@sideboard-ai/core 0.1.273 → 0.1.275

package/dist/index.js

@@ -173,7 +173,7 @@ import {
   worktreeBoardStatus,
   worktreeCleanupSettings,
   writeWorktreeFile
-} from "./chunk-N3LASDJM.js";
+} from "./chunk-SQOAFR2U.js";
 import {
   BASE_ALLOWED_TOOLS,
   BRIGHTSY_MCP_ALLOWED_TOOLS,
@@ -263,7 +263,7 @@ import {
   whichOnPath,
   worktreeMcpToolNames,
   writeInjectedMcpConfig
-} from "./chunk-ADWNK2JH.js";
+} from "./chunk-NIB2IZ6J.js";
 import {
   brightsyMcpServerName,
   connectBrightsyTeam,
@@ -380,7 +380,7 @@ import {
   waitForTurnToolResult,
   worktreeRunPortsPath,
   wrapReviewSkillMarkdown
-} from "./chunk-HO2T6BC3.js";
+} from "./chunk-MGS5T2A3.js";
 import {
   STDERR_EVENT_MAX_CHARS,
   STDOUT_EVENT_MAX_CHARS,
@@ -446,7 +446,7 @@ import {
   parseAbleTimeOAuthCallbackUrl,
   resolveAbleTimeOAuthHost,
   startAbleTimeOAuth
-} from "./chunk-LAIBYKZS.js";
+} from "./chunk-QINJKNLR.js";
 import {
   ableTimeDependencyTarget,
   commentAbleTimeTask,
@@ -471,8 +471,8 @@ import {
   toAbleTimeIssueInfo,
   updateAbleTimeTask,
   verifyAbleTimeConnection
-} from "./chunk-UXI52MLJ.js";
-import "./chunk-AGXZAMOF.js";
+} from "./chunk-2J34G3WJ.js";
+import "./chunk-NQ7JMVSU.js";
 import {
   ABLETIME_MCP_PATH,
   ABLETIME_MCP_PM_PATH,
@@ -493,7 +493,7 @@ import {
   normalizeAbleTimeCredential,
   normalizeAbleTimeHost,
   rewriteAbleTimeError
-} from "./chunk-L6CYOON4.js";
+} from "./chunk-PZURG3XN.js";
 import {
   LEGACY_PLAN_FILE_REL,
   PLAN_FILE_NAME,
@@ -557,7 +557,7 @@ import {
   stageBuffersAsAttachments,
   syncWorkspacesFromThreads,
   takenTeamSlugsForOrchestration
-} from "./chunk-PTNGMA5C.js";
+} from "./chunk-A2G3ZBJS.js";
 import {
   FAMOUS_SOCCER_TEAMS,
   GITHUB_PR_BODY_MAX_CHARS,
@@ -657,7 +657,7 @@ import {
   worktreeDisplayLabelForGroup,
   worktreeNameFromPath,
   worktreeSlugForTicket
-} from "./chunk-USBZ7PH4.js";
+} from "./chunk-IPPY3FG5.js";
 import {
   appendMessage,
   createEmptyThread,
@@ -910,7 +910,7 @@ import {
   withTurnScopedCost,
   writeSecureJson,
   writeViewerContext
-} from "./chunk-PAH7KDL2.js";
+} from "./chunk-YNTXWFXT.js";
 import {
   THINKING_EFFORTS,
   isThinkingEffort,
@@ -1384,12 +1384,12 @@ async function persistLinearTokens(data, viewer) {
     organizationName: viewer?.organizationName
   });
 }
-async function fetchLinearViewer(accessToken) {
+async function fetchLinearViewer(accessToken2) {
   const res = await httpFetch(LINEAR_GRAPHQL, {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
-      Authorization: linearAuthorizationHeader(accessToken)
+      Authorization: linearAuthorizationHeader(accessToken2)
     },
     body: JSON.stringify({
       query: "{ viewer { name organization { name } } }"
@@ -5139,7 +5139,7 @@ async function handleJobStop(params, _ctx) {
   return stopDetachedJob(jobCwd(rec), id, reason ? { reason } : void 0);
 }
 async function defaultTurnWait(ref, timeoutMs) {
-  const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-K42IBMBE.js");
+  const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-QMKVXVUR.js");
   const orch = getOrchestrator2();
   const thread = await orch.waitForTurn(ref, timeoutMs, {
     resolveIfStillRunning: true
@@ -5633,7 +5633,7 @@ async function startMcpServer() {
     );
   }
   try {
-    const { maxConcurrentAgents: maxConcurrentAgents2 } = await import("./app-settings-L5HGYXWJ.js");
+    const { maxConcurrentAgents: maxConcurrentAgents2 } = await import("./app-settings-NI4X5HW3.js");
     orch.setMaxConcurrent(maxConcurrentAgents2());
   } catch {
   }
@@ -6121,7 +6121,7 @@ async function startMcpServer() {
   if (!worktreeProfile) {
     registerConnectedIssueVendorTools(server);
     const { getCaffeinateHold: getCaffeinateHold2, setCaffeinateHold: setCaffeinateHold2 } = await import("./caffeinate-hold-DYJGWK6Y.js");
-    const { resolveNewThreadOptions: resolveNewThreadOptions2, resolveThreadDefaults: resolveThreadDefaults2 } = await import("./app-settings-L5HGYXWJ.js");
+    const { resolveNewThreadOptions: resolveNewThreadOptions2, resolveThreadDefaults: resolveThreadDefaults2 } = await import("./app-settings-NI4X5HW3.js");
     const accountDefaults = resolveThreadDefaults2();
     const accountDefaultsHint = `Account defaults: agent=${accountDefaults.agent}, model=${accountDefaults.model?.trim() || "Auto"}, effort=${accountDefaults.effort}`;
     server.tool(
@@ -8992,7 +8992,14 @@ function parseRemoteClientMessage(raw) {
     const hostSecret = str2(parsed.hostSecret);
     const deviceLabel = str2(parsed.deviceLabel);
     if (!deviceId || !hostSecret || !deviceLabel) return null;
-    return { type: "host_register", deviceId, hostSecret, deviceLabel };
+    const accountToken = str2(parsed.accountToken);
+    return {
+      type: "host_register",
+      deviceId,
+      hostSecret,
+      deviceLabel,
+      ...accountToken ? { accountToken } : {}
+    };
   }
   if (msg.type === "pair") {
     const code = str2(parsed.code).toUpperCase();
@@ -9121,6 +9128,10 @@ function newCode() {
   return code;
 }
 var RemoteHub = class {
+  constructor(opts = {}) {
+    this.opts = opts;
+  }
+  opts;
   hosts = /* @__PURE__ */ new Map();
   remembered = /* @__PURE__ */ new Map();
   bySocket = /* @__PURE__ */ new Map();
@@ -9159,7 +9170,7 @@ var RemoteHub = class {
   }
   dispatch(socket, msg) {
     if (msg.type === "host_register") {
-      this.registerHost(socket, msg.deviceId, msg.deviceLabel, msg.hostSecret);
+      this.registerHost(socket, msg.deviceId, msg.deviceLabel, msg.hostSecret, msg.accountToken ?? "");
       return;
     }
     if (msg.type === "host_pair") {
@@ -9186,7 +9197,14 @@ var RemoteHub = class {
       this.fromHost(socket, msg);
     }
   }
-  registerHost(socket, deviceId, deviceLabel, hostSecret) {
+  registerHost(socket, deviceId, deviceLabel, hostSecret, accountToken) {
+    if (this.opts.authorizeHost) {
+      const decision = this.opts.authorizeHost({ accountToken, deviceId, deviceLabel, hostSecret });
+      if (!decision.ok) {
+        send2(socket, { type: "error", message: decision.message });
+        return;
+      }
+    }
     const prior = this.remembered.get(deviceId);
     const existing = this.hosts.get(deviceId);
     if (prior && prior.hostSecret !== hostSecret || existing && existing.hostSecret !== hostSecret) {
@@ -9218,6 +9236,7 @@ var RemoteHub = class {
     this.bySocket.set(socket, { role: "host", deviceId });
     send2(socket, { type: "registered", deviceId, deviceLabel });
     if (host.phone) send2(socket, { type: "phone_joined" });
+    this.opts.onAuthorized?.(socket);
   }
   issueCode(socket) {
     const bound = this.bySocket.get(socket);
@@ -9279,6 +9298,7 @@ var RemoteHub = class {
         online: Boolean(host)
       };
     });
+    if (hosts.some((host) => host.deviceId)) this.opts.onAuthorized?.(socket);
     send2(socket, { type: "hosts", hosts });
   }
   releasePhoneSocket(socket) {
@@ -9318,6 +9338,7 @@ var RemoteHub = class {
       deviceLabel: host.deviceLabel
     });
     this.bySocket.set(socket, { role: "phone", deviceId: host.deviceId });
+    this.opts.onAuthorized?.(socket);
     send2(socket, {
       type: "paired",
       deviceId: host.deviceId,
@@ -9354,6 +9375,524 @@ var RemoteHub = class {
 // src/remote/client.ts
 import { WebSocket as WsWebSocket3 } from "ws";
 
+// src/remote/phone-chats.ts
+import { randomUUID as randomUUID7 } from "crypto";
+var PHONE_CONTROL_PREFIX = "\0sb.phone\n";
+var PHONE_USER_PREFIX = "Phone\n\n";
+var TRANSCRIPT_LIMIT = 40;
+var MESSAGE_LIMIT = 4e3;
+var PREVIEW_LIMIT = 90;
+var HISTORY_PAGE_SIZE = 40;
+var AGENT_KINDS = /* @__PURE__ */ new Set(["claude", "codex", "opencode", "brightsy", "cursor"]);
+var MAX_PHONE_FILES = 8;
+var MAX_PHONE_FILE_CHARS = Math.ceil(8 * 1024 * 1024 * 4 / 3);
+var MAX_PHONE_FILES_CHARS = Math.ceil(20 * 1024 * 1024 * 4 / 3);
+var MAX_DICTATION_CHARS = Math.ceil(12 * 1024 * 1024 * 4 / 3);
+function encodePhoneControl(payload) {
+  return PHONE_CONTROL_PREFIX + JSON.stringify(payload);
+}
+function takePhoneControl(text6) {
+  if (!text6.startsWith(PHONE_CONTROL_PREFIX)) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(text6.slice(PHONE_CONTROL_PREFIX.length));
+  } catch {
+    return "invalid";
+  }
+  return parsePhoneControl(parsed);
+}
+function parsePhoneControl(value) {
+  if (!value || typeof value !== "object") return "invalid";
+  const op = value.op;
+  if (op === "list") return { op: "list" };
+  if (op === "history") {
+    const query = textField(value, "query");
+    const after = textField(value, "after");
+    return { op: "history", ...query ? { query } : {}, ...after ? { after } : {} };
+  }
+  if (op === "sources") {
+    const repoPath = textField(value, "repoPath");
+    if (!repoPath || !isProjectPath(repoPath)) return "invalid";
+    const query = textField(value, "query");
+    return { op: "sources", repoPath, ...query ? { query } : {} };
+  }
+  if (op === "models") {
+    const agent = agentField(value);
+    if (!agent) return "invalid";
+    return { op: "models", agent };
+  }
+  if (op === "dictate") {
+    const id = textField(value, "id");
+    const audioBase64 = base64Field(value, "audioBase64");
+    if (!id || !audioBase64 || audioBase64.length > MAX_DICTATION_CHARS) return "invalid";
+    return { op: "dictate", id, audioBase64 };
+  }
+  if (op === "create") return parsePhoneCreate(value);
+  const chatId = typeof value.chatId === "string" ? value.chatId.trim() : "";
+  if (!chatId) return "invalid";
+  if (op === "open" || op === "archive" || op === "restore" || op === "stop") return { op, chatId };
+  const draft = parsePhoneDraft(value);
+  if (draft === "invalid") return "invalid";
+  if (op === "options") return { op: "options", chatId, ...draft };
+  if (op === "prompt") {
+    const text6 = typeof value.text === "string" ? value.text.trim() : "";
+    const hasPayload = Boolean(text6 || draft.files?.length || draft.links?.length);
+    if (!hasPayload) return "invalid";
+    return { op: "prompt", chatId, text: text6, ...draft };
+  }
+  return "invalid";
+}
+function textField(value, key) {
+  const raw = value[key];
+  return typeof raw === "string" ? raw.trim() : "";
+}
+function agentField(value) {
+  const agent = textField(value, "agent");
+  if (!agent) return void 0;
+  return AGENT_KINDS.has(agent) ? agent : void 0;
+}
+function base64Field(value, key) {
+  const raw = value[key];
+  if (typeof raw !== "string") return "";
+  return raw.replace(/\s/g, "");
+}
+function parsePhoneDraft(value) {
+  const draft = {};
+  if (textField(value, "agent")) {
+    const agent = agentField(value);
+    if (!agent) return "invalid";
+    draft.agent = agent;
+  }
+  if ("model" in value) {
+    const model = value.model;
+    if (model === null || model === "") draft.model = null;
+    else if (typeof model === "string") draft.model = model.trim().slice(0, 200);
+    else return "invalid";
+  }
+  if ("effort" in value && value.effort != null) {
+    const effort = value.effort;
+    if (!isThinkingEffort(effort)) return "invalid";
+    draft.effort = effort;
+  }
+  if ("fast" in value) {
+    const fast = value.fast;
+    if (typeof fast !== "boolean") return "invalid";
+    draft.fast = fast;
+  }
+  if ("planMode" in value) {
+    const planMode = value.planMode;
+    if (typeof planMode !== "boolean") return "invalid";
+    draft.planMode = planMode;
+  }
+  if ("autonomy" in value && value.autonomy != null) {
+    const autonomy = value.autonomy;
+    if (autonomy !== "default" && autonomy !== "full") return "invalid";
+    draft.autonomy = autonomy;
+  }
+  const files = parsePhoneFiles(value.files);
+  if (files === "invalid") return "invalid";
+  if (files.length) draft.files = files;
+  const links = parsePhoneLinks(value.links);
+  if (links === "invalid") return "invalid";
+  if (links.length) draft.links = links;
+  const prompt = textField(value, "prompt");
+  if (prompt) draft.prompt = prompt.slice(0, 2e4);
+  return draft;
+}
+function parsePhoneFiles(value) {
+  if (value == null) return [];
+  if (!Array.isArray(value) || value.length > MAX_PHONE_FILES) return "invalid";
+  const files = [];
+  let total = 0;
+  for (const item of value) {
+    if (!item || typeof item !== "object") return "invalid";
+    const name = (textField(item, "name").replace(/[/\\]/g, "_") || "file").slice(0, 180);
+    const dataBase64 = base64Field(item, "dataBase64");
+    if (!dataBase64 || !/^[A-Za-z0-9+/=]+$/.test(dataBase64)) return "invalid";
+    if (dataBase64.length > MAX_PHONE_FILE_CHARS) return "invalid";
+    total += dataBase64.length;
+    if (total > MAX_PHONE_FILES_CHARS) return "invalid";
+    files.push({ name, dataBase64 });
+  }
+  return files;
+}
+function parsePhoneLinks(value) {
+  if (value == null) return [];
+  if (!Array.isArray(value) || value.length > 8) return "invalid";
+  const links = [];
+  for (const item of value) {
+    if (!item || typeof item !== "object") return "invalid";
+    const ref = textField(item, "ref").slice(0, 80);
+    if (!ref) return "invalid";
+    const title = (textField(item, "title") || ref).slice(0, 200);
+    const url = textField(item, "url").slice(0, 500);
+    links.push({ ref, title, ...url ? { url } : {} });
+  }
+  return links;
+}
+function parsePhoneCreate(value) {
+  const draft = parsePhoneDraft(value);
+  if (draft === "invalid") return "invalid";
+  const goal = textField(value, "goal") || draft.prompt || "";
+  const where = value.where;
+  if (where == null || where === "orchestration") {
+    return {
+      op: "create",
+      where: "orchestration",
+      ...draft,
+      ...goal ? { goal, prompt: goal } : {}
+    };
+  }
+  if (where === "worktree") {
+    const chatId = textField(value, "chatId");
+    if (!chatId) return "invalid";
+    return { op: "create", where: "worktree", chatId, ...draft };
+  }
+  if (where === "project") {
+    const repoPath = textField(value, "repoPath");
+    if (!repoPath || !isProjectPath(repoPath)) return "invalid";
+    const sourceRaw = textField(value, "sourceType");
+    let sourceType;
+    if (sourceRaw === "branch" || sourceRaw === "pr" || sourceRaw === "ticket") sourceType = sourceRaw;
+    else if (sourceRaw) return "invalid";
+    const sourceRef = textField(value, "sourceRef");
+    if ((sourceType === "pr" || sourceType === "ticket") && !sourceRef) return "invalid";
+    const title = textField(value, "title").slice(0, 200);
+    const cowboy = value.cowboy === true;
+    return {
+      op: "create",
+      where: "project",
+      repoPath,
+      ...draft,
+      ...sourceType ? { sourceType } : {},
+      ...sourceRef ? { sourceRef } : {},
+      ...title ? { title } : {},
+      ...cowboy ? { cowboy: true } : {}
+    };
+  }
+  return "invalid";
+}
+function phoneVisibleText(role, text6) {
+  const trimmed = text6.trim();
+  if (role === "user" && trimmed.startsWith(PHONE_USER_PREFIX)) {
+    return trimmed.slice(PHONE_USER_PREFIX.length).trim();
+  }
+  return trimmed;
+}
+function clip(text6, limit) {
+  if (text6.length <= limit) return text6;
+  return `${text6.slice(0, limit - 1)}\u2026`;
+}
+function summarize(thread) {
+  return {
+    id: thread.id,
+    title: thread.title?.trim() || "Untitled",
+    status: thread.status,
+    preview: previewOf(thread),
+    updatedAt: thread.updatedAt
+  };
+}
+function previewOf(thread) {
+  const messages = listPhoneMessages(thread);
+  const last = messages[messages.length - 1];
+  if (!last) return "";
+  return clip(last.text.replace(/\s+/g, " ").trim(), PREVIEW_LIMIT);
+}
+function listPhoneMessages(thread) {
+  const out = [];
+  for (const message of thread.messages) {
+    if (message.role !== "user" && message.role !== "agent") continue;
+    const names = (message.attachments ?? []).map((item) => item.name.trim()).filter(Boolean);
+    const text6 = clip(
+      [phoneVisibleText(message.role, message.text), names.length ? names.join(", ") : ""].filter(Boolean).join("\n"),
+      MESSAGE_LIMIT
+    );
+    if (!text6) continue;
+    out.push({ role: message.role, text: text6 });
+  }
+  for (const prompt of thread.queue) {
+    const text6 = clip(phoneVisibleText("user", prompt), MESSAGE_LIMIT);
+    if (text6) out.push({ role: "user", text: text6 });
+  }
+  return out.slice(-TRANSCRIPT_LIMIT);
+}
+function repoName(repoPath) {
+  const parts = repoPath.replace(/\/$/, "").split("/");
+  return parts[parts.length - 1] || repoPath;
+}
+function isProjectPath(path2) {
+  if (!path2 || path2 === "/" || path2 === ".") return false;
+  return !isGlobalThread({ repoPath: path2 });
+}
+function listPhoneChats() {
+  return listGlobalThreads().slice().sort((a, b) => a.updatedAt < b.updatedAt ? 1 : a.updatedAt > b.updatedAt ? -1 : 0).map(summarize);
+}
+function listPhoneSidebar() {
+  const threads = listThreads();
+  const byRepo = /* @__PURE__ */ new Map();
+  for (const thread of threads) {
+    if (!isProjectPath(thread.repoPath)) continue;
+    const list = byRepo.get(thread.repoPath) ?? [];
+    list.push(thread);
+    byRepo.set(thread.repoPath, list);
+  }
+  for (const workspace of listWorkspaces()) {
+    if (!isProjectPath(workspace.path) || byRepo.has(workspace.path)) continue;
+    byRepo.set(workspace.path, []);
+  }
+  const projects = [...byRepo.entries()].sort(([a], [b]) => repoName(a).localeCompare(repoName(b))).map(([path2, repoThreads]) => ({
+    name: repoName(path2),
+    path: path2,
+    worktrees: groupHomeBoardWorktrees(repoThreads).map((group) => ({
+      label: worktreeDisplayLabelForGroup(group),
+      chats: group.map(summarize)
+    }))
+  }));
+  return { orchestration: listPhoneChats(), projects };
+}
+function historyStamp(thread) {
+  return thread.archivedAt || thread.updatedAt;
+}
+function historyCursor(chat) {
+  return `${chat.updatedAt}	${chat.id}`;
+}
+function historyQueryMatch(chat, query) {
+  if (!query) return true;
+  return `${chat.title} ${chat.where} ${chat.agent} ${chat.preview}`.toLowerCase().includes(query);
+}
+function listPhoneHistory(opts) {
+  const query = opts?.query?.trim().toLowerCase() ?? "";
+  const after = opts?.after?.trim() ?? "";
+  const all = listThreads({ includeArchived: true }).filter((thread) => thread.status === "archived").filter((thread) => isGlobalThread(thread) || isProjectPath(thread.repoPath)).sort((a, b) => historyStamp(a) < historyStamp(b) ? 1 : historyStamp(a) > historyStamp(b) ? -1 : 0).map((thread) => ({
+    id: thread.id,
+    title: thread.title?.trim() || "Untitled",
+    preview: previewOf(thread),
+    updatedAt: historyStamp(thread),
+    where: isGlobalThread(thread) ? "Orchestration" : repoName(thread.repoPath),
+    agent: thread.agent
+  })).filter((chat) => historyQueryMatch(chat, query));
+  let start = 0;
+  if (after) {
+    const index = all.findIndex((chat) => historyCursor(chat) === after);
+    start = index >= 0 ? index + 1 : all.length;
+  }
+  const chats = all.slice(start, start + HISTORY_PAGE_SIZE);
+  const last = chats.at(-1);
+  const more = start + chats.length < all.length;
+  return {
+    chats,
+    total: all.length,
+    ...more && last ? { next: historyCursor(last) } : {}
+  };
+}
+function readPhoneThread(chatId) {
+  const id = chatId.trim();
+  if (!id) return null;
+  const thread = readThread(id);
+  if (!thread || thread.status === "archived") return null;
+  if (isGlobalThread(thread)) return thread;
+  if (!isProjectPath(thread.repoPath)) return null;
+  return thread;
+}
+function phoneComposerOptions(thread) {
+  return {
+    agent: thread.agent,
+    model: thread.model ?? null,
+    effort: thread.effort,
+    fast: Boolean(thread.fast),
+    planMode: Boolean(thread.planMode),
+    autonomy: thread.autonomy ?? "default"
+  };
+}
+function phoneTurnAttachments(draft) {
+  const links = (draft.links ?? []).map((link) => ({
+    id: randomUUID7(),
+    name: link.ref,
+    kind: "issue",
+    content: [`Linked issue: ${link.ref} \u2014 ${link.title}`, link.url ? `URL: ${link.url}` : null].filter(Boolean).join("\n")
+  }));
+  const files = (draft.files ?? []).map((file) => ({
+    id: randomUUID7(),
+    name: file.name,
+    kind: "file",
+    previewDataUrl: `data:application/octet-stream;base64,${file.dataBase64}`,
+    content: `File attached: ${file.name}`
+  }));
+  return [...links, ...files];
+}
+function openedFrom(thread, place) {
+  const fresh = readThread(thread.id) ?? thread;
+  return {
+    chat: summarize(fresh),
+    messages: listPhoneMessages(fresh),
+    place,
+    options: phoneComposerOptions(fresh)
+  };
+}
+function openPhoneChat(chatId) {
+  const thread = readPhoneThread(chatId);
+  if (!thread) return null;
+  const place = isGlobalThread(thread) ? { kind: "orchestration" } : projectPlace(thread);
+  return openedFrom(thread, place);
+}
+function sameRepoPath(a, b) {
+  return a.replace(/\/+$/, "") === b.replace(/\/+$/, "");
+}
+function projectPlace(thread) {
+  const group = threadsSharingWorktree(thread.worktreePath);
+  return {
+    kind: "project",
+    repoPath: thread.repoPath,
+    worktree: worktreeDisplayLabelForGroup(group.length > 0 ? group : [thread])
+  };
+}
+function assertKnownProject(repoPath) {
+  const path2 = repoPath.trim();
+  if (!isProjectPath(path2)) throw new Error("Pick a project on this Mac.");
+  const known = listWorkspaces().some((workspace) => sameRepoPath(workspace.path, path2)) || listThreads().some(
+    (thread) => thread.status !== "archived" && sameRepoPath(thread.repoPath, path2)
+  );
+  if (!known) throw new Error("That project is not on this Mac.");
+  return path2;
+}
+function draftAgentOptions(draft, defaults) {
+  return {
+    agent: draft?.agent ?? defaults.agent,
+    model: draft && "model" in draft ? draft.model ?? null : defaults.model,
+    effort: draft?.effort ?? defaults.effort,
+    fast: draft?.fast ?? defaults.fast,
+    planMode: Boolean(draft?.planMode),
+    autonomy: draft?.autonomy
+  };
+}
+function createPhoneChat(agent) {
+  const defaults = resolveOrchestratorDefaults();
+  const thread = createGlobalChat({
+    agent: agent ?? defaults.agent,
+    model: defaults.model,
+    effort: defaults.effort,
+    fast: defaults.fast
+  });
+  return openedFrom(thread, { kind: "orchestration" });
+}
+async function createPhoneOrchestration(draft) {
+  const goal = (draft?.goal ?? draft?.prompt ?? "").trim();
+  const attachments = phoneTurnAttachments(draft ?? {});
+  if (!goal && attachments.length === 0) return createPhoneChat(draft?.agent);
+  const defaults = resolveOrchestratorDefaults();
+  const options = draftAgentOptions(draft, defaults);
+  const thread = await startOrchestration({
+    goal: goal || "See the attached files.",
+    agent: options.agent,
+    model: options.model,
+    effort: options.effort,
+    fast: options.fast,
+    planMode: options.planMode,
+    autonomy: options.autonomy,
+    attachments
+  });
+  return openedFrom(thread, { kind: "orchestration" });
+}
+function createPhoneWorktreeAgent(fromChatId, draft) {
+  const source = readPhoneThread(fromChatId);
+  if (!source || isGlobalThread(source)) throw new Error("That worktree is not on this Mac.");
+  const defaults = resolveNewThreadOptions();
+  const options = draftAgentOptions(draft, defaults);
+  const attachments = persistPendingFileAttachments(
+    source.worktreePath,
+    phoneTurnAttachments(draft ?? {})
+  );
+  const thread = createChatTab({
+    fromThreadId: source.id,
+    agent: options.agent,
+    model: options.model,
+    effort: options.effort,
+    fast: options.fast,
+    autonomy: options.autonomy,
+    attachments
+  });
+  if (draft?.planMode !== void 0) updateThread(thread.id, { planMode: draft.planMode });
+  return openedFrom(thread, projectPlace(readThread(thread.id) ?? thread));
+}
+async function createPhoneProjectWorktree(repoPathOrInput) {
+  const input = typeof repoPathOrInput === "string" ? { repoPath: repoPathOrInput } : repoPathOrInput;
+  const path2 = assertKnownProject(input.repoPath);
+  const defaults = resolveNewThreadOptions();
+  const options = draftAgentOptions(input, defaults);
+  const thread = await createThread({
+    sourceType: input.sourceType ?? "branch",
+    sourceRef: input.sourceRef || "default",
+    repoPath: path2,
+    title: input.title,
+    cowboy: input.cowboy,
+    agent: options.agent,
+    model: options.model,
+    effort: options.effort,
+    fast: options.fast,
+    planMode: options.planMode,
+    autonomy: options.autonomy,
+    attachments: phoneTurnAttachments(input),
+    prompt: input.prompt,
+    reuseExisting: false
+  });
+  return openedFrom(thread, projectPlace(thread));
+}
+function sourceWarning(label, err) {
+  const message = err instanceof Error ? err.message : String(err);
+  return message ? `${label}: ${message}` : `${label} failed.`;
+}
+async function listPhoneSources(repoPath, query) {
+  const path2 = assertKnownProject(repoPath);
+  const q = query?.trim() ?? "";
+  const warnings = [];
+  const [prs, branches, issues] = await Promise.all([
+    listPrs(path2, { state: "open", limit: 40, ...q ? { query: q } : {} }).catch((err) => {
+      warnings.push(sourceWarning("Pull requests", err));
+      return [];
+    }),
+    listBranches(path2).catch((err) => {
+      warnings.push(sourceWarning("Branches", err));
+      return [];
+    }),
+    listIssues(path2, { limit: 40, ...q ? { query: q } : {} }).catch((err) => {
+      warnings.push(sourceWarning("Issues", err));
+      return { issues: [] };
+    })
+  ]);
+  const needle = q.toLowerCase();
+  const branchRows = branches.filter((branch) => !needle || branch.name.toLowerCase().includes(needle)).slice(0, 50).map((branch) => ({
+    ref: branch.name,
+    title: branch.current ? `${branch.name} (current)` : branch.name
+  }));
+  return {
+    prs: prs.slice(0, 40).map((pr) => ({
+      ref: String(pr.number),
+      title: clip(pr.title || `PR #${pr.number}`, 140),
+      ...pr.url ? { url: pr.url } : {}
+    })),
+    branches: branchRows,
+    issues: (issues.issues ?? []).slice(0, 40).map((issue) => ({
+      ref: issue.identifier,
+      title: clip(issue.title || issue.identifier, 140),
+      ...issue.url ? { url: issue.url } : {}
+    })),
+    ...warnings.length ? { warnings } : {}
+  };
+}
+async function listPhoneModels(agent) {
+  const catalogs = await listModelsForAgent(agent);
+  return (catalogs[0]?.models ?? []).slice(0, 40).map((model) => ({
+    id: model.id,
+    label: model.displayName || model.id
+  }));
+}
+function archivePhoneChat(chatId) {
+  const thread = readPhoneThread(chatId);
+  if (!thread) return false;
+  updateThread(thread.id, { status: "archived" });
+  return true;
+}
+
 // src/remote/listen.ts
 var REMOTE_STOPPED_REPLY = "Sideboard stopped the in-progress turn.";
 function formatRemotePrompt(text6) {
@@ -9366,6 +9905,8 @@ function isRemoteStopCommand(text6) {
 }
 var handleChain2 = Promise.resolve();
 var inboundGeneration = 0;
+var chatChains = /* @__PURE__ */ new Map();
+var chatGeneration = /* @__PURE__ */ new Map();
 function enqueue(fn) {
   const run2 = handleChain2.then(fn, fn);
   handleChain2 = run2.then(
@@ -9387,10 +9928,340 @@ function interruptRemoteCoordinator(deviceId, log = () => void 0) {
     return false;
   }
 }
+function bumpChat(chatId) {
+  const next = (chatGeneration.get(chatId) ?? 0) + 1;
+  chatGeneration.set(chatId, next);
+  return next;
+}
+function enqueueChat(chatId, fn) {
+  const prev = chatChains.get(chatId) ?? Promise.resolve();
+  const run2 = prev.then(fn, fn);
+  chatChains.set(
+    chatId,
+    run2.then(
+      () => void 0,
+      () => void 0
+    )
+  );
+}
+function emitControl(opts, reply) {
+  opts.onOutbound({ type: "assistant", text: encodePhoneControl(reply) });
+}
+function interruptChat(chatId, log) {
+  try {
+    const thread = readPhoneThread(chatId);
+    if (!thread) return false;
+    if (thread.status !== "running" && thread.status !== "queued") return false;
+    getOrchestrator().stop(thread.id, { clearQueue: true });
+    log(`interrupt phone \u2192 chat ${thread.id.slice(0, 8)} (${thread.status})`);
+    return true;
+  } catch (err) {
+    log(`interrupt chat: ${err instanceof Error ? err.message : String(err)}`);
+    return false;
+  }
+}
+function emitChatTurn(opts, chatId, threadId) {
+  const thread = readThread(threadId);
+  if (!thread) {
+    emitControl(opts, { op: "error", chatId, message: "That agent is not on this Mac." });
+    return;
+  }
+  if (thread.status === "stopped") {
+    emitControl(opts, { op: "stopped", chatId });
+    return;
+  }
+  const result = getOrchestrator().getTurnResult(thread.id);
+  const pending = extractPendingPlanQuestions(
+    [...thread.messages].reverse().find((m) => m.role === "agent")?.parts
+  );
+  if (result.taskState === "input-required" && pending) {
+    emitControl(opts, {
+      op: "ask",
+      chatId,
+      text: result.text.trim(),
+      questions: pending.questions.map((q) => ({
+        question: q.question,
+        options: q.options.map(
+          (o) => o.description ? { label: o.label, description: o.description } : { label: o.label }
+        )
+      }))
+    });
+    return;
+  }
+  const reply = outboundReplyFromTurn(result, {
+    inputRequired: "Sideboard is waiting for an answer.",
+    canceled: REMOTE_STOPPED_REPLY,
+    completedEmpty: () => "",
+    failed: (detail) => detail ? `Sideboard failed: ${detail}` : "Sideboard failed before producing a result."
+  });
+  emitControl(opts, { op: "assistant", chatId, text: reply.trim() });
+}
+function phoneError(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function deliverPhoneTurn(opts, chatId) {
+  const thread = readPhoneThread(chatId);
+  if (!thread || thread.status !== "running" && thread.status !== "queued") return;
+  const generation = bumpChat(chatId);
+  enqueueChat(chatId, async () => {
+    if (chatGeneration.get(chatId) !== generation) return;
+    try {
+      await getOrchestrator().waitForTurn(chatId, 14 * 60 * 1e3);
+    } catch (err) {
+      if (chatGeneration.get(chatId) !== generation) return;
+      emitControl(opts, { op: "error", chatId, message: `Sideboard failed: ${phoneError(err)}` });
+      return;
+    }
+    if (chatGeneration.get(chatId) !== generation) return;
+    emitChatTurn(opts, chatId, chatId);
+  });
+}
+function applyPhoneOptions(chatId, draft) {
+  const patch = {};
+  if (draft.agent) patch.agent = draft.agent;
+  if ("model" in draft) patch.model = draft.model ?? null;
+  if (draft.effort) patch.effort = draft.effort;
+  if (draft.fast !== void 0) patch.fast = draft.fast;
+  if (draft.planMode !== void 0) patch.planMode = draft.planMode;
+  if (draft.autonomy) patch.autonomy = draft.autonomy;
+  if (Object.keys(patch).length === 0) return;
+  getOrchestrator().setThreadOptions(chatId, patch);
+}
+function stagePhoneTurnFiles(worktreePath, draft) {
+  const links = phoneTurnAttachments({ links: draft.links });
+  const files = stageBuffersAsAttachments(
+    worktreePath,
+    (draft.files ?? []).map((file) => ({ name: file.name, dataBase64: file.dataBase64 }))
+  );
+  return [...links, ...files];
+}
+function handlePhoneControl(cmd, opts) {
+  const log = opts.onLog ?? (() => void 0);
+  if (cmd.op === "list") {
+    emitControl(opts, { op: "sidebar", ...listPhoneSidebar() });
+    return;
+  }
+  if (cmd.op === "history") {
+    const page = listPhoneHistory({ query: cmd.query, after: cmd.after });
+    emitControl(opts, {
+      op: "history",
+      chats: page.chats,
+      total: page.total,
+      ...page.next ? { next: page.next } : {},
+      ...cmd.query ? { query: cmd.query } : {},
+      ...cmd.after ? { after: cmd.after } : {}
+    });
+    return;
+  }
+  if (cmd.op === "sources") {
+    const repoPath = cmd.repoPath;
+    const query = cmd.query;
+    void listPhoneSources(repoPath, query).then(
+      (page) => emitControl(opts, {
+        op: "sources",
+        repoPath,
+        ...query ? { query } : {},
+        ...page
+      })
+    ).catch((err) => {
+      emitControl(opts, { op: "error", message: phoneError(err) });
+    });
+    return;
+  }
+  if (cmd.op === "models") {
+    const agent = cmd.agent;
+    void listPhoneModels(agent).then((models) => emitControl(opts, { op: "models", agent, models })).catch((err) => {
+      emitControl(opts, { op: "error", message: phoneError(err) });
+    });
+    return;
+  }
+  if (cmd.op === "dictate") {
+    const id = cmd.id;
+    const transcribe = opts.transcribeWav;
+    if (!transcribe) {
+      emitControl(opts, { op: "error", message: "Speech is not available on this Mac." });
+      return;
+    }
+    void transcribe(cmd.audioBase64).then((text6) => emitControl(opts, { op: "dictated", id, text: text6.trim() })).catch((err) => {
+      emitControl(opts, { op: "error", message: phoneError(err) });
+    });
+    return;
+  }
+  if (cmd.op === "options") {
+    const thread = readPhoneThread(cmd.chatId);
+    if (!thread) {
+      emitControl(opts, { op: "error", chatId: cmd.chatId, message: "That agent is not on this Mac." });
+      return;
+    }
+    try {
+      applyPhoneOptions(thread.id, cmd);
+      const fresh = readPhoneThread(thread.id) ?? thread;
+      emitControl(opts, { op: "options", chatId: fresh.id, ...phoneComposerOptions(fresh) });
+    } catch (err) {
+      emitControl(opts, { op: "error", chatId: cmd.chatId, message: phoneError(err) });
+    }
+    return;
+  }
+  if (cmd.op === "create") {
+    if (cmd.where === "worktree") {
+      void (async () => {
+        try {
+          const opened = createPhoneWorktreeAgent(cmd.chatId, cmd);
+          const prompt = cmd.prompt?.trim() || (cmd.files?.length || cmd.links?.length ? "See the attached files." : "");
+          if (prompt) {
+            try {
+              await getOrchestrator().send(opened.chat.id, formatRemotePrompt(prompt));
+            } catch (err) {
+              emitControl(opts, { op: "error", chatId: opened.chat.id, message: phoneError(err) });
+            }
+          }
+          const fresh = openPhoneChat(opened.chat.id) ?? opened;
+          emitControl(opts, { op: "opened", ...fresh });
+          if (prompt) deliverPhoneTurn(opts, fresh.chat.id);
+        } catch (err) {
+          emitControl(opts, { op: "error", message: phoneError(err) });
+        }
+      })();
+      return;
+    }
+    if (cmd.where === "project") {
+      void createPhoneProjectWorktree(cmd).then(async (opened) => {
+        const prompt = resolveCreateFirstPrompt({
+          sourceType: cmd.sourceType ?? "branch",
+          prompt: cmd.prompt
+        }) || (cmd.files?.length || cmd.links?.length ? "See the attached files." : "");
+        if (prompt) {
+          try {
+            await getOrchestrator().send(opened.chat.id, formatRemotePrompt(prompt));
+          } catch (err) {
+            emitControl(opts, { op: "error", chatId: opened.chat.id, message: phoneError(err) });
+          }
+        }
+        const fresh = openPhoneChat(opened.chat.id) ?? opened;
+        emitControl(opts, { op: "opened", ...fresh });
+        if (prompt) deliverPhoneTurn(opts, fresh.chat.id);
+      }).catch((err) => {
+        emitControl(opts, { op: "error", message: phoneError(err) });
+      });
+      return;
+    }
+    const goal = cmd.goal?.trim() || cmd.prompt?.trim() || "";
+    if (goal || cmd.files?.length || cmd.links?.length) {
+      void createPhoneOrchestration({ ...cmd, goal }).then((opened) => {
+        emitControl(opts, { op: "opened", ...opened });
+        deliverPhoneTurn(opts, opened.chat.id);
+      }).catch((err) => {
+        emitControl(opts, { op: "error", message: phoneError(err) });
+      });
+      return;
+    }
+    try {
+      const agent = coerceOrchestratorAgent(
+        cmd.agent ?? opts.agent ?? resolveOrchestratorDefaults().agent
+      );
+      emitControl(opts, { op: "opened", ...createPhoneChat(agent) });
+    } catch (err) {
+      emitControl(opts, { op: "error", message: phoneError(err) });
+    }
+    return;
+  }
+  if (cmd.op === "open") {
+    const opened = openPhoneChat(cmd.chatId);
+    if (!opened) {
+      emitControl(opts, { op: "error", message: "That agent is not on this Mac." });
+      return;
+    }
+    emitControl(opts, { op: "opened", ...opened });
+    return;
+  }
+  if (cmd.op === "archive") {
+    const thread = readPhoneThread(cmd.chatId);
+    if (!thread) {
+      emitControl(opts, { op: "error", message: "That agent is not on this Mac." });
+      return;
+    }
+    bumpChat(thread.id);
+    interruptChat(thread.id, log);
+    archivePhoneChat(thread.id);
+    emitControl(opts, { op: "sidebar", ...listPhoneSidebar() });
+    return;
+  }
+  if (cmd.op === "restore") {
+    const chatId2 = cmd.chatId;
+    void getOrchestrator().restore(chatId2).then(() => {
+      emitControl(opts, { op: "sidebar", ...listPhoneSidebar() });
+      emitControl(opts, { op: "restored", chatId: chatId2 });
+    }).catch((err) => {
+      emitControl(opts, {
+        op: "error",
+        chatId: chatId2,
+        message: err instanceof Error ? err.message : String(err)
+      });
+    });
+    return;
+  }
+  if (cmd.op === "stop") {
+    if (!readPhoneThread(cmd.chatId)) {
+      emitControl(opts, { op: "error", chatId: cmd.chatId, message: "That agent is not on this Mac." });
+      return;
+    }
+    bumpChat(cmd.chatId);
+    interruptChat(cmd.chatId, log);
+    emitControl(opts, { op: "stopped", chatId: cmd.chatId });
+    return;
+  }
+  const chatId = cmd.chatId;
+  const generation = bumpChat(chatId);
+  interruptChat(chatId, log);
+  enqueueChat(chatId, async () => {
+    if (chatGeneration.get(chatId) !== generation) return;
+    const thread = readPhoneThread(chatId);
+    if (!thread) {
+      emitControl(opts, { op: "error", chatId, message: "That agent is not on this Mac." });
+      return;
+    }
+    if (thread.status === "running" || thread.status === "queued") {
+      try {
+        getOrchestrator().stop(thread.id, { clearQueue: true });
+      } catch {
+      }
+    }
+    if (chatGeneration.get(chatId) !== generation) return;
+    try {
+      try {
+        applyPhoneOptions(thread.id, cmd);
+      } catch (err) {
+        emitControl(opts, { op: "error", chatId, message: phoneError(err) });
+      }
+      const live = readPhoneThread(thread.id) ?? thread;
+      const staged = stagePhoneTurnFiles(live.worktreePath, cmd);
+      const text6 = cmd.text.trim() || (staged.length ? "See the attached files." : "");
+      const formatted = formatRemotePrompt(text6);
+      await getOrchestrator().send(thread.id, formatted, { attachments: staged });
+      await getOrchestrator().waitForTurn(thread.id, 14 * 60 * 1e3);
+    } catch (err) {
+      if (chatGeneration.get(chatId) !== generation) return;
+      const message = err instanceof Error ? err.message : String(err);
+      emitControl(opts, { op: "error", chatId, message: `Sideboard failed: ${message}` });
+      return;
+    }
+    if (chatGeneration.get(chatId) !== generation) return;
+    emitChatTurn(opts, chatId, thread.id);
+  });
+}
 function handleRemoteInbound(text6, opts) {
-  const generation = ++inboundGeneration;
   const log = opts.onLog ?? (() => void 0);
   const body = text6.trim();
+  const control = takePhoneControl(body);
+  if (control) {
+    if (control === "invalid") {
+      emitControl(opts, { op: "error", message: "invalid phone command" });
+      return;
+    }
+    handlePhoneControl(control, opts);
+    return;
+  }
+  const generation = ++inboundGeneration;
   if (body) interruptRemoteCoordinator(opts.deviceId, log);
   enqueue(async () => {
     if (generation !== inboundGeneration) return;
@@ -9505,7 +10376,8 @@ function runRemoteHost(opts) {
       type: "host_register",
       deviceId: opts.deviceId,
       deviceLabel,
-      hostSecret: opts.hostSecret
+      hostSecret: opts.hostSecret,
+      ...opts.accountToken?.trim() ? { accountToken: opts.accountToken.trim() } : {}
     });
   };
   const loop = async () => {
@@ -9621,7 +10493,8 @@ function runRemoteHost(opts) {
       handleRemoteInbound(msg.text, {
         deviceId: opts.deviceId,
         onLog: log,
-        onOutbound: emit
+        onOutbound: emit,
+        transcribeWav: opts.transcribeWav
       });
     }
   };
@@ -9648,6 +10521,606 @@ function runRemoteHost(opts) {
   };
 }
 
+// src/relay/account-login.ts
+import { randomBytes as randomBytes7 } from "crypto";
+
+// src/relay/accounts.ts
+import { createHash as createHash2, randomBytes as randomBytes6, randomUUID as randomUUID8, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, realpathSync } from "fs";
+import { createRequire } from "module";
+import { dirname, join as join6 } from "path";
+var GITHUB_ACCOUNT_ISSUER = "https://github.com";
+var RELAY_DEVICE_CAP = 3;
+function thisModuleFile() {
+  const cjsFile = typeof __filename !== "undefined" ? __filename : "";
+  return cjsFile || process.argv[1] || join6(process.cwd(), "package.json");
+}
+function openDatabase(filePath) {
+  const req = createRequire(thisModuleFile());
+  const specifier = "node:sqlite";
+  const { DatabaseSync: SqliteDatabase } = req(specifier);
+  const db = new SqliteDatabase(filePath);
+  db.exec("PRAGMA journal_mode = WAL");
+  return db;
+}
+function sha256(value) {
+  return createHash2("sha256").update(value).digest("hex");
+}
+function sameHash(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual2(left, right);
+}
+function normalizeEmail(email) {
+  const trimmed = email?.trim().toLowerCase() ?? "";
+  return trimmed || null;
+}
+function longestMountPoint(dir, mounts) {
+  let best = "/";
+  for (const line of mounts.split("\n")) {
+    const point = line.split(" ")[1]?.replace(/\\040/g, " ");
+    if (!point) continue;
+    if (dir === point || dir.startsWith(point.endsWith("/") ? point : `${point}/`)) {
+      if (point.length > best.length) best = point;
+    }
+  }
+  return best;
+}
+function assertRelayAccountsDurable(filePath) {
+  if (process.env.SIDEBOARD_RELAY_ACCOUNTS_EPHEMERAL === "1") return;
+  if (process.env.NODE_ENV !== "production") return;
+  if (process.platform !== "linux") return;
+  const dir = realpathSync(dirname(filePath));
+  const mounts = readFileSync5("/proc/mounts", "utf8");
+  const point = longestMountPoint(dir, mounts);
+  if (point === "/") {
+    throw new Error(
+      `Relay accounts at ${filePath} are on the machine root filesystem. Mount a Fly volume so sign-ins survive deploys.`
+    );
+  }
+}
+var RelayAccountStore = class {
+  db;
+  constructor(filePath) {
+    mkdirSync4(dirname(filePath), { recursive: true });
+    this.db = openDatabase(filePath);
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS accounts (
+        id TEXT PRIMARY KEY,
+        created_at INTEGER NOT NULL,
+        device_cap INTEGER NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS identities (
+        issuer TEXT NOT NULL,
+        subject TEXT NOT NULL,
+        account_id TEXT NOT NULL,
+        email TEXT,
+        email_verified INTEGER NOT NULL,
+        PRIMARY KEY (issuer, subject)
+      );
+      CREATE INDEX IF NOT EXISTS identities_email ON identities(email);
+      CREATE TABLE IF NOT EXISTS credentials (
+        token_hash TEXT PRIMARY KEY,
+        account_id TEXT NOT NULL,
+        created_at INTEGER NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS devices (
+        device_id TEXT PRIMARY KEY,
+        account_id TEXT NOT NULL,
+        host_secret_hash TEXT NOT NULL,
+        device_label TEXT NOT NULL,
+        created_at INTEGER NOT NULL
+      );
+    `);
+  }
+  close() {
+    this.db.close();
+  }
+  /**
+   * First sign-in creates an account. The same issuer+subject returns that
+   * account. A verified email match attaches a second provider. `linkAccountId`
+   * attaches while that account’s credential is already signed in.
+   * Each call mints a new Mac credential. Older credentials stay valid.
+   */
+  signIn(identity, linkAccountId) {
+    const issuer = identity.issuer.trim();
+    const subject = identity.subject.trim();
+    if (!issuer || !subject) throw new Error("Sign-in is missing an identity.");
+    const email = normalizeEmail(identity.email);
+    const verified = Boolean(identity.emailVerified && email);
+    const link = linkAccountId?.trim() || null;
+    this.db.exec("BEGIN");
+    try {
+      const existing = this.db.prepare("SELECT account_id, email FROM identities WHERE issuer = ? AND subject = ?").get(issuer, subject);
+      let accountId;
+      if (existing) {
+        if (link && link !== existing.account_id) {
+          throw new Error("That sign-in already belongs to another Sideboard account.");
+        }
+        accountId = existing.account_id;
+        this.requireAccount(accountId);
+        if (email) {
+          this.db.prepare("UPDATE identities SET email = ?, email_verified = ? WHERE issuer = ? AND subject = ?").run(email, verified ? 1 : 0, issuer, subject);
+        }
+      } else if (link) {
+        this.requireAccount(link);
+        accountId = link;
+        this.insertIdentity(issuer, subject, accountId, email, verified);
+      } else {
+        const byEmail = verified ? this.accountIdForVerifiedEmail(email) : void 0;
+        accountId = byEmail ?? randomUUID8();
+        if (!byEmail) {
+          this.db.prepare("INSERT INTO accounts (id, created_at, device_cap) VALUES (?, ?, ?)").run(accountId, Date.now(), RELAY_DEVICE_CAP);
+        }
+        this.insertIdentity(issuer, subject, accountId, email, verified);
+      }
+      const credential = this.mintCredential(accountId);
+      const stored = this.db.prepare("SELECT email FROM identities WHERE account_id = ? AND email IS NOT NULL ORDER BY email_verified DESC LIMIT 1").get(accountId);
+      this.db.exec("COMMIT");
+      return { accountId, credential, email: stored?.email ?? email };
+    } catch (err) {
+      this.db.exec("ROLLBACK");
+      throw err;
+    }
+  }
+  verifyCredential(token) {
+    const trimmed = token.trim();
+    if (!trimmed) return null;
+    const row = this.db.prepare("SELECT account_id FROM credentials WHERE token_hash = ?").get(sha256(trimmed));
+    return row?.account_id ?? null;
+  }
+  /** Drop one Mac credential. The account and its other Macs stay. */
+  logout(token) {
+    const trimmed = token.trim();
+    if (!trimmed) return;
+    this.db.prepare("DELETE FROM credentials WHERE token_hash = ?").run(sha256(trimmed));
+  }
+  /** Delete the account and every identity, credential, and Mac bound to it. */
+  revokeAccount(accountId) {
+    const id = accountId.trim();
+    if (!id) return;
+    this.db.exec("BEGIN");
+    try {
+      this.db.prepare("DELETE FROM devices WHERE account_id = ?").run(id);
+      this.db.prepare("DELETE FROM credentials WHERE account_id = ?").run(id);
+      this.db.prepare("DELETE FROM identities WHERE account_id = ?").run(id);
+      this.db.prepare("DELETE FROM accounts WHERE id = ?").run(id);
+      this.db.exec("COMMIT");
+    } catch (err) {
+      this.db.exec("ROLLBACK");
+      throw err;
+    }
+  }
+  /**
+   * Accept `host_register` for a signed-in account. The device row survives
+   * process restart, so a later register with a different host secret is rejected
+   * and a new device id counts against the cap.
+   */
+  authorizeHost(input) {
+    const deviceId = input.deviceId.trim();
+    const hostSecret = input.hostSecret.trim();
+    const deviceLabel = input.deviceLabel.trim() || "This Mac";
+    if (!deviceId || !hostSecret) return { ok: false, message: "sign in required" };
+    const accountId = this.verifyCredential(input.accountToken);
+    if (!accountId) return { ok: false, message: "sign in required" };
+    this.db.exec("BEGIN");
+    try {
+      const account = this.db.prepare("SELECT id, device_cap FROM accounts WHERE id = ?").get(accountId);
+      if (!account) {
+        this.db.exec("ROLLBACK");
+        return { ok: false, message: "sign in required" };
+      }
+      const device = this.db.prepare("SELECT device_id, account_id, host_secret_hash FROM devices WHERE device_id = ?").get(deviceId);
+      const secretHash = sha256(hostSecret);
+      if (!device) {
+        const count = this.db.prepare("SELECT COUNT(*) AS n FROM devices WHERE account_id = ?").get(accountId);
+        if (count.n >= account.device_cap) {
+          this.db.exec("ROLLBACK");
+          return { ok: false, message: "This account already has the maximum number of Macs." };
+        }
+        this.db.prepare(
+          "INSERT INTO devices (device_id, account_id, host_secret_hash, device_label, created_at) VALUES (?, ?, ?, ?, ?)"
+        ).run(deviceId, accountId, secretHash, deviceLabel, Date.now());
+        this.db.exec("COMMIT");
+        return { ok: true, accountId };
+      }
+      if (device.account_id !== accountId) {
+        this.db.exec("ROLLBACK");
+        return { ok: false, message: "This Mac is registered to another account." };
+      }
+      if (!sameHash(device.host_secret_hash, secretHash)) {
+        this.db.exec("ROLLBACK");
+        return { ok: false, message: "host secret rejected" };
+      }
+      this.db.prepare("UPDATE devices SET device_label = ? WHERE device_id = ?").run(deviceLabel, deviceId);
+      this.db.exec("COMMIT");
+      return { ok: true, accountId };
+    } catch (err) {
+      this.db.exec("ROLLBACK");
+      throw err;
+    }
+  }
+  requireAccount(accountId) {
+    const row = this.db.prepare("SELECT id FROM accounts WHERE id = ?").get(accountId);
+    if (!row) throw new Error("That Sideboard account is no longer on the relay.");
+  }
+  accountIdForVerifiedEmail(email) {
+    const row = this.db.prepare(
+      "SELECT account_id FROM identities WHERE email_verified = 1 AND email = ? LIMIT 1"
+    ).get(email);
+    return row?.account_id;
+  }
+  insertIdentity(issuer, subject, accountId, email, verified) {
+    this.db.prepare(
+      "INSERT INTO identities (issuer, subject, account_id, email, email_verified) VALUES (?, ?, ?, ?, ?)"
+    ).run(issuer, subject, accountId, email, verified ? 1 : 0);
+  }
+  mintCredential(accountId) {
+    const credential = randomBytes6(32).toString("hex");
+    this.db.prepare("INSERT INTO credentials (token_hash, account_id, created_at) VALUES (?, ?, ?)").run(sha256(credential), accountId, Date.now());
+    return credential;
+  }
+};
+
+// src/relay/account-oauth.ts
+var RELAY_GIT_HOSTS = ["github"];
+var REMOTE_LOGIN_PATH = "/remote/login";
+var REMOTE_OAUTH_CALLBACK_PATH = "/remote/oauth/callback";
+var REMOTE_OAUTH_RESULT_PATH = "/remote/oauth/result";
+var REMOTE_LOGOUT_PATH = "/remote/logout";
+var STATE_RE = /^[A-Za-z0-9_-]{16,128}$/;
+var LOGIN_TTL_MS = 10 * 60 * 1e3;
+var RelayLoginSessions = class {
+  waiting = /* @__PURE__ */ new Map();
+  results = /* @__PURE__ */ new Map();
+  begin(state, provider, accountId) {
+    this.sweep();
+    this.waiting.set(state, { provider, accountId, expiresAt: Date.now() + LOGIN_TTL_MS });
+  }
+  takeLogin(state) {
+    this.sweep();
+    const row = this.waiting.get(state);
+    if (!row) return null;
+    this.waiting.delete(state);
+    if (row.expiresAt < Date.now()) return null;
+    return row;
+  }
+  putResult(state, value) {
+    this.results.set(state, { value, expiresAt: Date.now() + LOGIN_TTL_MS });
+  }
+  /** `undefined` means the browser flow has not finished. */
+  takeResult(state) {
+    this.sweep();
+    const row = this.results.get(state);
+    if (!row) return this.waiting.has(state) ? void 0 : null;
+    this.results.delete(state);
+    if (row.expiresAt < Date.now()) return null;
+    return row.value;
+  }
+  sweep() {
+    const now = Date.now();
+    for (const [state, row] of this.waiting) {
+      if (row.expiresAt < now) this.waiting.delete(state);
+    }
+    for (const [state, row] of this.results) {
+      if (row.expiresAt < now) this.results.delete(state);
+    }
+  }
+};
+var GIT_HOST_AUTH = {
+  github: {
+    label: "GitHub",
+    authorizeUrl: "https://github.com/login/oauth/authorize",
+    scope: "user:email",
+    fetchIdentity: fetchGithubIdentity
+  }
+};
+function providerOf(value) {
+  return RELAY_GIT_HOSTS.includes(value) ? value : null;
+}
+function relayAuthorizeUrl(provider, client, redirectUri, state) {
+  const host = GIT_HOST_AUTH[provider];
+  const url = new URL(host.authorizeUrl);
+  url.searchParams.set("client_id", client.clientId);
+  url.searchParams.set("redirect_uri", redirectUri);
+  url.searchParams.set("scope", host.scope);
+  url.searchParams.set("state", state);
+  return url.toString();
+}
+async function readJson(res) {
+  const text6 = await res.text();
+  if (!text6) return {};
+  try {
+    return JSON.parse(text6);
+  } catch {
+    throw new Error("Sign-in provider returned a non-JSON response.");
+  }
+}
+function accessToken(body) {
+  const token = body.access_token;
+  if (typeof token !== "string" || !token.trim()) {
+    const message = body.error_description;
+    throw new Error(typeof message === "string" && message.trim() ? message : "Sign-in provider rejected the code.");
+  }
+  return token.trim();
+}
+async function fetchGithubIdentity(client, code, redirectUri, fetchImpl) {
+  const tokenRes = await fetchImpl("https://github.com/login/oauth/access_token", {
+    method: "POST",
+    headers: { Accept: "application/json", "Content-Type": "application/json" },
+    body: JSON.stringify({
+      client_id: client.clientId,
+      client_secret: client.clientSecret,
+      code,
+      redirect_uri: redirectUri
+    })
+  });
+  const token = accessToken(await readJson(tokenRes));
+  const userRes = await fetchImpl("https://api.github.com/user", {
+    headers: { Authorization: `Bearer ${token}`, Accept: "application/vnd.github+json", "User-Agent": "sideboard-relay" }
+  });
+  const user = await readJson(userRes);
+  const subject = typeof user.id === "number" ? String(user.id) : "";
+  if (!subject) throw new Error("GitHub did not return an account id.");
+  const emailRes = await fetchImpl("https://api.github.com/user/emails", {
+    headers: { Authorization: `Bearer ${token}`, Accept: "application/vnd.github+json", "User-Agent": "sideboard-relay" }
+  });
+  const emails = await readJson(emailRes);
+  const list = Array.isArray(emails) ? emails : [];
+  const primary = list.find((row) => row.primary === true && row.verified === true);
+  const anyVerified = list.find((row) => row.verified === true);
+  const chosen = primary ?? anyVerified;
+  const email = chosen && typeof chosen.email === "string" ? chosen.email : null;
+  return { issuer: GITHUB_ACCOUNT_ISSUER, subject, email, emailVerified: Boolean(email) };
+}
+async function fetchRelayIdentity(provider, client, code, redirectUri, fetchImpl) {
+  return GIT_HOST_AUTH[provider].fetchIdentity(client, code, redirectUri, fetchImpl);
+}
+async function readBody(req) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    size += buf.length;
+    if (size > 8192) throw new Error("body too large");
+    chunks.push(buf);
+  }
+  const text6 = Buffer.concat(chunks).toString("utf8").trim();
+  if (!text6) return {};
+  return JSON.parse(text6);
+}
+function sendJson2(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+  res.end(JSON.stringify(body));
+}
+function sendHtml(res, status, title, body) {
+  res.writeHead(status, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
+  res.end(`<!DOCTYPE html><html><head><meta charset="utf-8"><title>${escapeHtml(title)}</title></head><body>${body}</body></html>`);
+}
+async function handleRelayAccountHttp(opts) {
+  const reqUrl = opts.req.url || "/";
+  const path2 = reqUrl.split("?")[0];
+  const method = opts.req.method || "GET";
+  const origin = opts.publicOrigin.replace(/\/+$/, "");
+  const redirectUri = `${origin}${REMOTE_OAUTH_CALLBACK_PATH}`;
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  if (method === "POST" && path2 === REMOTE_LOGIN_PATH) {
+    let body;
+    try {
+      body = await readBody(opts.req);
+    } catch {
+      sendJson2(opts.res, 400, { ok: false, error: "invalid login request" });
+      return true;
+    }
+    const provider = providerOf(typeof body.provider === "string" ? body.provider : "");
+    const state = typeof body.state === "string" ? body.state.trim() : "";
+    if (!provider || !STATE_RE.test(state)) {
+      sendJson2(opts.res, 400, { ok: false, error: "invalid login request" });
+      return true;
+    }
+    const client = opts.oauth[provider];
+    if (!client?.clientId || !client.clientSecret) {
+      sendJson2(opts.res, 503, {
+        ok: false,
+        error: `${GIT_HOST_AUTH[provider].label} sign-in is not configured on this relay.`
+      });
+      return true;
+    }
+    let accountId = null;
+    const linkToken = typeof body.accountToken === "string" ? body.accountToken.trim() : "";
+    if (linkToken) {
+      accountId = opts.store.verifyCredential(linkToken);
+      if (!accountId) {
+        sendJson2(opts.res, 401, { ok: false, error: "sign in required" });
+        return true;
+      }
+    }
+    opts.sessions.begin(state, provider, accountId);
+    sendJson2(opts.res, 200, { ok: true, url: relayAuthorizeUrl(provider, client, redirectUri, state) });
+    return true;
+  }
+  if (method === "GET" && path2 === REMOTE_OAUTH_CALLBACK_PATH) {
+    const url = new URL(reqUrl, origin);
+    const state = url.searchParams.get("state")?.trim() ?? "";
+    const code = url.searchParams.get("code")?.trim() ?? "";
+    const providerError = url.searchParams.get("error")?.trim() ?? "";
+    const pending = STATE_RE.test(state) ? opts.sessions.takeLogin(state) : null;
+    if (!pending) {
+      sendHtml(opts.res, 400, "Sideboard", "<h1>Sign-in expired</h1><p>Return to Sideboard and try again.</p>");
+      return true;
+    }
+    if (providerError || !code) {
+      const message = providerError || "Sign-in was cancelled.";
+      opts.sessions.putResult(state, { ok: false, error: message });
+      sendHtml(opts.res, 400, "Sideboard", `<h1>Could not sign in</h1><p>${escapeHtml(message)}</p>`);
+      return true;
+    }
+    const client = opts.oauth[pending.provider];
+    if (!client) {
+      opts.sessions.putResult(state, { ok: false, error: "Sign-in is not configured on this relay." });
+      sendHtml(opts.res, 503, "Sideboard", "<h1>Sign-in is not configured</h1>");
+      return true;
+    }
+    try {
+      const identity = await fetchRelayIdentity(pending.provider, client, code, redirectUri, fetchImpl);
+      const signed = opts.store.signIn(identity, pending.accountId);
+      opts.sessions.putResult(state, {
+        ok: true,
+        credential: signed.credential,
+        email: signed.email,
+        accountId: signed.accountId
+      });
+      sendHtml(
+        opts.res,
+        200,
+        "Sideboard",
+        "<h1>Signed in</h1><p>Return to Sideboard. This window can close.</p>"
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      opts.sessions.putResult(state, { ok: false, error: message });
+      sendHtml(opts.res, 400, "Sideboard", `<h1>Could not sign in</h1><p>${escapeHtml(message)}</p>`);
+    }
+    return true;
+  }
+  if (method === "GET" && path2 === REMOTE_OAUTH_RESULT_PATH) {
+    const url = new URL(reqUrl, origin);
+    const state = url.searchParams.get("state")?.trim() ?? "";
+    if (!STATE_RE.test(state)) {
+      sendJson2(opts.res, 400, { ok: false, error: "invalid login request" });
+      return true;
+    }
+    const result = opts.sessions.takeResult(state);
+    if (result === void 0 || result === null) {
+      sendJson2(opts.res, 404, { ok: false, error: "pending" });
+      return true;
+    }
+    if (!result.ok) {
+      sendJson2(opts.res, 400, { ok: false, error: result.error });
+      return true;
+    }
+    sendJson2(opts.res, 200, {
+      ok: true,
+      credential: result.credential,
+      email: result.email,
+      accountId: result.accountId
+    });
+    return true;
+  }
+  if (method === "POST" && path2 === REMOTE_LOGOUT_PATH) {
+    let body;
+    try {
+      body = await readBody(opts.req);
+    } catch {
+      sendJson2(opts.res, 400, { ok: false, error: "invalid logout request" });
+      return true;
+    }
+    const token = typeof body.accountToken === "string" ? body.accountToken : "";
+    opts.store.logout(token);
+    sendJson2(opts.res, 200, { ok: true });
+    return true;
+  }
+  return false;
+}
+
+// src/relay/account-login.ts
+var RemoteAccountLoginCancelled = class extends Error {
+  constructor() {
+    super("Sign-in cancelled");
+    this.name = "RemoteAccountLoginCancelled";
+  }
+};
+function isRemoteAccountLoginCancelled(err) {
+  return err instanceof RemoteAccountLoginCancelled;
+}
+function remoteAccountHttpOrigin(wsUrl = remoteRelayUrl()) {
+  const url = new URL(wsUrl);
+  url.protocol = url.protocol === "wss:" ? "https:" : "http:";
+  url.pathname = "";
+  url.search = "";
+  url.hash = "";
+  return url.origin;
+}
+function sleep2(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(new RemoteAccountLoginCancelled());
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(new RemoteAccountLoginCancelled());
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function startRemoteAccountLogin(opts) {
+  if (opts.signal?.aborted) throw new RemoteAccountLoginCancelled();
+  const origin = (opts.origin ?? remoteAccountHttpOrigin()).replace(/\/+$/, "");
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const state = randomBytes7(16).toString("hex");
+  const timeoutMs = opts.timeoutMs ?? 5 * 6e4;
+  const pollIntervalMs = opts.pollIntervalMs ?? 400;
+  const linkToken = opts.linkToken?.trim() ?? "";
+  const started = await fetchImpl(`${origin}${REMOTE_LOGIN_PATH}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      provider: opts.provider,
+      state,
+      ...linkToken ? { accountToken: linkToken } : {}
+    })
+  });
+  const startBody = await started.json();
+  if (!started.ok || !startBody.url) {
+    throw new Error(startBody.error || "Could not start sign-in.");
+  }
+  await Promise.resolve(opts.openUrl?.(startBody.url));
+  const deadline = Date.now() + timeoutMs;
+  const resultUrl = `${origin}${REMOTE_OAUTH_RESULT_PATH}?state=${encodeURIComponent(state)}`;
+  while (Date.now() < deadline) {
+    if (opts.signal?.aborted) throw new RemoteAccountLoginCancelled();
+    let res;
+    try {
+      res = await fetchImpl(resultUrl);
+    } catch {
+      if (opts.signal?.aborted) throw new RemoteAccountLoginCancelled();
+      await sleep2(pollIntervalMs, opts.signal);
+      continue;
+    }
+    let data;
+    try {
+      data = await res.json();
+    } catch {
+      await sleep2(pollIntervalMs, opts.signal);
+      continue;
+    }
+    if (data.ok && data.credential && data.accountId) {
+      return {
+        credential: data.credential,
+        email: data.email ?? null,
+        accountId: data.accountId
+      };
+    }
+    if (data.error && data.error !== "pending") throw new Error(data.error);
+    await sleep2(pollIntervalMs, opts.signal);
+  }
+  throw new Error("Sign-in timed out.");
+}
+async function disconnectRemoteAccount(opts) {
+  const origin = (opts.origin ?? remoteAccountHttpOrigin()).replace(/\/+$/, "");
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  await fetchImpl(`${origin}${REMOTE_LOGOUT_PATH}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ accountToken: opts.accountToken })
+  });
+}
+
 // src/slack/app-home.ts
 var SLACK_APP_HOME_DOWNLOAD = "https://sideboard-downloads.t3.tigrisfiles.io/Sideboard-latest-arm64.dmg";
 var SLACK_APP_HOME_LANDING = "https://www.sideboard.cloud/slack/";
@@ -10104,14 +11577,19 @@ async function tryServeStatic(req, res, root) {
 }
 
 // src/relay/server.ts
-function sendHtml(res, status, title, body) {
+function sendHtml2(res, status, title, body) {
   res.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
   res.end(slackOAuthHtmlPage(title, body));
 }
-function sendJson2(res, status, body) {
+function sendJson3(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
+function relayClientIp(req) {
+  const fly = req.headers["fly-client-ip"];
+  if (typeof fly === "string" && fly.trim()) return fly.trim();
+  return req.socket.remoteAddress ?? "unknown";
+}
 function startRelaySocketPing(ws, intervalMs) {
   const ping = setInterval(() => {
     if (ws.readyState !== ws.OPEN) {
@@ -10139,11 +11617,26 @@ async function startRelayServer(opts) {
   const clientSecret = (opts.clientSecret ?? process.env.SIDEBOARD_SLACK_CLIENT_SECRET ?? "").trim();
   const redirectUri = (opts.oauthRedirectUri ?? slackOAuthRelayRedirectUri()).trim();
   const pending = new SlackOAuthPendingStore();
+  let boundPort = 0;
   const hub = opts.hub ?? new SlackRelayHub({
     fetchImpl: opts.fetchImpl ?? fetch,
     onLog: log
   });
-  const remoteHub = new RemoteHub();
+  const accountsPath = opts.accountsPath?.trim() ?? "";
+  if (accountsPath) assertRelayAccountsDurable(accountsPath);
+  const accountStore = accountsPath ? new RelayAccountStore(accountsPath) : null;
+  const accountSessions = new RelayLoginSessions();
+  const relayOAuth = opts.relayOAuth ?? {};
+  const authMarks = /* @__PURE__ */ new Map();
+  const remoteByIp = /* @__PURE__ */ new Map();
+  let remoteSockets = 0;
+  const remoteHub = new RemoteHub({
+    authorizeHost: accountStore ? (input) => {
+      const decision = accountStore.authorizeHost(input);
+      return decision.ok ? { ok: true } : { ok: false, message: decision.message };
+    } : void 0,
+    onAuthorized: (socket) => authMarks.get(socket)?.()
+  });
   const handleCallback = async (reqUrl, res) => {
     const url2 = parseSlackOAuthCallbackUrl(reqUrl);
     if (!url2) return false;
@@ -10152,7 +11645,7 @@ async function startRelayServer(opts) {
     const code = url2.searchParams.get("code")?.trim() ?? "";
     if (error) {
       if (state) pending.put(state, { ok: false, error: `Slack OAuth: ${error}` });
-      sendHtml(
+      sendHtml2(
         res,
         400,
         "Slack",
@@ -10161,7 +11654,7 @@ async function startRelayServer(opts) {
       return true;
     }
     if (!state || !code) {
-      sendHtml(res, 400, "Slack", "<h1>Invalid callback</h1><p>State or code missing.</p>");
+      sendHtml2(res, 400, "Slack", "<h1>Invalid callback</h1><p>State or code missing.</p>");
       return true;
     }
     if (!clientSecret) {
@@ -10169,7 +11662,7 @@ async function startRelayServer(opts) {
         ok: false,
         error: "Relay is missing SIDEBOARD_SLACK_CLIENT_SECRET"
       });
-      sendHtml(
+      sendHtml2(
         res,
         500,
         "Slack",
@@ -10192,7 +11685,7 @@ async function startRelayServer(opts) {
           void hub.handleAppHomeOpened(payload.team_id, payload.user_id);
         }
       }
-      sendHtml(
+      sendHtml2(
         res,
         200,
         "Slack connected",
@@ -10201,7 +11694,7 @@ async function startRelayServer(opts) {
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       pending.put(state, { ok: false, error: message });
-      sendHtml(res, 400, "Slack", `<h1>Could not connect Slack</h1><p>${escapeHtml(message)}</p>`);
+      sendHtml2(res, 400, "Slack", `<h1>Could not connect Slack</h1><p>${escapeHtml(message)}</p>`);
     }
     return true;
   };
@@ -10211,19 +11704,30 @@ async function startRelayServer(opts) {
     const state = url2.searchParams.get("state")?.trim() ?? "";
     const value = pending.take(state);
     if (!value) {
-      sendJson2(res, 404, { ok: false, error: "pending" });
+      sendJson3(res, 404, { ok: false, error: "pending" });
       return true;
     }
     if (!value.ok) {
-      sendJson2(res, 400, { ok: false, error: value.error });
+      sendJson3(res, 400, { ok: false, error: value.error });
       return true;
     }
-    sendJson2(res, 200, { ok: true, ...value.payload });
+    sendJson3(res, 200, { ok: true, ...value.payload });
     return true;
   };
   const httpServer = createServer3((req, res) => {
     void (async () => {
       const reqUrl = req.url || "/";
+      if (accountStore && await handleRelayAccountHttp({
+        req,
+        res,
+        store: accountStore,
+        oauth: relayOAuth,
+        sessions: accountSessions,
+        publicOrigin: opts.relayPublicOrigin?.trim() || process.env.SIDEBOARD_RELAY_PUBLIC_ORIGIN?.trim() || `http://127.0.0.1:${boundPort}`,
+        fetchImpl: opts.fetchImpl
+      })) {
+        return;
+      }
       if (await handleCallback(reqUrl, res)) return;
       if (handleResult(reqUrl, res)) return;
       const ableTimeBounce = ableTimeOAuthLocalBounceUrl(reqUrl);
@@ -10237,7 +11741,7 @@ async function startRelayServer(opts) {
         return;
       }
       if (req.url === "/health") {
-        sendJson2(res, 200, {
+        sendJson3(res, 200, {
           ok: true,
           service: "sideboard-relay",
           sessions: hub.listSessions().length,
@@ -10256,7 +11760,7 @@ async function startRelayServer(opts) {
         return;
       }
       if (req.url === "/") {
-        sendJson2(res, 200, {
+        sendJson3(res, 200, {
           ok: true,
           service: "sideboard-relay",
           sessions: hub.listSessions().length,
@@ -10283,6 +11787,14 @@ async function startRelayServer(opts) {
       socket.destroy();
       return;
     }
+    if (target === remoteWss) {
+      const ip = relayClientIp(req);
+      const count = remoteByIp.get(ip) ?? 0;
+      if (count >= 20 || remoteSockets >= 4e3) {
+        socket.destroy();
+        return;
+      }
+    }
     target.handleUpgrade(req, socket, head, (ws) => {
       target.emit("connection", ws, req);
     });
@@ -10317,7 +11829,10 @@ async function startRelayServer(opts) {
       hub.detachSocket(socket);
     });
   });
-  remoteWss.on("connection", (ws) => {
+  remoteWss.on("connection", (ws, req) => {
+    const ip = relayClientIp(req);
+    remoteByIp.set(ip, (remoteByIp.get(ip) ?? 0) + 1);
+    remoteSockets += 1;
     const socket = {
       send: (data) => {
         if (ws.readyState === ws.OPEN) ws.send(data);
@@ -10329,14 +11844,35 @@ async function startRelayServer(opts) {
         }
       }
     };
+    let released = false;
+    const authTimer = accountStore ? setTimeout(() => {
+      try {
+        ws.close(4001, "sign in required");
+      } catch {
+      }
+    }, 12e4) : null;
+    authMarks.set(socket, () => {
+      if (authTimer) clearTimeout(authTimer);
+    });
+    const release = () => {
+      if (released) return;
+      released = true;
+      if (authTimer) clearTimeout(authTimer);
+      authMarks.delete(socket);
+      remoteSockets -= 1;
+      const next = (remoteByIp.get(ip) ?? 1) - 1;
+      if (next <= 0) remoteByIp.delete(ip);
+      else remoteByIp.set(ip, next);
+      remoteHub.detachSocket(socket);
+    };
     startRelaySocketPing(ws, REMOTE_PING_INTERVAL_MS);
     log("remote client connected");
     ws.on("message", (data) => {
       const raw = typeof data === "string" ? data : data.toString("utf8");
       remoteHub.handleClientMessage(socket, raw);
     });
-    ws.on("close", () => remoteHub.detachSocket(socket));
-    ws.on("error", () => remoteHub.detachSocket(socket));
+    ws.on("close", release);
+    ws.on("error", release);
   });
   const port = opts.port ?? 0;
   const host = opts.host ?? "0.0.0.0";
@@ -10345,7 +11881,7 @@ async function startRelayServer(opts) {
     httpServer.listen(port, host, () => resolve());
   });
   const address = httpServer.address();
-  const boundPort = typeof address === "object" && address ? address.port : typeof port === "number" ? port : 0;
+  boundPort = typeof address === "object" && address ? address.port : typeof port === "number" ? port : 0;
   const url = `ws://${host === "0.0.0.0" ? "127.0.0.1" : host}:${boundPort}${SLACK_RELAY_DESKTOP_PATH}`;
   log(`relay listening on ${url}`);
   const ac = new AbortController();
@@ -10388,13 +11924,14 @@ async function startRelayServer(opts) {
         httpServer.close((err) => err ? reject(err) : resolve());
       });
       await socketModeDone.catch(() => void 0);
+      accountStore?.close();
     }
   };
 }
 
 // src/slack/outbound-watch.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
+import { join as join7 } from "path";
 var MAX_WATCHES = 40;
 var MAX_REPLIES_PER_WATCH = 30;
 var WATCH_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
@@ -10402,7 +11939,7 @@ var POLL_INTERVAL_MS = 12e3;
 var lastPollMs = 0;
 var nameCache = /* @__PURE__ */ new Map();
 function storePath3() {
-  return join6(appDataDir(), "slack-outbound-watch.json");
+  return join7(appDataDir(), "slack-outbound-watch.json");
 }
 function watchId(teamId, channelId, ts) {
   return `${teamId}:${channelId}:${ts}`;
@@ -10417,7 +11954,7 @@ function readStore3() {
   const path2 = storePath3();
   if (!existsSync5(path2)) return [];
   try {
-    const parsed = isSecureFileEncrypted(path2) ? readSecureJson(path2) : JSON.parse(readFileSync5(path2, "utf8"));
+    const parsed = isSecureFileEncrypted(path2) ? readSecureJson(path2) : JSON.parse(readFileSync6(path2, "utf8"));
     return Array.isArray(parsed?.watches) ? parsed.watches : [];
   } catch {
     return [];
@@ -10469,7 +12006,7 @@ async function continueSourceThread(threadId, prompt) {
       await continueOnReply(threadId, prompt);
       return;
     }
-    const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-K42IBMBE.js");
+    const { getOrchestrator: getOrchestrator2 } = await import("./orchestrator-QMKVXVUR.js");
     await getOrchestrator2().send(threadId, prompt);
   } catch {
   }
@@ -11061,6 +12598,7 @@ export {
   disconnectLinear,
   disconnectLinearConnection,
   disconnectOptionalService,
+  disconnectRemoteAccount,
   disconnectSlackWorkspace,
   discoverSkills,
   downloadAbleTimeAttachment,
@@ -11317,6 +12855,7 @@ export {
   isPrNotMergeableError,
   isPresentPlanToolName,
   isPrimaryCheckoutThread,
+  isRemoteAccountLoginCancelled,
   isRemoteStopCommand,
   isSelfWrittenRecord,
   isSessionQuotaLimit,
@@ -11678,6 +13217,7 @@ export {
   startMcpServer,
   startOrchestration,
   startRelayServer,
+  startRemoteAccountLogin,
   startSlackOAuth,
   statWorktreePath,
   stopAgentRpcServer,