4.string().min(1).optional(),
+  durationMs: z4.number().int().min(0),
+  ok: z4.boolean(),
+  title: z4.string().optional()
 });
 var MeetingEventSchema = EventBaseSchema.extend({
-  type: z3.literal("meeting"),
-  batchID: z3.string().min(1),
-  purpose: z3.string().optional(),
-  roles: z3.array(z3.string().min(1)),
-  decisionIDs: z3.array(z3.string().min(1)).optional()
+  type: z4.literal("meeting"),
+  batchID: z4.string().min(1),
+  purpose: z4.string().optional(),
+  roles: z4.array(z4.string().min(1)),
+  decisionIDs: z4.array(z4.string().min(1)).optional()
 });
 var DecisionEventSchema = EventBaseSchema.extend({
-  type: z3.literal("decision"),
-  agent: z3.string().min(1).optional(),
-  summary: z3.string().min(1),
-  tags: z3.array(z3.string().min(1)).optional()
+  type: z4.literal("decision"),
+  agent: z4.string().min(1).optional(),
+  summary: z4.string().min(1),
+  tags: z4.array(z4.string().min(1)).optional()
 });
 var ActivityEventSchema = EventBaseSchema.extend({
-  type: z3.literal("activity"),
-  kind: z3.enum(["route", "agent", "decision", "commit"]),
-  agent: z3.string().min(1).optional(),
-  summary: z3.string().min(1)
+  type: z4.literal("activity"),
+  kind: z4.enum(["route", "agent", "decision", "commit"]),
+  agent: z4.string().min(1).optional(),
+  summary: z4.string().min(1)
+});
+var SessionEndpointEventSchema = EventBaseSchema.extend({
+  type: z4.literal("session-endpoint"),
+  url: z4.string().url(),
+  directory: z4.string().min(1).optional(),
+  worktree: z4.string().min(1).optional(),
+  title: z4.string().min(1).optional()
 });
-var OpenTeamEventSchema = z3.discriminatedUnion("type", [
+var OpenTeamEventSchema = z4.discriminatedUnion("type", [
   RouteEventSchema,
   MessageEventSchema,
   ToolcallEventSchema,
   MeetingEventSchema,
   DecisionEventSchema,
-  ActivityEventSchema
+  ActivityEventSchema,
+  SessionEndpointEventSchema
 ]);
 
 // src/telemetry/types.ts
-import { z as z4 } from "zod";
-var CostRecordSchema = z4.object({
-  ts: z4.number().finite(),
-  sessionID: z4.string().min(1).optional(),
-  promptHash: z4.string().min(1),
-  promptChars: z4.number().int().min(0),
+import { z as z5 } from "zod";
+var CostRecordSchema = z5.object({
+  ts: z5.number().finite(),
+  sessionID: z5.string().min(1).optional(),
+  promptHash: z5.string().min(1),
+  promptChars: z5.number().int().min(0),
   tier: ComplexityTierSchema,
-  routeKind: z4.enum(["local", "frontier"]),
+  routeKind: z5.enum(["local", "frontier"]),
   selected: ModelRefSchema,
-  rationale: z4.string(),
-  estimatedCostUSD: z4.number().finite().min(0),
-  baselineCostUSD: z4.number().finite().min(0),
-  estimatedSavingsUSD: z4.number().finite(),
-  budgetAction: z4.string().min(1),
-  tokensIn: z4.number().int().min(0).optional(),
-  tokensOut: z4.number().int().min(0).optional()
+  rationale: z5.string(),
+  estimatedCostUSD: z5.number().finite().min(0),
+  baselineCostUSD: z5.number().finite().min(0),
+  estimatedSavingsUSD: z5.number().finite(),
+  budgetAction: z5.string().min(1),
+  tokensIn: z5.number().int().min(0).optional(),
+  tokensOut: z5.number().int().min(0).optional()
 });
 
 // src/telemetry/read.ts
@@ -994,7 +1554,7 @@ async function readSessionEvents(dir, deps) {
   return events.sort((a, b) => a.ts - b.ts);
 }
 
-// src/dashboard/backlog.ts
+// src/console/backlog.ts
 var ITEM_RE = /^\s*[-*+]\s+\[( |x|X)\]\s+(.*)$/;
 var ASSIGNEE_RE = /^\[@([^\]]+)\]\s*(.*)$/;
 function parseAssignee(text) {
@@ -1042,7 +1602,27 @@ function buildLoopSnapshot(backlogPath, items) {
   };
 }
 
-// src/dashboard/state.ts
+// src/console/session.ts
+var DEFAULT_SESSION_STATUS_THRESHOLDS = {
+  runningWindowMs: 30000,
+  idleWindowMs: 30 * 60000
+};
+function deriveSessionStatus(lastTs, nowMs, options = {}) {
+  const thresholds = options.thresholds ?? DEFAULT_SESSION_STATUS_THRESHOLDS;
+  const age = nowMs - lastTs;
+  if (age > thresholds.idleWindowMs) {
+    return "ended";
+  }
+  if (options.waitingInput === true) {
+    return "waiting-input";
+  }
+  if (age <= thresholds.runningWindowMs) {
+    return "running";
+  }
+  return "idle";
+}
+
+// src/console/state.ts
 var DEFAULT_RECENT_ROUTES = 50;
 var DEFAULT_ACTIVITY_LIMIT = 100;
 var DEFAULT_DECISIONS_LIMIT = 100;
@@ -1085,9 +1665,9 @@ function meetingToActivity(meeting) {
     summary: `Reunión (${roles})${purpose}`
   };
 }
-function activityFeed(aggregate, limit) {
+function composeActivity(activityViews, decisions, meetings, limit) {
   const entries = [
-    ...aggregate.activity.map((view) => {
+    ...activityViews.map((view) => {
       const entry = {
         ts: view.ts,
         kind: view.kind,
@@ -1098,11 +1678,39 @@ function activityFeed(aggregate, limit) {
       }
       return entry;
     }),
-    ...aggregate.decisions.map(decisionToActivity),
-    ...aggregate.meetings.map(meetingToActivity)
+    ...decisions.map(decisionToActivity),
+    ...meetings.map(meetingToActivity)
   ];
   return entries.sort((a, b) => b.ts - a.ts).slice(0, Math.max(0, limit));
 }
+function activityFeed(aggregate, limit) {
+  return composeActivity(aggregate.activity, aggregate.decisions, aggregate.meetings, limit);
+}
+function buildSessionTabs(aggregate, costRecords, nowMs, limits, options) {
+  return aggregate.sessions.map((summary) => {
+    const id = summary.sessionID;
+    const routes = costRecords.filter((record) => record.sessionID === id);
+    const decisions = aggregate.decisions.filter((decision) => decision.sessionID === id).slice(0, Math.max(0, limits.decisionsLimit));
+    const meetings = aggregate.meetings.filter((meeting) => meeting.sessionID === id).slice(0, Math.max(0, limits.meetingsLimit));
+    const activity = composeActivity(aggregate.activity.filter((view) => view.sessionID === id), aggregate.decisions.filter((decision) => decision.sessionID === id), aggregate.meetings.filter((meeting) => meeting.sessionID === id), limits.activityLimit);
+    const tab = {
+      sessionID: id,
+      status: deriveSessionStatus(summary.lastTs, nowMs, {
+        thresholds: options.thresholds,
+        waitingInput: options.waitingInputSessionIDs.has(id)
+      }),
+      summary,
+      recentRoutes: recentRoutes(routes, limits.recentRoutesLimit),
+      decisions,
+      meetings,
+      activity
+    };
+    if (summary.endpoint !== undefined) {
+      tab.endpoint = summary.endpoint;
+    }
+    return tab;
+  });
+}
 function loopFrom(backlog) {
   if (backlog === undefined) {
     return;
@@ -1113,19 +1721,25 @@ function loopFrom(backlog) {
   }
   return snapshot;
 }
-function buildDashboardState(inputs) {
+function buildConsoleState(inputs) {
   const recentRoutesLimit = inputs.recentRoutesLimit ?? DEFAULT_RECENT_ROUTES;
   const activityLimit = inputs.activityLimit ?? DEFAULT_ACTIVITY_LIMIT;
   const decisionsLimit = inputs.decisionsLimit ?? DEFAULT_DECISIONS_LIMIT;
   const meetingsLimit = inputs.meetingsLimit ?? DEFAULT_MEETINGS_LIMIT;
   const aggregate = aggregateEvents(inputs.events);
   const costRecords = inputs.events.filter(isRoute).map(routeEventToCostRecord);
+  const nowMs = Date.parse(inputs.generatedAt);
+  const sessionsDetail = buildSessionTabs(aggregate, costRecords, Number.isNaN(nowMs) ? 0 : nowMs, { recentRoutesLimit, activityLimit, decisionsLimit, meetingsLimit }, {
+    thresholds: inputs.statusThresholds ?? DEFAULT_SESSION_STATUS_THRESHOLDS,
+    waitingInputSessionIDs: new Set(inputs.waitingInputSessionIDs ?? [])
+  });
   const state = {
     generatedAt: inputs.generatedAt,
     session: {},
     cost: summarizeCostRecords(costRecords),
     totals: aggregate.totals,
     sessions: aggregate.sessions,
+    sessionsDetail,
     recentRoutes: recentRoutes(costRecords, recentRoutesLimit),
     decisions: aggregate.decisions.slice(0, Math.max(0, decisionsLimit)),
     meetings: aggregate.meetings.slice(0, Math.max(0, meetingsLimit)),
@@ -1145,24 +1759,201 @@ function buildDashboardState(inputs) {
   return state;
 }
 
-// src/web/server.ts
+// src/web/console.ts
 var SSE_HEADERS = {
   "content-type": "text/event-stream",
   "cache-control": "no-cache",
   connection: "keep-alive"
 };
 var JSON_HEADERS = { "content-type": "application/json" };
+function bearerFromHeader(request) {
+  const header = request.headers.authorization;
+  if (typeof header !== "string" || !header.startsWith("Bearer ")) {
+    return;
+  }
+  const value = header.slice("Bearer ".length).trim();
+  return value.length === 0 ? undefined : value;
+}
+function authorized(request, query, token) {
+  const provided = tokenFromQuery(query) ?? bearerFromHeader(request);
+  return provided !== undefined && safeEqualToken(provided, token);
+}
+async function readJsonBody(request, limit) {
+  return new Promise((resolve) => {
+    let raw = "";
+    let aborted = false;
+    request.on("data", (chunk) => {
+      if (aborted) {
+        return;
+      }
+      raw += chunk.toString("utf8");
+      if (raw.length > limit) {
+        aborted = true;
+        resolve(undefined);
+      }
+    });
+    request.on("end", () => {
+      if (aborted) {
+        return;
+      }
+      try {
+        resolve(JSON.parse(raw));
+      } catch {
+        resolve(undefined);
+      }
+    });
+    request.on("error", () => resolve(undefined));
+  });
+}
+function parseConsolePath(path) {
+  const match = /^\/console\/session\/([^/]+)\/(stream|input|permission|pty)$/.exec(path);
+  if (match === null) {
+    return;
+  }
+  return {
+    sessionID: decodeURIComponent(match[1]),
+    action: match[2]
+  };
+}
+async function handleStream(request, response, sessionID, deps) {
+  const endpoint = await deps.resolveEndpoint(sessionID);
+  if (endpoint === undefined) {
+    response.writeHead(404, JSON_HEADERS).end(JSON.stringify({ error: "no endpoint" }));
+    return;
+  }
+  response.writeHead(200, SSE_HEADERS);
+  response.write(`event: open
+data: {}
+
+`);
+  const controller = new AbortController;
+  request.on("close", () => controller.abort());
+  const client = deps.createClient(endpoint);
+  try {
+    await client.streamFrames(sessionID, (frame) => response.write(frameToSse(frame)), controller.signal);
+  } catch {} finally {
+    controller.abort();
+    response.end();
+  }
+}
+async function handleInput(request, response, sessionID, deps) {
+  const endpoint = await deps.resolveEndpoint(sessionID);
+  if (endpoint === undefined) {
+    response.writeHead(404, JSON_HEADERS).end(JSON.stringify({ error: "no endpoint" }));
+    return;
+  }
+  const body = await readJsonBody(request, MAX_INPUT_CHARS + 1024);
+  const input = parseSessionInput(body);
+  if (input === undefined) {
+    response.writeHead(400, JSON_HEADERS).end(JSON.stringify({ error: "invalid input" }));
+    return;
+  }
+  await deps.createClient(endpoint).sendPrompt(sessionID, input.text);
+  response.writeHead(202, JSON_HEADERS).end(JSON.stringify({ ok: true }));
+}
+async function handlePermission(request, response, sessionID, deps) {
+  const endpoint = await deps.resolveEndpoint(sessionID);
+  if (endpoint === undefined) {
+    response.writeHead(404, JSON_HEADERS).end(JSON.stringify({ error: "no endpoint" }));
+    return;
+  }
+  const body = await readJsonBody(request, 4096);
+  const record = typeof body === "object" && body !== null ? body : {};
+  const permissionID = record.permissionID;
+  const responseValue = record.response;
+  if (typeof permissionID !== "string" || permissionID.length === 0 || responseValue !== "once" && responseValue !== "always" && responseValue !== "reject") {
+    response.writeHead(400, JSON_HEADERS).end(JSON.stringify({ error: "invalid permission" }));
+    return;
+  }
+  await deps.createClient(endpoint).respondPermission(sessionID, permissionID, responseValue);
+  response.writeHead(202, JSON_HEADERS).end(JSON.stringify({ ok: true }));
+}
+async function handlePty(_request, response, sessionID, deps) {
+  if (deps.ptyEnabled !== true || deps.createPtyClient === undefined) {
+    response.writeHead(403, JSON_HEADERS).end(JSON.stringify({ error: "pty disabled" }));
+    return;
+  }
+  const endpoint = await deps.resolveEndpoint(sessionID);
+  if (endpoint === undefined) {
+    response.writeHead(404, JSON_HEADERS).end(JSON.stringify({ error: "no endpoint" }));
+    return;
+  }
+  const client = deps.createPtyClient(endpoint);
+  const pty = await client.createPty({ command: "", title: "openteam" });
+  if (pty === undefined) {
+    response.writeHead(502, JSON_HEADERS).end(JSON.stringify({ error: "pty create failed" }));
+    return;
+  }
+  const token = await client.connectToken(pty.id);
+  if (token === undefined) {
+    response.writeHead(502, JSON_HEADERS).end(JSON.stringify({ error: "connect token failed" }));
+    return;
+  }
+  response.writeHead(200, JSON_HEADERS).end(JSON.stringify({
+    ptyID: pty.id,
+    wsUrl: client.wsUrl(pty.id, token.ticket)
+  }));
+}
+async function handleConsoleRoute(request, response, url, deps) {
+  if (!url.pathname.startsWith("/console/")) {
+    return false;
+  }
+  const route = parseConsolePath(url.pathname);
+  if (route === undefined) {
+    response.writeHead(404, JSON_HEADERS).end(JSON.stringify({ error: "not found" }));
+    return true;
+  }
+  if (!deps.terminalEnabled) {
+    response.writeHead(403, JSON_HEADERS).end(JSON.stringify({ error: "terminal disabled" }));
+    return true;
+  }
+  if (!authorized(request, url.searchParams, deps.token)) {
+    response.writeHead(401, JSON_HEADERS).end(JSON.stringify({ error: "unauthorized" }));
+    return true;
+  }
+  if (route.action === "stream" && request.method === "GET") {
+    await handleStream(request, response, route.sessionID, deps);
+    return true;
+  }
+  if (route.action === "input" && request.method === "POST") {
+    await handleInput(request, response, route.sessionID, deps);
+    return true;
+  }
+  if (route.action === "permission" && request.method === "POST") {
+    await handlePermission(request, response, route.sessionID, deps);
+    return true;
+  }
+  if (route.action === "pty" && request.method === "POST") {
+    await handlePty(request, response, route.sessionID, deps);
+    return true;
+  }
+  response.writeHead(405, JSON_HEADERS).end(JSON.stringify({ error: "method not allowed" }));
+  return true;
+}
+
+// src/web/server.ts
+var SSE_HEADERS2 = {
+  "content-type": "text/event-stream",
+  "cache-control": "no-cache",
+  connection: "keep-alive"
+};
+var JSON_HEADERS2 = { "content-type": "application/json" };
 var HTML_HEADERS = { "content-type": "text/html; charset=utf-8" };
 function isAddressInUse(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "EADDRINUSE";
 }
 async function renderState(deps) {
-  return renderDashboardHtml(buildDashboardState(await deps.readSnapshot()), {
-    refreshMs: deps.config.refreshMs
+  return renderConsoleHtml(buildConsoleState(await deps.readSnapshot()), {
+    refreshMs: deps.config.refreshMs,
+    ...deps.console !== undefined ? {
+      consoleToken: deps.console.token,
+      terminalEnabled: deps.console.terminalEnabled,
+      ...deps.console.ptyEnabled !== undefined ? { ptyEnabled: deps.console.ptyEnabled } : {}
+    } : {}
   });
 }
 async function stateJson(deps) {
-  return JSON.stringify(buildDashboardState(await deps.readSnapshot()));
+  return JSON.stringify(buildConsoleState(await deps.readSnapshot()));
 }
 function sseMessage(json) {
   return `event: state
@@ -1189,27 +1980,42 @@ function tryListen(server, host, port) {
     server.listen(port, host);
   });
 }
-async function createDashboardServer(deps) {
+async function createConsoleServer(deps) {
   const create = deps.createServer ?? createHttpServer;
   const log = deps.log ?? ((message) => console.log(message));
   const clients = new Set;
+  const resolveEndpoint = async (sessionID) => {
+    const state = buildConsoleState(await deps.readSnapshot());
+    return state.sessionsDetail.find((tab) => tab.sessionID === sessionID)?.endpoint?.url;
+  };
+  const consoleDeps = deps.console === undefined ? undefined : {
+    token: deps.console.token,
+    terminalEnabled: deps.console.terminalEnabled,
+    resolveEndpoint,
+    createClient: deps.console.createClient,
+    ...deps.console.ptyEnabled !== undefined ? { ptyEnabled: deps.console.ptyEnabled } : {},
+    ...deps.console.createPtyClient !== undefined ? { createPtyClient: deps.console.createPtyClient } : {}
+  };
   const handle = async (request, response) => {
+    const url2 = new URL(request.url ?? "/", "http://localhost");
+    if (consoleDeps !== undefined && await handleConsoleRoute(request, response, url2, consoleDeps)) {
+      return;
+    }
     if (request.method !== "GET") {
       response.writeHead(405).end("method not allowed");
       return;
     }
-    const url2 = new URL(request.url ?? "/", "http://localhost");
     const path = url2.pathname;
     if (path === "/" || path === "/index.html") {
       response.writeHead(200, HTML_HEADERS).end(await renderState(deps));
       return;
     }
     if (path === "/api/state") {
-      response.writeHead(200, JSON_HEADERS).end(await stateJson(deps));
+      response.writeHead(200, JSON_HEADERS2).end(await stateJson(deps));
       return;
     }
     if (path === "/healthz") {
-      response.writeHead(200, JSON_HEADERS).end(JSON.stringify({ ok: true }));
+      response.writeHead(200, JSON_HEADERS2).end(JSON.stringify({ ok: true }));
       return;
     }
     if (path === "/favicon.ico") {
@@ -1217,7 +2023,7 @@ async function createDashboardServer(deps) {
       return;
     }
     if (path === "/events") {
-      response.writeHead(200, SSE_HEADERS);
+      response.writeHead(200, SSE_HEADERS2);
       response.write(sseMessage(await stateJson(deps)));
       clients.add(response);
       request.on("close", () => {
@@ -1245,10 +2051,10 @@ async function createDashboardServer(deps) {
     }
   }
   if (!bound) {
-    throw new Error("dashboard: no available port");
+    throw new Error("console: no available port");
   }
   const url = `http://${deps.config.host}:${boundPort}`;
-  log(`[openteam] dashboard en ${url}`);
+  log(`[openteam] console en ${url}`);
   const notify = async () => {
     if (clients.size === 0) {
       return;
@@ -1565,10 +2371,10 @@ function watchSources(paths, onChange, deps, debounceMs = 250) {
 }
 
 // src/web/start.ts
-function startDashboard(deps) {
-  return createDashboardRuntime(deps);
+function startConsole(deps) {
+  return createConsoleRuntime(deps);
 }
-async function createDashboardRuntime(deps) {
+async function createConsoleRuntime(deps) {
   const backlogPath = deps.backlogPath ?? DEFAULT_BACKLOG_PATH;
   const decisionsPath = deps.decisionsPath ?? DEFAULT_DECISIONS_PATH;
   const readSnapshot = createSnapshotReader({
@@ -1587,11 +2393,12 @@ async function createDashboardRuntime(deps) {
     recentRoutesLimit: deps.config.recentRoutes,
     ...deps.session !== undefined ? { session: deps.session } : {}
   });
-  const createServer = deps.serve ?? createDashboardServer;
+  const createServer = deps.serve ?? createConsoleServer;
   const server = await createServer({
     readSnapshot,
     config: deps.config,
-    ...deps.log !== undefined ? { log: deps.log } : {}
+    ...deps.log !== undefined ? { log: deps.log } : {},
+    ...deps.console !== undefined ? { console: deps.console } : {}
   });
   const watchFn = deps.watch ?? ((path, listener) => fsWatch(path, { persistent: false }, listener));
   const watcher = watchSources([deps.sessionsDir, decisionsPath, backlogPath, deps.agentDir], () => {
@@ -1607,21 +2414,32 @@ async function createDashboardRuntime(deps) {
   };
 }
 
-// src/cli/dashboardServe.ts
-function parseDashboardServeArgs(rest) {
+// src/cli/consoleServe.ts
+function parseConsoleServeArgs(rest) {
   return {
     status: rest.includes("--status"),
     serve: rest.includes("--serve"),
     open: rest.includes("--open")
   };
 }
-async function runDashboardServe(deps, options) {
+async function runConsoleServe(deps, options) {
   const config = await deps.loadConfig(deps.configPath);
-  const start = deps.startDashboard ?? startDashboard;
+  const start = deps.startConsole ?? startConsole;
+  const terminalEnabled = config.console.terminal.enabled;
+  const ptyEnabled = config.console.terminal.pty === true;
+  const token = (deps.generateToken ?? (() => encodeToken(randomBytes(32))))();
+  const makeClient = deps.createConsoleClient ?? ((endpoint) => createConsoleClient({
+    endpoint,
+    ...deps.serverPassword !== undefined ? { password: deps.serverPassword } : {}
+  }));
+  const makePtyClient = deps.createPtyClient ?? ((endpoint) => createPtyClient({
+    endpoint,
+    ...deps.serverPassword !== undefined ? { password: deps.serverPassword } : {}
+  }));
   let runtime;
   try {
     runtime = await start({
-      config: config.dashboard,
+      config: config.console,
       sessionsDir: deps.sessionsDir,
       decisionsPath: deps.decisionsPath,
       backlogPath: deps.backlogPath,
@@ -1632,11 +2450,18 @@ async function runDashboardServe(deps, options) {
       listAgentFiles: deps.listAgentFiles,
       now: deps.now,
       ...deps.gitLastCommit !== undefined ? { gitLastCommit: deps.gitLastCommit } : {},
+      console: {
+        token,
+        terminalEnabled,
+        ptyEnabled,
+        createClient: makeClient,
+        createPtyClient: makePtyClient
+      },
       log: deps.log
     });
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    deps.log(`No se pudo iniciar el dashboard: ${message}`);
+    deps.log(`No se pudo iniciar el console: ${message}`);
     return { exitCode: 1 };
   }
   deps.log("Escuchando en loopback. Pulsa Ctrl+C para parar.");
@@ -1649,7 +2474,7 @@ async function runDashboardServe(deps, options) {
   }
   await deps.waitForSignal();
   runtime.close();
-  deps.log("Dashboard detenido.");
+  deps.log("Console detenido.");
   return { exitCode: 0 };
 }
 
@@ -1951,8 +2776,8 @@ function errorMessage(error) {
   }
   return String(error);
 }
-async function listOpenAICompatibleModels(baseURL, fetch) {
-  const response = await fetch(modelsEndpoint(baseURL), {
+async function listOpenAICompatibleModels(baseURL, fetch2) {
+  const response = await fetch2(modelsEndpoint(baseURL), {
     method: "GET",
     headers: { accept: "application/json" }
   });
@@ -2403,6 +3228,139 @@ function createDetect(exec) {
   };
 }
 
+// src/cli/tunnel.ts
+function parsePort(value) {
+  if (value === undefined) {
+    return;
+  }
+  const n = Number.parseInt(value, 10);
+  return Number.isInteger(n) && n >= 1024 && n <= 65535 ? n : undefined;
+}
+function parseTunnelArgs(rest) {
+  const options = {
+    terminal: rest.includes("--terminal") || rest.includes("--expose-opencode"),
+    allowAnonymous: rest.includes("--allow-anonymous"),
+    yes: rest.includes("--yes") || rest.includes("-y")
+  };
+  for (let i = 0;i < rest.length; i += 1) {
+    if (rest[i] === "--port") {
+      const port = parsePort(rest[i + 1]);
+      if (port !== undefined) {
+        options.consolePort = port;
+      }
+    } else if (rest[i] === "--opencode-port") {
+      const port = parsePort(rest[i + 1]);
+      if (port !== undefined) {
+        options.opencodePort = port;
+      }
+    }
+  }
+  return options;
+}
+function parseDevtunnelUrls(stdout) {
+  const urls = [];
+  const seen = new Set;
+  const re = /Hosting port (\d+) at (https:\/\/\S+)/g;
+  let match = re.exec(stdout);
+  while (match !== null) {
+    const port = Number.parseInt(match[1], 10);
+    const url = match[2].replace(/[.,)]+$/, "");
+    const key = `${port} ${url}`;
+    if (!seen.has(key)) {
+      seen.add(key);
+      urls.push({ port, url });
+    }
+    match = re.exec(stdout);
+  }
+  return urls;
+}
+function planTunnel(input) {
+  const { options, consolePort, opencodePort, hasServerPassword } = input;
+  const ports = [consolePort];
+  const warnings = [];
+  const errors = [];
+  let exposeTerminal = false;
+  if (options.terminal) {
+    if (hasServerPassword) {
+      exposeTerminal = true;
+      ports.push(opencodePort);
+      warnings.push("Terminal remota EXPUESTA: opencode puede ejecutar comandos y editar ficheros a través del túnel.");
+    } else {
+      warnings.push("OPENCODE_SERVER_PASSWORD no está definido: la terminal remota queda deshabilitada; solo se expone la Console (observación).");
+    }
+  }
+  let allowAnonymous = false;
+  if (options.allowAnonymous) {
+    if (options.yes) {
+      allowAnonymous = true;
+      warnings.push("Túnel ANÓNIMO: cualquiera con la URL accede sin autenticación. Úsalo solo temporalmente.");
+    } else {
+      errors.push("El túnel anónimo (--allow-anonymous) requiere confirmación explícita con --yes (doble confirmación).");
+    }
+  }
+  return {
+    ports,
+    exposeTerminal,
+    allowAnonymous,
+    warnings,
+    errors,
+    ok: errors.length === 0
+  };
+}
+function buildDevtunnelArgs(plan) {
+  const args = ["host"];
+  for (const port of plan.ports) {
+    args.push("-p", String(port));
+  }
+  if (plan.allowAnonymous) {
+    args.push("--allow-anonymous");
+  }
+  return args;
+}
+async function runTunnel(deps, options) {
+  if (!await deps.isInstalled()) {
+    deps.log("No se encontró 'devtunnel'. Instálalo con: winget install Microsoft.devtunnel");
+    return { exitCode: 1 };
+  }
+  if (!await deps.isLoggedIn()) {
+    deps.log("No hay sesión en Dev Tunnels. Inicia sesión con: devtunnel user login");
+    return { exitCode: 1 };
+  }
+  const plan = planTunnel({
+    options,
+    consolePort: options.consolePort ?? deps.consolePort,
+    opencodePort: options.opencodePort ?? deps.opencodePort,
+    hasServerPassword: deps.hasServerPassword
+  });
+  for (const warning of plan.warnings) {
+    deps.log(`⚠ ${warning}`);
+  }
+  if (!plan.ok) {
+    for (const error of plan.errors) {
+      deps.log(`✖ ${error}`);
+    }
+    return { exitCode: 1 };
+  }
+  const child = deps.spawn("devtunnel", buildDevtunnelArgs(plan));
+  const seen = new Set;
+  const onData = (chunk) => {
+    for (const { port, url } of parseDevtunnelUrls(chunk.toString("utf8"))) {
+      const label = port === deps.consolePort ? "Console" : "opencode";
+      const line = `${label} (puerto ${port}): ${url}`;
+      if (!seen.has(line)) {
+        seen.add(line);
+        deps.log(line);
+      }
+    }
+  };
+  child.stdout?.on("data", onData);
+  deps.log("Túnel activo. Pulsa Ctrl+C para cerrarlo.");
+  await deps.waitForSignal();
+  child.kill();
+  deps.log("Túnel cerrado.");
+  return { exitCode: 0 };
+}
+
 // src/commands/baseline.ts
 function formatRef(ref) {
   return ref === null ? "—" : `${ref.providerID}/${ref.modelID}`;
@@ -2464,18 +3422,18 @@ function autoBaseline(config) {
   };
 }
 
-// src/commands/dashboard.ts
-function renderDashboardStatus(dashboard) {
-  const url = `http://${dashboard.host}:${dashboard.port}`;
+// src/commands/console.ts
+function renderConsoleStatus(console_) {
+  const url = `http://${console_.host}:${console_.port}`;
   return [
-    "Dashboard (multi-sesión, se lanza desde la CLI):",
+    "Console (multi-sesión, se lanza desde la CLI):",
     `  URL:        ${url}`,
-    `  Refresco:   ${dashboard.refreshMs} ms (SSE + polling)`,
-    `  Rutas:      últimas ${dashboard.recentRoutes}`,
-    dashboard.autoPortFallback ? "  Puerto:     con fallback automático si está ocupado" : "  Puerto:     fijo (sin fallback)",
+    `  Refresco:   ${console_.refreshMs} ms (SSE + polling)`,
+    `  Rutas:      últimas ${console_.recentRoutes}`,
+    console_.autoPortFallback ? "  Puerto:     con fallback automático si está ocupado" : "  Puerto:     fijo (sin fallback)",
     "",
-    "Lánzalo con:",
-    "  openteam dashboard                (Ctrl+C para parar; --open abre el navegador)",
+    "Lánzala con:",
+    "  openteam console                  (Ctrl+C para parar; --open abre el navegador)",
     "",
     "Agrega TODAS las sesiones de opencode que escriben eventos en",
     "  .opencode/openteam/sessions/*.jsonl",
@@ -2616,7 +3574,7 @@ function buildOrchestratorAgent(frontier, options = {}) {
     "- **scribe** — memoria silenciosa del equipo. Registra decisiones y",
     "  aprendizajes en un log compartido (`.opencode/openteam-decisions.md`) sin",
     "  ejecutar cambios de código. Modelo **local**; permisos de solo lectura más",
-    "  edición de ese log. **Formato parseable** para el dashboard: una decisión",
+    "  edición de ese log. **Formato parseable** para el console: una decisión",
     "  por línea como item de lista Markdown, ya **redactada** (sin prompts ni",
     "  datos sensibles):",
     "  `- YYYY-MM-DD [agente] Resumen breve de la decisión #tag1 #tag2`",
@@ -2751,8 +3709,9 @@ var HELP = [
   "  openteam baseline auto            Baseline cheapest-capable (modo auto)",
   "  openteam doctor                   Diagnóstico de runtimes y config",
   "  openteam agents                   Lista los agentes y el LLM (local/frontier) de cada uno",
-  "  openteam dashboard                Lanza el dashboard web multi-sesión (Ctrl+C para parar; --open abre el navegador)",
-  "  openteam dashboard --status       Muestra la config del dashboard sin lanzarlo",
+  "  openteam console                  Lanza la Console web multi-sesión (Ctrl+C para parar; --open abre el navegador)",
+  "  openteam console --status         Muestra la config de la Console sin lanzarla",
+  "  openteam tunnel                   Expone la Console vía Dev Tunnels (--terminal expone opencode; Ctrl+C para cerrar)",
   "  openteam report                   Resumen de coste/ahorro (telemetría)",
   "  openteam yolo status              Muestra si el modo YOLO está activo",
   "  openteam yolo on                  Activa YOLO (opencode auto-aprueba todo)",
@@ -2942,9 +3901,9 @@ async function runCli(argv, deps) {
     if (command === "agents") {
       return await runAgents(deps, configPath, opencodeConfigPath);
     }
-    if (command === "dashboard") {
+    if (command === "console") {
       const config = await deps.loadConfig(configPath);
-      return { exitCode: 0, stdout: renderDashboardStatus(config.dashboard) };
+      return { exitCode: 0, stdout: renderConsoleStatus(config.console) };
     }
     if (command === undefined || command === "help" || command === "--help") {
       return { exitCode: 0, stdout: HELP };
@@ -2995,7 +3954,7 @@ function fixedActionBody(action) {
 `);
 }
 function buildOpenteamCommand() {
-  return renderCommand("Comandos runtime de openteam (baseline show|set|auto, doctor, agents, dashboard, report)", [
+  return renderCommand("Comandos runtime de openteam (baseline show|set|auto, doctor, agents, console, report)", [
     "Usa la herramienta `openteam` para ejecutar el comando indicado por el usuario: $ARGUMENTS",
     "",
     "Interpreta los argumentos así y llama a la herramienta `openteam` una sola vez:",
@@ -3005,7 +3964,7 @@ function buildOpenteamCommand() {
     '- `baseline auto` → `action: "auto"`',
     '- `doctor` → `action: "doctor"`',
     '- `agents` → `action: "agents"`',
-    '- `dashboard` → `action: "dashboard"`',
+    '- `console` → `action: "console"`',
     '- `report` → `action: "report"`',
     "",
     "Devuelve la salida de la herramienta tal cual, sin reinterpretarla."
@@ -3035,7 +3994,7 @@ function buildOpenteamCommands() {
     file("openteam-baseline", buildBaselineCommand()),
     file("openteam-doctor", renderCommand("openteam · diagnóstico de runtimes locales y configuración", fixedActionBody("doctor"))),
     file("openteam-agents", renderCommand("openteam · lista los agentes y el LLM (local/frontier + suscripción) de cada uno", fixedActionBody("agents"))),
-    file("openteam-dashboard", renderCommand("openteam · estado y URL del dashboard web multi-sesión", fixedActionBody("dashboard"))),
+    file("openteam-console", renderCommand("openteam · estado y URL de la Console web multi-sesión", fixedActionBody("console"))),
     file("openteam-report", renderCommand("openteam · resumen de coste/ahorro (telemetría)", fixedActionBody("report")))
   ];
 }
@@ -3421,7 +4380,7 @@ async function runSetup(deps) {
       `Baseline frontier: ${frontier.providerID}/${frontier.modelID}`,
       `Runtimes locales: ${enabledSummary || "ninguno habilitado"}`,
       `Modo YOLO: ${yolo ? "activado (auto-aprueba permisos)" : "desactivado"}`,
-      "Dashboard web: se lanza aparte desde la CLI con 'openteam dashboard' (multi-sesión, loopback)",
+      "Console web: se lanza aparte desde la CLI con 'openteam console' (multi-sesión, loopback)",
       `Escrito: ${OPENCODE_CONFIG_PATH}, ${DEFAULT_CONFIG_PATH}, ${ORCHESTRATOR_AGENT_PATH}, ${OPENTEAM_COMMAND_DIR}/*.md (${slashCommands.length} comandos)`,
       "",
       "Siguientes pasos:",
@@ -3620,10 +4579,10 @@ async function main() {
     process.exitCode = result2.exitCode;
     return;
   }
-  if (argv[0] === "dashboard") {
-    const flags = parseDashboardServeArgs(argv.slice(1));
+  if (argv[0] === "console") {
+    const flags = parseConsoleServeArgs(argv.slice(1));
     if (!flags.status) {
-      const result2 = await runDashboardServe({
+      const result2 = await runConsoleServe({
         loadConfig,
         configPath: DEFAULT_CONFIG_PATH,
         sessionsDir: DEFAULT_SESSIONS_DIR,
@@ -3637,6 +4596,7 @@ async function main() {
         now: () => new Date().toISOString(),
         gitLastCommit: createGitLastCommit(nodeExec),
         waitForSignal,
+        ...process.env.OPENCODE_SERVER_PASSWORD !== undefined ? { serverPassword: process.env.OPENCODE_SERVER_PASSWORD } : {},
         log: (message) => process.stdout.write(`${message}
 `),
         openBrowser
@@ -3645,6 +4605,27 @@ async function main() {
       return;
     }
   }
+  if (argv[0] === "tunnel") {
+    const config = await loadConfig(DEFAULT_CONFIG_PATH);
+    const options = parseTunnelArgs(argv.slice(1));
+    const opencodePortEnv = Number.parseInt(process.env.OPENCODE_PORT ?? "", 10);
+    const result2 = await runTunnel({
+      isInstalled: async () => (await nodeExec("devtunnel", ["--version"])).exitCode === 0,
+      isLoggedIn: async () => {
+        const out = await nodeExec("devtunnel", ["user", "show"]);
+        return out.exitCode === 0 && !out.stdout.toLowerCase().includes("not logged");
+      },
+      spawn: (command, args) => spawn(command, args),
+      consolePort: config.console.port,
+      opencodePort: Number.isInteger(opencodePortEnv) ? opencodePortEnv : 4096,
+      hasServerPassword: process.env.OPENCODE_SERVER_PASSWORD !== undefined && process.env.OPENCODE_SERVER_PASSWORD.length > 0,
+      waitForSignal,
+      log: (message) => process.stdout.write(`${message}
+`)
+    }, options);
+    process.exitCode = result2.exitCode;
+    return;
+  }
   const result = await runCli(argv, deps);
   process.stdout.write(`${result.stdout}
 `);