meshy-node 0.10.2 → 0.10.4

package/main.cjs

@@ -865,14 +865,14 @@ var require_jwa = __commonJS({
     "use strict";
     init_cjs_shims();
     var Buffer2 = require_safe_buffer().Buffer;
-    var crypto6 = require("crypto");
+    var crypto7 = require("crypto");
     var formatEcdsa = require_ecdsa_sig_formatter();
     var util5 = require("util");
     var MSG_INVALID_ALGORITHM = '"%s" is not a valid algorithm.\n  Supported algorithms are:\n  "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512" and "none".';
     var MSG_INVALID_SECRET = "secret must be a string or buffer";
     var MSG_INVALID_VERIFIER_KEY = "key must be a string or a buffer";
     var MSG_INVALID_SIGNER_KEY = "key must be a string, a buffer or an object";
-    var supportsKeyObjects = typeof crypto6.createPublicKey === "function";
+    var supportsKeyObjects = typeof crypto7.createPublicKey === "function";
     if (supportsKeyObjects) {
       MSG_INVALID_VERIFIER_KEY += " or a KeyObject";
       MSG_INVALID_SECRET += "or a KeyObject";
@@ -962,17 +962,17 @@ var require_jwa = __commonJS({
       return function sign(thing, secret) {
         checkIsSecretKey(secret);
         thing = normalizeInput(thing);
-        var hmac = crypto6.createHmac("sha" + bits, secret);
+        var hmac = crypto7.createHmac("sha" + bits, secret);
         var sig = (hmac.update(thing), hmac.digest("base64"));
         return fromBase64(sig);
       };
     }
     var bufferEqual;
-    var timingSafeEqual = "timingSafeEqual" in crypto6 ? function timingSafeEqual2(a, b) {
+    var timingSafeEqual = "timingSafeEqual" in crypto7 ? function timingSafeEqual2(a, b) {
       if (a.byteLength !== b.byteLength) {
         return false;
       }
-      return crypto6.timingSafeEqual(a, b);
+      return crypto7.timingSafeEqual(a, b);
     } : function timingSafeEqual2(a, b) {
       if (!bufferEqual) {
         bufferEqual = require_buffer_equal_constant_time();
@@ -989,7 +989,7 @@ var require_jwa = __commonJS({
       return function sign(thing, privateKey) {
         checkIsPrivateKey(privateKey);
         thing = normalizeInput(thing);
-        var signer = crypto6.createSign("RSA-SHA" + bits);
+        var signer = crypto7.createSign("RSA-SHA" + bits);
         var sig = (signer.update(thing), signer.sign(privateKey, "base64"));
         return fromBase64(sig);
       };
@@ -999,7 +999,7 @@ var require_jwa = __commonJS({
         checkIsPublicKey(publicKey);
         thing = normalizeInput(thing);
         signature = toBase64(signature);
-        var verifier = crypto6.createVerify("RSA-SHA" + bits);
+        var verifier = crypto7.createVerify("RSA-SHA" + bits);
         verifier.update(thing);
         return verifier.verify(publicKey, signature, "base64");
       };
@@ -1008,11 +1008,11 @@ var require_jwa = __commonJS({
       return function sign(thing, privateKey) {
         checkIsPrivateKey(privateKey);
         thing = normalizeInput(thing);
-        var signer = crypto6.createSign("RSA-SHA" + bits);
+        var signer = crypto7.createSign("RSA-SHA" + bits);
         var sig = (signer.update(thing), signer.sign({
           key: privateKey,
-          padding: crypto6.constants.RSA_PKCS1_PSS_PADDING,
-          saltLength: crypto6.constants.RSA_PSS_SALTLEN_DIGEST
+          padding: crypto7.constants.RSA_PKCS1_PSS_PADDING,
+          saltLength: crypto7.constants.RSA_PSS_SALTLEN_DIGEST
         }, "base64"));
         return fromBase64(sig);
       };
@@ -1022,12 +1022,12 @@ var require_jwa = __commonJS({
         checkIsPublicKey(publicKey);
         thing = normalizeInput(thing);
         signature = toBase64(signature);
-        var verifier = crypto6.createVerify("RSA-SHA" + bits);
+        var verifier = crypto7.createVerify("RSA-SHA" + bits);
         verifier.update(thing);
         return verifier.verify({
           key: publicKey,
-          padding: crypto6.constants.RSA_PKCS1_PSS_PADDING,
-          saltLength: crypto6.constants.RSA_PSS_SALTLEN_DIGEST
+          padding: crypto7.constants.RSA_PKCS1_PSS_PADDING,
+          saltLength: crypto7.constants.RSA_PSS_SALTLEN_DIGEST
         }, signature, "base64");
       };
     }
@@ -1324,7 +1324,7 @@ var require_jws = __commonJS({
     exports2.createSign = function createSign(opts) {
       return new SignStream(opts);
     };
-    exports2.createVerify = function createVerify(opts) {
+    exports2.createVerify = function createVerify2(opts) {
       return new VerifyStream(opts);
     };
   }
@@ -3632,7 +3632,7 @@ var require_verify = __commonJS({
     var validateAsymmetricKey = require_validateAsymmetricKey();
     var PS_SUPPORTED = require_psSupported();
     var jws = require_jws();
-    var { KeyObject, createSecretKey, createPublicKey } = require("crypto");
+    var { KeyObject, createSecretKey, createPublicKey: createPublicKey2 } = require("crypto");
     var PUB_KEY_ALGS = ["RS256", "RS384", "RS512"];
     var EC_KEY_ALGS = ["ES256", "ES384", "ES512"];
     var RSA_KEY_ALGS = ["RS256", "RS384", "RS512"];
@@ -3716,7 +3716,7 @@ var require_verify = __commonJS({
         }
         if (secretOrPublicKey2 != null && !(secretOrPublicKey2 instanceof KeyObject)) {
           try {
-            secretOrPublicKey2 = createPublicKey(secretOrPublicKey2);
+            secretOrPublicKey2 = createPublicKey2(secretOrPublicKey2);
           } catch (_) {
             try {
               secretOrPublicKey2 = createSecretKey(typeof secretOrPublicKey2 === "string" ? Buffer.from(secretOrPublicKey2) : secretOrPublicKey2);
@@ -4155,7 +4155,7 @@ var require_lodash5 = __commonJS({
     function isObjectLike2(value) {
       return !!value && typeof value == "object";
     }
-    function isPlainObject6(value) {
+    function isPlainObject7(value) {
       if (!isObjectLike2(value) || objectToString2.call(value) != objectTag2 || isHostObject(value)) {
         return false;
       }
@@ -4166,7 +4166,7 @@ var require_lodash5 = __commonJS({
       var Ctor = hasOwnProperty3.call(proto2, "constructor") && proto2.constructor;
       return typeof Ctor == "function" && Ctor instanceof Ctor && funcToString2.call(Ctor) == objectCtorString2;
     }
-    module2.exports = isPlainObject6;
+    module2.exports = isPlainObject7;
   }
 });
 
@@ -4285,7 +4285,7 @@ var require_sign = __commonJS({
     var isBoolean = require_lodash2();
     var isInteger = require_lodash3();
     var isNumber2 = require_lodash4();
-    var isPlainObject6 = require_lodash5();
+    var isPlainObject7 = require_lodash5();
     var isString = require_lodash6();
     var once = require_lodash7();
     var { KeyObject, createSecretKey, createPrivateKey: createPrivateKey2 } = require("crypto");
@@ -4304,7 +4304,7 @@ var require_sign = __commonJS({
         return isString(value) || Array.isArray(value);
       }, message: '"audience" must be a string or array' },
       algorithm: { isValid: includes.bind(null, SUPPORTED_ALGS), message: '"algorithm" must be a valid string enum value' },
-      header: { isValid: isPlainObject6, message: '"header" must be an object' },
+      header: { isValid: isPlainObject7, message: '"header" must be an object' },
       encoding: { isValid: isString, message: '"encoding" must be a string' },
       issuer: { isValid: isString, message: '"issuer" must be a string' },
       subject: { isValid: isString, message: '"subject" must be a string' },
@@ -4321,7 +4321,7 @@ var require_sign = __commonJS({
       nbf: { isValid: isNumber2, message: '"nbf" should be a number of seconds' }
     };
     function validate(schema, allowUnknown, object3, parameterName) {
-      if (!isPlainObject6(object3)) {
+      if (!isPlainObject7(object3)) {
         throw new Error('Expected "' + parameterName + '" to be a plain object.');
       }
       Object.keys(object3).forEach(function(key2) {
@@ -28834,10 +28834,10 @@ var require_object_inspect = __commonJS({
       }
       if (!isDate(obj) && !isRegExp(obj)) {
         var ys = arrObjKeys(obj, inspect3);
-        var isPlainObject6 = gPO ? gPO(obj) === Object.prototype : obj instanceof Object || obj.constructor === Object;
+        var isPlainObject7 = gPO ? gPO(obj) === Object.prototype : obj instanceof Object || obj.constructor === Object;
         var protoTag = obj instanceof Object ? "" : "null prototype";
-        var stringTag = !isPlainObject6 && toStringTag && Object(obj) === obj && toStringTag in obj ? $slice.call(toStr(obj), 8, -1) : protoTag ? "Object" : "";
-        var constructorTag = isPlainObject6 || typeof obj.constructor !== "function" ? "" : obj.constructor.name ? obj.constructor.name + " " : "";
+        var stringTag = !isPlainObject7 && toStringTag && Object(obj) === obj && toStringTag in obj ? $slice.call(toStr(obj), 8, -1) : protoTag ? "Object" : "";
+        var constructorTag = isPlainObject7 || typeof obj.constructor !== "function" ? "" : obj.constructor.name ? obj.constructor.name + " " : "";
         var tag = constructorTag + (stringTag || protoTag ? "[" + $join.call($concat.call([], stringTag || [], protoTag || []), ": ") + "] " : "");
         if (ys.length === 0) {
           return tag + "{}";
@@ -32848,14 +32848,14 @@ var require_etag = __commonJS({
     "use strict";
     init_cjs_shims();
     module2.exports = etag;
-    var crypto6 = require("crypto");
+    var crypto7 = require("crypto");
     var Stats = require("fs").Stats;
     var toString3 = Object.prototype.toString;
     function entitytag(entity) {
       if (entity.length === 0) {
         return '"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"';
       }
-      var hash = crypto6.createHash("sha1").update(entity, "utf8").digest("base64").substring(0, 27);
+      var hash = crypto7.createHash("sha1").update(entity, "utf8").digest("base64").substring(0, 27);
       var len = typeof entity === "string" ? Buffer.byteLength(entity, "utf8") : entity.length;
       return '"' + len.toString(16) + "-" + hash + '"';
     }
@@ -34626,7 +34626,7 @@ var require_application = __commonJS({
     "use strict";
     init_cjs_shims();
     var finalhandler = require_finalhandler();
-    var Router17 = require_router();
+    var Router18 = require_router();
     var methods = require_methods();
     var middleware = require_init();
     var query = require_query();
@@ -34691,7 +34691,7 @@ var require_application = __commonJS({
     };
     app.lazyrouter = function lazyrouter() {
       if (!this._router) {
-        this._router = new Router17({
+        this._router = new Router18({
           caseSensitive: this.enabled("case sensitive routing"),
           strict: this.enabled("strict routing")
         });
@@ -35651,11 +35651,11 @@ var require_cookie_signature = __commonJS({
   "../../node_modules/.pnpm/cookie-signature@1.0.7/node_modules/cookie-signature/index.js"(exports2) {
     "use strict";
     init_cjs_shims();
-    var crypto6 = require("crypto");
+    var crypto7 = require("crypto");
     exports2.sign = function(val, secret) {
       if ("string" !== typeof val) throw new TypeError("Cookie value must be provided as a string.");
       if (null == secret) throw new TypeError("Secret key must be provided.");
-      return val + "." + crypto6.createHmac("sha256", secret).update(val).digest("base64").replace(/\=+$/, "");
+      return val + "." + crypto7.createHmac("sha256", secret).update(val).digest("base64").replace(/\=+$/, "");
     };
     exports2.unsign = function(val, secret) {
       if ("string" !== typeof val) throw new TypeError("Signed cookie string must be provided.");
@@ -35664,7 +35664,7 @@ var require_cookie_signature = __commonJS({
       return sha1(mac) == sha1(val) ? str : false;
     };
     function sha1(str) {
-      return crypto6.createHash("sha1").update(str).digest("hex");
+      return crypto7.createHash("sha1").update(str).digest("hex");
     }
   }
 });
@@ -36569,7 +36569,7 @@ var require_express = __commonJS({
     var mixin = require_merge_descriptors();
     var proto2 = require_application();
     var Route = require_route();
-    var Router17 = require_router();
+    var Router18 = require_router();
     var req = require_request();
     var res = require_response();
     exports2 = module2.exports = createApplication;
@@ -36592,7 +36592,7 @@ var require_express = __commonJS({
     exports2.request = req;
     exports2.response = res;
     exports2.Route = Route;
-    exports2.Router = Router17;
+    exports2.Router = Router18;
     exports2.json = bodyParser.json;
     exports2.query = require_query();
     exports2.raw = bodyParser.raw;
@@ -36722,7 +36722,7 @@ __export(util_exports, {
   captureStackTrace: () => captureStackTrace,
   cleanEnum: () => cleanEnum,
   cleanRegex: () => cleanRegex,
-  clone: () => clone2,
+  clone: () => clone3,
   createTransparentProxy: () => createTransparentProxy,
   defineLazy: () => defineLazy,
   esc: () => esc,
@@ -36736,7 +36736,7 @@ __export(util_exports, {
   getParsedType: () => getParsedType2,
   getSizableOrigin: () => getSizableOrigin,
   isObject: () => isObject2,
-  isPlainObject: () => isPlainObject2,
+  isPlainObject: () => isPlainObject3,
   issue: () => issue,
   joinValues: () => joinValues,
   jsonStringifyReplacer: () => jsonStringifyReplacer,
@@ -36870,7 +36870,7 @@ function esc(str) {
 function isObject2(data) {
   return typeof data === "object" && data !== null && !Array.isArray(data);
 }
-function isPlainObject2(o) {
+function isPlainObject3(o) {
   if (isObject2(o) === false)
     return false;
   const ctor = o.constructor;
@@ -36896,7 +36896,7 @@ function numKeys(data) {
 function escapeRegex(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function clone2(inst, def, params) {
+function clone3(inst, def, params) {
   const cl = new inst._zod.constr(def ?? inst._zod.def);
   if (!def || params?.parent)
     cl._zod.parent = inst;
@@ -36974,7 +36974,7 @@ function pick(schema, mask) {
       continue;
     newShape[key2] = currDef.shape[key2];
   }
-  return clone2(schema, {
+  return clone3(schema, {
     ...schema._zod.def,
     shape: newShape,
     checks: []
@@ -36991,14 +36991,14 @@ function omit(schema, mask) {
       continue;
     delete newShape[key2];
   }
-  return clone2(schema, {
+  return clone3(schema, {
     ...schema._zod.def,
     shape: newShape,
     checks: []
   });
 }
 function extend2(schema, shape) {
-  if (!isPlainObject2(shape)) {
+  if (!isPlainObject3(shape)) {
     throw new Error("Invalid input to extend: expected a plain object");
   }
   const def = {
@@ -37011,10 +37011,10 @@ function extend2(schema, shape) {
     checks: []
     // delete existing checks
   };
-  return clone2(schema, def);
+  return clone3(schema, def);
 }
 function merge(a, b) {
-  return clone2(a, {
+  return clone3(a, {
     ...a._zod.def,
     get shape() {
       const _shape = { ...a._zod.def.shape, ...b._zod.def.shape };
@@ -37049,7 +37049,7 @@ function partial(Class2, schema, mask) {
       }) : oldShape[key2];
     }
   }
-  return clone2(schema, {
+  return clone3(schema, {
     ...schema._zod.def,
     shape,
     checks: []
@@ -37078,7 +37078,7 @@ function required(Class2, schema, mask) {
       });
     }
   }
-  return clone2(schema, {
+  return clone3(schema, {
     ...schema._zod.def,
     shape,
     // optional: [],
@@ -37985,7 +37985,7 @@ function mergeValues2(a, b) {
   if (a instanceof Date && b instanceof Date && +a === +b) {
     return { valid: true, data: a };
   }
-  if (isPlainObject2(a) && isPlainObject2(b)) {
+  if (isPlainObject3(a) && isPlainObject3(b)) {
     const bKeys = Object.keys(b);
     const sharedKeys = Object.keys(a).filter((key2) => bKeys.indexOf(key2) !== -1);
     const newObj = { ...a, ...b };
@@ -38840,7 +38840,7 @@ var init_schemas = __esm({
       $ZodType.init(inst, def);
       inst._zod.parse = (payload, ctx) => {
         const input = payload.value;
-        if (!isPlainObject2(input)) {
+        if (!isPlainObject3(input)) {
           payload.issues.push({
             expected: "record",
             code: "invalid_type",
@@ -40309,7 +40309,7 @@ var init_schemas3 = __esm({
           // { parent: true }
         );
       };
-      inst.clone = (def2, params) => clone2(inst, def2, params);
+      inst.clone = (def2, params) => clone3(inst, def2, params);
       inst.brand = () => inst;
       inst.register = ((reg, meta) => {
         reg.add(inst, meta);
@@ -42760,7 +42760,7 @@ var init_zod_json_schema_compat = __esm({
 });
 
 // ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
-function isPlainObject3(value) {
+function isPlainObject4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function mergeCapabilities(base, additional) {
@@ -42771,7 +42771,7 @@ function mergeCapabilities(base, additional) {
     if (addValue === void 0)
       continue;
     const baseValue = result[k];
-    if (isPlainObject3(baseValue) && isPlainObject3(addValue)) {
+    if (isPlainObject4(baseValue) && isPlainObject4(addValue)) {
       result[k] = { ...baseValue, ...addValue };
     } else {
       result[k] = addValue;
@@ -52212,7 +52212,7 @@ var require_extend = __commonJS({
       }
       return toStr.call(arr) === "[object Array]";
     };
-    var isPlainObject6 = function isPlainObject7(obj) {
+    var isPlainObject7 = function isPlainObject8(obj) {
       if (!obj || toStr.call(obj) !== "[object Object]") {
         return false;
       }
@@ -52249,7 +52249,7 @@ var require_extend = __commonJS({
       return obj[name2];
     };
     module2.exports = function extend4() {
-      var options, name2, src, copy, copyIsArray, clone4;
+      var options, name2, src, copy, copyIsArray, clone5;
       var target = arguments[0];
       var i = 1;
       var length = arguments.length;
@@ -52269,14 +52269,14 @@ var require_extend = __commonJS({
             src = getProperty(target, name2);
             copy = getProperty(options, name2);
             if (target !== copy) {
-              if (deep && copy && (isPlainObject6(copy) || (copyIsArray = isArray2(copy)))) {
+              if (deep && copy && (isPlainObject7(copy) || (copyIsArray = isArray2(copy)))) {
                 if (copyIsArray) {
                   copyIsArray = false;
-                  clone4 = src && isArray2(src) ? src : [];
+                  clone5 = src && isArray2(src) ? src : [];
                 } else {
-                  clone4 = src && isPlainObject6(src) ? src : {};
+                  clone5 = src && isPlainObject7(src) ? src : {};
                 }
-                setProperty(target, { name: name2, newValue: extend4(deep, clone4, copy) });
+                setProperty(target, { name: name2, newValue: extend4(deep, clone5, copy) });
               } else if (typeof copy !== "undefined") {
                 setProperty(target, { name: name2, newValue: copy });
               }
@@ -57136,7 +57136,7 @@ var init_rpc_metadata = __esm({
 });
 
 // ../../node_modules/.pnpm/@opentelemetry+core@2.8.0_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/core/build/esm/utils/lodash.merge.js
-function isPlainObject5(value) {
+function isPlainObject6(value) {
   if (!isObjectLike(value) || baseGetTag(value) !== objectTag) {
     return false;
   }
@@ -57301,7 +57301,7 @@ function isPrimitive(value) {
   return typeof value === "string" || typeof value === "number" || typeof value === "boolean" || typeof value === "undefined" || value instanceof Date || value instanceof RegExp || value === null;
 }
 function shouldMerge(one5, two) {
-  if (!isPlainObject5(one5) || !isPlainObject5(two)) {
+  if (!isPlainObject6(one5) || !isPlainObject6(two)) {
     return false;
   }
   return true;
@@ -57593,12 +57593,12 @@ var init_default_service_name = __esm({
 });
 
 // ../../node_modules/.pnpm/@opentelemetry+resources@2.7.1_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/resources/build/esm/utils.js
-var isPromiseLike;
+var isPromiseLike2;
 var init_utils5 = __esm({
   "../../node_modules/.pnpm/@opentelemetry+resources@2.7.1_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/resources/build/esm/utils.js"() {
     "use strict";
     init_cjs_shims();
-    isPromiseLike = (val) => {
+    isPromiseLike2 = (val) => {
       return val !== null && typeof val === "object" && typeof val.then === "function";
     };
   }
@@ -57624,7 +57624,7 @@ function defaultResource() {
 }
 function guardedRawAttributes(attributes) {
   return attributes.map(([k, v]) => {
-    if (isPromiseLike(v)) {
+    if (isPromiseLike2(v)) {
       return [
         k,
         v.catch((err) => {
@@ -57678,13 +57678,13 @@ var init_ResourceImpl = __esm({
       static FromAttributeList(attributes, options) {
         const res = new _ResourceImpl({}, options);
         res._rawAttributes = guardedRawAttributes(attributes);
-        res._asyncAttributesPending = attributes.filter(([_, val]) => isPromiseLike(val)).length > 0;
+        res._asyncAttributesPending = attributes.filter(([_, val]) => isPromiseLike2(val)).length > 0;
         return res;
       }
       constructor(resource, options) {
         const attributes = resource.attributes ?? {};
         this._rawAttributes = Object.entries(attributes).map(([k, v]) => {
-          if (isPromiseLike(v)) {
+          if (isPromiseLike2(v)) {
             this._asyncAttributesPending = true;
           }
           return [k, v];
@@ -57701,7 +57701,7 @@ var init_ResourceImpl = __esm({
         }
         for (let i = 0; i < this._rawAttributes.length; i++) {
           const [k, v] = this._rawAttributes[i];
-          this._rawAttributes[i] = [k, isPromiseLike(v) ? await v : v];
+          this._rawAttributes[i] = [k, isPromiseLike2(v) ? await v : v];
         }
         this._asyncAttributesPending = false;
       }
@@ -57714,7 +57714,7 @@ var init_ResourceImpl = __esm({
         }
         const attrs = {};
         for (const [k, v] of this._rawAttributes) {
-          if (isPromiseLike(v)) {
+          if (isPromiseLike2(v)) {
             diag2.debug(`Unsettled resource attribute ${k} skipped`);
             continue;
           }
@@ -113819,12 +113819,12 @@ var init_default_service_name2 = __esm({
 });
 
 // ../../node_modules/.pnpm/@opentelemetry+resources@2.8.0_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/resources/build/esm/utils.js
-var isPromiseLike2;
+var isPromiseLike3;
 var init_utils13 = __esm({
   "../../node_modules/.pnpm/@opentelemetry+resources@2.8.0_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/resources/build/esm/utils.js"() {
     "use strict";
     init_cjs_shims();
-    isPromiseLike2 = (val) => {
+    isPromiseLike3 = (val) => {
       return val !== null && typeof val === "object" && typeof val.then === "function";
     };
   }
@@ -113850,7 +113850,7 @@ function defaultResource2() {
 }
 function guardedRawAttributes2(attributes) {
   return attributes.map(([k, v]) => {
-    if (isPromiseLike2(v)) {
+    if (isPromiseLike3(v)) {
       return [
         k,
         v.catch((err) => {
@@ -113904,13 +113904,13 @@ var init_ResourceImpl2 = __esm({
       static FromAttributeList(attributes, options) {
         const res = new _ResourceImpl({}, options);
         res._rawAttributes = guardedRawAttributes2(attributes);
-        res._asyncAttributesPending = attributes.filter(([_, val]) => isPromiseLike2(val)).length > 0;
+        res._asyncAttributesPending = attributes.filter(([_, val]) => isPromiseLike3(val)).length > 0;
         return res;
       }
       constructor(resource, options) {
         const attributes = resource.attributes ?? {};
         this._rawAttributes = Object.entries(attributes).map(([k, v]) => {
-          if (isPromiseLike2(v)) {
+          if (isPromiseLike3(v)) {
             this._asyncAttributesPending = true;
           }
           return [k, v];
@@ -113927,7 +113927,7 @@ var init_ResourceImpl2 = __esm({
         }
         for (let i = 0; i < this._rawAttributes.length; i++) {
           const [k, v] = this._rawAttributes[i];
-          this._rawAttributes[i] = [k, isPromiseLike2(v) ? await v : v];
+          this._rawAttributes[i] = [k, isPromiseLike3(v) ? await v : v];
         }
         this._asyncAttributesPending = false;
       }
@@ -113940,7 +113940,7 @@ var init_ResourceImpl2 = __esm({
         }
         const attrs = {};
         for (const [k, v] of this._rawAttributes) {
-          if (isPromiseLike2(v)) {
+          if (isPromiseLike3(v)) {
             diag2.debug(`Unsettled resource attribute ${k} skipped`);
             continue;
           }
@@ -131632,6 +131632,8 @@ function formatHelp(command) {
       "      --reset                Ignore remembered startup options and prompt again",
       "      --disable-auth         Disable bearer auth for this run",
       "      --qr-code              Render a mobile connection QR for the node DevTunnel URL",
+      "      --enable-ghc-tunnel    Enable the GitHub Copilot Tunnel without prompting",
+      "      --disable-ghc-tunnel   Disable the GitHub Copilot Tunnel without prompting",
       "  -h, --help                 Show this help"
     ].join("\n");
   }
@@ -131664,6 +131666,8 @@ function formatHelp(command) {
     "      --reset                Ignore remembered startup options and prompt again",
     "      --disable-auth         Disable bearer auth for this run",
     "      --qr-code              Render a mobile connection QR for the node DevTunnel URL",
+    "      --enable-ghc-tunnel    Enable the GitHub Copilot Tunnel without prompting",
+    "      --disable-ghc-tunnel   Disable the GitHub Copilot Tunnel without prompting",
     "  -h, --help                 Show this help"
   ].join("\n");
 }
@@ -131750,6 +131754,12 @@ function parseArgs(argv) {
       case "--qr-code":
         result.qrCode = true;
         break;
+      case "--enable-ghc-tunnel":
+        result.ghcTunnel = true;
+        break;
+      case "--disable-ghc-tunnel":
+        result.ghcTunnel = false;
+        break;
       default:
         if (!arg.startsWith("-") && !result.command && isKnownCommand(arg)) {
           result.command = arg;
@@ -132242,7 +132252,7 @@ function formatBanner(info) {
   const lines = [
     `Node:      ${info.name}`,
     `Role:      ${info.role} (term ${info.term})`,
-    `Endpoint:  ${info.endpoint}`,
+    `Node URL:  ${info.endpoint}`,
     `Dashboard: http://localhost:${info.port}`
   ];
   if (info.dashboardOrigin) {
@@ -136899,6 +136909,76 @@ function isNodeStatus(value) {
   return typeof value === "string" && NODE_STATUSES.has(value);
 }
 
+// ../../packages/core/src/storage/task-store-parsers.ts
+init_cjs_shims();
+function parseTask(value) {
+  if (!isPlainObject(value)) {
+    return null;
+  }
+  const status = asTaskStatus(value.status);
+  const priority = asTaskPriority(value.priority);
+  const conversationKind = value.conversationKind === void 0 ? "meshyChat" : asTaskConversationKind(value.conversationKind);
+  if (typeof value.id !== "string" || typeof value.title !== "string" || typeof value.description !== "string" || typeof value.agent !== "string" || value.project !== null && typeof value.project !== "string" || value.effectiveProjectPath !== null && value.effectiveProjectPath !== void 0 && typeof value.effectiveProjectPath !== "string" || value.branch !== null && value.branch !== void 0 && typeof value.branch !== "string" || conversationKind === null || !isPlainObject(value.payload) || status === null || priority === null || value.assignedTo !== null && typeof value.assignedTo !== "string" || value.assignedNodeName !== void 0 && value.assignedNodeName !== null && typeof value.assignedNodeName !== "string" || typeof value.createdBy !== "string" || value.result !== null && !isPlainObject(value.result) || value.error !== null && typeof value.error !== "string" || typeof value.retryCount !== "number" || !Number.isFinite(value.retryCount) || typeof value.maxRetries !== "number" || !Number.isFinite(value.maxRetries) || typeof value.createdAt !== "number" || !Number.isFinite(value.createdAt) || typeof value.updatedAt !== "number" || !Number.isFinite(value.updatedAt)) {
+    return null;
+  }
+  const queuedMessages = parseTaskQueuedMessages(value.queuedMessages);
+  return {
+    id: value.id,
+    title: value.title,
+    description: value.description,
+    agent: value.agent,
+    project: value.project ?? null,
+    effectiveProjectPath: typeof value.effectiveProjectPath === "string" ? value.effectiveProjectPath : null,
+    branch: value.branch === void 0 ? void 0 : typeof value.branch === "string" ? value.branch : null,
+    conversationKind,
+    payload: clone(value.payload),
+    ...queuedMessages ? { queuedMessages } : {},
+    status,
+    priority,
+    assignedTo: value.assignedTo,
+    assignedNodeName: typeof value.assignedNodeName === "string" ? value.assignedNodeName : null,
+    createdBy: value.createdBy,
+    result: value.result === null ? null : clone(value.result),
+    error: value.error,
+    retryCount: value.retryCount,
+    maxRetries: value.maxRetries,
+    createdAt: value.createdAt,
+    updatedAt: value.updatedAt
+  };
+}
+function parseTaskQueuedMessages(value) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) return void 0;
+  const messages = [];
+  for (const entry of value) {
+    if (!isPlainObject(entry)) return void 0;
+    if (typeof entry.id !== "string" || !Array.isArray(entry.content) || typeof entry.createdAt !== "number" || !Number.isFinite(entry.createdAt)) {
+      return void 0;
+    }
+    messages.push({
+      id: entry.id,
+      content: clone(entry.content),
+      createdAt: entry.createdAt
+    });
+  }
+  return messages;
+}
+function asTaskStatus(value) {
+  return isTaskStatus(value) ? value : null;
+}
+function asTaskPriority(value) {
+  return isTaskPriority(value) ? value : null;
+}
+function asTaskConversationKind(value) {
+  return isTaskConversationKind(value) ? value : null;
+}
+function clone(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // ../../packages/core/src/storage/file-store.ts
 var FILE_NAMES = {
   cluster: "cluster.json",
@@ -136948,26 +137028,26 @@ var FileStore = class {
   }
   getClusterInfo() {
     this.ensureOpen();
-    return this.cluster === null ? null : clone(this.cluster);
+    return this.cluster === null ? null : clone2(this.cluster);
   }
   setClusterInfo(info) {
     this.ensureOpen();
-    this.cluster = clone(info);
+    this.cluster = clone2(info);
     this.persistSection("cluster");
   }
   upsertNode(node2) {
     this.ensureOpen();
-    this.nodes.set(node2.id, clone(node2));
+    this.nodes.set(node2.id, clone2(node2));
     this.persistSection("nodes");
   }
   getNode(id) {
     this.ensureOpen();
     const node2 = this.nodes.get(id);
-    return node2 === void 0 ? null : clone(node2);
+    return node2 === void 0 ? null : clone2(node2);
   }
   getAllNodes() {
     this.ensureOpen();
-    return Array.from(this.nodes.values(), (node2) => clone(node2));
+    return Array.from(this.nodes.values(), (node2) => clone2(node2));
   }
   removeNode(id) {
     this.ensureOpen();
@@ -136987,15 +137067,15 @@ var FileStore = class {
   }
   createTask(task) {
     this.ensureOpen();
-    const copy = clone(task);
+    const copy = clone2(task);
     this.tasks.set(copy.id, copy);
     this.persistSection("tasks");
-    return clone(copy);
+    return clone2(copy);
   }
   getTask(id) {
     this.ensureOpen();
     const task = this.tasks.get(id);
-    return task === void 0 ? null : clone(task);
+    return task === void 0 ? null : clone2(task);
   }
   getAllTasks(filter = {}) {
     this.ensureOpen();
@@ -137012,7 +137092,7 @@ var FileStore = class {
     const offset = normalizeBound(filter.offset) ?? 0;
     const limit = normalizeBound(filter.limit);
     const sliced = limit === void 0 ? tasks.slice(offset) : tasks.slice(offset, offset + limit);
-    return sliced.map((task) => clone(task));
+    return sliced.map((task) => clone2(task));
   }
   updateTask(id, updates) {
     this.ensureOpen();
@@ -137022,12 +137102,12 @@ var FileStore = class {
     }
     const merged = {
       ...current,
-      ...clone(updates),
+      ...clone2(updates),
       id: current.id
     };
     this.tasks.set(id, merged);
     this.persistSection("tasks");
-    return clone(merged);
+    return clone2(merged);
   }
   deleteTask(id) {
     this.ensureOpen();
@@ -137085,28 +137165,28 @@ var FileStore = class {
   }
   createTaskShare(share) {
     this.ensureOpen();
-    const copy = clone(share);
+    const copy = clone2(share);
     this.shares.set(copy.id, copy);
     this.persistSection("shares");
-    return clone(copy);
+    return clone2(copy);
   }
   getTaskShare(id) {
     this.ensureOpen();
     const share = this.shares.get(id);
-    return share === void 0 ? null : clone(share);
+    return share === void 0 ? null : clone2(share);
   }
   getTaskShareByTaskId(taskId) {
     this.ensureOpen();
     for (const share of this.shares.values()) {
       if (share.taskId === taskId && share.revokedAt === void 0) {
-        return clone(share);
+        return clone2(share);
       }
     }
     return null;
   }
   getAllTaskShares() {
     this.ensureOpen();
-    return Array.from(this.shares.values(), (share) => clone(share));
+    return Array.from(this.shares.values(), (share) => clone2(share));
   }
   updateTaskShare(id, updates) {
     this.ensureOpen();
@@ -137116,12 +137196,12 @@ var FileStore = class {
     }
     const merged = {
       ...current,
-      ...clone(updates),
+      ...clone2(updates),
       id: current.id
     };
     this.shares.set(id, merged);
     this.persistSection("shares");
-    return clone(merged);
+    return clone2(merged);
   }
   getElectionValue(key2) {
     this.ensureOpen();
@@ -137156,7 +137236,7 @@ var FileStore = class {
   }
   loadNodes() {
     const raw3 = this.readJsonFile("nodes");
-    if (!isPlainObject(raw3)) {
+    if (!isPlainObject2(raw3)) {
       this.markDirty("nodes");
       return /* @__PURE__ */ new Map();
     }
@@ -137176,7 +137256,7 @@ var FileStore = class {
   }
   loadTasks() {
     const raw3 = this.readJsonFile("tasks");
-    if (!isPlainObject(raw3)) {
+    if (!isPlainObject2(raw3)) {
       this.markDirty("tasks");
       return /* @__PURE__ */ new Map();
     }
@@ -137196,7 +137276,7 @@ var FileStore = class {
   }
   loadTaskShares() {
     const raw3 = this.readJsonFile("shares");
-    if (!isPlainObject(raw3)) {
+    if (!isPlainObject2(raw3)) {
       this.markDirty("shares");
       return /* @__PURE__ */ new Map();
     }
@@ -137216,7 +137296,7 @@ var FileStore = class {
   }
   loadElection() {
     const raw3 = this.readJsonFile("election");
-    if (!isPlainObject(raw3)) {
+    if (!isPlainObject2(raw3)) {
       this.markDirty("election");
       return /* @__PURE__ */ new Map();
     }
@@ -137274,7 +137354,7 @@ var FileStore = class {
   serializeSection(section) {
     switch (section) {
       case "cluster":
-        return this.cluster === null ? null : clone(this.cluster);
+        return this.cluster === null ? null : clone2(this.cluster);
       case "nodes":
         return Object.fromEntries(sortEntries(this.nodes));
       case "tasks":
@@ -137304,7 +137384,7 @@ var FileStore = class {
     }
   }
 };
-function clone(value) {
+function clone2(value) {
   return structuredClone(value);
 }
 function normalizeBound(value) {
@@ -137332,23 +137412,23 @@ function createPriorityCounter() {
     critical: 0
   };
 }
-function isPlainObject(value) {
+function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseStringArray(value) {
   return Array.isArray(value) && value.every((item) => typeof item === "string") ? [...value] : void 0;
 }
 function parseNodeSettingsSnapshot(value) {
-  if (!isPlainObject(value)) {
+  if (!isPlainObject2(value)) {
     return void 0;
   }
   if (typeof value.collectedAt !== "number" || !Number.isFinite(value.collectedAt) || typeof value.version !== "string" || typeof value.uptime !== "number" || !Number.isFinite(value.uptime)) {
     return void 0;
   }
-  return clone(value);
+  return clone2(value);
 }
 function parseDevTunnelHealth(value) {
-  if (!isPlainObject(value)) {
+  if (!isPlainObject2(value)) {
     return void 0;
   }
   if (value.status !== "healthy" && value.status !== "failed" || typeof value.checkedAt !== "number" || !Number.isFinite(value.checkedAt)) {
@@ -137364,10 +137444,10 @@ function parseDevTunnelHealth(value) {
   };
 }
 function isClusterInfo(value) {
-  return isPlainObject(value) && typeof value.clusterId === "string" && typeof value.createdAt === "number" && Number.isFinite(value.createdAt);
+  return isPlainObject2(value) && typeof value.clusterId === "string" && typeof value.createdAt === "number" && Number.isFinite(value.createdAt);
 }
 function parseNodeInfo(value) {
-  if (!isPlainObject(value)) {
+  if (!isPlainObject2(value)) {
     return null;
   }
   const role = asNodeRole(value.role);
@@ -137393,41 +137473,8 @@ function parseNodeInfo(value) {
     settingsSnapshot: parseNodeSettingsSnapshot(value.settingsSnapshot)
   };
 }
-function parseTask(value) {
-  if (!isPlainObject(value)) {
-    return null;
-  }
-  const status = asTaskStatus(value.status);
-  const priority = asTaskPriority(value.priority);
-  const conversationKind = value.conversationKind === void 0 ? "meshyChat" : asTaskConversationKind(value.conversationKind);
-  if (typeof value.id !== "string" || typeof value.title !== "string" || typeof value.description !== "string" || typeof value.agent !== "string" || value.project !== null && typeof value.project !== "string" || value.effectiveProjectPath !== null && value.effectiveProjectPath !== void 0 && typeof value.effectiveProjectPath !== "string" || value.branch !== null && value.branch !== void 0 && typeof value.branch !== "string" || conversationKind === null || !isPlainObject(value.payload) || status === null || priority === null || value.assignedTo !== null && typeof value.assignedTo !== "string" || value.assignedNodeName !== void 0 && value.assignedNodeName !== null && typeof value.assignedNodeName !== "string" || typeof value.createdBy !== "string" || value.result !== null && !isPlainObject(value.result) || value.error !== null && typeof value.error !== "string" || typeof value.retryCount !== "number" || !Number.isFinite(value.retryCount) || typeof value.maxRetries !== "number" || !Number.isFinite(value.maxRetries) || typeof value.createdAt !== "number" || !Number.isFinite(value.createdAt) || typeof value.updatedAt !== "number" || !Number.isFinite(value.updatedAt)) {
-    return null;
-  }
-  return {
-    id: value.id,
-    title: value.title,
-    description: value.description,
-    agent: value.agent,
-    project: value.project ?? null,
-    effectiveProjectPath: typeof value.effectiveProjectPath === "string" ? value.effectiveProjectPath : null,
-    branch: value.branch === void 0 ? void 0 : typeof value.branch === "string" ? value.branch : null,
-    conversationKind,
-    payload: clone(value.payload),
-    status,
-    priority,
-    assignedTo: value.assignedTo,
-    assignedNodeName: typeof value.assignedNodeName === "string" ? value.assignedNodeName : null,
-    createdBy: value.createdBy,
-    result: value.result === null ? null : clone(value.result),
-    error: value.error,
-    retryCount: value.retryCount,
-    maxRetries: value.maxRetries,
-    createdAt: value.createdAt,
-    updatedAt: value.updatedAt
-  };
-}
 function parseTaskShare(value) {
-  if (!isPlainObject(value)) {
+  if (!isPlainObject2(value)) {
     return null;
   }
   if (typeof value.id !== "string" || typeof value.taskId !== "string" || typeof value.createdAt !== "number" || !Number.isFinite(value.createdAt) || value.revokedAt !== void 0 && (typeof value.revokedAt !== "number" || !Number.isFinite(value.revokedAt))) {
@@ -137455,20 +137502,11 @@ function asNodeRole(value) {
 function asNodeStatus(value) {
   return isNodeStatus(value) ? value : null;
 }
-function asTaskStatus(value) {
-  return isTaskStatus(value) ? value : null;
-}
-function asTaskPriority(value) {
-  return isTaskPriority(value) ? value : null;
-}
-function asTaskConversationKind(value) {
-  return isTaskConversationKind(value) ? value : null;
-}
 function sortEntries(input) {
   return Array.from(input.entries()).sort(([left], [right]) => left.localeCompare(right));
 }
 function isRecoverableAtomicReplaceError(err) {
-  if (!isPlainObject(err)) {
+  if (!isPlainObject2(err)) {
     return false;
   }
   const code4 = err.code;
@@ -139924,7 +139962,10 @@ var ExecutionEngine = class {
   buildConfig(task) {
     const config2 = {};
     const p2 = task.payload;
-    if (typeof p2.model === "string") config2.model = p2.model;
+    if (typeof p2.model === "string") {
+      const model = p2.model.trim();
+      if (model) config2.model = model;
+    }
     if (typeof p2.systemPrompt === "string") config2.systemPrompt = p2.systemPrompt;
     if (Array.isArray(p2.allowedTools) && p2.allowedTools.every((t) => typeof t === "string")) {
       config2.allowedTools = p2.allowedTools;
@@ -141170,6 +141211,10 @@ function getCurrentGitBranch(workDir) {
 init_cjs_shims();
 var import_node_child_process3 = require("child_process");
 
+// ../../packages/core/src/agents/agent-models.ts
+init_cjs_shims();
+var DEFAULT_CLAUDE_CODE_MODEL = "claude-opus-4-8[1m]";
+
 // ../../packages/core/src/agents/cli-invocations.ts
 init_cjs_shims();
 var fs9 = __toESM(require("fs"), 1);
@@ -141412,7 +141457,7 @@ var ClaudeLiteAdapter = class {
       "json",
       "--no-session-persistence",
       "--model",
-      options.model ?? "sonnet",
+      options.model ?? DEFAULT_CLAUDE_CODE_MODEL,
       "--permission-mode",
       "default",
       "--tools",
@@ -141459,7 +141504,6 @@ init_cjs_shims();
 var fs10 = __toESM(require("fs"), 1);
 var path10 = __toESM(require("path"), 1);
 var import_node_child_process4 = require("child_process");
-var DEFAULT_CLAUDE_MODEL = "sonnet";
 function buildClaudeModeArgs(mode) {
   switch (mode) {
     case "plan":
@@ -141474,7 +141518,7 @@ function buildClaudeModeArgs(mode) {
   }
 }
 function getClaudeModelArg(model) {
-  return model ?? DEFAULT_CLAUDE_MODEL;
+  return model ?? DEFAULT_CLAUDE_CODE_MODEL;
 }
 function getClaudeStreamError(event) {
   if (event.type !== "result") {
@@ -144758,6 +144802,452 @@ ${joinErrors.map((e) => `  - ${e}`).join("\n")}`
   }
 };
 
+// ../../packages/core/src/mobile-auth/index.ts
+init_cjs_shims();
+
+// ../../packages/core/src/mobile-auth/protocol/index.ts
+init_cjs_shims();
+
+// ../../packages/core/src/mobile-auth/protocol/qr.ts
+init_cjs_shims();
+var MOBILE_PAIRING_QR_TYPE = "meshy.mobile.pairing";
+var MOBILE_PAIRING_QR_VERSION = 3;
+function buildPairingQrPayload(payload) {
+  return {
+    type: MOBILE_PAIRING_QR_TYPE,
+    version: MOBILE_PAIRING_QR_VERSION,
+    ...payload
+  };
+}
+function serializePairingQrPayload(payload) {
+  return JSON.stringify(payload);
+}
+
+// ../../packages/core/src/mobile-auth/audit.ts
+init_cjs_shims();
+function createLoggerAuditRecorder(logger33) {
+  const auditLog = logger33.child("mobile-audit");
+  return {
+    record(event) {
+      const { eventType, ...rest } = event;
+      auditLog.info(eventType, {
+        timestamp: event.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
+        ...rest
+      });
+    }
+  };
+}
+
+// ../../packages/core/src/mobile-auth/pairing-invitations.ts
+init_cjs_shims();
+var MobilePairingInvitationError = class extends Error {
+  constructor(code4, message, statusCode) {
+    super(message);
+    this.code = code4;
+    this.statusCode = statusCode;
+    this.name = "MobilePairingInvitationError";
+  }
+  code;
+  statusCode;
+};
+var DEFAULT_TTL_MS = 5 * 60 * 1e3;
+var DEFAULT_MAX_TTL_MS = 10 * 60 * 1e3;
+var DEFAULT_MAX_USES = 1;
+function normalizePositiveInteger2(value, fallback) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return fallback;
+  return Math.max(1, Math.floor(value));
+}
+function requireApiBaseUrl(value) {
+  const trimmed = value?.trim();
+  if (!trimmed) {
+    throw new MobilePairingInvitationError("MOBILE_ENDPOINT_UNAVAILABLE", "mobile API endpoint is not available", 409);
+  }
+  try {
+    const url3 = new URL(trimmed);
+    return url3.toString().replace(/\/$/, "");
+  } catch {
+    throw new MobilePairingInvitationError("INVALID_MOBILE_ENDPOINT", "mobile API endpoint is invalid", 400);
+  }
+}
+var MobilePairingInvitationService = class {
+  constructor(options) {
+    this.options = options;
+    this.now = options.now ?? (() => Date.now());
+    this.defaultTtlMs = options.defaultTtlMs ?? DEFAULT_TTL_MS;
+    this.maxTtlMs = options.maxTtlMs ?? DEFAULT_MAX_TTL_MS;
+    this.defaultMaxUses = options.defaultMaxUses ?? DEFAULT_MAX_USES;
+  }
+  options;
+  invitations = /* @__PURE__ */ new Map();
+  connections = /* @__PURE__ */ new Map();
+  now;
+  defaultTtlMs;
+  maxTtlMs;
+  defaultMaxUses;
+  createInvitation(input = {}) {
+    this.expireStaleInvitations();
+    const apiBaseUrl = requireApiBaseUrl(input.apiBaseUrl ?? this.options.getApiBaseUrl());
+    const now = this.now();
+    const ttlMs = Math.min(normalizePositiveInteger2(input.ttlMs, this.defaultTtlMs), this.maxTtlMs);
+    const maxUses = normalizePositiveInteger2(input.maxUses, this.defaultMaxUses);
+    const invitation = {
+      version: 1,
+      pairingId: `pair_${nanoid(24)}`,
+      nodeId: this.options.nodeId,
+      nodeName: this.options.nodeName,
+      apiBaseUrl,
+      createdAt: new Date(now).toISOString(),
+      expiresAt: new Date(now + ttlMs).toISOString(),
+      maxUses,
+      usedCount: 0,
+      ...input.createdBy ? { createdBy: input.createdBy } : {},
+      status: "active"
+    };
+    this.invitations.set(invitation.pairingId, invitation);
+    this.options.audit?.record({
+      eventType: "mobile.pairing.created",
+      pairingId: invitation.pairingId,
+      nodeId: invitation.nodeId,
+      outcome: "success"
+    });
+    return {
+      invitation: { ...invitation },
+      qr: buildPairingQrPayload({
+        nodeId: invitation.nodeId,
+        nodeName: invitation.nodeName,
+        apiBaseUrl: invitation.apiBaseUrl,
+        pairingId: invitation.pairingId,
+        expiresAt: invitation.expiresAt,
+        maxUses: invitation.maxUses,
+        aad: this.options.aad
+      })
+    };
+  }
+  getInvitation(pairingId) {
+    this.expireStaleInvitations();
+    const invitation = this.invitations.get(pairingId);
+    return invitation ? { ...invitation } : null;
+  }
+  listInvitations() {
+    this.expireStaleInvitations();
+    return [...this.invitations.values()].map((invitation) => ({ ...invitation }));
+  }
+  consumeInvitation(pairingId, input) {
+    this.expireStaleInvitations();
+    const invitation = this.invitations.get(pairingId);
+    if (!invitation) {
+      throw new MobilePairingInvitationError("PAIRING_NOT_FOUND", "unknown pairing invitation", 404);
+    }
+    if (invitation.status !== "active") {
+      throw new MobilePairingInvitationError("PAIRING_NOT_ACTIVE", `pairing invitation is ${invitation.status}`, 409);
+    }
+    if (invitation.usedCount >= invitation.maxUses) {
+      invitation.status = "consumed";
+      throw new MobilePairingInvitationError("PAIRING_CONSUMED", "pairing invitation has no remaining uses", 409);
+    }
+    invitation.usedCount += 1;
+    if (invitation.usedCount >= invitation.maxUses) {
+      invitation.status = "consumed";
+    }
+    const connection = {
+      connectionId: `conn_${nanoid(24)}`,
+      nodeId: invitation.nodeId,
+      nodeName: invitation.nodeName,
+      apiBaseUrl: invitation.apiBaseUrl,
+      pairedAt: new Date(this.now()).toISOString(),
+      ...input.deviceName ? { deviceName: input.deviceName } : {},
+      ...input.platform ? { platform: input.platform } : {},
+      ...input.appVersion ? { appVersion: input.appVersion } : {},
+      tokenSubject: {
+        tenantId: input.identity.tenantId,
+        ...input.identity.objectId ? { oid: input.identity.objectId } : {},
+        upn: input.identity.upn
+      }
+    };
+    this.connections.set(connection.connectionId, connection);
+    this.options.audit?.record({
+      eventType: "mobile.pairing.consumed",
+      pairingId,
+      nodeId: invitation.nodeId,
+      outcome: "success",
+      sourceAddress: input.sourceAddress,
+      outerPrincipal: input.identity.upn
+    });
+    return { ...connection, tokenSubject: { ...connection.tokenSubject } };
+  }
+  cancelInvitation(pairingId) {
+    this.expireStaleInvitations();
+    const invitation = this.invitations.get(pairingId);
+    if (!invitation || invitation.status !== "active") return false;
+    invitation.status = "cancelled";
+    this.options.audit?.record({
+      eventType: "mobile.pairing.cancelled",
+      pairingId,
+      nodeId: invitation.nodeId,
+      outcome: "success"
+    });
+    return true;
+  }
+  listConnections() {
+    return [...this.connections.values()].map((connection) => ({
+      ...connection,
+      tokenSubject: { ...connection.tokenSubject }
+    }));
+  }
+  revokeConnection(connectionId) {
+    const connection = this.connections.get(connectionId);
+    const deleted = this.connections.delete(connectionId);
+    if (deleted) {
+      this.options.audit?.record({
+        eventType: "mobile.connection.revoked",
+        nodeId: connection?.nodeId,
+        outcome: "success"
+      });
+    }
+    return deleted;
+  }
+  dispose() {
+    this.invitations.clear();
+    this.connections.clear();
+  }
+  expireStaleInvitations() {
+    const now = this.now();
+    for (const invitation of this.invitations.values()) {
+      if (invitation.status === "active" && Date.parse(invitation.expiresAt) <= now) {
+        invitation.status = "expired";
+        this.options.audit?.record({
+          eventType: "mobile.pairing.expired",
+          pairingId: invitation.pairingId,
+          nodeId: invitation.nodeId,
+          outcome: "failure",
+          reason: "expired"
+        });
+      }
+    }
+  }
+};
+
+// ../../packages/core/src/mobile-auth/aad-validator.ts
+init_cjs_shims();
+var crypto4 = __toESM(require("crypto"), 1);
+
+// ../../packages/core/src/mobile-auth/protocol/base64url.ts
+init_cjs_shims();
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var DECODE_TABLE = (() => {
+  const table2 = new Int16Array(128).fill(-1);
+  for (let i = 0; i < ALPHABET.length; i += 1) {
+    table2[ALPHABET.charCodeAt(i)] = i;
+  }
+  return table2;
+})();
+function fromBase64Url(text10) {
+  const length = text10.length;
+  const remainder = length % 4;
+  if (remainder === 1) {
+    throw new Error("mobile-auth: invalid base64url length");
+  }
+  const fullGroups = Math.floor(length / 4);
+  let outLength = fullGroups * 3;
+  if (remainder === 2) {
+    outLength += 1;
+  } else if (remainder === 3) {
+    outLength += 2;
+  }
+  const out = new Uint8Array(outLength);
+  let outIndex = 0;
+  let i = 0;
+  const decode2 = (charCode) => {
+    const value = charCode < 128 ? DECODE_TABLE[charCode] ?? -1 : -1;
+    if (value < 0) {
+      throw new Error("mobile-auth: invalid base64url character");
+    }
+    return value;
+  };
+  for (; i + 4 <= length; i += 4) {
+    const c0 = decode2(text10.charCodeAt(i));
+    const c1 = decode2(text10.charCodeAt(i + 1));
+    const c2 = decode2(text10.charCodeAt(i + 2));
+    const c3 = decode2(text10.charCodeAt(i + 3));
+    out[outIndex++] = c0 << 2 | c1 >> 4;
+    out[outIndex++] = (c1 & 15) << 4 | c2 >> 2;
+    out[outIndex++] = (c2 & 3) << 6 | c3;
+  }
+  if (remainder === 2) {
+    const c0 = decode2(text10.charCodeAt(i));
+    const c1 = decode2(text10.charCodeAt(i + 1));
+    out[outIndex++] = c0 << 2 | c1 >> 4;
+  } else if (remainder === 3) {
+    const c0 = decode2(text10.charCodeAt(i));
+    const c1 = decode2(text10.charCodeAt(i + 1));
+    const c2 = decode2(text10.charCodeAt(i + 2));
+    out[outIndex++] = c0 << 2 | c1 >> 4;
+    out[outIndex++] = (c1 & 15) << 4 | c2 >> 2;
+  }
+  return out;
+}
+
+// ../../packages/core/src/mobile-auth/protocol/bytes.ts
+init_cjs_shims();
+function bytesToUtf8(bytes) {
+  return new TextDecoder().decode(bytes);
+}
+
+// ../../packages/core/src/mobile-auth/aad-validator.ts
+var DEFAULT_JWKS_TTL_MS = 60 * 60 * 1e3;
+var DEFAULT_CLOCK_SKEW_SEC = 120;
+function decodeJsonSegment(segment) {
+  return JSON.parse(bytesToUtf8(fromBase64Url(segment)));
+}
+function parseJwt(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [headerB64, payloadB64, signatureB64] = parts;
+  try {
+    return {
+      header: decodeJsonSegment(headerB64),
+      payload: decodeJsonSegment(payloadB64),
+      signingInput: `${headerB64}.${payloadB64}`,
+      signature: Buffer.from(fromBase64Url(signatureB64))
+    };
+  } catch {
+    return null;
+  }
+}
+async function defaultJwksFetch(tenantId) {
+  const response = await globalThis.fetch(
+    `https://login.microsoftonline.com/${encodeURIComponent(tenantId)}/discovery/v2.0/keys`
+  );
+  if (!response.ok) {
+    throw new Error(`mobile-auth: AAD JWKS fetch failed with status ${response.status}`);
+  }
+  return await response.json();
+}
+var MobileAadTokenValidator = class {
+  allowedTenants;
+  audiences;
+  allowedUpns;
+  allowedUpnDomains;
+  jwksFetch;
+  now;
+  clockSkewSec;
+  jwksTtlMs;
+  jwksCache = /* @__PURE__ */ new Map();
+  constructor(config2) {
+    this.allowedTenants = new Set(config2.allowedTenants.map((t) => t.toLowerCase()));
+    this.audiences = new Set(config2.audiences);
+    this.allowedUpns = config2.allowedUpns ? new Set(config2.allowedUpns.map((u) => u.toLowerCase())) : void 0;
+    this.allowedUpnDomains = config2.allowedUpnDomains ? new Set(config2.allowedUpnDomains.map((d) => d.toLowerCase())) : void 0;
+    this.jwksFetch = config2.jwksFetch ?? defaultJwksFetch;
+    this.now = config2.now ?? (() => Date.now());
+    this.clockSkewSec = config2.clockSkewSec ?? DEFAULT_CLOCK_SKEW_SEC;
+    this.jwksTtlMs = config2.jwksTtlMs ?? DEFAULT_JWKS_TTL_MS;
+  }
+  async validate(authorization) {
+    const token = (authorization ?? "").replace(/^Bearer\s+/i, "").trim();
+    if (!token) {
+      return { ok: false, reason: "missing-token" };
+    }
+    const jwt2 = parseJwt(token);
+    if (!jwt2) {
+      return { ok: false, reason: "malformed-token" };
+    }
+    if (jwt2.header.alg !== "RS256" || !jwt2.header.kid) {
+      return { ok: false, reason: "unsupported-alg" };
+    }
+    const tid = typeof jwt2.payload.tid === "string" ? jwt2.payload.tid.toLowerCase() : void 0;
+    if (!tid || !this.allowedTenants.has(tid)) {
+      return { ok: false, reason: "tenant-not-allowed" };
+    }
+    let verified = false;
+    try {
+      verified = await this.verifySignature(tid, jwt2.header.kid, jwt2.signingInput, jwt2.signature);
+    } catch {
+      return { ok: false, reason: "jwks-error" };
+    }
+    if (!verified) {
+      return { ok: false, reason: "bad-signature" };
+    }
+    const nowSec = Math.floor(this.now() / 1e3);
+    const exp = typeof jwt2.payload.exp === "number" ? jwt2.payload.exp : 0;
+    const nbf = typeof jwt2.payload.nbf === "number" ? jwt2.payload.nbf : 0;
+    if (exp + this.clockSkewSec < nowSec) {
+      return { ok: false, reason: "expired" };
+    }
+    if (nbf - this.clockSkewSec > nowSec) {
+      return { ok: false, reason: "not-yet-valid" };
+    }
+    const iss = typeof jwt2.payload.iss === "string" ? jwt2.payload.iss : "";
+    if (iss !== `https://login.microsoftonline.com/${tid}/v2.0` && iss !== `https://sts.windows.net/${tid}/`) {
+      return { ok: false, reason: "bad-issuer" };
+    }
+    const aud = jwt2.payload.aud;
+    const audValues = Array.isArray(aud) ? aud : [aud];
+    if (!audValues.some((value) => typeof value === "string" && this.audiences.has(value))) {
+      return { ok: false, reason: "bad-audience" };
+    }
+    const upnRaw = typeof jwt2.payload.upn === "string" ? jwt2.payload.upn : typeof jwt2.payload.preferred_username === "string" ? jwt2.payload.preferred_username : "";
+    const upn = upnRaw.trim().toLowerCase();
+    if (!upn || !upn.includes("@")) {
+      return { ok: false, reason: "invalid-upn" };
+    }
+    if (this.allowedUpns && !this.allowedUpns.has(upn)) {
+      return { ok: false, reason: "upn-not-allowed" };
+    }
+    if (this.allowedUpnDomains) {
+      const domain2 = upn.slice(upn.indexOf("@") + 1);
+      if (!this.allowedUpnDomains.has(domain2)) {
+        return { ok: false, reason: "upn-domain-not-allowed" };
+      }
+    }
+    return {
+      ok: true,
+      identity: {
+        tenantId: tid,
+        upn,
+        objectId: typeof jwt2.payload.oid === "string" ? jwt2.payload.oid : void 0,
+        name: typeof jwt2.payload.name === "string" ? jwt2.payload.name : void 0
+      }
+    };
+  }
+  async verifySignature(tenantId, kid, signingInput, signature) {
+    let key2 = await this.findKey(tenantId, kid, false);
+    if (!key2) {
+      key2 = await this.findKey(tenantId, kid, true);
+    }
+    if (!key2 || key2.kty !== "RSA" || !key2.n || !key2.e) {
+      return false;
+    }
+    try {
+      const publicKey = crypto4.createPublicKey({ key: { kty: "RSA", n: key2.n, e: key2.e }, format: "jwk" });
+      return crypto4.createVerify("RSA-SHA256").update(signingInput).verify(publicKey, signature);
+    } catch {
+      return false;
+    }
+  }
+  async findKey(tenantId, kid, forceRefresh) {
+    const cached2 = this.jwksCache.get(tenantId);
+    const fresh = cached2 && !forceRefresh && this.now() - cached2.fetchedAt < this.jwksTtlMs;
+    let jwks = fresh ? cached2.jwks : void 0;
+    if (!jwks) {
+      jwks = await this.jwksFetch(tenantId);
+      this.jwksCache.set(tenantId, { jwks, fetchedAt: this.now() });
+    }
+    return jwks.keys.find((entry) => entry.kid === kid);
+  }
+};
+
+// ../../packages/core/src/mobile-auth/ingress/index.ts
+init_cjs_shims();
+
+// ../../packages/core/src/mobile-auth/ingress/types.ts
+init_cjs_shims();
+
+// ../../packages/core/src/mobile-auth/ingress/devtunnel.ts
+init_cjs_shims();
+
 // ../../packages/api/src/index.ts
 init_cjs_shims();
 
@@ -145342,7 +145832,7 @@ var BatchTaskIdsBody = external_exports.object({
 init_cjs_shims();
 var path32 = __toESM(require("path"), 1);
 var fs27 = __toESM(require("fs"), 1);
-var import_express17 = __toESM(require_express2(), 1);
+var import_express18 = __toESM(require_express2(), 1);
 
 // ../../packages/api/src/middleware/auth.ts
 init_cjs_shims();
@@ -145433,56 +145923,129 @@ function getAuthLogger(req) {
 function getBearerAuthHeader(req) {
   return req.headers[MESHY_AUTHORIZATION_HEADER] ?? req.headers.authorization;
 }
-function createAuthMiddleware(config2) {
-  return (req, _res, next2) => {
-    const log2 = getAuthLogger(req);
-    if (SKIP_AUTH_PATHS.includes(req.path)) {
-      next2();
+function isPromiseLike(value) {
+  return Boolean(value && typeof value.then === "function");
+}
+function isMobileBearerAllowed(req, config2) {
+  return config2.allowMobileBearerAuth?.(req) === true;
+}
+function validateApiKey(req, config2) {
+  if (!config2.apiKey) {
+    return;
+  }
+  const provided = req.headers["x-api-key"];
+  if (!provided || provided !== config2.apiKey) {
+    throw new MeshyError("VALIDATION_ERROR", "Invalid or missing API key", 401);
+  }
+}
+function rejectBearerRequest(req, log2, reason) {
+  log2.warn("rejected bearer-authenticated request", {
+    path: req.path,
+    method: req.method,
+    hosts: getRequestHosts(req),
+    reason
+  });
+  throw new MeshyError("VALIDATION_ERROR", "Invalid or missing bearer token", 401, { reason });
+}
+function logAcceptedBearer(req, log2, message, reason) {
+  log2.debug(message, {
+    path: req.path,
+    method: req.method,
+    hosts: getRequestHosts(req),
+    reason
+  });
+}
+async function validateMobileBearer(header, config2) {
+  if (!config2.validateMobileBearerToken) {
+    return { ok: false, reason: "mobile-auth-unavailable" };
+  }
+  try {
+    return await config2.validateMobileBearerToken(header);
+  } catch {
+    return { ok: false, reason: "mobile-auth-error" };
+  }
+}
+function authenticateBearerRequest(req, config2, log2) {
+  if (config2.allowTrustedHostBypass !== false && isTrustedDashboardRequest(req, config2)) {
+    log2.debug("skipping bearer auth for trusted dashboard request", {
+      path: req.path,
+      method: req.method,
+      hosts: getRequestHosts(req)
+    });
+    return;
+  }
+  const header = getBearerAuthHeader(req);
+  const nodeBearer = config2.validateBearerToken(header);
+  if (nodeBearer.ok) {
+    logAcceptedBearer(req, log2, "accepted bearer-authenticated request", nodeBearer.reason);
+    return;
+  }
+  if (!isMobileBearerAllowed(req, config2)) {
+    rejectBearerRequest(req, log2, nodeBearer.reason);
+  }
+  return validateMobileBearer(header, config2).then((mobileBearer) => {
+    if (mobileBearer.ok) {
+      logAcceptedBearer(req, log2, "accepted mobile bearer-authenticated request", mobileBearer.reason);
       return;
     }
-    if (config2.validateBearerToken) {
-      if (config2.allowTrustedHostBypass !== false && isTrustedDashboardRequest(req, config2)) {
-        log2.debug("skipping bearer auth for trusted dashboard request", {
-          path: req.path,
-          method: req.method,
-          hosts: getRequestHosts(req)
-        });
-        next2();
-        return;
-      }
-      const result = config2.validateBearerToken(getBearerAuthHeader(req));
-      if (!result.ok) {
-        log2.warn("rejected bearer-authenticated request", {
-          path: req.path,
-          method: req.method,
-          hosts: getRequestHosts(req),
-          reason: result.reason
-        });
-        throw new MeshyError("VALIDATION_ERROR", "Invalid or missing bearer token", 401, {
-          reason: result.reason
-        });
-      }
-      log2.debug("accepted bearer-authenticated request", {
-        path: req.path,
-        method: req.method,
-        hosts: getRequestHosts(req),
-        reason: result.reason
-      });
-      next2();
+    rejectBearerRequest(req, log2, `node:${nodeBearer.reason}; mobile:${mobileBearer.reason}`);
+  });
+}
+function authenticateMobileOrApiKeyRequest(req, config2, log2) {
+  return validateMobileBearer(getBearerAuthHeader(req), config2).then((mobileBearer) => {
+    if (mobileBearer.ok) {
+      logAcceptedBearer(req, log2, "accepted mobile bearer-authenticated request", mobileBearer.reason);
       return;
     }
-    if (!config2.apiKey) {
-      next2();
+    validateApiKey(req, config2);
+  });
+}
+function authenticateRequest(req, config2) {
+  if (SKIP_AUTH_PATHS.includes(req.path)) {
+    return;
+  }
+  const log2 = getAuthLogger(req);
+  if (config2.validateBearerToken) {
+    return authenticateBearerRequest(req, config2, log2);
+  }
+  if (config2.validateMobileBearerToken && isMobileBearerAllowed(req, config2)) {
+    return authenticateMobileOrApiKeyRequest(req, config2, log2);
+  }
+  validateApiKey(req, config2);
+}
+function createAuthMiddleware(config2) {
+  return (req, _res, next2) => {
+    const result = authenticateRequest(req, config2);
+    if (isPromiseLike(result)) {
+      void result.then(() => next2(), next2);
       return;
     }
-    const provided = req.headers["x-api-key"];
-    if (!provided || provided !== config2.apiKey) {
-      throw new MeshyError("VALIDATION_ERROR", "Invalid or missing API key", 401);
-    }
     next2();
   };
 }
 
+// ../../packages/api/src/middleware/mobile-paths.ts
+init_cjs_shims();
+var MOBILE_PAIRING_CONSUME_PATH = /^\/api\/mobile\/pairings\/[^/]+\/consume$/;
+var MOBILE_REST_PATH_PREFIXES = [
+  "/api/system/",
+  "/api/cluster/",
+  "/api/nodes",
+  "/api/node-operations",
+  "/api/tasks",
+  "/api/events",
+  "/api/shared"
+];
+function isMobileBearerAuthPath(pathname) {
+  if (MOBILE_PAIRING_CONSUME_PATH.test(pathname)) {
+    return true;
+  }
+  if (pathname === "/api/mobile" || pathname.startsWith("/api/mobile/")) {
+    return false;
+  }
+  return MOBILE_REST_PATH_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(prefix));
+}
+
 // ../../packages/api/src/middleware/routing.ts
 init_cjs_shims();
 function isRoutingMiddlewareDeps(input) {
@@ -147386,6 +147949,42 @@ function buildNodeSettingsSnapshot(options) {
     packages: runtimeMetadata?.packages ?? {}
   };
 }
+function buildSystemInfo(deps) {
+  const self2 = deps.nodeRegistry.getSelf();
+  const auth = deps.config.authMetadata ?? {
+    enabled: false,
+    allowSameTenant: false,
+    allowedUsers: []
+  };
+  const settingsSnapshot = buildNodeSettingsSnapshot({
+    auth,
+    inspectRuntimeTools: deps.inspectRuntimeTools,
+    localDashboardOrigin: deps.localDashboardOrigin,
+    runtimeMetadata: deps.runtimeMetadata,
+    runtimeUpdate: deps.getRuntimeUpdate?.() ?? deps.runtimeUpdate,
+    storagePath: deps.storagePath,
+    workDir: self2.workDir
+  });
+  return {
+    ...self2,
+    nodeId: self2.id,
+    version: settingsSnapshot.version,
+    packageName: settingsSnapshot.packageName,
+    uptime: settingsSnapshot.uptime,
+    transportType: deps.getTransportType?.() ?? "direct",
+    dashboardOrigin: deps.dashboardOrigin ?? self2.dashboardOrigin,
+    localDashboardOrigin: deps.localDashboardOrigin,
+    auth: settingsSnapshot.auth,
+    os: settingsSnapshot.os,
+    runtime: settingsSnapshot.runtime,
+    runtimeUpdate: settingsSnapshot.runtimeUpdate,
+    agents: settingsSnapshot.agents,
+    startupRequirements: settingsSnapshot.startupRequirements,
+    components: settingsSnapshot.components,
+    repository: settingsSnapshot.repository,
+    packages: settingsSnapshot.packages
+  };
+}
 
 // ../../packages/api/src/node/agent-upgrade-service.ts
 var AGENT_PACKAGES = {
@@ -147504,6 +148103,12 @@ function parseRuntimeRestartStartArgs(value) {
     }
     startArgs.qrCode = value.qrCode;
   }
+  if (value.ghcTunnel !== void 0) {
+    if (typeof value.ghcTunnel !== "boolean") {
+      throw new MeshyError("VALIDATION_ERROR", "Runtime restart ghcTunnel must be a boolean", 400);
+    }
+    startArgs.ghcTunnel = value.ghcTunnel;
+  }
   return Object.keys(startArgs).length > 0 ? startArgs : void 0;
 }
 function parseOptionalString(value, key2) {
@@ -147530,6 +148135,9 @@ var DEFAULT_POLL_INTERVAL_MS = 1e3;
 var DEFAULT_STARTUP_TIMEOUT_MS = 15 * 60 * 1e3;
 var DEFAULT_STOP_TIMEOUT_MS = 3e3;
 var GHC_TUNNEL_ARGS = ["-y", "ghc-tunnel@latest", "-d"];
+var GHC_TUNNEL_SETUP_ARGS = ["-y", "ghc-tunnel@latest", "--setup", "-d"];
+var GHC_TUNNEL_READY_PATTERN = /GitHub Copilot API Proxy/i;
+var GHC_TUNNEL_API_PATTERN = /^\s*(OpenAI API|Responses API|Anthropic API)\b/im;
 var trackedTunnels = /* @__PURE__ */ new Map();
 function createTail() {
   return { text: "", observedBytes: 0, truncated: false };
@@ -147602,11 +148210,8 @@ function tunnelArgs() {
 function windowsShellQuote(value) {
   return /[\s&()^|<>"]/.test(value) ? `"${value.replace(/"/g, '\\"')}"` : value;
 }
-function createCopilotTunnelSpawnInvocation(host, port, platform6 = process.platform) {
-  void host;
-  void port;
+function buildNpxInvocation(displayArgs, platform6) {
   const displayCommand = tunnelCommand(platform6);
-  const displayArgs = tunnelArgs();
   if (platform6 !== "win32") return { command: displayCommand, args: displayArgs, displayCommand, displayArgs };
   return {
     command: "cmd.exe",
@@ -147615,6 +148220,14 @@ function createCopilotTunnelSpawnInvocation(host, port, platform6 = process.plat
     displayArgs
   };
 }
+function createCopilotTunnelSpawnInvocation(host, port, platform6 = process.platform) {
+  void host;
+  void port;
+  return buildNpxInvocation(tunnelArgs(), platform6);
+}
+function createCopilotTunnelSetupInvocation(platform6 = process.platform) {
+  return buildNpxInvocation([...GHC_TUNNEL_SETUP_ARGS], platform6);
+}
 function checkTcpPort(host, port, timeoutMs) {
   return new Promise((resolve24) => {
     const socket = import_node_net.default.createConnection({ host, port });
@@ -147655,6 +148268,9 @@ function parseGithubDeviceFlow(output) {
     ...expires ? { expiresInSeconds: Number(expires) } : {}
   };
 }
+function hasGithubCopilotTunnelReadyOutput(output) {
+  return GHC_TUNNEL_READY_PATTERN.test(output) && GHC_TUNNEL_API_PATTERN.test(output);
+}
 function buildResult(options) {
   const available = options.available ?? (options.status === "already-running" || options.status === "available");
   return {
@@ -147840,8 +148456,11 @@ async function enableGithubCopilotTunnel(options = {}) {
 ${stderr.text}`) ?? auth;
     publish2(auth ? "auth-required" : "starting");
   };
-  child.stdout?.on("data", (chunk) => handleOutput(stdout, Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))));
-  child.stderr?.on("data", (chunk) => handleOutput(stderr, Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))));
+  const stdoutListener = (chunk) => handleOutput(stdout, Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+  const stderrListener = (chunk) => handleOutput(stderr, Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+  const drainListener = (_chunk) => void 0;
+  child.stdout?.on("data", stdoutListener);
+  child.stderr?.on("data", stderrListener);
   child.once("error", (err) => {
     childState.spawnError = err instanceof Error ? err : new Error(String(err));
   });
@@ -147850,11 +148469,21 @@ ${stderr.text}`) ?? auth;
     if (trackedTunnels.get(key2) === child) trackedTunnels.delete(key2);
   });
   publish2("starting");
+  const releaseStartupOutputCapture = () => {
+    child.stdout?.unref?.();
+    child.stderr?.unref?.();
+    if (options.captureOutputAfterReady !== false) return;
+    child.stdout?.removeListener?.("data", stdoutListener);
+    child.stderr?.removeListener?.("data", stderrListener);
+    child.stdout?.on("data", drainListener);
+    child.stderr?.on("data", drainListener);
+  };
   const deadline = Date.now() + startupTimeoutMs;
   while (Date.now() < deadline) {
     if (await portChecker(host, port, portCheckTimeoutMs)) {
       trackedTunnels.set(key2, child);
       child.unref?.();
+      releaseStartupOutputCapture();
       return buildResult({ host, port, command, args, pid, status: "available", stdout, stderr, auth });
     }
     if (childState.spawnError) {
@@ -147869,6 +148498,72 @@ ${stderr.text}`) ?? auth;
   await terminateChildProcess(child, stopTimeoutMs);
   return buildResult({ host, port, command, args, pid, status: "failed", stdout, stderr, auth, detail: `Timed out waiting for port ${port}` });
 }
+async function runGithubCopilotTunnelSetup(options = {}) {
+  const host = DEFAULT_HOST;
+  const port = DEFAULT_PORT;
+  const invocation = createCopilotTunnelSetupInvocation();
+  const command = invocation.displayCommand;
+  const args = invocation.displayArgs;
+  const stdout = createTail();
+  const stderr = createTail();
+  const outputLimitBytes = options.outputLimitBytes ?? DEFAULT_OUTPUT_LIMIT_BYTES;
+  let auth = null;
+  const child = (options.spawnSetup ?? defaultSpawnTunnel)(invocation.command, invocation.args, {
+    cwd: options.cwd ?? process.cwd(),
+    shell: false,
+    windowsHide: true,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const pid = typeof child.pid === "number" ? child.pid : null;
+  const publish2 = (status, detail) => {
+    options.onProgress?.(buildResult({ host, port, command, args, pid, status, stdout, stderr, auth, detail }));
+  };
+  let settled = false;
+  let resolveResult;
+  const releaseSetupOutputCapture = () => {
+    child.stdout?.unref?.();
+    child.stderr?.unref?.();
+    child.stdout?.removeListener?.("data", stdoutListener);
+    child.stderr?.removeListener?.("data", stderrListener);
+    child.unref?.();
+  };
+  const settle = (result) => {
+    if (settled) return;
+    settled = true;
+    resolveResult?.(result);
+  };
+  const handleOutput = (target, chunk) => {
+    appendTail(target, chunk, outputLimitBytes);
+    auth = parseGithubDeviceFlow(`${stdout.text}
+${stderr.text}`) ?? auth;
+    publish2(auth ? "auth-required" : "starting");
+    if (options.resolveOnReadyOutput && hasGithubCopilotTunnelReadyOutput(`${stdout.text}
+${stderr.text}`)) {
+      releaseSetupOutputCapture();
+      settle(buildResult({ host, port, command, args, pid, status: "available", available: true, stdout, stderr, auth }));
+    }
+  };
+  const stdoutListener = (chunk) => handleOutput(stdout, Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+  const stderrListener = (chunk) => handleOutput(stderr, Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+  child.stdout?.on("data", stdoutListener);
+  child.stderr?.on("data", stderrListener);
+  publish2("starting");
+  return new Promise((resolve24) => {
+    resolveResult = resolve24;
+    child.once("error", (err) => {
+      const message = err instanceof Error ? err.message : String(err);
+      settle(buildResult({ host, port, command, args, pid, status: "failed", available: false, stdout, stderr, auth, detail: message }));
+    });
+    child.once("close", (code4, signal) => {
+      if (code4 === 0) {
+        settle(buildResult({ host, port, command, args, pid, status: "available", available: true, stdout, stderr, auth }));
+        return;
+      }
+      const detail = `ghc-tunnel --setup exited with code ${code4 ?? "null"}${signal ? ` (${signal})` : ""}`;
+      settle(buildResult({ host, port, command, args, pid, status: "failed", available: false, stdout, stderr, auth, detail }));
+    });
+  });
+}
 
 // ../../packages/api/src/node/node-operation-service.ts
 var LEADER_REPORT_RETRY_MS = 5e3;
@@ -147888,22 +148583,22 @@ var InMemoryNodeOperationStore = class {
   operations = /* @__PURE__ */ new Map();
   get(id) {
     const operation = this.operations.get(id);
-    return operation ? clone3(operation) : null;
+    return operation ? clone4(operation) : null;
   }
   list(filter = {}) {
-    return Array.from(this.operations.values()).filter((operation) => matchesFilter(operation, filter)).sort((a, b) => b.createdAt - a.createdAt).map((operation) => clone3(operation));
+    return Array.from(this.operations.values()).filter((operation) => matchesFilter(operation, filter)).sort((a, b) => b.createdAt - a.createdAt).map((operation) => clone4(operation));
   }
   upsert(operation) {
-    const copy = clone3(operation);
+    const copy = clone4(operation);
     this.operations.set(copy.id, copy);
-    return clone3(copy);
+    return clone4(copy);
   }
   update(id, updates) {
     const current = this.operations.get(id);
     if (!current) return null;
-    const next2 = { ...current, ...clone3(updates), id, createdAt: current.createdAt };
+    const next2 = { ...current, ...clone4(updates), id, createdAt: current.createdAt };
     this.operations.set(id, next2);
-    return clone3(next2);
+    return clone4(next2);
   }
 };
 var NodeOperationService = class {
@@ -148284,7 +148979,7 @@ function matchesFilter(operation, filter) {
 function isTerminalStatus(status) {
   return status === "succeeded" || status === "failed";
 }
-function clone3(value) {
+function clone4(value) {
   return JSON.parse(JSON.stringify(value));
 }
 
@@ -148965,7 +149660,7 @@ init_cjs_shims();
 
 // ../../packages/api/src/preview/preview-server.ts
 init_cjs_shims();
-var crypto4 = __toESM(require("crypto"), 1);
+var crypto5 = __toESM(require("crypto"), 1);
 var fs23 = __toESM(require("fs"), 1);
 var path28 = __toESM(require("path"), 1);
 var http2 = __toESM(require("http"), 1);
@@ -159449,15 +160144,15 @@ function doctype2(node2, state3) {
 }
 function stitch(node2, state3) {
   state3.stitches = true;
-  const clone4 = cloneWithoutChildren(node2);
-  if ("children" in node2 && "children" in clone4) {
+  const clone5 = cloneWithoutChildren(node2);
+  if ("children" in node2 && "children" in clone5) {
     const fakeRoot = (
       /** @type {Root} */
       raw({ type: "root", children: node2.children }, state3.options)
     );
-    clone4.children = fakeRoot.children;
+    clone5.children = fakeRoot.children;
   }
-  comment2({ type: "comment", value: { stitch: clone4 } }, state3);
+  comment2({ type: "comment", value: { stitch: clone5 } }, state3);
 }
 function comment2(node2, state3) {
   const data = node2.value;
@@ -172266,7 +172961,7 @@ var import_extend = __toESM(require_extend(), 1);
 
 // ../../node_modules/.pnpm/is-plain-obj@4.1.0/node_modules/is-plain-obj/index.js
 init_cjs_shims();
-function isPlainObject4(value) {
+function isPlainObject5(value) {
   if (typeof value !== "object" || value === null) {
     return false;
   }
@@ -173596,7 +174291,7 @@ var Processor = class _Processor extends CallableInstance {
       } else if (parameters2.length > 0) {
         let [primary, ...rest] = parameters2;
         const currentPrimary = attachers[entryIndex][1];
-        if (isPlainObject4(currentPrimary) && isPlainObject4(primary)) {
+        if (isPlainObject5(currentPrimary) && isPlainObject5(primary)) {
           primary = (0, import_extend.default)(true, currentPrimary, primary);
         }
         attachers[entryIndex] = [plugin, primary, ...rest];
@@ -173623,7 +174318,7 @@ function assertUnfrozen(name2, frozen) {
   }
 }
 function assertNode(node2) {
-  if (!isPlainObject4(node2) || typeof node2.type !== "string") {
+  if (!isPlainObject5(node2) || typeof node2.type !== "string") {
     throw new TypeError("Expected node, got `" + node2 + "`");
   }
 }
@@ -173799,12 +174494,12 @@ function buildPreviewRouteUrl(origin, route, session) {
   const suffix = encodedEntryPath.length > 0 ? `/${encodedEntryPath}` : session.kind === "service" ? "/" : "";
   return `${origin.replace(/\/+$/, "")}/${route}/${session.token}${suffix}`;
 }
-var DEFAULT_TTL_MS = 15 * 60 * 1e3;
+var DEFAULT_TTL_MS2 = 15 * 60 * 1e3;
 var PreviewSessionManager = class {
   sessions = /* @__PURE__ */ new Map();
   create(options) {
-    const token = crypto4.randomBytes(32).toString("hex");
-    const expiresAt = Date.now() + (options.ttlMs ?? DEFAULT_TTL_MS);
+    const token = crypto5.randomBytes(32).toString("hex");
+    const expiresAt = Date.now() + (options.ttlMs ?? DEFAULT_TTL_MS2);
     if (options.port !== void 0) {
       const session2 = {
         token,
@@ -176705,7 +177400,10 @@ async function sendTaskFollowUpMessage(deps, task, content3, metadata) {
     });
     try {
       const client = new NodeMessageClient({ heartbeat: deps.heartbeat, logger: deps.logger });
-      const delivery = await client.send(node2, createNodeMessage("task.message", { taskId: task.id, content: content3 }));
+      const delivery = await client.send(node2, createNodeMessage("task.message", {
+        taskId: task.id,
+        content: content3
+      }));
       return delivery.queued ? { queued: true } : {};
     } catch (err) {
       restoreTaskState(deps.taskEngine, task);
@@ -176737,6 +177435,18 @@ function queueRunningTaskMessage(deps, task, content3) {
   });
   return queued;
 }
+var MESSAGEABLE_STATUSES = /* @__PURE__ */ new Set(["running", "completed", "cancelled", "failed"]);
+async function applyTaskMessage(deps, task, content3) {
+  if (!MESSAGEABLE_STATUSES.has(task.status)) {
+    throw new MeshyError("VALIDATION_ERROR", `Cannot send message to task in ${task.status} status`, 400);
+  }
+  if (task.status === "running") {
+    const queued = queueRunningTaskMessage(deps, task, content3);
+    return { ok: true, queued: true, queuedMessages: queued.queuedMessages ?? [] };
+  }
+  const result = await sendTaskFollowUpMessage(deps, task, content3);
+  return result.queued ? { ok: true, queued: true } : { ok: true };
+}
 function cancelQueuedTaskMessage(deps, taskId, messageId) {
   const task = deps.taskEngine.removeQueuedTaskMessage(taskId, messageId);
   if (!task) {
@@ -177242,6 +177952,10 @@ var ACTIVE_STATUSES = /* @__PURE__ */ new Set(["pending", "assigned", "running"]
 var TASK_DELETE_NOTIFY_TIMEOUT_MS = 1500;
 var TASK_DETAIL_PROXY_TIMEOUT_MS = 1e4;
 var TASK_DETAIL_PROXY_HEADER = "x-meshy-task-detail-proxy";
+var DEFAULT_TASK_TITLE_GENERATION_MODEL = "gpt-5.4-mini";
+function getTaskTitleGenerationModel(agent) {
+  return agent === "claudecode" ? void 0 : DEFAULT_TASK_TITLE_GENERATION_MODEL;
+}
 function shouldGenerateTitle(task) {
   return task.payload.titleSource === "derived";
 }
@@ -177267,6 +177981,7 @@ function scheduleTitleGeneration(deps, task) {
   }
   const prompt = getTitlePrompt(task);
   const cwd = deps.workDir;
+  const model = getTaskTitleGenerationModel(task.agent);
   log2.info("generating task title", {
     taskId: task.id,
     agent: task.agent,
@@ -177279,7 +177994,8 @@ function scheduleTitleGeneration(deps, task) {
     existingTitle: task.title
   }, {
     agent: task.agent,
-    cwd
+    cwd,
+    ...model ? { model } : {}
   }).then(({ title }) => {
     const current = deps.taskEngine.getTask(task.id);
     if (!current) {
@@ -177752,22 +178468,11 @@ function createTaskRoutes() {
     if (!task) {
       throw new MeshyError("TASK_NOT_FOUND", `Task ${taskId} not found`, 404);
     }
-    if (!["running", "completed", "cancelled", "failed"].includes(task.status)) {
-      throw new MeshyError("VALIDATION_ERROR", `Cannot send message to task in ${task.status} status`, 400);
-    }
-    if (task.status === "running") {
-      const queued = queueRunningTaskMessage({ taskEngine, logger: rootLogger }, task, body3.content);
-      res.json({ ok: true, queued: true, queuedMessages: queued.queuedMessages ?? [] });
-      return;
-    }
-    const result = await sendTaskFollowUpMessage({
-      taskEngine,
-      engineRegistry,
-      nodeRegistry,
-      heartbeat,
-      logger: rootLogger
-    }, task, body3.content);
-    res.json(result.queued ? { ok: true, queued: true } : { ok: true });
+    res.json(await applyTaskMessage(
+      { taskEngine, engineRegistry, nodeRegistry, heartbeat, logger: rootLogger },
+      task,
+      body3.content
+    ));
   }));
   router.use(createTaskOutputRoutes());
   return router;
@@ -178266,52 +178971,7 @@ function createSystemRoutes() {
     res.json({ status: "ok", timestamp: Date.now(), pid: process.pid });
   }));
   router.get("/info", asyncHandler11(async (req, res) => {
-    const {
-      nodeRegistry,
-      getTransportType,
-      config: config2,
-      dashboardOrigin,
-      localDashboardOrigin,
-      storagePath,
-      inspectRuntimeTools: inspectTools,
-      runtimeMetadata,
-      getRuntimeUpdate,
-      runtimeUpdate
-    } = req.app.locals.deps;
-    const self2 = nodeRegistry.getSelf();
-    const auth = config2.authMetadata ?? {
-      enabled: false,
-      allowSameTenant: false,
-      allowedUsers: []
-    };
-    const settingsSnapshot = buildNodeSettingsSnapshot({
-      auth,
-      inspectRuntimeTools: inspectTools,
-      localDashboardOrigin,
-      runtimeMetadata,
-      runtimeUpdate: getRuntimeUpdate?.() ?? runtimeUpdate,
-      storagePath,
-      workDir: self2.workDir
-    });
-    res.json({
-      ...self2,
-      nodeId: self2.id,
-      version: settingsSnapshot.version,
-      packageName: settingsSnapshot.packageName,
-      uptime: settingsSnapshot.uptime,
-      transportType: getTransportType?.() ?? "direct",
-      dashboardOrigin: dashboardOrigin ?? self2.dashboardOrigin,
-      localDashboardOrigin,
-      auth: settingsSnapshot.auth,
-      os: settingsSnapshot.os,
-      runtime: settingsSnapshot.runtime,
-      runtimeUpdate: settingsSnapshot.runtimeUpdate,
-      agents: settingsSnapshot.agents,
-      startupRequirements: settingsSnapshot.startupRequirements,
-      components: settingsSnapshot.components,
-      repository: settingsSnapshot.repository,
-      packages: settingsSnapshot.packages
-    });
+    res.json(buildSystemInfo(req.app.locals.deps));
   }));
   router.post("/runtime/restart", asyncHandler11(async (req, res) => {
     const { restartRuntime } = req.app.locals.deps;
@@ -178507,9 +179167,120 @@ function createNodeOperationRoutes() {
   return router;
 }
 
-// ../../packages/api/src/routes/telemetry.ts
+// ../../packages/api/src/routes/mobile.ts
 init_cjs_shims();
 var import_express16 = __toESM(require_express2(), 1);
+function asyncHandler13(fn) {
+  return (req, res, next2) => {
+    fn(req, res, next2).catch((error2) => {
+      if (error2 instanceof MobilePairingInvitationError) {
+        res.status(error2.statusCode).json({ error: { code: error2.code, message: error2.message } });
+        return;
+      }
+      next2(error2);
+    });
+  };
+}
+function getService(req) {
+  const service = req.app.locals.deps.mobilePairingInvitations;
+  if (!service) {
+    throw new MeshyError("VALIDATION_ERROR", "mobile pairing is not enabled on this node", 404);
+  }
+  return service;
+}
+async function requireMobileAadIdentity(req) {
+  const validator = req.app.locals.deps.mobileAadValidator;
+  if (!validator) {
+    throw new MeshyError("VALIDATION_ERROR", "mobile AAD auth is not enabled on this node", 401);
+  }
+  const result = await validator.validate(req.headers.authorization);
+  if (!result.ok) {
+    throw new MeshyError("VALIDATION_ERROR", `mobile AAD auth failed: ${result.reason}`, 401);
+  }
+  return result.identity;
+}
+function getSourceAddress(req) {
+  const forwarded = req.headers["x-forwarded-for"];
+  if (typeof forwarded === "string" && forwarded.length > 0) {
+    return forwarded.split(",")[0]?.trim();
+  }
+  return req.ip ?? void 0;
+}
+function optionalString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function optionalPositiveInteger(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : void 0;
+}
+function createMobileRoutes() {
+  const router = (0, import_express16.Router)();
+  router.post(
+    "/pairings",
+    asyncHandler13(async (req, res) => {
+      const body3 = req.body ?? {};
+      const created = getService(req).createInvitation({
+        ttlMs: optionalPositiveInteger(body3.ttlMs),
+        maxUses: optionalPositiveInteger(body3.maxUses),
+        createdBy: optionalString(body3.createdBy) ?? "local-node-user"
+      });
+      res.status(201).json(created);
+    })
+  );
+  router.get(
+    "/pairings",
+    asyncHandler13(async (req, res) => {
+      res.json({ pairings: getService(req).listInvitations() });
+    })
+  );
+  router.get(
+    "/pairings/:pairingId",
+    asyncHandler13(async (req, res) => {
+      const invitation = getService(req).getInvitation(req.params.pairingId);
+      if (!invitation) {
+        throw new MeshyError("VALIDATION_ERROR", "unknown pairing invitation", 404);
+      }
+      res.json({ invitation });
+    })
+  );
+  router.delete(
+    "/pairings/:pairingId",
+    asyncHandler13(async (req, res) => {
+      res.json({ cancelled: getService(req).cancelInvitation(req.params.pairingId) });
+    })
+  );
+  router.post(
+    "/pairings/:pairingId/consume",
+    asyncHandler13(async (req, res) => {
+      const identity2 = await requireMobileAadIdentity(req);
+      const body3 = req.body ?? {};
+      const connection = getService(req).consumeInvitation(req.params.pairingId, {
+        identity: { tenantId: identity2.tenantId, upn: identity2.upn, objectId: identity2.objectId },
+        deviceName: optionalString(body3.deviceName),
+        platform: optionalString(body3.platform),
+        appVersion: optionalString(body3.appVersion),
+        sourceAddress: getSourceAddress(req)
+      });
+      res.json(connection);
+    })
+  );
+  router.get(
+    "/connections",
+    asyncHandler13(async (req, res) => {
+      res.json({ connections: getService(req).listConnections() });
+    })
+  );
+  router.delete(
+    "/connections/:connectionId",
+    asyncHandler13(async (req, res) => {
+      res.json({ revoked: getService(req).revokeConnection(req.params.connectionId) });
+    })
+  );
+  return router;
+}
+
+// ../../packages/api/src/routes/telemetry.ts
+init_cjs_shims();
+var import_express17 = __toESM(require_express2(), 1);
 var FRONTEND_EVENT_NAMES = /* @__PURE__ */ new Set([
   "feature.settings.opened",
   "feature.preview.created",
@@ -178565,7 +179336,7 @@ var frontendTelemetryEventSchema = external_exports.object({
   }
 });
 function createTelemetryRoutes() {
-  const router = (0, import_express16.Router)();
+  const router = (0, import_express17.Router)();
   router.post("/events", (req, res, next2) => {
     try {
       const body3 = frontendTelemetryEventSchema.parse(req.body);
@@ -178610,7 +179381,7 @@ function isSuppressedRequestTelemetryRoute(req) {
   return REQUEST_TELEMETRY_SUPPRESSED_ROUTES.has(key2);
 }
 function usesLargeJsonBodyLimit(pathname) {
-  return pathname === "/api/cluster/join" || pathname === "/api/node" || pathname.startsWith("/api/node/") || pathname === "/api/tasks" || pathname.startsWith("/api/tasks/") || pathname === "/api/worker" || pathname.startsWith("/api/worker/");
+  return pathname === "/api/cluster/join" || pathname === "/api/node" || pathname.startsWith("/api/node/") || pathname === "/api/tasks" || pathname.startsWith("/api/tasks/") || pathname === "/api/worker" || pathname.startsWith("/api/worker/") || pathname.startsWith("/api/mobile/");
 }
 function usesCapabilityJsonBodyLimit(pathname) {
   return pathname === "/api/capabilities/share" || pathname === "/api/capabilities/conflict-check" || pathname === "/api/node" || pathname.startsWith("/api/node/");
@@ -178737,7 +179508,7 @@ function resolveStaticDir(baseDir) {
   return null;
 }
 function createServer2(deps) {
-  const app = (0, import_express17.default)();
+  const app = (0, import_express18.default)();
   app.locals.deps = deps;
   registerTaskMessageQueueDrainer(deps);
   if (typeof deps.heartbeat.setNodeMessageHandler === "function") {
@@ -178747,6 +179518,12 @@ function createServer2(deps) {
   const authConfig = {
     apiKey: deps.config.apiKey,
     validateBearerToken: deps.config.validateBearerToken,
+    validateMobileBearerToken: deps.mobileAadValidator ? async (header) => {
+      const value = Array.isArray(header) ? header[0] : header;
+      const result = await deps.mobileAadValidator.validate(value);
+      return result.ok ? { ok: true, reason: "mobile-aad", identity: result.identity } : { ok: false, reason: result.reason };
+    } : void 0,
+    allowMobileBearerAuth: (req) => isMobileBearerAuthPath(req.path),
     getTrustedHosts: () => {
       const trustedHosts = [];
       if (deps.dashboardOrigin) {
@@ -178800,7 +179577,7 @@ function createServer2(deps) {
   const runtimeBaseDir = resolveRuntimeBaseDir();
   const staticDir = resolveStaticDir(runtimeBaseDir);
   if (staticDir) {
-    const staticMiddleware = import_express17.default.static(staticDir);
+    const staticMiddleware = import_express18.default.static(staticDir);
     app.use((req, res, next2) => {
       if (isApiRequest(req) || isPreviewRequest(req)) {
         next2();
@@ -178813,9 +179590,9 @@ function createServer2(deps) {
       staticMiddleware(req, res, next2);
     });
   }
-  const defaultJsonParser = import_express17.default.json({ limit: JSON_BODY_LIMIT });
-  const largeJsonParser = import_express17.default.json({ limit: JSON_BODY_LIMIT_LARGE });
-  const capabilityJsonParser = import_express17.default.json({ limit: JSON_BODY_LIMIT_CAPABILITIES });
+  const defaultJsonParser = import_express18.default.json({ limit: JSON_BODY_LIMIT });
+  const largeJsonParser = import_express18.default.json({ limit: JSON_BODY_LIMIT_LARGE });
+  const capabilityJsonParser = import_express18.default.json({ limit: JSON_BODY_LIMIT_CAPABILITIES });
   app.use((req, res, next2) => {
     const parser = usesCapabilityJsonBodyLimit(req.path) ? capabilityJsonParser : usesLargeJsonBodyLimit(req.path) ? largeJsonParser : defaultJsonParser;
     parser(req, res, next2);
@@ -178856,6 +179633,7 @@ function createServer2(deps) {
   app.use("/api/worker", createWorkerRoutes());
   app.use("/api/system", createSystemRoutes());
   app.use("/api/node-operations", createNodeOperationRoutes());
+  app.use("/api/mobile", createMobileRoutes());
   app.use("/api/telemetry", createTelemetryRoutes());
   app.use("/api/events", createEventRoutes());
   if (staticDir) {
@@ -179478,10 +180256,27 @@ var path34 = __toESM(require("path"), 1);
 var readline = __toESM(require("readline/promises"), 1);
 var import_node_child_process13 = require("child_process");
 var STARTUP_REQUIREMENTS = ["az", "devtunnel", "claude", "codex", "copilot"];
+var GITHUB_AUTH_STATUS_ARGS = ["auth", "status", "--hostname", "github.com"];
+var GITHUB_AUTH_LOGIN_ARGS = [
+  "auth",
+  "login",
+  "--hostname",
+  "github.com",
+  "--web",
+  "--git-protocol",
+  "https",
+  "--skip-ssh-key"
+];
+var COPILOT_TUNNEL_PORT2 = 8314;
 function writeLine(stream, message = "") {
   stream.write(`${message}
 `);
 }
+var ANSI = { reset: "\x1B[0m", bold: "\x1B[1m", cyan: "\x1B[36m", green: "\x1B[32m", amber: "\x1B[33m", red: "\x1B[31m" };
+function highlight(label, message) {
+  const color2 = { info: "bold", success: "green", warning: "amber", error: "red", accent: "cyan" }[label];
+  return `${ANSI[color2]}${message}${ANSI.reset}`;
+}
 function shouldPromptForStartupTools() {
   return Boolean(process.stdin.isTTY && process.stdout.isTTY);
 }
@@ -179593,10 +180388,13 @@ function buildLoginCommand(requirement) {
   if (requirement === "az") {
     return { command: "az", args: ["login"] };
   }
+  if (requirement === "copilot") {
+    return { command: "gh", args: [...GITHUB_AUTH_LOGIN_ARGS] };
+  }
   return { command: "devtunnel", args: ["user", "login"] };
 }
 function isAuthenticated(requirement, commandRunner) {
-  const command = requirement === "az" ? { command: "az", args: ["account", "show"] } : { command: "devtunnel", args: ["user", "show"] };
+  const command = requirement === "az" ? { command: "az", args: ["account", "show"] } : requirement === "copilot" ? { command: "gh", args: [...GITHUB_AUTH_STATUS_ARGS] } : { command: "devtunnel", args: ["user", "show"] };
   const result = commandRunner(command.command, command.args, false);
   if (!result.ok) {
     return false;
@@ -179612,7 +180410,7 @@ function isRequirementSatisfied(requirement, status) {
   if (!status || status.installed !== true || status.status !== "ok") {
     return false;
   }
-  if (requirement === "az" || requirement === "devtunnel") {
+  if (requirement === "az" || requirement === "devtunnel" || requirement === "copilot") {
     return status.authenticated === true;
   }
   return true;
@@ -179621,12 +180419,214 @@ function sleep4(ms) {
   return new Promise((resolve24) => setTimeout(resolve24, ms));
 }
 function areCachedAuthRequirementsCurrent(commandRunner) {
-  return isAuthenticated("az", commandRunner) && isAuthenticated("devtunnel", commandRunner);
+  return isAuthenticated("az", commandRunner) && isAuthenticated("devtunnel", commandRunner) && isAuthenticated("copilot", commandRunner);
 }
 function resolveStartupRequirementsMetadata(storagePath) {
   const metadata = readStartupMetadataFile(storagePath).startupRequirements;
   return metadata && typeof metadata === "object" ? metadata : {};
 }
+function persistCopilotTunnelPreference(storagePath, metadata, enabled2, now) {
+  metadata.copilotTunnel = { enabled: enabled2, updatedAt: now.toISOString() };
+  const metadataFile = readStartupMetadataFile(storagePath);
+  metadataFile.startupRequirements = {
+    ...metadataFile.startupRequirements ?? {},
+    ...metadata
+  };
+  writeStartupMetadataFile(storagePath, metadataFile);
+  return metadata;
+}
+async function ensureOptionalCopilotTunnel(options) {
+  if (!isRequirementSatisfied("copilot", options.metadata.components?.copilot)) {
+    return;
+  }
+  const status = await checkGithubCopilotTunnel({
+    portChecker: options.startupOptions.copilotTunnelPortChecker,
+    portCheckTimeoutMs: options.startupOptions.copilotTunnelPortCheckTimeoutMs
+  });
+  if (status.available) {
+    if (options.startupOptions.copilotTunnelEnabled !== void 0) {
+      persistCopilotTunnelPreference(options.storagePath, options.metadata, options.startupOptions.copilotTunnelEnabled, options.now);
+    }
+    writeLine(options.stdout, highlight("success", `GitHub Copilot Tunnel already available on port ${COPILOT_TUNNEL_PORT2}; skipping setup.`));
+    return;
+  }
+  const preference = options.startupOptions.copilotTunnelEnabled ?? options.metadata.copilotTunnel?.enabled;
+  if (preference === false) {
+    persistCopilotTunnelPreference(options.storagePath, options.metadata, false, options.now);
+    writeLine(options.stdout, highlight("info", "GitHub Copilot Tunnel disabled by startup preference."));
+    return;
+  }
+  if (preference === true) {
+    persistCopilotTunnelPreference(options.storagePath, options.metadata, true, options.now);
+    await options.releasePrompt();
+    const auth2 = await ensureRequirementAuthenticated(
+      "copilot",
+      options.getAsk,
+      options.commandRunner,
+      options.stdout,
+      options.stderr,
+      options.releasePrompt,
+      options.authPollIntervalMs,
+      options.authPollTimeoutMs
+    );
+    if (!auth2.authenticated) {
+      writeLine(options.stderr, highlight("error", "GitHub Copilot Tunnel requires GitHub authentication; skipping tunnel setup."));
+      return;
+    }
+    writeLine(options.stdout, highlight("accent", "Configuring GitHub Copilot Tunnel..."));
+    await runCopilotTunnel(options);
+    return;
+  }
+  const ask = options.getAsk();
+  if (!ask) {
+    writeLine(options.stdout, highlight("warning", `GitHub Copilot Tunnel is optional. Start in a TTY to enable the local proxy on port ${COPILOT_TUNNEL_PORT2}.`));
+    return;
+  }
+  writeLine(options.stdout);
+  writeLine(options.stdout, highlight("info", "Enable GitHub Copilot Tunnel?"));
+  writeLine(
+    options.stdout,
+    highlight("warning", "This will configure Claude Code and Codex to use the GitHub Copilot model provider, then start a local proxy on port 8314. You may be asked to sign in to GitHub with a device code.")
+  );
+  if (!await confirm(ask, "Enable GitHub Copilot Tunnel?")) {
+    persistCopilotTunnelPreference(options.storagePath, options.metadata, false, options.now);
+    return;
+  }
+  persistCopilotTunnelPreference(options.storagePath, options.metadata, true, options.now);
+  await options.releasePrompt();
+  const auth = await ensureRequirementAuthenticated(
+    "copilot",
+    options.getAsk,
+    options.commandRunner,
+    options.stdout,
+    options.stderr,
+    options.releasePrompt,
+    options.authPollIntervalMs,
+    options.authPollTimeoutMs
+  );
+  if (!auth.authenticated) {
+    writeLine(options.stderr, highlight("error", "GitHub Copilot Tunnel requires GitHub authentication; skipping tunnel setup."));
+    return;
+  }
+  writeLine(options.stdout, highlight("accent", "Configuring GitHub Copilot Tunnel..."));
+  await runCopilotTunnel(options);
+}
+var COPILOT_TUNNEL_KEY_INFO_PATTERN = /GitHub Copilot API Proxy|^\s*(Dashboard|OpenAI API|Responses API|Anthropic API)\b/i;
+var COPILOT_TUNNEL_API_INFO_PATTERN = /^\s*(OpenAI API|Responses API|Anthropic API)\b/i;
+function extractCopilotTunnelKeyInfo(output) {
+  return output.split(/\r?\n/).map((line) => line.replace(/\s+$/, "")).filter((line) => line.trim() !== "" && COPILOT_TUNNEL_KEY_INFO_PATTERN.test(line));
+}
+function hasCopilotTunnelApiInfo(lines) {
+  return lines.some((line) => COPILOT_TUNNEL_API_INFO_PATTERN.test(line));
+}
+async function runCopilotTunnel(options) {
+  let lastAuthCode;
+  let reportedKeyInfo = false;
+  let reportedWaitingForAuth = false;
+  let releaseStartupWait;
+  const startupWait = new Promise((resolve24) => {
+    releaseStartupWait = resolve24;
+  });
+  const reportTunnelKeyInfo = (tunnel) => {
+    if (reportedKeyInfo) return false;
+    const keyInfo = extractCopilotTunnelKeyInfo(`${tunnel.stdout}
+${tunnel.stderr}`);
+    const pidSuffix = tunnel.pid ? ` (pid ${tunnel.pid})` : "";
+    if (keyInfo.length > 0 && hasCopilotTunnelApiInfo(keyInfo)) {
+      reportedKeyInfo = true;
+      writeLine(options.stdout, `GitHub Copilot Tunnel is ready${pidSuffix}:`);
+      for (const line of keyInfo) writeLine(options.stdout, `  ${line.trim()}`);
+      return true;
+    }
+    return false;
+  };
+  const reportTunnelReady = (tunnel) => {
+    if (reportTunnelKeyInfo(tunnel)) return true;
+    if (!tunnel.available) return false;
+    reportedKeyInfo = true;
+    const pidSuffix = tunnel.pid ? ` (pid ${tunnel.pid})` : "";
+    writeLine(options.stdout, `GitHub Copilot Tunnel is available on port ${tunnel.port}${pidSuffix}.`);
+    return true;
+  };
+  const reportTunnelFailure = (tunnel) => {
+    if (tunnel.available || tunnel.status === "auth-required") return;
+    writeLine(options.stderr, tunnel.detail ?? "GitHub Copilot Tunnel failed to start.");
+  };
+  const surfaceDeviceLogin = (update, releaseOnAuth) => {
+    if (update.status === "auth-required" && update.auth && update.auth.code !== lastAuthCode) {
+      lastAuthCode = update.auth.code;
+      writeLine(options.stdout);
+      writeLine(options.stdout, "GitHub sign-in required to enable the Copilot tunnel.");
+      writeLine(options.stdout, `Open ${update.auth.url} and enter the device code below.`);
+      writeLine(options.stdout, `Device code: ${update.auth.code}`);
+      writeLine(options.stdout, "Waiting for you to finish signing in...");
+      if (releaseOnAuth && !reportedWaitingForAuth) {
+        reportedWaitingForAuth = true;
+        writeLine(options.stdout, "GitHub Copilot Tunnel is waiting for GitHub sign-in; Meshy startup will continue.");
+      }
+      if (releaseOnAuth) releaseStartupWait?.();
+      return;
+    }
+    if (reportTunnelKeyInfo(update)) {
+      releaseStartupWait?.();
+    }
+  };
+  const waitForSetup = async () => {
+    const setupPromise = runGithubCopilotTunnelSetup({
+      resolveOnReadyOutput: true,
+      spawnSetup: options.startupOptions.copilotTunnelSetupSpawn,
+      onProgress: (update) => surfaceDeviceLogin(update, false)
+    });
+    const firstSetupResult = await Promise.race([
+      setupPromise.then((setup) => ({ kind: "result", setup })),
+      startupWait.then(() => ({ kind: "started-proxy" }))
+    ]);
+    if (firstSetupResult.kind === "started-proxy") {
+      void setupPromise.then((setup) => {
+        if (!reportedKeyInfo && !setup.ok) reportTunnelFailure(setup);
+      }).catch((err) => {
+        if (!reportedKeyInfo) writeLine(options.stderr, `GitHub Copilot Tunnel setup failed: ${err instanceof Error ? err.message : String(err)}`);
+      });
+      return "started-proxy";
+    }
+    if (!firstSetupResult.setup.ok) {
+      writeLine(options.stderr, firstSetupResult.setup.detail ?? "GitHub Copilot Tunnel setup failed.");
+      return "failed";
+    }
+    return reportTunnelKeyInfo(firstSetupResult.setup) ? "started-proxy" : "completed";
+  };
+  try {
+    const setupStatus = await waitForSetup();
+    if (setupStatus !== "completed") {
+      return;
+    }
+    writeLine(options.stdout, "Waiting for ghc-tunnel to launch...");
+    const tunnelPromise = enableGithubCopilotTunnel({
+      captureOutputAfterReady: false,
+      portChecker: options.startupOptions.copilotTunnelPortChecker,
+      portCheckTimeoutMs: options.startupOptions.copilotTunnelPortCheckTimeoutMs,
+      pollIntervalMs: options.startupOptions.copilotTunnelPollIntervalMs,
+      spawnTunnel: options.startupOptions.copilotTunnelSpawn,
+      startupTimeoutMs: options.startupOptions.copilotTunnelStartupTimeoutMs,
+      onProgress: (update) => surfaceDeviceLogin(update, true)
+    });
+    const firstResult = await Promise.race([
+      tunnelPromise.then((tunnel) => ({ kind: "result", tunnel })),
+      startupWait.then(() => ({ kind: "progress" }))
+    ]);
+    if (firstResult.kind === "result") {
+      if (!reportTunnelReady(firstResult.tunnel)) reportTunnelFailure(firstResult.tunnel);
+      return;
+    }
+    void tunnelPromise.then((tunnel) => {
+      if (!reportTunnelReady(tunnel)) reportTunnelFailure(tunnel);
+    }).catch((err) => {
+      writeLine(options.stderr, `GitHub Copilot Tunnel failed to start: ${err instanceof Error ? err.message : String(err)}`);
+    });
+  } catch (err) {
+    writeLine(options.stderr, `GitHub Copilot Tunnel failed to start: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
 function shouldSkipStartupRequirementsCheck(storagePath, now = /* @__PURE__ */ new Date()) {
   const metadata = resolveStartupRequirementsMetadata(storagePath);
   if (metadata.lastCheckedOn !== formatLocalDate2(now)) {
@@ -179694,12 +180694,6 @@ async function ensureStartupRequirements(storagePath, options = {}) {
   const commandRunner = options.commandRunner ?? createDefaultCommandRunner(platform6);
   const authPollIntervalMs = options.authPollIntervalMs ?? 1e3;
   const authPollTimeoutMs = options.authPollTimeoutMs ?? 12e4;
-  if (shouldSkipStartupRequirementsCheck(storagePath, now) && areCachedAuthRequirementsCurrent(commandRunner)) {
-    return {
-      skipped: true,
-      metadata: resolveStartupRequirementsMetadata(storagePath)
-    };
-  }
   const promptSessionFactory = options.promptSessionFactory ?? createPromptSession;
   let promptSession;
   const getAsk = () => {
@@ -179712,6 +180706,26 @@ async function ensureStartupRequirements(storagePath, options = {}) {
     promptSession = void 0;
     await current.close();
   };
+  if (shouldSkipStartupRequirementsCheck(storagePath, now) && areCachedAuthRequirementsCurrent(commandRunner)) {
+    const metadata2 = resolveStartupRequirementsMetadata(storagePath);
+    await ensureOptionalCopilotTunnel({
+      storagePath,
+      metadata: metadata2,
+      now,
+      getAsk,
+      releasePrompt,
+      commandRunner,
+      stdout,
+      stderr,
+      startupOptions: options,
+      authPollIntervalMs,
+      authPollTimeoutMs
+    });
+    return {
+      skipped: true,
+      metadata: metadata2
+    };
+  }
   const checkedAt = now.toISOString();
   const checkedOn = formatLocalDate2(now);
   const components = {};
@@ -179734,7 +180748,7 @@ async function ensureStartupRequirements(storagePath, options = {}) {
         };
         continue;
       }
-      if (requirement === "az" || requirement === "devtunnel") {
+      if (requirement === "az" || requirement === "devtunnel" || requirement === "copilot") {
         const authResult = await ensureRequirementAuthenticated(
           requirement,
           getAsk,
@@ -179770,6 +180784,19 @@ async function ensureStartupRequirements(storagePath, options = {}) {
   };
   metadataFile.startupRequirements = metadata;
   writeStartupMetadataFile(storagePath, metadataFile);
+  await ensureOptionalCopilotTunnel({
+    storagePath,
+    metadata,
+    now,
+    getAsk,
+    releasePrompt,
+    commandRunner,
+    stdout,
+    stderr,
+    startupOptions: options,
+    authPollIntervalMs,
+    authPollTimeoutMs
+  });
   return {
     skipped: false,
     metadata
@@ -180521,6 +181548,15 @@ init_cjs_shims();
 // ../../packages/client-sdk/src/types.ts
 init_cjs_shims();
 
+// ../../packages/client-sdk/src/mobile/index.ts
+init_cjs_shims();
+
+// ../../packages/client-sdk/src/mobile/protocol/index.ts
+init_cjs_shims();
+
+// ../../packages/client-sdk/src/mobile/protocol/qr.ts
+init_cjs_shims();
+
 // src/bootstrap/mobile-connection-qr.ts
 var require2 = (0, import_node_module.createRequire)(importMetaUrl);
 function printMobileConnectionQrs(writer, options) {
@@ -180579,6 +181615,71 @@ function isDevTunnelOrigin(value) {
   }
 }
 
+// src/bootstrap/mobile-pairing.ts
+init_cjs_shims();
+var import_node_module2 = require("module");
+function setupMobilePairing(options) {
+  const service = new MobilePairingInvitationService({
+    nodeId: options.nodeId,
+    nodeName: options.nodeName,
+    getApiBaseUrl: options.getEndpoint,
+    aad: options.aad,
+    audit: createLoggerAuditRecorder(options.logger)
+  });
+  const validator = new MobileAadTokenValidator(options.aadValidation);
+  options.logger.child("mobile-auth").info("mobile pairing invitations enabled", {
+    allowedTenants: options.aadValidation.allowedTenants
+  });
+  return {
+    service,
+    validator,
+    getEndpoint: options.getEndpoint,
+    nodeId: options.nodeId,
+    nodeName: options.nodeName
+  };
+}
+function renderQrCode2(payload) {
+  try {
+    const localRequire = (0, import_node_module2.createRequire)(importMetaUrl);
+    const qrcodeTerminal = localRequire("qrcode-terminal");
+    let rendered = null;
+    qrcodeTerminal.generate(payload, { small: true }, (output) => {
+      rendered = output;
+    });
+    return rendered;
+  } catch {
+    return null;
+  }
+}
+function isHttpsOrigin(value) {
+  if (!value) return false;
+  try {
+    return new URL(value).protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function printMobilePairingQr(writer, pairing) {
+  const endpoint = pairing.getEndpoint();
+  if (!isHttpsOrigin(endpoint)) {
+    writer.line("");
+    writer.line("Mobile Pairing: waiting for an https endpoint (DevTunnel). Pairing QR is unavailable on local http origins.");
+    return null;
+  }
+  const created = pairing.service.createInvitation({ createdBy: "node-startup" });
+  const serialized = serializePairingQrPayload(created.qr);
+  const qr = renderQrCode2(serialized);
+  writer.line("");
+  writer.line(`Mobile Pairing QR (scan in the Meshy app, expires ${created.invitation.expiresAt}, max uses ${created.invitation.maxUses}):`);
+  if (qr) {
+    writer.line(qr);
+  } else {
+    writer.line(serialized);
+  }
+  writer.line("The phone will sign in with AAD and then use the existing REST API with a bearer token.");
+  return created.qr;
+}
+
 // src/bootstrap/runtime-restart.ts
 init_cjs_shims();
 var fs32 = __toESM(require("fs"), 1);
@@ -180779,6 +181880,8 @@ function formatStartArgs(args) {
   if (args.config) result.push("--config", args.config);
   if (args.disableAuth) result.push("--disable-auth");
   if (args.qrCode) result.push("--qr-code");
+  if (args.ghcTunnel === true) result.push("--enable-ghc-tunnel");
+  if (args.ghcTunnel === false) result.push("--disable-ghc-tunnel");
   return result;
 }
 function detectRuntimeRestartMode(env4 = process.env, entryPath = process.argv[1]) {
@@ -182231,12 +183334,12 @@ var import_node_path5 = __toESM(require("path"), 1);
 
 // ../../node_modules/.pnpm/@azure+monitor-opentelemetry@1.18.1/node_modules/@azure/monitor-opentelemetry/dist/esm/shared/module.js
 init_cjs_shims();
-var import_node_module2 = require("module");
+var import_node_module3 = require("module");
 var import_node_path4 = require("path");
 var import_node_url2 = require("url");
 function loadAzureFunctionCore() {
   try {
-    return (0, import_node_module2.createRequire)(importMetaUrl)("@azure/functions-core");
+    return (0, import_node_module3.createRequire)(importMetaUrl)("@azure/functions-core");
   } catch (e) {
     return void 0;
   }
@@ -188972,7 +190075,7 @@ function resolveTelemetryConfig(options = {}) {
 
 // src/bootstrap/telemetry-events.ts
 init_cjs_shims();
-var crypto5 = __toESM(require("crypto"), 1);
+var crypto6 = __toESM(require("crypto"), 1);
 var nodePath3 = __toESM(require("path"), 1);
 var TERMINAL_STATUSES4 = /* @__PURE__ */ new Set(["completed", "failed", "cancelled", "archived"]);
 function taskEventName(status) {
@@ -189021,7 +190124,7 @@ function projectPathKind(value) {
 function projectPathHash(value) {
   const normalized = normalizeProjectKey(value);
   if (!normalized) return void 0;
-  return crypto5.createHash("sha256").update(normalized).digest("hex").slice(0, 16);
+  return crypto6.createHash("sha256").update(normalized).digest("hex").slice(0, 16);
 }
 function projectDimensions(task) {
   const project = task?.effectiveProjectPath ?? task?.project;
@@ -189624,6 +190727,42 @@ function createTunnelManager(options) {
 }
 
 // src/bootstrap/start-node.ts
+function splitEnvList(value) {
+  const items = value?.split(",").map((item) => item.trim()).filter(Boolean);
+  return items && items.length > 0 ? items : void 0;
+}
+var DEFAULT_MOBILE_AAD_CLIENT_ID = "195fbb50-69da-45d8-b811-10d18264270b";
+var DEFAULT_MOBILE_AAD_TENANT_ID = "72f988bf-86f1-41af-91ab-2d7cd011db47";
+function isTruthyEnv(value) {
+  return ["1", "true", "yes", "on"].includes((value ?? "").trim().toLowerCase());
+}
+function resolveMobileAadConfig(env4) {
+  if (isTruthyEnv(env4.MESHY_MOBILE_PAIRING_DISABLED)) {
+    return null;
+  }
+  const tenantId = env4.MESHY_MOBILE_AAD_TENANT_ID?.trim() || DEFAULT_MOBILE_AAD_TENANT_ID;
+  const clientId = env4.MESHY_MOBILE_AAD_CLIENT_ID?.trim() || DEFAULT_MOBILE_AAD_CLIENT_ID;
+  const scopes = splitEnvList(env4.MESHY_MOBILE_AAD_SCOPES) ?? [`api://${clientId}/.default`];
+  const audiences = splitEnvList(env4.MESHY_MOBILE_AAD_AUDIENCES) ?? [`api://${clientId}`, clientId];
+  const allowedTenants = splitEnvList(env4.MESHY_MOBILE_AAD_ALLOWED_TENANTS) ?? [tenantId];
+  const allowedUpns = splitEnvList(env4.MESHY_MOBILE_AAD_ALLOWED_UPNS);
+  const allowedUpnDomains = splitEnvList(env4.MESHY_MOBILE_AAD_ALLOWED_UPN_DOMAINS);
+  return {
+    aad: { tenantId, clientId, scopes },
+    validation: {
+      allowedTenants,
+      audiences,
+      ...allowedUpns ? { allowedUpns } : {},
+      ...allowedUpnDomains ? { allowedUpnDomains } : {}
+    }
+  };
+}
+function resolveMobileAadConfigForStartup(args, env4) {
+  if (args.qrCode !== true) {
+    return null;
+  }
+  return resolveMobileAadConfig(env4);
+}
 function buildTelemetryBaseDimensions(options) {
   return {
     appVersion: options.runtimeMetadata.packageVersion,
@@ -189668,7 +190807,7 @@ function createNodeTelemetry(config2, logger33, baseDimensions) {
       createAzureTelemetryService({ connectionString: config2.connectionString, baseDimensions }),
       { logger: telemetryLogger }
     );
-    telemetryLogger.info("Telemetry initialized [succeeded]");
+    telemetryLogger.info("Telemetry initialized [succeeded]. Meshy collects sanitized operational telemetry such as runtime details, feature usage, task lifecycle events, and API route metrics. Prompts, transcripts, request bodies, bearer tokens, raw paths, and raw stack traces are not collected.");
     return telemetry;
   } catch {
     telemetryLogger.warn("Telemetry initialized [failed]");
@@ -189748,6 +190887,7 @@ function registerShutdownHandlers(options) {
     try {
       const telemetry = options.getTelemetry();
       telemetry.trackEvent("runtime.shutdown", { reason, runtimeMode });
+      options.onShutdown?.();
       options.tunnelManager.stopHealthChecks();
       await closeHttpServer(options.server);
       await options.tunnelManager.stop();
@@ -189795,7 +190935,9 @@ async function startNode(args) {
     });
     telemetry.trackEvent("startup.started");
     terminalWriter.line("Checking startup requirements (az, devtunnel, claude, codex, copilot)...");
-    const startupRequirements = await ensureNpxStartupTools(config2.storage.path);
+    const startupRequirements = await ensureNpxStartupTools(config2.storage.path, {
+      copilotTunnelEnabled: hydratedArgs.args.ghcTunnel
+    });
     telemetry.trackEvent("startup.preflight.completed", startupRequirementDimensions(startupRequirements));
     terminalWriter.line(
       startupRequirements.skipped ? "Startup requirements already verified today; skipping checks." : "Startup requirements check complete."
@@ -189852,6 +190994,18 @@ async function startNode(args) {
     const previewProxyManager = new PreviewProxyManager();
     let deps;
     let requestShutdownForRestart;
+    const mobileAad = resolveMobileAadConfigForStartup(hydratedArgs.args, process.env);
+    const mobilePairing = mobileAad ? setupMobilePairing({
+      nodeId: self2.id,
+      nodeName: self2.name,
+      logger: logger33,
+      getEndpoint: () => meshyNode.getNodeRegistry().getSelf().endpoint,
+      aad: mobileAad.aad,
+      aadValidation: mobileAad.validation
+    }) : null;
+    if (hydratedArgs.args.qrCode === true && !mobileAad) {
+      logger33.child("mobile-auth").info("mobile pairing disabled via MESHY_MOBILE_PAIRING_DISABLED");
+    }
     const tunnelManager = createTunnelManager({
       authMetadata,
       config: config2,
@@ -189975,7 +191129,9 @@ async function startNode(args) {
       runtimeMetadata,
       previewSessionManager,
       previewProxyManager,
-      quickChatStore: createQuickChatStore(config2.storage.path)
+      quickChatStore: createQuickChatStore(config2.storage.path),
+      mobilePairingInvitations: mobilePairing?.service,
+      mobileAadValidator: mobilePairing?.validator
     };
     meshyNode.getLogger().info("configured node auth mode", {
       authEnabled: authMetadata.enabled,
@@ -189999,6 +191155,9 @@ async function startNode(args) {
       terminalWriter.line(`
 ${banner}`);
       printMobileConnectionQrs(terminalWriter, { enabled: hydratedArgs.args.qrCode === true, nodeName: self3.name, nodeEndpoint: self3.endpoint });
+      if (mobilePairing) {
+        printMobilePairingQr(terminalWriter, mobilePairing);
+      }
       telemetry.trackEvent("startup.completed");
       terminalWriter.line("");
     });
@@ -190006,7 +191165,10 @@ ${banner}`);
       server,
       meshyNode,
       tunnelManager,
-      getTelemetry: () => telemetry
+      getTelemetry: () => telemetry,
+      onShutdown: () => {
+        mobilePairing?.service.dispose();
+      }
     });
     requestShutdownForRestart = shutdownHandle.requestShutdown;
     await tunnelManager.syncDashboardTransport("startup");