Local reach

"Local reach" is how a cloud browser reaches a service on your own machine — your dev server, a LAN host — through a user-local tunnel daemon, so an agent can drive software running on your own network rather than only public sites.

The one command is nightjar tunnel up <port>, and it ships. It creates (or claims) a narrow reach grant for that one port, starts the daemon in the foreground, and runs until you interrupt it. What is not yet shipped is the signed distribution — there is no installer, so the CLI is built from source today. Both halves are tracked by ADR-035 (Local Reach Grants), which is why this page's build-status marker reads partial rather than today.

The one-command path

Run this on the machine where the local service runs — the address resolves on the daemon's host, not in the cloud browser, so a daemon elsewhere cannot reach your laptop:

nightjar tunnel up 5173

That self-provisions the grant with your own key (it needs the reach:self scope and the org's allowAgentSelfReach policy). If instead an agent provisioned reach for you — it called local_reach_ensure and handed you a one-time njrg_… claim code — pass it, and the CLI authenticates as you rather than as the agent:

nightjar tunnel up 5173 --claim njrg_… --org my-org

Either way you never handle a raw join token: the join authority is injected into the daemon's process and never printed.

Or reach your machine via the API

By default a cloud session reaches public sites only — your localhost and LAN are not reachable until you say so. If you are wiring reach into your own tooling rather than running the CLI, both options below use the /v1 API directly. Pick one:

1. Declare the host on your network — the targeted option, and it works even when org intranet mode is off. Call PATCH /v1/networks/{networkId} with a body like { "declaredHosts": ["127.0.0.1"] }. A bare host or IP allows any port; "127.0.0.1:5173" allows only that port. You can also set declaredHosts when you first POST /v1/networks.
2. Or turn on org-wide intranet mode, which reaches undeclared loopback and LAN hosts. Call PUT /v1/governance with { "intranetMode": true } (needs the org:admin scope).
3. Start a new session. The allowlist and the intranet-mode flag are read once, at session launch — a session that is already running keeps its launch-time list, so a change only takes effect in a fresh session.
4. Drive your service by its address, for example http://127.0.0.1:5173.