@paradow/ledge 0.13.0 → 0.14.0

package/dist/cli/{daemon-ZUDRXUCP.js → daemon-KHGAO6BC.js}

@@ -3,11 +3,19 @@ import {
   readFrames
 } from "./chunk-OLLQBK6N.js";
 import {
+  NO_ALWAYS,
+  NO_NOTE,
   QUESTION_TOOLS,
+  Refusal,
+  STALE,
   answeredBy,
+  assertDialogIs,
   bareName,
+  bottomLines,
   crossSession,
   crossSessionNotices,
+  dialogMismatch,
+  flatten,
   formatLedgeMessage,
   gitInfo,
   gitSummary,
@@ -17,8 +25,9 @@ import {
   pendingTool,
   readPeers,
   reduce,
-  repositoryId
-} from "./chunk-IOASI5FF.js";
+  repositoryId,
+  shownCommand
+} from "./chunk-UWANRALT.js";
 import {
   PARENT_AGENT_VARS,
   agentEnv,
@@ -27,28 +36,49 @@ import {
   claudePlan,
   claudeToolAnswered,
   spawnSession
-} from "./chunk-5XFBRTKO.js";
+} from "./chunk-ULWVO3TH.js";
 import {
   DEFAULT_PROJECTS,
+  DEFAULT_RELAY_URL,
   DOCUMENT_MAX_BYTES,
+  DevicePollResponseSchema,
+  DeviceStartResponseSchema,
   EffortSchema,
   IslandPrefsSchema,
   MAX_PROPOSALS,
   MachinesSchema,
+  MobileConfigSchema,
   ModelIdSchema,
   NOTE_NOT_TYPED,
+  PAIR_LABEL_MAX,
+  PENDING_BODY_MAX,
+  PHONE_PROTOCOL,
   PROTOCOL_PORT,
+  PhoneClientMessageSchema,
   ProjectsSchema,
+  RELAY_CLOSE_SIGNED_OUT,
   RecentSchema,
+  RefusalCodeSchema,
+  RelayServerMessageSchema,
   RouteResultSchema,
+  SNAPSHOT_BODY_MAX,
+  SealedFrameSchema,
   SessionSchema,
   SshAliasSchema,
+  THREAD_BUDGET,
+  THREAD_ITEMS_MAX,
+  THREAD_TEXT_MAX,
+  TOOL_TEXT_MAX,
+  TOPIC_MAX,
+  ToolSchema,
+  UNTYPABLE,
   backendOf,
   ensureDaemonToken,
   extractProposal,
   hostAllowed,
   isArchived,
   offers,
+  padPlain,
   parseClientMessage,
   parseProjectBlock,
   parseProposalBlock,
@@ -60,30 +90,30 @@ import {
   proposalRows,
   requestAuthorized,
   selectDaemonProtocol
-} from "./chunk-PPRB4XIX.js";
+} from "./chunk-5LVPB3ET.js";
 import {
   LEDGE_VERSION
-} from "./chunk-LMQADKT7.js";
+} from "./chunk-QUUZSAPI.js";
 import {
   SERVICE,
   inDaemonService,
   tmuxServerAtRisk
-} from "./chunk-XIO4OIHR.js";
+} from "./chunk-6A7JPTHV.js";
 import {
   realTmux,
   runFile
-} from "./chunk-ZEHTNFPV.js";
+} from "./chunk-FPW7MF5X.js";
 import {
   log
-} from "./chunk-YUSY3E47.js";
+} from "./chunk-5DDBCJX2.js";
 import {
   ensureLedgeDir,
   paths
-} from "./chunk-FGOFRWIB.js";
+} from "./chunk-QBJEUZYW.js";
 
 // src/daemon/index.ts
 import { writeFile as writeFile7, rm as rm5 } from "fs/promises";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 
 // src/daemon/omp/owner.ts
 import { mkdir, readFile, writeFile } from "fs/promises";
@@ -718,72 +748,19 @@ var History = class {
 
 // src/daemon/server.ts
 import { createServer } from "http";
-import { homedir as homedir6 } from "os";
-import { basename as basename4, join as join12 } from "path";
+import { homedir as homedir7 } from "os";
+import { basename as basename4, join as join13 } from "path";
 import { WebSocketServer, WebSocket as WebSocket2 } from "ws";
 
-// src/adapters/types.ts
-var NO_ALWAYS = 'no "always" option in this dialog, answer in the terminal';
-var NO_NOTE = "no place for a note in this dialog, answer in the terminal";
-var STALE = "the request changed, look again";
-function assertDialogIs(pending, shown) {
-  if (shown === null) return;
-  const want = pending.kind === "diff" ? "permission" : pending.kind;
-  if (shown !== want) throw new Error(STALE);
-}
-var UNCHECKED = "the request on screen cannot be checked, answer in the terminal";
-var COMMAND_TOOLS = /* @__PURE__ */ new Set(["Bash", "shell", "Shell"]);
-var compact = (t) => t.replace(/\s+/g, "");
-var EDGE = 4;
-var WIDE = /[\u1100-\u115f\u2e80-\ua4cf\uac00-\ud7a3\uf900-\ufaff\ufe30-\ufe4f\uff00-\uff60\uffe0-\uffe6\u{1f300}-\u{1faff}\u{20000}-\u{3fffd}]/u;
-var columns = (text) => [...text].reduce((n, c) => n + (WIDE.test(c) ? 2 : 1), 0);
-function shownCommand(raw) {
-  const lines = raw.map((l) => l.trimEnd());
-  while (lines.length && !lines.at(-1).trim()) lines.pop();
-  while (lines.length && !lines[0].trim()) lines.shift();
-  return { lines: lines.map((l) => l.trim()), ends: lines.map(columns) };
-}
-function commandMismatch({ lines, ends }, asked, width) {
-  if (!lines.length || lines.at(-1).endsWith("\u2026") || lines.length > 1 && !width) return UNCHECKED;
-  const edge = (width ?? 0) - EDGE;
-  const a = asked.trim();
-  let at = 0;
-  for (let i = 0; i < lines.length; i++) {
-    if (!a.startsWith(lines[i], at)) return STALE;
-    at += lines[i].length;
-    if (i === lines.length - 1) break;
-    if (ends[i] + 1 + columns(lines[i + 1].split(/\s/)[0]) <= edge) {
-      const nl = /^[ \t]*\n[ \t]*/.exec(a.slice(at));
-      if (!nl) return STALE;
-      at += nl[0].length;
-    } else if (a[at] === " ") at++;
-    else if (ends[i] < edge) return STALE;
-  }
-  return at === a.length ? null : STALE;
-}
-function dialogMismatch(shown, pending, width) {
-  if (!shown) return UNCHECKED;
-  if (shown.kind !== (pending.kind === "diff" ? "permission" : pending.kind)) return STALE;
-  if (pending.kind === "question") {
-    const screen = compact(shown.text), asked = compact(pending.text);
-    return !asked || screen === asked || !!screen && (asked.startsWith(screen) || screen.startsWith(asked)) ? null : STALE;
-  }
-  if (pending.source === "pane") return shown.text === pending.text ? null : STALE;
-  if (pending.tool !== void 0 && COMMAND_TOOLS.has(pending.tool)) return shown.command ? commandMismatch(shown.command, pending.text, width) : UNCHECKED;
-  return null;
-}
-function bottomLines(pane, n = 5) {
-  return pane.split("\n").filter((l) => l.trim() !== "").slice(-n).join("\n");
-}
-var flatten = (text) => text.replace(/\s*[\r\n]+\s*/g, " ").trim();
-
 // src/adapters/claude.ts
 var OPTION = /^\s*(?:❯\s*)?(\d+)\.\s+(\S.*?)\s*$/;
 var FOOTER = /^\s*(?:(?:Enter to select\b.*)?Esc to cancel\b|ctrl\+g to edit\b)/;
 var PLAN_FOOTER = /^\s*ctrl\+g to edit\b/;
+var GUTTER = /^│\s*/;
 var REVIEW_QUESTION = /^\s*Ready to submit your answers\?$/;
 var RULE = /^─{10,}$/;
 var DASHED = /^╌{10,}$/;
+var INPUT_TOP = /^─{10,}(?: \S.* ─+)?$/;
 var FOOTER_SLACK = 2;
 var isBlank = (l) => l.trim() === "";
 var isRule = (l) => RULE.test(l.trim()) || DASHED.test(l.trim());
@@ -798,7 +775,14 @@ function footerIndex(lines) {
 }
 function reviewEnd(lines) {
   let last = lines.length - 1;
-  while (last >= 0 && isBlank(lines[last])) last--;
+  for (let rules = 0; last >= 0; last--) {
+    if (isBlank(lines[last])) continue;
+    if (rules < FOOTER_SLACK && INPUT_TOP.test(lines[last].trim())) {
+      rules++;
+      continue;
+    }
+    break;
+  }
   if (last < 1 || lines[last].match(OPTION)?.[1] !== "2" || lines[last - 1].match(OPTION)?.[1] !== "1") return -1;
   let q = last - 2;
   while (q >= 0 && isBlank(lines[q])) q--;
@@ -837,7 +821,7 @@ function parseDialog(pane) {
   let q = first - 1;
   while (q >= 0 && isBlank(lines[q])) q--;
   const questionLines = [];
-  while (q >= 0 && !isBlank(lines[q]) && !isRule(lines[q]) && questionLines.length < 3) questionLines.unshift(lines[q--].trim());
+  while (q >= 0 && !isBlank(lines[q]) && !isRule(lines[q]) && questionLines.length < 3) questionLines.unshift(lines[q--].trim().replace(GUTTER, ""));
   if (questionLines.length === 0) return null;
   let top = q;
   while (top >= 0 && !RULE.test(lines[top].trim())) top--;
@@ -914,7 +898,7 @@ function promptGone(pane, pending) {
 var STATUS_SLACK = 3;
 var INPUT_MAX = 12;
 var isInputRule = (l) => /^─{10,}$/.test(l.trim());
-var isInputTop = (l) => /^─{10,}(?: \S.* ─+)?$/.test(l.trim());
+var isInputTop = (l) => INPUT_TOP.test(l.trim());
 function inputBox(lines) {
   let end = lines.length;
   while (end > 0 && isBlank(lines[end - 1])) end--;
@@ -967,7 +951,7 @@ function rowPlan(n, text) {
 function freeTextPlan(text, pane) {
   const d = pane ? parseDialog(pane) : null;
   const i = d?.kind === "question" ? d.options.findIndex((o) => FREE_ROW.test(o)) : -1;
-  if (i < 0) throw new Error(NO_FREE_ROW);
+  if (i < 0) throw new Refusal(NO_FREE_ROW, "free_text");
   return rowPlan(i + 1, text);
 }
 var PLAN_ACCEPT = /\bmanually approve\b/i;
@@ -980,11 +964,11 @@ function alwaysOption(pane) {
   const d = pane ? parseDialog(pane) : null;
   const full = d ? d.options.map((o, i2) => `${o} ${d.details[i2] ?? ""}`) : [];
   const i = d?.kind === "plan" ? full.findIndex((o) => PLAN_ALWAYS.test(o) && !CLEAR_CONTEXT.test(o)) : d?.kind === "permission" ? full.findIndex((o) => ALWAYS.test(o) && !AUTO_MODE.test(o)) : -1;
-  if (i < 0) throw new Error(NO_ALWAYS);
+  if (i < 0) throw new Refusal(NO_ALWAYS, "not_offered");
   return i + 1;
 }
 function notePlan(note, pane) {
-  if (pane && parseTrust(pane)) throw new Error(NO_NOTE);
+  if (pane && parseTrust(pane)) throw new Refusal(NO_NOTE, "not_offered");
   const text = flatten(note);
   const d = pane ? parseDialog(pane) : null;
   const row = d?.kind === "plan" ? d.options.findIndex((o) => PLAN_NOTE_ROW.test(o)) : -1;
@@ -1158,11 +1142,11 @@ var ALWAYS2 = /don['’]t ask again/i;
 function alwaysKeys(d) {
   const i = d?.kind === "approval" ? d.raw.findIndex((o) => ALWAYS2.test(o)) : -1;
   const key = i < 0 ? void 0 : d.raw[i].match(/\(([a-z])\)\s*$/)?.[1];
-  if (!key) throw new Error(NO_ALWAYS);
+  if (!key) throw new Refusal(NO_ALWAYS, "not_offered");
   return [{ text: key }];
 }
 function noteKeys(d, note) {
-  if (d?.kind === "confirm") throw new Error(NO_NOTE);
+  if (d?.kind === "confirm") throw new Refusal(NO_NOTE, "not_offered");
   const no = d?.kind === "plan" ? optionNumber2(d.options, /^No\b/) : null;
   return [...no ? digit2(no) : [{ keys: ["Escape"] }], { until: atRest2, denied: true }, { text: flatten(note) }, { waitMs: REPLY_ENTER_DELAY_MS }, { keys: ["Enter"] }];
 }
@@ -1183,7 +1167,7 @@ var codexAdapter = {
     }
     if (d?.kind === "confirm") {
       const trust = optionNumber2(d.options, /^Trust all\b|^Yes\b/i);
-      if (!trust) throw new Error("no trust option in this dialog, answer in the terminal");
+      if (!trust) throw new Refusal("no trust option in this dialog, answer in the terminal", "not_offered");
       return [{ text: String(trust) }, { keys: ["Enter"] }];
     }
     if (d?.kind === "plan" || pending.kind === "plan") {
@@ -1336,12 +1320,12 @@ function promptStillVisible3(lastLines2) {
   if (end >= 0 && lines[end].trim().startsWith("\u2514") && lines.some((l) => QUESTION_FOOTER2.test(l) || /\(p or Esc\)\s*│?$/.test(l))) return true;
   return end >= 0 && DIALOG_FOOTER.test(lines[end]) && lines.some((l) => DIALOG_ACCEPT.test(l.trim()));
 }
-var compact2 = (s) => s.replace(/\s+/g, "");
+var compact = (s) => s.replace(/\s+/g, "");
 var typed = (text) => (lastLines2) => {
   const lines = toLines(lastLines2);
-  const want = compact2(`\u2192 ${text}`);
+  const want = compact(`\u2192 ${text}`);
   for (let i = lines.length - 1; i >= 0; i--) {
-    if (INPUT.test(lines[i]) && compact2(lines.slice(i).join("")).startsWith(want)) return true;
+    if (INPUT.test(lines[i]) && compact(lines.slice(i).join("")).startsWith(want)) return true;
   }
   return false;
 };
@@ -1359,7 +1343,7 @@ var onChoice = (i, what) => (lastLines2) => {
 };
 function answerPlan(q, n) {
   const i = n - 1;
-  if (i < 0 || i >= q.options.length) throw new Error(`the question has no option ${n}`);
+  if (i < 0 || i >= q.options.length) throw new Refusal(`the question has no option ${n}`, "not_offered");
   const from = q.cursor < 0 ? 0 : q.cursor;
   const moves = Array(Math.abs(i - from)).fill(i > from ? "Down" : "Up");
   return [
@@ -1381,7 +1365,7 @@ function atRest3(pane) {
   return i >= 0 && !TELL_INSTEAD.test(lines[i]) && !lines.slice(i).some((l) => BUSY3.test(l));
 }
 function notePlan2(lines, note) {
-  if (parseTrust2(lines) || parseQuestion(lines)) throw new Error(NO_NOTE);
+  if (parseTrust2(lines) || parseQuestion(lines)) throw new Refusal(NO_NOTE, "not_offered");
   const text = flatten(note);
   const typeIt = [{ text }, { until: typed(text) }, { keys: ["Enter"] }];
   if (lines.some((l) => TELL_INSTEAD.test(l))) return typeIt;
@@ -1398,7 +1382,7 @@ var cursorAdapter = {
   keysFor(decision, pending, pane, note) {
     const lines = pane ? toLines(pane) : [];
     if (pane) assertDialogIs(pending, shownKind(lines));
-    if (decision === "always") throw new Error(NO_ALWAYS);
+    if (decision === "always") throw new Refusal(NO_ALWAYS, "not_offered");
     if (decision === "deny" && note) return notePlan2(lines, note);
     if (parseTrust2(lines)) return [{ text: decision === "accept" ? "a" : "q" }];
     const q = parseQuestion(lines);
@@ -1783,7 +1767,7 @@ var OmpRpc = class _OmpRpc {
   request(type, params = {}, timeoutMs = 3e4) {
     if (this.exited || this.closing) return Promise.reject(new RpcError("OMP has ended", "closed"));
     const id = `l${++this.seq}`;
-    return new Promise((resolve7, reject) => {
+    return new Promise((resolve8, reject) => {
       const timer = timeoutMs > 0 ? setTimeout(() => {
         this.pending.delete(id);
         reject(new RpcError(`${type}: no answer`, "timeout"));
@@ -1793,7 +1777,7 @@ var OmpRpc = class _OmpRpc {
         reject,
         resolve: (f) => {
           if (f.success === false) return reject(new RpcError(String(f.error ?? `${type} refused`), "refused"));
-          resolve7(f.data);
+          resolve8(f.data);
         }
       });
       this.write({ id, type, ...params }).catch((e) => {
@@ -2055,6 +2039,12 @@ function project(f, t, at, helper) {
         t.working = false;
         return [ev({ name: "StopFailure", text: str2(f.error) ?? "the instruction failed" })];
       }
+      if (f.status === "aborted" && f.sessionSettled === false && t.working) {
+        t.working = false;
+        t.reply = void 0;
+        t.sent = false;
+        return [ev({ name: "Stop", interrupt: true })];
+      }
       return [];
     }
     default:
@@ -2121,7 +2111,7 @@ var APPROVAL_MODE = "always-ask";
 var STREAM_MS = 120;
 var ompModelArgs = (model, effort) => [...model ? ["--model", model] : [], ...effort ? ["--thinking", effort] : []];
 function ompArgs(o) {
-  return ["--mode", "rpc-ui", "--session-dir", o.dir, "--cwd", o.cwd, "--approval-mode", APPROVAL_MODE, ...ompModelArgs(o.model, o.effort), ...(o.dirs ?? []).flatMap((d) => ["--add-dir", d]), ...o.resumeFile ? ["--resume", o.resumeFile] : []];
+  return ["--mode", "rpc-ui", "--session-dir", o.dir, "--cwd", o.cwd, "--approval-mode", o.approval ?? APPROVAL_MODE, ...ompModelArgs(o.model, o.effort), ...(o.dirs ?? []).flatMap((d) => ["--add-dir", d]), ...o.resumeFile ? ["--resume", o.resumeFile] : []];
 }
 function createOmpHost(deps) {
   const { store } = deps;
@@ -2229,7 +2219,8 @@ function createOmpHost(deps) {
         ...state.sessionId ? { agentSessionId: state.sessionId } : {},
         ...state.sessionFile ? { agentSessionFile: state.sessionFile } : {},
         ...o.model ?? model ? { model: o.model ?? model } : {},
-        ...o.effort ?? state.thinkingLevel ? { effort: o.effort ?? state.thinkingLevel } : {}
+        ...o.effort ?? state.thinkingLevel ? { effort: o.effort ?? state.thinkingLevel } : {},
+        ...o.approval && o.approval !== APPROVAL_MODE ? { approval: o.approval } : {}
       };
       attach(id, rpc);
       store.upsert(session);
@@ -2736,12 +2727,12 @@ function loginShellEnv(opts = {}) {
   const shell = opts.shell ?? process.env.SHELL;
   if (!shell) return Promise.resolve({});
   const [bin, ...args] = (opts.command ?? envCommand)(shell);
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     execFile2(bin, args, { timeout: opts.timeoutMs ?? 5e3, maxBuffer: 4 * 1024 * 1024 }, (err, stdout) => {
       const env = err ? {} : parseEnv(String(stdout));
-      if (env.PATH) return resolve7(env);
+      if (env.PATH) return resolve8(env);
       log(`login shell environment unavailable (${shell}: ${err ? err.message.split("\n")[0] : "printed no PATH"}), launching with the daemon's`);
-      resolve7({});
+      resolve8({});
     });
   });
 }
@@ -3579,17 +3570,17 @@ async function readAt(request, path) {
     if (stat3.size > DOCUMENT_MAX_BYTES) return failure(request, "too_large");
     const chunk = Buffer.allocUnsafe(64 * 1024);
     const parts = [];
-    let bytes = 0;
-    while (bytes <= DOCUMENT_MAX_BYTES) {
-      const { bytesRead } = await file.read(chunk, 0, Math.min(chunk.length, DOCUMENT_MAX_BYTES + 1 - bytes), null);
+    let bytes2 = 0;
+    while (bytes2 <= DOCUMENT_MAX_BYTES) {
+      const { bytesRead } = await file.read(chunk, 0, Math.min(chunk.length, DOCUMENT_MAX_BYTES + 1 - bytes2), null);
       if (!bytesRead) break;
       parts.push(Buffer.from(chunk.subarray(0, bytesRead)));
-      bytes += bytesRead;
+      bytes2 += bytesRead;
     }
-    if (bytes > DOCUMENT_MAX_BYTES) return failure(request, "too_large");
+    if (bytes2 > DOCUMENT_MAX_BYTES) return failure(request, "too_large");
     let text;
     try {
-      text = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(parts, bytes));
+      text = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(parts, bytes2));
     } catch {
       return failure(request, "invalid_utf8");
     }
@@ -3598,7 +3589,7 @@ async function readAt(request, path) {
       requestId: request.requestId,
       path: await realpath(path),
       text,
-      bytes,
+      bytes: bytes2,
       modifiedAt: stat3.mtime.toISOString()
     };
   } catch (e) {
@@ -3676,7 +3667,7 @@ var execRun2 = (env) => async (file, args) => {
 function createModels(deps = {}) {
   const env = deps.env ?? (async () => process.env);
   const run2 = deps.run ?? execRun2(env);
-  const readText = deps.readText ?? ((p) => readFile5(p, "utf8").catch(() => ""));
+  const readText2 = deps.readText ?? ((p) => readFile5(p, "utf8").catch(() => ""));
   const now = deps.now ?? Date.now, ttl = deps.ttlMs ?? MODELS_TTL_MS;
   const cache = /* @__PURE__ */ new Map();
   const flying = /* @__PURE__ */ new Map();
@@ -3684,7 +3675,7 @@ function createModels(deps = {}) {
     const e = await env();
     const home = e.HOME ?? homedir5();
     if (tool === "claude") {
-      const settings = await readText(join10(e.CLAUDE_CONFIG_DIR ?? join10(home, ".claude"), "settings.json"));
+      const settings = await readText2(join10(e.CLAUDE_CONFIG_DIR ?? join10(home, ".claude"), "settings.json"));
       let model;
       try {
         model = settings ? JSON.parse(settings).model : void 0;
@@ -3700,7 +3691,7 @@ function createModels(deps = {}) {
     if (r.code === null) throw new Error("not installed");
     if (r.code !== 0) throw new Error(r.stderr.trim().split("\n").pop() || `exit ${r.code}`);
     if (tool === "cursor") return parseCursorModels(r.stdout);
-    return parseCodexModels(r.stdout, codexConfig(await readText(join10(e.CODEX_HOME ?? join10(home, ".codex"), "config.toml"))));
+    return parseCodexModels(r.stdout, codexConfig(await readText2(join10(e.CODEX_HOME ?? join10(home, ".codex"), "config.toml"))));
   }
   return {
     list(tool) {
@@ -4034,6 +4025,654 @@ function serveSsh(ws, alias, opts = {}) {
   ws.on("error", () => stop());
 }
 
+// src/mobile/gateway.ts
+import { hostname } from "os";
+
+// src/mobile/outbox.ts
+var QUEUE_MESSAGES_MAX = 300;
+var QUEUE_BYTES_MAX = 8 * 1048576;
+var costOf = (padded) => Math.ceil(Buffer.byteLength(padded, "utf8") * 4 / 3) + 256;
+function createOutbox(opts) {
+  const now = opts.now ?? (() => performance.now());
+  const frames = opts.frames ?? 200;
+  const bytes2 = opts.bytes ?? 4 * 1048576;
+  const windowMs = opts.windowMs ?? 1e4;
+  const queues = /* @__PURE__ */ new Map();
+  const queuedBytes = /* @__PURE__ */ new Map();
+  const turn = [];
+  let window = [];
+  let windowBytes = 0;
+  let running = false;
+  let closed = false;
+  let timer = null;
+  const clear = (deviceId) => {
+    queues.delete(deviceId);
+    queuedBytes.delete(deviceId);
+    const i = turn.indexOf(deviceId);
+    if (i >= 0) turn.splice(i, 1);
+  };
+  const prune = () => {
+    const limit = now() - windowMs;
+    while (window.length > 0 && window[0].at <= limit) windowBytes -= window.shift().cost;
+  };
+  const pump = async () => {
+    if (running || closed || timer !== null) return;
+    running = true;
+    try {
+      while (!closed && turn.length > 0) {
+        prune();
+        const deviceId = turn[0];
+        const queue = queues.get(deviceId);
+        const item = queue[0];
+        const full = window.length >= frames || window.length > 0 && windowBytes + item.cost > bytes2;
+        if (full) {
+          const wait = Math.max(1, window[0].at + windowMs - now());
+          timer = setTimeout(() => {
+            timer = null;
+            void pump();
+          }, wait);
+          return;
+        }
+        queue.shift();
+        queuedBytes.set(deviceId, (queuedBytes.get(deviceId) ?? 0) - item.cost);
+        turn.shift();
+        if (queue.length > 0) turn.push(deviceId);
+        else clear(deviceId);
+        window.push({ at: now(), cost: item.cost });
+        windowBytes += item.cost;
+        let ok = false;
+        try {
+          ok = await opts.send(deviceId, item.text);
+        } catch {
+          ok = false;
+        }
+        if (!ok && !closed) {
+          clear(deviceId);
+          try {
+            opts.onGone(deviceId);
+          } catch (err) {
+            opts.log(`phone outbox: onGone failed (${err instanceof Error ? err.name : "error"})`);
+          }
+        }
+      }
+    } finally {
+      running = false;
+    }
+  };
+  const enqueue = (deviceId, text, key, priority = false) => {
+    const cost = costOf(text);
+    let queue = queues.get(deviceId);
+    const at = key === void 0 ? -1 : queue?.findIndex((q) => q.key === key) ?? -1;
+    if (queue && at >= 0) {
+      queuedBytes.set(deviceId, (queuedBytes.get(deviceId) ?? 0) - queue[at].cost + cost);
+      queue[at] = { key, text, cost, ...queue[at].priority ? { priority: true } : {} };
+    } else {
+      queue ??= [];
+      if (priority) {
+        let i = 0;
+        while (queue[i]?.priority) i++;
+        queue.splice(i, 0, { key, text, cost, priority: true });
+      } else queue.push({ key, text, cost });
+      queues.set(deviceId, queue);
+      queuedBytes.set(deviceId, (queuedBytes.get(deviceId) ?? 0) + cost);
+      if (!turn.includes(deviceId)) turn.push(deviceId);
+    }
+    if (queue.length > QUEUE_MESSAGES_MAX || (queuedBytes.get(deviceId) ?? 0) > QUEUE_BYTES_MAX) {
+      clear(deviceId);
+      opts.log(`phone outbox: queue overflow for device ${deviceId}`);
+      opts.onOverflow(deviceId);
+      return;
+    }
+    void pump();
+  };
+  return {
+    push(deviceId, msg, key) {
+      if (closed) return;
+      const json = JSON.stringify(msg);
+      const padded = padPlain(json);
+      if (padded === null) {
+        opts.log(`phone message too large: ${msg.type} ${Buffer.byteLength(json, "utf8")} bytes`);
+        const err = padPlain(JSON.stringify({ type: "error", code: "too_large", request: msg.type }));
+        enqueue(deviceId, err, `too_large:${msg.type}`, true);
+        return;
+      }
+      enqueue(deviceId, padded, key, msg.type === "operation.result" || msg.type === "error");
+    },
+    drop: clear,
+    close() {
+      closed = true;
+      if (timer) clearTimeout(timer);
+      timer = null;
+      queues.clear();
+      queuedBytes.clear();
+      turn.length = 0;
+      window = [];
+    }
+  };
+}
+
+// src/mobile/operations.ts
+function fingerprint(m) {
+  const f = m;
+  return JSON.stringify([m.type, m.id, f.decision ?? null, f.note ?? null, f.text ?? null, f.expect?.key ?? null]);
+}
+var OperationRegistry = class {
+  records = /* @__PURE__ */ new Map();
+  now;
+  ttlMs;
+  max;
+  constructor(o = {}) {
+    this.now = o.now ?? Date.now;
+    this.ttlMs = o.ttlMs ?? 864e5;
+    this.max = o.max ?? 500;
+  }
+  begin(owner, op, fp) {
+    this.expire();
+    const known = this.records.get(op);
+    if (known) {
+      if (known.owner !== owner || known.fingerprint !== fp) return { kind: "conflict" };
+      return { kind: "replay", record: { ...known } };
+    }
+    if (this.records.size >= this.max && !this.evictOldestFinished()) return { kind: "conflict" };
+    const record = { op, owner, fingerprint: fp, status: "received", at: this.now() };
+    this.records.set(op, record);
+    return { kind: "fresh", record: { ...record } };
+  }
+  /** An operation already forgotten (expired) is left forgotten. */
+  finish(op, status, reason) {
+    const r = this.records.get(op);
+    if (!r) return;
+    r.status = status;
+    if (reason) r.reason = reason;
+    else delete r.reason;
+  }
+  get(op) {
+    this.expire();
+    const r = this.records.get(op);
+    return r && { ...r };
+  }
+  expire() {
+    const limit = this.now() - this.ttlMs;
+    for (const [op, r] of this.records) if (r.at < limit) this.records.delete(op);
+  }
+  evictOldestFinished() {
+    for (const [op, r] of this.records) {
+      if (r.status !== "received") {
+        this.records.delete(op);
+        return true;
+      }
+    }
+    return false;
+  }
+};
+
+// src/mobile/risk.ts
+import { homedir as homedir6 } from "os";
+import { resolve as resolve7, sep as sep2, join as join12 } from "path";
+var SHELL_TOOLS = /* @__PURE__ */ new Set(["Bash"]);
+var high = (reason) => ({ risk: "high", reason });
+var low = (reason) => ({ risk: "low", reason });
+var inside = (cwd, p) => {
+  const root = resolve7(cwd);
+  const full = resolve7(root, p);
+  return full === root || full.startsWith(root + sep2);
+};
+function isSensitive(cwd, p) {
+  if (p.includes("~")) return true;
+  const full = resolve7(cwd, p);
+  const segs = full.split(sep2);
+  if (segs.includes(".git") || segs.some((s) => s.startsWith(".env"))) return true;
+  const home = homedir6();
+  return [join12(home, ".ssh"), join12(home, ".ledge")].some((d) => full === d || full.startsWith(d + sep2));
+}
+var PUSH = /\bgit\s+push\b/;
+var DESTROYS = [/\brm\s+-\w*[rRf]/, /\bgit\s+reset\s+--hard\b/, /\bgit\s+clean\b/, /\bgit\s+branch\s+-D\b/, /\bgit\s+checkout\s+--\s/];
+var DEPLOYS = [/\bdeploy\b/, /\bterraform\s+apply\b/, /\bkubectl\s+(apply|delete)\b/];
+var PUBLISHES = /\b(npm|pnpm|yarn)\s+publish\b/;
+var PIPES_TO_SHELL = /\b(curl|wget)\b[^\n]*\|\s*(sudo\s+)?(ba|z|da)?sh\b/;
+var SHELL_SYNTAX = /[;&|<>`'"\\$*?[\]{}\x00-\x1f\x7f]/;
+var FORBIDDEN_FLAG = /^(--output|--hostname-bin|--ext-diff$|--textconv$|-c$|-exec$|-execdir$|-ok$|-okdir$|-delete$|-fprint|-fls$)/;
+var RG_FORBIDDEN_FLAG = /^--pre/;
+var READ_ONLY = /* @__PURE__ */ new Set(["ls", "pwd", "cat", "head", "tail", "wc", "rg", "grep", "find"]);
+var GIT_READ_ONLY = /* @__PURE__ */ new Set(["status", "diff", "log", "show", "rev-parse"]);
+var GIT_BRANCH_FLAGS = /* @__PURE__ */ new Set(["-a", "-v", "--list", "--show-current"]);
+var SCRIPT_WORDS = /* @__PURE__ */ new Set(["pnpm", "npm", "yarn", "npx", "node", "make", "cargo", "go", "bash", "sh"]);
+function classifyShell(command, cwd) {
+  if (PUSH.test(command)) return high("pushes");
+  if (DESTROYS.some((r) => r.test(command))) return high("destroys");
+  if (DEPLOYS.some((r) => r.test(command))) return high("deploys");
+  if (PUBLISHES.test(command)) return high("publishes");
+  if (PIPES_TO_SHELL.test(command)) return high("pipes_to_shell");
+  if (SHELL_SYNTAX.test(command)) return high("shell_syntax");
+  const words = command.trim().split(/ +/).filter(Boolean);
+  const first = words[0];
+  if (!first || first.includes("=")) return high("unknown");
+  const args = words.slice(1);
+  const beforeDashes = args.includes("--") ? args.slice(0, args.indexOf("--")) : args;
+  if (args.some((a) => FORBIDDEN_FLAG.test(a)) || first === "rg" && beforeDashes.some((a) => RG_FORBIDDEN_FLAG.test(a))) return high("unsafe_flag");
+  const dd = args.indexOf("--");
+  const bad = (v) => v !== "" && (isSensitive(cwd, v) || !inside(cwd, v));
+  const flagBad = (a) => a.includes("/") || a.includes("~") || bad(a.slice(a.indexOf("=") + 1 || a.length));
+  const checked = args.some((a, i) => dd !== -1 && i > dd ? a.startsWith("-") || bad(a) : a.startsWith("-") ? flagBad(a) : bad(a));
+  if (checked) return high("sensitive_path");
+  if (READ_ONLY.has(first)) return low("read_only_command");
+  if (first === "git") {
+    const sub = args[0];
+    if (sub && GIT_READ_ONLY.has(sub)) return low("read_only_command");
+    if (sub === "branch" && args.slice(1).every((a) => GIT_BRANCH_FLAGS.has(a))) return low("read_only_command");
+  }
+  if (SCRIPT_WORDS.has(first) || first.startsWith("python") || first.startsWith("./")) return high("script");
+  return high("unknown");
+}
+function classify(input) {
+  const { kind, tool, text, cwd, command } = input;
+  if (kind === "question") return low("question");
+  if (kind === "plan") return high("plan");
+  if (kind === "diff") {
+    const t = text.trim();
+    const paths2 = t === "" || t === "patch" ? [] : t.split(", ").map((p) => p.trim()).filter(Boolean);
+    if (paths2.length === 0 || paths2.some((p) => /[,\n\r]/.test(p))) return high("unknown");
+    if (paths2.some((p) => isSensitive(cwd, p))) return high("sensitive_path");
+    if (paths2.some((p) => !inside(cwd, p))) return high("writes_outside_folder");
+    return low("edit_inside_folder");
+  }
+  if (kind !== "permission") return high("unknown");
+  if (tool === "Read") {
+    const p = text.trim();
+    if (p === "") return high("unknown");
+    if (isSensitive(cwd, p)) return high("sensitive_path");
+    return inside(cwd, p) ? low("read_only_command") : high("unknown");
+  }
+  if (tool === "WebFetch" || tool === "WebSearch") return high("network");
+  if (!tool || !SHELL_TOOLS.has(tool)) return high("unknown");
+  return classifyShell(command ?? "", cwd);
+}
+function commandOf(p) {
+  if (p.kind !== "permission" || p.source === "rpc") return void 0;
+  if (p.source === "hook" && !(p.tool && SHELL_TOOLS.has(p.tool))) return void 0;
+  return p.text.trim() === "" ? void 0 : p.text;
+}
+function riskOf(s) {
+  const p = s.pending;
+  if (!p) return void 0;
+  const command = commandOf(p);
+  return classify({ kind: p.kind, ...p.tool ? { tool: p.tool } : {}, ...command !== void 0 ? { command } : {}, text: p.text, cwd: s.workdir ?? s.cwd, source: p.source });
+}
+
+// src/mobile/project.ts
+function pickSet(o, keys) {
+  const out = {};
+  for (const k of keys) if (o[k] !== void 0) out[k] = o[k];
+  return out;
+}
+function clip(s, max) {
+  if (s.length <= max) return { text: s, cut: false };
+  const end = /[\ud800-\udbff]/.test(s[max - 1] ?? "") ? max - 1 : max;
+  return { text: s.slice(0, end), cut: true };
+}
+function toPhonePending(p, key, risk, riskReason, bodyMax) {
+  const body = p.body === void 0 ? void 0 : clip(p.body, bodyMax);
+  return {
+    kind: p.kind,
+    text: p.text,
+    source: p.source,
+    ...body ? { body: body.text } : {},
+    ...pickSet(p, ["tool", "helperId", "parentState"]),
+    ...p.options ? { options: [...p.options] } : {},
+    ...p.optionDetails ? { optionDetails: [...p.optionDetails] } : {},
+    key,
+    risk,
+    riskReason,
+    ...body?.cut ? { cut: true } : {}
+  };
+}
+function toPhoneRequest(s, bodyMax) {
+  if (!s.pending) return void 0;
+  const verdict = riskOf(s) ?? { risk: "high", reason: "unknown" };
+  return toPhonePending(s.pending, pendingKey(s.pending), verdict.risk, verdict.reason, bodyMax);
+}
+var toPhoneFullRequest = (s) => toPhoneRequest(s, PENDING_BODY_MAX);
+function toPhoneSession(s, readAt2) {
+  const pending = toPhoneRequest(s, SNAPSHOT_BODY_MAX);
+  return {
+    id: s.id,
+    name: s.name,
+    tool: s.tool,
+    project: s.project,
+    title: s.title,
+    state: s.state,
+    startedAt: s.startedAt,
+    lastActivityAt: s.lastActivityAt,
+    // Topics are already cut to TOPIC_MAX where they are set; clipped again so no source can swell a snapshot.
+    ...s.topic !== void 0 ? { topic: clip(s.topic, TOPIC_MAX).text } : {},
+    ...pickSet(s, ["repo", "branch", "worktree"]),
+    helpers: s.helpers.map((h) => ({ id: h.id, kind: h.kind, task: h.task, state: h.state, ...pickSet(h, ["finishedAt"]) })),
+    // A preview only: the whole reply is in the thread.
+    ...s.lastReply ? { lastReply: { text: clip(s.lastReply.text, TOOL_TEXT_MAX).text, at: s.lastReply.at, ...pickSet(s.lastReply, ["plan"]) } } : {},
+    ...pending ? { pending } : {},
+    unread: !!s.lastReply && s.lastReply.at > readAt2
+  };
+}
+function toPhoneItem(item) {
+  let cut = false;
+  const text = (s, max = THREAD_TEXT_MAX) => {
+    const c = clip(s, max);
+    if (c.cut) cut = true;
+    return c.text;
+  };
+  const optText = (s, max = THREAD_TEXT_MAX) => s === void 0 ? {} : { v: text(s, max) };
+  const base = { id: item.id, at: item.at, turn: item.turn, ...pickSet(item, ["helperId"]) };
+  let out;
+  switch (item.kind) {
+    case "prompt":
+    case "message":
+    case "reply":
+      out = { kind: item.kind, ...base, text: text(item.text) };
+      break;
+    case "tool": {
+      const input = optText(item.input, TOOL_TEXT_MAX), output = optText(item.output, TOOL_TEXT_MAX), error = optText(item.error, TOOL_TEXT_MAX);
+      out = {
+        kind: "tool",
+        ...base,
+        tool: item.tool,
+        label: text(item.label),
+        status: item.status,
+        ...input.v !== void 0 ? { input: input.v } : {},
+        ...output.v !== void 0 ? { output: output.v } : {},
+        ...error.v !== void 0 ? { error: error.v } : {},
+        ...pickSet(item, ["durationMs"]),
+        files: item.files.map((f) => ({ path: f.path, ...pickSet(f, ["from"]), change: f.change }))
+      };
+      break;
+    }
+    case "permission":
+      out = { kind: "permission", ...base, tool: item.tool, text: text(item.text), ...pickSet(item, ["decision"]) };
+      break;
+    case "helper":
+      out = { kind: "helper", ...base, task: text(item.task), state: item.state, ...pickSet(item, ["agentType"]) };
+      break;
+    case "sent": {
+      const summary = optText(item.summary);
+      out = {
+        kind: "sent",
+        ...base,
+        to: item.to,
+        text: text(item.text),
+        status: item.status,
+        ...summary.v !== void 0 ? { summary: summary.v } : {},
+        ...pickSet(item, ["peer", "received", "via"])
+      };
+      break;
+    }
+    case "received":
+      out = { kind: "received", ...base, from: item.from, text: text(item.text), ...pickSet(item, ["peer", "sent"]) };
+      break;
+    case "notice": {
+      const summary = optText(item.summary), reason = optText(item.reason);
+      out = {
+        kind: "notice",
+        ...base,
+        notice: item.notice,
+        text: text(item.text),
+        ...pickSet(item, ["name", "peer", "time", "status", "count"]),
+        ...item.recipients ? { recipients: [...item.recipients] } : {},
+        ...summary.v !== void 0 ? { summary: summary.v } : {},
+        ...reason.v !== void 0 ? { reason: reason.v } : {}
+      };
+      break;
+    }
+  }
+  return { item: out, cut };
+}
+var bytes = (v) => Buffer.byteLength(JSON.stringify(v), "utf8");
+function toPhoneThread(items) {
+  const kept = [];
+  const cut = [];
+  let used = 2;
+  for (let i = items.length - 1; i >= 0 && kept.length < THREAD_ITEMS_MAX; i--) {
+    const projected = toPhoneItem(items[i]);
+    const size = bytes(projected.item) + (kept.length > 0 ? 1 : 0);
+    if (used + size > THREAD_BUDGET) break;
+    used += size;
+    kept.push(projected.item);
+    if (projected.cut) cut.push(projected.item.id);
+  }
+  return { items: kept.reverse(), cut: cut.reverse(), more: kept.length < items.length };
+}
+function capabilities() {
+  const caps = {};
+  for (const tool of ToolSchema.options) caps[tool] = { freeTextAnswer: tool !== "omp" && !!adapterFor(tool).freeText };
+  return caps;
+}
+
+// src/mobile/gateway.ts
+var REQUEST_NAME = /^[a-z][a-z.]{0,39}$/;
+function createPhoneGateway(deps) {
+  const { mobile, log: log2 } = deps;
+  const startedAt = new Date(deps.now ? deps.now() : Date.now()).toISOString();
+  const registry = new OperationRegistry();
+  const followers = /* @__PURE__ */ new Map();
+  let stopped2 = false;
+  const follower = (deviceId) => {
+    let f = followers.get(deviceId);
+    if (!f) followers.set(deviceId, f = { subscribed: false, watching: null, reads: /* @__PURE__ */ new Map() });
+    return f;
+  };
+  const forget = (deviceId) => {
+    followers.delete(deviceId);
+    outbox.drop(deviceId);
+  };
+  const approved = (deviceId) => mobile.state().devices.some((d) => d.id === deviceId);
+  const live2 = (id) => {
+    const s = deps.session(id);
+    return s && !isArchived(s) ? s : void 0;
+  };
+  const projected = (deviceId, s) => toPhoneSession(s, followers.get(deviceId)?.reads.get(s.id) ?? startedAt);
+  const snapshot = (deviceId) => ({
+    type: "snapshot",
+    protocol: PHONE_PROTOCOL,
+    sessions: deps.sessions().filter((s) => !isArchived(s)).map((s) => projected(deviceId, s)),
+    capabilities: capabilities(),
+    daemon: { version: deps.version, name: clip(hostname(), 40).text }
+  });
+  const outbox = createOutbox({
+    send: (deviceId, text) => mobile.send(deviceId, text),
+    onGone: (deviceId) => {
+      log2(`phone: device ${deviceId} gone`);
+      followers.delete(deviceId);
+    },
+    onOverflow: (deviceId) => {
+      if (followers.get(deviceId)?.subscribed) outbox.push(deviceId, snapshot(deviceId), "snapshot");
+    },
+    log: log2,
+    ...deps.outbox
+  });
+  const push = (deviceId, msg, key) => {
+    if (!stopped2) outbox.push(deviceId, msg, key);
+  };
+  const result = (deviceId, op, status, reason) => {
+    if (stopped2 || !approved(deviceId)) return;
+    push(deviceId, { type: "operation.result", op, status, ...reason ? { reason } : {} });
+  };
+  const precheck = (msg) => {
+    const s = live2(msg.id);
+    if (!s) return { status: "rejected", reason: "unknown_session" };
+    switch (msg.type) {
+      case "session.decide":
+        if (!s.pending || pendingKey(s.pending) !== msg.expect.key) return { status: "rejected", reason: "stale" };
+        if (msg.decision !== "deny" && riskOf(s)?.risk !== "low") return { status: "rejected", reason: "confirm_required" };
+        return msg.note !== void 0 && UNTYPABLE.test(msg.note) ? { status: "rejected", reason: "untypable" } : void 0;
+      case "session.reply": {
+        if (msg.expect ? !s.pending || pendingKey(s.pending) !== msg.expect.key : !!s.pending) return { status: "rejected", reason: "stale" };
+        const options = s.pending?.kind === "question" ? s.pending.options : void 0;
+        if (options?.length && /^[1-9]$/.test(msg.text) && Number(msg.text) > options.length) return { status: "rejected", reason: "invalid" };
+        return UNTYPABLE.test(msg.text) ? { status: "rejected", reason: "untypable" } : void 0;
+      }
+      case "session.interrupt":
+        return s.tmuxSession || backendOf(s) === "omp-rpc" ? void 0 : { status: "rejected", reason: "read_only" };
+    }
+  };
+  const local = (msg) => {
+    switch (msg.type) {
+      case "session.decide":
+        return { type: "session.decide", id: msg.id, decision: msg.decision, ...msg.note !== void 0 ? { note: msg.note } : {}, expect: { kind: msg.expect.kind, text: msg.expect.text, key: msg.expect.key } };
+      case "session.reply":
+        return { type: "session.reply", id: msg.id, text: msg.text };
+      case "session.interrupt":
+        return { type: "session.interrupt", id: msg.id };
+    }
+  };
+  const outcomeOf = (code) => {
+    if (!code) return { status: "failed" };
+    if (code === "not_taken") return { status: "failed", reason: "not_taken" };
+    const known = RefusalCodeSchema.safeParse(code);
+    return { status: "rejected", reason: known.success ? known.data : "invalid" };
+  };
+  const run2 = async (msg) => {
+    const refused = precheck(msg);
+    if (refused) return refused;
+    const out = local(msg);
+    let error;
+    await deps.dispatch(out, (m) => {
+      if (m.type === "error" && (m.request === void 0 || m.request === out.type)) error ??= { code: m.code };
+    });
+    return error ? outcomeOf(error.code) : { status: "applied" };
+  };
+  const write = async (deviceId, msg) => {
+    const begun = registry.begin(deviceId, msg.op, fingerprint(msg));
+    if (begun.kind === "conflict") return result(deviceId, msg.op, "rejected", "conflict");
+    if (begun.kind === "replay") return result(deviceId, msg.op, begun.record.status, begun.record.reason);
+    let outcome;
+    try {
+      result(deviceId, msg.op, "received");
+      outcome = await run2(msg);
+    } catch (e) {
+      log2(`phone ${msg.type} failed (${e instanceof Error ? e.name : "error"})`);
+      outcome = { status: "failed" };
+    }
+    registry.finish(msg.op, outcome.status, outcome.reason);
+    result(deviceId, msg.op, outcome.status, outcome.reason);
+  };
+  const read = (deviceId, msg) => {
+    switch (msg.type) {
+      case "snapshot.request":
+        follower(deviceId).subscribed = true;
+        return push(deviceId, snapshot(deviceId), "snapshot");
+      case "session.thread": {
+        if (!live2(msg.id)) return push(deviceId, { type: "error", code: "unknown_session", request: msg.type });
+        return push(deviceId, { type: "session.thread", id: msg.id, ...toPhoneThread(deps.thread(msg.id) ?? []) });
+      }
+      case "session.pending": {
+        const session = live2(msg.id);
+        const pending = session && toPhoneFullRequest(session);
+        if (!pending) return push(deviceId, { type: "error", code: "unknown_session", request: msg.type });
+        return push(deviceId, { type: "session.pending", id: msg.id, pending });
+      }
+      case "session.watch": {
+        if (msg.id === null) {
+          follower(deviceId).watching = null;
+          return;
+        }
+        if (!live2(msg.id)) return push(deviceId, { type: "error", code: "unknown_session", request: msg.type });
+        follower(deviceId).watching = msg.id;
+        const lines = deps.preview(msg.id);
+        if (lines) push(deviceId, { type: "session.preview", id: msg.id, lines: [...lines] }, `session.preview:${msg.id}`);
+        return;
+      }
+      case "session.read": {
+        const s = live2(msg.id);
+        if (!s) return push(deviceId, { type: "error", code: "unknown_session", request: msg.type });
+        const at = new Date(msg.at).toISOString();
+        const f = follower(deviceId);
+        if (at > (f.reads.get(msg.id) ?? "")) f.reads.set(msg.id, at);
+        if (!f.subscribed) return;
+        return push(deviceId, { type: "session.updated", session: projected(deviceId, s) }, `session.updated:${s.id}`);
+      }
+    }
+  };
+  const receive = (deviceId, text) => {
+    if (stopped2) return;
+    let raw;
+    try {
+      raw = JSON.parse(text);
+    } catch {
+      raw = void 0;
+    }
+    const parsed = raw === void 0 ? void 0 : PhoneClientMessageSchema.safeParse(raw);
+    if (!parsed?.success) {
+      const type = raw?.type;
+      const request = typeof type === "string" && REQUEST_NAME.test(type) ? type : void 0;
+      log2(`phone message refused: ${request ?? "?"}`);
+      return push(deviceId, { type: "error", code: "invalid", ...request !== void 0 ? { request } : {} });
+    }
+    const msg = parsed.data;
+    if ("op" in msg) {
+      void write(deviceId, msg).catch((e) => log2(`phone ${msg.type} failed (${e instanceof Error ? e.name : "error"})`));
+      return;
+    }
+    try {
+      read(deviceId, msg);
+    } catch (e) {
+      log2(`phone ${msg.type} failed (${e instanceof Error ? e.name : "error"})`);
+    }
+  };
+  const pruneRevoked = () => {
+    if (followers.size === 0) return;
+    const ids = new Set(mobile.state().devices.map((d) => d.id));
+    for (const deviceId of [...followers.keys()]) if (!ids.has(deviceId)) forget(deviceId);
+  };
+  const removed = (id) => {
+    for (const [deviceId, f] of followers) {
+      f.reads.delete(id);
+      if (f.watching === id) f.watching = null;
+      if (f.subscribed) push(deviceId, { type: "session.removed", id });
+    }
+  };
+  const unsubscribeMessage = mobile.onMessage(receive);
+  const unsubscribeChange = mobile.onChange(pruneRevoked);
+  return {
+    forward(m) {
+      if (stopped2 || followers.size === 0) return;
+      try {
+        switch (m.type) {
+          case "session.updated":
+            if (isArchived(m.session)) return removed(m.session.id);
+            for (const [deviceId, f] of followers) {
+              if (f.subscribed) push(deviceId, { type: "session.updated", session: projected(deviceId, m.session) }, `session.updated:${m.session.id}`);
+            }
+            return;
+          case "session.removed":
+            return removed(m.id);
+          case "session.preview":
+            for (const [deviceId, f] of followers) {
+              if (f.watching === m.id) push(deviceId, { type: "session.preview", id: m.id, lines: [...m.lines] }, `session.preview:${m.id}`);
+            }
+            return;
+          case "session.thread.item": {
+            const watchers = [...followers].filter(([, f]) => f.watching === m.id);
+            if (watchers.length === 0) return;
+            const { item, cut } = toPhoneItem(m.item);
+            for (const [deviceId] of watchers) push(deviceId, { type: "session.thread.item", id: m.id, item, ...cut ? { cut: true } : {} });
+            return;
+          }
+          default:
+            return;
+        }
+      } catch (e) {
+        log2(`phone forward of ${m.type} failed (${e instanceof Error ? e.name : "error"})`);
+      }
+    },
+    stop() {
+      if (stopped2) return;
+      stopped2 = true;
+      unsubscribeMessage();
+      unsubscribeChange();
+      outbox.close();
+      followers.clear();
+    }
+  };
+}
+
 // src/daemon/server.ts
 var CONTINUE_ARGS = { claude: ["--continue"], codex: ["resume", "--last"], cursor: ["--continue"] };
 var RESUME_ARGS = { claude: (id) => ["--resume", id], codex: (id) => ["resume", id], cursor: (id) => ["--resume", id] };
@@ -4052,9 +4691,9 @@ function launchArgs(msg) {
   const effort = msg.effort ? EFFORT_ARGS[msg.tool]?.(msg.effort) ?? [] : [];
   return [...msg.continue ? CONTINUE_ARGS[msg.tool] : [], ...model, ...effort, ...more ?? [], ...prompt ? [...more ? ["--"] : [], prompt] : []];
 }
-var NoteNotTyped = class extends Error {
+var NoteNotTyped = class extends Refusal {
   constructor() {
-    super("denied, but the note could not be typed");
+    super("denied, but the note could not be typed", NOTE_NOT_TYPED);
   }
 };
 var DELETED_TTL_MS = 5 * 60 * 1e3;
@@ -4106,8 +4745,8 @@ async function startServer(opts) {
   const agentEnv2 = opts.agentEnv ?? (async () => ({ ...process.env, ...await loginShellEnv() }));
   const chat = opts.chat ?? createChat({ store, tmux, home: paths().dir, userHome: opts.home, env: agentEnv2, bin: opts.claudeBin, now, projects: () => projects, forge: createForge({ env: agentEnv2 }) });
   const router = createRouter({ env: agentEnv2 });
-  const omp = opts.omp ?? createOmpHost({ store, env: agentEnv2, dir: join12(paths().dir, "omp"), now });
-  const models = opts.models ?? createModels({ env: agentEnv2, omp: async () => ompChoices(await omp.catalog(opts.home ?? homedir6())) });
+  const omp = opts.omp ?? createOmpHost({ store, env: agentEnv2, dir: join13(paths().dir, "omp"), now });
+  const models = opts.models ?? createModels({ env: agentEnv2, omp: async () => ompChoices(await omp.catalog(opts.home ?? homedir7())) });
   const token = await ensureDaemonToken();
   const httpServer = createServer(unauthorized);
   const sockets = /* @__PURE__ */ new Set();
@@ -4147,13 +4786,17 @@ async function startServer(opts) {
   const islandFile = opts.islandFile ?? paths().island;
   let island = readIsland(islandFile);
   const islandMsg = () => ({ type: "island", prefs: island });
+  const mobile = opts.mobile;
+  const unavailable = !mobile && opts.mobileUnavailable !== void 0 ? { enabled: false, relayUrl: DEFAULT_RELAY_URL, account: null, signin: null, signinError: null, link: { state: "unavailable", error: opts.mobileUnavailable.slice(0, 200) }, devices: [], pairings: [] } : void 0;
   const send = (ws, msg) => {
     if (ws.readyState === WebSocket2.OPEN) ws.send(JSON.stringify(msg));
   };
   const localClients = /* @__PURE__ */ new Set();
   const remoteClients = /* @__PURE__ */ new Set();
+  let gateway;
   const broadcast = (msg) => {
     for (const c of localClients) send(c, msg);
+    gateway?.forward(msg);
   };
   const history = opts.history;
   const unsubscribeHistory = history ? [
@@ -4169,10 +4812,12 @@ async function startServer(opts) {
       if (c.type === "removed") history.forget(c.id);
     })
   ] : [];
+  const unsubscribeMobile = mobile?.onChange(() => broadcast({ type: "mobile", state: mobile.state() }));
   const typing = /* @__PURE__ */ new Set();
+  const replyText = async (id, text) => (await replyTo(id, text))?.message ?? null;
   const mailbox = createMailbox({
     store,
-    replyTo,
+    replyTo: replyText,
     typing,
     now,
     relayQueued: (id) => chat.queuedRelays().some((q) => q.relay.id === id),
@@ -4180,7 +4825,7 @@ async function startServer(opts) {
       history?.recordSent(id, m);
     }, mark: (id, rid, status) => history?.markSent(id, rid, status) }
   });
-  const relay = createRelay({ chat, store, replyTo, broadcast, now, typing, next: (id) => mailbox.kick(id) });
+  const relay = createRelay({ chat, store, replyTo: replyText, broadcast, now, typing, next: (id) => mailbox.kick(id) });
   const previews = /* @__PURE__ */ new Map();
   const titles = /* @__PURE__ */ new Map();
   const unsubscribe = store.onChange((c) => {
@@ -4196,13 +4841,15 @@ async function startServer(opts) {
     if (c.type === "updated" && c.session.modelNext) void applyModelNext(c.session.id).catch((e) => log(`model change of ${c.session.id} failed: ${e.message}`));
     broadcast(c.type === "updated" ? { type: "session.updated", session: c.session } : { type: "session.removed", id: c.id });
   });
-  const sendSnapshot = (ws) => {
-    send(ws, { type: "snapshot", sessions: store.all(), recents: store.recents(), launcher, ...opts.daemon ? { daemon: { ...opts.daemon, routing: true, archive: true, models: true, modelSwitch: true, omp: true } } : {} });
-    send(ws, machinesMsg());
-    send(ws, projectsMsg());
-    send(ws, islandMsg());
-    for (const [id, lines] of previews) if (store.get(id)) send(ws, { type: "session.preview", id, lines });
-    send(ws, { type: "chat.history", turns: chat.history() });
+  const sendSnapshot = (reply) => {
+    reply({ type: "snapshot", sessions: store.all(), recents: store.recents(), launcher, ...opts.daemon ? { daemon: { ...opts.daemon, routing: true, archive: true, models: true, modelSwitch: true, omp: true, ompApproval: true, ...mobile || unavailable ? { mobile: true } : {} } } : {} });
+    reply(machinesMsg());
+    reply(projectsMsg());
+    reply(islandMsg());
+    if (mobile) reply({ type: "mobile", state: mobile.state() });
+    else if (unavailable) reply({ type: "mobile", state: unavailable });
+    for (const [id, lines] of previews) if (store.get(id)) reply({ type: "session.preview", id, lines });
+    reply({ type: "chat.history", turns: chat.history() });
   };
   const preview = (id, lines) => {
     if (!store.get(id)) return;
@@ -4214,7 +4861,7 @@ async function startServer(opts) {
   const UNTIL_LINES = 30;
   const CHECK_LINES = 500;
   async function runPlan(s, plan) {
-    if (!s.tmuxSession) throw new Error("session has no terminal (started without ledge)");
+    if (!s.tmuxSession) throw new Refusal("session has no terminal (started without ledge)", "read_only");
     for (const step of plan) {
       if ("text" in step) await tmux.sendText(s.tmuxSession, step.text);
       else if ("waitMs" in step) await new Promise((r) => setTimeout(r, step.waitMs));
@@ -4224,7 +4871,7 @@ async function startServer(opts) {
         for (; ; ) {
           const pane = await tmux.capture(s.tmuxSession, UNTIL_LINES);
           if (pane !== null && step.until(pane)) break;
-          if (Date.now() >= end) throw step.denied ? new NoteNotTyped() : new Error(NOT_TAKEN);
+          if (Date.now() >= end) throw step.denied ? new NoteNotTyped() : new Refusal(NOT_TAKEN, "not_taken");
           await new Promise((r) => setTimeout(r, UNTIL_POLL_MS));
         }
       }
@@ -4243,8 +4890,8 @@ async function startServer(opts) {
   }
   async function injectAndVerify(id, planFor, requirePrompt, decision) {
     const s = store.get(id);
-    if (!s) throw new Error(`unknown session ${id}`);
-    if (inFlight.has(id)) throw new Error("a decision is already in progress");
+    if (!s) throw new Refusal(`unknown session ${id}`, "unknown_session");
+    if (inFlight.has(id)) throw new Refusal("a decision is already in progress", "busy");
     inFlight.add(id);
     try {
       const adapter = adapterFor(s.tool);
@@ -4256,12 +4903,12 @@ async function startServer(opts) {
       let before = null;
       if (requirePrompt) {
         before = s.tmuxSession ? await tmux.capture(s.tmuxSession, DETECT_LINES) : null;
-        if (before === null || !adapter.promptStillVisible(bottomLines(before))) throw new Error(NO_PROMPT);
-        if (!stillTheSame()) throw new Error(STALE);
+        if (before === null || !adapter.promptStillVisible(bottomLines(before))) throw new Refusal(NO_PROMPT, "no_prompt");
+        if (!stillTheSame()) throw new Refusal(STALE, "stale");
         if (decided) {
           const shown = adapter.detectPrompt(before) ?? adapter.detectPrompt(await tmux.capture(s.tmuxSession, CHECK_LINES) ?? "");
           const refused = dialogMismatch(shown, decided, await tmux.width?.(s.tmuxSession) ?? void 0);
-          if (refused) throw new Error(refused);
+          if (refused) throw new Refusal(refused, refused === STALE ? "stale" : "no_prompt");
         }
       }
       const plan = typeof planFor === "function" ? planFor(before ?? "") : planFor;
@@ -4291,7 +4938,7 @@ async function startServer(opts) {
             if (!answer?.byHook && stillTheSame()) store.apply(id, { name: "Decided", at: now(), source: "daemon", ...decision ? { decision } : {} });
             throw e;
           }
-          e = new Error(NOT_TAKEN);
+          e = new Refusal(NOT_TAKEN, "not_taken");
         }
         if (answer?.byHook) return true;
         store.apply(id, { name: "InjectFailed", at: now(), source: "daemon", text: e.message });
@@ -4306,17 +4953,19 @@ async function startServer(opts) {
         return true;
       }
       store.apply(id, { name: "InjectFailed", at: now(), source: "daemon", text: NOT_TAKEN });
-      throw new Error(NOT_TAKEN);
+      throw new Refusal(NOT_TAKEN, "not_taken");
     } finally {
       inFlight.delete(id);
       awaited.delete(id);
     }
   }
-  const READ_ONLY = "session started without ledge, read only";
+  const READ_ONLY2 = "session started without ledge, read only";
   const NO_PROMPT = "no prompt visible in the terminal, open the tab";
   const NOT_TAKEN = "the terminal did not take it";
   const FREE_TEXT = "free-text answers are not supported yet, answer in the terminal";
   const NOT_OFFERED = "this answer is not offered for this request, answer in the terminal";
+  const unknownSession = () => new Refusal("unknown session", "unknown_session");
+  const readOnly = () => new Refusal(READ_ONLY2, "read_only");
   async function endSession(s) {
     if (s.source !== "launcher" || s.state === "exited") return;
     if (backendOf(s) === "omp-rpc") {
@@ -4329,22 +4978,25 @@ async function startServer(opts) {
   }
   async function replyTo(id, text, how = {}) {
     const s = store.get(id);
-    if (!s) return "unknown session";
-    if (s.source === "hook_only") return READ_ONLY;
+    if (!s) return unknownSession();
+    if (s.source === "hook_only") return readOnly();
     if (backendOf(s) === "omp-rpc") return replyOmp(s, text, how.steer === true);
-    if (s.pending && s.pending.kind !== "question") return `a ${s.pending.kind} prompt takes accept or deny, not a reply`;
-    if (text.trim() === "") return "empty reply";
+    if (s.pending && s.pending.kind !== "question") return new Refusal(`a ${s.pending.kind} prompt takes accept or deny, not a reply`, "not_offered");
+    if (text.trim() === "") return new Refusal("empty reply", "invalid");
     const pending = s.pending;
     const adapter = adapterFor(s.tool);
-    if (pending?.kind === "question" && !/^[1-9]$/.test(text.trim()) && !adapter.freeText) return FREE_TEXT;
+    if (pending?.kind === "question" && !/^[1-9]$/.test(text.trim()) && !adapter.freeText) return new Refusal(FREE_TEXT, "free_text");
     await injectAndVerify(id, (pane) => adapter.replyPlan(text, pending, pane || void 0), !!pending);
     return null;
   }
   async function replyOmp(s, text, steer) {
-    if (text.trim() === "") return "empty reply";
-    if (s.state === "exited") return "the session has ended";
-    if (s.pending) return omp.answer(s.id, text);
-    if (!omp.isLive(s.id)) return "the session is not running";
+    if (text.trim() === "") return new Refusal("empty reply", "invalid");
+    if (s.state === "exited") return new Refusal("the session has ended", "unavailable");
+    if (s.pending) {
+      const refused = await omp.answer(s.id, text);
+      return refused === null ? null : new Refusal(refused, "not_offered");
+    }
+    if (!omp.isLive(s.id)) return new Refusal("the session is not running", "unavailable");
     await omp.send(s.id, text, s.state === "working" ? steer ? "steer" : "follow_up" : "prompt");
     return null;
   }
@@ -4390,7 +5042,7 @@ async function startServer(opts) {
     store.upsert({ ...rest, state: "starting", source: "launcher" });
     try {
       const cwd = await resolveFolder(s.cwd, opts.home);
-      const spawned = await omp.launch({ id: s.id, name: s.name, cwd, resumeFile: file, ...model ? { model } : {}, ...effort ? { effort } : {} });
+      const spawned = await omp.launch({ id: s.id, name: s.name, cwd, resumeFile: file, ...model ? { model } : {}, ...effort ? { effort } : {}, ...s.approval ? { approval: s.approval } : {} });
       const { topic, topicSource, repo, repoPath, branch, worktree, repoId, project: project2 } = s;
       store.upsert({ ...spawned, ...topic ? { topic } : {}, ...topicSource ? { topicSource } : {}, ...repo ? { repo } : {}, ...repoPath ? { repoPath } : {}, ...branch ? { branch } : {}, ...worktree !== void 0 ? { worktree } : {}, ...repoId ? { repoId } : {}, project: project2 });
       log(`resumed ${spawned.name} (omp) in ${spawned.cwd} as ${spawned.id}`);
@@ -4447,13 +5099,14 @@ async function startServer(opts) {
   const chatLaunches = /* @__PURE__ */ new Set();
   async function launch(req) {
     if (req.tool === "omp") return launchOmp(req);
+    if (req.approval) throw new Error(`launch: ${req.tool} takes no approval mode`);
     return launchTmux({ ...req, tool: req.tool });
   }
   async function launchOmp(req) {
     if (req.continue) throw new Error("launch: OMP resumes an exact conversation, not the latest of a folder");
     const cwd = await resolveFolder(req.cwd, opts.home);
     const dirs = req.dirs?.length ? await Promise.all(req.dirs.map((d) => resolveFolder(d, opts.home))) : void 0;
-    const session = await omp.launch({ cwd, ...req.name ? { name: req.name } : {}, ...dirs ? { dirs } : {}, ...req.model ? { model: req.model } : {}, ...req.effort ? { effort: req.effort } : {} });
+    const session = await omp.launch({ cwd, ...req.name ? { name: req.name } : {}, ...dirs ? { dirs } : {}, ...req.model ? { model: req.model } : {}, ...req.effort ? { effort: req.effort } : {}, ...req.approval ? { approval: req.approval } : {} });
     store.touchRecent(session.cwd, session.project, session.startedAt);
     log(`launched ${session.name} (omp) in ${session.cwd} as ${session.id}`);
     const prompt = req.prompt?.trim();
@@ -4477,38 +5130,38 @@ async function startServer(opts) {
   let scanning = null;
   function sharedScan() {
     if (scanning) return scanning;
-    const home = opts.home ?? homedir6();
+    const home = opts.home ?? homedir7();
     const extra = extraRoots(home, [...store.recents().map((r) => r.cwd), ...store.all().filter((s) => s.state !== "exited").map((s) => s.cwd)]);
     const walk = (opts.scan ?? scanRepos)({ home, extra }).finally(() => {
       if (scanning === walk) scanning = null;
     });
     return scanning = walk;
   }
-  async function handle(ws, msg) {
-    const refuse = (message, id) => send(ws, { type: "error", ...id !== void 0 ? { id } : {}, message, request: msg.type });
+  async function handle(msg, reply) {
+    const refuse = (r, id) => reply({ type: "error", ...id !== void 0 ? { id } : {}, message: typeof r === "string" ? r : r.message, request: msg.type, ...typeof r === "string" ? {} : { code: r.code } });
     switch (msg.type) {
       case "document.read": {
         const session = msg.sessionId ? store.get(msg.sessionId) : void 0;
-        if (msg.sessionId && !session) return send(ws, { type: "document.error", requestId: msg.requestId, path: msg.path, code: "session_missing" });
-        return send(ws, await readDocument(msg, { cwd: session?.cwd, workdir: session?.workdir, home: opts.home ?? process.env.HOME ?? "" }));
+        if (msg.sessionId && !session) return reply({ type: "document.error", requestId: msg.requestId, path: msg.path, code: "session_missing" });
+        return reply(await readDocument(msg, { cwd: session?.cwd, workdir: session?.workdir, home: opts.home ?? process.env.HOME ?? "" }));
       }
       case "repos.inspect":
-        return send(ws, { type: "repos.info", requestId: msg.requestId, repos: await inspectRepos(msg.paths, { home: opts.home }) });
+        return reply({ type: "repos.info", requestId: msg.requestId, repos: await inspectRepos(msg.paths, { home: opts.home }) });
       // Lot 11: home, then the parents of the recent and live folders outside it. Answered even when it fails: an `error` for
       // repos.scan reads, to the fleet, as a daemon too old to know it. The remotes it carries are never logged.
       case "repos.scan": {
         try {
-          return send(ws, { type: "repos.found", requestId: msg.requestId, ...await sharedScan() });
+          return reply({ type: "repos.found", requestId: msg.requestId, ...await sharedScan() });
         } catch (e) {
           log(`repos.scan failed: ${e.message}`);
-          return send(ws, { type: "repos.found", requestId: msg.requestId, repos: [], truncated: false, error: "scan failed" });
+          return reply({ type: "repos.found", requestId: msg.requestId, repos: [], truncated: false, error: "scan failed" });
         }
       }
       // #58: answered even when the agent cannot be asked, so the form falls back to the agent's default and « Other… ».
       case "models.list":
-        return send(ws, { type: "models.listing", requestId: msg.requestId, tool: msg.tool, ...await models.list(msg.tool) });
+        return reply({ type: "models.listing", requestId: msg.requestId, tool: msg.tool, ...await models.list(msg.tool) });
       case "snapshot.request":
-        return sendSnapshot(ws);
+        return sendSnapshot(reply);
       case "machines.set": {
         writeMachines(msg.machines, machinesFile);
         machines = msg.machines;
@@ -4551,7 +5204,7 @@ async function startServer(opts) {
         return;
       }
       case "session.launch": {
-        if (msg.qid === void 0) return send(ws, { type: "session.launched", id: (await launch(msg)).id });
+        if (msg.qid === void 0) return reply({ type: "session.launched", id: (await launch(msg)).id });
         const qid = msg.qid;
         const rows = msg.rows ?? [0];
         const todo = rows.filter((r) => {
@@ -4566,7 +5219,7 @@ async function startServer(opts) {
             const p = chat.proposal(qid, r);
             try {
               const session = await launch({ tool: p.tool, cwd: p.cwd, prompt: p.prompt, model: msg.model, effort: msg.effort });
-              send(ws, { type: "session.launched", id: session.id });
+              reply({ type: "session.launched", id: session.id });
               chat.markLaunched(qid, session.id, broadcast, r);
             } catch (e) {
               chat.markFailed(qid, e.message, broadcast, r);
@@ -4582,11 +5235,11 @@ async function startServer(opts) {
         return;
       }
       case "folder.list":
-        return send(ws, await listFolder(msg.path, opts.home, msg.requestId));
+        return reply(await listFolder(msg.path, opts.home, msg.requestId));
       case "folder.create": {
         const listing = await createFolder(msg.parent, msg.name, opts.home, msg.requestId);
         if (!listing.error) log(`created folder ${listing.path}`);
-        return send(ws, listing);
+        return reply(listing);
       }
       case "session.event": {
         const ev = msg.event;
@@ -4621,9 +5274,9 @@ async function startServer(opts) {
         return;
       }
       case "session.thread":
-        return send(ws, { type: "session.thread", id: msg.id, items: history?.items(msg.id) ?? [] });
+        return reply({ type: "session.thread", id: msg.id, items: history?.items(msg.id) ?? [] });
       case "session.rename": {
-        if (!store.get(msg.id)) return refuse("unknown session", msg.id);
+        if (!store.get(msg.id)) return refuse(unknownSession(), msg.id);
         store.apply(msg.id, { name: "Renamed", at: now(), source: "daemon", text: msg.topic });
         return;
       }
@@ -4633,15 +5286,15 @@ async function startServer(opts) {
         return;
       case "session.decide": {
         const s = store.get(msg.id);
-        if (!s) return refuse("unknown session", msg.id);
-        if (s.source === "hook_only") return refuse(READ_ONLY, msg.id);
-        if (msg.expect && (s.pending?.kind !== msg.expect.kind || s.pending.text !== msg.expect.text || msg.expect.key !== void 0 && pendingKey(s.pending) !== msg.expect.key)) return refuse(STALE, msg.id);
-        if (!s.pending) return refuse("nothing to decide", msg.id);
-        if (backendOf(s) === "omp-rpc") return refuse("answer this request with one of its options", msg.id);
+        if (!s) return refuse(unknownSession(), msg.id);
+        if (s.source === "hook_only") return refuse(readOnly(), msg.id);
+        if (msg.expect && (s.pending?.kind !== msg.expect.kind || s.pending.text !== msg.expect.text || msg.expect.key !== void 0 && pendingKey(s.pending) !== msg.expect.key)) return refuse(new Refusal(STALE, "stale"), msg.id);
+        if (!s.pending) return refuse(new Refusal("nothing to decide", "nothing_to_decide"), msg.id);
+        if (backendOf(s) === "omp-rpc") return refuse(new Refusal("answer this request with one of its options", "not_offered"), msg.id);
         const pending = s.pending;
         const adapter = adapterFor(s.tool);
-        if (msg.decision === "always" && !offers(s.tool, pending.kind, "always")) return refuse(NOT_OFFERED, msg.id);
-        if (msg.note !== void 0 && (msg.decision !== "deny" || !offers(s.tool, pending.kind, "note"))) return refuse(NOT_OFFERED, msg.id);
+        if (msg.decision === "always" && !offers(s.tool, pending.kind, "always")) return refuse(new Refusal(NOT_OFFERED, "not_offered"), msg.id);
+        if (msg.note !== void 0 && (msg.decision !== "deny" || !offers(s.tool, pending.kind, "note"))) return refuse(new Refusal(NOT_OFFERED, "not_offered"), msg.id);
         const { decision, note } = msg;
         await injectAndVerify(msg.id, (pane) => adapter.keysFor(decision, pending, pane, note), true, decision);
         return;
@@ -4661,10 +5314,10 @@ async function startServer(opts) {
       }
       case "session.interrupt": {
         const s = store.get(msg.id);
-        if (s?.source === "hook_only") return refuse(READ_ONLY, msg.id);
+        if (s?.source === "hook_only") return refuse(readOnly(), msg.id);
         if (s && backendOf(s) === "omp-rpc") {
           if (!msg.restoreQueue) return void await omp.interrupt(s.id).catch((e) => refuse(e.message, msg.id));
-          return void await omp.interruptAndRestore(s.id).then((texts) => send(ws, { type: "session.queue.restored", id: s.id, texts }), (e) => refuse(e.message, msg.id));
+          return void await omp.interruptAndRestore(s.id).then((texts) => reply({ type: "session.queue.restored", id: s.id, texts }), (e) => refuse(e.message, msg.id));
         }
         if (!s?.tmuxSession) return;
         await tmux.sendKeys(s.tmuxSession, adapterFor(s.tool).interruptKeys());
@@ -4673,7 +5326,7 @@ async function startServer(opts) {
       case "session.kill": {
         const s = store.get(msg.id);
         if (!s) return;
-        if (s.source === "hook_only") return refuse(READ_ONLY, msg.id);
+        if (s.source === "hook_only") return refuse(readOnly(), msg.id);
         if (backendOf(s) === "omp-rpc") return endSession(s);
         if (s.tmuxSession) await tmux.killSession(s.tmuxSession);
         store.apply(msg.id, { name: "PaneGone", at: now(), source: "daemon" });
@@ -4681,27 +5334,27 @@ async function startServer(opts) {
       }
       case "session.dismiss": {
         const s = store.get(msg.id);
-        if (!s) return refuse("unknown session", msg.id);
-        if (s.state !== "exited" && s.source !== "hook_only") return refuse("the session is still running, kill it first", msg.id);
+        if (!s) return refuse(unknownSession(), msg.id);
+        if (s.state !== "exited" && s.source !== "hook_only") return refuse(new Refusal("the session is still running, kill it first", "busy"), msg.id);
         store.remove(msg.id);
         return;
       }
       case "session.archive": {
         const s = store.get(msg.id);
-        if (!s) return refuse("unknown session", msg.id);
+        if (!s) return refuse(unknownSession(), msg.id);
         await endSession(s);
         store.archive(msg.id, now());
         return;
       }
       case "session.restore": {
-        if (!store.get(msg.id)) return refuse("unknown session", msg.id);
+        if (!store.get(msg.id)) return refuse(unknownSession(), msg.id);
         store.unarchive(msg.id, now());
         return;
       }
       case "session.resume": {
         const s = store.get(msg.id);
-        if (!s) return refuse("unknown session", msg.id);
-        if (s.state !== "exited") return refuse("the session is still running", msg.id);
+        if (!s) return refuse(unknownSession(), msg.id);
+        if (s.state !== "exited") return refuse(new Refusal("the session is still running", "busy"), msg.id);
         const key = resumeKey(s);
         if (!key) return refuse("no conversation to resume", msg.id);
         const refused = await respawn(s, key, s.model, s.effort);
@@ -4711,7 +5364,7 @@ async function startServer(opts) {
       case "session.model": {
         const s = store.get(msg.id);
         if (!s) return refuse("unknown session", msg.id);
-        if (s.source === "hook_only") return refuse(READ_ONLY, msg.id);
+        if (s.source === "hook_only") return refuse(READ_ONLY2, msg.id);
         if (s.state === "exited") return refuse("the session has ended", msg.id);
         if (!resumeKey(s)) return refuse("no conversation to resume", msg.id);
         if (backendOf(s) === "omp-rpc" && !omp.isLive(s.id)) return refuse("the session is not running", msg.id);
@@ -4727,7 +5380,7 @@ async function startServer(opts) {
       }
       case "session.delete": {
         const s = store.get(msg.id);
-        if (!s) return refuse("unknown session", msg.id);
+        if (!s) return refuse(unknownSession(), msg.id);
         if (s.source === "launcher" || s.state === "exited") markDeleted(msg.id);
         await endSession(s);
         store.remove(msg.id);
@@ -4735,7 +5388,7 @@ async function startServer(opts) {
       }
       // An agent's message to another session: acked at once, typed when the target is free.
       case "session.message":
-        return send(ws, mailbox.submit(msg));
+        return reply(mailbox.submit(msg));
       // A chat card's instruction: a refusal reaches the requester as an `error`, the card's state everyone through chat.history.
       case "session.relay":
         return relay.request(msg.qid);
@@ -4744,15 +5397,15 @@ async function startServer(opts) {
       // Broadcast: every overlay shows the same progress, and the one that asked may be the one that reconnects.
       // A busy refusal goes to the asker only: it must not fail the flow the other overlays follow.
       case "update.daemon":
-        if (!opts.updater) return send(ws, { type: "update.failed", version: msg.version, reason: "no-systemd" });
-        return opts.updater.update(msg.version, broadcast, (m) => send(ws, m));
+        if (!opts.updater) return reply({ type: "update.failed", version: msg.version, reason: "no-systemd" });
+        return opts.updater.update(msg.version, broadcast, reply);
       case "chat.ask":
         return chat.ask(msg.qid, msg.text, broadcast, msg.tool);
       case "chat.route":
         try {
-          send(ws, { type: "chat.routed", qid: msg.qid, result: await router.route(msg) });
+          reply({ type: "chat.routed", qid: msg.qid, result: await router.route(msg) });
         } catch (e) {
-          send(ws, { type: "chat.error", qid: msg.qid, message: e.message });
+          reply({ type: "chat.error", qid: msg.qid, message: e.message });
         }
         return;
       case "chat.cancel":
@@ -4762,8 +5415,38 @@ async function startServer(opts) {
         return chat.reset(broadcast);
       case "session.focus":
         return;
+      // handled by the overlay plan via wt.exe; the daemon only acknowledges
+      // A refusal of the service (an unknown pairing, a sign-in while disabled) reaches the sender as an `error`.
+      case "mobile.set":
+      case "mobile.signin":
+      case "mobile.signin.cancel":
+      case "mobile.signout":
+      case "mobile.retry":
+      case "mobile.pairing.approve":
+      case "mobile.pairing.deny":
+      case "mobile.device.revoke":
+        if (!mobile) return refuse(new Refusal("mobile access is not available", "unavailable"));
+        return mobile.handle(msg);
     }
   }
+  function dispatch(msg, reply) {
+    return handle(msg, reply).catch((e) => {
+      if (msg.type === "document.read") return reply({ type: "document.error", requestId: msg.requestId, path: msg.path, code: "read_failed" });
+      log(`${msg.type} failed: ${e.message}`);
+      reply({ type: "error", ...msg.type.startsWith("session.") && "id" in msg ? { id: msg.id } : {}, message: e.message, request: msg.type, ...e instanceof Refusal ? { code: e.code } : {} });
+    });
+  }
+  if (mobile) gateway = createPhoneGateway({
+    mobile,
+    sessions: () => store.all(),
+    session: (id) => store.get(id),
+    thread: (id) => history?.items(id),
+    preview: (id) => previews.get(id),
+    dispatch,
+    version: opts.daemon?.version ?? "unknown",
+    log,
+    now
+  });
   wss.on("connection", (ws, req) => {
     ws.on("error", (e) => log(`socket error: ${e.message}`));
     const path = requestPath(req.url);
@@ -4791,7 +5474,8 @@ async function startServer(opts) {
     }
     localClients.add(ws);
     ws.once("close", () => localClients.delete(ws));
-    sendSnapshot(ws);
+    const reply = (m) => send(ws, m);
+    sendSnapshot(reply);
     ws.on("message", (data) => {
       let msg;
       let raw;
@@ -4801,13 +5485,10 @@ async function startServer(opts) {
       } catch (e) {
         log(`invalid message: ${e.message}`);
         const { type, id } = raw ?? {};
-        return send(ws, { type: "error", message: "invalid message", ...typeof id === "string" && id.length <= 200 ? { id } : {}, ...typeof type === "string" && type.length <= 64 ? { request: type } : {} });
+        const named = typeof type === "string" && type.length <= 64 ? type : void 0;
+        return reply({ type: "error", message: "invalid message", ...named?.startsWith("session.") && typeof id === "string" && id.length <= 200 ? { id } : {}, ...named ? { request: named } : {}, code: "invalid" });
       }
-      handle(ws, msg).catch((e) => {
-        if (msg.type === "document.read") return send(ws, { type: "document.error", requestId: msg.requestId, path: msg.path, code: "read_failed" });
-        log(`${msg.type} failed: ${e.message}`);
-        send(ws, { type: "error", id: "id" in msg ? msg.id : void 0, message: e.message, request: msg.type, ...e instanceof NoteNotTyped ? { code: NOTE_NOT_TYPED } : {} });
-      });
+      void dispatch(msg, reply);
     });
   });
   return {
@@ -4818,6 +5499,8 @@ async function startServer(opts) {
     close: () => new Promise((res) => {
       unsubscribe();
       for (const u of unsubscribeHistory) u();
+      unsubscribeMobile?.();
+      gateway?.stop();
       relay.close();
       mailbox.close();
       void omp.closeAll();
@@ -4831,11 +5514,11 @@ async function startServer(opts) {
 // src/update/self.ts
 import { existsSync } from "fs";
 import { readFile as readFile6, realpath as realpath2 } from "fs/promises";
-import { homedir as homedir7 } from "os";
-import { dirname as dirname6, join as join13 } from "path";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname6, join as join14 } from "path";
 function gitRoot(script, exists = existsSync) {
   for (let dir = dirname6(script); ; dir = dirname6(dir)) {
-    if (exists(join13(dir, ".git"))) return dir;
+    if (exists(join14(dir, ".git"))) return dir;
     if (dirname6(dir) === dir) return null;
   }
 }
@@ -4850,15 +5533,15 @@ async function daemonInfo() {
   const cgroup = await readFile6("/proc/self/cgroup", "utf8").catch(() => "");
   const install = installKind(script);
   const root = install === "git" ? gitRoot(script) : null;
-  return { version: LEDGE_VERSION, install, systemd: underSystemd(process.env, cgroup), home: homedir7(), ...root ? { manual: manualCommand(root) } : {} };
+  return { version: LEDGE_VERSION, install, systemd: underSystemd(process.env, cgroup), home: homedir8(), ...root ? { manual: manualCommand(root) } : {} };
 }
 
 // src/update/run-update.ts
-import { dirname as dirname7, join as join14 } from "path";
+import { dirname as dirname7, join as join15 } from "path";
 var PACKAGE = "@paradow/ledge";
 var NPM_TIMEOUT_MS = 3 * 6e4;
 var RESTART_COMMAND = "systemctl --user restart ledge-daemon";
-var npmCommand = (execPath, version) => ({ file: join14(dirname7(execPath), "npm"), args: ["i", "-g", `${PACKAGE}@${version}`] });
+var npmCommand = (execPath, version) => ({ file: join15(dirname7(execPath), "npm"), args: ["i", "-g", `${PACKAGE}@${version}`] });
 var lastLines = (output, n = 3) => output.split("\n").map((l) => l.trimEnd()).filter(Boolean).slice(-n).join("\n");
 var npmEnv = (execPath, env) => ({ ...env, PATH: `${dirname7(execPath)}:${env.PATH ?? ""}` });
 function createDaemonUpdater(deps) {
@@ -4920,6 +5603,1250 @@ ${output}` } : { code: r.code, output };
   };
 }
 
+// src/mobile/files.ts
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, renameSync as renameSync4, chmodSync, unlinkSync } from "fs";
+import { z } from "zod";
+
+// ../seal/src/errors.ts
+var SealError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message ?? code);
+    this.name = "SealError";
+    this.code = code;
+  }
+};
+
+// ../seal/src/encoding.ts
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+function b64u(bytes2) {
+  let out = "";
+  for (let i = 0; i < bytes2.length; i += 3) {
+    const n = bytes2[i] << 16 | (bytes2[i + 1] ?? 0) << 8 | (bytes2[i + 2] ?? 0);
+    out += ALPHABET[n >> 18 & 63] + ALPHABET[n >> 12 & 63];
+    if (i + 1 < bytes2.length) out += ALPHABET[n >> 6 & 63];
+    if (i + 2 < bytes2.length) out += ALPHABET[n & 63];
+  }
+  return out;
+}
+function fromB64u(text) {
+  if (text.length % 4 === 1) throw new SealError("bad_encoding", "invalid base64url length");
+  const out = new Uint8Array(Math.floor(text.length * 3 / 4));
+  let acc = 0;
+  let bits = 0;
+  let o = 0;
+  for (const ch of text) {
+    const v = ALPHABET.indexOf(ch);
+    if (v < 0) throw new SealError("bad_encoding", "invalid base64url character");
+    acc = acc << 6 | v;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      out[o++] = acc >> bits & 255;
+    }
+  }
+  if (acc & (1 << bits) - 1) throw new SealError("bad_encoding", "non-zero trailing bits");
+  return out;
+}
+
+// ../seal/src/bytes.ts
+function concat(...parts) {
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let o = 0;
+  for (const p of parts) {
+    out.set(p, o);
+    o += p.length;
+  }
+  return out;
+}
+
+// ../seal/src/identity.ts
+var subtle = globalThis.crypto.subtle;
+var ALGO = { name: "ECDH", namedCurve: "P-256" };
+async function generateIdentity(opts = {}) {
+  const extractable = opts.extractable ?? false;
+  const pair = await subtle.generateKey(ALGO, extractable, ["deriveBits"]);
+  const raw = new Uint8Array(await subtle.exportKey("raw", pair.publicKey));
+  const privateKey = pair.privateKey;
+  return { publicKey: b64u(raw), privateKey };
+}
+async function exportIdentity(id) {
+  return b64u(new Uint8Array(await subtle.exportKey("pkcs8", id.privateKey)));
+}
+async function importIdentity(pkcs8) {
+  const privateKey = await subtle.importKey("pkcs8", fromB64u(pkcs8), ALGO, true, ["deriveBits"]);
+  const jwk = await subtle.exportKey("jwk", privateKey);
+  if (!jwk.x || !jwk.y) throw new SealError("bad_key", "private key has no public coordinates");
+  const point = concat(new Uint8Array([4]), fromB64u(jwk.x), fromB64u(jwk.y));
+  const publicKey = b64u(point);
+  await importPublicKey(publicKey);
+  return { publicKey, privateKey };
+}
+async function importPublicKey(publicKey) {
+  const raw = fromB64u(publicKey);
+  if (raw.length !== 65 || raw[0] !== 4) throw new SealError("bad_key", "not an uncompressed P-256 point");
+  try {
+    return await subtle.importKey("raw", raw, ALGO, true, []);
+  } catch {
+    throw new SealError("bad_key", "point rejected by WebCrypto");
+  }
+}
+
+// ../seal/src/channel.ts
+var subtle2 = globalThis.crypto.subtle;
+var enc = new TextEncoder();
+var dec = new TextDecoder("utf-8", { fatal: true });
+var ECDH = { name: "ECDH", namedCurve: "P-256" };
+var VERSION = "ledge-seal/1";
+var SEQ_BYTES = 8;
+var TAG_BYTES = 16;
+function seqBytes(seq) {
+  const out = new Uint8Array(SEQ_BYTES);
+  new DataView(out.buffer).setBigUint64(0, BigInt(seq));
+  return out;
+}
+async function ecdh(priv, pub) {
+  return new Uint8Array(await subtle2.deriveBits({ name: "ECDH", public: pub }, priv, 256));
+}
+async function ephemeralKeys(pkcs8) {
+  if (pkcs8 === void 0) {
+    const eph = await subtle2.generateKey(ECDH, false, ["deriveBits"]);
+    return { privateKey: eph.privateKey, raw: new Uint8Array(await subtle2.exportKey("raw", eph.publicKey)) };
+  }
+  const der = fromB64u(pkcs8);
+  const probe = await subtle2.importKey("pkcs8", der, ECDH, true, ["deriveBits"]);
+  const jwk = await subtle2.exportKey("jwk", probe);
+  if (!jwk.x || !jwk.y) throw new SealError("bad_key", "ephemeral key has no public coordinates");
+  const raw = concat(new Uint8Array([4]), fromB64u(jwk.x), fromB64u(jwk.y));
+  return { privateKey: await subtle2.importKey("pkcs8", der, ECDH, false, ["deriveBits"]), raw };
+}
+async function startHandshake(self, role, peerPublicKey, opts = {}) {
+  const peerStatic = await importPublicKey(peerPublicKey);
+  const ss = await ecdh(self.privateKey, peerStatic);
+  const eph = await ephemeralKeys(opts.ephemeralPkcs8);
+  const ephRaw = eph.raw;
+  let ephPrivate = eph.privateKey;
+  return {
+    hello: b64u(ephRaw),
+    async finish(peerHello) {
+      const priv = ephPrivate;
+      ephPrivate = null;
+      if (!priv) throw new SealError("bad_key", "handshake already finished");
+      const peerEph = await importPublicKey(peerHello);
+      const peerEphRaw = fromB64u(peerHello);
+      const ee = await ecdh(priv, peerEph);
+      const selfStaticRaw = fromB64u(self.publicKey);
+      const peerStaticRaw = fromB64u(peerPublicKey);
+      const [pcStatic, deviceStatic, pcEph, deviceEph] = role === "pc" ? [selfStaticRaw, peerStaticRaw, ephRaw, peerEphRaw] : [peerStaticRaw, selfStaticRaw, peerEphRaw, ephRaw];
+      const th = new Uint8Array(
+        await subtle2.digest("SHA-256", concat(enc.encode(VERSION), pcStatic, deviceStatic, pcEph, deviceEph))
+      );
+      const ikm = await subtle2.importKey("raw", concat(ss, ee), "HKDF", false, ["deriveBits"]);
+      const okm = new Uint8Array(
+        await subtle2.deriveBits(
+          { name: "HKDF", hash: "SHA-256", salt: th, info: enc.encode(`${VERSION} keys`) },
+          ikm,
+          512
+        )
+      );
+      const aes = (raw, usage) => subtle2.importKey("raw", raw, { name: "AES-GCM" }, false, [usage]);
+      const pcToDevice = okm.slice(0, 32);
+      const deviceToPc = okm.slice(32, 64);
+      const sendKey = await aes(role === "pc" ? pcToDevice : deviceToPc, "encrypt");
+      const recvKey = await aes(role === "pc" ? deviceToPc : pcToDevice, "decrypt");
+      let sendSeq = 0;
+      let recvSeq = 0;
+      const params = (seq) => ({
+        name: "AES-GCM",
+        iv: concat(new Uint8Array(4), seq),
+        additionalData: concat(th, seq)
+      });
+      let sealChain = Promise.resolve();
+      let openChain = Promise.resolve();
+      const serial = (chain, task) => {
+        const run2 = chain.then(task);
+        return [run2, run2.catch(() => void 0)];
+      };
+      const sealOne = async (text) => {
+        const seq = seqBytes(sendSeq++);
+        const ct = new Uint8Array(await subtle2.encrypt(params(seq), sendKey, enc.encode(text)));
+        return b64u(concat(seq, ct));
+      };
+      const openOne = async (sealed) => {
+        const frame = fromB64u(sealed);
+        if (frame.length < SEQ_BYTES + TAG_BYTES) throw new SealError("bad_seal", "frame too short");
+        const seq = frame.slice(0, SEQ_BYTES);
+        const got = new DataView(seq.buffer).getBigUint64(0);
+        if (got > BigInt(recvSeq)) throw new SealError("gap", "a frame is missing before this one");
+        if (got < BigInt(recvSeq)) throw new SealError("replay", "frame already seen");
+        let plain;
+        try {
+          plain = await subtle2.decrypt(params(seq), recvKey, frame.slice(SEQ_BYTES));
+        } catch {
+          throw new SealError("bad_seal", "authentication failed");
+        }
+        recvSeq++;
+        try {
+          return dec.decode(plain);
+        } catch {
+          throw new SealError("bad_seal", "payload is not UTF-8");
+        }
+      };
+      return {
+        seal(text) {
+          const [run2, next2] = serial(sealChain, () => sealOne(text));
+          sealChain = next2;
+          return run2;
+        },
+        open(sealed) {
+          const [run2, next2] = serial(openChain, () => openOne(sealed));
+          openChain = next2;
+          return run2;
+        }
+      };
+    }
+  };
+}
+
+// ../seal/src/pairing.ts
+var subtle3 = globalThis.crypto.subtle;
+var enc2 = new TextEncoder();
+var COMMIT_DOMAIN = "ledge-pair/1 commit";
+var CODE_DOMAIN = "ledge-pair/1 code";
+function randomNonce() {
+  return b64u(globalThis.crypto.getRandomValues(new Uint8Array(32)));
+}
+async function sha256(...parts) {
+  return new Uint8Array(await subtle3.digest("SHA-256", concat(...parts)));
+}
+async function commit(devicePublicKey, deviceNonce) {
+  return b64u(await sha256(enc2.encode(COMMIT_DOMAIN), fromB64u(devicePublicKey), fromB64u(deviceNonce)));
+}
+async function checkCommitment(commitment, devicePublicKey, deviceNonce) {
+  let given;
+  let expected;
+  try {
+    given = fromB64u(commitment);
+    if (fromB64u(deviceNonce).length !== 32) return false;
+    expected = fromB64u(await commit(devicePublicKey, deviceNonce));
+  } catch {
+    return false;
+  }
+  if (given.length !== expected.length) return false;
+  let diff = 0;
+  for (let i = 0; i < expected.length; i++) diff |= given[i] ^ expected[i];
+  return diff === 0;
+}
+async function pairingCode(input) {
+  const hash = await sha256(
+    enc2.encode(CODE_DOMAIN),
+    fromB64u(input.pcPublicKey),
+    fromB64u(input.devicePublicKey),
+    fromB64u(input.deviceNonce),
+    fromB64u(input.pcNonce)
+  );
+  const n = new DataView(hash.buffer, hash.byteOffset, 4).getUint32(0, false) % 1e6;
+  const digits = String(n).padStart(6, "0");
+  return `${digits.slice(0, 3)} ${digits.slice(3)}`;
+}
+
+// ../seal/src/fingerprint.ts
+var subtle4 = globalThis.crypto.subtle;
+var DOMAIN = new TextEncoder().encode("ledge-key/1");
+async function fingerprint2(publicKey) {
+  await importPublicKey(publicKey);
+  const digest = await subtle4.digest("SHA-256", concat(DOMAIN, fromB64u(publicKey)));
+  return b64u(new Uint8Array(digest)).slice(0, 22);
+}
+
+// src/mobile/files.ts
+var RelaySessionSchema = z.object({ token: z.string().min(1), accountId: z.string().min(1), login: z.string(), relayUrl: z.string() });
+var ApprovedDeviceSchema = z.object({
+  id: z.string().min(1),
+  publicKey: z.string().min(1),
+  label: z.string(),
+  approvedAt: z.string(),
+  lastPeer: z.string().optional(),
+  lastSeenAt: z.string().optional()
+});
+function writePrivate(file, content) {
+  const tmp = `${file}.${process.pid}.tmp`;
+  writeFileSync4(tmp, content, { mode: 384 });
+  chmodSync(tmp, 384);
+  renameSync4(tmp, file);
+}
+function readText(file, name) {
+  try {
+    return readFileSync4(file, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return null;
+    throw new Error(`${name} cannot be read (${e.code ?? "error"})`);
+  }
+}
+function readJson(file, name, schema) {
+  const raw = readText(file, name);
+  if (raw === null) return null;
+  try {
+    return schema.parse(JSON.parse(raw));
+  } catch {
+    log(`${name} is invalid, ignoring it`);
+    return null;
+  }
+}
+var DEFAULT_CONFIG = () => ({ enabled: false, relayUrl: DEFAULT_RELAY_URL });
+function readMobileConfig() {
+  return readJson(paths().mobile, "mobile.json", MobileConfigSchema) ?? DEFAULT_CONFIG();
+}
+function writeMobileConfig(c) {
+  writePrivate(paths().mobile, JSON.stringify(MobileConfigSchema.parse(c), null, 2) + "\n");
+}
+function readRelaySession() {
+  const s = readJson(paths().mobileSession, "mobile-session.json", RelaySessionSchema);
+  return s && s.relayUrl === readMobileConfig().relayUrl ? s : null;
+}
+function writeRelaySession(s) {
+  writePrivate(paths().mobileSession, JSON.stringify(RelaySessionSchema.parse(s), null, 2) + "\n");
+}
+function clearRelaySession() {
+  try {
+    unlinkSync(paths().mobileSession);
+  } catch {
+  }
+}
+async function loadPcIdentity() {
+  const file = paths().mobileKey;
+  const stored = readText(file, "mobile-key")?.trim();
+  if (stored) {
+    try {
+      return await importIdentity(stored);
+    } catch {
+      log("mobile-key is invalid, creating a new key");
+    }
+  }
+  const id = await generateIdentity({ extractable: true });
+  writePrivate(file, await exportIdentity(id));
+  return importIdentity(await exportIdentity(id));
+}
+function readDevices() {
+  return readJson(paths().devices, "devices.json", z.array(ApprovedDeviceSchema)) ?? [];
+}
+function writeDevices(list) {
+  writePrivate(paths().devices, JSON.stringify(z.array(ApprovedDeviceSchema).parse(list), null, 2) + "\n");
+}
+
+// src/mobile/link.ts
+import WebSocket3 from "ws";
+var BACKOFF_FIRST_MS = 1e3;
+var BACKOFF_MAX_MS = 6e4;
+var PING_EVERY_MS = 25e3;
+var PONG_WITHIN_MS = 1e4;
+var WELCOME_WITHIN_MS = 15e3;
+var ERROR_MAX = 200;
+var realSchedule = (fn, ms) => {
+  const h = setTimeout(fn, ms);
+  return () => clearTimeout(h);
+};
+function wsUrl(relayUrl) {
+  const u = new URL("/ws", relayUrl);
+  u.protocol = u.protocol === "http:" ? "ws:" : "wss:";
+  return u.toString();
+}
+function createRelayLink(opts) {
+  const now = opts.now ?? Date.now;
+  const random = opts.random ?? Math.random;
+  const schedule = opts.schedule ?? realSchedule;
+  const Impl = opts.WebSocketImpl ?? WebSocket3;
+  const url = wsUrl(opts.relayUrl);
+  let state = "off";
+  let ws = null;
+  let failures = 0;
+  let cancelRetry = null;
+  let cancelPing = null;
+  let cancelDeadline = null;
+  let finished = false;
+  const setState = (s) => {
+    state = s.state;
+    opts.onState(s);
+  };
+  const stopPing = () => {
+    cancelPing?.();
+    cancelPing = null;
+  };
+  const stopDeadline = () => {
+    cancelDeadline?.();
+    cancelDeadline = null;
+  };
+  const armDeadline = (sock, error) => {
+    stopDeadline();
+    cancelDeadline = schedule(() => {
+      cancelDeadline = null;
+      if (ws === sock) fail(error);
+    }, WELCOME_WITHIN_MS);
+  };
+  const drop = () => {
+    stopPing();
+    stopDeadline();
+    const old = ws;
+    ws = null;
+    if (old) {
+      old.removeAllListeners();
+      old.on("error", () => {
+      });
+      old.terminate();
+    }
+  };
+  const nextDelay = () => {
+    const base = Math.min(BACKOFF_FIRST_MS * 2 ** failures, BACKOFF_MAX_MS);
+    failures++;
+    const jittered = base * (1 + (random() * 2 - 1) * 0.2);
+    return Math.round(Math.min(jittered, BACKOFF_MAX_MS));
+  };
+  const fail = (error) => {
+    drop();
+    if (finished) return;
+    const delay2 = nextDelay();
+    const cut = error.slice(0, ERROR_MAX);
+    log(`mobile link: offline (${cut}), retry in ${delay2} ms`);
+    setState({ state: "offline", retryAt: new Date(now() + delay2).toISOString(), error: cut });
+    cancelRetry = schedule(() => {
+      cancelRetry = null;
+      connect();
+    }, delay2);
+  };
+  const signedOut = (reason) => {
+    drop();
+    finished = true;
+    log(`mobile link: signed out (${reason})`);
+    setState({ state: "signed_out", reason });
+  };
+  const armPing = (sock) => {
+    stopPing();
+    cancelPing = schedule(() => {
+      if (ws !== sock) return;
+      sock.ping();
+      cancelPing = schedule(() => {
+        if (ws === sock) fail("no pong from the relay");
+      }, PONG_WITHIN_MS);
+    }, PING_EVERY_MS);
+  };
+  const connect = () => {
+    if (finished) return;
+    setState({ state: "connecting" });
+    const sock = new Impl(url, { headers: { authorization: `Bearer ${opts.token}` } });
+    ws = sock;
+    armDeadline(sock, "no answer to the upgrade from the relay");
+    let lastError = "";
+    sock.on("error", (e) => {
+      lastError = e.message;
+    });
+    sock.on("unexpected-response", (_req, res) => {
+      if (ws !== sock) return;
+      res.resume();
+      if (res.statusCode === 401) signedOut("session_invalid");
+      else fail(`unexpected server response: ${res.statusCode ?? 0}`);
+    });
+    sock.on("open", () => {
+      if (ws !== sock) return;
+      armDeadline(sock, "no welcome from the relay");
+      armPing(sock);
+    });
+    sock.on("pong", () => {
+      if (ws === sock) armPing(sock);
+    });
+    sock.on("message", (data) => {
+      if (ws !== sock) return;
+      let parsed;
+      try {
+        parsed = JSON.parse(data.toString());
+      } catch {
+        parsed = void 0;
+      }
+      const r = RelayServerMessageSchema.safeParse(parsed);
+      if (!r.success) {
+        log("mobile link: ignored an invalid relay frame");
+        return;
+      }
+      if (r.data.type === "welcome") {
+        failures = 0;
+        stopDeadline();
+        if (state !== "online") {
+          log("mobile link: online");
+          setState({ state: "online" });
+        }
+      }
+      opts.onMessage(r.data);
+    });
+    sock.on("close", (code) => {
+      if (ws !== sock) return;
+      if (code === RELAY_CLOSE_SIGNED_OUT) signedOut("other_pc");
+      else fail(lastError || `connection closed (${code})`);
+    });
+  };
+  connect();
+  return {
+    send(m) {
+      if (state !== "online" || !ws || ws.readyState !== WebSocket3.OPEN) return false;
+      ws.send(JSON.stringify(m));
+      return true;
+    },
+    retryNow() {
+      if (finished || state !== "offline") return;
+      cancelRetry?.();
+      cancelRetry = null;
+      connect();
+    },
+    close() {
+      if (state === "off" && finished) return;
+      finished = true;
+      cancelRetry?.();
+      cancelRetry = null;
+      const old = ws;
+      stopPing();
+      stopDeadline();
+      ws = null;
+      if (old) {
+        old.removeAllListeners();
+        old.on("error", () => {
+        });
+        if (old.readyState === WebSocket3.OPEN) old.close(1e3);
+        else old.terminate();
+      }
+      setState({ state: "off" });
+    }
+  };
+}
+
+// src/mobile/signin.ts
+import { setTimeout as delay } from "timers/promises";
+var CALL_TIMEOUT_MS = 15e3;
+var ERROR_MAX2 = 200;
+var Cancelled = class extends Error {
+};
+function startSignIn(opts) {
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const abort = new AbortController();
+  const sleep2 = opts.sleep ?? ((ms) => delay(ms, void 0, { signal: abort.signal }));
+  let cancelled = false;
+  let deviceCode = "";
+  const onCancel = new Promise((_resolve, reject) => {
+    abort.signal.addEventListener("abort", () => reject(new Cancelled()), { once: true });
+  });
+  onCancel.catch(() => {
+  });
+  const guard = (p) => Promise.race([p, onCancel]);
+  const post = async (path, body) => {
+    if (cancelled) throw new Cancelled();
+    const res = await guard(fetchImpl(new URL(path, opts.relayUrl).toString(), {
+      method: "POST",
+      headers: body === void 0 ? {} : { "content-type": "application/json" },
+      ...body === void 0 ? {} : { body: JSON.stringify(body) },
+      signal: AbortSignal.any([abort.signal, AbortSignal.timeout(CALL_TIMEOUT_MS)])
+    }));
+    if (!res.ok) throw new Error(`relay answered ${res.status}`);
+    return guard(res.json());
+  };
+  const run2 = async () => {
+    const start = DeviceStartResponseSchema.parse(await post("/auth/device/start"));
+    deviceCode = start.deviceCode;
+    opts.onCode({
+      userCode: start.userCode,
+      verificationUri: start.verificationUri,
+      expiresAt: new Date(Date.now() + start.expiresIn * 1e3).toISOString()
+    });
+    let interval = start.interval;
+    for (; ; ) {
+      await guard(sleep2(interval * 1e3));
+      const poll = DevicePollResponseSchema.parse(await post("/auth/device/poll", { deviceCode }));
+      switch (poll.status) {
+        case "pending":
+          break;
+        case "slow_down":
+          interval = poll.interval;
+          break;
+        case "ok":
+          return { status: "ok", session: { token: poll.token, accountId: poll.accountId, login: poll.login, relayUrl: opts.relayUrl } };
+        default:
+          return { status: poll.status };
+      }
+    }
+  };
+  const result = run2().catch((e) => {
+    if (cancelled || e instanceof Cancelled) return { status: "cancelled" };
+    let error = e instanceof Error ? e.name === "ZodError" ? "invalid relay answer" : e.message : "sign-in failed";
+    if (deviceCode) error = error.split(deviceCode).join("[redacted]");
+    return { status: "failed", error: error.slice(0, ERROR_MAX2) };
+  });
+  return {
+    result,
+    cancel() {
+      if (cancelled) return;
+      cancelled = true;
+      abort.abort();
+    }
+  };
+}
+async function signOut(session, fetchImpl = fetch) {
+  try {
+    const res = await fetchImpl(new URL("/auth/logout", session.relayUrl).toString(), {
+      method: "POST",
+      headers: { authorization: `Bearer ${session.token}` },
+      signal: AbortSignal.timeout(CALL_TIMEOUT_MS)
+    });
+    await res.body?.cancel();
+  } catch {
+  }
+}
+
+// src/mobile/pairing.ts
+var PAIRING_TTL_MS = 5 * 6e4;
+var MAX_PAIRINGS = 3;
+var PAIRING_LINGER_MS = 1e4;
+var DEFAULT_LABEL = "Appareil";
+var realSchedule2 = (fn, ms) => {
+  const h = setTimeout(fn, ms);
+  return () => clearTimeout(h);
+};
+function cleanLabel(raw) {
+  let s = raw.replace(new RegExp("\\p{Cc}", "gu"), "").trim();
+  if (s.length > PAIR_LABEL_MAX) {
+    s = s.slice(0, PAIR_LABEL_MAX);
+    if (/[\uD800-\uDBFF]$/.test(s)) s = s.slice(0, -1);
+    s = s.trim();
+  }
+  return s || DEFAULT_LABEL;
+}
+var isPairFrame = (f) => f.k.startsWith("pair_");
+function createPairing(opts) {
+  const now = opts.now ?? Date.now;
+  const ttlMs = opts.ttlMs ?? PAIRING_TTL_MS;
+  const schedule = opts.schedule ?? realSchedule2;
+  const entries = /* @__PURE__ */ new Map();
+  let stopped2 = false;
+  const active = (e) => e.state === "waiting" || e.state === "confirm" || e.state === "approved";
+  const remove = (e) => {
+    e.cancelTimer();
+    if (entries.get(e.peer) === e) entries.delete(e.peer);
+  };
+  const settle = (e, state) => {
+    e.cancelTimer();
+    e.state = state;
+    e.cancelTimer = schedule(() => {
+      if (entries.get(e.peer) !== e) return;
+      entries.delete(e.peer);
+      opts.onChange();
+    }, PAIRING_LINGER_MS);
+    opts.onChange();
+  };
+  const onTtl = (e) => {
+    if (entries.get(e.peer) !== e) return;
+    if (e.state === "waiting" || e.state === "confirm") {
+      log(`mobile pairing: expired for peer ${e.peer}`);
+      settle(e, "expired");
+    } else if (e.state === "approved") {
+      remove(e);
+      opts.onChange();
+    }
+  };
+  const byId = (id) => [...entries.values()].find((e) => e.id === id);
+  const onCommit = (peer, frame) => {
+    const old = entries.get(peer);
+    if (old) remove(old);
+    const others = [...entries.values()].filter(active).length;
+    if (others >= MAX_PAIRINGS) {
+      log(`mobile pairing: refused peer ${peer}, ${MAX_PAIRINGS} pairings already pending`);
+      opts.send(peer, { k: "pair_no" });
+      if (old) opts.onChange();
+      return;
+    }
+    const e = {
+      id: b64u(globalThis.crypto.getRandomValues(new Uint8Array(16))),
+      peer,
+      label: cleanLabel(frame.label),
+      commitment: frame.c,
+      pcNonce: randomNonce(),
+      expiresAt: now() + ttlMs,
+      state: "waiting",
+      code: null,
+      device: null,
+      revealing: false,
+      cancelTimer: () => {
+      }
+    };
+    entries.set(peer, e);
+    e.cancelTimer = schedule(() => onTtl(e), ttlMs);
+    opts.send(peer, { k: "pair_offer", pc: opts.pc.publicKey, n: e.pcNonce });
+    opts.onChange();
+  };
+  const onReveal = async (peer, frame) => {
+    const e = entries.get(peer);
+    if (!e || e.state !== "waiting" || e.revealing) return;
+    e.revealing = true;
+    let ok = false;
+    let code = "";
+    let id = "";
+    try {
+      await importPublicKey(frame.d);
+      if (fromB64u(frame.n).length === 32 && await checkCommitment(e.commitment, frame.d, frame.n)) {
+        code = await pairingCode({ pcPublicKey: opts.pc.publicKey, devicePublicKey: frame.d, deviceNonce: frame.n, pcNonce: e.pcNonce });
+        id = await fingerprint2(frame.d);
+        ok = true;
+      }
+    } catch {
+      ok = false;
+    }
+    if (stopped2 || entries.get(peer) !== e || e.state !== "waiting") return;
+    e.revealing = false;
+    if (!ok) {
+      log(`mobile pairing: reveal from peer ${peer} does not match its commitment`);
+      remove(e);
+      opts.send(peer, { k: "pair_no" });
+      opts.onChange();
+      return;
+    }
+    e.code = code;
+    e.device = { publicKey: frame.d, fingerprint: id };
+    e.state = "confirm";
+    opts.onChange();
+  };
+  return {
+    async receive(peer, frame) {
+      if (!isPairFrame(frame)) return false;
+      if (stopped2) return true;
+      if (frame.k === "pair_commit") onCommit(peer, frame);
+      else if (frame.k === "pair_reveal") await onReveal(peer, frame);
+      return true;
+    },
+    approve(id) {
+      const e = byId(id);
+      if (!e || e.state !== "confirm" || !e.device) return;
+      if (now() > e.expiresAt) {
+        settle(e, "expired");
+        return;
+      }
+      opts.approve({
+        id: e.device.fingerprint,
+        publicKey: e.device.publicKey,
+        label: e.label,
+        approvedAt: new Date(now()).toISOString(),
+        lastPeer: e.peer
+      });
+      log(`mobile pairing: approved device ${e.device.fingerprint}`);
+      opts.send(e.peer, { k: "pair_ok" });
+      e.state = "approved";
+      e.cancelTimer();
+      e.expiresAt = now() + ttlMs;
+      e.cancelTimer = schedule(() => onTtl(e), ttlMs);
+      opts.onChange();
+    },
+    deny(id) {
+      const e = byId(id);
+      if (!e || e.state !== "confirm" && e.state !== "waiting") return;
+      opts.send(e.peer, { k: "pair_no" });
+      settle(e, "refused");
+    },
+    linked(deviceId) {
+      const e = [...entries.values()].find((x) => x.state === "approved" && x.device?.fingerprint === deviceId);
+      if (e) settle(e, "linked");
+    },
+    views() {
+      return [...entries.values()].map((e) => ({
+        id: e.id,
+        label: e.label,
+        code: e.code,
+        expiresAt: new Date(e.expiresAt).toISOString(),
+        state: e.state
+      }));
+    },
+    reset() {
+      const dropped = [...entries.values()].filter((e) => e.state === "waiting" || e.state === "confirm");
+      for (const e of dropped) remove(e);
+      if (dropped.length) opts.onChange();
+    },
+    stop() {
+      stopped2 = true;
+      for (const e of entries.values()) e.cancelTimer();
+      entries.clear();
+    }
+  };
+}
+
+// src/mobile/channels.ts
+var READY = '{"t":"ready"}';
+var REKEY_INTERVAL_MS = 2e3;
+var REKEY_TABLE_PRUNE_AT = 256;
+var codeOf = (err) => err instanceof SealError ? err.code : err instanceof Error ? err.name : "error";
+function createChannels(opts) {
+  const now = opts.now ?? Date.now;
+  const entries = /* @__PURE__ */ new Map();
+  const lastDevice = /* @__PURE__ */ new Map();
+  const lastRekey = /* @__PURE__ */ new Map();
+  const queues = /* @__PURE__ */ new Map();
+  let epoch = 0;
+  const peerGen = /* @__PURE__ */ new Map();
+  let confirmations = 0;
+  let pcFingerprint = null;
+  const approved = (deviceId, publicKey) => opts.devices().find((d) => d.id === deviceId && (publicKey === void 0 || d.publicKey === publicKey));
+  const hasConfirmed = (deviceId) => [...entries.values()].some((e) => e.deviceId === deviceId && e.confirmed);
+  const close = (e, why) => {
+    if (entries.get(e.peer) !== e) return;
+    entries.delete(e.peer);
+    log(`mobile channel: closed for device ${e.deviceId} on peer ${e.peer} (${why})`);
+    if (e.confirmed && !hasConfirmed(e.deviceId)) opts.onClosed(e.deviceId);
+  };
+  const denied = (peer) => opts.send(peer, { k: "denied" });
+  const rekey = (peer) => {
+    const t = now();
+    const last = lastRekey.get(peer);
+    if (last !== void 0 && t - last < REKEY_INTERVAL_MS) return;
+    if (lastRekey.size >= REKEY_TABLE_PRUNE_AT) {
+      for (const [p, at] of lastRekey) if (t - at >= REKEY_INTERVAL_MS) lastRekey.delete(p);
+    }
+    lastRekey.set(peer, t);
+    opts.send(peer, { k: "rekey" });
+  };
+  const onHello = async (peer, frame) => {
+    const device = approved(frame.f);
+    if (!device || await fingerprint2(device.publicKey).catch(() => null) !== device.id) {
+      log(`mobile channel: denied hello from peer ${peer} for fingerprint ${frame.f}`);
+      denied(peer);
+      return;
+    }
+    const e0 = epoch;
+    const g0 = peerGen.get(peer) ?? 0;
+    let channel;
+    let reply;
+    try {
+      const hs = await startHandshake(opts.pc, "pc", device.publicKey);
+      channel = await hs.finish(frame.e);
+      reply = hs.hello;
+    } catch (err) {
+      log(`mobile channel: handshake failed for device ${device.id} on peer ${peer} (${codeOf(err)})`);
+      const old2 = entries.get(peer);
+      if (old2) close(old2, "new hello");
+      if (epoch === e0 && (peerGen.get(peer) ?? 0) === g0) rekey(peer);
+      return;
+    }
+    pcFingerprint ??= fingerprint2(opts.pc.publicKey);
+    const f = await pcFingerprint;
+    if (epoch !== e0 || (peerGen.get(peer) ?? 0) !== g0) return;
+    if (!approved(device.id, device.publicKey)) {
+      log(`mobile channel: denied hello from peer ${peer}, device ${device.id} revoked`);
+      denied(peer);
+      return;
+    }
+    const old = entries.get(peer);
+    if (old) close(old, "new hello");
+    entries.set(peer, { peer, deviceId: device.id, publicKey: device.publicKey, channel, confirmed: false, confirmedSeq: 0 });
+    lastDevice.set(peer, device.id);
+    log(`mobile channel: hello from device ${device.id} on peer ${peer}`);
+    opts.send(peer, { k: "hello", e: reply, f });
+  };
+  const onMsg = async (peer, frame) => {
+    const e = entries.get(peer);
+    if (!e) {
+      const id = lastDevice.get(peer);
+      if (id !== void 0 && !approved(id)) {
+        log(`mobile channel: denied msg from peer ${peer}, device ${id} revoked`);
+        denied(peer);
+      } else {
+        rekey(peer);
+      }
+      return;
+    }
+    if (!approved(e.deviceId, e.publicKey)) {
+      close(e, "revoked");
+      denied(peer);
+      return;
+    }
+    let text;
+    try {
+      text = await e.channel.open(frame.s);
+    } catch (err) {
+      if (err instanceof SealError && err.code === "replay") return;
+      if (entries.get(peer) !== e) return;
+      close(e, codeOf(err));
+      rekey(peer);
+      return;
+    }
+    if (entries.get(peer) !== e) return;
+    if (!approved(e.deviceId, e.publicKey)) {
+      close(e, "revoked");
+      denied(peer);
+      return;
+    }
+    if (e.confirmed) {
+      opts.onMessage(e.deviceId, text);
+      return;
+    }
+    if (text !== READY) {
+      close(e, "no key confirmation");
+      rekey(peer);
+      return;
+    }
+    const sealed = await e.channel.seal(READY);
+    if (entries.get(peer) !== e) return;
+    e.confirmed = true;
+    e.confirmedSeq = ++confirmations;
+    opts.send(peer, { k: "msg", s: sealed });
+    log(`mobile channel: confirmed device ${e.deviceId} on peer ${peer}`);
+    opts.onConfirmed(e.deviceId, peer);
+  };
+  const handle = async (peer, frame) => {
+    if (frame.k === "hello") await onHello(peer, frame);
+    else if (frame.k === "msg") await onMsg(peer, frame);
+  };
+  return {
+    receive(peer, frame) {
+      const run2 = (queues.get(peer) ?? Promise.resolve()).then(() => handle(peer, frame)).catch((err) => log(`mobile channel: error on peer ${peer} (${codeOf(err)})`));
+      queues.set(peer, run2);
+      void run2.then(() => {
+        if (queues.get(peer) === run2) queues.delete(peer);
+      });
+      return run2;
+    },
+    async send(deviceId, text) {
+      let best = null;
+      for (const e2 of entries.values()) {
+        if (e2.deviceId === deviceId && e2.confirmed && (!best || e2.confirmedSeq > best.confirmedSeq)) best = e2;
+      }
+      if (!best || !approved(best.deviceId, best.publicKey)) return false;
+      const e = best;
+      const sealed = await e.channel.seal(text);
+      if (entries.get(e.peer) !== e) return false;
+      opts.send(e.peer, { k: "msg", s: sealed });
+      return true;
+    },
+    drop(peer) {
+      peerGen.set(peer, (peerGen.get(peer) ?? 0) + 1);
+      const e = entries.get(peer);
+      if (e) close(e, "peer gone");
+    },
+    dropDevice(deviceId) {
+      for (const e of [...entries.values()]) if (e.deviceId === deviceId) close(e, "revoked");
+    },
+    reset() {
+      epoch++;
+      peerGen.clear();
+      for (const e of [...entries.values()]) close(e, "relay welcome");
+    },
+    online() {
+      return new Set([...entries.values()].filter((e) => e.confirmed).map((e) => e.deviceId));
+    }
+  };
+}
+
+// src/mobile/service.ts
+var REVOKE_TIMEOUT_MS = 15e3;
+async function createMobileService(opts = {}) {
+  const now = opts.now ?? Date.now;
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const pc = await loadPcIdentity();
+  let config = readMobileConfig();
+  let session = readRelaySession();
+  let devices = readDevices();
+  let link = null;
+  let linkState = { state: "off" };
+  let signin = null;
+  let signinError = null;
+  let signinRun = null;
+  let stopped2 = false;
+  const changeListeners = /* @__PURE__ */ new Set();
+  const messageListeners = /* @__PURE__ */ new Set();
+  const changed = () => {
+    if (stopped2) return;
+    for (const fn of changeListeners) {
+      try {
+        fn();
+      } catch (e) {
+        log(`mobile: change listener failed (${e.message})`);
+      }
+    }
+  };
+  const sendFrame = (peer, frame) => {
+    link?.send({ type: "send", to: peer, body: JSON.stringify(frame) });
+  };
+  const saveDevices = (next2) => {
+    writeDevices(next2);
+    devices = next2;
+  };
+  const pairing = createPairing({
+    pc,
+    send: sendFrame,
+    approve(d) {
+      const old = devices.find((x) => x.id === d.id);
+      saveDevices(old ? devices.map((x) => x.id === d.id ? { ...x, label: d.label } : x) : [...devices, d]);
+    },
+    onChange: changed,
+    now,
+    ...opts.schedule ? { schedule: opts.schedule } : {}
+  });
+  const channels = createChannels({
+    pc,
+    devices: () => devices,
+    send: sendFrame,
+    onConfirmed(deviceId, peer) {
+      if (devices.some((d) => d.id === deviceId)) {
+        const at = new Date(now()).toISOString();
+        try {
+          saveDevices(devices.map((d) => d.id === deviceId ? { ...d, lastPeer: peer, lastSeenAt: at } : d));
+        } catch (e) {
+          log(`mobile: devices.json not written (${e.message})`);
+        }
+      }
+      pairing.linked(deviceId);
+      changed();
+    },
+    onMessage(deviceId, text) {
+      for (const fn of messageListeners) {
+        try {
+          fn(deviceId, text);
+        } catch (e) {
+          log(`mobile: message listener failed (${e.message})`);
+        }
+      }
+    },
+    onClosed: () => changed(),
+    now
+  });
+  const onRelayMessage = (m) => {
+    switch (m.type) {
+      case "welcome":
+        channels.reset();
+        pairing.reset();
+        changed();
+        return;
+      case "deliver": {
+        if (m.from === "pc") return;
+        let raw;
+        try {
+          raw = JSON.parse(m.body);
+        } catch {
+          return;
+        }
+        const r = SealedFrameSchema.safeParse(raw);
+        if (!r.success) return;
+        if (r.data.k.startsWith("pair_")) {
+          pairing.receive(m.from, r.data).catch((e) => log(`mobile pairing: error on peer ${m.from} (${e.name})`));
+        } else {
+          void channels.receive(m.from, r.data);
+        }
+        return;
+      }
+      case "presence":
+        if (!m.online) channels.drop(m.peer);
+        return;
+      case "error":
+        if (m.to) channels.drop(m.to);
+        return;
+    }
+  };
+  const closeLink = () => {
+    const old = link;
+    link = null;
+    old?.close();
+    if (old) pairing.reset();
+    linkState = { state: "off" };
+  };
+  const openLink = () => {
+    if (stopped2 || link || !config.enabled || !session) return;
+    const self = { link: null };
+    const created = createRelayLink({
+      relayUrl: session.relayUrl,
+      token: session.token,
+      onState(s) {
+        if (self.link !== null && link !== self.link) return;
+        linkState = s;
+        changed();
+      },
+      onMessage(m) {
+        if (link !== self.link) return;
+        onRelayMessage(m);
+      },
+      now,
+      ...opts.WebSocketImpl ? { WebSocketImpl: opts.WebSocketImpl } : {},
+      ...opts.schedule ? { schedule: opts.schedule } : {}
+    });
+    self.link = created;
+    link = created;
+  };
+  const cancelSignin = () => {
+    signinRun?.cancel();
+    signinRun = null;
+    signin = null;
+  };
+  const startSignin = () => {
+    if (!config.enabled) throw new Error("mobile access is disabled");
+    cancelSignin();
+    signinError = null;
+    const relayUrl = config.relayUrl;
+    const run2 = startSignIn({
+      relayUrl,
+      onCode(c) {
+        if (signinRun !== run2) return;
+        signin = c;
+        changed();
+      },
+      fetchImpl,
+      ...opts.sleep ? { sleep: opts.sleep } : {}
+    });
+    signinRun = run2;
+    void run2.result.then((r) => {
+      if (signinRun !== run2) return;
+      signinRun = null;
+      signin = null;
+      if (r.status === "ok") {
+        writeRelaySession(r.session);
+        session = r.session;
+        log(`mobile: signed in as ${r.session.login}`);
+        closeLink();
+        openLink();
+      } else if (r.status !== "cancelled") {
+        signinError = r.status;
+        log(`mobile: sign-in ended (${r.status === "failed" ? r.error : r.status})`);
+      }
+      changed();
+    }).catch((e) => {
+      log(`mobile: sign-in not saved (${e.message})`);
+      if (signinRun === null) {
+        signinError = "failed";
+        changed();
+      }
+    });
+  };
+  const revokeOnRelay = async (peer) => {
+    if (!session || linkState.state !== "online") return;
+    try {
+      const res = await fetchImpl(new URL("/auth/devices/revoke", session.relayUrl).toString(), {
+        method: "POST",
+        headers: { authorization: `Bearer ${session.token}`, "content-type": "application/json" },
+        body: JSON.stringify({ peer }),
+        signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+      });
+      await res.body?.cancel();
+      if (!res.ok) log(`mobile: relay did not revoke peer ${peer} (status ${res.status})`);
+      else log(`mobile: relay revoked peer ${peer}`);
+    } catch (e) {
+      log(`mobile: relay did not revoke peer ${peer} (${e.name})`);
+    }
+  };
+  const revoke = async (id) => {
+    const d = devices.find((x) => x.id === id);
+    if (!d) return;
+    saveDevices(devices.filter((x) => x.id !== id));
+    log(`mobile: revoked device ${id}`);
+    channels.dropDevice(id);
+    if (d.lastPeer) sendFrame(d.lastPeer, { k: "denied" });
+    changed();
+    if (d.lastPeer) await revokeOnRelay(d.lastPeer);
+  };
+  const pairingIn = (id, states) => {
+    const p = pairing.views().find((v) => v.id === id);
+    if (!p || !states.includes(p.state)) throw new Error("no such pairing waiting for a decision");
+  };
+  openLink();
+  return {
+    state() {
+      const online = linkState.state === "online" ? channels.online() : /* @__PURE__ */ new Set();
+      return {
+        enabled: config.enabled,
+        relayUrl: config.relayUrl,
+        account: session ? { login: session.login, accountId: session.accountId } : null,
+        signin,
+        signinError,
+        link: linkState,
+        devices: devices.map((d) => ({
+          id: d.id,
+          label: d.label,
+          approvedAt: d.approvedAt,
+          online: online.has(d.id),
+          ...d.lastSeenAt ? { lastSeenAt: d.lastSeenAt } : {}
+        })),
+        pairings: pairing.views()
+      };
+    },
+    onChange(fn) {
+      changeListeners.add(fn);
+      return () => {
+        changeListeners.delete(fn);
+      };
+    },
+    async handle(msg) {
+      if (stopped2) throw new Error("mobile access is stopped");
+      switch (msg.type) {
+        case "mobile.set": {
+          const next2 = { enabled: msg.enabled, relayUrl: msg.relayUrl };
+          const moved = next2.relayUrl !== config.relayUrl;
+          writeMobileConfig(next2);
+          config = next2;
+          if (moved) {
+            cancelSignin();
+            clearRelaySession();
+            session = null;
+            closeLink();
+          }
+          if (!config.enabled) {
+            cancelSignin();
+            closeLink();
+          } else {
+            openLink();
+          }
+          changed();
+          return;
+        }
+        case "mobile.signin":
+          startSignin();
+          changed();
+          return;
+        case "mobile.signin.cancel":
+          cancelSignin();
+          changed();
+          return;
+        case "mobile.signout": {
+          cancelSignin();
+          const old = session;
+          session = null;
+          clearRelaySession();
+          closeLink();
+          changed();
+          if (old) await signOut(old, fetchImpl);
+          log("mobile: signed out");
+          return;
+        }
+        case "mobile.retry":
+          link?.retryNow();
+          return;
+        case "mobile.pairing.approve":
+          pairingIn(msg.id, ["confirm"]);
+          if (linkState.state !== "online") throw new Error("the relay is offline");
+          pairing.approve(msg.id);
+          return;
+        case "mobile.pairing.deny":
+          pairingIn(msg.id, ["confirm", "waiting"]);
+          pairing.deny(msg.id);
+          return;
+        case "mobile.device.revoke":
+          return revoke(msg.id);
+      }
+    },
+    send: (deviceId, text) => channels.send(deviceId, text),
+    onMessage(fn) {
+      messageListeners.add(fn);
+      return () => {
+        messageListeners.delete(fn);
+      };
+    },
+    async stop() {
+      if (stopped2) return;
+      cancelSignin();
+      closeLink();
+      pairing.stop();
+      stopped2 = true;
+      changeListeners.clear();
+      messageListeners.clear();
+    }
+  };
+}
+
 // src/daemon/index.ts
 async function startDaemon(opts = {}) {
   await ensureLedgeDir();
@@ -4937,7 +6864,7 @@ async function startDaemon(opts = {}) {
   }
   for (const s of store.all()) {
     if (backendOf(s) !== "omp-rpc") continue;
-    await reapOwner(join15(paths().dir, "omp", s.id)).catch(() => false);
+    await reapOwner(join16(paths().dir, "omp", s.id)).catch(() => false);
     if (s.state === "exited") continue;
     const at = (/* @__PURE__ */ new Date()).toISOString();
     store.apply(s.id, { name: "StopFailure", at, source: "daemon", text: "Ledge restarted: the OMP process ended with it" });
@@ -4955,7 +6882,15 @@ async function startDaemon(opts = {}) {
   if (loaded.clean) {
     for (const id of history.ids()) if (!store.get(id)) history.forget(id);
   } else log(`history cleanup skipped: ${loaded.reason}`);
-  const server = await startServer({ store, tmux, port: opts.port, daemon, updater, history });
+  let mobile;
+  let mobileUnavailable;
+  try {
+    mobile = await createMobileService();
+  } catch (e) {
+    log(`mobile access not available: ${e.message}`);
+    mobileUnavailable = e.message.slice(0, 200);
+  }
+  const server = await startServer({ store, tmux, port: opts.port, daemon, updater, history, mobile, mobileUnavailable });
   ompLive = () => server.omp.liveCount();
   const poller = startPoller({ store, tmux, broadcastPreview: server.preview });
   await writeFile7(paths().pid, String(process.pid));
@@ -4966,6 +6901,7 @@ async function startDaemon(opts = {}) {
     process.off("SIGINT", onSignal);
     poller.stop();
     await server.close();
+    await mobile?.stop();
     await store.save();
     await history.flush();
     await rm5(paths().pid, { force: true });