wherdr 1.3.1 → 1.3.2

package/.output/server/chunks/nitro/nitro.mjs

@@ -21,8 +21,12 @@ import { spawn, execFile } from 'node:child_process';
 import net from 'node:net';
 import readline from 'node:readline';
 import fs$1 from 'node:fs/promises';
-import { fileURLToPath } from 'node:url';
+import dns from 'node:dns';
+import { promisify } from 'node:util';
+import QRCode from 'qrcode-terminal/vendor/QRCode/index.js';
+import QRErrorCorrectLevel from 'qrcode-terminal/vendor/QRCode/QRErrorCorrectLevel.js';
 import { verifyAuthenticationResponse, generateAuthenticationOptions, verifyRegistrationResponse, generateRegistrationOptions } from '@simplewebauthn/server';
+import { fileURLToPath } from 'node:url';
 
 crypto.webcrypto?.subtle || {};
 const randomUUID = () => {
@@ -5892,12 +5896,12 @@ function createRouter$1(options = {}) {
   }
   return {
     ctx,
-    lookup: (path) => lookup(ctx, normalizeTrailingSlash(path)),
+    lookup: (path) => lookup$1(ctx, normalizeTrailingSlash(path)),
     insert: (path, data) => insert(ctx, normalizeTrailingSlash(path), data),
     remove: (path) => remove(ctx, normalizeTrailingSlash(path))
   };
 }
-function lookup(ctx, path) {
+function lookup$1(ctx, path) {
   const staticPathNode = ctx.staticRoutesMap[path];
   if (staticPathNode) {
     return staticPathNode.data;
@@ -8286,7 +8290,7 @@ function createStorage(options = {}) {
     }
     context.watching = true;
     for (const mountpoint in context.mounts) {
-      context.unwatch[mountpoint] = await watch(
+      context.unwatch[mountpoint] = await watch$1(
         context.mounts[mountpoint],
         onChange,
         mountpoint
@@ -8582,7 +8586,7 @@ function createStorage(options = {}) {
       }
       context.mounts[base] = driver;
       if (context.watching) {
-        Promise.resolve(watch(driver, onChange, base)).then((unwatcher) => {
+        Promise.resolve(watch$1(driver, onChange, base)).then((unwatcher) => {
           context.unwatch[base] = unwatcher;
         }).catch(console.error);
       }
@@ -8629,7 +8633,7 @@ function createStorage(options = {}) {
   };
   return storage;
 }
-function watch(driver, onChange, base) {
+function watch$1(driver, onChange, base) {
   return driver.watch ? driver.watch((event, key) => onChange(event, base + key)) : () => {
   };
 }
@@ -8642,83 +8646,83 @@ async function dispose(driver) {
 const _assets = {
   ["scripts:build-nerd-font.py"]: {
     import: () => import('../raw/build-nerd-font.mjs').then(r => r.default || r),
-    meta: {"type":"text/plain; charset=utf-8","etag":"\"13aa-ys9YUI0kyQcBWrUDXjdBVLF8Z3E\"","mtime":"2026-10-08T11:43:41.732Z"}
+    meta: {"type":"text/plain; charset=utf-8","etag":"\"13aa-ys9YUI0kyQcBWrUDXjdBVLF8Z3E\"","mtime":"2026-10-10T00:23:41.677Z"}
   },
   ["scripts:build-terminal-font.py"]: {
     import: () => import('../raw/build-terminal-font.mjs').then(r => r.default || r),
-    meta: {"type":"text/plain; charset=utf-8","etag":"\"cf5-BDqHg2xDFu+6dg84HBWtyBtrEoU\"","mtime":"2026-10-08T11:43:41.732Z"}
+    meta: {"type":"text/plain; charset=utf-8","etag":"\"cf5-BDqHg2xDFu+6dg84HBWtyBtrEoU\"","mtime":"2026-10-10T00:23:41.677Z"}
   },
   ["scripts:bump-homebrew.sh"]: {
     import: () => import('../raw/bump-homebrew.mjs').then(r => r.default || r),
-    meta: {"type":"application/x-sh","etag":"\"61b-suAgb/6azMZO/UmEjog8x0wZsQA\"","mtime":"2026-10-08T11:43:41.732Z"}
+    meta: {"type":"application/x-sh","etag":"\"61b-suAgb/6azMZO/UmEjog8x0wZsQA\"","mtime":"2026-10-10T00:23:41.677Z"}
   },
   ["scripts:check-leaks.mjs"]: {
     import: () => import('../raw/check-leaks.mjs').then(r => r.default || r),
-    meta: {"type":"text/javascript; charset=utf-8","etag":"\"35b3-41HZueHfw7xuicx4q83qwdTEpbc\"","mtime":"2026-10-08T11:43:41.732Z"}
+    meta: {"type":"text/javascript; charset=utf-8","etag":"\"35b3-41HZueHfw7xuicx4q83qwdTEpbc\"","mtime":"2026-10-10T00:23:41.677Z"}
   },
   ["scripts:dev.wherdr.open.plist"]: {
     import: () => import('../raw/dev.wherdr.open.mjs').then(r => r.default || r),
-    meta: {"type":"text/plain; charset=utf-8","etag":"\"1de-12VO2xq63mciP26rEzRh3cGfEkI\"","mtime":"2026-10-08T11:43:41.732Z"}
+    meta: {"type":"text/plain; charset=utf-8","etag":"\"1de-12VO2xq63mciP26rEzRh3cGfEkI\"","mtime":"2026-10-10T00:23:41.677Z"}
   },
   ["scripts:docker-entrypoint.sh"]: {
     import: () => import('../raw/docker-entrypoint.mjs').then(r => r.default || r),
-    meta: {"type":"application/x-sh","etag":"\"3f3-8om3/mMriIIJYO+YcdXNJsv8tkI\"","mtime":"2026-10-08T11:43:41.732Z"}
+    meta: {"type":"application/x-sh","etag":"\"3f3-8om3/mMriIIJYO+YcdXNJsv8tkI\"","mtime":"2026-10-10T00:23:41.677Z"}
   },
   ["scripts:herdr-plugin.sh"]: {
     import: () => import('../raw/herdr-plugin.mjs').then(r => r.default || r),
-    meta: {"type":"application/x-sh","etag":"\"89ea-WMEExeYOqeXl5Lacbu/zP6mb8fY\"","mtime":"2026-10-08T11:43:41.732Z"}
+    meta: {"type":"application/x-sh","etag":"\"994f-jk8Je2eDp1XdX/Sk4mufv2vrJOc\"","mtime":"2026-10-10T00:23:41.677Z"}
   },
   ["scripts:install-claude-statusline.sh"]: {
     import: () => import('../raw/install-claude-statusline.mjs').then(r => r.default || r),
-    meta: {"type":"application/x-sh","etag":"\"db6-p7KGlvbZ+Qjt+JiT5yVtU4w3kfg\"","mtime":"2026-10-08T11:43:41.732Z"}
+    meta: {"type":"application/x-sh","etag":"\"db6-p7KGlvbZ+Qjt+JiT5yVtU4w3kfg\"","mtime":"2026-10-10T00:23:41.677Z"}
   },
   ["scripts:install-host-open.sh"]: {
     import: () => import('../raw/install-host-open.mjs').then(r => r.default || r),
-    meta: {"type":"application/x-sh","etag":"\"103a-/zplHeQSS471/Vz3quwajHmzFQs\"","mtime":"2026-10-08T11:43:41.732Z"}
+    meta: {"type":"application/x-sh","etag":"\"103a-/zplHeQSS471/Vz3quwajHmzFQs\"","mtime":"2026-10-10T00:23:41.677Z"}
   },
   ["scripts:pack-output.mjs"]: {
     import: () => import('../raw/pack-output.mjs').then(r => r.default || r),
-    meta: {"type":"text/javascript; charset=utf-8","etag":"\"54b-eU4eNNIxIecG1kwaLdtiTYODSSI\"","mtime":"2026-10-08T11:43:41.732Z"}
+    meta: {"type":"text/javascript; charset=utf-8","etag":"\"54b-eU4eNNIxIecG1kwaLdtiTYODSSI\"","mtime":"2026-10-10T00:23:41.677Z"}
   },
   ["scripts:reveal.sh"]: {
     import: () => import('../raw/reveal.mjs').then(r => r.default || r),
-    meta: {"type":"application/x-sh","etag":"\"72e-h/LTEU7exXdiR3GKqhj71UOwAqQ\"","mtime":"2026-10-08T11:43:41.732Z"}
+    meta: {"type":"application/x-sh","etag":"\"72e-h/LTEU7exXdiR3GKqhj71UOwAqQ\"","mtime":"2026-10-10T00:23:41.677Z"}
   },
   ["scripts:wherdr-open.sh"]: {
     import: () => import('../raw/wherdr-open.mjs').then(r => r.default || r),
-    meta: {"type":"application/x-sh","etag":"\"b5b-U5OyQk3hziU9KiUyB/1FT5TkOxk\"","mtime":"2026-10-08T11:43:41.732Z"}
+    meta: {"type":"application/x-sh","etag":"\"b5b-U5OyQk3hziU9KiUyB/1FT5TkOxk\"","mtime":"2026-10-10T00:23:41.677Z"}
   },
   ["server:branding:favicon.ico"]: {
     import: () => import('../raw/favicon.mjs').then(r => r.default || r),
-    meta: {"type":"image/vnd.microsoft.icon","etag":"\"3aee-Oem7XTWv+9HEwv9u/3K5QcIjS3E\"","mtime":"2026-10-08T11:43:41.734Z"}
+    meta: {"type":"image/vnd.microsoft.icon","etag":"\"3aee-Oem7XTWv+9HEwv9u/3K5QcIjS3E\"","mtime":"2026-10-10T00:23:41.681Z"}
   },
   ["server:branding:icons:apple-touch-icon.png"]: {
     import: () => import('../raw/apple-touch-icon.mjs').then(r => r.default || r),
-    meta: {"type":"image/png","etag":"\"1f8-AVRrBnAhalXrGkFPGdvl0fM7DH8\"","mtime":"2026-10-08T11:43:41.734Z"}
+    meta: {"type":"image/png","etag":"\"1f8-AVRrBnAhalXrGkFPGdvl0fM7DH8\"","mtime":"2026-10-10T00:23:41.681Z"}
   },
   ["server:branding:icons:favicon-32.png"]: {
     import: () => import('../raw/favicon-32.mjs').then(r => r.default || r),
-    meta: {"type":"image/png","etag":"\"a3-hAEc+Ymq1aYS3kFLyZK/H18Pge8\"","mtime":"2026-10-08T11:43:41.734Z"}
+    meta: {"type":"image/png","etag":"\"a3-hAEc+Ymq1aYS3kFLyZK/H18Pge8\"","mtime":"2026-10-10T00:23:41.681Z"}
   },
   ["server:branding:icons:icon-192.png"]: {
     import: () => import('../raw/icon-192.mjs').then(r => r.default || r),
-    meta: {"type":"image/png","etag":"\"222-kioUoPaSCUaRhKKWw0PRtFbAhxk\"","mtime":"2026-10-08T11:43:41.734Z"}
+    meta: {"type":"image/png","etag":"\"222-kioUoPaSCUaRhKKWw0PRtFbAhxk\"","mtime":"2026-10-10T00:23:41.681Z"}
   },
   ["server:branding:icons:icon-512-maskable.png"]: {
     import: () => import('../raw/icon-512-maskable.mjs').then(r => r.default || r),
-    meta: {"type":"image/png","etag":"\"84b-mCXgbBkXk7sqOhmJ8hjp80SN3Qk\"","mtime":"2026-10-08T11:43:41.734Z"}
+    meta: {"type":"image/png","etag":"\"84b-mCXgbBkXk7sqOhmJ8hjp80SN3Qk\"","mtime":"2026-10-10T00:23:41.681Z"}
   },
   ["server:branding:icons:icon-512.png"]: {
     import: () => import('../raw/icon-512.mjs').then(r => r.default || r),
-    meta: {"type":"image/png","etag":"\"8fc-ZwRMqAqQZeLLx4iNTZxs09C4Q1I\"","mtime":"2026-10-08T11:43:41.734Z"}
+    meta: {"type":"image/png","etag":"\"8fc-ZwRMqAqQZeLLx4iNTZxs09C4Q1I\"","mtime":"2026-10-10T00:23:41.681Z"}
   },
   ["server:branding:icons:icon-maskable.svg"]: {
     import: () => import('../raw/icon-maskable.mjs').then(r => r.default || r),
-    meta: {"type":"image/svg+xml","etag":"\"4a1-7XtnuN5ZOwiwIjpgpj+/Rg9LssY\"","mtime":"2026-10-08T11:43:41.734Z"}
+    meta: {"type":"image/svg+xml","etag":"\"4a1-7XtnuN5ZOwiwIjpgpj+/Rg9LssY\"","mtime":"2026-10-10T00:23:41.681Z"}
   },
   ["server:branding:icons:icon.svg"]: {
     import: () => import('../raw/icon.mjs').then(r => r.default || r),
-    meta: {"type":"image/svg+xml","etag":"\"49c-O1XxkWwKTf6VBoC0i4TEPdGPsCw\"","mtime":"2026-10-08T11:43:41.734Z"}
+    meta: {"type":"image/svg+xml","etag":"\"49c-O1XxkWwKTf6VBoC0i4TEPdGPsCw\"","mtime":"2026-10-10T00:23:41.681Z"}
   }
 };
 
@@ -9621,7 +9625,7 @@ function _expandFromEnv(value) {
 const _inlineRuntimeConfig = {
   "app": {
     "baseURL": "/",
-    "buildId": "6466b0ab-7935-460c-abdf-2ea632dae6d0",
+    "buildId": "7afbf062-5369-4002-b20d-7a582ff6e0f1",
     "buildAssetsDir": "/_nuxt/",
     "cdnURL": ""
   },
@@ -10197,6 +10201,7 @@ const HERDR_CHILD_ENV = Object.fromEntries(
 const AGENT_KINDS = (env.AGENT_KINDS || "pi,claude,codex,gemini,cursor,devin,agy,cline,omp,mastracode,opencode,copilot,kimi,kiro,droid,amp,grok,hermes,kilo,qodercli,qwen,letta,maki,muse").split(",").map((s) => s.trim()).filter(Boolean);
 const APP_URL_FILE = path$1.join(DATA_DIR, "app-url.json");
 const ENV_APP_URL = /^https:\/\//i.test(env.APP_URL || "") ? env.APP_URL : "";
+const BOOT_APP_URL = env.APP_URL || "";
 function savedAppUrl() {
   var _a;
   try {
@@ -10209,8 +10214,13 @@ function savedAppUrl() {
 if (!ENV_APP_URL && savedAppUrl()) env.APP_URL = savedAppUrl();
 const appUrl = () => env.APP_URL || "mailto:herdr-web@localhost";
 const HOST_LABEL = (env.HOST_LABEL || os.hostname()).trim().slice(0, 40);
+function machineLabel(tailnetName, fallback = HOST_LABEL, containerName = IN_DOCKER && !(env.HOST_LABEL || "").trim()) {
+  const short = (tailnetName || "").split(".")[0].trim().slice(0, 40);
+  return containerName && short ? short : fallback;
+}
 const PASSKEY_USER = (env.PASSKEY_USER || "wherdr").trim().slice(0, 64);
 const POLL_MS = Number(env.POLL_MS || 1e3);
+const TAILNET_REFRESH_MS = Number(env.TAILNET_REFRESH_MS || 3e4);
 const NOTIFY_SETTLE_MS = Number(env.NOTIFY_SETTLE_MS || 4e3);
 const UPLOAD_DIR = env.UPLOAD_DIR || path$1.join(HOME, ".cache/herdr-web/uploads");
 const UPLOAD_TTL_MS = 7 * 864e5;
@@ -10555,7 +10565,7 @@ async function agentPrompt(target, text) {
     await herdr("agent.prompt", { target, text });
   }
 }
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const sleep$1 = (ms) => new Promise((r) => setTimeout(r, ms));
 
 var __defProp$5 = Object.defineProperty;
 var __defNormalProp$5 = (obj, key, value) => key in obj ? __defProp$5(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
@@ -12835,6 +12845,19 @@ async function ompCommandTemplates(fs, home) {
   return out;
 }
 
+const PASTE_MIN_LINES = 12;
+const PASTE_MIN_CHARS = 1500;
+const lineCount = (s) => s ? s.split("\n").length : 0;
+const isLongPaste = (s) => {
+  const t = s.trim();
+  return lineCount(t) > PASTE_MIN_LINES || t.length > PASTE_MIN_CHARS;
+};
+const BLOCK = /<pasted_content(?:\s[^>]*)?>\n?([\s\S]*?)\n?<\/pasted_content(?:\s[^>]*)?>/g;
+function pastedBlocks(raw) {
+  if (!raw.includes("<pasted_content")) return [];
+  return [...raw.matchAll(BLOCK)].map((m) => m[1].trim()).filter(isLongPaste);
+}
+
 const WINDOW_BYTES = 2 * 1024 * 1024;
 const MAX_READ_BYTES = 24 * 1024 * 1024;
 const PAGE_ITEMS = 120;
@@ -12853,6 +12876,10 @@ function humanText(t) {
   if (u !== s) return u;
   return isNoise(s) ? null : s;
 }
+const pastedOf = (raw) => {
+  const b = pastedBlocks(raw).map((s) => clip(s));
+  return b.length ? { pasted: b } : {};
+};
 const normMsg = (t) => stripImageTags(t).replace(/\s+/g, " ").trim().toLowerCase();
 function sameMsg(queued, said) {
   const q = normMsg(queued).slice(0, 60);
@@ -13030,10 +13057,11 @@ function parseClaude(lines, home = "") {
     const ts = d.timestamp || null;
     if (d.type === "attachment" && d.attachment && d.attachment.type === "queued_command" && d.attachment.commandMode === "prompt" && (d.attachment.origin || {}).kind === "human") {
       const parts = Array.isArray(d.attachment.prompt) ? d.attachment.prompt : [{ type: "text", text: String(d.attachment.prompt || "") }];
-      const text = stripImageTags(unwrapPasted(parts.filter((p) => p.type === "text").map((p) => p.text).join("\n")));
+      const raw = parts.filter((p) => p.type === "text").map((p) => p.text).join("\n");
+      const text = stripImageTags(unwrapPasted(raw));
       const images = parts.filter((p) => p.type === "image").length;
       if (text || images) {
-        items.push({ role: "user", text: clip(text), images, ref: images ? ref : void 0, ts: d.attachment.timestamp || ts });
+        items.push({ role: "user", text: clip(text), images, ref: images ? ref : void 0, ts: d.attachment.timestamp || ts, ...pastedOf(raw) });
         pendingCmd = null;
         said(text, d.attachment.timestamp || ts, images);
       }
@@ -13084,7 +13112,7 @@ function parseClaude(lines, home = "") {
         } else {
           const text2 = humanText(content);
           if (text2) {
-            items.push({ role: "user", text: clip(text2), ts });
+            items.push({ role: "user", text: clip(text2), ts, ...pastedOf(content) });
             pendingCmd = null;
             said(text2, ts);
             noteSaid(d);
@@ -13094,6 +13122,7 @@ function parseClaude(lines, home = "") {
       }
       if (!Array.isArray(content)) continue;
       let text = "";
+      let raw = "";
       let images = 0;
       let toolImages = content.filter((p) => p && p.type === "image").length;
       for (const part of content) {
@@ -13111,12 +13140,13 @@ function parseClaude(lines, home = "") {
           if (special(String(part.text || ""), ts)) continue;
           const t = humanText(part.text);
           if (t === null) continue;
+          raw += "\n" + String(part.text || "");
           if (/^\[Request interrupted/.test(t)) items.push({ role: "system", text: "Interrupted", ts });
           else text += (text ? "\n" : "") + unwrapPasted(t.replace(/\[Image #\d+\]\s*/g, ""));
         } else if (part.type === "image") images++;
       }
       if (text.trim() || images) {
-        items.push({ role: "user", text: clip(text.trim()), images, ref: images ? ref : void 0, ts });
+        items.push({ role: "user", text: clip(text.trim()), images, ref: images ? ref : void 0, ts, ...pastedOf(raw) });
         pendingCmd = null;
         said(text, ts, images);
         noteSaid(d);
@@ -13964,14 +13994,25 @@ var __defNormalProp$3 = (obj, key, value) => key in obj ? __defProp$3(obj, key,
 var __publicField$3 = (obj, key, value) => __defNormalProp$3(obj, typeof key !== "symbol" ? key + "" : key, value);
 const fsp$3 = fs.promises;
 const LOCAL_LABEL_FILE = path$1.join(DATA_DIR, "machine-label.txt");
-function readLocalLabel() {
+function renamedLabel() {
   try {
-    return fs.readFileSync(LOCAL_LABEL_FILE, "utf8").trim().slice(0, 40) || HOST_LABEL;
+    return fs.readFileSync(LOCAL_LABEL_FILE, "utf8").trim().slice(0, 40);
   } catch {
-    return HOST_LABEL;
+    return "";
   }
 }
 const localMachineLabel = () => localMachine.label;
+let tailnetLabel = "";
+function adoptTailnetName(name) {
+  const label = machineLabel(name);
+  if (label === HOST_LABEL || label === tailnetLabel) return;
+  tailnetLabel = label;
+  if (renamedLabel() || localMachine.label === label) return;
+  localMachine.label = label;
+  for (const other of sessions.values()) if (!(other instanceof RemoteMachine)) other.label = label;
+  log(`machine name: ${label} (from Tailscale)`);
+  changed();
+}
 function localOs() {
   const p = os.platform();
   return p === "darwin" ? "Darwin" : p === "linux" ? "Linux" : p;
@@ -13979,7 +14020,7 @@ function localOs() {
 const localMachine = {
   key: LOCAL,
   profileId: null,
-  label: readLocalLabel(),
+  label: renamedLabel() || HOST_LABEL,
   local: true,
   target: null,
   session: HERDR_SESSION || "default",
@@ -14015,7 +14056,7 @@ function localMachineId() {
   }
   return selfId;
 }
-const selfNames = () => [HOST_LABEL, os.hostname(), ...SELF_HOSTS].filter(Boolean);
+const selfNames = () => [HOST_LABEL, os.hostname(), tailnetLabel, ...SELF_HOSTS].filter(Boolean);
 class SkipMachine extends Error {
 }
 const PROBE_SCRIPT = `echo "home=$HOME"
@@ -16171,7 +16212,7 @@ async function createAgent(body) {
       created = await hx("worktree.create", params, 3e4);
     } catch (e) {
       if (e.code !== "not_git_worktree") throw e;
-      await sleep(1e3);
+      await sleep$1(1e3);
       created = await hx("worktree.create", params, 3e4);
     }
   } else if (!target) {
@@ -16196,7 +16237,7 @@ async function createAgent(body) {
   const pathSetup = 'export PATH="$HOME/.local/bin:$HOME/.kimi-code/bin:$HOME/.bun/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"';
   await herdr("pane.send_input", { pane_id: paneId, text: pathSetup });
   await herdr("pane.send_input", { pane_id: paneId, keys: ["enter"] });
-  await sleep(400);
+  await sleep$1(400);
   let lastErr = null;
   for (let i = 0; i < 16; i++) {
     try {
@@ -16211,7 +16252,7 @@ async function createAgent(body) {
         break;
       }
       if (lastErr.code === "timeout" || lastErr.code === "unreachable" || /name/i.test(lastErr.code)) break;
-      await sleep(500);
+      await sleep$1(500);
     }
   }
   if (lastErr) {
@@ -16297,7 +16338,7 @@ async function closePanel(paneId) {
     if (!panelOpen(r.read && r.read.text, p.agent)) return sent;
     await herdr("pane.send_input", { pane_id: paneId, keys: ["esc"] });
     sent = true;
-    await sleep(400);
+    await sleep$1(400);
   }
   return sent;
 }
@@ -16336,10 +16377,184 @@ async function readUpload(name) {
   return { type: ext === "jpg" ? "image/jpeg" : `image/${ext}`, body: await fsp$2.readFile(path$1.join(UPLOAD_DIR, name)) };
 }
 
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function createPaneSizes(deps) {
+  const entries = /* @__PURE__ */ new Map();
+  const log = deps.log || (() => {
+  });
+  function save() {
+    if (!deps.save) return;
+    const out = {};
+    for (const [pane, e] of entries) if (e.original) out[pane] = e.original;
+    deps.save(out);
+  }
+  function drop(pane, e) {
+    if (entries.get(pane) !== e) return;
+    entries.delete(pane);
+    save();
+  }
+  function keepReason(e, now) {
+    const o = e.original;
+    if (!now) return "pane gone";
+    if (o.terminal && now.terminal && o.terminal !== now.terminal) return "another terminal";
+    if (now.rows === o.rows && now.cols === o.cols) return "already at its size";
+    const set = e.set;
+    if (set && (now.rows !== set.rows || now.exact && now.cols !== set.cols)) return `resized by another client to ${now.cols}x${now.rows}`;
+    return null;
+  }
+  async function restore(pane, e) {
+    var _a;
+    const o = e.original;
+    const why = keepReason(e, await deps.read(pane).catch(() => null));
+    if (why) return log(`term ${pane} size kept (${why})`);
+    for (let attempt = 0; attempt < 2; attempt++) {
+      if (attempt) await sleep((_a = deps.retryMs) != null ? _a : 1500);
+      if (e.clients > 0) return;
+      if (await deps.resize(pane, o.cols, o.rows).catch(() => false)) return;
+    }
+    log(`term ${pane} could not get its ${o.cols}x${o.rows} back`);
+  }
+  function schedule(pane, e, ms) {
+    clearTimeout(e.timer);
+    e.timer = setTimeout(() => {
+      e.timer = void 0;
+      e.restoring = restore(pane, e).catch(() => {
+      }).finally(() => {
+        e.restoring = null;
+        if (e.clients === 0 && !e.timer) drop(pane, e);
+      });
+    }, ms);
+  }
+  async function hold(pane) {
+    let e = entries.get(pane);
+    if (e) {
+      clearTimeout(e.timer);
+      e.timer = void 0;
+      e.clients++;
+    } else {
+      const fresh = { original: null, ready: Promise.resolve(), clients: 1, set: null, restoring: null };
+      fresh.ready = deps.read(pane).catch(() => null).then((size) => {
+        fresh.original = size;
+        if (size) save();
+      });
+      entries.set(pane, fresh);
+      e = fresh;
+    }
+    const entry = e;
+    await entry.ready;
+    if (entry.restoring) await entry.restoring;
+    let released = false;
+    return {
+      resized(cols, rows) {
+        if (!released) entry.set = { cols, rows };
+      },
+      release(clean) {
+        if (released) return;
+        released = true;
+        if (--entry.clients > 0) return;
+        if (!entry.original) return drop(pane, entry);
+        schedule(pane, entry, clean ? deps.closeMs : deps.graceMs);
+      }
+    };
+  }
+  function adopt(sizes) {
+    for (const [pane, size] of Object.entries(sizes)) {
+      if (entries.has(pane)) continue;
+      const e = { original: size, ready: Promise.resolve(), clients: 0, set: null, restoring: null };
+      entries.set(pane, e);
+      schedule(pane, e, deps.graceMs);
+    }
+  }
+  function stop() {
+    for (const e of entries.values()) clearTimeout(e.timer);
+  }
+  return { hold, adopt, stop, held: () => [...entries.keys()] };
+}
+function parseSttySize(out) {
+  const m = /^\s*(\d{1,4})\s+(\d{1,4})\s*$/.exec(out);
+  if (!m) return null;
+  const rows = Number(m[1]);
+  const cols = Number(m[2]);
+  return rows > 0 && cols > 0 ? { cols, rows } : null;
+}
+function cleanSavedSizes(raw, isPane) {
+  const out = {};
+  if (!raw || typeof raw !== "object") return out;
+  for (const [pane, v] of Object.entries(raw)) {
+    const s = v;
+    if (!isPane(pane) || !s || !Number.isInteger(s.cols) || !Number.isInteger(s.rows)) continue;
+    if (s.cols < 10 || s.cols > 400 || s.rows < 5 || s.rows > 200) continue;
+    out[pane] = { cols: s.cols, rows: s.rows, exact: s.exact === true, ...typeof s.terminal === "string" ? { terminal: s.terminal } : {} };
+  }
+  return out;
+}
+
 const clampInt = (v, lo, hi, dflt) => {
   const n = parseInt(String(v), 10);
   return Number.isFinite(n) ? Math.min(hi, Math.max(lo, n)) : dflt;
 };
+const TTY_SIZE_SCRIPT = 't=$(ps -o tty= -p "$1" 2>/dev/null | tr -d " "); [ -n "$t" ] && [ -c "/dev/$t" ] && stty size < "/dev/$t"';
+function ttySize(pane, pid) {
+  const machine = machineOfPane(pane);
+  if (!machine) return Promise.resolve("");
+  if (machine.exec) return machine.exec(TTY_SIZE_SCRIPT, [String(pid)], { timeoutMs: 4e3 }).then((r) => r.code === 0 ? r.stdout.toString("utf8") : "", () => "");
+  if (IN_DOCKER) return Promise.resolve("");
+  return new Promise((resolve) => execFile("sh", ["-c", TTY_SIZE_SCRIPT, "sh", String(pid)], { timeout: 2e3 }, (err, stdout) => resolve(err ? "" : String(stdout))));
+}
+async function readPaneSize(pane) {
+  var _a, _b, _c, _d, _e, _f, _g, _h;
+  const p = (_a = await herdr("pane.get", { pane_id: pane }, 3e3).catch(() => null)) == null ? void 0 : _a.pane;
+  if (!p) return null;
+  const terminal = typeof p.terminal_id === "string" ? { terminal: p.terminal_id } : {};
+  const rows = Number((_b = p.scroll) == null ? void 0 : _b.viewport_rows) || 0;
+  const pid = Number((_d = (_c = await herdr("pane.process_info", { pane_id: pane }, 3e3).catch(() => null)) == null ? void 0 : _c.process_info) == null ? void 0 : _d.shell_pid);
+  if (Number.isInteger(pid) && pid > 1) {
+    const tty = parseSttySize(await ttySize(pane, pid));
+    if (tty && (!rows || tty.rows === rows)) return { ...tty, exact: true, ...terminal };
+  }
+  const local = splitId(pane).local;
+  const rect = (_h = (_g = (_f = (_e = await herdr("pane.layout", { pane_id: pane }, 3e3).catch(() => null)) == null ? void 0 : _e.layout) == null ? void 0 : _f.panes) == null ? void 0 : _g.find((x) => x.pane_id === local)) == null ? void 0 : _h.rect;
+  const cols = Number(rect == null ? void 0 : rect.width) || 0;
+  if (!rows || !cols) return null;
+  return { cols, rows, exact: false, ...terminal };
+}
+const sizesFile = () => path$1.join(DATA_DIR, "term-sizes.json");
+const delay = (name, dflt) => {
+  const n = Number(process.env[name]);
+  return Number.isFinite(n) && n >= 0 ? n : dflt;
+};
+let sizes = null;
+const paneSizes = () => sizes || (sizes = createPaneSizes({
+  read: readPaneSize,
+  resize: (pane, cols, rows) => resizePane(pane, cols, rows),
+  // Longer than the 1.5 s left to a closed control session to go away.
+  closeMs: delay("WHERDR_TERM_CLOSE_MS", 2e3),
+  graceMs: delay("WHERDR_TERM_GRACE_MS", 3e4),
+  save(held) {
+    const file = sizesFile();
+    try {
+      if (!Object.keys(held).length) return fs.rmSync(file, { force: true });
+      fs.mkdirSync(DATA_DIR, { recursive: true });
+      fs.writeFileSync(`${file}.tmp`, JSON.stringify(held) + "\n", { mode: 384 });
+      fs.renameSync(`${file}.tmp`, file);
+    } catch (e) {
+      log(`term sizes: ${e.message}`);
+    }
+  },
+  log
+}));
+function startPaneSizes() {
+  let saved = null;
+  try {
+    saved = JSON.parse(fs.readFileSync(sizesFile(), "utf8"));
+  } catch {
+    return;
+  }
+  paneSizes().adopt(cleanSavedSizes(saved, (id) => PANE_RE.test(id)));
+}
+function stopPaneSizes() {
+  sizes == null ? void 0 : sizes.stop();
+}
 function openTerm(ws, url) {
   const pane = url.searchParams.get("pane") || "";
   if (!PANE_RE.test(pane)) {
@@ -16356,30 +16571,53 @@ function openTerm(ws, url) {
   const rows = clampInt(url.searchParams.get("rows"), 5, 200, 24);
   const args = ["terminal", "session", "control", splitId(pane).local, "--cols", String(cols), "--rows", String(rows)];
   if (url.searchParams.get("takeover") === "1") args.push("--takeover");
-  const child = machine.spawnHerdr(args);
   const sess = { pane, visible: true };
   termSessions.add(sess);
-  log(`term ${pane} opened ${cols}x${rows}${args.includes("--takeover") ? " (takeover)" : ""}${machine.local ? "" : ` on ${machine.label}`}`);
-  readline.createInterface({ input: child.stdout }).on("line", (line) => {
-    if (ws.isOpen()) ws.send(line);
-  });
-  readline.createInterface({ input: child.stderr }).on("line", (line) => {
-    log(`term ${pane} stderr: ${line}`);
-    if (ws.isOpen()) ws.send(JSON.stringify({ type: "herdr.stderr", message: line }));
-  });
-  child.on("error", (e) => {
-    if (ws.isOpen()) ws.send(JSON.stringify({ type: "terminal.closed", reason: `herdr: ${e.message}` }));
-    ws.close(4500, "herdr error");
-  });
-  child.on("exit", (code) => {
-    termSessions.delete(sess);
-    if (ws.isOpen()) ws.close(4e3, `herdr exit ${code}`);
-  });
-  child.stdin.on("error", () => {
-  });
+  let child = null;
+  let hold = null;
+  let closed = false;
+  let size = { cols, rows };
+  let attached = false;
+  const early = [];
   const toChild = (obj) => {
-    if (child.stdin.writable) child.stdin.write(JSON.stringify(obj) + "\n");
+    if (!child) {
+      if (early.length < 64) early.push(obj);
+    } else if (child.stdin.writable) {
+      child.stdin.write(JSON.stringify(obj) + "\n");
+    }
   };
+  function start() {
+    const c = machine.spawnHerdr(args);
+    child = c;
+    log(`term ${pane} opened ${cols}x${rows}${args.includes("--takeover") ? " (takeover)" : ""}${machine.local ? "" : ` on ${machine.label}`}`);
+    readline.createInterface({ input: c.stdout }).on("line", (line) => {
+      if (!attached && line.includes('"terminal.frame"')) {
+        attached = true;
+        hold == null ? void 0 : hold.resized(size.cols, size.rows);
+      }
+      if (ws.isOpen()) ws.send(line);
+    });
+    readline.createInterface({ input: c.stderr }).on("line", (line) => {
+      log(`term ${pane} stderr: ${line}`);
+      if (ws.isOpen()) ws.send(JSON.stringify({ type: "herdr.stderr", message: line }));
+    });
+    c.on("error", (e) => {
+      if (ws.isOpen()) ws.send(JSON.stringify({ type: "terminal.closed", reason: `herdr: ${e.message}` }));
+      ws.close(4500, "herdr error");
+    });
+    c.on("exit", (code) => {
+      termSessions.delete(sess);
+      if (ws.isOpen()) ws.close(4e3, `herdr exit ${code}`);
+    });
+    c.stdin.on("error", () => {
+    });
+    for (const m of early.splice(0)) toChild(m);
+  }
+  paneSizes().hold(pane).then((h) => {
+    if (closed) return h.release(true);
+    hold = h;
+    start();
+  });
   return {
     onMessage(raw) {
       let m;
@@ -16393,9 +16631,12 @@ function openTerm(ws, url) {
           if (typeof m.text === "string" && m.text.length <= 65536) toChild({ type: "terminal.input", text: m.text });
           else if (typeof m.bytes === "string" && m.bytes.length <= 9e4) toChild({ type: "terminal.input", bytes: m.bytes });
           break;
-        case "terminal.resize":
-          toChild({ type: "terminal.resize", cols: clampInt(m.cols, 10, 400, cols), rows: clampInt(m.rows, 5, 200, rows) });
+        case "terminal.resize": {
+          size = { cols: clampInt(m.cols, 10, 400, cols), rows: clampInt(m.rows, 5, 200, rows) };
+          if (attached) hold == null ? void 0 : hold.resized(size.cols, size.rows);
+          toChild({ type: "terminal.resize", ...size });
           break;
+        }
         case "terminal.scroll":
           if (m.direction === "up" || m.direction === "down") {
             toChild({ type: "terminal.scroll", direction: m.direction, lines: clampInt(m.lines, 1, 500, 3) });
@@ -16419,13 +16660,18 @@ function openTerm(ws, url) {
           break;
       }
     },
-    onClose() {
+    onClose(clean = false) {
+      closed = true;
       termSessions.delete(sess);
-      toChild({ type: "terminal.release" });
-      child.stdin.end();
-      setTimeout(() => {
-        if (child.exitCode === null) child.kill("SIGTERM");
-      }, 1500);
+      const c = child;
+      if (c) {
+        toChild({ type: "terminal.release" });
+        c.stdin.end();
+        setTimeout(() => {
+          if (c.exitCode === null) c.kill("SIGTERM");
+        }, 1500);
+      }
+      hold == null ? void 0 : hold.release(clean && sess.visible);
     }
   };
 }
@@ -16586,14 +16832,14 @@ async function waitMenu(paneId, ok, timeoutMs = 6e3) {
     const m = parseModelMenu(await screen(paneId));
     if (m && ok(m)) return m;
     if (Date.now() > until) return null;
-    await sleep(250);
+    await sleep$1(250);
   }
 }
 async function closeMenu(paneId) {
   for (let i = 0; i < 3; i++) {
     if (!parseModelMenu(await screen(paneId))) return;
     await herdr("pane.send_input", { pane_id: paneId, keys: ["esc"] });
-    await sleep(400);
+    await sleep$1(400);
   }
 }
 async function openMenu(p) {
@@ -16621,7 +16867,7 @@ async function readAllOptions(paneId, first) {
   for (let i = 0; i < 8 && m.scrollDown; i++) {
     const last = m.options[m.options.length - 1].n;
     await herdr("pane.send_input", { pane_id: paneId, keys: moveKeys(m.cursor, last + 1) });
-    await sleep(350);
+    await sleep$1(350);
     const next = await waitMenu(paneId, (x) => x.kind === "model", 2e3);
     if (!next || next.cursor <= last) break;
     const before = all.size;
@@ -16703,7 +16949,7 @@ async function setModel(paneId, wanted) {
         const confirm = p.agent === "claude" ? switchConfirmKeys(text, confirmAs) : null;
         if (confirm) await herdr("pane.send_input", { pane_id: p.id, keys: confirm });
         clear = confirm || parseModelMenu(text) ? 0 : clear + 1;
-        await sleep(confirm ? 400 : 250);
+        await sleep$1(confirm ? 400 : 250);
       }
       if (clear < 2) throw new HerdrError("stale", "The /model menu changed \u2014 try again.");
       const info = { id: null, label: confirmAs, effort, at: new Date(started).toISOString() };
@@ -16726,14 +16972,14 @@ async function waitOmpSelector(paneId, ok, timeoutMs = 6e3) {
     const s = await ompSelector(paneId).catch(() => null);
     if (s && ok(s)) return s;
     if (Date.now() > until) return null;
-    await sleep(250);
+    await sleep$1(250);
   }
 }
 async function closeOmpSelector(paneId) {
   for (let i = 0; i < 3; i++) {
     if (!await ompSelector(paneId).catch(() => null)) return;
     await herdr("pane.send_input", { pane_id: paneId, keys: ["esc"] });
-    await sleep(400);
+    await sleep$1(400);
   }
 }
 const OMP_SELECTOR_COLS = 160;
@@ -16773,7 +17019,7 @@ async function waitOmpModel(p, id, since) {
     const info = await transcripts.model(p).catch(() => null);
     if (info && info.id === id && info.at && Date.parse(info.at) >= since - 1500) return true;
     if (Date.now() > until) return false;
-    await sleep(300);
+    await sleep$1(300);
   }
 }
 async function ompSetModel(paneId, wanted) {
@@ -16797,7 +17043,7 @@ async function ompSetModel(paneId, wanted) {
         }
         for (const ch of typed) {
           await herdr("pane.send_input", { pane_id: p.id, keys: [ch === " " ? "space" : ch] });
-          await sleep(80);
+          await sleep$1(80);
         }
         s = await waitOmpSelector(p.id, (x) => x.search.length > 0, 3e3) || s;
         at = rank(s);
@@ -16808,7 +17054,7 @@ async function ompSetModel(paneId, wanted) {
         const delta = at - s.cursor;
         if (delta === 0) break;
         await herdr("pane.send_input", { pane_id: p.id, keys: [delta > 0 ? "down" : "up"] });
-        await sleep(120);
+        await sleep$1(120);
         if (n === 79) throw new HerdrError("stale", "The model selector did not follow \u2014 nothing was changed.");
       }
       s = (_b = (_a = await waitOmpSelector(p.id, (x) => x.cursor === at && x.options[at].label === id, 3e3)) != null ? _a : await ompSelector(p.id)) != null ? _b : s;
@@ -16867,7 +17113,7 @@ async function waitSlider(paneId, ok, timeoutMs) {
     const s = parseClaudeEffortScreen(await screen(paneId).catch(() => ""));
     if (s && ok(s)) return s;
     if (Date.now() > until) return null;
-    await sleep(250);
+    await sleep$1(250);
   }
 }
 async function sliderGone(paneId, timeoutMs = 3e3) {
@@ -16875,7 +17121,7 @@ async function sliderGone(paneId, timeoutMs = 3e3) {
   let clear = 0;
   while (clear < 2 && Date.now() < until) {
     clear = parseClaudeEffortScreen(await screen(paneId).catch(() => "")) ? 0 : clear + 1;
-    if (clear < 2) await sleep(250);
+    if (clear < 2) await sleep$1(250);
   }
   return clear >= 2;
 }
@@ -16884,7 +17130,7 @@ async function closeEffortSlider(paneId) {
     if (!parseClaudeEffortScreen(await screen(paneId).catch(() => ""))) return;
     await herdr("pane.send_input", { pane_id: paneId, keys: ["esc"] }).catch(() => {
     });
-    await sleep(400);
+    await sleep$1(400);
   }
 }
 async function openEffortSlider(p) {
@@ -16918,7 +17164,7 @@ async function waitOmpEffort(p, model, prev, shown, sinceAt, hasTranscript) {
       if (now && prev === "auto" && shown !== "auto" && Date.now() - pressed > OMP_REDRAW_MS) return { level: now, at: sinceAt, shown: now };
     }
     if (Date.now() - pressed > 3e3) return null;
-    await sleep(200);
+    await sleep$1(200);
   }
 }
 async function ompCycleTo(p, before, level) {
@@ -17031,7 +17277,7 @@ async function setEffort(paneId, level) {
         let clear = 0;
         while (clear < 2 && Date.now() < until) {
           clear = parseModelMenu(await screen(p.id)) ? 0 : clear + 1;
-          await sleep(250);
+          await sleep$1(250);
         }
         if (clear < 2) throw new HerdrError("stale", "The /model menu changed \u2014 try again.");
       } catch (e) {
@@ -17064,16 +17310,26 @@ function compareVersions(a, b) {
   for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return x[i] - y[i];
   return 0;
 }
+const MODES = ["docker", "docker-build", "npm", "npm-global", "brew", "plugin"];
 function installMode(env) {
-  return env === "docker" || env === "docker-build" || env === "npm" || env === "brew" ? env : "native";
+  var _a;
+  return (_a = MODES.find((m) => m === env)) != null ? _a : "native";
 }
-function updateCommand(mode) {
+function updateCommand(mode, repo) {
   if (mode === "docker") return "docker compose pull && docker compose up -d";
   if (mode === "docker-build") return "git pull && docker compose -f docker-compose.yml -f docker-compose.build.yml up -d --build";
   if (mode === "npm") return "npx wherdr@latest";
-  if (mode === "brew") return "brew upgrade wherdr";
+  if (mode === "npm-global") return "npm install -g wherdr@latest && wherdr restart";
+  if (mode === "brew") return "brew upgrade wherdr && brew services restart wherdr";
+  if (mode === "plugin") return `herdr plugin install ${repo} --yes`;
   return "git pull && npm ci && npm run build";
 }
+function oneTapMode(mode) {
+  return mode === "plugin" || mode === "npm-global" || mode === "brew";
+}
+function updateRunning(job, now) {
+  return !!job && !["done", "rolled-back", "failed"].includes(job.state) && now - job.updatedAt < 10 * 6e4;
+}
 
 const CODEX_RELEASE_NOTES = "https://github.com/openai/codex/releases/latest";
 const CODEX_STANDALONE_COMMAND = `sh -c 'curl -fsSL https://chatgpt.com/codex/install.sh | CODEX_NON_INTERACTIVE=1 sh'`;
@@ -18131,7 +18387,7 @@ function sendPrompt(p, text) {
         keys: async (keys) => {
           await herdr("pane.send_input", { pane_id: p.id, keys });
         },
-        sleep,
+        sleep: sleep$1,
         sentSince: async (since) => {
           const r2 = await transcripts.chat(p, {});
           return (r2.items || []).filter((i) => i.role === "user" && i.ts && Date.parse(i.ts) >= since - 1e3).map((i) => i.text);
@@ -18200,13 +18456,13 @@ function takeBackFromClaude(p) {
       await herdr("pane.send_input", { pane_id: p.id, keys });
     },
     chat: async () => (await transcripts.chat(p, { fresh: true })).items || [],
-    sleep,
+    sleep: sleep$1,
     pending: () => (queued.get(p.id) || []).map((q) => q.text)
   }).catch(() => null);
 }
 async function cancelTurn(p, text) {
   if (!unansweredTurn((await transcripts.chat(p, { fresh: true })).items || [], text)) return null;
-  const r = await interruptAgent({ call: (m, params, t) => herdr(m, params, t), sleep, now: Date.now }, p);
+  const r = await interruptAgent({ call: (m, params, t) => herdr(m, params, t), sleep: sleep$1, now: Date.now }, p);
   if (!r.stopped) return null;
   const item = await takeBackFromClaude(p);
   if (!item) return null;
@@ -18242,7 +18498,7 @@ function reconcileQueued(p) {
 }
 const unqueueBusy = /* @__PURE__ */ new Set();
 async function deliveryDone(paneId) {
-  for (let i = 0; i < 60 && deliverBusy.has(paneId); i++) await sleep(100);
+  for (let i = 0; i < 60 && deliverBusy.has(paneId); i++) await sleep$1(100);
 }
 async function cancelQueued(paneId, text, id) {
   const p = findPane(paneId);
@@ -18288,7 +18544,7 @@ async function cancelQueued(paneId, text, id) {
         return { queue: r2.queue || [], items: r2.items || [] };
       },
       prompt: (t) => agentPrompt(p.id, t),
-      sleep,
+      sleep: sleep$1,
       original: (e) => {
         var _a2, _b2;
         return !e.text && e.images ? ((_a2 = ownPhotos.shift()) == null ? void 0 : _a2.text) || fromHistory(e) : ((_b2 = own.find((q) => q !== mine && sameMsg(e.text, msgText(q.text)))) == null ? void 0 : _b2.text) || fromHistory(e) || e.text;
@@ -19170,1059 +19426,1568 @@ function stopNotices() {
   listeners.clear();
 }
 
-const fsp = fs.promises;
-const REFUSED = {
-  archive: "Archives cannot be read by the agent: extract the files first",
-  video: "Videos cannot be read by the agent",
-  audio: "Audio files cannot be read by the agent",
-  office: "Office documents cannot be read by the agent: export to PDF or text first",
-  executable: "Programs and binary files cannot be read by the agent",
-  binary: "Binary files cannot be read by the agent",
-  pdf: "This agent cannot read PDFs: only Claude Code can",
-  too_large: "File too large for the agent",
-  empty: "Empty file"
+// The phone address: wherdr published on the tailnet by `tailscale serve`
+// (private, only your devices). Reads Tailscale's state, publishes and
+// unpublishes wherdr's port, and checks that the address really answers.
+// Used by the server (Settings › Phone, server/utils/phone.ts) and by
+// `wherdr phone` / `wherdr panel`. No dependency on the rest of bin/lib nor
+// on packages: the server bundles this file.
+
+const exec = promisify(execFile);
+
+const LINKS = {
+  download: 'https://tailscale.com/download',
+  https: 'https://login.tailscale.com/admin/dns',
+  operator: 'https://tailscale.com/kb/1242/tailscale-serve',
 };
-async function saveAttachment(data, originalName, paneId) {
-  const pane = findPane(paneId);
-  const m = machineOfPane(paneId);
-  if (!pane || !m) throw new HerdrError("bad_pane", "Pane not found");
-  const check = checkAttachment(pane.agent, { name: originalName, type: "", size: data.length }, data.subarray(0, SNIFF_BYTES));
-  if (check.ok && check.kind === "image") throw new HerdrError("unsupported", "Images go through the photo upload");
-  if (!check.ok) throw new HerdrError(check.reason === "too_large" ? "too_large" : "unsupported", REFUSED[check.reason]);
-  const stored = storedAttachmentName(originalName, /* @__PURE__ */ new Date(), crypto.randomBytes(3).toString("hex"));
-  if (!isStoredAttachmentName(stored)) throw new HerdrError("bad_name", "Invalid file name");
-  let file;
-  if (m instanceof RemoteMachine) {
-    if (m.status !== "online") throw new HerdrError("unreachable", fmt("{machine} is unreachable", { machine: m.label }));
-    file = await m.putUpload(stored, data, "file");
-  } else {
-    file = path$1.join(ATTACH_DIR, stored);
-    if (path$1.dirname(file) !== path$1.resolve(ATTACH_DIR)) throw new HerdrError("bad_name", "Invalid file name");
-    await fsp.mkdir(ATTACH_DIR, { recursive: true, mode: 448 });
-    await fsp.writeFile(file, data, { mode: 384, flag: "wx" });
+
+// The tailscale CLI: the macOS app's binary, Homebrew, system folders, then the PATH.
+function tailscaleBin(env = process.env, exists = existsSync) {
+  const dirs = ['/Applications/Tailscale.app/Contents/MacOS/Tailscale', '/opt/homebrew/bin/tailscale', '/usr/local/bin/tailscale', '/usr/bin/tailscale'];
+  for (const dir of (env.PATH || '').split(path$1.delimiter)) if (dir) dirs.push(path$1.join(dir, 'tailscale'));
+  return dirs.find(p => exists(p)) || null
+}
+
+// Tailscale's own socket on Linux. Its local API answers the same JSON as the
+// CLI: a Docker container has no `tailscale` command, but docker-compose.yml
+// mounts this folder, so wherdr reads the state there. Anyone may read; the
+// API also accepts changes from Tailscale's operator, but wherdr only ever
+// sends GET requests to it (localApi below).
+const TAILSCALED_SOCKET = '/var/run/tailscale/tailscaled.sock';
+function tailscaledSocket(env = process.env, exists = existsSync) {
+  const file = env.WHERDR_TAILSCALED_SOCKET || TAILSCALED_SOCKET;
+  return exists(file) ? file : null
+}
+
+// GET on Tailscale's local API → the body, '' on any failure.
+function localApi(socketPath, route, timeoutMs = 4000) {
+  const { promise, resolve } = Promise.withResolvers();
+  const req = http.get({ socketPath, path: `/localapi/v0/${route}`, headers: { host: 'local-tailscaled.sock' }, timeout: timeoutMs }, (res) => {
+    let text = '';
+    res.setEncoding('utf8');
+    res.on('data', (c) => { if (text.length < 1 << 20) text += c; });
+    res.on('end', () => resolve(res.statusCode === 200 ? text : ''));
+    res.on('error', () => resolve(''));
+  });
+  req.on('timeout', () => req.destroy());
+  req.on('error', () => resolve(''));
+  return promise
+}
+
+// `tailscale status --json` → { name, connected, https }: this machine's
+// tailnet name (machine.tailnet.ts.net) or null, whether Tailscale is up,
+// and whether the tailnet issues HTTPS certificates.
+function tailnetStatus(statusJson) {
+  let s = null;
+  try { s = JSON.parse(statusJson); } catch {}
+  const dns = s?.Self?.DNSName;
+  return {
+    name: typeof dns === 'string' && dns ? dns.replace(/\.$/, '') : null,
+    connected: s?.BackendState === 'Running',
+    https: Array.isArray(s?.CertDomains) && s.CertDomains.length > 0,
+  }
+}
+
+// The HTTPS entries of a serve configuration that proxy to wherdr's local
+// port on this machine's own name: [{ hostPort, httpsPort, funnel }], or null
+// when the configuration could not be read (Tailscale stopped, not JSON).
+// Background entries (`--bg`) and those of a `tailscale serve` still running
+// in a terminal (Foreground) both count. `funnel`: also open to the Internet.
+function wherdrEntries(name, port, serveJson) {
+  let config = null;
+  try { config = JSON.parse(serveJson); } catch {}
+  if (!name || !config || typeof config !== 'object' || Array.isArray(config)) return null
+  const target = new RegExp(`^(https?://)?(127\\.0\\.0\\.1|localhost):${port}/?$`);
+  const out = [];
+  for (const part of [config, ...Object.values(config.Foreground || {})]) {
+    for (const [hostPort, entry] of Object.entries(part?.Web || {})) {
+      const colon = hostPort.lastIndexOf(':');
+      if (hostPort.slice(0, colon).toLowerCase() !== name.toLowerCase()) continue
+      if (!Object.values(entry?.Handlers || {}).some(h => target.test(h?.Proxy || ''))) continue
+      out.push({ hostPort, httpsPort: hostPort.slice(colon + 1), funnel: Boolean(part.AllowFunnel?.[hostPort]) });
+    }
   }
-  log(`file received ${stored} (${Math.round(data.length / 1024)} KB, ${check.kind})${m instanceof RemoteMachine ? ` -> ${m.label}` : ""}`);
-  return { path: file, name: stored, kind: check.kind, size: data.length, ref: attachmentRef(pane.agent, check.kind, file) };
+  return out
 }
-async function cleanAttachments() {
+
+const addressOf = (name, httpsPort) => `https://${name}${httpsPort === '443' ? '' : `:${httpsPort}`}/`;
+
+// Phone address: the `tailscale serve` entry whose proxy targets wherdr's
+// local port (served on any HTTPS port), else the address publishing would
+// give (same port) with served: false. Null without a tailnet name.
+function phoneAddress(name, port, serveJson) {
+  if (!name) return null
+  const entries = wherdrEntries(name, port, serveJson) || [];
+  const hit = entries.find(e => !e.funnel) || entries[0];
+  if (hit) return { url: addressOf(name, hit.httpsPort), served: true, httpsPort: hit.httpsPort, ...(hit.funnel ? { funnel: true } : {}) }
+  return { url: `https://${name}:${port}/`, served: false, httpsPort: String(port) }
+}
+
+// The addresses wherdr adopts by itself (server/utils/phone.ts): what
+// `tailscale serve` publishes for its port on this machine's name, read from
+// Tailscale, which only the owner of the machine configures. null: unknown
+// (nothing is changed then); []: nothing is published. An address that
+// `tailscale funnel` also opens to the Internet is never adopted.
+function servedAddresses(name, port, serveJson) {
+  const entries = wherdrEntries(name, port, serveJson);
+  return entries && entries.filter(e => !e.funnel).map(e => addressOf(name, e.httpsPort))
+}
+
+// HTTPS ports already published by `tailscale serve` (for anything).
+function servedPorts(serveJson) {
   try {
-    for (const n of await fsp.readdir(ATTACH_DIR)) {
-      const f = path$1.join(ATTACH_DIR, n);
-      const st = await fsp.lstat(f);
-      if (st.isFile() && Date.now() - st.mtimeMs > UPLOAD_TTL_MS) await fsp.unlink(f);
-    }
+    const web = JSON.parse(serveJson || '{}')?.Web || {};
+    return Object.keys(web).map(k => k.slice(k.lastIndexOf(':') + 1))
+  } catch { return [] }
+}
+
+// The command that publishes wherdr's port, as typed by hand (Docker mode).
+// `httpsPort`: the tailnet port, wherdr's own by default.
+const publishCommand = (port, httpsPort = port) => `tailscale serve --bg --https=${httpsPort} http://127.0.0.1:${port}`;
+const publishArgs = port => ['serve', '--bg', `--https=${port}`, `http://127.0.0.1:${port}`];
+const unpublishArgs = httpsPort => ['serve', `--https=${httpsPort}`, 'off'];
+
+// A tailnet address typed by hand: https://machine.tailnet.ts.net[:port]/ → its
+// normalized form, or null.
+function tailnetUrl(text) {
+  try {
+    const u = new URL(String(text || '').trim());
+    if (u.protocol !== 'https:' || !/^[a-z0-9-]+(\.[a-z0-9-]+)*\.ts\.net$/i.test(u.hostname) || u.username || u.password) return null
+    return `https://${u.host.toLowerCase()}/`
+  } catch { return null }
+}
+
+// A failed `tailscale serve` → { code, link } for the known causes, else null.
+// code: 'operator' (Linux: the user may not change Tailscale's settings),
+// 'https' (no HTTPS certificates on the tailnet), 'offline' (not connected).
+function serveError(output) {
+  const text = String(output || '');
+  const link = /https:\/\/login\.tailscale\.com\/\S+/.exec(text)?.[0];
+  if (/access denied|permission denied|--operator|not permitted/i.test(text)) return { code: 'operator', link: LINKS.operator }
+  if (/https?\b.*(not enabled|disabled)|serve.*not enabled|enable https|certificates?.*(not enabled|disabled)|\/f\/serve/i.test(text)) return { code: 'https', link: link || LINKS.https }
+  if (/needslogin|not logged in|logged out|tailscale is stopped|is tailscale running|not running|failed to connect to local tailscale/i.test(text)) return { code: 'offline', link: LINKS.download }
+  return null
+}
+
+// Tailscale's state for wherdr's port: { installed, bin, socket, connected,
+// https, name, phone, taken, served }. Read with the CLI, or without one
+// (Docker) from Tailscale's socket.
+async function inspect(port, bin = tailscaleBin(), socket = bin ? null : tailscaledSocket()) {
+  if (!bin && !socket) return { installed: false }
+  const run = args => exec(bin, args, { encoding: 'utf8', timeout: 8000 }).then(r => r.stdout, () => '');
+  const status = tailnetStatus(bin ? await run(['status', '--json']) : await localApi(socket, 'status?peers=false'));
+  const serve = !status.name ? '' : bin ? await run(['serve', 'status', '--json']) : await localApi(socket, 'serve-config');
+  const phone = phoneAddress(status.name, port, serve);
+  // Publishing on wherdr's port would replace whatever else is served there.
+  const taken = Boolean(phone && !phone.served && servedPorts(serve).includes(String(port)));
+  return { installed: true, bin, socket, ...status, phone, taken, served: servedAddresses(status.name, port, serve) }
+}
+
+// The tailnet's DNS suffix (tailnet.ts.net) from /etc/resolv.conf's search
+// line: a Docker container copies it from the host when MagicDNS is on.
+function tailnetDomain(resolvConf) {
+  for (const line of String(resolvConf || '').split('\n')) {
+    const m = /^\s*search\s+(.+)$/.exec(line);
+    const hit = m?.[1].split(/\s+/).find(d => /^[a-z0-9-]+\.ts\.net$/i.test(d));
+    if (hit) return hit.toLowerCase()
+  }
+  return null
+}
+
+// Tailscale's DNS (MagicDNS): a Docker container does not use it, but reaches it.
+const MAGIC_DNS = '100.100.100.100';
+
+// The system's lookup, then MagicDNS for *.ts.net names.
+function lookup(host, opts, cb) {
+  dns.lookup(host, opts, (err, address, family) => {
+    if (!err || !/\.ts\.net$/i.test(host)) return cb(err, address, family)
+    const resolver = new dns.Resolver({ timeout: 3000, tries: 1 });
+    resolver.setServers([MAGIC_DNS]);
+    resolver.resolve4(host, (e2, list) => {
+      if (e2 || !list?.length) return cb(err)
+      if (opts?.all) cb(null, list.map(a => ({ address: a, family: 4 })));
+      else cb(null, list[0], 4);
+    });
+  });
+}
+
+// Why a request failed: 'dns' (name not found), 'refused', 'timeout', 'cert'
+// (invalid certificate), 'tls' (no HTTPS on that port), or 'network'.
+function failureCause(err) {
+  const code = String(err?.code || '');
+  const msg = String(err?.message || '');
+  if (code === 'ENOTFOUND' || code === 'EAI_AGAIN' || code === 'EAI_NONAME') return 'dns'
+  if (code === 'ECONNREFUSED') return 'refused'
+  if (code === 'ETIMEDOUT' || msg === 'timeout') return 'timeout'
+  if (/CERT|SELF_SIGNED|UNABLE_TO_VERIFY|ALTNAME/.test(code)) return 'cert'
+  if (code === 'EPROTO' || /wrong version number|ssl3_get_record|packet length/i.test(msg)) return 'tls'
+  return 'network'
+}
+
+// GET of `route` on the address → { status, text }, or { cause } when it failed.
+function fetchText(url, route, timeoutMs) {
+  const { promise, resolve } = Promise.withResolvers();
+  let u;
+  try { u = new URL(route, url); } catch { return Promise.resolve({ cause: 'network' }) }
+  // Accept JSON: a refused host then answers { code: 'host' }, not the HTML page.
+  const req = https.get(u, { lookup, timeout: timeoutMs, headers: { accept: 'application/json' } }, (res) => {
+    let text = '';
+    res.setEncoding('utf8');
+    res.on('data', (c) => { if (text.length < 65536) text += c; });
+    res.on('end', () => resolve({ status: res.statusCode || 0, text }));
+    res.on('error', e => resolve({ cause: failureCause(e) }));
+  });
+  req.on('timeout', () => req.destroy(new Error('timeout')));
+  req.on('error', e => resolve({ cause: failureCause(e) }));
+  return promise
+}
+
+// What an answer of /api/health means: 'ok' (wherdr, and it accepts this
+// address), 'host' (wherdr's host check refused it), or null: not a wherdr
+// that has this route (versions up to 1.3.1, or another program).
+function healthReach(status, text) {
+  if (status >= 200 && status < 300 && /"name"\s*:\s*"wherdr"/.test(text)) return 'ok'
+  if (status === 403 && /"code"\s*:\s*"host"/.test(text)) return 'host'
+  return null
+}
+
+// reachable() with the details: { reach, cause?, status? }: `cause` when
+// unreachable (failureCause), `status` the HTTP code when something answered.
+// /api/health is asked first: it goes through wherdr's host check, which the
+// static manifest does not (it answers for any host name). The manifest only
+// recognizes an older wherdr without that route.
+async function probe(url, timeoutMs = 8000) {
+  const health = await fetchText(url, 'api/health', timeoutMs);
+  if (health.cause) return { reach: 'unreachable', cause: health.cause }
+  const reach = healthReach(health.status, health.text);
+  if (reach) return { reach, status: health.status }
+  const manifest = await fetchText(url, 'manifest.webmanifest', timeoutMs);
+  if (manifest.cause) return { reach: 'unreachable', cause: manifest.cause }
+  const ok = manifest.status >= 200 && manifest.status < 300 && manifest.text.includes('wherdr');
+  return { reach: ok ? 'ok' : 'other', status: ok ? manifest.status : health.status }
+}
+
+// Runs `tailscale <args>` without a terminal → { code, output }. On a tailnet
+// without HTTPS, `tailscale serve` prints a link and waits: the timeout ends it.
+function runTailscale(bin, args, timeoutMs = 30_000) {
+  return exec(bin, args, { encoding: 'utf8', timeout: timeoutMs }).then(
+    r => ({ code: 0, output: `${r.stdout}${r.stderr}` }),
+    e => ({ code: typeof e.code === 'number' ? e.code : -1, output: `${e.stdout || ''}${e.stderr || ''}${e.message || ''}` }),
+  )
+}
+
+const PHONE_GRACE_MS = 9e4;
+const TRANSIENT = { timeout: true, tls: true, refused: true, cert: true, network: true };
+function phoneReach(probe, since, now = Date.now()) {
+  if (probe.reach !== "unreachable") return probe.reach;
+  return probe.cause && TRANSIENT[probe.cause] && now - since < PHONE_GRACE_MS ? "pending" : "unreachable";
+}
+
+function qrSvg(text) {
+  const qr = new QRCode(-1, QRErrorCorrectLevel.M);
+  qr.addData(text);
+  qr.make();
+  const n = qr.getModuleCount();
+  let d = "";
+  for (let r = 0; r < n; r++) {
+    for (let col = 0; col < n; col++) if (qr.isDark(r, col)) d += `M${col + 2} ${r + 2}h1v1h-1z`;
+  }
+  return { size: n + 4, path: d };
+}
+
+function hostname(value) {
+  try {
+    if (!value || /[\s/@?#]/.test(value)) return null;
+    const url = new URL(`http://${value}`);
+    if (url.username || url.password || url.pathname !== "/" || url.search || url.hash) return null;
+    return url.hostname.replace(/^\[|\]$/g, "").toLowerCase().replace(/\.$/, "");
   } catch {
+    return null;
   }
 }
-
-const _mZt23IdRC2vLuqDtWT6mb7m9BgHXq3U5QrnQ7Z5Hc4c = defineNitroPlugin((nitroApp) => {
-  initVapid();
-  startMachines();
-  startPolling();
-  startThreadLimits();
-  startNotices();
-  cleanUploads();
-  cleanAttachments();
-  const purge = setInterval(() => {
-    cleanUploads();
-    cleanAttachments();
-  }, 6 * 3600 * 1e3);
-  log(`herdr-web \u2014 socket ${HERDR_SOCK}${HERDR_SESSION ? ` (session ${HERDR_SESSION})` : ""}`);
-  nitroApp.hooks.hook("close", () => {
-    stopPolling();
-    stopNotices();
-    stopMachines();
-    clearInterval(purge);
+let servedHosts = [];
+function setServedHosts(urls) {
+  servedHosts = urls.flatMap((url) => {
+    try {
+      return [new URL(url).hostname.toLowerCase()];
+    } catch {
+      return [];
+    }
   });
-});
+}
+function allowedHosts(appUrl2 = process.env.APP_URL || "", extra = process.env.HERDR_WEB_ALLOWED_HOSTS || "", interfaces = os.networkInterfaces(), served = servedHosts) {
+  const names = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", os.hostname().toLowerCase(), ...served]);
+  try {
+    if (appUrl2) names.add(new URL(appUrl2).hostname.toLowerCase().replace(/^\[|\]$/g, ""));
+  } catch {
+  }
+  for (const addresses of Object.values(interfaces)) {
+    for (const address of addresses || []) names.add(address.address.toLowerCase().replace(/%.+$/, ""));
+  }
+  for (const item of extra.split(",")) {
+    const name = hostname(item.trim());
+    if (name) names.add(name);
+  }
+  return names;
+}
+function hostAllowed(host, names = allowedHosts()) {
+  const name = hostname(host || "");
+  return Boolean(name && names.has(name));
+}
+function hostRefusalIsHtml(path, accept) {
+  return !path.startsWith("/api/") && /\btext\/html\b/i.test(Array.isArray(accept) ? accept.join(",") : accept || "");
+}
+function phoneFixCommand(install = process.env.WHERDR_INSTALL || "") {
+  if (install === "brew" || install === "npm-global") return "wherdr phone";
+  if (install === "docker" || install === "docker-build" || install === "plugin") return "curl -fsSL https://wherdr.dev/install | sh";
+  return "npx wherdr phone";
+}
+function hostRefusedPage(install) {
+  const command = phoneFixCommand(install);
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
+<meta name="robots" content="noindex"><title>wherdr \xB7 address not enabled</title>
+<style>
+:root{color-scheme:dark}*{box-sizing:border-box}
+body{margin:0;min-height:100vh;display:grid;place-items:center;background:#0d0f12;color:#e8eaed;font:15px/1.5 Inter,system-ui,-apple-system,sans-serif;padding:24px max(16px,env(safe-area-inset-right)) 24px max(16px,env(safe-area-inset-left))}
+main{max-width:480px;border:1px solid #3a3f47;padding:24px}
+.tag{font:11px/1 "JetBrains Mono",ui-monospace,monospace;letter-spacing:.08em;text-transform:uppercase;color:#9aa0a8;margin:0 0 16px}
+h1{font:600 20px/1.25 Archivo,system-ui,sans-serif;margin:0 0 8px}
+p{margin:0 0 12px}hr{border:0;border-top:1px solid #3a3f47;margin:20px 0}
+code{font:13px/1.45 "JetBrains Mono",ui-monospace,monospace}
+pre{margin:0;padding:10px 12px;border:1px solid #3a3f47;background:#15181d;white-space:pre-wrap;overflow-wrap:anywhere;user-select:all;-webkit-user-select:all}
+</style></head><body><main>
+<p class="tag">wherdr \xB7 403</p>
+<h1>This address isn't enabled yet.</h1>
+<p>wherdr enables by itself the address <code>tailscale serve</code> publishes for it. On the machine that runs wherdr, run this, then reload:</p>
+<pre><code>${command}</code></pre>
+<hr>
+<h1 lang="fr">Cette adresse n\u2019est pas encore activ\xE9e.</h1>
+<p lang="fr">wherdr active tout seul l\u2019adresse que <code>tailscale serve</code> publie pour lui. Sur la machine qui fait tourner wherdr, lance ceci, puis recharge :</p>
+<pre><code>${command}</code></pre>
+</main></body></html>
+`;
+}
+function crossSiteRequest(headers) {
+  const site = headers["sec-fetch-site"];
+  return typeof site === "string" && site !== "same-origin" && site !== "none";
+}
 
-const plugins = [
-  _9as7ch5sSe9R7BrbrDE2GGZpuA6oP9uMAcL7iRtRgrw,
-_mZt23IdRC2vLuqDtWT6mb7m9BgHXq3U5QrnQ7Z5Hc4c
-];
+const MAX_SESSION_DAYS = [1, 7, 30, 90, 365];
+const DEFAULT_MAX_SESSION_DAYS = 7;
+const DAY_MS = 24 * 3600 * 1e3;
+function isMaxSessionDays(v) {
+  return MAX_SESSION_DAYS.includes(v);
+}
 
-const assets = {
-  "/manifest-en.webmanifest": {
-    "type": "application/manifest+json",
-    "etag": "\"260-q1JnCK0/ecdKwgeTve6N4I6/mWI\"",
-    "mtime": "2026-10-08T11:44:03.930Z",
-    "size": 608,
-    "path": "../public/manifest-en.webmanifest"
-  },
-  "/manifest.webmanifest": {
-    "type": "application/manifest+json",
-    "etag": "\"26e-ykoYuj4V8la457yChW3oQTur8RU\"",
-    "mtime": "2026-10-08T11:44:03.930Z",
-    "size": 622,
-    "path": "../public/manifest.webmanifest"
-  },
-  "/sw.js": {
-    "type": "text/javascript; charset=utf-8",
-    "etag": "\"1b1d-uKe7we3azu1ltb6U6uThnVqkUn4\"",
-    "mtime": "2026-10-08T11:44:04.183Z",
-    "size": 6941,
-    "path": "../public/sw.js"
-  },
-  "/_nuxt/AgentView.C4YOwvZG.css": {
-    "type": "text/css; charset=utf-8",
-    "etag": "\"15c8-yoJUdtWy2mP7U+kxJ717a6Bzxgg\"",
-    "mtime": "2026-10-08T11:44:03.918Z",
-    "size": 5576,
-    "path": "../public/_nuxt/AgentView.C4YOwvZG.css"
-  },
-  "/_nuxt/B6qBWHWB.js": {
-    "type": "text/javascript; charset=utf-8",
-    "etag": "\"13f-jMtJt8dAqnEh2SAOR1babBORdK4\"",
-    "mtime": "2026-10-08T11:44:03.918Z",
-    "size": 319,
-    "path": "../public/_nuxt/B6qBWHWB.js"
-  },
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "" , value);
+const SESSION_MS = 12 * 3600 * 1e3;
+const RENEW_MS = 10 * 60 * 1e3;
+const CHALLENGE_MS = 5 * 60 * 1e3;
+const AUTH_COOKIE = "hw_session";
+const CHALLENGE_COOKIE = "hw_challenge";
+class AuthError extends Error {
+  constructor(code, message) {
+    super(message);
+    __publicField(this, "code");
+    this.code = code;
+  }
+}
+function createAuth({ dataDir, log: log2 = () => {
+}, passkeyUser = "herdr" }) {
+  const FILE = path$1.join(dataDir, "auth.json");
+  let db = { secret: null, generation: 0, credentials: [] };
+  try {
+    db = { ...db, ...JSON.parse(fs.readFileSync(FILE, "utf8")) };
+  } catch {
+  }
+  const save = () => {
+    fs.mkdirSync(dataDir, { recursive: true });
+    fs.writeFileSync(FILE, JSON.stringify(db, null, 2) + "\n", { mode: 384 });
+  };
+  if (!db.secret) {
+    db.secret = crypto.randomBytes(32).toString("hex");
+    save();
+  }
+  const bootstrapToken = crypto.randomBytes(24).toString("base64url");
+  if (!db.credentials.length) log2(`First passkey: bootstrap token ${bootstrapToken}`);
+  const enabled = () => db.credentials.length > 0;
+  const sign = (v) => crypto.createHmac("sha256", db.secret).update(v).digest("base64url");
+  const safeEq = (a, b) => {
+    const x = Buffer.from(String(a));
+    const y = Buffer.from(String(b));
+    return x.length === y.length && crypto.timingSafeEqual(x, y);
+  };
+  const readCookie = (req) => {
+    const c = String(req.headers.cookie || "").split(/;\s*/).find((s) => s.startsWith(`${AUTH_COOKIE}=`));
+    if (!c) return null;
+    try {
+      return decodeURIComponent(c.slice(AUTH_COOKIE.length + 1));
+    } catch {
+      return null;
+    }
+  };
+  const challengeClient = (req) => {
+    const c = String(req.headers.cookie || "").split(/;\s*/).find((s) => s.startsWith(`${CHALLENGE_COOKIE}=`));
+    return (c == null ? void 0 : c.slice(CHALLENGE_COOKIE.length + 1)) || null;
+  };
+  const checkBootstrap = (body) => {
+    if (!enabled() && !safeEq(String((body == null ? void 0 : body.bootstrapToken) || ""), bootstrapToken)) {
+      throw new AuthError("bootstrap", "Invalid bootstrap token (see the server logs)");
+    }
+  };
+  const maxSessionMs = () => {
+    var _a;
+    return ((_a = db.maxSessionDays) != null ? _a : DEFAULT_MAX_SESSION_DAYS) * DAY_MS;
+  };
+  function session(req, now = Date.now()) {
+    const v = readCookie(req);
+    if (!v) return null;
+    const parts = v.split(".");
+    if (parts.length !== 3 && parts.length !== 4) return null;
+    const mac = parts.pop();
+    if (!mac || parts[1] !== String(db.generation) || !safeEq(mac, sign(parts.join(".")))) return null;
+    const exp = Number(parts[0]);
+    const since = parts.length === 3 ? Number(parts[2]) : exp - SESSION_MS;
+    if (!(exp >= now) || !Number.isFinite(since)) return null;
+    if (now > since + maxSessionMs() + SESSION_MS) return null;
+    return { exp, since };
+  }
+  function isUnlocked(req) {
+    return !enabled() || session(req) !== null;
+  }
+  const secure = (req) => req.headers["x-forwarded-proto"] === "https" || String(req.headers.origin || "").startsWith("https://") ? "; Secure" : "";
+  function sessionCookie(req, now = Date.now(), since = now) {
+    const exp = now + SESSION_MS;
+    const payload = `${exp}.${db.generation}.${since}`;
+    return `${AUTH_COOKIE}=${payload}.${sign(payload)}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${SESSION_MS / 1e3}${secure(req)}`;
+  }
+  const clearCookie = (req) => `${AUTH_COOKIE}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0${secure(req)}`;
+  function renew(req, now = Date.now()) {
+    if (!enabled()) return null;
+    const s = session(req, now);
+    if (s === null || s.exp - now > SESSION_MS - RENEW_MS) return null;
+    return { cookie: sessionCookie(req, now, s.since), expiresAt: now + SESSION_MS };
+  }
+  function relying(req) {
+    const origin = String(req.headers.origin || "");
+    const { hostname } = new URL(origin);
+    return { origin, rpID: hostname };
+  }
+  const challenges = /* @__PURE__ */ new Map();
+  const challengeKey = (kind, client) => `${kind}:${client}`;
+  const issueChallenge = (req, kind, value) => {
+    const client = crypto.randomBytes(24).toString("base64url");
+    for (const [key, challenge] of challenges) if (challenge.exp < Date.now()) challenges.delete(key);
+    challenges.set(challengeKey(kind, client), { value, exp: Date.now() + CHALLENGE_MS });
+    return `${CHALLENGE_COOKIE}=${client}; Path=/api/auth/; HttpOnly; SameSite=Strict; Max-Age=${CHALLENGE_MS / 1e3}${secure(req)}`;
+  };
+  const takeChallenge = (req, kind) => {
+    const client = challengeClient(req);
+    const key = challengeKey(kind, client || "");
+    const c = challenges.get(key);
+    challenges.delete(key);
+    if (!c || c.exp < Date.now()) throw new AuthError("challenge", "Challenge expired, try again");
+    return c.value;
+  };
+  async function registerOptions(req, body = {}) {
+    if (enabled() && !isUnlocked(req)) throw new AuthError("locked", "Unlock first");
+    checkBootstrap(body);
+    const { rpID } = relying(req);
+    const opts = await generateRegistrationOptions({
+      rpName: "wherdr",
+      rpID,
+      userName: passkeyUser,
+      userDisplayName: passkeyUser,
+      attestationType: "none",
+      excludeCredentials: db.credentials.map((c) => ({ id: c.id, transports: c.transports })),
+      authenticatorSelection: { residentKey: "preferred", userVerification: "required" }
+    });
+    return { ...opts, __cookie: issueChallenge(req, "reg", opts.challenge) };
+  }
+  async function registerVerify(req, body) {
+    if (enabled() && !isUnlocked(req)) throw new AuthError("locked", "Unlock first");
+    checkBootstrap(body);
+    const { origin, rpID } = relying(req);
+    const v = await verifyRegistrationResponse({
+      response: body.response,
+      expectedChallenge: takeChallenge(req, "reg"),
+      expectedOrigin: origin,
+      expectedRPID: rpID,
+      requireUserVerification: true
+    });
+    if (!v.verified || !v.registrationInfo) throw new AuthError("rejected", "Key rejected");
+    const { credential } = v.registrationInfo;
+    db.credentials.push({
+      id: credential.id,
+      publicKey: Buffer.from(credential.publicKey).toString("base64url"),
+      counter: credential.counter,
+      transports: credential.transports || [],
+      name: String(body.name || "Device").slice(0, 40),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    save();
+    log2(`lock: key registered (${db.credentials.length})`);
+    return { ok: true, __cookie: sessionCookie(req) };
+  }
+  async function loginOptions(req) {
+    const { rpID } = relying(req);
+    const opts = await generateAuthenticationOptions({
+      rpID,
+      userVerification: "required",
+      allowCredentials: db.credentials.map((c) => ({ id: c.id, transports: c.transports }))
+    });
+    return { ...opts, __cookie: issueChallenge(req, "auth", opts.challenge) };
+  }
+  async function loginVerify(req, body) {
+    const { origin, rpID } = relying(req);
+    const cred = db.credentials.find((c) => c.id === (body.response && body.response.id));
+    if (!cred) throw new AuthError("unknown_key", "Key unknown on this server");
+    const v = await verifyAuthenticationResponse({
+      response: body.response,
+      expectedChallenge: takeChallenge(req, "auth"),
+      expectedOrigin: origin,
+      expectedRPID: rpID,
+      requireUserVerification: true,
+      credential: { id: cred.id, publicKey: Buffer.from(cred.publicKey, "base64url"), counter: cred.counter, transports: cred.transports }
+    });
+    if (!v.verified) throw new AuthError("rejected", "Unlock rejected");
+    cred.counter = v.authenticationInfo.newCounter;
+    cred.lastUsed = (/* @__PURE__ */ new Date()).toISOString();
+    save();
+    return { ok: true, __cookie: sessionCookie(req) };
+  }
+  function disable(req) {
+    if (!isUnlocked(req)) throw new AuthError("locked", "Unlock first");
+    db.credentials = [];
+    db.generation += 1;
+    save();
+    log2("lock disabled");
+    return { ok: true, __cookie: clearCookie(req) };
+  }
+  function lockAll(req) {
+    if (!enabled() || !isUnlocked(req)) throw new AuthError("locked", "Unlock first");
+    db.generation += 1;
+    save();
+    log2("lock: all devices locked");
+    return { ok: true, __cookie: clearCookie(req) };
+  }
+  function setMaxSession(req, days) {
+    if (!enabled() || !isUnlocked(req)) throw new AuthError("locked", "Unlock first");
+    if (!isMaxSessionDays(days)) throw new AuthError("invalid", "Invalid duration");
+    db.maxSessionDays = days;
+    save();
+    return { ok: true, maxSessionDays: days };
+  }
+  function status(req, { resume = false, now = Date.now() } = {}) {
+    var _a, _b;
+    const devices = db.credentials.map((c) => ({ name: c.name, createdAt: c.createdAt, lastUsed: c.lastUsed || null }));
+    if (!enabled()) return { enabled: false, unlocked: true, devices };
+    const s = session(req, now);
+    const deadline = s ? s.since + maxSessionMs() : 0;
+    if (!s || resume && now >= deadline) {
+      return { enabled: true, unlocked: false, expiresAt: null, now, devices, ...s ? { __cookie: clearCookie(req) } : {} };
+    }
+    const renewed = renew(req, now);
+    return {
+      enabled: true,
+      unlocked: true,
+      expiresAt: (_a = renewed == null ? void 0 : renewed.expiresAt) != null ? _a : s.exp,
+      deadline,
+      now,
+      maxSessionDays: (_b = db.maxSessionDays) != null ? _b : DEFAULT_MAX_SESSION_DAYS,
+      devices,
+      ...renewed ? { __cookie: renewed.cookie } : {}
+    };
+  }
+  return {
+    isUnlocked,
+    status,
+    renew,
+    registerOptions,
+    registerVerify,
+    loginOptions,
+    loginVerify,
+    disable,
+    lockAll,
+    setMaxSession,
+    lock: (req) => ({ ok: true, __cookie: clearCookie(req) }),
+    // For tests.
+    _sessionCookie: sessionCookie,
+    _db: () => db,
+    _bootstrapToken: () => bootstrapToken,
+    _takeChallenge: takeChallenge
+  };
+}
+
+const auth = createAuth({ dataDir: DATA_DIR, log, passkeyUser: PASSKEY_USER });
+const reqOf = (event) => ({ headers: getRequestHeaders(event) });
+function sameOrigin(headers) {
+  const o = headers.origin;
+  if (!o) return false;
+  try {
+    return new URL(o).host === headers.host;
+  } catch {
+    return false;
+  }
+}
+const BODY_MAX = 256 * 1024;
+function sendError(event, status, body) {
+  setResponseStatus(event, status);
+  setResponseHeader(event, "cache-control", "no-store");
+  return body;
+}
+function defineApi(fn, opts = {}) {
+  return defineEventHandler(async (event) => {
+    const url = getRequestURL(event);
+    try {
+      let body = {};
+      if (event.method === "POST") {
+        const headers = getRequestHeaders(event);
+        const ctype = String(headers["content-type"] || "");
+        const typeOk = opts.raw ? opts.raw.test(ctype) : ctype.startsWith("application/json");
+        if (!sameOrigin(headers) || !typeOk) return sendError(event, 403, { error: "Origin refused" });
+        const max = opts.raw ? opts.max || 20 * 1024 * 1024 : BODY_MAX;
+        const tooLarge = opts.raw ? opts.tooLarge || "Image too large (20 MB max)" : "Request too large";
+        if (Number(headers["content-length"] || 0) > max) throw new HerdrError("too_large", tooLarge);
+        const raw = await readRawBody(event, false);
+        if (raw && raw.length > max) throw new HerdrError("too_large", tooLarge);
+        if (opts.raw) body = { data: raw || Buffer.alloc(0), ctype };
+        else {
+          try {
+            body = raw && raw.length ? JSON.parse(raw.toString("utf8")) : {};
+          } catch {
+            throw new HerdrError("bad_json", "Invalid JSON");
+          }
+        }
+      }
+      const out = await fn(event, body);
+      setResponseHeader(event, "cache-control", "no-store");
+      if (out && typeof out === "object" && "__cookie" in out) {
+        const o = out;
+        setResponseHeader(event, "set-cookie", String(o.__cookie));
+        delete o.__cookie;
+      }
+      return out;
+    } catch (e) {
+      const err = e;
+      const known = e instanceof HerdrError || url.pathname.startsWith("/api/auth/") && Boolean(err.code);
+      const code = known ? err.code : "internal";
+      if (!known) log("error", event.method, url.pathname, e);
+      const status = err.code === "unreachable" ? 503 : err.code === "locked" ? 401 : 400;
+      return sendError(event, status, { error: err.message, code });
+    }
+  });
+}
+function sendImage(event, img) {
+  setResponseHeader(event, "content-type", img.type);
+  setResponseHeader(event, "cache-control", "private, max-age=86400");
+  setResponseHeader(event, "x-content-type-options", "nosniff");
+  setResponseHeader(event, "content-security-policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox");
+  return img.body;
+}
+
+const PORT = String(process.env.NITRO_PORT || process.env.PORT || 3e3);
+const LOOPBACK = { "localhost": true, "127.0.0.1": true, "::1": true };
+function phoneAccess(event) {
+  const req = reqOf(event);
+  const lock = auth.status(req);
+  if (lock.enabled && lock.unlocked) return true;
+  const headers = getRequestHeaders(event);
+  let host = "";
+  try {
+    host = new URL(`http://${headers.host || ""}`).hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  } catch {
+    return false;
+  }
+  const proxied = Object.keys(headers).some((k) => k === "x-forwarded-for" || k === "forwarded" || k.startsWith("tailscale-"));
+  const peer = (event.node.req.socket.remoteAddress || "").replace(/^::ffff:/, "");
+  const localPeer = /^127\./.test(peer) || peer === "::1" || IN_DOCKER && peer === dockerGateway();
+  return Boolean(LOOPBACK[host]) && !proxied && localPeer;
+}
+function dockerGateway() {
+  try {
+    const row = fs.readFileSync("/proc/net/route", "utf8").split("\n").map((l) => l.trim().split(/\s+/)).find((f) => f[1] === "00000000");
+    const hex = row == null ? void 0 : row[2];
+    return hex ? [3, 2, 1, 0].map((i) => String(Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16))).join(".") : "";
+  } catch {
+    return "";
+  }
+}
+let adopted = (() => {
+  var _a;
+  try {
+    return ((_a = JSON.parse(fs.readFileSync(APP_URL_FILE, "utf8"))) == null ? void 0 : _a.source) === "serve";
+  } catch {
+    return false;
+  }
+})();
+function saveAppUrl(url, fromServe = false) {
+  if (process.env.APP_URL === url && (adopted || !fromServe)) return;
+  fs.mkdirSync(DATA_DIR, { recursive: true });
+  fs.writeFileSync(APP_URL_FILE, `${JSON.stringify(fromServe ? { url, source: "serve" } : { url }, null, 2)}
+`);
+  adopted = fromServe;
+  if (process.env.APP_URL === url) return;
+  process.env.APP_URL = url;
+  initVapid();
+  log(`APP_URL set to the phone address ${url}`);
+}
+function forgetAppUrl() {
+  fs.rmSync(APP_URL_FILE, { force: true });
+  const was = process.env.APP_URL;
+  if (BOOT_APP_URL) process.env.APP_URL = BOOT_APP_URL;
+  else delete process.env.APP_URL;
+  initVapid();
+  log(`phone address ${was} is no longer published by tailscale serve: forgotten`);
+}
+function applyServed(served) {
+  if (!served) return;
+  setServedHosts(served);
+  if (ENV_APP_URL) return;
+  const current = process.env.APP_URL || "";
+  if (served.length) saveAppUrl(served.includes(current) ? current : served[0], true);
+  else if (adopted) {
+    if (current !== BOOT_APP_URL) forgetAppUrl();
+    adopted = false;
+  }
+}
+const nameListeners = [];
+function onTailnetName(f) {
+  nameListeners.push(f);
+}
+function tellName(name) {
+  if (name) for (const f of nameListeners) f(name);
+}
+let adoptedAt = 0;
+let adopting = null;
+function adoptServed(maxAgeMs = 0) {
+  if (adopting) return adopting;
+  if (maxAgeMs && Date.now() - adoptedAt < maxAgeMs) return Promise.resolve();
+  const bin = tailscaleBin();
+  adopting = inspect(PORT, bin, bin ? null : tailscaledSocket()).then((net) => {
+    applyServed(net.served);
+    tellName(net.name);
+  }, (e) => {
+    log(`tailscale serve could not be read: ${(e == null ? void 0 : e.message) || e}`);
+  }).finally(() => {
+    adoptedAt = Date.now();
+    adopting = null;
+  });
+  return adopting;
+}
+let watch = null;
+function startTailnetWatch() {
+  void adoptServed();
+  watch = setInterval(() => {
+    void adoptServed();
+  }, TAILNET_REFRESH_MS);
+}
+function stopTailnetWatch() {
+  if (watch) clearInterval(watch);
+  watch = null;
+}
+let typed = "";
+const waitSince = /* @__PURE__ */ new Map();
+async function phoneStatus() {
+  var _a, _b, _c, _d, _e, _f, _g;
+  const bin = tailscaleBin();
+  const socket = bin ? null : tailscaledSocket();
+  const out = {
+    mode: bin ? "native" : IN_DOCKER ? "docker" : "missing",
+    platform: process.platform,
+    port: PORT,
+    connected: false,
+    https: false,
+    url: null,
+    served: false,
+    funnel: false,
+    taken: false,
+    suggested: null,
+    command: publishCommand(PORT),
+    reach: null,
+    reachCause: null,
+    reachStatus: null,
+    checkedAt: null,
+    appUrl: "",
+    appUrlFromEnv: Boolean(ENV_APP_URL),
+    qr: null
+  };
+  if (bin || socket) {
+    const net = await inspect(PORT, bin, socket);
+    applyServed(net.served);
+    tellName(net.name);
+    out.connected = Boolean(net.connected && net.name);
+    out.https = Boolean(net.https);
+    out.served = Boolean((_a = net.phone) == null ? void 0 : _a.served);
+    out.funnel = Boolean((_b = net.phone) == null ? void 0 : _b.funnel);
+    out.taken = Boolean(net.taken);
+    out.suggested = (_d = (_c = net.phone) == null ? void 0 : _c.url) != null ? _d : null;
+    out.url = out.served ? net.phone.url : null;
+  }
+  if (out.mode === "docker") {
+    if (!out.suggested) {
+      let resolv = "";
+      try {
+        resolv = fs.readFileSync("/etc/resolv.conf", "utf8");
+      } catch {
+      }
+      const domain = tailnetDomain(resolv);
+      const machine = (process.env.HOST_LABEL || "").trim().toLowerCase().replace(/[^a-z0-9-]/g, "-");
+      out.suggested = domain && machine ? `https://${machine}.${domain}:${PORT}/` : null;
+    }
+    if (!out.url) out.url = typed || tailnetUrl(process.env.APP_URL);
+    const httpsPort = httpsPortOf(out.url || out.suggested);
+    if (httpsPort) out.command = publishCommand(PORT, httpsPort);
+  }
+  if (out.url) {
+    let p = await probe(out.url, 5e3);
+    if (!out.served && (p.reach === "ok" || p.reach === "host") && !ENV_APP_URL) {
+      saveAppUrl(out.url);
+      if (p.reach === "host") p = await probe(out.url, 5e3);
+    }
+    const since = (_e = waitSince.get(out.url)) != null ? _e : Date.now();
+    if (p.reach === "ok") waitSince.delete(out.url);
+    else waitSince.set(out.url, since);
+    out.reach = phoneReach(p, since);
+    out.reachCause = (_f = p.cause) != null ? _f : null;
+    out.reachStatus = (_g = p.status) != null ? _g : null;
+    out.checkedAt = Date.now();
+  }
+  out.appUrl = process.env.APP_URL || "";
+  if (out.reach === "ok" && out.url) out.qr = qrSvg(out.url);
+  return out;
+}
+function httpsPortOf(url) {
+  try {
+    return url ? new URL(url).port : "";
+  } catch {
+    return "";
+  }
+}
+const fail = async (error, more = {}) => ({ ok: false, error, ...more, status: await phoneStatus() });
+async function phoneAction(body) {
+  var _a;
+  if (body.action === "address") {
+    const url = tailnetUrl(body.url);
+    if (!url) return fail("address");
+    typed = url;
+    return { ok: true, status: await phoneStatus() };
+  }
+  if (body.action !== "publish" && body.action !== "unpublish") return fail("failed", { detail: "Unknown action" });
+  const bin = tailscaleBin();
+  if (!bin) return fail("offline", { link: "https://tailscale.com/download" });
+  const net = await inspect(PORT, bin);
+  if (!net.connected || !net.phone) return fail("offline", { link: "https://tailscale.com/download" });
+  let args;
+  if (body.action === "publish") {
+    if (net.phone.served) return { ok: true, status: await phoneStatus() };
+    if (net.taken) return fail("taken");
+    args = publishArgs(PORT);
+  } else {
+    if (!net.phone.served) return { ok: true, status: await phoneStatus() };
+    args = unpublishArgs(net.phone.httpsPort);
+  }
+  const r = await runTailscale(bin, args);
+  waitSince.clear();
+  log(`tailscale ${args.join(" ")} \u2192 ${r.code}`);
+  if (r.code !== 0) {
+    const known = serveError(r.output);
+    return fail((_a = known == null ? void 0 : known.code) != null ? _a : "failed", { link: known == null ? void 0 : known.link, detail: r.output.trim().slice(-600) });
+  }
+  return { ok: true, status: await phoneStatus() };
+}
+
+const fsp = fs.promises;
+const REFUSED = {
+  archive: "Archives cannot be read by the agent: extract the files first",
+  video: "Videos cannot be read by the agent",
+  audio: "Audio files cannot be read by the agent",
+  office: "Office documents cannot be read by the agent: export to PDF or text first",
+  executable: "Programs and binary files cannot be read by the agent",
+  binary: "Binary files cannot be read by the agent",
+  pdf: "This agent cannot read PDFs: only Claude Code can",
+  too_large: "File too large for the agent",
+  empty: "Empty file"
+};
+async function saveAttachment(data, originalName, paneId) {
+  const pane = findPane(paneId);
+  const m = machineOfPane(paneId);
+  if (!pane || !m) throw new HerdrError("bad_pane", "Pane not found");
+  const check = checkAttachment(pane.agent, { name: originalName, type: "", size: data.length }, data.subarray(0, SNIFF_BYTES));
+  if (check.ok && check.kind === "image") throw new HerdrError("unsupported", "Images go through the photo upload");
+  if (!check.ok) throw new HerdrError(check.reason === "too_large" ? "too_large" : "unsupported", REFUSED[check.reason]);
+  const stored = storedAttachmentName(originalName, /* @__PURE__ */ new Date(), crypto.randomBytes(3).toString("hex"));
+  if (!isStoredAttachmentName(stored)) throw new HerdrError("bad_name", "Invalid file name");
+  let file;
+  if (m instanceof RemoteMachine) {
+    if (m.status !== "online") throw new HerdrError("unreachable", fmt("{machine} is unreachable", { machine: m.label }));
+    file = await m.putUpload(stored, data, "file");
+  } else {
+    file = path$1.join(ATTACH_DIR, stored);
+    if (path$1.dirname(file) !== path$1.resolve(ATTACH_DIR)) throw new HerdrError("bad_name", "Invalid file name");
+    await fsp.mkdir(ATTACH_DIR, { recursive: true, mode: 448 });
+    await fsp.writeFile(file, data, { mode: 384, flag: "wx" });
+  }
+  log(`file received ${stored} (${Math.round(data.length / 1024)} KB, ${check.kind})${m instanceof RemoteMachine ? ` -> ${m.label}` : ""}`);
+  return { path: file, name: stored, kind: check.kind, size: data.length, ref: attachmentRef(pane.agent, check.kind, file) };
+}
+async function cleanAttachments() {
+  try {
+    for (const n of await fsp.readdir(ATTACH_DIR)) {
+      const f = path$1.join(ATTACH_DIR, n);
+      const st = await fsp.lstat(f);
+      if (st.isFile() && Date.now() - st.mtimeMs > UPLOAD_TTL_MS) await fsp.unlink(f);
+    }
+  } catch {
+  }
+}
+
+const _mZt23IdRC2vLuqDtWT6mb7m9BgHXq3U5QrnQ7Z5Hc4c = defineNitroPlugin((nitroApp) => {
+  initVapid();
+  startMachines();
+  startPolling();
+  startThreadLimits();
+  startNotices();
+  startPaneSizes();
+  onTailnetName(adoptTailnetName);
+  startTailnetWatch();
+  cleanUploads();
+  cleanAttachments();
+  const purge = setInterval(() => {
+    cleanUploads();
+    cleanAttachments();
+  }, 6 * 3600 * 1e3);
+  log(`herdr-web \u2014 socket ${HERDR_SOCK}${HERDR_SESSION ? ` (session ${HERDR_SESSION})` : ""}`);
+  nitroApp.hooks.hook("close", () => {
+    stopPolling();
+    stopNotices();
+    stopPaneSizes();
+    stopTailnetWatch();
+    stopMachines();
+    clearInterval(purge);
+  });
+});
+
+const plugins = [
+  _9as7ch5sSe9R7BrbrDE2GGZpuA6oP9uMAcL7iRtRgrw,
+_mZt23IdRC2vLuqDtWT6mb7m9BgHXq3U5QrnQ7Z5Hc4c
+];
+
+const assets = {
+  "/manifest-en.webmanifest": {
+    "type": "application/manifest+json",
+    "etag": "\"260-q1JnCK0/ecdKwgeTve6N4I6/mWI\"",
+    "mtime": "2026-10-10T00:24:14.956Z",
+    "size": 608,
+    "path": "../public/manifest-en.webmanifest"
+  },
+  "/manifest.webmanifest": {
+    "type": "application/manifest+json",
+    "etag": "\"26e-ykoYuj4V8la457yChW3oQTur8RU\"",
+    "mtime": "2026-10-10T00:24:14.956Z",
+    "size": 622,
+    "path": "../public/manifest.webmanifest"
+  },
+  "/sw.js": {
+    "type": "text/javascript; charset=utf-8",
+    "etag": "\"1b1d-wHdIux7mWagbphlmnadZ+jdW3jQ\"",
+    "mtime": "2026-10-10T00:24:15.363Z",
+    "size": 6941,
+    "path": "../public/sw.js"
+  },
+  "/_nuxt/AgentView.C4YOwvZG.css": {
+    "type": "text/css; charset=utf-8",
+    "etag": "\"15c8-yoJUdtWy2mP7U+kxJ717a6Bzxgg\"",
+    "mtime": "2026-10-10T00:24:14.946Z",
+    "size": 5576,
+    "path": "../public/_nuxt/AgentView.C4YOwvZG.css"
+  },
+  "/_nuxt/B7QP1TFs.js": {
+    "type": "text/javascript; charset=utf-8",
+    "etag": "\"1118a-Gc+7ipGEaJc4tPQJbl761DHnbVc\"",
+    "mtime": "2026-10-10T00:24:14.946Z",
+    "size": 70026,
+    "path": "../public/_nuxt/B7QP1TFs.js"
+  },
   "/_nuxt/BDNMzG2s.js": {
     "type": "text/javascript; charset=utf-8",
     "etag": "\"54-MasMfSk/A98C3Gn9uIOxtFxkWNw\"",
-    "mtime": "2026-10-08T11:44:03.918Z",
+    "mtime": "2026-10-10T00:24:14.946Z",
     "size": 84,
     "path": "../public/_nuxt/BDNMzG2s.js"
   },
   "/_nuxt/Bd17z0YL.js": {
     "type": "text/javascript; charset=utf-8",
     "etag": "\"1615-CPDn06/EO3pj6KudXz5uMZ0FkhI\"",
-    "mtime": "2026-10-08T11:44:03.918Z",
+    "mtime": "2026-10-10T00:24:14.946Z",
     "size": 5653,
     "path": "../public/_nuxt/Bd17z0YL.js"
   },
-  "/_nuxt/BpQH8Ho1.js": {
-    "type": "text/javascript; charset=utf-8",
-    "etag": "\"e3-flLwB9P4XX6B82smMHA/xJ0MHtI\"",
-    "mtime": "2026-10-08T11:44:03.918Z",
-    "size": 227,
-    "path": "../public/_nuxt/BpQH8Ho1.js"
-  },
-  "/_nuxt/BMIe8p_3.js": {
-    "type": "text/javascript; charset=utf-8",
-    "etag": "\"1f34c-xbnpB4ou/Yo+mnIWUPmKT1dw6kg\"",
-    "mtime": "2026-10-08T11:44:03.918Z",
-    "size": 127820,
-    "path": "../public/_nuxt/BMIe8p_3.js"
-  },
-  "/_nuxt/C12eXl5z.js": {
+  "/_nuxt/BOpBIziZ.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": "\"3743-LHJuwpFjgipbDnhMaCyj/9CAzuY\"",
-    "mtime": "2026-10-08T11:44:03.918Z",
-    "size": 14147,
-    "path": "../public/_nuxt/C12eXl5z.js"
-  },
-  "/_nuxt/C2T9fQ4f.js": {
-    "type": "text/javascript; charset=utf-8",
-    "etag": "\"238-ULCQ+lAhpp4nPDbIDScqd3xGFLs\"",
-    "mtime": "2026-10-08T11:44:03.918Z",
-    "size": 568,
-    "path": "../public/_nuxt/C2T9fQ4f.js"
+    "etag": "\"17047-w7HRRR9UP7E4j/0+gMWSMH60Me4\"",
+    "mtime": "2026-10-10T00:24:14.946Z",
+    "size": 94279,
+    "path": "../public/_nuxt/BOpBIziZ.js"
   },
   "/_nuxt/CWwyK2XK.js": {
     "type": "text/javascript; charset=utf-8",
     "etag": "\"7e5e-4BG2J9cvS3sx6WQ360LFqNaThyA\"",
-    "mtime": "2026-10-08T11:44:03.918Z",
+    "mtime": "2026-10-10T00:24:14.947Z",
     "size": 32350,
     "path": "../public/_nuxt/CWwyK2XK.js"
   },
-  "/_nuxt/BrAeJIZR.js": {
-    "type": "text/javascript; charset=utf-8",
-    "etag": "\"46cdd-poAuGC5qlfraU64uRa+Yc2AkKhw\"",
-    "mtime": "2026-10-08T11:44:03.918Z",
-    "size": 290013,
-    "path": "../public/_nuxt/BrAeJIZR.js"
-  },
   "/_nuxt/CXG-cOdh.js": {
     "type": "text/javascript; charset=utf-8",
     "etag": "\"d4e-hM6T4bjr/qfJVvSNRqFH3ePHBQY\"",
-    "mtime": "2026-10-08T11:44:03.918Z",
+    "mtime": "2026-10-10T00:24:14.947Z",
     "size": 3406,
     "path": "../public/_nuxt/CXG-cOdh.js"
   },
-  "/_nuxt/CYxHnMNH.js": {
+  "/_nuxt/BWXdFfeg.js": {
+    "type": "text/javascript; charset=utf-8",
+    "etag": "\"39363-ZuVw+u9xjhW/x3aFJmung4q3Pdg\"",
+    "mtime": "2026-10-10T00:24:14.946Z",
+    "size": 234339,
+    "path": "../public/_nuxt/BWXdFfeg.js"
+  },
+  "/_nuxt/Cd8j9O5w.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": "\"16ad4-A0W9NTd4vhWgkMxHSgPh07/MudQ\"",
-    "mtime": "2026-10-08T11:44:03.918Z",
-    "size": 92884,
-    "path": "../public/_nuxt/CYxHnMNH.js"
+    "etag": "\"238-VLnqq4ND3a28No8coqBgt+ad3DA\"",
+    "mtime": "2026-10-10T00:24:14.947Z",
+    "size": 568,
+    "path": "../public/_nuxt/Cd8j9O5w.js"
+  },
+  "/_nuxt/COFCNFpG.js": {
+    "type": "text/javascript; charset=utf-8",
+    "etag": "\"16ee4-rnyLLYmsFymH3XyCdaXwcJEEGuQ\"",
+    "mtime": "2026-10-10T00:24:14.947Z",
+    "size": 93924,
+    "path": "../public/_nuxt/COFCNFpG.js"
   },
   "/_nuxt/Ci8N4mWR.js": {
     "type": "text/javascript; charset=utf-8",
     "etag": "\"2426-fCrTYUyhtdHnTmu6ZJeEttvxVMo\"",
-    "mtime": "2026-10-08T11:44:03.918Z",
+    "mtime": "2026-10-10T00:24:14.947Z",
     "size": 9254,
     "path": "../public/_nuxt/Ci8N4mWR.js"
   },
-  "/_nuxt/CctS2Xn6.js": {
+  "/_nuxt/CkZ8t6uB.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": "\"16078-Cz/Wvlpwr6os4SjIEqnTr9/8LlU\"",
-    "mtime": "2026-10-08T11:44:03.918Z",
-    "size": 90232,
-    "path": "../public/_nuxt/CctS2Xn6.js"
+    "etag": "\"3743-91mhngVNRfpvaYKVJ/QoYV6yh1A\"",
+    "mtime": "2026-10-10T00:24:14.947Z",
+    "size": 14147,
+    "path": "../public/_nuxt/CkZ8t6uB.js"
   },
-  "/_nuxt/DLLQgP0d.js": {
+  "/_nuxt/D7sxNXx1.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": "\"ed-o6vDEpQGmmIRAyMcrFDkG+VrA/Y\"",
-    "mtime": "2026-10-08T11:44:03.919Z",
-    "size": 237,
-    "path": "../public/_nuxt/DLLQgP0d.js"
+    "etag": "\"13f-Neu4hxK7KXpqJx1TOH9mlMOz1nI\"",
+    "mtime": "2026-10-10T00:24:14.947Z",
+    "size": 319,
+    "path": "../public/_nuxt/D7sxNXx1.js"
   },
-  "/_nuxt/CiYar6hg.js": {
+  "/_nuxt/DViwOclv.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": "\"16f07-We6JfDwPvSXrF5YZ4079o5Xc8i8\"",
-    "mtime": "2026-10-08T11:44:03.918Z",
-    "size": 93959,
-    "path": "../public/_nuxt/CiYar6hg.js"
+    "etag": "\"10a-+H4vdCMSTz83KYVa6X+gWZCDDow\"",
+    "mtime": "2026-10-10T00:24:14.947Z",
+    "size": 266,
+    "path": "../public/_nuxt/DViwOclv.js"
   },
-  "/_nuxt/SiL1FJ5s.js": {
+  "/_nuxt/DyBZDSCV.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": "\"176ad-/hlyeMkW67OV1A4G2nhIsYJX+vE\"",
-    "mtime": "2026-10-08T11:44:03.919Z",
-    "size": 95917,
-    "path": "../public/_nuxt/SiL1FJ5s.js"
+    "etag": "\"1f34c-1/LEO6HIPrMJPOnrvbeL2tadMf4\"",
+    "mtime": "2026-10-10T00:24:14.947Z",
+    "size": 127820,
+    "path": "../public/_nuxt/DyBZDSCV.js"
   },
-  "/_nuxt/Dwh-l2rQ.js": {
+  "/_nuxt/DoD7Qb5P.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": "\"3919e-zK0jGmVhIk455555qPCvrLTDhXs\"",
-    "mtime": "2026-10-08T11:44:03.919Z",
-    "size": 233886,
-    "path": "../public/_nuxt/Dwh-l2rQ.js"
+    "etag": "\"4c573-s0WTgDKba5SDqDXhmDa67SGcDHk\"",
+    "mtime": "2026-10-10T00:24:14.947Z",
+    "size": 312691,
+    "path": "../public/_nuxt/DoD7Qb5P.js"
   },
   "/_nuxt/archivo-latin-ext-wght-normal.C4zznr8T.woff2": {
     "type": "font/woff2",
     "etag": "\"7f60-cwHN4xD2RhU0GVBfKzpzYZ7Al6U\"",
-    "mtime": "2026-10-08T11:44:03.919Z",
+    "mtime": "2026-10-10T00:24:14.947Z",
     "size": 32608,
     "path": "../public/_nuxt/archivo-latin-ext-wght-normal.C4zznr8T.woff2"
   },
   "/_nuxt/archivo-latin-wght-normal.E0tuGl4L.woff2": {
     "type": "font/woff2",
     "etag": "\"8870-ZUSfFgU3jYpWYbszVY1rxpynehc\"",
-    "mtime": "2026-10-08T11:44:03.919Z",
+    "mtime": "2026-10-10T00:24:14.947Z",
     "size": 34928,
     "path": "../public/_nuxt/archivo-latin-wght-normal.E0tuGl4L.woff2"
   },
   "/_nuxt/archivo-vietnamese-wght-normal.XAtsl5Q_.woff2": {
     "type": "font/woff2",
     "etag": "\"33b8-4zjQHgOy7y9EDRZs7TDAFDM4Ams\"",
-    "mtime": "2026-10-08T11:44:03.919Z",
+    "mtime": "2026-10-10T00:24:14.947Z",
     "size": 13240,
     "path": "../public/_nuxt/archivo-vietnamese-wght-normal.XAtsl5Q_.woff2"
   },
-  "/_nuxt/WLQjK8uJ.js": {
+  "/_nuxt/SiL1FJ5s.js": {
+    "type": "text/javascript; charset=utf-8",
+    "etag": "\"176ad-/hlyeMkW67OV1A4G2nhIsYJX+vE\"",
+    "mtime": "2026-10-10T00:24:14.947Z",
+    "size": 95917,
+    "path": "../public/_nuxt/SiL1FJ5s.js"
+  },
+  "/_nuxt/D4Yz4rat.js": {
     "type": "text/javascript; charset=utf-8",
-    "etag": "\"9b3fe-Mhwqc5w8lJiuRM/0t8kIRoh6evE\"",
-    "mtime": "2026-10-08T11:44:03.919Z",
-    "size": 635902,
-    "path": "../public/_nuxt/WLQjK8uJ.js"
+    "etag": "\"16234-4R0MEqvg4VFo319EzlQAELnsvis\"",
+    "mtime": "2026-10-10T00:24:14.947Z",
+    "size": 90676,
+    "path": "../public/_nuxt/D4Yz4rat.js"
+  },
+  "/_nuxt/8ksjcuDu.js": {
+    "type": "text/javascript; charset=utf-8",
+    "etag": "\"9d965-5D6213Qjb51iD9KHvuiyUPU3qew\"",
+    "mtime": "2026-10-10T00:24:14.946Z",
+    "size": 645477,
+    "path": "../public/_nuxt/8ksjcuDu.js"
   },
   "/_nuxt/bLP7Jj-b.js": {
     "type": "text/javascript; charset=utf-8",
     "etag": "\"eab-MDKLGS0aoyNdipefSjbM7x6w6Y8\"",
-    "mtime": "2026-10-08T11:44:03.919Z",
+    "mtime": "2026-10-10T00:24:14.948Z",
     "size": 3755,
     "path": "../public/_nuxt/bLP7Jj-b.js"
   },
   "/_nuxt/error-404.Bb87HomL.css": {
     "type": "text/css; charset=utf-8",
     "etag": "\"97d-4h9VfBznldxjqagfMldh1hDncR0\"",
-    "mtime": "2026-10-08T11:44:03.919Z",
+    "mtime": "2026-10-10T00:24:14.948Z",
     "size": 2429,
     "path": "../public/_nuxt/error-404.Bb87HomL.css"
   },
   "/_nuxt/error-500.Bwd7zAaE.css": {
     "type": "text/css; charset=utf-8",
     "etag": "\"772-nqXXACYtFiPK+D42BNu4uEECARA\"",
-    "mtime": "2026-10-08T11:44:03.919Z",
+    "mtime": "2026-10-10T00:24:14.948Z",
     "size": 1906,
     "path": "../public/_nuxt/error-500.Bwd7zAaE.css"
   },
-  "/_nuxt/inter-cyrillic-ext-wght-normal.BOeWTOD4.woff2": {
-    "type": "font/woff2",
-    "etag": "\"6568-cF1iUGbboMFZ8TfnP5HiMgl9II0\"",
-    "mtime": "2026-10-08T11:44:03.919Z",
-    "size": 25960,
-    "path": "../public/_nuxt/inter-cyrillic-ext-wght-normal.BOeWTOD4.woff2"
+  "/_nuxt/hePW80VL.js": {
+    "type": "text/javascript; charset=utf-8",
+    "etag": "\"2cc-fA8td6k29UVF6JoPfhOPkceTK1M\"",
+    "mtime": "2026-10-10T00:24:14.948Z",
+    "size": 716,
+    "path": "../public/_nuxt/hePW80VL.js"
   },
   "/_nuxt/inter-cyrillic-wght-normal.DqGufNeO.woff2": {
     "type": "font/woff2",
     "etag": "\"493c-n3Oy9D6jvzfMjpClqox+Zo7ERQQ\"",
-    "mtime": "2026-10-08T11:44:03.919Z",
+    "mtime": "2026-10-10T00:24:14.948Z",
     "size": 18748,
     "path": "../public/_nuxt/inter-cyrillic-wght-normal.DqGufNeO.woff2"
   },
+  "/_nuxt/inter-cyrillic-ext-wght-normal.BOeWTOD4.woff2": {
+    "type": "font/woff2",
+    "etag": "\"6568-cF1iUGbboMFZ8TfnP5HiMgl9II0\"",
+    "mtime": "2026-10-10T00:24:14.948Z",
+    "size": 25960,
+    "path": "../public/_nuxt/inter-cyrillic-ext-wght-normal.BOeWTOD4.woff2"
+  },
   "/_nuxt/inter-greek-ext-wght-normal.DlzME5K_.woff2": {
     "type": "font/woff2",
     "etag": "\"2be0-BP5iTzJeB8nLqYAgKpWNi5o1Zm8\"",
-    "mtime": "2026-10-08T11:44:03.919Z",
+    "mtime": "2026-10-10T00:24:14.948Z",
     "size": 11232,
     "path": "../public/_nuxt/inter-greek-ext-wght-normal.DlzME5K_.woff2"
   },
+  "/_nuxt/entry.Crt1r4l3.css": {
+    "type": "text/css; charset=utf-8",
+    "etag": "\"60b9f-TZJSjtJYwO9YgW0BvzvwELvXTcA\"",
+    "mtime": "2026-10-10T00:24:14.948Z",
+    "size": 396191,
+    "path": "../public/_nuxt/entry.Crt1r4l3.css"
+  },
   "/_nuxt/inter-greek-wght-normal.CkhJZR-_.woff2": {
     "type": "font/woff2",
     "etag": "\"4a34-xor/hj4YNqI52zFecXnUbzQ4Xs4\"",
-    "mtime": "2026-10-08T11:44:03.920Z",
+    "mtime": "2026-10-10T00:24:14.948Z",
     "size": 18996,
     "path": "../public/_nuxt/inter-greek-wght-normal.CkhJZR-_.woff2"
   },
   "/_nuxt/inter-latin-ext-wght-normal.DO1Apj_S.woff2": {
     "type": "font/woff2",
     "etag": "\"14c4c-zz61D7IQFMB9QxHvTAOk/Vh4ibQ\"",
-    "mtime": "2026-10-08T11:44:03.920Z",
+    "mtime": "2026-10-10T00:24:14.948Z",
     "size": 85068,
     "path": "../public/_nuxt/inter-latin-ext-wght-normal.DO1Apj_S.woff2"
   },
   "/_nuxt/inter-latin-wght-normal.Dx4kXJAl.woff2": {
     "type": "font/woff2",
     "etag": "\"bc80-8R1ym7Ck2DUNLqPQ/AYs9u8tUpg\"",
-    "mtime": "2026-10-08T11:44:03.920Z",
+    "mtime": "2026-10-10T00:24:14.948Z",
     "size": 48256,
     "path": "../public/_nuxt/inter-latin-wght-normal.Dx4kXJAl.woff2"
   },
   "/_nuxt/inter-vietnamese-wght-normal.CBcvBZtf.woff2": {
     "type": "font/woff2",
     "etag": "\"280c-nBythjoDQ0+5wVAendJ6wU7Xz2M\"",
-    "mtime": "2026-10-08T11:44:03.920Z",
+    "mtime": "2026-10-10T00:24:14.948Z",
     "size": 10252,
     "path": "../public/_nuxt/inter-vietnamese-wght-normal.CBcvBZtf.woff2"
   },
   "/_nuxt/jetbrains-mono-cyrillic-wght-normal.D73BlboJ.woff2": {
     "type": "font/woff2",
     "etag": "\"2f4c-WiAGfn140d4QND3ayQWaCHF8rbE\"",
-    "mtime": "2026-10-08T11:44:03.920Z",
+    "mtime": "2026-10-10T00:24:14.948Z",
     "size": 12108,
     "path": "../public/_nuxt/jetbrains-mono-cyrillic-wght-normal.D73BlboJ.woff2"
   },
   "/_nuxt/jetbrains-mono-greek-wght-normal.Bw9x6K1M.woff2": {
     "type": "font/woff2",
     "etag": "\"232c-Dnz9DhH4c266e6TziU1pxRkV6FY\"",
-    "mtime": "2026-10-08T11:44:03.920Z",
+    "mtime": "2026-10-10T00:24:14.948Z",
     "size": 9004,
     "path": "../public/_nuxt/jetbrains-mono-greek-wght-normal.Bw9x6K1M.woff2"
   },
   "/_nuxt/jetbrains-mono-latin-ext-wght-normal.DBQx-q_a.woff2": {
     "type": "font/woff2",
     "etag": "\"3b5c-HLF7Wvs2Z1IA1cPRs6jnor8OUQ4\"",
-    "mtime": "2026-10-08T11:44:03.927Z",
+    "mtime": "2026-10-10T00:24:14.949Z",
     "size": 15196,
     "path": "../public/_nuxt/jetbrains-mono-latin-ext-wght-normal.DBQx-q_a.woff2"
   },
   "/_nuxt/jetbrains-mono-latin-wght-normal.B9CIFXIH.woff2": {
     "type": "font/woff2",
     "etag": "\"9dd4-5yd+cUUhzrXxdMyYebUeD0qml1M\"",
-    "mtime": "2026-10-08T11:44:03.927Z",
+    "mtime": "2026-10-10T00:24:14.949Z",
     "size": 40404,
     "path": "../public/_nuxt/jetbrains-mono-latin-wght-normal.B9CIFXIH.woff2"
   },
-  "/_nuxt/jetbrains-mono-vietnamese-wght-normal.Bt-aOZkq.woff2": {
-    "type": "font/woff2",
-    "etag": "\"1d50-/Re0MyD6BV8h81wBPVijGZH5GBs\"",
-    "mtime": "2026-10-08T11:44:03.927Z",
-    "size": 7504,
-    "path": "../public/_nuxt/jetbrains-mono-vietnamese-wght-normal.Bt-aOZkq.woff2"
-  },
-  "/_nuxt/whFLy_Ne.js": {
-    "type": "text/javascript; charset=utf-8",
-    "etag": "\"10fef-Fe8e6U4rNb//7sdPdQau3Trl7fU\"",
-    "mtime": "2026-10-08T11:44:03.927Z",
-    "size": 69615,
-    "path": "../public/_nuxt/whFLy_Ne.js"
-  },
-  "/_nuxt/entry.cKR16VqG.css": {
-    "type": "text/css; charset=utf-8",
-    "etag": "\"5f50e-lGjGgrLDJlABD7dGL+/Cu4UfQi8\"",
-    "mtime": "2026-10-08T11:44:03.919Z",
-    "size": 390414,
-    "path": "../public/_nuxt/entry.cKR16VqG.css"
-  },
   "/_nuxt/wherdr-nerd-codicons.CtEsfSAf.woff2": {
     "type": "font/woff2",
     "etag": "\"d9b0-kmO/x6KCTFRlVipOvl+5XcArGUw\"",
-    "mtime": "2026-10-08T11:44:03.927Z",
+    "mtime": "2026-10-10T00:24:14.949Z",
     "size": 55728,
     "path": "../public/_nuxt/wherdr-nerd-codicons.CtEsfSAf.woff2"
   },
+  "/_nuxt/jetbrains-mono-vietnamese-wght-normal.Bt-aOZkq.woff2": {
+    "type": "font/woff2",
+    "etag": "\"1d50-/Re0MyD6BV8h81wBPVijGZH5GBs\"",
+    "mtime": "2026-10-10T00:24:14.949Z",
+    "size": 7504,
+    "path": "../public/_nuxt/jetbrains-mono-vietnamese-wght-normal.Bt-aOZkq.woff2"
+  },
   "/_nuxt/wherdr-nerd-awesome.DQ3_iAfa.woff2": {
     "type": "font/woff2",
     "etag": "\"30178-02mpQKEDb74Ec8LtlhKceB1vHO8\"",
-    "mtime": "2026-10-08T11:44:03.927Z",
+    "mtime": "2026-10-10T00:24:14.949Z",
     "size": 196984,
     "path": "../public/_nuxt/wherdr-nerd-awesome.DQ3_iAfa.woff2"
   },
   "/_nuxt/wherdr-nerd-extension.Dai_ky39.woff2": {
     "type": "font/woff2",
     "etag": "\"f76c-CjERGtjtOrkpSXy7JyZNl1CAu0U\"",
-    "mtime": "2026-10-08T11:44:03.927Z",
+    "mtime": "2026-10-10T00:24:14.949Z",
     "size": 63340,
     "path": "../public/_nuxt/wherdr-nerd-extension.Dai_ky39.woff2"
   },
+  "/_nuxt/wherdr-nerd-material-1.BdvqkCqW.woff2": {
+    "type": "font/woff2",
+    "etag": "\"1e130-1GKpbVoJoRf3AxaKTZS8FjxkOd4\"",
+    "mtime": "2026-10-10T00:24:14.949Z",
+    "size": 123184,
+    "path": "../public/_nuxt/wherdr-nerd-material-1.BdvqkCqW.woff2"
+  },
   "/_nuxt/wherdr-nerd-devicons.ZMSFX1sW.woff2": {
     "type": "font/woff2",
     "etag": "\"30f78-2RuGTMLnbTBdhlI9ExApyiUeD8c\"",
-    "mtime": "2026-10-08T11:44:03.927Z",
+    "mtime": "2026-10-10T00:24:14.949Z",
     "size": 200568,
     "path": "../public/_nuxt/wherdr-nerd-devicons.ZMSFX1sW.woff2"
   },
   "/_nuxt/wherdr-nerd-material-2.C_flbBWO.woff2": {
     "type": "font/woff2",
     "etag": "\"1f95c-q6dAP964z2dgEvWzAYjTAzBtzBc\"",
-    "mtime": "2026-10-08T11:44:03.928Z",
+    "mtime": "2026-10-10T00:24:14.949Z",
     "size": 129372,
     "path": "../public/_nuxt/wherdr-nerd-material-2.C_flbBWO.woff2"
   },
   "/_nuxt/wherdr-nerd-material-3.8xz7iX-Y.woff2": {
     "type": "font/woff2",
     "etag": "\"2248c-3GBJ1KjkT+xYPhza9V/DKaILa7Y\"",
-    "mtime": "2026-10-08T11:44:03.928Z",
+    "mtime": "2026-10-10T00:24:14.949Z",
     "size": 140428,
     "path": "../public/_nuxt/wherdr-nerd-material-3.8xz7iX-Y.woff2"
   },
-  "/_nuxt/wherdr-nerd-material-1.BdvqkCqW.woff2": {
-    "type": "font/woff2",
-    "etag": "\"1e130-1GKpbVoJoRf3AxaKTZS8FjxkOd4\"",
-    "mtime": "2026-10-08T11:44:03.927Z",
-    "size": 123184,
-    "path": "../public/_nuxt/wherdr-nerd-material-1.BdvqkCqW.woff2"
-  },
   "/_nuxt/wherdr-nerd-material-4.CO_PudDR.woff2": {
     "type": "font/woff2",
     "etag": "\"1fa80-YcJvpFD/M3vTC4y6SMmp7s8a9gw\"",
-    "mtime": "2026-10-08T11:44:03.928Z",
+    "mtime": "2026-10-10T00:24:14.949Z",
     "size": 129664,
     "path": "../public/_nuxt/wherdr-nerd-material-4.CO_PudDR.woff2"
   },
-  "/_nuxt/wherdr-nerd-powerline.B_kAMxXr.woff2": {
-    "type": "font/woff2",
-    "etag": "\"1bc0-iXm39wQwNbm2VjpVBOn72grfku0\"",
-    "mtime": "2026-10-08T11:44:03.928Z",
-    "size": 7104,
-    "path": "../public/_nuxt/wherdr-nerd-powerline.B_kAMxXr.woff2"
-  },
   "/_nuxt/wherdr-nerd-octicons.Hl4VEx8m.woff2": {
     "type": "font/woff2",
     "etag": "\"f890-FkAsW3iqENK+lU5UlSze0yqnE2s\"",
-    "mtime": "2026-10-08T11:44:03.928Z",
+    "mtime": "2026-10-10T00:24:14.949Z",
     "size": 63632,
     "path": "../public/_nuxt/wherdr-nerd-octicons.Hl4VEx8m.woff2"
   },
+  "/_nuxt/wherdr-nerd-powerline.B_kAMxXr.woff2": {
+    "type": "font/woff2",
+    "etag": "\"1bc0-iXm39wQwNbm2VjpVBOn72grfku0\"",
+    "mtime": "2026-10-10T00:24:14.950Z",
+    "size": 7104,
+    "path": "../public/_nuxt/wherdr-nerd-powerline.B_kAMxXr.woff2"
+  },
   "/_nuxt/wherdr-symbols.C1LsPKmg.woff2": {
     "type": "font/woff2",
     "etag": "\"1304-Lwyr1XiDl3FK38nmS/6Pk9wfiWc\"",
-    "mtime": "2026-10-08T11:44:03.928Z",
+    "mtime": "2026-10-10T00:24:14.950Z",
     "size": 4868,
     "path": "../public/_nuxt/wherdr-symbols.C1LsPKmg.woff2"
   },
   "/_nuxt/yzABg5xl.js": {
     "type": "text/javascript; charset=utf-8",
     "etag": "\"1c49-W7I7waHyF8BfftITNIl1xCbNFQw\"",
-    "mtime": "2026-10-08T11:44:03.928Z",
+    "mtime": "2026-10-10T00:24:14.950Z",
     "size": 7241,
     "path": "../public/_nuxt/yzABg5xl.js"
   },
   "/_nuxt/builds/latest.json": {
     "type": "application/json",
-    "etag": "\"47-InxxMr1b0NpxElCQDYMExsdTFyM\"",
-    "mtime": "2026-10-08T11:44:03.903Z",
+    "etag": "\"47-gUq0w2mhEU+I4n1/G1rUjuC+PWE\"",
+    "mtime": "2026-10-10T00:24:14.921Z",
     "size": 71,
     "path": "../public/_nuxt/builds/latest.json"
   },
-  "/_nuxt/builds/meta/6466b0ab-7935-460c-abdf-2ea632dae6d0.json": {
+  "/_nuxt/builds/meta/7afbf062-5369-4002-b20d-7a582ff6e0f1.json": {
     "type": "application/json",
-    "etag": "\"58-DWte5uFWPeAlfWNx7Bc31+0PHIM\"",
-    "mtime": "2026-10-08T11:44:03.899Z",
-    "size": 88,
-    "path": "../public/_nuxt/builds/meta/6466b0ab-7935-460c-abdf-2ea632dae6d0.json"
-  }
-};
-
-const _DRIVE_LETTER_START_RE = /^[A-Za-z]:\//;
-function normalizeWindowsPath(input = "") {
-  if (!input) {
-    return input;
-  }
-  return input.replace(/\\/g, "/").replace(_DRIVE_LETTER_START_RE, (r) => r.toUpperCase());
-}
-const _IS_ABSOLUTE_RE = /^[/\\](?![/\\])|^[/\\]{2}(?!\.)|^[A-Za-z]:[/\\]/;
-const _DRIVE_LETTER_RE = /^[A-Za-z]:$/;
-const _ROOT_FOLDER_RE = /^\/([A-Za-z]:)?$/;
-function cwd() {
-  if (typeof process !== "undefined" && typeof process.cwd === "function") {
-    return process.cwd().replace(/\\/g, "/");
-  }
-  return "/";
-}
-const resolve = function(...arguments_) {
-  arguments_ = arguments_.map((argument) => normalizeWindowsPath(argument));
-  let resolvedPath = "";
-  let resolvedAbsolute = false;
-  for (let index = arguments_.length - 1; index >= -1 && !resolvedAbsolute; index--) {
-    const path = index >= 0 ? arguments_[index] : cwd();
-    if (!path || path.length === 0) {
-      continue;
-    }
-    resolvedPath = `${path}/${resolvedPath}`;
-    resolvedAbsolute = isAbsolute(path);
-  }
-  resolvedPath = normalizeString(resolvedPath, !resolvedAbsolute);
-  if (resolvedAbsolute && !isAbsolute(resolvedPath)) {
-    return `/${resolvedPath}`;
-  }
-  return resolvedPath.length > 0 ? resolvedPath : ".";
-};
-function normalizeString(path, allowAboveRoot) {
-  let res = "";
-  let lastSegmentLength = 0;
-  let lastSlash = -1;
-  let dots = 0;
-  let char = null;
-  for (let index = 0; index <= path.length; ++index) {
-    if (index < path.length) {
-      char = path[index];
-    } else if (char === "/") {
-      break;
-    } else {
-      char = "/";
-    }
-    if (char === "/") {
-      if (lastSlash === index - 1 || dots === 1) ; else if (dots === 2) {
-        if (res.length < 2 || lastSegmentLength !== 2 || res[res.length - 1] !== "." || res[res.length - 2] !== ".") {
-          if (res.length > 2) {
-            const lastSlashIndex = res.lastIndexOf("/");
-            if (lastSlashIndex === -1) {
-              res = "";
-              lastSegmentLength = 0;
-            } else {
-              res = res.slice(0, lastSlashIndex);
-              lastSegmentLength = res.length - 1 - res.lastIndexOf("/");
-            }
-            lastSlash = index;
-            dots = 0;
-            continue;
-          } else if (res.length > 0) {
-            res = "";
-            lastSegmentLength = 0;
-            lastSlash = index;
-            dots = 0;
-            continue;
-          }
-        }
-        if (allowAboveRoot) {
-          res += res.length > 0 ? "/.." : "..";
-          lastSegmentLength = 2;
-        }
-      } else {
-        if (res.length > 0) {
-          res += `/${path.slice(lastSlash + 1, index)}`;
-        } else {
-          res = path.slice(lastSlash + 1, index);
-        }
-        lastSegmentLength = index - lastSlash - 1;
-      }
-      lastSlash = index;
-      dots = 0;
-    } else if (char === "." && dots !== -1) {
-      ++dots;
-    } else {
-      dots = -1;
-    }
-  }
-  return res;
-}
-const isAbsolute = function(p) {
-  return _IS_ABSOLUTE_RE.test(p);
-};
-const relative = function(from, to) {
-  const _from = resolve(from).replace(_ROOT_FOLDER_RE, "$1").split("/");
-  const _to = resolve(to).replace(_ROOT_FOLDER_RE, "$1").split("/");
-  if (_to[0][1] === ":" && _from[0][1] === ":" && _from[0] !== _to[0]) {
-    return _to.join("/");
-  }
-  const _fromCopy = [..._from];
-  for (const segment of _fromCopy) {
-    if (_to[0] !== segment) {
-      break;
-    }
-    _from.shift();
-    _to.shift();
-  }
-  return [..._from.map(() => ".."), ..._to].join("/");
-};
-const dirname = function(p) {
-  const segments = normalizeWindowsPath(p).replace(/\/$/, "").split("/").slice(0, -1);
-  if (segments.length === 1 && _DRIVE_LETTER_RE.test(segments[0])) {
-    segments[0] += "/";
-  }
-  return segments.join("/") || (isAbsolute(p) ? "/" : ".");
-};
-
-function readAsset (id) {
-  const serverDir = dirname(fileURLToPath(globalThis._importMeta_.url));
-  return promises.readFile(resolve(serverDir, assets[id].path))
-}
-
-const publicAssetBases = {"/_nuxt/builds/meta/":{"maxAge":31536000},"/_nuxt/builds/":{"maxAge":1},"/_nuxt/":{"maxAge":31536000}};
-
-function isPublicAssetURL(id = '') {
-  if (assets[id]) {
-    return true
-  }
-  for (const base in publicAssetBases) {
-    if (id.startsWith(base)) { return true }
-  }
-  return false
-}
-
-function getAsset (id) {
-  return assets[id]
-}
-
-const METHODS = /* @__PURE__ */ new Set(["HEAD", "GET"]);
-const EncodingMap = { gzip: ".gz", br: ".br" };
-const _uN03ln = eventHandler((event) => {
-  if (event.method && !METHODS.has(event.method)) {
-    return;
-  }
-  let id = decodePath(
-    withLeadingSlash(withoutTrailingSlash(parseURL(event.path).pathname))
-  );
-  let asset;
-  const encodingHeader = String(
-    getRequestHeader(event, "accept-encoding") || ""
-  );
-  const encodings = [
-    ...encodingHeader.split(",").map((e) => EncodingMap[e.trim()]).filter(Boolean).sort(),
-    ""
-  ];
-  for (const encoding of encodings) {
-    for (const _id of [id + encoding, joinURL(id, "index.html" + encoding)]) {
-      const _asset = getAsset(_id);
-      if (_asset) {
-        asset = _asset;
-        id = _id;
-        break;
-      }
-    }
-  }
-  if (!asset) {
-    if (isPublicAssetURL(id)) {
-      removeResponseHeader(event, "Cache-Control");
-      throw createError$1({ statusCode: 404 });
-    }
-    return;
-  }
-  if (asset.encoding !== void 0) {
-    appendResponseHeader(event, "Vary", "Accept-Encoding");
-  }
-  const ifNotMatch = getRequestHeader(event, "if-none-match") === asset.etag;
-  if (ifNotMatch) {
-    setResponseStatus(event, 304, "Not Modified");
-    return "";
-  }
-  const ifModifiedSinceH = getRequestHeader(event, "if-modified-since");
-  const mtimeDate = new Date(asset.mtime);
-  if (ifModifiedSinceH && asset.mtime && new Date(ifModifiedSinceH) >= mtimeDate) {
-    setResponseStatus(event, 304, "Not Modified");
-    return "";
-  }
-  if (asset.type && !getResponseHeader(event, "Content-Type")) {
-    setResponseHeader(event, "Content-Type", asset.type);
-  }
-  if (asset.etag && !getResponseHeader(event, "ETag")) {
-    setResponseHeader(event, "ETag", asset.etag);
-  }
-  if (asset.mtime && !getResponseHeader(event, "Last-Modified")) {
-    setResponseHeader(event, "Last-Modified", mtimeDate.toUTCString());
-  }
-  if (asset.encoding && !getResponseHeader(event, "Content-Encoding")) {
-    setResponseHeader(event, "Content-Encoding", asset.encoding);
-  }
-  if (asset.size > 0 && !getResponseHeader(event, "Content-Length")) {
-    setResponseHeader(event, "Content-Length", asset.size);
-  }
-  return readAsset(id);
-});
-
-const MAX_SESSION_DAYS = [1, 7, 30, 90, 365];
-const DEFAULT_MAX_SESSION_DAYS = 7;
-const DAY_MS = 24 * 3600 * 1e3;
-function isMaxSessionDays(v) {
-  return MAX_SESSION_DAYS.includes(v);
-}
-
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => __defNormalProp(obj, key + "" , value);
-const SESSION_MS = 12 * 3600 * 1e3;
-const RENEW_MS = 10 * 60 * 1e3;
-const CHALLENGE_MS = 5 * 60 * 1e3;
-const AUTH_COOKIE = "hw_session";
-const CHALLENGE_COOKIE = "hw_challenge";
-class AuthError extends Error {
-  constructor(code, message) {
-    super(message);
-    __publicField(this, "code");
-    this.code = code;
+    "etag": "\"58-LQMKUB4Jlz4hjuTcu/d4TGQA1Kc\"",
+    "mtime": "2026-10-10T00:24:14.916Z",
+    "size": 88,
+    "path": "../public/_nuxt/builds/meta/7afbf062-5369-4002-b20d-7a582ff6e0f1.json"
   }
-}
-function createAuth({ dataDir, log: log2 = () => {
-}, passkeyUser = "herdr" }) {
-  const FILE = path$1.join(dataDir, "auth.json");
-  let db = { secret: null, generation: 0, credentials: [] };
-  try {
-    db = { ...db, ...JSON.parse(fs.readFileSync(FILE, "utf8")) };
-  } catch {
+};
+
+const _DRIVE_LETTER_START_RE = /^[A-Za-z]:\//;
+function normalizeWindowsPath(input = "") {
+  if (!input) {
+    return input;
   }
-  const save = () => {
-    fs.mkdirSync(dataDir, { recursive: true });
-    fs.writeFileSync(FILE, JSON.stringify(db, null, 2) + "\n", { mode: 384 });
-  };
-  if (!db.secret) {
-    db.secret = crypto.randomBytes(32).toString("hex");
-    save();
+  return input.replace(/\\/g, "/").replace(_DRIVE_LETTER_START_RE, (r) => r.toUpperCase());
+}
+const _IS_ABSOLUTE_RE = /^[/\\](?![/\\])|^[/\\]{2}(?!\.)|^[A-Za-z]:[/\\]/;
+const _DRIVE_LETTER_RE = /^[A-Za-z]:$/;
+const _ROOT_FOLDER_RE = /^\/([A-Za-z]:)?$/;
+function cwd() {
+  if (typeof process !== "undefined" && typeof process.cwd === "function") {
+    return process.cwd().replace(/\\/g, "/");
   }
-  const bootstrapToken = crypto.randomBytes(24).toString("base64url");
-  if (!db.credentials.length) log2(`First passkey: bootstrap token ${bootstrapToken}`);
-  const enabled = () => db.credentials.length > 0;
-  const sign = (v) => crypto.createHmac("sha256", db.secret).update(v).digest("base64url");
-  const safeEq = (a, b) => {
-    const x = Buffer.from(String(a));
-    const y = Buffer.from(String(b));
-    return x.length === y.length && crypto.timingSafeEqual(x, y);
-  };
-  const readCookie = (req) => {
-    const c = String(req.headers.cookie || "").split(/;\s*/).find((s) => s.startsWith(`${AUTH_COOKIE}=`));
-    if (!c) return null;
-    try {
-      return decodeURIComponent(c.slice(AUTH_COOKIE.length + 1));
-    } catch {
-      return null;
-    }
-  };
-  const challengeClient = (req) => {
-    const c = String(req.headers.cookie || "").split(/;\s*/).find((s) => s.startsWith(`${CHALLENGE_COOKIE}=`));
-    return (c == null ? void 0 : c.slice(CHALLENGE_COOKIE.length + 1)) || null;
-  };
-  const checkBootstrap = (body) => {
-    if (!enabled() && !safeEq(String((body == null ? void 0 : body.bootstrapToken) || ""), bootstrapToken)) {
-      throw new AuthError("bootstrap", "Invalid bootstrap token (see the server logs)");
+  return "/";
+}
+const resolve = function(...arguments_) {
+  arguments_ = arguments_.map((argument) => normalizeWindowsPath(argument));
+  let resolvedPath = "";
+  let resolvedAbsolute = false;
+  for (let index = arguments_.length - 1; index >= -1 && !resolvedAbsolute; index--) {
+    const path = index >= 0 ? arguments_[index] : cwd();
+    if (!path || path.length === 0) {
+      continue;
     }
-  };
-  const maxSessionMs = () => {
-    var _a;
-    return ((_a = db.maxSessionDays) != null ? _a : DEFAULT_MAX_SESSION_DAYS) * DAY_MS;
-  };
-  function session(req, now = Date.now()) {
-    const v = readCookie(req);
-    if (!v) return null;
-    const parts = v.split(".");
-    if (parts.length !== 3 && parts.length !== 4) return null;
-    const mac = parts.pop();
-    if (!mac || parts[1] !== String(db.generation) || !safeEq(mac, sign(parts.join(".")))) return null;
-    const exp = Number(parts[0]);
-    const since = parts.length === 3 ? Number(parts[2]) : exp - SESSION_MS;
-    if (!(exp >= now) || !Number.isFinite(since)) return null;
-    if (now > since + maxSessionMs() + SESSION_MS) return null;
-    return { exp, since };
-  }
-  function isUnlocked(req) {
-    return !enabled() || session(req) !== null;
-  }
-  const secure = (req) => req.headers["x-forwarded-proto"] === "https" || String(req.headers.origin || "").startsWith("https://") ? "; Secure" : "";
-  function sessionCookie(req, now = Date.now(), since = now) {
-    const exp = now + SESSION_MS;
-    const payload = `${exp}.${db.generation}.${since}`;
-    return `${AUTH_COOKIE}=${payload}.${sign(payload)}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${SESSION_MS / 1e3}${secure(req)}`;
-  }
-  const clearCookie = (req) => `${AUTH_COOKIE}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0${secure(req)}`;
-  function renew(req, now = Date.now()) {
-    if (!enabled()) return null;
-    const s = session(req, now);
-    if (s === null || s.exp - now > SESSION_MS - RENEW_MS) return null;
-    return { cookie: sessionCookie(req, now, s.since), expiresAt: now + SESSION_MS };
-  }
-  function relying(req) {
-    const origin = String(req.headers.origin || "");
-    const { hostname } = new URL(origin);
-    return { origin, rpID: hostname };
-  }
-  const challenges = /* @__PURE__ */ new Map();
-  const challengeKey = (kind, client) => `${kind}:${client}`;
-  const issueChallenge = (req, kind, value) => {
-    const client = crypto.randomBytes(24).toString("base64url");
-    for (const [key, challenge] of challenges) if (challenge.exp < Date.now()) challenges.delete(key);
-    challenges.set(challengeKey(kind, client), { value, exp: Date.now() + CHALLENGE_MS });
-    return `${CHALLENGE_COOKIE}=${client}; Path=/api/auth/; HttpOnly; SameSite=Strict; Max-Age=${CHALLENGE_MS / 1e3}${secure(req)}`;
-  };
-  const takeChallenge = (req, kind) => {
-    const client = challengeClient(req);
-    const key = challengeKey(kind, client || "");
-    const c = challenges.get(key);
-    challenges.delete(key);
-    if (!c || c.exp < Date.now()) throw new AuthError("challenge", "Challenge expired, try again");
-    return c.value;
-  };
-  async function registerOptions(req, body = {}) {
-    if (enabled() && !isUnlocked(req)) throw new AuthError("locked", "Unlock first");
-    checkBootstrap(body);
-    const { rpID } = relying(req);
-    const opts = await generateRegistrationOptions({
-      rpName: "wherdr",
-      rpID,
-      userName: passkeyUser,
-      userDisplayName: passkeyUser,
-      attestationType: "none",
-      excludeCredentials: db.credentials.map((c) => ({ id: c.id, transports: c.transports })),
-      authenticatorSelection: { residentKey: "preferred", userVerification: "required" }
-    });
-    return { ...opts, __cookie: issueChallenge(req, "reg", opts.challenge) };
-  }
-  async function registerVerify(req, body) {
-    if (enabled() && !isUnlocked(req)) throw new AuthError("locked", "Unlock first");
-    checkBootstrap(body);
-    const { origin, rpID } = relying(req);
-    const v = await verifyRegistrationResponse({
-      response: body.response,
-      expectedChallenge: takeChallenge(req, "reg"),
-      expectedOrigin: origin,
-      expectedRPID: rpID,
-      requireUserVerification: true
-    });
-    if (!v.verified || !v.registrationInfo) throw new AuthError("rejected", "Key rejected");
-    const { credential } = v.registrationInfo;
-    db.credentials.push({
-      id: credential.id,
-      publicKey: Buffer.from(credential.publicKey).toString("base64url"),
-      counter: credential.counter,
-      transports: credential.transports || [],
-      name: String(body.name || "Device").slice(0, 40),
-      createdAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
-    save();
-    log2(`lock: key registered (${db.credentials.length})`);
-    return { ok: true, __cookie: sessionCookie(req) };
-  }
-  async function loginOptions(req) {
-    const { rpID } = relying(req);
-    const opts = await generateAuthenticationOptions({
-      rpID,
-      userVerification: "required",
-      allowCredentials: db.credentials.map((c) => ({ id: c.id, transports: c.transports }))
-    });
-    return { ...opts, __cookie: issueChallenge(req, "auth", opts.challenge) };
-  }
-  async function loginVerify(req, body) {
-    const { origin, rpID } = relying(req);
-    const cred = db.credentials.find((c) => c.id === (body.response && body.response.id));
-    if (!cred) throw new AuthError("unknown_key", "Key unknown on this server");
-    const v = await verifyAuthenticationResponse({
-      response: body.response,
-      expectedChallenge: takeChallenge(req, "auth"),
-      expectedOrigin: origin,
-      expectedRPID: rpID,
-      requireUserVerification: true,
-      credential: { id: cred.id, publicKey: Buffer.from(cred.publicKey, "base64url"), counter: cred.counter, transports: cred.transports }
-    });
-    if (!v.verified) throw new AuthError("rejected", "Unlock rejected");
-    cred.counter = v.authenticationInfo.newCounter;
-    cred.lastUsed = (/* @__PURE__ */ new Date()).toISOString();
-    save();
-    return { ok: true, __cookie: sessionCookie(req) };
+    resolvedPath = `${path}/${resolvedPath}`;
+    resolvedAbsolute = isAbsolute(path);
   }
-  function disable(req) {
-    if (!isUnlocked(req)) throw new AuthError("locked", "Unlock first");
-    db.credentials = [];
-    db.generation += 1;
-    save();
-    log2("lock disabled");
-    return { ok: true, __cookie: clearCookie(req) };
+  resolvedPath = normalizeString(resolvedPath, !resolvedAbsolute);
+  if (resolvedAbsolute && !isAbsolute(resolvedPath)) {
+    return `/${resolvedPath}`;
   }
-  function lockAll(req) {
-    if (!enabled() || !isUnlocked(req)) throw new AuthError("locked", "Unlock first");
-    db.generation += 1;
-    save();
-    log2("lock: all devices locked");
-    return { ok: true, __cookie: clearCookie(req) };
+  return resolvedPath.length > 0 ? resolvedPath : ".";
+};
+function normalizeString(path, allowAboveRoot) {
+  let res = "";
+  let lastSegmentLength = 0;
+  let lastSlash = -1;
+  let dots = 0;
+  let char = null;
+  for (let index = 0; index <= path.length; ++index) {
+    if (index < path.length) {
+      char = path[index];
+    } else if (char === "/") {
+      break;
+    } else {
+      char = "/";
+    }
+    if (char === "/") {
+      if (lastSlash === index - 1 || dots === 1) ; else if (dots === 2) {
+        if (res.length < 2 || lastSegmentLength !== 2 || res[res.length - 1] !== "." || res[res.length - 2] !== ".") {
+          if (res.length > 2) {
+            const lastSlashIndex = res.lastIndexOf("/");
+            if (lastSlashIndex === -1) {
+              res = "";
+              lastSegmentLength = 0;
+            } else {
+              res = res.slice(0, lastSlashIndex);
+              lastSegmentLength = res.length - 1 - res.lastIndexOf("/");
+            }
+            lastSlash = index;
+            dots = 0;
+            continue;
+          } else if (res.length > 0) {
+            res = "";
+            lastSegmentLength = 0;
+            lastSlash = index;
+            dots = 0;
+            continue;
+          }
+        }
+        if (allowAboveRoot) {
+          res += res.length > 0 ? "/.." : "..";
+          lastSegmentLength = 2;
+        }
+      } else {
+        if (res.length > 0) {
+          res += `/${path.slice(lastSlash + 1, index)}`;
+        } else {
+          res = path.slice(lastSlash + 1, index);
+        }
+        lastSegmentLength = index - lastSlash - 1;
+      }
+      lastSlash = index;
+      dots = 0;
+    } else if (char === "." && dots !== -1) {
+      ++dots;
+    } else {
+      dots = -1;
+    }
   }
-  function setMaxSession(req, days) {
-    if (!enabled() || !isUnlocked(req)) throw new AuthError("locked", "Unlock first");
-    if (!isMaxSessionDays(days)) throw new AuthError("invalid", "Invalid duration");
-    db.maxSessionDays = days;
-    save();
-    return { ok: true, maxSessionDays: days };
+  return res;
+}
+const isAbsolute = function(p) {
+  return _IS_ABSOLUTE_RE.test(p);
+};
+const relative = function(from, to) {
+  const _from = resolve(from).replace(_ROOT_FOLDER_RE, "$1").split("/");
+  const _to = resolve(to).replace(_ROOT_FOLDER_RE, "$1").split("/");
+  if (_to[0][1] === ":" && _from[0][1] === ":" && _from[0] !== _to[0]) {
+    return _to.join("/");
   }
-  function status(req, { resume = false, now = Date.now() } = {}) {
-    var _a, _b;
-    const devices = db.credentials.map((c) => ({ name: c.name, createdAt: c.createdAt, lastUsed: c.lastUsed || null }));
-    if (!enabled()) return { enabled: false, unlocked: true, devices };
-    const s = session(req, now);
-    const deadline = s ? s.since + maxSessionMs() : 0;
-    if (!s || resume && now >= deadline) {
-      return { enabled: true, unlocked: false, expiresAt: null, now, devices, ...s ? { __cookie: clearCookie(req) } : {} };
+  const _fromCopy = [..._from];
+  for (const segment of _fromCopy) {
+    if (_to[0] !== segment) {
+      break;
     }
-    const renewed = renew(req, now);
-    return {
-      enabled: true,
-      unlocked: true,
-      expiresAt: (_a = renewed == null ? void 0 : renewed.expiresAt) != null ? _a : s.exp,
-      deadline,
-      now,
-      maxSessionDays: (_b = db.maxSessionDays) != null ? _b : DEFAULT_MAX_SESSION_DAYS,
-      devices,
-      ...renewed ? { __cookie: renewed.cookie } : {}
-    };
+    _from.shift();
+    _to.shift();
   }
-  return {
-    isUnlocked,
-    status,
-    renew,
-    registerOptions,
-    registerVerify,
-    loginOptions,
-    loginVerify,
-    disable,
-    lockAll,
-    setMaxSession,
-    lock: (req) => ({ ok: true, __cookie: clearCookie(req) }),
-    // For tests.
-    _sessionCookie: sessionCookie,
-    _db: () => db,
-    _bootstrapToken: () => bootstrapToken,
-    _takeChallenge: takeChallenge
-  };
+  return [..._from.map(() => ".."), ..._to].join("/");
+};
+const dirname = function(p) {
+  const segments = normalizeWindowsPath(p).replace(/\/$/, "").split("/").slice(0, -1);
+  if (segments.length === 1 && _DRIVE_LETTER_RE.test(segments[0])) {
+    segments[0] += "/";
+  }
+  return segments.join("/") || (isAbsolute(p) ? "/" : ".");
+};
+
+function readAsset (id) {
+  const serverDir = dirname(fileURLToPath(globalThis._importMeta_.url));
+  return promises.readFile(resolve(serverDir, assets[id].path))
 }
 
-const auth = createAuth({ dataDir: DATA_DIR, log, passkeyUser: PASSKEY_USER });
-const reqOf = (event) => ({ headers: getRequestHeaders(event) });
-function sameOrigin(headers) {
-  const o = headers.origin;
-  if (!o) return false;
-  try {
-    return new URL(o).host === headers.host;
-  } catch {
-    return false;
+const publicAssetBases = {"/_nuxt/builds/meta/":{"maxAge":31536000},"/_nuxt/builds/":{"maxAge":1},"/_nuxt/":{"maxAge":31536000}};
+
+function isPublicAssetURL(id = '') {
+  if (assets[id]) {
+    return true
   }
+  for (const base in publicAssetBases) {
+    if (id.startsWith(base)) { return true }
+  }
+  return false
 }
-const BODY_MAX = 256 * 1024;
-function sendError(event, status, body) {
-  setResponseStatus(event, status);
-  setResponseHeader(event, "cache-control", "no-store");
-  return body;
+
+function getAsset (id) {
+  return assets[id]
 }
-function defineApi(fn, opts = {}) {
-  return defineEventHandler(async (event) => {
-    const url = getRequestURL(event);
-    try {
-      let body = {};
-      if (event.method === "POST") {
-        const headers = getRequestHeaders(event);
-        const ctype = String(headers["content-type"] || "");
-        const typeOk = opts.raw ? opts.raw.test(ctype) : ctype.startsWith("application/json");
-        if (!sameOrigin(headers) || !typeOk) return sendError(event, 403, { error: "Origin refused" });
-        const max = opts.raw ? opts.max || 20 * 1024 * 1024 : BODY_MAX;
-        const tooLarge = opts.raw ? opts.tooLarge || "Image too large (20 MB max)" : "Request too large";
-        if (Number(headers["content-length"] || 0) > max) throw new HerdrError("too_large", tooLarge);
-        const raw = await readRawBody(event, false);
-        if (raw && raw.length > max) throw new HerdrError("too_large", tooLarge);
-        if (opts.raw) body = { data: raw || Buffer.alloc(0), ctype };
-        else {
-          try {
-            body = raw && raw.length ? JSON.parse(raw.toString("utf8")) : {};
-          } catch {
-            throw new HerdrError("bad_json", "Invalid JSON");
-          }
-        }
-      }
-      const out = await fn(event, body);
-      setResponseHeader(event, "cache-control", "no-store");
-      if (out && typeof out === "object" && "__cookie" in out) {
-        const o = out;
-        setResponseHeader(event, "set-cookie", String(o.__cookie));
-        delete o.__cookie;
+
+const METHODS = /* @__PURE__ */ new Set(["HEAD", "GET"]);
+const EncodingMap = { gzip: ".gz", br: ".br" };
+const _uN03ln = eventHandler((event) => {
+  if (event.method && !METHODS.has(event.method)) {
+    return;
+  }
+  let id = decodePath(
+    withLeadingSlash(withoutTrailingSlash(parseURL(event.path).pathname))
+  );
+  let asset;
+  const encodingHeader = String(
+    getRequestHeader(event, "accept-encoding") || ""
+  );
+  const encodings = [
+    ...encodingHeader.split(",").map((e) => EncodingMap[e.trim()]).filter(Boolean).sort(),
+    ""
+  ];
+  for (const encoding of encodings) {
+    for (const _id of [id + encoding, joinURL(id, "index.html" + encoding)]) {
+      const _asset = getAsset(_id);
+      if (_asset) {
+        asset = _asset;
+        id = _id;
+        break;
       }
-      return out;
-    } catch (e) {
-      const err = e;
-      const known = e instanceof HerdrError || url.pathname.startsWith("/api/auth/") && Boolean(err.code);
-      const code = known ? err.code : "internal";
-      if (!known) log("error", event.method, url.pathname, e);
-      const status = err.code === "unreachable" ? 503 : err.code === "locked" ? 401 : 400;
-      return sendError(event, status, { error: err.message, code });
     }
-  });
-}
-function sendImage(event, img) {
-  setResponseHeader(event, "content-type", img.type);
-  setResponseHeader(event, "cache-control", "private, max-age=86400");
-  setResponseHeader(event, "x-content-type-options", "nosniff");
-  setResponseHeader(event, "content-security-policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox");
-  return img.body;
-}
-
-function hostname(value) {
-  try {
-    if (!value || /[\s/@?#]/.test(value)) return null;
-    const url = new URL(`http://${value}`);
-    if (url.username || url.password || url.pathname !== "/" || url.search || url.hash) return null;
-    return url.hostname.replace(/^\[|\]$/g, "").toLowerCase().replace(/\.$/, "");
-  } catch {
-    return null;
   }
-}
-function allowedHosts(appUrl2 = process.env.APP_URL || "", extra = process.env.HERDR_WEB_ALLOWED_HOSTS || "", interfaces = os.networkInterfaces()) {
-  const names = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", os.hostname().toLowerCase()]);
-  try {
-    if (appUrl2) names.add(new URL(appUrl2).hostname.toLowerCase().replace(/^\[|\]$/g, ""));
-  } catch {
+  if (!asset) {
+    if (isPublicAssetURL(id)) {
+      removeResponseHeader(event, "Cache-Control");
+      throw createError$1({ statusCode: 404 });
+    }
+    return;
   }
-  for (const addresses of Object.values(interfaces)) {
-    for (const address of addresses || []) names.add(address.address.toLowerCase().replace(/%.+$/, ""));
+  if (asset.encoding !== void 0) {
+    appendResponseHeader(event, "Vary", "Accept-Encoding");
   }
-  for (const item of extra.split(",")) {
-    const name = hostname(item.trim());
-    if (name) names.add(name);
+  const ifNotMatch = getRequestHeader(event, "if-none-match") === asset.etag;
+  if (ifNotMatch) {
+    setResponseStatus(event, 304, "Not Modified");
+    return "";
   }
-  return names;
-}
-function hostAllowed(host, names = allowedHosts()) {
-  const name = hostname(host || "");
-  return Boolean(name && names.has(name));
-}
-function hostRefusalIsHtml(path, accept) {
-  return !path.startsWith("/api/") && /\btext\/html\b/i.test(Array.isArray(accept) ? accept.join(",") : accept || "");
-}
-const HOST_REFUSED_PAGE = `<!doctype html>
-<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
-<meta name="robots" content="noindex"><title>wherdr \xB7 address not enabled</title>
-<style>
-:root{color-scheme:dark}*{box-sizing:border-box}
-body{margin:0;min-height:100vh;display:grid;place-items:center;background:#0d0f12;color:#e8eaed;font:15px/1.5 Inter,system-ui,-apple-system,sans-serif;padding:24px max(16px,env(safe-area-inset-right)) 24px max(16px,env(safe-area-inset-left))}
-main{max-width:440px;border:1px solid #3a3f47;padding:24px}
-.tag{font:11px/1 "JetBrains Mono",ui-monospace,monospace;letter-spacing:.08em;text-transform:uppercase;color:#9aa0a8;margin:0 0 16px}
-h1{font:600 20px/1.25 Archivo,system-ui,sans-serif;margin:0 0 8px}
-p{margin:0 0 8px}hr{border:0;border-top:1px solid #3a3f47;margin:20px 0}
-</style></head><body><main>
-<p class="tag">wherdr \xB7 403</p>
-<h1>This address isn't enabled yet.</h1>
-<p>On the computer, open wherdr \u2192 Settings \u203A Phone (or press Check), then reload.</p>
-<hr>
-<h1 lang="fr">Cette adresse n\u2019est pas encore activ\xE9e.</h1>
-<p lang="fr">Sur l\u2019ordinateur, ouvre wherdr \u2192 R\xE9glages \u203A T\xE9l\xE9phone (ou appuie sur V\xE9rifier), puis recharge.</p>
-</main></body></html>
-`;
-function crossSiteRequest(headers) {
-  const site = headers["sec-fetch-site"];
-  return typeof site === "string" && site !== "same-origin" && site !== "none";
-}
+  const ifModifiedSinceH = getRequestHeader(event, "if-modified-since");
+  const mtimeDate = new Date(asset.mtime);
+  if (ifModifiedSinceH && asset.mtime && new Date(ifModifiedSinceH) >= mtimeDate) {
+    setResponseStatus(event, 304, "Not Modified");
+    return "";
+  }
+  if (asset.type && !getResponseHeader(event, "Content-Type")) {
+    setResponseHeader(event, "Content-Type", asset.type);
+  }
+  if (asset.etag && !getResponseHeader(event, "ETag")) {
+    setResponseHeader(event, "ETag", asset.etag);
+  }
+  if (asset.mtime && !getResponseHeader(event, "Last-Modified")) {
+    setResponseHeader(event, "Last-Modified", mtimeDate.toUTCString());
+  }
+  if (asset.encoding && !getResponseHeader(event, "Content-Encoding")) {
+    setResponseHeader(event, "Content-Encoding", asset.encoding);
+  }
+  if (asset.size > 0 && !getResponseHeader(event, "Content-Length")) {
+    setResponseHeader(event, "Content-Length", asset.size);
+  }
+  return readAsset(id);
+});
 
-const needsUnlock = (p) => p.startsWith("/api/") && !p.startsWith("/api/auth/") || p.startsWith("/uploads/");
-const _M8hgLp = defineEventHandler((event) => {
+const HOST_RECHECK_MS = 3e3;
+const needsUnlock = (p) => p.startsWith("/api/") && !p.startsWith("/api/auth/") && p !== "/api/health" || p.startsWith("/uploads/");
+const _M8hgLp = defineEventHandler(async (event) => {
+  if (!hostAllowed(event.node.req.headers.host)) await adoptServed(HOST_RECHECK_MS);
   if (!hostAllowed(event.node.req.headers.host)) {
     if (hostRefusalIsHtml(event.path.split("?")[0], event.node.req.headers.accept)) {
       setResponseStatus(event, 403);
       setResponseHeader(event, "content-type", "text/html; charset=utf-8");
       setResponseHeader(event, "cache-control", "no-store");
-      return HOST_REFUSED_PAGE;
+      return hostRefusedPage();
     }
     return sendError(event, 403, { error: "Host not allowed", code: "host" });
   }
@@ -20270,6 +21035,7 @@ const _lazy_2uy6Z9 = () => import('../routes/api/effort.post.mjs');
 const _lazy_7FhJOq = () => import('../routes/api/efforts.get.mjs');
 const _lazy_Wg_MPT = () => import('../routes/api/file.post.mjs');
 const _lazy_kEWyNy = () => import('../routes/api/gitroot.get.mjs');
+const _lazy_1Vqvr9 = () => import('../routes/api/health.get.mjs');
 const _lazy_U4OEhz = () => import('../routes/api/input.post.mjs');
 const _lazy_PDyMr9 = () => import('../routes/api/interrupt.post.mjs');
 const _lazy_mtPGaX = () => import('../routes/api/isgit.get.mjs');
@@ -20316,6 +21082,8 @@ const _lazy_TqhtLZ = () => import('../routes/api/space.post.mjs');
 const _lazy_oeuOKk = () => import('../routes/api/state.get.mjs');
 const _lazy_ecbrXA = () => import('../routes/api/unqueue.post.mjs');
 const _lazy_AUmWqe = () => import('../routes/api/update.get.mjs');
+const _lazy_1DfWY6 = () => import('../routes/api/update.post.mjs');
+const _lazy_lxIhkr = () => import('../routes/api/update/status.get.mjs');
 const _lazy_5f22vB = () => import('../routes/api/upload.post.mjs');
 const _lazy_9iwHBL = () => import('../routes/api/worktrees.get.mjs');
 const _lazy_IA8rJi = () => import('../routes/api/worktrees/remove.post.mjs');
@@ -20360,6 +21128,7 @@ const handlers = [
   { route: '/api/efforts', handler: _lazy_7FhJOq, lazy: true, middleware: false, method: "get" },
   { route: '/api/file', handler: _lazy_Wg_MPT, lazy: true, middleware: false, method: "post" },
   { route: '/api/gitroot', handler: _lazy_kEWyNy, lazy: true, middleware: false, method: "get" },
+  { route: '/api/health', handler: _lazy_1Vqvr9, lazy: true, middleware: false, method: "get" },
   { route: '/api/input', handler: _lazy_U4OEhz, lazy: true, middleware: false, method: "post" },
   { route: '/api/interrupt', handler: _lazy_PDyMr9, lazy: true, middleware: false, method: "post" },
   { route: '/api/isgit', handler: _lazy_mtPGaX, lazy: true, middleware: false, method: "get" },
@@ -20406,6 +21175,8 @@ const handlers = [
   { route: '/api/state', handler: _lazy_oeuOKk, lazy: true, middleware: false, method: "get" },
   { route: '/api/unqueue', handler: _lazy_ecbrXA, lazy: true, middleware: false, method: "post" },
   { route: '/api/update', handler: _lazy_AUmWqe, lazy: true, middleware: false, method: "get" },
+  { route: '/api/update', handler: _lazy_1DfWY6, lazy: true, middleware: false, method: "post" },
+  { route: '/api/update/status', handler: _lazy_lxIhkr, lazy: true, middleware: false, method: "get" },
   { route: '/api/upload', handler: _lazy_5f22vB, lazy: true, middleware: false, method: "post" },
   { route: '/api/worktrees', handler: _lazy_9iwHBL, lazy: true, middleware: false, method: "get" },
   { route: '/api/worktrees/remove', handler: _lazy_IA8rJi, lazy: true, middleware: false, method: "post" },
@@ -20877,5 +21648,5 @@ setupGracefulShutdown(listener, nitroApp);
 }
 const nodeServer = {};
 
-export { recentDirsWithKinds as $, ATTACH_MAX as A, keysFor as B, parseChoices as C, parseOmpField as D, sameQuestion as E, sleep as F, getMachine as G, HerdrError as H, installClaudeStatusline as I, codexStatus as J, codexMenuOpen as K, terminalUpdateLine as L, MACHINE_KEY_RE as M, terminalUpdateDone as N, restarts as O, PANE_RE as P, log as Q, withPaneLock as R, builtinCommands as S, slashCommands as T, UPLOAD_DIR as U, HOME as V, localMachine as W, readSubs as X, vapidPublicKey as Y, pushReady as Z, machineConfigs as _, defineApi as a, quietActive as a$, installedAgentKinds as a0, IN_DOCKER as a1, HOST_OPEN_TARGET as a2, HOST_OPEN_KEY as a3, PANE_RE$1 as a4, splitId as a5, HOST_OPEN_USER as a6, listDirs as a7, closePanel as a8, setEffort as a9, initVapid as aA, herdrOn as aB, getState as aC, HERDR_CHILD_ENV as aD, HERDR_BIN as aE, currentMachineSlots as aF, paneBaseMachine as aG, projectOf as aH, isProjectThread as aI, limitMachineKeys as aJ, validLimit as aK, readThreadLimits as aL, writeThreadLimits as aM, closeTrailingMention as aN, restarting as aO, hasHeld as aP, INPUT_STATES as aQ, inputVisible as aR, shouldHold as aS, sendPrompt as aT, agentPrompt as aU, isBusyError as aV, HOLD_AGENTS as aW, pendingPrompts as aX, parseQuiet as aY, writeGlobalQuiet as aZ, writeSubs as a_, refreshModel as aa, listEfforts as ab, saveUpload as ac, underHome as ad, isSlashCommand as ae, addQueued as af, interruptAgent as ag, takeBackFromClaude as ah, takeBack as ai, isGitRepo as aj, projectFolderKinds as ak, baseMachines as al, DATA_DIR as am, renameMachine as an, readMenu as ao, searchKeys as ap, findEntry as aq, stepToward as ar, clickMovesOnly as as, setModel as at, listModels as au, TOP as av, HOST_LABEL as aw, getRequestHeaders as ax, ENV_APP_URL as ay, APP_URL_FILE as az, screenChoices as b, readGlobalQuiet as b0, validPushSubscription as b1, replaceSubscription as b2, pushSend as b3, readQuotas as b4, retryQueued as b5, parseWaitScreen as b6, settingsTabs as b7, tabsOfRow as b8, hasTranscript as b9, encodePath as bA, joinRelativeURL as bB, defineRenderHandler as bC, createError$1 as bD, destr as bE, getRouteRules as bF, relative as bG, joinURL as bH, getResponseStatusText as bI, getResponseStatus as bJ, useNitroApp as bK, nodeServer as bL, SEARCH_DEADLINE_MS as ba, SEARCH_MAX_RESULTS as bb, spaceTitle as bc, markSeen as bd, listSessions as be, openSession as bf, PANE_DIRECTIONS as bg, cancelQueued as bh, installMode as bi, updateCommand as bj, compareVersions as bk, allMachines as bl, recentDirs as bm, joinId as bn, useStorage as bo, setResponseHeader as bp, getRouterParam as bq, readUpload as br, defineWebSocketHandler as bs, eventClients as bt, getStateJson as bu, hostAllowed as bv, sameOrigin as bw, mirrorSize as bx, openTerm as by, useRuntimeConfig as bz, createAgent as c, defineEventHandler as d, watchScreen as e, findPane as f, choicesCache as g, herdr as h, getQuery as i, saveAttachment as j, auth as k, localMachineLabel as l, machineFor as m, machineOfPane as n, fmt as o, poll as p, transcripts as q, reqOf as r, sendError as s, takenBackOf as t, uploadNames as u, withoutTakenBack as v, withOmpTab as w, withSentText as x, currentModel as y, sendImage as z };
+export { recentDirsWithKinds as $, ATTACH_MAX as A, keysFor as B, parseChoices as C, parseOmpField as D, sameQuestion as E, sleep$1 as F, getMachine as G, HerdrError as H, installClaudeStatusline as I, codexStatus as J, codexMenuOpen as K, terminalUpdateLine as L, MACHINE_KEY_RE as M, terminalUpdateDone as N, restarts as O, PANE_RE as P, log as Q, withPaneLock as R, builtinCommands as S, slashCommands as T, UPLOAD_DIR as U, HOME as V, localMachine as W, readSubs as X, vapidPublicKey as Y, pushReady as Z, machineConfigs as _, defineApi as a, readGlobalQuiet as a$, installedAgentKinds as a0, IN_DOCKER as a1, HOST_OPEN_TARGET as a2, HOST_OPEN_KEY as a3, PANE_RE$1 as a4, splitId as a5, HOST_OPEN_USER as a6, listDirs as a7, closePanel as a8, setEffort as a9, herdrOn as aA, getState as aB, HERDR_CHILD_ENV as aC, HERDR_BIN as aD, currentMachineSlots as aE, paneBaseMachine as aF, projectOf as aG, isProjectThread as aH, limitMachineKeys as aI, validLimit as aJ, readThreadLimits as aK, writeThreadLimits as aL, closeTrailingMention as aM, restarting as aN, hasHeld as aO, INPUT_STATES as aP, inputVisible as aQ, shouldHold as aR, sendPrompt as aS, agentPrompt as aT, isBusyError as aU, HOLD_AGENTS as aV, pendingPrompts as aW, parseQuiet as aX, writeGlobalQuiet as aY, writeSubs as aZ, quietActive as a_, refreshModel as aa, listEfforts as ab, saveUpload as ac, underHome as ad, isSlashCommand as ae, addQueued as af, interruptAgent as ag, takeBackFromClaude as ah, takeBack as ai, isGitRepo as aj, projectFolderKinds as ak, baseMachines as al, DATA_DIR as am, renameMachine as an, readMenu as ao, searchKeys as ap, findEntry as aq, stepToward as ar, clickMovesOnly as as, setModel as at, listModels as au, TOP as av, HOST_LABEL as aw, phoneAccess as ax, phoneStatus as ay, phoneAction as az, screenChoices as b, validPushSubscription as b0, replaceSubscription as b1, pushSend as b2, readQuotas as b3, retryQueued as b4, parseWaitScreen as b5, settingsTabs as b6, tabsOfRow as b7, hasTranscript as b8, SEARCH_DEADLINE_MS as b9, useRuntimeConfig as bA, encodePath as bB, joinRelativeURL as bC, defineRenderHandler as bD, createError$1 as bE, destr as bF, getRouteRules as bG, relative as bH, joinURL as bI, getResponseStatusText as bJ, getResponseStatus as bK, useNitroApp as bL, nodeServer as bM, SEARCH_MAX_RESULTS as ba, spaceTitle as bb, markSeen as bc, listSessions as bd, openSession as be, PANE_DIRECTIONS as bf, cancelQueued as bg, installMode as bh, oneTapMode as bi, updateCommand as bj, compareVersions as bk, updateRunning as bl, allMachines as bm, recentDirs as bn, joinId as bo, useStorage as bp, setResponseHeader as bq, getRouterParam as br, readUpload as bs, defineWebSocketHandler as bt, eventClients as bu, getStateJson as bv, hostAllowed as bw, sameOrigin as bx, mirrorSize as by, openTerm as bz, createAgent as c, defineEventHandler as d, watchScreen as e, findPane as f, choicesCache as g, herdr as h, getQuery as i, saveAttachment as j, auth as k, localMachineLabel as l, machineFor as m, machineOfPane as n, fmt as o, poll as p, transcripts as q, reqOf as r, sendError as s, takenBackOf as t, uploadNames as u, withoutTakenBack as v, withOmpTab as w, withSentText as x, currentModel as y, sendImage as z };
 //# sourceMappingURL=nitro.mjs.map