Local reach

"Local reach" is how a cloud browser reaches a service on your own machine — your dev server, a LAN host — through a user-local tunnel daemon, so an agent can drive software running on your own network rather than only public sites.

The Target is a single command that installs and joins in one step. That one-command path is not yet shipped; it is tracked by ADR-035 (Local Reach Grants). This page exists to exercise the honesty system end-to-end — it documents the intended design, and its build-status marker says exactly that.

Today — manual until ADR-035 lands

The one-command path above is not built yet. You can still reach your own machine today; it just takes a few manual steps. Part 2 of the getting started guide walks the same path in context.

Reach your machine today (manual)

By default a cloud session reaches public sites only — your localhost and LAN are not reachable until you say so. There is no CLI for this yet; both options below use the /v1 API. Pick one:

Declare the host on your network — the targeted option, and it works even when org intranet mode is off. Call PATCH /v1/networks/{networkId} with a body like { "declaredHosts": ["127.0.0.1"] }. A bare host or IP allows any port; "127.0.0.1:5173" allows only that port. You can also set declaredHosts when you first POST /v1/networks.
Or turn on org-wide intranet mode, which reaches undeclared loopback and LAN hosts. Call PUT /v1/governance with { "intranetMode": true } (needs the org:admin scope).
Start a new session. The allowlist and the intranet-mode flag are read once, at session launch — a session that is already running keeps its launch-time list, so a change only takes effect in a fresh session.
Drive your service by its address, for example http://127.0.0.1:5173.

If reach is refused

If the page body reads Nightjar: host is not in the network reachability allowlist, then the host is not in declaredHosts (and intranet mode is off), or you changed the setting without starting a fresh session.