toyon 0.11.0 → 0.12.0

package/dist/cli.js

@@ -2,10 +2,74 @@
 // @bun
 
 // src/cli.ts
-import { existsSync as existsSync10, statSync as statSync4 } from "fs";
+import { existsSync as existsSync11, statSync as statSync4 } from "fs";
 import { join as join7, resolve } from "path";
+// package.json
+var package_default = {
+  name: "toyon",
+  version: "0.12.0",
+  description: "Toyon is where coding agents work on your web app while you check each change by using it. Every chat gets its own running copy with a live preview.",
+  license: "MIT",
+  type: "module",
+  homepage: "https://toyon.dev",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/toyon-dev/toyon.git"
+  },
+  bugs: "https://github.com/toyon-dev/toyon/issues",
+  keywords: [
+    "ai",
+    "agents",
+    "claude-code",
+    "codex",
+    "opencode",
+    "git",
+    "worktree",
+    "preview",
+    "dev-server"
+  ],
+  bin: {
+    toyon: "bin/toyon.js"
+  },
+  files: [
+    "bin",
+    "dist",
+    "cloud"
+  ],
+  engines: {
+    node: ">=18"
+  },
+  os: [
+    "darwin",
+    "linux"
+  ],
+  scripts: {
+    prepublishOnly: "bun ../../scripts/pack.ts"
+  },
+  dependencies: {
+    bun: "1.4.2",
+    "bun-pty": "0.4.10"
+  },
+  devDependencies: {
+    "@toyon/shared": "workspace:*"
+  }
+};
+
+// src/app.ts
+import { spawn as spawn3, spawnSync } from "child_process";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
+
+// src/daemon.ts
+import { spawn } from "child_process";
+import { existsSync as existsSync2, mkdirSync, openSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { join as join2 } from "path";
 
-// ../shared/src/pair.ts
+// ../shared/src/knock.ts
+var KNOCK_TTL_MS = 5 * 60000;
+var machineLink = (host) => `https://${host}/`;
 var isTailnetName = (host) => host.endsWith(".ts.net");
 var listed = (names) => names.length < 2 ? names[0] ?? "" : `${names.slice(0, -1).join(", ")} and ${names.at(-1)}`;
 function tailnetLine(phones) {
@@ -28,14 +92,34 @@ function tailnetLine(phones) {
 }
 
 // ../shared/src/daemon.ts
+var APP_SCHEME = "toyon";
+var START_LINK = `${APP_SCHEME}://start`;
+var LSREGISTER = "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";
 var DAEMON_FILES = {
   token: "token",
+  helper: "Toyon.app",
+  launcherLog: "launcher.log",
   pid: "daemon.pid",
   state: "state.json",
   drafts: "drafts.json",
   log: "daemon.log",
   remote: "remote.json"
 };
+function previewsLine(r) {
+  return addressedByPort(r.previews) ? `previews on ports ${PREVIEW_PORTS.from}-${PREVIEW_PORTS.to}` : `previews at ${r.previews}`;
+}
+function acceptRemote(view, policy) {
+  if (policy.remote === "off")
+    return "remote access is turned off by your organization's policy";
+  const host = view.host.toLowerCase();
+  if (!isRemoteHost(host))
+    return `${view.host} is not a name a front can answer for`;
+  if (policy.remote === "tailscale" && !isTailnetName(host)) {
+    return "your organization's policy allows remote access over Tailscale only";
+  }
+  const why = checkPreviews(view.previews, host);
+  return why ?? { host, previews: view.previews };
+}
 var PREVIEW_PORTS = { from: 10001, to: 10008 };
 var DNS_NAME = /^(?=.{1,253}$)[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/;
 function isRemoteHost(name) {
@@ -83,10 +167,6 @@ function parseRemote(text) {
 }
 var WS_CLOSE_UNAUTHORIZED = 4401;
 
-// ../shared/src/launcher.ts
-var LAUNCHER_ORIGIN = "https://toyon.cloud";
-var launcherAddLink = (machineOrigin) => `${LAUNCHER_ORIGIN}/#add=${encodeURIComponent(machineOrigin)}`;
-
 // ../../node_modules/.bun/zod@4.5.4/node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
   const numericValues = Object.values(entries).filter((v) => typeof v === "number");
@@ -5187,68 +5267,6 @@ function parseVersion(v) {
     return null;
   return { nums: [Number(m[1]), Number(m[2]), Number(m[3])], pre: m[4] ?? null };
 }
-// package.json
-var package_default = {
-  name: "toyon",
-  version: "0.11.0",
-  description: "Toyon is where coding agents work on your web app while you check each change by using it. Every chat gets its own running copy with a live preview.",
-  license: "MIT",
-  type: "module",
-  homepage: "https://toyon.dev",
-  repository: {
-    type: "git",
-    url: "git+https://github.com/toyon-dev/toyon.git"
-  },
-  bugs: "https://github.com/toyon-dev/toyon/issues",
-  keywords: [
-    "ai",
-    "agents",
-    "claude-code",
-    "codex",
-    "opencode",
-    "git",
-    "worktree",
-    "preview",
-    "dev-server"
-  ],
-  bin: {
-    toyon: "bin/toyon.js"
-  },
-  files: [
-    "bin",
-    "dist",
-    "cloud"
-  ],
-  engines: {
-    node: ">=18"
-  },
-  os: [
-    "darwin",
-    "linux"
-  ],
-  scripts: {
-    prepublishOnly: "bun ../../scripts/pack.ts"
-  },
-  dependencies: {
-    bun: "1.4.2",
-    "bun-pty": "0.4.10"
-  },
-  devDependencies: {
-    "@toyon/shared": "workspace:*"
-  }
-};
-
-// src/app.ts
-import { spawn as spawn2, spawnSync } from "child_process";
-import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
-
-// src/daemon.ts
-import { spawn } from "child_process";
-import { existsSync as existsSync2, mkdirSync, openSync, readFileSync } from "fs";
-import { homedir } from "os";
-import { join as join2 } from "path";
 
 // src/layout.ts
 import { existsSync, realpathSync } from "fs";
@@ -5272,7 +5290,6 @@ function installOnPath() {
 }
 var restartCmd = restartCommand(method, package_default.version, method === "npx" ? installOnPath() : "none", process.env.npm_config_registry ?? null);
 var daemonEntry = packaged ? join(here, "daemon.js") : join(here, "../../daemon/src/index.ts");
-var iconSvg = packaged ? join(here, "shell", "icon.svg") : join(here, "../../shell/public/icon.svg");
 
 // src/daemon.ts
 var port = Number(process.env.TOYON_PORT ?? DAEMON_DEFAULT_PORT);
@@ -5292,6 +5309,23 @@ async function health() {
     return null;
   }
 }
+async function daemonFetch(path, init = {}) {
+  const token = readToken();
+  if (!token)
+    return null;
+  try {
+    return await fetch(`${base}${path}`, {
+      method: init.method ?? (init.body === undefined ? "GET" : "POST"),
+      headers: {
+        authorization: `Bearer ${token}`,
+        ...init.body === undefined ? {} : { "content-type": "application/json" }
+      },
+      body: init.body === undefined ? undefined : JSON.stringify(init.body)
+    });
+  } catch {
+    return null;
+  }
+}
 function readToken() {
   if (!existsSync2(tokenFile))
     return null;
@@ -5329,63 +5363,46 @@ async function startDaemon() {
   }
   return await health() !== null;
 }
+function behind(daemonVersion) {
+  return daemonVersion === undefined || newer(package_default.version, daemonVersion);
+}
+async function ensureDaemon() {
+  let running = await health();
+  if (!running) {
+    console.log("starting Toyon daemon\u2026");
+    running = await startDaemon() ? await health() : null;
+    if (!running) {
+      console.error(`daemon failed to start; \`toyon logs\` shows why (${logFile})`);
+      return null;
+    }
+  } else if (behind(running.version)) {
+    console.log(`toyon: the running daemon is ${running.version ?? "older"}; \`${restartCmd}\` starts ${package_default.version}`);
+  }
+  const token = readToken();
+  if (!token) {
+    console.error("daemon token missing; `toyon doctor` says where it looked");
+    return null;
+  }
+  return { token, url: shellUrl(token, running.branded === true), remote: running.remote ?? null };
+}
+function post(route, token, body) {
+  return fetch(`${base}${route}`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+}
 function shellUrl(token, branded) {
   return branded ? `http://toyon.localhost/#token=${token}` : `http://toyon.localhost:${port}/#token=${token}`;
 }
 
-// src/launcher.m
-var launcher_default = `// The Toyon.app bundle's executable. A plain C stub that execs the launch script never hears
-// about a file dropped on the Dock icon: that arrives as an Apple Event, which only an
-// NSApplication receives. So this is the smallest Cocoa app there is: it collects the paths the
-// event names, answers the event (Finder waits on the answer, and an exec before it would leave
-// Finder hanging), and once launched execs the script with those paths. The open-files call comes
-// before the finish-launching one, which is why the paths are collected first and the exec waits
-// for the second. With nothing dropped the script runs with no arguments.
-//
-// Read into the CLI as text (app.ts) and compiled at \`toyon --install-app\` on the machine itself.
-#import <Cocoa/Cocoa.h>
-#include <libgen.h>
-#include <mach-o/dyld.h>
-#include <stdlib.h>
-#include <unistd.h>
-
-@interface Launcher : NSObject <NSApplicationDelegate>
-@property(strong) NSMutableArray<NSString *> *paths;
-@end
-
-@implementation Launcher
-- (void)application:(NSApplication *)app openFiles:(NSArray<NSString *> *)files {
-  [self.paths addObjectsFromArray:files];
-  [app replyToOpenOrPrint:NSApplicationDelegateReplySuccess];
-}
-- (BOOL)applicationSupportsSecureRestorableState:(NSApplication *)app {
-  return YES;
-}
-- (void)applicationDidFinishLaunching:(NSNotification *)note {
-  char self_[4096];
-  uint32_t n = sizeof(self_);
-  if (_NSGetExecutablePath(self_, &n) != 0) exit(1);
-  NSString *script = [NSString stringWithFormat:@"%s/../Resources/launch.sh", dirname(self_)];
-  NSMutableArray<NSString *> *argv = [NSMutableArray arrayWithObjects:@"bash", script, nil];
-  [argv addObjectsFromArray:self.paths];
-  const char **cargv = calloc(argv.count + 1, sizeof(char *));
-  for (NSUInteger i = 0; i < argv.count; i++) cargv[i] = [argv[i] fileSystemRepresentation];
-  execv("/bin/bash", (char *const *)cargv);
-  exit(1);
-}
-@end
-
-int main(void) {
-  @autoreleasepool {
-    NSApplication *app = [NSApplication sharedApplication];
-    Launcher *launcher = [Launcher new];
-    launcher.paths = [NSMutableArray new];
-    app.delegate = launcher;
-    [app run];
-  }
-  return 0;
+// src/openUrl.ts
+import { spawn as spawn2 } from "child_process";
+function openUrl(url) {
+  const child = spawn2(process.platform === "darwin" ? "open" : "xdg-open", [url], { stdio: "ignore" });
+  child.on("error", () => {});
+  child.unref();
 }
-`;
 
 // src/app.ts
 var CHROMIUMS = ["Google Chrome", "Arc", "Brave Browser", "Microsoft Edge", "Chromium"];
@@ -5431,13 +5448,21 @@ function findPwaId(browser, manifestId) {
   }
   return null;
 }
+function showAppWindow(daemon) {
+  const appUrl = shellUrl(daemon.token, false);
+  console.log(`toyon: app window (${appUrl.split("#")[0]})`);
+  if (openAppWindow(appUrl))
+    return;
+  console.log("no Chromium browser found; opening in default browser");
+  openUrl(daemon.url);
+}
 function openAppWindow(appUrl) {
   const manifestId = new URL("/", appUrl).href;
   for (const app of CHROMIUMS) {
     if (spawnSync("open", ["-Ra", app]).status === 0) {
       const id = findPwaId(app, manifestId);
       const flag = id ? `--app-id=${id}` : `--app=${appUrl}`;
-      spawn2("open", ["-na", app, "--args", flag], { stdio: "ignore" }).unref();
+      spawn3("open", ["-na", app, "--args", flag], { stdio: "ignore" }).unref();
       if (!id) {
         console.log(`tip: install Toyon as an app (browser menu, then Install, or the install button in the top bar when opened in a tab)`);
         console.log(`     once installed, it gets a native-style title bar; \`toyon --app\` then launches the installed app`);
@@ -5447,145 +5472,11 @@ function openAppWindow(appUrl) {
   }
   return false;
 }
-function installApp(appUrl) {
-  const manifestId = new URL("/", appUrl).href;
-  const appDir = join3(homedir2(), "Applications", "Toyon.app");
-  const macos = join3(appDir, "Contents", "MacOS");
-  const resources = join3(appDir, "Contents", "Resources");
-  rmSync(appDir, { recursive: true, force: true });
-  mkdirSync2(macos, { recursive: true });
-  mkdirSync2(resources, { recursive: true });
-  writeFileSync(join3(appDir, "Contents", "Info.plist"), `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0"><dict>
-  <key>CFBundleName</key><string>Toyon</string>
-  <key>CFBundleDisplayName</key><string>Toyon</string>
-  <key>CFBundleIdentifier</key><string>dev.toyon.app</string>
-  <key>CFBundleVersion</key><string>0.0.1</string>
-  <key>CFBundlePackageType</key><string>APPL</string>
-  <key>CFBundleExecutable</key><string>Toyon</string>
-  <key>CFBundleIconFile</key><string>AppIcon</string>
-  <!-- takes any file or folder dropped on it, without becoming the default opener for anything -->
-  <key>CFBundleDocumentTypes</key>
-  <array>
-    <dict>
-      <key>CFBundleTypeName</key><string>Anything</string>
-      <key>CFBundleTypeRole</key><string>Editor</string>
-      <key>LSHandlerRank</key><string>Alternate</string>
-      <key>LSItemContentTypes</key>
-      <array>
-        <string>public.item</string>
-        <string>public.folder</string>
-      </array>
-    </dict>
-  </array>
-</dict></plist>
-`);
-  const launcher = join3(resources, "launch.sh");
-  writeFileSync(launcher, `#!/bin/bash
-# Finder launches get a minimal PATH; find bun ourselves
-BUN=""
-for CAND in "$HOME/.bun/bin/bun" /opt/homebrew/bin/bun /usr/local/bin/bun; do
-  [ -x "$CAND" ] && BUN="$CAND" && break
-done
-
-# start the daemon if it isn't running
-if ! curl -s --max-time 1 http://127.0.0.1:${port}/health >/dev/null 2>&1; then
-  if [ -n "$BUN" ] && [ -f "${daemonEntry}" ]; then
-    nohup "$BUN" run "${daemonEntry}" >> "$HOME/.toyon/daemon.log" 2>&1 &
-    for _ in $(seq 1 40); do
-      curl -s --max-time 1 http://127.0.0.1:${port}/health >/dev/null 2>&1 && break
-      sleep 0.25
-    done
-  fi
-fi
-
-TOKEN=$(cat "$HOME/.toyon/token" 2>/dev/null)
-
-# what was dropped on the icon, or opened with it: each path goes to the daemon, which opens a
-# project, a file in one, or a file on its own, and holds it for the window opened below. A
-# refusal is logged in the daemon's words, since nothing here has a screen (the daemon says it in
-# the shell too); a success is logged as its status alone, since the reply carries the file's text.
-for P in "$@"; do
-  BODY=$("$BUN" -e 'console.log(JSON.stringify({ path: process.argv[1] }))' "$P" 2>/dev/null) || continue
-  REPLY=$(curl -s -o /dev/null -w '%{http_code}' -X POST -H "Authorization: Bearer $TOKEN" \\
-    -H "content-type: application/json" --data "$BODY" http://127.0.0.1:${port}/open 2>/dev/null)
-  if [ "$REPLY" != "200" ]; then
-    REPLY="$REPLY $(curl -s -X POST -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" \\
-      --data "$BODY" http://127.0.0.1:${port}/open 2>&1 | head -c 300)"
-  fi
-  echo "$(date '+%Y-%m-%d %H:%M:%S') open $P: $REPLY" >> "$HOME/.toyon/launcher.log"
-done
-
-URL="http://toyon.localhost:${port}/#token=$TOKEN"
-MANIFEST_ID="${manifestId}"
-CACHE_DIR="$HOME/.toyon/pwa"
-# installed PWA (native-style title bar) if any profile has it, else a plain app window.
-# The app id lives in the browser's sync DB right before the manifest id; cache it once found.
-find_pwa_id() { # $1 = data dir, $2 = cache file
-  local root="$HOME/Library/Application Support/$1" id p f
-  if [ -f "$2" ]; then
-    id=$(tr -d '[:space:]' < "$2")
-    for p in "$root"/*/; do [ -d "$p/Web Applications/Manifest Resources/$id" ] && { echo "$id"; return; }; done
-  fi
-  for p in "$root"/*/; do
-    for f in "$p/Sync Data/LevelDB/"*.log "$p/Sync Data/LevelDB/"*.ldb; do
-      [ -f "$f" ] || continue
-      # the record straddles newline bytes, so flatten before the line-based grep
-      id=$(LC_ALL=C tr '\\n\\0' '  ' < "$f" | LC_ALL=C grep -aoE "web_apps-dt-[a-p]{32}.{0,16}$MANIFEST_ID" 2>/dev/null | head -1 | LC_ALL=C sed -E 's/^web_apps-dt-([a-p]{32}).*/\\1/')
-      if [ -n "$id" ] && [ -d "$p/Web Applications/Manifest Resources/$id" ]; then
-        mkdir -p "$CACHE_DIR" && printf '%s' "$id" > "$2"; echo "$id"; return
-      fi
-    done
-  done
-}
-launch() { # $1 = browser name, $2 = data dir
-  local id; id=$(find_pwa_id "$2" "$CACHE_DIR/$(echo "$1" | tr -c 'A-Za-z0-9
-' '-').id")
-  if [ -n "$id" ]; then exec open -na "$1" --args --app-id="$id"; fi
-  exec open -na "$1" --args --app="$URL"
-}
-${CHROMIUMS.map((a) => `if open -Ra "${a}" 2>/dev/null; then launch "${a}" "${DATA_DIRS[a]}"; fi`).join(`
-`)}
-exec open "$URL"
-`);
-  chmodSync(launcher, 493);
-  const stub = join3(macos, "Toyon");
-  const src = join3(home, "launcher.m");
-  writeFileSync(src, launcher_default);
-  const cc = spawnSync("clang", ["-O2", "-fobjc-arc", "-framework", "Cocoa", "-o", stub, src], { stdio: "ignore" });
-  if (cc.status !== 0) {
-    writeFileSync(stub, `#!/bin/bash
-exec /bin/bash "$(dirname "$0")/../Resources/launch.sh"
-`);
-    chmodSync(stub, 493);
-  }
-  try {
-    const svg = iconSvg;
-    const tmp = join3(home, "iconset.tmp");
-    const iconset = join3(tmp, "AppIcon.iconset");
-    mkdirSync2(iconset, { recursive: true });
-    spawnSync("qlmanage", ["-t", "-s", "1024", "-o", tmp, svg], { stdio: "ignore" });
-    const big = join3(tmp, "icon.svg.png");
-    if (existsSync3(big)) {
-      for (const size of [16, 32, 64, 128, 256, 512, 1024]) {
-        spawnSync("sips", ["-z", String(size), String(size), big, "--out", join3(iconset, `icon_${size}x${size}.png`)], {
-          stdio: "ignore"
-        });
-      }
-      spawnSync("iconutil", ["-c", "icns", iconset, "-o", join3(resources, "AppIcon.icns")], { stdio: "ignore" });
-    }
-  } catch {}
-  spawnSync("xattr", ["-cr", appDir], { stdio: "ignore" });
-  const signed = spawnSync("codesign", ["--force", "--deep", "-s", "-", appDir], { stdio: "ignore" }).status === 0;
-  if (!signed)
-    console.warn("warning: could not codesign the app bundle; macOS may refuse to open it");
-  console.log(`installed ${appDir}; launch "Toyon" from Spotlight or drag it to the Dock`);
-  spawn2("open", ["-a", appDir], { stdio: "ignore" }).unref();
-}
 
 // src/args.ts
 var VERBS = new Set([
+  "start",
+  "helper",
   "stop",
   "restart",
   "update",
@@ -5607,6 +5498,9 @@ function parseArgs(argv) {
   const [first, ...rest] = argv;
   if (first !== undefined && VERBS.has(first)) {
     switch (first) {
+      case "helper":
+        return { kind: "helper", args: rest };
+      case "start":
       case "stop":
       case "restart":
       case "update":
@@ -5658,12 +5552,9 @@ function parseArgs(argv) {
   }
   let path = null;
   let app = false;
-  let installApp = false;
   for (const a of argv) {
     if (a === "--app" || a === "--pwa")
       app = true;
-    else if (a === "--install-app")
-      installApp = true;
     else if (a.startsWith("-"))
       return { kind: "error", message: `unknown option ${a}` };
     else if (path !== null)
@@ -5671,7 +5562,7 @@ function parseArgs(argv) {
     else
       path = a;
   }
-  return { kind: "open", path, app, installApp };
+  return { kind: "open", path, app };
 }
 function parseLogs(rest) {
   let follow = false;
@@ -5739,6 +5630,7 @@ usage
   toyon [path]            start the daemon if it is not running, register the repo at path
                           (or open the file at path: in its project, or on its own)
                           (default: the current directory) and open the shell
+  toyon start             start the daemon if it is not running, and open nothing
   toyon stop              stop the daemon and every dev server and agent it runs
   toyon restart           stop the daemon and start it again from what is installed now; every
                           shell reconnects on its own
@@ -5757,9 +5649,9 @@ usage
   toyon remote --tailscale
                           open the shell from your tailnet at this machine's Tailscale name:
                           sets up tailscale serve for Toyon and ports 10001-10008
-  toyon pair              print a QR code to scan with your phone's camera: it opens the shell
-                          at the remote name, signed in, and adds it to toyon.cloud; the code
-                          works once and lasts 2 minutes
+  toyon pair              show this machine's address as a QR code for your phone, and let in
+                          each device that opens it, from this terminal; Toyon's window asks
+                          the same question when one is open
   toyon deploy fly up <name> [--region code] [--repo url]
                           run Toyon on your own Fly account at https://name.fly.dev with your own
                           keys; --repo clones that repository onto it the first time
@@ -5770,7 +5662,6 @@ usage
 
 options for toyon [path]
   --app                   open a Chromium app window (the installed Toyon app when there is one)
-  --install-app           write ~/Applications/Toyon.app and open it
 
 environment
   TOYON_HOME              where state lives (default ~/.toyon)
@@ -5786,7 +5677,7 @@ policy
 // src/deploy/fly.ts
 import { randomBytes } from "crypto";
 import { Resolver } from "dns/promises";
-import { existsSync as existsSync5, mkdirSync as mkdirSync4, mkdtempSync, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, mkdtempSync, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync3 } from "fs";
 import { tmpdir } from "os";
 import { join as join5 } from "path";
 
@@ -5839,14 +5730,6 @@ function safeUser() {
   }
 }
 
-// src/openUrl.ts
-import { spawn as spawn3 } from "child_process";
-function openUrl(url) {
-  const child = spawn3(process.platform === "darwin" ? "open" : "xdg-open", [url], { stdio: "ignore" });
-  child.on("error", () => {});
-  child.unref();
-}
-
 // src/policy.ts
 function refusedByPolicy(verb, m) {
   console.error(`toyon: ${verb} is turned off by your organization's policy (${m.source ?? "policy"})`);
@@ -6075,7 +5958,7 @@ async function up(cmd, bin) {
       throw new DeployError("the deploy failed; flyctl's output above says why");
     }
   } finally {
-    rmSync2(ctx, { recursive: true, force: true });
+    rmSync(ctx, { recursive: true, force: true });
   }
   console.log("waiting for the machine to answer");
   let up = false;
@@ -6088,15 +5971,20 @@ async function up(cmd, bin) {
   }
   if (!up)
     console.log(`it has not answered yet; \`fly logs -a ${cmd.name}\` shows what it is doing`);
-  printLinks(cmd.name, token);
+  await printLinks(cmd.name, token);
   console.log("the volume holds the only copy of anything not pushed to a remote");
-  openUrl(launcherAddLink(`https://${cmd.name}.fly.dev`));
 }
-function printLinks(app, token) {
+async function printLinks(app, token) {
+  const origin = `https://${app}.fly.dev`;
+  const handed = (await daemonFetch("/machines", { body: { origin, token } }))?.ok === true;
+  if (handed) {
+    console.log(`
+toyon: ${app}.fly.dev is in your list; open Toyon here to use it, and pair your phone from there`);
+    return;
+  }
   console.log(`
-toyon: https://${app}.fly.dev/#token=${token}`);
+toyon: ${origin}/#token=${token}`);
   console.log("the link grants a shell on that machine; keep it to yourself");
-  console.log(`add it to your list at toyon.cloud: ${launcherAddLink(`https://${app}.fly.dev`)}`);
 }
 async function destroy(cmd, bin) {
   if (!cmd.yes) {
@@ -6114,7 +6002,7 @@ async function destroy(cmd, bin) {
     }
   }
   must(await capture(bin, ["apps", "destroy", cmd.name, "--yes"]), "could not delete the app");
-  rmSync2(tokenFile2(cmd.name), { force: true });
+  rmSync(tokenFile2(cmd.name), { force: true });
   console.log(`deleted ${cmd.name}`);
   return 0;
 }
@@ -6133,7 +6021,7 @@ async function deploy(cmd) {
     else if (cmd.action === "destroy")
       return await destroy(cmd, bin);
     else if (existsSync5(tokenFile2(cmd.name))) {
-      printLinks(cmd.name, readFileSync4(tokenFile2(cmd.name), "utf8").trim());
+      await printLinks(cmd.name, readFileSync4(tokenFile2(cmd.name), "utf8").trim());
     } else {
       throw new DeployError(`${cmd.name} was not deployed from this machine; its token is not in ${cloudDir}`);
     }
@@ -6318,6 +6206,41 @@ async function doctor() {
   return lines.every((l) => l.ok) ? 0 : 1;
 }
 
+// src/helper.ts
+import { fileURLToPath as fileURLToPath2 } from "url";
+function planHelper(args) {
+  if (args.some((a) => a.startsWith(`${APP_SCHEME}:`)))
+    return { kind: "start" };
+  const paths = [];
+  for (const a of args) {
+    if (a.startsWith("file:")) {
+      try {
+        const p = fileURLToPath2(a);
+        if (p !== "" && p !== "/")
+          paths.push(p);
+      } catch {}
+    } else if (a !== "")
+      paths.push(a);
+  }
+  return paths.length === 0 ? { kind: "start" } : { kind: "open", paths };
+}
+async function helper(args) {
+  const plan = planHelper(args);
+  console.log(`toyon helper: ${args.length > 0 ? args.join(" ") : "(nothing)"}`);
+  const daemon = await ensureDaemon();
+  if (!daemon)
+    return 1;
+  if (plan.kind === "start")
+    return 0;
+  for (const path of plan.paths) {
+    const res = await post("/open", daemon.token, { path });
+    if (!res.ok)
+      console.error(`could not open ${path}: ${await res.text()}`);
+  }
+  showAppWindow(daemon);
+  return 0;
+}
+
 // src/logs.ts
 import { existsSync as existsSync7, readFileSync as readFileSync6, statSync as statSync3 } from "fs";
 async function logs(opts) {
@@ -6353,1685 +6276,36 @@ async function logs(opts) {
   }
 }
 
-// ../../node_modules/.bun/qrcode-generator@2.0.4/node_modules/qrcode-generator/dist/qrcode.mjs
-var qrcode = function(typeNumber, errorCorrectionLevel) {
-  const PAD0 = 236;
-  const PAD1 = 17;
-  let _typeNumber = typeNumber;
-  const _errorCorrectionLevel = QRErrorCorrectionLevel[errorCorrectionLevel];
-  let _modules = null;
-  let _moduleCount = 0;
-  let _dataCache = null;
-  const _dataList = [];
-  const _this = {};
-  const makeImpl = function(test, maskPattern) {
-    _moduleCount = _typeNumber * 4 + 17;
-    _modules = function(moduleCount) {
-      const modules = new Array(moduleCount);
-      for (let row = 0;row < moduleCount; row += 1) {
-        modules[row] = new Array(moduleCount);
-        for (let col = 0;col < moduleCount; col += 1) {
-          modules[row][col] = null;
-        }
-      }
-      return modules;
-    }(_moduleCount);
-    setupPositionProbePattern(0, 0);
-    setupPositionProbePattern(_moduleCount - 7, 0);
-    setupPositionProbePattern(0, _moduleCount - 7);
-    setupPositionAdjustPattern();
-    setupTimingPattern();
-    setupTypeInfo(test, maskPattern);
-    if (_typeNumber >= 7) {
-      setupTypeNumber(test);
-    }
-    if (_dataCache == null) {
-      _dataCache = createData(_typeNumber, _errorCorrectionLevel, _dataList);
-    }
-    mapData(_dataCache, maskPattern);
-  };
-  const setupPositionProbePattern = function(row, col) {
-    for (let r = -1;r <= 7; r += 1) {
-      if (row + r <= -1 || _moduleCount <= row + r)
-        continue;
-      for (let c = -1;c <= 7; c += 1) {
-        if (col + c <= -1 || _moduleCount <= col + c)
-          continue;
-        if (0 <= r && r <= 6 && (c == 0 || c == 6) || 0 <= c && c <= 6 && (r == 0 || r == 6) || 2 <= r && r <= 4 && 2 <= c && c <= 4) {
-          _modules[row + r][col + c] = true;
-        } else {
-          _modules[row + r][col + c] = false;
-        }
-      }
-    }
-  };
-  const getBestMaskPattern = function() {
-    let minLostPoint = 0;
-    let pattern = 0;
-    for (let i = 0;i < 8; i += 1) {
-      makeImpl(true, i);
-      const lostPoint = QRUtil.getLostPoint(_this);
-      if (i == 0 || minLostPoint > lostPoint) {
-        minLostPoint = lostPoint;
-        pattern = i;
-      }
-    }
-    return pattern;
-  };
-  const setupTimingPattern = function() {
-    for (let r = 8;r < _moduleCount - 8; r += 1) {
-      if (_modules[r][6] != null) {
-        continue;
-      }
-      _modules[r][6] = r % 2 == 0;
-    }
-    for (let c = 8;c < _moduleCount - 8; c += 1) {
-      if (_modules[6][c] != null) {
-        continue;
-      }
-      _modules[6][c] = c % 2 == 0;
-    }
-  };
-  const setupPositionAdjustPattern = function() {
-    const pos = QRUtil.getPatternPosition(_typeNumber);
-    for (let i = 0;i < pos.length; i += 1) {
-      for (let j = 0;j < pos.length; j += 1) {
-        const row = pos[i];
-        const col = pos[j];
-        if (_modules[row][col] != null) {
-          continue;
-        }
-        for (let r = -2;r <= 2; r += 1) {
-          for (let c = -2;c <= 2; c += 1) {
-            if (r == -2 || r == 2 || c == -2 || c == 2 || r == 0 && c == 0) {
-              _modules[row + r][col + c] = true;
-            } else {
-              _modules[row + r][col + c] = false;
-            }
-          }
-        }
-      }
-    }
-  };
-  const setupTypeNumber = function(test) {
-    const bits = QRUtil.getBCHTypeNumber(_typeNumber);
-    for (let i = 0;i < 18; i += 1) {
-      const mod = !test && (bits >> i & 1) == 1;
-      _modules[Math.floor(i / 3)][i % 3 + _moduleCount - 8 - 3] = mod;
-    }
-    for (let i = 0;i < 18; i += 1) {
-      const mod = !test && (bits >> i & 1) == 1;
-      _modules[i % 3 + _moduleCount - 8 - 3][Math.floor(i / 3)] = mod;
-    }
-  };
-  const setupTypeInfo = function(test, maskPattern) {
-    const data = _errorCorrectionLevel << 3 | maskPattern;
-    const bits = QRUtil.getBCHTypeInfo(data);
-    for (let i = 0;i < 15; i += 1) {
-      const mod = !test && (bits >> i & 1) == 1;
-      if (i < 6) {
-        _modules[i][8] = mod;
-      } else if (i < 8) {
-        _modules[i + 1][8] = mod;
-      } else {
-        _modules[_moduleCount - 15 + i][8] = mod;
-      }
-    }
-    for (let i = 0;i < 15; i += 1) {
-      const mod = !test && (bits >> i & 1) == 1;
-      if (i < 8) {
-        _modules[8][_moduleCount - i - 1] = mod;
-      } else if (i < 9) {
-        _modules[8][15 - i - 1 + 1] = mod;
-      } else {
-        _modules[8][15 - i - 1] = mod;
-      }
-    }
-    _modules[_moduleCount - 8][8] = !test;
-  };
-  const mapData = function(data, maskPattern) {
-    let inc = -1;
-    let row = _moduleCount - 1;
-    let bitIndex = 7;
-    let byteIndex = 0;
-    const maskFunc = QRUtil.getMaskFunction(maskPattern);
-    for (let col = _moduleCount - 1;col > 0; col -= 2) {
-      if (col == 6)
-        col -= 1;
-      while (true) {
-        for (let c = 0;c < 2; c += 1) {
-          if (_modules[row][col - c] == null) {
-            let dark = false;
-            if (byteIndex < data.length) {
-              dark = (data[byteIndex] >>> bitIndex & 1) == 1;
-            }
-            const mask = maskFunc(row, col - c);
-            if (mask) {
-              dark = !dark;
-            }
-            _modules[row][col - c] = dark;
-            bitIndex -= 1;
-            if (bitIndex == -1) {
-              byteIndex += 1;
-              bitIndex = 7;
-            }
-          }
-        }
-        row += inc;
-        if (row < 0 || _moduleCount <= row) {
-          row -= inc;
-          inc = -inc;
-          break;
-        }
-      }
-    }
-  };
-  const createBytes = function(buffer, rsBlocks) {
-    let offset = 0;
-    let maxDcCount = 0;
-    let maxEcCount = 0;
-    const dcdata = new Array(rsBlocks.length);
-    const ecdata = new Array(rsBlocks.length);
-    for (let r = 0;r < rsBlocks.length; r += 1) {
-      const dcCount = rsBlocks[r].dataCount;
-      const ecCount = rsBlocks[r].totalCount - dcCount;
-      maxDcCount = Math.max(maxDcCount, dcCount);
-      maxEcCount = Math.max(maxEcCount, ecCount);
-      dcdata[r] = new Array(dcCount);
-      for (let i = 0;i < dcdata[r].length; i += 1) {
-        dcdata[r][i] = 255 & buffer.getBuffer()[i + offset];
-      }
-      offset += dcCount;
-      const rsPoly = QRUtil.getErrorCorrectPolynomial(ecCount);
-      const rawPoly = qrPolynomial(dcdata[r], rsPoly.getLength() - 1);
-      const modPoly = rawPoly.mod(rsPoly);
-      ecdata[r] = new Array(rsPoly.getLength() - 1);
-      for (let i = 0;i < ecdata[r].length; i += 1) {
-        const modIndex = i + modPoly.getLength() - ecdata[r].length;
-        ecdata[r][i] = modIndex >= 0 ? modPoly.getAt(modIndex) : 0;
-      }
-    }
-    let totalCodeCount = 0;
-    for (let i = 0;i < rsBlocks.length; i += 1) {
-      totalCodeCount += rsBlocks[i].totalCount;
-    }
-    const data = new Array(totalCodeCount);
-    let index = 0;
-    for (let i = 0;i < maxDcCount; i += 1) {
-      for (let r = 0;r < rsBlocks.length; r += 1) {
-        if (i < dcdata[r].length) {
-          data[index] = dcdata[r][i];
-          index += 1;
-        }
-      }
-    }
-    for (let i = 0;i < maxEcCount; i += 1) {
-      for (let r = 0;r < rsBlocks.length; r += 1) {
-        if (i < ecdata[r].length) {
-          data[index] = ecdata[r][i];
-          index += 1;
-        }
-      }
-    }
-    return data;
-  };
-  const createData = function(typeNumber, errorCorrectionLevel, dataList) {
-    const rsBlocks = QRRSBlock.getRSBlocks(typeNumber, errorCorrectionLevel);
-    const buffer = qrBitBuffer();
-    for (let i = 0;i < dataList.length; i += 1) {
-      const data = dataList[i];
-      buffer.put(data.getMode(), 4);
-      buffer.put(data.getLength(), QRUtil.getLengthInBits(data.getMode(), typeNumber));
-      data.write(buffer);
-    }
-    let totalDataCount = 0;
-    for (let i = 0;i < rsBlocks.length; i += 1) {
-      totalDataCount += rsBlocks[i].dataCount;
-    }
-    if (buffer.getLengthInBits() > totalDataCount * 8) {
-      throw "code length overflow. (" + buffer.getLengthInBits() + ">" + totalDataCount * 8 + ")";
-    }
-    if (buffer.getLengthInBits() + 4 <= totalDataCount * 8) {
-      buffer.put(0, 4);
-    }
-    while (buffer.getLengthInBits() % 8 != 0) {
-      buffer.putBit(false);
-    }
-    while (true) {
-      if (buffer.getLengthInBits() >= totalDataCount * 8) {
-        break;
-      }
-      buffer.put(PAD0, 8);
-      if (buffer.getLengthInBits() >= totalDataCount * 8) {
-        break;
-      }
-      buffer.put(PAD1, 8);
-    }
-    return createBytes(buffer, rsBlocks);
-  };
-  _this.addData = function(data, mode) {
-    mode = mode || "Byte";
-    let newData = null;
-    switch (mode) {
-      case "Numeric":
-        newData = qrNumber(data);
-        break;
-      case "Alphanumeric":
-        newData = qrAlphaNum(data);
-        break;
-      case "Byte":
-        newData = qr8BitByte(data);
-        break;
-      case "Kanji":
-        newData = qrKanji(data);
-        break;
-      default:
-        throw "mode:" + mode;
-    }
-    _dataList.push(newData);
-    _dataCache = null;
-  };
-  _this.isDark = function(row, col) {
-    if (row < 0 || _moduleCount <= row || col < 0 || _moduleCount <= col) {
-      throw row + "," + col;
-    }
-    return _modules[row][col];
-  };
-  _this.getModuleCount = function() {
-    return _moduleCount;
-  };
-  _this.make = function() {
-    if (_typeNumber < 1) {
-      let typeNumber = 1;
-      for (;typeNumber < 40; typeNumber++) {
-        const rsBlocks = QRRSBlock.getRSBlocks(typeNumber, _errorCorrectionLevel);
-        const buffer = qrBitBuffer();
-        for (let i = 0;i < _dataList.length; i++) {
-          const data = _dataList[i];
-          buffer.put(data.getMode(), 4);
-          buffer.put(data.getLength(), QRUtil.getLengthInBits(data.getMode(), typeNumber));
-          data.write(buffer);
-        }
-        let totalDataCount = 0;
-        for (let i = 0;i < rsBlocks.length; i++) {
-          totalDataCount += rsBlocks[i].dataCount;
-        }
-        if (buffer.getLengthInBits() <= totalDataCount * 8) {
-          break;
-        }
-      }
-      _typeNumber = typeNumber;
-    }
-    makeImpl(false, getBestMaskPattern());
-  };
-  _this.createTableTag = function(cellSize, margin) {
-    cellSize = cellSize || 2;
-    margin = typeof margin == "undefined" ? cellSize * 4 : margin;
-    let qrHtml = "";
-    qrHtml += '<table style="';
-    qrHtml += " border-width: 0px; border-style: none;";
-    qrHtml += " border-collapse: collapse;";
-    qrHtml += " padding: 0px; margin: " + margin + "px;";
-    qrHtml += '">';
-    qrHtml += "<tbody>";
-    for (let r = 0;r < _this.getModuleCount(); r += 1) {
-      qrHtml += "<tr>";
-      for (let c = 0;c < _this.getModuleCount(); c += 1) {
-        qrHtml += '<td style="';
-        qrHtml += " border-width: 0px; border-style: none;";
-        qrHtml += " border-collapse: collapse;";
-        qrHtml += " padding: 0px; margin: 0px;";
-        qrHtml += " width: " + cellSize + "px;";
-        qrHtml += " height: " + cellSize + "px;";
-        qrHtml += " background-color: ";
-        qrHtml += _this.isDark(r, c) ? "#000000" : "#ffffff";
-        qrHtml += ";";
-        qrHtml += '"/>';
-      }
-      qrHtml += "</tr>";
-    }
-    qrHtml += "</tbody>";
-    qrHtml += "</table>";
-    return qrHtml;
-  };
-  _this.createSvgTag = function(cellSize, margin, alt, title) {
-    let opts = {};
-    if (typeof arguments[0] == "object") {
-      opts = arguments[0];
-      cellSize = opts.cellSize;
-      margin = opts.margin;
-      alt = opts.alt;
-      title = opts.title;
-    }
-    cellSize = cellSize || 2;
-    margin = typeof margin == "undefined" ? cellSize * 4 : margin;
-    alt = typeof alt === "string" ? { text: alt } : alt || {};
-    alt.text = alt.text || null;
-    alt.id = alt.text ? alt.id || "qrcode-description" : null;
-    title = typeof title === "string" ? { text: title } : title || {};
-    title.text = title.text || null;
-    title.id = title.text ? title.id || "qrcode-title" : null;
-    const size = _this.getModuleCount() * cellSize + margin * 2;
-    let c, mc, r, mr, qrSvg = "", rect;
-    rect = "l" + cellSize + ",0 0," + cellSize + " -" + cellSize + ",0 0,-" + cellSize + "z ";
-    qrSvg += '<svg version="1.1" xmlns="http://www.w3.org/2000/svg"';
-    qrSvg += !opts.scalable ? ' width="' + size + 'px" height="' + size + 'px"' : "";
-    qrSvg += ' viewBox="0 0 ' + size + " " + size + '" ';
-    qrSvg += ' preserveAspectRatio="xMinYMin meet"';
-    qrSvg += title.text || alt.text ? ' role="img" aria-labelledby="' + escapeXml([title.id, alt.id].join(" ").trim()) + '"' : "";
-    qrSvg += ">";
-    qrSvg += title.text ? '<title id="' + escapeXml(title.id) + '">' + escapeXml(title.text) + "</title>" : "";
-    qrSvg += alt.text ? '<description id="' + escapeXml(alt.id) + '">' + escapeXml(alt.text) + "</description>" : "";
-    qrSvg += '<rect width="100%" height="100%" fill="white" cx="0" cy="0"/>';
-    qrSvg += '<path d="';
-    for (r = 0;r < _this.getModuleCount(); r += 1) {
-      mr = r * cellSize + margin;
-      for (c = 0;c < _this.getModuleCount(); c += 1) {
-        if (_this.isDark(r, c)) {
-          mc = c * cellSize + margin;
-          qrSvg += "M" + mc + "," + mr + rect;
-        }
-      }
-    }
-    qrSvg += '" stroke="transparent" fill="black"/>';
-    qrSvg += "</svg>";
-    return qrSvg;
-  };
-  _this.createDataURL = function(cellSize, margin) {
-    cellSize = cellSize || 2;
-    margin = typeof margin == "undefined" ? cellSize * 4 : margin;
-    const size = _this.getModuleCount() * cellSize + margin * 2;
-    const min = margin;
-    const max = size - margin;
-    return createDataURL(size, size, function(x, y) {
-      if (min <= x && x < max && min <= y && y < max) {
-        const c = Math.floor((x - min) / cellSize);
-        const r = Math.floor((y - min) / cellSize);
-        return _this.isDark(r, c) ? 0 : 1;
-      } else {
-        return 1;
-      }
-    });
-  };
-  _this.createImgTag = function(cellSize, margin, alt) {
-    cellSize = cellSize || 2;
-    margin = typeof margin == "undefined" ? cellSize * 4 : margin;
-    const size = _this.getModuleCount() * cellSize + margin * 2;
-    let img = "";
-    img += "<img";
-    img += ' src="';
-    img += _this.createDataURL(cellSize, margin);
-    img += '"';
-    img += ' width="';
-    img += size;
-    img += '"';
-    img += ' height="';
-    img += size;
-    img += '"';
-    if (alt) {
-      img += ' alt="';
-      img += escapeXml(alt);
-      img += '"';
-    }
-    img += "/>";
-    return img;
-  };
-  const escapeXml = function(s) {
-    let escaped = "";
-    for (let i = 0;i < s.length; i += 1) {
-      const c = s.charAt(i);
-      switch (c) {
-        case "<":
-          escaped += "&lt;";
-          break;
-        case ">":
-          escaped += "&gt;";
-          break;
-        case "&":
-          escaped += "&amp;";
-          break;
-        case '"':
-          escaped += "&quot;";
-          break;
-        default:
-          escaped += c;
-          break;
-      }
-    }
-    return escaped;
-  };
-  const _createHalfASCII = function(margin) {
-    const cellSize = 1;
-    margin = typeof margin == "undefined" ? cellSize * 2 : margin;
-    const size = _this.getModuleCount() * cellSize + margin * 2;
-    const min = margin;
-    const max = size - margin;
-    let y, x, r1, r2, p;
-    const blocks = {
-      "\u2588\u2588": "\u2588",
-      "\u2588 ": "\u2580",
-      " \u2588": "\u2584",
-      "  ": " "
-    };
-    const blocksLastLineNoMargin = {
-      "\u2588\u2588": "\u2580",
-      "\u2588 ": "\u2580",
-      " \u2588": " ",
-      "  ": " "
-    };
-    let ascii = "";
-    for (y = 0;y < size; y += 2) {
-      r1 = Math.floor((y - min) / cellSize);
-      r2 = Math.floor((y + 1 - min) / cellSize);
-      for (x = 0;x < size; x += 1) {
-        p = "\u2588";
-        if (min <= x && x < max && min <= y && y < max && _this.isDark(r1, Math.floor((x - min) / cellSize))) {
-          p = " ";
-        }
-        if (min <= x && x < max && min <= y + 1 && y + 1 < max && _this.isDark(r2, Math.floor((x - min) / cellSize))) {
-          p += " ";
-        } else {
-          p += "\u2588";
-        }
-        ascii += margin < 1 && y + 1 >= max ? blocksLastLineNoMargin[p] : blocks[p];
-      }
-      ascii += `
-`;
-    }
-    if (size % 2 && margin > 0) {
-      return ascii.substring(0, ascii.length - size - 1) + Array(size + 1).join("\u2580");
-    }
-    return ascii.substring(0, ascii.length - 1);
-  };
-  _this.createASCII = function(cellSize, margin) {
-    cellSize = cellSize || 1;
-    if (cellSize < 2) {
-      return _createHalfASCII(margin);
-    }
-    cellSize -= 1;
-    margin = typeof margin == "undefined" ? cellSize * 2 : margin;
-    const size = _this.getModuleCount() * cellSize + margin * 2;
-    const min = margin;
-    const max = size - margin;
-    let y, x, r, p;
-    const white = Array(cellSize + 1).join("\u2588\u2588");
-    const black = Array(cellSize + 1).join("  ");
-    let ascii = "";
-    let line = "";
-    for (y = 0;y < size; y += 1) {
-      r = Math.floor((y - min) / cellSize);
-      line = "";
-      for (x = 0;x < size; x += 1) {
-        p = 1;
-        if (min <= x && x < max && min <= y && y < max && _this.isDark(r, Math.floor((x - min) / cellSize))) {
-          p = 0;
-        }
-        line += p ? white : black;
-      }
-      for (r = 0;r < cellSize; r += 1) {
-        ascii += line + `
-`;
-      }
-    }
-    return ascii.substring(0, ascii.length - 1);
-  };
-  _this.renderTo2dContext = function(context, cellSize) {
-    cellSize = cellSize || 2;
-    const length = _this.getModuleCount();
-    for (let row = 0;row < length; row++) {
-      for (let col = 0;col < length; col++) {
-        context.fillStyle = _this.isDark(row, col) ? "black" : "white";
-        context.fillRect(col * cellSize, row * cellSize, cellSize, cellSize);
-      }
-    }
-  };
-  return _this;
-};
-qrcode.stringToBytes = function(s) {
-  const bytes = [];
-  for (let i = 0;i < s.length; i += 1) {
-    const c = s.charCodeAt(i);
-    bytes.push(c & 255);
-  }
-  return bytes;
-};
-qrcode.createStringToBytes = function(unicodeData, numChars) {
-  const unicodeMap = function() {
-    const bin = base64DecodeInputStream(unicodeData);
-    const read = function() {
-      const b = bin.read();
-      if (b == -1)
-        throw "eof";
-      return b;
-    };
-    let count = 0;
-    const unicodeMap = {};
-    while (true) {
-      const b0 = bin.read();
-      if (b0 == -1)
-        break;
-      const b1 = read();
-      const b2 = read();
-      const b3 = read();
-      const k = String.fromCharCode(b0 << 8 | b1);
-      const v = b2 << 8 | b3;
-      unicodeMap[k] = v;
-      count += 1;
-    }
-    if (count != numChars) {
-      throw count + " != " + numChars;
-    }
-    return unicodeMap;
-  }();
-  const unknownChar = 63;
-  return function(s) {
-    const bytes = [];
-    for (let i = 0;i < s.length; i += 1) {
-      const c = s.charCodeAt(i);
-      if (c < 128) {
-        bytes.push(c);
-      } else {
-        const b = unicodeMap[s.charAt(i)];
-        if (typeof b == "number") {
-          if ((b & 255) == b) {
-            bytes.push(b);
-          } else {
-            bytes.push(b >>> 8);
-            bytes.push(b & 255);
-          }
-        } else {
-          bytes.push(unknownChar);
-        }
-      }
-    }
-    return bytes;
-  };
-};
-var QRMode = {
-  MODE_NUMBER: 1 << 0,
-  MODE_ALPHA_NUM: 1 << 1,
-  MODE_8BIT_BYTE: 1 << 2,
-  MODE_KANJI: 1 << 3
-};
-var QRErrorCorrectionLevel = {
-  L: 1,
-  M: 0,
-  Q: 3,
-  H: 2
-};
-var QRMaskPattern = {
-  PATTERN000: 0,
-  PATTERN001: 1,
-  PATTERN010: 2,
-  PATTERN011: 3,
-  PATTERN100: 4,
-  PATTERN101: 5,
-  PATTERN110: 6,
-  PATTERN111: 7
-};
-var QRUtil = function() {
-  const PATTERN_POSITION_TABLE = [
-    [],
-    [6, 18],
-    [6, 22],
-    [6, 26],
-    [6, 30],
-    [6, 34],
-    [6, 22, 38],
-    [6, 24, 42],
-    [6, 26, 46],
-    [6, 28, 50],
-    [6, 30, 54],
-    [6, 32, 58],
-    [6, 34, 62],
-    [6, 26, 46, 66],
-    [6, 26, 48, 70],
-    [6, 26, 50, 74],
-    [6, 30, 54, 78],
-    [6, 30, 56, 82],
-    [6, 30, 58, 86],
-    [6, 34, 62, 90],
-    [6, 28, 50, 72, 94],
-    [6, 26, 50, 74, 98],
-    [6, 30, 54, 78, 102],
-    [6, 28, 54, 80, 106],
-    [6, 32, 58, 84, 110],
-    [6, 30, 58, 86, 114],
-    [6, 34, 62, 90, 118],
-    [6, 26, 50, 74, 98, 122],
-    [6, 30, 54, 78, 102, 126],
-    [6, 26, 52, 78, 104, 130],
-    [6, 30, 56, 82, 108, 134],
-    [6, 34, 60, 86, 112, 138],
-    [6, 30, 58, 86, 114, 142],
-    [6, 34, 62, 90, 118, 146],
-    [6, 30, 54, 78, 102, 126, 150],
-    [6, 24, 50, 76, 102, 128, 154],
-    [6, 28, 54, 80, 106, 132, 158],
-    [6, 32, 58, 84, 110, 136, 162],
-    [6, 26, 54, 82, 110, 138, 166],
-    [6, 30, 58, 86, 114, 142, 170]
-  ];
-  const G15 = 1 << 10 | 1 << 8 | 1 << 5 | 1 << 4 | 1 << 2 | 1 << 1 | 1 << 0;
-  const G18 = 1 << 12 | 1 << 11 | 1 << 10 | 1 << 9 | 1 << 8 | 1 << 5 | 1 << 2 | 1 << 0;
-  const G15_MASK = 1 << 14 | 1 << 12 | 1 << 10 | 1 << 4 | 1 << 1;
-  const _this = {};
-  const getBCHDigit = function(data) {
-    let digit = 0;
-    while (data != 0) {
-      digit += 1;
-      data >>>= 1;
-    }
-    return digit;
-  };
-  _this.getBCHTypeInfo = function(data) {
-    let d = data << 10;
-    while (getBCHDigit(d) - getBCHDigit(G15) >= 0) {
-      d ^= G15 << getBCHDigit(d) - getBCHDigit(G15);
-    }
-    return (data << 10 | d) ^ G15_MASK;
-  };
-  _this.getBCHTypeNumber = function(data) {
-    let d = data << 12;
-    while (getBCHDigit(d) - getBCHDigit(G18) >= 0) {
-      d ^= G18 << getBCHDigit(d) - getBCHDigit(G18);
-    }
-    return data << 12 | d;
-  };
-  _this.getPatternPosition = function(typeNumber) {
-    return PATTERN_POSITION_TABLE[typeNumber - 1];
-  };
-  _this.getMaskFunction = function(maskPattern) {
-    switch (maskPattern) {
-      case QRMaskPattern.PATTERN000:
-        return function(i, j) {
-          return (i + j) % 2 == 0;
-        };
-      case QRMaskPattern.PATTERN001:
-        return function(i, j) {
-          return i % 2 == 0;
-        };
-      case QRMaskPattern.PATTERN010:
-        return function(i, j) {
-          return j % 3 == 0;
-        };
-      case QRMaskPattern.PATTERN011:
-        return function(i, j) {
-          return (i + j) % 3 == 0;
-        };
-      case QRMaskPattern.PATTERN100:
-        return function(i, j) {
-          return (Math.floor(i / 2) + Math.floor(j / 3)) % 2 == 0;
-        };
-      case QRMaskPattern.PATTERN101:
-        return function(i, j) {
-          return i * j % 2 + i * j % 3 == 0;
-        };
-      case QRMaskPattern.PATTERN110:
-        return function(i, j) {
-          return (i * j % 2 + i * j % 3) % 2 == 0;
-        };
-      case QRMaskPattern.PATTERN111:
-        return function(i, j) {
-          return (i * j % 3 + (i + j) % 2) % 2 == 0;
-        };
-      default:
-        throw "bad maskPattern:" + maskPattern;
-    }
-  };
-  _this.getErrorCorrectPolynomial = function(errorCorrectLength) {
-    let a = qrPolynomial([1], 0);
-    for (let i = 0;i < errorCorrectLength; i += 1) {
-      a = a.multiply(qrPolynomial([1, QRMath.gexp(i)], 0));
-    }
-    return a;
-  };
-  _this.getLengthInBits = function(mode, type) {
-    if (1 <= type && type < 10) {
-      switch (mode) {
-        case QRMode.MODE_NUMBER:
-          return 10;
-        case QRMode.MODE_ALPHA_NUM:
-          return 9;
-        case QRMode.MODE_8BIT_BYTE:
-          return 8;
-        case QRMode.MODE_KANJI:
-          return 8;
-        default:
-          throw "mode:" + mode;
-      }
-    } else if (type < 27) {
-      switch (mode) {
-        case QRMode.MODE_NUMBER:
-          return 12;
-        case QRMode.MODE_ALPHA_NUM:
-          return 11;
-        case QRMode.MODE_8BIT_BYTE:
-          return 16;
-        case QRMode.MODE_KANJI:
-          return 10;
-        default:
-          throw "mode:" + mode;
-      }
-    } else if (type < 41) {
-      switch (mode) {
-        case QRMode.MODE_NUMBER:
-          return 14;
-        case QRMode.MODE_ALPHA_NUM:
-          return 13;
-        case QRMode.MODE_8BIT_BYTE:
-          return 16;
-        case QRMode.MODE_KANJI:
-          return 12;
-        default:
-          throw "mode:" + mode;
-      }
-    } else {
-      throw "type:" + type;
-    }
-  };
-  _this.getLostPoint = function(qrcode) {
-    const moduleCount = qrcode.getModuleCount();
-    let lostPoint = 0;
-    for (let row = 0;row < moduleCount; row += 1) {
-      for (let col = 0;col < moduleCount; col += 1) {
-        let sameCount = 0;
-        const dark = qrcode.isDark(row, col);
-        for (let r = -1;r <= 1; r += 1) {
-          if (row + r < 0 || moduleCount <= row + r) {
-            continue;
-          }
-          for (let c = -1;c <= 1; c += 1) {
-            if (col + c < 0 || moduleCount <= col + c) {
-              continue;
-            }
-            if (r == 0 && c == 0) {
-              continue;
-            }
-            if (dark == qrcode.isDark(row + r, col + c)) {
-              sameCount += 1;
-            }
-          }
-        }
-        if (sameCount > 5) {
-          lostPoint += 3 + sameCount - 5;
-        }
-      }
-    }
-    for (let row = 0;row < moduleCount - 1; row += 1) {
-      for (let col = 0;col < moduleCount - 1; col += 1) {
-        let count = 0;
-        if (qrcode.isDark(row, col))
-          count += 1;
-        if (qrcode.isDark(row + 1, col))
-          count += 1;
-        if (qrcode.isDark(row, col + 1))
-          count += 1;
-        if (qrcode.isDark(row + 1, col + 1))
-          count += 1;
-        if (count == 0 || count == 4) {
-          lostPoint += 3;
-        }
-      }
-    }
-    for (let row = 0;row < moduleCount; row += 1) {
-      for (let col = 0;col < moduleCount - 6; col += 1) {
-        if (qrcode.isDark(row, col) && !qrcode.isDark(row, col + 1) && qrcode.isDark(row, col + 2) && qrcode.isDark(row, col + 3) && qrcode.isDark(row, col + 4) && !qrcode.isDark(row, col + 5) && qrcode.isDark(row, col + 6)) {
-          lostPoint += 40;
-        }
-      }
-    }
-    for (let col = 0;col < moduleCount; col += 1) {
-      for (let row = 0;row < moduleCount - 6; row += 1) {
-        if (qrcode.isDark(row, col) && !qrcode.isDark(row + 1, col) && qrcode.isDark(row + 2, col) && qrcode.isDark(row + 3, col) && qrcode.isDark(row + 4, col) && !qrcode.isDark(row + 5, col) && qrcode.isDark(row + 6, col)) {
-          lostPoint += 40;
-        }
-      }
-    }
-    let darkCount = 0;
-    for (let col = 0;col < moduleCount; col += 1) {
-      for (let row = 0;row < moduleCount; row += 1) {
-        if (qrcode.isDark(row, col)) {
-          darkCount += 1;
-        }
-      }
-    }
-    const ratio = Math.abs(100 * darkCount / moduleCount / moduleCount - 50) / 5;
-    lostPoint += ratio * 10;
-    return lostPoint;
-  };
-  return _this;
-}();
-var QRMath = function() {
-  const EXP_TABLE = new Array(256);
-  const LOG_TABLE = new Array(256);
-  for (let i = 0;i < 8; i += 1) {
-    EXP_TABLE[i] = 1 << i;
-  }
-  for (let i = 8;i < 256; i += 1) {
-    EXP_TABLE[i] = EXP_TABLE[i - 4] ^ EXP_TABLE[i - 5] ^ EXP_TABLE[i - 6] ^ EXP_TABLE[i - 8];
-  }
-  for (let i = 0;i < 255; i += 1) {
-    LOG_TABLE[EXP_TABLE[i]] = i;
-  }
-  const _this = {};
-  _this.glog = function(n) {
-    if (n < 1) {
-      throw "glog(" + n + ")";
-    }
-    return LOG_TABLE[n];
-  };
-  _this.gexp = function(n) {
-    while (n < 0) {
-      n += 255;
-    }
-    while (n >= 256) {
-      n -= 255;
-    }
-    return EXP_TABLE[n];
-  };
-  return _this;
-}();
-var qrPolynomial = function(num, shift) {
-  if (typeof num.length == "undefined") {
-    throw num.length + "/" + shift;
-  }
-  const _num = function() {
-    let offset = 0;
-    while (offset < num.length && num[offset] == 0) {
-      offset += 1;
-    }
-    const _num = new Array(num.length - offset + shift);
-    for (let i = 0;i < num.length - offset; i += 1) {
-      _num[i] = num[i + offset];
-    }
-    return _num;
-  }();
-  const _this = {};
-  _this.getAt = function(index) {
-    return _num[index];
-  };
-  _this.getLength = function() {
-    return _num.length;
-  };
-  _this.multiply = function(e) {
-    const num = new Array(_this.getLength() + e.getLength() - 1);
-    for (let i = 0;i < _this.getLength(); i += 1) {
-      for (let j = 0;j < e.getLength(); j += 1) {
-        num[i + j] ^= QRMath.gexp(QRMath.glog(_this.getAt(i)) + QRMath.glog(e.getAt(j)));
-      }
-    }
-    return qrPolynomial(num, 0);
-  };
-  _this.mod = function(e) {
-    if (_this.getLength() - e.getLength() < 0) {
-      return _this;
-    }
-    const ratio = QRMath.glog(_this.getAt(0)) - QRMath.glog(e.getAt(0));
-    const num = new Array(_this.getLength());
-    for (let i = 0;i < _this.getLength(); i += 1) {
-      num[i] = _this.getAt(i);
-    }
-    for (let i = 0;i < e.getLength(); i += 1) {
-      num[i] ^= QRMath.gexp(QRMath.glog(e.getAt(i)) + ratio);
-    }
-    return qrPolynomial(num, 0).mod(e);
-  };
-  return _this;
-};
-var QRRSBlock = function() {
-  const RS_BLOCK_TABLE = [
-    [1, 26, 19],
-    [1, 26, 16],
-    [1, 26, 13],
-    [1, 26, 9],
-    [1, 44, 34],
-    [1, 44, 28],
-    [1, 44, 22],
-    [1, 44, 16],
-    [1, 70, 55],
-    [1, 70, 44],
-    [2, 35, 17],
-    [2, 35, 13],
-    [1, 100, 80],
-    [2, 50, 32],
-    [2, 50, 24],
-    [4, 25, 9],
-    [1, 134, 108],
-    [2, 67, 43],
-    [2, 33, 15, 2, 34, 16],
-    [2, 33, 11, 2, 34, 12],
-    [2, 86, 68],
-    [4, 43, 27],
-    [4, 43, 19],
-    [4, 43, 15],
-    [2, 98, 78],
-    [4, 49, 31],
-    [2, 32, 14, 4, 33, 15],
-    [4, 39, 13, 1, 40, 14],
-    [2, 121, 97],
-    [2, 60, 38, 2, 61, 39],
-    [4, 40, 18, 2, 41, 19],
-    [4, 40, 14, 2, 41, 15],
-    [2, 146, 116],
-    [3, 58, 36, 2, 59, 37],
-    [4, 36, 16, 4, 37, 17],
-    [4, 36, 12, 4, 37, 13],
-    [2, 86, 68, 2, 87, 69],
-    [4, 69, 43, 1, 70, 44],
-    [6, 43, 19, 2, 44, 20],
-    [6, 43, 15, 2, 44, 16],
-    [4, 101, 81],
-    [1, 80, 50, 4, 81, 51],
-    [4, 50, 22, 4, 51, 23],
-    [3, 36, 12, 8, 37, 13],
-    [2, 116, 92, 2, 117, 93],
-    [6, 58, 36, 2, 59, 37],
-    [4, 46, 20, 6, 47, 21],
-    [7, 42, 14, 4, 43, 15],
-    [4, 133, 107],
-    [8, 59, 37, 1, 60, 38],
-    [8, 44, 20, 4, 45, 21],
-    [12, 33, 11, 4, 34, 12],
-    [3, 145, 115, 1, 146, 116],
-    [4, 64, 40, 5, 65, 41],
-    [11, 36, 16, 5, 37, 17],
-    [11, 36, 12, 5, 37, 13],
-    [5, 109, 87, 1, 110, 88],
-    [5, 65, 41, 5, 66, 42],
-    [5, 54, 24, 7, 55, 25],
-    [11, 36, 12, 7, 37, 13],
-    [5, 122, 98, 1, 123, 99],
-    [7, 73, 45, 3, 74, 46],
-    [15, 43, 19, 2, 44, 20],
-    [3, 45, 15, 13, 46, 16],
-    [1, 135, 107, 5, 136, 108],
-    [10, 74, 46, 1, 75, 47],
-    [1, 50, 22, 15, 51, 23],
-    [2, 42, 14, 17, 43, 15],
-    [5, 150, 120, 1, 151, 121],
-    [9, 69, 43, 4, 70, 44],
-    [17, 50, 22, 1, 51, 23],
-    [2, 42, 14, 19, 43, 15],
-    [3, 141, 113, 4, 142, 114],
-    [3, 70, 44, 11, 71, 45],
-    [17, 47, 21, 4, 48, 22],
-    [9, 39, 13, 16, 40, 14],
-    [3, 135, 107, 5, 136, 108],
-    [3, 67, 41, 13, 68, 42],
-    [15, 54, 24, 5, 55, 25],
-    [15, 43, 15, 10, 44, 16],
-    [4, 144, 116, 4, 145, 117],
-    [17, 68, 42],
-    [17, 50, 22, 6, 51, 23],
-    [19, 46, 16, 6, 47, 17],
-    [2, 139, 111, 7, 140, 112],
-    [17, 74, 46],
-    [7, 54, 24, 16, 55, 25],
-    [34, 37, 13],
-    [4, 151, 121, 5, 152, 122],
-    [4, 75, 47, 14, 76, 48],
-    [11, 54, 24, 14, 55, 25],
-    [16, 45, 15, 14, 46, 16],
-    [6, 147, 117, 4, 148, 118],
-    [6, 73, 45, 14, 74, 46],
-    [11, 54, 24, 16, 55, 25],
-    [30, 46, 16, 2, 47, 17],
-    [8, 132, 106, 4, 133, 107],
-    [8, 75, 47, 13, 76, 48],
-    [7, 54, 24, 22, 55, 25],
-    [22, 45, 15, 13, 46, 16],
-    [10, 142, 114, 2, 143, 115],
-    [19, 74, 46, 4, 75, 47],
-    [28, 50, 22, 6, 51, 23],
-    [33, 46, 16, 4, 47, 17],
-    [8, 152, 122, 4, 153, 123],
-    [22, 73, 45, 3, 74, 46],
-    [8, 53, 23, 26, 54, 24],
-    [12, 45, 15, 28, 46, 16],
-    [3, 147, 117, 10, 148, 118],
-    [3, 73, 45, 23, 74, 46],
-    [4, 54, 24, 31, 55, 25],
-    [11, 45, 15, 31, 46, 16],
-    [7, 146, 116, 7, 147, 117],
-    [21, 73, 45, 7, 74, 46],
-    [1, 53, 23, 37, 54, 24],
-    [19, 45, 15, 26, 46, 16],
-    [5, 145, 115, 10, 146, 116],
-    [19, 75, 47, 10, 76, 48],
-    [15, 54, 24, 25, 55, 25],
-    [23, 45, 15, 25, 46, 16],
-    [13, 145, 115, 3, 146, 116],
-    [2, 74, 46, 29, 75, 47],
-    [42, 54, 24, 1, 55, 25],
-    [23, 45, 15, 28, 46, 16],
-    [17, 145, 115],
-    [10, 74, 46, 23, 75, 47],
-    [10, 54, 24, 35, 55, 25],
-    [19, 45, 15, 35, 46, 16],
-    [17, 145, 115, 1, 146, 116],
-    [14, 74, 46, 21, 75, 47],
-    [29, 54, 24, 19, 55, 25],
-    [11, 45, 15, 46, 46, 16],
-    [13, 145, 115, 6, 146, 116],
-    [14, 74, 46, 23, 75, 47],
-    [44, 54, 24, 7, 55, 25],
-    [59, 46, 16, 1, 47, 17],
-    [12, 151, 121, 7, 152, 122],
-    [12, 75, 47, 26, 76, 48],
-    [39, 54, 24, 14, 55, 25],
-    [22, 45, 15, 41, 46, 16],
-    [6, 151, 121, 14, 152, 122],
-    [6, 75, 47, 34, 76, 48],
-    [46, 54, 24, 10, 55, 25],
-    [2, 45, 15, 64, 46, 16],
-    [17, 152, 122, 4, 153, 123],
-    [29, 74, 46, 14, 75, 47],
-    [49, 54, 24, 10, 55, 25],
-    [24, 45, 15, 46, 46, 16],
-    [4, 152, 122, 18, 153, 123],
-    [13, 74, 46, 32, 75, 47],
-    [48, 54, 24, 14, 55, 25],
-    [42, 45, 15, 32, 46, 16],
-    [20, 147, 117, 4, 148, 118],
-    [40, 75, 47, 7, 76, 48],
-    [43, 54, 24, 22, 55, 25],
-    [10, 45, 15, 67, 46, 16],
-    [19, 148, 118, 6, 149, 119],
-    [18, 75, 47, 31, 76, 48],
-    [34, 54, 24, 34, 55, 25],
-    [20, 45, 15, 61, 46, 16]
-  ];
-  const qrRSBlock = function(totalCount, dataCount) {
-    const _this = {};
-    _this.totalCount = totalCount;
-    _this.dataCount = dataCount;
-    return _this;
-  };
-  const _this = {};
-  const getRsBlockTable = function(typeNumber, errorCorrectionLevel) {
-    switch (errorCorrectionLevel) {
-      case QRErrorCorrectionLevel.L:
-        return RS_BLOCK_TABLE[(typeNumber - 1) * 4 + 0];
-      case QRErrorCorrectionLevel.M:
-        return RS_BLOCK_TABLE[(typeNumber - 1) * 4 + 1];
-      case QRErrorCorrectionLevel.Q:
-        return RS_BLOCK_TABLE[(typeNumber - 1) * 4 + 2];
-      case QRErrorCorrectionLevel.H:
-        return RS_BLOCK_TABLE[(typeNumber - 1) * 4 + 3];
-      default:
-        return;
-    }
-  };
-  _this.getRSBlocks = function(typeNumber, errorCorrectionLevel) {
-    const rsBlock = getRsBlockTable(typeNumber, errorCorrectionLevel);
-    if (typeof rsBlock == "undefined") {
-      throw "bad rs block @ typeNumber:" + typeNumber + "/errorCorrectionLevel:" + errorCorrectionLevel;
-    }
-    const length = rsBlock.length / 3;
-    const list = [];
-    for (let i = 0;i < length; i += 1) {
-      const count = rsBlock[i * 3 + 0];
-      const totalCount = rsBlock[i * 3 + 1];
-      const dataCount = rsBlock[i * 3 + 2];
-      for (let j = 0;j < count; j += 1) {
-        list.push(qrRSBlock(totalCount, dataCount));
-      }
-    }
-    return list;
-  };
-  return _this;
-}();
-var qrBitBuffer = function() {
-  const _buffer = [];
-  let _length = 0;
-  const _this = {};
-  _this.getBuffer = function() {
-    return _buffer;
-  };
-  _this.getAt = function(index) {
-    const bufIndex = Math.floor(index / 8);
-    return (_buffer[bufIndex] >>> 7 - index % 8 & 1) == 1;
-  };
-  _this.put = function(num, length) {
-    for (let i = 0;i < length; i += 1) {
-      _this.putBit((num >>> length - i - 1 & 1) == 1);
-    }
-  };
-  _this.getLengthInBits = function() {
-    return _length;
-  };
-  _this.putBit = function(bit) {
-    const bufIndex = Math.floor(_length / 8);
-    if (_buffer.length <= bufIndex) {
-      _buffer.push(0);
-    }
-    if (bit) {
-      _buffer[bufIndex] |= 128 >>> _length % 8;
-    }
-    _length += 1;
-  };
-  return _this;
-};
-var qrNumber = function(data) {
-  const _mode = QRMode.MODE_NUMBER;
-  const _data = data;
-  const _this = {};
-  _this.getMode = function() {
-    return _mode;
-  };
-  _this.getLength = function(buffer) {
-    return _data.length;
-  };
-  _this.write = function(buffer) {
-    const data = _data;
-    let i = 0;
-    while (i + 2 < data.length) {
-      buffer.put(strToNum(data.substring(i, i + 3)), 10);
-      i += 3;
-    }
-    if (i < data.length) {
-      if (data.length - i == 1) {
-        buffer.put(strToNum(data.substring(i, i + 1)), 4);
-      } else if (data.length - i == 2) {
-        buffer.put(strToNum(data.substring(i, i + 2)), 7);
-      }
-    }
-  };
-  const strToNum = function(s) {
-    let num = 0;
-    for (let i = 0;i < s.length; i += 1) {
-      num = num * 10 + chatToNum(s.charAt(i));
-    }
-    return num;
-  };
-  const chatToNum = function(c) {
-    if ("0" <= c && c <= "9") {
-      return c.charCodeAt(0) - 48;
-    }
-    throw "illegal char :" + c;
-  };
-  return _this;
-};
-var qrAlphaNum = function(data) {
-  const _mode = QRMode.MODE_ALPHA_NUM;
-  const _data = data;
-  const _this = {};
-  _this.getMode = function() {
-    return _mode;
-  };
-  _this.getLength = function(buffer) {
-    return _data.length;
-  };
-  _this.write = function(buffer) {
-    const s = _data;
-    let i = 0;
-    while (i + 1 < s.length) {
-      buffer.put(getCode(s.charAt(i)) * 45 + getCode(s.charAt(i + 1)), 11);
-      i += 2;
-    }
-    if (i < s.length) {
-      buffer.put(getCode(s.charAt(i)), 6);
-    }
-  };
-  const getCode = function(c) {
-    if ("0" <= c && c <= "9") {
-      return c.charCodeAt(0) - 48;
-    } else if ("A" <= c && c <= "Z") {
-      return c.charCodeAt(0) - 65 + 10;
-    } else {
-      switch (c) {
-        case " ":
-          return 36;
-        case "$":
-          return 37;
-        case "%":
-          return 38;
-        case "*":
-          return 39;
-        case "+":
-          return 40;
-        case "-":
-          return 41;
-        case ".":
-          return 42;
-        case "/":
-          return 43;
-        case ":":
-          return 44;
-        default:
-          throw "illegal char :" + c;
-      }
-    }
-  };
-  return _this;
-};
-var qr8BitByte = function(data) {
-  const _mode = QRMode.MODE_8BIT_BYTE;
-  const _data = data;
-  const _bytes = qrcode.stringToBytes(data);
-  const _this = {};
-  _this.getMode = function() {
-    return _mode;
-  };
-  _this.getLength = function(buffer) {
-    return _bytes.length;
-  };
-  _this.write = function(buffer) {
-    for (let i = 0;i < _bytes.length; i += 1) {
-      buffer.put(_bytes[i], 8);
-    }
-  };
-  return _this;
-};
-var qrKanji = function(data) {
-  const _mode = QRMode.MODE_KANJI;
-  const _data = data;
-  const stringToBytes = qrcode.stringToBytes;
-  (function(c, code) {
-    const test = stringToBytes(c);
-    if (test.length != 2 || (test[0] << 8 | test[1]) != code) {
-      throw "sjis not supported.";
-    }
-  })("\u53CB", 38726);
-  const _bytes = stringToBytes(data);
-  const _this = {};
-  _this.getMode = function() {
-    return _mode;
-  };
-  _this.getLength = function(buffer) {
-    return ~~(_bytes.length / 2);
-  };
-  _this.write = function(buffer) {
-    const data = _bytes;
-    let i = 0;
-    while (i + 1 < data.length) {
-      let c = (255 & data[i]) << 8 | 255 & data[i + 1];
-      if (33088 <= c && c <= 40956) {
-        c -= 33088;
-      } else if (57408 <= c && c <= 60351) {
-        c -= 49472;
-      } else {
-        throw "illegal char at " + (i + 1) + "/" + c;
-      }
-      c = (c >>> 8 & 255) * 192 + (c & 255);
-      buffer.put(c, 13);
-      i += 2;
-    }
-    if (i < data.length) {
-      throw "illegal char at " + (i + 1);
-    }
-  };
-  return _this;
-};
-var byteArrayOutputStream = function() {
-  const _bytes = [];
-  const _this = {};
-  _this.writeByte = function(b) {
-    _bytes.push(b & 255);
-  };
-  _this.writeShort = function(i) {
-    _this.writeByte(i);
-    _this.writeByte(i >>> 8);
-  };
-  _this.writeBytes = function(b, off, len) {
-    off = off || 0;
-    len = len || b.length;
-    for (let i = 0;i < len; i += 1) {
-      _this.writeByte(b[i + off]);
-    }
-  };
-  _this.writeString = function(s) {
-    for (let i = 0;i < s.length; i += 1) {
-      _this.writeByte(s.charCodeAt(i));
-    }
-  };
-  _this.toByteArray = function() {
-    return _bytes;
-  };
-  _this.toString = function() {
-    let s = "";
-    s += "[";
-    for (let i = 0;i < _bytes.length; i += 1) {
-      if (i > 0) {
-        s += ",";
-      }
-      s += _bytes[i];
-    }
-    s += "]";
-    return s;
-  };
-  return _this;
-};
-var base64EncodeOutputStream = function() {
-  let _buffer = 0;
-  let _buflen = 0;
-  let _length = 0;
-  let _base64 = "";
-  const _this = {};
-  const writeEncoded = function(b) {
-    _base64 += String.fromCharCode(encode(b & 63));
-  };
-  const encode = function(n) {
-    if (n < 0) {
-      throw "n:" + n;
-    } else if (n < 26) {
-      return 65 + n;
-    } else if (n < 52) {
-      return 97 + (n - 26);
-    } else if (n < 62) {
-      return 48 + (n - 52);
-    } else if (n == 62) {
-      return 43;
-    } else if (n == 63) {
-      return 47;
-    } else {
-      throw "n:" + n;
-    }
-  };
-  _this.writeByte = function(n) {
-    _buffer = _buffer << 8 | n & 255;
-    _buflen += 8;
-    _length += 1;
-    while (_buflen >= 6) {
-      writeEncoded(_buffer >>> _buflen - 6);
-      _buflen -= 6;
-    }
-  };
-  _this.flush = function() {
-    if (_buflen > 0) {
-      writeEncoded(_buffer << 6 - _buflen);
-      _buffer = 0;
-      _buflen = 0;
-    }
-    if (_length % 3 != 0) {
-      const padlen = 3 - _length % 3;
-      for (let i = 0;i < padlen; i += 1) {
-        _base64 += "=";
-      }
-    }
-  };
-  _this.toString = function() {
-    return _base64;
-  };
-  return _this;
-};
-var base64DecodeInputStream = function(str) {
-  const _str = str;
-  let _pos = 0;
-  let _buffer = 0;
-  let _buflen = 0;
-  const _this = {};
-  _this.read = function() {
-    while (_buflen < 8) {
-      if (_pos >= _str.length) {
-        if (_buflen == 0) {
-          return -1;
-        }
-        throw "unexpected end of file./" + _buflen;
-      }
-      const c = _str.charAt(_pos);
-      _pos += 1;
-      if (c == "=") {
-        _buflen = 0;
-        return -1;
-      } else if (c.match(/^\s$/)) {
-        continue;
-      }
-      _buffer = _buffer << 6 | decode(c.charCodeAt(0));
-      _buflen += 6;
-    }
-    const n = _buffer >>> _buflen - 8 & 255;
-    _buflen -= 8;
-    return n;
-  };
-  const decode = function(c) {
-    if (65 <= c && c <= 90) {
-      return c - 65;
-    } else if (97 <= c && c <= 122) {
-      return c - 97 + 26;
-    } else if (48 <= c && c <= 57) {
-      return c - 48 + 52;
-    } else if (c == 43) {
-      return 62;
-    } else if (c == 47) {
-      return 63;
-    } else {
-      throw "c:" + c;
-    }
-  };
-  return _this;
-};
-var gifImage = function(width, height) {
-  const _width = width;
-  const _height = height;
-  const _data = new Array(width * height);
-  const _this = {};
-  _this.setPixel = function(x, y, pixel) {
-    _data[y * _width + x] = pixel;
-  };
-  _this.write = function(out) {
-    out.writeString("GIF87a");
-    out.writeShort(_width);
-    out.writeShort(_height);
-    out.writeByte(128);
-    out.writeByte(0);
-    out.writeByte(0);
-    out.writeByte(0);
-    out.writeByte(0);
-    out.writeByte(0);
-    out.writeByte(255);
-    out.writeByte(255);
-    out.writeByte(255);
-    out.writeString(",");
-    out.writeShort(0);
-    out.writeShort(0);
-    out.writeShort(_width);
-    out.writeShort(_height);
-    out.writeByte(0);
-    const lzwMinCodeSize = 2;
-    const raster = getLZWRaster(lzwMinCodeSize);
-    out.writeByte(lzwMinCodeSize);
-    let offset = 0;
-    while (raster.length - offset > 255) {
-      out.writeByte(255);
-      out.writeBytes(raster, offset, 255);
-      offset += 255;
-    }
-    out.writeByte(raster.length - offset);
-    out.writeBytes(raster, offset, raster.length - offset);
-    out.writeByte(0);
-    out.writeString(";");
-  };
-  const bitOutputStream = function(out) {
-    const _out = out;
-    let _bitLength = 0;
-    let _bitBuffer = 0;
-    const _this = {};
-    _this.write = function(data, length) {
-      if (data >>> length != 0) {
-        throw "length over";
-      }
-      while (_bitLength + length >= 8) {
-        _out.writeByte(255 & (data << _bitLength | _bitBuffer));
-        length -= 8 - _bitLength;
-        data >>>= 8 - _bitLength;
-        _bitBuffer = 0;
-        _bitLength = 0;
-      }
-      _bitBuffer = data << _bitLength | _bitBuffer;
-      _bitLength = _bitLength + length;
-    };
-    _this.flush = function() {
-      if (_bitLength > 0) {
-        _out.writeByte(_bitBuffer);
-      }
-    };
-    return _this;
-  };
-  const getLZWRaster = function(lzwMinCodeSize) {
-    const clearCode = 1 << lzwMinCodeSize;
-    const endCode = (1 << lzwMinCodeSize) + 1;
-    let bitLength = lzwMinCodeSize + 1;
-    const table = lzwTable();
-    for (let i = 0;i < clearCode; i += 1) {
-      table.add(String.fromCharCode(i));
-    }
-    table.add(String.fromCharCode(clearCode));
-    table.add(String.fromCharCode(endCode));
-    const byteOut = byteArrayOutputStream();
-    const bitOut = bitOutputStream(byteOut);
-    bitOut.write(clearCode, bitLength);
-    let dataIndex = 0;
-    let s = String.fromCharCode(_data[dataIndex]);
-    dataIndex += 1;
-    while (dataIndex < _data.length) {
-      const c = String.fromCharCode(_data[dataIndex]);
-      dataIndex += 1;
-      if (table.contains(s + c)) {
-        s = s + c;
-      } else {
-        bitOut.write(table.indexOf(s), bitLength);
-        if (table.size() < 4095) {
-          if (table.size() == 1 << bitLength) {
-            bitLength += 1;
-          }
-          table.add(s + c);
-        }
-        s = c;
-      }
-    }
-    bitOut.write(table.indexOf(s), bitLength);
-    bitOut.write(endCode, bitLength);
-    bitOut.flush();
-    return byteOut.toByteArray();
-  };
-  const lzwTable = function() {
-    const _map = {};
-    let _size = 0;
-    const _this = {};
-    _this.add = function(key) {
-      if (_this.contains(key)) {
-        throw "dup key:" + key;
-      }
-      _map[key] = _size;
-      _size += 1;
-    };
-    _this.size = function() {
-      return _size;
-    };
-    _this.indexOf = function(key) {
-      return _map[key];
-    };
-    _this.contains = function(key) {
-      return typeof _map[key] != "undefined";
-    };
-    return _this;
-  };
-  return _this;
-};
-var createDataURL = function(width, height, getPixel) {
-  const gif = gifImage(width, height);
-  for (let y = 0;y < height; y += 1) {
-    for (let x = 0;x < width; x += 1) {
-      gif.setPixel(x, y, getPixel(x, y));
-    }
-  }
-  const b = byteArrayOutputStream();
-  gif.write(b);
-  const base64 = base64EncodeOutputStream();
-  const bytes = b.toByteArray();
-  for (let i = 0;i < bytes.length; i += 1) {
-    base64.writeByte(bytes[i]);
-  }
-  base64.flush();
-  return "data:image/gif;base64," + base64;
-};
-var qrcode_default = qrcode;
-var stringToBytes = qrcode.stringToBytes;
-
-// ../shared/src/qr.ts
-function qrModules(text) {
-  const qr = qrcode_default(0, "M");
-  qr.addData(text, "Byte");
-  qr.make();
-  const n = qr.getModuleCount();
-  return Array.from({ length: n }, (_, r) => Array.from({ length: n }, (_, c) => qr.isDark(r, c)));
-}
-function qrText(modules, margin = 2) {
-  const n = modules.length + margin * 2;
-  const light = (r, c) => {
-    const row = modules[r - margin];
-    const v = row?.[c - margin];
-    return v === undefined ? true : !v;
-  };
-  const lines = [];
-  for (let r = 0;r < n; r += 2) {
-    let line = "";
-    for (let c = 0;c < n; c++) {
-      const top = light(r, c);
-      const bottom = r + 1 < n ? light(r + 1, c) : true;
-      line += top && bottom ? "\u2588" : top ? "\u2580" : bottom ? "\u2584" : " ";
-    }
-    lines.push(line);
-  }
-  return lines.join(`
-`);
-}
-
-// src/pair.ts
-async function printPairCode() {
-  const token = readToken();
-  if (!token)
-    return "daemon token missing; `toyon doctor` says where it looked";
-  let res;
-  try {
-    res = await fetch(`${base}/pair`, { method: "POST", headers: { authorization: `Bearer ${token}` } });
-  } catch {
-    return "Toyon is not running. Start it with `toyon`, then run `toyon pair`.";
-  }
-  if (!res.ok)
-    return await res.text() || `the daemon refused a pairing code (${res.status})`;
-  const mint = await res.json();
-  console.log(`
-${qrText(qrModules(mint.url))}
-`);
-  console.log("Scan with your phone's camera. The code works once and lasts 2 minutes.");
-  console.log(mint.url);
-  if (isTailnetName(new URL(mint.url).hostname)) {
-    const r = await fetch(`${base}/pair/phones`, { headers: { authorization: `Bearer ${token}` } }).catch(() => null);
-    const phones = r?.ok ? await r.json() : null;
-    console.log(tailnetLine(phones).text);
-  }
-  return null;
-}
-async function pair() {
-  if (!await health()) {
-    console.error("toyon: Toyon is not running. Start it with `toyon`, then run `toyon pair`.");
-    return 1;
-  }
-  const refused = await printPairCode();
-  if (refused) {
-    console.error(`toyon: ${refused}`);
-    return 1;
-  }
-  return 0;
-}
-
-// src/remote.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync7, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
-
-// src/tailscale.ts
-class TailscaleError extends Error {
-}
-function tailscaleCli(bin = Bun.which("tailscale")) {
-  return async (args) => {
-    if (bin === null) {
-      throw new TailscaleError("Tailscale is not installed here (no tailscale on PATH); https://tailscale.com/download");
-    }
-    const p = Bun.spawn([bin, ...args], { stdin: "ignore", stdout: "pipe", stderr: "pipe" });
-    const [out, err] = await Promise.all([new Response(p.stdout).text(), new Response(p.stderr).text()]);
-    return { ok: await p.exited === 0, out, err };
+// src/prompt.ts
+function confirm(question) {
+  process.stdout.write(`${question} [y/N] `);
+  return new Promise((resolve) => {
+    process.stdin.once("data", (chunk) => resolve(String(chunk).trim().toLowerCase().startsWith("y")));
+    process.stdin.once("end", () => resolve(false));
+  });
+}
+
+// src/remote.ts
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
+
+// ../shared/src/tailscale.ts
+import { existsSync as existsSync8, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+var dnsName = (raw) => (raw ?? "").replace(/\.$/, "").toLowerCase();
+
+class TailscaleError extends Error {
+}
+var MAC_APP_CLI = "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
+function findTailscale() {
+  return Bun.which("tailscale") ?? (existsSync8(MAC_APP_CLI) ? MAC_APP_CLI : null);
+}
+var NOT_INSTALLED = "Tailscale is not installed here (no tailscale on PATH); https://tailscale.com/download";
+function tailscaleCli(bin = findTailscale()) {
+  return async (args) => {
+    if (bin === null)
+      throw new TailscaleError(NOT_INSTALLED);
+    const p = Bun.spawn([bin, ...args], { stdin: "ignore", stdout: "pipe", stderr: "pipe", timeout: 5000 });
+    const [out, err] = await Promise.all([new Response(p.stdout).text(), new Response(p.stderr).text()]);
+    return { ok: await p.exited === 0, out, err };
   };
 }
 function entries(daemonPort) {
@@ -8046,33 +6320,66 @@ var lastLine = (r) => (r.err.trim() || r.out.trim()).split(`
 `).at(-1) ?? "tailscale failed";
 var notRunning = (text) => /failed to connect|is Tailscale running/i.test(text);
 var NOT_RUNNING = "Tailscale is not running here; start the Tailscale app or the tailscaled service, then run `tailscale up`";
-function tailnetName(json) {
+function readinessOf(json) {
   let st;
   try {
     st = JSON.parse(json);
   } catch {
-    throw new TailscaleError(notRunning(json) ? NOT_RUNNING : "tailscale status --json printed nothing Toyon can read");
+    return {
+      state: "not-running",
+      name: null,
+      line: notRunning(json) ? NOT_RUNNING : "tailscale status --json printed nothing Toyon can read"
+    };
   }
+  const name = dnsName(st.Self?.DNSName) || null;
   switch (st.BackendState) {
     case "Running":
       break;
     case "NeedsLogin":
-      throw new TailscaleError("Tailscale is signed out; run `tailscale up`, then this again");
+      return { state: "signed-out", name, line: "Tailscale is signed out; run `tailscale up`, then this again" };
     case "NeedsMachineAuth":
-      throw new TailscaleError("this machine is waiting to be approved in the Tailscale admin console");
+      return {
+        state: "needs-approval",
+        name,
+        line: "this machine is waiting to be approved in the Tailscale admin console"
+      };
     case "Stopped":
-      throw new TailscaleError("Tailscale is disconnected; run `tailscale up`, then this again");
+      return { state: "signed-out", name, line: "Tailscale is disconnected; run `tailscale up`, then this again" };
     default:
-      throw new TailscaleError(`Tailscale is not connected yet (${st.BackendState ?? "no state"}); try again shortly`);
+      return {
+        state: "not-running",
+        name,
+        line: `Tailscale is not connected yet (${st.BackendState ?? "no state"}); try again shortly`
+      };
   }
-  const name = (st.Self?.DNSName ?? "").replace(/\.$/, "").toLowerCase();
   if (!name || st.CurrentTailnet?.MagicDNSEnabled === false) {
-    throw new TailscaleError("MagicDNS is off for this tailnet; turn it on under DNS in the Tailscale admin console");
+    return {
+      state: "magicdns-off",
+      name,
+      line: "MagicDNS is off for this tailnet; turn it on under DNS in the Tailscale admin console"
+    };
   }
   if (!(st.CertDomains ?? []).some((d) => d.toLowerCase() === name)) {
-    throw new TailscaleError("HTTPS certificates are off for this tailnet; turn them on under DNS in the Tailscale admin console");
+    return {
+      state: "https-off",
+      name,
+      line: "HTTPS certificates are off for this tailnet; turn them on under DNS in the Tailscale admin console"
+    };
   }
-  return name;
+  return { state: "ready", name, line: `this machine is ${name} on your tailnet` };
+}
+async function readiness(ts) {
+  let st;
+  try {
+    st = await ts(["status", "--json"]);
+  } catch (e) {
+    if (e instanceof TailscaleError)
+      return { state: "not-installed", name: null, line: e.message };
+    throw e;
+  }
+  if (!st.ok && notRunning(st.err + st.out))
+    return { state: "not-running", name: null, line: NOT_RUNNING };
+  return readinessOf(st.out || st.err);
 }
 function parseServeConfig(json) {
   const text = json.trim();
@@ -8107,10 +6414,10 @@ async function readConfig(ts) {
   return parseServeConfig(r.out);
 }
 async function serveTailnet(ts, daemonPort) {
-  const st = await ts(["status", "--json"]);
-  if (!st.ok && notRunning(st.err + st.out))
-    throw new TailscaleError(NOT_RUNNING);
-  const name = tailnetName(st.out || st.err);
+  const r = await readiness(ts);
+  if (r.state !== "ready" || r.name === null)
+    throw new TailscaleError(r.line);
+  const name = r.name;
   const config = await readConfig(ts);
   const want = entries(daemonPort).map((e) => ({ e, h: holder(config, name, e) }));
   const taken = want.flatMap(({ e, h }) => h.kind === "other" ? [`https ${e.port} (${h.what})`] : []);
@@ -8140,25 +6447,44 @@ async function unserveTailnet(ts, daemonPort) {
   }
   return removed;
 }
+async function turnTailnetOn(ts, daemonPort, file) {
+  const host = await serveTailnet(ts, daemonPort);
+  const view = { host, previews: portPreviews(host) };
+  writeFileSync4(file, `${JSON.stringify(view, null, 2)}
+`);
+  return view;
+}
+async function turnRemoteOff(ts, daemonPort, file, was) {
+  rmSync2(file, { force: true });
+  if (was && isTailnetName(was.host))
+    await unserveTailnet(ts, daemonPort);
+}
 
 // src/remote.ts
 function saved() {
-  if (!existsSync8(remoteFile))
+  if (!existsSync9(remoteFile))
     return null;
   return parseRemote(readFileSync7(remoteFile, "utf8"));
 }
-var same = (a, b) => (a?.host ?? null) === (b?.host ?? null) && (a?.previews ?? null) === (b?.previews ?? null);
 var ports = `${PREVIEW_PORTS.from}-${PREVIEW_PORTS.to}`;
-function describe2(r) {
-  const at = addressedByPort(r.previews) ? `${r.previews}, ports ${ports}` : r.previews;
-  return `remote access: https://${r.host}/, previews at ${at}`;
+var describe2 = (r) => `remote access: https://${r.host}/, ${previewsLine(r)}`;
+async function switchRemote(body) {
+  const res = await daemonFetch("/remote", { body });
+  if (!res)
+    return "Toyon is not answering";
+  if (!res.ok)
+    return await res.text() || `the daemon refused (${res.status})`;
+  return await res.json();
 }
-function save(r) {
-  mkdirSync5(home, { recursive: true });
-  writeFileSync4(remoteFile, `${JSON.stringify(r, null, 2)}
-`);
-  console.log(describe2(r));
+async function switched(body) {
+  const r = await switchRemote(body);
+  if (typeof r === "string") {
+    console.error(`toyon: ${r}`);
+    return false;
+  }
+  return r.remote;
 }
+var HOW_TO_OPEN = 'open it on your phone from the phone button in Toyon, or pick this machine under "add a machine"';
 async function remote(cmd) {
   const managed = await loadManaged();
   if (managed.policy.remote === "off")
@@ -8169,83 +6495,144 @@ async function remote(cmd) {
   }
   const h = await health();
   if (cmd.to === null && !cmd.tailscale) {
-    const r = saved();
-    console.log(r ? describe2(r) : "remote access is off; `toyon remote <name>` turns it on");
-    if (h && !same(h.remote, r))
-      console.log("the running daemon started before this; `toyon stop` then `toyon` applies it");
+    const r = h ? h.remote ?? null : saved();
+    console.log(r ? describe2(r) : "remote access is off; `toyon remote --tailscale` turns it on");
+    const ts = h?.tailscale ?? await readiness(tailscaleCli());
+    if (ts && !(r && ts.state === "ready"))
+      console.log(ts.line);
     return 0;
   }
-  let r = null;
   if (cmd.tailscale) {
-    let name;
-    try {
-      name = await serveTailnet(tailscaleCli(), port);
-    } catch (e) {
-      if (!(e instanceof TailscaleError))
-        throw e;
-      console.error(`toyon: ${e.message}`);
-      return 1;
+    if (h) {
+      const now = await switched({ tailscale: true });
+      if (now === false)
+        return 1;
+      if (now)
+        console.log(describe2(now));
+    } else {
+      let r;
+      try {
+        mkdirSync5(home, { recursive: true });
+        r = await turnTailnetOn(tailscaleCli(), port, remoteFile);
+      } catch (e) {
+        if (!(e instanceof TailscaleError))
+          throw e;
+        console.error(`toyon: ${e.message}`);
+        return 1;
+      }
+      console.log(`${describe2(r)}; Toyon reads it when it starts`);
     }
-    r = { host: name, previews: portPreviews(name) };
-    save(r);
-    console.log(`tailscale serve sends https://${name}/ to 127.0.0.1:${port}, and each of ports ${ports} to the`);
-    console.log("same port on 127.0.0.1; only devices on your tailnet reach them");
-  } else if (cmd.to === "off") {
-    const was = saved();
-    rmSync3(remoteFile, { force: true });
-    console.log("remote access is off");
-    try {
-      const removed = await unserveTailnet(tailscaleCli(), port);
-      if (removed > 0)
-        console.log(`removed Toyon's ${removed} tailscale serve entries`);
-    } catch (e) {
-      if (!(e instanceof TailscaleError))
-        throw e;
-      if (was && isTailnetName(was.host))
+    console.log(HOW_TO_OPEN);
+    return 0;
+  }
+  if (cmd.to === "off") {
+    if (h) {
+      if (await switched({ off: true }) === false)
+        return 1;
+    } else {
+      try {
+        await turnRemoteOff(tailscaleCli(), port, remoteFile, saved());
+      } catch (e) {
+        if (!(e instanceof TailscaleError))
+          throw e;
         console.error(`toyon: could not remove tailscale serve entries: ${e.message}`);
+      }
     }
-  } else if (cmd.to !== null) {
-    r = { host: cmd.to, previews: cmd.ports ? portPreviews(cmd.to) : hostPreviews(cmd.to) };
-    save(r);
-    if (addressedByPort(r.previews)) {
-      console.log(`point a TLS front for ${r.host} at 127.0.0.1:${port} on 443, and each of ports ${ports} at`);
-      console.log("the same port on 127.0.0.1");
-    } else {
-      console.log(`point a TLS front for ${r.host} and *.${r.host} at 127.0.0.1:${port}. With Caddy:
+    console.log("remote access is off");
+    return 0;
+  }
+  const to = cmd.to;
+  const view = acceptRemote({ host: to, previews: cmd.ports ? portPreviews(to) : hostPreviews(to) }, managed.policy);
+  if (typeof view === "string") {
+    console.error(`toyon: ${view}`);
+    return 1;
+  }
+  if (h) {
+    if (await switched(view) === false)
+      return 1;
+  } else {
+    mkdirSync5(home, { recursive: true });
+    writeFileSync5(remoteFile, `${JSON.stringify(view, null, 2)}
+`);
+  }
+  console.log(describe2(view));
+  if (addressedByPort(view.previews)) {
+    console.log(`point a TLS front for ${view.host} at 127.0.0.1:${port} on 443, and each of ports ${ports} at`);
+    console.log("the same port on 127.0.0.1");
+  } else {
+    console.log(`point a TLS front for ${view.host} and *.${view.host} at 127.0.0.1:${port}. With Caddy:
 `);
-      console.log(`  ${r.host}, *.${r.host} {
+    console.log(`  ${view.host}, *.${view.host} {
     reverse_proxy 127.0.0.1:${port}
   }
 `);
-      console.log("the wildcard certificate needs Caddy's DNS challenge, through your DNS provider's module");
+    console.log("the wildcard certificate needs Caddy's DNS challenge, through your DNS provider's module");
+  }
+  console.log("Toyon refuses the name over plain http; a device that opens it asks to be let in");
+  if (!h)
+    console.log("Toyon reads this when it starts");
+  return 0;
+}
+
+// src/pair.ts
+var POLL_MS = 2000;
+async function waiting() {
+  const r = await daemonFetch("/knocks");
+  return r?.ok ? await r.json() : [];
+}
+async function pair() {
+  const h = await health();
+  if (!h) {
+    console.error("toyon: Toyon is not running. Start it with `toyon`, then run `toyon pair`.");
+    return 1;
+  }
+  let remote = h.remote ?? null;
+  if (!remote) {
+    const r = await switchRemote({ tailscale: true });
+    if (typeof r === "string") {
+      console.error(`toyon: ${r}`);
+      return 1;
     }
-    console.log("Toyon refuses the name over plain http: the token in the link grants a shell on this machine");
+    remote = r.remote;
   }
-  if (r) {
-    const add = launcherAddLink(`https://${r.host}`);
-    console.log(`add it to your list at toyon.cloud: ${add}`);
-    openUrl(add);
+  if (!remote) {
+    console.error("toyon: remote access did not come on; `toyon remote` says what Tailscale is missing");
+    return 1;
   }
-  if (h && !same(h.remote, r)) {
-    console.log("the daemon reads this at start; `toyon stop` then `toyon` applies it");
-    if (r)
-      console.log("after that, `toyon pair` shows a code to scan with your phone");
-  } else if (h && r) {
-    const refused = await printPairCode();
-    if (refused)
-      console.error(`toyon: ${refused}`);
+  console.log(machineLink(remote.host));
+  console.log(HOW_TO_OPEN);
+  if (isTailnetName(remote.host)) {
+    const r = await daemonFetch("/phones");
+    const phones = r?.ok ? await r.json() : null;
+    console.log(tailnetLine(phones).text);
+  }
+  console.log("waiting for a device; ctrl-c to stop");
+  const asked = new Set;
+  for (;; ) {
+    for (const k of await waiting()) {
+      if (asked.has(k.id))
+        continue;
+      asked.add(k.id);
+      const from = k.from === null ? "a device that opened the address" : `a Toyon page at ${new URL(k.from).host}`;
+      const yes = await confirm(`${k.word} wants in (${from}). Let it in?`);
+      const r = await daemonFetch(`/knock/${k.id}/answer`, { body: { letIn: yes } });
+      if (!r?.ok)
+        console.log(`${k.word} stopped waiting`);
+      else
+        console.log(yes ? `${k.word} is in` : `${k.word} turned away`);
+    }
+    await Bun.sleep(POLL_MS);
   }
-  return 0;
 }
 
 // src/stop.ts
-import { rmSync as rmSync4 } from "fs";
+import { rmSync as rmSync3 } from "fs";
 var WAIT_MS = 1e4;
 async function stop() {
   const h = await health();
   let pid = h?.pid ?? readPid();
   if (pid !== null && !alive(pid)) {
-    rmSync4(pidFile, { force: true });
+    rmSync3(pidFile, { force: true });
     pid = null;
   }
   if (pid === null) {
@@ -8264,7 +6651,7 @@ async function stop() {
   if (alive(pid)) {
     process.kill(pid, "SIGKILL");
     console.error(`daemon (pid ${pid}) did not exit in ${WAIT_MS / 1000}s; killed. Dev servers it ran may still be up.`);
-    rmSync4(pidFile, { force: true });
+    rmSync3(pidFile, { force: true });
     return 1;
   }
   console.log(`stopped Toyon (pid ${pid})`);
@@ -8291,12 +6678,11 @@ async function restart() {
 }
 
 // src/uninstall.ts
-import { existsSync as existsSync9, readFileSync as readFileSync8, rmSync as rmSync5 } from "fs";
-import { homedir as homedir3 } from "os";
+import { existsSync as existsSync10, readFileSync as readFileSync8, rmSync as rmSync4 } from "fs";
 import { join as join6 } from "path";
 function readState() {
   const file = join6(home, DAEMON_FILES.state);
-  if (!existsSync9(file))
+  if (!existsSync10(file))
     return {};
   try {
     return JSON.parse(readFileSync8(file, "utf8"));
@@ -8313,18 +6699,11 @@ async function git(cwd, ...args) {
     return false;
   }
 }
-function confirm(question) {
-  process.stdout.write(`${question} [y/N] `);
-  return new Promise((resolve) => {
-    process.stdin.once("data", (chunk) => resolve(String(chunk).trim().toLowerCase().startsWith("y")));
-    process.stdin.once("end", () => resolve(false));
-  });
-}
 async function uninstall(opts) {
   const state = readState();
   const repos = state.repos ?? [];
   const worktrees = (state.worktrees ?? []).filter((w) => w.kind !== "main");
-  const app = join6(homedir3(), "Applications", "Toyon.app");
+  const helper = join6(home, DAEMON_FILES.helper);
   const branches = worktrees.map((w) => w.branch).filter((b) => !!b && b.startsWith("toyon/"));
   console.log("toyon uninstall removes:");
   console.log(`  ${home}  (state, transcripts, agent adapters, ${worktrees.length} worktree director${worktrees.length === 1 ? "y" : "ies"})`);
@@ -8332,8 +6711,8 @@ async function uninstall(opts) {
     const repo = repos.find((r) => r.id === w.repoId);
     console.log(`    ${w.path}  (worktree of ${repo?.path ?? "?"})`);
   }
-  if (existsSync9(app))
-    console.log(`  ${app}`);
+  if (existsSync10(helper))
+    console.log(`  ${helper}  (the hidden helper that starts Toyon from the Dock app)`);
   console.log("and stops the daemon if it is running.");
   console.log("it keeps: your repos, every branch Toyon made" + (branches.length ? ` (${branches.length} under toyon/)` : "") + ", and Toyon's settings in each repo (.toyon/ or toyon.json).");
   if (!opts.yes && !await confirm("continue?")) {
@@ -8344,18 +6723,21 @@ async function uninstall(opts) {
     await stop();
   for (const w of worktrees) {
     const repo = repos.find((r) => r.id === w.repoId);
-    if (repo && existsSync9(repo.path)) {
+    if (repo && existsSync10(repo.path)) {
       const ok = await git(repo.path, "worktree", "remove", "--force", w.path);
-      if (!ok && existsSync9(w.path))
-        rmSync5(w.path, { recursive: true, force: true });
+      if (!ok && existsSync10(w.path))
+        rmSync4(w.path, { recursive: true, force: true });
       await git(repo.path, "worktree", "prune");
-    } else if (existsSync9(w.path)) {
-      rmSync5(w.path, { recursive: true, force: true });
+    } else if (existsSync10(w.path)) {
+      rmSync4(w.path, { recursive: true, force: true });
     }
   }
-  rmSync5(home, { recursive: true, force: true });
-  if (existsSync9(app))
-    rmSync5(app, { recursive: true, force: true });
+  if (existsSync10(helper)) {
+    try {
+      await Bun.spawn([LSREGISTER, "-u", helper], { stdout: "ignore", stderr: "ignore" }).exited;
+    } catch {}
+  }
+  rmSync4(home, { recursive: true, force: true });
   console.log("removed. `npm uninstall -g toyon` removes the command itself.");
   return 0;
 }
@@ -8445,13 +6827,10 @@ async function restartOnto(version) {
 }
 
 // src/cli.ts
-function behind(daemonVersion) {
-  return daemonVersion === undefined || newer(package_default.version, daemonVersion);
-}
 async function open2(cmd) {
   const explicit = cmd.path !== null;
   const target = resolve(cmd.path ?? process.cwd());
-  const register = explicit || existsSync10(join7(target, ".git"));
+  const register = explicit || existsSync11(join7(target, ".git"));
   if (process.platform === "linux") {
     const missing = missingSandboxTools();
     const blocked = missing.length === 0 ? bwrapStartError() : null;
@@ -8460,28 +6839,12 @@ async function open2(cmd) {
     else if (blocked)
       console.log(bwrapBlockedAdvice(blocked, userNamespacesRestricted()));
   }
-  const running = await health();
-  if (!running) {
-    console.log("starting Toyon daemon\u2026");
-    if (!await startDaemon()) {
-      console.error(`daemon failed to start; \`toyon logs\` shows why (${logFile})`);
-      return 1;
-    }
-  } else if (behind(running.version)) {
-    console.log(`toyon: the running daemon is ${running.version ?? "older"}; \`${restartCmd}\` starts ${package_default.version}`);
-  }
-  const token = readToken();
-  if (!token) {
-    console.error("daemon token missing; `toyon doctor` says where it looked");
+  const daemon = await ensureDaemon();
+  if (!daemon)
     return 1;
-  }
-  const file = explicit && existsSync10(target) && statSync4(target).isFile();
+  const file = explicit && existsSync11(target) && statSync4(target).isFile();
   if (file) {
-    const res = await fetch(`${base}/open`, {
-      method: "POST",
-      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-      body: JSON.stringify({ path: target })
-    });
+    const res = await post("/open", daemon.token, { path: target });
     if (!res.ok) {
       console.error(`could not open ${target}: ${await res.text()}`);
       return 1;
@@ -8489,39 +6852,34 @@ async function open2(cmd) {
     const opened = await res.json();
     console.log(opened.kind === "file" ? `toyon: opening ${target} in its project` : `toyon: opening ${target}`);
   } else if (register) {
-    const res = await fetch(`${base}/register`, {
-      method: "POST",
-      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-      body: JSON.stringify({ path: target })
-    });
+    const res = await post("/register", daemon.token, { path: target });
     if (!res.ok) {
       console.error(`could not open ${target}: ${await res.text()}`);
-      if (explicit || !cmd.app && !cmd.installApp)
+      if (explicit || !cmd.app)
         return 1;
     }
   }
-  const branded = (await health())?.branded === true;
-  const url = shellUrl(token, branded);
-  const appUrl = `http://toyon.localhost:${port}/#token=${token}`;
-  if (cmd.installApp) {
-    installApp(appUrl);
-  } else if (cmd.app) {
-    console.log(`toyon: app window (${appUrl.split("#")[0]})`);
-    if (!openAppWindow(appUrl)) {
-      console.log("no Chromium browser found; opening in default browser");
-      openUrl(url);
-    }
-  } else {
-    console.log(`toyon: ${url}`);
-    openUrl(url);
+  if (cmd.app)
+    showAppWindow(daemon);
+  else {
+    console.log(`toyon: ${daemon.url}`);
+    openUrl(daemon.url);
   }
-  const remote = (await health())?.remote;
-  if (remote)
-    console.log(`toyon: remote at https://${remote.host}/#token=${token}`);
+  return 0;
+}
+async function start() {
+  const daemon = await ensureDaemon();
+  if (!daemon)
+    return 1;
+  console.log(`toyon: ${daemon.url}`);
   return 0;
 }
 async function run(cmd) {
   switch (cmd.kind) {
+    case "start":
+      return start();
+    case "helper":
+      return helper(cmd.args);
     case "help":
       process.stdout.write(HELP);
       return 0;