frizz 0.3.0 → 0.4.0

package/dist/frizz.js

@@ -10,6 +10,180 @@ var __export = (target2, all) => {
     __defProp(target2, name, { get: all[name], enumerable: true });
 };
 
+// packages/server/src/local-origin.ts
+import { isIP } from "node:net";
+function publicAuthority(policy) {
+  const raw = policy?.publicOrigin;
+  if (!raw) return null;
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (url.origin !== raw) return null;
+  return {
+    hostname: normalizedHostname(url.hostname),
+    port: explicitPort(url),
+    authority: url.host.toLowerCase(),
+    scheme: url.protocol === "https:" ? "https" : "http"
+  };
+}
+function authoritySendsFetchMetadata(authority) {
+  return LOCAL_HOSTNAMES.has(authority.hostname) || authority.scheme === "https";
+}
+function acceptsHostname(hostname, policy) {
+  if (LOCAL_HOSTNAMES.has(hostname)) return true;
+  if (!policy?.exposed) return false;
+  if (isIP(hostname) !== 0) return true;
+  return (policy.allowedHosts ?? []).some((allowed) => allowed === "*" || allowed.toLowerCase() === hostname);
+}
+function oneHeader(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function normalizedHostname(hostname) {
+  const lower = hostname.toLowerCase();
+  return lower.startsWith("[") && lower.endsWith("]") ? lower.slice(1, -1) : lower;
+}
+function explicitPort(url) {
+  if (url.port) return Number(url.port);
+  return url.protocol === "https:" ? 443 : 80;
+}
+function validExpectedPort(port) {
+  return Number.isInteger(port) && port >= 1 && port <= 65535;
+}
+function parseLocalHttpOrigin(value, expectedPort, policy) {
+  const raw = oneHeader(value);
+  if (!raw || !validExpectedPort(expectedPort) || raw !== raw.trim()) return null;
+  const declared = publicAuthority(policy);
+  if (declared && raw === policy?.publicOrigin) return declared;
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "http:" || url.origin !== raw) return null;
+  const hostname = normalizedHostname(url.hostname);
+  if (!acceptsHostname(hostname, policy) || explicitPort(url) !== expectedPort) return null;
+  return { hostname, port: expectedPort, authority: url.host, scheme: "http" };
+}
+function parseLocalHost(value, expectedPort, policy) {
+  const raw = oneHeader(value);
+  if (!raw || !validExpectedPort(expectedPort) || raw !== raw.trim() || raw.includes(",")) return null;
+  let url;
+  try {
+    url = new URL(`http://${raw}`);
+  } catch {
+    return null;
+  }
+  if (url.username || url.password || url.pathname !== "/" || url.search || url.hash) return null;
+  if (url.host.toLowerCase() !== raw.toLowerCase()) return null;
+  const hostname = normalizedHostname(url.hostname);
+  const declared = publicAuthority(policy);
+  if (declared && hostname === declared.hostname) {
+    return url.port === "" || Number(url.port) === declared.port ? declared : null;
+  }
+  if (!acceptsHostname(hostname, policy) || explicitPort(url) !== expectedPort) return null;
+  return { hostname, port: expectedPort, authority: url.host.toLowerCase(), scheme: "http" };
+}
+function hasForwardedAuthority(headers) {
+  return FORWARDED_HEADERS.some((name) => headers[name] !== void 0);
+}
+function forwardedAuthorityAllowed(headers, host, policy) {
+  if (!hasForwardedAuthority(headers)) return true;
+  const declared = publicAuthority(policy);
+  return !!declared && declared.hostname === host.hostname;
+}
+function isTrustedLocalHttpRequest(headers, expectedPort, allowMissingOrigin = false, policy) {
+  const host = parseLocalHost(headers.host, expectedPort, policy);
+  if (!host) return false;
+  if (!forwardedAuthorityAllowed(headers, host, policy)) return false;
+  if (headers.origin === void 0) return allowMissingOrigin;
+  const origin = parseLocalHttpOrigin(headers.origin, expectedPort, policy);
+  return !!origin && host.hostname === origin.hostname && host.port === origin.port;
+}
+function allowedLocalCorsOrigin(origin, expectedPort, policy) {
+  return parseLocalHttpOrigin(origin, expectedPort, policy) ? origin : void 0;
+}
+function normalizeBindHost(value) {
+  const trimmed = value.trim();
+  if (!trimmed) throw new Error("--host requires an address");
+  const bare = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
+  const lower = bare.toLowerCase();
+  if (lower === "localhost") return LOOPBACK_BIND_HOST;
+  if (isIP(bare) === 0) {
+    throw new Error(`invalid --host address: ${value} (use an IP address such as 0.0.0.0, :: or 127.0.0.1)`);
+  }
+  return bare;
+}
+function bindHostIsExposed(host) {
+  return !LOOPBACK_BIND_HOSTS.has(host.trim().toLowerCase());
+}
+function normalizePublicOrigin(value) {
+  const trimmed = value.trim();
+  const invalid = (why) => new Error(`invalid --public-origin: ${value} (${why})`);
+  if (!trimmed) throw new Error("--public-origin requires a URL");
+  let url;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    throw invalid("use a full URL such as https://frizz.example.com");
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") throw invalid("only http and https are supported");
+  if (url.username || url.password) throw invalid("an origin carries no credentials");
+  if (url.pathname !== "/" || url.search || url.hash) throw invalid("an origin is a scheme and host only, with no path");
+  if (!url.hostname) throw invalid("no hostname");
+  return url.origin;
+}
+function normalizeAllowedHosts(values) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    for (const entry of value.split(",")) {
+      const host = entry.trim().toLowerCase();
+      if (host) seen.add(host);
+    }
+  }
+  return [...seen];
+}
+function rejectWebSocketUpgrade(socket, status = 403, reason = "Forbidden") {
+  const body = `${reason}
+`;
+  const response = [
+    `HTTP/1.1 ${status} ${reason}`,
+    "Connection: close",
+    "Content-Type: text/plain; charset=utf-8",
+    `Content-Length: ${Buffer.byteLength(body)}`,
+    "",
+    body
+  ].join("\r\n");
+  try {
+    socket.end(response);
+  } catch {
+    try {
+      socket.destroy();
+    } catch {
+    }
+  }
+}
+var LOCAL_HOSTNAMES, FORWARDED_HEADERS, LOOPBACK_BIND_HOST, ALL_INTERFACES_BIND_HOST, LOOPBACK_BIND_HOSTS;
+var init_local_origin = __esm({
+  "packages/server/src/local-origin.ts"() {
+    "use strict";
+    LOCAL_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+    FORWARDED_HEADERS = [
+      "forwarded",
+      "x-forwarded-for",
+      "x-forwarded-host",
+      "x-forwarded-port",
+      "x-forwarded-proto"
+    ];
+    LOOPBACK_BIND_HOST = "127.0.0.1";
+    ALL_INTERFACES_BIND_HOST = "0.0.0.0";
+    LOOPBACK_BIND_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "localhost", "[::1]"]);
+  }
+});
+
 // packages/server/src/frizz-paths.ts
 import { existsSync } from "node:fs";
 import { homedir as homedir2, tmpdir } from "node:os";
@@ -1250,160 +1424,6 @@ var init_project_launch = __esm({
   }
 });
 
-// packages/server/src/local-origin.ts
-import { isIP } from "node:net";
-function publicAuthority(policy) {
-  const raw = policy?.publicOrigin;
-  if (!raw) return null;
-  let url;
-  try {
-    url = new URL(raw);
-  } catch {
-    return null;
-  }
-  if (url.origin !== raw) return null;
-  return {
-    hostname: normalizedHostname(url.hostname),
-    port: explicitPort(url),
-    authority: url.host.toLowerCase(),
-    scheme: url.protocol === "https:" ? "https" : "http"
-  };
-}
-function authoritySendsFetchMetadata(authority) {
-  return LOCAL_HOSTNAMES.has(authority.hostname) || authority.scheme === "https";
-}
-function acceptsHostname(hostname, policy) {
-  if (LOCAL_HOSTNAMES.has(hostname)) return true;
-  if (!policy?.exposed) return false;
-  if (isIP(hostname) !== 0) return true;
-  return (policy.allowedHosts ?? []).some((allowed) => allowed === "*" || allowed.toLowerCase() === hostname);
-}
-function oneHeader(value) {
-  return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-function normalizedHostname(hostname) {
-  const lower = hostname.toLowerCase();
-  return lower.startsWith("[") && lower.endsWith("]") ? lower.slice(1, -1) : lower;
-}
-function explicitPort(url) {
-  if (url.port) return Number(url.port);
-  return url.protocol === "https:" ? 443 : 80;
-}
-function validExpectedPort(port) {
-  return Number.isInteger(port) && port >= 1 && port <= 65535;
-}
-function parseLocalHttpOrigin(value, expectedPort, policy) {
-  const raw = oneHeader(value);
-  if (!raw || !validExpectedPort(expectedPort) || raw !== raw.trim()) return null;
-  const declared = publicAuthority(policy);
-  if (declared && raw === policy?.publicOrigin) return declared;
-  let url;
-  try {
-    url = new URL(raw);
-  } catch {
-    return null;
-  }
-  if (url.protocol !== "http:" || url.origin !== raw) return null;
-  const hostname = normalizedHostname(url.hostname);
-  if (!acceptsHostname(hostname, policy) || explicitPort(url) !== expectedPort) return null;
-  return { hostname, port: expectedPort, authority: url.host, scheme: "http" };
-}
-function parseLocalHost(value, expectedPort, policy) {
-  const raw = oneHeader(value);
-  if (!raw || !validExpectedPort(expectedPort) || raw !== raw.trim() || raw.includes(",")) return null;
-  let url;
-  try {
-    url = new URL(`http://${raw}`);
-  } catch {
-    return null;
-  }
-  if (url.username || url.password || url.pathname !== "/" || url.search || url.hash) return null;
-  if (url.host.toLowerCase() !== raw.toLowerCase()) return null;
-  const hostname = normalizedHostname(url.hostname);
-  const declared = publicAuthority(policy);
-  if (declared && hostname === declared.hostname) {
-    return url.port === "" || Number(url.port) === declared.port ? declared : null;
-  }
-  if (!acceptsHostname(hostname, policy) || explicitPort(url) !== expectedPort) return null;
-  return { hostname, port: expectedPort, authority: url.host.toLowerCase(), scheme: "http" };
-}
-function hasForwardedAuthority(headers) {
-  return FORWARDED_HEADERS.some((name) => headers[name] !== void 0);
-}
-function forwardedAuthorityAllowed(headers, host, policy) {
-  if (!hasForwardedAuthority(headers)) return true;
-  const declared = publicAuthority(policy);
-  return !!declared && declared.hostname === host.hostname;
-}
-function isTrustedLocalHttpRequest(headers, expectedPort, allowMissingOrigin = false, policy) {
-  const host = parseLocalHost(headers.host, expectedPort, policy);
-  if (!host) return false;
-  if (!forwardedAuthorityAllowed(headers, host, policy)) return false;
-  if (headers.origin === void 0) return allowMissingOrigin;
-  const origin = parseLocalHttpOrigin(headers.origin, expectedPort, policy);
-  return !!origin && host.hostname === origin.hostname && host.port === origin.port;
-}
-function allowedLocalCorsOrigin(origin, expectedPort, policy) {
-  return parseLocalHttpOrigin(origin, expectedPort, policy) ? origin : void 0;
-}
-function normalizeBindHost(value) {
-  const trimmed = value.trim();
-  if (!trimmed) throw new Error("--host requires an address");
-  const bare = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
-  const lower = bare.toLowerCase();
-  if (lower === "localhost") return LOOPBACK_BIND_HOST;
-  if (isIP(bare) === 0) {
-    throw new Error(`invalid --host address: ${value} (use an IP address such as 0.0.0.0, :: or 127.0.0.1)`);
-  }
-  return bare;
-}
-function bindHostIsExposed(host) {
-  return !LOOPBACK_BIND_HOSTS.has(host.trim().toLowerCase());
-}
-function normalizePublicOrigin(value) {
-  const trimmed = value.trim();
-  const invalid = (why) => new Error(`invalid --public-origin: ${value} (${why})`);
-  if (!trimmed) throw new Error("--public-origin requires a URL");
-  let url;
-  try {
-    url = new URL(trimmed);
-  } catch {
-    throw invalid("use a full URL such as https://frizz.example.com");
-  }
-  if (url.protocol !== "https:" && url.protocol !== "http:") throw invalid("only http and https are supported");
-  if (url.username || url.password) throw invalid("an origin carries no credentials");
-  if (url.pathname !== "/" || url.search || url.hash) throw invalid("an origin is a scheme and host only, with no path");
-  if (!url.hostname) throw invalid("no hostname");
-  return url.origin;
-}
-function normalizeAllowedHosts(values) {
-  const seen = /* @__PURE__ */ new Set();
-  for (const value of values) {
-    for (const entry of value.split(",")) {
-      const host = entry.trim().toLowerCase();
-      if (host) seen.add(host);
-    }
-  }
-  return [...seen];
-}
-var LOCAL_HOSTNAMES, FORWARDED_HEADERS, LOOPBACK_BIND_HOST, ALL_INTERFACES_BIND_HOST, LOOPBACK_BIND_HOSTS;
-var init_local_origin = __esm({
-  "packages/server/src/local-origin.ts"() {
-    "use strict";
-    LOCAL_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
-    FORWARDED_HEADERS = [
-      "forwarded",
-      "x-forwarded-for",
-      "x-forwarded-host",
-      "x-forwarded-port",
-      "x-forwarded-proto"
-    ];
-    LOOPBACK_BIND_HOST = "127.0.0.1";
-    ALL_INTERFACES_BIND_HOST = "0.0.0.0";
-    LOOPBACK_BIND_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "localhost", "[::1]"]);
-  }
-});
-
 // packages/server/src/boot-progress.ts
 import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { basename as basename3, dirname as dirname4, join as join6 } from "node:path";
@@ -6255,7 +6275,7 @@ var init_receipt_bus = __esm({
 function fallbackPort(base) {
   return base + 1e4;
 }
-var ATTACHMENT_IMAGE_EXTENSIONS, ATTACHMENT_DOC_EXTENSIONS, ATTACHMENT_EXTENSIONS, ATTACHMENT_MAX_BASE64_CHARS, ATTACHMENT_MAX_BYTES, ATTACHMENT_EXT_SET, ATTACHMENT_ACCEPT, FrizzStatus, BlockMechanism, RuntimeState, Backend, CodexModel, ThreadProfileOption, ThreadAgent, SubAgentView, BgShellView, CompletionHoldOp, CompletionHold, AskOption, AskQuestion, PendingAsk, NativeInputRequired, AwaitingHint, SnoozeUntil, SNOOZE_PROMPT_MAX, SnoozePrompt, RECURRING_PROMPT_MAX, RECURRING_MIN_INTERVAL_SECONDS, RECURRING_MAX_INTERVAL_SECONDS, RecurringPromptText, RecurringIntervalSeconds, ThreadRecurringPrompt, TIMER_PROMPT_MAX, TIMER_MAX_DELAY_SECONDS, TimerPromptText, SIGNOFF_NUDGE_MARKER, SIGNOFF_NUDGE_MESSAGE, ThreadWatchKind, RegisterableThreadWatchKind, ThreadWatchTarget, ThreadWatchView, ThreadTimerView, ThreadFence, PlanView, LimitWindow, LimitPause, ThreadView, BoardErrorItem, BoardSnapshot, QuotaWindow, ProviderQuota, QuotaSnapshot, ProviderAuth, AccountEmails, AuthSnapshot, AccountLogoutInput, AccountLogoutResult, AccountLoginStartInput, AccountLoginStartResult, AccountLoginStatusInput, AccountLoginStatusResult, PermissionMode, LocalFileOpener, Settings, DispatchProviderPreferences, DispatchPreferences, DispatchProfileSnapshot, SetDispatchPreferenceInput, DispatchInput, ADOPT_THREAD_MESSAGE_MAX_CHARS, AdoptThreadInput, AdoptThreadResult, FollowUpInput, UnqueueFollowUpInput, UnqueueFollowUpResult, DeliverQueuedNowInput, DeliverQueuedNowResult, SetThreadSnoozeInput, SetThreadRecurringPromptInput, SetOwnThreadRecurringPromptInput, SetOwnThreadRecurringPromptResult, GetOwnThreadRecurringPromptInput, OwnThreadRecurringPromptResult, SetOwnThreadTimerInput, CancelOwnThreadTimerInput, ListOwnThreadTimersInput, OwnThreadTimersResult, SetOwnThreadTimerResult, CancelOwnThreadTimerResult, AddOwnThreadWatchInput, PromoteOwnThreadWatchInput, PromoteOwnThreadWatchResult, DropOwnThreadWatchInput, ListOwnThreadWatchesInput, OwnThreadWatchesResult, AddOwnThreadWatchResult, DropOwnThreadWatchResult, SetOwnThreadStopHookInput, SetOwnThreadHeartbeatInput, ThreadPluginReloadResult, ConfirmAwaitingInput, RenameThreadInput, AiRenameThreadInput, AiRenameThreadResult, SetThreadPermissionInput, SetThreadPermissionResult, ThreadProfileOptionsInput, ThreadProfileOptionsResult, SetThreadProfileInput, SetThreadProfileResult, DISPATCH_TASK_BANNER, DISPATCH_TASK_BANNER_MARKER, GithubWakeItem, GithubWakeSteer, WAKE_SCOPE, WAKE_REF, WAKE_SINGLE, WAKE_MULTI_HEAD, GithubStatus, GithubItem, GithubListInput, GithubListResult, GithubBatchInput, GithubBatchResult, BoardMeta, ServerEvent, TranscriptEdit, TranscriptTodo, TranscriptToolCall, TranscriptPart, TranscriptMessage, TranscriptPageCursor, TranscriptPage, TranscriptEarlierInput, SocketTranscriptSlug, SocketClientMsg, ProjectCard, PROJECT_ICON_MAX_BASE64_CHARS, DirectoryPickResult, ThreadLocation, FRIZZ_ROUTE_PREFIX, DEFAULT_PORT;
+var ATTACHMENT_IMAGE_EXTENSIONS, ATTACHMENT_DOC_EXTENSIONS, ATTACHMENT_EXTENSIONS, ATTACHMENT_MAX_BASE64_CHARS, ATTACHMENT_MAX_BYTES, ATTACHMENT_EXT_SET, ATTACHMENT_ACCEPT, FrizzStatus, BlockMechanism, RuntimeState, Backend, CodexModel, ThreadProfileOption, ThreadAgent, SubAgentView, BgShellView, CompletionHoldOp, CompletionHold, AskOption, AskQuestion, PendingAsk, NativeInputRequired, AwaitingHint, RETIRED_AWAITING_KINDS, RETIRED_LINE_RE, AWAITING_FOR_MAX_MS, SnoozeUntil, SNOOZE_PROMPT_MAX, SnoozePrompt, RECURRING_PROMPT_MAX, RECURRING_MIN_INTERVAL_SECONDS, RECURRING_MAX_INTERVAL_SECONDS, RecurringPromptText, RecurringIntervalSeconds, ThreadRecurringPrompt, TIMER_PROMPT_MAX, TIMER_MAX_DELAY_SECONDS, TimerPromptText, SIGNOFF_NUDGE_MARKER, SIGNOFF_NUDGE_MESSAGE, ThreadWatchKind, GithubChecksState, GithubMergeState, GithubWatchStatus, ThreadWatchView, PR_WATCH_DEFAULT_FOR_MS, PrWatchView, AddOwnPrWatchInput, AddOwnPrWatchResult, DropOwnPrWatchInput, DropOwnPrWatchResult, ListOwnPrWatchesInput, OwnPrWatchesResult, ThreadTimerView, ThreadFence, PlanView, LimitWindow, LimitPause, ThreadView, BoardErrorItem, BoardSnapshot, QuotaWindow, ProviderQuota, QuotaSnapshot, ProviderAuth, AccountEmails, AuthSnapshot, AccountLogoutInput, AccountLogoutResult, AccountLoginStartInput, AccountLoginStartResult, AccountLoginStatusInput, AccountLoginStatusResult, PermissionMode, LocalFileOpener, Settings, DispatchProviderPreferences, DispatchPreferences, DispatchProfileSnapshot, SetDispatchPreferenceInput, DispatchInput, ADOPT_THREAD_MESSAGE_MAX_CHARS, AdoptThreadInput, AdoptThreadResult, FollowUpInput, UnqueueFollowUpInput, UnqueueFollowUpResult, DeliverQueuedNowInput, DeliverQueuedNowResult, SetThreadSnoozeInput, SetThreadRecurringPromptInput, SetOwnThreadRecurringPromptInput, SetOwnThreadRecurringPromptResult, GetOwnThreadRecurringPromptInput, OwnThreadRecurringPromptResult, SetOwnThreadTimerInput, CancelOwnThreadTimerInput, ListOwnThreadTimersInput, OwnThreadTimersResult, ThreadActivityItem, ListOwnThreadActivityInput, OwnThreadActivityResult, SetOwnThreadTimerResult, CancelOwnThreadTimerResult, SetOwnThreadStopHookInput, SetOwnThreadHeartbeatInput, ThreadPluginReloadResult, ConfirmAwaitingInput, RenameThreadInput, AiRenameThreadInput, AiRenameThreadResult, SetThreadPermissionInput, SetThreadPermissionResult, ThreadProfileOptionsInput, ThreadProfileOptionsResult, SetThreadProfileInput, SetThreadProfileResult, DISPATCH_TASK_BANNER, DISPATCH_TASK_BANNER_MARKER, GithubWakeItem, GithubWakeSteer, WAKE_SCOPE, WAKE_REF, WAKE_SINGLE, WAKE_MULTI_HEAD, GithubStatus, GithubRefCard, GithubRefPreviewInput, GithubRefPreviewResult, GithubItem, GithubListInput, GithubListResult, GithubBatchInput, GithubBatchResult, BoardMeta, ServerEvent, TranscriptEdit, TranscriptTodo, TranscriptToolCall, TranscriptPart, TranscriptMessage, TranscriptPageCursor, TranscriptPage, TranscriptEarlierInput, SocketTranscriptSlug, SocketClientMsg, ProjectCard, PROJECT_ICON_MAX_BASE64_CHARS, DirectoryPickResult, ThreadLocation, FRIZZ_ROUTE_PREFIX, DEFAULT_PORT;
 var init_src = __esm({
   "packages/shared/src/index.ts"() {
     "use strict";
@@ -6467,7 +6487,15 @@ var init_src = __esm({
       command: external_exports.string().optional(),
       // ISO8601 of the shell output file's last write — "last active 6 min ago" for a quiet-but-live
       // watcher. Optional (see SubAgentView.lastActivityAt).
-      lastActivityAt: external_exports.string().optional()
+      lastActivityAt: external_exports.string().optional(),
+      // The PROVIDER's session-wide background-task handle (`bzvtnt3ig`), as distinct from `id`, which is
+      // the launch tool_use id. Both name the same shell and neither is a substitute for the other:
+      // `id` is what the two copies of a row reconcile on, and this is the handle the runtime hands the
+      // MODEL — "Command running in background with ID: bzvtnt3ig" is the only id a worker ever sees, so
+      // it is the one it registers a `shell` watcher against. Matching on `id`/`label` alone meant every
+      // such watcher was unfireable (scheduler.evalWatchers, 2026-08-14). Absent for a CODEX row, whose
+      // single `processId` IS its `id`, and for a Claude row between its tool_use and its launch ack.
+      taskId: external_exports.string().optional()
     });
     CompletionHoldOp = external_exports.object({
       label: external_exports.string(),
@@ -6504,9 +6532,12 @@ var init_src = __esm({
       title: external_exports.string().max(120)
     });
     AwaitingHint = external_exports.object({
-      kind: external_exports.enum(["pr-watch", "human", "timer", "pr", "ci", "session"]),
+      kind: external_exports.enum(["shell", "agent", "timer", "pr", "for", "reason"]),
       value: external_exports.string()
     });
+    RETIRED_AWAITING_KINDS = ["watch", "pr-watch", "human", "ci", "session"];
+    RETIRED_LINE_RE = new RegExp(`^\\s*(${RETIRED_AWAITING_KINDS.join("|")}):\\s*\\S`, "im");
+    AWAITING_FOR_MAX_MS = 24 * 60 * 60 * 1e3;
     SnoozeUntil = external_exports.string().regex(
       /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/,
       "Snooze time must be an ISO-8601 UTC instant"
@@ -6529,12 +6560,6 @@ var init_src = __esm({
       stopHook: external_exports.boolean(),
       heartbeat: external_exports.boolean(),
       postCompaction: external_exports.boolean(),
-      /** NOT a fourth trigger — a HOLD over all three. While it is on, nothing is sent for as long as the
-       *  thread is blocked on the human: an unanswered ```question fence, a native ask, or a permission
-       *  prompt. The footer panel seeds it ON for a fresh arming, with the stop hook, because they are one
-       *  intent — see scheduler.ts, "WHAT A PENDING QUESTION DOES TO ALL THREE TRIGGERS". The stored column
-       *  still defaults OFF, so an existing row and an older caller both keep the behaviour they had. */
-      pauseOnQuestions: external_exports.boolean(),
       intervalSeconds: external_exports.number().int().positive().optional(),
       armedAt: external_exports.string(),
       /** Last delivery per trigger; stamped separately so each reads its own clock. */
@@ -6547,33 +6572,154 @@ var init_src = __esm({
     TimerPromptText = external_exports.string().trim().min(1).max(TIMER_PROMPT_MAX);
     SIGNOFF_NUDGE_MARKER = "**This message is from frizz, not from the human.**";
     SIGNOFF_NUDGE_MESSAGE = [
-      `${SIGNOFF_NUDGE_MARKER} Nothing about your task has changed, and this is not a request to do more work.`,
+      `${SIGNOFF_NUDGE_MARKER} Nothing about your task has changed, and no new work is being asked of you.`,
+      "",
+      "You rested without a fence, so this thread cannot be triaged.",
+      "",
+      "**IF THE TASK STILL HAS PARTS LEFT, THE FENCE IS NOT WHAT YOU OWE \u2014 THE WORK IS.** If ANY part of the",
+      "original task is unfinished, unverified, or deferred, resume it NOW, in THIS turn, and sign off once it",
+      "is genuinely finished. A milestone, a green test run and a long turn are none of them endings, and",
+      "neither is naming the next step or writing it into a scratch file.",
+      "",
+      "**AND THAT TASK IS ALSO THE CEILING \u2014 finish it, and nothing else.** Work you notice on the way is a",
+      "FINDING TO REPORT in your sign-off, never work to take on: the bug beside the one you were sent for,",
+      "the refactor the code obviously wants, the second issue the first one touches. Widening the job is not",
+      "thoroughness \u2014 it is a different job nobody asked for, and it buries the answer they did ask for under",
+      "changes they now have to review. If it should be done, name it in one line and let the human dispatch",
+      "it.",
       "",
-      "You rested without a fence, so this thread cannot be triaged. Add one at the END of your next message:",
+      "**IF WHAT YOU WERE ASKED FOR IS A DOCUMENT, THE DOCUMENT IS THE ENDING.** A triage, a review, an",
+      "investigation, a recommendation, a plan \u2014 when that is the deliverable, the finished write-up IS the",
+      "work. Implementing what it proposes is the NEXT job, and not yours unless you were asked. Sign off with",
+      "the write-up.",
+      "",
+      "**DECIDE RATHER THAN ASK.** Stop only for a decision that is genuinely the human's AND that blocks you",
+      "right now: ask that one in a question fence. Every other open choice INSIDE the task \u2014 a name, a",
+      "default, a reversible design call \u2014 is yours to make: decide it, say in one line which way you went and",
+      "what would reverse it, and carry on. A choice that would ENLARGE the task is not one of those: an",
+      "unanswered question is not permission to go build the answer.",
+      "",
+      "Otherwise, add a fence at the END of your next message:",
       "",
       "- `` ```question `` \u2014 you need the human. One question per fence, lettered options, one recommended.",
       "- `` ```done `` \u2014 genuinely FINISHED. A DISMISSAL: the card is filed away and nobody looks again, so",
       "  if anything is still owed, it is not done. Body: 1-3 sentences, then bullets, each opening with a",
       "  **bolded verb phrase**.",
-      "- Blocked on a PR, CI, or your own background shell? Register it with `mcp__frizz__watch` and rest.",
+      "- `` ```awaiting `` \u2014 you are WAITING on work that is actually running. It is PURE STRUCTURE: one line",
+      "  per thing you are waiting on, a REQUIRED `for:` duration, and one line of `reason:` prose.",
+      "",
+      "  ```awaiting",
+      "  shell: <the id your runtime gave you>",
+      "  pr: owner/repo#123",
+      "  for: 2h",
+      "  reason: what you are waiting for, in one line",
+      "  ```",
+      "",
+      "  Frizz CHECKS every line: name something that is not running and you are bumped rather than parked.",
+      "  A fence that names NOTHING is not a park at all \u2014 if you are not waiting on anything, you are not",
+      "  awaiting, you are done. Register a PR with `mcp__frizz__watch_pr` and a timer with",
+      "  `mcp__frizz__timer`; `mcp__frizz__activity` reads back everything you have running, with its id.",
+      "",
+      "**STILL OWED counts things you are not going to do yourself.** A decision you are RECOMMENDING, a",
+      "draft you wrote but did not send, follow-up work you discovered \u2014 all of it dies with the card, even",
+      "the part that is someone else's to do. Each ends on a question with your recommendation as option A,",
+      "or gets its own card first via `mcp__frizz__spawn_thread`; none of them is a `done`. And what is not",
+      'worth a card is not worth a SENTENCE: delete the dangling "one thing to carry forward", never park it',
+      "in the handoff.",
       "",
       "**DO NOT REPEAT YOURSELF.** If the message you just wrote already stands on its own, reply with the",
       "fence ALONE \u2014 the human reads both together, so restating it costs them the second read for nothing.",
+      "The same holds inside one message: the card is the ledger of what shipped, the prose is only what a",
+      "ledger cannot hold, and a sentence that reads the same in either belongs in exactly one of them.",
       "",
       "Only if it does NOT stand alone, fix that first, briefly. It has to be readable cold: the human has",
       "seen nothing since their own last message \u2014 the Goal, this reminder, a watcher wake all came from",
       "frizz \u2014 so anything you assumed they had followed, they have not."
     ].join("\n");
     ThreadWatchKind = external_exports.enum(["shell", "github"]);
-    RegisterableThreadWatchKind = external_exports.enum(["shell"]);
-    ThreadWatchTarget = external_exports.string().trim().min(1).max(200);
+    GithubChecksState = external_exports.enum(["none", "running", "passing", "failing"]);
+    GithubMergeState = external_exports.enum(["mergeable", "blocked", "conflicting", "unknown"]);
+    GithubWatchStatus = external_exports.object({
+      checks: GithubChecksState,
+      /** The counts behind the verdict, so the card can say "3 running, 12 passed" the way GitHub does
+       *  rather than only "checks are running". */
+      running: external_exports.number().int().nonnegative(),
+      passed: external_exports.number().int().nonnegative(),
+      failed: external_exports.number().int().nonnegative(),
+      /** The failing job NAMES, capped — what a human actually needs to decide whether to look. */
+      failing: external_exports.array(external_exports.string()).max(8).default([]),
+      merge: GithubMergeState,
+      /** OPEN | CLOSED | MERGED, lowercased. A merged or closed PR ends the wait outright. */
+      state: external_exports.enum(["open", "closed", "merged"]),
+      /** When frizz last heard from GitHub. A poll can fail or be rate-limited, and a stale reading stated
+       *  as current is worse than no reading. */
+      polledAt: external_exports.string(),
+      /** The head commit this verdict was reached on. A PR watcher reports a CI verdict when it is NEWS, and
+       *  "red again on a new commit" is news that the bare word `failing` cannot express. Optional because a
+       *  reading taken before 2026-08-17 carries none. */
+      head: external_exports.string().optional(),
+      /** A digest of WHICH jobs are failing right now. The head commit alone cannot express a re-run of the
+       *  same job, or a slower job going red after the first — both of which are a second failure the worker
+       *  must hear about. Empty when nothing is failing. */
+      failureSig: external_exports.string().optional()
+    }).strict();
     ThreadWatchView = external_exports.object({
       id: external_exports.string(),
       kind: ThreadWatchKind,
       target: external_exports.string(),
       state: external_exports.enum(["armed", "fired", "dropped"]),
-      createdAt: external_exports.string()
+      createdAt: external_exports.string(),
+      /** `github` rows only, and absent until the first successful poll. */
+      github: GithubWatchStatus.optional()
+    }).strict();
+    PR_WATCH_DEFAULT_FOR_MS = 6 * 60 * 60 * 1e3;
+    PrWatchView = external_exports.object({
+      id: external_exports.string(),
+      /** `owner/repo#N`, normalized — the same string the board's row and the status book are keyed by. */
+      target: external_exports.string(),
+      state: external_exports.enum(["armed", "dropped", "settled"]),
+      createdAt: external_exports.string(),
+      /** The PR's checks/mergeability as the poller last saw it. Absent until the first successful poll. */
+      github: GithubWatchStatus.optional()
     }).strict();
+    AddOwnPrWatchInput = external_exports.object({
+      slug: ThreadSlug,
+      /** `owner/repo#123` or a PR URL. Parsed server-side; an unparseable ref is refused rather than stored,
+       *  because a watcher that can never fire is worse than none — the worker rests believing it is covered. */
+      target: external_exports.string().trim().min(1).max(200),
+      /** How long to watch, as a DURATION (`30m`, `2h`, `3d` — parseAwaitingDuration).
+       *
+       *  A PR nobody ever reviews would otherwise be polled forever, and a thread parked on it would wait
+       *  forever with it — the same unbounded wait the awaiting fence's `for:` closes, one level down. A
+       *  duration rather than an instant for the same reason it is one there: it cannot be written in the
+       *  past (maintainer 2026-08-15, asking for it explicitly).
+       *
+       *  REQUIRED BY THE TOOL, OPTIONAL ON THE WIRE, and the asymmetry is deliberate. A worker's MCP server
+       *  outlives every frizz restart, so a session dispatched before this existed still holds a binary that
+       *  cannot send it — and making the RPC reject that would break `watch_pr` outright for every thread
+       *  already running, with no recourse from inside those threads. Absent ⇒ PR_WATCH_DEFAULT_FOR, which
+       *  still BOUNDS the poll; the point of the field is that a worker chooses, and one that cannot choose
+       *  is better bounded than broken. */
+      for: external_exports.string().trim().min(1).max(16).optional()
+    }).strict();
+    AddOwnPrWatchResult = external_exports.object({
+      id: external_exports.string(),
+      target: external_exports.string(),
+      /** True when this exact PR was ALREADY watched by this thread, so the call registered nothing new.
+       *  Re-registering after a compaction is the common case, and a duplicate would double every wake. */
+      alreadyArmed: external_exports.boolean(),
+      watches: external_exports.array(PrWatchView)
+    }).strict();
+    DropOwnPrWatchInput = external_exports.object({
+      slug: ThreadSlug,
+      id: external_exports.string().min(1).max(64)
+    }).strict();
+    DropOwnPrWatchResult = external_exports.object({
+      dropped: external_exports.boolean(),
+      watches: external_exports.array(PrWatchView)
+    }).strict();
+    ListOwnPrWatchesInput = external_exports.object({ slug: ThreadSlug }).strict();
+    OwnPrWatchesResult = external_exports.object({ watches: external_exports.array(PrWatchView) }).strict();
     ThreadTimerView = external_exports.object({
       id: external_exports.string(),
       prompt: external_exports.string(),
@@ -6731,6 +6877,16 @@ var init_src = __esm({
       // AUTO-bump (the scheduler resumes the agent with exactly this text) rather than a reminder, which is
       // the distinction the held row's tooltip renders. Absent ⇒ the card merely re-surfaces.
       snoozePrompt: external_exports.string().optional(),
+      /** The EVENT snooze on the resting card is armed for this exact rest — the human has said "hide this
+       *  until something reports". Distinct from `snoozedUntil`, which is a wall-clock park on the whole
+       *  thread: this one has no deadline and clears itself when the thread comes to a NEW rest.
+       *
+       *  It travels because the chat has to honour it too (2026-08-14). Until then only the QUEUE did, on
+       *  the reasoning that the card states a FACT the drawer must keep showing or it blanks at rest and
+       *  reads as "the agent died". That reasoning holds for a thread nobody has parked; once the human has
+       *  explicitly parked THIS rest, showing them the same card with the same button one surface over is
+       *  not information, and they said so. */
+      bgSnoozed: external_exports.boolean().optional(),
       // Which Claude transport serves this thread: "broker" = a session-broker-owned Agent SDK session
       // (typed control channel), "tmux" = the interactive TUI in a pane. Only the broker can be asked to
       // reload its plugin closure in place, so the board needs it to decide whether to offer that verb at
@@ -6848,6 +7004,13 @@ var init_src = __esm({
       // Optional so a pre-restart server keeps working; absent means "fall back to `/`", i.e. the old
       // behaviour. Registry-derived, so it is the same slug every other surface links to.
       projectSlug: external_exports.string().optional(),
+      // The server's home directory — the expansion of a `~` a worker wrote in prose. Agents reference
+      // files that way constantly (`~/.claude/CLAUDE.md`), and the browser has no way to derive it, so a
+      // `~`-anchored Markdown link had no absolute path to become and stayed a same-origin anchor that
+      // navigated out of Frizz. The client only ever uses it to build a path it then hands BACK to the
+      // server, which realpath-gates it exactly as it gates one the author typed in full. Optional so a
+      // pre-restart server keeps working; absent means `~` links stay unresolved, i.e. the old behaviour.
+      homeDir: external_exports.string().optional(),
       // (No `.frizz/ exists` bit here on purpose. Threads are session-first — the ui.db registry IS the
       // board — so `.frizz/` presence says nothing about whether this project has one. Its only consumer
       // was a shell gate that dead-ended `.frizz`-less repos; the server still probes the directory
@@ -6954,13 +7117,23 @@ var init_src = __esm({
       // Default action for a vetted non-image local path in agent markdown. Image clicks always use the
       // OS default viewer so screenshots retain their expected behavior.
       localFileOpener: LocalFileOpener.optional(),
-      // GitHub batch-dispatch prompt templates (the picker's per-item worker prompt). Optional: when
-      // unset OR blank the server falls back to its exported DEFAULT_ISSUE_PROMPT / DEFAULT_PR_PROMPT.
-      // Substitution tokens the server fills: {repo} {n} {title} {url} {labels} {body}. The leading
-      // `THREAD: <slug>` tag is prepended by the server (not part of the editable template) so a custom
-      // prompt can never break the thread↔.frizz-file binding. Optional so old settings blobs parse.
-      githubIssuePrompt: external_exports.string().optional(),
-      githubPrPrompt: external_exports.string().optional()
+      // The GitHub batch-dispatch prompt template (the picker's per-item worker prompt). Optional: when
+      // unset OR blank the server falls back to its exported DEFAULT_GITHUB_PROMPT. Substitution tokens
+      // the server fills: {repo} {n} {title} {url} {labels} {body}. The leading `THREAD: <slug>` tag is
+      // prepended by the server (not part of the editable template) so a custom prompt can never break the
+      // thread↔.frizz-file binding. Optional so old settings blobs parse.
+      //
+      // ONE field, not one per kind. Issue and PR each had their own template until 2026-08-15, and the two
+      // said the same thing twice: read the whole thread, be skeptical, cite what you checked, post nothing.
+      // A person tuning "be more dubious" had to make the same edit in two boxes and keep them in step. The
+      // ONE thing that genuinely differs per kind — which `gh` command reads the item — is a line in the
+      // metadata block, so the merged template just carries both, and the worker picks the one that applies.
+      //
+      // There is no migration off the two old keys, and that is deliberate (the maintainer's call): Settings
+      // is a non-strict z.object, so `githubIssuePrompt`/`githubPrPrompt` are STRIPPED the moment an old
+      // blob is parsed. Any existing override is dropped and the reader gets the new shipped default —
+      // exactly the intended backfill. Merging two customized templates into one has no correct answer.
+      githubPrompt: external_exports.string().optional()
     });
     DispatchProviderPreferences = external_exports.object({
       model: external_exports.string().trim().min(1).max(200).optional(),
@@ -7089,9 +7262,6 @@ var init_src = __esm({
       // so a client that predates it — an older tab, an older MCP server — keeps writing the row correctly
       // with the trigger off, which is the honest reading of a caller that has never heard of it.
       postCompaction: external_exports.boolean().default(false),
-      // The QUESTION HOLD (2026-08-11). Defaulted for the same reason as the trigger above: a caller that
-      // has never heard of it means "don't hold", which is also this option's own default.
-      pauseOnQuestions: external_exports.boolean().default(false),
       intervalSeconds: RecurringIntervalSeconds.optional()
     }).strict();
     SetOwnThreadRecurringPromptInput = external_exports.object({
@@ -7103,8 +7273,14 @@ var init_src = __esm({
       // so a client that predates it — an older tab, an older MCP server — keeps writing the row correctly
       // with the trigger off, which is the honest reading of a caller that has never heard of it.
       postCompaction: external_exports.boolean().default(false),
-      // The QUESTION HOLD (2026-08-11), defaulted exactly as the trigger above and for the same reason.
-      pauseOnQuestions: external_exports.boolean().default(false),
+      /** ACCEPTED AND IGNORED. The question hold was deleted 2026-08-16 (see scheduler.ts) and no caller in
+       *  this repo sends it any more — but this object is `.strict()`, and the caller on the other end is a
+       *  DETACHED worker daemon holding the `frizz-mcp.mjs` it was spawned with. Those outlive a server
+       *  restart by design, so for as long as any pre-2026-08-16 worker is alive a `start` would otherwise
+       *  come back as a validation error on a field the model cannot see it is sending. Tolerated here rather
+       *  than in the router so the shape stays one declaration; delete it once no such worker can be running.
+       *  The BROWSER input above needs no such clause — a stale tab is one reload away. */
+      pauseOnQuestions: external_exports.boolean().optional(),
       intervalSeconds: RecurringIntervalSeconds.optional()
     }).strict();
     SetOwnThreadRecurringPromptResult = external_exports.object({
@@ -7131,6 +7307,23 @@ var init_src = __esm({
     OwnThreadTimersResult = external_exports.object({
       timers: external_exports.array(ThreadTimerView)
     }).strict();
+    ThreadActivityItem = external_exports.object({
+      kind: external_exports.enum(["shell", "agent", "timer", "pr"]),
+      /** The string a `<kind>:` fence line must carry. For a shell that is the runtime task id the worker
+       *  was shown; for a PR, `owner/repo#N`; for a timer, its `tmr_…` row id. */
+      id: external_exports.string(),
+      label: external_exports.string(),
+      /** ISO8601 of when it started or was armed — absent when frizz has no instant for it. */
+      since: external_exports.string().optional(),
+      /** A timer's fire instant, or a PR's expiry. Absent for shells and sub-agents. */
+      until: external_exports.string().optional()
+    }).strict();
+    ListOwnThreadActivityInput = external_exports.object({
+      slug: ThreadSlug
+    }).strict();
+    OwnThreadActivityResult = external_exports.object({
+      activity: external_exports.array(ThreadActivityItem)
+    }).strict();
     SetOwnThreadTimerResult = external_exports.object({
       id: external_exports.string(),
       fireAt: external_exports.string(),
@@ -7140,49 +7333,6 @@ var init_src = __esm({
       cancelled: external_exports.boolean(),
       timers: external_exports.array(ThreadTimerView)
     }).strict();
-    AddOwnThreadWatchInput = external_exports.object({
-      slug: ThreadSlug,
-      // REGISTERABLE kinds only, which is `shell` and nothing else — deliberately narrower than
-      // `ThreadWatchKind`, whose `github` member is a board-derived VIEW row with no registration behind it.
-      // The MCP tool already refuses a PR here in words ("a pr wait does not belong here — use an ```awaiting
-      // fence"); this is the same refusal at the wire, where it cannot be talked past.
-      kind: RegisterableThreadWatchKind,
-      target: ThreadWatchTarget,
-      /** The worker is BLOCKING on this one inside its tool call, so the scheduler settles it silently
-       *  instead of delivering a wake — see the column comment in storage.ts. Defaulted, so a caller that
-       *  has never heard of it registers an ordinary background watch. */
-      foreground: external_exports.boolean().default(false)
-    }).strict();
-    PromoteOwnThreadWatchInput = external_exports.object({
-      slug: ThreadSlug,
-      id: external_exports.string().min(1).max(64)
-    }).strict();
-    PromoteOwnThreadWatchResult = external_exports.object({
-      promoted: external_exports.boolean(),
-      watches: external_exports.array(ThreadWatchView)
-    }).strict();
-    DropOwnThreadWatchInput = external_exports.object({
-      slug: ThreadSlug,
-      id: external_exports.string().min(1).max(64)
-    }).strict();
-    ListOwnThreadWatchesInput = external_exports.object({
-      slug: ThreadSlug
-    }).strict();
-    OwnThreadWatchesResult = external_exports.object({
-      watches: external_exports.array(ThreadWatchView)
-    }).strict();
-    AddOwnThreadWatchResult = external_exports.object({
-      id: external_exports.string(),
-      /** True when this exact (kind, target) was ALREADY armed on the thread, so the call registered
-       *  nothing new. A worker re-registering after a compaction is the common case, and silently minting a
-       *  duplicate would mean two wakes for one event. */
-      alreadyArmed: external_exports.boolean(),
-      watches: external_exports.array(ThreadWatchView)
-    }).strict();
-    DropOwnThreadWatchResult = external_exports.object({
-      dropped: external_exports.boolean(),
-      watches: external_exports.array(ThreadWatchView)
-    }).strict();
     SetOwnThreadStopHookInput = external_exports.object({
       slug: ThreadSlug,
       prompt: RecurringPromptText.nullable(),
@@ -7285,6 +7435,43 @@ ${DISPATCH_TASK_BANNER}
       nameWithOwner: external_exports.string().nullable(),
       authed: external_exports.boolean()
     });
+    GithubRefCard = external_exports.object({
+      ref: external_exports.string(),
+      kind: external_exports.enum(["issue", "pr", "commit"]),
+      repo: external_exports.string(),
+      // owner/repo, for the card's header line
+      url: external_exports.string(),
+      title: external_exports.string(),
+      body: external_exports.string(),
+      // already truncated server-side to the card's excerpt budget
+      state: external_exports.string(),
+      // OPEN | CLOSED | MERGED | DRAFT — empty for a commit, which has no state
+      stateReason: external_exports.string().optional(),
+      // COMPLETED | NOT_PLANNED | REOPENED — GitHub's closed-issue nuance
+      at: external_exports.string().optional(),
+      // ISO: opened-at for an issue/PR, committed-at for a commit
+      authorLogin: external_exports.string().optional(),
+      authorName: external_exports.string().optional(),
+      // commits carry a git author name with no GitHub account behind it
+      authorAvatar: external_exports.string().optional(),
+      labels: external_exports.array(external_exports.object({ name: external_exports.string(), color: external_exports.string() })).default([]),
+      additions: external_exports.number().int().nonnegative().optional(),
+      deletions: external_exports.number().int().nonnegative().optional(),
+      changedFiles: external_exports.number().int().nonnegative().optional(),
+      comments: external_exports.number().int().nonnegative().optional(),
+      // Epoch ms of the fetch this card came from. The CLIENT owns the freshness decision (render the
+      // cached card instantly, then revalidate if it is old), so it has to be able to see the age.
+      fetchedAt: external_exports.number().int().nonnegative()
+    });
+    GithubRefPreviewInput = external_exports.object({
+      refs: external_exports.array(external_exports.string().min(3).max(120)).min(1).max(100),
+      refresh: external_exports.boolean().default(false)
+    });
+    GithubRefPreviewResult = external_exports.object({
+      cards: external_exports.array(GithubRefCard),
+      missing: external_exports.array(external_exports.string()),
+      error: external_exports.string().optional()
+    });
     GithubItem = external_exports.object({
       kind: external_exports.enum(["issue", "pr"]),
       number: external_exports.number().int().positive(),
@@ -7951,6 +8138,7 @@ var init_local_image = __esm({
 });
 
 // src/production.ts
+init_local_origin();
 import { readFileSync as readFileSync10 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
@@ -8625,6 +8813,7 @@ ${SYNC_END}`);
       }),
       // Yellow, above the dim hint: exposing the board off loopback is the one launch outcome the
       // operator must not skim past, so it may not share the hint's low-contrast styling.
+      ...options2.qr?.length ? ["", ...options2.qr.map((row) => `  ${row}`)] : [],
       ...options2.warning ? ["", `  ${this.c(ANSI.yellow, options2.warning)}`] : [],
       ...hint ? ["", `  ${this.c(ANSI.dim, hint)}`] : [],
       ""
@@ -8801,6 +8990,7 @@ function parseCliArgs(argv) {
     "--detach",
     "--stop",
     "--status",
+    "--link",
     "--help",
     "-h",
     "--dev",
@@ -8832,6 +9022,7 @@ function parseCliArgs(argv) {
     // Retain the option in the parsed shape for callers, but normal frizz-dev is always attached.
     foreground: true,
     stop: args2.has("--stop"),
+    link: args2.has("--link"),
     status: args2.has("--status"),
     help: args2.has("--help") || args2.has("-h"),
     dev: args2.has("--dev"),
@@ -8844,6 +9035,7 @@ function parseCliArgs(argv) {
   };
 }
 var EXPOSED_WARNING = "Anyone who can reach this address can run commands on this machine as you. Frizz has no login \u2014 only do this on a network you trust.";
+var REUSED_NETWORK_FLAGS_WARNING = "This joined the Frizz already running on this machine, so --host/--public-origin were ignored. Stop it first (frizz --stop) and relaunch with the flag to change how the board is reached.";
 var PUBLIC_ORIGIN_WARNING = "Frizz has no login of its own, so whatever sits in front of this origin IS the access control. Require authentication there (Cloudflare Access, Tailscale) \u2014 an unauthenticated tunnel lets anyone with the URL run commands on this machine as you.";
 function resolveBindSelection(options2, env = process.env) {
   const fromEnv = env.FRIZZ_HOST?.trim();
@@ -8854,7 +9046,14 @@ function resolveBindSelection(options2, env = process.env) {
   ]);
   const publicOriginRaw = options2.publicOrigin ?? env.FRIZZ_PUBLIC_ORIGIN?.trim();
   const publicOrigin = publicOriginRaw ? normalizePublicOrigin(publicOriginRaw) : void 0;
-  return { host, exposed: bindHostIsExposed(host), allowedHosts, ...publicOrigin ? { publicOrigin } : {} };
+  const publicToken = publicOrigin ? env.FRIZZ_PUBLIC_TOKEN?.trim() || void 0 : void 0;
+  return {
+    host,
+    exposed: bindHostIsExposed(host),
+    allowedHosts,
+    ...publicOrigin ? { publicOrigin } : {},
+    ...publicToken ? { publicToken } : {}
+  };
 }
 function boardAddress(url) {
   return url.includes("?") || url.endsWith("/") ? url : `${url}/`;
@@ -9140,16 +9339,129 @@ import { basename as basename6, dirname as dirname7, extname as extname2, isAbso
 import { fileURLToPath } from "node:url";
 import watcher from "@parcel/watcher";
 
+// packages/server/src/restart-supervisor.ts
+import { request as requestHttp, createServer as createServer2 } from "node:http";
+import { connect } from "node:net";
+
+// packages/server/src/access-codes.ts
+import { randomBytes, timingSafeEqual, createHmac } from "node:crypto";
+var CODE_BYTES = 16;
+var SESSION_BYTES = 32;
+var DEFAULT_CODE_TTL_MS = 5 * 6e4;
+var DEFAULT_SESSION_TTL_MS = 365 * 24 * 60 * 6e4;
+function defaultRandomToken(bytes) {
+  return randomBytes(bytes).toString("base64url");
+}
+function secretsMatch(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+var AccessStore = class {
+  codes = /* @__PURE__ */ new Map();
+  options;
+  /** Signing key for sessions. Persisted by the caller; a fresh one signs every device out. */
+  signingKey;
+  constructor(options2 = {}) {
+    this.signingKey = options2.signingKey ?? randomBytes(32);
+    this.options = {
+      codeTtlMs: options2.codeTtlMs ?? DEFAULT_CODE_TTL_MS,
+      sessionTtlMs: options2.sessionTtlMs ?? DEFAULT_SESSION_TTL_MS,
+      now: options2.now ?? Date.now,
+      randomToken: options2.randomToken ?? defaultRandomToken,
+      onConsumed: options2.onConsumed
+    };
+  }
+  /** Mint a code to show as a QR or a link. Minting does not invalidate codes already outstanding. */
+  issue() {
+    this.sweep();
+    const now = this.options.now();
+    const code = {
+      code: this.options.randomToken(CODE_BYTES),
+      createdAt: now,
+      expiresAt: now + this.options.codeTtlMs
+    };
+    this.codes.set(code.code, code);
+    return { code: code.code, createdAt: code.createdAt, expiresAt: code.expiresAt };
+  }
+  /**
+   * Trade a code for a session, at most once, ever.
+   *
+   * The consumed marker is set BEFORE anything else can observe success, and JS runs this method to
+   * completion without interleaving, so two browsers racing the same code cannot both win. That
+   * atomicity is what makes "single-use" true rather than aspirational — it is the first thing the
+   * tests attack.
+   */
+  redeem(code) {
+    if (!code) return { ok: false, reason: "unknown" };
+    const stored = this.codes.get(code);
+    if (!stored || !secretsMatch(stored.code, code)) return { ok: false, reason: "unknown" };
+    const now = this.options.now();
+    if (stored.consumedAt !== void 0) return { ok: false, reason: "already-used" };
+    if (now >= stored.expiresAt) {
+      this.sweep();
+      return { ok: false, reason: "expired" };
+    }
+    stored.consumedAt = now;
+    this.sweep();
+    this.options.onConsumed?.(code);
+    return { ok: true, session: this.mintSession(now), expiresAt: now + this.options.sessionTtlMs };
+  }
+  /**
+   * A session is `<expiry>.<hmac>` — stateless, so it needs no server-side table, and signed with a key
+   * the caller persists so it survives a restart. Self-describing expiry means a stale cookie is
+   * rejected without a lookup, and rotating the key revokes every outstanding session at once.
+   */
+  mintSession(now) {
+    const expiresAt = now + this.options.sessionTtlMs;
+    const nonce = this.options.randomToken(SESSION_BYTES);
+    const payload = `${expiresAt}.${nonce}`;
+    return `${payload}.${this.sign(payload)}`;
+  }
+  sign(payload) {
+    return createHmac("sha256", this.signingKey).update(payload).digest("base64url");
+  }
+  /** Is this cookie a session signed by this board's key, and still in date? */
+  verifySession(session) {
+    if (!session) return false;
+    const cut = session.lastIndexOf(".");
+    if (cut <= 0) return false;
+    const payload = session.slice(0, cut);
+    const signature = session.slice(cut + 1);
+    if (!secretsMatch(signature, this.sign(payload))) return false;
+    const expiresAt = Number(payload.slice(0, payload.indexOf(".")));
+    return Number.isFinite(expiresAt) && this.options.now() < expiresAt;
+  }
+  /**
+   * Drop codes past their expiry so a long-lived board does not accumulate them forever.
+   *
+   * A CONSUMED code is deliberately kept until that same expiry rather than deleted on use. Deleting it
+   * immediately would make a replay indistinguishable from a typo — both "unknown" — and the difference
+   * matters: "already-used" is the message that tells someone their link was used by somebody else.
+   * It costs one small entry for at most the code TTL.
+   */
+  sweep() {
+    const now = this.options.now();
+    for (const [key, stored] of this.codes) {
+      if (now >= stored.expiresAt) this.codes.delete(key);
+    }
+  }
+  /** Outstanding codes that could still be redeemed — neither consumed nor expired. */
+  outstanding() {
+    this.sweep();
+    return [...this.codes.values()].filter((stored) => stored.consumedAt === void 0).map(({ code, createdAt, expiresAt }) => ({ code, createdAt, expiresAt }));
+  }
+};
+
 // packages/server/src/restart-supervisor.ts
 init_local_origin();
 init_local_image();
 init_src();
-import { request as requestHttp, createServer as createServer2 } from "node:http";
-import { connect } from "node:net";
 var SUPERVISOR_CONTROL_PREFIX = "/_frizz/control";
 var SUPERVISOR_RESTART_PATH = `${SUPERVISOR_CONTROL_PREFIX}/restart`;
 var SUPERVISOR_UPDATE_RESTART_PATH = `${SUPERVISOR_CONTROL_PREFIX}/update-restart`;
 var SUPERVISOR_STATUS_PATH = `${SUPERVISOR_CONTROL_PREFIX}/status`;
+var SUPERVISOR_ACCESS_CODE_PATH = `${SUPERVISOR_CONTROL_PREFIX}/access-code`;
 var SUPERVISOR_CONTROL_PROTOCOL = 1;
 function responseJson(res, status, value) {
   res.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" });
@@ -9168,9 +9480,27 @@ function proxyHeaders(req, childPort, vouchSameOrigin = false) {
   delete headers.connection;
   return headers;
 }
+var PUBLIC_TOKEN_PARAM = "frizz_token";
+var ACCESS_CODE_PARAM = "frizz_code";
+var PUBLIC_TOKEN_COOKIE = "frizz_public";
+var SESSION_COOKIE = "frizz_session";
+var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+function readCookie(header, name) {
+  if (!header) return void 0;
+  for (const pair of header.split(";")) {
+    const eq = pair.indexOf("=");
+    if (eq === -1) continue;
+    if (pair.slice(0, eq).trim() === name) return pair.slice(eq + 1).trim();
+  }
+  return void 0;
+}
+function unauthorizedPage(reason) {
+  const detail = reason === "already-used" ? "That link has already been used. Generate a fresh one." : reason === "expired" ? "That link expired. Generate a fresh one." : "This address needs a current access link.";
+  return `<!doctype html><meta charset="utf-8"><title>Unauthorized</title><meta name="viewport" content="width=device-width,initial-scale=1"><style>body{margin:3rem;font:16px system-ui;color:#e7e7e7;background:#171717}main{max-width:30rem;padding:1.5rem;border:1px solid #444;border-radius:.75rem;background:#222}</style><main><h1>Unauthorized</h1>${detail ? `<p>${detail}</p>` : ""}</main>`;
+}
 function isControlRequest(req) {
   const url = new URL(req.url ?? "/", "http://frizz.invalid");
-  return url.pathname === SUPERVISOR_RESTART_PATH || url.pathname === SUPERVISOR_UPDATE_RESTART_PATH || url.pathname === SUPERVISOR_STATUS_PATH;
+  return url.pathname === SUPERVISOR_RESTART_PATH || url.pathname === SUPERVISOR_UPDATE_RESTART_PATH || url.pathname === SUPERVISOR_STATUS_PATH || url.pathname === SUPERVISOR_ACCESS_CODE_PATH;
 }
 function isLocalImageRequest(req) {
   if (req.method !== "GET" && req.method !== "HEAD") return false;
@@ -9192,17 +9522,40 @@ var RestartSupervisorProxy = class {
    * judged here first.
    */
   policy;
+  /**
+   * Codes and sessions for the public origin, or null when no public origin is declared (loopback-only
+   * boards are never gated, so there is nothing to store).
+   */
+  access;
   /** Both halves of every live upgraded pair, so close() can actually finish. See close(). */
   upgradedSockets = /* @__PURE__ */ new Set();
   constructor(options2) {
     this.options = options2;
     this.host = options2.host ?? LOOPBACK_BIND_HOST;
+    this.access = options2.publicOrigin ? new AccessStore({
+      onConsumed: () => options2.onCodeConsumed?.(),
+      ...options2.sessionKey ? { signingKey: options2.sessionKey } : {}
+    }) : null;
     this.policy = {
       exposed: bindHostIsExposed(this.host),
       allowedHosts: options2.allowedHosts ?? [],
       ...options2.publicOrigin ? { publicOrigin: options2.publicOrigin } : {}
     };
   }
+  /**
+   * Mint a single-use code for this board, or null when no public origin is declared.
+   *
+   * Issuing does NOT invalidate codes already outstanding — pressing the key twice, or two people
+   * asking at once, must not silently break the first QR somebody is still walking towards.
+   */
+  issueAccessCode() {
+    return this.access?.issue() ?? null;
+  }
+  /** The full URL to show as a link or a QR. */
+  accessUrl(code) {
+    const origin = this.options.publicOrigin;
+    return origin ? `${origin}/?${ACCESS_CODE_PARAM}=${encodeURIComponent(code)}` : null;
+  }
   async listen() {
     if (this.server) return;
     const server = createServer2((req, res) => this.handle(req, res));
@@ -9316,6 +9669,26 @@ var RestartSupervisorProxy = class {
       res.end("Forbidden");
       return;
     }
+    if (pathname === SUPERVISOR_ACCESS_CODE_PATH) {
+      if (this.arrivedPublicly(req)) {
+        res.writeHead(403);
+        res.end("Forbidden");
+        return;
+      }
+      if (req.method !== "POST") {
+        res.writeHead(405, { allow: "POST" });
+        res.end();
+        return;
+      }
+      const link = this.issueAccessCode();
+      const url = link && this.accessUrl(link.code);
+      if (!link || !url) {
+        responseJson(res, 409, { error: "this board has no public origin, so there is nothing to link to" });
+        return;
+      }
+      responseJson(res, 200, { url, expiresAt: link.expiresAt });
+      return;
+    }
     if (pathname === SUPERVISOR_STATUS_PATH && req.method === "GET") {
       responseJson(res, 200, { protocol: SUPERVISOR_CONTROL_PROTOCOL, ...this.status() });
       return;
@@ -9365,11 +9738,93 @@ var RestartSupervisorProxy = class {
     });
     res.end(req.method === "HEAD" ? void 0 : result.body);
   }
+  /**
+   * Is this request arriving as the declared public origin rather than over loopback?
+   *
+   * The token gate keys on this and not on "is the port exposed", because the two are independent:
+   * a tunnelled board stays bound to 127.0.0.1 while being reachable from the internet by name.
+   */
+  arrivedPublicly(req) {
+    const declared = this.options.publicOrigin;
+    if (!declared) return false;
+    const host = parseLocalHost(req.headers.host, this.options.port, this.policy);
+    return !!host && !LOOPBACK_HOSTNAMES.has(host.hostname);
+  }
+  /**
+   * Bearer check for the public origin. Two ways in: the cookie the exchange below sets, or the
+   * one-time `?frizz_token=` in the URL the operator was handed at launch.
+   *
+   * Compared with `timingSafeEqual` on equal-length buffers — a plain `===` on a secret leaks its
+   * prefix to a patient attacker, and this secret is the only thing between the internet and a shell.
+   */
+  /**
+   * Is this request carrying a session this process minted?
+   *
+   * Sessions only. A raw `?frizz_code=` is NOT accepted here — it is redeemed once by exchangeCode()
+   * below and traded for a session, so a code that has already been spent cannot keep working just by
+   * staying in somebody's URL bar.
+   */
+  sessionAccepted(req) {
+    if (!this.access) return true;
+    if (this.options.publicToken && this.legacyTokenAccepted(req)) return true;
+    return this.access.verifySession(readCookie(req.headers.cookie, SESSION_COOKIE));
+  }
+  /**
+   * The standing `FRIZZ_PUBLIC_TOKEN`, for headless boxes where nobody can press a key to mint a code.
+   * Deliberately kept as a separate, opt-in path rather than folded into sessions: it has the weaker
+   * properties (never rotates, every copy stays valid) and the readout says so.
+   */
+  legacyTokenAccepted(req) {
+    const expected2 = this.options.publicToken;
+    if (!expected2) return false;
+    const url = new URL(req.url ?? "/", "http://frizz.invalid");
+    const supplied = url.searchParams.get(PUBLIC_TOKEN_PARAM) ?? readCookie(req.headers.cookie, PUBLIC_TOKEN_COOKIE);
+    return !!supplied && secretsMatch(supplied, expected2);
+  }
+  /**
+   * Trade `?frizz_code=…` (or the legacy `?frizz_token=…`) for a cookie, then bounce to the same URL
+   * without the secret, so it never lands in history, a Referer header, or a screenshot.
+   */
+  exchangeCode(req, res) {
+    const url = new URL(req.url ?? "/", "http://frizz.invalid");
+    const code = url.searchParams.get(ACCESS_CODE_PARAM);
+    const legacy = url.searchParams.get(PUBLIC_TOKEN_PARAM);
+    if (code === null && legacy === null) return false;
+    let cookie;
+    if (code !== null) {
+      const redeemed = this.access?.redeem(code);
+      if (!redeemed?.ok) {
+        res.writeHead(401, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+        res.end(unauthorizedPage(redeemed?.reason));
+        return true;
+      }
+      cookie = `${SESSION_COOKIE}=${redeemed.session}`;
+    } else {
+      if (!this.legacyTokenAccepted(req)) return false;
+      cookie = `${PUBLIC_TOKEN_COOKIE}=${this.options.publicToken}`;
+    }
+    url.searchParams.delete(ACCESS_CODE_PARAM);
+    url.searchParams.delete(PUBLIC_TOKEN_PARAM);
+    const target2 = `${url.pathname}${url.search}${url.hash}` || "/";
+    res.writeHead(302, {
+      location: target2,
+      "set-cookie": `${cookie}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=31536000`,
+      "cache-control": "no-store"
+    });
+    res.end();
+    return true;
+  }
   handle(req, res) {
     if (isControlRequest(req)) {
       void this.handleControl(req, res);
       return;
     }
+    if (this.arrivedPublicly(req) && this.exchangeCode(req, res)) return;
+    if (this.arrivedPublicly(req) && !this.sessionAccepted(req)) {
+      res.writeHead(401, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+      res.end(unauthorizedPage());
+      return;
+    }
     if (!this.authorityAccepted(req)) {
       res.writeHead(403, { "content-type": "text/plain; charset=UTF-8" });
       res.end("Forbidden");
@@ -9403,6 +9858,10 @@ var RestartSupervisorProxy = class {
     req.pipe(upstream);
   }
   handleUpgrade(req, socket, head) {
+    if (this.arrivedPublicly(req) && !this.sessionAccepted(req)) {
+      rejectWebSocketUpgrade(socket, 401, "Unauthorized");
+      return;
+    }
     if (!this.authorityAccepted(req, false)) {
       socket.destroy();
       return;
@@ -9705,6 +10164,9 @@ var Supervisor = class {
       host: opts.host,
       allowedHosts: opts.allowedHosts,
       publicOrigin: opts.publicOrigin,
+      publicToken: opts.publicToken,
+      onCodeConsumed: opts.onCodeConsumed,
+      sessionKey: opts.sessionKey,
       childPort: () => this.childPort,
       restart: () => this.restartFromBrowser(),
       updateRestart: this.updateRestart ? () => this.updateFromBrowser() : void 0,
@@ -9727,6 +10189,13 @@ var Supervisor = class {
   currentBoot() {
     return this.boot;
   }
+  /** Mint a single-use access link for the public origin, or null when none is declared. */
+  issueAccessLink() {
+    const code = this.publicProxy.issueAccessCode();
+    if (!code) return null;
+    const url = this.publicProxy.accessUrl(code.code);
+    return url ? { code: code.code, url, expiresAt: code.expiresAt } : null;
+  }
   async start() {
     if (this.supervisorLock) {
       mkdirSync8(dirname7(this.supervisorLock), { recursive: true });
@@ -10333,6 +10802,7 @@ Options:
   --host [address]       serve on a network address instead of loopback (bare --host means 0.0.0.0)
   --allowed-host <name>  with --host, also accept this DNS name as the board's address (repeatable)
   --public-origin <url>  serve behind a proxy/tunnel reachable at this exact origin
+  --link                 print a fresh single-use access link for the running board
   --debug                stream the full event feed to the terminal instead of the compact readout
   -h, --help             show this help
 
@@ -10340,14 +10810,16 @@ Environment:
   FRIZZ_HOST              same as --host
   FRIZZ_ALLOWED_HOSTS     same as --allowed-host, comma separated
   FRIZZ_PUBLIC_ORIGIN     same as --public-origin
+  FRIZZ_PUBLIC_TOKEN      standing secret for HEADLESS boxes that cannot show a QR
 
 --host puts a board that can run shell commands as you on the network, and Frizz has no login: anyone
 who reaches the port controls it. Only do this on a network you trust. An IP address works as-is; to
 reach the board by DNS name you must list that name with --allowed-host ("*" allows any).
 
 --public-origin serves the board through a tunnel or reverse proxy without putting it on the LAN
-at all \u2014 Frizz stays on loopback and the tunnel dials it. Frizz still has no login, so require
-authentication at the proxy: with Cloudflare Access, that is the whole of your access control.`
+at all \u2014 Frizz stays on loopback and the tunnel dials it. It prints a SINGLE-USE access link, and
+shows it as a QR so you can scan it from a phone; press L for a fresh one at any time. Scanning it
+trades the code for a session cookie, so the link itself stops working the moment it is used.`
   );
   process.exit(0);
 }
@@ -10459,15 +10931,17 @@ async function openOrPrint(port, reused, path = "") {
   }
   const network = reused ? [] : networkUrls(port, bind.host);
   const publicOrigin = reused ? void 0 : bind.publicOrigin;
+  const networkFlagsIgnored = reused && (bind.publicOrigin !== void 0 || bindHostIsExposed(bind.host));
   const warnings = [
     ...network.length > 0 ? [EXPOSED_WARNING] : [],
-    ...publicOrigin ? [PUBLIC_ORIGIN_WARNING] : []
+    ...publicOrigin ? [PUBLIC_ORIGIN_WARNING] : [],
+    ...networkFlagsIgnored ? [REUSED_NETWORK_FLAGS_WARNING] : []
   ];
   if (!readout) {
     console.log(`${reused ? "reusing" : "started"} Frizz ${PACKAGE_VERSION} for ${workspace.root}`);
     console.log(url);
     for (const address of network) console.log(address);
-    if (publicOrigin) console.log(publicOrigin);
+    if (publicOrigin) console.log(`${publicOrigin}/${bind.publicToken ? `?frizz_token=${bind.publicToken}` : ""}`);
     for (const warning of warnings) console.log(warning);
     return;
   }
@@ -10476,7 +10950,7 @@ async function openOrPrint(port, reused, path = "") {
     [
       { label: "Local", value: boardAddress(url), accent: true },
       ...network.map((address) => ({ label: "Network", value: `${address}/`, accent: true })),
-      ...publicOrigin ? [{ label: "Public", value: `${publicOrigin}/`, accent: true }] : [],
+      ...publicOrigin ? [{ label: "Public", value: `${publicOrigin}/${bind.publicToken ? `?frizz_token=${bind.publicToken}` : ""}`, accent: true }] : [],
       { label: "Project", value: `${workspace.name} \u2014 ${tildePath(workspace.root, home)}` },
       ...logger.file ? [{ label: "Logs", value: tildePath(logger.file, home) }] : []
     ],
@@ -10525,6 +10999,7 @@ async function runSupervisor(port, token) {
     host: bind.host,
     allowedHosts: bind.allowedHosts,
     ...bind.publicOrigin ? { publicOrigin: bind.publicOrigin } : {},
+    ...bind.publicToken ? { publicToken: bind.publicToken } : {},
     cwd: workspace.root,
     stateDir: workspace.stateDir,
     launchTarget: target,
@@ -10577,6 +11052,7 @@ async function runSupervisor(port, token) {
   });
   process.on("SIGINT", stop);
   process.on("SIGTERM", stop);
+  process.on("SIGHUP", stop);
   void supervisor.stopRequested.then(stop);
   await supervisor.firstBoot;
   return await new Promise(() => {