frizz 0.2.0 → 0.4.0

package/dist/frizz.js

@@ -10,10 +10,184 @@ var __export = (target2, all) => {
     __defProp(target2, name, { get: all[name], enumerable: true });
 };
 
+// packages/server/src/local-origin.ts
+import { isIP } from "node:net";
+function publicAuthority(policy) {
+  const raw = policy?.publicOrigin;
+  if (!raw) return null;
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (url.origin !== raw) return null;
+  return {
+    hostname: normalizedHostname(url.hostname),
+    port: explicitPort(url),
+    authority: url.host.toLowerCase(),
+    scheme: url.protocol === "https:" ? "https" : "http"
+  };
+}
+function authoritySendsFetchMetadata(authority) {
+  return LOCAL_HOSTNAMES.has(authority.hostname) || authority.scheme === "https";
+}
+function acceptsHostname(hostname, policy) {
+  if (LOCAL_HOSTNAMES.has(hostname)) return true;
+  if (!policy?.exposed) return false;
+  if (isIP(hostname) !== 0) return true;
+  return (policy.allowedHosts ?? []).some((allowed) => allowed === "*" || allowed.toLowerCase() === hostname);
+}
+function oneHeader(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function normalizedHostname(hostname) {
+  const lower = hostname.toLowerCase();
+  return lower.startsWith("[") && lower.endsWith("]") ? lower.slice(1, -1) : lower;
+}
+function explicitPort(url) {
+  if (url.port) return Number(url.port);
+  return url.protocol === "https:" ? 443 : 80;
+}
+function validExpectedPort(port) {
+  return Number.isInteger(port) && port >= 1 && port <= 65535;
+}
+function parseLocalHttpOrigin(value, expectedPort, policy) {
+  const raw = oneHeader(value);
+  if (!raw || !validExpectedPort(expectedPort) || raw !== raw.trim()) return null;
+  const declared = publicAuthority(policy);
+  if (declared && raw === policy?.publicOrigin) return declared;
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "http:" || url.origin !== raw) return null;
+  const hostname = normalizedHostname(url.hostname);
+  if (!acceptsHostname(hostname, policy) || explicitPort(url) !== expectedPort) return null;
+  return { hostname, port: expectedPort, authority: url.host, scheme: "http" };
+}
+function parseLocalHost(value, expectedPort, policy) {
+  const raw = oneHeader(value);
+  if (!raw || !validExpectedPort(expectedPort) || raw !== raw.trim() || raw.includes(",")) return null;
+  let url;
+  try {
+    url = new URL(`http://${raw}`);
+  } catch {
+    return null;
+  }
+  if (url.username || url.password || url.pathname !== "/" || url.search || url.hash) return null;
+  if (url.host.toLowerCase() !== raw.toLowerCase()) return null;
+  const hostname = normalizedHostname(url.hostname);
+  const declared = publicAuthority(policy);
+  if (declared && hostname === declared.hostname) {
+    return url.port === "" || Number(url.port) === declared.port ? declared : null;
+  }
+  if (!acceptsHostname(hostname, policy) || explicitPort(url) !== expectedPort) return null;
+  return { hostname, port: expectedPort, authority: url.host.toLowerCase(), scheme: "http" };
+}
+function hasForwardedAuthority(headers) {
+  return FORWARDED_HEADERS.some((name) => headers[name] !== void 0);
+}
+function forwardedAuthorityAllowed(headers, host, policy) {
+  if (!hasForwardedAuthority(headers)) return true;
+  const declared = publicAuthority(policy);
+  return !!declared && declared.hostname === host.hostname;
+}
+function isTrustedLocalHttpRequest(headers, expectedPort, allowMissingOrigin = false, policy) {
+  const host = parseLocalHost(headers.host, expectedPort, policy);
+  if (!host) return false;
+  if (!forwardedAuthorityAllowed(headers, host, policy)) return false;
+  if (headers.origin === void 0) return allowMissingOrigin;
+  const origin = parseLocalHttpOrigin(headers.origin, expectedPort, policy);
+  return !!origin && host.hostname === origin.hostname && host.port === origin.port;
+}
+function allowedLocalCorsOrigin(origin, expectedPort, policy) {
+  return parseLocalHttpOrigin(origin, expectedPort, policy) ? origin : void 0;
+}
+function normalizeBindHost(value) {
+  const trimmed = value.trim();
+  if (!trimmed) throw new Error("--host requires an address");
+  const bare = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
+  const lower = bare.toLowerCase();
+  if (lower === "localhost") return LOOPBACK_BIND_HOST;
+  if (isIP(bare) === 0) {
+    throw new Error(`invalid --host address: ${value} (use an IP address such as 0.0.0.0, :: or 127.0.0.1)`);
+  }
+  return bare;
+}
+function bindHostIsExposed(host) {
+  return !LOOPBACK_BIND_HOSTS.has(host.trim().toLowerCase());
+}
+function normalizePublicOrigin(value) {
+  const trimmed = value.trim();
+  const invalid = (why) => new Error(`invalid --public-origin: ${value} (${why})`);
+  if (!trimmed) throw new Error("--public-origin requires a URL");
+  let url;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    throw invalid("use a full URL such as https://frizz.example.com");
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") throw invalid("only http and https are supported");
+  if (url.username || url.password) throw invalid("an origin carries no credentials");
+  if (url.pathname !== "/" || url.search || url.hash) throw invalid("an origin is a scheme and host only, with no path");
+  if (!url.hostname) throw invalid("no hostname");
+  return url.origin;
+}
+function normalizeAllowedHosts(values) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    for (const entry of value.split(",")) {
+      const host = entry.trim().toLowerCase();
+      if (host) seen.add(host);
+    }
+  }
+  return [...seen];
+}
+function rejectWebSocketUpgrade(socket, status = 403, reason = "Forbidden") {
+  const body = `${reason}
+`;
+  const response = [
+    `HTTP/1.1 ${status} ${reason}`,
+    "Connection: close",
+    "Content-Type: text/plain; charset=utf-8",
+    `Content-Length: ${Buffer.byteLength(body)}`,
+    "",
+    body
+  ].join("\r\n");
+  try {
+    socket.end(response);
+  } catch {
+    try {
+      socket.destroy();
+    } catch {
+    }
+  }
+}
+var LOCAL_HOSTNAMES, FORWARDED_HEADERS, LOOPBACK_BIND_HOST, ALL_INTERFACES_BIND_HOST, LOOPBACK_BIND_HOSTS;
+var init_local_origin = __esm({
+  "packages/server/src/local-origin.ts"() {
+    "use strict";
+    LOCAL_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+    FORWARDED_HEADERS = [
+      "forwarded",
+      "x-forwarded-for",
+      "x-forwarded-host",
+      "x-forwarded-port",
+      "x-forwarded-proto"
+    ];
+    LOOPBACK_BIND_HOST = "127.0.0.1";
+    ALL_INTERFACES_BIND_HOST = "0.0.0.0";
+    LOOPBACK_BIND_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "localhost", "[::1]"]);
+  }
+});
+
 // packages/server/src/frizz-paths.ts
 import { existsSync } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { join as join2 } from "node:path";
+import { homedir as homedir2, tmpdir } from "node:os";
+import { dirname, join as join2 } from "node:path";
 function legacyFrizzRoot(home = homedir2()) {
   return join2(home, LEGACY_DIR_NAME);
 }
@@ -387,7 +561,7 @@ import {
   writeFileSync as writeFileSync2
 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { dirname, join as join4, resolve } from "node:path";
+import { dirname as dirname2, join as join4, resolve } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 function errorCode2(error) {
   return error && typeof error === "object" && "code" in error && typeof error.code === "string" ? error.code : void 0;
@@ -492,7 +666,7 @@ function quarantineLock(lockPath) {
   return true;
 }
 function tryAcquireLock(lockPath, adapter) {
-  mkdirSync2(dirname(lockPath), { recursive: true, mode: 448 });
+  mkdirSync2(dirname2(lockPath), { recursive: true, mode: 448 });
   let fd;
   try {
     fd = openSync2(lockPath, "wx", 384);
@@ -513,7 +687,7 @@ function tryAcquireLock(lockPath, adapter) {
 `, "utf8");
     fsyncSync(fd);
     closeSync(fd);
-    syncDirectory(dirname(lockPath));
+    syncDirectory(dirname2(lockPath));
   } catch (error) {
     try {
       closeSync(fd);
@@ -663,7 +837,7 @@ function syncGitConfigPath(path) {
   } finally {
     closeSync(fd);
   }
-  syncDirectory(dirname(path));
+  syncDirectory(dirname2(path));
 }
 function syncGitConfig(dir) {
   let raw;
@@ -744,6 +918,35 @@ function resolveGitProjectIdentity(dir, home = homedir4()) {
     release();
   }
 }
+function parseRepoLabel(remoteUrl) {
+  const url = remoteUrl.trim();
+  if (!url) return null;
+  const scp = url.match(/^[^/@]+@[^:/]+:(.+?)(?:\.git)?\/?$/);
+  if (scp) return normalizeOwnerRepo(scp[1]);
+  const m = url.match(/^[a-z][a-z0-9+.-]*:\/\/[^/]+\/(.+?)(?:\.git)?\/?$/i);
+  if (m) return normalizeOwnerRepo(m[1]);
+  return null;
+}
+function normalizeOwnerRepo(path) {
+  const parts = path.split("/").filter(Boolean);
+  if (parts.length < 2) return null;
+  return parts.slice(-2).join("/");
+}
+function originRemoteUrl(dir) {
+  try {
+    return execFileSync2("git", ["remote", "get-url", "origin"], {
+      cwd: dir,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim() || null;
+  } catch {
+    return null;
+  }
+}
+function resolveProjectLabel(dir) {
+  const url = originRemoteUrl(dir);
+  return url ? parseRepoLabel(url) : null;
+}
 var GLOBAL_LOCK_NAME, GLOBAL_LOCK_OWNER, PORT_LOCK_DIR, INCOMPLETE_LOCK_GRACE_MS, LOCK_POLL_MS, PROJECT_ID_RE, SYNC_WAIT2;
 var init_project_identity = __esm({
   "packages/server/src/project-identity.ts"() {
@@ -773,7 +976,7 @@ import {
   statSync as statSync3,
   writeFileSync as writeFileSync3
 } from "node:fs";
-import { basename as basename2, dirname as dirname2, isAbsolute, join as join5 } from "node:path";
+import { basename as basename2, dirname as dirname3, isAbsolute, join as join5 } from "node:path";
 function errorCode3(error) {
   return error && typeof error === "object" && "code" in error && typeof error.code === "string" ? error.code : void 0;
 }
@@ -796,8 +999,8 @@ function syncDirectory2(path) {
   }
 }
 function atomicJson(path, value) {
-  mkdirSync3(dirname2(path), { recursive: true, mode: 448 });
-  const temp = join5(dirname2(path), `.${basename2(path)}.${process.pid}.${randomUUID3()}.tmp`);
+  mkdirSync3(dirname3(path), { recursive: true, mode: 448 });
+  const temp = join5(dirname3(path), `.${basename2(path)}.${process.pid}.${randomUUID3()}.tmp`);
   let fd;
   try {
     fd = openSync3(temp, "wx", 384);
@@ -807,7 +1010,7 @@ function atomicJson(path, value) {
     closeSync2(fd);
     fd = void 0;
     renameSync2(temp, path);
-    syncDirectory2(dirname2(path));
+    syncDirectory2(dirname3(path));
   } catch (error) {
     if (fd !== void 0) {
       try {
@@ -984,7 +1187,7 @@ function writeNewOwner(path, record) {
     fsyncSync2(fd);
     closeSync2(fd);
     fd = void 0;
-    syncDirectory2(dirname2(path));
+    syncDirectory2(dirname3(path));
   } catch (error) {
     if (fd !== void 0) {
       try {
@@ -1200,6 +1403,7 @@ var OWNER_NAME, MUTATION_GUARD_NAME, OWNER_VERSION, PARTIAL_GRACE_MS, GUARD_TIME
 var init_project_launch = __esm({
   "packages/server/src/project-launch.ts"() {
     "use strict";
+    init_project_identity();
     init_process_generation();
     init_process_generation();
     OWNER_NAME = "project-launch.owner";
@@ -1220,163 +1424,9 @@ var init_project_launch = __esm({
   }
 });
 
-// packages/server/src/local-origin.ts
-import { isIP } from "node:net";
-function publicAuthority(policy) {
-  const raw = policy?.publicOrigin;
-  if (!raw) return null;
-  let url;
-  try {
-    url = new URL(raw);
-  } catch {
-    return null;
-  }
-  if (url.origin !== raw) return null;
-  return {
-    hostname: normalizedHostname(url.hostname),
-    port: explicitPort(url),
-    authority: url.host.toLowerCase(),
-    scheme: url.protocol === "https:" ? "https" : "http"
-  };
-}
-function authoritySendsFetchMetadata(authority) {
-  return LOCAL_HOSTNAMES.has(authority.hostname) || authority.scheme === "https";
-}
-function acceptsHostname(hostname, policy) {
-  if (LOCAL_HOSTNAMES.has(hostname)) return true;
-  if (!policy?.exposed) return false;
-  if (isIP(hostname) !== 0) return true;
-  return (policy.allowedHosts ?? []).some((allowed) => allowed === "*" || allowed.toLowerCase() === hostname);
-}
-function oneHeader(value) {
-  return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-function normalizedHostname(hostname) {
-  const lower = hostname.toLowerCase();
-  return lower.startsWith("[") && lower.endsWith("]") ? lower.slice(1, -1) : lower;
-}
-function explicitPort(url) {
-  if (url.port) return Number(url.port);
-  return url.protocol === "https:" ? 443 : 80;
-}
-function validExpectedPort(port) {
-  return Number.isInteger(port) && port >= 1 && port <= 65535;
-}
-function parseLocalHttpOrigin(value, expectedPort, policy) {
-  const raw = oneHeader(value);
-  if (!raw || !validExpectedPort(expectedPort) || raw !== raw.trim()) return null;
-  const declared = publicAuthority(policy);
-  if (declared && raw === policy?.publicOrigin) return declared;
-  let url;
-  try {
-    url = new URL(raw);
-  } catch {
-    return null;
-  }
-  if (url.protocol !== "http:" || url.origin !== raw) return null;
-  const hostname = normalizedHostname(url.hostname);
-  if (!acceptsHostname(hostname, policy) || explicitPort(url) !== expectedPort) return null;
-  return { hostname, port: expectedPort, authority: url.host, scheme: "http" };
-}
-function parseLocalHost(value, expectedPort, policy) {
-  const raw = oneHeader(value);
-  if (!raw || !validExpectedPort(expectedPort) || raw !== raw.trim() || raw.includes(",")) return null;
-  let url;
-  try {
-    url = new URL(`http://${raw}`);
-  } catch {
-    return null;
-  }
-  if (url.username || url.password || url.pathname !== "/" || url.search || url.hash) return null;
-  if (url.host.toLowerCase() !== raw.toLowerCase()) return null;
-  const hostname = normalizedHostname(url.hostname);
-  const declared = publicAuthority(policy);
-  if (declared && hostname === declared.hostname) {
-    return url.port === "" || Number(url.port) === declared.port ? declared : null;
-  }
-  if (!acceptsHostname(hostname, policy) || explicitPort(url) !== expectedPort) return null;
-  return { hostname, port: expectedPort, authority: url.host.toLowerCase(), scheme: "http" };
-}
-function hasForwardedAuthority(headers) {
-  return FORWARDED_HEADERS.some((name) => headers[name] !== void 0);
-}
-function forwardedAuthorityAllowed(headers, host, policy) {
-  if (!hasForwardedAuthority(headers)) return true;
-  const declared = publicAuthority(policy);
-  return !!declared && declared.hostname === host.hostname;
-}
-function isTrustedLocalHttpRequest(headers, expectedPort, allowMissingOrigin = false, policy) {
-  const host = parseLocalHost(headers.host, expectedPort, policy);
-  if (!host) return false;
-  if (!forwardedAuthorityAllowed(headers, host, policy)) return false;
-  if (headers.origin === void 0) return allowMissingOrigin;
-  const origin = parseLocalHttpOrigin(headers.origin, expectedPort, policy);
-  return !!origin && host.hostname === origin.hostname && host.port === origin.port;
-}
-function allowedLocalCorsOrigin(origin, expectedPort, policy) {
-  return parseLocalHttpOrigin(origin, expectedPort, policy) ? origin : void 0;
-}
-function normalizeBindHost(value) {
-  const trimmed = value.trim();
-  if (!trimmed) throw new Error("--host requires an address");
-  const bare = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
-  const lower = bare.toLowerCase();
-  if (lower === "localhost") return LOOPBACK_BIND_HOST;
-  if (isIP(bare) === 0) {
-    throw new Error(`invalid --host address: ${value} (use an IP address such as 0.0.0.0, :: or 127.0.0.1)`);
-  }
-  return bare;
-}
-function bindHostIsExposed(host) {
-  return !LOOPBACK_BIND_HOSTS.has(host.trim().toLowerCase());
-}
-function normalizePublicOrigin(value) {
-  const trimmed = value.trim();
-  const invalid = (why) => new Error(`invalid --public-origin: ${value} (${why})`);
-  if (!trimmed) throw new Error("--public-origin requires a URL");
-  let url;
-  try {
-    url = new URL(trimmed);
-  } catch {
-    throw invalid("use a full URL such as https://frizz.example.com");
-  }
-  if (url.protocol !== "https:" && url.protocol !== "http:") throw invalid("only http and https are supported");
-  if (url.username || url.password) throw invalid("an origin carries no credentials");
-  if (url.pathname !== "/" || url.search || url.hash) throw invalid("an origin is a scheme and host only, with no path");
-  if (!url.hostname) throw invalid("no hostname");
-  return url.origin;
-}
-function normalizeAllowedHosts(values) {
-  const seen = /* @__PURE__ */ new Set();
-  for (const value of values) {
-    for (const entry of value.split(",")) {
-      const host = entry.trim().toLowerCase();
-      if (host) seen.add(host);
-    }
-  }
-  return [...seen];
-}
-var LOCAL_HOSTNAMES, FORWARDED_HEADERS, LOOPBACK_BIND_HOST, ALL_INTERFACES_BIND_HOST, LOOPBACK_BIND_HOSTS;
-var init_local_origin = __esm({
-  "packages/server/src/local-origin.ts"() {
-    "use strict";
-    LOCAL_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
-    FORWARDED_HEADERS = [
-      "forwarded",
-      "x-forwarded-for",
-      "x-forwarded-host",
-      "x-forwarded-port",
-      "x-forwarded-proto"
-    ];
-    LOOPBACK_BIND_HOST = "127.0.0.1";
-    ALL_INTERFACES_BIND_HOST = "0.0.0.0";
-    LOOPBACK_BIND_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "localhost", "[::1]"]);
-  }
-});
-
 // packages/server/src/boot-progress.ts
 import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { basename as basename3, dirname as dirname3, join as join6 } from "node:path";
+import { basename as basename3, dirname as dirname4, join as join6 } from "node:path";
 function bootProgressPath(stateDir) {
   return join6(stateDir, BOOT_PROGRESS_NAME);
 }
@@ -1397,419 +1447,13 @@ var init_boot_progress = __esm({
   }
 });
 
-// packages/server/src/sqlite-quiet.ts
-function isSqliteExperimentalNotice(warning, type) {
-  const name = typeof warning === "string" ? type : warning?.name;
-  if (name !== "ExperimentalWarning") return false;
-  const text = typeof warning === "string" ? warning : warning?.message ?? "";
-  return text.includes("SQLite");
-}
-var emitWarning;
-var init_sqlite_quiet = __esm({
-  "packages/server/src/sqlite-quiet.ts"() {
-    "use strict";
-    emitWarning = process.emitWarning.bind(process);
-    process.emitWarning = ((warning, ...rest) => {
-      const type = typeof rest[0] === "string" ? rest[0] : void 0;
-      if (isSqliteExperimentalNotice(warning, type)) return;
-      return emitWarning(warning, ...rest);
-    });
-  }
-});
-
-// packages/server/src/sqlite.ts
-import { createRequire } from "node:module";
-function namedParameters(sql) {
-  const found = /* @__PURE__ */ new Set();
-  for (let index = 0; index < sql.length; index++) {
-    const char = sql[index];
-    if (char === "'" || char === '"' || char === "`") {
-      const quote = char;
-      index++;
-      while (index < sql.length) {
-        if (sql[index] === quote) {
-          if (sql[index + 1] === quote) index++;
-          else break;
-        }
-        index++;
-      }
-      continue;
-    }
-    if (char === "[") {
-      while (index < sql.length && sql[index] !== "]") index++;
-      continue;
-    }
-    if (char === "-" && sql[index + 1] === "-") {
-      while (index < sql.length && sql[index] !== "\n") index++;
-      continue;
-    }
-    if (char === "/" && sql[index + 1] === "*") {
-      index += 2;
-      while (index < sql.length && !(sql[index] === "*" && sql[index + 1] === "/")) index++;
-      index++;
-      continue;
-    }
-    if (char === "@" || char === ":" || char === "$") {
-      let end = index + 1;
-      while (end < sql.length && /[A-Za-z0-9_]/.test(sql[end])) end++;
-      if (end > index + 1) found.add(sql.slice(index + 1, end));
-      index = end - 1;
-    }
-  }
-  return [...found];
-}
-function isNamedBagCandidate(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value) && !ArrayBuffer.isView(value) && !(value instanceof ArrayBuffer) && !(value instanceof Date);
-}
-function plainRow(row) {
-  return row === void 0 || row === null ? row : Object.assign({}, row);
-}
-function hasBinding(bag, name) {
-  return name in bag || `@${name}` in bag || `:${name}` in bag || `$${name}` in bag;
-}
-function transactionControl(sql) {
-  let last = null;
-  for (const statement of sql.split(";")) {
-    const text = statement.trim().toUpperCase();
-    if (/^BEGIN\b/.test(text)) last = "open";
-    else if (/^(COMMIT|END)\b/.test(text)) last = "close";
-    else if (/^ROLLBACK\b/.test(text) && !/^ROLLBACK\s+TO\b/.test(text)) last = "close";
-  }
-  return last;
-}
-var DatabaseSync, PreparedStatement, Database;
-var init_sqlite = __esm({
-  "packages/server/src/sqlite.ts"() {
-    "use strict";
-    init_sqlite_quiet();
-    ({ DatabaseSync } = createRequire(import.meta.url)("node:sqlite"));
-    PreparedStatement = class {
-      #statement;
-      #required;
-      #sql;
-      constructor(statement, sql) {
-        this.#statement = statement;
-        this.#sql = sql;
-        this.#required = namedParameters(sql);
-      }
-      /**
-       * Build exactly the bindings this statement asks for, and nothing else.
-       *
-       * Frizz hands whole row objects to statements that bind a subset of their fields, which raw
-       * node:sqlite rejects with "Unknown named parameter". The obvious fix is
-       * `setAllowUnknownNamedParameters(true)` — but that method only exists from Node 23.11, and using it
-       * would have raised Frizz's floor above the release that first shipped `node:sqlite` at all, for no
-       * reason. Selecting the required names from the bag needs no runtime API, and gets the same result.
-       *
-       * A name the caller never supplied throws, rather than binding NULL the way node:sqlite would.
-       * See the file header: silently writing NULL where a value was expected is the one difference that
-       * could quietly corrupt data instead of failing.
-       */
-      #bind(params) {
-        if (params.length === 1 && this.#required.length > 0 && isNamedBagCandidate(params[0])) {
-          const bag = params[0];
-          const bound = {};
-          for (const name of this.#required) {
-            if (!hasBinding(bag, name)) {
-              throw new RangeError(
-                `Missing named parameter "${name}" for statement: ${this.#sql.trim().slice(0, 120)}`
-              );
-            }
-            const value = name in bag ? bag[name] : bag[`@${name}`] ?? bag[`:${name}`] ?? bag[`$${name}`];
-            bound[name] = value === void 0 ? null : value;
-          }
-          return [bound];
-        }
-        return params.map((value) => value === void 0 ? null : value);
-      }
-      run(...params) {
-        const result = this.#statement.run(...this.#bind(params));
-        return { changes: Number(result.changes), lastInsertRowid: Number(result.lastInsertRowid) };
-      }
-      get(...params) {
-        return plainRow(this.#statement.get(...this.#bind(params)));
-      }
-      all(...params) {
-        return this.#statement.all(...this.#bind(params)).map(plainRow);
-      }
-    };
-    Database = class {
-      #db;
-      /** Transaction nesting depth, so a nested transaction becomes a SAVEPOINT rather than an error. */
-      #depth = 0;
-      /** Fallback transaction state for runtimes without `isTransaction` (added in Node 24). */
-      #openTransaction = false;
-      /** better-sqlite3 exposes the database file here; the scheduler tests reopen a store through it. */
-      name;
-      constructor(path, options2 = {}) {
-        this.name = path;
-        this.#db = new DatabaseSync(path, options2.readonly ? { readOnly: true } : {});
-      }
-      /** True while a transaction is open, however it was opened. */
-      get inTransaction() {
-        const native = this.#db.isTransaction;
-        return typeof native === "boolean" ? native : this.#openTransaction;
-      }
-      /**
-       * Type parameters are `<BindParameters, Row>`, matching better-sqlite3 — 53 call sites already
-       * spell them that way (`prepare<[string], SessionRow>`), and silently swapping the order would
-       * type every one of them as `any` rather than failing loudly.
-       */
-      prepare(sql) {
-        return new PreparedStatement(this.#db.prepare(sql), sql);
-      }
-      /** Returns the database, matching better-sqlite3, so existing `db.exec(a).exec(b)` chains hold. */
-      exec(sql) {
-        this.#db.exec(sql);
-        const control = transactionControl(sql);
-        if (control === "open") this.#openTransaction = true;
-        else if (control === "close") this.#openTransaction = false;
-        return this;
-      }
-      /**
-       * `PRAGMA` with better-sqlite3's calling convention. Frizz only ever SETS pragmas (`journal_mode`,
-       * `busy_timeout`, `foreign_keys`) and ignores the result, but returning the rows keeps the shape
-       * honest for a read like `pragma("journal_mode")`.
-       */
-      pragma(source) {
-        const sql = `PRAGMA ${source}`;
-        try {
-          return this.#db.prepare(sql).all();
-        } catch {
-          this.#db.exec(sql);
-          return void 0;
-        }
-      }
-      /**
-       * better-sqlite3's `transaction()`, including the part that is easy to miss: it is RE-ENTRANT.
-       * Calling one transaction-wrapped function from inside another must not throw "cannot start a
-       * transaction within a transaction" — better-sqlite3 quietly switches to a SAVEPOINT, and Frizz's
-       * storage layer composes these freely, so the nesting has to survive the port.
-       */
-      transaction(fn) {
-        const runWith = (mode) => (...args2) => {
-          const depth = this.#depth;
-          const savepoint = `frizz_txn_${depth}`;
-          this.#depth = depth + 1;
-          try {
-            this.exec(depth === 0 ? `BEGIN ${mode}` : `SAVEPOINT ${savepoint}`);
-            let result;
-            try {
-              result = fn(...args2);
-            } catch (error) {
-              this.exec(depth === 0 ? "ROLLBACK" : `ROLLBACK TO ${savepoint}`);
-              if (depth > 0) this.exec(`RELEASE ${savepoint}`);
-              throw error;
-            }
-            this.exec(depth === 0 ? "COMMIT" : `RELEASE ${savepoint}`);
-            return result;
-          } finally {
-            this.#depth = depth;
-          }
-        };
-        const wrapper = runWith("IMMEDIATE");
-        wrapper.default = wrapper;
-        wrapper.deferred = runWith("DEFERRED");
-        wrapper.immediate = runWith("IMMEDIATE");
-        wrapper.exclusive = runWith("EXCLUSIVE");
-        return wrapper;
-      }
-      close() {
-        this.#db.close();
-      }
-    };
-  }
-});
-
-// packages/server/src/migrate-fray.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync2, lstatSync, readdirSync as readdirSync2, realpathSync as realpathSync2, renameSync as renameSync4, rmdirSync } from "node:fs";
-import { homedir as homedir5 } from "node:os";
-import { join as join7, resolve as resolve2 } from "node:path";
-function xdg2(env, name) {
-  const value = env[name];
-  return value && (value.startsWith("/") || /^[A-Za-z]:[\\/]/u.test(value)) ? value : void 0;
-}
-function movesFor(env, platform, home) {
-  const moves = [{ from: join7(home, ".fray"), to: join7(home, ".frizz") }];
-  if (platform === "win32") {
-    const local = env.LOCALAPPDATA || join7(env.USERPROFILE || home, "AppData", "Local");
-    moves.push({ from: join7(local, "Fray"), to: join7(local, "Frizz") });
-  } else if (platform === "darwin") {
-    const support = join7(home, "Library", "Application Support");
-    moves.push({ from: join7(support, "Fray"), to: join7(support, "Frizz") });
-    moves.push({ from: join7(home, "Library", "Caches", "Fray"), to: join7(home, "Library", "Caches", "Frizz") });
-  } else {
-    moves.push({ from: join7(home, ".local", "share", "fray"), to: join7(home, ".local", "share", "frizz") });
-    moves.push({ from: join7(home, ".local", "state", "fray"), to: join7(home, ".local", "state", "frizz") });
-    moves.push({ from: join7(home, ".cache", "fray"), to: join7(home, ".cache", "frizz") });
-  }
-  for (const name of ["XDG_DATA_HOME", "XDG_STATE_HOME", "XDG_CACHE_HOME"]) {
-    const base = xdg2(env, name);
-    if (base) moves.push({ from: join7(base, "fray"), to: join7(base, "frizz") });
-  }
-  return moves;
-}
-function migrateFrayGlobalRoots(options2 = {}) {
-  const env = options2.env ?? process.env;
-  const platform = options2.platform ?? process.platform;
-  const home = options2.home ?? homedir5();
-  const exists = options2.exists ?? existsSync2;
-  const rename = options2.rename ?? renameSync4;
-  const merge = options2.merge ?? mergeInto;
-  const moved = [];
-  for (const move of movesFor(env, platform, home)) {
-    if (!exists(move.from)) continue;
-    try {
-      if (exists(move.to)) {
-        if (merge(move.from, move.to)) moved.push(move);
-        continue;
-      }
-      rename(move.from, move.to);
-      moved.push(move);
-    } catch {
-    }
-  }
-  return moved;
-}
-function mergeInto(from, to) {
-  let moved = false;
-  for (const entry of readdirSync2(from, { withFileTypes: true })) {
-    const src = join7(from, entry.name);
-    const dst = join7(to, entry.name);
-    if (!existsSync2(dst)) {
-      renameSync4(src, dst);
-      moved = true;
-      continue;
-    }
-    if (entry.isDirectory() && lstatSync(dst).isDirectory() && mergeInto(src, dst)) moved = true;
-  }
-  try {
-    rmdirSync(from);
-  } catch {
-  }
-  return moved;
-}
-function migrateFrayProjectDir(projectDir) {
-  const from = join7(projectDir, ".fray");
-  const to = join7(projectDir, ".frizz");
-  try {
-    if (!lstatSync(from).isDirectory()) return false;
-    if (!existsSync2(to)) {
-      renameSync4(from, to);
-      return true;
-    }
-    return lstatSync(to).isDirectory() ? mergeInto(from, to) : false;
-  } catch {
-    return false;
-  }
-}
-function readId(dir, scope, key) {
-  let output;
-  try {
-    output = execFileSync3("git", ["config", ...scope, "--get-all", key], {
-      cwd: dir,
-      encoding: "utf8",
-      env: { ...process.env, LC_ALL: "C" },
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-  } catch {
-    return void 0;
-  }
-  const values = output.replace(/\r?\n$/u, "").split(/\r?\n/u).filter((value) => value.length > 0);
-  if (values.length !== 1) return void 0;
-  const id = (values[0] ?? "").trim();
-  return PROJECT_ID_RE2.test(id) ? id : void 0;
-}
-function writeId(dir, scope, id) {
-  try {
-    execFileSync3("git", ["config", ...scope, "--replace-all", CURRENT_KEY, id], {
-      cwd: dir,
-      stdio: ["ignore", "ignore", "ignore"]
-    });
-  } catch {
-    return false;
-  }
-  return readId(dir, scope, CURRENT_KEY) === id;
-}
-function hasBoard(id, home) {
-  const db = join7(projectStateDir(id, home), "ui.db");
-  if (!existsSync2(db)) return false;
-  let sql;
-  try {
-    sql = new Database(db, { readonly: true });
-    const row = sql.prepare("select count(*) as n from session").get();
-    return Number(row?.n ?? 0) > 0;
-  } catch {
-    return true;
-  } finally {
-    try {
-      sql?.close();
-    } catch {
-    }
-  }
-}
-function linkedWorktreeScopes(dir) {
-  const gitPath = (flag) => {
-    try {
-      const raw = execFileSync3("git", ["rev-parse", flag], {
-        cwd: dir,
-        encoding: "utf8",
-        env: { ...process.env, LC_ALL: "C" },
-        stdio: ["ignore", "pipe", "ignore"]
-      }).trim();
-      return realpathSync2(resolve2(dir, raw));
-    } catch {
-      return void 0;
-    }
-  };
-  const gitDir = gitPath("--git-dir");
-  const commonGitDir = gitPath("--git-common-dir");
-  if (!gitDir || !commonGitDir || gitDir === commonGitDir) return void 0;
-  return {
-    legacy: ["--file", join7(gitDir, "fray.config")],
-    current: ["--file", join7(gitDir, "frizz.config")]
-  };
-}
-function adopt(dir, legacy, current, home) {
-  const legacyId = readId(dir, legacy, LEGACY_KEY);
-  if (!legacyId) return void 0;
-  const currentId = readId(dir, current, CURRENT_KEY);
-  if (currentId === legacyId) return void 0;
-  if (currentId && hasBoard(currentId, home)) return void 0;
-  if (!writeId(dir, current, legacyId)) return void 0;
-  return currentId ? { id: legacyId, replaced: currentId } : { id: legacyId };
-}
-function migrateFrayProjectId(projectDir, { home } = {}) {
-  const adopted = [];
-  const repository = adopt(projectDir, ["--local"], ["--local"], home);
-  if (repository) adopted.push(repository);
-  const worktree = linkedWorktreeScopes(projectDir);
-  if (worktree) {
-    const own = adopt(projectDir, worktree.legacy, worktree.current, home);
-    if (own) adopted.push({ ...own, worktree: true });
-  }
-  return adopted;
-}
-var PROJECT_ID_RE2, LEGACY_KEY, CURRENT_KEY;
-var init_migrate_fray = __esm({
-  "packages/server/src/migrate-fray.ts"() {
-    "use strict";
-    init_frizz_paths();
-    init_sqlite();
-    PROJECT_ID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
-    LEGACY_KEY = "fray.id";
-    CURRENT_KEY = "frizz.id";
-  }
-});
-
 // packages/server/src/project-root.ts
 import { createHash as createHash3, randomUUID as randomUUID4 } from "node:crypto";
-import { closeSync as closeSync3, existsSync as existsSync3, fsyncSync as fsyncSync3, mkdirSync as mkdirSync5, openSync as openSync4, readFileSync as readFileSync5, renameSync as renameSync5, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
-import { dirname as dirname4, join as join8, parse, resolve as resolve3 } from "node:path";
+import { closeSync as closeSync3, existsSync as existsSync2, fsyncSync as fsyncSync3, mkdirSync as mkdirSync5, openSync as openSync4, readFileSync as readFileSync5, realpathSync as realpathSync2, renameSync as renameSync4, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname5, join as join7, parse, resolve as resolve2 } from "node:path";
 function projectIdPath(root) {
-  return join8(root, FRIZZ_DIR, ID_FILE);
+  return join7(root, FRIZZ_DIR, ID_FILE);
 }
 function readProjectIdFile(root) {
   let raw;
@@ -1825,17 +1469,17 @@ function readProjectIdFile(root) {
   }
 }
 function writeProjectIdFile(root, id) {
-  const dir = join8(root, FRIZZ_DIR);
+  const dir = join7(root, FRIZZ_DIR);
   mkdirSync5(dir, { recursive: true });
-  const ignore = join8(dir, SELF_IGNORE);
-  if (!existsSync3(ignore)) {
+  const ignore = join7(dir, SELF_IGNORE);
+  if (!existsSync2(ignore)) {
     try {
       writeFileSync5(ignore, "*\n", { flag: "wx" });
     } catch {
     }
   }
   const path = projectIdPath(root);
-  const temp = join8(dir, `.${ID_FILE}.${process.pid}.${randomUUID4()}.tmp`);
+  const temp = join7(dir, `.${ID_FILE}.${process.pid}.${randomUUID4()}.tmp`);
   let fd;
   try {
     fd = openSync4(temp, "wx", 384);
@@ -1844,7 +1488,7 @@ function writeProjectIdFile(root, id) {
     fsyncSync3(fd);
     closeSync3(fd);
     fd = void 0;
-    renameSync5(temp, path);
+    renameSync4(temp, path);
   } catch (error) {
     if (fd !== void 0) {
       try {
@@ -1863,7 +1507,7 @@ function writeProjectIdFile(root, id) {
 function projectRootLockName(root) {
   return `identity-path-${createHash3("sha256").update(root).digest("hex")}.lock`;
 }
-function ensureProjectIdFile(root, home = homedir6(), seed) {
+function ensureProjectIdFile(root, home = homedir5(), seed) {
   const existing = readProjectIdFile(root);
   if (existing) return existing;
   const release = acquireNamedLaunchLockSync(home, projectRootLockName(root));
@@ -1883,23 +1527,52 @@ function isNotAGitWorktree(error) {
   return /not a git repository/iu.test(stderr) || /must be run in a work ?tree/iu.test(stderr);
 }
 function hasAny(dir, names) {
-  return names.some((name) => existsSync3(join8(dir, name)));
+  return names.some((name) => existsSync2(join7(dir, name)));
+}
+function isHomeDirectory(dir, home = homedir5()) {
+  const canonical = (value) => {
+    try {
+      return realpathSync2(resolve2(value));
+    } catch {
+      return resolve2(value);
+    }
+  };
+  try {
+    return canonical(dir) === canonical(home);
+  } catch {
+    return false;
+  }
+}
+function existingProjectId(dir) {
+  const fromFile = readProjectIdFile(dir);
+  if (fromFile) return fromFile;
+  try {
+    return readGitProjectId(dir);
+  } catch {
+    return void 0;
+  }
 }
-function discoverProjectRoot(cwd = process.cwd(), home = homedir6()) {
+function isExistingProjectRoot(dir) {
+  return existingProjectId(dir) !== void 0;
+}
+function hasProjectMarker(dir) {
+  return hasAny(dir, REPO_MARKERS) || hasAny(dir, PROJECT_MARKERS);
+}
+function discoverProjectRoot(cwd = process.cwd(), home = homedir5()) {
   let dir;
   try {
-    dir = resolve3(cwd);
+    dir = resolve2(cwd);
   } catch {
-    return resolve3(cwd);
+    return resolve2(cwd);
   }
-  const stop = resolve3(home);
+  const stop = resolve2(home);
   const filesystemRoot = parse(dir).root;
-  for (let at = dir; ; at = dirname4(at)) {
+  for (let at = dir; ; at = dirname5(at)) {
     if (at === stop || at === filesystemRoot) break;
-    if (existsSync3(projectIdPath(at))) return at;
+    if (existsSync2(projectIdPath(at))) return at;
     if (hasAny(at, REPO_MARKERS)) return at;
     if (hasAny(at, PROJECT_MARKERS)) return at;
-    if (dirname4(at) === at) break;
+    if (dirname5(at) === at) break;
   }
   return dir;
 }
@@ -6035,6 +5708,10 @@ var init_zod = __esm({
 });
 
 // packages/shared/src/thread-slug.ts
+function slugify(title) {
+  const s = title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return s.slice(0, THREAD_SLUG_MAX_CHARS).replace(/-+$/g, "") || "thread";
+}
 var THREAD_SLUG_MAX_CHARS, ThreadSlug;
 var init_thread_slug = __esm({
   "packages/shared/src/thread-slug.ts"() {
@@ -6595,7 +6272,10 @@ var init_receipt_bus = __esm({
 });
 
 // packages/shared/src/index.ts
-var ATTACHMENT_IMAGE_EXTENSIONS, ATTACHMENT_DOC_EXTENSIONS, ATTACHMENT_EXTENSIONS, ATTACHMENT_MAX_BASE64_CHARS, ATTACHMENT_MAX_BYTES, ATTACHMENT_EXT_SET, ATTACHMENT_ACCEPT, FrizzStatus, BlockMechanism, RuntimeState, Backend, CodexModel, ThreadProfileOption, ThreadAgent, SubAgentView, BgShellView, CompletionHoldOp, CompletionHold, AskOption, AskQuestion, PendingAsk, NativeInputRequired, AwaitingHint, SnoozeUntil, SNOOZE_PROMPT_MAX, SnoozePrompt, RECURRING_PROMPT_MAX, RECURRING_MIN_INTERVAL_SECONDS, RECURRING_MAX_INTERVAL_SECONDS, RecurringPromptText, RecurringIntervalSeconds, ThreadRecurringPrompt, ALLDONE_SENTINEL, OPT_OUT_NOTE, TIMER_PROMPT_MAX, TIMER_MAX_DELAY_SECONDS, TimerPromptText, ThreadTimerView, ThreadFence, PlanView, LimitWindow, LimitPause, ThreadView, BoardErrorItem, BoardSnapshot, QuotaWindow, ProviderQuota, QuotaSnapshot, ProviderAuth, AccountEmails, AuthSnapshot, AccountLogoutInput, AccountLogoutResult, AccountLoginStartInput, AccountLoginStartResult, AccountLoginStatusInput, AccountLoginStatusResult, PermissionMode, LocalFileOpener, Settings, DispatchProviderPreferences, DispatchPreferences, DispatchProfileSnapshot, SetDispatchPreferenceInput, DispatchInput, ADOPT_THREAD_MESSAGE_MAX_CHARS, AdoptThreadInput, AdoptThreadResult, FollowUpInput, UnqueueFollowUpInput, UnqueueFollowUpResult, DeliverQueuedNowInput, DeliverQueuedNowResult, SetThreadSnoozeInput, SetThreadRecurringPromptInput, SetOwnThreadRecurringPromptInput, SetOwnThreadTimerInput, CancelOwnThreadTimerInput, ListOwnThreadTimersInput, OwnThreadTimersResult, SetOwnThreadTimerResult, CancelOwnThreadTimerResult, SetOwnThreadStopHookInput, SetOwnThreadHeartbeatInput, ThreadPluginReloadResult, ConfirmAwaitingInput, RenameThreadInput, AiRenameThreadInput, AiRenameThreadResult, SetThreadPermissionInput, SetThreadPermissionResult, ThreadProfileOptionsInput, ThreadProfileOptionsResult, SetThreadProfileInput, SetThreadProfileResult, DISPATCH_TASK_BANNER, DISPATCH_TASK_BANNER_MARKER, GithubWakeItem, GithubWakeSteer, WAKE_SCOPE, WAKE_REF, WAKE_SINGLE, WAKE_MULTI_HEAD, GithubStatus, GithubItem, GithubListInput, GithubListResult, GithubBatchInput, GithubBatchResult, BoardMeta, ServerEvent, TranscriptEdit, TranscriptTodo, TranscriptToolCall, TranscriptPart, TranscriptMessage, TranscriptPageCursor, TranscriptPage, TranscriptEarlierInput, SocketTranscriptSlug, SocketClientMsg, DEFAULT_PORT;
+function fallbackPort(base) {
+  return base + 1e4;
+}
+var ATTACHMENT_IMAGE_EXTENSIONS, ATTACHMENT_DOC_EXTENSIONS, ATTACHMENT_EXTENSIONS, ATTACHMENT_MAX_BASE64_CHARS, ATTACHMENT_MAX_BYTES, ATTACHMENT_EXT_SET, ATTACHMENT_ACCEPT, FrizzStatus, BlockMechanism, RuntimeState, Backend, CodexModel, ThreadProfileOption, ThreadAgent, SubAgentView, BgShellView, CompletionHoldOp, CompletionHold, AskOption, AskQuestion, PendingAsk, NativeInputRequired, AwaitingHint, RETIRED_AWAITING_KINDS, RETIRED_LINE_RE, AWAITING_FOR_MAX_MS, SnoozeUntil, SNOOZE_PROMPT_MAX, SnoozePrompt, RECURRING_PROMPT_MAX, RECURRING_MIN_INTERVAL_SECONDS, RECURRING_MAX_INTERVAL_SECONDS, RecurringPromptText, RecurringIntervalSeconds, ThreadRecurringPrompt, TIMER_PROMPT_MAX, TIMER_MAX_DELAY_SECONDS, TimerPromptText, SIGNOFF_NUDGE_MARKER, SIGNOFF_NUDGE_MESSAGE, ThreadWatchKind, GithubChecksState, GithubMergeState, GithubWatchStatus, ThreadWatchView, PR_WATCH_DEFAULT_FOR_MS, PrWatchView, AddOwnPrWatchInput, AddOwnPrWatchResult, DropOwnPrWatchInput, DropOwnPrWatchResult, ListOwnPrWatchesInput, OwnPrWatchesResult, ThreadTimerView, ThreadFence, PlanView, LimitWindow, LimitPause, ThreadView, BoardErrorItem, BoardSnapshot, QuotaWindow, ProviderQuota, QuotaSnapshot, ProviderAuth, AccountEmails, AuthSnapshot, AccountLogoutInput, AccountLogoutResult, AccountLoginStartInput, AccountLoginStartResult, AccountLoginStatusInput, AccountLoginStatusResult, PermissionMode, LocalFileOpener, Settings, DispatchProviderPreferences, DispatchPreferences, DispatchProfileSnapshot, SetDispatchPreferenceInput, DispatchInput, ADOPT_THREAD_MESSAGE_MAX_CHARS, AdoptThreadInput, AdoptThreadResult, FollowUpInput, UnqueueFollowUpInput, UnqueueFollowUpResult, DeliverQueuedNowInput, DeliverQueuedNowResult, SetThreadSnoozeInput, SetThreadRecurringPromptInput, SetOwnThreadRecurringPromptInput, SetOwnThreadRecurringPromptResult, GetOwnThreadRecurringPromptInput, OwnThreadRecurringPromptResult, SetOwnThreadTimerInput, CancelOwnThreadTimerInput, ListOwnThreadTimersInput, OwnThreadTimersResult, ThreadActivityItem, ListOwnThreadActivityInput, OwnThreadActivityResult, SetOwnThreadTimerResult, CancelOwnThreadTimerResult, SetOwnThreadStopHookInput, SetOwnThreadHeartbeatInput, ThreadPluginReloadResult, ConfirmAwaitingInput, RenameThreadInput, AiRenameThreadInput, AiRenameThreadResult, SetThreadPermissionInput, SetThreadPermissionResult, ThreadProfileOptionsInput, ThreadProfileOptionsResult, SetThreadProfileInput, SetThreadProfileResult, DISPATCH_TASK_BANNER, DISPATCH_TASK_BANNER_MARKER, GithubWakeItem, GithubWakeSteer, WAKE_SCOPE, WAKE_REF, WAKE_SINGLE, WAKE_MULTI_HEAD, GithubStatus, GithubRefCard, GithubRefPreviewInput, GithubRefPreviewResult, GithubItem, GithubListInput, GithubListResult, GithubBatchInput, GithubBatchResult, BoardMeta, ServerEvent, TranscriptEdit, TranscriptTodo, TranscriptToolCall, TranscriptPart, TranscriptMessage, TranscriptPageCursor, TranscriptPage, TranscriptEarlierInput, SocketTranscriptSlug, SocketClientMsg, ProjectCard, PROJECT_ICON_MAX_BASE64_CHARS, DirectoryPickResult, ThreadLocation, FRIZZ_ROUTE_PREFIX, DEFAULT_PORT;
 var init_src = __esm({
   "packages/shared/src/index.ts"() {
     "use strict";
@@ -6807,7 +6487,15 @@ var init_src = __esm({
       command: external_exports.string().optional(),
       // ISO8601 of the shell output file's last write — "last active 6 min ago" for a quiet-but-live
       // watcher. Optional (see SubAgentView.lastActivityAt).
-      lastActivityAt: external_exports.string().optional()
+      lastActivityAt: external_exports.string().optional(),
+      // The PROVIDER's session-wide background-task handle (`bzvtnt3ig`), as distinct from `id`, which is
+      // the launch tool_use id. Both name the same shell and neither is a substitute for the other:
+      // `id` is what the two copies of a row reconcile on, and this is the handle the runtime hands the
+      // MODEL — "Command running in background with ID: bzvtnt3ig" is the only id a worker ever sees, so
+      // it is the one it registers a `shell` watcher against. Matching on `id`/`label` alone meant every
+      // such watcher was unfireable (scheduler.evalWatchers, 2026-08-14). Absent for a CODEX row, whose
+      // single `processId` IS its `id`, and for a Claude row between its tool_use and its launch ack.
+      taskId: external_exports.string().optional()
     });
     CompletionHoldOp = external_exports.object({
       label: external_exports.string(),
@@ -6844,9 +6532,12 @@ var init_src = __esm({
       title: external_exports.string().max(120)
     });
     AwaitingHint = external_exports.object({
-      kind: external_exports.enum(["pr-watch", "human", "timer", "pr", "ci", "session"]),
+      kind: external_exports.enum(["shell", "agent", "timer", "pr", "for", "reason"]),
       value: external_exports.string()
     });
+    RETIRED_AWAITING_KINDS = ["watch", "pr-watch", "human", "ci", "session"];
+    RETIRED_LINE_RE = new RegExp(`^\\s*(${RETIRED_AWAITING_KINDS.join("|")}):\\s*\\S`, "im");
+    AWAITING_FOR_MAX_MS = 24 * 60 * 60 * 1e3;
     SnoozeUntil = external_exports.string().regex(
       /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/,
       "Snooze time must be an ISO-8601 UTC instant"
@@ -6863,21 +6554,172 @@ var init_src = __esm({
     RecurringIntervalSeconds = external_exports.number().int().min(RECURRING_MIN_INTERVAL_SECONDS).max(RECURRING_MAX_INTERVAL_SECONDS);
     ThreadRecurringPrompt = external_exports.object({
       prompt: external_exports.string(),
-      /** The two mechanisms, named as the panel labels them. `stopHook` fires at every rest; `heartbeat`
-       *  fires on `intervalSeconds` and reaches the agent mid-turn. */
+      /** The three mechanisms, named as the panel labels them. `stopHook` fires at every rest; `heartbeat`
+       *  fires on `intervalSeconds`; `postCompaction` fires whenever the harness summarizes the thread's
+       *  context away. The latter two both reach the agent mid-turn. */
       stopHook: external_exports.boolean(),
       heartbeat: external_exports.boolean(),
+      postCompaction: external_exports.boolean(),
       intervalSeconds: external_exports.number().int().positive().optional(),
       armedAt: external_exports.string(),
-      /** Last delivery of the ON REST trigger; the two are stamped separately so each reads its own clock. */
+      /** Last delivery per trigger; stamped separately so each reads its own clock. */
       lastRestFiredAt: external_exports.string().optional(),
-      lastScheduleFiredAt: external_exports.string().optional()
+      lastScheduleFiredAt: external_exports.string().optional(),
+      lastCompactFiredAt: external_exports.string().optional()
     }).strict();
-    ALLDONE_SENTINEL = "ALLDONE";
-    OPT_OUT_NOTE = `If there is genuinely no further work, reply ${ALLDONE_SENTINEL} on its own line to stop these prompts \u2014 but be sure, because it permanently stalls this run.`;
     TIMER_PROMPT_MAX = SNOOZE_PROMPT_MAX;
     TIMER_MAX_DELAY_SECONDS = 30 * 24 * 60 * 60;
     TimerPromptText = external_exports.string().trim().min(1).max(TIMER_PROMPT_MAX);
+    SIGNOFF_NUDGE_MARKER = "**This message is from frizz, not from the human.**";
+    SIGNOFF_NUDGE_MESSAGE = [
+      `${SIGNOFF_NUDGE_MARKER} Nothing about your task has changed, and no new work is being asked of you.`,
+      "",
+      "You rested without a fence, so this thread cannot be triaged.",
+      "",
+      "**IF THE TASK STILL HAS PARTS LEFT, THE FENCE IS NOT WHAT YOU OWE \u2014 THE WORK IS.** If ANY part of the",
+      "original task is unfinished, unverified, or deferred, resume it NOW, in THIS turn, and sign off once it",
+      "is genuinely finished. A milestone, a green test run and a long turn are none of them endings, and",
+      "neither is naming the next step or writing it into a scratch file.",
+      "",
+      "**AND THAT TASK IS ALSO THE CEILING \u2014 finish it, and nothing else.** Work you notice on the way is a",
+      "FINDING TO REPORT in your sign-off, never work to take on: the bug beside the one you were sent for,",
+      "the refactor the code obviously wants, the second issue the first one touches. Widening the job is not",
+      "thoroughness \u2014 it is a different job nobody asked for, and it buries the answer they did ask for under",
+      "changes they now have to review. If it should be done, name it in one line and let the human dispatch",
+      "it.",
+      "",
+      "**IF WHAT YOU WERE ASKED FOR IS A DOCUMENT, THE DOCUMENT IS THE ENDING.** A triage, a review, an",
+      "investigation, a recommendation, a plan \u2014 when that is the deliverable, the finished write-up IS the",
+      "work. Implementing what it proposes is the NEXT job, and not yours unless you were asked. Sign off with",
+      "the write-up.",
+      "",
+      "**DECIDE RATHER THAN ASK.** Stop only for a decision that is genuinely the human's AND that blocks you",
+      "right now: ask that one in a question fence. Every other open choice INSIDE the task \u2014 a name, a",
+      "default, a reversible design call \u2014 is yours to make: decide it, say in one line which way you went and",
+      "what would reverse it, and carry on. A choice that would ENLARGE the task is not one of those: an",
+      "unanswered question is not permission to go build the answer.",
+      "",
+      "Otherwise, add a fence at the END of your next message:",
+      "",
+      "- `` ```question `` \u2014 you need the human. One question per fence, lettered options, one recommended.",
+      "- `` ```done `` \u2014 genuinely FINISHED. A DISMISSAL: the card is filed away and nobody looks again, so",
+      "  if anything is still owed, it is not done. Body: 1-3 sentences, then bullets, each opening with a",
+      "  **bolded verb phrase**.",
+      "- `` ```awaiting `` \u2014 you are WAITING on work that is actually running. It is PURE STRUCTURE: one line",
+      "  per thing you are waiting on, a REQUIRED `for:` duration, and one line of `reason:` prose.",
+      "",
+      "  ```awaiting",
+      "  shell: <the id your runtime gave you>",
+      "  pr: owner/repo#123",
+      "  for: 2h",
+      "  reason: what you are waiting for, in one line",
+      "  ```",
+      "",
+      "  Frizz CHECKS every line: name something that is not running and you are bumped rather than parked.",
+      "  A fence that names NOTHING is not a park at all \u2014 if you are not waiting on anything, you are not",
+      "  awaiting, you are done. Register a PR with `mcp__frizz__watch_pr` and a timer with",
+      "  `mcp__frizz__timer`; `mcp__frizz__activity` reads back everything you have running, with its id.",
+      "",
+      "**STILL OWED counts things you are not going to do yourself.** A decision you are RECOMMENDING, a",
+      "draft you wrote but did not send, follow-up work you discovered \u2014 all of it dies with the card, even",
+      "the part that is someone else's to do. Each ends on a question with your recommendation as option A,",
+      "or gets its own card first via `mcp__frizz__spawn_thread`; none of them is a `done`. And what is not",
+      'worth a card is not worth a SENTENCE: delete the dangling "one thing to carry forward", never park it',
+      "in the handoff.",
+      "",
+      "**DO NOT REPEAT YOURSELF.** If the message you just wrote already stands on its own, reply with the",
+      "fence ALONE \u2014 the human reads both together, so restating it costs them the second read for nothing.",
+      "The same holds inside one message: the card is the ledger of what shipped, the prose is only what a",
+      "ledger cannot hold, and a sentence that reads the same in either belongs in exactly one of them.",
+      "",
+      "Only if it does NOT stand alone, fix that first, briefly. It has to be readable cold: the human has",
+      "seen nothing since their own last message \u2014 the Goal, this reminder, a watcher wake all came from",
+      "frizz \u2014 so anything you assumed they had followed, they have not."
+    ].join("\n");
+    ThreadWatchKind = external_exports.enum(["shell", "github"]);
+    GithubChecksState = external_exports.enum(["none", "running", "passing", "failing"]);
+    GithubMergeState = external_exports.enum(["mergeable", "blocked", "conflicting", "unknown"]);
+    GithubWatchStatus = external_exports.object({
+      checks: GithubChecksState,
+      /** The counts behind the verdict, so the card can say "3 running, 12 passed" the way GitHub does
+       *  rather than only "checks are running". */
+      running: external_exports.number().int().nonnegative(),
+      passed: external_exports.number().int().nonnegative(),
+      failed: external_exports.number().int().nonnegative(),
+      /** The failing job NAMES, capped — what a human actually needs to decide whether to look. */
+      failing: external_exports.array(external_exports.string()).max(8).default([]),
+      merge: GithubMergeState,
+      /** OPEN | CLOSED | MERGED, lowercased. A merged or closed PR ends the wait outright. */
+      state: external_exports.enum(["open", "closed", "merged"]),
+      /** When frizz last heard from GitHub. A poll can fail or be rate-limited, and a stale reading stated
+       *  as current is worse than no reading. */
+      polledAt: external_exports.string(),
+      /** The head commit this verdict was reached on. A PR watcher reports a CI verdict when it is NEWS, and
+       *  "red again on a new commit" is news that the bare word `failing` cannot express. Optional because a
+       *  reading taken before 2026-08-17 carries none. */
+      head: external_exports.string().optional(),
+      /** A digest of WHICH jobs are failing right now. The head commit alone cannot express a re-run of the
+       *  same job, or a slower job going red after the first — both of which are a second failure the worker
+       *  must hear about. Empty when nothing is failing. */
+      failureSig: external_exports.string().optional()
+    }).strict();
+    ThreadWatchView = external_exports.object({
+      id: external_exports.string(),
+      kind: ThreadWatchKind,
+      target: external_exports.string(),
+      state: external_exports.enum(["armed", "fired", "dropped"]),
+      createdAt: external_exports.string(),
+      /** `github` rows only, and absent until the first successful poll. */
+      github: GithubWatchStatus.optional()
+    }).strict();
+    PR_WATCH_DEFAULT_FOR_MS = 6 * 60 * 60 * 1e3;
+    PrWatchView = external_exports.object({
+      id: external_exports.string(),
+      /** `owner/repo#N`, normalized — the same string the board's row and the status book are keyed by. */
+      target: external_exports.string(),
+      state: external_exports.enum(["armed", "dropped", "settled"]),
+      createdAt: external_exports.string(),
+      /** The PR's checks/mergeability as the poller last saw it. Absent until the first successful poll. */
+      github: GithubWatchStatus.optional()
+    }).strict();
+    AddOwnPrWatchInput = external_exports.object({
+      slug: ThreadSlug,
+      /** `owner/repo#123` or a PR URL. Parsed server-side; an unparseable ref is refused rather than stored,
+       *  because a watcher that can never fire is worse than none — the worker rests believing it is covered. */
+      target: external_exports.string().trim().min(1).max(200),
+      /** How long to watch, as a DURATION (`30m`, `2h`, `3d` — parseAwaitingDuration).
+       *
+       *  A PR nobody ever reviews would otherwise be polled forever, and a thread parked on it would wait
+       *  forever with it — the same unbounded wait the awaiting fence's `for:` closes, one level down. A
+       *  duration rather than an instant for the same reason it is one there: it cannot be written in the
+       *  past (maintainer 2026-08-15, asking for it explicitly).
+       *
+       *  REQUIRED BY THE TOOL, OPTIONAL ON THE WIRE, and the asymmetry is deliberate. A worker's MCP server
+       *  outlives every frizz restart, so a session dispatched before this existed still holds a binary that
+       *  cannot send it — and making the RPC reject that would break `watch_pr` outright for every thread
+       *  already running, with no recourse from inside those threads. Absent ⇒ PR_WATCH_DEFAULT_FOR, which
+       *  still BOUNDS the poll; the point of the field is that a worker chooses, and one that cannot choose
+       *  is better bounded than broken. */
+      for: external_exports.string().trim().min(1).max(16).optional()
+    }).strict();
+    AddOwnPrWatchResult = external_exports.object({
+      id: external_exports.string(),
+      target: external_exports.string(),
+      /** True when this exact PR was ALREADY watched by this thread, so the call registered nothing new.
+       *  Re-registering after a compaction is the common case, and a duplicate would double every wake. */
+      alreadyArmed: external_exports.boolean(),
+      watches: external_exports.array(PrWatchView)
+    }).strict();
+    DropOwnPrWatchInput = external_exports.object({
+      slug: ThreadSlug,
+      id: external_exports.string().min(1).max(64)
+    }).strict();
+    DropOwnPrWatchResult = external_exports.object({
+      dropped: external_exports.boolean(),
+      watches: external_exports.array(PrWatchView)
+    }).strict();
+    ListOwnPrWatchesInput = external_exports.object({ slug: ThreadSlug }).strict();
+    OwnPrWatchesResult = external_exports.object({ watches: external_exports.array(PrWatchView) }).strict();
     ThreadTimerView = external_exports.object({
       id: external_exports.string(),
       prompt: external_exports.string(),
@@ -6982,6 +6824,14 @@ var init_src = __esm({
       // Live background SHELLS the worker launched (tailer-derived). Same default-[] discipline. Rendered
       // in the anchored background-ops strip alongside sub-agents; ids make current rows drillable.
       bgShells: external_exports.array(BgShellView).default([]),
+      // The thread's ARMED WATCHERS — registry-derived, not folded from the transcript, which is what makes
+      // them survive the worker saying one more sentence. Same default-[] discipline as the two above.
+      //
+      // These NEVER park the thread: a row with an armed watcher stays a visible queue handoff, and Snooze
+      // remains the only way to hide one (maintainer 2026-08-12, choosing this over auto-Held for every
+      // kind). So this field is for the operator to SEE what a thread is waiting on — it deliberately feeds
+      // no queue-membership rule.
+      watches: external_exports.array(ThreadWatchView).default([]),
       // A pending native AskUserQuestion the session is frozen on (tailer-derived). Optional — absent
       // when there's no unanswered ask. Feeds needsAction + the read-only question render + "Answer in Terminal".
       pendingAsk: PendingAsk.optional(),
@@ -7027,6 +6877,16 @@ var init_src = __esm({
       // AUTO-bump (the scheduler resumes the agent with exactly this text) rather than a reminder, which is
       // the distinction the held row's tooltip renders. Absent ⇒ the card merely re-surfaces.
       snoozePrompt: external_exports.string().optional(),
+      /** The EVENT snooze on the resting card is armed for this exact rest — the human has said "hide this
+       *  until something reports". Distinct from `snoozedUntil`, which is a wall-clock park on the whole
+       *  thread: this one has no deadline and clears itself when the thread comes to a NEW rest.
+       *
+       *  It travels because the chat has to honour it too (2026-08-14). Until then only the QUEUE did, on
+       *  the reasoning that the card states a FACT the drawer must keep showing or it blanks at rest and
+       *  reads as "the agent died". That reasoning holds for a thread nobody has parked; once the human has
+       *  explicitly parked THIS rest, showing them the same card with the same button one surface over is
+       *  not information, and they said so. */
+      bgSnoozed: external_exports.boolean().optional(),
       // Which Claude transport serves this thread: "broker" = a session-broker-owned Agent SDK session
       // (typed control channel), "tmux" = the interactive TUI in a pane. Only the broker can be asked to
       // reload its plugin closure in place, so the board needs it to decide whether to offer that verb at
@@ -7068,9 +6928,6 @@ var init_src = __esm({
       // ISO8601 read/seen telemetry (threadSeen RPC — recorded when the human opens the thread). Kept for
       // compatibility and analytics only; viewing never acknowledges or removes a queue handoff.
       seenAt: external_exports.string().optional(),
-      // Project-relative scratchpad path (.frizz/threads/<session-id>/scratch.md) once provisioned — the worker's
-      // compaction-proof working memory, rendered as the thread's doc tab.
-      scratchpadPath: external_exports.string().optional(),
       // Project-relative plan artifact this thread was dispatched from (.frizz/plans/*.md), if any.
       planPath: external_exports.string().optional(),
       // Which agent backend runs this thread (Codex-support epic, Phase 3) — drives the subtle per-row
@@ -7087,13 +6944,13 @@ var init_src = __esm({
       // Raw durable barrier bit. Unlike permissionPending this remains true for a future/corrupt value,
       // so rolling clients fail closed instead of enabling another composer while ownership is unknown.
       permissionChangePending: external_exports.boolean().optional(),
-      // The last decision the worker's permission POLICY made for this thread (cc-worker/hooks/
-      // perm-policy.mjs), and how many times it has DENIED. A policy decision never blocks anyone, so it
-      // has no other way of being noticed — an allow is not written to the transcript at all. Surfacing it
-      // is what keeps "frizz silently approved something on your behalf" from being invisible.
-      // Deferred requests are deliberately absent: those already show as a permission prompt / Needs you.
+      // The last DENIAL the worker's permission POLICY made for this thread (cc-worker/hooks/
+      // perm-policy.mjs), and how many times it has denied. A refusal changes what the worker can do, so
+      // it earns a card. Approvals and deferrals are deliberately absent: a deferral already shows as a
+      // permission prompt / Needs you, and an approval blocks nobody — the quiet line that used to report
+      // one stuck to the bottom of the thread forever, describing a command the reader had long moved past.
       permPolicy: external_exports.object({
-        decision: external_exports.enum(["allow", "deny"]),
+        decision: external_exports.literal("deny"),
         rule: external_exports.string(),
         reason: external_exports.string(),
         tool: external_exports.string().nullable(),
@@ -7135,6 +6992,25 @@ var init_src = __esm({
       projectName: external_exports.string(),
       projectLabel: external_exports.string(),
       // "owner/repo" from the git origin remote; falls back to projectName
+      // "owner/repo" ONLY when that origin remote is github.com — the link target the rendered-markdown
+      // autolinker turns `#123` and a bare commit hash into. Deliberately NOT projectLabel, which is a
+      // host-agnostic DISPLAY name: a GitLab origin yields an owner/repo there too, and pointing its `#12`
+      // at github.com would be a wrong destination rather than a missing one. Absent means the
+      // augmentation stays off (no remote, another forge, or a pre-restart server).
+      githubRepo: external_exports.string().optional(),
+      // This project's URL slug — the `<slug>` in `/project/<slug>`. The client cannot derive it: a
+      // PREFIXED page reads it off its own path, but the LAUNCHING project is served unprefixed and so has
+      // nothing to read, which left `/` — the all-projects GRID — as the only URL its queue could name.
+      // Optional so a pre-restart server keeps working; absent means "fall back to `/`", i.e. the old
+      // behaviour. Registry-derived, so it is the same slug every other surface links to.
+      projectSlug: external_exports.string().optional(),
+      // The server's home directory — the expansion of a `~` a worker wrote in prose. Agents reference
+      // files that way constantly (`~/.claude/CLAUDE.md`), and the browser has no way to derive it, so a
+      // `~`-anchored Markdown link had no absolute path to become and stayed a same-origin anchor that
+      // navigated out of Frizz. The client only ever uses it to build a path it then hands BACK to the
+      // server, which realpath-gates it exactly as it gates one the author typed in full. Optional so a
+      // pre-restart server keeps working; absent means `~` links stay unresolved, i.e. the old behaviour.
+      homeDir: external_exports.string().optional(),
       // (No `.frizz/ exists` bit here on purpose. Threads are session-first — the ui.db registry IS the
       // board — so `.frizz/` presence says nothing about whether this project has one. Its only consumer
       // was a shell gate that dead-ended `.frizz`-less repos; the server still probes the directory
@@ -7223,6 +7099,17 @@ var init_src = __esm({
       // presents it; resolveClaudeEffort (server/backend/claude-effort.ts) translates it at the spawn edge.
       effort: external_exports.enum(["low", "medium", "high", "xhigh", "max", "ultra", "ultracode"]).optional(),
       notifications: external_exports.boolean(),
+      /**
+       * The permanent column of project icons. OFF by default, on purpose.
+       *
+       * A rail of every project on the machine is a standing invitation to leave the thread you are in —
+       * "just too tempting" (maintainer 2026-08-06). Frizz's home is one board; the grid is a page you go
+       * to, not furniture you sit beside. Hidden, the way back is a breadcrumb in the status bar, which
+       * costs a click exactly when you meant to switch and nothing when you did not.
+       *
+       * Machine-level, like the font: which chrome you want is a property of the person, not the repo.
+       */
+      projectRail: external_exports.boolean(),
       // UI type family. `mono` (default) is the mono-forward system; `sans` swaps prose/UI chrome to a
       // sans stack while code / tool lines / the terminal stay mono. Optional so an old settings blob
       // parses; defaultSettings pins "mono".
@@ -7230,13 +7117,23 @@ var init_src = __esm({
       // Default action for a vetted non-image local path in agent markdown. Image clicks always use the
       // OS default viewer so screenshots retain their expected behavior.
       localFileOpener: LocalFileOpener.optional(),
-      // GitHub batch-dispatch prompt templates (the picker's per-item worker prompt). Optional: when
-      // unset OR blank the server falls back to its exported DEFAULT_ISSUE_PROMPT / DEFAULT_PR_PROMPT.
-      // Substitution tokens the server fills: {repo} {n} {title} {url} {labels} {body}. The leading
-      // `THREAD: <slug>` tag is prepended by the server (not part of the editable template) so a custom
-      // prompt can never break the thread↔.frizz-file binding. Optional so old settings blobs parse.
-      githubIssuePrompt: external_exports.string().optional(),
-      githubPrPrompt: external_exports.string().optional()
+      // The GitHub batch-dispatch prompt template (the picker's per-item worker prompt). Optional: when
+      // unset OR blank the server falls back to its exported DEFAULT_GITHUB_PROMPT. Substitution tokens
+      // the server fills: {repo} {n} {title} {url} {labels} {body}. The leading `THREAD: <slug>` tag is
+      // prepended by the server (not part of the editable template) so a custom prompt can never break the
+      // thread↔.frizz-file binding. Optional so old settings blobs parse.
+      //
+      // ONE field, not one per kind. Issue and PR each had their own template until 2026-08-15, and the two
+      // said the same thing twice: read the whole thread, be skeptical, cite what you checked, post nothing.
+      // A person tuning "be more dubious" had to make the same edit in two boxes and keep them in step. The
+      // ONE thing that genuinely differs per kind — which `gh` command reads the item — is a line in the
+      // metadata block, so the merged template just carries both, and the worker picks the one that applies.
+      //
+      // There is no migration off the two old keys, and that is deliberate (the maintainer's call): Settings
+      // is a non-strict z.object, so `githubIssuePrompt`/`githubPrPrompt` are STRIPPED the moment an old
+      // blob is parsed. Any existing override is dropped and the reader gets the new shipped default —
+      // exactly the intended backfill. Merging two customized templates into one has no correct answer.
+      githubPrompt: external_exports.string().optional()
     });
     DispatchProviderPreferences = external_exports.object({
       model: external_exports.string().trim().min(1).max(200).optional(),
@@ -7361,6 +7258,10 @@ var init_src = __esm({
       prompt: RecurringPromptText.nullable(),
       stopHook: external_exports.boolean(),
       heartbeat: external_exports.boolean(),
+      // The POST-COMPACTION trigger (scheduler SOURCE 7, added 2026-08-06). Defaulted rather than required
+      // so a client that predates it — an older tab, an older MCP server — keeps writing the row correctly
+      // with the trigger off, which is the honest reading of a caller that has never heard of it.
+      postCompaction: external_exports.boolean().default(false),
       intervalSeconds: RecurringIntervalSeconds.optional()
     }).strict();
     SetOwnThreadRecurringPromptInput = external_exports.object({
@@ -7368,8 +7269,29 @@ var init_src = __esm({
       prompt: RecurringPromptText.nullable(),
       stopHook: external_exports.boolean(),
       heartbeat: external_exports.boolean(),
+      // The POST-COMPACTION trigger (scheduler SOURCE 7, added 2026-08-06). Defaulted rather than required
+      // so a client that predates it — an older tab, an older MCP server — keeps writing the row correctly
+      // with the trigger off, which is the honest reading of a caller that has never heard of it.
+      postCompaction: external_exports.boolean().default(false),
+      /** ACCEPTED AND IGNORED. The question hold was deleted 2026-08-16 (see scheduler.ts) and no caller in
+       *  this repo sends it any more — but this object is `.strict()`, and the caller on the other end is a
+       *  DETACHED worker daemon holding the `frizz-mcp.mjs` it was spawned with. Those outlive a server
+       *  restart by design, so for as long as any pre-2026-08-16 worker is alive a `start` would otherwise
+       *  come back as a validation error on a field the model cannot see it is sending. Tolerated here rather
+       *  than in the router so the shape stays one declaration; delete it once no such worker can be running.
+       *  The BROWSER input above needs no such clause — a stale tab is one reload away. */
+      pauseOnQuestions: external_exports.boolean().optional(),
       intervalSeconds: RecurringIntervalSeconds.optional()
     }).strict();
+    SetOwnThreadRecurringPromptResult = external_exports.object({
+      replaced: ThreadRecurringPrompt.nullable()
+    }).strict();
+    GetOwnThreadRecurringPromptInput = external_exports.object({
+      slug: ThreadSlug
+    }).strict();
+    OwnThreadRecurringPromptResult = external_exports.object({
+      recurringPrompt: ThreadRecurringPrompt.nullable()
+    }).strict();
     SetOwnThreadTimerInput = external_exports.object({
       slug: ThreadSlug,
       prompt: TimerPromptText,
@@ -7385,6 +7307,23 @@ var init_src = __esm({
     OwnThreadTimersResult = external_exports.object({
       timers: external_exports.array(ThreadTimerView)
     }).strict();
+    ThreadActivityItem = external_exports.object({
+      kind: external_exports.enum(["shell", "agent", "timer", "pr"]),
+      /** The string a `<kind>:` fence line must carry. For a shell that is the runtime task id the worker
+       *  was shown; for a PR, `owner/repo#N`; for a timer, its `tmr_…` row id. */
+      id: external_exports.string(),
+      label: external_exports.string(),
+      /** ISO8601 of when it started or was armed — absent when frizz has no instant for it. */
+      since: external_exports.string().optional(),
+      /** A timer's fire instant, or a PR's expiry. Absent for shells and sub-agents. */
+      until: external_exports.string().optional()
+    }).strict();
+    ListOwnThreadActivityInput = external_exports.object({
+      slug: ThreadSlug
+    }).strict();
+    OwnThreadActivityResult = external_exports.object({
+      activity: external_exports.array(ThreadActivityItem)
+    }).strict();
     SetOwnThreadTimerResult = external_exports.object({
       id: external_exports.string(),
       fireAt: external_exports.string(),
@@ -7434,6 +7373,11 @@ var init_src = __esm({
       // attempted a write after the flip to danger-full-access was still refused). So the change is real and
       // durable, yet it does not reach work already executing. Distinct from "next-resume", which means
       // nothing was applied to the live session at all.
+      //
+      // It is ALSO the Claude answer, arrived at from the opposite direction: a permission mode is a LAUNCH
+      // flag there, so frizz retires the idle worker process and the next turn cold-resumes under the new
+      // one (router `setThreadPermission`). Same promise to the operator — stored, and true from the next
+      // turn on — reached by restarting rather than by retuning.
       effect: external_exports.enum(["applied", "next-turn", "next-resume"])
     });
     ThreadProfileOptionsInput = external_exports.object({ slug: ThreadSlug }).strict();
@@ -7491,6 +7435,43 @@ ${DISPATCH_TASK_BANNER}
       nameWithOwner: external_exports.string().nullable(),
       authed: external_exports.boolean()
     });
+    GithubRefCard = external_exports.object({
+      ref: external_exports.string(),
+      kind: external_exports.enum(["issue", "pr", "commit"]),
+      repo: external_exports.string(),
+      // owner/repo, for the card's header line
+      url: external_exports.string(),
+      title: external_exports.string(),
+      body: external_exports.string(),
+      // already truncated server-side to the card's excerpt budget
+      state: external_exports.string(),
+      // OPEN | CLOSED | MERGED | DRAFT — empty for a commit, which has no state
+      stateReason: external_exports.string().optional(),
+      // COMPLETED | NOT_PLANNED | REOPENED — GitHub's closed-issue nuance
+      at: external_exports.string().optional(),
+      // ISO: opened-at for an issue/PR, committed-at for a commit
+      authorLogin: external_exports.string().optional(),
+      authorName: external_exports.string().optional(),
+      // commits carry a git author name with no GitHub account behind it
+      authorAvatar: external_exports.string().optional(),
+      labels: external_exports.array(external_exports.object({ name: external_exports.string(), color: external_exports.string() })).default([]),
+      additions: external_exports.number().int().nonnegative().optional(),
+      deletions: external_exports.number().int().nonnegative().optional(),
+      changedFiles: external_exports.number().int().nonnegative().optional(),
+      comments: external_exports.number().int().nonnegative().optional(),
+      // Epoch ms of the fetch this card came from. The CLIENT owns the freshness decision (render the
+      // cached card instantly, then revalidate if it is old), so it has to be able to see the age.
+      fetchedAt: external_exports.number().int().nonnegative()
+    });
+    GithubRefPreviewInput = external_exports.object({
+      refs: external_exports.array(external_exports.string().min(3).max(120)).min(1).max(100),
+      refresh: external_exports.boolean().default(false)
+    });
+    GithubRefPreviewResult = external_exports.object({
+      cards: external_exports.array(GithubRefCard),
+      missing: external_exports.array(external_exports.string()),
+      error: external_exports.string().optional()
+    });
     GithubItem = external_exports.object({
       kind: external_exports.enum(["issue", "pr"]),
       number: external_exports.number().int().positive(),
@@ -7853,7 +7834,25 @@ ${DISPATCH_TASK_BANNER}
       // there and stores the DISPATCH id here. Additive + optional: absent when the ack was never seen (a
       // resumed session whose dispatch scrolled out), and the line then renders as plain text, not a dead link.
       peerFrom: external_exports.string().optional(),
-      peerDispatchId: external_exports.string().optional()
+      peerDispatchId: external_exports.string().optional(),
+      // …and the tell that `peerFrom` is ONLY that subagent_type — that the parser could not resolve the
+      // dispatch's own description for this sender. It matters because a profile cell is not a name: every
+      // child dispatched at `frizz:opus-high` reports under the identical string, so a divider reading
+      // «frizz:opus-high» names the MODEL, not the work, and two siblings are indistinguishable
+      // (maintainer 2026-08-06: "I'm also still occasionally seeing things like 'Agent <OPUS:HIGH>
+      // rested'"). The client renders an unnamed sender as "Sub-agent reported" and keeps the cell in the
+      // tooltip, rather than promoting a profile to a title.
+      //
+      // Resolution is genuinely late-arriving, not merely missing: the description comes from the DISPATCH
+      // record, so a report rendered while the window has not yet reached that record is unnamed and gains
+      // its title once it has. Set only on the Claude path — a codex peer names a real task.
+      peerUnnamed: external_exports.literal(true).optional(),
+      // The sender's own RUNTIME agent id (`origin.senderTaskId`) — kept so a LATER pass can finish the job
+      // the fold could not. The paged transcript RPC folds a bounded window, so a report whose dispatch
+      // scrolled above the page start has no description available at fold time; the tailer still holds the
+      // pairing, and `projectTranscriptPeerNames` uses this id to ask it. Never a drawer key on its own —
+      // that is `peerDispatchId`, which the same pass can also supply once this resolves.
+      peerSenderTaskId: external_exports.string().optional()
     });
     TranscriptPageCursor = external_exports.string().min(1).max(2048).regex(/^[A-Za-z0-9_-]+$/);
     TranscriptPage = external_exports.object({
@@ -7872,12 +7871,240 @@ ${DISPATCH_TASK_BANNER}
       external_exports.object({ t: external_exports.literal("sub"), topic: external_exports.literal("transcript"), slug: SocketTranscriptSlug }).strict(),
       external_exports.object({ t: external_exports.literal("unsub"), topic: external_exports.literal("transcript"), slug: SocketTranscriptSlug }).strict()
     ]);
-    DEFAULT_PORT = 4917;
+    ProjectCard = external_exports.object({
+      id: external_exports.string(),
+      slug: external_exports.string(),
+      name: external_exports.string(),
+      path: external_exports.string(),
+      lastOpenedAt: external_exports.string(),
+      /** The directory is gone — moved or deleted. The card stays so it can be reopened or forgotten. */
+      stale: external_exports.boolean(),
+      /**
+       * When this project's icon was last established, or absent if it never has been.
+       *
+       * Carried purely so the client can hang it off the `/_frizz/project-icon` URL: the icon bytes are
+       * cached hard (a rail of forty squares is forty requests, and none of them should recur), which
+       * means a newly uploaded icon would otherwise stay invisible behind the cached old one. A changed
+       * version is a changed URL, so the swap is immediate without weakening the caching for everyone.
+       *
+       * Deliberately NOT "does this project have an icon". Answering that for a project nobody has
+       * scanned yet would mean scanning it, and this list is one file read on purpose.
+       */
+      iconVersion: external_exports.string().optional(),
+      /**
+       * Whether this project HAS an icon — and crucially, whether we have even looked.
+       *
+       * Three states, not a boolean, because the two "no icon to draw right now" cases must behave
+       * differently and a boolean collapses them:
+       *   · `icon`    — one is stored; draw it.
+       *   · `none`    — scanned, nothing found. Draw the monogram and DO NOT request the icon route,
+       *                 which is what stops an iconless project flashing its initials and then swapping.
+       *   · `unknown` — never scanned. The monogram shows, but the request MUST still go out, because
+       *                 that request is what triggers the (lazy, cached) scan in the first place.
+       *
+       * Collapsing `unknown` into `none` deadlocks the whole feature: no image element is rendered, so
+       * the icon route is never called, so the scan never runs, so the project stays `unknown` forever.
+       * Measured 2026-08-06 — a rail of 29 projects had scanned exactly ONE, and only because a probe
+       * had fetched that one's URL by hand.
+       */
+      iconStatus: external_exports.enum(["icon", "none", "unknown"]),
+      /** An operator's uploaded icon, rather than one the scan found. Drives what the menu offers. */
+      iconIsCustom: external_exports.boolean().optional()
+    });
+    PROJECT_ICON_MAX_BASE64_CHARS = 4 * 1024 * 1024;
+    DirectoryPickResult = external_exports.discriminatedUnion("kind", [
+      external_exports.object({ kind: external_exports.literal("picked"), project: ProjectCard }),
+      external_exports.object({ kind: external_exports.literal("cancelled") }),
+      external_exports.object({ kind: external_exports.literal("unavailable"), reason: external_exports.string() })
+    ]);
+    ThreadLocation = external_exports.object({ projectSlug: external_exports.string(), projectName: external_exports.string() });
+    FRIZZ_ROUTE_PREFIX = "/_frizz";
+    DEFAULT_PORT = 9393;
+  }
+});
+
+// packages/server/src/project-registry.ts
+import { closeSync as closeSync4, existsSync as existsSync3, fsyncSync as fsyncSync4, mkdirSync as mkdirSync6, openSync as openSync5, readFileSync as readFileSync6, readdirSync as readdirSync2, realpathSync as realpathSync3, renameSync as renameSync5, rmSync as rmSync6, writeFileSync as writeFileSync6 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
+import { basename as basename4, dirname as dirname6, join as join8 } from "node:path";
+function registryPath(home = homedir6()) {
+  return join8(frizzPaths({ home }).data, "registry.json");
+}
+function readRegistry(home = homedir6()) {
+  let raw;
+  try {
+    raw = readFileSync6(registryPath(home), "utf8");
+  } catch {
+    return { ...EMPTY, projects: [] };
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed?.version !== 1 || !Array.isArray(parsed.projects)) return { ...EMPTY, projects: [] };
+    return {
+      version: 1,
+      projects: parsed.projects.filter(
+        (p) => p && typeof p.id === "string" && typeof p.path === "string" && typeof p.slug === "string"
+      )
+    };
+  } catch {
+    return { ...EMPTY, projects: [] };
+  }
+}
+function writeRegistry(registry, home = homedir6()) {
+  const path = registryPath(home);
+  mkdirSync6(dirname6(path), { recursive: true });
+  const temp = `${path}.${process.pid}.tmp`;
+  let fd;
+  try {
+    fd = openSync5(temp, "w", 384);
+    writeFileSync6(fd, `${JSON.stringify(registry, null, 2)}
+`, "utf8");
+    fsyncSync4(fd);
+    closeSync4(fd);
+    fd = void 0;
+    renameSync5(temp, path);
+  } catch (error) {
+    if (fd !== void 0) {
+      try {
+        closeSync4(fd);
+      } catch {
+      }
+    }
+    try {
+      rmSync6(temp, { force: true });
+    } catch {
+    }
+    throw error;
+  }
+}
+function slugifyProject(value) {
+  const s = slugify(value);
+  return s === "thread" ? "project" : s;
+}
+function deriveSlug(dir, taken, options2 = {}) {
+  const base = slugifyProject(basename4(dir));
+  const parent = slugifyProject(basename4(dirname6(dir)));
+  const qualified = GENERIC.has(base) && parent ? `${parent}-${base}` : base;
+  const candidates = [
+    qualified,
+    ...options2.remoteOwner ? [`${slugifyProject(options2.remoteOwner)}-${base}`] : [],
+    ...parent && parent !== qualified ? [`${parent}-${base}`] : []
+  ];
+  for (const candidate of candidates) {
+    if (candidate && !taken.has(candidate) && !RESERVED.has(candidate)) return candidate;
+  }
+  const root = candidates[0] || "project";
+  for (let n = 2; ; n++) {
+    const candidate = `${root}-${n}`;
+    if (!taken.has(candidate) && !RESERVED.has(candidate)) return candidate;
+  }
+}
+function canonicalPath(dir) {
+  try {
+    return realpathSync3(dir);
+  } catch {
+    return dir;
+  }
+}
+function registerProject(input, home = homedir6()) {
+  input = { ...input, dir: canonicalPath(input.dir) };
+  const registry = readRegistry(home);
+  const at = (input.now ?? (() => /* @__PURE__ */ new Date()))().toISOString();
+  const byId = registry.projects.find((p) => p.id === input.id);
+  if (byId) {
+    if (byId.path === input.dir) {
+      byId.lastOpenedAt = at;
+      writeRegistry(registry, home);
+      return { entry: byId, action: "reopened" };
+    }
+    if (existsSync3(join8(byId.path, ".frizz", ".id"))) return { action: "duplicate" };
+    byId.path = input.dir;
+    byId.lastOpenedAt = at;
+    writeRegistry(registry, home);
+    return { entry: byId, action: "moved" };
+  }
+  const byPath = registry.projects.find((p) => p.path === input.dir);
+  if (byPath) {
+    byPath.id = input.id;
+    byPath.lastOpenedAt = at;
+    writeRegistry(registry, home);
+    return { entry: byPath, action: "rekeyed" };
+  }
+  const taken = new Set(registry.projects.map((p) => p.slug));
+  const entry = {
+    id: input.id,
+    path: input.dir,
+    slug: deriveSlug(input.dir, taken, { remoteOwner: input.remoteOwner }),
+    lastOpenedAt: at
+  };
+  registry.projects.push(entry);
+  writeRegistry(registry, home);
+  return { entry, action: "created" };
+}
+function listProjects(home = homedir6()) {
+  const byRecency = (a, b) => a.lastOpenedAt < b.lastOpenedAt ? 1 : a.lastOpenedAt > b.lastOpenedAt ? -1 : 0;
+  return readRegistry(home).projects.map((p) => ({ ...p, stale: !existsSync3(p.path) })).sort((a, b) => {
+    if (a.order === void 0 && b.order === void 0) return byRecency(a, b);
+    if (a.order === void 0) return 1;
+    if (b.order === void 0) return -1;
+    return a.order - b.order;
+  });
+}
+function findByPath(path, home = homedir6()) {
+  const canonical = canonicalPath(path);
+  return readRegistry(home).projects.find((p) => p.path === canonical || p.path === path);
+}
+var EMPTY, GENERIC, RESERVED;
+var init_project_registry = __esm({
+  "packages/server/src/project-registry.ts"() {
+    "use strict";
+    init_src();
+    init_frizz_paths();
+    init_project_root();
+    EMPTY = { version: 1, projects: [] };
+    GENERIC = /* @__PURE__ */ new Set([
+      "app",
+      "src",
+      "web",
+      "www",
+      "main",
+      "repo",
+      "code",
+      "server",
+      "client",
+      "packages",
+      "site",
+      "scratch",
+      "tmp",
+      "test"
+    ]);
+    RESERVED = /* @__PURE__ */ new Set([
+      "_frizz",
+      "rpc",
+      "events",
+      "ws",
+      "term",
+      "attach",
+      "local-image",
+      "local-visualization",
+      // `control` answers `/control/stop` and `/control/status` — the supervisor channel the board polls
+      // every few seconds. It was missing from this list, so a directory called `control` could have taken
+      // the segment and routed the whole machine's supervisor polling into one project's app, which has no
+      // such route. Only newly minted slugs consult this, so adding it strands nothing already registered.
+      "control",
+      "project-icon",
+      "assets",
+      "favicon",
+      "manifest",
+      "index",
+      "api",
+      "health"
+    ]);
   }
 });
 
 // packages/server/src/local-image.ts
-import { readFileSync as readFileSync7, realpathSync as realpathSync4, statSync as statSync4 } from "node:fs";
+import { readFileSync as readFileSync8, realpathSync as realpathSync5, statSync as statSync4 } from "node:fs";
 import { extname, isAbsolute as isAbsolute2 } from "node:path";
 function resolveLocalImage(rawPath) {
   if (!rawPath || !isAbsolute2(rawPath)) return { status: 400 };
@@ -7885,13 +8112,13 @@ function resolveLocalImage(rawPath) {
   if (!contentType) return { status: 400 };
   let real;
   try {
-    real = realpathSync4(rawPath);
+    real = realpathSync5(rawPath);
   } catch {
     return { status: 404 };
   }
   try {
     if (!statSync4(real).isFile()) return { status: 404 };
-    return { status: 200, contentType, body: readFileSync7(real) };
+    return { status: 200, contentType, body: readFileSync8(real) };
   } catch {
     return { status: 404 };
   }
@@ -7911,7 +8138,8 @@ var init_local_image = __esm({
 });
 
 // src/production.ts
-import { readFileSync as readFileSync9 } from "node:fs";
+init_local_origin();
+import { readFileSync as readFileSync10 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { join as join11 } from "node:path";
@@ -8076,12 +8304,12 @@ function manifestIdFor(url) {
   return url.endsWith("/") ? url : `${url}/`;
 }
 function execFileP(cmd, args2) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve5, reject) => {
     execFile(
       cmd,
       args2,
       { encoding: "utf8", timeout: 1e4 },
-      (err, stdout) => err ? reject(err) : resolve6(stdout)
+      (err, stdout) => err ? reject(err) : resolve5(stdout)
     );
   });
 }
@@ -8160,9 +8388,9 @@ function openCdpSession(browserPath, dataPath) {
   cmdPipe.on("error", failAll);
   resPipe.on("error", failAll);
   child.on("exit", () => failAll(new Error("chrome exited before the CDP handshake completed")));
-  const call = (method, params = {}, timeoutMs = 2e4) => new Promise((resolve6, reject) => {
+  const call = (method, params = {}, timeoutMs = 2e4) => new Promise((resolve5, reject) => {
     const id = ++seq;
-    pending.set(id, { resolve: resolve6, reject });
+    pending.set(id, { resolve: resolve5, reject });
     cmdPipe.write(JSON.stringify({ id, method, params }) + "\0");
     setTimeout(() => {
       if (pending.has(id)) {
@@ -8175,15 +8403,15 @@ function openCdpSession(browserPath, dataPath) {
     await call("Browser.close").catch(() => {
     });
     if (child.exitCode !== null || child.signalCode !== null) return;
-    await new Promise((resolve6) => {
+    await new Promise((resolve5) => {
       const t = setTimeout(() => {
         child.kill();
-        resolve6();
+        resolve5();
       }, 1e4);
       t.unref();
       child.once("exit", () => {
         clearTimeout(t);
-        resolve6();
+        resolve5();
       });
     });
   };
@@ -8585,6 +8813,7 @@ ${SYNC_END}`);
       }),
       // Yellow, above the dim hint: exposing the board off loopback is the one launch outcome the
       // operator must not skim past, so it may not share the hint's low-contrast styling.
+      ...options2.qr?.length ? ["", ...options2.qr.map((row) => `  ${row}`)] : [],
       ...options2.warning ? ["", `  ${this.c(ANSI.yellow, options2.warning)}`] : [],
       ...hint ? ["", `  ${this.c(ANSI.dim, hint)}`] : [],
       ""
@@ -8661,15 +8890,15 @@ init_project_launch();
 init_local_origin();
 init_boot_progress();
 init_frizz_paths();
-init_migrate_fray();
 init_project_root();
 init_logging();
 init_src();
-import { execFileSync as execFileSync4 } from "node:child_process";
+init_project_registry();
+import { execFileSync as execFileSync3 } from "node:child_process";
 import { createServer } from "node:net";
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync6, realpathSync as realpathSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync7, realpathSync as realpathSync4, writeFileSync as writeFileSync7 } from "node:fs";
 import { homedir as homedir7, networkInterfaces } from "node:os";
-import { basename as basename4, join as join9, resolve as resolve4 } from "node:path";
+import { basename as basename5, join as join9, resolve as resolve3 } from "node:path";
 import { setTimeout as delay2 } from "node:timers/promises";
 var PORT_SCAN_COUNT = 100;
 var LAUNCH_TIMEOUT_MS = 3e4;
@@ -8761,6 +8990,7 @@ function parseCliArgs(argv) {
     "--detach",
     "--stop",
     "--status",
+    "--link",
     "--help",
     "-h",
     "--dev",
@@ -8792,6 +9022,7 @@ function parseCliArgs(argv) {
     // Retain the option in the parsed shape for callers, but normal frizz-dev is always attached.
     foreground: true,
     stop: args2.has("--stop"),
+    link: args2.has("--link"),
     status: args2.has("--status"),
     help: args2.has("--help") || args2.has("-h"),
     dev: args2.has("--dev"),
@@ -8804,6 +9035,7 @@ function parseCliArgs(argv) {
   };
 }
 var EXPOSED_WARNING = "Anyone who can reach this address can run commands on this machine as you. Frizz has no login \u2014 only do this on a network you trust.";
+var REUSED_NETWORK_FLAGS_WARNING = "This joined the Frizz already running on this machine, so --host/--public-origin were ignored. Stop it first (frizz --stop) and relaunch with the flag to change how the board is reached.";
 var PUBLIC_ORIGIN_WARNING = "Frizz has no login of its own, so whatever sits in front of this origin IS the access control. Require authentication there (Cloudflare Access, Tailscale) \u2014 an unauthenticated tunnel lets anyone with the URL run commands on this machine as you.";
 function resolveBindSelection(options2, env = process.env) {
   const fromEnv = env.FRIZZ_HOST?.trim();
@@ -8814,7 +9046,17 @@ function resolveBindSelection(options2, env = process.env) {
   ]);
   const publicOriginRaw = options2.publicOrigin ?? env.FRIZZ_PUBLIC_ORIGIN?.trim();
   const publicOrigin = publicOriginRaw ? normalizePublicOrigin(publicOriginRaw) : void 0;
-  return { host, exposed: bindHostIsExposed(host), allowedHosts, ...publicOrigin ? { publicOrigin } : {} };
+  const publicToken = publicOrigin ? env.FRIZZ_PUBLIC_TOKEN?.trim() || void 0 : void 0;
+  return {
+    host,
+    exposed: bindHostIsExposed(host),
+    allowedHosts,
+    ...publicOrigin ? { publicOrigin } : {},
+    ...publicToken ? { publicToken } : {}
+  };
+}
+function boardAddress(url) {
+  return url.includes("?") || url.endsWith("/") ? url : `${url}/`;
 }
 function networkUrls(port, host, interfaces = networkInterfaces) {
   if (!bindHostIsExposed(host)) return [];
@@ -8837,10 +9079,30 @@ function networkUrls(port, host, interfaces = networkInterfaces) {
   }
   return urls;
 }
-function resolveWorkspace(cwd = process.cwd(), home = homedir7(), env = process.env, { migrate = false } = {}) {
+function resolveLaunchIntent(cwd = process.cwd(), home = homedir7(), env = process.env) {
+  const candidate = realpathSync4(discoverProjectRoot(cwd, home));
+  const known = isExistingProjectRoot(candidate) || findByPath(candidate, home) !== void 0;
+  if ((known || hasProjectMarker(candidate)) && !isHomeDirectory(candidate, home))
+    return { kind: "open", workspace: resolveWorkspace(cwd, home, env) };
+  const host = mostRecentProject(home, env);
+  const reason = isHomeDirectory(candidate, home) ? "home" : "unadopted";
+  if (!host) return { kind: "empty", directory: candidate, reason };
+  return reason === "home" ? { kind: "grid", workspace: host } : { kind: "offer", workspace: host, directory: candidate };
+}
+function mostRecentProject(home, env) {
+  for (const entry of listProjects(home)) {
+    if (entry.stale || isHomeDirectory(entry.path, home)) continue;
+    try {
+      return resolveWorkspace(entry.path, home, env);
+    } catch {
+    }
+  }
+  return void 0;
+}
+function resolveWorkspace(cwd = process.cwd(), home = homedir7(), env = process.env) {
   let gitRoot;
   try {
-    gitRoot = execFileSync4("git", ["rev-parse", "--show-toplevel"], {
+    gitRoot = execFileSync3("git", ["rev-parse", "--show-toplevel"], {
       cwd,
       encoding: "utf8",
       // stderr is CAPTURED, not ignored: it is the only thing that distinguishes "no worktree here"
@@ -8851,15 +9113,12 @@ function resolveWorkspace(cwd = process.cwd(), home = homedir7(), env = process.
     if (!isNotAGitWorktree(error)) throw new Error("unable to resolve Git repository root");
     gitRoot = void 0;
   }
-  if (migrate) migrateFrayGlobalRoots({ env, home });
-  const root0 = realpathSync3(gitRoot ?? discoverProjectRoot(cwd, home));
-  if (migrate) migrateFrayProjectId(root0, { home });
+  const root0 = realpathSync4(gitRoot ?? discoverProjectRoot(cwd, home));
   const identity = gitRoot ? resolveGitProjectIdentity(root0, home) : void 0;
   const root = identity?.root ?? root0;
-  if (migrate) migrateFrayProjectDir(root);
   const id = ensureProjectIdFile(root, home, identity?.id);
   const stateDir = projectStateDir(id, home);
-  mkdirSync6(stateDir, { recursive: true });
+  mkdirSync7(stateDir, { recursive: true });
   const target2 = {
     projectId: id,
     projectDir: root,
@@ -8870,7 +9129,7 @@ function resolveWorkspace(cwd = process.cwd(), home = homedir7(), env = process.
     root,
     id,
     stateDir,
-    name: basename4(root),
+    name: basename5(root),
     identityScope: identity?.scope ?? "repository"
   };
 }
@@ -8885,7 +9144,7 @@ function workspaceLaunchTarget(workspace2) {
 function workspaceFromLaunchTarget(target2, env = process.env) {
   let root;
   try {
-    root = realpathSync3(target2.projectDir);
+    root = realpathSync4(target2.projectDir);
   } catch {
     throw new Error("pinned Frizz workspace is no longer available");
   }
@@ -8895,14 +9154,14 @@ function workspaceFromLaunchTarget(target2, env = process.env) {
     root,
     id: target2.projectId,
     stateDir: target2.stateDir,
-    name: basename4(root),
+    name: basename5(root),
     identityScope: target2.identityScope === "worktree" ? "worktree" : "repository"
   };
 }
 function parseStatusFile(path, authoritative, expected2, adapter = defaultProcessPlatformAdapter) {
   try {
     const value = JSON.parse(
-      readFileSync6(path, "utf8")
+      readFileSync7(path, "utf8")
     );
     if (!Number.isInteger(value.pid) || value.pid <= 0 || !Number.isInteger(value.port) || value.port < 1 || value.port > 65535)
       return null;
@@ -8944,19 +9203,21 @@ function liveWorkspaceOwner(stateDir, expected2, adapter = defaultProcessPlatfor
 function readPreferredPort(stateDir) {
   try {
     const value = JSON.parse(
-      readFileSync6(join9(stateDir, "launcher.json"), "utf8")
+      readFileSync7(join9(stateDir, "launcher.json"), "utf8")
     );
     return Number.isInteger(value.port) && value.port > 0 && value.port <= 65535 ? value.port : void 0;
   } catch {
     return void 0;
   }
 }
-async function probeFrizz(port, expected2, fetcher = fetch) {
+var HEALTH_PROBE_TIMEOUT_MS = 1e3;
+async function probeFrizz(port, expected2, fetcher = fetch, timeoutMs = HEALTH_PROBE_TIMEOUT_MS) {
   const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 1e3);
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
   timeout.unref?.();
   try {
-    const response = await fetcher(`http://127.0.0.1:${port}/health`, {
+    const scope = expected2.slug ? `${FRIZZ_ROUTE_PREFIX}/${expected2.slug}` : FRIZZ_ROUTE_PREFIX;
+    const response = await fetcher(`http://127.0.0.1:${port}${scope}/health`, {
       signal: controller.signal
     });
     if (!response.ok) return null;
@@ -8981,26 +9242,36 @@ function expectedOwnerHealth(target2, owner) {
     ...owner ? { ownerProof: projectLaunchTokenProof(target2, owner.token) } : {}
   };
 }
-async function canBindPort(port, host = LOOPBACK_BIND_HOST) {
-  const bind2 = (candidate) => new Promise((resolveBind) => {
+async function probeBindPort(port, host = LOOPBACK_BIND_HOST) {
+  return new Promise((resolveBind) => {
     const server = createServer();
     server.unref();
-    server.once("error", () => resolveBind(false));
-    server.listen(candidate, host, () => server.close(() => resolveBind(true)));
+    server.once(
+      "error",
+      (error) => resolveBind(error.code ?? "EADDRINUSE")
+    );
+    server.listen(port, host, () => server.close(() => resolveBind(void 0)));
   });
-  return bind2(port);
 }
-function portCandidates(preferred) {
+async function canBindPort(port, host = LOOPBACK_BIND_HOST) {
+  return await probeBindPort(port, host) === void 0;
+}
+function portUnavailableMessage(port, code) {
+  if (code === "EACCES" || code === "EPERM")
+    return `port ${port} is reserved by the system, not held by a process (bind returned ${code}); on Windows list the reservations with: netsh int ipv4 show excludedportrange protocol=tcp`;
+  return `port ${port} is already in use`;
+}
+function portCandidates(preferred, base = DEFAULT_PORT) {
+  const fallback = fallbackPort(base);
   return [
+    base,
     preferred,
-    ...Array.from(
-      { length: PORT_SCAN_COUNT },
-      (_, index) => DEFAULT_PORT + index
-    )
+    ...Array.from({ length: PORT_SCAN_COUNT }, (_, index) => fallback + index)
   ].filter((port) => !!port && port <= 65535);
 }
-function noFreePortMessage() {
-  return `no free Frizz development port found in ${DEFAULT_PORT}-${DEFAULT_PORT + PORT_SCAN_COUNT - 1}`;
+function noFreePortMessage(base = DEFAULT_PORT) {
+  const fallback = fallbackPort(base);
+  return `no free Frizz port: ${base} is taken, and so is every port in ${fallback}-${fallback + PORT_SCAN_COUNT - 1}`;
 }
 async function allocatePort(explicit, preferred, options2 = {}) {
   const host = options2.host ?? LOOPBACK_BIND_HOST;
@@ -9015,14 +9286,17 @@ async function allocatePort(explicit, preferred, options2 = {}) {
   };
   if (explicit !== void 0) {
     const allocated = await claim(explicit);
-    if (!allocated) throw new Error(`port ${explicit} is already in use`);
+    if (!allocated)
+      throw new Error(
+        portUnavailableMessage(explicit, await probeBindPort(explicit, host))
+      );
     return allocated;
   }
-  for (const port of portCandidates(preferred)) {
+  for (const port of portCandidates(preferred, options2.base)) {
     const allocated = await claim(port);
     if (allocated) return allocated;
   }
-  throw new Error(noFreePortMessage());
+  throw new Error(noFreePortMessage(options2.base));
 }
 async function waitForWorkspace(port, expected2, timeoutMs = LAUNCH_TIMEOUT_MS, options2 = {}) {
   const started = Date.now();
@@ -9059,21 +9333,135 @@ init_project_launch();
 init_project_launch();
 import { fork } from "node:child_process";
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { existsSync as existsSync4, mkdirSync as mkdirSync7, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync8, readFileSync as readFileSync9 } from "node:fs";
 import { createServer as createNetServer } from "node:net";
-import { basename as basename5, dirname as dirname5, extname as extname2, isAbsolute as isAbsolute3, relative, resolve as resolve5, sep as sep2 } from "node:path";
+import { basename as basename6, dirname as dirname7, extname as extname2, isAbsolute as isAbsolute3, relative, resolve as resolve4, sep as sep2 } from "node:path";
 import { fileURLToPath } from "node:url";
 import watcher from "@parcel/watcher";
 
 // packages/server/src/restart-supervisor.ts
-init_local_origin();
-init_local_image();
 import { request as requestHttp, createServer as createServer2 } from "node:http";
 import { connect } from "node:net";
+
+// packages/server/src/access-codes.ts
+import { randomBytes, timingSafeEqual, createHmac } from "node:crypto";
+var CODE_BYTES = 16;
+var SESSION_BYTES = 32;
+var DEFAULT_CODE_TTL_MS = 5 * 6e4;
+var DEFAULT_SESSION_TTL_MS = 365 * 24 * 60 * 6e4;
+function defaultRandomToken(bytes) {
+  return randomBytes(bytes).toString("base64url");
+}
+function secretsMatch(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+var AccessStore = class {
+  codes = /* @__PURE__ */ new Map();
+  options;
+  /** Signing key for sessions. Persisted by the caller; a fresh one signs every device out. */
+  signingKey;
+  constructor(options2 = {}) {
+    this.signingKey = options2.signingKey ?? randomBytes(32);
+    this.options = {
+      codeTtlMs: options2.codeTtlMs ?? DEFAULT_CODE_TTL_MS,
+      sessionTtlMs: options2.sessionTtlMs ?? DEFAULT_SESSION_TTL_MS,
+      now: options2.now ?? Date.now,
+      randomToken: options2.randomToken ?? defaultRandomToken,
+      onConsumed: options2.onConsumed
+    };
+  }
+  /** Mint a code to show as a QR or a link. Minting does not invalidate codes already outstanding. */
+  issue() {
+    this.sweep();
+    const now = this.options.now();
+    const code = {
+      code: this.options.randomToken(CODE_BYTES),
+      createdAt: now,
+      expiresAt: now + this.options.codeTtlMs
+    };
+    this.codes.set(code.code, code);
+    return { code: code.code, createdAt: code.createdAt, expiresAt: code.expiresAt };
+  }
+  /**
+   * Trade a code for a session, at most once, ever.
+   *
+   * The consumed marker is set BEFORE anything else can observe success, and JS runs this method to
+   * completion without interleaving, so two browsers racing the same code cannot both win. That
+   * atomicity is what makes "single-use" true rather than aspirational — it is the first thing the
+   * tests attack.
+   */
+  redeem(code) {
+    if (!code) return { ok: false, reason: "unknown" };
+    const stored = this.codes.get(code);
+    if (!stored || !secretsMatch(stored.code, code)) return { ok: false, reason: "unknown" };
+    const now = this.options.now();
+    if (stored.consumedAt !== void 0) return { ok: false, reason: "already-used" };
+    if (now >= stored.expiresAt) {
+      this.sweep();
+      return { ok: false, reason: "expired" };
+    }
+    stored.consumedAt = now;
+    this.sweep();
+    this.options.onConsumed?.(code);
+    return { ok: true, session: this.mintSession(now), expiresAt: now + this.options.sessionTtlMs };
+  }
+  /**
+   * A session is `<expiry>.<hmac>` — stateless, so it needs no server-side table, and signed with a key
+   * the caller persists so it survives a restart. Self-describing expiry means a stale cookie is
+   * rejected without a lookup, and rotating the key revokes every outstanding session at once.
+   */
+  mintSession(now) {
+    const expiresAt = now + this.options.sessionTtlMs;
+    const nonce = this.options.randomToken(SESSION_BYTES);
+    const payload = `${expiresAt}.${nonce}`;
+    return `${payload}.${this.sign(payload)}`;
+  }
+  sign(payload) {
+    return createHmac("sha256", this.signingKey).update(payload).digest("base64url");
+  }
+  /** Is this cookie a session signed by this board's key, and still in date? */
+  verifySession(session) {
+    if (!session) return false;
+    const cut = session.lastIndexOf(".");
+    if (cut <= 0) return false;
+    const payload = session.slice(0, cut);
+    const signature = session.slice(cut + 1);
+    if (!secretsMatch(signature, this.sign(payload))) return false;
+    const expiresAt = Number(payload.slice(0, payload.indexOf(".")));
+    return Number.isFinite(expiresAt) && this.options.now() < expiresAt;
+  }
+  /**
+   * Drop codes past their expiry so a long-lived board does not accumulate them forever.
+   *
+   * A CONSUMED code is deliberately kept until that same expiry rather than deleted on use. Deleting it
+   * immediately would make a replay indistinguishable from a typo — both "unknown" — and the difference
+   * matters: "already-used" is the message that tells someone their link was used by somebody else.
+   * It costs one small entry for at most the code TTL.
+   */
+  sweep() {
+    const now = this.options.now();
+    for (const [key, stored] of this.codes) {
+      if (now >= stored.expiresAt) this.codes.delete(key);
+    }
+  }
+  /** Outstanding codes that could still be redeemed — neither consumed nor expired. */
+  outstanding() {
+    this.sweep();
+    return [...this.codes.values()].filter((stored) => stored.consumedAt === void 0).map(({ code, createdAt, expiresAt }) => ({ code, createdAt, expiresAt }));
+  }
+};
+
+// packages/server/src/restart-supervisor.ts
+init_local_origin();
+init_local_image();
+init_src();
 var SUPERVISOR_CONTROL_PREFIX = "/_frizz/control";
 var SUPERVISOR_RESTART_PATH = `${SUPERVISOR_CONTROL_PREFIX}/restart`;
 var SUPERVISOR_UPDATE_RESTART_PATH = `${SUPERVISOR_CONTROL_PREFIX}/update-restart`;
 var SUPERVISOR_STATUS_PATH = `${SUPERVISOR_CONTROL_PREFIX}/status`;
+var SUPERVISOR_ACCESS_CODE_PATH = `${SUPERVISOR_CONTROL_PREFIX}/access-code`;
 var SUPERVISOR_CONTROL_PROTOCOL = 1;
 function responseJson(res, status, value) {
   res.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" });
@@ -9092,13 +9480,34 @@ function proxyHeaders(req, childPort, vouchSameOrigin = false) {
   delete headers.connection;
   return headers;
 }
+var PUBLIC_TOKEN_PARAM = "frizz_token";
+var ACCESS_CODE_PARAM = "frizz_code";
+var PUBLIC_TOKEN_COOKIE = "frizz_public";
+var SESSION_COOKIE = "frizz_session";
+var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+function readCookie(header, name) {
+  if (!header) return void 0;
+  for (const pair of header.split(";")) {
+    const eq = pair.indexOf("=");
+    if (eq === -1) continue;
+    if (pair.slice(0, eq).trim() === name) return pair.slice(eq + 1).trim();
+  }
+  return void 0;
+}
+function unauthorizedPage(reason) {
+  const detail = reason === "already-used" ? "That link has already been used. Generate a fresh one." : reason === "expired" ? "That link expired. Generate a fresh one." : "This address needs a current access link.";
+  return `<!doctype html><meta charset="utf-8"><title>Unauthorized</title><meta name="viewport" content="width=device-width,initial-scale=1"><style>body{margin:3rem;font:16px system-ui;color:#e7e7e7;background:#171717}main{max-width:30rem;padding:1.5rem;border:1px solid #444;border-radius:.75rem;background:#222}</style><main><h1>Unauthorized</h1>${detail ? `<p>${detail}</p>` : ""}</main>`;
+}
 function isControlRequest(req) {
   const url = new URL(req.url ?? "/", "http://frizz.invalid");
-  return url.pathname === SUPERVISOR_RESTART_PATH || url.pathname === SUPERVISOR_UPDATE_RESTART_PATH || url.pathname === SUPERVISOR_STATUS_PATH;
+  return url.pathname === SUPERVISOR_RESTART_PATH || url.pathname === SUPERVISOR_UPDATE_RESTART_PATH || url.pathname === SUPERVISOR_STATUS_PATH || url.pathname === SUPERVISOR_ACCESS_CODE_PATH;
 }
 function isLocalImageRequest(req) {
-  return (req.method === "GET" || req.method === "HEAD") && new URL(req.url ?? "/", "http://frizz.invalid").pathname === "/local-image";
+  if (req.method !== "GET" && req.method !== "HEAD") return false;
+  const { pathname } = new URL(req.url ?? "/", "http://frizz.invalid");
+  return LOCAL_IMAGE_PATH.test(pathname);
 }
+var LOCAL_IMAGE_PATH = new RegExp(`^${FRIZZ_ROUTE_PREFIX}(?:/[^/]+)?/local-image$`);
 var RestartSupervisorProxy = class {
   server = null;
   restartInFlight = null;
@@ -9113,17 +9522,40 @@ var RestartSupervisorProxy = class {
    * judged here first.
    */
   policy;
+  /**
+   * Codes and sessions for the public origin, or null when no public origin is declared (loopback-only
+   * boards are never gated, so there is nothing to store).
+   */
+  access;
   /** Both halves of every live upgraded pair, so close() can actually finish. See close(). */
   upgradedSockets = /* @__PURE__ */ new Set();
   constructor(options2) {
     this.options = options2;
     this.host = options2.host ?? LOOPBACK_BIND_HOST;
+    this.access = options2.publicOrigin ? new AccessStore({
+      onConsumed: () => options2.onCodeConsumed?.(),
+      ...options2.sessionKey ? { signingKey: options2.sessionKey } : {}
+    }) : null;
     this.policy = {
       exposed: bindHostIsExposed(this.host),
       allowedHosts: options2.allowedHosts ?? [],
       ...options2.publicOrigin ? { publicOrigin: options2.publicOrigin } : {}
     };
   }
+  /**
+   * Mint a single-use code for this board, or null when no public origin is declared.
+   *
+   * Issuing does NOT invalidate codes already outstanding — pressing the key twice, or two people
+   * asking at once, must not silently break the first QR somebody is still walking towards.
+   */
+  issueAccessCode() {
+    return this.access?.issue() ?? null;
+  }
+  /** The full URL to show as a link or a QR. */
+  accessUrl(code) {
+    const origin = this.options.publicOrigin;
+    return origin ? `${origin}/?${ACCESS_CODE_PARAM}=${encodeURIComponent(code)}` : null;
+  }
   async listen() {
     if (this.server) return;
     const server = createServer2((req, res) => this.handle(req, res));
@@ -9237,6 +9669,26 @@ var RestartSupervisorProxy = class {
       res.end("Forbidden");
       return;
     }
+    if (pathname === SUPERVISOR_ACCESS_CODE_PATH) {
+      if (this.arrivedPublicly(req)) {
+        res.writeHead(403);
+        res.end("Forbidden");
+        return;
+      }
+      if (req.method !== "POST") {
+        res.writeHead(405, { allow: "POST" });
+        res.end();
+        return;
+      }
+      const link = this.issueAccessCode();
+      const url = link && this.accessUrl(link.code);
+      if (!link || !url) {
+        responseJson(res, 409, { error: "this board has no public origin, so there is nothing to link to" });
+        return;
+      }
+      responseJson(res, 200, { url, expiresAt: link.expiresAt });
+      return;
+    }
     if (pathname === SUPERVISOR_STATUS_PATH && req.method === "GET") {
       responseJson(res, 200, { protocol: SUPERVISOR_CONTROL_PROTOCOL, ...this.status() });
       return;
@@ -9286,11 +9738,93 @@ var RestartSupervisorProxy = class {
     });
     res.end(req.method === "HEAD" ? void 0 : result.body);
   }
+  /**
+   * Is this request arriving as the declared public origin rather than over loopback?
+   *
+   * The token gate keys on this and not on "is the port exposed", because the two are independent:
+   * a tunnelled board stays bound to 127.0.0.1 while being reachable from the internet by name.
+   */
+  arrivedPublicly(req) {
+    const declared = this.options.publicOrigin;
+    if (!declared) return false;
+    const host = parseLocalHost(req.headers.host, this.options.port, this.policy);
+    return !!host && !LOOPBACK_HOSTNAMES.has(host.hostname);
+  }
+  /**
+   * Bearer check for the public origin. Two ways in: the cookie the exchange below sets, or the
+   * one-time `?frizz_token=` in the URL the operator was handed at launch.
+   *
+   * Compared with `timingSafeEqual` on equal-length buffers — a plain `===` on a secret leaks its
+   * prefix to a patient attacker, and this secret is the only thing between the internet and a shell.
+   */
+  /**
+   * Is this request carrying a session this process minted?
+   *
+   * Sessions only. A raw `?frizz_code=` is NOT accepted here — it is redeemed once by exchangeCode()
+   * below and traded for a session, so a code that has already been spent cannot keep working just by
+   * staying in somebody's URL bar.
+   */
+  sessionAccepted(req) {
+    if (!this.access) return true;
+    if (this.options.publicToken && this.legacyTokenAccepted(req)) return true;
+    return this.access.verifySession(readCookie(req.headers.cookie, SESSION_COOKIE));
+  }
+  /**
+   * The standing `FRIZZ_PUBLIC_TOKEN`, for headless boxes where nobody can press a key to mint a code.
+   * Deliberately kept as a separate, opt-in path rather than folded into sessions: it has the weaker
+   * properties (never rotates, every copy stays valid) and the readout says so.
+   */
+  legacyTokenAccepted(req) {
+    const expected2 = this.options.publicToken;
+    if (!expected2) return false;
+    const url = new URL(req.url ?? "/", "http://frizz.invalid");
+    const supplied = url.searchParams.get(PUBLIC_TOKEN_PARAM) ?? readCookie(req.headers.cookie, PUBLIC_TOKEN_COOKIE);
+    return !!supplied && secretsMatch(supplied, expected2);
+  }
+  /**
+   * Trade `?frizz_code=…` (or the legacy `?frizz_token=…`) for a cookie, then bounce to the same URL
+   * without the secret, so it never lands in history, a Referer header, or a screenshot.
+   */
+  exchangeCode(req, res) {
+    const url = new URL(req.url ?? "/", "http://frizz.invalid");
+    const code = url.searchParams.get(ACCESS_CODE_PARAM);
+    const legacy = url.searchParams.get(PUBLIC_TOKEN_PARAM);
+    if (code === null && legacy === null) return false;
+    let cookie;
+    if (code !== null) {
+      const redeemed = this.access?.redeem(code);
+      if (!redeemed?.ok) {
+        res.writeHead(401, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+        res.end(unauthorizedPage(redeemed?.reason));
+        return true;
+      }
+      cookie = `${SESSION_COOKIE}=${redeemed.session}`;
+    } else {
+      if (!this.legacyTokenAccepted(req)) return false;
+      cookie = `${PUBLIC_TOKEN_COOKIE}=${this.options.publicToken}`;
+    }
+    url.searchParams.delete(ACCESS_CODE_PARAM);
+    url.searchParams.delete(PUBLIC_TOKEN_PARAM);
+    const target2 = `${url.pathname}${url.search}${url.hash}` || "/";
+    res.writeHead(302, {
+      location: target2,
+      "set-cookie": `${cookie}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=31536000`,
+      "cache-control": "no-store"
+    });
+    res.end();
+    return true;
+  }
   handle(req, res) {
     if (isControlRequest(req)) {
       void this.handleControl(req, res);
       return;
     }
+    if (this.arrivedPublicly(req) && this.exchangeCode(req, res)) return;
+    if (this.arrivedPublicly(req) && !this.sessionAccepted(req)) {
+      res.writeHead(401, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+      res.end(unauthorizedPage());
+      return;
+    }
     if (!this.authorityAccepted(req)) {
       res.writeHead(403, { "content-type": "text/plain; charset=UTF-8" });
       res.end("Forbidden");
@@ -9324,6 +9858,10 @@ var RestartSupervisorProxy = class {
     req.pipe(upstream);
   }
   handleUpgrade(req, socket, head) {
+    if (this.arrivedPublicly(req) && !this.sessionAccepted(req)) {
+      rejectWebSocketUpgrade(socket, 401, "Unauthorized");
+      return;
+    }
     if (!this.authorityAccepted(req, false)) {
       socket.destroy();
       return;
@@ -9436,8 +9974,8 @@ function createSupervisorShutdownHandler(options2) {
     );
   };
 }
-var packagesDir = resolve5(import.meta.dirname, "..", "..");
-var workspaceDir = resolve5(packagesDir, "..");
+var packagesDir = resolve4(import.meta.dirname, "..", "..");
+var workspaceDir = resolve4(packagesDir, "..");
 var INITIAL_BOOT_REASON = "initial boot";
 function defaultDevWatchRoots() {
   return [workspaceDir];
@@ -9447,17 +9985,17 @@ function isWithin(path, root) {
   return rel === "" || rel !== ".." && !rel.startsWith(`..${sep2}`) && !isAbsolute3(rel);
 }
 function ignoredDevPath(path) {
-  const parts = resolve5(path).split(sep2);
+  const parts = resolve4(path).split(sep2);
   const name = parts.at(-1) ?? "";
   return parts.some((part) => GENERATED_DIRS.has(part) || part === "fixtures" || part.endsWith(".fixtures")) || /\.(?:test|spec)\.[^.]+$/.test(name) || name.includes(".golden.");
 }
 function classifyDevChange(path, roots = defaultDevWatchRoots()) {
-  const absolute = resolve5(path);
-  const root = roots.find((candidate) => isWithin(absolute, resolve5(candidate)));
+  const absolute = resolve4(path);
+  const root = roots.find((candidate) => isWithin(absolute, resolve4(candidate)));
   if (!root) return null;
   if (ignoredDevPath(absolute)) return null;
-  const name = basename5(absolute);
-  const relToWorkspace = relative(resolve5(root), absolute);
+  const name = basename6(absolute);
+  const relToWorkspace = relative(resolve4(root), absolute);
   const parts = relToWorkspace.split(sep2);
   const packageName = parts[0] === "packages" ? parts[1] : void 0;
   if (name === "package.json" && parts.length === 3 && packageName && CHILD_PACKAGE_METADATA.has(packageName)) {
@@ -9478,12 +10016,12 @@ function classifyDevChange(path, roots = defaultDevWatchRoots()) {
   return null;
 }
 function devConfigSyntaxError(path) {
-  const name = basename5(path);
+  const name = basename6(path);
   const isTsconfig = /^tsconfig(?:\.[^.]+)?\.json$/.test(name);
   if (name !== "package.json" && !isTsconfig) return null;
   let text;
   try {
-    text = readFileSync8(path, "utf8");
+    text = readFileSync9(path, "utf8");
   } catch (err) {
     return `${name}: ${err instanceof Error ? err.message : err}`;
   }
@@ -9598,10 +10136,10 @@ var Supervisor = class {
     if (launchOwner.pid !== callerGeneration.pid || launchOwner.processStart !== callerGeneration.processStart) throw new Error("dev supervisor caller is not the exact project launch owner");
     this.port = opts.port;
     this.launchTarget = opts.launchTarget;
-    this.cwd = resolve5(opts.cwd ?? opts.launchTarget.projectDir);
+    this.cwd = resolve4(opts.cwd ?? opts.launchTarget.projectDir);
     if (this.cwd !== opts.launchTarget.projectDir) throw new Error("dev supervisor cwd does not match its owned project");
     this.parentEnv = projectLaunchEnvironment(opts.env ?? process.env, opts.launchTarget, opts.launchOwnerToken);
-    this.roots = (opts.watchRoots ?? defaultDevWatchRoots()).map((root) => resolve5(root));
+    this.roots = (opts.watchRoots ?? defaultDevWatchRoots()).map((root) => resolve4(root));
     this.watchEnabled = opts.watch !== false;
     this.childEnvironment = opts.childEnvironment ?? (() => ({}));
     this.debounceMs = opts.debounceMs ?? DEV_RESTART_DEBOUNCE_MS;
@@ -9611,10 +10149,10 @@ var Supervisor = class {
     this.childArgs = opts.childArgs ?? [];
     this.watchSubscribe = opts.watchSubscribe ?? ((root, callback, options2) => watcher.subscribe(root, callback, options2));
     this.reexec = opts.reexec ?? (typeof process.execve === "function" ? (request) => process.execve(request.executable, request.argv, request.env) : void 0);
-    if (opts.stateDir && resolve5(opts.stateDir) !== opts.launchTarget.stateDir) {
+    if (opts.stateDir && resolve4(opts.stateDir) !== opts.launchTarget.stateDir) {
       throw new Error("dev supervisor state directory does not match its owned project");
     }
-    this.supervisorLock = resolve5(opts.launchTarget.stateDir, "dev-supervisor.lock");
+    this.supervisorLock = resolve4(opts.launchTarget.stateDir, "dev-supervisor.lock");
     this.ownerToken = opts.launchOwnerToken;
     this.logLine = opts.log ?? ((line) => log.info("supervisor", stripPrefix(line)));
     this.errorLine = opts.error ?? ((line) => log.error("supervisor", stripPrefix(line)));
@@ -9626,6 +10164,9 @@ var Supervisor = class {
       host: opts.host,
       allowedHosts: opts.allowedHosts,
       publicOrigin: opts.publicOrigin,
+      publicToken: opts.publicToken,
+      onCodeConsumed: opts.onCodeConsumed,
+      sessionKey: opts.sessionKey,
       childPort: () => this.childPort,
       restart: () => this.restartFromBrowser(),
       updateRestart: this.updateRestart ? () => this.updateFromBrowser() : void 0,
@@ -9648,9 +10189,16 @@ var Supervisor = class {
   currentBoot() {
     return this.boot;
   }
+  /** Mint a single-use access link for the public origin, or null when none is declared. */
+  issueAccessLink() {
+    const code = this.publicProxy.issueAccessCode();
+    if (!code) return null;
+    const url = this.publicProxy.accessUrl(code.code);
+    return url ? { code: code.code, url, expiresAt: code.expiresAt } : null;
+  }
   async start() {
     if (this.supervisorLock) {
-      mkdirSync7(dirname5(this.supervisorLock), { recursive: true });
+      mkdirSync8(dirname7(this.supervisorLock), { recursive: true });
       this.writeStatus("starting", "watcher initializing");
     }
     try {
@@ -10145,8 +10693,8 @@ var npmRegistryReleaseAdapter = {
 // src/preflight.ts
 import { spawnSync } from "node:child_process";
 import { chmodSync, statSync as statSync5 } from "node:fs";
-import { createRequire as createRequire2 } from "node:module";
-import { dirname as dirname6, join as join10 } from "node:path";
+import { createRequire } from "node:module";
+import { dirname as dirname8, join as join10 } from "node:path";
 var SUPPORTED_NODE_LINES = [
   { major: 22, minor: 13 },
   { major: 23, minor: 4 }
@@ -10195,10 +10743,10 @@ function ensureNativeHelperPermissions(options2 = {}) {
   if (platform === "win32") return;
   const stat = options2.stat ?? ((path) => statSync5(path));
   const chmod = options2.chmod ?? ((path, mode) => chmodSync(path, mode));
-  const resolvePty = options2.resolvePty ?? (() => createRequire2(import.meta.url).resolve("node-pty/package.json"));
+  const resolvePty = options2.resolvePty ?? (() => createRequire(import.meta.url).resolve("node-pty/package.json"));
   try {
     const helper = join10(
-      dirname6(resolvePty()),
+      dirname8(resolvePty()),
       "prebuilds",
       `${platform}-${options2.arch ?? process.arch}`,
       "spawn-helper"
@@ -10211,10 +10759,13 @@ function ensureNativeHelperPermissions(options2 = {}) {
 }
 
 // src/production.ts
+init_src();
+init_project_registry();
+init_project_identity();
 var PACKAGE_NAME = process.env.FRIZZ_REGISTRY_PACKAGE ?? "frizz";
 function resolvePackageVersion() {
   try {
-    const manifest = JSON.parse(readFileSync9(join11(import.meta.dirname, "..", "package.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync10(join11(import.meta.dirname, "..", "package.json"), "utf8"));
     if (typeof manifest.version === "string" && manifest.version.trim()) return manifest.version.trim();
   } catch {
   }
@@ -10251,6 +10802,7 @@ Options:
   --host [address]       serve on a network address instead of loopback (bare --host means 0.0.0.0)
   --allowed-host <name>  with --host, also accept this DNS name as the board's address (repeatable)
   --public-origin <url>  serve behind a proxy/tunnel reachable at this exact origin
+  --link                 print a fresh single-use access link for the running board
   --debug                stream the full event feed to the terminal instead of the compact readout
   -h, --help             show this help
 
@@ -10258,14 +10810,16 @@ Environment:
   FRIZZ_HOST              same as --host
   FRIZZ_ALLOWED_HOSTS     same as --allowed-host, comma separated
   FRIZZ_PUBLIC_ORIGIN     same as --public-origin
+  FRIZZ_PUBLIC_TOKEN      standing secret for HEADLESS boxes that cannot show a QR
 
 --host puts a board that can run shell commands as you on the network, and Frizz has no login: anyone
 who reaches the port controls it. Only do this on a network you trust. An IP address works as-is; to
 reach the board by DNS name you must list that name with --allowed-host ("*" allows any).
 
 --public-origin serves the board through a tunnel or reverse proxy without putting it on the LAN
-at all \u2014 Frizz stays on loopback and the tunnel dials it. Frizz still has no login, so require
-authentication at the proxy: with Cloudflare Access, that is the whole of your access control.`
+at all \u2014 Frizz stays on loopback and the tunnel dials it. It prints a SINGLE-USE access link, and
+shows it as a QR so you can scan it from a phone; press L for a fresh one at any time. Scanning it
+trades the code for a session cookie, so the link itself stops working the moment it is used.`
   );
   process.exit(0);
 }
@@ -10277,6 +10831,7 @@ var bind = (() => {
     return fail(error);
   }
 })();
+var launchIntent;
 var workspace = (() => {
   try {
     if (!reexec) {
@@ -10284,11 +10839,17 @@ var workspace = (() => {
       else assertLaunchPrerequisites();
     }
     const pinned = projectLaunchTargetFromEnvironment(process.env);
-    if (reexec) {
+    if (reexec || process.env.FRIZZ_PRODUCTION_SUPERVISOR === "1") {
       if (!pinned) throw new Error("registry successor is missing its pinned project identity");
       return workspaceFromLaunchTarget(pinned);
     }
-    return resolveWorkspace(options.repoPath);
+    const intent = resolveLaunchIntent(options.repoPath);
+    if (intent.kind === "empty")
+      throw new Error(
+        intent.reason === "home" ? "frizz cannot open your home directory as a project, and there is no other project to show yet. cd into a repository and run frizz there." : `${intent.directory} is not a Frizz project yet, and there is no other project to show. Run frizz inside a repository, or add this one from the projects page once a board is open.`
+      );
+    launchIntent = intent;
+    return intent.workspace;
   } catch (error) {
     return fail(error);
   }
@@ -10313,8 +10874,39 @@ async function existingPort() {
   for (const port of new Set(ports)) if (await probeFrizz(port, expected)) return port;
   return void 0;
 }
-async function openOrPrint(port, reused) {
-  const url = `http://127.0.0.1:${port}`;
+function ownSlug() {
+  try {
+    return registerProject(
+      { dir: workspace.root, id: target.projectId, remoteOwner: resolveProjectLabel(workspace.root)?.split("/")[0] },
+      homedir8()
+    ).entry?.slug;
+  } catch {
+    return void 0;
+  }
+}
+var cachedSlugPath;
+function slugPath() {
+  if (cachedSlugPath === void 0) {
+    if (launchIntent?.kind === "grid") cachedSlugPath = "/";
+    else if (launchIntent?.kind === "offer") cachedSlugPath = `/?add=${encodeURIComponent(launchIntent.directory)}`;
+    else {
+      const slug = ownSlug();
+      cachedSlugPath = slug ? `/project/${slug}` : "";
+    }
+  }
+  return cachedSlugPath;
+}
+async function joinRunningFrizz() {
+  const slug = ownSlug();
+  if (!slug) return void 0;
+  for (const port of /* @__PURE__ */ new Set([DEFAULT_PORT, fallbackPort(DEFAULT_PORT)])) {
+    if (await probeFrizz(port, { projectId: target.projectId, projectDir: target.projectDir, slug }))
+      return { port, slug };
+  }
+  return void 0;
+}
+async function openOrPrint(port, reused, path = "") {
+  const url = `http://127.0.0.1:${port}${path}`;
   logger.info("launcher", `${reused ? "reusing" : "started"} Frizz at ${url}`);
   readout?.settle("server", "done", reused ? `already running on port ${port}` : `port ${port}`);
   let browser;
@@ -10339,24 +10931,26 @@ async function openOrPrint(port, reused) {
   }
   const network = reused ? [] : networkUrls(port, bind.host);
   const publicOrigin = reused ? void 0 : bind.publicOrigin;
+  const networkFlagsIgnored = reused && (bind.publicOrigin !== void 0 || bindHostIsExposed(bind.host));
   const warnings = [
     ...network.length > 0 ? [EXPOSED_WARNING] : [],
-    ...publicOrigin ? [PUBLIC_ORIGIN_WARNING] : []
+    ...publicOrigin ? [PUBLIC_ORIGIN_WARNING] : [],
+    ...networkFlagsIgnored ? [REUSED_NETWORK_FLAGS_WARNING] : []
   ];
   if (!readout) {
     console.log(`${reused ? "reusing" : "started"} Frizz ${PACKAGE_VERSION} for ${workspace.root}`);
     console.log(url);
     for (const address of network) console.log(address);
-    if (publicOrigin) console.log(publicOrigin);
+    if (publicOrigin) console.log(`${publicOrigin}/${bind.publicToken ? `?frizz_token=${bind.publicToken}` : ""}`);
     for (const warning of warnings) console.log(warning);
     return;
   }
   const home = homedir8();
   readout.ready(
     [
-      { label: "Local", value: `${url}/`, accent: true },
+      { label: "Local", value: boardAddress(url), accent: true },
       ...network.map((address) => ({ label: "Network", value: `${address}/`, accent: true })),
-      ...publicOrigin ? [{ label: "Public", value: `${publicOrigin}/`, accent: true }] : [],
+      ...publicOrigin ? [{ label: "Public", value: `${publicOrigin}/${bind.publicToken ? `?frizz_token=${bind.publicToken}` : ""}`, accent: true }] : [],
       { label: "Project", value: `${workspace.name} \u2014 ${tildePath(workspace.root, home)}` },
       ...logger.file ? [{ label: "Logs", value: tildePath(logger.file, home) }] : []
     ],
@@ -10405,6 +10999,7 @@ async function runSupervisor(port, token) {
     host: bind.host,
     allowedHosts: bind.allowedHosts,
     ...bind.publicOrigin ? { publicOrigin: bind.publicOrigin } : {},
+    ...bind.publicToken ? { publicToken: bind.publicToken } : {},
     cwd: workspace.root,
     stateDir: workspace.stateDir,
     launchTarget: target,
@@ -10444,7 +11039,7 @@ async function runSupervisor(port, token) {
   log: ${tildePath(logger.file, homedir8())}` : "";
       process.stdout.write(
         code === 0 ? `
-  Frizz stopped. Agent sessions in tmux keep running.${suffix}
+  Frizz stopped. Running agents keep going \u2014 they are detached daemons.${suffix}
 
 ` : `
   Frizz stopped with errors (exit ${code}).${suffix}
@@ -10457,6 +11052,7 @@ async function runSupervisor(port, token) {
   });
   process.on("SIGINT", stop);
   process.on("SIGTERM", stop);
+  process.on("SIGHUP", stop);
   void supervisor.stopRequested.then(stop);
   await supervisor.firstBoot;
   return await new Promise(() => {
@@ -10471,7 +11067,12 @@ try {
   }
   const existing = await existingPort();
   if (existing) {
-    await openOrPrint(existing, true);
+    await openOrPrint(existing, true, slugPath());
+    process.exit(0);
+  }
+  const joined = await joinRunningFrizz();
+  if (joined) {
+    await openOrPrint(joined.port, true, slugPath());
     process.exit(0);
   }
   const claim = tryAcquireProjectLaunchOwner(target, "launcher");
@@ -10496,7 +11097,7 @@ try {
     ]);
     portReservation();
     portReservation = void 0;
-    await openOrPrint(port, false);
+    await openOrPrint(port, false, slugPath());
     await running;
   } finally {
     release?.();