friend-assistant 0.1.1 → 0.1.3

package/dist/friend.mjs

@@ -1269,8 +1269,8 @@ function repairDangling(db) {
 }
 function loadHistory(db) {
   const msgs = loadAll(db, WINDOW);
-  const start = msgs.findIndex((m) => m.role === "user" && m.content.some((b) => b.type === "text"));
-  return start === -1 ? [] : msgs.slice(start);
+  const start2 = msgs.findIndex((m) => m.role === "user" && m.content.some((b) => b.type === "text"));
+  return start2 === -1 ? [] : msgs.slice(start2);
 }
 
 // ../server/src/agent/prompt.ts
@@ -2111,6 +2111,7 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { ToolListChangedNotificationSchema } from "@modelcontextprotocol/sdk/types.js";
+import crossSpawn from "cross-spawn";
 import { createHash } from "node:crypto";
 
 // ../server/src/connectors/store.ts
@@ -2235,6 +2236,20 @@ function friendlyToolName(original, taken) {
   taken.add(out);
   return out;
 }
+function killTree(pid) {
+  try {
+    if (process.platform === "win32") crossSpawn("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true }).on("error", () => {
+    });
+    else process.kill(pid, "SIGKILL");
+  } catch {
+  }
+}
+async function stopLive(l) {
+  const pid = l.transport?.pid ?? null;
+  await Promise.race([l.client.close().catch(() => {
+  }), new Promise((r) => setTimeout(r, 3e3).unref?.())]);
+  if (pid) killTree(pid);
+}
 var messageOf = (e) => (e instanceof Error ? e.message : String(e)).slice(0, 400);
 var sleepReject = (ms, what) => new Promise((_, rej) => {
   const t = setTimeout(() => rej(new Error(what)), ms);
@@ -2374,13 +2389,14 @@ ${l.stderr}` : ""}`, isError: true };
     entry.connecting = (async () => {
       try {
         const transport = this.transportFor(cfg, entry);
+        entry.transport = transport;
         client.onclose = () => {
           if (this.live.get(id2) === entry && entry.status === "ready") {
             entry.status = "error";
             entry.error = "The connection closed.";
           }
         };
-        await Promise.race([client.connect(transport), sleepReject(this.opts.connectTimeoutMs ?? 3e4, "It did not answer in time.")]);
+        await Promise.race([client.connect(transport), sleepReject(this.opts.connectTimeoutMs ?? 6e4, "It did not answer in time.")]);
         await this.readTools(id2, entry);
         client.setNotificationHandler(ToolListChangedNotificationSchema, async () => {
           try {
@@ -2393,10 +2409,7 @@ ${l.stderr}` : ""}`, isError: true };
       } catch (e) {
         entry.status = "error";
         entry.error = `${messageOf(e)}${entry.stderr ? ` (${entry.stderr.trim().split("\n").slice(-2).join(" ").slice(0, 200)})` : ""}`;
-        try {
-          await client.close();
-        } catch {
-        }
+        await stopLive(entry);
         throw new Error(entry.error);
       } finally {
         entry.connecting = void 0;
@@ -2447,10 +2460,7 @@ ${l.stderr}` : ""}`, isError: true };
     this.forget(id2);
     if (!l) return;
     l.client.onclose = void 0;
-    try {
-      await l.client.close();
-    } catch {
-    }
+    await stopLive(l);
   }
 };
 function flatten(content) {
@@ -2473,11 +2483,12 @@ var PRESETS = [
     id: "chrome",
     name: "Chrome control",
     description: "Lets Friend open pages, read them, click and type in your own Chrome, through your chrome-control extension.",
-    connector: { id: "chrome", name: "Chrome control", kind: "stdio", command: "chrome-control-mcp", args: [] },
+    quick: true,
+    connector: { id: "chrome", name: "Chrome control", kind: "stdio", command: "npx", args: ["-y", "chrome-control-mcp"] },
     setup: [
-      "Install it once: npm install -g chrome-control-mcp",
-      "Run chrome-control-mcp setup, then load the extension it points to in chrome://extensions (Developer mode, Load unpacked).",
-      "Switch the extension on in Chrome. Friend starts the program itself when you add the connector."
+      "Press Connect. Friend checks that Chrome control is installed and, if it is, adds it for you: it runs npx -y chrome-control-mcp, the same as claude mcp add chrome-control -- npx -y chrome-control-mcp.",
+      "If it is not installed yet, Friend says so and can install it for you in the background (npx -y chrome-control-mcp setup).",
+      "The one step nobody can do for you, because Chrome does not allow silent installs: load the extension in chrome://extensions (Developer mode, Load unpacked) and switch it on."
     ],
     warning: "While the extension is on, Friend can act as you on any site it allows. Every action still asks for your approval; in the extension's popup you can limit it to certain sites."
   },
@@ -2496,6 +2507,122 @@ var PRESETS = [
   }
 ];
 
+// ../server/src/connectors/quick.ts
+import { existsSync as existsSync4 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join6 } from "node:path";
+var find = (id2) => PRESETS.find((p) => p.id === id2 && p.quick);
+var isQuickPreset = (id2) => !!find(id2);
+var MANUAL_EXTENSION = "One step only you can do, because Chrome does not allow programs to install extensions silently: open chrome://extensions, turn on Developer mode (top right), click Load unpacked and choose the folder shown above. Then click the extension's icon and switch it on.";
+function chromeFolder(home) {
+  return join6(home, ".chrome-control-mcp");
+}
+function chromeInstalled(home = homedir()) {
+  const base = chromeFolder(home);
+  const ext = join6(base, "extension");
+  const installed = existsSync4(join6(base, "token")) && existsSync4(join6(ext, "manifest.json")) && existsSync4(join6(base, "native-host"));
+  return { installed, extensionFolder: installed ? ext : null };
+}
+function quickCheck(id2, deps = {}) {
+  const preset = find(id2);
+  if (!preset) return null;
+  const c = chromeInstalled(deps.home);
+  if (c.installed) {
+    return { preset: id2, name: preset.name, ready: true, message: "Chrome control is installed on this PC.", installCommand: null, manualStep: null, extensionFolder: c.extensionFolder };
+  }
+  return {
+    preset: id2,
+    name: preset.name,
+    ready: false,
+    message: "Chrome control is not installed on this PC yet. Please install it first, then press Connect again.",
+    installCommand: "npx -y chrome-control-mcp setup",
+    manualStep: MANUAL_EXTENSION,
+    extensionFolder: null
+  };
+}
+async function quickInstall(id2, deps, onLine) {
+  if (!find(id2)) return { ok: false, output: "", extensionFolder: null, message: "That is not a one-click connector." };
+  const lines = [];
+  const r = await deps.run("npx", ["-y", "chrome-control-mcp", "setup", "--no-claude", "--no-open", "--no-flag"], {
+    onLine: (l) => {
+      lines.push(l);
+      onLine?.(l);
+    }
+  });
+  const after = chromeInstalled(deps.home);
+  const output = (lines.length ? lines : r.stdout.split(/\r?\n/)).filter((l) => l.trim()).slice(-12).join("\n");
+  if (r.code !== 0 || !after.installed) {
+    return { ok: false, output, extensionFolder: null, message: "The install did not finish. You can run it yourself in a terminal: npx -y chrome-control-mcp setup" };
+  }
+  return { ok: true, output, extensionFolder: after.extensionFolder, message: `Chrome control is installed. ${MANUAL_EXTENSION}` };
+}
+function readExtensionState(text2) {
+  try {
+    const o = JSON.parse(text2);
+    if (typeof o.extension === "boolean") return o.extension ? "connected" : "off";
+    if (typeof o.connected === "boolean") return o.connected ? "connected" : "off";
+  } catch {
+  }
+  const t = text2.toLowerCase();
+  if (/not connected|disconnected|no extension|extension is (off|not)|waiting for (the )?extension|not enabled|disabled/.test(t)) return "off";
+  if (/extension[^.\n]*connected|connected[^.\n]*extension|"connected"\s*:\s*true|bridge[^.\n]*connected/.test(t)) return "connected";
+  return "unknown";
+}
+async function quickConnect(id2, deps) {
+  const preset = find(id2);
+  if (!preset) return { ok: false, connector: null, extension: "unknown", message: "That is not a one-click connector." };
+  const check3 = quickCheck(id2, deps);
+  if (!check3.ready) return { ok: false, connector: null, extension: "unknown", message: check3.message };
+  const { hub } = deps;
+  const existing = hub.list().find((c) => c.id === preset.connector.id);
+  const view = existing ? existing.enabled ? await hub.reload(existing.id) : await hub.setEnabled(existing.id, true) : await hub.add(preset.connector);
+  const connector = { id: view.id, name: view.name, status: view.status, error: view.error, tools: view.tools };
+  if (view.status !== "ready") {
+    return { ok: false, connector, extension: "unknown", message: `${preset.name} is saved, but it did not start: ${view.error ?? "unknown error"}` };
+  }
+  const statusTool = hub.toolSpecs().find((t) => t.name === `mcp.${view.id}.status`);
+  let extension = "unknown";
+  if (statusTool) {
+    const r = await hub.call(statusTool.name, {});
+    if (!r.isError) extension = readExtensionState(r.text);
+  }
+  const base = `${preset.name} is on with ${view.tools} tools.`;
+  const message = extension === "connected" ? `${base} Your Chrome extension is connected. Friend can use Chrome now (it still asks before each action).` : extension === "off" ? `${base} But the Chrome extension is not connected yet. Click its icon in Chrome and switch it on (if it is not loaded: chrome://extensions, Developer mode, Load unpacked, then choose ${check3.extensionFolder}).` : `${base} Check that the Chrome extension is loaded and switched on (click its icon in Chrome).`;
+  return { ok: true, connector, extension, message };
+}
+
+// ../server/src/connectors/run.ts
+import crossSpawn2 from "cross-spawn";
+var LIMIT_MS = 5 * 6e4;
+var runCommand = (cmd, args, opts) => new Promise((resolve10) => {
+  let stdout = "";
+  let child;
+  try {
+    child = crossSpawn2(cmd, args, { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+  } catch (e) {
+    resolve10({ code: 127, stdout: e.message });
+    return;
+  }
+  const timer = setTimeout(() => child.kill(), LIMIT_MS);
+  const feed = (d) => {
+    const s = d.toString();
+    stdout += s;
+    if (opts?.onLine) {
+      for (const line of s.split(/\r?\n/)) if (line.trim()) opts.onLine(line);
+    }
+  };
+  child.stdout?.on("data", feed);
+  child.stderr?.on("data", feed);
+  child.on("error", (e) => {
+    clearTimeout(timer);
+    resolve10({ code: 127, stdout: stdout + e.message });
+  });
+  child.on("close", (code) => {
+    clearTimeout(timer);
+    resolve10({ code: code ?? 1, stdout });
+  });
+});
+
 // ../server/src/approvals.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 
@@ -2927,7 +3054,7 @@ import { spawn } from "node:child_process";
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { chmodSync as chmodSync2, mkdtempSync as mkdtempSync2, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 var MAX_CODE_CHARS = 5e4;
 var MAX_OUTPUT_CHARS = 2e4;
 var MAX_EXTRA_FILES = 10;
@@ -2987,15 +3114,15 @@ var CodeBox = class {
     if (extra.reduce((sum, [, body]) => sum + body.length, 0) > MAX_EXTRA_FILE_CHARS) return { ok: false, error: "The sandbox files are too large." };
     const setup = SETUP[input.language];
     const timeoutMs = input.timeoutSec && input.timeoutSec > 0 ? Math.min(input.timeoutSec * 1e3, MAX_TIMEOUT_MS) : DEFAULT_TIMEOUT_MS;
-    const dir = mkdtempSync2(join6(tmpdir(), "friend-code-"));
+    const dir = mkdtempSync2(join7(tmpdir(), "friend-code-"));
     try {
-      const file = join6(dir, setup.file);
+      const file = join7(dir, setup.file);
       writeFileSync3(file, input.code);
       chmodSync2(dir, 493);
       chmodSync2(file, 420);
       for (const [name, body] of extra) {
-        writeFileSync3(join6(dir, name), body);
-        chmodSync2(join6(dir, name), 420);
+        writeFileSync3(join7(dir, name), body);
+        chmodSync2(join7(dir, name), 420);
       }
       const args = [
         "run",
@@ -3130,12 +3257,12 @@ var Memory = class {
 // ../server/src/app.ts
 import { dirname as dirname3, resolve as resolve2 } from "node:path";
 import { fileURLToPath } from "node:url";
-import { join as join10 } from "node:path";
+import { join as join12 } from "node:path";
 
 // ../server/src/config.ts
-import { chmodSync as chmodSync3, existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "node:fs";
-import { homedir } from "node:os";
-import { join as join7 } from "node:path";
+import { chmodSync as chmodSync3, existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join8 } from "node:path";
 var DEFAULT_CLAUDE_CODE = { model: "sonnet", command: "claude", fallback: "ollama" };
 function sanitizeClaudeCode(raw) {
   const r = raw && typeof raw === "object" ? raw : {};
@@ -3208,12 +3335,13 @@ var DEFAULT_DESTRUCTIVE_PATTERNS = [
   String.raw`\b(iex|invoke-expression)\b`
 ];
 function defaultDataDir() {
-  return process.env.FRIEND_HOME ?? join7(homedir(), ".friend");
+  return process.env.FRIEND_HOME ?? join8(homedir2(), ".friend");
 }
 var defaults = (dataDir) => ({
   bind: "127.0.0.1",
   port: 8787,
   publicUrl: null,
+  https: false,
   trustProxy: false,
   allowedOrigins: [],
   allowedHosts: [],
@@ -3230,7 +3358,7 @@ var defaults = (dataDir) => ({
   dataDir
 });
 function configPath(dataDir) {
-  return join7(dataDir, "config.json");
+  return join8(dataDir, "config.json");
 }
 function saveConfig(cfg) {
   const { dataDir, ...rest } = cfg;
@@ -3245,7 +3373,7 @@ function loadConfig(dataDir = defaultDataDir()) {
   mkdirSync4(dataDir, { recursive: true });
   const file = configPath(dataDir);
   const base = defaults(dataDir);
-  if (!existsSync4(file)) {
+  if (!existsSync5(file)) {
     const { dataDir: _d, ...rest } = base;
     saveConfig({ ...rest, dataDir });
     return base;
@@ -3255,6 +3383,7 @@ function loadConfig(dataDir = defaultDataDir()) {
   return {
     ...base,
     ...stored,
+    https: stored.https === true,
     destructivePatterns,
     ollama: { ...DEFAULT_OLLAMA, ...stored.ollama },
     claudeCode: sanitizeClaudeCode(stored.claudeCode),
@@ -3268,7 +3397,7 @@ function loadConfig(dataDir = defaultDataDir()) {
 // ../server/src/db.ts
 import Database from "better-sqlite3";
 import { mkdirSync as mkdirSync5 } from "node:fs";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 
 // ../server/src/migrations.ts
 var MIGRATIONS = [
@@ -3385,7 +3514,7 @@ create table plugins (
 // ../server/src/db.ts
 function openDb(dataDir) {
   mkdirSync5(dataDir, { recursive: true });
-  const db = new Database(join8(dataDir, "friend.db"));
+  const db = new Database(join9(dataDir, "friend.db"));
   db.pragma("journal_mode = WAL");
   db.pragma("foreign_keys = ON");
   db.exec("create table if not exists schema_version (id integer primary key, applied_at integer not null)");
@@ -3483,16 +3612,16 @@ var DeviceHub = class {
 import fastifyCookie from "@fastify/cookie";
 import fastifyStatic from "@fastify/static";
 import Fastify from "fastify";
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import { isIP } from "node:net";
 import { WebSocket, WebSocketServer } from "ws";
 import { z as z10 } from "zod";
 
 // ../server/src/http-error.ts
 var HttpError = class extends Error {
-  constructor(status, message) {
+  constructor(status2, message) {
     super(message);
-    this.status = status;
+    this.status = status2;
   }
   status;
 };
@@ -3558,7 +3687,7 @@ function createGateway(deps) {
     forceCloseConnections: true
     // shutdown must not wait for idle keep-alive connections
   };
-  const app = Fastify(options);
+  const app = Fastify(deps.tls ? { ...options, https: { key: deps.tls.key, cert: deps.tls.cert } } : options);
   app.register(fastifyCookie);
   const hostOf = (header) => {
     const h = (header ?? "").trim().toLowerCase();
@@ -3768,6 +3897,24 @@ function createGateway(deps) {
       return connectorError(reply, e, "add");
     }
   });
+  app.get("/api/connectors/quick/:preset", { onRequest: connectorGuard }, async (req, reply) => {
+    try {
+      return deps.connectors.quickCheck(req.params.preset);
+    } catch (e) {
+      return connectorError(reply, e, "quick-check");
+    }
+  });
+  for (const action of ["install", "connect"]) {
+    app.post(`/api/connectors/quick/:preset/${action}`, { onRequest: connectorGuard }, async (req, reply) => {
+      const body = z10.object({ pin: z10.string().min(1).max(32) }).safeParse(req.body);
+      if (!body.success) return reply.code(400).send({ error: "Enter your PIN to continue" });
+      try {
+        return await (action === "install" ? deps.connectors.quickInstall : deps.connectors.quickConnect)(req.params.preset, body.data.pin, req.ip);
+      } catch (e) {
+        return connectorError(reply, e, `quick-${action}`);
+      }
+    });
+  }
   app.post("/api/connectors/:id/enabled", { onRequest: connectorGuard }, async (req, reply) => {
     const body = z10.object({ enabled: z10.boolean(), pin: z10.string().min(1).max(32).optional() }).safeParse(req.body);
     if (!body.success) return reply.code(400).send({ error: "Invalid input" });
@@ -3903,7 +4050,7 @@ function createGateway(deps) {
     deps.onLock?.();
     return { ok: true };
   });
-  if (deps.webDir && existsSync5(deps.webDir)) {
+  if (deps.webDir && existsSync6(deps.webDir)) {
     app.register(fastifyStatic, { root: deps.webDir });
     app.setNotFoundHandler((req, reply) => {
       if (req.method === "GET" && !req.url.startsWith("/api")) return reply.sendFile("index.html");
@@ -3928,6 +4075,7 @@ function createGateway(deps) {
     const fwd = config.trustProxy ? String(req.headers["x-forwarded-for"] ?? "").split(",").at(-1)?.trim() : "";
     return fwd || req.socket.remoteAddress || "unknown";
   };
+  let activeOwner = null;
   function handleClient(ws, req) {
     if (!originAllowed(req)) {
       audit.log("anonymous", "ws.origin_refused", { origin: req.headers.origin });
@@ -3936,6 +4084,19 @@ function createGateway(deps) {
     const token = parseCookies(req.headers.cookie)[COOKIE_NAME];
     const session = token ? auth.resolveSession(token) : null;
     if (!session) return ws.close(4401, "unauthorized");
+    const params = new URL(req.url ?? "/", "http://localhost").searchParams;
+    const tab = (params.get("tab") ?? "").slice(0, 64);
+    if (tab) {
+      if (activeOwner && activeOwner.ws.readyState === WebSocket.OPEN) {
+        if (params.get("takeover") !== "1" && activeOwner.tab !== tab) return ws.close(4409, "in use elsewhere");
+        activeOwner.ws.close(4410, "replaced");
+      }
+      const mine = { ws, tab };
+      activeOwner = mine;
+      ws.on("close", () => {
+        if (activeOwner === mine) activeOwner = null;
+      });
+    }
     const conn = {
       ip: clientIp(req),
       send: (m) => {
@@ -3946,6 +4107,7 @@ function createGateway(deps) {
     const dispose = deps.onClientConnect?.(session, conn);
     ws.on("close", () => dispose?.());
     ws.on("message", (data) => {
+      if (tab && activeOwner?.ws !== ws) return;
       let json;
       try {
         json = JSON.parse(String(data));
@@ -4125,8 +4287,8 @@ var ClaudeProvider = class {
 
 // ../server/src/provider/claude-code/provider.ts
 import { createHash as createHash3 } from "node:crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync4, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join9 } from "node:path";
+import { chmodSync as chmodSync4, existsSync as existsSync7, mkdirSync as mkdirSync6, readFileSync as readFileSync4, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join10 } from "node:path";
 
 // ../server/src/provider/claude-code/bridge.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -4411,7 +4573,7 @@ var NOT_SIGNED_IN = /not logged in|please run \/login|invalid api key|authentica
 var ClaudeCodeProvider = class {
   constructor(opts) {
     this.opts = opts;
-    this.home = join9(opts.dataDir, "claude");
+    this.home = join10(opts.dataDir, "claude");
     this.now = opts.now ?? Date.now;
     this.bridge = new ToolBridge((call) => this.owner.inbox.push({ kind: "call", call }));
   }
@@ -4641,7 +4803,7 @@ ${item.stderr}`;
       "local",
       "--system-prompt",
       req.system,
-      ...conv.guest ? ["--no-session-persistence"] : ["--mcp-config", join9(this.home, "mcp.json"), "--allowedTools", req.tools.map((t) => `mcp__friend__${encodeToolName(t.name)}`).join(","), ...resume ? ["--resume", resume] : []]
+      ...conv.guest ? ["--no-session-persistence"] : ["--mcp-config", join10(this.home, "mcp.json"), "--allowedTools", req.tools.map((t) => `mcp__friend__${encodeToolName(t.name)}`).join(","), ...resume ? ["--resume", resume] : []]
     ];
     const proc = new ClaudeProc(
       {
@@ -4672,7 +4834,7 @@ ${item.stderr}`;
   startBridge() {
     this.bridgeReady ??= (async () => {
       await this.bridge.start();
-      const file = join9(this.home, "mcp.json");
+      const file = join10(this.home, "mcp.json");
       writeFileSync5(file, JSON.stringify({ mcpServers: { friend: { type: "http", url: this.bridge.url, headers: { Authorization: `Bearer ${this.bridge.token}` } } } }));
       try {
         chmodSync4(file, 384);
@@ -4682,10 +4844,10 @@ ${item.stderr}`;
     return this.bridgeReady;
   }
   // ---- the session id, kept so a restart of Friend can pick the conversation up again ----
-  sessionFile = () => join9(this.home, "session-id");
+  sessionFile = () => join10(this.home, "session-id");
   readSession() {
     try {
-      return existsSync6(this.sessionFile()) ? readFileSync4(this.sessionFile(), "utf8").trim() || null : null;
+      return existsSync7(this.sessionFile()) ? readFileSync4(this.sessionFile(), "utf8").trim() || null : null;
     } catch {
       return null;
     }
@@ -5120,6 +5282,63 @@ var OllamaProvider = class {
   }
 };
 
+// ../server/src/tls.ts
+import { chmodSync as chmodSync5, existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "node:fs";
+import { networkInterfaces } from "node:os";
+import { isIP as isIP2 } from "node:net";
+import { join as join11 } from "node:path";
+import { generate } from "selfsigned";
+var DAYS = 825;
+var RENEW_BEFORE_MS = 30 * 24 * 36e5;
+function lanAddresses(ifaces = networkInterfaces) {
+  const out = [];
+  for (const list2 of Object.values(ifaces())) {
+    for (const i of list2 ?? []) if (i.family === "IPv4" && !i.internal && !out.includes(i.address)) out.push(i.address);
+  }
+  return out;
+}
+function tlsHosts(extra = [], ifaces) {
+  return [.../* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", ...lanAddresses(ifaces), ...extra.map((h) => h.toLowerCase()).filter(Boolean)])];
+}
+async function ensureTlsCert(dataDir, extraHosts = [], ifaces, now = Date.now) {
+  const dir = join11(dataDir, "tls");
+  const keyFile = join11(dir, "key.pem");
+  const certFile = join11(dir, "cert.pem");
+  const metaFile = join11(dir, "meta.json");
+  const hosts = tlsHosts(extraHosts, ifaces);
+  if (existsSync8(keyFile) && existsSync8(certFile) && existsSync8(metaFile)) {
+    try {
+      const meta = JSON.parse(readFileSync5(metaFile, "utf8"));
+      const covered = hosts.every((h) => meta.hosts.includes(h));
+      if (covered && meta.expires - now() > RENEW_BEFORE_MS) return { key: readFileSync5(keyFile, "utf8"), cert: readFileSync5(certFile, "utf8") };
+    } catch {
+    }
+  }
+  const altNames = hosts.map((h) => isIP2(h) ? { type: 7, ip: h } : { type: 2, value: h });
+  const pems = await generate([{ name: "commonName", value: "Friend" }], {
+    keySize: 2048,
+    notBeforeDate: new Date(now() - 24 * 36e5),
+    // a day back, so a phone whose clock is a little slow still accepts it
+    notAfterDate: new Date(now() + DAYS * 24 * 36e5),
+    algorithm: "sha256",
+    extensions: [
+      { name: "basicConstraints", cA: false },
+      { name: "keyUsage", digitalSignature: true, keyEncipherment: true },
+      { name: "extKeyUsage", serverAuth: true },
+      { name: "subjectAltName", altNames }
+    ]
+  });
+  mkdirSync7(dir, { recursive: true });
+  writeFileSync6(keyFile, pems.private);
+  writeFileSync6(certFile, pems.cert);
+  writeFileSync6(metaFile, JSON.stringify({ hosts, expires: now() + DAYS * 24 * 36e5 }));
+  try {
+    chmodSync5(keyFile, 384);
+  } catch {
+  }
+  return { key: pems.private, cert: pems.cert };
+}
+
 // ../server/src/voice/challenge.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
 var Challenges = class {
@@ -5181,22 +5400,22 @@ var Challenges = class {
 
 // ../server/src/voice/crypto.ts
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes3 } from "node:crypto";
-import { chmodSync as chmodSync5, existsSync as existsSync7, mkdirSync as mkdirSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "node:fs";
+import { chmodSync as chmodSync6, existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "node:fs";
 import { dirname as dirname2 } from "node:path";
 var KEY_BYTES = 32;
 var IV_BYTES = 12;
 var TAG_BYTES = 16;
 function loadOrCreateKey(path) {
-  if (existsSync7(path)) {
-    const key2 = readFileSync5(path);
+  if (existsSync9(path)) {
+    const key2 = readFileSync6(path);
     if (key2.length !== KEY_BYTES) throw new Error(`invalid voice key file (expected ${KEY_BYTES} bytes): ${path}`);
     return key2;
   }
-  mkdirSync7(dirname2(path), { recursive: true });
+  mkdirSync8(dirname2(path), { recursive: true });
   const key = randomBytes3(KEY_BYTES);
-  writeFileSync6(path, key, { mode: 384 });
+  writeFileSync7(path, key, { mode: 384 });
   try {
-    chmodSync5(path, 384);
+    chmodSync6(path, 384);
   } catch {
   }
   return key;
@@ -5614,7 +5833,7 @@ async function createApp(opts) {
   const camera = new CameraBroker(opts.cameraTimeoutMs);
   const memory = new Memory(db);
   const tasks = new Tasks(db);
-  const plugins = new Plugins(db, join10(opts.dataDir, "plugins"));
+  const plugins = new Plugins(db, join12(opts.dataDir, "plugins"));
   const hub = new McpHub(new ConnectorStore(opts.dataDir));
   const admin = makeAdmin({ hub, plugins, dataDir: opts.dataDir, audit: (what, detail) => audit.log("agent", what, detail) });
   function commitSettings(patch, how) {
@@ -5720,7 +5939,7 @@ async function createApp(opts) {
   const voice2 = opts.voice;
   const speaker = voice2 ? new Speaker(voice2, audit, () => config.voice.ttsVoice) : null;
   const voiceAvailable = () => !!voice2 && voice2.available();
-  const voiceprint = voice2 ? new Voiceprint(db, loadOrCreateKey(join10(opts.dataDir, "voice.key"))) : null;
+  const voiceprint = voice2 ? new Voiceprint(db, loadOrCreateKey(join12(opts.dataDir, "voice.key"))) : null;
   const enrollment = voiceprint ? new Enrollment(voiceprint, SPEAKER_MODEL) : null;
   const challenges = new Challenges((id2) => {
     broadcast({ type: "voice.challenge.end", id: id2 });
@@ -5837,7 +6056,7 @@ async function createApp(opts) {
       if (!isPluginId(id2)) throw new HttpError(400, "That is not a plugin name.");
       if (!listCatalog(catalogDir).some((c) => c.id === id2)) throw new HttpError(404, "That plugin is not in the catalog.");
       await requirePin(pin, ip);
-      const r = plugins.install(join10(catalogDir, id2));
+      const r = plugins.install(join12(catalogDir, id2));
       if (!r.ok) throw new HttpError(400, `That plugin cannot be installed: ${r.error}`);
       audit.log("owner", "plugin.installed", { id: r.id, upgraded: r.upgraded, ip });
       return { id: r.id, upgraded: r.upgraded };
@@ -5892,6 +6111,24 @@ async function createApp(opts) {
         throw new HttpError(404, e.message);
       }
     },
+    quickCheck: (preset) => {
+      const c = quickCheck(preset, { home: opts.quick?.home });
+      if (!c) throw new HttpError(404, "That is not a one-click connector.");
+      return c;
+    },
+    quickInstall: async (preset, pin, ip) => {
+      if (!isQuickPreset(preset)) throw new HttpError(404, "That is not a one-click connector.");
+      await requirePin(pin, ip);
+      audit.log("owner", "connector.quick_install", { preset, ip });
+      return quickInstall(preset, { hub, run: opts.quick?.run ?? runCommand, home: opts.quick?.home });
+    },
+    quickConnect: async (preset, pin, ip) => {
+      if (!isQuickPreset(preset)) throw new HttpError(404, "That is not a one-click connector.");
+      await requirePin(pin, ip);
+      const result = await quickConnect(preset, { hub, run: opts.quick?.run ?? runCommand, home: opts.quick?.home });
+      audit.log("owner", "connector.quick_connect", { preset, ok: result.ok, extension: result.extension, ip });
+      return result;
+    },
     remove: async (id2) => {
       try {
         await hub.remove(id2);
@@ -5901,7 +6138,9 @@ async function createApp(opts) {
       }
     }
   };
+  const tls = config.https ? await ensureTlsCert(opts.dataDir, [...config.allowedHosts, ...config.publicUrl ? [new URL(config.publicUrl).hostname] : []]) : void 0;
   const gateway = createGateway({
+    ...tls ? { tls } : {},
     connectors: connectorsApi,
     voicePreview: async (id2) => {
       if (!voice2 || !voiceAvailable()) throw new HttpError(503, "Voice is not available. Run: friend voice setup");
@@ -6118,11 +6357,10 @@ async function createApp(opts) {
       camera.cancelAll(broadcast);
       agent.cancel();
       approvals.denyAll("Shutting down");
-      await gateway.close();
-      await provider.close?.().catch(() => {
-      });
-      await hub.close().catch(() => {
-      });
+      await Promise.all([gateway.close().catch(() => {
+      }), provider.close?.().catch(() => {
+      }), hub.close().catch(() => {
+      })]);
       db.close();
     }
   };
@@ -6250,7 +6488,7 @@ var SidecarProcess = class {
 import { createInterface as createInterface2 } from "node:readline";
 
 // ../agent-cli/src/commands/config.ts
-import { isIP as isIP2 } from "node:net";
+import { isIP as isIP3 } from "node:net";
 var list = (v) => v.split(",").map((s) => s.trim()).filter(Boolean);
 var bool = (v) => {
   if (v !== "true" && v !== "false") throw new Error("Expected true or false");
@@ -6280,10 +6518,11 @@ var PARSERS = {
   model: (v) => v,
   bind: (v) => {
     const t = v.trim();
-    if (t !== "localhost" && isIP2(t) === 0) throw new Error("bind must be an IP address such as 127.0.0.1 (this PC only) or 0.0.0.0 (also your network), or localhost. Easier: friend lan on");
+    if (t !== "localhost" && isIP3(t) === 0) throw new Error("bind must be an IP address such as 127.0.0.1 (this PC only) or 0.0.0.0 (also your network), or localhost. Easier: friend lan on");
     return t;
   },
   publicUrl: (v) => v === "" ? null : v,
+  https: bool,
   port: (v) => {
     const n = Number(v);
     if (!Number.isInteger(n) || n < 0 || n > 65535) throw new Error("Port must be a number between 0 and 65535");
@@ -6336,6 +6575,7 @@ var KEY_HELP = {
   provider: "which model answers: claude (API key), claude-code (your Claude subscription) or ollama (on this PC)",
   bind: "address Friend listens on: 127.0.0.1 is this PC only, 0.0.0.0 is your whole network (easier: friend lan on)",
   port: "the web port (easier: friend lan port N)",
+  https: "true serves a secure https:// address (Friend makes its own certificate), so a phone may use the microphone (easier: friend lan https on)",
   publicUrl: "the address people use when Friend is behind your own domain, or empty",
   roots: "folders Friend may read and write freely, separated by commas",
   allowedOrigins: "extra web addresses allowed to connect, separated by commas",
@@ -6400,8 +6640,8 @@ import { resolve as resolve6 } from "node:path";
 import { WebSocket as WebSocket2 } from "ws";
 
 // ../agent-cli/src/tools/fs.ts
-import { closeSync, mkdirSync as mkdirSync8, openSync, readSync, readdirSync as readdirSync2, statSync, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname5, join as join11 } from "node:path";
+import { closeSync, mkdirSync as mkdirSync9, openSync, readSync, readdirSync as readdirSync2, statSync, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname5, join as join13 } from "node:path";
 
 // ../agent-cli/src/tools/roots.ts
 import { lstatSync as lstatSync2, realpathSync } from "node:fs";
@@ -6463,7 +6703,7 @@ function fsList(args, ctx) {
       if (e.isDirectory()) return `[dir]  ${e.name}`;
       let size = 0;
       try {
-        size = statSync(join11(g.abs, e.name)).size;
+        size = statSync(join13(g.abs, e.name)).size;
       } catch {
       }
       return `[file] ${e.name} (${size} bytes)`;
@@ -6504,8 +6744,8 @@ function fsWrite(args, ctx) {
   if ("error" in g) return { ok: false, error: g.error };
   if (Buffer.byteLength(args.content) > MAX_WRITE) return { ok: false, error: "Content too large (5 MB limit)" };
   try {
-    mkdirSync8(dirname5(g.abs), { recursive: true });
-    writeFileSync7(g.abs, args.content);
+    mkdirSync9(dirname5(g.abs), { recursive: true });
+    writeFileSync8(g.abs, args.content);
     return { ok: true, output: `Wrote ${Buffer.byteLength(args.content)} bytes to ${g.abs}`, truncated: false };
   } catch (e) {
     return { ok: false, error: e.message };
@@ -6514,7 +6754,7 @@ function fsWrite(args, ctx) {
 
 // ../agent-cli/src/tools/shell.ts
 import { spawn as spawn4, spawnSync } from "node:child_process";
-function killTree(child) {
+function killTree2(child) {
   if (!child.pid) return;
   if (process.platform === "win32") {
     spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"], { windowsHide: true });
@@ -6526,7 +6766,7 @@ function killTree(child) {
     }
   }
 }
-function runCommand(command, cwdArg, ctx, argv) {
+function runCommand2(command, cwdArg, ctx, argv) {
   let cwd = ctx.roots[0] ?? process.cwd();
   if (cwdArg) {
     const r = resolveInRoots(cwdArg, ctx.roots);
@@ -6559,7 +6799,7 @@ function runCommand(command, cwdArg, ctx, argv) {
     child.stderr.on("data", take);
     const timer = setTimeout(() => {
       timedOut = true;
-      killTree(child);
+      killTree2(child);
     }, ctx.timeoutMs);
     child.on("error", (e) => {
       clearTimeout(timer);
@@ -6617,7 +6857,7 @@ async function systemInfo(sampleMs = 250) {
   return { ok: true, output: lines.join("\n"), truncated: false };
 }
 function processList(ctx) {
-  return process.platform === "win32" ? runCommand("", void 0, ctx, { file: "tasklist.exe", args: ["/fo", "csv", "/nh"] }) : runCommand("", void 0, ctx, { file: "ps", args: ["-eo", "pid,comm"] });
+  return process.platform === "win32" ? runCommand2("", void 0, ctx, { file: "tasklist.exe", args: ["/fo", "csv", "/nh"] }) : runCommand2("", void 0, ctx, { file: "ps", args: ["-eo", "pid,comm"] });
 }
 
 // ../agent-cli/src/tools/index.ts
@@ -6641,7 +6881,7 @@ async function runTool(name, args, ctx) {
       case "process.list":
         return await processList(ctx);
       case "shell.run":
-        return await runCommand(a.command, a.cwd, ctx);
+        return await runCommand2(a.command, a.cwd, ctx);
       default:
         return { ok: false, error: `Unknown tool: ${name}` };
     }
@@ -6671,10 +6911,10 @@ function startDeviceNode(opts) {
     state = s;
     opts.onState?.(s);
   };
-  function connect() {
+  function connect2() {
     if (stopped) return;
     setState("connecting");
-    const sock = new WebSocket2(opts.url, { headers: { authorization: `Bearer ${opts.token}` } });
+    const sock = new WebSocket2(opts.url, { headers: { authorization: `Bearer ${opts.token}` }, ...opts.ca ? { ca: opts.ca } : {} });
     ws = sock;
     sock.on("error", () => {
     });
@@ -6719,10 +6959,10 @@ function startDeviceNode(opts) {
       if (opts.reconnect === false) return;
       const delay = Math.min(base * 2 ** attempt, 1e4);
       attempt += 1;
-      timer = setTimeout(connect, delay);
+      timer = setTimeout(connect2, delay);
     });
   }
-  connect();
+  connect2();
   return {
     connected,
     state: () => state,
@@ -6741,15 +6981,15 @@ function startDeviceNode(opts) {
 
 // ../agent-cli/src/commands/start.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
-import { existsSync as existsSync9, readFileSync as readFileSync7, writeFileSync as writeFileSync9 } from "node:fs";
-import { dirname as dirname7, join as join13, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync8, writeFileSync as writeFileSync10 } from "node:fs";
+import { dirname as dirname7, join as join15, resolve as resolve5 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // ../agent-cli/src/commands/lan.ts
-import { networkInterfaces } from "node:os";
+import { networkInterfaces as networkInterfaces2 } from "node:os";
 var LOOPBACK3 = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1"]);
 var isLoopbackBind = (bind) => LOOPBACK3.has(bind);
-function lanAddresses(ifaces = networkInterfaces) {
+function lanAddresses2(ifaces = networkInterfaces2) {
   const out = [];
   for (const list2 of Object.values(ifaces())) {
     for (const i of list2 ?? []) {
@@ -6758,11 +6998,12 @@ function lanAddresses(ifaces = networkInterfaces) {
   }
   return out;
 }
-function urlsFor(bind, port, ifaces = networkInterfaces) {
-  const local = `http://127.0.0.1:${port}`;
+function urlsFor(bind, port, ifaces = networkInterfaces2, https = false) {
+  const scheme = https ? "https" : "http";
+  const local = `${scheme}://127.0.0.1:${port}`;
   if (isLoopbackBind(bind)) return { local, network: [] };
-  if (bind === "0.0.0.0" || bind === "::") return { local, network: lanAddresses(ifaces).map((a) => `http://${a}:${port}`) };
-  return { local, network: [`http://${bind}:${port}`] };
+  if (bind === "0.0.0.0" || bind === "::") return { local, network: lanAddresses2(ifaces).map((a) => `${scheme}://${a}:${port}`) };
+  return { local, network: [`${scheme}://${bind}:${port}`] };
 }
 var PORT_HELP = "The port must be a whole number from 1024 to 65535.";
 function parsePort(v) {
@@ -6770,34 +7011,58 @@ function parsePort(v) {
   if (v === void 0 || v.trim() === "" || !Number.isInteger(n) || n < 1024 || n > 65535) throw new Error(PORT_HELP);
   return n;
 }
-function show(io2, bind, port, ifaces) {
-  const u = urlsFor(bind, port, ifaces);
+function show(io2, bind, port, ifaces, https = false) {
+  const u = urlsFor(bind, port, ifaces, https);
   io2.out(`Listens on:    ${bind}:${port}`);
   io2.out(`On this PC:    ${u.local}`);
   if (u.network.length) for (const n of u.network) io2.out(`On your network: ${n}`);
   else if (isLoopbackBind(bind)) io2.out("On your network: not reachable (only this PC). Turn it on with: friend lan on");
   else io2.out("On your network: no network address found. Check that this PC is connected.");
 }
-async function lanCommand(args, io2, ifaces = networkInterfaces) {
+async function lanCommand(args, io2, ifaces = networkInterfaces2) {
   const [sub, ...rest] = args;
   const cfg = loadConfig(io2.dataDir);
   switch (sub) {
     case void 0:
     case "status":
-      show(io2, cfg.bind, cfg.port, ifaces);
+      show(io2, cfg.bind, cfg.port, ifaces, cfg.https);
+      io2.out(cfg.https ? "Secure (https): on. A phone can use the microphone and camera." : "Secure (https): off. A phone cannot use the microphone or camera. Turn it on with: friend lan https on");
+      return 0;
+    case "https": {
+      if (rest[0] !== "on" && rest[0] !== "off") {
+        io2.err("Usage: friend lan https on | off");
+        return 1;
+      }
+      cfg.https = rest[0] === "on";
+      saveConfig(cfg);
+      show(io2, cfg.bind, cfg.port, ifaces, cfg.https);
+      io2.out("");
+      io2.out("Restart Friend to apply (stop it, then: friend start).");
+      if (cfg.https) {
+        io2.out("Friend makes its own security certificate, so the first time a phone opens the https:// address it shows a warning:");
+        io2.out("  Android Chrome: Advanced, then Proceed.   iPhone Safari: Show Details, then visit this website.");
+        io2.out("After that, the microphone and camera work from the phone. Only that address is affected; nothing is installed on the phone.");
+        if (isLoopbackBind(cfg.bind)) io2.out("Friend is still only reachable from this PC. To open it from a phone too: friend lan on");
+      }
       return 0;
+    }
     case "on": {
       const portFlag = rest.indexOf("--port");
       if (portFlag >= 0) cfg.port = parsePort(rest[portFlag + 1]);
       cfg.bind = "0.0.0.0";
+      if (rest.includes("--https")) cfg.https = true;
       saveConfig(cfg);
-      show(io2, cfg.bind, cfg.port, ifaces);
+      show(io2, cfg.bind, cfg.port, ifaces, cfg.https);
       io2.out("");
       io2.out("Restart Friend to apply (stop it, then: friend start).");
       io2.out("Things to know:");
       io2.out("  - Anyone on your network can open the sign-in page. Your password and PIN still guard everything; use a strong password.");
-      io2.out("  - The connection is plain http: other people on the network could read it. Use it only on a network you trust, or put Friend behind HTTPS (see publicUrl in the README).");
-      io2.out("  - Browsers allow the microphone and camera only on localhost or HTTPS, so voice and camera will not work from another device over plain http.");
+      if (cfg.https) {
+        io2.out("  - Secure (https) is on. The first time a phone opens the address it shows a certificate warning (Advanced, then Proceed); after that the microphone works.");
+      } else {
+        io2.out("  - The connection is plain http: other people on the network could read it. Use it only on a network you trust.");
+        io2.out("  - Browsers allow the microphone and camera only on localhost or HTTPS, so voice and camera will not work from a phone over plain http. Fix: friend lan https on");
+      }
       io2.out("  - Windows may ask to allow Node.js through the firewall the first time: allow it on Private networks.");
       io2.out("  - Going to a name such as http://my-pc:8787 needs: friend config set allowedHosts my-pc");
       return 0;
@@ -6805,41 +7070,41 @@ async function lanCommand(args, io2, ifaces = networkInterfaces) {
     case "off":
       cfg.bind = "127.0.0.1";
       saveConfig(cfg);
-      show(io2, cfg.bind, cfg.port, ifaces);
+      show(io2, cfg.bind, cfg.port, ifaces, cfg.https);
       io2.out("Restart Friend to apply.");
       return 0;
     case "port": {
       cfg.port = parsePort(rest[0]);
       saveConfig(cfg);
-      show(io2, cfg.bind, cfg.port, ifaces);
+      show(io2, cfg.bind, cfg.port, ifaces, cfg.https);
       io2.out("Restart Friend to apply.");
       return 0;
     }
     default:
-      io2.err("Usage: friend lan status | on [--port N] | off | port N");
+      io2.err("Usage: friend lan status | on [--port N] [--https] | off | port N | https on|off");
       return 1;
   }
 }
 
 // ../agent-cli/src/commands/voice.ts
 import { spawn as spawn5 } from "node:child_process";
-import { existsSync as existsSync8, mkdirSync as mkdirSync9, readFileSync as readFileSync6, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname6, join as join12, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync7, writeFileSync as writeFileSync9 } from "node:fs";
+import { dirname as dirname6, join as join14, resolve as resolve4 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function voicePaths(dataDir) {
-  const home = join12(dataDir, "voice");
-  const venv = join12(home, "venv");
+  const home = join14(dataDir, "voice");
+  const venv = join14(home, "venv");
   return {
     home,
     venv,
-    python: process.platform === "win32" ? join12(venv, "Scripts", "python.exe") : join12(venv, "bin", "python"),
-    models: join12(home, "models"),
-    marker: join12(home, "installed.json")
+    python: process.platform === "win32" ? join14(venv, "Scripts", "python.exe") : join14(venv, "bin", "python"),
+    models: join14(home, "models"),
+    marker: join14(home, "installed.json")
   };
 }
 function readMarker(dataDir) {
   try {
-    return JSON.parse(readFileSync6(voicePaths(dataDir).marker, "utf8"));
+    return JSON.parse(readFileSync7(voicePaths(dataDir).marker, "utf8"));
   } catch {
     return null;
   }
@@ -6936,8 +7201,8 @@ async function voiceSetupCommand(io2, deps = {}, args = []) {
     io2.err("Python 3.10 or newer is required. Install it from https://www.python.org/downloads/ and run this again.");
     return 1;
   }
-  mkdirSync9(p.home, { recursive: true });
-  if (!existsSync8(p.python)) {
+  mkdirSync10(p.home, { recursive: true });
+  if (!existsSync10(p.python)) {
     io2.out("1/3 Creating a private Python environment\u2026");
     const r = await run2(py.cmd, [...py.args, "-m", "venv", p.venv], { onLine });
     if (r.code !== 0) {
@@ -6963,7 +7228,7 @@ ${tail(dl.stdout)}`);
     return 1;
   }
   const marker = { python: p.python, sttModel: cfg.voice.sttModel, ttsVoice: cfg.voice.ttsVoice, at: Date.now() };
-  writeFileSync8(p.marker, JSON.stringify(marker, null, 2));
+  writeFileSync9(p.marker, JSON.stringify(marker, null, 2));
   io2.out("Voice is ready. Start Friend with `friend start`, then hold Space to talk.");
   return 0;
 }
@@ -6979,7 +7244,7 @@ async function voiceStatusCommand(io2) {
     io2.out("Voice engine:   not installed. Run: friend voice setup");
     return 0;
   }
-  if (!existsSync8(marker.python)) {
+  if (!existsSync10(marker.python)) {
     io2.out("Voice engine:   installed, but its Python is missing. Run: friend voice setup");
     return 0;
   }
@@ -7052,7 +7317,7 @@ async function voiceCommand(args, io2) {
 function findWebDir(explicit) {
   const here = dirname7(fileURLToPath3(import.meta.url));
   const candidates = [explicit, process.env.FRIEND_WEB_DIR, resolve5(here, "../../../web/dist"), resolve5(here, "web")];
-  return candidates.find((c) => !!c && existsSync9(join13(c, "index.html")));
+  return candidates.find((c) => !!c && existsSync11(join15(c, "index.html")));
 }
 async function startFriend(opts) {
   const stored = loadConfig(opts.dataDir);
@@ -7086,18 +7351,20 @@ async function startFriend(opts) {
     }
   });
   const { port } = await app.start();
-  const tokenFile = join13(opts.dataDir, "local-device.token");
-  let token = existsSync9(tokenFile) ? readFileSync7(tokenFile, "utf8").trim() : "";
+  const tokenFile = join15(opts.dataDir, "local-device.token");
+  let token = existsSync11(tokenFile) ? readFileSync8(tokenFile, "utf8").trim() : "";
   if (!token || !app.auth.resolveDevice(token)) {
     token = app.auth.redeemPairCode(app.auth.createPairCode(), "this-pc");
-    writeFileSync9(tokenFile, token, { mode: 384 });
+    writeFileSync10(tokenFile, token, { mode: 384 });
   }
   const node = startDeviceNode({
-    url: `ws://127.0.0.1:${port}/device`,
+    url: `${app.config.https ? "wss" : "ws"}://127.0.0.1:${port}/device`,
     token,
-    roots: app.config.roots
+    roots: app.config.roots,
+    ...app.config.https ? { ca: readFileSync8(join15(opts.dataDir, "tls", "cert.pem"), "utf8") } : {}
+    // this PC trusts only its own Friend's certificate
   });
-  const urls = urlsFor(app.config.bind, port);
+  const urls = urlsFor(app.config.bind, port, void 0, app.config.https);
   opts.out(`Friend is running at ${urls.local}`);
   for (const n of urls.network) opts.out(`Also on your network: ${n}`);
   if (!app.auth.hasOwner()) opts.out("No owner yet. Run: friend onboard (guided), or friend setup (just the account)");
@@ -7127,8 +7394,8 @@ async function startFriend(opts) {
     async stop() {
       if (watcher) clearInterval(watcher);
       node.stop();
-      await sidecar?.stop();
-      await app.stop();
+      const wait = (ms) => new Promise((r) => setTimeout(r, ms).unref?.());
+      await Promise.race([Promise.allSettled([sidecar?.stop(), app.stop()]), wait(6e3)]);
     }
   };
 }
@@ -7322,8 +7589,8 @@ async function memoryCommand(args, io2) {
 }
 
 // ../agent-cli/src/commands/plugin.ts
-import { existsSync as existsSync10, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
-import { dirname as dirname8, join as join14, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync12, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { dirname as dirname8, join as join16, resolve as resolve7 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var USAGE2 = "Usage: friend plugin catalog | list | install <name|folder> [--yes] | enable <id> | disable <id> | remove <id>";
 function defaultCatalog() {
@@ -7337,10 +7604,10 @@ async function pluginCommand(args, io2, deps = {}) {
   const flags = rest.filter((a) => a.startsWith("--"));
   const arg = rest.find((a) => !a.startsWith("--"));
   if (sub === "catalog") {
-    const dirs = existsSync10(catalogDir) ? readdirSync3(catalogDir).filter((d) => statSync2(join14(catalogDir, d)).isDirectory()) : [];
+    const dirs = existsSync12(catalogDir) ? readdirSync3(catalogDir).filter((d) => statSync2(join16(catalogDir, d)).isDirectory()) : [];
     if (dirs.length === 0) io2.out("The catalog is empty.");
     for (const d of dirs.sort()) {
-      const r = inspectPlugin(join14(catalogDir, d));
+      const r = inspectPlugin(join16(catalogDir, d));
       if (!r.ok) {
         io2.out(`${d}  (invalid: ${r.error})`);
         continue;
@@ -7356,7 +7623,7 @@ async function pluginCommand(args, io2, deps = {}) {
   }
   const db = openDb(io2.dataDir);
   try {
-    const plugins = new Plugins(db, join14(io2.dataDir, "plugins"));
+    const plugins = new Plugins(db, join16(io2.dataDir, "plugins"));
     if (sub === "list") {
       const all = plugins.list();
       if (all.length === 0) io2.out("No plugins installed. See: friend plugin catalog");
@@ -7370,8 +7637,8 @@ async function pluginCommand(args, io2, deps = {}) {
         io2.err(USAGE2);
         return 1;
       }
-      const inCatalog = !/[\\/]/.test(arg) && existsSync10(join14(catalogDir, arg));
-      const source = inCatalog ? join14(catalogDir, arg) : existsSync10(resolve7(arg)) ? resolve7(arg) : null;
+      const inCatalog = !/[\\/]/.test(arg) && existsSync12(join16(catalogDir, arg));
+      const source = inCatalog ? join16(catalogDir, arg) : existsSync12(resolve7(arg)) ? resolve7(arg) : null;
       if (!source) {
         io2.err(`"${arg}" is not in the catalog and there is no such folder. See: friend plugin catalog`);
         return 1;
@@ -7425,8 +7692,8 @@ async function pluginCommand(args, io2, deps = {}) {
 }
 
 // ../agent-cli/src/commands/onboard/index.ts
-import crossSpawn2 from "cross-spawn";
-import { mkdirSync as mkdirSync11 } from "node:fs";
+import crossSpawn4 from "cross-spawn";
+import { mkdirSync as mkdirSync12 } from "node:fs";
 import { resolve as resolve8 } from "node:path";
 
 // ../agent-cli/src/commands/ollama.ts
@@ -7594,13 +7861,13 @@ async function ollamaCommand(args, io2, deps = {}) {
 }
 
 // ../agent-cli/src/commands/onboard/exec.ts
-import crossSpawn from "cross-spawn";
+import crossSpawn3 from "cross-spawn";
 var CHECK_TIMEOUT_MS = 2e4;
 var capture = (cmd, args, opts) => new Promise((resolve10) => {
   let stdout = "";
   let child;
   try {
-    child = crossSpawn(cmd, args, { cwd: opts?.cwd, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    child = crossSpawn3(cmd, args, { cwd: opts?.cwd, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
   } catch (e) {
     resolve10({ code: 127, stdout: e.message });
     return;
@@ -7627,7 +7894,7 @@ var capture = (cmd, args, opts) => new Promise((resolve10) => {
 var interactive = (cmd, args) => new Promise((resolve10) => {
   let child;
   try {
-    child = crossSpawn(cmd, args, { stdio: "inherit" });
+    child = crossSpawn3(cmd, args, { stdio: "inherit" });
   } catch {
     resolve10(127);
     return;
@@ -7670,14 +7937,14 @@ async function checkDocker(d) {
 async function checkOllama(d) {
   const base = { id: "ollama", label: "Ollama", need: "optional", unlocks: "a free, private model that runs on this PC" };
   const v = await d.run("ollama", ["--version"]);
-  let running = false;
+  let running2 = false;
   try {
-    running = (await d.fetch("http://127.0.0.1:11434/api/version", { signal: AbortSignal.timeout(2500) })).ok;
+    running2 = (await d.fetch("http://127.0.0.1:11434/api/version", { signal: AbortSignal.timeout(2500) })).ok;
   } catch {
-    running = false;
+    running2 = false;
   }
-  if (v.code === 0) return { ...base, ok: true, detail: `${first(v.stdout).replace(/^.*version is /i, "Ollama ")}${running ? ", running" : ", installed (start the Ollama app if it is not running)"}` };
-  if (running) return { ...base, ok: true, detail: "an Ollama server is running at 127.0.0.1:11434" };
+  if (v.code === 0) return { ...base, ok: true, detail: `${first(v.stdout).replace(/^.*version is /i, "Ollama ")}${running2 ? ", running" : ", installed (start the Ollama app if it is not running)"}` };
+  if (running2) return { ...base, ok: true, detail: "an Ollama server is running at 127.0.0.1:11434" };
   return { ...base, ok: false, detail: "not installed" };
 }
 async function checkClaude(d, command = "claude") {
@@ -7749,16 +8016,16 @@ function installPlan(id2, platform, have) {
 }
 
 // ../agent-cli/src/commands/onboard/state.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync10, readFileSync as readFileSync8, renameSync as renameSync3, rmSync as rmSync5, writeFileSync as writeFileSync10 } from "node:fs";
-import { dirname as dirname9, join as join15 } from "node:path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync11, readFileSync as readFileSync9, renameSync as renameSync3, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "node:fs";
+import { dirname as dirname9, join as join17 } from "node:path";
 var FEATURES = ["claude-code", "claude-api", "ollama", "voice", "sandbox"];
 var emptyState = () => ({ version: 1, done: {}, features: [], restart: [] });
-var statePath = (dataDir) => join15(dataDir, "onboarding.json");
+var statePath = (dataDir) => join17(dataDir, "onboarding.json");
 function loadState(dataDir) {
   const f = statePath(dataDir);
-  if (!existsSync11(f)) return emptyState();
+  if (!existsSync13(f)) return emptyState();
   try {
-    const raw = JSON.parse(readFileSync8(f, "utf8"));
+    const raw = JSON.parse(readFileSync9(f, "utf8"));
     const done = raw.done && typeof raw.done === "object" ? Object.fromEntries(Object.entries(raw.done).filter(([, v]) => typeof v === "string")) : {};
     const features2 = Array.isArray(raw.features) ? raw.features.filter((x) => FEATURES.includes(x)) : [];
     const restart = Array.isArray(raw.restart) ? raw.restart.filter((x) => typeof x === "string") : [];
@@ -7769,9 +8036,9 @@ function loadState(dataDir) {
 }
 function saveState(dataDir, state) {
   const f = statePath(dataDir);
-  mkdirSync10(dirname9(f), { recursive: true });
+  mkdirSync11(dirname9(f), { recursive: true });
   const tmp = `${f}.tmp`;
-  writeFileSync10(tmp, JSON.stringify(state, null, 2));
+  writeFileSync11(tmp, JSON.stringify(state, null, 2));
   renameSync3(tmp, f);
 }
 function resetState(dataDir) {
@@ -7860,7 +8127,7 @@ function defaultOnboardDeps() {
     openUrl: async (url) => {
       const [cmd, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
       try {
-        crossSpawn2(cmd, args, { stdio: "ignore", detached: true }).unref();
+        crossSpawn4(cmd, args, { stdio: "ignore", detached: true }).unref();
       } catch {
       }
     },
@@ -8127,7 +8394,7 @@ async function workspace(c) {
   const answer = await text(c.ui, current ? "Workspace folder" : "Workspace folder (Enter to skip)", current ?? "");
   if (answer) {
     const abs = resolve8(answer);
-    mkdirSync11(abs, { recursive: true });
+    mkdirSync12(abs, { recursive: true });
     cfg.roots = [abs];
     saveConfig(cfg);
     io2.out(`Workspace: ${abs}`);
@@ -8161,11 +8428,12 @@ async function network(c) {
   }
   cfg.port = port;
   cfg.bind = where === "lan" ? "0.0.0.0" : "127.0.0.1";
+  cfg.https = where === "lan" ? await yesNo(c.ui, "Use a secure (https) address so a phone can use the microphone? Your phone will show a one-time certificate warning.", true) : false;
   saveConfig(cfg);
-  const u = urlsFor(cfg.bind, cfg.port);
+  const u = urlsFor(cfg.bind, cfg.port, void 0, cfg.https);
   io2.out(`Friend will be at ${u.local}`);
   for (const n of u.network) io2.out(`and on your network at ${n}`);
-  if (where === "lan") io2.out("Note: the microphone and camera only work on this PC (or over HTTPS). Everything else works from the other devices.");
+  if (where === "lan" && !cfg.https) io2.out("Note: the microphone and camera only work on this PC (or over HTTPS). Everything else works from the other devices. Later: friend lan https on");
   return "done";
 }
 async function look(c) {
@@ -8184,7 +8452,7 @@ async function look(c) {
   return "done";
 }
 function summary(cfg, c) {
-  const u = urlsFor(cfg.bind, cfg.port);
+  const u = urlsFor(cfg.bind, cfg.port, void 0, cfg.https);
   const db = openDb(c.io.dataDir);
   let owner = "not created yet";
   try {
@@ -8214,7 +8482,7 @@ async function finish(c) {
     io2.out("Start it whenever you like with: friend start");
     return "done";
   }
-  const url = urlsFor(cfg.bind, cfg.port).local;
+  const url = urlsFor(cfg.bind, cfg.port, void 0, cfg.https).local;
   if (await yesNo(c.ui, "Open it in your browser when it is up?", true)) setTimeout(() => void deps.openUrl(url), 2500);
   io2.out("Starting Friend. Press Ctrl+C to stop it.");
   c.state.done.finish = (/* @__PURE__ */ new Date()).toISOString();
@@ -8296,6 +8564,175 @@ async function doctorCommand(io2, partial = {}) {
   return requiredMissing ? 1 : 0;
 }
 
+// ../agent-cli/src/commands/daemon.ts
+import { spawn as spawn6, spawnSync as spawnSync2 } from "node:child_process";
+import { closeSync as closeSync2, existsSync as existsSync14, mkdirSync as mkdirSync13, openSync as openSync2, readFileSync as readFileSync10, renameSync as renameSync4, rmSync as rmSync6, statSync as statSync3, writeFileSync as writeFileSync12 } from "node:fs";
+import { connect } from "node:net";
+import { join as join18 } from "node:path";
+var USAGE3 = "Usage: friend daemon start | stop | restart | status";
+var MAX_LOG_BYTES = 5 * 1024 * 1024;
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+var realDeps = {
+  launch(logFile) {
+    const fd = openSync2(logFile, "a");
+    try {
+      const child = spawn6(process.execPath, [process.argv[1], "start"], { detached: true, stdio: ["ignore", fd, fd], windowsHide: true });
+      child.unref();
+      return child.pid;
+    } finally {
+      closeSync2(fd);
+    }
+  },
+  alive(pid) {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch (e) {
+      return e.code === "EPERM";
+    }
+  },
+  async kill(pid) {
+    if (process.platform === "win32") {
+      spawnSync2("taskkill", ["/pid", String(pid), "/T", "/F"], { windowsHide: true });
+    } else {
+      try {
+        process.kill(pid, "SIGTERM");
+      } catch {
+        return;
+      }
+      for (let i = 0; i < 40 && realDeps.alive(pid); i++) await sleep(200);
+      if (realDeps.alive(pid)) {
+        try {
+          process.kill(pid, "SIGKILL");
+        } catch {
+        }
+      }
+    }
+    for (let i = 0; i < 25 && realDeps.alive(pid); i++) await sleep(200);
+  },
+  portOpen(port, withinMs) {
+    return new Promise((resolve10) => {
+      const s = connect({ port, host: "127.0.0.1" });
+      const done = (ok) => {
+        s.destroy();
+        resolve10(ok);
+      };
+      s.setTimeout(withinMs, () => done(false));
+      s.once("connect", () => done(true));
+      s.once("error", () => done(false));
+    });
+  },
+  now: Date.now
+};
+var pidFile = (dataDir) => join18(dataDir, "friend.pid");
+var logFileOf = (dataDir) => join18(dataDir, "friend.log");
+function readPid(dataDir) {
+  try {
+    const r = JSON.parse(readFileSync10(pidFile(dataDir), "utf8"));
+    return Number.isInteger(r.pid) && r.pid > 0 ? r : null;
+  } catch {
+    return null;
+  }
+}
+function running(dataDir, deps) {
+  const r = readPid(dataDir);
+  if (r && deps.alive(r.pid)) return r;
+  if (r) rmSync6(pidFile(dataDir), { force: true });
+  return null;
+}
+function since(ms) {
+  const s = Math.max(0, Math.round(ms / 1e3));
+  if (s < 90) return `${s} seconds`;
+  if (s < 5400) return `${Math.round(s / 60)} minutes`;
+  if (s < 129600) return `${Math.round(s / 3600)} hours`;
+  return `${Math.round(s / 86400)} days`;
+}
+async function start(io2, deps) {
+  const existing = running(io2.dataDir, deps);
+  const cfg = loadConfig(io2.dataDir);
+  const urls = urlsFor(cfg.bind, cfg.port, void 0, cfg.https);
+  if (existing) {
+    io2.out(`Friend is already running in the background (pid ${existing.pid}) at ${urls.local}`);
+    return 0;
+  }
+  if (await deps.portOpen(cfg.port, 500)) {
+    io2.err(`Port ${cfg.port} is already in use. Friend may be running in a terminal (stop it with Ctrl+C), or another program uses that port (friend lan port N).`);
+    return 1;
+  }
+  mkdirSync13(io2.dataDir, { recursive: true });
+  const log = logFileOf(io2.dataDir);
+  try {
+    if (existsSync14(log) && statSync3(log).size > MAX_LOG_BYTES) renameSync4(log, `${log}.old`);
+  } catch {
+  }
+  const pid = deps.launch(log);
+  if (!pid) {
+    io2.err("Could not start Friend in the background.");
+    return 1;
+  }
+  writeFileSync12(pidFile(io2.dataDir), JSON.stringify({ pid, startedAt: deps.now() }));
+  for (let i = 0; i < 60; i++) {
+    if (await deps.portOpen(cfg.port, 300)) {
+      io2.out(`Friend is running in the background (pid ${pid}) at ${urls.local}`);
+      for (const n of urls.network) io2.out(`Also on your network: ${n}`);
+      io2.out(`Stop it with: friend daemon stop   (log: ${log})`);
+      return 0;
+    }
+    if (!deps.alive(pid)) break;
+    await sleep(250);
+  }
+  rmSync6(pidFile(io2.dataDir), { force: true });
+  io2.err(`Friend did not start. See the log: ${log}`);
+  return 1;
+}
+async function stop(io2, deps) {
+  const r = running(io2.dataDir, deps);
+  if (!r) {
+    io2.out("Friend is not running in the background.");
+    return 0;
+  }
+  await deps.kill(r.pid);
+  if (deps.alive(r.pid)) {
+    io2.err(`Could not stop Friend (pid ${r.pid}). End that process yourself.`);
+    return 1;
+  }
+  rmSync6(pidFile(io2.dataDir), { force: true });
+  io2.out("Friend stopped.");
+  return 0;
+}
+async function status(io2, deps) {
+  const cfg = loadConfig(io2.dataDir);
+  const urls = urlsFor(cfg.bind, cfg.port, void 0, cfg.https);
+  const r = running(io2.dataDir, deps);
+  if (r) {
+    io2.out(`Friend is running in the background (pid ${r.pid}, for ${since(deps.now() - r.startedAt)}).`);
+    io2.out(`Address: ${urls.local}`);
+    for (const n of urls.network) io2.out(`Also on your network: ${n}`);
+    io2.out(`Log: ${logFileOf(io2.dataDir)}`);
+    return 0;
+  }
+  if (await deps.portOpen(cfg.port, 500)) io2.out(`Friend is not running in the background, but port ${cfg.port} is in use. It may be running in a terminal.`);
+  else io2.out("Friend is not running. Start it in the background with: friend daemon start");
+  return 1;
+}
+async function daemonCommand(args, io2, deps = realDeps) {
+  switch (args[0]) {
+    case "start":
+      return start(io2, deps);
+    case "stop":
+      return stop(io2, deps);
+    case "restart": {
+      const code = await stop(io2, deps);
+      return code === 0 ? start(io2, deps) : code;
+    }
+    case "status":
+      return status(io2, deps);
+    default:
+      io2.err(USAGE3);
+      return 1;
+  }
+}
+
 // ../agent-cli/src/commands/claude.ts
 async function check2(run2, command) {
   const v = await run2(command, ["--version"]);
@@ -8364,7 +8801,7 @@ async function claudeCommand(args, io2, deps = {}) {
 }
 
 // ../agent-cli/src/commands/setup.ts
-import { mkdirSync as mkdirSync12 } from "node:fs";
+import { mkdirSync as mkdirSync14 } from "node:fs";
 import { resolve as resolve9 } from "node:path";
 async function setupCommand3(io2) {
   const db = openDb(io2.dataDir);
@@ -8390,7 +8827,7 @@ async function setupCommand3(io2) {
     const cfg = loadConfig(io2.dataDir);
     if (workspace2) {
       const abs = resolve9(workspace2);
-      mkdirSync12(abs, { recursive: true });
+      mkdirSync14(abs, { recursive: true });
       cfg.roots = [abs];
     }
     if (apiKey) cfg.apiKey = apiKey;
@@ -8417,7 +8854,7 @@ async function statusCommand3(io2) {
   io2.out(`Data folder:  ${cfg.dataDir}`);
   io2.out(`Owner set up: ${owner}`);
   io2.out(`Listens on:   ${cfg.bind}:${cfg.port}`);
-  for (const n of urlsFor(cfg.bind, cfg.port).network) io2.out(`Network URL:  ${n}`);
+  for (const n of urlsFor(cfg.bind, cfg.port, void 0, cfg.https).network) io2.out(`Network URL:  ${n}`);
   io2.out(`Public URL:   ${cfg.publicUrl ?? "(none)"}`);
   io2.out(`Workspace:    ${cfg.roots.length ? cfg.roots.join(", ") : "(none, every file action asks first)"}`);
   io2.out(`Model:        ${cfg.model}`);
@@ -8426,12 +8863,13 @@ async function statusCommand3(io2) {
 }
 
 // ../agent-cli/src/cli.ts
-var USAGE3 = `Usage: friend <command>
+var USAGE4 = `Usage: friend <command>
 
   onboard                    guided setup, step by step: checks this PC, installs what is missing, asks what you want
   doctor                     check what this PC has and what is missing (changes nothing)
   setup                      create the owner account (password, PIN, assistant name)
   start                      run the gateway and a local device node
+  daemon start|stop|restart|status  run Friend in the background (no terminal needed), stop it, or see if it is running
   pair                       print a one-time code to connect another PC
   node --url <ws-url> --code <code> [--roots a,b] [--name pc]
                              connect this PC to a Friend gateway
@@ -8456,6 +8894,8 @@ async function run(argv, io2) {
         return await setupCommand3(io2);
       case "start":
         return await startCommand(io2);
+      case "daemon":
+        return await daemonCommand(rest, io2);
       case "pair":
         return await pairCommand(io2);
       case "node":
@@ -8471,7 +8911,7 @@ async function run(argv, io2) {
       case "version":
       case "--version":
       case "-v":
-        io2.out(true ? "0.1.1" : "development");
+        io2.out(true ? "0.1.3" : "development");
         return 0;
       case "lan":
         return await lanCommand(rest, io2);
@@ -8490,7 +8930,7 @@ async function run(argv, io2) {
       case "config":
         return await configCommand(rest, io2);
       default:
-        io2.err(USAGE3);
+        io2.err(USAGE4);
         return 1;
     }
   } catch (e) {
@@ -8551,4 +8991,5 @@ var io = {
 };
 run(process.argv.slice(2), io).then((code) => {
   if (code !== 0) process.exitCode = code;
+  if (process.argv[2] === "start") setTimeout(() => process.exit(), 1e3).unref();
 });