frizz 0.3.0 → 0.4.0

package/README.md

@@ -33,7 +33,7 @@ Then run it in any directory — a repo, a jj checkout, or a folder of scripts.
 $ cd path/to/acme
 $ npx frizz
 
-  FRIZZ v0.3.0  ready in 4.0s
+  FRIZZ v0.4.0  ready in 4.0s
 
   ➜  Local:    http://127.0.0.1:9393/project/acme/
   ➜  Project:  acme — path/to/acme
@@ -133,6 +133,7 @@ Options:
   --host [address]       serve on a network address instead of loopback (bare --host means 0.0.0.0)
   --allowed-host <name>  with --host, also accept this DNS name as the board's address (repeatable)
   --public-origin <url>  serve behind a proxy/tunnel reachable at this exact origin
+  --link                 print a fresh single-use access link for the running board
   --debug                stream the full event feed to the terminal instead of the compact readout
   -h, --help             show this help
 
@@ -140,14 +141,16 @@ Environment:
   FRIZZ_HOST              same as --host
   FRIZZ_ALLOWED_HOSTS     same as --allowed-host, comma separated
   FRIZZ_PUBLIC_ORIGIN     same as --public-origin
+  FRIZZ_PUBLIC_TOKEN      standing secret for HEADLESS boxes that cannot show a QR
 
 --host puts a board that can run shell commands as you on the network, and Frizz has no login: anyone
 who reaches the port controls it. Only do this on a network you trust. An IP address works as-is; to
 reach the board by DNS name you must list that name with --allowed-host ("*" allows any).
 
 --public-origin serves the board through a tunnel or reverse proxy without putting it on the LAN
-at all — Frizz stays on loopback and the tunnel dials it. Frizz still has no login, so require
-authentication at the proxy: with Cloudflare Access, that is the whole of your access control.
+at all — Frizz stays on loopback and the tunnel dials it. It prints a SINGLE-USE access link, and
+shows it as a QR so you can scan it from a phone; press L for a fresh one at any time. Scanning it
+trades the code for a session cookie, so the link itself stops working the moment it is used.
 ```
 
 <br/>
@@ -226,7 +229,9 @@ authentication at the proxy: with Cloudflare Access, that is the whole of your a
 >
 > The address you pass must be the exact origin your browser shows — scheme and host, no path. Frizz accepts that one origin, and accepts `X-Forwarded-*` only on requests that actually arrived as it.
 >
-> **This is the part that matters: Frizz has no login, so whatever you put in front of the tunnel *is* your access control.** A bare tunnel publishes a shell-capable board to the open internet for anyone who has the URL. Require authentication at the proxy — with Cloudflare, that means a [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/policies/access/) application over the hostname, with a policy allowing only your own email, created *before* the hostname resolves. Tailscale Serve is the same idea with device identity instead of SSO. Frizz prints this warning on every launch that names a public origin, and it is not boilerplate.
+> Frizz prints a **single-use** access link and renders it as a QR in your terminal, so you can scan it from a phone without typing forty characters. Scanning trades the code for a session cookie and the link immediately stops working; press **L** any time for a fresh one. A code expires in five minutes, and a spent one says so rather than failing silently.
+
+**Even so: Frizz has no accounts, so that link — and anything you put in front of the tunnel — *is* your access control.** A bare tunnel publishes a shell-capable board to the open internet for anyone who has the URL. Require authentication at the proxy — with Cloudflare, that means a [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/policies/access/) application over the hostname, with a policy allowing only your own email, created *before* the hostname resolves. Tailscale Serve is the same idea with device identity instead of SSO. Frizz prints this warning on every launch that names a public origin, and it is not boilerplate.
 
 </details>
 

package/dist/claude-agent-broker.js

@@ -20623,13 +20623,18 @@ function startClaudeQuery(executablePath, options) {
       ...options.session.kind === "new" ? { sessionId } : { resume: sessionId },
       canUseTool,
       onElicitation,
-      // PROJECT + LOCAL by default — see ClaudeQueryStartOptions.settingSources. `[]` was correct while
-      // this was a standalone foundation nothing dispatched through; once the broker became the DEFAULT
+      // EVERY scope by default — see ClaudeQueryStartOptions.settingSources. `[]` was correct while this
+      // was a standalone foundation nothing dispatched through; once the broker became the DEFAULT
       // Claude transport it silently stopped every worker from seeing the repo's own `CLAUDE.md` /
       // `AGENTS.md` and its `.claude/skills`. Measured differential in the frizz repo, one variable:
       // this factory answered `NO-CLAUDE-MD` where a plain `claude -p` in the same cwd answered
-      // "# No pull requests — land on local `main`". `"user"` stays OUT on purpose (see the field docs).
-      settingSources: options.settingSources ?? ["project", "local"],
+      // "# No pull requests — land on local `main`". That fix restored PROJECT + LOCAL and left USER
+      // out, which kept a second, quieter half of the same regression: the tmux transport ran plain
+      // `claude` and got all three scopes, so a broker session was the only place the operator's
+      // `~/.claude/settings.json` stopped applying. Measured 2026-08-16 against the maintainer's real
+      // config, one variable: `--setting-sources=project,local` reported their `env` block UNSET where
+      // `user,project,local` reported it applied.
+      settingSources: options.settingSources ?? ["user", "project", "local"],
       // The frizz worker environment (see ClaudeQueryStartOptions): load the local cc-worker plugin so a
       // broker session gets the frizz sub-agent profiles + hooks, mount the MCP servers (frizz +
       // chrome-devtools), and pre-approve them.