@opentig/cli 0.2.3 → 0.2.4

package/dist/chunks/{server-Cz0gvydn.mjs → server-DMk8-Xxt.mjs}

@@ -1,12 +1,13 @@
+import { a as normalizePairingOrigin, c as redactSensitiveText, i as loadStartupNetwork, n as applyNetworkPatch, o as backupPathFor, r as isLoopbackHost, s as writeFileAtomically } from "./network-settings-CdFeKFRB.mjs";
 import process$1, { execArgv, execPath, hrtime, platform } from "node:process";
-import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process";
-import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
-import fs, { appendFileSync, closeSync, constants, createReadStream, createWriteStream, openSync, readFileSync, readSync, statSync, watch, writeFileSync } from "node:fs";
 import { access, appendFile, chmod, cp, link, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
 import path, { delimiter, dirname, extname, isAbsolute, join, resolve } from "node:path";
+import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import fs, { appendFileSync, closeSync, constants, createReadStream, createWriteStream, openSync, readFileSync, readSync, statSync, watch, writeFileSync } from "node:fs";
 import os, { constants as constants$1, homedir, networkInterfaces } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { aborted, callbackify, debuglog, inspect, promisify, stripVTControlCharacters } from "node:util";
+import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process";
+import { aborted, callbackify, debuglog, inspect, promisify, stripVTControlCharacters, types } from "node:util";
 import { StringDecoder } from "node:string_decoder";
 import tty from "node:tty";
 import { scheduler, setImmediate, setTimeout as setTimeout$1 } from "node:timers/promises";
@@ -12931,26 +12932,6 @@ function refine(fn, _params = {}) {
 function superRefine(fn, params) {
 	return /* @__PURE__ */ _superRefine(fn, params);
 }
-//#endregion
-//#region ../../src/shared/redaction.ts
-/** Removes credential-shaped values before text reaches logs or clients. */
-function redactSensitiveText(value) {
-	return value.replace(/\b(?:github_pat_|gh[opusr]_)[A-Za-z0-9_]{16,}/g, "[redacted]").replace(/\bauthorization\s*[:=]\s*(?:bearer|basic)\s+[^\s,;]+/gi, "authorization=[redacted]").replace(/\b(authorization|cookie|set-cookie)\s*[:=]\s*[^\s,;]+/gi, "$1=[redacted]").replace(/\b(token|secret|password)\s*[:=]\s*[^\s,;]+/gi, "$1=[redacted]").replace(/https?:\/\/[^\s"'<>]+/gi, (candidate) => redactUrl(candidate));
-}
-function redactUrl(candidate) {
-	try {
-		const url = new URL(candidate);
-		if (url.username || url.password) {
-			url.username = "[redacted]";
-			url.password = "";
-		}
-		url.search = "";
-		url.hash = "";
-		return url.toString();
-	} catch {
-		return "[redacted-url]";
-	}
-}
 var EMPTY_AI_USAGE = {
 	inputTokens: null,
 	outputTokens: null,
@@ -13104,34 +13085,6 @@ function flattenWhitespace$1(value) {
 	return flattened.replace(/ {2,}/g, " ").trim();
 }
 //#endregion
-//#region ../../src/main/persistence/atomicWrite.ts
-function backupPathFor(filePath) {
-	return `${filePath}.bak`;
-}
-async function writeFileAtomically(filePath, contents, options = {}) {
-	if (options.parseJson) JSON.parse(contents);
-	const directory = path.dirname(filePath);
-	await mkdir(directory, {
-		recursive: true,
-		...options.directoryMode === void 0 ? {} : { mode: options.directoryMode }
-	});
-	const temporary = `${filePath}.${randomUUID()}.tmp`;
-	try {
-		const handle = await open(temporary, "wx", 384);
-		try {
-			await handle.writeFile(contents, "utf8");
-			await handle.sync();
-		} finally {
-			await handle.close();
-		}
-		await rename(temporary, filePath);
-		await chmod(filePath, 384);
-	} catch (error) {
-		await rm(temporary, { force: true });
-		throw error;
-	}
-}
-//#endregion
 //#region ../../src/main/persistence/AiLogStore.ts
 /**
 * Records a run without ever letting the attempt reach the caller. Diagnostics
@@ -17348,6 +17301,64 @@ function isGitHubHttp(value) {
 	}
 }
 //#endregion
+//#region ../../src/main/git/ReadSingleFlight.ts
+/** Shares pending attempts only; invalidated results/errors get at most two retries. */
+var ReadSingleFlight = class {
+	generations = /* @__PURE__ */ new Map();
+	invalidate(scope) {
+		const generation = this.generations.get(scope);
+		if (generation) generation.invalidated = true;
+		this.generations.delete(scope);
+	}
+	clear() {
+		for (const scope of this.generations.keys()) this.invalidate(scope);
+	}
+	async run(scope, key, read, retryInvalidated = true) {
+		for (let attempt = 0; attempt < 3; attempt++) {
+			const { generation, promise } = this.pending(scope, key, read);
+			try {
+				const value = await promise;
+				if (!generation.invalidated || !retryInvalidated) return value;
+			} catch (error) {
+				if (!generation.invalidated || !retryInvalidated) throw error;
+			}
+		}
+		throw new Error("The repository changed repeatedly during the read. Try refreshing again.");
+	}
+	pending(scope, key, read) {
+		let generation = this.generations.get(scope);
+		if (!generation) {
+			generation = {
+				invalidated: false,
+				flights: /* @__PURE__ */ new Map()
+			};
+			this.generations.set(scope, generation);
+		}
+		const existing = generation.flights.get(key);
+		if (existing) return {
+			generation,
+			promise: existing
+		};
+		const current = generation;
+		const release = () => {
+			if (current.flights.get(key) === promise) current.flights.delete(key);
+			if (!current.flights.size && this.generations.get(scope) === current) this.generations.delete(scope);
+		};
+		const promise = Promise.resolve().then(read).then((value) => {
+			release();
+			return value;
+		}, (error) => {
+			release();
+			throw error;
+		});
+		current.flights.set(key, promise);
+		return {
+			generation,
+			promise
+		};
+	}
+};
+//#endregion
 //#region ../../src/main/git/GitProcess.ts
 /**
 * Two spellings of the same directory must share one queue. Collapsing case and
@@ -17358,6 +17369,9 @@ function normalizeLockKey(value) {
 	return process.platform === "win32" ? unified.toLowerCase() : unified;
 }
 var GitProcess = class {
+	reads = new ReadSingleFlight();
+	repositoryScopes = /* @__PURE__ */ new Map();
+	invalidationListeners = /* @__PURE__ */ new Set();
 	writeQueues = /* @__PURE__ */ new Map();
 	activeChildren = /* @__PURE__ */ new Set();
 	activeControllers = /* @__PURE__ */ new Set();
@@ -17369,6 +17383,32 @@ var GitProcess = class {
 	withNetworkContext(cwd, task) {
 		return this.networkScope ? this.networkScope(cwd, task) : task();
 	}
+	registerRepository(cwd, commonDir) {
+		const key = normalizeLockKey(path.resolve(cwd));
+		const scope = normalizeLockKey(path.resolve(commonDir));
+		if (this.repositoryScopes.get(key) === scope) return;
+		this.invalidate(cwd);
+		this.repositoryScopes.set(key, scope);
+	}
+	unregisterRepository(cwd) {
+		this.invalidate(cwd);
+		this.repositoryScopes.delete(normalizeLockKey(path.resolve(cwd)));
+	}
+	readScope(cwd) {
+		const key = normalizeLockKey(path.resolve(cwd));
+		return this.repositoryScopes.get(key) ?? key;
+	}
+	onInvalidate(listener) {
+		this.invalidationListeners.add(listener);
+	}
+	invalidate(cwd) {
+		const scope = this.readScope(cwd);
+		this.reads.invalidate(scope);
+		for (const listener of this.invalidationListeners) listener(scope);
+	}
+	shareRead(cwd, key, read, retryInvalidated = true) {
+		return this.reads.run(this.readScope(cwd), JSON.stringify([path.resolve(cwd), key]), read, retryInvalidated);
+	}
 	run(cwd, args, options) {
 		let index = 0;
 		while (args[index] === "-c") index += 2;
@@ -17376,13 +17416,28 @@ var GitProcess = class {
 			"fetch",
 			"push",
 			"ls-remote"
-		].includes(args[index] ?? "")) return this.network(cwd, args, options, (next, settings) => this.runDirect(cwd, next, settings));
+		].includes(args[index] ?? "")) return this.network(cwd, args, options, (next, settings) => this.runDirect(cwd, next, settings, false));
 		return this.runDirect(cwd, args, options);
 	}
-	runDirect(cwd, args, options) {
+	runDirect(cwd, args, options, retryInvalidated = true) {
 		const globalArgs = ["--no-pager"];
 		if (options.readOnly) globalArgs.push("--no-optional-locks");
-		return this.spawnGit(cwd, [...globalArgs, ...args], options);
+		const execute = () => this.spawnGit(cwd, [...globalArgs, ...args], options);
+		if (options.readOnly) {
+			if ("signal" in options && options.signal != null || "onStderr" in options && options.onStderr != null) return execute();
+			const key = createHash("sha256").update(JSON.stringify([
+				args,
+				options,
+				this.authenticationKey?.(cwd)
+			])).digest("hex");
+			return this.shareRead(cwd, `git:${key}`, execute, retryInvalidated).then((output) => ({
+				...output,
+				stdout: Buffer.from(output.stdout),
+				stderr: Buffer.from(output.stderr)
+			}));
+		}
+		this.invalidate(cwd);
+		return execute().finally(() => this.invalidate(cwd));
 	}
 	/**
 	* `lockKey` serializes against a queue other than `cwd` without changing the
@@ -17406,9 +17461,11 @@ var GitProcess = class {
 		const queued = previous.then(() => current);
 		this.writeQueues.set(key, queued);
 		await previous;
+		this.invalidate(rawKey);
 		try {
 			return await task();
 		} finally {
+			this.invalidate(rawKey);
 			release();
 			if (this.writeQueues.get(key) === queued) this.writeQueues.delete(key);
 		}
@@ -20525,6 +20582,7 @@ var RepositoryService = class {
 	async preparePath(selectedPath) {
 		const repository = await this.inspectPath(selectedPath);
 		this.repositories.set(repository.id, repository);
+		this.git.registerRepository(repository.path, repository.commonDir);
 		return repository;
 	}
 	async completeSetup(id, validate = () => void 0) {
@@ -20541,6 +20599,7 @@ var RepositoryService = class {
 			operation: "relocate-repository",
 			message: "The recent repository no longer exists."
 		});
+		const previous = this.get(id);
 		const repository = await this.inspectPath(selectedPath);
 		if (repository.id !== id && this.settings.recentRepositories.some((item) => item.id === repository.id)) throw new GitOperationError({
 			code: "INVALID_ARGUMENT",
@@ -20548,14 +20607,19 @@ var RepositoryService = class {
 			message: "That folder is already in OpenTig. Remove the old entry instead, or choose a different location."
 		});
 		await this.settings.relocateRepository(id, repository);
+		this.git.unregisterRepository(previous.path);
 		this.repositories.delete(id);
 		this.repositories.set(repository.id, repository);
+		this.git.registerRepository(repository.path, repository.commonDir);
 		return repository;
 	}
 	async forget(repositoryKey) {
 		const key = normalizeRepositoryKey(repositoryKey);
 		const organization = await this.settings.forgetRepository(key);
-		for (const [id, repository] of this.repositories) if (normalizeRepositoryKey(repository.commonDir) === key) this.repositories.delete(id);
+		for (const [id, repository] of this.repositories) if (normalizeRepositoryKey(repository.commonDir) === key) {
+			this.git.unregisterRepository(repository.path);
+			this.repositories.delete(id);
+		}
 		return organization;
 	}
 	recent(id) {
@@ -20602,6 +20666,7 @@ var RepositoryService = class {
 				commonDir: recent.commonDir
 			};
 			this.repositories.set(id, hydrated);
+			this.git.registerRepository(hydrated.path, hydrated.commonDir);
 			return hydrated;
 		}
 		throw new GitOperationError({
@@ -20614,6 +20679,16 @@ var RepositoryService = class {
 		return this.settings.recentRepositories;
 	}
 	async status(id, includeStats = true) {
+		const repository = this.get(id);
+		return structuredClone(await this.git.shareRead(repository.path, `status:${includeStats}`, () => this.readStatus(id, includeStats)));
+	}
+	invalidate(id) {
+		this.git.invalidate(this.get(id).path);
+	}
+	invalidateIfKnown(id) {
+		if (typeof id === "string" && (this.repositories.has(id) || this.recent(id))) this.invalidate(id);
+	}
+	async readStatus(id, includeStats) {
 		const repository = this.get(id);
 		const status = parseStatus((await this.git.run(repository.path, [
 			"status",
@@ -20643,7 +20718,10 @@ var RepositoryService = class {
 	*/
 	async forgetWorktree(worktreePath) {
 		const target = normalizeWorktreePath$1(worktreePath);
-		for (const [id, repository] of this.repositories) if (normalizeWorktreePath$1(repository.path) === target) this.repositories.delete(id);
+		for (const [id, repository] of this.repositories) if (normalizeWorktreePath$1(repository.path) === target) {
+			this.git.unregisterRepository(repository.path);
+			this.repositories.delete(id);
+		}
 		return this.settings.forgetWorktreePath(worktreePath);
 	}
 	/**
@@ -21851,6 +21929,7 @@ var GitHubService = class {
 	runner;
 	git;
 	repositories;
+	reads = new ReadSingleFlight();
 	gitAccess;
 	accounts;
 	constructor(resolver, runner, git, repositories, accounts) {
@@ -21858,9 +21937,37 @@ var GitHubService = class {
 		this.git = git;
 		this.repositories = repositories;
 		this.accounts = accounts ?? new GitHubAccountsService(resolver, runner, git);
+		this.git.onInvalidate((scope) => this.reads.invalidate(scope));
+	}
+	invalidate(repositoryId) {
+		if (repositoryId) this.reads.invalidate(this.git.readScope(this.repositories.get(repositoryId).path));
+		else this.reads.clear();
+	}
+	async shareRead(repositoryId, resource, read) {
+		for (let attempt = 0; attempt < 3; attempt++) {
+			const repository = this.repositories.get(repositoryId);
+			const revision = this.accounts.authRevision;
+			const key = JSON.stringify([
+				repository.path,
+				repository.commonDir,
+				revision,
+				this.accounts.revisionFor(repository),
+				...resource
+			]);
+			try {
+				const value = await this.reads.run(this.git.readScope(repository.path), key, read);
+				if (revision === this.accounts.authRevision) return structuredClone(value);
+			} catch (error) {
+				if (revision === this.accounts.authRevision) throw error;
+			}
+		}
+		throw new Error("The GitHub account changed repeatedly during the read. Try refreshing again.");
 	}
 	async status(forceRefresh = false) {
-		if (forceRefresh) this.accounts.refreshAuthentication();
+		if (forceRefresh) {
+			this.invalidate();
+			this.accounts.refreshAuthentication();
+		}
 		const detected = await this.accounts.detect(forceRefresh);
 		return {
 			installed: !!detected.candidate,
@@ -21871,6 +21978,7 @@ var GitHubService = class {
 		};
 	}
 	async repositoryAccount(repositoryId, forceRefresh = false) {
+		if (forceRefresh) this.invalidate(repositoryId);
 		const repository = this.repositories.get(repositoryId);
 		const info = await this.repositoryInfo(repositoryId);
 		const remote = await this.remote(repositoryId);
@@ -21911,9 +22019,23 @@ var GitHubService = class {
 			return "";
 		}
 	}
-	async repositoryInfo(repositoryId) {
+	repositoryInfo(repositoryId) {
+		return this.shareRead(repositoryId, [], () => this.readRepositoryInfo(repositoryId));
+	}
+	async readRepositoryInfo(repositoryId) {
+		return (await this.routing(repositoryId)).info;
+	}
+	routing(repositoryId) {
+		return this.shareRead(repositoryId, ["routing"], async () => {
+			const remote = await this.remote(repositoryId);
+			return {
+				remote,
+				info: await this.infoForRemote(remote)
+			};
+		});
+	}
+	async infoForRemote(url) {
 		try {
-			const url = await this.remote(repositoryId);
 			let parsed = parseGitHubRemote(url);
 			if (!parsed) {
 				const ssh = parseSshRemote(url);
@@ -21946,9 +22068,12 @@ var GitHubService = class {
 			};
 		}
 	}
-	async listPullRequests(repositoryId, states) {
+	listPullRequests(repositoryId, states) {
+		return this.shareRead(repositoryId, ["list", [...states].sort()], () => this.readListPullRequests(repositoryId, states));
+	}
+	async readListPullRequests(repositoryId, states) {
 		const { repository, nameWithOwner, auth, executable } = await this.requireGitHub(repositoryId, "gh-pr-list");
-		const results = await Promise.all(states.map((state) => this.runGh([
+		const results = await Promise.all(states.map((state) => this.runGhRead([
 			"pr",
 			"list",
 			"-R",
@@ -21969,11 +22094,14 @@ var GitHubService = class {
 		})));
 		return this.withStackMembership(repository.path, nameWithOwner, auth, executable, selectPullRequestsNewestFirst(results.flatMap((result) => parsePullRequestList(result.stdout)), states));
 	}
-	async findPullRequestForBranch(repositoryId, branchName) {
+	findPullRequestForBranch(repositoryId, branchName) {
+		return this.shareRead(repositoryId, ["branch", branchName], () => this.readFindPullRequestForBranch(repositoryId, branchName));
+	}
+	async readFindPullRequestForBranch(repositoryId, branchName) {
 		const operation = "gh-pr-for-branch";
 		const { repository, nameWithOwner, auth, executable } = await this.requireGitHub(repositoryId, operation);
 		const branch = validateRef(branchName, operation);
-		const openPull = sortPullRequestsNewestFirst(parseBranchPullRequestList((await this.runGh([
+		const openPull = sortPullRequestsNewestFirst(parseBranchPullRequestList((await this.runGhRead([
 			"pr",
 			"list",
 			"-R",
@@ -21994,8 +22122,8 @@ var GitHubService = class {
 			timeoutMs: NETWORK_TIMEOUT_MS,
 			maxOutputBytes: 1048576
 		})).stdout, nameWithOwner, branch)).find((pull) => pull.state === "OPEN");
-		if (openPull) return openPull;
-		return sortPullRequestsNewestFirst(parseBranchPullRequestList((await this.runGh([
+		if (openPull) return (await this.withStackMembership(repository.path, nameWithOwner, auth, executable, [openPull]))[0];
+		const pull = sortPullRequestsNewestFirst(parseBranchPullRequestList((await this.runGhRead([
 			"pr",
 			"list",
 			"-R",
@@ -22015,11 +22143,15 @@ var GitHubService = class {
 			operation,
 			timeoutMs: NETWORK_TIMEOUT_MS,
 			maxOutputBytes: 1048576
-		})).stdout, nameWithOwner, branch))[0] ?? null;
+		})).stdout, nameWithOwner, branch))[0];
+		return pull ? (await this.withStackMembership(repository.path, nameWithOwner, auth, executable, [pull]))[0] : null;
+	}
+	getPullRequest(repositoryId, prNumber) {
+		return this.shareRead(repositoryId, ["details", prNumber], () => this.readGetPullRequest(repositoryId, prNumber));
 	}
-	async getPullRequest(repositoryId, prNumber) {
+	async readGetPullRequest(repositoryId, prNumber) {
 		const { repository, nameWithOwner, auth, executable } = await this.requireGitHub(repositoryId, "gh-pr-view");
-		const details = parsePullRequestDetails((await this.runGh([
+		const details = parsePullRequestDetails((await this.runGhRead([
 			"pr",
 			"view",
 			String(prNumber),
@@ -22044,7 +22176,7 @@ var GitHubService = class {
 			const batch = pulls.slice(start, start + 25);
 			try {
 				const numbers = batch.map((pr) => pr.number);
-				const memberships = parseStackMemberships((await this.runGh([
+				const memberships = parseStackMemberships((await this.runGhRead([
 					"api",
 					"graphql",
 					"-f",
@@ -22074,7 +22206,10 @@ var GitHubService = class {
 		}
 		return enriched;
 	}
-	async getPullRequestStack(repositoryId, prNumber) {
+	getPullRequestStack(repositoryId, prNumber) {
+		return this.shareRead(repositoryId, ["stack", prNumber], () => this.readGetPullRequestStack(repositoryId, prNumber));
+	}
+	async readGetPullRequestStack(repositoryId, prNumber) {
 		const operation = "gh-pr-stack";
 		const { repository, nameWithOwner, auth, executable } = await this.requireGitHub(repositoryId, operation);
 		const options = {
@@ -22085,7 +22220,7 @@ var GitHubService = class {
 			timeoutMs: NETWORK_TIMEOUT_MS,
 			maxOutputBytes: 4194304
 		};
-		const read = async (endpoint) => this.runGh(["api", endpoint], options);
+		const read = async (endpoint) => this.runGhRead(["api", endpoint], options);
 		let listing;
 		try {
 			listing = await read(`repos/${nameWithOwner}/stacks?pull_request=${prNumber}`);
@@ -22103,9 +22238,12 @@ var GitHubService = class {
 		});
 		return complete;
 	}
-	async getPullRequestDiff(repositoryId, prNumber) {
+	getPullRequestDiff(repositoryId, prNumber) {
+		return this.shareRead(repositoryId, ["diff", prNumber], () => this.readGetPullRequestDiff(repositoryId, prNumber));
+	}
+	async readGetPullRequestDiff(repositoryId, prNumber) {
 		const { repository, nameWithOwner, auth, executable } = await this.requireGitHub(repositoryId, "gh-pr-diff");
-		const patch = (await this.runGh([
+		const patch = (await this.runGhRead([
 			"pr",
 			"diff",
 			String(prNumber),
@@ -22128,7 +22266,10 @@ var GitHubService = class {
 			lineCount: patch ? patch.split("\n").length : 0
 		};
 	}
-	async getPullRequestCommitDiff(repositoryId, oid) {
+	getPullRequestCommitDiff(repositoryId, oid) {
+		return this.shareRead(repositoryId, ["commit-diff", oid], () => this.readGetPullRequestCommitDiff(repositoryId, oid));
+	}
+	async readGetPullRequestCommitDiff(repositoryId, oid) {
 		const operation = "gh-pr-commit-diff";
 		const { repository, nameWithOwner, auth, executable } = await this.requireGitHub(repositoryId, operation);
 		if (!/^[0-9a-f]{40,64}$/i.test(oid)) throw new GhOperationError({
@@ -22136,7 +22277,7 @@ var GitHubService = class {
 			operation,
 			message: "The commit is not valid."
 		});
-		const patch = (await this.runGh([
+		const patch = (await this.runGhRead([
 			"api",
 			`repos/${nameWithOwner}/commits/${oid}`,
 			"--header",
@@ -22215,14 +22356,21 @@ var GitHubService = class {
 			];
 			if (input.draft) args.push("--draft");
 			verifyAccount();
-			const created = parseCreatedPullRequestUrl((await this.runGh(args, {
-				auth,
-				executable,
-				cwd: repository.path,
-				operation,
-				timeoutMs: 12e4,
-				maxOutputBytes: 1048576
-			})).stdout);
+			this.invalidate(input.repositoryId);
+			let result;
+			try {
+				result = await this.runGh(args, {
+					auth,
+					executable,
+					cwd: repository.path,
+					operation,
+					timeoutMs: 12e4,
+					maxOutputBytes: 1048576
+				});
+			} finally {
+				this.invalidate(input.repositoryId);
+			}
+			const created = parseCreatedPullRequestUrl(result.stdout);
 			if (!created) throw new GhOperationError({
 				code: "GH_INVALID_OUTPUT",
 				operation,
@@ -22238,13 +22386,12 @@ var GitHubService = class {
 	}
 	async requireGitHub(repositoryId, operation) {
 		const repository = this.repositories.get(repositoryId);
-		const info = await this.repositoryInfo(repositoryId);
+		const { remote, info } = await this.routing(repositoryId);
 		if (!info.isGitHub || !info.nameWithOwner) throw new GhOperationError({
 			code: "GH_NOT_GITHUB_REPO",
 			operation,
 			message: "The origin remote does not point to a GitHub repository."
 		});
-		const remote = await this.remote(repositoryId);
 		const authenticated = await this.accounts.authenticate(repository, remote, info.nameWithOwner, operation);
 		return {
 			repository,
@@ -22252,6 +22399,10 @@ var GitHubService = class {
 			...authenticated
 		};
 	}
+	runGhRead(args, options) {
+		const key = createHash("sha256").update(JSON.stringify([args, options])).digest("hex");
+		return this.reads.run(this.git.readScope(options.cwd), `command:${key}`, () => this.runGh(args, options), false);
+	}
 	async runGh(args, options) {
 		const result = await this.run(options.executable, args, options);
 		if (result.exitCode !== 0) throw classifyFailure({
@@ -22975,6 +23126,11 @@ function normalizeRemoteFetchIntervalSeconds(value) {
 	const stepped = Math.round(rounded / 5) * 5;
 	return Math.min(300, Math.max(5, stepped));
 }
+//#endregion
+//#region ../../src/main/window/desktop-window-size.ts
+/** Smallest restored desktop width that keeps the toolbar on one row.
+*  Renderer wrapping starts at max-width 1100px in styles/mobile.css. */
+var DESKTOP_MIN_WINDOW_WIDTH = 1104;
 var defaults = {
 	version: 2,
 	githubAccounts: {},
@@ -23041,6 +23197,7 @@ var SettingsStore = class {
 	loaded = false;
 	repositoryAiWriteVersions = /* @__PURE__ */ new Map();
 	pendingWrite = Promise.resolve();
+	persistedSnapshot = null;
 	backgroundTimers = /* @__PURE__ */ new Map();
 	backgroundDirty = /* @__PURE__ */ new Set();
 	lastBackgroundWriteError = null;
@@ -23075,6 +23232,7 @@ var SettingsStore = class {
 		}
 		const backup = await readJsonDocument(backupPathFor(this.filePath));
 		if (!backup.ok || backup.raw !== snapshot) await writeFileAtomically(backupPathFor(this.filePath), snapshot, { parseJson: true });
+		this.persistedSnapshot = snapshot;
 	}
 	get recentRepositories() {
 		return [...this.data.recentRepositories];
@@ -23455,8 +23613,11 @@ var SettingsStore = class {
 	enqueueWrite() {
 		const snapshot = this.snapshot();
 		const write = this.pendingWrite.then(async () => {
+			if (snapshot === this.persistedSnapshot) return;
+			this.persistedSnapshot = null;
 			await writeFileAtomically(this.filePath, snapshot, { parseJson: true });
 			await writeFileAtomically(backupPathFor(this.filePath), snapshot, { parseJson: true });
+			this.persistedSnapshot = snapshot;
 		});
 		this.pendingWrite = write.catch(() => void 0);
 		return write;
@@ -23529,7 +23690,7 @@ function validate(value, defaultDoubleControlShortcutEnabled) {
 	const parsedBounds = windowBoundsRecordSchema.safeParse(input.windowBounds);
 	const bounds = parsedBounds.success ? parsedBounds.data : null;
 	const windowBounds = bounds && typeof bounds.width === "number" && Number.isFinite(bounds.width) && typeof bounds.height === "number" && Number.isFinite(bounds.height) ? {
-		width: Math.max(900, bounds.width),
+		width: Math.max(DESKTOP_MIN_WINDOW_WIDTH, bounds.width),
 		height: Math.max(600, bounds.height),
 		...typeof bounds.x === "number" && Number.isFinite(bounds.x) ? { x: bounds.x } : {},
 		...typeof bounds.y === "number" && Number.isFinite(bounds.y) ? { y: bounds.y } : {}
@@ -23777,6 +23938,7 @@ var OpenTigRuntime = class {
 	}
 	publishRepositoryChange(repositoryId, scope) {
 		if (this.closePromise) return;
+		this.services.repositories.invalidateIfKnown(repositoryId);
 		const elapsed = Date.now() - this.lastNotifiedAt;
 		if (elapsed < 1e3) {
 			this.trailingChange = this.trailingChange?.repositoryId === repositoryId ? {
@@ -24989,11 +25151,26 @@ function orderingIndexArg(value, operation) {
 //#region ../../src/main/runtime/registerServerCommands.ts
 function registerServerCommands(registry, services, host) {
 	const serverDefinitions = new Map(Object.values(OPEN_TIG_SERVER_COMMANDS).map((definition) => [definition.command, definition]));
+	const repositoryMutations = new Set(Object.entries(OPEN_TIG_SERVER_COMMANDS).filter(([method, definition]) => definition.mutation && [
+		"repository.",
+		"index.",
+		"commits.",
+		"refs."
+	].some((prefix) => method.startsWith(prefix))).map(([, definition]) => definition.command));
 	const handleWithContext = (channel, operation, handler) => {
 		const definition = serverDefinitions.get(channel);
 		if (!definition) throw new Error(`Not a server command: ${channel}`);
 		if (definition.operation !== operation) throw new Error(`Operation mismatch for ${channel}: ${operation}`);
-		registry.registerHandler(definition, (context, args) => handler(context, ...args));
+		registry.registerHandler(definition, async (context, args) => {
+			const first = args[0];
+			const repositoryId = typeof first === "object" && first !== null && "repositoryId" in first ? first.repositoryId : first;
+			if (repositoryMutations.has(channel)) services.repositories.invalidateIfKnown(repositoryId);
+			try {
+				return await handler(context, ...args);
+			} finally {
+				if (repositoryMutations.has(channel)) services.repositories.invalidateIfKnown(repositoryId);
+			}
+		});
 	};
 	const handle = (channel, operation, handler) => {
 		handleWithContext(channel, operation, (_context, ...args) => handler(...args));
@@ -25470,6 +25647,8 @@ function clipboardImageArg(value) {
 //#endregion
 //#region ../../src/shared/server-protocol.ts
 var OPEN_TIG_PROTOCOL_VERSION = { protocolVersion: 4 }.protocolVersion;
+/** UTF-8 JSON bytes, including the envelope and escaped strings. */
+var OPEN_TIG_MAX_SERVER_MESSAGE_BYTES = 4194304;
 //#endregion
 //#region ../../src/shared/application-profile.ts
 function applicationName(profile) {
@@ -26327,7 +26506,11 @@ async function handleRequest(context, request, response) {
 			listeningOnLan: !isLoopbackAddress(listener.host),
 			listenerHost: listener.host,
 			actualPort: listener.port,
-			ready: context.isReady()
+			ready: context.isReady(),
+			...context.webAccess ? {
+				configuration: context.webAccess.getStatus(),
+				recoveryCommand: context.webAccess.getStatus().recoveryCommand
+			} : {}
 		});
 	}
 	if (method === "GET" && rawPath === "/api/auth/sessions") {
@@ -26343,9 +26526,20 @@ async function handleRequest(context, request, response) {
 			};
 		}) });
 	}
-	if (method === "POST" && rawPath === "/api/admin/pair") return handleLocalAdminPair(context, request, response);
+	if (method === "POST" && (rawPath === "/api/admin/pair" || rawPath === "/api/admin/status")) return handleLocalAdminRequest(context, request, response, rawPath === "/api/admin/status");
 	if (method === "POST" && rawPath.startsWith("/api/")) {
 		if (!isAllowedOrigin(request)) return sendJson(response, 403, { error: "Forbidden origin." });
+		if (rawPath === "/api/auth/web-access") {
+			if (!context.auth.authenticate(request.headers)) return sendJson(response, 401, { error: "Authentication required." });
+			if (!context.webAccess) return sendJson(response, 503, { error: "Web access settings are unavailable." });
+			const body = await readJsonObject(request, response);
+			if (!body) return;
+			try {
+				return sendJson(response, 200, await context.webAccess.update(body), { Connection: "close" });
+			} catch (error) {
+				return sendJson(response, 400, { error: error instanceof Error ? error.message : "Could not change web access." }, { Connection: "close" });
+			}
+		}
 		if (rawPath === "/api/html-preview") return handleHtmlPreview(context, request, response);
 		if (rawPath === "/api/auth/pairing-link") {
 			if (!context.auth.authenticate(request.headers)) return sendJson(response, 401, { error: "Authentication required." });
@@ -26354,7 +26548,17 @@ async function handleRequest(context, request, response) {
 				code: "WEB_ACCESS_DISABLED"
 			});
 			if (!context.isReady()) return sendJson(response, 503, { error: "Server is not ready." });
-			const url = new URL("/pair", request.headers.origin);
+			const body = request.headers["content-length"] && request.headers["content-length"] !== "0" || request.headers["transfer-encoding"] ? await readJsonObject(request, response) : {};
+			if (!body) return;
+			let endpoint;
+			try {
+				endpoint = body.endpoint === void 0 ? request.headers.origin : normalizePairingOrigin(typeof body.endpoint === "string" ? body.endpoint : "");
+			} catch {
+				return sendJson(response, 400, { error: "Enter a valid pairing endpoint." });
+			}
+			const status = context.webAccess?.getStatus();
+			if (!endpoint || endpoint !== request.headers.origin && !status?.pairingEndpoints.includes(endpoint)) return sendJson(response, 400, { error: "Select an active pairing endpoint or save its domain." });
+			const url = new URL("/pair", endpoint);
 			const pairing = context.auth.createPairingToken();
 			url.hash = new URLSearchParams({ token: pairing.token }).toString();
 			return sendJson(response, 200, {
@@ -26519,14 +26723,20 @@ function isLoopbackAddress(value) {
 	const normalized = value.startsWith("::ffff:") ? value.slice(7) : value;
 	return normalized === "::1" || normalized.startsWith("127.");
 }
-async function handleLocalAdminPair(context, request, response) {
+async function handleLocalAdminRequest(context, request, response, statusOnly = false) {
 	const admin = context.admin;
 	const suppliedToken = request.headers["x-opentig-admin"];
 	if (!admin || !isLocalAddress(request.socket.remoteAddress) || typeof suppliedToken !== "string" || !sameSecret(admin.token, suppliedToken)) return sendJson(response, 404, { error: "Not found." });
 	const body = await readJsonObject(request, response);
 	if (!body) return;
-	if (body.instanceId !== admin.instanceId || typeof body.publicOrigin !== "string") return sendJson(response, 409, { error: "OpenTig server identity mismatch." });
-	const origin = normalizePublicOrigin(body.publicOrigin);
+	if (body.instanceId !== admin.instanceId) return sendJson(response, 409, { error: "OpenTig server identity mismatch." });
+	if (statusOnly) return sendJson(response, context.isReady() ? 200 : 503, {
+		status: context.isReady() ? "ready" : "not-ready",
+		...context.identity,
+		instanceId: admin.instanceId,
+		pid: process.pid
+	});
+	const origin = typeof body.publicOrigin === "string" ? normalizePublicOrigin(body.publicOrigin) : null;
 	if (!origin) return sendJson(response, 400, { error: "Invalid public origin." });
 	if (!context.auth.descriptor().browserAccessEnabled) return sendJson(response, 403, {
 		error: "Web access is disabled.",
@@ -26684,6 +26894,64 @@ function redactOperationResult(result) {
 	};
 }
 //#endregion
+//#region src/bounded-json.ts
+/** Stop JSON.stringify before it builds an oversized wire message. */
+var JsonByteLimitError = class extends Error {};
+function stringifyBounded(value, maxBytes) {
+	let bytes = 0;
+	let root = true;
+	const populated = /* @__PURE__ */ new WeakSet();
+	const add = (count) => {
+		bytes += count;
+		if (bytes > maxBytes) throw new JsonByteLimitError("JSON byte limit exceeded.");
+	};
+	const text = JSON.stringify(value, function(key, entry) {
+		if (typeof entry === "object" && entry !== null && types.isBoxedPrimitive(entry)) {
+			if (types.isNumberObject(entry)) entry = +entry;
+			else if (types.isStringObject(entry)) entry = String(entry);
+			else if (types.isBooleanObject(entry)) entry = Boolean.prototype.valueOf.call(entry);
+		}
+		const omitted = entry === void 0 || typeof entry === "function" || typeof entry === "symbol";
+		const isRoot = root;
+		root = false;
+		if (omitted && !Array.isArray(this)) return entry;
+		if (!isRoot) {
+			if (populated.has(this)) add(1);
+			else populated.add(this);
+			if (!Array.isArray(this)) add(stringBytes(key, maxBytes - bytes) + 1);
+		}
+		if (typeof entry === "string") add(stringBytes(entry, maxBytes - bytes));
+		else if (entry === null || omitted) add(4);
+		else if (typeof entry === "number") add(Number.isFinite(entry) ? String(entry).length : 4);
+		else if (typeof entry === "boolean") add(entry ? 4 : 5);
+		else if (typeof entry === "object") {
+			add(2);
+			populated.delete(entry);
+		}
+		return entry;
+	});
+	if (text === void 0) throw new TypeError("Expected a JSON value.");
+	return {
+		text,
+		bytes
+	};
+}
+function stringBytes(value, remaining) {
+	let bytes = Buffer.byteLength(value) + 2;
+	if (bytes > remaining) throw new JsonByteLimitError("JSON byte limit exceeded.");
+	if (!/[\u0000-\u001f"\\\ud800-\udfff]/.test(value)) return bytes;
+	bytes = 2;
+	for (let start = 0; start < value.length;) {
+		let end = Math.min(start + 16384, value.length);
+		const previous = value.charCodeAt(end - 1), next = value.charCodeAt(end);
+		if (previous >= 55296 && previous <= 56319 && next >= 56320 && next <= 57343) end++;
+		bytes += Buffer.byteLength(JSON.stringify(value.slice(start, end))) - 2;
+		if (bytes > remaining) throw new JsonByteLimitError("JSON byte limit exceeded.");
+		start = end;
+	}
+	return bytes;
+}
+//#endregion
 //#region src/websocket.ts
 var NORMAL_FRAME_LIMIT = 1048576;
 var CONTENT_FRAME_LIMIT = 9437184;
@@ -26706,6 +26974,7 @@ var OpenTigWebSocketTransport = class {
 	connectionLimit;
 	requestRateLimit;
 	requestRateWindowMs;
+	measureTransport = process.env.OPENTIG_PERF_LOG === "1";
 	heartbeat;
 	upgradeHandler;
 	closePromise = null;
@@ -26746,6 +27015,10 @@ var OpenTigWebSocketTransport = class {
 		this.closePromise ??= this.closeTransport();
 		return this.closePromise;
 	}
+	/** Keep authentication and runtime alive while clients reconnect to a new bind. */
+	reconnectClients() {
+		for (const socket of this.clients.keys()) socket.terminate();
+	}
 	upgrade(request, socket, head) {
 		if ((request.url ?? "").split(/[?#]/, 1)[0] !== "/ws") return rejectUpgrade(socket, 404, "Not Found");
 		if (!isAllowedOrigin(request)) return rejectUpgrade(socket, 403, "Forbidden");
@@ -26806,6 +27079,7 @@ var OpenTigWebSocketTransport = class {
 		if (bytes.byteLength > frameLimit(input.command)) return this.sendProtocolError(socket, input.id, "Command request exceeded the transport limit.");
 		if (input.command === IPC.repositoryReadImage) return this.sendProtocolError(socket, input.id, "Image previews use authenticated HTTP.");
 		const controller = new AbortController();
+		const startedAt = this.measureTransport ? performance.now() : void 0;
 		state.requests.set(input.id, controller);
 		const execution = this.options.registry.execute(state.sessionId, input.command, input.args, { signal: controller.signal });
 		this.pendingOperations.add(execution);
@@ -26823,6 +27097,10 @@ var OpenTigWebSocketTransport = class {
 			});
 		} finally {
 			state.requests.delete(input.id);
+			if (startedAt !== void 0) this.measure("request", startedAt, {
+				requestBytes: bytes.byteLength,
+				operation: commandDefinition(input.command)?.operation ?? "unknown"
+			});
 		}
 	}
 	sendProtocolError(socket, id, message) {
@@ -26840,21 +27118,93 @@ var OpenTigWebSocketTransport = class {
 		});
 	}
 	broadcast(message) {
-		for (const socket of this.clients.keys()) this.send(socket, message);
+		let serialized;
+		for (const socket of this.clients.keys()) {
+			if (!this.canSend(socket)) continue;
+			if (serialized === void 0) serialized = this.serialize(message);
+			this.sendSerialized(socket, serialized);
+		}
 	}
 	send(socket, message) {
-		if (socket.readyState !== WebSocket.OPEN) return;
+		if (this.canSend(socket)) this.sendSerialized(socket, this.serialize(message));
+	}
+	canSend(socket) {
+		if (socket.readyState !== WebSocket.OPEN) return false;
 		const state = this.clients.get(socket);
-		if (state && !this.options.auth.hasSession(state.sessionId)) return socket.close(1008, "Session expired or revoked");
-		const serialized = JSON.stringify(message);
-		if (socket.bufferedAmount + Buffer.byteLength(serialized) > MAX_BUFFERED_SEND_BYTES) {
+		if (!state || !this.options.auth.hasSession(state.sessionId)) {
+			socket.close(1008, "Session expired or revoked");
+			return false;
+		}
+		return true;
+	}
+	serialize(message) {
+		const startedAt = this.measureTransport ? performance.now() : void 0;
+		let serialized = null;
+		let outcome = "accepted";
+		try {
+			serialized = stringifyBounded(message, OPEN_TIG_MAX_SERVER_MESSAGE_BYTES);
+		} catch (error) {
+			if (!(error instanceof JsonByteLimitError)) throw error;
+			outcome = "message-too-large";
+			if (message.type === "result") {
+				outcome = "response-too-large";
+				serialized = stringifyBounded({
+					type: "result",
+					id: message.id,
+					result: {
+						ok: false,
+						error: {
+							code: "RESPONSE_TOO_LARGE",
+							operation: "server-protocol",
+							message: "Response exceeded the 4 MiB transport limit. Request a smaller scope.",
+							maxBytes: OPEN_TIG_MAX_SERVER_MESSAGE_BYTES
+						}
+					}
+				}, OPEN_TIG_MAX_SERVER_MESSAGE_BYTES);
+			}
+		}
+		if (startedAt !== void 0) this.measure("serialize", startedAt, {
+			bytes: serialized?.bytes ?? 0,
+			outcome,
+			maxBytes: OPEN_TIG_MAX_SERVER_MESSAGE_BYTES
+		});
+		return serialized;
+	}
+	sendSerialized(socket, serialized) {
+		if (!this.canSend(socket)) return;
+		if (!serialized) {
+			socket.close(1009, "Server message too large");
+			return;
+		}
+		const startedAt = this.measureTransport ? performance.now() : void 0;
+		const bufferedBytes = socket.bufferedAmount;
+		if (bufferedBytes + serialized.bytes > MAX_BUFFERED_SEND_BYTES) {
+			if (startedAt !== void 0) this.measure("send", startedAt, {
+				bytes: serialized.bytes,
+				bufferedBytes,
+				outcome: "backpressure"
+			});
 			socket.close(1013, "Client is too slow");
 			return;
 		}
-		socket.send(serialized, (error) => {
+		socket.send(serialized.text, (error) => {
+			if (startedAt !== void 0) this.measure("send", startedAt, {
+				bytes: serialized.bytes,
+				bufferedBytes,
+				outcome: error ? "failed" : "written"
+			});
 			if (error) this.options.logger("warn", "WebSocket send failed.");
 		});
 	}
+	measure(kind, startedAt, data) {
+		try {
+			this.options.logger("info", `WebSocket performance ${JSON.stringify({
+				kind,
+				durationMs: performance.now() - startedAt,
+				...data
+			})}`);
+		} catch {}
+	}
 	checkHeartbeats() {
 		for (const [socket, state] of this.clients) {
 			if (!this.options.auth.hasSession(state.sessionId)) {
@@ -26944,8 +27294,11 @@ var OpenTigServer = class {
 	ready = false;
 	startPromise = null;
 	stopPromise = null;
+	networkMutation = Promise.resolve();
+	network;
 	constructor(options) {
 		this.options = options;
+		this.network = options.network;
 		this.logger = options.logger ?? (() => void 0);
 		this.httpServer = createServer$1(createOpenTigHttpHandler({
 			runtime: options.runtime,
@@ -26954,6 +27307,10 @@ var OpenTigServer = class {
 			cancelUpdate: () => options.registry.resumeAfterUpdate(),
 			clientRoot: options.clientRoot,
 			auth: options.auth,
+			webAccess: {
+				getStatus: () => this.getWebAccessStatus(),
+				update: (patch) => this.updateWebAccess(patch)
+			},
 			identity: options.identity,
 			mode: options.mode ?? "desktop",
 			isReady: () => this.ready,
@@ -27003,6 +27360,74 @@ var OpenTigServer = class {
 			browserAccessEnabled: this.options.auth.descriptor().browserAccessEnabled
 		};
 	}
+	getWebAccessStatus() {
+		const address = this.httpServer.address();
+		const port = address?.port ?? this.network.listenerPort;
+		const host = address?.address ?? this.network.listenerHost;
+		const localEndpoint = `http://${formatHost(host === "0.0.0.0" ? "127.0.0.1" : host === "::" ? "::1" : host)}:${port}`;
+		const endpoints = Object.values(networkInterfaces()).flat().filter((entry) => entry && !entry.internal && !entry.address.startsWith("169.254.") && !entry.address.startsWith("fe80:") && (host.includes(":") || entry.family === "IPv4")).map((entry) => `http://${formatHost(entry.address)}:${port}`);
+		const networkEndpoints = [...new Set(endpoints)].sort();
+		const listeningOnLan = !isLoopbackHost(host);
+		return {
+			webAccessEnabled: this.options.auth.descriptor().browserAccessEnabled,
+			lanAccessEnabled: this.network.lanAccessEnabled,
+			publicOrigin: this.network.publicOrigin,
+			listeningOnLan,
+			listenerHost: host,
+			actualPort: port,
+			serverState: this.ready ? "ready" : "restarting",
+			localEndpoint,
+			networkEndpoints,
+			pairingEndpoints: this.network.webAccessEnabled ? [.../* @__PURE__ */ new Set([
+				localEndpoint,
+				...listeningOnLan ? networkEndpoints.filter((endpoint) => host === "0.0.0.0" || host === "::" || new URL(endpoint).hostname.replace(/[[\]]/g, "") === host) : [],
+				...this.network.publicOrigin ? [this.network.publicOrigin] : []
+			])] : [],
+			connectedSessionCount: this.webSockets.connectedSessionCount,
+			restartError: null,
+			...this.options.recoveryCommand ? { recoveryCommand: this.options.recoveryCommand } : {}
+		};
+	}
+	updateWebAccess(patch) {
+		const operation = this.networkMutation.then(async () => {
+			if (!this.ready || this.stopPromise) throw new Error("Server is not ready.");
+			const previous = this.network;
+			const next = applyNetworkPatch(previous, patch);
+			const rebind = next.listenerHost !== previous.listenerHost || next.listenerPort !== previous.listenerPort;
+			if (rebind && !this.options.registry.pauseForUpdate()) throw new Error("Wait for running operations to finish before changing the listener.");
+			try {
+				if (rebind) await this.rebind(next);
+				try {
+					await this.options.networkSettings.save(next);
+					await this.options.onNetworkChanged?.(next);
+				} catch (error) {
+					if (rebind) await this.rebind(previous);
+					await this.options.networkSettings.save(previous);
+					await this.options.onNetworkChanged?.(previous);
+					throw error;
+				}
+				this.network = next;
+				await this.setBrowserAccessEnabled(next.webAccessEnabled);
+				if (rebind) this.webSockets.reconnectClients();
+				return this.getWebAccessStatus();
+			} finally {
+				if (rebind) this.options.registry.resumeAfterUpdate();
+			}
+		});
+		this.networkMutation = operation.catch(() => void 0);
+		return operation;
+	}
+	async rebind(config) {
+		const previous = this.network;
+		this.httpServer.close();
+		this.httpServer.closeIdleConnections();
+		try {
+			await this.bind(config.listenerHost, config.listenerPort);
+		} catch (error) {
+			await this.bind(previous.listenerHost, previous.listenerPort);
+			throw new Error("Could not use that listening address or port. The previous listener has been restored.", { cause: error });
+		}
+	}
 	async setBrowserAccessEnabled(enabled) {
 		if (!this.ready) throw new Error("Server is not ready.");
 		const pending = this.options.auth.setBrowserAccessEnabled(enabled);
@@ -27023,8 +27448,17 @@ var OpenTigServer = class {
 		return this.stopPromise;
 	}
 	listen() {
-		const host = this.options.host ?? "127.0.0.1";
-		const port = this.options.port ?? 6767;
+		return this.bind(this.network.listenerHost, this.network.listenerPort).then((address) => {
+			this.network = {
+				...this.network,
+				listenerHost: address.host,
+				listenerPort: address.port,
+				lanAccessEnabled: this.network.listenerHost === address.host ? this.network.lanAccessEnabled : !isLoopbackHost(address.host)
+			};
+			return address;
+		});
+	}
+	bind(host, port) {
 		return new Promise((resolve, reject) => {
 			const onError = (error) => reject(error);
 			this.httpServer.once("error", onError);
@@ -27043,6 +27477,7 @@ var OpenTigServer = class {
 		});
 	}
 	async stopServer() {
+		await this.networkMutation;
 		this.ready = false;
 		await this.webSockets.close();
 		if (this.httpServer.listening) await new Promise((resolve, reject) => {
@@ -27069,10 +27504,11 @@ function formatHost(host) {
 */
 async function runOpenTigServer(config) {
 	if (config.profile !== void 0 && config.profile !== "production" && config.profile !== "dev") throw new Error("Invalid application profile.");
+	const { networkSettings, network } = await loadStartupNetwork(config);
 	let transport = null;
 	const auth = await OpenTigSessionAuth.open({
 		source: config.auth,
-		browserAccessEnabled: config.browserAccessEnabled ?? config.mode === "web-access",
+		browserAccessEnabled: network.webAccessEnabled,
 		...config.profile ? { profile: config.profile } : {},
 		dataDirectory: config.serverDataPath ?? path.join(path.dirname(config.settingsPath), "server"),
 		...config.secureCookies === void 0 ? {} : { secureCookies: config.secureCookies }
@@ -27101,6 +27537,10 @@ async function runOpenTigServer(config) {
 		registerServerCommands(registry, runtime.services, headlessHost);
 		registry.setProblemLog(runtime.services.problems);
 		transport = new OpenTigServer({
+			network,
+			networkSettings,
+			...config.recoveryCommand ? { recoveryCommand: config.recoveryCommand } : {},
+			...config.onNetworkChanged ? { onNetworkChanged: config.onNetworkChanged } : {},
 			runtime,
 			registry,
 			...config.updates ? { updates: config.updates } : {},
@@ -27127,7 +27567,19 @@ async function runOpenTigServer(config) {
 			runtime,
 			clientRoot,
 			...address,
-			createPairingLink: () => pairingLink(address.origin, transport.createPairingToken()),
+			get host() {
+				return transport.getWebAccessStatus().listenerHost;
+			},
+			get port() {
+				return transport.getWebAccessStatus().actualPort;
+			},
+			get origin() {
+				const status = transport.getWebAccessStatus();
+				return `http://${status.listenerHost.includes(":") ? `[${status.listenerHost}]` : status.listenerHost}:${status.actualPort}`;
+			},
+			getWebAccessStatus: () => transport.getWebAccessStatus(),
+			updateWebAccess: (patch) => transport.updateWebAccess(patch),
+			createPairingLink: () => pairingLink(transport.getWebAccessStatus().localEndpoint, transport.createPairingToken()),
 			getStatus: () => transport.getStatus(),
 			revokeAllSessions: () => transport.revokeAllSessions(),
 			setBrowserAccessEnabled: (enabled) => transport.setBrowserAccessEnabled(enabled),
@@ -27172,4 +27624,4 @@ var headlessHost = {
 	revealItem: () => void 0
 };
 //#endregion
-export { preferredServerPort as a, redactSensitiveText as c, applicationName as i, runOpenTigServer as n, normalizeRuntimePlatform as o, OneTimeBootstrapAuthSource as r, writeFileAtomically as s, resolveServerClientRoot as t };
+export { preferredServerPort as a, applicationName as i, runOpenTigServer as n, normalizeRuntimePlatform as o, OneTimeBootstrapAuthSource as r, resolveServerClientRoot as t };