@sideboard-ai/core 0.1.274 → 0.1.276

package/dist/index.cjs

@@ -1081,6 +1081,9 @@ function normalizeVault(raw) {
   if (typeof raw.remoteHostSecret === "string" && raw.remoteHostSecret.trim()) {
     out.remoteHostSecret = raw.remoteHostSecret.trim();
   }
+  if (typeof raw.remoteAccountToken === "string" && raw.remoteAccountToken.trim()) {
+    out.remoteAccountToken = raw.remoteAccountToken.trim();
+  }
   if (typeof raw.githubPat === "string" && raw.githubPat.trim()) {
     out.githubPat = raw.githubPat.trim();
   }
@@ -1777,7 +1780,8 @@ function emptyPublicIntegrations() {
     hasVercelToken: false,
     hasSupabaseToken: false,
     hasPosthogToken: false,
-    hasSentryToken: false
+    hasSentryToken: false,
+    hasRemoteAccount: false
   };
 }
 function hasLinearOAuth(integrations) {
@@ -1794,29 +1798,7 @@ function toPublicAppSettings(settings) {
     if (key.trim()) environment[key] = "";
   }
   const integrations = { ...settings.integrations };
-  const slackClientSecret = integrations.slackClientSecret;
-  const slackAppToken = integrations.slackAppToken;
-  const githubPat = integrations.githubPat;
-  const abletimeAccessToken = integrations.abletimeAccessToken;
-  const abletimeRefreshToken = integrations.abletimeRefreshToken;
-  const vercelToken = integrations.vercelToken;
-  const supabaseAccessToken = integrations.supabaseAccessToken;
-  const posthogPersonalApiKey = integrations.posthogPersonalApiKey;
-  const sentryAuthToken = integrations.sentryAuthToken;
-  delete integrations.linearApiKey;
-  delete integrations.linearAccessToken;
-  delete integrations.linearRefreshToken;
-  delete integrations.linearClientSecret;
-  delete integrations.slackClientSecret;
-  delete integrations.slackAppToken;
-  delete integrations.remoteHostSecret;
-  delete integrations.githubPat;
-  delete integrations.abletimeAccessToken;
-  delete integrations.abletimeRefreshToken;
-  delete integrations.vercelToken;
-  delete integrations.supabaseAccessToken;
-  delete integrations.posthogPersonalApiKey;
-  delete integrations.sentryAuthToken;
+  for (const key of INTEGRATION_VAULT_KEYS) delete integrations[key];
   return {
     ...settings,
     environment,
@@ -1824,15 +1806,18 @@ function toPublicAppSettings(settings) {
       ...integrations,
       hasLinearApiKey: hasLinearCredentials(settings.integrations),
       hasLinearOAuth: hasLinearOAuth(settings.integrations),
-      hasSlackClientSecret: Boolean(slackClientSecret?.trim()),
-      hasSlackAppToken: Boolean(slackAppToken?.trim()),
-      hasGithubPat: Boolean(githubPat?.trim()),
-      hasAbleTimeToken: Boolean(abletimeAccessToken?.trim() || abletimeRefreshToken?.trim()),
-      hasAbleTimeOAuth: Boolean(abletimeRefreshToken?.trim()),
-      hasVercelToken: Boolean(vercelToken?.trim()),
-      hasSupabaseToken: Boolean(supabaseAccessToken?.trim()),
-      hasPosthogToken: Boolean(posthogPersonalApiKey?.trim()),
-      hasSentryToken: Boolean(sentryAuthToken?.trim())
+      hasSlackClientSecret: Boolean(settings.integrations.slackClientSecret?.trim()),
+      hasSlackAppToken: Boolean(settings.integrations.slackAppToken?.trim()),
+      hasGithubPat: Boolean(settings.integrations.githubPat?.trim()),
+      hasAbleTimeToken: Boolean(
+        settings.integrations.abletimeAccessToken?.trim() || settings.integrations.abletimeRefreshToken?.trim()
+      ),
+      hasAbleTimeOAuth: Boolean(settings.integrations.abletimeRefreshToken?.trim()),
+      hasVercelToken: Boolean(settings.integrations.vercelToken?.trim()),
+      hasSupabaseToken: Boolean(settings.integrations.supabaseAccessToken?.trim()),
+      hasPosthogToken: Boolean(settings.integrations.posthogPersonalApiKey?.trim()),
+      hasSentryToken: Boolean(settings.integrations.sentryAuthToken?.trim()),
+      hasRemoteAccount: Boolean(settings.integrations.remoteAccountToken?.trim())
     }
   };
 }
@@ -1959,6 +1944,14 @@ function normalizeIntegrations(raw) {
     const secret = source.remoteHostSecret.trim();
     if (secret) out.remoteHostSecret = secret;
   }
+  if (typeof source.remoteAccountToken === "string") {
+    const token = source.remoteAccountToken.trim();
+    if (token) out.remoteAccountToken = token;
+  }
+  if (typeof source.remoteAccountEmail === "string") {
+    const email = source.remoteAccountEmail.trim().toLowerCase();
+    if (email) out.remoteAccountEmail = email;
+  }
   if (typeof source.githubGitAuthMode === "string" && GIT_AUTH_MODES.has(source.githubGitAuthMode)) {
     out.githubGitAuthMode = source.githubGitAuthMode;
   }
@@ -2302,110 +2295,31 @@ function readSettingsFile() {
   }
 }
 function diskHoldsSecrets(disk) {
-  return Boolean(
-    disk.integrations.linearApiKey || disk.integrations.linearAccessToken || disk.integrations.linearRefreshToken || disk.integrations.linearClientSecret || disk.integrations.slackClientSecret || disk.integrations.slackAppToken || disk.integrations.remoteHostSecret || disk.integrations.githubPat || disk.integrations.abletimeAccessToken || disk.integrations.abletimeRefreshToken || disk.integrations.vercelToken || disk.integrations.supabaseAccessToken || disk.integrations.posthogPersonalApiKey || disk.integrations.sentryAuthToken || Object.keys(disk.environment).length > 0
-  );
+  return INTEGRATION_VAULT_KEYS.some((key) => Boolean(disk.integrations[key])) || Object.keys(disk.environment).length > 0;
 }
 function mergeVault(disk) {
   const vault = loadSecretVault();
   const environment = { ...vault.environment ?? {}, ...disk.environment };
   const integrations = { ...disk.integrations };
-  if (vault.linearApiKey && !integrations.linearApiKey) {
-    integrations.linearApiKey = vault.linearApiKey;
-  }
-  if (vault.linearAccessToken && !integrations.linearAccessToken) {
-    integrations.linearAccessToken = vault.linearAccessToken;
-  }
-  if (vault.linearRefreshToken && !integrations.linearRefreshToken) {
-    integrations.linearRefreshToken = vault.linearRefreshToken;
-  }
-  if (vault.linearClientSecret && !integrations.linearClientSecret) {
-    integrations.linearClientSecret = vault.linearClientSecret;
-  }
-  if (vault.slackClientSecret && !integrations.slackClientSecret) {
-    integrations.slackClientSecret = vault.slackClientSecret;
-  }
-  if (vault.slackAppToken && !integrations.slackAppToken) {
-    integrations.slackAppToken = vault.slackAppToken;
-  }
-  if (vault.remoteHostSecret && !integrations.remoteHostSecret) {
-    integrations.remoteHostSecret = vault.remoteHostSecret;
-  }
-  if (vault.githubPat && !integrations.githubPat) {
-    integrations.githubPat = vault.githubPat;
-  }
-  if (vault.abletimeAccessToken && !integrations.abletimeAccessToken) {
-    integrations.abletimeAccessToken = vault.abletimeAccessToken;
-  }
-  if (vault.abletimeRefreshToken && !integrations.abletimeRefreshToken) {
-    integrations.abletimeRefreshToken = vault.abletimeRefreshToken;
-  }
-  if (vault.vercelToken && !integrations.vercelToken) {
-    integrations.vercelToken = vault.vercelToken;
-  }
-  if (vault.supabaseAccessToken && !integrations.supabaseAccessToken) {
-    integrations.supabaseAccessToken = vault.supabaseAccessToken;
-  }
-  if (vault.posthogPersonalApiKey && !integrations.posthogPersonalApiKey) {
-    integrations.posthogPersonalApiKey = vault.posthogPersonalApiKey;
-  }
-  if (vault.sentryAuthToken && !integrations.sentryAuthToken) {
-    integrations.sentryAuthToken = vault.sentryAuthToken;
+  for (const key of INTEGRATION_VAULT_KEYS) {
+    const stored = vault[key];
+    if (stored && !integrations[key]) integrations[key] = stored;
   }
   return { ...disk, environment, integrations };
 }
 function persistSplit(settings) {
   const integrations = { ...settings.integrations };
-  const linearApiKey = integrations.linearApiKey;
-  const linearAccessToken = integrations.linearAccessToken;
-  const linearRefreshToken = integrations.linearRefreshToken;
-  const linearClientSecret = integrations.linearClientSecret;
-  const slackClientSecret = integrations.slackClientSecret;
-  const slackAppToken = integrations.slackAppToken;
-  const remoteHostSecret = integrations.remoteHostSecret;
-  const githubPat = integrations.githubPat;
-  const abletimeAccessToken = integrations.abletimeAccessToken;
-  const abletimeRefreshToken = integrations.abletimeRefreshToken;
-  const vercelToken = integrations.vercelToken;
-  const supabaseAccessToken = integrations.supabaseAccessToken;
-  const posthogPersonalApiKey = integrations.posthogPersonalApiKey;
-  const sentryAuthToken = integrations.sentryAuthToken;
-  delete integrations.linearApiKey;
-  delete integrations.linearAccessToken;
-  delete integrations.linearRefreshToken;
-  delete integrations.linearClientSecret;
-  delete integrations.slackClientSecret;
-  delete integrations.slackAppToken;
-  delete integrations.remoteHostSecret;
-  delete integrations.githubPat;
-  delete integrations.abletimeAccessToken;
-  delete integrations.abletimeRefreshToken;
-  delete integrations.vercelToken;
-  delete integrations.supabaseAccessToken;
-  delete integrations.posthogPersonalApiKey;
-  delete integrations.sentryAuthToken;
+  const vault = { environment: settings.environment };
+  for (const key of INTEGRATION_VAULT_KEYS) {
+    vault[key] = integrations[key];
+    delete integrations[key];
+  }
   writePrivateFile(
     appSettingsPath(),
     `${JSON.stringify({ ...settings, environment: {}, integrations }, null, 2)}
 `
   );
-  saveSecretVault({
-    linearApiKey,
-    linearAccessToken,
-    linearRefreshToken,
-    linearClientSecret,
-    slackClientSecret,
-    slackAppToken,
-    remoteHostSecret,
-    githubPat,
-    abletimeAccessToken,
-    abletimeRefreshToken,
-    vercelToken,
-    supabaseAccessToken,
-    posthogPersonalApiKey,
-    sentryAuthToken,
-    environment: settings.environment
-  });
+  saveSecretVault(vault);
 }
 function loadAppSettings() {
   const disk = readSettingsFile();
@@ -2616,6 +2530,20 @@ function updateIntegrationsSettings(patch) {
       integrations.remoteHostSecret = patch.remoteHostSecret.trim();
     }
   }
+  if ("remoteAccountToken" in patch) {
+    if (patch.remoteAccountToken == null || patch.remoteAccountToken.trim() === "") {
+      delete integrations.remoteAccountToken;
+    } else {
+      integrations.remoteAccountToken = patch.remoteAccountToken.trim();
+    }
+  }
+  if ("remoteAccountEmail" in patch) {
+    if (patch.remoteAccountEmail == null || patch.remoteAccountEmail.trim() === "") {
+      delete integrations.remoteAccountEmail;
+    } else {
+      integrations.remoteAccountEmail = patch.remoteAccountEmail.trim().toLowerCase();
+    }
+  }
   if ("githubGitAuthMode" in patch) {
     if (patch.githubGitAuthMode == null) {
       delete integrations.githubGitAuthMode;
@@ -3354,7 +3282,7 @@ function childEnvWithAppSettings(extra) {
 function harnessEnvKey(harness) {
   return HARNESS_ENV_KEYS[harness];
 }
-var import_node_crypto2, import_node_fs9, import_node_os4, import_node_path10, HARNESS_ENV_KEYS, DEFAULT_AGENTS, GITHUB_GIT_AUTH_MODES, FOLLOW_UP_BEHAVIORS, AGENT_DONE_SOUNDS, CHAT_TEXT_SCALES, CHAT_TEXT_SCALE_DEFAULT, CLOUD_CONNECT_AGENTS, ISSUE_SOURCES, GIT_AUTH_MODES, REVIEW_LABEL_MAX, EMPTY_SETTINGS, CONFIRM_ACCOUNT, CONFIRM_PROJECT, DEFAULT_CLI_BIN;
+var import_node_crypto2, import_node_fs9, import_node_os4, import_node_path10, HARNESS_ENV_KEYS, DEFAULT_AGENTS, GITHUB_GIT_AUTH_MODES, FOLLOW_UP_BEHAVIORS, AGENT_DONE_SOUNDS, CHAT_TEXT_SCALES, CHAT_TEXT_SCALE_DEFAULT, INTEGRATION_VAULT_KEYS, CLOUD_CONNECT_AGENTS, ISSUE_SOURCES, GIT_AUTH_MODES, REVIEW_LABEL_MAX, EMPTY_SETTINGS, CONFIRM_ACCOUNT, CONFIRM_PROJECT, DEFAULT_CLI_BIN;
 var init_app_settings = __esm({
   "src/store/app-settings.ts"() {
     "use strict";
@@ -3407,6 +3335,23 @@ var init_app_settings = __esm({
     ];
     CHAT_TEXT_SCALES = [1.2, 1.4];
     CHAT_TEXT_SCALE_DEFAULT = 1.2;
+    INTEGRATION_VAULT_KEYS = [
+      "linearApiKey",
+      "linearAccessToken",
+      "linearRefreshToken",
+      "linearClientSecret",
+      "slackClientSecret",
+      "slackAppToken",
+      "remoteHostSecret",
+      "remoteAccountToken",
+      "githubPat",
+      "abletimeAccessToken",
+      "abletimeRefreshToken",
+      "vercelToken",
+      "supabaseAccessToken",
+      "posthogPersonalApiKey",
+      "sentryAuthToken"
+    ];
     CLOUD_CONNECT_AGENTS = /* @__PURE__ */ new Set([
       "claude",
       "codex",
@@ -18515,7 +18460,7 @@ function lastRequestOccupancy(thread) {
 function shouldResetSessionForOccupancy(thread, occupancyTokens = SESSION_RESET_OCCUPANCY_TOKENS) {
   return lastRequestOccupancy(thread) >= occupancyTokens;
 }
-async function maybeCompactContext(thread, thresholds = {}, summarize = summarizeConversation) {
+async function maybeCompactContext(thread, thresholds = {}, summarize2 = summarizeConversation) {
   if (!shouldCompactContext(thread.messages, thresholds)) {
     return { didCompact: false, thread };
   }
@@ -18524,7 +18469,7 @@ async function maybeCompactContext(thread, thresholds = {}, summarize = summariz
     return { didCompact: false, thread };
   }
   const transcript = formatMessagesAsTranscript(older, { tools: "summary" });
-  const { summary, method } = await summarize(transcript, {
+  const { summary, method } = await summarize2(transcript, {
     cwd: thread.worktreePath
   });
   let messages = applyCompaction(thread.messages, summary, thresholds);
@@ -19213,17 +19158,7 @@ var init_worktree_run_ports = __esm({
   }
 });
 
-// src/mcp/wait-for-job.ts
-function mcpWaitForJobTimeoutMs(requested) {
-  return mcpWaitForTurnTimeoutMs(requested);
-}
-function sanitizeDetachedJobId(id) {
-  const s = id.trim();
-  if (!JOB_ID_RE.test(s)) {
-    throw new Error(`detached-job id must be 1\u201364 chars [A-Za-z0-9._-], got ${JSON.stringify(id)}`);
-  }
-  return s;
-}
+// src/mcp/job-process.ts
 function jobAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
   try {
@@ -19247,6 +19182,23 @@ function jobTreeAlive(pid) {
   if (pid == null) return false;
   return jobAlive(pid) || processGroupAlive(pid);
 }
+var init_job_process = __esm({
+  "src/mcp/job-process.ts"() {
+    "use strict";
+  }
+});
+
+// src/mcp/wait-for-job.ts
+function mcpWaitForJobTimeoutMs(requested) {
+  return mcpWaitForTurnTimeoutMs(requested);
+}
+function sanitizeDetachedJobId(id) {
+  const s = id.trim();
+  if (!JOB_ID_RE.test(s)) {
+    throw new Error(`detached-job id must be 1\u201364 chars [A-Za-z0-9._-], got ${JSON.stringify(id)}`);
+  }
+  return s;
+}
 function readIntFile(file) {
   if (!(0, import_node_fs50.existsSync)(file)) return null;
   const n = Number.parseInt((0, import_node_fs50.readFileSync)(file, "utf8").trim(), 10);
@@ -19430,7 +19382,7 @@ async function waitForDetachedJob(cwd, id, opts) {
   const root = cwd.trim() || process.cwd();
   const dir = resolveJobDir(root, jobId);
   const timeoutMs = mcpWaitForJobTimeoutMs(opts?.timeoutMs);
-  const sleep2 = opts?.sleep ?? sleepMs;
+  const sleep3 = opts?.sleep ?? sleepMs;
   if (!(0, import_node_fs50.existsSync)(dir)) {
     return {
       stillRunning: false,
@@ -19456,7 +19408,7 @@ async function waitForDetachedJob(cwd, id, opts) {
     snap = snapshotJob(dir);
     if (snap.exitCode === 0 && !snap.running) return toResult(jobId, snap);
     if (!snap.running) return toResult(jobId, snap, { failed: true });
-    await sleep2(Math.min(2e3, Math.max(50, deadline - Date.now())));
+    await sleep3(Math.min(2e3, Math.max(50, deadline - Date.now())));
   }
   snap = snapshotJob(dir);
   return toResult(jobId, snap);
@@ -19488,7 +19440,7 @@ async function stopDetachedJob(cwd, id, opts) {
   const jobId = sanitizeDetachedJobId(id);
   const root = cwd.trim() || process.cwd();
   const dir = resolveJobDir(root, jobId);
-  const sleep2 = opts?.sleep ?? sleepMs;
+  const sleep3 = opts?.sleep ?? sleepMs;
   const why = opts?.reason?.trim() ?? "";
   if (!(0, import_node_fs50.existsSync)(dir)) {
     return {
@@ -19520,11 +19472,11 @@ async function stopDetachedJob(cwd, id, opts) {
   const graceMs = Number.isFinite(opts?.graceMs) ? Math.max(50, opts.graceMs) : 2e3;
   const deadline = Date.now() + graceMs;
   while (Date.now() < deadline && jobTreeAlive(targetPid)) {
-    await sleep2(Math.min(100, Math.max(20, deadline - Date.now())));
+    await sleep3(Math.min(100, Math.max(20, deadline - Date.now())));
   }
   if (targetPid != null) {
     killProcessTree(targetPid, "SIGKILL");
-    await sleep2(100);
+    await sleep3(100);
   }
   const exitFile = (0, import_node_path50.join)(dir, "exit");
   if (!(0, import_node_fs50.existsSync)(exitFile)) {
@@ -19556,6 +19508,7 @@ var init_wait_for_job = __esm({
     import_node_fs50 = require("fs");
     import_node_path50 = require("path");
     init_workspace_scratch();
+    init_job_process();
     init_wait_for_turn();
     MAX_JOB_CONTINUES = 8;
     MAX_JOB_DELTA_LINES = 80;
@@ -26890,7 +26843,8 @@ var init_orchestrator = __esm({
             throw new Error(`Thread is archived: ${thread.id}`);
           }
           const followUp = resolveSendFollowUp(current, opts?.followUp);
-          const consumed = consumeComposerAttachments(current);
+          const explicit = opts?.attachments;
+          const consumed = explicit !== void 0 ? { attachments: current.attachments, consumed: explicit } : consumeComposerAttachments(current);
           const queued = appendQueuedItem(
             current.queue,
             current.queueAttachments,
@@ -26904,7 +26858,7 @@ var init_orchestrator = __esm({
           const inFlight = this.activeTurns.has(thread.id) || this.startingTurns.has(thread.id) || current.status === "running";
           shouldSteer = followUp === "steer" && (inFlight || current.queue.length > 0);
           const patch = queued;
-          if (consumed.consumed.length > 0) {
+          if (explicit === void 0 && consumed.consumed.length > 0) {
             patch.attachments = consumed.attachments;
           }
           if (!inFlight) patch.status = "queued";
@@ -29393,6 +29347,7 @@ __export(index_exports, {
   disconnectLinear: () => disconnectLinear,
   disconnectLinearConnection: () => disconnectLinearConnection,
   disconnectOptionalService: () => disconnectOptionalService,
+  disconnectRemoteAccount: () => disconnectRemoteAccount,
   disconnectSlackWorkspace: () => disconnectSlackWorkspace,
   discoverSkills: () => discoverSkills,
   downloadAbleTimeAttachment: () => downloadAbleTimeAttachment,
@@ -29649,6 +29604,7 @@ __export(index_exports, {
   isPrNotMergeableError: () => isPrNotMergeableError,
   isPresentPlanToolName: () => isPresentPlanToolName,
   isPrimaryCheckoutThread: () => isPrimaryCheckoutThread,
+  isRemoteAccountLoginCancelled: () => isRemoteAccountLoginCancelled,
   isRemoteStopCommand: () => isRemoteStopCommand,
   isSelfWrittenRecord: () => isSelfWrittenRecord,
   isSessionQuotaLimit: () => isSessionQuotaLimit,
@@ -30010,6 +29966,7 @@ __export(index_exports, {
   startMcpServer: () => startMcpServer,
   startOrchestration: () => startOrchestration,
   startRelayServer: () => startRelayServer,
+  startRemoteAccountLogin: () => startRemoteAccountLogin,
   startSlackOAuth: () => startSlackOAuth,
   statWorktreePath: () => statWorktreePath,
   stopAgentRpcServer: () => stopAgentRpcServer,
@@ -30543,12 +30500,12 @@ async function persistLinearTokens(data, viewer) {
     organizationName: viewer?.organizationName
   });
 }
-async function fetchLinearViewer(accessToken) {
+async function fetchLinearViewer(accessToken2) {
   const res = await httpFetch(LINEAR_GRAPHQL, {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
-      Authorization: linearAuthorizationHeader(accessToken)
+      Authorization: linearAuthorizationHeader(accessToken2)
     },
     body: JSON.stringify({
       query: "{ viewer { name organization { name } } }"
@@ -38389,7 +38346,14 @@ function parseRemoteClientMessage(raw) {
     const hostSecret = str5(parsed.hostSecret);
     const deviceLabel = str5(parsed.deviceLabel);
     if (!deviceId || !hostSecret || !deviceLabel) return null;
-    return { type: "host_register", deviceId, hostSecret, deviceLabel };
+    const accountToken = str5(parsed.accountToken);
+    return {
+      type: "host_register",
+      deviceId,
+      hostSecret,
+      deviceLabel,
+      ...accountToken ? { accountToken } : {}
+    };
   }
   if (msg.type === "pair") {
     const code = str5(parsed.code).toUpperCase();
@@ -38518,6 +38482,10 @@ function newCode() {
   return code;
 }
 var RemoteHub = class {
+  constructor(opts = {}) {
+    this.opts = opts;
+  }
+  opts;
   hosts = /* @__PURE__ */ new Map();
   remembered = /* @__PURE__ */ new Map();
   bySocket = /* @__PURE__ */ new Map();
@@ -38556,7 +38524,7 @@ var RemoteHub = class {
   }
   dispatch(socket, msg) {
     if (msg.type === "host_register") {
-      this.registerHost(socket, msg.deviceId, msg.deviceLabel, msg.hostSecret);
+      this.registerHost(socket, msg.deviceId, msg.deviceLabel, msg.hostSecret, msg.accountToken ?? "");
       return;
     }
     if (msg.type === "host_pair") {
@@ -38583,7 +38551,14 @@ var RemoteHub = class {
       this.fromHost(socket, msg);
     }
   }
-  registerHost(socket, deviceId, deviceLabel, hostSecret) {
+  registerHost(socket, deviceId, deviceLabel, hostSecret, accountToken) {
+    if (this.opts.authorizeHost) {
+      const decision = this.opts.authorizeHost({ accountToken, deviceId, deviceLabel, hostSecret });
+      if (!decision.ok) {
+        send2(socket, { type: "error", message: decision.message });
+        return;
+      }
+    }
     const prior = this.remembered.get(deviceId);
     const existing = this.hosts.get(deviceId);
     if (prior && prior.hostSecret !== hostSecret || existing && existing.hostSecret !== hostSecret) {
@@ -38615,6 +38590,7 @@ var RemoteHub = class {
     this.bySocket.set(socket, { role: "host", deviceId });
     send2(socket, { type: "registered", deviceId, deviceLabel });
     if (host.phone) send2(socket, { type: "phone_joined" });
+    this.opts.onAuthorized?.(socket);
   }
   issueCode(socket) {
     const bound = this.bySocket.get(socket);
@@ -38676,6 +38652,7 @@ var RemoteHub = class {
         online: Boolean(host)
       };
     });
+    if (hosts.some((host) => host.deviceId)) this.opts.onAuthorized?.(socket);
     send2(socket, { type: "hosts", hosts });
   }
   releasePhoneSocket(socket) {
@@ -38715,6 +38692,7 @@ var RemoteHub = class {
       deviceLabel: host.deviceLabel
     });
     this.bySocket.set(socket, { role: "phone", deviceId: host.deviceId });
+    this.opts.onAuthorized?.(socket);
     send2(socket, {
       type: "paired",
       deviceId: host.deviceId,
@@ -38753,11 +38731,802 @@ var import_ws5 = require("ws");
 
 // src/remote/listen.ts
 init_orchestrator_capable();
+init_stage_files();
 init_orchestrator();
 init_app_settings();
 init_global_workspace();
 init_thread_store();
+init_implied_first_prompt();
+
+// src/remote/phone-media.ts
+init_diff();
+var PHONE_IMAGE_MAX_BYTES = 15e5;
+var IMAGE_MIME = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  bmp: "image/bmp"
+};
+function phoneWorktreeRelative(worktreePath, raw) {
+  let text6 = raw.trim();
+  if (!text6) return null;
+  if (/^file:\/\//i.test(text6)) {
+    try {
+      text6 = decodeURIComponent(new URL(text6).pathname);
+    } catch {
+      return null;
+    }
+  }
+  text6 = (text6.split("#")[0] ?? text6).replace(/\\/g, "/");
+  if (!text6 || text6.includes("\0") || text6.split("/").includes("..")) return null;
+  const root = worktreePath.replace(/\/+$/, "");
+  if (!root || root === "/") return null;
+  if (text6.startsWith("/")) {
+    if (text6 !== root && !text6.startsWith(`${root}/`)) return null;
+    text6 = text6 === root ? "" : text6.slice(root.length + 1);
+  }
+  text6 = text6.replace(/^\.\//, "").replace(/\/+$/, "");
+  if (!text6 || text6 === "." || text6.startsWith("/")) return null;
+  return text6;
+}
+function phoneImageMime(relativePath) {
+  const ext = relativePath.split(".").pop()?.toLowerCase() ?? "";
+  return IMAGE_MIME[ext] ?? null;
+}
+function phoneImageDataUrl(worktreePath, raw) {
+  const relative = phoneWorktreeRelative(worktreePath, raw);
+  if (!relative) return null;
+  const mime = phoneImageMime(relative);
+  if (!mime) return null;
+  try {
+    const file = readWorktreeFileForUpload(worktreePath, relative, { maxBytes: PHONE_IMAGE_MAX_BYTES });
+    return `data:${mime};base64,${file.contentBase64}`;
+  } catch {
+    return null;
+  }
+}
+
+// src/remote/phone-chats.ts
+var import_node_crypto25 = require("crypto");
+init_list_models();
+init_home_board();
+init_stage_files();
+init_worktree_labels();
+init_thinking_effort();
+init_app_settings();
+init_global_workspace();
+init_thread_store();
+init_workspaces();
+init_chat_tabs();
+init_create();
+init_orchestrator();
+var PHONE_CONTROL_PREFIX = "\0sb.phone\n";
+var PHONE_USER_PREFIX = "Phone\n\n";
+var TRANSCRIPT_LIMIT = 40;
+var MESSAGE_LIMIT = 4e3;
+var PREVIEW_LIMIT = 90;
+var HISTORY_PAGE_SIZE = 40;
+var AGENT_KINDS = /* @__PURE__ */ new Set(["claude", "codex", "opencode", "brightsy", "cursor"]);
+var MAX_PHONE_FILES = 8;
+var MAX_PHONE_FILE_CHARS = Math.ceil(8 * 1024 * 1024 * 4 / 3);
+var MAX_PHONE_FILES_CHARS = Math.ceil(20 * 1024 * 1024 * 4 / 3);
+var MAX_DICTATION_CHARS = Math.ceil(12 * 1024 * 1024 * 4 / 3);
+function encodePhoneControl(payload) {
+  return PHONE_CONTROL_PREFIX + JSON.stringify(payload);
+}
+function takePhoneControl(text6) {
+  if (!text6.startsWith(PHONE_CONTROL_PREFIX)) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(text6.slice(PHONE_CONTROL_PREFIX.length));
+  } catch {
+    return "invalid";
+  }
+  return parsePhoneControl(parsed);
+}
+function parsePhoneControl(value) {
+  if (!value || typeof value !== "object") return "invalid";
+  const op = value.op;
+  if (op === "list") return { op: "list" };
+  if (op === "history") {
+    const query = textField(value, "query");
+    const after = textField(value, "after");
+    return { op: "history", ...query ? { query } : {}, ...after ? { after } : {} };
+  }
+  if (op === "sources") {
+    const repoPath = textField(value, "repoPath");
+    if (!repoPath || !isProjectPath(repoPath)) return "invalid";
+    const query = textField(value, "query");
+    return { op: "sources", repoPath, ...query ? { query } : {} };
+  }
+  if (op === "models") {
+    const agent = agentField(value);
+    if (!agent) return "invalid";
+    return { op: "models", agent };
+  }
+  if (op === "dictate") {
+    const id = textField(value, "id");
+    const audioBase64 = base64Field(value, "audioBase64");
+    if (!id || !audioBase64 || audioBase64.length > MAX_DICTATION_CHARS) return "invalid";
+    return { op: "dictate", id, audioBase64 };
+  }
+  if (op === "create") return parsePhoneCreate(value);
+  const chatId = typeof value.chatId === "string" ? value.chatId.trim() : "";
+  if (!chatId) return "invalid";
+  if (op === "open" || op === "archive" || op === "restore" || op === "stop") return { op, chatId };
+  if (op === "open-file" || op === "media") {
+    const path2 = textField(value, "path");
+    if (!path2 || path2.length > 2e3) return "invalid";
+    if (op === "media") return { op, chatId, path: path2 };
+    const startLine = lineField(value, "startLine");
+    const endLine = lineField(value, "endLine");
+    return {
+      op,
+      chatId,
+      path: path2,
+      ...startLine != null ? { startLine } : {},
+      ...endLine != null ? { endLine } : {}
+    };
+  }
+  const draft = parsePhoneDraft(value);
+  if (draft === "invalid") return "invalid";
+  if (op === "options") return { op: "options", chatId, ...draft };
+  if (op === "prompt") {
+    const text6 = typeof value.text === "string" ? value.text.trim() : "";
+    const hasPayload = Boolean(text6 || draft.files?.length || draft.links?.length);
+    if (!hasPayload) return "invalid";
+    return { op: "prompt", chatId, text: text6, ...draft };
+  }
+  return "invalid";
+}
+function textField(value, key) {
+  const raw = value[key];
+  return typeof raw === "string" ? raw.trim() : "";
+}
+function lineField(value, key) {
+  const raw = value[key];
+  if (typeof raw !== "number" || !Number.isInteger(raw) || raw < 1 || raw > 1e6) return void 0;
+  return raw;
+}
+function agentField(value) {
+  const agent = textField(value, "agent");
+  if (!agent) return void 0;
+  return AGENT_KINDS.has(agent) ? agent : void 0;
+}
+function base64Field(value, key) {
+  const raw = value[key];
+  if (typeof raw !== "string") return "";
+  return raw.replace(/\s/g, "");
+}
+function parsePhoneDraft(value) {
+  const draft = {};
+  if (textField(value, "agent")) {
+    const agent = agentField(value);
+    if (!agent) return "invalid";
+    draft.agent = agent;
+  }
+  if ("model" in value) {
+    const model = value.model;
+    if (model === null || model === "") draft.model = null;
+    else if (typeof model === "string") draft.model = model.trim().slice(0, 200);
+    else return "invalid";
+  }
+  if ("effort" in value && value.effort != null) {
+    const effort = value.effort;
+    if (!isThinkingEffort(effort)) return "invalid";
+    draft.effort = effort;
+  }
+  if ("fast" in value) {
+    const fast = value.fast;
+    if (typeof fast !== "boolean") return "invalid";
+    draft.fast = fast;
+  }
+  if ("planMode" in value) {
+    const planMode = value.planMode;
+    if (typeof planMode !== "boolean") return "invalid";
+    draft.planMode = planMode;
+  }
+  if ("autonomy" in value && value.autonomy != null) {
+    const autonomy = value.autonomy;
+    if (autonomy !== "default" && autonomy !== "full") return "invalid";
+    draft.autonomy = autonomy;
+  }
+  const files = parsePhoneFiles(value.files);
+  if (files === "invalid") return "invalid";
+  if (files.length) draft.files = files;
+  const links = parsePhoneLinks(value.links);
+  if (links === "invalid") return "invalid";
+  if (links.length) draft.links = links;
+  const prompt = textField(value, "prompt");
+  if (prompt) draft.prompt = prompt.slice(0, 2e4);
+  return draft;
+}
+function parsePhoneFiles(value) {
+  if (value == null) return [];
+  if (!Array.isArray(value) || value.length > MAX_PHONE_FILES) return "invalid";
+  const files = [];
+  let total = 0;
+  for (const item of value) {
+    if (!item || typeof item !== "object") return "invalid";
+    const name = (textField(item, "name").replace(/[/\\]/g, "_") || "file").slice(0, 180);
+    const dataBase64 = base64Field(item, "dataBase64");
+    if (!dataBase64 || !/^[A-Za-z0-9+/=]+$/.test(dataBase64)) return "invalid";
+    if (dataBase64.length > MAX_PHONE_FILE_CHARS) return "invalid";
+    total += dataBase64.length;
+    if (total > MAX_PHONE_FILES_CHARS) return "invalid";
+    files.push({ name, dataBase64 });
+  }
+  return files;
+}
+function parsePhoneLinks(value) {
+  if (value == null) return [];
+  if (!Array.isArray(value) || value.length > 8) return "invalid";
+  const links = [];
+  for (const item of value) {
+    if (!item || typeof item !== "object") return "invalid";
+    const ref = textField(item, "ref").slice(0, 80);
+    if (!ref) return "invalid";
+    const title = (textField(item, "title") || ref).slice(0, 200);
+    const url = textField(item, "url").slice(0, 500);
+    links.push({ ref, title, ...url ? { url } : {} });
+  }
+  return links;
+}
+function parsePhoneCreate(value) {
+  const draft = parsePhoneDraft(value);
+  if (draft === "invalid") return "invalid";
+  const goal = textField(value, "goal") || draft.prompt || "";
+  const where = value.where;
+  if (where == null || where === "orchestration") {
+    return {
+      op: "create",
+      where: "orchestration",
+      ...draft,
+      ...goal ? { goal, prompt: goal } : {}
+    };
+  }
+  if (where === "worktree") {
+    const chatId = textField(value, "chatId");
+    if (!chatId) return "invalid";
+    return { op: "create", where: "worktree", chatId, ...draft };
+  }
+  if (where === "project") {
+    const repoPath = textField(value, "repoPath");
+    if (!repoPath || !isProjectPath(repoPath)) return "invalid";
+    const sourceRaw = textField(value, "sourceType");
+    let sourceType;
+    if (sourceRaw === "branch" || sourceRaw === "pr" || sourceRaw === "ticket") sourceType = sourceRaw;
+    else if (sourceRaw) return "invalid";
+    const sourceRef = textField(value, "sourceRef");
+    if ((sourceType === "pr" || sourceType === "ticket") && !sourceRef) return "invalid";
+    const title = textField(value, "title").slice(0, 200);
+    const cowboy = value.cowboy === true;
+    return {
+      op: "create",
+      where: "project",
+      repoPath,
+      ...draft,
+      ...sourceType ? { sourceType } : {},
+      ...sourceRef ? { sourceRef } : {},
+      ...title ? { title } : {},
+      ...cowboy ? { cowboy: true } : {}
+    };
+  }
+  return "invalid";
+}
+function phoneVisibleText(role, text6) {
+  const trimmed = text6.trim();
+  if (role === "user" && trimmed.startsWith(PHONE_USER_PREFIX)) {
+    return trimmed.slice(PHONE_USER_PREFIX.length).trim();
+  }
+  return trimmed;
+}
+function clip(text6, limit) {
+  if (text6.length <= limit) return text6;
+  return `${text6.slice(0, limit - 1)}\u2026`;
+}
+function summarize(thread) {
+  return {
+    id: thread.id,
+    title: thread.title?.trim() || "Untitled",
+    status: thread.status,
+    preview: previewOf(thread),
+    updatedAt: thread.updatedAt
+  };
+}
+function previewOf(thread) {
+  const messages = listPhoneMessages(thread);
+  const last = messages[messages.length - 1];
+  if (!last) return "";
+  return clip(last.text.replace(/\s+/g, " ").trim(), PREVIEW_LIMIT);
+}
+function listPhoneMessages(thread) {
+  const out = [];
+  for (const message of thread.messages) {
+    if (message.role !== "user" && message.role !== "agent") continue;
+    const names = (message.attachments ?? []).map((item) => item.name.trim()).filter(Boolean);
+    const text6 = clip(
+      [phoneVisibleText(message.role, message.text), names.length ? names.join(", ") : ""].filter(Boolean).join("\n"),
+      MESSAGE_LIMIT
+    );
+    if (!text6) continue;
+    out.push({ role: message.role, text: text6 });
+  }
+  for (const prompt of thread.queue) {
+    const text6 = clip(phoneVisibleText("user", prompt), MESSAGE_LIMIT);
+    if (text6) out.push({ role: "user", text: text6 });
+  }
+  return out.slice(-TRANSCRIPT_LIMIT);
+}
+function repoName(repoPath) {
+  const parts = repoPath.replace(/\/$/, "").split("/");
+  return parts[parts.length - 1] || repoPath;
+}
+function isProjectPath(path2) {
+  if (!path2 || path2 === "/" || path2 === ".") return false;
+  return !isGlobalThread({ repoPath: path2 });
+}
+function listPhoneChats() {
+  return listGlobalThreads().slice().sort((a, b) => a.updatedAt < b.updatedAt ? 1 : a.updatedAt > b.updatedAt ? -1 : 0).map(summarize);
+}
+function listPhoneSidebar() {
+  const threads = listThreads();
+  const byRepo = /* @__PURE__ */ new Map();
+  for (const thread of threads) {
+    if (!isProjectPath(thread.repoPath)) continue;
+    const list = byRepo.get(thread.repoPath) ?? [];
+    list.push(thread);
+    byRepo.set(thread.repoPath, list);
+  }
+  for (const workspace of listWorkspaces()) {
+    if (!isProjectPath(workspace.path) || byRepo.has(workspace.path)) continue;
+    byRepo.set(workspace.path, []);
+  }
+  const projects = [...byRepo.entries()].sort(([a], [b]) => repoName(a).localeCompare(repoName(b))).map(([path2, repoThreads]) => ({
+    name: repoName(path2),
+    path: path2,
+    worktrees: groupHomeBoardWorktrees(repoThreads).map((group) => ({
+      label: worktreeDisplayLabelForGroup(group),
+      chats: group.map(summarize)
+    }))
+  }));
+  return { orchestration: listPhoneChats(), projects };
+}
+function historyStamp(thread) {
+  return thread.archivedAt || thread.updatedAt;
+}
+function historyCursor(chat) {
+  return `${chat.updatedAt}	${chat.id}`;
+}
+function historyQueryMatch(chat, query) {
+  if (!query) return true;
+  return `${chat.title} ${chat.where} ${chat.agent} ${chat.preview}`.toLowerCase().includes(query);
+}
+function listPhoneHistory(opts) {
+  const query = opts?.query?.trim().toLowerCase() ?? "";
+  const after = opts?.after?.trim() ?? "";
+  const all = listThreads({ includeArchived: true }).filter((thread) => thread.status === "archived").filter((thread) => isGlobalThread(thread) || isProjectPath(thread.repoPath)).sort((a, b) => historyStamp(a) < historyStamp(b) ? 1 : historyStamp(a) > historyStamp(b) ? -1 : 0).map((thread) => ({
+    id: thread.id,
+    title: thread.title?.trim() || "Untitled",
+    preview: previewOf(thread),
+    updatedAt: historyStamp(thread),
+    where: isGlobalThread(thread) ? "Orchestration" : repoName(thread.repoPath),
+    agent: thread.agent
+  })).filter((chat) => historyQueryMatch(chat, query));
+  let start = 0;
+  if (after) {
+    const index = all.findIndex((chat) => historyCursor(chat) === after);
+    start = index >= 0 ? index + 1 : all.length;
+  }
+  const chats = all.slice(start, start + HISTORY_PAGE_SIZE);
+  const last = chats.at(-1);
+  const more = start + chats.length < all.length;
+  return {
+    chats,
+    total: all.length,
+    ...more && last ? { next: historyCursor(last) } : {}
+  };
+}
+function matchPhoneThread(chatId) {
+  const id = chatId.trim();
+  if (!id) return null;
+  const exact = readThread(id);
+  if (exact) return exact;
+  const match = findThreadByRef(id);
+  if (!match) return null;
+  if (match.id !== id && !match.id.startsWith(id)) return null;
+  return match;
+}
+function visiblePhoneThread(thread) {
+  if (isGlobalThread(thread)) return true;
+  return isProjectPath(thread.repoPath);
+}
+function findPhoneChat(chatId) {
+  const thread = matchPhoneThread(chatId);
+  if (!thread || !visiblePhoneThread(thread)) return null;
+  return thread;
+}
+function readPhoneThread(chatId) {
+  const thread = findPhoneChat(chatId);
+  if (!thread || thread.status === "archived") return null;
+  return thread;
+}
+function phoneComposerOptions(thread) {
+  return {
+    agent: thread.agent,
+    model: thread.model ?? null,
+    effort: thread.effort,
+    fast: Boolean(thread.fast),
+    planMode: Boolean(thread.planMode),
+    autonomy: thread.autonomy ?? "default"
+  };
+}
+function phoneTurnAttachments(draft) {
+  const links = (draft.links ?? []).map((link) => ({
+    id: (0, import_node_crypto25.randomUUID)(),
+    name: link.ref,
+    kind: "issue",
+    content: [`Linked issue: ${link.ref} \u2014 ${link.title}`, link.url ? `URL: ${link.url}` : null].filter(Boolean).join("\n")
+  }));
+  const files = (draft.files ?? []).map((file) => ({
+    id: (0, import_node_crypto25.randomUUID)(),
+    name: file.name,
+    kind: "file",
+    previewDataUrl: `data:application/octet-stream;base64,${file.dataBase64}`,
+    content: `File attached: ${file.name}`
+  }));
+  return [...links, ...files];
+}
+function openedFrom(thread, place) {
+  const fresh = readThread(thread.id) ?? thread;
+  return {
+    chat: summarize(fresh),
+    messages: listPhoneMessages(fresh),
+    place,
+    options: phoneComposerOptions(fresh)
+  };
+}
+function openPhoneChat(chatId) {
+  const thread = readPhoneThread(chatId);
+  if (!thread) return null;
+  const place = isGlobalThread(thread) ? { kind: "orchestration" } : projectPlace(thread);
+  return openedFrom(thread, place);
+}
+function sameRepoPath3(a, b) {
+  return a.replace(/\/+$/, "") === b.replace(/\/+$/, "");
+}
+function projectPlace(thread) {
+  const group = threadsSharingWorktree(thread.worktreePath);
+  return {
+    kind: "project",
+    repoPath: thread.repoPath,
+    worktree: worktreeDisplayLabelForGroup(group.length > 0 ? group : [thread])
+  };
+}
+function assertKnownProject(repoPath) {
+  const path2 = repoPath.trim();
+  if (!isProjectPath(path2)) throw new Error("Pick a project on this Mac.");
+  const known = listWorkspaces().some((workspace) => sameRepoPath3(workspace.path, path2)) || listThreads().some(
+    (thread) => thread.status !== "archived" && sameRepoPath3(thread.repoPath, path2)
+  );
+  if (!known) throw new Error("That project is not on this Mac.");
+  return path2;
+}
+function draftAgentOptions(draft, defaults) {
+  return {
+    agent: draft?.agent ?? defaults.agent,
+    model: draft && "model" in draft ? draft.model ?? null : defaults.model,
+    effort: draft?.effort ?? defaults.effort,
+    fast: draft?.fast ?? defaults.fast,
+    planMode: Boolean(draft?.planMode),
+    autonomy: draft?.autonomy
+  };
+}
+function createPhoneChat(agent) {
+  const defaults = resolveOrchestratorDefaults();
+  const thread = createGlobalChat({
+    agent: agent ?? defaults.agent,
+    model: defaults.model,
+    effort: defaults.effort,
+    fast: defaults.fast
+  });
+  return openedFrom(thread, { kind: "orchestration" });
+}
+async function createPhoneOrchestration(draft) {
+  const goal = (draft?.goal ?? draft?.prompt ?? "").trim();
+  const attachments = phoneTurnAttachments(draft ?? {});
+  if (!goal && attachments.length === 0) return createPhoneChat(draft?.agent);
+  const defaults = resolveOrchestratorDefaults();
+  const options = draftAgentOptions(draft, defaults);
+  const thread = await startOrchestration({
+    goal: goal || "See the attached files.",
+    agent: options.agent,
+    model: options.model,
+    effort: options.effort,
+    fast: options.fast,
+    planMode: options.planMode,
+    autonomy: options.autonomy,
+    attachments
+  });
+  return openedFrom(thread, { kind: "orchestration" });
+}
+function createPhoneWorktreeAgent(fromChatId, draft) {
+  const source = readPhoneThread(fromChatId);
+  if (!source || isGlobalThread(source)) throw new Error("That worktree is not on this Mac.");
+  const defaults = resolveNewThreadOptions();
+  const options = draftAgentOptions(draft, defaults);
+  const attachments = persistPendingFileAttachments(
+    source.worktreePath,
+    phoneTurnAttachments(draft ?? {})
+  );
+  const thread = createChatTab({
+    fromThreadId: source.id,
+    agent: options.agent,
+    model: options.model,
+    effort: options.effort,
+    fast: options.fast,
+    autonomy: options.autonomy,
+    attachments
+  });
+  if (draft?.planMode !== void 0) updateThread(thread.id, { planMode: draft.planMode });
+  return openedFrom(thread, projectPlace(readThread(thread.id) ?? thread));
+}
+async function createPhoneProjectWorktree(repoPathOrInput) {
+  const input = typeof repoPathOrInput === "string" ? { repoPath: repoPathOrInput } : repoPathOrInput;
+  const path2 = assertKnownProject(input.repoPath);
+  const defaults = resolveNewThreadOptions();
+  const options = draftAgentOptions(input, defaults);
+  const thread = await createThread({
+    sourceType: input.sourceType ?? "branch",
+    sourceRef: input.sourceRef || "default",
+    repoPath: path2,
+    title: input.title,
+    cowboy: input.cowboy,
+    agent: options.agent,
+    model: options.model,
+    effort: options.effort,
+    fast: options.fast,
+    planMode: options.planMode,
+    autonomy: options.autonomy,
+    attachments: phoneTurnAttachments(input),
+    prompt: input.prompt,
+    reuseExisting: false
+  });
+  return openedFrom(thread, projectPlace(thread));
+}
+async function listPhoneModels(agent) {
+  const catalogs = await listModelsForAgent(agent);
+  return (catalogs[0]?.models ?? []).slice(0, 40).map((model) => ({
+    id: model.id,
+    label: model.displayName || model.id
+  }));
+}
+function archivePhoneChat(chatId) {
+  const thread = readPhoneThread(chatId);
+  if (!thread) return false;
+  updateThread(thread.id, { status: "archived" });
+  return true;
+}
+
+// src/remote/phone-sources.ts
+init_worktree();
+function sourceWarning(label, err) {
+  const message = err instanceof Error ? err.message : String(err);
+  return message ? `${label}: ${message}` : `${label} failed.`;
+}
+async function listPhoneSources(repoPath, query) {
+  const path2 = assertKnownProject(repoPath);
+  const q = query?.trim() ?? "";
+  const warnings = [];
+  const [prs, branches, issues] = await Promise.all([
+    listPrs(path2, { state: "open", limit: 40, ...q ? { query: q } : {} }).catch((err) => {
+      warnings.push(sourceWarning("Pull requests", err));
+      return [];
+    }),
+    listBranches(path2).catch((err) => {
+      warnings.push(sourceWarning("Branches", err));
+      return [];
+    }),
+    listIssues(path2, { limit: 40, ...q ? { query: q } : {} }).catch((err) => {
+      warnings.push(sourceWarning("Issues", err));
+      return { issues: [] };
+    })
+  ]);
+  const needle = q.toLowerCase();
+  const branchRows = branches.filter((branch) => !needle || branch.name.toLowerCase().includes(needle)).slice(0, 50).map((branch) => ({
+    ref: branch.name,
+    title: branch.current ? `${branch.name} (current)` : branch.name
+  }));
+  return {
+    prs: prs.slice(0, 40).map((pr) => ({
+      ref: String(pr.number),
+      title: clip(pr.title || `PR #${pr.number}`, 140),
+      ...pr.url ? { url: pr.url } : {}
+    })),
+    branches: branchRows,
+    issues: (issues.issues ?? []).slice(0, 40).map((issue) => ({
+      ref: issue.identifier,
+      title: clip(issue.title || issue.identifier, 140),
+      ...issue.url ? { url: issue.url } : {}
+    })),
+    ...warnings.length ? { warnings } : {}
+  };
+}
+
+// src/remote/phone-live.ts
+init_orchestrator();
+init_thread_store();
+
+// src/remote/phone-stream.ts
+init_message_parts();
+var PHONE_STREAM_FLUSH_MS = 80;
+function phoneStreamFrame(parts) {
+  return {
+    text: visibleAssistantText(void 0, parts),
+    activity: liveActivitySummary(parts)
+  };
+}
+var SKIPPED = /* @__PURE__ */ new Set(["session_id", "usage", "stderr", "exit"]);
+function phoneStreamParts(parts, event) {
+  if (SKIPPED.has(event.type)) return null;
+  return applyAgentEvent(parts, event);
+}
+function phoneStreamFlushNow(event) {
+  return event.type === "tool_use" || event.type === "tool_result" && !event.partial;
+}
+
+// src/remote/phone-live.ts
 var REMOTE_STOPPED_REPLY = "Sideboard stopped the in-progress turn.";
+var chatChains = /* @__PURE__ */ new Map();
+var chatGeneration = /* @__PURE__ */ new Map();
+var phoneTurnGen = /* @__PURE__ */ new Map();
+function bumpChat(chatId) {
+  const next = (chatGeneration.get(chatId) ?? 0) + 1;
+  chatGeneration.set(chatId, next);
+  return next;
+}
+function finishPhoneTurn(chatId, generation) {
+  if (phoneTurnGen.get(chatId) === generation) phoneTurnGen.delete(chatId);
+}
+function enqueueChat(chatId, fn) {
+  const prev = chatChains.get(chatId) ?? Promise.resolve();
+  const run2 = prev.then(fn, fn);
+  chatChains.set(
+    chatId,
+    run2.then(
+      () => void 0,
+      () => void 0
+    )
+  );
+}
+function emitControl(opts, reply) {
+  opts.onOutbound({ type: "assistant", text: encodePhoneControl(reply) });
+}
+function watchPhoneStream(opts, chatId, threadId, generation) {
+  let parts = [];
+  let timer = null;
+  let lastKey = "";
+  let closed = false;
+  const alive = () => !closed && chatGeneration.get(chatId) === generation;
+  const flush2 = () => {
+    timer = null;
+    if (!alive()) return;
+    const frame = phoneStreamFrame(parts);
+    const key = `${frame.activity}
+${frame.text}`;
+    if (key === lastKey) return;
+    if (!frame.text && !frame.activity) return;
+    lastKey = key;
+    emitControl(opts, { op: "stream", chatId, text: frame.text, activity: frame.activity });
+  };
+  const schedule = (event) => {
+    if (phoneStreamFlushNow(event) || lastKey === "") {
+      if (timer) {
+        clearTimeout(timer);
+        timer = null;
+      }
+      flush2();
+      return;
+    }
+    if (timer) return;
+    timer = setTimeout(flush2, PHONE_STREAM_FLUSH_MS);
+  };
+  const off = getOrchestrator().on((event) => {
+    if (!alive()) return;
+    if (event.type !== "turn_output" || event.threadId !== threadId) return;
+    const next = phoneStreamParts(parts, event.event);
+    if (!next) return;
+    parts = next;
+    schedule(event.event);
+  });
+  return () => {
+    closed = true;
+    if (timer) clearTimeout(timer);
+    off();
+  };
+}
+function interruptChat(chatId, log) {
+  try {
+    const thread = readPhoneThread(chatId);
+    if (!thread) return false;
+    if (thread.status !== "running" && thread.status !== "queued") return false;
+    getOrchestrator().stop(thread.id, { clearQueue: true });
+    log(`interrupt phone \u2192 chat ${thread.id.slice(0, 8)} (${thread.status})`);
+    return true;
+  } catch (err) {
+    log(`interrupt chat: ${err instanceof Error ? err.message : String(err)}`);
+    return false;
+  }
+}
+function emitChatTurn(opts, chatId, threadId) {
+  const thread = readThread(threadId);
+  if (!thread) {
+    emitControl(opts, { op: "error", chatId, message: "That agent is not on this Mac." });
+    return;
+  }
+  if (thread.status === "stopped") {
+    emitControl(opts, { op: "stopped", chatId });
+    return;
+  }
+  const result = getOrchestrator().getTurnResult(thread.id);
+  const pending = extractPendingPlanQuestions(
+    [...thread.messages].reverse().find((m) => m.role === "agent")?.parts
+  );
+  if (result.taskState === "input-required" && pending) {
+    emitControl(opts, {
+      op: "ask",
+      chatId,
+      text: result.text.trim(),
+      questions: pending.questions.map((q) => ({
+        question: q.question,
+        options: q.options.map(
+          (o) => o.description ? { label: o.label, description: o.description } : { label: o.label }
+        )
+      }))
+    });
+    return;
+  }
+  const reply = outboundReplyFromTurn(result, {
+    inputRequired: "Sideboard is waiting for an answer.",
+    canceled: REMOTE_STOPPED_REPLY,
+    completedEmpty: () => "",
+    failed: (detail) => detail ? `Sideboard failed: ${detail}` : "Sideboard failed before producing a result."
+  });
+  emitControl(opts, { op: "assistant", chatId, text: reply.trim() });
+}
+function phoneError(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function deliverPhoneTurn(opts, chatId) {
+  const thread = readPhoneThread(chatId);
+  if (!thread || thread.status !== "running" && thread.status !== "queued") return;
+  const id = thread.id;
+  const claimed = phoneTurnGen.get(id);
+  if (claimed != null && claimed === chatGeneration.get(id)) return;
+  const generation = bumpChat(id);
+  phoneTurnGen.set(id, generation);
+  enqueueChat(id, async () => {
+    if (chatGeneration.get(id) !== generation) return;
+    const stopStream = watchPhoneStream(opts, id, id, generation);
+    try {
+      await getOrchestrator().waitForTurn(id, 14 * 60 * 1e3);
+    } catch (err) {
+      stopStream();
+      finishPhoneTurn(id, generation);
+      if (chatGeneration.get(id) !== generation) return;
+      emitControl(opts, { op: "error", chatId: id, message: `Sideboard failed: ${phoneError(err)}` });
+      return;
+    }
+    stopStream();
+    finishPhoneTurn(id, generation);
+    if (chatGeneration.get(id) !== generation) return;
+    emitChatTurn(opts, id, id);
+  });
+}
+
+// src/remote/listen.ts
 function formatRemotePrompt(text6) {
   return `Phone
 
@@ -38789,10 +39558,312 @@ function interruptRemoteCoordinator(deviceId, log = () => void 0) {
     return false;
   }
 }
+function publishOpenedChat(opts, chatId) {
+  const opened = openPhoneChat(chatId);
+  if (!opened) {
+    emitControl(opts, { op: "error", message: "That agent is not on this Mac." });
+    return;
+  }
+  emitControl(opts, { op: "opened", ...opened });
+  if (opened.chat.status === "running" || opened.chat.status === "queued") {
+    deliverPhoneTurn(opts, opened.chat.id);
+  }
+}
+function applyPhoneOptions(chatId, draft) {
+  const patch = {};
+  if (draft.agent) patch.agent = draft.agent;
+  if ("model" in draft) patch.model = draft.model ?? null;
+  if (draft.effort) patch.effort = draft.effort;
+  if (draft.fast !== void 0) patch.fast = draft.fast;
+  if (draft.planMode !== void 0) patch.planMode = draft.planMode;
+  if (draft.autonomy) patch.autonomy = draft.autonomy;
+  if (Object.keys(patch).length === 0) return;
+  getOrchestrator().setThreadOptions(chatId, patch);
+}
+function stagePhoneTurnFiles(worktreePath, draft) {
+  const links = phoneTurnAttachments({ links: draft.links });
+  const files = stageBuffersAsAttachments(
+    worktreePath,
+    (draft.files ?? []).map((file) => ({ name: file.name, dataBase64: file.dataBase64 }))
+  );
+  return [...links, ...files];
+}
+function handlePhoneControl(cmd, opts) {
+  const log = opts.onLog ?? (() => void 0);
+  if (cmd.op === "list") {
+    emitControl(opts, { op: "sidebar", ...listPhoneSidebar() });
+    return;
+  }
+  if (cmd.op === "history") {
+    const page = listPhoneHistory({ query: cmd.query, after: cmd.after });
+    emitControl(opts, {
+      op: "history",
+      chats: page.chats,
+      total: page.total,
+      ...page.next ? { next: page.next } : {},
+      ...cmd.query ? { query: cmd.query } : {},
+      ...cmd.after ? { after: cmd.after } : {}
+    });
+    return;
+  }
+  if (cmd.op === "sources") {
+    const repoPath = cmd.repoPath;
+    const query = cmd.query;
+    void listPhoneSources(repoPath, query).then(
+      (page) => emitControl(opts, {
+        op: "sources",
+        repoPath,
+        ...query ? { query } : {},
+        ...page
+      })
+    ).catch((err) => {
+      emitControl(opts, { op: "error", message: phoneError(err) });
+    });
+    return;
+  }
+  if (cmd.op === "models") {
+    const agent = cmd.agent;
+    void listPhoneModels(agent).then((models) => emitControl(opts, { op: "models", agent, models })).catch((err) => {
+      emitControl(opts, { op: "error", message: phoneError(err) });
+    });
+    return;
+  }
+  if (cmd.op === "dictate") {
+    const id = cmd.id;
+    const transcribe = opts.transcribeWav;
+    if (!transcribe) {
+      emitControl(opts, { op: "error", message: "Speech is not available on this Mac." });
+      return;
+    }
+    void transcribe(cmd.audioBase64).then((text6) => emitControl(opts, { op: "dictated", id, text: text6.trim() })).catch((err) => {
+      emitControl(opts, { op: "error", message: phoneError(err) });
+    });
+    return;
+  }
+  if (cmd.op === "options") {
+    const thread = readPhoneThread(cmd.chatId);
+    if (!thread) {
+      emitControl(opts, { op: "error", chatId: cmd.chatId, message: "That agent is not on this Mac." });
+      return;
+    }
+    try {
+      applyPhoneOptions(thread.id, cmd);
+      const fresh = readPhoneThread(thread.id) ?? thread;
+      emitControl(opts, { op: "options", chatId: fresh.id, ...phoneComposerOptions(fresh) });
+    } catch (err) {
+      emitControl(opts, { op: "error", chatId: cmd.chatId, message: phoneError(err) });
+    }
+    return;
+  }
+  if (cmd.op === "create") {
+    if (cmd.where === "worktree") {
+      void (async () => {
+        try {
+          const opened = createPhoneWorktreeAgent(cmd.chatId, cmd);
+          const prompt = cmd.prompt?.trim() || (cmd.files?.length || cmd.links?.length ? "See the attached files." : "");
+          if (prompt) {
+            try {
+              await getOrchestrator().send(opened.chat.id, formatRemotePrompt(prompt));
+            } catch (err) {
+              emitControl(opts, { op: "error", chatId: opened.chat.id, message: phoneError(err) });
+            }
+          }
+          const fresh = openPhoneChat(opened.chat.id) ?? opened;
+          emitControl(opts, { op: "opened", ...fresh });
+          if (prompt) deliverPhoneTurn(opts, fresh.chat.id);
+        } catch (err) {
+          emitControl(opts, { op: "error", message: phoneError(err) });
+        }
+      })();
+      return;
+    }
+    if (cmd.where === "project") {
+      void createPhoneProjectWorktree(cmd).then(async (opened) => {
+        const prompt = resolveCreateFirstPrompt({
+          sourceType: cmd.sourceType ?? "branch",
+          prompt: cmd.prompt
+        }) || (cmd.files?.length || cmd.links?.length ? "See the attached files." : "");
+        if (prompt) {
+          try {
+            await getOrchestrator().send(opened.chat.id, formatRemotePrompt(prompt));
+          } catch (err) {
+            emitControl(opts, { op: "error", chatId: opened.chat.id, message: phoneError(err) });
+          }
+        }
+        const fresh = openPhoneChat(opened.chat.id) ?? opened;
+        emitControl(opts, { op: "opened", ...fresh });
+        if (prompt) deliverPhoneTurn(opts, fresh.chat.id);
+      }).catch((err) => {
+        emitControl(opts, { op: "error", message: phoneError(err) });
+      });
+      return;
+    }
+    const goal = cmd.goal?.trim() || cmd.prompt?.trim() || "";
+    if (goal || cmd.files?.length || cmd.links?.length) {
+      void createPhoneOrchestration({ ...cmd, goal }).then((opened) => {
+        emitControl(opts, { op: "opened", ...opened });
+        deliverPhoneTurn(opts, opened.chat.id);
+      }).catch((err) => {
+        emitControl(opts, { op: "error", message: phoneError(err) });
+      });
+      return;
+    }
+    try {
+      const agent = coerceOrchestratorAgent(
+        cmd.agent ?? opts.agent ?? resolveOrchestratorDefaults().agent
+      );
+      emitControl(opts, { op: "opened", ...createPhoneChat(agent) });
+    } catch (err) {
+      emitControl(opts, { op: "error", message: phoneError(err) });
+    }
+    return;
+  }
+  if (cmd.op === "open") {
+    const thread = findPhoneChat(cmd.chatId);
+    if (!thread) {
+      emitControl(opts, { op: "error", message: "That agent is not on this Mac." });
+      return;
+    }
+    if (thread.status === "archived") {
+      void getOrchestrator().restore(thread.id).then(() => {
+        emitControl(opts, { op: "sidebar", ...listPhoneSidebar() });
+        publishOpenedChat(opts, thread.id);
+      }).catch((err) => {
+        emitControl(opts, { op: "error", message: phoneError(err) });
+      });
+      return;
+    }
+    publishOpenedChat(opts, thread.id);
+    return;
+  }
+  if (cmd.op === "archive") {
+    const thread = readPhoneThread(cmd.chatId);
+    if (!thread) {
+      emitControl(opts, { op: "error", message: "That agent is not on this Mac." });
+      return;
+    }
+    bumpChat(thread.id);
+    interruptChat(thread.id, log);
+    archivePhoneChat(thread.id);
+    emitControl(opts, { op: "sidebar", ...listPhoneSidebar() });
+    return;
+  }
+  if (cmd.op === "restore") {
+    const chatId2 = cmd.chatId;
+    void getOrchestrator().restore(chatId2).then(() => {
+      emitControl(opts, { op: "sidebar", ...listPhoneSidebar() });
+      emitControl(opts, { op: "restored", chatId: chatId2 });
+    }).catch((err) => {
+      emitControl(opts, {
+        op: "error",
+        chatId: chatId2,
+        message: err instanceof Error ? err.message : String(err)
+      });
+    });
+    return;
+  }
+  if (cmd.op === "media") {
+    const thread = readPhoneThread(cmd.chatId);
+    const dataUrl = thread ? phoneImageDataUrl(thread.worktreePath, cmd.path) : null;
+    emitControl(opts, {
+      op: "media",
+      chatId: cmd.chatId,
+      path: cmd.path,
+      ...dataUrl ? { dataUrl } : {}
+    });
+    return;
+  }
+  if (cmd.op === "open-file") {
+    const thread = readPhoneThread(cmd.chatId);
+    const relative = thread ? phoneWorktreeRelative(thread.worktreePath, cmd.path) : null;
+    if (!thread || !relative) {
+      emitControl(opts, { op: "error", chatId: cmd.chatId, message: "That file is not in this worktree." });
+      return;
+    }
+    void getOrchestrator().statPath(thread.id, relative).then((kind) => {
+      if (kind === "missing") {
+        emitControl(opts, { op: "error", chatId: cmd.chatId, message: "That file is not in this worktree." });
+        return;
+      }
+      opts.onOpenWorktreeFile?.({
+        threadId: thread.id,
+        path: relative,
+        ...kind === "dir" ? { directory: true } : {},
+        ...cmd.startLine != null ? { startLine: cmd.startLine } : {},
+        ...cmd.endLine != null ? { endLine: cmd.endLine } : {}
+      });
+    }).catch(() => {
+      emitControl(opts, { op: "error", chatId: cmd.chatId, message: "That file is not in this worktree." });
+    });
+    return;
+  }
+  if (cmd.op === "stop") {
+    if (!readPhoneThread(cmd.chatId)) {
+      emitControl(opts, { op: "error", chatId: cmd.chatId, message: "That agent is not on this Mac." });
+      return;
+    }
+    bumpChat(cmd.chatId);
+    interruptChat(cmd.chatId, log);
+    emitControl(opts, { op: "stopped", chatId: cmd.chatId });
+    return;
+  }
+  const chatId = cmd.chatId;
+  const generation = bumpChat(chatId);
+  phoneTurnGen.set(chatId, generation);
+  interruptChat(chatId, log);
+  enqueueChat(chatId, async () => {
+    if (chatGeneration.get(chatId) !== generation) return;
+    const thread = readPhoneThread(chatId);
+    if (!thread) {
+      emitControl(opts, { op: "error", chatId, message: "That agent is not on this Mac." });
+      return;
+    }
+    if (thread.status === "running" || thread.status === "queued") {
+      try {
+        getOrchestrator().stop(thread.id, { clearQueue: true });
+      } catch {
+      }
+    }
+    if (chatGeneration.get(chatId) !== generation) return;
+    const stopStream = watchPhoneStream(opts, chatId, thread.id, generation);
+    try {
+      try {
+        applyPhoneOptions(thread.id, cmd);
+      } catch (err) {
+        emitControl(opts, { op: "error", chatId, message: phoneError(err) });
+      }
+      const live = readPhoneThread(thread.id) ?? thread;
+      const staged = stagePhoneTurnFiles(live.worktreePath, cmd);
+      const text6 = cmd.text.trim() || (staged.length ? "See the attached files." : "");
+      const formatted = formatRemotePrompt(text6);
+      await getOrchestrator().send(thread.id, formatted, { attachments: staged });
+      await getOrchestrator().waitForTurn(thread.id, 14 * 60 * 1e3);
+    } catch (err) {
+      if (chatGeneration.get(chatId) !== generation) return;
+      const message = err instanceof Error ? err.message : String(err);
+      emitControl(opts, { op: "error", chatId, message: `Sideboard failed: ${message}` });
+      return;
+    } finally {
+      stopStream();
+      finishPhoneTurn(chatId, generation);
+    }
+    if (chatGeneration.get(chatId) !== generation) return;
+    emitChatTurn(opts, chatId, thread.id);
+  });
+}
 function handleRemoteInbound(text6, opts) {
-  const generation = ++inboundGeneration;
   const log = opts.onLog ?? (() => void 0);
   const body = text6.trim();
+  const control = takePhoneControl(body);
+  if (control) {
+    if (control === "invalid") {
+      emitControl(opts, { op: "error", message: "invalid phone command" });
+      return;
+    }
+    handlePhoneControl(control, opts);
+    return;
+  }
+  const generation = ++inboundGeneration;
   if (body) interruptRemoteCoordinator(opts.deviceId, log);
   enqueue(async () => {
     if (generation !== inboundGeneration) return;
@@ -38907,7 +39978,8 @@ function runRemoteHost(opts) {
       type: "host_register",
       deviceId: opts.deviceId,
       deviceLabel,
-      hostSecret: opts.hostSecret
+      hostSecret: opts.hostSecret,
+      ...opts.accountToken?.trim() ? { accountToken: opts.accountToken.trim() } : {}
     });
   };
   const loop = async () => {
@@ -39015,7 +40087,8 @@ function runRemoteHost(opts) {
       handleRemoteInbound("stop", {
         deviceId: opts.deviceId,
         onLog: log,
-        onOutbound: emit
+        onOutbound: emit,
+        onOpenWorktreeFile: opts.onOpenWorktreeFile
       });
       return;
     }
@@ -39023,7 +40096,9 @@ function runRemoteHost(opts) {
       handleRemoteInbound(msg.text, {
         deviceId: opts.deviceId,
         onLog: log,
-        onOutbound: emit
+        onOutbound: emit,
+        transcribeWav: opts.transcribeWav,
+        onOpenWorktreeFile: opts.onOpenWorktreeFile
       });
     }
   };
@@ -39050,6 +40125,671 @@ function runRemoteHost(opts) {
   };
 }
 
+// src/relay/account-login.ts
+var import_node_crypto27 = require("crypto");
+
+// src/relay/accounts.ts
+var import_node_crypto26 = require("crypto");
+var import_node_fs70 = require("fs");
+var import_node_module7 = require("module");
+var import_node_path68 = require("path");
+var GITHUB_ACCOUNT_ISSUER = "https://github.com";
+var RELAY_DEVICE_CAP = 3;
+function thisModuleFile3() {
+  const cjsFile = typeof __filename !== "undefined" ? __filename : "";
+  return cjsFile || process.argv[1] || (0, import_node_path68.join)(process.cwd(), "package.json");
+}
+function openDatabase(filePath) {
+  const req = (0, import_node_module7.createRequire)(thisModuleFile3());
+  const specifier = "node:sqlite";
+  const { DatabaseSync: SqliteDatabase } = req(specifier);
+  const db = new SqliteDatabase(filePath);
+  db.exec("PRAGMA journal_mode = WAL");
+  return db;
+}
+function sha256(value) {
+  return (0, import_node_crypto26.createHash)("sha256").update(value).digest("hex");
+}
+function sameHash(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && (0, import_node_crypto26.timingSafeEqual)(left, right);
+}
+function normalizeEmail(email) {
+  const trimmed = email?.trim().toLowerCase() ?? "";
+  return trimmed || null;
+}
+function longestMountPoint(dir, mounts) {
+  let best = "/";
+  for (const line of mounts.split("\n")) {
+    const point = line.split(" ")[1]?.replace(/\\040/g, " ");
+    if (!point) continue;
+    if (dir === point || dir.startsWith(point.endsWith("/") ? point : `${point}/`)) {
+      if (point.length > best.length) best = point;
+    }
+  }
+  return best;
+}
+function assertRelayAccountsDurable(filePath) {
+  if (process.env.SIDEBOARD_RELAY_ACCOUNTS_EPHEMERAL === "1") return;
+  if (process.env.NODE_ENV !== "production") return;
+  if (process.platform !== "linux") return;
+  const dir = (0, import_node_fs70.realpathSync)((0, import_node_path68.dirname)(filePath));
+  const mounts = (0, import_node_fs70.readFileSync)("/proc/mounts", "utf8");
+  const point = longestMountPoint(dir, mounts);
+  if (point === "/") {
+    throw new Error(
+      `Relay accounts at ${filePath} are on the machine root filesystem. Mount a Fly volume so sign-ins survive deploys.`
+    );
+  }
+}
+var RelayAccountStore = class {
+  db;
+  constructor(filePath) {
+    (0, import_node_fs70.mkdirSync)((0, import_node_path68.dirname)(filePath), { recursive: true });
+    this.db = openDatabase(filePath);
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS accounts (
+        id TEXT PRIMARY KEY,
+        created_at INTEGER NOT NULL,
+        device_cap INTEGER NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS identities (
+        issuer TEXT NOT NULL,
+        subject TEXT NOT NULL,
+        account_id TEXT NOT NULL,
+        email TEXT,
+        email_verified INTEGER NOT NULL,
+        PRIMARY KEY (issuer, subject)
+      );
+      CREATE INDEX IF NOT EXISTS identities_email ON identities(email);
+      CREATE TABLE IF NOT EXISTS credentials (
+        token_hash TEXT PRIMARY KEY,
+        account_id TEXT NOT NULL,
+        created_at INTEGER NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS devices (
+        device_id TEXT PRIMARY KEY,
+        account_id TEXT NOT NULL,
+        host_secret_hash TEXT NOT NULL,
+        device_label TEXT NOT NULL,
+        created_at INTEGER NOT NULL
+      );
+    `);
+  }
+  close() {
+    this.db.close();
+  }
+  /**
+   * First sign-in creates an account. The same issuer+subject returns that
+   * account. A verified email match attaches a second provider. `linkAccountId`
+   * attaches while that account’s credential is already signed in.
+   * Each call mints a new Mac credential. Older credentials stay valid.
+   */
+  signIn(identity, linkAccountId) {
+    const issuer = identity.issuer.trim();
+    const subject = identity.subject.trim();
+    if (!issuer || !subject) throw new Error("Sign-in is missing an identity.");
+    const email = normalizeEmail(identity.email);
+    const verified = Boolean(identity.emailVerified && email);
+    const link = linkAccountId?.trim() || null;
+    this.db.exec("BEGIN");
+    try {
+      const existing = this.db.prepare("SELECT account_id, email FROM identities WHERE issuer = ? AND subject = ?").get(issuer, subject);
+      let accountId;
+      if (existing) {
+        if (link && link !== existing.account_id) {
+          throw new Error("That sign-in already belongs to another Sideboard account.");
+        }
+        accountId = existing.account_id;
+        this.requireAccount(accountId);
+        if (email) {
+          this.db.prepare("UPDATE identities SET email = ?, email_verified = ? WHERE issuer = ? AND subject = ?").run(email, verified ? 1 : 0, issuer, subject);
+        }
+      } else if (link) {
+        this.requireAccount(link);
+        accountId = link;
+        this.insertIdentity(issuer, subject, accountId, email, verified);
+      } else {
+        const byEmail = verified ? this.accountIdForVerifiedEmail(email) : void 0;
+        accountId = byEmail ?? (0, import_node_crypto26.randomUUID)();
+        if (!byEmail) {
+          this.db.prepare("INSERT INTO accounts (id, created_at, device_cap) VALUES (?, ?, ?)").run(accountId, Date.now(), RELAY_DEVICE_CAP);
+        }
+        this.insertIdentity(issuer, subject, accountId, email, verified);
+      }
+      const credential = this.mintCredential(accountId);
+      const stored = this.db.prepare("SELECT email FROM identities WHERE account_id = ? AND email IS NOT NULL ORDER BY email_verified DESC LIMIT 1").get(accountId);
+      this.db.exec("COMMIT");
+      return { accountId, credential, email: stored?.email ?? email };
+    } catch (err) {
+      this.db.exec("ROLLBACK");
+      throw err;
+    }
+  }
+  verifyCredential(token) {
+    const trimmed = token.trim();
+    if (!trimmed) return null;
+    const row = this.db.prepare("SELECT account_id FROM credentials WHERE token_hash = ?").get(sha256(trimmed));
+    return row?.account_id ?? null;
+  }
+  /** Drop one Mac credential. The account and its other Macs stay. */
+  logout(token) {
+    const trimmed = token.trim();
+    if (!trimmed) return;
+    this.db.prepare("DELETE FROM credentials WHERE token_hash = ?").run(sha256(trimmed));
+  }
+  /** Delete the account and every identity, credential, and Mac bound to it. */
+  revokeAccount(accountId) {
+    const id = accountId.trim();
+    if (!id) return;
+    this.db.exec("BEGIN");
+    try {
+      this.db.prepare("DELETE FROM devices WHERE account_id = ?").run(id);
+      this.db.prepare("DELETE FROM credentials WHERE account_id = ?").run(id);
+      this.db.prepare("DELETE FROM identities WHERE account_id = ?").run(id);
+      this.db.prepare("DELETE FROM accounts WHERE id = ?").run(id);
+      this.db.exec("COMMIT");
+    } catch (err) {
+      this.db.exec("ROLLBACK");
+      throw err;
+    }
+  }
+  /**
+   * Accept `host_register` for a signed-in account. The device row survives
+   * process restart, so a later register with a different host secret is rejected
+   * and a new device id counts against the cap.
+   */
+  authorizeHost(input) {
+    const deviceId = input.deviceId.trim();
+    const hostSecret = input.hostSecret.trim();
+    const deviceLabel = input.deviceLabel.trim() || "This Mac";
+    if (!deviceId || !hostSecret) return { ok: false, message: "sign in required" };
+    const accountId = this.verifyCredential(input.accountToken);
+    if (!accountId) return { ok: false, message: "sign in required" };
+    this.db.exec("BEGIN");
+    try {
+      const account = this.db.prepare("SELECT id, device_cap FROM accounts WHERE id = ?").get(accountId);
+      if (!account) {
+        this.db.exec("ROLLBACK");
+        return { ok: false, message: "sign in required" };
+      }
+      const device = this.db.prepare("SELECT device_id, account_id, host_secret_hash FROM devices WHERE device_id = ?").get(deviceId);
+      const secretHash = sha256(hostSecret);
+      if (!device) {
+        const count = this.db.prepare("SELECT COUNT(*) AS n FROM devices WHERE account_id = ?").get(accountId);
+        if (count.n >= account.device_cap) {
+          this.db.exec("ROLLBACK");
+          return { ok: false, message: "This account already has the maximum number of Macs." };
+        }
+        this.db.prepare(
+          "INSERT INTO devices (device_id, account_id, host_secret_hash, device_label, created_at) VALUES (?, ?, ?, ?, ?)"
+        ).run(deviceId, accountId, secretHash, deviceLabel, Date.now());
+        this.db.exec("COMMIT");
+        return { ok: true, accountId };
+      }
+      if (device.account_id !== accountId) {
+        this.db.exec("ROLLBACK");
+        return { ok: false, message: "This Mac is registered to another account." };
+      }
+      if (!sameHash(device.host_secret_hash, secretHash)) {
+        this.db.exec("ROLLBACK");
+        return { ok: false, message: "host secret rejected" };
+      }
+      this.db.prepare("UPDATE devices SET device_label = ? WHERE device_id = ?").run(deviceLabel, deviceId);
+      this.db.exec("COMMIT");
+      return { ok: true, accountId };
+    } catch (err) {
+      this.db.exec("ROLLBACK");
+      throw err;
+    }
+  }
+  requireAccount(accountId) {
+    const row = this.db.prepare("SELECT id FROM accounts WHERE id = ?").get(accountId);
+    if (!row) throw new Error("That Sideboard account is no longer on the relay.");
+  }
+  accountIdForVerifiedEmail(email) {
+    const row = this.db.prepare(
+      "SELECT account_id FROM identities WHERE email_verified = 1 AND email = ? LIMIT 1"
+    ).get(email);
+    return row?.account_id;
+  }
+  insertIdentity(issuer, subject, accountId, email, verified) {
+    this.db.prepare(
+      "INSERT INTO identities (issuer, subject, account_id, email, email_verified) VALUES (?, ?, ?, ?, ?)"
+    ).run(issuer, subject, accountId, email, verified ? 1 : 0);
+  }
+  mintCredential(accountId) {
+    const credential = (0, import_node_crypto26.randomBytes)(32).toString("hex");
+    this.db.prepare("INSERT INTO credentials (token_hash, account_id, created_at) VALUES (?, ?, ?)").run(sha256(credential), accountId, Date.now());
+    return credential;
+  }
+};
+
+// src/relay/account-oauth.ts
+var RELAY_GIT_HOSTS = ["github"];
+var REMOTE_LOGIN_PATH = "/remote/login";
+var REMOTE_OAUTH_CALLBACK_PATH = "/remote/oauth/callback";
+var REMOTE_OAUTH_RESULT_PATH = "/remote/oauth/result";
+var REMOTE_LOGOUT_PATH = "/remote/logout";
+var STATE_RE = /^[A-Za-z0-9_-]{16,128}$/;
+var LOGIN_TTL_MS = 10 * 60 * 1e3;
+var RelayLoginSessions = class {
+  waiting = /* @__PURE__ */ new Map();
+  results = /* @__PURE__ */ new Map();
+  begin(state, provider, accountId) {
+    this.sweep();
+    this.waiting.set(state, { provider, accountId, expiresAt: Date.now() + LOGIN_TTL_MS });
+  }
+  takeLogin(state) {
+    this.sweep();
+    const row = this.waiting.get(state);
+    if (!row) return null;
+    this.waiting.delete(state);
+    if (row.expiresAt < Date.now()) return null;
+    return row;
+  }
+  putResult(state, value) {
+    this.results.set(state, { value, expiresAt: Date.now() + LOGIN_TTL_MS });
+  }
+  /** `undefined` means the browser flow has not finished. */
+  takeResult(state) {
+    this.sweep();
+    const row = this.results.get(state);
+    if (!row) return this.waiting.has(state) ? void 0 : null;
+    this.results.delete(state);
+    if (row.expiresAt < Date.now()) return null;
+    return row.value;
+  }
+  sweep() {
+    const now = Date.now();
+    for (const [state, row] of this.waiting) {
+      if (row.expiresAt < now) this.waiting.delete(state);
+    }
+    for (const [state, row] of this.results) {
+      if (row.expiresAt < now) this.results.delete(state);
+    }
+  }
+};
+var GIT_HOST_AUTH = {
+  github: {
+    label: "GitHub",
+    authorizeUrl: "https://github.com/login/oauth/authorize",
+    scope: "user:email",
+    fetchIdentity: fetchGithubIdentity
+  }
+};
+function providerOf(value) {
+  return RELAY_GIT_HOSTS.includes(value) ? value : null;
+}
+function relayAuthorizeUrl(provider, client, redirectUri, state) {
+  const host = GIT_HOST_AUTH[provider];
+  const url = new URL(host.authorizeUrl);
+  url.searchParams.set("client_id", client.clientId);
+  url.searchParams.set("redirect_uri", redirectUri);
+  url.searchParams.set("scope", host.scope);
+  url.searchParams.set("state", state);
+  return url.toString();
+}
+async function readJson2(res) {
+  const text6 = await res.text();
+  if (!text6) return {};
+  try {
+    return JSON.parse(text6);
+  } catch {
+    throw new Error("Sign-in provider returned a non-JSON response.");
+  }
+}
+function accessToken(body) {
+  const token = body.access_token;
+  if (typeof token !== "string" || !token.trim()) {
+    const message = body.error_description;
+    throw new Error(typeof message === "string" && message.trim() ? message : "Sign-in provider rejected the code.");
+  }
+  return token.trim();
+}
+async function fetchGithubIdentity(client, code, redirectUri, fetchImpl) {
+  const tokenRes = await fetchImpl("https://github.com/login/oauth/access_token", {
+    method: "POST",
+    headers: { Accept: "application/json", "Content-Type": "application/json" },
+    body: JSON.stringify({
+      client_id: client.clientId,
+      client_secret: client.clientSecret,
+      code,
+      redirect_uri: redirectUri
+    })
+  });
+  const token = accessToken(await readJson2(tokenRes));
+  const userRes = await fetchImpl("https://api.github.com/user", {
+    headers: { Authorization: `Bearer ${token}`, Accept: "application/vnd.github+json", "User-Agent": "sideboard-relay" }
+  });
+  const user = await readJson2(userRes);
+  const subject = typeof user.id === "number" ? String(user.id) : "";
+  if (!subject) throw new Error("GitHub did not return an account id.");
+  const emailRes = await fetchImpl("https://api.github.com/user/emails", {
+    headers: { Authorization: `Bearer ${token}`, Accept: "application/vnd.github+json", "User-Agent": "sideboard-relay" }
+  });
+  const emails = await readJson2(emailRes);
+  const list = Array.isArray(emails) ? emails : [];
+  const primary = list.find((row) => row.primary === true && row.verified === true);
+  const anyVerified = list.find((row) => row.verified === true);
+  const chosen = primary ?? anyVerified;
+  const email = chosen && typeof chosen.email === "string" ? chosen.email : null;
+  return { issuer: GITHUB_ACCOUNT_ISSUER, subject, email, emailVerified: Boolean(email) };
+}
+async function fetchRelayIdentity(provider, client, code, redirectUri, fetchImpl) {
+  return GIT_HOST_AUTH[provider].fetchIdentity(client, code, redirectUri, fetchImpl);
+}
+async function readBody(req) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    size += buf.length;
+    if (size > 8192) throw new Error("body too large");
+    chunks.push(buf);
+  }
+  const text6 = Buffer.concat(chunks).toString("utf8").trim();
+  if (!text6) return {};
+  return JSON.parse(text6);
+}
+function sendJson2(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+  res.end(JSON.stringify(body));
+}
+function relayOAuthReturnPage(title, body) {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>${escapeHtml2(title)}</title>
+<style>
+  :root {
+    --bg: #09090b;
+    --card: #16171b;
+    --line: rgba(255, 255, 255, 0.08);
+    --text: #f4f5f7;
+    --muted: #9aa3ad;
+    --blue: #3b9eff;
+    --blue-fill: #0f7ed4;
+  }
+  * { box-sizing: border-box }
+  body {
+    margin: 0;
+    min-height: 100vh;
+    display: grid;
+    place-items: center;
+    padding: 48px 24px;
+    background:
+      radial-gradient(closest-side, rgba(15, 126, 212, 0.22), transparent 72%) center -120px / 720px 480px no-repeat,
+      var(--bg);
+    color: var(--text);
+    font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", "Helvetica Neue", sans-serif;
+    -webkit-font-smoothing: antialiased;
+  }
+  main {
+    width: min(28rem, 100%);
+    background: var(--card);
+    border: 1px solid var(--line);
+    border-radius: 16px;
+    padding: 28px 28px 32px;
+  }
+  .brand {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    margin: 0 0 22px;
+    font-weight: 650;
+    font-size: 17px;
+    letter-spacing: -0.02em;
+  }
+  .mark { position: relative; display: inline-block; width: 26px; height: 26px; flex: none }
+  .mark i { position: absolute; width: 18px; height: 18px; border-radius: 3px; transform: rotate(14deg) }
+  .mark i:first-child { left: 6px; top: 6px; background: var(--blue-fill) }
+  .mark i:last-child { left: 1px; top: 1px; border: 2px solid #d7dbdf }
+  h1 { margin: 0; font-size: 1.5rem; line-height: 1.2; letter-spacing: -0.03em; font-weight: 650 }
+  p { margin: 10px 0 0; line-height: 1.55; color: var(--muted) }
+  a { color: var(--blue) }
+</style>
+</head>
+<body>
+<main>
+  <div class="brand"><span class="mark" aria-hidden="true"><i></i><i></i></span>Sideboard</div>
+  ${body}
+</main>
+</body>
+</html>`;
+}
+function sendHtml(res, status, title, body) {
+  res.writeHead(status, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
+  res.end(relayOAuthReturnPage(title, body));
+}
+async function handleRelayAccountHttp(opts) {
+  const reqUrl = opts.req.url || "/";
+  const path2 = reqUrl.split("?")[0];
+  const method = opts.req.method || "GET";
+  const origin = opts.publicOrigin.replace(/\/+$/, "");
+  const redirectUri = `${origin}${REMOTE_OAUTH_CALLBACK_PATH}`;
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  if (method === "POST" && path2 === REMOTE_LOGIN_PATH) {
+    let body;
+    try {
+      body = await readBody(opts.req);
+    } catch {
+      sendJson2(opts.res, 400, { ok: false, error: "invalid login request" });
+      return true;
+    }
+    const provider = providerOf(typeof body.provider === "string" ? body.provider : "");
+    const state = typeof body.state === "string" ? body.state.trim() : "";
+    if (!provider || !STATE_RE.test(state)) {
+      sendJson2(opts.res, 400, { ok: false, error: "invalid login request" });
+      return true;
+    }
+    const client = opts.oauth[provider];
+    if (!client?.clientId || !client.clientSecret) {
+      sendJson2(opts.res, 503, {
+        ok: false,
+        error: `${GIT_HOST_AUTH[provider].label} sign-in is not configured on this relay.`
+      });
+      return true;
+    }
+    let accountId = null;
+    const linkToken = typeof body.accountToken === "string" ? body.accountToken.trim() : "";
+    if (linkToken) {
+      accountId = opts.store.verifyCredential(linkToken);
+      if (!accountId) {
+        sendJson2(opts.res, 401, { ok: false, error: "sign in required" });
+        return true;
+      }
+    }
+    opts.sessions.begin(state, provider, accountId);
+    sendJson2(opts.res, 200, { ok: true, url: relayAuthorizeUrl(provider, client, redirectUri, state) });
+    return true;
+  }
+  if (method === "GET" && path2 === REMOTE_OAUTH_CALLBACK_PATH) {
+    const url = new URL(reqUrl, origin);
+    const state = url.searchParams.get("state")?.trim() ?? "";
+    const code = url.searchParams.get("code")?.trim() ?? "";
+    const providerError = url.searchParams.get("error")?.trim() ?? "";
+    const pending = STATE_RE.test(state) ? opts.sessions.takeLogin(state) : null;
+    if (!pending) {
+      sendHtml(opts.res, 400, "Sideboard", "<h1>Sign-in expired</h1><p>Return to Sideboard and try again.</p>");
+      return true;
+    }
+    if (providerError || !code) {
+      const message = providerError || "Sign-in was cancelled.";
+      opts.sessions.putResult(state, { ok: false, error: message });
+      sendHtml(opts.res, 400, "Sideboard", `<h1>Could not sign in</h1><p>${escapeHtml2(message)}</p>`);
+      return true;
+    }
+    const client = opts.oauth[pending.provider];
+    if (!client) {
+      opts.sessions.putResult(state, { ok: false, error: "Sign-in is not configured on this relay." });
+      sendHtml(opts.res, 503, "Sideboard", "<h1>Sign-in is not configured</h1>");
+      return true;
+    }
+    try {
+      const identity = await fetchRelayIdentity(pending.provider, client, code, redirectUri, fetchImpl);
+      const signed = opts.store.signIn(identity, pending.accountId);
+      opts.sessions.putResult(state, {
+        ok: true,
+        credential: signed.credential,
+        email: signed.email,
+        accountId: signed.accountId
+      });
+      sendHtml(
+        opts.res,
+        200,
+        "Sideboard",
+        "<h1>Signed in</h1><p>Return to Sideboard. This window can close.</p>"
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      opts.sessions.putResult(state, { ok: false, error: message });
+      sendHtml(opts.res, 400, "Sideboard", `<h1>Could not sign in</h1><p>${escapeHtml2(message)}</p>`);
+    }
+    return true;
+  }
+  if (method === "GET" && path2 === REMOTE_OAUTH_RESULT_PATH) {
+    const url = new URL(reqUrl, origin);
+    const state = url.searchParams.get("state")?.trim() ?? "";
+    if (!STATE_RE.test(state)) {
+      sendJson2(opts.res, 400, { ok: false, error: "invalid login request" });
+      return true;
+    }
+    const result = opts.sessions.takeResult(state);
+    if (result === void 0 || result === null) {
+      sendJson2(opts.res, 404, { ok: false, error: "pending" });
+      return true;
+    }
+    if (!result.ok) {
+      sendJson2(opts.res, 400, { ok: false, error: result.error });
+      return true;
+    }
+    sendJson2(opts.res, 200, {
+      ok: true,
+      credential: result.credential,
+      email: result.email,
+      accountId: result.accountId
+    });
+    return true;
+  }
+  if (method === "POST" && path2 === REMOTE_LOGOUT_PATH) {
+    let body;
+    try {
+      body = await readBody(opts.req);
+    } catch {
+      sendJson2(opts.res, 400, { ok: false, error: "invalid logout request" });
+      return true;
+    }
+    const token = typeof body.accountToken === "string" ? body.accountToken : "";
+    opts.store.logout(token);
+    sendJson2(opts.res, 200, { ok: true });
+    return true;
+  }
+  return false;
+}
+
+// src/relay/account-login.ts
+var RemoteAccountLoginCancelled = class extends Error {
+  constructor() {
+    super("Sign-in cancelled");
+    this.name = "RemoteAccountLoginCancelled";
+  }
+};
+function isRemoteAccountLoginCancelled(err) {
+  return err instanceof RemoteAccountLoginCancelled;
+}
+function remoteAccountHttpOrigin(wsUrl = remoteRelayUrl()) {
+  const url = new URL(wsUrl);
+  url.protocol = url.protocol === "wss:" ? "https:" : "http:";
+  url.pathname = "";
+  url.search = "";
+  url.hash = "";
+  return url.origin;
+}
+function sleep2(ms, signal) {
+  return new Promise((resolve2, reject) => {
+    if (signal?.aborted) {
+      reject(new RemoteAccountLoginCancelled());
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve2();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(new RemoteAccountLoginCancelled());
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function startRemoteAccountLogin(opts) {
+  if (opts.signal?.aborted) throw new RemoteAccountLoginCancelled();
+  const origin = (opts.origin ?? remoteAccountHttpOrigin()).replace(/\/+$/, "");
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const state = (0, import_node_crypto27.randomBytes)(16).toString("hex");
+  const timeoutMs = opts.timeoutMs ?? 5 * 6e4;
+  const pollIntervalMs = opts.pollIntervalMs ?? 400;
+  const linkToken = opts.linkToken?.trim() ?? "";
+  const started = await fetchImpl(`${origin}${REMOTE_LOGIN_PATH}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      provider: opts.provider,
+      state,
+      ...linkToken ? { accountToken: linkToken } : {}
+    })
+  });
+  const startBody = await started.json();
+  if (!started.ok || !startBody.url) {
+    throw new Error(startBody.error || "Could not start sign-in.");
+  }
+  await Promise.resolve(opts.openUrl?.(startBody.url));
+  const deadline = Date.now() + timeoutMs;
+  const resultUrl = `${origin}${REMOTE_OAUTH_RESULT_PATH}?state=${encodeURIComponent(state)}`;
+  while (Date.now() < deadline) {
+    if (opts.signal?.aborted) throw new RemoteAccountLoginCancelled();
+    let res;
+    try {
+      res = await fetchImpl(resultUrl);
+    } catch {
+      if (opts.signal?.aborted) throw new RemoteAccountLoginCancelled();
+      await sleep2(pollIntervalMs, opts.signal);
+      continue;
+    }
+    let data;
+    try {
+      data = await res.json();
+    } catch {
+      await sleep2(pollIntervalMs, opts.signal);
+      continue;
+    }
+    if (data.ok && data.credential && data.accountId) {
+      return {
+        credential: data.credential,
+        email: data.email ?? null,
+        accountId: data.accountId
+      };
+    }
+    if (data.error && data.error !== "pending") throw new Error(data.error);
+    await sleep2(pollIntervalMs, opts.signal);
+  }
+  throw new Error("Sign-in timed out.");
+}
+async function disconnectRemoteAccount(opts) {
+  const origin = (opts.origin ?? remoteAccountHttpOrigin()).replace(/\/+$/, "");
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  await fetchImpl(`${origin}${REMOTE_LOGOUT_PATH}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ accountToken: opts.accountToken })
+  });
+}
+
 // src/slack/app-home.ts
 var SLACK_APP_HOME_DOWNLOAD = "https://sideboard-downloads.t3.tigrisfiles.io/Sideboard-latest-arm64.dmg";
 var SLACK_APP_HOME_LANDING = "https://www.sideboard.cloud/slack/";
@@ -39431,9 +41171,9 @@ var import_node_http5 = require("http");
 var import_ws6 = require("ws");
 
 // src/relay/static.ts
-var import_node_fs70 = require("fs");
+var import_node_fs71 = require("fs");
 var import_promises = require("fs/promises");
-var import_node_path68 = __toESM(require("path"), 1);
+var import_node_path69 = __toESM(require("path"), 1);
 var TYPES = {
   ".css": "text/css; charset=utf-8",
   ".html": "text/html; charset=utf-8",
@@ -39464,9 +41204,9 @@ function resolveStaticPath(root, requestUrl) {
     return null;
   }
   if (!pathname.startsWith("/") || pathname.includes("\0")) return null;
-  const rootResolved = import_node_path68.default.resolve(root);
-  const candidate = import_node_path68.default.resolve(rootResolved, `.${pathname}`);
-  if (candidate !== rootResolved && !candidate.startsWith(rootResolved + import_node_path68.default.sep)) {
+  const rootResolved = import_node_path69.default.resolve(root);
+  const candidate = import_node_path69.default.resolve(rootResolved, `.${pathname}`);
+  if (candidate !== rootResolved && !candidate.startsWith(rootResolved + import_node_path69.default.sep)) {
     return null;
   }
   return candidate;
@@ -39480,7 +41220,7 @@ async function fileSize(file) {
   }
 }
 function sendFile(req, res, file, size) {
-  const ext = import_node_path68.default.extname(file).toLowerCase();
+  const ext = import_node_path69.default.extname(file).toLowerCase();
   res.writeHead(200, {
     "Content-Type": TYPES[ext] ?? "application/octet-stream",
     "Content-Length": size,
@@ -39490,7 +41230,7 @@ function sendFile(req, res, file, size) {
     res.end();
     return true;
   }
-  (0, import_node_fs70.createReadStream)(file).pipe(res);
+  (0, import_node_fs71.createReadStream)(file).pipe(res);
   return true;
 }
 async function tryServeStatic(req, res, root) {
@@ -39499,7 +41239,7 @@ async function tryServeStatic(req, res, root) {
   if (!candidate) return false;
   const direct = await fileSize(candidate);
   if (direct != null) return sendFile(req, res, candidate, direct);
-  const asIndex = import_node_path68.default.join(candidate, "index.html");
+  const asIndex = import_node_path69.default.join(candidate, "index.html");
   const indexSize = await fileSize(asIndex);
   if (indexSize != null) return sendFile(req, res, asIndex, indexSize);
   return false;
@@ -39507,14 +41247,19 @@ async function tryServeStatic(req, res, root) {
 
 // src/relay/server.ts
 init_abletime_oauth();
-function sendHtml(res, status, title, body) {
+function sendHtml2(res, status, title, body) {
   res.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
   res.end(slackOAuthHtmlPage(title, body));
 }
-function sendJson2(res, status, body) {
+function sendJson3(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(JSON.stringify(body));
 }
+function relayClientIp(req) {
+  const fly = req.headers["fly-client-ip"];
+  if (typeof fly === "string" && fly.trim()) return fly.trim();
+  return req.socket.remoteAddress ?? "unknown";
+}
 function startRelaySocketPing(ws, intervalMs) {
   const ping = setInterval(() => {
     if (ws.readyState !== ws.OPEN) {
@@ -39542,11 +41287,26 @@ async function startRelayServer(opts) {
   const clientSecret = (opts.clientSecret ?? process.env.SIDEBOARD_SLACK_CLIENT_SECRET ?? "").trim();
   const redirectUri = (opts.oauthRedirectUri ?? slackOAuthRelayRedirectUri()).trim();
   const pending = new SlackOAuthPendingStore();
+  let boundPort = 0;
   const hub = opts.hub ?? new SlackRelayHub({
     fetchImpl: opts.fetchImpl ?? fetch,
     onLog: log
   });
-  const remoteHub = new RemoteHub();
+  const accountsPath = opts.accountsPath?.trim() ?? "";
+  if (accountsPath) assertRelayAccountsDurable(accountsPath);
+  const accountStore = accountsPath ? new RelayAccountStore(accountsPath) : null;
+  const accountSessions = new RelayLoginSessions();
+  const relayOAuth = opts.relayOAuth ?? {};
+  const authMarks = /* @__PURE__ */ new Map();
+  const remoteByIp = /* @__PURE__ */ new Map();
+  let remoteSockets = 0;
+  const remoteHub = new RemoteHub({
+    authorizeHost: accountStore ? (input) => {
+      const decision = accountStore.authorizeHost(input);
+      return decision.ok ? { ok: true } : { ok: false, message: decision.message };
+    } : void 0,
+    onAuthorized: (socket) => authMarks.get(socket)?.()
+  });
   const handleCallback = async (reqUrl, res) => {
     const url2 = parseSlackOAuthCallbackUrl(reqUrl);
     if (!url2) return false;
@@ -39555,7 +41315,7 @@ async function startRelayServer(opts) {
     const code = url2.searchParams.get("code")?.trim() ?? "";
     if (error) {
       if (state) pending.put(state, { ok: false, error: `Slack OAuth: ${error}` });
-      sendHtml(
+      sendHtml2(
         res,
         400,
         "Slack",
@@ -39564,7 +41324,7 @@ async function startRelayServer(opts) {
       return true;
     }
     if (!state || !code) {
-      sendHtml(res, 400, "Slack", "<h1>Invalid callback</h1><p>State or code missing.</p>");
+      sendHtml2(res, 400, "Slack", "<h1>Invalid callback</h1><p>State or code missing.</p>");
       return true;
     }
     if (!clientSecret) {
@@ -39572,7 +41332,7 @@ async function startRelayServer(opts) {
         ok: false,
         error: "Relay is missing SIDEBOARD_SLACK_CLIENT_SECRET"
       });
-      sendHtml(
+      sendHtml2(
         res,
         500,
         "Slack",
@@ -39595,7 +41355,7 @@ async function startRelayServer(opts) {
           void hub.handleAppHomeOpened(payload.team_id, payload.user_id);
         }
       }
-      sendHtml(
+      sendHtml2(
         res,
         200,
         "Slack connected",
@@ -39604,7 +41364,7 @@ async function startRelayServer(opts) {
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       pending.put(state, { ok: false, error: message });
-      sendHtml(res, 400, "Slack", `<h1>Could not connect Slack</h1><p>${escapeHtml2(message)}</p>`);
+      sendHtml2(res, 400, "Slack", `<h1>Could not connect Slack</h1><p>${escapeHtml2(message)}</p>`);
     }
     return true;
   };
@@ -39614,19 +41374,30 @@ async function startRelayServer(opts) {
     const state = url2.searchParams.get("state")?.trim() ?? "";
     const value = pending.take(state);
     if (!value) {
-      sendJson2(res, 404, { ok: false, error: "pending" });
+      sendJson3(res, 404, { ok: false, error: "pending" });
       return true;
     }
     if (!value.ok) {
-      sendJson2(res, 400, { ok: false, error: value.error });
+      sendJson3(res, 400, { ok: false, error: value.error });
       return true;
     }
-    sendJson2(res, 200, { ok: true, ...value.payload });
+    sendJson3(res, 200, { ok: true, ...value.payload });
     return true;
   };
   const httpServer = (0, import_node_http5.createServer)((req, res) => {
     void (async () => {
       const reqUrl = req.url || "/";
+      if (accountStore && await handleRelayAccountHttp({
+        req,
+        res,
+        store: accountStore,
+        oauth: relayOAuth,
+        sessions: accountSessions,
+        publicOrigin: opts.relayPublicOrigin?.trim() || process.env.SIDEBOARD_RELAY_PUBLIC_ORIGIN?.trim() || `http://127.0.0.1:${boundPort}`,
+        fetchImpl: opts.fetchImpl
+      })) {
+        return;
+      }
       if (await handleCallback(reqUrl, res)) return;
       if (handleResult(reqUrl, res)) return;
       const ableTimeBounce = ableTimeOAuthLocalBounceUrl(reqUrl);
@@ -39640,7 +41411,7 @@ async function startRelayServer(opts) {
         return;
       }
       if (req.url === "/health") {
-        sendJson2(res, 200, {
+        sendJson3(res, 200, {
           ok: true,
           service: "sideboard-relay",
           sessions: hub.listSessions().length,
@@ -39659,7 +41430,7 @@ async function startRelayServer(opts) {
         return;
       }
       if (req.url === "/") {
-        sendJson2(res, 200, {
+        sendJson3(res, 200, {
           ok: true,
           service: "sideboard-relay",
           sessions: hub.listSessions().length,
@@ -39686,6 +41457,14 @@ async function startRelayServer(opts) {
       socket.destroy();
       return;
     }
+    if (target === remoteWss) {
+      const ip = relayClientIp(req);
+      const count = remoteByIp.get(ip) ?? 0;
+      if (count >= 20 || remoteSockets >= 4e3) {
+        socket.destroy();
+        return;
+      }
+    }
     target.handleUpgrade(req, socket, head, (ws) => {
       target.emit("connection", ws, req);
     });
@@ -39720,7 +41499,10 @@ async function startRelayServer(opts) {
       hub.detachSocket(socket);
     });
   });
-  remoteWss.on("connection", (ws) => {
+  remoteWss.on("connection", (ws, req) => {
+    const ip = relayClientIp(req);
+    remoteByIp.set(ip, (remoteByIp.get(ip) ?? 0) + 1);
+    remoteSockets += 1;
     const socket = {
       send: (data) => {
         if (ws.readyState === ws.OPEN) ws.send(data);
@@ -39732,14 +41514,35 @@ async function startRelayServer(opts) {
         }
       }
     };
+    let released = false;
+    const authTimer = accountStore ? setTimeout(() => {
+      try {
+        ws.close(4001, "sign in required");
+      } catch {
+      }
+    }, 12e4) : null;
+    authMarks.set(socket, () => {
+      if (authTimer) clearTimeout(authTimer);
+    });
+    const release = () => {
+      if (released) return;
+      released = true;
+      if (authTimer) clearTimeout(authTimer);
+      authMarks.delete(socket);
+      remoteSockets -= 1;
+      const next = (remoteByIp.get(ip) ?? 1) - 1;
+      if (next <= 0) remoteByIp.delete(ip);
+      else remoteByIp.set(ip, next);
+      remoteHub.detachSocket(socket);
+    };
     startRelaySocketPing(ws, REMOTE_PING_INTERVAL_MS);
     log("remote client connected");
     ws.on("message", (data) => {
       const raw = typeof data === "string" ? data : data.toString("utf8");
       remoteHub.handleClientMessage(socket, raw);
     });
-    ws.on("close", () => remoteHub.detachSocket(socket));
-    ws.on("error", () => remoteHub.detachSocket(socket));
+    ws.on("close", release);
+    ws.on("error", release);
   });
   const port = opts.port ?? 0;
   const host = opts.host ?? "0.0.0.0";
@@ -39748,7 +41551,7 @@ async function startRelayServer(opts) {
     httpServer.listen(port, host, () => resolve2());
   });
   const address = httpServer.address();
-  const boundPort = typeof address === "object" && address ? address.port : typeof port === "number" ? port : 0;
+  boundPort = typeof address === "object" && address ? address.port : typeof port === "number" ? port : 0;
   const url = `ws://${host === "0.0.0.0" ? "127.0.0.1" : host}:${boundPort}${SLACK_RELAY_DESKTOP_PATH}`;
   log(`relay listening on ${url}`);
   const ac = new AbortController();
@@ -39791,13 +41594,14 @@ async function startRelayServer(opts) {
         httpServer.close((err) => err ? reject(err) : resolve2());
       });
       await socketModeDone.catch(() => void 0);
+      accountStore?.close();
     }
   };
 }
 
 // src/slack/outbound-watch.ts
-var import_node_fs71 = require("fs");
-var import_node_path69 = require("path");
+var import_node_fs72 = require("fs");
+var import_node_path70 = require("path");
 init_paths();
 init_private_file();
 init_secure_file();
@@ -39810,7 +41614,7 @@ var POLL_INTERVAL_MS = 12e3;
 var lastPollMs = 0;
 var nameCache = /* @__PURE__ */ new Map();
 function storePath4() {
-  return (0, import_node_path69.join)(appDataDir(), "slack-outbound-watch.json");
+  return (0, import_node_path70.join)(appDataDir(), "slack-outbound-watch.json");
 }
 function watchId(teamId, channelId, ts) {
   return `${teamId}:${channelId}:${ts}`;
@@ -39823,9 +41627,9 @@ function tsNewer(a, b) {
 }
 function readStore4() {
   const path2 = storePath4();
-  if (!(0, import_node_fs71.existsSync)(path2)) return [];
+  if (!(0, import_node_fs72.existsSync)(path2)) return [];
   try {
-    const parsed = isSecureFileEncrypted(path2) ? readSecureJson(path2) : JSON.parse((0, import_node_fs71.readFileSync)(path2, "utf8"));
+    const parsed = isSecureFileEncrypted(path2) ? readSecureJson(path2) : JSON.parse((0, import_node_fs72.readFileSync)(path2, "utf8"));
     return Array.isArray(parsed?.watches) ? parsed.watches : [];
   } catch {
     return [];
@@ -40470,6 +42274,7 @@ async function pollSlackOutboundWatches(opts) {
   disconnectLinear,
   disconnectLinearConnection,
   disconnectOptionalService,
+  disconnectRemoteAccount,
   disconnectSlackWorkspace,
   discoverSkills,
   downloadAbleTimeAttachment,
@@ -40726,6 +42531,7 @@ async function pollSlackOutboundWatches(opts) {
   isPrNotMergeableError,
   isPresentPlanToolName,
   isPrimaryCheckoutThread,
+  isRemoteAccountLoginCancelled,
   isRemoteStopCommand,
   isSelfWrittenRecord,
   isSessionQuotaLimit,
@@ -41087,6 +42893,7 @@ async function pollSlackOutboundWatches(opts) {
   startMcpServer,
   startOrchestration,
   startRelayServer,
+  startRemoteAccountLogin,
   startSlackOAuth,
   statWorktreePath,
   stopAgentRpcServer,