toyon 0.20.0 → 0.22.0

package/dist/cli.js

@@ -2,70 +2,8 @@
 // @bun
 
 // src/cli.ts
-import { existsSync as existsSync12, statSync as statSync5 } from "fs";
-import { join as join7, resolve } from "path";
-// package.json
-var package_default = {
-  name: "toyon",
-  version: "0.20.0",
-  description: "Toyon is where coding agents work on your web app while you check each change by using it. Every chat gets its own running copy with a live preview.",
-  license: "MIT",
-  type: "module",
-  homepage: "https://toyon.dev",
-  repository: {
-    type: "git",
-    url: "git+https://github.com/toyon-dev/toyon.git"
-  },
-  bugs: "https://github.com/toyon-dev/toyon/issues",
-  keywords: [
-    "ai",
-    "agents",
-    "claude-code",
-    "codex",
-    "opencode",
-    "git",
-    "worktree",
-    "preview",
-    "dev-server"
-  ],
-  bin: {
-    toyon: "bin/toyon.js"
-  },
-  files: [
-    "bin",
-    "dist",
-    "cloud"
-  ],
-  engines: {
-    node: ">=18"
-  },
-  os: [
-    "darwin",
-    "linux"
-  ],
-  scripts: {
-    prepublishOnly: "bun ../../scripts/pack.ts"
-  },
-  dependencies: {
-    bun: "1.4.4",
-    "bun-pty": "0.4.10"
-  },
-  devDependencies: {
-    "@toyon/shared": "workspace:*"
-  }
-};
-
-// src/app.ts
-import { spawn as spawn3, spawnSync } from "child_process";
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
-
-// src/daemon.ts
-import { spawn } from "child_process";
-import { existsSync as existsSync3, mkdirSync, readFileSync } from "fs";
-import { homedir } from "os";
-import { join as join2 } from "path";
+import { existsSync as existsSync13, statSync as statSync5 } from "fs";
+import { join as join8, resolve } from "path";
 
 // ../shared/src/knock.ts
 var KNOCK_TTL_MS = 5 * 60000;
@@ -104,6 +42,8 @@ function acceptRemote(view, policy) {
   return why ?? { host, previews: view.previews };
 }
 var PREVIEW_PORTS = { from: 10001, to: 10008 };
+var FRAME_PORT = 1e4;
+var FRAME_LABEL = "frames";
 var DNS_NAME = /^(?=.{1,253}$)[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/;
 function isRemoteHost(name) {
   return DNS_NAME.test(name) && !/\.\d+$/.test(name) && name !== "localhost" && !name.endsWith(".localhost");
@@ -129,6 +69,9 @@ function checkPreviews(previews, host) {
   if (hostname !== host && !hostname.endsWith(`.${host}`)) {
     return `previews at ${hostname} are not ${host} or under it, so the preview cookie cannot reach them`;
   }
+  if (previews.includes("{id}") && new URL(previewOrigin(previews, FRAME_LABEL, 1)).hostname === `${FRAME_LABEL}.${host}`) {
+    return `${previews} would put a preview at ${FRAME_LABEL}.${host}, which is where rendered pages live`;
+  }
   return null;
 }
 function previewOrigin(previews, worktreeId, port) {
@@ -5171,6 +5114,100 @@ function describeManaged(p) {
 // ../shared/src/ports.ts
 var DAEMON_DEFAULT_PORT = 4141;
 
+// ../shared/src/project.ts
+function hasControlChar(s) {
+  for (const ch of s) {
+    const code = ch.codePointAt(0) ?? 0;
+    if (code < 32 || code === 127)
+      return true;
+  }
+  return false;
+}
+function projectNameError(raw) {
+  const name = raw.trim();
+  if (!name)
+    return "a project name is required";
+  if (name.length > 100)
+    return "that name is too long: keep it under 100 characters";
+  if (name.includes("/") || name.includes("\\"))
+    return "a project name cannot contain a slash";
+  if (/\s/.test(name))
+    return "a project name cannot contain spaces";
+  if (hasControlChar(name))
+    return "a project name cannot contain control characters";
+  if (name === "." || name === "..")
+    return `"${name}" is not a project name`;
+  if (name.startsWith("-") || name.startsWith("."))
+    return "a project name cannot start with a dot or a dash";
+  return null;
+}
+var URL_FORM = /^(?:https?|ssh|git|file):\/\/\S+$/i;
+var SCP_FORM = /^[\w.-]+@[\w.-]+:\S+$/;
+var BARE_HOST_FORM = /^[\w-]+(?:\.[\w-]+)+\/\S+$/;
+function gitUrl(raw) {
+  const typed = raw.trim();
+  const url = BARE_HOST_FORM.test(typed) ? `https://${typed}` : typed;
+  if (!URL_FORM.test(url) && !SCP_FORM.test(url))
+    return null;
+  const page = fromForgePage(url);
+  const name = repoNameFrom(page?.url ?? url);
+  if (!name || projectNameError(name))
+    return null;
+  return page ? { url: page.url, name, ...page.branch ? { branch: page.branch } : {} } : { url, name };
+}
+var FORGES = {
+  "github.com": (segs) => {
+    if (segs.length < 2)
+      return null;
+    const [kind, ...rest] = segs.slice(2);
+    const branch = kind === "tree" ? rest.join("/") : kind === "blob" || kind === "commits" ? rest[0] : undefined;
+    return { repo: segs.slice(0, 2), branch };
+  },
+  "gitlab.com": (segs) => {
+    const cut = segs.indexOf("-");
+    if (cut < 2)
+      return segs.length >= 2 && cut < 0 ? { repo: segs } : null;
+    const [kind, ...rest] = segs.slice(cut + 1);
+    const branch = kind === "tree" ? rest.join("/") : kind === "blob" || kind === "commits" ? rest[0] : undefined;
+    return { repo: segs.slice(0, cut), branch };
+  },
+  "codeberg.org": (segs) => {
+    if (segs.length < 2)
+      return null;
+    const [kind, what, ...rest] = segs.slice(2);
+    const branch = kind === "src" && what === "branch" ? rest[0] : undefined;
+    return { repo: segs.slice(0, 2), branch };
+  }
+};
+function fromForgePage(url) {
+  if (!/^https?:\/\//i.test(url))
+    return null;
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return null;
+  }
+  const read = FORGES[u.hostname.toLowerCase()]?.(u.pathname.split("/").filter(Boolean));
+  if (!read)
+    return null;
+  const branch = read.branch ? decodeSegment(read.branch).replace(/\/+$/, "") : "";
+  return { url: `${u.protocol}//${u.host}/${read.repo.join("/")}`, ...branch ? { branch } : {} };
+}
+function decodeSegment(s) {
+  try {
+    return decodeURIComponent(s);
+  } catch {
+    return s;
+  }
+}
+function repoNameFrom(url) {
+  const bare = url.split(/[?#]/)[0]?.replace(/\/+$/, "") ?? "";
+  const afterHost = SCP_FORM.test(bare) ? bare.split(":")[1] ?? "" : bare;
+  const last = afterHost.split("/").pop() ?? "";
+  return last.replace(/\.git$/i, "");
+}
+
 // ../shared/src/sandbox.ts
 var BWRAP_APPARMOR_PROFILE = `abi <abi/4.0>,
 include <tunables/global>
@@ -5250,6 +5287,68 @@ function parseVersion(v) {
     return null;
   return { nums: [Number(m[1]), Number(m[2]), Number(m[3])], pre: m[4] ?? null };
 }
+// package.json
+var package_default = {
+  name: "toyon",
+  version: "0.22.0",
+  description: "Toyon is where coding agents work on your web app while you check each change by using it. Every chat gets its own running copy with a live preview.",
+  license: "MIT",
+  type: "module",
+  homepage: "https://toyon.dev",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/toyon-dev/toyon.git"
+  },
+  bugs: "https://github.com/toyon-dev/toyon/issues",
+  keywords: [
+    "ai",
+    "agents",
+    "claude-code",
+    "codex",
+    "opencode",
+    "git",
+    "worktree",
+    "preview",
+    "dev-server"
+  ],
+  bin: {
+    toyon: "bin/toyon.js"
+  },
+  files: [
+    "bin",
+    "dist",
+    "cloud"
+  ],
+  engines: {
+    node: ">=18"
+  },
+  os: [
+    "darwin",
+    "linux"
+  ],
+  scripts: {
+    prepublishOnly: "bun ../../scripts/pack.ts"
+  },
+  dependencies: {
+    bun: "1.4.4",
+    "bun-pty": "0.4.10"
+  },
+  devDependencies: {
+    "@toyon/shared": "workspace:*"
+  }
+};
+
+// src/app.ts
+import { spawn as spawn3, spawnSync } from "child_process";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join4 } from "path";
+
+// src/daemon.ts
+import { spawn } from "child_process";
+import { existsSync as existsSync4, mkdirSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { join as join3 } from "path";
 
 // ../shared/src/logfile.ts
 import { chmodSync, existsSync, openSync, renameSync, statSync } from "fs";
@@ -5264,14 +5363,15 @@ function openLog(path, maxBytes = LOG_ROTATE_BYTES) {
 }
 
 // src/layout.ts
-import { existsSync as existsSync2, realpathSync } from "fs";
-import { delimiter, dirname, join } from "path";
+import { existsSync as existsSync3 } from "fs";
+import { dirname, join as join2 } from "path";
 import { fileURLToPath } from "url";
-var here = dirname(fileURLToPath(import.meta.url));
-var packaged = existsSync2(join(here, "daemon.js"));
-var method = installMethod(packaged ? join(here, "..", "package.json") : null);
-function installOnPath() {
-  for (const dir of (process.env.PATH ?? "").split(delimiter)) {
+
+// ../shared/src/install-path.ts
+import { existsSync as existsSync2, realpathSync } from "fs";
+import { delimiter, join } from "path";
+function installOnPath(path = process.env.PATH ?? "") {
+  for (const dir of path.split(delimiter)) {
     if (dir === "" || dir.includes("/_npx/"))
       continue;
     const bin = join(dir, "toyon");
@@ -5283,17 +5383,22 @@ function installOnPath() {
   }
   return "none";
 }
+
+// src/layout.ts
+var here = dirname(fileURLToPath(import.meta.url));
+var packaged = existsSync3(join2(here, "daemon.js"));
+var method = installMethod(packaged ? join2(here, "..", "package.json") : null);
 var restartCmd = restartCommand(method, package_default.version, method === "npx" ? installOnPath() : "none", process.env.npm_config_registry ?? null);
-var daemonEntry = packaged ? join(here, "daemon.js") : join(here, "../../daemon/src/index.ts");
+var daemonEntry = packaged ? join2(here, "daemon.js") : join2(here, "../../daemon/src/index.ts");
 
 // src/daemon.ts
 var port = Number(process.env.TOYON_PORT ?? DAEMON_DEFAULT_PORT);
 var base = `http://127.0.0.1:${port}`;
-var home = process.env.TOYON_HOME ?? join2(homedir(), ".toyon");
-var tokenFile = join2(home, DAEMON_FILES.token);
-var pidFile = join2(home, DAEMON_FILES.pid);
-var logFile = join2(home, DAEMON_FILES.log);
-var remoteFile = join2(home, DAEMON_FILES.remote);
+var home = process.env.TOYON_HOME ?? join3(homedir(), ".toyon");
+var tokenFile = join3(home, DAEMON_FILES.token);
+var pidFile = join3(home, DAEMON_FILES.pid);
+var logFile = join3(home, DAEMON_FILES.log);
+var remoteFile = join3(home, DAEMON_FILES.remote);
 async function health() {
   try {
     const r = await fetch(`${base}/health`, { signal: AbortSignal.timeout(1000) });
@@ -5322,13 +5427,13 @@ async function daemonFetch(path, init = {}) {
   }
 }
 function readToken() {
-  if (!existsSync3(tokenFile))
+  if (!existsSync4(tokenFile))
     return null;
   const t = readFileSync(tokenFile, "utf8").trim();
   return t === "" ? null : t;
 }
 function readPid() {
-  if (!existsSync3(pidFile))
+  if (!existsSync4(pidFile))
     return null;
   const n = Number(readFileSync(pidFile, "utf8").trim());
   return Number.isInteger(n) && n > 0 ? n : null;
@@ -5411,19 +5516,19 @@ var CHROMIUMS = [
   { name: "Microsoft Edge", dataDir: "Microsoft Edge", bundleId: "com.microsoft.edgemac" },
   { name: "Chromium", dataDir: "Chromium", bundleId: "org.chromium.chromium" }
 ];
-var pwaCacheDir = join3(home, "pwa");
+var pwaCacheDir = join4(home, "pwa");
 function profilesOf(browser) {
-  const root = join3(homedir2(), "Library", "Application Support", browser.dataDir);
-  if (!existsSync4(root))
+  const root = join4(homedir2(), "Library", "Application Support", browser.dataDir);
+  if (!existsSync5(root))
     return [];
-  return readdirSync(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => join3(root, d.name));
+  return readdirSync(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => join4(root, d.name));
 }
 function pwaStillInstalled(browser, id) {
-  return profilesOf(browser).some((p) => existsSync4(join3(p, "Web Applications", "Manifest Resources", id)));
+  return profilesOf(browser).some((p) => existsSync5(join4(p, "Web Applications", "Manifest Resources", id)));
 }
 function findPwaId(browser) {
-  const cache = join3(pwaCacheDir, `${browser.name.replace(/\W+/g, "-")}.id`);
-  if (existsSync4(cache)) {
+  const cache = join4(pwaCacheDir, `${browser.name.replace(/\W+/g, "-")}.id`);
+  if (existsSync5(cache)) {
     const id = readFileSync2(cache, "utf8").trim();
     if (/^[a-p]{32}$/.test(id) && pwaStillInstalled(browser, id))
       return id;
@@ -5431,13 +5536,13 @@ function findPwaId(browser) {
   const ids = shellOrigins.map((o) => `${o}/`.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&")).join("|");
   const re = new RegExp(`web_apps-dt-([a-p]{32})[\\s\\S]{0,16}?(?:${ids})`);
   for (const p of profilesOf(browser)) {
-    const dir = join3(p, "Sync Data", "LevelDB");
-    if (!existsSync4(dir))
+    const dir = join4(p, "Sync Data", "LevelDB");
+    if (!existsSync5(dir))
       continue;
     for (const f of readdirSync(dir)) {
       if (!/\.(log|ldb)$/.test(f))
         continue;
-      const m = re.exec(readFileSync2(join3(dir, f), "latin1"));
+      const m = re.exec(readFileSync2(join4(dir, f), "latin1"));
       if (m && pwaStillInstalled(browser, m[1])) {
         mkdirSync2(pwaCacheDir, { recursive: true });
         writeFileSync(cache, m[1]);
@@ -5469,16 +5574,16 @@ function focusShell() {
   child.unref();
 }
 function installedAppBundle() {
-  const apps = join3(homedir2(), "Applications");
-  const shelves = existsSync4(apps) ? readdirSync(apps, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name.endsWith(".localized")).map((d) => join3(apps, d.name)) : [];
+  const apps = join4(homedir2(), "Applications");
+  const shelves = existsSync5(apps) ? readdirSync(apps, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name.endsWith(".localized")).map((d) => join4(apps, d.name)) : [];
   for (const app of CHROMIUMS) {
     const id = findPwaId(app);
     if (!id)
       continue;
-    const kept = profilesOf(app).map((p) => join3(p, "Web Applications", `_crx_${id}`));
+    const kept = profilesOf(app).map((p) => join4(p, "Web Applications", `_crx_${id}`));
     const hit = [...shelves, ...kept].flatMap(bundlesIn).find((b) => {
       try {
-        return readFileSync2(join3(b, "Contents", "Info.plist"), "latin1").includes(id);
+        return readFileSync2(join4(b, "Contents", "Info.plist"), "latin1").includes(id);
       } catch {
         return false;
       }
@@ -5489,9 +5594,9 @@ function installedAppBundle() {
   return null;
 }
 function bundlesIn(dir) {
-  if (!existsSync4(dir))
+  if (!existsSync5(dir))
     return [];
-  return readdirSync(dir).filter((n) => n.endsWith(".app")).map((n) => join3(dir, n));
+  return readdirSync(dir).filter((n) => n.endsWith(".app")).map((n) => join4(dir, n));
 }
 function launchInstalledApp() {
   let seen = null;
@@ -5508,7 +5613,7 @@ function launchInstalledApp() {
   return seen ? { kind: "uninstalled", browser: seen } : { kind: "none" };
 }
 function readLinkHandlers() {
-  const plist = join3(homedir2(), "Library", "Preferences", "com.apple.LaunchServices", "com.apple.launchservices.secure.plist");
+  const plist = join4(homedir2(), "Library", "Preferences", "com.apple.LaunchServices", "com.apple.launchservices.secure.plist");
   const out = spawnSync("plutil", ["-convert", "json", "-o", "-", plist], { encoding: "utf8" });
   if (out.status !== 0)
     return null;
@@ -5679,6 +5784,9 @@ usage
   toyon [path]            start the daemon if it is not running, register the repo at path
                           (or open the file at path: in its project, or on its own)
                           (default: the current directory) and open the shell
+  toyon <git url>         open the shell with that repository ready to clone into the current
+                          directory; a page on GitHub, GitLab or Codeberg is read back to its
+                          repository, and to its branch
   toyon start             start the daemon if it is not running, and open nothing
   toyon stop              stop the daemon and every dev server and agent it runs
   toyon restart           stop the daemon and start it again from what is installed now; every
@@ -5723,9 +5831,9 @@ policy
 // src/deploy/fly.ts
 import { randomBytes } from "crypto";
 import { Resolver } from "dns/promises";
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, mkdtempSync, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, mkdtempSync, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync3 } from "fs";
 import { tmpdir } from "os";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 
 // ../shared/src/managed-load.ts
 import { readFileSync as readFileSync3, statSync as statSync2 } from "fs";
@@ -5783,12 +5891,12 @@ function refusedByPolicy(verb, m) {
 }
 
 // src/deploy/context.ts
-import { cpSync, existsSync as existsSync5, mkdirSync as mkdirSync3, writeFileSync as writeFileSync2 } from "fs";
-import { join as join4 } from "path";
+import { cpSync, existsSync as existsSync6, mkdirSync as mkdirSync3, writeFileSync as writeFileSync2 } from "fs";
+import { join as join5 } from "path";
 var bunVersion = package_default.dependencies.bun;
 function machineSources() {
-  const dist = packaged ? here : join4(here, "..", "dist");
-  return existsSync5(join4(dist, "daemon.js")) ? { dist, cloud: join4(dist, "..", "cloud") } : null;
+  const dist = packaged ? here : join5(here, "..", "dist");
+  return existsSync6(join5(dist, "daemon.js")) ? { dist, cloud: join5(dist, "..", "cloud") } : null;
 }
 function machinePackageJson() {
   const manifest = {
@@ -5802,18 +5910,18 @@ function machinePackageJson() {
 }
 function writeMachineContext(src, out) {
   mkdirSync3(out, { recursive: true });
-  cpSync(src.dist, join4(out, "dist"), { recursive: true });
-  cpSync(join4(src.cloud, "Dockerfile"), join4(out, "Dockerfile"));
-  cpSync(join4(src.cloud, "entrypoint.sh"), join4(out, "entrypoint.sh"));
-  writeFileSync2(join4(out, "package.json"), machinePackageJson());
+  cpSync(src.dist, join5(out, "dist"), { recursive: true });
+  cpSync(join5(src.cloud, "Dockerfile"), join5(out, "Dockerfile"));
+  cpSync(join5(src.cloud, "entrypoint.sh"), join5(out, "entrypoint.sh"));
+  writeFileSync2(join5(out, "package.json"), machinePackageJson());
 }
 
 // src/deploy/fly.ts
 var DAEMON_PORT = 4141;
 var VOLUME = "toyon_data";
 var VOLUME_GB = 5;
-var cloudDir = join5(home, "cloud");
-var tokenFile2 = (app) => join5(cloudDir, `${app}.token`);
+var cloudDir = join6(home, "cloud");
+var tokenFile2 = (app) => join6(cloudDir, `${app}.token`);
 
 class DeployError extends Error {
 }
@@ -5857,7 +5965,10 @@ function flyToml(app, region) {
     '    method = "get"',
     '    path = "/health"'
   ];
-  for (let p = PREVIEW_PORTS.from;p <= PREVIEW_PORTS.to; p++) {
+  const ports = [FRAME_PORT];
+  for (let p = PREVIEW_PORTS.from;p <= PREVIEW_PORTS.to; p++)
+    ports.push(p);
+  for (const p of ports) {
     lines.push("", "[[services]]", `  internal_port = ${p}`, '  protocol = "tcp"', '  auto_stop_machines = "stop"', "  auto_start_machines = true", "  min_machines_running = 0", "  [[services.ports]]", `    port = ${p}`, '    handlers = ["tls", "http"]');
   }
   return `${lines.join(`
@@ -5892,8 +6003,8 @@ function secret(env, file) {
   const fromEnv = process.env[env]?.trim();
   if (fromEnv)
     return fromEnv;
-  const path = join5(cloudDir, file);
-  return existsSync6(path) ? readFileSync4(path, "utf8").trim() || null : null;
+  const path = join6(cloudDir, file);
+  return existsSync7(path) ? readFileSync4(path, "utf8").trim() || null : null;
 }
 async function capture(bin, args, input) {
   const p = Bun.spawn([bin, ...args], {
@@ -5958,7 +6069,7 @@ async function up(cmd, bin) {
     throw new DeployError("could not tell which Fly region is closest; pass --region (`fly platform regions` lists them)");
   console.log(cmd.region ? `region ${region}` : `region ${region}, the closest to you; --region picks another`);
   mkdirSync4(cloudDir, { recursive: true, mode: 448 });
-  if (!existsSync6(tokenFile2(cmd.name)))
+  if (!existsSync7(tokenFile2(cmd.name)))
     writeFileSync3(tokenFile2(cmd.name), randomBytes(32).toString("hex"), { mode: 384 });
   const token = readFileSync4(tokenFile2(cmd.name), "utf8").trim();
   const app = ["-a", cmd.name];
@@ -5994,12 +6105,12 @@ async function up(cmd, bin) {
     must(await capture(bin, ["ips", "allocate-v4", "--shared", ...app]), "could not add an IPv4 address");
   if (!/"Type":\s*"v6"/.test(ips))
     must(await capture(bin, ["ips", "allocate-v6", ...app]), "could not add an IPv6 address");
-  const ctx = mkdtempSync(join5(tmpdir(), "toyon-machine-"));
+  const ctx = mkdtempSync(join6(tmpdir(), "toyon-machine-"));
   try {
     writeMachineContext(src, ctx);
-    writeFileSync3(join5(ctx, "fly.toml"), flyToml(cmd.name, region));
+    writeFileSync3(join6(ctx, "fly.toml"), flyToml(cmd.name, region));
     console.log("building the machine in your Fly builder and deploying it");
-    const deployArgs = ["deploy", ctx, "--config", join5(ctx, "fly.toml"), "--remote-only", "--ha=false", "--yes"];
+    const deployArgs = ["deploy", ctx, "--config", join6(ctx, "fly.toml"), "--remote-only", "--ha=false", "--yes"];
     if (!await show(bin, [...deployArgs, "--build-arg", `BUN_VERSION=${bunVersion}`])) {
       throw new DeployError("the deploy failed; flyctl's output above says why");
     }
@@ -6066,7 +6177,7 @@ async function deploy(cmd) {
       await up(cmd, bin);
     else if (cmd.action === "destroy")
       return await destroy(cmd, bin);
-    else if (existsSync6(tokenFile2(cmd.name))) {
+    else if (existsSync7(tokenFile2(cmd.name))) {
       await printLinks(cmd.name, readFileSync4(tokenFile2(cmd.name), "utf8").trim());
     } else {
       throw new DeployError(`${cmd.name} was not deployed from this machine; its token is not in ${cloudDir}`);
@@ -6081,7 +6192,7 @@ async function deploy(cmd) {
 }
 
 // src/doctor.ts
-import { existsSync as existsSync7, statSync as statSync3 } from "fs";
+import { existsSync as existsSync8, statSync as statSync3 } from "fs";
 
 // src/sandboxDeps.ts
 import { readFileSync as readFileSync5 } from "fs";
@@ -6131,6 +6242,34 @@ async function toolVersion(cmd, args) {
     return null;
   }
 }
+var GH_AUTH_TIMEOUT_MS = 8000;
+async function ghStatus() {
+  const version = await toolVersion("gh", ["--version"]);
+  if (!version)
+    return { kind: "missing" };
+  try {
+    const p = Bun.spawn(["gh", "auth", "status"], {
+      stdout: "ignore",
+      stderr: "ignore",
+      env: { ...process.env, GH_PROMPT_DISABLED: "1", GH_NO_UPDATE_NOTIFIER: "1" },
+      timeout: GH_AUTH_TIMEOUT_MS
+    });
+    await p.exited;
+    return p.exitCode === 0 ? { kind: "ready", version } : { kind: "signedOut", version };
+  } catch {
+    return { kind: "signedOut", version };
+  }
+}
+function githubLine(status, platform = process.platform) {
+  const install = platform === "darwin" ? "brew install gh" : "sudo apt install gh";
+  if (status.kind === "missing") {
+    return line(true, "github", `gh is not installed, so the pull request land route pushes and leaves the pull request to you; \`${install}\`, then \`gh auth login\``);
+  }
+  if (status.kind === "signedOut") {
+    return line(true, "github", `${status.version}, but not signed in or GitHub was out of reach, so the pull request land route pushes and leaves the pull request to you; \`gh auth login\``);
+  }
+  return line(true, "github", `${status.version}, signed in; the pull request land route can open and merge pull requests`);
+}
 function handshake(token) {
   return new Promise((resolve) => {
     const ws = new WebSocket(`ws://127.0.0.1:${port}/ws?token=${token}`);
@@ -6172,7 +6311,7 @@ function agentLines(agents) {
       continue;
     const state = a.installed === null ? `${a.id} ${a.pinned} is not installed` : `${a.id} runs ${a.installed}, not the pinned ${a.pinned}`;
     if (a.error)
-      lines.push(line(false, "agents", `${state}: ${a.error}. The agent's install button in Settings or \`${restartCmd}\` tries again`));
+      lines.push(line(false, "agents", a.held ? `${state}: ${a.error}. The agent's install anyway button in Settings runs it past the rule` : `${state}: ${a.error}. The agent's install button in Settings or \`${restartCmd}\` tries again`));
     else
       lines.push(line(true, "agents", `${state}; it may still be installing`));
   }
@@ -6185,6 +6324,7 @@ async function doctor() {
   const managed = await loadManaged();
   const git = await toolVersion("git", ["--version"]);
   lines.push(git ? line(true, "git", git) : line(false, "git", "not found on PATH; Toyon needs git 2.x"));
+  lines.push(githubLine(await ghStatus()));
   if (process.platform === "linux") {
     const missing = missingSandboxTools();
     const blocked = missing.length === 0 ? bwrapStartError() : null;
@@ -6243,10 +6383,10 @@ async function doctor() {
       lines.push(line(false, "shell", `could not fetch: ${e.message}`));
     }
   }
-  if (existsSync7(logFile)) {
+  if (existsSync8(logFile)) {
     const kb = (p) => Math.round(statSync3(p).size / 1024);
     const before = previousLog(logFile);
-    const kept = existsSync7(before) ? `, and ${kb(before)} KB kept from before` : "";
+    const kept = existsSync8(before) ? `, and ${kb(before)} KB kept from before` : "";
     lines.push(line(true, "log", `${logFile} (${kb(logFile)} KB${kept})`));
   }
   const width = Math.max(...lines.map((l) => l.label.length));
@@ -6298,9 +6438,9 @@ async function helper(args) {
 }
 
 // src/logs.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
 async function logs(opts) {
-  if (!existsSync8(logFile)) {
+  if (!existsSync9(logFile)) {
     console.log(`no log yet at ${logFile}; it appears once \`toyon\` has started the daemon`);
     return opts.follow ? 0 : 1;
   }
@@ -6319,7 +6459,7 @@ async function logs(opts) {
   let offset = statSync4(logFile).size;
   for (;; ) {
     await Bun.sleep(300);
-    if (!existsSync8(logFile))
+    if (!existsSync9(logFile))
       continue;
     const size = statSync4(logFile).size;
     if (size < offset)
@@ -6342,17 +6482,17 @@ function confirm(question) {
 }
 
 // src/remote.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
 
 // ../shared/src/tailscale.ts
-import { existsSync as existsSync9, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync10, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
 var dnsName = (raw) => (raw ?? "").replace(/\.$/, "").toLowerCase();
 
 class TailscaleError extends Error {
 }
 var MAC_APP_CLI = "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
 function findTailscale() {
-  return Bun.which("tailscale") ?? (existsSync9(MAC_APP_CLI) ? MAC_APP_CLI : null);
+  return Bun.which("tailscale") ?? (existsSync10(MAC_APP_CLI) ? MAC_APP_CLI : null);
 }
 var NOT_INSTALLED = "Tailscale is not installed here (no tailscale on PATH); https://tailscale.com/download";
 function tailscaleCli(bin = findTailscale()) {
@@ -6366,10 +6506,11 @@ function tailscaleCli(bin = findTailscale()) {
 }
 function entries(daemonPort) {
   const list = [{ port: 443, target: `http://127.0.0.1:${daemonPort}` }];
-  for (let p = PREVIEW_PORTS.from;p <= PREVIEW_PORTS.to; p++)
+  for (const p of [FRAME_PORT, ...previewPorts()])
     list.push({ port: p, target: `http://127.0.0.1:${p}` });
   return list;
 }
+var previewPorts = () => Array.from({ length: PREVIEW_PORTS.to - PREVIEW_PORTS.from + 1 }, (_, i) => PREVIEW_PORTS.from + i);
 var serveOn = (e) => ["serve", "--bg", `--https=${e.port}`, e.target];
 var serveOff = (e) => ["serve", `--https=${e.port}`, "off"];
 var lastLine = (r) => (r.err.trim() || r.out.trim()).split(`
@@ -6518,11 +6659,11 @@ async function turnRemoteOff(ts, daemonPort, file, was) {
 
 // src/remote.ts
 function saved() {
-  if (!existsSync10(remoteFile))
+  if (!existsSync11(remoteFile))
     return null;
   return parseRemote(readFileSync7(remoteFile, "utf8"));
 }
-var ports = `${PREVIEW_PORTS.from}-${PREVIEW_PORTS.to}`;
+var ports = `${FRAME_PORT} and ${PREVIEW_PORTS.from}-${PREVIEW_PORTS.to}`;
 var describe2 = (r) => `remote access: https://${r.host}/, ${previewsLine(r)}`;
 async function switchRemote(body) {
   const res = await daemonFetch("/remote", { body });
@@ -6747,11 +6888,11 @@ async function restart() {
 }
 
 // src/uninstall.ts
-import { existsSync as existsSync11, readFileSync as readFileSync8, rmSync as rmSync4 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync8, rmSync as rmSync4 } from "fs";
+import { join as join7 } from "path";
 function readState() {
-  const file = join6(home, DAEMON_FILES.state);
-  if (!existsSync11(file))
+  const file = join7(home, DAEMON_FILES.state);
+  if (!existsSync12(file))
     return {};
   try {
     return JSON.parse(readFileSync8(file, "utf8"));
@@ -6772,7 +6913,7 @@ async function uninstall(opts) {
   const state = readState();
   const repos = state.repos ?? [];
   const worktrees = (state.worktrees ?? []).filter((w) => w.kind !== "main");
-  const helper = join6(home, DAEMON_FILES.helper);
+  const helper = join7(home, DAEMON_FILES.helper);
   const branches = worktrees.map((w) => w.branch).filter((b) => !!b && b.startsWith("toyon/"));
   console.log("toyon uninstall removes:");
   console.log(`  ${home}  (state, transcripts, agent adapters, ${worktrees.length} worktree director${worktrees.length === 1 ? "y" : "ies"})`);
@@ -6780,7 +6921,7 @@ async function uninstall(opts) {
     const repo = repos.find((r) => r.id === w.repoId);
     console.log(`    ${w.path}  (worktree of ${repo?.path ?? "?"})`);
   }
-  if (existsSync11(helper))
+  if (existsSync12(helper))
     console.log(`  ${helper}  (the hidden helper that starts Toyon from the Dock app)`);
   console.log("and stops the daemon if it is running.");
   console.log("it keeps: your repos, every branch Toyon made" + (branches.length ? ` (${branches.length} under toyon/)` : "") + ", and Toyon's settings in each repo (.toyon/ or toyon.json).");
@@ -6792,16 +6933,16 @@ async function uninstall(opts) {
     await stop();
   for (const w of worktrees) {
     const repo = repos.find((r) => r.id === w.repoId);
-    if (repo && existsSync11(repo.path)) {
+    if (repo && existsSync12(repo.path)) {
       const ok = await git(repo.path, "worktree", "remove", "--force", w.path);
-      if (!ok && existsSync11(w.path))
+      if (!ok && existsSync12(w.path))
         rmSync4(w.path, { recursive: true, force: true });
       await git(repo.path, "worktree", "prune");
-    } else if (existsSync11(w.path)) {
+    } else if (existsSync12(w.path)) {
       rmSync4(w.path, { recursive: true, force: true });
     }
   }
-  if (existsSync11(helper)) {
+  if (existsSync12(helper)) {
     try {
       await Bun.spawn([LSREGISTER, "-u", helper], { stdout: "ignore", stderr: "ignore" }).exited;
     } catch {}
@@ -6898,8 +7039,9 @@ async function restartOnto(version) {
 // src/cli.ts
 async function open2(cmd) {
   const explicit = cmd.path !== null;
+  const clone = cmd.path !== null ? gitUrl(cmd.path) : null;
   const target = resolve(cmd.path ?? process.cwd());
-  const register = explicit || existsSync12(join7(target, ".git"));
+  const register = !clone && (explicit || existsSync13(join8(target, ".git")));
   if (process.platform === "linux") {
     const missing = missingSandboxTools();
     const blocked = missing.length === 0 ? bwrapStartError() : null;
@@ -6911,7 +7053,20 @@ async function open2(cmd) {
   const daemon = await ensureDaemon();
   if (!daemon)
     return 1;
-  const file = explicit && existsSync12(target) && statSync5(target).isFile();
+  if (clone && cmd.path !== null) {
+    const res = await post("/clone", daemon.token, { url: cmd.path, parent: process.cwd() });
+    if (!res.ok) {
+      console.error(`could not open ${cmd.path}: ${await res.text()}`);
+      return 1;
+    }
+    console.log(`toyon: ${clone.name} is ready to clone into ${process.cwd()}; press return in Toyon to start`);
+    if ((await res.json()).delivered)
+      focusShell();
+    else
+      openShell(daemon);
+    return 0;
+  }
+  const file = explicit && existsSync13(target) && statSync5(target).isFile();
   if (file) {
     const res = await post("/open", daemon.token, { path: target });
     if (!res.ok) {