diff --git a/.lane/memory/apps/app/src/app.tsx/01M4YT6XB7NQ89E6F4P375REE7-all-projects-and-project-vie.md b/.lane/memory/apps/app/src/app.tsx/01M4YT6XB7NQ89E6F4P375REE7-all-projects-and-project-vie.md
index 918286d1..ba2cd533 100644
--- a/.lane/memory/apps/app/src/app.tsx/01M4YT6XB7NQ89E6F4P375REE7-all-projects-and-project-vie.md
+++ b/.lane/memory/apps/app/src/app.tsx/01M4YT6XB7NQ89E6F4P375REE7-all-projects-and-project-vie.md
@@ -4,9 +4,9 @@ anchor: function App
 created: 2026-10-15T03:38:04Z
 norm: '1'
 sig: 063d0f00fea02511
-body_hash: 59c41863ebaa7c91
-raw_hash: 6b011c6b27c22f32
-vouched: 2026-10-19T21:10:15Z
+body_hash: 247d8e002cbe5eea
+raw_hash: ff8ae1733758ca88
+vouched: 2026-10-22T00:00:58Z
 lines: 235-824
 ---
 
diff --git a/.lane/memory/apps/app/src/invite.ts/01M5G7R116DA7GH3PEGHY3GHDG-an-invite-link-only-fills-th.md b/.lane/memory/apps/app/src/invite.ts/01M5G7R116DA7GH3PEGHY3GHDG-an-invite-link-only-fills-th.md
new file mode 100644
index 00000000..e7ba8924
--- /dev/null
+++ b/.lane/memory/apps/app/src/invite.ts/01M5G7R116DA7GH3PEGHY3GHDG-an-invite-link-only-fills-th.md
@@ -0,0 +1,13 @@
+---
+id: 01M5G7R116DA7GH3PEGHY3GHDG
+anchor: function parse
+created: 2026-10-21T22:01:42Z
+norm: '1'
+sig: dbfd6fc52114c42f
+body_hash: 5e6861eabfa9b10e
+raw_hash: 263fdf4182735ac0
+vouched: 2026-10-21T23:56:16Z
+lines: 13-24
+---
+
+an invite link only fills the join form; joining must stay an explicit Check and join, since a link can name any directory.
diff --git a/.lane/memory/apps/app/src/invite.ts/01M5GE9M9PFM6TQP78EH33REEJ-the-invite-must-stay-in-the.md b/.lane/memory/apps/app/src/invite.ts/01M5GE9M9PFM6TQP78EH33REEJ-the-invite-must-stay-in-the.md
new file mode 100644
index 00000000..47c09324
--- /dev/null
+++ b/.lane/memory/apps/app/src/invite.ts/01M5GE9M9PFM6TQP78EH33REEJ-the-invite-must-stay-in-the.md
@@ -0,0 +1,12 @@
+---
+id: 01M5GE9M9PFM6TQP78EH33REEJ
+anchor: function link
+created: 2026-10-21T23:56:10Z
+norm: '1'
+sig: e3ff675f8b8f97f4
+body_hash: d44684f05493d6ed
+raw_hash: 5d27cd630e96e30a
+lines: 13-15
+---
+
+the invite must stay in the URL fragment so the secret never reaches the site's server
diff --git a/.lane/memory/apps/desktop/electrobun.config.ts/01M53CZ2S58V1DTJKB64V1SVRD-wkwebview-dictation-needs-ns.md b/.lane/memory/apps/desktop/electrobun.config.ts/01M53CZ2S58V1DTJKB64V1SVRD-wkwebview-dictation-needs-ns.md
index a3bdec70..7df6efc8 100644
--- a/.lane/memory/apps/desktop/electrobun.config.ts/01M53CZ2S58V1DTJKB64V1SVRD-wkwebview-dictation-needs-ns.md
+++ b/.lane/memory/apps/desktop/electrobun.config.ts/01M53CZ2S58V1DTJKB64V1SVRD-wkwebview-dictation-needs-ns.md
@@ -4,8 +4,9 @@ anchor: '@file'
 created: 2026-10-16T22:22:49Z
 norm: '1'
 sig: eb0482a0ddee93a6
-body_hash: de216f5680cfb1c1
-raw_hash: 6c0b5799010be95c
+body_hash: 6737492378c42f80
+raw_hash: da3e9e067339f0bf
+vouched: 2026-10-21T22:03:14Z
 lines: 1-42
 ---
 
diff --git a/.lane/memory/apps/desktop/electrobun.config.ts/01M5G7R10ME8H8G95ECA7MKHBE-each-build-channel-registers.md b/.lane/memory/apps/desktop/electrobun.config.ts/01M5G7R10ME8H8G95ECA7MKHBE-each-build-channel-registers.md
new file mode 100644
index 00000000..f9a12c85
--- /dev/null
+++ b/.lane/memory/apps/desktop/electrobun.config.ts/01M5G7R10ME8H8G95ECA7MKHBE-each-build-channel-registers.md
@@ -0,0 +1,12 @@
+---
+id: 01M5G7R10ME8H8G95ECA7MKHBE
+anchor: '@file'
+created: 2026-10-21T22:01:42Z
+norm: '1'
+sig: eb0482a0ddee93a6
+body_hash: 6737492378c42f80
+raw_hash: da3e9e067339f0bf
+lines: 1-45
+---
+
+each build channel registers its own scheme (ace, ace-canary, ace-dev) so a dev or Canary build never answers stable's invite links; apps/app/src/invite.ts reads all of them.
diff --git a/.lane/memory/apps/host/src/gateway-client.ts/01M4YQRMKVKT45GACS27J2TXWY-channel-listings-must-outliv.md b/.lane/memory/apps/host/src/gateway-client.ts/01M4YQRMKVKT45GACS27J2TXWY-channel-listings-must-outliv.md
index b7d44fa4..072712ea 100644
--- a/.lane/memory/apps/host/src/gateway-client.ts/01M4YQRMKVKT45GACS27J2TXWY-channel-listings-must-outliv.md
+++ b/.lane/memory/apps/host/src/gateway-client.ts/01M4YQRMKVKT45GACS27J2TXWY-channel-listings-must-outliv.md
@@ -4,9 +4,9 @@ anchor: class GatewayClient
 created: 2026-10-15T02:55:20Z
 norm: '1'
 sig: 41366b9e88f0e890
-body_hash: 127e52dea129b080
-raw_hash: 557fa94c93b713ff
-vouched: 2026-10-15T12:04:25Z
+body_hash: 0ea1b5a225ceb8b0
+raw_hash: 99b659f96ee9516e
+vouched: 2026-10-22T00:00:58Z
 lines: 33-240
 ---
 
diff --git a/.lane/memory/apps/host/src/gateway.ts/01M4YVZ6KGNQ7MFS1RP81MQCE0-a-hosted-channel-s-location.md b/.lane/memory/apps/host/src/gateway.ts/01M4YVZ6KGNQ7MFS1RP81MQCE0-a-hosted-channel-s-location.md
index c4901f86..49171b86 100644
--- a/.lane/memory/apps/host/src/gateway.ts/01M4YVZ6KGNQ7MFS1RP81MQCE0-a-hosted-channel-s-location.md
+++ b/.lane/memory/apps/host/src/gateway.ts/01M4YVZ6KGNQ7MFS1RP81MQCE0-a-hosted-channel-s-location.md
@@ -4,9 +4,9 @@ anchor: function handle
 created: 2026-10-15T04:08:49Z
 norm: '1'
 sig: e597b5fbc8e664ce
-body_hash: 1b1e7b788ab2e1af
-raw_hash: 581d53ea3cc3de56
-vouched: 2026-10-20T17:05:11Z
+body_hash: 14495715208898b4
+raw_hash: 2426d3718700367c
+vouched: 2026-10-22T00:00:58Z
 lines: 266-519
 ---
 
diff --git a/.lane/memory/apps/host/src/gateway.ts/01M4Z2BCKRNHVMYEMC0KH3Q6BN-a-hosted-channel-must-be-rea.md b/.lane/memory/apps/host/src/gateway.ts/01M4Z2BCKRNHVMYEMC0KH3Q6BN-a-hosted-channel-must-be-rea.md
index c1997c10..c843f55c 100644
--- a/.lane/memory/apps/host/src/gateway.ts/01M4Z2BCKRNHVMYEMC0KH3Q6BN-a-hosted-channel-must-be-rea.md
+++ b/.lane/memory/apps/host/src/gateway.ts/01M4Z2BCKRNHVMYEMC0KH3Q6BN-a-hosted-channel-must-be-rea.md
@@ -4,9 +4,9 @@ anchor: function handle
 created: 2026-10-15T06:00:20Z
 norm: '1'
 sig: e597b5fbc8e664ce
-body_hash: 1b1e7b788ab2e1af
-raw_hash: 581d53ea3cc3de56
-vouched: 2026-10-20T17:05:11Z
+body_hash: 14495715208898b4
+raw_hash: 2426d3718700367c
+vouched: 2026-10-22T00:00:58Z
 lines: 281-561
 ---
 
diff --git a/.lane/memory/apps/host/src/gateway.ts/01M50KBA3ME0Q9274A639MK6KJ-gateway-sockets-must-never-d.md b/.lane/memory/apps/host/src/gateway.ts/01M50KBA3ME0Q9274A639MK6KJ-gateway-sockets-must-never-d.md
index 5d9417a6..59596158 100644
--- a/.lane/memory/apps/host/src/gateway.ts/01M50KBA3ME0Q9274A639MK6KJ-gateway-sockets-must-never-d.md
+++ b/.lane/memory/apps/host/src/gateway.ts/01M50KBA3ME0Q9274A639MK6KJ-gateway-sockets-must-never-d.md
@@ -4,9 +4,9 @@ anchor: function websocket
 created: 2026-10-15T20:16:37Z
 norm: '1'
 sig: 1b462e5d3bc33728
-body_hash: 39bbd535e37f47a0
-raw_hash: c1a585dfb617245a
-vouched: 2026-10-20T17:10:51Z
+body_hash: e4839023c586ff4f
+raw_hash: cda22d4980cf5a80
+vouched: 2026-10-22T00:00:58Z
 lines: 673-737
 ---
 
diff --git a/.lane/memory/apps/host/src/gateway.ts/01M5AZZV2CRMNFXZKM0B3AWRVX-a-move-to-a-cloud-workspace.md b/.lane/memory/apps/host/src/gateway.ts/01M5AZZV2CRMNFXZKM0B3AWRVX-a-move-to-a-cloud-workspace.md
index bbceedef..8cef3bb9 100644
--- a/.lane/memory/apps/host/src/gateway.ts/01M5AZZV2CRMNFXZKM0B3AWRVX-a-move-to-a-cloud-workspace.md
+++ b/.lane/memory/apps/host/src/gateway.ts/01M5AZZV2CRMNFXZKM0B3AWRVX-a-move-to-a-cloud-workspace.md
@@ -4,9 +4,9 @@ anchor: function handle
 created: 2026-10-19T21:09:57Z
 norm: '1'
 sig: e597b5fbc8e664ce
-body_hash: 1b1e7b788ab2e1af
-raw_hash: 581d53ea3cc3de56
-vouched: 2026-10-20T17:05:11Z
+body_hash: 14495715208898b4
+raw_hash: 2426d3718700367c
+vouched: 2026-10-22T00:00:58Z
 lines: 384-700
 supersedes: 01M5APK9YCQH467YNMKAC8BT5B
 ---
diff --git a/.lane/memory/apps/host/src/gateway.ts/01M5D4BXMERGZ1EZ3EYAFM3YC4-worker-requests-worker-never.md b/.lane/memory/apps/host/src/gateway.ts/01M5D4BXMERGZ1EZ3EYAFM3YC4-worker-requests-worker-never.md
index fcef8035..72e645a1 100644
--- a/.lane/memory/apps/host/src/gateway.ts/01M5D4BXMERGZ1EZ3EYAFM3YC4-worker-requests-worker-never.md
+++ b/.lane/memory/apps/host/src/gateway.ts/01M5D4BXMERGZ1EZ3EYAFM3YC4-worker-requests-worker-never.md
@@ -4,9 +4,9 @@ anchor: '@file'
 created: 2026-10-20T17:04:56Z
 norm: '1'
 sig: 1acdc0f6a0895ac5
-body_hash: c1aca6bd21460ec9
-raw_hash: 0c4c21e9c44f3962
-vouched: 2026-10-21T23:57:08Z
+body_hash: 55717cb5cf7a6c4f
+raw_hash: 3c39fe566762d0d1
+vouched: 2026-10-22T00:09:44Z
 lines: 1-1153
 ---
 
diff --git a/.lane/memory/apps/host/src/gateway.ts/01M5GEJ78HX2MSSVN17V2PTKAS-only-the-local-app-can-answe.md b/.lane/memory/apps/host/src/gateway.ts/01M5GEJ78HX2MSSVN17V2PTKAS-only-the-local-app-can-answe.md
new file mode 100644
index 00000000..bce083dd
--- /dev/null
+++ b/.lane/memory/apps/host/src/gateway.ts/01M5GEJ78HX2MSSVN17V2PTKAS-only-the-local-app-can-answe.md
@@ -0,0 +1,12 @@
+---
+id: 01M5GEJ78HX2MSSVN17V2PTKAS
+anchor: function asksChanged
+created: 2026-10-22T00:00:52Z
+norm: '1'
+sig: 89d3d187f4a8cef0
+body_hash: 10d18a209d9cd21c
+raw_hash: a2a5da6ab853d6c9
+lines: 391-394
+---
+
+only the local app can answer an ask (team-answer is a keychain op), so asks reach local sockets only
diff --git a/.lane/memory/apps/host/src/helper.ts/01M4V5N7FNEDME70ADSQF5H00A-helpers-must-stay-first-on-t.md b/.lane/memory/apps/host/src/helper.ts/01M4V5N7FNEDME70ADSQF5H00A-helpers-must-stay-first-on-t.md
index 4f62c773..9ff035cd 100644
--- a/.lane/memory/apps/host/src/helper.ts/01M4V5N7FNEDME70ADSQF5H00A-helpers-must-stay-first-on-t.md
+++ b/.lane/memory/apps/host/src/helper.ts/01M4V5N7FNEDME70ADSQF5H00A-helpers-must-stay-first-on-t.md
@@ -4,9 +4,9 @@ anchor: '@file'
 created: 2026-10-13T17:41:10Z
 norm: '1'
 sig: 4b03c8eb05d682d4
-body_hash: c6a92431f39aeeb2
-raw_hash: ab581bbaf4052fed
-vouched: 2026-10-20T18:47:51Z
+body_hash: d49430c648b04352
+raw_hash: f4153907c9e313c2
+vouched: 2026-10-21T19:33:15Z
 lines: 1-39
 ---
 
diff --git a/.lane/memory/apps/host/src/protocol.ts/01M5GEJ77XBRPQN89DW0CKNAWP-hello-answers-any-tailnet-pe.md b/.lane/memory/apps/host/src/protocol.ts/01M5GEJ77XBRPQN89DW0CKNAWP-hello-answers-any-tailnet-pe.md
new file mode 100644
index 00000000..81affd80
--- /dev/null
+++ b/.lane/memory/apps/host/src/protocol.ts/01M5GEJ77XBRPQN89DW0CKNAWP-hello-answers-any-tailnet-pe.md
@@ -0,0 +1,12 @@
+---
+id: 01M5GEJ77XBRPQN89DW0CKNAWP
+anchor: type Hello
+created: 2026-10-22T00:00:52Z
+norm: '1'
+sig: a2275d05c454362d
+body_hash: e3b0c44298fc1c14
+raw_hash: 7276efa4e6f4c00c
+lines: 157-157
+---
+
+hello answers any tailnet peer, so team carries only the directory's host, never the secret
diff --git a/.lane/memory/apps/host/src/team.ts/01M5FZ7YE9SPKEVN8YC2WGRKEM-ace-helper-runs-wrangler-as.md b/.lane/memory/apps/host/src/team.ts/01M5FZ7YE9SPKEVN8YC2WGRKEM-ace-helper-runs-wrangler-as.md
new file mode 100644
index 00000000..c9b4710b
--- /dev/null
+++ b/.lane/memory/apps/host/src/team.ts/01M5FZ7YE9SPKEVN8YC2WGRKEM-ace-helper-runs-wrangler-as.md
@@ -0,0 +1,12 @@
+---
+id: 01M5FZ7YE9SPKEVN8YC2WGRKEM
+anchor: '@file'
+created: 2026-10-21T19:33:07Z
+norm: '1'
+sig: e3b0c44298fc1c14
+body_hash: a4c52bd75b46f573
+raw_hash: 1915cbbdad9adc90
+lines: 1-98
+---
+
+Ace Helper runs wrangler as plain Bun via BUN_BE_BUN, and deploys the bundles apps/desktop/scripts/helper.ts writes to Resources/services; both layouts must stay in step.
diff --git a/apps/app/src/app.tsx b/apps/app/src/app.tsx
index f56682dc..90b46dc7 100644
--- a/apps/app/src/app.tsx
+++ b/apps/app/src/app.tsx
@@ -44,6 +44,7 @@ import { Github, GithubSidebar } from "./github";
 import { useGithubRefresh } from "./github-cache";
 import { desktop, here, titlebar } from "./desktop";
 import { host } from "./host";
+import { type Invite, parse } from "./invite";
 import { Rename } from "./layout/rename";
 import { MoveChannel } from "./move-channel";
 import { Navigation, type Page, WindowControls } from "./navigation";
@@ -55,6 +56,8 @@ import { type AppProject, label, projects, title } from "./projects";
 import { type Section, Settings } from "./settings";
 import { SetupProject } from "./setup-project";
 import { ShareProject, useCanShare } from "./share-project";
+import { TeamAsks } from "./team-asks";
+import { TeamSetup } from "./team-setup";
 import { UpdateNotice } from "./updates";
 import { useWindowStorage } from "./window-storage";
 
@@ -298,6 +301,9 @@ export function App() {
 	const [left, setLeft] = useLocalStorage("panel:left", true);
 	const [width, setWidth] = useLocalStorage("panel:left:width", 200);
 	const [pins, setPins] = useLocalStorage<string[]>("ace:pinned-channels", []);
+	// Offered once on first run; Settings → Team opens it again.
+	const [offered, setOffered] = useLocalStorage("ace:team-setup", false);
+	const [teaming, setTeaming] = useState<boolean | "inviting" | Invite>(false);
 	const [collapsed, setCollapsed] = useState<Record<SessionSidebarGroupId, boolean>>({
 		pinned: false,
 		mine: false,
@@ -317,6 +323,38 @@ export function App() {
 		}
 		return () => window.removeEventListener("ace:updates", open);
 	}, []);
+	useEffect(() => {
+		const open = () => {
+			setSettings(false);
+			setTeaming(true);
+		};
+		const invite = () => {
+			setSettings(false);
+			setTeaming("inviting");
+		};
+		// The desktop app hands over an invite link it was opened with, as an event or, for a new
+		// window, in the hash.
+		const join = (link: string) => {
+			const invite = parse(link);
+			if (!invite) return;
+			setSettings(false);
+			setTeaming(invite);
+		};
+		const joining = (event: Event) => join((event as CustomEvent<string>).detail);
+		window.addEventListener("ace:team-setup", open);
+		window.addEventListener("ace:team-invite", invite);
+		window.addEventListener("ace:join", joining);
+		const fragment = new URLSearchParams(location.hash.slice(1)).get("join");
+		if (fragment) {
+			history.replaceState(null, "", location.pathname + location.search);
+			join(fragment);
+		}
+		return () => {
+			window.removeEventListener("ace:team-setup", open);
+			window.removeEventListener("ace:team-invite", invite);
+			window.removeEventListener("ace:join", joining);
+		};
+	}, []);
 
 	useEffect(() => {
 		const timer = setInterval(() => setNow(Date.now()), 60_000);
@@ -1028,6 +1066,19 @@ export function App() {
 						onClose={() => setSettings(false)}
 					/>
 				)}
+				{(teaming || (!offered && connected && !current)) && (
+					<TeamSetup
+						key={typeof teaming === "object" ? teaming.url : String(teaming)}
+						github={hello.github}
+						invite={typeof teaming === "object" ? teaming : undefined}
+						inviting={teaming === "inviting"}
+						onClose={() => {
+							setOffered(true);
+							setTeaming(false);
+						}}
+					/>
+				)}
+				<TeamAsks />
 				{desktop && <UpdateNotice onOpen={() => window.dispatchEvent(new Event("ace:updates"))} />}
 				<Toaster />
 			</TooltipProvider>
diff --git a/apps/app/src/directory-settings.tsx b/apps/app/src/directory-settings.tsx
index 0dd44837..806af838 100644
--- a/apps/app/src/directory-settings.tsx
+++ b/apps/app/src/directory-settings.tsx
@@ -6,6 +6,7 @@ import type { Diagnostics } from "@ace/host/protocol";
 import { desktop } from "./desktop";
 import { host } from "./host";
 import { useDiagnostics } from "./host-settings";
+import { parse } from "./invite";
 import { Confirm, Group, Page, Problem, Row, Status, Value } from "./settings-layout";
 
 const SETUP = "https://github.com/githubnext/ace/blob/main/docs/setup.md#team-directory";
@@ -204,7 +205,14 @@ function TeamDirectory(
 				label="Directory"
 				description={directory.url || (
 					<>
-						Not joined. <Setup>Set up a directory</Setup>
+						Not joined.{" "}
+						<button
+							type="button"
+							onClick={() => window.dispatchEvent(new Event("ace:team-setup"))}
+							className="rounded-sm underline outline-none hover:text-foreground focus-visible:ring-2 focus-visible:ring-ring/30"
+						>
+							Set up your team
+						</button>
 					</>
 				)}
 				footer={
@@ -237,11 +245,15 @@ function TeamDirectory(
 									autoFocus
 									type="url"
 									spellCheck={false}
-									aria-label="Directory URL"
-									placeholder="https://ace-directory.example.workers.dev"
+									aria-label="Invite link or directory URL"
+									placeholder="Invite link or https://ace-directory.example.workers.dev"
 									value={url}
 									disabled={!!action.busy}
-									onChange={(event) => setUrl(event.target.value)}
+									onChange={(event) => {
+										const invite = parse(event.target.value);
+										setUrl(invite?.url || event.target.value);
+										if (invite) setSecret(invite.secret);
+									}}
 								/>
 								<Input
 									type="password"
@@ -304,6 +316,15 @@ function TeamDirectory(
 							: "Syncing…"}
 					</Value>
 				)}
+				{directory.url && saved && !editing && (
+					<Button
+						variant="outline"
+						disabled={!!action.busy}
+						onClick={() => window.dispatchEvent(new Event("ace:team-invite"))}
+					>
+						Invite…
+					</Button>
+				)}
 				{!editing && (
 					<Button
 						variant="outline"
diff --git a/apps/app/src/invite.ts b/apps/app/src/invite.ts
new file mode 100644
index 00000000..e225b86c
--- /dev/null
+++ b/apps/app/src/invite.ts
@@ -0,0 +1,35 @@
+/**
+ * An invite link carries the team's directory URL and secret in one string a teammate can click or
+ * paste. Opening one only fills in the join form; the person still checks and joins.
+ */
+import type { Invite } from "@ace/host/protocol";
+
+export type { Invite };
+
+/**
+ * An https page, because chat apps linkify it and not `ace://`; it offers the download, then hands
+ * off to stable's `ace://join`. The invite rides in the fragment, which browsers never send.
+ */
+export const page = "https://ace.githubnext.com/join";
+
+export function link({ url, secret }: Invite): string {
+	return `${page}#${new URLSearchParams({ directory: url, secret })}`;
+}
+
+/** Reads the page's link, or a handoff in any build's scheme (ace, ace-canary, ace-dev). */
+export function parse(text: string): Invite | undefined {
+	let value: URL;
+	try {
+		value = new URL(text.trim());
+	} catch {
+		return;
+	}
+	const params = `${value.origin}${value.pathname}`.replace(/\/$/, "") === page
+		? new URLSearchParams(value.hash.slice(1))
+		: /^ace(-[a-z]+)?:$/.test(value.protocol) && value.host === "join"
+		? value.searchParams
+		: undefined;
+	const url = params?.get("directory");
+	const secret = params?.get("secret");
+	if (url && secret) return { url, secret };
+}
diff --git a/apps/app/src/team-asks.tsx b/apps/app/src/team-asks.tsx
new file mode 100644
index 00000000..0ee98ca8
--- /dev/null
+++ b/apps/app/src/team-asks.tsx
@@ -0,0 +1,62 @@
+import { useState, useSyncExternalStore } from "react";
+
+import {
+	Button,
+	Dialog,
+	DialogContent,
+	DialogDescription,
+	DialogFooter,
+	DialogHeader,
+	DialogTitle,
+} from "@ace/ui";
+
+import { host } from "./host";
+
+/**
+ * Someone on the tailnet asked to join this host's team. Approving sends them the directory URL
+ * and team secret; closing leaves the ask to expire.
+ */
+export function TeamAsks() {
+	const asks = useSyncExternalStore(host.subscribe, () => host.asks);
+	const [dismissed, setDismissed] = useState<string[]>([]);
+	const [busy, setBusy] = useState(false);
+	const [error, setError] = useState("");
+	const ask = asks.find((value) => !dismissed.includes(value.id));
+	if (!ask) return null;
+	const who = ask.github || ask.login;
+
+	async function answer(approve: boolean) {
+		setBusy(true);
+		setError("");
+		try {
+			await host.request({ op: "team-answer", ask: ask!.id, approve });
+		} catch (error) {
+			setError((error as Error).message);
+		} finally {
+			setBusy(false);
+		}
+	}
+
+	return (
+		<Dialog open onOpenChange={(next) => next || setDismissed([...dismissed, ask.id])}>
+			<DialogContent className="gap-4 sm:max-w-[28rem]">
+				<DialogHeader>
+					<DialogTitle>Let {who} join your team?</DialogTitle>
+					<DialogDescription>
+						{ask.login} on {ask.host}{" "}
+						asked from Ace. Approving sends this host's directory URL and team secret to {ask.host}
+						{" "}
+						over your tailnet.
+					</DialogDescription>
+				</DialogHeader>
+				{error && <p role="alert" className="text-xs text-destructive">{error}</p>}
+				<DialogFooter>
+					<Button variant="ghost" disabled={busy} onClick={() => void answer(false)}>
+						Deny
+					</Button>
+					<Button disabled={busy} onClick={() => void answer(true)}>Approve</Button>
+				</DialogFooter>
+			</DialogContent>
+		</Dialog>
+	);
+}
diff --git a/apps/app/src/team-setup.tsx b/apps/app/src/team-setup.tsx
new file mode 100644
index 00000000..91e9aefe
--- /dev/null
+++ b/apps/app/src/team-setup.tsx
@@ -0,0 +1,759 @@
+import { type ReactNode, useEffect, useId, useState } from "react";
+
+import {
+	Button,
+	buttonVariants,
+	Dialog,
+	DialogContent,
+	DialogDescription,
+	DialogFooter,
+	DialogHeader,
+	DialogTitle,
+	Input,
+	Switch,
+} from "@ace/ui";
+import { IconArrowUpRight, IconCheck, IconCopy, IconLoader } from "@ace/ui/icons";
+import type { TeamPeer } from "@ace/host/protocol";
+
+import { host } from "./host";
+import { useDiagnostics } from "./host-settings";
+import { type Invite as Team, link, page, parse } from "./invite";
+
+const DOCS = "https://github.com/githubnext/ace/blob/main/docs/setup.md";
+const PROVIDERS = {
+	cloudflare: { label: "Cloudflare" },
+	fly: { label: "Fly.io" },
+};
+
+// Names, URLs, and secrets are typed exactly; macOS would otherwise capitalize and correct them.
+const RAW = { autoCorrect: "off", autoCapitalize: "off", spellCheck: false } as const;
+
+type Provider = keyof typeof PROVIDERS;
+type Step = "fork" | "join" | "directory" | "remote" | "setup" | "invite" | "solo";
+const STEPS: Partial<Record<Step, string>> = {
+	directory: "Directory",
+	remote: "Remote channels",
+	setup: "Set up",
+	invite: "Invite",
+};
+
+/**
+ * First-run setup for the first person on a tailnet, or a way into the team for everyone after.
+ * Membership stays the tailnet's: this only decides where the team's channels are listed.
+ * `invite` opens on joining with an invite link's values; `inviting` opens on this team's invite.
+ */
+export function TeamSetup({ github, invite, inviting, onClose }: {
+	github?: string;
+	invite?: Team;
+	inviting?: boolean;
+	onClose: () => void;
+}) {
+	const [step, setStep] = useState<Step>(invite ? "join" : inviting ? "invite" : "fork");
+	const [starting, setStarting] = useState(true);
+	const [listed, setListed] = useState<"hosted" | "peers">("hosted");
+	const [provider, setProvider] = useState<Provider>("cloudflare");
+	const [hosted, setHosted] = useState(false);
+	const [joined, setJoined] = useState<Team>();
+	const [error, setError] = useState("");
+
+	useEffect(() => {
+		if (!inviting) return;
+		host.request<Team>({ op: "team-invite" }).then(
+			setJoined,
+			(error: Error) => setError(error.message),
+		);
+	}, [inviting]);
+
+	return (
+		<Dialog open onOpenChange={next => next || onClose()}>
+			<DialogContent className="gap-4 sm:max-w-[34rem]">
+				{STEPS[step] && !inviting && <Steps current={step} />}
+				{step === "fork" && (
+					<>
+						<Checks github={github} />
+						<Header
+							title="Set up Ace for your team"
+							description="Everyone on your tailnet is your team. Start with how they'll find each other's channels."
+						/>
+						<Nearby onJoined={onClose} />
+						<div role="radiogroup" className="flex flex-col gap-2">
+							<Choice
+								selected={starting}
+								onSelect={() => setStarting(true)}
+								title="Get your team started"
+							>
+								You're the first on this tailnet. Pick where the team's channels are listed. You can
+								change it later.
+							</Choice>
+							<Choice
+								selected={!starting}
+								onSelect={() => setStarting(false)}
+								title="Join your team"
+							>
+								Someone already set Ace up. Use the invite link they sent you.
+							</Choice>
+						</div>
+						<Footer
+							back={<Button variant="ghost" onClick={onClose}>Just me for now</Button>}
+							next={
+								<Button onClick={() => setStep(starting ? "directory" : "join")}>Continue</Button>
+							}
+						/>
+					</>
+				)}
+				{step === "join" && (
+					<>
+						<Header
+							title="Join your team"
+							description={invite
+								? "Check the directory before you join: it lists your channels for everyone who has this link."
+								: "Paste the invite link your teammate sent you, or enter the directory URL and team secret."}
+						/>
+						{!invite && <Nearby onJoined={onClose} />}
+						<Join initial={invite} onJoined={onClose} back={() => setStep("fork")} />
+					</>
+				)}
+				{step === "directory" && (
+					<>
+						<Header
+							title="Where should your team's channels be listed?"
+							description="A directory lists every channel, so they stay visible while their Mac sleeps, and lets you share projects and see who's here."
+						/>
+						<div role="radiogroup" className="flex flex-col gap-2">
+							<Choice
+								selected={listed === "hosted"}
+								onSelect={() => setListed("hosted")}
+								title={
+									<>
+										Hosted directory <Pill recommended>Recommended</Pill>
+									</>
+								}
+							>
+								Runs in your own cloud account.
+								<div className="mt-2 flex gap-1.5">
+									{(Object.keys(PROVIDERS) as Provider[]).map(id => (
+										<Button
+											key={id}
+											size="sm"
+											variant="outline"
+											aria-pressed={listed === "hosted" && provider === id}
+											className={`border ${
+												listed === "hosted" && provider === id ? "border-primary text-primary" : ""
+											}`}
+											onClick={(event) => {
+												event.stopPropagation();
+												setListed("hosted");
+												setProvider(id);
+											}}
+										>
+											{PROVIDERS[id].label}
+										</Button>
+									))}
+								</div>
+							</Choice>
+							<Choice
+								selected={listed === "peers"}
+								onSelect={() => setListed("peers")}
+								title="Peer to peer only"
+							>
+								Nothing to deploy. Teammates on the tailnet see your channels only while your Mac is
+								awake, with no shared projects, presence, or remote channels.
+							</Choice>
+						</div>
+						<Footer
+							back={
+								<>
+									<Button variant="ghost" onClick={() => setStep("fork")}>Back</Button>
+									<a
+										href={`${DOCS}#on-celld`}
+										target="_blank"
+										rel="noopener noreferrer"
+										className={buttonVariants({ variant: "link" })}
+									>
+										Host myself <IconArrowUpRight aria-hidden data-icon="inline-end" />
+									</a>
+								</>
+							}
+							next={
+								<Button onClick={() => setStep(listed === "hosted" ? "remote" : "solo")}>
+									Continue
+								</Button>
+							}
+						/>
+					</>
+				)}
+				{step === "remote" && (
+					<>
+						<Header
+							title="Allow channels that run off your Mac"
+							description="Channels run on your Mac by default. Turn on what your team may move elsewhere, now or later."
+						/>
+						<div className="flex flex-col gap-2">
+							<Toggle
+								checked={hosted}
+								onChange={setHosted}
+								title="Hosted channels"
+								description={`Chat keeps going while your Mac sleeps; tools still run on it. Adds a channel service on ${
+									PROVIDERS[provider].label
+								}.`}
+							/>
+							<Toggle
+								checked={false}
+								disabled
+								title={
+									<>
+										Cloud workspaces <Pill>Soon</Pill>
+									</>
+								}
+								description="Chat and tools run in containers from a fresh clone, billed per container minute."
+							/>
+						</div>
+						<Footer
+							back={<Button variant="ghost" onClick={() => setStep("directory")}>Back</Button>}
+							next={<Button onClick={() => setStep("setup")}>Continue</Button>}
+						/>
+					</>
+				)}
+				{step === "setup" && (
+					<Setup
+						provider={provider}
+						hosted={hosted}
+						back={() => setStep("remote")}
+						onJoined={(url, secret) => {
+							setJoined({ url, secret });
+							setStep("invite");
+						}}
+					/>
+				)}
+				{step === "invite" && (
+					<>
+						<Header
+							title={inviting ? "Invite your team" : "Your team is ready"}
+							description="Send teammates these steps."
+						/>
+						{joined
+							? <Members team={joined} />
+							: error
+							? <p role="alert" className="text-xs text-destructive">{error}</p>
+							: <p className="text-xs text-muted-foreground">Reading the invite…</p>}
+						<Footer next={<Button onClick={onClose}>Done</Button>} />
+					</>
+				)}
+				{step === "solo" && (
+					<>
+						<Header
+							title="Your team is ready"
+							description="Teammates just need to be on your tailnet and run Ace. They'll see your channels while your Mac is awake."
+						/>
+						<Invite>
+							<li>
+								Download Ace from <Link href="https://ace.githubnext.com">ace.githubnext.com</Link>
+							</li>
+							<li>
+								Get on your tailnet:{" "}
+								<Link href="https://login.tailscale.com/admin/users">invite them in Tailscale</Link>
+							</li>
+						</Invite>
+						<Footer
+							back={
+								<Button variant="ghost" onClick={() => setStep("directory")}>
+									Add a directory
+								</Button>
+							}
+							next={<Button onClick={onClose}>Done</Button>}
+						/>
+					</>
+				)}
+			</DialogContent>
+		</Dialog>
+	);
+}
+
+function Setup({ provider, hosted, back, onJoined }: {
+	provider: Provider;
+	hosted: boolean;
+	back: () => void;
+	onJoined: (url: string, secret: string) => void;
+}) {
+	const command = `bun services/deploy.ts ${provider}${hosted ? " --hosted" : ""}`;
+	// Ace deploys Cloudflare's bundled services itself; Fly.io still needs a checkout and flyctl.
+	if (provider === "cloudflare") {
+		return <Deploy hosted={hosted} command={command} back={back} onJoined={onJoined} />;
+	}
+	return (
+		<>
+			<Header
+				title="Deploy to Fly.io"
+				description={
+					<>
+						Ace deploys to Cloudflare for you. For Fly.io, run this from an Ace checkout signed in
+						to <code>fly</code>, then enter what it prints.
+					</>
+				}
+			/>
+			<Copyable value={command} />
+			<Join onJoined={onJoined} back={back} />
+		</>
+	);
+}
+
+function Deploy({ hosted, command, back, onJoined }: {
+	hosted: boolean;
+	command: string;
+	back: () => void;
+	onJoined: (url: string, secret: string) => void;
+}) {
+	const [waiting, setWaiting] = useState<string | null>(null);
+	const [busy, setBusy] = useState(false);
+	const [error, setError] = useState("");
+	const [commands, setCommands] = useState(false);
+	const stages = [
+		{ label: "Sign in to Cloudflare", from: "Checking your Cloudflare" },
+		...hosted ? [{ label: "Deploy hosted channels", from: "Deploying hosted" }] : [],
+		{ label: "Deploy the directory", from: "Deploying the directory" },
+		{ label: "Join this Mac", from: "Joining" },
+	];
+	const [stage, setStage] = useState(-1);
+
+	async function deploy() {
+		setBusy(true);
+		setError("");
+		setStage(0);
+		try {
+			const { url, secret } = await host.deployTeam(hosted, (text) => {
+				setWaiting(text);
+				const next = stages.findIndex(({ from }) => text?.startsWith(from));
+				if (next >= 0) setStage(next);
+			});
+			onJoined(url, secret);
+		} catch (error) {
+			setError((error as Error).message);
+		} finally {
+			setBusy(false);
+			setWaiting(null);
+		}
+	}
+
+	return (
+		<>
+			<Header
+				title="Deploy to Cloudflare"
+				description={
+					<>
+						Ace deploys your tailnet's services to your Cloudflare account, makes a new team secret,
+						and joins this Mac. You'll sign in to Cloudflare in your browser if you haven't before.
+						{" "}
+						<Link href={`${DOCS}#from-the-app`}>
+							What this creates <IconArrowUpRight className="inline size-3" aria-hidden />
+						</Link>
+					</>
+				}
+			/>
+			<ol className="flex flex-col gap-1.5 text-sm">
+				{stages.map(({ label }, index) => (
+					<li key={label} className="flex items-center gap-2">
+						{index < stage
+							? <IconCheck className="size-3.5 text-primary" aria-hidden />
+							: index === stage && busy
+							? <IconLoader className="size-3.5 animate-spin" aria-hidden />
+							: <span className="size-3.5 text-center text-muted-foreground">·</span>}
+						<span
+							className={index > stage || (index === stage && !busy)
+								? "text-muted-foreground"
+								: ""}
+						>
+							{index === stage && waiting || label}
+						</span>
+					</li>
+				))}
+			</ol>
+			{error && <p role="alert" className="text-xs text-destructive">{error}</p>}
+			{commands && <Copyable value={command} />}
+			<Footer
+				back={
+					<>
+						<Button variant="ghost" disabled={busy} onClick={back}>Back</Button>
+						<Button variant="link" onClick={() => setCommands(!commands)}>
+							{commands ? "Hide the command" : "Show the command"}
+						</Button>
+					</>
+				}
+				next={
+					<Button disabled={busy} onClick={() => void deploy()}>
+						{busy ? "Deploying…" : error ? "Try again" : "Deploy"}
+					</Button>
+				}
+			/>
+		</>
+	);
+}
+
+/** The invite link, with its two values for anyone who joins by hand. */
+function Members({ team }: { team: Team }) {
+	const [separate, setSeparate] = useState(false);
+	return (
+		<>
+			<Invite>
+				<li>
+					Download Ace from <Link href="https://ace.githubnext.com">ace.githubnext.com</Link>
+				</li>
+				<li>
+					Get on your tailnet:{" "}
+					<Link href="https://login.tailscale.com/admin/users">invite them in Tailscale</Link>
+				</li>
+				<li>
+					Open the invite link, or paste it into Join your team
+					<div className="mt-2 flex flex-col gap-1.5">
+						<Copyable
+							value={link(team)}
+							label={`${page.replace("https://", "")} · ${new URL(team.url).host}`}
+						/>
+						{separate && (
+							<>
+								<Copyable value={team.url} />
+								<Copyable value={team.secret} secret />
+							</>
+						)}
+					</div>
+					<Button
+						variant="link"
+						size="sm"
+						className="h-auto px-0 text-xs"
+						onClick={() => setSeparate(!separate)}
+					>
+						{separate ? "Hide the URL and secret" : "Copy the URL and secret separately"}
+					</Button>
+				</li>
+			</Invite>
+			<p className="rounded-md bg-muted px-3 py-2 text-xs leading-5">
+				<b className="font-medium">Send it privately.</b>{" "}
+				The link holds the team secret: anyone with it can read every channel's name and summary and
+				post in hosted channels.
+			</p>
+		</>
+	);
+}
+
+/** Peers' hosts already in a team; asked again while open, since a teammate may come online. */
+function useTeamPeers(): TeamPeer[] {
+	const [peers, setPeers] = useState<TeamPeer[]>([]);
+	useEffect(() => {
+		let live = true;
+		const load = () =>
+			host.request<TeamPeer[]>({ op: "team-peers" }).then(
+				(value) => live && setPeers(value),
+				() => {},
+			);
+		void load();
+		const timer = setInterval(load, 5000);
+		return () => {
+			live = false;
+			clearInterval(timer);
+		};
+	}, []);
+	return peers;
+}
+
+/** Ask a teammate's host to let this one in; their owner approves in their Ace. */
+function Nearby({ onJoined }: { onJoined: () => void }) {
+	const peers = useTeamPeers();
+	const [asking, setAsking] = useState<TeamPeer>();
+	const [error, setError] = useState("");
+	if (!peers.length) return null;
+
+	async function ask(peer: TeamPeer) {
+		setAsking(peer);
+		setError("");
+		try {
+			await host.request({ op: "team-ask", host: peer.host });
+			onJoined();
+		} catch (error) {
+			setError((error as Error).message);
+		} finally {
+			setAsking(undefined);
+		}
+	}
+
+	return (
+		<div className="flex flex-col gap-2">
+			{peers.map((peer) => (
+				<div
+					key={peer.host}
+					className="flex items-center justify-between gap-3 rounded-md border border-border/70 px-3 py-2 text-sm"
+				>
+					<span className="min-w-0">
+						<span className="font-medium">{peer.github || peer.login}</span>
+						<span className="text-muted-foreground">
+							{" "}on {peer.host} is in a team.
+						</span>
+					</span>
+					<Button
+						size="sm"
+						variant="outline"
+						disabled={!!asking}
+						onClick={() => void ask(peer)}
+					>
+						{asking === peer && <IconLoader className="size-3.5 animate-spin" aria-hidden />}
+						{asking === peer ? "Waiting…" : "Ask to join"}
+					</Button>
+				</div>
+			))}
+			{asking && (
+				<p className="text-xs text-muted-foreground">
+					{asking.github || asking.login} approves it in their Ace. You join as soon as they do.
+				</p>
+			)}
+			{error && <p role="alert" className="text-xs text-destructive">{error}</p>}
+		</div>
+	);
+}
+
+/** Today's Settings → Team join: the directory checks the secret before either is saved. */
+function Join({ initial, onJoined, back }: {
+	initial?: Team;
+	onJoined: (url: string, secret: string) => void;
+	back: () => void;
+}) {
+	const id = useId();
+	const [url, setUrl] = useState(initial?.url || "");
+	const [secret, setSecret] = useState(initial?.secret || "");
+	const [busy, setBusy] = useState(false);
+	const [error, setError] = useState("");
+
+	async function join() {
+		setBusy(true);
+		setError("");
+		try {
+			await host.request({ op: "directory-set", url, secret });
+			onJoined(url.trim(), secret.trim());
+		} catch (error) {
+			setError((error as Error).message);
+		} finally {
+			setBusy(false);
+		}
+	}
+
+	return (
+		<>
+			<form
+				id={id}
+				className="flex flex-col gap-2"
+				onSubmit={(event) => {
+					event.preventDefault();
+					void join();
+				}}
+			>
+				<Input
+					{...RAW}
+					type="url"
+					aria-label="Invite link or directory URL"
+					placeholder="Invite link or directory URL"
+					value={url}
+					disabled={busy}
+					onChange={(event) => {
+						const invite = parse(event.target.value);
+						setUrl(invite?.url || event.target.value);
+						if (invite) setSecret(invite.secret);
+					}}
+				/>
+				<Input
+					{...RAW}
+					type="password"
+					autoComplete="new-password"
+					aria-label="Team secret"
+					placeholder="Team secret"
+					value={secret}
+					disabled={busy}
+					onChange={(event) => setSecret(event.target.value)}
+				/>
+				{error && <p role="alert" className="text-xs text-destructive">{error}</p>}
+			</form>
+			<Footer
+				back={<Button variant="ghost" disabled={busy} onClick={back}>Back</Button>}
+				next={
+					<Button type="submit" form={id} disabled={busy || !url.trim() || !secret.trim()}>
+						{busy ? "Checking…" : "Check and join"}
+					</Button>
+				}
+			/>
+		</>
+	);
+}
+
+function Checks({ github }: { github?: string }) {
+	const { value } = useDiagnostics(true);
+	const tailscale = value?.tailscale;
+	return (
+		<div className="flex flex-wrap gap-x-4 gap-y-1 text-xs text-muted-foreground">
+			<Check ok={tailscale?.state === "running"}>
+				Tailscale {tailscale?.state === "running"
+					? `· ${tailscale.name}`
+					: tailscale
+					? "isn't connected"
+					: "…"}
+			</Check>
+			<Check ok={!!github}>
+				{github ? `GitHub · ${github}` : (
+					<>
+						GitHub: run <code>gh auth login</code>
+					</>
+				)}
+			</Check>
+		</div>
+	);
+}
+
+function Check({ ok, children }: { ok: boolean; children: ReactNode }) {
+	return (
+		<span className="inline-flex items-center gap-1.5">
+			{ok
+				? <IconCheck className="size-3.5 text-primary" aria-hidden />
+				: <span className="font-semibold text-warning">!</span>}
+			{children}
+		</span>
+	);
+}
+
+function Steps({ current }: { current: Step }) {
+	return (
+		<ol className="flex flex-wrap items-center gap-x-2 gap-y-1 text-xs text-muted-foreground">
+			{Object.entries(STEPS).map(([step, label], index) => (
+				<li
+					key={step}
+					className={`flex items-center gap-2 ${
+						step === current ? "font-medium text-foreground" : ""
+					}`}
+				>
+					{index > 0 && <span className="h-px w-3 bg-border" aria-hidden />}
+					{label}
+				</li>
+			))}
+		</ol>
+	);
+}
+
+function Header({ title, description }: { title: string; description: ReactNode }) {
+	return (
+		<DialogHeader>
+			<DialogTitle>{title}</DialogTitle>
+			<DialogDescription>{description}</DialogDescription>
+		</DialogHeader>
+	);
+}
+
+function Footer({ back, next }: { back?: ReactNode; next: ReactNode }) {
+	return (
+		<DialogFooter className="flex-row items-center justify-between sm:justify-between">
+			<div className="flex items-center gap-1">{back}</div>
+			{next}
+		</DialogFooter>
+	);
+}
+
+function Choice({ selected, onSelect, title, children }: {
+	selected: boolean;
+	onSelect: () => void;
+	title: ReactNode;
+	children: ReactNode;
+}) {
+	return (
+		<div
+			role="radio"
+			aria-checked={selected}
+			tabIndex={0}
+			onClick={onSelect}
+			onKeyDown={(event) => {
+				if (event.key === " " || event.key === "Enter") {
+					event.preventDefault();
+					onSelect();
+				}
+			}}
+			className={`cursor-pointer rounded-lg border bg-card px-3.5 py-3 text-left outline-none focus-visible:ring-2 focus-visible:ring-ring/30 ${
+				selected ? "border-primary ring-1 ring-primary" : ""
+			}`}
+		>
+			<div className="flex items-center gap-2 text-sm font-medium">{title}</div>
+			<div className="mt-0.5 text-xs leading-5 text-muted-foreground">{children}</div>
+		</div>
+	);
+}
+
+function Toggle({ checked, onChange, disabled, title, description }: {
+	checked: boolean;
+	onChange?: (checked: boolean) => void;
+	disabled?: boolean;
+	title: ReactNode;
+	description: string;
+}) {
+	const id = useId();
+	return (
+		<div className="flex gap-3 rounded-lg border bg-card px-3.5 py-3">
+			<Switch
+				id={id}
+				checked={checked}
+				disabled={disabled}
+				onCheckedChange={onChange}
+				className="mt-0.5"
+			/>
+			<label htmlFor={id} className={`flex flex-col gap-0.5 ${disabled ? "opacity-60" : ""}`}>
+				<span className="flex items-center gap-2 text-sm font-medium">{title}</span>
+				<span className="text-xs leading-5 text-muted-foreground">{description}</span>
+			</label>
+		</div>
+	);
+}
+
+function Pill({ recommended, children }: { recommended?: boolean; children: ReactNode }) {
+	return (
+		<span
+			className={`rounded-full px-2 text-[0.6875rem] font-medium leading-5 ${
+				recommended ? "bg-primary/15 text-primary" : "border text-muted-foreground"
+			}`}
+		>
+			{children}
+		</span>
+	);
+}
+
+function Invite({ children }: { children: ReactNode }) {
+	return (
+		<ol className="flex list-decimal flex-col gap-2 pl-5 text-sm marker:text-muted-foreground">
+			{children}
+		</ol>
+	);
+}
+
+function Link({ href, children }: { href: string; children: ReactNode }) {
+	return (
+		<a
+			href={href}
+			target="_blank"
+			rel="noopener noreferrer"
+			className="text-primary underline-offset-2 hover:underline"
+		>
+			{children}
+		</a>
+	);
+}
+
+/** `label` shows in place of a value that carries a secret. */
+function Copyable({ value, secret, label }: { value: string; secret?: boolean; label?: string }) {
+	const [copied, setCopied] = useState(false);
+	return (
+		<div className="flex min-w-0 items-center gap-2 rounded-md border bg-card py-1 pr-1 pl-3 font-mono text-xs">
+			<span className="min-w-0 flex-1 truncate">{secret ? "•".repeat(24) : label || value}</span>
+			<Button
+				size="sm"
+				variant="ghost"
+				aria-label={secret ? "Copy team secret" : label ? "Copy invite link" : "Copy"}
+				onClick={() =>
+					void navigator.clipboard.writeText(value).then(() => {
+						setCopied(true);
+						setTimeout(() => setCopied(false), 1500);
+					})}
+			>
+				{copied ? <IconCheck aria-hidden /> : <IconCopy aria-hidden />}
+			</Button>
+		</div>
+	);
+}
diff --git a/apps/desktop/electrobun.config.ts b/apps/desktop/electrobun.config.ts
index 323a85d9..244e5971 100644
--- a/apps/desktop/electrobun.config.ts
+++ b/apps/desktop/electrobun.config.ts
@@ -11,6 +11,9 @@ export default {
 		// Electrobun writes this to CFBundleVersion and version.json; the helper script moves it to
 		// CFBundleShortVersionString and sets the orderable bundle version.
 		version: current(channel).display,
+		// Invite links open the app; each channel takes its own scheme so a dev build never answers
+		// stable's links.
+		urlSchemes: [channel === "stable" ? "ace" : `ace-${channel}`],
 	},
 	build: {
 		// Electrobun's bundled runtime matches its native FFI; Ace Helper carries its own Bun.
diff --git a/apps/desktop/scripts/helper.ts b/apps/desktop/scripts/helper.ts
index 650a747b..5b156ad8 100644
--- a/apps/desktop/scripts/helper.ts
+++ b/apps/desktop/scripts/helper.ts
@@ -1,5 +1,13 @@
 import { createHash } from "node:crypto";
-import { copyFileSync, cpSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import {
+	copyFileSync,
+	cpSync,
+	mkdirSync,
+	readdirSync,
+	readFileSync,
+	rmSync,
+	writeFileSync,
+} from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -142,6 +150,25 @@ const helpers = join(contents, "Helpers");
 mkdirSync(helpers, { recursive: true });
 copyFileSync(await lane(), join(helpers, "lane"));
 
+// Ace Helper deploys the team's Cloudflare services without a checkout, so it ships them bundled.
+for (const service of ["directory", "channel"]) {
+	const source = fileURLToPath(
+		new URL(`../../../services/${service}/wrangler.jsonc`, import.meta.url),
+	);
+	const out = join(contents, "Resources", "services", service);
+	run([compiler, "x", "wrangler", "deploy", "-c", source, "--dry-run", "--outdir", out]);
+	rmSync(join(out, "index.js.map"));
+	rmSync(join(out, "README.md"));
+	const { $schema: _, ...settings } = Bun.JSONC.parse(readFileSync(source, "utf8")) as Record<
+		string,
+		unknown
+	>;
+	writeFileSync(
+		join(out, "wrangler.json"),
+		JSON.stringify({ ...settings, main: "index.js", no_bundle: true }),
+	);
+}
+
 const sdk = await sparkle();
 writeFileSync(
 	join(contents, "Resources", "Sparkle-LICENSE.txt"),
diff --git a/apps/desktop/src/index.ts b/apps/desktop/src/index.ts
index 9ecb1754..99e2841b 100644
--- a/apps/desktop/src/index.ts
+++ b/apps/desktop/src/index.ts
@@ -35,6 +35,8 @@ const windows = new Set<BrowserWindow>();
 // Menu actions, the dock, and updates go to the window the person used last.
 let focused: BrowserWindow | undefined;
 let ready = false;
+/** An invite link the app was launched with, held until Ace Helper is up. */
+let invited: string | undefined;
 
 function authorize(value: string): void {
 	if (value !== secret) throw new Error("Native controls are only available to Ace's local app");
@@ -103,6 +105,19 @@ function dispatch(target: BrowserWindow, action: string): void {
 	);
 }
 
+/** Hands an invite link to the page, which asks before joining. */
+function accept(link: string): void {
+	if (!ready) {
+		invited = link;
+		return;
+	}
+	if (!focused) return open(undefined, `join=${encodeURIComponent(link)}`);
+	focused.activate();
+	focused.webview.executeJavascript(
+		`window.dispatchEvent(new CustomEvent("ace:join", { detail: ${JSON.stringify(link)} }))`,
+	);
+}
+
 function show(action?: string): void {
 	if (!ready) return;
 	if (!focused) return open(undefined, action);
@@ -214,6 +229,9 @@ ApplicationMenu.setApplicationMenu([
 ]);
 
 Electrobun.events.on("reopen", () => show());
+Electrobun.events.on("open-url", ({ data }: { data: { url: string } }) => {
+	if (URL.parse(data.url)?.host === "join") accept(data.url);
+});
 // The webview only navigates within the app; links that open a new window go to the browser.
 Electrobun.events.on("new-window-open", ({ data }: { data: { detail: { url: string } } }) => {
 	const target = URL.parse(data.detail.url);
@@ -325,7 +343,8 @@ async function start(): Promise<void> {
 		await helper.act("start");
 	}
 	ready = true;
-	show();
+	if (invited) accept(invited);
+	else show();
 	native.start();
 	updates.start();
 }
diff --git a/apps/host/src/asks.ts b/apps/host/src/asks.ts
new file mode 100644
index 00000000..8f20d1c8
--- /dev/null
+++ b/apps/host/src/asks.ts
@@ -0,0 +1,80 @@
+/**
+ * Asking to join over the tailnet. A host that isn't in a team asks a teammate's host, and that
+ * host's owner approves in their app; the directory URL and secret then go to the asking host over
+ * WireGuard, so nobody sends them by hand. Tailscale names who is asking, and only this host's
+ * owner, from its local app, can approve.
+ */
+import type { Invite, TeamAsk } from "./protocol";
+import { invite } from "./settings";
+
+/** Long enough to notice the prompt; an unanswered ask then fails instead of waiting forever. */
+const EXPIRES = 5 * 60_000;
+
+type Waiting = {
+	ask: TeamAsk;
+	/** The asking peer's socket, so an ask ends with its connection. */
+	from: object;
+	resolve: (value: Invite) => void;
+	reject: (error: Error) => void;
+	timer: ReturnType<typeof setTimeout>;
+};
+
+const waiting = new Map<string, Waiting>();
+
+export function list(): TeamAsk[] {
+	return [...waiting.values()].map(({ ask }) => ask);
+}
+
+function end(id: string, changed: () => void) {
+	const entry = waiting.get(id);
+	if (!entry) return;
+	clearTimeout(entry.timer);
+	waiting.delete(id);
+	changed();
+	return entry;
+}
+
+/** Waits for the owner's answer; asking again from the same machine replaces the earlier ask. */
+export async function ask(
+	from: object,
+	person: { login: string; host: string; github?: string },
+	changed: () => void,
+): Promise<Invite> {
+	// Refuse before prompting anyone when there is nothing to hand over.
+	await invite();
+	for (const { ask } of waiting.values()) {
+		if (ask.login === person.login && ask.host === person.host) {
+			end(ask.id, changed)?.reject(new Error("Asked again"));
+		}
+	}
+	const id = crypto.randomUUID();
+	const expires = Date.now() + EXPIRES;
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			end(id, changed)?.reject(
+				new Error("Nobody answered in time. Ask again when they're around."),
+			);
+		}, EXPIRES);
+		waiting.set(id, { ask: { id, ...person, expires }, from, resolve, reject, timer });
+		changed();
+	});
+}
+
+export async function answer(id: string, approve: boolean, changed: () => void): Promise<void> {
+	const entry = waiting.get(id);
+	if (!entry) throw new Error("That request has ended");
+	if (!approve) {
+		end(id, changed);
+		return entry.reject(new Error("They declined. Ask them for an invite link instead."));
+	}
+	const team = await invite();
+	end(id, changed);
+	entry.resolve(team);
+}
+
+/** A peer that disconnects can't receive an approval. */
+export function drop(from: object, changed: () => void): void {
+	for (const entry of waiting.values()) {
+		if (entry.from === from) end(entry.ask.id, changed)?.reject(new Error("Disconnected"));
+	}
+}
diff --git a/apps/host/src/config.ts b/apps/host/src/config.ts
index 78e53a9a..577b2a03 100644
--- a/apps/host/src/config.ts
+++ b/apps/host/src/config.ts
@@ -18,6 +18,8 @@ export const config = {
 	webPort: process.env.ACE_WEB_PORT ? Number(process.env.ACE_WEB_PORT) : undefined,
 	peerPort: process.env.ACE_PEER_PORT ? Number(process.env.ACE_PEER_PORT) : undefined,
 	app: fileURLToPath(new URL("../../app/dist", import.meta.url)),
+	/** The team's Cloudflare services: sources in a checkout, prebuilt bundles in the app. */
+	services: fileURLToPath(new URL("../../../services", import.meta.url)),
 	appUrl: process.env.ACE_APP_URL,
 	helper: false,
 	/** Ace Helper's app version, reported by /health so a conflict can name the build on the port. */
diff --git a/apps/host/src/gateway-client.ts b/apps/host/src/gateway-client.ts
index 41c112a0..74bd2ce2 100644
--- a/apps/host/src/gateway-client.ts
+++ b/apps/host/src/gateway-client.ts
@@ -11,6 +11,7 @@ import type {
 	Project,
 	Request,
 	TabRename,
+	TeamAsk,
 	TerminalFrame,
 	WindowState,
 } from "./protocol";
@@ -61,6 +62,8 @@ export class GatewayClient {
 	channels: Listing[] = [];
 	projects: Project[] = [];
 	people: People = {};
+	/** Asks to join the team waiting for this host's owner; only the local app receives them. */
+	asks: TeamAsk[] = [];
 	/** Everyone here by project ID, while the host is connected. */
 	presence: Record<string, Presence[]> = {};
 	settingsVersion = 0;
@@ -137,6 +140,10 @@ export class GatewayClient {
 			this.projects = frame.projects;
 			return this.#emit();
 		}
+		if ("asks" in frame) {
+			this.asks = frame.asks;
+			return this.#emit();
+		}
 		if ("people" in frame) {
 			this.people = frame.people;
 			return this.#emit();
@@ -257,6 +264,14 @@ export class GatewayClient {
 		return this.#request({ op: "compute-start", channel }, { waiting });
 	}
 
+	/** Deploy and join the team's services, hearing each step; see `team-deploy`. */
+	deployTeam(
+		hosted: boolean,
+		waiting: (text: string | null) => void,
+	): Promise<{ url: string; secret: string }> {
+		return this.#request({ op: "team-deploy", hosted }, { waiting });
+	}
+
 	#request<T>(
 		request: HostRequest,
 		observe: Pick<Pending, "watch" | "waiting">,
diff --git a/apps/host/src/gateway.ts b/apps/host/src/gateway.ts
index 9ef852b6..1e8331a5 100644
--- a/apps/host/src/gateway.ts
+++ b/apps/host/src/gateway.ts
@@ -12,6 +12,7 @@ import * as compute from "./compute";
 import { config } from "./config";
 import * as demo from "./demo";
 import { diagnostics } from "./diagnostics";
+import * as asks from "./asks";
 import * as directory from "./directory";
 import { retryLoginShell, shell } from "./environment";
 import type { GatewayClient, Watch } from "./gateway-client";
@@ -51,6 +52,7 @@ import { type Machine, self, whois } from "./tailnet";
 import {
 	checkKey,
 	forgetKey,
+	invite,
 	removeKey,
 	setCompute,
 	setDirectory,
@@ -61,6 +63,7 @@ import {
 	storeKey,
 } from "./settings";
 import { resume, shutdown } from "./shutdown";
+import { deploy as deployTeam } from "./team";
 import * as terminals from "./terminals";
 import * as web from "./web";
 import * as windows from "./windows";
@@ -71,6 +74,8 @@ type Client = {
 	user: string;
 	/** Arrived over the tailnet. Peers act only on this host's channels, and never as its owner. */
 	peer: boolean;
+	/** The tailnet machine a peer connected from, as Tailscale named it. */
+	machine?: string;
 	local: boolean;
 	channels: Map<string, Promise<Connection>>;
 	/** This client's connections to peer hosts, opened when it first uses one of their channels. */
@@ -382,6 +387,12 @@ function projectsChanged(): Promise<void> {
 	});
 }
 
+/** Only the local app can answer an ask, so only it is told about them. */
+function asksChanged(): void {
+	const frame = JSON.stringify({ asks: asks.list() } satisfies HostFrame);
+	for (const socket of sockets) if (socket.data.local) socket.send(frame);
+}
+
 function settingsChanged(): void {
 	for (const socket of sockets) {
 		if (!socket.data.peer) socket.send(JSON.stringify({ settings: true } satisfies HostFrame));
@@ -443,7 +454,15 @@ async function lifecycle(
 const owned = new Set<HostRequest["op"]>(["archive", "archive-inactive", "delete", "fork"]);
 const windowOps = new Set<HostRequest["op"]>(["window", "windows", "tab-rename", "tab-result"]);
 const moveOps = new Set<HostRequest["op"]>(["move-targets", "move"]);
-const keychainOps = new Set<HostRequest["op"]>(["key-store", "key-forget", "directory-set"]);
+const keychainOps = new Set<HostRequest["op"]>([
+	"key-store",
+	"key-forget",
+	"directory-set",
+	"team-deploy",
+	"team-invite",
+	"team-ask",
+	"team-answer",
+]);
 const localOps = new Set<HostRequest["op"]>([
 	"projects",
 	"project-access",
@@ -461,6 +480,7 @@ const localOps = new Set<HostRequest["op"]>([
 	"key-check",
 	"key-remove",
 	"preferences",
+	"team-peers",
 	"compute",
 	"folder",
 	"compute-start",
@@ -567,8 +587,15 @@ async function handle(
 				updating = false;
 			}
 			return;
-		case "hello":
-			return { user: client.user, host: name, github: github.login(loginChanged) };
+		case "hello": {
+			const team = directory.url();
+			return {
+				user: client.user,
+				host: name,
+				github: github.login(loginChanged),
+				...(team ? { team: new URL(team).host } : {}),
+			};
+		}
 		case "project-access":
 			return access.describe(request.project);
 		case "project-share":
@@ -657,6 +684,24 @@ async function handle(
 		}
 		case "directory-set":
 			return setDirectory(request.url, request.secret);
+		case "team-deploy":
+			return deployTeam(request.hosted, (waiting) => send({ id, waiting }));
+		case "team-invite":
+			return invite();
+		case "team-peers":
+			return peers.teams();
+		case "team-ask": {
+			const team = await peers.ask(request.host);
+			return setDirectory(team.url, team.secret);
+		}
+		case "team-request": {
+			if (!client.peer || !client.machine) throw new Error("Ask from your own host");
+			const asker = { login: client.user, host: client.machine };
+			const login = people()[client.user];
+			return asks.ask(socket, login ? { ...asker, github: login } : asker, asksChanged);
+		}
+		case "team-answer":
+			return asks.answer(request.ask, request.approve, asksChanged);
 		case "models":
 			if (request.host && request.host !== name && !client.peer) {
 				return (await remote(client, request.host)).request({ op: "models" });
@@ -840,6 +885,9 @@ function websocket(): Bun.WebSocketHandler<Client> {
 				socket.send(JSON.stringify({ projects: await projects.list() } satisfies HostFrame));
 				socket.send(JSON.stringify({ people: people() } satisfies HostFrame));
 				socket.send(JSON.stringify({ presence: present() } satisfies HostFrame));
+				if (socket.data.local) {
+					socket.send(JSON.stringify({ asks: asks.list() } satisfies HostFrame));
+				}
 			});
 		},
 		async message(socket, raw) {
@@ -880,6 +928,7 @@ function websocket(): Bun.WebSocketHandler<Client> {
 		close(socket, code) {
 			sockets.delete(socket);
 			windows.drop(socket);
+			if (socket.data.peer) asks.drop(socket, asksChanged);
 			if (!socket.data.peer) lobbyChanged();
 			log("info", "gateway.close", { user: socket.data.user, peer: socket.data.peer, code });
 			for (const open of socket.data.channels.values()) {
@@ -891,8 +940,16 @@ function websocket(): Bun.WebSocketHandler<Client> {
 	};
 }
 
-function client(user: string, peer: boolean, local = false): Client {
-	return { user, peer, local, channels: new Map(), remotes: new Map(), terminals: new Map() };
+function client(user: string, peer: boolean, local = false, machine?: string): Client {
+	return {
+		user,
+		peer,
+		local,
+		machine,
+		channels: new Map(),
+		remotes: new Map(),
+		terminals: new Map(),
+	};
 }
 
 async function serveApp(url: URL): Promise<Response> {
@@ -985,8 +1042,9 @@ function team(machine: Machine, listener: web.Listener, tls?: Bun.TLSOptions): S
 			const ip = server.requestIP(request);
 			if (!ip) return new Response("Forbidden", { status: 403 });
 			let user: string;
+			let from: string;
 			try {
-				user = await whois(ip.address, ip.port);
+				({ login: user, host: from } = await whois(ip.address, ip.port));
 			} catch (error) {
 				log("warn", "gateway.whois", { address: ip.address, ...failure(error) });
 				return new Response("Forbidden", { status: 403 });
@@ -996,7 +1054,7 @@ function team(machine: Machine, listener: web.Listener, tls?: Bun.TLSOptions): S
 				log("warn", "gateway.browser.refused", { user, origin });
 				return new Response("Open Ace from your own host", { status: 403 });
 			}
-			return server.upgrade(request, { data: client(user, !browser) })
+			return server.upgrade(request, { data: client(user, !browser, false, from) })
 				? undefined
 				: new Response("Upgrade failed", { status: 400 });
 		},
diff --git a/apps/host/src/helper.ts b/apps/host/src/helper.ts
index 7e3ceac2..dee793f1 100644
--- a/apps/host/src/helper.ts
+++ b/apps/host/src/helper.ts
@@ -22,6 +22,7 @@ desktop(ACE_IDENTIFIER, ACE_PROFILE);
 config.helper = !cli;
 config.version = ACE_VERSION;
 config.app = join(dirname(process.execPath), "..", "Resources", "app", "web");
+config.services = join(dirname(process.execPath), "..", "Resources", "services");
 config.worker = [process.execPath, "--worker"];
 
 if (cli) {
diff --git a/apps/host/src/peers.ts b/apps/host/src/peers.ts
index fff546fa..fa34a912 100644
--- a/apps/host/src/peers.ts
+++ b/apps/host/src/peers.ts
@@ -4,7 +4,7 @@ import { isIP } from "node:net";
 import { config } from "./config";
 import { GatewayClient } from "./gateway-client";
 import { log } from "./log";
-import type { Hello, Listing, People } from "./protocol";
+import type { Hello, Invite, Listing, People, TeamPeer } from "./protocol";
 import { type Machine, peers } from "./tailnet";
 
 /** Hosts serve their tailnet listener on the same port unless told otherwise. */
@@ -139,6 +139,32 @@ export function find(channel: string): Machine | undefined {
 	}
 }
 
+/** Peers whose hosts are in a team, asked now: a peer may have joined since it first answered. */
+export async function teams(): Promise<TeamPeer[]> {
+	const found = await Promise.all(
+		[...hosts.values()].map(async ({ machine, client }) => {
+			if (client.status !== "open" || stalled.has(machine.name)) return;
+			const hello = await Promise.race([
+				client.request<Hello>({ op: "hello" }),
+				Bun.sleep(3000),
+			]).catch(() => undefined);
+			if (!hello?.team) return;
+			const peer: TeamPeer = { host: machine.name, login: machine.login, team: hello.team };
+			const github = hello.github || named[machine.login];
+			if (github) peer.github = github;
+			return peer;
+		}),
+	);
+	return found.filter((peer) => !!peer);
+}
+
+/** Waits for the peer's owner to approve; see asks.ts. */
+export function ask(name: string): Promise<Invite> {
+	const client = hosts.get(name)?.client;
+	if (client?.status !== "open") throw new Error(`${name} isn't reachable on the tailnet`);
+	return client.request<Invite>({ op: "team-request" });
+}
+
 export function machine(name: string): Machine | undefined {
 	return hosts.get(name)?.machine;
 }
diff --git a/apps/host/src/protocol.ts b/apps/host/src/protocol.ts
index c9340080..f497e372 100644
--- a/apps/host/src/protocol.ts
+++ b/apps/host/src/protocol.ts
@@ -162,7 +162,17 @@ export function isInactive(
 }
 
 /** `github` is the host owner's GitHub login, when its GitHub CLI is signed in. */
-export type Hello = { user: string; host: string; github?: string };
+/** `team` is the host of the directory this host joined, never its secret, so peers can ask to join. */
+export type Hello = { user: string; host: string; github?: string; team?: string };
+
+/** What joining a team takes: its directory URL and the team secret. */
+export type Invite = { url: string; secret: string };
+
+/** A peer whose host is in a team, which this host can ask to join. */
+export type TeamPeer = { host: string; login: string; github?: string; team: string };
+
+/** Someone on the tailnet asking this host's owner to let them into the team. */
+export type TeamAsk = { id: string; login: string; host: string; github?: string; expires: number };
 
 /** GitHub logins by participant (Tailscale login), from this host, its peers, and the directory. */
 export type People = Record<string, string>;
@@ -311,6 +321,23 @@ export type HostRequest =
 	| { op: "key-forget"; name: string }
 	/** Join after the directory accepts the URL and secret, or keep the saved secret; null leaves. */
 	| { op: "directory-set"; url: string | null; secret?: string }
+	/**
+	 * Deploy the tailnet's directory, and hosted channels with `hosted`, to the owner's Cloudflare
+	 * account, then join it. Answers with the directory URL and the secret to send teammates.
+	 */
+	| { op: "team-deploy"; hosted: boolean }
+	/** The joined directory's URL and the saved team secret, for the owner to invite a teammate. */
+	| { op: "team-invite" }
+	/** Peers whose hosts are in a team, for a host that isn't in one yet. */
+	| { op: "team-peers" }
+	/**
+	 * Ask a peer's owner to let this host into their team; on approval it answers with the
+	 * directory and secret over the tailnet, and this host joins as with `directory-set`.
+	 */
+	| { op: "team-ask"; host: string }
+	/** Sent by an asking peer host. Answers with the directory URL and secret once the owner approves. */
+	| { op: "team-request" }
+	| { op: "team-answer"; ask: string; approve: boolean }
 	/** Quiesce this helper before replacing its application, or recover a canceled update. */
 	| { op: "update-prepare" }
 	| { op: "update-cancel" }
@@ -376,6 +403,8 @@ export type HostFrame =
 	| { settings: true }
 	/** Opened projects belong to the local owner and are never sent to tailnet peers. */
 	| { projects: Project[] }
+	/** Asks to join the team that wait for the owner, sent to the local app only. */
+	| { asks: TeamAsk[] }
 	/** Sent to local clients when known GitHub logins change. */
 	| { people: People }
 	/**
diff --git a/apps/host/src/settings.ts b/apps/host/src/settings.ts
index 2c05b98d..cf9bc96f 100644
--- a/apps/host/src/settings.ts
+++ b/apps/host/src/settings.ts
@@ -7,7 +7,7 @@ import { forget, key, KEYCHAIN_WAITING, latest, overriding, settled, store } fro
 import { models, parseModel } from "./manage";
 import { canonical } from "./move";
 import { isModel, preference, saveCompute, saveFolder, savePreference } from "./preferences";
-import type { Compute, ProviderId, Settings } from "./protocol";
+import type { Compute, Invite, ProviderId, Settings } from "./protocol";
 
 const providers = new Map(
 	[
@@ -175,6 +175,14 @@ export async function forgetKey(name: string): Promise<boolean> {
 	}
 }
 
+/** What a teammate needs to join: this host's directory and the secret it was joined with. */
+export async function invite(): Promise<Invite> {
+	const url = directory.url();
+	const secret = await key("ACE_SECRET");
+	if (!url || !secret) throw new Error("Join the team's directory first");
+	return { url, secret };
+}
+
 /**
  * Join the team's directory, or leave it when `url` is null. A new secret replaces the saved
  * ACE_SECRET only after the directory accepts it; without one, the saved secret must work.
diff --git a/apps/host/src/tailnet.ts b/apps/host/src/tailnet.ts
index 15b8f862..57bf5670 100644
--- a/apps/host/src/tailnet.ts
+++ b/apps/host/src/tailnet.ts
@@ -143,15 +143,18 @@ export async function certificate(
 	return { cert, key };
 }
 
-/** The person behind an inbound TCP connection, as Tailscale verified it. Tagged nodes are refused. */
-export async function whois(ip: string, port: number): Promise<string> {
+/**
+ * The person and machine behind an inbound TCP connection, as Tailscale verified them. Tagged
+ * nodes are refused.
+ */
+export async function whois(ip: string, port: number): Promise<{ login: string; host: string }> {
 	const address = tailnet(ip);
 	if (!address) throw new Error("Not a tailnet address");
 	const endpoint = isIP(address) === 6 ? `[${address}]:${port}` : `${address}:${port}`;
 	const value = await run(["whois", "--json", "--proto=tcp", endpoint]) as {
-		Node: { Tags?: string[] };
+		Node: { Name: string; Tags?: string[] };
 		UserProfile: { LoginName: string };
 	};
 	if (value.Node.Tags?.length) throw new Error("Tagged nodes cannot participate");
-	return value.UserProfile.LoginName;
+	return { login: value.UserProfile.LoginName, host: value.Node.Name.split(".")[0] || address };
 }
diff --git a/apps/host/src/team.ts b/apps/host/src/team.ts
new file mode 100644
index 00000000..4b4e6ea7
--- /dev/null
+++ b/apps/host/src/team.ts
@@ -0,0 +1,98 @@
+/**
+ * Deploy the team's services to the person's own Cloudflare account and join the directory, so
+ * the first person on a tailnet needs no checkout. services/deploy.ts does the same from a
+ * checkout, and also deploys to Fly.io.
+ */
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+
+import { config } from "./config";
+import { key } from "./keys";
+import { setDirectory } from "./settings";
+import * as tailnet from "./tailnet";
+
+/** Matches the repository's catalog, so a source run and the app deploy with the same wrangler. */
+const WRANGLER = "wrangler@4.140.0";
+const MODEL_KEYS = ["ANTHROPIC_API_KEY", "OPENAI_API_KEY"];
+
+export type Deployed = { url: string; secret: string };
+
+export async function deploy(
+	hosted: boolean,
+	waiting: (text: string | null) => void,
+): Promise<Deployed> {
+	const domain = await tailnet.domain();
+	if (!domain) throw new Error("Connect to Tailscale first: the services serve only your tailnet.");
+	// The services serve one tailnet, so its name names them, as tail1234 in tail1234.ts.net.
+	const team = domain.split(".")[0]!.toLowerCase();
+
+	waiting("Checking your Cloudflare sign-in…");
+	if (!/logged in/i.test(await wrangler(["whoami"]))) {
+		waiting("Sign in to Cloudflare in your browser…");
+		await wrangler(["login"]);
+	}
+
+	const secret = Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString("hex");
+	const shared = { ACE_SECRET: secret, TAILNET: domain };
+	const vars: Record<string, string> = { ...shared };
+	if (hosted) {
+		waiting("Deploying hosted channels…");
+		const models: Record<string, string> = {};
+		for (const name of MODEL_KEYS) {
+			const value = await key(name);
+			if (value) models[name] = value;
+		}
+		vars.HOSTED = await worker("channel", team, { ...shared, ...models });
+	}
+	waiting("Deploying the directory…");
+	const url = await worker("directory", team, vars);
+
+	waiting("Joining this Mac to the directory…");
+	// A Worker serves its new secrets a few seconds after they're set.
+	for (let attempt = 1;; attempt++) {
+		try {
+			await setDirectory(url, secret);
+			break;
+		} catch (error) {
+			if (attempt === 12) throw error;
+			await Bun.sleep(5_000);
+		}
+	}
+	waiting(null);
+	return { url, secret };
+}
+
+async function worker(
+	service: string,
+	team: string,
+	vars: Record<string, string>,
+): Promise<string> {
+	const name = `ace-${service}-${team}`;
+	// The app ships prebuilt bundles with a wrangler.json; a source run builds from the service.
+	const dir = join(config.services, service);
+	const file = existsSync(join(dir, "wrangler.json")) ? "wrangler.json" : "wrangler.jsonc";
+	const output = await wrangler(["deploy", "-c", join(dir, file), "--name", name]);
+	const url = /https:\/\/\S+\.workers\.dev/.exec(output)?.[0];
+	if (!url) throw new Error(`Cloudflare gave no workers.dev URL for ${name}`);
+	await wrangler(["secret", "bulk", "-c", join(dir, file), "--name", name], JSON.stringify(vars));
+	return url;
+}
+
+/** Ace Helper is a compiled Bun, which runs as plain Bun with BUN_BE_BUN, so wrangler needs no Node. */
+async function wrangler(args: string[], input?: string): Promise<string> {
+	const child = Bun.spawn([process.execPath, "x", "--bun", WRANGLER, ...args], {
+		env: { ...process.env, BUN_BE_BUN: "1", WRANGLER_SEND_METRICS: "false" },
+		stdin: input === undefined ? "ignore" : new TextEncoder().encode(input),
+		stdout: "pipe",
+		stderr: "pipe",
+	});
+	const [output, error] = await Promise.all([
+		new Response(child.stdout).text(),
+		new Response(child.stderr).text(),
+	]);
+	if (await child.exited) {
+		const reason = (error || output).trim().split("\n").filter(Boolean).at(-1);
+		throw new Error(`wrangler ${args[0]} failed: ${reason}`);
+	}
+	return output;
+}
diff --git a/docs/setup.md b/docs/setup.md
index 8e60e7a2..d1d9491a 100644
--- a/docs/setup.md
+++ b/docs/setup.md
@@ -94,6 +94,29 @@ picks them up. `Settings → Team → Team services` shows which ones a host's d
 printf %s https://ace-channel.<your-subdomain>.workers.dev | bunx wrangler secret put HOSTED
 ```
 
+### From the app
+
+**Get your team started** (also under `Settings → Team`) can deploy to Cloudflare for you, with
+no checkout. **Deploy** does this, and nothing else:
+
+- Signs in with your own `wrangler login`. If you aren't signed in, it opens Cloudflare's sign-in
+  page in your browser. Ace never sees a Cloudflare password or token.
+- Creates `ace-directory-<tailnet>` in that account, named for the first label of your tailnet's
+  MagicDNS name (`tail1234` in `tail1234.ts.net`). With hosted channels on, it also creates
+  `ace-channel-<tailnet>`. Each is a Worker with SQLite-backed Durable Objects, served at
+  `https://<name>.<your-subdomain>.workers.dev`, with Workers Logs on.
+- Gives each Worker a new random team secret and your tailnet's name. The channel service also gets
+  the model keys saved in this Mac's Keychain.
+- Saves the secret in this Mac's Keychain and joins the directory. It shows the URL and the secret
+  once, for you to send teammates privately.
+
+The Workers answer only hosts on your tailnet that hold the secret. Ace changes nothing else in the
+account. To undo it, leave the directory in `Settings → Team`, then delete the Workers:
+
+```sh
+bunx wrangler delete --name ace-directory-<tailnet>   # and ace-channel-<tailnet>
+```
+
 ### On celld
 
 celld runs the same services on any machine with an S3, R2, GCS, Tigris, or Azure Blob bucket.