appduct 0.14.0 → 0.15.0

package/dist/cli/routes/mcp.js

@@ -14,6 +14,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "daemonLogMaxBytes",
   "eventsLogMaxBytes",
   "policy",
+  "webOrigins",
   "advertisedIp",
   "scheme",
   "restartDaemonOnVersionMismatch"
@@ -74,6 +75,7 @@ var defaultConfig = (paths) => {
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
     eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
+    webOrigins: [],
     policy: {
       default: "allow",
       destructive: "allow"
@@ -144,6 +146,12 @@ var loadConfig = async (paths, options = {}) => {
       "restartDaemonOnVersionMismatch"
     );
   }
+  if (parsed.webOrigins !== void 0) {
+    if (!Array.isArray(parsed.webOrigins)) {
+      throw configError("webOrigins", "must be an array of origin strings.");
+    }
+    config.webOrigins = parsed.webOrigins.map((origin) => requireNonEmptyString(origin, "webOrigins"));
+  }
   if (parsed.policy !== void 0) {
     if (typeof parsed.policy !== "object" || parsed.policy === null || Array.isArray(parsed.policy)) {
       throw configError("policy", "must be an object.");
@@ -1069,7 +1077,7 @@ var EXIT_CODE_BY_ERROR_TYPE = {
   // EX_NOINPUT (66): "an input file did not exist or was not readable" — `doctor` throws this for a
   // missing external tool or an unreadable/corrupt artifact, deliberately distinct from every other
   // code here so a release pipeline can't mistake "we couldn't tell" for either a clean pass or an
-  // assertion failure (docs/tasks/08-appduct-doctor.md).
+  // assertion failure.
   inspection_error: 66,
   connection_error: 70,
   session_error: 71,
@@ -1829,23 +1837,34 @@ var probeIosProjectYml = async (root) => {
   };
 };
 var PROBES = [
-  probeAndroidGradle,
-  probeAndroidManifest,
-  probeIosInfoPlist,
-  probeIosProjectYml
+  ["android", probeAndroidGradle],
+  ["android", probeAndroidManifest],
+  ["ios", probeIosInfoPlist],
+  ["ios", probeIosProjectYml]
 ];
+var isFlutterProject = async (root) => {
+  return (await readCappedText(join5(root, "pubspec.yaml"))).ok;
+};
 var discoverNativeScheme = async (root) => {
   const tried = [];
   const results = [];
-  for (const probe of PROBES) {
-    const outcome = await probe(root);
-    tried.push(...outcome.tried);
-    if (outcome.result !== void 0) {
-      results.push(outcome.result);
+  const flutter = await isFlutterProject(root);
+  const androidRoot = flutter ? join5(root, "android") : root;
+  const iosRoots = flutter ? [join5(root, "ios"), join5(root, "macos")] : [root];
+  for (const [platform, probe] of PROBES) {
+    let roots = [root];
+    if (platform === "android") {
+      roots = [androidRoot];
+    } else if (probe === probeIosInfoPlist) {
+      roots = iosRoots;
+    }
+    for (const probeRoot of roots) {
+      const outcome = await probe(probeRoot);
+      tried.push(...outcome.tried);
+      if (outcome.result !== void 0) {
+        results.push(outcome.result);
+      }
     }
-  }
-  if (results.length === 0) {
-    return { tried };
   }
   const distinctSchemes = new Set(results.map((entry) => entry.scheme));
   if (distinctSchemes.size > 1) {
@@ -1853,7 +1872,7 @@ var discoverNativeScheme = async (root) => {
       "Conflicting deep-link schemes found in this project: " + results.map((entry) => `${entry.origin} says ${JSON.stringify(entry.scheme)}`).join(", but ") + ". Appduct will not guess which one is right \u2014 pass --scheme <scheme> to pick one."
     );
   }
-  return { result: results[0], tried };
+  return { results, tried };
 };
 
 // src/scheme.ts
@@ -1916,19 +1935,21 @@ var discoverStaticProjectScheme = async (cwd) => {
   const tried = [`${appJsonPath} ("expo.scheme")`];
   const appJsonScheme = await discoverExpoScheme(cwd);
   if (appJsonScheme !== void 0) {
-    return { scheme: appJsonScheme, source: "app-json", origin: appJsonPath, tried };
+    return { scheme: appJsonScheme, source: "app-json", origin: appJsonPath, nativeResults: [], tried };
   }
   const native = await discoverNativeScheme(resolve(cwd));
   tried.push(...native.tried);
-  if (native.result !== void 0) {
+  const [first] = native.results;
+  if (first !== void 0) {
     return {
-      scheme: native.result.scheme,
-      source: native.result.source,
-      origin: native.result.origin,
+      scheme: first.scheme,
+      source: first.source,
+      origin: first.origin,
+      nativeResults: native.results,
       tried
     };
   }
-  return { tried };
+  return { nativeResults: [], tried };
 };
 var globalConfigDirs = (options = {}) => {
   const excluded = /* @__PURE__ */ new Set([join6(resolve(options.homeDir ?? homedir()), PROJECT_CONFIG_DIR)]);
@@ -2104,6 +2125,25 @@ ${tried.map((location, index) => `  ${index + 1}. ${location}`).join("\n")}
 
 // src/link.ts
 var composeDeepLink = (scheme, result) => `${scheme}:///?appduct=${result.deepLinkPayload}&pin=${encodeURIComponent(result.pin)}`;
+var assertWebPageUrl = (pageUrl) => {
+  let protocol;
+  try {
+    protocol = new URL(pageUrl).protocol;
+  } catch {
+  }
+  if (protocol !== "http:" && protocol !== "https:") {
+    throw usageError(`"url" must be an http(s) URL (got "${pageUrl}").`);
+  }
+};
+var composeWebLink = (pageUrl, result) => {
+  const payload = result.deepLinkPayload;
+  return {
+    sessionId: result.sessionId,
+    url: `${pageUrl.split("#")[0]}#appduct=${payload}`,
+    script: `window.__APPDUCT__.connect("${payload}")`,
+    expiresAt: result.expiresAt
+  };
+};
 
 // src/qr-terminal.ts
 import { toQR } from "toqr";
@@ -2146,14 +2186,18 @@ var WAIT_FOR_SESSION_TOOL_NAME = "appduct_wait_for_session";
 var OPEN_TARGET_ADDRESS_OVERRIDE = "127.0.0.1";
 var DEFAULT_WAIT_TIMEOUT_MS = 12e4;
 var NO_TARGET = "none";
+var WEB_TARGET = "web";
 var QR_INSTRUCTIONS = 'This link was NOT delivered to a device \u2014 a human has to open it. Before calling appduct_wait_for_session: show the user the "qr" field verbatim inside a fenced code block (it is pre-rendered terminal art \u2014 do not redraw, summarize, or describe it), show "deepLink" underneath it for a device that cannot scan, and ask the user to scan it with the target device. Only then call appduct_wait_for_session; it blocks until the device connects and gives no output while it waits, so calling it before you have asked will look like a hang.';
 var CONNECT_TOOL_DESCRIPTOR = {
   name: CONNECT_TOOL_NAME,
-  description: 'Mint an Appduct session link and get it onto a device. With no "target", auto-detects a booted iOS simulator or attached Android device and delivers the link to it, returning { sessionId, delivered: true, autoDetected: true } \u2014 this is the normal agent path and needs no human. Pass target "android" or "ios-sim" (optionally with "device") to choose explicitly, or target "none" to force the human flow. Delivering to "android" (explicit or auto-detected) needs "appId" (the Android package name) \u2014 without it, more than one installed app declaring the same scheme would show an ambiguous "Open with" chooser on the device instead of failing loudly. Target "ios-device" is an experimental, never-auto-detected path that delivers to a paired physical iPhone/iPad via xcrun devicectl; it needs "appId" (the iOS bundle id), iOS 17+, Xcode 15+, a connected and trusted device with Developer Mode on, a dev-signed build installed, and the phone on the same network as this machine. An "appId" not supplied here falls back to "appId.<platform>" in the nearest .appduct/config.json (see "appduct init"); it is rejected outright with target "ios-sim" or "none", which need no app id. Pass "relaunch": true with ios-device if the app is already running and the delivery does not take. Only when no device is detected (or target is "none") does this return a QR code for a human to scan, along with an "instructions" field saying what to do with it. Follow up with appduct_wait_for_session to know when the device has connected.',
+  description: `Mint an Appduct session link and get it onto a device. With no "target", auto-detects a booted iOS simulator or attached Android device and delivers the link to it, returning { sessionId, delivered: true, autoDetected: true } \u2014 this is the normal agent path and needs no human. Pass target "android" or "ios-sim" (optionally with "device") to choose explicitly, or target "none" to force the human flow. Delivering to "android" (explicit or auto-detected) needs "appId" (the Android package name) \u2014 without it, more than one installed app declaring the same scheme would show an ambiguous "Open with" chooser on the device instead of failing loudly. Target "ios-device" is an experimental, never-auto-detected path that delivers to a paired physical iPhone/iPad via xcrun devicectl; it needs "appId" (the iOS bundle id), iOS 17+, Xcode 15+, a connected and trusted device with Developer Mode on, a dev-signed build installed, and the phone on the same network as this machine. An "appId" not supplied here falls back to "appId.<platform>" in the nearest .appduct/config.json (see "appduct init"); it is rejected outright with target "ios-sim" or "none", which need no app id. Pass "relaunch": true with ios-device if the app is already running and the delivery does not take. Target "web" is for a web page: pass "url" (the page to open) and get back { url, script } \u2014 open "url" in a browser, or run "script" in a page that is already open, then call appduct_wait_for_session. It needs no scheme and no device. To have the daemon attach a page that is already open in a Chrome launched with --remote-debugging-port, also pass "browserUrl" (its debugging endpoint on this machine: 127.0.0.1, [::1] or localhost, such as http://127.0.0.1:9222): the tab whose address starts with "url" is attached and the call returns { sessionId, url, targetId, attached: true }, with no further step; "url" is the tab's own address. When no tab or several match, the error lists the open tabs with their target ids; pass one as "targetId" to pick it. A popup, or a page in a new tab, is not attached. Only when no device is detected (or target is "none") does this return a QR code for a human to scan, along with an "instructions" field saying what to do with it. Follow up with appduct_wait_for_session to know when the device has connected.`,
   inputSchema: {
     type: "object",
     properties: {
-      target: { type: "string", enum: ["android", "ios-sim", "ios-device", NO_TARGET] },
+      target: { type: "string", enum: ["android", "ios-sim", "ios-device", NO_TARGET, WEB_TARGET] },
+      url: { type: "string" },
+      browserUrl: { type: "string" },
+      targetId: { type: "string" },
       device: { type: "string" },
       appId: { type: "string" },
       relaunch: { type: "boolean" },
@@ -2192,10 +2236,10 @@ var asOptionalConnectTarget = (value) => {
   if (value === void 0) {
     return void 0;
   }
-  if (typeof value !== "string" || !(isOpenTarget(value) || value === NO_TARGET)) {
+  if (typeof value !== "string" || !(isOpenTarget(value) || value === NO_TARGET || value === WEB_TARGET)) {
     throw new McpBuiltinToolError(
       "invalid_request",
-      '"target" must be "android", "ios-sim", "ios-device", or "none".'
+      '"target" must be "android", "ios-sim", "ios-device", "web", or "none".'
     );
   }
   return value;
@@ -2273,6 +2317,42 @@ var handleConnectTool = async (rawArgs, deps) => {
   const appId = asOptionalNonEmptyString(args.appId, "appId");
   const relaunch = asOptionalBoolean(args.relaunch, "relaunch");
   const ttlSeconds = asOptionalPositiveNumber(args.ttlSeconds, "ttlSeconds");
+  const url = asOptionalNonEmptyString(args.url, "url");
+  const browserUrl = asOptionalNonEmptyString(args.browserUrl, "browserUrl");
+  const targetId = asOptionalNonEmptyString(args.targetId, "targetId");
+  if ((browserUrl !== void 0 || targetId !== void 0) && requestedTarget !== WEB_TARGET) {
+    throw new McpBuiltinToolError("invalid_request", '"browserUrl" and "targetId" only apply with target "web".');
+  }
+  if (targetId !== void 0 && browserUrl === void 0) {
+    throw new McpBuiltinToolError("invalid_request", '"targetId" needs "browserUrl": it names a tab of that browser.');
+  }
+  if (requestedTarget === WEB_TARGET) {
+    if (url === void 0) {
+      throw new McpBuiltinToolError("invalid_request", '"url" (the page to open) is required with target "web".');
+    }
+    if (device !== void 0 || appId !== void 0 || relaunch !== void 0) {
+      throw new McpBuiltinToolError(
+        "invalid_request",
+        '"device", "appId" and "relaunch" do not apply with target "web".'
+      );
+    }
+    try {
+      assertWebPageUrl(url);
+    } catch (error) {
+      throw new McpBuiltinToolError("invalid_request", error.message);
+    }
+    if (browserUrl !== void 0) {
+      const attached = await deps.call(RPC_METHODS3.webAttach, { url, browserUrl, targetId, ttlSeconds });
+      return { ...attached, attached: true };
+    }
+    return composeWebLink(
+      url,
+      await deps.call(RPC_METHODS3.linkCreate, { ttlSeconds, transport: "web" })
+    );
+  }
+  if (url !== void 0) {
+    throw new McpBuiltinToolError("invalid_request", '"url" only applies with target "web".');
+  }
   if (device !== void 0 && (requestedTarget === void 0 || requestedTarget === NO_TARGET)) {
     throw new McpBuiltinToolError(
       "invalid_request",
@@ -3678,6 +3758,36 @@ var renderInvokeData = (colors, data, flags) => {
   return [colors.green("Result"), formatScalar(data, flags)];
 };
 var renderLinkData = (colors, data, flags, qr) => {
+  if ("attached" in data) {
+    return [
+      colors.green("Page Attached"),
+      ...renderFields(
+        "Page",
+        [
+          ["Session", data.sessionId],
+          ["Tab", data.targetId],
+          ["URL", data.url],
+          ["Expires", new Date(data.expiresAt * 1e3).toISOString()]
+        ],
+        flags
+      )
+    ];
+  }
+  if ("script" in data) {
+    return [
+      colors.green("Link Created"),
+      ...renderFields(
+        "Link",
+        [
+          ["Session", data.sessionId],
+          ["URL", data.url],
+          ["Script", data.script],
+          ["Expires", new Date(data.expiresAt * 1e3).toISOString()]
+        ],
+        flags
+      )
+    ];
+  }
   const lines = [
     colors.green("Link Created"),
     ...renderFields(
@@ -3798,6 +3908,7 @@ var renderDaemonStatusData = (colors, data, flags) => {
         ["PID", data.daemon.pid],
         ["Started at", data.daemon.started_at],
         ["WSS port", data.daemon.wss_port],
+        ["Web port", data.daemon.web_port],
         ["Pinned keys", data.daemon.pinned_keys.length],
         ["Sessions", data.daemon.session_count]
       ],

package/dist/cli/routes/sessions/index.js

@@ -93,7 +93,7 @@ var EXIT_CODE_BY_ERROR_TYPE = {
   // EX_NOINPUT (66): "an input file did not exist or was not readable" — `doctor` throws this for a
   // missing external tool or an unreadable/corrupt artifact, deliberately distinct from every other
   // code here so a release pipeline can't mistake "we couldn't tell" for either a clean pass or an
-  // assertion failure (docs/tasks/08-appduct-doctor.md).
+  // assertion failure.
   inspection_error: 66,
   connection_error: 70,
   session_error: 71,
@@ -549,6 +549,36 @@ var renderInvokeData = (colors, data, flags) => {
   return [colors.green("Result"), formatScalar(data, flags)];
 };
 var renderLinkData = (colors, data, flags, qr) => {
+  if ("attached" in data) {
+    return [
+      colors.green("Page Attached"),
+      ...renderFields(
+        "Page",
+        [
+          ["Session", data.sessionId],
+          ["Tab", data.targetId],
+          ["URL", data.url],
+          ["Expires", new Date(data.expiresAt * 1e3).toISOString()]
+        ],
+        flags
+      )
+    ];
+  }
+  if ("script" in data) {
+    return [
+      colors.green("Link Created"),
+      ...renderFields(
+        "Link",
+        [
+          ["Session", data.sessionId],
+          ["URL", data.url],
+          ["Script", data.script],
+          ["Expires", new Date(data.expiresAt * 1e3).toISOString()]
+        ],
+        flags
+      )
+    ];
+  }
   const lines = [
     colors.green("Link Created"),
     ...renderFields(
@@ -669,6 +699,7 @@ var renderDaemonStatusData = (colors, data, flags) => {
         ["PID", data.daemon.pid],
         ["Started at", data.daemon.started_at],
         ["WSS port", data.daemon.wss_port],
+        ["Web port", data.daemon.web_port],
         ["Pinned keys", data.daemon.pinned_keys.length],
         ["Sessions", data.daemon.session_count]
       ],

package/dist/cli/routes/sessions/link.js

@@ -27,6 +27,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "daemonLogMaxBytes",
   "eventsLogMaxBytes",
   "policy",
+  "webOrigins",
   "advertisedIp",
   "scheme",
   "restartDaemonOnVersionMismatch"
@@ -87,6 +88,7 @@ var defaultConfig = (paths) => {
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
     eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
+    webOrigins: [],
     policy: {
       default: "allow",
       destructive: "allow"
@@ -157,6 +159,12 @@ var loadConfig = async (paths, options = {}) => {
       "restartDaemonOnVersionMismatch"
     );
   }
+  if (parsed.webOrigins !== void 0) {
+    if (!Array.isArray(parsed.webOrigins)) {
+      throw configError("webOrigins", "must be an array of origin strings.");
+    }
+    config.webOrigins = parsed.webOrigins.map((origin) => requireNonEmptyString(origin, "webOrigins"));
+  }
   if (parsed.policy !== void 0) {
     if (typeof parsed.policy !== "object" || parsed.policy === null || Array.isArray(parsed.policy)) {
       throw configError("policy", "must be an object.");
@@ -916,7 +924,7 @@ var EXIT_CODE_BY_ERROR_TYPE = {
   // EX_NOINPUT (66): "an input file did not exist or was not readable" — `doctor` throws this for a
   // missing external tool or an unreadable/corrupt artifact, deliberately distinct from every other
   // code here so a release pipeline can't mistake "we couldn't tell" for either a clean pass or an
-  // assertion failure (docs/tasks/08-appduct-doctor.md).
+  // assertion failure.
   inspection_error: 66,
   connection_error: 70,
   session_error: 71,
@@ -1643,31 +1651,42 @@ var probeIosProjectYml = async (root) => {
   };
 };
 var PROBES = [
-  probeAndroidGradle,
-  probeAndroidManifest,
-  probeIosInfoPlist,
-  probeIosProjectYml
+  ["android", probeAndroidGradle],
+  ["android", probeAndroidManifest],
+  ["ios", probeIosInfoPlist],
+  ["ios", probeIosProjectYml]
 ];
+var isFlutterProject = async (root) => {
+  return (await readCappedText(join4(root, "pubspec.yaml"))).ok;
+};
 var discoverNativeScheme = async (root) => {
   const tried = [];
   const results = [];
-  for (const probe of PROBES) {
-    const outcome = await probe(root);
-    tried.push(...outcome.tried);
-    if (outcome.result !== void 0) {
-      results.push(outcome.result);
+  const flutter = await isFlutterProject(root);
+  const androidRoot = flutter ? join4(root, "android") : root;
+  const iosRoots = flutter ? [join4(root, "ios"), join4(root, "macos")] : [root];
+  for (const [platform, probe] of PROBES) {
+    let roots = [root];
+    if (platform === "android") {
+      roots = [androidRoot];
+    } else if (probe === probeIosInfoPlist) {
+      roots = iosRoots;
+    }
+    for (const probeRoot of roots) {
+      const outcome = await probe(probeRoot);
+      tried.push(...outcome.tried);
+      if (outcome.result !== void 0) {
+        results.push(outcome.result);
+      }
     }
   }
-  if (results.length === 0) {
-    return { tried };
-  }
   const distinctSchemes = new Set(results.map((entry) => entry.scheme));
   if (distinctSchemes.size > 1) {
     throw usageError(
       "Conflicting deep-link schemes found in this project: " + results.map((entry) => `${entry.origin} says ${JSON.stringify(entry.scheme)}`).join(", but ") + ". Appduct will not guess which one is right \u2014 pass --scheme <scheme> to pick one."
     );
   }
-  return { result: results[0], tried };
+  return { results, tried };
 };
 
 // src/scheme.ts
@@ -1730,19 +1749,21 @@ var discoverStaticProjectScheme = async (cwd) => {
   const tried = [`${appJsonPath} ("expo.scheme")`];
   const appJsonScheme = await discoverExpoScheme(cwd);
   if (appJsonScheme !== void 0) {
-    return { scheme: appJsonScheme, source: "app-json", origin: appJsonPath, tried };
+    return { scheme: appJsonScheme, source: "app-json", origin: appJsonPath, nativeResults: [], tried };
   }
   const native = await discoverNativeScheme(resolve(cwd));
   tried.push(...native.tried);
-  if (native.result !== void 0) {
+  const [first] = native.results;
+  if (first !== void 0) {
     return {
-      scheme: native.result.scheme,
-      source: native.result.source,
-      origin: native.result.origin,
+      scheme: first.scheme,
+      source: first.source,
+      origin: first.origin,
+      nativeResults: native.results,
       tried
     };
   }
-  return { tried };
+  return { nativeResults: [], tried };
 };
 var globalConfigDirs = (options = {}) => {
   const excluded = /* @__PURE__ */ new Set([join5(resolve(options.homeDir ?? homedir()), PROJECT_CONFIG_DIR)]);
@@ -1926,6 +1947,39 @@ ${tried.map((location, index) => `  ${index + 1}. ${location}`).join("\n")}
 // src/link.ts
 var OPEN_TARGET_ADDRESS_OVERRIDE = "127.0.0.1";
 var composeDeepLink = (scheme, result) => `${scheme}:///?appduct=${result.deepLinkPayload}&pin=${encodeURIComponent(result.pin)}`;
+var assertWebPageUrl = (pageUrl) => {
+  let protocol;
+  try {
+    protocol = new URL(pageUrl).protocol;
+  } catch {
+  }
+  if (protocol !== "http:" && protocol !== "https:") {
+    throw usageError(`"url" must be an http(s) URL (got "${pageUrl}").`);
+  }
+};
+var composeWebLink = (pageUrl, result) => {
+  const payload = result.deepLinkPayload;
+  return {
+    sessionId: result.sessionId,
+    url: `${pageUrl.split("#")[0]}#appduct=${payload}`,
+    script: `window.__APPDUCT__.connect("${payload}")`,
+    expiresAt: result.expiresAt
+  };
+};
+var mintWebLink = async (options) => {
+  assertWebPageUrl(options.url);
+  const result = await callDaemon(
+    RPC_METHODS2.linkCreate,
+    { ttlSeconds: options.ttlSeconds, transport: "web" },
+    { stateDir: options.stateDir, spawn: options.spawn, autoSpawn: options.autoSpawn }
+  );
+  return composeWebLink(options.url, result);
+};
+var attachWebTab = async ({ stateDir, spawn, autoSpawn, ...params }) => {
+  assertWebPageUrl(params.url);
+  const result = await callDaemon(RPC_METHODS2.webAttach, params, { stateDir, spawn, autoSpawn, requestTimeoutMs: 3e4 });
+  return { ...result, attached: true };
+};
 var mintLink = async (options) => {
   if (options.target !== void 0 && !isOpenTarget(options.target)) {
     throw usageError(
@@ -2013,6 +2067,9 @@ var mintLink = async (options) => {
 // src/commands/link.ts
 var handleLinkCommand = async (options, context) => {
   let openTarget;
+  if (options.browserUrl !== void 0 || options.targetId !== void 0) {
+    throw usageError('"--browser-url" and "--target-id" only apply with "--open web".');
+  }
   if (options.open !== void 0) {
     if (!isOpenTarget(options.open)) {
       throw usageError(
@@ -2046,6 +2103,35 @@ var handleLinkCommand = async (options, context) => {
   });
   return { ok: true, data: result };
 };
+var handleWebLinkCommand = async (options, context) => {
+  if (options.url === void 0) {
+    throw usageError('"--open web" needs the page URL: appduct sessions link --open web <url>.');
+  }
+  if (options.device !== void 0 || options.appId !== void 0 || options.relaunch !== void 0) {
+    throw usageError('"--device", "--app-id" and "--relaunch" do not apply with "--open web".');
+  }
+  if (options.targetId !== void 0 && options.browserUrl === void 0) {
+    throw usageError('"--target-id" needs "--browser-url": it names a tab of that browser.');
+  }
+  if (options.browserUrl !== void 0) {
+    const attached = await attachWebTab({
+      stateDir: context.stateDir,
+      spawn: context.spawn,
+      ttlSeconds: options.ttlSeconds,
+      url: options.url,
+      browserUrl: options.browserUrl,
+      targetId: options.targetId
+    });
+    return { ok: true, data: attached };
+  }
+  const result = await mintWebLink({
+    stateDir: context.stateDir,
+    spawn: context.spawn,
+    ttlSeconds: options.ttlSeconds,
+    url: options.url
+  });
+  return { ok: true, data: result };
+};
 
 // src/cli/command-options.ts
 var parsePositiveIntegerOption = (value, flagName) => {
@@ -2404,6 +2490,36 @@ var renderInvokeData = (colors, data, flags) => {
   return [colors.green("Result"), formatScalar(data, flags)];
 };
 var renderLinkData = (colors, data, flags, qr) => {
+  if ("attached" in data) {
+    return [
+      colors.green("Page Attached"),
+      ...renderFields(
+        "Page",
+        [
+          ["Session", data.sessionId],
+          ["Tab", data.targetId],
+          ["URL", data.url],
+          ["Expires", new Date(data.expiresAt * 1e3).toISOString()]
+        ],
+        flags
+      )
+    ];
+  }
+  if ("script" in data) {
+    return [
+      colors.green("Link Created"),
+      ...renderFields(
+        "Link",
+        [
+          ["Session", data.sessionId],
+          ["URL", data.url],
+          ["Script", data.script],
+          ["Expires", new Date(data.expiresAt * 1e3).toISOString()]
+        ],
+        flags
+      )
+    ];
+  }
   const lines = [
     colors.green("Link Created"),
     ...renderFields(
@@ -2524,6 +2640,7 @@ var renderDaemonStatusData = (colors, data, flags) => {
         ["PID", data.daemon.pid],
         ["Started at", data.daemon.started_at],
         ["WSS port", data.daemon.wss_port],
+        ["Web port", data.daemon.web_port],
         ["Pinned keys", data.daemon.pinned_keys.length],
         ["Sessions", data.daemon.session_count]
       ],
@@ -2747,10 +2864,13 @@ var route = async (context) => {
   return executeCommand(
     commandName(context),
     guarded(context)(
-      () => handleLinkCommand(
+      () => (options.open === "web" ? handleWebLinkCommand : handleLinkCommand)(
         {
           ttlSeconds: parsePositiveIntegerOption(options.ttl, "--ttl"),
           scheme: typeof options.scheme === "string" ? options.scheme : void 0,
+          url: context.args[0],
+          browserUrl: typeof options.browserUrl === "string" ? options.browserUrl : void 0,
+          targetId: typeof options.targetId === "string" ? options.targetId : void 0,
           open: typeof options.open === "string" ? options.open : void 0,
           device: typeof options.device === "string" ? options.device : void 0,
           // cac camelCases `--app-id`; the dashed spelling is kept as a fallback so a

package/dist/cli/routes/sessions/ls.js

@@ -24,6 +24,7 @@ var KNOWN_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "daemonLogMaxBytes",
   "eventsLogMaxBytes",
   "policy",
+  "webOrigins",
   "advertisedIp",
   "scheme",
   "restartDaemonOnVersionMismatch"
@@ -84,6 +85,7 @@ var defaultConfig = (paths) => {
     daemonLogMaxBytes: DEFAULT_DAEMON_LOG_MAX_BYTES,
     eventsLogMaxBytes: 10 * 1024 * 1024,
     restartDaemonOnVersionMismatch: false,
+    webOrigins: [],
     policy: {
       default: "allow",
       destructive: "allow"
@@ -154,6 +156,12 @@ var loadConfig = async (paths, options = {}) => {
       "restartDaemonOnVersionMismatch"
     );
   }
+  if (parsed.webOrigins !== void 0) {
+    if (!Array.isArray(parsed.webOrigins)) {
+      throw configError("webOrigins", "must be an array of origin strings.");
+    }
+    config.webOrigins = parsed.webOrigins.map((origin) => requireNonEmptyString(origin, "webOrigins"));
+  }
   if (parsed.policy !== void 0) {
     if (typeof parsed.policy !== "object" || parsed.policy === null || Array.isArray(parsed.policy)) {
       throw configError("policy", "must be an object.");
@@ -923,7 +931,7 @@ var EXIT_CODE_BY_ERROR_TYPE = {
   // EX_NOINPUT (66): "an input file did not exist or was not readable" — `doctor` throws this for a
   // missing external tool or an unreadable/corrupt artifact, deliberately distinct from every other
   // code here so a release pipeline can't mistake "we couldn't tell" for either a clean pass or an
-  // assertion failure (docs/tasks/08-appduct-doctor.md).
+  // assertion failure.
   inspection_error: 66,
   connection_error: 70,
   session_error: 71,
@@ -1376,6 +1384,36 @@ var renderInvokeData = (colors, data, flags) => {
   return [colors.green("Result"), formatScalar(data, flags)];
 };
 var renderLinkData = (colors, data, flags, qr) => {
+  if ("attached" in data) {
+    return [
+      colors.green("Page Attached"),
+      ...renderFields(
+        "Page",
+        [
+          ["Session", data.sessionId],
+          ["Tab", data.targetId],
+          ["URL", data.url],
+          ["Expires", new Date(data.expiresAt * 1e3).toISOString()]
+        ],
+        flags
+      )
+    ];
+  }
+  if ("script" in data) {
+    return [
+      colors.green("Link Created"),
+      ...renderFields(
+        "Link",
+        [
+          ["Session", data.sessionId],
+          ["URL", data.url],
+          ["Script", data.script],
+          ["Expires", new Date(data.expiresAt * 1e3).toISOString()]
+        ],
+        flags
+      )
+    ];
+  }
   const lines = [
     colors.green("Link Created"),
     ...renderFields(
@@ -1496,6 +1534,7 @@ var renderDaemonStatusData = (colors, data, flags) => {
         ["PID", data.daemon.pid],
         ["Started at", data.daemon.started_at],
         ["WSS port", data.daemon.wss_port],
+        ["Web port", data.daemon.web_port],
         ["Pinned keys", data.daemon.pinned_keys.length],
         ["Sessions", data.daemon.session_count]
       ],