friend-assistant 0.1.0 → 0.1.2

package/dist/friend.mjs

@@ -2111,6 +2111,7 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { ToolListChangedNotificationSchema } from "@modelcontextprotocol/sdk/types.js";
+import crossSpawn from "cross-spawn";
 import { createHash } from "node:crypto";
 
 // ../server/src/connectors/store.ts
@@ -2235,6 +2236,20 @@ function friendlyToolName(original, taken) {
   taken.add(out);
   return out;
 }
+function killTree(pid) {
+  try {
+    if (process.platform === "win32") crossSpawn("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true }).on("error", () => {
+    });
+    else process.kill(pid, "SIGKILL");
+  } catch {
+  }
+}
+async function stopLive(l) {
+  const pid = l.transport?.pid ?? null;
+  await Promise.race([l.client.close().catch(() => {
+  }), new Promise((r) => setTimeout(r, 3e3).unref?.())]);
+  if (pid) killTree(pid);
+}
 var messageOf = (e) => (e instanceof Error ? e.message : String(e)).slice(0, 400);
 var sleepReject = (ms, what) => new Promise((_, rej) => {
   const t = setTimeout(() => rej(new Error(what)), ms);
@@ -2374,13 +2389,14 @@ ${l.stderr}` : ""}`, isError: true };
     entry.connecting = (async () => {
       try {
         const transport = this.transportFor(cfg, entry);
+        entry.transport = transport;
         client.onclose = () => {
           if (this.live.get(id2) === entry && entry.status === "ready") {
             entry.status = "error";
             entry.error = "The connection closed.";
           }
         };
-        await Promise.race([client.connect(transport), sleepReject(this.opts.connectTimeoutMs ?? 3e4, "It did not answer in time.")]);
+        await Promise.race([client.connect(transport), sleepReject(this.opts.connectTimeoutMs ?? 6e4, "It did not answer in time.")]);
         await this.readTools(id2, entry);
         client.setNotificationHandler(ToolListChangedNotificationSchema, async () => {
           try {
@@ -2393,10 +2409,7 @@ ${l.stderr}` : ""}`, isError: true };
       } catch (e) {
         entry.status = "error";
         entry.error = `${messageOf(e)}${entry.stderr ? ` (${entry.stderr.trim().split("\n").slice(-2).join(" ").slice(0, 200)})` : ""}`;
-        try {
-          await client.close();
-        } catch {
-        }
+        await stopLive(entry);
         throw new Error(entry.error);
       } finally {
         entry.connecting = void 0;
@@ -2447,10 +2460,7 @@ ${l.stderr}` : ""}`, isError: true };
     this.forget(id2);
     if (!l) return;
     l.client.onclose = void 0;
-    try {
-      await l.client.close();
-    } catch {
-    }
+    await stopLive(l);
   }
 };
 function flatten(content) {
@@ -2473,11 +2483,12 @@ var PRESETS = [
     id: "chrome",
     name: "Chrome control",
     description: "Lets Friend open pages, read them, click and type in your own Chrome, through your chrome-control extension.",
-    connector: { id: "chrome", name: "Chrome control", kind: "stdio", command: "chrome-control-mcp", args: [] },
+    quick: true,
+    connector: { id: "chrome", name: "Chrome control", kind: "stdio", command: "npx", args: ["-y", "chrome-control-mcp"] },
     setup: [
-      "Install it once: npm install -g chrome-control-mcp",
-      "Run chrome-control-mcp setup, then load the extension it points to in chrome://extensions (Developer mode, Load unpacked).",
-      "Switch the extension on in Chrome. Friend starts the program itself when you add the connector."
+      "Press Connect. Friend checks that Chrome control is installed and, if it is, adds it for you: it runs npx -y chrome-control-mcp, the same as claude mcp add chrome-control -- npx -y chrome-control-mcp.",
+      "If it is not installed yet, Friend says so and can install it for you in the background (npx -y chrome-control-mcp setup).",
+      "The one step nobody can do for you, because Chrome does not allow silent installs: load the extension in chrome://extensions (Developer mode, Load unpacked) and switch it on."
     ],
     warning: "While the extension is on, Friend can act as you on any site it allows. Every action still asks for your approval; in the extension's popup you can limit it to certain sites."
   },
@@ -2496,6 +2507,122 @@ var PRESETS = [
   }
 ];
 
+// ../server/src/connectors/quick.ts
+import { existsSync as existsSync4 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join6 } from "node:path";
+var find = (id2) => PRESETS.find((p) => p.id === id2 && p.quick);
+var isQuickPreset = (id2) => !!find(id2);
+var MANUAL_EXTENSION = "One step only you can do, because Chrome does not allow programs to install extensions silently: open chrome://extensions, turn on Developer mode (top right), click Load unpacked and choose the folder shown above. Then click the extension's icon and switch it on.";
+function chromeFolder(home) {
+  return join6(home, ".chrome-control-mcp");
+}
+function chromeInstalled(home = homedir()) {
+  const base = chromeFolder(home);
+  const ext = join6(base, "extension");
+  const installed = existsSync4(join6(base, "token")) && existsSync4(join6(ext, "manifest.json")) && existsSync4(join6(base, "native-host"));
+  return { installed, extensionFolder: installed ? ext : null };
+}
+function quickCheck(id2, deps = {}) {
+  const preset = find(id2);
+  if (!preset) return null;
+  const c = chromeInstalled(deps.home);
+  if (c.installed) {
+    return { preset: id2, name: preset.name, ready: true, message: "Chrome control is installed on this PC.", installCommand: null, manualStep: null, extensionFolder: c.extensionFolder };
+  }
+  return {
+    preset: id2,
+    name: preset.name,
+    ready: false,
+    message: "Chrome control is not installed on this PC yet. Please install it first, then press Connect again.",
+    installCommand: "npx -y chrome-control-mcp setup",
+    manualStep: MANUAL_EXTENSION,
+    extensionFolder: null
+  };
+}
+async function quickInstall(id2, deps, onLine) {
+  if (!find(id2)) return { ok: false, output: "", extensionFolder: null, message: "That is not a one-click connector." };
+  const lines = [];
+  const r = await deps.run("npx", ["-y", "chrome-control-mcp", "setup", "--no-claude", "--no-open", "--no-flag"], {
+    onLine: (l) => {
+      lines.push(l);
+      onLine?.(l);
+    }
+  });
+  const after = chromeInstalled(deps.home);
+  const output = (lines.length ? lines : r.stdout.split(/\r?\n/)).filter((l) => l.trim()).slice(-12).join("\n");
+  if (r.code !== 0 || !after.installed) {
+    return { ok: false, output, extensionFolder: null, message: "The install did not finish. You can run it yourself in a terminal: npx -y chrome-control-mcp setup" };
+  }
+  return { ok: true, output, extensionFolder: after.extensionFolder, message: `Chrome control is installed. ${MANUAL_EXTENSION}` };
+}
+function readExtensionState(text2) {
+  try {
+    const o = JSON.parse(text2);
+    if (typeof o.extension === "boolean") return o.extension ? "connected" : "off";
+    if (typeof o.connected === "boolean") return o.connected ? "connected" : "off";
+  } catch {
+  }
+  const t = text2.toLowerCase();
+  if (/not connected|disconnected|no extension|extension is (off|not)|waiting for (the )?extension|not enabled|disabled/.test(t)) return "off";
+  if (/extension[^.\n]*connected|connected[^.\n]*extension|"connected"\s*:\s*true|bridge[^.\n]*connected/.test(t)) return "connected";
+  return "unknown";
+}
+async function quickConnect(id2, deps) {
+  const preset = find(id2);
+  if (!preset) return { ok: false, connector: null, extension: "unknown", message: "That is not a one-click connector." };
+  const check3 = quickCheck(id2, deps);
+  if (!check3.ready) return { ok: false, connector: null, extension: "unknown", message: check3.message };
+  const { hub } = deps;
+  const existing = hub.list().find((c) => c.id === preset.connector.id);
+  const view = existing ? existing.enabled ? await hub.reload(existing.id) : await hub.setEnabled(existing.id, true) : await hub.add(preset.connector);
+  const connector = { id: view.id, name: view.name, status: view.status, error: view.error, tools: view.tools };
+  if (view.status !== "ready") {
+    return { ok: false, connector, extension: "unknown", message: `${preset.name} is saved, but it did not start: ${view.error ?? "unknown error"}` };
+  }
+  const statusTool = hub.toolSpecs().find((t) => t.name === `mcp.${view.id}.status`);
+  let extension = "unknown";
+  if (statusTool) {
+    const r = await hub.call(statusTool.name, {});
+    if (!r.isError) extension = readExtensionState(r.text);
+  }
+  const base = `${preset.name} is on with ${view.tools} tools.`;
+  const message = extension === "connected" ? `${base} Your Chrome extension is connected. Friend can use Chrome now (it still asks before each action).` : extension === "off" ? `${base} But the Chrome extension is not connected yet. Click its icon in Chrome and switch it on (if it is not loaded: chrome://extensions, Developer mode, Load unpacked, then choose ${check3.extensionFolder}).` : `${base} Check that the Chrome extension is loaded and switched on (click its icon in Chrome).`;
+  return { ok: true, connector, extension, message };
+}
+
+// ../server/src/connectors/run.ts
+import crossSpawn2 from "cross-spawn";
+var LIMIT_MS = 5 * 6e4;
+var runCommand = (cmd, args, opts) => new Promise((resolve10) => {
+  let stdout = "";
+  let child;
+  try {
+    child = crossSpawn2(cmd, args, { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+  } catch (e) {
+    resolve10({ code: 127, stdout: e.message });
+    return;
+  }
+  const timer = setTimeout(() => child.kill(), LIMIT_MS);
+  const feed = (d) => {
+    const s = d.toString();
+    stdout += s;
+    if (opts?.onLine) {
+      for (const line of s.split(/\r?\n/)) if (line.trim()) opts.onLine(line);
+    }
+  };
+  child.stdout?.on("data", feed);
+  child.stderr?.on("data", feed);
+  child.on("error", (e) => {
+    clearTimeout(timer);
+    resolve10({ code: 127, stdout: stdout + e.message });
+  });
+  child.on("close", (code) => {
+    clearTimeout(timer);
+    resolve10({ code: code ?? 1, stdout });
+  });
+});
+
 // ../server/src/approvals.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 
@@ -2927,7 +3054,7 @@ import { spawn } from "node:child_process";
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { chmodSync as chmodSync2, mkdtempSync as mkdtempSync2, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 var MAX_CODE_CHARS = 5e4;
 var MAX_OUTPUT_CHARS = 2e4;
 var MAX_EXTRA_FILES = 10;
@@ -2987,15 +3114,15 @@ var CodeBox = class {
     if (extra.reduce((sum, [, body]) => sum + body.length, 0) > MAX_EXTRA_FILE_CHARS) return { ok: false, error: "The sandbox files are too large." };
     const setup = SETUP[input.language];
     const timeoutMs = input.timeoutSec && input.timeoutSec > 0 ? Math.min(input.timeoutSec * 1e3, MAX_TIMEOUT_MS) : DEFAULT_TIMEOUT_MS;
-    const dir = mkdtempSync2(join6(tmpdir(), "friend-code-"));
+    const dir = mkdtempSync2(join7(tmpdir(), "friend-code-"));
     try {
-      const file = join6(dir, setup.file);
+      const file = join7(dir, setup.file);
       writeFileSync3(file, input.code);
       chmodSync2(dir, 493);
       chmodSync2(file, 420);
       for (const [name, body] of extra) {
-        writeFileSync3(join6(dir, name), body);
-        chmodSync2(join6(dir, name), 420);
+        writeFileSync3(join7(dir, name), body);
+        chmodSync2(join7(dir, name), 420);
       }
       const args = [
         "run",
@@ -3130,12 +3257,12 @@ var Memory = class {
 // ../server/src/app.ts
 import { dirname as dirname3, resolve as resolve2 } from "node:path";
 import { fileURLToPath } from "node:url";
-import { join as join10 } from "node:path";
+import { join as join12 } from "node:path";
 
 // ../server/src/config.ts
-import { chmodSync as chmodSync3, existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "node:fs";
-import { homedir } from "node:os";
-import { join as join7 } from "node:path";
+import { chmodSync as chmodSync3, existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join8 } from "node:path";
 var DEFAULT_CLAUDE_CODE = { model: "sonnet", command: "claude", fallback: "ollama" };
 function sanitizeClaudeCode(raw) {
   const r = raw && typeof raw === "object" ? raw : {};
@@ -3208,12 +3335,13 @@ var DEFAULT_DESTRUCTIVE_PATTERNS = [
   String.raw`\b(iex|invoke-expression)\b`
 ];
 function defaultDataDir() {
-  return process.env.FRIEND_HOME ?? join7(homedir(), ".friend");
+  return process.env.FRIEND_HOME ?? join8(homedir2(), ".friend");
 }
 var defaults = (dataDir) => ({
   bind: "127.0.0.1",
   port: 8787,
   publicUrl: null,
+  https: false,
   trustProxy: false,
   allowedOrigins: [],
   allowedHosts: [],
@@ -3230,7 +3358,7 @@ var defaults = (dataDir) => ({
   dataDir
 });
 function configPath(dataDir) {
-  return join7(dataDir, "config.json");
+  return join8(dataDir, "config.json");
 }
 function saveConfig(cfg) {
   const { dataDir, ...rest } = cfg;
@@ -3245,7 +3373,7 @@ function loadConfig(dataDir = defaultDataDir()) {
   mkdirSync4(dataDir, { recursive: true });
   const file = configPath(dataDir);
   const base = defaults(dataDir);
-  if (!existsSync4(file)) {
+  if (!existsSync5(file)) {
     const { dataDir: _d, ...rest } = base;
     saveConfig({ ...rest, dataDir });
     return base;
@@ -3255,6 +3383,7 @@ function loadConfig(dataDir = defaultDataDir()) {
   return {
     ...base,
     ...stored,
+    https: stored.https === true,
     destructivePatterns,
     ollama: { ...DEFAULT_OLLAMA, ...stored.ollama },
     claudeCode: sanitizeClaudeCode(stored.claudeCode),
@@ -3268,7 +3397,7 @@ function loadConfig(dataDir = defaultDataDir()) {
 // ../server/src/db.ts
 import Database from "better-sqlite3";
 import { mkdirSync as mkdirSync5 } from "node:fs";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 
 // ../server/src/migrations.ts
 var MIGRATIONS = [
@@ -3385,7 +3514,7 @@ create table plugins (
 // ../server/src/db.ts
 function openDb(dataDir) {
   mkdirSync5(dataDir, { recursive: true });
-  const db = new Database(join8(dataDir, "friend.db"));
+  const db = new Database(join9(dataDir, "friend.db"));
   db.pragma("journal_mode = WAL");
   db.pragma("foreign_keys = ON");
   db.exec("create table if not exists schema_version (id integer primary key, applied_at integer not null)");
@@ -3483,7 +3612,7 @@ var DeviceHub = class {
 import fastifyCookie from "@fastify/cookie";
 import fastifyStatic from "@fastify/static";
 import Fastify from "fastify";
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import { isIP } from "node:net";
 import { WebSocket, WebSocketServer } from "ws";
 import { z as z10 } from "zod";
@@ -3558,7 +3687,7 @@ function createGateway(deps) {
     forceCloseConnections: true
     // shutdown must not wait for idle keep-alive connections
   };
-  const app = Fastify(options);
+  const app = Fastify(deps.tls ? { ...options, https: { key: deps.tls.key, cert: deps.tls.cert } } : options);
   app.register(fastifyCookie);
   const hostOf = (header) => {
     const h = (header ?? "").trim().toLowerCase();
@@ -3768,6 +3897,24 @@ function createGateway(deps) {
       return connectorError(reply, e, "add");
     }
   });
+  app.get("/api/connectors/quick/:preset", { onRequest: connectorGuard }, async (req, reply) => {
+    try {
+      return deps.connectors.quickCheck(req.params.preset);
+    } catch (e) {
+      return connectorError(reply, e, "quick-check");
+    }
+  });
+  for (const action of ["install", "connect"]) {
+    app.post(`/api/connectors/quick/:preset/${action}`, { onRequest: connectorGuard }, async (req, reply) => {
+      const body = z10.object({ pin: z10.string().min(1).max(32) }).safeParse(req.body);
+      if (!body.success) return reply.code(400).send({ error: "Enter your PIN to continue" });
+      try {
+        return await (action === "install" ? deps.connectors.quickInstall : deps.connectors.quickConnect)(req.params.preset, body.data.pin, req.ip);
+      } catch (e) {
+        return connectorError(reply, e, `quick-${action}`);
+      }
+    });
+  }
   app.post("/api/connectors/:id/enabled", { onRequest: connectorGuard }, async (req, reply) => {
     const body = z10.object({ enabled: z10.boolean(), pin: z10.string().min(1).max(32).optional() }).safeParse(req.body);
     if (!body.success) return reply.code(400).send({ error: "Invalid input" });
@@ -3903,7 +4050,7 @@ function createGateway(deps) {
     deps.onLock?.();
     return { ok: true };
   });
-  if (deps.webDir && existsSync5(deps.webDir)) {
+  if (deps.webDir && existsSync6(deps.webDir)) {
     app.register(fastifyStatic, { root: deps.webDir });
     app.setNotFoundHandler((req, reply) => {
       if (req.method === "GET" && !req.url.startsWith("/api")) return reply.sendFile("index.html");
@@ -4125,8 +4272,8 @@ var ClaudeProvider = class {
 
 // ../server/src/provider/claude-code/provider.ts
 import { createHash as createHash3 } from "node:crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync4, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join9 } from "node:path";
+import { chmodSync as chmodSync4, existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync4, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join10 } from "node:path";
 
 // ../server/src/provider/claude-code/bridge.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -4411,7 +4558,7 @@ var NOT_SIGNED_IN = /not logged in|please run \/login|invalid api key|authentica
 var ClaudeCodeProvider = class {
   constructor(opts) {
     this.opts = opts;
-    this.home = join9(opts.dataDir, "claude");
+    this.home = join10(opts.dataDir, "claude");
     this.now = opts.now ?? Date.now;
     this.bridge = new ToolBridge((call) => this.owner.inbox.push({ kind: "call", call }));
   }
@@ -4641,7 +4788,7 @@ ${item.stderr}`;
       "local",
       "--system-prompt",
       req.system,
-      ...conv.guest ? ["--no-session-persistence"] : ["--mcp-config", join9(this.home, "mcp.json"), "--allowedTools", req.tools.map((t) => `mcp__friend__${encodeToolName(t.name)}`).join(","), ...resume ? ["--resume", resume] : []]
+      ...conv.guest ? ["--no-session-persistence"] : ["--mcp-config", join10(this.home, "mcp.json"), "--allowedTools", req.tools.map((t) => `mcp__friend__${encodeToolName(t.name)}`).join(","), ...resume ? ["--resume", resume] : []]
     ];
     const proc = new ClaudeProc(
       {
@@ -4672,7 +4819,7 @@ ${item.stderr}`;
   startBridge() {
     this.bridgeReady ??= (async () => {
       await this.bridge.start();
-      const file = join9(this.home, "mcp.json");
+      const file = join10(this.home, "mcp.json");
       writeFileSync5(file, JSON.stringify({ mcpServers: { friend: { type: "http", url: this.bridge.url, headers: { Authorization: `Bearer ${this.bridge.token}` } } } }));
       try {
         chmodSync4(file, 384);
@@ -4682,10 +4829,10 @@ ${item.stderr}`;
     return this.bridgeReady;
   }
   // ---- the session id, kept so a restart of Friend can pick the conversation up again ----
-  sessionFile = () => join9(this.home, "session-id");
+  sessionFile = () => join10(this.home, "session-id");
   readSession() {
     try {
-      return existsSync6(this.sessionFile()) ? readFileSync4(this.sessionFile(), "utf8").trim() || null : null;
+      return existsSync7(this.sessionFile()) ? readFileSync4(this.sessionFile(), "utf8").trim() || null : null;
     } catch {
       return null;
     }
@@ -5120,6 +5267,63 @@ var OllamaProvider = class {
   }
 };
 
+// ../server/src/tls.ts
+import { chmodSync as chmodSync5, existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "node:fs";
+import { networkInterfaces } from "node:os";
+import { isIP as isIP2 } from "node:net";
+import { join as join11 } from "node:path";
+import { generate } from "selfsigned";
+var DAYS = 825;
+var RENEW_BEFORE_MS = 30 * 24 * 36e5;
+function lanAddresses(ifaces = networkInterfaces) {
+  const out = [];
+  for (const list2 of Object.values(ifaces())) {
+    for (const i of list2 ?? []) if (i.family === "IPv4" && !i.internal && !out.includes(i.address)) out.push(i.address);
+  }
+  return out;
+}
+function tlsHosts(extra = [], ifaces) {
+  return [.../* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", ...lanAddresses(ifaces), ...extra.map((h) => h.toLowerCase()).filter(Boolean)])];
+}
+async function ensureTlsCert(dataDir, extraHosts = [], ifaces, now = Date.now) {
+  const dir = join11(dataDir, "tls");
+  const keyFile = join11(dir, "key.pem");
+  const certFile = join11(dir, "cert.pem");
+  const metaFile = join11(dir, "meta.json");
+  const hosts = tlsHosts(extraHosts, ifaces);
+  if (existsSync8(keyFile) && existsSync8(certFile) && existsSync8(metaFile)) {
+    try {
+      const meta = JSON.parse(readFileSync5(metaFile, "utf8"));
+      const covered = hosts.every((h) => meta.hosts.includes(h));
+      if (covered && meta.expires - now() > RENEW_BEFORE_MS) return { key: readFileSync5(keyFile, "utf8"), cert: readFileSync5(certFile, "utf8") };
+    } catch {
+    }
+  }
+  const altNames = hosts.map((h) => isIP2(h) ? { type: 7, ip: h } : { type: 2, value: h });
+  const pems = await generate([{ name: "commonName", value: "Friend" }], {
+    keySize: 2048,
+    notBeforeDate: new Date(now() - 24 * 36e5),
+    // a day back, so a phone whose clock is a little slow still accepts it
+    notAfterDate: new Date(now() + DAYS * 24 * 36e5),
+    algorithm: "sha256",
+    extensions: [
+      { name: "basicConstraints", cA: false },
+      { name: "keyUsage", digitalSignature: true, keyEncipherment: true },
+      { name: "extKeyUsage", serverAuth: true },
+      { name: "subjectAltName", altNames }
+    ]
+  });
+  mkdirSync7(dir, { recursive: true });
+  writeFileSync6(keyFile, pems.private);
+  writeFileSync6(certFile, pems.cert);
+  writeFileSync6(metaFile, JSON.stringify({ hosts, expires: now() + DAYS * 24 * 36e5 }));
+  try {
+    chmodSync5(keyFile, 384);
+  } catch {
+  }
+  return { key: pems.private, cert: pems.cert };
+}
+
 // ../server/src/voice/challenge.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
 var Challenges = class {
@@ -5181,22 +5385,22 @@ var Challenges = class {
 
 // ../server/src/voice/crypto.ts
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes3 } from "node:crypto";
-import { chmodSync as chmodSync5, existsSync as existsSync7, mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "node:fs";
+import { chmodSync as chmodSync6, existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "node:fs";
 import { dirname as dirname2 } from "node:path";
 var KEY_BYTES = 32;
 var IV_BYTES = 12;
 var TAG_BYTES = 16;
 function loadOrCreateKey(path) {
-  if (existsSync7(path)) {
-    const key2 = readFileSync5(path);
+  if (existsSync9(path)) {
+    const key2 = readFileSync6(path);
     if (key2.length !== KEY_BYTES) throw new Error(`invalid voice key file (expected ${KEY_BYTES} bytes): ${path}`);
     return key2;
   }
-  mkdirSync7(dirname2(path), { recursive: true });
+  mkdirSync8(dirname2(path), { recursive: true });
   const key = randomBytes3(KEY_BYTES);
-  writeFileSync6(path, key, { mode: 384 });
+  writeFileSync7(path, key, { mode: 384 });
   try {
-    chmodSync5(path, 384);
+    chmodSync6(path, 384);
   } catch {
   }
   return key;
@@ -5614,7 +5818,7 @@ async function createApp(opts) {
   const camera = new CameraBroker(opts.cameraTimeoutMs);
   const memory = new Memory(db);
   const tasks = new Tasks(db);
-  const plugins = new Plugins(db, join10(opts.dataDir, "plugins"));
+  const plugins = new Plugins(db, join12(opts.dataDir, "plugins"));
   const hub = new McpHub(new ConnectorStore(opts.dataDir));
   const admin = makeAdmin({ hub, plugins, dataDir: opts.dataDir, audit: (what, detail) => audit.log("agent", what, detail) });
   function commitSettings(patch, how) {
@@ -5720,7 +5924,7 @@ async function createApp(opts) {
   const voice2 = opts.voice;
   const speaker = voice2 ? new Speaker(voice2, audit, () => config.voice.ttsVoice) : null;
   const voiceAvailable = () => !!voice2 && voice2.available();
-  const voiceprint = voice2 ? new Voiceprint(db, loadOrCreateKey(join10(opts.dataDir, "voice.key"))) : null;
+  const voiceprint = voice2 ? new Voiceprint(db, loadOrCreateKey(join12(opts.dataDir, "voice.key"))) : null;
   const enrollment = voiceprint ? new Enrollment(voiceprint, SPEAKER_MODEL) : null;
   const challenges = new Challenges((id2) => {
     broadcast({ type: "voice.challenge.end", id: id2 });
@@ -5837,7 +6041,7 @@ async function createApp(opts) {
       if (!isPluginId(id2)) throw new HttpError(400, "That is not a plugin name.");
       if (!listCatalog(catalogDir).some((c) => c.id === id2)) throw new HttpError(404, "That plugin is not in the catalog.");
       await requirePin(pin, ip);
-      const r = plugins.install(join10(catalogDir, id2));
+      const r = plugins.install(join12(catalogDir, id2));
       if (!r.ok) throw new HttpError(400, `That plugin cannot be installed: ${r.error}`);
       audit.log("owner", "plugin.installed", { id: r.id, upgraded: r.upgraded, ip });
       return { id: r.id, upgraded: r.upgraded };
@@ -5892,6 +6096,24 @@ async function createApp(opts) {
         throw new HttpError(404, e.message);
       }
     },
+    quickCheck: (preset) => {
+      const c = quickCheck(preset, { home: opts.quick?.home });
+      if (!c) throw new HttpError(404, "That is not a one-click connector.");
+      return c;
+    },
+    quickInstall: async (preset, pin, ip) => {
+      if (!isQuickPreset(preset)) throw new HttpError(404, "That is not a one-click connector.");
+      await requirePin(pin, ip);
+      audit.log("owner", "connector.quick_install", { preset, ip });
+      return quickInstall(preset, { hub, run: opts.quick?.run ?? runCommand, home: opts.quick?.home });
+    },
+    quickConnect: async (preset, pin, ip) => {
+      if (!isQuickPreset(preset)) throw new HttpError(404, "That is not a one-click connector.");
+      await requirePin(pin, ip);
+      const result = await quickConnect(preset, { hub, run: opts.quick?.run ?? runCommand, home: opts.quick?.home });
+      audit.log("owner", "connector.quick_connect", { preset, ok: result.ok, extension: result.extension, ip });
+      return result;
+    },
     remove: async (id2) => {
       try {
         await hub.remove(id2);
@@ -5901,7 +6123,9 @@ async function createApp(opts) {
       }
     }
   };
+  const tls = config.https ? await ensureTlsCert(opts.dataDir, [...config.allowedHosts, ...config.publicUrl ? [new URL(config.publicUrl).hostname] : []]) : void 0;
   const gateway = createGateway({
+    ...tls ? { tls } : {},
     connectors: connectorsApi,
     voicePreview: async (id2) => {
       if (!voice2 || !voiceAvailable()) throw new HttpError(503, "Voice is not available. Run: friend voice setup");
@@ -6250,7 +6474,7 @@ var SidecarProcess = class {
 import { createInterface as createInterface2 } from "node:readline";
 
 // ../agent-cli/src/commands/config.ts
-import { isIP as isIP2 } from "node:net";
+import { isIP as isIP3 } from "node:net";
 var list = (v) => v.split(",").map((s) => s.trim()).filter(Boolean);
 var bool = (v) => {
   if (v !== "true" && v !== "false") throw new Error("Expected true or false");
@@ -6280,10 +6504,11 @@ var PARSERS = {
   model: (v) => v,
   bind: (v) => {
     const t = v.trim();
-    if (t !== "localhost" && isIP2(t) === 0) throw new Error("bind must be an IP address such as 127.0.0.1 (this PC only) or 0.0.0.0 (also your network), or localhost. Easier: friend lan on");
+    if (t !== "localhost" && isIP3(t) === 0) throw new Error("bind must be an IP address such as 127.0.0.1 (this PC only) or 0.0.0.0 (also your network), or localhost. Easier: friend lan on");
     return t;
   },
   publicUrl: (v) => v === "" ? null : v,
+  https: bool,
   port: (v) => {
     const n = Number(v);
     if (!Number.isInteger(n) || n < 0 || n > 65535) throw new Error("Port must be a number between 0 and 65535");
@@ -6330,11 +6555,42 @@ var GROUPS = {
     }
   }
 };
+var KEY_HELP = {
+  apiKey: 'Anthropic API key, used when the model is "claude"',
+  model: "Claude model name, used with the API key",
+  provider: "which model answers: claude (API key), claude-code (your Claude subscription) or ollama (on this PC)",
+  bind: "address Friend listens on: 127.0.0.1 is this PC only, 0.0.0.0 is your whole network (easier: friend lan on)",
+  port: "the web port (easier: friend lan port N)",
+  https: "true serves a secure https:// address (Friend makes its own certificate), so a phone may use the microphone (easier: friend lan https on)",
+  publicUrl: "the address people use when Friend is behind your own domain, or empty",
+  roots: "folders Friend may read and write freely, separated by commas",
+  allowedOrigins: "extra web addresses allowed to connect, separated by commas",
+  allowedHosts: "extra host names that may reach Friend (for example my-pc), separated by commas",
+  trustProxy: "true when Friend sits behind your own reverse proxy",
+  "voice.enabled": "true or false: use speech at all",
+  "voice.sttModel": "listening model: tiny, base, small, \u2026 (bigger is more accurate and slower)",
+  "voice.ttsVoice": "speaking voice (easier: friend voice setup, or Settings)",
+  "voice.language": "force a spoken language such as en or hi, or empty to detect it",
+  "voice.speakTyped": "true or false: also speak the replies to typed messages",
+  "voice.accept": "0 to 1: a voice at or above this match is you",
+  "voice.challenge": "0 to 1: a voice between this and accept must be confirmed with your PIN",
+  "ollama.url": "address of the Ollama server, for example http://127.0.0.1:11434",
+  "ollama.model": "the local model, for example qwen2.5:7b",
+  "ollama.vision": "true or false: the local model can look at pictures",
+  "ollama.contextTokens": "how much the local model remembers at once (1024 to 131072)",
+  "claudeCode.model": "model for your Claude subscription: sonnet, haiku, opus or a full name",
+  "claudeCode.command": "the command that starts Claude Code, if it is not on the PATH",
+  "claudeCode.fallback": "ollama or none: what to use when Claude is unavailable"
+};
 var allKeys = () => [...Object.keys(PARSERS), ...Object.entries(GROUPS).flatMap(([g, f]) => Object.keys(f).map((k) => `${g}.${k}`))];
 async function configCommand(args, io2) {
   const [sub, key, ...valueParts] = args;
+  if (sub === "keys") {
+    for (const k of allKeys()) io2.out(`${k.padEnd(24)} ${KEY_HELP[k] ?? ""}`);
+    return 0;
+  }
   if (sub !== "set" || !key) {
-    io2.err("Usage: friend config set <key> <value>");
+    io2.err("Usage: friend config set <key> <value> | friend config keys");
     return 1;
   }
   const value = valueParts.join(" ");
@@ -6370,8 +6626,8 @@ import { resolve as resolve6 } from "node:path";
 import { WebSocket as WebSocket2 } from "ws";
 
 // ../agent-cli/src/tools/fs.ts
-import { closeSync, mkdirSync as mkdirSync8, openSync, readSync, readdirSync as readdirSync2, statSync, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname5, join as join11 } from "node:path";
+import { closeSync, mkdirSync as mkdirSync9, openSync, readSync, readdirSync as readdirSync2, statSync, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname5, join as join13 } from "node:path";
 
 // ../agent-cli/src/tools/roots.ts
 import { lstatSync as lstatSync2, realpathSync } from "node:fs";
@@ -6433,7 +6689,7 @@ function fsList(args, ctx) {
       if (e.isDirectory()) return `[dir]  ${e.name}`;
       let size = 0;
       try {
-        size = statSync(join11(g.abs, e.name)).size;
+        size = statSync(join13(g.abs, e.name)).size;
       } catch {
       }
       return `[file] ${e.name} (${size} bytes)`;
@@ -6474,8 +6730,8 @@ function fsWrite(args, ctx) {
   if ("error" in g) return { ok: false, error: g.error };
   if (Buffer.byteLength(args.content) > MAX_WRITE) return { ok: false, error: "Content too large (5 MB limit)" };
   try {
-    mkdirSync8(dirname5(g.abs), { recursive: true });
-    writeFileSync7(g.abs, args.content);
+    mkdirSync9(dirname5(g.abs), { recursive: true });
+    writeFileSync8(g.abs, args.content);
     return { ok: true, output: `Wrote ${Buffer.byteLength(args.content)} bytes to ${g.abs}`, truncated: false };
   } catch (e) {
     return { ok: false, error: e.message };
@@ -6484,7 +6740,7 @@ function fsWrite(args, ctx) {
 
 // ../agent-cli/src/tools/shell.ts
 import { spawn as spawn4, spawnSync } from "node:child_process";
-function killTree(child) {
+function killTree2(child) {
   if (!child.pid) return;
   if (process.platform === "win32") {
     spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"], { windowsHide: true });
@@ -6496,7 +6752,7 @@ function killTree(child) {
     }
   }
 }
-function runCommand(command, cwdArg, ctx, argv) {
+function runCommand2(command, cwdArg, ctx, argv) {
   let cwd = ctx.roots[0] ?? process.cwd();
   if (cwdArg) {
     const r = resolveInRoots(cwdArg, ctx.roots);
@@ -6529,7 +6785,7 @@ function runCommand(command, cwdArg, ctx, argv) {
     child.stderr.on("data", take);
     const timer = setTimeout(() => {
       timedOut = true;
-      killTree(child);
+      killTree2(child);
     }, ctx.timeoutMs);
     child.on("error", (e) => {
       clearTimeout(timer);
@@ -6587,7 +6843,7 @@ async function systemInfo(sampleMs = 250) {
   return { ok: true, output: lines.join("\n"), truncated: false };
 }
 function processList(ctx) {
-  return process.platform === "win32" ? runCommand("", void 0, ctx, { file: "tasklist.exe", args: ["/fo", "csv", "/nh"] }) : runCommand("", void 0, ctx, { file: "ps", args: ["-eo", "pid,comm"] });
+  return process.platform === "win32" ? runCommand2("", void 0, ctx, { file: "tasklist.exe", args: ["/fo", "csv", "/nh"] }) : runCommand2("", void 0, ctx, { file: "ps", args: ["-eo", "pid,comm"] });
 }
 
 // ../agent-cli/src/tools/index.ts
@@ -6611,7 +6867,7 @@ async function runTool(name, args, ctx) {
       case "process.list":
         return await processList(ctx);
       case "shell.run":
-        return await runCommand(a.command, a.cwd, ctx);
+        return await runCommand2(a.command, a.cwd, ctx);
       default:
         return { ok: false, error: `Unknown tool: ${name}` };
     }
@@ -6644,7 +6900,7 @@ function startDeviceNode(opts) {
   function connect() {
     if (stopped) return;
     setState("connecting");
-    const sock = new WebSocket2(opts.url, { headers: { authorization: `Bearer ${opts.token}` } });
+    const sock = new WebSocket2(opts.url, { headers: { authorization: `Bearer ${opts.token}` }, ...opts.ca ? { ca: opts.ca } : {} });
     ws = sock;
     sock.on("error", () => {
     });
@@ -6711,15 +6967,15 @@ function startDeviceNode(opts) {
 
 // ../agent-cli/src/commands/start.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
-import { existsSync as existsSync9, readFileSync as readFileSync7, writeFileSync as writeFileSync9 } from "node:fs";
-import { dirname as dirname7, join as join13, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync8, writeFileSync as writeFileSync10 } from "node:fs";
+import { dirname as dirname7, join as join15, resolve as resolve5 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // ../agent-cli/src/commands/lan.ts
-import { networkInterfaces } from "node:os";
+import { networkInterfaces as networkInterfaces2 } from "node:os";
 var LOOPBACK3 = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1"]);
 var isLoopbackBind = (bind) => LOOPBACK3.has(bind);
-function lanAddresses(ifaces = networkInterfaces) {
+function lanAddresses2(ifaces = networkInterfaces2) {
   const out = [];
   for (const list2 of Object.values(ifaces())) {
     for (const i of list2 ?? []) {
@@ -6728,11 +6984,12 @@ function lanAddresses(ifaces = networkInterfaces) {
   }
   return out;
 }
-function urlsFor(bind, port, ifaces = networkInterfaces) {
-  const local = `http://127.0.0.1:${port}`;
+function urlsFor(bind, port, ifaces = networkInterfaces2, https = false) {
+  const scheme = https ? "https" : "http";
+  const local = `${scheme}://127.0.0.1:${port}`;
   if (isLoopbackBind(bind)) return { local, network: [] };
-  if (bind === "0.0.0.0" || bind === "::") return { local, network: lanAddresses(ifaces).map((a) => `http://${a}:${port}`) };
-  return { local, network: [`http://${bind}:${port}`] };
+  if (bind === "0.0.0.0" || bind === "::") return { local, network: lanAddresses2(ifaces).map((a) => `${scheme}://${a}:${port}`) };
+  return { local, network: [`${scheme}://${bind}:${port}`] };
 }
 var PORT_HELP = "The port must be a whole number from 1024 to 65535.";
 function parsePort(v) {
@@ -6740,34 +6997,58 @@ function parsePort(v) {
   if (v === void 0 || v.trim() === "" || !Number.isInteger(n) || n < 1024 || n > 65535) throw new Error(PORT_HELP);
   return n;
 }
-function show(io2, bind, port, ifaces) {
-  const u = urlsFor(bind, port, ifaces);
+function show(io2, bind, port, ifaces, https = false) {
+  const u = urlsFor(bind, port, ifaces, https);
   io2.out(`Listens on:    ${bind}:${port}`);
   io2.out(`On this PC:    ${u.local}`);
   if (u.network.length) for (const n of u.network) io2.out(`On your network: ${n}`);
   else if (isLoopbackBind(bind)) io2.out("On your network: not reachable (only this PC). Turn it on with: friend lan on");
   else io2.out("On your network: no network address found. Check that this PC is connected.");
 }
-async function lanCommand(args, io2, ifaces = networkInterfaces) {
+async function lanCommand(args, io2, ifaces = networkInterfaces2) {
   const [sub, ...rest] = args;
   const cfg = loadConfig(io2.dataDir);
   switch (sub) {
     case void 0:
     case "status":
-      show(io2, cfg.bind, cfg.port, ifaces);
+      show(io2, cfg.bind, cfg.port, ifaces, cfg.https);
+      io2.out(cfg.https ? "Secure (https): on. A phone can use the microphone and camera." : "Secure (https): off. A phone cannot use the microphone or camera. Turn it on with: friend lan https on");
       return 0;
+    case "https": {
+      if (rest[0] !== "on" && rest[0] !== "off") {
+        io2.err("Usage: friend lan https on | off");
+        return 1;
+      }
+      cfg.https = rest[0] === "on";
+      saveConfig(cfg);
+      show(io2, cfg.bind, cfg.port, ifaces, cfg.https);
+      io2.out("");
+      io2.out("Restart Friend to apply (stop it, then: friend start).");
+      if (cfg.https) {
+        io2.out("Friend makes its own security certificate, so the first time a phone opens the https:// address it shows a warning:");
+        io2.out("  Android Chrome: Advanced, then Proceed.   iPhone Safari: Show Details, then visit this website.");
+        io2.out("After that, the microphone and camera work from the phone. Only that address is affected; nothing is installed on the phone.");
+        if (isLoopbackBind(cfg.bind)) io2.out("Friend is still only reachable from this PC. To open it from a phone too: friend lan on");
+      }
+      return 0;
+    }
     case "on": {
       const portFlag = rest.indexOf("--port");
       if (portFlag >= 0) cfg.port = parsePort(rest[portFlag + 1]);
       cfg.bind = "0.0.0.0";
+      if (rest.includes("--https")) cfg.https = true;
       saveConfig(cfg);
-      show(io2, cfg.bind, cfg.port, ifaces);
+      show(io2, cfg.bind, cfg.port, ifaces, cfg.https);
       io2.out("");
       io2.out("Restart Friend to apply (stop it, then: friend start).");
       io2.out("Things to know:");
       io2.out("  - Anyone on your network can open the sign-in page. Your password and PIN still guard everything; use a strong password.");
-      io2.out("  - The connection is plain http: other people on the network could read it. Use it only on a network you trust, or put Friend behind HTTPS (see publicUrl in the README).");
-      io2.out("  - Browsers allow the microphone and camera only on localhost or HTTPS, so voice and camera will not work from another device over plain http.");
+      if (cfg.https) {
+        io2.out("  - Secure (https) is on. The first time a phone opens the address it shows a certificate warning (Advanced, then Proceed); after that the microphone works.");
+      } else {
+        io2.out("  - The connection is plain http: other people on the network could read it. Use it only on a network you trust.");
+        io2.out("  - Browsers allow the microphone and camera only on localhost or HTTPS, so voice and camera will not work from a phone over plain http. Fix: friend lan https on");
+      }
       io2.out("  - Windows may ask to allow Node.js through the firewall the first time: allow it on Private networks.");
       io2.out("  - Going to a name such as http://my-pc:8787 needs: friend config set allowedHosts my-pc");
       return 0;
@@ -6775,41 +7056,41 @@ async function lanCommand(args, io2, ifaces = networkInterfaces) {
     case "off":
       cfg.bind = "127.0.0.1";
       saveConfig(cfg);
-      show(io2, cfg.bind, cfg.port, ifaces);
+      show(io2, cfg.bind, cfg.port, ifaces, cfg.https);
       io2.out("Restart Friend to apply.");
       return 0;
     case "port": {
       cfg.port = parsePort(rest[0]);
       saveConfig(cfg);
-      show(io2, cfg.bind, cfg.port, ifaces);
+      show(io2, cfg.bind, cfg.port, ifaces, cfg.https);
       io2.out("Restart Friend to apply.");
       return 0;
     }
     default:
-      io2.err("Usage: friend lan status | on [--port N] | off | port N");
+      io2.err("Usage: friend lan status | on [--port N] [--https] | off | port N | https on|off");
       return 1;
   }
 }
 
 // ../agent-cli/src/commands/voice.ts
 import { spawn as spawn5 } from "node:child_process";
-import { existsSync as existsSync8, mkdirSync as mkdirSync9, readFileSync as readFileSync6, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname6, join as join12, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync7, writeFileSync as writeFileSync9 } from "node:fs";
+import { dirname as dirname6, join as join14, resolve as resolve4 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function voicePaths(dataDir) {
-  const home = join12(dataDir, "voice");
-  const venv = join12(home, "venv");
+  const home = join14(dataDir, "voice");
+  const venv = join14(home, "venv");
   return {
     home,
     venv,
-    python: process.platform === "win32" ? join12(venv, "Scripts", "python.exe") : join12(venv, "bin", "python"),
-    models: join12(home, "models"),
-    marker: join12(home, "installed.json")
+    python: process.platform === "win32" ? join14(venv, "Scripts", "python.exe") : join14(venv, "bin", "python"),
+    models: join14(home, "models"),
+    marker: join14(home, "installed.json")
   };
 }
 function readMarker(dataDir) {
   try {
-    return JSON.parse(readFileSync6(voicePaths(dataDir).marker, "utf8"));
+    return JSON.parse(readFileSync7(voicePaths(dataDir).marker, "utf8"));
   } catch {
     return null;
   }
@@ -6906,8 +7187,8 @@ async function voiceSetupCommand(io2, deps = {}, args = []) {
     io2.err("Python 3.10 or newer is required. Install it from https://www.python.org/downloads/ and run this again.");
     return 1;
   }
-  mkdirSync9(p.home, { recursive: true });
-  if (!existsSync8(p.python)) {
+  mkdirSync10(p.home, { recursive: true });
+  if (!existsSync10(p.python)) {
     io2.out("1/3 Creating a private Python environment\u2026");
     const r = await run2(py.cmd, [...py.args, "-m", "venv", p.venv], { onLine });
     if (r.code !== 0) {
@@ -6933,7 +7214,7 @@ ${tail(dl.stdout)}`);
     return 1;
   }
   const marker = { python: p.python, sttModel: cfg.voice.sttModel, ttsVoice: cfg.voice.ttsVoice, at: Date.now() };
-  writeFileSync8(p.marker, JSON.stringify(marker, null, 2));
+  writeFileSync9(p.marker, JSON.stringify(marker, null, 2));
   io2.out("Voice is ready. Start Friend with `friend start`, then hold Space to talk.");
   return 0;
 }
@@ -6949,7 +7230,7 @@ async function voiceStatusCommand(io2) {
     io2.out("Voice engine:   not installed. Run: friend voice setup");
     return 0;
   }
-  if (!existsSync8(marker.python)) {
+  if (!existsSync10(marker.python)) {
     io2.out("Voice engine:   installed, but its Python is missing. Run: friend voice setup");
     return 0;
   }
@@ -7022,7 +7303,7 @@ async function voiceCommand(args, io2) {
 function findWebDir(explicit) {
   const here = dirname7(fileURLToPath3(import.meta.url));
   const candidates = [explicit, process.env.FRIEND_WEB_DIR, resolve5(here, "../../../web/dist"), resolve5(here, "web")];
-  return candidates.find((c) => !!c && existsSync9(join13(c, "index.html")));
+  return candidates.find((c) => !!c && existsSync11(join15(c, "index.html")));
 }
 async function startFriend(opts) {
   const stored = loadConfig(opts.dataDir);
@@ -7056,18 +7337,20 @@ async function startFriend(opts) {
     }
   });
   const { port } = await app.start();
-  const tokenFile = join13(opts.dataDir, "local-device.token");
-  let token = existsSync9(tokenFile) ? readFileSync7(tokenFile, "utf8").trim() : "";
+  const tokenFile = join15(opts.dataDir, "local-device.token");
+  let token = existsSync11(tokenFile) ? readFileSync8(tokenFile, "utf8").trim() : "";
   if (!token || !app.auth.resolveDevice(token)) {
     token = app.auth.redeemPairCode(app.auth.createPairCode(), "this-pc");
-    writeFileSync9(tokenFile, token, { mode: 384 });
+    writeFileSync10(tokenFile, token, { mode: 384 });
   }
   const node = startDeviceNode({
-    url: `ws://127.0.0.1:${port}/device`,
+    url: `${app.config.https ? "wss" : "ws"}://127.0.0.1:${port}/device`,
     token,
-    roots: app.config.roots
+    roots: app.config.roots,
+    ...app.config.https ? { ca: readFileSync8(join15(opts.dataDir, "tls", "cert.pem"), "utf8") } : {}
+    // this PC trusts only its own Friend's certificate
   });
-  const urls = urlsFor(app.config.bind, port);
+  const urls = urlsFor(app.config.bind, port, void 0, app.config.https);
   opts.out(`Friend is running at ${urls.local}`);
   for (const n of urls.network) opts.out(`Also on your network: ${n}`);
   if (!app.auth.hasOwner()) opts.out("No owner yet. Run: friend onboard (guided), or friend setup (just the account)");
@@ -7292,8 +7575,8 @@ async function memoryCommand(args, io2) {
 }
 
 // ../agent-cli/src/commands/plugin.ts
-import { existsSync as existsSync10, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
-import { dirname as dirname8, join as join14, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync12, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { dirname as dirname8, join as join16, resolve as resolve7 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var USAGE2 = "Usage: friend plugin catalog | list | install <name|folder> [--yes] | enable <id> | disable <id> | remove <id>";
 function defaultCatalog() {
@@ -7307,10 +7590,10 @@ async function pluginCommand(args, io2, deps = {}) {
   const flags = rest.filter((a) => a.startsWith("--"));
   const arg = rest.find((a) => !a.startsWith("--"));
   if (sub === "catalog") {
-    const dirs = existsSync10(catalogDir) ? readdirSync3(catalogDir).filter((d) => statSync2(join14(catalogDir, d)).isDirectory()) : [];
+    const dirs = existsSync12(catalogDir) ? readdirSync3(catalogDir).filter((d) => statSync2(join16(catalogDir, d)).isDirectory()) : [];
     if (dirs.length === 0) io2.out("The catalog is empty.");
     for (const d of dirs.sort()) {
-      const r = inspectPlugin(join14(catalogDir, d));
+      const r = inspectPlugin(join16(catalogDir, d));
       if (!r.ok) {
         io2.out(`${d}  (invalid: ${r.error})`);
         continue;
@@ -7326,7 +7609,7 @@ async function pluginCommand(args, io2, deps = {}) {
   }
   const db = openDb(io2.dataDir);
   try {
-    const plugins = new Plugins(db, join14(io2.dataDir, "plugins"));
+    const plugins = new Plugins(db, join16(io2.dataDir, "plugins"));
     if (sub === "list") {
       const all = plugins.list();
       if (all.length === 0) io2.out("No plugins installed. See: friend plugin catalog");
@@ -7340,8 +7623,8 @@ async function pluginCommand(args, io2, deps = {}) {
         io2.err(USAGE2);
         return 1;
       }
-      const inCatalog = !/[\\/]/.test(arg) && existsSync10(join14(catalogDir, arg));
-      const source = inCatalog ? join14(catalogDir, arg) : existsSync10(resolve7(arg)) ? resolve7(arg) : null;
+      const inCatalog = !/[\\/]/.test(arg) && existsSync12(join16(catalogDir, arg));
+      const source = inCatalog ? join16(catalogDir, arg) : existsSync12(resolve7(arg)) ? resolve7(arg) : null;
       if (!source) {
         io2.err(`"${arg}" is not in the catalog and there is no such folder. See: friend plugin catalog`);
         return 1;
@@ -7395,8 +7678,8 @@ async function pluginCommand(args, io2, deps = {}) {
 }
 
 // ../agent-cli/src/commands/onboard/index.ts
-import crossSpawn2 from "cross-spawn";
-import { mkdirSync as mkdirSync11 } from "node:fs";
+import crossSpawn4 from "cross-spawn";
+import { mkdirSync as mkdirSync12 } from "node:fs";
 import { resolve as resolve8 } from "node:path";
 
 // ../agent-cli/src/commands/ollama.ts
@@ -7564,13 +7847,13 @@ async function ollamaCommand(args, io2, deps = {}) {
 }
 
 // ../agent-cli/src/commands/onboard/exec.ts
-import crossSpawn from "cross-spawn";
+import crossSpawn3 from "cross-spawn";
 var CHECK_TIMEOUT_MS = 2e4;
 var capture = (cmd, args, opts) => new Promise((resolve10) => {
   let stdout = "";
   let child;
   try {
-    child = crossSpawn(cmd, args, { cwd: opts?.cwd, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    child = crossSpawn3(cmd, args, { cwd: opts?.cwd, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     resolve10({ code: 127, stdout: e.message });
     return;
@@ -7597,7 +7880,7 @@ var capture = (cmd, args, opts) => new Promise((resolve10) => {
 var interactive = (cmd, args) => new Promise((resolve10) => {
   let child;
   try {
-    child = crossSpawn(cmd, args, { stdio: "inherit" });
+    child = crossSpawn3(cmd, args, { stdio: "inherit" });
   } catch {
     resolve10(127);
     return;
@@ -7719,16 +8002,16 @@ function installPlan(id2, platform, have) {
 }
 
 // ../agent-cli/src/commands/onboard/state.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync10, readFileSync as readFileSync8, renameSync as renameSync3, rmSync as rmSync5, writeFileSync as writeFileSync10 } from "node:fs";
-import { dirname as dirname9, join as join15 } from "node:path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync11, readFileSync as readFileSync9, renameSync as renameSync3, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "node:fs";
+import { dirname as dirname9, join as join17 } from "node:path";
 var FEATURES = ["claude-code", "claude-api", "ollama", "voice", "sandbox"];
 var emptyState = () => ({ version: 1, done: {}, features: [], restart: [] });
-var statePath = (dataDir) => join15(dataDir, "onboarding.json");
+var statePath = (dataDir) => join17(dataDir, "onboarding.json");
 function loadState(dataDir) {
   const f = statePath(dataDir);
-  if (!existsSync11(f)) return emptyState();
+  if (!existsSync13(f)) return emptyState();
   try {
-    const raw = JSON.parse(readFileSync8(f, "utf8"));
+    const raw = JSON.parse(readFileSync9(f, "utf8"));
     const done = raw.done && typeof raw.done === "object" ? Object.fromEntries(Object.entries(raw.done).filter(([, v]) => typeof v === "string")) : {};
     const features2 = Array.isArray(raw.features) ? raw.features.filter((x) => FEATURES.includes(x)) : [];
     const restart = Array.isArray(raw.restart) ? raw.restart.filter((x) => typeof x === "string") : [];
@@ -7739,9 +8022,9 @@ function loadState(dataDir) {
 }
 function saveState(dataDir, state) {
   const f = statePath(dataDir);
-  mkdirSync10(dirname9(f), { recursive: true });
+  mkdirSync11(dirname9(f), { recursive: true });
   const tmp = `${f}.tmp`;
-  writeFileSync10(tmp, JSON.stringify(state, null, 2));
+  writeFileSync11(tmp, JSON.stringify(state, null, 2));
   renameSync3(tmp, f);
 }
 function resetState(dataDir) {
@@ -7830,7 +8113,7 @@ function defaultOnboardDeps() {
     openUrl: async (url) => {
       const [cmd, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
       try {
-        crossSpawn2(cmd, args, { stdio: "ignore", detached: true }).unref();
+        crossSpawn4(cmd, args, { stdio: "ignore", detached: true }).unref();
       } catch {
       }
     },
@@ -8097,7 +8380,7 @@ async function workspace(c) {
   const answer = await text(c.ui, current ? "Workspace folder" : "Workspace folder (Enter to skip)", current ?? "");
   if (answer) {
     const abs = resolve8(answer);
-    mkdirSync11(abs, { recursive: true });
+    mkdirSync12(abs, { recursive: true });
     cfg.roots = [abs];
     saveConfig(cfg);
     io2.out(`Workspace: ${abs}`);
@@ -8131,11 +8414,12 @@ async function network(c) {
   }
   cfg.port = port;
   cfg.bind = where === "lan" ? "0.0.0.0" : "127.0.0.1";
+  cfg.https = where === "lan" ? await yesNo(c.ui, "Use a secure (https) address so a phone can use the microphone? Your phone will show a one-time certificate warning.", true) : false;
   saveConfig(cfg);
-  const u = urlsFor(cfg.bind, cfg.port);
+  const u = urlsFor(cfg.bind, cfg.port, void 0, cfg.https);
   io2.out(`Friend will be at ${u.local}`);
   for (const n of u.network) io2.out(`and on your network at ${n}`);
-  if (where === "lan") io2.out("Note: the microphone and camera only work on this PC (or over HTTPS). Everything else works from the other devices.");
+  if (where === "lan" && !cfg.https) io2.out("Note: the microphone and camera only work on this PC (or over HTTPS). Everything else works from the other devices. Later: friend lan https on");
   return "done";
 }
 async function look(c) {
@@ -8154,7 +8438,7 @@ async function look(c) {
   return "done";
 }
 function summary(cfg, c) {
-  const u = urlsFor(cfg.bind, cfg.port);
+  const u = urlsFor(cfg.bind, cfg.port, void 0, cfg.https);
   const db = openDb(c.io.dataDir);
   let owner = "not created yet";
   try {
@@ -8184,7 +8468,7 @@ async function finish(c) {
     io2.out("Start it whenever you like with: friend start");
     return "done";
   }
-  const url = urlsFor(cfg.bind, cfg.port).local;
+  const url = urlsFor(cfg.bind, cfg.port, void 0, cfg.https).local;
   if (await yesNo(c.ui, "Open it in your browser when it is up?", true)) setTimeout(() => void deps.openUrl(url), 2500);
   io2.out("Starting Friend. Press Ctrl+C to stop it.");
   c.state.done.finish = (/* @__PURE__ */ new Date()).toISOString();
@@ -8334,7 +8618,7 @@ async function claudeCommand(args, io2, deps = {}) {
 }
 
 // ../agent-cli/src/commands/setup.ts
-import { mkdirSync as mkdirSync12 } from "node:fs";
+import { mkdirSync as mkdirSync13 } from "node:fs";
 import { resolve as resolve9 } from "node:path";
 async function setupCommand3(io2) {
   const db = openDb(io2.dataDir);
@@ -8360,7 +8644,7 @@ async function setupCommand3(io2) {
     const cfg = loadConfig(io2.dataDir);
     if (workspace2) {
       const abs = resolve9(workspace2);
-      mkdirSync12(abs, { recursive: true });
+      mkdirSync13(abs, { recursive: true });
       cfg.roots = [abs];
     }
     if (apiKey) cfg.apiKey = apiKey;
@@ -8382,12 +8666,12 @@ async function statusCommand3(io2) {
   const cfg = loadConfig(io2.dataDir);
   const db = openDb(io2.dataDir);
   const auth = new Auth(db, new Audit(db));
-  const owner = auth.hasOwner() ? `yes (${auth.assistantName()})` : "no, run: friend setup";
+  const owner = auth.hasOwner() ? `yes (${auth.assistantName()})` : "no, run: friend onboard";
   db.close();
   io2.out(`Data folder:  ${cfg.dataDir}`);
   io2.out(`Owner set up: ${owner}`);
   io2.out(`Listens on:   ${cfg.bind}:${cfg.port}`);
-  for (const n of urlsFor(cfg.bind, cfg.port).network) io2.out(`Network URL:  ${n}`);
+  for (const n of urlsFor(cfg.bind, cfg.port, void 0, cfg.https).network) io2.out(`Network URL:  ${n}`);
   io2.out(`Public URL:   ${cfg.publicUrl ?? "(none)"}`);
   io2.out(`Workspace:    ${cfg.roots.length ? cfg.roots.join(", ") : "(none, every file action asks first)"}`);
   io2.out(`Model:        ${cfg.model}`);
@@ -8408,13 +8692,16 @@ var USAGE3 = `Usage: friend <command>
   ollama setup|status        use a local model through Ollama (no API key needed)
   lan status|on|off|port N   let other devices on your network open Friend, or change the port (restart to apply)
   claude setup|status        use your Claude subscription through Claude Code (no API key needed)
-  voice setup|status|forget  install or check local speech (hold Space to talk); forget deletes your saved voice
+  voice setup|list|status|forget  install local speech and choose a female or male voice; check it; forget deletes your saved voice
   memory list|forget <n>|clear  see and delete the notes Friend keeps about you
   plugin catalog|list|install|enable|disable|remove  add skills and sandboxed tools
   rules list|remove <id>     manage always-allow rules
   devices list|revoke <id>   manage paired devices
   status                     show configuration
-  config set <key> <value>   keys: apiKey, model, port, bind, publicUrl, roots, trustProxy, allowedOrigins`;
+  config set <key> <value>   change a setting; "friend config keys" lists them all
+  version                    print the version
+
+Start here: friend onboard`;
 async function run(argv, io2) {
   const [cmd, ...rest] = argv;
   try {
@@ -8438,7 +8725,7 @@ async function run(argv, io2) {
       case "version":
       case "--version":
       case "-v":
-        io2.out(true ? "0.1.0" : "development");
+        io2.out(true ? "0.1.2" : "development");
         return 0;
       case "lan":
         return await lanCommand(rest, io2);